From 421bfb800eb50f421efe5b9afc4e82e48335a095 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 15 Oct 2024 00:38:43 +0000 Subject: [PATCH] Added chart versions: codefresh/cf-runtime: - 6.4.5 dynatrace/dynatrace-operator: - 1.3.1 paravela/chronicle: - 0.1.27 redpanda/redpanda: - 5.9.7 --- assets/codefresh/cf-runtime-6.4.5.tgz | Bin 0 -> 43726 bytes assets/dynatrace/dynatrace-operator-1.3.1.tgz | Bin 0 -> 56456 bytes assets/paravela/chronicle-0.1.27.tgz | Bin 0 -> 62621 bytes assets/redpanda/redpanda-5.9.7.tgz | Bin 0 -> 409279 bytes charts/codefresh/cf-runtime/6.4.5/.helmignore | 3 + charts/codefresh/cf-runtime/6.4.5/Chart.yaml | 28 + charts/codefresh/cf-runtime/6.4.5/README.md | 1230 + .../cf-runtime/6.4.5/README.md.gotmpl | 1007 + .../cf-runtime/6.4.5/files/cleanup-runtime.sh | 37 + .../6.4.5/files/configure-dind-certs.sh | 132 + .../cf-runtime/6.4.5/files/init-runtime.sh | 80 + .../6.4.5/files/reconcile-runtime.sh | 38 + .../_components/app-proxy/_deployment.yaml | 70 + .../_components/app-proxy/_env-vars.yaml | 19 + .../_components/app-proxy/_helpers.tpl | 43 + .../_components/app-proxy/_ingress.yaml | 32 + .../_components/app-proxy/_rbac.yaml | 47 + .../_components/app-proxy/_service.yaml | 17 + .../event-exporter/_deployment.yaml | 62 + .../_components/event-exporter/_env-vars.yaml | 14 + .../_components/event-exporter/_helpers.tpl | 43 + .../_components/event-exporter/_rbac.yaml | 47 + .../_components/event-exporter/_service.yaml | 17 + .../event-exporter/_serviceMontor.yaml | 14 + .../_components/monitor/_deployment.yaml | 70 + .../_components/monitor/_env-vars.yaml | 26 + .../_components/monitor/_helpers.tpl | 42 + .../templates/_components/monitor/_rbac.yaml | 56 + .../_components/monitor/_service.yaml | 17 + .../_components/runner/_deployment.yaml | 103 + .../templates/_components/runner/_helpers.tpl | 42 + .../templates/_components/runner/_rbac.yaml | 53 + .../_init-container.yaml | 30 + .../_main-container.yaml | 28 + .../_sidecar-container.yaml | 22 + .../volume-provisioner/_cronjob.yaml | 58 + .../volume-provisioner/_daemonset.yaml | 98 + .../volume-provisioner/_deployment.yaml | 67 + .../volume-provisioner/_env-vars.yaml | 88 + .../volume-provisioner/_helpers.tpl | 93 + .../_components/volume-provisioner/_rbac.yaml | 71 + .../volume-provisioner/_secret.yaml | 22 + .../volume-provisioner/_storageclass.yaml | 47 + .../cf-runtime/6.4.5/templates/_helpers.tpl | 51 + .../6.4.5/templates/app-proxy/deployment.yaml | 9 + .../6.4.5/templates/app-proxy/ingress.yaml | 9 + .../6.4.5/templates/app-proxy/rbac.yaml | 9 + .../6.4.5/templates/app-proxy/service.yaml | 9 + .../templates/event-exporter/deployment.yaml | 9 + .../6.4.5/templates/event-exporter/rbac.yaml | 9 + .../templates/event-exporter/service.yaml | 11 + .../templates/extra/extra-resources.yaml | 6 + .../templates/extra/runtime-images-cm.yaml | 19 + .../hooks/post-install/cm-update-runtime.yaml | 18 + .../hooks/post-install/job-gencerts-dind.yaml | 68 + .../post-install/job-update-runtime.yaml | 77 + .../post-install/rbac-gencerts-dind.yaml | 37 + .../pre-delete/job-cleanup-resources.yaml | 73 + .../pre-delete/rbac-cleanup-resources.yaml | 46 + .../6.4.5/templates/monitor/deployment.yaml | 9 + .../6.4.5/templates/monitor/rbac.yaml | 9 + .../6.4.5/templates/monitor/service.yaml | 9 + .../templates/other/external-secrets.yaml | 2 + .../6.4.5/templates/other/podMonitor.yaml | 2 + .../6.4.5/templates/other/serviceMonitor.yaml | 2 + .../6.4.5/templates/runner/deployment.yaml | 9 + .../6.4.5/templates/runner/rbac.yaml | 9 + .../6.4.5/templates/runtime/_helpers.tpl | 123 + .../templates/runtime/cm-dind-daemon.yaml | 10 + .../6.4.5/templates/runtime/rbac.yaml | 48 + .../runtime/runtime-env-spec-tmpl.yaml | 214 + .../6.4.5/templates/runtime/secret.yaml | 11 + .../6.4.5/templates/runtime/svc-dind.yaml | 16 + .../templates/volume-provisioner/cronjob.yaml | 11 + .../volume-provisioner/daemonset.yaml | 11 + .../volume-provisioner/deployment.yaml | 10 + .../templates/volume-provisioner/rbac.yaml | 9 + .../templates/volume-provisioner/secret.yaml | 10 + .../volume-provisioner/storageclass.yaml | 10 + charts/codefresh/cf-runtime/6.4.5/values.yaml | 951 + .../dynatrace-operator/1.3.1/.helmignore | 25 + .../dynatrace-operator/1.3.1/Chart.yaml | 23 + .../dynatrace-operator/1.3.1/README.md | 48 + .../dynatrace-operator/1.3.1/app-readme.md | 5 + .../dynatrace-operator/1.3.1/logo.png | Bin 0 -> 9908 bytes .../dynatrace-operator/1.3.1/questions.yml | 236 + .../activegate/clusterrole-activegate.yaml | 47 + .../activegate/serviceaccount-activegate.yaml | 20 + .../Common/crd/dynatrace-operator-crd.yaml | 5783 ++++ .../templates/Common/csi/clusterrole-csi.yaml | 47 + .../1.3.1/templates/Common/csi/csidriver.yaml | 29 + .../1.3.1/templates/Common/csi/daemonset.yaml | 280 + .../templates/Common/csi/priority-class.yaml | 23 + .../1.3.1/templates/Common/csi/role-csi.yaml | 70 + .../Common/csi/serviceaccount-csi.yaml | 22 + .../edge-connect/serviceaccount-operator.yaml | 20 + .../clusterrole-kubernetes-monitoring.yaml | 114 + .../serviceaccount-kubernetes-monitoring.yaml | 20 + .../Common/oneagent/clusterrole-oneagent.yaml | 45 + .../oneagent/serviceaccount-oneagent.yaml | 21 + .../Common/operator/clusterrole-operator.yaml | 109 + .../Common/operator/deployment-operator.yaml | 111 + .../Common/operator/role-operator.yaml | 170 + .../operator/serviceaccount-operator.yaml | 20 + .../Common/webhook/clusterrole-webhook.yaml | 102 + .../Common/webhook/deployment-webhook.yaml | 138 + .../webhook/mutatingwebhookconfiguration.yaml | 58 + .../webhook/poddisruptionbudget-webhook.yaml | 11 + .../Common/webhook/role-webhook.yaml | 70 + .../templates/Common/webhook/service.yaml | 27 + .../webhook/serviceaccount-webhook.yaml | 21 + .../validatingwebhookconfiguration.yaml | 104 + .../1.3.1/templates/NOTES.txt | 10 + .../1.3.1/templates/_csidriver.tpl | 74 + .../1.3.1/templates/_helpers.tpl | 53 + .../1.3.1/templates/_labels.tpl | 102 + .../1.3.1/templates/_platform.tpl | 84 + .../1.3.1/templates/application.yaml | 98 + .../dynatrace-operator/1.3.1/values.yaml | 196 + charts/paravela/chronicle/0.1.27/.helmignore | 23 + charts/paravela/chronicle/0.1.27/Chart.lock | 9 + charts/paravela/chronicle/0.1.27/Chart.yaml | 25 + charts/paravela/chronicle/0.1.27/README.md | 76 + .../paravela/chronicle/0.1.27/app-readme.md | 12 + .../0.1.27/charts/sawtooth/.helmignore | 25 + .../0.1.27/charts/sawtooth/Chart.lock | 6 + .../0.1.27/charts/sawtooth/Chart.yaml | 10 + .../0.1.27/charts/sawtooth/README.md | 96 + .../sawtooth/charts/standard-defs/Chart.lock | 6 + .../sawtooth/charts/standard-defs/Chart.yaml | 10 + .../sawtooth/charts/standard-defs/README.md | 0 .../standard-defs/charts/common/.helmignore | 22 + .../standard-defs/charts/common/Chart.yaml | 23 + .../standard-defs/charts/common/README.md | 327 + .../charts/common/templates/_affinities.tpl | 102 + .../charts/common/templates/_capabilities.tpl | 117 + .../charts/common/templates/_errors.tpl | 23 + .../charts/common/templates/_images.tpl | 75 + .../charts/common/templates/_ingress.tpl | 55 + .../charts/common/templates/_labels.tpl | 18 + .../charts/common/templates/_names.tpl | 32 + .../charts/common/templates/_secrets.tpl | 129 + .../charts/common/templates/_storage.tpl | 23 + .../charts/common/templates/_tplvalues.tpl | 13 + .../charts/common/templates/_utils.tpl | 62 + .../charts/common/templates/_warnings.tpl | 14 + .../templates/validations/_cassandra.tpl | 72 + .../common/templates/validations/_mariadb.tpl | 103 + .../common/templates/validations/_mongodb.tpl | 108 + .../templates/validations/_postgresql.tpl | 131 + .../common/templates/validations/_redis.tpl | 76 + .../templates/validations/_validations.tpl | 46 + .../standard-defs/charts/common/values.yaml | 5 + .../standard-defs/templates/_ingress.tpl | 101 + .../charts/standard-defs/templates/_lib.tpl | 51 + .../standard-defs/templates/_lib_image.tpl | 50 + .../standard-defs/templates/_lib_volumes.tpl | 34 + .../sawtooth/charts/standard-defs/values.yaml | 1 + .../charts/sawtooth/sextant/details.yaml | 27 + .../0.1.27/charts/sawtooth/sextant/form.js | 330 + .../0.1.27/charts/sawtooth/sextant/options.js | 48 + .../0.1.27/charts/sawtooth/sextant/summary.js | 43 + .../charts/sawtooth/templates/NOTES.txt | 0 .../charts/sawtooth/templates/_sawtooth.tpl | 361 + .../templates/_sawtooth_containers.tpl | 449 + .../charts/sawtooth/templates/_utils.tpl | 16 + .../charts/sawtooth/templates/ingress.yaml | 6 + .../sawtooth/templates/peered-nodes.yaml | 30 + .../sawtooth/templates/pernode-services.yaml | 62 + .../sawtooth/templates/serviceaccount.yaml | 13 + .../templates/validator-clusterroles.yaml | 24 + .../templates/validator-env-configmap.yaml | 143 + .../sawtooth/templates/validator-roles.yaml | 30 + .../sawtooth/templates/validator-set.yaml | 67 + .../sawtooth/templates/validators-svcs.yaml | 26 + .../0.1.27/charts/sawtooth/values.yaml | 488 + .../0.1.27/charts/standard-defs/Chart.lock | 6 + .../0.1.27/charts/standard-defs/Chart.yaml | 10 + .../0.1.27/charts/standard-defs/README.md | 0 .../standard-defs/charts/common/.helmignore | 22 + .../standard-defs/charts/common/Chart.yaml | 23 + .../standard-defs/charts/common/README.md | 327 + .../charts/common/templates/_affinities.tpl | 102 + .../charts/common/templates/_capabilities.tpl | 117 + .../charts/common/templates/_errors.tpl | 23 + .../charts/common/templates/_images.tpl | 75 + .../charts/common/templates/_ingress.tpl | 55 + .../charts/common/templates/_labels.tpl | 18 + .../charts/common/templates/_names.tpl | 32 + .../charts/common/templates/_secrets.tpl | 129 + .../charts/common/templates/_storage.tpl | 23 + .../charts/common/templates/_tplvalues.tpl | 13 + .../charts/common/templates/_utils.tpl | 62 + .../charts/common/templates/_warnings.tpl | 14 + .../templates/validations/_cassandra.tpl | 72 + .../common/templates/validations/_mariadb.tpl | 103 + .../common/templates/validations/_mongodb.tpl | 108 + .../templates/validations/_postgresql.tpl | 131 + .../common/templates/validations/_redis.tpl | 76 + .../templates/validations/_validations.tpl | 46 + .../standard-defs/charts/common/values.yaml | 5 + .../standard-defs/templates/_ingress.tpl | 101 + .../charts/standard-defs/templates/_lib.tpl | 51 + .../standard-defs/templates/_lib_image.tpl | 50 + .../standard-defs/templates/_lib_volumes.tpl | 34 + .../0.1.27/charts/standard-defs/values.yaml | 1 + .../paravela/chronicle/0.1.27/questions.yaml | 130 + charts/paravela/chronicle/0.1.27/replicate.sh | 193 + .../chronicle-sawtooth-0-keys/validator.priv | 1 + .../chronicle-sawtooth-0-keys/validator.pub | 1 + .../chronicle-sawtooth-1-keys/validator.priv | 1 + .../chronicle-sawtooth-1-keys/validator.pub | 1 + .../chronicle-sawtooth-2-keys/validator.priv | 1 + .../chronicle-sawtooth-2-keys/validator.pub | 1 + .../chronicle-sawtooth-3-keys/validator.priv | 1 + .../chronicle-sawtooth-3-keys/validator.pub | 1 + .../chronicle-sawtooth-4-keys/validator.priv | 1 + .../chronicle-sawtooth-4-keys/validator.pub | 1 + .../0.1.27/secrets/exported_configmaps.yaml | 43 + .../chronicle/0.1.27/templates/_chronicle.tpl | 128 + .../chronicle/0.1.27/templates/_utils.tpl | 44 + .../templates/check_metrics_available.yaml | 23 + .../0.1.27/templates/chronicle-config.yaml | 17 + .../0.1.27/templates/chronicle-init.yaml | 228 + .../templates/chronicle-secret-volume.yaml | 12 + .../0.1.27/templates/id-provider-service.yaml | 20 + .../templates/id-provider-statefulset.yaml | 28 + .../chronicle/0.1.27/templates/ingress.yaml | 4 + .../templates/pernode-opa-tp-service.yaml | 20 + .../0.1.27/templates/pernode-tp-service.yaml | 18 + .../0.1.27/templates/secrets-roles.yaml | 28 + .../chronicle/0.1.27/templates/service.yaml | 17 + .../0.1.27/templates/serviceaccount.yaml | 12 + .../0.1.27/templates/statefulset.yaml | 218 + .../templates/test-token-getter-roles.yaml | 35 + .../0.1.27/templates/tests/api-test.yaml | 130 + .../templates/tests/auth-endpoints-test.yaml | 160 + .../0.1.27/templates/tp-service.yaml | 13 + .../0.1.27/templates/tp-statefulset.yaml | 93 + charts/paravela/chronicle/0.1.27/values.yaml | 272 + charts/redpanda/redpanda/5.9.7/.helmignore | 28 + charts/redpanda/redpanda/5.9.7/Chart.lock | 9 + charts/redpanda/redpanda/5.9.7/Chart.yaml | 38 + charts/redpanda/redpanda/5.9.7/LICENSE | 201 + charts/redpanda/redpanda/5.9.7/README.md | 1214 + .../5.9.7/charts/connectors/.helmignore | 29 + .../5.9.7/charts/connectors/Chart.yaml | 25 + .../redpanda/5.9.7/charts/connectors/LICENSE | 201 + .../5.9.7/charts/connectors/README.md | 574 + .../connectors/templates/_deployment.go.tpl | 136 + .../connectors/templates/_helpers.go.tpl | 131 + .../charts/connectors/templates/_helpers.tpl | 79 + .../connectors/templates/_pod-monitor.go.tpl | 18 + .../connectors/templates/_service.go.tpl | 20 + .../templates/_serviceaccount.go.tpl | 18 + .../charts/connectors/templates/_shims.tpl | 289 + .../connectors/templates/_values.go.tpl | 15 + .../connectors/templates/deployment.yaml | 17 + .../connectors/templates/pod-monitor.yaml | 17 + .../charts/connectors/templates/service.yaml | 17 + .../connectors/templates/serviceaccount.yaml | 17 + .../templates/tests/01-mm2-values.yaml | 176 + .../5.9.7/charts/connectors/values.yaml | 311 + .../redpanda/5.9.7/charts/console/.helmignore | 24 + .../redpanda/5.9.7/charts/console/Chart.yaml | 23 + .../redpanda/5.9.7/charts/console/README.md | 353 + .../5.9.7/charts/console/chart_test.go | 158 + .../5.9.7/charts/console/configmap.go | 61 + .../5.9.7/charts/console/deployment.go | 535 + .../console/examples/console-enterprise.yaml | 94 + .../redpanda/5.9.7/charts/console/helpers.go | 84 + .../redpanda/5.9.7/charts/console/hpa.go | 82 + .../redpanda/5.9.7/charts/console/ingress.go | 88 + .../redpanda/5.9.7/charts/console/notes.go | 67 + .../redpanda/5.9.7/charts/console/secret.go | 84 + .../redpanda/5.9.7/charts/console/service.go | 60 + .../5.9.7/charts/console/serviceaccount.go | 60 + .../5.9.7/charts/console/templates/NOTES.txt | 20 + .../console/templates/_configmap.go.tpl | 25 + .../console/templates/_deployment.go.tpl | 133 + .../charts/console/templates/_helpers.go.tpl | 82 + .../charts/console/templates/_helpers.tpl | 25 + .../charts/console/templates/_hpa.go.tpl | 25 + .../charts/console/templates/_ingress.go.tpl | 46 + .../charts/console/templates/_notes.go.tpl | 40 + .../charts/console/templates/_secret.go.tpl | 22 + .../charts/console/templates/_service.go.tpl | 20 + .../console/templates/_serviceaccount.go.tpl | 39 + .../5.9.7/charts/console/templates/_shims.tpl | 289 + .../charts/console/templates/configmap.yaml | 17 + .../charts/console/templates/deployment.yaml | 17 + .../5.9.7/charts/console/templates/hpa.yaml | 17 + .../charts/console/templates/ingress.yaml | 17 + .../charts/console/templates/secret.yaml | 17 + .../charts/console/templates/service.yaml | 17 + .../console/templates/serviceaccount.yaml | 17 + .../templates/tests/test-connection.yaml | 22 + .../testdata/template-cases-generated.txtar | 22208 ++++++++++++++ .../testdata/template-cases.golden.txtar | 24705 ++++++++++++++++ .../console/testdata/template-cases.txtar | 136 + .../redpanda/5.9.7/charts/console/values.go | 215 + .../5.9.7/charts/console/values.schema.json | 323 + .../redpanda/5.9.7/charts/console/values.yaml | 279 + .../charts/console/values_partial.gen.go | 206 + .../redpanda/5.9.7/templates/NOTES.txt | 26 + .../5.9.7/templates/_cert-issuers.go.tpl | 57 + .../redpanda/5.9.7/templates/_certs.go.tpl | 71 + .../redpanda/5.9.7/templates/_chart.go.tpl | 61 + .../5.9.7/templates/_configmap.go.tpl | 504 + .../redpanda/5.9.7/templates/_console.go.tpl | 60 + .../5.9.7/templates/_example-commands.tpl | 58 + .../redpanda/5.9.7/templates/_helpers.go.tpl | 535 + .../redpanda/5.9.7/templates/_helpers.tpl | 368 + .../redpanda/5.9.7/templates/_memory.go.tpl | 63 + .../redpanda/5.9.7/templates/_notes.go.tpl | 167 + .../templates/_poddisruptionbudget.go.tpl | 21 + .../_post-install-upgrade-job.go.tpl | 123 + .../5.9.7/templates/_post_upgrade_job.go.tpl | 87 + .../redpanda/5.9.7/templates/_rbac.go.tpl | 116 + .../redpanda/5.9.7/templates/_secrets.go.tpl | 419 + .../5.9.7/templates/_service.internal.go.tpl | 38 + .../templates/_service.loadbalancer.go.tpl | 101 + .../5.9.7/templates/_service.nodeport.go.tpl | 80 + .../5.9.7/templates/_serviceaccount.go.tpl | 18 + .../5.9.7/templates/_servicemonitor.go.tpl | 26 + .../redpanda/5.9.7/templates/_shims.tpl | 289 + .../5.9.7/templates/_statefulset.go.tpl | 725 + .../redpanda/5.9.7/templates/_values.go.tpl | 1326 + .../templates/connectors/connectors.yaml | 109 + .../console/configmap-and-deployment.yaml | 239 + .../redpanda/5.9.7/templates/entry-point.yaml | 17 + .../templates/tests/test-api-status.yaml | 52 + .../templates/tests/test-auditLogging.yaml | 86 + .../tests/test-connector-via-console.yaml | 166 + .../5.9.7/templates/tests/test-console.yaml | 49 + .../test-internal-external-tls-secrets.yaml | 122 + .../tests/test-kafka-internal-tls-status.yaml | 62 + .../templates/tests/test-kafka-nodelete.yaml | 100 + .../tests/test-kafka-produce-consume.yaml | 83 + .../tests/test-kafka-sasl-status.yaml | 79 + .../tests/test-license-with-console.yaml | 61 + .../tests/test-lifecycle-scripts.yaml | 66 + .../tests/test-loadbalancer-tls.yaml | 173 + .../templates/tests/test-nodeport-tls.yaml | 173 + .../test-pandaproxy-internal-tls-status.yaml | 81 + .../tests/test-pandaproxy-status.yaml | 72 + .../tests/test-prometheus-targets.yaml | 84 + .../templates/tests/test-rack-awareness.yaml | 61 + .../tests/test-rpk-debug-bundle.yaml | 104 + .../templates/tests/test-sasl-updated.yaml | 71 + .../redpanda/5.9.7/values.schema.json | 5848 ++++ charts/redpanda/redpanda/5.9.7/values.yaml | 1131 + index.yaml | 132 +- 353 files changed, 91284 insertions(+), 1 deletion(-) create mode 100644 assets/codefresh/cf-runtime-6.4.5.tgz create mode 100644 assets/dynatrace/dynatrace-operator-1.3.1.tgz create mode 100644 assets/paravela/chronicle-0.1.27.tgz create mode 100644 assets/redpanda/redpanda-5.9.7.tgz create mode 100644 charts/codefresh/cf-runtime/6.4.5/.helmignore create mode 100644 charts/codefresh/cf-runtime/6.4.5/Chart.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/README.md create mode 100644 charts/codefresh/cf-runtime/6.4.5/README.md.gotmpl create mode 100644 charts/codefresh/cf-runtime/6.4.5/files/cleanup-runtime.sh create mode 100644 charts/codefresh/cf-runtime/6.4.5/files/configure-dind-certs.sh create mode 100644 charts/codefresh/cf-runtime/6.4.5/files/init-runtime.sh create mode 100644 charts/codefresh/cf-runtime/6.4.5/files/reconcile-runtime.sh create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_env-vars.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_helpers.tpl create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_ingress.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_service.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_env-vars.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_helpers.tpl create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_service.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_serviceMontor.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_env-vars.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_helpers.tpl create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_service.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/_deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/_helpers.tpl create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/_rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/environment-variables/_init-container.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/environment-variables/_main-container.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/environment-variables/_sidecar-container.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_cronjob.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_daemonset.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_env-vars.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_helpers.tpl create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_secret.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_storageclass.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/_helpers.tpl create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/ingress.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/service.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/event-exporter/deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/event-exporter/rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/event-exporter/service.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/extra/extra-resources.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/extra/runtime-images-cm.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/cm-update-runtime.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/job-gencerts-dind.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/job-update-runtime.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/rbac-gencerts-dind.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/hooks/pre-delete/job-cleanup-resources.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/hooks/pre-delete/rbac-cleanup-resources.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/monitor/deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/monitor/rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/monitor/service.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/other/external-secrets.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/other/podMonitor.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/other/serviceMonitor.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/runner/deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/runner/rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/runtime/_helpers.tpl create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/runtime/cm-dind-daemon.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/runtime/rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/runtime/runtime-env-spec-tmpl.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/runtime/secret.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/runtime/svc-dind.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/cronjob.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/daemonset.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/secret.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/storageclass.yaml create mode 100644 charts/codefresh/cf-runtime/6.4.5/values.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/.helmignore create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/Chart.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/README.md create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/app-readme.md create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/logo.png create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/questions.yml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/activegate/clusterrole-activegate.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/activegate/serviceaccount-activegate.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/crd/dynatrace-operator-crd.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/clusterrole-csi.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/csidriver.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/daemonset.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/priority-class.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/role-csi.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/serviceaccount-csi.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/edge-connect/serviceaccount-operator.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/kubernetes-monitoring/clusterrole-kubernetes-monitoring.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/kubernetes-monitoring/serviceaccount-kubernetes-monitoring.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/oneagent/clusterrole-oneagent.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/oneagent/serviceaccount-oneagent.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/clusterrole-operator.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/deployment-operator.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/role-operator.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/serviceaccount-operator.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/clusterrole-webhook.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/deployment-webhook.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/mutatingwebhookconfiguration.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/poddisruptionbudget-webhook.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/role-webhook.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/service.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/serviceaccount-webhook.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/validatingwebhookconfiguration.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/NOTES.txt create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/_csidriver.tpl create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/_helpers.tpl create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/_labels.tpl create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/_platform.tpl create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/templates/application.yaml create mode 100644 charts/dynatrace/dynatrace-operator/1.3.1/values.yaml create mode 100644 charts/paravela/chronicle/0.1.27/.helmignore create mode 100644 charts/paravela/chronicle/0.1.27/Chart.lock create mode 100644 charts/paravela/chronicle/0.1.27/Chart.yaml create mode 100644 charts/paravela/chronicle/0.1.27/README.md create mode 100644 charts/paravela/chronicle/0.1.27/app-readme.md create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/.helmignore create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/Chart.lock create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/Chart.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/README.md create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/Chart.lock create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/Chart.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/README.md create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/.helmignore create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/Chart.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/README.md create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_affinities.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_capabilities.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_errors.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_images.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_ingress.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_labels.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_names.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_secrets.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_storage.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_tplvalues.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_utils.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_warnings.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_cassandra.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_mariadb.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_mongodb.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_postgresql.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_redis.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_validations.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/values.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_ingress.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_lib.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_lib_image.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_lib_volumes.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/values.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/details.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/form.js create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/options.js create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/summary.js create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/NOTES.txt create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/_sawtooth.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/_sawtooth_containers.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/_utils.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/ingress.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/peered-nodes.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/pernode-services.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/serviceaccount.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-clusterroles.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-env-configmap.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-roles.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-set.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validators-svcs.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/sawtooth/values.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/Chart.lock create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/Chart.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/README.md create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/.helmignore create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/Chart.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/README.md create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_affinities.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_capabilities.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_errors.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_images.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_ingress.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_labels.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_names.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_secrets.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_storage.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_tplvalues.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_utils.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_warnings.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_cassandra.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_mariadb.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_mongodb.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_postgresql.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_redis.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_validations.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/values.yaml create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_ingress.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_lib.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_lib_image.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_lib_volumes.tpl create mode 100644 charts/paravela/chronicle/0.1.27/charts/standard-defs/values.yaml create mode 100644 charts/paravela/chronicle/0.1.27/questions.yaml create mode 100644 charts/paravela/chronicle/0.1.27/replicate.sh create mode 100644 charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-0-keys/validator.priv create mode 100644 charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-0-keys/validator.pub create mode 100644 charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-1-keys/validator.priv create mode 100644 charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-1-keys/validator.pub create mode 100644 charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-2-keys/validator.priv create mode 100644 charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-2-keys/validator.pub create mode 100644 charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-3-keys/validator.priv create mode 100644 charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-3-keys/validator.pub create mode 100644 charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-4-keys/validator.priv create mode 100644 charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-4-keys/validator.pub create mode 100644 charts/paravela/chronicle/0.1.27/secrets/exported_configmaps.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/_chronicle.tpl create mode 100644 charts/paravela/chronicle/0.1.27/templates/_utils.tpl create mode 100644 charts/paravela/chronicle/0.1.27/templates/check_metrics_available.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/chronicle-config.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/chronicle-init.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/chronicle-secret-volume.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/id-provider-service.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/id-provider-statefulset.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/ingress.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/pernode-opa-tp-service.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/pernode-tp-service.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/secrets-roles.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/service.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/serviceaccount.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/statefulset.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/test-token-getter-roles.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/tests/api-test.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/tests/auth-endpoints-test.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/tp-service.yaml create mode 100644 charts/paravela/chronicle/0.1.27/templates/tp-statefulset.yaml create mode 100644 charts/paravela/chronicle/0.1.27/values.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/.helmignore create mode 100644 charts/redpanda/redpanda/5.9.7/Chart.lock create mode 100644 charts/redpanda/redpanda/5.9.7/Chart.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/LICENSE create mode 100644 charts/redpanda/redpanda/5.9.7/README.md create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/.helmignore create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/Chart.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/LICENSE create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/README.md create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_deployment.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_helpers.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_helpers.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_pod-monitor.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_service.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_serviceaccount.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_shims.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_values.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/templates/deployment.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/templates/pod-monitor.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/templates/service.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/templates/serviceaccount.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/templates/tests/01-mm2-values.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/connectors/values.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/.helmignore create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/Chart.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/README.md create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/chart_test.go create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/configmap.go create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/deployment.go create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/examples/console-enterprise.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/helpers.go create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/hpa.go create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/ingress.go create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/notes.go create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/secret.go create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/service.go create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/serviceaccount.go create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/NOTES.txt create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/_configmap.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/_deployment.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/_helpers.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/_helpers.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/_hpa.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/_ingress.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/_notes.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/_secret.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/_service.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/_serviceaccount.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/_shims.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/configmap.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/deployment.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/hpa.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/ingress.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/secret.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/service.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/serviceaccount.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/templates/tests/test-connection.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/testdata/template-cases-generated.txtar create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/testdata/template-cases.golden.txtar create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/testdata/template-cases.txtar create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/values.go create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/values.schema.json create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/values.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/charts/console/values_partial.gen.go create mode 100644 charts/redpanda/redpanda/5.9.7/templates/NOTES.txt create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_cert-issuers.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_certs.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_chart.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_configmap.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_console.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_example-commands.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_helpers.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_helpers.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_memory.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_notes.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_poddisruptionbudget.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_post-install-upgrade-job.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_post_upgrade_job.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_rbac.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_secrets.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_service.internal.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_service.loadbalancer.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_service.nodeport.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_serviceaccount.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_servicemonitor.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_shims.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_statefulset.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/_values.go.tpl create mode 100644 charts/redpanda/redpanda/5.9.7/templates/connectors/connectors.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/console/configmap-and-deployment.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/entry-point.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-api-status.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-auditLogging.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-connector-via-console.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-console.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-internal-external-tls-secrets.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-internal-tls-status.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-nodelete.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-produce-consume.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-sasl-status.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-license-with-console.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-lifecycle-scripts.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-loadbalancer-tls.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-nodeport-tls.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-pandaproxy-internal-tls-status.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-pandaproxy-status.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-prometheus-targets.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-rack-awareness.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-rpk-debug-bundle.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/templates/tests/test-sasl-updated.yaml create mode 100644 charts/redpanda/redpanda/5.9.7/values.schema.json create mode 100644 charts/redpanda/redpanda/5.9.7/values.yaml diff --git a/assets/codefresh/cf-runtime-6.4.5.tgz b/assets/codefresh/cf-runtime-6.4.5.tgz new file mode 100644 index 0000000000000000000000000000000000000000..0f7164aa7c803e11f9be3f2d95a9e1dab77a67f9 GIT binary patch literal 43726 zcmZ6SRa6{Zw5{>R3GNb{;O_1o+}%C6(@1a#65I&{cXxM(;O_3O-IxEI^K|Q>MvYM~ zwQKCXWX^AqM#E!4{C9!rAm~kGR9Vbq6uA_}^dP z&AruCoCIYo>>VJ^Kh9hTx&N_5b#;4V!)I5MpFAL=@h$HJB!0|cF|scPk;?MMZ6!q$ zOa@Z^*)fJfwqXBN-o?KR_N>%sWHK|D_Jlse(cIw(;Y|>i`(vKzb?PjEJY&rfC{-|f z+$0T`?hTpICue7x(37R7_9T4Ctx>*kI@=2gc52jB1T{B-O~Jyp0Oqo{w>Q8WU;$jR z_;?0j20^P|;m1vI6a-0v3Ve>560_gr5)Zt2YM_1!uF^spCqTq9@TW~wDgLB?9Jn2d z=jsurf`DM@LAlL>t04mL2>>7fs+nZDqSk?R2RtI`E;o2&%sqi3xVl&=?0II)HSyAK zGdbv36U_d@h}w1s2?tRGP1xE@B$-XvFiiW&WYEER{~)>~q0ka1Oi}-I*-fHMXY|2Y zn*e^n7yh28zs^>Ep$e*;cdw35Y0q@q9|SR({}=`7RXXDk1Ux01Py z;#M4p3rC^w2Nb+HVMdu@y!c89@3&eaajj!UWzLRAvEL{4*Hi@&TGzz80pnrnzSH>x zZc5m6_xkcDnH(J19~7w}Pki+(-H14LO1`fR=;`R((A>}_t}*labbpT(Z(^2%o64#f z9QSOH6%KHGmh0udqQp%=-__hN%U{V-#)7wWFOlZ}%Mdts;DQjJ50+6dn%x5mgJKfujw#pPt9}iP)tI zg@Jj7^MUa0@qB^kRThQ8&O>j(fQb}A)Cmzx3dCosb7GKP0sFFsNzaCP1KFHExke48?dP zER2EGvvHKi8)g`vAo(DWt<*vPT4F(}RkRRt@P zO0FejLAZT~%ZjvmxV#T!pq=Q3ZUrhGNi_`W2(fupn(~hfl)O6I(;HtQ+y61y)%qv@0XGz z7Fa{Ex=<@V6PR2Wt;iLOHN`i}z(ULu8C_jMw3>8F zLbKr6YN!|#`Vl$=*|aMG85w&C;^PWPAk$F1kIR6RUp;G3-(0U@FijnLz7M6J6mvW% z5N-f*JI&#MJwWbaJO)k}4&X}4C4$z@bUU<*SI&K82CxQPU>Nf%UhETJLf1hRH)0S< zU{V&=2vCi!A0y*u6C8Mln_0#Z=2qZP`v+C_2AN4I6XrA9d^ z$=@=K$ya4`=LBen=mDSU0enJVE|;$w@5tXtS4|J3O!4)e&fPA)a3BUkLtBq;#3I%} z<^Nc8W*o{MC8*No3#uZdVI|a<-LDMZv}W{j|xcOlaJ#s~B&T`$KUU zGG&jfwv|PDdy%|>vZu%^!9Kb+X^Yv%$tc(GUC3O~@X_buZt)F{ry|(Om?dcS+grrw z@*udfq?>Z(~#MUq~;D#^~ej`F6o(y-2kD0z{gP z8sd%#DB`11W@HfGZ&U&>lXe?*k%>#X=)Z;nkJ9?$-A52lj}t2TyjhqJCD+U)j6QFb zJZccHSIb`>3_0~~m=f&9l{|l@B1wCT3NNRvu@h|5k+BbP)oy1kV~1*6zQ^}1Vyo63L9g!$;S4&xDnW}+>_lseF3Z6(|8DpU8A4IsRq;CXqQe3{>Vr@UKVt%F%J$Xcj+f${5>)CwOjr# z>^fXMOq4tG{{n7QmJoFd(9amwUgvXH13pmO>*-(&s9#v}ivZzdlXjdmW)5fHd30|<0O;U0{g3ggISl2XL|;ea>~dDbH3U`I z6x>u>mb*K93*mYE0y@-)B?H|vtok|Msrfn?WEa{ViH{|n{*0yq9a3#}oRrLZh8YqjO18ljdsV zT&AySk!F4zwl~i8`lQ}0?*jmvt%^?Ma2{F2FICqA*8^}N#8?$NfrAZQb4M__MeJb2 z2KdK-{-shK6k*tSFFVC^FHAInRtx&b69-MTyGUYDtDhp%Ii9uA=ibmAL;D1g(H`H1 zJ0Qn=lXbDrBf-h;J1!iq!2YFsls{1UAK!yRmCnT#7yk&|n;y;k>Npf&g-@DvtO)SA zVh^SnyXf3Z9^fAX(zMM=Cb7E8&1ICm??MpaQL-_O^d3>}i4ek~!;Fuj?&izKuse!& zjrxm@%Un2{@CXKdhZDxMUYEXA_2BgoxXw_{M4cy|+^4BINoq{br zP$B`)GOgaQO*WyE+Q)zf@-r>--^o@g%y&5C%=wYTF<6NMUDyg(ijr-us90Gwf4iI-%7aZNF z>dRG(ltycfn2$sYd)gY~?F=YV5qyAVXw)VrupmNT#yzfL;>ZTWMj+`uce%u3DnEz&NBZc>k5 zt~~M>=DS61ovhQmw)g=J2S~QJie#r^5?!!b_@lqlWxwO&Vn+5W8tz=P^iON^rmHEGu`0nj7RR>vBl zw(zT-!!?@16C&TmeS5zwERm33ypx#uG`@m@+#UF(Djf|7-vCW!L?pcly|-v_h8^#% zwg%Gsk*=BbPflxB{KFQCTM7DfR#$`bz_ox}#zD&F{aTbk527t@0|D0w)*&-oIr;8V zVWd3$^NM%&EtCD?r<$!_PI+Hf*~lSB0ypuze|*Gh%SA>`J{K-%)XN}byQn=9ho~Nv z^?~6TrfVZylWU2iT@LhXN>RLfncmUo@+`Gwjk9p_wqUv+n5SN(bYm2UAB?(H&ao|X zR&$@0-(8e4@&58u!j|GzixT=k)~;um9F;)A;)7UCZG|Cvj?Cd`>(jqG2G+r_B$bWa z-npsdZVTrVBPaBKODjq@fZx!CB--rp-U&vMTVV<|WcjIv)H)u`Xg`wy`+FxQ4_2~e zp)Zk*D28K%tY0~NAvc_hviFA+B3YV_fX1u*SFS~Kfas4bOLIF`%9jgh7~swVZ`Y&gkO}(d{HRw2w8tt+`LxLNczQ!7TE$dx(Mn{1l3H5Xx*|8idv#+q*XtBJ;^By*q zw(dgN$KS0s2pDZQ+tAKq(4(ubFi<;` z58WPXgpvuFsVl<(q0^HDbeq;lglnYabM8;;Yn^2B7q}9+AryY!EE?j+SK^)J9j$6 zG9XgEJwpQq*$wxq+>2^{`2#^fw? zGRy1WE?PA4D$FN3dK)OR`PEx7@832_gJ>OT2TK2u9ff_M6=Ff^aiSP^<5Mn0h0dtFkXzL` zav}>00#ii)a$cO@F*zElitYMCHrJ`$;wDPphhA=WX)M9WB%f4n%^KwW0O-Cil6e^U zABNhgk@#ExUi9Lchtsl6Y-Zw$;>iI`{T!`NdnlIBPqe34Z03Kk&aJ zThI~Bj=M}l5xy#BCYbiei69sb9Fy!xcJ#!Ek*jm*%)z{4eUYbo>c2H5q4_J_D1AyL zhMv$Z$(<*m~8pYyEP&FA~)&tSt~4 zvXG{;$8!!x^c=qWO6?|_dRqiW3I@HehaliK3^XW4=sr6sK4>IzGBKP;>fbLm1B%5)Y^7eZ2> zzJ)FrYGV4u!8r*qGf#6kxpJd&MtG8jDc)yeWKj@0wm&dCFzYBFXUZMoo(k?B+QVM zOB)Z!t*C%{(n(>2Fo(3kycz@~*}cCyvGy)vWFOp;K{E)Hu@rFow5aAY0y>c2jbpJ{ zHY=eK&fS4tvlmC=cq-6u4WDPR=+A(x6^nhgVHPvNY67cNkV*S`Op7Mx%8j%p(Dx-O znyeW2>h613SM*WFRE3IJc!{o}*s(|3#lI=uklRz2lk*?j4+>LJ{%W&7W`xdixBwR> zZ|{Y!IXVl{+{=TppE?YS#(3rCb;;xI;I;eF)`cPTdr}ouOdY`tzBtwQ+=j&8%mpL` zX~a_LZPl%*l(a;-+^P z!R6}@mfN9>mHL^y5t=R3=H{5{--d5M!=|^8ojljYt`?$e>c{d(E&bIpL~O3;aq+=l(AEKI2d1N3s{e zkSq*CQi}V-t+oLK(sjbsEv{8WCai6MC zw&u&c#bxPnF?d(8{>H&*5!fq@WHYn_L%s%*5%I zY~=&@VPf7knU+Zl#Qw5WE@ zniFkv-hRnu*-xqx=b!Fq<+0-yp-Ovg-Qx($L6IeMJXj>Af!&7;iz5DY(GyEQamsuE zU0Lm#BnD&|;Xj;EB|0iR^gO{Nzgbpt^9|;V&4RQfd7Up&f6jzqyZd%)f<5@Cs7+n- zA@!FW_D)LC;a8Bn(^t`gR;iwzzc)rrgF~&5-&ktsliJ>~rYcjuHCepg#=_92F=(PE zcJ>M#!}8LP(t1K4nXvBPJn4U@i$b4o(|>DqT>NF2Aq=)(EL#}L=er)m3^n0JMc@3U z?FrnhMtVSf-xm)qnn4o7_CCS4e(jp2dj2QinBa=G(i)z3wUg-fFaInly;{1oIA?&=PjU zpb5Fr8Z-kqeHAr!tkQIT?RL3c8v6XNg0Tu7xOk8f5lD~ES;u+$C4*bN zOt;uNlWo^KHOS>Qew10B22D`d?)GeSEfsq-=kVo|!g-XogxuTuggmP8ym zW%FVYoK|P5B_%({&n1xmtV1cUw+KP)ws23i9F$W@a4S;SJqycR#fkgTpd$pGjW@pXc z(X5hu$D*?F2=cOU>GJ&0l7OKC0Pnqp88eDrC*^|zbzTUh)l{l_KtS*Jf9Yvuf9NQ3 z8_+~12CQAWLDPK(bf4vHuK&0U(QZZytxDtWV1i=Z<_{OTIl8$BN0bs?ImR+O6d$nTWbS}zv4?4eNN`F3A zK{)MfT58bEf&6C;eqA7FdxIASy>-!l!bq8SgLI8>8;njHj*c1&79BSRc%#0Xgi7y3b7_S~;Fg}6C%WG; z?>F&SC5#(lPDU^Q8`54u7_m=tDr2nOn{g;k;n-*Z=ubDHOqe^bw9;Qma zZpWV?NAWG$WxFe{u>iJm<8*o(H;zaVReGmrK374Vo)TP14i>*!+>U$HL`Lsm0KM%5 z2z~`GJ;k9m-GZrAo8EIWs|>Gd8Ab)`&XrJ$x^gvVqYk(C^To zj2(#6@^7G{Z~lzsZD`(JyVnb3tTp_SgZK{CI>XX1%J}^&u{EgSwwx`mU#!G6^K*Io zzB1oC_Cu-349%dEYU6|6c5yIBu5iz&(sn=ki&XjrZyj>%%9;iF={>9azdLFcY=M{sAZ-W;% zaON{*Ea!{OTm7#?DeD}WF0zJgwoH{l!3B}Au6=&=+&2ChKY2ockm%x0c(y^9kQJoQ zHD=SLw?aSq#z!x(6)AHIoMcFS+px6Kcu6_;q&2>~g|rKLhzYi{)?1Io%MrWgQddVJ zi2341jK}~L%3J7@6+^q+nuDYaapbR=;>-A$-)Wb^SD^ju>poV%cFjC39@#U21B)YV zXxbjQo*-tYk!V*|!=IS#DqYH;`?FlNQ1-70j%q^H#dxY}SEyK_n~Vu2iCD_s?|D7O z9{S2%UFhy*2F0q1ea5CAGtGD(4N9Zm^>hmrqHx&$laL@~M%Cgb5xd75#z57DN7!*d`Dq~YY2!Y~2la?tbZ~Tz^Zf7^W#XsYCDm6yN4KGFxvQNR_MViIVuhHcGdWab43U z{(|r)v{(p}Vyqja%5KLTYm1-8IF4&LgI-9DDM)EBiHS8L{C7$(c%G>G^z>5OS5`tz z3#H8Kc}8v%sWsoh=$w^)e8f6tcz>>%S}Zq0cSiz~wW4rTVcyg-cXv`DxF_z~^yn!~ zNkfOqvS)Vcb=5-TFOgOZVj6jqxYcQUe7C&CzXE3R*5%s1Z#jAl>>U(xmeo8Tdy(bI zYONxx++025r>DBzw3U6}R?*3_iSC}4s~SzkYw)Uxzb|M_Mt2Cjl2%P^LtT-=7F!r~ ziHzi^dgYRuTdPdj<{Gya`dDm&C(CxriH)xOUB0`OwqA^Op3BbgWJ`?lh&i;#hK6Xi6!a0KYd2+<} z0grp8R0n02$~y44Xxr7D(ZlsItv_gO73@ICxCTB*E1m|9R(?2F-v0E@-p|Q)lx6Ri z#ovCuO-Ote{SoMJ&efB*kQ`_ICskpNfyVK7bC}7xXt066V~MoQ$!nZ2yY4u=SNez3 z#WqVV2(9c*dhMY*valNb{2jO;)e~8Tb;KJPWt7hQ1L`fj5y3FO_G*=dN3z&yfsbcT z^4s&N;!j34OB$sR-vH6gWsw}jx@UP2%WH8+v)uvY7MkeYXK4F)u5X}L%}OUlmFA+7 zILD~hWw9x)gQDaEFlS6)>IV2yOYI7bYP(SR-W}N>0%A6X$+AMxgIDc)e`2a3S?lnS z9ILc6YiDC^4r^Ld=ct?jFR?%w+Jg0zZ@{ZNDPSkcN;7b#v5Y4t)US{=U8o~Hs3Y6P zOG{M0BS>v~%&Y=cdRx2+{{<>_q;f(iW);m!Ta*suQr}t-V;)aiJHn5yA~!q0J8@z1 z)8`lUq+Eaj5Bnd=A3xqeuI!~VAJb-dLD)+fTQ5vUrI{foOk};Jh9ay% z8g+-Fu}9DTpl&T(5o?v8*=4sk6(O=!reTG}qg+_Mmc_m$qZYd__1+26uXOt83{V6a zGLmZe?Z@tI)eX7WS+;Z5F95D>GFNa?!AlPy-5$^p*#Wq?X#wm&Z7~XlMHYU$*lbrS z7Zh;HX+%QU?lWMpN_JW;wt8dBT6`IF_Vt=2c4L})L;21XQ~F>NVPG|K1sjI-fdb?$ z0r{yz>8q_4xbY;cj6Aka zYWntOD=r@VJv{i-Kvl1H8wC9pc!e*sa!0;Scg4^P6~#H6>A59WSnlij5ja))HlKi0 zZ$5wqSKZ@J;8m45P_c(w%fkO|&T_8>0~BEKsgQ}?O{UdNW=heeQhDa<;R(al^qv!wqbJ9+L7_rN`(LLpbC3*mSKQ=%6P?1~6WF~|m}vw2bawL5 z9nkOqZb@i(23@ft1CiECDuAg^^NRkt!AHY@7BPd_vpvJ6?%~1OS_?9J!+LFYArBV; zc^sS3Atp?MFOPL=KXajuYkTuN&&;WRj6YqWKGJ2X3kx2lqnYT`RNc7e>m4;#R9y`O zYLc%l3cb-4?%r;-Z3-hjg9ZE&I>4oi%^+d!M4WNplg0B#pr#Jm{)?L7DKpCrlPN)R z!$p8kmfguK4g0j-zpG+7`9*N_hwbUd5op%q!-?|b%n12G%K=2!{yl4Y1kot{rg-4h z#6cK|M@zNBGuQ|;MbrCb=JVO=l!c`<{5i>Gp z_KcV365BD>C|S^Rx&BeC*%#RKct-kb)NWtQHm3(7N&0*mv7fF@FD=QPu-lf^PMx(C zd9z)EQB_SoK|GQHwegSqB=%kjGY7#0_g9?k7XrozSDNX%gtZv_oAJ}}O8lE8b18xU z1QWKH2(!H`%?ZK#RfB~po;9u))WxCK4Jem9hlKksygE!SO#6MYK{L{ndRo85BNkS8 zWvfiN*&9b+4Gu@o^(w49K<+<8oMx!f7T^n5A^;`>k~+G1+md4x@k>SyMMl(Us?ihOIq3% zjD9tpf?`0oEbRr8TTqOu9Gj91PV=BNu6KEQ$<)=4(MnBS5S1uy6KI@0+}pmYS@9e8 zCU}V(tk(u6C8pj2FMP({k1eUWzPH?A7O-BGhSA$+s3Qb#6o*XvcEjt<{)}5&6a-j! zSc-528j}6;ZL-U^=~^%t%evzIPoAkTUa&HA`Z=UFessZ%Oh#g?@by*GUu*y`KEH}Qaf*oJcZBY^QoFz(yvGbuA_ z(~S}L@3}W{F#m81S|B&B)dgG$jGFM%*C&^VQNSzB#hqxFR?y$-?Ml`+_M0@&r!@Ej zt@?yYvod<`@yxItEYti?nhv?C}d0MQgo>zY?jlu-CHo*6vgp+8bCJcHHv4SRy+JSa#MvQV(OET?An+QGqgNMd zFO5)M^E*imI@I@9`_BbDd6IicB~0@KU$@M7r;>ZJUzky{$e!!qVw~H{4)7A%@5fwb zRNJ)=AO+ptyOHr3Zu{iQpmRGUUk*nX)5BVEb@=eb<;mb%{SQLrt3>_&s*Ct{&(t;P z5=>YvGNzq?a(FCy-y_*bO!V+>=6v$tWnR*6++r^D?QcwvBYk5xl4p!(N^gb#NbfhT zya{)Qz6kP2agf~|WN!R(gH!)8T5*U}a{UgP(uZ`YM!6K;a0aIq@kL7pTD*Y+7}3FI z-Map@pM_*1n-VtCMa!ZFBm-Q=PSI6Y(+WT^*FSuCZ*lPDY-&`ep0IbkQEG%s(l{Ph z>Yd3_`Pm$`MRI98!)kq(-s-Pe72G2~-=(7(IpYR+urYfF(=U3tEU=KR0pSreup~JN znQ{&Wguj(O3qLr#=T1^)U-5miEcae^aF8zB+_wbkhW0)@5d7EG5l*n5IE1y~C;y=L zVu8DsqPMB2ORBFIBp7KJ-}FClhWsUiJK{1^Lq~ddAFQS3#a}dehw~M7u{^73c0<&{ zE<~&n!Jw&$*ltFR^lj4XC1m;nmX}kD|Kl=D?=y4%&>`+7*GD11Qy{g@=xFn6P)@I# zN`1_z>w~@osy<>uyhm08YM07iGpC>1HRErZu+2N17&*+NNjer!$qo#HBDMJWWD~R7&(xNm@8S-wOzxJ469IL`ozivNq9kKDWW3xT@C+E{3`@(nAMVq< z9ifFpfZqYk2o2Io`0VUlRwO&!-sP2gO~i*#A=ACVVvhI^CfWNg461C)VvhJNx?Q1I zbvZ+MUuEHN8X3&IYk??j7+i{2@ufvM^Xb=kY{}rY)@TD4GxFy&c}p! zPLO}vJuzPTAEG0&ly%=ZFjY-}o1r9|B8Bv8lH>stH%G^tf6GKzI_6v_r>3WGaz*R? zb4|up8s&4iJ6XM)-Bu$_Iw#c;XW`*wTZ$|htriWXnnbJFJV!uu_AD)iLG^V zEMGEoS7Edsqq*wh{<0!)yl^n%M($qV+Oada;G(#vISSs9sTuUh+!`QJJ*I^p00^U1 zGmNuLo{+31Q>KRmtmQc<#*4%=gjwM@Kdrr4twRP8rUSp|YP)nr6h~>SMa5%St|Dxi ztowO}J(JU^Osk7!XI7K%*nbN{^>(9;9o~bJvwK&%a%KlhfWBPDM zXLuy~unnf=dKxp_C5XB%!SYYfguJ5`xlxu$5qoID@QeizTKnrDmoL*S@P)3^TtDL$ zj8Mxt-tN_{1%<+zSNXH#PGOa(LSHMj6jxMn?lfBkgZ!vy;<2eEK>9qZ^QC6u(y@*E zz`q`J)(~wHAYr}|sy#5#`BF28lshqM1Pn_Oyq|ts4aataY@RLsGvPsL5jxV{-hCdH zjk*-c+)Gh0dQGt_^zK*vxv!D0^C;Q>&*Ko{UxHjRb}P&(akE2}CCL1CUlLFy*ZK*0 zNXex=(OQU>%$rkpD~$}Wg3`Z6ksJ^lF_5YRDXDR47Ah=`$O&W2LNMcRnAc~Lm_X_g z9zzv${6w~kyC-jX;#oB#N1$+E+ZbXg00o>*!QHyWhRl7N8}(T}6_o zL2thcxLb}JUfOWd@>T2t;ki3v;`O%gBu5VhEk5WDrsBbBv z4H>7&l43kO8|2*>YpEXXC3oucHkgfdW^YS6)IfBfGDMy-Ow{_$W-2cv43*#X$mz1P z`%%1HI5s1GysPiZhUS2R88+ zb_Z3HIBo$QDJwC-U*jTAR1g;t5E9^8QP2`dNlafr-KR1G8yxH29Ca#+!sVT~98}Bj zgZ;0kw3Zp?TPU6I`=_ot|D;Dp!x7^7DQgU(Er0fEtMn(&HfzJg5d8?dSL}_5zxYGh z$?_mV-a#Y#Z}Pm$Tp+B)HwnFR0qaks48>Xg>kktdoctW|y_oXBzPm$^bxx3^^Xk@L zBs6Xu$+iYBh57N#&}`XPjFva;=Vp^}w8-mzl>igKB~H8*Hd2g+n3>;H%%s{jRyT+C zwAF=R&yjoI{rb-Kx8?$zwb(vJ$t@)qtC)13>Kbo>Ca?F&;>IZ;{ScI{CAbxsbPsL^ z{%B|fugmC8g6>$Mpejw!J%LSG%7W(cZk>L)2_YoCrXCB+Vv%WLFSGvo5-&hu-5|ly zNM`lJn}9KT2|QiaA{E3)mbrK_@_L8Ah}e56v5^e@)4`#mHDby;4jvK(ux_z@&1?p# zgSNYsRS?ttQ{rDj!<$ymV?uKF%#sN8ZJpZ(i!x(bo#Tt|qU`lsI-0~pDrrbw)h*DWJEIG{vb71er~Hil z(Lr(95Q`kq`j+O+%eLf4>b)W<1Ih29P9K~h%JJf^Png3PfA4qxe1C$}HXdAn0AJVY z_$_MBcodb|jKOg%IUI?#q)YuuUkvBHZYKH&_~-L(#P5N%44ZNSv}I1bAw@d_=zUB} z%|*Q%5qi}k$t;%J1es0n21F>1P2>t|J@yRzA?w*DfO;OSgZ4xXj>LwjN;Q&ISG4(a zmF;a8dI_rPX^!9wg#@C%cw>{gpPKxmzbS=$E@t7skBhf)Nxh&^?v~IF4qs2NV;!~r zu7SlI`8zK2_gi)#ciP+cW}W{yGYjM=?nfA8C~(GCDB|x^A(k7uBaKxF(ZMgD@F0{# zzwUuPk!qt?Jq6#0xS`)1dRT67h)ZHw8iR*9YPF5Grww|4QAtNT>djVY!z9Ca(~3D^<|k@U`(L_YgHq-sd&i=-mcjs8 zI%?RWw1%HG%-EFY)$P5A)G*USm_X`IREh4?9s>(RS4{aSk`#sgn(fzrI_CmvCs(^YwME|oKx2~xqMsT(Db~`0w0{Dy>730RpHe4Fe_&=J> zuMej&uO%70oDr?>S+ijz$Q5)z7>O@d-g@Pm_T`%j;&U-bo)4^)r3{I0o$#ZagnvkR zKN+p4IGdklGVqX;9;{z>@yGSiTYus^5~Wx-JR^^D21FfZbLH7*ua7PH<6wt;vx=Y{ zM2m|Cq~OL#ajp<%&)gjS1pmlYO+gWT5gyMI(C-&8h|I3DwRr z1%ljR6_m_YR^qnlmL_Dzy5{ddwJpz}$6rE#ipxyKqCDg!lV3CLnr zF*y*d&CBbjkyP5rQ?}522E?>!2X)syFl+61GJp=wfRgf8=M8QjOL2*3-9G>6y@^d{ zV0t}p9}GAE2Yma$jH1BR4c2M~fw}(gjfP=vWG4(dXi%XnGD)0&Qqy0DQyWI}sgGxC_E?~F00aWnv z1lo&zIsnEW<9;E-%lTn~2C2{tf?!hWEudyx)9cn`A;1uf{O*8&7e>|@YW&&fTBYRr-I4;OYy-zgepvoH5kS^N1ZAmQ?$1hcK-3|iuOu7_Gfn>3 zMe6cPkT;&yn`?lcnm>C}7&d<2iKSFoOV9J2yk>Tjux=x=;Zm-1{7+>8Ai4LP*f=IG97wm#b!->*oX_wOjc7XIEEC zO;2D#*|;%qD=EhXLf~%5s*dMiWgd%ku~0)dK|mFAYeac*f(Aw=$!etgyt+L93fhgO zx$h5ffSL*jOw+|RG*kZ-p=5__x>Xw74Um@oxC;2N9{=1pB+1}%guf1u@2CvEgflB3 z&Nbd|`DfKz*AG5xBKC4yPXT#3leGu)5U(yiQ^1LL)>@*pZ+3n^tpyMW@;Z!^fLKZb zC`MsL-C-08dA-8UTPg6q(=W_?^$zgFmqa^|Tr^F!1Ab|AJ)+x>`LTlGT+)z~)d}Ip zFyGKvR!CEQG1X?O8Q8Ph3Tco8Y1||NJIJ6jOr1^r?(u(L;M8wdn8@bx(og2F z7`BmHYx847w7`Zn5lQ4XxGMef_kuEn{g@uzKEYaL4~DWZNW+gX$UibGCS}ecMl%#b zK4glM_!V`U5}Fu5IXQ=NTYZ~u4u^)+7}BB7E0F?L2n~wiT*+>A)T*kE2pNU@xGuPC zEjS5iIBcj0G1Z^F&5Ce=qt&WP&}wZuE+jhCHCK3GgTqx=s0Kd&42ad2nZ(2kyp8zK z`5coGpoqtu*lu7yDXf_7)Lcji+N|7+$b0p^tJt{W(!02hj#+N+$+yFhs`g)Xd_)o% zDO>juwD;ie=f?dIr4HQ1aK!sIkY-FUKu%PgL8#y1kZX5g!K5)-${WG~gc)vbDl|7oywk+<$j~^Q!9_+0y zaj@>h59#q$)=^LQaBlGzPJdwHU;|P-gDDi-UZOYbz#>R7=f+l^l0Uv>~ItU z;qgpHenIrt_?fTw@IEJuCVukaK_(Ls^a0eAI%|j`7E-dIN(@kgoqUzYgw~erW_S>E zZpV;;=A3rO3;N1h*bK=c#xW_46}}o{0Li0yT2v+6A{SKRL|Zf(;2DbG{phZWx&Og8 zwV%<-YT87ooJ5T!$Dvjf*#^-B_*>24u>e8)W3w#NoygwCg-UI4!uAEn-maDUNiIfZ z$!XyJYTZ&NgsuyyTnkP02@F`cc&q+ga_>Z1 z)Q+Jl6AgKLsFC@XuIuJyeHkzZnK!mUe}v=k6Uf+Mg;`W2qsZ+bVc=BZTWdq=?ch<-CIq!d9h{ zi?20exiUU=vfk?s?-U1D75&=LhmkPcxRdhc`E~(Px2e^q*_79syhcTWVEZ0KN-q7C zMb>nm4{hY^iiE3Xy-tr_gn0Z34%GV=*MJT@O9>U{C}U)##LCuj?uwwzvY*|l>gVsn zjoo&n5UD3XG(*Y{;6- zZXq`5eo8HW4uam=`%H+X@lo}UkO(ECE!$n zeIr4t<{#ZML%@}-tykcN%xV?5+U!GmQ~xRz*1QTxq(D~MqYO!zb3iahd7l3+taaAd z0Pa3r1b^zMN7LKVoYzNe`<^MM(+X2z?ruS|$Z^d!x6dPSicwc=jM`u!kHY>Venf~* z|K@?E6-;VB4bGGeT>^3tHqnC#<&YME>nCr}L%`}KRZw^H%@%hOVl~(tK9CXZnOgPm z6*oov=`YAA0HoXnF6-p+sZIWj($70uF`lz~zz(;m6Cq=Rd(&wd?c+adZSjl+ywVUPv81y_X`vN}B>oWLEA!`rd#wwsUMa|e@SYrs1o9PIe|ygz(_`dL6GkuR8GonXznD-{295yO z)Z>-*^CA2ss*tL_rm2L{{EsuADZe?QZbOA(hojV9u9lv=wa;GSH$RU=E1o7{k&iBz z_LdX;w96?tZ6Xy~TJT-wi}_wgV3b=xN{S&5QMgOz{~{F_}-i=JN>x=G}E z7FUSk0l9g4T<8cy6a?|S*9b)U$}b1nT?O35#4 z_=9hlLovGf%HKW&QMa$0ZxLGGFO;%sTnKTR7>Oc_>ACMonvIKgqBa=nveb00eK|B1J%|yBdW{{Te!DO4_we`y4@(qCs|A z9+Bb(eyBv!^rls!wIT~jO5MOg-2Vg4Krz4l;!g>7JRIcC?l+hQyAl0H7IHzk-RoWS z8X&VUKok)8*9;NpM4bx#=cV>$eYdTo=2#k!<)fHEh9$#S@IB^ovdQvd+sNo|C1V*W zkBNDf)QhN>-+VDr30|@$arB3=%Sppa=MrZ4u!IR4FGd#G@>(m6*DOpGS$_En6Qo#e zZROB2mjsV}$a=zQ;rZX5itqxC1*h11F#Df_`ioTj--G)0{J)8m`K~SswU!ZPb7E0; zGQMVKaT_!FzzgC5HKScw1gB6QE7$k3qEL_%@lVRo{f8a%Y;3uZ+EI960!`NHF)x|Y zt!bZ_Jk=#I2@2Y2o_cjQxMT`XXunyS4w{R9g5z7lgsN`CgAn_&PW4 zw8j)p|5))=-|4QwR7BL^J9=$OIa)~cDCJQpGumUmd!=kaL?dR*DNsZ|?RjM3ho|Xh zrYjQ5gCw6;neS@BAD~|(hF3pZJU08R?_zg{~!OveAIZ{PoJD6OOfh{6b~yYq)~9inate!Q7oLvet3ja=BZf(dJ3XKl}8 zyAfzl-j>`8Fu_4J6N==?LllTAu#?Dw;_P!&m|v*$)QyZ*Txvk#-&wU{t|wOW*T$7i z3tX3RVS#7#?Fn>dF62(Pg1HYH+I?#mJCU9~PB`h}kGFQeE(EihNw^uKn&Y+4x~r^A z&w?2Mbq9k9Av0cD`WF<1l(WI&0ws40_|6hu81veI-YwAX=ZNKvA^7nI&YyD`h)*IA za}6dW{2eAJbSNlaW9$mIY`ak=;?`#IypfBo;OIc*hmG>qz?UzfC&mPgLziS)44SN3 zdH%~jCw+@*-&z-E-HU#E*g0#Sv=`2O?VeRm8FlknPOiIh>|Qf9sdRwUjA4+RUJSwW zL9=t-?hQ{bPEOjrN5wP?l{Cu77p=GL-tg6B=k)kd5zay+7v1jV>FHCzR>xxjvi&zt z1K9|VTx18$lP8045|=d6ulvJ`ZvPQ6)e%UechVUQTc;Q2kIAwUIHZw$d-cD~9JGh+^OMf`;~<;BA!D!V4UcLs zUJPG%{@w09&K9L(kg<4LPheL{B9XP{_d6%&;_Hz8`N-RT4mMe`aF&EQqmZ%>}$`6R$(1-%B?$TAekbMkKYNgY}kba@qiK7bJR3iR3s-J zh=c7LNW^7)hQ8<+c}||rNYkC^8Y7n7xmT@Gx}iJij8fnhXpHo-Y-4TOHl*4{D}EP< zwW0$Gl|q^V={wX9-J2kw({?Kce5+!BKFSX!1n7<2uLz(+UMv9I8T`}Q{S%no)7~Fj z^M!W)B{i0|;@{d5ZT6QE2qX#lt=e<&qkn5NBIZ<#;=M40{9D`97ZwvYW)!~T5vTQ; zEQ)4)%wW}eDNKS3!dO`*4E0rGT>&Q67`9xC((~kPRkVTMnt|^U=sA!Siz&lePQuo< z@E^4RQX<@TAN{S-D9Vd74Kck~iOj%j`ixgG%u;VR@}j`x|Bw$KnPAjQN{8tQA4z@s zyyBMH1pYOHGzc+vGmg?CFN=Sv+93l^+iI_{qL%Tihmk!O30m*8*!q#UrRUxQql`eN z+E|M#rOfbSg2paTau0%D(1IionyfYO2oXsbK}AkEsBsNexEO{s8JVw3ZR@r(Rd{2EC1UTMUw_=xk8fz zsZEd{Nask}&&>PvMDh5Vi&fUwWMnCq@m@`rAB#(xX}GzQP6ND{gsRXIYd@_ImhX27 z{xsM9r>Z6+sGsceA=i~{s-0Hl7ujkHztr$bAo9Ac5*-aRxpt- zY_(v5m2%cwu4QDRa~iPH0NdDYfI+JpY5bT#aE`g9JB@_}jqrQy0oicMT>nB0 zH++I`5t|y2RBVF1Kk@ZioM6fNuN@pE{lC@@>)ZFA8%f-}Sd4c!8t$U5;BqTwdWADn z#pN=V^Gyb0%XH0_*HY+(Ev|lF-f*J)T5YcEvu=4Wgt96LQf03N^G+`DmO{S=?|4hv zNIA+&mCuc%q0cUjn`vJ3Bws5pn9JX^FM*=`U%b4gYn=v{^8dr+`~Q0NaLfNUlAZ+r zcW;eF(So+Tf6MzHg7=3!?YrgvEAan2_<~=?|LfJ%`_KBpHvYp#(kA&oD5uJAdGF)! z-oku$4X&#DrT<>p>Q|GB^8dTI0$RrZtA__k|6ea&Z2A92(w6^!&%9d35ZH3*?=}_X z|93G3ST6t9lluStgYEtQM$(r5Z{`2{-BSdo*zPJ{M=H$!#Y*5YE>_(Imh%5vHL3qO z-1`68Oxp7QE&sn~{;zS0?Jn@tlg9te33R7u>|p}$w~ZzIzgpc-@P8)$Z{xphBn6NL zv{Eu{R4K8)MKB#&d2GD4X){S%|Gjqe_^fSCo%?QM;rg!~?H?T`&i}RgQEhAgv61xb znHGhq$DL7^N!5>LfqK0Ep`W$Ri@sIw7ASz?X z0LHr@z?$Pxvs8Na3=DYuF&=r$3!oR2N(T6&OCXOwLs0{(F~|IDrA+K59Y7 z8{rQ-&&Dt?cqe#|d6|yDMwI)o^GsqVit!Qxf{3p%6Ys7+>^u`-Y(1BkzVye$a$pE= zCVne;02ttp0S0yR(}$gB0XFK!rzm${ z9n1*)u=C8)eu~~D`xWmIhuePD2iKN;!{k088-iFdfIQIrz5ik78N8;3EE!seW&mvd zJtGhtBYH!Z1AfZ@TdaoRuo^`gIBB&Df*goPwh#sWj832f_V%#n&iD2hr@3f#qA;IU0Isl&8kLHQzZtTpO0?-- zl}f(?$v-LZ3BrUy5^Y%o0vaIK1=g*FT+X+UC%D1cjKbNJx58K?=}r2vQp{l>dM9*#V#zd69AwS{1GrVwj6y{x73Fa{BcPk>%VbrQRpZtAT|dT2WPNN zIuU$3z&^5RB`Q}D0~q6=rPAJBXX;}TSYFWB+XIZ$fWg^kBS2?9`vx60(0w1;Xe8qF zjRikB1;8B`H@z;`X=0e-~YQ8CTfk^5?Ce9bG?D?CL(0G%Ip zIrJVJHGrbvI6kg3%I{@@0C{5yb|{2Ay5n0or=s#1^3c?BdF~CI18QR*(uUkyjgGc= z?ht4>|M`)i0Pa2q%`x=}+ng;x%2loI#RcVg-P}5hT#FAqAEP;3q@_9!6Qj zpp;>gS&qWB0O?ZX%BO4teEz~wYnx+}|FNJf|E^vkP3J~-K-OoA;n!HttISne8Lp8G2udBtMt%wh zP@|Ik;1lc^Ggwm#->5}>W3FR-7f5jF6Msf|Dkhyc8vY zVIWm7us|NrYg7{$>Pb~`Khi3#6DLfn39G>bt^2WR3bPyA{SLp#a}tTAiF$Ied_Txq_3QdEq4 z!@3G*(>|L`84@S^+-oH8! z{RGGhu#}6#X>67TY}=ng%cB4Zff-YZmZGeeHT9G$U4YjI|le;46}wR z4J2bcXk`ooBlE*9r{y2M71)#Y!CSuX&hr|OkxTeP?kRSZ_?=ODS9JO8vOi#iWyL7e zCeBZE;TVes#km99eKI-{&Vs$YG(w!#>gMbh?$hWhlXHu?wYL`@PZ+dp8Mjj8*s!W z4Vh{1i(@W3hUInNeEani6n@BbTlkZHBJ-aktR1E#X<4H`WkQKO7y8JDF7n_IIYMgv zl@a;w6p3;pH)h`eb+RUY)|8VI5;}_}pPbZ3_bMobvM~idfwu_Hs5=kC&V#FHTNe@# zKpqN!VT_^2qz7oQ^Mt$~HAcvVSJ`s;-ky@Y`6eOdUQ@XsajqmkOB@fcfJGB~0*Cnn z2YDO{_8e%6zj9uY&Q7vjhT9b1WbuHPpyeS&w8^K`GjN8+Y$W+y(Ql#HOjLSaw#WlH_fF6)*I*&a_9Iryg=5Q}gDW*D zoT08z3}-><*Ci!Ge({+vw6gLqS8jmM;nFKhS)wdGBtGX~zKH*n)syMvHTaj1g5?G% zPv?gGEu3v>Iy~5~*HUFfpZK2!a*PQiFja;}L`nC2IGr1r_=bu!St(SvIeIBgEt3Jf zk_S94%q57em18R}Mrf7Gsu(Q2YM*q@L9gEg-CpNibI=BF+wb`o(=;_uqFG836}oDGpl6VWx~#GlBaW0$(_8cYfI07~ znFkCecs8B@#N;+{p{6S%1idp)d;GZn)t}Fwi=Gq6GN9)O^_18t07VY8Eu!vV__Yo2 zXRaGpeDL9o4noathm~_+0PTS5TpWT%0YF~-R@^MfV_QkR#V z=9x4{i1dV64fBciC&eC@sLJwAoozeyYOQY6sz&Vv-=50-zzQILpWXm}2!Doh>nXRn zG|wtET^D~0x3hAS&#$n85Vh=jqsjXsPDlF2&AzpGcl(~@(+Li;zYeT1&Hj=N^O#dB z52pB<1yg*6uINOtAto{h+!ltN1Y zd{CmnfZv*0{Pag4lv@CkziTF2&iT^?_}BqhT+Ddbfm|sILNvXqKd@;83ADYysv_BznFN(# zEuq~%^PBXX!t%3JWre?P;JlI1<9@rG4=ZUy>1t0Dw2tw5HbI*t0%T)5g;Z8zRFZ>G{b7CX{NjVz!6^r<8baSqde`K2 zt-(^M$5@&Jd8jg_Y*{3%=X^5QlHwzG6&L80iY+{@9V5?qmwHdiCH&*)u8dXbLNdZ+ zn$ZJprY-7ps93FKL06t9q<*T2{pB-c6HM_aFk5))&lorcqryfdIxggu;+B)kiwO+5 z!01@q_t>OzZn<}~aOW1-M9 zX0*aLnTmBoD>DiW3Bgbhb_D}N6j;2ELN~!0znNV#GMIp0<*4#mC1;)kiOXM*aBN~#o&AcYPq>wZ~HOk-}R5_#Qr!Fgp!fhz?mO%7(o{Z~Z5=`KXU>_Pa z@Jv~xh>mmF?QaoHA_~|nTc6Gil_RtY;?BM#cY4ljf1}t_yLhI=6+5iUO(VcQcJX-5 z=c|0zhH&NYG`^8!u+j^rqT<1o+_T!;ipcB>S~s03@~(8*;lZ^ui37$)k4mxt8&~;f zBYx&RX?0aws%hD#?--OiR~7z8V0n&3oGWqI6%__Nq*7V?T+W59Pu*xvW*^#Y=mo@b zYlgi+?NKQ#rw%gOIZ&JYyjVB<#Kp*CSNPHrnQTODRUEwUl3S zLL>r1vqgUec96%;YP&!;Y+PP3t~A@>w<6&YQk-vgzqR>)^`HwN4iDq83qijLe(PVH z^LI!^wNuHFYJh*j6Psoy!TQdQB(lO#3Vym)+$Wd`9z(<}58{{VWuKs1D}cirIA2;I z&en;1=)D|O)MZy!@S4~K#syWv#ipn zWGI_W&`c|tGxW<6l@MgMR#`kfi1f;B@AjQV1%;NorjT+)aiDqj;k zO-6OrxvNN$zj7Oz@YSwLoVAL~kd_%95K5(3<~5vHw@A1w;o+X;(IkG1;+oG4+v}?Z zs(fzcvP=QL)UMt%O-)U_LF4a1Oa~y(cjA?T@?0QZLfi$ZD`0@`J3f;&x*@<{3@1 zT-CIA8mu&p9)$8)l!dq$QX!DrLV}TMl(mEc%D{4cC7U&&7RD?cUaAFkV>`H=oo>KhsyDSOxKG2J%bryd7K@cN4pvYqar7Ew@sWVKnsmIk7cou;F z{lESX>RZ$Q{lETCF&H?QKoWIYA9)Up4X8Ge_)u~sJ+}p$pz$P}toKTRc%f@zdG=)J z<*Y+Rngn4$^ZZ!l2?+O$V?fY&49S`($=YU&{VVr1rBY-V7)?oOsLL;ofOy+J5Bhe%zahoF51ZBrLb=#x^a?SbQ#9%4Gp_! zauJEc*$lgCeRxYv_?3(^!7lRc+sw3wluZ#7--Pl=ft?W8;sOXkO~!LbWW0ESFA8Sy%(_&4v1xR0amREMpG~Frt_)VjuwJY&?DmV7J<*FToO93yNcKBFi)+bdqx(h z52Iig!F?n%wJuJToB-jx01QoiTQv{Zos`i4kf-Vbph4TM-z+UdLS26>=8654T#fxxyik<}=3W%qNmL7yEqAm`8)z1DHx z>Yf7O*ggr7JCB6;MfVLnuYie}6Uy&iqaUjOhIXW?ap~g{g)7|0C17MJYQ+bs+1*S$ zXCh8Wg27c^guSsciiirAdA6T~W6z<`FJzR^%{SKb2;1(IqA!9|=RfW@ad15ZBEeL{ zw4+&f14XSx!HQIwStJ~@v4SH6y(?06e(e_^LpjzEV z&yjD>13F_AXNrVxlbHW?V-qxGZ%*wX7ZBA-L#iR#<1nwkH|MPr=k4pz~NGmog| zFrZUQVtYD6MqWo8g%6#R^HaEVehd-{dw2vExqWdwj#|CmAs z)xz|%0Cr&@`cU^^9vCs%>~?*_K0L|>3GXEzRAQ&doF!x>FJx!LRhGT6<2AxQyf#Z) zOi4M1$#v&csV8Y0t&G^yjKbjW;iW0wr?BWLj!l^I${*Lv2_`5A1H)I&A+mS}CeV3y zh?vzjkB9OuDQ!fzs8*eN!4eJ$oUC3hYZ?{ohAH_>#<`4fz(Op*^CB;B$u>Is&?KuE zOYsYT)hLr=*#wK}GF0m5CAYG4A{p7Hzvo2Ao zGa!>EuSHTx%LQ_J|7MYE9#knw38HvaMLRPbIXH;zF)pbbcXiW*kW!IoH4V)8R7{It zmCP`(jy3_~HriqB zY3JoK#F;7WB4=U;W9E3sj$IVn<3h)&T&4rf~wTMr(vo9a+E5;T5#J_fR1rgyF4X z9ks)rGr{iM$H}700Lsi*AcE>uG25>d8C`X2fZsD_#hTV!6oFH zjTN48)@^-gomj`#(V*FBQ)$oY%In5lb|bfQZcllhh6pisfXAs~K7z!%Z5afT-&p}@ zl=g45=P^G7k0U#X1$)B4o_ftDT$U#RIr;ly{*q29U*jsBq`jO&2ifjaJi4`A*C38# z#GwJaEI|X2TN2}GJ$=1em%>ba0Xyxhz+N1ovJqs6E=`j`02LI`X3=(c z>?<2x;~)&|60OJ~I^lE{2DAdx_9IMYVZZ_%P|oJCXWonN_!C1Nv&gc`ebC?8O)ZPX z2u8na2Qk-ZV)EF(bd=28j#F1O@}fju;KY+T5fif=BQl{1yu#{{?L;9R?%a>PnXgbN zdKcbMF@IMa$k~ZwF%HzY4(yE$j#7875MzlESGjC}kA@615Q;bntX*RGnfZ1MFGzfR zjeYr!KpAd@Fq3~F{&HDu9;zypVd8HPnC}-sowl@|e>FO#95D)gW9HjIO7KhLk)@O? z9IyqDQ&KL2%Wt`ydM^YX>TC;AnHoYxfcJPp(qh^{N{5N(v)yZ)TIlK(N#1P`b@0Wg z|4q{jWU;UoB2oxjF%>n~2qVLud1$8?tlUZ^D*i0Sp80AElepK*gVq_@GmoAgOqFDw zZ)})6d|)^9aYgz4jTg9HFxC)?E^UX)Cn8pgJW_e2XmQPvb>fF{a?YY)rDbE~q#`>V znx;8KAB!tNT$!R;O2C&xwn;15nyFxlJjiC=cNtpoke;x^m8+OdIJ4#g@<1QSaa4i? z1(_AhCJgAFumm(YB!tfR&Qc@%(3w?2W=(Gy-IyetVmF-HUSK-mG%xyoIw1jUUD&V6 zmf)N9YlibT|CG`Bj~Lo>4>EZ~N(^|Y0U>*nm4PGf$0Vi1vl2R$0if{6`z!*L>IvoQ z3qg$dHyOd5u3#nr)1!RTRwH@D!`i}z5wVyOsd@<%=?n|V$PFdY5>}f!8p0l9;qr%> zorgxgJ%)T8IA+XVTszQnw3q|agObW6p`zCDiOTlFxxg266b6b{4DW?#C>gXA)YqCX z?$|0$e=cINN%K7x|6RByc`o@8DfTZsoyE6oDjTAGM%u`_>3M;|OU_%!x9KvGP|BcJ zcs4^`%wU^Ia4_~ZLvdA{*)RhFa7>lQ368wjOeop<9OJ-Mf`TN;24tA~KRn?;Iz^3U zpbt381gK`_?>S|SByok(wBwMD`$8~V_F}TrKI>YigQL!Aqtza~v%1#nicJ}5eq1iL z&6CsQ3xGfpGiQRGD;0U^Jk8?Q!xs_BlrQcMDY55Osqs-#r^~sSY40M7yu=7TSi9NVrP+ljQNo_-Olq==kJpUFiBJ8Tde; zjV^SmAnLnFpHbXNjDwiz<&JNA)7&pa0=mZ0B>7OR(Xs9(KooG;7?oO{GYxi^XFX9L-HLn{Uz z!z+}fAPmJ{o=FSySw?Xzd{n?KN_Lu!k34QqCKK%YTDx&-_0Aei>rgqqnbym-(UuCvNSbLGhRE0)_sq~Jq(rr8v+*F`lcsTIOY@*X`jBP4 z!jSkKA{b}3?y{uupjn-_VqweW-i;SK6PfleBQR&Iogx{EDJX)9_uQPbbM4vi(j*Q; zANk%DMi*AElL*AZ`P5(ym}F5k_s#uEX%`Lo<{IuI96P9_nunH%`Nuh-7MZH!Z08Xzvr+ELO~H?!I5E%qHqdn9S&0@epp2C5LHHYFXsJ}#qn7% zge@N_%Y?*?(%v#vN*F+XUz>D}-olVgjMCR?U^tlKWG@xpkTR)*2$@N2P2rGI&tEKg zQ=SUZMi<~U$AhiHu!3W!lB^iZXXHoNc5mgIJ?^)|=3a?yBUrwP+9AB>g1luiyOO!C zIkjL$o6dsya8q(k1rBK?tc$MZB6R55BKF(1S#u zSNIkpcjQvpQ0`*RhLVR3rEiA)Z-#x2={Jl1U)G}ks0sT^n)G+l3;xZz|L3&s6O1>o z?L+p6F8cr=HSHdCWx`r?&ysTABd(UAd+pv(e(qEM(ciTD;axYvc?Agqi(Yo1&*Et6%BokWc+Kx!N zDf8w{HP%JIU%jsL$<=rDB)hO)*HimKBBk%@u|3x7dey9&`!97lT;55l-(VbJLQKUr zSTI-YJ)>H01pegEUbe`C4fzMrJt8r@R=Y<-U6&~F_PkDB^GQhJg4Rdv9-^N?G@~>x zz(FMIIVl+I%#J5#O!Ui#ODhQBP#xvY6~;5hKAGDuC)8nO2yIIF{lz}dRaej*Rh(mA zD$f+MI+(n_h@+WNpK97eh049BtsAV3_(-1)C({nXHj^WVjn$>(Ixi7 z8#*td7DSoIhMvg)ocW$(lP1U{_sD~Phc!u4^XVmysN4e1otd_B-f}5{o=2GQ$RfTs z_2LYGbl|8ADJYbv*Y6&7b7(`a>-r*<@cxSeRxLwe1y@`zJk`<;RuNbJGrwA zM!wX^!eaGT0DK~1R~|7ePfI1rlv&O{cG{hD*^9WTqf+2oK}4sqk7CIj}d$3mw0T89JX zt5>!DbUf}_tkreJkg*19fwf)HhHL>*eXl` zM&2y|a2_zRfaM&suNhJlS!zX!*Bpcd5x0)ej<6m)E1@PcJB63<9?nG&nms=ib7jx0 zR)p^d!Ex*bV3@+o zS|=ZFE+VQWJcoT0Ahnsv{)v!J-C?9BvLLlLY})J%iMSO>QE6T`MGIDVCn5pTu?=&< zrQ@l4L=fV$5`ycCf{g)*nZ%AjI|O5x-1qpFl#obV%BP!M!jL+@-7{KB!q^?E^Zf@T z1uE^bmCY$4YFY8rtRSH;z3EwJIx|z4LRAP>+2woxibzq4-OA@kbKhs zQ}Q5PLZlS~0{sWs1le!`WC1TxB+_u1L@S{yaFol?94KAo66$Mlzshp%$6rK0N`nz? zR;w<&W_sUjmNc1v7EidnU~D8WThmxQRv8j4pTI;*)gWNtQv0cyFU;DjJnctxyOG)> z8gH!cC;(R5`BE*uiWyG@zKI@_YX9YSjTE@e^dSl2iA;D2yhkfmNz=z@RHD`IrAp=Z z_jEc`0sKvrrvgwLYfS>)W7Q?m?kSCEYwI*KJBmGfeZ6J}4lNn8SkxGv`S>3rG89gk*lc`A{K7lnc23#su}3;@_@yU0i>9HR<+ZB0mv@$n z{sJ${Afb+4f21Vgd&(W}tMARKA%ZyR5408M(-bbdXraG3vpGdl-_@sh%0PZ!+dK7G z6LvR~)T1L&YVLi1Kx=|rh+1?UNw_Ozgc}JfyzR!aO49x*ZL%Ed6WC%ENSnwmYV*xx z4FTbaL=6e<(UOL2x!Fx2Z~l8p9J$>+oxqU~eiL~kAJWF+h5+Ze*s(L)Sm!)iufuV( ztK;CBGL5d)?6jM$6Kl|F_pR=S#))2kQLR4gZph)Jf(I`9DUX)DERSPMsmIYx_)-@; zVc>Xl$H;g+Gwd)+RXR!yICDhaC`K-hv6ChB#|mD&*;C40VgyTA+M=VV+R~J6h}jY3 zxiLQ4d9jr43oMR{M4aE1@TwZ)grHeOXVv|y&_3d(oy3qD4?4>oxYWT|1E<}iPV>Fh z9a!zg8_2sW?52aW^OKW7ulde8Z47Dy2wBX13KX)Q&3*q2Vw350y)|lw@mYik)A1ie z@)TQ1=X(cc&D=L?=H4swC8c-uU}eask4ss0Vqaok{CVxbi4LIaIlPf`L*8{xiVYRR zr71Qt%|+fHy{;>{H}qYdzpifjHX$rMyAF>E9e?g(^ieO$shw^2QAZ|vc+hwGTkM|q z8--OnIHpp{3K?j>TAixG&8uoPD+UE~-+$QE2@jJPwWWVan#-mph$#hh5pgv20+{LJ z$ae4!;u0AI?YCyaJaaPfi56RmUzGg{j!u!_GHparh>3oam zw5Vh*?3%|4@2T+XnJu@$?vmXsitjnN=1K9t$EFlmCec`PkbA5^oC9JLxi}vT;|)t7 z_)sCQ@wJm__ur4Hz()IkAUFjRB*Z~mG-J6Z(0`NZ8Y+I=Fb!uP@)V<-30omypM6+G z=n~MP1Prsxpfs7l%e;I|^d93Gd(|~WHW8k^&(KjAY{xwC^0Q@~<*Zz~?==^ZkC9~$ zOxVH`+>yvA@pFO=9!_=1fU?V-9?cg~j93BwoqK=N^)OMB#klUYPkuoj3%@F!Qo@X+ znzTFptT>;OqIbz46Ut2w4~STz>HU_++Y8j#jm3@Bfg*wDbexh(3Vh0C9X_p#K(bnN zE~#>nCh_J@>x@*|n1yZ*_@yFHVl8-4l{!??0F5J_Fw4t_y}mk@(>f8faugKC2H0OJ z8_0#C3TFitNai!7<_5}PeTqo82AD+vEVDq7YAA!&^HB5rDY^=TTeFwxN=`VP+VsS~ z(1RHz=V%_lSz<@A{z>XmGPw5Oq;q^s<-UJd%|Y{>)qF241B26^UawWF)mfCcw{}#`s-9cttkdo5^&e_!Bg<0>zKJR$OxrK_&Dx8N zRng@(>1u{U?p60+6&a>$nYy(-sQR!gl$sXg5n#l~sD|qndd?HIa0>ZAuJ@==Uo&dv z_b}fJWV{5#$dD!{!w<(}9Mx-Pt!BOiIK9?!o3$R$Usr=7-Z(H|Jq>u~8P)g9eY0vf zBe2LfyMu$;%a?<(&H8 z$q+~NS7z0$y;33c-mMLROmI{`pb!oc2>r(KW1z(LSU`f&?CZPw+uopa)?3niM2v7o z>NRuEq@zD>t~YyQN6uW;{GK&!^#{$9PJ1Z{j*PJv8;%dj4Qf@B>X-Vi{{H+8sLLmv zUkV2a{-;I~fvaAlDr&8!@9Jl*GwY<)rXb#&uO?yOnqxjqbiVu6>Dfu6Zw;*WajTu* zZsuKueps)XwSBXue>HPS?NyPzgr@*!1vg=IHS)uo6Ukjp8~so_e-#Y6Jdgo2b>h<~oJ#VsYe(rSNzdh;vJfJ(6x9wZq(^k9DZ*|&w z{nf#~+RmcKhjldQ_37l%MjVn}|3R(Swffy(28}+Q=YB7#w5QaO{j`r)!dqH*@N=vG zjvlP%XGe{`1&8ad4%5MwchG7#n*G)XYjED~w@%U{TvhqJ{myEf^xyqLr;yiN25;|W zwVG?UvgD;YH&Y3{RYzguOfVS4!zg30Vq~8|LD(XbJl! z8~p*Y(b~4eWZBF$7fQMFtX8Y+Vm!vtwe6?F@8ZwcK_s^0IT6|Bvl2rQCWSPhYEZoM zzBk3;9P)Vh7`Y*YkPkWLp@-(~p^2+VSl%!xUof;`|N zLeUAhTTnsoD#>PyH$c6#(-X+h5RMR?J?{4^Tyl!R7LfcB7aHi1=YtSkg(DQs<1tJx zg;Syb^pcq_=zsnFv;-d~^r_rUyPicMsIXHUN1pSTZuy=p_OiiK58TuxY_PB_pWbzM z_L9N*cx*ej8w`kYgfyiH=0KstQv*sLXHhuC@dVG4N#g+(*YAolmSpQu1_Q@f7;VtS z*SxnVRNqp*Nx2O0%Wf<}n8Mfw(Oz~g zZGuZlkRNE53;9dUf&$D}GYs+$)-(;)UOmz_D8O%O9pvp5#Ui&ov&Cio2~`MbO(a8l z-;|O+uTmnGSS%oSKFcMO^dg&&TGoWf57-HEYJc{o^C@CcsC+-XNy2;agEtP*jqNFZ ziV-$QjAw-FO0B@7f|d6h-K%FzI?!3DsJY`{?EWYcjBhfW6%>~Y2qBE zQw(oCPPQ z=D{mY;<=DFaUQUyw~t4Ao!O=Qy$I)o-KS_^;~5^~z`;?RFWoJgy@sN`!Q2mKA&Cth z9Z}rrqe&QEr8-F>ajxrTnIFGXg$YSX*2P*xD1=7qV*NDk^b*vD{`5)vM>*7Ux>fz^ z8KhJg%#<0CM|$P=$d$?MW#qY)t5;;;hc^SRhDgz}IM^oYv9QEJ2tj6FO;pV-x8EffY~hO&o~7K*h>#gyhTrZ|H*70hJ8Z}I|?9; z3o*PP4vlys1L(pC`N-CIES9ag(0JV^VnPK{-(1PO;0!KLEoA>TkFe{JE7P%^i5HAd z!|Y?acF2{hf`;U3zNqEFcArlNC*5A6m~np@NL#xzRH_V1DcF~`bA^LUSP(ySY+u3> zRk%9?2MKkCl_9<)>|etn-mo$pJAmr2GL&d%y2O{nw80bOJ-*G2NJ4vU{M;KfKx`ho zw|*J4j+EDIDK{S_a_tj%OBMJu8ERhGC4*TJTESWpJRv(?bFrUm+w<*9&-dcn{}Bcm zGMEzs+axw>wwy!jO;37{sEyHYw6zSMu(&)paH88;j5CV^w6Ci+LspNn0c9Do(5|LS zSNi>FPX%;^Zy^*-F+4VT4KeFW2&iW@yH;PB*FP^2Wd`+SgtR#BYZvhMz|y!!I~TSxx>o zn8Y^^~uq7dvB6X-l3j|sc7 z*#7r=4!x@9r+XQ_vZqZRNv{OD@q6h-$d7$5ya?e*LR)IzeU+aij7z0!HI7a#bLyJo zFrLo*C+nkHtyT~A_u>C)wVM9FR((->`SQEk{>$o%7ccf->{q|5*7j@Fm*1i4lVPyr zXHH@}`mXxLePsvt7x{Vq9Ay)bY1-Xg63R!10FWjR0Qtst$Cy3*$*DwXd3gzpy`a+bxP)qkk>AqU}y(s-&EjIG_4EzG$Vw5uEm;L5+168yjeqIVqvD|y^#XFFv) z&Y^Kt+BkTP8RxHjF#AHoGKmSgQ2j`uu*b+-9VrdETNk4&;m>glaV4&7biQ0+#w0Oi zB&oDR=&SEO|;*?+Wgs zO0R_x#qLtaBoxX$JZk}D-`-II7%|f@0|)I56KK+=<1B_Xa?Hd$e|Q$Z9E zw%~{O_Kl?>O39~D6IG9u1E@9?kHt~Ex3a|Q~aZobx zSKP7&#GBG*Gg&_$UX=pgd#)?WRN81sg{8gyaO%YfH9s?1bfRXJx)MiBAAZ@^fYS@NYn@nZH9edymF%y?&jH;diO;pmk(u=eyyshjvS7=0cHzJiH|l zW?J5hkTY+a-rb058Z#^ZtN81M#m)?$y+HSqJge|Di|PGD*v)|e9MsG$EuFZH8zk*m~SB4ykU2|!uo zXx2){`OM}dr1*H#h(93vQWWGGpLs1{6P?G)O;Y^s$b)I=7)B!%E=sCK1Lj@=mpqd$ zQiD+wj7s{|Wq2SD&O2A5Cgc%q`CHUo0k> zG*ZTo2q^v{6*a2gMqz2u7wf(y399QY5xm?Bh6;*gapUoQObqg=D8%v{&UueRAFYgO zT87_l%!U^WGOi>gN5f6jHkgYIAnhJF%-3Jcb{mzWR$P(H0_1f zJN63#Ld2|nL1m{d)ROkNu-j#E2ZS8SgCAhY9`Le-k=Vp(&#EwrMU9?{Gx?4hTrczj z#l}gmGYm;`en1?R2TBLJ|v)Qg^6kTF(O|GWFxyp z|F{;L%F~y4y;pxW1ZSL0_FyV*khl3a`1u6QXz-!9sPa*lEaytA=Do)BB66uOM#;j}+-x&ve^+zcezafwSaBYT@I! zs2!n20qs@{D(#J(KNT%A6b7)8rZ134+SG<6Nop$oZ)oFmk<(*lC;Xe#hx7yCJDo`OXaML# zN};fKCVMM|uCv%g<90zmSts6)t6?b``WLdG4BZa?l+YMEs zQLVci8~GKVzHVP%7;xQ#EI^TT&2#$R=_iC)Lb!s6m}ps<1+_N;yv!@Qn(|PLlG_QH z88iTBu7uQI@KQw2AIqs^0W)y`B=njWBTWehw&A(^KOXGA)&h{>>QwZR4a`NxQveo( za5X_+tJXWyvoyJga=1TQwvbSbs<(Ths=BhnLc#ZUj1%G{!8G)cBPyJgtt*zIny2Ng*Q1XNwPTY#T1kCdnEYCvDgmW1< z!xy=)mF>RmM)OVGL(QaG_lVL1tGE1WnJy*yTTVHTc30ppu+xJaK9{@rDP9b2jR<ai3*_?}h;?6e&d&Xk~Q0F=$5-+~f+l{*G4a)u{eyHYY zdmf{KU3hfTy{e-bf<lt!4ieQrqsO`Ztx?#?6G5VTMd}Luzy;t{-u%aIR^r$O(nFinCMJH`h zq{RL6^vge*{6z;~e1pk+S^l8|Sm7LS>az%Dh&Pf@g)I15<1D&bo%i@C6|Z0AwtIrE zDqMEfF27Z&bl^F0k^dv~jVN?31?Ros9lE<)t}(uMjk@SL;ZBiaY(b1BZkuAeBY4Cc zB}ev0M0H0>j%-v}SIpT*(i!K6^l(EKF*P|1;$j=Cq~ip_gMH%dhfM)G8fCttba89) z$Ii4SnAq$UEaI%eOZTO=Yy;X_*M9K|+7xicAr)nXbTot`FEbV*SsX|Um3ILZz$jG+{>K95;XtF~gp!w?I9{j`;$HkSj)t5CXSBeYMY-x}hX zS-Zb5#OJe6{nk0G=1HuZ&#d+Hqoh7WQQsa^ro)BNVvOst<$;cHF@0q-YElcq1=>4O zt!+5{C=ekE2&h~Rr!t~0#8^Hwf8zz_9OIjtlHv%_3U zE<+W;X))Za{dkyxT}Ur>len_h+Dsd;_~}7$EEV3G;T16gN$(q*0>9Ul7%)c~Xi+UH zq$uw49%7Z+YDqKsnqFc6m~c2VQ!EkgP#T0vdxpWB1rw_7Vc4rX`>}r{DWQInUkfk1 zh(V2V!o;6{Gx^Ba&|jkyOul?4RZ;m&$ER{>I}tX3?kNYSNT=z=S^igR36p>tR#+t|W5WlYHl^vGNBQF z%iF6;EEa)4QAvxB=2rZn3)Z2&v!r_IlpI3rqsrNF$C#>75}6K`fWze)vF#29m5|G} zX{o~^pQz}$x?uO28wY{f!P(`O<(iH26bDM#cknRI2a5h z7O2;x0jVE8YTK3XG%OoKGT4+(RATbcPz%?{J0J6{Ds|o(7GL#Sl7fiknMu* zDb*eXDoH}d`a|bHpUOCUe-pJXQP3LCE@r`5)iM8ei3oPeFJA_89YNRc+*r~i^rtAV z0o2b>lh2UuY|roB525~ng>Fo-DMWEP^!o%gW7ki?@yT#0&f&>543j}JxW)9rPRoFf z;C!6c1IPLai4vK2TKoC#1hIR@>7&oHN3H3cjD1>JSj&rvI^L2PAD%1rH1W4wfox}9 z-{uU%JobG2YI>JAbonoGjyPi@{U4ZlJv&)C8c@pGY#f$ws^?Sv)=B zR+8O+K&umZ4aMqwxE|X zQBm3G)!f1<9~*~-(*)ml6pzA`7pQ*xcAtInXcrF zHHtx=U2@j%sy;Pf>0$ba?eQs zO%Q|(thmQDWTxAGIN1_qw!c&H_y|(gC=u04sIesrdLYgvsnQS;A9IYuLG&=!8VdQ= znry8v>Xi6A+Hg-0S!*GKE*|k?llOr9HA@>8y7xVWOOPItLos}Q&=lU&2KNRJwnLd{ zf#ewyx~GA`XpTFIRBT`{XyjdHZbo}%a!3B`LE0^TIeE%mZ!xIz2eK>-=B zO_l^Tqr_gZN_wG+IaEt~Jng4&SP-ywp6XZ=eH;g!yVjj<3D zra~>e?8Rn_lQ;z<>U%KzV+$pvu3`f-RisB8Qf?%*c*@5kmv!hV#Fvm|x=N%p;&|Jzw1 zsc{_a{=wWU%c2xVpPH}VN|(BT%e*PMs!1ReLx_ew$DX5zA-sKvk))+3N1Hl*glZbX zn2PGjEq)vnd&FNVvZds&3C{pR!NfwfKsm z;#e7szxITwe(}X+n1n^=m~;8*w~*#V^kzGx<{)%Xfgbu!rgHWqMX~B)1=nz zDiK{#D;aMs+XKB1C}9vPi1RVFv+}P^@s@x?mefnBR^5tf#e92vdbYBo@Wo%qQ-5qL z9obH_CgtDCG$htN8v`w!arq^>_>oVdl(MMN;(WtC{;#kSH^LEg;gGgWSX5rR>D_Is z!9B@scgUTPhnjSaL>&2^XZ3(fKU)*iWcBuD?PUu?ZJAaL`&-3pIq;gTSvJ%!Q0;zi zg0zAg;bb9UC1)xwei>C_SLFEM9fKj8Ffgc(fWTkO)&MWIQ2pP>PKU(oMfbUOr)xHP zg!rOYBhv?6o*p3V=K_Bkw74usyWVyUa%`PYpXVra@(MKz5LRmxeihpx+05?3ExHD| zdUEcEit?1v?@eyCGpX;1e58+Tg-p+$ZWa+w)N~#ZCg>#{x5Mm?0kCj=J(8hS1})&< zg4_LBn6&h8WeNV5w^$szf?a9>E8mQ<92cR&cwz= z;cziCjgV2v5V@HV-@^(G5*LtD<6o6nz=p_ovZ?WL-_R-Wd|lFZrJ}9RGse8heJnod2-tn_$*qN+NsUx7hG~=<}eqrpVi);bmY(9j` zg`UaUf#KJyT0tANokinvm;vRCBQ6GC#pSxnlVR>?-R!-g!3e6;ZIIj#Yv(@W5FFJH z^$8Y?;BtNw^GvRwSg#2Syjo}|)+Hmr%_ki1Tm!4iOH{~NHhc%y8f+mN4owbCzY|5v zFunLzatuCqB9DlYi3VS|2156lUnY!pEGI0mK^(9c|8S0{FEs9njEN=;*rHid;=Q<$ z-Tk&x{Qlccx%mIgP6-5dR+m<5oGYi5Ga8n9W3EJ!s&WJ%%oba)NbayRM4ghWYV$^P z#$Sd#J+ZF079b#QY0*mC0u)cAgu*E~du;m};9Ln;!c8Sve3%5e`g4P2I-)eh1wNv4 z7U^CY4p6&?ga9k#+VLVzeW!E?zaUF4CDJDP{2+PqvL=nDJFvEIC_{M6p+x=0)Zo6h6uf^9!Rs;ttYE}aoBAO!Q0c^S%K20qT8>9NZu+^nt(0o!>Uw`G=Vv3y z&Epls4ki=T$STp3?~M~HjAT`%N0f{dS|53*)?y+PA1;ikO_=9tIfA+u#UAj{2n_{H zz?rkcI4Nj~XW*d;1HG)uiG5BcXqf9unxkxG(d27!h1X0dvyOuI6@XNJo$$Eot7u-$ zK9kR%N4YGzU#KFUS3;JtlCV(7?6<$`ztRrU+|-3jS->y|+;hc>l=<^@y@?}GzbHgn z<}oKk4Ly<^*DT3m-E?(Um`DIBBvI^2PX+aVC!<01Z$j4v?-_#S8EprD}LB8pXva*3yR|~L`>$5d#kODDb zBAE0v^Pu%Wq6pA)?et^2uG~885!-?Ey!03nj*;7rc)Mg=RG2zQe|HtZojK5kVzzf> zA7N0VmaE!Zc$Cl62Mv>Kl!Iu0<7*cidXC$Q4cxm&i9(pY-glbXiY%NlsRTdNX#*=@ zwT?0|`%!C|2OrN_9=GaoCws9`zh3nD#lLlhLqR@~5d=(YG7Hw_uj)bZ6C1oCvVka- zN>>YS(ZH5Q@sNa6Hp6j9->TC2rB0<);~ODdg zf8M!0SMY?{mGH+>8XbHL30LTKf_3klXN1foW3@PolK(`^r;f2%j=2=wP>JmhQ&T?Z z;US}+jl4}bVPX9CPg?)upYZ>We*z|y7yIp>(EP_gnPrXxKr_$J;BP;cv>Jp#I7JuA zfC#6PRe6{UPX&Fl3|(_h7fShuF}^pxm+~RNB5RRHUs~VZq8^WoP-!RxsCsZGi=7wi zo@+1?0#O{nhPO>p9YiXm@58Di@B^L*=lpf(cF{!h^&?*4sdFaMTMLk258)`jXcgQn zH_Msc%COZomI-;QTU}#Lp`li>#Azu=LY`=3ga8phestQS`lt}C=XbyLoC~&gLideZ zS&EgXMwk7CvuyT^rTpJhoC;H(-j(Bfco^f$+IJl?(~LFvI$tM*wwE)#T(#35&x2JR zy@5q3Y?mEC=T+XI-q4}Z*5U?cFtr%$df5%s7~1g^H0<47E;iA&B#|7xv7&<>W9_>J z#S?-oNTkPjqn5M)I`ZfG8-_jK%UxVkK)kogi~RK{}?E8 z|81a{dOv_+`KDBv8Cu}~?%V50{_2I1{;ii0%_x{Gb3m(T#_yo|(9Wwk4AG^lI*TtG zYd4+WM+&6BsS+y9LF`Qe&ufQ=W{`0i_Zf{U2RaLQ&7xT|F|-}J^Cm)Sssn#Umxg8i z$3h8FGWS<1;Y|92D~*g*&MS9uTe8y3gl_%g;4fx`pULn^X>Q!2d!&9LJ!Vuq+dNBD zVy&EuO_kZBIlj$ixgi0Y(1L25aTc8pX}HhCRY;Ievu13koc5FAN?W4!sSrARI|kww zt4LuS&0@*qP@q?O#!x!_WFS)9 zPBwF9L<3Dp9!v#=ef!K*Bd|X+nG3=Dz*7UDr`ah_q6yEb9>{KpCbhW1`9xc+$99lu z-4bbkk(Xcz)GlDaLw?BzBf#n7$JVb&e*s2Js8hN&x?RHb`-Oex^#8?y6bplt2w{%s zqb3XEl8t{hLhTjt!ddN1ds6v<`m48~$*YL26s_LYb6l0hNb1EqdY$_fS%jn3)}WI3 z$S@+YQ`KvEtO$+7l(v>V*h+@qxAq|0lV$~1&uBz&FtzECHR36_=JVslJuup^HIf@wI!7|8YZJw*op>kBryb{c zTpy9ovhOp&6`c1J^2_Eyh&25H>8eY0IUIMQq-=bURxXSJ-Zr7h9xRcEe7{cJp}&gi^n%Nt=BXs=raG zd|x;-88hdfm>J(s7%w@@e9D1eQLwHd))0lMUy!7kH;0rVi@RV5bF7#1Rs*zLiWWpf*T6N|N%v=qCQd}ywO zRG}B0tUFk0CvV5ZV~{)x0-|})EUZeGozT%Bmi6f$`+0)J5nKdZk&%NN#5ca0igqAs8?&1;vqChKeY1T^mO zi_xI#dFabGHurd%#u2R-+b_@x;<(3A&eIkU!ck|kew>*cjI~^4+dN-YScLJ14B_D(S7~Xa4Z|oDTPzZd4P)68F1OvpGa>V?r>03C*_R>J>(HO9Tuc zjg&?inV=$!U^# zPN6s(#oFY+9kX6k6%Nn4z|2>d$pyqy;#{ZE#fZaZ>9A9-K+YTNBd{3l^ZT@7|3_YqTjXmZiQ1%KDTzgD{gX!*;v5nz9meAK!F2K`lF41Ka(!UGR zn}S$sRi~0IX+oOZenoCF@4F`#XzmGaIGS|;-uOBDj{~YxyuBI9Ue;P-|L}x6W0g$Y zg)OIl(hE?#y0{T%*&*D+z0p>=i0EDU;zAU04=pDx8mi;!IR>PfCuEDZ9o;T_CSA)@ z$ero_;`Qx){r45)M^5~)KpLb2rPZk_17$0wk}{xaLiMCQeA%m2_;nRG`s?;zTmCw0 zbzdDRQjkTdF#A!?gsu$L+2|T=vzK$AjyXZYUuR=>k9*qhEox-Ie}N_VjcuViynnI$ zTiq(P=Uz*J4K-*AzzAZI!o!*feo0KGXTqxbetPxhy{KpZk4#RLv(9=P3H8)PgEFgY zPQjHl!}UQ_=Kbl~AsjH}j-SL`OXog-dj*d`b8sR;+s#oAWXxd>pc~EkH{d4adkodL7VBLj}q2VGvRQK9Sii7Q?I8VDASw=Pr1h*Nr%y|67 zJXc7*N}v_~IsV5^j$1A&I5)PJSq5_IV#nTr@J+Pyg?xlfuEriMpN5EH}8_3lUO8hNUk{FYcW)1(6(XweU_}KN6ZuBbcY~;_y#uW>2 zgbk=O&;!NZHHa5FO8pY`AO|ub^RR$<1*RDnyQGU3tezJw-r!4?94mCVKb*(1C9dNtor+A(!%H({Ev^H6Slg1Rw^W~8 zyHaY`CBKM= zwuDT`uZ_G*-}XY`6+h*k{w7PaGE@0_Xo#Y*l(OS!@R|qXxYsf-tjP6J*N;!^+}!Vt z7N+>N)T}9rsoK(F7oC>ur2M4~Ar$biAV=oO#SW{1Di>vjI4s888TweN6ZGst6j(O+ zy!v{GBiysU-Fo?+Co^XUS#*K^JFhf~5vV~Y(LDnJxmzK1LcV?UvkE_AQ7I%v#9f6W)4pL$g z-|ialsia?`Lx<1NQl;Ht2=?L%NRch@PyPfFW0Az$Bw<>b{G0i z?PB7>;8<+BY3>)j2M+KEo~FlwIGfBdHh`zweh*5zchHQEWOO8-r~}r1A=yWF44sLa z&y$1nViG0cpMz$O;2>;$jz0UR*;VUk=-m=3J*C3|5p%N$A|ix zTg^{fy0V7*9dPTOQzYu9!L00nrj&1|i?SaLZ;msgnVJ)X!ZpqDH0@U%V9pdt=dm#7 zU%{(VX`3{|AvqZ1#86#%b#L5KxBL{o!_;KmBVO%j5YDf&Xv!S}m?@q15qQ%)gMfIf zdbXX^G=oO67hC-Gr^dgKaCM@}Zo13?=q&WCS|tp=gOqLC1NNew7}E;Nx=l}_VjMSC z8pl*JPmD?oc*R`Gr@Zz`;kxdur-q}-q@mwzobU$VKWHBteQMaZ_YMFRWLbyC-z;2t z6rA`g71MjEVodoJdX`D)F)Cm)py%Xret>^u3xlo51yuYdrzjG*w?BW~9IQ`kd}_sg zkzNG(@4q~sCi!9Ber;{}sDBE4M{8elpI`hw95-KMi=aP(-y~q4PaK3lNg+PS`+j=z zdaZGdQ=y#RLNxtvw+vQA?#DRRLeTc0z+UaG62=Gd+>8dMPZ}qvnvsv_4g?dqNs%kJ zN+Iba!9&*MsjAt27fvL6MRC?v*)58ZMLTE8D2imp^T77g$)iTYrLpgDhq?9~gESlL zkNahB$4r`o1c~j;y*Un#=pAKEreALOMO0ZB{J=KJVZ+sN6$>&CILkUaRFM6ClE04A z^fr`;H;tEtHf{wz`IRH5xiiGKBJ22ZTx+vfam(aMV%h23Ki+4pZ`Y@rbL|ASeLfF; UJ~conE(I) literal 0 HcmV?d00001 diff --git a/assets/dynatrace/dynatrace-operator-1.3.1.tgz b/assets/dynatrace/dynatrace-operator-1.3.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..b9b8fd155fa2f6784a7b357c0494cc1e67cdb8fa GIT binary patch literal 56456 zcma&NbC9IpvhUr~)3z}^ZQHhO+qP}nwryL}wry2&+Q!@ax6i)sxhHPixb;V^T)FbQ z))N&~Pt=p2Ox#Ea6rg{-zQ})?#f+`2fiAi|U9sBZ!8?4<6?exSV=lE58n_$RsuHrhHN<6{hL-_qzfPn` z97p6>#R$&8IDj%3?w+rn@~+L8*5I3j#$4u~MG4lTP4nf-Mr!Ao2PJlcq}=&IRJ4Bo zrmdH2WS(yH-H>*_*&mA3^}d6B_x`qycT#nIKlXQYeC~8qlEWA!jx=0pK5fdC-!g74xcxg>(zdRoeUiZxp z4g!ooBn>uJOE$T+W}j+WmMXcmP(BYP)>ax*J;~$4^MV6vYf_5x3jt3=6Y>R5KpBqy zJ(RWKdP0cdbdnE-7Y^bl7Pe!~v?&s(x7WM7kB=_Lo=lQ%K6RqVTjNV@o>c4&piy zL49GHOf+R0DJyioKIXqlEM=>q9m4G7jhKF%ZD}s4zAFB$q%CH;{z9FWAaHd9a=QCU zrPb|OKm7W7Ia{g~`TW8-g5)?J(wH4m$XBJ+>4st3&tx6(^pu^&%0M6ykB~?~@?T8I zD+DH$-1kYxn`oM?T!X%s;;pmwUHARW>?Spvl1w^aHqgpfKq^X60@f8eG!%deCKH65 ziHtHxL2!~>LdvL5o_x&7!?i|z*J$Jqk{^g<-oLwM4@$nOrOC)vD~ZalWu!p^Pj{EW z>0;;P;qK+i?#bw$wSDhnARtCMq$Nfr5?-+!QLkYPVDO4;<8#A@5Rc#QXl)Ik7)L`U zdePc4;Q!t~NrD*QTyCLw^eSR}`C}Tv#Ow=zl&yVL_{G`5)tPm{&F{?m%ihWH_W6$F{q+kw`zx%6lan_cPhcqlLWl=V;3*ec=z%Cf zX=arezZnkDDCL_1Dh|jZAse)k-v{M~?jZ<}Z{Y()WKZ@W->cj33}DDmq{Oj;w>iikq@e65*$AVJ+|3g}RVOCi0nRHBYUK+&_9Iy#R&g(Q(~}^KicuQ6 zMP4Xa__7ainfPYxtGw9+D4i8yk#~K*mC~l`U7WPI_<9_!-#Q7 z(dSec$z$8bhNMKfn~%K78nHNt{H!@QBilsGPWEpCVu^;GwCsr6hz@;M(x6t%IG3WPGI36h|6+P)Ao3JO_mcN2-iP2|u60@+M+ z=>$eQ6UZ|XksF0PAyB!xtui9{lg&(oiW;~jBW@8sP9lHv91?*CyezTWmg|sp3lE;? z^sKsFA64r17JGWO9(s(uMEf|56?2fDr9@_0Op7)=6O8SjA0OG^MJ~^?DLB~g{Ph+5M>oB$Zq2ZxR)UwdiTZwQxKl zi7WD}g0!LNzdlQQ>;4*5)JW+ zK6r5QNEAwkau5}xdKN=eu7!dj`0K+j#DtUy*aR;FyeofXHP|Dr zl6%8CZ9=3>&fm-J`zj#DmHg-y0k?y13LAeX5#>SKKKEU3RQ~}C4X6+d~oJyuiykBXtq& zvAMJ*8d$SsT1#KQ$Rx=%xd2grji!y=KTH$II4@0prwUb>3B)7_>0;*452q!gU;e%_2775ks`G9kxI1&Kxg zd4KZmSY?0pz8)_{-n{!pG2m<-^m{)Ab{^Y3IMl|Ii{_%!SGk{*j+bux=63wK{t_yJ z0qs#K-zb$^)x`}#UQPbK{FO}cIEJw4yK=)QTWcn7=RhHz!2A$uu< z_<4*V7O27pOd8~>BF2sHI8J6}H#pV1XAu#{jA1M!g&yS3eA-c@E&-x+g*g$qHlaJ! zQ(h1MQB}pMb!9#c##5Em?i%eevz8FYEIrWLnxBr8PgEFGZa97HBv0O1)u!lOKQ&+z z$Wckkg}Y&5*f*p_-sj}5*HNXV`wp}nk4oI?f(UHx^T6=@ltEU-OB=Phb{KU^qBZjq zeY=6X8Yg7NguWT%THD>aXS_^lXQ{_Wu=vz0J{j1w-y>~J$00x9Z3?BB^%M6E!Z?y) zu)qVg3JTJs!&*T;RIoC+=@619Y<2kol22I0pmj`oJ*A_I zupiI zUR>?07bvKFS^rsKfmA*G%%@3%mwe%AVRpID1xX0 z}>mN#Riz%DA9P+vmaH`nt_Y9`G>T#HQ4N$vaO{Dv)``htK@=1ww z;c}d<4D?nW4;J#wK&SFruz(XeQhoD&a>eU@J2Rq*^DK(fYD}@4DT~;>BL0;>9LPnP z@LBXuQH}}Nmc#FDmc^>VG7kho)hcd2Hau1(tk3<}e$o1?VOs5MzZfeC z3{7|tQz2F1GH+px5SOG9hBBUu2t%5F2r_Xm+ymE~lTlcpM(mp9o<=@X6M97vrE zPphLb#wqr~h;w;a4HFVliCG~Ta!rJCl0EO5ycsOrf`~)cTyv~Td=MR0>4+P@OZ8bB znv-$)3<4`ln6N1`%9@qoCwx#>-Qc?8h!AWCe~@%!el>x6*}eg~gx!RV`Q^1P57O#h zdVcmEe6f@Pt$o{3jk{eCQ;)SAo0w;FL+C9}VRV4!Ml6=1OBXZg_2VO&b8vF{!ywef z#zwL0jWw$-bk0tDrHKk|Pc8QbtMR;tz+)nSSRN@mOPAm-Bz0uJUCfdfQd8K8Z{p>Z z4$n#$)U=()OI1ydTefe3NFKKPSI>uKbxy;QClzoyzoe_QHs7QF@(?id9(}95qqXHu zuXt6~*6aB&&^_!BIZ5U#x1eoytf^=+1ooGMi-U)c^W*Eqy*B5b$Yt(!G|mLJwEJI` zK1bT{9*@UQz!vR^sI6=+Ar%AxF7%{A13Ak|WOSk0fJO}&t#QjEP5qRSXnH*8Rs&1e z@k7Ac`qqACWtKTl6lH@%*L7L&nw9W;i{UKFR<_?m=BK<$(m3QK4N;NN7*ZpsxG5kg zwWGSWCtwVTh&nN+T|o;ME{Xcy64|MTYNQ0h@{PK0kbAVi!qoNhk)aJcd6sT z7qzR!);Qad4zpwPI(?)Qwn>@8x=;O404@VhCTE%ytcMTr;TP_>iXwET4#+@21%jgzWJr?rw+ztgGbq-1Yd@st*6 zTVLvRk5|h+17X5F!zporb)fWAe3FhM&qIY*fK0Sf@pH>MY49ZJYQiI$JM03;tD1-}!le-@23i`Fy#M%Nx`S+7YwszbzAh zmUDyBl}~b9ShW^&2`{qLbEuH5{TvG_%gW0Ph&(eM6`wDew4rGRbvU!)JXi6p{sOHW z2346TgB2uZ`$aauS3^Xwl4Tn(V7B|QG=XzEk;LC+aMi)?26!cAwGs6ARBCRpUmUGY z1Qws08%k#cy>LsrnKZy@w}>5J$cp%Q2yBF_ooqcnrPU4%V`O`(Uh5x*;4A7?oOo)v zo9tqejBqfZOiPyo{)$JDOgNtyR-&M}4v_MCIA;DD>ry-Kd)zoS$w(4_=3ZN;AF#gb zGr=5Sc_+#io$%^^<$8F9vfRAm5r5673joNk&8W-UZD(%aYo1C9M;6rSfZ0bR)s!6) znB=8Z_x>$b0l}Jf@@Ei6<56Nhjvkd^g<@O$CFoXuzvVqG9Ft7^Q3gqh3r(|^V%a(b zR_KFCxPY!kPOysq`jzwX{ilP+`?Gf@=i}bsb%*zBq>*=OH`mwq+x2zD^FDHS@~@?> zjU8?6tWT-juMbj{W7gw^o!k#08Q++y!Q za4Z(8f>bf8!g~;<{p*|FS2cZG zm$uxnMAqn|1HtVO&<)Jdhr)5X9wSbY+18Vw)NG``sRAf@2RD906b$A z)SUumZ5(4T(qxp$Wro|yFWzCeBbQQF*mbQD*S)Gx7WZig0;yb`q2hCRG6N#zxV{HBS z4VB3$xCqp3k(0zTkiu*(>@{z*Ba*MFQ`a8;^fE4Wto}&5Ga4h-=j&c=K2L)5A0(v9 z{p4I++uYnB39AZIt0dN&>>vcAn5#ZvgEjF8XzPjCR9NFZtvis~F-kATn+EdeDMSrx z_i~CjCwp9;qi)Gm=u9*#fkjWmYPeeMq zH7&30Zp>lvdFrKih;ZLqA1`A66uV;(U4=IMPW~ta&&MonI9*ow|4P)L>*tTb)QKy% zwbQ`P1LxK(d8*I`pIN6OZ1?Foe4QR!#R8F3r|st$-V&}iy{iDFK%6O8ST;e=Izkpw zo+2`0Ma;(X_m>djIh%k6Jum8gab~)ZWxs|uM);C-K*wTr25z+{sCqT?)*Ac%HZQsy zKySoz!RCeitt9c;B&1SlvSB1 zLKax`=21^iu>2Q zswTYy%7udP@KAjGkx_X&+i?$nKoWlqj<)*WaV{3}vKfKiYd-C?K0#{Mkxkb>4d9r6 zp;&Cp3Z$>m!Jf7UxlYUSCKM@UZ!gH7n8ac`j8gfS0=HMR{~R%tmcCXN4g%u)Y0t8?P;UHq)y|a} zif{Btb0j`h4g<^eWSeC`+*>l~^oQwu8BN2bvQOc8btSlr9qvx?!l1yLqn0i~%=Mw1 zXC9WLQfq$T^n>vIVkZ!F)p=1aKb<8lVxc#Qtr81mQgv%%Tq#fWn3h<3FN$teyp>53 znX2j_7E&;ElVZTnnwT4mcBGZUApRJEvQCbPoRR7`o=_=2r^O4!xU=6Ur^ZO-RKy@C zs4yF15*EB_M&gw9{Upe^8pU6$@EL5vyDUQ_C^hFHY$67+T=3Gsodw2wUrW*x=Qj)a zqW~s8hC1(Ntmzt^A&O%yzP`!Eq|Ck;RO!V#%vVChE>^gRc+lmOij6KA^IDL84V59J zZoZj338A~JA{5Gm>Rir=lzxho0Eh3-%Q0?&ckPrS;N@$9l`5k@&_HVl_E_nfMNddSdd9k2azp%u+5@nyYg}e|Bf$@-Pcx)0vR6f@#>3-V zNJJ!zP-`#hm{(3n?@B8=WmyByty1xMLgsWrupHeKA#Y7`ECRfkFw>AA-sEjz?pW$_|%?FeSt18i}OM5IS>9eAqKOfHvS zXP1%D1nAO7AEen2qwr}il7v`}gwf2g99#v4*B0GXTEw|Jn(aFNZk1UhTpS*w2fifl z1r?D|2iu#}=lO8!%qfqBt05@)`4F5Xiw#?dGDdmrM>*-6H`WNdg%tj%iM5}OeI?g9 zdbpzb$whoXdW5s^qx3lw?r%p0Ofw*;FsvXrzX~7F$sXXSW!7@dTC4L84hT4c!Dj!; zzh<=zg0BcSYgkp0(F+NyX9O&>9uauQAI<;X_#Ei+6$A}tONJ_59v{0kb=j(s@s}g|X3*@!x>|*_o18LB6*vk8n7Ar2U&u>1NM72h zMgK}MpI0xSv1k&=cP7|)bUa+rKFQuk5zR(9TUK;N8Go<6yI<|ElC)CFX36ofb+^jL z02b-Ux_70hBbrRWjoPteuB3yb21n@jT3jb)Xd#0mvHg{Diz7{qdB#BVf|G!)(WpsR zeVs?{qK)4cQSXgQuvek^fs6R+vU37AsIszZGvbK}QD_t=+?5;3;q$=}Z2Q(0T;LhY z#RR!J1n@GmAQ>MUyABo;UIRgfBWT?3bHX>FYCHy~fZi z{!hEDexmI8cIUn`tFw$UO@Y;6;hq}g`q1zJgC8kep6ae$9`QGpS?tK3Pop(0IZuRj zxSSk6LJ_rR&!g0&`CBto^Lml`qnEgUZ;251k^Be~qox0Rn}LYCFj#zMN7wXNs1OgP zz4|fvWQvTJ3zfI2n;CKv3fb{`YdhuOq%j4WPc)gq7dsDI0n5i*p+_r0H%iMLjtC;z zPAs67XX1n7m_BQh{IQ3y?b-O5s7jHTTO(U2A32Oya>#g1MFio?HUZBDiJClB_8?B!qZ_$J~OyxpRCc`ui(kX7j(R#YQasXZZ1i2sQ8?IVv zu|D21d*nuj4>-@u*T?iW)gKZIv*|cVJp~v99ERvz)mSiI)ORpDD|m)3e^6KXTzYW_ zJUCqguYwrAY!qBgDLae21l2MyZxzPIvKj+tyCy#fJCl>WQQ7( z|2GUu04Aejiw7Q(8ws)LXEhRU7%2D>F%#LlzT8&ouOdXoJ55{gvA%qYw&jTA)ja+E z2pv}EWMfb-*Iyij4ZVpbDUJ@-=WyCgH9|u1eDpmz^ zHDOjsz^I5x#m?eMG#N5skb_En?d(_4HW5Ot_jE8R6LWc}z^wVlmMINj@A0uE$MK@i zU=$mW?Nx_oL4k@EQ3S4x7HvM87`XdIE}d%|TNjvSy&TFgA!Rn0jkaFmUGAWjq>cu} zL#&20x}q-Oy^9`DQwL>7y$hDV)jv=i;(zq6 z7ALfWkhN;1a<*D~bbP_Ygw+|7P}Y!UkRo#)Pj&1$T>+6|9BH~ zInH0vX02yY=X!X5ymA|k8I}Xjh&>qgXY|EXLEZ=b6-YX#n-W7maT;+EOsAHFJ8w+4 zLiLD~x6W>i^arsUuT@(D@GsDMvjqQIRYBQp#e9jZHKT%A)VD8k5JychB05nM%wAzO zalX(|R;X`?-d8a(?F)Q z!-|w@iH_`?;ot0rFPqA|uih#(&0QZjLdsp}Q$4CjFmSdDv1#*-n9+(GnM(`m4# zlOc-IA8D}Q<7u#@WQ41i5H69Q#{D)UR&4s1jeAjRcEeU|hAdhC30_e7o+B=KrPw*w zd@l|#m<&Qrd~Z`21r;FA@Aqkp3S!9eTle3hy@T)5yyCz20HHAiMpyi2NUdQYvBN}e zi-Ob|2>td*6JjtLd{2Ijr}Z7>W@(Lp(0o}yY7J`ASy;jBmqel6YR_ z-#U+fi~h68=s$}{OdQ8ZFNft_8az9zpL_rz@nucs7!9;-cOD@TYgTRRd@Op8rAw zGNC%#uN$e}VLMf%4ijF9>J)&ScXrNwV#Z@eNqID}v!Y)SEwHx!fxb=@srLy;(W;Pm z&&_Lz?AK#&u1|S0>bxy@zfaMkW$&$5g{*voT4#Lnv!s&tVM53h`=y1p9uu--Xf7le z$>{9m9-_dn`g#oS5s{RKIs^bo%wj}7KkI9mWj0pB2;G5GeGfa7Ml=)TBDU4fKT_x1 zU0q((3GVE}3vRbFKj}6sK{07MVCw`#F@>?QlNX+8vo0>E{N*$*Hlrdl^vtUm?*n<7 zP9l?H%ydRVGO#Ewtf+y*TbzqG<%B)AS#_@Y^D_9frvRI2e1H9{1jxZqHfv>5He*#& z2KZlB$W_VS74E9!`|JO@xo&U;iSpL_O?l6zrUH<0Q!y(8_av%8?KlYF;_5;5fQh1X z^39^Wm+RZ%PE$1tJMgL6_|(3xCGh0@4Gt}=r=QO`3?y^}iIGC6C+FiggJcJ>h3?~v zLFz76MRhMe>n``6b1^a{Kxpn;U-Z$}rU6hiu*@GBToK59qKR=UOFDeMy#Q%~i)THM zEV#dQ8?4;#KubiNQDzn-?Na#VTrsSzjTZlhP4y+~iXX}8pnWjdJO5m6cnp>TM0+lZ zszZvEzVD^7=iT&D0{*Sy;SBiY{mLRLXJ~V=Z%gzEG=jX;@3GK)S-d$K0Hef-20i8Z zXRvd-bxL(haYLp_jo+tdOP^l^n=_M-lqS?CkKj@JoG@;BDr(4p^o)8`MQ(4$u%0a1 zXPYBsS$RZ#*_+#|n!TsK#xrsA9sOdUdKIUvA4zsOI{JSB1MxHw^vZ zRPrY8x!dOy@!4FVr%~zGNZz%S&&VhUuGrz|GfN6pBklLKug@*6kh6)9pPQaCY&^zJ*x4&x=B?QZI3C(@dL8@}skcWh8<`gGNCO zL#-)7alNhqL=yNhU(**w4)Y>-X2KO9ZV|$|RCrEwzA%os8DaCpX`r}_wN(fE)=mUC zd`D6j)uL8eKJKkC`->5^9pa~ivWQl!(yFd;w7CA&_YpB>-oH@(ak&fWm6lQKyo7!C zt6myH6E>~DFPN3&!xb$eW~^NHbW5GD+P2i{0cXYAPR$TL-aAhde@g1tgAeynATbBT zLNIf*AzG?AY(v$5XA)b}2@v-Ld)Bbz0#mQs)e3p@UuSD?g|59>xZT{$?jmC&z>Q1< z;mV-Knh*^IT}f-}8_pT!E5XSxMk3zN!J}ljaa&naO99|WHDYxUW-F;pR!hE5Le9Yr z=cLBMPRqif%FT4rZoj6^IB+G+dfxYc5d^G2t@d!-I$%@Vb|129nkBA@tlM4=dm=I95^%>csK0uGGg*!CqITn<8G^?(<{t7y-1vXoXtk~7Y3j~GuArck0V;CE z5I@&aA+BxL#6WsIF!3=n7}9nowNw8xp}q>U!iO+X($(VVDS^$f4Je2cOHKVn9r$DER;H5IOTW?RkRV_rMugwpd9^CVVDq~ z9$NP$8cH~Py=6*{fbPOW-U)J_@@1f1=BWQ@Y4;{Ao*htaae-;xv536t^LP)+hEEU; zWcECJU==BO_+zD@dR;XsUW;q0+$GAq>9;1K8*{i2y3azcEsq%)_51X5cbtwjY^oIu zra&H0uuScjT0xdP@XiT!3ideQ zgb}2}uJBxkf3d3iZ^*qxrWPhDabW>bNmN9FWMgX^ACrQLaEN@AMnamSp&#w#NrGSo zT-fg0k4_9Kw&$QOmxZlTTJt| z5V;BWOXwh^3`m{sU=Q*2NFQu6I_ht3%dhZryuzvRKeR2J>}F9aY*Cr;0F-H7s$mL0 zG4ab0QG~{P6ub3N$(HVDG7JcfT6VE3Swae0Qs_~fE2Hwu49P5HF$LvE2+$`|Ls3tAT*E7FOwUVTO19A;&0Eh@XpdF@01?9L2&``n}>K?m(Dv>AVVf_^hLM&c41n?{(qr{)9EDU1x*%C(mwh9=wn>}pKW zPJYUqo-p2v61XWH;t)dfB|2wrr@P|`V~XSR5_*6w5oDYY6|2QteQXw2CVW@$)iO|z znm$+B767P^HJ-nWs5&-=Nti`C_-U>GaM5%GnLoa?oO^>G14H%FO ze%Y3f`!SD~F)+KjFgX(}KDVXAPVQ7vhcjr9?tkJi>5W8S(h&tsDx)wMa(@XPM}n8* z^4k%RT7dMMn|XrtWAfXHAY>tee3uk{n=VVLOaZ%5_1cD3s*W%B_1c6G(+~lS0lSOi z5CMwGh#;kmIN{Jb1bcY)D&jUx4Tq*{*>LKgkZN7_kG zchoKcVVjuciKtyXqSp7b$Swi>Wz4q^crZ1rk1inc+woOY#Ql#UC*rj_8vg4>A6$AR z3?3^95!Xd&FNz{7g`vVu1XacmQ~CSROqs0^%CzewhT=EVw|8FTd#1G4#;`va^IS*B za}frAJ{|@SZTu$``$k{XYZVc0=-#!EmcI7Rd5>%DSt~h zCjK|=y3Y6Vca(>rQquRQ8FG7yN=#T`Vf!r~yeSytZ;5*TrAyK?{LlP7G2!tagYO^3ceF`RjJLkFJsCom}_Nh*1H;S-0c zr0q_#NzQ|rdn#Aiwv!N6{K@uiAItjg>z{6MSI!8TyTukka1{^FY+cm>T-VcGtakjc z&X47P_n!~tGgNvgl^e}u7z<*91g=q~A1)Mvfwo5JSP>?@04)`^K`AZM$N6(5kHa8R zdSWR7K?Ak{jZsB_)8nvAZ>P7v`rP1B-pwt?MWTPA@@P>;h6xLDJUc8*9`@eW9aj+o z{gC+cz$k?a47KzQ9M;y zOWv!m{`K4W!84IvAVuXOn$)*I$p{yZ?i#XmgTaOkA2W9&_WT<@cIw8i?RRYG7(Gxd zAxMVP+Iu;B`f7)5%FLIWTkVWydNNR}bf^FQG({^Il? zu?DSbDDVz6Li@5@>w|wiZK$PG} zo5olLF2nwwh^tO$$SxelfCSX5XJyL|l(0@1S%gu3)B|gW!@&4WNxB(Joe6b* zyxlm_NbD~V`-4~v#?R}U{rdWS``d?@18)~BtWSXb9{scM6JrRu&UF;+a%wOh8~3pk z#SbpRVYs*w4L^%=JeGkP!EzkhtLBFRXk;Yn7iu@fKICf0t6+vc@)7pdf%SkIh`UB- z+#47w#gEm4L9!2NwQ|LTv%P6@$@9Q768q5~y8ngs-jLY{&m^^{|oHpL@Ngls>$%4{Stt*%^vIHgjwa{7jFx6tKjU*4i#n;TSu*#C@eXEXU|oUY9vweHamxG zM67bz&Nz%?3~8%VL|RjdEAL}Eyb6kHEWeYqOmuUy+;iILl;6NhvznsSL!)5GibE+T zmI7L4%>PS+*gh%sKfoSSvpiK*3#D~P4uGkkK0J7T9!i><_+HcQ;A3+CKU^>8ovmaO zRL~uP8parwe`g9Y>p-9}xYzw*pI6SmJdV-nP)mJar;3}cjHF=9K$G1clR)ICT5~5U z@?JPa($VS-`tB1}{jY3+0HOd%qwnxzG)(;vU02_amP7An>o1-HC8A;x9v9Zqv2RXt z?mvwyz-epQ%yBBMzSo7MXS8c#gMCu$A9N~AArvWQmy)CrA!#~YuC4MZ6j2y; zm)T%fdA14dQ3C}za|t{A`eQxI@a;z4u20zPE{yQ;*4lvZlDzLy@#OWw*6 zI7xkh0~`X@m*c=pyF*DVJaVNnjQ39{Z(8tkGl`RB^s>fs%K{rneJu2s4w*kVBv6r{ zYPT20TQ_II!?pIuRoz>Jo$DUkv3))l0Fd7zPW-iu2F##a7CQc)5+JN#yLL`k$v~MP z80gJ^V7iMh{&?Y*|FpibU?!FU&v;{T6)EW%?u!e>GI4igARucrW$_1p8@fAmFoZ9% zD5;cp-65uNJ6rM|1-wPEXcl~M&|e0+Y(yfW`HeN0ozud0rb=`x-xEAu4iTpOf^(0R zPyDW62!vh)PP#T&edZ@L74)wYisHNjH7y(P_2sfK<{}ooV>ec+rgalZ%*K?SX|;eW za~-ptqoyaNrRpV#Ds5QK4xBaZZ6sGyl>MbLeLZ0U=RssUdI{sLi_r^8<-uiH3V6!0 zM|ZTDXY@!gyCeytWhv!5lOLogxLiw6bOIx(80U({}Mqh5%%2jmBh({gkVr-i@GNXsg{=eY8pt1eBw-1En zjdm=&%rfTxXS`=;{{MjYoPPaJyhk0!cp3Y5@xS9e2wVi7xRw7i-ivbmUwBW>_TPAq z?GfvL;ypK}|KPo#^*rMP9VAvjq10`-iE_;?HTgD^;TP*KVow*O0;>zYyyH_ylC=~W zJqlKJC)d(3s~;8DunimV?+kxC#an7zJJ%_ESHG#(BG6Bo7S91Uj5&6;83%)_k86u3 zmLKD+RfIP!Pdvk#oxKI7DTdsl5k~3v&x)_2Ktmu8QJxu(%U2XU2IrbxHdRbjvlZQw zLk`heRqDCw2OUag-?{1}jrpMj2qlPwI21hP{%{ns5Dpe6=pKB@1XMImW&uX1P}`>x zC=={-HSUqDM@!3I+sz{N_ce)=I$ge?Vn<}OASfE*3$@)AjD$#k6}SHz-qSz+KjFRG z5VR4YvIAmqo2vxmy&#D|JgJ}pM?E;Qxny@~;{nV@{$Ux>rtHPObH9q*m_~()<57+S za5#SOjE3bdq1IIh0S`WYQ>RKGBZJT29A>*s8X?djTd_orVpO0Fff6eB6b@f&#n3r} z4Kw+)M3FP-MxG|;=6I*%S;iC`+=qu2d*XiLiGh#r?k#Lw@z6iEz@QFVle5C+aPxNE zk|jq7AJK@bGm@f&AM-Eti@-bM<(SbBI5DDvRNE+H;7IdzyI}$SG)DTm5#GqM|gDOo#kE36GMZUwd)-<=YR! zXUp9%=0kY*8~UkMlNy%7GN&m9!X*(dAg;q~-oP9q@Vr^sLXTR!XC5{>Ie64%v&oW6 zb3b1Zm+EtV!o`WMcW99c_K~r3o|+Z^^cAXr?yn8kp)R+>34CxkHa4i;Vurqu<&VN> ze`t@jvBx@f7j`)KYp*oRC;-ju>4Ml;Sex>R!qe&Zy9VG9-E+r^4*ooUUhHY^h)A^T zxM_jX^Vb35lnF{CK`|4*4mz$DvSwSM*T2`@M9lk4&z7W&td=oDNw>+#gC&!@cOs*I zraq_^w?~pNTfF<%di@N%ZG~YW={F~7?@@e!q}wRns_&6mO$ETw=4&5%pVt1nf@=o-=JpzW$Nx{;B~nL3%A^z4H!?Xtk``{8LLNG-lq6=5_ysXEX7#?q*go+Z&Z-H^KZ0EGtqlXbA_fs4(c z`cb;sh`Z9j+ndY5)U`-8hPMabDnBI@aIX6GP^r7)oUtkV;2NYZx$13d)j2#xH<>t9r;cdWv^6xikZCJ@VVETuw08>4DgyF+}LW+iXsO&9bAhT3USI=}_#)@r&)w+qhv zlhchQ#JBRbGJZIH3J?v!MztlBG)=AAQ?b#5vT>7@V<2I31%H4Ug{AgGX&&paNh9Xy zr^Q{Oh)<&-Veu~S<*E-%OiQZ#y1Tq?DgsBpt2OpZ!JA%A&0a;hKF()mE_i86zCI=n zuTOm8c|JE|1Q#YoGn$;0%jGM%X)A@`Lw=FirQNc3AQ7kMt*|8;1^DRMtv5@f=o?!i zHIc8cC^!47%FcaP_p^65*2dzS#V$Y3_Wus+a`0k|M^^IjO z(D|%L<;nRlD%(9V<(0nl{krP$_^!nMWIBKUcKG9xjcir>c(#LRMbh71mZVSX>_HUmyB=(|s<%ROsy31s3 zL~M!^MQhH+l@lXeGxU-_X`}p7Gt9UMib-zK7E5&ks)v&OD+H@Xo0#U`P;7J>P$};0 zs}N*L>jH_O=`S+SM9nF}qGCljI%l&HSkPOXtIv-JxF<_?&2>#WRBUnn1~~lnxu2Ik zK+H@aIIv7m!M?F{L#J4>8a9SuFc^gwUI*wjEEQ7Q9A&#*N_S9cpz3nc(?yds%>^xQ zObe#XMi8fX!>N(_Z>VZ#zg=jLVHih322_K6WkdA~FL*H32#fYk$)9XbP@+xe^qzw+(p zFBLYmpKN4sC7CCGZ9If=_(7N$QgBRT){ykw%4Qv1p%Xl{QZ-hlGGbgdd0I2LLEjfX zOp&4od)|Hfi&!!HWc2uCX~MFgu3aGwWy&VNjem7+Xzi_*)>60inS%qm*nM?p=VK;+ zxl~=wOp{H1gVCIfVL_u)I3u$i`&s@rlYaOydK$t0;&#DF-J zs{{xanK*6+hemZr|Y&F5Ax?JE> zQORz2?NZJ9^ZtKy-D7xV&9*4u*tTukNyoNrqhs5)?T&4BY}*~%Mkl%HulG4;AKX7# zg*oT1wPv0gqux=sn*KVL<>-W#O*oMp=SLM}>uym>j{jn48x!!Cv(}YWnC1Bk%RG@X zvRve_w(I!qwiE(DpKp30m#Ox2$6vaPdxR@>8%W4!cFAX%s|jC{;o;Cq0aPk(e@3VElXMT3FB>if)B$G-(D1T+3_V`<;;i*I!oc}mn#2IP{I12 z0FAGQahYrz*dxpxFa3!6hoO#61#oo+L1I45SDda2iX_W~EJ4v;IQcA#y-wO*paN6U z?l2)sB_t^&;-ORxCA1fDGGrk1zJyhQ*t>&dN@bfu2GPZyVi8W%F$2-5t9h0D;a=Wk zmv<5qm?HtLRP@tWNKKkSR!Yn4j$u~iA{w#?LZ}{vWT0e=x((AJNvv;H@e5zSiUmW8k!rN<=Rj zyOJ7NtKzx5aD_=C2!53wLxsroad5u>wHNFBVfCcL6WrnoBWtUgKMwV_!t5$`>)pZU z{_&o(6(c?t)YJk#L;Ijf<6o)Yl22Kpy*fWf)P`Rffm|1UP3vqgR?!a?| zWz;6=I09&zxe2Q6vk$8RYT;FsT|ytsE67Ip`J8iCI0Bzg=UjzJN#$XI%&;yJLT(xaIm#rnH4iy+FoKySK?-h?H9dYt5uN|wp#4r>UO@gdBWr4_?2TV ze^Y>vOL-Qf>lAQ6ieZul)-PnnBm8D_=~fjOHgEzbN8W);3^;s784l}!trKs3@je?x z?5GLkGr%hQ{d=7_A-j@4YA|$GieaIq<4XgKaCHB@OR7zcK5(u8Fu*R)5^WC-qVV0) z$dCgaYEYcfSUqbyYA1GBH5G8;)=e^BbJm_VNy4m8mozwD;>M>b31K_$Sor{md%{o*+6SBu@#!S(jCUM9bo;QtB|Zp=<|~N zP8P!owezL(m9aGMFk=mrFFl6p@>h>(d{t)Q_c!Qf8BzWpNoOERx4f1_{WX0a(xVwZ zuf~Ek1t1H}bNC^jy8j|%4`iko4hfAK5E)W7{#nsIgbo;mejiUwy3x>;?eS$g`AC~k z8HE2WDzINrim?DitH9fYH zm1*|#>7><1qI=zv|3%B>WFu5peN-*JnJ>ipb>hO&?VhBKcaDd5a8nu=5vvBOyXx2P z(qtLc^bM(r{yU>%j6wf||5d$4Xo% z;J7hlPO%*K(Oj}H2IpzZH}Or?CS5E~iGySG2!r{-C{ar~HPOZxG)>%u*}pL)>qxZd zI_?lyl8GY$h1=6gG8VwC)ckyT{aM|>9SjShXw1@E zr7Nh~V;PcA`Zjye$pQ(glU=I;;MJT_a_HFpZJ_=NuJgcXYj%EV(M4X_qb(^E9TJW6 z0(NuZ$lKjpgbq>reY?>LuEWB6HRq5AF^>lGB z!c;`D(lfUV2C6XDG~XHajKbn*#!ePl3|S0QDCt#$B@MuPYYqDc9RFP>3y0RRbUp}k zA$#M?D-BW;rcvl=H@ibebIetr20Sku2XPpKH;2*>&KT2^hPC`>RF5A-uRysnm|Qn(Icve0Jz3;ZbdU}Co_)MMr#}2;27K@A0}X9$$+FS` zK%kV(Uh;s-0RSnqe~cJ_{#D9Y*hZtraC-MBlahcr)V-G&HG*T)X=ha4X7E0{$;!fV zb>`IXM&2$fskQXIf&*Nmesfzp^Xfz02lvi39!;GO4a>r-%HWt^@3v9A6*<_82V{e~ z=TdIENf96+3>C?zYbwAG0!`0}fjG>a1WLcQ8@c%5J({I!i2R*^YNPgFUlPu^(e;`I zYS|<#(f=KWwWPaGLLNgR%sq#I(RYNK2d_!;omwG*u2(Q$yN(WiBsEZOSm>saT-IX# zklkjZOHjeD0;hjTLr7Tr?q$GTe*~B;QK;W_W%EfDN7A)99K$a~)T?rNI!Q{=^SKw2 zCgtH@+<8C*3U0}}lR)8}JN*}i_0iDEeyOk#@UTj>hTVe-_|Tom8Et>cyiZj2aIcp! z-JEqxhxb=I2pyUfAZ#cmNJ4LJR|P!fGAyI&O)`ZzUn6-4F|Pq(aI4n(wqE|-j$2;; zw*tkl-R!^-7sLe7)iPuf4Q4y-vtKKPnZCx6FbP0&!?@^^qxGJyU*xd|bUSmlo4&uc z$Qk+@8!K8vloF#``$!m8`yQ-Uga;!s|ERFEgfA5)6AjJiveVCqSxQZJe4zm-ea7ip zwoP^nRE@UCUJE?^aw3+HB!d}Vj^ym}sID10VHmeMCk@`J%B_81$xU#cNbf9HlCs`$ zbZd5bo0Np@&9H6q@=3>bU-7&H+DJ6|VU)VCGU zX=#eM;@hc|=M6@tX-=~II2E<6beg{D!1>;*lZ>^W4HBn2uL4~EuD`@*zVz2j@_*^C zxyX3XkSINuJFfMJdJErLVfq>7QlwcPa>~I7V3|LA>j>s>73~2 zGP3z+PHXu{-dXH8iqpY*z_sl2h_uf1#MeSCJ;n*?djXCcb8 zO80fs+*rh;fX00)TA=Ggb!_Q}A9K1|N;H%|7!54}Tpc{nl80*Hg@#^D{4seQ|V1cVRdu7-NC3D9ZNv(@S zc}E*TX=oWgBznL|0CQsIJZS~{acu{~w=eGX?etEl`Iln(KUpEz6j{@~o-@b!3O6`M zo#|~d#c`jilE>rUMZaF!mw(SQ#8K$A6izO}y_zWmHAnsS3%8j{4M%L24se{HQZ2)e zF~<{TQ7rabUSttsvPmVBO`83l^hbM*-h62Gr|I%Kx5mUfZCCPJ@Cz`pdad@NvmrVIDnT8{nLfR{o;nw9TAHwYW)qnCr zj<`0+|CSdTo1_P$r0a*2P|)lH0SHR(ZohB!RwE@h6p#lz4KGzA!mPlZWVj7)m=7+V z>_OXkjRAXh8FF_$Epb!xn5l)a1C7p2@{|V8+O_5S4PL>tP>LKw6oD2}ACh-<2r*@! zzuNb!)8z&~4<_X+F*L*Ql^DY1`$`EEq zdo>hI{nn0mWsMJpi#f(Peo{iWluuO^9+k&kZ*1vTLRXVfNqtvxylJj(^VyLJ61wPK zEaZSD?`<`{YZH*WQR}n(OTHT1g8q^()_*5o`&QK{na~wa5*J`AGPl^aYBPKpYykFd zcU+@6<#fv`D6Ze(#sp?vaW-x!Ms9}3u^l=(aKRRB($bXb5kR7>LgfAItl>rz;!$U_ zsEg-%Vjt}(YQw!|&TfGd)fG6wQL;WccaF3<$A?41Rj5MvFoU~O168<+9nS(6R~J|n zS_X(@)&46pgz@j0q4WQp8A3`F3xU2@BWh*r3@uzQ1z8~>pe-XcJ*G7wKYSBMH8-MBJOQ*LzDOBPe*j1EIgDMbF_MRgMJf$oL2y(yol_ICzD&X}ev zT;F!u)DL|bUJG^3e)>$#X(7Up|zgAKIW;~Vpwf?tk9xHLhK4mTvTYcdFW*5y|V zz;7zT>kXtO$1pU?q29C@+)FUHCg~SizWwjbh;kXqM54?_Xl-Otodu$`HF^~HH4GA^ zeh(Mibd^d!`AV)?z6xczlY3dYHn?^1Jxc%I>94v8YJt{D?(c~HLyI^KKmAG8>d=Jq2NOU_06t)NiTfLt8VR**W7U&r80{k+t#X2U0~J>1V&73Ot!*QNX&FSohSl6@Yk)c{V=>ZE z$Z6{ENvpSAqFenFXhtKIEINiw!S4-dVNiY11k2vBb?ntw`m5%Zrva-z@b=P=u}lgR{q zSiI}tC;EDNa^G196A=CcUF4qO{?r#(P^O|mk$^AXrFQ4yhS zUjw+M@*4l6Av0}DGulvAql^@$M7}!Z_wjBeP@(mSeZ$zOw#igc!EZVe*fB{@T&7!= zY~oVb-yTgg&=$s(1o$M3P^C^tQ3IYC{Z-gZ07#J#SnUm6C4$Ku9gVAKPW_LcN)Ylb z1giRalT1F5b_sD%nnjjZ9Mr``1#4n_7D}*L1s25F@+UR^F0|{1-Iy$6{#dz80*NMD zxkaC?DFo8vptd%srR7HEE({$Wycnb^Q=?OOIco#5wk;uS0{D3`@Y(Z=>?RaJpJ$Ix z8v&*MeYUC<4#Di;TJzlGe35-}Z$#WVe2qIAExXP6wYRa*A(F zvNA1EGWFr!65m<@@!7++mYcJsSlGDTC7HbJ%AH+TTK~NzIMLY1|oH}4MCETn(DB!~2FE(A@WJ6s=8Zs;d z*Lq{iWcTn0rw@d+AM75+W<4ALg(yd@boqUZX(Ts~>&e_(+ZGVRwUsz%&FXyj(ix5L z2Ip2pCH`6kD+H`6nTZK;f;%JVH=oFfI>TPau(<1(t`_%=PJ)nP($70Wbi#D&IFxO@ zM!pN<^AUVv=r}$|^{aG~+c+rEJ_+=cCTwpdoRJ=}KQb9qi3@lRH9JLAue{+B-395tW4>j{#0+Mi?qo3et%1?~bNYnlU2AY`N1*A!2pFX-r zYM;^_8k%-`ZPvNv$0OASC>Z)OU^mA%bmg=$82Mi6mCuC$|`E1{O89b4cS2REazNmyL1ZPBN_dsn7llF zWbNc*WNWl@WNWZ%WF7EurRJMa;0`+RuSWw>%GxIrbo8m#BPNV&2x@pW}Ory>Ox2d zu##ZT8iJ&SpC(yZqY`;Y*2rH;o&zX+5AC8wRDiXJ&w(M2ZC#m{IPim;aLIZEO{N;Hw9|mE6u)6D0yPT0Iw_%{2lGm8?bLBf6*08u1-s= z?vd(3P=nmjBC3G>_0sbEiB?uVvTk|{_mA+`b{dE}$kO}jG5?On@TK_*2zsY7_y>~` z1Sb*Z`eUvQqubT$uo)6J^t(#$MNtPAQsc0d4c?^s6KXqrYTmS&P1UDDi{_k`FL_lR z#`f+n*6Zi$%~Mg+UecVsvVK8Y^``l7{h=skacU?FWQO*u$@BS>Am|HTg}8|motp`& zX<<#78G)b5(rGN&jCgz{-G9{iU@nP&hSc8{X2NNu4{H288vNWgSmd#48T(B$atfDVGTO|D>=hUXR@Vnj) zeji_)IJQdvjl#E*21rFm;?sj@DCkO#xY$g{PA;4Qlx)mBk+BI3rA3?{T34g7D76yx zLY*lhj5etJq=j9?HP-${NiBKMXao1rU`!^-ySQAg*z&Zf#$XS2mha0Wx?{2bQlqVl zQCpIEA!8f>&EB+gI>M^-yhm8jkfSa7PZ_v&TMs>m%WaB{Ql|1AZ;x+Y?LQxtHpLP` zoIq$9MhqNv6lOsn>wAbmA^7>kTBHh6gje3Wj|CM=p>8xqhlp8P4HAC5Z}q~g$Jc;P zgI|nE?PVSEm}Ejcmqkg)7mwGKSljIv-2r$+P*-ql=D+lh(AnDG;A;FN?!tpz4+J*~ zRr!q#l5eDD5{2fXULOj0f`^3ys$Xos-BV`)4QA9o>|tIYkGA#e=XhShJYwFOg?Wq9 zJ&N_~4pyFIJJISIbso82eqzdYh27tZZzIBL`XV(JqKjCwK0OX<+C%(>!s`Do6t8lK+pM9gGo1*!5{+{fdR>A+yy-|&!Ao`s?6%22>e z#Q9ypQd~hFw{@PKNGeKK+Ey=8j8J&KzBP~3yb%M^^G8J=h&+;H$AO=7e$Vg!y_j1> z>$ZPsOu!rG9wlceUym5IARcMl;@C%CE!BbbS9RfzYkcUO?>-Ur67alLb^^biP8!aN zo6R3}TA-LT5;l$<_0AUCddjgEzR@TbXbB_}!5Hfi_2~I3I%=)!bw$O&$Y4&`9#)UL zWR~dG(a@QLWood;cL|&uQ@g5HR~R zYBgEx(nF%;FlBqOL*~0(8p^ToD&v&ItjMNM@d(n=$37 zNoA_rjZ+IigJ>6JCv@_u0|vLFfLN#|*=I=x5kA*)Coqut(T<$mQI?F`Q}bhQQ(8b= zA@TsDTy`fV40$h1H#AiJC>nWw&6z)#DRO}d-J=pppb%L#43wurfOMKjr@0dZE$94P zN!UgOrFIukhhi@Fbww#W8R2@Gz@bTYJ#rq^^#ZTV^Vm3XWDvp6`pxIq9tto1M}T=( z{}Euw!mG{@L5rBI;_B(pIKTM8PbI%G1Y9O%{T=^DfaP(^f6e{70E?ag=65B4%$5)VZOY^yuM+1#mcI4nTQCX0Xo*!UvnBI3 zFl4>fq(#?j1$($S6GSkie|7~Z`Fc}3zvrTLmj}KDr;8`x+;z4hc*%C$N`BV}r<;r% z>9%0T(DaU)j!ALpnDz6Su!P@kmPQiq2hG$TujZ8F-pC{#QX~C{RyopEvBgLt5kEPb z>l+&G$fy@VRb%@q>Hp=&f(c(>F8}zkG*1ADa6$(>orfWbu>hxtF*)ApK z($`=HpO28e+Lv!qIf4?pJ)qn2(mrfjfBvq>$Ck_G%Fp2h^WG(UZ)Yw6y0r ztoX1or&!&gk&Aj>T8?S4*jxXysk<9&1K;Dc};hCK}(v|6|hLo8b_05LUiaT z7^{W^5!6jJYOM8NHav|cPxiBl1LiAVvtEuKKLR>zJQOOQ=#+oXJU&&s86S3sq;_Ed8doWKe`SrjprUI90-5RnwpPTS+DG{0IBb6uC+%gtit*kjuald}x89^O%AS zqU=dEfl+yp!IP@n&xR+`ZH1(#&qNAwH3a2OEq81lq>0NzfB*q$!vKt65*eU^Fosoc zSJ#R22`=W${xAt@OD(O~X4NWiO)K70|JRzO3WCPwhw3MV$dl;~ygDkd=+RI2U#^$g zR_x#_Q*S&~#%70Izpmc8zFD@L*=qB~h>^SreL^q!EU+xJAwHa&_`=U=Mq7})=ENhK z{b>AwDf?)Q78!0(mG*V!N8^a&eLXm3k_t0MqtGsgz$vcOWT4o3hQZ-l6AHDl4-BO$ z4;?pUI|+>u?V#tReF7s-tRYXXNHsFnS^aa`Feu3&)tLmZ8Vr^jnft9C?kqJ54y5-fD0y( zywISs;#y!E{B=X5I2bx^}(1Qu3+YsMb#TH<9vr>$pBZ4ry`o)V=(KrF_UerF5p-BLrZGkvN;u5C%4yl{}nEkT`H zY=WF!k|ZP^vOvm-PD0A4t2m=)&Tiyu8=`4J$bhEaJcwd~a>g)hy@~?)l_q(7V4KdQ znaa_K{Cah{08;B42}lN@LJpg{HJ>G!_DYO$aYxUs)oXg^+v=s__URt4n_e~1Lj2oa zHLq(_d@m6_uj}Mbysu^l$ny#*pG$bG&aP4F-)8>b51kt&hgV9@Px7yie_dio@pYxD z*Ev$^--{myhv{zWq`n65I|hd7>gfM@P=WUjwWOCwxX9{D#Gi?#ujjqq$_&!oAU6WV zLTbLBi?2$j=Hg1I{XQ388k~;VHxqN9@Npse#+_ht(?EO@nTtF6HCht))dBn({MqFH z&qxuPWxOc`gvD%j4Xb5Kv)V+4g^FsSF#V`_4ND;(Q5ZC_F(!3s zkk&|0Myio2qf&&LP%{BB0HhfZMQY6GjJRTvveil8o)Kn7tOtI*vksE=a%*bE=PL@@UV?;Z(c+yToJooC)a7M& z=LcrKV9MnF+a7iIaXq;8D!e~+^Ck?ZZqe}`m=l0yI;XJbT%BmVF` zVF@!jFp4K^DdFbdR-Cv{pimF$O`q$Qqhoca!hbp^0MM?*|H4<&W$hE&VdBd$t*Qn{ zU9V1w6(sP@I`BT4Phl*e{U~Ef)!9?F9~d3HkY6mPr&5(xF!eF$Vk)dlea;xr6#M8wTcD++l0s!K z;iy1SyD9!-QB&z|22qBhs=Rfbvpcb0QeM_feehkyN_bx8UdDlSWd%FD2j%9d`J_NC zWjPs9Tu{LY!s@nN)PWTQnlD~y}Ih9{lH9pp5h{=j&-BZvKDyQ`^#?pTAQIDMVE~gQq zkRaP3qi@e$pqO{iFImA(-*R?@GaAB1J1>z$ zg9$k}YhVC_;y4!Z25T7qG%4D+Jr>2}_IO91H9jZ_h^=sJ3I>sv_d-^{;Wq3RtcR|V zi;EqcE~3iKQaHu*TVo4kL2Q&eg-U8TL@Y512nHxiSc!%IA&IyHAZL82v=K6_~MGMC%Zso)DfX>Z{&iduC} z;hSSqS4|l;VZ+>##bB-0!JFdvg^-I7W4H7RhB@k7Ee4KU0}&0_IH%Y8stn5hT=NT8 zU><;qNh&h|1e6{2i852)PoCgjhA-lY>a| zla2L#bq=(^dKW}jJQTLy zm|&ue{csfmw z$rv5Gf{TU`ej&NY*js35v4}vgKNG4lr4#wp?p2N)JwDF!uo^jRD7j6_*Vl2VUw_g1 z`+Y@v7o+XtMfBlQqtF9rt}-c1-800*sVzm0%z}=}^wrIf+?#96P99~Jti^uXWwSN} zK(Uevg-f47rsx;Jl6F`#oddGbppugVTM22Vn<4#vhQy+9ArMNJnEoPrzAOY2OoWyu zPV4~Lpx7qT^IH4ZNg?TQdTL##VY0Ry8Guk@NZYxhuxZjjND!=jK!)QFRY@@v8D%b$ z3JyGE;40gIN12)Gi>OdYuH-xs_PP$)BQ^_`P!zUA4u3O zEXXSs1*Y5i88Bdu2}l954fRt&I1z6 zbDOdw5|+p##ki^lA@6SnnQqzB;~xE)JS(OS=78j%GRqcrE>-f2u?QP$&a$Lh_5wC* zunp<{J}83_+5#~ID@kv;YQ8J8pjem`B9V^TsvI^C(}kf{Nf+F?I3TZ3`DvPsV)ob; zhPLVqD+i^G`!*{vOfVTA(vp7f=cor=%uqhf+_s*EXp$_`Hvw0ApA5r!ph+zB5NXc< zbOw%yHH@gz&p15;4jcxPXD$H0K8!Kd_&t+m2GIr%!eoq{*%UQ1lZa?U1lvoM}eLO}otXVH>0w1qq(oCJ|-#`g?+x@go<0{Sonta6Llio5JHdD_*L zXhk+!eJbPgG)pCd#WEgH_YH-JhTrkLf<4+vRsAIdYV*oJ3pxj{8!!u%w9E$Of;(&0 z%pYuz7eAM9YH)d?8%!`Clny!W;ht_K`%43q3Qe#Rz2U>kgJS_R5>E+h4;>RyN=xCur`+|z*=U$<2xx_oqCo8HR~WJl1KbF3e$?k1J2gx0(SDDQIs?W3 zph*Fb2ic_|2IfcVZ)%5%aQ^9TFI52-2T+Bgfs)-2w)vX3YTSyUTzM0*P)R|&PvQb| zNHS-`K_8odHb!)<1nwbDXLbkuz-4p{QiJLu4^bd;-KhE6vH07;)GN}9d5xy(lA)zY zf52{Szp_8WMeV8HJ_LtIJB#48YivFysthwik7awqYLa?bL#|uVi$y8Re%ooWqc1pC zyPQNMnG_+g3&mNu`^s+seS9lz>D-$=7mXzqjraWM_5h6vE;QUBK*lvhiXA8#0m6=( z#OZFIO8*#5$T2`{*^ElHRzl(`f~i+J%laE)I~r7idH6+qoBjR@r~eVD5Wle~0HI+!%^YdltwD{#sCAQK2LW`~`D;#-`$<5N4Q|QSiuy@L_CU4N zufuo%@on#~>_y&FhVU;uy%f5K!8bh(<-2$b+&zVE9$gHx#*oAk^we^Xm6*i5Th(^IZ?1&V$h=s?CER~il+n!zAns@KN`i`>b4x@3bG>wanoeFW$t9fBTYaMjttQPln83WVo6;*iIMV#-Leg*T5i zmU{IuVk`?7tAV`e;08_A1|j)De6*UJj-13q@A)D4*C*Z1vY%5W5r!ux@265ijnv{4 zV-4H2F=t2)5n@C5#_M+pD?96m3Bs^j3uM-S>gOdRQLV`KmSZZHUs8}>;DN>jSt;tu zK;ukuiBC`?@z7S?0)r zB;a0Z<*4O^+nosXImi)xaPRbNz%5y*=bmTZeQeJC0(yj1hJg)V2l36kj*-G3lsZSm zJM|qIu>lk@eq<0BXi75_>Hw5+bTK1aWv=(^&71Lyu*gNJSc2!cpFJl8Yh> z?%0HhlPT%MXrT>c9&FT6mJyXDvHtyF?XbMv{Ug##uo8dyE}&F)dREg?a|?@!VsNS& z{e$!5*>Elj0m5+JBMjsmkY?}1g;KoVx_((2VJ5qfqpjTgPL&QJ0NH24!hRe-ktWxM z4)c124U+sI4JWQhkPvFwS;34B7o=KX$&TSdS|sR?hG4nRc%ypJCSfHFDY6pa8dz8u zB@nh>IY@MKj%5bE&K!#2kRDIW&#gaS-pql8!;*~{G%^9#FuH%W4LJ zrzHEn^GtT8lQ2uVZemHGl9u?y%2I7%`CZ!`>ZV3R$R%+qcJK$=q*0ZwVliBHCPz2b zf;YlWq68O39}4Y^CL3F3xr9xcygp&bLUI4WNgt=o!L{Xv!Mc;h_o82Hp8m7^!_Wz# ztWI*O+m&aod5Ay*ZtN+$MV0B}6Dy_*9LuHZ?UE)L4W&5-vmN`IFoKSAv`yDD&N)CO zJ7&V=t5HIb^ejMtLZDEx&7Jx2qf<^PFge&I!pts|T%EYhn%cl{<#T?YB1|tHXONFR z#t>g;9lHzjH8(gQ!f*+=p!H*}Fs9_4{N;i5aZ9A<&nSBM4D(JK}w96LHvrV@jzTyGr}>jWH!Z^9-*;V zFj>825`RSCmqp@K7;L^-n&Fmp@pUBgS^h;xDy2k=P&!3LGxcKOuR0H~ii`W&b=gxJIVjU!+G%kY zWSSCMh25R&4N;^{2u@BxU3uN@DA`^GL6)q=hX+PbWjGi9e67CPCd*djYJlyDUWLu5 zQ-ot2>S6NGdkNu?l65utIu2c6@6 z81+d4(PO+QFlc+foeOU81!i|DKig)CI=8m-7^0*bM+8fdu5gtyR66hku6^T70&@`| zh#J#*2Fs!g4Nd>v0GE)OLe@7*kd)8Cutb0NK(Z}HADf>XCY)z(al=fe+9Wx9W@pHX zp~IeE0V-MW;XDolSO~G-z^Pv~kQjQ+h;`1AVn`AmLlUMJ0`@5FxXGl>kRyYMv*KZ< zPXkUiC}=0meNIPK_c4&Tubw@Iy6pcUzt}lU@yW%OsxC0sXD)P$hAeJPYY|=4M>1}{ z3YFB!+|28~+B^NW53=v%B;*`Ad(dOMtu-TAgjlf_glTwzPNQ4iv&ji=!pWiMo?Vv+ z!SIt!jw3-Fuxy4<(uyN>O6e$SnBGXHB~cZX!omca5)l)`$0MJpk9-|Nc8Dbo zYdf1^D0!E$yl;Km5r?f?Bz5ii$&wU%v8#Kz`YdxYe(51u+y74--Z8cuQ43s=g*c2* zzVKP;ICoT4UWb)#vY5%lJ_9(8B3)tJ6c1$7sZ+dKM&&z=dFUqSAe<~z(J`cu0IwSV zi$@>+loJ)?kL~6m{vfdbydOE(-4!84U{X%=tR{JLs+|?DCfB% z2oF+S9m#jCZ}FV>?hQmN*b)sKS|vzal$N@5Nbu@8wsIv&$x2a&aMmtCa%0**&+lT` zqB@fUgrAeVcNT+5w?e^I2LvFC@HwW&qLT5CyA_IHHVpfTkdK9tBv&Gv^m;runQx^! z645dm!gT1-mG5D@Nz69a(59dodPuoJjh3#sV3-)zw?x=5+sK~=IlOwxLT}ShTt~EYtCp1kNgvt; zaGjIA7)%~WH0jLpnbLhsVKBh@!6T^TE3x)X3Wm-r*q@3-5PIH&HYmd=F*67th5}@#$dgW zJj2u)-r@}D?fcD}{nj9(*V0}dGT3uFX`lkU%|XiTi?ZjWg!29M4nH@rotLI7)?*L> zhiipdYe2wEn9hzVb8zDN&Q5?7V=#xm*3<%MF8r#_h^jS*z9ICOej!gX`87jrRxyhe}A>&s+v~`B+(!R891G#JxW_}O z(o}&eAtP_?tq=(+L%_?nmXMgiMVP5?r4VyroZ_UOb(R$bC1$C3Vw!c}8yO``ns8fj z9qUCA85`Av1(=Hmv416m#eu%|`3h8st>qV$LV{$Ovn8kSV^7Yl3}#+~$~N1ke-m-Q zunbx_UZLJq0yj_ZC(xPYL@FgvUg_`g&SR|{K__-7RL<(9OeEX)MZSpe8W!M$n$LT* zgTNfw$GBcdm#FYIGoXlBZ2eKCl6MC&;k;)SCRw=oL7qv?qTptYP;}renfOj0;5ajlD%)}LeEKk#>&8xRx$X%9ryF38zR3H%j=C?RR~iVOkZYEqWO zrpQ|;z37`zL8bwJK?%yPqQ3eb(5~IMd&g56#@1(=jjgUfzbZ3|ew*JD|BLoixFZvR2D{;lv}>I@-!z9Wn(e`Uvccv7 z0YjlD<&TQK?O4aOo0ZIp@HJGKM7&_6$=V>-{aI3yAGHkF^RD9#!{v#goWU7CJXpWev$G>B zSfZNC4!m2L@bo!xYyhRRTB9Iw|n66WVs^YDknv zIe9K!7OxJeJqUM7IAo|~?QU2!+rJdO%d=L!*f5tmtf#7{Qj>W(IxkEq>PQi!qa&pf zaMu|84caD~C}<(B2yqrAy*jCG8f|(c58KF4-Bs8gY5rD|h*lSz7ma3sQluoSF#1MvFLi!e#|+SYj6?yzAM%V^W%J%e6p3Q+;1%ILa}X;f znxMk-v-6iIB;;}_cKYa=xH{56=!0}UFz9MHw5TOUo-s*euX?yt(aHM~fo>US=CT0{ z5v9cq&i&^*l2)~WbV+>(svVa`cC`BjYSg%iDkB{onH~0s&dF2N$_b+9g5FF z61V$|-LXYSC*SI3_)bSsV^y3~RhSNyZu+K)Gh=p?z44@2e^o-*$leOMmP;<2@V zqV30g0`h+4_2UlMAfT9kRkK3Tin|miNDD=Z z7k76k?!mRV6-{vn#U(&O^5*{Tz3=lp`6HjrIWxPPb9QHE=esl09LxlMAO0iJ#rm(e zkAb^(`vBQn+s2;08Dy&B3rtmoh;(|Y(kzY6m5+9aprpU2g5jX$7BZYmsDFQtB;Au4 zYEk8z=CqFR@6r%^CF+@CLingtg{>CB43|^5ELcE{4p&_h6@*E>!q7bM`>tR8wQ9dg z_gh5m81Y%DtM?AOoz>LQb}3l~VW3v{>L*!z`V&)JRlU7J)OnNtA0ET|eXZbsT=#tN z>DRsp`eZBNhK1{50xa}ib1g+}3hRvw5&!!PR9PjZ`PauNuNPh41XS6UW8Bu>ygw#= z9k}cBH*yY2cPsr;ie36;@4>;UZ5MiAGk+M+i7|B{r{@B^I`n%aQ8oC2_wq&qGbQuf-mwHvYK#Y z*B)d4mx1iRFaB>2A%j{-_W$&b09pJ0vi=bMzxs?Uo(n(ypa1aRw+#QAytw1k`F|N# z$^V!C4%rHpR_Vg^`_aVv@w;{2nf^N|DKT=om-S}kg>bAmGDy9@X%us&#*T5c2X}$S zwYeCBz(?`Kvi@d13c@TM(LCGUHeEeEJpsVEISiDNLUaR|;!r!%E%WA7o1B_DN}uH} zQk$GqKb$R-op`{{OKV}9NBtlGZu=bxjY`X>sXdS;CYj_=(MjrLmV5hkem(sO^)&}7 z#<2rwnC~fS^Ly?BFqy~sVpB?!o(1JeVxmWd86@E#`O- z!8V(b{i@;^3Kn@WOIM;oT#Y4V6#&yDpT3L ztHSaf5)Zu)c?LI|uZnVAMUU!77lY1GlB^YnNt=w5$h;^x!yQwfn8zI>?iN)@I{ zw}R3!^HJmB?g?b1d4e22DEVteSfud83)6uhu3hb_s89Jc!Gg$f_YyNQYs&X+WC;xr zyN0D4DcG6wJq3tt?#VX4wrini{;gKe-D@KTOX#M=Zo%>mlF;-*-U>_%qP^9Pr#rALrUNCC8G@edqg? z!p@RL1xI(>PGzgP=w(4mm-r^6V@p$$$H_W`ld+3pY3?01gB|j~iUSguLVb@(5;2e3 z%6nZV0aoY6U~~v$ic80|rYJE94ykx>Kpv@}>im2hq0jtjVWdn0PpONM%Y0OsRGR)J z87JCf0eKw4K6Vu2&c0|mNl_cW!%LxHuMKm=>?0|W>_T)?0OT4f4nD-A;} z(St4aEKOoGM*7n$q*V6+k;?IElnWSC4zwCrwBz;ia>XU%Ncyz~8R(h$ke& zs_j$+-Y%-U7^hL=@fMZISe=#cyZh;A=O@nhj;b#z#qGzLOiFbx`JB}{(w6^Cv+n8F zvvt1N;z6OasTeoJm5QdY>kzb7s7A-&FJYBM0=r5~BDQMw>OD=75?=$T|E4|ts%0ct zKw>wHLbw?EQcO`y6r_=2({Hz*4r#`zA`godI!lKO{;n=@%U0;MB<+7=_`O0JE{C6> zM!-xUt9jC}M61`ija2r_cM4w(dpMkZ6Jq68r4W%%ur;997`Lx>^RDA1j z%R|OYNagbPf6gG3$zm~8Gl)PUQ(t`vBDrY&o>bi6{z~Lr*4VhV-6Dj^RYw%;rDZ0o zKNde12>_Q@YFn6^8HU_e6kw*s%ni3~l4(ksRvWDv=pI~YRO#qPSw<{*=?)e~2b{U- z$JS}O=Q%2)eW=zV#yl0Kgx2T+)O>iVaKqQ`Zq>^=={QsmY%Xf;zv45E!=c1VK&~Ub zCs6G78c7BtE|jUU5WEWU6ykz-g|uh!+xNoF?_UeaQji|BAhXxjjlW1vY>}^`@OThE z=b(PYSWkiViXY5~gpkn8*stg&(R4FPX6mV#=*G8o)np6e$BL%o{@kpflI!yN`(!@bUn%dCR44r7aL=7*w1JEP)hY0CrY$3BD3y2U z8gtV7z!cMsjwo#`=xi+hBBt1rzS_x!-NSf{ISlA*D2|3|xu1iFarKxR1Lb5XIr+m% z&QZFoDYEM#xwh(<`Y~^Oc#~X~(-Vh_E#K>VIQN6@#`wlC9MeMbOPp}nbzx& z31ZeH%{`ohloa+UN|hQtfzMsewfkE!T^?ziW7P!va`af4DmnuqQE`}`|EwtfEMsO? z&M*dXo{PqD)3>u8@CWyD=$(rFhk)HHhVsxIzy zrPjf`D|l^JSXiAa$`~6bFtA6Y&CMcQ@P{Yyu0jl1sSl2oG5+<2n7K=(T8%UJ4a5SX zx40tOyjmVN)d6iKnD)yUsldIpvh!;{!FSRk&%J{XdrX~BZTmJzWJnI~q>mq_;H+=H zd}2v68bPeCcmOJ!f zc8PRA6c!GvO-ciZ~D#UBqR9^P$ zzEoIKxQ;cGnUVLmA#Ofp%dJ?Ag0%;_Z=xPwoxQm$pj_}@OTW@pXDS{M~Yd-9I7>bd}qAn^ZZKrH2o$`4(Y8i!HCLDDC%(2kAoF` zVt3)!aE&&O8X2rwR;1RfUtmj@9q3^sT02T~>y)aiz;5&aOY6Vv_?%9rsMm`%_!&O# z@%A%SxWHbssvi0^r?moUndM%b5RZCP%Mh;hh)tGBJ|0o-U&W@Dz^mVkQf@0BoD_em za($w<%L^znQ-0^Ftm43G$3$wmZ~U`elV$NOv2JRfLI8gD2fi%Gk^`m#U?($bg>7lq zV7&a?_B(mWi3Tj0XWK#6$dOrqywHyUB@EH*WUg#( z+WqIbL6w+|z?Zc1WW42CG%-z0v%+`{uqXfU&Bmd4luwkQ zQSD*7=)~ISq{XCjX$i5CuI%FF4y)>ge3854-|(7VhsHz1QTUQ~rhZy;$}6Rz{!Zp7 zK-1v;AZsQRus%?EkjkDv^!Vlt{-sveM#*drTDwS1qdIlxGONtHj3TmY3 z7NgTb-tq*X6(h61D~FhxQa{Yu102rOT%I5lNMzt+tdEkZ`-y(L1iYTydr36I0u9mP zDr*ABV-QtRTbSI$-ow6Kyy=9kG7^s1^1`NVW;)iZnJU9)F%BGq-ux{2rTWARl>fp+ zIyD)TEXXh~mzl+~3V*W@cXRuFgRyp-?h*t4?*2riY7z*o@vM19xLqT976iQE?EweO z(g;z)kt0Mf-2G?_P*VgdH*+)s8Ur8wlE|M3N<1mj1W9vvQGK)Dx}k|aSy_HuLCo+r zT;2hR^@1tS7ccXahlS3R3Get}Ts(47+plfG^1Vdn z$B50?&N3xr9U|>M`P%=bLfwKY5H|7%YGKO9si#-ZdRM-{heKi|@aHl}= z0~YT`T$l8yovK`xPi?u6$~8mgKLyVG-B8Hu`gycOJ6h^0!CaG6mv+QAa=oRx7{B{S zUUV)RZ%wS;97VfK5^b|-0u|a$mtu{*=KqIQHK)(JFKH2VLop;BzkRz?WRY-0QaFDw zt?mo5%l+O+*vRy95Q*7r**gN9lYgeC<20OrmQ~$JDA!8Y97pY%lyVRj`MBXnW!B1B zk!SX4>^t5S@YrvkjXKbUXzJtJbX+~Y0(0p&Vk6E?Zy zbY5*m!eD~kB@+vhsc?H=M2;(h#^i<3qq}9*BfP+fAM_v9SF|1Aeev#bHdZAul00mK zRK9|lrUI4kOYcwj=v<<`)@A~*7^(KHRluht#5=LjiIFY1`#mDh$nfwK!BYC4*WR7G zUp|-q>;9gycL0z(l&*1(w${cn6(VLbl8G5v^e`ln>;KW(CVs0qJPk33XbA8G3_Tw zGI#Il`A>terUm9LN+9f*UsRKZNG8fwnK+ZK>2N%0sCl19Xt3VAXxi_bky!?l@}k{H zVT@W}2wScy)_+Vj^&7?Fw5$Qeg-&K6reYDRxoJ%w5nB(4*vA7q7$kuCAQT?`KQCr4 zVy8Lbc|U7IA}pKQ9Ww3l03& z8d`K3+n(tHlKg#VrNUx`~Ep|0_ zA?|=|!(6h2{0fn!6zFXxGOHbo-(F z*N-xs&)RKKR-GNkfWwR#;UffBffX2v&``O$lj(!o5B>wLQG_=8qEXuKdElee+M%W7 zOpM2=lKbn#P2wyi>uS7)=QBvo2r=+jDh8cytmrzh?C=%XQlfk89gN1ABC7v zTAN?l(*n*ZfmW*<9o*hTKgM@_}hIw+){NIgTh<|HP zj+GbvoWE^D$}xbulIcxmP%oR{|fK!xeE0Q_0s&@)J<| zQX^5V1Nx-$CPR7NrZfi{wcFPC+@*vpHG6$|d(*6CY^g6(afq%s8Bg$WTKA-sfRHMh z?@e8xmHcO`rX7Uuj?7vkf(Hh0Jb|SI*ueqyv)$Xm47oes}FP=&!40#180v(X0NZ# z)6-s@IMlJk9{2YDH^RwOVaPt2!8&lRrc(&}yl!WIm3vP2VlFFe(@U$ASt*_$8FL1m zI~hH`+{E}l_)eGKl~4%N`BMf#mgThT9?IN-8eFmSFc|6l;Q!5sQgE< zg%p)3J~6heF&O!w$)1?D? z1Jw)1<(8{c{+G!H7iatlNd~9XkuOvQV~k?OB?PFtGAzCq4)O%Vz4pQXEx1j4A56ll z_G;Kwuf_yo!<_V0sHOXTGd4sY6QcR!UjM1Urm^7Q$cFs1!r($`X%-xZ7*&xuP5A*| zWv|*|y96Gk+x`XoF1XkOYH3{E0sG*7@wY(yDi-11OM$GYTnz`6y8I|x*RHp9IEJA- zR6MV)S-SGM1*CD3b|n0F`3k>(y!(auvZN_bOi9qiG;FdtpXNq5RY*&A{4zZFmx>0_ zwWI1m)s{1VD7{gMM9&NBme|M-g@rF_4SD%p-%KH&+w6~6Xp)-FbC}FsErrIw zw+zJJ;%xX`T(Dlf!{QdzFmcnG4M@uVjPm5CUlzOC$W|gF{{2<|BmPD<08tiD14_n}*ZgOdb7%!Vn5+YlS5w z;|_mhH7fLa!XEUK-{<;6Q3=zcCe>aA(-iBq`o#XppMaWFEd1_gB)+(QN#K%>$ ze|)m%wZmu5xhe4d8*Oer0|;>ZCJry@`JIT!%-o$q^ud6q`-q7ZY8RuI1XsBg48l*a zw^2QG*0+!9qa4fgnJtoTF}|bx8$&ajjgnJm+mLnyFUQ&?pvjGqYK4Hj9Y%07^&4ho zvi1&y0LaD8A|7F&hkXD=MUeMWdwDI|oI0$;?_gD20^_qX=d>$3^Cc1O&YIesY0ZO? zD$+fH$Ww5kTTb)#aW)*zc>;LnjJkOY2vEd?`ApjC4P?Aq>*eA7O~EBn5EjEr8(}Xjmy^OMd&J`KCqo@@h#r8;p%x+U1d82)Sw3Tobk4NIU3rorJjx z9&SY0>0@^ZRiXv`5pKsnso2<_2s_qkBY1pQ8g%Yn#J?r?8I;7muNIoyuCvC|{cUp} z7&VG?hoi4jr_4j1lRy~h+NB}Xj%GQp?f}Gkro=+43Cu!B6IS7p3R%BfD7Iuv{) z$P#sNqNxNEa}Mo@F)}Z>{;9DFS;a{s7G6QYU|G>bg)K&ei3R7{>k<UzTW?wgPta51c}xW>mJfG_9D(uU;IsxA*mEIMG+Vxj%@I7l^ra#NJ^# z6?*vpyOrI!%w&rg{3xoaQ&_?Jj#VcoEcr|Suq-S3+k7^K1Vzko113J!9ybf*-Iv9D zqaGscHgxeTZA;`~f4h9c-6yWLdI~YloDHzO96XB^_dmeg)U3tWS?s?qSBIICAc_#} zn@8z^b4+~i@Q3XkbrlTO^_88?z=G0C!d3gmiy_(8yD`>k@bVYNc$IO4^ZApNtMxZ+ z#5|()LYNGdEVDQ64xkPqA#&f@`I`D79&vYi37839z)}s;<-s!wSLqGP6l4A>3BYjd zrIWnVO?2Exy()@??;78a=%}M}ZDVD*UVKaGXEIy(MX`v1GY0}&zVw@u%ly1P_&wRW z$hH-GUs?%o`|8>sr-obQnPsSG>Bsr%+4#=L2f=T#DWxD3h~3CXaoC*mBbDO8!j8`ugi#{Ns6dju39Xo=xgeNG=-W6RRA@kq7lKV-Mg2F=&(ptlA2!Pf|xUyC!#*@9Bi`x3oF<($ctkVa7aeL488X&Y31hdkWwJarv@(?D1HMf;785h0b}U+m#^2&v zE!Df;Ckt=(?XCTN%vL>D?Ady%f!Co*d@K=r6%l_|#Nbb28?UfRu(^i%jS8C`?1!R6 z-12qpwlY#}{!^~?5_RHDaPGGOChit_Y^zxC>MdR0rFU1O4qFPHrC^fKyeToCM z3VxEgNaTy(?F@}LJ@b5T4yKxp@}Ra=|IQ&|rD8(o?w*==ak9)t9L=ER4B;MPe@qW3 zpHNaQ+c0J!iXfy{@QdyI_sT4MX*fx80b@8`<%DDgqIzhIQ2+em#h)_UZwZ$ZOw)>_ z4L2U9B!gVEMQa{ZLnc)d;SthbITWB+8?d@-zidt28&s#L%$2Xm3|zBHobRh-IVx5%3ObV?g7Za0|!(*{{%#E%e_}pHw2$KWbBBP=6tF?IH2;f}eJTr06 z-Tv1wEw{#9MFFghk18M=_`ZvWU3NyH>a}OV61r_FJwM@SM3%E@kV!DE$@D+t#!`pB z4@Q5O-{W6wTbq{d@v%X<(6iX~nOH_;=@+9XoQP^yEv^j5?GC1`muObDJ51zOPOGQn zY{l?Iq{zI*3MXZ16Dre<*7s39&10|Gv*(m+o^R~&ImV{ug!p-92~a8E8+2-}sKxQD z^{7_pX>HZJR?WsT#QYYUaZ|93P{?z)C!YN1#mKNH_DjT2{GEFjerNB6FNH8+%t@HK z1Gb&uOG*G~1+!SfVuSD}MPf1I$f!J0_M{4@cU762UwO^6R6NrWX`FsOM1?ue_I={; zhL%tH?uabp5(?;piGI1Z(lp(T)MXoZd3E{W7>h0K;3c7&;z(G6f*dM&uvBBR`0LoPP3 zyIofG>JXF34u$DK>)l#4-<)dPq@?Av;r&kT`6+^itH>+))2LP@8hy+EXM_kZF4_wagZWEYe-*o_%9P3Ch;Ki$q|dM-4d#2 z)H*CL3fSqVcjTwM3q4N+8W{3W`q_>s#xqZpF_qiXi)6rn-12?Y$eJeeb5~NEs@mWhD(h}Cwc~tXy3Jesw|mdI+!-cDR81sw$w60<(Qxo)=FHi(&l_rK zLK@dFX3XWakN6B9dj*=PLuz592RFYTw3$D9BR4>DYFb@JoXS!E1-)A+#JC&tB-iT4 zJY*@1vZbnUlpVaHcVtw#PNMulV`7W*Ye6ni+0wF^1H?dWjak~G^e-|gPVgSTfK4|$*FB)vi? z=(>qWC=vhzU5v|{ak^|u=qzQs+^?755x@O)Qb;z|zLX{8@<*z0j;kmMlr}OthS#C1 zm9k50E8X#$i2T`_z|{@Oce|@YJrmuYvw)?R2QEMV>62Z0{<$x%v`Yx8Lh$@#051vG-*}wWG%SdJNniHP*uyigmT{Mlxj@{^Y$yt__Cy z`>v|7blft`>KGG4heNV2-ewl`!L_2TjArSh*^BRUZyh3K@#W-068?5;Q0t{#>>KAN z#De=<&RP6*1@4I3E6;G=8Qf;S#L0S%w}Ugx(1QObD4kAshZA4BETmxdlir+c33rtl z<~w0R>9tW0CZU|fH7&+I70)@sHF@RL`jF?aXIdBx;l9MzRMeL?=(>GQVH@` zPV_DOF~IyLua71p%}0Fo^rbIYVvn1Md%!q*+Spci7efNym9oyYinTrUicxtScL=g? zn9NV3WD*%sm~5t4ava%rl~1FX*VX*_%;J~vF+dJ`oaId|IdzVR`3>T?@CM-M=g)_y z0&Mo?_r%<)I)4>vllp7$C5V&ITpgoEM7l_*9mjr=hOZS04}8y7p=Y6+iV&M>Pv(5h zDS$ryNr_mQ;xv@i=>`6T!gnhU4Q#$qA0+U|4KyP`{qa5MKpe&lCOXVEVdBD)^W}Cn zWumE3wr!sxZRMt$eEErv#J-dd4p?}WtvutRk4IQN(i0MtAoSrRk{ykPx>VGT+7*pN zs(8P#WAdu{b9Jb;XflaYQjS4A{ljS9GuXc|Ic*;+``nPJxy#ULnnmd*9sT|C*|P}hk3XOmZjjVSYR3oyw7z*&op9ZCAJ zlQdCl9k9{8^f}|TGQz6jSFjZeI1q+3IOuk>m>_k*Gvcmk^Z`_0ZAlvTgRs;wdppe?OmGQ{9x{!ofhjYntAY0KPf4b`bd9=C zXZfSZckMgK@dl@H7d8% z*H-E*D3bxzK+T%xVMzig$PD44lIXuXlzX+eWU!FMXh1gq2_^3n(fg#uX;nUzCqe@= z)B!r~D^(V`sI<;^wwjj|$C>CD7eiWclPqqvbx5GCV-}0{BgfDV7pmy{m1gvGZ#682 zuWxB^6SSNEDd@e?__&}Z6OlESe=!nzun%IX{_7!=tKa!#Ib($nkA)}3JZ z)a2CRtnd`zX7cdy2*5Czm`$0kf%`VTZL8&p7@W<{Q6PuN5y&d8obAd-q!d@WmuZP9 zmR3qZ6cJM;p}u$FB#P8b+?MRE<64{snrZHlh57qIMM$Uz{)$FkS9xh^b-CqB@6*6( z4Zv$%{kAq7i}r0-smHQooY6b1(9SSP$k)5om!QXg=?i1W7us4@9lQV1-DiXC3O=9d zvrLPN-Mc$kOb8#nyNv^r4)nWC-NX10soqvoh_fP@Q2tFB8^y(Qd&{<`DAkFa8A-&- z2JN%2kiY*_FYDKHXt7x64d`3-A7z9wTWE{JV$^~>pl$XbF$2_Sv%d!gb$;2Af`9;@ zw+9;r8LvR0p`c6PC*C|+Zcbo$7t>wzWzLUh0KjD>TE2{`nzB5!2|VM+6S@PXI)^>P zY13ABpZyiAxp|81yV;lgA$m90jBnw!Xy0CNzhAow1Qs>#Ri13w_ifyf3CBEL1q`{; z76fc;^sc_UZuoH;s_M?wb9N@P*nn^gq`%8Si+<9k_!v!YF8)X8F5?I={9y}fu&n_; z%n!%413aI!U^G|;hfF+0&LChz)d~7H_IiR*netjWPm`ysyvE`}%(AWLG71->3vaty ztM@jqr5YYDN0r^CcuUp(gjWDN96aPl24rS{30?aS15oMSlRDPY?J>(9=s*sBp!Lr0 z3D(uy1EY(!R`5mvq|Zxk;_2g;DXM4$Y#1g7e%u}K3rr8*@*i&@Mu55)>uJ~iv_qJx zttZC=DhS-z#QjgE3IMDk&)d%KR(g4>5co=UbAhe%bVO+*YlBJkTob?)XrcUy_w1TDqyv~H}Hx4DNtB(XS+ zUNTcfLvjMAiQ6@@RqGnMY%Rce61`WAgHkwEGSp%kMt6Pp2W0GRtIM3(m95@Sq81jd zmCt;aHal6bl!4v78Fi1o(ygCYnisl0DDonlbiu>f@2UY$K?DXO82MryN$V7}9oAc` z84V2*wZ$Q4XQ0^zxDle(rXu+A;^cxl*c2-0yaMEWrUSZLCx*zS0;Qb}(Foe5^iAIu zw*8ja>GVb9OL(`d8X#^5CuHEEp?6PklTAqiGJ+7G1HwC_T{};en%}ttSpC$e&DvV` zydP*VLc2}a29fCl&04|LeJ$_)x*;AOrl!@M121~dF{_ac*<O4t}1sIwrE$26Jw# zn{n`%qgetDuwGSYhl0!6>$~o6u=*s^Aji_bY$)5uSY+OZ7xjdEWvuQqZ;r_3*WlOB zr|N7B@|bpQ_^|o@rx2c-zt@mBa*T(ZMr>nU96uV;3wy7Rn`sC8f3ZYluZDKfXj=Q4 zA@VvBsu*)Vg3`A8;2Ve3(zi_O#N<6~d$8wovFnOd-V@4Nf9PD#i&o!|i{#xw;pIru z3+?*%@>qVaa^tg~R~~zvA(&=%y`EbB+w=0;dQ@hZv^^}r6KEOKg8uy^MRnn?%W(hz7OOsw}uiy&S0N7VOl zlOf#t&O*pI0#5_fW_Lh(>K0TBzKVpFa(_Tv+&yUf0hxsT2hL8l+(7pJTO$?RDximE z0)W4!wA(>d_z4vB^!YK=0O7-T3(!|y$xk4&bMrqA3!9qECxh`M*vJYwk zUnR;#BBbGSI}L_b_i}=i>npf{+L<6Dae!4>~iY>Y_v5U4s5xJ-=${{c)(`!T-y;*rk&8q zRxEj|tmK`XT1sOEN`M1r=YjwX9pz|Uw=Ls$UZxhn)-ts~o832=3fL1Car zJ3FI=S&dtQbf7@iF#tb!6MENt)sy9qZ+9W=b=J&#K&oeN$>#;>r#THOxG3%aPquh~1cId<*0Cp!2dLNS`P&7xl@)ZSrY8pvk@bURgpf zboqnP^GybCE@-3mZh*=zya<6*MIUzx`e3I4+^hxulX8Jx$SDjI_j$bz`;Cz^ zs;ryl%<2ZbBz^m6BiP{=c!;nsY=&Fj9>oOx@aYKvRZI|L(K6LELr3IULs~Bn*hT$b znKwQ(!fo>Ffb{Na?tl-|Q8K05GFN3)IWikfj`up2h}zq~A&}wv=QQBI)Db}_d>Pcu z{QmhkTz{6@_+~ijb?|jdcq*;geTdLX3N0e^xW3#Q>j9CgA8d1VUbpmAJ^jsL$1*lp zDgeaJI7_ByHhZdBYq}*9qUMgMy#VD{dC6oiJ(BC52GN3#2-f-_ocdZ6n`e>jUw1G- zCp36tSp|=sY(ZJ{R1V(%s>4P*VD7W*m3hoLefV_Ik*8>?ptwCLue6oM` zwq6^e7OcVIZ0mdH=&cJfGHWOO7uj~MgP4`>xQbEaqKu&JYeNp&Hu#viy6T4Df1DLAgp|J>U zC2`Y}YF(_Ewx`Vrp^YU{_s*}dITWg&NE7(@Q(L;T7VyN(iFuLJdy*}QWhW&J4U1Y< zB;Y2Snq)uElNy+#2iBQ-Zh!PE`ciRw?oEPRWPG6zNWO&sm1}#+BJ9bPH>?Ovx;Lgk z;JRH2k)D}@Do7^EKq>$N_z1f<7{5&sm-a((Jb`%`DbDYao|K3)zw>o*XgM~ z)N&)4_CxuD@=22yxaVk=ZcpZ3RFbE3rUpzUcFofw50DBewFO2W;ZX;S$*!hEvs$fo zdTi`GFA_jymAyrSd#~e%EPJECC!l)>V;`cT?!&)m0vgyw>|ha9HW6tKE)~CH@KaX* zS@-iLesCt$#w9y9g~Z>U?UnxMR6DLI$xDLOP4PzMn+u4{ea!uvp`HHm405=$76^ic zOf&%u;8noZlJWb?>rnBV!ZL7jm3P-EKRtc-PTco-d=`@jegv}2TZ7CJ%t|+aQ@VL2 z{hz<{!Pew6K!FE@fK5MF|6|DA-`?$woCH8c&{PWv%$TH4M75k-XIZpcYQ1ZKqb8VH zpTzmxPAX4tq2J^!Qrtf*SOs01YL~4TSx_E#hCE5}_8<;m<$*<(5=(Q{Atvhk)V<+G(FgK-GG<71Lc+9uK+Hy%(F(K2tq=G@ZLA zi7T7;upAla`P@(7pU|6fIC!KP6}f^+hd$S0NYRG=d3Z9CtgjZkJ(0A$aDu8|Tw0ex z)I;}6B%?#6y?lN3N2-RbLjA$%%5kwYxdA)(@-;ktHEwDb4MsfxuDeTT$(aUQ?a`KZia-e0$u8c|u9Nfe z^^>Cu|DAi2AGBLHqi4NVeX!KjS;T3K8OZAyw4chgZYC`O!P6ai0VXTp7&P^w)$Kj;A<5H;x-TD7Z*XYLtqHy*9qrStO^MH zB$1nnz}V;NWW!SGX;J2jR`x>Bu6m+x?c)dskNaK?nj0X>-(^_<`Hj|sDwhP=YN9uzfT^17>3PSBCjHsj$CfjM-jDK9E0^E7tJbE1W z9_j~z{9!XT7pe$gBCW*HikDMjGJzX`jQDlr1!U_k(lySo54NwlQ$x!Z6uQoRWR=x! zJslU6Xn+UQZ$->;lWO-~PmW<}X7g`S20Y~25eii(r&wd)mYIjkvwEVR#5 z(`-T(8f=zIep)5;Jdcbs@`k!EHl3q2jMKvWy|$mKr?xlR_Uh|<{EPte(Ee@^)#Jk{ z(48aX`J|U6yn(0gq}%7Te998=j8%hmu{O7v)E;WRl3?H0=dyCCE%WEz5HTh?+jUNk zMmzfiO(>@_1Fkn*EHulwyp{e8O{Hys9!>ip>OU?1EsHLR3334sVM%$@9y%9eJA;i;7t(NurdMhuU;-cH79s-<#{P%yfDZ=y*a0&jV-?`w*JP$|9Bl`X= zXCNdHdw`xMo1p+_k*&po+|k^oSr1NcE4ZLvElqA~Va;yQ`Vz)cc|)l5ZH9?FbOaLE z3|{91v^>vZof|)_)7E#wVEgpSK=>F`^5V(aeXmy=xb-kNGzQ8MeLVbmhLO50mIw?v zA(U^8@pGENMwA>S+f0#%28LMK422(U7i=!^Uyk+{;0`_-ZH?V1pUpq&`ZpZKR_Mw+ zu1>;X_Lfw!?zpr5PGbj0=AGr>t-6eS;m=S`2r%fX=4`-(*Wz(J{YN|P%`g@zBGgX) zx_>t$Ff?HMCl!7Q{=2(z`Qf!20u61;Zdc&lZ6{SWg!XABqCU2dx1quGVJ5Wwo!`ca z(^IU`y5tjL0(Lw(#yZ<^Zt&EZ1L-+QAPA&U2WH9GK-xLtC^7%PuhEu$u-Q#KX$Wq7mH?DqF8LyCrDO3-dRtMZ} zsrSAF9les72adIay6o?)>|8?aMp}9bqAR~?>(ctrw4P0_I$N5pA+v<<7oCDJr+BlC)LldP?%;_4fNGW<}(#)zT%oIPOpTagNbCv%q^d zNneWr_o-`~P|ctJo)=mZo6o{e*<#l(;u&JQ5;#iJ;Q;~M!h2z=A$J!vxmFJqMg-Za zcW0pplOx1a%Y=TV`-l7|D)2$R)mF$sNjKs$CQ3C2@QW9AyAI27zGegCxh+=1O4z_z zWd)d(N0zzmlD>zKN|xAcRo&GP$kGc%QauzWkl$oA6mF{08hTqTCL;rkDSiU$W1)Z> zfizZ{t~B{Ak5~g^rQ~)xvmn{J%?_lno~c0nbXVdVq_>n+1y&{(`dw7n7aWVDQwMY| zkegQcNqcoD;|2r%Wr_{F$Hb8;!l^31pz&h9gSoRgg7c$6At&u3fO|x~EXYDxcR6vo z^ru|R8NjhjZ36@3D+9oVkb&)RP0(|mgEe6Y4?}RSVLv)wzH3IiOcuHriiVAA! zhWz5xDrajv9?x2GhtfXq+zk~R8CiYVNDj~>QPeE1q}_g>C*sbtyad%cmUPDNNlq!J zR+!!rFc6C=CSp##d~0xY7jk_~vs7{bOJe~auH^yE5vo_=kL~%wr|=hw&m50AprQ;S zX3-+i0|GX1e2$v}HHcz12-45@^W{(drJiqtZmCa}TG~_42{WVMc8LZF?MG`@*!?MF z69)Cu%2Ci=oC*HKVX7@;w(LDWY9iSjQ=HFzRAK&$;ex=N9D`;CQXeR4KaiP@xBAxGbOK;VYwmU!?krluXJ~~Ovf8O7|s0$(e zfU3hBV%7W37pGO5Ul`C1hR5)Vc6#r1872pg;CL5ArcwRKjJ&;3kB zSiAoD8(L)pTlLeab6*Iquj#D*s}O^eHO_W8iSE{NFe2L-BBr=rjGMQWR*||bW@HSP(=>~i*! zsyEXrkwXXgsSuFMDvWQgYgriIMlg%nM%ns@>s-+AqY#s$kksD}VKD5BH zzVrO_65i7=d*lr|KMnEZ{DaI-#(4Xl^2Oew1Em>$xZqwbhIhQH0k5VmiuFGMk4*=L zhbwgBYAs4qApG7C5Gm@qsM2YTW~jF}XDv!K_3Sv(GB;H9!kj|@?M>~tkbtsQfd-WkN!-h}dVU3} ze>dndaUmmKjADiFLb(d4@7h}nZJ{r3Kltxs7(OpQIg0d$)Ye{uDHbHinS8|>jqWVK zr0SdZ`|usGOfsV!fqXojTVVKT%{N2JqybBB>-B@7@j7`jN0hUVjSsQMa|~{IXb7Gw z`$F8)(L9=;0?NVFrwysb3kTol1(qn)@-DvzM9Qe}mc;nt+gEv33=i?n)b#Dv-z|$I zrWyax5&R*ALo}(L>_cU(vBjYa((}ym{H*dADx?Y)@>;VypL-tF&QH;0s#+x2cs2hm z_e5g60mCCXRoduqxIzGa_bF8&ByLQvD#XOKP0*q^X%Nt)|bJYrrw7|Zh59RMA z6QFAF7gzsZ03sFL>geR}ambbA($wMLRlXLKvTl+S$&oVVbhh(`RA;UR4z8+$g;5Ix=y#)42R5*GI2;T@N7 zX+RhLc>7hyh&IIX==tP;$VE>hj{LG~CD^-Ks&12*nCOHQ#jg)-_~G`r6OO68k`>#2 zkQFRKejNwhD^ekvSg5_gI+>n}q`OBQxs^BnazPMRWH)rd6xpvhz`XS&7Mk`vzN3Eo zRv~{|nf0`yteeHxr)3=#MLj338;>-06^Sp$Ar}ysh-+>3xUcn(?4gLy&k}0}|_u+q)La%@@|)i=7uMFXizi zalemTCz})_Sk`g{I%L!6j3wO-94DKPg|lAHkUt?$JfvBZ=hTUataYc(kj0En12}G! z^rs<0{utRj?{XC&CjKU|nxR6H-MF;QL9|gq6dy+O5YDzARCcJ(zuYih7E9d4Qth~u zs5WY$)j|i^bs!&!r{A!Yv6(d&`38TzI#Jb<-)xJ6$81J6Nz%Ui?uPOH`^oJ*bHIbT zu-xchGIct}9g*lPe>Hdc6*VD}zDH};H9LV&qz#044+{`K z5okt?DwN;@)C67fIjXxLjZN~!^PdfD=Kz2MV!oF&c{rR^T)GEMkOeLS`_T#8GZUTX zn83ew-n8ctb7sv*PC6OQh7Pv$;UmV@irQHPMt+ z^Y|%Qnke@dn_Q4!^jKNoDqx|CgG+u~+@ew?gEBL1N6BK=x}r>hW-MePYwf)Gmuzj> zeCJjz0pl=Pqz7_zkhwL};jC;KsoTWP6Qgu}H}8G|n}VsQuyhFgF#FkNAp;D@qp@?AVX!!wdJJG>%8(H6b4; zSj9q?xCE@gE=`s%ChO~lAQ~+2p5`-ioUG-fM%GC4$)X$K1X*&s$HlgCwTOB#zN0<7 zWZ5Hal8aOe^4T)R5<`;OA5(By+Y{_Z>%v3K!IAGWBA=nf*5?hm z<4roXpcI^kkRpPJ8We?u;8~4M%st>@H;@ed`% zQNIdn9y~m=@?qRDbHL-Hb$@&PE-;q3;BM0O>tz@I?FnLe^G~|fiba!gSgu5U&EJ;X zSRt{ofxpHyV|UpIAl6y1zY=I6g~gyoT(Q3KsF3d?iL30i)Pz?1pdx-o>B85OQ5whR zO2cJJM|UuifwGW!P6Q9Gz#9UdONitc2~nJ>G31Ar_Fcqnwql~O`cH7w5worp&tuS7?Sj|3}%#Q zla|gonGlEkwWR<$s4rhEnsWD(?14(SqjffC)70mcoml9{Ep>=-P*8!T%xEc?4csVJ zK&-RNKl_g$?m|QqpfIOy{5|Z2C!u01*}>z%LH8#lKD-AUB2h zp#V@) zj&kyti*h>~a-**%V02;9%=lwvW`IKcx2KSdGR+1WP|5*(M%@ZjR*vCv6WI7f)WToa z@GyjWNpTD`3&M(#Q@J`*i_h#qjSs<)h%&G9R2;Wy>jkq5JK_+J8Zo}2S(9n(b6My1 z6E{Q)!uYs3FKJBvyFhNm9N0amLk|e~jv32Ttm_k=&*fc z`$~vkeM6gMqs5hYfw>`hC^4TP8)ck$FCr1xwqdy&q$i@|rXD-yT30-zcBgBtSaifu znxAAf_EAS+=6^OoDkp#(Uu<3D_i&I{XKM474DXwWe0GfW@sjwCAAXm_?Fs;em1<`k zy}*j$uqN&fmfw*fQLnGLkzkKrb43rxJ#LhJ0?NQ8*I&#xm5pjgXHCA-LTsyP5aKaD zRi_2wAIcP~QmjL-JmYx|T)PduBumY~;|m9)T;K;Ic*Gr9*C(eTfg515bV7Pr5eQ_t z5XCx-JliMZxN!$w9+X_xCK+o$RZceG-We?rn5Ql<6rTWp42S0n@di_y$CKFj=(O!( ze&cSpyBlx8!boYHy)1iGl>CnBRcL8Mra#~j>GJsRW1m}CuA1(D7tw;sCITV8yl7f9 zxRnkxpyqjxa9oLc$4$vhaN3T_b|C+51|lWJwQl;Ym*-j8W+kp|L9wJq(!&7`{$nwS z5{v%EPdIl?aKHtj2BStk)8XtRn{OjKEtDhU5v`A}wF5IoUhag%Zp$zvsS52( zWWH2epu(?6>c~ZYm!zdHJC3@d{NL;p)$0A|gy*k~iJ9jwZ}o62QrINSMQy0^B478% zpEHv!0zBf5vQo$t$SpfXjJNC5WWGGQ$}Z)YA$Ol15WCU+x4J^k?rOr(g0Pmn-S>co zL1{em+~RcAk)7AVvpf0W^fFPiR-`n!J!2;aRi0{aDw^g)sS-~_Rm~D-w^ZaaaWBu~ zUp4JH>E!0xHe3+!Tte>1I0&{a!7e-R;d2_CsqLz43AigV>Z;Gn>MSlsj*9eQQ!pf9 zl7WS~zZT(pV&}d5d(rkHqs|w`UDt`%OkOsKzL(c9$8_ajv{bS&6Moa4>bA2L$#!{I z4Bw9xCEt1s3Go=hCSU7mo+TdIDG!Amd}fzlTcUJbTN^$Azy4*V5RV~EmPSGU_F)wY zUZS_$FAnaS8eN;#aw(z>nwg)U(~{w(i6Kn}S6%PDxRW~^H8-ryO120LHB-yHc0@H{ ztNp{yMGO~2-cPA-iIqyzM&GIo)pXL%BIF6wpmTBzzhkC29xb@E^rcxv13R@Cnw<X`o`enqBW&VvYKLT7d1 zDIp{e6erMF;D@iM7Br%EYt_O9^3aF{&-8gqIxa@VH0fYAdc-S+af?sj?Nzm3wE;lVRzGqvT3OBa&UIAnux z5ppQM^B@4xyLlHqN|L=bDpdIXb14fP9!SzQrNXS^$T}0*{JA4Bz%<*UEnujcmaqeT z(4uh|EZ#gz2YFIN!?*KGw4nT#2LUME6`QoxsYLofU%i01;6>c>&RLQ=uOiu)B~cee z?Z=%^pnj==+OHR@;&b(XsW`U$DY;pH$qQmzgUGD)EPS++Ivui@{>TLdJj}H-8)MqB zF=?Yt@7XMASS0CSht_`KJ6&o8YBfnVkt=ILD?>}wrC%?D<*UsjD=l^__ zi%Q|p0+=CmrC{SEf}{IF#ouo64D4Gz%)nv^gfV?w1Q*3gY=mAC2YuF5v>iqXp;LSr zv>9)9_c(dXQHqREd})jsgwb!d9=)rVGKZ#+^i;?|zAuvW<~FwCo9%zN_pO52oXB8G zV5l$6Qn|00&L)J=sLY@sTCg9@k3jcVsLidWgwcX0aJrRp33Lu2h!Px1VK5>Iku;8_ zylqM-gENDmkTrchvK~b}M6P_9Oa_gj)PH!bYB0Jl^hRUfg(`>=K$E@{K~3>$BHXFNxeY;G*)V~vP~ze+2~=8$LLgBgJJlC-iX}y36DS1N9$hJJRlrG)QV4m4uclL1D_i-< zwhrZX4yCB!B!atAQHkb9=MX4tf;T0I@zyB5G&YAoi(t`0=(J!ejWCJ8rgiTH?Jd0H z$E32YsLWt0jm2SGvENGnPNId;6+8H>C<;I(v6z07gw{8;2y7aMLk|v6((^+z>eH3{yqZP`q6gE1LW2mDAZDmij<9Dh za^FGW{3BLu0(&(xl;QVgK$ZkYg?=)d(7ot;;Av|e^e)BT77Yf=-hvrK3u1;u_QG?a zqUb9?s_c8fv9z1Ikp3>1-DQJ;rb18lBg9nJ=`V(qi2l-29^OLPv>td(wtk;{-DQJ_ z*C%jqkWl+{=Dmf>ohj#^;=p2MK2D3E(rA9Po?dbClxgo%uSa3Ou>4S>_U3H3&&$)^ zG0kgH(l3oZug5U3!KYWF0}y*Y2Go0eeFMsBdcbN&<*6`q2Avbx7dY}dZ;p;pRQh6+ zI7}9k!3>D>WQEWueoo9_HYY@$k|=j6(}SrY@*GH+zJ|~g0;vk{rhKf&Zweuk&2go1 z!kHm~eWKU>^OxYJY=!+f&3sER1}2l~HJyP>WO_IJd9l}~k62>!@mSJ-Cq`BFeX z98CIy6Sm1$6#gG1SbYF)Q_Ol zI48UnIUj(K^9f+R|HASuFl<_g{LjFIpYEYdkk<)Oh|s@LJ{iDh^pE{~g@^2cg?s?Q z)BpkhVGlBZh)=e*?!%#U7Y;7!{SRnghV|#iw||EG{c!i~m^@H{Z-9{fQWk$+So}6D zW`!`r=xjPOcyN4nkLCy8arfETS9!D;1RD&r6Yr-bK5-2UfC;|QLU?n&!JsUIw~Y_} zBIu*5&%=Mp`zv6|ATNMEupemp_sasGNdA69Z_@|!ZN47y2RN1a9LW2b&Gd!*`w7iA zW%i)tH2s3OAFTeY%;uZ0nn4ev1=HAURtVFVHW)6wR|kXd)<4kQf4yt}fE@uh3u1s>{pZ5pPj~+zEBsfu{62vmShwGAxckZW{~GuItv@FI-}S%if7kz4 S*Z&Iu0RR7@hN~(73I_n+nrw~$ literal 0 HcmV?d00001 diff --git a/assets/paravela/chronicle-0.1.27.tgz b/assets/paravela/chronicle-0.1.27.tgz new file mode 100644 index 0000000000000000000000000000000000000000..725ff961aaaf6682c137a311ae0843044d674055 GIT binary patch literal 62621 zcmV)^K!Cp=iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYcd)qd$Fus55Q_Nx9b({^UyJTzE`ySUx+ics!ukEzIeX~6- zL_!j4ieL%Qj@Hik?7s&$61?f+TiUMJ=SeLRn89UcFc=JG+*wRQ-wkl{c!px;EYLjo z(*r-PR;xAW^~C>Mtyb~>?S8BOr*?1H>UO)mZm;#HR=eBowf_XIhi*vKlTe1@Keg_S ztJt~U$%Dd>FvNTk(oqAzMGOUG>bQup06RWux;SS3#K+zUA{4U_$CbrApGE;%*ddzZ z5gco(sw^Ah03(W3*^~ksDDr>6G4)9}f~!sgMN#^**NhN0dr%xLr{lDF*Qgu&5fkrr)A0kJ0t$gdIJ7BAVi&)JaX{Ql zcZU4X9wYY>doRHwbN&-eLqeJFLKKrL9HP+W6A;D3OI+q;vjTH;i7EIDFro{XkQfq* zV+xEwj9n6YfI<&`O>n#be?Ct{ck)pEa6;m_pd26}An<(3Vt<@4>_LFNDUQJgG$siH z6fOW!irGu>L-9*C_@zLD+?Y^4aq}c#e#8->nE9AGu-ljsKJt2qJ>pVl%p&KS#Fw<0 zk&f^3ahv!79yOZ+6>ai&Mj0mxr;SUzxF)eDsK@AzZ47FoNS167;Sr!H3Vc`ew_!|P z+vyA&pPPyA@f77hABKm4Ye2i+DP_gme`80`=7c;F6(XgC<}V~o*w-1R!cF>deo(Qwk~x5neazB`xIz7AHvRlLR_Hfkdjrwh;-9KoxJAY}lN3E9iyAcT)|6idX!Spc{ zz~%hk8Fc%@BLDZ=-7Wt=#beucs4+KI035Fy2<@%CJWJxTBnCos_9W!1Uqa65GIK-5m z#AJ*e9CA5oj>k)o@2D7RU79y>jEzp`z;H|o(ntWwjeH&>^XHf(>1Bo&RWdwtkIk+)Kp1=O+ro~Icn+H@LUjru>SnPeY9!60(iBf!m z18y58j2tpe&o$^c$N4CDg#)y>!;A`8oR#`wXe*$NpkI%Dg8U$f@%b#qbVdTv>+2cj zyAKJU7oacU+hmO65Hn2S+7AL?@dAo<6?KjAgv1!8{uO8ZB!XM$%6TtV7(usH-?V$u zTDy|g+Di~V3|n<8xoTNQx#C76WEcY z51shIDKnusU2}cUR;yGDE(sa(Lmcz=rW<7zHO)e|`Ne)IW+zI5;DiLeyT~_!zlTVC zfLnMoc}v(yj42M8S_ZRs_x}?DRo6{H1`I*H5$awv@iu|3bzn& zn$-Q}Ium?(e$sK;PRnjNLuY8x6aL6z^aBZ!ITkViLEuxy`2cyI&-EG7dRK-oyCCqrI0bHCP<-|c%haPX&03h}iwJAD{O|Q(>rI)iRYPjo$%>Ge+0TlB5Ib5h3yE!Q6L^ zkT3`J+GjIBid`@umiEEsrOnZ20bMq$LSBDEsFeL$Du}lNrYY?6{Zj0i0T4V|i{k{b zSp^P0&_x{PycC%=k5>R)j`uvMz{&>+hb;DS5#o7J4^NE8&lxP;Cecn5dXk1c>;@<< zkVCdwsY)rMDr-XPC#4~i0_gzr3B*5RX+nVtyDa3 z#Q_iB_p8Dq@uJZn5z5m$iBQEZ6ewnVJB5U%3hz#iwAA8X#6C-HMJvP^iO`$SXGKMl zW8z!JHMG}kMduaj71*pCiI6NS^)5q`edvXIr5gKa3eZvwmPE*9fuX$KTMMewUqOwL z9A3_1i-`Ck8vzOea(%&K6jJ00=5WL->|KZhN;x%NRl(HurB4ByD2kc_k&kI}oP=J$ zdk{O*e{+c!jaJX|6Ain~qQ@Wh?&qQ9JomE5iLpG#76Lc@0k<$mQO@9*eyb7#EOLrl zA1So;UZ+yP%CQCyM*&&PMIWS`7I-B!nj4{&h_elmiCyo2INHrns@;$&tRoULJv01o zzRG8YjEvBLBi@{Q1uWJ8fGn%8_qp$dyi0lZdw&CZtL za{7L*EL>u6$B1H&Ppa~Y5%u>{Thpk~;EbK`7=OdJGNLb>?enDYb&R6f|NTy2$1xn8 zywUrVB1LOJOExGd@@;|RA7o600&}LO&s@SQ7V%0vt5@z6-x_Q73iax|Tg7SFvW1DYSDPtJG=>hXk6)ZCeG6@=qlKRcCmWaF&s1!e(}i zc?&&(i%XAc;#5prje(I%9Lk-mu+sqo@k-EU4U%lV5=BRiMnov%+PhT0{Yk3#USpxQ zxKiZkV&EZ$xDbFDj`IRW7pYROwde}L4;hX_6l4(nkTMjyLMtI8z$mQLwo3xdz;`8v zK?B6$l^>H(EMHeB_T}-CUb5ddj}+jm!hvs$r#@xzqByB3qAJeFx>05i%3?X}mM&#g z7-sdi!%zZ|9>jX%9C8*2VODP_6j6?-zN{3C|eVW z*cS5gR=SfMLHe>9jRwR~r9kh}CtYM!zqFDg6r5#luwS6&;}X3zHxN9)}-w;TBD^*HTcn8+rsf);)QU^ zeE4R4ix)L5Qzonw_W5^b9Ph-RCQ@auLc#)C11`cb6L#m(ra9pOZN_m_qm@9Or%2t$&i;L8S#;`MLQ<-ka$q&c7*$60`W0lo$HGbE{ zlzvYo)llVOU}WEZc(T zcpkBZB9%Sf*AOTpF`DAz08uK>lP&9|+A(=Pl}nem2+>^mN&D0%oZJl*N$BB;A9B4s z*7(9C2wp-+N(jKGq6}A!g^nY4E17T4nNdOdBaFoni)Ua&Ik1vJ72LXBQOtfoL6VKl zviUOWmnJNSx`Oi{S7I$Lq5i*d36I(x^KUs(+iQL8>s6M29I02;+`gs(!7v}>w!Ldq zHmg!}O{IjbJlmF^pXg9Khivohgm$*IuTbE7h>?|t+T|L{TD0+TcB3J!aHb)_LGe_b zFe?J#Yi2x6xbi6^8efRCWMfgbP0XgAgQ%S`7Cq5yrHJmc@ng}dIWo&udLE?hxU0KC z0oWbvZn^%{o5G5=w>q?|t!|qm)Rwmb*3E@Y0l*x6d>^7KKNP5#KgZhBjiZ7wb_t)YtOWu^ z9>NG(4S?eL&y{u(x%rfHN>rkPqt$-{i6kAU!*i|TVWC7~3?I%^$)BD(PAYAhr>~D* zegE2-dwX!(&~N$3ntuZaM{!6KI)YxSrPe9L@FWS8$S!aFKexN}Z|=$b{~4Y~LKZYH zvO7~OdVtFSEAIac`|aZW&q1p<-1`4N#dC9GgH(3G%BEf0`7N+NeQMm?fb)aA9g-dk zh}SmY&=W-(CLAF*3jqAk4H6H775HPvML}SPm@@2H@LY&w2Q1CqR`zEGXHRYZm*LIY zuk7x^Ca;@d!w$W2VRV?a#U=AO38g=&Gf9F#mUnccqu3AG1gtNpB`dFoJwRg|P-l*q zJNr)jT^hCu^NQN##>| zfk=O25Gp_r;XqE`G(BS3^IGS2gohCK&fGzEa>3wSdD?6Vn;!KeD9%QH^?g@sCc0CSjjT1e^h1!&cLK+U`U>(jt`39_6KOUv7aVk{j-H}Icq7;RgiRn8qy-S7MaI|i5BYmgrh_m&TX zOd8vd%!g*FN?yzrcw&CcFG=_1Npnaan=eblYTGILK(Q?UQ^JKe$7{__-%SUqx7FDG9f z83;~$?)feQOT0NHgjp$5ryIuf5Jp_?l1D`n1XwZ@L{>@u-uv{aQCeh5sMGzYtaPgU ziNvw%=rBEDwfxY-A03almpFEOVu8Yvp1{a@89d|cWpoHm+Bf5{#w=WowyIS*P(`c^ zP0jlGM)HqFZT?eN%y!DnFX%|@mve10yR&0f%xNigv;3K6SkA6Iql2XcD3;gs7NI_R zySd5c-#mu1%u&qF>ME=Y%@#@y*;pGgRB&Xbt*l=E!kf63#?-lp|KzM%onBkH}lnAp=rzIf7SZ$&aiuV zF~=}5s(t@9Ug48HO6Z!LZD z{LyFPn4b5&0U+5*#af{c-FXdn?f&ZuRs9zJ;$VBQ`>!}R2-c3SX2IeA!vB0|*#|%U zWrq*QpZ{DeV28M3R7B(6lFXH5`(zlaYC#W$6cL%%ML?S3SgLa0piO3dPO9A7`Z9ROOnMs>Vo+ zS6AYtR26NkI?V10{2ItZDXnJbE{DLUPyb!@P2A=9^l8-Zbvu=n)9VSJKB>m0JFuUM zEn#l`xmfvlR~(A1Dy&b(oeX~(1nXk#hn^o!)o|HD`oe z+8z!t!?twIwnoaK)fV5xbx5CtFU2pKxGu(?xM86emGw3)oZuS((yM4xa}bfaCEY^k zhaL_Y^!Qd=ZbIe}3315G5b`v_F7J}&v60sE)4ua(bFBLsYb|Es6|1nTs0s|lOdHYO z;wv1hPx<@oZ_B$qP7UQk%04Gypo9_OhkceScP{S6X18wvGB;w=zQr-9FPX8bBHlyY z5Tqf(W+=v<%?CIA1|V(=z4GJql9P-;dYqazM?sP{VCUo20gw<{W~;``EJI-?u+N8MlzDPvwT_E3R`rmP~O;F)(l2S>IOt? z_w{pCxL;sS_cChbk6@(}8N{rrR7R#UHhq~^OYF7Mc+A;N1z=ikK88Jm4cje~5A*at zMi~d(fdM{zfd2w}0#@ZTTSWsyakjpeW8;TY2=O)WdcY~LOvN$+QaYGm+azI8!q%d% zCG>KtPyz~KjJ$=sFH4t`4GynHW$BA1_*@(`WRrozD{~$?`FY4_f$VluB`1uf83mc8|h)GUzYR{GmrG!Mt9uvYSi%}#TNd7=_`WpG1lw;dxu=CBkv-8o;$-C2Yux({~ zJ!}<;RnX;+$QNXpMS{|I!XUe*>Qj((?>Hq|r2)nfv|Fu4<;t;&>sGMcr5{DSd3x1= zbOP67KDDG&6LosMRvU1n^~M~&s)~>`qUJjXuDNlo#p`ib9^RkYWumzK{PfAGlMN2N zavgQOJ`HzSM#l%P8lAPdt*Z$9KW!B)OE|gz)=rm2OsO15iCaf7-U>S_6>WS>MA$1W z*>ciE1yU+cB0`;9n_Qxf zqwQZ!(#a%?bRk-ASymV`o#EZdQQC|OwbnT8HD0cvHJ_FGC~TP(DCEpQ6qAThlxonG z8o(tqF>|wv@0WN%o0Y6=w<;mjj^E+UO`4<%EJJMjUi$vOtSY(gdv#iP9$6N)w-#4c zWCc#6VBHRYk+h8dswL)-XtQVZP|V zph&zW&Fzo4a6G1HHld_Dj;$%@Lzr%I3ga3jmO@-Ehv8NMo)Wl4qUS)#L5JuWZSUzQZkdINOLO1ItS zZMS*L6;%2Ml}lBYpfU%pZx7OnrxF_X*EEYP4I~5+;>&@vRk$8U=+eg&x=~FvX;s*o zwJOkUi=8D)a5h~V1`o(a%HBuSUs*4?h|XN&aQU$%y+G(-sg6R`VV`S`~RuK z5=khJb^oW;?Y4{ee+J#w*8lG*o=W%Z6CKHyNq?*30QvI@SM4I9(4|g%I!I>b!FP#q zl={Y%!a&=Qive8>vk7Txb}d&_l;RPzzy43W%5kTsivP`AwmRU&eVl+--T!EHi}4?a z!~XXE|C2mxh3Tkpcx>%rV^OTo`l@7qO$M{q1P?KdY4(6QRzoQ&Wt z3Au=&nDP!DsW@@GxQ|07N{hgHS~khl6Z@?Ly~&GW!iY@=q5lnfTlxPK&t2s|iXxib8R7VnaoU)V#4L?N>>KNa5wQj?LHZO8Ku+S>OBOpL$m9 z|9gXOG5%M-zm5O#B#(@;lfVA=yh3{9q8~eug$~+L)S@frqdFUavslvdB`0YSd@H^0 z95WTJx+?y)LX+`mhSthA!b*#3&^iaZWwfWzI?HI4m2acPxe$NkulN3NT5%QsM>r0N zCsU%c=>8^vRr+72)hgb+7DqysJ^-@n)vCHCfJ*svL0zyXBH4OE40W6$2RAIjnHR!bIO!#)q`0f zOe283RziuoPL|sU`5ZdVWirNbh#8lmq!|&<-gr**pj1V``=bfd-{G@N{y&85|I<40 zf4ak>{ddsb>VHr2{LUo&Z%?|Lspfv$GCtSRCzAA^o4mKril<8ctHWG7CINm3E5IuG z-)$H7|AWDxzm@+_@f5{%JVvfa6hLC-HzeZ-lg!wAN`gB|aTyoXpe|Kec*2z;zo{4? zjW`M9iN6gf^1qHr5}ApjEqKQNiSY!-X<}HH#8_OgoATnyTOj8=!0TpS3jkL*9vh$J zwVm|m6tmLGw&qZMDMO?^(1_XbxHxFlUWE-_`V>!uYlRxNC2ej17_)n?Ii<{$>q(vm^Xn)Wh#&A6 zuOf_ENxk0CZ6g(Y)$8%q(o%Ct1fVner9fExd2L}hEgM$Mo zN2-V0+kD`Gb*|Hu;_T64h0gxff%lh#uInxZpp0b5lZ?w_-u=oTS{5D$$>UN-Hi|32JHUQ=SS7k z-4rn%@)~5BSkBJBK7D<5adLEa_T#(LR|QbDGyBn}oT*L_rPn0(RG{U;@}-*cRZQli z503Spe(rna&8EFd)LAgYHxt;+HFXyjB!LiP4;TS;uLKYS zzREFGShsK&NUUC&4cmPw-d8qg7v>3NFvhUUwUu2XUSbY(WxH#5QNJ&I$mWzNr3HuOsBlHzfclZ7EE=xM^1!R zi9E)0!myp@YpW`wKMMD%N_lIfds_~H(^M@Km2qx41d)1fNlvdG?VoFb9GRDjL z#F6U468jYja@*G&qzK18;S00iuT}6ojJ&`PaXma0WqK*VCBs?j_X=qYin_&jn-{Jf z%q1ABn2U=uzP)nXz|UFqR#(*$^^Vnj&vpak&y~&gufJiVhp8lQwcF3F-9DslyXjVI zogLQZA}v=WKgIZCW~bMW)(4B0N606!&V5n2z?-EM*tw!AUfC-gpoNlcBbDk|KRHQS z{5U~=ki__W7GpXiftUZT=5yI##Ta@1iqXoKdEDWuOqu@3LpEr&Rt(x7(+FEKBbM>5 zh%;E1F1Q9Nb}wy}qTNPU$PYNNEdj5IV*MUG@Fur5T;Q^qiK;@0<*7!j!*5qWS~(kc zMO2+Lte$|EMl&p0JfSLk_2#6o6zBR*x{`p3#!gd}&z40!nr@{SwCimvl~E#dYw1-s zKj+%#M7!q|51`AD=8X9=PmwF)$LXdPqsYmpDY|?>=ZVFts)*HK4}p*_Wn;rO06fmYrB8FWkc{|BvY{HG^*lqe%HJlD*?r(d{p zr$*Akr-aRN2Gpm&LsU(npZPXXL_FH$TLAHWlmE1dB43QpWBdQN+nr(Q{^xMm-pc={cnYd)QTB6EGzEyrW|awxe~|G#goLKB z2lL!D0M>`0o)L0s$q;wt54MK`%#0A#;w4R77h?~5sYmb_xtC-z`OcsFY$Wo0YPipoKavsqrW_QH8+LXqAw)nvZA%& zBhv~?&sMKzID~|Xe84lDPABXZnvk86suNgmofB1x8DCjT2dk?aoihWkauCjvgH{9{ zyvxad%99V{cbA^vZ=A;b{pojyHLh0`K`Ya2&9fjTriCJCMF0a}wSN-PQ z*?CsS0JH|$D2K057hPY1{nZF|Z$#)k*y()Q-79A^bP>g{BfAZLl}Dj9V=S`D*!kn( z2}%NSiScm1>=MYIzZOsOQ(@Y?@rGTcW%UWPkYCJTt0m= zv-w(vgQsQW^KEyE?OEYZF(I)Td6WyDF|N;IZZZQ{JMT}wEAfjzfe*0rf567SLJOAX zsd{5zPE!oS>yM&s50I_uTn-Bm*G=LWdk&lkbynIkc~jN?CB`n}asy_F!WiQ)mDqKy zD6+cYt*RxgRM-Q8@{(2Eyg)(Zhq!sUPe*O1({tM0<$@63K@!&GuJykn?qpRK=@iKH%9RHe5x&RWG}u{HeRS5 zAm+xarntvT>r`B+*K+wyiAw8(S>4~lGJO~7+(3oPS0QnYw^^-|T^W)jgQJAa_}Gi2 zzBE(Q#tDOvDAKMK1u7+;6e-%tuB-(5p%61yvTb~u3KKuTWpGt;Wn+K2qmws>>xVwb z;}F*%Yf1Cw1ax*ljj#gA6f;h=Tz#PeOF{AZ z7u>=OBM$itH&t1go8&FiGCVojVky~6olyFJ{-e|eIpcHPZI0oVHE zbMu_A=0-)XO!3A>{cVlCJr#R4XCN%Kr}_d$;oil|+FKVAiclMW&b9yNbqs=;ZuodM z@iNyvoO!$w_J5A0eBE3}vh><^^>qxwzrmg5)&RUU0Oy{q0eEWw&cFN(8-TZV->uyj z-NnvZ$g*}v;<@Yn=XG@B4Q?tIkMrxV2g_MH=G@6?EH%jfd|fSWuOg5A_|juW}bFEuMVA1DB7ZO~EE*A>fG1*E_mN#rh@tVpiuC ze)$y~E?7K#)eMuM>azFkE!&;(b9deUsu~&t7R2 zDx9-rCY2uRuPKGGTz6erwIaSRHZHfW2p+3mQ_@~N!n$H=Wp^IEHJ1r3QntK7ubXig64p z4m*o$b=s-Idc6@z%HGxNNFKh6H4C=fckJD#k9DWJzx>LV!QC06&n+CsB)0Z;m*Fs! zm!%uSvu_Ax?m3Zuo5|1sns7%@CuNX10T(^C=zemH$E3N-Yt?K#EsD;yt_d4ysN*8jAfPR9c07)5C82R`#L zb-qo;Sj~*1{=X;a0buTjrxV!TsKFC{a{HlbcWu$ z1q1PpDnoyySbxLWH^k9+;3Jx8%gYXPDh3Sh=3)_j{v;32;PpoqBbSM@QxbcAhyvg^ zKgzu~e;pA|^u18`-RY}0Z;!syJ_b7{?_OQJJ^KE2>Rtf5_HO23@b;@uyTv2;XK;)H zH{paXFn#mx>|9;O)NMhb2U74C>I&b8${_Ie&hzIxs&(*}8ZIp?H=MTiip|sB^J|A_ zt=js@sIX=b|3Ck^P_8c3#)Zam!J_-csC7vgVm`~o#u#NcjSMJOkNbpQSM*Y7?vl8W z6CVd&O-xAfP40%Zv~)^DyK!_(7Of1BS(l;Uk-D(%)NBypeBGdJdC%%Kf|DDT+M0m9 zdJsv3?ki4}@Am_X)H~z}c>uZi7_#lIsWI*^26H!s3^};ss?g?wQ&Lft06eaMwyr?E zhlo@(`G*&it7N1A^ySg8LdV*CJb&1bd!w`l+AcKciV&yzgQ-~=&-<4{B$lhZHbu#6Kw5C^Rhaxc*o zQ>XC^&SyRannWU}2+$c00^rNJ+>86+^d-bNK+M0w5Fs`*-lNcKJcAHV#l{q#M=_rG zAF(Gd7XH_s1Mk9M0VEVPd6OW*F$8{yord%3?BYx$r+Ws+!uSC{9G`*b$F$*0ebyBJ z%H}tm@xSAy_*cJ}O`H55{gYmW%?uEia7iSt4%5a9hh9gG7tR=6HeNVv&i^K{KW)7D z-^Mfe0mVK^D7<;~nl_v$Ccj{pH5}i=s40ub!VlSzjo%{ zgX36n|Et^S75Tr@8xFVp{}j(NI8M_OHE!kV3%B5587GXuxPQk9hJ;E}f-vuriO>~1C{~19nE?^1!3sU%=UYG$jIY7S2+=ZRA`ZDiN2J&J zgv4|BIXz+(#kh|B^DTV%$w1=7I3m<%BwqXsx1wtHMgx;um|GYJ#JzN9$PZa$rdiFP zF*N;ILSbl{ug-`VidzupE6l7FB|#wVv$_qk3V*K?{H4|3Ox_Z95@X6W00BfRd%SW$ zrVt1vZ9-xr56>-#Gjmb?8js)mKMPQDibQG^fp;3CX!dIWQGgcHSlnCB@~Y&fNZYA7 zoG_V>am>4$(ot&Q<_(V%PC#v0QQQ80z6Cd-jLcKpA&9V?qT%A=Kng1&oE&dHNdTrY z#Id84w2H90?p8(pJw?IcG{%%V*?|m4z!?;~m{JrkbQm}FIpqpj5$0$CV+`a9$Fc8u zn3IZS<$-IdV)Wm*#Hk^vh^cerhiR{3Oqoa;l$S3Gu8U(Pk4WMg*vOq@;Kk;$n4(Uf zrdTTh&j@9Du%pjC2PpP$?8 zC_ylYak5bEi)K?@nFX|JYy-*(%B(6>K%``~$fu^;Wb@LMqa+yk8$u=LYQ7b3Rg991 zRrAeER{;|e-*Q$!;=@;jWR6>rq-&s`2Nke+*Ko*UA6L~AefT-6qcI4qDD)(Gc-Re4 zT$qte&ZtTmbZsQ!tx1!mkx158{3z26Br?1N#TY)EsggfEcbulKmT8Pi96s}{u+KzV_e0E}h6Ze_PwQ~<`;_Z$?y z%-_P7=O-Pf?X=R;#WhOKwO*8#&lkt);V2-Bx#*3Yd@(j<=-IMmqR{J9P6t>GH#LiK zc&3ePjv~lU&K!MwAEs$4eimgu`txKCN%k5-kpaL<1Qj5N<*_m((KJRL&Vc1leg!l? z6wrjv=onAF`8unCh6b`K-HKF{ z7U>?x(3!Lbp;4XuaJ-xKMC(th6079KhIc`JgSpDOqNMu=uyVO?Ecj^&d^5#L2|*$M z%6d~MGN_b5sbxxKSIPLL*ZSHo^2)la(z@j;v*8(}@lxriRGBSgX^437JPqU_Rit4P zVvPUROIQJ#*hcVLOsHAiRu$Y_?lviCuYpV$4uvj-V`1x%I;m`8yAn=5VJHVAOuSh| zUVs8gShiWuLntPS(~X&PLYKAqZXYwX>62hp*QfrKT>E)PtDuXpF_bQao&pu|y!nb5 zGf)*(bOo1$)b}t~T-Aq35&)Vo9K#HWHpn<`b-hfJG`v+CIF2=a3Ars?i8?H`Z?={~ zexLYW8S?x0Z(c2dJn@F@;lvx*!`7s2_j+#I-fw%@?(7e}K5n<#t^EUqRz%QAqV*_T z6|N%i9GrFNI}fWs-kL0PQ14FNIWTu2?i_%JrtKW?&qvz1W^6*)MXD$eb~W5J=(+@V zU9$e%M)E)Klb!#dD6(UWyg7d8GoTgczwLgfnE$2Q?{D+JJjr8P?OhUkGFCGVh5qY@ zTmnnIo$pJ+1w^w2^<5MIiNW)yK0^T@O0lqXBk+8#(2Wx=^#klpaqKi2wsAJ#o7;C` z_WNcL;aHXhZD#^R!Dlo*cp4*lFXcY*Ajk{58Sx0s<6H z6Tb2OI!4j#|9)3$97fa+7JxhyF=_uyEunk|E(APR+=G|kqKG9imUtxin%RhO%={3C zOzkNA82r#nD2o>_0Y&2cMHJ+a5{gCiFsIS@CrQ9XAx!+x1N;%qqX2_P=Ex7JC_71F zHp8*l1I39ecP)s42m>~1HdP(!j9KJdllYQ08qc1=i#Kz=XrYk3Xf$3NQDX?iAQvY# zKcO!HrB)v@fu1rRiAYN7?l)gUG7FaTqVYnwBFu0w2X}^I2G@QNs3M{#sTC8Df|#`; z#EiF{lgxr7F)$QQ`QBGL-n|4$AP{Ts425ZP1cDe-PLL|}xM5S{tFIqUofp5a)hd(! zB3CA#?uWVbX*{d$e|1{zg8c8byIcAHBu_f)qejE@1+Y`o<_L-g%tjiiZv>XrfRsx| zas!dx&6JyaeVb}z2nCP0mpFz3%+%*#1m`onthhQ8ccep-I=7H=Ok8jAC%*eqoLy+a znX)li7309r^Z^FojW*V<)$z=biMcJUpxJu{=|lrb!c6Zr=3$d832Hp76HO8M(fo$yjsYg+EC{%Nnm$zS45X^(m?F zEX|W-RmV$YnfCpSakyvzGU^^Vc+-huN) zbpIL1b;5vH=*XH!`FHD#;S*8lPs&ZpI+bx$k*C&jrzm%LliGLdv0{@q#qL~QE0v8qd^%8{L-(JEQL>~JS1___GBDx`ci8cM*b zj-M0`nfP9-DDsc0PmIzt<&)ykksVCvzq7sn@g&c){}Q)#>5S`QXM(YT5ul4uQpUfP zv0DV7Kp;IUgc8IEXb&T8KRx;3m}?I3Z8FAjh?%@I_MVEkzD|z9;BRLF)WyjU$A5>v zoeKc`$3^?^@WJ@m0mpHEf)D8}>7N?U;I*_umw;;5R1s0n&fFi<_pQ}M+FE!v8Y1K? zPK26DghIq<$Aglt8sev&$q`H=Wo7$ z{qFtwVYk%+cm~2jU7S=m)P*vAC~%2!1T04GC0C}T=b{G@@su+sSM`#paeVsv==}Ao zi<5V+&JHc1Lw}Wo!cxzncs`8+w19+?wAn46u}J?6tQ;H49@v&Kko zG8qbqjBoj=*y(^wVU8*9jM|cjlXZsX5p4uyn)X_zlu<5zlKv+%sIXx3taHe7ZLFa zt&+@t5nZ`iv*Z`a|LRM}s_9AB{16fEf`2@;G!ywGv^i!wBA&f-lfl%fgZM04V$&jI zPOcBTI~t(K3!9D5ZZ<-@jsm2|5{Vs*Jpmj3_P5vXzN(IdctX62XksZo^+sSAL59tU z_f?tIsukR+ToMX`~*P^QXcK{G7zHI0@bB4xk_%SLBE ze&dJMOR$=9GMnOWIn>Rxe03z$^hTYiX-8MCahE<9096zy)stA3)RP4og?Op8Xj4M~ zlm76>0rHJt11|q516u85l-pR^q76W1N?!+na&os3nYf!uY?2BE<`iEZ_tb?dTiSh5+CxVQ{2oulv#GNz$H63 zxdrzV-+g&aD;svO!{q`~wOYhsPn)cUQIH4mF67U{o#&=N=H-?lvWbXZ5+OD_+`Vxm z3`g`c&GjYHJ4qn&y9I|}r9)KCG%RN1lruV{Y4^ln8?#~rI97QxWO$ccOlSj;@*yig zQMrFbtCZwZT_}NzLYs;_#c1V~# zAxY>RrhDrZJT5U*^0@YX6oOoie~iUdv4;9|AwCtxE4L7@F=G4+VtlOFp`5zwnIB+5 ziR!%tcEA-4L%9{S=#e}D9m(RL>v1L4tdyx4ynnlf05z$!pn-t3bN252>G5l>ds<)_ zwXEDUWRbr8378@eYV?abKowElD;bT1df>7iOSY-*7=OkwMp@>vQe5^jAKnFtk|W0K zv5MKN3|%i9fLXlY93}_6|{=gyr$aL#-wJPJ$3)HVas=?J4 z$`r{jBOOSi!!sgrp8RlJXr~cy-b|0K34iDLb3M3!fwqb~=#dcX1>u#H1bLC-Przqd zpBFXql5A7LE6acx3cUd9jUOilX?c^|AQDTneVhneTtgKz1OnHVRo&DV+ksRcoWiOGVxs>hs?O;T9M#TY`q&M{bf=u6V!C(Pb90HADw>v`ka5|dgOmw86h$p z&;1bV42uDx8EWBNnF)GP=ewh`^NXX?ue0o<25g;uv?BhU3bSGEQTc9HK`Tnhbj}Zr zGU?Z6aEj+dg_+2fUSU!)T9cMHd%wKdJ8!=_w5-2^YJTg}uDG%6!7gpWi=Adu^(H5B zjK=1S3wmmVvF8fM%xs9hsKf{$5bd`qj!-OYG=Wb`^LBA`dV2KF!+gUHP0#*!zEiS% zjh3ef?ubEv`HYhg8#Xt2ZD5SG=TklD3I6&X`Jp!Tz5a;ZM2L^ZGdS6RVL+0lXx$m# z-txf_H^oxRp>#kMv%G7p;w1$voe!};=fWo&79oR5qm&9Fi9W?BwkBnKV$H~a=mj&U zN987?LW~Ja_6CpDkSmC&SUE6!11CI6RkRdSCO(<{H?#lCBYeX%&M?&3mv}*&A|VW7 zBzB_Mzgi#1s`zj1qW@>7(;M`*_W!4NhU4yjcQ_ohhrK~}f)0kAPOpvepfl<8-1b2W z}=2Pe&5d>`9B$NfMYfPcZ>Yr8E*OiNuE|` zfZJWKwePmt2zi|r8jd?%chG6$iHn9UJm`;yUJs9l2YAq(OuD%14#yoAwZ`4n1b6la zTM6)ce%9ju_GeiC`&<5hil;wB6R*=5PEc=vvDY7?gYLM4$Af+kciMQ+-=Fl{ZoiMb zuGj8QChY_44RPndb;teQq=mNJ|NDOK$p4SO{%`sJNuE{*9k~6;xYge8?oT?M$++8h zJ=E!Rz0UB!9d_}sHJtQ2T@QJv({u5ljrV)KcCXVLxcj~C*xO2g-}AE;|93va`ajt6 z|5H5Pez)7gUC*7gyZift)}+1P!ovx|Zl{mjj@$3F_OaJ(4SEOTHtONlzPI1+jwihX zG#vIPTkijzKX>H+$6x=q{Qo3RtJ53z25r>a?|aA{><{t5csT60`un}H*WX8d&uzB` zV|*|i9N=zm-0vRrTixNr>)~$upx@ocTM6)ce%9ju?q^v4xBmZ6@^sw;uHp~+Ub{PN z_0e#$f6#At+TMZN8g%<(Z=bWe*B_6E?ZH0Ay%uT@d&5C@(DBBdPIt@wzwhUc{Qvmt z|CaxssEd$_;fp0x4ML!H57 zIOuu(gYmd^Fz$K7{eE}ixxMyaJRA&=x8EIZ_y521=Z^gU*z13{wdMaOd0O388+8X= zuZ6pK-0ymAjNSbN7m2qlOKI z_W=6#D?pWl*a#lLk*EfEn*+c1DP;}t4hMd36KDtNK`ANBVCpY)TK7i&{Z!H$w~;JfK3 zbxT@DSO6oBdrEFrXSlyVY^&SiiSLb|-Nv0kuidu$B2YYIwGVXLj}EdT(=JJ+a<UyJFSL?BOH1-bbTxoLnSgq z>U_baIwbcf4YeJkYiH`SSu##2j$INm95Tlx^XAxRA)5P|)}k2OomQu#-!}lRH1_{( zJNp8?5pC|v^Ak8z^a_6S@`R~&_Dxc2} ze4a--BhZ#N{$rjM{Lhqo&k`ZDvhY?371h7=<6IF-Ju&v%$>9-RSGYbw{2Q9FK z{_v4mu(Q`_C?I_MufpM{fvSz%6j^+Doqb~jZ@Ao=<51>SI8!Nr8jv%zh@=iWKfwst z4C_2CA`+GYID#gxmnCW#!Of=z01Ie_S)|7_7h_JL!np>f?^fKEmh_95qDQ2V+`90rPiS$e0IF$oyR_Bm$Bfg~ac) zP}VgQn`6AzMg58KSx%t%W=_J*4W#rY^-RY_5gPk}&wNbN`dJ-I4#lTW%2cHCNK^#n zyt&B_&ZkfL=$!n!%RV}%IKYTvCk#RBgM3(C2D2 zgPsHdpvFVs`$4Kv62x}`LatZ=2a5uwc*R^fk1co(k|D)ws~)JqPP|!rbq&LzCx4n` zZZ_Mg$O)qXTxQ{&ebQtBwUNt5KTTIrz)=QjrbNHbI8*}Mcnp@z)zJerbUEY=Tbu@# zO#)mqYiX7yRofO~PcT4j84x?XEZS)#gqaaY%~s;k1j65B0OX?@gMU>N0ndx$rEAk9 zib%|;&TJ$HV6O-;6Z1DWX--h9TI5^#wuyX6740)7Uq55yUScj^s%BWjRE5$NGPm00 zWNv=3%Sqb&e4EqV?&VvRYYJZ_D4O7N@=r7mtejvrK(v++d5pp-E{Jfkid7McAdZ}1 z+>A)lnQB__ntbj*R$U8|D=a4ila7i}x|4pDa)p26_|zUx zf0b)whObab!_&W=3gMy0D{F>YcaG%{sb6yWc`o7sr}*~vz>*EJQXH1DeOR)+>K9nY zh7Cr2Ghgi$nx^PRh*xDVsh%16OjOs?Rvew}4#j+i_9PW9R;t^sP?WFj6N z4_R}G(hvZ-E=fYBl6_Z?t15dWi^}OY&2Y-tkT2$_3_y0efTc=oN&k{lF-d|z<~?xs z>VWFSTJ$rZmEhA*%WDBqgOwXNIdWh7S2zTeCO~|t;;{QvBqbH**_S{P7A1^}C%zGC zG-`K9X=BJ7vzZ@GYX;k>Vh*zU0Ze==&-QP9_1|#)zfc+QH`D@FuK&Y+@%~S1>;L~W zPmZZ5W=RBreafQ(TfJgi6v9=Q$y#Tbb2%|by#e&^c(nX5`U ziB5gW;>8H&3tRtiTrwA58JdnjrLbx|gL9G2o66M69L6ajtif5+CG&`cIAqJf6E?$f z4U)Fga$2fN=Fu`HW7>2H2_)-l-fzArDJqiilQ_tZ#&iP>A)>rzoh-GNliisU6~L0i zlvR?y_v#cI1F@ZMGj?R9Q`J>{#A8*IIY(3RNsh8vfXgp6r*>g$C10x++vx_b>a(NA z+bCDx$ivl@O_8|-Ekn~fjJ(T5MET-H9QohnUppDm$P+L<_m1%)S6p>#beJxHRl|`3 zlp6`Dc*?meK;YdoDrP;?hZvSfiS^2YiI7=2ggeP-&U*O|2yanw*LQ5@~oJD^-`LI?s^++)%xG+4~zbv z!%k;A|4;E0{J&hp@Ko%L--MGGQ5GjIOJdwua!;({qSg_7CvR85H#nGspc|3!Y8sP7 zBx`h)<(N!;7si-fV;q9ICjye{oCZjffV7<}3!jIhfGosvJ6?d#C=Mo0V@CM0sBfsq z+bLC7Qdo>}bB-v(arQ}GcJW=_at%U#6fit;9R>t>v>A{oq57LWNAaZ-h113*UR;yd z6BlR{G#h3(h;ZDn(^Hj(ot~>SY~9z!9Qj!ua2xO(`N7CY4*uUpOHx0_FIDB-Z5?@C zRzO)f5UR|m*}T5KcFfM!-Hwy9{JF_>`#kWok^H~oZJ<@_e|s<}?*H0@?fu^;d7eFk zf*gGI4BiN78{=OSKgJ%Hv&V0m$FG19639EYQA}J+DW(oD|KIe|kHEZ2)Ohx+k-u6b zq058gtr+>uJR9-9VGTkPdFgr`W6%oz9}J53|2w_mHvaq5Ji>wO%Ab#bVg?gGzibIqYj6V+IuhY!UF57cke9a zk43dJi1p>ssm1^Of7affFej8u6w5L2Dp8ClIF7ORDvAAYdgjismjr$|eIxSrtJi5J zTxpJxm2l`{ZLkvO`maAmF{U)TE+HM?F0t|yxWtRR`yPpKjF`+8ZM>G<9F?3Bl~d(a z>P2D}uvdCi8g6pe*q_eW2-+2ft8^k~DE8_ma;x~NPev26 z%ZIuV<`JZ2fs=j6Ul24KVN?-)+JkaK?=G6NQRhsp8Be%hX>QNB(QwC-e%&QUr%Jyq zHHv$c_a-tX^(Vq8@m!ot7=yM~ESesimc7j~=LQf*s@VW<;)uUvvn*_&-nb++qLEW*8WX zrztUH=?|r0?9WH$YW!fhv{`9fzv^lK~+uwMG%G0e&8WtwwxsZ^R*H*Cf95 z!>Mz*FR#$8Lkm^a@`SM+wY!Ykec0*r%cJ8oYWlid6_1g-fxH>sd*~#>gw06o|64d7 zZ8U_-sz2ON9-qEicL3ek+hF|ePkJcwGqT@k=xS=NKWbFO;^RHz!vaF(G>+gJEr1blXV|^0DSeHkLzf@2n0SecJxD_42Wf$>({);K?Xy`yXXaqk2)%^s zneWcDzZ3-&0`fdx-bn-N=F=w&Aa!GN8p@%JH_N9cZbSh=jHmdcFyw$AQihQSWFoGG zOzPVJpFY7DyC|VpLiWR{pd#MyODuihbXh-yzjd81=hGx$yaj;3@339Q##7dIT zvjE32iJiua7v}`V7-BppSJ;E=8CI9_5kmo)?oychp+8T;s@Zt)Vomi!MOiW0nxkc7 zWUQO#S07sT!B2ZHKK#$8pI&_Wv}3{Z-0;9HFmlFXJ`#Ibcnm>4%c$*h?}q>Lp1azA z1aYo;5om?|r(3@N(`#@2zn|t=&;BD8f%92RlIcv!B`JoIXc{Arb9qAfztSonAxecm ztU4M8HbV?JNFm&~=&w0~R!hd)$gh-HA*v469gaA_jsTh3 zn#H$og^5`QsMW1%wL~CVH^waeLj|jy_&D%H67|qo^ry@46K`j(E=$ekm1|+Ud zrKR~I?uS##)e5m1a*f1@{vb)uXK+ozT?T9xlWV<%a=d8}T{uqv%J7{aGipt}>bGi0 zjoZ7Wj*brD7vhKF*seSZ=E(&Ly^8v!qn|hQy=+I${V)qRm*!mTWtNJdIV0CLBTW{Q zWE@~RBZS#A9L%MYtnE{pVA_0^b>5cbXJ60!0Nd%jsPbxN=pDNFMWK>9J6XY#S zkRSZE&a<}9X3t&qKXJYNVf4RVuXO*b*Y0f3|DNR8K>ssLCs9lyE&xT`1?5Rl4wxxP zM8|f3+Tada|6wy+4CSy>9rCRbL#n66g}5knVK#2^p*<>#=fZp37*RP2AvlZ;uW5O% zKFBmfljwjTsVhji3x_o|YEK=Fzs-OkZ;cRJOX7iuV#RSugL_n4mntKIR8(BYE~kj= z6>%?d3~vNMq(^80^a@=NJTkkO)3xoSF^@Dnw}pTKj|kIVqGx0eg`qTY@QEzKboSnMnZg|lve*n84H=9@^w zxX@8MZLSXMMS2O5mpJ3WNxiTsTtVIy?O9Fa>Z{(^nVC{@6Rk_sJC~>_tt|Hd3{tZ9 zSA-+ZMZ^%9XDOF@GFjd1!}%z;qBiI(ehdrl@K9y<4DtOMO+pa*_7+ zH}$J%pFAZx~$rK>%Y6EJh&>M8tkZ!1E{K_924>ng=SQF>gg`?nKHS3MA&u^h1WH zxMb>l#Rtx`bDkT)y!8=f8dzGZ6C|uRfR-jF-4_{0=%d3GXWUi3Jem8yv3DUcJjcK0 zfLD2a?3GK^yJ$!R#>~rQz$At2JDF$vaqA0J`RX~}; zL4-^fzVHr>uRbj7=Ig<}*H$CUCl%e-a&*ykB}8ZE8-tFt2JPAyU;rDA|` zpbv{{x6%^I^)}QNZFOO;NcWjyB2LmvCl8rzRn`wpHAT1Csa6xpI#X>?v!U4t=j-nPc1vzR3q3D{)S~M&7NZ43T5}9z~IM6g50=cw5p8!}Yax(ni-i&#YuO4PrI7 zrI&a}3^8W0kFPMNEpbmJh%xdOD&vv27FT9hW~5csINr})c(SE@EpQ=N>c)!qLq29$ z@eWnH;$Bt9+5;=V;groRXt%^15@1+g|iup?v3wDlVcjZj(rZ@EA zdWK_}XfqvSp8{osllwAWC_t`Y1{uNF94N5GovOb{V1Lg;D~ct3(?k0eR*0pSfSu`x zt6}ulARS@LfgkyPKl0s6nD{Ye^6nRAI95&}ia$LGOg2@{3E1L{Ig^*X&GL)t=~U6C z2QdmgGEWCif|1h+Hhf7)fKiwS_2UeSTRV&Z@;so6`It!i{2HKBa;Q>t3iBcDA3`*X z`%@J8UY5f|DmU5|qBC``zM}^A+LzSoSuGU?J1NP@yrEhynwim!*ID&MDc9I!!Hb3gm7uZKk5tq5VNe za;!xxN^sQQ8cKx_O_hCEid~5eu3ZL%TqY4%S6p0a-DGD;j7K%Mdq!q-4bNPuR9bl@ z4m`w=5zab4|A(s!my|t@wR#LI5!945u1ws*c+kV4TguR`;-?w@>;)&?|DV0L?`s@K z8b$xlr_ct@0=?KIK+`kXhi4DnFtgm9p}9cMoV~q$K(Up?gJXFtIgn|1KKuQt^kVrf zaRN=#yLk84Lu{#3DwRs5QdNmWxE~VV_Dso`c;DvSI`7g|o%Zz9ni9nr-Re=+OO_fH z6P^p?Yil&x7Dg3}VS73kQGr0arJ{_>y>iN9^GijDsto`8y>1FT)A2ydQ{9JvuwR1)QwuuF^Us1324f!Rb0(T zt)YTC&6?<^vgACi^sA|akE|l--a1dUIK8BRd0x-b_J2+jxLEz+{{P+XUh(|@#s2?P z&*JgFc8uD&Sr<~~+L z?iQ^%Dk!W}&CcSUZ*hNirI{vDkf7yS+Gm;k4rbt7k&S{`Nw2JS8R_)?ulB#%cATBP z+Rv*i)r)G(YJ2k{;-BBMto+Yn{^qX$bL4+#uT#qZu=nQW{@*8g7LxywPZ9~{7P!#1OMJtv9X)I_OP+V@JAi+!a`$=ZF$Rr<+L;b}LDz3^NZ&z7& zC&sk#PdpAcs%t-^xYA|kzqE`!ivQh-5a^fJR_EABtVJ z-t#J(e!T>cY@9ub=oH$4}mz^9N?H6eH!26qoVNC4jMTW{l;h{gyVkuGgxX} zQ9=fN-QVB0(H-hzM)r1*s8&hYJdsv9cJW*QdO`7mNFz1+pw34 zT4-5Pgt`*zNE#Dev{9GTAhRphLa8~O<=Fx}Na$EEnQ{c@j@-(*s(^?ZD*(NY6hx9n6_0JRvZ4l{~O%1RWSaWVrn!^OQlnL3yxDxbJvcg8*@S? z0lATm84(W>btp;)XzhQoHDyCYL4@>uRq`mlHVs~u2r?yTAFbb+sx} znK715#Q0^Wak2_PL^JHB@?2KaQ1qbcWERmxl~mSBm_l&qAEJmxjw;=RgufPYSN+Sp?|(SU-wy7|G&XW6hy;DTY$Ot-%iQ?yZdJMMgM<_X94~H zS2^Se_i4&i!taEJA!G)|!&z#-;TBc?0uN`Te>|g<&yw?%&}^G2j(oIkEE8?*bl65# zLdOl2Q>vJ~@lKx5{t!eyYCFll{^kE=^^T43_UpY~Tc(@(_2BH}_~gePI?H;Ge8P#x ziI3KWN^T{Nyua^>H=@k_{l+Fz%0^^zAIpR;@*q2$qJ)TUlE{})Sa?DMzf5g)b3_c+ zS3m}05>0}HM$&B>oHOe)5G&e{gy|&2DcE+z+;>zfj%dZPO13Q9#mnOHZ}KcD|1JNM ztxFFxh9f`0HH*PK`_G%#uM6`3O?T%d|L>DL3&?-vp+nF+J>DoOruvsbq(ZQku6StT z!<2E70a#}o(uu!}la+Sj&F>YOIcDU&%T+n)jFEL#r`Sx0^2pFWum)>m_+XC0R<^6X zzp6Y_UE`RVwWNb)Fw5%FM3B`*hjPEyll`q-BbyS}+I<#W-z)Yq8H9?b!D-!*TSoM(3=m2 zhSOjaY#U(xi0F>ZpncAmD1=*$hjo=H`=NB#(JOMi7oxc>>9vAjQ~{Os?b**hyAyN9 zyg19MhBN=AnQ!G|=>KD!1laG_nu6x&|8HKG{Qvg$I-M8&|0$kj^#7m5cptufbnRdB z(X-M0bw_J8e~5m2nAWe`_%b?w1xXju_;q~+4ySyyw9;RIRju;l#2W>iz-_Hf5VDFF zA*Fm&zjY|U5t3L`sM$80QOaw!4vF=toolrMj*!pV&A@_@s@HSt&)>exu75`2Fz|py z>bg@dQHJ_;wnW82sNELj3f6Cp6bm?F1Rr^Kl*1t38$ikE*n3a8l= z`%l@(H(B5wZ7=_bYkd>Em)Oi}uodu@*~m8p^T^wH-H8RpeaS6+9h3)d;5FE1zJ0gF z=^}G1r?Y**&HEReZn-WzWS-e8(jpV9rrskPX2kqmU}Q5b`kNfp4E;GHYD>wg5wqVv z^AOiZvH#F$NSC(%bUQnH#q;02z3$8T?~^=B*?+`%AHMx_LWX~Rd?S!zrsrb>vU^)^ z36f|(&=zDj^@R*VW%4d&5K{FY#UPZ2RbvpEZN|xis4?TrH7XT4Rc};!ZU&)4%yA#H zVtrq|eky~~Inf^eWmA&;HW$)C%11{TuUK#lU(}eP;Pp{Gn=N8cv9Xx5SzX-vC2bIP z3(wLlrX<;afLTmdu;r!=Vm2On-S9G4LCSAP&p*RC3~dyv=c3p#jB($vaQ zRy!7ZN=|_*aOT!h*>`M{Mt;=4nq_PL61kYIV?I1qc?s* z`^@9&|BZX}MWjbo^n*Fho-aW_A1+VL8GMWEITn{x#(dJ&s!HXOQ7vniR-x(^zknpM zmDS}$NnYLkhPk-1KaVHfY(g(6>55S2fO=$kXSWtFFY+okuir4c)b?o(%ha$$T$tuI zKg=rkEDh0*VgF5tAIwSwHz)pgZ+o|B|J~c^?7Y~2pWZbm|Si@cCgjU)jQ!G53~;*~~C2t2ML9*7|1VfLxO)b7Lr50Hg#?@CWgKAqlIo z;pKo?RoscJ)0TNq>#f*asG!LdtrzY{EA*pX<;}4%w^q3V`Mt7h+ICoHaDUKMl*JpY ztNqZ*KAe8QZ0qDgq%t!y|Rm$%zl&Ta*cn&F>km#jB%=f!Mo!wWm**{y&3*6Vq; zC@Dl|t;f}Ze=!SGHH-&t&m_=iX?K#Vn#>iicVn{mjVTRg8MQcm!Hw3VX&UuQd;KuW zI`){&CjGk+@vgI5K7rnVKR{e#nxahVY+6XmIf>SlUV#34A9Z&(8jnP!YViR6uY_j@ zFIWY%P|q(>>kH^r8*;sC*XUQG0hRWD$+e@1?Q9i8USC($ygg&hm7vdgpZxFoJjVXt zUJI+N0Q2(y?(KAn{$H;@~#-y*v4{OsYUPdFY&Nz2D)~~q;AKWaf$wH?aOeP zzHDmdY@gq!+P<`lDeC4<$=n5Fww`SL`7&vqcG46!AtmUAo9|6gxB$cIpJhfCJ&a** zGN`}De(u~US}d2nqA8nkb-|rd+14GiEL82bZFO?n*|umyXJoV9ln=uvrDJgWwn8x- z)KZo!G9>(6nj|F3Op5K&WvDpvjpWGPr&nrep=%MX`b9Ld-3_|PHqxFfB3ZllujpTq zc2@jf>|asE9;oIzM|Y#f4=isRkl^7`w~|;h7qnpCM{ABF)FQDF+g}yMl@t(I;K+By z{w!mSZ1k;nnt&xrJdYjELi)cuBH=g~Ml>Odv@u8j@4VhFp8sukw_ozVJjt_yPB9mf z3NCY%V=I=O2=&t-^o10Uv3HG!gt@I1bTJATVrd-HgfqlOBn-hN28}WIMnN>(L5a%--Y3Z>^w+45btGx-?oSXI1p44HvzS!YQH=)D$S8m?S6+BI35(!}H5?vBSOOZjbZP@TCZGo z6SrQueSF<|E0-7>(e0aoKZk*8Hh{s!Q;1j$h%O&);mOEh{^~u&Z zWUp9g{+}Hk9R7Udj{U{jm_7er?{4oE_y1k->Sg{v!Lx$i%6q}|Z1^eYCqip^Cq};2 zIzS))PQr2i^`~`xvzS;ATsDFm#0&DUzR1NQZ%k z`h?#QA#fBTvYy*&t*oGnpZ)vXo9CaC6&s>S78nG`$Q-6!bpv69Bqt+@C=p)nc6s57yQ%xzr3&+7Py4^{)bsa>0 z4~ZRoF#H+Etuf(PXwL#=iEzc139g5B2Wc2eS4lX}*0sh{sT!g7-$@u!^eat5zb%ni zSwY7UHy6RRS|FsQA`&Nb68MB6tZA-oc%ol1Nf^2r1>OjGI1(xl91K7l#Ds)2MiIGD z0TmvBSKmH@_6CB4ZgLbXnz;H;G@kt!g=~yU- zLRppI;U^s+;LLXteh?uqOc^H$bLBDxUnLnvn4!MlF;1A+W56*^EI@qJXbNnSh;YKt zX?CgJSsL+RO!6qk3H9B8Zf&6TxBoaj+i=k#V2Q*pb0>Pr=@>RN7eAdNk0d-81Rmyu zZ3@00!cB@1Buo&jDSnFnPHCDT92+k(H4jb`0=5JeaKc(G$40m7cDMi1a%6vZ+^*Y^ zRm2{b2zm&PAZS3tklx7a1N))8&sUzEXimTr9E9*qZT!?sRxAR}FCL8vYz+NiFd(3` zGvZ~KuAqa#Acz7U2t4luQeqVkd=d!)kObM!9Xce;O9I#>qQ=i1I=YSJZHvcIobve< zT6fOuXWsY6s&?19Lsx3XV?!x7qCRmM9q=o3hvY@g2qWF-W&GOrWv$pv6|7&ktp;?%WaN_4M5igz^lbHI7Bqf@})Yph?iN7NrR3TRT<@uxz6G@U1O}-o^Fqz)r825v);dCku#8R`X`BOCy=TEhVPN7Ag zss`+V_ADB^LcXh|{3_p7HSR(#a-0YeZ^>YN+Pp4TNiPh9WYjT9!N6R0Yr#hW1Iq&= ze8UwS;$F$c4CyPtYq9ha8vRE5Zl-r!m9fNeoX|K4z=~@M!YZTdFEQc^V41Dmc|@CH zY1RLNSTc?|8Kfa2c{H11Y1jX9SOyV<>?}Rvy8dE>TolWskG&F#3t)Nn_TU{#2%~A@ zkwuVQaQ66BNH)gu-Pz$1gj^KMn1+EjEhE|#OIiO*W2tRHLix1u)L1g<-VsQc?c`KM#-3^piX4Pyw z9^>JB<@Kp{f=fU1=EzfRAeVk@&JAEpEZ5=7RdbNodA?V|=uJ&nt1Qtz51k_XWl83v3eQ>5Y}PVks8wCHWBIqNLHxs)$E$v{nwJv&Tkjbfqk}72BL*1iqTsLZqIj z0|?Sc7Wpz8p!8I^svw_naHk1M2u}hsA>j5H3=j?zg8eD-U}f-Kdq0tjiEvat zwLFDTTRHsrzvR!`HIa4O-FEric6$T0LlO=7sExWE)Mh-P(J;%bBILhnCii#7#G6Rg z-$b%57?5Py1Fh>ynGX>`kiP9QY zl#wm@6~Tn7nJ_uTMl=n5BvFu=D0DNMW`i+E$nPnMcsSLSz1#-mYV}I2pkimDxb_1N z<{KQo>}l_#F?s_d?-yjbM+0s1UPZu|T;boQLFgkAO@f3*V;KjQ1mK7Y%DOxs#ZrA( zM3*xxTNOIG$bw()Mj`af*!$pgD3RX7%=iLp{X~YsF3byalo;JR^%fd&^vnEtOR*b; zphu~$@=O*C5;`{ajw?j_zY&kC0SP#hS(Y&$E!2(cTpYgqwTL2C*^PgYsp!N{0ka)O z85#r$<5m|0#^8UBRV=Bmx=IsOR_zTzaR!wbKIa~juN%DV8ljPD6rDe3NC;I|0|OZVv+HC zoFp+<%}DhupLyd~$P~iV$p%Dw+3Zy3ZU-ZzufWVFDPDe9%i5X3)5&Jtj9h+K+1xQl z!FmEo^BL@w`b0X?3VgsE7jWf>zz~g8qL3*~B>_@KkitUkn)IQTB-0m?M{~xn>h8I# zg~!jjeeh9+usnX&ZCYP<2(85UPcn*g#;=e}+MEw8Hh#I};SUBmV>KjEBH=$t|M8gX_6l=dC z7Q%g+a+PC1l|UR1LC6~y@vFsM##<{Z=sYG~fI}1j1(`P@W6Z4J1OY0`<&Y?Usa^{q zK8;CF01TpG3n4!nuAX+X(#5S@ZPL{}U?`;ER^CF0+~RQ@k{Qej z5*Rsi#^c7ptFo)HL9ITv}i)$&O{waDF< zIk-!tk$uqtaUiZhx`n|t5nlv%lUtr(6hs4>jHM5-Oq9axL6X_I1#cfjuuaC1M-;F= z>9tl2TiP7AlFNjW=a&^h|C-TXLDujidn8&bNOoOer1FuhAnVjIn^`LJ`dm8cbmg)< zvd%1Bn+SrAtrn99-{4R?k2ilDQ6}>kW(ach3k}mT(I@B#AZ?=Kf#$uo)80gOGbfP3 zrQKF}G5mlDJQ?z*f}oyEy21h~1X~W{w$pC4u;&rRex^Q|hwcHCL}Th_*L>CDooncf zVE@-7;N(3F01N(@+t_*V2U(zn?|uwgtr+vsJh-PSd1gNwNIwV3fhdFG zq-U-S*Lk*156;hjeSdb?%9PBBK0fTVY~53m5^i`I}w z9*r0c$wTt4cREj-dA-wJBKLa39;(2fub{L!EfsjZ8ns{R6q|BTesO#7vC|k%Z z2)-sniZUFMgtOeRsU&kCjKxlyFpkDkl}s5j&=!Vjzun#}P;$Fci9ztcE3LCr_Sd2Yl!XPqkKn_K}F&YW< z_S>IbA@f{|5AWMTz+p!Ac9G-w#G^jhXjKuSyA&b1HX*u?Lx}DdAVjyC5IR5L2c1tq zx%W}jbvtgS)%y58LML=W#(k2Y?#?FK?re89Rf>*n9g~J`Fhj5*5u2q!5Cv>R{46SQ z81PZrhpc^qkyUcV6~-}7nL`H-9}!0-P2Jc;d=xM=#=p_TP6Hw@_+g^kN}VxQEN_IP zAz?Bvo=i|EzGvzG)Qp4e0;fVm&?KhDW0E(EEN&yB( z5!00F0SY)H;XrJ$aN;X1!;tLg{ZDSI_3G8H;6d6&aR{{jc(4V3{S1%BP%mnLih79x63eP zl0ihHaJu25kAEi#nVk((X8{!~fa5@QO1dX)z#iDck>DvGjVVwm+xbePkf83Bod!qx zfwdg;K~O>JL@HI`RSBobj+;YkfPddwQKcO~&QV-G2OH7gMV^_YJ9{km!dmlw1%!pQ z{}m(^&azL^MEN_0@d)<`4?LJqpze<7m<~xq#K_;^Y0m7bb5vUSE(MFd6O8JUL|u6W z2}H8YAuve-!$y+1j+NO#Y0)|nNTIBB`?4JEAv!@af==J5=FKL+lMbEH8b<>mzHl@} z0b?m)&6||^x|&6bPnky|oCMTlN;4s{nB{BxlrYh}7Fc>V;%F+yF+(Hkg^ZWX&o#Si za?S{}*(|*C#8B%=LIxz!V(KFu3<5AfLNT9uso3SfsLh@`lkLmN&gD25$|2rbF@HKK zBaVj|VH;|es87*Q4xa7=Ks## zZfXASz1;uzB+pY%ZZWraT7EDjjQ0>5;qBLZy-wfX=?uQ#+uQ99c6ayozW=U|eGmJc z@9<#v^)B(=eBa&K^>(-4;O_@JxZipG=Jj63_werE&6}O>PRj&>_E3Afv%TwdzIV1e z7u`m?93eR4>xr#Xq_2ge36oaTK2hgHu;PbPvA?s%{3|Q>l!K7TXVkKP z_t58i_2M9ksN6Kmx9Tz~%U^7>wSodYDw(?)41~P;$yY_d1p{cv!D~kaq{0bL7Of{J zrbfY-X5su(*(YTf9DLd=MGlBYvFDK(*2dO|GJX&SV#nTV6pRP_+f zG3Wr0@XIbMnyc^1LpQTU6Vr%I7@TZDQ3mWAGJBl9Fp?%?gwWO1mC+%L?fUBK>JEMU z1X!qRY(9Q!sZ3~vzE`9s?uJYRM#|@R}GEvRLlb^voiTah^clPnzpw( za9C1q)}pjz5vrX~>^78LXN-dgsg!;wA&fgX4jPkOwdj$A|19s!sc98^V*>ZbsH=69 zD~Moyg^%5&1#ecff*o}hsyGS8g0T9X@inP}uM721+sKQMdN`~mXpH#?+Q58NguBMd zP2Zs{Xh!*H)WVcG3Gb}5gH2#ZL1>_hS~a|v2^yFJ+0P2fe7={wRS-^9aJfv^RvhAx z={%AestQk)6Nn(pO&=Ul+8z!rL}dLigEQIRDUKM1_bk87jdQBq9x*AlRW~4uX_f8+;`>46w>kf?xPXdoY>j?S%o_;g8sWb^iTWJzD zY)W?$i8}MUVvVZKCX|=8ra99GYj`UL*t+|pmoEW+YEt(BGn4Z6fh&SCQPHZzcN|1# z1pCu-;?YQkNWpp&M8P;6gD(`q0+c+_?h|yDMv-(G8_)#OKzfAe6t&nmRLg@tbcedz z9q3Y_rJndugA=~}5Sa_Y1WIFk3+O~C93Inwz=$CnhV+K`$fq|^);djP_C$$*z(BU2 zgW5w~v4Y9WBP3BI>xb04z6_!P)qX@3=w+4Mth|epAy7|>1@Q|cIFxWi35UlyE<#YK zS9XE2lvxi3kes&b~7+LK(8Xc$DM*H23sg@Yq;aFUeq zXG0$u&B3RaJZ{F4R)spA)J48FM_PD1A9_dpn%LBSVv<1f4v(E7eKs^v*G7IFiom_k zUy2mnPBT(u<>LN;e^p^65Kxlp*)T{<$yX){CC`&6#-4SlyYv5pQ z;F;}Dj8fB#4^8npE;I#Z@LNHobAjjhC^5grri`GEYu1N*MsT4hk&*@yFs%eM#b z{&8`3@b1VWi8||QciUf<2kZmdWkz2fSRiyuzZx6g(r3lLF-cCSPtK+79FB_6J9!X) zd}@DZETEB2-z~}nB;vY=j#`(^lug4pZwW?L1hYZSLG4^DvywZ7pm(GKoOe4v3PlC3 zq>}F|<^+6o8NP`KxS$$ik zh}G8X&THM4`P_rIbNl7daXhOrbpyZE*lwq@n{`Z-=)t?$O$pVoz8y<@{jSsbPJvIr z?@hdD32vQ`h%k1V&_1ahuUx5`GmIpSls|w~R-Y@{vUBEfMuX-dJv|N&Nr>(92`2v( zsNCRy>w}0yolDrLp%`!jrvb>f3+EYkXvgqYMH@ZwxfzBrNdoFyxCId>$prGh*mx$y zDN;?LmYt8lG|r&u^N|KvV2=kAqRtP2zMEA|f!~fm14lm6`9+{0@KV52kPn-vpK^pD zWs1tvgjfpFLS7klr}7e@JJg2O+Df1ZEPAjhB=@F_zJ+FshMHKtM8*_i$Xbr)kEeRAjL=$;82WEj1wG&(h0AO4)aFD zPebVtl)J4;@zBKdJ~<#{oz8+cXTHT zwsOjdd@&S4FsN6z)OUN~K9(*enD(Nh# z5djj6RQ?w_Fy9%G?u_8E8t6<4H$hB%L{q-0BC7Q&0JkaJq4xK9+b3_{>^k3f`mddC zmwfMh?+-f8cW=md-+kZj47%R;dVLUh_Zn8I=0TO`>68%BSwW9OmHA1%(*C5{Kbljm z0zK1$WpCt+LRRKAWj7XO- zv%1!DuXL8iaZGTcb9yDTACj@n>^c(Rw2sg|P%Rwg3G^SCV2ohM@ zyro$pXN#S;!MUZnqo#8sDP?3eIX$N|g?{0FI7L1cYZ*kZ2N2_*5FDZ~7}N^OTRIcZ zTjg~$+p$cW^_~D<)7EVAT874X*iRsD9Lq74R@oTga@{-s`}+?+9ZDX81PWPV4{(UY zu(U|u{!Q^qOU*F2CL!n&ST#Tg$V(Zg@z$_UGBs7!8n_~Yt z()yca>-b*ocPz*~^nHy}p&Yb})54Ax^BmP-Oj42OhG;L5w-i6joO>2?RahU zDJue&R`J~igq#U-9FIm3@i^jM+}qj$*)I62x7+FLDi~#|>L@EgR7FYsO74PY8T)*K z$3ny97FA6!7y5kPYAJ`}1J9#r1UqM`a~cg&=1W`wC9zLJdIM_zm@*ztVF(fm2{`&w z^!DO(6XB4LXgVB;`OwDx1V6POIiNsQF_R;?Y{k-k*Y=? z9BF0_Jvh4*#@)EzRD+zuOrtU*jp}-ROD}ygrX_f{)DiCsq=Q$jLhSa+3VJ7%fQwUf zXsJEte88Y_MEFYrE|jBCOR}09wxV9hnS3M zbS@)?uReadLU%2@H82!ZBJ#7)0q0?Z#!#vrCmW>#M)v7X6>bs%K=5m)QurpH`urbR zhG>&(c*!>A<^K_X=ktHOd9%0slKxjKr|_rwt{)JB^0fb-|a@aosLXIZY^FC zXGjEdf8R0-SFS6CZaswJ?ih1#^ivJ>6>Y1EEQ_9MnSLzAG$LCI8`80;xk92Aq z`@}-Iuyj#lYOlbDVbK+PX?dzd zN<=to`1?WRyJkovb+QqX7Q&7T|LfT!TRxowcZ(Wi3Y91Of__UqRz2W@aTvj zQ4;ck#7oEWE|CVEP))S$u_}?e;68XMo0Z+xXYjJy-R(Ef@$RgSTdihY*P~v9*np6g z@T!Ntju6IkM3hrM78=P2?x$!bI7N$!;*KMJpi0<9HWSd%znWCZk)uf!)BT1$(AgPg zvrRGEgX*zmS_8xpi^(Eq+H$~Ky^x$2O1C1 zx~{)*f3J#v{w#U?{$2FbunE051m$<+S*??qY zK{S(q=l))>GjOjck;kQg|LW)Sqoc#~`>ci4&!jp!Rn}M~Qn(=h?bkyTGt5C+gHG=m?yOsn z_Wb@)vV429LF?0@WuU{nQ$MShY}+B#QDqAV7;FEM7-+Bz-!Q_BN11b7V9IMUWm{R$ zPn-l3^e-J%K?{Wyl&wyu0h1JS6VCWH~bxQKz-Uy>BIBcUY--v4xXDdheBm52F^ zDpy*pv{!YNHu}>(YF91Jxwh`_+oHWp@(^!CQG4~XhI23AGysDf2LVaI*TN1SQz6h} z%;WpmH9lVVZQnj_Q)CJn;`q&Gl(hKl4x%>Nstq2I9Zf&(V6M19VZ9=rRu#< z6A*8N&o@V+nKN?hRqN>F5Y;T))w4<{Lowzfqj8k*Qx^Q9vl4ji2IKQ|FbHl@d#jD^ z@3%gGF3ZdE>t@?fAtNj+YxogrTdsn)_%Trj^e3s@b zff4Y6kE-oUGP>4{DdXoHC%lc?cC;(HpJ7fa*A=*#pFM~G(rljz0DHJYwu66stNvP8TTR{sFx^)_}f^m8^Y`HbC%L=~18Tul}v2uAM#lKgSoB=f^*u9Q<^?U%5@L4gQAx z8e{;1-zbRC>Sr6?{a=w!ja{SNkVLC04!q^lhyc!L)nMMZ+ZEbC=42;JEC36z6UAVL zCuy`*ci=e#NS)MZMwdC7MpdU5nkb8?e6@`sd2cerwS2DG4$l*2)kx|XgGxhF@!lAD zUPgU#U|ln#e5Bd7&mUwBF#V~>-F7g2Wf+S-r?FyWoAKk`@ z%<;nPygzW8JdR^)0?SAnn)J}IJ?mA(vGvB0+QwWBx$ zO+w4V@*)#s!)SPp)N)WD-4EO#&J<7RyC9K+3dcpQOf#?Vdx0~Xh#aYaP-vm@XkfjcqZ2_MF%<|K( zfi$ajA(hC&^-Tc6GIg`Ch$U((m-1z6Cb73nRV&(HiR!mAsJ!a&TWcnov9A#_CgiUX zlgQGd?R7u!IBH8Y+EPxpq4AA}aG{PuSb``jrS}pw%_-NMDI^!^$~8Zv!;nl!*cMBY zg4?c?hNXOZs4Z^+%Zkh2qV*ZxY$}?E%cNXVvgP2GL8u3fnD zABy$GP^WQBlFEf}HPo2Yfy;)V9-o#G_aEI z+-%sHda?j?A%o`u7G)NJsh#cSk|H8yxO0?ImqZg+Y(=uYY=vSvX|9--%2sA*LDoL- zr}ys;e!4t)e|U6$d46$lc9C7x2S$V00Ij4Wu1scff8TCdW=!48>HEXW+GZp|Opa2zxDI_;ArBAhTcpj$EZ9Z0FN_9@re$-&P@ z%QYro~FwzzJhH9J*&W2RD4 zXcUZUGWYE~6)Zo6Z7pnDc`Oy?X6dduNkz>l2R|L1U0hzg|Hsiu3uU>4t+`mZQZ8>) z*I>?%&VD(5cXWAtI2Ve2d7K4FZNY8nlIykAJ8gK#f43>Iu(ctlSj%I9b`3730DQNz z8&{&16>pB{Q~}$%=B}D!G7(2E}Gd6|>r}wpC}_NN5}UuZ^ko z9a=s<#D?Rj14l>itmD%<(e67HKE`e!2EiU)iTl5qLFcFPI5JVKAlq7`ZR{*6}OC*qjg zDei;V#Y)h&9Ixar9D77Yv2Rpcm_e$H&oeG`t62UPUQVA(0zMIsS!eYR;xLn3a5?_6 z6U{y%cjdCkK8?QhZ^t0EL&n2cBuj0%7?XUicS+Aj*cxuiUEKaae$w1z-%7tAE6tHp z#Vhf1a_X5XXbyPM^+QHBlR_z4oQUm{Aa_LEF>hZ zX6!8QzTo6P|2bpkLLLTlOW9>eY3#C*#q}f38}q#MwkX_ zp5^xXiFo+-5hOSyPktONBfG*R$L6<>FWYq%=od|OhOQv#zO0sz_tkyap4!SJ{y3ag zx_lt#P>#_LJ9JYS-IqLZQ%F2AFEw0^3+uYcSpVoM zttL{n1qib8HOMbmy|6!=?@_)Zvs0zrp?rL_b+xsVg>75nrD3 zOl<0ErW(?z?qBa7jwr`{!Rs#rj7F0W&5?pdo@Gf2W`?SpnQeh*`y(3 z+Clp0vz0Ix2)zNlvHk0m_uYdJ%GIeKxZpfEfN%Lzb{maFwV>K;fVl%zyM@PHtH#%U zkRT^6B)t-?suEuD8wtQxVt2(Ksg-4DJ)xEz? zMhWVtAwg#FtVLHXrH1=urpcvyP(rNc8HdYCzSygiq7 zm1^a}e`w?~%;?=FsiIcfqG zdpwvB3t-{gK$pIZp*S10l%{e>LOeYu9*ulfoti7(P(?LC5_$dc0&sE_9?fmQkzWbQO6mfCb^mPvt*7YT^({YHBAUMpAcssPGFXl(=F)|GCpKg z72J}%_Nwl)CzQ@Kmcgeg0dPgJ5Hns217c|y`Tf;$JoCV%ckxKD+>&alFTbWXI;);D zSt=Ht%B31C0~P5uv+ajNqKWY&sludq1%g|Z-q13(W(0n0YimXc(O1Y2&Sdr}l2q2s zz83Ud68SL=jA#1l=Yzxl=fnBM(cz_u8@_LPBTNqeDgs)!uh>~Aom|zw&K!eW2D*v? zcxGq0OKuviam%HT{lXenDU0D^b24vUTugymKs!aYEnR$B24Z%Nk;QE_mmO4vubYaH z$9BmEtrVnImm*~sTck&2uj~w@`IcK{zFz*1M)_Z4!nNfte{697=j-jl{h!;NoxSas z{4Y=Os7w4xA>|c0_A2)J;`@R8uI<}}?1OfRrmDGYJ7AaOI^Qgg{7fLobOi^VC*)@? zsq#7`0%=mRO|F@X$M_E#;Tth=$6E;viG!1|8KfGFZ2H?p2CFILtVNoOid!VPNcV=Eq!zIm#!+1x@MdN z5g(xT|6-0jl+S@KwkOuwTzfU=`u5RYA?1Z^K1+I$q0`PI*EU59)Ie}JaxwV+Kgeg zg~OefoHGwa@{!CFhTt;d;1`mxfJQwu>9($e$nT+ZIfGjE%?^z(7Eyb52T}}!5?~T* z!`(;#WVP;&IhkHeUAEBhqGZ(~)Dfyf59zGOnZ=={?{JV8YaFQpCo+c@v3^Q(rHh!i*WH)=pHK1##@l+;x)=ov z=@Ew;0249vC?*N4`$&&H96Dt8n1f2t`gKGiRJ~#dut`cbGXOXt%3H-pGzzBxQQqyX zz`fea_Jn!oE}`VjaPZ2s$IM7{q!6ic4Xd&xS=&vTR6?psmYCrSWOyg3Fstoqa@`qM zI@o4rJu-LAD=Ms)rB8NozH1`{q&*Rog|iz2KsVHxhg&JTrv-iM6?%t5F9o*YBLYH9 zuDpHBV1!W-0kMlW-BDv*!1O2rqG8`J9YtiVhMw zR``lq#kNZNPEOrf4aCbd;z5{e5QKYU<;K=JstvrdMCshd*qn9$7FCf}0}a9C#OWdH zByJhC3x+JHq-0|~%(C`WPN$6b^OmAjm9*5pl?%G3#@+1`jthBX@eOlAihZY#LmYV| zaUdKm!eI}!h2(0ta^_*J$}x3o$oz40;U;B4)rBm$_KjU}+7AOZI-&fGV1Ihx`(n>bSPumMiw^tmtHb6pJUfnb z=pnFBJWpfC%Ts!q=>JN5Vr4*I*a9@q{=56;by5G{e*I$qd6H+Is-jL!=9pu`pkFv< zIk7Jd%dh*@%RWvyg@g5c!x!|LL_MSrU2?YSF&>iBGz`y)mk`cuD^>AZul4zJ-bPib z4Q@9mmpxk`TX_}LSJ|q6k*CT0&zy49mLQ?wB36KT_TQb|()}NAcK2T9|5H50`JeQ$ z=i-!)XcGJZI<$NJ9q6G(GAKpxjD|H<+NwM0ozI`=o*CIj*cvY_rA3$gS&}r=cgW#5 z_%Wer%zEf!yS>@Qam=NTEfA0 zkFb!C$3K*Ea{`gQS61@%{Gkz)Zg$|bf!2o{t%oGafUFC}cB2s#8|94+WZxPl5mW~y zqMSf~QJ6M3@jw`aoKv4aOR%<|NA@(HOp>xtKq!G)aUS5>tPTSxZ{Vf@o;&Hiue2|1*o> z*F!9Vvq8r&(3<*{x77$Ub~N{JrA4qBlndL!i;l{|m~G3cN3G%PZP=88Y< zqjtVmB}P&BuS#?rhrzA#DpCrLKO5Z3nN4j)fmPWj#}PxmG&ms<4CM87pd|XsKI(2% zFmcN!I`qbVAqUJFe<;yIvfpj%1C;C`*#pA`=Y*qj*qGfy`RjhWilc;j@#E3S(fRQ? zeA~ANv-3$UWBC&6MYY+M5Fe5A2Wqd{HDH(xOUMxZ_UbxxP-hRlLte^}<8__w4NdSy zt!m*@*=UZp+N+<{w%~p%jTuS!r8jojsJ*aO51cQUG*7#B1sgQ#hZ@xnfK;}{k*BU6 z%t{6ZY;;Yga^b1(OtwQ()r)hky}IsUJ|{0s+E>HSq#=deQVk`+WJB>{otvtT0xd*> zDcO=AbRlAD<%^mdXCF@Vxb1gyiaB^l!RW4MP&UB7X+*&LL=V5)wz=<5VohwG+2{2A z;k)-APA(KPZ0~YSk+*VF9lg)RN8gh?{*ou?DVfVkZv+!j~2@P zgIHSoa=D+nNUu&BZy}G=pPL559$M9ZW&&8tgtn=mmH|^VCmU?}0P@w+(iWlG7p9w$ z+B^tDbR+5KEo8E+FiN-xyq7 zpERe-9r`_`+{6p|KjR1wAp`Cy4Fhl5L#H^wVMxMO!4RFsKIY_{CzzArRNAVgulE@Z z!yp=dfC7dlLfv0~0AV()K*ThNU@})w1R6*E%Ag8YT~=>ki!nC0BD6YAC;^SQ~$t9wow6C&pDI@X;|yyLTe~s zIn#$!g(E=0!61kNKCPpS{$5KDE3HW#j9l)N8ZcQFu{tPOiCQ26({~x5?1(kXzNvIc z`IJ&rfh%m5AVK^(qm(yHSf_3gsLN8ff$lWU-A?|PuACmM62*DRzPj7R)4#>Ce$A=B zToSJ$(0Qr5R1(DkW}U@=kZ59t@r&gh+?au2mh3NM!n@q>dFlKT!bov^c8lXvo5o&2 zX;#=6%(JJ?Vq29Oy=b}B55qUuAL~oo9A`iij}%Iow7M}@!RwBK{s%I0idJdLWn1^d}Ru;o|Ar8hDdQUVf><{FOtmIC-#q$}? zteOkVn?>Uc(!#@Ib)cf|zg76dfBdu1{+~H);yu3ocV};>WdGgkyzKv<;t^Zu?CHOI=tLf_naJeEami-0QI4%$C?MIuDa9f$5Q+S7WJ-_<(Z`F# z9zO~;1yIGzvSt^(nrmB!V+2Io#-GL?YBrgAly@V(eYxAz^N71%WRBOJkU@h>b`XBC#!$7Ofx}ZlZ*Q z7;cb=F&|m)apbpFP(+6E!m9N+A%ozS_~<6!BlM>Y7rl?dDWVb76eyvXBq$6b;$>J-V2wS$xY~>&}7yweHZBwvp-$^cA|3@drIf12Py8kBhZG zNl6bZC7D+sLpMPfqCP=Bi9;QuSuayTU#q9$^e8Q-GI!)-C9) zwqraMLqI1aNdn&|Vx-&cJaCIHKom}qe3gTwycfneh_o5ssI&zFDYzamMy3)majsMHC6_ChqlT9E~YWj zK*Zn807XGq7~Aal1enM=O)2-~^L@TD2X-&fHe`rKxvDVJu;Md1XcqYw>YQRes(>WOSA=BKt;o_f&@aLY*rIDB;z>a4da>X& zKh29ZEfN@sd}K->9Fn9c0kZm>UXw`jfUb}-k|20*4|Y~X&7Hu{S2M5eT1E`&+p=B1 zFRB46DYEEKNbKMHm=Wc>n=(i>I3_#^JXQxUO+o=MO~QuoX5eNK^JYZ&2cLUlW zWmC28xE1(YNS+`H#_1UGU`$jL>^Nmy;C7Zqk&ce|h z>TY+6ZRQT0MU!KE3(cw6SUON{xnW3eh>v`F6J^k8$`MU;1EPfjeCsr(A5!o7GKdBg z?h+DhNoIu`vc;5#5{@Y0@VJuZ7PtTcmH6~h-LYK(PZwzbEqAMY1t?46&xFGW=Rq`N zGqBP{8eo;beW?OgcEZ&d5{V``c@a&5ghp@$v6x<4GF6Ztc0(w{y^PrdTqQH+-a056W6FPnQ*heX;v!Mf!)_eGWpq+m3lheq z)VV`DrJZcsx@CHvAN(fJr2(i=?>g6B}!>OPfPXvALP#aon&l=k78bdX_5wM0z z#p+8n1s4W+fP*kiR5z^nC+edSW(cFUx~mYeDdS{}ZbpGOl0EdWP~rnFsVbxOA^8BP z;Mvp{0|2V!1Pdl==Y(v#K=2X43GWlkT|Is?#xh_m6)TddRLLhXNyY&aI=bZiUyGa{ zFyxJdb`3qYi>vn#bIEHafU&}B{Xp8@fhdtL(>jQ?Tp##|&QP@OlQauYpVdYb`=?IHXCyM`H!`za;M==_JuZ-A<=>NG3m1pKPM-PG=LH(xZz_7+eRP z;Q`+i;&Kz6zWw1sd4=7Hf;m(Qr~Cq;mB#$jnV5cosA~ushn{tbd5SF1j zdV?)3=ES!Gq9JB5?T-UF8Fb_#FumR{+*P8Wza(hqndbaF*_IR&L^ zF%bGSMnf^FOV!XeZMp4dfykB%%4Vh9C)XM2$V&y4&@u9ULiK3 zY3Li{2d7$~vLNz6tcdQTe!x*0B_s?$nXQ?F`j&@tLZtA=M!gv0n8~}ZM5~#I)3-q~ zb47&Q0tHN&O+X>Zwl3NHu`b>Qg-Cfg=mL%?P=n_!omul%shw3-*%*gmA4k`-+t#J( z0l_VPn2+9KMh*jz0yqq_*{{DNKSC?J_dNv0hikt8Pw;G)?u=x_CToEHY!-QduU zVP#(^2!i0*fXK3P7N+s0SPDl%A`4Eobe!*t;$0>>xi~G1`$zd6@mP&MZ0tX+uc*W* zJa(-28xbHB?TG9Am|M@`23|w z$mHg)Kb4HB*N{7OvUPy&TCJ58bPN#l*2T=8h{XT1hFzab#?&X5BpL=0tSTUwV435w zF;6?HoFmIQNy>Qd?ZxS~+jTn@IJnh!9xPEv0jh*S3BUBhU!Da1*Gd=>zb11a zKoK#`hO`QVwNI@FV(nBbVT?!^&ZsRuSJu-~a(3gEEUoE8&MICF#T2Qke>;0DVLhm6 zTH6a|@RJgnHPjznCb2h@^dl#Uz1rGy#%)wHX1DaxCu3TwdrKYhKC2>x+dC^LPaP9_2En@8QL{*GE9Y%W5q{G zP*6dsJ+=pEeu2fl4}`~|_G`6F$zm}(S8kx^gtJX_Xp|}@weLer#xy#Yr#x35KV6j? zly2X1T18{&9A4YD-E^U4dy{H#c+B&^`tx5#ZaI$lmQOei!sT!OobUg)yIsux+}U~k za{tqlJUQ3D?Ur%4lFoFN%;}*Ij4<@};#9_yQ3f`9eV4y4l#8IBa&^%7_i0R$koZHA zT^H4At)Md!hu9-b9ozWi*8NS{Ux>Y}$&3+N$)9c_D}#zpZowVJt^@~dV)|sS^wH;t zgt7E!k*5t1!z;E2smIfVwDLf56exh|p|0B%J;8lO!;~vO7qL5}$=LmkwZwlj2xcDX z&s9}fIv(R>>i))fOZ{B|AuA<-n6oi`0HcUFB>V?hGIWAL7*w%e%0SwNo0hQ%70c-N zfO00)ztVNLH&LuuZrkm) zWP`_^D7D2$LE@j{gip6d8CWMXtwqDufM7AmtcN~+5`FQh2g{0dM2gcelt(sWoLs|S z&)H$;k)QeUU-9h&+L+`2^X7H8aQ}Pv&CZMe&(k~}jTlD>j(j>km)4Sfl#t)kAR+5( z^1Za8tZlSpVH!(q)+*<2sh4XTEmaEqSoYD!RturEsu^!7J!_ky)JGW?qoW%A9$KrC zS8JQ9gpwv}861@RE@VDQF32tKp|uNT_SZ_RZ#OQ>Ti)broZMy~h#znjlWZbqB61@m zN_C-o{fF941(ZS9i9q0Q`uRf|jHeRi+ecD8Aj1EuEoo;t~M|o4h4nPc)Qd&cLLlWd+ zMi36;5!T72g;2mA7wRWX(3-O*^;4+M%x!)oQeK=ms;S<#u>Vvbnfg!7!0Sb*H0=K{ zx1^zyQlZk=Tcyh&Uq=3`jeHB<&YAsrTYZTWw837eZq*#1OK{s2%h)|C`5?i5K+PAm z-OdlZk2#j=;#!~5kl@IaPiTQjlzi;zKOoI<5DlM@cNUs=g_Efg&2`GRw;}betBHOt z&re{lug?J05mf2i>2F_U4B)gJbK-yPQGl1TW`KR@qHYAt(Qt|U@64g`fj%^@rv9&RELwHO%qqquWu$s6K{>qP2_3?LMw2t)Yw*9fBz*)|_vNYBg&4OzKjUwW4#5I*g z@r(*%97JFg>7g}^vmplaMr4e8=wrszL1n=V<-eCdO?b3G__V-l*|4u1wmg0LVRb}L2R#bIp$K8taC6AN0z)V_=VC)-QfVKyahFT zyPeMN+*P5`icqr}oXlDYEW6W`ring}HT`*Z^P-uUfJ5La;aqrMB8E@BYm!)p$dW4G zI62h8bOk})mA;fnqEEHI0yP%yC{Bi~qL&Byq<&UEv*Y|{*wY45`=nB0H;~qaIiUr0 z?sa9&GV`dqMSiQST{S4Ger_16#694QPSa4Rh^~pB^-TUgZoo7MO#&7` zcGl@BPVks;k_b7F2sFi(Q;3cmu`icFSae{ZZ_1s#jFvFbOMN0ihNNXp_^+!7fIlwu z|Jf~f-}V8+mzC`mV)DSB;K(CBdauqu=bmNQu@tpd^>h2<2!iu#EPM9JEx=ANC+pk0 z8@l8TPNE z_SUbK#lN1hcTGwaGLCr`zk)r^5N1fOC_#ii94jm2r&eoB{WK)5yf%lSeK_girErABHIo^}RBIM%rB|qOMmI7_ zU%*VsPue8}w4XUG{8Owu^Pr#59Ng?gB@eqRPdzd}5eU}27T8SdG#IQHWWE)=i2LMFbaRh(r5k=|*tlabMLeJ^Zh4Zf1d-YNRhA?ay{#Dgy`32H43~-R3kaA9h%!jaH=db9Z8t;K8*p3MM^tK~Qmpqkb!8i1^Kuu+gpjJaNR z+u5iDUFmzEpsrVYFQB_S^zqY%JI3+)y4b}7yTKV}@c*;-uI+8(NW$p(%wK^+r#Dt6 zq$OX|-p!tMoXm`$?oNE{bn@(W_uGa@NJ5(;*Z?F)lX!po``}9OCQ7!fI5Xmh#3FGi zR26_ip)Of{FV^JwgT1G6ZsBxyPhY&~b{i0&y$PMD7w42jh%rJNfws4B1%P=b!M%F& znP-ywZo#(vTPo&mJ6CE1zlrHp+3NI6dsG|P=DF9?y#Jfu9Hud(aS)>c+c_04mvsef zi~qd8+bhTa-#yyj?EmX{O8$Q^%k0mtbaIYShSC_N5k@lSrP7S5n5rtv9buRgIy(j< z&NFtrvqRxcIK+H3=}#D<5lJ~pc^HxLP9JlzIT_x{C<=DFySwJSCli{g-v753zL4EJ z9*D2rpMy)ykHF+&DSB8d?>`H%acFdz*i)Lt1ox>}%%<*m_x{z^wmZ##Au%k`N89}0 zJKC+x|HDoG=e0avYkKS1jfaTwW57mm_u%ljAIC4ge-Xdvp`%_8z1Te%?DYrH_o&R;e;@809333&?HwNdkN>YW(Hov6=f65NEhzxB&Hrx2|9|&jZ*%@%%Y#0_ah9MD z>hz$0ZRWAN4l(e`|R@f8KfK*+fd3rg<({ z^;;#{^~W>&JujI-J_<7sywCW6ZgTBj_2t{ zjy+(UbZpvQCu4wC(R;v#*FOelV%@Sq9WFBz;Q@|30NewP?|Z)DRXqZp{8i^;-kFdFEOPa^(F zW@OhW%0D<{kp5ODIWm;I~H)6r?;tQ zi!51${Jw&uZEa~O()m&IXYfc958qw?BQ~3M-OvBCi2e6L`Tl3W+ug+fTg&4~1<)x> z5&&(`RU10g#1u6e2C-qqm5ORBFgzu^-|n{;8vb(cj!xof2r8Z&U_lr4y;AjLF|G7Qhio z#v#*7ORXkI>S{tweTxpU+^d`C6KkIUq*^Hpi^_7N~34&k>sm!TGp?7ROx_y6Ce z(O|0-(7OL0mF>R|dYky~>v;;3iXlG9K!UGPF&o9P=WWR}|1gmjRwPvcvmr&=J{u;U z`Yw(Gk}K4?z&P0-gYnF!pa~-~R`#uMcq|=6824l}cdW90nIsbzgm6zx&D?QxPV>_L zsG*Zy*bTe7N^a58Cw;aP5t68>Z|45avx=ai7=1#M{A$bq=qw_0lZvW{2fjj6UP=A# zGzm6N$ALX&JW-V{^ia(ek6%;fJsiqU3IUliX3fiP0kM8*ng*q#m3plq4(tK0?sI7H z?UZW<@@0EvcgdX7Er-LV9>tK$9Tkh0`zZdd{(6!#jk*Cdv=5yRh2nZx$1m*$Sci^6 zLj_DI!Bf$$)PfkEQ!yWzxx}a-ReZ=#+dJQ}NqI$y#Wf@!4xkr9nnfsMmny zlivlOZ zdV{s?|J{S5^8VjFINZ>G9Z$*rD}o#i<=OZw9Z;AjNSos)R^zC30)AB9Rp9R^83V~D zGP25$l1ZjwUMS5m8R7`^5x+qw1=>#pC@u>KUIYY@H^hQK% zi^fAmd8gF5q;QJR&KNR|X#Pn#yI`46%rv1t$~IzhlO_blY$qW@!pyf|4C%E@Fm{b* zH-yI0fkw9$=onjGU~g5tAWz8_n6Y|eh|P&cR7YcolVc~`?SDCtSUbm8x^lr=N5w3W zt+XOSmpR_qxw*Ls-N80_$0;g*ZFb!}D}L^^{x9ea)VBZk4$J;O2YbDZ|LTiJLUB60j7BJ)Bsd+O4O3!YzxjkBnY~!4V^k%S zM#w0vorbWOqV?HXxIfon7?n(vVeQJGsGoTbidHO%9RQKB}goLVaqw?NQp zQR$e;-5@+1@ng`dQCwL3zst79ii_L9czRK z-x4k7Q12duvozz5Sm)P2se+H9E9VflWl(5m8>Wm;7=!iBD` zic4TdVuSx3@psDc^7P0^Tv`w9ZMUU`)Ybk}Ff4MlxXzb?L*=4$azMzP4{Zc>=L*vI zL70CiItaQzI924BI-m;Z-IwMZ>ta%yi6_mk%xuqRqhpSx?7Az4PPKMh8jGD;zlnU3 z;(=63Y|EPo2Wg#hQG0P(wKj92V#_Pl9Kp*N;y<}Yv*+5%Pg)~Z5MGApiCW;4SEQ;} zyBt+IwhomQ<8O_%HvdZTaFUUP3}-)x<+g|rV*tM7KDN5qSlHFR&TP!Lz4gt;vL&b3A`@)Rlv>$rT92rqdRl>`;p~O0 z6EvJD-6m(O`TV!4^MApGzoY?ZIsYH+_72PE|NZ?<{GYWvcR2s^5ds|2A>wXUeSJ~T zI9Ce{B9ynxH3AzHW?nRH<{5{E-9hQ?DwPsuog6aoJ~df{#_ z=+=00Hj_T=*aqc>4Sdz*&a~G@9QOPoCY#FoD??92N%{xrFNhygdYuUB3o&Cc{FtJv zLrzTa%xl8EIO-bA4W^8H%IqIo$7GHM}+FkI!mE&UiH+&2@Snx&)&;yiWH5>6vg0XgtSvW zv4wBgj=^U$MOPkt!E@-p@?B@_yDaF>ow* z^f#h|Zdb+IDDISbA)ULLg(~M_D4VppX8G+0sbV$(Y7JD~t_(yQQN-;ZI#}%hqa>D9 zRMDW@_45t50%7l=AnYvxVb4NX0Y%SAMI>aKXH`htVOc$V4MnOb=oGKGgv4O7?^-?p z8KiKm{hZ3ZfdJ@@A^@gl2!1rKQ?|6u&1+J?tE62{^asUyn1dUVKIMRqD7i6PsOZ-Q z(FLdWue`r==tiw+7X8{#>Ui%~273Gw{6TOkukET>aBnVP8rRgXT>YG}pA{Sh{o@k} zqsHm+OW^;So}XM^etdWF`VzdkxOjJQ4E~!;)O<8qNo8Vu6T2s$zokhoqzgy;p6M5o;(Nem*2Vw7?W69&d`CKw<^C{|({ zAEB9fdyO(7Q97=N+WSuV8?u#v{nrVVsZMb!6J<*7j9@DICw*zQ9|Op(5q?Y}Rxq(w zSt^p95xEIC+2NE-`UzqqLU=Gj$ygc52AHu4Vmn*;-~+{e!OaLKD6n+Vej_vY|%ft)ug|8xZ8J6Jl#lJP=u|j29c+qh7mI z8xf?Y;v#xE&0McZbd4xDlMG?Ud?}@2nUa-(?L5xuF_7w)0$-?DpXZY#QMH&+>U8F? zYnB%;F|8Gh8~L{Py!qR1r!hdu0xVvD$`LZ1_kt-Ucmk)D5I@zp%`Qv1I0_13atb}X z1Tf14-3o8RT1G7X@`@p&<)8}HOf=y&0fGl$+qENen(1^3p zG(hY<`5%cxB;;bz(I;&o4x3GR4wF}A#>!c}bSP|L?;3d8nOuK02Rk=YN`cU(M6+>; zCTVTC6-Ozon6z!$pnG10ZDb)SmR3ZDa(9)nu2Xrd~%afb` zJ7*U{!8ZD{(0HBIN2gk<*+fHi;80#|11>A%-vuEH-z8Sv9ImgII=~twq0Ya@nUIXjf%B~j7L4+ zEJGpZZZ;TtXr~EeOs+Qf!sl73wI%Udtv=rtW_k2J2zI~r4*YeWRmp$aq3bUC-(Ig* zk^gr0H}SvM@+_hMb!0ii6pfi5nv!J(wfPq89#@}(z*&p#l0l-{pS)m9bwbdBC*3{r zL6p~P?Fy)JILMIc(iT2s8Hz%tJtkcbNO|qcrctp(8*U3Ol=nsNvZ&guqu=_os`X#7 zQhglgmi2$PyI;=#ebno2?7!CXEV2H-`ILzjs+_b&vPAQN(OqMLiYuI~t7746t*a>c zZi*hu4JJu41Ak6nf(IDI0A`sSZ0LPN zs&!eOi#`P8%o->&GDfaeCOS*dz>pcB;KWwwE$j2J0ItH?x7lI9`n)iO4*gCQeYvxyGMv8slE|jm|q<@Ejm;y z#jVrAT6nuOfMqT$wDu%jxXp&Us}t*77W| z|6BFHqP1Sa=jfLVPpCCqYw?Xj{ZiXE*WDr)%h=p;Vp&tmmk<2$%>Fq~!Cz`B0B;H} zcC793JDtZ$>Bwa=X_eB_y#g>+B=Wrz{T8TH5PGkiFhq3-7Q6E~?nI)9*-=P}LU58K zvS_sw9hu{#6u{ch*ONFNbr{QQ%NX-@l0ntiWi!dxyy{wsyf&E1&60Vt*@n72z>3a z5`QSh3@iIk^=ka8cKr_U6O<15$OpZyq#+SBl=n!$m;9=`Df~UxfIv_F3de$=z_L#j zC7)UkeQ+~ER3+N9IK~VxP6WHpn+v6uYbJw=VC*6a1k$JKKU8D?S!}JmEE!J^V^>(S zEIkJ(93BfXjQyEd4ErJYD9-yCj;_G~Q^u9=7vhL&qYynmW7U`fRnY_l@{T!QF9po% ziyrAv^JWYvOk*;(h*Qlda)JQ7A|ydDEjIOWgrwIFCjiDVV6${yl%UH{++6>@2+9mCw-^^zf^%Y=~YNe29>Sgwq0@?=hoM@`#~lNsH# z=k8QGt-M|iV#uKr&bmndm+gfs!k*~09*4CZG?aB*Ccc3F;XX>EN``hFKh3dcFB$2g z6!sGoyOt?A6Tfshx5>Kni3xjp?o5fYk8VAc&6cI9V%>8k`g{Y1??6<;7_Oyr85HSg zcPB67>ZpP$Z9devs4CardO#d$XjQJp&9KzYAq9cM4tmWmk^hoYJC^N)+#m|J#kziy zWFrWAosRnXb}~j3N1)dM+mkG-minSSc7HDf`gD0)mS+*hm6fll0ve)E7wSsjBuRe6 zT%LpdUw{4RU<3I7<%2I`dtjV`gGC$9Wjrb6X-woL3R8}aCWAqOYA0WPki^Qs1)|Fhs4naoI6q5;ac5yu;jf5)2X|{-bs!Fy=rC&`XT(O8? zMjNbabJ~P}d0fxR^#7btnP`1^`~P0=uyX&u(f_aMS>FHG^-;T2R0q=LvvyV0Y!Qh9 zxs#a<&k&({U7S;3QD@*%SNTy#e~>UrrH|8iSom1uxm(ueXs57BH8+ZTvB#J5E6r7r z$`!O)%h)WVKcyPDP^42*E18|uEu)OyfAxR$T|YZ_w{NSf#EW{!8b`BP;ve6$s`Wqj z0j%x-E$e^xuzOUF|K8o*$e-4@Oe4IKK2hOHFMkN+_qV+uK_od;xvP(BVD^ zf*3_4Mx7c3%Bu-ZVt~>qm_n)yHPt0ERF)5zi20JPYh~P&-9RO*u+R`9&H+ zWC@lU2`2uKkpYF&tB38>kSe@W$k1OaRi!4d5+R}7hr3lYww4D)XezM{lrk{{ou;4$ zxn8lcm4@3{o^QYdO2%f(R1|Eb+}x`Sdts`6Ej6<$4d)sqF&cfb<4`d4^V@el1N9}0 z?^Kq%3xC)DL+05kDgSLTO-emK-?67! zhX`;AOuj0072g;JFAoGcLEt6WHa9IfFhve=KD;#5>QrS`SvnQ;%WvaU71<(~qc>Ie zvId7@1a&vFfKXjhYb)gxl9&DoNJ$##(u=TM^R->+_Wl~pdPP2zclOJ2VxhmX&4(Vo z=s*8P(G*dJeh@E@UjqG8mnw3ZTeM8%yImoMwbw$O!i}E84kd$;u;HSvNxQBm9e5n_ z=jQpk&#L7A8%R@}4r`A9t@__?MgM!a*WJkf>v)!s|34}c1K1}Mt^O1jkiu>&y|EOkW`*5TkU8DM^*tv^36ajzFw& zgD5jWh$m9FBj$RbdkI7@fm70RbQhb=ZtCHvP}h!9hv? zySsa|iT}HnXNmP+Tj(HgYUm4SIn=*$A{7g3CB?%cHcUC^*an-FLniQ-HL@~Byv4J^ zVul$->vCOA8Dr#wH6b=B(iR!U2G&At6(20n(5ilo^;ex`YG@5p^PY^;3}ks-LIqkw z@LHYsj@5V@_sB(&>zqDIrtdXpnY@Lm$#-6It0=UmP4gCNNR=(M5chv(h@Mk4z@HXs z<{HgHRjJgHvE*}Y{PI&#ZogdWGbq>|O0hz!6UsLKGWwVquZlTTbOfjv)UmQwY8hk1 z%4ixb5o>tUZv!k>a8uK@g(6mtE59Q?bcW>x~707cdNM<&O6V%lgTHX zU`S_RFiDk|q*c~3l?5J-xY4B%T5{-_yLPqC1U;;ItI=0j6WRKMF-$uPP{Gv!HdDk5Y!2=V%0#ia zHCR~Jsj}~jcjLXH=)Dxq-Id-52v!u(QQsc@>~javLi6%0t0QOe%VM^b4EmH! z{u-1nCGng3x;Z%EqdN=zrMButen_Jc=1691T?8Pfc)6tsA2lBxO6`c1SX5{@He3+G z8;%at`Q#URt!YQB&&JHaX=9>ax7KezzRa(GfwBZgl0}+^Q!P<#_3Ipo%0y^978MFM zAB{8%1cHJqJ{=VxD2_$~>GHu{d=4x8RChuu+P%366bdkOs`ksPK7<-fSCPEZV`$l& z+8w@%5AH55zQgMN93(W%nP%>*DZc;{=CvLGO?5EM$JoEhL4J`9Ze?fr74G$mz;WlL%7d8 zb9ba=CRRhe6)R@M{9S^wxfK0PQZ)y^g`(~%Sw}JV{UdjAeGvT*Nrz-%{ZFsEcUZpv z?HwI#?tj9HwRW3| zClfw;lkaBK*M2D-gxkZTREz1A>|a1FrYg8|=svyL zcG{J3f^kYiF2VBfI=Rw@^{8}m4Dkh2a`~#$ri{}i7hrl-K46FkHe%=sHEj%Hz`~7S8{Az0Pef!1a!0Cw(d<2VhOt6Rrl7=%6)Zjy4gprds|pT(3#Adw7-T*H*ebqURy>e;HwXND=!pQ7XU| z{a^3k=&_E|Ff3oF8aT7Mc>Q+|HqYU{~XqNGz!2Rre^hDUgmxpK&P*V(f`#W zcqtX2)5Ja9Kx$g5)dAXLtu61Kg4BK$;+E@m3!KsGY>`|pvx^dT-KZ2rUUy{Kaf~MA%a{6)DQ*nw+fzw(`N8fQ(8bzvq zHO*H07P*|RqrE+6CsT-O%xSR%gO)pKzY(cF>X{ft+hv+Mu+(d+I>q74ISw}Vv24RD zR){%6T#{q%rWTvi&^z#+1FR&juzI(pq$uuw!(3cDp4F{xE~1xQ z>B_CPG_~UO&h0I``;u3Cc>RXirEyFxEYrXeS!tTP{4lTFqf|scg#MSJ7`uVsTKso%;0{B7@_}@5%FQIyh3A6m2j%+_$m%+vlg2R5tPor zb}2_%X&io?HAknlR<#29vvz1kci5zGzgH^Cat7;qJG80|XN;Mvom>i4R>#y_Zb)Mx@;#}kLkNJI6J?SgSU6z+q{*icyPcke77U`^+LYU^JW(__=X#E`@KE}G3E7LfS!O-$vA z39W9daFkj$mw$zaLrdt!6O+!4H7AMweCf+_nMpP^ceb~Wsc|fRIYeFSlq@6|bLC{` z&&{M+@1!XmLMpA7GT+;xG69A&K1Yo#MwrR7$)Gupee2vQYb@`YqA8zoP0pQ4*fs-m zG*rItYMnwqKNfXNL^kJ5^)h@~xdwN$6^iMgx3WT!A>yYKN>Q4t6#YsvRG7wgx+f4wd60a8pR44l1w z!@Mw~LmaZJW$uVgm@-NM;z@;UvQm z+euW>-!-pni839j86Q$I$;6VP_y;6ph$GNP{04~yM+2hjg`T&y1>XPo@2@XB@9OGG zNY-AAGL*(BjWE*EyVzTgb$fE3*Gkr7&<#I@pNvtCPR4d@Q=;ik+@xswZ_%0Tu@BkE zdjbUbz;-+XlT65|wv>bmX842YciQu=aT*^3ae~LgpJ3*V5r;y079cBtYmQ7ZJ#;vj zB#APWl=s=D)_A5wBjEoXB?$o^2~A>O0kO3O&Qfj@!Firsq?I6&Q8L9bVgMSP8=ajP zSB5A9HzOR4Km=1E0?CU3=?5`I3CTc;ZZth~3OdOR75aC~CIQAUg+oL`&wEuMXQ2bR z;{Wo)q>o^hvAnfw{YH{Qu}qAzgv`c5I26LFYF_>%10Xr`RJD&&5G51F5oMv;rsP+J zh7n|-FL;b2Ce9f08YdG?{9?cq(9jfd#K3u;RPSPvay&*w5Hm{R5R;t_*naiH`9&uL zuO*Z~{IWUGC!CDsf#&^>mmorv;{lE!N9?)a`=QLFn96_&f;GiYG2R)OPyjP)MW*M$ zIYm;Jz%WP5^8y##UfA3Hix;Tz?uEUutEz}IE)w_<9D%@qBni1u=>z+T%IB-@P7Ei& zDa48VrVoC4CTkXv#xD`ckUSX1crZXxXlE$OA>9Heg8@!4#{$kT0w}SI;~1p^0f++k z`2t=e7EvruiD2R93wZM>Q`r{J(rm)pD|lam`A^&TRaN`qeF0Z`#zTv#FeNbx85!^^ z@CB$u%>V-N0*Fr%YEx=W8`fo@V*g$%QZe{U5(`1?E9Af;28b zB3`T;l8nR}B^8`xBsPHTh`&>g>j1NmL}Z+i6s6q4lPid>ihR-pi9$&QCl3dSoJ^-M zgMFMVIGrklxYO)f{HdFV?NjZ(Q)tVihI?dO>y>Ra@tAbK)nr|p2bgAv~!FS44Jxfcz zi?zDMp8eq4^{SqS0o0ucNb*@Y$%YihD7Ug#cTZvmIpg34Cka3)n@C@RT33l7o}yGK zU2l+lqneaQM0J7C0|?v0NqxdAW*5F&wrFuj@Jq-uY>pBkMXq-uZDk7fYI`|E?@5 zoqa{@DoC-;V3H(2mXx}yDg`v}$RZbnaNi2M#?*$7km?Kg##8vo)pNiQ0>7M@YQJr7 z$ug7>-m!+XjMIq>=@x>T0c4XTQAYOcs&)XcNpy{<;z4kMhL~|W1KL00EgT~Twqul0 z6hV&SW3fSjViy#pF{0;rM*ydcBN%r|L${NqarC|C&EIxAIc|y(FRtnaUV-ZF!#7bw zawjKdm4s~dgREO2lx(`(`F2HH_WBl(l|9RyuvfIed^6jA{uHK-KK}G!bdA#Zss^jz zZ`zy&Kr?+bV**_Zpj1pBbr&EuXQC$C$@!U;XYF)hh)!{YjO`L3zI}I2q>WM^QeUrv zqLp7vZ)QCb&839nsHA>YDu)o0oqj@wJGtYTy`XovhNU5`g6!f?`Iiu4@u_~r<@tL1TEQTx}dQfvbV%2u4m#J@%@oM^YEl; zcbY)P#4dT&geP1o*oLof5>Ikf{}J|4vQD{gjS`y63W*%2arB4_r(ah^XbJ#Tp?*~J zPu{vKX;Y!ld*^L`&hc3mm`AsJZM{XxDbmfO+`TrQHrlB>S2bZRa6;%6$V?rBMe8Lc z1jH*N;D{3MrifA;%NakPdc_M~QT~)7wci*;vG_Oxe@B-olG zRarTxEScmg>xF36$Shj?oIlO)DXV>hGTM^Q{H5!jve!2#x-I#*jIV4$i<8<)cI9cU z4M^wH#z=IPD7Q7ooU#YLp4ehZy_^iBlb%1G*+1RGkUR~)Db)XMd&@M)bY$3?bMY#; zuY$g7G_(3V@DqP1-nSbho4$K~_1&)D0e*tgAs_jm z*9AV~l%&HvvWi&$bvK2-b0&TcRQ=~b)s+e)RrbWlx=QCstlL2y_eqMftHM2kaRe5p zGc=XfnAQQppw^&I)ek`{`sy#=zop0Q!<I`+h&aSsQ^B&8&nUK>M z7iabQMbjxzqhCGGzy7wp<&`jw(d!WlSuRiVEU}TH(il<2 zkK!+8J^iFlmRJ}ePIFao;gV?5z>3PVrMM$lcQxxK2iS;Ak{BouR3r-1&2xLe7*O=* z1f@KgnaWY&0CM%@O6;KGWTLtDXO7zy4i9_VyD~;!K*{@nEVr_zUEZs47*jj^s|ikG zfYK?ZBpoY1Fp8xisub4M{U}u8!!oj*W!XB{(PcLL>M%;KXI9@QZ-=O|9%j}S*vKc! z6?SP}Xc1z}==59JNnl!A{=%j&bC6r803t$9TfL6!snc`E z>qJ>54fCtl5xFtjrn8lX;8GlBKDZH5e%szMQ3Iwb#9|Bmis3r0>gZ>RG{?9BXB<$y zw?M!~PzbQf&`KtNl=fFP9>g;ATTPIdtHn_DD4#a^l_G^OeX}9GyrN_{5JN`0gZX$3q|9f!F#L|}lVI#9@rOcVkp z3;_*=J~f$3Erq5BT8~=jSC@P4YH9j8*#}ob!YcioY+7HJgic`mwNSBzex+d2_I_YF z`W1qQ-;07(%Be81Uzcc3kjnMUx&-{^WuFBcv%#hwZ2N1y1hwI$XCNM;AEy-Ov2S z;p!WWm5`Do!Rhcl9E!bPBMZPjnQ$FrK$id<4&@?mO~kL3HyQV~w!meEA`BCNB?ehE zLSx7r=LFGI9?OAhd#Pg&06xpmv1kydLl1yBC)cqtvNFY;SZ&JG9W#&+X;$t5fIh)- zmY`!0%UU5Op67(6XzA+0mXwT~8{@kz>+lsj=@6%%JdeX+TeGSi4u@_ty|8x}_JSDo zF-(JAH=u`mo|jFM+`t)o3h*F@L*VSGv^(cd zpQ|v@3~^cfZ19%wbBY*B`BMdtHa*G#f|SCU2LR?s1^1f|sfkUO%m6b$r>YS^208e~ z?teSauURmW4?QnN{fUF_zKX$JL5&)Vafp-4m0aBte2v5x!QJQ+rx4(DKTGrCGg)s{Vm{-AGnn8wtyPChDgUF z*#ge3V?MKVlOnQ-N*JaFzTLl+4GkDkZW#kVx5ZR5?qjR;e5408ZE_&}1$7?~S% zAX|D4&IX3}{J?(>+-}~=5H7y2<6^{^2{;*uX9A&-3cA8D5er)ZVn6Ub4@MDU>?abV zHgHd5NiZgHp606&?m|Zw2*w{N=IEUy0K@-i?d%f&11-_Ri@#yd%OD@MwR^6EXZCYK z#)Xz_+?{#sY*n$6;8L7XNz`4IoryJJuRbjgIgMN zBx7CX4t6}#tzV9kr%ga8_|+B8Tx6>d zMHbX8-~zh^fR!pmA(PAE2Q;&&6u6WF7JyB}O7&4YH_AYzfT5IO86!^4MJZvrk$!M$ zugsnUM#czmJVs13a0630DTksqC!%$#Zih3%7?ys?Gu5pWAw~#OR>lSkbLwv8EBTJb zm3$urL48;!jg`B{bOPD}T8%4V6>l^JnK)UJL$TK>u(brIAgP ze0%E^1|4TfKH@M8b@Wb@PLFNMa1&?i{N(cT69(jEa`lWkXp)Mf+%MNvgsgmaxoSsZNxYj&vY}_-CUeC@u^eH2h1E-mnPqwcoeH8ITRyLuq zr4<9qV1%q2M9vK$Am9&1QUTse|8pqTywKspTVE`2kfFnU5Ck!bNQ^pO9U^*nLPXC+ zL~k{S=sf@;di97f@d1A}@dUJa9|66v8+JYKmvkVd2ftCx}R|2=!=c>y>#*3J4gQ|K@O4b^z18&Xj`xdPjI0g-6v&p@B>k*c&S zhqq^N?=&PRt0G#;;TPN7t+uIx3<8oSvrY(p`8%R$el$=M1yryA%&;DmGEeHrGjIe` z!Ba696N#n#<^|wqfdwTK=}?7N6_}=bVF9cG{BvhZmkuOwf#&iS zXhetai_E0V*)w$(Hj?)DTB`RDF*|we8F@EFk=(M7VlEY>v|SxK4lR~A;rW-O0zDqkQHmk1ToRQ zS+LA(gy~GsF$W_bh4Pmy&NX*vYR(9-**v(5$k6)XB{)D)M_?5YF`#293M m!E`s^ME|+>Ek)MeJez0pY@Wyc{NDfo0RR7?tY8)ZE(QRqPT@BI literal 0 HcmV?d00001 diff --git a/assets/redpanda/redpanda-5.9.7.tgz b/assets/redpanda/redpanda-5.9.7.tgz new file mode 100644 index 0000000000000000000000000000000000000000..94f9d6379314fdaebb4a6ffdf17c35424f3f7215 GIT binary patch literal 409279 zcmV)JK)b&miwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMZ%dfPbCFxY=rSAoxdciZlHum=RO7_8t1ka!(J5ECV=#ELSPyh;bLZONxKZ2nT_fO`K z^1%`=g6}r{8xDuVCr3x}|HI)h|Np~-Cr`dRIC?sK^ytyiqoc#`h6jgFA3yyL3^$HR z$uDLc((i_A_mv;q7xIH)NI2w}glyCU08);p(Bt!XGQeaXFW?NZ5%|;t0DwLS;R20- zp&9uQ0NH2+eBxapIxsH>9$D<0KYYkx^2g}<@Mv&2c$$GZiP>^OZnGfu!%+Y^V!Vi6 zfISp4Gy=yF^ya94I2e{S3a<)7ctN~)fkHKM-DymN5twrxvC;m%Pdt_xOXl;fUr?|B zJ3syfJQ^Gf2gBX1G8l6dECy^YVeR9PQ?idk#$gcb_WCAb885QQ=9>{R;82tHQF#NvIU5GqRC@bqxzgnZygTbNh)$Xtci%8AF`yi)Sp^CIfao>xl*Y zy=46s5QiM%5K%ed*(K|X?bgc?;|$9UA$BF9v$Px8ct1iU3Q#Y%^o+#RQ%hO`CJR9j zdtXgqk1r!M5(5per*>E}i;oA-2TyySo9lHy^UKNqfOuCM@1sHf508$X7UciY<4*qH z$1l&iH^7~TgQtVT=Qgah_^x2O2akF_o*~9ZfX(6I<0qp>!^20@XC8cV;7y+mhmVK; za5_X!A5EX5XHO`n}T+Wmj< zczEz=nA`u44iARi{=bjkHh8U+XdiGQbr+>egL5+FH;^Lmio~HWr8w9*K7X|f;?PGF zkPrc>)KJvh7Mq+?Jc&7>Kx^dy&L~1c$z}rp&JmK(-@dyzJ$We=AK+uAK0-dY!F=A^ z27HbgxFPgPYD~~qdL0Y^4yS}J6dDxGAoX!L10IQ%6wl@ykQ<>3&2cp7ZG#IjjPq9p z6Q;n*J~;vZNn$+)Yq)wA_JG#5fUqUD!H#IMrC)CC{!g$ZF<8JQ2nh!!FAP z90HFlq5#9tL+P-R9tJ=nAYhP*P~iZS!vJJzHv^FOwtL&crVxB`w7-9Ib2ESv*#V(5 zWBaiE*QX~h-=4pe#*g^ow=h7A0gC<^V~Tt*SsG1j5+D%38?kJ1ZRC>U5ZqAAaX8xp zOs{!wJF_BTSae!BpFJAVKE`0d5% z%X9GVJve#y_QmPN>ASb*;N2^5{PsV=ucvQc>;Z)N98rL7BP#GG6ksup$QLVW$j2Zc zs6+hCBIMyI_CNr`Sqx_g%*ZvOp&*V3(FJB=F&TiN-`fTOUSMtP76&!xNy;(HDJUA^ zkO9RQWsld8Vlj(icBhD<&_h0$QnCPoZOZSMm{0+gqeUd`R^VeQ<==83*XI?XU>Z|7 zSevRz2&7f1KNKTidepvctpdnLf-p+0Oessprtk4A#y--leJs)2?@1(n{P9OMR{4P; z7N#)Jq8B_GJQ)ndLd+ihTqw6JaiN zfXieu2GYVX%|>8rtMbEX90d7~&9fqa7ibFOfP-J-38Enq)9wW^6G;0+7)yhm{`-ae zb7Wo%jTZ(A$Z^VU0ysed6Z-@Da+|;)uz{1wKaj`SK(8mdg^MUad*E`h99%tP1BU1| z_AFcKa?tbSq`j7qN8n%oR-L{jJ^~B{$dijJG%rqtb*D&DcC{Im~i$! zn(i-b$eQB~X!5Im#w^Wc$r{Gde zIft`LA^N{p{@CyLlyK4=VFoUbgB!SH5`2_^8G+O3Tf)yMVkqQ!S~*vo(jpT<%ZhtS z{ioj-@60nPPy~5c8zjX+H(((rJ|5fyA+cP^ishpJcEPVj!qL2fkU($9h2 zQtkB=5Sk5?LJKBBrCuN|Ra)r_1~C&n58W!DeLrL+0QDmPw(N!j7({b8$ZqI4VO)%R zD;@Yi3qhYOS^z?!9}&T-`g|D)aK8}7PtWuU3OWG{c~mfBq0UZ_(1@k9j3~JlYvWPm zqmW~$WT|2Z$+pFaS*qP?jEh5dm2xd4nX*>h5ZxC<*q6QbBZ{vfM}3NBLUUaTHkQ!) zxf+JW%U--Zd;jv}_~PXY@KP*yL@`5&X>)~^V24CXS=g=P#ztYS7*XMvL5*sLcwgA1 z9QmoD|5u>}34QS|={#&FOaLWV_K{L!b_YHE?f42UEnO)cni{vPdwgDj8(l23)HdIhIf5CoWU6e0>(97TjGC0n+Q z`CJgHc2{q!zB0XYA`R04cuTku%LwwAN^^*W!4kl0hy%&X#pg69T^RWBFW~y{(csZw zIOs{>uNCY>Ccc#T3zgf)O#U;2!=8j2QR2s1TU1lPzzqT{p3M;B(n3}9uqVOJ$ql*| z)1+)`90UqkX=UT7Y!3rQ^hfF3S<@xVSoK2Bu;B3epCd4Z0Yhd8zh);|(7>Lsmc^7o z4luWt>oPm-ZxEjo|5CDhPQaz;@KOmOrDSWiYk;#oZGxlXJKZshy*YpkTxtm+!I?Ir zgp(WOPeYDoh$@>;NEIwCNzp?XFD8fzD?NggV{Jq-ZD4~C-2_X)@1!cHR*jPgdr}rA zUyQ)PVY1lQDC9t}R;K2L%}E^if{%JI5`?8-8wy~1wygbd3H=2QFZVLDh{WFu7{ZzK zyj*^?7E1PaA-YTG?KNgxIvxb3l0~CiFNl4lbTQerq&utQFb)CWPc=rd9*E_ZW3m(yV+V)oU%SFoBc9QyGxAzZr59i^@#zjf^hp^K6eUM}U8&uuTr-t3pinBKee7x^mx24yCmYA5Wz>hAZ+Ct&Qh+OAv0M3=Vs+g)`7eWeXm0%#WW|%$~u(eL)E3TaAzmg#v zHg;)9bu9ZCTk|^B^QuR7smG%F7$go5p@oaBbgAqk^YttF@konROQT7(me7rS7 zd`tP*EO)Tp_(W+TqHpQN}XB(FJ_!9)D)x; z#kV2x(Q)!*Bv=~>$ZVOj0>ygvjE6T_qZ4&PTp(eXy2gbp%JO#8I7{GpknKo3>26;i zT5Dra(6fFrvL{|Fg^=^I(E>&zxr5dErOTo=clkRXMFCj~49nju(2`{ortOW~kiHnJ zJ`}f{=o^?o1GL>7suAs{1M4fky6*)f_B9ugcD07DCs+S9DkJQsS>lM5zA=WMZ5TK) z%Jbv%*K4y!hP;?!zT6kKN8fs}D=aoX7Z{6IBhB|yn@x6~wPyyp(dpDO%E}t>8o5 zUY?)4KYr6c|K+%U`1pzDYU#7b2ZtJm1n>xCUZ>a`o54skCplSLl9;Bw+s-00bD6bP zkM3!`w_}F1h*vIE!xN-7u$B5=8KP_}9qPNtoFHjCC>dWes0%4p(&tJAoS;Na)+dO1 z&Ti&}DUYT+c9mMU-#`|U=A=N7XkZ4=BH~LkhZgiIIEor!KoRtpN)a}A8QpqKFEiNh>Hp+!@sFHO%$h?Vj!N=4WZ zQAT^-(xJ!FYu!(}mYZu&DRSZ)p{8${fo`cOO&b5k5FP0#?1Tl%U1OZmnG*x~Mu%LK zjMW-t+3E_D4lZPHaqTo}3s*aKq;fVv>58gVDG>;A$7)~ZPRwFS9QwRKHrP#imQ$g9Baq;@RQh!LLiDW!sRg9mKjArN)txsroQ^RowjP)dPiI zpAy3R>I0h_;Lsmwgyf?W7zz%lpAZU8lz2YPerb;}k!gHx#>)d0BgXb}yef-p!l!t^ zY;RHGMD{hA-prBoQ4%UyxTT%VN#G}r4=-KHbdD4^U;u(k4-Py*dRJ&UP)?gm>37)E z+JZLYwEvkUha(9v8eQ$BIz<9c@CB=HaE++?r*zkbe#$9SxT67gsXaAg)!|q$3?&gl z0?=&~U=MSNBjZvzxGd@1LXXc8rgnQ7(Wdar;3Uju=X;Cm>dfexgkpC zA%WB|A8zxI;#E2yQk68v+TSy9a-1ET{@jBvbKFq@^|b?G1dbj(8xGSo%BkVfA7=UN zl9LlZR2!Iqozs^Rn>m7hpq!Y>@1~WhJyoAu$Q<@Qr z1^<%{_)xQhls!n^c&ZV6@%CJTEEvKsRb*azKqxkE#;Ky)#)+w-4#L$wRKdl9S!;%s zuC3Ir_0o!03k}FVOO=73LE_`lDimQTE9gOjUdLzK^VyEkc8vB*W3*D=m&#oUi`9EJ z&lD?pq8m%pM}LM7LeFzOf_jVi4WU=6&%}3)uQ6Y)Z8L=lZ0nyg;?%Rc5hj$)BK6sx zKJXFt3^N9e>OxJRbayB^g<&cJ((Y5?C3&KB{Oiy|koE8SVg+?zikweHGJ=g*PN1X< z1D7u&BaHr2TOW*L892w46U%thBn6|~>P%vu@4}8;(w*$QB|bVMl<&VL(EkYrF!T}K zHFm_glx3KusB2=RP;x^(W5%VHL|SGY%(k_qE!aG^^2l5mOXn$sbljZGW_2GWrj&Hq zZD(v0JFfG`fdNslT^h~AJoSs^8Gv_TumqQ861CGJnMw~)W!&nSS0}{V%1fl(vC0z$ zpnom)EJIn=q`kZ5Tu~}P=Fmo&r(&IzQk5J-=E(~dXI1(G@~_2mN`H}R_ctgn!;H)! zgy3=Z(Ab{lOVaspg@UEvl!#(!LC*0^P)Go|4090^gG14y7-9syE5t!SnD$nf83gi_ zR;g23=kp*_@|U6n8WzGdqL@(3CAR9?xPhWhH;p@8T}1~JhBKsNGcrr5SJArZB)Mfm zDgw6X(H^@x&6R-P3%JIGoOR@@&{=zJWjvGaU5hb85jo!|z^OMBMvJm$4!p!+Y0$eGqnS*u(-h!^y@l2mVkq`kC za=J`6sro{!D51WJzq0gv6LFG6)@0(ebZ6N^45q(kh!2Wi>*?^cI(cS|hEVY0?YWYe z$%ag(R4*Eq0#3)NCy#O~!Aw6%zbd2?hT1hR+9{NUo{GaP8&eo19=v2ug?@sr5rs3w zejfaWw7~qtC?WveA}{926@_FPv@lE+^b^ zKgL?@#m|>Z?t=Wweg1cNk#b?1vp0=N2Hyq&~7B zj0@#>LKxZ=qG|*#Zy=Sip*Wlp@qZsp;@Rb%l5LzqPkCPhGJ7rh7|E-Msb&@WAZGIR zjvx@mvB$s!dRL;m^ga&cFb&VO&S@>(QGCy2$iLEA+Ubj0IqJ)UJj}ShfwUl@ygv}m z_P1pR{iFk_^+?nOUrOluWonOK(&$QS3S-%DEJ0j?h>{3VC5noxsfBK;u${iJgXhd% zQD&|`lIm1nB}GvW_0qpda37farjlIqa$L95N9KwFnsDPYN*2PBjamO)geVm42nD}m zPe6um5U1F)-f;q$M`5HUV4+?Qdg(NlMsTQ4ObF@-JQ@n26QuVS(}`vBHtM0i$46l# zmRk2?V%9ar1MnL&Cts(GWAZ%%i;LIi_K_Eqxwq)dUzYk8%eoOmp;3dw5{QWXV!P7(BFl)OhMk}0u*vS1%QD9pfzNkC>P`Wei{t9>4MeHG5mc5P5P zSQIi6?xhIjj^bzd8iimQ3kFQ6@$YPFFmH*F+Qxu2mXB(=Cyh2A$!97T1x3sRdwVez zG!`tgR--xYl*{!q=D)-f<-06mDLA|plHobqOqI@rpF0CX1Ih2UHpn(5C08OXZ z6L#e?y|*LT3id7~p(~1`Ad=Tc1#eU4l<{_{<79nBXG*Bsnj7a+j>jVl?5HL)HWwk&sWY#4E5`NDCWGr4FVRpfV15(-X`Y{7T(C;g@kX)LV z&txNr2^d~x279VdR*~amYVBQlwvpK&@{MGu_v*T{$;7E@~;B`;9h=zi~X+A9l0G)&@E6vy6I+&YPVP2Eanyvhb< z@pOuB1sA;918?@g&wJov51j3RU-2GzgZIGCcn@6QJ#dCoA*8LV%b#ONVaO5kFQpRx ze-Rb;lxP2YNg(!waEnNUG*eg4aA;=+$`D1BLgOkUs&2FYGll`?%f9w`h`0OOYGi#V z+X`c`KSP}LRgMzm_hJ8^g!R1uGS(;4{w$dQjm;0>%kx}Y;hvbSX4$R!+Ru%LTr5!w_vc)0W4fOVPv=BQAWh1 zCVmi@WCKR$HP|F5rgvFVB}}FbpveU=IeSwg7DW7|p_{X)J#d9kBrgwQJ=1AhnWQYh zVJg^uwlCM-P$I?wmqOC1>>`NDv}vJ-l=Z~+l>b-VKveS`5XOYK7PiyK677Y1(ki(Z zNh2#Qo+WlRM|2@iEA$0w7B7?uR2L8by-9S4Tg~kZxJ@9{5s1de`V%&*`gECd& za5#K}!4F_KIBbNp2UP1ngIn-taPTuWpdSsuyDI$x?A**D7YrP*g)kHJoKduZIAptt z;MV!vQ&y~Iw4kbK$T^lMnf?TUfZWJTd@!uit#(p&qxV26YlR@j)AV+=Qk!ltOM^1% zzJ|BERZPz4IrTj4Srr#nYPMMY0vk>Z2E}2_gcTM$1$P`S&28BUxkh3s)!sFFijSpX zIoFvFlMOOKA({#fT{+6E`qm(HjE1P^HDxFxMQO&ti71mN;9l{HXfgPnaYEs&?aj}k zEtD!w8sh%$pr`+toU0s97ztvIKm_^R*zt3sj#6YeP(rxhGs!-z^Zxw#uCOQN)v6bm zUV>{9#Oj)s5Eg^Np|ErrT}EbZ`0uiPCNf@_ReRu4BRvp!ok2dolxliN0Fp|$0Bv5` z*WFL2PT*m>KDyCK0P#XJNK!R~z65G6&y-J$;vr(QmEvqoL>{YA#UTrm2{#UhMibC6 zf+ih~zYO65d#T4l}ZL+t5+{nI3|A;^tv`}O6XcnAIu@Ge5(IfverxnOAF zqF2?>Y-wgnbvb~fu};V@Us%2QGepQX;JE% zWQAB};4oYvB^~{tIf|L;mIEoCE_8&4A%;A~DL0ZyA1X7in60C)p(r+$aN`Sw#<@nr zlc{$bd^@>s)@5jFdX1mvI1uY_qLPAmt zMVw-EZSo__5gX!4({i0Z(yXssJhbHhTm7w!eZMIQuwfa{AO$Mqz(yrOK^AOY8WiP$ zIdD&}`6u~xG64>PkPru#*|VhDZV8$Y3~&)jpk(@{^cIHRLRSwi(HW80G!D??#dCC z(3NhHEX`%oMQfb17+WiE$&(x-Pjb(w2JcO3rOPzu)wQ(|1gPvO{qm;^5LEG9U3golJ|8e6p7NJ!fN{5HK(>|bdp|(pXJSOc~qi8ypTSH z%S{rV%CThflo?+~D(sS&0u#e#-2z@Uos#pe(?(n(zDnQPhk+)xMF-NU03Rb*DOwPY zbY{eC_9LN`me;SA9#jy?8qXIp%W!&#r1XSO-+f~R1HW_?X}9dZpD@+ZrZoW#gW2w zm7PokdK&1!tivdrT%$~Hpxh98g{X|#V!32iyJ@;qHUf`&0K}0GIXdSQax~M5l)9(z zo&*67XTQk?Jpd-LKQp-k7x4DCFi8V$wntW5wDdqbsMaFnfkidS<8*8h9;BM<$sk6t zjF;yY9I=dpq-M?naak?G26;J!*oy09Phu4yU{BJN^0w1ZH(|#^1(-fiy}diI13&YwgJ|jYniwXC{(CiVKxaPr}f5r{$@&Of#jD^P1Z{NtjhHJqwn1 z3X|OQ(4&MgYpd*8@q@-2xycERl|AQlqLk_x-|Nie7_GC?b1 z!8xAIc_0IrqQD%s9{c(tOtO4tz2s#O!zJ-7G?~7)?a~jle@6VYLK%$%R9c%XQS)-F z{O&kSL*+G@L_+>uTZ&A|#baB6Hmucd_%)7uJ1M$p%1p`v9huTm*6|-K&W9S7m=hgl zCams~b|zb*P=tlKZY)+EA!rsMPcjR+&-6S94yN6S z@?(4dwksl8y^U48xBYo0X{t(B2`=r*j+b_({?Eh)a)l>VYWqy-Nj*40AYYU6 zo)v$?RQrl0_pME2@KX)W<@=NLwc!7Kuz0?GSD8UFp*aeF3mN2?O|f!3 zoU1L5j>F{*To%0$BXB02mPTCJ-UsPH$QfpWvlrT=%Ik;W$NU$AUeUT!)&cvOk~k7P zQ;n6z;W3l>o0CVnjbfyxjO4rUJt6!JW-?ua0FQli0*#fa2<30G&{A?gpcrA61{G9X z3SllcLaN-V@)}$c?mZ~K0|Fk{Ef8=A_dvj%-2`cctym8mRdrc(B|KA5IV8(qCa~}R z1}wPKJFvj{7VPSzzVfA5-9_pdNZm)(jwN)4#9oh6F0Q#Yox(6)*LDJ_gu=2*$)b z7^p-mHz6PqvTB_r4uiCF<^5n02^ltZE7P6u|G0t{g^R`q>~NG3Y|493f)G?)-kRPSTmoA9h4DhwO-2OP$y~Y7W|u7aEAB`$l(i2-`xm4F~?D6^-n`PVVX&- zO9|m70hPRqgZw>H^hPG7Qf_I1Au(WO3LPBi3o+(u4Mz5TQKfBNmLPShly{Y@&zz(P z)-A{)$&{G!;0-z@>{};o6{@KtHBX>7N0o%$(ZbhE3n^nDv|ILXX4$v5?XWqa5nEv} zz2w`|tg0-&-Znb6iYD9QNQRtZo-VZ(#gVqCBBenXWMEh{eB!WI7R)*QUK{s*)sH!Lq?ewMMW9SDD;x3JRAyJi-f++ zhAD67>UbiZIv;uRMk__{CCPkWPzfMg*CYE0-@gHZ8L1)yYVHIhO;f@^=@OSK=L05ozq~OS zEVb^L>2?m848j0Df_{KQq?wBfhQq$VfJ^~TDd=Z`&zT(_m~p`nXTY<}Hpt@Of`#@n zT-7ktvMX;v66UY(wuzxi%nBx8!{SR%|7A8GcHxqFHvhEp zoMciE$(p)po)A^+ESIC)D$q0NrQR29d+RjNcJ7DtWQ@dIUig;|S|Kmzl!PQ^;Pjn! z94C{PXojfomZrG}Cnz8{0Ls+#P;yQk8LgeRI_+ILNFwuW11J-&sbCL=7jeL0h;-Mf zO3Xk+m^|&B1}zsG;zKPi894f z7$eJ3Av;NY6-l-SZVoGzhB`?P$S!#tqA|o|jIL40nTo2js|vr8Cz&$eef}P@CW>}f z{M4?{|C26gH7ENF1=IeVFphltcCuXqIu21^T|P3gKw0e5dwVMAeHnTTyuCP6yGgY5 z0^(gMvdW2=$Fl8tY2M5{=|KXS)58InbEM zVublg5Zqp-NHJOebBHH(c2dc+4QznpNM%RazlL-_z>_rHx;&XQGn?r!(*whQpc1g^ z{^r)f&-kbG;~i6_X;)P_LZMIS9{Bx@y3u2*<;zR*D5)c7Dvp|*-eO2J7AozYshOq{ zE7Aqz;Li%`kE1_dFMb^TS;PBLvyiz75TwzSR=l(KiVY)FmW3AGb`|&pkJEQ1z7*+e zT<2sV?@goyYlQZ=HS?m8ci1=SQ2GZ?M&b1W39Aa;un~SVxD6nkp^;|BDxC2K1;O|# zBsbw0lT5;Ul}P3!a+% zk>>gH7dQmRXQydp!5w*Hl7#BYwLE0Z1>Z-6@-$&=QkzqdNLunu7pBw-iWq9rm(FHH zC?A36PmYdK=t*HV95PPR*^pZi^quSut(UUCH6Qxf{ebw}d$w{c%A_XT3?`4kDpmSSC)sM2R_#r>O9qiFjA`X_R6icDbakuOKo$5NCG(rS zNS8y5p4q49j}FSW&&BKWV8=m8Br^#xSCGAzcL4d zQ=Q^d-hoUC94i%NYO3O-rB+#{GP^`w^4B*oN`1R>j!)#4IF5yul(E--h0`mT;j@yk zuEgUi?wT-GQ$9LnsTmGBeEvv7@Y6INTMRN?XAs6h&E%Txy+M3VbV9_tUh=XPsF|rE z8!a$LHwKnaQ;t^^r!X^(M;5q}s)U)oDp`SC(zN=nDVtTn8*2CV@cH4!m`D|I)DejC z5}ch_x`Eson1N6xzBauCODz?J!7TS5jr0w8HMx%-9cXd(z(`K{<-9psK+R8NkiE4< znSA+PzpKi~tA_b(_)Oi*kVNn@^do}996H&B5DLwB0vYzcoxPgO)sfRS7@A4l#5QOc zQ}Y5f?w4OKF3z%y9_+v?2+oB1en!cyx@#-oHWJfeM@-Jd^vI2QS5lgxwau~IJEXPV zHh6g(A*{bSTq6UG3FAeuiw5d7%qt0!9`HP|U8BmHnHt4eZ98=sUdl50v2h z-a4j99WmOw4=GZ01qA`?f==?7g(WgSSFK3~1cU_OMFc%=0&}xY9%1LAIlRV%8qL)j zv$|N#^m%}qzF$zV5H`N{@KJrhs@y{Y!HGPQRN3y6G-EN1h$;bT`d2e3AF5si{-^57 z{9b;#W{8_=QYt_#&8w5E24V`s}IX-&`R{uz+uIq7w?)90Y_!Dh5x#Io1(*B!3^%BeE_z$JaoDV`ftlD5BW}=^2oIaCjBKH$F#@N6gEBKaX z1-7khqH1@jyR<@KG?5Xi_L~}Z`kkK2Q8JOLt_4dT*i8et1Us_ET@YX$0=cXGoibOR z?sEdYD>9vy^l~s9E|}HRQrJvrtUnkpn3ZU#Y;e}ex=QCeF%gg|AVoZ{8lmKSKpUCF zk3G>Z_vT{-bgTlttY&2hOqLwA@16(X;0^w%w0Eg7NU);sqi2twK5?CSPQVSsJdedh zXAh~H{45T>=%8x$W#YJN7*s61;LPy?(Ui{c0+E(9pevnnj!z}s~4r$|hG zly+LySvui`zJ%znpYjWZP1BeelDG3q$66SvZk!)!ajcG=Q#64A3_VoR{b9*G>(-h6 z4@ zX&7*5`Dc|c>f;ED?UlOW0!hJNqnQ(0S{T$8B+Dq~y_9Z9TnaVBZkV;JEv57374m`^pdQ3;F%42f)^UV1H|*f;8A@e}9JgJf39I^Y!H|m^lg-eQypaXZ!kp zIr`b!lkgN3*)Rn`^)+!3I@|Xtobvs{;o-1?=AfO844A!^k0J+QIJ#Zd}{>$B`t<6lhZwUQr=EJ4~dVCi|y;a z(eKa{QHuN*GVtL%$fo-v#|CKb$kzf=+vpWWf#2<*ZU?nO z`P z?A7$KW$tvXt}HchvMswh%mt#Ao3cjhs+tMlw$VGCDfjC*e#i0aVRbrF{jb|W-43dU z^+0td2lOgFt`xxa>IkS9>c>XKrGQ86;O(z7Usir)wc4^Ob$$!JrgXGIBioenBrA3s zRj--vw_@k*H8aqbqqUVUpq-2XtFcT+rrBQJ+&Mn2WDjUBf555(a2`T?Sp*#9kuw6V zSR+rtWGvnLi#MS$rqee8(qw_{fJD*AIi za}PQ0&fO~-cjxXk-*o2%m9V?>f;AE7&I>AV|JKh7zNLfc?%chTqs8W(9IgAJlcVLG zcXBj~`?oGfyL0!o@bAvuUA}w}4wCNNy{ct*wqam)XB(@a+?{QJ?rdXa_}#htS1_#Z z+&$B@lTDp$>SR-0<1bw{b?5HgxqJStWyeNo}jXoe&Zr7}kFK@*0KwVi^^-NQLEGFtDrlP6HKI zrzjJnYdLo=Fcb&JsiOT_x<*!;(|oj`*x?nWZkdYSb6j_Q96)v zDVPh>=d`8&8KW4zpb&?q`oxT-2_{r{nY}JbBDs`bmMoZnQ3ZGTrMUb%@QlQSYU^3)U#D7K0_h?!< zcg@;!gHh?EZB=PiHPg5@Y@+MSyTC8#3YiXCD|=N+;+i>&a>oPZ`cLz?@^I=lSnUer z0V#qjr?ysrWI=?7a-Pw|e+;noxR8e8Xu8zed>b*2Dtl<)RPB0cwV}UC6U?0P6^J_7 z-nMLC(RwTGL`m{q4sxxIpo;{(APb1?^TyKUPCg=w1qlm|on{wK1rfQaGph26n>i{6 zRizi!#iWPCuQXk2W7+dn9NQ>V^<~uRSg(uLxm8;!Zj;b+HTX6U`YzBe7Vlddc6klP z4TH6dTW%P1TDfv~pO%dZ~gs!li*P`pzr!sBTdPXw4rfwN> zO&iysU^Fz2{Grbm5|Tfnm^n>ZfISqlN|UC}@vlEUuW$j?PJ6k7u@$jb_&w@jY=95d z&iyS%H0yw@oOxZ5^cy~hgkeZHEIm4M3ihZOXZua*=RF*?J#6eyS`*BR;uO?vpOyW< zl~Z&VPAS{{LD3Z7UZ6!3z=E7}nq`LQH7?XX{JLg|k(heuJq%~xFjvsuW>?wvw7(|M z|4He$^wV47Bcbx-eC*XERp964dSz}s-IT^Dp&1G-C$prrrT$Uumws60UBwGH%QViF zX#HJ=LxPy8V(&hh;!ss&_ejVg4iN&j~dp z;nyXs7=uTT=?LZ%O%WCnMglPvR?~rjBuFX*S5K3walXF;LBCqka)L7}S2Eucl%p^p zf6~3RO5**Gk)jdooGJ=5kHhwLphMV6ALi6_>}ssMgH=GvWPfV9anaebk!#|-guR=> zQQ{To_w02T^Qrfkl9c5q!OB;1du!$(FjtjsyyV5%tUK0M(J2SXb8q~7|7sC zJfaO_4k%Q2&sVo8UyW->4nN*Qj_=3&_9vms_t&$~`pyuc9AwtnvEy%fmMA5p$8T!F9Fjg?RO` z1|FCs*|d7K*lql;QinPPUu{kAyA@Iki^n&MjtcFv@o2^VRh(vb($6^L>{pw<;d{^_jZa zLk*(~Di|VRc^HOW#NAIg9|f+)u~N?X3%ta9jqA+y?i?kDfK6bsv*|l$myM0JB&t1_-KvnG7<1hcUs?7f6P9Zit=uU3BQa0rN2(} zBFW)ig-I%+Ywb!$HO^}#eHRU2VezuhY+&Y%NVL)vql`d_pOkQHXq0SPP}kYH1cao z=#IBlnK7>}$T{34fNZ8R61 z`vo?Eogw9BRqQP;Q}y<}R$6vsZ7ny|rTi#gHQy@ef~Z^VWJXR`7$JXmW@No`_z5PW zR?2W0(>%VIG=vMoW-%)1|NeL;elJTEcv@~+3DKnhuu~%0Sb(Is@7K|>TjI~ee*2vy z2RYOg?}LZ!1nYfogQXt)XP2_OW6^u1;+!^n36r7;M3%{(Vkq5GDb9xmB2t-f)k%%iYr$0wb77Y{MT{|(KZo3MNw!OUCl`@qpq?g-Y;l{L1%0(zgsZoi>Bp2 zniBh(zuLlSZ8O`47Tsa`Fn6h(HYEPMpTV2>G{JSd1d>%*uxrj0`}C*loeoLqTM0ID zg*V(qrwi7&-PbJ&yU=fI?l=qa7j0HLjJ7z^s)3y1jRTA{`YyEn0Y+^F#i5ciY_>eZ zcbje?Yn&-HI}b43aGzm2cNO+7t+916Z_Vxtm`@612=qck0LKmj)8mb+jT{Xuy@>Y) zN1K|t>D2o6DdIa^7aLr6dEzPyGW+zf3l*ZP1Eka)!cK8*^2;(OEEUgjOkRDX3s^7r zvi>_*hcwritEpL?kB!M$od(|ocKWHCp-*EUfIuf0V2W_-wV%h=t=Z%lk->7!osqB` zvf)0|b>U#)XXg9va~HtS{^LgERcG>l+-Rx47yDms?49C1iKTJ^mY-?nM=bYMt`02u zCST*!SD#L9d8kKrJ0}3p#)6GhHaUOnR;) zm4JO*gU)A!QU|GnXYs3x={ous>x(z-SNa7I&JomjEF8}2d9*j9oHun4>h)a__90FH z{p!;q$BI_|qQ{Kg9X{Pji(TUJPlMc1H1v>c+hA*9iEXJO&G|Ngl8CnMg(ens=eEub zrE4Yt9@?wJI9f4zk|y-HRcWi_q?L+_j`&qer|3Ie60I5_1<8{VT#0@;&a4DE{)~YJ zxh!GCDn%1AQ@fBUF4`Bt^YfcB?wFD$0^^d4S3S{L3UO|!r5Z0Et@z1+pfuDo2`&rs z9yYC zZ%blZPQISp8O&DLj?xKn=VXUulaz*)zZ};6DVjuzwd2@0Bmw>_HxK#vo717HbFgnjk2<{>QUDzE zoaV|p?`8EaTn@-@PF)T%pm_c8Ux^;X#FGdYoGTJa5O-UNiG7YOC#HjDw>a^0 zURS81UU0Ac7PiE)wA35N=S~*sV9P+ z6ZV2>jtm}Gz{~9Xx2#OK28LWSaYz9FenEu zco{c|!}^@n_eywF5%75d)tO(&^(Et58^JfgAfQ3D0yD5*CC(gBHlWvSK*e19ygBmkMQYdPc=Wa{mmcuz4p0m zcfGUC6Dg;bv*q>nIzL#_AlI`eXM0nUb6W!YaSC_+)uc|`Q`f&J61dSqT{`ii0n-Ft zlzzF)RKmOxgFXYh?aZxS64)eCg#O6g*iJI-A_5z#UW&oDwV$rhAQb)2ZI?*1h4PLB z>#bHHZbZ`7TjzAL&Kd6~S+DTfh+ckpOw@EUvow`ii5LEQ7ZilI$sOd=#Pc^uNYG~L zzbW3l)QLdgN@#;}tipW^TXJp0-*y3@7gtn&2}=<^>tXKDqqT;Mx5Z1(LPR{gCCkTP zQyahjnHiI8mB|cW{Wb+{S2#L)))5VV4jC|D@ddt2ZEW+5$o-~=OSy)Q2X|dfus=9@ zTmR6W;p8L+*vZ-@S?w6;kMxNQ0VC~aV6r4lZwdU>jy>kO17+rCWQ%w_%)sT@4r zh53RPch?WP2FOhvuMptc|K?jkX@5kQuUwRz6Lsz@(+ho zt`w&_5x;ROid&Q0rn0#?5kkwf%YajhrrL00l-b_&r3tQP^=U;y03l=R_nUn!;l{g0 z`t#E5l?AawBk)FeDWLoNX6e=ESRf`Jh)#aQfT&IP@^^Pm`;v9F{W4_gPcfaPA7|Cc z?+Po`s`&)>&L@zeKw9oAul5f6<8n{hW6X4vT^eF*vthpmDDz9Ol`tgr(TQz|>8p^= zj#u3Z{wBsnftC##cTJc&WX*f{3{94`ZlE|%4MtM?iWsG{$^2_K~71sERHEOC?ZZGq??LM zpXxf>b#6Qwwk#`nwk;LWJ!-jQ8dP2r{|BF!C@V%xVN;f8%2eEcxJcDcF>GjP+#3t$ z%cd*v&Q)YIbP$3jjOcdn|4rc4ZoxW*bx`Vw;!_`_46lM-lqMh+rtqM+JN zd&PZKpR;rK{55y_HcpG|kru#-xhL@zQT52xxx0gV`v(M2$KVDMN`4HV4Q-wpyJ9H5 z4q!IiR!J8l7!t;O5fYa;Fe)X!SjJXso#J!uUTM zmQ;!{R9&Js)x{>;Tf|NOo4)BDg4L$nS3DJ{2hK&34G``NJ6IQ-@Fv zfcfVaL8(Up2MzlpdJA5&s(W?Ln_}F#zqi;QXQDVG08?y`60av{f!^#LUxv+C&OttE zvw>Q4{mz#MN&H&e6(9Q&&xiJhTZF=nt=*zQkgs@>$~(7|ot`V#0oD{zj_>QzSYxi$AhRf~_koY2zw0_E~n z_u)cxzjEE{S%<78L4|X+n`U!cj%h0_pQ?Mab26{hw8f$c;A^=-N_p?;1JNQT`T^S* z1~PJAsG{f9JomWA9}`lCHl)N;oUnB0_~CbBbjWsxQ)8x~a!P1t4oBTupn6tk-P7Kc zSX{EcHMlC+^?lZjRQl+2$gh3~)e!x|g}m~s=!$zk;3w|TnpyAKJG2T^-Z|2bKZtX* zdS(3A4&ZffvsEqHz|ig9NPQNfy!z^u`SmP@EJ;IXbhWMmT@3hUdcO6ZiK-}Jeon90 zW`4JHeJ|>gV|ll91~&yixY~M8Keu~a7rfF!XMOqOD6b`-(SXSIyxG#1mGxQQcFm1n zIp4RIHy7c7ueqtfsPzNA=W=u&ox_Z)rhz!YxBrA1Z4?f~86OM^h~ft~-#Lx(ApDIi zbzr)E*7&()*V{`N;oO-9z1)R`V{GtkJey$YL;hd5+t#GaBr#04CEZF8wF3sZvZ*xp zWyAe&uOP`5t)(a46T4o9+dX)$gyPM@QjdJSP+W8V|AV=^HFkb0|6kCJhRmS^+e(n1 z7&^`h+{SW{MykK1(m!EC*k5;5Sj3hY<+vmh@~e*T(Ch#qaoq1o0=tU%1{mb+`k2xh zs%2=QM?#K%W8d-ChfPtY8;WbH2XBN!267p6$_VU4{uE`kt#NQZjKX&q9kFXMx(Ua} z3db1O>H4T^-CpWcxgwXScJK1^OWDF8)?t){(!6ls9r`18yYh487^@spB?FeT`GUv%YGJcpSldKfEXQJi|29VG$L1yh zemeUYne48ta#bAkEw~a%jf^W4pq4Vh~V=t^`!cH7tO+^grF zP+Y+egYtkePP@j1gaZD3UR;;JqSx69r|kLp)9@tlhb9A~88lB{1elz;NXNA$ym%}7V)b<>#= ztkS3BcvnKnA%{;!E*r&UDOBQ&T)h@T7YrKUsx)n< z=AUzVJ1(^@kbN0aIkHVrh+`LH$908P)yi%;$1V=3@ThnZi`w+-y~wD;+dmzG&R(y{ z4qj(XnSMYI&i{kHIyU4O*@xig9%|`eJ%W{5xuFe$$(5VI`%CX==e7{-!y=28NbV?> zVOAEMY-;#TPNB<(OFs{2@az9E@Vib2(^avLE1{4E=%mijpaD0N@N&v>6Dk)xps44} zRh*Uz&~OfY8x(IzPZyjv5hhR$SzM}Uc-vUpx8bNGt1cf~eavr77LS~97%wRjshBl( zdA!~TuG`2sTa zJ5SQ6X=&?`l6n;T)RelWN#d}hiWjI)KmEFMll~yC;4dEILG#7vTKBTUhw*L?%ub~s z__-OpuJit;WBt67q;z=8T)kY5krrNnCTUTU_sZ}#A4amp?T zNyLYvEM-<6>dEBnTI3zP3{h-94B-j~pOodFGa$WjmI)R~@~Xx}ssSPC*}*Jgb_$`( z*HERI@EL4IINe+z`ssLa;U3ituD&Rw!2vz&H5hKIRmwYNb^*sGiJBtt@xYB!Wg->M zJNwV>e5a>lD$2Sk{ek0O!zx4;O>=3tb575fFKX7iD=s+R?pQKIBpocF3*Q4HNxq6N z*BE@&Roq=dZtOMDO6x1^^(Ez2Cx>ZOO=`q#$7hC#-e?L3LiET-tiL_0AB@E5-*Mq} zx*O6?&Vt}C)oZm3L(YQWCd09)Q5cm8d$LOLnJtkq7>t<2ZfS#KRAb- z-vWLR*TW2c5ZlxI&)~I*AB6tiw)}eCIRn6atGE$fev5gA`OQ{B3Pqi;$bQrqud%%S z?c`OjQSpXA`^XgloFm0?S9h%xO6_Sa?W~<3%k6$@D79RiDy#YWqjD-(DyhYPTaARD zhU*U+OZzlQ$bZ22TEM`aN)>cXs$I^T>5M(}f9H|nM@tmKW4$N8Jj`BB`-Q$=hkL#^ zzYU(ReF+!7y6%@1e9ew)NX}O&ZgUW8zlZI=d)^2I;NGVvdrTaG``SLQ5IZ`2lLV^23BCL;&$3uFiuRWHrw#$;LZnyqfUC+hZUxsa zpPB~Sq52ewK^-72&K}18kILlx3OKBrr%$lWmHzBG?88BBOVL{9|InW7#bi`iAYIUN z9BpGhI0c7y?;z*}x`=F{Ii@A4-&&2_DZtu$cgu7)0z-wn><>g@rnrLfCN&qm%V$0t zU?2V$wNaP93sx@|=(fJ73~@(SXhYKNQp}iPSxRN|ynJrVWEs7@WZlCEGro@Cd~ZO- zBK?t9tBO8Q{AfwGdAe{kxo7~UP1LS{q=7P_@dClJYQzhQhN=&>8|3R_CSsza9RHGBIz1-MitPERo>2M1 z#w;tTo@}3qlnzJAQ^NRBQGJrl`#CQSIR1}5-!RTIQ<5ve@Z#@z$v&_)eq!F=KjNv{ z?l1MbxcB0$=&qmA!66VC4;>9c zebj!1&DS)^%VPv+ZD-|Q@Pb{UK=kqC6?mR1@59%nFymvl>NfFAZB%mFCsx`&6`qz` zl+9e(dqCa+99FbSAE5*|3`nW=zByQCIi|YGUP=bpHhx}S6G5anYR4rSbfzrpktnW4 z5g0*{-+hx1VN1@cMON0$Egg8VPvEf>Gabb9r>#Fq>!@Cqz#_b2QL+1!L^FivydbWd zrdC-?Yd^?gIk0qTf(l-i&4G*b>}y9{I~*4NYOa{=-l(%%w=4)F-wR~cDr)_vaOBmla5iH{ ziOlN(+j0@SE!)u9uBnnc1e=ib2OOlolCjFv$oI{!n%$^U$K0t=C7pMg1>ogYQ)iCQ zB`2muql06h8m>cirpkKWt1V4}9Hh_dH=iLY)wrZ=PwmMb5;Th=)N2=KFeUE$KgAIk zqzJFUIbywX2gWyhY-E6z(pG-&F0(YFPY!bG&h%sI^Zm_pZ$9bR(=y z(%&`RUL*X`B21{>IqR0zh1M!)T|BQ@pQyz9fGag=r6u?aZsu0XVGjcSw1g~ zmhy1qv&QkDS-$tcS82^$Ug>M1KWf@(cBZLeVX@X8J%3O-=hroA-q0R8*T1?T-%_V= zuHKb#R=h;mQbv@e-%(*GY0acLhH28HCMG(+#7KP^k>)VdsXb^xqJ15NIIqG?TOK#i zK~~J>l#TTFa<(7r!lQ5Mo5rh~=t>%!Id({>Bp==*vYds=in~Fg+sfD2VHD|y)X>eH zNWr1re!E5-{`?O36c{3W6bSh|-j5ad7?%9npoB>&2~Z1Vbh~}}pwnh0lxdE{^=G&y z#Q`sfTL!eZ!4dj}x~3>FtLx>UbBQ{^`@HmG+{fa=O}4|9aGBEncA9j~Y%6|KKfQnp zl}%Uc4(M+fGn%Tg)MKLtf!_s##vSikPr}_6YtqpxO_sXKXU-E-<5|`A@NFNcNf+w= zXg22yUffK!sRB~PPi%ou_M~X<(miuRY#)W!4$|^|Zi61wTx`ua86V|!m0GY+mRwuS z%==0CYrI8@_%{dYvil1GHR&1RRk;b#gBA{yU7Lyx{lXEE9y-BE-e|4fT6M=_XRi>s z{o%?azb$O~ZR8SR=>;E<;~DMo655oz%Ke;s*V3hRos`WVKe6sp`@OqfcU-w*3M7)a z<(x0!@pEw}d=nyszWxk^0&iD4C#N^F1>)kdF$g`l1bFy- z{BJ+~6oLge|F?b$@5?<;z9(Hn1Tfflz!ZMd$eb}hRKJ}p=~wtds7_-06RAE3mzZh2 z%K**?WN=bZKlxfBv`1qc`~OJR6UpxYWhs!JOEv%l9Yg(DvEA0m%I*XUI0YtTc|^YJ zgFm__$T5Pjf$9QL5*9iW0{M~uYL};!XAN8!-i31`)l}robQH7^7G1>?58MjI>V2gN z1P4Vay@*A<$st`@(E?rE-v;GoVB^Gt^W@3zOYv!HdKc(R7|;h!B_hQefYY#>tqLVZ zu!H&u+(F<(5YvIlW*`M!=!xQ>Lpj0Z5rE>TYBPXGJOjvnvh=^--#IuqKq>3+khs@5 z0@r-KJ?`!-Fow7!$&Q$bmtCJCVmp)kNr-5c=Q;KfcYbH{aJr z;=yNnZ25y_W4ZcPSM(EyrKcR8hLM>2v4vaHCa$(dE0H&uuZlL$B$$K9yq@3Z8y2sd zH`%A)viML>RHamk6w8#$LkV^HA(ba@Q9bDmLH_1?Wu(#Kfnb4{*#aRzBD~n!{xqlf zI=Bus6Yza;gZS!p^=NnXa&cn>B9!g>3f*rBH47z-f!yimsdfF3yBXiTT|WkTwTglg z)Fb|9FbwvR|La#4uXY^YEui0NDi@mi66M%}POFV;RWyp6HLIk z6P%XkuoB}Q`3k%b3RQX_0YiGr3Oy|nSw5UY_Hl6WE#eb*ArXjpsk=uX84x@~x&7_g z^)>Ee@$LKgHu$vv)e}M3-QAMypCdmKTRnn$C%lFd!UW5?vx;$Io_>%QPq>C+PKfM6 ziOZ9p9;Z!UD*U778QSef54LW7uQ*OPD;QRx`%%yKa2iL%&W7R$1{$&VY=r{9$_g`6 ziz)S+?nIE5IMnGv&OFt2Y{owe(TZv@Iis9ku+2Me8xBB40?xk5Zo5b6V7BkxEqQFftGDtIH!9|Mw@aA951 zq>-BTp~h_+wYcAOnPKs}TB0+QvGkqdCcGFUTFMcl19FZ&<_bfpy|gs=3*=GaaQT4s`eDYY~l0(A%5B~fP_ zq9yLCh_2?;c71s15F5}^ConC$2+R(_A1B-(2cs@JS6+QQJufJoC0oqz>7SqR%1XHD zv!(4`^erFqOoB@5z_8!IH{5E4=7o(7WjLYW%L=D;fCG8or_N@^}v3UxkU1KR3qBkcn7i$%$Sdkhj1Ecn>pv zDv4Hmx0pVIuD-YxBmcu1tjsoL8UcID0}4d;WloFv{e`*Xgl|OP7)WIj)`<>pR!i_@ z5N!ieMBPC(To_|wW1#I|gmhpysiT4NQh%RmZZKslnd882E^aUE8hH0TYuVBvgl}1f zReaQ0!dcN(Sr-YRJLV^af1&aG>u;vOTLiN1oiVvYJ1=?k-xf5ql$q-W)*iaV@f7iF zvrQO~qHAekG%3@jUwI6QK`!V^s~w3Nc}5EI3mqGcm_h*8?A~pvAyPhdLzej?__`dG z3_(TmCneT$M|bVE@WHN0r-K^rD_LyFtf*J+Uw)0~tj`2*vmb4$M{;b*c-2{4+A&=9 zA^1+|7~^qcoJw@8w79078Oc?O1Zx-BRmqu_B9%lZ^%FkPnS&3zGE#$rK{6!59cp$? z;FG|{!PU}dB3oI%GVV>D>_}%N=z|@^vAvR=ZR$UaC%7tm-~Z&CYrTx|$G`?e<=R?v zFF8Qs<^T(kh{~T3BWg>h-%O;i!^kmNjJkC0)G?TVu4dNXmc=-fF>_7WIL?6hU?hq- zv}Bn?(rnGmWo~P0Y3Hdb&nE^IG-j?2D0zt>ON9Z5voaRt&obf&IPRKOM@)1-duR!N;n(#DkQhu~Qte>?KGX^0CM6xXhfCQ~>xNcv>EtHE^9%K@59~KQ0C;@bx28q!S+{7v=e>sD^IP>!$?1!Q zwl_aFgfO>Ap?Zh*MAnoWJiA;EE(yN$vV@{13yD_ImF-G@+z$MN=S?l0zW?DpO?h2Q!MUBQXDQ|1C^3|oupl1r}6?{dt( zw?tGe(nP-2R`A6$+I?>ohjvy+Qo4?#gTUfy@~JWYO6)@eKMjJ^$_t;jlA=38ooYEa zsa<+iIi@-tJslR)(B?Fi)_di_+SNqdK%rrfn>y29?)g4f+^)Ebmm&xe#KH1*2dkvJ zl!whp`4_*tpZi_G@(67ml{o$~F1TUr>;)Vw!cOIICAPw{Q)qKzyPI`Yh{#QwiND;< zAu@EBfrYUC1b~CA(d$yOx<^@uHl;Fo{GdzzR_)4mQ^f)7il&RelI4~<2fDsD@kx6GWwJr)oMHs`;5} zemtp~=lfX6#`-&ysQq!fBd(!f;i8eup-)k=N+?alEmXc>>;@;;%cTZ#c+$P5(wgqb zLdfUTjHTVe+Zzf!O)LZ||5(UPTOGWlIbMfiizu8jJX2tv&sI%K^-_Sw?zC{9Xihu% z*F^e^m-yOm zKo^J%R<7NW?_#9}$`bgd+vBa)nQNS9xf**ZJ-@Cl;*bB0`fQf~h_vkl=)3{Fm>M}GlJB}7)S2*DncIlE)#=ReP=5^N7InS*p-b!eW zTOJGmAN~yBE#dSiRmt=7{b|u)#CW6PSO+cB%Y|U9-UP{2yL90SyGo6R>U>dl%!6$G z;BPIL5fA-Edl0(V1oTq2Nd}nbB><0|Ly3XFq8RSVae5(gLAq-sy$rLBC7H!#P+DhI zm8uO?fuhbN++tLtX<{jdK_h%uQGr&_eZEwKhK4uFYf3;xM+iJ^QH-Bv4N7>LBuo*x zBb%Z+HKHOrE8RXAV!1UEga!SOM>@(@=Q%-YVCyxg9@O~-S+SuTU8Ehlcf|Ez0E%&O z8!3RRGn{ud$1jmC+z9OCSOor0rFCH4~ zmc}6N5)Pykdy4e1w(bgENKqJ;l*Si?=mdIuGJWG->IFC2+(za31x7IRI&3~u5?@n8 zy;K|tNyl$(dXw%lvcCyPD%6%2?80%1{9Nwsh1KR-Aa>Q!Ez&N3pfFQ)OlXc3Osi-R zw(}rSBkWSRkL!J4!a8^!=(tOOy&2^wj|gK1IZSIwJt5_KmMgPpV_z$edslw z50>Y;uiIKYF$A2U9XDv(VOd4cR|MQil@l?jJ%%h-c`GUOw1#iD7NpMQ5D*`vqE?UM zs;z68=>*B2%{6iFjB7@;wMahV!CI!p+(l`IOGO006w&7Pr&e?is$XQ03s#o|VZ&Tl zNIPn1%UZ%qc4?kAZR{C)sKiP$eRbeWdmOoXMN5d@G|73>N=Yxdc<_j!$%RLnKT{0w zYm+$SzavZ4sQ)2(>(4@JfzHr(;DM|4B;!~gbQWgOR&&{!#HZFl5Z)Mg@oF|8!p{vY z0McE$t6;M6FAfF1-T}Pvt3@qbJKua2CIA~Pzi!aPosF|b7OaJ@CtR>C(sr*8Sv?-# zt;*`f_=}1bY9_hItnZ0cL3L)_`bjrVuwl?6gxuk!BE0eJkyE*A@y(2nD))wG=o-Je!&0?++|k+~>}S$c+<9hL>x*(C~v@&3R;I@)=Yixz6x@m``5&(%re&|xDf zdK$^pG*t_sFu*#Ed6l+RpuJ!mf@8Sz#70V~;SS+o%gV%McCp>z;D{cH+o>u`uQ?Ut zGG(yknC8rx#5HlLOR^P(V}Ru!8AJw6Cl)8EgUVE>2k^EHwsG)Z8rYJkM6{ zH=XO4Tyux%7>K6h7Q-B^kFTA_35TLM)Ak;(RmHJHwy-a6zI;r38<~8HbXN`0Zy(_N z67%BsaWZb-XOT@JXKuQ5rf;6^&K)=XA)5D9W*6-9u8 zf+K{R`_*>zMatX6H9SQ#^ z@xSu1(iA&Cnv#|~<(jqj{n8G(8Idk=M15J~9Djx(bw&=+${Nzf6X}*Hv?omf`I~c? zZnj6@x}k-|*TEQV*k!Y@DM=~y^pRNyxU&)mCu%Q7Skt)U-_2B1{8n)f4t7QQy{aTbv zvTL}M!_~=^50$eJ%gn1tty{Uh{b3Q*(@r?hEZ3{EKs!jaOdur`?|uU30jTkPkkTex zP4rkqU|0^rdDs7dbdK zz&3B_eo?VMRG(zehy|VM3$T5UIvlgWXEzHjGY<~2tAomPWJj~I$E@icWppz48bMf~Q<3xM$n{JF_J?Z*ZI#5C_h;)TCvT#i-jE3SE4~>yMDm|=M*;P>?3ekD_2*P^vwym!(q$rWwpLTH~7&w z0n+7H^IioMx?gjd%TN)26nTdXA6P!Rj>l ztr}DL%mcNP=2h*$$N5iH{RDR=)Xb^Oa_6VFSn@#E`Y(z>V2jc>GnLQjt)~jWrSj)= zYK`6#!MShs-f?y9SBbuV`=WsRzH_8>^3y_WiFo72XZ0AhwX}L!wtLM~8dF8~kptjW zQGfB~Ov#U$lMcN$SN$G_SFK8eY8`pc)cw`Ir5OeI1ZVp3Nqe$^v#@v}M%TtpOUlX~ zaiG&aO%#=P-JxpU|K?_7NWc0oZF|9)R!c1RpM;5PENey zlve|C>qK%5{M^*$Z9JPOeSeUttCbPq-G@}(W@(D-8DapX683b@_LnYZ&$tElQ`2h% z47%`HD4Y%o)`7fyaTv`s6TGAad~@L>#cO+NYOnlaMZ(yfNqa%Wq!FR)!I$6oef9FNf+0XgKR%tlxfyD80j$W%BjxR&|=ZsF`vy)+e6 zvOo;4V@OIAa?`CPu^_S>?Y#8^P=Ue`019jCT|tB2S45aVdo=7Rm(rL?P6%;8(w6=n zmHZ7l%wSEKB+DNSB0;&jJYk~{Y)iZ*6?o;Gu**Hpinqb&1Z)&TcC=yn^X+)wQL#UP zzwdeTYRS#i0mC(h%Q$69(YwEy7`QT3i4C^%HMaI(Gl2ST@X33;^!6Cc{-B*N!yPyl z`)VOGyEGQ^fu_qC?y|a6)PEnWe$QZXhJ!5F-x`C6#L`=U)3$tD_neqq_||yx@Wej# zsC;Z}TJw229CT0?j)20!s+D&^wHtv!xDD743GLu#hh&co1F=6tT(9Zlc!UAr5&J=> z=?7%DavBfxq%lhi5_N#yBoMI*{VLEQ0@Myc;rVj%YzP362nhD>A5(lG-}OdM56P{p zl}u~M^)b!_`Vx|ZJLI$A?J$Il)j2OOPsEMB z&jj}sUIOC*s}TI{m}v);!A*#0GK=x&<&LOB#^OOHV{x!f~TY7d@#ruJ$b4YPFYn!|7YNS zpHQgC+kp`lk);0}@J;U^onJhoqBa;5*iDFBVj4Wtpbu1QTPCwPk_fN0an~R(N zTOcnt$fuZZXdfoM>d=6Dd-~enSv1S?&Yp9COv#Ku6sj-+8FEuMt-vp#E{H zPSG6{Jrb&05>ayg!$fglxGoBRf!p*-!)&pV_k&do%z8Pn=j-4WKT$QoaGu_wIKHBt zxt`y7y2#q7drmxGb}o!3^$c)!=t$Z`MY3)mMfy;5;^1by$e+K)j6o@VmJ9Cts!~5V z+6TYakxi2jf>}@GAy$(j>dOVaQsfQtD-fIl5kjj;Hc4q02LW!k{;bz)Tyj++{mk+X6Tj0b{VJuXAv>{3~p_|$&iWek2`s%0i_$fP+&5tXk#JD;$=A0@&$k7I z@AlJ{yuGJ!KYp#9X`{L&ucHWuMmHK`;LZXR9R@zIwzgZnithqO(GDfOI&$1%zDabMi@Nb9wlzVU?>Gf(%J zf7&bUdd%ZHCFl|Wkh-Ki+r7kp(&AH_qz7WUehcaN`%y6L=;`^NoTxYg7}Iy;^O1*Z zi{IBLt#bqh$G|5Mc(4le=Zf~}b{(|OeOBi}sIQXovBWkjPQi(P>22!}+AdaYXq|6y zm-q@4!iCU}wbhJR^85el6xBW6V}I-u6q`Bn>L0{I5L=rHxk(ezEWAQNXGnv#aiF78 zylA7(4za4bLeOFb)*@CVekCVqOT1PAN``LSsn{# zA^S5YREOoGL+6+R3qlfc!P7G$>-W&pM2yB2$b>)&KQhCP<@8D|n7Dkz!c?GalbR+9 ztTa9DcKrw~$+j)T5*dXB{WE&jTh3h9^F4R=dHI~DxYl@|FR?k@&h+)1U)}gv$30(F z`^wqYKNj!=eAnE++pYr$AFlJcuJc^ppBh}=ZTAX#tk!J5h1>)_%T^nETL%G}84o@TPcki#yV>e7HbLOyNH%B~R@X z?sQ1*rDEM4s_U7A>O_s^8B)WRC%a3RBlzKJzEI;F?=R`5Z%ff3JVk7u=rbl+Y0=qfI9lb@ z!+8=~OX!1Gmf?hvN?7GKN|@AHn5FT+6716OG)eH~EYOxe9**U_JF4}Md?QzeULO|L zpy`!@Y;D`7hJ1T1y?uy-{0W9nKT9G_=*k+5g0{*qRt81do3942%_xp8x*qhoa zMMpE!)5YImi_r^RphYXD=&(6ytaMw=5qZj##aU?#B?!*ZZTbIW0j6%LoVP<;FksymJPc@?M3 zROTJL-+)&}%{M)Yd2ky^(B;KQ-rx6ly^Gx&Rzok&9@t=IGHl1FwfF}90cr)+01g(4 zi>$VD`Kp{Ej;sD`=^0CSK7)Nu0bl0jA{~XvyO?D>ouLXE+SXOsXInYTvLN#|!|CGd zMG@16W6|lK$(9@y2OXANs?}$T&mnvE$GV{at!d-cko+}PdiugGwO=$B#lvhx|M-cm z^nK$~ktC)}rH&4wy{&n@zwTc`*Ix!Bt!YA?G@X)Ql*bLQBuZS= zk)jjTc~nM9)u9~tfqEZ|-jX%=ZBBkmyjguHq(nsDL}dXM-psG)nODhn2P^;dmczNoRH9d`Z%lECFC~c2^x>vUYe#y>l=jIcF@>5-ZGLDn%Sz?3V^TjMfL*c5QB*fW* zEz>-zq-n|1uPT|1{29LUmsD}wd6Dqw^eav24Ggl|^Cvaa0|cKVEe!FA6feHyX1+u; zZx`!RD3L;Oo*}S^JIKMN-K<<+pXF)y2XV8_m_PDI&zr>nX(tnPPwySLT@-R57+87v zJlaow!S|@htVhO=vX*mbmuhH&IKyM^LU@$Uskuv)z3_~={SO{YjLy{e)zkZ?k84K* ze76s{@8*?_t0%zPjH=qPEqL>**Lc&NsQwDhvww>)xsqp-fZ`A|zUf<>-156GNU*ql zpD=MmoAkkjdwu$Q?b=nZGOC+PjQhLv;nLM}J))b31{L;GpuX`^Ag%Ee^c;fc{{q24 zKEJEd4Kg6rG#KHKG6MaO6`G6|JPoS2EFC7$cx~8ts5qK_XR&+&^1m|dX`io z=U-b_RfPiYdVw2*>$P;5P8J+!G8mQ-$k3(l3RC0>WbW9SRGqq|q$)Bd{-wX%s>s&N z8i2Y%QSuS1&Vz=nJ3$P3kU`)CD)mY_O+~t6>zdLuN%y8S6nX^< zTrqE{qqb<$Hr{*&#|GC>v6zfkg%g7^vxcKPUGLHue~O>7{J)JP|EMsw9_xQR*8ljk*8dQ^fAA%eML!S_+LM|Mk@C^B%Q?0t6U`Q-)z5b&&r7DC zTMpofESLZw(0agV8U(lC^AraD$VVQZX90Kj$=?wWra;l2fmb^M2MR8b3pu+|JVD?W zldVx=JMvNBQNS0upqQ2cJ_VZ>w}KLHj|aRhCo-Rab{SDdnGC!|gemqrT!1(_wGQvN z1WMJc9-yT;i0Z@2DFenRm;iOU{|k^QN!8z3aQPSAAeE=JuzrJ`)U^(jQuX>LoCKw` z70W=f3STAqJ_J%O0fnG3i$x+*#vLk+Y8A!zRkqa`X`Kc=y`nX9K$Z29VU9yJo8;#9 ztl*Z!H*+KMk@6kNBnR|IAkKZ~Q?U51gf$h{Z(dw0$fe76EJVeN9Ow4Vl?JGd;=s-rnFfM zF`Sc)a)i;J&*-ojl)(%qG!ogZuk8cXvfnQWSWv2bbE{JEFd` z0GV3i zY?sAf_WPZk_;db8Z)e8u`}X(!PH#K+`xq&IBy=fpbMrH#(rhU)ZL4Oop-ezL*c%*i z{Yx)-eSFj)7%f?ySCIz-1g|JiDQmQqCBT=o3r<9eQs9m;=7)a}q8mg^7kFg4?K&37 zRcX6(Ibs^pX~Y>7c^!Tf>8Mfcj$8c2uj(F%(@Y!@Hq}v~yALCH;RinR5$*mgo62%W z-D@j{wV`X$4axcIPWSunc4ym($H~w)F7wY%OS;z$YE)j0gP|Qi-6k4ei(vpJlA7Ik zxON2%b5+(PJ8jRY1{OtY)HN@6E!VBd?oVVHuzDmZAS>aD=~97g_1WpTP#7;Z=$80MCqMN^ zrDNr1aFMEajgei*2L_!^3KY=kT%lY2;0oO;*zEr%;nY)^_m>8u#;H`;Xd;3cc5zTN z>moPrGG^WoOAJBt)cG11Z9RJey=z36Pm$LV$4=>TLG_gyKU?51xCL=LAlh-U$DiX+ zTByCPL?-g6!OMI^Z~_%lsF86h~R7ALtgjElQVIT z>j!~?4L~4sn*%>&T=qsV^j!{+>1l!q0&EOJ0iJ+Fcli9t#gqx%ABA{&ITmlJxfTqk zlM6)TQAu2S%9~J8NW1$)Rj*AlLxO$@Mi2wP*_Fp~`PM9rUtvJyLBFdljQmlOR}!zf z@lYoM=G5XtpTTB;!t#&WpqE~E0*GBv0Oy@gD4StaU4bg6JLNlD+ErK4_)xU1w?@?f z)!aPBH0EXq{>}GA#W$kB51(z}gBl{_DF&4p_@<%}e{V6pp0^4f;G-swz#I(0197$; zLlspm&+`bP)Ox_w)NOQu+-u(KS#(LKhF z(#4=8X1ZO;L$h?fT_oLOiJSdgRc!fcZhJ)%rX&zz=ITvcvObFwBTz7KJ8wdZ$x#W3 z1&SHEc!ZMuPdg=w5lc5gpLUf0NR=g+Ysa?P-0Xjd?|c#QDbii>eJ@@3Ah*5Fg(aF- zUNRu$2}3O+9lnec>+^!(E9LtvHlFyE^6k}o)tg-~4VfQ+O|9kFnN-Yfq2i_zYfq1{ z3t$v+5Y3ZBq9u>>j+*zpQ;Fpf(Q2D^8o;s-Gxq0JTXs;z2O7>C`ffdYqV{9$q9u%+ z6nH2i$QAY9RbY!h0`8O$6f*OK0x`SU`{q2Ru#Q@)N`ZPI_)Jen{H29R_GMRtYj6s3 zzfjGFT)V8Wj%G+eGfgiE z-jJYC?kG9U=BBQ6QC}K~J4vUWMd>U)H7WmALv?u}B;RF*ZgeX6GFjeCh;v<|6Crwh zkaPhQdT^p?AF;Inf_x{ zL6}$4kLSU7!j+XWl$DY<56-D#EUQLZ=Nm1U=LmbnGkl#%$89CeE}!GV9O6~@>Jici zr=J&NERJQy1(WfUxc+z~{KF{|Xg}AE(!w2&NxMSf%+E!ObUOXj6GL53f&g7Y_ZCow ziSXI;5ka1GK+EE+T6JVAlU3ee?v5_YupY?I&#W%EEDe`h0CZns4x&tsncg)ZQJ`;tvKm~Td)01C@9|s4gfd6u`HyDUtI4;BY2m3$o z9Ul(fCzadNgSRJp$8Yy!BmV92-unZPe9U|L`-juFsmG}- z;9g8LpEY(Hq1{iPJ~d}xty62BReF{H0z$v#A8?%r)ly`JsRMJc+62Y9QSFyn` z@mQ)1`qY19yAj3~Kv`rh)nD?)Ao;GwP${cq!WQ>=iW$munk&kruMbxN#RUKmzDJhh zi-^$)O#q9zLCD$OLQt`UiDr*#{aG2M;hUc7r!Ug3~&q!I6xWCb1&?TQ@|+_#=7_7 zv-QamM56a-GVIyK1>#IK3P#b1sIB7x4YZh z{lt@)ApJz*rX^%B(o1LE){I;hGNabEO}13Zt2p(*d+Uqk&0A_w_ZwT({nAC>l=^jvKJ`8H$r`#_@O_UPSo&Rx791u(fyZ|6lF?= z8BnU1Lc!))b3s^hk)FT`%#UMFiuio2z_#&DOb7)x!c{}Rd;>PT=Rj>N@(!{|ei~#VChFJ8QOJpZrar{MgrS)k(h|92<^-fHT{-l)M!a{IMz z+jJvSV^C>h=g*!gK%PB&12*Wn7+~R=e(`Y4 zrQEehwkG;ZBH!|QW`S-X33Pm7ndBc?2y*dcf& zhSe>Syz+-^O5Y?Q0N`qRfm{}Vj)?NreaXhaa@gc=JDnTI+_8e{6o~*}0T+#+i<&GO zoGKhF%Fm`i2z=ayY zWH}PI>JYdAo_acvf;_hqA*s0w{3{gPf-$^C08Sa6K<2wJ2yQ!hG=(>oC+x;6%uDalKDsJ?_h_k_sO!7CG zaN^_8jjazNAsvbWe2cscLy1`MX>>`ThXhM$9XGZLb_kkM)X`boL&;kro;?b+}5cU{TI-N535t{-0VkAB)8Uhv zh}qP+adCa!TRSsAs#I`1uC_ZaxY`DYfoUXsTf|Mb;nZ6^wK&)y_2#^t1rlV-s25Qo zfml-bRM(m*$t_c$&bG|BaePUkrCdQK5>Vw^%dHkFMlowIHzV$5+ZR}??N18mm+isk z#u+C*XI~O>Ksb6TQ4m*H=2GDj8yAt?ry`Y%&`)Hpd>I1ifUm+|>D3Dlx!6PC{{AWW zUm#zuU@wcwnBLVeDJ5&xF(cc$BwTd<^;dHmlw(TOESM13+-Xp6SD{lZ0Waa2T!_~d zx?QoZRFs)!0S@32Sc_9vCU@*~INTlm^sk9cTe?q9xc06I%Dc#+rl4b2_i}&#v@K8I z%U_TQQE%-wUMRMh0OKqEC)0YibaeEIox$}Odt4>^C!PWqhH*~f&r?Kh^`)Bj%mR1> z=ok|jA|VDjJh3&qJs5=)SWLgvGOa{ZY< zvRqUvPEwX&k%YCm-?=los*ol3_k1~I1<9RKHt)HRIea(ReFF%B9_Wy=m13W5Mb@}3 zHIW%LZUdt$d2%+G{u=w@&LCmY7vYJ`;au*ZMVjy&Gk->IWu|5dCsBa(=_jdNHo|5m zd-9Ybl3}IVMBCdx`bZIxy;V;S$MGlsTBhgaBios~7lNWD1P#vBPimFI$S<;O)J9-G zm{NwwVK~C|h-jvd;mCLA9`}rYJbVd{PIoGqG8_1QdbhXK?_^Z0Ul-^+C0e8#+6Z^JFds%bx zxZHamr^>9Fy9P_uB?n#;({zCoN1U;Bfl`F&ZQM-Na_$e3NlzPJJn4nAlC@#hggLsv zAiy^rzGPfKf&q9cSIATIN~Cgl`iwuo5hAke2@C?z=?I|*o^qvI{{Hm5Su!OyqSX`1 zmBWjIFAZas*y`3~?an1&B@ZZeia7yvBCsPAbMG8%PW%vT?%19`dNr5jz%aLzje0s~ zcKX%xm86holovy_WiXl6D%NL%PS8MVP|Kn~@hNKg24%+bUwzodvpiRryC+Yv!-+s~SKl=Zz z;^!{k|1X~fD!c(tu=mz{^rQG_eH1N;gcu-C5mGo#;FpgfyoP=t0#mHaV4{5U2dsiRnJ_RXDis#9~{ddUowy6%6wop@}IUlra`jhs(Kwho3d82guFk(LGe!hsxo zo?|TL>Zh!=?ea!4ICOF*DwlDWlpAPA`O$U$ zjW6a^0xRM_c3!=FmD2xuy_da5{cjaNh58?5L&X9^#R5ag0u@T&1;&gr0;7MzNucw~ zkoD06QFvWX(~#M;RBEmL_#(c$M-Rg5Um?j8x<(VUvwn50Yy80s_uy*m?oWs%fhoxF zl^WevHL@y@C?#qaA~@fmZ^V^;jy6ku5A8!jMSvl}L4XMD%3`DhMVR^wliOLpWbm?4 z9mpihbWGSrtlXrwbjPr1=N3*x;x9VApv(b|0M5|_a?}O9rmV9b=V z6G&)|HskcRwDx1{MiMjH9Li}q#K$qx% zx===I=n{<%LD2gU2Dhgevv+=g=q+Vv;>acBkZHI_k8#M~s%IP$nbFWB$&@~KbrzRM zgn0tl*pV67lMQt0!bCHh&851&_(0YY%NxyJfsUAkMz1tZFlC2wd;BPO$N$3@YqQCT z8(|!82#MXC@8X%#p|!s+~A{U~_%Od2@4`wzDVsdCuM! z{2Z4!dJ6_$`cd0TuCFV5C}G#6=Vz%)-xX+_@TF9&t!D@mVbA2{T&{4czv zA8C0~YvGkLiWcD5L$M`Zk7hpw4jhgA&}U^jwm~$CRjmKR7klxS6?4UKpj@VE*-(?s zEBYp!w+TDZ0`eGLBYytNs`ZuQ)+xi79$siMC(|I1Rs;dCp5^4MX!57O;GKj%+qdUa zs{WM#7a4Xc_gWEE%=Pnu3_RX*UH;b@zC!UC#?3<1&`CeJz|zNiam21OTWNiNoR7awst9n)4B5;6xJ1Fo?&B+VSv76+T26{p~ck>OiJ&}fFO&2(QwA8p%a ztGt7AJ+*8BXj5a(3iAxPFlUqm+2ear&_W#;$|{6pqH9)VCs@6iKv)SBuBP_H!h|iX zL@_^QYaQk!PVZqd_DpJkX%>1S5Jr$oo72xv_w6f2oq>oJQd6huK0UR-= zjWIz&abA;|x9T_-WKGgAJO?diXOOnA$@Eqh6sQZeYw?|&AXXG^=#SC}H^(IgrX^at zAIibIg~DqnOMmJqFt2n`wwf6Le?sg?esSb8L|{(6RegYWlpr(gQE40 z;7LuVDUQi6=vEXp%;6Eajn~MOQFk|}e`GIqSl}zwP%qX-8xtKlt87j73cZ%D3#-jK z3xrH&yIYDz5U1lYm2a0ac^QGVPLr5b^-3y(HtTn*3xm#ZlBxltOlT4xLBuF^zPm!V zweGpo0y#^;Y=zUcAzT);u2n9#h-}4Q)g{`Z;(Gq8^Ch~x7Wsdsoc;FG|F>r|=)$v}a>2*V*s|w3yp<@4q5qJ<@ z+Z=+zYiZ1_{OX-J1Fg#C#D-v2S zZ}>(nyKdIx*xaH5o_K(BiWumib8vp1f#V9@K3Cn^_o>odqN~%nnXcI+8nS5=R9(}l zHN*LniRittE!7_wI{1WFdn-Lt-RXpY-#CL8r~$`;2B%C8F- z#hl$nT;t05(z(Dm(2G|xMmZ7il`6Ar!JeYPj~EB4zIrued0UnOCXK-qV^%_`MU}`Dq-By_dwbasdojd^=@E6^I^qt$%r|DWxlNzqt6Jgfh=kjWb zg~ZFH%1PclUrrY2ERLf2P-Mv*s*GMbQe-x%`8p*JU)oYLuDHaHG`zLYWTb*nQJ;986l2q zl-$?JMby9V{qP+@=to750(xdLizE^T7l?%AXJpky58vb!2^00H;_C5KgTC3?+MsVXyshirmWM8;ms`p*IaFi( zP5rwoFozw2E`7?#tz&3WAG5cja8Y&i^`=2k6pBgbz+PbOp8F&48|Zkz5fzZ6rwQGf zQbg#M1AhM>z{V&%2j>6)QC7!!`!;0l1d&>0EPYTR!Xj1Dt$31Dz>o-5JF0-?Z*DZufcJeEljecFzSX zwZZwwKQH37+4s7+axY5#?o;TP?$*VHXQ7`w{~vMz-3H75SNZ?E+UdVc*Z=SLUp@N& ztm3D@|3|Svh0l+w6>*AJ<^5l;COj!Eo9&Xi5ds6>LoOuyaUK~9;aPq5jmJA5KgY@4 zt?+PnWA}F1MX|nRyF7`BoZHPwjyj8T6N#>VoQ9rNo!7eRCDB#qLcCp4BHemK%*1k5 z-So}pNcn2h+LGo0l>)riQs8ux^mKy_3~+mJw*8{-Jg6cQW`t_cSm1BJ@V!(jx$LS z^ylR-QwEoc43%DleQ~quplc+55osdDj?Djx_^k3%Gn4nKZUFs>cp-9li+{EPd?_3r zj3LO%vSxWge4b(ksbd^Kpd^X)q#ozbRe5jLO{@H>)?(ft{m}En%eB&VE-I9ri@MQ? zrP_|dd;z8BA~&>8z+b*&U)XvN?`1`b&&4;U`P3uis&pS5pi|rPMaeAbFQv8xClQXh zg3ZTp@uPk;*ZyTDwU|^jCOX@)a3Tv-h^6Etap?5o-^i_%4Yv$0^)BhdI0MY{I6qc< zzb{RZ{Btk#HC8s)Y_X;&^(R?ybLy`%>K+wUi_6VeYof|>{SA|(4p*7h+30t(eI`q% zp8mMEKhI6T0-=92Jr#MnqH5GhoUHy(b*KKw)`$ElUZ;&=-K<=|xe*ayRSHT&0Hw_w zIly_Ues2=WNXDr-)5sHXZWh=LdxzIMia!eON5Q>n!Tl%K_SavyubbANPq9CX_P@+6 z;Zb{k+ywpv+WW(*?GIJ1b-gru7)3N+nYI=y-BS5UGU{|nabA(0Pjwu)yuW;q6G%P6 z6~UG{aIC{|N!<#6181hk!_wnE`FL0|o9Kg|lD@6I^Z^f2k0+=FPf!o-RQ(P8@_C>Cvb?6+^K;o|C|dlt4M`YQ~4kAGH?e?+{F__r6$MUX?BujCGbc*jIj3{AWBil zd>90`;^E1Mx1t9tAbbDg>Cy1x>CvvUL7nrux&%P9 zf4_Hle0FfWcf5Zve0y+oaCX3l8J?UTygU5I?o&D1KY)B?jf=sShpxA{hzFe;;B4HD z8HZ??8BeKww6bX`1&i|TT&H-Bwi1o&bLz3h1}FJ6!O zX!QD(_p*{;D6WMgoF0(_%!oNz@^LCwZ$oAdydm{^wEb8s%Z1zXpUY#EWfWn_UI#L)a_jIY3E z8{CP!4k9n(7uf^=hNtcrh`OeU_Tm@h>1NZA`2kSNXt%YgIKf(1_uwlKIVL(7JpCkG zxQ4#>$$9hJzn5uQb*BKjcM|C#O4jMFqfjYb#`ihge?jmSB6KSrv|>SUNWKFQ zyx86bV?+?Rk@JpVC|KGLGniSl{|z{;J9%67rgQIrUGUWDZ*MzK!SCSf*WA}H;pkD+aN66m zBA|wFsg~7SSy#c*OLmAuR4ux2W4= zJ@FZ@hlKDkYh;9llp-R_?4;Fil?Hgz^DnvD?&51iZijqn z43SPHy%vLowE@GRlzt74Jvb(J5c#gOvIZpG|qS(^C zCZ-~@LS_p#5${Aq48or>IUb#vbS$*oqPm1-}Q&H{xl6IC}X;cPHlqHNAf$6X}6z$W@!CHgWulCZ!z zd9Bs;^wJq*E%;> zTPt=l6d>ez78+1HQ+b281gAnS6zq-Tkg94fF@US8bP`~EHH~uAe6j25?Y3Z>v&cAe z<%eW36!gWX{Jfnh{m@I5evnyThCtVe|cNYV1WWdHv^y3DH0>Op=U}r&+fyCC_89bs zDchV_>-BDm6Z$}x|EFM=DHklc`QafAa%Ixv2{6y!LGn-M#yFS#Ssfm<3!l1BDRQHX zTa~&enP%-uHwDhj;Hk(VKODo*3lIUVzk$}#;qk%oho|7+^i(!XG%+^{(o}cA-@O5w ztzH{o*PRlAJOCL8xVUTeo%ot6u2=`ozXNs!jWL1&8}ri$Kwo?YLL7Gfg9zq=$Y)O} zmJLcqf}A-F{hz!0-BBHG5t4`~zL0D=qX0qV1M*TLT42#Axv#OmYV;B+v2dw9B=Q#!)Y7Y-r18Hy)EKK^F= zPF+$Q9S+WRTRrvH@xkARyuaO6Up?_h;J4pECj?IGj<>yc!0*Xo6sixWb*I0+f3DlA zCj3ZV+*-F9`5IVFi$pi~`fWt8izt=onDuTGqIK8nI5EvksoOCNwyJnKO%XxCZ;BG!0#Y&lQvt4kiY&Fv?BBEci=4+ zm*0xg%KXCNrKXXrSMnd=v`p9OG9{vn2o9MaPLXwQm*_&=4VoUdw!qfC1O96_)$MHk zDvuGd{fC!gtt4uRNP&=;S`brXw{>TJf798Z_vh;7i)&1L!-O<&xC)|7f?Pq_KizxZ z8T`E0dD-hbS=F`O)}v^hWJnO525h&r$)y`~0|}*!z)S!OIuWpIpL9BAWMDyh5BmT6 z-@P{Y@BdDZG34@9c!2G;{>FKx^gZ|vdFaskKSeE>w71$>)bo-V)n^E_8r($+O{Qy2=bl-iUFRo zXeu{vO#DkfgaMc!O5r6ET3r6LNmONbZsE4YDW4KxDcV<2K23KEQN?14y`Gyj0&ciG z73}XN5QHq=Z<8dlw%-~P*Tke5Jh)yD{t8;Lf)}flwkDhC^}qicwC*ybyU(tZq?;I> zMu^C(QrCo9iE!{6pN*x44t`6F^?QuC`8p|a@~Sq*Q; zv_&R)i$A}e#dz!qA~Fm-+y#RGp~w#})ykB1AwL}Xq0ep$J@Lw2H2B!!{y5`8XF;_- zK6Hs--EZJxhfmGEJS8GRyH-r^!(8q>-j&36B_rCowj#f|WMc$ugUuH|7>~o|u1~(P z`;&61Ve>JU8|oV3$-zHP4))Iu-VWalhG+jgIoNIWo;-QGcebYty)xS3B90#sGyLT2 zU~nb{yTcG=BR@dSlP6LJx?|*CiJgRx?D+(_3=_52a!L3^nDqWj6d`Wi>A~)eRqu&8 z+9x~kFrq3}hVRNLhmGD+h9-cMQ~+R*-SkGFa|T)(2*B5- zs6iZpzx2UZ0B^3q(>uX~pw+*B+I}LTcUpI<6KzJkOOrAOAr1>rz{t2Bd5aNuCXGz! zOC&ewyk1MO^+!P85h*nf0zN~6352&**?Yh$krSQ+eNm3XoO+!Pe? z8p(k^f|PPya((vfWJZrQ*|Z;bLbDTgU-q=)fJwXZXLTE}$zaD~7B?xaMVDx5lzSOg z$d33j781&K;Qq;KT8|!=HA=U8C8H4UKQ%B+woO1H`70 zw(E$^?;M=Fk&HIFfD|dtNq)`6njGWaNnco(Ms}HAPSr1a>Ww zN#L)Amt{-g&%Xo5n8^$dBTRsX7F_rH-JS0CU(UffiLO9LQOBkS&^X%GGK04Y5al0O zQzuUIdcR0K2Z=r79Gw3@^NmXp@`e@e~RkC<0*bOi^Y zA4N){R!%R?>B$yBU$Ut+8ea^|M|n< z?EX#etCJ6>XG6|-gZnKQ`8queO?G59nft#*1Tl6i<5F~h@J1X;d<~v{a<0(rC+E#m z@D*^;_mpmRpE+-U^J(+9e>uN@`pc(w_u1B`-qzFhIoPD1rb4w>=kcGv!hqTi z@q}m)~qF((m`P?YKGHN|k_Ll$!J92-ehHqFQd70UovTC1~aRtXxYecLZ<| z!C!8jN}W8n?Kh{DbK3mrlyZUe8tLQ-cpg>qN0t0hC4W@OA64>4mHbg9UxiAZQ_^5f z^ziyO<65CUI~sHk>4DBD~MJ<>Kzd61Bc^007yB9Mh#MY)GO?;@SK-ml36;;JB8ZoSjwT{>s87(mB}z3J8{?& z++CNsQ*z9Z#`ImtrAd;`GN>7(sOLpha(O^*Rv*{O$j@hICnp3m?BZZ;c4e_VA4(;k zT_YFHVza5`Gxa@N*E3AMD4@0`b3U`?x)I{7I&Uf zjOx^^Qzgu6)h;ja)!$^qpA4p>k^coa-Pp#YQUFLTu$^}SA(`DW-LA6gd4BzGL5;4y zOj)!LczONr?N`0+UaJ20>zA*#AM1aw;^(fY{nr2S-E10PF)N4W=5t+$8;Ki_yr>}grnJ_LyvtF^&Wj_t zq~^8_90tiHVkhd)RQQ%7q^Sd($m|!++5QQC5k>JHQY3|~MkQCq8Ht?)s@50n)a`E3 zov2D)`EUf4z5`i$*1u4%B2NAde7-4f)z~Y4<{8k>dihr2U*H$~a7dHLoe5ixBuq`%qlDyrHd8K;hRY3K=JnbC{0WiG?d^$eH>=Z%oc267l z9Led9YqdSbp^z#l5Lq~C&7<-c8gO|b(WQg<`xS)2)p1FJO6W0 zc%ek$A~t~X^M7yW^{bc3^M8MP=XLM#{J)By^7DV11uAR+N7mk{wwd+0N6ssQX6`<$ zDrkAHH92&%l_n?CcQ0w6_?814o96R)87z=A&D?Mw51PJbr_$8;R_NS{FxX&k1^JQ#l_q_ zviPDbo*y^($l+_i;e2Wy8GKO&PhWgJvicgbx}2m(X3u2-dhISFoA4j}8c(xUa3R^s z9F1nVk~4OwhAz3ZJUAn8H1gdO9Qf|71Dqr5iaZQ9(Fb@+Ty!c*q2xr|QtNg4HmdUG zEWRd79Ws%~UcNVyr9a|(HD!8B*h=N4SB@>LG_X}Q(lUf|caw{yey&6f$AWiuW%oZ^ zgzybW;-}*N$6|qsyPspV-xv}3c&}C~^CdtF|>`7cW+S>%`C*Fk`!TQHPcBW$SGAi%RupO$Emy z$Tw$wGwdyr6+g1~ABMeanEbvW_MX%7X1M$3v$K;&=KjMlceSuY^Z$|5cXl)YIB<48Q{xDqEG=a&GJ6 zvYqs+?3u<0@aVw*_%q*6iTzgt2%3GxJ(U0J(#wHDL|(t{dNXw3AkO%$VosQF;VCF(KxyqMN*;FRGBf0M-Y z3}5jhSy3k?A3Z7vk3ZR;lKo$0GgW40d3CcHid+iUFv!g?L|pT99ADkx1To^f)R>`6 zVjPM1&x}R=lFUWoy)tvfSzuCi9WZ&wB!GEYD=a)%KxN8zW4FqW*fDdGM3xqW_QlQ3 z0J&tehA*8^4>tv_^`+GQ1UcU&Zlk;cL`_jj5#DRQR-4X*s?S48~Ltul|a?I6rD zy<%;wf{vyu&9t;_J(?g!i%i>b=2NpRmT@sbn2K1@9Oc`{)`wTVYllm&Oa73Y^(lvK z*Rmuw$ssvCN{IE7WS`aCG=a<=r|3|bzRr==tQ{Cdsc^iyJW%h*mF?dTDT84yLx8sO z$$UJitn4RO{})$(i|PFKPr3fz@AqE6Na_DCw|8DV>i?_wDbW8fFlLky7!|7inoDjY zzOrqTAG?i;lllumT%67SKZxMMZ2k+K7r64pfjy)WLJ7$n>c6F}iZ)BK|H)wlJp>{R zB%USL^F|wSQNuS^&MhcJYLQ*-Q9{>R!B8Y3f3ko7JU_(?BzFjpWP@@!^fW|$ zye>g@AOT)u!qq zbxO}3O>R%>*x`%<4B4v}&O;pyZCLzpjUah2IA&Y`CZ}M-x<90T$j~K8>?TWQN=yow zA$MvXgh#~QR=9k`?luZACg#yY0lOxQ6hT7KDU!Jl9D4_emUv*vP7oh&?rlbOqkHLf zx95m!w#+>aWyB9JHCPoEA3wZ?f$xF;cM3!1vs++HK(ZTv3D6KKOAy%HxNfWNGlS$p zM$jet@*XmG49@@c+ji%N-~Y1tsVjcD+kXD)zWuk&tFM!<@4x=^_3Z1(*I)dv@BObo z`CrfcuP1){Z>{tBaCrkZK4;00;A8%7pbilX44) zZ~HIeG3ApN-@knQDjrlme7*DfMelp7@tJ)7!w)Zey;uF$udPo`#H(Har$AW0|K;~T z{P4r}tM6a*U&SA`6}zUrYU1#dY}R6YC9Gf8^mWhr@oVbBK<>=RCOz;~i-vY)&A0GX z#cG{~S0TO$0S8yDRKao!#yd&o)$2_H-`tKv)Mhh$Kc(!1Z$B&9b}Yj8m%6l4J8G_w zDQBi!Zs~J|%HfuTTuipl<*pWG#Hx$tIAW3W<;_<#U%`C2@`WkZpICBYiHY^ZS56vI zt2Zt)q`XMTinN@_krDawp-?s?#6nsk022QBI9r-+a^ zJ%0w9Eozg0Q_X7pC^g6~X!$d&th@QMYzqSlAF|V{DPIKWZ@|X26H9}IBupG5xIrCT zZBWeIHa9eaTRF7zI$)GZAmO07YU#7{ElQuA8Kuuok@Ts{A>x1uHeJN|adR>aMwuPS zUQ5f^p8O#2AB00*e2X0NVnz;mu>=lDGYa25y4yCRESq;i50TCUhW;q!fD#2Z+axbp zlK$ukrqNwlHA2jUicWLA-2_IO1F~iF6Gz?Oeits?Bj_SJ|wRkGbZ=S(aT1PX;hp*B?Edtlk(?>KP4_I?uQxtxnU8RAeW)(i}nT=Plb zx6HZBcpqrh*OTT@gtM2_s%ap>(yGsjCwE4y*5Lp7oe_IE=D%BhMm#SzD?cOlmU2cs zmke8LeVs)9^j3OKOdWQmXN94tEObajp?jrg;8h(D#lgzYg<@yrGb~}dnY*1)=(?Da zIO6>1I(En6fLPvL-o=?^5hE*3pqJuonYW2o$I*|>JVA}vddm@M0N%jpc!Hc88vCn> zWNx;<3c#cjGN@Lz%3e%%)CX4CjON~(^~p=;q~hjd)*@t8X~U)hyBYu+llgC<7yD}} z3qMl4tyUtLofD>;Le8aG_s5~{he0y^#$z9*^WvAv&{L3%Lpg9QSym0z*Yg%5=g2~6}Dmm zW$CcFDXM9=PYMGXPWuirXM&c5fZAT$8M^^jB1?`V9AI`F1`J}6^l3zYgC2G{E{jF! zXJd0ujjQebKplOxb{i1j%!(K^m`$Tq_cqx4)6#M6lop@RP?3>8n3EQpOD%y)Y1L0s#Nv>e{zyx`k3A1gTW#YmAt z`iEj2Kt0DvNZAEs6JVKCKF7RtN3~Ol3T{&Qq!Oy!d{&qL&p5?%v(Gj#FulsnSma_) zWLM5mvq-Jw8O=;)YUWNw17&rK){$G431F`tqK4|eo~E4S8<8hll+|cFzYK0eB4fP` zFsvX9kh(#C{pp)UBsNOMnPlS z)|8PlCcNx$%#XVBSoo%lSYiszj(ZD9*RZ-SXVgUWDjVxML2Fm0GA>w+=683`XWA&E z>Sk7rX7vweq4H%BHRH3RYIa4+&b}rHx^Dw7&FHAd)A{X)AGtFH3AC2JCfInl?);CcM82VsVDwFE-TyV#?I<_Kpua z!6k7(jpzOSlIQ(>^}K&rY~HU1zooX_x##=ClIQzF^?duig%>(2%W+Y0Nz2~vEg28} zUL_*t?R9?49cNro&8@a81U1Pd{V(WyI!a>Yz%630H&2tsCi|QlOIYx;M^pLanjWF% z>{emDDm_%5$XS}N;==@Z{6A<2aX3V`D9GHP{4C1&rJ|d@1x-upL}>X-t z51tuC<;3d_K~YFC3rQ0V`U*}JAKF|i@_iV%`u+RvH4eCjGIO%L;Jg5$g;5GIz!vZM{N~*XiXoG(ZhL@*LR`*4vy$MDmalA(qHVg(|^boKa)^I8<#fWJ>O7h|`+)7pjFd*p97!yQ6IvNYXH3Bq34jy6T zzRwXvl|5tJe6dDSaDMEiQec!V)OePK%1@_mnZ^q)lOAi%MVc+`q;XoUT&T^MF+V?H zwj?n5i?%pqLyDi4-GNTtw}A!8IH{hQ71kJm5wOrbW}s(*tJBLjKLT`*93V788JaAKEpSnNGkn3jPl6AZDQTU+-ro6P23!)u3H!2WcSQB?@8w+j{%=M)aJvGHVez zQ&wMy(tp3yE9hB?b}Es-Uyfsc4HC7vXzMq^O!GoLu~Y2J4eeZYw$AzOH@UDdhZBjt zph0J^u|a3A+@RwqQk^FdR+G87VgE3dBq{^GRv%LK7;!YShcXp>(d!6I){(~vuJkSF z(lEwmT3Y$limZM%^&$p`BSpTIVI%^^!&&<%Wf+e@8WMc7O}Y)MBd8XNczg`&UHy?* zFIYX6F7v(_qkdn|a^4Fqr-9tR78A68<6;8r2t1=df}A~CK$*~6qSvR-iuPztd$Zd( zr_jKf<+NUJeJx zmuDAOz-oOkQ@(z(_>*7X{d9VHetLB}7@og9N#3N&e;ZgRxNV}flj!C&xcv=Q#t+SO zGd=U9WI8%Gs`htl#m}UHMDa5pcIaf5Bn_D-Pc&t2vQu8ALu3PQ(`+5TqKDE35`PtM z=g(wYMqiJY);2;;CkS11zId`>m7;febaHZeIvA{VPHCA{K5XA=n!GoalQ%}W$CW5E z3~5~vLtpR>p9KYh`7DkN4xag4ErdI*#J3V;L^%4mzLw_O3UvqYlm~#BP4tOPly9x0ZWWG zhbcr1&JPsMaBatM#j1G%`xZQN!7~bW|MB-e_y{O+!5IlJ^ubU?an@et9~0 z_xkFvwe7^j1GY`EhXMv{Tg27T#^;8_+jXsAP+t$dbP@F+@!Hi$!AH~@yI0pCY?pa-O>gYr-7KD zs|i7L5_)cvp7P%qi99V2-=Y9f`m{Dla?N4h9q`p}fVl}eLl6s7bhfvJNIKh99Zlzn zi$pi?!F!Fz_u#$Q9R``%Hq-*NO(MsJu1gNNSm?g5k+HW6X;?ZWayn5+SX!H;v6Xd} z(i78-osVr-t#`by*UoKf7PBYwtPf>VAzthuLXc8UA7P1_WL<}f1B^KxI^iuM4?{n6 z(NM*1zgOy?#-%Ds5ri&kmxs9t#Y$AcO?54iDhEG3c3v*?+`l(u9TMFD$BQXL1WXY0 z*rffw(INirFQWCsLFYS0V)X5T=Xn-`wfrw@jA+(h&VVrsE6w#(&P!?RIEd0|yfoKW z{;OG8bFRB;-dttTD zS%1*IJUz~#k9N{O&6`X4K9e>k7n;f+kNCHz>eJ2{tq!8q{g(wXKADwBtXBdj_Os6S z;&MfJhe#Hw^1#onmTpk9K2(eg#f81l*K>N#ryl-<+D5L(UVL5OpTV zhXjo=W#pmJ+~g;h>XRk!(Ol>AZPr1ilP_@BN-RC`ZJXTgSl=zNwO@GodT+dxZ;FPt zFk^4rW=u${yBxFTYiZTnsuXiZu$kpy9~-7PCyLY9wWL|ciQF_dP)TS86&!~N#UTX_RH*{L`#e?$(r+@N<>N1_#bUL&s|>V zD69FhLrWT2U{)RflM4-eB1=}6G=yRo9m6DaRe}ChBn-(Hf_z%ng(^~pG)xteom&#s zOd<8`m?DuXWHncXa_e8}WSM~wjYFW|5}Ki#+_z8gYQtxDSHRdNxtgl$4cyNYxh}}@ z7*5S9Zd&W>T*s-D#&18NGbtq5bBSC-Cp~!@9a(x_$!A~miKSQBcFYx>!HMV+c?eP@0(ix%w)uhd z2ip+|uaSL?16KrSAW9EsLWJx_xF}T!M`jcsF@hbszyPX;vd*FFVur&2dgkhi?v;0Z zXZnek3`F9fokkSTeSP=x^yK2`{N!l(%jxSk!^_jxr$>YARZy$AJfO+NsdA_nIP8;7 z@<;tr*{do4G~%Q!B%42C($YGc5scZS!==JhDKETQNExWG-zcoibxQxF!{6U=LH1It z2qt0Rqo6F-r!bvs^ZTWWD(2kdPdJ zs|f;nGT>HbIRV?xXd7S(f)IFNFh&H>IEq5TkPH3@u0jAE2Sp6938sKxdb0ya8~`>! zAdbcax(L8A!~x*yQ84C;l9=luC%N~31QwramG4H~a;?^TbV8ogtwfNxjCO^6L>cs> zVnQ96j3)VlB2Reuig|hT=CPJInqyXa%QqEK^W+vgDoc)K0V|GN$k2ch$k6z~v@ED> zGfCG3MILq_wLlM8@D^f^i$|Bn({{6v@Jx;y7)7)z65ZV3z_oyt*|BN(wSk+O@P-EX zn(;nxQ~5{sC=3rJ8n1W`EDv5Ik2W3lwQgNMa66@eYRr7LR9J+6I)V9+Ig{6oacxlC zMd-@!2I+VWuy0PM!FZYGQ*WN={Z$b*FJC9&_IXT}eUxnjtSEHf2vZzaA}&G?I}aAH zE+B!Phde7oBMq=Ay2XxIqYJ(ib+HYZDiykz=89SJ6!KgV$7#O#%LsBhrNAHvnE+;v zL5?yXm-_8y$_z6>&JB(IwA<$TV>5rZ1{uEk};S zb<-I+O!liOBMD3WMeKP4={&Ox8$}ks8F#nwMO$8y$`qTOg$(m`&!<7`%sbF5gWPIe zc8=SX4Z3Gx6nf$KVGt1n-QzHzj6f`XinDCEtD1hM$t|IajN@*WQO}J}n{cSnh!e=e zjH4W-pG_GcA~+P=%Y&3kvM)Vp^3C`W zq#>CeVX3T_V0--`vgpq>g~;Y7ZDoVt*|1+<9Ww!@WF1a)Ui^ldZ$8qI4_+V0NNI;3 zb2U^@VMSISmO-7SKNI6uDZXsjudh2%hnWn0oGgZ-y+=mTUX$4L#wKdI)Kcck^0Ef2 zRa0{vBiO$nXoT;9)hHUQNqF0eVp~ci&?jR5Yq=;wfr|nMquNB7nRa#A56yb6Q6?TG>^Zsnp%0!FPeY|mh!`23AR@9YR~#G(WUh!429{Mdmu=)n z?4kIf3gtj_S&NgoG=VY{v{1h_kS~wTZPN+d-G4!2KV{_^U{Pk7YgM zio2)D@Rr%QTr10TS744cFzG>-0Z@5gQ(0#NY(=5l7&fDAg$8SMHW#WEhNiTqW#K7c zcqZtK_RSJB19DX*ttg4~ms;9xv(CdiFF9E{J#L6|%~ zy+=;0Y^BozGPT|4SM-pL%gnrJG^_LjWuqQEVP8x3(qoR`XIe)Zj@ZoW7!fo=WSI+j zhwykJu40?}>Bgnp| zGvLg>XFM+!;>uHdT%HvMCS5K~#;darJ`qu`c!#szFudM-Fww2E`cRwF3o^MdmK8d9 z3k6jZkFU?W&atxhFp4@i@iig=Vu*Hd*ySB8tGHcR|2Uuw1`aB@F;mvu3H>MxP{5W3 zQ+qmfN}L%POYW^dO~m;&Ow}fn`@5deN<;?E7YW9Trq&A#2#d zY*Sp`@e|!Tt37#&{+B0o1nDcAYpvYAzN9=Q9>>i&x|+~T&D~4W9nF?tsJ%IhOU~k1 zcg#f&$CZI;mD^{LQ+-ir>m%H%dCTV|A1Kb>99ci-i(jkk5X~3$z2k+kJ5(=*qCEGI ziy`mZWr9eHI>Y{cv*3gJ6&)Do_bdSCWf=+3(u9;UX-f=Ip)}XZF!IBvDx5S6Kzkz6 ziFtXc!r`8=M>TVqtlJ`$$JY*M-I|Fmvp&R%H7Vev&d;naWlc9_`tW{mgYJYaGjA}o z?j|UB7f{GB9bqovW$lQ`x7)4Tj`}0blAkp)W^ITi9k*^fg{K8$V{Wl4v+2#3PqyK9 z)VN*ZeK)~ERE9yt%b&^yY$_kG@9>%r^MBj?p72joNmt)mq1~Zc|8dx1k+*~~dc9un z#onIyZ?D(O{Tj3z|SZ^1Ty3T&Ph}<8cqTh_^w;SL62e=v)AExjDvCKiok%%n@?#-MfL6L z0)I7GD5is>!E0sS0IMm_Ylt{XN-5a?X1{OzeE7V{edBc;el2964+bu1!6e==i{Nru zTj9roe35nGBrEB*h_2$BRZdR_NN=}b$MG-<*c*8NQ#=|WGQfW!EfA^yZ1-QheED*> z|3c?3Z7^lo>(Gby!)wv6(A2otRX1X#WRyVrXN+QW!lg@*l=T*RZ)hIe{a$YdNJWoB zmv=eDs?VWMC8#ySHH0-Y%?m^Z6G+?wf_r=4@4uV{zY^*kdWRAJhX@=2jR2TFhX@je zW%OVk=G_^<^}_Kmi2Y&OorJK^eLX}is4t@OZ(czmQEPx^S#%DM(bI4Qm0nacLN#b( z2DYcg4|}NWYGT4wPH&O45*ryA=bD-7Z-{t@L&kfwD#lsKbnZnv_bQCAv+!J0XG11> zv&sfoc$4jddoZ)p>Wk{+$9fu5G0cNDWp=gd6t8c8S%Nf*jqmc)F+Tn4RKv7)XO ztRhzw%w_OeF5YL93Tp(vWhLfG#Fa`JX!WkCm?D+$t>OKXY(g{se-()~U`gt-GRf1h ziN(Scp+1z5cM=gopsi(!eh>e!WiD@m6Fms@79ls)Fa) z$*^DRBxrE|hp#*wqXC1Ac67gP=KfD!l*tTlRd@vSA)?w2F;^js51-m$p*6b8q{79| zh`qf<<0FfB`A#{6i= z;>bh8`rG4bv7FG4pi`2|W7>zjIYYE83y7Gqm36Ep){3eM3T1N%Z^S`pOsR9Vo4&p- zzU|LW&B729-Yluab?bUHmxHGf$ExXgG3|$TnBmiDsP{Czww~*I6%x4~Llr()!@B+w zQdJaU0!}gSRC}F6F_-cwFZk{Yqwv6Uo_>v^+`DvJ#aYxEkAH9 z$_Ng|N&HY6sKqy{xD1&;j%1vVn;^QKy;om)7RdwEoNwkdaxoe17F+Z)%9iM5W`Yx4 z&&JtIp130MV`_+!fr$E$sWp;D1~1DXiv8S@?-z(-uh^nM6#MfL#okJeJF9yON!P>I zNlm4$3mNQ|V9Qz=Cp03Q*CE>!a_#4i!+iLjk$Qhh%lWS?mBee$?2j|U_{tCXIb<$N zpR=<8G`qN!9@(oRv#PM*bs{b^ zhhAirvoY0Q&oXE4f~|L*=N`M+LaYD2!NDtn&`%Ext!ZUT1cJKC;~^_+u}Iy%{pT;f zf7$z?znj`dW?5Mu2iTAO1Zx5j+kWhgz;<&Bc9rqEWU3VZh05&MAHm2Aq4;O7)7#HH zm>DTP4oWZswu{qE4ChNE%Bwi2@-?k0G`YstB$qTvM``L^aUg4`BrDvarE1yBM^ej@ z;u=1Tet$;){ft_vs%D9RsS$J#`0$Af*kU>h*^OUjlrq2gwqKB%Tj9+d^r;h3%|LRB zK5mk`5Pse+X1eWKH=uRk0{h~5l zwS_Y^*t6}PuV4$8-`p`g|Cl$61BSf;LlNiHy=;iwN5${-?A70W`QQAQGu(`kOU)I# zbi2y*i)raq>lwA5xgEY+Q{=XA9*-hD4-tudybg&RvqU{;gD>N*N=m;+u8#x$=NCq| z%e(L*wzb4i(Ic$UVP%ObJ3~%MkmK2;rPVl$4Pd9NnYpTwOf0o)bR(Z-f^k;D(Y_3v@nQ` z(Plo3GF+71uJ**V%S6YBg#SSf!(q^D#B`jFMEXV2LCLtRY|OkJAqAl$aWo~%dN*;*m zJ;_*FIsdebo>-YC5{HZ2IQkVmT!j~qP0Ba`M^#;N&IOmb(Hds9T-`e6_U2mFQjYo6 zFJ#l0&x*JwjrKyoQ-AJ&r$wUN8=KiG(S3eRSNv7P{neCrOp?b`r6UhPD zUIUoFTwPr>hjPML^awx>oC)&bB^qPO$U}2*Y392cz?<$wwp7=s3|>=a^UI50<=-*M z*NJl0?vg6FGMo;HZc16?m*&p6dObKsgmL}xO-$L(nTq{>HD4^+1eeDclcVv6$2#GC zHNl0PcRysDcMg)~&uoLK{<~s;xy9EDkFWz70?+;gqBsHy9OUkZ&~o0%D2xLaU|F%B zd9=evr@-eLZmZ^AWn((z{VkCSvzJnnzfOZ&Ov1oNfk~Cu)l^w-tzH^sHrI42>^?Kz z&b^FoGAJm}>2*5gOlIC`N#jgyDD&jUKz-nz@Ui>N^ zwh!dLFOCKS{qMoi;Pvp$>G3Z|=VyaAZK265Qg%mKrT}Ev<6%2Sw=)RuKT5 zrmwZR;y^;rLu8q;&h_;98Ew%8c8H{Vy)j;qu(paz&M@^WdbkufOlM>T1O0VP+R9RH zpiK^QPBqH|mY81PIt${w@MYP~{E+^P*c;?bV1TJV724JDwJaFx;BDwn&XRmRXzu!b zL%uUOzC3zk4}LkaclTecD7fALa%Jc**=3K<(~2jM$x0SFiLxE7*CKn9R<&wsjyL0Z zlDs5#OcAlNtS>u81S!1>iMwR$s^LOS|M?1gD0lz$vFk^tNb8Dt#V%q_H)C|3$z6Pj zJjn2^nq|>dyqbIDl>n?7&4u#msmFEE4VbKq?9qo2Um;tBsTGEiF6ENvH|SwS-V_a< zaJ-3|IJ^N#GHj(-ovu^m0ysh&-osi?WD*MrU(EhfvUW)LfM^vsgbWsw|3EKSPG zJepqLO)xG}Z82dB6t(bIg!nmyq1CNGk$DiCnXDL!ZlZnut;|^6|NGS zf5CX}A`~5mk#r+T`*B-SPYPVefjY(F+~S3lM?KmVgLI$Kt^+#`VOBESin0apaVhoG zxDK?P)Ur+m1S{GhGFJQe=!xu&4Z$orzL@dc0MrxC>3vE#KO@E$q8ZKL>Ztw#IV~+0 z{_>dT+%z}6?-G<&RBvOTh0EN2t6ksotY>4cHGbS>Y$UD-L8OIq9AZVNomVP(j9s)5 zSf=jRioKc(dRgshvqDDmB}hEx|&P6x6= zVK4NV-`J}$GUtLAkHdh59=duxc=T9N@maNbC&^MPzq1_3xprdfvG_L6KDj{;*#|hF z$cYIW+~DZSqrV}7M-RHgc4469Ev?t#c+17Bmef#B>1v)x#@TkG2v0q_IJ-!0$68%K zV1jRU#Y-4rgD8vuL6*gS*87qwD!CCP7PRhAn7VvR(4R3T=vY(?I*Qq3^@zw#EJH@Q zsiitlqq*g}&d_5?&(ccSu;-QFVkXv+{A&$q{belmLGuz2qAEDj`%{B@JSs_+x!v-r zZm#Emzu5sT56h&hUI(eer$EXLBgysQRnIvvEd!|j%7nyLUD&p0k;^ZkjPW-{h6qeE z`61G*6IQPy{%1W-#s~%e$|?H^9E&;1FG)(!?1n}8hPZk?DBTlcLX!1V+=`w*;kbso zS*r0FX*un^oGhE~}I|@W{ha|SIfSKJK}PA`PKcDpPRra zZm+NH8%&?~)Go08FOU6aEI*p9)UIItK{39$ zWd-Ac+GGfC%QRPIFSE|3a<(X>-b$+@E=2~PO)1Un6mx=QMu!AEiwhzsV7mORkJu!1 zEnrO;i-y;bV#lhuE(iT)sYvSyDLeifF?@Z!JTY!np}eUR6Q5Vi$hah%*GS6LgvHf; zPQ=X)h}m_0Pf<~N=eJCepRUHwL|4h6i_ul1>=rAatM4o6YU;$q=k;{eJY8Ng+!vAT zu7XuR0UJsbeZ>ZpD5|B%D0)oONpsG)v7FRcP8zTA#%8jynQ-PGEwfBsO~RR{VJ|69 z#I-S-JgV8`GhzK3tI2Y$CRNM6F`6t7$GL23Gg?jf`TIqhOB$GRV>aoW(ZSK+bv4I; zA}XaQgw14k;Tm?0X51(%)Cx4?9~QH?{7^9?nXhks1{bjbJ|~OI`bcxS>1GOP_Ir;+ zoBiHmW}AMmmOASWWzphESZx#}D?cipfYm0)G`>2+&8%ek2} zoQ)M{4Tr(TlC!bod`YLk#+0*MQ%;UusH;SNR&>1C+$CD>U80*Oc$Y{VMEu+=y-XzD zE_9P9-@imcsfy>({8`N#ArH77P0PTsrqv=^R6qfuD|J4ppBV;Wto+#6Savs--7oTt z*qC^iYvQe9Af;)e>MRHwTkkx~ijpU2?9GV*38)}X3=v7g@;&ohOnuZR7;k{12K&e@+v?YyUk%HrmLfU3CU zB^q^(=pc-VgPQ4w>k-{%E?~RV%8p##&Xu-O(m4^esFqzQDqV{+`Wy7H`;?YKNYP26 zZ!Hf}k_v>Gy(Cf8ZWkZRO7BaRjxi$09k7tVF*+v5MFGRmqn#sq8r=Q{Gf@+aRx|UK ztPHm*yGP2}_EyTadGm6%ttV(XUKqPWDp59sj)N#23gXU->2-{K0_l;9;b>`yPfqCyZ+~X#2WjJm&WP**AjSA! zAU)#beGCIguqY^;-%e?vCb>P@rQYjDri;Pp@#X2&O6j6(b+UAkQ$e%KrFlS;ow|aR zdMXQb^#8uQJRJ^xIl4SOdF174prJR`I1+@dNL;I;ftBmt#%a|kUE)fP0X#PxoStXS;%Ideq=^J8c7zb=NB&d(dQSf~R1+%C=1>|N2TAey0 z_s20ulYRu92^!$P)?uJBaMviq#cHVJeU?fbj({P>f1&p?kw$ovr-vUh^dQ)ENt1rT zV$=$6*6RRi%B{r|R!obt8Aw|WLGG$T2@HMR=ZARCj?)$ntNc(q`cP{YaoEJVP^4Kg zX+C<%-EkExI36p02TyP_}lDpsK} zdr;EzT>Rm0pWjatQI{b<;v9>1oiGTH!$M;Iv-1FbZ_Y7#ymOR(eUrZS!f9owgR(^7y$?wC5?sr?Sv4aAN zT);xWCI}owe6NB*IAV8@An+=T16N#Z0ozA|S8WgnE+QZd5C{qILxQ%r>__l*%t8V@ z*&Tpmf{>2_Mmqou5E6Z#zr8v;J_RG}A>d*vKSD0J!)&s}CYXY|klcV#NC0$Q%m;-Y zz`-aaz661wF(fYE#ZDMK5ImkR5Z(od&DKh#+_YR5}zyaXGorhuIAU&a^_YM$) z^B%%$E++#hCIG?_Fq#3#wzdEO6UL&0Zujo)t^);>osf*XdQ#ojXUC`KgHxMBy7eyb z5T!tchPmMS0l+Boumi6>1Uz`hmr1OKSYjLiuEyhFyaT9O<1KS7QUqzBFwHDh7yuXm z>u3PZ1{V0~XmB>z+4|?%)h}<~U4efdU0xoYU!9!}z}ri3{Pz6h?CR|8`2f6q1&+@D z1%5p{KiL5Yvk4*q-A9DO9uj~#>X6&n(xjpX=d{58rV(=R2s^-o!8nFv1jgYlk_<1)Cg_D0r_ zpaVVvKc?)JI!6Tv02KN?=U%e&jg0n_kzlHmQ0_)5fZwc83f-kY9p zik07znezjclQFR5Gj)WEM*vvqC)pQ3xXl@51V#ffRo>t~Ar64GV`brQ8{dd0B62s| z8!$sy6HJO;Y<)k;W*)VZRvf2VE@^kJ!_YH3b6{}ePWn&X%o2@bt zZWMc-w4HUhJTpJAZ3D3M-}+zjzwIr(a_F8B_*>}3KFU*{`R)zZ;>#PH2Db*GS8R}^ zrTWqdeV=c;Y=>OdOo<&*uWp_xrR&ZPfwE{OPjnmxq!SBRwqv!;uSBr-;ArsrIMtB! zl5sKCMn8hHSA)ZE555HiK^NGBGqdy4GaZC}R-S2=cplG*$tmxvf^`ZR5f&Gkr z`jNBLkgz4d`lAK5L3TxaSyg*ydDCzDESu_`2Ba#szB4>A^5`@9A6&2 zu?N2#*}MBM{;dN)&cAYQhFB>w@Vz`Np<|Le!jr`kYf&bjRX0wp&EKf;-JI#aLJz6 z2b+FUG6H9I^0N%POZi3SaS10=8f@oQG^y@S!;*QNo)*eEVx9|P%TGTLwv0n2caX}5 z@_wfV9mZ_Z;oG&7oJ(7p`?pJ>R}8)sCFqf z7A@a0+lFpsg*i*zV9t&qG9A}Q!9^yaUR4N-09dIcR~SvPT`OV0=_|dIR=TP=DOBRW zfih9M4!Jcb0T)B42>q=fs}M!W@n<@R4LL3O1i z+=r131J}+WeU>rm?Z3OvU-bJq`|s}V^ZkwecOAct{dZ&k{aWq6(j+T`%2JE0)R|JF zkT~A9wLvpEzFWr8&Do{WwbaSIrL1gX1S}U=H3Z@m0uxB(Q{JA_oFW6+4ac^S%64P} z1TX^=L=eCMWeB>w(*PkCxuDvXE#Rs$WEX)>WDP}SDrniT0il2)5)n+1t=d?i1AzGO z8*q(AAwkLZcP20xBf29u${nO)=ZMpouNYKQH~Gh2HLW=~fTilvxtK z_6)E)>>#<+kOC;VAtamwb8J9x9gjJZIITn>W%fACQdXyeln+aYSn0sVx>~9gu#yEf zXOZwj^J#m_v?)88owHS$G`FCFR4ZFq#rW$FbQ>G18Ca-f5lx?+>CEvG}~U%R9w5E_)ea(rFfIVrYf+6bX(=X z)jNxSp*6MS8?CX)bT;QI6urG=1TW3F2aomWb=xqz-wu~QNPc^FzXKWskEiyhR|K=DeHRX_tlV_?Oc+ zN0+BRpAD`q|CK;_*eU^iQ3qJ*h#Ci(5%t4GM@%9|k51m4ogZDCt#*RN;Z`%dE{q~= zp>lVo-N2ET~dn3E!S6!5RhEhkU=Jh zh&&!#5Yvryt}dE%l|0fP+FHO#GT<7hd`6qa)D*jKr~TuR1TI~F`K~znVZNbEevtH} z(5{t1+1PB z+;e$6NLn{Qn{Atx(YU0hWNj+OtlXu_=_Ep?-h?i)KyPoiXTCJI@pfi~)O0H5GtlwF@~yzK3t?fo<61FPc##nnnlv-qx>FXV)xnb|}( zx8>UTMRxcvl5xy4#d;1>ShHob66pFkIJ!8i;~=8VvKfcybi*%7_{HK|P2d(r_>0_R zvrVpkd+EMbu(48Wd)8hn{Rd^v7QGG~Luog9F|CivEI%+J(t(LIjkB6@Y(@QP0J%)+ zRr`%-k$l4cQ!;TQVq9By5~;W3z)M+B!OoS7D4#L1Gwnmath9ACjET(mm_|by>UrUM zMA0>30#ywEvI-+qgppN5Usc+SGaev=wD>FRi&(aT!&5xpl5uDub)biXu~oo{@p4P- z7U7pZmRSq(jm@_LTt*;6LLgnr)w#~j*U%ZCb$SZFwUnNt&h&@kk zr;_IR7OM9Fa$xCHv-RWi#u#N-u^(xt6zD(H#eP$1iblxA&L2|4AP z$niZysy2o3a!dPN@hIcHR#v>Cp}5SMWIS&kmYI(pZRhWotzyuM_{$0xi2`X=&d#}J zm1lT*W)tMx(Ac-NC~FI!Tvz)Vw@uI0N1(D8e*|;_clTe=*az*x0ti@BtV{uSs%QSB zq^AYE^G%(Cl@7=J%rd_Gxt;kZ2Gv!~Jn<$zZVYKj{3i;yh8l%5&J|r6mW!(O}ga6CC} zQQZN!?Qh-Sz&!vLp}XZH23^SD!4?1k^w9yZj9YD`?h5eflbz$+min4T&_M@WiPzdw z=UhJqAHkn-$dpII6V|T-<(uGCoDRyz>Ui36W=2Wy`2{#|QNX}niE9I<`s#r+R8NrS zcj%-$3Bw!f0C2dAFKicih#@-)J?uPK2kMT2E#B$)m~)^kQte$R>;(f})UO778!?L3w8kjx&8Ji_C%g(+1s`5|NvMVIPGtOI}$0-JX^F zbq(nx`NMXSe|}6nCUL;92S{`S99dOJaCh*B;X<-)ohYdZ$@e;?t+ZFN-S)NL(vG*b+^ z-vL2Fd|eS_F%k0}Lne_qfw%GstEVZ3D-oE9Y>e_+Di{BO690F=9RiTj*cUUP;;Nmb zYAP;%`iL(yq#%NXaU!6I$xE^Z0|wWK|G(<9sScAyxf`rJQE&=UlMNZy4w$|B+qeavCLY)Lf|6C59R=wi5&PlDaXkYt~5)clQ8yN z;3Db}e9e1_up{_Z7&Cwf5s^9iN1_|mBKe^8A-}sml?^aPOhBS{7LXaB%)SM5hpp{& z5aA*E2n0!&jAPQT*w(FWnSN81&HV`A-3|EmgG?^b>VNvy{KDAU_22DgzvGJqtkwqs zf(8ETkpEGD%>rueGRgDAFjj&CIZF|>?1o4t^6(*ZCfSsG=pHlBHy({}9-h{RbUL3n zOsx+kJnT~wppxc*;=i~e;m!`%!X}&~@a$mAwDYMAOBrNn6nhl0G(^qlsK2{025o+i z`K!18B$@K;TMTU--n8WWZ@vBfy#IH1cW-xN|5?XxeW$DYlc6vLIDKz>RDp zX(_#Yl@MLBEgKqaW?F6Mhc1hl&4!q!U7mz2O{!F#gC`xmT^e>fEmYSWRw1r@o72|T7QS3D7Q3z*i@iuWmVD1m>ahs%8)e!%G4Zks$)DI^q%S0aPoK1ulT&q*0u%Dq zt-QvOJ4~{n9L7h+Kl%Q+kUi))^5iGAn#?4 zfl*UKaJMFgd~4%G_>7zgd>Zctrmb*S*-^*wAf>#klD#Y1bbL%mNIGxCe+GiD9qZ3?Bg*sz*byD(NwL^gCGOyoQ)dK4 ze+R(omvjp04ej{wzT$n3+a|?eJ5*JJ6?#|Bw2^94CF5n7-Lm_G9)4BjmLLk@v)t7~ig#x>puH{_pe<(a@9r!?P z&I)|m|4_Iw+K-?|OFp0vfzuJBsm?1Z1O0EI$ln?UuE6Pj-Ip}^bSixL)1P`BMqallQ5V_FB9?>|*&eW!0GBTnpp_CF1qaovFCwnd8kAMs+=K5QaBn>#B6>LOIK@FVoGl8Eh{){6H+zxH#Poeu85!PZ_53z=PzHr z$mRcex!>F5|5?j#6aTY`|JlUzUI44pJfok>XJ6h>nyDz zcfF;`Y5UWs4!w2wq_-E;Wy%w1s#v$&{%*Hr0!*&%w6(&cRGcqWB(0bKl6V$$Zv?g| z2Ww-guwMS__h0t&_y3>2eBRs0f9v>dd;>1kjbqhDX6c~%uCcfk>Vz)Je8ndLY$r)cUos^BaL7MAZ2eDu z$g@$lZ_YV`FtGnZBm~>IgE|@-FoM`aZd*d7FF^+(%k@YQ=l-tf)`$1lk9`ot{xv^< zM;bdj$?a<0I~+rt4S`TW6AARd4iM;xFc8%Xu*VGa$^$6WB7xTScG?{Dxwx!RW#v9V z9!0rF-+)WRViM$#B;p4R=!+xsZ&J`R?=zQ-RhUeAVWY)&!A@F5O5dnRD@Y|IU0(}Q z&B>XBf)@$-0};tB#2_Y{OukTkqCd-PKv|iHab2CI#KB?P_CJzw^+$kt)XHxoun)cs zBNR~T0XlR%%$bROiwGV)3?(Lq;<`MrBf>FSjEk(OKqY_n@sSXEK72@ms6^N$^JrH( zhegFCRpLsyiKj*H**EB+X^(v6ZqS4IwepN)7`H4<1|w|8gdayO@afaHTP095UaJx% zX!=^|kK|evam`1oxa5<_5lW{^OPsaR0%C=ss|G&+vK}jpaCV~#aYO`99vp&gFv5hg z<}g9`77>Oia=DB{K|W?~QIcE_QLdaUH9k}PiKLY3yltt}lixOqWK=Tib}8v(t7uK5 zp>|me^zN>`Yv0={w}uFz<=dw|5V`^VNzi~USvVIJPMh9_9G@0Bay9lz5g`X?ZXQ@Z zn+?sak><*S|C4o3j@Vqg!e?KcC3n7Gz5Tc3R^uGyAg1{L_xZnb_TS#~{>J{hj^D=q zyRrXn?7vg(zcXI%mW3mlmx2%x1xexPn$p-(g)>^uS{!@E(1pfU=E{>|V_)9bm!DQB z!&2){%u#+K*_2A+&5dmE7V)N$>@U7bFL8jJlx~h{)X7hkfU=9mvNWJff{iJF>G?9k z$a4V=!5soRa9c^M{BRM8JQW&%i>@&YQp(E5Z^8ZHu-^l+}^1qA6 zO7DXF9cp^R%_h8I$kK7lX(ovRPYGFosUV}5Y z5Whg3g^l<=U3`D4!h2~lwIsF6PnU0hJ-r+lLZHg1)+A8AHe$GAW?YgR>qHuvKLSRu zKZr*od=IRS)vOepRhY!Z+mn38DFOT|68ZT$7gRGJc3Tb$ZI4;cDl7y(=>y`QcE;xb9f?Dtn(a^6- zt(2RRxfUA)+x$B7+)zFw|Uz>4)zWXeKW5XFIkzF{p(rtm(u?~txi5`?T>3Xl3I zKf@wxm_S-W26=fk=g6)td@>(Z%1&pYO1ao_j1(O*eDWG0jW~Cf+9btoxWvjJ3tF6> zmci(;4Hlc*wm0H1aHn7!L zz3QP~h7oKEex}>R$~spTtwzvqj5f0xZJOx+V&}~f_pg7`;{RXn?&kFW{_~fc`k!n0 zZS?<*{{NNh|4rimr$z8D-CWQ-XJCOx&!0VTV=UMN+sohTbl!WkwbA@Gn%~pX{7O|n z=y)>qeBx8*f6c7S$p+7}F8J&Om8Hz)QjSbiQqveZp3MP~91%5YU(r;9R{gQ8jMZ=? z+1N$YA^5s^bB^3XU+DBQkC@VWH7aP?F|qm__Mh9eZ!rvs zgCqKmB60v;?C(F{PapnF!Z=Ewem)wgj{}Cht{XZxh}h7JaDZ&C6WSt0{D1yD5OM{} z>6+koU?nB)tsP+5js^a$8bLCq2Ni0hivLvEo!A62aEG`ke*X4KMuEZrgb^3^h1jM~ zf?^?AWD4azydPqQWEu3se$RL%lHc36{&Qg4BZxg<+cK$>(1i70wh!-Zt}Uy_%g=^y za*}L%`Yz{%w;0`lkKjLlf{p<^dx+3sYg^8Nenyk92}oF~T0)Ug*;KagCj9*U{ddsH zET2kb`uD$sZL1|JEsFZEoG6B>+9vq;5t#3+wonq?Y{C32QM9(VL2ew-2N~`E3&(d( zx79)14N+Vk&;9vfsxw1mdBHX%*_W1)IU5tT?U38C9wE+pn*KLJ&V%D2o9pz^3^gCj z-_-nHFZc5Pzr7cm`VVXQZS=pVsQ+#Je@`L)cSX9AVyREI$d{=I846OhezbAaJ#Jj@ z;Pmphv*Xj!u-ImS=e-&~V1*Cx!w2BU<@R#M_hKN3;Aa9Ibb$yC-GMC54t8^4y?O89 zJ*x5_nxFvtme0(^w{wD^3O(F|?kyzUWLI`0f(9&%ItEYxcof*4tn{qje`jh~T!ynp znfJeh;mv@PJ#rhge1!u{C&=Ae`)otX1en$H)h()LtXnjhv)MM8wW8NWJv!-*D9Ej* zp3ggx;on(gJRNUNlc`8gbh=aJ-{+b!72VI7J^v9f5(f_0?+LS@O&PWGhyXgL+ndlu z2cQ?ee7T=tjgKw6ZhnjZrs#hmbg!Yu1aUcaFK?LObse_qQ^=zjn# zK?9U>(&9QG0L#z<0a%tE2*6S_K>+5{1p(NaNf{LFm!S{>u((PHz|xe$lzJ9X3jvs- z7y>X`X=u(A6OUm{5y00WbbnHu)B>4=&ugm$nCIqSkB3g>zCCgrF8oO$sT3u)M&L$o zUC_NZcYJ6u9`NYmjH|e(mxr7W(t~dICcZ`_Kn&5O2n)S+ieDg}(m=apZw@CF4X zUmYJEpI%-a7C$J|Z!z66(a^(`9a>iTdxFGSKo1R@L^j|}zAwgB0;}~wzx`wZ+hf4$ zTcEsPp!9SkojGEwgKGrD;lw5|0R2MEz*=XDIR_Yw(P3+wpB12$3}S=6iN%nM2+))0 zXl+yUC+LBe__kf%uez99`i`GCn4gv{v)_z+EH|BtwPu8N#ysQX>)>F_Pxjw?|L))j6uVP& z+rklOslTjh_ha6xCQJ=?*z-7%kvNb=Feyv=D*J$o3FhexRLLTIi`m20)*Q7Y>+49a zugc&PsW7;L`hxjA8Hr60oab;dt{{g;`QX#f&m)jx+8I`)kEHPETu5~=ycL;PDH zzo%{+F3T~UpA)%;j<~v(2;ZHX?}bK~%=R+$&`&sUaWMX@rbs!YahLa=u#t zq|c;c8@%&|a z+j#zF@%+v1_gjY7ue5!w|F7Wn1Iuyyt_pYmd^!zZ|L34TStdjFqz6_N1%!N!59#m-a=VoLs(mwS8rIse~Y zf0O@ZJ-h zY*B-SF3WQLC05V;!mVJ9?LVul|M_CCU#S1N|NP~~{kv z+H0}`t-ao8;Y@h4iHtWUnT<(iev{0>#vrpX$b4o7nasWumo&miFhoU|pQFxQSLa3P z(|7)9Vhg= z@}IVY?U-SYc2`q!RhLUmpBVrA<@D(F)i3`#Y;89aq!l|eC_0P~feg8w^jU}AIvrJg zvEzjf^bUUL{m|>$-3fvon>@60`V(j=IKY1$g56%P=4Ns_3TI@TiK{+$#6@JTdS$}GM+OQ}fDB@7SFb@Vrf2+Ws>X;vAy5g_k zf2J^y$7D{m8>T&Ox50<43~=9o%Qz6{fZ8QHg7H&$D^DB&yc4=8_Z3&~4icxVfpQ#n z-O!=NqpsYH-9KYQ9&j)gH?}j~iKPLTr-OH|uhv5W>e9G6Oa6yC1V-p0482387rv2a zTlHP?21i%7C+~=V+u_Gv2RaPjqANM%@Bi+|tpPp)iag}7?T)At8%I|ATksLwIl%S+ zXm1tiuO%^MyvW~`bH!CTao@iWp7+{?!oCTva|DvRyskC{Z_9z3o;9H&75X(n@Fw#t zvj+g69zqf5?;8)r9kn_uWd^$cS^zqgr9eb>d_Gjw$<0F51)m@g#QrtcPDYAXaA^Qja0>Kt4p9=2u0e*?RSIF zMMEbHMtBT90uf8_t;N^NIuQT)y>IXR+xm8^+!0^r_FE%V5?5vJY7*T54G|E-0M)IC zhyb=d2`MY*s`E}Dg;ztt$(xua`tZ}|eg^0g`3JK`@II}SoF za@XTHhocb=Fnf@*i9+`%^8h6L=p-gM7!RBYa$^q%C<0*>0_ zRhuIkTO$@$Wm4ej1QO)he4iVL7oT51HaP&@n3Aq&)iuObBL$}JiFe^*QqjvTBwY_* zr+pYBE@)iYTuInmNm$L5gt@N<=nhD91H?H9rcQA5aYbZ+1n(azR4K=?^%97Uo?6`df@17k0|mTnoLQ4r)ohHnvw zAe$J^xm5lQ2+&w5k`X~8e6KV=@L%l?cpG>RLaB@-NL;7~9u81vt8+3K4j5N7FHet7 z-kf%Pw=)izA9-8ffaB2j!vOqtJOC~xbgMJQtSkOs&S$H0{TJzq|JM&D<1YU{{U^N* zx@kw((7A~tq1w@{?>h7@+WM|@4R5x->oA}HJ0y6#_1*us^$qw95*)@9oSmG~txiP3 z{~(8Lb+C(IS2ic%f3`Zel(YNp*4B5Oak$0hT`u2uw;bGkWHyuRf2B~aVvPFzzx$&9 zJXimtzuVi~|5(otO#5X`BwIBt4dclU_}?&yA$b71z208sM^kJZLh!jdy?iqON9QM| zCE?ZEOYm-Rx&tmxFD~DnygTNPcSNg`v%%Hn*-!8I6VXAx15S`|Omhviqot|DvIFP@ zdLHl*l-EERBEGO8aFt9Npr|lG#1wJv7Lm}69pQCXUGcVwb%bL8QsD9-r732B9N9@9 zun7s{@dW%JjXszHH*{hyAm`x`^ z5f&vShN756Aw@LBYO>&ZjV#rRC8k2bHg3yL!#hNF z__=``Cah3_{Pzw&4`t{Nn`pY1uLK4N@L>SQ!oJDJrLi+nfbH-DR80T+K|&8j-zH}6 zFsCMwKnk~0^Cj>aWKsr;sl+^O(2$~KxzY_ z4p@A9`FTp?@&O_Qx$^BuU|d|F_d^$tRK_f-7g);p{PlIrgi0h#fYRcrt(-vWAL2gu zPO|sX+G{{H*wOocgvT+F0*ep_QqbRuYIjA@VelZINo9`%B%->McI`mDK^TDnO|9CT zl=%}+{W$^e7y@ePk_pXmz z3;}zH%xV8KBsT@7AT0JAV!?+vrKMW{2YMRG29T&z)AFH<0KA3R6UOR-t#*fVQ%-;m zRHT%~Y-sKlgbX_lRl|CYfqJRnPLvS|< zJ+UbO7kzO6y^=LA@?*`XMw#uu1M=uo*yGf!RrNdZTp)%ZAL7)(8$lu{h2up`!$$;p z4_r~W5s16SfuNHB`lziJUECTOK}Q@CJH{EAAhiG##|{cd>8c-V9~TaT(iP9|fn>`X z<0S}G8&0342^_q$%$fkh6{b-tW(Ar2DkPP_?--kcajqW*(DO9grt!6pnPMJV?vS;H zIphL7wH3rbf{z!(3cbqWxT`%aOhJWnWidRb_iHqP-Ux)FYT>2XX%DPqPTD3d&-;We zha({33P~7XXGhe(gr1L!9$ASfL?0+aJ~df5rZh(U2$4x=zzInd%Hx^~yvFvEjA*w5e&%8oANDwze&S;u$SS;=R!fx` zW1E>=S;U}9+&j!=jUWtcvGNq(ia%{<0?C*w zPT>Re*n>SH2<-q&2)Yf0f4Xp*>+k^A1k@Qg$B2*B*Af2TrJw2OoCQ zClMm@sHNhG5-d!;%@p$!UMz&=!iXiux!^5wfu0)+bOAZj{Q_2JTZK44Dx<8Gh=eJi zQXy)CNY2$*Js;kn9Wa5nNJx1aAfZQxqY;<$LO_w{?Wq69eiRZW7bf8YN>El(pSfeE5B#Jz)Zia#PAhFDOmjcc4Aoi(hYfSF?L3UzdH{qKBauB7EV6i(#1P5cS z(V!&M*xdNrv<;xAVq=5?=wIU?k?O@~`49Ajq=u_bTNWxIFAJO+;*KwcKI=N*Y{b_; z(S<0(jMH?oC=4sRD;z`qS}-}KxNoNiRw7%IkWyP9j88+9??y!aEh1Muct>N*_*6YK zmWP0H*8MY;uQ{X3a>Y6ZC(Z;3I8~~4+K&-n^q{Au*TWZ*stAYW)5=n!7MZj%nhOF- z_n12Jv{WTe2fju5>S&qtHX;|t{*I(0F44$B5?T<-sLk>Sui#`msVXE8l9HB>kX+?a=y~CtJl{3% zI@n6|sTyZ>=+{x#2^lKwA^f{@IpHX z9tx8)22KV{31Wxuu=I4?QPjP|*`kZM+_Yl|6M{rpy4}>=qzR$~o;*vOKT; zZYTuW2oVv&#zM8@2ulwxpd|SGM6*b9+ni}7>#r0)zSNeC5wrk9_e@6EL8`~#BDd)v zH+Gl70!nsD0kdMgjIOlm35B;_=$K}FUKv`oPufJkVrqgj7{QJ^P4H@TQ;y+Myb5B2 z42Vz_5C*1|UVW18*2sgRK$`*+Y8X>o8-ac%Rnb})el(eRhR8@JoWV3e0X$0i3_mi* z=?PfuKO{RvEJH2p8CEW(8oC||C?}q$D~N37Y(|? zP?MdoBe73$Cd*|g^eGtdK~dnwz7|_E6r&l7)c^Ey=6RYxuo2H&x|xKv3S1*82aq^V ze-bfOev48RrCNm$TZOS+3II97m$4MQ6EzPLXd`01? z1e%?6+lWBu;GselF|BjSRucX3p$%(Z3P8bIl{tkIsar-eD>}-UWfDy#rwL>hWM3#d z$`c@U)l>?k9i63|FB-a!JnUeu{)!$A2T5Yzc*skUhB3=9V^x~2Qc0hWm^b7|QSaKc zKF^|>DKSfcX%LL;LW-`g_CCt*&qKyPO1wAXe7O##QpUIKSg3dW7!jb+I6{OXSH;`& zZD1^k8c0eP(m={kF$zBkU>6!068CPCEhZRmf{--CzMy+3U%-nFxY7a$?Z~(gEl0Z{ zl0j)gr0jjsS_NmmP3|sZgC{PSSru z!twIZX_Ts8Z-LV2{ba$^-lr+3+ZFo8{)xQJ@{r~K}>vkJA(kS}<=2PHnI}t=k?B$oP{a?jlS?EiLx_et(92nMxzRaLZMKo%gckaqx~Mb5A5nb zPIgbv4))%>-aREJZ%$8+d;7TC;%#BXB6U`iiHIeKTL-wA!Bb(8U1*Y|B1ySY&tbp= zG67pD@Lw)*9eXKS8>O6#;jCiBHJ2dSr3kn^CZkZ-_pD%zbuU`0hgsykXFhptNvb}2 z&FKY?;PU)H?Yx9tDc)6hU>~s{5g0qO5fkauF}0YRtW2btYch!0FyccN2dvq$x81FR zDc4$l7V`TBDhiT>EaDfS&;fG8R7h#>Eeyzv&>)k|Inga3Jqz21NXdnnvIty~jYR;a zmX7JLXv0@u8<&9GIRIi&aw8j$10E{H7OxVN0)sYPP9xK)k7N)0;_$go2p!fPJ6w!=#zGm#{8$XcKi zOcde+%A-k&yAh2BlQ>syU=ytI1PR1=teDrO2LfiY*#bUP3VPWPr~9zRbQ)f9xFj8D z_YEnzCW3Kp(B0z-_}(YGf!Y%k6^!InkazQq+F2C8fR}i2xt1>r=U%rNEi@PjfmTqk zbQUh#!RAUR88DD1EkXf9h#G@IBxnZJ(r*fU$HpJ*Dp+IlhRANVI zzIfFFIq@=czT&cQ-NStHlektVAv{W2f&o39j`Q(>M@t+zw;@*N*4H9n#MO_LAkD=n z;0u~gev6Vz^xRV9uz|J-t1}ZHpnO&f9@jh2W?*R(vH>$`{6``RYfR@f9fKq?%C)6p zzMLm%n%|ab%Q2ObrE2+TBWkN^H@=u^Wg{QZR8b(Osa58$9d2~gMvDtF@cz*YwXfE> z!NL38lau|U7YG07swo6(L6St%n&?LL4p6zacS(ehvn4-hX*Y_ZHNmLWf=4XHup&Io zwepkvfU_u+gvCK5BnthDlm?e9lf--b&dU!e5e>|4H#N)zQdOV&+=>rm-h$0m$M+BPmGAu(h_68YvEK zk#D2~jTMhwpk^j!Gd5SN7c6&Kfg4hTiBunY5U<2SqGYhA_KM=or*?i(Xfi5!o>&1X zXYO6Cc_ue<&@>qFD2&&zyal|)pnS{v4w~DT;iaN!D>bxK7dHr~C8dH* zD}~gO6~k)DT@};1lWJObSx)PY>S--1sP(y>o4@`n{IUN3Hm>6CVa)aa-+KCV>q)2V z|G%@{`Rf0FA3qPssma6q6N|=VZ$#6K^t2d2&)9am-Eg+9E_umgybIIubmR(R{mOeB z94U0hB5C&9A~>ZBXFfn^{P$ZM4*%Hy-hcXT!=%^d9X5Uy&3_is6Tw`S&`h z{-$Kn08*y2a5GO*==|E&pEmu5T5K!)GF6z6S-Qdn{TF=k3w$h@0yLqg9qjkaZiM-(fE%1WfeaA0eUz^tqn5JG#Wo! zVsuIWhv#I=-+t_O+MRx*@sXV7X%aq?Bc=C#wCd}}#z&VR9}EAe-x?onApitlm^$)N zt*97MSxWMe{P4WvZ~5EgFI#?xEcGp%p7F!S<};v>UKr|+2js2E$C;B|E%pHofL>f| znm|sVREc=zufL8(NTcV-xPMA$HhOOQZ8jPv!>7KXqg;szr8`QS+>@M$P_{@w<9vyr zVlPtC)4||9b@)>Y=WpUdqGxZ&GRh;c{NpNmn@`xRWm3$?3A_}DSREbYW{y#tU2$0I zn^a0ZjN6b6RD^8vff-tx#$lVr8E@Oc`i;hS-@QQL(f#f_(*N+OZwNgJdG=ZihddtM zIkBC-6~Wb?B*MSZT#*+}&>{UTbUeXZ9i6xaQUibiL_HNTBbRh=Nr|bAV2n&)P$4{TMJY6zQ_4tx1X@KBA!QiW$<=0SSo!nLjui0oo?4;HV z^16B#Q?)ENc#OY+8=weW_X|Tv%|_U{!&hS_r8d(R*O{5`TAJu7Un?CnjAo;O^DL=YoZ0i$?w+9f|TT%5jhzSnZ!$1?6IX(2Q;!`o--arxNyMC&cRZMW+nU}U&YSC z1;qwlXgn(fgw-*RdijF64?5=16h+~>31Z5$V~91(1vF981Z^ya%(7(_IIi?hsOZvf zk-j6ZnEE>p#_YeVP$cG2Jv}ONV!Z^ZfNM4yuepSKoy0y=qE7hQXPovDRT3Ak9YO=i*Kp(=objm;l7g*^m3hef5xKBN6r?ObtgmY24CQOlk|D(^HMXXfdphMTVw#`AL3vN zc4Kh$PZ)S3rJ*AN!4=_xW+sN!*-Ecdp20nhZCxS7<4$KbEoxPk^;4u4Y)RJ`)AxKl z850WGrxZ_&*;t^i3rYnGJpp9 z3{bZeA~Dp<0o}2R;p^4N7*_rcRE;s6s@*tub+jIyrr4Rid&Z9nV2mqR?#oG|j2Sm9 zsEq=5phdvaH)mPYj8HVFV?}~SFo*d+LKUeaxF$Cwb~{m z@N-_2&%@@(rrLSk58j0knaom}ypif0^}(~*1ih};+dJJoZ1;ZJZErt*;(e-~-feQ6{Hh0j+h+Qw+>tx~ZoPf{^62ZNb5$ zJB|gHY)U*cEN=#X&SAsF43nqCyeHPl0fLdAmCZ7FicanEWjLoiC&&5%MyU?{!npfD z_kLlO)#!~yT2<+^wu5*HKz<4b`BtO{@Lqnvu4~dlF9W5JTc3WS>s9d>_487y<|;Kx zC+bSV)b&x}ru+a7<9E&qN+4IsUW5hpWcq@=jKzDm-5wMWOp_@BPiQ(r)lxR%@FtZ#8a(+JY)qFQNiF=)nZ{L|I)(F0U>cw|G!G+H8 zFafHpbC+TWgyoZ~oN1JhNCb}A05h^--L*SM+UZ*@aK{%Cp1}b(gtIS=B6lp9=Smt2 z3d~T8^v6^G@|pB?3`y5sMO1}beyM{;fV&@>>ebxX>s$%B(7Mv;L+ur}zLr6YhdtMT zq%)p!*BB|ErYyjWA%xaUuTShzWP~`x< z#*uD6v1p9$zu=Y)azNXe^`SHm3a@6lG0^isUCU($vCJ4n<<=$CkY%7>vrtD0aAUia~*mIq*yRJ@;_qnQdnN|Q_cMFt}_rspXeDkO@H zvI%H$(76DHVBvWrhUbzE)kx1J+y_2+y4891?8&2+2UnWs`f^(#l!V6)ZfbXs2d z^Ybx%?{&AIJbSeB_|fAhbq#pz-Z_rx`}29&Jl=Wo>}luwt?j}A6zS?~!mUTBnBJR> z#@jtD)AtH2a$>n?9)IY9x0~Rj!s38!=GRJu>$5dRhlx)D? zHyXC~JTYU2{Q1RkRyT`Urmq>iUv9TXYE)n~8;w2nh^R;Cp-Xo4zgocNc6JC<3MLTA zlJPO5UqDiT2M6?RT*pPs$VlloTD9Vt#0G7fbu1D?9w=2VWs+su7Kose6hh4$0AN@g zYP+AzCc!1mYnG0D^AcOLFu}Ffp4ClEIXn_8U$mD-@GVn3a*o@LNT&+;n8p*Z4`Jn;kXTD*CdgxQy8p6ER*?hM zHSwU#Y?a%F(rVCSTND55-j#Z#X=sR@lf#) ztT)(MSu49>z%$ifSV0l4D79*(kZbFx}px0Gj`3c_FxVYm5sp6?F>TB znea7Jat`EsB;`CTYA)mQ3(C@H>Q=>?30Md69w}D~zCto97nY{m8Vn7KL4H=c@wkT7 zN}gq&WNml&m)c?0 z5Xw2;7cW(vW47(s>F|!+^n*xDLTyA2+xc*2p1kue@W{<*#`L9W%`IxiWKFx$jxWVp z)G^hqJ1cwIZM}GFeVe&}?rzNK_`NoG%(isEYcxmL0@HP*Uvgrybi&LH_WYS)amLal z3mk9`H*F8IJ>Yg53Bua647iR((&{BhU9@AL5^XY zq3L(l{OAt7uIIJPAHCc^;KK}(`nu`*NNXT88x50pDW`AM#_r9=vA3?)WEraHea9EtUq)Kf0?t^FKhx^Y;%^D*dt6(<{?NE!r8%7yMRM=ZM*>7_|tu7x|l z;@R}pmw>VD+xZn@N&*MWOsP{57jSK%TB4j5b%?dsYhBoWEnlJaC z-^{bpRA4HCU_^R25=^KR(3oUmIGp!^^>5`d>03uw|1TyRm}1W#e2d9nOp~^LftXdV zc@+67bkd!!jZV6MSX_ucjUsUkSJjvvTk#Rzc<6G*nExcFPtIdDAsSkVs;0>ztIQhg z+L@yS$1+I>$$il68FoLsONPs$+%L)w+>BN+yyYI5aWvoHHLJ1pz*Sb6rA)#jr*k*t zNq4_tR?_BcLBk(uMB|X9O>jp<)1pOJUks-di>Bb**)%0)*h?{<8r0e*Ky_Xt9@S%A zVX6xq@@`B6k7e#xRKVeb=`a?n0Ud0OfNhnEDE>cY4Q`-5h=r&wo zint$ZPlCHfvTc7q}8ck)wE*?y^QLN31ZysLg4i*e<87VqrXJ z+_`P2+<&vtP=9HcVri~S zvl=0!xYkL!ZF#Nym^XugawYQ)&*}M+wB64Atok)qh?Qn1z3$tc zttXEjy=!?&i}t$TKY8@HVu+{VfnFiI?uM>wdVGX_&@7B+nG7ec?0;QFUj}gFcCa1j@$OVeKXoX z&kKpO{LFT~Uyd5zcfPO8X6>wZzOPVixsjzwpuWLwc6PR^T((?4=#+P=cb;|f(blqj zG@Ej_=cBEgP{}<7Hfy=i^QWvxITba`g9i635Fdas$zc%3}6zkHM*kwrk3k|GkTsuu}T$_9;U^k|c zVdN&}V6(O=V|(_=ab9g60$ehKco}XP5){u4(M{CJ+ht+@8N>X0V$18H-F)IiraT-9&0(fH}??4+PWNwPsNDLGLcoTTD?CFh^r(7v9k zmeJw>*!rdsy0__<3KMygdHdrX_+}Hms-%?0vF2G>2p`2ty|OT)hxyuro|dKQv0fEo z4p3L8u$xRtD|EGqs`AkJzD9XKi1#t7I>pH9M9bm7Q^h|`g7qPuCPA~&I6c{Oj?1uV zaY{3lgs)@QH0ZMG&XEe z+4R4!#jqW*D;6y>NJL`zTD5}=wgUl~k?4@AbDOL>lGTjCH$ALrFt&dj6~R&coklz~ z!QdNk?TbZ>GeO2eX5@;c7ecZop(*Q<{xwY@`==VC`Zr`3lVKlYz57{816G>?aUi_% zaC7pkYrr`K@Bo99^5Dvl(TvNC2a;US0LuL57uz(Wv#vqZcM|R<(TC|y0>H;2hKtU4 zxcLA8v@L+T_}6+Tv%HhLre)r9v(Y%Tf9SwcaP2932Bakm{j;o zZ4)80b6tMo{9oe2Usp2!nSkbm^;f=GlN0GII2F`fugc0ti3raOD?=7ax|RgD%fc-t zv~gZIwffM2s2JH6{`{M`ScP3&;L%!=^eh2#X6~MKj8Z1-&W{ia0YdsQIk}Jwa%JVB z<6AYZUcv(OScc8VxWtZGIt1gGroezJ^62*H`t|luwIMw=rb-`{?=~K&uXsFcOY^L0 zY7Z; zB!*MJxT*XuV&=`H^11|WEs$oT@ym$CB%Q=DR^24yNtE#l@PT#8wSX!M|^=UHiLacyI1FX+r(xQSzovimh4Fbpw4UfGc%RB_>6e{$| znZPVl3T9q%EcZ$>8JF^JS`cE;*HCs5h>v>abJ%+Dypdkezz_|e&$o9Msa@oZ_0DV& zmbT_#)-`g?qNsfti|g2(Dt#xY=L)9i;Dw(%dBOaca=ga-p6YaA<%zF%(Ve#v+=XyK z?_AESK9z705hFi>$Nw%~`|n|z+gY}deDg-VzPQ>ym9So?_EGL%ZA>NAA`H!z3!K^~ zDU(oAt7@amw_KN}*Mf5;cuZ|-x{#1gA{R3TH?1keQC#te4Vm=aFpq-#FsC&q)2mMS z$g@0IaKGJFs~T{?rF?qw^N*7_jM(0()XRDhQ7CjY`z$l%H1E1rrN2Y+IV@o2l5Q<>7#p^qgGnMqp+L(*yj3tQInR^&+vp-D9zzOnMp zP(|GNxxFTWPujM_*%9o?1QY0`OnTj|Pc0A2Cg4M@9YTI~`rhk$+y3KMyyS+I%ZVVF ztc`_L=gmfA@8pdmm_83JALP!!K{Cl-)MkJ)gsr8P53kosGX&uVN{#6ygKIK~9wpf* zWi*6JBC07Fi;zXNl;x7Vy@-TkwJVTMz1qx@pp8W}r1tRFsu`6cc1kbk{F0K;36h%aH+28B-OsT zck)KsM1vw^I8_T{WQ<{&rEP7i-c*Y*-`U!L8|0`#O5lTPjOA8!X`&2V-@3&9n~laH z)~Lya)#nyyh}mqJRtEsan$+ONkwnDRM{;dV)+$yyc_E)B=N6KVoG482h(G*NtQ<_%dYVW>IlMAd19l*(<5u6ApD0zvNV@hD)P6sTyM})ydn^YeXfXxLa($;;8&N z`qyB_cvcT6jlX5Z`@b^r1 z$z_Wiw#cg%Ict%V7WtXC$RTf$SG+~ec#E8HCBOAuRR7h4rZmnN3;RldlK(AwK=QKu zY}q(Oa5c>-Jf`ol7!!{T6>N=|oHZ)4<;H=CzfEYwvuRt~Jk;CG2RNEGg|_Ns)*iA< zw(*XGg>BmYO~`f-Q7PME&>q@Blkdp>6-%eifHa8}G4kSg)GlC1+KPoPi*w|Y?=ZLf z%>G*L%wk6XfvGXo%zBMZR}goLMV-HfG=%e^sf|UKL(_vn!OvExBr z9tT=Y!BnNrElT}>t*Vwb;M|C+NsCZhHYKl*g&`eiz%yFlN_je5s|&Rkb4FI|jl-8} z!@P6SEd{lBSBN`zCSdbc|C;_=vxDI4;TRW!^;9ZZ2Ij0=&t zWm3R$jdH6VOfks)1S+|~w&J#*aaryYSKiT7yY7HhL2Y*Zp3{dq@%nZdj9CV$D%|e+ zs6M;VOQB$BR6q?Ro|2G-JkSN{X53iJBJRZ`9I{O9&~IW}{C=Het_4_ekJzfi6%6Ws z7tv(Q4wV#ID?3zxRdB4AQqFhxh2OHM@t9|OMkza3bC#T?0auZ~n8@jcc)#oz){yOH zF~lm?n7wE*($dczu0(pjOuZ5!H{q&MpKH5DS{VVQ`pi7t%4LqWH5Nx}mV|>Yo_hWb zj&$&@00z zo>!La>wUt4jD;_IpKCA{f$FrpAIOzw<}(WCxp>^3={|>Ou7&?qGXI-MX34S_G@~zg zdVH-OjCk@HMB5xJnvKRm>^fVR#HXncnYpQj1jj5ySDXOOQzRJCSf@D_rc)vY5KoR= zXNp)swI=Nr)UQFM@20viz9C~CbH#!-9dN-Te}N%sMM``|fwmMrHxq1iU4IS%Hy4ku zg6`i((4BFXvapwlln&V*4MyxsT4t+acjHC30MKVzg3Ds{bwU1{EXZsU^LY4KSKTZW zZnm^^Z=YlRltF)8B!ARJ67egDoj6Iw1@i}#N0XGDjZ!8@B3i3TJ|A*rN$f1fUNI@B z(F+#QX^#aW4%fOS76PwcSacQ-B4H^P;k~0@0J|jO>kN~g1!v`uX&ZxCaC<_>EB8|; zsM_Xs?z@otCV1-$4zDgX#d+G4;U#51XRrs?qOk@u<>gn(!l*R-Jp6T3o(E z^82KR16DgrIZw0;3}ka7drn@KOc0qs$O;WoA*B;*1>(I$cK?rTLB=W(OTx0C>hd&$ ztCphG8j5i(g4b*`(7(92;M6Phdg)6s$oehPSIeOf>(sE2Pu@tDGgK*ou$(}y1 zE7}C*)w6S7SD3338J6ZUB*n#hpF~B7%|_!F_yv81fQEGx@W~6~1!PlGppSdaeAE>z zpFxECNIS9w$eUywDSE#zEp^tMb7VfW71NE}c8KdpI5H2`A3WEH8TF0xj1*|2>*?)9 zRLY}u`1{TS)@(FR%FptEozJN`DizV7+fGu(##m_lfq4iPnR#W9+<~i2n13Fl#{$sH zSv^Xf+_TwZG4$meHB0^6o84m`+$9Ykr7q+I!b3j?1C>E9OL{DAuwFzFMzhg4nv5^7 zzCtCicB7CIG7qH7W0XyGS_reX9bJp`lBK9P8%0lFj4!u_NFhT2^8-) z$ItTSSpHaP$dxwv4)wP4uKdM}U2Py=rDBq(ljl~;{DtQ`TVV7!J{2N66dr4_3xZSVs#$9aYl*d&W1CV?|p8dOJOi4vFohPvQ$J7gacrvtRHvx?rR)1 zpl`H4*?#VMdo9CV-ZQ+mml2~;HUgb?Hw@D?WZb*~3e~-}`>gZq@xl$(cDe2%<0~Uj zTjgr`BI0eKbI^H9sD33R)*OH}A98gjueSYd|51DUk-zP)Frzv*`sd=&BKR8q{J!&S zd->7ayZTp!{8jlQU!Z>Vrrojos^RZFgE;josSoZneCEJ=p7R&GgI2SUTo04Chr! z19oy>2JE?j)qa}4Cqvc1%p;G9#8!}{jgOtIzaXPnFv%E6Qr62vLPkPdlIsx1l#Bg#3lPH>!-odN0{nJCD zlm!|Q@}tshEKcAnp{FM#Qf*JMV%}(~W77)oMpTj!O+ykg8b&;3X3HJ(P=OT#GM9yX zLQeNzcIRzF?lqk@J?FpXi?prqk(&?HKW!Xz+QxAx=DfWO09`8|OSL9n?ZOq2NsGMJ zWtxLgixRy|(K$%J(#4t7KmPmc^m|?7w7nf~5gok68RBmNesXz}KB7Xf;f# zN@NfHV%csyy{6MzeR7hhEuxpHABme*39an!K@?#Mv48Nwaa1O<(YI**PtgBP`ER$?po@`Uduz z7LM&-9jz{;h(N`r*~l0H)O*a8C!Act-%0{m-U!r_mO8m4noMFsW70R2>60rUhpi#4 zKCvG_!ufugbjE5Axf!tve!q-w9~8-05C(aP=lWLRmt`pHqG%ZoR^47^kd&O18tp}t zk5vPmkrNIV)?d4RN{+J;ORu@Cr&@g}@5Qxs?m`IFuy=(jYjxUP40Cy}T{9!KQ#P-- z&rCGd<-I!>+*0nlcR$tw^W58z3s9Sl#&KfGZ0YnUT2=+H>`YQiObQE`zhMt0Mt#Wp zw?b~9+xT{uAXw1?;!ny5^;ef#zPqaKjc_hdyb}qzgbXp^G^S%7;H8J;BIfZhPx;^O z>n%dpD+S9!EI_uoTMO6ERS8m#{SB zOyltO7=m6b{1f|r9&lZlW)oZ$mHxk(_q&Nkj@gJR1LwXLU#7_8%jG8mbZ0>k4b4(Rs zk+a1rb5v!S&oNh3ESimmuCYh3cAF8n*oHuiVBrJ>TVu?wNhT5=$j>}eH6yCbSkZN9 zRVuAjXIT-AMY9Es{y5WxW4fdH`iu)ot)f?G0LN;UBbw>LN3taAl+LJjMA)FoC4(A8 z+Jz+iA||J10hQe63S?Qg#i9geWy3{@{2jG?QNUgQw>kEb4UMH57hodF*}0(wIhdZ_9Q?_jr><(gz4@AS!m;Y&2f0^CyiW zvZwaF0mo8)BbGAF^Ez>^v)58%v<}>lzLmOSP>dD8B3PSH0kCg=m;PVOuh94h-=NYr z^E-pmHz#l%L4Dob+6Zd^K-Lj1jV=Suk~ztM20l5n!nyQXN$s50hH@=uDoS5Cb5KX~ zc8TV7)r3prn@Kv~wp=?Ab5M}CD%3n`s&^?BUSzs@WRS9qj6@XLh}6I#D360^5;93B z=?Byg6yII4sZV}UoNh{AVO>j<4j~C5&f-i-nn^GsRFX8gY+-r>C{1VjQAY_E))hiBa%h3 zboiXa7(t%q6qBT24neI%zVhS7SmWDfD3qE4W5^JT}(n6w>M8Mho7I z;67G-71q}!|8>dVWXZ2f8ID|4SeFJ+swevR>8fx_pUM{<*?09J44%+zNoYkMP@6Z; zBVKo8S2gg+!UDK%q z*IgF2bnL|d8Nj`w*PMeEnFWf5`ELG%tqPU|nw)C(pKKDdbIQfJ;x=`dD(*s%p4&uBGB~wEtdg9@!6+56m`HMPOfUcw%uZa_M8~^1?cdHN zxnOD)Q;=&EJim3|gN|W>RW5U{bns)pWNHT((|AfGA5Wr;#!Q3EqoE{8gp~XuVl5?U z)EIDcOvPk4N+y|4a1Q_$7kKs0r4}V&OV@V?BazxUlaycah{5)dSNlE~U|@+kHIpP2 zY9q=^TB4j%Kx_dPYm>p9+6J3lOs(S5FHHm{tTZx5Ex)lySM?75m1AY@4-rurWU z$wGQ;N)`>;BOx;ux;6sWG%$%-8x!1AZ3K>lBZrvIEKhNU$tVpndI#o8VZ=fJXahq9hN+mukPG$g-+ISK1T(6g&@33edwcmz`u~z59w+Z$ z^L^`PZqpvDJiu=n&Np(Lywj}6l~jxIM9M?L(Df>n7^#BOCQ>6hLHpz^3S|RSR<*Y% zcEGYa(NyjILb8xtaf(Yrjo)uH+T;Z^fv7$6m7FArNTCLEn}E3j`zE$;on!7|N+_Ac z{I`j|JctW9>UxJKWP|xbzd=Yp4~OWtNT0=5{bn^~ojQHGM#8K$l0yXSR^9 z-)Pv0n;R8^!HKBxwH<~=W|N!f+}x%K*N>o4kVWl8vB&0viDYfsmWFrQFe-f6&P3aM z-_BQ6!)3$!Ku&>L2Cx76`twEo7@@ccs|Zx17}BZB%{>qkQ#y`r38T~Lbe=qV1pjtA zo$|k1k2_EQYwOX|&d$!xqn$_F|JB)g@@VVHf051|jdAYJL}oPougWOE?4Z({L#hw z!PNoi+wCsdO=vJ;?QOqP*C@WM4DyAm)@ZaQX_U*-ih@)4+yk9%*D$A98?nqFNO zN^kb%2n8{Zvs7&ISY|YeHXAhIe`l%WBJPr_?FLPf{7+50kjWtBpgwhTz13J2_AIf< z2=q&}oEtn)jST`gzkZMnsFdos6|-zJp}$>a$#n26y`F6D1poZ$`th6JNB`Kn_<3@= z{pi(;m#>aDpY9AUo;=%TPqrRE4Y#&}txov(V*BE8NVmerbkNz9mrC@5zTQR($*W;Q zZ5?(P|98vZ-ts%`P6OgaaYybpEH}94iAITXLk^Rt7(%2&Svq_qOe7I&RJc{=)=)5N zIx6;|Xx2ud*vO^{>%y&pHor8k%pf}cmcO<0$KBTE$bUSu-N6PhU;giO9&LBZ^8d-> z&R6+=A3qPsYZQ^8F@U3_Bt0?6u9ar|Qk`|s=(w@ld)d?x=jwc-&xVZ$pi-y&Vv>o} zdKA%N%J6{Y6YEWMbbNNOw@>ik$|ZipLa<;q9^f%mo$=7Hm+S02R!1~MBV|LH!m%e1 z$rLU4wzR0F= zOs8;OK*Oo&nY|BK0*8k{jFX5%^t&CFh2Rrgw?kZjA%em%jEm}PL%po=pz%O$8A?=j zH#e`ZuYC&0`XU{golS1OKG@qo>g~hUroMO+M@-5*gMm7yq2#)V7>Ve$nl_jlm~tM2 zs~);&=s9mZD9lYxEQ6dnpgIk}9!|nn~j!((n@zINevxDQK9yxwVc8~r^em*#Q(Xv%c-m7DnR7k25I#=hc2bO&d0(jfP zoaH>LHP~f95bEzkSL8^4Xph%<>*Og z?}S4#NX3{aA*n0c>eHi%;gGhx?bL_)c_~sdn4~aRm#amLb|C#BTK;g<1rrOQSywSe ztr7uJ{M^7kA5M74v>=CD3%S_<_4;bjp4K)`v5koLdrQ|Pv`Ag%0 zBGaB2kA<~GNa(WNCdbB>+t0TV2z}{Wa`+7s3Zoi!iRaDvbTEmc^5^DRwTpT`tPr@I zMv-Hk&}JU#>*-*4d)OlV@zjSSJ!Y`Vm5{#QfV>#-Yv{R4K72x;^G)0afH9sm9^9`9 z+cC#?$=i1g#5vC`4f-`|+qs#!f!cS25NNF%<;n7p<1qmWr2mL8FI8=~euFrlu5?B) z2%NcnYu@zXrIHE=?5D|vTA_&a+ubN4G6Q+1+dD>VrS54g0C@e0Vl$&d*@W)Eh^H86 z65q1Zw&?+T$3grrW592>NgvPLxw79^Z8ACpE_dhwv^|+b5hkU^o(=}2Z&Ulh)zPb1@n)oC3nRL3<(#2%uYm_b;+~N zvmFC>S1Af(+LkP#C^bxUQYm4Y5@IPPywRHr?i#A;!AbW7a8JpLqaOV3mvEn04JZ@l zG-Q-L18EaK(OJ_J&KE*tY9vXIrHbDz2hK*jhql*KJux%UuEkl=v)lofgc2=_(Nv3v zTXgM0Q?Im&u^?>`C083qf_2s57}$%Zu=IZZd)f05!y1SKf2G)C0x! zdx+`(x?qdYw@+OHS3U3uYi#LH2#`=j>?CCa{@#76S5V=FT}t_d-Nh94+5wa=NJG5Z z!Z|`~I?dF+4$OE#GuTds=yGyl5@O+XUncTPP4c5^s-E((l0U!=_NGnAGYtdU_4x0s zOSX2lI#0J~A&qldGYO{N1TZbQit2*~6d43p zDTv0wp;sk`uQ|ioK3-Ba`CV<#(h7xrO9t@TD(GS`z}xDC2fqFWpLI!lYspTEi=@yO zzFMI#nbB+_i=E&z+X-}$yFu{*hMuXJ!KfzZw%K%>GIbO|v5)jb7Z1Ft!XTq)YKW=+ zG89yOo8NQV_Zz*Q2WujR;lt;tpOrlnXXar@MHO@`P z=ef8!*KO|-pBxd0C7|-M$ZWFAXSImo%XK5BITvr$WSMts5yO}HMyIc9)yZAoZW9iQ z+kop$wTP3^2gpJ8t=?!0Te=v?O4&XAaD5abj% z4d(U(xJ;HL5=xMScE(IByxmfb$Qh8n%md{UVUCux29)E+Mkm<_s(q1-z1^mQ2-YcM z;IJTEk4#Jutic_**(t#PLzuq^&j|B}zB-quNn7_&97^HyTu)$WHkW+T9g}vP#H7$g zmr_f>CFp10In-MojwPGzRXby%gYbyOCIzP=Ud`a^Ne7hEJuN}FOEz7ZZu(GUA|LLa zU?l+clu|G6hEkVox`0yJ<}*>SGPBp`HjLSJm)>sg_1%RoNh%}9ZDO-&?9T(9%8Wpo z(c-*;bg((8dZtdJYAq)TOD7Ve*3223=0jxVV_SY;Q>_%&D12thGs{l2NVYKxMl|Mf zY|3p}Wyv7q6U0i?{R{!#NAT%*Tb}<tSeHeL-yaf+WI&> z#3~8-JGIt>lqTBa5?}j`u|-f(s=`P32~@PdqEVOZbd-h><%Ut>h5_p*pbsQ8U_D)~ zADNWKQ^zuc#vYg+Gete)?HK4nZ-zDP5^(Ohb8ks&9)ysMe(r!&&N+^5_9r5&Fbg52 zrW#|V(w`U)&3zfrNFTHfeb8zq!aQ+)o`7CkgUmfN>i^(Jnv49S$(W@)Fq{Zd7!MN? z@-wppY=~AfO(tF9Z5hFiWgWU?d*^ZIki$bv)!$vZJq!S>6UGU5#At$vRKT5HN&gFG zuLZIZjU6AqyoiObiv%DHEffAlujnCt{}ZDL9?rL4HSp=Hz1L#6Z`jQPdU}mUK6$us zPtA!oC{+;;XvD~i+}BJsHpkya*%GK;?m@+CH7q=3j>n*EqYT8z55nRsox2R!60eV~$cJH+l{f5|e6kR5*zonMKIOBpfo$1!MaDO-!#Sj}$HNoL|1;Sgx)! zmnC$oD^quTgXH$`abcTP4?b6td&TEh%$5K}O4ekv?~<(!yelWb?~)yOUdVKBTbC<} z;;axbB#B9uH*esPo-c#RlUbN-uY}1?Ehdi}HEhG;E1rsYjIQzKI@1VMyt5(%$|>&0 zSDL3EShuFr-MydB4_?4Cf)Waai2-Gdj|}^m1y60R+FB1ACVqBElLGjcsTeybIQzav zfM~SF(>A`;Ed$e?YFurLug5fLxF$g(?4SUEQxgCz!X%eMHZmYd#SreQwQZ2A)1DRy zvE(7s1q3b_%rFbl%I)-&7sEhHqxzf26Q=K0)HFkX___0?)OBSPhA_2w{H00-0GwXv z9QXV01I9uyK~V{gY!9q+w49^^8suks2Qf4p_~b}r+VXA(3t!_70KGAp@iE*3gyyJ^ z=G7w6xFiY11faxrX0UV?M5j@2OcqgSB!7?LIVEKn$YCP16eTZcaG872Q#{qcG39}3 z7;>q$_X(FHa>24|#^O9Q?st|79WR&VnPPFv#(WY#ahZv9`dV#kupS%MT9~o4tv3DL z!9XqbDM=@0WodD*XfsDLuTPW~?~1YV65OxFB4nEnfI#p!)wsh=GL18CpMZQ#L}*6m z?j1)WWVadi85}f*L&Zpnk;Nnm@iv`ENMMei(;yJ3xeYKG&dKj0X6vP1K8!ZI;z2zP z)&GmcQcvorwd<1g-;hZjSobF5&=c~kaQ$4kMx#}7;II@)ur?K>46A8p6g3{pOmT_H z@rPif;n+Cib{>kS;J#A@psxkBkx-x>mh?+xMjE6-N)qw`xBz8XY`aBv|Br0x8#GB+ zrY{#95M5HF|47J8ZAm#&cmgdBRcVms)GY>?I%ke(8unX|YBK;0wr?7Z0n#HWMA00H9$;# z1eV)60^m2-(7h78og5|>=dR+czQb5HgFV#8(H;wy45iOBA=IG@VdBRXc_-l*tK?OX zmseO->`7Mmx~_^zUvZZ?Gxv2Nlg}v#fZH`bR?yi)y+fvxl!H+^&)qas`nj5sFF?Sl z0VNv4c9JqS#xTSO<{?xh#BHxUkiw1ka`kKKCx7)4Hup%OSw3Zil)cLC`50(KY8wS| z+gU;ezZvCEl>BcKUCG8C;9Lnkr|b(#pmOn)E-4mEnPoN_$XBVDBuaK6*mM%_$~Tgw z`6Jy11)A~5I*w0;$PT$2(<~UN(aoz-)g?O}?QlfX%=CfIUX6z1D}ZUkkszjGLf4vv zLOvOH$sw3+j2)i;&a~e9SlfwA)J|JpueGyrV!OsN{F>tG_Y<0px?~gE%=oyWZGPbK zvl|5JyMpyh7G7CHZci)gdCn4A?nRD_Ua7P3`Hn@XV7l8aSyn>pgH!Bsjya`zQ&_+S z6&LHY2gePTX)}5e24aYLAkaFDK8ZScg(O23Ynd~V=Jd75ht^Qv8p}0)b)@btO_mkt zVST!43DLT{;Suoc)3#4z#7L}}T=RAUzIoq2>OA`62J+nSXHNW&^HUdE- zCId!d9yOcfBgw?yq=;?PiIrGi`KqbgY>X!|gG3hjy}qWGRC-rvIPY?$OvF2|mT&^E^|sHX>|c&bU7&8C`k^@}r@4LuX48Y1~f zc$_s$Lo|(?hqYri?JBPn^kyw1@j;ngmta2F0`sLdXV&bs%85ubHFwP!Z#E1cIy5z2 z?v^NOxAlmpp0{bjJ>n&)$V4C_k9cQ$CmwN!>99L^<2%f*)de31QX1Dh4u%#>aO>=G z;~1bLh-9jv1iVY!f!7T4PN%bIv6wAEKnSurnNjYeEZf{3*l$bp0Ol6rjc6Kr&Dpp< zUuHF%(8U*UpU|`Rl!IX`?Bjh?F4tQ;y=4K^tbMV}Al(&hT^gh-I{Z@xj!*uPdENZ- zBw7>x%h^kBuQ!=-DF)fCXFP#;%DbF$G!?@3<6K*uv2^Us=89(d>m{gwP3xe1<;NBH z@h({sO}6uya*58cn_3yX% zPja!LXO4H?9YV`9Yt=MWjkR-(XW0uL(rhB#M@#Tyo*uvH`iY@=-4dWXUC0!~Jea4^Vpb#LlMFm(N;O zpFkh5T9Inwqr4eT368Ss3XA&2Rt2o{7?=US+OR;|&n=rB%GRK7UKS>OtrBekBdlqy zyY*=oEFWhP-~C)HT9k9CW3-HUHwd+(oBIXv%w6qL-0C_;)B@oB~tcB`2DH5;Xd%9p9EM6m{EK6RoZ0<@=%BG5hW+RVyo1S^+T3#Rm zUa`$jXJ=rMaP*=Y*VOt=uP{iz=Cj-$R`5k#rnll3xhbV6n-=#|_`r5k_L*I#r}8(p zv$DJHGM$ybF`WUc72JhCFZ1M!WPNN@9Ph39sMOuf8L8CKZ8)ja)h$`6)Z08>0*j|- zY@>yJWI4kdlbNiO$azqQZlz@2m@jIKZ2&b#i8y3Zs_jBEUC6FBoww~s487X+dTa4s za=0^aJq?x<{O%WZ8dqftfM3E`TF|=a=}VqUvo@@!#S8`CX@M)q#(vbR)NTvZmvU3h z41LKoaQ0#CUSHaXoi}qf;@R<1#B;oV>UBlOX~~;;h2+hYF4&?jo{C)aTK$>OV}u5zp{S=Jl(j*pJ^_s-7uj*ng*yn1uGdvQ zUkj;bmYjgw;Jo_+QwQ$8o`rtRz0{1%IJd>+$K&I(-r4Ey$$4-8^zZwpy}3w~(`Mi?A$oU#rV%{wni?5cr1DiSE-ri69hr8#e`>zgqXQ%%>e{=eJ?ocbZ z&c6RzH|l1tUhSQ~K7Mt+f3*AK>-`tC*z29E9EW&YF8OJH_vHNeg<=^>| zHt!*zzKu9^#ce=g12*IKFel0abZlpZOcwXg@MouQdT0AD&iD3DYh_YEH$f5wv^m#p zVRePzQ3`5;PM|LcbUd-p=^OEjnMxxV?Iitr6cD^mGFA^Ti`nu4_$1k0(Fj(g% zUE!BbS321H23_Hovj=EXDPhV(Fl0Udre473-`J+rQ7`Bp1kREGpzT7s-gX2PVlU`_ z^${$Z&fAWlGRF)0Uws6NxyWYo^f8;~OyN=U3Fa%+6I~TZmHD^>SlDM3R)unR083|u ztiUqaV*Lox#rk78v-5Id**Tp-j#^*x-`T?6Z2H|?kZW4&7~E7oAMl8^bZ&8-oVW$H zv`SN7HT5AVvrcf2$0GJi-}oC-VYH#@D2ij% z;|avr*L8^g6-;Et;tP?g0oZLxbwaPD-z$7x8e4^@XM#;=O2_)4pFkGp=ikU#62Cx_ zLQd$VnirBqR~Oy_B-N-fsD9>-Q~-!=XDWxco7?XF>iM%!G%nAxDc{;?lT&e);l`-Y*z%5THYLA;``JSwt-_)$^j`Q}V=|A; zvB@f2?%A{vMYEy%cvB?VCa7P=bE$2vFgDBFw=!4Wg$8o3l&RV17g0-XO>#4!YgY+A z2O)6ZU6KU%ut$Fm8o*At90}%cnzxtHc5KUuXq2Wm71WBr z8ri}Z*jXiT`+n(Dg?=-_tRGb;(5Vgf;WFxaxvg=%ndrTHSaC~7low-%by$e56Ac^v zazx+LO&7$t(IhG5OT;{KVf$iQni7*}Zn=o&rDG%Sc2*s*Ux*mJ-ON|#XZgtW<)R#` z5O^#z8V9UyN!BzE#5fT##OvP~R!!%WmY43nTUOC4qMTr+2nug3<>wT zd2FN%%IOmC&mQs4J&pOgByf+7uUPs;N#88xV|_pBEg6rxOo;6rldT%c{DsIm=VHD# z7wYO0V$BVAnWH~!jfZ*2Uv>pc6Y z{`Z!)f8TBYpZ2@Ao%Z+UcWAD9Sh{`lyJqvR@X?<)+&6#5jtY;U?L)76#vM;&cFKnA z{UKEHE(}>wuyD!+at;z!Zg5S40H#e`ZuZ@?XNQawdP@At0_V$l@`)!43<4qhfDT&FON-m~QQ-=qT zOgN&~YMNj+V2XK6u2Y`zc-SIR&vC<@i=03PDJ~0>C1OHj;_ddxLC+&U?)DCPt;R10 zXFnakIU~R9o}TU=ogM7=$nh!JJ3hjg?H)OPNp_F^Nq#;!deO4gq24D@RZgUYE7Gyh zZx~iFz-={Rtnv_$h{nSS9WpW$R}43Tgr#FHC6*|T!v^G?&{+s7!|@y6ZGuqW{I0S8 zK7pd2r3wWg4sE;I9j|C;2jy}FV}*~qk5NZKtt8dGcJsT&9v*wBEub}+MA4M|HlYy| zs8e$dxciM?7=e8b+Gpg+4va&R3l>l)#4W~*I0ac?!~@Qv5KBw})r=hAl5AW|vE=Dd zPqkHqR+G@2PndyKq8HL;w!XcHK9)QR8X2)@tV0z|mFVZ{P#6K>y!<^5}87{>%3Eldt;!ef)f=_y0&ln9uh@ z7myPX9%Ab+#$r{j|Ds33<6)i|Vr84cEegPV5y`+45gxKE<$>IfL#T{g%@XUT9@f{0 zd1m=u<=suvbvttrh?EJqpey9>b{XoAnZLV+@3hKSpGw$i=cW=~D(CN7rq!WQsZ9;a zl~%KmTIAJw!D!0TGjYk{o{3+;H<#5a4b_CFd1W`OE%PPi(Y{62xi!lF<@SGb%drms z&(6-))=tI$v-5TTzn7mG`+q*+3panQT7NM+{|e=){mSig zsSm!?;#kX3$t{tU%&d%6B+7kP&iWFRuu8!bFA_BTkw!EQ*ew++SB0|6@=MU4<{rO4 zZwVB$d{(Z1lIOinUeYm-cwTqOJ2<&|q=uqjO>Oqz9*>6+>t!^!^eV}k9cATCl@Cuc zu#D$r5xgT2L!{U=VR=sD1C!DFi_=oR{;ca~CH+qu8CO*U7wCUmPq&|x?LSYS?tIn% z?&D{^{+CbqvTC5V4}US*VA&2->r(h1VG6nvb;3^X`m~B#^GIphZd`3?1qESs^=75Q zK-OeZ;~@{v?`JDsQvQ$l_@>@Ji{$_I_SWO_`M>k%>GoIoe;+?H^LYp;7e*^>cfPvhB zbFnjJR7#eX(#qaq-flfJ;6Gb4J@p>5HUx&fPgnpBE7JsSk-zzk3`N!@-<)|f`ni#_ ztmc(FngG>rY0ZphQ{JR?{tWA7MCH$Hs<6YP%Qs_UjhpS|54mUpF-~aUP8m&y>+*3H z6P*|xb+b~ZyhR?uQbZI=3q-OEJFtu73^H|Y&@dz$Th{xTH*H?dhwT1sYzoD@TTm=z z17~WIEM3pcm`cn3xwbo& zU)LfzSWF&{?@nGMS$h6r1-5(`vcVd+SGI^}*TjHJcO0_8ozi~)w+W40X+4|r7we-t zjYH&rS|L3=z9>IleM(?AUCWX{ydPfN-J*zuxSS;JtXOly9Q}vK;cNxS9;0V!L3w%( z`*!E9HtLkgNrZbfj;$~xMBPDAr+z62N6d?Y9o<;NDwn0z)oR$Kr^Ik;=JpGqEQY?v1Ik~K4> zNM|xb?bLi09)X>0=JHW{$HpKMBDIe`7qVXnBPBGI>{M6t^V}UIS>suyIzbBFjkg)y zjp=2}@2t)^uBFG55FBmLT43zqF~&dt?+J}Fo=u6h{$Mvmq{LvTjX-4Mo2#boz5=8c zvow$2?*HGno%Z+d{=9+l-|s$jT2DST|GIJcas2V{%cE$3&s4S1PdFEfeMHbdY+zA@X;(F@Y`!$TBRMe zR>;g}rdn>#LqRN*B|?obsFwq?M1V6w9==z@Yj2ggkhgR$5krK+ z>G?OZ@ld+t-_Wy~KPmxvP9E|VR@R3b+QE(CQ-N%6Eh%3B^)7+hwniG9ez<^x2sueU{}AIAD^EfGK|57*C=> zWk+(?(mJ*$9!31KaLA)SB8NO$kwYG>fkVoSqIM6z<1)&+c_$88+8)!G4@$l#N#wFk z@rI@7h*)46)0NCw!cHi3TIKqA{1_=52d&3Ig5W-rec_ZaspRTK`VX`zamY zb^Pzv<4!sLW9#wGSO4F8`T3gv?`!_Q|J?k4ZBjn9RgM;UA!xJXy|B{IBYyJ_uG%go z|K0RYH`oAfApf6if7So)<>#yX|0@5#%Kw$*znh%uKSTbT90@m3{+E*fmHa=Q&eN~* z|2}@c%KxwO|Ev68N&ef+I)8ZKzoPs%*&tTk1{TWyt?hFDkDVuvzRLgm`1vaTzsmow z^8Y6C-=;$OLvI61$^VSWOm23z+T-zdTVD;WunEkU|Jz$i=9lw7ZGW}@-^VRzuRN_zMb(g ztGu95)MjZaQc2o^v`PD#{ObMsYm81c&%gPg=K4GkA^SwW`H-@Zr!2_MCu#JFNd7x} z{>=yV&v_`W<4Dl(6H#EEfAc~8bDoKeMxTgUfGp11*)(C#fBp4W@0$<$(Ybo`Nj>`Y z*Z5bDc=hh8CV!d|_HL=wJfO8puC^MNJPy0$M1&2K_^aC>P{pH5K71f`>9O*9KtB2O z2{sW0M1KaMvG8q84y=#lw~5FY`ShtlbY+|_APg0AEU-dFA0Jz*RzCSiVjhPq&d8%u zNe@DtEMjU5B(IS^65`V95{+f)MLT2>%UCP)cjMf1S1Zwt)~emSIq-F z)=;`66u~7+eWMaUR(|t`nrQn+7u14Ge;tVNn8smO|Eb_?UhsJHg36KetQ|Oie6+t4 zB3VY-?^(lnl%+HwIS2JJ#fr*50_>y0M);JhY;1tUR%5eqJzwo2g8I3&3C3hk8$ zP;6-Qp0ZF-d}YM)3{EdprBUs>imm@XJNNUaPmad*SH$gk4Q_MCqBh4bb0iha>c*jd z8}Q*I#f9@l4P^7--tp1V{@&T~>G{#_;r`;mWFq0g7sgoSQEXO_{8U(3pBrBnnci;i z_4(oc-cP$n2ff4R-pT9TgCoyrP};ueBpac}m9F!Gvald*Sn0u^-@6bGUiO}MNy=zQ z+9}bLI|n@8^!85`0m;w1FMr;}XD7S8-Y>_eFN!TK#^f*L;l_Z+A=wEq+~xen1r> zCXCD~fbD>#ncRe+GE-N=3#cEYnYSc(wKdo@!OiM8tQKp2Rvc%o^fyd)_PTezf3*AK z>-`tcvvg9K{7ACJAA(o%BCLD+dv8t;&i;9Ra(aArym$QiIc#8O`~NswLMl6w^-q5y z4{NX>&z}=d4Pl1tt-|-9=U(r%yF^&D1PUtwu*0kab5|oN4x+fu6+45TLn2;Truf2H z#%*}A%;%u>d1p*!WXzV5$ zpYgu5XXhD>C5lcDZ4OJw*xU$FgG6DsycZxe;xs3th@@B-tj+ojJ5=g&?4JsS_-}B>os!SI-u68lXnLXts>LZR=)riC5Vu7xT*v zyQw<>XF!<07TFUT^ik9x7UHpT2VyXgENiRvCiPOS-9WYqAAV}o|Gt0xvUpMmNt+W- zZkEg^Wpm2Vo4-Zp9Tms3`LOi&3LTYaXY*n8(c@VbTC_+zB>$^sV9q!mkh2kUl~WPR$(WHq zOrns$&6BwZ8}L+SWWcWBB1jS{3CJ~Lh9og#p)B;B2_h4E9mDrZb%LV(c>fqPqse0Q zC)~Bc(neH#awdor(UrdQOlhFdit%=~2u2M7ZpY*Z@V;PhuLsw_EF?T87gUa5B-Npc zlnA&L%&l12h-L){0gcgMoQ@5W4w>PuMZw7=VeeTm0Wm;!C81;1F+`!#ca zsn+0}{CElH9I|RALanvp4q-HARODhB>AtT-G#Rr)F^My{EW3>*rA@}FpA(vmx};<> zafX6-artXnzP@vB`ZOL&y`e+qyXZQXfY0zle0!^Lv}@5r0j!$lmwj4kIus%6lFp+? zj~cnCHrmn5L(m)?RwKond*09OVe@7G%<=#7M=ToiVJuR1I~a@dKRhYdf8KiXWV`d# z|LZ<}9*`57DN!iFGYDpzT#r~xE+#wzFRO$GmvqRa-%u(FmqbnytXL{XEQ-i55*Gw& zr-MgP$|9QaD@GEUjhyE+4jT_h%!b;LEJ+z|#NY<;-%Xz!#}R5H$^XyZ->*>daN5p9^pH(a{z^FOnOBiyM<=$dmE>fy9*+ffgCwG6qXVENF^>1y+t}ONEBQSr z0Nv;hen=uEpA&KBIARlBC=?2XszRYkql8kzQA`sOc){-Rr(1NwRA7)6u|FBnnTg@5&UykPJL@4~^Cns z7a@yC*Yh3+Bj%}H2;wQckaj(CiIsvRx_2`FbJo8JF}rym3*tYY_nthftp8`vHt*v< zZ{>p)eaaz{-kg?B@MIhP9VZ#)Q?#|Y`E=$>3t}8W@jKZ&dV7qv4|d&1!dLH((EH=P zHaglnJbJhLen&lSL#y5W^!VmA)ESZ8DGSL}HBN7)=N^#u4EY zVXPx#;s~%;GC`Dd)9!us*m@&W+dMi_Q2+}QR|uh)$0XE1dPt5r%SL1Ly$<@M0!1v$ zAhAjXFUD(#Ria&$wM29xY@Eq4c&%kMVLm5-b(iw4_NF~}!F_Ad}WQ1e12cT<6 zWQiJ}30cJxRn)*07k1vCU zdY=F|y2AjyGWKwq@stT73aaK4Zs*81P<$AQKpV8BUu74Bw~-FHgecTR|J_#mVTg60 zujPCF6HtJo2~O|`3|rN&$ilHftgSXs82(_YvBv=0rOX9Y+{8HAptMzlFDpnxI+Rnj z_k{}d#wm)O{9G0reO6 zTkfpm1ZZ+jqfEi#$mI_MfLszDQc(@W1wPY@0H&qJYR4uy;*cq8zRYPURL$Zf(!UOY z;%BOh35)2^_-=%qU~PA*p9h(Q7;Ojv))CJ(%DM0uM5LXsJvZ)5H)z}SU&N(pb)Z1~ z-9T;ib<}Y()z5T|6on8tRg6m`%uP9j5k{Ik0Ippgpn*{tX2>Qf zRSSv%a%PyLJhxYAz^?StCog)^B+H#J5yenh(HZtHjGxtn0z~X9j6n`5PAirGP3$o8 z1)xc1hBd(vLHHcg7=qPnvD$4VO%(%%*sv1L<${%N36nG=xp*@!2=F#3u_C3~Tk_it z3R?qW11HGnU+Tq_vvX=*)Yk)2l0@_p4M@x`S_Kt$38&{;%T)vsew71MAI&r{qc@N= z4J_gVEOcS#hAsgD3DTpX@cX1Ij_rOE2oB~<=;kC@)_zWZno~D3wREM z;bekozCKBcIdF=i3k+jIIEkmqP&fm^4QK*7k zeaGH$fx4*;GhST-`I2?|%L!-}oZU-vJQT3foFL~aj3p_I3QPSK<1>+OJBvapsm~G| z$5w2MY%rnH2oI}w0CxfAfSy?j&=JV-np$CJ8MeE*yM?Q$D5(tHD}Eo4F^-3b4QDGa z%kB2a&&OmVL-c;1i)A)MBqpKcETLgr&B6f3z(*Hcy$5%ACRt*rkJKt~iB1YaDLP3} zEEb@@XwTh>a@pnf!4d~2G{H1hFUM3!(RR12Ton>iA<0CzBAf~V^>J_rd!%Whr(f-S zT3g9=EtlwRM~sxXz@fIHTSP^e3E1VK#|g+wqelJ$60g{r$fYGhd90QnLzak?h8fF5 zJVg`C&y?ung?40BE+XhC!RGM5+*_K#iAq@c2TUT2+_f6`^(9=s+N|sw&q^;D!RPk|5(iP%7 z%?2?I>br_n%;P zHp~@A3`cCzsz_8Ip$(!IO7&Qs*_+@q(ne!^PC(1E2!S2VhC`+2F(gPFx6QwFk}@v! z#N=|oD9T1F1TkYrrbwXYD8F)=rm-?NSrSh*m6hx=sD&}66JgpqgBwgW5SO~S+)PMF zgutA_>Kt;KjI2dNsNMVAg})(M2*>7bEEs^30ZnqP9$u@yUh&3|qS2}z~m>3mWoHGWq-!s=%ba>j7qC^oEIx8_WU4iF5%4V_HsPx?FD zT#fOC$f#69jmb!F0$AqA7dk;jD$WyduqSB5g)y}YIL-y*sU4P`j|ph1a!j-;R^~*j zGFfA^atXLtV`j^v?zEQpd;dXhJySGa4y-Z zQYd68wYp779?jA6U`mwQNFtg|+M17)MnmP8YH1K>Qfu2dsVuav44YY)b=@W z`qYk_LX}o_l(OHoQ->=S;%q__#V6W&bdP40h|5`8!BnRE2#7&6oN~{h(=#U$)1+mZrd2Iq8~cUUk)TdlBScWfK(ZY!}E5v4b^9c2PoR2Iw4jID_4sNho-sb$Sg zOHT^}kc${7v?<|mgOjjxi&{!(<@0Y0KQ-09&Jo}vNiLFgPYidzz{Yg%=Qokn-mrDaZ-g311}E7;dl|YqV45l1 zNLOGsEKy9bQ0A2Dr8ln>t2K?45!|$>cKLUdTj z8MS4OiXE^HpYe8`%Gm09j+e{W1`SjiR#plq5a)#J$&zErqmCNnG@qM<@rg2+m103K z4DOoB(s5=vZmgNEt3uOPJysn#TGbo4 z-sh{BW=72dG#!S~AhhZl+0#e;{sEKfrTp{;_Ll+EMwwc+BQWpOHUg-LEG1l!$mH8m z%fOiu(~;ILw1ZTVdKR8Mfelz>Iyy36Vjy^Pf)pusYPN?t3wR!&6RUuTK*xnxJvw3_ zIi*&)of9ENcypkp)fan=fhR;b8jVl}A%qMf^ObRPtxD>~<)k^q)=-$K`BhU0H6>Uu zxPPIiG!v3dFrNZ8G(iy&A*TZ~6}iztN3`yrwX4a_o7oK-wg6437XjL(0!$~uRjXex zS9F=?i(qcv9=ik@v-ji^X4bwaP=%@_1c&3QiR!kdQj{mR)tuT#gScUWA8VZIG(V1; zv{*q!)}FR@s%uh#LB#7KmJQL#{>huYHad8B(AhtDb+mu*dhhMt!ATpv-85*+v?N8n8eCf6Ddms zg;NJOnbB5ZnO$(2a+Y$c)N>f{5M{!YrRI(m==e*uw^2YCF;47~=2U=W7c8W?nXHAn zIcEiLtb5Q}H)b{OeHWlNIZ4$^Zzvwn7!J?()y|8^x#C@ghlY_b6oa!wK2EadkMttbc-k(drZp#$VboC%SiTi7lo!l4wc zIoYj1dX}~i#?in|Sxlj0;}L+V#S=U#`|#D$$NE>v5Od&qRG|sr*jc`27l0vzGO|T&nBxI9`VqTXXx?>_* zZQw(tpjRDn21f2o$I&^3L(-uM-w=WtBG}*t175Fy?*p_Qsy#tb!Af4$^LDXOJB#9% zF@-b*?sBaj7S26xvs!34W=wlQ!P8kfYzLn!!e~f9p0p7L3?XYA3?kKTP$T`Oz;|Sl zP?@jC{PZ@qxFa@*jTZ{^maY;zO7qo6EmXiJW$Y^|O2<7UKtHkzWeI6hGA9_&(*azJ z4SP9ZXi~_!(=@h3Zg+wnrMGhMnpRlr-=updNwcz!72igpC z+C*eXl1RTXW^vTuI>&qhlE^C8ITefLoN->9mKo167J|U_65~W|*ZszWsZlnH0ZkPJ z3YzB1{Ds4fj@p>xq8WJaU{~#{O<{2G`}X1C-oftvfA-ZBg0~<|<7q>7L-iY=a*>}U zA%sqre4%Z^D9YXht5!1_6RvNEXlt%rSn@+k;z%HpgfSCZ=nps!&xnMon0{fT#5lCO z-PAG@NL6F?IhJ&QHg;L^Z5}V+tWgX6Z!HAYI+&@&ZKNCzV;wl#wsSVC){2-W5??x( zuJral!7@O<5QJmF5GT5|@snC94sA8x2muQj3XDFZytQ zl|)F%U|;PO<&#en{G!k#SkU}D-cZh-yXNkh!pVVoIHu=TQWl4aAEwjk^dtHJc(Y;k zl=UMt&vS+@l}!^>vuP?2*GQ;Yw*1l6Qfi_rrqx7fDGhy5W=+>idF|wyH&?%l{FL>M;s|tXB!Ui-?Q}Yxvy1i7E1KwIF`GO=rw6ZYcVJxzB9&+qcI%zlGw@;n zoq2!zkY}IW40=KD$;S;P!$rT_rIS%0#-LsVlywI<8j-GP-O-IZCGY!x2sw?(%VCUV zNBo{)PFm=1A8Pl(7xbXocbw+S^s$|$P7>W%{-0MjHAQh77PTL6L-K}r> zLs4_Ld}>xuGh(4AC+h{HC6T6HuT!?y+}7?25)V6LrpVJh%LareL=w?G>*%H(ht#dW zQw#74A8$L8Y*a2J4WmRhQ?zl2eSqm!=&QBRdlK{-StMcng0bkgZr;4hb%JQoHSe`N z@8Lsx+_=Lc;(3qJ|F{af{X0N7()u0bs`tE~a?144>3{cvtzNL%**w*K89q~A9-DOx^1K4{)Ip&xE7(*pU4cd1aeip&vrnCRBBlu`R$j=7IXb37Er}>V z$IMAo0jC$4Al&{AW@<4wVwpadPBtNo=RJPBtJh}#@ng?BJw5e4`wBI`|JlzoDnb6H zw(n$)@gV_aM~rdjS#Qg4`}ys1zwi5P-_{3L-@beSxW$B4^3bejeyjDxJt$m&%Tw;; z!O$MQTu-+o4bVHY!D3F(X))}rXU|VT?3|WJaay4%I<1hZPKcaz>m)=`9^Lb{kgwoi%aVm_@X{x62YG{X0b90t)uPl_#9X6 zRpmRkYV#AMu`$Yt6NJg6drWLESK5s-c~naFRg zC_b1qGFnhnK^oCra3{ab63s_Fh=AM&m+j&=`@;qRbAn=CJ- z0vFB91eN7>SHIFMy=T#HK|;0l(sNNZH_zK2qSIVBouZUc6K;*Il+t0ypwkg&XJmSZD_}(OoW8gGRiMc+) zf50*vAJae9yOwLcS)R)#10B^im`WYu!b!+@BoMZV&=nbC2>B(G6bLp@P>^IJlO+S{ zXCXmMFeJ+f8K56b{wQ>W_*Q6TJ2Rw`bV4A! zVnXAXn*7n`es+~s7nsT_S+F5nLE-@Yg7tM+9LMZJn6w!NkYs3t%?*D}@@X;a0{B$} zEbj7>xx{Utt4-LrR(je_3>{N2RFWbALS>a6?H!+>?ZbWT22O(mJ|ZLa{`CFPo3#$V)?01+Zxq>j2Y3q(KJFx4JcP7s z>&19(*VjZ}u$bHh?nS@XLHsuK!^R$$))C8Zb23`D%c!ZtB}r>iesVHlYt~)MT`5J? zWS|j<4s~rXB{sDV$x>p{s^tDzPDDyVEn1)q0QjCjOp^#{sPS}$e_Mg~`=9e79mc(_ zGuh@}b(KK#^-J3aT(0_>>-ugSetydN3R0=x645KY)|3s?LYSzh;ux^3-I>cybw}0= z!duF9dIj0k-b-c{*ksz2Nf*-Ymx&pRr9LOLgY&Z%Wrsm}LZU5%Zly?=JMnsj$G zX5IPxG3z#~8LZ}wI~uI+eEwi{o9hhLEq!t;19UrVFlsBN+l;jh{sYOllNTOjH6*<+ zaeK2E@ITppJ{2f_GF4ps`RiW~;1>Dc?QjJYt0vSpE9EMLGH)zJs9Rh+Zink(Ewj$D zG*W896)0wQmomY0;pX5se2!o5ykVogH7b%b`l>5sx=vCZOHMT7tY<2#owPjfkSQg~ zaBGo=bH=u=2KE+T{z!0oO#dK$-`{%ew|xj+6`(Ptncw$&e%qgr3FA}M;>okkx77dA z_Br`IBSJ1{_oZ?Aa-4$-4!1(6YNsvFgVWIozNC|Eg2n`=P+(qXt}vIcM^F?GGNB~s zv#Ca(YfS@-(1p9b;pUHDT9lz*X0aTq|Yk`I{1VMr%d}jA&4qf zO<)~EIwyDrC8K7A7CNy@GXe~YNI^9o2rdj+5|UJk?gis#F~gDQrcD3SiRqAp(=aC8 zhq<`zXtY{01gE)kdNSrjj9DD{{U>c7@_yoYm&AB_Y)dlsHru`)a_N!C!jK5z0O+-S zNhgG5vS>I%04FRW+e64RI$i5Dx*fGV?|?-F+3$#Fc9Ds2Ori|(gw7Jb;P)2UXhej* z0cNkjK`k)wVZp073>mj4FOsD!W}_+kgC%4=>`?=%_Af-3+&~ZiaQOpK7MyGDar#f(a zJ#$pDlbdHpSOP3JIVp>7W&Jq)fZJ9Q-cjblHP_G`5EpDj_-^^XgOjL(6G^YSA`~$a zNpFqtPG4#VaxwmAp?iMg)LyWRs4QK8D#f$nItk!HxxQyPMG3iRYGcE_X(FVO(>CR# z?qa6<8ZMal{m)<8zLn!Y5oM*8sWN6lLYeTkuS)~_W6UGJ?OzZ&8cVfXZqC>SE0Y}P zE^m{sOqWW7gQSe;wAw(83F0PCbyFP%Z!>!3H_I!p8N!bVC)ZkAfkW|IrH9k6acrGB zkAM&ZVyMAp5>v-oNmYE9Gis>4kkwmk1= z9Mh<>zNK<@=9Sc*bk2XujTLOGFvL7X#J)0#Gs7d3vh zAoZ<)I+0;4y(@~<1HjRyTk2G?PC_(PRa?H=qrE^?L){-QP(5>#Q4ka&EWdgL+cba5iOQoEJkW2<%b>7k*16<@SGZ#+LVP$B0mmwh$1O{LM z&2&0KkwM9lJebizNFN#m=zvL6_$D79yltGh%JiG)+CMhFQAeVci3ImzVT-7;!}G>P zr?w56I~#(kX}(szSkQOPb+)w_{{}C@Z4RNK``Rd;FEI@zpT}(upww~Qlez@zRo~2Q zVqfjMHh?FK@h`iPZWH@*&o$hiHR28z-40ny!}aQ_rJm~NiQDl7o{FXo$JVg=kqXK9 z6p|RO8Pj@)wXh==N6184920$0L8p5+cRbkzQk%p8hi4`wDup;`2Bsw>-J?PohZz-P zG$8VVkR-p@i2fj)!Iq(fx5>oQAd(x`ld-Awt>(2-s?^h*z`fZgX2DRr<}6Fsi)M45 z4brLUq-Vz4+T^^2g|kHeb<)2}ju?|~seq!(%S;5%l5O!`koCGtXZE`6WJr!B8Qp@> zSn8=x;3F2tG#R~z5RWGM+G-(`C9gRS$>FW-$a8zH?`TaTM6%e%v91@@q8}w;vAy&K zClhgz#D9Ua+yT?*EO&puHBY(P3?#S>i|)I1BdhVK(0Xl-!7H;DnV4u7*lo z&K;XAemj|7;At-ChFKgZ<|?IHZL1$cwTG7H**_r^$wu|rcBe>^3FIA}b4S(PL*o>t(rL@zipQeP^dts+A?T} zEi2KgJjQ}<>l$OxL(B8bbQjNbu!y;q#*iXNImXOokmmT%tIT$7jwN10ly(l<%xXRu zQ@&Qm$mx;&m<`a7@jm*n9mhyW$dPL6N*Aapl*~Y3eB}}52`MEWi58ecA8;I_EV&`T zj)kBh*H}wuz{7dkJ;i(lbrmCdFq?F#Vz2t(K)uUM_C~!kxnrW`jZws zIX_Y&U~c9pF>vcK*I)>oedggfUB$p10NOEE$2;8ILhQ~~Xks=R(PRyrXaKi7?+qKx zkF`XnpM7ZH_x%gZ6aPyEy8wP&8;%;h#uRBx^|_Ntj=2GnLYM233{9AjP>7fb(n6S% zJ~}0wGk)4erwV`dUz!Y=N$3@kK{jfTjWAR@(g{m|3)V3e1?-mRz0JP_=$A2pbW3ph z3NedXv=<4QkPdJZ2rK>GylWDDIfs)<{pV~#59ug(-7*Mza^5>(D_X= zBtni;t<_KT&$EJXi)dDTTwYBjr!#oz-ylUmio-ne#_uZ#Q@^i9_@(XZZXwj<94nrC zvMEY?@OqV|WfZ2Rl_isWZ1q?gzz~dWOZzN{+po=1Vlwu%{giPj{Qif}_F0;9i}}^> zfB$sz>6ef0JQy6-8%^EN3BFEl*du%WMI zIMKegkRffub%n(@cB7`txW+|ZmIzmHcj`Upx9VQ>(tY?!PitLhZYPbo&`JZTFFTXe zvxzofRM~xZU5nFPs5@tIHX(0S@7h14{yN0#NQb+y%en`nD<|nfl-D%Pb9$>I%2S(k zxicGO^*WiPa=J@-po=`O8}EiL>&U;=x8RmQTF^hpnhx=n>9vmfv$u2(-nYRSSLO*x z#QJ2d1AOk~qqQCqT;*ioYxCycbs>jqej4h32o{sB_J&OHB))kc^Xq?X_MSX{Qmg;5 z`Q*O-$8CHZ-LUT=R9VU3{SkfiCzMa>fJRZ|rOpd_;t}biWqg;4wfg5rIqc1RtU3dsU_Y zG4EA~=Tu@~d?YG+LP}T~6Hmi2T;iF_=Bk6M)N}A;wVI1}Ueu3y5o~?`k1DCx^O+_8 zok}Y=?qk0E@4a~P;zdRNKkq$zb}#>Lg1Kmgknt7 zziSLi)NyX7ioLsQEc_Tz_6NawHHZ{Kt@M?$S5svGQ*Fji}(NFboC z7gKbCCbp!ib+m}U^GsT=9hN1sk9rD?PN$|1%nC2i+LworJ)3LP#5{xm>P-)=k@IS? z=ez2i?WrjQz(c4A6X+xNEZ=>tHgtQ|42|mN&G7gpXU=xhgM(p!cJpIr1G9GOtf2q@ zZKy-1({S$WAtdprk9^;-!b;A9%_3UQX>j!byN^D6G{~2ZqhKLbU5)Pf6^weudrfZ2 zYQT^~we3tY@DM`oUza{sc-Vs|>uZJOsjG@dfrst;WsmF$J0nRSNuCkUD|=!4mWi7j z)b<<&&-PFw^QVD+bzs;Xa%ZO)va+KV565&k`+%U*t-{!~AJOM8?lNvVMZ#sbHZ;Go zYg@0-h3@ScOyePI_5r8tKozIvl1+vegy)uef?;|KDCGp>c~ug5aEr43%mtr9?5-O% z4I-f!Svk0x-7PW@(r z0{RHfiq!J7H$0o(RI1uTRF*Wn)7biw+KfD-{ua51}y=63|c+qQ3OC z&!A%ph6OPTaco=_DVAf?Sihhi^iel|qMPVar~B&l++Sh~yeiVfT5+}eApUmIZ=@uD^2|hQlZbiyfJ=~lQIhVxFA*z)q#Li!J(s-kEkoF{IYDCh|Zi4d4i+c0=eCOT0+ zL1D&YT})pQW+(|q-xhTKHZVXZw3whU&0tAR%y*r`uaA0L-@T<~e30&N$v0q^6d{gj zGHP5h6PlPCQ$p#s2u<*%^I&r`Uy(b9@83%r(?5VK4+#$yhmMGn4A8f3rq7&axAfc` zIeJMu#|m08u@}wl&oiQ>9W7?T9dD)kyT=jU!#lpzUAw2Qw>#^C&2I?OQ!kD2A{||U(<{yOHFD5Av|}uf!5Ubmxm(b|YE;&OXu>)-x+*9$oXPQ4 zC*|yNYS7-vn>xa3JDDOS--;jeikXGgalxsSB!PrCUb%HH9vn_p+Bq8nSO-5P@f8~T z<@eE_9X(a~35z5`cGSy-Md_Q_wC6|ugeH>2U2Rf#aGcVFbOuJd_gd-&Lwdlk#Nl5OekjP7sli0 zZ+7MCb*GsG{6Go91GQU(CV9S2HIY|_%(IKy1P=M&ztv7dtxpHwwX^Q1F=G*;ZlJ8; zF`Z1pW$D?%s>osM2?uGz*)vz^oP}vLNW<2-ATEA2y4qW&tnkej&z>2g?Z7ycy+$tF zBDjV|;O7PZMj|K_%qVXuG)XfF8!VK2H~x;uzD|WE1u@nymNW#NQc-JyBjQYgw#~eU zYRgstE81Eni0jox;FcVnBho)q7-#o(?;;lH_#}obDPh@I;k+Imp?iZrXMf0`XQh`m!91CI}mTNXu zyDk5E;&xU4$?3TEqk~4unPh`(_?pTeu%O{~Cdam4pwV6;2~Rl{xhvDU6paFNeEcqV zGH%pcgRT{`5lw8DdBtb7w*LOhiRLr-@wW@9NeXJGdNN{c6q9^Dz)FL%gvUAm>Zec! zP#o7BYY6G%-z7k#gbTH4ZR@-q;NgNF*_p&kydO~x*28o=rS97_3g^5H){mu{!+18V z!2{>HmeU#_)F9hVX$fdrVwMUo*0|B-N3X8Z+oL$BF^u(w6+;CAQ<})kcu-)DF2*GB z9wMB-EOJSki&D=SsbUM=^0-ho3pLHm{~4J&zS#f}TU3HHNZONKWv?dT5J1M@v*SC&wUnkQF>i5Ht?1x2Dl) zdQWg#+vN&3YkdQ>xg3m!`H%E8`+ek_U;{Pb9W(iikGlHLhkjc%*GXfMuM<}4XVz2X_t6Is z_&%6*O89?-1}SH$(k6-U`{=W7V*POWlR9vC{H1N$7tY2xue9y+hA!cGe%a4?=ztk8 z789KK`EOs^#k-FCa@PCGj2$Waw(R2kE*0we-ye?MFkZ2*_w(-LEe z39Jbl^EA(!VIF>5IOT30j^=515k-~7XagXw_imBpWA58+_qPd6-jHM@$G+B=>Tn?i z$dc$ZGH^APW64Q3N1ZoWf2C`c%|mb(e|6;f>FkV`Kjaieev-wp|FIFwO?C%344w6+ zCR%AasU(wX``Lt>Pd*2QhUatGpf(KK50>MmF6Itt?!cBA-ZF!95S;nz!U4}1wgdY_ zzkf6M4NvROs!z(_-EUu-7k#{d>lUo}lKFa*C0sAka}6D*v8c~A;8bb=T?0bBWYBd~ zwn~Yi8>wj5*;m~Y@ugMmMp-=fm2z0q72c{uI^Br>bVSs(<|z+ay5SU+oiX>TDR1=k zttL10x@n?HV2YPah|RJrt{teiX_=JN8SAONj!p%qDA#!rP6`&hSW<=NZ1{eDoY183 z%-e-4ySuNC5avOtj;Rp}oMqe;3ZqeYV;E<$Iy;MDEYv2fPjFS!XU{oSglXeSc27~4 zv{=OIwjDPN_J;lg^y-Pd%`kU2~gjgP6GTR-n9A3+8Os)3I-A{t8MV;^lm zlxNUtwa}jsjQMxLk{0s0-$ES&mP2XMN1xid0|npo1P#nn)0iZY`twfK|6=+7DL)ks zMl6u&)$@TYkpEjRdRt}rzt!8?ypR95m5<`T?ql>ize5Yr#lAb|K6=~*#s+59HwlX6 zk>5b^bLM{(F$pV*CK0(r0Y;nkl>rT4CH0CQAAO?Y6DKm$i@N_(-y_?_A8#m z?%?)uz=wD3z}=x(I;-FP<}OhyA6XNTS3X92YwQL??Fx_|&n zGx8)8@-5*bI73oO0I|PLh=jxyIe}oYP?ns~2@w)c(&{=u>i=d#Y~_^Bv!nUQKkxa- zKch+HBi|7ntyTjbvyoi}H`5e60B9y>SYp32F)I!Hp~znFflUp+7~~tfj!nY!wZ#*iWPxPq|UAVOBM~D{qo{FLtNDioUmGCl2RaPuw>x#o~(kSF;YQ z%D5v~?m`o3UjUG~~+_1H}k(wKs^F~@UsgJaIVjS<3 zzHQupS)qd&@Yg~HjV5G{E44Jw;o`9`vVnfOXv0b+|Flau88+-!8lVA%e7~fq&o)0R zvTF%RbX|(pf7kO?i|=n;L$a>eJoH6M!u$ss`f2TQ_*#eTz60Y3tPEG6*XUL3r8d-SdierJ}<`|6x*+pW3N?A@@%So{cL6z zoV^F;Xb~>xC_+&MID zYWI!`Ewu7WHP-21IpKHQ^wI*UH8&usWFpLJRgW`tsaOepuf*!-E#0Tiwb=pz^91=b zli3xGXEs58Ep42GY%K#`DKyG~UXdPzCv?^%GAXM3M*CO)hJ4INi!t;&Cev9kq%nbVNlo@n*F9ir&CwSf zL_l@i<|6@Xc^0>dDy!=2noCWso`!w%!lHRCXAQ5&0jJP7GG#y)&tX{hQEt}Etg)1- zUu!q}Kxu~abHUJzFTjUnJt2#IdT-Cw>E&-WvV zM|lga6Kv;29%|m^4JcY!+3F-7xn3Lv@MXQp4Bs+TfKa2eK_=gb{x?;vI&dn1DEM_Z zcq3vq@xgU`Oa(gKCUi7lga4Y&UNr1gGGKjSeI;C2J?x;o2!Uqv~uDs(13)<-@7)iP{}%~9A)kVoJip55~qnc9vQLrqGi)FPTW zyD0RM6Uw>F*)eY}2lb3h9m#vM7$TU)tF6nF2|))j`Pnep!f6Fot~>DdlJlQ2_Zud^ zRe7_*?r@DYa8rOfz^=hvI?ea-_VJrfhug=;zq~uz{i--^b&lW)E9wiu9Yx8G%~a{T z+xqR#>b%UStC;1(qjx9oet7@t)9d|{Pd{uQ@9%8CKl$;mIq#O%oe`Ctfuc6fB)P1X+7 zrRr$nepU0`R7+%q^S--(w6}Be?&#M~$9qRV@9*qw@9eyLf3WoKUm~K$wPPY%I<~~_ zZ-OOvu)7&DLb|loFPr_7AK(A*7hX0%)~|8d==pA_pR>YgFILUr-qG>9gY7rlJ3D*F z$0zT8+B^6w@_{9{TJuDRj?}?rcghLuOyZTV`*%N`Z2xsvy&~yXwc25hYqhRcHqpg8 z-#*;`>n(1W?wq1;Y( zzoUuFi(uQ_xk0)T-_p_E?&0>q?)Inc-M9M(+lTvqHOG=AYzGJnV)@QbFYA-NfkX#)Ru&uV&6T@+#c*AAE54hHhPTZ= z8=RyuWb^q~ANikrgZx@1z$PvEO2pkGorJ|n_B|%?BoJe*TP;CZ!%+(i7$2u;aFz`S zPlzNUpsYK=2_BKCGniJEfQfxU^;Ck5w^GXzxkzhmM%K{txy^jl2=J!as!PdiEEelZ zY7?@_ge4}g&FZ+cip?!>>$3DUbg511l0J+jQ|Q#d(?m#|G-d)rtGpNP%Bh?-;*M!9 zIh`D5!y&yyeh0p1Nr*O{Ke5;SAKj|mc?J9LddA-p^`D-+sM&u{HaG9>zuWjg{inT4 z#RE_w2b54#kqB5K@ZJkuQV5E{b=AL}kR=HTC1nXD8Y;@^RM%kH9+_2Pr%{eH71*g% z%<%yG9qrx3$SUDVyPu-pGaS<)B@x1D3gZgAUkHNr2JIz!{shJ-(13(E69fr1A?T-E zSZQhuDTyP2FeeDA3fVeYRGEdQTA?`>A)|K`2_?{+@3{C_a#^L>9mGEVCJk&b3Y=2auT_X{4nF3B=W81sFjoebLOFYzExyOpShp>h0~@lm+|~YTrdmB zoPf?Iz>PCKFB$$iB4zvuO^VTNG_8E6MV_OvM3d&XiWbFNc1`3m`38v%?@Iq$LjR}9 zh!e5C^Z%zWp4ZR+x9;n|-pXf&{$I@bd>de2xBF^!emjmk(f4IMucng|QC5m3vnZ># zb5LU@1a=au&sClFyDiDEwu>xlvfuY3`27+pL0-AO;Qhk8KGop5N zI~kQ+(a?n{%~U`so~rLIlx3zF4l|duLsBOr`#M!V)6Wu-!P#U$xT9d$I*|&3lk9o1 zS$SPnoyQQ+VyQK^T!!)a>BSZI%~s3J&xValA*PDkeMd9}g?zfBVAFLPcy${sW;pr* z$2bWIce#71c`;gezG;`W^@PX^#?O?xd-k0^-0%IRjj!f{R919fwJ?>F86N;N)L5~g zL#M`y!V|VjA6BSu*Yb*NjV1K|gh_G(?SFCn@AGH9+WGH`r}z5*ZG2|v|8~w7ME|N* zUybhn$Q0CZ9PFpP0KFy>&S-H8_PbiJ=>5?fG?*fuCD5N76G4!Dy?@$xm!@J$I1we` znCLK2v+=pc$VkqqB4g@N#w3{?s_K{n^-3}un|Y1mDmn%mXL@E_XIV})T~_nV=U|?$ zVH>sTQJnp5_ZtDBjbLCkxS4f58mzWeL8%1bn^1i##uHXp^PB_pwmh6dW+u()M4m1!4jw@<$n&;76#g= z_^|mAijFDtzxc>xy#sJ$(H8z2+qRudGO=yj*2K0mv2ELSCbpeSY&#RP`{myI{`KCg zSJi#0tIz7{I^DI`*?aBv`#vN3dCnp?o@)QYN%#A|HK5nT8ezps81PWyl$rgWEmW9$ zG%BC+dzo+dBl+AlSof%8`x&IIIq%yyEQq zc4HyEW?$}*_W_?+F8pKc>$5%1WQlF{0|tr4s5-Oyn6=nA@N+#vv}*x(*4fR4USb8S zB7;;3n9-lSKHXMF+I6Li&<&J#qJGd{}Jv%a*DKj?a#C3-=lp^ld zh%yJ~=JytBITxqmSLt4?%`&nfhH~a!9H~#2(YEg_kxRvUi=@!@g8Uqp#Sxeyu0F`u zBxbvX6h#(g-Tii=RF%T1>8k^H2q+7ZnF{Nv#UA+8fcyCV-Rs$2S)xD%lhqW{6_sU} zB;Zbf`H88JOL~Z%AvtS=u>~k*Vg6;(IgAO=4q)<=@7p`6KMS;k{g~4u>+1#O+67$N z+4p)Hv;y<&w#NdtzX$YJ`rMl@_}$tTD^P}^-#l7>dvJZu0h^;w=ZA9O#IQz-;{tVG z*KOL(Ax6Am5n^1jC9lHRD@k@iEVV8>@14z^xdA`NFd`NgqjTk#I)B1NAJy!+epEm> z1uqyzjlKsXUNp;(d!CY{fDOtmSe(i?q7${b`)y+;Z34>`oSFL1<-q+dI*#hmx=K7{ za0QOazg1nFw8Ouiq)rT^x`p!-oUA44Z3>&^A^)=NvR*>h_&QBjfHR|4>X@fInYgkf z}Y$bk%SqnV>Mn-BcQB7M9XqU*BwMMZF0B5cTQ zFQ0j3amYqa`I6OOJ>9+&sHX~bu3o&H@als_6+02T8l)(ibU{^ucYjw$kn8<^ghnM# zYo-}4s_MO~^5W8*U56C!wQhyI-~9e%|Lc9ZR7v}v0Vg%$Da%=nXMT1r*NXTFF_ZNh zpt)*J1t54mXsG%5@;92A>E@wtd%>dYTjcPK47vbz;!}n%Fn$k0>~}u8FN{S)_VdPi z;hRoRZkZ{!t>@`hfxHhn1OeLry_5?&wH`I^|I}iTG=7d1q((+|)fx2R=wDAqb3)U9 z(EDQr!y#9|6X-=Qb7x9*1Jys#GG{a6j-A$W>K6Fd%h8S9XaE2-t9A#pw?2IW0IRjW zC%3?n9Hvqz9EUm0RE)M1#O;x$EX*FS@V3}*`E@t6wAtStoNsLD@gzFX?i{0IR9N|n z1?s={T?zx_x3sw%?Tr>T`8xqwb5T=S$^w~ggcq~wWmJ)#moJ)W^P?xUifQoGJQ%YS z!34l#;XF&^I|dRLgFi2V+v^s%U&uLetBSx@A>ii51;3BVU!XUW0iTakJ#c&U`_{y1 zBnLO)#H0GuY|AVkNin#se9V^HS!}(p1X$lz1(M{X25jprxYxMrgkJT|<5~0seaq8{ZP;)%9;$D77x^yplUHEMs)UkJLFc2?foWt}6#| zfwQj|HQDcRCQ=Z5mYv=fw7$j?3}b6DD|5Q+6E|~b#T(a@i@}=>l%cLm1Hqmp1+mu*$}&Zy&39UT_k8a6hY#?j8)%@PnfBu z&Rp52k)LaLGRFw8L&DpWFT=yKjo|pddWiF$f_OFd%EK|a=9Rqkox8u{0HVp3ZD49! z5ZR@WnBrOYhWRzt#V2BBjXTv(YcisX6}&WAi-wf@74%EiLaTopCVQ)FDg-o_8>Tz{ zCy2<9WGljj_|^GqjIN!^)ai97!}#s9GC)(KFdAOImrU*kA)cNQq?({c=XxxNDk;X( zib*K7q9$8!4ty0Eptlpnh<{|gE>#|54~9*nuH89c8OHg^%coEo?YrYL?xiE zX9njdmJHKcH_u^59+6A>Oi^q9x@fWs!4k~Z90GOHB<*C6ARdAVfi^-cI*gsK%MQz) zO)i_s=tP8GZ)givIq=K4`Qht3PrlZJ0A9P-{Q;#<#P}8g3IN}a(@Q}`0N>{W^>;JR z`>DT~MMQs%ei;NOgA z94`R1E`vvt{fp|J%DxY4OwxdZ;u#~C=I~EeV!KBUP8X36hZ*pf^~;0IkJpmNwXfrb z_vnv9MGXIKZ=J`=e7>)n_2^Ua^7sAkWR&;Z>w=emcDfq?tXcKxeL4tzm?ZsN-t>On ze%TG^d;9Dv*PV;T)(z9IPE$q=OqjD2aJZ5yZ~IZk#I;W6A4YNVv+$UT|FIksv34UX zV0ad*<}U-c?3#EG#-CrMU{l*ar4~}aIWFbN`~DD)rP;kca-iQU*$K8cU2}!(>Rc{X zT~)-2{1RYgcb-Z!serPlofvWckht-tpzvT>coSf7ZtY%)(xBJ+q1pP=_-i03m=fwz zx;BTd42g}BwWXV8BC0CKG68kw-nh(`CNi{2%n}7^#@Q$h#!*75SeCt8p?)&7#m<^T zhb*P$ba!Etd_O5*XxjQ;#o~nQV}yaRxnFM?@fMGOdV20o(mkZoZL!1bmk8dL)F6h} zQ!i@io&C^s?WZGDhq|%Pwo;528jMK3z3w~Tn`DZBVjYcN-gJ_{lrs!Yh9x;g6fq~2 zHeb!P)QyhL*t6JS#tv*a-Mm(`GM$uDD{Ge9aZte7ieYEX0F~t8hr>O8VQH zPF28|R?<5yV>Ad2QuYWPP6%K0Ix9+^2VZDn`Rgu`D(Q|C3HJSS#N&^x*pRckYBO%6 zo}KI(1H2TY$goxFJdWSnfg2Cu_ry|_#D!co1g{IAxbWA&(~3P*rVYzB|M|8H$?Xr2 z%@=D77|MXVxbO`TbUpF-F?0YIeA>Q^4uQ`H0KjRjZ$V(aG?mc>9(qgefur0!GyWv} zG_3bX6UAa?GiO`8VXIQv5t9k5a7;1m;V`^588@L>l9L$=F$v#6h@2Fec;GxUDagm( z_BTRIgtwSc5CQjv7C8@@YKk01XZX_}>fFi+LwSWZ4plxZMv)CJC+27Tav5fm>*Tp5 z18SEP47O<&)J`N`|3CWZ(D~G?Lcs|Vm)g-C+zQ+P{PpCnTBD^+B}Ctci^x@yKjG{?0V(29;p&17h6z)RYk3!`$>L_bMCRrp1;0-Hnb`sDG{K%x))DH&- zWc`8W{jU`^&?|n;ea#+@-K)wO-nYpaFu%Fp_>1*44LPLQpqYi4dzF?Tnn6|N&|L>A zOC~B}Lo!Y0a-)NUuxROIl1I=&(2pF5i@!{XzZ(3y1Gb+1*S||~+aKtUQ_l+v&jS;H z9cFKj5ceIztDF3*K3*<~TZ6*uV8aE)59lsCu?hn8xN&nhD`#9uwZu5F-xk^Er296fkF|X7#;;OWIDI(jHeC9pdv6gb(`u+tWn?g!WUi= z#NC5sN#VZE^RnT{q6ak^4S0V9(0t)%I#YN9tV9XJ0z-^FHcTmkyb<@0x? z1Ka;~{^uILzt>P3a9Sw|TxkD2a&L%6`t-k|1g3I*3nD`ju*X9E3n*RR?)9JMK~u6J zJ9m?et3V1FN3pXh?0PASMafhC+ZZZkV#22JW-qr7A`#fU1cBv|`qC=Gll3z2$79*@ zL5W^3+{NO@h10nTQpxN5vzHj@q6T59({c4&GBusPHqmS`PN9IJ5Gqt@3h%02xBE3~ z5WqK{DiqUYIy(C)pt9yAGx;dYK?9qo8m4d;LGa6|h95*ExJKX_T!kvDH!LVNEL<~s z@B%M0j`VOOLdw&q;AMdXeF?OS4Ot%dyCM3n*82Tg@`2zXQ3)A)PQ-BG?KI4p%CHxN zO<_4JA)KLXza<`NoO_>0gtk0Jm3up~5d}K18oc7!#;f1syF8YEGRN>nTu~}4343@n z>i50pnLU@Mej)gn_u~Bm0RD#)4%d?Vd+pdqpZUK8}M%OD*bc#TM|`t`WFH z`41x|O0Bpgg$H9P1j3-f=kr{PPV~^y!RO`L;AdnIYH~8$x2_f;M`i=WSGP+H*<>ho zOvTk;pEsYu&(~m&eZvnUzKg1WD@~_7S9l?Cf;@BDiswNef{5s49|DBC%onZ%^e4_k z*CT$w?vCgq>q&|^*!ArVERz)X$NyiT>xEto-J%wlGfjVH3V08=FIlbL0-p14dOI5e zk2M647ZUeDT8hhwzN8LdHSKBr=0%bze zg7nedwh%AvePIh~oHom%528XDW*j1)BmT_3^h&gHHF*f+pp+T-gKTJFZaRdha|~ri zoJbCdUpmy?@+uwcO?L&+s#1cj*ipt^zt0F)QDg!i{7jY1e1^Vdd|U!o9B7cceCE0G z=D!5T%e4tcu9jgfE!!M_qUY?PIxWmt6stO# zzZm~xJJlOX|0c9WF8)JktEy_#H5X(K>nzfs%WS`c;Lz|bcrl&v!+OWs(EdM+cI!FA zpOc=nQ-0rwI8sp14P(@Q-D76~dgl6o|4`cg;&(^hJBr*Z?`My@hD8PqEASk=+2wyY zo9R~4!_UBpkgP`_1!FB3^SpTj0?969cw@{PC$xRIV zBq{ZG-Wh2e|EfRXH;aB>8jfKzSGJ2tvKS^TfpL;cPJH@NYiyfJWZezwC6uL`Sj+%`P6tSNR&XSvYLk~e@Yaz6 z^%a&;5P0=DY(`!?3r-`7$)bbm&fAK0TXf4v0@Lc>}wFdo}xDBBM(xtxP14*!eF$*1>|;fYrv~8a0ap;2%ukAliMQK?chE*j!0<^wDZjYA{DB`Ey~A< zqE=C!{i1&otk>em2Cm7a2eFIT^{QMuflYlOacHZu%AfYBz z=N}1TW>x&%5{9nEVrdfK()hgDJ4~K197h5*98`4bHa`NoyJ(Q}DW@S=tEgf1Xs#Fi zyAE;{%=eqqxx$=lk@|zP!E{UhTuZ^%ntqqx0Du3I(JL z`p%R?>9Q|gz;=uo4Xr3ej#rX_wi|&rD7k2pt-o%Vd;zR}0h(ZpM%Esx-W1fbpPkMo zop#o*h4P)}H^?PPGkEWR5S@i02(eT|m`OPl!^!o|B;z_vrc6`}?jdC|BMpYKP(e9T zxQoW&gXyQZQihA8cX>@GOXxs%6@|G*3PO6BKh5TUdX%~akmW^@UF29dd0GI;835PrIaS51G+bzG*9%fEw6B6=L=l-#ZESamu_B=I_m=gSGs~GO!$A zqrIdEdJ>TY1-v-XnWDgC}5uQffQGv6ayFMSQQ<-;Z^_d2q50oXY!y~ilNStP_`wztpe;F?G1!h=nG}yk~P1_GLc+qc8 zt8Vp~G8ZLnqNuPsvwopW$5Qc!oh&5-+1R%dotf{76i>lv1r%*`+iF>9%I~=`lOJ`L z1UH|(@zNQ>X4JA2ohko==QQJ|W8$pW{D5BsSDtCM(Jw(YS*9m$?8rmbT31yIRfC#o z!ap!PO3V_QK#;UsbgXciC@3l!AjrBG)kPMH{z`L`q7(kOn-_pE@31$(j22AKBDo2! zqS0f<#eUSt-lJxnSHq_q`NtUfZ&_;R$z)^RcI}YTw8WDs1J4OOKR> zPqyEzj#p!MWIgtTv*CkM$k4$zcu~y(tv~;OGB3`qp@id2~qq6M=z@1cH2Zbxyj1BGy`AQBfhUt2XyLxZWQY860Wl*tB z!yZY#@V2!f18V!8@5f;_teVA3D}j4w!9bQvS;htV@$Uoz(Fzhd9syO^p$3<`R8t!i zLe{PPeTnu3MZuEj3Er~1vT>R% zb%)tDMTcHxc{utQ=V+d3N2*^BQG)5mkj4@0U(nQYqIZE7tRa461OS^?eeNHnp8zjQ zQX{K z>j)DY?pxlAQO4Il==)q*i4BvRxQuskc7qEOBX5qNTTO4_!bE92O#?KpL{q9!Lg`r+ z1!FBRy`1d_icIheG99mBgP;rZXvsvVRzgCc8FX2JO)b5eb6X z*=-^yjG?{e8HQ;ee+^QDaeQ)%>4qa0gG{KzOQrP0*{@UOoyBYq~ZOZiE>Q&BgW??fs%rA(=$Ucr-F)( z@4{V~0taRnUdYo7(9pK=E~A`g_`-9y$*?Eiin)l*w^ks1_I-X!62ODUHEVrrDZ(C& zsRtsi2B81vO+hS7_~dw$S8zL2UbK)YFvJD2W@pSc1Mzhl+%7;FcF7wz2{!)S7_T4gS99De zAW>ebFRk(v&RB@Y=J;>FcmE<-vY)(g&iB`f7+O*jmh#%88AzOOSU z`aSL!8&JJpLvJ%q_RKsZb-A0+&`EZ#@(J;By=fFN3s5(3AJs2GL_(CCOjEF6hz9+Z zmM#sWph#m|?tpj~-+hfAz$QAP>E_$ncO??aK9u-;8fb(tE(N7ovgRC|B!$28>1{|JCek_X@uzyFO@b zGkBth0UyKxap=48y$t`{`bl+YIo=WUi(qC0y~aiTsHkdLHkWjTF)B2th#6@vaQ-w# z!ZK)XF9lrwr+i@glRPH}DYogLbYL8&{l<-E0OSrhk66HxjHVG-`!E#x00(g-+ycqI zPJi>!F{g+!98BwibtXF|LH>ek$9@3$JY=ltaFS<~XBr8Q*bz&tm6SPOYb3UG2nWx_ zs)N4+cRxWx)YZ?$_SYDgp=dBvh6)9d0)~lxpFnY`^Ts0*Yojl?N3C}IVia0LR0)aX z7)v$G16eJ1=*uRVVuN$OSu5vXlhv5fK!oQr`YLBf^7k7>)Sq0?_*zmz{iv8 zfvzE-m#gnR;M5TCunKHl-}JtJTz|mc^}F@a5z;F{CWcm(?uI65t`M<&*hLWsf`<w_f{MZm@# zeu<^g2(9F;aQOxr@p!eZvxaCO!mgqKUcucvG#nG;pIuSP*Vb%{sefb~X(pH-VbhIK z?Jk9tYgDN02e)S?@Y*H~O5E?_kNG%QCh6lfKAkeLMXrT57{*KEG)a4pXR6Qx`PRAl ze(mEX1^_&ronOfZQ1=fM{g9V1GMD+1qBAFK?jKa=__U1irxXk4^x` zcCsDXmCd7vcKiORE-SJnxJoL_1iw3XnM=2s+cZ(cyY4C_$*8Pn)zC?&S$RXE!MKQ^ zkq8BXz>1=={G=p>_#1V~2iAbBJk@KdTTF%gwf39UL#Uxu@aAs~}W=}oyWC=vE;t>arbi)J^q$suZx z*?r$i#&;kc8rG}SRE4IQEb=z|!>Yd&1ia~#)<|ay_$X*zCv(7yByuMl5s3WgrUVK0 zw{oCRRHXe;b;>OXt^KBDy4$IPc0ytKTj^q;D@ z${Tl~kwiFHlAL=y&c!!Shgf7;YU^G!ut1M2?I$Y(1Do`pos+l<)KsyHQpGh#t4WR_ zboW@%>Zuh^`wa&^fG-$p)|n(v;gg+L{;LUpe;8KD8q#h9G102!9S={ndY5;1f$@un zZt1gl|Li@83#jkE-8hsb)UR(QCS#i88VVdTJK2~)&;T98;f*nuB*VlYu2Lp8{EIq7 z%UY$qel^psmrWxiQrxXT*f*w7>U8gasnLta2g;1IU!ym93l_Q7BJuEZINC^+y!}hE zpY?pd1u6qJmvph-sjIs?WY14XhO2_m^r)N&V3L8GbZx*TLCLTBG^K;zD}B7jz+sq> zri%dO17*P6?y<)i$|Fh>keCO8KL-p%XxRG>4pC1DbT;QOr<8IY*Ejt>)%aHJqsiU@rT4@QC*s67!qQ5emV7|1kYjzE>kS$fh z|4M1pfbU4}ZwVd#Qz@R*P*d-Ps0Z$9jj@(Al>1!@;A*%3R}Z7zsQ$3g>AFhU7%T$@zZ>Vcs5Ew`&o0OZ`xbvf7I_m)HnhGl6w2;%E)c-1?#3}_q zw!KY-f8hz;<}R zoET03F;qgW8U#Ez4Sy1DfB1#d!EzndeW<9fG{$gMVdkS6ms(=pL>%qpHn0Q)kvf@K z%3V9$j&-ylGV zfPXOE0>}aF*<4)yI6`W-HK}U-yV`3Gf3lC##TCg>lEE)kVzM+ z2!nIl^y;S2^0%bdxv#%B$e-%(gZ*by^dNzm+Cn{|Gq<91ESB_n<70(}4o`vik))Nz z*r27eL2CLW@{A43#uczps|n>C1&L zmEmOi8#HYJ>hUW9ODxloZfIx1gW(o&o643b7h5VFIyQb32$N5YGJVvnmIsJWJOq3P zyrMEkP62+Hb>s~;BTCj)Byf(_Cj18L^VBb^qdSC|(or^O^I>EMxPoT?83^l);7^Hn zPS50u(xX!pAtyo2ej>+oagekXvu6zTDifKk8`Ka~X-GF`)5%+{({mFz2^$l97 z3z8Qy>7e{(E?9r8OlL!}`cP=;v9e}7BFkSeMvF)GL#%cUk#OlyPx9076#V`g5?q-a zUTl+8x8+GVBjEgna;Pz?ehlA*?3#?(>SSd@?NjnDaLSZ%B)ggm@H-8+6|Tbull-lb4T|n3y=~DD`sykTHWgUj9!(GAVPN7Siw|#T|8QFHt57mCETEb+4gsh z+s)H!w8#_X?X&l;)a!4u3L9FbX~Lj_zU!?~Z#FQm;v6z-NC3ri*0 z76WLOL6~vOX;d}*WIgvC0+zfZanV;ir^lAIqAN>#p`=y)u@tdEPSSWnLMRbq$54Y> zOOZ_Hlkg^R!@ggEcN71T%>>hY5*n3PCc;Cp=gN#hbSmogngnOMOJ--=D!*SP=@~8L z8^apzMrD7QprNg1euu6;F1pZ#N?41?oO2uN?x1y=&AXdK7{qGy9wdOz;V+1T95iqo z12b_LHwC?y93`ThNdU!7q1MS3s=Q$~9KoYROu6_aQf2n{-LInmj3^2Y`{g5(Gux(W#m(o4I)k8?ymajI;yVd3m0kTUi z+sZVw~mmLE6GVL2uO|{YrZh{&f}=+=Mhe zC<2#arn8VxYP!aXYQfj5-_du(Xhz{giuF<*px;y#)AO6ywD>jEVqCG zUIDzVl7w9})O0TJHA;?}DI<>S_F-k18&>+D;CWT%;hs)`n6EAER3|SjvyGl?xP&;w ze0&&kL_~K~K?1j)&acRA_n79bTigb&rf9CRD~F*9%H+*t}$1{QDd8y zoq*Rx@DdCBpe~x}POrAJwAS+*?z*?YsXPQq-<=%|9sLV48mF~WLWD3dW(ViBj(#K_ zpy)ltaL}GYa~(fIf~rZpJLj+vU+0*xv$_-V&=szEY%u|%+^t>0#@`nK3GM_b^RDNH z2iRRllB-zgu%JjYU+=jH63L8;C)MW&?A+va_Ovy53q>hY&O-h@rLh$ESY-~@4fLRO zxwGH@>>LncyhH+O;MEPxYZK-T>{V90H->`3ibMy-_Y)^dd^rK-Or#NW9&;RG$BbJK z{5W900iq-pihalwJPEs3*81T^3x!I14NMpaVgMz225MI4;G{fzZe%eg`kjxY;7RD9 zb&0?9E3CCWf;h;pNei!!`(h*lsE?4{0*0=9P4wROSuRL1)3vV#ohxdYB$CVa3$o8q zo4nqT$wPDm2m1pUe)!xBOR6;lZd546osd<1Jc{MwpPp`@b=>bEkUf zb7fCWZVmQLSZlYdbZspf;b%g=*xW1A95cr1QqZ0^8{umchr+H@%#T_qbK%HGlz09b zRlG}ApHObAZ^PCPEy*rBG|`Z2c9E+K`tECY#`lLmpzk;&wf9kS@-H3LnIm^`?AYD7lX=S0uUt!u zy+8uiJ7S!?uWVq>L0_uQ<_38CtRv{{>h@!!D1aD^%E;xDGpgvDBo4^mHAN=>{Adiv z`1)ECg$4Lu6^{4|K0Au^5pS9vy_ovN3!^|>lRfIb9~eV?pFlb2CHC<&-i_x^skj|; zhkL&Pzj4bGfI(Z&fu?H;8du+T<;XqxSyrz|k4)PNQqbQ=LZe^lMFR2JJdQcFQU)y& z{we@-1xlTfJ>a;ooFp{=b9c2oLA$baI(K3hBst?#5k^LR%0*9I2^d1cnL?K?E?m=; z3NTUi+RkUh=0}(=kYUx{MVa;_i5=4*Upa;XqsMT~kbxvvk0|5+;e5`gdk|U#E%SP? z)4ji4effjr)*b*gQdL64DI6gN*wqf}+nN}M`39Av~= z!k~+Cge8<;)RusV&MQCAf@G_6#PVfZO7=KqD0`S5fuo653dt5DV5ekqZ32Z-Lc8*q zD1A50o(+}in5-|HhJq0ip!uefRo?)K3^82Rhn5R0cXE5&yS0~j&^GRZShrDbk~aQJEAa^@jjx6;m~O>6v^uI_7~7CWh!zR$ z{#Zh~_Kl0^3VNAsCQXPGR_Z;!(x4JbT|z-n^ArwEPFNg(haw7L`a&m`*}*0}p}u}W zsZ0s0`fVM6D*#`Dtvq9(gjv9+d0Zfor+7+AIyY&mFk#M;g6CqJ2p(X2ql5QoPXg~N&5gkk80!OjH|s=iZe$>uJ^QqC zi6T7Lq(90s`t4l`q5}sZjM#;Eq*mn39Q(6VEo<-Ml8<##-NwqCMEDn&85K^MgODly zR2}qtI!B)cBCA{E4BYAcI4s^Pn}=3o+aDx6eDx}GD|zGx-1J64S^VDFsI7hOx^)}g z%0%6FM2N5;R2nQ~1Hdm@P;I+r+=p5JDAM}WcQ`>0L(1??mm2tQaX&RI# zhdYvz!7OV6^`i?)_h`B41e%TC?@xbY>439a3fA+~x6N9=%DT=_mG(w~ZLN}}$OC&D zi6)^5J?2mCK#=5|;hFTsJ#II%X8IAo26iqV95#N zvaX>QSDx-)N87)u?AwfdU!iKklsN)FdtL94WR&*tfIEJS%!gXFqB@wNmJ1%CBc8FO zX!6L|+9I0DB@}7v-#O%<9xkH+t|2NJi>kT=KaB*=MJ+@Kx&~T>S|QlK1s@8N#BQTl zmqVui%FDyCsCZ{x0xu#PCk~ zBd6Wz&Qa<~&Up1bafV-&BS z+Y`(Wk$F-B&0W*0wp70hTvRuHh1>goSPRMgIW{<{Dbx^oS2eIic{T=YX#Ri?VsXe_?oD4!|?bc(%LlSJ0QfITfx%6z5HbIB^PS z_c{{1{~ncxvfPm$@A_8(KYzP#0Eym!0LK6Qz_*E??eK4k)G>Xv2wDeX=O|LXf!f_m zhI~?x^96i}x}dXbZheb)pvUZxGMd`8vl^t0BtqZQTzilSB@y`03xr^meQHry_F|e8 zCio%2ErZX6AaOyUYvsR%8tzfGbg3?oT=d5W)8d}V|pf2C5BH9_# znv7LVMeADdv_GJsMk$af##Ys!fR>tY$foJBswYzt5JRSK{(pQh?pXxe3~KF>fZD0k zeX6i~xoAExaU7iAcvZv822i4#(~^U*0Wpa%lp-XkLSNQVHKy|{Yi)|y?JiTG!Nq+d)^B)Y0SgvD$fpJUqo6eKUCCM`(n()zs89QAgbwKi9ZF~}(RJg2 zg(|-occ02|ks(Gw=-DU2gz0teL33lO*(%AOIJ@FwyYOA>O6@~*6J>Cm84*b;3=y{? zNu)2BPC%J_RFG(tR9PebJf#4pPLjPimh|O*YdB-HO$Km<@g)KMfYaZ8*|M7$XJL!k&*Psi8uL{h zLk`J|9@K#sR0C|;MoBIi@%S~IFZ^*8tus*?nC8YV?HFMo06)mQQshnUO~#QnX!S-c zcLxH;Po3?TuAg&5vBG$vXgqv>z9LZpA4cfF-(gG=>Y#rDtL?Yk5%f~0qqCxmn6wsL zN?tDo2V$+eI*;wz`$*%A$+<&UtO!JRuA>VA;L@kkA~RCU#9Rc?qsfY2RzSTUBc&r? zDTiX?*Nm0yRE1-ZtLX$BWkqJ-`C|NL_m=EQ~{o|$6OL#N{lcEi*HSM z&OmB&t~^1jYN(J<@V;9K0q~sXqKQCgxTw8Zlyz<-lR}2oz$o8JD(4^xXi;+x)_$y# z=yEtnQ#3n8ClpIG{W3&iHI!)|?e7TjuW<4m$Nr{+ROhk> z7%UQK#iep0Y$P7uG=Zm%J!if?>ll+hi1JI0Gyj@g|6_fsvuKH=9U}^qcJkm<=TV+1 z!Ag1)S&UXZt#9*(NI86X;u|RswHPP)J20lIh~NS>!7bz$aw5Dk<8unx>0ixy)p)n& z>DQ4Or)HVaYyuu_dUoI22gW97zH|B0@JnvPSRTHR)kIdXfJ1+U`#u5@pd$td?>EdV zY@+d&AF?2M54`>7Lje>_0uoOEyApuxgRh%e0Rhx~2I~Mz8%U00H{UZ#;@Z*O^{^!7 zk%Yf1DN4R(EVMvGkjt6;#e+WxbC0N_>nfwV6-Vn*wH?HwKia642t3ZiD|j|C85Cjp zt6v;0tZA~vY!G>{@RD|_%>7~J`0d z4K$XdluO1mGOe5M#?xg3H=kynbrlg<3oQ%B6H->^ za2gihK_eQv(~h(}6mg|@E~b~9UP#Wi7@saG5N>m8f?RlMaIB;f{ApxzI9!+Kbf*lh z=~>6{IN!Ru>2brFX}lh;E0AV_ZnT-nh|A-d^1AZoAv9N!D;KN32mRAZ>%AZ2!htCw z*RV1S1aWQ`L7vrjt;{K`PjzX8R7^j1szPgI)yu@YL8{Aya;L4{TR)D7ZC?ONOX694 z#n&hU2tR?$Xw4JAr*Yt+#~c45kng{bD;Z!h+9;3@Qc1EaYaAQtAEolo%aDGAF8WZR zoP53B7y4R@5p8~OEBo%er~sG_wTiZi}&Vz;iH1?S?+(9(v}WlAw7 z%&F*BvcW9Fu(H8yz20z1*p&edI*d>QG=M7@DP&E5kkvryyoNZnuO`!+jp%Zc%YtQ1 zBps&tv;B%5kc#j#>Do;EQjX{6U4Cx8YWl+~M>_*TS%i+q=JkePXS48}u?f>`@G8Yf zyaecKOiPx7zLxB{ui2afq|bc1T>%vQ4sxKR)|(*Q5YchKm%e}e>;JY599};26>xwL zYeLP0N{ZoDGqlxmm?|e#TqKzpV&Z;pcdWDSj@B}Y68J@?_*PtDA@Sbo65ph^Qsf!hh5PP{NOW$?y@Y)t%qlfAxG@Y4-XNIEtea7OuY2rkebl#o?&!}U-%HO+;%;K#qiEI(7THo=}6*+Zi+_0koQKixkI(1Fy>K`;?17s{6k z&0y3WE_#vGO=Rik*w_@KmFb3@0Ax~FwARspLY&_Mlfc)m&#>jM6r2zW>WB;Q{FZG$ zdrpe$F8na#@#`DYX6@eLXnEwvD;K|-{g_ALd7Q&soPUQzmJ!lWGN}ThROIJw3mF(N zq0;Ax%zY?f1%B50^ySM&L@<&q68iTlUL2rTGoy6s&G&~?^`nL zg}AN-XxFMCyvPuz&cRxFrJv5KrBM|-IR}0M?!q6<>qLXy|_0vi5e!DfP&y zk|KVPy|bxY!V&6Iv`VZrQ}>}dsj?^4ISEYIEJQHBmGR1@(NZ;}4?e?=tR9E_^Pa)aB~b3x=n1GYH(cbkR-$;gmRSB(-q#-_FM8%O~wjUWgV* zpcZvDk|00(mGe&`7z-=)CQ;xpeGhT+Q#tg!QK~WF8l8VDa`G$r9-a)pHuq=hEN;Fi+V(t{e2kY~+tl0U`kNol)M6_xK1>P9?8<~_YEw~C2jt%8(R-wcK-m+pC9_prZVF20-5wT zyI&_pJ6Dp|ukmjg2(9!xdY*UQLzOX4<_V%G<(1NVDLDH)-xR}F4axJX|EBNmeD0ZUhcaT10ZQos`M_1 zLNs8Sj+haMeV>|zGfJ5gC@1VVUmNZ}5b+xbT6}`pAt?L50AE0$zk)UwG+mE}vlG?w zv=8+_V^gW|REU#K+QbCj@IV4CgrtkQ(nyAD!TD^V==VU(2t14vi&Il}$0W)5njMFv z%Z-gv&Bla$U4tD8mu6=N@wu@6Xo0PwBU9>)E+_wymRGTecpwy1$d!2}9KkfcQh7^K z+PxeMRT5LEueob3z;x@!k!iL{JDv2kui8IcY=3m(UxW18o#iX7@84MdX#322_g`54 zarOM#&0l|csrBuh)_b?qbCWWin#S^r>$fMKUB2FW`IFZBSJ%&t=tpCwmTVY0@^5|l z_U8GEPp^ISr>$d`H_v{fLX4F1#f9mn3GUSWBZdovBqj}jTHm~oTE4LP-igQj%b(u+ zQ3Vr@=FC)M>%v!?$IrEI-&uQOVEyCz#;w-*S9PEmKb1F}T?}wMW?UnOeGPVyo(c|o zpjt2$j`TrLINr#y9%yi$kQm`&t}@|)@N8F^14j_6%z%?iNf zQraK{Wk{MNX#z$ujD!KpSgn=3!nnXyJ&+qEC>nzanubvv!%+gKC_8dB9GQrz(XXvvDQ3IiOJhlHVp^B~I((Ns zP`U1#UuY~c16iA9$%5cxJx>9#+A~XCS*WRgX42~QR4h51jBI(qh#4YHK**R3wf-nO*qL_i-HF# z)d~f0{bal)k@p()Dt3yCm^em_ECjuo*sN$n5nL|IS(pwNY;J9YAEkq74>VTB27NhZ zULqAFmJlWu{7DZa9aAqdhL7MLXq=gC=B7~*8MH(Hkt7@*wIDxAA_~6ie2}6X50|AO zAq=J6g=59V!NOFaPt{;VXZy@&oXYX`w>CzS+O3TkR7Ub!gu=92I}@e2a@}VmXK#E` z|J(AHBdss4ZM?tw@$&K3>zC3g1FjLO*loBzg>U$9wY5I+v<;*~!i5B6amAOnHqjP3B@!9bPAxu$`mZo z0)Y|CLQ2Aub|hf56w0TYXu4t5voWOewP!4u4veDqCDY^h%&hXF(iv6Yfg&`)$~=V@ z5aNMkKB3HK()K{P62~Kx!SqC*$blrQlK7(?dD42lNW{}fl$}Vm&5;C?RqQB^!e^J$ zN!0QgWIjA)D>trxpV)r+gPF0VE1U1XtDQPm#MM<;ETp(JADx-89>Z9Mrqhjpx&P)w z*|zJYw^olo-Makc@~xHUTerX8{^eTh>e2n{pZvRZ_J`Hiqnk%xd}{ex`}mLAsAjs3 zDN>zZ=pYNYFQ2s|4AsSq9c5TdV)U4WFifa4flmw-$#4>J;FYJMGj-aIvUf1clS3s< z+pe*x^2HUIm{2iQOH>Q{M-3mlT)h&RgfCYdNzPi1U(Pp-5aV%SWTt9!qYJ3t1Np<_ zl=Mz#8GPk|pa()>Haf%3)Fly#gBRwD<*45SMN)(`=4N4NEZ~7Ec842TK#(*%-@)FJ zW`SH{hB%FLk43w5pli;HhIW~OCF`? zV!2?2?8+s(T+ZC_Otl+#JR0f39g9Z3*f(b8h{=T++KwR}sU*_g;=}^^aIF!g43$iz z&|)N+P)K9vq0k8>B@s$1hnk*%iR5TT9P~g0Q3#3^ZbZ7S^BxG9rZV$IyfG6p&`O1J z0{SSSQMtek@TCl2$|=WA;&>GX8G?ugGM)C;lqa1^?)hohpyi&dX)lE3E)ehqKx)fxDHEXc}!|S>9w6Q@=K-!aTwPG_=$S8 zzOd(8P*KMZ&Za5D#YWp`p7YtMK@U{NYoUOT%+kdjZ1HjjM$X?Nmv@r+p;T^o-tWYr zX6GB>p8Q2{6hU!@qG(6Y4uru;goYU#&kh8|37CXY%z*%tI07>gO|m7W2n90?gOL_e z8lSY`RtJ)WhzDAvB@ALcP;7oS-`EWmUHf7E{X?xgcPzvcLve&6V1z*!f<#ahK?t=) zq+E)Z%c8#d29k=B3`Qd;ArTH7CMg<4zyee%1>m&K7UW2MnYy|uf}k;i!Vv-^F&dVr zm;8c32oz^+d_EBMQ?DO;Z$NL&s5=AxVN}D8wEeQ4GUjf+jH=bVQ}ekOVmu!mD_mD zARS9MI>;9|p(%)5(SofCmJ=9Bp$LtU3`0^dgP|m4LjrAC{OR-ru^6LGs?ch=P~c0s z@k$1?2PzJky0*?=+y3m8kzap)fAfp+zFEG|KKo&x8v@1o_4q6>S#5|2j*%!%U<76{E2x8n z@1I{ix_SNi`!CH{M)xf@`lnC+zoi!^EA5MK+HSzo z2LtzR|MULI%}>8we&0H~iRL(CKf$e|w;LO`*H1=TAO3Rh%hriI_g~%q?&6`9E3F%E zZXdtv+r09V;cjKR8gF#<+Rh5M9_;PCtI0dB;{q~Jsw{L-BQM}+JT-uihKjx1%Wecm zVG6?u6t$Y>c6*ty1n-O+R@F6 zFRop8qO=r&(HM;YYH6jkIF4gDP5@o9o!|w-7!G47YO5|rDCx{#xK&*|Fgnp8Lq!MT z1NHc*2g--1{Gp+UbU)5DJ&;h}&F#PS{7W<3#-;6ZFRp#Paq7R;-r4^6B@2yoqZorD z1c6foO5+TIU=-593TTQ*`-`52QIe!EiopnmW(b;+k0gyDBut|u4AZa#mSk)%;0m0` z$H?hwt+xvprAbs3=Ij|aj3!8uA#t1i!zAVlCJB3oTpUHEMWC3S#b%r#Xp|-qn86qV zgK-+M*>Q|O!TrNnHU5Zpwdyu+2OA)c;M%3soE)e!^rC=hR=|ZsK47r}PKPUe3LEKw z0~Sot|BR0j8i>hKDr*4|YtWs;fVI!_m3g)@HZrDx$mS+25Rj2jFgiOEq>XZmMO1(w zE}P@>W9$Sm9)z17XsB77_t!FclZZnRx`cx=772$Yv@5td)9m?v#c%?{fwxkTFZs(w zmM=-Wg_0ynQ-BqR>m)irrEMFs7W(=4u)t~N!w0dLvv*%YoTzU8Y<*cEB9E#&HJaI!=|3oDkGd~(1 zsG&3YMe|?=d9IM@9LHkRYdeJYjWhpRzP)|!#`arpH`lL*w_ksI`@QS!GcQ>I)aDCS z#1_Q;6CLge1V!MaEG_SO<(ffM96-`!)PC(YzxZkM_J@Bz&_4O;Q~%g_srAZhEARjJ z{(jc?>n|7o);@D)hxH`J1~AhDpSAyBK7`I;wtZ{NcK0t4&D1< z^|kQ*lgpp2UR?dKw0wceODi-~?DlgUw1qVMeIS{}k z$k>Z9V8O^~gSvXQ)~wsb5OAfsQA{lbXrl<4AIuIdX6pJQ-6z}8D_iNENu;$0ir%r# zPb!bBp5-PF^3-BTd914C20NN-srO~-J=bKWNbO~Yuk!-HELcaas#eNBo@)%M!4e** z7zme!@_ybfeB!^>PV8@8IlFcB^!7W?BZsH^+sCeLUwx(ZwNu zN)h+WEP)+UfRQwc;3O)a2&X_Dgun?Dk;U!~RVYa^1ceaF>rUQ)#$Xagaa?}i$=l&D zNs<^090^SNPpbwLf|9JdmQ@bKZm0_sek`>0&FScD<1fp%HeOAyzPtVQ(f0E%ZJoTj zc6Rg53zHz$Bg5-%vQB{$RK8hG6}rYw zNBYuWP)D<30~=?kiX4&EX<1*pTAVb1jBufOX0aX|Q+7`=m=jaerAow`GCq~f=2b5@ zTpOFS_RB_RiKK5}v}AzopB#*v!46qJE7!{-;pz0)4COG~jhj!jzI=J>>?}NpG+0Xri#Xd!Z$_ikA~$CwIo<$Wwa^=xuyU$ZPrU>A1rL2x%V-h>;k>;Dl@;&aoi9 z>)&m?{qDb?-unE?z}Cr67`tBG7=_a`OryB9TMS208buV#nPRf$n%Tr$4hxI~YktcJ ze!Y8i<@1#*TVLI5oq6F2bmjHsa|d&S?H^xle{*EEb?w8Y?|QzO7>Z_ailzx?eDa!5 zDU!=JMH4b<44sNeOK-H#zrA(otF1TQb4Dc+MqmkF>@W#IV3YzDT?bS`B%xix52_bj zLKK#oz)6b0F$$&`dtAavf`(xlRqjZBQN4}8cB;3gB7>4Czjgedw-R-lt*G?hHtvBwrKX{|{ z?X6#b`h4}v{i|2ptqWI|KCyu+%tb39J9yi-e#xx-(E9me zlnEqM*EEF1`C*IVY-BJ!YNt_JfP;xNYNJjv+&wn82E(8PN>P}jFDZgz7|GB$&~J5| zDTd3dKm6#7K#l!4wQaz-?Jh215xH?=Zom1l*hDMqY^> z+{H$9;^^osHXP=CMfuR1J;pMH$yA{+7uMCWHXdXCv8f0*Wz$6Q8k^#fbQ1N}g1kc; zU_H;V!|CZ+zkL%h6NZ#M4;3rCLRU5O`((f$$@4z-q0x`55JMYCvUhjfI!KHFIeFt& zN-)8P(gY@}N4j}AM5mO;_D&9=0TM4JD^1z0!QksKGzL#Mj2;ROA^BF7Trw$?2oEG+ z3xT{m2XTfUk9Z)TI6LKJESn21ru>5jJr}Zj-{1#Qe(BJYT(ziklXgZV`PXSml7DU} zz?6J7k`0BmXC|FrEF1F;)f1xFp$@?)h9NPUA$J;;R$k6_WTxJHIWKPQh(bvMC*?SZ zy{TQS*0tXCUi@qx$&aLLHAkx_R=)6W{rLLU*Y9thdvymD*FZEoNGuGPo?(0qw|3}a zFqds_{^f5Ue|GcAm5saBPa=Vg?H5bG_;(mo)jUKhfDDwU$MDE(%KRd!dNA8#ksBJU zHAD5Z_Gc(h!t<(MPv`FUzWfc_iM7tYWo^ifk)>&dS+M_Lxc&37_Q{XiXWv}8)%xVp zy>I@y`TkKW2zsRI8?@KUx?DRfWMe|5evjZ8pQKR4`iWtkgW0;>M}y2P zVRcNZjCi0doT{cv`H5a^qPq)b0*)=FXeJu#A(#o6rhABG!b!TrgLtGdN`yy~tOuH$ z?1P{>74SevjvN{2=1$e=3p_QcJN(9cF=0g9UBZZ&Ik=vzk#jx+dV8P@vshGRYuzbW zT|3oQWCN}kH#@caCLN$?QAuUKijL}YNb>N!{?fY;937<6sZb%UH$mor=a6NR-O_W= zJUXL1HfUDseri}118fzm7PV?~ep-29qf*rss$44W_ZGS@Q-C25eB88BIV_%96dYEo zS4ZxQ!3TS=fH);~n4%Z_vV)|><6Bo4g`K`d;Bpo5p~XJ?U3D7Sz`(5S7y5XonoeEL zc(EO&pr~yC&&s*6P`)rXzV+3qd*8LLzP)r}<=V=JtCuv^XM{_{f&*QprFfDbu?kEL zHe>F7Y=RukYEWadRNM$+eju8$f|!e7<2BpR)_jVyi~PyW#w{Y&xGG#F3veLTtMhy` z7t8kI%0UtsMN%k;IPLI%@qY@I_-NjuNt8NQd^GMqq|PaN0hM z4`B$Lpb-k`!5u3P&iKCSZ$5>T5FGu#b;*ICKpAC=V0} z(&nfm7wYmr@!Ys~P&yBObixBo&@el;Q&>KZz!-v~2t{HrjpGCioZoGIKvqtY_rBgd zbz}2|3rjEhp4s~Jmf5G1K`5A@7y@B127xJ<0Zv^uK9_iORAvX%+kz_B;`4?Eyq}3K z8e8N-q&FV0lhB2csj?TF*tLjG0jDzxI3sl66bd{{m9Pk-hrFXa546fS&A>J|1;QN| z*vZ8gAxIpSFb?k_#)3o%8ly1+CtzvM7}(A~h^A?bLNVN$BY`BkIn=wRT}B6br$}<$ z`J;pn#6aYjtZzien)IB-dxNb7t6d#8TrLk3N!6P5sag4cMt#Xe4^)p2g@(gX0;|fL zb~ChC8J%DBK(&F{sk-0f*8%t=C6x?CTl_k}hRA*$Lct(cqB~_&ta~88L)erhthBqa zw>$(#7=bq2A=%>mK)}xAYlszc%bc+rqM9QCCmYLLd}_{cxf^bFCCAr@;A1QE<%NRj zvs!vQ5bO3GvgpfJV*G^2lslLJkTAtC zFrjenoz@o=#xMjUDCL|QPO2hU*hfUsG(%A&O)_>WZ8t_B3`{H8=4{R@L(muk!z9s* zMjJy&lBQ`2gJA?gaT3Grv)Iuv2_pmyT)B5J`WAEOXfrxdW+(^a@8&0;wJx1qd2jih ztz&0fFPxmdfA!#BR)5<3^ltm=<<+mZjvaT(8tCK_t>p|f`}@Hdfifh669@_;42qMe zYFCbej2_OmWo4vK{<(kbNsFc#&N0@rFeh>a*%1)UMRn{OokvE|VQwK5vO~i5$CtP7 zd^>yZ61?@=<>e3mWn)e(3t~cAIFmt96F*I%dy15(;q_E8T`dbEjJGQGV1l4C(W%^M zIB%!wPyT)D?nj-wZcMlZL1S4Q#f?n<_}su`)0c}IpEVQA;IR5&uUR3}Y=uqn1zzNJ z@i&xeB^+UDx)i>Km-~BJG1+sbjwxWg8Q%ve2+fI)6 zRy3m#f`Qnc&Z|>~kpim-3jGV7m20NNy^(41wXjSo(foR!sF2(}$rC4E_oDTH4A-1Z9 z>vDWE$@>-tD%M+~Q~XiE*A~VV@lL%G;OKm}3xUn&^7+|;9l$nc7fe9YQD2p0XJ;#k zWO9d3UAW6Uo+)v%-fcwXQU91u2x1eqx6t3VpZ_VhaxS^`#{pQ+tTgQ*A9liJY){Wz>>&FhRonQJPz530sKXozZA~-^m2u0(l-R+0a6pT>> zj5ytX2#q2biebu~+#$};49+k(#prBevOL@aiKNCwTCwg}2xM;ggS8WXw)rGiFOMuz zcAu=g00%d2-n&z4Uwd=qr}fv`-<*(}tLL}A z{k-+|)s@$_KD-%efBoZ5^g2DAkCK{m)*jO8!Z?iLIHK6UZ4iz@5t3w3q66W=oHN1^ z*$_Ts!nc7&h)tUyCq}C&bkTxw%Rm3u>Q9^Be=D?JxwP>{7uE`aNt|H_Mj4mY@dSfO z9K*>j*hLZyO477Fb|DCiq7;H7WEc89lPZ;hUFrAs*>78)9oaaNX#MnKW##z#OKUG~ z-~P&y9dArX}B>m*(_p);vC!uksl*?1u%Qqw<@Yx;2m(AYSgo0?1-bKFU+ z(7@^$>Y$?>P2&hc;|yUFoQRVIOfeMgWEN*o8pb7VduK7)jZ-j#GBkxC6h@K=ilTN= z7YIgC7>ZG(HNbYP3S**RQNXx7P=XqWG^NX~iVS+7K|wlMO>PUoY^^DquG(;dpBW^Zj!)A;C4ik2*Y3u0rU-a(Y?KeH!{AB^MBdC z@cO;)w=dm|ZXP`!TD`JyeB<-&SKios{Rg}3Pzcs*9(J2VPhDNAQ<3JBQOD%3jOc$F z{i*GA=ZbV+#b!d<6B+DK7+s7=$qr?!5$uzmex7e+|4 zI+!FNH& zl0X=Yz;Vo0m`5;}!VpX@aAB*_B?t^7X{0v?H8)OB1cl-hP17&|GYqUaQFeN$F$~QR za_UNji;fN?LW4c~`;jz75faeI8#MAz$nR`}EA z+0R=Sp5OZR&FuOIw)eb)_xKcBZW?a*saj}iF$Pp=lF>&7Rtouw3u*P1?S z7cvp(G#D+Po7(>F>ei{t>!+7LHH;yRmUrymA4o6qL!Bd_#%Bk~VGEDaj0JYIY56A# z6D%^z`-6F6NWNqtP4=Z`h_>MX?WO%5sQmrVIbmibBaA z>=6Wt;s{Dnl*IF6Fip!@VLK=Sfx{?)QYg`pXC8IVGoPhK42JD&L05MgiO3iprApo| z>F?xKw79R?wBwI{aUy4*VT!asEngwXWN^ei_xUK~Z4 zMkZwFX6uuWHcwq>-F~t4<#loWO6#jr%WrPHy>w#jT>Jg6w?DttzI<%*K>u-eavPguuI}v+EMIXK-jR zGm5%)ZH7dH0{GW(Di5QfNnBR58TrWRNo2^#put0v-r7teR4xuJPTF&n-6QmdP%K!> zH7$H)axM_gkL=8n4kX7dU*?b=n9*9uIETT(V1OtKdl|iJ+GXjVt;NG^MS0kB=-@mY z3?fPG?GCYn!^xdjCbL*8%m%FNIyE^K$~l?Xa$OB&(TNc?mbG(X75=oF_Am}$u`z2$8ryg7ZalyF;%m*#ufN^Ccp|ZV{r&BizV2o$bdpRG ziBW&qfs;lh{vSi-BxbhCGzw>=`wl^@%CzE?;(TcDB5sF4B zXYCq=;53aRq`l075GV%2B*=}>-5TXL9z$*{k*`fuqxv%|m%lKX$q!Z;2XkfX zy;n1qZ(`7w?rz80ymE2l&gMH`ZNGmR-aPf{(CRnOcByn0oEgw-+xep+F=|K7#aU8=*j3yWoA#nnxm9i#wF`$Mkq{C!O;X%V+@$sGd#b5?T z30VzI(Kv&EFr1!(McoKWG9-=A%JH;AHiD!P2E$RtifmIzsOc}w)=7LM;7@gv`7xM5 zD2707HSBJLMsS=!5Zuv!0fi|HMKPN0DZJB7VYIaPBu2mtgOC_T+3V&}P`r{xK?zEw zx@qIXo9A3npCU@oePNJ3`OBE*0FrE3nO-PTFL9=or~8ZCP3byA^)(2 zBzy0F*#7FKZ{@S%=1X_lC!TMAc75f8ZacxyB+MW*ZSO}yQ3T0gq$4?IFi__P>unow zgrF&sfGHA22o%8?$|=m2!C-_WD9lFvVj<%pX9Jau36vpdoQ4_a>o7PSG%fpVC0j8q zdfu|&OK+}x)4Ftn_{Y-c&y9_(T_~@9^FQ?Ct?%DH+`e_U3+=^d9LFh&uvPhCB#y$A zs?W0_y%a?guyj+}lU^L7fKLm&D{8ygmC&wS9_d0@<70F6v1r83|5j`khezzA9^0Q@ zT0gaQ^M|FA?GqoazqWb$>fcvBH@WH73L$QCY;t@gGh3RoIP8w74!fgcy(&0H>f@8C zutmo)!K3wIn{1;=(F6I0Q&DPQa5rhjypJ!vu>SnL@3)VBw0ZX9&EqEzitTG(FCS@t zb$0oirB}C4Umddu-Z(80GXkR#5=RJWV`NQ+_I%MadvbL-lRs4CiLvx$gFxNpC8+Sj^yeSZ0?mD}xO=l|V4^}R0Y zXXo;Uj@GYj-O)rXp1J?#`giRcFW&pA zb@|<`D_`ocYt5wJph6(J#rLTf{%;t`r#8IA`$F@GY(nF^K%ips;v=|wPSocJ?vFblu%#6j$Q4f^N)lDxbZ)IW80|jCQ z!t^{9s}B(aSq~)m5+)UZbNpmyoR~Do)LaDCH7urRu{;}76*PJ+bhkN8TB|f0}K*fAr5|&x}uOzi@u@=(ig;mp|EIxx?sCglqZ@PdI;MBD08; zIGnWKhPknhO+YYQy4Nvyr%ia!l}MEQ4l6-!9y_!C!`2&Lc$R)xzrOkXovjl;-Mh1P zUD*2Yt%Jh$`6HX}p5~@HAvQ&Xq4EPM2e9j>);|BA{Y#&;PJO)f#>w{g=ZWPXm(R6+ zIM@2|_041NOl+R`apR+Zte@@SI96(e<;irTjwA#5QENkQxfk?wxjayH#(s|`6MoAk zkqAa%7)E273Ssxb$fhpv6j=)U*ur=Lu{!so6CQ|w3w;nYJ2*g%dLUwEerPHq_!+!= z8B;JilRg_UgdB9KHAkYo>9aAcBRq2ejuo4!(yRx{<)yyDnP#{&I1qz<8N>sPk59x$ zQ?q%A3MTTybG5nn&>%DCfkq3#<`h}0M0<}_Ai|UW`GQQ9l>|NI8Qdn+lOGG{H@bJ0 zj8Dc!0@~ZLM%ZTvl8i7pGUboxwa3Sau^cg$h9i@K-9?DT`}9NVfl8{6gNi-5t{!;7O$`#fu$!W(5y$UXa zGo{jiMQ$1O)Ba*-vgCRb&wHTioY}Q&u+SLD)h8q2YAQ!~py|T;5|Jhtnt(|d$g^&UAW%?pf}jWnAyI;+OMjH>0=iGN=_# z$h4n-rO^KHn~l@M|Go9vjs5FK+DDJ&@4wO9{`tf8JFSmTPwKM>AirEr|VD1=5a z3TCV|pb?5fF@z!rf}lu}Bqd?Ghh#IsVGo4K2BuLWABki&$NQ=WV$#Lp?#jh47JCrD zpL}e*b?N5DTN@Ye-PpSNR_pWE;~O`!OD_*>ef(nk)W`duRAuIzNnBnzoBQ|X*B>LR zw-0Xp_+I;K%puyj5;THpNkGkEp#y-zh?gUlou3L-3F8qd;?`2EZ7*6DYa?ylci|7_)Re)+5A zPueei>*{wH7J=dvfx;BbAQ(+CIE^!g+kQ&yo;}+}%(3UI75+C<)NQQlm=FA8`}Wo4 z>#Y+nuV2_cadG)vp93T6%glKoRtyYq1?5RBADDFY3i4SWJe}kl653|G zV-Zj!M@#dKQz%VR7%=7-(|jW|EWJPg<*>{1egEaPGwtVpS@~h*_7lzR>*pS`tpf3+ zYwOw@t0yB~B+deyK!41t1jA;KJok`6ZVKI$`BH9?7Dol5PT)NUe|NOK6XkEJd*X0lB zjq?uBn|y7e&iEG>;{vBWR5<|Y-;2in5|g!#j+QUoySw?pJIMNblPS!&krag^Fhfw* zeC=)off7xLo>U)JwA@A z4CMxhvgzpn9hjW4c3T-4ZD11<(}Zo$Xk(rn8U5S(o0~`9YyJFvwRP;(wNtI{kF;LD zJZYYqLwfSSSbcD8wj3(jXDPpT`B1ra>aES6kFUP6@z(m6D<7@C_b+1ey%(%H1Olcp z9K)4lS$kaKiFkQfD2F4g?O4*Q$Cf@xt-QMNcCP))-Q~~M-dq1=>&(pq`IRd>EVr2U z1uGe*XnHs(ln1M$)*-~XVZ59!&)AM&$9znw(s(nLo=Yv7o_fuS!_w@ewb$&-z);+_ z%dIayUOU%*_qd#Q6Ef@0U<^SB6r9W7Trs?}>c>vWF+Wro@HITp;`l&geimJrFuh$Y z42On1P|}~A3ynp6JLtN`CI^QNeI?U7TfZF6BUSs$EZ;u;@k0Cd_x^idwy%G&byp>> zPC5AGI=%A0hv#@z?PS`;1#}*cFCbYY@_S{Ze9#j(j6`?`v|sHIq zCI?tOzIE~F+PiBPHeTL-{++GMM_Qk~cc@oKFBE1_24?<$=Ki}omE}qw$N%@MVC1on zugALX3SHGDfBf?R5(p3|5rjPU43ZF00z{U_UMFXroZ~%N_vDbb3SvZbnG~pSiArGjT`wd%lW<6E04;9UmPX^;}NKi zXuGU)B|{d};;m$Y$uK39CsoDltr^iU76^a{@B-pEf!1^Gq+B=vGa~RJ3IWf6rgQ8w zM>qyB;#-5CnPI|VN+BV_H*Plql^MX0)C0+CAAvbZ1GV{94^l4dzP$3L{Nm91QeoF8 zfBAHZlVRS!kFOt{bP%pZF6_5E-Du)2iv`_8Q$Xu-9+hG`|Ly^KO0QBZkpEkGJ(jBtcj z@;_RvrOFa4CvN!S$=9cum)Wzc%NzIO>lb>wrRN66wW$XObQsC0=Z~QYluOrjx$;LGob+9zH@(RksFsb!xqAiNU2x3mCG2e+tm@pne zk)m@OCN;^Y@u=WW4-U$|kv}^Bkva6ev9Nq|ZBO?0 z>Vx8$*K0?AyVZ>71r&0iqO&AL$vHqdEC>}1mUi^J{CSxbkG^*2_uO6oP=0W4?dWvd z+%e6PfmsxiZ|}zLKmBX@#moGY3)y?5wD(>4_WA6W{QWn-%fC2~zy3)Cx6%sSDp^GN z$v%~9$TqU%??C ztO{87D5OAQPqX3mGb;t>fF`l)tDESTA zlwYlEI5WsY#3^Y2R^%IypeO+d_|0vPuS)=Km4P8}kYUCEC74l!AeHBk>;-}Vd7d)X z%zsY~2Sz75+RnY3Kj8&{g%;a+Oky&lO>+mZ8jnUz;fMLq6dxKLlNimVeJ{)V&$Hh0 ziPy5$I;H^gfa6;#9BLEWqL4BGAr^~mO)XL$I`RSdtGubw)!xq*JRjUd z$}l5N8nj29aEyuXOb*4yp+bsa_C@LR>)gTLd5XuM_;!qEJ`^9E>TqN-r)XzJkUtt% z5B~J-QtA1g{QLWB7r#EqoV2e!A;m{W^KX{(OUKrC{wC2OVPoE;>mM01CWgH&i=Wz# z0u?r#UX?x>p+eAEB`r-xq>EyI<^Kl^mH*5-D^%qYM8>U+g)KHQD&rptOh<%q(K8F_ z`Jt(l_!;d?#A9?#4SLPZyWOX5$2GP=z6BKPQ`u5(AJ%uuAXmxi#)<>(Y(dtT^R2oE zF}<%YvC?&7_;3?5-XbZy#-UtG^q%Xtgk79?w5Z)^h7-||Il=NR!<9ltZp7>u*lq_> zY_!`R448DDP^7WGD5kathbPApCMJ1z_U0}NQu9P^k6qtcT)zGFqj~+q*9YYjpGoG@ z-?9&5*~jI*=f=m^j}{I-@0K^W=|+;Qd-atsYK1e7bTgyBy80y&Q-+kquC_E`*6I@I z(wdqiTJ=S+aN$e-(c%2km%@eHr4Of!&ebcKUHR8PWUsr6yI$AFNinyR$54Q1^Ek#a zo}hZp?{;%ao6!iBaEQR*oKbW=7!NzsoreM-I+KzNL>k5E;DBThdI91oVl@n+bu4!L zd*Riw^+V+smrIZDmEN5F%`a*0@cQZOkGZ#hSzj*PJRJ4!*lI*JPZ^jaLM0#&a0G#- zIH!@=bur@%^7wSItyg$76ESgSh4q_q8~Y1SU+2GEDIR=Q*m<#h=urN~$Jpw5uQPv1 zk&Sxm)4PPOxIP8tX@^Be{k2Q09}CA%6nDOi38B?H)8CR<4yXV*j>kxe6P8c{1;zl8 zng=KqaciTq$~Ja=jApxe=u$ijLs+6cK3&cq1mayZ`$K}T4Hmp!`5^p zqM!ekK5<(0%(zRgTSE@>n0Cu9ZP98y@17jNV_R=*Dd(`qD5Y3Tn62rgzPY(oB$e8> zw#Dzu$KI~q-8iSS_zSo0ukJ2CIXYE1{OXsv=L0suGwVe5Ia7P%ohPcnuP#+)ENPX^NFL?Alp zs_ziB1Lf@6wbG@-h20mj56VY>Tw5-GKDBZr`%<1DXLH*`LXGpLUcD&|bx_&@!toRl z9*SEKa&z-$b5PQN!oDxx_2f>X!mD?sI|u*%8~Z@7=Ie{{x%>I!rvjk(;p#UkY9JIAjxtW^#0r3b@aCQ@PmTa6qm&?yaa}Nydlyqyf6dlub?m*pReXH2u>7KM?8(}p z%<k^r-AFW)Y-o#gqaPSH*LSUs`hh*-v@4ko8k{W3we>?@C$JvE5i$W{ z1s&x1^eJ<7n^4y08}tiG0(~KVgiyJxxd}ZQpLEEl%ms?)zm(pcYH_5asKkpN7;$)A z+PWiMGp+F{xX>*Oc*f;i=<(@s&7kPIX1Y}`VspdZ;W3HdH#XvPwx*&DX-30S{e3F+ zpay#__D##kod)`_deGaanpMlWOC!^Upmn?1SQH6NK#U_Yj&=b-%0t4{qj2iSnphQ# zQdrq3WO(z)MA{wgjDtKcRGD&Qcya{BVJcL%?RJ`F4#EoMk~Ck6B4uh1ZZqzGfXGd zzLCz-aTqrvdeC@MPX`yq8|rb^A(vyw;OmzN$l1rFrBpM-Yf_%G2{x|x2d6xiMnN+Z z6C<-GNio(o8M|g7$wh2pA%oN0D8e}~tgg5N#YH$4&2k|I?RrVBnMPPkZ2|37mEV5M z?Oeb7pU&EK{@{-ENrqG^9iQ`VmsuI$QOFZ^&*p;m@*B|Wwh3PxG=cvh=* zk{5UR?1jSKr|VDStM>~RPt+?k2}yHHg=-h(D-sap5haXpm;zyQJwqa$;d#fn$V)B! zZzKgZ&$W$Y3q%ReaLrZpEivcSmevCVtnP)mXrJoOfBD}?-B3xgRVbqy-v#XynS4LOftS^^$p4>Q<*|&15r3rS( zaYq!M#SOq9Fd@;yVMCmcBp{Kq^CtEXO{DfTj{*Cn=-}U;sgdee0xvox zc&HVS0+lGiV=x{`89LS7UP!AV@wiRS6;QnUiWW~@40i$hE8yJDNweQOY#SB~P4>9z zVPSsJIotHsR8Pn{(TdrCKCj;&ZP3;#0Qm?LL?Dj=&tpP4fvcpdcSk9c%26cL^yXF1+OP7x2zbt3Z7T+$f zE)@?RDIa*4y^%Rpxb%MYRQA|#Y579_dDR|L(h>v!0FFnpZ0EfILWTrDYfk)j;Gmj_ z#RK{9C5m}W7;X|Xxx2uGCoDBMPlC#39v1h$`~K_0{OP@GpR+gDj;+0P|7$q^^!40- zm2Z7mdni*>ou5RaIC<`oA%FV(_xUF`OH0ce_t!7~^!d@+tKSG+c;M%4(V=gY{}q3U zKZ9hiKmZYV$RnOIUJ!UtjapT}qILesj#zZ&%T#gy7xcT81L6FW2OE2SnLqx%@OEkS zR^_<01^7IX@Xv`>L7E;?w><;2KG7piP8|%XN5|V9)5kjBl=l44f@J!% zx^Y7?-5(3-C6FeulRBPB;$y#PESuHcB-%vT6Tx}?=u`-$CHN$Wq=!Zjv9|GO*{1`^ zK9z4)Gs(iTIUK~FN=P6($fz=8H#!+Hrwr;?6Q&!tMdM6f5@^6YJfV&I-OYyw7ELCz zVN43^1zfX%8tmmtM$OTH!8JEtN4xt}f<9=Qu6-4uSZFFftM|n;uBdNX9glfOT+wJU zv@p}BGDH)#r9JA32AlWo)y1>2B)Z0GFQoZrn~_ciWuCAGqgq#=%38|{Z~vpax}Gn{ z|GCoi;d*RwwXAs|z#7+;pSw);>&*s*y$i0WyH7P55W2@EV`P!5pM_+R$=VX<357gC zw|p6ON^nmlYpB&&>{HE#qKr&D(V{2U()& zYVd8HX_}W%P2&pnd^OVtPMf=7%9@}9eJbtP_+oYT1V?;*sww?QV;7986T#t$*)G$I z)*lv5-28s^Wa<6x^$+X&*7lZ;Ek~yFKc30#%iK}I4_B7*=k~2V&%eBrdGfd7-HVyS znJ?P%&JTt6=l)c_a-l(5?KBRwplikB*X7|gBp`tx%2A#oj2T}|9j&_s?d~~uzjYu0 zL`^6iI+A-+cyqaQXXk(CKK{CR{fCvC`2$PF(u*tWPqRx6<}OcaTo`I;METsc{K4DV z;|knZ5Ml;+o^U)zDbEpD;nAx#We!b?`NMJt*DwCXkbT+LU<$*UfN?w|QulIqPSTP~ zCW@!6)g5lZI31aBwh$lzL7){;PNnprc=_7ZpFaOk`n0Qbc@J6rVRj)_`m%T9z-a!+ zqm|d01Gx_?m!;`BXqNfqQ**w)65*OmCi^Dn@fp;8stUiAN$67<7sh8zgWagT${yY7 zf2o|@D#`KPo|P;MLVVmbCfb(gb%GDO@Pj8v<=td=mpQDiw4ih8pnQnp$yJC#0zoC-O6JhFdFCSkP+4~|0hmw>fFLns z1+&2;XQt`~#*#{|bGc44l2qt2LxkfAsq9QrhdM)y5>BW|7;mY*E~Y`9F)ZlJqN4P( z3o{O1#ABP(j5wP1p}S92I(%>A)Y_T+4@VV!^pFD#K*BK@_4Qsr7@-`;^GJ5w5fcyr ztYS3DB&K0PD65ElicNmXwwJYC!+P3%t}_euFvnh1@yNBpm&f^w*UESH75Cg3{CnZu z<+(rF{w=?BI`=U1B!BXjkh!Fw_$d|^p@5?lLd0=EAcW^gi%nFuf6B-1CQ8q5te?%^ z??SQT*46y2!@tVy9x3hFx4t`fy!85Q@!Xrj>0RY_r~0#>N+<4=Z!VW_yk9IFIneMi z#^GEmf9UhveVsLTK6hsA`o^8Lr)$S@$3n$pA2U}(Hcwn!?d8wecZEk6)(@;6C|p<` zUOBpYa{X9&c{zLTkC~%|J5TCW0hlnkTI%|ZNVlW8l|yc87v<08Kx|;q4IsRCYYr8bqt1M5rW^QUr8M>028uiK->xadha(yA6xyj~Ruj?T^LT|&#viA8(R z-9KT+&d}Jjv^_|loM8*H?ZLStbmfPC9dH$o?9ZGlzPh%0q44-%{=*qpw0QlFv>>X* zI=@-Ap!FZW&mX_{_2I_7{LWL2Cpr-$4$79ZaxMGfw_6Md=WDr)v~dj5&~%H(PGmmc zev-RXJaxYC>`~#~)Bm@6d-X)=$Fte@rTy;;xAql}-&}i#%8yTO(Etyxc7efGw!=j*j|=#ug$5Q_For)ZcPV1~k!h>kL&Ib}r-v zGa9W&etZs{iL8DpJbm@&|2L3*yLQDJ&ELPiai)0ja_-{r?=x@y_Z4!sRz&e7T;lvE z0i;A%p1~Qe>9}q=I0WmlhrPNri>G&1ygjabrRzl^IY02td&-J%slrAka#qs#&NROSRrjnBJ09o|1TXJOdg z^qwMvX5OwIH8gGnWL>F4ZuS2bW#B&(jNuzlw~|_lD0H8#UHnJO-{j+3)R2aBb3$5L zv66O7PphbqdePxdF=13|?o)+KK41Sr%b#`nbgI8kMR(c{w0d*rVmV!f&byLEQHs_{Ov5Mgffq_;go5c6!h>e#GV!7lYk z^RoL)ah!^_OvpY}5)3akGsk3-0Jcid(@g}N-g$p>ClEm+J~AQ!HMY)4AJub^dYd6N zTO{xaZl|HXPh-C9d*@U=f+%K$@~vX>6LVv}A#dYWEm;l-geM5MsMO=6BRIqcr2H?Lm&FSwzTQ~* zl-s#-*k3w-xqRftQ1*QB`1Sma%U#P41B5W7gw#kO+g}Gy2@`k%+LXeRCb#n2Ac*4_ z;&~;#W{xq!cuq;LmT&?^M5x)s?MmT*Rk#J|mTJF33;&AG$qBl2Xx!U!+Yv`z<-9av zAv2D7@$=eAt-6KRC7}}x!-B`S9c5w6A;xo{#Z|J(F`HV z6IfF(-XeD$B7z0L5m@>35ah9fR4~B2Ksit$ocvaL&sb;S;D-ypE-YV;WG)r1Ut8HH z;iTCj^g%89aI907NZSKL;`lI^Jw8nPqwT>F{j;K{`Ww~OQSr)ow~32SFUDqFiF9>u zXottk7mw&m@6WD&7L{qx_s=*Elrs&*g zJle#twA)PJTb#yG7zu}dA>O$Xb(i;cW#Cv0a4Wg@A2%d+iO+ z(&3i25@&x9^MNg!W^4qeikcR$nzo95AETqyiDhI>g+H}62qME1+w=0or}4zRurSx& zl<4fxNNq*x%F*M%Ng<{I$vU#v(cOdj1QNS@L~$<`^>EZT9GD={kc=N@c#g_@VOI8* z_TE^3)Z&M+k7y_3^PUN<#1+%SrASZR8#6LtnjcGc2*hdTrY0kHFh--e>6V;NYlmsP zqk`Y&0c4QV4!Lc<)|^FyYt(4b%s>!yRanB?au?H851$PE?~K;oNKb3f|60d_Ee{dF ztsWa`du(1SkU)UI^MJ{5 z3{%1jghw^e{)PcSjLHndJjY>-1SF#`2LUEnK%AgJFbsuFOS9rL+KO+5a2!V{1{4!a zD`Y-$o*2M!fENf8n8X3LxHzXCV{LID1#g*P3fsCuhluHda$W;hhF_6~=>=gt;2*ZqQ{qhhIcmz2}I0`T%pccg5 z=0zhEV6b`kkg^|REDCB9ov*87-eow~gm=s%)akioA5VpdlRb4v=ERf7n(?Uc{I77ks{zkgS}{V9LyvnO|9&N1*OXY*7Ge_6&{@t?rqNZ6Pc4VeQrC0m1yVg%;ul)^&vhPaE4^}T^&Xlg7 z6LRd`cAGYol<#By**$gP!%KVV#m<#e|6bm=R6cmF^kykkzHqpF zV}E7j8^qQG^8gaSDaFj?9&cRu>C=t;{wtY->z`ci^8452S1+=c^KVY&-ySc0I97h} zApiP!>G{s}v(i?&hIP8x{*e*+R?g>l-VnLn!T*8Vy^|*sduJNATH-Vh+*x~X&AnfL zR9?Oy{gKuX95bh6e^)quXXRe*LGj76!m;a_qs5Ew)^^JIJAZybtacZGVPX=FSkul; zE1wLHyX!7YB^TnTW;E@Z6`h9^d=6W>_XbkDT6T0a>hi-c!a2Bqy0HCQt+Wr;SfqB>38wb?R12W>U_x?Xvg=bYS+qW=D|(f@DwwB&p{o`8GS zF=DE;&9%WTj9JqmhmXik1Cw^n z(@iL^k}IpW?Y4Nba9t3gc}w8BaAZ}bD!TAw0Vw=pIy5&Inr}`WE^M$y?2h<|ePX&_ z*QfH&@pgA5sax=+{j*-KPi62dD!9CAY)Gv(c{^04jrNPBoz;^emwU>$%_!OFgx@vo zY==*J7yv!n!B6^w-2f+xi%xTAh{ze&#rvU4+ZrA`66dtT0~XwdqgCE`eMEqU4=luu z&gQUGqolWihp7#=kiWHVIPDF{*Spo|#&!0QiCG!;Ew^nuLre5?kw9A0pm*;$!p`xD z&I8QGwJqIS1i{Xux|lQo(U7_wUUOT{ni4aYFGouRZV7kS{_yCtM&&YZ0+h8}A9*WFv7r{b=^1Q$*JV`PjiOW1(^AA_g zy(!(an~7kOUdU010VTEAr#fD;aYLEh3t_|&Ryn6jT{D;g!eds!LF5GFIG*r`1AG@E zT7n=j0RsdOgp6TS5$$Tr>ji{TBJjKf;TlUv+u$vtF?jk^YV&}0))7f{BHV-YkDsH^rx?L&?wJWMBgU?`DJ4h?$HocJMs5QLNQ zxacvBUE@sf;%DM9Ly$LFryM>xh%dP?n{Wa1r7+6jZ%F0P0KnNVQn_9oCvQ!&3#_@>BED*(yc?qPkRcx?w5BxA%V|Hipr`Hc)BhQSt1-^39j4Z+`mpE`M9&PHUP&wJ{$#os-VMf*wPOL+h4 zd;iyWzTC1xE+Y~I3VDuE3<$-14TrC-6Z!#BjhRO)M}GSJvUK-N=IQUUM@rXEu3Y>x z_g!vh`T3({?n~js%fi_&^@dnUYgXsgYt2%fdSPhXN<>BHF033f=5BwzKhHahw?C|3 z{6q2n-g;3q1mYDX`(|-{_*d&sHhx&WvwpVx`iIiftI@gjJO3D~gkj2c67Udk06>9o z2ywi?SI!f)<|G1vU_^w#Kq&(Ae;AA1nKSC=ql~i84(ldbPQuN>{{7n3vB3H(Sh%-0 zd$8ph1F!eb z^G?T~oW%z}WIwl;IgrGORDxG1GQM3N;mnib%jGUQBMDFKRXOdP0mr(5 zAVL!!)Tc^oQ2SeId5yqhMOJOMhkwE#j~JxvpTkT#PY1E~N$U_6o?cqLU%q^KeOLM2 zr|kLCqq}Qwx){cxaicHVUXORCU#n2j+WqqRd-?lki^t9tmfmMx>vPYOrCSG!7f-6Q zmy2gUm6!H!_w^~hDdeB&Q_W3UH1U?(6ZSsUP|7#t^>+6?PRAEQ(_Ybycq|OYEfz7` zzQOmieY0wXkt=^VQoj7KxOXXYq4e}f>EizNTiMsY)1boccU_E_&pRTW@yTJ@UOQ9L ze&0C!-P&PK?tFgf@_%+S_&q&+sv&5ZT{L-Hp|~lVpA7Y>My+A_Z)0Evr{=f?DG?mv z7#1j~@C^U2fRoA-BIraOJ~7?h?D2*uMzad*fKRXKw@5k)IV?b)VTQJ9;XgamEQ7k3 zQ|(rG;rVlSJkx*7@BW-S^wYcdD|@`w_7WV^3O`=|*u|Vo#XWY(t;vxD=bj#x+zrk; z+v~Q@FHX5N9;F5C_G!b$oiShTL>CQ7%zAiTGK52t`;KlVI!F&$EzzNw;iSp5py^YA z^q662Iw|P%^6xw{g(r!BXxyeZ*(9&NSHKAJgh5h6rT*uACHj<$jE*e~Pxh%CQ{r_p zI5@i4*D?a>g<)b!dizuTeIi~dg#!)Fx(IaQgaG>7Y0ODa-jcm8j3UDh$&<=AU0^DY_RT#8F-lr1CDS z*M5~hccXe&7JqSTi5$2?^QDE9X?@4`=wo z>vNgc#ijlE4>v6GwF3a*X0vfi^)X?`blY1et0*udcMMavTbqR$%V#0BSY?Hc5O)Eo9G3MV-PT*_EE@A?;+FdsKGYa z%4@0CW9&<}PI4e%j-wprq|}y$XJ?DM_gnq~hSpy6=ii*Su)^L)%5%OK@tETo&&z8? z1B3(sIa&`Xl>r}l4p9a;1qD5V5C*)^1$(8P#;kZIIOj74YsNtf_oO#}@o4GLo%!Z5MRCe^-KQQ ztHQlwxexh0A2u!)K7Y={ayfr^`L{otG-T}+HZar8&Xu0s`&;Sq>9x0om-ovL zKGp6w!O|+SS~_!}`0h&K$l21DqyLs$^5s9?H|6f_Xl{c|_T}Q^S8GoSOAo$Vf4BD1 z`{&}*N7=n==dE(X}CQI+`;hxZ7t81Fm#%zK{_F^$JOmt1AmAtux>nrkskkkbQ+;;)Eq~+X`uXgw;)|1oQx8?;lLx(-`@#-M zvdfe%J*}@2H;WxYOk2fJYQSX##Um5b14i3;^R75uwd=glaSQP-4zopl)7IP~Gt}rE zg*IQq=uk`z)x=s3p?xZy(L0XEgUtg(yPsK>t-4CYp}-fdr6HfoI37<3`n28COe~$7 z8uTqLcr9}avNqbS_xWp|R^ODa|L~2OoeV<6Q=WF%h|Gf&V1LV};hr}SPaDRJx=_of zVHuKq5xHI8XWo$SGcWT8E-8Nj00Pyc=WN$LHS^81~oFQ5OGeOx?rxA64sU(#ywE#}h9qRH)P(*O4$ z(%hP+l#UTl0EEK;cUZ?4XALaj4F_AMs-|UzZrU#p;-*qagLUlOvE073C&kk@vahla zbEp2}yOsSb_y1nJb7FO=!^|ZdPkAC>d8uN?c%BlDQ<5qsn1`UD?!DE#MOa`!U>Ncg z3V_EPl~1+hIZ7EJTPE60CpB{+pK=y0o|_Ikv3U9Pw&c_5iLB`R3)!z5KC

fIN0(RMmY46W>|eWHI&t8?iZAz;E?oLm?ri4A((UWzcOTc@ zZZF+5K0Bxv&3rP@_JozF#peajAd_rvWI9bj3z-82;mUt)dfsGcF5e5DfOSH<=#?e= zzkV+Fs(j$CJ6OJX_^;o%enS8Rz_VKNdHd;FpnwAq@oi-KV^r=#s(v#To6kKTb$YmH zOIbbX9;wB1>P`9Woy=K(Iz;&F(!W?Hh)xl66P@E80KrK=hb@Cez#A$>OWe)92m+TTs`uye=VHalRKTg zHIx0E|KZxo6U~TCE8l;PQjQ}GwYH-_oRGExAPN!10u{GnyhgPnQWZXbQa84GIREs% zZtd#op>NX=?ga#3$RMdnO~~#UU}_-PGRZZwmLbPvzht6kZp_*U`6U;E-IG)w{G~1@QKsd}Z(j6NBmog`Q^~e0DAJ-0l!!Z|2)W9qqO?N>I_`~y^ZQF5PZtip-?(X7Kd{hW)hcY;{}gx+)cxa&b}u!; znE)1jgATQSx~1!)Lw|$pz^S#@a@AVc4$_GQ3pZ|&*5ox*PY3Pf3bol$3lUt@n_H{# zpt1H!key04;YH1&qKt(j8PZUt&|0596+I{QSd)XtU8+RJ} z#=LP*%$lql2ra0kq{((NI5=vda}%wVR1e^_uq+=51b!j&RvIO{;?iORt;NNHey;TZ z)A+5)g{@v-)6E4Hcm<69sWDsQYSa>&ZCtoyB9ZlWzk6tGTApkma{&IKu=Hl-wW_pq zBX=`@>dxfX=lMq`0_9I9N>>hjSKjlHYl&YDxMPy|WxZ>$9=z=GPIaIk(9Q-^f>z(8 ztB5!L8H>1ly1AilbMws$ZofYeogSD2PSdC)R5xXrkGIMm_w@9sV%`MN`CW2hsWJ8J z!gOrZJ2^iUmkCUjr(O~^7mZ5(uQctv7chVjAytBEk#RT6Y2|}gM@B|XlU{dK#I1Ig zr*k%cOQDqG34^G{_Eg^jvz^(W{+{DACHzUyh-?0Zs)#4l>%8IhZqq! zOyu~n0o>didBwzZ0EG&*4e27}8V~{~;~3^BLx@tYn$9lS`Zo7R$RN*2!e22|mQdb8 zdSw8{r+Ak`iH5I590hX9|&XM8-`-rtUanU!bwj4kxD;C=Y|>8;qj@eU!*1qQg<#lL_y;H4S5!^9E$+ajIH|&{yIy(Z1Vop zT-6}!q{af%qfxbc%51EYR?5q=q{4pQGc#TtR2e1!MOl`~ly1}(*oLf1z*P@zsf`?s z+dPv7(Y?y>_0XQ?t*Stw&`*NfBNuNbv$XSqZ(CBi88eFhkMw*u4@5jqL2V7&;&C8g zgoTFdb<3xrz!Kpg&#kT|Dy|y%9aDVgym8} zzf$LF#&B2d6EGc|YQ~AyZ4}5jfrAV+C=L}kFmZ)uh!6-V1*l?DbQ`%s0Ku5hS{1VB zfj1VI3k|nmX9;}^oDdFRi%lAS;w`;9i{qtzAC++ffEYuJ=b3^}1aJsqz!4>Axfc*h zAmKS)UR4qR4l;~!xgp+l;Z>e!d8^afnsBtc9@4p9HLkpfik}+L3y%I zzCMVR@88TX?=SAVwtju(Sn>6XnYFh@uzIoh>C?ZJ&m1Z2yX%%~3g9?O5v=#Ffw-A! z+CweTFaiMp;g+_{O8qMvM@#z-%GE>>hcK16R(zb>BB=-S0099YaV>^vDY*8g^yotI z%8#Y1dsm*VpGy69 z0ieM1m{LLoMiAl|R{=4*q3rBMJcPpLmr}JU+nH+t+&qB@py3dzpP@M1PnEyVUcdo? zQbEA7etVu^A`lFeK2JahkEnp_7~PhnX$$}X0wh2J833S$=eHx+5COmeS}}OOmFlyH zK-@V7pnT}&AAFYS`OM+M()H}F|12zDS=l>Y+`04D+kv8N{6bpvwZy0U)uC1-NIMtv zjZB)_(I6I;7G|CH_oK8WHK%|%?bxw{de@&7PuyAg;`&GSc_M%CZh6o1%+-w({0=b? zmavXbI9i*bcG>#};zWk%GislUanhzlxQTH)U4RNLDL?qIafAIWb0G6_VdZUlTvRz9 zMq7e#F}>G|nWeogX2b>Nan%7m-q-tHmYUiXry-hBLg_fR0 zI9Cl?QD8PO*u#E;)Uims<##5|O`Qs;+N@DMKhn73{UM)sF`i24joRdV6Q@eZ0Bo}p z+NqAjnF|ZTbf3zhW!Bbg{sm;8X-muO5&~O{`L~(b4>zp~jH-mgZJ-rl5F!E9T$YXX z);%TypV>lh||fbqB;H3K&zsFed^y+Fk!JS-jDncG#kwbT9oVBy(o zP5#P>uTRQ{PwY^n!K92pff696Eyh#8aeyItX|Z0w^N3+2RKv2{)@Ft<ZzVzZ$`Q3@~!;ilw=G^(x=R1Yv>&3(8iqGE6=Ux&CCjbyA01!gR zsK6l(gGv~v{O&H=+X>H8#x|{VhB<VFMd%#;2=CG8gQ^4a&#;}~1kzzHGE{^TuFE7!ov`EBx1 z3KVe=P==tuI3f@pwtqA2JOw;po39fgUSOO67=pATPl45hhpc8}pGseIwA-ySsXkRT z+SOM%?}x*JriG25$^u+9kp(D~a|TT^f{8^kE5k%kV^H$AWW@+St{*IY*`F$1JN(m! zC*Q<4DVJ~FIH?q@#dkKNDwIQI3~Kk`oxX5N&(JYBt4ym+d7b!Ykdt-_vzQqDxLU4hgw zdqo7h;!dghoBfi!&K`h!`cxpW7@ru{ZoV_Mc`zP;eX7N{%c^z7HrI!-KGnQ)+&8j4 zsH;NX+?s`iX;++OLYL}00+FcibOg5s8aS&;WpII;Ek&&JJC z$)Qw2J*u0S?DuM=k>u@!XN@T+VARv$ zw?i3?0*qlwC`PiWTR=b%Vjk9l{M#)+o(TXz!YKrd0l*l?VbFaXJVG1?3CFdfv%v+k z-Z^jJEi)4Av{!%#V907=)HRSIKIxc};-}BIMn|#7q!5=}+V`<|@yN>c%*j6#K3>T0 z{;~Y}jS_|`oBbp*^){A%Kg@pHw>VY4^+dn^tZ?O3dH>5_W{;Y}EdTJvHsH~=vynoM zlhUN@!97aYC*wH|P=J+UgL?s{Jb-|->vjnVx6L^3u<^=sZu7Xo5ys?W-+RI4F_{xU zEeBLa03AX>ptX!JndA!w0f0Q{K5=Q#;O7FP9dXOGGr1#M2Z)fa`Qw`FU?fuMF4P6s3Xk~Sv;kj_I-5)4TiZkt^MtgYqiZ?gMWPwG{3`GYrB zF8B*)cbAX9b+7DleZ%gcUVw8^ySwQfw=G7<^jK4?cP8$4jYgF|RzN8s0APVv_*w1Kp62H!$diCm@t782w%(b+A7*h;5Y^$#efP3a~uH*`hP%x90IK3 z4XH)iM|j=fa8v`p!ndR@O}LE0Y^-s~Q@^)y5v`F=%f4JD5FVgfB)Z&EOaaE264sWe zF<^BnzhFDxKR(#RAWdZ1VQV0;P@ zoE%chbXxk4)lb=5zbWrMS$=sWdm_6xUB3N1vy^mX_I2x_m3aOH|W-k>4LKzhV z>C8Zh7>L;2sfhCYP)A!QhaMTzvt)LZA8TC)IDT_QCPZp=8ve9#V*N(p-KFB;M}_;B zN|(;BJo#;?lTm;$4=4b##2FB9NPv(qC7S?Y1PQ8lRXUL%!8{PSN}A`l`Zm>Sr!%an zaJ?v-38j}uzyI^fq2m76H1}f6p1Jqe9i^wYN@td53MUS%yw4olUcy;Din8VznhbGq z2qQDTSlg32mv>I|XmD;=Vtd5&7H-vFl?Fi)E|>>$c8mHW-2EN7jLuPNSq)2ZzQNnqlTLt}aJ7A|FR?E+5)cy7ew| z>DQ%8Csz+8@h{Q68cS%-g1Hh9Crtr?_@@tgk)3QOm4BnP(d#CQyzd z89_2Y1;`7uLT)VULt_9EBvkwuTM3|29`Fz%iXo`#8_Uxk13(F)fJw#VT>WicH-}B# z@9k5;g}BDza-^)S?l*NJ%GtDu8B#j}4~@Gfb^h9g1$hRX!{NY8pK37@ossh;!Gyr% zyh$?o&H{#z@ZOO_^pKwa_r7NPn%&Uu%*63ANUz@YhO=c@U0|%KyC@=s#g~3{?%iTBv$76;U^? zD@B+m$Lcr4QU01)AOyDX-_a&WWDhj_cY}uh*l>SD;=@Z%+xt_xIgeIBZmnWOD9Wu> z(?Ti^rFbG9j%bN@0C!1Zo%vXEI&I!mVyC|R$IKmb@%66!je|Q@AJaOQ^F#}cv$J&a z+RDZ3VUl^5eUUvsTH61ybohAT)|r(ry5j2}708?^;{|~M05PV3AdXa~d<_NgB}MKb z{{KKrt8x17EURUl2{dkrhh)c&9r?RQvJVO;-zV3OeEn3u|EO^7X*{(<^t7A|)DTK6 zXhPCj)W&pTWF{nA)2JqQyl{M9`OdrlC_KEq^5ZYJsKKPh6M}>YR-K;rJEWBwEHRhX zqhaImq zXzBD1f#4R+m^7pL>Hd~mW>^2D(E?G+&H2&(L1}yZK(;A={o82%% zi)DXQxOXJ8YjE}Xce!`jr7hYVn{K(}lQ?E31i>b8){jEV{Ee zYD*-PN1b2byH_s(Tmv$V?>3>4M1KvI6v}63FD4($6eL zhZ0TRZrLD$&hB=LZPM?y3^e{G^0%|WF>4)e>e}JnTy(Z@wnx2z)VzOA3q=D4ec}O| zOnp<3MN%?Sjztr(`G&h14gI_>GKu5{!?E3gpvHb@cz)0jHg`KBi5MK4sx#ns2t7y# zB|StWrGcZ$v!KgZ1UpR4sXenv&3xT}keN?)kSOYQh#-u%vMe#BB09Ce5R9ApMvR&FRQ1DXCH1{EZuqV zyGoEkS57(6D{pZ#RALPbv+)t1tKNMjuNnbRV3Y|0#27-JvPxcTwL@IzY_48Lc@98? zTAlRsmaqvn?$jRTc`OJ7BQYzMYe2SC$T5Lq1Yp`ytj?_$q@@xbFa!lG<^oEY48WSG zy}7#EzpwmdU+(z7tUk{#J^0U!vuhtW&gXBvDV=*PDF?EU)~Jo_I;NuA)4{cmh1d79Z`W?ET&(aX=wtfH59$lpucV7!l}KaOl{Jhpzl4y#2&F(Ym$;>(GvW z-%)GQHj?KA!tsnT#PNh89#KHr7>25h*a#zmagae;O`GbaygIy%mVgAqAvdu#%4*WM0w zYi1AH7v0INt?aqb@S>#0%-|l;D|fkOetOeng3dT)nM3a#j+7t0DLq~)Tzav-%jb*b z?iOyITD@C5cRqI^_Ok_rfvF~VR9%^oVZtz=v5t*4F}mskJu_%cYZit_n($?V>|pg! z?)HDIKPf&q^LI~nt1vMnaFAAfL=bZr37FD`K|AMj+XKViQQXn41(+j{VaT=86ih6b z2c=BNfNt)mn;WXw0$m82kv733=HFk7kM|W%-u>^jN55OSU)X`8y_aeLrx%d&4t>bN9)3p+H)U&dV96_=#U|Q_a$-`w>tr8ghP zOXp6FSH7S2c2LS8f)H%AfE^*Ps z?EBj}bB@@B?#kibThD#&sQkag_-rNzO33jaEVviUNpGk`P3Q z7=joGdxz|S^wv7ulA(7Z&ryh_0N&cGScq8wo6g5w;vCIT9AxVl?47}whe*bx+*W!E zl=jb-4&B~7RlkMbRzl-X+ioc(wQ{|Da;bdx@t=+VRy~uZoYXsF zNg5v-v`=>&%?;X6(K?R)paPB9?aJ+9;@A2{#)t5>y@L$7qw#xKLhhjP4!sg z1CT+Gp(sT6vT$sjIV?*^J8DsLl_z?uio05o0vc@wBp#*}DpAHNWzvZ|6vefphU&dr zxcu}=?b)T`vCS)$2QPo4EZsl5jd}h03)yPG%vt8n_K51-Sk4@P>hgmVaTEX|`on>ER5 zQ>uWj)8q*2K2Q|qgjTt6kG7*8hSKG$Gm*;d*^Os^EzLeHJX(EgHimZqGd7_i10Ejd zcM*~7QMgvR@~|Jon9h5ZIT57T?6&}SK#0FjX?mlIbqTK$3Ev;r`YqPHFeR6FMtaCY ztFH>zOSd1DE*&>kpWXa(^}wrN7iM?jyCfuE`4&#=0SE|9C>k=5ra6{_9O*JSu@uHM zM=*pm;W$DX_TirqqX`lUaV+8EhDq3#ILHAEDTq7w3jTcSfkmbO#X(v+h#!ps%K(b) z$izV>!yPX4>norf#$b=6lVEE`u#b5AEX z?pVwF&xdszPdY%y!h?%4awOM<2kwQ`9ct{b-AEcVw^@F_cx)%`fXsv zK?PK{9-JedXzL+n8!>?Koig*-wZ?CR`a+s)oiV8HFe8Bx{rc5i#rMTWQUN&3O0h#zfTAH}0l*zFVN>9{IzB^$ zU~p?E@;za$9?AFaDj<=|damiu*FFuU2k$FoqzG zrWp<~9APm70BLv}_hSqhAc!IigJ?uBiy@0Z1A#j;6Y_?=k)$hB&z_ec1~9`xj-mj| zL4rAgw^TI=G&68(w4>9+Z~Rt%9EdRuF+iLoxS0YRUFVPD?~hvGW{)4MMtb6oF;fq~ zz)De#Q(JB4Fpws|8K5Z^69^k*Hht{)G}=;MITj#}PzYgEmr%Mq&scycn!#Kb@R;68 z5eODSvBH=gHcf;~s)i8I8=ow|t2DZ}4`A7IovK-+l?nHQHn^9qIuXqWt zvO*n^_??F<8{E!-bF9bjb+oZZHH%AtU6I-T`GkP`e*FFZUYr2ekgcZv$Dj1rtU+e4f9 zRogfRwAiLnD2#TGsuw)Dw0NM2NY;(2I7cSKih#-P^)D;;YA@z`A&_ZIBg_JZVjx8U zhOImQ@ycw}leNN8%IXoqq0gl&XU_dkw0LXt`q#V7qH|V_7!O@oEWi8k^DA#MH_opg0)khh;IC6t!)imC6{V###F7xD zC}u_gX^O)w@Fk`>KnUb@(x2H33(HEjV*O?Md-uxg;>pULtJQ^5<%dtpuWnc0T(tdX zpBAYSlP-HZ+w|=uSSDn3FwT(T9SD`*vT>` zA{DDk+G6_rx=FAfsTg9Yoso*M-%Uot;b=r0gC_t|R)tv?+&ZUH2J8+w~emJjc;oKp`0+ywF@COqHb2Q{SV*^UwKT?3^Fh@ZaBbosmLrZC)kkAwa zgrhqw8foKH+~rHpbh$tK{TZcPR(Bwc>oT^e(mg1bCGCSIEMWpMCKXdN0lAFbdfgN> zr}ZhfTn4tbrzyECYvEY6CD5Oj7;`jWDFA310?ZOrxAIEbMRu!#Adb{^i!S$khUHj>P^6Pg+pd?M?Tm@h@KJsm6Fv~f ze!pcc@Kkg511ypMH8kCro)xpnA39k zbh;}Os?9v54Tlq4E0b7$#5AD{b!3xITRO8qTnFo7{d3QRi%FTYmX7buO3IWVQl!}3 zn5Q-*X+XBIJW>0+r}}W9iAw%Iv+u(&m}(YkS|?E04~1Y{rkp*;V%aHRb3>FUekQsu**-JKNG9$UoV z%}TRW@BU$=c(?ZOXg;ZT)s57xZvAbU+o^>#>LQ!w2_5={RjaRuorG0Gpi46x z1^gni(ax|!9hA!=KAju5f3{*c6dG?xQl0G9^zQ<@ z*Up96j)I{pVGV(hMEj-uL7UhCts_SZRK_kh%TY>YOAj|ad3q8#PsP%MW?x=12;qk- zg;&(Zy_Iw83$j0WsDH^8kFFnHf2Szi_;%!bPr6cw2}jXenjAyXfZ|YHOzj1b+Xn5* zu?&M)rZ>MIWa%w27tvjK*PwlfhpbD1;grJyyMSD#@{6*yI;I^a?O-!YUW{M8TzUJJ zU48fcpT9obyj{L{Xl=Q1%PI}21r*0%ggI$iX^!In!$77Nq!vQJFo*^`Y^Sdb4=4(A z3`;mfXvAU$NkiZUSisSQVsKkRqg6kL%riJ>Q_*cQPgC2#%hPmAVU;L~+R`JMex*_a zGwpZUr^lRTm6+^1U;;U#FKDw8(Lk{@0|7t1dJ=S!I(-?>rQ8K=W&y)ugnQ9@4={jX zDT>BB0wPj~!VIJ^K^SrflNNrlQ=38;U=8f2OMk zFZM(7!Ei))fUurO*dHNdDbcYqYM;>cg67Ttulgd??j9?=Ydx*+i-d}oT90GvhpEc5 z1J$Kh)n`vvjueh<-dg?GR3n=rd+O`EzuJb%XJ3~-9sfhFu)vhwU0pwEtG#$z{(NNZ zQuXo~z6Za>M}R_zCWzt?18IZ^O)%AdsS}AJMh!9qVHRPIqZmLiAEjl77`g^^TyG5B znELCN(x(%QtMvBC>aERtYj+Aas;{4|pRC=vRGNFbesA?|@!hw?C{*Q#)eQ>gZd-b3 z?tE!!|HjSY`NHkW&4;CDw=4V4+al|CHVzgZmfi_*^t%Y=sT!MBb^8of4+@hShIJ;Q z>Ix?~1t&SZc|z!X4-KL*lfu7iyE8WqjajqNe9E2aa;7wf*ohv^-2KDKv&zDUnZk=d zmp&}5&FWY0*7n``QC_}u$>UgkSDCvgjGt)MOpeTqB4vl)0Q3$zlO~Pjt1HCxYdym3%WS7M46$1mQ$n-YI&#CEHc-!l( zUAyEmXVN_$8gEE`IcPF++OS_P^DqIfgJE{c<3SQvTaui!*{&3q)dzQahm#)uMxZGI z6vIG{k&FOILl!d-ce0mGkB-6Yq_o}I9vU3d3{LS-Zhl|P+O&dfBfKX@lN@08?%$Lz z95UN#3vc!14>#52`TZLUr3bG|ryh-#F24AWB-b+t+!jaVIo2z?r-5a0a0{I35pyG5e6s z-57XPz?N0p#^f?ILOWpHGd9SM1}9Ppr(EV3^ak}lr-Ac}$!?wT5F?iX71-L`GH#7r z=A0alxcgn`AcSZN5yEb1Gz?)$osmTBV2CJ8LzW?c0K(B622?K)>o!+0kZcJaG@@ui z(SU0}@w?+j@_RkMOIf7uYuq!zZ@I3?=J`Lol;0;g`v)LlFiioPlHycm2}d(*)6b?g z{oOHjBCX^i79hO@lyReA_H+8AAWPy9&HeA!&s9HOsU3Rx7dBtock)-&xp&q3^MCsH z|0zFP=n2LKh;STggmmmwF(?EnfB=>z?xg^PG@(c%5L`b1Er(bNv4|!Fuq;b4L<&GV z04W9%j^(;8YiODhBWT5*HoM5K_6aZ%Hw|;YG@3T9#D?J^foF8j+nU&jjgNRCx~~~> zQz|Kf-}W0!qStkdODqnKVKLUtK&)t-5_gW+L8|9^&K*&mboBBGr@F`&>+ z8auK|{k$NoQeJ8Tt+o90>c3VV-YOq??=3#6?z>&Nd0|)W;9+0w`MYg`tO{Kpw!Qer zEJbmcL6~MCgAs---ZqA+CJ08XDKnl@%Vi47;E+<^SS>M~M=s-8i!)|}j-OS+K&o_` z#k%f8CyJy>+L2T>ls{(J@tv3p!-i$vGL91ya+z@=-T(GWblZiolJlWoAo^-UZC1IR6G2%a_#EI{=)fp8ZTnxI8W!HYA%qEw5Yu_}R(Dp!h}4O$q=L(? zEUvuBS1!B`Y~I?KFV0r)9sbSVD@#vS_N*;cm!7X2tG++5{>CYJZ?|$|<<`Fz_ij9| z99rnStJ_8GlD?=j{Zr-0Tz2ikugZ&eYuD}%ZtknRIsBX7mR~OvP81gZh2Fd*xV&Sx z3pdNFUcWSDZ#NQ`%LOzZxompE<}e6B;aN9UMz<#5AlFoZdm&r>wz#+TfUL#|hd_b* z7NBda_16??{W(pTSkrbc8U=rzF(h>n8vVR>Cqk}axr|e$1&JoPY0s17l>yw*j z%a^Z}pB!3yUOV!!t4Z{IhCrLH@G zc7&y-c7h;BI|B+(h;#u31`YA-ly=z9%4M-o%p90%!2tdd_UM2fj!x5wi3Y$n!lRQj zDVHH;7?H4dW|G0Sc}?MPhQH0aX3fT16u&&1%Y>H)3T|i5)JAjqggt9CG$*IPs7Vbc zwl||?$av1VE<`ma{jQ+n75l zbRBT(IvodMj75ScfF~SNZtI7DvpH**>wk(fGSMD3S`aa}{>G-5guOQEQR^rZEgfjA z_^y0(&NjVrd-V_-6)^zBBGbNXhyTCAGU#gh{ttSS)|qXrz{4r3Z4n0B+JhZfF5AWJ z5*vOa?x;f}wQ+ViHH;8yiq^HvMjdVlLrQ~|bJKZOOWSQa7{mfdD|(e0?s~^)-Kq5$ zThktQEIVVFA&zfw1V{!|S=-=fkmjFt{J$D}>Ef;b zDxH{R3wJ8FKRSDv-XP7;2y+c4>`vcxLNJ9t+lFpS<_BT1r+9Jyfv*D%uzHXu+9i9VQ8kk7MB3{C6{R<t#Xt%+Ec)HBB8tI~;{Z+Xz}n0pie&-hXn+V|INmL%i&YD83_}x+>##Lbgze4N zpr!n6NQlq`9R%qaPumDR6SQDo6qAh7+DfZuF*6*dQ`#|8q?s%JNFPGYbu+(p!L^pvcx7jxh&JjMqvN8H4tRI4d7!wOWfG_thWgq zYQlWFgb_U84?Bn==TChLKgM`EZ-y!?G<>_{GEX)c(Fl_2Lt;swxK_cAdfe?_8nJ-_ z36+%PczgeY-G8NjdjI%$n{zA6#f5(=y?eKL@4t3$V-S|u&{+sM3So{WgytXuG)KOf ztfSM7p!v)ToB6RFx)4-uo-Hpe#S44Z_LV+7%2xJ2Ek65u_4wV@XDf?qC!D4GPm5oA zTWBSTL9*Zft+Mp-*K4npU*D~~)qLNi>R={CL>-mOr`GmuKG--^K7Q6xz4dH;vHI+I zVXksyUwU=lVC}>G((^m3hkh$f(t&75aS%cRX^MiV5zLi8wP@_uIhAoijW(8RCk}4B zE4{jdPc|M~msi&KRM-pak3<#UIt3ztOoTe>n;I zT<^tW0uT)unu09C7(&pvZRV?zbz_0)ll#BL77{Qg9WgFywT?;}t=2A-7WSJ~AFX_- zoVZ=Na;1-9$_7lLXICzxn0ALc3ssYx(ji&iZps|`Vdd`7#?`eee>E4sl!?45(&E18!FZ7w8SzWk=%@Ez)))FzKoj!~b>`@|sIfaGnWbv& z-6)4QXIEyYs^{O-9xaY&*XB(0>gSDXwKI46ltsmdCQMK%N*f&PEZt@xct*1D>XYN8 zH@B*Ddx{s!*FRQYEw5haQ(_yx-FQwkt$Z!Q7sw!%<_O}k1V3{sCj9m|BTYN9xp!#y zkENrpN{^lu7s|I^{q|qVk3LiuZ>)YPy}z?@@4qXrkN0T=lNCJzX9i;Mcw<74{5nUxa(d#G~mxxG)(U{b?)JwTME>nzzGlq|HicVGFz zyQF>X_vMFgOK)EEDK2ccaawLivp%2KF_Og=j#T$8mEIlPJmW5ZIuPtrA~z8P z@y@&l!;(3dE}yI&`B-{&ws!T>=IrF=x$@-$R=U-oIVUl+29ces#>DAG2f6Qwr7{Qs|q4()L}vfVOopE*I0_o;`5 z1;2T5bdFA&0KdxS=9DadU9=iuh*KcRnK5QJ?LBmt*#R-pt%_`G zI>==aWjvA+C96Gh8FmDWdKD6-$8o|GBp@(D+q{EvnIW#4AfE0H5%r^SL>RP}8%mGp zh;}?6NW%%OzDNAl);&{mA=3a+G}{P8z3mL#c5KJuzF%w@ai+&0?*3c()t~CM zM?X?D$70NZ{}&N(hohAAu`>IY+VbJ*hnuyOJ@TG zodL6)N~38#W(`vikroA|=yugQJeq^1e{hz}Bx1BivXeH>78W|+M!L|jbXeup!^OvR z?c`DT`#zm%1i!%WM#lWoGU~?N^84krCo3-pHjdRkz5c%P^j`5m?b!V0fk8uOCK?ry zo*l0aaD~g|rAxK>qnrDyk01W@;dJfJO?mCazRHQqnZn-U{9pRb7i zn35XF_|Q(+;<_hP0+{0t#4w2<*2-n0nJK|PJ3k*;+ zL2DV+OjdgR;gvV5$7;vkR8KEgPamjUIIuBSy?>;(XR&zfuT%Y6oi-v@JP?)3{N}Jx zv&~X6PmS7i<2JRo9eCf5wMuVje8w~tQMVFDhf#Q9Txwu+IGPBK+v53vyA#JSK9+IC zl5&~fR*%qICo~Cl zs^cA?9}tVW&=1;tYE&)@D}8S5;MQ1XgTyG81>HIt_lU18rZteJDQH}~?-VP+ni`|r zFsQL;M7w=_Z3EX}Q=p=u+)Ou{L1W-~vrs%Rrm?v^Q?_>E&b{=JO#vqTl!X#WIdYlG zxHBL9_K6{YRoI(4@{VZ`TBXiPH% zF+F_jA!KNPIkvt5@hlhdXk^C`jt3w?G=Uf))MH2n7=j23X|^lMF$IF!K<^Ht2w(wC zLupb1iUt(qXxyv6I7}Ft<2bUD?iwH*1?jq*GNcfpKrENYM;}EC(PY z)VGIM4i7S|zemDcruD$<;*zm(Sehn;;oa+{=tC&NP&8s7=v+r(#v`?>HE#OH^5#@V z7qrbdM4O#blsOo7OtmcD&5dsC&p(ttAF3VMm;Cx_?Joc7Wwr ziX{{)9ZZXch{Bj=dM(-kh_`ldirrx>EtaJbq8OTkcH%{wTF07uf-hZ@v<4%igK;_*UAzpOx)E^o-rv*Zf!pUTm z!LVL!>UzzY)MW*4YSdoTkH{d|(4D#weLsD9I#jxSt-828x$>}lZniSNM;JWWuIKlJ z-b@4fP)x$FKct}29ZvltV;txtqGG4CmQ=ozO{g0jDeafvghb|iA!KftV|(xp#fjI_ zm615&ZkQfQx}te@&?hCdM5kA-tbVG^zjYKYJZ@Bd<9cJnFDHEK+>??f6)F{@KY z{dq;SedEN-GNvhe`_ijL&^dpuGJkUOMx=W3TC;0}kpu-*kr2G3b{@oW93%|vx%04F z+Y$v}mrTVwrNPNdK7G$U`nHG`WX9LYJ5Ma9dY;gA;A$GbI zvAQunx_~tlAIz}H;DlJH9`kezPi*Y#TTfyB-+GS%*{U#xoa7)3K!Q0Avykg0>>|Q3 z08%>>b`i@k2-7rSS%zT%;b(G}b3KJIK%@>E+*XP*rcxfGo(l?vr{Khl!#?g1CWW=Z z-m=t$F`~AM-nPa#FG>lMlFYaxlMnk{&BXsbcA#GM>F8yl# zY3bdPwRo=f@p$F@`SpdueDTp3*UtLH=FQ5NryFyX3m40$AM@LuL`-B6J1KzxBZ}oP z$1;GT7z%gFdIN+41OtF6h9!uiF;k~Z=$7^*@Ra}~z)&pJE0*B^1cU)JjS$_rCKGIe zY`1b~7D_X*u`GuHXlhbY1Yldr9;SGwx_;6V!VE`fdTSG_t4e$zu5JP_hGroHzD;&Y z(lg`RicW8I?5jaN0l(wc{L>>aY z!lz6LJst#Z4Zawa*{Mr`YRs)sf;8j*MqZi$$gv#DaE+jYUCcC?1r#QTZBkhBD>JK> zhD#5ry&+R$)$uL@MqzG{fgE88!s3XD-oo+P{Aa5C;r>sbo|o@m?}d@Z48VY}5&&t) zAxIEMO9P|_AOjc%u?^!+pViJm0yv7sfWw#&7BY1^l!QG95#sghG0s0)* zP-Vs@OZY(F41)?Z6GpXwV{}<88 zaDWC75DKw~LNs96x`-zQ?3V!2CydjR8Rxgc=m#+1I7~o2WNp_hf`DaNLer2DPowFv z&}9A6Q(`LR^izU)WF1d2?r}k$V?BLGSje!DW~G>lXu!}6!}JI@L1O>`i=h(;q}Vr@{326XLqX)F4fMyDLp$- zefi$`V{Olc)q|x^clh^1>wC)Q&u`32qldqVE22AgCPD-=TiXH$Scnme5xp%_1VWCW zT$c1Ed{{&TLDesAcp?av>mY)t+jkn6;Dl~;(5c!95d;`woNB*Z78xOqI3MtY)ej@N zY_KObnMV1jJ7VmEPws&&u3kO#^;O|ydG>YX%zR~TZsl(6?aRu(dw=+I?dln@{?`7} zr#+Pi`&M5xLB~U;bUZ%o)gTeJw|Hj#OrmsmfAQ4D(b};C)hlPiD{p^azOYZgI46uf zSiW%lkGqPuN{crti>Ku4M>p>Us%M{+pFS@>D7>!i+h2UFD}FRK%Z#u@GZP#XmAJdK z_s!pn_cm`Ak5o>cSX-`rIgb;YH`fjqp4;ewulG0h*F%al9dGQee8e&m9`*U+7B6gL zh!Oa|g&_{2;kYK)j_@XIvaxt|m|>*t+66LXJH&3l;^MwVq+ii0%E{3AWhUvYyo=7uOGGOs>koe%Nd_=gNwMbh;+3WAQ+QUob#v`}dH5(a;4+q36(I@W1Z#e zhW%d6q-6P|c$5R36tnjk3BM!8NN=8c1lISJmyWKV zue`ZhKDNKOuXg!)?Z#b0wBL@Y_8Co-OPm(Y=&>keI6Y?d=grfg3!fBl!L%-&HAyp> z)ZQ-@7FOmg|KaFUjp;~~G6vHVqD1GQRp$%qp(t@8Cmz2Zd&{Io@1Ar^R?76N+SzA6 zeLhsURC+xJO1JisjdPV3hl?jy=g``n)%%@UCAs9VWJas6SKljU)}9wm zF}W=2V7wt14g%2+8M#bJl-XSNyY4(X@wr-)pV66H3I8ZWR~Z)rY6WM`rH%cS$LGzp zo98yZRNgFa+^F2Yx_YQ|Xkq{`(%hcz z`dOy5jJih+R~9N)?x-tI_pO}fc2J852d9|9iA+Z_vKVt6N#XA96^+3#7>UIYH7ZE5 z>1Xtq(tDw9dP3+KRC{^ur*~hf2TxWGUE6qFdwX*2%i6U*v%}8W$D~Jn zawgL``af1jCPh{1_7T*TI~FI=dYzbuh*__F4msEEx+y8>p+w6hisxGlWD{& zN=VtsDAy(5MWofTm4(`w_ujR8>-Tll`K8Lm{k5B?HcywIEao=n-9(q!IMAm?rpc5| z5wyp|qHo%&P>E7#FE{3)(=oc=6xrGb=n={v$~!y9S1>U$?$AWuYol5TF@w&ikG38| z=H^B(+DP<~jBmy_Ex7@-!6dzAW70GeV8g-Ivn7XMW~TovP7Z4GUfQ1wgTyZ|Wi2xf zPu?f(&s#os$Y9xcy7H#H^lp4*VfEhH=dZUavxj|aM@vT@{;GO$Z|QwMpG?-A6-#?# zxNA?*ff32_GrKmAtSnXU-YdO0y>Ulj`AzxI-1@QdwJ+7BXR8m3d;1hE+B^qjOfE_3 zyS7S;v>imV{;7IoxlaLpv*^*7ol%N)Hh0`O7&Gl;j;gTNI^uPujN8o8Y}`Wu8)!Xi z##A(JJ=yKZk(KmCa;5w!r1=MrsYyue{;1OJm+Y>A>W#hSdq=~Cchxty?Zv}GYbX2k z-K5w6qO>}^okglmjAl@ilPvI$mHCIor{#l>HuvTJt8l7v`|ak#%{{B9OUqCDb@wP8 zu*zkWaLQ-ovYB+w(r3Y%jqSy%p~h+5*e|gDSm~u#d{CNuQk&mDT>A8K^XB@^+QVms zd3NR6=4_vSjSs0OoZ?v+oybm24T`Om!DxCa<{Bpce!Yd98Pi}etBA^Fqh7~MYo&^2 zm_mybyeb|^2LG?A<0LRapEQ|I_-T9mvg=gf7;Rl!;lW$#8d}(PT2M570eI z{(9T=FMleXJX~EoR6cU$p9*hx{l-~-emGw{e)Q|(U+thKIAOBu936?)v7HQLa58Af zgypjAw74y4vqmn9jwZT?OEjd4q=^7oay69*0|&A#jDF-YKmOT>X1M&tuEM+XIUNDv;)sFnsoE(+T=3dR=HD| z_@F7B@%iO41Ea&*gsy&9I?a0ZlX6+a`tt+w3gYIDGh}=)FGz?ulr|FM1W|Y?D-irX zoTX@`Fay`*h(T?IQXzhWI65iFNX!bnU2xv*-QJvfO+!57U2d`pWssQwlQ}8xw+ItO4nCAp-o{G@VC~dyp4OVaLn2 z4-S>CAN}dwa&d3rqW=$H?~k}*r8mc`N8fJDfBjs$bNLqolaJ?g(RQaa&?Jembha%D z^YLMW=}5vc)RvB#=%n@Y8&?z4m4gplzixI|uNb+Qq9KGdk95We1G;%OcR|kuLn!i! z*_yurq3CXQXH0^}tjP#nSm)M+wr_Wk4GAvQ8tqO4n=X`3`KLPCZXbbDxU1on3v*vz zSLdG8UM}`;I74xe8UTGl|=+0$YBCl1`sUm#5cfk6l4g1Z8UyX$VGy#Y&LJz<;uUyIXGsl$=^(#!qRHrFG$fam-kuvQ9Xwlp@yfV< z0I#3fyi$7kzH;X3=Dw9%|57+BRhhcC7@!H@u|Un*M2t;4MY}eTgAAZB;Ej_!Q@hnW z;UT7unv}0D|I^QjudMKmC5B1J)Jm{MovpufPAWCXp1KY4O)?M}MYI^vlmfzl~?Omun`j9lOoi5xhKYUx-f8*PoDOy18zP=Qt zgNrey`esjc;YI1#v&x05|EjAVdd>W9tbF0c+NqyD?`geRIdFG%cJtKALiNbrwez*l z?^bWNeoIA53(LCodz60thGK2D`e1(ZkcwZB5}pkLYSfL{>i&ys%f&CX>vzge7YesF z?tgu*4nB+!am=Wy(Zs?xWa8XrA zyb~Z6F^Hx(x??A(K7UnST25DQ?f+Hb=H}VrtMZ$drPI%PZwCVq5d&pSeaImq}_VU|^hN3XFt>Z>{ z&t>!G?X`EowO4D`)1{@irKg7rCyU3w-Ye|s@6r)d4?6}C9Pa$)njAYWTF$#*aBCt=G8pBo+$iJ9Pt-v$(&MOyv#aGn|MQQqpl z(vf@4+M(y=I~OY-_9&|t_pMwI6z%btv^LR7lyVed^~fO+8Qjq6Ogl=87*O1bM8Zo( z>VIzyl*r50ln>>`9NG~oQ-6$F2KDOtU&Ah6yqhk?E>s~c!f(4HZ+3OGFr-NP^1YkL zD~b`bl$yByD7W#n_-v=T;C3oiYSNb!JQ~;umr}F61{Ke{I`k)fAmW(p(4AVb#Cs`6 z422O(AS4VX6k=JH_YeM7rO+Ns1*0jy5J4b9@F7hWYf{@cX>2ranwairRVLBVqyd`H z9ON328u`}ndwiy}xUllJ^zMD};COBR(dv_b?$i1$i4<@w;RuBQ$1;t03E!$2&S+;^ zf16ZhH|cRcvIK6O7j#dKl{!5)pb_dk9wW-$$D&EB2?7w*TY{5ujVNok6->ZPwBt++ z*N&WUR+ny+AKbJ2x_0N_HisbtXci!jcgpS50NJgsqbRP|Q8)k*%g~5nc^$EzD==UP z%~33&0Yx*Yw+aX`ix6Sy`VAQG0~e&35#q2|wpRqn)(Hz3ek|IG7KI_jfaVxAveZvI za~92TtV7W%9?buK{eAi3QEBCl#TT1I6_f^LUUYt+&&w>IKu8zX0d#FeEXmJNcKWe5S%L@JP?AfRaodorm|029m+hTYM+VF5!^9JBQSfh#nO;&m~8qIAStAj!{o}<^1`u=PZA%vGdig+%JYkKnJZeFf_ zx>$aCq<(?+zsPU2`?s}+FL$?f!w+Xl&p!Ujuy(zA^6u*A^4=5PjU%;_pIa}iUMW3& z^4H3j`~P7qTq~bDSbB7IsAT#sISn1<01BNq(N92w6x` z1ofoCpa6{lL=@dcH|F&779`14p9sZ#(P^h>&09m(WX_uvTSy^*48X9KKG|k@(+sJbaV1Yhnq~k^5z_Ne#DJ!0hT+|p`>buqLP%j6B7h)` zwoXOVOFv}M*4AF{rn;wpUoZc>QRUuNSzMd*R-d0=JK*0H%at#`DZcsBAAb6Ha_w>H z{XK1eWl^u9HB-}qqh`{WQFpx+PXrSdt1#N;%ve92ax}ntl^J^v1#h?PzsvKNO{*9G zxqRT$`orp(ho!5_UQKQG-EKiC(YS{7h;=%pLPez=j&7}vp+|;B>+!=y)u1)D9#ts3 zs$8EfJ$b6j{k`<`)XFha;nqLbE?p?Tu6{l&sDm=D?5k)F=`CZE-BlXutc=Z^nNs$s z&gR3-`?XKYwf%36>FUE=E-{xgkA|$qu{zpAsN+t1(lHJi zVj@L%Xh<8!quz;R{mIg;z4C{6)0uO`s1bx!+qwFhG}99u%AM9>OiSo?JHG&Rs3`4V zew1oMhy~j1DAH2H!&FmN-?3^t6^yizIeiq{Ox6=098D8-YZvUP-7=Yu)(5v~db97@ zu(0pL(?6%Tfe}P)FdMu!kE|KTI zB2(QVdpoY#m6CVtua1?Ey(qkAR!{!>&@W*^fg^d&CwQhc)={_DOq$K?VRMM3Y({0< zA)4oM3$_QeAuf!!o?D?5YYz{~zP>L#x>Y{;syS(T-9Qsu=P%+2VHk>GD8l|cE6b=5 zx|A{u+qG0GD!h(QaHfU>$B@;nBSJJ%!SkI_bb=; zPL=L0tILPa^l3h|rH*izA{>EeOX#6~&i%W2+LTkZo)S}PR}bkDQwRdU@N$=gK1n!^ zV<63RnOU~6vb2I*@G|8T5#?#3wMJKmC|Q1Tu{gW-xcD(zdv@xF-q?3SAFolIbmXoN==-EFfBrXa-vq4^`5wcCA@N^{OW?Wau5 z)zZ4-UOHf|Eq^MXKk~=w(&EoCM|dJZwIP}{^9YRYS;WvZWC-Gs0#ba62(uLCFzK8{ z5fJ7SBaYs4X*50Npn)>u)!KEUSvBqRkBbUPYi88Q+%c~<5ARZJ&Td{F{=+t!3B$4k z^325@bBKZvQxMRo=Om&DrXdS?utC2t#dvG%IF=@uB@jWx^t!lWISyc&0Xs1|Xhwj| zJkATnVk^L<(#!V}Uql&6tHbVJmzR$h_ODzi@4r@=t>6E5e(Cf}eK;Dg+?ZY6yRlH& zbEqHJAa>{d4lp?u2#eSPwGm3y>%M#c%j&+DD@*_Luj=aEh02X%|6(n@efHbZle5e( zeCyq5zi^fhy&ovP+ql=ZViXqASdJa_%m_ z{Mt4OA*XB0NKsfU&tCbD(x<(yjZ44J7akYS*DgO=|G4&L^;G5Va_Qse;{CP9d{=*q z!2&W6Llz(oLz*xYX84_=zrlhanjv-M5(E?r3B$o}=Yei{_YcVO(Im0h0-0nh1x-72 zy$&J@L5iah-RmI2fCT{19M`#n*s_|DZ7#wS<3=(3%c+ToGB%j~{*Fy!Vo>eZ?~j(uvi*|1CJ+v_!NLq%{7Rg?GsksoyT^P{8XO4R%(@?f2$-)JXu2KyklO zI&r6R?3Jf>|9bhtz1pR@^@r=H%X?o|-X5tOxTRY;U%7ZBRC%?Z6Vz|I_`4O_l4#sub?XmJHH1rm)OTGfNaOnp%x>Vkl2c z^4_vR*TRRpxF^y%buTseBk$>PdCJ04!M#6 zey<j;`4a?mR{ND5?y)t?W5n-BT%=S-uh@)Zdda!$lIvu{oLqCt{(rZ z%1LiC;%DE)FD|?CkIW}A-PO{`bz{c1Po#s z25)I`1hK3n9U?$1CM*I>2mPhKi~Q1MG#k=tYJ9A5k?srYJZ8DfrvQOu^gEd>?~5{4 zxy+gl<|L>uErChOC6_rTdhlNQnj#EjX+UU>V_Ap+hAd>b_Rq?IE7CrUcK>ztM5em@ zrEqGO&yzS5s!YRS;oNaW{9JA~E!golv?()@o zXHfWKQi|@=kg{06nd}o{h%g69-OA9pVpzmMj>Qx!UN6y<)girF=uyF1nFy+f1euv^ zS@n!)p==)cp?2n4>FkH{(&O@hcck?B@o##qnE@J51VR>(?lm)jIEteHRllE-!czc1 z2tf_X{k~d0%RqYTT|&`dOGK+l?B?D$xB9V#4J#v{UspAg>S0dC- zX4UQCc3F7Ip#Af7e0Z9Yc*7P-C|zwAsZDN-&Q zPK7d|hCl99ru8k~8PT9;QabaT#Tsbzc62)Fl71&^Fb?WDr=scB?Fq)~dw)(b6XYAB zwK>Oq^$5gquV=;;@ieE8Cmf6@W`ZrHtu@S8HEN3)nnDjh9AP};7o^ljBh@AMVMPE-x0J2HbPaAiExnmt-9yTE zPgV9@5q_f{i+6prHd{G#)S3VK_P?tq_m%g)s-3(3^=@_k(BI0-@6@X5`6d1fv0L|m zY;cnGIMa#N^BB{PR;n4ak1}3i$&ScyIyC9&Dt+Tc>B8H}o7?|Y-gD`vcdskg53XEW zyH>h(u}7)e)?YIQOZ!3ZbXeM5CUzn>+sq@Qa+yEZyh;fsJccR01G||324tB`T2=o; z;SI6%+pw@JYn}FH8YWE|V-8{1aL-mn!>(Y2kBx!}rkVQvu#k4R6;<)(p&_nx;LGZ< zmD$y&l}p!(^J}j(8;5JhKJ#DL>XV`Q{!i}~Yp*VSeOWrNuXg0!`X|Hp)z_E)o~_GtJqCY!kD z!dmqplQ7F=Q$XPz>(N_;GRLjCY3T0gCx!zE)WiGU-&W-e1Ofg`H;a3v`eqcEx)3g-)@ zCu#NBcXaqxEY-f>?)y)%)*N4Kp$4!?+mX?|=obiJs zBryu5dI!M&X)f(BG?sl{M8ez7)zjS15tN@un8`J{!-QZu+Ax0(*RMC8F8sRj_}uEb zZ>qN&=O0zCR34986XHXo21$OZ_vXFl&DV$5uC9Hjs~+E)Z|+_G_Nzc^-@&b==EJ+| z2U^dsHuhYvAHGpLFiw<`Gv0uPm4YC-Sx<0iLY09{X&%9j|LJ7<7h}o^;pt48%{;AF z(F%PwB#A^^!618tM|5|>9QN|Z-T!LiP37$7!N!eaYsV_5*B{ouKT&zMe$BhST;FqK z?R(Lf+NpIV4nZ|Jqm_F(0S9~pv;|x-`Ox&vVLB!MYV)CbapOki!`kC)?fXZb^(SNM z0ZnR`&Y=&nM+Aft?1ZG#J47Wm<0Um>{@MNa`pdJ8(~Fqa*?e(#>)O|qrOj8Bw~beK z*7uK_dBCHz8<0J}q;^Yke(-Y;SRVbi?gQaOl7F)cKH7B)-_#l^`%Fv}o zof%PfM32<&F4lf{XsbSNy?C{`RDbzog02V`qeLJ^$T-P%bdny5mdNdeGQzG8q7VwE z98<$>X7vq|FVvp2rv@&XEaljc&JJl8C<S3@A$a{LeOX?T)0^HDcnX8rM&59o=}c^`No$ zv3}*==KTp~ZiM0_nACAjiqGd)h(u#1qLW2w84u-W!zjr}(FL6(zw8uM$(%z;4b4x0 zAyhkD_Rl{*MM=3(pvaWG5D#L|z)7FrEpK$pJoR2JSre z&cKL)Z#>=Wo?xi+K~91(;Ki)ua6x))N+okkN0j!r^%u1hH_f}N&(==-_-20VcI)1~ z>b*(2Jr{7Qwed_+C~#Y{Sq;B9D2&>unkG5o03eBzB#j}&&o2#GG@93V%F&2Wkc+Y2 z6v76#LFEt&1?5bd2u-k}u*@w=iK+uY%Sh46el}@9MKZB2rMCH^BgSd<&{wNZ*6z2S zo}WaQp{BU&0I9cmhKuz;ts-DXN0ceuytDqXb#Jlt;9TwW6?B4vZE~r{s}lz}$+Rn? z&kmQKC#)k%ZXS8M`C|P<^ZN_c9F#rPFc7lOn>L^-_MhCKP^;gDce-g_8h4q~kjGpXK6*Vp-lM=d}|WOY`-c z`&M6U-tspO-mD%HXt_U@CT5&cYtm~`TX}QX{jbL2?WxAw1C2NH8`oFf7~|1#2F5Iq zTS^q$&eF$ZW}k~&xZf#;BTfVl-CuoFdwM_n&6vVSliOmDMWIU0N)DuT?BHjvg3;@? zXWZ_d;xmdb+2D>lLe_X#CGCmr4y@+hatiYY`j0ZDc)+&TTOoc5&ocj+M}7HrW8uKe z+FWHJQ-616o%GLz49jDVsg0WJ`uYV=WGad$aSFS`=(tSido*Ogj~`u}j4r7O6_Zv*xpY zi6(WWRCY!vuoDsHf+bBkEkZ$5L@`&kQpsBmC{0DBP!O|o$C*jK9q-xitR+N;x>dQK zIP0TEB9BS=LpRWsgPZ#lwf7I#-~0a>Zd|@zUi=<>b6KaOPNBdzhHJWg)%-bB)9qUY7S%M0Ou#galgMOD(}09SOw%dc=~cj#P@tNz zxg0qd3+A@YB9_LQPRLCRWkxe$v+!cR5bZpMyG(`~D_`wxQ``sX5oPB~O%V^GW_ zM2kkew9BvQJ3x4kR4EBVfP?~rUfUCC9xNvpXUjy{ zYJz@|R!RnY_dpD&Z2+C=-B0ktY&jrXvDB!tFRwx^ zV*Up9x-?}ez=%CR=vA9cVRi-lpVzm(aL%6T2VCsrJnP8eLuC)pFFW-v)R%L5Rm6-9 z_in;PcLVH9*uARUtTIgovT%|f_PWX?-|Wu49L;%+swAtaz!0445pe{y`T}JJ?84JQrL|~M@D{#yw|X|!FTb4g_;)Tk zs4J;)Keu3S(QiUkCZobqV0HxqC800%|Fot0e@Npn~n+pBE*@0eF& zj0gp)Xap9dVNrpNB2nbTz-pExc{chXAc-wwcB`q*`p*N(m{m)RMDNIH0L%!=tgO!l zu>c0&B=f9K(%SscCmKZJ03MoA9bHi_Wj=Q2!SC4(e~fxxSbO;LSqy`ki1^!pv`AXgSNx^ zI8-n~5G0BtG=92gD!7N zMOqzA1xcGwkbz#~_U8jVlPYB{T+^IgUJ-=L?Yu-B7I&gxjENmW7{l2mANmYBh^f%4wQH1Ms zOQMh>P=p3FLgA1?$YF>FpU*7?2!udL1hfeeF@k90a7KbWP=tac4G@SE5Fr4LL#q7( z#{hy67(r4rAW4kucrWt6KiHf-q&ol@FY^Rmn$g=8%umGHxV+2H+xbY!BCVa_1AoNi zfl=5GzUc@=lqjc7IRoh)#tV_=Vb0urXvf&&Wv-`i8WK3ghZdQJ6i!n}j|HGVN7I@# z$v;b-VI{O7vjtR36{JxabGnK^H_l%tZ)?Y9??bG1?{?Pr%&*^UT==x|u<>kp<8JYH zTi064duz*=h>b^u#-UTqM|U>oM`Ez10fA6}qC1QW+?fqg8scr3*zm-r+ei|!4OAY7 zz``gL5(r5GnkH$AAlft=Ls$}uBDd>7a-bwQitl2R{0$>Q2D~|+0STeC;xuLVD_JU- zMS-_LTw@?1p%j)ecbO7)#Dth*YL_F?r3GWbLU0iFrCf%=fbw8Nq6xtBzKaYYbAcIq zXvF(AltAh)mP`B}bdCr}TQ_=X7mrX3*)_$0N(^$2esVh}abl*Iz{H2h+K2lS!b3=T zMz6O>QgW9;3;T3?d@zxiA)M^&)jQ!t%Cbc7AekQ`l9_RIdEOWZk+_zQ((2C5*JzkX z=k#$jL?mZ}roJICgbuODsn0-$1S84biFJ1vlzGN;yZ;?3Gii6o7+{f(r?$0d33TVf zz$Ebc{H|OyJDb?v718$bahJLa4{0P(jny98ZeJIQOSk~(%fnr4MMx^v`hPm;q}%fT zdb@fW|K?wXjf*o_b#CS1)|1sAS|8r5-u2L%Z#Qmq7XJbD#I&IC;lajt-M?!GF8puv z&Hl#g1Gd`ynab(bs{_sbXKJUPRbTx0>CNhrslI$_EWl;=+A+Z|V~sb@ge#xcjySOT zp^J_8i~lpbxinMQ{h3%73T`&gLMGHN_w0sh<3oeg%BY}WWP*jv1h&mt2bUasWVv#Hm2snj;j^t$| zTA{#`&iypti%}My5c-l{-P5>tq4nbM#*N0poz){MqIx~wyz+K53?}MJ_Zl`W@cI2d zPgW?X9^KVl+x0{oYPYxX!C`GsZL8gw6K@@E+}ZCkSC16hPXE1p7;H%ZB?y8b5xN}$ zifl)`>Kzd&9T}0DQR4c`+U+@M{mO&dzE8cf4K@TuJOx(a>e}L->I41~0i-C5q#%kQ z7{CxfQ{Ym zBW1;m1+r=}+dA>6x>UP3S9`vgO#Qlgq{& z1LJ`HCom2JFQnd$FNF~lhN9hA8~=HyXpcNn((vC$)LtAGb3eCY9~7 zH9zKJY*6~BiS?L?Msy{%1F<7o(0jbr;N(q@6AmeFZ8lDTxNbi4q~n8K%ECC02_sGVp~ zaaXKlw&jCG-ioj7TYp8jE+756`uaDv=Izt9W2a4H>gmy^5p4{$$rHdUW`}Hd{a^Qh zwg)n^v*J-M(3QpJqc^N~{9ZBsgo=}*)q+yUqBU}B!{=pXNC^d2F@P>hbdb%C{&hjm zU=n|jbczx+e^w2kB zu!dV=3Q_uEVGD1WzSiO8%7Nyo`PEm_)f0^;d&d+wOO$*vR!U%I#=%NZs^ZGBJz(cn z!wWQOR@C-EEe!1L8=lj4Su`&c7!*wSQCun%M6{9!k@7K83zlpF!}CHxMiLGaz5W~J z4&n>LpiUo7QoVVwgX>5%Xn_HJ|ItjPXQTO^fDg~u!Fs^w2oVZluAYM%OJ-@yNZ0xQ ztei?BhD;9k^Q%X#eRqFVeNkB$BP~X2yufy>lUXC&f=c{=uG*e6+S=oV+R}C9H>=|u zRsb6wm9`r68CHtdqSUDk+@ga9VCMIisoq+B)Oa#qd-m=ZjaOHiA0K>^4sG3U9=}d| zH;#;{3@#?O z1?VjAdL);pvJzfri<73rLoQf`~{4qWBou%>={5z*8?_ zK`6Y`f3)~hXkq*!o)DL3LpoEyJ6MTL@}FS__$6*lj(;7yakzP7A=WxISGiR`cys+p z>%zO{o2QlU8pjS)?~f4{F=-AMC^l+VE>fChI+HJBVDHQsR9&F#Lu(wsF#l|dAzq(l z<|b!6h%-mCB^c;sIV+M2Wn$xm0HpnT7wX2fC85CMi!m(*Z4yR>f~beNz?s5YM+p}S ztj?X>Wc!=-v>+Fgi*4zoMcO}yX2>*4j+1(eDy6q4xK4(}q}FB@3TBf!=g;kGh_{Kz zSiXj!eNsBs*|2?KIf=6&P7XO6iUG{|gaUfIlhnl+VFbcXToO!D6bfclBHfpI8LH_* z+-8yr1@T<8vunBw4jILGF5%(+)3iX5m;2S;fQIpbFK(d~I3uBukI#5?amKH*-a(EG zUq**Pob$NdQafs7e2iLhQgztK$WUcP9Jvf+ql%I_4}?tqDXBHg*L zBB`UKU7~@`F|xJe?ZfoNUV)B4JMIB`^NK*)3 z_Xk8Jg_zWa@y{ItaR!x6ItIlVi6NsLKMWv6~{+S|EsEun6MW+1Yi3qHvJCfg4_{$bDR(dM}mTRqEY zWTY63A_<6~B-SS1BXF|odh)rEVnEVN*mrJ|Hj$GVU~ z+c;gjak}>Ia_jiX=HiFO+@moK1T+RP8f_EIA_xs&JL1TwSTH+;5CjBDPymwjD0Y1a zNt*7xX87(DT}UR1MF@50wuhHtKba0I^{L(j>hz3JS#YXktRhg0lM32k|Ifh?BaHZB7-6*M$r(39kX%RWd}t_8pnG<{>L%EVh{lcg(4I{ zD4M1r(v4U+9Os2XNC@zDRFuvH%Ld+zSVTwxfy=1j0}U zq-lpw*)@#^(Op(vR8EQ4U+)ywWwc<>1WF(THc~8T1Y!tJC|T_ev1D^OmtMjWhS_8> zLMB-mPot0mIHX95BM+^)i$A`<+qk{hdirqny6^9;%a@u9FC#0rs(V_C_o{c-E-70l zp4DG1j}{jck|>T--4k~%zcz|d7z#i)Amp&DP$-HaBo2^CWQC$I2q_vvC={a+6jEKD z=OGs_6to?|=(e-yxNt67v0tkb_ktXQ}FgS=jaC$HyDz#>Hz9&v>j68*>x4xCv7-%S?&eLL_F^MkS@$ zK{A{ASRn8bc~1dRGJoe&myt3vA)p=+1E#ikaPxHaJMHF^=7Bqn2Y1$Q|IDFZ`rbO* zefU-V$PcY6r&ljD=gxoIPhDGHd#!CQKK@Ig@#1M?@m1^g>E`*p&5!4Z+L49zr~U70 zZ%%K#-kM*1vG#UzPyN+o$pTOo#WZo4qWZ_C%==CpYi#jYf*#-C?F6xVtoM^h5`b^hr&W7 z!??P@x5ji5*cO#x@4H{Z8z@2@?+ zyYV_&dw9n9ZS(ne)$42Le>YBhBxsDFF$BRe1VJbY5b%q%V|zI(OGHT%lb%A6_c5uW zl(@?h-MJ$uLL;?tI)h=WtA6Fcg`08$iA z5(vrGgCoV1F~n7cF}SU*^+L9E6=9=}qXe)0uz9v}@Jm7)#^U`yakEnrPTTZ0K#!0P zNTDQzI8BWZj%k3=H~}Dq4Q*&D2a(FzY*u_`hq#%A6zsDWbc2agw4@0^-{i4}}ulpl&?T z*D(x|pcB4xoK`%mp!Bnm*;$=?X2!y&&aT{R-g{KL{H$`k_3`S)-pbzUgXZCvtH;+q z3~RVt)l`KumC&-LG(rn)ytv%jf2#5Qf#%hV8)sKvG!D&NFd z_ljCK-)iFWwT0@5+L3d->SXid88Wl>wzl*%xOQ`(v)iTfg*d;5MoCRUg+E zK2_$B>T>h?!OcsXcXcbT*RIuGp55BBaxh zw|Q~naP?BLdGV0^OH@_>ag0Do0w+)!f!l`Zq`?cPDTIa;j#3aKZ~`Ytg4#i49km(+ zrQ!bHI&G;8fj?rFJ75;;Czs+nxU$LcdlB5u#y(Uc_pwJgcBZx;63GJxtR-dA+XGg!OU42;6Hm{#pd-*x~twUGJ zf!T0Ti;mE8g{{|@6Ro8)nt%N9?;AIOyY}f~y!B%5KmW+sq`W$*-&$s?w9ZIeo*Gta z6Lt{i)&V!mG6~O!@@uc(uAZx(e_A`Vu<^*>T0Yu(dq%nOdi}!cp2mgqe`!Ac*nD@C zQJ0`A$I-1(+?K+9!&M2PW?85>6uvQ+3x`M4rT*;Q)?QRApQ)XD-#W86rTgdV-1Pdr z%>%Xf-!ZBXiN@{0V7#b~uxnzH6^CmfQKRx$tmH5UH5^S}E6F=Wu89LC#%Fq1=b@AJ z-nn`Jb0$SHOM6@94Vp+eLcCdwE;W;MC}20z_~<~5wtO3R%v+|oD0Tbz3gw6YgR)aa z&h#Ip{l9dUlrEkR=iM$IB7kUAjVt&`0H&r``2LuM1MV+6DAFA6Vf#e^b&xcH9TEDP z;P$GI;u51)Hq#A#l8li4lu$5*PO&lhGJDF%a~sYNZ7<3^p&3Oc(sL_Gii>`6G@DL| zBnek9QKc<)bWz1RfGXV3+ zggqLvq`OagGe2m4TYbU^1S9$IxG0L#G=?EvwXV0-U`biqBY+2x>#~IM&N$Tt>v#4Z znI>ujEe%w&Z%NQoZEN5Tzk@df2w|OxqjnJD5EE z*9W#1M+QXP-t%GixSM;r4=EHyafqV)!QC*3V-(rm*v4#3C<;gdP&7mU1dt?9i1Nlm zL{UhRC`4!u%)THV0@;UxLP61tNh6rvzCA+4U`i-xdvTUEMko{%#GV2Oz)2dQ2!>K5f{^Va zXkLVUe5>vQ!p%Z-zZwaXuWC)#*!ufIFO!TaGTi9(zJ z2--1xX&j#jW)D$-qZCeI2!fy#f??QBu@rHD5d=+9c>AntyA@;?eh(2EkR*vgKoS&! z5~HFlIuac^ZIfDTP2?SsW3Rp9(GWYxSOPl+QD=%tqpM16YaN67aZr|#@ zk<*I=G>t)w#CfI{ia;7d8U_4l_h}j@X#x`M={MH!Lr|IoG>%~?4rl^EgyQ3|pivyQ zhnWL-$0+dc0lfEpxVpSazVSGBe`avRFcRaQw3zH&+$am-4zk|xV8D3b?IBsfV3<|% zeA9)vo1#e2NqcwTJn;79XMo!!wp2l6FUqsMbJ6Y)1f&L|J1vsX%=Gp!$fRKl zIY{haPGUb37M+PMZ_UlsFWz0h*?Q57aJT#0t$p>gCu)x#{b6?VWb^sy>H+_6>n9gh zPc~nis$Bfn>KXs;UHs<(jMD(=4nT6&4$%wrOOQAM36dsI3IL3z+qX<(f#euOAwiKS zw!O6g93`j`F%z-&=|N{H#R1I?n%F+$?ZB{IE>+5>Pfda(Hz;QnLP0JK4IM#s8jOlG z9VqHe8lga3*2=()3vuN;W?o5M(9qHulR_vk86{&u<-JbgN0pb8lLl0*%r`$>Zhm~^ z&yB*74goR-F!XJ4{tY7@EjeV`#=eEB4XY1sv>E{0GZDrG87Cl_;Sj<%tHt zphFD2RgC^3hHRa7Z@g(ff3$vZT;+x$k6C3z%$eoquKwR*^UbSYuI|ZiE*h&3YUiG; zp09s=(%f@xS_=bLXUADeGJ zs_Q@eu=Xh0e0PAGC4a<#+MxrE%{Q&R&suj5HD8?h@%@$cPsqPoZx0Jx<>s9awFCPn zk{qkYFE7OS1M%5rW-W~)&+7N~u73<|exIrz{q*ga9&uA_`T*AIFfAyQi@s18rKHjc zmy!C?+~%DzWllkMA&3l9XgxaAI&-*sVB;lP zJ8`6T-~cAr&H52PdR&TRvz(-i0?OFJ$&1!!u-NYe>d&XlYKaE@smui$RX{8hq*4;- z&qCV0B>up;85pFT>f~Xb4e&kl-iAMB90cgQ_xJNQ@Za zwL5?N=i1@~Bk3$Sf`F5TN1=t2WFS!Q@gNt_5IrGjhk!FC#anT;Ur9P$v??#V<_AF`AfkJg~rCYO|oq~s^cs6r?}sH}x#B|0TKU@)kK0(RHtQbK`JWzwh; zkiql92E0=~Lyk+)04M^%x6MWT{{|R7u11U|sf>4-HvU)Z;^kQL>6OaUjT@Dh&FA-< zZ{P8(EUa#n$e>V=qvg4Xlu6%UA+$olRH-L4qfo4biY$aej{ftE)R`GD6OKY*XLXF zC&z4QGhQ}55T-Sugi@|7S|;4P*Pb_yE&ggqLE_i$9^G8IRXJQ={@^TF{hr#Pck4H6 zj}Q0MIhNRVi~DksGAH~9e~s_V3ah6oC*-vg`y1asZR~l_T%2EhSAW0HKc=(7<|Lbh zCE#$wlycpMaeq5$xp8#FE)|GIJN-pZS=Y74i=R4z%FjpK&N1NB;?*(nr^i=hLHX|1mR zlyS)emahNLFI zpkp1nX9R@95~+^qJ3DF@W<9$z930bGG6`qIs_eKmDB{>I z0oxs3tI6`f!UZtME>r=hOoEkh&4pz>2HAONASxTW$P%s7JdiQ`)DG8*Ev+7(Tx5F1aUIY{xi!p-b@ z6$D?>^YSdMa_VrYol^@+?|>2=_(^>)EoDp=9bf0qes0%?Chhi^+bW8u4dXlBX_a!C zj0ZIK@!f8cc`3C7WpzFBB|T4p2&V$#(WQ^??EH+3uczaAQ(5L2Pl_<6Tm24~T@jHx zqUrMZt}RN8%uM~tJdNBt&d0QC+ELiU;NV_)*dyUKCixQ zU7xQX-`_lcYEtM8L%@b0D_T)ZoTOFZ63hqsl&nL*l#b(tA{UV`P&yq4r2|!>tO_Px9 zK{-AXkYg0-sc4aT@`u=revB$=@-CTdRBJnaC-xAhsTd>>h#@pS)Y{$OuI~Fy^U<05 zflKw}k897XcN(|m{#@C+dZxbbSmVMqV)vN#PNR^97)_y&Bv2Z~VaJbU6e?#IZ-b`= zqD0)Q>OV>H1MSBSrG?HN8z1JKBq5Gt6x}(7;sGC$ZFdzO^daGuQ=qf`@!~W}I)|nw zRUILUK{(6K97h2OF&yRM5j~sV*B)Ig){Z=0dD(cf)PBqFvAr!MG=+81CS1QAnji?2 zgy>FyADSd+8teF)k3%w}C_<7bff6)D5N)VY=Vx5^I2vLoN#boFb2mgETB3Hu```ef zQP_o4_0T@b{!ou@lL`Z%APeECn46iICN2gWKP>@}xUD*LRRQxc8? znxM(Y1Bt=?)qJ@sX%`e{HS6pd08hK~@vX$nJ0l*Wgl_1@7^mqK%$TL;#jZk=5{+Bp7b<9Ti0)vp>q%x&D+ywzHo z8!e20#7P1Nz5B|ccqtT05fnKJ7z=P5r)Z2KClbYJ97S;oKuF;zj$#-fD1Q79pePz| z6FW=*A9C0VB5y~H<6wH4XAWvE*Z7kP6UT;1;G!7IGJp^-ymCmS`kGWD| zGz^}KhVp8_{9JEy%B6%~p0tWa;Epy=HeVn9@%8Ic^T>_*^W#YE#^us%Q|n$=5KBtU7N>SPkOj_HX6zHzk^>c#WneV zwcb9~HSV9Q?yJ2ykF4MPRsF=PmDl}mRqi@i2xcUaDpDOjbTI^Yu3II7zH&-BTfgpBh09_XOE)x{a#o7!Oi;N zmw&44S$kW1yT5v(_4rNw#QDanm#sH2z-EM&=F z^3WZNKA>sy1#`@Iy-AnGnKn!e&4m-dkAI0JBZdkO*OYM?F+Rh6Vsl0(&+(Zv`jR&^ z)|TNCyy-*oN$s3)DM^c{oL)NK%JF*?l37l(m6;ukoL=9Hicsk{y6_~k|4o3||Fn_wi;%n{JXbYC(6%4|902Atvpes?Bh_DCH+WeUjCL6@6KqNO0;FsMnp zI`Fw;AYq(vj2Qq=YJA@tIn6HXl@W`QLH|0^(s!Gjl0@O>Fxm$fl_P9d)FU07L3Oq$ z4KeVs>}*n{;7p%mY=m99y`i8afsug5X&Mj+L3b63&$GizR`bpkR=Kl?gs^jIn~Sc)J_~It({rlUs-A{zTH6wp#g$1xbp;+r)IdItYX)jR2}`+;nCgG_;wDM_bagN=TV*mkIk4&%|mD)h0Je*QnkM^xy`SJa;=C#Gja_jgHTaSWY!r-9~ z7er!A(SMGNknL#{0R&FbG%-rL0YO5Fq=(5njHZCJ8!nSqx*Z|PWnf7*ZHPj4-tA?E zA~3FCOBzd`LXGdwR*qF}3f33aU)JuQZX9@Bd$OPS@y+ALncEvDcaUqG-nLQDZmvVn zNr+b=J4r~0is=I-1a zV`n#yU0b;&HFbMo$B>b1gPNpJ8jvJKAt-==#(GC%OO@DBYtWVJrzURZgkUn(@(#0t&=2xo3tz5_#6rV3SZbJ*$v- z*pMyi<=h?b#j~xWmFKl%ZyI|q*B>0H|FC!cSnKlKuN&_dvhMo+h5D_tGn;3AQ$0O; zeE{t^n|SYto4YPOalM_4M{Me^-UuHr*Md(C;~7H0q6+g9}2dq$!PFd z%pWm?7CBAX9S!ov<;!}|xPEu@Qe*DjgzedPin^=>lpd_^?`23 zcgZliK6orH3=6k3*@(ix+N=7rGwW9y7cM92haUgwug&ik8HE+ItXa#LZ2jUHF9gpF9nYv(!7{8?RMdBd$uq2ft+&ffe{1D_N8ZF--WCK3T`MKj@GEX`LDY=Or zKL(;0r@3N{3L`KVp-}D6=n0AE)#6;NXA17bJx`F`wSu4dy__Y6GU-l$uAOcVSmX*` z>dUkH)^2Sc{cGdO!5=>!*|=2y;n>Ff+R6X@*(fj_NlH#r0|Du5g9B^7w+-sDvgqKL zrMC@kp4?hm?-8DjwCHh!B2Yk6fF=n5Kv%o?T!S80I3g-E$wXxu#5*@mDi23vHibw& z%V}Rq&Ekqv9$L9r6G-?1cst0jUoiyzDE4q zYxPnhS2FgWX8M1rLTXGjGeTh^Pzu2@NQ`Dcq#%MpK!BkWf`VMF_2owEOXjdDo5@Ku zEM-ZPKqyHfBumC-*ya?DLwdU(07q+T&M&T?*tP{f(g+TuRHhyUmU zK`@d)kS;TOFY}Tb1Kiwk3Zf`Mk|ZN{U`cYDxcAm{>%)z2Jk3LUsp=_9 zx$-*Ge0pQtA;7Fd=3=qi2W+FQe?Z~+HjNpd#ov7QYU9)9huWo^t@&ly&t>ZO1aKU2 z{QAkiHTIr$*52N0oZHv9`np_wAgLZNHl95))%P58u?&Ie;>pVi|@*c)=uFwp9f&m?jGCm2l zLp(EWR(&>Ll4m?Xk(cx-BnK>tMspeZclC{=h?=lvof3I66WujrB#khUI!GKbuvl5z zIg*s`pyG2)BX*1~Jj1l0x~{;eqPO<(nnWCfND+${W_wC4k4ZEzh)Q-0kw$!Yj$v!? zv@oxCD}$^SCd8sRkR_ZkeOb$Ih)hb^8SR|ajpoganY<;Fy`)abBGFO&nOWTHGGn`V zsxi7?mE4>cD^g=hPpKnhVpOqH_!M864ARct2@>l>Cty^xIRl5!bk+~!n`axBk2TMK zSKqtTxO%kmss8C$i~N|guf5_1?%Z} zLYA?Wuq?Bj5+UQ3lhC6gQZj;Fbv9*i141j}p-}ZF6cT<0)#lqhhOL{8Yu`&Y=POGr zHq{whrY&YnLe&|OC21?mH9bmI%q9me>#n}B-hl`)DwP4^!NNu0>DZ3!t5X!15(9>yXqz)-M^;j9w?W> z%T_9=;$?;;5gZ^Wf%6eVZrgHgs>AL9druE>@pD2Z-R7-}a08T(0A=;MD zaF7U;z!01SIEPZzEz$cNR+}p^#H?zT#$1?C;8VCV+g6b$Ln?#XYK3U1CSyx6a}zzku;X!4nPt^Ax1+Qr!fGD zjy*YwIu*rH2vL9%1f+2U-&U`?)TtDO5hO_wfS|V3I2v|d5N$$Ngn$T+0|;nHkDyfT z?D0K9RkgLicqb)%5lhO%f=?0hqJ{B^H=rz)Tsh_!2|h~JoKl@Cel8>HG(Z7~(CK(#D#18wdZ;diTTXz1F=~`d>6I zTyI>M`~BvdQIl~RkQfO7MB68IL-7j6ETuUxkqS%LJ_)s-98S+LDLA00}>@6 zisK~KJ{uXnphqy0!f*=Z60kyK7t1han#D@fKxfQkl1W-8%9P}tw4aHm)fYFhw9588 z9z)bh8k31~WN@@IlC0GY-6Ex_<0#0cYc0xW-S&c2q#KMd4`*v()kzUVTxs#2v9 zFWcmvV$?zKzi+o9k?_eASj^e=R_Q=Sftn{Ys;?9P~U~pCWon3d* z(fq9#7It}YeaG$@P2ZZ7In=ZEl&o*;3~{)c2rc;;G_D@4Io3PC?+r^V$w+9A31Ls= z!h^&PgD@(}*k;w;xiL`uy*|Gy7tPKlwl_d>5IZyv+%i`T@$Tw73ius{U2N4yu9IZT zRFRtt4hPww5nrm1jpq8<1d~per4Zue1iZNbHyex?WMdSmkN{a~+X03w0 zFf*D$r~VBTwbcWg$19Kj`^VSMHlKgnJb$fvyzK@xhJdzmw|@0}V_~oB_ti6h#MV#! zcjNJgWMy%4xvlq(aadvQ+cbueG>)MdMk4LNp2Q^kHY7-z!~jl1nt&*VLyE~uJEW9H z(^;=vzO6wTDHd-n-oBOSIiNreZ*AL$vBUFhu<8cxD%iMdab$*5NzVx3vpTvW*{}Rt^+? z``2v!*gI3}?frapPwV`%?H2T_z<{Fx976$#0*WFaNs{eb$gbjJ$;V*af$i#1beNLc z;wVYPx4SCTT^e|}U-+p|x?Ch8OFA*QJnqwu&0pxIvDrnY1w}%JV2OfO4f;tW$RT7f zAvVg=p6H-NHuH;eRwNWqA*adJ$6tgcdO+lbf=EUq0U_xwJ|>uHfhXDiN8(J*sN3L` zn5$@t_zK$#ACBV~Y&$N-LUCy#<_g8zort0&ij(b-p-d{`zEj}a|JvGLeOdX~IC3oN zUpuX=9I8D!ONENHTc5f=F}FLkf4@C{Bf9?G`o-4b{mq-vU0nXU?OGLrzPKfxab-gp ze`s6M+N#Irk4K0uO8o)d(1>iEU%UFt#@=()BkLE}4y#6tj$0?f2hr%nB}+!l%$)Q~ zydrrvCYKN8-@1Bk<4No2>9w;XvYt`RN>IJ0|Lmd)B7|nwxd^+t z|41Mz6WM?2nawG-rn$ zAE>_MOrzUNGL9gCD?8JGrnl2!JM=T3@YG%%Y1}$eeIu;itS?+LiyC|9e`l|~dB!U^ zwL7POy|obgQ{%gHt-WUxt;g?LFArBSb8jW-$4v3JIvS7FI&<0GCBAP6G@O2>$P6YW_SP>fL{>-#WCLox@IS zS&l$*hM%Ht^--pN`SHq)+KV^V#@xZmliG`gn40^0rP?7fCi$yUTRLhq{4Ljb@ZhiY z{reivk2mh#7mQJkx<%hL1jjK0m3zs&J`&%!MY#eU98dt6|oE3?SjuN*Nvy_(d7F5~Ox^b}a z|5;gXJ$|?T{pxGWuh(y`-yS!DbkI;{C5W>#qoq^4Y%ym?2Gqqn623xQVv5O(1&bxeNM(`rW6_zEt&|xo%3nqSYuBsQ(48}wBN3q> zsAj$Mkfm9@T9T7mY(jz7WzU*SZVXtn14uG!1IAUh{%q*8zoLL3AfPbv-zh|Hbs$d_ z2(iWjM-0=CAD(};akBcfvb=d|iqj^b$k)SYBR#_~f z3+Wk&QX05nDXpDM0*dK$G|oTv;|F@@-qJ;qu2B=NvRvK!0V>3zVM;>;>P;J>DtnRKUWuP zrw(GZOV1tSwt7`s=47QLimXQy(CUnMATgv2@K$HzV(rBt!PaFbHl|z>L;`GGPvXGP zp5p|goH7+o75I0@m6xp}^O4rviLnX|=2lU&Y=&?vAZAHciY!_{b8!IWI-dE=%5Vxy z2?b$uS;HjOm0?P2f=&trbj--?!mLs+5(;|z&JGmK8BzaFpW5JYN&Al^l~v|?X5~-e zWtF6z4kvGC%5BxR>r344)s)HT;1AUByVVODw>FLoYR`@}j^6rZZEiV3ZN98uKf87} zj&t*gpkjWeUdB=|qOa4WP+-c)NJmhIAO&t8FwJwBWI&1?clK5d*1Q&(Eu$F5|1T*# zW;!k=Mrjkxi}R}Lp4P1cYnLZjM%`wISjnZ!*V}C3tj(hzE?GP?in714?}}{oX5-nB z|8MI;^YBvr(re4w`3Wi@RdEu$LFnToA;HjWBrlyr7op6ibQlu~vbf7Cm9w`fJ*^Q6 zq9HLW(HtqNJwgE}JgY5GX{5}*h1hJt2FDlOl2^Z5F4DJFUgTMUy_d=qpG^iNlf8()!W&tt%J4-n`p5 zac+Xjcr+RvSNYPEgZ8r8s+eFl=;<;=Gv#Qovq&o*(4qlO9p z`k(7>e^a~r?oZ8whkpFPdphD3d}Z( z);fl`y>kopdCct?m$)5tLi&y&Zb#c7nhA*8Av(m{j`+($LCP3RZZ9V8sKVqD3Y76s z3^Dnm5r0ztrOfT+NH!tQ_lei11>(4w$-}P25XO^^@!=FP#dwoTk_nl{CN1jtNZzr$ z+>|9HRx-%Qpj=4Ea&eL0#LSeLr@Fi&34CX4CT4*zn6qVT=Rl+j8Rz4GXR*fl-HJe7 z5h=DGd|t82mYyAkV$KmHwI|*b2~m;z_Nr!s-3j^(}mplKF7tuXj*0sBBQ7Jgiv^8I2VTT zXsmw$wG$p5bj;TgaCoOEpGptq(&zslU5DZ_P(L~`( zYT-7Pk`wd+5$hsGN7TSov?&U~*f1c6L*XaOl+CF;A2&er{k`VCi)&BP_4$*{V@Ee1 z{H=1P@~Ca`F+Gb~fHOxqGXBiKcWG-PtduL)J z0QpXXMKZ7+JFaW?d@Sb}uzYkps|Lz`AA*13)7t#MzKQ&%b-5Qia3lsFryve#0;OmG zNP?hYm%{dQDF^&o=0&$LGOBT%hU7iUFsB(1w+}UB>s({u_P73VZ6GKVAOOX2oJ2?x zL)wtw&!rJiCJaRzr41JQDIl+*%#u+wYyd@2njj%Hk{caR6iHyPACX|djlKgpx?a z2wuGAG>Xs=Vgv-E*!d}(fEdyvyC37!O%i}6a2z9O3ObqPzquAlxi#y z?T*9&1d0L-bO{Q3kou(97so@|ep;V803m3AQe6Ok7uywcYkE;E`oQ{2*M(bin-@1; zHjiFyUAtO4^j-7Pnb!RN#)D&IFdE~|39z7+q*lxJG*&CB`8T=8gtAX!_qj0 zm??G)3#TF7X{IzYGh;eU=X7i*&g*E?yZD_LC0UA{f#>&p=bvenmAb`s?^WGTK}hg( zw`qc;Awr|Xs1ST2!qiG~>Sz*bW3{>KZ~APt1Bcbo`r%8n zzxzY|{F}Are?vr7I^|ycX`Fdm5F&eHPuN}Qm{Cs`o8c{v!S5&Wm zSGhAd6;ydtzx$-R@6VNe-&M}^Q_J(!i|g0pr5Cjmi~L?fs!am0E))j1WFnw`2hR8909UJ z5hMXY(g=iTd!yJgMgXS(f|5WGqYn@ogE;K1jf@FBt=1+Iido@Vt!D%O0<#%4nl-bs zH~Tmfdi8})x_-KK<5=z3?v?wsU3XfSp0B>xbO$176u>U3cW46wBn@zq6vB8+K-k{) z@v+FC6hdJbhT#N+07J=*-r}9z7)|2@fplC(0&swE%AV)2@JEFH>vU4o!C2iR^7d8h z?3ZYH(8L7JdK`#pMyWB%WfFyQ6u_@{>~A=z_z%w+fHg-48nDy9+Gxj=D_TsdUE5EA)4vSwuXss_V)sCNDnQwf0 zP`$Hu>|f1iC!#AS*UpJc9~(!mVk?hwj1rLXS-;!vVogUr(qAYusT?kyf6|{<8yy^I zg4FGXEY2U{Z69lx5Gly^|3XR=OuL7DOesZ3Mszl=u3cqn;~3krjum5(=-6&03PdPfA5t!CT650Zh(!jvklM_p zG1Ac9%$jt#Iv-sGj7hmtYSB5S1vBc}l5RdTa&?zP-+FPjcKty4+RDAv=f7xvIwAQf z?8P+GcAB0PGM+livQovdre=x(JmTZnQxw2xoJ0W6eP~}hYnLCF=Ec_L&D-@o%j*{! z5B9cB@BU}3b^P4Q^OYAP??VFs2Lw){fT93_BPiNke)){Xkyt&qgi1~MI8~w(2{Wfc z6DSEN1P~}WRHN3>YmK|R{!rexwrH8G&);7AFscR=fuJ~r;TvWHO(B48uk~BC8P&MM z5LXIp%o7kJNfO0`8Crk<7{n18V%)7+mUINW$Fz8NW=+~1VeQQ>S=@{lS=j?DrVgpO z`u5SYo9x9Xf>1a{Q~bstfuJZsBajqQwaJZUq)0f{UJTno+ZaR<8lg#)K)N@~4c~A> zQ6xbEdccyK^2dIl@k3)Mfof7Dd(mv*f^UisKM{j9O~(BD5V_kV01 zI`;LiJoU$iS5EiSnx9VBE-clLJ>xZoDz8>|etEkvyYdMAzIk)e)0w5@j;}D_< zhIALJF)k1zF=}IRqi~v{DM)rhPqs)rFJiRZC$z!>8pUXmhL{k>6VND5AQ*}cQ9OCk zX`T6NFwt^FYRHNL5Q8Yqy#}+j^T@Z2hx64twF8?uF=(8oFi1n*YX<=&P)K7aA%sPn zKxqP^^msEELm@(u2nA^zQV2j1MBwT$07;AlcpFyOhN6uGqJ_1a64AE*V*6+-NNt>9 z^3VLnp*QfUS;h;qql_M_Rx4n2Bz(%|(aWt@OQflCVf`*6)0{i(bXhpYgwf|v3>y;& zrgvgondUA!dRS)lZuv!Nw`%=x`Tpv;#QOQho9B(E$Fb7G`jMx;`tJRVLWJ4kiK08;X-QtZ)Nj^yH=it2j{ARCzqYG!ZmIt6Mt@^ACtX$Z^& zn3C-}u3)uR%9d*;-2(Ki$1hqhueOeS`mQg;U6@M+3!5^#R1$qU%oR$zq}GfQ2Ry*6 zC_gRh+s6F0eC_;l{nR5CDhs3)u1K82%2Le5)jduY8sCJGB~gX+flawsh(xXzi=x?t zQpN^f!EkfWpS3IGH>&!hgO#22bBn8cDwi#*52LmF^8sN16+i%_X%s9_q%1U*w;N^ICm`X|CbL87N%T^gOe**I zFe<6K=fLF!QCWaKO<6iZHe*rsJBgn}6@uO42@D98Bp1>;I@4H~Le-hK!uTn&cN&og zJms*tfHSuR^pp_=Ma&+FsnQW=@B44J`2z~t7$?0}oys)CqH^hCai5}p#moCM+{|?tLe^`CpIP<*y%w$AqW z!Rggnr86wj71~A~cJ@0Q1su{9+IGTsSW!OItn#PwAtxX2YD>7PZrgM(j>@O?W74X& z*O#s|4_~kDZSFX;zK;@Z=fP98^A?~}t>6B#e5!tPU*o_9Z0$ko(7BNQFP}e=DMRh$ zVyZ`^N?2ziZPk?#I`Qme{p`cl+m`jy)wlJN_o|oc&tBAD?U#MKdRo`Kd#!w?dG&Jj zW$XM!ek>IPC_*7LMWO^Ga2g}qkofKwIaQ8PLh)~V#mMS4ky$gV7;3M&e))9k{O-zY zemN631teJ5-8EWleQ}@u88KWvL6Q9Vh4`UbIIgJ={rvvv50oIt$jY))s)=T zJ_|KK6=5Vwp(NG*l)<80VFU^&g2IGAMQcxNyiB5%2aP+ATThRt|6AXCZRJ6z{^1#y zL8MGa`0+#e%6skS2N*H?P5E8x@r&C2lmGECSVP4B25YF>j$?!pyTe{=aP1j$MEtk( zeEs~F_qWzBg4Ubct@-=S`4@lU{<%brBN3<8%A12N{g2hNE3c@Pw|{KCeO=mLd&!Kv z;tTK&$O`gVR!UrBiG(diTiD00lK^O@pq%Cpj4th?er-(-72hr|26^9a+#E$U^2}(E z04qf==jI=@D7^fwySiN7Q9Zi8zwvUZzVAij_S3bc)}H4hL~86FgNBtNb1Gy0nYrFk zep`AceZo?AT}pQJX3(b`wqTbTdFVbYJPl!l&+3y)}+QE z4~{jyj8dFe9*c#+CnFPg=qB+3JKl2}7lVZZ1kgAEiBa7qP&`z|Te{k_$F--&OYf?$ zn=cO3-z_^v6c(l2x#T1(sW3gqW)4v)Mu=Yz6~fOAD_?3oe%3tjaP@X`eyMV}dG$zX z2dCl_0H8F2 zfZ&i>pl;dPj_0kn_x`f7yuPowXTJI7!e2k%G>*})P47r5(QdnM0pnRF1DcSfBT7su#uEzojOyi_2U!v32#u_Vo*(erQ+uaO2IX+K0s%TVj2oe&kkb=Y!$w zwh1vXDwo`)U835P4KSmD(InS|JHss)>snk=X0-GFv z7R;evKJ0Hj+dtR*c)WUf?W(hSWc|VF(#kRgDp$rRlv&3~(3|p%qkf$XB{Dy*De5 z?9F$lGc&a-ms>Ayw(i_(zP-lHgqG#hnF4Q4+rR%?x&mA0{UCPiV2%tC8W z)j!3_8q@O0nK}3)2cadcVi2rY(6NJ$MwFKAeX&PqIV&M$li;KJx-jR7%EY3gSw877 z%GACQ-5mxo1ELz;%~L*^+fMxi9qcNaj3mFaLASP0zjV8HcgKiU!tFARZZ;CbS*cS) zFl|rTq6d7e&&20%rQ@Ne~ z{=Y*Jy2v-sjI&7g{{@Ji+-4UvF3uZQ9<4sNlrDU}*}U^s(>n9;m(bpvztuQ+c#M6P zqi#-!Bm|d|HX|En50=NoB1h7w(~Pl)7RTH`W%}qAtO#D*uZvF6E*H$o#UfeA?~}$y zY`1f6sOR5kjY(Zxr< zS3S}=dbo9EevJP2XTrV#0ixeQp1H7xYxo*nbFT0>jjo-_xdT$MNUJavXYB-=QEZ90 z#Ufsq*bHhC;y-=A_sovCa0L zQSOh{$ve`uk2+=Z(cQ|)zl>1=eMT2Sxs%MEj^->9pCw^%4$DqQttl;%k9s_6fkJGr z9;v)uKhrq9u=Yy7vQR$N__WkIzTa0n@FcQ+yR^JMkF)sAg5zJQnsn0EsHP|u=`DI^ zHo`w1@mL~ln2kW2&lTc~$_bhTI8D=d$HV%+YvC0Wv+)^z`(XV<^XkRV*VcBG@2DqR zXKsI9uDxGuz4+L?db%`U-~X2W&p$`$c-yv#ML9(<&PXx=Bb8C*G-8okHbRwF8;~*e z<6+4;y;_clMIK`s*z%|njE!RBvD!=*!HufH@zr9m=v3{w%$KE`! ztG;-ob$+k2b@a&yeLTW?n)Y(AnX{uRA9u})MU!(xCYxjK%tgsmRxDBhlX67EXZ!zB zgRslciv*~Oc z^sHHDcco_7J}##;E0YEy=+JjQe_qd8(FWy-HQ%4FKCUg?uPrV#Z=N4f6ouJhEU-nI zHZ6?~LnqxgrO=VJ( zl4OjPNb0lGqlS)2Ef)Es#XQrS>F@!wSfqC;Ojd6e%w`!sg~Xz)!r=4rO)zsbXO|}A z4*du&Y5VxomawE)djn^4N!x){qqw919g|B+AjlAylrY%EBD;#*(CnZg=2nYE=6u%X zOGf8>@^%wQU0$`-k@gW{k;^^pl#Gum?VbgaSv3qqC=%48nQ1G*0EN1PDonpAE3}>a z*r?FF&WKABJrShKklM@YwD1CAe(~lr3Gr^08dvRoa zm+C*2gN;4sVflflbhWwXUErq(?2k=Fnd+fe8H*;07Mq5tTJ_d1f%tffy682!lmo4@ zbCT5Wp7GPUq9#0;7oGEm*%=oya2NK@+czKIsGO<1-d0^$JzH6<^lmT^W~yNjMR1fL z2n-S^O<+Jc#DB8}7*)HVE^i5Ff^(eOX(Uv{sCIFxmPs-cbO!P)BCegi);xaT%ZC%C zqiaW37pvFmPab^RytB8q<7MgIe=0jg*^y8K8W0$OBp@gZ$4LTd-##ux1lT0T9HJCP zkrXK$_77+hCjmM{*uuPVhqj|0@`jm1M{&Am@OGL>5@2O*krZ7$-LoHParUFR@p`fI zB5zCuP7{E@c=Xqtnp+M>l{;;e6OZQ|hLSYo3@Gj-6BWcFh z9qB#bTK&#Zk>&H<$_Lx$7mcUKD>o&-`eWnJr~g5G{Ny)?QxK9AyBPi;M>e2v6r&Ne zdmyLF4kbCV3-!eZ-+xnn?7X-DJbvDGWJYX>(YAbiC;9VbMDKCRH1^n=Se zQ7jKULIWA2ag0Ji_v(3`flNbyQ4~pW$FaP7H8%esMy%<{NM8}^jALWY?GJl^iIqQz z0vrMYr#K^eyXgC0mF{dtHADeQkQh!Nyy4am;y55NAz%W)5EMX&jzzJUAOXNgNTE2O zNCKg#9#wE?NYf-qK(cdrSK2=tD)yqx+GD5}F4Tz!pr#A~T-LR{SgeE6`TvaKEuc0h zldItJVa!L*oL8xI3Xl{^Xa89Ha3B7x;Dqu6N9(}bK>Xh;FO1U9ugk|*FNv!c>gUf* zh-wdB_FrpVxluc}ymsu%(!18dTa}ZIOZOUkKYmxbIak@&f2scT%=(e)qx$^y+QEIL z2i23c%X`Z^>UR$PK2@7vNVcxMUwu-4^rHJdo4BAT-6%c(bK}vqf5)4T4pm?K(AMFF zUpc>Bds*9gq;c;f*?;qo=K8x^q`gU^t`zz6InQ#BfMZBuY~R zpfI9+#m5$b49UqUH<%&@7MPWG;A$Bmu!>BOI00~+7Ua{B2ue{HNe}IYfgoX~;%x2&b=t^mU=--G3!($CsP8cW<_c;53F47|P3?#Be|$7=jAz zixYq%0EXch1;$xM2uMOmLI7!iQ#2xkY#;~(00g4r6B}ZrbvlMQHpMoW*Y8)ZHP0<> zjb;baE{~?Wd31Sp+ToWHv~9-Fb)@-_Snb%__reY$gzo z&6xyBu)dEWNS4*wWo$7)H>K5J!;)lL+%fCq3M0bE*LwwGXvD;ZI2_GxZ28K)H4f&)&C#B}#CG<#mHbk*td1*6gmd4z8`@xK% zITsdH*(IHL5tVrBQSHpSY_{a^cYRe!$%g1{V?>cqkZvy{VA9ADl2YUT>Rg;DH{&)|-{}6?tK> zp5DW$Fr0-^FTqn`?qvZnKu05}KP1n1eNvLy0f@#U{UJRtm0;Y5&;^{tm0`V3Z3gs@ z>4I&H4-w3JGmxBG5m&~{TkQmMPOhS$Z`_VZ`aGjM!tN#Wz^UZa-ydN3`*^_l-78Ea z%;pCXdn_8Bv`+t!J{STm76DaY9Nzr_tq)Qj1z+>eDT=22R-0bs3R;WfHoPs98r|?7 zkIG`Ua%wHxWCDzNhr^&qn_gVtO?f+>Q~}tekyQEf02Rz?vm(eR6|S6nj8f#R(*;$2 zvtrP3Jq3O4kYHxL3l#XAWA&?d+&_gY43Z?#8%jdXAa%kOOHL0aO-G?iDF$I+9hEK} z*Cd@PNDsWpeckTWxzA6ar@5!+8W-~S;1rFc2t{BhisKYb(8v#SaK$Dw%u`87FbHhS zgYTmpVA8B28sJnopfSlq1r?{#rowbgZ5yhw{+rV45p^XA94BxL!zmOY5Q6Lw9=A%n zERt%Ckd}`@1g9~I6aukL0Boa)sb0_qL(eZxfsn9vuhPZY8KESNBQ!lgH1@#LyY0=( z^R4?&n>Tk?Za1GCt6coo@2iKWo5zk+F0Eg0J-z=oyRfzoC=5V~!hisVnnG|05Fi9- zqi_sj0DkRw&Oi(ec zWM!W%=uF%@0~()p)|cKk_CKkAJiSSeqBMa*itOG*&2?;&Gzw6R5a`c|jUOT1iNzk- zqX2;b!6Ax}G>$0zh?$1tXk57Tsj1tJJfcH1#7d{!&{y_M6pHrNgC1 zjpd6xe>(}Jb9{eW-PgLayFP!Z`n<9e{bv2Jrg`f2`tH)(^nYqkPZ65hmHjh3xdnK$ zx>H-aTd1Eqv3`H$=IWWx4_0rkUe3mL_tPd=@j`y0zw)$y5gvLRiKy*tSC z%JS;N=7+OCwdaZL@>x9||FvZO+}~s0bXWQjHwCobzp*rq9)NOz*xoJ>}1SpN6 zC`#iPPNF0qIFrvygV8vO0+fUhr7#?!VVkJ6MK{fiVX$r|V^ObWFys9?4L&O{;Q@lu zD2^k-m)c+(3q1yg{WVBPD?Hu9{V<@;RClL5)?}WNu`;)tG^s#=_VvF+_aU2C-kV*u z=lAN*U#>iCE!?loFVLlX2I0v+fkPBhz0Vdy{4;<;gv6*x*IsSSn(ce+>kp|Aqhz!t zfqTq$qA*<;S-50K8s+f|#RGC>oLjQ29i7Al%C@@S%qT&3NAF8XhtXjf3hs>vbABz> z`KYdl&kcB!01sL|q`8x0q&9z2n)E+0T+V!qH}A%t1K*b~G_St?U32kyea{}ee&JB%Cf;1Q_&=>j?;B4K#TxHF zG!O5qy;&F(BAbCT%u@NN$2SA>0O}&BjUf&`ZypcCBish2csD(Dw(qAg|eC?l8Stw7#Xfv8;-$`t@W8hdWTO#d0kyh&V&f--q$iAqO_qn zW5OEx4kAt_MN^{tFE=^#zBS}7j?0==+te-r+-yey9#*>30S`x=v-DRI;+hx(VRFzVF-$Kt=is!kyi)d>g7o3 zX6y7v>Yui3>+qrwjT1l&0}yr$UyhcA0)&7hK~emWSrjEO2tfM_WLqSY#lhK}5EZn{*H=5S%~>3=j~bAqv{p?D4W^ zEo*10?^cd*=yw=N;D7{J=d&+@0f>wPze5Q~(16Bi1V>Q}!y(o|q$ZP5f6O1xc%tq6 zyR!@3P-RJ!rXY&r8@hhGmnJr}Y6=n*LQ!DD?8hKzcf^Eff&>_jppe380>v>J;O(!b zvxQl2f68{9-8258BO72{Q;cfn7;oV5U^r-lCgvL$>dx92?|97-A`=ZeneRwKv0{db zgwh5+hOSbGper;dH;e>|1{6SfXC)vYq$mV*Psk50Nz|)U_7MM^ROIX~dy!zw$dnA% zB8+SU>1g-<(cWZ4TQ6R$e)`wyC&MO0TnJE#Y=4R#vUF$+;uL|=LPT5=BLD;hJV>)1iUlrLl)I=@f&NYoLSt zq+FZKuX4zwgIDu}5mD!}hM$y|YYj|8mSU%jB!Z)%xza=c1?r^T+H)>!0?!So&ACpH z78{?dm0Aabf(M&x^9PlbQp@vB7o3YDleR=u;P*Cc)jLx}Ty%o}mCo5|d$Q1(lwEdf zyc@*V2ex`;C}z`ZdWlSOt|33=HH62<=c?uAo}ZYPpW6#Z+KipsJ50up&P`~i9iTH8 z8Sva~L?>Tia<0qk3aK@n?+(KJTv^6qkb86yh0rM!+3nxe&mC>uIdA)gy?SJA|H{4OOzX(m zwSAoVA2{&}KO_8xOEGZUcWwXhtwmmt( z!{Yb=4@+?Auz1^B++nl2&E{w-Pa2YZbXcx9GMWsDMdpqhz@qId@d+Q67mK!G+eRW~ zyUoi>l%3QUT*)z!veo%N*Duc3ULIb*R=HJuU*C7|Z>8s@w_60udMfWKJ3>8tDydeJ zawH&OK~$S>Ui@+GW%*`hp?>|?+EV$AMS$T-qcp?-h0!>~0ol3mtE(v386uOdrBC_t zh1%X5boE~S=z;R%+NYh3W6Nu&O|=`>5{q2O0$>D+(*#ZtkU-j}RJ(=qqA?hZCVm+4btu58 zPYpEoeGk3DuPsychga%*uC2Z)-+=X}=Nhj*wT_)_y?fZ)d3EJZ_kDI?&x9yAoz)HK zAy%Kn9rp&+ELpfIT<{Eu3s-jpiTc|+zh8U4dIL5e?*C);HuKMBoQl}cA8r4Ar2cw$ z{p!)$^OrOAd*>S`7uH@NjoVLKH!sz1pKe?_RJtH-EZzI^@uPCPK#5cIRLY4*`_ILM zKH;UOrinqbu|tleh)pcYhSZ9rPTu=)KP480eZi#7>*>`jSrm(=fKTJJQUVa&LP8m| zrSntmhXjkJ3n+{vFq)!B4o(*ZIF2B6=SB)XoNj%`V)OQ!#)+rvH=76FG){k7zb0+& zyz`5{uP#)cl|HG;w|Hs0Q~yO;S3Z9JxORQz-Pg5O=Nijbzh1jKRk_nTe29zPRYiRg ze(r8{ccig=?_aeihbJoszpgD`s_niauYG*q+ZT`idG`z}DP(deF}b3g=4H z{fOv6@Hheyj6m>_jNQ$~7(z^W0$Hs&!CS$~?v=Zx>$1j^vm@%F_u6ypkkf?TIpr8@ zWU$8bKsLShShsowo2tFr|2Lw!_h|KA^ZLsX#bBd1(v%OXSSd>X+@zl?U+dTSXeU1o z`ERaYW~+Ov4|1jb)g!gT&#l}}AW00P0oI-9KNan_zm1OUKU2u!;w^b=$Fs(%C$+Or z%O_fkr?;;yA*IJe3cz#h0rG*KfBLPM7Ys zj_j$NXdJ$r{B7;zV)pZrSd5NZHo|kdAv`)gQ-B$zo>$(=(uf?Rrm!iC{9mU#qX{84 z?#iM1@_gggP3h{v>XCnnej8qS>Q)YCV2gs7$|R6S8dcSvLDUcEx5vgv?n0YV6CMG>j%ou607%1moe5m{2Z37 z$uTTrE^ASQCZz%*{!yA=xwE#be(2CReUpiL)i7KXizrf~9c~3y3;OM|#Q}MVrBoL* zob?$%f`l}RBGk`0H!vR-OA9sir+uZ<&7F@L^XKc2_OBfKO>JpsZE1dOd5mTc4vTUV zUI9TdPvh9)7@39$i618HTtb|}5z4EjoWy|>?8gsDr_wd;5GcF;zr*iG9h2T!AqskH z@sqRme%F8hxbms-exdZ>n}3w#iA&j&2vb<%FvXA42wk$g|Ps_4B9(uaA_PA z;Y;I03{`PP8II$Sq)_7j4~);W-p0G_{NuNH^}y=0)uq+>5&Mr!MH}Pk3^!x`Y%7;* zyN-^?aN0Rb(1|e5!pV9ON-ep#SY+}s6-QS)*dU>cGjVpYfQArzvVLxV<#yxI#m196{^r})>pQH~E9<*f4y>QD zZ68Cr)Wrvx<*Ed9z~)j;lCz8?j}}f!;dmMaz;r*^B8@3+0!?BoU8!F_RX&vX#?!d_ zSYw~4zOGzdebIWh7^ob#j?osl+G>~CIEl#wRnVhce7TJUp`$RS|84Ma@$L{8hiFS#%NJK7@;eZOgMzhj>e7; zy2{mYW^&dFup(EJN+R6r01{M;);r>{G>wj7$4?L)Uyd_$_{m=5-=JNbMn@66kAE@oR*0}aiKZZzbvbnsYc4VQoV@Ksv<#2P?DCcM-9L*K9Y>b~=&i22%0@PH1kfg~R$)`xg z39ltH=L~DV;(XFo%{lRK#E}z=@{)pKLp{*@GR}Npvb&2o3Ta1PETYWD5&XK&x9lwe z>`;Jl0d^<=V*u>X_7!+z0PJv@7y{TC=ENe`q&G=#tRxnFh!Bes8=A>fNS8*$qGDQ+ z!}yVPol0<+b<$AW7mD|g1>T%Bu8jw+3|L*PD4`jT35!f>XW;Gdsemt|n36GGu`3zB zlN2%MVf-kIMZJtiLm?;+D|J613@_vFxb(V5piQV+!Uw?{U>arua*sS1Y19G#U1;sghoD{ad(zHfzV^jNeE`OSt;g{Mx9I+lMMYagQn9dhFX*K+oxO+ zY_nq6JTpN_S}3z___HBL(BVm?G{+YPttc-Sn=cH z8*hG!_-F&FL{p4sr`E5DGoEFEME~v_fmmWBi)m-LvC^g~2{qWLdj|{G?l}KiJ9oQ& z{C(@lt@_@5t1rv*m9ynN-4}%-iD^I)I1MopCs7Q8B+jPIjQa zcg{-^KvkTfXE_y|0FXief(~Mf2i2tNuTQi-?5(0aNjTu9fhEv>zoSvfPJ zsuLK3q9lbPD5T+r1f2WEA$kkPTM9>r-U7jXXS=iHx8U#xl+1QJ-@Q6w*S~S zt%pz77V>M$twTrJFY+Ew#c+%!DGKRSeCT{Ci4rJ<5tJZ|4Iu~ufv~H#j-;_+B!U7O z0vrQ?0KJ$??ip1;q5vZR+1}tf3q*QTvfu=U1A1c=u$g{EOaHO^9>f6-a1=nsvMo`0 zNGFWObKRNJL;JPP-Vxvj0*C+#g9u9)mEsCR5s2V8MnI-CDM!ke4~NUo*RD)X2a>Iu z_gjzN{+qvoD45E>E2Z{ieAVkCtPaSQD_ zDrmLmgy#(?fT9FOQv@L}RdAX_ z2uO7y1AK?MQ36spicw<*t)h^?@Qv|GL6oE*)|+G8$pTQ4#!0L__BSODZo}X`?O3+2-Xvq>-pxY2CTLvRHfkxbbFJcT#Ll{#(CUKXrBGcE0}pQJ}J~ytF>wZ4mzB ztn2{s-g#C)k~E}f5@L`*NJ#W>7-Jv+0ZBmukO+VzL@-E#Hu7SN(dBw?9D{>HbxhZ` zQE$V9Fd+b7B!ZwMiU>_k6d({{Bssu)^d_g#<=~r`oq4EbZ(KHe%r3QYXW{evq3W^P zo7dG(q3ZML>XAQ`kCYCg^?S?pXV1$AYx}OxY%)6`P63LdY5s_El%z;V(LjhNLD2|J z5C}EaE=E9z0FopTK%zK4Ah2>LCQZ-;4bk@AIUWr#h!u0D zrjygfhF&qz76;=MQ@A*385JhpSzU)?QJeEON{<}DH2L> zh00w?0kL%J?Q&*Y>0#-`Z~kJC;?>iwm+z&uXZz~cp06FOox8cZlTjw)$Py{MYBHuA zF4Lqo;IVQ`Ww6am<^;<1oAUh1-aj;N?61Ar!6<DI1>)WBWIa52s5f>POCflP#Sp-TJb0dgWbX&)r1* z!p`dH-_{;JsGYml+;w{8`1YT|p%Kq(XYR_FiXmrz1!~p9~IW zU1yh9X?%l2l>Ol4dpjGC_cSlPFCDL6x=}gs`RSCT@(3v{w@#exO)DXTpF%Jig*e1; zfFLMF5$F#i!WpufgogQ1W2O*Ms2R@#qNP9^*yE9u9J6xWAJU+K(*`6!2^?ZHHq;Q= z5tYRen!q50BmxNpp>PuXpxX{m1jk5>#)PC_bODHJO2U zI6x{AEKM&9!eIw(&a$Ks1jH#488W;Ydrz02)*hWLpSCq_EL6|dZf*h$Yv1_YzWV|2 z>UaQP7)C>a7NiCNj3NMy;a%HvgqnxafItvP;1HoHlBN;BujWkv903S{qiu$EcSi`w z$+nL{*ku7}fKVvXH5YpZ{dE7S`xXW%l%TtQlI}7?C}RqTcCKf+bZz{Zzt8$>*Pqsp z?5N#es-Ih|KRDmIccs4fLvXrsYqs+A^V7|&{Y@^+AkdBa10kCL;wVjko_e@DNgY@`XUEe=m3Uu7MzuVH+JJgb<*B<_;hG%C3KIHeN6aB_TjC-dhG}xG^Am zw>$90UQ-)WhaT(d35hNr4LZT%01MK~5O9hKFRwTumzHGMt1Vs@v?5>T>xm#U|hRUymXD>hij*wJ`VK9t`#5aDY01%qJ z06-kJzYB~rdnYiAA|Rv?NFz9cVk8at0sj+#L@{DxT>xVn^~Gsfa8rvOub;e&uDmLp z`Caqfz4i&9Er8(+dB)CQ)=f%=-k>#-8KutZv!+-;vUVi>rpCV3sp^d4VFPz&?&uk0(|V&v|b2|7mG+x{r2RZPuJF;hF%Z^jpyjfbRqZjp$1c9s$- zlc9C%di~OSJ?X4H-BaIxZ1v2_?&>o`<+49px;;~yzs4w^&5B1RRU-=+8ZKERBlp;3 zsv$_7%o@qi1|%dLy)nhK#+Ri^V4nM2k-1S}k=9!gi>kIY0H~##$>Vd|ibB*Qw zD+d`x)T*@>r+qX`Z`$Fqg;K)>_0Hs@lc}jGju%16!;?coZJ2#8{yLyFM4Vx$-Wp0y zrEnymzpTVUJSoSRbG|4o5ED^FVG2kaLBK zNrr*PQ%iY16=c;e;~T12XPNIc?sRO>v|0qtMYqC_h6Q)2Q&wKjw$ z((aUz!wosut~YDRXE zYS3vtJ~v7CoQSE@*F)p1=OKxHHRKoR-f`fGL=s=|PZ1$$7GFLZnd1GUfkay3#~nga z?I8_cd4)wzCpWL3)h;9|P~iK^QP@ahw7`pXtn4d2iLN~Bo08_N{wtmxpuhebOd2l2 zaW2jlm7fizlHQP)pCehmxVF2oaIbW@vU~mJ>QZg~eP8x;)HS!Ma4Nu+t!9gE&wZZl z@W6>k{pGRhUCh3|SUS3P)E=Y0%{TY&8t^hh=%$iYT)~b6P8!n^0e0o2-9zT}JcLR~ zHs;_bRIWbAluwr*SI#yT@2tH2{I+)RaFzwC^n^Hw$^e0@dw9x_aT7A-^mN!4?>|kc znMBGVjEu#JlUA`PI^9{bY#Z&DjU?IdN(<(Sv_r{;P7w|fET;?8g*0@|>XasV=ZhK- z=+R3n8Crc8URiL>jZ0Zf2_P1`>odcAnGpFb(_vo58wGI;hZxRFcq1T1(g==ou#2># z5Na=We1NxUWwiU1vWv5nF>;gvS#4gdiZs$5-6=0l}#D zJ%+sQ1p?i$6zMU@ZYYLf5QRA0_!D%)VB{sc5fn|)B#Dw7z9Jn{QE}Xn#fLD9cFYo( zp~WJH)ixJy-=!5a%5!3o&bl%0L%FEmEfxjjU$w)ESmQFRQ(z!!H;F|$2M59k9b%Ev zJZJQLB@(%E5vkSS(27M!Dz%|1g-w`P6f#8Qqgag8Mgt-!h5!`DDS(o~D8}|8!?MRI z97iCDBY>s>K>-4`opHQh-x;Pjj$(YjC@djq-i z6+)WE2@HiC4kNk=hLN0_G+;v9#O{dR5;iexN}63Pg)wW16mw&M6MLSsO@N7tfO)#m z{ou_aCguhm$-_%bg`%0M6wfPNTwS{TGqMdx@o6RH^fd=sgj z*4FPHDxZ>>|y`NgkH?~S)L@Am=F&d?5grHCyX|La- zHq8kfqfrb)5C~C%h7b}6!lW<`D2r&@m)rgB*bZl5VHVpi*AB1HIq8~4Q?Yb}53{%x zVq&kF-K$M!#^fcgE|kvXRv$M`-r+$cc5T-_P>mc7RQun@`>0J0`{0-gi-7RxT4P~p zTl4j+WaH}N%GuJvm3`Ri{*lrCgXq#9z+|euJBY*9hj~wF=U;2Pu9a^(!=)?VRUb5W zKC7R-v36N9LU=G84oVp0pmt2IN~6$l<&rUSXF8zIV6cb4wRnU3wtZw@MI;CeWKgkTr zW7a%UepWu#nt#d7kS`9?Wf67jM4_^TQ-%sJ=fm2zMLc zU-VX=OjTdVN)KCa-qz;#uRL+C9$PKK5sOa77m;aVvpO~l3w5yBTJflHR9kM_wy|eQy|x^4O`Ngk(P-KfwTnfl zUJ>#XkPx>K87&;L_fK$6h?M<*^_FrrT|l1Fsb_U_-DQ2NT`z}3L@Z)X(K)fm5g@T- z^e5?^~|iE!~{` zZbTDFf>dTC$Vnqr28cOb02hl=s1y1;Itw#Ue=6&?iA6K9Xg1`SW=_2%#Jzf(Ni32M zH3XySEFmbh%AH=|rV*F2i_kr>yJRbT!y>ffjzjmr}sPX9G>VfZ)<#%HgOqnfk zQlMKM$ytNxadZ`nX40!fJUSgM7J25TqERZSVY7a$$=Ps7EDAct(teB$%#*0Uw;7;Qx(QL|l7aCv(ggp8`kX)PEuJL#ZUWK9!>M2ek_ z4w>_cMQqhGq=7-TRV*s#BFV5+Z69tDHs%FnRT8g@cIKJb5V?^7A7stL?3CBy=ID$N zp(qp~yVrgHOtVTq;}g>5>$?wrezJaj<KR&-(d7Aq37)4Mi ztelh?lPzc(XIvG-wB1MQ=9HNku_%-F&d3u4&+^ZmYtHeeWYV7ijK|`XX-<~Z*!7IG zZCe3O@={*GHnAvWkrhS^afP=So(?jtRVBqgxFto-$ezGSgd#8;`RRC%y<^+LipP{g zPmZZB@F=CYR3;Wl6Je>2X{b&W5$KBh8SWmw4Y;6C#I%N){&PsBDfaImoDiwNbkKzJ z?aoQB(Hi`bdTUhXAdFg60w=XbkBsD1beiWs{THp>+b3GT^yU5g#+Ch%5n2tQHmV$K zv&x=}nOO-|e|l7_Zo{{UMJ6d?nx+}4u1FAzh(!q}l^fBe)_|K%+QX93>SGANsL|Gc zq(b(eKy!5G6}-(^-?@N|Xh05V4aaOLU7DMJC?YF5bSe+85XA@y4z}*%PK`9YHmqEi z#>4DIGAI`L3eys~nQwS@EAhj}CNk|d@>Xv9Uqz#A54kBeVss48$sa<8rJO2_MKT*Q z@lT!Ye{WpeTYGY`aq(qwRFUt3J;wOH;jF+BZT5+l^L;#1-7! z(}8>(OU)_xZOq2&W3}gx|BE*Eo~fTbwQ{_6_^KmTJAStEqJHmEW9RP5C{HhEWNSx_ zI#lBmi)Jui7G(ko-IL)gA{J#y`P{6HU|v#Ew9n2;NU_MRmFPBEbIr+=KaEbA%rGJ8 zCl)P8B9hYepX1p{zHuGm^3H&iN`?Glk0Ix)rdu^6k^#}eU&D!$u$?7mXbb++bro_fBa{B^jjkPOyA_U+!II zBoqgVVjKTK3LrRw0Z7uYi=WwI(5phZc|~TtoGK7%uPlbPVK9mpC4%~6A-WpM@2@1m~gvLnB*4=T^Fgu7vPjei~%EU3-_$qPSd34Ql3ec3_wB9=7IEMn0rSE7avI0 z&i{Jte7uU;_}4Q)3%v@QV*ns;~N7S;!IS@WOsP? z!df%4r8D(MSIQ55CH;MB{aEeLyZYrze3FTcX@Vdao603Ir@b+P402@S7$gV`??xnd z52~vTh|_hr@pN(ob(IN9zdf6 zil8*$4GaeeLSZCDD7%R;XM={X?41%?X>sad+$w6+jF|0+~*kFxA>pJCXfkKt7rfF%)IEz zAT#`pxHsbdewV;3!UU!W3POev!1`heQzQ*&*hbohN?niD)@17X__e(?r9oR;`yGPh z&erx^|IOOT)q|C#l@o>9v&Y{~!VLop6T~r3X(6No0|?@Hz>|>2#&CS)Ofp6Q8C-wx zvY>6=*#G&}F9{0vbvLO&#P4^%uD!VbZ?Jjm=IWER=a{J8bLXzwxeLv! zPw3jSqtypTzU#=)c!sZq%CnV2YbOX<<@)DWjeV!;cg{5LUifqQe))dw?E~Z5-cIjq z1ptf?i68_tpa>d5#L^7ge`ze?7bYl7P9F#yS>y ze@m&XfZSsWF@Wx3rUbXI+R0%lv{Pp$WN4xkLy^i2>PHuO7btt+)Kly!z_DR<Z`@=qanFaTNYTv0w2AzZ(Gqq^%t;qT2$ zPuD;FrE;yZef53ifa%Zitzm_2hJ|@MXWt1bwWX1lii?~#W`WUc@nlmYZ`su;UyAdh z%j-@hhM=all4U^IhYE$#=r*?f*zLp!U6m|tn2)r1p49=Hdam`SHI-rAnd!-VEEa>@ zH%jQ!$MOkq_e4FTRK`QhJt}j{A#%hvS>M-EcmH7v1i6wb&SP%gR#F?sYwaFWMkk9D zXNPq6ZuoT(XZHpqOCTDP#EAZ0zxMXu*OyjLufMA8*i-r71(S4lOwlwZScal$z-(@C zoeglSHc652Cv)6GdXsDqejcVNv&i703>EvL~g1* z3`4eVq_%FMKuAFrV}yk46UZ=_z|08$LQDt94%Zm(8k=zy$#BY)oF7o_}wWod)}O<>-2mVgAJ z8KN5wgh$sRFbM$x@N|5^Bw%QoW(gWH6xy_}x(oF1N=su1F-5d!jM@TiFpg&orWm+6 zD8!)ho*%JMSjcQn0*b4!8|`KfHKeac*RLs;uR7_~_cGkP`?R|Aaqa1j`cF%LT|4|m zI=oAU3_>#sGk~CI#0shE1fT$75DSN=ltPu#2v4YlD!f3^1G6a>PYq<9Twn|1rpM-n z2yl0m8J->(V+s&75M*dV6ksr9DR!#aK{F6x07;f037SAO=m3s*SUVs=1H^!d6uGv% z(|{xI@dh7ulI|w{$v;W!`kWS>gn}c%df5V2On2HE}yI{)puU? zMyl_ZM$~Cu%AE4E-hi)Q0U!6sOwA#171rnsul9&(jm78pAnh$+PI_U$(c4h=k)QZ{M@| z3%F7hxG5 zG8Q~fOdN#?U9HPwdm(M}8l{tay8t!e0Bsv;V=85%U6Xqom+TpCXR|~;GM5d=gJ06$ zTE7cKHA$fLW|Fy~`ovu&K8oP!dtDs-%WE$x0>Dg(=BdoRRd(fdV zW1%a#aymk%i-Mu%r!B%`G36;F_gv|sn9{G_Hrz_JY9 zw3;azk`#ejP2FnjBpvMiIZN5RDFJ;MB7!C{-MyaSIb$Yhnjjd89ywzM#Y9dmtTOw3 zjsc}vEw?EKa_&R3x}Emjum11aE?tnRy?OBW)la{vUwc@;w72={X7$z0?}Qa*2r)%r zObf74G8h9A03;mx1yLlT7@~7OJn@E!pdf)DL68_S45UecFi9j$lGNt^y;Bb-vp~n1M7!la%nyVCx7FvtVTWEQ<>{xk-2cW4gl701o6F45cVb&IX1pp60V- zYX?7nEWc{pKJnK-G(Wv>9^WfGcr%az2rx9FDZbGoDS!cjV~Buhf}~j*Ks43hQ3OL% zh#_dOX}}VQWoX{f+k9~|>(-tAr0cI0nK1nYmBSOx)%WJ^~4w-AaMOjqm>2{PBL{$`M8N^qoxg?SOo-ySe7MNmLM1gf_Ct)EuMO4Vx~Sa&7+a_{`OIf zq2v@;84v^*VGITD4qKOUBxca?x*&yP`~_g#PNnn_gJfW7m`&igdXN}ASWsDgvZ1wM zWpDZT`pH=N_WJGShXal0*T*dknB82pNQOV87p5TwOgBg!@3IbQ7EW7#1KF zF%$z?l0*VNH#2Z^Od$lr++YI-Axf7i6K%n4gpWZ?8%NfE{A=Y&^}>ZYrZS7=a8;jcOL5KAeNrsI0JP)s|e@;qfi|RgEr^*!5#h@!-&gP`d)_6Om zuA+(_P+WD3Oh`9I{~br#nYL!QhEC_aWD)75UDo2MNIRuWSH~O6*@-+BGe-sIXvb^k% zYp<&(&or*ywAQX1SU-Pn6h_!7>sJd)d(ZDNtNbvMo-jx?zUSR*^LV}vx)G$-*W z(-Z;P)*=sMB+RNzfU{z^IU~K!Y3>Q4WHt?di6o*l-mI{u%YM7Sy63e}YyfLr^_RBeoDXUK^W;>7Z zWK>}yG$zz}X2Xj*Z8YUK8B_tLlZQED1ca+ZQp7P@3|zx5YU^7z@S)X ziA8#ZHB+|eGT5^)8R*P9e`a1R^6FBG7QJE8Xo|YUBAJJWHPb6eN~w6FBo_I#F@_xE z&15}(oAZzt&k#Fk{}qgIXwhPGdJ!n z&Mp5`dv&<_?sfI#-tw8o^=qH6ZtNc>1w#xC!R9o=6vt=BrpLsjbR2L$g-`=p&8K(W?-AylcFdV z5+u>if0SgiE%zM-B<)Oaelln%0?HH71ost%E#R>@(~F$<$bdsOm$Z6<-1j_bor8~d z(~k4jt?+JoT)JfE&lUmesF>3jFaXdkzuRFchnRpEL$>2j+>`Pm&8qoDJeJYt(lL&J z2fd_+lOrN%nnB$_!(Hi~`~0E#es}Zcsp|RHwWUYRGY=cP9HD10S`Tc(i zNjZjy0FcEz6uGeFDhU|^@CrE%NOp6bp{EdXk|G$)G6+D5LIi>>oqZ%ACj$XZ0g@Ra z+$1p+X54h=RDG>3)&DckB>Q$S*G87i_h0g>oc)JfBF2yfyB7%YclP7fZGpg(goEK0 z)M^ds^l7Y<89Z~jg}GQh-nC-K@OWmmMtkRYWPrvK<^xH*7|JsJxxz!|8Q1wGIK%Tw zhtAWR4hj6|Ysa)MglzmTwBeZ02YN)EoB0J5J`gAxXA8Z=F>IdNNG6m8)3bR>Yd1fLKclZ8{pU*Q-2Lo*#fJ5k6O11&|!hD|X17%?f&wjY%QSMIn z7N|QH-DY19Qa#q8cF#)+B!yBOhR$}+Q=Xh(E-B$TY5$k@4D@Y{v$HE8V@W&L4%c_z z_9}?WC)_4o>FY zRE?q7H)2!e(z$xFr1(0eT z&BsDsJodj-PJsJ{hduIM+D;p!)h?_4SUG zH^%Cxz29*&365k?*;C!K)Vz0ke(iPWpG?(P$IEXmYh6aWL3H$tNNEj+V*RQPLZNkO zy;wviH6?i85+U^X4YZhqF-`M)*JJ+Hq%ynL7QGan9KyFl53!#Pui z7;uri8CM@2s_wg$uU?x(>E;Rh*^GTSXEx89YxDTq%7^N?w<{lh*LZTOvGbCq_S3b$ zRd3vOTPsi3A1}Y0P}sI%B1;NT3__rTefz==j;2+-wJkqyoP55#ukrCk<@#DCAb2^&0dXmPuTQl{G$LcpPtUjJZ z{N|qX59ceu3B3Hy^zFuzm6w00oU%1f>}#AkYhC-HvG+*x^pXF&cIM}|$JTC-%yVjU z2xt~`<5YbeT4m9n{_}r3Kd*)1qz!P`96Y)FXzj}Kj_R4mwNvM<&1UPgMy-ue%&*s;uD!18kW5hp6;RGe<3ov>WL!0rWHc}d{cs=h@j68prDBmW<4q{Ca|zob zF-VkEgi>oMDHertIxMq)Gn(5l6%{>i)GkISZDCgJH##%m1k#*u8$R zdEh|#UGv7{DMrl?l2K{WILzaxDn&;tR3HT^viiL7@b$*y|EfID8NIpBZ$#A_@0ZV% zY8P)#QG-%qw8sWI-fZZ*!3}Kpi*T5y3$hddh@lwtONw*>CB1o#P+xq~uf1eyuWu|L zUU|KGp}FVa@~QgUxAoW0e_K9Q-F~%p_eA~enbpUEDY~YhjcSpa8cGe7+`~!aV!9NN zGC8)#ZosK78>ak1l|9>dv47>Gr19xs{l>Le?byfq&izwVOkq&Stc-ssHIegWhmzF3 zDI^o2BB`KqoD^zKBR~;1Rzwlz27`A4!s6pRs~jnv(W44PznX+vGNHT>8DZn-Gj09K zyT-foe%Umu9TQ6C+h%G1KW$zv5sMgwBcdHFC1fU&Vo}Vc3b;%BvOz^@lV)TWW(blb zFx9zP_=Ut{n-IHV?c6cqH=o~_)ef!A(1)|M|Kp!%GMjxUWsY)B)16MQ)=rB>gHpO+ z9I0J4Ve@3OVo@HtP*LwB7E4o1*jWac{LtbzBsqyri+0vVOQ+mSxLe6KdSGM8n?sSL zC+hfW(^O`3tNjt7d3x%VIkvKWV+Y-Q{^@s>_iInSU%yvBe2$%BbY`=K`P^uEULn@o z`VV&+OOH)6zpvi7TfR0$0rb2!iHoBpghP6jN@5mj(v^=ZSDH5u{%z%M{q>H<-RBFd zm(~wdFHWOK#mqwq$_VmF7?>GKc3F_q#xHv90L>!qwnQV6p#k0X4f^VA`eRA%`IY$J zR`=|vKi{?T;y=pA$<^&_^~LGh-H)02-mCRJKQ!Mgt$nJzZCrT&PZO*Le|&M!kO>Sv zB{L;vxJINp>*K9cqI{+KX#4u^&$ny0CmDL0xG9rd7)V+y*ph>Ea_YHwASelPBdT=j zpimI}q~gohs=FRmw;xHZy|179VdXr}axhR6S56iZi=d6$?u6dV&IXGvu_&o@C0)9% zC<_t)X>spQho!r>|05)To_s)JbD4AAFn=50%r9T7-#F0N_n>y;r~0uoGxb}S%crVm zuhd@Lt{;3gsm+>rNi32kLwfVvY);YDcn9~Nv^tTa3jg5T&FMA#Oy{*n$0`rXpVp60 zm?g@PS!0kX=ZJySTq-DWJ18Tb)KFS(%v(c_v@b3eLBEB|Kl}T(ZFIkg_ua5o8!lL;4@IGI%?cK{%+%%)(SoEQ-mD z23OoP$g>`h2T6IMK+K9oTKjyVNKT{Br)_c06B*BPo@Ca5Rrb|%aS2rtn6^W6Mc|xI zOV0;~(yXJUII@1d)R9vvWI2t{QQyWT&&t`28~<5Vd=QwWals(@cXon?@|c9?kqf zYB;GT*?hzz7RjkBCvXA(vC>>oWr}c50%Zz|)#O=*%^?bl~58Cp5-#{=mA`Qs=&qDHIvW9}Im zmk%$$`tNjb>XnyHLG(OGV=9UBkV4p#SnTHEPZ-c`T%s=RBGnk9EwBAE!Z zi$!ow84Y^o)Dsk)h}NL#tN3XqxGZv1fT-`5{yEseWxzMU{+ez)A99Xt+L01mrpZXhW-n|8{g z!}Yryo`izpouWzxt+e;o-{V<%?`> z@8Q~k)0G#smlr3rWT6;dTo_!)EGfT7;~7Zu>fI81hEG+L+WqEXN^Z4JESmMjltvCS1pBZ5{dLH$$+o@KA(7z2y`=OOLwX^j=_6kprBdqA^BkUbXg(mtsWM7wCrSRz9q8e|7rD3vXYw5&5U zQ=(lm`4sA$osOc}dC@Jidfi;`8=l@2F2vMfNEC$B#EV&>;?(k(KU%~JUQmv3k%TQ~ z*E1@)K+C!Xw+?-H%e57)yx&d&@sK66Rg!>ueq2rM{)M$4oPnMfn9pbBf@?zVJW>tA zYm9(MkpcjlZQFQ&HDTzrM;M!`$QYCS_?pJkOU=s{YPT=0FV)T;U0PR+%`Z8}C3%-%awS}ly6sHtA z(pfUJ-AD{#(R?E7ZQFr9=bSy2>WDoDptFr=xo?at)*}!d+T@AOeOhqp2(r{LR_KN|FJmVgHxfBg( zOBEi}etGZep6ZoH|EaSJ zVrmG80Y;GIaknP`Lt;eH0P(up&p^OJ3=q`%{Nmc)`$gIp{swwxrQrUkJm7osyQ zw}Px#SAR3W~Vp)t(>rRCiCsVum`n&ZbWaZ+<+2xP^&r7T4%kL{U zEaf9$7%4+h5U~tHvLtRHd>K6I-8&jTA0d(f6hH*R1Ry91w^$nmfif%sAtGr4Ff0Us zrU0b)P$&!=i0jzJxuSe78`=sS#VM1uLOk%G%@~?yDa4YHPYhVh0L)OtkQk^UOp0F+ zNVj~!rAcyRAgxTN5^TDtq+FDk4#e=5iiJ@H#jTB%Zz*HKJgF$;fHxJgK7rj4Zmy=_)b zGf~N8yh#_KITmW7(z)B4&mhu7OI!PsfCpp3n6ja0=Q4p8WYQ^I0AnKbYx|HgohX<+ z?VGs{&|y&(3CnH0lvW;rQo5VK1(7UugkvnTYR_-_6 zU0+>VeuB%7)-O(mj?`|ysT?TZUb(xx@8?ffDmUzF4{F!;`}LLmD@PYr-ml+m+&a27 zbO`|w$xx7ihyo0|xiiqypi3Z)F-;&6A&3BENsJ*sxP-)ga0xk#EorTrZGcBMrIdbE zbcx@Du}6z+QvyuB`@_ny+V%6R_rCiIppw>j^PJ^r5|W}=B%>D%c}*Ag?lUlQtd&zH zEjK!BR2fr=MFA~}a^VaNVll>`73^UEbplDmV1xmS1mFxS4{J|%t$+Gc^Yq8$M$5rw z6xk52A367%U)A0olp2T84TNf*AJr+7)Bg*3ig3DBSS+GSF$5Fci|D)K5B#})8oN>(c#2RoZ(M|AJCuR^@|=p+t2kn;ET2Y|+T77Ay+4ke_5?0^^Kd!#rUp?`B{mJU%Kd(MtJ;9SrUab(wCcS#7x&3VY_@~v| zRJQT%%IdS`g^cxeq7=*=w-YD>4)~M{^-`pwH@Ubf3F?A zv3^}%zEs_DZ{x<=+3ymXjT3*Y?Kx7t_+bR|Dw_){0v7%_*3IjWnx}TIoo!rwY;B%- z*w}uj_WJ1O=c~u77q8Xte^~wLx2roQ=ocl8!>PgHx!^#mTEW=mq4{{wp&CfvwvA_Z z8OTv-2?WI=gI$`@Ik;Efp{!V><2uZR9byp`?k@6Uyc>dDKiprycOj-;0EIw$zkj!O zw0wV(n}SN2^+^X(sN`ZE5R-aC7m&vN9{dV&%@y?;qE8AOCB4_xgjs)Q?@L-`z>o-%T=_pv$33 zV`7RxUezfY~*Tif~b`(tSB`P%LYWe$b+S1?6A=^RL6-ErrznK(Laoka(b zWyB&{>fjoRIlbK>7R7P~eSQ)QfSsK@e`T{@VTx))MR$s~_tu|OPrhy5I>Aopv{WMC z8es#l&jt8t29~e>YC?X=pmPv`A=PAj`GFJJv6*uHrZ2;Y%Q5lXcuu`nx`)wn7c{N9k)UznmAzCggQ zO4`R&B``;+Y=T*Jf{Cd4BB<66-&nuWSi12wLX1!nsfv(v561*zZ^%h2;WhR3xAq0J zStiry`-@ZirX$~Xe}9mM>Lb-`sdy|M6JoXTew-G)6Rm2!>^70x*z49j?Z$ zh7}nA`?5XbN+`OB#-vLsI7cS!CPqoM+h%2l+BgFlz%mGtc%-et>aI7xHqF&9+}k*? zJTYb}qA8NX5D_e(NfHAF!!L*{Qc^iXN?9_eE%tqwiT29N7hMF91g22?l#3@i1xYb9 z!*cze2a?rmjU$iX0Ff=Z|`}xDg zpWp2&-wjj_th{NQd|lhUd!>zJ5{jTnkboswfe4xqkQ8EYH}>bKqXJ9Q1PR&c0$G!- zV4Vz$0ipo~fIy%M0z!%+84`ism0X;rN>J|`A7YhcX_5w@6TYJxVl~G4fPQ|ym)3rn zqA*|yOmM@j22~wF>Bd;C-r8QM?mE!Ca(ZoN_4T3Z(_OU_2WG|vI~fy}mnHy26oYA@ zi31_Y0v1D-8lE{=m(jb0Cyv1vWs})~xuYG(S{faiFpa%G)gGQ4Gc7O$AVi=OF<@v` zFa)46L$gA03Lpjy%}@YM6~Kf>6eKn$13|I~0;;VR@JtJaB^ZKe3ErgeC9)XN)|Q7t zh9v$hTRpn|u({{>@&)tS!RpeT>cuzJNB3Gdis4McK}CrS7@cOFi7zj?qx$wG&u5B2 z-maSqMHT{lU)7JDpA<2L2wQD-hU@8!XEoeMrN*E3>4jsaC`?L*=6;~^{i%9lpKJ9*`GQgPZD&aM-6)1as&qUl5DjRWp#ei+5)v#;bs~ZB`tl7@b+Q1{ zEjnsQLYf2w(K=}t2*)D4I?WIOF$BUi07Aa?Nv&bA1FfSombj5xnyi;wbEDbKNVi92zqlbVG!Wmz!=P8l4VFBv{nI@p=bp0 zbdjJi z2PT@y$|r@WWnH;QdwCr7@;Cqd{>+@AdiOqH8b=;*vYs;yh!$TgSVM&S+(rQC9mAy~ z2Kp5OrLUfE9zPUbJybaotbMv3hm}*S@2huCRnC-;l@G`^j{LUvelMp^WOC6nREJD1 zvS=|GM=LU$@eBpAk&{zHO-f!P6Edb@yD&j4NJ$8hkx}J`zHBc=!X>6G)|@3Hp?N>+ zm*`ahuUwxi3KbmV{eBVh;4m%(5;?tZ zF)~=HJZn!ni)lr$#o9MovS#H-uV`1)lU0u`7y8{=vY1Tb;j-uDo{Rt_Wx*SdhMc`e z+hXrekCz9mvapa2#`sYx>o4m&&sX2RYo0w?KX6uDdGuSuw;5Ochl}M0)t8rBvC{i+ z6?4JfV)5i6R#b~!uu5=I;tIpi7^I59HmhSujlLf^MiS-XQ#kmNR8ePF%-U^amM0EO z5AHF5*HGdZ(WS=Q)*%<=A~mLtmg2VhQX~=C5?aF@PHLoKuY(_|0ci@b1Zvw6qajf? zHy+TX5AAK3#)LfzZTxQP-3XHH4bsNV4Q{IBh^1S~fsi#vVn`6M<&-nD6(RsIBnc7= zIGob}(iGcb2%oeI(hS5TjQ|N5mPCL>44=n2$zsG%kRpb#7zsj&uzqnQ%!$FvT3xh_tEXg~sjO=XHiG=zYrXjTxSq0u&Xom_j+ICQ^$?nLe8t=~lIS1#6W9^cpx zs*m4ASB|Y;)U59vhHH?3Vj%=91py*RieVs_ij19xG)q#5g`3JDgCGU*7{CTaumsHl z8bF3%5QSkYunA9`l7fqMwl}E`WK^r?{F=iS?r$j=_Z6g+&L&4z1?M%>Kn`)Af(oT$ zZWkXy#4V4SwgLsWLTy(-G`-*-PEHghCzeEmvXvu7In%zE0vn~ zMbOR>K!esBvtbt}TX!~W?;J~Z)YH#DRc_X=A89=L@CQM`#7rxA62TLCh#(9T zxnv_`9CTNxgEJB+C%8~@j2a$p-$Lzp1 zANE!tmMOs>mfo>7FYLpm%@i__jdbF%!Rv*Ah*e4a6TaxmGllpI@;b|C9x9e zFo;EFNv^#BX-qP!ShN5w19+LXw^;`-(>llD0%lNqH)uymG|kFcU1@<2H8WfvlWAVQ z=#3S04zb8C4Tr3SiP)MRq=^q)!=#CnBdAk2r$yKNs&RJb=Lbanz}xa6H6O&LUECL8 zY=jUdI+g)63Q7!f-H7=dm$%b9D`!`qt-Q!rUPx+Zp2}*^PJX^qJ9xW#?ZxMx{%`q2 zKl?#{j3O%*skDl)J1l?|Aq(@#RAc}mLQ^ckV#tgHA%O&mSPHf9uY3TJjfbtcrlaVO z=CddD+b8OmFAc*zVkv&Ghvf6ijZ^E7jLX~CE;c_NPSs9a&NiMOuig2f@!??Z3p&>| z+NZs{#$m9ISLRF*$*?2acZ3K=85Pncd(Q@L-VRqGF_Qa#MgCYhD>N!7V$q33h1rs} zdlRd(=hHH=NNJ=NB&l52E8c8!7saAHh-%aV!xxBXl`ih+Q2+wOuq{~j0KA6)5Hcjd zKxp(TJ62y*w|}heJil?g`fLxod{oigd$V#l!8@d@cQ;P|y7F-K&ga|97b^EYKdqiR zHaxmonbs8{`A4{R{zB!!{Q92NGxb*&>*wDutnDptuRq;UJNn5vw{m~^&ia|<9bYie zf#STuF)|t}&sQEc_a3j^JGXYA`C+Mf>{9d1i}K0UrS<*ujUDeAuXilJTHfao8ZR4k z*~B8N*42eWIK`rQcbAgX=~Wd%ez6ECbf)kED=<>oh@4Ry+Q)+O)<5&yaf29>Bn0g^ zf!u*ZG-5lU1-B5Osq$+5aQXdjng@>jY2$J$6wJWLBvgwTqbF_;`}jv^<;3d!^1k&W zjYGE@SI(@RZT@&&(g$9V;C~nJ3R^77c-GA&H0CUw$3E4rU-s3HzpZb-Q#*A%v-WKG zdz2~x1QuB%fB2rpt}Dwg*6ya7cW$k`FH|qzw0x@{&Vuv>_#Llmr%tULuf5z}+4Ftn zVB^Dc+0RSwSKgFg{C?$QhVeZyhGl3TAEI~jrl=TSV3yB`{lY| zNHW-Y0#GhpAW5c_{GO4uYX?H5e_MW1*}1y2aqG3b`Qg(@w<~$S9H=NS&MlQS+6GeG zN|R>L$1UnIXyc?kJ_7DwDUwDM+qpyk!U^LusRN2Mf4h(WRQX}JPyzy$AW2MhuE@R; z?yR?+OssH#-xI!i`O(JXwS&LgR{d~cLZ>@&38CrK<%a|O9dhu#WBu9Mr0Geqlyz`W z(`s|VW)2Lx=FS&gg}6#O)%4uP@Vl=!ZysN{);w@~@psLWSE@I5#%j;@PN% zibXBIOe|kmzfwE3z4qqAgyPZ*;X%h)I2a=)keI3i5~Wf^PRe=fvcCI2g4LIg8ds06 zov5ApvGLRC+O6~dRXe=HN=>MoanT4gUP#Rj&W}ZR&@>oS%cb=PXM6qDQjbS4lK-m-GN zXVW5~9IXAQH?-a*7R_72-BA>BXAVVV{l1P9RPS$%3rJE%YsS@`lVg0Mv$J&Hn@pk9 z`Sr7gu2lacZqoimY2L2l5A3#jr+Vti#%X$W&)T)dwYT$)!v~gcubnOBCiErEq=x!Z z<0T`MF)}DPno@xFj0`9h_wkSD#LXw*Cnl_edYdBTFgtj&-`HI~68*N=ymD?~wz})B zum0>~_2{X}PRE2&^&XGLA9chBDZ0&re4i1^ygn13G@qg#Pn;5qqJ^&MFre6VNM65O z#G+x9JHWpaOzc}EiF%Z*Z#JYG&UMa|(C`ax`Ca*yv3~d5=jVmy(#wtgBb$H#gy~P~ z@8q8!Y&W9dfl@3_ zNS$I)4*Iy!ip&~X6%~tQky0@axN|>i$rEr>jgLep3-DZMjx{U>bNz$}VF`T&3AQ9s zEWiBL?wnBl^^X&}%q5d*6+!Ey-eKn`nOJ1ALoO=Pq=FH#hzVmlG{FHjBrAFI!A)?Xg}RpaW%=DXdE`yZ-H zPnO@T@2XxplA5A&!x0TfK+U|+%3+YPM&;^n0b}9FGS1&~(Sn?CQQSbS3J#yaKZ;Z~ z8*|zeZTATD-0F#y?akAdnmg`RFJGuXJ!kipuj92t&AT5y|FpVmimr>1`P5L7EtX9= zq;Rw@CYwVhP>=eNbKk9RUq9YBx3l^2MD5o5mA8#YyO!^-PQwb3A9~gecM%`hS!GU& zMVUzm|NcM>$gYMp25?tb>f2wKp&39!_Lr1Mje9n0#oR6x z1BO!FZiUq&9ZHlJq|$%4TfMJ|!d2BH~-32Mb6pIeoTgsc;$fSS#7B8tw4B#fMYQY3Q`opWeT z5EMZ$fX2UQ_{yj?BrqEqx6ZFVkW}_Ae{Af&?fg^uRQ2q$jf0g>l@sebYj=*!SD)XX zrq^amF^_LnY8H!>L@YD78JIl@wOEwOpjit&?+LpGe#}s^Q~-)au)sQMT`O*6J=IwiH57!@*uO+H?Z#FKUshxkhe4+OK z&BpE7#_p5fO(Asg@KC~VG{i(a;@6U+wFB;1fvQzrSDrQApZ@;y>)+Ks+*>)ge5P^v zhiOKY2>Qh$l~3un%%%s!|0E>@5{n|K$l%7fI4>5-)wGAF&j)Eya{e?o=7t`bviu?= zl}csdd0%u$Y7k413`Xe7&#}f^7NflZf=RI`?d8H~V|km;A{NP!I;vfWC3M}h86l~7MZy7NshE)5gAY>xn{$H*)A64eKwHMj8R&P zY-!P@b4rqZ>wYl>bp0q5)SSJqsSS*w2|K3f^0Dw{t|7wN%1(W#?5rGJUYgMH=_z|~ zTosf>O72_Wtw!z4kIjP@e$_a1YJJBfSaf_LG#K1+=s27<&syXQUb-~VeqLB`1D#eZ zGAbZ69d46N|Qy^ho46PG^x?b+N!VjF={1<`)1rt9=rE`2lL0yrZ=hInM&2ijhVv${6o zPnUD6G;PSUnB#|tEt$YvdtK}JBHGOA{$oD?hF}Pc;UE}2ZyZJcjEWDhJQ@RIFbYP2 z=o1lg!eE3PE=Q@m#Rvt%7zu}g%+~&9#S;;O8xunkFl0hZr8J3Wx*4iu8K-({iMhpoFnjHnc z*FT*s-&=mRzGMAixcY4S=NHw}_Z5{V^&4kb-c(Ost3JHhoj*cgcmgAqqDh7%NXXDE z1Gt7u3jzg zX)Nu`e||Wjtqe<0h=w%43991*dwH9mO^xUsT+koLO?)<#Y_)!-}NJR zsE7zH$+R2Ei+Kdz9@9~~M@*ptwiYw$fdUAIq!>h!U8BD@A5L9b{bA+d%EiWx%YSPt zZTt~9AO&ceflRvvL(b)pz$^&~(3xC)RRwh?z!*l_VKVummCm26YBvk|hb6 zg2SVlblW{Ld&a?Z_C(%+%~%z(U@)f&$kYCT0oE=q4wOSd8e)QF>7lXp{B`AFWADe> z>1*PZlYd-3Bs{t^7`E06Ab@UV5Tqe3G`KU6Apk?;wwgI{cnRDBRIq?0S(+jd;vZee z0E8$=V|Egf-OsAbPNhv}Qku9sV}KIIu9FgmE$I_V754*cY*wlk0Iye`HXoc_J*WB& zmX;67+~p%1w~FN>zbJlP-MoCNytDawck|Tt`kn2)^vdDd*~g%`a&!Gj?etqq_4X;P zud)Axbp4{N{Hn7QkNPPOcq%V{+Bnucyyxei9(gKzo98a9zF)fUMOpE3yFc}pJ6c{MS<_Zn3 z!LN1~;{Uw%irzR}KX*=8N(n##7GNO`6%s&-ByeYm=MmFQu_I`P>g+<3SX3Y&NrVxJ z7z$t(0SfTSDGf+KkwiO)q5$CB=V2mhw|p$<+G>U>aAK+QioMdNDJ9%&8d04 z6HT_Jv_lP+m|R5_m2!<~au0@0hFGV<&+UFo_DecHRw@MMhw3pGkbD23Zntw>*f{;3 zRuM^0xU|*IcSJqVGIiGn=aVVv1_REroU#jw|#SI)}QyGevs}SuJ>*I;FsGI>Z(n&?yL9sN()zw{Yfny9f83w+ zEr0Omel?+?GZcXc1Zcf+Z&$$ei#+7Z!EHs^FO?^*f(_UOFhO1yTrOiY73xsRkk1RK-b(7E}Tm z7GX?dY8oAI1_Krl6hHuBk|F`qIiMKU0SStPh$LIcz|KLvGyNr2cmc3I5t$L?VDHb) zE;%}in8Gvz7@>oe83JJzW8C9_?2X{I;x^$SR7e$>;J^sV2C~I0KrGvavU107`SxP< z>QAxY#&zKVoPnEF#*pD~}JHE1eWqWh`;av0R(|q|x{n-Pa46uyv^W_&C z2bIlFPa3C}BLB_vl{8i4`%FR>dH7u8@KW>r$;QDqjZ5zvr{AxfvG+#p<;%vq zD~)rfs(0Rhb=tc@s=Df~i@B9cpFj2z8t*TauYOxUdhGk!{U3U%%^N>-Hi!v_1?wlu zhd0h`oKb=Lv18S{yL8n{*OyQKpXGC%9^1l!0YM-V(imcf!88LQ?412f!9WKg3rS1> znr0b_CTX^H9JR#*1Dz_w_NlFV5o~5e>UrdrL7|O;02C$w!kr^!zKwzan=;7)G`!4o zpuPMjd^YF68k2BFhW8&5GbCid@H$hwzx0>%+9j!dbzg1oF5$HXB8G+x2`S9C)({W^ z07#M&JlUgJg1{^Rr#dm1!GH!NO%o7c5>pfl7y;^47Elz%?XbE+X9j`s6m?hcmT!K3 zDq4QN_GI;D==)BNSYLL>3-7m7NjHu<^m{@*ZA;U zR5fHw*-0K-YI;L*zBo&2lle%J2=*_0I2Pq%!WinBnp4}8fxdb=$&Bxbq@W!s@tB61 zoH7*0w7EM539Hi`QA@aE;In*5_ovcU$L!)z9TNXguUma4(rMFB8w&-+P}3j_AYfPkz)0Ir_5Pj8l|Sg+jr~i1(U-E7?du<^mu`N({rmcv zciPo=6Pil1fTj@(F-x{MXxq{Ew#tfMEJOf;C|wdzz7RtJ07)pMdO?a|F+?QI4r^X^ ziLmB1@ATUSRIi-P=*k8t%Y1N11KTw6AWaiP3YhQnb+2pr;_8brx)%lvOA-v?xAPE1 zlN3SGLY6wj6u=As%yfnxBrt(702E1+05S|iu)Mk#q$!$!3`6%X&6S0cEijhzo<=lA z-5k4&_hccgkOPO#(eZccv)&T`;PxFpM`bE3bk0or#P^@y=N9Vc?>8<#+4wQPaokcr zd~$hTLv;jd(zGHl!w>{R0fJ!wWEr6opc#tB7_gX{hBrT6NS18v!5T8AR~}Th8`9tZ z^XmJR%Pj(e;ZJFpl{w6i@7sT=eSErp=<|o>vF+~a(wjduFTZUbxm!E=uzKf8^~O%+ zx0d?;hogrC!zRDWZxHeUIPo`S^}`iw_2t>MqmAcFuyS|p&G*d@FSc&a_cq|k=6rMM zu($l<@}0(^J00;E&mF(5dy=sgYIq8>6oFWl-Za`E1<6j-g~^6FK>`-i03(PoL@Wf< z7-o1O$(7S#!Ym-9ET$kpxD$|xw^4WSXwE9BnUu2iceTs0#PgtSV}-vDH21-b^~Bc zkkrlf83C3cXqvZx^Gv0{i&hx>DBK!B^h$vP&J(s0E;sg&2y7FZ0yD1Ds*D^ zjh4QCkCXpw95b^6g3RYHknThWA1IQ-ZmlMlRK$i$jtMpU<-x|)Pb=4JKfUGDKsIO1 z4wj~5628&mtUYr1K2f))Ma|zK{B?daVh#%!!-JM!hse(o!n1z!7&~g%4CWfa<}O&5 zWA@VXE@dxh3a`~WWb>vX_U^d_kHy=!cZ&)?RVqQm4JXFaz(S&wEu;q;S>m_Qy4~68 zl1_I9d~US04h`mgD2gJzNW|?tdrTBOR^hlFjTA2g zmYW-B7i0u3%cl*2Ah)2PcQH4w=`g_x#XyLt9He@l5sZXjL9Q%R@#P_0Hk~whfurO9 zBUrL5ofIn7<4es;wb<`XnfUVHj|LDj`7FJM`G8lpKt$|Po;UzHPtY~5OfN_ge=vX< zQ2D8L?ZW!|#@+Lk-Tzv@^QyA1e5rBZINN-CZTZ>q)yCeXjRylE0X%vCoRQE)?L%P! zQZBPv+l>rh(Wu5m1#rOLpOT`!WQn*{ie3sz&NJK)0VBktSSQViMHV_Gb@^rOt4Fug z;)h~UF_2zpFCRrc2xgcF6BLVlgJA}YOg!!*B;LG_lDOP_2(Dg;ftiltp)Bg!M~j;Z zM~}&{bIBO+xFNBztGR2bzVCG9qYx1~WEmPzupPo~Nb91=O?9>HG{9#cu{1+s7PX?rO}y}6 zFhjC5A~1~@Okqg!MJRv>lPpQmEF20^K&PD};R%W~Qi(-*W5}4BHRLA66Ce;ECu7Og*D27%(~2H!zjx7L;SUo4gYsWAPCzy?XOpTp4o1erBF*e# zV05s61?Y-qQmOU^eMr231+6-njAnpoHr|r==Y$QgsD1jG0Httvr1k)>ynpw*E=Cb1 z7--@7QY(aj(x$X)1wL-5%!g8Tovw8z#vet1ahep(omoq-UTg8WI?s(vmRO2ZDB5Yg z!2<#bIA>5LHW5K!+Do8x`x1#ah(J~qoNg&14GSO;Oywj_7F$B?!*Ko>0*WU zYj>GSH1A*r*C)<%X*H=*6)`O++TU3 zbEkhOT&><`r+Xg5IL?ATg?{bS1J&(zNzDIYn85PR9T)+NieOLZO<>5zj?a`}03KX^&VI8h{YdqYWvtcmPQ^oiHHB-7&zx26s z{=$!ymoKWvKCIjokP>gXKxQVRNHjqr?pUl>OdPW$OOb4&$MkB6vou981VIW(z;F4p zq59-#{&i*lk=ntX|B1HnYKyzc{7qx=cJB^x~wWG%hFUv>Y6h76rZ(lp?%inG2 zif|+_v=Nz8V`)TR^6S;*(*6IbzkQ|c(He*Ue`$>`&O5!c{8HbG zf3DyCyinhJbbZJ4mrvzw*UAUq*S9Sf4^_4u==lMkyorMIB=d0|2PI0qSr6|UR8AjX z-%+@@wtMaQhyv$K*{rlb+vz|k!<+Bg)B3KbVq3T?U&{9`OoRxoO$MqdI>Th<} z4nDxu{nx9nPE~e&`s1HQm?f*4$#@wF*DTX+ZK}U)Y)~0_OV?Bm9LV$;4blu`Nz~lz z{=X2C7t&OpG?!mqsULs0a;mod-joi?B`twcGh;h1cSllA2r|0ukxK6t!-BJrH_^E7xEYWKB8PDU?THe?L^=k&l&>y-Madj=ar*Z>kl8*Uz{(! zsh)eFS{Ye;zse@39R{7AE2Hl13rx@rRWP6c{qGG|;1;`dp6U6SjKpo?wZinuyZr0Q z7h+>j2QO+w9uvr<6s;&+q9H?EawP#tS~Awz^1Wufk$VTCTJ?>xGF32ATC&97A$6k5{$XfNCtvo~(} zd+}xU&i2ad`{j=ps>fgCFBBdWJ}XiE#Eba)*2c`< zNfyyfiBi38WYnt!S^t!Xl1=*@{nqNSvr!>8b}l<7MVgGa?M-raVs6zpeV1MeN;M@? z!EA1XL}6nCFQib|IzQkD6p{e<3ltJ0HHJVT!7}3s6cP+IAW&$8Q=+KG)9~D!8L^tl zEv1(hrbNk*%x|!!jVd&TUSac;!#(W_yL{ocl!9!|hDi)$Q=)Jx*kmYJtXV_napM=Q zul_=EhpgQVeL8K^mulS!gX}zvQF3;;nBYvX1fX2i_7{b8#}dvt=WENSY$%^_b?Pn9VzG_b* znx+U0iGgaD4v(lbLy{~-0GcLA0z(P{3Vj8FTyO3&hGPp&-P3jss~2?W);AV~s> zVi6o*3TwqP)@H}&MH0GPF7u2&Ij>2D+NU^8W679|+s`Ru)}c0d)a_NFL;7BRNEi03 z@A$9pO2_JlKa}p44;-%?d{sPI+0}%E38(=Pm|%(ac6>k%2+|}X5d>|V+Q3a8$xlTDbTPe6iXNI)XFMz}2)hM+M9Eupu5 zm?z6H7?YS1Y6!$q6h$I57S3~$#ta4&B54|c4dc)hKc^c41~Lqd8Xu2BWY2hsaLf>C zsn+!2o(q>&jyua|Zm;k8w)SyX`R=Q4E8CyfPH(FodHmf-(zV$g6{c5DO!NZ3j1hBE zYtiVF4a{37+36F&W7i)YD&F~1`Q38;^tS5qr$}wziNd3Q{Ow;V%GN_Hz`_40pM6z+ zw>y8=vG(}y-^SN>S--2i+gfM`=If(nKf1a4x%~ESboB|$U#}dvxqhwu@@ePe%H^%O z(uK*@XXU;7iuYFT{JOGjNB&0PZ0T5cqAT8NtqH>s;I(5%^Ly&o?yO%g-Y7k+Tt2T` zTW*`*{?>7uiI`S_Qs)ze37Pe1ix$$RP3i#d;-2XRc{M!f45EQrY{Qwer+Fxjj=VCOif zv871ZG~l3)1(J36+JNOAlttZGjXN2NkzMQ+o#LrhA}LRCss)njCH`8C zi;z_-nqy_qYj1A>rm3(HLN%wdc^4R`hc^e|G80A*9#N=Ss7MX%pva&eOE+1j#$*~% zWRO5m46`YrlH)kdn?nx{w+p`LLFy}Y-|zzUx9=;TyU_8g2s+*vf^B@hcy`XbXo!5% z2hdN8)2bZqD>zMkW={$z639%l0}GyEYn!F`yrJCAjyp#TWf3CS+M2v3;ck} zNU)^}(OjiXPOm~e(~}{jFi8MJv^lq}75dkObAmWZ2x%73m~4>f2bN!&LL_2ZQZxgL zFQzGKOeiG*DT1IN!(f^Q3HHL760rahfYUiw&#yl$KizATuOBQvsUN>o zxLn*X*jp(UpbeLs5BEzjEWt8R0QL)ELjk-IWPLKD?0i~8km3dJ+}rFm=D*9p6E_hCs0+}qIw*#x#1>UA8)DCfv%#z6HZJSolXb<#^J>MKNVk!BK)kftWO8SDzS4s5wsxTc_+6n-8?WEoRJ9pj})0?2s3*n`uR_8-~`EB+O=K`&fq`shg84 z7i`VlVGmfhWdLEUt}D@8Cxo%O={R;P#2p8G0Il2D&WsDy)iD8m`@*edc}6#%>q%)? zUSaH}G}=lvPtZ=|aFi~=bYZ$WUk9SA&^r1+x--emA#~fm?of!Xy}I*hZQu3vQ{@}W ztJ^Bi9~LjI?QMNldQg4$VC`w`#HHrs+Kbj*J311aTRw2|%k#Axf7H)y4wj1mAR!Gg z3)lugmtx=;OA&=hK(QpT@k_uEG)seCQ0{==WymCQVAkTD66LVd&xP&MWCylOHg@K{ zuwAlo%-2NECY2@&A8@z7Fj^{^R$`Qz5xO|&yGq}0xtGGju4t9Kuik3Oj$zE`@ozMV#*`ltI59#n9% z&}1a&j<>5gDRO%}Zf9~zw6?E&|4en~&f@9yGj!?k@4w+7W}mE_pIAFo+Vj7~J^9n+ z`?pHF>vwk5AMRVbOOQt)6TBq901kxZKF9?LT{L zm9-%84HQ&8eZTVPN$L3Nij&yrj@NIT4EFv&$tDKAS-Ww)c3@le)1KPX<@&Ds<$E7~ zTY8#YKmL8?-Tlg$W5t`bGp__1EAGxou)5nsq%|k+JY-UaxdrW9>$0%*0`Z6~I`{_n z_EipFT|fVa^82&JXO%M->O0R=K3=R`|18wv3Y&FGgu}jhecZ`%Q0$mNjd{4QMJWIP zg;~J{t)6&PxpQLuPX0{(QT4{bz}oZa`o0sDL(4xepDFC;ZR{4T>!b`K#aIlMU<%GjMUAuYgx4){qzb`NBT)9`-@wRsM zX8q!+pO?4((4P}O5V}9uy8vX&zm%ObL*5*UmrE}S`)W`2uihwKS-<{|{MFxmd0)Nv zpy$iH=)nO5{RATTp+KvjM&y<3&x$pqH2jFiE&nLqsUO=L`@Z`2nzMRwN9En;^1Bb^ zGasvW9~E!?PyOaWN&V^>V;fx533m=L11W}XT~7RKK*B=cMQeP{$IASSZkivzxO!Sz zzVf>I`ZhPaVcp6&m(;7&yt&Q(B>M7s{lRyYqxbT!zN?*l@$<(^YbW|Mu$bdwPrypq z7e{p~{wACDa2}nJtb0kBi{_>(jQHoAiFUkhK61D zOWl-imK!x^^Rf695v4U^nu&RpQzGbz&LlJ{Wsvg?om!zFrbOmNcCaY!3k7E-z4)Po zf$_Pz0em=1VN8(_t6<+`1}O{~g2I6M=UQiYh1Gv3_`Une!Qc z7RwK+UVC5gyc318`v{#PpEF3EC`*MHf#26-b zFyolkg_4%gl*s0r;qQFF?KW{cd$@ zetGrm@5|fH{rv9oh#6Yu=RDfwO1XiPB5B`&3j)LK48z8|yS%pZG0?xdfo%D}%k$k> zn>eO%gSetYQtxeJN$axx>)XSGkTemI>TIb5uR-ev9tJ8W50pUzR?pVD01M z%Jrj#-Ng&_V^^y8c2p0JGHcK+RXb!hYdpqDCOu+%T!NN7{V%080TbYTo!_sXt-pRA zD(xxn{#^UC{g2gcqn3P|MMnpXVwsJTY77rhj%+l)dw0@aKY!D^a$)UC{qCXlV{6w( z6sTs&d7Wl~XNKc^5d@}0vsr^7+LOjAHHs6J+cwjwEA*R zy~5-db5cW?H0M}%e~HNI0&;%8x^!`E|LX1XnZ2du;xG8Df9K0 zl9nw5_{YkwD{DvBp07R4-x`r^A3J4^O&HYDG}i++LxVJIprT^$+>nVv)qR;sQIwU- z0(4dl6P+ZZ(#AJ&r0r_A5GCl}>tqgJSJO#>g*7Z5V2P{oR2bz8Ok4?5@`b-^B7KzTOzgu=6VwB^Eqv=I}^64 zRny2bo;wo(Om9|9)@SW?n2=ooelZURxY2xyQaT0NqyFOKRH|^7D1UrhxpAWOtoU%{ z;89u)xKIP*gc@P|YPmNTATwLu2HxmuYpZXE1+nS|Hc*{?C8R-!Jd^ zpej9DDji!tIZpSHI_EuZ%lwqc#7UOLl5sdQC5kawIy=kxNUNQ0>g6^6@$WXQMu4@k z-d3hkVVU2>@ACOH^D()#&)-7;u@u8HWIxYoE+?B3#TO!Szcw~6-q`gT7N$f#6C(|U zz(#{4m57o~i9#eBw~XLIHLoo;LxzG4$OwlF1$$^t!epqXhTLc_6h#kmp(ZA#L`xRG zVmQG{L(fFiGKaIDNW~YM zC&LM;yEq$+#8eWy7-+i5%6KzhF=B9$RJ7BtVhx~|yQ#EDVJ zQeMCtVK+O|rVWi99tLHTetkEye?Bsg1FAd{NwmN2xT6KEwA|H<##yLLJ+@5E^7qJg#|la=R_EAWhJt&74m6*A3)` zn0HLhpg5&BIyBby>^>y^j7>X@EzODv&;{qRW+ar)&>%RpFQ=s_jbPZ>?n^*G`fVm6 z>L2zVio~b@wjN%};@{LvpNWeGvBXXEuAp_{THDzLe)~wlbn$C zJf*B~Nh)uhkNG;o8aT#aqAs z)>}UPs`mPI<;*DRBZ(-)5Df$*hBU=OhHN*>rl^k-xI+sUsG`PV3VQusrMRz}N)4$F z$maT)jS4D5#RjUmzO%UXH|vMXyN=gy9*sCBog=D8kTeSk0zgbKECEQwg0CPsy0WqE zp$mh%clAh1*nCZ&jED5dAQI7#K+Pe@M|xx#z)*-DAU!tkw|MC=?en;%@o*rD(m^@R z$(PQh)Jc6m(a}}=aJ};Q#_H#l6SXIIETy-#$444p5sH&a00=PC!vFG+UjV~E(29@1 zr{znsBtm3UmUf&FI(VZiq79Qkk|9_q#H@o1fgo=1p;`;Rhc;UmG+1gK8b@am5)_Ro zvgrtRL+SX;k~tk?+BoK9?()eDvT`=`Dg(tjDmvIIku{N0xTG=l)u4&=<&eQBDdX@JSGx-Vie z0Fa>pq5wtGB!EHzKxmpJ5se#NViYlS+N&f$T&^M5gwCC5p1AeVFe`ViOyqCocU9lq zw)*q;YlpVhp6(vS3njBrZzeN@8OlHoH#Fvl&a@L}debtBSwessTHbZBc4lY!`t$1f zt-o+|9u6I}`gzaV@gMS+szU)K+m-j&YOA0Ax4 zUb*_Jeq^_$yzg$yl$&9BvP1*;Pm?SI83IsL8-u_BO!h?$YGNi?3SfWI^p?tWG1rIt&efA!qBXvMt733-jY|D6}M)w#c!6FdpWBGrus*iC_Ghoy1bWHt@4S z^^?UgVm!%Vh2w?LqG7}yBIHf*?IIkDtH+hUDtuUbS-tjh zA=F7H;f9S#f@Fo9c><6uAOHaebX-yf7@f7vwUk=;C3xhL0OoX9!e%ooBgTwe!CmfY zk^}@`VE=Oe^QT?q4=>B-_SGJ5U46cCxAyw{`o3x5p3KnXMyo>Jo;-;NfJqV)f|4(o zq$!4A!FZA{kb)GZ8Inbq1~di`@w@hrg@9&YlR`Mu{Whe{c6F~W9YQ)OD--s|7wmJY z-tT+y4B$LVW->D~N%^87BjA!(p6sl@K2kk>t#oMpLiyCmVEyfrm0h@Ucu!^ffwkNI z{HOeZf2FIw<-bt%$c6l^!u>Y-maESaTiH{6cf(oSyT1R+gW}^aH&Z`umOhAT4h@ojnU>1z+uumdPvxuarjh!OKB-IR7vq@nVb4(?h35q+TTv^6v?ZC`izq2-TgD59D@5OnB7K1UN%p3B%6m4k@OYcQ)pdB@v7JM*G@w z{oISSyZ%3yPamya{ak-?aQ(t``PQ+h@PMCW8BF7iHHvrbf)Fr}VlgYUc0m$A$bxoE z8ASE zW;eAOobCMW=>D0Qci05H2Lu4iG884~JkXe77)&BOux)U#Dq-INSW|M2_h2SD`A#x` zgaktj$hp<_zWH_S^}GDO+T|De`q^!NE1%z9zxTR+{6O{S?b`Jhzg}C`{ru_h5Jv(M zB%mowBYxpdlB5wLF)19uAF>pL#F!EMF<=;ip(&Pu1jCX9MezslhZqxpWyyxDNlS<* z_ci;#pxM#&4P{uWRalHn+}%|H*IJ;&N$Z5RiV#9f0zhG*CMN)bB*id;=fNJ6)upp3 zv2KW3Yj^f;i3BCcsD{)9VkxoALU8*4M3`&@!|eAT>zA+nRDXD-vhUJAYTG~kuW(~S z5-=>yF#O7(5Cf7y06-zH5kUe&2DOL`Bf~Kg7}1a=D24@ypjZSDe^Ud3MkJ&f&g!TO zptja}-)^q>BwK%Qe*N~J3QtRqt0z7$OqKU94&<)*Z7wEE%d-|9E-uAg7~lz;Kl>ao(z&WA`;-+$Mo z{n1`}U$|X;b)kN3cm3Uo&c~_x+e4}PhZEKJI~Lc^mJX@@Rz35ydS+Yw_0Hn^^6}T@ z^SgfjyuWa+(7t!#?sqHC57*Bum#;i8yl5>^Bet;jc3U*1ubzBMi1GmN``JwD<=+56_1bJiyCMA3#?1soM~F{F)c0i(?FGqI0wG&m{)kj zsovdddX8e`F~&k#^jhi6zz+yRDAn_AI7hnZ^t{r8IuKClbd?TiV|<}?P{|{9 zc;|8b-k$2cZ9Q4rmNc9}*E3W)T8mM+Dq%ABrZvS6LtceHC+>d*IT?&C2))7m-JYJp zwMwgWDUw;@7MC;6Eb0eKo9)}|D`dKbG^^#4YMrMM6HRwTSVERmBMRLn#9DJw)uMHV z{|nT_F| zJs3|#Cpw}9txC>@U5qi|49{EAwyZ!++m`l(x<+O_3$BD&VRCKG&=cI^k;?>GuS`4p zl{U5ynmC(8&O|o586!KP#i}unV_~h*Y>KE1DG3u*N<$+|&8@03n$$T)7}(;sD6L%^ zV{2 zIEI^6BKLA?$mZNR8qV?8Z+JWH=Ue}ya`F7?&idm| z->qE9pX_Sa#?wn)Ip~$E^)2b4*Fh=z^<&L?iCk$j&(C_euaMwnXYKr2xvTGf zmp@!NeYo;?U-|x1`PwdyXl@Y16t3A+pJ*{jBW4qsazm|8ZFfCej4P9Oy z(Oirjt;^ z$u!05`OZ05l3*#=yuBH<_a!Kd0fvZW8i*2tY&fq2!AWR}BxwTSKK)#lnp3z3G<22H z`7pDwozu;DHvE&IDhA9f>zERy=E;r8dC8g!5wqcqab=p%ECr+AH29{Ro~aC2;FQSY zUi8|;%r_!YBw#RW*x8M-?bzs~SzA103r~qs#*H6$nOqB$VoKy^0F!G38gggDa7wfo zb442hu9o>Jk;V*|+`G{yrO1*HVMt>Z(3n9i**u2h zzi8~)xgml9fW#0m48bx0V1$RM`Vu6@Bt>9?LM&oPL^mJ+lOjX_MAH-r085c93jyF0 z`$hJJS;=PPep6K1kmMa)lNb}2Auyu&1{bCPfeEICqv;}zy)^&0f~~Oo%~2)y$Yc%r*pm8=F3!;Y0z7K!^cjs8LTsf+QhJ zBL)Hh39^Zt83+RbH=2z`efqv6!*ca~d(UiuEr`gjGcj$7#Ak5#Ag1?_MyYjKQgXY8 z4u_51UpNxE#L{e!mlKmP$Y~PN1@01-HX#h$hURqcGKrvC?MjW72A+>(rM|^kYKal| zp!Nkdg2|Rc%FzaD-i_-sVn z_9pp-f|CYyOLC+~CwOtrU}wcmVK8B_;HLJGuvBnziDtW-kpZP(3F+UARIuILzQ1d0 zG*f9+PfEl1;eg7c>?StjJfKD(hoTxrOCo)uD zf0P;IE1y;_=U)`If5U%@+H;1w<!;VQRPTLWeYa(EBFB@B zr4j%ZQ3QoBMKooFN2wfRhM-wQ13(ZYU@?QKUXkM-3FAgTY2C0jBDrxSj2oU{Q}s7x z%sPXMew;L$$5AqdOI|8DB_i}lJ{zYPrM`I-tJIsPM9B<@j?^q}H*nwl-s;kdfKNYf zaMGk~fl805TfDMdKlG6--7OzDRDAm7wy|>b3Xg1Yqg(;i;*~xBQ+d0mc$la@xmmk> zs{H0p0?eXPEC%P(t80!$zlQWT~s$gqHE97?wiBJ81fj_pw$B}c1{{!*Hg zqQCy_|Glu^aHWq7(JRx$iOyWxetK57zLoPazv>1@;ijR(lpvLEYl4mq78o#c#7#M} zJ;zGR-&Stj%I}b`9$wu(M!}{zC0yuB(;LF_ejD(Kcx1>akuE!DwOhKnn!@TUPA1s% zG^eJ!AwGwywxpsCR~JL|&+4))xdD)=1kAUkbjDUY{CfSCxps2z+Sc;>i^bP#Z&$Y# z_U2FgCjYARQM6?Yld2N(v@C{G;c;vjwL6S<$|cLHHU?Up^I4WixqMTiu+FWJ=w^Ke z?VuI7YB^rA=gHXB@!_bRB&72Zmp<2S^tSE^rU46B*b034FB&UdU%21&wP$BmUv=&l zhnZJmb@rtM9igOghQ!+NV2OIMPbyGk{nD{9inBV2z7((|F$|0uO+xG%EZs~SVq$Ru z_=S30a&^yUX9vNql+aFz+y=}^%VoXxq((6%S_+Ie+9q(X)G-?fE!qO}Lq=bh|0C2Z zmgoAqDMQjM!mxFj_%G_FWZI@@-4O{X&}u6W%NMp) zKRl^kxLrSVxOmoGetf6AdwGk#cp+GO@TUIi#u$y7^joL|S~7W?l~AABwzEFauoyfz^8I3q_CzpA$O z`|qk}o_$yUbftXeT=m7>|NLY1+0HMoek|V9S8iV`_PQW^0(*&R2_1^0lAOdvwKguE zmBiZ1wvZ~K0vS7hJ3VuqzZd+lE%ZA?Q&Fl*sGJMEu`<6_Kr!uD@J8puVU3E{M3u9z z*AADr-!E>@Um0NzBTGXQo7p5??A8Sm>`-PsI%~ zlvcNwbgnMhKiTEHSu;)O{Thi&YSe2;tDn~%$={a`?XI3VTiJ0nf4+MDT>Z|6(yjW9 zW3@~7N0`UOm4}=2g;SC^85m`=32I_Wl<_B+-f4+IHY2M_2d6|x9%kko)}GH4**UYy zJ0+4ENAy67jCTHJ(mILG9!#1>cRhr=FhbRgI~bx={`p^^BLT9;&c)RZu5AeG2wiO6DsDUlte7qh)`p{|I8l1+&M(^9q0DpO}h%mQMk#oKvE z=b+B75j#iE0>+#;nF-1Lzrer;dS}R`;+VQ2OJXH(_Vz5InOqil*6aDbB%nD)(uvQ!9+>X-_~?ls}~lqh7jMO<0j zD^nVp$h>|Mp;V9BkqOo?(f&4^CwOQchy`=msy4Mh=!r+ z>r#82UQTL|^E4P5N4f~)yyc}=Ulz81`^VbjYlY|f-`DOutv`5}%8!bdv*=LB>;cG0 zvv8gwnSqJU?dFfDBd?#>kzcM}x>>pXu6Fgw+PlItB2hhixAN&=_0HAbRL(7rdYic= zt#~P`;J$z_k?_9y#2B`z#DYP2KleV zJT)uT^$;$nM7lI0Lp_wt@hOD- zVwHbQ8$`uM68MsR?~@$z5~JH88|7;TjTc&+ddY%*vrVB$q@_?XEyLrs#C&9Q8)W77 z%(U6=(ndub2Xy1wUJIPcnMfi%x&=H^jj6Bh-e^L&&SP?qfljHUZDxfPw3qiG9ORg0 zs6>|lIC%IAWESLhVbXH9YzG`x^q{&}cM=dTJ3tQV91oUki^#LX%8o3We5#lrg}cSO z22nR3>$-gRciNUg^0}AQ=V!`i4}E#RcK?5WF=?=%4s~S$nxGAxGoD2~EbFF7 zu+`JEE9$62ovU0trI;;0eYXFr8<^qoSzIyaCry)zR5I~k82kOD(PnFLfc2;-YsGPX|ec@d3;p(S(nPu&> z?LWR;D?A%flSzayfiWN$3eljU=SO`7l{%$uZv6OkQwhvMl3<%}&ZC>!0QONVH6XR5 zmO7Qq1%#Kywn%_fvVD5dG@HQ}o9ATim1@*;*+6^J>ZqmOu3df={_pi;l`GpyA69O8 z>sPjwx8ErrepuMO*1Xl@hY-_bXi1ud6bV{fw^6u9l3*Yt zApsB|NQ!|_KtmNW6bT?gY&Z5gaLp~w4iyc9G$t6#5-eAWSGRzCorKmm2?7BYFfE36 zYi39rwS=4Dl>@^7GZ3>FaB^0gDBnULP4wkHNnl7p0<`9?x)qWm;YEjclLMu8e}8^FhwEA)gY6L)iNtVg{B9J1&F}_BDzZt#SF&WgV_Q`|PZ~ z-&eev|2WI@Q*2S&`F>pAb@*2-&-WDuLyA%H{bIiGru^nX{ouo2yUTBPO%!(yQq23Q z;&$<@RoClsIgK2SRZ=WOB!7IW_Uc9T@m*#8+L6tZ$h*G7NEUhd@FDr1e^WjAsk-e| z?eQg%t8}n({8;toIbGz(^={bS!ed4G%C_3RBU7vAR$u!5P(S|^wa^SB$=}syS4tRuU}VgK3zZ2vejm!h9L_vKrGr=$r;436frgzoT4a%5dZ)JlA#gHG$au=Ej0}3 zhG-&#geCw2u!x0#UXuZ?yPH^(}^^N-a*{%7{Up{f ze|LNB-Ij3SR%P4$*y;!SFn0IGB*g;2(iHDpFbQcI(+py1VSYDFBLFZt-lE82NU{_` zFbsq&O9I@|;~$s}SeijJ1pppG@Ww`6#6Ohe{pI%BgY`Ydhvl6&J^%fqsrK&CFcsn% zw?mdyI*}OjFpXi%nUTA@ut;D)Gg_tX4=Nv+qXrcFz374NTvONvvfg*k=h8{Wof@4S}eTCXcEH4Bx# zz+31jGU{|9%+JoO9RKuxzTB$rxo65>Tc|&}N2CicDo5X0>UXX<>sPi`KP~64*H6Fg z_>YYv4Pm0DW-gF*q!!GHezxYcQ-G~0SJ4hzJecexOs6z19?oVKL>(v^Vo84H=E^n> zRnrq+3MicJKB}fH>!IhgZK9@D{!M3V+B_@md9A>7#0%6}*HAL&j7~l!k_VWyvw8KR zB&I}WpKm%HZu*WEoz&rV2UGSbkzW##yQaf&F0Yfa!#GkJj5eMqZT#F$uh`d;GoBP_ z$@GlX(|RCui=bx!wF5CtyK*y`!E7}8SU?jAwVp!LX?Ic?SG6AXPMK;^HIUhCvZ>P0 zo93UlsTRj2luk?t&`4Xe8;Ac!2U~v_^$t3dnuo2&sG8(w#UVsP1Zm9hQcf`@Az&D` zk8+wqDt&^V7&lMNxSI!m&BYR!doqL&0ZbsW7GA zQWSv*9)4V7?V>mK-Msubh)I%yfNd>{J2TTk~G1Pn4@Af_-Ph>aRznqn|wg*cvT z+bc(3t?pWVQvI|oyuPP?;nlpaa_qCQa3R0^tMwa>`mOu5dvE*6CM-!|NRW_X2nYeq zqDBEDd7zUFA}JCg3L-#J5D{d9*(pc_WdWceq-lcP*n`m|22JOlBuN%Qz|tFeZTLP7 z?YTrY;p`0M)+I(HXlcR{TMPbdE@n(mtEd^O=UZ`0Rw8D4zb3WXdOlADbQI}!MZ~>d zk(t$rl$?)%x@6f5`xIE&q{OULv>pv1ihs~;n2aSDlHwzJQv{$P)jDMD47pkU;RY6` zvBj_J9dHS~w08`%6yE614HXJO$vOtJ3_)N%-YH-)q!7U(fq_Leu$&E9_fZ3jgd~X& zVrhn;Fs4zXz`<=N0ck`NB+*Abg)9)Jo<=QBpUyl@^0Q4Pkw8lGi?T>nGtqdQ<5#6e zGe{?TMBxQ_qXu`pB|yMoj?Soz*6yUq!yTpEJRi5HqZ2~3(gxp9qJft+%2;#r%wj7Z!Vuml zY#&?mQ%3dCR^;Ly#%Rk-!er5Aiwl!QBcYDdKEM=Rvc=p>^d`un*0$f?vbx6M(u8wv zHw0pJ&nFG@8?2dGdpEJsad@jz)$bL;`8Fe%AU8iox6Yj{Nb;) zV<)PQ&lcZ(`P}->T2rmPm&IA%w@*^P`K-48RQ<)B!mYKF>*rUWwmvJIu3mmty|wqZ z<&%#qk1nq6C~jRlT|T^Z?H;ZjyjHpu8-wh*Wy_Zr)i-xn-~Mmy@JEY*C_j4cuihTY z_2ew0?e&*oG0U)sMu^|3vhnz&7_ zBsM1e%DI5j&d2rK3~#gb*z8y{A;*|pO-1eTnd**x`J|J`0-dRSP~nV4I-b#5j1yp!yRn!nS*Pm@}K_ZUbzscJla{_b+xkNCH=R; z!TRS{t1o`4oPY4cH+-K_o0uF!z@45F(TJuggd4$dLcXvx5_0&$O}$P; z0|W@z$J}gtbw5^4?q6zsW^7co{Yh>4>i^~seE;Qj`Rv1Q`T#{byDA;R8!JiL>kga3 z2}jbG@c1@tIVGy?`?!9`{}l#v57?>p{9L+pt$3!gZ-20I@9OW0um8LC9WGpJvPbM} zQUo1tQ|G}7Lpg1(TR0b+rAkkU)F3WRx6Ag*rBfoTS_mB6}7@b(45uV>k zt-TNCZ>~QH=1;62Ek3S3*yCD1T0Q-^yz^5JznA*=@q0UMG7`opmg`hY)?OTDw@-Xo zuAO<<^9dhtZ%HA~s5SrZ$;5p8D0|dm&P<6Mi$*08(34V&*4E{E4&mxiUEIb{8W)Il z2?PHufmX_;n{^w(^;79#<-%#sr~J&fDCwKC`H*cebEiPwg;ybSed~q#^B48KM{AEB zSMR>fpD%t|IcUwl8>2u+-!mzpX*Du1eaVJ7M$n3W%Ymi_Xvq$T$?BB~?2+l+a-htLr1tF5p#FQwZ(!*G91{4*D&rFF- zahu7YN%#`xp3hQYn?0uXB4$dI)Tr7x9U)+JBrZ*oc9*QH39eR5D^=|)&>@iOg~c4< z>pV%cvEZEYo4)4z3R97^#BQ{zZM^2H9KHgo4=+_--!46u&aB*rrTss@y;Fbrws332 zY^Bpp!vrTK(!=~~mF*!QZ?WOx=a{#@Zat<@gLD_gFP+Anzl|^y2~m=GoA1e8;4La; z?*9*Vjm4pxjq+A~?PhiNuEKHmm*-VasPK~H|%E>6~oRry25cU^fU7+9`ZyC<@6YJZ`hpv@hy{TV$ zKccXxcu2Q)yPR&1}kb9bw=tfFppJj1>kuI-X$3Kz|tRAjkJ^j1< zz1ppJmCH9)ZjlTWz{7H^OW7{Sr)1(rZbkrV;<_zkdI_^^1k~l>>*% zw=UM+Z2NMbs=q#7e}4S0>&KP8AJ#AZwtD{BsJ0v!sWXN!Z)w#}xBf64|C7CP;?BzF z%8RWlJ8OIII`dCfPnFKDUn_oGd0yZ5aYSiBojo~6IJx8&a{zH0)JG=!-^z|mQtv!A zt78T+|4R5~*;#pbH(I(BsqMP3@~r&+ME&Ev`p$=y`$wv8kJWcP`g8tt`PfKvAa9g! zgs1Ixqlb5ZchQ?d9mV01Mn-oh!!OWV#1`EGzj;I~(>yUM2?mUkTm|EsRt zxmP}PSY5q)u6Fn6560q$5w_8gBPmBfil;;=x+ld5r$iZ_+Gp?WR7+?|6gJF7X+Bej z;@|XLuu{G$Q7-M%XjB_bU^l8v(nTUUC5p{DH{1-*Od>NSaw(#&5tO6mdCR6aM+7mz zIch|%9Yr}J8XBVGP>ulojWZGoMZ#TcPA@5AM8-ZP^4pLO@H3JcCsKWcq-kH+htUMI(HTJbd%kYUB=yN&HWKa9xKurvD{;@K znw-TW3-Q2 znqe0*VM{{qX$Jqs>L{D`+Goe-7r5u!Eb<||0>2!$A{Gb`3k<+Dr=bQi>I-dVk}b$X zHa?VnX?x*xZR_#klkW&7z@7}LGU%8X|DSx~Ayy@%;>4DP_5|C&G(CJ5L07%mak%IBR z5e5t*P>TyN3b)80fG8GY7Sjx~VHlbp%s+`KhM@t|h$Gs%kx=Qqeqtz^A7MZv5;0uJ zeaLKGN-Yvt+)3?#kN$>N53Pfdopji-(PnKZ4cDYqI zBk%oPQlb}tniuZYK3@Cs@-Kz$#Vh~HaAoz+m;b1*KEGIhc<{G{hxHxDzO5hI7x~Htn&%Z@Rf<7Bo$C5O?FQ9i+BXS({OW3~IwD{r=WOQ$MZudVK` zKfg6>o(BZjSST^WJI|9O0TFDkQhcEwC`b@24O_n-Inx7{VMvA~2#Q4rAsX`sKBN&z zkp#mwxdSd=x9VGO7`!RoaeSiLX{os?eqt*MLbU(k_^W)|MXA`ny%ZF>J zYEKM&WidECFYo1oxf`KPhlUzcQ_UrP5ShH?A87qV?Zh)&esP+to<3bZ`M9*Ra`Ez( zo&u$BcKymvJ;nGJDVu{^ihQsPPtec@ z`#0NtNEX!3rW>H}9_a)!lact1^XWnL1lZg!x8Quv*!K<|_g8)? zV!-}s9t-r#CL{=FI_K_ff|juVCR@NGjhJ#|-)mS^GyhB@#DK(_3m za4{T+v)-sNWE!^-7`;rXwOL0ugTgnhNcYu0;IlgDA&oHR_FC!4YSisxr6D_PMYehO zDX_s-utHh1w$`bXQY8`3M0~adzWw!C+}L9xL^M20hQcIlg*hMCo-h=oXbSa&_lO3x^w*H5qah`7 z$_3kxC0H6jRwzL3Bni;Qdkh4~jS07%Iqu-JT{5yX&2V$YB!x*9cLeA=(URU3UcvuM z-CJ%slAP(|-{&f{wO;qyyS2`U%t+9#LCj1g*IKW%>6^K+iN@)=n$$ahnF&!PWl-gstS+uMG4v_^b>_4Cyo z>Ee9j(*Dk?4~^TeN`INQ>&+<=YT@1N+?>F^l~U;<$tK$ z_Mw$?lGek0OSgtuo$dSoZRI6pS-H6UdinC;NRGXG?Yw=WDPisFx3?`{YhApueE-*< z@AsGQDYWUu`}JqbxBpw;zHq15`tI!d?&YI@Z9drLZ0$VTx73!zv;jr{3gRT7ARr+{ z(gUy&FBF(f#=#kUV{%e(WBtJZ*%Ncy^8R$5p>dKRC|u|ea$|)AG~T0bu-1SDDlG%T z>p)2rXRQP2h|cTwv!0y*IcGk?OqkvzK_imE8Qud%n%b}cfWpLR00{z6{g^M)$SO2O z<2Z&kRto|#6hH#P*9a#FoWZyR7}iG9>5fd?YBo+EUc4OrkLlY988 zpbtvq;jsR2ARk=0(mr#oarEKhqsFVFD|Z?$(8n z(QREiV6K>Wc-)dmBDBfkb|^|)q;QwL){>9qqZ(*UJW-^wyhasDV~u007k48?_l=q;Co9Q{`6r1( z`vcO5>B|i27&oXq2J-o`ZcChakin~tK&}*+#i)Hn3qh;O<^FKMUt~2gEyo3RH?y+h zp+e^EZI}g_>OOB;h@>u)ARB|e;p^3DO!X2kP5rm^7p<44*Y{V}?yc_`I**JbYV|5` zWJ<_N6KUx%P(oG@my@ohIC{xF+%wMt^ZLim^_K-x{qp*q=H=VN@`GkYZDP4nH@D0( zyTlYyn!{0TGR|A>%FE`hn}7P#@0QN3?Il`QPoSl9pP%S|Re$s6*0Z}S&xZ9d=Bf&- zjZ$_dd|iPwYSPY{!ad9~@o@8V!MvHDmfwDQer@OK%e4o} z#;wbXPn*|IW>`FZN7hv?1YKB#!_>EXx{)WkJbf&bF-Rx!@F|(1EEc8Wy)p00hQ%Uv zZ}e4wjS`E@MK`9bN>TpG#bx$pYiendNP%L37CPqr_@h^A-0N5j_-2bzZ&krd36{U+AStfeT zEKA03_gVXYI4Im&(CbX&8qqODO6QoB(~mi2jxDhI%g+8E!F1Y@vgtD}e*I`bP&5TF zf{)Bk&^Uu23Hq_r25y_o%TFxMEaVanb)t~TZ3R(%V$dT`Mjnb%H zP{qZf1!=s(BO7hRlwwiI7V}i%F&8^pfDRPBk*HYYFjT_|2Q+OoE$9#E;?mi|1>hK@ z03_kYev}3{Mw3t|TtNHgyY|65ORriV52ZW1&NqL!8EjmC)Vy|OWiOYbhyw~D644ub zYYIaYL(L*ci70&IdPGqK>RJ_GlOhBFNHY|UArev;LqY<<9>q zMbZu z0vH_NWFHzaJl{NbW9gFMY=k(zu~2kzd))IAh9m)l;{uZI5TkK|1{eco5TT}U1Sy8u z*pUH9U<^(0&PN(jkYpgm)uAT9gkS(cw^J|6@`nO2Z@P=le9_{Mg*P)|PAo z{85&N>B6Q*39u;(dOGDB95ze{6)>RnvjPS1a{V`d&hY%&j}m|-kzU}}F3CKU_3{7Q z!~8~+$^NNX?{ToNM=>O+Yo$(WAyl&!bLznlqmcqkHhEz7H~~qSlFkORkpY00KURPt z<<5qBpLiz43Mi&&TorXLz`-XP{+I!JnZlxt_J_)5#Db)(x6u@i8xV8hwrZ}2o)L~7 zV3k+(NNM*Cw>M)k1f)rAIGKf!EkqF@GlS1${cZ`@wB})Kgkj&PtP!cgs5E*vf9UpV zR%iJKu>OxXpS{no+;5(J(0RB0FP%qs`#=19^ZT31U-uKR^WE#UJ1ZC4=XZ5JK3m_V zXx@0+etTv0Wb4ci?emA4H!k#Cj#19Pzj<^=`{UUl^M{qIp9fD}{b>LD4~INU@BXd* z{m%B8-FQF$?{A-dyL7vLaOsEEH6Dqb6+(sfQyOG7#Cpe zalnN_!m`a@5D`9Px`U&v^7##K z1jk5XoYzk?7{M^0>#Xqc%9{sHE}iD*^*?%BTsv*}Q)|b~^+)9AhpwfYjd!2cE^*oA zIFU+Z%t2^R@H5PpZqyHSj^1y)KGS)2cIo!&v-Xu2?c=xC9tLGgC(+Ug{4dReA4Z7g zXgbmSOUc>Y+kz>7aPtFXw^H* zSpVOQH9#qJvAkH6@FsBboAIl;p#$W3qkkl+7*!`TRBV;a4*jWt1teOlKN?N5D!bV= zn$FReB7E(}@>N}P&-an~0oHZ=wEsY4ycCmA_=5G@jkA|q2lgyK`s3>U^^1-7dzbGu zZ$EC|Ki=5=mRY^ge*I~NA}ty#Cx@_T!gy}HA{B*>CCkNHaURbigl)yLNeDLe8Cgqp z)kx)(T#av>0)V0sMt$)j@a6njl3$Q(ss>qJVP>V-repw_mRMC8ZmQbtd+r8Y4yUdooZW!X(pSH&gcEobFQ^Y-2L!`-XbVDrU~>krm;tlV6C z-8_A7>1KP^iT{~W38`Gi9>hkak8!yD1w6ybwkrb`{a|hiDjiB>fnma`l*xg{Fracy z5~I_5tG0aEkS+|fYcLHZ+F62FtR4}2DPcvC9 zBo=A3iHM_;vxL9G0I(YL0W4EUCj+&#Ex_Brru^@A8_VUDVNz$xzBxSK_EvD*Mb90!Q zU7+=y(>psmJ}_%XovFsFGp!HL|2BTNPa7raut&&mc=KKJ{>8?wi~rWSc&c;vZeRuj z>g}8i*1{*~Mpg?09KqnfnxRA}YGRSmR*CylB1Jt zzS6?i@LZ+`1{fM*!n@HB8Vj`ZCBBiQ0{kJ~C1`zb=i%k`TkZ4rl+Ei;|5G+)fdj5Y zEE$$0ZSHC76`+W?SVX0BjA7KJQW9>3-KCO+#Ug8gAV+0Q{RT_bZ5NBIcCX1)sp0x4 z-zvn!xbXo1jK}?Iy(eJTq{Jenh45}Hl6s3gloN}xKPf0c|A2=T69Dh-aal0|@Gd@j zT2KI-AZ7~+0BCY7D1ZS3qAsz>?DTD2qO?%56Uh)(RtCSOhG^UnDneP*SPIKTMJ)1YOe$q~bNBfLL=9xg*d$^5=9C(N3zbU?zM?cfSjJ{1Yj~^`yO!L1 zAx+_FBq|G|$iNExRZv5L)X z`YF9Y@hZLAo%yYrUK*!V0ER$$zXsc^me++N5&tl3+XTyx23hQfe84Ix;TF%xj;X{4 zoBv7rj-)!-1FZ;G9J0`u=IbH3$kJiU15m42cMu>7sVF8d@XZ&;}iP zN3UvpK{RLtA&x^K1`>q<0&RG%!97D`12>+#04 z%s$x84h+=3{GqjL`|7ckQ)_n(@>J{ly~}shO9y_{I(2OE@#@W`H{I(6_$=^0Zx+u05}^V2@yC(Fbu+RL=ljN49*`e0Z;@6AxVHueay0o@Kj13 zLs9!BtfV<|Gct7Amlo(-2p~z4B-3X}jrT2rfTn4P#`?A<+^0$w3Q;TyM{<71dg?q5 z2t<((Qk;HmoqAr%w01pO*-?MF^jyArym{-y=H59^nOdlcX}#^6*>;cl!$DH`G% zrWNSUc^m-`2Hte^c9j%Kp$HqN+aC_Ko*i%AdfncBto~^IMiN^*@h?jke%8En+p>PM zb@gHW{Xderw0O9)XVUP`a=IbFol*>KfQiC z*1r07_0sB9r?+pmEkwycG(}+)ps;S728eoiyIF!{kQhZX6e4hvfegj;#Bc>jNJ5JN zumY8)n$p9f&>GKB1fUQtw8SGC&@`kdjJpiPatV3F>~{O5ap48QS1{z`1vY0fT4k>Y zfWQ!-0Z9;?CE@dv#=#fuJNuefJ}tk7?eA{YceX#AoSU$~D> zAkY*|(tzkkT$+ZtLo~)<03r(D6a^`U28ee>z#+*nG=N~{NE)Stt+utm7_p44=Tr4b zK)^;Tr;(XzJ>1wh;(zI6)Ym-tu=Dy}Wl%V-SUTxirg17q_=BJpW7M=A*w3y}f8HLg)&k zESUtZt#BDKzHp|Ci zQF*;vVXyT6C8}64WumhEWXNGC5o9;o$oNYhkpxL&u*-%U2h39hNs|mVQ10x%-)$a# z!2BFT&3&`^Hn)yEDqn`7-V!v_qC6XH?RekbyQ{VT@LzJ4^{3wo>*kRVM+64C0r|L* z>@XUqsSQtxUp9{*DUzWmID>2+fCNUt4QC7oh{Q0wE66?;{R$8?z)1+X#1&JzqKK9Q z&WwGGzd|gCMP@Bo;$f)RHAw@^Wl~~Mv|?v7RAQ22QDuE*x7liv;QM$_)~t{H{Ts!IDd5fus7AWNv~OfeWOMQ; zK03olnt>P&C=PMt?tSy}-ql-yklncc=$C8T^=rrRzY5L|oF*xZCNVxH2>=YqkQBlZ zKbM3=G(%w|NzFhdp%G4C2qP(qq#=zX&{H|%ZgX)22^u1jOC^DTW>ZPndrV`5bT4fB zB{d<2$nd;*3j~olhRv}y2fmVsWXh||7^J<0mrV~z=@hlxX0P%vL@ExRpZgS%j9=il z9zjG2YK&6Be@VCUh2G&^ujGIYmIH~VdU=l%OaQw^93z-|xhlbZP!I;I<^RR_kA^wFxtapSg%n1o98O)lF zD2HzH7$*eO7W6i)!mPEo7vq?EG2S!3!`DC zh)Z_QSo_~NlbTw-Fw~ap+H2JFFsHb81AOyvaSqH4Zw+f)Vb0CrC{Z(T?Z5c?=K$h|D9WY`Pa3*%?D4{&-^mkJo91wXk_L2f32VPd!~|8 znx~JM8V^ovjg~^wkfCr4AV85gg(x)JTb3jU0x%d&0ff;MiBbHTlz2BBbMIx-)6`Ke?cr-yYq|oxwFm7H{7dd*AA;zK3JE|wLg9MU1#rGCD}Q8@tgij zf--K*%Ms`$(UTb*JaqHeh9XGc<5T>#n8y*p;1H*AgkvOR zD6%`1`_+&cv9L|8qwHUUw_`+^P)Tkv5T2BI1R?5?$H`2_qnDV(qSWBnBLqBR5j3O| zr9v@PN(!h(`W+#{sTw8tKy1U^Lqs<+$SA*O9#9Oz5#ATk|Z~=c46h= z+V$qmqf7gmFP{F-|9Teh^3r}5_cRYYvvNs3S!W_GOV$J!K93^J!)KPZcdndiT)y`A z52u?y9_j2p^##hF`LGnzZU)R54z}u?koDz}j9BE4)D%(yW7?%X&`KB?dYe!daf*hB zLNr5QT;3E;;}B9VDWMD^!e7q538^L z+5%o?msk+ z{umiyPLcn7=F~(uvN4|>g^G<#bJ1Iwz+||0pc^gvaGK>l`?@bblfjP*XAf^534SKkDo{+x&2ru0Jj>Pa_M} z@>0mkP^*kk!nT9}hfI^F%D7T)L$y4=E#~V7+<__OJBXALky*2y&FM-eak_#@EP6D+ zO%9=vfS~~c!QkWRKcCu_w0e1)yLxBkY5no~gSFkkBl}3KH zLF4SRTKnJ)P3PpBU-;@5{;hHN$M&`RQyLv5D+$JsV&%=b*}MyRDg{!UrDYtaE0MV* z&O$mM79m4kGRlZ_QF?-`h((%oWMEGrm~z46_lB#{g<%FN5C60o2Hz|usizMA3T@_P zWm1hM|!(Z^19pe{H-v*uJ@a7C66LFTQB!?4nA7C+PZgr>Ehq&d$`TwV*}9EsC@w?#iE1*q=G3; z7D`#aOMzGv&d2>mOPUO`evyNCmZSufg}KCxXq1uoHede}NgTuitfeD*%O-*8r!qIx zRR@lI3pJNgz?zNcA6K5w&_^tWMVFi+#WQYB9+4ZbIIDprmY$b;RLLqCv23bQvFR1D zXuizxAOJ%`h?6}*`hVDXXH*5JY9Xc&uwCcOlg@X0*LVDPS?_GxO4ne^UReQ z%oz>4Fiw^wTCH%hYK9~vG^trev&0p3x?EyW*sR3dkr~D%2JDO>6Df~mW&J^ajl$C- zS!vQI%{gZqy+y6oHOgD3O({a7k>aDmx*4KCkZL`x+rkLvYi>j=iYhA6sFHukcp`Qu z*XM))$8eeg0C343{!qe|3;1hdQA`{B`ht(WV>TAK19l@1Pa}5__>ANZni=DE%*}~K zF2CEpF-3Fgg4{sH#UhWJ)Rniu^aC#h~Jq~iGJ??04whAD<^O-_mVeCOOK+W^xF>A*K9*ZGD z0VWmi%9V^?RC*y=u^LDZ@Xug`pgK%Uszh9?6MRY^?rz}&x;O8>`21@9;nx7POVnk; zNG28rC;0*ZZ&^`0%;|@4bTcLmxfyt&cMPi`LyABmRt{0F&3D(}%O7T6yxY$df_Kvt zLD7i8AVLfSyFzUPi*51;MroXU`?f>0!d2DFugO&-0?*Fy;Fq3>bnz z3@IoC2p~-|2qUOX;h+9@;RJ@;``_Sr(T`D&FB4Y{$shx~BSs(y;83l6h?O|Mc5!*v z(n0X2_N8~rcUsS$buSQ74I=>4{ZQK*795ZRjc5QFMiA<_@hiaLKq6zxCt(smM9?I_ zD25>kjKP6`IwYV-3Q+{0H$PU*p}8;9XG9Fy{lF}QPX_>D-9VLN`kh&?*_}7LtcD3a zWAx@dgVEX_*BNJwRe(yy>7e%GC!cStRv)eITi)H?@kG9~bN%t8E+R1kLo`A2qEY8b z45vsMVnSU65Y0e9Gx$tsRDuQ!ATh)M65%*NkmA?QfE(kOAVK$=&@_0uspqA0;N7Ox z%fD!TxVd(}v*-H=&s|Y6mv%{ID!zN`d)E)PU+rB#ISt6}v715@L^6<&O2+DU_LW=p z?~I*WpSF%L-+XaRg_!$?e=Q$xy}CTV`nYvy@5;sHN2?!xv37U$T=Vf^e86sD3uJ8j z<+sMaHm~hyoq5=Pd8KpYO6S7P&)=<_X?!@it-r)i)^BXS-Lrmw?ZNW7#__AI8xK~_ zt-WeKx;zMdwFP84BoF~{oFZ|8AgPTpGb=J3-~>Za6e4MYK@bOs`2uKqK@l}!s*u3+ z2Mj_GFboou&mm|ABk3{iBcfn;*@b65il7YPV5?_n7oeKWJo1rM4QKW@?(b~ue%5&R zcwyz!@+0AS4*+5aNDcTQV^AH06Nn;UpLN13dxT>QLE*El%@9Hy0}Kri2D_A_{u_Z$ zG>0HJ-qLUkhu%$@QvTpnWI9k5t<%xygR{WC#DX^>K^ShwrUB9|6_cmT^!Cu>*jeLT z`}@ZukBt-gGM)(4lCi#PIY7@cES1C_dNzwP7`He^sWu9fmHylM-p13n^|$fZ+9Bj$ zJ?&rq(0+EhdFSd#1#1?_v@^$ubMIM$|O9GW>J$o2$U3+0( zKKQfseeK6rmu}b^53aPgzwhkWJyMNS$pu++pHEk$NRC%ZhNrqam{G*M5=v(VbLWX3 zA6XF09j3JgAyl<4NvAk>&jze^x_FV*;n>=XXye4m-~4{<{m}PNTkT3`#zDG`6GaKM zT&%UH!pPiC0g!bfz^6VCl9F~MKd5@!&n>OXkG8Rp)#_L`4E!j#y2iNljKw*?SI2bW zq%)?N0Iinmfk~PPV8e`9N&idaNQ^52L=R##js+F1L8Vo@$a zEoj&~!^Nw|?D=%kEf#s5B_fh98nl!oy0H`|ismS;AjP7ntS~jSKfo!5 zqA&(-yb}om>*Bz9(bVgETAy~;_h__^#W%lS+y6f+cN=@2H{P7=?B4m!m`8<^6eK7N z0GjT`^O*rjO_LM}H{Rh05)eVG3*z7jyx$AF(TDzQSacjHUAAlmDD6vz!v1nV04YrX znxH9?#QBCkLDCe16MgaM;m|ikEJ>Vy?58ZY9A+CC{swyFfq+C51xeUHLKtGCUmxh4 zKOy?r;zz;pPj77AX`(AVKIUwZGzlR?ll-{ojU6-vA&zDUu@4bWF#usC#4x~6IMyQ@ zjKQKw644CCP#jn^-i^605MiID%BUdCZ0>g?$%O^QX40ZY$fM?uz_0Lm6Ou%B^I~hJ z6gMw?OlFc!} zgRpi6%N3pr`WWj%P~f*-5dDgp|L1NCVv$NTZH{ars=Z=S&^%0apP*(2=}~O8sx~{c z+A`RA@WHCRafQFYCkQD@Zo;dhxpzlOfc-&{=)oH7U(0 zuE&zFu9puU3%2M_1M4zLhe0P0EOH-am`mhv;Ig~tY1>KF1=X%G=KpISP0H+95TY4?K>`wx-bDOHpo91_u&)qQmBa>zAtT7K1MOGeukBsgS!msO+1hih{q$sX z0Fq&Urk)oWD1^KvS-i|Jc(`A+MH{d%!1zP`Kj_FC)2y%{Pn2G$8wt=sP!udml%HBVn!+B5zD%w!B1oKk@Yq?$M1 zDCqTT?PHgk7iQ5MuyCu-hq%#X)pSZM%E+{Uw6T6kIuv4&x>^ZDa|@Vq+)6AvhcgAI zc_ghL`J0j@&FaGD++nS|3-U;??9Y{SoMjAR-QZsEC#+&$j=+uiB_R)Tj)Ln(;9+;R z=f-qA^8Ap0N8{cJ>*rA*9xp7KuK7&dCqjMFjCdcq^uy}S#=9RIH+D#u&rW%?(a1C7 z*r47_Nmtbc#iF=c!6Y=AL~yV;Ou*o#aHrL8N7+pjZ%t*)h8-&7W==%@HG=TZQFFXT zXkFj+YgOas{`RY@om)pbudYy2=?u{tBTc!v1w;ZA$y>sOdM(Ue8|s)8+}imXPO%e^)G?ynL9_@^xhlixYwT{{`SVladD(RF<+? z;FY)S_pNiU5-V5!bLI8o<;9)yZ8N;}3K335k*;{SS^gYe%6fvT@hVwd&YX@GdWo-Z zukTv>P;GC2_OG2ChyDX^T>1F<(F~P>3BN~|;$*6z#=>hns4sTFgWmX8B;{LL)aWE z1{9pkOfpka*riyCXUr|k(^@O6P>h^**qr@^56p|2N+dU1J$r45W_1T+^rccsa(ng zwH5v;V9gRbvPN>Iz&wBy1+Zc4)_<-q@8f-ePnFy%B#TnS%3-n!MrB}SrL`HaRi1)l zzJr^$&|+uLdEYdzE@EP(WqFvBYpgkQA{u4=kWvx8Y+4exIJl(;4PF7_=C%5n)t4)W zHSN2fn9q0A?E_cW4o!3M>}ieE=hBNsM4TR#bBe;OD(;Gvl$1p)7G-=`-jf~qxd>pI zkP>2%+c#K}g?vJ_Ojpp#s7P|U`v^e}^9)mSb2B=VqSDQ6`^Qgsh>E4jH9* zI1&ksTHmLYiA65EDXboCm_#h{RRY#>-ofX5L0R5c?8}dR`JlCG%)C8lTD|h`&FA-8 zAKyb!B5(D;9aRp2{eH+ph?w>1ahP!UO7JN*~LNPRMA)77&ZFDry?xR7vVB zy6Hp9q4%p?!<5xs8vY$p&N$2_^{73b;or@#zHEMc*M5Fu`DUd3ZvWEL#hZ(tR!=TH zs85r54Y?U((IsW&nP_5~u`wp35sMUZn}WsolqbX@qKMO8IWal~N*an=YDws|O1@cQ3)-@Tj!W2*R!|f-h(#NFmwYMVwW~5VwOlNs z%uIX=f2;c)Z7b3|075Q%i|EFTna19NfS!%LMbPvYbFzY7z1d)-vnI2Bgo{=2jV4ls zVQOB48^ZCCA9HE7MkzIpTwpKMa^{ItuCA44W^$!^2VVWSp^3>%u7s=iPsZV_IU-zA z7oJq83Td5B;Zi_t8QHs;KA@5+CF4Rqk$lvp>|?n4U)gF>e|j@LyO0bWDV4lwwUp%; zZH9dj3DBgbsmQp@cC_jGjYJC04^AOw){(&~KD%RNK28ymDVU{BXz~qqwG)(N+zOqi z7*B9oo~cY|_@D#K2Fy^cs&Ol69qojwskZPXouI)pQBF1F6U2n3n|}_XIX>&pabqh_ zwZ7LA0}4v-nAQCGN*+rohP>Db=GPT`xS!xOJIv5_;f4>)PsZh0+7VW2Z1kx4^;nen z67w@IN08xEq~OU}9lD=12UHqAUmr*o>`BK~yFmeG?Eo){7qZi>pD4OAoF*sCf%M3c z!j~#3m1@q-&+~#bPr1pctXg}=)dCbtrsyw>J!lp+r5Z}f82R)%pkT&PwSj0ACFw~O zsb#H7nb6}VRm5A4g|rDzMUbw#Sr>gok~3MtzAP}wtWZCxI!Pb$R%#1K=%Ic3Y1XXo z1{fKmplO48H?Q0NItCFC}Fp|zAyqFwG zL+9%$vUa3FsygUB$^#hG- zZ&tp?8ux!_9D6&M9YO+31jI3f0{{>r2!s>8fXiEFvgS1^ADY}$iLVkd>%2KmV{wlM zaav2$G=ez9#@l-Re*N;FT2HorzTG-^t@-?Yim9w1a)Z-7 zL7gec7>x-N8hiokj~Z#3U=@Mm1Vz&nH8>|4SaJE2xPEW-y8dU~e16<62@#3opufG~ zBG++9(TIV4fC>+Emm<4Sq+y@tIE5vJGZa7=AQ43XfK#ByFXoB+jVPR;$!-kIeoTGb z@kJs`{e!phj>8#%L5l2al<;*Mjc6Q^6ddClM^f3OaF>NyeI+Ak)?<~NE@~e-npk_W zxTACP#NxTtgDZPhw=?ylbItP~h5KwC5EubSjHUr!ry&Rc4)A`<`1l4G!We=;Xr?|x z3;_v10R}@jB4`9?{yu{M&^U>D>&iq@sUZ&}EM=p(D`F64nfi#hl}RNTX~^QKj@}p4 zhewlhh;=>j&yb+lTJ1+-;xVzjCl~=WXlp`_=2i zD_XbiNKM|Ozn2R*@GEZ#_p{?K34Cv#Ujhh8selfP=;eYc&Tiaj%W%>Qm$$xM3!z2nJTQ{A>QE=-#O(2LtfG7qhXozqM(3=-cq_HA~ z#u*$k05TM!x^dyRPGik`B6fXlm{jS8f5x+V#w(X61r`E;VFX5#gXr9Rfd@zuqbSG| zcmTwrK;r^YzwmO9(`r}?f||mCJjX5o$8my$6pnKiht7?+o#z+VJ~m$-S$w$s{e)GV z#z>OF0M4(t1Q`rtXbKZr5$1_*gbRY0ZAE|>iP2b3?STMTFVr#5fJal7v;J<`Q=)M=+_+Yl7?|J#;OQaPXGc*?aEujnB_Z z;`Xi^!?L}>fW)90Ev%MCX3+hRz$(s_EJh6qc45U()KTFrYumT$Hx^Gf_IzLe_}gv6 z!ptsdWV9$4$tT7L$r(q%i1VoyVGK)nvt16ykbB7ZKzNlwo;!YB`eI%7G zCc=H!VO;JB_eDqEYdwjkXeAr8)L56LRAW~mec7$5lnl9%qUPp=%86-nj!bauArzEI z{HzP5m~QNCWH~FMt?E<{fIJkB-t+kd70(E3P~kLz(+H<&UNR|( zVH87m!JXs23`t`&0dZyq4Jr~t7=k2@NQeP~0XX2}l0twJ2tfwpaH&&@bS!EpSp7Vd zYC|X=5Q`$oD4RV^20W6ySX9xPy?V9I2HaD{rshdRQh;Pm7>_#aCt|Gm(Y$gaooqdN-MIf|<fFyAo_GsQ?v27s6P!xi2jCIX`39Rd? z-@wnQmX*Q@vu4vX%A?J{i&3>yh+I8*y={qIt;w={K)a8&s-n}`)#2D+Z#{ul9q)bU zV{@uCQao#n^?{W_q-vs^%8-4(l9yK^y6?*R8OJ!)Xv1IuLw}>)w&)B(`-yp3M*C z{P_vjN}EFxcVHNi>a#0Hc-JuC(iyYfT)79_5@udUVLwEUAn$siTCie6Em|J(brN?e zvP4Z++5!PPT^oG1>h}v49!dAQ#j=^x?a4|g6Hitr^RIhHz5P8F9q_rLnN1-o4*6QI z#7tXbU-#c26BVRBKUzLtYaY4QPp(~4basDNf7;yj(A~Uocj?^P`Sj|M_VruD^25f7 z?bhG)uj~7Wqb%;m{oB6j6z=sS%}dAreff1a+UFMd+VccPQUs0gjn^ecBdUAGKb5bI zL!8Da9HViZzyY8L3Y$pRrb|#P()xN(GzR%AzF167$;2Y9)Zp#m4V-SVsA_dmY&LiI zfNc=BgXWOAd(!?rDz!@@S%`bwvxrW~EtOm$PK!mpV$`KK``o?7MXmOk#iG2V2Y+;9 za-GR<_liYw8X7~9sg&@+sNj>NlH1DE%#`r;d#l$3$>5uGUV1v6_a7r+A|T)~iu~UM zh}F-HWb*;R5^VH!!a>v)=xB|VS-=+j+~V?hC{yGua_vsz{-^q`_1*RBqU8Fi&cXeP zZS9*+>aV8NB&JOa1t4aSYss3WrJ^((N#}U0(ft0q_Om_fj|x+Y^B_V6lo1!;R>9y@+Wjux;y=G@T)J#*zq*IDUf!I>F7vZe;fP1W%8NGLA|y8}+%r*Hdx{b9kRo5o*) zJ_R9VO9F+e29rC=Ev=l7_{x-~!dsZOdGE>JnkP>fY`ntqGLMM)TZ)lWKj`&Rh2Cj=z7r zqVMcFmv7yFQ&@WcAEEaCC(T3Ocb>n3!9RQdU#Hi{0wp0{)beZA4+5McCnuvya59{5 z!RoP%m&`azk^~Yc`+pi&j&?5m@UzeNKHvV+;;rVx>y0}X7WZ`S9MCpypIbZC`t+c4 z`iJ(9Kg>|Y3MAw1xRz@dKK_Ti7L8UkT6aJ!s>&8>X8$+iw{UqI3&vu6BxzOYH`m{Z zgb%NBRB6mQ^0z$|BW+3hCiMQN@~eViK`1(aZtZI8;jxuZ|JnKB*3xso(LaMl-MQ>6 z)>J}skkX1pfkfFJh~!znC3Ip@DxF|+<*Iq6CKd&Y3odiitHq_IaRaa{Sdi38Wx}Ke zo18xuBAFcUk2YB=B!OWV4f-*y|3Q;#!56cXg!qrn#_J14Py6|e){_S-Cz}U%j^8h& z+Ou|gX;<^yskOtM$L|(q=qFE!t5QO#UEC-RL89oln`ap4nBHdhjHDH|ILys9)MdIz zsAR=#;jcELC0M~PV5Rntmp7R12u2xs@Ju;_VFT)DAs6IiGFZ$Ji;ov+ETn9Dp-%OXsZd$q1 zex~v2dgH|RqO}iy>R&K{JT};_{S=0ng?}&p_jk9V%|kC2KTR=*DHwI+lkOrbGp$?>GZovE0eg)*<{YppZqm#!~=T)Ejkf9(%zHyWSLtQ~4!ev712`a)r0C9P&WBpurx z>q{i&_Y@1fMYnG~U*12Z6b+;Gu@5~01y)j4^>Pcv45}n;1%#{Fe(( z#EfE5%;CWX(^F_%Cya*S-#R>HGNECTNu_g2OU4kDeT89PB?>`)W_~5= z9ospQ9OHzKSl3i=<(-=(-wf}{6;%FT2%V#{>eW>NS7vc{^Y-iUTZ95-)X%jJJX+n= z{O->3zQ+9{**`RIoLSp#TzNTz^J4=ML)^^C)N#@kLvHd0Vhj_0@ac+Sf0VfrB$QOm0#u@jj@n0 z&gjx=QR1t4t`3?J>h0B2u=(m!^T+4T)`#PbqxU)|kCvDAw~y}V+&JGp_IiDP^UD4i zEXE|sY9N+T7rAEh7P1*n(jnu9nG9%anGI$wOu)2h1s=hKg%~CJ@t1k zomqO?cze2ibVu{Wo%KicAD1sI&7!kPp+by8+&$4k)HGfrPK=+Cg>L`u=Kiydmlx`f z*N(Thf2cofd^ps)`|)Qpl&^M`7o0gF&B=Bt;^ipqG0M4dokHB+=GzK{qI4OPE{H`Q zg4SCD3(1j#NPfTH?JYxNDzteSJEU7e7Ya~{K_!Pr02oCBk|apP<=@N0W!#kzizsh8 zWY2tc#{HODDkNr6OC@LI+e1W-$)yr;hgg)1r#2p8O^ZcFWd&@kRvwTMi(CqRetx&| z6Y2R%4>DS8@AI?ldf_gTs4f`@aMmN6&gNEP!)Hof+1^UG8Z4W zD0>>JK&q7{xm}D@!>~SX$#W+GCdn zqy7nv9$3F<&J-3#jUQ#c#PZspy3A$Y+oKk>Nd**nr6a6S@YH2yCVrF}Il39?0DEz( z_LoHhCCRMjS7d<`$E|jc#iq4tm0{dDy*tveN(ymg&c!1^Y=wKmmSD_Ph?K0}2!2s- zc(OF6WeQa*md^OOLnBR(gL*mpHU~o25$C^nCrYkR{PnM#vN ze>#KD+DYN8r|g>EFC~r@B3gOcRfxqyd|k6OuD&(k8VspPT>U<3j-QS$HAzh-EU(wN z%2;shVYBe{4QWHlWweh|?8jx9=kU3SbwRYV6vG7{)ThQfQ^?83jBh=;vvO?dcKvYc z!uO5W_f++h>gM4yi@VipH@*fhK4Kri0nCdM`9w9G7|pPSD@X-3p@F9@#E&;Rb+yfJ zAU!-<0NXs&?F%}GHZ7HV2|sZn8LlB5{|BZ&!YcVV?(fEWO9jKKxj?1;cH z$S?#soa22Mv^Om=LVcyr4dCTMmRy4uM9(zCIQD%I8$r?}1sHIW+OmS1co3(Qh*{c$l!>=`NcjFBq#zW zyX^TsrBIU!RiM=y{}M8LS|h=S3H9(VhIGWBK!45y8X=mdXe7jLohKNC2!IVkP7gbD zLAWD5nMBgSCb}0S5)P}CK^UMn%){x;^_{KPAJg9dPPIQitzVF~?|tz6TGjl1U;E9? z=CQ+_Yx_EqTt3}CdA{*t-!wA5&XuS@|LEJ?BuvHk$h2jZR4>4?2dVmLar^Dl z-{jkGA1@wRdG`;Mer|ud-gvgZdHh!6!aRn zjagvh#b?Wh8kdhX-(Rl(*nWSr{djx*wz>WG&g!1ObRO+$pWJ0>T{yaUw{PApG3*H% zVI+nK3d1P^$8eH{n-`5Cl3AE!ioyXz03!*Kpcw`uyF2tPQtb6vciLg8;(kJ^7-k~l z@J~lra20|K)}`6gLaPvQC}wG?{mkdnlP2Wq`%Yhz`lnzIJA zj-8nBG9fTXc0&U2E-|1R=YRlEXo-OsgCUw^W>by^8>YcAL?c8%8eurYA72BIG>J0= zBG3dreKuOr)pWIqRQi?M?Hd={r+2JhXdJk{a((Sd=x@{6^EE@SWBL-eN&nat8qdfD zX4}~BaU&!gBbP`rMJxv#T%>dr2Y`= zJh`=WaQ)=0o06#>c_{DUxZ(;`s>pH1DH0J3AW1Ohi~qKMt#NGc+RmS6)~`3;y)!T0k2uK*DbY zg25mF1P!@w1*`BoL1t6gBejT%^;%$zQe7<_Ro3$C5+K#}(J_qkf>_!<^W0>w;$N&o9G{C5lRUA0Orpmwv zDy04Cgjm$r^TX<+*27(kmsTF)$>z>me5F!2Ln0FPZ7?V_V6otwQs)6q&^QJL!EO4H zRQhKoo2731?b5^Mo*$Ra>p#D1-Z-fhw-4WK9(dk*b!X+=>WTVM@wPA7b7ehHD=>T^ zgHwPZ`v@z(xIs9gagqRIE=@E%VUs+hw)FiOXG$CKWGM}2W?&Rz(8kmd9;Y}2^oG~P z@VYSwkqAc=5Zow{5COPh`k6*4fzbp`V-$n{5;y@N!1+fhgAq*E;hABhq|#}OsbXK0 zfV10JI-mIb;Ma}E`&$Q&{PFJ}@BMsyr^DU8q?4x6cVIE>MWg9T%9_uRGJ)OA`jx=a z;rjE9UDeJzziD1L@t4+x*Oi~wpCp%_EMHi9^^c4o)_S=+wRU^?xw?Lpa4mnoa(new z>-#(H>-!4BOFsX&zH8}pWAFRsoom1S{Hb|tf248#!_q0mS?a-i~d9_yUYM63Z7V ztDlw+|NZUd=DWv@3uju}_cnIk@0>dRht|8t6L&xC5Mlkz4}oX~0Ehud5nZ+X{{DY@ zbTJ%a1PKTdVgw)v0>bVlWQ$uLyHaQsm`60C0f8`~6Ei^37zQzjb60_cq^OqV6v8XP z96bz))LRSe5!RD6Db7o)^X66i*pqPQ#*5V-TMr&idV|r3BpC`Y{KsVk$smdzgb3vc z9zbG<#AyU)TN(%g;(&$}f`~$Z!uzjtoxL_6}@=|=iuUm{h8Qg->sHSv&=lzE2F z9?-Bi?i&eEBz8s$w`hn%RqBWU%Eq`z@1#Cr()|0I(29Y{t}56&#AKh1HUQ z!NEZ9k;8C7Ta2p3s9Xs{UOKvo>a{U3(2txcSQ#-`DJRC;3RYvKTE2(r5DdCiks3_i zV2sr|6D?7VwT~U9Y$QTi$ejoTw`NX4U5dyhaTlvp;w&%Cva9X^ck;(e{f8TVrD?RA--DoZ%dbNwC|l-Jl;BfXy^=AE$SG- zSPOxgaWvGIDqx9AbV_cpFI6dDj0vVwYsas*et!o=Ykdl= zW_L96?7*(7uI{SBv-9i{05b`I1Q@{C`Fjx>fkYxQ;MqNv6>K>u*|LHqOR^sHz0_fbp3W&lKuM|lB8$GB)NONlU!5cuIRuRmQ2P{wOs+f!<#l*{f+6pCR6!e zLa%u;;R4R`pK0%mV-6S^@-h5YhzdNwoFHHUQ3XyUO1O>FCuDW(VN+zDo8Bj-li27lt)ES3R6&c??dunu9tCDG zv0tN#CkF$LjVa{TsI-GZYHpuOmDEMeCXFgQCTAR*>7CvX^f6beEz=lB7{)xJl;;8B z2^27H#x$0_`+ec7$Kz`^@}He~_T$LE7jHC@K@}V%kQac!3y^16AdtaM$i^^+2mzh} zp5h`TTQm(dB^x6M@{n$5senPqBcAca7d$K)7ce9YK_DQ)mDt7v00>5i;~*~}o{%DO ztpeAWrL=XHcWcLR+UuEB;u-Vd(O|;ejAKk`{gtJeTIDEuA}i36696FNfx^0j2tte~ zM~QshO-u~CIm=MLsmbCK(*eC?;n}o7PtZ7OnvgDO1TZFoAe1dyRnLlhKmXsAo0$*3 zD7=3#cm7b}(&dGl>t8+l)wS~3|F`l*Q(iKT2>@YK^bu%4Pq08RUDxX zgVl3<163JJ6fXtsl%-6^22llQDv!umC?t7M9FOWDu0m8sVje_CS`(E~P(3-1Mq!ns zY${?N!SSRashgWN)$x_hB&P?#fG55=&a%paY)M+S_Cew7&nt)4&aS`X%$~koewsgb zYUQ>yd-dtsy_E}V4|4BcUwXf^e55pGzdt_wKMUW1{H=5O&wtGwyPdi8RqpAx%ePie z?>DvOSjYRg}ddKONUo3{%!4c z=KX6E>mU9-``}#e!%y3Dpk;19)?}`ncx&x)_Quz_8|RlV9msugxdk7ZjM%Kats}xS zgec<)#*71igQ$~TokBzfLg>aR2?0O|-;xi_p;74#B?x~`Z;F~iff0>ruFvmJ%Gl4i zB4K~|0+gbST}FS#s;pr?-aV^CeYR!BvdFNlL&CDc)lXI~nf*-}%c4P_7_PKktrA@> z(XlaDcP_3U&mO*(Shzf!yZX((3Ibj90FuN9J$?48Y4yGANB5Q=u6}qR|M*nl;f2iE z9~bU#>gwf zt4}izzl`htd-b!$i_0goSFh%d9bNon(Ds-7-LIF<)@SK=y8WXwig_)4^z7@^hs&S- zzdy_rZvV`ivp-zQeE<342bnWpywRrBeQ}piUsC^AM41gO`|$eenT6Y{w^l#Q-1-<~ z@1M`V|0MU|)_<)WUOG~^e!5Lr(+mME^xoU?`n(24MmV=JX<^}$s|#P~ z@<+Z*=P#dLI9UIsSKmK2Nwu@77(b?5mG{5QAO1Z1&F9NM3$#sFizB)LVvrN?jg8Hl zCgj2Kl0d*#v$@BL=9w#?EJjvO{QmT#!tq;t_Ub$92iw$Z!X~fNFqoJ9ZMPEGQ(t^o zo0v%}OOXGw_`~Y4m8ZGOPtAtEuYaC>agI);le$AQtA+C@1&N#UwpE9r*Q6I z?(UCM&+g@K9a=gqORF3yYWKwZ6yjuKUYlWh#xZSaQr!OijoP?$g58 zm$E+`bY!l7@TcX&`MV#Fu6&&T^;=8k%E!6$xBmS5qq7}UcR$--_oUbCHE{JksT96C zr!(tkq7gr@QN<_ghyt~~lx|+5nw5~PG!LBC>SkzPpWP#QR9hy`8%RA8aW(10kq)}Y z1_rcsk93V?h{0LG>)@J{v-I@$rym7-vfmy4{kKooej}NmZf9=({I8vKu`a1mB@!mn zXk&NCdXObO(g^mUo>+8dUc~NxG3JsymrOEQ;4rk+ZCeO&jN?K12F4v)eyN zp9qZyr^1p4Vstzz2IIY+nmlPq7C;O}m$+?{oEz3nqb5C>fA5R+cb?tPJUzU8Hhb%M z?&QVAtA&prJbSqM70P`1`5SBZvcDZ)JCpnBiw^piw|aX)vR7C47)L_MQD@!5_=Ksa zlR>Z!49;s*0kiVltaf{4ZW1T}9tnuN46GgX;#ESzab@|`>h;W#U%91+LyaGXOz~K1 zsu_dF|FthZ4QAf|{@*eeKlq=~l@m)xvWKoMc0xDDLZfwikXqH7P6S~`#BzebVKSvr zIUIe-nPA=CIjvDmh7J5&w6hfu!y_rHl%6?l*|zmCpYX(@L%}A!m-*s{l`oc`cG6&D zUvhNLn$)O#o@8`Xd4^6I=)8Tx?REDx9R3Bs2!}!WO3jYvSj`Q%l}M7FZ(DWrbiiX$ z{!FdX&TU(tH#@7WJk340xqdZ!|H<0XL7BvOx}k)Oag^hDP`CZyH=f!S zjuft*|FbUt{;~QzL^Km4!^#X$(d;kZ74F;!Ej%pz_{5(5^`KDr;Bgy$AkE|?^drtu zIR{!;VFt_c=+mfVI^38IdH85>GU3#y`umeJoQx{Sr%}xaN#Gt4smRB#%uIzRJ|}}n{y7B=0*%7 z+fDX@7^Xs{xU4#bqVyFt&`QiH`109Z4od-ne zJORH<_-a%WzC>C=k+>CZ7aE$coi-%SYV)Ch%Y-YUv3VF&n^>n25UqO6Hji~0s%w|q z?s6+p)@+WLBEX^1%I4XEnZgmOT(74{2QlGjmPM8MkiX8t?P9+%cLCP zl^&e3YQ01$$SZ&D-PP~b5B+gFSSQ9p7KhYoIcf$LV30gWcq<~eNr2UiZeqwdShIDN zz{QD(pOg?PvWC}0Qy!@a(sGhu5}Mg3{Hlo zN5kop{5j3#8cAD|DFdN5Ex>ty6nq-Go^MbdfxYWeL7v`XjtkM zgJ~wL>z$WnEf|6(Pmm@CBgu+zt8~ob!PUowt534;-YR_b)%5b2+`+?(zxDtAxMW#W zbeka*3KS4!Vgm$t%r|4NfDrNmri6ABs)KpLh`}~{@Wsc?hgc0cfDz+>;uupR5RABT2)vSS6h;_e4pXj^aaKc~V4edEAW9(5^Bh$U z$sz(~9AAnPYsnSC!~w6&=iA7mP;9(8U&KTo9hoEs={L5Z^e@NwWTYoe<4t0&)~^43 z;cV{ogPn}6TKg=2^hff?^)D8_nO?k+RIhxy`0d)S*&Da=2X8K&{nu)`mBYEC-xq#( znmc|mf8+b?rJq)hE?>!h|K#_l*WS*4_+>4>W2+yoUm0I`H(0p%Yv%mL%=KH#Kga)N z;o#D#avFIo*4nA;so%1Pe;#^vXZ>7H=HA8S$Il*C-xjXju?^)epNy;=EL=F1=7j8{ zFQ@ZAKCLGB^UB4-;cv4aJ;^>fy>xmqd*$N7`Rv0-Lj&r!oaLRQ4P(V%G?;sIygYuJ zA*4Wz`nCC$=(i@Hl zh$0R&NREVaEUXWJ=7J+C+Khrsa_F@Kq5e6m)7>*97f(TxR=eBOo@m019|aC=VF{OaM*DZ3F;0KoA4PA#!>H z#(<;d6w@qJ%VadRjM6&r2WR28cL(MQpB?|}+PC?OCl{|8*RSTU99(+3^4Wp9I4x<& z(hL`J_K(PvA{(*HM~eTNhz;ubXz`!!ab3VZn+i4RK{JzZ*d*0~rotAm6&)x&leV~R z$vSm`OLJmSjJDuIP_@^CXga8*2c<#0m!P(4P+jDXz7Iz`RgpZdNtd;63b$9228E$S z$jH~Vevr}xLheYCYu^6KK%}X36e8|fIx#S_m4O(eeB4l15udf+ho5H*f@3kFGzJ!{ zbF%}m-@3ok{}LThX8#vLiCuAYic)QYk&K0Dh|QDi;T=ezhyrCv}b(n zX6~2sZPX++#|Wi7<%mEL$78O-HMdy>aUc+B-O!N)t!rk&8LVrc8gUFT9-~IOl;y{{ z8y_1N-fPnyj&c-H3I)JXggK5CV~97)GD3Ts?fek%2ouJUW~>Yp0iMDdDP3jfH**s` zXdp3WGc@1)EkL&OC#;i#EN@4zt8S~$es&eUojG^MoQY&wT!1 z<@3Tv_m;0FS5HR^U*A~%x|Pz%1Q`AhmS3?2_#~5GM8ruvYhl-I;0)>!qJmfj5Oirmr8*_%ophzIpQtwMo zPB&4|vgZ#wGgt5Z=lXTyzZP!YTR7@o`FP=n?dJWHD@+GenUkNSSI*gTXMQ?ReOmbb z(E7)@Q|Fd{So?f-GJovU%BP{x;q0Za7Oym@K}w7j>9y|`&M$qla%bV%@^AV3U*``V zTRL1g`pfdQ{8zX5mfDdbVTBrTv={`32*LsZfG=|`bf6sxJOe=BFu|At0C@(sz}8pu zNKmVSxlR|q*;fScZ%D)JR0>FWV4d0p2aT30S48P3sdSJmecf-FEm?~jj@^|bWWU)y9NO1# zf-HR=_e3VCseChVT^7v?b;PG5bzjs%Vani&wl8XLR%((N6hCiXVpwku8~x6aHl>0X z*R0GQ!PL)@w06jqFpMi^(~bl|FA_yo0yvjBf4Ok+i{*ohkE>fWoIz6ox5wg;at>G` zd|%90PdH#rd7XNBQNh3{DY`#4mgfJfZtZThn0_5U6R`p^8g5B;FdeNgG%UDh=H!J^ zw`q2ocpQqwE+5KXK9W0eVfCB*pwLAy5@a#GzxTP#N|)<=PO(aSZf|(-jRJ(m8S#_M{3+F z9zH3hTWAQ6n&$@%8kOi7;$o)K`8++sSuMjAPBaNWgU#jhj2Q=}tj6is4A&7?L(py% zhh~OD1CnPkXmga6jz$WHac^28*GmKqMjHtCkNafl5-6FDHKYt6`*c{A&Q^^IsHHMD z<#!0V{Q-C5<8U%GWHq`?W{Hkk>JsOujm##8`a0!VFyM6mCioTh(@KE1XS~8=;po#U zhI*@cfiMJNky5&WWPyhW^F#o3Bny228m)qHWL7!WTL-XdzCX3Ew$J)T=O>2jeUhv< z&LvcU72>z@N!C%g@a6JntMBF?oE|&ie0w^3_R`|DwcCS#nZpYgnnrr_fCvKMiw3Fs zotQzy5hN5H4i)xc#32sg5`AS`1}UBt-Lg2aaaN|J#MjtBw@wiT96-2^Yk@k4(!C8_ z3t=0f8kK8Efn;I-evQfz8xQPLsphp#aYCc&9gE9}6^tl=V;a?5s4uiJtKHC{QBC(6 zN8Rms76gnp+CX@oFbFBniiU4xnuQ~`vR{6;{;p&B`0{uEl{0riwVa##0cwT@(Ub? zD2E_p0!EMsL}~Iv#GoKBj@EM=aDX-^IYv(TZ`pv<2b-o+l`7Gq$HT7&Of5`HC*rg4@8X9V+cda#{mYwj?#9HL#Ax`gHwd zeq13{ncD!S_|&*vFd}=CG{p#bL(DVh35`yYCaH>zVQELWuVlk5$I=5+U-i#oK8c>N zzVbxMY+#?|lJn`#i4A6*rvARF;-y4ukP?#fB^R4kga&@0Ppp_nl_?F9UO0=$h&MD_ zTBZ_SgHXx#+MLiJZI4)j!Dz|M+MLlKJYaTJ+;$Ww4Z_ChqE)X`PJ^n$aCs1PL-v8e zQOUF7NW_e_C&kf=d9`CVA zyKm&Rd7fhol%$M=tf6wE%$z@; zJ^f|j#`Wx-@BII7EPwb+_LCEd?3cI8=`F=}Rvk7kUC2H;TsU=TRmv>`)G^(-u)6>gmSKnVhwQ_&?j;?4*qw<;rdCx#fp+E>NE?Q~NsCfbM1j3Rpn?ld5-pSnm zVewAp+(&O@Z(cvJ@;IW{C2Q|xj=i&Tb7JMCmQQ6q`sgo(n~(PWQ}?&4zsf1#O^3%8jz-=rhXlO2Azz%fsO`p2HuD!qqcCTWdHzxfN}Bv007zl5k`dP;XlEmCdFY6qkjS$s<7}+ zDzLLnFa2VXjh2AtE~~zAFUe1>R#k^u68NHagko=`Y<^#Pz*TDXKDAoC?++?-*)O9u zQA+b8@@9EkwUze1;@A76{v&bNN%YN}H?X0g$lmYsi&5J~73=rv()L)~SiQl3#p@R% zQJX(hja2bTM5!$ldSfnT7sCNDDn{P$2H*4sB2imF(wHXc{I-D2Ejrcqltwim`ut6j zm96eAvx-+c1HD1sD0|k4KK~mLPiX~KGf;y!$Qwo8ruuxVQB#`A8McF=**L%|4oRiI zHxkJD`L*iRNHpvXxb@|x*EDu@Sy?Zi{EF(gx}saF-QK9$zM);)Vo{H}rZP#=ZYbDl zTOy+NN9NRCn_pcT3U%#PYe_og9E!@Zx?)~$m8hB~>Wioywzes1Y;;Z2)YnrXXT_}K z-xk$ybx8wP2aCN`(pk&hp_HtmhO2EwJzO0v2?=S!q9(2`Dcb6?_)%Bn&uk>9n7m!_ zvx(YcbFXf^*D~B|t-jsR&RcxEp_R9LUDe6ewvboWtjcDrE^6b&*L9<ijp`r8#rX%7D;)Hz-k2E#;d}{K zqrb}?5NW5@ciJnRG`MO$DqD-nV_q&>GK9tK>P=lm1F}bS%td1UvP9RYu!}$<+65xI zI2U#hkrIyBTmT8!?h*k*$Uy|mu!D&r2VKO)BZt7*AZG{2Dbk7~X!9AOQpsn@=K7?w zX;2xRV)_bKPK{)wBcq*4>bx$YDX0WnRQ^`0%iEmG>k~t^sOPV5icv>Zoi4qs?3kq$ zSnd2WXfExVYK%rD|MJ}+#{NOWTSHTp(!r$qULioB^iy`4Fa3&Je*KxJE=^;nmg`n5 zO7*wDSD%$#*quSgoEUzia>{ta5%j-V`J@8(<9n^QIGt6$^Wh*_{-H)fO)uLQ~kw9n@MZ--O zEu%Op`mk-x6iczJ>e)g`r`UMjpjR}mmUeTxh<6tMyK&G8h>ne_w$OM@L8ojMm+#4~ z41Zll`{l>`{pIuh{#Rv^Hyrx+SHAEBgLC^eMGT-i`RmWS6={`lSI>v#)1EyRN!f$R z>N&Z5kp0_%jid)E(zAG0R{iZj<>Oz^ zspujVU8JImRCJMw*Hk!lk%}%-(M2lu@_gwc6h7&Dw>aD z7pd5zr@Y-nDqxK_unQM-;ewYJF4zzUkuF-WH)dHEE$E^JU9_N!7Ie{q*Hk!l(Sj~o z&_xUO@_gx{1zohDixzazf-YLnMGH#5E?Uq<3!0B(7cJPMr@Xx#*U&`^UgnwhN}&Y~ zTSQa?0CpWDC~-IL7)r2zzedHud1$hycXPJw5A5G|nKm#U9C7b8yxd4V?C2YdaP0PGfQtE)SXA|fCi3| z-N6}3O_fq_SLVyY>Fk4}J==sh*pOWSPJ}p)*qoR-0COP-s1r~Z;9U-ZXTa{jcFa2{ zz&59Y0f+_S;xKjc0v2mlJYQ-`qw)u8cGB5-!KDvtRMsApsNA8y@rzBz`?MO>#o|CJr8a`fGDPdfCNdh zoi@J{$U($mz)Mm#Ts4m&L;yg@q&7^2>l8Tw@enXsW(}5kj_^Fg1lHdb-i1PT4+@ba zmtXH%`XzxmI;)$F%C9BwVkSF@nZ(CDdh@WloitDGmQ}n|(=8gsUx{Pz-Y}4t#$gNg@$$MGm5|T{n@pFcWvNZ8~Cec1Apno(%v$8zx3Vta$2~H{n7Q7-xHIhX1>M{ z?~eJp*wP*FkQYQd@1&R)Yyyv*JOBdVp@U+?7q2j39% z9LQ;RzA%GxdFWp~doyQnHCmhFJr-vW=my#wldIN=7WU-9@dU4ELw4C@k6m8T=Tyi< zDn=OBH|w#b>QWTHEE%Lm#%*Y@p_LZU*vM#j+K3xcnwZBF3{EyQU872Qy}U2zvu{tQ zL_$5oHpO0<0KL|p9uYKD?FCu-t0JoOdl@YK-7to(?Y0#q9f(-iL!1k)yW68J{rxh zNSAe#{6=%xtD?O!7HXLGVp4R-YN50e)R2b&GeCISb|ynaD8d45KB3iwqdev*CM_qn z8d3nMfDvkm2LdDzo`aG^Q8DcI28#VNDn=q3BUzj|Ze4$?H06=@_?O>ZxUg_${Y37w zBl&l37w#X+eR6E=c<#taI=}d&mP53DnkItbId8zN_l7kpZ&FW&=J(ajrnbmWbzUA2 z!{K096$|)n;fSXgp`jWw8x0y&!sGRcDyQfOI%^M0h8aiklv?{pRWiZVW_2JMRP_f- z`>87EDr!Kgzx~}Ch>BsC%^|AZ{+|Qo)SV+whLkbn3h!$(ho1*}l5NqlTiPq#CAwUq zBdSr2u6$Ma_cq-JH7Db!r^Ms#q&YWRI>UY7~05n zqphjMI}3+b-djJl{$=6dZ#Ah`Iwm=c4TUb;&tAW}c5(TntMJ`t3-4sEJzhD#dTm%< zR{tF0EDEJ9+!V53zyB|9t$rx{PdL7KCj0rZXO9Y3KU{ie;gkBZ^}4xqs-gJ&mHV;W zv2T~&Tl+MyaB=nc;&n7R0k1<{ylyMAD{jE40W!Fa zQ>>KlIJDZr^fd+TcB)g8GtpERx9j3|UEHpV+wDQg^jbo9JKCeqh2CLUvXHd~?~u?K zlkmLoU9C?_YjkiVWS&O4_A}&Fhwxt9WRaqHyA*^{YwYtwc{Dyg>Y5A(tvaMpjZNDp z>?2|gznGlF35_a(BQ^qiBEgt)5FzZeIh=Mzfgo@$K@gnOW#jE4 zVc2D-06>m+G3bP_W_yf<5|+`};JnM{*K1U42n=98Jw07feRdril+LMF4R&SV&t!kN zkv(%a|KVqgpNud3xbSH8orc2W0p887 z)lI4*`K_i&Z8{mR*c7)R2FD`mDnflnaFD9aOVthsS-F*ecs>8ciGTFbm7f>yW`6v5 z@r%Nz=hxp|e6oCH<)`0&JDPd$bLRY`Y88q*SIzgMh7lwdkE}kPe0%ZR%==d}7w)ZI z9I8$65(F?4vm_cSpwHbrlf82NZ!2H?OYZQU?78pdB^d%9f6|&#C~tcGo%#ae0zcJI zK<4{*?Tgp4=TH1Wzxd^|C-Uq^jcz5ZC3o#s_PvYw$3L%ptX;hvUwf3f@br#LvE7@NKuF> z;2&HU|JcfWObFYqjMG5xYl?g9P-kv0;?ZaC4Dm3BtyYSo&0vqD&cRv4Noxn-M=-9N zPbSh#>uLvr6r*0-fFKTYTM%SoG+|BRz6K;@pf3~&n4Ad(Jj4?b2cum`P7ai+~s{yU@KcM@xNLnJ9y$Z@LqucFrvIh~(hbJ3nFd zZY<%LPb|+CPcRbIsO-aII=^eCR8TZp)l5RRsHb*2MJ2U!b}*Xc`=jElPU!Fxlo+v% zP0%)}qdrNks%PCvstv_Pb!Dhits*1y{W!r;`A^Zu#c+IIz0MPu@WpuhXhKUHbHoE9 z>G|@%kr%rgKK7a2V}rwqS$?;)CK~A7+e*{6&egr)0!9P9Tk-!IFw7g62Pr8)_!U!t z_V3rIOwlnilpO4Fnr5TBIpM6MzHOI|mB*#L_mq0{DtC3)U99Ua*42$(HFvRBSz_%i zz4cY@>F3gFAw(T0wUBVzuGW^SURuviBN2mf-QM*qdu``W&EpISaCbb;N_A4AJzl#S z|BuC+Lz%DduU%Nay!c+`quUPq)?Cq`cbE=3G^(*6*Qax{`C1f|z?mbHNxem*idUcY zz%e|8HL3|Vn{r!G6!ukLHMpqpF3KUsI~d>{$jLdFOSAz25@h2jM$|?b$6PgtCfdAC%k z+~vR`hW(K`Pqt9d*%OF*d%7NYTlc_|%b9BZy5tXg-CwS>AD+*x%{beT z(U?Eo=bP@8jX>EKt$IV{&XPJ0S-@x|j(jKY!juTXUA+%eCVaQgBdRfXb(0}&%%^=%NGGc-ehebwhE|FkHU3T7Sb3qp;*c`}7sLkQvIEDr6 zVmu&#vr`9vj56e66xkWDzc6cWdDy$L#@l4+EY5kQn)DA^1}3y`=|%>74clF(=EspO z)lok<-m9}1$E|OfddJO1L(fQ$PS2;`hWa8vV;s|a!@cq}+iAL1LxvzH@PO^&6@_ZZW6F36iO}56s)me5JkKMH zS{hu{5K)FO!i=>ry{eJG10Dj%H5#|NJjcz(plj>iEnD}{1Wq?(HP$GuIR>A~o%TB?LFYLM<-(~YfUVcNqTQ>mtiSfwLOnBS% z{(zHM%y#5ASj?}fX@4hsH=K5Evys2QGaEmQ&Nnmi57Rl5doUzyi>bfZXKhUV!-lq| z{%C`xUpJ;;=@*hSv>OiaI@$O4dN{xZs9oMvz{k(vMD59Md)j&**~ML5&Iln{mcA6R+vc+X36u&zX&%2$J*upi!?;8SMOI z^>NDAKh|3z?Q8AS9|}4Z+}vL=7x>|xzTuv?%su9jw@f`|^OSL1YKhw_UZ8L+u1h9e zkV-W&jTt&9EGGi4q%4-fW?z9l_+Zey1! zt0bGOs%6CdmaeC7aHQANV^O%2Q^^SYrc{Gym2dC3W$QVM;b^n&)eZEH_Kf%T51K9G z*5_%0qO!G#Qn%W`CMsO#B@g#nx2s_3oO!`Gv2>cYzzowCj*h)Ksqvco{lcgP%HMZG zUAp(2Ht*&a!wnr4=VM}|o*mj`?eaXg$eNFNoN#`0TJl*V+4Jg;=ED1*&x|eH&0aX$ zQ1E`k{`Q4Rus@$&ba;(3GmY;`=%2|+sUy*=T;J4Wuw_*jPA$Lpx6GZJi;tELW*+}o z`0ak?-l0FOUj5(9xrfUi8MB9u{B`ku{=Fv+t(e(V8w}z3WV8B@VV%d-6u*3>E(L{2 z2pynu0qTyRl5&&2YS-XN={C82_+-gE)qo|DE|#<<1IEDA$R-RIj!D2=e!>$W=a`$cspU=tb@F!K+_BE`u(Z>-GGx99dNQ!Ae1}Q5ePLB z06T|5aXmcaw6nTctOGR4Z#Jjt=uA6ED%u*68q>ohDP9rP5|$zuTO)CA8*GXfCT#PA`#42I}JbjaS<8n~Lkl{{1qm8lQkxM^CK$?4?1w_JE*#EdjAT z(C^QMnIT&8WNraXsS$- zS1+Pz-U_7G6P7LDQ?Z7GEIk=&Oz3V%_kv8{rFEoKm42hKf24PZVx*cLVYgPvT9A~v zcYJbC*W07h87B;z1xY$RjyI`{aoEzcL!nO%r}0hpQ?Y8bUg|LoZg2cpGd-Z=YL55n zO+5yE&s#nE(LqCxX>dES))pGbb5w9k_+L|9r^5m_55P6oh&pZK=F!F$%9>QH*5CbF zwLLbu=hZl2mOTxIHnuaHufZr?xdYZZ6^}|T#A{yyPRfk%m3;KG_7GzeHPi7PqsD^} z@Cb4OC&h|(JiL$~f*3wE#GZ1ix6VMQx5E6#3$wnC*vrsQ5i!HeJYV=75GpARSQ>o zX;Xk&`I*jR3%JFKtS#Jnv~tt??8oeppRy0W`~A^p`((4JoQpsS$5BE#j0Ikx2ml~Y zSHkHC;|Rr+aD)niK%q2QBo%Q)eUV1p!LOhYnCAxLeT^~oy^Sfy=K`siN!yTg&e7oK zrBTHqu-b77*XowR8r7~rh|-hQ_CbiXTr1x@b?M!TdfemJ!oDy&&E8-vOlc4mHW}j> zjwk`rv`bRBmH9Wm{ZvL)$0VON(XFA(-GHN=8kT;$dthGwdLk=3*PSnCkkR-HXLT#} zv}?Lgql)9$NUu(CQGa*Z)L|o-@VkSJj88S(9}*7wHWZVIkkb~e-7!&`G?^>+3tt@@ z`u*1n*{j!7nUn7)avyxObm<>|Sh%VAQ~vR#wL_`=)010+SF{$NL8D63nx)02QJLmv ztL!KW2n@8_7_-|MM@1wcCxZ^c0fC9YVRH!%=nygQnF5byAr=4du zv0`T2eFSEF8z|*Uj&YUq)(b*lr2hCX!)+B1BZx2~gzldG2SSDgNCD%U8-O6fJP-il z+F0ZS3;`1;qAlz{Y5@|!7~_OSrEU+p`>P=!Jiv(T-iRPT8Ks24<^!TefC&OmnJkgQ zh#-!`fTsf2VnonJ^8}u!N+!7uiNQkQprdFv)2LPt<65?z@_F{^ zBlp^e3MQ-ZU@+R}^@)*GBr5vlLPJ$&T;Vx^AV@iZF@XSvrB;)@WYpW)J1&50dTf5G zr%DO<{HCpyhpQLf%>4YbqD6~C7!n>p1{p6v)M(MFcDa1$B-Sn@FpfgRLk2Mh0uiLv zu2?AK6E}`zHeazs`IbO9iu9j+h&5Vs=kM+R%hG)z2J_X_F>@D+5|h6IE@&gjU@^{kEiePE2T2YJw2O z2*aAx-I!07V*1J`#}>XSeDZ7d`0=F^t4A{D&*i?mUU>I%_Sc67PMtk>D0B9gKmGpb z&_8k?oU3M1sl%|C(x~F|)#nM17?=n|Y*BB-<+a&;qDHlPcj@|ph4az;hd(WSzj!Tw z?ozdy#q){6+*Z{Z05K;Z%yT>^Yd|GfxzYr%er5Sk_S=K&M`x7l7;RO>Wah-LD@WHa zF8`8$=VnK>s~l*D#guHO2o@yyt8YG>=yNtUs)Td_B+!)po_coMz53;We_l8;70O>f-eOP}KG!~b{P*>f*)Ja~UQq6n$ae%% ztlO%}?G4*$soS^05?9;W6bz}XYe?P71k(;rZo9F-2epAv@-+?D*})F&hT*)TVK`kb zxIKN>OL3)&F1P3zvrY07gCM0*^{4#v`k2%68i}9h3$j3^Q)X+(fHvBVpBFPIbx3K( zq-IjDeT2n}njn&!VBjvH1Er>RuYzeD{7qc^T~8AB%9Dq^ppc2`8md-p&w~+ah!G$h z<`LRG+c)7k%26n@SJ&IVF~%ImyzGV&CHG(eI1IST)>Qg6pb?ND%yS%m?#oB`1}n(+ zV-bi7h(Z8%aX=tPc|l+TZZRO700{sB&sq)$Mur+B`YXBXa+(U*T@5+SPmJ-K$;9QJY+MYXd0S{~Xsl&E?QSVaVl-~o z;^C3X^(vhqD%CQL+Hq}sd|0FMj85xE`VF;K&80M|NWA=~f^jMY%pQ|q4Oe3Io*#F~ z9XvWCuH7zNJhJl5+Ub8^`K)mHXl>R@Fc>xB7=}EL$;R?w5DHB}7}*R_Vg_mlxln)v zfpCOzJfn=KGDL-PPyiGO08juqBEegfU=G=iw;d=4hj|VQH5}IO4d{b@n|C8i4haIH zL>lCwU~HGnSDBGKJ>~8n*Hzysn8^!2U&vf}u>StDtL0Riv4+>}{oCilEX!EkblJDL zwjD#I#ragLZk#wkm1frUb3aw?RU*tv6_rHyj!nG|tWp(%r%uN&~UC zv4-u{47c+p8<|w!DO{p7L>h$HCSi%1zAyE9ic_Bfad655J_|$K~$m-fgfKW=YMQ zi1@~#-Vt+RxuIQqqQcm3!k{QKc!(}B92TAWSlAnIn;jm}8S{Aq?m>4TSbf}^6dkc5 z>8#{ab@^j)qrNiBMS1jllcBH}iO74t@@>&9=ZWz)HYU4>v-AswHdK*dSfg70uJF~t zK?4ViCb@6u0(j3%WQ6WSP>@uZb1+~*a2&SrH@8+%$*GymPE|5$un zxcFV+)S1-kz0tx)XA0-P&3}4SIkVWjFAQ5`w|+wQG9h~1o@nvrU&3Pn$%41HVH{F} zD5`}H!PsgfvR^;VKECvyf6kx$@~{83b~JPB!=(%V?@w>obie<0{Xg=be!7X#;m5R` z!egCs?FKy~Xs$7Rt!Df8Z+bL`1FgD${=oVPUFL(wBhMZ#e>l2+a`CI>>&uq{i`T>^ z!$KjY0zeSTj6(A<@0M1U+%#el!~VKvsM|vVFQeIiP}gfPH$+Bn!Q3xc>zSK)uD!%afnA)k*woox5w+az-UiHULcY*Pex4b^OD%FCmSD@ zDC}V`@31;Y6IJ1-D4PPkv|cW0RGvOpf7%&uFR-eH#}+b+nH`EkYcB4clD%+k>}v|S z6rYzGYfq2JUREYVUz1O(%d=!onM<*0p)QHj8}~+vn=Po{Z7aEJRO9YMU%fE(_l^eo zJ$i3*A^PttC;pVVdoFkHlfq{Q;ak=>@`vvi?j6hAd@q0G*LqPilhS+RmejCudP_2a z6DWdMKwR5}Od#Yjk6bw%fglJRz(`>o*BvVwNp~zZ z`N-7S&PM+*lKcJ><80#J79XvB;8;FeICCg}@M!Mjy_Iv>pWm%but?PD4b-ios2KKp z14X@NRE$J6Mz1)_h$j`a`&uO{m+oG=xcD&t=_lDQ&K7Qc|F4;chu1IUfB7wU=chU` zqZc=hDl$3aEIuj~nD)7CvHk{eFp(nq2ybZeQ79S<>%wlsXwuy9<$kz-GlCAeq6uz- zkXkXDis+X3^r@rEa-!Y z8ckjz7@qS6+3*odQ&*vdv*18HIsj6-;E*n< z@P61f+HWZ9-71NwYcAt*$KH{g6kVbttK_80Mvi6n8k}&?uaYAV)b0AVOT-IlZWQXjB0|n00c@ zVrzF0^8_PNjcU?kbM>bbPG~w4Qz%^<@EGKLk3|RNjSV^(%lvR5bNxqaTXBye5_pam znoE1cLrgKEsHLn&#aK8XKeN>&V}ID@5KZ!oIZOn=IK*Mb;bMp!Xt_}cJfR!s$NH^t zLN_zi@e!OSm^L@$3~A6%Xl!D-R2oFFyOZ@ZRO6uZH`U-(5Z& zDtz=q?#$W${afzFU2X2t>tW9e@0)=!yF-~A(6`e^auU)+89Cm-a$e`hvx|I)$_TRKTFLK!Ah=2O&SPWLEG zXM@|7iYiR#I(tTCHZOdfzj7vb`&RDb^X;ay03g_yt*w+0fJl*dv9%V61OPT>C+U1X z!?Kl%#{%IoN7~G1EbtTnie%>=Z@O}NkW8A&d8mv|3wGIZtvm8$j{dgr)54|v$s2F~ z&6NNCdE^36Xj-&JR>-CMZYw1miGd%Y6FD;<>d) z>a{zCpRVZID0t1zX>kcJUGqcQ@+nW|$>;0m{)LX@&z{O$|8?mw&fmVRxG#s@;mUm8 z*-+{v7&JR76Jtm2+^Ry3s$JvCD5UKXZ9j-@2DJ7@)TK8*yp@p4@)A&R zY=AF;W5Z_9(xJpKKRUdj$xbzkx!sZ3rb{t#K<71WY`no12Z<-0O6juY=^;rMTMt`!yyDVA5#^c`@(1EO8DIYdri4(4EjlkgBQ0Wg7KyAuo8DL4>y zAdxzu%VBpifk#YqF~N!LHXu4GR=CYM;O$5IHL7v_hb0K^2gNB679rUzDS0A6$D!k#mF|1sj{fw*k43O4Ezxd!^ z-_G8>yY`Fn=Z4<;JG-P`FZ`z8MD@c;O(MNe8?=sL!)#-hsa0Cbr0i*{S*=#}#Zn`2 zN8Q5_j{xSqvWJZ`aBD-IXwfy9bElL)632vqm9b>2j|cL<9?qYW5~=MCdH=!!SbrjN~5 zmitTSO*t*~K`7(mCY>oV6s>>0HGidaB-SRyxEbXs%*{$8`R?i{ZflH@< zyic(p-BgFARQkmi^oG%JW8YZ3V7@VNPjYa$k2vfjJ_Qm{IM+x++Sr-R{I#SfXX-^W zb+0AvTyZ@akiFfcKUZqL-XFFjZ!Xb3uJ7?}ZkT!*5AlTJNV&Ojdpfeo(Rx8tAf@AX z>9>XZ44rjHGjCF(>hsBh{EKBb`Fxrt^|5`*-Bjl*S;>90)4U-FhM^Amn`B=<3hi2| z)y{U5Q>`DSQ=L|Irl%%B%7}}5cKpo=jl~CgP4ZXUNvb0791#eDyU5@{IfM}}XK`t8 zHlz?R25}n)6v%kYQ%GRT8y9(kA)!>_{;@SrZnhhK+@wf6Ok@u0JMG8K1B@xAtc3%; zx_DbB=KPjagLEP57KlfYrcdu4#ku@4i(Yc1a0$6Jj`($I+hBQTb zDs6O(T)H?m;_=N*P!R>Yivn~2TI;O|%B;>rOX(WrU{D=w=F@OxxvI@rTi zbi?*8C>R0`Vg!l60gADV4_}dEX6dBx?3?WA@3QY+TR5Wo0F*#$zwg|ak7^P?;==+7 z;0fa);}`^_v->Eqakxi82_V7Pc;ivmt7pb^V`}$^&@LeYfj%AzCRwjsKJD8()FhzdlY9u5}dI3A=o~Na% z_Q{LC7&op_b?%w<>Q5QTg}8w1j+;!iwVhvz%XDj3{;hEBqh~)BZvSG;9=bBJe0S}= zwHt+FA7?*$xJ?c=F2LC^b}@u0FLF+oT_6NG9TYo72XRn=+8_^IfVynF17MCrcF`^h z9O5Bjz#(qY!DhckWhPofs)pQbhck_2Miu)O_Gwgoks3mm60LY-)}m33j{6ePl2z-u zZpz)02=5ER#;WVCTD4|j)Z-}&8;aF{&ArB+F9-sUFebZ+D^Ls}#f)!paV!>iKp3Iz z=wTS501Ei`MtgJj9wkcNL>}ZlCoq#5J?U7b|UuX#;4~R ztieq%Zp%Qt>w9XYWc_*VRD0|z)b)YPZJ&B>_^40076BZy7N{; zl`9n;tXr4Uen&VM8Dc$Q>DugsM1eYu)9&F>k8D6?v&8bBxnI6$Jqvwazqfu4j=3<(?&iT*{LNVY-tqjQv;SU~4rU)eZn7UYY_wb1kP(GEfjs2_N2ow?<9=L%g((&o zr91#UCOnp3xUWRzwTZ=5++YQ-7ts!u;OYnci+8x}kta*X>y8F(D7|D-yXVuC9DtxOQpzYl-}9qRMr2x*%A97$DZk;Q~TNFyk5Qb56KaA1?$ z5}An7xzXmEl6&#F4fva41chf4=lC7+m}5+0U{3{o_kdS3k^ue?pgg_nW5q zO@=J-s39<9Of=84aPEpYeqip6dds;=PK7B`ngR$ZKcxoHeJ=W16+HKQ>v5cYyGT0+*8!y8xjRFo(d9 z-N}m(*&uRa&c#Cq!BjwybMS;w8+P%;Zl^9l1pz|FSMOKa{TmnSrb5@RY@7Vbs_URy zwPyFT?HLEM?nQ39;uWSwh!>c^1G;EA(o{q8i?eacTCLxd+Rn?RNOc+BP;|PRQ z7Eb-@_@32et)KKw+Tg5LKj`5bue(ay6z;OqsC?6b`IxA1`BEu@-`1B-yHe?}a*1Tp zuWu;GZird^!|m%XsYE(riTk4ypjjDcn<%_YRDe@12N-GH3`m zO|y;Ph&tDJs(v43fjQS`^W8C?{o#{P{@SlAALM@f-1=tj?jvvZhc7Y*-*HXn9$qVa zd$RqO+33}z=+mTDS<+*5Pxz=->q!M7vy-j&1}H#|@d(QN0$ZSxZtJANmcizAs6QCD zDC`#fp0<01z(dCI7;~-m3JwqsavW?!-^249Cs4SV3wP9*Cp<*a5V=0|- z1*BrIk$GqF;&kDMd%4qhRzF$%vT=V$!A;ds-|I+w`JGVBOwE>j4lpm}X~cezAIRHIt{B6IiMYW^k0)Ie>FY80i5@8mzd zzIbH)#PX5VQ!5v8PtP6*|8MT-$+uTN&R)O&$HJ*QnbYsq^v&|-Ibxl$&We2#{$a!t z&XI=Vb63B}p1ziOd?a)8+vw`u%&pUl$Jfp*oLIS-zwk}r#-se5!&86G96bH(7kM2; zq)Tfe!7=+vF=yDs6B33ham>ac}qwl)8T_ z{sK~gqTn`wyKVzpnQD_>6d%~eSys002;x9^BK(@V4D3*!MpOQQp{}<;*IS_LEwIPD z1&YiKqT22aY#hELl?>Fy_ZzRYyd~7CUcm>jm3AZT5yrQ0jRNhMQCf!j9xX(5s{i@GpTb zQ0#=k0gZ|)k*N;z9)rPEjUo$cRLtS`cPzNHz~oQa1G5^H+f%|1MxCkAK%dqGbWW&I zO-xLV58G!wC5_VT8JLUBjraGlIgM)AH<+3hVj<&hPUT@e)%z#6T?D56drs--j!ZFI zHl7ei`={o$k**5URbjd+%pOx=o?jX1%DH+ux3^TA?)cP?&&%n8UG0|_Pb7*aH7XvI zJVj^wv}9PL;%Dajr=1Z!!`+FwGZVAs<_%G!8oncL-qjZGfQz>S5IYfUPKpH126zDw z4%+~;GsxMogCIe4iCBO(;^HB5+7RQgK%5BJ7;qA5uUuWTIT!CfUqb7SPZ>tTb~mq4 zS%=+$G_8@aSo-z$ag7R#?ixNk9j4Qx#yO1&>U+Gk3p}^OSzI!qI=}Q+0;cZX#lCef z+h0vuy%>~;lk;|eAW?rWtV(`O>38q1e7*YV(pmE#{`c76542(AXuLAET;mzY4bNk0=mjmS{OtB7s|2|J zpS}0)PAs|BhyVAd;3tQ+ea+0NsuS_`>x&Q|G9pUywZ}vOA_)*enrpA_>708y=bT2J zbM9WN5kk`E7}B?RmjsBDIDlH};AyQ{Ynl_P_NlOISM6s%+o&eB>UP!glOJ+xtK5C? zUrRrh&c6OL_Ve@0wM$z~rP&>o9eXP~UYD+KtDL{xqcB1-maj%sFlO#Ii}$vXH#$5>Y6HluA5RwT>YjxIc{?7yMNKV7(Ae)6hv@b&vw#rx^XxgYN#0&tEDXzEIhJsQTn0G52!rZ0YIQ(#w72ZO2{ZgD)4)|L?-d9#u85QW6ICILcZ;W&b(x5HW{htVu<|em&5`5;S1)&r2QWp&^HzrhP4!!f*^75 z@tPYDfJA^HrO4UjBq9JoLaIZs1VS{ykQ9R?IzrB11P)1zVj+;b$MEZf_5ClPyBuV}v!t|zz{?QndWsHQNz?hnG zYdROl3oSrd!-O%?9P(d$3_)uIOyePiEY&2%7xDM^k#uv~^b|@Uno;-t)7stJm9vja z&rdF0^Hv|69?;FTq665Y9|sJEXquuBiD5Y8&?k#UDJ=I_G8qlT0`ZI|x>5*dNRuQ1 zA;ut_CK#H)IMYBbBM1l}PGAH@Fo1--yCg;6Btw%lLD3Y&eYb6f-#)5OXq07>t4%2k zs;GO>Wt}1_HvQUJntitT3AGM^~`Y^3svx`8Nx%7OoVo zhv$BpyHwrrsP7v|p$Ujn1jHze0f?p;F`>=FE#}8|aT}|j)b@NqYTMb^68d9YgSYi{ zfB4_pi@S68O9yu?T&*3vHg}d^u-G0<Xvtfr-c{4o37nI`)khAj+I7TwM6?W_x8^pTD%{vZF{hZ)tjs>U2r01 zpIp5)6$-?i@w6usP6xvtZ#1Bg<*&|Pn0r;*f2Hs!|GaeUb@5j5S>L+!TE9Bdrq||= zlrBHw+!NcB%ViV&dfpYosCQgg6El^I!70sfbfis%`PL0Wd>$uY`oo;T-Imq<6W5%%4By>wh?A-_Whgknd4yLl-rAh!-%4AfH4Fsh?PBz z23AF*`@0S|3AgY2Odt3yV0OGD>X)ncZcWCm#AFL#=~UF!-;wqx_Vp=bqlO`} zepsNkD`b<2ua3mEBdr?lq(*~k2PMs9^ZI?8?E1@0q4xxwnJFf+!}JO$Yk-!n0F(cdT3LOQ0be*6_WepGYgk3~PfWAUz1X9FBtWvB`Bh^YnTOoaY;61*Yy7{dvpBC0 zML!l&xz&PeL@WQ|=gH@Rdv5jPTEZboS`7J2egVkm&oCatu3C33JmA+*O5?=mhDQE! z8{C>Q&{rJMp zwLx!;OjKCr4G zR8nu4LN3>c5aQL63rkKWBKjQ`Q3{@F5E1fpFj0~METSYoOf2ye*{J&9N`SHz8&VW zB?i+8li4F7sc(K;{*t$_XYtrr_1&Af>%~(G?w@BT8Bb z>25WVAuuiS6~Gi8O!1{%Pi(HMPY*~hgV0AiQeUR^{T+(aY;D~hiNffzLbpar0C_*py*{EoS*_y!^iFe;z(?o zWEhNw3^yO^+M&3T2>dSfcp}CB7S5`>`1m)K&1b9UX6I%LFBdi!4$begR}Wk%y|`O? za5$bn;jA6qIrpXqH5${KM6M=$A{RaUaE7L%bSNh5VHVQ++T5-GD%_g8UA=dsvge2Q zFT_h341tuC!4aw+xsa>Acrx(*X7&D!${X&IB{gm3ve>{l@5fZ@Oadk#s*(U=Ac+Bdby1V{gRlXV zpAUfl6XC@hyX#fK+9AcQBLiC3w}URE@absBjAvwgD$RXnJu|UT0O2HoK{k4IqjAhM z&R`gWVG^wG5Th7~F*qlShzO3Eq!@~Z3@(LZh8Tunh=Je>L6(2Sp4eyve+w_pHf1H? z-JWPPF=cIHywz!+C)%JYmjHX0&fhJZgd8hL9MCNW#BLy335uZz43HSc5IEvuD0@k} zg5x+zA&RC*L^3q~pNZ#|3$szkWr?J2ob@xy1oW(*xJz0o6GMDGtdJ!H>XP-^vRM<( zDP)0ucg)D%)Yrd3psMTDXaasc*UD(0NMsdr)}|~|SLMi7CCxgsF3L@hW8Dg?Q}Wja z2X1F&;Seka^E)fowiZtmuP*MYZ8=`KwYhZV)VFI{6(Ghy2ICw8jir*jj3jkEBL@^k z5E#W(=PkIC%sEQ-J1Fyju9IG?gRO=%ZQB! zT!+PjhXyL&yqbtkOAFA?Ui9QNg(#eY3`vqSPIIG}))L1- zW6bh@08tpk7zDY28UW%HwmcCC8qzqy3*!I;g9w^{%bEm3to$-!(HJcxk&G9S(dvVq zg9g~cY!xoeP>?_rU`4}o;L}&p$34o4>glWg<)U&{M0>;J28Qc=2fdg)r_*u~n_L&d{|t(?cj;qR^p??O7RA$`-MysKE+ z%}nDC;#Zu{6*)M1EZnT! zK2SMxeeVAJL-GEeA*S&mIx;;tDAn(O8Tog9_c!|T&C3g03s>iFRgOMg*!Ra?Mx`83 z5Cf2*F(~>~00R_;(=>C5XpUZcw&<$YJ-xH;@E)BIA%3PEOw>~Y_SPWPbtIJuK;6F zfUyX$cy%$=N2e^~9Dm4=b7n9Z<6QEEkUMVHaB#;Bd-F>JAaAI0{6(UWKmH2-*+Y>V zP4ek!hV{g#Lgq1!_yJx&oH42e>Y9H_oI9je!r@tk<1OkBy*g zf0hqRX}Q#R9@p+D2?;YFD#)TFw5AhNT(^1C-Joex^yB}80R!eZiRb&f%2|92{*PHkRq!P@Vt)-LFP&Zbs5 zEVhyFtZJLxVpbZJDwW!9cUTPSE+$29l8f%~)*!pZ;81Q%6AO28YZb56uu7|LeOt5L zHgYYZ>IPIB)RKZ-b64U?Kp+wZKso^HMknNgHfQ2uSv!Ll1|w`hsw8Y7L0DPtu*MNC zN`E_Ub%#7EMZd2<%)QHoFpO7DysN%Ay!yab=F`s&pGF~?p%H_TAFsLPfPxH8(U4Oq zui+UC5(G_BK(hTAn!#|2rlkNCavXz@qybH`8c2lrG#ZYD`Lw54Fzcg*CV(3-K9%rt zG%<>IO?~R~Bt716G@J?Z-KieGpYLDo<5P&$p1&?`UOe;N2=97n*H82JikGXmU(dZ; z+WGUFqj+u470!U^ig2}d@m=9o^`|Yx1CGTl@9$Zo8h`2FZ0+fZ`E$iH^H-}o*-qhJ z@Ok2>yZ;<49j|DI(c?Di!UKZhkbO!^4W{gz(e16j#OiELVgBJ^YtSGlsy~=z?Al1w zJ7(^sv=OyMi3=ejE{#~7RSg(&^6LSQ;=c+gt%~p_Rdfvz)XpX zQ$D?|a`-?O>-5Ta<%}!Aq^f@k3=R!R4{Dl1Bu*o|n=wt(41*yW;o?JD)zK!agFbcE zK~Ge~cp%JPGVEqVD$a~gaKp2ku+Lca-s8Cgl{1In{PRCmUS1E??q6FtTDXQfO)P*I zfB?f_P-14S%yt}-NIEWo#Fr-)q$DQ?K_C+2jEElS)v@86&M!15TVaUU-u||EhAUWreo`Nt$w$OX{IU*?-Z`@A~=0>FUF+rI)h{ zr{3So|L9t{M^^6aD?Phe+J9hi^Y2?BdYKG=fo!m64un$*S=^u*up0GQOQ`L_qI9A0 zh>LYWJ2gSk(GkeHG&Lc$_zbZAt!C%w2#ye~1xEBxFQCdK&Fo0T#!*_tIPROE?Ski1 z({ZCWCwyMzpBU47yn`VV|K8dT;3oT>gM4CwM#hm`AdGAI6apWb55yT|cr%)F{FcpV z!+y@~9*^HF{1DJyPv4pypp6ZflO9ai1C&c|g2QQRj9#ZR&>YfZR+C%(A)lRN_`%&> zeYe`68B0v?babcF3d^W1Yv9Mc)*H>mx4l3vPPVta7B^RJUVZ=CwD{`%t=gftWd8K` zh1;3J-P*R}cKhPK@~($0gDe>EP5Yvp#VwggXY9+$iYusyjn-zBX|6MA2lTtA9lU$> zwI-YO>T+h6(#$`Gt}i$qm4Tl#r@7>mPrfVN*;Cs8u6*)p_0?hh$o$#-meSLUg$seo zmZ#iSj|KuszHI5$B>@pQq#+_HL}3g;F56cevmjv4B$6VHAQ&_vOTSEnS$g@}#Q0#0 zpEFG^8=OpzOn2X~08##&XtPeENotT!c+m_UK?H>uUX-7V)v}xZr~Kr=;_lj`Gu68{ zs?U!7{?}A-&*G87PsQhdU%XkqyeA#m)Jyw99HViJq*rnY0E{GA?OPw&deWuI=>2Fc ztjVlpT}J*117?z3X(?=JNBREK(z~;jT@T8ePt|tsE?s(^nLiO4DV^T=E0)wB9wo;) zGvH2@E;sfIr{`an4<4#)ew?8b^VeExcjcQVlWW^K0g8qgM&Jl^VPujN32BA_q_~lZ zauWenI@q11IWk}b4y%Z%*+=(@R2?7qY@_pqG{0HrUV2|5fCRB z>4PgkQ8bAW3`X^`T_YGo6AXZW1cgv7%|)8Gh<6tiHZv)p`c^Fw7`5WI-b|LmYHvA2cFMgUplTaN6J@b=YOc(+vhFsdGhPx!_-GISH@|+kGZa^ z967TG@`+d)Ybrq@g2FJGpZl|^xDt!|{KXf4GgY>ns-D05^Xu8_o-^eGmrIu}mtGz( z?p-+c^Q-4QEU7pEG=`HTO))eE7~X-Yn}7FB>D}JiiAUv^H+lAiD%Lsy?tIJz z0Kfo*V&_U6nj+S@62ssK$HhE9czV>sUDq22OTmTn)zf>*Kb$Pws_pw};b!ga z;kmtq#}dNP7>NL)NlHXG!!*=DarsD$pb$wwp?rw|7B`uqqT-dezxzX9@kdmC@}hce z*S~)6Qp@|_KdK#{Egd{O4l1wCv5YIpBe9N#2x4fQUS9ONFhl?#D2%}F`Q$p@J!PTV2!AzcCRmkp_!Z`!m+2hfxXYKRPJ6b-+WX)aBpFE{$TNS z>E(&i@ssa=8k4rm#k_Je+N_32CUkaF#=u{9#O?T~Gl?9MX8fjqRUiFCZrbFkoxM^oc8bFOmxc>WSqy|cBr<^6T-;_=q9Tz8iZ1eS*>M+5m+F4b!fXoCYxzhIhb5zAA< zeIqA$*wHU)@`VlKX?4@S-Pm~Q37;<7+~D_=5>G7NSuFIJ3(SyA23OwsYPI+}dtNx0 zHnbM5RwQkC_D11Beoyi4!llxyZKZ7wY>THB4$j@JU7F2r&!2CN3SlNSoWKAg5shIu zy*yh*5~&%+RsAzljzqsHq8A9+UpjMRezzrmfh+0|@5IpOcm5Nicyq$+wSV#jBZA$n93K`Dv@UY8w*?2{Zd5k-h z&P^fCF5ST^TSOW($VIjwZr%)mD#9eIQR>V?%c3uRp&HLw9fIJx^#Ak=`O^R)<&Jac2S-#Zx>OX zPCYdm?G)(gSfNqv5a|i1RL4+H%Zho=jrEMvlZokBflG8u<5 z8(HUg&;Q5}zzx<(9~1~31R^I`V=yxCQ=!L^6R(} zi}R~c>cKOidZ{~ljzWibF)#CPrZPf!eCw!%!j^?-LudP#ED3{W^j2fc*f69hp-dVJ7N(H@@70}Rc;AVWhhgLxYzfBfVm zoB{M{Q{k;jAc`ay9D}^Wq_y$0bI&*&fmAHbVF&&MDH}Q^8}LNDD!yl5E*rs2 zwy~s|50+R@s&M6`N17@;{~|d5CVzHl?%Cqa+U6gZ4(GSeT@iUhidmZvv{|hk*r7Sd z_a|`cukL(V`SDq1{y=U2)#Sg*uO9uga_f5jRPk;3)bZlhrGpDk+O>{IGviu^T{+5k zf^Z1B%ytSP@j=RvG^9zu0mAl}hGOj<6`0N-ht)n}?RO9G!<@J+7AS4m^1JHMZIx4x zzA2oZKiT6@45%rqk{%FT_Zd9V@vN6$S~%UQK%0 zF-H@O5$9b};Ujv2>hhE5oNXK<<73mj>+Zm)1@f*@8LvZQX#csXcrw#;_I`U&(D(!Z+#m1hpYYj;iIg=5YLM^jfOeU+%;;{5PHQ#A-FcAZM;bPTS) zlpW5bdX{^oEtPJ&$!^doP2aJPJl3&U#ZSe07S>_3f2UGvbVjvR=@{gTC?1mbE&B{h zs$8|rvG$S!sZ6^DRt>66N}F1%vpZ}fAMy#JM}9rjy4DYDbB@@3%?9!Dz#FjvN+AX4(o0Yk=qIL z`H*->wb>`9!RRR5=R$%ZDd?xBzz`SCrXH{=%>&BslmjN6S!va+r^1u)KzxvhYg+r- z`Z&6+u=iz8!f(PhPunq(gxHKrk|ZGkqlsYL(+TCUW%X_Ylp9uQ?7FGxflNaCE$Jc^ zPufaM7rk?sk=+KWqeI> z)m4fs*5hIr#G%m%Q%w(|ScrPYU@+-yU9*Y&BFHu5 zQp!s08tqnFnR49ou{O+fotc-EZHj42yEHkG({(FlyTUm#Hk7R0*;G4vSQZ7=ob? zhI2!^o6T0+v7>tWKHgE$KWkTBE!=KfY+qmdLTktG=t@UUd{er2xw`-6 z((K}ypWohDc=CH%dNFAeXc~8>ja_T|Uh*oo4-0L_+a!37lVgemBuzj95fnqvG$-v- zJ0QF!GAi{hPuPg zuh!}EjZZ0L;b8wLlWd;Ji$LnhNUrJc+7Lv23-&4Ngs7j}Upl^h;bH0Vwfw#BE7wou z_vGKHYMWn`UmpK!?JO$^=*n(xMBj2xvvN8gY(d>cK;wu;G>IsTA}EC83_%G&Y& z1qK}IaUc+|x_fW&S^3$S>b1@PSA6}u%7u$_mrFbM>#L8>F5WNf=gK!Wmb24F5fN+0 z&zE*xEgY1RQw|}{0D>Sf0;4DbBau+h81e}u+*I7Pc8#wp7n-CFd^& zQ<>_!ZA&|cN_+3jJ+-jwl6gVJyOm4NJ!$o2vm@gnU;xoj>(k9*5I*!76 zq2^I4#QZ{oA2zT-zb3Z&#EGqhkF8If!^g;H#d=vR#({rZG{B)G`tJDVS zrC($~$;VzeKl_YQjRyJj8Kt6QVVzPTn_T%ZWuO%@eaap*41OI!{IC*A7*Vt#Q6-Hp z#E(VHgtg_y`{n^!WW=AHf6y42fuO(Bq?mc+gJ~0C}kZ zWQYI?`h1Y~VnKh<b)ACw}B;vf7%-QxW>^2Ptbdm87 zY286DABxje2KwQ1nMkmO>z!A_xMP06xeWL_rb)4wsjRHx2_hLjoX8V@?8`q;LRe z;Q{Dpn7u|07(`+ONiy)`b%`8efB}%i7zrLwIUpI5!Z3nBlD&c$8j*mZD5*{XG)|Hf zJN-e+waAX^Sd+_;m!_qCUK)Rj&;2KtRra1Qzq?yHb-s3Odu8jj!GD!soQeI#`Cp~| zM~b)e_ewurq4TFXUEcCXcAp=H<9w3i6u>A7LWE&}CP{+rDEW`Uy6}p2YS=obej}Ag zdd3=^IQJ@DcwWB$L-A1U@ZQ?pi*qkZhaZ)nzy2ngHO#v7}!bwXIpvhIlC1Yl@_QvUcTM>B^qp7Jsl-w{Bnjp?I+R^m*m@ zv+|KGwHJp63U8{1uGKEztX+CJQ{LO6dag5EO~RHFy5$NiJS@&?9K{pGqYD?7t}WbO zI8Z#0s2q5mKie9^4X@;+P@FSw3opudPA=}8-&sC+(=xYj{>Q}wwVO8!$N!SwSH5rOe{4-RtK_>+Zm1og8T^m3`ihv~}J?_vS>~DA(9ZyDOH> zh#q}oE80Wo8-v&v;2T?M163MxWEC>2d904|&v>RnquL0rkWEka57ljsoIk3NMZ6=< zs8jd39qG)>#FRE>9S3B+*g;d$_X~BWZBUC^V$@f6+NXA>4To%Fw4+OxTB4uMdDCB- zTP^KThr4jBWhPe8Q(s+cU!-eo19j9d(zUjM?fF5jH3YixtU-F+U2CfiQlFiDeV@Rq zhDDVMnRPTf6*Q#6^;S_jV+xs}PBUQW*QE3+g)B7gU!fHGI-oe7Hnc*;`4L=gtDo9E zeOvB#=JM0Kb5Hf}?<^i$Cnp@FX%O@VupsVX{8$hM0p<64y#WFcK8*I`q~A~aaS!Q- zJ{tESoQ6II_xJ*IAV7LCrU{|`_)a+1P+1#U+xilx@y;B1L^kq{%t#FiA`e6nuaz3r`7rOfmBwE2KecOTe#jTQOM}O?0NiiWaoLn|xX!BhO zp9n7*3x|L8Uh#D0@QLz+JLMbq|9k%G{GsYk#|kg2J6@EpY_A-=yzm0m?*7<=cw>ap z0|sLvcZ>#eb~u%>h)c@PQ^PqTJfN=}y-|C1qz5^&`k|qS(UzLf@tbCaIVv3yxk{@0 z(|jtXE;<)Wgn++aH73>0yN^!HzboH=^0)t17oIPi4W&!77nY7zPMs;9vV5C=w)*NP zU_q27#ggV23uisT)QU9Vhce1#V}pK-PbtWWTZnSg9j(%l(G-L<2H<+pk$oTq*i>Ad za!`7&k#}92GYp0C0m~Smcy}BbhkfK%-8ATOPx0TLQQK17G_#ymqq5@?Uni!gIxh;D zggebouEie9a$RlPlZ6N074Gz+7F?$XKxixB`Rm0{^L*IIxDxg&prQ*c(GCII1x!ol)SLNaC%x-dG_ev z`4hEkuggE3?d5xCR3cZC+G(vSz=&yZb5H6a?<&chdd0c{!&KOW~)LJ|f{Rth|4)aO&S8Pe}2vDj}87#ArTMT8Cb*vtoD+)qHZtf^k|5Mh)puyK_QGW_=VZJ;92F6fGdOgfS>7bFDAh<^iog1H`GyPzSzY**TNrw~J&xSp(eo!MO z%4fs_*HOq8)tXgpvs=tcqf(_(+wJSix+dj?=~3=a&R*9+w9kdRjxDAH%+qC6jZVhL zhE?BUIZ|OAHpFdH+-KNW&$(^YZI>2Xrh89lPehY|CJ4Z$quFSFD+0rC9MOoqGvXl& zA;3wTMi~13pvCv8Y3XiA>av+B!T%0K64 zIisgNjZHF@@U0*|6|(Bl1I4qY!*3QY*KVAy9iN4zJ-02T?Uxt!6_4eA_;cmj)q%>M zi>!CoLV<%*h-M(h&;)=4AQ*0r>|X>C8?WeueUR1(#mtxh&Y2Yrj43DaJ*$|2pa?)l zqGL%Mib7RaixF;lCZoxiGsl+JF4)tsZlcHt+e%Bh96>f^?x;UC!30dBA?Y0uPB1M;31Ms;pTi$N;H zPub9wO-% zBn}V;*)yUopB{t&(Fjt!UTx6nO)>+zPAjz>kQf6Ipco0u2~af70EAJ}iPGhOVF*AF zI3vj!N|6XcK(aXS8qU+?cu=d&4Y<0tp5!E=aE7D^e$suNRUsRW*}}#U??xjVKcGp1 zL^v(9zVIn`)X1nQQ41{pxN`E)`%80giks*5M5-sw)b?I77EV+SUMO8UvnJaNAcRAT zBoWg^cM}xJ&;-e$1!Q&ilp)a3E<+f`AcBzSYdN4Xh9MaOla7iaF`7ao%~@guT@3+) z5MWqit9zbUTByxj;Sr41OegFik(=&G6zYyWmNb)ocU)M4YE-543omCiw9Z10>3J-J z8BZ!Rne3vEaSSm81~_S^+s#EB0!WYuO3XzDry&j)C_NV$geZc97<*i?C##B4CS6h8~Z2qmFE}eG3KSGMxffNBIgx4DZODSOXPqo%|HZ7yk?#x7*25Kj2 z#!=qysRvqn{e)$_HFrcv3JbgD z_iidaEA6{GH=C-wd{ub3Dsx+xUR%dhJdKRG08+>TZrzwoC@l>cglNb*@ri}w1BsX? z9A7zqA_1ZR!7|pcQsZ`2O#E#JIWd;T(i?)}s6$1CR_me2039GLy}!VY)o#JS1Z z+sp6oh_^@};dD7wi7BZzDLuHMEWdi}sy^C0cldv5+xORY9j`vypQxSOQ@gZ-)u)Zm zT3&Mq07-yJQ%x4{E}i`O&85&kmQKAFRGQP`h=j^z>l$ z;pP<-posJyi$)V1uv(?0kC!%IYTWN7UXFbPx_;4ety1NpJ9FXN4Fsnt;a|2S8KOe(K%pf@DG=y2ny|69iNq6vFCd<=(BeS0=BTz!r`K^v*UQYfKes5tUrNhcL$>j+0f(PD;P5Md=hq;^ zbq_N9MX9ijk4IdQ$Yi&qfkGB_N1Vhotx1{cn=+qQMKb+ayWfMzNkXrX4UaR%P<@A) zjBC`xIfX1{!iU_%*WMHBy$_0hgj9WhDINU?D75b3kM;JbD~(JtGdPKcIu688(jyZ2 zIGIVLeJiI<-)3QBKn^BS;hAN_J8Dh%m5nC?sjr%#gE7+>HZf1mwi@P$ubiI50-03U z*BDEy-pl3zTzwy&TxH%_89c4+u_qfydBy_HOgI{zX`GD$#LBd@G7MO^f7QBbYt$uC zaV!u^q^5hRn{_$pcBidh&+gWJ8M!o4~zwppJXVAi}_&vv<4_pXHPbiZ5AB_qU`-|pyY&km=D(#n9> zq}P4G-hDKu8FG$)jQ#t#$1J^przV|aqq>fpc&gJbK1C0Z(f_QC{C|R4`$h5vef+ie zvrop+Xp&E#jAKBrkWGCZFhWM46)@RHAOvcB>na^keg3Wo$4?Li{E!Jy9)vK4hB$%y z=^*q`Sb!l(56)l|fd_n~kHLICNRlWR3}6HuBxrvCAQ)T?Wh zJ$QdshlDii&u2*6(SgcBl%1#B`0s9F=3POHW>|2O9W?*#!a3Xc;uBcDv8}L62M*>Pls6j#PAqW$fo;IyHOxAWWbmMIr!8T95fJ5#MO{~l7R$bAjPbGkgt6(_L;>R zuGKB&`={q;YiG_ZZmGR^Q#et*bA91ik6mN5>%;tTl-2q}{sAE$2#0KBwszu1Y4%v< z!140_m-(mK;=`%xm0gunKPn4nDo5Yc_V4)cq0(VIpom`~i;bH5g$!RZ*|19?Gv>m^ z5T7%m3q9kTOeK8$_vEt4OcL15W`4+vT&Cj_q^zf2QcCti?bY7encJ0Z`|~HO_xDy$ z?O420c>1S)RQ};bkL@20S;gn-l!c!}XjL{wNI}LHZfVaS7WRx4Pn7nb`L5T_U0xuK z&>WmG@H=ApFX?qgNTWhF#YPwO?4 zTipHgiKI0Aa z3ylGe+P`{4w{*=GE*|Pp*lci&&`c$8A#2_8T_Imphsg=1jSh3#=(kK645@yF3{2Z} zM&A^z;d3)`#@d7zA0;D3yHjg$iVitBjUz~q3}iz|*N;4{?X(m5Ms3bR4%t$cQH9Ly z6|OJQ!J!$2NV`p^ETmy7G>{um$odHGiY86eHmsXW2B#Tjl;G;Sjtp;ZYhp4vndDu~ zS-JD3J%3h|_ZwIM=L*+YqWgMm;LiMQDwj)&9* zm2SJqZqO-B-?7~U>)5p74yHAT>oD5CQz-xv#q4n-S?~HQi8ijyo`&%! zA{LVtM{BWYjp_{|7i;UYT)UtxJ}kT1=F+LuN|nmuH1|5VyY?Sfd_WDr-FP7L zt=2Q6@PxeFTO3lGo$$}){m6)%?#UmJb@uyp6pce=0YsBL}S1$&H; zR)T#%w83<45;>GPWF#VNdaSzw28myBoBwmol#Fni1~>*kVuM2rF(i%Qq*V5504bbi zh>jF`0MaX*9wZ^r84N?n&AcU)F`b(APSJ)VDB*}tRo>XKPXHUJ=8{!Cm%xD2fhp=ojX z5KZDZL(q&sJX6l$H;W2adhvAeLT%f-#g{+7IU3Vcj_fS{SiC)d@c;ea(yi**)7hEY zf!k8DBAg;IK+$5djz>l1gaCtppeP_@V{;9M?AlRrK`*{A&YxfY%%3;6&=*#PCT z(G>5(gfYNRwUX#yEif1Z0Yh^pyTl|l8iGSQ=b%?)rYf~K9-bDPs({8ZjKXjXh|bmW zgJYE+c9{PTj0=wjO3zN1new(foo22a5jaLL1c6IVT|@(jQHbndau67z7=Uro-0D0dJ?rZVdg|h<-N86S) z*1iOLb?=kHzF(KNKVR79DxAd2*S3})ZZ@C}<`J)y+QXBR^XJ~bD?NBpzHy-VsxB17_^XKQzl=j^G4Hb3Mc-w zI4dh1+wr>(GYzFUhiM8x3NbXr5C{+yA;mc?T27r~OHR?tlNw_f8Uqw0*wlFKhyc6f z`@~5ck|ZREE*Euuu-~7txou)=d(N1cCdUTT4vV%6s}Yr{a8MHTUPsVS13PAw+1_#6VI!e_Gwq` zOi@=EqY}yTGJz&1hJ9+i)6TyqJfP~4D%fr&Lo*g;M$7lQc10Gf4-G+Qm}i7`I3Vj6 zKdjT}Lw4LA<-7CS5d}+}=CHHzNuK1Ws6^PKw@+qi?X+u*Ywas!G4Eh_CKWQrQWE=s zD=$mu-^@R&UbxuV=I?TUSBQaMS}G|n(IgA)K- z-cCpnk;=ic0>zi*;cWp}>rm$n06+*JisF#AH4WG7NYZWyl4ib9+kBUS7)G%PjaS)( zfl6m{Oo@#2L)EM8jNDIpY2EpJL_&ibS9`{vY}*DWMcJ;%%^2*7ebu9!IZJ)RrUCR;`W7ml_Qr5 zPYSn-hyV8vb35i{|5dqmXnudkc}8LcMUXTuG0yqBkRxoo(b(^Ohq*Azd9vfstO%>8Ny$Ze+!iFf2Wc_k#34@Nm ze5S_69mA@bQ2WKRa^ZOKNp0u#K(uyw&p*~}{e%F}fM7VR?d{IdXbNBeB7%3C)jUVD zQJs`UT_c#C;Xph+GKQr^>gb#96St%fKdU{zmOmDmPLM?5ZguAYkbhR%|Gai)$NaYP zyB`W?Y@Jkt9N+|oFYob*_PT+95D+-iDWMSq0Rw5oIg{(48z=$*hyfBYI0b1big)?4 z5+f-Rr%2xFt3jh4Ys%ik5{yHFz)6}SMV7nC34}%3EWb2`lOzT(D3}BN0o*3K){T`e z->n{b6kWPnd2*t5=xKYgAjVJ>1}TmLZc5c}7;#3@qGCY|hZuts9G>>NRMU|_SbPP( zvv_9QSlBhc_c#A2AKqF#Qn=zTye(ZkKXQqU!9Y#?YMlwiD%7J87Tth$x(< zgfiMW8An?pmQVbsvCZ!(-JjJgoSWa>tvS$na+3gu3?wnKyHy-`)lrct*&j3;-J=7d z(=vZ4=*k~0y?$Q3{}>duEnQGMe_h>k?yn1POV75wf7NM9QaH^(2qmcbGYvbo%SZ_z9M0%|9ffLm;Z>E2p-&1|L zKY!@Ae<{8BX<-jX=-!W}Ai2CPqH#nsID-?k$k9~u@M+n;Wgrc3j36LnKiJN$8SlcP zDWBL;eSM_7>*dmA!{W}=K>mD3t3}eQsvNM-xI&a3`p0pBK5;7}K9L4%?;0FYxyItc z8+GsCbT(zi>}GK}LOS-oSm-G26M8OlGg_0F5M#*JP6XtlM9r(2{$@_8PN@-8!Dx4k}& zkNH|ZHhON!%`)^6ug%H3He}8Od6zsNi}$S|<>yWLzRm;=>q+>|)(Jd~Ak+sN#SGWz zL^3n7fKGdG3^-~R(ZeDw11^(|4P%| zGfn$CF@HM@xY1$KD`eWn@rBFb&naYeUwJs7kZH`xB;EfDQb!*|KnCdgX@@lb7!KB- zw7c0N^+7Z|Lk2%C``9nW2IxFUTBKue1@`q3SjU>5x=K4%A9E{Xp?2W);;!nu9l7fH zJwLy?w@z$i6b=y{U}#S;K;aA>^b&qg5CjqF@j*XDdwf2G7@Wj|41rM?^3pyGFf;>$ z3=O>u*7Q*J#zr@;3$NIP62H zSXN#RtO(4DhF@i&05pXY1O;fa*H;0JBb?>|io1Lh(hNi51j9RlTpRTT_Y}ktNX62; zAbK_f99t*}4xA5R;%Lu5;dFTMEEliC>*vim27kT+=O`sg}RH&ECJ?@H1a8slFxhM?ekxU;9}1S)BohNP=z``%#+nMGn;A7^y@dcl05FInb~ca=k0AsULqeJ&ffS05 zpa6ye21$D?<$xd%gCm-g!(0djU=U7W5CA?9uh+=V`i_EI#<~Y~;sC=KKzzigPWcK> z5HeEf_W^}dfWT?#uv(g=a7a;5D!g_j&I-{4L32VZHY%pGr^tiC9o~gaeT8$?dnXFJ zl*N;!!`C%SC+1%k?nD>f@?#4MR}9=y(Dc#Ho#5C^YY7!V7z7l9AkAPTO-h9dh()8; zJyHZZ#dpwtC!9^D?dEqE&ue|{%@964+ebGz9>g~Bopb3J+r)z<_t#> zXiG8`uxI$8GopH>iDc1u`25FpjRSm9FQ0|98OZ?|jK&~?xYklS8VDr$m84stnIujT zBncr!0R$k4t%-Jk1SF1=6sKwloK7e+9!pq66lzv0qD7PAxY;QlfEud4IEGJFx4-VV z?jeRj3_&oG=yiZ0hy#q2hSkaeNs*8wFhUY<12D+oIF9&?1}HM&?0V6oDGZ}&2*uEE zZj`b0^RBN#xCn$H3Ky=J@fp$evT*PHtxRq9a_Q!d%J%b%7v>IBo<8y~JlBKyQtm&&31c3E}T(|`V^cJ;_#r}A40XWl!{fJ*H}j76hV`afjD9S1Qepy7;*<`g1{+?q-cgjh~O-w?LzKEaD|9~ zkY1kYtjF46h5>*C4j>J9Q2!=q7{dpsjy4{^08LRejZ4JB5hPC1Bo3sN4%^ddQpfr+q7vD6$R;9^XHZh5t{@uy0Z@Zuv<(> zrN=d(o+KyQNtt%VGMKoa6WFlbMWvvmoV8o8mM$^h=Xd5Gr{u*U@@kI6Qwermil|9ER z51z$~k6E!@EPW1W3IGTpWGEU#*z&HK`&=7k&Qj$hK~M~{Y<@C0Mj}q2QF=P<%S6+{ zvqt@h$L;YN{UXO_xs+jO#yKQ-B^>usK=?Qd@7a7ZYBr5V#uGVU5Q|15?ZWOfduw38FP~+1{B|CHmtd=iI@2{DCRxSGg&R}h zyA9{3Dd7(+n;>+XVl%qYp};uJD>Qz&5-px$5qgOi|A4>(& zX`xFy9>_G5<~QSX-3i?EZ|mysNJAx3DcYxyxmAqg7v$((1!2}(h^2p1$mRdlvet?Q z8i<34XJ z@Olrn&m*_3`%QLX zX`OBsAg?bpiD;m|ai=-T)f{iL$xTi>CODUTF7-?*;nA=GG;*2F3>bqyp5i=e4{)AY z`R5mt&UJ&v$S*RH>&KjL-6ALv=q7_JT#3|NUj*e!Yt$igliA7Sgo+HQ@sG9cyOR^2 z_p-mPV`V)9fRYTMozcXQ-nxP2fjc>&K%m#y9+;&WQTu@SY9Fj+44OjguCE3O$AD64 zbovL@8rbt6xGro!J3A9!XlCz~w)pgUy{QqiLgtRx{BcL!kFUqnV+xrkIxzlq^so^3 z2p1X#8-loB`N|K^^6ecQo(U>saZA{i&Z>u7tmB^t;C?-D^o{YbHW2;#Ld!X~<$R30 zygpJ^u&?cs0P6kYyc_JaeVaCIDqY`OxK;k~<2 zY^tB1|FW55S3jM#`i03cTM`WQ7Y~*XZm(T?@xSHUSLc5Ebq_Tgl=v_$nnPDP9gpyn zNH#>$nKK^MSU+Q*oRVsozFwLj?I4DfPOr`&);*mQHTHvWRx>S3u-X!5?!iEH&%UME z{Jy12Wa->ZXD1%(H?{xHKDkV&lI|R!{iwl)tezd`}fMyHZ(9OE^`D(i2IN4 zhe}7UmY?1ce^+Cg8nLNxi2}+u_U5+?&OiJ^@kL>O58s#(=AxC$h$%dy7r8!WR+(dj zo-aq|IhE9@&n0) z)l-v6k9&%nVZ431** zb(qUP&CPV%$C(Bj5E3OV;>5u8v?i$;i(~v7N*mP7(0Xrpf=SG97v_!`U)zTanGFF~ zHXMQNTZFP$)gy$-)C6RFiE%?lol0%Cvx95a8Xkh2p%MPlU9ZEE$i>OYKzgEojAl#2 z=aOFaLARlfR&%4s+J_f4NvYFboE;S<$xBUm6Lzb!wcIpLZ^ks1sX<-h+l+sL(dtuU z3f>dz8HxgM3Sl^jIN-C5PG?0y9K$du!DT52Bn>Hy0-T3L5V;V;C>$Y*k|KzQ7{mdf zF|75_+9FXtPL44^5I7((#C*g)krU(!^&BmgVhoZb!WjaSjz*E=kR~VqNGYOFKw}8v zB*Ab<3Acg-s-b0<-_*`^+q(= zshQ5TvVeGcD={@@MZ#NkAfCSM;xH3o{TL+%1gf8Pdngzm#K+iKS^Gh*!?J)6^H&6g ztbeNWD$z|?q}4w$g=wOQZ?@KJ&LYE@SL>fi8(G2k^}jY5AD91vZNf;|=V4~&Xe40f z$C0kQS?>*I(B|OAu=W_G%C}^@icw96#&hvVOa%p<0K>vg7|nUtrx*B}=!REq#y~p5 zmY&;I8`n&X@;9QargeWvvr_tjkz{;Omo%-VeX|*8^ICheWv2Q2^G47Jnd^r`-HpmM z*f%biiz&x~Q~hz!#?ax7`&Bz9;O^GUF=x6dy0fgh=%iu5Iw2yAnRJE%-HPMLn#oa= zVSj&l+rG+<7h~m{@8%Czj@@25RlRoWPu2mJ@zrC*m|!4^ zWJg$To+({$(i-+~8&f*Siv*BnD2ApXj>DBaMHtTl!n%)0k~0*60f>-TpikVKG(g_< z#%upSd+)v6Msl?e|L?09>u0~~^=o*iC-pRJzcz?WfB=XrVI$1w= z%~3vYmpdEBZk7%ujg|K=jEg(IUO2I|t$t%${q3ps8Jh^w5a58rbkY?@A5n-x1W&QG z@?mV2Nk>0}wHZapj1prZ8i<&(Dm`Txoiy^c#Af3zA~V4~_iQHvj#Q35)Rf*|-j6XOR(YQ7H$sh%7O)Yb4Exv~708M@Q(K=mPudFZF8=8#iZbZ_mwdqw1%2mX6@Ht4Avb zZr1j{tX??ED!%Hs=9WEmmL&)R?*VrpVODy8=3LZ>d6+oC0+t|#;INQDL?Hwi76*uB z8Jz6B=m;DwZ$3nCO1WVZ;dJJyLa$0~j`*#MXDYk)FKwSc@~i(hceu9qIa}Ype{P4n zyrXowa{YAu#`E9SuC3j54B*7--Ij#0(~J~)o5k5bE}r>w_1(_ujYs9nKfF8%8~e{N zGQk#=oH53nc?V~N+P>wqGNcebXnK~OQJc7IIx3WP_7qJ7qkYO?aEj=U?tbqy9*K%P zXv!A#<&@&WDG9ZuV8wfiS2|z6`KIyom_SIc+3!n<_EeskB1hb*u6)}j+~+ckuaUQP zX2d1rvQ*m&7P{%F(O^NX^M(SQ&K)P|$(v4SlBUTquy(E};=(I*q&*xXqMhD_&}mP* zh5n+-m{-Fz70C!{Pl+U0S=mTIr%>4VPuAyRZsI#-t%k!1z9aXMp1n1nv>;=ce{0g= zf0`$`T6{($Fgiq~r=PA;BGt>1^@U$OLr*Z@xcy<&4`B(;-T<%rch z&c7ILZjf$`H9wLtn)r9`tB@4MJ&RZWzw(3Hon!y>Eu0#{O(R*HfHcVMc`rp5|fEBjW|;vfXmhtNs~gRz+56cM#?it)IIrY?f#D1 z;p_h>-TTe_?dr}`OGj(lAM}upWguV(C<<>8XQzGXSQm~WoF;IV;qp?qjv3?*N>sMR zw?Di*U%R(QTernaCzZ#df{Jj3+t)+hAh^0d>2&IG&CmE6?#JoGZ$>tgD;@`0> z0ZEc;pEQN^$!uQn+k$j`_su`gzo_j$6RB-ETs`-q_`JH~Rq^_IjDERJs3u&DT@4t6 z(cIG?sNTI&JW$%caOQt1Z_cRZ_Et6@TbQjpxU0|BZrsmR_uu?DSK*^zqKePTr2ZY4!Hj`s+)h zmA!W>7mmyy{AKw%r>YpmwfFBt@oxF@zryp!Yx{Q2UHjJ`c@?T>uT)Q;D{ZgcJM!j?Z-Ju5}HLciwM9l6oku*XJGt| zk7BY0G$0T`aqr8zxjhn^rb$TBP~7W5y77MA1)v~7;3On^Twei_fg}R}2Nzb%p{JJh z%d*EfxOYL2EP>O@TAT$mivzN^b3ri#0xZS$bS}C%5lWaHlMmoU_$%9HD?2YQ9V#6j z##88XCzYPNP(Ap(diCxf^#4~nUfFeT;Y?`MZHlnu-$o$&k2|bfKq|7%Jt#R>U z<@O%$(nW#DI_)Iw8_KbetBuL5FVyWrV!6NwK~CEV-K3~BuPqo?K|6)kd@wO>?V#%u zwZVhAFg-3bti2IJ1r>#98Q)Axz@#;9HL->shT6F!mACKv*keOuo7t5kHhzR@T)@HJ zDsO5A5<-%p5leJ2x+*tMG*0bpTzdbH%J!#odrFTQd#`th-HTzA=Ua%L?hwJAT22BO z5-VoCsxNPt)h zArU!qnzX{N6~Cqd6hR_H&`5YEVRvgprPNi5-GdH`p~kv!x&` z&ljenJ#FjxC&deu%XccL_vz~oF8-mu{mCzjvxC^vy-w8EgKa7SIHVv!0R~VMVv(3p z*gQIC37V!5qyeBHLJ$rDyEY)hD}V%vSP0+%niC*^a2gPR7T25{n?*e43@2~`0g7YP z@e~$C<1B*{Y#$spM3M;hxw2sxnne@|d*i5ev+%~`6X^jAyoDEY`=$R|xpHgnmA3xm zfVq6Gvj4uTe8p1Tc08gjuLaZ#LDM=75JHb&8y>A6No7C=PbDD7Od zB%&w=kqm+?&EP8p&)j% zKpH`M?Q_KNusC_A7!MX}bpm+2UXLp!#VWVAuQt`px*1oXscd%5J6a1wcP_r0yViKL zcJ;CL=8l^lil#`K#TkMD1c7t{PFF6UtlT{?x3}@#{>4*;`o3Gmm(|S=dddxO zc6qwsI8D=#BuQE*w^Np1?b3~JDJMy$%*j+FlVcnh4F_hqRIIY$u# z=jy6Ws8=$3a)@nd67Z`$=7n;0Op*8BmB8XwcAI_&*#p~J#IXECAto1h!}#PI+FcAGh=6WSa3`<)m&`Uy3ufI zr)1t>L5iuvF_}yJy@CXFzgHCun|XygyVmV60l??VBo*9&;v}-$MtXec`n1ak)LZ;L zCO~;lW9#+G)$`>SptAMV+=cq(Cx0qGZtQvbGx0tXLj>3q-PC6Y2G90q*)d*;SF0Sg zd9tb=tfB4vya5pLniaoT-hU?p<4=K=5s;9eXdEz~Gwm7y5 zL&^vl8c_g|y+{B7fD{36*kOYFs1xBChQUb$ITq6=9udSMM1Y_w6ZAi^ODI`5o@CS~j%Lnju}R(?O(_$t3-2?9|7K%AlxWC&_t_QWrnk8fkVWLEI5SZpdcspJecpTCgz zo|%GiY*HQ;yh#&@B+)Q0a!)##v?*s6yoqB?^_QokvM^Yx{^HQmEvm8ohDA}^`o4T_ z@r>U#V1pL9zTlLN+3aLa__&o?QBY;YrE*QOww{7HE3bCf9`5>6ea}6eK%n8WKhm^! zs+)vXb3W2Gg#UdwhJ3!PT#8xNEc}EvYmLdBBT_778yRbxv?Ax}qfu?!O&f%Lh(;97 z5;#s#0H@jhH=SS2@0|dR2m6)STGALNI)PKZlfv6%DaRioIlaOF}|0g=Q z?SwQxU;V#{r5&{=C#xs!7I#-~-JgG4dR}|Id2Jv#wx-(})p^zywg|b;SAQ~=t~PGn zFJ7-5I@*5AFxQT)6TZ$O@ry^E67Iv*!->c1r0UVpe`>jWX!x5 zZ`w5ITgh%OHOYywB;>tU@6k@l_*6y!GR90$!7Ft#hWMD;I}rnhFGnw=_omWP%oI$- zbjqe>Hj|kiHP|f$vlJVR$MP=xzlYwPOQJh9kxLdxh*1+YuWE%vMC~qY*9!pF9_Uhc zb?OX9TEtnzSRc|Nj_c60+a2-bHBes?izEBIpyPF5!rpC z)-NQ~WX5aFYD7e$R<_F)!CtdhS8wpWGm6$+sypyR79DAO(Fc*7^7+ZWo`X8 zmCgB5$$;SZVIQ3g=-n}~TYC5t;0#z*J}CzcnijR$PA4a&n0_)d_;vg^zPc?~sp*JJ z6_8?4uh!YRXZcLZ%#TbPsK;7xhO``c$uD&czapqQfEz7o6CG4ZF`0QpDIaYfGtOw; zQmh3$oi*vSts(eNA29~_)6vjJa@xRV4rlNCdJ2*oeq-P4k>&-fn()o^4>9{>_RX?d zm`*wEVSDo=JrBn8NE7i%F*oB!|D9>=nbzH`(FWaa@{3R|t}cSX_S^P+$JS4}*s+VQ z9h-MldnLX=O5$`R11?88<(I@A$z(Q`a7!`A z*lOLRBN>)BvPnrK8IlAX5lM4^Bu%mcmtm9&oBZ6`Yws~yQG{B1=<<6a4oSk}3nWvC zd`CTMBJb4t16mue?rPOkI4N;Cq?l^Lo^j}DjfGSwd)DGI^3()$~U;yq;I!^ z`*E3zkz2SAR$du5M5wf8Vl2vewif;oj`;%7<$m?2os!r}x4OasPc+r)x8<4OR7b*! zNI1!_9`_`Yv8W>~aje`8Nm5PEBafR@fLyB_i}}JHiErg3QqtO|ByGp0d0LzmR2LN` ztjr{QImc?eE=j?c%>-!fQ_G*BXn3QVxC4g+z-H2cutc%4RP8u){ z7mhQygJxVTbUK}0x0@iK6EZZ-K(B*kD9Y>fc%T<=Uon0Du(CbbkZDAz9W zlUhSi0SXqK6!YXlGM8Pq7Vnf-OIxSQy(7N6P-T5udZupSl_>95yQNrY(mJIR#v(qMw`+9BZsMCUJ)M?;y!52tj6Mgj2@3GWHc1T}m6} z1gm{iFDAndgA_w@K4c$;jY%%E>&A!5-ZEJ zO{Wc;MtH^cg4G(Cw8vB~-h=F<-iI=Qm{XbUGiJl|(%5uPilqg`hC)h}pCF}}GE<0* z7WCt;9s#)leR9Y#>mQNpCM^P?*5YyJ9#@|pTsm4kbG~|S=fcCr?uU&d`x-BgRWCl9 zdsW}P#p_`yCU{K`f<;GE&PTLd`5-rI4vH zGL=sDtwmm5AoTG_~ zyk;qjNo6t{t;P|X>RYwe`t69!qLs^RR?WuC+2UKomKW} zx>$I5vR?7lI#y=VZftLMyTMtHs9J^m6ZNFvrfMkh%u0nxW>Cn!l_|!w2AN5_k*d4L z-PT76xvqV@>lNC74GzDNcE4vE^c#n_8hYFUcKUh4k|Amtg_C;#)}8OUC&i%G?^6!+ z9?2?&p&pM6A!&R;KCK~eQzLA+n z9MTa_%EDt=>`d1!y{zupZw<{|p5Mu?Vb2YbuPdP`3L=Qp97x_zn;i-$h9YUir5EJm z9z#eIG}+15)`hy7p-G6to(ZBP3rWbVx!ynKbX|gFa6mB}qQ_62KMf#F<6NXw!GJ(O zFn|ECH<2G87#bjib5gMdNYW%?7z%cvD-R4vtRZ}Z!43!TOx!Jm7mf$aG;5f&4a|By zSXS>>f1`eQb@zXl_Rqa9UH^II<;$gO-wr~|CyFmDp3}=k6b1khB#kHtDa6an`?ATu zVmpoC)xz>YUhUUdVU7g%TlE^U3>vSVyCDE^q19>}VS4nYO6?V1*57f>#o3&x)T|)~#0|#b#(t zx@|y1QkT)*^S@pk>ezT*Dc?yZ^mts{-sH!2UW%Mup`en|=t z2mk;9MG%05LbP9s_Gzc(34y%j_l*NP$}fwL%I_QB?QC59&RlcGa(+7Lj}IyAN-d4wc^gy83#Xp>q8~F99VGCn>;C1Yk*;1^|cvDd(K@Y7cKL zATi%j>XjVK*UG|N+s@c|?wi~1z@sK!2|YIRxkBt)BCRvV{@*NgXd}bx+dB(qU-?wQ z_N`G|4~FsTrXUh?kA6Hc_nJa_T#7~HUZ-Yc{BzDS(!PJmEh^#b@+0Myjk>B!$#8!t96N@@2ogL1ii3& zzvhPzp6~dvSl~SWv1r`<8OidMCE zJHDg!=f{WB|GVqC&y?F`1^GP)N3d5Qp_JCXX384b1^|Qy~oYs4u*!L+u`*<(&1!T%E^!f z;Xy7)y8sSYHv?D?0|=J!A`b(+6h#vZgCl}KtEkbRKbpQhVSbAE=YCUaY6itD79sTX z+9}1t$;$O@WAk_BUe^v>uAMzAsM2*^I2KQ$q&J7iKK#g`BV>Sz9LNF zKh0fLmd`Dm{hO)uu6pBvOZwFiGDTrhJDE@jgVZG$tu$H2eKRCKyuCl(cGhV0^^*FB zSML_D4$!Av4PGNNUT2qRJm*a?Dnw^^s){j4H+_`PkEbJen=D#nWZydQY zgbYMNIXMR8B2Pv}#AUPUARX@^TK(R>%Ck%L{hLdtsu$kWpS+(xIfOi88h*1Y0p{Gm z>{ZZwz>qA3Ajx6-+<+yM^w|yJzA`sIoR0!rt;)y zY0PS%DEGbSH~(>Uq|M5e0WuVad-$pQW>LMbbSCEXJ`tr9Qefb=Vozl zV62`*M36!;;QE>l_nat84;pVz|FZhxRp}r$zyJSgH@7z)9iH1?J@+bE+k3e5uzun8 z?-sXJPCXu?lYH8+Ff&Gi(P0IYWvq}tpO>F)V%P5Lx+J=N+|IuC&gIVJOWiXasJ|*( z+y4W2!K>m#unD`oe&t5(`g@To-FkE-6)PW^G)IMbV$070I{w<|li9VBtK~_0C;j{v zO0a3j<}*58ao_ZuA^IpdqYKdK-_o+jwzSODVwIA!&WNHJYP zF$u*&<;3z6mnGI4HG(pv%ow#$W9PF!NH9978RgptoV+DovQ}GJQ8-CZEQ6R~*2n;J zY9itNgcFC(_MA3f{iFJ1^TNT(k<-O9Li@GPkW(3RChIp#F@rF<4#TWW+A6oH1KFGu z6H#p#Hl0=}%~DL^WOII%N3eW2W1@owndqnx6k=%_;q->=ARCk8XowNLHuTxQG~Vy3 zzrNVGeMs#6-TE6wV}4~!Hs%RPF?(W6m_Y1y>vd9$@c2VQ%9EK?!ta%0N||g%qjDvJ zJ}ak6-=tPWA~6!!u(I`hK+|mK3e3vkgZ>m+OUDI$vS^IzpHeYY8>1Helx^i>G4l8#iA3w zUfxsrYW3Cog?n?4CFQ-1w@<&W-M?1a-q?F$Y5NFYOSL)N6#QIB&TM_M9Tm@1pPz1= z*t4{)e)rZ7uMan_T$DBrY^@zQlPzv3o%qWzGnjSx7@5cetH(HHNd~*mnuKy#j-_tX zJc*kUQzXMA1GGkpjc0>`8u`?S&)~(Sm}fXuPJ2Cw%I2Ndza8SLNvqy{Cwj9SirD=VmTaC zyb+;rhGH0|4{sPn;{a!AK=vFDmLU+0v!ZeD1JYDE!r@rf)Q(A4CS8tjEAp8aUOXJ1 zRb%U$(#yr!O|{og=f1B#x>I{_wSMz-gYEUlucrUp*nDz+N9FAm-tWSTo2$o< zmrrn}Lf3%#Zc*@Jaqa^I!ILDU85SpKgtLGqS>`_>2;L-kPhrHTgqn$Q&IE16mix1e zX+-bK&}QM&W`y~aOiM>hLAvYSq(dG5z=>EmAMd@*sQ4R;6ifIg)K-T(IKZAW2oMNq zmEkTQVdlGx&Gr>~?iuc52Qq==3YRO+ zhq!6KT#5x!VS1Fx>8Rm0WLXAzbg>ZcQTM#LW{-_KjQS~sUNAaROf{b7Z`5E+6^&1; zyKl|)?MM6X$e!HVrE9z6nuZKt!)Pc=&y53+0MI1GaFWS~-SS>T-wg|~I1X`0_1Lf^kYE9hAkOyOu>b`K#Naq5pDX1_L;}&34Mm-B zxI8A_UI-DS5kxqJQ#8e}Ts}e(`-7oy8nHOv{)i+kHk?mx5E-)#NA(q2%%ai@Of zY3Y=R&C~H?v0Oi$MW`dE6**yHNE;m2j86}i7&u}X;a23yy|~L>+kgM#Y%zXX-;m^@ zuPbL>RZkzPoIPIOcBuG<_jqAv`BnAOQ)A`QyBVhb*!+#cE)Zc!;wB^r@ zOXvCaQY!_DVHp+@Btb%&C1?f>%qPk*yC{+bBp@h;1T4ZqC$Zp4N2cTJ*Y=SShF4;Y zpe(P5bJ-xKBmhfM5HcLMrK^$v1Y`(`WB@L%B_fQw-)_*P*qA7o(phc58lMu`D&!(f zIS0DwS$zu;GDm4_V0S4njqtq8MTe|UFaS-E_^ ze*3*^?pF2KZ0*EmVOpwfw7;v-;W~_lXH4CkhOmrS>xmZSk0OweV#W!CuX+-KH7>!} zpvIgobovj2qf2y0k!YhcA?)WTCiy@kWOs?De?vt}sU}#$(BpWm#o%#aq#qe6U$j#nVy!Mz zqNeJ}X;m>_K^Ef>aW;fefU`g#&Y4Q{W9u4W?>qv3)`%LIW_EF>u;sFaU=vO;f!UH${+$gn(jsw!Ja2F3TP;#Ij#T!ol`zieUgwQ{DD#=U_8{ z4H*j}=OWKglHD@!P+1p zVsJnV6WpkcUhQAEX%jRJIWDIR*y(*a*ws;TBl8<$H|-SL$1D*PdT4ZC>2V zeqDKVr?Go`r-58#K0pzYu^i8BOCz=8A*4jG)HNRodn z*U~#lHVON$e~JaD$8iG7A{xiJrxqf{IYZGDLlYd}`+l}LNizsi)Uv8)XuQv90w5WR z1q{A^%REKJ?E@I*#UYJwg_kvwHr2Gi!X4KmGTr4zcAZa9KdPWK!&u?DB(iNsJgxWhJON!!L4Z#P3c5`mD+>qTwxuCOs{x351jSeVf~ z>U6;-Tw@-aov=xJ6MbM5BV`L!thm5T%ASSFDOdDLrmB!=dWaa9% z(xLL6#@_AqvqvLyFMd-!xpi&rG;a&?Zh<(}lly+RsdTAw`@7ohL(;`POV|AMqxY)! zAC_(wpEkB`E8W$W-sriqL|Leg2S!9B`Kq$z*}qEHmM)ie*A5<7c;9$;oK7xXT-a57 zXr&|{Zj`rSU-5;q+8l+b*%%r3dJ|?3Snb1&#aZbHa@aVCmDQKFf4+M1)h@71j(#q1 z6^(A4xGMjq8KJ}Bt9&Z36pc({l$O>Lf~1i6j|U{hD#g6`=bSF18#-Bn*~G|L zChPS{F&(3&HA!vL;fsb?&!|g^MJ=mKON}-dF-4Km<_E(}K{>e>c7sh}RRh4Lgc61j z(GNL=)(X`Aw0K|&MI&Jr^B-r%CS)mo<))}3m zH`q#qj{Ew-t>nF?K6op>f_gZ>mCs9f`5&dvJ_??Lpa%UU%&iU014efGuHl!-WU=2dKs zl~dn{CzS}eTGMDXZt7JD8=2ow~#Nc9<%LR}zYtpOH=W;33 zXq_&_f5IBrNc_fZ8hk<@M2(~bJuFnCE^W4mc_3g|59D*erb(QEs5=n#iNL3gw4SuP zv~>e284Po6Ls-i{(;CQyqS*~y1~b&OTa9LI@pW#_<`QUi%}n?*22!;G@hu(7NsKZRU}mz|3p)VslS5AeTR(`cayC|Cy6Y z)aF}B)7o&Gk7DpIX7d3CeU!~d;2UT14X#xKQD4H7ObVAm)RSsmKK(YtHs?-T&uW{$ z>5WP_F2zXQWJVMAH1k%cY*SKfq{%H6am&piDW(mFP*xF?W&gW?23kO^vFb3o)aem0 zVU;gy;Y7M+hDch$F!rR?se{e?+GS1Mp1pBL%HMGZ;&iw|9&X@n`}(`1NNlTE``?QG z=agVrG#znz5^K8xwi=Ezrjwg#hEr%=Ss8xi#1|B66SGM~rg-KHij**9L`2f#@+shA zJBHerQz^QPb9)u7Rt@I*)NGMhG=H#a*veb~&E|rUar>mAHGMlSx0DuNEJABX#?7D0 z-CXVBb$Xru8QNqc{Z7K1Co>AQm*JF}l&y5cc0t;nj7@(+2X%Ger2r5^`l%6>Ps~jv ze&TMbj?G5x76k`3z?q#=LQYAZ3Q9Y1!POa+SLgQWIh8z78>^-`McGVr)Mbovew%Wy zy}O@VJT*R&b~&AjNy5x|2VqMqbU`zxE$sw8l};i~nJYlxmT+)92ptMJd zvCSP)my6J5AjQm|Q!`{ohR_QhQl67yV_KPUAT`l!Asp6G>K~bF{U6lvALUO|fE~b} zrdVdf{ppqNX?iOThjzwe>d*MI@v!E(xWR6fVqdh<-_~q zmbWKXX-ob6+4{RX-t_vw%mujR4i8N@yf_U#3`qhH?Q%GPn_WJZ3M)5 zb}fi55C>+pvXG)uj1=1hn!d}Ig+Aw}IJNN!AxT4$AUF)DKL&(bmnxLk3vtmqFv}j# zb^+L)AYD4kOpl)~eph|J8v9oSU4_qeoq;ik&JFbo#1zp%cKVucv8Yf_;PPpikT zT89wB5wV+%aXxfqe?({KkJz0_oe=YKO_)u5w2WSIhynvA!y#jypCq?pZ-%obmwUp$ zzAlW?Q;HsP7Z1+8UAkO<^KRkH!maX?=)#d9zJpFu9)&2DxP2@%tu0t6JdqPZw@a{s zJZcvgchr&1YmNF?uZjHPiL3Vhh&oz4`}gv#4-e+=Rxi8`m(DHSsy=yNe|~WB^!)5F zu-d9jA)f`L*ETJNN>62xl~j9#5Q-8kG7&`l3EF=$QI1I7YR~wE-PQrExP9Rn+c>-L zm*tngw%4y7sq8-@oHE_N$Yo04h6rI-#ejQ6xUePI8ddyH7-o9XmmC`#5d)&_hz>tl zzw=6@MlZZ%Z%l~Iy@HNv0QrE;U>29SJF4#Zj1-#~0mxws^Itpwny}x+U%rE)33rz$ zGiF7&%P>Qlro2Q!ilyToUM&v3pxH7JMRw8Mkikh3u@r%?e**9~+JSn7((3Vq(!&Sm zmtgrR+&pFz!(Q4b0Opi7ofiM3?|J|M=;qzQrr2& zADR+kb+%+37sKxEfW4n>9Nb(!TtBk8vip^fpJ?4rP{NiGl9Q}RWF7%o-DF-9;ExYy zT21Th`6wOg%CrF~fU_hAC*w;4LF>l7(^N0LeW|oXmad&WU%FS^y>Pwp{oTI{k+gf@ zz@`iqTxifpu%KRCo*7)@i3Ej6$7>RK8naJIyXuFx%so@g9jx8kHiS51blxMJ6cWrg zIw~A^38v9THHArE7XlGC(Cel_4@vo$tvz+vq%xe5V&m#j!IP*$iiHgF5Iw`!X&9EZ zrLrWIkzz@CFi3MprVoZ~5c!R!U>tH+b6@P+u-}G!CSIWxCdR@%L|mbU;_Jokn6iNY z>2Pq$IO~kHLC$s`O$EfZ{4c$>n=?$%!ufu)=E0~c9$aqkcUQwm0GjnmdiAr`#^W6gZR zhMuc;6WS!jf=)u{?P%S4DP|fE;zGwSFoGjnJP-(`q}XWOFvQ|b=qxDC@(PnWHr{6i zu6K{<#s2eE?ZH_sGk1Pu;S{E-+}{7qP%LAHNfQNCLarYPHjR(_i7DaUB*8{K_AV-U zN;s4qg8n>6+J})XVvW%5kdbEjQ$c`=)gc1Y>)4@s`oV{rmWA_~*f&GSVNLi_36q%9 zIipQ#`7|WG85)$N4CtiTCMfjo8B!ab&`U9gB`37Y?7(l5VnBmJq;WtczKIW_K#cX! z=_=JsYDf*-bun&|V%bo5RJfJO+0kh!rWf|54a5slEF@EcFg3(FO!|ZL1g|V+!y%RD z723QrM0U81Ha1ci3m7dvH-B%ms6NRm_sX66UVM3#OSAP$J0gw4n@d-!yDu-?Yn*yh zfAygBU2Xra^35Tp^9W=0jYC@GiAtuiDvcITQiygh!N!t=E(<5S>>_|9y<;=_&kD(gs2;q(k5Y#S@i_DyaIGS;9}=F|BZ3*c7hgpBK$?n5A^ z0TMBQq;ay-5ckF3~kI(X+eD%+z?bTxkD|hbvZfx;T{n3%~F7I!uhjz>zsy{wl zI{lBiqu#GLQ(+CLN~k+xt`&qJDb{&p+>O_O|MO1F7(g==j%bFZ2?zkmvg^X)m5_)) zG-L=8k~j`1;tO&h2)9&g$KR%m7vyD*h|f!d zbPzg$asKH=3r)(!-&wnEf`gF^X!#_V9V`QG$YWF*l4l^OkMq5Yfp`WY!x3YMb(D~>W7vQ z8k%Npwn%r&v$&Ssr8VeSp2y*?(0d(9-PY&KIhFDrT zt`hANyVhE;@Gmu6Ns}}~Q!GJ3{yk5-Z;D4MmyT54oNXL9R6qHBZS$QWx(Ki&AX$Q; zXqLfomIJ=oo5_VcAH)!zX@Z6TF>I&Y-EcM$Vpx`2wF6``=fIO;GDPdf`dQk|j*cgS z8qSoz^Nv1R!kF&_Bt&Hf?us?eOOLy_GjtOV9e5=Mq3NkYQ*B?}_z`6C`92 z!68W&gLGzCiozj>VXO~(2#Hou32_K;$g(WzgZIfmoI!vh_;f9)fjun(rx+5kIA?Y) zkAl`D#p0trUa6_gz(7Ho;yIQrE~mtlN5eVoU-Q&HJT4s`S$H{sw>HoeWod%OX>y!bcU@l`Q)Jnk(%JpRLB|j8?iP=C$~zdS_Ql7HL;d94KW1x>AJk4h zYg|22Ke4U;?l@i9yJO)2uXg3tk>bmxEpw0OUoUR0K6|U?Zu(+}6P5b|G9-2!FjRJN zXnfXj#2|q%?LgINUx&H@6^I2u6b z0+J*EO;S)?>&AnWF56GXk$U%it6vs$Qp(bNd$WFI->R^5N3_(aMwC zWM2b-1(1ORP4prUV=0EAX@)~ECUQJSP$Z&R$bi8$DFqNtA)H>ecPWPI$LN6I%E=zv zlS^l%15swoLr(Ro)=~hCv-|C(2bEJVDhD4{4s82H>CDo8Ksp=eF8uKFY6pIJijRRk zz|mEH+SwWLAw=VDJib$Vc3}KhjoAxx2j-4XRxX~N|GqK1t$KDx^~udt>+Z)j_8gr*wsi4#l^yrLRwd@{d?v4se`wZRTO|LCtGTr7AfpKJ!+zQe zYvD!h>1AL14-3!cw=BMGT-{l@d%gHFT)BPJ{LlKM@5&eFPyBWmFNS7Gnk8|ZB5@pt z5Z_=wZ?ce5#=?w+@6Spwb;iS|n3rH0%3%u+-mQ?41f$G35Zh=U-1Dq%KrltL6V4soST?#nx4QBqyP>X)WyIa(7v`q5#?{n zo8k!tBhsu}la=QS{hd0BL<~i-fa#^w37nuPwjYf*%K#du@nQJYBots6g2ZuxWR_hf zvX54W%Ub{>JAiIlm!_%$J+NN~5QG#%QbKLSth_=jf=dyOZ|eM*YT} z%Grmd1C4j*i`z=u%D3vXPv;KIf8X106L+k%l+bx9=<_|jr`qGQjh%;U&v(_&pDrGo zdt95{(s+JU_Hi!MNAVX`4{ToCCTm=Nt&ghaca#rS_8#x+`qbYYWs>u+EB7Dx=P&d9 zuA9Z1#_H{3)iV$I*^35G`EGT``_g8-{G@(y_u`qw>&6c+=Py*A9$VV_;c{iqnJx}h zk1N~S`|Z`udlq*r-u+{J+n(C~?Te?2v*k0n`sqEYk9D;GqDY!xXo@CS9ML3N-*qm; zSp+EpB9f+PiiQKbT7zgpzaq#hF&gp(1iT@uY6_)D-ot!UVGkL5J8;X63qcG-#td)< zu>{TXZU|R3WNbXrm$f0&?hRZ*d&OGOGsIj$(XCBbd{H{=Z;rTJgDs1QM}`AJlWTHeNo``l*9!i~jUmABss1Pq0vlYW0RrwfV6X;J37$tc$msz@Y1W%Y|Q zQ5oc!X<0k&}H{6(3Dj->luIc5ZGI!4Qa|0Zy#AWpEwrRuV)2ih$ILSw}#eW8Edw@p#x1 z@kCRO@Jf>$5OoaU=jl1EMORhM1Y~;^1C};oKLz^;iNF2Xe!oe zC$~aQ3XTx5Isifru0p&WHqptywKjP-no+6^+tOJkPAUZo(^_VfSE%6q+i06HMl->T z)A6H(y8RDA;t|ESrD*g?0B+HjBQ*dW=jiJJxCJZJmK%g{I~cIpCquW@`L(%iHAME4aZ!L=CSLBf!T63 zGS&y4mFhTNYK44r{@ny;)kfM|-}2~N;vQGP8*p`nRm~|~fl+m`b(Ai_;v+flNH~?4 zk;!9@cA?ggZ(4<&aI52a;oDS9(%bq|sY#Ev{zP;nj|+Z3Y1Ae@7f|a;N3Rp4_1}Dn z{5V(#R|ZH*0d`0*)s~ejf~QLU#PL*Njtffa06HS&Hm9coobn*!LIb0qu2P9G6H&L9 z^B(Vp!J2-iHQ|(-JW~^PM{J0t;hSdZbe6PAG0#A21H)#FQcOj;XY?@!W^_~2t187C zQ_DXCtm%pn;Y7-j+=Y7`5RwdoLy`m}gPd*( zI+=Dz%y6)$!0BW-_x7YsibcGpwO|ozCpytaK%a6a=9dLJ<#`DG0StkWSI)ug*!!AZ zIQ^^Q_QuuYOW*yyap+BP7pM9vz!$MR#tfu6x56JM*=SfTL<(4wt-k%yALpOT>Sxb2 zE*@F@UcLCDe)8pqi@y>4q&v_7TbNc(#KZtttYUCEDvM>j3j{-!6rxS8iJB}w@QnSn zcJEaE>fs^86GMUsP;6S~6dwbC7=##>dmq?$4Em#EOecL4{QQ{C&r_C8ivQ5;9h(+H zCG|k1X#K8NV~ab>cdHNHH=f;}s2zJ9kj?F>-r7>gH!h!AI+liWJB@slx?Vk;4zm0l z!~XM91WRL0JZbgb<@(k8rLC3wFNY8WiQzCQVxr>=0D}{NAlZ$<(%U%D;%G#Oj@SV~ z^h?|COSeO?a{sxvc&%}I|6hgzOY%^D#iZSd)abraOtrtFAh4mNbDzDF$_YEOPo{vn}-VfxlXugLSjZ?#b4m$inh93zq z;B2yH{Nd?zO4macx^nQ<+^bR9GSaSeZ6aG zdoosjQGB%cy7aF8>Yc9o;>G-(aQ)3L@z?W{?>OK>dv;ANzG`fH*toW*{`lw*Z_h2f z$N$lIJ&QRC^=sc(cI_N`_D;CGs%*sBqfz_ln60+=VfDtgg?E9)=QGuP@A<&3z53A! z#UPYLG@}H|7IL0Ikbnw)67eAFw0eK@;jUsP6TmY%xLog)C6s*4!EqJFrstR02n}x3BQuF zD>NRy{-$zq$K3agJ9`>OXUn^aPl?LGy_H?NNKCjt^v1AN;3*;AsBTpC4{Jyqj%Xsy>7nPeY8<)3MPHmfe zJO8qHdH&ImUtr^dLSWq#^m4I%ax@qlG3ydurO@x`hlg%SD8n#?OEG^g8L+73X(#_X z2Ut3$fQ@f-NU#b2h+QSm=NK_8h>u%QYAJ@plud~3iDA=nBN!joNinhEO3z3!jn<;q z#*lztfD6+LJ>zL{Fl+#6oFXBKQyeY-BL(t}>Tt6~Aq0+Io4Dp*HBO(6)E}HHJt$r( zJ*_{wS%3YetF{#x4!IIZu{5hnhZI7%Y#VKmVw>{ZiQ5}JlGZZWKwyejI;xmX^0Au> z>im!p(3E{z!%aupC=5yiQVLzy4(@{;U)QcasO-PkcyV*-PWhI1@ltf@K>2j_zz$ok zdiJ?yVM}Anp&?9=QMVXD25GPmv__@L@zvZQ*4q4|+WwRO)5XB<Fk8pRoU}q;d15fEZ1@1EH9228#B?ZF|SZ*c5WnN((>WbK~?48&f4<_wXL`6C%4SK zslMIr9ir2N*0>nFzi(=q)oO*i@`_-NOs_MP^4sFR%9ZbaTRr~n!}VcSoe5;6n8Ars zq-Th=WesU_h*Ct-ymD4Iq2v|Wl%w`fvQm8GMx&WF^)k*&o9k!K*N*S3Jw8@{ccXg$ z>Ted0Exaq=Tsk+zV2uUTsqRxS8U?uxpMw9nG81}gquQaH!TRIV3lHb7)^@yW z+`dx0Ts&0Y`fmJh^Vj}Z-~D_Tw^9T$T7p@rxP_k**%B;`hn*Uia5wAFC;R92RIWU4 zoO|=@#W(ef*B4&R-L8Ir>6bq*JzUz7`0c{(>f_C|le0qznTgrb_@F4csYzZzTH#B@ z6g}p9o5<}aiG^#n7LW+^TS!OSQ`2%)JQ?OcTpt9Sd<57gM66XQhR6A5KpzkPM)COu zI-uX81ownyNYFQRB$^%LpMVYo`<9<1aYe{Oad(Km$Zr{wQzMS|7aNg9figB7F%|ec z0(}twHVy$9clXp zzur2&bh&onxqNX;>HccHArO%noB}vOQ=bujcO?UrM4dN2{G2h8AZe09c;|VW7`7Kh zQ2^) z2TFJU_lK7c7a#qze&Ry;K=BY~h76Q(Te@C7f1=J3)!f9x-Fs^mLUPfB9=x3Nq;%)WZtXo-l=iH zt1`f;bVP7bP?`>#oAV-neA;2l1_bXSLY|pyDlD3i*zH|TxhLQVa9rh<9VgS`J|>@u z4)ZpjSovm)&y|}OO@XD_nm!JLc{$lZZ zb;q6BmXnpo&q_NNpEhnDn?F&#czJ&R*E52z@i-L@FhfLjsiD4T6SJw?#~ARO(c0y6 zG}f`6--0(zo-5zCc@}O91U0eIm@;Y4lPNKI^0cy>JTVg?TRlY<`XHpymW)k@CN%ku zLUoiBcp4p#4f<3cC~+E0x*`mllqH3ZhskE0*%*%_?bhcQKmX*g6?<>-MNLjVq0z_s z9kB`FJ3AZ?xmx!zj)ykthWsP4f&31X3QxO+v+4^3Ka`}|Z;o(Gi}Pby`uG}AwNp6E zS_C#`lvOEKJ8h&C{2T0M+t4(HL__|btK13mUJ!_4pa!4Tw~6S8Px ze7HfLo)Ei`m12}n&+pAXLu^sHp-xVS3^TqlqYMF`#<0Z+Gnky%fCHNuRX>RW^Xp$ z?X4c#^3R2nfB4<}o!Wy(<=2giTdD_k)=#WOZw?K3Cs+<$Am0qK$Vi;k2Jrsj7PU)`thR zJqOh#?uAlsNH>CFNQy-?ph=2l8N_Tb7@k>Xg5jJnSO>S8y(G-(GY+M4kp60>a8B|k zRJ;WvM&pRYSw8n-yT88r=iK&R*Y6yy?mAO_@^1c7`C9GD=Km{gn>$+FzQ1eV+0GDXF%O$z5Ji!Y?R0j# zf~PV#!7`vLdMfQ!LC|UZ^gt%d8>jT#HPD>w5roFXnx+WAAd(`)QB_@w&ntIM=PG;e zet25DcfX^KxR1X)jaf)?P}%q{K1Z zm%FzvVIV^<_b4gSe$Z{5(P}5hCPn3-D8SMz!?Cwo*%^+As33D!8V}a=`9~tUO8|pI zmVl6?23R5zND>UeQr%$P-Gi-;86s`*g)^o}krhHuji8Xho9BT9w%Vr%nxqL9;iBtg zdTH1EgQa70`)UX76dzT#pZ`Ve#pdF*#Vd{boBJ&qz)%cL0d8$mrGwlUbb9dgk^n@TaN6&9xR*}-7fVK|V{0pSZw_Gy)Z_Nw9& zvYtqRi-+njXMcG4GGE_&sru*uUb%EOKUO<;vaw@UUp;na@kxH}Ol0lm>GJ~zmd+NB zR1e<-m77<_tLN@Dwp?D?H@}5y+~Z=aiycJT|HXgT{ir_kkH+h}#@fx}Z{NMji(JQYld)DxD zb$4~Zj=ctv2_gd|L61FyoHIa#wf87fIcJS>&RL?UbdCs+1fN4lZ}C4QK%x_pL`|@* zPhxeU>vn}(w{BJ4--SF!^9nlMZt zJ2c#+N)?P0*XCBysOaO?teq_Q3T~S13G|QoJ6lttu0E61m}0k6+bhmi@C7#cX>{3H3FIkZ)&fYU`Kumazc!fJ9IIjQr1 zPJ7D*zSV&m+npS)o%!b)TNPI{X~K4mfR^9KH|VlX$>W`iS6|G*$3M&7(@TZ96?_kT z%j_6~{A=qi!=n%w<+0>?dZ1Pe1B`??321_*0o-VSMPb}F_{VBp8B`7@#X*HS9~GY9 z50ut7+ae*7H1qds)**VA9#ywL7@|%HW~D|jNaBD-adZRGgba;Q5TiL3V|UXPQVfH0 zeK9QCby8>J#Mtg(x>D0Vr>x+Tdqm7vb=GDJiWCnRh!Hdi7+lnbZQgj-*zzX1bi4lc zc>U^`%7caL;n`BB!lCS zh9o_>iHoBshEjl{7?L6hst^2)VK5p66ze2UOV=>wsg9=W=UtNk8mDQDh6LLrTyt=_ z&1StXGs1h){w0n95;8a=bhAy4C@3dq(5`v7Hveh-Pv!H*=GjC4?O52lxrbZ?&R`76 zaBlIfi8YcyBR)}~2ppgQ=fX2vGEJCa(k&`e^X`t)4kr-s>o1Nk9ay@8ly{b&Rc{@w&&*cu?}8s+-K!tF#yM3bJ|YR4q#%WH zO5l6E8HT`7wBL}#07m1GByeW%5lO66D+&ofuV`Je&zcjEID{mmSX(uNIqy8)Y$okZ z^q?lrKd(MJ694cnUb!$o`{7af!NQT+z1s^|J=&IB~yr{&1mo z`hcA+@L-<6$)GVF9uc7;=11vbj3^A|{M)oi_y&v0sp;wQqpD9{&p%q4t?Y@{cRi@j z99Y`($IfY_A04jPcz>yJ|7`umh1$_O%`10*zkG6e`^UEz8V~oEZ+x7+P(D|=SwH&F zw0zyh(LV$E-Wmrke7LHxa_VvD^MWLW(SRf=3dH~eXyVh(3t|kQF`6c6h9qemha2i) zi}%)t48fo@fCM&xI>a!P!Dt#_;_6VT&1%#J8!?zd#K1^Yqi4gdn_nyWSlT5bvb+3vM~)U8wrRzag#~NkJRwF{?KXp82_dj ztHCpVFFy4-ZEoe?3mvGrlPW9!xImxwmhoLg?d^gwEe>%fRP*nycB{5exYec`$ws-( zn*LYBAj#3Uy)K9qGqB6c#V&|V`t2$;H<1IiJ-(xKb#eb+>ObuM_-^0A+1kqk3tLNv zJDb5@7H;cEP%4_@cj1=F!}k@gnLNgfGQxKYubDiHhnF9exv;!GK0pGcAO>g(&?E!^ zY_JQEP&>j}EFlb>X&xE8k`$^?Bs!s%srWjeRZqz=pUP?Rnmidk6t`7hYMWit?L=Sw z?YZBSt~W0~Uf4H8rAYurGc<-l9K$dgLm|DPNB0WxY{9}y8|D424eD^&XirlfViZc? z3>=IrN--$T00_Ex9CIq2!J8e-lDCDlnRHe@CSt~q#ZgKg4=NMUQ4uKsK```6-2zd2 zzOnUG`Pkyq@AB36$LW41yM)1Tj3EKh1D`8lFchO0lZ||{iF3DSmw~J;NNYW_HIm#zKWHFRMX$WynRv{jf z!68lJz0trl04Rl_3^n+Wl|UNDQ3g_Y3l7|m3`{~mlQ;@l4LXPil1bSUim*);WA9n< z+-^GS@&i!1{r$&RTfSR3*1U4N{_HtY+j;cEt%Vo0{Z~HBrW+40v&$XKk*IelokBY^ z=ARhMg9s>MdX*&A-Cx*v{e0p5;@j%kE6uG>J8Rz!cNB652iwEP`xVQfFuxi5>Oxv&G77dF5cf{^+i?w(WqE^ZB1}ypALQN}(tNaSA{Zf=_e(N$3?@48M?~p8k%h9o@Bjmi&$VAEsZ|4$OXE*xXOkkZ@%} zN2y+V2Bjzz0)Y0pz7Me#i-iWmc=Iqoktl!!Mz3x^t_agh(J%}RNgQLDX2ZJkOucfn zhb~<|wSAgedR#qowYKAj`JKNmUFz5Z1Nrd6bavV;m?YI>U9#iA$V3F$gVUY04cj|q z%J{9Sv>T|W*RJvk0I&aVt(5k0DKNrIu|OiVwk-aIF<@5`Q-i-SP4M@459=LAV#g2L;W$Z4;JnRLazGL zht(U$m$oe)S^lB1{nrKFrIL6>KLlZO( z7)T5Ze#HokVK9I}$j}5z&?pc5N>Ml@NeTi;LEf=x2?AGn$zB&03j}H6_mG&909Jug~Xo zXQW7T=bPru)71xC=kI;Hpzv_k> z3wewt`&6j2++)RPyR*Hy_j+Zndis8*{_^3{Oz!u8$dafi-kcO634$PShIMuz8jLC8QD-o=+Ef@u zVg!kHRt{_w⁣#+;5k6Rh})qtM5Ay@s*BhmiAQd9;br&>ect0AKF%%ZQX^p^>Uek|w2&>DmV_0`&&IP;(WFoAk*P9Km8whW&GRP~?l<=zEgc`A;8Cq! zj+xxNR40{_p|r53QX0rn+TLUOrykaji?Q59bNLE>HF9`_=t>oyO{c3yp2(t0&JkZk$-U7fUtn+^OtY zxbpS*t%4f|x{o-j2g=Z*Kvb*)P{8%`N~9GBJ=TF)YZmJ^4FZ zlfNi@vUhCH*6No7sBCB05Rf41D@u{1C6MSwwf!Po!J@LuV=iJywXC5Sx)drx13g;Rzn$1t6xt= z5+7kw2hU59P57pPRU$OlrHEZkwVHr5M5nYX_DI&|NkpbSigq-M5rON`>gr|T$gQIsBL)rVv5d)4@E$laQP^P@Oak` zs+i(OOfduh@@J934VTT{{iUjAvexH^3UN) zm!2%2{rKkk@(-Z-@zf?2a(<$qNd8OqNxZK57YvEJj<%BUT4JQOE_Aiys!1gJIfD|Js`9^0{_JQOIRy zZC+m6GsL$!{iCQ56(>RTUAV{ri_+bz-4^G{TPlZ^_tc-w)^@#go4(-yQ}eucfV1WBeEsZ7D3hm~xvpZ%#Dl&Mn>Km)8DqbXtKr$A#Qj zR)^X5Y-zSOx2^H+C0e>POj9LBClvgy*uU=^NBD={du+}1mLL1# zyab_>1wPffEuu@Py*eV6&o>`DZtT6cc%!jncHuzd(!tUe(W;XGfH5dRK+f5_Pba~0 zPZZg_sc2e?{N=CfIex*Aac9A)oe)z6Pj$ZiW3H6jo4F4-Zlto9vCx-A` zl}4NH&3NAY=MPt#w-4|YNIyC2)Zh6vtb^Cwj=azRjcJ64rJolFm*Z6^tkUotD3xtb*fswNpZnec^ zv};mG3M{q1+;KsQGcO;V45b9=TDf zjvt#*f<#kfI0B~y>0+0eH);q9Cr@^Z{jqetbfS9o?03zxyZ^d$xH+@sG#eCJr7KU=+Hp!LvPd6jC$B7;PTzY+4(sdEL|T-Rk}<1~R|0B|nueERxjW7z8B zey0u%C_{Yk3&$Pws(x*z{%m)1@1^RQ!m&Dq`aZyTq!iod#-N36MT zwsK|h;HJi|YYX@7jn^kL{_4dG&1ct|H*YsyT^4^KBhP6wg&uF+{QbA}rzgwT>FS$n z)myKA*SIm`UwBfzakP5n2@@N}AA*NSBP9nJN0GnO?KyBzzcQ;*ND+!CsJOuxdV}KS zyuYS7jk*>elrKs(` zzbMqWJpgk+jK8SzVivZtFivGjYd{UTwaOWL3XOl7-0%TnNvTt?#}_yD-5=uX#QeDS zFvHh#E6GWljPI!G+4l<5&WK!!6wM0Fgi)^b4AK2UAZkF>!*#fEk9^8bf00h+D4L8^ zFQ?v_EGc3x&PHR z?mky9T>b7VzWLa*#r(LbXtwFHQbd_irL^L8DX93VNiQ!Y7-ovyhlMeXc8++jn31te z@R#b?QrP%D9E7*TK5Lx6zxc#bI``pPN|A|#ag4v+(9go*kBmW#BDtQwejIca-Ch1k2a{wR4l=8dBJ!ZuGZGuZ zoSL2@`3necuT6}_#?)!0s3`?;njuLN{YjQcVP&AV>0UZrd$Rv~Uv>6EQntA*P86DFOp*yxubLz%(Q@#-?qEniRX*=Y@ zb65UZ!c$TN9d}#I4l#S*k#HGhN-3fk3+a@CP09Yf)Dsf!Kw0g2J^xcAh)r#kV`^H< z4K#vmuyZKtjZN^Qg&~}#4$r@AUfW;ZKV-A!8U9+Rl^)HcqmC?p<+3hMx@hk0N&oQZ z!>~^MKsc}SP9%lOYi%wbwa0tcL3!@OlV7XmkJo3fORJ~Oin+LY31A4Cb2_2@)6cgf z(?Yew>5w9_F%1~u&)+NmMzREMGn%Eygz)VMqLCuOY)B&pndqjn#@xWf-!+#YQ`DH2 z&(4q_X~K>2=LwE}Gg0|y6cg2M0N^M}QWQyjx_T3?ZTk(r!f4QL<*xz<7_@jcBJ>w; zB1!)2DM2<7{Irc6tX{E>$FdBLo+#fKvTGJBLM7TV*u_Rfm!-=fj@0Jyn5vBV90@W{GksfabHL-P@*lOOnyE8^zL!G#ygr|KtX zmY(b9XUZq)?`NAw_IRp$ABLB2l;)Oq5QuPr-Dec5)S5}g8W}B05xqq}ndO6?IU|OM z##4rLn6!BuLD6v|VJJW_3`20@%lyRtm0~;{^Y>aYFCT4O`r*UnrETS#T21rRjSq9x zH^-V!-!(3sEbXZ6dByzWyJ6N8n>I<2oHD>S#Sp{e6tL&@-PbJPRBU`?!`mXt*VCMJ{F&$Z#fM~l*S^}Tn+s2u&zE=F8+*6a zjvZ{C-8I=f^l*r^CchuAdNbX5v7CH|K+o!nInq)@GYvD@oY4L%%Eq%&L=AYs#(Fnz zmiM66 zjoDmc$8*eMc1O}L=AWM&$;wB3VXVtp7H?iJqWwEEM;mX>RvuJm?o^M>G_IW;LR_WU zViY%VNy}qoVYytoKbirfHkwcI+gwS`cQS}wfI+mY8<`TynJinZRym~qag&d zsrh@dt3H$QOj09D2sFiR1=LusrUOT2JEgmm(Po~^dqfn4-125P4x?tmcF^ryv>R_QGP{=%;% z!+1`w#5@*9tb17LPYNP#h&VttZ!!6kd zjWNLk=k<*!UD&qIqa_(Fl93FnV7*J<(w7>wwo8$#8d|TUTJ#Z^X3a?LxW0 z0Z9V1N61_Zppc{>O|#7<5dshfaS{NWgX9tfy(LMAlQ@I%xmx^#`F+9lP#Bw)_rb!u zKS<9ItYYz2S0fYCTyV!1ZW0LqB*172qq{eW1TZ*B&=6<(v4ANY0un%`cdK9w&fp9i zR5x&dQPgA^1+Jh_&5YVZnN(7kK4D-2g9RV8$-U|cxd;U*4~?icpEYow{P^tg&3~?) zIn=y)*7hIv%E6^Q^S2ZJ=E2iTySb}HG4%NS*@ercz4iUiYP0)F_vyy2Hk6^8sD*@M-4GPPWGf;g@~oTAJ6UOySRhF26a0A-Mb&25eU5BA zJ-ED0{f~ux^_^$Q@?B@?Qe)?9A8WGwLJ-#Ictq&QbgQC~c+q0xn+gJVS5H)dMO$p`ur|hQIOcVj`U#BXExyqJf1%Z?pHUedHfs6yVykj834srLJreNd&0%Tv^yS8p zy&vBmEgf1qw0Nv?x%Tkx*NvOIs#~6wZvSIpE0WzjOr0?R;((+8q;Z0v;Kos40g2H# zP0`dqQJ4W>D1rhQ!83f@QJ8UeY(l5)XN|OKo}4JU!~(a=d?E!~WJL#e39(k$)zk0H z^%uu{{R|g^fdJxYcdG^9C__R>lD%+;Nn`Q5vOa9D_JUll|BWG(!>? zO0r_(w{&MgKZa4pfvr%8GBin3oRITtbb(2|N*gK^D80cOa`2wFgdQsU2N|5|yk_J9hW`uWQeC{B`-t{4uJurT*;j;>GIaeFGTY15;9G=UN zF+2~Py@w#q5IBtiY!JkugdqV=(-fb+)Er5G54EN=VV)uyY9pFi7D9M6vF}kt7KMP7SN+zx(`%=p(sdF6pQXK7*&BDH~0uS#{lGn2`Zia$MDM;%r+@pZ#X=-Fwr^fR;ea? zq7h1`zp1{xL;i#-l=9t)=H6Gn*x%=$8b?07C?8ooFRh%bojoH#s&}99GB+?&`m-Q55C zWOc_(qIvnv;=|hgr+wE!%F@-+lRwq(U;cZnaesg1g$HXMnEB7iua}-xw;rtDen;{0 ze`Bt_zFs~*{ndXgA6-6Be>1bR?Q7N7AK%=ozkbQf8Z>LaU%FU(_@*%QT59n`^T1x` z^0CidO%XT_Aq5x=;si+p0)84Fg2V|D(iFzf5YRXzHjoUP(2P%kame2mu`&~cRt|gW zR0%~uKoAT$h)ShUjHYpl>0;IR0?<8+&g1 zU#RMlxyFs{{Z%T#-~`069z0l_01(AdtRD`RhO1~<4oJO^QiUW%k`xI@1`srZ_ExD7 zq5z;I%WJhtj~EmLOIck}e4&E(GIGHwF0&!h{NS)E-j zCPZM0){WxbFolEteeEr+@29i*x2Z(b7W&$dpsWDA0=;7{bH(+eoSiy{C&{RZ0=2h z6LIVfPBf=g##B-B=QOxEr%=-*|J?0Bjh^rfNlmu9sXUnEAJ=Wwpw}ljSka~K)|#D` z37Z;(?a@d`V|8szdkaqBwd2VGx*)h8|Cucfl1{!GmDSYK%AzU%InAtg1g!ik00T9$ zEt4Fsk)2Mp#mv9O*Pb{B9N3>gN#=jT0E}dJ(#<{|)02{Hq}1L#zy>O!zpx68(vh1Q zQr?`^RZ!;#6_|MkQ4>EgP^zjTN`&o6E42m zXmgB}{0L#KN|W^6mDaN+#&mFA;6-?FU} z@lz=@4oI5DL66M@2}Yv?2~f}*)<_dLiF1#)^jT?B5a2X`H~}aO!y)Xw)Fudw29SjO zjf8|c6G(Ih{RTL{Z8&2#LS7n1(&B zd9LW%!KeRIojv^9#S^6irTg`{AG*Fr14gF1zo)Xhd2@Sh$N9>Wg{|0E%LhgqCvGfn zFTG0rqx$Fs9Iam5 zjHJ1n?1JNi03%U~pgA=prtVM%XK)$-dT@Ow!3l;Y7?h%L48=)|hP@RYg_AfAaTaU8 zn`3$twW(L0wIfFF=8PjB9@e%!u3g`SFWzb1I9c6xzjCqp;N1Mfg_*|VGmBg8OV2xR z`ZS-l!Wv*(9_{1oM!hqaHOnGX3aZQRxW214-6ts5Vj*7nJ^j|BCL^QFh4HZ8>CKL? zZ-EN^vf<{;w({%BgFjVf=kH9^A8Z}@yFdc7+DK_Kaf^tO>F$$_JF*^m%9!kW0&WV# z)#CC8HDphjJ*MjHsgLjPl&_UveocP3Hvg`==iF~fR~j$gCW8X$8B3gSn(eUQDh%}j ziQq`2t0z3>Q>bF%(r4|MhUh8(;vTa=N{+3zE<-AWb(5g8%4EB=N2a~HHKF_QunYbP zgNc%(6AbS`B#xTa%Uvp=5 z)?|!95;A}x7?i*;9OrB=_u*f!sAmdeXc8j`9LIS4Yl5UnNTW0jR*Zj~Zn5kVk zyfj;W*-@|}cxwrRF(eLXoFPa8P$(g!TMGnAG-u!E%jc@Qt}>O|wL^Q$5329C)(_7u zoitUiUXIsa?X6yVz?B!Kxziq>yDYF;~EyK%C9 zet+rQNPYJ9$9L~kn+N!|Br~3zBqDq>Jg$$snQ<57H-gx$#}U*fMY2JyGBKv$x}wLW zNXQdN*xXKTeI$xfWE^-#C#@YTvpbx;5LX3ksr)!ADbD)Y8oC+KI0bQrW}SLuqnj~6 z5GcxEtYda!qj3gUu*1pSwH!H`SM6(>&^f8>*CD9@X+x-$RzH`V87>T{QVvvg^E;b!x|e%5GWUFcLtJRL0}0&cEs57*~z|8Mo- z0nNg`-&E($SGQkORNuX6Y~9=b*)Xu?HvER2Bo1pvQIic!SSB=+yay(Nm*9)_r5pug z{*{3%L>$GunYNkphcMmZ`mFJew5{L#8+P>hu%mUfW2;J8hS2nik(SD~X>^kIqSoWI z=+${`f%5C(Eqioj1-#aoR+hM|&gOEu!(Q&Xer*}e8Sx_h4_R9kb5al_mW{erY#mn2 z;MTfYJswaI!0zQF+g4#nHm{!kNo2CeW0{b)7!i?4Z}>?hVy!tkvg8e{26o8(+MiRq z>P-QU&lymV(l(D<-_RCPf_Th9 z{e)+fc01abI9cEiOw^fp&7oj=9h15h|iqK}`zq{incE=8W82gdv!|bmeoIkucQ#zGf zd{94rbAyn>6oKJ{m!X|LFGVo4&jmeBAMoL%(~Ws3+Ua)Vt8Q{115paaU9=ko49#FZ zhQ?eB+BsSs8dKsRVmC>Vv5B>9py5Eo=B1;{XBPQ^ zDckQOgdsqCP)^t4>nkSgHd7?x^a_DuEXeNBKR0f@nm=4RQn}W6eX8^1yUjCJ3&wx_zWn zhxn+>{>WLSLtYSa7+4#6SB^H%-CI1=IDYx>%{zw^#?r2Z1Fq%$%jfxDw-!{BF?&We zLik(fm6e0dH|Ls%PSuX>m(;eMFAo#HQelhR;$lo^b&?MQSqrL3xbR$VyccSyzVlpT z-_Adl9#xO+id8#kov!NRCV2w{>S8Mi?hFnYwm zF}%>cojAxSiQ*6?hJp^fAr-MI2>2vNmi^QUMJ$vR~2(aj3s_{3=`7Rk@oh?Wr8B9(ZCEZ)%FdaR%TVRkyK7++&cvwCCsC=|}?BwR9S+w*3hJWAOvUiBKP{or(T({;DLM{kyna zK5o@c_2S_Fwt4K?;=bh@&6$&>Tg`(z7mn5sTuA(`di+@S!>m*)j2GWSeTJsTy3qI; ze}T-Xgbb379P>gBX!nvLrjRMy(P_V605=xzjRKzEUz^)ezkY3GabM-&cgXKT^N*(Z zmnqj@W{ZHRT8!@7d0z@$y0!G&TRLW{|L~@H{asfUH$!K8OD3W{`vmddv`LC+P@(h) zqE-7+QiKj#gt&MFN!UVmDS}NGppkDC^u-5b9^A<{ZwEkC_~TJ`Rv5?5t`9gzVrF~R zs^P1R4MhzX93fxI$-kt9a24b1-Q~UI$MMBGr3-xYIMN3Mku`~#c&lYkXD!O0Mi>a4 zUG(2dJLYdLZL94U(ro(lfK0@#B|}9iLQ|uB3P&%Xir1bl@-|sG+Y;3(>-*L8ff6x5k-&SY0R%drC%?;V0LSk-PgefSD zT+azY@2np_He_KzDD#qWyExoTIT6fj#k!9K*;M$FRF_GW!zG3X?tH8M|GND)GNEy& zdn5Ln$KFp?-)#H8Z|2|E-^`Tme)YG~?O}U=T8c!-bY2vPtO}0HsE`zyP#Oy$l;N8J zoX$QvK|@c9fKf~>+Up5|ASoJyKPS40OV7VN%F!slBPx3rA1}@>3b|+9tpK^2F~(AS zLwjv5?6vl|P~CQDh=N>`X~@L+Q)SQACPyr}m=rO2gv%Aj>V^6ESWHN3ixv!0B$XRg zr?_3YFJqG*LtcV#$NlHQSfE*7G$o{nOlVsuq{t>rXbEJch{Ej@7eOFA&5NKZK@1LG zKJMVBS_p1`=gt5Qjyd=XMpt6lfF_WP3w>RjWyY|GDu+MqR|`#wHAjup(zCeQj-8J2 z#pku_$3I*l7M=`QcHXHJ1Kq5aY#4_@QxNL-)Dmv_n~}!r6SYT|e^ooPXW>Tu{txws zH@%HlFP67hD;Jly&F@`4VG}~7dP_Cp=uXWQHwzh`&7smzd=HBRaq39T2syl+32?rR zy^&KQt`aIicBR@%7i$+zl=sKKa@KD>7`00(FBUE>K5afe=36)-WODbeO+st6%f-rD z88>u6kBPJKZP1L`Wfmc?Weutv=xvLN^3rC=_o|0ymhSye?eL@dnIQ$%1l30MsL*|}@+@Z*Is#XJ6OBYHG_G(>$N7Ho zUS_t4v)?u%7c3SydKcA*Ti&Zd?+L(s2Ac3QR!~Z-Q@A0(VNqUj&fl2)RqgE7=9AgY z)jPL8zCQ<>Z%;XMn@iX0J9mkhl0!0p*SMIOM0}$6qP)K4?byPlVf9zm3UINHlpw(b zDqIn)`bp_1qo0UHQ;g8B)5mzF;zTARMa+|oKP1K^)mh!6#<+!nQbdsu4rc_(`D9_> zk|HS$}vVfGgFx@B` zTp{0!`M&x0&7IHZ-v*Z6H=n#}?7dricO6;0@m={zI0&eV&me=`nkvAZ!_@s*tovH>a+dz z-7o7G_x$GL+m~N`xHM{Bde)fRQaw1++_Gii{lbC9wqZ7u!l6j6pc7-;DHLM+sSY1K z?t`)vm7}^F;xXv9WTq!WYyO?y7&Z27%%2ZO4Gqdg?mpUmIzxCeL~8kuJ}uCkTJ4B> zT+lR6R*&c*nCy@4XmIf6y5%I+I- zPLWUY=eSm_W%zbnzfh8{sIaMZC^;S3m}d4EZK0wsm$8_Ne5PEhd`HCVFcvL*gZnev zIp2elM;i3l=d^Js<>g!Y1GO?gY;?ai9^uc%?F$2Z^P*4CNEI=j5H>NB+@SWAnVb=w zjjy;{McXIkRQHDE2bdYGWnH#>&K%{xmDRkH6Q9$#!DNizbp~o&FEd=@y1|5a2;Hh7;VN8yXrf& z*7n_q%&L{k>^9BD3)$!Lz_4Pk)}(C0s<-O2GW~b#GwB;xsp6LxhLzPeX8lesQ)$PP zCYenm9P1n#p;b)!YxX^ZZgn8nDD^UnQmwVxERN49M)U&35TzmRPfyft-YGxjZWoBfF^+t=hE`7MYPa^6Pbf-v>JJ`O?kycF z->zM`8>k(6!^_>6yJ#GlDqs9KceMHH?)-t}TMI9~pTElKkOPH4Wk~sFGc<-X7{j2D#t8J2LLy5DoWXD$MM)Ba3`ug>vp+5E zTx`Y{yjqw($g7PJ_Ou}kfV!}|^e{62SWucdtM6YDD?F;fG%8GPg-4z45}h@l4ki=s zpu0D%to*~$_WI22(t(BT%hwiXt2^EZWOYRx(?bbM`?|@h6&ID`UlyUj?>!o>Jv&^v zh1-{pl@2W(vPbE!^Nl^*gdv23*ie$Hy9qiGCn#fTEef4*JIn7=I2D18G8ciNDYKtr zIWl9Jpu;|-P3Ez}QH3irH9Dx#gHOT@vLUAv#xc1(DjUu`(~c&*_HjoTA5>tQ(;twf zhOpEOImm=Gs*zlGLrqzpD>k0pufI4|JAG;X$*-oe*820A+T6RpHLt#8S!`bjq+`HT zSW=KWsq>EVm&y`E?u(Cemw-KyF=!Uo`Nh#Xrg0g~-;P;}xW06A@-NjhH)==TG!I^{ z?b^Ngth{64ba^Kydv8<>187JvBu)_&hT|l?(U6@;YQidyWCpK_EPvmnWtu^tF8Ue% z!N9eU_#}-26yqagIu%9NUL0+{-Cns=y4SdSuK8$ZsF12&o?UwBpFcH3Wl3-p!zda< zF_Ixy%iKt=jxU4u93W_h@M*zckm} zf3U9wPT&kh(^gBXoNx(`hpg%F}7$vMr{7blKWC5kiMUBgsXkNS1y#MO&y($L-G{#Ug z6p_d(Di94(lwc?hd%sh7=}P(dA1gP?dz(+^n!9cXO4}NrL}tsY2rsqwv?6X?4Pp@o*pTLMN8aRu8W1^o@YH1&xm>FWTN9`jvaozLePOx&g`tn8PeX#Px zRXO4ATp9gi$m_(hTSgb)y-Sfe@vKut^|E zqJW|(6i^sJ(0Fe~AOji5kQmE08V1K7z?@iA7VVXtLUhMfx=<{goxLSH3D8yxSi0Fat{*CBJc0`!oa&e%+xVT^n zN1~@_O!L)TW>e{2>FIC($1p-vPBx#t8L2+rUAz2bXa|!kOX0mjqjOg zm10mART_TCkk36IIiZLv_!mW3rz15s4fkyOkmn*0sl7^vNqd=6rt*7mDy{NuN+ zTH^;j+dz=IZ=hZEj=Qy}vfF{lpJiW4?CEZ`Qllwvmoh}L4xafcTRKs?{&Du?{OkJ8Tk+btt(B9%tKPd?J#)LU?d1HC&Q9GIbG^p$x^!L` zhd_nFu#@24?da)T6!xQ*LCA#Bf<6)8>z$Tms2=t3V~VXAhSl3!>koD|&c7)gshz*N zu=m5GaoNIsv^3W|dYY?DdOH?r6lXA!AaMeqD28vi7uJv+jgJcN_W288rB;x-i5voU zZjXhN3fwC0v>gfX?`^eelmZweNSxu1_qA%x4pDUk%0QeXNeU$)iqZre)FsPC@rt@n zQ39uM1|I}s4rmm|Ah!34#JW)+_+vIL?re>4RnkI1K@V z6C58@pJfZi0EnU_BuJE@DTe92Y>@y01t=sirsL6R&)_}<#qxCabEuLGKxqu+IEL0- zhAv)O`xiJ#W00Y6fvIYRs;F{8H_aK&YraJPU(?>|l}ELMTdH?vYiEwt?w)PlzF6D! zHsD&go?dwLp%YuPk5{o@X9f^ksX;KvI-4Xg1_G|LkkyxySkf1d(qn^lX0ub_#c7Np0g7YYdoDw+3>J*S`t)0hUQq*_YxaG* zElHw~Kv9yQ85+gV0lF>00GfaptF;F`#N!rm^I=$w61e&hWHN1s(Ufv9A7HpJnN9kH zFNuzX2@|83nCR&STt4Qp{mHO&Hk|%0S--w}J=>4&2V9yhA8PEF{jFnh`-g}BSG_RP z*m6qtJ6!S--st2#|%bA~|h{`X1&1t4j@Fk)UBN+x@1j>*ofipdPiJ}LO+7NXL zr%*uRkRl;KDGY9;FEQlxSq#>m%1gokg22c@CSr1xEDK2fRk^nAng~t%6=Ah{Fx^E5 zihe7a6j5D8F}+38kRds<55m%0mDxzJ{Jfv$0w^F*ie?C=yW#@GN-i3J-kJ*lk|0<2 zsR!3w5*()?Nzy3EpoGv66{;=@!{Lg41gs7*xT~<}k_UQaYHJgscKjAL|GaeSzZ$P^ zv%GSB+Uc)}#m_8*bti-P4h%n^dzcDWTJAX>0Akj>=s9 z`O)T$E3yyQzn|Y-zAh-$=?_c{=cn^VD4lXVJuZCK@{46W;dCrGq8Aq%#W<5TZ?IX3utq)9M+Cb`AI>P8Ho3YB zxm|7zXBYz-?D+xp-6txC9gd}~-_#F0u3g*q=i0SX^Ou)rYP+uf>D$WQ`u#KYxjpmy z1fQYP>MWD?;VAU335PA1?DjEke?Fo~j(3`h?WbIGwf4iPyIdhpjF&dPw$S^9;nVH7 z#ph?F$b{849h&Z(0}mJ#IVmz`?O4{qT*NyiMSN@SP7!>Y-?Zj6?vGEWF%&`+!%=_{ z1P%Jr(^)Ps&MZt51WHl_3K#}J8j#(|>6|XZnt%xc$8dn+G{MjWSb5i=;B<;1Ax)3~ zpbUxwj1Nv{07c*w1dyg_3MKJ@$mqtfm#qrdxaER;7*P;r^Jz`OoE+z2JEIF)U;etD+KtxT$ukUjm~(Bb7kQX}Ho1)lV-I!~;F9&)wHIjYPAab#gA7u` zLk3stZS8KU7@n(l9rR~ zR-dmt8fiaiwW9>VqMV37iC0ouMkX4&dPFf3o?wLqT{zM`LWEv5H#zIAv?TRjiIczjL7xc9|JPNU8;Q$z1UY|_lQCt$Zs4TFz43`JNX}pF15yklhh*p5shm}8 zWlR5)t!#g!-W&03VBc*YQ!-JMdla|*Q!Go1G0t*xLT=VMgU%3VjhHA5yt@3~e{8@S z@|W8+Lcn7W(>8U1HY9##i@<-9O8u-=95Kiuj=(p35w}_?ttDJGsT%pQ%n)|PeWEq; zOYAipX-60%7PFC)q6uf)_xmO5^T8K1BiL;yC5AO7XvQDYF{#OdVlo>PvnrS$-KuDv zpcu-mSgjJ1X-bjuMDx0FDPkW91+Dp?o9c^WDx4ZiZMgoU(^zsmpi@r#Qy3hik>Glu zm0TZq++@>FJJg8{^GN@~Ti@kM2ckcMEwL&RQ3y=MrATpXT$zrvmP@i|kr>xY5wmQ% zbs<^F0s9geI=j+nw-H$}C-CaKCEmOM<3 z#A2m&tqHF?=nJ~r{$gzU=Jx`Lolc6e)(H zsaErDa%_?!1vUC(4gfMevEiLx=MFfgRB6`;{xe$y|FhTj=S@=W7@EB&DX{T-oUKY} z%}?>EVBbFD@g^ei!iuI5b{l6Rk?u@LiuIiT?mnN}eNx^;B*GneqDD0NqqP5(&oq_Jqfo@vh(KX>}fT^Yo$Wp(A8^r8~8|OItiv>#vr`w|rOr zxdUEzIGv5QCk-h=`Un)Kft#T)pN9an$AbglWEjjvk!}LezzHdUF;0(%Mj6sWV3fxR z+z_J)m)ql^*J6ry?_3DN?O?-ITmOEt)^@9T1svj7+~eJNI`Qg{y)nMsF)&q+vRG8H ztW(H!XHn3Pysurk;H@8>t8ckkJ8>nm)P-Y*CyOYKrWgYsvCDp2W5>n$r%Shz&70R3 z-sGznu37$*4~cERj_~^VtRN1Z_{52YqqS#S%Deunyub1GiTva2n}wI9r+-*@*Esud zVXl7aHC{ivt9taP;3eJRc%nqlQIbqM4LLp%a^+Ee#A5d;bb+8utom1Pns=*toj*Y& zRYFoY>kBXM3l_hbe^}nWxV>@xg`)ZPeV0a5^>~ZOCw2e+U@~hE@_Z$TQ)SW$Va*aG z;?R%A2z!isYjzDyDPbT%;*i0pjqS8vlg6*)$6e&q+|gI%ZQ>$f0A(ecPh+G8P*x%+o$=ud0Wm@*}};LbsNo~vA}o!C-)`F03l(yovYQ!GIMKYqmOU3z}& z_piu!u^3hm{OBxfsVh6b4OE}qZ(KUMbgXu2Pvh0e+V!*F)edgu1B3dm_v$8Swh@? z(+j>VL4sj9zb#`Jdeu;dgWo5Fi+7)C#%#*qxS1c^h6B&vSvnN?&qDL!8JDrTW6oQD z{H}WVM0vaLH{E3#bGx;^$ast&(qrYBnU7`t|LnbIcVfx4H~#*9isOE4_w^m)Id$qp z{I};K1PBm8M4=f!V={=GM6ms=&N=6tgF5$gROhuCCGA8hJGeZqSf4%r`B|Yk_hRKhk0n}ag^qn+c{lp`!OD~Q z8}qj-XU57q%Ws>f-WnSx5C4jfK`!-Eym^aS=ore7ye^wG1d9&9hnA5XT{2jT<*^Z` z9GL-rKF}0`OlV0>RE{VkrD7fx&f}aVj{!LX$w+iK<24zcWDM!h48J&nS;Ak%dRY=F zM#^^8?w-{A?Ykj{!KED0sX}}J9?8CDCJCh+vDpEi2NXff8W52q^fX0=CuyO@3cFIw z#JJrWf}V&RG0a3Ur)5ICp9EcPPVx#$z{JFyM0%w6e718Oj(9e_`B8n>ky(u>_?;zb zLHZB+`miTcS!K`}6|NiXvG*@LD*rU~JCQoQhQGB^`R(a!MrdPKpJ`$mznM?+-1*@n zA-~Y9tp!NltS|&+i#q;Y_1UfZizB~kT>IF3x4UuwLv`*+`E_Mi_3}~S!YTa&gwvr% zdO);TYJRue8jXv;DEF}nt8eiwkPMlO7Dh1_!RJJmA*!4h9igPH7(#I-j5E3vY3Kh0 zgzNB}T-???bGf;FwtD4a{poqTZ~g|ge7HIL;q#lNT|*8>49|;=pbW9aaw*3MA0%;I zQnSq=wA*Yc>qpOTt!%5DXq?~K{CKi<`~BkE#-m;3`%C;(OFs$4R8xisV|qy=h#;DY zq#P0Gc`pOD`U(C(b8MBCF$O8FSKiHpP&7%SBw+p-wnyup3a0`NQgU#rZw?mZ%V&lh ziOHDTrJ;ppq?N~VtE^srdZGPjv>+_+GgvxkEHWj#4jVPu^d>pt58KC4kw^_eqFFiO zNtyVrNxvCC=^9G{{xT{a+X9_P(hU^ZHFA6LLh2#j;{c@`N`rCPz|PXtIz~-f5Re zl`Nr51%Vs^1;**5RrX@BcQ7NaaOk9lpK~8zVbYWQG~Z^fHu^*&pyKD(5zc^YMaqvV z+nRUoEkCS0n7^K=&faQVIa|B%qI|LT{`JZoQ)Bn3twWlTxG>~dEw+o6CgPERPPpyS z`30z3nC9Z-Z(c3@)Odg9o6oO)SO0Kt@lg3}YXp(F^BRA5k! zL{bqk*CstBM@Gj;Z_jZQ8TH~!Aj4;Yk|E>J%rE3j`H_(k<@A(4Dmv>SgW)s<;pXJ# z2Z^EY$T;sFNdjP@NQp)1C>t9Lf7_XjVI5m{nv-X_wxqNb)m&=@hEx(@7DN zc7A-o(I7MB7;=#NN5DE^_|9@ePJdX~xp1sJH^fk9HZVf{#Z(uGQNKq*)Y{qo%|jP| z)i`{*vi(jCjxzs_<;~_EJQxQ8qVLT9idr=i2N+kffi+x`h_d=qSEAVx<-Ff`&tUf^f zV(3#rzZ-7O0EhB^7=;mxpEu|L5AxGCUkK43;cqapMmR$T#}SOePIJ)S*C!lUSKa4l1qJpPCxcQ2}4d zJjgdX*U-HAz@!n=NA2IHToYqDxkantR$hk|bBU@+n!s^(Vw#Sy@p=ML~nMzzbAOx0r_8h39to*a?YE^_&j#h||% zFOJmj&MrKzJgV*eSUz9B`0?)?%^Zj+@P75+{rM**fBuK1YxP?vIej-gwl|4E6vGIV z#wdn@6uv>8K#U+6l%z2R(g2V&!ER;%NMkW~TQHG@<%2Nx`vmQT{ni960%FW^;e;W= zbW{t-$#~qu20ksIQ>?#iGh|5+7qFf~Lp(C&N5@%3COzAf>1W&;t#k}QS+c=NM(AkT zCdR&MAfZw5&x(9$5K+L!di$7Rhs#m2eTkb1C#?LW*+5>VB525(Rl~V-BO#4~zbn#l z8};-tIrh#FSGGN@d|^ zsCx9_2K@YJ4@XwW1F`1c`{Ev@J7O5rXV#@h4V&ZMqv0`<8qT+eI)@?T)oQ6hr8Qf@ zK-6d**M6h`wN5}qrqxt$m%hA@uHQXce*nHfLBGD2<+TsVOU9+s=|h2~@{jZ9T-$-v z@wdY}92Jnp0Y)=jYWk_f-o|>Nn3VzOJ6SUVV6r ztL>8XSTc-)3_;>Fj^ThNnN6n_D@_}V{Jf70f#JdX&r%2(l#>$zs<1Z4DgP+K8rcR0 zAPPy6zx%S*iOmNm3ZsAiZt2?mp2pnH{O5;5^cl@y1SD63B$@z_%a;3PoMJKz1q8_u zkV8@-oS-3&^N8%$ zwDk1lr5%e87cVuoU-`SIUmOGgfs!N*XenM3jAC$rp^S7S1R;gvIE4*EYeJF)jgc5Y zX_R3gN=vhv&?rU&lwk$Po#d0=nn2y_g_}V1553B9oLAB*D;a+;yRUd+r3JA)+c$OP5ZINI?J+P#DvLDaZS_ z#fOc(A8Ti>%NI|5S3cZNw`3G(*;B4z<7og*LqGyjTD4?=#!#B10ErH+To|=#iU5N$ zI71RR#3h;jTSS3?q!^YO4H%&Z7|n!JZPT08A|ZK@7%U*i6*N;CPpCD*Caf{j$e1Lp z*TU20gL6ygHNT-o<_{^|^G8>17w3_U%v($K&S{;$ap2@g<&tv#C1(*Fh>xrMY2|qH$ey3yJn}B=ZJxil z^nUqToYUb$NAU!~07#-Z)k+mYOe%<%Am}0?4G5Yh7z(E#jloSN`%gP)IIf@ImC}^M z+i$7EFaU5!f{ zKye&W5Qj8@QcNGRe-gz}0>@ZM(Ozs_elHyvbB{{Z>)46K^IM^S22O>4TZvbm$iWAT)BomWbjCxbx-*Lhe4TjE<- ze~lH~S!Xm%O>m-LVVtB9m7Tn{4-nwr9Gy`osefM`(!=%hYdSZ%Iqp?h!p>bW4}a~ z2M;q&RX{k@mfYqHbgWbe^7ne%pPmek@<;zmhuAK-(#sm-j0Q`3r%PWl(2l4VST;1w zp{ZnQWVmsjM4fOV=~IMq{Io=ec?j}BAT}?(HL9C7Qsz)ED*7I2BV3OeMoLEZ7)WM~ zGPp)P$QSy{oAsgYso{iGx@OeQK_zv%N1Pg^#Z7OHxc<;shKcoPt5*s!4hn;cYxCKM zNypiZI#NY)OWB#Y`n8jvpV!}=`g!hQcgY<(87G)pJu*=f8QRJ>3^GKgnZzgfr{H9W zUztbI95=ZnnWZus#|5o-TuMAEpucaqlM^LVAn%86-orJo^7GsJp|kV1D~}g11DCAPzeqojmFer*a2rxK6=pzFVgOCO|pYVJw z_Q~r8i+YlZu?+A2bz4Cr5R{xiPhRxL!Prw>UTf=Ja?#Hv_n9OB1nvqNWK67 zSHoMJAo~P6Gy^G$q=>;|9T|l(C`OB#zbxv?OyPMOSkku=o z3~$oQkQu-$;P_5L9ij+|q)~d1G_eeW6hl!IPKoQ!mg1Jd6i79q;vaNrQ|O9(lwwfG zFc=U|4wvtwtJmJdLMu1=sgDe-{!j|g5=UeJN&%XoAe1J&rZF6c7{&~f7$$InA{YWv zD8@jBq@>xd0fSNmM&ppBEtzm>E$(G4>9~z(b2P<G`2kl^6zbKvICBX^Nx)fEzn+1ONkY3PVYfp$QTv>CH@4>NR1;&MO-wc?Dxr(5(d0 z3pj=n6ox{Iv%T1R0msl)yThRTfV^XXCw+t2->l6kVto_Nh`85)Q#1}}RNMmB?$7-- zvwV5PzO=8lcUM0v3?NMc8V3Z`+X`a_mLF1t(a9i8#DIyC;_M!U!9P$I{dV)IgghTJswAZY(gmDgcm=hG!qRk7qIr2q|n6YSMg zFG2HAi4Q7hDDEl@)O>$YjW)udjwwlEkYC=Fc8!Bz0AY(!tmFp+iQCBmD(D2ah@AlZ zu6F*It@+~7WOtwItEK-+?s1cbn^KZYK}8end;>y|E^trUB59~J;1$UAf1`QaDt?86yh`i7!+gZP0rz!XewnI zyq_l1WQM;~w0o&g;9JPfWO#rZ zjSu==P$MBpK^kKZ+v-SY&2j`UOshswhu*x{VIl{RQm*?z{xLoIN9Cq9kkj)U2!c8$1{}3H1KFuZneTImh-lc1xljozp%fr-V+dD z6wQS*=b!AsAdNu+N2PO>GC(pYq-la3|``G@xj72L*|>`FTG#9!U8GhH$#G)(lG&gxASf7@p#SqYNNX3Id7(kO7-|3~`j4#wH{U5knCGg%s!NbMHM9lm-lqqGXSp zoiQ|+6`Jvl$DrCism+L(q3M(|r55=*&&aM@pr>0F_srijmd`hCpQ`S;wz99EMIta9 z!%z$my$uqBL4qMshLE&J1Wp0KkPIB$8nsWFG8jgZI7PvJIlEO?7Ns#9?;5;bNjoeo zc^I)Xi5qjr=l9ItX&ioC{-F4F=}7H*ch6*lXAbpIyM0oyMjM@`9`&6-H*OHrPZ{$) z>W?^7g4$l5h?42WqOz1t_DL{SU*ByU-1W!ii4Tn(dm9fAtvsrH%2)U8%2%Em8lPVN zK_G!)hKmHy$uwG=v1nfSpq*zl6~zVA1SDmv+!K7=6sKsDi23S$3Nk|_dx=F*Zk=`} zsfvk97nAO|7l#_xJ}us;y?HB;QaNeOiOHg-6CyIUg;`rc#d(;!`7;OL6)1}1B}>G; zj<&K^4wLIZAFI|tDFTqR)t^o$(nu~IbEh*QcQhOiB08(dC`a<4aMX|Z{N9AGTR5Fr z{o&pgXH@qkB$G{t<6YM{9M2{YO`@H`LlS`&Cl&JjU&8UMKOJy;{m9?`v9`6wW@zau zagl@?Ig&SqjWZ_0TF5QJ>I~PSpPuV)V0}Ldq8I@HfifrtQ9xlV^V6xM47ua1H2>K< z<)7+zZv0i(+~2)H$GKCFL7ZX;64DHV;WR<9O`60a$XWtdJbuMJwkn3XCPTK63_qx`D;a(zPL8Z21DQ=sCHP=D>qz|9zKN_n zSe|R%c)hZ_e6sfNgQM~27K^3$a_8yNvm14C~utxlOIl|D8#v#oLO=98rXd>nguPOjd z;24ErkcIfdVq5EO&RgqGj+I~44jgS9+V$_`R!(hOOHtP9`eFH&ZTU|9`s{*xa#W@kqEl%K`)B;K~^jDzCvA=^Cnh$RD@IGwy6S69~IKQNJ9izB${x z^6a;@xmOEwmHU5fzInNJV86ZGvb1$Q`zjZhe-4u%`vDi)LM9GW(ayNCTkS9q8WKLg z9HH4x7n>(GHi}M1`AwVGcU9Jkrh-1D2aDK8`qE2gS3{-Ne`Vf8Jnr|d&S?pPQggz` zVVCUSrFDBl#%pT}muPWI=XY-T@69$Tpj_Ot_C_d?h-{I!xPH5g$)fH6&lwPR1$d4C zA0ct=aX#qJvV9LZ;>l%-p2XTV#5(lh_gh!1Ze6qJtt%nO_glN;E5|Xs^_Ukx8~ro> z^uP65!bRAP!LaPcodwC=UXVm}bPy;>4$*F>f;3S)F{&KVF=S4T0BkHAi?=2(-|jPKqMlptNllQby`T$Ca+f503-E(|Gsyo{;lo1k9Io7 zzv`kV)8UL?77cs-@ywcg7;y(8Zdohe?8yaW!EjdQac9C_cP<-}CEb}!K9Tmx5jM_=H49$klyub)YvI_Q$iGo{=LilwU3BPiGQwcU0zXWnyI6w$UoIK;%0$6NzBd zFAKIJ1zE=)%GL~GJ8~@Y;_YEw&aEU(y}-xn(Voz1HKd4w$HjIVE0c zZJa2Rr6f_KHDp>_?;35idkaQ*ZU5G$ST-fysht0xOuOG=f%eNh;rMElo>^-^)_T7B zXr%LGZN*njxERQwDh`gZbFye%FIas`q@nc|Hihi}e}rlM`i%cAd8~y@2_18Wg>+G zisV}-_ZRAtJDJRUyRJ~9>ouiyN{j2|h#nM6|Eo>|t5e#ajE24L%zF25bwUJze{h0( zsSe0w)9$Q4*x8^>C!*1CJZMk)+*$wn)w8xT)n^}6k3Fd$xmUTqvV$Oz=EwW1F4meN zb>w8}MeEai-Dq`Y$nTA0aY;bd?Q_eAYugVBUhB<2!9ViZawCK! zOuZRpLq#D?D2o>3%!!qqOP3b+EIu1Ts0n+q$fvLBd~PHX6VfJkzqk0bx%+AL?%U>` z`;7y;s@INl>aMZfPy`@w8gi~6Zo-%)#@$k^O_akY8k?fmJ+j(c0@-_}38Yd(MdN1@vF?q{3IJISY5?0h=|M(up8 zO%A`?e^zgwA(qblroLyNqPqRz()-4_xy3h)k5^ZA*YDh`e>xIh*wNf`Q^@fq!B{R* zMy1CSG@tmsbtWp z-#UM)a<=yRk! z^2NUmA(alL5*9H6NHjcre@as2o0?~z)s9_jK77=CexdTZe*S@eeyIMN*1Ob%+iEgH zk*D1whAggC4!Vd0>G{{CYV1G2eud8z7_n#yO22Sn>h|Es{M+)Y+Lias+3k$dx;$Hb zccJi~l>^Nq!?lQAk1?zkZ*k@sq&IGGGIpwIjtOtanXRJIR^^>pNuQaw8zGK zkdK1#6xTQH%QC5o@eATwQ`F2W^oKK}+#@lYMRh3cj{I?I>E;IJ&ep#zzo_5cQG0d2 z`r%^z#PjmSr3Xu&bY%17^YqHL+UqOBtUEJ|mrC|! z$ZRp$Oe1#nj~cD*#}S29t5n!+W1BBxpY8GCgl_es!f7>F^;(7DNA{-cCU&U!#{6)S z+QzLvDivz&xXP@s3FwJvOk^e)w{|ul|f-qX|z_G#nt+h zUgg@*m&6YX4EEj4pCvsGN(?%p<0g&P_@mBgYwO!4$i+WDFq|YBlSwnK`cXNqRT(#1 zrryUNHYDSy)}m6{OcvLVR+Yt}RjL$9rO9p_R(%IO&CyF3t!>Oc@|8NQ=b4ouJFG2Z zx5LaTi`8UQj4PB%mDOr9=~c$f7FzTK&2VCy^ftxU=~&_Um<>qQ?M{VRySaVX>u}DH zQffz)U#b5D=Z^-J%%U1KD~zLx9~Gkptx;jtZl+0=IJC5J`8KrL_BqO&^h+5FL`5epY2NN4iT+fgsQHlZBFUY+u!)cU+48SGfAt)N7DbR=P z8Gsh06-G&n2Vh8&!YGOb4>SZsfQo-o-#%D;+BkWcn=BRsTUb2CQMN%a7ODqNeSWrh^N;2UPTvlV zqe`ME1O#Aclx|TtZwzVyXCR8x5L;~tr7-eehqhU4Ar~|)EFYw4tJ!^xHD@dB4gOf=~X*AyE z(S41puU0NCU0L{P`iI8TSDMAcCRjasS|DN~ljz@>Y$l=683N#eUZOhF*&Qno36RUOS-y=q zgV{fm^k##sLc%rCbsj~4Q0;L=kp+Rd0rxT&0mb}Gd`MS_8HrQlZZrqTkwLwoVt9(| z#q}%d4`m#^-Jh+gwsTnFxqzbn*Utr-*} z07K&Z-QYE#mBsrjJGqgcG{zi7GJql>h0!>T19Y=lHPA6z5ROj@%E#SPfud7TJW37T zeGX+lt}O&>D@XX#k$#LAH&x{!j9#xay2AjBAegUyBM zGduWn3n@=V(mezK1*^;NK%}VvLKMeo67(QgFe)^Y@qT`0dpvwTpF?BLS`4{ZSi}ug zQ3e0Bhy-Kqacf|lyQjI%)G_yvSlYX?^FO|+9B&?ZUzx2QJW)IJa`{wk_q~2DD~4hW zMq}LLiGmmc5Ril%6Z}NCkNxT*s?_!SlJSetkG#OXIr=myocVfB#2$}(c$I0f2zKnYo6I& zpZl0->_55m=pTRiCq`)k>_{g1f2!wRR^RR^&$<^M|LwQwmEDuy)ZT7ey4W{Dt3JB5 z@TvM{Ho5QwlyB4y-ded{eesl6sdi;ssd7=a@Kbf){^fh~cYj^mzO#ID>0ISFe}P!O z%~`Pr3HTbvkCpc}uiss{v3#@guy*BwX>m@(VI3m$lVLPYqL6}sByki48;t!hj6xwp zq8NY-z$u2@Oqji?beLD7#xmtS`)mwd{r2hognjqExMp)v8?bR1eOwFx2uxRPC`1V!Tv z7wA(IHO;*IP+mLmQ+E+!+cTQMP;50s01#tH8V-+_CZlNzqXEW10x$%Fav<0G0H#5T z1SCN*I8Kr{30aIpVrXU@SQ3PXYPPNk{y@O*&B~F*{nh(t>$`R>pIJFeR33Lh6Iqa4 zPv$RdSv*|X`~Q~rmd{l0->&Rw-re1NxPNgLuiS2I>ryv$ztr_)F^s?{28A>vC>-UW z*L8Npx^jM1oV7TSRioVdAS|S{GtCoss;B14ujWryZ{1qByR@zL_{?w0dza5Pu013d z&U4-qM?0f@esa<%JSLHt_hG_Oc6lp=yEdq`2aGQdX!K9H`MM<@8)0_~Z zH_ls-g-s?ytXduGoer+sYHS8k1|_;R*}!hHRhJtj0L21I7eRJoNh5@EOD%4%ojC8a z)DAxVruOt&7|BkvrUC23E7py2L{Qt-zwu?dZA{qgzBKMl@v~&>cU5m3Y+gOlym=}r zd|5|ldc4)Rd82V~d;R0y#?!gx?)%ky?|)Z$nq4{ZUG44t+S%jFw;E?(4xlP&e@V%V z^Hl>*mejnWLe4tjF-~yuJ{=*`30Jb0l=t@6j$B*0@NME)ovnSiRJ-wM z5Z%+dCglhd4_nM>FD+ChhM~yT4uq&C;V6pY4BbbO>L(x7?w(w^TRvNURKIyBviNMI zx&LJC@Z8UHXO|90DA`sdvT}y3@4mFMy?W$b`BnYiqsp1(W0hm`hpR7-H!ogYerc-Q ztnE6zRb2P-q*6-x>M!qp_q+1pg)56^7jG`lqP6{d8V|PpM|lm3d>G(B)(H?Pz(D?f zh!8Q5jSINms7$yC(g$l0qk4f2YO=gW`7ncd-ru<}?I-#|S%i{q5e$o5HnAFXhU39+ zXRr>G#aJR8F0DFeQFFql=+yA1{}+s=2hLXq;UMNNSk{3mU@J!#^JmjxZwCow{T%tf zanvxmcIKiDebQAJ_l!U74*Koca5P-%WCbv~YkJzq6RgMo)-APkz9sSDm_L?C7l-*a zg%A7fSUBG860C(q(b6Sb>vQXyDPpK9tK|Y@70z_-r|{u;aCJozDt+9a?Zh;Hh|q1- zSVM8qw%?J4Z~;a}j>J>$AllxxQ>HX>r08lz$NxJo1oNUZ4y-_l(YN5Ravkg|Sto7K zYEkAdxMRtv{}0iG*WGpoLfP!PK~K7~A(p}SxV;fSH+Qm@v*0YEf;9kH%RO*P5G0<9 zc~-+A$Vviq4yJJawzX7U8(RyDS}{e^?+pjSt7?#qu7TBvKyYHiLU8_zA)PT<&TXVL z$@)`<;2E3C5DRjusJwQkLgjR6IHiV^M;Fy83mE79En7I1)H9qv-R=o%XgudAQORL& z)z<&#%K_F_<(qL%w|4_Ia-_p6@e5628lTYiYG@;fx$Rc{V^hBXrdoR-{%7~{7r~~1 z&URZL*ffURbl9}D4r#COIa|>i4NfyzhvT1spf*ub$&s`tp`JFTEQ+>sZ1u>Iu$>x> z#n3hke^y80qjDq$>9q5ImF`~+Ty5>A4i2z3Ki53`0aj+K2M;el{d~t(J9c$r_-eX{ z6UdQ(KNxZ;y1ujkb&W)EALYkzK)bzO!c8++fQF3Q7a$owgE9d?;9jqv01(9};Kcv~ zfjdAzj35G-ha|e^xe^hp!$6P85z6fDo~|ys(lJ+jbtZL+etCGduDY%M^Wa)JGEJdW ziFK04UyK7e5={A$-JZ%gEpo)*K&iGj{$CN^EvAgmjE%;l{JXjAoXx_S#;xPO`&I4T zef83=`FpjUZyM)rH7}k1d2ZVe;;l-daS5*H_eaB+o+(Z^_<&p-h?Xmr=S%w=PYx{H ztXy5W@sIMg-+z8rzxP1!iUc@I4_LV^BqoI?u<&t+Z}9I6bv{8`a|S5@nyvp>zS}&$ zFZEsh&2?}6($3o3Pt~{Yt7kvdXCE!!{%iBrA!YO0SsNF*U=3|b1{ez96v5fe{Q789 z(r7W0>4`9{nx;%6Qh+fFXGW`6U)5jT5&J-Y)wWG!&H8bP_Q(E?eEziZ;G5d9d*zqk zG)_JL`NQSKlj4mz9ce`%GKo(K5g#N}TS^&5gcwLNWHez(iQ$mx^D}&mp#I%VC8f~l zmJT;B?O%9e_&?=Gjq|(1OZ%5D+p^K+>)%%|zxu6EHVMEf+e~@o3>7L+gzQqe90xDclyAT zAc()^9S{)dl7I_>9O=~hEazr2EvsO#t&#X#~LH-TKKA<(LFHMj7anqRC)kjHC zn!dkMo6t=r?3z?aCr3aasmU1hx~ND!)3{cP$q`48Kis{rSz1Cz$CSdOwizoG_L+Fa zoK1t2Hlxr3QNs^#22dEzp!jBMf`sYqnt0=g$K;+YDfwjF2xp#UR*o#piPY#d!CG3O z*6|_uIuCLl7arr|we}s@l0WVqk7*p3-$2U|<8&tLGbfFxe@JCbV3}f+kMSo%Mhb?Y zw-n1nG=fL*%!GG_QSy;Z2hi~d9~f7LFjIVx-a%D;)Mg(})sF94I=sC9 z^Zj}LB8v1GQa3g1p!vwGGbTq|VScxAriVFEnw-ht2~ylO!cc-Ha0odh(f@1+v#5fe zv1RiTi&J3XI`-}2E~0W&-Q4rR{=@v+%)-Z&or{OHwdefFv<8za(OmW5%i8XfzS{OP z)z@zp&wRId`}Ygm%5w|n{!rb1{^z$>hFJYnLi;a6rqnvMP=92Ik_(^I2ia_jqUbcQ zkgM@RednI3mO{tk0r$xeCS~xWX)V{=a}siM#@Bmi8=PY#zT_zqhk~XqaJ(`bWpzD%WH>CGrpk6jNy> zIm34e*G@CoQ9J(*2V2-bESzh;dKRnft?v2M__*Vb_3gvBdM>Alh}sk?AvBi5J zn!1F`11qRFHPyUuD>Q#`@oIDS@XGPU8$*aQPD6{yz=y7uG*xIsj*JzpR=$--5L#!@ z$`Mb=j|rEolpG088bawIW{BX74>{&m#UorKz`me=XtFdJCvBk&%6s5U(J^h@+GoaX zOzl0|F|D!al0s~(9X?&Z@L^@I(4FW#T9e_D*Q~WqD@2~f80aX`{55_JuXoais-+^w z%B95v3wNq#_f_VWw=0)s7j{?n;fp7P5k+s|P_F>pzVr3G$`g^A{kyL&9$S32__Ta` zh|h__Qclnr>-eZ}sgWUi2e6LDt$0!qni$Z8>iJ^JkR+{EMTp`!$nYN6bgtfpH9s}( z=LADNutxvc0ns3SQ(lOO&mPOTP&K6;r9?3>;rAwl`q9T-g7K0ZQ7ZL1kBV?jhGLkckR48OL_;g&37$X6Gdas|m>Q^e95k7*U44JZ&_>kW+Bp!E->qkib zYBPXSoIv?rqzsv&is4D2Q%+84`D@l@ddsMvwB&G|5TKbekDq^#=ay!%>W9a*n&U$?whxB4s^+^HEVxyt zA~D7F4TgkV)fZjGTr`^CvquaByBbJ2Y}`xyeeuDz2sSV}oi`TuQMQaXZgJ*a{G4TP zyruTbftYa6>43+VacJ$n%^7%s%hF*<_Spd)QW^O(`%A~159Z4n@?w_sW{Slx8FVjj zP8#^@=0GEE)H&=4y)~z#lDg5@kV7xtg}P+c#HSVLH{i}`r*2X>=8Pj5iEwTbe8GrY zl75PhjX2y9 z(ItP00DR}G55n@eR;e;tRsBb`uUJ@G%lC0R`b0!cBYBgKG-udrOzRWK_uUJ_9gvVH zn$r5la^Dgr6Pi~ONqLxCgAE$8@b>rRBegR}YLE9|*9?q07t1b7-C0Zl^)0Xw_? z)zQ-kfUdd)1beeqa5a;{Xc|)eu4c*r4KW%AB+afT052eL2nmd2U5eNkd>X@cFuxLf znv7vEhQb&U|K-L6LkR#$9^!}qKaFnTr_r?Zh~OxWktBsm0op;pKpbOTs2%vyKkAB- zP-tC7?1{8S0G}p~2B0(goH_MWfQZL!!j{~bQf6jM#B8RN6zR2Z0vsF9h!1tozqW^e zzrOKeJFmoBzFa?cXW{b7#nJlf`_TZU-{>Ny)%?KYw#Dm1Q84bzTS%f9j{0$jFl2jUuEy!`n=efPQV zYR|U)pW3Ah3%i<+KYlZRwR}n-LL!}?38_&r5yCTO5OU*M;j=cDnZvA9>s$`YSU_CV zjHIBk+O6BQ{jZje`)0R3l|zMb~bjOT73NZX7l=o`P~7RMIakF)n6%DGW#flu9wu~Yf34M&kcko zF|KlVQ$!-5Z!C2YjlK(Up+6oRizZTf<&*+7Y>rRPsN5OfOlpjO{H`qm)WwKY)M4@Q z_e8!l8q=zBA(Zd!vqLhC^Gn=wvY4GV^P3;YL7y7V|8)a>K&ecM_ns+}v=5rPSQ~UO zZ5R<5_RNfv32n}ZM^z(0oY^MB-*DSN_{AE-QpT?Pl0gK(ssjAzVxU1Zsi#~C&uE4i zZZPwC@qR)13D{nPxB=WoMb2z<8z#BQ$DaMZhTG^ejxbJk*GNJ(P81#FAno^;)<}d) zMjSWjh7%W{aN1?ZlGB4qtj!Gcg--Ao;1+NICjT-{)sDPto;W&xp|Etrva-`xKKtFm zwaQ7`-+lqmNucL*AIT6k#?L;=klZAg8C7%hN0JbWlM{pxL9sRKh)J5?emfePQYkV8 zR7vo+CD)*bs;~EsS6|(VH%{GHzWs;ahN@>?HeS7|ogD_W5|TJcVHm(Mi~$5rZ#HP< z7KTR}C)r5`r#%{)4(a$dq}@?E100X2Cd6?lwRi#NpO#q1Xxg>B?Kdk&s=H4#Zyif` zW!@n=2!jL-Fbo9@M$s6GZ!RRIubASWp`jQ){0M2pTw(Ucib!&VA|Xitj051_8>o_| zPzooB9zd1soTdbj7Wbf6dx)4wlFUcdgveKkQf@qJ76+&FHQwK-J-)f{Y5rv6$z5mV zP2({;_Uo0K!BBuQlw=|R01BljfHGWYW?^my(vTz}iL)JperSaNV^*gRx!RooQW)I_ ztq@Qc2^bb%amQ^85ROTYff?`3rR*WMyg5~op| z=1%gpG*J0k_0*?@z4h}Ce*Sc;y8ZUj#l@G6^G};sKlPRbpfpWUB*p=ZToWW_6qN%* zQ4&K@nnSqV?u&3K;1rduaqVXP;K}Lcr6cv%cm92R>B0Bw)%pN=4l)n(yuYWWN^!{v zC!=vd;0(YAL57t92xyXl6bZ#=TnP>~DV|%ib{avtE$T2 zP;>$=T&&$cApdROIY*H+jZp-Y%)OxmMWQ%Hp?#(tLC^$&GH{3~N74+60*XLM9K|8g z2OqTc2}lwQOF0Jv2ptLOFf^?;V06ahFR(WTdGMOGyH~fAZ69kB7{;v1S2#x4ZL|TBWMFb3feJD5+by^`%>fVuIi0v^$Xk9>-^&B z!uqGZizj|4U#=h9(R_QTaqCt6z}e=ZZS#AoclX!cKKx!=Kl-xz`b_yoG^NV?>X?bgXI91-u=+Lc2_aFeChj@gO#_Hv(1NxR&La;y=)%c z0&?zLcy~AdRC8%3w5(k|arT5ppGAJ^SGq699)4 zAOJp?2SJh$C7B+GoJ54tMW@w+88uhIEn?90`ch$B?9&v^5Cld;TGWs&Z3oR0xBpsw z_ICNFU-vU-fT2;8VJNz{H3JyQK$?P3+L!?X#Zf?FLx5US1j*nSU?_&983M=pSu&I& zQIbHVaW`9Krq)&4f$%t8xm+sLJr^R4ujw_;OsxqiOrWVoba{P-P4h+5VH-K=Wm6VT zdTki(wz3fRMAB?}S1{%CbQ6Ia2-1xZ9dW9eY3>2gzF{vrX(k!&1_x=kznC)-SC58z z@jnFPBo)XGDkkHJ1+9aK+KJ0!p$xZ(9htj>3nz5HT6(|uqJI6w{JD|osLRDZUQ8xiiK;L9u2NzE#xc4*dGt^08=R*Qb@;`X5~7 zcb~71E?*iV48&;~r2tAYB#PlQq&7QFj;Vlk@P5e0#%K7MueRAV)8qW3ejOBJ0MS*? zpW>gzU+X1B<@NmKZ_D?Vk5(@||IP2>)w!EP^bbMOfFN*!q)7}=G_kp1a*+2o$a=jpWiSkIMx+yNj`;&=j>2CRDCMYExg)$gJG88T%owbKx7!C;x3QucTCbT+7${~JYWB#Xa z{Y8VLwd45fg$)A;kp-PQLms^|AN9&cNCHb2{Vbzx=y zNWa-f5pY$ffW+*Rkr>KA$Y6b_G8jnU6h@=NP-Ord;0!@Qnq&x+U{GlX63_r8C;+fN zG=O5ksWtDI8W+ZuG14?js|Jf%JyR2UVGAKfgNl?YH3f|(s}5QVl3{D@$*$(BqxCb_ zD~DGuR!^UbHs3s%-_6vH?5*uMxOiu}{IPtn>lpvi;q2D`AnQjjmTxcJ=fZ%9onlGN z@2$VR>0REpa^UlW<;S0I<$nJ3y#D-HbLXSw{bM#_{z>EAA>KQmpIaJF9&v2LKvAxy za#6i}rulAe`QY-c^7ZQTYxVa#8W*p8er+^zhH>Z!7sCL90g50=iXZ^SFdGYSWh6t; zBqVSKMFGP=eBcOo5cB3p=~bGjf>#;>{)vfLF(qmC0K{>km2e)w>a|kC03%RT-0Gp~ zDQ#*ni>HZ*m^&Sadq;Rk=xj0h2 zeZ2okNSa~@X4RXJ@HGHHDS*>VpHp`Lq5#k+jSWFk0ci@uNeZGQjxl&YUxTFZ)zzMj z3ELw8_QWtc>VkSKnGZ=-?%15=J&T9`^YfkM3tK<`gf2)CQ?$=zjrv!Io8!^=T1D-z zCum<}K~@igyI$L$FevXlIy+Fy9AJev38u9(rxzYoef`;eWO zCa9S&I$}P>Kh!8*Z-`6Att^8WP+f+SoWl zny~vJ|E609;yE^*nBd2%UwTT3OsJGPKJEraczlnfKM_x7>6&#%^>ezo%dN;D8#=k(q87HlZJHI zmEhlv>}={WG>t-tlf6_Sf|7c*ldlaZzv}Xj@tkzjDubr!GSJY2ksvmj{@RggtTbf<`v~b{uAv%Y~ z01hCt8g`L@A?Qs_bQzc;uf)wS$XMJiNk5fDQJSW3d>}WKU?_@WAjycksW~^TAIwWd zCv$2MKh*(6zAB?o2rvrkL8;c*_xjh3S8vPv8&{s2o9DLwrFvmU^WLlGiG%fHcN#aI z|9WxG^z+9feO*?7L6pE5f|Q~yg^(ag$Z&SF#e7yk;{agX?Xf;SD}z!LMiDqo0gR$y zzx)`(U?@#PtSd=}tE{`IZ$f@2>TvU;9~Cod)H-cc+HdAPF*z>-qA1P` zqHq{W0*F&oubsnyebQ%g=@`?1Ou76ux2<*d3``oJDU!-5R8CAx0|CiEnplk!L{+eP z<@(>753kntU;am9$H)KIPt^cKDVm@tDb`fLppYU_6i7!$B)}LzksJi9eyJcFV@Lwf z7*5eBiQzQfClQMgBm_7sOdIS_#1@*H=;35zmY)=x4=$|S`P0(V%H#UUPab*oz_z6q z5 zb|*$s8j)nybgnRAB^@v(@Z-c2TH#<=BblA5UwFOvV)>J4M%UbVXKU@@<@Jiccq(e? zSpEIAzcg>nu3T9BSbqNZh2xc5yecHpJTU7s{y0^6w{)le@?!J)p61(=yh^#|o5Q*0 z`;+x|JA*6dDu?xdsh@pXKfAs8YS;3+>WNp?3%h^*bYSWH68Ch5SjMaN>`3$MT=nX+ zrRN;SVxSb(7VhwfC#pmPxo~Dv6IBdh zw2ymvgjTN5ZrnqwIbaDZYsIfyxikfCXk>BX!{g?yf*eK1SxF_Nm0bUdhaiWuba z+ziTyd_Nh@Xhu~!Q5(E+s(NK-?fU)Nffx0&Zw-dp+`XkY{VXvCAVD)Uq@~Vu0F=T3 z3GhA#)LP@q(A?Xh(xw>=dF_W%A_dwJf55 zCbxUh|GyXsu5Q#4r&iZVlP1tjkwx_>)Irm3Ig+!$ZU{LuS&Cs}@zr6rTM9GLwd}VD zZ7w|H*B)t}sITsd8R{i1R4;h+DrJoou#^U9&_o=Gc9rlPt# z7c3&!)7zWxchyhsYdkwOf2z6n+5Ft{g~qeDe_whrzbo1}^>+SgcQFy6-i0WG zku<<@hQI+ubGomSC!LC=OZ56r>P5fXol?UvLbjPv*d^kWkldTr{b(II2kzOljs~-x z*D(9$b)RMdP4;LuL-JbX-^K3JGS0c%!EV{2=_&78i9TKYm*k!N?@Ht&N;L^u$(K#1 znq)bwzckY%PJ9{DWc$j_CNWJ8!i|<)jb2;-m3b5KxZk@fs034*IpO1Ib!UG0$EIYw zMz(Oto3?c3?w0@73NIjT+OqaWD3OS4k+&EX*CzuX8gQK^H|Wo@oiI7#$z_V3#G3E2 zj`{cf*43(8*Vd5Mt}pWaR{z+P9586BoR@hp`e*#BUU^S%Muhbd4$J!3S?k^HwO&-4 zr12A54mO9Huk(CU82Wx8-I8u<p?Dc$gn7+mpz{Z23by;39R~m~;wxzi!e$KSRK$>ob^eNt{aQ5 zdO>4jSp}=1F5E7=&a}m)4~i|J_liL&cF7q~ zML9)9V@^s|GnYR*tI=ski<4_a++R+I{ohQ7)BcS47jOYv5-BZX#*D)yM~u<)6TXjfdq(DIYc%^z9{l%BHuE2C=Lh zNsW2i#~}lnOhJzLv`OFps#t#xY`m4f{RJqnJHK>r2JFg1pR>g)y#dl|BdV4oGuG*; zLS(wTcPt>iru`m2@X>(8aKgiol%MjuAwU@)1KmD~AsEJud1yC;e!q|QQ&_-D6M!Ur zWFX+C-0roVwc)s|^&saCh2@CdPzl| ze3o9u9L;SPo6nv%_Z@3IdR(7crc&b}l9D4?gPwcEN1D1X zksi&$DW8ge-gaC&qSJGeEPZJJJ;4$d=9MXpspv#M%FT^+KO~e>w#jkfEM!xJUq$N= zFV|k(sXQCi%-;u<13$mH+kEk6X&4$jlW7D9sWoLt0_W4obR-L4eCS>df7|k>R7ku> z1YJ6g<|$s$=m^6rv4L13hAY$D`v;t?pCrtZY*^ z&c6{-YxY)-Decs#EnW=dg)hmF5!~oBF@b~s3vU><&G9VR%F+U$Eyw%mDj+`2!`3z5M6xAU$pX#1tEei+{$ZBCSx`dKHp(WRL z%qB-@d@2;l1V)CK@h&e8hMVxEVBG8Bl_iz=Nta2_D-Aiqmanrahn(5mh=^~@vJm&b zS-G_Iu6FQ9_4cL4>+PTK52HOjtdzzYmyn|V@%FbP z=|4@?PTrmWRC~T{eph4PthfAR;dJHP%Jt`0@yqni^-rB?2WaVe$A{`lGL-CX*YZ-G zAv_+Q5-Rx&DM#Ygi6qf`C}V3e;D1F1QAH@qR>RIwSG#J4U$`+ufLz{fnc;Jjbf70_ zZ6unbQvCJt3$Y*gaRdtu0EY#xC_};lWa)fRNmDWYGWj)lOL{OzswM(DSfa9g)`EV( z4~1#rAV>4DLabokoPq8kulN6F?>)QQNUr?h_xmZ@vOQX_4ZEwls{?i&kO>fp2qb~W z{*RFXA`*cJGv1>-$~k8$=PZq~&Jh8o&oM~f;yENhp%W6t(RjSpE3v!Kb-V7ZTle0s z`u+UMuyD9OQ^CSQBS*pNDUiwJN3EZuWRN0?PJenvNGm*$l96IKEvwbOkl&Y+9J-{M z5Ek6N7;9vKi9`t@y+V7NHSMF5pM^95H7XB3cI%Hd;o&ZCJz*wP3S?(dm&Z#2O*p3~ z^4Y)yUigENzypQKtOXtD8XSlhJ*}75JYeMNQl!6PSFh6i%Ahc1PPWwbf@;UPHs!cUFCly zZcBheilAr+zNA7RK@cp0Jj_xdVgXB0fF+1NWTOyg2$BIf?^M1R6%f*pVj;Z_cFTZk z+^Cu!?6kC1>?OxDxiQ~VNa7@Re)=aSu3S1?d-x`^aI1FmcJuX?Z<}{-2parn?dcWm z9|ad-^YM$N>kDTar?)rXJzUyt=S>w0`1c=}NELF!nvuXb>2^JZ%q+5=bEi zCn-cjf*}EpdcxrMID3sK9H#&x7#2r}px{3XAtpBt6QA(>bNNaA+41Gwg{7OzJ4HRR ziipjlA&@1en(5yy=Nu^X&mfyye5ZX7lWoHHrqsHvGf6PP<6-Q~j+PJHGFbBK$2HCxR0F`uU%;*7Wh8&HI;^?^d@w{kHn#b?x<=@{{t- z+_!T#>Q8p|jgbLD06+lA9wbx%2MAGApR7eju{cdZikDaS16!h3In-E|VG&JJ0QRAv zVo91tI1PoQZ@N)ym_uODFXf?F9Id1y+`c}stc_33P+`45CpNvb0nRP4LFNhoxq$ta@C+ zT74;_6e)wl?9`Xyk`}x97qt_|bmjB&7pk*c77zX98>af=+R_1@Uy-y|763r8INl@2 zhKNQar0L!mbb!VoNg%)sK{6yG5uy>mA&D5U5_Y5B)`}QFvn-dGZ{U0oIsI-HSi}jP zW74k@U-gdSDa{ma@(z|kW|**BJ898r#ZStrtUZyq7H&1(&3=6LmxXPMmp--m;z?!m z!^Qu$)}Nej-rN71g?r8IN4{zv*%SRm@Na^4<-NQMQd#1ktM_MXFL%i2FIV3jubsL0 zi}Eq1esSkt(hHBj7Buw*{d2EBKHNP2cz$+nXXRY|`k^1*-{DR6LGr)F3x8JpW$q1Z zTsT%cdg9l~+L3GZ=d-_&2%v{yM1uq%X#`esL6#+Gc73TJ%dqT9Cb*Ia(ljDBiVuyY z0gWISh!0H$5KB@*Di)5~H2O(fM#5cb6hM`W8nRBeMCTzkgiE@t=GMoS=7l4T zJ5OrgZw)V}o!_-hYL~A-)m3WmLMRY06(6P0?s4>gbV__XZ2lUafYS| znt+gGD2k$bud#?CNCMKFeGF36Xx)&t?7dpFUC1Aoj(k0LYkBY7mFE73^M~tq-dlcn z{at6WtrPwoYO=gsqK&k$sY~-vOli}SqV@p}MC$;>4EuUV#^sPvU zsSxS%NXek>CP6UP8FMZ)*0?)DX=2uqwfsva#Z5;P3aTlGt&^ikenbV_@5b$~Yrc_~ z@ZvhZtg%S?+geCS6#khX)-q!XChQKlg`cB1AJ__^lp&@y@b}dY`GGBHwBaK~A%gZm zpV#c3M1d4|+&*8jCPSlf;RpZr@XaLc?38eyRKE|Y8R*NG0%CQCa~q@WpgQR+2~pnL zL=mIH-Tj}b@M&D-ECOLUgrjaHVT^`9N7v&Zl!&I8aLN%EezqM*;j~p_FuNv)Q@K8( z)C-F$tr3hyCOtx9=%(;>6yyw^qRGhLLejS;r!R7gojpr(dS;MEw~KMPoMBX@&?O@- zFaH*|BDeXg_|oog)T-vIJC)P(Cu?V~sG27pj+gH&JuuX6UFs|WKQ7IqBjyzDo@~WI zGi*Zm8NL+*jfRDo{GWoLb2oIG>j$1Jov2bc%a2UEq z7Dp6C!PR_;CfR=6=`;yQL{gkmK)YrXHFsWM0|4n$aRcSk_OTcSG6)CEAdto~0;g8w z?gD8%AnDe4T8hato19V7Qhl-n$r22UprolRzFv3^8vA!OAKqF#_qWPZFh4u@xb}Wq z|3r+XD2iRtM0b;s0fwSjk|Yu8or$f?IRtTLm_&?31i}GH0D@o;!=S!=`y^rk#Nn`f z`?i8wIn7>4k2mU9ZY&(F?Y-@8>^)HbzQaxY z<>BJ@Eu2!+?|fIeD!9?yvisKy&*-s*v-2t{pN`JTkkR$<34?&npF*rjII9l

Yy$mu zdA!_{2`pS_oVZjycxUcz_4&bt>(wg{{vzsEl6Il{h6xqWk>hqCzSXM21UfMvV=2$;9*%y!jdAh0g9T zo+l*$4H1Qym0*R&5z`&7oM$c^CyHod<+q5YNkp&=H3VEafDB6$IHDkpvlJvL9$YzO z0mG6EPElwjw&uOO3}YCAVi^XI1Pc&F^Sdo(eA!q=T;6lrGbu$V&Hb?0uKH-~pCIw1 z(9l~TWS9T~y<^thQN%x4c-O;@T@SjD1Pa-ea?Ce5%`dV|<{WY?A=sflIx$J5tdnxg zRdjU}755bE(LjFnYcjdY!piwr8IL5?$+#zySWR+RoMc(R*~ZL;D*1$azvpP>IIo3c z^*uis;N4fbrQ@cr>szlZ-=#j@nW$W;zW%UuuH$IA2W|*55ldME(9x+HN-K3|7Bp8{yFfQS2Q69I58xEbI18hAW)(& zjzHN8iid)rYz_G)IaX?Iz|bhn(Nb8BrQ^kcA;3()ADNJ2)^YC_wL?p?po!%D<0;1m znq!;4cM|E=i}<_}8}&r{TWPQk@Wg+;QD#G`I4YF>qZQw&+oKU!3FA`fNG2eQMSOuo zW-Zo@dV*1pY;`-7Hy4zJB3YT&lZp5|xolXL@?9r(CAZ}Y%C-5dE{8i z*Rw@nWrTuSP-3;3UJX~}%@#g2S$n)U9QNjmsWJYI)u*cSfTU^Ojm}%glA%aqWfa3X zuPnJbh`v}PkjS_jqO9%RWNYrN73_0GX*HJ=CH|?^RK9c7u2I=Ej?vWxymdDj@%x0o^-cPxbe$H_ ztVh@)pk;AeGOXn{@<-CEQC(5yNk!J)6O<;6c7tYYb(!#|JPE%?wtCWNwNb|`(rMC1 zN;g_loF5Z`yVa*KTFCpoeTVv!PEciIH|r-N)Nihkfgk!X<3fypOT~JU)OXbS$YWkM`7t9$f2onHjJi+OG>pKnjQjD z8%NW#HuygUFT=k*CfDr6oC`%N$0nut7Fy+<4P#g6`0mcXUfc>?JjV8!AzO;zU25?w zOicb{61gX*JrWWbC)HEQtYP#glgle16cr;fGr6v`6ZVoRmx#7@&~f=5ERHW#oN2%I zI_oq4N>g{Z5{>9H0k2S#c35bA`%23b{zw&_w)*4*AcrjKSW;5e9BTM#&W}|I*tAKG zP54|6*OxS{jpyOPu=Ge)ZK9%b%iaABWS7l8CYM0Ts2@P1q(JL@Q& z904hxllbYF>=dMla>y~gGwyB;ykf+>O1F&TdS@%Ow9BzrDY6Qe`)?!UtfO61Esql~ zSV|eK`6r>bTbm+-B^8kV5xDKFfy82)GD zjZA2gQxQ|v=G*WZhT6UgRR5FE!LEwQ%s@G2@V3BdSmY~sr>4}jN{$(nCQr*I$6a!) zXd9;oUy*Lu$dKyt*>+%lFp3#q(S?xS@I{w9Fs)^GLZO(9x?Mj3Q<$=VB7{la zMw`ye#5@jN%08l&W3+X3%hbP3N{SDxJp^BX5RCiEgR_EF-Y(x<#avhiE0`&m@yoGr zymO{i#0W-{kRSsr;|T_6l4XKk1tkoX}R)rRv+51Eo#6Xs! zNCbxcp$y`Xfe`2K0N+^3vd(78e_EcfLAbS$2bm_t^b1_<^yvJ-g&Xr{KHjaK-7$YZ z-Mn?Zx$V5Ryl?q%_0Uc2R}#PNMR%pNiE-Lji4yWz+Aty}C27m)n9>k=tyhe}&z02j zcWVB6{pD_>Toqm3(R_8Oe&ptm;)&p-TbKO>wJ{hmO5Vfup-duRj2V;NgwN)bUc1F) z>nVI~_T2K_#}%Dixrtlob*Ga`)(@&2u2|1Qh831LMxF2_Fr2ZyKT^7cRKs#kV5o?mQUJCRhyeM{h z-uzAd`xi^IiHXfabU5P!#VLRbxgS@NNri^H>a#=Avf)%}DlYbU9qIm9eR;02{m>Ai z*~WmFK}&|Y(ZobpH=UK%t;lLJ0h7bQhtT5r9nFw#p__RpQ!%|!j#0EWgS&F%aHcH~ zaHA|WY#EzynZ!(Y9j(kP9I0Nt2CJ zijX*v;#lnF&6fGMl{@w8j~0$pPDPy6(}$KG{JDImap&SNMqG3vy(J^=Nrpv})&cD# zrWT^57RKBewcwheyCF^CQPQ8`B??_g8-EVT0-I3#Cv{_a;p&d@75M+vPd$$ zi@Ec2+tgyE^^Rn+!dS0$ImZ;l6oacbd}(54+8q#r6nzqVY+^h;%JdH8mba9*FTE`` zwmkf0bL+m}64eXuKHeQta2WHsN5xD|E4Oq|FAmUF(;lxYFXYtuB)FOM`sfL%Cvryn z*Yw{bOM4fO)NbBr?mGI9VMp5>v5&A~m%5rhFp-h*sF2^Rbq`Myt{f`_0_zvtm(oH! zY8j>xQw$3erHzd0LmKb69puHi8h22|RG)o>qF zizs`sl;)Z{Pm2ZbkzI&5<5s_oXJA^bx23JIh}Z+ku!N5EPA3)7F(J}mTf%_JBc6dA z&fQDp6N}Fl_UjurKCmCJk2LmNT-rBGlHo||mEH-X93!KQnA|r4r*+YZsTnOjW{_hk zFP?D=3wRio129P{Njc{7@|V8e8On%iG;2`N;rMWg4FqZ2Ex0Byp}~@!u3WuJb0{&I zrY&AMhHSy$C^9RFP&gbEYu9T~$*~ECB_yP8#IT$~j(H1yTR!9L9^gY&#+ysIH+;I; z^x`0!Q|Mm2@Sn9uH|y_)Va5jD0-=o*y09<@rpJ+W<(F~42jT|PZTf7(zmA9tn2 zRc{#2&xf}SeZj^@otgBz(&dbPn3M=@cpJ`kGlm|Df~f7qXfmyyQaHu~&-b7V9a6i%gn_|Z1^$TX`GD>}Y0 zTDH2!r-gxVTge-%UKApsK z0jtmDZeVC1L@GHmqko8vO(o?i{w*$c^Wurd*_-vd$N%v0S!3VMWXGh2Afc53f`u%k zNUAST;0BVO0)in41`!O`?TAoLDGJAFmJb>%Mh2u9oFO5>a$5VM&r^zobTJM6fIg>7KZ=fMH1paL^lf7C@RokR~Y9LnShZvowvk zBRVh)D^v8D27_T$&4glBz1XQ_koa0IGNSy6d1yc0oj+Zw9k?X8ymU#^-0`^lptk*v zt2TS1a%$;xa`8ap@>O#FPW8wZ+n;);a8gLE)mzuRJgXfDnRWRMt&*e?`ou8WG=Up?1>FK-`$ocX>}YQ}V}pv&%Gh zo%%TY@zIRDv3*t~t0&-Bm~>J?m6FH`3KBdoEwLuzxrj+4EmSTTaTa>YwE6GLvvbF* zJD--{{aMU%W1Ucjr9^_^Ow7*GoIv#FuQE$F-2hv*DWZ<1`IYQ ztPUhBa&yAXjPG+Y3cTQTI7Qj(KoM!ysvL(FuWq>5(4`r5=b}Q!i#FPR_b^>LpRk&6 zQ?WQg*eIJ=;YCYna$^*(CsM+AzkOImwXu1{CMaS%;%Hj1whgIik9!JeXydw=XflNi zp3o3NzPCQA9?g0QpD;yi(+{zXW4P>uimIm>XGp8JGh$U6@d&vws%9sg0by~njsDwmhNR?}ZpDPAZwud6J)5B>xmYYaP4qD9WPl`TschU4Z zIEQ9RU&bM|#jGvzsKa}*4zW33wo3;>kJL}r5=y98^>EUnK+0LPgGdp@nL$M^ zP204pLAvQLvL`-w5)IN>yH+r5HAW`+ z7kLa%-;{6F?!5b3`Azv%W%ts)>el^>2Y=r@eXe^M1piV`RwSKaB4ZFfqLmOw)WRJ;?UQ#j0|1TFq|hU*v9{FD9O2Z&`@c4G<0uTgAGYm~j(^buXke6>RUN-)Ub61+C zih_tD2*C8H{Qv^e3}PYT(>sV6t0{_RAq~0B`cV!MEDaD2C`6M05H#q+{fcOUWGD^- zSj%%diB6cX0VGxY?J#0fAy|Mznu5eYhQc6*Kokvy)Rk>R2`8rGgBeLk!a7tWBhjf= z(kL4H4#t+A%x!I6IWl)@aqq&;#Vu_4;HKK?cm1qH21uL)6wdHCxddi{AOHj)c%ve= z5{TmnX9fIK{j3DBBqRY1SR4_E>_z4WQ&abMc@6<0JcmI9y=Hiv$^6CGo9N;yQDnibG_znPnjV}Io>t%I-G_kIwQmybhWvhC~pD0MRT#G7ypL z<2gqxL$Cy70c2@JlkC7GQ-k=oj63WwrUe%TG?OwcI&EYaxA5eq%FqzMXSfs@zGncI|`7&z_~K zv+q^{n-aHDwnS1H_>^A^KsQApiUtg1NgPl#Kx|*SDJrt`sCs#uy!r0%!kxJeO)a0S zk7j5HSc1S=mOuo}3{5d5LlmSDN#G1kusDOGAvmT80;gCCvMj{_8jv)}W07KM#4vDW z#^H!W6yn{KAxIG<3n`o>S%##TfjFjI5_>{uLrm>ZS*dX5lQP5{Q*E>$Y#k(1oi@Yp zA9X-WxL2hqkc8j8+VF>*XSUH!Oi6!W#iMd3J{R}OsKxuUCjAu1@&7UyG?GB^0Ky*w zC?0}N&hn*!;z?%czIj0LB*|_ZQ2g59OQ5+iKLa$kVX)@Os8f!`qlwn&+mdq3tSx}n zCK)$K$*~E|mz+=&^fWQK;gcyd>RBIhTg!dMJt;}OeR4^i4W@Fe#bEqPESOHlvEPrc zZUp{)`^mp=wOnnns-yIZu--^wCCtdIJwUd4f9004eW#@=8K!k3^O&9D>{^v!xFf0O zZDX}L@}3#qmH0&7A1a!7Kl|n%ZJSc9Eh+2pvi~QHhsedh6vCfRj;YNpuNhTav({9? zD957Oc)aj$l?YYxndCczfb6dJxUq15Yva*c%wi}s^%LOysY7{UA|}UZPcrC8{oAyL zGOeEi_iyc02gm$t&K_I1V2`g4^iKrw2Z8|NI6`=U2?9Dmk|e?UJwcKT_!u9%k`Iz7 z7(fA%W&NxlA%>zT5AC54pgg44-zl;LbaHH_pilTZsaHsjDfLvb^R>L7%G#}REWP%< za5!KTyDe+k-0IGYZYP_>7z&+ZP32Rfo86Bu z#iY)P$DCwol8K060c2PfpA_yRS;KN7f}fHTDY2HWS8shNZ(rU~zKq3}k2Ux1)@*KE zxnF)hjI>jRShyfHTKx}$OSIb|rE6d&8?pwc~k+<3Ti`K}lRqPtKY98J3OVyFWd zW{)Ulv=bSLJKFFBkQUQ4u66h(dWiV(b@kkNbL06n0v3cK|Zmlab= zT=KMgPoo?wnd~WJFWKcwd*)s(-kJNZv~XS3cy{ySqq!5~e_o$HQwrJxLN31;ZGel- zQofV5j1GgN1HBq@m335jBUm(9T*A$HZCUb}us2WZg_{bwq8Ms7@BeS@=n<3sk8?-n z4>nG|YhHiuseeDrWM!waLh!5pTFD3vjfd2=_ikhVz50b0mEB^O(p`|ra8Z1KScaKH zAT91qh9#yW!bz|Oq%mTQ2)F0)j%aTE;oSvebNi`G{nq!{%A4N?8@un<_C0MrdJY5M za7eO#zL2C-{+ZrbJ@YRlZui8v5l@NLO+vyAlC8_*aMI=$BO1W| zdf{O6%*$VWy!r9k*K=2EcP>}2pPAd)yuQa!y>@EpSpCE8=JA(}_b-QhjRK^iuBaH& zvk#hwx)g~N^aht-julmtC9BZw^+Vg3H0Ol+kYP5RQMk4Z0Nmlx65=O`t~e4?ls)bc z!W3*I3Qzz{_C{kJUAkDmb7WedGcjM7){r>HRqqV);x;;w@UWgN}9j|P!ojSI( zzj^Pq7-pllHMnQQE8)s@dSpTxp*KM0d=BAj^_yL|(e4o93CS>xJqm>p-T+foH5v}i z*l@cLk7^@lp#slJ&8yCsH{PH7cyswm_2Px``lWq|+M(I%{)_)xeetk<|4!}ou8+fd zP?H!Au+O9%1*xw|H9`=J=`qqoZZBay5KEw^=x#iyK8;!t4? z+AEu|O96Istn0f+8QUML7oL~T`sN-t-`tTey{SIjJ9mZk&ma7&RLsyz(CO(?(I-5l z@JSlIYSN&yX{CUcI|BWx@#Mt+3zSbS+*dcB?p*$ENC~n9DZeDc?AmnHz)FF$$uMHd zlE`aBxmVwL;ml8gXlh)JC7qKNS5!)?Nja9ypuBB*%28AaA=CP~pK+)*n^hKDfOd-j z<7HSX6q^i?LJU(GmM8f81hK(SeO*Uhr_TCU4rKr1?RKYTp|l0PD9>_@Shq-Ew7wO z3XkCN!i=qRZ&3zbRSS^8wGZS}-A1lL>x=9aZ5~57? zoGzO-$uXk@yq0>LF52Xnc~C%N>)6zomoW01^JaoB1BSHOUNR@N!ztILqda3%KZ=G& zQU&XHR$PeUptjaeoUUA+f46X@ar)9MQse-pnSw>=$Jag^F?nDSrw|>HnE7XwU6ot&dq2Kv>^arg{$&0} z$~FIi^*45$`QJGqPG?U{d{S(^GHeq?bwR!q>Clp$$czi215-U#f%zenDu+gZ>slSdzWr5-CMp_yY!)Y>ssLB!@t!Y z9{SCYva7vnaSFKV6_LLV3+>cN}MqX+Yq-Hn4=o3p1Ihh8l2u3ZqX_I;ST;#AQ;l^PL; zo2yFjWT#W^xKkxfK;}0{eVAT-7rQ=S^;!%*N-9s|U=Z)I!Re(-zsl6^KJYcqov1vh zzB=AGxV84=`tsfK`}s4K3q!sTjj~fTlCC*SMx;=dyRGoN1!DJ(+U}FpXJ^XymJT9@$OecN;fi*pBzt!F8YMiD<5`w^3a?J3V*_)I>z@7B% zlM1@5a{$!DLC{B3K0 zBP_|U2V#b!$&!mo2R}!dcH!63fs{!I2#WeDGD8acX&<6Vd4w+Ti{Y3C64^jHm5yWr zvRK3yNMwYc0NR@w$8~|AEzI>E-M~%9N4!CrHfg8-!0JkJM~Hu)i(Rs`y>iL>=jzM5 z<%@qOMjAKwG+tb)KYiG^-r>O;0_zmgEKM^waGkKASs%} zS%~*mhYS#qp=p8wL=Sz)0L=grkr1(*F&Y%*)aRe@1V-tp@w83sXGUDg2$dWRkHBmx zi60Oe*#NLpp*J21HDGCP^VFM#?MtVYxA<#E?+ETTP9Isgmk)itbg6dZX8p#Q`3sxt7ccRYI6UM4q!9}t!y=j_Spvt=x)29s41f$p(+ojT zB*by%p9WBMB4am_GX--&6`iz-o@vVRVQKmRtD3mgHZeMA{nj<*{A}aqvAM(b!}~;? z6~{)VNYilC-#i&+%tA!J)o5|$E(qfI-LOtcG9X>lcf1-Bp#AxHm^Ty@# z{@STyw$_?4ZDeo1{6{N*&RRBF~moM6xl7d2{U((aH_SPf|no7HbjgMr~2enA%RF?!Ks~=45@W{jI|aa(n@GPutA!4 zPcyiI%@%EVGUbyt*iaG2{l%FPt?+x)XR6<6Fxtn8bV)cW92=O7lbH}2`5Z%V$6d5G zk)*V~WNKY$Y-rk@pBT;tq&B_Ev9Lj%oXAc^gWb*GbHPw;{t3R(_Xk7et`j}6Ih7Wr z#e!#y`iVRq=+eosfT*UVDKTMobi*nYhmkFzHxZi#mKrhRGgHJs9jqnj2{g{X#!brW z_pdJ;s$47Yub+8ZeQ{G)J~~p{e`0RO$WjM4>qmnV4Ld|fS!7r&6Dx*t<{9D9p4N+7 zQllsxu>@G*?N11yhxh(hNrqt&xsupGiegxD za9~jW5J=#bAr=4vXNiHpJ`suIkY!0q;0fEfWuBzM42=aI%2yBAvY83~;@%o)V^X4L zKvE1v1D2GA`CNQh-+5SHxx%^G1;3G@S(+g5UZgt!;1op>B(Ey|QPe{@vL2=+l+n8SZM6dvDp3Y8z4Z!+L>J^0G(um-1mU2$Pp4KD- z3_=V;GiVSPJQ>L%L;@V((&jWdm>IcKvA9VJ6Ev$(NW$N-2nP&g2_$Jt%iHQN-X%T% zooKv!P(Gt<+Bu>$moBR$JtHAJ_{kk=`VJt0a#qI_K5c=g~DIAeBPS7NQ_XH{JLBd4S1b_(O z6iJZ`%YqF>DK$>JlFqRr;UkqA!7XGKTyTc^_-DxCt4O8HApRN95Wp4pBjo#NJLnOZ z8q7uGP-R6D9$HJ`g552xo()rZ?TDmzt{*zmcabM?NUdVA_He#n6`Ym?u($JtIEy2O z;z6PJTjasY5ED3J5F#Oi`XG`5ilGRWL>$c1ZjhwYk-}(cwA8Cz+X*dPYs{W)9N)Tp zrn=|y!sVs=!Tn|4J zrF9nGK(aKN$xTTY-$F6tj6y$Rr8ju*2N64aOnxO`IPRL;im=_Q6NyCe(3M0KEI zi#0boB=3wq=Yd9GOsXbK86mSp8)Gmynzu8;bIiS2MXaNojmn}Lz}$iI9lUw}YGv>8 zQBF2CWYRxWjvCAeH;=abs799%DzfEBX$p}npeW&X$~AZT=klfMp zx=yk<1b}3q^tx^vY*km;b&hZ;tdm&SS+jDql#FOg8L9puy_(tLxa1OF+0u7~2RKVo zbZ;64KvT@h0?*4XCDJRFK@?7sfEi|qhb)aFlB6gWLKfn5pZp3kEF=KIN#R;fX*4@J zL-{)~TfaRiGKzpSMN%}6s5qI)>aB8&Q8@)yTR&m}4G0F{V%lCX93Sx^uGxT4@8<`juDB*EY`gaDER344dlG8QM<)i9f*^g&7%x>3D3kuz}3UXa08 zPRBmp{$ust?)shsfBWIx&9AsUi0cf}rGjK!R8zpPT*xEAxm-xtGAT;cv#PLs!C%>5 ze$+U6y1MQ9pK520d|N;BqVQGue!Oyj{!FC<()Pt^PwLNhB$lqtKN=}tBq!#dE?ir@ zT7P=IarwKfpy9{&%iAl*tGnLRu3!4|#}BnbyTjGfZ!7$R<5DFFy87XMz4j&Wzrm_9j-pvqc~&p zX9|lS=J)^b>U{0>z3Q10^)0)q+io?F9sXh24hd=B7gOX$RB6p%{%;e*Y?APR z4yo;s`h;Y7(fs~-El423faG91Q_peeoq6h}T zVca4~LIN<5Mi9{m&{V%tE(Cz#=%rgR0RbX2?hPq=HEcVd=GkKlZ>x{r&h4bDr!LJu zXuiIHf3tXFVQ2a9FFHS8AIC{9G^Q|!LI4f{3BS2g8%#LVqW00CmQuL|J@?$Er{Y?p zc$-=E$bstZH`RkT7LL}Rzo>5A*0_9b{&nN>$;OETGmR&Y$|prKsK;hTJX7J30?!26 zTgp7H5nV1cExy&-P-e1s)^%>>!?HFle)e=LpPrzMvrajdbhtt>9pzt}w-OvIG18RG zuk}0t{|Z5~B#9uyAcR9i1JsXyrFQR0^XeDdPr*Wx074wGIATb+66g$0!9qiT0J9QK;Vb}%mv72eX7Nh&O#+&Q0H+B4T?)r( z5<-Fih=Pcw2Vr1wh>p0(G2dt@5}x{`3Niai3-BKkkgt3)#Xv9^@MYy#_3ruQgS8#k z@^hD_>a+Jhb<`??aXtlcPB*^&_};qsU2Xq^`4@}(HaA`!X}&mHJ@tIZ z$5P3Jdc4>QUraIZY0rKvE61pDGo!S{4E}*996sWTTGAysW>Do*_ST+7+!0cjvSW6a zyp2=wg=QP$H;-iyo`;K~oQIBl3yywjYWuZt`=JjMEK2I(imZdzIOg@=jQGn7A z`_ww)$;4!yd`1?}L}d|AT-MT`to04ZJgr9jrk%&ojHYvIB@^_>(t%JUlT8;ntz4#@ zR;8n-ZGyI+nr34ena?A~KoJ#fUdjT!JzEA=hR>V}N5d)8INh^t3(mRZOKYb-HCyWq zw`%#h->9z)04? zX02rkMijCCcD`-mHQCDGI|5sd!ew5O?%n^*C(49Z=vT)N)B{)J?(JXAl=)7Wf~jCylwl~U0h=oCnZ#{;I`g8;LPGYQf^ zcm)!O%j4lcEk=)?5<{dGjS)oIW07}7!-LZd4iHQV&_}t!iOW)d0hZz{MptJ8V#O+t z10nzBIsQ@7gfp2HouhK8vOU&=csp7v8d-R`xHQuI;OT4mRjMNO_}dQ-`(yYTLR83} zmwBEq)SkvI*ZRCh9WU1J(tGQ*Z@Ig7-ybcj8KO+waCk`kNtT!u0XBr8!z_6|h^9-4 zf{q(%GI7Fm?rw`_^OO2!eHgs-=`G{2$?8xr=i}|QH^U&qiL{?~-uFZ**t>g+&|PWG zqQNh_`uOv_J+rY-EBs_GmHcV=L4avWC+bYQgjjcBqp8yT>| z8PZSuKHR#Du4bz2r^lng$M4t1#;vv6Sm`Z&`>u1iGaVVe4eWlspFVQ4`dr%j(@|I0(CG1XhQK8K;cYYzp=TgA%dX);dc;7S%}{W^CkF)zSxamQ9MZL5J6`=^%O-m|C( ze|Q*#g=y-tAOJ(wPi3fy=@#t}!m;brFC~}uM#EjJ_i4rUd-I`v<8pA2Lr$6HPsoy| z6+wu=a^Y?}{G(aL?aNn<=ZD1gN(`ZAleDCQ!l*-~U@ zM3WG8XuxT#WBo(Xr{}%xhSQl;m1Ta-61k6{+ocU_fjvsmy}gN%vDG1x;warw|gZ= zZ64+JeY5vI2iE!el}fE->cLm?s0hX$KdM&FL3tUtHH6e*fUo9_nQSitG8I7|1s{^v zx7_*j1&A><`N!)+1`B_d-qDRz&5(_&jzrYe^yqT*c$_$%=Uq>h@+>qdV8z;bQ*mtU%&K!>^~l_p9GZR>(S_jEK{HQ_CDpk z?C&i^d@M%^U%<2zVRhvp&hDgS8k4CoM67G7rJ0wioV9#Vt+N*7rW!#KCIZ;KK%jK6 zd6^6BLnvlBS@1hGIiLTD0(STH_#QiWzLjYa1i8!j(iV`y?v+V`ukn)6ns6 z+^+KU^?R_%zO13K<(w zDGF-fF&u-QQ&IgHk`iiKuw7k(lRFpwj0vow`Eu6Ap|lKZ*B+9{qlWpwscJ%4f+V198t@4u{HDTjkQq{<@oilcc zd+dleL9g@>)mVuosSzHA=!Wt8F1^@uXHa%RL0!ZoBio4)IYrOM6%1yol)XfL6nd1c zPfHa&-3tFbyA-uG05xisdYs-ZW{g{zRtHHegyK{q5JdFt3DIil6{69D5A(XRe3pgo z$Q{Ej0ug)&uSZE$`-3*KWyu=VMWc+I|olbvee?Ya9KraFMayyysE)&J(LeO%3|A17aMnDUJ-O&>S2wBMWbZx zzBd^5&8Hh-<7L`HtlTY}(V}L`-Zf2@tfsJO)m~-HFH@DOTP>8~qNbmlb&RlAD_NjY zCJtEOt=5BVYc9#6cNheHVdjkQ-Fwp|V{{BhxWeO-5txX!rY@M)gbJSSr=!-myXI7{B16MNn! zxH{dEGpk=gsB<9AMlh{lU>E-Q8Tc?KrPIk>fK^>7SvKwn7Sq<91mNxJEi`T9v$GoLhQ5r*$+SQEkw+5F#{wq7YF3q4u=2+ zL5lB_;6qA+*iQ{0k=?^FEqiugO?W~luma-f(-26iqgR~-qY5^m0E%bX22KW@LjeSk zy(h>b?E@Fj(1#p*z#|nR4*or#NY!8IUslco6IOr)At}o;L~5fbPtKvF@Usjp8Hw6_ zzBT3Vsma-RkvTku?bliU1l~cFkX{B)D>y#%tGcS#(%yJw&yj%(4!J1rviQ|pwz;=^ zp5HHA4mWlo;^Fy%Fp)s2XADy&>T4MK+z~S+2EfQDUPab3fD8sTd|Ox~76}2)7Y?t2 zdo&r+urel1Sh6Z~P^J_&NAmy{DAX?}Z{q$gk}uUCbv4ZfHw;mxg%mQ;B|BS|lVwB41y^&LjR5 zTAt^K<77j%Gt*_U75}SDB|bB5$&9z4I*OHq9{+W(N^)LXRhoLgZkFP{44a|bv9tCg zM`EXx$UPo!_eN4(LK;Jcb0^gN2SZ-tEr!f-O5KREL3#Q^T+Yz{&U^wVYj563Vzom& z5mChnV;{l+VJ6fbbI=P*9=uDr;Y6HDZ_)ASUlV5=DIo*hJLzOEU#b+5mvZE1eHj+S zg)mi)I15D(`9YeXs66dRa|9dO!EEnCmnj|SUqZNut7o|vzjgkr$}rO|y-MY9MqIdJ z-~>-mEQW-AxN~ihUyy4{M(pr1oa5-WxxasSspYWfj}t*)V z#Oqf7(6YqiQsrP=TjTlifj}%yfL49vP-$KrZ&(gXoRh!^V@zOpCP;9EAiIYGt)aR{ zw~64mm2e4&R~j>oPtSYYH&D=S&}p5KfHrOqLG_KoDtcZVFK(gEUVgLzrP` zjusC?2r6x_iB&p}f@F*mHn#w>o{8zHzQo5hGQQj{&8UaBVTKI zkse)+7T*SMz0tkL_1OG)X<*;{Sm0gc-Q)2fz!!`R7(`Ymwa-f(Ls*Fg5^||D8Cd++ zqeqZwXit?4IGhYIppnDa+#lg0=2TLNM2dj!?W)fOoQ(kq5nR&(I{er|)q9<-m3E!yr^oZe`}yPgot?QiV^foJz=~1@R)b5C`ys#OFlPU7`*<<(BIxn4 zmahk)$wIgDl5vS1cZSB=CWlv%sBB}BIw|JV4s_bL(Y~ksP{HQsa^tcvrSPzM^7M3O zNwTuSY)3>=#2nJ7eq!749OiGKI1j6csZiy^Th_N$A45v!d<@Ek)$}P{ zUSt6Vhz9nKPg@5C4k9a*W)!{s2B?V`tOYWx9iE1<@Y#{rQc++UyvZ&_S zVduEofy^Jo(u~oXFS*0}{)xxkuLb2@H=lRihC>CvCQSqsq}ItgdCG)iwH8lRs^rw8 zwmSwfs|Z&Ur*jD6b{p`z&Zrw4&;FVr8YWTV3 zcz){qUUi-~=L790-{6mpA;X31C)3!E?Ei+-nEDn_K)nk5?m z#1qND87MIIAwU2K!s(ij&53R(O11%0JF#<(?q#1=kbLK_o*0rL<0JgA_$b_ z?lZtdh-Wn(n(bl9T6i~@aTdFphV^p&+oPXcrR}xd@nvYGZnD?E(I5x?aBvF|Phn&; zS{@vggf8WMM&7kU+p^+Y@A1y_J$m|VEOt^ljNuhSi!GHdY=%~wO!J^#AW&v0E*^C< zqk2WZnbFDonR9ngZ?eHDDL;6h*HDd=Crd{LgrYixjx7LwumV-GHXO?ryj6d_YWO-0+xH15a z6|Yll$CtI!;jvQBSI3AWw&$Izqs7PhamGqeP3gOhpZPUw@Xt$sOQ+7HrHf=LYU8SP zt4-soCdhq8iOtIu4Mam9UsH!_qs8l#ZRH}H*7Qw**4>!P`}Oxhrmfx1Manos^fNzR z@9XZ*$GKb2<9P4a%|HInZFt|W$TIKZNi(oklR{bcqTM#DP|%0L?4YdAw9hwpd4gU1 zr%&zB`ZGvODn>Wg^oK1Ide)LGOY_FDtE}xWB+l)f5=LWWA*b`n%frmUF!o*J*uDcR zJ+78)I{$6g&Q11d8dw>>%Srs7?ZsT*r%k&~e7~Q=xSp3z{*SvP{I6AhpNH<+C`n1M z2D8j+*V5G{&u-h+^mecEgK7F|-AUW#YTeRRJJ!zB?P~8w=pMbwRf`SU&dsJO+ZW3; z(av@2*3N0&#@!p&4%($2h)oOnBw?Kz=dD&!d?**ffz z`IqYVL8}G$*WDf8=arVv{^892!Tdw14!mpp0;8)SE!E!bOXx}7=b+2|rF-D1INR20 zU%eZ;_bX*KxZKaTQ8~Z6MY*3BGdccG^N*k2r+=^C2j{sz=l6@b-#%okfVT8A*zes$O%mK#{Mf|KPjd$4eYmyHj-jgpH4v?BBXL z+gO$CTefaqIyc#Dn!8Q8uCg3Yo6Br|pA3@szNP)V-;KxZ==ps-=IZ!-R<;!>@W20l z(!aq`{@$OrTD|YxpU=wCpU?AM?|<+)T|brN_}*f>4UN~Uc&W`-Nq(R6Gbf|?JRUz^ zYJ6Ys^yNoPYT%T5-^tr}MGfkY>=5IxASNj6P#TrcHG~r%;SJwb*=oD0O}n)f%MBf% znzdd#mEK5e8%EoF_w&!)GzMC{m7(V>A@b~j1idFV{^kE_AIG9Q+)aZ z-JD{;)g*FlTey6(iU`=<<`E+;k7s;O;OIA)jQg#mKRE;i2O+z_(lugOg!sVGy%E2S zSfhRdN37c`7I%HgpK6w1wb6@Ia<5%96RpopG%K=nh4=qxa^`QrYC@CTU5g(xS@N=G zG*_f{Q&H2a+RLQUsPD&Cb-fiFr1hdpO;mLvO3AF~hJ}Pk-VRVDjy;K=^QxO5Rn?|; zfJD*YE18uv(`?0uANI1rB7ykLV2JK7srv!vnzYKY)*_E*2;QR(85uPQB+SOsPBxS+ zZMxMRIL{6LejMTnHs?_=G(Ly3WiA^-AwYx$}=~+9o8iQ6D~P> zpnn|R`XnuS+tw?RlXWOmy8)^-=;X$M!>u*(>UJ$D;~6da2vA*5XYIIiB2Jd8VN|Njz?PwU3xBpV?l9_DN(4hxUasJ+UF z3ZANIHkXEV9$qJlaw{XPQ`^8e>Ai5ZYIG9asY7+4-O)y6n!MsFe|%cE;Z}(O&p{lT z>dId-~RVwtUu&&|ueyACtY{sWt%L{nv>D@I@zPAFPhPuLs~C(3MxY zzMl2klrn+SLan(6$`gRx;--kxC5Vixc0l2h2gLD zP9#cpSqM|_Ou^mQtD>8e-N75+-h#grFdb~$lLrPpI!qeglRS93s@)v(zd<%f8t`VF z&8Bz@cy8LxZ5Hs7W&9RRAMA9SRlJODJjd(U<)(i+-vLbjQA~3mh8!$-2PCEd{L-=f z_tHng;T!{B9B}W+GKLeN6fg_S9;?p+pmY|ILnd-gSr zhuCgX#XddM!9@mVJ_fHnsXYv8@hguS_2DiuM zf7!(h@JodIAETZ@?rmVurGIJd2m>$=?wxbrBA{GvmOGcg!s$*M5D9ENi@-u9k1ib= zi4B)<>nSYmEH+I1dQ+Ea>-sfoW>EenD|pN0OK3^VRI153Fm$t~>+FkWP)$gvP3^Wz zCV&L+e-!@@oQ|D#s>eU^$PQQ#JBY>*906eTEmSft0i=SdW9eJ?7t>?Yz}C_AbpTuf zRe8aUOb!RSTpO%j6$q9_g|5uGc9yL+cg)nSU#tZYTE1w}wr?ACtf~yLFC~XX)B{SK#20WxXJIC2?{Whe2PHv|*Zv(7wKq9oiILQS zfw+-|Vi2_X?*RouL(mblr7dv){)c{-4$uz@f{vg~Z~~MCZBN(N4sZ&TivQ66D3(E$(dBgnTmXN;Yhpo1$VfuY z)9r5g&;d%&F*#s8??;@ltV9(!3Xr$6H_=@h$hGHj7#^ zc%zIYhW8~Tp6uN7byYXKO=;jlrd!})rg z3Q!!KK*!%1Z~;{O)lslx)RzfN+ih4BYp=uq5~v2cjc)IM`_1d8ou*=mWQ#Rwz;aKg zg`A6Y3`Xwp^`9 zO{cEku;?*m%${d6&+=UNrDd4WN%^!pJ#0Aywlk+^Vb~tQARp~}81MD4g&G*+>5ur^pPp}iF=T zyR^F25r&6a%9$kL9^FNoR;}^e{Gs*1ZVB_*_ZXCLGF?-jJb-SDbi});Hx?L_&1Qol zv2lQxy)d$K!xqtY5)?KjQ}7W#|0QIG+bmC|OMliLitJ8G zkBu$6cdqA$Kz8V~I9|EKXmN+rIWq(=8pC2+tW!_w%NENH^JLC;ufyM;Z=;>Wl)#H& z#vq9I$_8oO((U%+dm#5|cfjfn|A!6=sVi{d?Qi(D;35MTWs-8``OL|Nq-;GIF$Am| zo1cRVOJ+OPLdF?Yx+))ph0d&|#G-Bk=JIWTI4Y%Wpn-URkR*8qqIbhg;sq-#xvFaJ zdge^3LzhBxFpj=fY+&i}sojt`wAtw1^3sb6D%I(6{o~TxyZvpKQ62F?v>m41>>vo{ zZBJC3Ix_eWYlB$J@r)JmXfrF+jIq>iB>v$F!JmVmEhf;CTPob~5IrRB(zRX^{)2d! z%pH%c;6>4cXsncnA|LJn7bH$*wya=*m!2rfB?#8-lGbTlH=LSNDcPd%e+Z2Ue* zC_WA+@-A@?lxtw!LbkNJ&cCevq0n6In3%9f4n~}yE91iuI-!8D0%i2b0tTiMir8#K zO?J2u-{@>=V!W`?p-C=0Zi(yPIP^zqEjL^2BnF=7mq?1GS`}JkMpT;Q&?MR^#r+*nRgL z11#FZZ8yD|TFW(OgPel5IF5_U!aK}l1-zeT=|&@y!(NupM#66|#MzP1`yWvQq}X}m zj`O%c1|hwn%kwD*_-w=jdD-b)!^yArjg(q!7ZzNCTHQ(=2h+y4F_w!baV@hGyE&Oj z&+ABRQE>@rKca{O9_>FOB>MgIOO|4?$*G<7j8N!bYLJ-uFOCZ9sEkBl&hIT6!9!~;>wm92)LFxxny!Rf*0BBP?-}|tfn;Wu_5|8e#cN- zrF2~@pX;8XURGB*r_KvKqjmixdJg})-G`;}P!paII2DbEmM<5NPmnKCKch?7Cl)OH z3!=RdMs_ihT7dy=h%Hz^+%1&RrcM}BuNd;W#+EIc)x-5$_Uz>RL(C}f$0oPMEJtJW z(x}V!S{V8&5YZ?`Nijkuvk5$IP{vbuP}Qt>7O*xvrXG-~iC?fvX&Jctr{o&^a$Poo zg!%HV9H`u=uO?GoqARJ~C;*+Kd$AIxT|62EXrJwtc8URIZ=OZUg0PV<4`Z3Ec(Vq0l*#YzaPnJp9=NjmyhyV? zATwsh9)hL^R9PaO4#JC#nd&qpg|(J$+1>?$r3<~x#mP|&mLnX}Q4^CbahQ7x7A~tyV{O2ixt=F-TD|$8oGcYRJF7Yu`IRHn&no)(5{6`D%2RFlP~6I;dquw z{4A^I;tU7nT{F?T{;-uYDeFRqEPLFc`IJ71>6E+I0=GV2`{car(PExylu{`|t{frD zH0~3L6eb`wvZg`}6OT)b)R!53$nkkE6nSH+izEm9l;;Ab*PoFXsp8?yTcy7q@=G0n z8`m`+9FP6sr+b3OrG3wL7=@>xQ)v>IyO(X04dI!&;nAe)j7LYVG}l^0P-0~sjywt( zN#vEU9zpVOQCMGNfODJ@A8m{i@;JXHZi;;9e${DYbcCP31|c*E&$COapwBV1 z$#2n;)HJ4?hWrnYDA&TExv5TcWBbw=q+VT2v)cGnB;!cdzQB`rje9T)hEF&JX6jus zq(Ss4XKIULax}PUvi+b`%88)2dDtfVisFjmyR*LDpzHl46O5QD!H317Jdwxd8cNTA zxAzzZ9yc-cXG*_P8OtvqBKyMrXb}VdryO|%$8We2-LC;hGdCMq0%nF1k<@-Qoy0iR z8gV$>G`<_q#H3J)FUBZ5kBEq^CtZPNZusit+qc;MRcc*aI`2;3Q6OlZJVcpuMrKii!>}O?W1^31p&B`J6ko$f=mif3LQq0lI z&#SWUprRvDqU-vov9OGwW64;IGw$rgx8?g7%K2Fi+k!1N%X=z)mfpD0a_nZ3S5i~H zL;M<}+B%)DI6>+e_XwM_R@(9*WWrG(O{>Q*NG( zI$;^>JbD{x@$8u%UtU@GkZisI50CsGPGegH|F^8txE^LV3-G%Dj?|&tTs_OT6m^V} z;`#PqaK_OS{qTa~`5i+)nTOly2V2T^dyfvmrB}@oNCuQtCHVJ>wxD~ms2gdz_3C~c zxuMCS_&D#vn0cq+5TK#Fro@H-)*YvGzQZxoqv}#dlB~^pMh=jw3<5UJYaCC&3&fyKb6A3NeSE1Wu+TJ4# zP|i%JK@*tmljGYa(g5+C5Xnz!Kr0Mz1ovoW23Ms{dD1!Kdls|3Z%6XgZy_#xKOw=^ z#LI0*6XIEjzLm2X4?uBG$&bA~d`<;JZe*9lC|NnsE&e|y8md~qxA@nuH2Z!$5#hFQy8s&(}Qt~3jusn85b^{G;2pU)+9F_#muijx%w)EHr^ zd;F&+6(uQ1{Z!}$P5dZ}lW#_H${ts8=6C+nIyW260j9WkA4SNOpFB+ z(3FH3l!K~`#5FKl%cdy_Gi{tSB)JZme@IY{i$R*2Ltt18rpvKnKq*NI>pRes7L1{V zmdi?BtcO@^ElF7=Ayb!OGd4s`f}4M5VBHZ_CQ|!iPFNLrhF&UL?1&yy^)Z-W zTz6#a3T_=4QK^rw+gBG-@D&ZjR+@P;2i=g9a8+t9RqQ~LmGhoV7Fb3}v&TaE&D|~# zRhv48bVxT0&dBnh-S35b)FdI9s-#KK3!Vsf^bVldo0Nz`P%ESrT+9?T1*IaIHIb6< z%#S7>bw-E2x7|aE{8nVz-VoZrUd%OEJWg##GSqn{YMAQilA$77cgR#0Z%ML7GFYd) zkb-oR_F=q_Ek}>$b^%FAxLrYOxP5~t=&hWT$3&Ei&L zPfS=o5U)sHPP232WT{=aC>H5ugQev#b@^ zoV2VR+FX3vZ6Il@QY)Z~D-P!9;W5Q@;4xz)m7PgH9kRIYr)+abztb-r@|jJ4`7_iu zTq4%_s}kcpK|Gdlk_I-NE{|;@m}3O>Ai{M^TTC{THriK3Uh%g^*I)Zc?@F1cr zmeIXd3bp<#%wG4$IX;ChmvlIDrpRvcLt$R!+z64+P!c@+WDpTEX2zS72 z_sdme^Ntkzb-iRR!})rN@=&oNiTT#t#66{=jX^Ep*ZwiHiB(EmF#T1EyX>Mnok?>J}9%m54}6Y5|YYCMZlL z#eAQrVP|QHpx8JGQE5~mvfCoiXz7>{AjuNl!+?@@>I9~!MSMJ6n2CvnHCg_v3P07e7g!Pj-({3u|<@2u&g3;ge%z+!NCV( ztbsuhT(ZFX@yFBjT%O+Bc2xA6VP(D&meJ$Iv+BNcB^~&b@=;h^(pMGrwx_H%C@HiY z%!;jiF5oA@nwLVlYl4(Qf$0bIQy}rKq47%nc4m7|)7tP?=o{W#2$Xl)an&D`@n?e*NUzca?#E;IlNKj;NNZ)FVv5jMv(YorR zOq%mB<$KPj#jdl?iNNEsAvc|;nBuHw0&r%aMHD>uy@1lA_g(-1fS;cc=1.18-0' + catalog.cattle.io/release-name: cf-runtime +apiVersion: v2 +dependencies: +- name: cf-common + repository: oci://quay.io/codefresh/charts + version: 0.16.0 +description: A Helm chart for Codefresh Runner +home: https://codefresh.io/ +icon: file://assets/icons/cf-runtime.png +keywords: +- codefresh +- runner +kubeVersion: '>=1.18-0' +maintainers: +- name: codefresh + url: https://codefresh-io.github.io/ +name: cf-runtime +sources: +- https://github.com/codefresh-io/venona +version: 6.4.5 diff --git a/charts/codefresh/cf-runtime/6.4.5/README.md b/charts/codefresh/cf-runtime/6.4.5/README.md new file mode 100644 index 000000000..df1451845 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/README.md @@ -0,0 +1,1230 @@ +## Codefresh Runner + +![Version: 6.4.5](https://img.shields.io/badge/Version-6.4.5-informational?style=flat-square) + +Helm chart for deploying [Codefresh Runner](https://codefresh.io/docs/docs/installation/codefresh-runner/) to Kubernetes. + +## Table of Content + +- [Prerequisites](#prerequisites) +- [Get Chart Info](#get-chart-info) +- [Install Chart](#install-chart) +- [Chart Configuration](#chart-configuration) +- [Upgrade Chart](#upgrade-chart) + - [To 2.x](#to-2-x) + - [To 3.x](#to-3-x) + - [To 4.x](#to-4-x) + - [To 5.x](#to-5-x) + - [To 6.x](#to-6-x) +- [Architecture](#architecture) +- [Configuration](#configuration) + - [EBS backend volume configuration in AWS](#ebs-backend-volume-configuration) + - [Azure Disks backend volume configuration in AKS](#azure-disks-backend-volume-configuration) + - [GCE Disks backend volume configuration in GKE](#gce-disks-backend-volume-configuration-in-gke) + - [Custom volume mounts](#custom-volume-mounts) + - [Custom global environment variables](#custom-global-environment-variables) + - [Volume reuse policy](#volume-reuse-policy) + - [Volume cleaners](#volume-cleaners) + - [Rootless DinD](#rootless-dind) + - [ARM](#arm) + - [Openshift](#openshift) + - [On-premise](#on-premise) + +## Prerequisites + +- Kubernetes **1.19+** +- Helm **3.8.0+** + +⚠️⚠️⚠️ +> Since version 6.2.x chart is pushed **only** to OCI registry at `oci://quay.io/codefresh/cf-runtime` + +> Versions prior to 6.2.x are still available in ChartMuseum at `http://chartmuseum.codefresh.io/cf-runtime` + +## Get Chart Info + +```console +helm show all oci://quay.io/codefresh/cf-runtime +``` +See [Use OCI-based registries](https://helm.sh/docs/topics/registries/) + +## Install Chart + +**Important:** only helm3 is supported + +- Specify the following mandatory values + +`values.yaml` +```yaml +# -- Global parameters +# @default -- See below +global: + # -- User token in plain text (required if `global.codefreshTokenSecretKeyRef` is omitted!) + # Ref: https://g.codefresh.io/user/settings (see API Keys) + # Minimal API key scopes: Runner-Installation(read+write), Agent(read+write), Agents(read+write) + codefreshToken: "" + # -- User token that references an existing secret containing API key (required if `global.codefreshToken` is omitted!) + codefreshTokenSecretKeyRef: {} + # E.g. + # codefreshTokenSecretKeyRef: + # name: my-codefresh-api-token + # key: codefresh-api-token + + # -- Account ID (required!) + # Can be obtained here https://g.codefresh.io/2.0/account-settings/account-information + accountId: "" + + # -- K8s context name (required!) + context: "" + # E.g. + # context: prod-ue1-runtime-1 + + # -- Agent Name (optional!) + # If omitted, the following format will be used '{{ .Values.global.context }}_{{ .Release.Namespace }}' + agentName: "" + # E.g. + # agentName: prod-ue1-runtime-1 + + # -- Runtime name (optional!) + # If omitted, the following format will be used '{{ .Values.global.context }}/{{ .Release.Namespace }}' + runtimeName: "" + # E.g. + # runtimeName: prod-ue1-runtime-1/namespace +``` + +- Install chart + +```console +helm upgrade --install cf-runtime oci://quay.io/codefresh/cf-runtime -f values.yaml --create-namespace --namespace codefresh +``` + +## Chart Configuration + +See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). + +## Upgrade Chart + +### To 2.x + +This major release renames and deprecated several values in the chart. Most of the workload templates have been refactored. + +Affected values: +- `dockerRegistry` is deprecated. Replaced with `global.imageRegistry` +- `re` is renamed to `runtime` +- `storage.localVolumeMonitor` is replaced with `volumeProvisioner.dind-lv-monitor` +- `volumeProvisioner.volume-cleanup` is replaced with `volumeProvisioner.dind-volume-cleanup` +- `image` values structure has been updated. Split to `image.registry` `image.repository` `image.tag` +- pod's `annotations` is renamed to `podAnnotations` + +### To 3.x + +⚠️⚠️⚠️ +### READ this before the upgrade! + +This major release adds [runtime-environment](https://codefresh.io/docs/docs/installation/codefresh-runner/#runtime-environment-specification) spec into chart templates. +That means it is possible to set parametes for `dind` and `engine` pods via [values.yaml](./values.yaml). + +**If you had any overrides (i.e. tolerations/nodeSelector/environment variables/etc) added in runtime spec via [codefresh CLI](https://codefresh-io.github.io/cli/) (for example, you did use [get](https://codefresh-io.github.io/cli/runtime-environments/get-runtime-environments/) and [patch](https://codefresh-io.github.io/cli/runtime-environments/apply-runtime-environments/) commands to modify the runtime-environment), you MUST add these into chart's [values.yaml](./values.yaml) for `.Values.runtime.dind` or(and) .`Values.runtime.engine`** + +**For backward compatibility, you can disable updating runtime-environment spec via** `.Values.runtime.patch.enabled=false` + +Affected values: +- added **mandatory** `global.codefreshToken`/`global.codefreshTokenSecretKeyRef` **You must specify it before the upgrade!** +- `runtime.engine` is added +- `runtime.dind` is added +- `global.existingAgentToken` is replaced with `global.agentTokenSecretKeyRef` +- `global.existingDindCertsSecret` is replaced with `global.dindCertsSecretRef` + +### To 4.x + +This major release adds **agentless inCluster** runtime mode (relevant only for [Codefresh On-Premises](#on-premise) users) + +Affected values: +- `runtime.agent` / `runtime.inCluster` / `runtime.accounts` / `runtime.description` are added + +### To 5.x + +This major release converts `.runtime.dind.pvcs` from **list** to **dict** + +> 4.x chart's values example: +```yaml +runtime: + dind: + pvcs: + - name: dind + storageClassName: my-storage-class-name + volumeSize: 32Gi + reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName' + reuseVolumeSortOrder: pipeline_id +``` + +> 5.x chart's values example: +```yaml +runtime: + dind: + pvcs: + dind: + name: dind + storageClassName: my-storage-class-name + volumeSize: 32Gi + reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName' + reuseVolumeSortOrder: pipeline_id +``` + +Affected values: +- `.runtime.dind.pvcs` converted from **list** to **dict** + +### To 6.x + +⚠️⚠️⚠️ +### READ this before the upgrade! + +This major release deprecates previously required `codefresh runner init --generate-helm-values-file`. + +Affected values: +- **Replaced** `.monitor.clusterId` with `.global.context` as **mandatory** value! +- **Deprecated** `.global.agentToken` / `.global.agentTokenSecretKeyRef` +- **Removed** `.global.agentId` +- **Removed** `.global.keys` / `.global.dindCertsSecretRef` +- **Removed** `.global.existingAgentToken` / `existingDindCertsSecret` +- **Removed** `.monitor.clusterId` / `.monitor.token` / `.monitor.existingMonitorToken` + +#### Migrate the Helm chart from version 5.x to 6.x + +Given this is the legacy `generated_values.yaml` values: + +> legacy `generated_values.yaml` +```yaml +{ + "appProxy": { + "enabled": false, + }, + "monitor": { + "enabled": false, + "clusterId": "my-cluster-name", + "token": "1234567890" + }, + "global": { + "namespace": "namespace", + "codefreshHost": "https://g.codefresh.io", + "agentToken": "0987654321", + "agentId": "agent-id-here", + "agentName": "my-cluster-name_my-namespace", + "accountId": "my-account-id", + "runtimeName": "my-cluster-name/my-namespace", + "codefreshToken": "1234567890", + "keys": { + "key": "-----BEGIN RSA PRIVATE KEY-----...", + "csr": "-----BEGIN CERTIFICATE REQUEST-----...", + "ca": "-----BEGIN CERTIFICATE-----...", + "serverCert": "-----BEGIN CERTIFICATE-----..." + } + } +} +``` + +Update `values.yaml` for new chart version: + +> For existing installation for backward compatibility `.Values.global.agentToken/agentTokenSecretKeyRef` **must be provided!** For installation from scratch this value is no longer required. + +> updated `values.yaml` +```yaml +global: + codefreshToken: "1234567890" + accountId: "my-account-id" + context: "my-cluster-name" + agentToken: "0987654321" # MANDATORY when migrating from < 6.x chart version ! + agentName: "my-cluster-name_my-namespace" # optional + runtimeName: "my-cluster-name/my-namespace" # optional +``` + +> **Note!** Though it's still possible to update runtime-environment via [get](https://codefresh-io.github.io/cli/runtime-environments/get-runtime-environments/) and [patch](https://codefresh-io.github.io/cli/runtime-environments/apply-runtime-environments/) commands, it's recommended to enable sidecar container to pull runtime spec from Codefresh API to detect any drift in configuration. + +```yaml +runner: + # -- Sidecar container + # Reconciles runtime spec from Codefresh API for drift detection + sidecar: + enabled: true +``` + +## Architecture + +[Codefresh Runner architecture](https://codefresh.io/docs/docs/installation/codefresh-runner/#codefresh-runner-architecture) + +## Configuration + +See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). + +### EBS backend volume configuration + +`dind-volume-provisioner` should have permissions to create/attach/detach/delete/get EBS volumes + +Minimal IAM policy for `dind-volume-provisioner` + +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "ec2:AttachVolume", + "ec2:CreateSnapshot", + "ec2:CreateTags", + "ec2:CreateVolume", + "ec2:DeleteSnapshot", + "ec2:DeleteTags", + "ec2:DeleteVolume", + "ec2:DescribeInstances", + "ec2:DescribeSnapshots", + "ec2:DescribeTags", + "ec2:DescribeVolumes", + "ec2:DetachVolume" + ], + "Resource": "*" + } + ] +} +``` + +There are three options: + +1. Run `dind-volume-provisioner` pod on the node/node-group with IAM role + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: ebs-csi + + ebs: + availabilityZone: "us-east-1a" + +volumeProvisioner: + # -- Set node selector + nodeSelector: {} + # -- Set tolerations + tolerations: [] +``` + +2. Pass static credentials in `.Values.storage.ebs.accessKeyId/accessKeyIdSecretKeyRef` and `.Values.storage.ebs.secretAccessKey/secretAccessKeySecretKeyRef` + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: ebs-csi + + ebs: + availabilityZone: "us-east-1a" + + # -- Set AWS_ACCESS_KEY_ID for volume-provisioner (optional) + accessKeyId: "" + # -- Existing secret containing AWS_ACCESS_KEY_ID. + accessKeyIdSecretKeyRef: {} + # E.g. + # accessKeyIdSecretKeyRef: + # name: + # key: + + # -- Set AWS_SECRET_ACCESS_KEY for volume-provisioner (optional) + secretAccessKey: "" + # -- Existing secret containing AWS_SECRET_ACCESS_KEY + secretAccessKeySecretKeyRef: {} + # E.g. + # secretAccessKeySecretKeyRef: + # name: + # key: +``` + +3. Assign IAM role to `dind-volume-provisioner` service account + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: ebs-csi + + ebs: + availabilityZone: "us-east-1a" + +volumeProvisioner: + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Additional service account annotations + annotations: + eks.amazonaws.com/role-arn: "arn:aws:iam:::role/" +``` + +### Custom volume mounts + +You can add your own volumes and volume mounts in the runtime environment, so that all pipeline steps will have access to the same set of external files. + +```yaml +runtime: + dind: + userVolumes: + regctl-docker-registry: + name: regctl-docker-registry + secret: + items: + - key: .dockerconfigjson + path: config.json + secretName: regctl-docker-registry + optional: true + userVolumeMounts: + regctl-docker-registry: + name: regctl-docker-registry + mountPath: /home/appuser/.docker/ + readOnly: true + +``` + +### Azure Disks backend volume configuration + +`dind-volume-provisioner` should have permissions to create/delete/get Azure Disks + +Role definition for `dind-volume-provisioner` + +`dind-volume-provisioner-role.json` +```json +{ + "Name": "CodefreshDindVolumeProvisioner", + "Description": "Perform create/delete/get disks", + "IsCustom": true, + "Actions": [ + "Microsoft.Compute/disks/read", + "Microsoft.Compute/disks/write", + "Microsoft.Compute/disks/delete" + + ], + "AssignableScopes": ["/subscriptions/"] +} +``` + +When creating an AKS cluster in Azure there is the option to use a [managed identity](https://learn.microsoft.com/en-us/azure/aks/use-managed-identity) that is assigned to the kubelet. This identity is assigned to the underlying node pool in the AKS cluster and can then be used by the dind-volume-provisioner. + +```console +export ROLE_DEFINITIN_FILE=dind-volume-provisioner-role.json +export SUBSCRIPTION_ID=$(az account show --query "id" | xargs echo ) +export RESOURCE_GROUP= +export AKS_NAME= +export LOCATION=$(az aks show -g $RESOURCE_GROUP -n $AKS_NAME --query location | xargs echo) +export NODES_RESOURCE_GROUP=MC_${RESOURCE_GROUP}_${AKS_NAME}_${LOCATION} +export NODE_SERVICE_PRINCIPAL=$(az aks show -g $RESOURCE_GROUP -n $AKS_NAME --query identityProfile.kubeletidentity.objectId | xargs echo) + +az role definition create --role-definition @${ROLE_DEFINITIN_FILE} +az role assignment create --assignee $NODE_SERVICE_PRINCIPAL --scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$NODES_RESOURCE_GROUP --role CodefreshDindVolumeProvisioner +``` + +Deploy Helm chart with the following values: + +`values.yaml` +```yaml +volumeProvisioner: + podSecurityContext: + enabled: true + runAsUser: 0 + runAsGroup: 0 + fsGroup: 0 + +storage: + backend: azuredisk + azuredisk: + availabilityZone: northeurope-1 # replace with your zone + resourceGroup: my-resource-group-name + + mountAzureJson: true + +runtime: + dind: + nodeSelector: + topology.kubernetes.io/zone: northeurope-1 +``` + +### GCE Disks backend volume configuration in GKE + +`dind-volume-provisioner` should have `ComputeEngine.StorageAdmin` permissions + +There are three options: + +1. Run `dind-volume-provisioner` pod on the node/node-group with IAM Service Account + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: gcedisk + + gcedisk: + # -- Set GCP volume backend type (`pd-ssd`/`pd-standard`) + volumeType: "pd-standard" + # -- Set GCP volume availability zone + availabilityZone: "us-central1-c" + +volumeProvisioner: + # -- Set node selector + nodeSelector: {} + # -- Set tolerations + tolerations: [] + +# -- Set runtime parameters +runtime: + # -- Parameters for DinD (docker-in-docker) pod + dind: + # -- Set node selector. + nodeSelector: + topology.kubernetes.io/zone: us-central1-c +``` + +2. Pass static credentials in `.Values.storage.gcedisk.serviceAccountJson` (inline) or `.Values.storage.gcedisk.serviceAccountJsonSecretKeyRef` (from your own secret) + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: gcedisk + + gcedisk: + # -- Set GCP volume backend type (`pd-ssd`/`pd-standard`) + volumeType: "`pd-standard" + # -- Set GCP volume availability zone + availabilityZone: "us-central1-c" + # -- Set Google SA JSON key for volume-provisioner (optional) + serviceAccountJson: | + { + "type": "service_account", + "project_id": "...", + "private_key_id": "...", + "private_key": "...", + "client_email": "...", + "client_id": "...", + "auth_uri": "...", + "token_uri": "...", + "auth_provider_x509_cert_url": "...", + "client_x509_cert_url": "..." + } + # -- Existing secret containing containing Google SA JSON key for volume-provisioner (optional) + serviceAccountJsonSecretKeyRef: {} + # E.g.: + # serviceAccountJsonSecretKeyRef: + # name: gce-service-account + # key: service-account.json + +# -- Set runtime parameters +runtime: + # -- Parameters for DinD (docker-in-docker) pod + dind: + # -- Set node selector. + nodeSelector: + topology.kubernetes.io/zone: us-central1-c +``` + +3. Assign IAM role to `dind-volume-provisioner` service account + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: gcedisk + + gcedisk: + # -- Set GCP volume backend type (`pd-ssd`/`pd-standard`) + volumeType: "`pd-standard" + # -- Set GCP volume availability zone + availabilityZone: "us-central1-c" + +volumeProvisioner: + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Additional service account annotations + annotations: + iam.gke.io/gcp-service-account: @.iam.gserviceaccount.com + +# -- Set runtime parameters +runtime: + # -- Parameters for DinD (docker-in-docker) pod + dind: + # -- Set node selector. + nodeSelector: + topology.kubernetes.io/zone: us-central1-c +``` + +### Custom global environment variables + +You can add your own environment variables to the runtime environment. All pipeline steps have access to the global variables. + +```yaml +runtime: + engine: + userEnvVars: + - name: GITHUB_TOKEN + valueFrom: + secretKeyRef: + name: github-token + key: token +``` + +### Volume reuse policy + +Volume reuse behavior depends on the configuration for `reuseVolumeSelector` in the runtime environment spec. + +```yaml +runtime: + dind: + pvcs: + - name: dind + ... + reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName' + reuseVolumeSortOrder: pipeline_id +``` + +The following options are available: +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName'` - PV can be used by ANY pipeline in the specified account (default). +Benefit: Fewer PVs, resulting in lower costs. Since any PV can be used by any pipeline, the cluster needs to maintain/reserve fewer PVs in its PV pool for Codefresh. +Downside: Since the PV can be used by any pipeline, the PVs could have assets and info from different pipelines, reducing the probability of cache. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,project_id'` - PV can be used by ALL pipelines in your account, assigned to the same project. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,pipeline_id'` - PV can be used only by a single pipeline. +Benefit: More probability of cache without “spam” from other pipelines. +Downside: More PVs to maintain and therefore higher costs. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,pipeline_id,io.codefresh.branch_name'` - PV can be used only by single pipeline AND single branch. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,pipeline_id,trigger'` - PV can be used only by single pipeline AND single trigger. + +### Volume cleaners + +Codefresh pipelines require disk space for: + * [Pipeline Shared Volume](https://codefresh.io/docs/docs/pipelines/introduction-to-codefresh-pipelines/#sharing-the-workspace-between-build-steps) (`/codefresh/volume`, implemented as [docker volume](https://docs.docker.com/storage/volumes/)) + * Docker containers, both running and stopped + * Docker images and cached layers + +Codefresh offers two options to manage disk space and prevent out-of-space errors: +* Use runtime cleaners on Docker images and volumes +* [Set the minimum disk space per pipeline build volume](https://codefresh.io/docs/docs/pipelines/pipelines/#set-minimum-disk-space-for-a-pipeline-build) + +To improve performance by using Docker cache, Codefresh `volume-provisioner` can provision previously used disks with Docker images and pipeline volumes from previously run builds. + +### Types of runtime volume cleaners + +Docker images and volumes must be cleaned on a regular basis. + +* [IN-DIND cleaner](https://github.com/codefresh-io/dind/tree/master/cleaner): Deletes extra Docker containers, volumes, and images in **DIND pod**. +* [External volume cleaner](https://github.com/codefresh-io/dind-volume-cleanup): Deletes unused **external** PVs (EBS, GCE/Azure disks). +* [Local volume cleaner](https://github.com/codefresh-io/dind-volume-utils/blob/master/local-volumes/lv-cleaner.sh): Deletes **local** volumes if node disk space is close to the threshold. + +### IN-DIND cleaner + +**Purpose:** Removes unneeded *docker containers, images, volumes* inside Kubernetes volume mounted on the DIND pod + +**How it runs:** Inside each DIND pod as script + +**Triggered by:** SIGTERM and also during the run when disk usage > 90% (configurable) + +**Configured by:** Environment Variables which can be set in Runtime Environment spec + +**Configuration/Logic:** [README.md](https://github.com/codefresh-io/dind/tree/master/cleaner#readme) + +Override `.Values.runtime.dind.env` if necessary (the following are **defaults**): + +```yaml +runtime: + dind: + env: + CLEAN_PERIOD_SECONDS: '21600' # launch clean if last clean was more than CLEAN_PERIOD_SECONDS seconds ago + CLEAN_PERIOD_BUILDS: '5' # launch clean if last clean was more CLEAN_PERIOD_BUILDS builds since last build + IMAGE_RETAIN_PERIOD: '14400' # do not delete docker images if they have events since current_timestamp - IMAGE_RETAIN_PERIOD + VOLUMES_RETAIN_PERIOD: '14400' # do not delete docker volumes if they have events since current_timestamp - VOLUMES_RETAIN_PERIOD + DISK_USAGE_THRESHOLD: '0.8' # launch clean based on current disk usage DISK_USAGE_THRESHOLD + INODES_USAGE_THRESHOLD: '0.8' # launch clean based on current inodes usage INODES_USAGE_THRESHOLD +``` + +### External volumes cleaner + +**Purpose:** Removes unused *kubernetes volumes and related backend volumes* + +**How it runs:** Runs as `dind-volume-cleanup` CronJob. Installed in case the Runner uses non-local volumes `.Values.storage.backend != local` + +**Triggered by:** CronJob every 10min (configurable) + +**Configuration:** + +Set `codefresh.io/volume-retention` for dinds' PVCs: + +```yaml +runtime: + dind: + pvcs: + dind: + ... + annotations: + codefresh.io/volume-retention: 7d +``` + +Or override environment variables for `dind-volume-cleanup` cronjob: + +```yaml +volumeProvisioner: + dind-volume-cleanup: + env: + RETENTION_DAYS: 7 # clean volumes that were last used more than `RETENTION_DAYS` (default is 4) ago +``` + +### Local volumes cleaner + +**Purpose:** Deletes local volumes when node disk space is close to the threshold + +**How it runs:** Runs as `dind-lv-monitor` DaemonSet. Installed in case the Runner uses local volumes `.Values.storage.backend == local` + +**Triggered by:** Disk space usage or inode usage that exceeds thresholds (configurable) + +**Configuration:** + +Override environment variables for `dind-lv-monitor` daemonset: + +```yaml +volumeProvisioner: + dind-lv-monitor: + env: + KB_USAGE_THRESHOLD: 60 # default 80 (percentage) + INODE_USAGE_THRESHOLD: 60 # default 80 +``` + +### Rootless DinD + +DinD pod runs a `priviliged` container with **rootfull** docker. +To run the docker daemon as non-root user (**rootless** mode), change dind image tag: + +`values.yaml` +```yaml +runtime: + dind: + image: + tag: rootless +``` + +### ARM + +With the Codefresh Runner, you can run native ARM64v8 builds. + +> **Note!** +> You cannot run both amd64 and arm64 images within the same pipeline. As one pipeline can map only to one runtime, you can run either amd64 or arm64 within the same pipeline. + +Provide `nodeSelector` and(or) `tolerations` for dind pods: + +`values.yaml` +```yaml +runtime: + dind: + nodeSelector: + arch: arm64 + tolerations: + - key: arch + operator: Equal + value: arm64 + effect: NoSchedule +``` + +### Openshift + +To install Codefresh Runner on OpenShift use the following `values.yaml` example + +```yaml +runner: + podSecurityContext: + enabled: false + +volumeProvisioner: + podSecurityContext: + enabled: false + env: + PRIVILEGED_CONTAINER: true + dind-lv-monitor: + containerSecurityContext: + enabled: true + privileged: true + volumePermissions: + enabled: true + securityContext: + privileged: true + runAsUser: auto +``` + +Grant `privileged` SCC to `cf-runtime-runner` and `cf-runtime-volume-provisioner` service accounts. + +```console +oc adm policy add-scc-to-user privileged system:serviceaccount:codefresh:cf-runtime-runner + +oc adm policy add-scc-to-user privileged system:serviceaccount:codefresh:cf-runtime-volume-provisioner +``` + +### On-premise + +If you have [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) deployed, you can install Codefresh Runner in **agentless** mode. + +**What is agentless mode?** + +Agent (aka venona) is Runner component which responsible for calling Codefresh API to run builds and create dind/engine pods and pvc objects. Agent can only be assigned to a single account, thus you can't share one runtime across multiple accounts. However, with **agentless** mode it's possible to register the runtime as **system**-type runtime so it's registered on the platform level and can be assigned/shared across multiple accounts. + +**What are the prerequisites?** +- You have a running [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) control-plane environment +- You have a Codefresh API token with platform **Admin** permissions scope + +### How to deploy agentless runtime when it's on the SAME k8s cluster as On-Premises control-plane environment? + +- Enable cluster-level permissions for cf-api (On-Premises control-plane component) + +> `values.yaml` for [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) Helm chart +```yaml +cfapi: + ... + # -- Enable ClusterRole/ClusterRoleBinding + rbac: + namespaced: false +``` + +- Set the following values for Runner Helm chart + +`.Values.global.codefreshHost=...` \ +`.Values.global.codefreshToken=...` \ +`.Values.global.runtimeName=system/...` \ +`.Values.runtime.agent=false` \ +`.Values.runtime.inCluster=true` + +> `values.yaml` for [Codefresh Runner](https://artifacthub.io/packages/helm/codefresh-runner/cf-runtime) helm chart +```yaml +global: + # -- URL of Codefresh On-Premises Platform + codefreshHost: "https://myonprem.somedomain.com" + # -- User token in plain text with Admin permission scope + codefreshToken: "" + # -- User token that references an existing secret containing API key. + codefreshTokenSecretKeyRef: {} + # E.g. + # codefreshTokenSecretKeyRef: + # name: my-codefresh-api-token + # key: codefresh-api-token + + # -- Distinguished runtime name + # (for On-Premise only; mandatory!) Must be prefixed with "system/..." + runtimeName: "system/prod-ue1-some-cluster-name" + +# -- Set runtime parameters +runtime: + # -- (for On-Premise only; mandatory!) Disable agent + agent: false + # -- (for On-Premise only; optional) Set inCluster runtime (default: `true`) + # `inCluster=true` flag is set when Runtime and On-Premises control-plane are run on the same cluster + # `inCluster=false` flag is set when Runtime and On-Premises control-plane are on different clusters + inCluster: true + # -- (for On-Premise only; optional) Assign accounts to runtime (list of account ids; default is empty) + # Accounts can be assigned to the runtime in Codefresh UI later so you can kepp it empty. + accounts: [] + # -- Set parent runtime to inherit. + runtimeExtends: [] +``` + +- Install the chart + +```console +helm upgrade --install cf-runtime oci://quay.io/codefresh/cf-runtime -f values.yaml --create-namespace --namespace cf-runtime +``` + +- Verify the runtime and run test pipeline + +Go to [https:///admin/runtime-environments/system](https:///admin/runtime-environments/system) to check the runtime. Assign it to the required account(s). Run test pipeline on it. + +### How to deploy agentless runtime when it's on the DIFFERENT k8s cluster than On-Premises control-plane environment? + +In this case, it's required to mount runtime cluster's `KUBECONFIG` into On-Premises `cf-api` deployment + +- Create the neccessary RBAC resources + +> `values.yaml` for [Codefresh Runner](https://artifacthub.io/packages/helm/codefresh-runner/cf-runtime) helm chart +```yaml +extraResources: +- apiVersion: rbac.authorization.k8s.io/v1 + kind: Role + metadata: + name: codefresh-role + namespace: '{{ .Release.Namespace }}' + rules: + - apiGroups: [""] + resources: ["pods", "persistentvolumeclaims", "persistentvolumes"] + verbs: ["list", "watch", "get", "create", "patch", "delete"] + - apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshots"] + verbs: ["list", "watch", "get", "create", "patch", "delete"] +- apiVersion: v1 + kind: ServiceAccount + metadata: + name: codefresh-runtime-user + namespace: '{{ .Release.Namespace }}' +- apiVersion: rbac.authorization.k8s.io/v1 + kind: RoleBinding + metadata: + name: codefresh-runtime-user + namespace: '{{ .Release.Namespace }}' + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: codefresh-role + subjects: + - kind: ServiceAccount + name: codefresh-runtime-user + namespace: '{{ .Release.Namespace }}' +- apiVersion: v1 + kind: Secret + metadata: + name: codefresh-runtime-user-token + namespace: '{{ .Release.Namespace }}' + annotations: + kubernetes.io/service-account.name: codefresh-runtime-user + type: kubernetes.io/service-account-token +``` + +- Set up the following environment variables to create a `KUBECONFIG` file + +```shell +NAMESPACE=cf-runtime +CLUSTER_NAME=prod-ue1-some-cluster-name +CURRENT_CONTEXT=$(kubectl config current-context) + +USER_TOKEN_VALUE=$(kubectl -n cf-runtime get secret/codefresh-runtime-user-token -o=go-template='{{.data.token}}' | base64 --decode) +CURRENT_CLUSTER=$(kubectl config view --raw -o=go-template='{{range .contexts}}{{if eq .name "'''${CURRENT_CONTEXT}'''"}}{{ index .context "cluster" }}{{end}}{{end}}') +CLUSTER_CA=$(kubectl config view --raw -o=go-template='{{range .clusters}}{{if eq .name "'''${CURRENT_CLUSTER}'''"}}"{{with index .cluster "certificate-authority-data" }}{{.}}{{end}}"{{ end }}{{ end }}') +CLUSTER_SERVER=$(kubectl config view --raw -o=go-template='{{range .clusters}}{{if eq .name "'''${CURRENT_CLUSTER}'''"}}{{ .cluster.server }}{{end}}{{ end }}') + +export -p USER_TOKEN_VALUE CURRENT_CONTEXT CURRENT_CLUSTER CLUSTER_CA CLUSTER_SERVER CLUSTER_NAME +``` + +- Create a kubeconfig file + +```console +cat << EOF > $CLUSTER_NAME-kubeconfig +apiVersion: v1 +kind: Config +current-context: ${CLUSTER_NAME} +contexts: +- name: ${CLUSTER_NAME} + context: + cluster: ${CLUSTER_NAME} + user: codefresh-runtime-user + namespace: ${NAMESPACE} +clusters: +- name: ${CLUSTER_NAME} + cluster: + certificate-authority-data: ${CLUSTER_CA} + server: ${CLUSTER_SERVER} +users: +- name: ${CLUSTER_NAME} + user: + token: ${USER_TOKEN_VALUE} +EOF +``` + +- **Switch context to On-Premises control-plane cluster**. Create k8s secret (via any tool like [ESO](https://external-secrets.io/v0.4.4/), `kubectl`, etc ) containing runtime cluster's `KUBECONFG` created in previous step. + +```shell +NAMESPACE=codefresh +kubectl create secret generic dind-runtime-clusters --from-file=$CLUSTER_NAME=$CLUSTER_NAME-kubeconfig -n $NAMESPACE +``` + +- Mount secret containing runtime cluster's `KUBECONFG` into cf-api in On-Premises control-plane cluster + +> `values.yaml` for [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) helm chart +```yaml +cf-api: + ... + volumes: + dind-clusters: + enabled: true + type: secret + nameOverride: dind-runtime-clusters + optional: true +``` +> volumeMount `/etc/kubeconfig` is already configured in cf-api Helm chart template. No need to specify it. + +- Set the following values for Runner helm chart + +> `values.yaml` for [Codefresh Runner](https://artifacthub.io/packages/helm/codefresh-runner/cf-runtime) helm chart + +`.Values.global.codefreshHost=...` \ +`.Values.global.codefreshToken=...` \ +`.Values.global.runtimeName=system/...` \ +`.Values.runtime.agent=false` \ +`.Values.runtime.inCluster=false` + +**Important!** +`.Values.global.name` ("system/" prefix is ignored!) should match the cluster name (key in `dind-runtime-clusters` secret created previously) +```yaml +global: + # -- URL of Codefresh On-Premises Platform + codefreshHost: "https://myonprem.somedomain.com" + # -- User token in plain text with Admin permission scope + codefreshToken: "" + # -- User token that references an existing secret containing API key. + codefreshTokenSecretKeyRef: {} + # E.g. + # codefreshTokenSecretKeyRef: + # name: my-codefresh-api-token + # key: codefresh-api-token + + # -- Distinguished runtime name + # (for On-Premise only; mandatory!) Must be prefixed with "system/..." + name: "system/prod-ue1-some-cluster-name" + +# -- Set runtime parameters +runtime: + # -- (for On-Premise only; mandatory!) Disable agent + agent: false + # -- (for On-Premise only; optional) Set inCluster runtime (default: `true`) + # `inCluster=true` flag is set when Runtime and On-Premises control-plane are run on the same cluster + # `inCluster=false` flag is set when Runtime and On-Premises control-plane are on different clusters + inCluster: false + # -- (for On-Premise only; optional) Assign accounts to runtime (list of account ids; default is empty) + # Accounts can be assigned to the runtime in Codefresh UI later so you can kepp it empty. + accounts: [] + # -- (optional) Set parent runtime to inherit. + runtimeExtends: [] +``` + +- Install the chart + +```console +helm upgrade --install cf-runtime oci://quay.io/codefresh/cf-runtime -f values.yaml --create-namespace --namespace cf-runtime +``` + +- Verify the runtime and run test pipeline + +Go to [https:///admin/runtime-environments/system](https:///admin/runtime-environments/system) to see the runtime. Assign it to the required account(s). + +## Requirements + +| Repository | Name | Version | +|------------|------|---------| +| oci://quay.io/codefresh/charts | cf-common | 0.16.0 | + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| appProxy.affinity | object | `{}` | Set affinity | +| appProxy.enabled | bool | `false` | Enable app-proxy | +| appProxy.env | object | `{}` | Add additional env vars | +| appProxy.image | object | `{"registry":"quay.io","repository":"codefresh/cf-app-proxy","tag":"0.0.47"}` | Set image | +| appProxy.ingress.annotations | object | `{}` | Set extra annotations for ingress object | +| appProxy.ingress.class | string | `""` | Set ingress class | +| appProxy.ingress.host | string | `""` | Set DNS hostname the ingress will use | +| appProxy.ingress.pathPrefix | string | `""` | Set path prefix for ingress (keep empty for default `/` path) | +| appProxy.ingress.tlsSecret | string | `""` | Set k8s tls secret for the ingress object | +| appProxy.nodeSelector | object | `{}` | Set node selector | +| appProxy.podAnnotations | object | `{}` | Set pod annotations | +| appProxy.podSecurityContext | object | `{}` | Set security context for the pod | +| appProxy.rbac | object | `{"create":true,"namespaced":true,"rules":[]}` | RBAC parameters | +| appProxy.rbac.create | bool | `true` | Create RBAC resources | +| appProxy.rbac.namespaced | bool | `true` | Use Role(true)/ClusterRole(true) | +| appProxy.rbac.rules | list | `[]` | Add custom rule to the role | +| appProxy.readinessProbe | object | See below | Readiness probe configuration | +| appProxy.replicasCount | int | `1` | Set number of pods | +| appProxy.resources | object | `{}` | Set requests and limits | +| appProxy.serviceAccount | object | `{"annotations":{},"create":true,"name":"","namespaced":true}` | Service Account parameters | +| appProxy.serviceAccount.annotations | object | `{}` | Additional service account annotations | +| appProxy.serviceAccount.create | bool | `true` | Create service account | +| appProxy.serviceAccount.name | string | `""` | Override service account name | +| appProxy.serviceAccount.namespaced | bool | `true` | Use Role(true)/ClusterRole(true) | +| appProxy.tolerations | list | `[]` | Set tolerations | +| appProxy.updateStrategy | object | `{"type":"RollingUpdate"}` | Upgrade strategy | +| dockerRegistry | string | `""` | | +| event-exporter | object | See below | Event exporter parameters | +| event-exporter.affinity | object | `{}` | Set affinity | +| event-exporter.enabled | bool | `false` | Enable event-exporter | +| event-exporter.env | object | `{}` | Add additional env vars | +| event-exporter.image | object | `{"registry":"docker.io","repository":"codefresh/k8s-event-exporter","tag":"latest"}` | Set image | +| event-exporter.nodeSelector | object | `{}` | Set node selector | +| event-exporter.podAnnotations | object | `{}` | Set pod annotations | +| event-exporter.podSecurityContext | object | See below | Set security context for the pod | +| event-exporter.rbac | object | `{"create":true,"rules":[]}` | RBAC parameters | +| event-exporter.rbac.create | bool | `true` | Create RBAC resources | +| event-exporter.rbac.rules | list | `[]` | Add custom rule to the role | +| event-exporter.replicasCount | int | `1` | Set number of pods | +| event-exporter.resources | object | `{}` | Set resources | +| event-exporter.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | Service Account parameters | +| event-exporter.serviceAccount.annotations | object | `{}` | Additional service account annotations | +| event-exporter.serviceAccount.create | bool | `true` | Create service account | +| event-exporter.serviceAccount.name | string | `""` | Override service account name | +| event-exporter.tolerations | list | `[]` | Set tolerations | +| event-exporter.updateStrategy | object | `{"type":"Recreate"}` | Upgrade strategy | +| extraResources | list | `[]` | Array of extra objects to deploy with the release | +| fullnameOverride | string | `""` | String to fully override cf-runtime.fullname template | +| global | object | See below | Global parameters | +| global.accountId | string | `""` | Account ID (required!) Can be obtained here https://g.codefresh.io/2.0/account-settings/account-information | +| global.agentName | string | `""` | Agent Name (optional!) If omitted, the following format will be used `{{ .Values.global.context }}_{{ .Release.Namespace }}` | +| global.agentToken | string | `""` | DEPRECATED Agent token in plain text. !!! MUST BE provided if migrating from < 6.x chart version | +| global.agentTokenSecretKeyRef | object | `{}` | DEPRECATED Agent token that references an existing secret containing API key. !!! MUST BE provided if migrating from < 6.x chart version | +| global.codefreshHost | string | `"https://g.codefresh.io"` | URL of Codefresh Platform (required!) | +| global.codefreshToken | string | `""` | User token in plain text (required if `global.codefreshTokenSecretKeyRef` is omitted!) Ref: https://g.codefresh.io/user/settings (see API Keys) Minimal API key scopes: Runner-Installation(read+write), Agent(read+write), Agents(read+write) | +| global.codefreshTokenSecretKeyRef | object | `{}` | User token that references an existing secret containing API key (required if `global.codefreshToken` is omitted!) | +| global.context | string | `""` | K8s context name (required!) | +| global.imagePullSecrets | list | `[]` | Global Docker registry secret names as array | +| global.imageRegistry | string | `""` | Global Docker image registry | +| global.runtimeName | string | `""` | Runtime name (optional!) If omitted, the following format will be used `{{ .Values.global.context }}/{{ .Release.Namespace }}` | +| monitor.affinity | object | `{}` | Set affinity | +| monitor.enabled | bool | `false` | Enable monitor Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#install-monitoring-component | +| monitor.env | object | `{}` | Add additional env vars | +| monitor.image | object | `{"registry":"quay.io","repository":"codefresh/cf-k8s-agent","tag":"1.3.18"}` | Set image | +| monitor.nodeSelector | object | `{}` | Set node selector | +| monitor.podAnnotations | object | `{}` | Set pod annotations | +| monitor.podSecurityContext | object | `{}` | | +| monitor.rbac | object | `{"create":true,"namespaced":true,"rules":[]}` | RBAC parameters | +| monitor.rbac.create | bool | `true` | Create RBAC resources | +| monitor.rbac.namespaced | bool | `true` | Use Role(true)/ClusterRole(true) | +| monitor.rbac.rules | list | `[]` | Add custom rule to the role | +| monitor.readinessProbe | object | See below | Readiness probe configuration | +| monitor.replicasCount | int | `1` | Set number of pods | +| monitor.resources | object | `{}` | Set resources | +| monitor.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | Service Account parameters | +| monitor.serviceAccount.annotations | object | `{}` | Additional service account annotations | +| monitor.serviceAccount.create | bool | `true` | Create service account | +| monitor.serviceAccount.name | string | `""` | Override service account name | +| monitor.tolerations | list | `[]` | Set tolerations | +| monitor.updateStrategy | object | `{"type":"RollingUpdate"}` | Upgrade strategy | +| nameOverride | string | `""` | String to partially override cf-runtime.fullname template (will maintain the release name) | +| podMonitor | object | See below | Add podMonitor (for engine pods) | +| podMonitor.main.enabled | bool | `false` | Enable pod monitor for engine pods | +| podMonitor.runner.enabled | bool | `false` | Enable pod monitor for runner pod | +| podMonitor.volume-provisioner.enabled | bool | `false` | Enable pod monitor for volumeProvisioner pod | +| re | object | `{}` | | +| runner | object | See below | Runner parameters | +| runner.affinity | object | `{}` | Set affinity | +| runner.enabled | bool | `true` | Enable the runner | +| runner.env | object | `{}` | Add additional env vars | +| runner.image | object | `{"registry":"quay.io","repository":"codefresh/venona","tag":"1.10.2"}` | Set image | +| runner.init | object | `{"image":{"registry":"quay.io","repository":"codefresh/cli","tag":"0.85.0-rootless"},"resources":{"limits":{"cpu":"1","memory":"512Mi"},"requests":{"cpu":"0.2","memory":"256Mi"}}}` | Init container | +| runner.nodeSelector | object | `{}` | Set node selector | +| runner.podAnnotations | object | `{}` | Set pod annotations | +| runner.podSecurityContext | object | See below | Set security context for the pod | +| runner.rbac | object | `{"create":true,"rules":[]}` | RBAC parameters | +| runner.rbac.create | bool | `true` | Create RBAC resources | +| runner.rbac.rules | list | `[]` | Add custom rule to the role | +| runner.readinessProbe | object | See below | Readiness probe configuration | +| runner.replicasCount | int | `1` | Set number of pods | +| runner.resources | object | `{}` | Set requests and limits | +| runner.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | Service Account parameters | +| runner.serviceAccount.annotations | object | `{}` | Additional service account annotations | +| runner.serviceAccount.create | bool | `true` | Create service account | +| runner.serviceAccount.name | string | `""` | Override service account name | +| runner.sidecar | object | `{"enabled":false,"env":{"RECONCILE_INTERVAL":300},"image":{"registry":"quay.io","repository":"codefresh/codefresh-shell","tag":"0.0.2"},"resources":{}}` | Sidecar container Reconciles runtime spec from Codefresh API for drift detection | +| runner.tolerations | list | `[]` | Set tolerations | +| runner.updateStrategy | object | `{"type":"RollingUpdate"}` | Upgrade strategy | +| runtime | object | See below | Set runtime parameters | +| runtime.accounts | list | `[]` | (for On-Premise only) Assign accounts to runtime (list of account ids) | +| runtime.agent | bool | `true` | (for On-Premise only) Enable agent | +| runtime.description | string | `""` | Runtime description | +| runtime.dind | object | `{"affinity":{},"env":{"DOCKER_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE":true},"image":{"pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/dind","tag":"26.1.4-1.28.7"},"nodeSelector":{},"podAnnotations":{},"podLabels":{},"pvcs":{"dind":{"annotations":{},"name":"dind","reuseVolumeSelector":"codefresh-app,io.codefresh.accountName","reuseVolumeSortOrder":"pipeline_id","storageClassName":"{{ include \"dind-volume-provisioner.storageClassName\" . }}","volumeSize":"16Gi"}},"resources":{"limits":{"cpu":"400m","memory":"800Mi"},"requests":null},"schedulerName":"","serviceAccount":"codefresh-engine","terminationGracePeriodSeconds":30,"tolerations":[],"userAccess":true,"userVolumeMounts":{},"userVolumes":{}}` | Parameters for DinD (docker-in-docker) pod (aka "runtime" pod). | +| runtime.dind.affinity | object | `{}` | Set affinity | +| runtime.dind.env | object | `{"DOCKER_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE":true}` | Set additional env vars. | +| runtime.dind.image | object | `{"pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/dind","tag":"26.1.4-1.28.7"}` | Set dind image. | +| runtime.dind.nodeSelector | object | `{}` | Set node selector. | +| runtime.dind.podAnnotations | object | `{}` | Set pod annotations. | +| runtime.dind.podLabels | object | `{}` | Set pod labels. | +| runtime.dind.pvcs | object | `{"dind":{"annotations":{},"name":"dind","reuseVolumeSelector":"codefresh-app,io.codefresh.accountName","reuseVolumeSortOrder":"pipeline_id","storageClassName":"{{ include \"dind-volume-provisioner.storageClassName\" . }}","volumeSize":"16Gi"}}` | PV claim spec parametes. | +| runtime.dind.pvcs.dind | object | `{"annotations":{},"name":"dind","reuseVolumeSelector":"codefresh-app,io.codefresh.accountName","reuseVolumeSortOrder":"pipeline_id","storageClassName":"{{ include \"dind-volume-provisioner.storageClassName\" . }}","volumeSize":"16Gi"}` | Default dind PVC parameters | +| runtime.dind.pvcs.dind.annotations | object | `{}` | PV annotations. | +| runtime.dind.pvcs.dind.name | string | `"dind"` | PVC name prefix. Keep `dind` as default! Don't change! | +| runtime.dind.pvcs.dind.reuseVolumeSelector | string | `"codefresh-app,io.codefresh.accountName"` | PV reuse selector. Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#volume-reuse-policy | +| runtime.dind.pvcs.dind.storageClassName | string | `"{{ include \"dind-volume-provisioner.storageClassName\" . }}"` | PVC storage class name. Change ONLY if you need to use storage class NOT from Codefresh volume-provisioner | +| runtime.dind.pvcs.dind.volumeSize | string | `"16Gi"` | PVC size. | +| runtime.dind.resources | object | `{"limits":{"cpu":"400m","memory":"800Mi"},"requests":null}` | Set dind resources. | +| runtime.dind.schedulerName | string | `""` | Set scheduler name. | +| runtime.dind.serviceAccount | string | `"codefresh-engine"` | Set service account for pod. | +| runtime.dind.terminationGracePeriodSeconds | int | `30` | Set termination grace period. | +| runtime.dind.tolerations | list | `[]` | Set tolerations. | +| runtime.dind.userAccess | bool | `true` | Keep `true` as default! | +| runtime.dind.userVolumeMounts | object | `{}` | Add extra volume mounts | +| runtime.dind.userVolumes | object | `{}` | Add extra volumes | +| runtime.dindDaemon | object | See below | DinD pod daemon config | +| runtime.engine | object | `{"affinity":{},"command":["npm","run","start"],"env":{"CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS":1000,"DOCKER_REQUEST_TIMEOUT_MS":30000,"FORCE_COMPOSE_SERIAL_PULL":false,"LOGGER_LEVEL":"debug","LOG_OUTGOING_HTTP_REQUESTS":false,"METRICS_PROMETHEUS_COLLECT_PROCESS_METRICS":false,"METRICS_PROMETHEUS_ENABLED":true,"METRICS_PROMETHEUS_ENABLE_LEGACY_METRICS":false,"METRICS_PROMETHEUS_HOST":"0.0.0.0","METRICS_PROMETHEUS_PORT":9100},"image":{"pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/engine","tag":"1.174.13"},"nodeSelector":{},"podAnnotations":{},"podLabels":{},"resources":{"limits":{"cpu":"1000m","memory":"2048Mi"},"requests":{"cpu":"100m","memory":"128Mi"}},"runtimeImages":{"COMPOSE_IMAGE":"quay.io/codefresh/compose:v2.28.1-1.5.0","CONTAINER_LOGGER_IMAGE":"quay.io/codefresh/cf-container-logger:1.11.7","COSIGN_IMAGE_SIGNER_IMAGE":"quay.io/codefresh/cf-cosign-image-signer:2.4.0-cf.2","CR_6177_FIXER":"quay.io/codefresh/alpine:edge","DOCKER_BUILDER_IMAGE":"quay.io/codefresh/cf-docker-builder:1.3.13","DOCKER_PULLER_IMAGE":"quay.io/codefresh/cf-docker-puller:8.0.18","DOCKER_PUSHER_IMAGE":"quay.io/codefresh/cf-docker-pusher:6.0.16","DOCKER_TAG_PUSHER_IMAGE":"quay.io/codefresh/cf-docker-tag-pusher:1.3.14","FS_OPS_IMAGE":"quay.io/codefresh/fs-ops:1.2.3","GC_BUILDER_IMAGE":"quay.io/codefresh/cf-gc-builder:0.5.3","GIT_CLONE_IMAGE":"quay.io/codefresh/cf-git-cloner:10.1.28","KUBE_DEPLOY":"quay.io/codefresh/cf-deploy-kubernetes:16.1.11","PIPELINE_DEBUGGER_IMAGE":"quay.io/codefresh/cf-debugger:1.3.6","TEMPLATE_ENGINE":"quay.io/codefresh/pikolo:0.14.1"},"schedulerName":"","serviceAccount":"codefresh-engine","terminationGracePeriodSeconds":180,"tolerations":[],"userEnvVars":[],"workflowLimits":{"MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS":600,"MAXIMUM_ALLOWED_WORKFLOW_AGE_BEFORE_TERMINATION":86400,"MAXIMUM_ELECTED_STATE_AGE_ALLOWED":900,"MAXIMUM_RETRY_ATTEMPTS_ALLOWED":20,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED":900,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED_WITHOUT_UPDATE":300,"TIME_ENGINE_INACTIVE_UNTIL_TERMINATION":300,"TIME_ENGINE_INACTIVE_UNTIL_UNHEALTHY":60,"TIME_INACTIVE_UNTIL_TERMINATION":2700}}` | Parameters for Engine pod (aka "pipeline" orchestrator). | +| runtime.engine.affinity | object | `{}` | Set affinity | +| runtime.engine.command | list | `["npm","run","start"]` | Set container command. | +| runtime.engine.env | object | `{"CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS":1000,"DOCKER_REQUEST_TIMEOUT_MS":30000,"FORCE_COMPOSE_SERIAL_PULL":false,"LOGGER_LEVEL":"debug","LOG_OUTGOING_HTTP_REQUESTS":false,"METRICS_PROMETHEUS_COLLECT_PROCESS_METRICS":false,"METRICS_PROMETHEUS_ENABLED":true,"METRICS_PROMETHEUS_ENABLE_LEGACY_METRICS":false,"METRICS_PROMETHEUS_HOST":"0.0.0.0","METRICS_PROMETHEUS_PORT":9100}` | Set additional env vars. | +| runtime.engine.env.CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS | int | `1000` | Interval to check the exec status in the container-logger | +| runtime.engine.env.DOCKER_REQUEST_TIMEOUT_MS | int | `30000` | Timeout while doing requests to the Docker daemon | +| runtime.engine.env.FORCE_COMPOSE_SERIAL_PULL | bool | `false` | If "true", composition images will be pulled sequentially | +| runtime.engine.env.LOGGER_LEVEL | string | `"debug"` | Level of logging for engine | +| runtime.engine.env.LOG_OUTGOING_HTTP_REQUESTS | bool | `false` | Enable debug-level logging of outgoing HTTP/HTTPS requests | +| runtime.engine.env.METRICS_PROMETHEUS_COLLECT_PROCESS_METRICS | bool | `false` | Enable collecting process metrics | +| runtime.engine.env.METRICS_PROMETHEUS_ENABLED | bool | `true` | Enable emitting metrics from engine | +| runtime.engine.env.METRICS_PROMETHEUS_ENABLE_LEGACY_METRICS | bool | `false` | Enable legacy metrics | +| runtime.engine.env.METRICS_PROMETHEUS_HOST | string | `"0.0.0.0"` | Host for Prometheus metrics server | +| runtime.engine.env.METRICS_PROMETHEUS_PORT | int | `9100` | Port for Prometheus metrics server | +| runtime.engine.image | object | `{"pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/engine","tag":"1.174.13"}` | Set image. | +| runtime.engine.nodeSelector | object | `{}` | Set node selector. | +| runtime.engine.podAnnotations | object | `{}` | Set pod annotations. | +| runtime.engine.podLabels | object | `{}` | Set pod labels. | +| runtime.engine.resources | object | `{"limits":{"cpu":"1000m","memory":"2048Mi"},"requests":{"cpu":"100m","memory":"128Mi"}}` | Set resources. | +| runtime.engine.runtimeImages | object | See below. | Set system(base) runtime images. | +| runtime.engine.schedulerName | string | `""` | Set scheduler name. | +| runtime.engine.serviceAccount | string | `"codefresh-engine"` | Set service account for pod. | +| runtime.engine.terminationGracePeriodSeconds | int | `180` | Set termination grace period. | +| runtime.engine.tolerations | list | `[]` | Set tolerations. | +| runtime.engine.userEnvVars | list | `[]` | Set extra env vars | +| runtime.engine.workflowLimits | object | `{"MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS":600,"MAXIMUM_ALLOWED_WORKFLOW_AGE_BEFORE_TERMINATION":86400,"MAXIMUM_ELECTED_STATE_AGE_ALLOWED":900,"MAXIMUM_RETRY_ATTEMPTS_ALLOWED":20,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED":900,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED_WITHOUT_UPDATE":300,"TIME_ENGINE_INACTIVE_UNTIL_TERMINATION":300,"TIME_ENGINE_INACTIVE_UNTIL_UNHEALTHY":60,"TIME_INACTIVE_UNTIL_TERMINATION":2700}` | Set workflow limits. | +| runtime.engine.workflowLimits.MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS | int | `600` | Maximum time allowed to the engine to wait for the pre-steps (aka "Initializing Process") to succeed; seconds. | +| runtime.engine.workflowLimits.MAXIMUM_ALLOWED_WORKFLOW_AGE_BEFORE_TERMINATION | int | `86400` | Maximum time for workflow execution; seconds. | +| runtime.engine.workflowLimits.MAXIMUM_ELECTED_STATE_AGE_ALLOWED | int | `900` | Maximum time allowed to workflow to spend in "elected" state; seconds. | +| runtime.engine.workflowLimits.MAXIMUM_RETRY_ATTEMPTS_ALLOWED | int | `20` | Maximum retry attempts allowed for workflow. | +| runtime.engine.workflowLimits.MAXIMUM_TERMINATING_STATE_AGE_ALLOWED | int | `900` | Maximum time allowed to workflow to spend in "terminating" state until force terminated; seconds. | +| runtime.engine.workflowLimits.MAXIMUM_TERMINATING_STATE_AGE_ALLOWED_WITHOUT_UPDATE | int | `300` | Maximum time allowed to workflow to spend in "terminating" state without logs activity until force terminated; seconds. | +| runtime.engine.workflowLimits.TIME_ENGINE_INACTIVE_UNTIL_TERMINATION | int | `300` | Time since the last health check report after which workflow is terminated; seconds. | +| runtime.engine.workflowLimits.TIME_ENGINE_INACTIVE_UNTIL_UNHEALTHY | int | `60` | Time since the last health check report after which the engine is considered unhealthy; seconds. | +| runtime.engine.workflowLimits.TIME_INACTIVE_UNTIL_TERMINATION | int | `2700` | Time since the last workflow logs activity after which workflow is terminated; seconds. | +| runtime.gencerts | object | See below | Parameters for `gencerts-dind` post-upgrade/install hook | +| runtime.inCluster | bool | `true` | (for On-Premise only) Set inCluster runtime | +| runtime.patch | object | See below | Parameters for `runtime-patch` post-upgrade/install hook | +| runtime.rbac | object | `{"create":true,"rules":[]}` | RBAC parameters | +| runtime.rbac.create | bool | `true` | Create RBAC resources | +| runtime.rbac.rules | list | `[]` | Add custom rule to the engine role | +| runtime.runtimeExtends | list | `["system/default/hybrid/k8s_low_limits"]` | Set parent runtime to inherit. Should not be changes. Parent runtime is controlled from Codefresh side. | +| runtime.serviceAccount | object | `{"annotations":{},"create":true}` | Set annotation on engine Service Account Ref: https://codefresh.io/docs/docs/administration/codefresh-runner/#injecting-aws-arn-roles-into-the-cluster | +| serviceMonitor | object | See below | Add serviceMonitor | +| serviceMonitor.main.enabled | bool | `false` | Enable service monitor for dind pods | +| storage.azuredisk.cachingMode | string | `"None"` | | +| storage.azuredisk.skuName | string | `"Premium_LRS"` | Set storage type (`Premium_LRS`) | +| storage.backend | string | `"local"` | Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) | +| storage.ebs.accessKeyId | string | `""` | Set AWS_ACCESS_KEY_ID for volume-provisioner (optional) Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#dind-volume-provisioner-permissions | +| storage.ebs.accessKeyIdSecretKeyRef | object | `{}` | Existing secret containing AWS_ACCESS_KEY_ID. | +| storage.ebs.availabilityZone | string | `"us-east-1a"` | Set EBS volumes availability zone (required) | +| storage.ebs.encrypted | string | `"false"` | Enable encryption (optional) | +| storage.ebs.kmsKeyId | string | `""` | Set KMS encryption key ID (optional) | +| storage.ebs.secretAccessKey | string | `""` | Set AWS_SECRET_ACCESS_KEY for volume-provisioner (optional) Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#dind-volume-provisioner-permissions | +| storage.ebs.secretAccessKeySecretKeyRef | object | `{}` | Existing secret containing AWS_SECRET_ACCESS_KEY | +| storage.ebs.volumeType | string | `"gp2"` | Set EBS volume type (`gp2`/`gp3`/`io1`) (required) | +| storage.fsType | string | `"ext4"` | Set filesystem type (`ext4`/`xfs`) | +| storage.gcedisk.availabilityZone | string | `"us-west1-a"` | Set GCP volume availability zone | +| storage.gcedisk.serviceAccountJson | string | `""` | Set Google SA JSON key for volume-provisioner (optional) | +| storage.gcedisk.serviceAccountJsonSecretKeyRef | object | `{}` | Existing secret containing containing Google SA JSON key for volume-provisioner (optional) | +| storage.gcedisk.volumeType | string | `"pd-ssd"` | Set GCP volume backend type (`pd-ssd`/`pd-standard`) | +| storage.local.volumeParentDir | string | `"/var/lib/codefresh/dind-volumes"` | Set volume path on the host filesystem | +| storage.mountAzureJson | bool | `false` | | +| volumeProvisioner | object | See below | Volume Provisioner parameters | +| volumeProvisioner.affinity | object | `{}` | Set affinity | +| volumeProvisioner.dind-lv-monitor | object | See below | `dind-lv-monitor` DaemonSet parameters (local volumes cleaner) | +| volumeProvisioner.enabled | bool | `true` | Enable volume-provisioner | +| volumeProvisioner.env | object | `{}` | Add additional env vars | +| volumeProvisioner.image | object | `{"registry":"quay.io","repository":"codefresh/dind-volume-provisioner","tag":"1.35.0"}` | Set image | +| volumeProvisioner.nodeSelector | object | `{}` | Set node selector | +| volumeProvisioner.podAnnotations | object | `{}` | Set pod annotations | +| volumeProvisioner.podSecurityContext | object | See below | Set security context for the pod | +| volumeProvisioner.rbac | object | `{"create":true,"rules":[]}` | RBAC parameters | +| volumeProvisioner.rbac.create | bool | `true` | Create RBAC resources | +| volumeProvisioner.rbac.rules | list | `[]` | Add custom rule to the role | +| volumeProvisioner.replicasCount | int | `1` | Set number of pods | +| volumeProvisioner.resources | object | `{}` | Set resources | +| volumeProvisioner.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | Service Account parameters | +| volumeProvisioner.serviceAccount.annotations | object | `{}` | Additional service account annotations | +| volumeProvisioner.serviceAccount.create | bool | `true` | Create service account | +| volumeProvisioner.serviceAccount.name | string | `""` | Override service account name | +| volumeProvisioner.tolerations | list | `[]` | Set tolerations | +| volumeProvisioner.updateStrategy | object | `{"type":"Recreate"}` | Upgrade strategy | + diff --git a/charts/codefresh/cf-runtime/6.4.5/README.md.gotmpl b/charts/codefresh/cf-runtime/6.4.5/README.md.gotmpl new file mode 100644 index 000000000..96e5ca574 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/README.md.gotmpl @@ -0,0 +1,1007 @@ +## Codefresh Runner + +{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }} + +Helm chart for deploying [Codefresh Runner](https://codefresh.io/docs/docs/installation/codefresh-runner/) to Kubernetes. + +## Table of Content + +- [Prerequisites](#prerequisites) +- [Get Chart Info](#get-chart-info) +- [Install Chart](#install-chart) +- [Chart Configuration](#chart-configuration) +- [Upgrade Chart](#upgrade-chart) + - [To 2.x](#to-2-x) + - [To 3.x](#to-3-x) + - [To 4.x](#to-4-x) + - [To 5.x](#to-5-x) + - [To 6.x](#to-6-x) +- [Architecture](#architecture) +- [Configuration](#configuration) + - [EBS backend volume configuration in AWS](#ebs-backend-volume-configuration) + - [Azure Disks backend volume configuration in AKS](#azure-disks-backend-volume-configuration) + - [GCE Disks backend volume configuration in GKE](#gce-disks-backend-volume-configuration-in-gke) + - [Custom volume mounts](#custom-volume-mounts) + - [Custom global environment variables](#custom-global-environment-variables) + - [Volume reuse policy](#volume-reuse-policy) + - [Volume cleaners](#volume-cleaners) + - [Rootless DinD](#rootless-dind) + - [ARM](#arm) + - [Openshift](#openshift) + - [On-premise](#on-premise) + +## Prerequisites + +- Kubernetes **1.19+** +- Helm **3.8.0+** + +⚠️⚠️⚠️ +> Since version 6.2.x chart is pushed **only** to OCI registry at `oci://quay.io/codefresh/cf-runtime` + +> Versions prior to 6.2.x are still available in ChartMuseum at `http://chartmuseum.codefresh.io/cf-runtime` + +## Get Chart Info + +```console +helm show all oci://quay.io/codefresh/cf-runtime +``` +See [Use OCI-based registries](https://helm.sh/docs/topics/registries/) + +## Install Chart + +**Important:** only helm3 is supported + +- Specify the following mandatory values + +`values.yaml` +```yaml +# -- Global parameters +# @default -- See below +global: + # -- User token in plain text (required if `global.codefreshTokenSecretKeyRef` is omitted!) + # Ref: https://g.codefresh.io/user/settings (see API Keys) + # Minimal API key scopes: Runner-Installation(read+write), Agent(read+write), Agents(read+write) + codefreshToken: "" + # -- User token that references an existing secret containing API key (required if `global.codefreshToken` is omitted!) + codefreshTokenSecretKeyRef: {} + # E.g. + # codefreshTokenSecretKeyRef: + # name: my-codefresh-api-token + # key: codefresh-api-token + + # -- Account ID (required!) + # Can be obtained here https://g.codefresh.io/2.0/account-settings/account-information + accountId: "" + + # -- K8s context name (required!) + context: "" + # E.g. + # context: prod-ue1-runtime-1 + + # -- Agent Name (optional!) + # If omitted, the following format will be used '{{ `{{ .Values.global.context }}_{{ .Release.Namespace }}` }}' + agentName: "" + # E.g. + # agentName: prod-ue1-runtime-1 + + # -- Runtime name (optional!) + # If omitted, the following format will be used '{{ `{{ .Values.global.context }}/{{ .Release.Namespace }}` }}' + runtimeName: "" + # E.g. + # runtimeName: prod-ue1-runtime-1/namespace +``` + +- Install chart + +```console +helm upgrade --install cf-runtime oci://quay.io/codefresh/cf-runtime -f values.yaml --create-namespace --namespace codefresh +``` + +## Chart Configuration + +See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). + +## Upgrade Chart + +### To 2.x + +This major release renames and deprecated several values in the chart. Most of the workload templates have been refactored. + +Affected values: +- `dockerRegistry` is deprecated. Replaced with `global.imageRegistry` +- `re` is renamed to `runtime` +- `storage.localVolumeMonitor` is replaced with `volumeProvisioner.dind-lv-monitor` +- `volumeProvisioner.volume-cleanup` is replaced with `volumeProvisioner.dind-volume-cleanup` +- `image` values structure has been updated. Split to `image.registry` `image.repository` `image.tag` +- pod's `annotations` is renamed to `podAnnotations` + +### To 3.x + +⚠️⚠️⚠️ +### READ this before the upgrade! + +This major release adds [runtime-environment](https://codefresh.io/docs/docs/installation/codefresh-runner/#runtime-environment-specification) spec into chart templates. +That means it is possible to set parametes for `dind` and `engine` pods via [values.yaml](./values.yaml). + +**If you had any overrides (i.e. tolerations/nodeSelector/environment variables/etc) added in runtime spec via [codefresh CLI](https://codefresh-io.github.io/cli/) (for example, you did use [get](https://codefresh-io.github.io/cli/runtime-environments/get-runtime-environments/) and [patch](https://codefresh-io.github.io/cli/runtime-environments/apply-runtime-environments/) commands to modify the runtime-environment), you MUST add these into chart's [values.yaml](./values.yaml) for `.Values.runtime.dind` or(and) .`Values.runtime.engine`** + +**For backward compatibility, you can disable updating runtime-environment spec via** `.Values.runtime.patch.enabled=false` + +Affected values: +- added **mandatory** `global.codefreshToken`/`global.codefreshTokenSecretKeyRef` **You must specify it before the upgrade!** +- `runtime.engine` is added +- `runtime.dind` is added +- `global.existingAgentToken` is replaced with `global.agentTokenSecretKeyRef` +- `global.existingDindCertsSecret` is replaced with `global.dindCertsSecretRef` + +### To 4.x + +This major release adds **agentless inCluster** runtime mode (relevant only for [Codefresh On-Premises](#on-premise) users) + +Affected values: +- `runtime.agent` / `runtime.inCluster` / `runtime.accounts` / `runtime.description` are added + +### To 5.x + +This major release converts `.runtime.dind.pvcs` from **list** to **dict** + +> 4.x chart's values example: +```yaml +runtime: + dind: + pvcs: + - name: dind + storageClassName: my-storage-class-name + volumeSize: 32Gi + reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName' + reuseVolumeSortOrder: pipeline_id +``` + +> 5.x chart's values example: +```yaml +runtime: + dind: + pvcs: + dind: + name: dind + storageClassName: my-storage-class-name + volumeSize: 32Gi + reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName' + reuseVolumeSortOrder: pipeline_id +``` + +Affected values: +- `.runtime.dind.pvcs` converted from **list** to **dict** + +### To 6.x + +⚠️⚠️⚠️ +### READ this before the upgrade! + +This major release deprecates previously required `codefresh runner init --generate-helm-values-file`. + +Affected values: +- **Replaced** `.monitor.clusterId` with `.global.context` as **mandatory** value! +- **Deprecated** `.global.agentToken` / `.global.agentTokenSecretKeyRef` +- **Removed** `.global.agentId` +- **Removed** `.global.keys` / `.global.dindCertsSecretRef` +- **Removed** `.global.existingAgentToken` / `existingDindCertsSecret` +- **Removed** `.monitor.clusterId` / `.monitor.token` / `.monitor.existingMonitorToken` + +#### Migrate the Helm chart from version 5.x to 6.x + +Given this is the legacy `generated_values.yaml` values: + +> legacy `generated_values.yaml` +```yaml +{ + "appProxy": { + "enabled": false, + }, + "monitor": { + "enabled": false, + "clusterId": "my-cluster-name", + "token": "1234567890" + }, + "global": { + "namespace": "namespace", + "codefreshHost": "https://g.codefresh.io", + "agentToken": "0987654321", + "agentId": "agent-id-here", + "agentName": "my-cluster-name_my-namespace", + "accountId": "my-account-id", + "runtimeName": "my-cluster-name/my-namespace", + "codefreshToken": "1234567890", + "keys": { + "key": "-----BEGIN RSA PRIVATE KEY-----...", + "csr": "-----BEGIN CERTIFICATE REQUEST-----...", + "ca": "-----BEGIN CERTIFICATE-----...", + "serverCert": "-----BEGIN CERTIFICATE-----..." + } + } +} +``` + +Update `values.yaml` for new chart version: + +> For existing installation for backward compatibility `.Values.global.agentToken/agentTokenSecretKeyRef` **must be provided!** For installation from scratch this value is no longer required. + +> updated `values.yaml` +```yaml +global: + codefreshToken: "1234567890" + accountId: "my-account-id" + context: "my-cluster-name" + agentToken: "0987654321" # MANDATORY when migrating from < 6.x chart version ! + agentName: "my-cluster-name_my-namespace" # optional + runtimeName: "my-cluster-name/my-namespace" # optional +``` + +> **Note!** Though it's still possible to update runtime-environment via [get](https://codefresh-io.github.io/cli/runtime-environments/get-runtime-environments/) and [patch](https://codefresh-io.github.io/cli/runtime-environments/apply-runtime-environments/) commands, it's recommended to enable sidecar container to pull runtime spec from Codefresh API to detect any drift in configuration. + +```yaml +runner: + # -- Sidecar container + # Reconciles runtime spec from Codefresh API for drift detection + sidecar: + enabled: true +``` + +## Architecture + +[Codefresh Runner architecture](https://codefresh.io/docs/docs/installation/codefresh-runner/#codefresh-runner-architecture) + +## Configuration + +See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). + +### EBS backend volume configuration + +`dind-volume-provisioner` should have permissions to create/attach/detach/delete/get EBS volumes + +Minimal IAM policy for `dind-volume-provisioner` + +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "ec2:AttachVolume", + "ec2:CreateSnapshot", + "ec2:CreateTags", + "ec2:CreateVolume", + "ec2:DeleteSnapshot", + "ec2:DeleteTags", + "ec2:DeleteVolume", + "ec2:DescribeInstances", + "ec2:DescribeSnapshots", + "ec2:DescribeTags", + "ec2:DescribeVolumes", + "ec2:DetachVolume" + ], + "Resource": "*" + } + ] +} +``` + +There are three options: + +1. Run `dind-volume-provisioner` pod on the node/node-group with IAM role + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: ebs-csi + + ebs: + availabilityZone: "us-east-1a" + +volumeProvisioner: + # -- Set node selector + nodeSelector: {} + # -- Set tolerations + tolerations: [] +``` + +2. Pass static credentials in `.Values.storage.ebs.accessKeyId/accessKeyIdSecretKeyRef` and `.Values.storage.ebs.secretAccessKey/secretAccessKeySecretKeyRef` + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: ebs-csi + + ebs: + availabilityZone: "us-east-1a" + + # -- Set AWS_ACCESS_KEY_ID for volume-provisioner (optional) + accessKeyId: "" + # -- Existing secret containing AWS_ACCESS_KEY_ID. + accessKeyIdSecretKeyRef: {} + # E.g. + # accessKeyIdSecretKeyRef: + # name: + # key: + + # -- Set AWS_SECRET_ACCESS_KEY for volume-provisioner (optional) + secretAccessKey: "" + # -- Existing secret containing AWS_SECRET_ACCESS_KEY + secretAccessKeySecretKeyRef: {} + # E.g. + # secretAccessKeySecretKeyRef: + # name: + # key: +``` + +3. Assign IAM role to `dind-volume-provisioner` service account + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: ebs-csi + + ebs: + availabilityZone: "us-east-1a" + +volumeProvisioner: + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Additional service account annotations + annotations: + eks.amazonaws.com/role-arn: "arn:aws:iam:::role/" +``` + +### Custom volume mounts + +You can add your own volumes and volume mounts in the runtime environment, so that all pipeline steps will have access to the same set of external files. + +```yaml +runtime: + dind: + userVolumes: + regctl-docker-registry: + name: regctl-docker-registry + secret: + items: + - key: .dockerconfigjson + path: config.json + secretName: regctl-docker-registry + optional: true + userVolumeMounts: + regctl-docker-registry: + name: regctl-docker-registry + mountPath: /home/appuser/.docker/ + readOnly: true + +``` + +### Azure Disks backend volume configuration + +`dind-volume-provisioner` should have permissions to create/delete/get Azure Disks + +Role definition for `dind-volume-provisioner` + +`dind-volume-provisioner-role.json` +```json +{ + "Name": "CodefreshDindVolumeProvisioner", + "Description": "Perform create/delete/get disks", + "IsCustom": true, + "Actions": [ + "Microsoft.Compute/disks/read", + "Microsoft.Compute/disks/write", + "Microsoft.Compute/disks/delete" + + ], + "AssignableScopes": ["/subscriptions/"] +} +``` + +When creating an AKS cluster in Azure there is the option to use a [managed identity](https://learn.microsoft.com/en-us/azure/aks/use-managed-identity) that is assigned to the kubelet. This identity is assigned to the underlying node pool in the AKS cluster and can then be used by the dind-volume-provisioner. + +```console +export ROLE_DEFINITIN_FILE=dind-volume-provisioner-role.json +export SUBSCRIPTION_ID=$(az account show --query "id" | xargs echo ) +export RESOURCE_GROUP= +export AKS_NAME= +export LOCATION=$(az aks show -g $RESOURCE_GROUP -n $AKS_NAME --query location | xargs echo) +export NODES_RESOURCE_GROUP=MC_${RESOURCE_GROUP}_${AKS_NAME}_${LOCATION} +export NODE_SERVICE_PRINCIPAL=$(az aks show -g $RESOURCE_GROUP -n $AKS_NAME --query identityProfile.kubeletidentity.objectId | xargs echo) + +az role definition create --role-definition @${ROLE_DEFINITIN_FILE} +az role assignment create --assignee $NODE_SERVICE_PRINCIPAL --scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$NODES_RESOURCE_GROUP --role CodefreshDindVolumeProvisioner +``` + +Deploy Helm chart with the following values: + +`values.yaml` +```yaml +volumeProvisioner: + podSecurityContext: + enabled: true + runAsUser: 0 + runAsGroup: 0 + fsGroup: 0 + +storage: + backend: azuredisk + azuredisk: + availabilityZone: northeurope-1 # replace with your zone + resourceGroup: my-resource-group-name + + mountAzureJson: true + +runtime: + dind: + nodeSelector: + topology.kubernetes.io/zone: northeurope-1 +``` + +### GCE Disks backend volume configuration in GKE + +`dind-volume-provisioner` should have `ComputeEngine.StorageAdmin` permissions + +There are three options: + +1. Run `dind-volume-provisioner` pod on the node/node-group with IAM Service Account + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: gcedisk + + gcedisk: + # -- Set GCP volume backend type (`pd-ssd`/`pd-standard`) + volumeType: "pd-standard" + # -- Set GCP volume availability zone + availabilityZone: "us-central1-c" + +volumeProvisioner: + # -- Set node selector + nodeSelector: {} + # -- Set tolerations + tolerations: [] + +# -- Set runtime parameters +runtime: + # -- Parameters for DinD (docker-in-docker) pod + dind: + # -- Set node selector. + nodeSelector: + topology.kubernetes.io/zone: us-central1-c +``` + +2. Pass static credentials in `.Values.storage.gcedisk.serviceAccountJson` (inline) or `.Values.storage.gcedisk.serviceAccountJsonSecretKeyRef` (from your own secret) + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: gcedisk + + gcedisk: + # -- Set GCP volume backend type (`pd-ssd`/`pd-standard`) + volumeType: "`pd-standard" + # -- Set GCP volume availability zone + availabilityZone: "us-central1-c" + # -- Set Google SA JSON key for volume-provisioner (optional) + serviceAccountJson: | + { + "type": "service_account", + "project_id": "...", + "private_key_id": "...", + "private_key": "...", + "client_email": "...", + "client_id": "...", + "auth_uri": "...", + "token_uri": "...", + "auth_provider_x509_cert_url": "...", + "client_x509_cert_url": "..." + } + # -- Existing secret containing containing Google SA JSON key for volume-provisioner (optional) + serviceAccountJsonSecretKeyRef: {} + # E.g.: + # serviceAccountJsonSecretKeyRef: + # name: gce-service-account + # key: service-account.json + +# -- Set runtime parameters +runtime: + # -- Parameters for DinD (docker-in-docker) pod + dind: + # -- Set node selector. + nodeSelector: + topology.kubernetes.io/zone: us-central1-c +``` + +3. Assign IAM role to `dind-volume-provisioner` service account + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: gcedisk + + gcedisk: + # -- Set GCP volume backend type (`pd-ssd`/`pd-standard`) + volumeType: "`pd-standard" + # -- Set GCP volume availability zone + availabilityZone: "us-central1-c" + +volumeProvisioner: + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Additional service account annotations + annotations: + iam.gke.io/gcp-service-account: @.iam.gserviceaccount.com + +# -- Set runtime parameters +runtime: + # -- Parameters for DinD (docker-in-docker) pod + dind: + # -- Set node selector. + nodeSelector: + topology.kubernetes.io/zone: us-central1-c +``` + +### Custom global environment variables + +You can add your own environment variables to the runtime environment. All pipeline steps have access to the global variables. + +```yaml +runtime: + engine: + userEnvVars: + - name: GITHUB_TOKEN + valueFrom: + secretKeyRef: + name: github-token + key: token +``` + +### Volume reuse policy + +Volume reuse behavior depends on the configuration for `reuseVolumeSelector` in the runtime environment spec. + +```yaml +runtime: + dind: + pvcs: + - name: dind + ... + reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName' + reuseVolumeSortOrder: pipeline_id +``` + +The following options are available: +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName'` - PV can be used by ANY pipeline in the specified account (default). +Benefit: Fewer PVs, resulting in lower costs. Since any PV can be used by any pipeline, the cluster needs to maintain/reserve fewer PVs in its PV pool for Codefresh. +Downside: Since the PV can be used by any pipeline, the PVs could have assets and info from different pipelines, reducing the probability of cache. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,project_id'` - PV can be used by ALL pipelines in your account, assigned to the same project. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,pipeline_id'` - PV can be used only by a single pipeline. +Benefit: More probability of cache without “spam” from other pipelines. +Downside: More PVs to maintain and therefore higher costs. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,pipeline_id,io.codefresh.branch_name'` - PV can be used only by single pipeline AND single branch. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,pipeline_id,trigger'` - PV can be used only by single pipeline AND single trigger. + +### Volume cleaners + +Codefresh pipelines require disk space for: + * [Pipeline Shared Volume](https://codefresh.io/docs/docs/pipelines/introduction-to-codefresh-pipelines/#sharing-the-workspace-between-build-steps) (`/codefresh/volume`, implemented as [docker volume](https://docs.docker.com/storage/volumes/)) + * Docker containers, both running and stopped + * Docker images and cached layers + +Codefresh offers two options to manage disk space and prevent out-of-space errors: +* Use runtime cleaners on Docker images and volumes +* [Set the minimum disk space per pipeline build volume](https://codefresh.io/docs/docs/pipelines/pipelines/#set-minimum-disk-space-for-a-pipeline-build) + +To improve performance by using Docker cache, Codefresh `volume-provisioner` can provision previously used disks with Docker images and pipeline volumes from previously run builds. + +### Types of runtime volume cleaners + +Docker images and volumes must be cleaned on a regular basis. + +* [IN-DIND cleaner](https://github.com/codefresh-io/dind/tree/master/cleaner): Deletes extra Docker containers, volumes, and images in **DIND pod**. +* [External volume cleaner](https://github.com/codefresh-io/dind-volume-cleanup): Deletes unused **external** PVs (EBS, GCE/Azure disks). +* [Local volume cleaner](https://github.com/codefresh-io/dind-volume-utils/blob/master/local-volumes/lv-cleaner.sh): Deletes **local** volumes if node disk space is close to the threshold. + +### IN-DIND cleaner + +**Purpose:** Removes unneeded *docker containers, images, volumes* inside Kubernetes volume mounted on the DIND pod + +**How it runs:** Inside each DIND pod as script + +**Triggered by:** SIGTERM and also during the run when disk usage > 90% (configurable) + +**Configured by:** Environment Variables which can be set in Runtime Environment spec + +**Configuration/Logic:** [README.md](https://github.com/codefresh-io/dind/tree/master/cleaner#readme) + +Override `.Values.runtime.dind.env` if necessary (the following are **defaults**): + +```yaml +runtime: + dind: + env: + CLEAN_PERIOD_SECONDS: '21600' # launch clean if last clean was more than CLEAN_PERIOD_SECONDS seconds ago + CLEAN_PERIOD_BUILDS: '5' # launch clean if last clean was more CLEAN_PERIOD_BUILDS builds since last build + IMAGE_RETAIN_PERIOD: '14400' # do not delete docker images if they have events since current_timestamp - IMAGE_RETAIN_PERIOD + VOLUMES_RETAIN_PERIOD: '14400' # do not delete docker volumes if they have events since current_timestamp - VOLUMES_RETAIN_PERIOD + DISK_USAGE_THRESHOLD: '0.8' # launch clean based on current disk usage DISK_USAGE_THRESHOLD + INODES_USAGE_THRESHOLD: '0.8' # launch clean based on current inodes usage INODES_USAGE_THRESHOLD +``` + +### External volumes cleaner + +**Purpose:** Removes unused *kubernetes volumes and related backend volumes* + +**How it runs:** Runs as `dind-volume-cleanup` CronJob. Installed in case the Runner uses non-local volumes `.Values.storage.backend != local` + +**Triggered by:** CronJob every 10min (configurable) + +**Configuration:** + +Set `codefresh.io/volume-retention` for dinds' PVCs: + +```yaml +runtime: + dind: + pvcs: + dind: + ... + annotations: + codefresh.io/volume-retention: 7d +``` + +Or override environment variables for `dind-volume-cleanup` cronjob: + +```yaml +volumeProvisioner: + dind-volume-cleanup: + env: + RETENTION_DAYS: 7 # clean volumes that were last used more than `RETENTION_DAYS` (default is 4) ago +``` + +### Local volumes cleaner + +**Purpose:** Deletes local volumes when node disk space is close to the threshold + +**How it runs:** Runs as `dind-lv-monitor` DaemonSet. Installed in case the Runner uses local volumes `.Values.storage.backend == local` + +**Triggered by:** Disk space usage or inode usage that exceeds thresholds (configurable) + +**Configuration:** + +Override environment variables for `dind-lv-monitor` daemonset: + +```yaml +volumeProvisioner: + dind-lv-monitor: + env: + KB_USAGE_THRESHOLD: 60 # default 80 (percentage) + INODE_USAGE_THRESHOLD: 60 # default 80 +``` + +### Rootless DinD + +DinD pod runs a `priviliged` container with **rootfull** docker. +To run the docker daemon as non-root user (**rootless** mode), change dind image tag: + +`values.yaml` +```yaml +runtime: + dind: + image: + tag: rootless +``` + +### ARM + +With the Codefresh Runner, you can run native ARM64v8 builds. + +> **Note!** +> You cannot run both amd64 and arm64 images within the same pipeline. As one pipeline can map only to one runtime, you can run either amd64 or arm64 within the same pipeline. + +Provide `nodeSelector` and(or) `tolerations` for dind pods: + +`values.yaml` +```yaml +runtime: + dind: + nodeSelector: + arch: arm64 + tolerations: + - key: arch + operator: Equal + value: arm64 + effect: NoSchedule +``` + +### Openshift + +To install Codefresh Runner on OpenShift use the following `values.yaml` example + +```yaml +runner: + podSecurityContext: + enabled: false + +volumeProvisioner: + podSecurityContext: + enabled: false + env: + PRIVILEGED_CONTAINER: true + dind-lv-monitor: + containerSecurityContext: + enabled: true + privileged: true + volumePermissions: + enabled: true + securityContext: + privileged: true + runAsUser: auto +``` + +Grant `privileged` SCC to `cf-runtime-runner` and `cf-runtime-volume-provisioner` service accounts. + +```console +oc adm policy add-scc-to-user privileged system:serviceaccount:codefresh:cf-runtime-runner + +oc adm policy add-scc-to-user privileged system:serviceaccount:codefresh:cf-runtime-volume-provisioner +``` + +### On-premise + +If you have [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) deployed, you can install Codefresh Runner in **agentless** mode. + +**What is agentless mode?** + +Agent (aka venona) is Runner component which responsible for calling Codefresh API to run builds and create dind/engine pods and pvc objects. Agent can only be assigned to a single account, thus you can't share one runtime across multiple accounts. However, with **agentless** mode it's possible to register the runtime as **system**-type runtime so it's registered on the platform level and can be assigned/shared across multiple accounts. + +**What are the prerequisites?** +- You have a running [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) control-plane environment +- You have a Codefresh API token with platform **Admin** permissions scope + + +### How to deploy agentless runtime when it's on the SAME k8s cluster as On-Premises control-plane environment? + +- Enable cluster-level permissions for cf-api (On-Premises control-plane component) + +> `values.yaml` for [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) Helm chart +```yaml +cfapi: + ... + # -- Enable ClusterRole/ClusterRoleBinding + rbac: + namespaced: false +``` + +- Set the following values for Runner Helm chart + +`.Values.global.codefreshHost=...` \ +`.Values.global.codefreshToken=...` \ +`.Values.global.runtimeName=system/...` \ +`.Values.runtime.agent=false` \ +`.Values.runtime.inCluster=true` + +> `values.yaml` for [Codefresh Runner](https://artifacthub.io/packages/helm/codefresh-runner/cf-runtime) helm chart +```yaml +global: + # -- URL of Codefresh On-Premises Platform + codefreshHost: "https://myonprem.somedomain.com" + # -- User token in plain text with Admin permission scope + codefreshToken: "" + # -- User token that references an existing secret containing API key. + codefreshTokenSecretKeyRef: {} + # E.g. + # codefreshTokenSecretKeyRef: + # name: my-codefresh-api-token + # key: codefresh-api-token + + # -- Distinguished runtime name + # (for On-Premise only; mandatory!) Must be prefixed with "system/..." + runtimeName: "system/prod-ue1-some-cluster-name" + +# -- Set runtime parameters +runtime: + # -- (for On-Premise only; mandatory!) Disable agent + agent: false + # -- (for On-Premise only; optional) Set inCluster runtime (default: `true`) + # `inCluster=true` flag is set when Runtime and On-Premises control-plane are run on the same cluster + # `inCluster=false` flag is set when Runtime and On-Premises control-plane are on different clusters + inCluster: true + # -- (for On-Premise only; optional) Assign accounts to runtime (list of account ids; default is empty) + # Accounts can be assigned to the runtime in Codefresh UI later so you can kepp it empty. + accounts: [] + # -- Set parent runtime to inherit. + runtimeExtends: [] +``` + +- Install the chart + +```console +helm upgrade --install cf-runtime oci://quay.io/codefresh/cf-runtime -f values.yaml --create-namespace --namespace cf-runtime +``` + +- Verify the runtime and run test pipeline + +Go to [https:///admin/runtime-environments/system](https:///admin/runtime-environments/system) to check the runtime. Assign it to the required account(s). Run test pipeline on it. + + +### How to deploy agentless runtime when it's on the DIFFERENT k8s cluster than On-Premises control-plane environment? + +In this case, it's required to mount runtime cluster's `KUBECONFIG` into On-Premises `cf-api` deployment + +- Create the neccessary RBAC resources + +> `values.yaml` for [Codefresh Runner](https://artifacthub.io/packages/helm/codefresh-runner/cf-runtime) helm chart +```yaml +extraResources: +- apiVersion: rbac.authorization.k8s.io/v1 + kind: Role + metadata: + name: codefresh-role + namespace: '{{ "{{ .Release.Namespace }}" }}' + rules: + - apiGroups: [""] + resources: ["pods", "persistentvolumeclaims", "persistentvolumes"] + verbs: ["list", "watch", "get", "create", "patch", "delete"] + - apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshots"] + verbs: ["list", "watch", "get", "create", "patch", "delete"] +- apiVersion: v1 + kind: ServiceAccount + metadata: + name: codefresh-runtime-user + namespace: '{{ "{{ .Release.Namespace }}" }}' +- apiVersion: rbac.authorization.k8s.io/v1 + kind: RoleBinding + metadata: + name: codefresh-runtime-user + namespace: '{{ "{{ .Release.Namespace }}" }}' + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: codefresh-role + subjects: + - kind: ServiceAccount + name: codefresh-runtime-user + namespace: '{{ "{{ .Release.Namespace }}" }}' +- apiVersion: v1 + kind: Secret + metadata: + name: codefresh-runtime-user-token + namespace: '{{ "{{ .Release.Namespace }}" }}' + annotations: + kubernetes.io/service-account.name: codefresh-runtime-user + type: kubernetes.io/service-account-token +``` + +- Set up the following environment variables to create a `KUBECONFIG` file + +```shell +NAMESPACE=cf-runtime +CLUSTER_NAME=prod-ue1-some-cluster-name +CURRENT_CONTEXT=$(kubectl config current-context) + +USER_TOKEN_VALUE=$(kubectl -n cf-runtime get secret/codefresh-runtime-user-token -o=go-template='{{ `{{.data.token}}` }}' | base64 --decode) +CURRENT_CLUSTER=$(kubectl config view --raw -o=go-template='{{ `{{range .contexts}}{{if eq .name "'''${CURRENT_CONTEXT}'''"}}{{ index .context "cluster" }}{{end}}{{end}}` }}') +CLUSTER_CA=$(kubectl config view --raw -o=go-template='{{ `{{range .clusters}}{{if eq .name "'''${CURRENT_CLUSTER}'''"}}"{{with index .cluster "certificate-authority-data" }}{{.}}{{end}}"{{ end }}{{ end }}` }}') +CLUSTER_SERVER=$(kubectl config view --raw -o=go-template='{{ `{{range .clusters}}{{if eq .name "'''${CURRENT_CLUSTER}'''"}}{{ .cluster.server }}{{end}}{{ end }}` }}') + +export -p USER_TOKEN_VALUE CURRENT_CONTEXT CURRENT_CLUSTER CLUSTER_CA CLUSTER_SERVER CLUSTER_NAME +``` + +- Create a kubeconfig file + +```console +cat << EOF > $CLUSTER_NAME-kubeconfig +apiVersion: v1 +kind: Config +current-context: ${CLUSTER_NAME} +contexts: +- name: ${CLUSTER_NAME} + context: + cluster: ${CLUSTER_NAME} + user: codefresh-runtime-user + namespace: ${NAMESPACE} +clusters: +- name: ${CLUSTER_NAME} + cluster: + certificate-authority-data: ${CLUSTER_CA} + server: ${CLUSTER_SERVER} +users: +- name: ${CLUSTER_NAME} + user: + token: ${USER_TOKEN_VALUE} +EOF +``` + +- **Switch context to On-Premises control-plane cluster**. Create k8s secret (via any tool like [ESO](https://external-secrets.io/v0.4.4/), `kubectl`, etc ) containing runtime cluster's `KUBECONFG` created in previous step. + +```shell +NAMESPACE=codefresh +kubectl create secret generic dind-runtime-clusters --from-file=$CLUSTER_NAME=$CLUSTER_NAME-kubeconfig -n $NAMESPACE +``` + +- Mount secret containing runtime cluster's `KUBECONFG` into cf-api in On-Premises control-plane cluster + +> `values.yaml` for [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) helm chart +```yaml +cf-api: + ... + volumes: + dind-clusters: + enabled: true + type: secret + nameOverride: dind-runtime-clusters + optional: true +``` +> volumeMount `/etc/kubeconfig` is already configured in cf-api Helm chart template. No need to specify it. + +- Set the following values for Runner helm chart + +> `values.yaml` for [Codefresh Runner](https://artifacthub.io/packages/helm/codefresh-runner/cf-runtime) helm chart + +`.Values.global.codefreshHost=...` \ +`.Values.global.codefreshToken=...` \ +`.Values.global.runtimeName=system/...` \ +`.Values.runtime.agent=false` \ +`.Values.runtime.inCluster=false` + +**Important!** +`.Values.global.name` ("system/" prefix is ignored!) should match the cluster name (key in `dind-runtime-clusters` secret created previously) +```yaml +global: + # -- URL of Codefresh On-Premises Platform + codefreshHost: "https://myonprem.somedomain.com" + # -- User token in plain text with Admin permission scope + codefreshToken: "" + # -- User token that references an existing secret containing API key. + codefreshTokenSecretKeyRef: {} + # E.g. + # codefreshTokenSecretKeyRef: + # name: my-codefresh-api-token + # key: codefresh-api-token + + # -- Distinguished runtime name + # (for On-Premise only; mandatory!) Must be prefixed with "system/..." + name: "system/prod-ue1-some-cluster-name" + +# -- Set runtime parameters +runtime: + # -- (for On-Premise only; mandatory!) Disable agent + agent: false + # -- (for On-Premise only; optional) Set inCluster runtime (default: `true`) + # `inCluster=true` flag is set when Runtime and On-Premises control-plane are run on the same cluster + # `inCluster=false` flag is set when Runtime and On-Premises control-plane are on different clusters + inCluster: false + # -- (for On-Premise only; optional) Assign accounts to runtime (list of account ids; default is empty) + # Accounts can be assigned to the runtime in Codefresh UI later so you can kepp it empty. + accounts: [] + # -- (optional) Set parent runtime to inherit. + runtimeExtends: [] +``` + +- Install the chart + +```console +helm upgrade --install cf-runtime oci://quay.io/codefresh/cf-runtime -f values.yaml --create-namespace --namespace cf-runtime +``` + +- Verify the runtime and run test pipeline + +Go to [https:///admin/runtime-environments/system](https:///admin/runtime-environments/system) to see the runtime. Assign it to the required account(s). + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + diff --git a/charts/codefresh/cf-runtime/6.4.5/files/cleanup-runtime.sh b/charts/codefresh/cf-runtime/6.4.5/files/cleanup-runtime.sh new file mode 100644 index 000000000..c1fc5f368 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/files/cleanup-runtime.sh @@ -0,0 +1,37 @@ +#!/bin/bash + +echo "-----" +echo "API_HOST: ${API_HOST}" +echo "AGENT_NAME: ${AGENT_NAME}" +echo "RUNTIME_NAME: ${RUNTIME_NAME}" +echo "AGENT: ${AGENT}" +echo "AGENT_SECRET_NAME: ${AGENT_SECRET_NAME}" +echo "DIND_SECRET_NAME: ${DIND_SECRET_NAME}" +echo "-----" + +auth() { + codefresh auth create-context --api-key ${API_TOKEN} --url ${API_HOST} +} + +remove_runtime() { + if [ "$AGENT" == "true" ]; then + codefresh delete re ${RUNTIME_NAME} || true + else + codefresh delete sys-re ${RUNTIME_NAME} || true + fi +} + +remove_agent() { + codefresh delete agent ${AGENT_NAME} || true +} + +remove_secrets() { + kubectl patch secret $(kubectl get secret -l codefresh.io/internal=true | awk 'NR>1{print $1}' | xargs) -p '{"metadata":{"finalizers":null}}' --type=merge || true + kubectl delete secret $AGENT_SECRET_NAME || true + kubectl delete secret $DIND_SECRET_NAME || true +} + +auth +remove_runtime +remove_agent +remove_secrets \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/files/configure-dind-certs.sh b/charts/codefresh/cf-runtime/6.4.5/files/configure-dind-certs.sh new file mode 100644 index 000000000..a1092eb1e --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/files/configure-dind-certs.sh @@ -0,0 +1,132 @@ +#!/usr/bin/env bash +# + +#--- +fatal() { + echo "ERROR: $1" + exit 1 +} + +msg() { echo -e "\e[32mINFO ---> $1\e[0m"; } +err() { echo -e "\e[31mERR ---> $1\e[0m" ; return 1; } + +exit_trap () { + local lc="$BASH_COMMAND" rc=$? + if [ $rc != 0 ]; then + if [[ -n "$SLEEP_ON_ERROR" ]]; then + echo -e "\nSLEEP_ON_ERROR is set - Sleeping to fix error" + sleep $SLEEP_ON_ERROR + fi + fi +} +trap exit_trap EXIT + +usage() { + echo "Usage: + $0 [-n | --namespace] [--server-cert-cn] [--server-cert-extra-sans] codefresh-api-host codefresh-api-token + +Example: + $0 -n workflow https://g.codefresh.io 21341234.423141234.412431234 + +" +} + +# Args +while [[ $1 =~ ^(-(n|h)|--(namespace|server-cert-cn|server-cert-extra-sans|help)) ]] +do + key=$1 + value=$2 + + case $key in + -h|--help) + usage + exit + ;; + -n|--namespace) + NAMESPACE="$value" + shift + ;; + --server-cert-cn) + SERVER_CERT_CN="$value" + shift + ;; + --server-cert-extra-sans) + SERVER_CERT_EXTRA_SANS="$value" + shift + ;; + esac + shift # past argument or value +done + +API_HOST=${1:-"$CF_API_HOST"} +API_TOKEN=${2:-"$CF_API_TOKEN"} + +[[ -z "$API_HOST" ]] && usage && fatal "Missing API_HOST" +[[ -z "$API_TOKEN" ]] && usage && fatal "Missing token" + + +API_SIGN_PATH=${API_SIGN_PATH:-"api/custom_clusters/signServerCerts"} + +NAMESPACE=${NAMESPACE:-default} +RELEASE=${RELEASE:-cf-runtime} + +DIR=$(dirname $0) +TMPDIR=/tmp/codefresh/ + +TMP_CERTS_FILE_ZIP=$TMPDIR/cf-certs.zip +TMP_CERTS_HEADERS_FILE=$TMPDIR/cf-certs-response-headers.txt +CERTS_DIR=$TMPDIR/ssl +SRV_TLS_CA_CERT=${CERTS_DIR}/ca.pem +SRV_TLS_KEY=${CERTS_DIR}/server-key.pem +SRV_TLS_CSR=${CERTS_DIR}/server-cert.csr +SRV_TLS_CERT=${CERTS_DIR}/server-cert.pem +CF_SRV_TLS_CERT=${CERTS_DIR}/cf-server-cert.pem +CF_SRV_TLS_CA_CERT=${CERTS_DIR}/cf-ca.pem +mkdir -p $TMPDIR $CERTS_DIR + +K8S_CERT_SECRET_NAME=codefresh-certs-server +echo -e "\n------------------\nGenerating server tls certificates ... " + +SERVER_CERT_CN=${SERVER_CERT_CN:-"docker.codefresh.io"} +SERVER_CERT_EXTRA_SANS="${SERVER_CERT_EXTRA_SANS}" +### + + openssl genrsa -out $SRV_TLS_KEY 4096 || fatal "Failed to generate openssl key " + openssl req -subj "/CN=${SERVER_CERT_CN}" -new -key $SRV_TLS_KEY -out $SRV_TLS_CSR || fatal "Failed to generate openssl csr " + GENERATE_CERTS=true + CSR=$(sed ':a;N;$!ba;s/\n/\\n/g' ${SRV_TLS_CSR}) + + SERVER_CERT_SANS="IP:127.0.0.1,DNS:dind,DNS:*.dind.${NAMESPACE},DNS:*.dind.${NAMESPACE}.svc${KUBE_DOMAIN},DNS:*.cf-cd.com,DNS:*.codefresh.io" + if [[ -n "${SERVER_CERT_EXTRA_SANS}" ]]; then + SERVER_CERT_SANS=${SERVER_CERT_SANS},${SERVER_CERT_EXTRA_SANS} + fi + echo "{\"reqSubjectAltName\": \"${SERVER_CERT_SANS}\", \"csr\": \"${CSR}\" }" > ${TMPDIR}/sign_req.json + + rm -fv ${TMP_CERTS_HEADERS_FILE} ${TMP_CERTS_FILE_ZIP} + + SIGN_STATUS=$(curl -k -sSL -d @${TMPDIR}/sign_req.json -H "Content-Type: application/json" -H "Authorization: ${API_TOKEN}" -H "Expect: " \ + -o ${TMP_CERTS_FILE_ZIP} -D ${TMP_CERTS_HEADERS_FILE} -w '%{http_code}' ${API_HOST}/${API_SIGN_PATH} ) + + echo "Sign request completed with HTTP_STATUS_CODE=$SIGN_STATUS" + if [[ $SIGN_STATUS != 200 ]]; then + echo "ERROR: Cannot sign certificates" + if [[ -f ${TMP_CERTS_FILE_ZIP} ]]; then + mv ${TMP_CERTS_FILE_ZIP} ${TMP_CERTS_FILE_ZIP}.error + cat ${TMP_CERTS_FILE_ZIP}.error + fi + exit 1 + fi + unzip -o -d ${CERTS_DIR}/ ${TMP_CERTS_FILE_ZIP} || fatal "Failed to unzip certificates to ${CERTS_DIR} " + cp -v ${CF_SRV_TLS_CA_CERT} $SRV_TLS_CA_CERT || fatal "received ${TMP_CERTS_FILE_ZIP} does not contains ca.pem" + cp -v ${CF_SRV_TLS_CERT} $SRV_TLS_CERT || fatal "received ${TMP_CERTS_FILE_ZIP} does not contains cf-server-cert.pem" + + +echo -e "\n------------------\nCreating certificate secret " + +kubectl -n $NAMESPACE create secret generic $K8S_CERT_SECRET_NAME \ + --from-file=$SRV_TLS_CA_CERT \ + --from-file=$SRV_TLS_KEY \ + --from-file=$SRV_TLS_CERT \ + --dry-run=client -o yaml | kubectl apply --overwrite -f - +kubectl -n $NAMESPACE label --overwrite secret ${K8S_CERT_SECRET_NAME} codefresh.io/internal=true +kubectl -n $NAMESPACE patch secret $K8S_CERT_SECRET_NAME -p '{"metadata": {"finalizers": ["kubernetes"]}}' diff --git a/charts/codefresh/cf-runtime/6.4.5/files/init-runtime.sh b/charts/codefresh/cf-runtime/6.4.5/files/init-runtime.sh new file mode 100644 index 000000000..eb3488af1 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/files/init-runtime.sh @@ -0,0 +1,80 @@ +#!/bin/bash + +echo "-----" +echo "API_HOST: ${API_HOST}" +echo "AGENT_NAME: ${AGENT_NAME}" +echo "KUBE_CONTEXT: ${KUBE_CONTEXT}" +echo "KUBE_NAMESPACE: ${KUBE_NAMESPACE}" +echo "OWNER_NAME: ${OWNER_NAME}" +echo "RUNTIME_NAME: ${RUNTIME_NAME}" +echo "SECRET_NAME: ${SECRET_NAME}" +echo "-----" + +create_agent_secret() { + + kubectl apply -f - < $1\e[0m"; } +err() { echo -e "\e[31mERR ---> $1\e[0m" ; return 1; } + + +if [ -z "${USER_CODEFRESH_TOKEN}" ]; then + err "missing codefresh user token. must supply \".global.codefreshToken\" if agent-codefresh-token does not exist" + exit 1 +fi + +codefresh auth create-context --api-key ${USER_CODEFRESH_TOKEN} --url ${API_HOST} + +while true; do + msg "Reconciling ${RUNTIME_NAME} runtime" + + sleep $RECONCILE_INTERVAL + + codefresh get re \ + --name ${RUNTIME_NAME} \ + -o yaml \ + | yq 'del(.version, .metadata.changedBy, .metadata.creationTime)' > /tmp/runtime.yaml + + kubectl get cm ${CONFIGMAP_NAME} -n ${KUBE_NAMESPACE} -o yaml \ + | yq 'del(.metadata.resourceVersion, .metadata.uid)' \ + | yq eval '.data["runtime.yaml"] = load_str("/tmp/runtime.yaml")' \ + | kubectl apply -f - +done diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_deployment.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_deployment.yaml new file mode 100644 index 000000000..26f3576b7 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_deployment.yaml @@ -0,0 +1,70 @@ +{{- define "app-proxy.resources.deployment" -}} +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "app-proxy.fullname" . }} + labels: + {{- include "app-proxy.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicasCount }} + strategy: + type: {{ .Values.updateStrategy.type }} + selector: + matchLabels: + {{- include "app-proxy.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "app-proxy.selectorLabels" . | nindent 8 }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- include (printf "%s.image.pullSecrets" $cfCommonTplSemver ) . | nindent 8 }} + serviceAccountName: {{ include "app-proxy.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + containers: + - name: app-proxy + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.image "context" .) }} + imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }} + env: + {{- include "app-proxy.environment-variables" . | nindent 8 }} + ports: + - name: http + containerPort: 3000 + readinessProbe: + initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.readinessProbe.failureThreshold }} + httpGet: + path: /health + port: http + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + {{- with .Values.extraVolumeMounts }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + volumes: + {{- with .Values.extraVolumes }} + {{- toYaml . | nindent 6 }} + {{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_env-vars.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_env-vars.yaml new file mode 100644 index 000000000..c9b9a0e36 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_env-vars.yaml @@ -0,0 +1,19 @@ +{{- define "app-proxy.environment-variables.defaults" }} +PORT: 3000 +{{- end }} + +{{- define "app-proxy.environment-variables.calculated" }} +CODEFRESH_HOST: {{ include "runtime.runtime-environment-spec.codefresh-host" . }} +{{- with .Values.ingress.pathPrefix }} +API_PATH_PREFIX: {{ . | quote }} +{{- end }} +{{- end }} + +{{- define "app-proxy.environment-variables" }} +{{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{- $defaults := (include "app-proxy.environment-variables.defaults" . | fromYaml) }} +{{- $calculated := (include "app-proxy.environment-variables.calculated" . | fromYaml) }} +{{- $overrides := .Values.env }} +{{- $mergedValues := mergeOverwrite (merge $defaults $calculated) $overrides }} +{{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $mergedValues "context" .) }} +{{- end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_helpers.tpl b/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_helpers.tpl new file mode 100644 index 000000000..2d4272ca9 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_helpers.tpl @@ -0,0 +1,43 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "app-proxy.name" -}} + {{- printf "%s-%s" (include "cf-runtime.name" .) "app-proxy" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "app-proxy.fullname" -}} + {{- printf "%s-%s" (include "cf-runtime.fullname" .) "app-proxy" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "app-proxy.labels" -}} +{{ include "cf-runtime.labels" . }} +codefresh.io/application: app-proxy +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "app-proxy.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +codefresh.io/application: app-proxy +{{- end }} + + +{{/* +Create the name of the service account to use +*/}} +{{- define "app-proxy.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "app-proxy.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_ingress.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_ingress.yaml new file mode 100644 index 000000000..d7860b363 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_ingress.yaml @@ -0,0 +1,32 @@ +{{- define "app-proxy.resources.ingress" -}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "app-proxy.fullname" . }} + labels: {{- include "app-proxy.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.ingress.class (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ .Values.ingress.class }} + {{- end }} + {{- if .Values.ingress.tlsSecret }} + tls: + - hosts: + - {{ .Values.ingress.host }} + secretName: {{ .Values.tlsSecret }} + {{- end }} + rules: + - host: {{ .Values.ingress.host }} + http: + paths: + - path: {{ .Values.ingress.pathPrefix | default "/" }} + pathType: ImplementationSpecific + backend: + service: + name: {{ include "app-proxy.fullname" . }} + port: + number: 80 +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_rbac.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_rbac.yaml new file mode 100644 index 000000000..87bd869ba --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_rbac.yaml @@ -0,0 +1,47 @@ +{{- define "app-proxy.resources.rbac" -}} +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "app-proxy.serviceAccountName" . }} + labels: + {{- include "app-proxy.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +--- +{{- if .Values.rbac.create }} +kind: {{ .Values.rbac.namespaced | ternary "Role" "ClusterRole" }} +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "app-proxy.fullname" . }} + labels: + {{- include "app-proxy.labels" . | nindent 4 }} +rules: + - apiGroups: [ "" ] + resources: [ "secrets" ] + verbs: [ "get" ] +{{- with .Values.rbac.rules }} + {{ toYaml . | nindent 2 }} +{{- end }} +{{- end }} +--- +{{- if and .Values.serviceAccount.create .Values.rbac.create }} +kind: {{ .Values.rbac.namespaced | ternary "RoleBinding" "ClusterRoleBinding" }} +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "app-proxy.fullname" . }} + labels: + {{- include "app-proxy.labels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: {{ include "app-proxy.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: {{ include "app-proxy.fullname" . }} + apiGroup: rbac.authorization.k8s.io +{{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_service.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_service.yaml new file mode 100644 index 000000000..4c3a93bf2 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/app-proxy/_service.yaml @@ -0,0 +1,17 @@ +{{- define "app-proxy.resources.service" -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "app-proxy.fullname" . }} + labels: + {{- include "app-proxy.labels" . | nindent 4 }} +spec: + type: ClusterIP + ports: + - name: http + port: 80 + protocol: TCP + targetPort: 3000 + selector: + {{- include "app-proxy.selectorLabels" . | nindent 4 }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_deployment.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_deployment.yaml new file mode 100644 index 000000000..62588b4d3 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_deployment.yaml @@ -0,0 +1,62 @@ +{{- define "event-exporter.resources.deployment" -}} +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "event-exporter.fullname" . }} + labels: + {{- include "event-exporter.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicasCount }} + strategy: + type: {{ .Values.updateStrategy.type }} + selector: + matchLabels: + {{- include "event-exporter.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "event-exporter.selectorLabels" . | nindent 8 }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- include (printf "%s.image.pullSecrets" $cfCommonTplSemver ) . | nindent 8 }} + serviceAccountName: {{ include "event-exporter.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + containers: + - name: event-exporter + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.image "context" .) }} + imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }} + args: [--running-in-cluster=true] + env: + {{- include "event-exporter.environment-variables" . | nindent 8 }} + ports: + - name: metrics + containerPort: 9102 + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + {{- with .Values.extraVolumeMounts }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + volumes: + {{- with .Values.extraVolumes }} + {{- toYaml . | nindent 6 }} + {{- end }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_env-vars.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_env-vars.yaml new file mode 100644 index 000000000..d28d0776f --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_env-vars.yaml @@ -0,0 +1,14 @@ +{{- define "event-exporter.environment-variables.defaults" }} +{{- end }} + +{{- define "event-exporter.environment-variables.calculated" }} +{{- end }} + +{{- define "event-exporter.environment-variables" }} +{{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{- $defaults := (include "event-exporter.environment-variables.defaults" . | fromYaml) }} +{{- $calculated := (include "event-exporter.environment-variables.calculated" . | fromYaml) }} +{{- $overrides := .Values.env }} +{{- $mergedValues := mergeOverwrite (merge $defaults $calculated) $overrides }} +{{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $mergedValues "context" .) }} +{{- end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_helpers.tpl b/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_helpers.tpl new file mode 100644 index 000000000..5b8b5eff7 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_helpers.tpl @@ -0,0 +1,43 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "event-exporter.name" -}} + {{- printf "%s-%s" (include "cf-runtime.name" .) "event-exporter" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "event-exporter.fullname" -}} + {{- printf "%s-%s" (include "cf-runtime.fullname" .) "event-exporter" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "event-exporter.labels" -}} +{{ include "cf-runtime.labels" . }} +app: event-exporter +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "event-exporter.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +app: event-exporter +{{- end }} + + +{{/* +Create the name of the service account to use +*/}} +{{- define "event-exporter.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "event-exporter.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_rbac.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_rbac.yaml new file mode 100644 index 000000000..69d7b6b2f --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_rbac.yaml @@ -0,0 +1,47 @@ +{{- define "event-exporter.resources.rbac" -}} +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "event-exporter.serviceAccountName" . }} + labels: + {{- include "event-exporter.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +--- +{{- if .Values.rbac.create }} +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "event-exporter.fullname" . }} + labels: + {{- include "event-exporter.labels" . | nindent 4 }} +rules: + - apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +{{- with .Values.rbac.rules }} + {{ toYaml . | nindent 2 }} +{{- end }} +{{- end }} +--- +{{- if and .Values.serviceAccount.create .Values.rbac.create }} +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "event-exporter.fullname" . }} + labels: + {{- include "event-exporter.labels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: {{ include "event-exporter.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ include "event-exporter.fullname" . }} + apiGroup: rbac.authorization.k8s.io +{{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_service.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_service.yaml new file mode 100644 index 000000000..6fa29ec1a --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_service.yaml @@ -0,0 +1,17 @@ +{{- define "event-exporter.resources.service" -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "event-exporter.fullname" . }} + labels: + {{- include "event-exporter.labels" . | nindent 4 }} +spec: + type: ClusterIP + ports: + - name: metrics + port: 9102 + targetPort: metrics + protocol: TCP + selector: + {{- include "event-exporter.selectorLabels" . | nindent 4 }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_serviceMontor.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_serviceMontor.yaml new file mode 100644 index 000000000..6092443f0 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/event-exporter/_serviceMontor.yaml @@ -0,0 +1,14 @@ +{{- define "event-exporter.resources.serviceMonitor" -}} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "event-exporter.fullname" . }} + labels: + {{- include "event-exporter.labels" . | nindent 4 }} +spec: + endpoints: + - port: metrics + selector: + matchLabels: + {{- include "event-exporter.selectorLabels" . | nindent 6 }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_deployment.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_deployment.yaml new file mode 100644 index 000000000..7efa6557b --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_deployment.yaml @@ -0,0 +1,70 @@ +{{- define "monitor.resources.deployment" -}} +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "monitor.fullname" . }} + labels: + {{- include "monitor.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicasCount }} + strategy: + type: {{ .Values.updateStrategy.type }} + selector: + matchLabels: + {{- include "monitor.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "monitor.selectorLabels" . | nindent 8 }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- include (printf "%s.image.pullSecrets" $cfCommonTplSemver ) . | nindent 8 }} + serviceAccountName: {{ include "monitor.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + containers: + - name: monitor + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.image "context" .) }} + imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }} + env: + {{- include "monitor.environment-variables" . | nindent 8 }} + ports: + - name: http + containerPort: 9020 + readinessProbe: + initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.readinessProbe.failureThreshold }} + httpGet: + path: /api/ping + port: 9020 + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + {{- with .Values.extraVolumeMounts }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + volumes: + {{- with .Values.extraVolumes }} + {{- toYaml . | nindent 6 }} + {{- end }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_env-vars.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_env-vars.yaml new file mode 100644 index 000000000..f58c7fa25 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_env-vars.yaml @@ -0,0 +1,26 @@ +{{- define "monitor.environment-variables.defaults" }} +SERVICE_NAME: {{ include "monitor.fullname" . }} +PORT: 9020 +HELM3: true +NODE_OPTIONS: "--max_old_space_size=4096" +{{- end }} + +{{- define "monitor.environment-variables.calculated" }} +API_TOKEN: {{ include "runtime.installation-token-env-var-value" . | nindent 2 }} +CLUSTER_ID: {{ include "runtime.runtime-environment-spec.context-name" . }} +API_URL: {{ include "runtime.runtime-environment-spec.codefresh-host" . }}/api/k8s-monitor/events +ACCOUNT_ID: {{ .Values.global.accountId }} +NAMESPACE: {{ .Release.Namespace }} +{{- if .Values.rbac.namespaced }} +ROLE_BINDING: true +{{- end }} +{{- end }} + +{{- define "monitor.environment-variables" }} +{{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{- $defaults := (include "monitor.environment-variables.defaults" . | fromYaml) }} +{{- $calculated := (include "monitor.environment-variables.calculated" . | fromYaml) }} +{{- $overrides := .Values.env }} +{{- $mergedValues := mergeOverwrite (merge $defaults $calculated) $overrides }} +{{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $mergedValues "context" .) }} +{{- end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_helpers.tpl b/charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_helpers.tpl new file mode 100644 index 000000000..71cc1c027 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_helpers.tpl @@ -0,0 +1,42 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "monitor.name" -}} + {{- printf "%s-%s" (include "cf-runtime.name" .) "monitor" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "monitor.fullname" -}} + {{- printf "%s-%s" (include "cf-runtime.fullname" .) "monitor" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "monitor.labels" -}} +{{ include "cf-runtime.labels" . }} +codefresh.io/application: monitor +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "monitor.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +codefresh.io/application: monitor +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "monitor.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "monitor.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_rbac.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_rbac.yaml new file mode 100644 index 000000000..88204796a --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_rbac.yaml @@ -0,0 +1,56 @@ +{{- define "monitor.resources.rbac" -}} +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "monitor.serviceAccountName" . }} + labels: + {{- include "monitor.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +--- +{{- if .Values.rbac.create }} +kind: {{ .Values.rbac.namespaced | ternary "Role" "ClusterRole" }} +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "monitor.fullname" . }} + labels: + {{- include "monitor.labels" . | nindent 4 }} +rules: + - apiGroups: [ "" ] + resources: [ "*" ] + verbs: [ "get", "list", "watch", "create", "delete" ] + - apiGroups: [ "" ] + resources: [ "pods" ] + verbs: [ "get", "list", "watch", "create", "deletecollection" ] + - apiGroups: [ "extensions" ] + resources: [ "*" ] + verbs: [ "get", "list", "watch" ] + - apiGroups: [ "apps" ] + resources: [ "*" ] + verbs: [ "get", "list", "watch" ] +{{- with .Values.rbac.rules }} + {{ toYaml . | nindent 2 }} +{{- end }} +{{- end }} +--- +{{- if and .Values.serviceAccount.create .Values.rbac.create }} +kind: {{ .Values.rbac.namespaced | ternary "RoleBinding" "ClusterRoleBinding" }} +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "monitor.fullname" . }} + labels: + {{- include "monitor.labels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: {{ include "monitor.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: {{ .Values.rbac.namespaced | ternary "Role" "ClusterRole" }} + name: {{ include "monitor.fullname" . }} + apiGroup: rbac.authorization.k8s.io +{{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_service.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_service.yaml new file mode 100644 index 000000000..f6ae9bb0f --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/monitor/_service.yaml @@ -0,0 +1,17 @@ +{{- define "monitor.resources.service" -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "monitor.fullname" . }} + labels: + {{- include "monitor.labels" . | nindent 4 }} +spec: + type: ClusterIP + ports: + - name: http + port: 80 + protocol: TCP + targetPort: 9020 + selector: + {{- include "monitor.selectorLabels" . | nindent 4 }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/_deployment.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/_deployment.yaml new file mode 100644 index 000000000..e1fb9439a --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/_deployment.yaml @@ -0,0 +1,103 @@ +{{- define "runner.resources.deployment" -}} +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "runner.fullname" . }} + labels: + {{- include "runner.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicasCount }} + strategy: + type: {{ .Values.updateStrategy.type }} + selector: + matchLabels: + {{- include "runner.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "runner.selectorLabels" . | nindent 8 }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- include (printf "%s.image.pullSecrets" $cfCommonTplSemver ) . | nindent 8 }} + serviceAccountName: {{ include "runner.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + initContainers: + - name: init + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.init.image "context" .) }} + imagePullPolicy: {{ .Values.init.image.pullPolicy | default "IfNotPresent" }} + command: + - /bin/bash + args: + - -ec + - | {{ .Files.Get "files/init-runtime.sh" | nindent 10 }} + env: + {{- include "runner-init.environment-variables" . | nindent 8 }} + {{- with .Values.init.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + containers: + - name: runner + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.image "context" .) }} + imagePullPolicy: {{ .Values.image.pullPolicy | default "IfNotPresent" }} + env: + {{- include "runner.environment-variables" . | nindent 8 }} + ports: + - name: http + containerPort: 8080 + readinessProbe: + initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.readinessProbe.failureThreshold }} + httpGet: + path: /health + port: http + {{- with .Values.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- with .Values.extraVolumeMounts }} + volumeMounts: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.sidecar.enabled }} + - name: reconcile-runtime + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.sidecar.image "context" .) }} + imagePullPolicy: {{ .Values.sidecar.image.pullPolicy | default "IfNotPresent" }} + command: + - /bin/bash + args: + - -ec + - | {{ .Files.Get "files/reconcile-runtime.sh" | nindent 10 }} + env: + {{- include "runner-sidecar.environment-variables" . | nindent 8 }} + {{- with .Values.sidecar.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + {{- with .Values.extraVolumes }} + volumes: + {{- toYaml . | nindent 6 }} + {{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/_helpers.tpl b/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/_helpers.tpl new file mode 100644 index 000000000..2608cb67e --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/_helpers.tpl @@ -0,0 +1,42 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "runner.name" -}} + {{- printf "%s-%s" (include "cf-runtime.name" .) "runner" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "runner.fullname" -}} + {{- printf "%s-%s" (include "cf-runtime.fullname" .) "runner" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "runner.labels" -}} +{{ include "cf-runtime.labels" . }} +codefresh.io/application: runner +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "runner.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +codefresh.io/application: runner +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "runner.serviceAccountName" -}} + {{- if .Values.serviceAccount.create }} + {{- default (include "runner.fullname" .) .Values.serviceAccount.name }} + {{- else }} + {{- default "default" .Values.serviceAccount.name }} + {{- end }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/_rbac.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/_rbac.yaml new file mode 100644 index 000000000..d95b958d5 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/_rbac.yaml @@ -0,0 +1,53 @@ +{{- define "runner.resources.rbac" -}} +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "runner.serviceAccountName" . }} + labels: + {{- include "runner.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +--- +{{- if .Values.rbac.create }} +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "runner.fullname" . }} + labels: + {{- include "runner.labels" . | nindent 4 }} +rules: + - apiGroups: [ "" ] + resources: [ "pods", "persistentvolumeclaims" ] + verbs: [ "get", "create", "delete", patch ] + - apiGroups: [ "" ] + resources: [ "configmaps", "secrets" ] + verbs: [ "get", "create", "update", patch ] + - apiGroups: [ "apps" ] + resources: [ "deployments" ] + verbs: [ "get" ] +{{- with .Values.rbac.rules }} + {{ toYaml . | nindent 2 }} +{{- end }} +{{- end }} +--- +{{- if and .Values.serviceAccount.create .Values.rbac.create }} +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "runner.fullname" . }} + labels: + {{- include "runner.labels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: {{ include "runner.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: {{ include "runner.fullname" . }} + apiGroup: rbac.authorization.k8s.io +{{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/environment-variables/_init-container.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/environment-variables/_init-container.yaml new file mode 100644 index 000000000..6dda110f7 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/environment-variables/_init-container.yaml @@ -0,0 +1,30 @@ +{{- define "runner-init.environment-variables.defaults" }} +HOME: /tmp +{{- end }} + +{{- define "runner-init.environment-variables.calculated" }} +AGENT_NAME: {{ include "runtime.runtime-environment-spec.agent-name" . }} +API_HOST: {{ include "runtime.runtime-environment-spec.codefresh-host" . }} +AGENT_CODEFRESH_TOKEN: + valueFrom: + secretKeyRef: + name: {{ include "runner.fullname" . }} + key: agent-codefresh-token + optional: true +EXISTING_AGENT_CODEFRESH_TOKEN: {{ include "runtime.agent-token-env-var-value" . | nindent 2 }} +KUBE_CONTEXT: {{ include "runtime.runtime-environment-spec.context-name" . }} +KUBE_NAMESPACE: {{ .Release.Namespace }} +OWNER_NAME: {{ include "runner.fullname" . }} +RUNTIME_NAME: {{ include "runtime.runtime-environment-spec.runtime-name" . }} +SECRET_NAME: {{ include "runner.fullname" . }} +USER_CODEFRESH_TOKEN: {{ include "runtime.installation-token-env-var-value" . | nindent 2 }} +{{- end }} + +{{- define "runner-init.environment-variables" }} + {{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} + {{- $defaults := (include "runner-init.environment-variables.defaults" . | fromYaml) }} + {{- $calculated := (include "runner-init.environment-variables.calculated" . | fromYaml) }} + {{- $overrides := .Values.env }} + {{- $mergedValues := mergeOverwrite (merge $defaults $calculated) $overrides }} + {{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $mergedValues "context" .) }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/environment-variables/_main-container.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/environment-variables/_main-container.yaml new file mode 100644 index 000000000..4d3f0304e --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/environment-variables/_main-container.yaml @@ -0,0 +1,28 @@ +{{- define "runner.environment-variables.defaults" }} +AGENT_MODE: InCluster +SELF_DEPLOYMENT_NAME: + valueFrom: + fieldRef: + fieldPath: metadata.name +{{- end }} + +{{- define "runner.environment-variables.calculated" }} +AGENT_ID: {{ include "runtime.runtime-environment-spec.agent-name" . }} +CODEFRESH_HOST: {{ include "runtime.runtime-environment-spec.codefresh-host" . }} +CODEFRESH_IN_CLUSTER_RUNTIME: {{ include "runtime.runtime-environment-spec.runtime-name" . }} +CODEFRESH_TOKEN: + valueFrom: + secretKeyRef: + name: {{ include "runner.fullname" . }} + key: agent-codefresh-token +DOCKER_REGISTRY: {{ .Values.global.imageRegistry }} +{{- end }} + +{{- define "runner.environment-variables" }} +{{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{- $defaults := (include "runner.environment-variables.defaults" . | fromYaml) }} +{{- $calculated := (include "runner.environment-variables.calculated" . | fromYaml) }} +{{- $overrides := .Values.env }} +{{- $mergedValues := mergeOverwrite (merge $defaults $calculated) $overrides }} +{{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $mergedValues "context" .) }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/environment-variables/_sidecar-container.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/environment-variables/_sidecar-container.yaml new file mode 100644 index 000000000..3adcbe5d4 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/runner/environment-variables/_sidecar-container.yaml @@ -0,0 +1,22 @@ +{{- define "runner-sidecar.environment-variables.defaults" }} +HOME: /tmp +{{- end }} + +{{- define "runner-sidecar.environment-variables.calculated" }} +API_HOST: {{ include "runtime.runtime-environment-spec.codefresh-host" . }} +USER_CODEFRESH_TOKEN: {{ include "runtime.installation-token-env-var-value" . | nindent 2 }} +KUBE_CONTEXT: {{ include "runtime.runtime-environment-spec.context-name" . }} +KUBE_NAMESPACE: {{ .Release.Namespace }} +OWNER_NAME: {{ include "runner.fullname" . }} +RUNTIME_NAME: {{ include "runtime.runtime-environment-spec.runtime-name" . }} +CONFIGMAP_NAME: {{ printf "%s-%s" (include "runtime.fullname" .) "spec" }} +{{- end }} + +{{- define "runner-sidecar.environment-variables" }} + {{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} + {{- $defaults := (include "runner-sidecar.environment-variables.defaults" . | fromYaml) }} + {{- $calculated := (include "runner-sidecar.environment-variables.calculated" . | fromYaml) }} + {{- $overrides := .Values.sidecar.env }} + {{- $mergedValues := mergeOverwrite (merge $defaults $calculated) $overrides }} + {{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $mergedValues "context" .) }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_cronjob.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_cronjob.yaml new file mode 100644 index 000000000..20bd2d56e --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_cronjob.yaml @@ -0,0 +1,58 @@ +{{- define "dind-volume-provisioner.resources.cronjob" -}} +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{- if not (eq .Values.storage.backend "local") }} +apiVersion: batch/v1 +kind: CronJob +metadata: + name: {{ include "dind-volume-cleanup.fullname" . }} + labels: + {{- include "dind-volume-cleanup.labels" . | nindent 4 }} +spec: + concurrencyPolicy: {{ .Values.concurrencyPolicy }} + schedule: {{ .Values.schedule | quote }} + successfulJobsHistoryLimit: {{ .Values.successfulJobsHistory }} + failedJobsHistoryLimit: {{ .Values.failedJobsHistory }} + {{- with .Values.suspend }} + suspend: {{ . }} + {{- end }} + jobTemplate: + spec: + template: + metadata: + labels: + {{- include "dind-volume-cleanup.selectorLabels" . | nindent 12 }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 12 }} + {{- end }} + spec: + {{- include (printf "%s.image.pullSecrets" $cfCommonTplSemver ) . | nindent 10 }} + serviceAccountName: {{ include "dind-volume-provisioner.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + restartPolicy: {{ .Values.restartPolicy | default "Never" }} + containers: + - name: dind-volume-cleanup + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.image "context" .) }} + imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }} + env: + {{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" .Values.env "context" .) | nindent 12 }} + - name: PROVISIONED_BY + value: {{ include "dind-volume-provisioner.volumeProvisionerName" . }} + resources: + {{- toYaml .Values.resources | nindent 14 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_daemonset.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_daemonset.yaml new file mode 100644 index 000000000..cb463231d --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_daemonset.yaml @@ -0,0 +1,98 @@ +{{- define "dind-volume-provisioner.resources.daemonset" -}} +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $localVolumeParentDir := .Values.storage.local.volumeParentDir }} +{{- if eq .Values.storage.backend "local" }} +--- +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: {{ include "dind-lv-monitor.fullname" . }} + labels: + {{- include "dind-lv-monitor.labels" . | nindent 4 }} +spec: + selector: + matchLabels: + {{- include "dind-lv-monitor.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "dind-lv-monitor.selectorLabels" . | nindent 8 }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- include (printf "%s.image.pullSecrets" $cfCommonTplSemver ) . | nindent 8 }} + serviceAccountName: {{ include "dind-volume-provisioner.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.volumePermissions.enabled }} + initContainers: + - name: volume-permissions + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.volumePermissions.image "context" .) }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | default "Always" }} + command: + - /bin/sh + args: + - -ec + - | + chown -R {{ .Values.podSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} {{ $localVolumeParentDir }} + volumeMounts: + - mountPath: {{ $localVolumeParentDir }} + name: dind-volume-dir + {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} + securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 10 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 10 }} + {{- end }} + resources: + {{- toYaml .Values.volumePermissions.resources | nindent 10 }} + {{- end }} + containers: + - name: dind-lv-monitor + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.image "context" .) }} + imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 10 }} + {{- end }} + command: + - /home/dind-volume-utils/bin/local-volumes-agent + env: + {{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" .Values.env "context" .) | nindent 10 }} + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: VOLUME_PARENT_DIR + value: {{ $localVolumeParentDir }} + resources: + {{- toYaml .Values.resources | nindent 10 }} + volumeMounts: + - mountPath: {{ $localVolumeParentDir }} + readOnly: false + name: dind-volume-dir + {{- with .Values.extraVolumeMounts }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + volumes: + - name: dind-volume-dir + hostPath: + path: {{ $localVolumeParentDir }} + {{- with .Values.extraVolumes }} + {{- toYaml . | nindent 6 }} + {{- end }} +{{- end }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_deployment.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_deployment.yaml new file mode 100644 index 000000000..9252b4520 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_deployment.yaml @@ -0,0 +1,67 @@ +{{- define "dind-volume-provisioner.resources.deployment" -}} +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "dind-volume-provisioner.fullname" . }} + labels: + {{- include "dind-volume-provisioner.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicasCount }} + strategy: + type: {{ .Values.updateStrategy.type }} + selector: + matchLabels: + {{- include "dind-volume-provisioner.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "dind-volume-provisioner.selectorLabels" . | nindent 8 }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- include (printf "%s.image.pullSecrets" $cfCommonTplSemver ) . | nindent 8 }} + serviceAccountName: {{ include "dind-volume-provisioner.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + containers: + - name: dind-volume-provisioner + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.image "context" .) }} + imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }} + command: + - /usr/local/bin/dind-volume-provisioner + - -v=4 + - --resync-period=50s + env: + {{- include "dind-volume-provisioner.environment-variables" . | nindent 8 }} + ports: + - name: http + containerPort: 8080 + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + {{- include "dind-volume-provisioner.volumeMounts.calculated" . | nindent 8 }} + {{- with .Values.extraVolumeMounts }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + volumes: + {{- include "dind-volume-provisioner.volumes.calculated" . | nindent 6 }} + {{- with .Values.extraVolumes }} + {{- toYaml . | nindent 6 }} + {{- end }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_env-vars.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_env-vars.yaml new file mode 100644 index 000000000..e1f5dfe60 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_env-vars.yaml @@ -0,0 +1,88 @@ +{{- define "dind-volume-provisioner.environment-variables.defaults" }} +{{- end }} + +{{- define "dind-volume-provisioner.environment-variables.calculated" }} +DOCKER_REGISTRY: {{ .Values.global.imageRegistry }} +PROVISIONER_NAME: {{ include "dind-volume-provisioner.volumeProvisionerName" . }} + +{{- if or .Values.storage.ebs.accessKeyId .Values.storage.ebs.accessKeyIdSecretKeyRef }} +AWS_ACCESS_KEY_ID: + {{- if .Values.storage.ebs.accessKeyId }} + valueFrom: + secretKeyRef: + name: {{ include "dind-volume-provisioner.fullname" . }} + key: aws_access_key_id + {{- else if .Values.storage.ebs.accessKeyIdSecretKeyRef }} + valueFrom: + secretKeyRef: + {{- .Values.storage.ebs.accessKeyIdSecretKeyRef | toYaml | nindent 6 }} + {{- end }} +{{- end }} + +{{- if or .Values.storage.ebs.secretAccessKey .Values.storage.ebs.secretAccessKeySecretKeyRef }} +AWS_SECRET_ACCESS_KEY: + {{- if .Values.storage.ebs.secretAccessKey }} + valueFrom: + secretKeyRef: + name: {{ include "dind-volume-provisioner.fullname" . }} + key: aws_secret_access_key + {{- else if .Values.storage.ebs.secretAccessKeySecretKeyRef }} + valueFrom: + secretKeyRef: + {{- .Values.storage.ebs.secretAccessKeySecretKeyRef | toYaml | nindent 6 }} + {{- end }} +{{- end }} + +{{- if or .Values.storage.gcedisk.serviceAccountJson .Values.storage.gcedisk.serviceAccountJsonSecretKeyRef }} +GOOGLE_APPLICATION_CREDENTIALS: {{ printf "/etc/dind-volume-provisioner/credentials/%s" (.Values.storage.gcedisk.serviceAccountJsonSecretKeyRef.key | default "google-service-account.json") }} +{{- end }} + +{{- if and .Values.storage.mountAzureJson }} +AZURE_CREDENTIAL_FILE: /etc/kubernetes/azure.json +CLOUDCONFIG_AZURE: /etc/kubernetes/azure.json +{{- end }} + +{{- end }} + +{{- define "dind-volume-provisioner.environment-variables" }} +{{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{- $defaults := (include "dind-volume-provisioner.environment-variables.defaults" . | fromYaml) }} +{{- $calculated := (include "dind-volume-provisioner.environment-variables.calculated" . | fromYaml) }} +{{- $overrides := .Values.env }} +{{- $mergedValues := mergeOverwrite (merge $defaults $calculated) $overrides }} +{{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $mergedValues "context" .) }} +{{- end }} + + +{{- define "dind-volume-provisioner.volumes.calculated" }} + {{- if .Values.storage.gcedisk.serviceAccountJson }} +- name: credentials + secret: + secretName: {{ include "dind-volume-provisioner.fullname" . }} + optional: true + {{- else if .Values.storage.gcedisk.serviceAccountJsonSecretKeyRef }} +- name: credentials + secret: + secretName: {{ .Values.storage.gcedisk.serviceAccountJsonSecretKeyRef.name }} + optional: true + {{- end }} + {{- if .Values.storage.mountAzureJson }} +- name: azure-json + hostPath: + path: /etc/kubernetes/azure.json + type: File + {{- end }} +{{- end }} + +{{- define "dind-volume-provisioner.volumeMounts.calculated" }} + {{- if or .Values.storage.gcedisk.serviceAccountJson .Values.storage.gcedisk.serviceAccountJsonSecretKeyRef }} +- name: credentials + readOnly: true + mountPath: "/etc/dind-volume-provisioner/credentials" + {{- end }} + {{- if .Values.storage.mountAzureJson }} +- name: azure-json + readOnly: true + mountPath: "/etc/kubernetes/azure.json" + {{- end }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_helpers.tpl b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_helpers.tpl new file mode 100644 index 000000000..e3d3a0d3f --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_helpers.tpl @@ -0,0 +1,93 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "dind-volume-provisioner.name" -}} + {{- printf "%s-%s" (include "cf-runtime.name" .) "volume-provisioner" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "dind-volume-provisioner.fullname" -}} + {{- printf "%s-%s" (include "cf-runtime.fullname" .) "volume-provisioner" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{- define "dind-volume-cleanup.fullname" -}} + {{- printf "%s-%s" (include "cf-runtime.fullname" .) "volume-cleanup" | trunc 52 | trimSuffix "-" }} +{{- end }} + +{{- define "dind-lv-monitor.fullname" -}} + {{- printf "%s-%s" (include "cf-runtime.fullname" .) "lv-monitor" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Provisioner name for storage class +*/}} +{{- define "dind-volume-provisioner.volumeProvisionerName" }} + {{- printf "codefresh.io/dind-volume-provisioner-runner-%s" .Release.Namespace }} +{{- end }} + +{{/* +Common labels for dind-lv-monitor +*/}} +{{- define "dind-lv-monitor.labels" -}} +{{ include "cf-runtime.labels" . }} +codefresh.io/application: lv-monitor +{{- end }} + +{{/* +Selector labels for dind-lv-monitor +*/}} +{{- define "dind-lv-monitor.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +codefresh.io/application: lv-monitor +{{- end }} + +{{/* +Common labels for dind-volume-provisioner +*/}} +{{- define "dind-volume-provisioner.labels" -}} +{{ include "cf-runtime.labels" . }} +codefresh.io/application: volume-provisioner +{{- end }} + +{{/* +Selector labels for dind-volume-provisioner +*/}} +{{- define "dind-volume-provisioner.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +codefresh.io/application: volume-provisioner +{{- end }} + +{{/* +Common labels for dind-volume-cleanup +*/}} +{{- define "dind-volume-cleanup.labels" -}} +{{ include "cf-runtime.labels" . }} +codefresh.io/application: pv-cleanup +{{- end }} + +{{/* +Common labels for dind-volume-cleanup +*/}} +{{- define "dind-volume-cleanup.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +codefresh.io/application: pv-cleanup +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "dind-volume-provisioner.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "dind-volume-provisioner.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- define "dind-volume-provisioner.storageClassName" }} +{{- printf "dind-local-volumes-runner-%s" .Release.Namespace }} +{{- end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_rbac.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_rbac.yaml new file mode 100644 index 000000000..fbcbc684f --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_rbac.yaml @@ -0,0 +1,71 @@ +{{- define "dind-volume-provisioner.resources.rbac" -}} +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "dind-volume-provisioner.serviceAccountName" . }} + labels: + {{- include "dind-volume-provisioner.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +--- +{{- if .Values.rbac.create }} +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "dind-volume-provisioner.fullname" . }} + labels: + {{- include "dind-volume-provisioner.labels" . | nindent 4 }} +rules: + - apiGroups: [ "" ] + resources: [ "persistentvolumes" ] + verbs: [ "get", "list", "watch", "create", "delete", "patch" ] + - apiGroups: [ "" ] + resources: [ "persistentvolumeclaims" ] + verbs: [ "get", "list", "watch", "update", "delete" ] + - apiGroups: [ "storage.k8s.io" ] + resources: [ "storageclasses" ] + verbs: [ "get", "list", "watch" ] + - apiGroups: [ "" ] + resources: [ "events" ] + verbs: [ "list", "watch", "create", "update", "patch" ] + - apiGroups: [ "" ] + resources: [ "secrets" ] + verbs: [ "get", "list" ] + - apiGroups: [ "" ] + resources: [ "nodes" ] + verbs: [ "get", "list", "watch" ] + - apiGroups: [ "" ] + resources: [ "pods" ] + verbs: [ "get", "list", "watch", "create", "delete", "patch" ] + - apiGroups: [ "" ] + resources: [ "endpoints" ] + verbs: [ "get", "list", "watch", "create", "update", "delete" ] + - apiGroups: [ "coordination.k8s.io" ] + resources: [ "leases" ] + verbs: [ "get", "create", "update" ] +{{- with .Values.rbac.rules }} + {{ toYaml . | nindent 2 }} +{{- end }} +{{- end }} +--- +{{- if and .Values.serviceAccount.create .Values.rbac.create }} +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "dind-volume-provisioner.fullname" . }} + labels: + {{- include "dind-volume-provisioner.labels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: {{ include "dind-volume-provisioner.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ include "dind-volume-provisioner.fullname" . }} + apiGroup: rbac.authorization.k8s.io +{{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_secret.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_secret.yaml new file mode 100644 index 000000000..f361a7991 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_secret.yaml @@ -0,0 +1,22 @@ +{{- define "dind-volume-provisioner.resources.secret" -}} +{{- if or .Values.storage.ebs.accessKeyId .Values.storage.ebs.secretAccessKey .Values.storage.gcedisk.serviceAccountJson }} +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: {{ include "dind-volume-provisioner.fullname" . }} + labels: + {{- include "dind-volume-provisioner.labels" . | nindent 4 }} +stringData: + {{- with .Values.storage.gcedisk.serviceAccountJson }} + google-service-account.json: | +{{- . | nindent 4 }} + {{- end }} + {{- with .Values.storage.ebs.accessKeyId }} + aws_access_key_id: {{ . }} + {{- end }} + {{- with .Values.storage.ebs.secretAccessKey }} + aws_secret_access_key: {{ . }} + {{- end }} +{{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_storageclass.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_storageclass.yaml new file mode 100644 index 000000000..62e910c87 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_components/volume-provisioner/_storageclass.yaml @@ -0,0 +1,47 @@ +{{- define "dind-volume-provisioner.resources.storageclass" -}} +kind: StorageClass +apiVersion: storage.k8s.io/v1 +metadata: + {{/* has to be exactly that */}} + name: {{ include "dind-volume-provisioner.storageClassName" . }} + labels: + {{- include "dind-volume-provisioner.labels" . | nindent 4 }} +provisioner: {{ include "dind-volume-provisioner.volumeProvisionerName" . }} +parameters: +{{- if eq .Values.storage.backend "local" }} + volumeBackend: local + volumeParentDir: {{ .Values.storage.local.volumeParentDir }} +{{- else if eq .Values.storage.backend "gcedisk" }} + volumeBackend: {{ .Values.storage.backend }} + type: {{ .Values.storage.gcedisk.volumeType | default "pd-ssd" }} + zone: {{ required ".Values.storage.gcedisk.availabilityZone is required" .Values.storage.gcedisk.availabilityZone }} + fsType: {{ .Values.storage.fsType | default "ext4" }} +{{- else if or (eq .Values.storage.backend "ebs") (eq .Values.storage.backend "ebs-csi")}} + volumeBackend: {{ .Values.storage.backend }} + VolumeType: {{ .Values.storage.ebs.volumeType | default "gp3" }} + AvailabilityZone: {{ required ".Values.storage.ebs.availabilityZone is required" .Values.storage.ebs.availabilityZone }} + fsType: {{ .Values.storage.fsType | default "ext4" }} + encrypted: {{ .Values.storage.ebs.encrypted | default "false" | quote }} + {{- with .Values.storage.ebs.kmsKeyId }} + kmsKeyId: {{ . | quote }} + {{- end }} + {{- with .Values.storage.ebs.iops }} + iops: {{ . | quote }} + {{- end }} + {{- with .Values.storage.ebs.throughput }} + throughput: {{ . | quote }} + {{- end }} +{{- else if or (eq .Values.storage.backend "azuredisk") (eq .Values.storage.backend "azuredisk-csi")}} + volumeBackend: {{ .Values.storage.backend }} + kind: managed + skuName: {{ .Values.storage.azuredisk.skuName | default "Premium_LRS" }} + fsType: {{ .Values.storage.fsType | default "ext4" }} + cachingMode: {{ .Values.storage.azuredisk.cachingMode | default "None" }} + {{- with .Values.storage.azuredisk.availabilityZone }} + availabilityZone: {{ . | quote }} + {{- end }} + {{- with .Values.storage.azuredisk.resourceGroup }} + resourceGroup: {{ . | quote }} + {{- end }} +{{- end }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/_helpers.tpl b/charts/codefresh/cf-runtime/6.4.5/templates/_helpers.tpl new file mode 100644 index 000000000..72f44e36a --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "cf-runtime.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "cf-runtime.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "cf-runtime.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "cf-runtime.labels" -}} +helm.sh/chart: {{ include "cf-runtime.chart" . }} +{{ include "cf-runtime.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "cf-runtime.selectorLabels" -}} +app.kubernetes.io/name: {{ include "cf-runtime.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/deployment.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/deployment.yaml new file mode 100644 index 000000000..90341b305 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/deployment.yaml @@ -0,0 +1,9 @@ +{{- $appProxyContext := deepCopy . }} +{{- $_ := set $appProxyContext "Values" (get .Values "appProxy") }} +{{- $_ := set $appProxyContext.Values "global" (get .Values "global") }} +{{- $_ := set $appProxyContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $appProxyContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $appProxyContext.Values.enabled }} +{{- include "app-proxy.resources.deployment" $appProxyContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/ingress.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/ingress.yaml new file mode 100644 index 000000000..56ab5e95e --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/ingress.yaml @@ -0,0 +1,9 @@ +{{- $appProxyContext := deepCopy . }} +{{- $_ := set $appProxyContext "Values" (get .Values "appProxy") }} +{{- $_ := set $appProxyContext.Values "global" (get .Values "global") }} +{{- $_ := set $appProxyContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $appProxyContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $appProxyContext.Values.enabled }} +{{- include "app-proxy.resources.ingress" $appProxyContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/rbac.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/rbac.yaml new file mode 100644 index 000000000..4db87dcb4 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/rbac.yaml @@ -0,0 +1,9 @@ +{{- $appProxyContext := deepCopy . }} +{{- $_ := set $appProxyContext "Values" (get .Values "appProxy") }} +{{- $_ := set $appProxyContext.Values "global" (get .Values "global") }} +{{- $_ := set $appProxyContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $appProxyContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $appProxyContext.Values.enabled }} +{{- include "app-proxy.resources.rbac" $appProxyContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/service.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/service.yaml new file mode 100644 index 000000000..0b9d85ec0 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/app-proxy/service.yaml @@ -0,0 +1,9 @@ +{{- $appProxyContext := deepCopy . }} +{{- $_ := set $appProxyContext "Values" (get .Values "appProxy") }} +{{- $_ := set $appProxyContext.Values "global" (get .Values "global") }} +{{- $_ := set $appProxyContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $appProxyContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $appProxyContext.Values.enabled }} +{{- include "app-proxy.resources.service" $appProxyContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/event-exporter/deployment.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/event-exporter/deployment.yaml new file mode 100644 index 000000000..494288240 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/event-exporter/deployment.yaml @@ -0,0 +1,9 @@ +{{- $eventExporterContext := deepCopy . }} +{{- $_ := set $eventExporterContext "Values" (get .Values "event-exporter") }} +{{- $_ := set $eventExporterContext.Values "global" (get .Values "global") }} +{{- $_ := set $eventExporterContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $eventExporterContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if and $eventExporterContext.Values.enabled }} +{{- include "event-exporter.resources.deployment" $eventExporterContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/event-exporter/rbac.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/event-exporter/rbac.yaml new file mode 100644 index 000000000..6a9bf5c65 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/event-exporter/rbac.yaml @@ -0,0 +1,9 @@ +{{- $eventExporterContext := deepCopy . }} +{{- $_ := set $eventExporterContext "Values" (get .Values "event-exporter") }} +{{- $_ := set $eventExporterContext.Values "global" (get .Values "global") }} +{{- $_ := set $eventExporterContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $eventExporterContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if and $eventExporterContext.Values.enabled }} +{{- include "event-exporter.resources.rbac" $eventExporterContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/event-exporter/service.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/event-exporter/service.yaml new file mode 100644 index 000000000..c5d856dfe --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/event-exporter/service.yaml @@ -0,0 +1,11 @@ +{{- $eventExporterContext := deepCopy . }} +{{- $_ := set $eventExporterContext "Values" (get .Values "event-exporter") }} +{{- $_ := set $eventExporterContext.Values "global" (get .Values "global") }} +{{- $_ := set $eventExporterContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $eventExporterContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $eventExporterContext.Values.enabled }} +{{- include "event-exporter.resources.service" $eventExporterContext }} +--- +{{- include "event-exporter.resources.serviceMonitor" $eventExporterContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/extra/extra-resources.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/extra/extra-resources.yaml new file mode 100644 index 000000000..1a9777c64 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/extra/extra-resources.yaml @@ -0,0 +1,6 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} + +{{- range .Values.extraResources }} +--- +{{ include (printf "%s.tplrender" $cfCommonTplSemver) (dict "Values" . "context" $) }} +{{- end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/extra/runtime-images-cm.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/extra/runtime-images-cm.yaml new file mode 100644 index 000000000..f269c84b2 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/extra/runtime-images-cm.yaml @@ -0,0 +1,19 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $values := .Values.runtime.engine.runtimeImages }} +--- +kind: ConfigMap +apiVersion: v1 +metadata: + {{- /* dummy template just to list runtime images */}} + name: {{ include "runtime.fullname" . }}-images + labels: + {{- include "runtime.labels" . | nindent 4 }} + annotations: + {{- with $values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +data: + images: | + {{- range $key, $val := $values }} + image: {{ $val }} + {{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/cm-update-runtime.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/cm-update-runtime.yaml new file mode 100644 index 000000000..46a306c56 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/cm-update-runtime.yaml @@ -0,0 +1,18 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $values := .Values.runtime.patch }} +{{- if $values.enabled }} +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: {{ include "runtime.fullname" . }}-spec + labels: + {{- include "runtime.labels" . | nindent 4 }} + annotations: + {{- with $values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +data: + runtime.yaml: | + {{ include "runtime.runtime-environment-spec.template" . | nindent 4 | trim }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/job-gencerts-dind.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/job-gencerts-dind.yaml new file mode 100644 index 000000000..4a08a229c --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/job-gencerts-dind.yaml @@ -0,0 +1,68 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $values := .Values.runtime.gencerts }} +{{- if and $values.enabled }} +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "runtime.fullname" . }}-gencerts-dind + labels: + {{- include "runtime.labels" . | nindent 4 }} + annotations: + helm.sh/hook: post-install,post-upgrade + helm.sh/hook-weight: "3" + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + {{- with $values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with $values.ttlSecondsAfterFinished }} + ttlSecondsAfterFinished: {{ . }} + {{- end }} + {{- with $values.backoffLimit }} + backoffLimit: {{ . | int }} + {{- end }} + template: + metadata: + name: {{ include "runtime.fullname" . }}-gencerts-dind + labels: + {{- include "runtime.labels" . | nindent 8 }} + spec: + {{- if $values.rbac.enabled }} + serviceAccountName: {{ template "runtime.fullname" . }}-gencerts-dind + {{- end }} + securityContext: + {{- toYaml $values.podSecurityContext | nindent 8 }} + containers: + - name: gencerts-dind + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" $values.image "context" .) }} + imagePullPolicy: {{ $values.image.pullPolicy | default "Always" }} + command: + - "/bin/bash" + args: + - -ec + - | {{ .Files.Get "files/configure-dind-certs.sh" | nindent 10 }} + env: + - name: NAMESPACE + value: {{ .Release.Namespace }} + - name: RELEASE + value: {{ .Release.Name }} + - name: CF_API_HOST + value: {{ include "runtime.runtime-environment-spec.codefresh-host" . }} + - name: CF_API_TOKEN + {{- include "runtime.installation-token-env-var-value" . | indent 10}} + {{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $values.env "context" .) | nindent 8 }} + {{- with $values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + restartPolicy: OnFailure +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/job-update-runtime.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/job-update-runtime.yaml new file mode 100644 index 000000000..955e882d7 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/job-update-runtime.yaml @@ -0,0 +1,77 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $values := .Values.runtime.patch }} +{{- if $values.enabled }} +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "runtime.fullname" . }}-patch + labels: + {{- include "runtime.labels" . | nindent 4 }} + annotations: + helm.sh/hook: post-install,post-upgrade + helm.sh/hook-weight: "5" + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + {{- with $values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with $values.ttlSecondsAfterFinished }} + ttlSecondsAfterFinished: {{ . }} + {{- end }} + {{- with $values.backoffLimit }} + backoffLimit: {{ . | int }} + {{- end }} + template: + metadata: + name: {{ include "runtime.fullname" . }}-patch + labels: + {{- include "runtime.labels" . | nindent 8 }} + spec: + securityContext: + {{- toYaml $values.podSecurityContext | nindent 8 }} + containers: + - name: patch-runtime + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" $values.image "context" .) }} + imagePullPolicy: {{ $values.image.pullPolicy | default "Always" }} + command: + - "/bin/bash" + args: + - -ec + - | + codefresh auth create-context --api-key $API_KEY --url $API_HOST + cat /usr/share/extras/runtime.yaml + codefresh get re +{{- if .Values.runtime.agent }} + codefresh patch re -f /usr/share/extras/runtime.yaml +{{- else }} + codefresh patch sys-re -f /usr/share/extras/runtime.yaml +{{- end }} + env: + - name: API_KEY + {{- include "runtime.installation-token-env-var-value" . | indent 10}} + - name: API_HOST + value: {{ include "runtime.runtime-environment-spec.codefresh-host" . }} + {{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $values.env "context" .) | nindent 8 }} + volumeMounts: + - name: config + mountPath: /usr/share/extras/runtime.yaml + subPath: runtime.yaml + {{- with $values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + restartPolicy: OnFailure + volumes: + - name: config + configMap: + name: {{ include "runtime.fullname" . }}-spec +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/rbac-gencerts-dind.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/rbac-gencerts-dind.yaml new file mode 100644 index 000000000..4907dac38 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/hooks/post-install/rbac-gencerts-dind.yaml @@ -0,0 +1,37 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $values := .Values.runtime.gencerts }} +{{- if and $values.enabled }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "runtime.fullname" . }}-gencerts-dind + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "runtime.fullname" . }}-gencerts-dind + namespace: {{ .Release.Namespace }} +rules: + - apiGroups: + - "" + resources: + - secrets + - configmaps + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "runtime.fullname" . }}-gencerts-dind + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "runtime.fullname" . }}-gencerts-dind +subjects: + - kind: ServiceAccount + name: {{ include "runtime.fullname" . }}-gencerts-dind + namespace: {{ .Release.Namespace }} +{{ end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/hooks/pre-delete/job-cleanup-resources.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/hooks/pre-delete/job-cleanup-resources.yaml new file mode 100644 index 000000000..0e3c7659f --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/hooks/pre-delete/job-cleanup-resources.yaml @@ -0,0 +1,73 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $values := .Values.runtime.patch }} +{{- if and $values.enabled }} +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "runtime.fullname" . }}-cleanup + labels: + {{- include "runtime.labels" . | nindent 4 }} + annotations: + helm.sh/hook: pre-delete + helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation + {{- with $values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with $values.ttlSecondsAfterFinished }} + ttlSecondsAfterFinished: {{ . }} + {{- end }} + {{- with $values.backoffLimit }} + backoffLimit: {{ . | int }} + {{- end }} + template: + metadata: + name: {{ include "runtime.fullname" . }}-cleanup + labels: + {{- include "runtime.labels" . | nindent 8 }} + spec: + {{- if $values.rbac.enabled }} + serviceAccountName: {{ template "runtime.fullname" . }}-cleanup + {{- end }} + securityContext: + {{- toYaml $values.podSecurityContext | nindent 8 }} + containers: + - name: cleanup + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" $values.image "context" .) }} + imagePullPolicy: {{ $values.image.pullPolicy | default "Always" }} + command: + - "/bin/bash" + args: + - -ec + - | {{ .Files.Get "files/cleanup-runtime.sh" | nindent 10 }} + env: + - name: AGENT_NAME + value: {{ include "runtime.runtime-environment-spec.agent-name" . }} + - name: RUNTIME_NAME + value: {{ include "runtime.runtime-environment-spec.runtime-name" . }} + - name: API_HOST + value: {{ include "runtime.runtime-environment-spec.codefresh-host" . }} + - name: API_TOKEN + {{- include "runtime.installation-token-env-var-value" . | indent 10}} + - name: AGENT + value: {{ .Values.runtime.agent | quote }} + - name: AGENT_SECRET_NAME + value: {{ include "runner.fullname" . }} + - name: DIND_SECRET_NAME + value: codefresh-certs-server + {{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $values.env "context" .) | nindent 8 }} + {{- with $values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + restartPolicy: OnFailure +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/hooks/pre-delete/rbac-cleanup-resources.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/hooks/pre-delete/rbac-cleanup-resources.yaml new file mode 100644 index 000000000..468ec2212 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/hooks/pre-delete/rbac-cleanup-resources.yaml @@ -0,0 +1,46 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $values := .Values.runtime.patch }} +{{- if and $values.enabled }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "runtime.fullname" . }}-cleanup + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "runtime.fullname" . }}-cleanup + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed +rules: + - apiGroups: + - "*" + resources: + - "*" + verbs: + - "*" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "runtime.fullname" . }}-cleanup + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "runtime.fullname" . }}-cleanup +subjects: + - kind: ServiceAccount + name: {{ include "runtime.fullname" . }}-cleanup + namespace: {{ .Release.Namespace }} +{{ end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/monitor/deployment.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/monitor/deployment.yaml new file mode 100644 index 000000000..00c9fb2f9 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/monitor/deployment.yaml @@ -0,0 +1,9 @@ +{{- $monitorContext := deepCopy . }} +{{- $_ := set $monitorContext "Values" (get .Values "monitor") }} +{{- $_ := set $monitorContext.Values "global" (get .Values "global") }} +{{- $_ := set $monitorContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $monitorContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $monitorContext.Values.enabled }} +{{- include "monitor.resources.deployment" $monitorContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/monitor/rbac.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/monitor/rbac.yaml new file mode 100644 index 000000000..f9812d565 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/monitor/rbac.yaml @@ -0,0 +1,9 @@ +{{- $monitorContext := deepCopy . }} +{{- $_ := set $monitorContext "Values" (get .Values "monitor") }} +{{- $_ := set $monitorContext.Values "global" (get .Values "global") }} +{{- $_ := set $monitorContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $monitorContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $monitorContext.Values.enabled }} +{{- include "monitor.resources.rbac" $monitorContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/monitor/service.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/monitor/service.yaml new file mode 100644 index 000000000..f99706614 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/monitor/service.yaml @@ -0,0 +1,9 @@ +{{- $monitorContext := deepCopy . }} +{{- $_ := set $monitorContext "Values" (get .Values "monitor") }} +{{- $_ := set $monitorContext.Values "global" (get .Values "global") }} +{{- $_ := set $monitorContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $monitorContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $monitorContext.Values.enabled }} +{{- include "monitor.resources.service" $monitorContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/other/external-secrets.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/other/external-secrets.yaml new file mode 100644 index 000000000..dc24e24e5 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/other/external-secrets.yaml @@ -0,0 +1,2 @@ +{{ $templateName := printf "cf-common-%s.external-secrets" (index .Subcharts "cf-common").Chart.Version }} +{{- include $templateName . -}} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/other/podMonitor.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/other/podMonitor.yaml new file mode 100644 index 000000000..4319b722b --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/other/podMonitor.yaml @@ -0,0 +1,2 @@ +{{ $templateName := printf "cf-common-%s.podMonitor" (index .Subcharts "cf-common").Chart.Version }} +{{- include $templateName . -}} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/other/serviceMonitor.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/other/serviceMonitor.yaml new file mode 100644 index 000000000..29f890fe2 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/other/serviceMonitor.yaml @@ -0,0 +1,2 @@ +{{ $templateName := printf "cf-common-%s.serviceMonitor" (index .Subcharts "cf-common").Chart.Version }} +{{- include $templateName . -}} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/runner/deployment.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/runner/deployment.yaml new file mode 100644 index 000000000..85777c487 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/runner/deployment.yaml @@ -0,0 +1,9 @@ +{{- $runnerContext := deepCopy . }} +{{- $_ := set $runnerContext "Values" (get .Values "runner") }} +{{- $_ := set $runnerContext.Values "global" (get .Values "global") }} +{{- $_ := set $runnerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $runnerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if and $runnerContext.Values.enabled .Values.runtime.agent }} +{{- include "runner.resources.deployment" $runnerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/runner/rbac.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/runner/rbac.yaml new file mode 100644 index 000000000..d5f8c1323 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/runner/rbac.yaml @@ -0,0 +1,9 @@ +{{- $runnerContext := deepCopy . }} +{{- $_ := set $runnerContext "Values" (get .Values "runner") }} +{{- $_ := set $runnerContext.Values "global" (get .Values "global") }} +{{- $_ := set $runnerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $runnerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if and $runnerContext.Values.enabled .Values.runtime.agent }} +{{- include "runner.resources.rbac" $runnerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/runtime/_helpers.tpl b/charts/codefresh/cf-runtime/6.4.5/templates/runtime/_helpers.tpl new file mode 100644 index 000000000..6ba04fcc3 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/runtime/_helpers.tpl @@ -0,0 +1,123 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "runtime.name" -}} + {{- printf "%s" (include "cf-runtime.name" .) | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "runtime.fullname" -}} + {{- printf "%s" (include "cf-runtime.fullname" .) | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "runtime.labels" -}} +{{ include "cf-runtime.labels" . }} +codefresh.io/application: runtime +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "runtime.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +codefresh.io/application: runtime +{{- end }} + +{{/* +Return runtime image (classic runtime) with private registry prefix +*/}} +{{- define "runtime.runtimeImageName" -}} + {{- if .registry -}} + {{- $imageName := (trimPrefix "quay.io/" .imageFullName) -}} + {{- printf "%s/%s" .registry $imageName -}} + {{- else -}} + {{- printf "%s" .imageFullName -}} + {{- end -}} +{{- end -}} + +{{/* +Environment variable value of Codefresh installation token +*/}} +{{- define "runtime.installation-token-env-var-value" -}} + {{- if .Values.global.codefreshToken }} +valueFrom: + secretKeyRef: + name: {{ include "runtime.installation-token-secret-name" . }} + key: codefresh-api-token + {{- else if .Values.global.codefreshTokenSecretKeyRef }} +valueFrom: + secretKeyRef: + {{- .Values.global.codefreshTokenSecretKeyRef | toYaml | nindent 4 }} + {{- end }} +{{- end }} + +{{/* +Environment variable value of Codefresh agent token +*/}} +{{- define "runtime.agent-token-env-var-value" -}} + {{- if .Values.global.agentToken }} +{{- printf "%s" .Values.global.agentToken | toYaml }} + {{- else if .Values.global.agentTokenSecretKeyRef }} +valueFrom: + secretKeyRef: + {{- .Values.global.agentTokenSecretKeyRef | toYaml | nindent 4 }} + {{- end }} +{{- end }} + +{{/* +Print Codefresh API token secret name +*/}} +{{- define "runtime.installation-token-secret-name" }} +{{- print "codefresh-user-token" }} +{{- end }} + +{{/* +Print Codefresh host +*/}} +{{- define "runtime.runtime-environment-spec.codefresh-host" }} +{{- if and (not .Values.global.codefreshHost) }} + {{- fail "ERROR: .global.codefreshHost is required" }} +{{- else }} + {{- printf "%s" (trimSuffix "/" .Values.global.codefreshHost) }} +{{- end }} +{{- end }} + +{{/* +Print runtime-environment name +*/}} +{{- define "runtime.runtime-environment-spec.runtime-name" }} +{{- if and (not .Values.global.runtimeName) }} + {{- printf "%s/%s" .Values.global.context .Release.Namespace }} +{{- else }} + {{- printf "%s" .Values.global.runtimeName }} +{{- end }} +{{- end }} + +{{/* +Print agent name +*/}} +{{- define "runtime.runtime-environment-spec.agent-name" }} +{{- if and (not .Values.global.agentName) }} + {{- printf "%s_%s" .Values.global.context .Release.Namespace }} +{{- else }} + {{- printf "%s" .Values.global.agentName }} +{{- end }} +{{- end }} + +{{/* +Print context +*/}} +{{- define "runtime.runtime-environment-spec.context-name" }} +{{- if and (not .Values.global.context) }} + {{- fail "ERROR: .global.context is required" }} +{{- else }} + {{- printf "%s" .Values.global.context }} +{{- end }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/runtime/cm-dind-daemon.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/runtime/cm-dind-daemon.yaml new file mode 100644 index 000000000..fc7f92905 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/runtime/cm-dind-daemon.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + {{- /* has to be a constant */}} + name: codefresh-dind-config + labels: + {{- include "runtime.labels" . | nindent 4 }} +data: + daemon.json: | +{{ coalesce .Values.re.dindDaemon .Values.runtime.dindDaemon | toPrettyJson | indent 4 }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/runtime/rbac.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/runtime/rbac.yaml new file mode 100644 index 000000000..a51b12526 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/runtime/rbac.yaml @@ -0,0 +1,48 @@ +{{ $values := .Values.runtime }} +--- +{{- if or $values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- /* has to be a constant */}} + name: codefresh-engine + labels: + {{- include "runtime.labels" . | nindent 4 }} + {{- with $values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +--- +{{- if $values.rbac.create }} +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: codefresh-engine + labels: + {{- include "runner.labels" . | nindent 4 }} +rules: + - apiGroups: [ "" ] + resources: [ "secrets" ] + verbs: [ "get" ] +{{- with $values.rbac.rules }} + {{ toYaml . | nindent 2 }} +{{- end }} +{{- end }} +--- +{{- if and $values.serviceAccount.create $values.rbac.create }} +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: codefresh-engine + labels: + {{- include "runner.labels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: codefresh-engine +roleRef: + kind: Role + name: codefresh-engine + apiGroup: rbac.authorization.k8s.io +{{- end }} + diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/runtime/runtime-env-spec-tmpl.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/runtime/runtime-env-spec-tmpl.yaml new file mode 100644 index 000000000..baf726511 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/runtime/runtime-env-spec-tmpl.yaml @@ -0,0 +1,214 @@ +{{- define "runtime.runtime-environment-spec.template" }} +{{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version -}} +{{- $kubeconfigFilePath := (include "runtime.runtime-environment-spec.runtime-name" .) -}} +{{- $name := (include "runtime.runtime-environment-spec.runtime-name" .) -}} +{{- $engineContext := .Values.runtime.engine -}} +{{- $dindContext := .Values.runtime.dind -}} +{{- $imageRegistry := .Values.global.imageRegistry -}} +metadata: + name: {{ include "runtime.runtime-environment-spec.runtime-name" . }} + agent: {{ .Values.runtime.agent }} +runtimeScheduler: + type: KubernetesPod + {{- if $engineContext.image }} + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" $engineContext.image "context" .) | squote }} + {{- end }} + imagePullPolicy: {{ $engineContext.image.pullPolicy }} + {{- with $engineContext.command }} + command: {{- toYaml . | nindent 4 }} + {{- end }} + envVars: + {{- with $engineContext.env }} + {{- range $key, $val := . }} + {{- if or (kindIs "bool" $val) (kindIs "int" $val) (kindIs "float64" $val) }} + {{ $key }}: {{ $val | squote }} + {{- else }} + {{ $key }}: {{ $val }} + {{- end }} + {{- end }} + {{- end }} + COMPOSE_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.COMPOSE_IMAGE) | squote }} + CONTAINER_LOGGER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.CONTAINER_LOGGER_IMAGE) | squote }} + DOCKER_BUILDER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.DOCKER_BUILDER_IMAGE) | squote }} + DOCKER_PULLER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.DOCKER_PULLER_IMAGE) | squote }} + DOCKER_PUSHER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.DOCKER_PUSHER_IMAGE) | squote }} + DOCKER_TAG_PUSHER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.DOCKER_TAG_PUSHER_IMAGE) | squote }} + FS_OPS_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.FS_OPS_IMAGE) | squote }} + GIT_CLONE_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.GIT_CLONE_IMAGE) | squote }} + KUBE_DEPLOY: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.KUBE_DEPLOY) | squote }} + PIPELINE_DEBUGGER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.PIPELINE_DEBUGGER_IMAGE) | squote }} + TEMPLATE_ENGINE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.TEMPLATE_ENGINE) | squote }} + CR_6177_FIXER: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.CR_6177_FIXER) | squote }} + GC_BUILDER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.GC_BUILDER_IMAGE) | squote }} + COSIGN_IMAGE_SIGNER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.COSIGN_IMAGE_SIGNER_IMAGE) | squote }} + {{- with $engineContext.userEnvVars }} + userEnvVars: {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $engineContext.workflowLimits }} + workflowLimits: {{- toYaml . | nindent 4 }} + {{- end }} + cluster: + namespace: {{ .Release.Namespace }} + serviceAccount: {{ $engineContext.serviceAccount }} + {{- if .Values.runtime.agent }} + clusterProvider: + accountId: {{ .Values.global.accountId }} + selector: {{ include "runtime.runtime-environment-spec.context-name" . }} + {{- else }} + {{- if .Values.runtime.inCluster }} + inCluster: true + kubeconfigFilePath: null + {{- else }} + name: {{ $name }} + kubeconfigFilePath: {{ printf "/etc/kubeconfig/%s" $kubeconfigFilePath }} + {{- end }} + {{- end }} + {{- with $engineContext.nodeSelector }} + nodeSelector: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with $engineContext.affinity }} + affinity: {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $engineContext.tolerations }} + tolerations: {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $engineContext.podAnnotations }} + annotations: + {{- range $key, $val := . }} + {{ $key }}: {{ $val | squote }} + {{- end }} + {{- end }} + {{- with $engineContext.podLabels }} + labels: {{- toYaml . | nindent 4 }} + {{- end }} + {{- if $engineContext.schedulerName }} + schedulerName: {{ $engineContext.schedulerName }} + {{- end }} + resources: + {{- if $engineContext.resources}} + {{- toYaml $engineContext.resources | nindent 4 }} + {{- end }} + {{- with $engineContext.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ . }} + {{- end }} +dockerDaemonScheduler: + type: DindKubernetesPod + {{- if $dindContext.image }} + dindImage: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" $dindContext.image "context" .) | squote }} + {{- end }} + imagePullPolicy: {{ $dindContext.image.pullPolicy }} + {{- with $dindContext.userAccess }} + userAccess: {{ . }} + {{- end }} + {{- with $dindContext.env }} + envVars: + {{- range $key, $val := . }} + {{- if or (kindIs "bool" $val) (kindIs "int" $val) (kindIs "float64" $val) }} + {{ $key }}: {{ $val | squote }} + {{- else }} + {{ $key }}: {{ $val }} + {{- end }} + {{- end }} + {{- end }} + cluster: + namespace: {{ .Release.Namespace }} + serviceAccount: {{ $dindContext.serviceAccount }} + {{- if .Values.runtime.agent }} + clusterProvider: + accountId: {{ .Values.global.accountId }} + selector: {{ include "runtime.runtime-environment-spec.context-name" . }} + {{- else }} + {{- if .Values.runtime.inCluster }} + inCluster: true + kubeconfigFilePath: null + {{- else }} + name: {{ $name }} + kubeconfigFilePath: {{ printf "/etc/kubeconfig/%s" $kubeconfigFilePath }} + {{- end }} + {{- end }} + {{- with $dindContext.nodeSelector }} + nodeSelector: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with $dindContext.affinity }} + affinity: {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $dindContext.tolerations }} + tolerations: {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $dindContext.podAnnotations }} + annotations: + {{- range $key, $val := . }} + {{ $key }}: {{ $val | squote }} + {{- end }} + {{- end }} + {{- with $dindContext.podLabels }} + labels: {{- toYaml . | nindent 4 }} + {{- end }} + {{- if $dindContext.schedulerName }} + schedulerName: {{ $dindContext.schedulerName }} + {{- end }} + {{- if $dindContext.pvcs }} + pvcs: + {{- range $index, $pvc := $dindContext.pvcs }} + - name: {{ $pvc.name }} + reuseVolumeSelector: {{ $pvc.reuseVolumeSelector | squote }} + reuseVolumeSortOrder: {{ $pvc.reuseVolumeSortOrder }} + storageClassName: {{ include (printf "%v.tplrender" $cfCommonTplSemver) (dict "Values" $pvc.storageClassName "context" $) }} + volumeSize: {{ $pvc.volumeSize }} + {{- with $pvc.annotations }} + annotations: {{ . | toYaml | nindent 8 }} + {{- end }} + {{- end }} + {{- end }} + defaultDindResources: + {{- with $dindContext.resources }} + {{- if not .requests }} + limits: {{- toYaml .limits | nindent 6 }} + requests: null + {{- else }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} + {{- with $dindContext.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ . }} + {{- end }} + {{- with $dindContext.userVolumeMounts }} + userVolumeMounts: {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $dindContext.userVolumes }} + userVolumes: {{- toYaml . | nindent 4 }} + {{- end }} + {{- if and (not .Values.runtime.agent) }} + clientCertPath: /etc/ssl/cf/ + volumeMounts: + codefresh-certs-server: + name: codefresh-certs-server + mountPath: /etc/ssl/cf + readOnly: false + volumes: + codefresh-certs-server: + name: codefresh-certs-server + secret: + secretName: codefresh-certs-server + {{- end }} +extends: {{- toYaml .Values.runtime.runtimeExtends | nindent 2 }} + {{- if .Values.runtime.description }} +description: {{ .Values.runtime.description }} + {{- else }} +description: null + {{- end }} +{{- if .Values.global.accountId }} +accountId: {{ .Values.global.accountId }} +{{- end }} +{{- if not .Values.runtime.agent }} +accounts: {{- toYaml .Values.runtime.accounts | nindent 2 }} +{{- end }} +{{- if .Values.appProxy.enabled }} +appProxy: + externalIP: >- + {{ printf "https://%s%s" .Values.appProxy.ingress.host (.Values.appProxy.ingress.pathPrefix | default "/") }} +{{- end }} +{{- if not .Values.runtime.agent }} +systemHybrid: true +{{- end }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/runtime/secret.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/runtime/secret.yaml new file mode 100644 index 000000000..2366d3ccf --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/runtime/secret.yaml @@ -0,0 +1,11 @@ +{{- if and .Values.global.codefreshToken }} +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: {{ include "runtime.installation-token-secret-name" . }} + labels: + {{- include "runtime.labels" . | nindent 4 }} +stringData: + codefresh-api-token: {{ .Values.global.codefreshToken }} +{{- end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/runtime/svc-dind.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/runtime/svc-dind.yaml new file mode 100644 index 000000000..098edb4e8 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/runtime/svc-dind.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + {{- include "runtime.labels" . | nindent 4 }} + app: dind + {{/* has to be a constant */}} + name: dind +spec: + ports: + - name: "dind-port" + port: 1300 + protocol: TCP + clusterIP: None + selector: + app: dind diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/cronjob.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/cronjob.yaml new file mode 100644 index 000000000..db955bc77 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/cronjob.yaml @@ -0,0 +1,11 @@ +{{- $volumeProvisionerContext := deepCopy . }} +{{- $_ := set $volumeProvisionerContext "Values" (get .Values.volumeProvisioner "dind-volume-cleanup") }} +{{- $_ := set $volumeProvisionerContext.Values "serviceAccount" (get .Values.volumeProvisioner "serviceAccount") }} +{{- $_ := set $volumeProvisionerContext.Values "global" (get .Values "global") }} +{{- $_ := set $volumeProvisionerContext.Values "storage" (get .Values "storage") }} +{{- $_ := set $volumeProvisionerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $volumeProvisionerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if and $volumeProvisionerContext.Values.enabled .Values.volumeProvisioner.enabled }} +{{- include "dind-volume-provisioner.resources.cronjob" $volumeProvisionerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/daemonset.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/daemonset.yaml new file mode 100644 index 000000000..39927149e --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/daemonset.yaml @@ -0,0 +1,11 @@ +{{- $volumeProvisionerContext := deepCopy . }} +{{- $_ := set $volumeProvisionerContext "Values" (get .Values.volumeProvisioner "dind-lv-monitor") }} +{{- $_ := set $volumeProvisionerContext.Values "serviceAccount" (get .Values.volumeProvisioner "serviceAccount") }} +{{- $_ := set $volumeProvisionerContext.Values "global" (get .Values "global") }} +{{- $_ := set $volumeProvisionerContext.Values "storage" (get .Values "storage") }} +{{- $_ := set $volumeProvisionerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $volumeProvisionerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if and $volumeProvisionerContext.Values.enabled .Values.volumeProvisioner.enabled }} +{{- include "dind-volume-provisioner.resources.daemonset" $volumeProvisionerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/deployment.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/deployment.yaml new file mode 100644 index 000000000..522fa8791 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/deployment.yaml @@ -0,0 +1,10 @@ +{{- $volumeProvisionerContext := deepCopy . }} +{{- $_ := set $volumeProvisionerContext "Values" (get .Values "volumeProvisioner") }} +{{- $_ := set $volumeProvisionerContext.Values "global" (get .Values "global") }} +{{- $_ := set $volumeProvisionerContext.Values "storage" (get .Values "storage") }} +{{- $_ := set $volumeProvisionerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $volumeProvisionerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $volumeProvisionerContext.Values.enabled }} +{{- include "dind-volume-provisioner.resources.deployment" $volumeProvisionerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/rbac.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/rbac.yaml new file mode 100644 index 000000000..f3ae9609f --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/rbac.yaml @@ -0,0 +1,9 @@ +{{- $volumeProvisionerContext := deepCopy . }} +{{- $_ := set $volumeProvisionerContext "Values" (get .Values "volumeProvisioner") }} +{{- $_ := set $volumeProvisionerContext.Values "global" (get .Values "global") }} +{{- $_ := set $volumeProvisionerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $volumeProvisionerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $volumeProvisionerContext.Values.enabled }} +{{- include "dind-volume-provisioner.resources.rbac" $volumeProvisionerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/secret.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/secret.yaml new file mode 100644 index 000000000..accf601d1 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/secret.yaml @@ -0,0 +1,10 @@ +{{- $volumeProvisionerContext := deepCopy . }} +{{- $_ := set $volumeProvisionerContext "Values" (get .Values "volumeProvisioner") }} +{{- $_ := set $volumeProvisionerContext.Values "global" (get .Values "global") }} +{{- $_ := set $volumeProvisionerContext.Values "storage" (get .Values "storage") }} +{{- $_ := set $volumeProvisionerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $volumeProvisionerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $volumeProvisionerContext.Values.enabled }} +{{- include "dind-volume-provisioner.resources.secret" $volumeProvisionerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/storageclass.yaml b/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/storageclass.yaml new file mode 100644 index 000000000..77a7602da --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/templates/volume-provisioner/storageclass.yaml @@ -0,0 +1,10 @@ +{{- $volumeProvisionerContext := deepCopy . }} +{{- $_ := set $volumeProvisionerContext "Values" (get .Values "volumeProvisioner") }} +{{- $_ := set $volumeProvisionerContext.Values "global" (get .Values "global") }} +{{- $_ := set $volumeProvisionerContext.Values "storage" (get .Values "storage") }} +{{- $_ := set $volumeProvisionerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $volumeProvisionerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $volumeProvisionerContext.Values.enabled }} +{{- include "dind-volume-provisioner.resources.storageclass" $volumeProvisionerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.4.5/values.yaml b/charts/codefresh/cf-runtime/6.4.5/values.yaml new file mode 100644 index 000000000..66fc9c2bd --- /dev/null +++ b/charts/codefresh/cf-runtime/6.4.5/values.yaml @@ -0,0 +1,951 @@ +# -- String to partially override cf-runtime.fullname template (will maintain the release name) +nameOverride: "" +# -- String to fully override cf-runtime.fullname template +fullnameOverride: "" + +# -- Global parameters +# @default -- See below +global: + # -- Global Docker image registry + imageRegistry: "" + # -- Global Docker registry secret names as array + imagePullSecrets: [] + + # -- URL of Codefresh Platform (required!) + codefreshHost: "https://g.codefresh.io" + # -- User token in plain text (required if `global.codefreshTokenSecretKeyRef` is omitted!) + # Ref: https://g.codefresh.io/user/settings (see API Keys) + # Minimal API key scopes: Runner-Installation(read+write), Agent(read+write), Agents(read+write) + codefreshToken: "" + # -- User token that references an existing secret containing API key (required if `global.codefreshToken` is omitted!) + codefreshTokenSecretKeyRef: {} + + # E.g. + # codefreshTokenSecretKeyRef: + # name: my-codefresh-api-token + # key: codefresh-api-token + + # -- Account ID (required!) + # Can be obtained here https://g.codefresh.io/2.0/account-settings/account-information + accountId: "" + + # -- K8s context name (required!) + context: "" + # E.g. + # context: prod-ue1-runtime-1 + + # -- Agent Name (optional!) + # If omitted, the following format will be used `{{ .Values.global.context }}_{{ .Release.Namespace }}` + agentName: "" + # E.g. + # agentName: prod-ue1-runtime-1 + + # -- Runtime name (optional!) + # If omitted, the following format will be used `{{ .Values.global.context }}/{{ .Release.Namespace }}` + runtimeName: "" + # E.g. + # runtimeName: prod-ue1-runtime-1/namespace + + # -- DEPRECATED Agent token in plain text. + # !!! MUST BE provided if migrating from < 6.x chart version + agentToken: "" + # -- DEPRECATED Agent token that references an existing secret containing API key. + # !!! MUST BE provided if migrating from < 6.x chart version + agentTokenSecretKeyRef: {} + # E.g. + # agentTokenSecretKeyRef: + # name: my-codefresh-agent-secret + # key: codefresh-agent-token + +# DEPRECATED -- Use `.Values.global.imageRegistry` instead +dockerRegistry: "" + +# DEPRECATED -- Use `.Values.runtime` instead +re: {} + +# -- Runner parameters +# @default -- See below +runner: + # -- Enable the runner + enabled: true + # -- Set number of pods + replicasCount: 1 + # -- Upgrade strategy + updateStrategy: + type: RollingUpdate + # -- Set pod annotations + podAnnotations: {} + + # -- Set image + image: + registry: quay.io + repository: codefresh/venona + tag: 1.10.2 + + # -- Init container + init: + image: + registry: quay.io + repository: codefresh/cli + tag: 0.85.0-rootless + + resources: + limits: + memory: 512Mi + cpu: '1' + requests: + memory: 256Mi + cpu: '0.2' + + # -- Sidecar container + # Reconciles runtime spec from Codefresh API for drift detection + sidecar: + enabled: false + image: + registry: quay.io + repository: codefresh/codefresh-shell + tag: 0.0.2 + env: + RECONCILE_INTERVAL: 300 + resources: {} + + # -- Add additional env vars + env: {} + # E.g. + # env: + # WORKFLOW_CONCURRENCY: 50 # The number of workflow creation and termination tasks the Runner can handle in parallel. Defaults to 50 + + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Override service account name + name: "" + # -- Additional service account annotations + annotations: {} + + # -- RBAC parameters + rbac: + # -- Create RBAC resources + create: true + # -- Add custom rule to the role + rules: [] + + # -- Set security context for the pod + # @default -- See below + podSecurityContext: + enabled: true + runAsUser: 10001 + runAsGroup: 10001 + fsGroup: 10001 + + # -- Readiness probe configuration + # @default -- See below + readinessProbe: + failureThreshold: 5 + initialDelaySeconds: 5 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 5 + + # -- Set requests and limits + resources: {} + # -- Set node selector + nodeSelector: {} + # -- Set tolerations + tolerations: [] + # -- Set affinity + affinity: {} + +# -- Volume Provisioner parameters +# @default -- See below +volumeProvisioner: + # -- Enable volume-provisioner + enabled: true + # -- Set number of pods + replicasCount: 1 + # -- Upgrade strategy + updateStrategy: + type: Recreate + # -- Set pod annotations + podAnnotations: {} + + # -- Set image + image: + registry: quay.io + repository: codefresh/dind-volume-provisioner + tag: 1.35.0 + # -- Add additional env vars + env: {} + # E.g. + # env: + # THREADINESS: 4 # The number of PVC requests the dind-volume-provisioner can process in parallel. Defaults to 4 + + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Override service account name + name: "" + # -- Additional service account annotations + annotations: {} + # E.g. + # serviceAccount: + # annotations: + # eks.amazonaws.com/role-arn: "arn:aws:iam:::role/" + + # -- RBAC parameters + rbac: + # -- Create RBAC resources + create: true + # -- Add custom rule to the role + rules: [] + + # -- Set security context for the pod + # @default -- See below + podSecurityContext: + enabled: true + runAsUser: 3000 + runAsGroup: 3000 + fsGroup: 3000 + + # -- Set node selector + nodeSelector: {} + # -- Set resources + resources: {} + # -- Set tolerations + tolerations: [] + # -- Set affinity + affinity: {} + + # -- `dind-lv-monitor` DaemonSet parameters + # (local volumes cleaner) + # @default -- See below + dind-lv-monitor: + enabled: true + image: + registry: quay.io + repository: codefresh/dind-volume-utils + tag: 1.29.4 + podAnnotations: {} + podSecurityContext: + enabled: true + runAsUser: 1000 + fsGroup: 1000 + containerSecurityContext: {} + env: {} + resources: {} + nodeSelector: {} + tolerations: + - key: 'codefresh/dind' + operator: 'Exists' + effect: 'NoSchedule' + volumePermissions: + enabled: true + image: + registry: docker.io + repository: alpine + tag: 3.18 + resources: {} + securityContext: + runAsUser: 0 # auto + + # `dind-volume-cleanup` CronJob parameters + # (external volumes cleaner) + # @default -- See below + dind-volume-cleanup: + enabled: true + image: + registry: quay.io + repository: codefresh/dind-volume-cleanup + tag: 1.2.0 + env: {} + concurrencyPolicy: Forbid + schedule: "*/10 * * * *" + successfulJobsHistory: 3 + failedJobsHistory: 1 + suspend: false + podAnnotations: {} + podSecurityContext: + enabled: true + fsGroup: 3000 + runAsGroup: 3000 + runAsUser: 3000 + nodeSelector: {} + affinity: {} + tolerations: [] + +# Storage parameters for volume-provisioner +# @default -- See below +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: local + # -- Set filesystem type (`ext4`/`xfs`) + fsType: "ext4" + + # Storage parametrs example for local volumes on the K8S nodes filesystem (i.e. `storage.backend=local`) + # https://kubernetes.io/docs/concepts/storage/volumes/#local + # @default -- See below + local: + # -- Set volume path on the host filesystem + volumeParentDir: /var/lib/codefresh/dind-volumes + + # Storage parameters example for aws ebs disks (i.e. `storage.backend=ebs`/`storage.backend=ebs-csi`) + # https://aws.amazon.com/ebs/ + # https://codefresh.io/docs/docs/installation/codefresh-runner/#aws-backend-volume-configuration + # @default -- See below + ebs: + # -- Set EBS volume type (`gp2`/`gp3`/`io1`) (required) + volumeType: "gp2" + # -- Set EBS volumes availability zone (required) + availabilityZone: "us-east-1a" + # -- Enable encryption (optional) + encrypted: "false" + # -- Set KMS encryption key ID (optional) + kmsKeyId: "" + + # -- Set AWS_ACCESS_KEY_ID for volume-provisioner (optional) + # Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#dind-volume-provisioner-permissions + accessKeyId: "" + # -- Existing secret containing AWS_ACCESS_KEY_ID. + accessKeyIdSecretKeyRef: {} + # E.g. + # accessKeyIdSecretKeyRef: + # name: + # key: + + # -- Set AWS_SECRET_ACCESS_KEY for volume-provisioner (optional) + # Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#dind-volume-provisioner-permissions + secretAccessKey: "" + # -- Existing secret containing AWS_SECRET_ACCESS_KEY + secretAccessKeySecretKeyRef: {} + # E.g. + # secretAccessKeySecretKeyRef: + # name: + # key: + + # E.g. + # ebs: + # volumeType: gp3 + # availabilityZone: us-east-1c + # encrypted: false + # iops: "5000" + # # I/O operations per second. Only effetive when gp3 volume type is specified. + # # Default value - 3000. + # # Max - 16,000 + # throughput: "500" + # # Throughput in MiB/s. Only effective when gp3 volume type is specified. + # # Default value - 125. + # # Max - 1000. + # ebs: + # volumeType: gp2 + # availabilityZone: us-east-1c + # encrypted: true + # kmsKeyId: "1234abcd-12ab-34cd-56ef-1234567890ab" + # accessKeyId: "MYKEYID" + # secretAccessKey: "MYACCESSKEY" + + # Storage parameters example for gce disks + # https://cloud.google.com/compute/docs/disks#pdspecs + # https://codefresh.io/docs/docs/installation/codefresh-runner/#gke-google-kubernetes-engine-backend-volume-configuration + # @default -- See below + gcedisk: + # -- Set GCP volume backend type (`pd-ssd`/`pd-standard`) + volumeType: "pd-ssd" + # -- Set GCP volume availability zone + availabilityZone: "us-west1-a" + # -- Set Google SA JSON key for volume-provisioner (optional) + serviceAccountJson: "" + # -- Existing secret containing containing Google SA JSON key for volume-provisioner (optional) + serviceAccountJsonSecretKeyRef: {} + # E.g. + # gcedisk: + # volumeType: pd-ssd + # availabilityZone: us-central1-c + # serviceAccountJson: |- + # { + # "type": "service_account", + # "project_id": "...", + # "private_key_id": "...", + # "private_key": "...", + # "client_email": "...", + # "client_id": "...", + # "auth_uri": "...", + # "token_uri": "...", + # "auth_provider_x509_cert_url": "...", + # "client_x509_cert_url": "..." + # } + + # Storage parameters example for Azure Disks + # https://codefresh.io/docs/docs/installation/codefresh-runner/#install-codefresh-runner-on-azure-kubernetes-service-aks + # @default -- See below + azuredisk: + # -- Set storage type (`Premium_LRS`) + skuName: Premium_LRS + cachingMode: None + # availabilityZone: northeurope-1 + # resourceGroup: + # DiskIOPSReadWrite: 500 + # DiskMBpsReadWrite: 100 + + mountAzureJson: false + +# -- Set runtime parameters +# @default -- See below + +runtime: + # -- Set annotation on engine Service Account + # Ref: https://codefresh.io/docs/docs/administration/codefresh-runner/#injecting-aws-arn-roles-into-the-cluster + serviceAccount: + create: true + annotations: {} + # E.g. + # serviceAccount: + # annotations: + # eks.amazonaws.com/role-arn: "arn:aws:iam:::role/" + + # -- Set parent runtime to inherit. + # Should not be changes. Parent runtime is controlled from Codefresh side. + runtimeExtends: + - system/default/hybrid/k8s_low_limits + # -- Runtime description + description: "" + + # -- RBAC parameters + rbac: + # -- Create RBAC resources + create: true + # -- Add custom rule to the engine role + rules: [] + + # -- (for On-Premise only) Enable agent + agent: true + # -- (for On-Premise only) Set inCluster runtime + inCluster: true + # -- (for On-Premise only) Assign accounts to runtime (list of account ids) + accounts: [] + + # -- Parameters for DinD (docker-in-docker) pod (aka "runtime" pod). + dind: + # -- Set dind image. + image: + registry: quay.io + repository: codefresh/dind + tag: 26.1.4-1.28.7 # use `latest-rootless/rootless/26.1.4-1.28.7-rootless` tags for rootless-dind + pullPolicy: IfNotPresent + # -- Set dind resources. + resources: + requests: null + limits: + cpu: 400m + memory: 800Mi + # -- Set termination grace period. + terminationGracePeriodSeconds: 30 + # -- PV claim spec parametes. + pvcs: + # -- Default dind PVC parameters + dind: + # -- PVC name prefix. + # Keep `dind` as default! Don't change! + name: dind + # -- PVC storage class name. + # Change ONLY if you need to use storage class NOT from Codefresh volume-provisioner + storageClassName: '{{ include "dind-volume-provisioner.storageClassName" . }}' + # -- PVC size. + volumeSize: 16Gi + # -- PV reuse selector. + # Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#volume-reuse-policy + reuseVolumeSelector: codefresh-app,io.codefresh.accountName + reuseVolumeSortOrder: pipeline_id + # -- PV annotations. + annotations: {} + # E.g.: + # annotations: + # codefresh.io/volume-retention: 7d + # -- Set additional env vars. + env: + DOCKER_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE: true + # -- Set pod annotations. + podAnnotations: {} + # -- Set pod labels. + podLabels: {} + # -- Set node selector. + nodeSelector: {} + # -- Set affinity + affinity: {} + # -- Set tolerations. + tolerations: [] + # -- Set scheduler name. + schedulerName: "" + # -- Set service account for pod. + serviceAccount: codefresh-engine + # -- Keep `true` as default! + userAccess: true + # -- Add extra volumes + userVolumes: {} + # E.g.: + # userVolumes: + # regctl-docker-registry: + # name: regctl-docker-registry + # secret: + # items: + # - key: .dockerconfigjson + # path: config.json + # secretName: regctl-docker-registry + # optional: true + # -- Add extra volume mounts + userVolumeMounts: {} + # E.g.: + # userVolumeMounts: + # regctl-docker-registry: + # name: regctl-docker-registry + # mountPath: /home/appuser/.docker/ + # readOnly: true + + # -- Parameters for Engine pod (aka "pipeline" orchestrator). + engine: + # -- Set image. + image: + registry: quay.io + repository: codefresh/engine + tag: 1.174.13 + pullPolicy: IfNotPresent + # -- Set container command. + command: + - npm + - run + - start + # -- Set resources. + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 1000m + memory: 2048Mi + # -- Set termination grace period. + terminationGracePeriodSeconds: 180 + # -- Set system(base) runtime images. + # @default -- See below. + runtimeImages: + COMPOSE_IMAGE: quay.io/codefresh/compose:v2.28.1-1.5.0 + CONTAINER_LOGGER_IMAGE: quay.io/codefresh/cf-container-logger:1.11.7 + DOCKER_BUILDER_IMAGE: quay.io/codefresh/cf-docker-builder:1.3.13 + DOCKER_PULLER_IMAGE: quay.io/codefresh/cf-docker-puller:8.0.18 + DOCKER_PUSHER_IMAGE: quay.io/codefresh/cf-docker-pusher:6.0.16 + DOCKER_TAG_PUSHER_IMAGE: quay.io/codefresh/cf-docker-tag-pusher:1.3.14 + FS_OPS_IMAGE: quay.io/codefresh/fs-ops:1.2.3 + GIT_CLONE_IMAGE: quay.io/codefresh/cf-git-cloner:10.1.28 + KUBE_DEPLOY: quay.io/codefresh/cf-deploy-kubernetes:16.1.11 + PIPELINE_DEBUGGER_IMAGE: quay.io/codefresh/cf-debugger:1.3.6 + TEMPLATE_ENGINE: quay.io/codefresh/pikolo:0.14.1 + CR_6177_FIXER: 'quay.io/codefresh/alpine:edge' + GC_BUILDER_IMAGE: 'quay.io/codefresh/cf-gc-builder:0.5.3' + COSIGN_IMAGE_SIGNER_IMAGE: 'quay.io/codefresh/cf-cosign-image-signer:2.4.0-cf.2' + # -- Set additional env vars. + env: + # -- Interval to check the exec status in the container-logger + CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS: 1000 + # -- Timeout while doing requests to the Docker daemon + DOCKER_REQUEST_TIMEOUT_MS: 30000 + # -- If "true", composition images will be pulled sequentially + FORCE_COMPOSE_SERIAL_PULL: false + # -- Level of logging for engine + LOGGER_LEVEL: debug + # -- Enable debug-level logging of outgoing HTTP/HTTPS requests + LOG_OUTGOING_HTTP_REQUESTS: false + # -- Enable emitting metrics from engine + METRICS_PROMETHEUS_ENABLED: true + # -- Enable legacy metrics + METRICS_PROMETHEUS_ENABLE_LEGACY_METRICS: false + # -- Enable collecting process metrics + METRICS_PROMETHEUS_COLLECT_PROCESS_METRICS: false + # -- Host for Prometheus metrics server + METRICS_PROMETHEUS_HOST: '0.0.0.0' + # -- Port for Prometheus metrics server + METRICS_PROMETHEUS_PORT: 9100 + # -- Set workflow limits. + workflowLimits: + # -- Maximum time allowed to the engine to wait for the pre-steps (aka "Initializing Process") to succeed; seconds. + MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS: 600 + # -- Maximum time for workflow execution; seconds. + MAXIMUM_ALLOWED_WORKFLOW_AGE_BEFORE_TERMINATION: 86400 + # -- Maximum time allowed to workflow to spend in "elected" state; seconds. + MAXIMUM_ELECTED_STATE_AGE_ALLOWED: 900 + # -- Maximum retry attempts allowed for workflow. + MAXIMUM_RETRY_ATTEMPTS_ALLOWED: 20 + # -- Maximum time allowed to workflow to spend in "terminating" state until force terminated; seconds. + MAXIMUM_TERMINATING_STATE_AGE_ALLOWED: 900 + # -- Maximum time allowed to workflow to spend in "terminating" state without logs activity until force terminated; seconds. + MAXIMUM_TERMINATING_STATE_AGE_ALLOWED_WITHOUT_UPDATE: 300 + # -- Time since the last health check report after which workflow is terminated; seconds. + TIME_ENGINE_INACTIVE_UNTIL_TERMINATION: 300 + # -- Time since the last health check report after which the engine is considered unhealthy; seconds. + TIME_ENGINE_INACTIVE_UNTIL_UNHEALTHY: 60 + # -- Time since the last workflow logs activity after which workflow is terminated; seconds. + TIME_INACTIVE_UNTIL_TERMINATION: 2700 + # -- Set pod annotations. + podAnnotations: {} + # -- Set pod labels. + podLabels: {} + # -- Set node selector. + nodeSelector: {} + # -- Set affinity + affinity: {} + # -- Set tolerations. + tolerations: [] + # -- Set scheduler name. + schedulerName: "" + # -- Set service account for pod. + serviceAccount: codefresh-engine + # -- Set extra env vars + userEnvVars: [] + # E.g. + # userEnvVars: + # - name: GITHUB_TOKEN + # valueFrom: + # secretKeyRef: + # name: github-token + # key: token + + # -- Parameters for `runtime-patch` post-upgrade/install hook + # @default -- See below + patch: + enabled: true + image: + registry: quay.io + repository: codefresh/cli + tag: 0.85.0-rootless + rbac: + enabled: true + annotations: {} + affinity: {} + nodeSelector: {} + podSecurityContext: {} + resources: {} + tolerations: [] + ttlSecondsAfterFinished: 180 + env: + HOME: /tmp + + # -- Parameters for `gencerts-dind` post-upgrade/install hook + # @default -- See below + gencerts: + enabled: true + image: + registry: quay.io + repository: codefresh/kubectl + tag: 1.28.4 + rbac: + enabled: true + annotations: {} + affinity: {} + nodeSelector: {} + podSecurityContext: {} + resources: {} + tolerations: [] + ttlSecondsAfterFinished: 180 + + # -- DinD pod daemon config + # @default -- See below + dindDaemon: + hosts: + - unix:///var/run/docker.sock + - tcp://0.0.0.0:1300 + tlsverify: true + tls: true + tlscacert: /etc/ssl/cf-client/ca.pem + tlscert: /etc/ssl/cf/server-cert.pem + tlskey: /etc/ssl/cf/server-key.pem + insecure-registries: + - 192.168.99.100:5000 + metrics-addr: 0.0.0.0:9323 + experimental: true + +# App-Proxy parameters +# Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#app-proxy-installation +# @default -- See below +appProxy: + # -- Enable app-proxy + enabled: false + # -- Set number of pods + replicasCount: 1 + # -- Upgrade strategy + updateStrategy: + type: RollingUpdate + # -- Set pod annotations + podAnnotations: {} + + # -- Set image + image: + registry: quay.io + repository: codefresh/cf-app-proxy + tag: 0.0.47 + # -- Add additional env vars + env: {} + + # Set app-proxy ingress parameters + # @default -- See below + ingress: + # -- Set path prefix for ingress (keep empty for default `/` path) + pathPrefix: "" + # -- Set ingress class + class: "" + # -- Set DNS hostname the ingress will use + host: "" + # -- Set k8s tls secret for the ingress object + tlsSecret: "" + # -- Set extra annotations for ingress object + annotations: {} + # E.g. + # ingress: + # pathPrefix: "/cf-app-proxy" + # class: "nginx" + # host: "mydomain.com" + # tlsSecret: "tls-cert-app-proxy" + # annotations: + # nginx.ingress.kubernetes.io/whitelist-source-range: 123.123.123.123/130 + + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Override service account name + name: "" + # -- Use Role(true)/ClusterRole(true) + namespaced: true + # -- Additional service account annotations + annotations: {} + + # -- RBAC parameters + rbac: + # -- Create RBAC resources + create: true + # -- Use Role(true)/ClusterRole(true) + namespaced: true + # -- Add custom rule to the role + rules: [] + + # -- Set security context for the pod + podSecurityContext: {} + + # -- Readiness probe configuration + # @default -- See below + readinessProbe: + failureThreshold: 5 + initialDelaySeconds: 5 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 5 + + # -- Set requests and limits + resources: {} + # -- Set node selector + nodeSelector: {} + # -- Set tolerations + tolerations: [] + # -- Set affinity + affinity: {} + +# Monitor parameters +# @default -- See below +monitor: + # -- Enable monitor + # Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#install-monitoring-component + enabled: false + + # -- Set number of pods + replicasCount: 1 + # -- Upgrade strategy + updateStrategy: + type: RollingUpdate + # -- Set pod annotations + podAnnotations: {} + + # -- Set image + image: + registry: quay.io + repository: codefresh/cf-k8s-agent + tag: 1.3.18 + # -- Add additional env vars + env: {} + + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Override service account name + name: "" + # -- Additional service account annotations + annotations: {} + + # -- RBAC parameters + rbac: + # -- Create RBAC resources + create: true + # -- Use Role(true)/ClusterRole(true) + namespaced: true + # -- Add custom rule to the role + rules: [] + + # -- Readiness probe configuration + # @default -- See below + readinessProbe: + failureThreshold: 5 + initialDelaySeconds: 5 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 5 + + podSecurityContext: {} + + # -- Set node selector + nodeSelector: {} + # -- Set resources + resources: {} + # -- Set tolerations + tolerations: [] + # -- Set affinity + affinity: {} + +# -- Add serviceMonitor +# @default -- See below +serviceMonitor: + main: + # -- Enable service monitor for dind pods + enabled: false + nameOverride: dind + selector: + matchLabels: + app: dind + endpoints: + - path: /metrics + targetPort: 9100 + relabelings: + - action: labelmap + regex: __meta_kubernetes_pod_label_(.+) + +# -- Add podMonitor (for engine pods) +# @default -- See below +podMonitor: + main: + # -- Enable pod monitor for engine pods + enabled: false + nameOverride: engine + selector: + matchLabels: + app: runtime + podMetricsEndpoints: + - path: /metrics + targetPort: 9100 + + runner: + # -- Enable pod monitor for runner pod + enabled: false + nameOverride: runner + selector: + matchLabels: + codefresh.io/application: runner + podMetricsEndpoints: + - path: /metrics + targetPort: 8080 + + volume-provisioner: + # -- Enable pod monitor for volumeProvisioner pod + enabled: false + nameOverride: volume-provisioner + selector: + matchLabels: + codefresh.io/application: volume-provisioner + podMetricsEndpoints: + - path: /metrics + targetPort: 8080 + +# -- Event exporter parameters +# @default -- See below +event-exporter: + # -- Enable event-exporter + enabled: false + # -- Set number of pods + replicasCount: 1 + # -- Upgrade strategy + updateStrategy: + type: Recreate + # -- Set pod annotations + podAnnotations: {} + + # -- Set image + image: + registry: docker.io + repository: codefresh/k8s-event-exporter + tag: latest + # -- Add additional env vars + env: {} + + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Override service account name + name: "" + # -- Additional service account annotations + annotations: {} + + # -- RBAC parameters + rbac: + # -- Create RBAC resources + create: true + # -- Add custom rule to the role + rules: [] + + # -- Set security context for the pod + # @default -- See below + podSecurityContext: + enabled: false + + # -- Set node selector + nodeSelector: {} + # -- Set resources + resources: {} + # -- Set tolerations + tolerations: [] + # -- Set affinity + affinity: {} + +# -- Array of extra objects to deploy with the release +extraResources: [] +# E.g. +# extraResources: +# - apiVersion: rbac.authorization.k8s.io/v1 +# kind: ClusterRole +# metadata: +# name: codefresh-role +# rules: +# - apiGroups: [ "*"] +# resources: ["*"] +# verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] +# - apiVersion: v1 +# kind: ServiceAccount +# metadata: +# name: codefresh-user +# namespace: "{{ .Release.Namespace }}" +# - apiVersion: rbac.authorization.k8s.io/v1 +# kind: ClusterRoleBinding +# metadata: +# name: codefresh-user +# roleRef: +# apiGroup: rbac.authorization.k8s.io +# kind: ClusterRole +# name: codefresh-role +# subjects: +# - kind: ServiceAccount +# name: codefresh-user +# namespace: "{{ .Release.Namespace }}" +# - apiVersion: v1 +# kind: Secret +# type: kubernetes.io/service-account-token +# metadata: +# name: codefresh-user-token +# namespace: "{{ .Release.Namespace }}" +# annotations: +# kubernetes.io/service-account.name: "codefresh-user" diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/.helmignore b/charts/dynatrace/dynatrace-operator/1.3.1/.helmignore new file mode 100644 index 000000000..98229532e --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/.helmignore @@ -0,0 +1,25 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ + +tests/ diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/Chart.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/Chart.yaml new file mode 100644 index 000000000..77b4abdee --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/Chart.yaml @@ -0,0 +1,23 @@ +annotations: + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Dynatrace Operator + catalog.cattle.io/kube-version: '>=1.19.0-0' + catalog.cattle.io/release-name: dynatrace-operator +apiVersion: v2 +appVersion: 1.3.1 +description: The Dynatrace Operator Helm chart for Kubernetes and OpenShift +home: https://www.dynatrace.com/ +icon: file://assets/icons/dynatrace-operator.png +kubeVersion: '>=1.19.0-0' +maintainers: +- email: marcell.sevcsik@dynatrace.com + name: 0sewa0 +- email: christoph.muellner@dynatrace.com + name: chrismuellner +- email: lukas.hinterreiter@dynatrace.com + name: luhi-DT +name: dynatrace-operator +sources: +- https://github.com/Dynatrace/dynatrace-operator +type: application +version: 1.3.1 diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/README.md b/charts/dynatrace/dynatrace-operator/1.3.1/README.md new file mode 100644 index 000000000..97a98a018 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/README.md @@ -0,0 +1,48 @@ +# Dynatrace Operator Helm Chart + +The Dynatrace Operator supports rollout and lifecycle of various Dynatrace components in Kubernetes and OpenShift. + +This Helm Chart requires Helm 3. + +## Quick Start + +Migration instructions can be found in the [official help page](https://www.dynatrace.com/support/help/shortlink/k8s-dto-helm#migrate). + +Install the Dynatrace Operator via Helm by running the following commands. + +### Installation + +> For instructions on how to install the dynatrace-operator on Openshift, head to the +> [official help page](https://www.dynatrace.com/support/help/shortlink/k8s-helm) + +#### For versions older than 0.15.0 + +Add `dynatrace` helm repository: + +```console +helm repo add dynatrace https://raw.githubusercontent.com/Dynatrace/dynatrace-operator/main/config/helm/repos/stable +``` + +Install `dynatrace-operator` helm chart and create the corresponding `dynatrace` namespace: + +```console +helm install dynatrace-operator dynatrace/dynatrace-operator -n dynatrace --create-namespace --atomic +``` + +#### For versions 0.15.0 and after + +Install `dynatrace-operator` helm chart using the OCI repository and create the corresponding `dynatrace` namespace: + +```console +helm install dynatrace-operator oci://public.ecr.aws/dynatrace/dynatrace-operator -n dynatrace --create-namespace --atomic +``` + +## Uninstall chart + +> Full instructions can be found in the [official help page](https://www.dynatrace.com/support/help/shortlink/k8s-helm#uninstall-dynatrace-operator) + +Uninstall the Dynatrace Operator by running the following command: + +```console +helm uninstall dynatrace-operator -n dynatrace +``` diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/app-readme.md b/charts/dynatrace/dynatrace-operator/1.3.1/app-readme.md new file mode 100644 index 000000000..844c96dd7 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/app-readme.md @@ -0,0 +1,5 @@ +# Dynatrace Operator + +The Dynatrace Operator supports rollout and lifecycle of various Dynatrace components in Kubernetes and OpenShift. + +As of launch, the Dynatrace Operator can be used to deploy a containerized ActiveGate for Kubernetes API monitoring. New capabilities will be added to the Dynatrace Operator over time including metric routing, and API monitoring for AWS, Azure, GCP, and vSphere. diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/logo.png b/charts/dynatrace/dynatrace-operator/1.3.1/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..6714eb8a59509d9513133b43b2de290f73be9c18 GIT binary patch literal 9908 zcmYj%c|27A_y22#u?!l?E=H*kp(IM0@s_kAN~kOqDnhHhJ7sHEy(=UQZ6sT~C83!{ zsqAU7r7>k+r)-1k-tX(`^Lspgf8@^0z305nd7kBUU(eG;M|(RtsyY<_Ah%`nMkfHs z@FN*WNx;ik=$C1Dkq+MMb`k)Y1;jrRxO-0({-}1!*7cNgkngDw?-M@2`cTjTAMGv2 zy#0Kfe7p~Z9slUF9)M-mTQ*wn3T+*1-+yIalQ&&hT8duR+q=)!<+Ju3i@@m3F{vjs z$DXdN@;)bV`m#%;^FqZ2g&qDl!7q(F9R#1M=tJmAHp5=__ujmogst%Pp^KO4e(*uuGQNdfaJ6RFPqenFM$+onoTezZ9RIp1K^;W{2e6tv5qD^H|haSJlChGx{0Ac;) zH4)of{SrA1T;C)r9?j^gIfYbxD=5uSdu6F8vB#Q4W{OoX7LFq=n@wV{0A9z^f44%> zFNUI?2)kJa4Y{rVMJ-Fm^I7vLV6hY)>mg#BsBdo`*Yu^mxSwMOo$jw-L^f!dsc-Br zIL{)3t~kUJd8LOQVOsa**}R+_R1~9v!G+l6sn3@;osSzZ-ZjV=zAb)PaVL<+ye7PY zC%EMrj_~vKd`w9;wdN^B5yUXAM+G1CKApcrPf`!ORmHp+NZT~;l<&NIE{?!!xqx$z zVdcL>`_hR9_S)VFB*6Ls8SvEGt}OcGNh z_I+fUyWJXjk@gV4n~keO)zkm|8hTQP!dg{>R-Bnxd`{FJe+4WmVV}k6$2W&Aq>|@WsT0zav!+dzU=X#@U$VHD z2N9Un#;8hRx%t6o0TSHBTwe)J+Z6ff-s)i^(ZD7xY-a!MuTF$(74eA0AJ2qwjfJaF zgB9R^2K$K&00dOLf{__u3@B-80=@#q5+-aw6AQ?e&$~H!H{IaRn1Ih;i*PP zWbF4YkbZ*LIun(y^p zfM?$T3a70~OH27jJK7#J< z{|1pc8SXYuH2unf0ux7su?%&!Z%N^r!bReAc)1u-+-}|FMw}0CzvVIB>-eGX@m3y?%vxaTt zQ@c;Nr)tMJ!dH_^Md)+KXkpNwvxbii#dpCv5LSVFGq>B5!l8MQsU>mwc=Tusi%sBL64HB)rOC!iPF+Y0 zdvcX2fVrcMYCK`M#4dSGtSf~m7{KyMQx+iZqJ-=mqMF;YziOi@qZvU`_{XDz>a6wX z-l@;FM7`CHyK>%mh}y2?B;6qgBO=QLaR_1_7)(E&F=v>=Th|crfL(-LMN;@EkE3`n z^=IIA;(NhphV&k7U8SKHl*Wn9lEI_N=6B0>^{+-n>%Yseq(Eo$@;%Nv(?3bf|{on9t>N1Fhpz1y+GV}orH&H5I zj_T$LL+#2X(n2ixu+=OX{Qr6`d)D>nlGaoZA>e;ncJ6HjBVedheZX7~edu`DoU7+B z*URf0s5xR6a_5TK;lNy#E=E;ikzLdwiu?|e>Pr|INv9&^4K@Dqm@yTfzWj4J>zr^h zj_fp#=mZ|o!uLd`$Ya~xX1~p;sXw)SE5W#}m>M{5UY^*FX zD|y-L1zyHz(H8AKVSO~RvO6eW1$*J0mtbdf@6{@&hp+tAX8)q)77cqvfCSq&&HKv4HvUuI_B*lKb`qU3)^-h9+9G1KL6JAA%e8a z9m?OJM&!^6zxGdG$34D!9xQ&rV01SfrcI?UR;)a^jE4IN90HcZ9Ahg~gcZvVO=wMi zWCUBv(KGb0vr|Y<4*JyWpEpVM!=Bk+I&UsQlW$FAas*6UIu&k+^flL1eP!2bD zbM$lEi`PHOe*Z>)zb$WgJw1{4ea0^@2U#95(p@om_H5TxPlJidh>kb>(9z5EsaKzT z$)*e1{4^yl+la=OuUT^03LSdey51j_kXoM;w~@+(=zf%nn!L&>IOs)-oBEnVcNi}0 z$U&x?uk4BYu(hJ&)uoAfUEWCr^7h`T*TQ_aiOlzSfKAi;tQ;E=3m$S_BBN0x`R zM91T}Ja(&p0W_%3{)B|r77-13``S5Q#VWyr-@116bqGZY+1gZf#`D(RKvI4y9{q6Q z&ASt`Cx@R1LaOnW;w$9shNy~ZTfVa|sds3I-zyxUm&i;uYH(??WGMvhrkO9mm`n9H zY{z)(v~KY~W%TaZBUAaAxeP0~Y3>9C5tlKeZ!0@yo^@)LJG2ZA+D60h_AOr}mVb|N z?VYf8vYsOo3Iq;o8aFX@lvrplernC*{TQ!gQhrcyFA`6Fb$9B;O4e2$V_{lLoYj7v zcI|*(vPpjJ$i|qync%SR1`JU^c;ZL1?{K?dm=f9g!}-%^ocpGR6b+Y9A>h(fid*=^Lb>Fj^H*5?PxGeyo9Z_I0qPbIk;&6LXa zjB%!B>wD~G*yA^0nJx?9N02)0@FBF%$qnhK&f8FU`oEE~vstD<5+BSluEo!vV?965 zw{mT+%`k=q^hNGzTr$bR^V@vf9P42yqfgE2T3SZbDDv1Y-(CaKyup)W{3^Enwb9g= zlc?v+zle7he0N!JW7Zc`uA9cYC-FDmc5-%vsV0#{BNC(-#_c}-)bmhM@BT^TRqsxG zWcCwhWqbWRiuTM6Yu1el&h7U0^ZP}GY$tnCjF3LnFngPhT^;0i2}UyMX}4hLK2143 z-Zi7dx)C|#fVoZ7jzs;)EO=(l5#3ly09PejuGVmkl4d^3XuOYeChhR>fj=8y-8!32 z=(ExjFn;NH@Pskmalk65&eT#Ra7P5+xV~lx9k|`v{9(<=_m(MktS6^Xa7^xqn*z4$ zNHMt~cfW{k5o%s$6C4jXGykIR>8O(5yiUgbYiksTwLo+=)$QtDRDH*VQO4p+ga1;49gy+r=PPc znBGY({$~U~j$BNxmXJ?#_x_wIlaV_ZQFXeLEI%=Zw;JGO9iO_>X|WqF))+-PD!%sj z0?W<61hQam=l2Hnb=?+lVohQZJ=$z^JY)S=S+M=9J;kfZU#j8(Cn`iV5R26aBo}rS z?td@OZE%qz{c8j)>%d@$0YBL$zR(Z}uo5#dO00F-WoZyf?Rag2Hhp81>;`9KF?2K1 z{YFPwNMhFdf#C&#!#X0hrlOvEWRSUoB$bFp9WG>xNfx%mZ}^FB0B?_EYLJJLe|mq# zJHFsGHxdq+($*h7Ov>_;1GaLfZPKhpLKoyt^4-T7mWj1mQ5!|3*UW4{MQL#VrDq`X zORgyh`XLgvw`1M&4i(bs+pekDnF9S95IH)-R>6QHLzk+;3LeJy=AAW4neDCMu?tSg zk(lex7=k>sqp-z+#tjiz$i_^-JZcJzIlm|6G{Bd(UVo6b_{l2L z;s?NFe$)Nx0Do#406^)eJ^*Pz4{U$8+Xl$1P*_`f)yaBqTh*Wq;w9m65B5n&0qJ$_ zk3e(8-Gbyw@e4Kf6z;7BKBM=^neb!`js|k}k_`Z8*bWa}pTC)jgX24aBY>~Pp%=8;ceEIU^Q*9H?0^pjZy-3eWx3ds)ESd9j}0IyvuD6FS1C+a~3ktqOXmM6q0tme~lq$^!XiWYaJ%sB#;{?=M##blY@uW7K=$FJ@^-@ zsf7sr)eNq#0DI)-gD)QbU&sw+zTn@}!;QaR?DT3SlxP!5SToJCQb55FtPvw8mEBo1 zcZ&kxEh1AkDYLFEIv~5k2E@Y9)qpg>3|E$gOauG`z*iM80|0Y2b>UO6FQU$#1y)A7 zRy=~iBjh(f2H9%MSRXAy`d(Ur3r~QnBrsV!0krRuf$iFxFp$AZ#F(j6=6e&;_U+a3 zUJ?YXP%vp9DOd@BC9dE*4S1a}yuTDma64Z{DpOdkCv6t6)Kvfs+OiBEsS6Ll%cUmV zjhd$7Z&!&y8F!GYu^ep9gNrd2B}9F_S;1i$o~NMu zcXLebNx=+o>8Ki6^{zA6B{(1;f?!E<+T8q4_(v0N!!>ns6}IqoaDP?5g(+}cg0@xZ zFeB~ohswZQ{DAA8SjLrZSVvFrr#vS$3O9ajh1ARrV<|*6*#PLxdIc2s;X7r3EIfmM z;6K>O>a*lDF$khYKK{j`w2gxQX5SS+>_Qi#q@&(_@Z2%r3o;vh1hmKb60B7T*krl* z4D0v-S%Wa4vATp_>@$$m{0YxA1)2vh2_-MIehv5_*L;u66xl3vk7Fs^)9mi`guI2# z`fFHgi6+d%k^2ay35Ru<3J$Jmy zI&=&-dRET%3)|Tn`t;(h{UG_UNRnU{Z1C!YsM7=Mzb?(Qei+lR@5*|#VkdriDbi9c z#?Ug9n55e1m4zK~41f9s=2OKn7JrSx_EqR*MG*9*I~LMQ2^0O-F7Y^58ci&!^FP`)fDx>kk&+TyC@meVDSv09Cn1rW1#s7iP?xSEqUJJ9|9F0MaY7R8~3oIlrn|UqI_hO73vsLOKIq z4JkcH1n!;LwD*Gq56?`L*-*2F%j3&JUc$)`BrFHgp^GYobUz91Ea9W19X>cj6wmXs zCm~Ld^x^Cgv6Zp>`cH}Q1n=(-dAOu&IVrXqwFsu&Jcd!UVI4d58CoB_KwH2VSLi>T zwObUggCF+u3>V-J5-+_v#ZxrMDUz8=k4%7@)FeF0~m@cVhx*jkBD`k zNKTH~A~gEAJ>(~)V-YQMbn5dv^myYo+ff;Az++Fo5-6hKn>yLf;JE0Yxd^5|I`6IF zCGZ?o169Z2(Yp)M0@B7xx5nN)15)@pNGqj({e52^W5L5E+m&EgDKgxLROXI-fk#D> zzwVP?-ep`1OIU4$suYyUU}Y~ldKtTk99%PHY!OK6rCz)du-{UBYA8}Ae2#|P9of4a z($@-5G*~}PD7i@=7?Bh)Ie4KcVq87?t2HDA;;R(mCH{h>jP1||nj^`r@%RIwq$#*) z`LDZ3at%4F&RrQFimcGUY>kz+*QM)vnoIqT#ZTPyIaR~wkN=pDu^u9X#UI4%A(h0v zeh*i{cHAXN(iFL_ozWm00%`*N7=#Om70P9V@^N#{0$Sx#us%9Yy9v zVD)KkUK1qY3Q7k|Vi<4tL6eA$$+N@C?WZjFvz#oRUljCTp+@-}fnI)l(VvGa5`l}) zQW|DkVN$NfTBbDxHx0!(%q`qD$SqSKnd1z6*6N_YQb@h=hxb=-G*4cfk2wa# z-~Uf4|B=vhjqGt{*19^#A#gu&;LxP z20tpRL)3XWX#aqng`^*xmUv5e z6$m(idi@MB`EAh)VB9o9s`LTuU&vO9cAUzp31N^lvbll;6X`vQ1vJPqT{jja#pCZT zR3Pap1ZOWzv>&z;De0TctD^I(|Flg}kd{HYd7$7A&v$oeBKZPNXD zSE7JIyBJf{l#}T)b~>*+;o#E9)VWYMonTJ24oe4VdcCK8?RLOr5Q>+Bt;-<$V+9e#BFypF zgc9I!th3z3O!`x7L}Jb%qZ6W@VU0)%_b$xW3A3MOGd%j?I$5Tv3=96S=|l-hz|lq* zX{NMf8OJ6|k8=Q|F z6VO%#1NT3Rd5Uy18>@kTupL7{3n($`UdoEUKb;QAWu~SS(qUr?T3*Tk z{}M^A8YJ=`DP!Asbk)_v%a|wW5gFG6oWa`;P3OK~JV@7@qlF&fgv2iovM4l%7)8K? z5^U|}#g)zCnZ8XB@r|RqRXM7b*56C60P&JhFmC>Hhm})6)i7@ADOigOe)-r0erU&5Y3O->#nJuEo zh!s+Fugb1=xG{OPO@n~coUqU*+XL~qR6o^x*t7i z8Vk%o_eD*KknZ^g=_O=rf8 zAz%vn5;-+b#gi_X|CrhtV22ayd^*rzEH-rRKu4B%Ci6x$-i-{<3UoLVR)PdF_wA)O z9lNDR#VCTLPv;KsO7MIMFV}c>xK+g1He+c-5j@bB9P-dtHI%Z~P2L-f{P+(FW9nI5cy*cz$ew@Qr5#GCNwAsXeJQ^K4XUpU$^ z$>Qc72dYhaFas)5JZcO7zm8H2rXQPDKGdQld$HNS3wilvqzC(iRL`@T3QtB3HMg1% z4mYiw)&ugmAm=^g7z1tV9W08uZ)W-%}AB4&Bmg>@Ld*wE8E8 z*VEcIG8_6#JYe$EXXIYgSYJ@$tle2?@aQHj3TQN-4jt?Aitsi`F|oF6{~ZKRK;3q; zc+sHTS>8_kLFrUF01>xi-Z(X|-K1K@IKG>_w_COgGtNK6f^+dmEp*$ag%qGyXgKDl zAR)t>Ag3D+!t;LI1{&U7?L!~uz>#6;G*t5GR&44en+8$4iev?2`(*sysSU!uJ=Lg= zOZXf9c&-fz^t-A`Tz=D$P^@yXHG6Nb=dg;)Bx7uVuRr<L#ryU768OY`g zMvqgYGZwu_j1!J*AN%iZZJT+a#>pUGNeA@EnNCx_!N6TC_$+=Pv@;#~WCuV5;ZBpWEW~XNS2uF<4d~6b9PTxF?GQu78W$e<0Z| R5fVsXi>>{}+<&~z{~v%ki3tDz literal 0 HcmV?d00001 diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/questions.yml b/charts/dynatrace/dynatrace-operator/1.3.1/questions.yml new file mode 100644 index 000000000..70c94f9da --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/questions.yml @@ -0,0 +1,236 @@ +categories: + - APM + - Monitoring +questions: + + #################### Global Configuration #################### + - variable: installCRD + label: "Install Custom Resource Definitions" + description: "Installs the Custom Resource Definitions for the Dynakube. This is recommended if you haven't installed it manually yet. Default: true" + default: true + type: boolean + group: "Global Configuration" + + - variable: image + label: "Set a custom image for operator components" + description: "Set a custom image for operator. Defaults to public.ecr.aws/dynatrace/dynatrace-operator" + default: "" + type: string + group: "Global Configuration" + + - variable: customPullSecret + label: "Set a custom pull secret for operator image" + description: "Set a custom pull secret for the operator image" + default: "" + type: string + group: "Global Configuration" + + #################### Operator Deployment Configuration #################### + - variable: operator.nodeSelector + label: "Assign the Dynatrace Operator's pod to certain nodes" + description: "Defines a NodeSelector to customize to which nodes the Dynatrace Operator can be deployed on - Please edit as Yaml for the best experience - see https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#nodeselector" + default: "" + type: string + group: "Operator Deployment Configuration" + + - variable: operator.tolerations + label: "Custom tolerations for the Dynatrace Operator's pod" + description: "Defines custom tolerations to the Dynatrace Operator - Please edit as Yaml for the best experience - see https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/" + default: "" + type: string + group: "Operator Deployment Configuration" + + - variable: operator.apparmor + label: "Enable AppArmor for the Dynatrace Operator's pod" + description: "Adds AppArmor security annotations to the Dynatrace Operator's pod. Default: false" + default: false + type: boolean + group: "Operator Deployment Configuration" + + - variable: operator.requests.cpu + label: "CPU resource requests settings for Dynatrace Operator's pods" + description: "The minimum amount of CPU resources that the Dynatrace Operator's pods should request. Affects scheduling. Default: 50m" + default: "50m" + type: string + group: "Operator Deployment Configuration" + + - variable: operator.requests.memory + label: "Memory resource requests settings for Dynatrace Operator's pods" + description: "The minimum amount of memory that the Dynatrace Operator's pods should request. Affects scheduling. Default: 64Mi" + default: "64Mi" + type: string + group: "Operator Deployment Configuration" + + - variable: operator.limits.cpu + label: "CPU resource limits settings for Dynatrace Operator's pods" + description: "The maximum amount of CPU resources that the Dynatrace Operator's pods can use. Default: 100m" + default: "100m" + type: string + group: "Operator Deployment Configuration" + + - variable: operator.limits.memory + label: "Memory resource limits settings for Dynatrace Operator's pods" + description: "The maximum amount of memory that the Dynatrace Operator's pods can use. Pod restarted if exceeded. Default: 128Mi" + default: "128Mi" + type: string + group: "Operator Deployment Configuration" + + + #################### Webhook Deployment Configuration #################### + + - variable: webhook.apparmor + label: "Enable AppArmor for the Dynatrace Webhook's pod" + description: "Adds AppArmor security annotations to the Dynatrace Webhook's pod. Default: false" + default: false + type: boolean + group: "Webhook Deployment Configuration" + + - variable: webhook.highAvailability + label: "Enable high availability for the Dynatrace Webhook's pod" + description: "Adds topologySpreadConstraints and increases the replicas to 2 for the Dynatrace Webhook's pod. Default: false" + default: false + type: boolean + group: "Webhook Deployment Configuration" + + - variable: webhook.hostNetwork + label: "Enable hostNetwork for the Dynatrace Webhook's pod" + description: "Enables hostNetwork for the Dynatrace Webhook's pod. Default: false" + default: false + type: boolean + group: "Webhook Deployment Configuration" + + - variable: webhook.requests.cpu + label: "CPU resource requests settings for Dynatrace Webhook's pods" + description: "The minimum amount of CPU resources that the Dynatrace Webhook's pods should request. Affects scheduling. Default: 300m" + default: "300m" + type: string + group: "Webhook Deployment Configuration" + + - variable: webhook.requests.memory + label: "Memory resource requests settings for Dynatrace Webhook's pods" + description: "The minimum amount of memory that the Dynatrace Webhook's pods should request. Affects scheduling. Default: 128Mi" + default: "128Mi" + type: string + group: "Webhook Deployment Configuration" + + - variable: webhook.limits.cpu + label: "CPU resource limits settings for Dynatrace Webhook's pods" + description: "The maximum amount of CPU resources that the Dynatrace Webhook's pods can use. Default: 300m" + default: "300m" + type: string + group: "Webhook Deployment Configuration" + + - variable: webhook.limits.memory + label: "Memory resource limits settings for Dynatrace Webhook's pods" + description: "The maximum amount of memory that the Dynatrace Webhook's pods can use. Pod restarted if exceeded. Default: 128Mi" + default: "128Mi" + type: string + group: "Webhook Deployment Configuration" + + + #################### CSI Driver Deployment Configuration #################### + + - variable: csidriver.enabled + label: "Deploy the Dynatrace CSI Driver" + description: "Deploys the Dynatrace CSI Driver via a DaemonSet to enable Cloud Native FullStack. Default: false" + default: false + type: boolean + group: "CSI Driver Deployment Configuration" + + - variable: csidriver.server.requests.cpu + label: "CPU resource requests settings for Dynatrace CSI Driver's server container" + description: "The minimum amount of CPU resources that the Dynatrace CSI Driver's server container should request. Affects scheduling. Default: 50m" + default: "50m" + type: string + group: "CSI Driver Deployment Configuration" + + - variable: csidriver.server.requests.memory + label: "Memory resource requests settings for Dynatrace CSI Driver's server container" + description: "The minimum amount of memory that the Dynatrace CSI Driver's server container should request. Affects scheduling. Default: 100Mi" + default: "100Mi" + type: string + group: "CSI Driver Deployment Configuration" + + - variable: csidriver.server.limits.cpu + label: "CPU resource limits settings for Dynatrace CSI Driver's server container" + description: "The maximum amount of CPU resources that the Dynatrace CSI Driver's server container can use. Default: 50m" + default: "50m" + type: string + group: "CSI Driver Deployment Configuration" + + - variable: csidriver.server.limits.memory + label: "Memory resource limits settings for Dynatrace CSI Driver's server container" + description: "The maximum amount of memory that the Dynatrace CSI Driver's server container can use. Pod restarted if exceeded. Default: 100Mi" + default: "100Mi" + type: string + group: "CSI Driver Deployment Configuration" + + - variable: csidriver.provisioner.requests.cpu + label: "CPU resource requests settings for Dynatrace CSI Driver's provisioner container" + description: "The minimum amount of CPU resources that the Dynatrace CSI Driver's provisioner container should request. Affects scheduling. Default: 300m" + default: "300m" + type: string + group: "CSI Driver Deployment Configuration" + + - variable: csidriver.provisioner.requests.memory + label: "Memory resource requests settings for Dynatrace CSI Driver's provisioner container" + description: "The minimum amount of memory that the Dynatrace CSI Driver's provisioner container should request. Affects scheduling. Default: 100Mi" + default: "100Mi" + type: string + group: "CSI Driver Deployment Configuration" + + - variable: csidriver.registrar.requests.cpu + label: "CPU resource requests settings for Dynatrace CSI Driver's registrar container" + description: "The minimum amount of CPU resources that the Dynatrace CSI Driver's registrar container should request. Affects scheduling. Default: 20m" + default: "20m" + type: string + group: "CSI Driver Deployment Configuration" + + - variable: csidriver.registrar.requests.memory + label: "Memory resource requests settings for Dynatrace CSI Driver's registrar container" + description: "The minimum amount of memory that the Dynatrace CSI Driver's registrar container should request. Affects scheduling. Default: 30Mi" + default: "30Mi" + type: string + group: "CSI Driver Deployment Configuration" + + - variable: csidriver.registrar.limits.cpu + label: "CPU resource limits settings for Dynatrace CSI Driver's registrar container" + description: "The maximum amount of CPU resources that the Dynatrace CSI Driver's registrar container can use. Default: 20m" + default: "20m" + type: string + group: "CSI Driver Deployment Configuration" + + - variable: csidriver.registrar.limits.memory + label: "Memory resource limits settings for Dynatrace CSI Driver's registrar container" + description: "The maximum amount of memory that the Dynatrace CSI Driver's registrar container can use. Pod restarted if exceeded. Default: 30Mi" + default: "30Mi" + type: string + group: "CSI Driver Deployment Configuration" + + - variable: csidriver.livenessprobe.requests.cpu + label: "CPU resource requests settings for Dynatrace CSI Driver's livenessprobe container" + description: "The minimum amount of CPU resources that the Dynatrace CSI Driver's livenessprobe container should request. Affects scheduling. Default: 20m" + default: "20m" + type: string + group: "CSI Driver Deployment Configuration" + + - variable: csidriver.livenessprobe.requests.memory + label: "Memory resource requests settings for Dynatrace CSI Driver's livenessprobe container" + description: "The minimum amount of memory that the Dynatrace CSI Driver's livenessprobe container should request. Affects scheduling. Default: 30Mi" + default: "30Mi" + type: string + group: "CSI Driver Deployment Configuration" + + - variable: csidriver.livenessprobe.limits.cpu + label: "CPU resource limits settings for Dynatrace CSI Driver's livenessprobe container" + description: "The maximum amount of CPU resources that the Dynatrace CSI Driver's livenessprobe container can use. Default: 20m" + default: "20m" + type: string + group: "CSI Driver Deployment Configuration" + + - variable: csidriver.livenessprobe.limits.memory + label: "Memory resource limits settings for Dynatrace CSI Driver's livenessprobe container" + description: "The maximum amount of memory that the Dynatrace CSI Driver's livenessprobe container can use. Pod restarted if exceeded. Default: 30Mi" + default: "30Mi" + type: string + group: "CSI Driver Deployment Configuration" diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/activegate/clusterrole-activegate.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/activegate/clusterrole-activegate.yaml new file mode 100644 index 000000000..9d41f7409 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/activegate/clusterrole-activegate.yaml @@ -0,0 +1,47 @@ +{{- if (eq (include "dynatrace-operator.openshiftOrOlm" .) "true") }} + +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: dynatrace-activegate + labels: + {{- include "dynatrace-operator.activegateLabels" . | nindent 4 }} +rules: + - apiGroups: + - security.openshift.io + resourceNames: + - privileged + - nonroot-v2 + resources: + - securitycontextconstraints + verbs: + - use +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: dynatrace-activegate + labels: + {{- include "dynatrace-operator.activegateLabels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: dynatrace-activegate + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: dynatrace-activegate + apiGroup: rbac.authorization.k8s.io +{{- end -}} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/activegate/serviceaccount-activegate.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/activegate/serviceaccount-activegate.yaml new file mode 100644 index 000000000..93fe71a3f --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/activegate/serviceaccount-activegate.yaml @@ -0,0 +1,20 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: dynatrace-activegate + namespace: {{ .Release.Namespace }} + labels: + {{- include "dynatrace-operator.activegateLabels" . | nindent 4 }} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/crd/dynatrace-operator-crd.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/crd/dynatrace-operator-crd.yaml new file mode 100644 index 000000000..01dc43bf7 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/crd/dynatrace-operator-crd.yaml @@ -0,0 +1,5783 @@ +{{ if .Values.installCRD }} +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.4 + name: dynakubes.dynatrace.com +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: dynatrace-webhook + namespace: {{.Release.Namespace}} + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: dynatrace.com + names: + categories: + - dynatrace + kind: DynaKube + listKind: DynaKubeList + plural: dynakubes + shortNames: + - dk + - dks + singular: dynakube + preserveUnknownFields: false + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.apiUrl + name: ApiUrl + type: string + - jsonPath: .status.phase + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: DynaKube is the Schema for the DynaKube API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: DynaKubeSpec defines the desired state of DynaKube + properties: + activeGate: + description: General configuration about ActiveGate instances. + properties: + annotations: + additionalProperties: + type: string + description: Adds additional annotations to the ActiveGate pods + type: object + capabilities: + description: Activegate capabilities enabled (routing, kubernetes-monitoring, + metrics-ingest, dynatrace-api) + items: + type: string + type: array + customProperties: + description: |- + Add a custom properties file by providing it as a value or reference it from a secret + If referenced from a secret, make sure the key is called 'customProperties' + properties: + value: + description: Custom properties value. + nullable: true + type: string + valueFrom: + description: Custom properties secret. + nullable: true + type: string + type: object + dnsPolicy: + description: Sets DNS Policy for the ActiveGate pods + type: string + env: + description: List of environment variables to set for the ActiveGate + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + group: + description: Set activation group for ActiveGate + type: string + image: + description: The ActiveGate container image. Defaults to the latest + ActiveGate image provided by the registry on the tenant + type: string + labels: + additionalProperties: + type: string + description: Adds additional labels for the ActiveGate pods + type: object + nodeSelector: + additionalProperties: + type: string + description: Node selector to control the selection of nodes + type: object + priorityClassName: + description: |- + If specified, indicates the pod's priority. Name must be defined by creating a PriorityClass object with that + name. If not specified the setting will be removed from the StatefulSet. + type: string + replicas: + description: Amount of replicas for your ActiveGates + format: int32 + type: integer + resources: + description: Define resources requests and limits for single ActiveGate + pods + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + tlsSecretName: + description: |- + The name of a secret containing ActiveGate TLS cert+key and password. If not set, self-signed certificate is used. + server.p12: certificate+key pair in pkcs12 format + password: passphrase to read server.p12 + type: string + tolerations: + description: Set tolerations for the ActiveGate pods + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: Adds TopologySpreadConstraints for the ActiveGate + pods + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + format: int32 + type: integer + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + format: int32 + type: integer + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + type: object + apiUrl: + description: |- + Dynatrace apiUrl, including the /api path at the end. For SaaS, set YOUR_ENVIRONMENT_ID to your environment ID. For Managed, change the apiUrl address. + For instructions on how to determine the environment ID and how to configure the apiUrl address, see Environment ID (https://www.dynatrace.com/support/help/get-started/monitoring-environment/environment-id). + type: string + customPullSecret: + description: |- + Defines a custom pull secret in case you use a private registry when pulling images from the Dynatrace environment. + To define a custom pull secret and learn about the expected behavior, see Configure customPullSecret + (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/kubernetes/get-started-with-kubernetes-monitoring/dto-config-options-k8s#custompullsecret). + type: string + enableIstio: + description: |- + When enabled, and if Istio is installed on the Kubernetes environment, Dynatrace Operator will create the corresponding + VirtualService and ServiceEntry objects to allow access to the Dynatrace Cluster from the OneAgent or ActiveGate. + Disabled by default. + type: boolean + kubernetesMonitoring: + description: Configuration for Kubernetes Monitoring + properties: + customProperties: + description: |- + Add a custom properties file by providing it as a value or reference it from a secret + If referenced from a secret, make sure the key is called 'customProperties' + properties: + value: + description: Custom properties value. + nullable: true + type: string + valueFrom: + description: Custom properties secret. + nullable: true + type: string + type: object + enabled: + description: Enables Capability + type: boolean + env: + description: List of environment variables to set for the ActiveGate + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + group: + description: Set activation group for ActiveGate + type: string + image: + description: The ActiveGate container image. Defaults to the latest + ActiveGate image provided by the registry on the tenant + type: string + labels: + additionalProperties: + type: string + description: Adds additional labels for the ActiveGate pods + type: object + nodeSelector: + additionalProperties: + type: string + description: Node selector to control the selection of nodes + type: object + replicas: + description: Amount of replicas for your ActiveGates + format: int32 + type: integer + resources: + description: Define resources requests and limits for single ActiveGate + pods + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + tolerations: + description: Set tolerations for the ActiveGate pods + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: Adds TopologySpreadConstraints for the ActiveGate + pods + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + format: int32 + type: integer + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + format: int32 + type: integer + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + type: object + namespaceSelector: + description: |- + Applicable only for applicationMonitoring or cloudNativeFullStack configuration types. The namespaces where you want Dynatrace Operator to inject. + For more information, see Configure monitoring for namespaces and pods (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/kubernetes/get-started-with-kubernetes-monitoring/dto-config-options-k8s#annotate). + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + networkZone: + description: Sets a network zone for the OneAgent and ActiveGate pods. + type: string + oneAgent: + description: |- + General configuration about OneAgent instances. + You can't enable more than one module (classicFullStack, cloudNativeFullStack, hostMonitoring, or applicationMonitoring). + properties: + applicationMonitoring: + description: |- + dynatrace-webhook injects into application pods based on labeled namespaces. + Has an optional CSI driver per node via DaemonSet to provide binaries to pods. + nullable: true + properties: + codeModulesImage: + description: The OneAgent image that is used to inject into + Pods. + type: string + initResources: + description: |- + Define resources requests and limits for the initContainer. For details, see Managing resources for containers + (https://kubernetes.io/docs/concepts/configuration/manage-resources-containers). + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + useCSIDriver: + description: Set if you want to use the CSIDriver. Don't enable + it if you do not have access to Kubernetes nodes or if you + lack privileges. + type: boolean + version: + description: The OneAgent version to be used. + type: string + type: object + classicFullStack: + description: |- + Has a single OneAgent per node via DaemonSet. + Injection is performed via the same OneAgent DaemonSet. + nullable: true + properties: + annotations: + additionalProperties: + type: string + description: Add custom OneAgent annotations. + type: object + args: + description: |- + Set additional arguments to the OneAgent installer. + For available options, see Linux custom installation (https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-oneagent/installation-and-operation/linux/installation/customize-oneagent-installation-on-linux). + For the list of limitations, see Limitations (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/docker/set-up-dynatrace-oneagent-as-docker-container#limitations). + items: + type: string + type: array + x-kubernetes-list-type: set + autoUpdate: + description: |- + Disables automatic restarts of OneAgent pods in case a new version is available (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/kubernetes/get-started-with-kubernetes-monitoring#disable-auto). + Enabled by default. + type: boolean + dnsPolicy: + description: Set the DNS Policy for OneAgent pods. For details, + see Pods DNS Policy (https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy). + type: string + env: + description: Set additional environment variables for the + OneAgent pods. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + image: + description: Use a custom OneAgent Docker image. Defaults + to the image from the Dynatrace cluster. + type: string + labels: + additionalProperties: + type: string + description: Your defined labels for OneAgent pods in order + to structure workloads as desired. + type: object + nodeSelector: + additionalProperties: + type: string + description: Specify the node selector that controls on which + nodes OneAgent will be deployed. + type: object + oneAgentResources: + description: |- + Resource settings for OneAgent container. Consumption of the OneAgent heavily depends on the workload to monitor. You can use the default settings in the CR. + Note: resource.requests shows the values needed to run; resource.limits shows the maximum limits for the pod. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + priorityClassName: + description: |- + Assign a priority class to the OneAgent pods. By default, no class is set. + For details, see Pod Priority and Preemption (https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/). + type: string + tolerations: + description: Tolerations to include with the OneAgent DaemonSet. + For details, see Taints and Tolerations (https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/). + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + version: + description: The OneAgent version to be used. + type: string + type: object + cloudNativeFullStack: + description: |- + Has a single OneAgent per node via DaemonSet. + dynatrace-webhook injects into application pods based on labeled namespaces. + Has a CSI driver per node via DaemonSet to provide binaries to pods. + nullable: true + properties: + annotations: + additionalProperties: + type: string + description: Add custom OneAgent annotations. + type: object + args: + description: |- + Set additional arguments to the OneAgent installer. + For available options, see Linux custom installation (https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-oneagent/installation-and-operation/linux/installation/customize-oneagent-installation-on-linux). + For the list of limitations, see Limitations (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/docker/set-up-dynatrace-oneagent-as-docker-container#limitations). + items: + type: string + type: array + x-kubernetes-list-type: set + autoUpdate: + description: |- + Disables automatic restarts of OneAgent pods in case a new version is available (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/kubernetes/get-started-with-kubernetes-monitoring#disable-auto). + Enabled by default. + type: boolean + codeModulesImage: + description: The OneAgent image that is used to inject into + Pods. + type: string + dnsPolicy: + description: Set the DNS Policy for OneAgent pods. For details, + see Pods DNS Policy (https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy). + type: string + env: + description: Set additional environment variables for the + OneAgent pods. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + image: + description: Use a custom OneAgent Docker image. Defaults + to the image from the Dynatrace cluster. + type: string + initResources: + description: |- + Define resources requests and limits for the initContainer. For details, see Managing resources for containers + (https://kubernetes.io/docs/concepts/configuration/manage-resources-containers). + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + labels: + additionalProperties: + type: string + description: Your defined labels for OneAgent pods in order + to structure workloads as desired. + type: object + nodeSelector: + additionalProperties: + type: string + description: Specify the node selector that controls on which + nodes OneAgent will be deployed. + type: object + oneAgentResources: + description: |- + Resource settings for OneAgent container. Consumption of the OneAgent heavily depends on the workload to monitor. You can use the default settings in the CR. + Note: resource.requests shows the values needed to run; resource.limits shows the maximum limits for the pod. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + priorityClassName: + description: |- + Assign a priority class to the OneAgent pods. By default, no class is set. + For details, see Pod Priority and Preemption (https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/). + type: string + tolerations: + description: Tolerations to include with the OneAgent DaemonSet. + For details, see Taints and Tolerations (https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/). + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + version: + description: The OneAgent version to be used. + type: string + type: object + hostGroup: + description: Sets a host group for OneAgent. + type: string + hostMonitoring: + description: |- + Has a single OneAgent per node via DaemonSet. + Doesn't inject into application pods. + nullable: true + properties: + annotations: + additionalProperties: + type: string + description: Add custom OneAgent annotations. + type: object + args: + description: |- + Set additional arguments to the OneAgent installer. + For available options, see Linux custom installation (https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-oneagent/installation-and-operation/linux/installation/customize-oneagent-installation-on-linux). + For the list of limitations, see Limitations (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/docker/set-up-dynatrace-oneagent-as-docker-container#limitations). + items: + type: string + type: array + x-kubernetes-list-type: set + autoUpdate: + description: |- + Disables automatic restarts of OneAgent pods in case a new version is available (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/kubernetes/get-started-with-kubernetes-monitoring#disable-auto). + Enabled by default. + type: boolean + dnsPolicy: + description: Set the DNS Policy for OneAgent pods. For details, + see Pods DNS Policy (https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy). + type: string + env: + description: Set additional environment variables for the + OneAgent pods. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + image: + description: Use a custom OneAgent Docker image. Defaults + to the image from the Dynatrace cluster. + type: string + labels: + additionalProperties: + type: string + description: Your defined labels for OneAgent pods in order + to structure workloads as desired. + type: object + nodeSelector: + additionalProperties: + type: string + description: Specify the node selector that controls on which + nodes OneAgent will be deployed. + type: object + oneAgentResources: + description: |- + Resource settings for OneAgent container. Consumption of the OneAgent heavily depends on the workload to monitor. You can use the default settings in the CR. + Note: resource.requests shows the values needed to run; resource.limits shows the maximum limits for the pod. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + priorityClassName: + description: |- + Assign a priority class to the OneAgent pods. By default, no class is set. + For details, see Pod Priority and Preemption (https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/). + type: string + tolerations: + description: Tolerations to include with the OneAgent DaemonSet. + For details, see Taints and Tolerations (https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/). + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + version: + description: The OneAgent version to be used. + type: string + type: object + type: object + proxy: + description: |- + Set custom proxy settings either directly or from a secret with the field proxy. + Note: Applies to Dynatrace Operator, ActiveGate, and OneAgents. + properties: + value: + description: Proxy URL. It has preference over ValueFrom. + nullable: true + type: string + valueFrom: + description: Secret containing proxy URL. + nullable: true + type: string + type: object + routing: + description: Configuration for Routing + properties: + customProperties: + description: |- + Add a custom properties file by providing it as a value or reference it from a secret + If referenced from a secret, make sure the key is called 'customProperties' + properties: + value: + description: Custom properties value. + nullable: true + type: string + valueFrom: + description: Custom properties secret. + nullable: true + type: string + type: object + enabled: + description: Enables Capability + type: boolean + env: + description: List of environment variables to set for the ActiveGate + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + group: + description: Set activation group for ActiveGate + type: string + image: + description: The ActiveGate container image. Defaults to the latest + ActiveGate image provided by the registry on the tenant + type: string + labels: + additionalProperties: + type: string + description: Adds additional labels for the ActiveGate pods + type: object + nodeSelector: + additionalProperties: + type: string + description: Node selector to control the selection of nodes + type: object + replicas: + description: Amount of replicas for your ActiveGates + format: int32 + type: integer + resources: + description: Define resources requests and limits for single ActiveGate + pods + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + tolerations: + description: Set tolerations for the ActiveGate pods + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: Adds TopologySpreadConstraints for the ActiveGate + pods + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + format: int32 + type: integer + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + format: int32 + type: integer + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + type: object + skipCertCheck: + description: |- + Disable certificate check for the connection between Dynatrace Operator and the Dynatrace Cluster. + Set to true if you want to skip certification validation checks. + type: boolean + tokens: + description: Name of the secret holding the tokens used for connecting + to Dynatrace. + type: string + trustedCAs: + description: |- + Adds custom RootCAs from a configmap. Put the certificate under certs within your configmap. + Note: Applies to Dynatrace Operator, OneAgent and ActiveGate. + type: string + required: + - apiUrl + type: object + status: + description: DynaKubeStatus defines the observed state of DynaKube + properties: + activeGate: + description: Observed state of ActiveGate + properties: + connectionInfoStatus: + description: Information about Active Gate's connections + properties: + endpoints: + description: Available connection endpoints + type: string + lastRequest: + description: Time of the last connection request + format: date-time + type: string + tenantUUID: + description: UUID of the tenant, received from the tenant + type: string + type: object + imageID: + description: Image ID + type: string + lastProbeTimestamp: + description: Indicates when the last check for a new version was + performed + format: date-time + type: string + serviceIPs: + description: The ClusterIPs set by Kubernetes on the ActiveGate + Service created by the Operator + items: + type: string + type: array + source: + description: Source of the image (tenant-registry, public-registry, + ...) + type: string + type: + description: Image type + type: string + version: + description: Image version + type: string + type: object + codeModules: + description: Observed state of Code Modules + properties: + imageID: + description: Image ID + type: string + lastProbeTimestamp: + description: Indicates when the last check for a new version was + performed + format: date-time + type: string + source: + description: Source of the image (tenant-registry, public-registry, + ...) + type: string + type: + description: Image type + type: string + version: + description: Image version + type: string + type: object + conditions: + description: Conditions includes status about the current state of + the instance + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + dynatraceApi: + description: Observed state of Dynatrace API + properties: + lastTokenScopeRequest: + description: Time of the last token request + format: date-time + type: string + type: object + kubeSystemUUID: + description: KubeSystemUUID contains the UUID of the current Kubernetes + cluster + type: string + lastTokenProbeTimestamp: + description: LastTokenProbeTimestamp tracks when the last request + for the API token validity was sent + format: date-time + type: string + oneAgent: + description: Observed state of OneAgent + properties: + connectionInfoStatus: + description: Information about OneAgent's connections + properties: + communicationHosts: + description: List of communication hosts + items: + properties: + host: + description: Host domain + type: string + port: + description: Connection port + format: int32 + type: integer + protocol: + description: Connection protocol + type: string + type: object + type: array + endpoints: + description: Available connection endpoints + type: string + lastRequest: + description: Time of the last connection request + format: date-time + type: string + tenantUUID: + description: UUID of the tenant, received from the tenant + type: string + type: object + healthcheck: + description: Commands used for OneAgent's readiness probe + type: object + x-kubernetes-preserve-unknown-fields: true + imageID: + description: Image ID + type: string + instances: + additionalProperties: + properties: + ipAddress: + description: IP address of the pod + type: string + podName: + description: Name of the OneAgent pod + type: string + type: object + description: List of deployed OneAgent instances + type: object + lastInstanceStatusUpdate: + description: Time of the last instance status update + format: date-time + type: string + lastProbeTimestamp: + description: Indicates when the last check for a new version was + performed + format: date-time + type: string + source: + description: Source of the image (tenant-registry, public-registry, + ...) + type: string + type: + description: Image type + type: string + version: + description: Image version + type: string + type: object + phase: + description: Defines the current state (Running, Updating, Error, + ...) + type: string + updatedTimestamp: + description: UpdatedTimestamp indicates when the instance was last + updated + format: date-time + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.apiUrl + name: ApiUrl + type: string + - jsonPath: .status.phase + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta2 + schema: + openAPIV3Schema: + description: DynaKube is the Schema for the DynaKube API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: DynaKubeSpec defines the desired state of DynaKube + properties: + activeGate: + description: General configuration about ActiveGate instances. + properties: + annotations: + additionalProperties: + type: string + description: Adds additional annotations to the ActiveGate pods + type: object + capabilities: + description: "Defines the ActiveGate pod capabilities\nPossible + values:\n\t- `routing` enables OneAgent routing.\n\t- `kubernetes-monitoring` + enables Kubernetes API monitoring.\n\t- `metrics-ingest` opens + the metrics ingest endpoint on the DynaKube ActiveGate and redirects + all pods to it.\n\t- `dynatrace-api` enables calling the Dynatrace + API via ActiveGate." + items: + type: string + type: array + customProperties: + description: |- + Add a custom properties file by providing it as a value or reference it from a secret + If referenced from a secret, make sure the key is called `customProperties` + properties: + value: + description: Custom properties value. + nullable: true + type: string + valueFrom: + description: Custom properties secret. + nullable: true + type: string + type: object + dnsPolicy: + description: Sets DNS Policy for the ActiveGate pods + type: string + env: + description: List of environment variables to set for the ActiveGate + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + group: + description: Set activation group for ActiveGate + type: string + image: + description: Use a custom ActiveGate image. Defaults to the latest + ActiveGate image provided by the registry on the tenant + type: string + labels: + additionalProperties: + type: string + description: Your defined labels for ActiveGate pods in order + to structure workloads as desired. + type: object + nodeSelector: + additionalProperties: + type: string + description: Specify the node selector that controls on which + nodes ActiveGate will be deployed. + type: object + priorityClassName: + description: |- + Assign a priority class to the ActiveGate pods. By default, no class is set. + For details, see Pod Priority and Preemption. (https://dt-url.net/n8437bl) + type: string + replicas: + default: 1 + description: Amount of replicas for your ActiveGates + format: int32 + type: integer + resources: + description: |- + Resource settings for ActiveGate container. + Consumption of the ActiveGate heavily depends on the workload to monitor. Adjust values accordingly. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + tlsSecretName: + description: |- + The name of a secret containing ActiveGate TLS cert+key and password. If not set, self-signed certificate is used. + `server.p12`: certificate+key pair in pkcs12 format + `password`: passphrase to read server.p12 + type: string + tolerations: + description: Set tolerations for the ActiveGate pods + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: Adds TopologySpreadConstraints to the ActiveGate + pods + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + format: int32 + type: integer + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + format: int32 + type: integer + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + type: object + apiUrl: + description: |- + Dynatrace `apiUrl`, including the `/api` path at the end. + - For SaaS, set `YOUR_ENVIRONMENT_ID` to your environment ID. + - For Managed, change the `apiUrl` address. + For instructions on how to determine the environment ID and how to configure the apiUrl address, see Environment ID (https://www.dynatrace.com/support/help/get-started/monitoring-environment/environment-id). + type: string + customPullSecret: + description: |- + Defines a custom pull secret in case you use a private registry when pulling images from the Dynatrace environment. + To define a custom pull secret and learn about the expected behavior, see Configure customPullSecret + (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/kubernetes/get-started-with-kubernetes-monitoring/dto-config-options-k8s#custompullsecret). + type: string + dynatraceApiRequestThreshold: + default: 15 + description: Minimum minutes between Dynatrace API requests. + type: integer + enableIstio: + description: |- + When enabled, and if Istio is installed in the Kubernetes environment, Dynatrace Operator will create the corresponding VirtualService and ServiceEntry objects to allow access to the Dynatrace Cluster from the OneAgent or ActiveGate. + Disabled by default. + type: boolean + metadataEnrichment: + description: Configuration for Metadata Enrichment. + properties: + enabled: + default: false + description: Enables MetadataEnrichment, `false` by default. + type: boolean + namespaceSelector: + description: The namespaces where you want Dynatrace Operator + to inject enrichment. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + required: + - enabled + type: object + networkZone: + description: Sets a network zone for the OneAgent and ActiveGate pods. + type: string + oneAgent: + description: |- + General configuration about OneAgent instances. + You can't enable more than one module (classicFullStack, cloudNativeFullStack, hostMonitoring, or applicationMonitoring). + properties: + applicationMonitoring: + description: |- + dynatrace-webhook injects into application pods based on labeled namespaces. + Has an optional CSI driver per node via DaemonSet to provide binaries to pods. + nullable: true + properties: + codeModulesImage: + description: The OneAgent image that is used to inject into + Pods. + type: string + initResources: + description: |- + Define resources requests and limits for the initContainer. For details, see Managing resources for containers + (https://kubernetes.io/docs/concepts/configuration/manage-resources-containers). + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + namespaceSelector: + description: |- + Applicable only for applicationMonitoring or cloudNativeFullStack configuration types. The namespaces where you want Dynatrace Operator to inject. + For more information, see Configure monitoring for namespaces and pods (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/kubernetes/get-started-with-kubernetes-monitoring/dto-config-options-k8s#annotate). + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + useCSIDriver: + default: false + description: Set if you want to use the CSIDriver. Don't enable + it if you do not have access to Kubernetes nodes or if you + lack privileges. + type: boolean + version: + description: The OneAgent version to be used. + type: string + type: object + classicFullStack: + description: |- + Has a single OneAgent per node via DaemonSet. + Injection is performed via the same OneAgent DaemonSet. + nullable: true + properties: + annotations: + additionalProperties: + type: string + description: Add custom OneAgent annotations. + type: object + args: + description: |- + Set additional arguments to the OneAgent installer. + For available options, see Linux custom installation (https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-oneagent/installation-and-operation/linux/installation/customize-oneagent-installation-on-linux). + For the list of limitations, see Limitations (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/docker/set-up-dynatrace-oneagent-as-docker-container#limitations). + items: + type: string + type: array + x-kubernetes-list-type: set + autoUpdate: + default: true + description: |- + Disables automatic restarts of OneAgent pods in case a new version is available (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/kubernetes/get-started-with-kubernetes-monitoring#disable-auto). + Enabled by default. + type: boolean + dnsPolicy: + description: Set the DNS Policy for OneAgent pods. For details, + see Pods DNS Policy (https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy). + type: string + env: + description: Set additional environment variables for the + OneAgent pods. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + image: + description: Use a custom OneAgent Docker image. Defaults + to the image from the Dynatrace cluster. + type: string + labels: + additionalProperties: + type: string + description: Your defined labels for OneAgent pods in order + to structure workloads as desired. + type: object + nodeSelector: + additionalProperties: + type: string + description: Specify the node selector that controls on which + nodes OneAgent will be deployed. + type: object + oneAgentResources: + description: |- + Resource settings for OneAgent container. Consumption of the OneAgent heavily depends on the workload to monitor. You can use the default settings in the CR. + - `resource.requests` shows the values needed to run + - `resource.limits` shows the maximum limits for the pod + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + priorityClassName: + description: |- + Assign a priority class to the OneAgent pods. By default, no class is set. + For details, see Pod Priority and Preemption (https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/). + type: string + secCompProfile: + description: The SecComp Profile that will be configured in + order to run in secure computing mode. + type: string + tolerations: + description: Tolerations to include with the OneAgent DaemonSet. + For details, see Taints and Tolerations (https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/). + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + version: + description: The OneAgent version to be used for OneAgents + running in the dedicated pod. This setting doesn't affect + the OneAgent version used for application monitoring. + type: string + type: object + cloudNativeFullStack: + description: |- + Has a single OneAgent per node via DaemonSet. + dynatrace-webhook injects into application pods based on labeled namespaces. + Has a CSI driver per node via DaemonSet to provide binaries to pods. + nullable: true + properties: + annotations: + additionalProperties: + type: string + description: Add custom OneAgent annotations. + type: object + args: + description: |- + Set additional arguments to the OneAgent installer. + For available options, see Linux custom installation (https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-oneagent/installation-and-operation/linux/installation/customize-oneagent-installation-on-linux). + For the list of limitations, see Limitations (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/docker/set-up-dynatrace-oneagent-as-docker-container#limitations). + items: + type: string + type: array + x-kubernetes-list-type: set + autoUpdate: + default: true + description: |- + Disables automatic restarts of OneAgent pods in case a new version is available (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/kubernetes/get-started-with-kubernetes-monitoring#disable-auto). + Enabled by default. + type: boolean + codeModulesImage: + description: The OneAgent image that is used to inject into + Pods. + type: string + dnsPolicy: + description: Set the DNS Policy for OneAgent pods. For details, + see Pods DNS Policy (https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy). + type: string + env: + description: Set additional environment variables for the + OneAgent pods. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + image: + description: Use a custom OneAgent Docker image. Defaults + to the image from the Dynatrace cluster. + type: string + initResources: + description: |- + Define resources requests and limits for the initContainer. For details, see Managing resources for containers + (https://kubernetes.io/docs/concepts/configuration/manage-resources-containers). + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + labels: + additionalProperties: + type: string + description: Your defined labels for OneAgent pods in order + to structure workloads as desired. + type: object + namespaceSelector: + description: |- + Applicable only for applicationMonitoring or cloudNativeFullStack configuration types. The namespaces where you want Dynatrace Operator to inject. + For more information, see Configure monitoring for namespaces and pods (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/kubernetes/get-started-with-kubernetes-monitoring/dto-config-options-k8s#annotate). + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + nodeSelector: + additionalProperties: + type: string + description: Specify the node selector that controls on which + nodes OneAgent will be deployed. + type: object + oneAgentResources: + description: |- + Resource settings for OneAgent container. Consumption of the OneAgent heavily depends on the workload to monitor. You can use the default settings in the CR. + - `resource.requests` shows the values needed to run + - `resource.limits` shows the maximum limits for the pod + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + priorityClassName: + description: |- + Assign a priority class to the OneAgent pods. By default, no class is set. + For details, see Pod Priority and Preemption (https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/). + type: string + secCompProfile: + description: The SecComp Profile that will be configured in + order to run in secure computing mode. + type: string + tolerations: + description: Tolerations to include with the OneAgent DaemonSet. + For details, see Taints and Tolerations (https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/). + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + version: + description: The OneAgent version to be used for OneAgents + running in the dedicated pod. This setting doesn't affect + the OneAgent version used for application monitoring. + type: string + type: object + hostGroup: + description: |- + Specify the name of the group to which you want to assign the host. + This method is preferred over the now obsolete `--set-host-group` argument. + If both settings are used, this field takes precedence over the `--set-host-group` argument. + type: string + hostMonitoring: + description: |- + Has a single OneAgent per node via DaemonSet. + Doesn't inject into application pods. + nullable: true + properties: + annotations: + additionalProperties: + type: string + description: Add custom OneAgent annotations. + type: object + args: + description: |- + Set additional arguments to the OneAgent installer. + For available options, see Linux custom installation (https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-oneagent/installation-and-operation/linux/installation/customize-oneagent-installation-on-linux). + For the list of limitations, see Limitations (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/docker/set-up-dynatrace-oneagent-as-docker-container#limitations). + items: + type: string + type: array + x-kubernetes-list-type: set + autoUpdate: + default: true + description: |- + Disables automatic restarts of OneAgent pods in case a new version is available (https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/kubernetes/get-started-with-kubernetes-monitoring#disable-auto). + Enabled by default. + type: boolean + dnsPolicy: + description: Set the DNS Policy for OneAgent pods. For details, + see Pods DNS Policy (https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy). + type: string + env: + description: Set additional environment variables for the + OneAgent pods. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + image: + description: Use a custom OneAgent Docker image. Defaults + to the image from the Dynatrace cluster. + type: string + labels: + additionalProperties: + type: string + description: Your defined labels for OneAgent pods in order + to structure workloads as desired. + type: object + nodeSelector: + additionalProperties: + type: string + description: Specify the node selector that controls on which + nodes OneAgent will be deployed. + type: object + oneAgentResources: + description: |- + Resource settings for OneAgent container. Consumption of the OneAgent heavily depends on the workload to monitor. You can use the default settings in the CR. + - `resource.requests` shows the values needed to run + - `resource.limits` shows the maximum limits for the pod + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + priorityClassName: + description: |- + Assign a priority class to the OneAgent pods. By default, no class is set. + For details, see Pod Priority and Preemption (https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/). + type: string + secCompProfile: + description: The SecComp Profile that will be configured in + order to run in secure computing mode. + type: string + tolerations: + description: Tolerations to include with the OneAgent DaemonSet. + For details, see Taints and Tolerations (https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/). + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + version: + description: The OneAgent version to be used for OneAgents + running in the dedicated pod. This setting doesn't affect + the OneAgent version used for application monitoring. + type: string + type: object + type: object + proxy: + description: |- + Set custom proxy settings either directly or from a secret with the field `proxy`. + Applies to Dynatrace Operator, ActiveGate, and OneAgents. + properties: + value: + description: Proxy URL. It has preference over ValueFrom. + nullable: true + type: string + valueFrom: + description: Secret containing proxy URL. + nullable: true + type: string + type: object + skipCertCheck: + description: |- + Disable certificate check for the connection between Dynatrace Operator and the Dynatrace Cluster. + Set to `true` if you want to skip certification validation checks. + type: boolean + tokens: + description: Name of the secret holding the tokens used for connecting + to Dynatrace. + type: string + trustedCAs: + description: |- + Adds custom RootCAs from a configmap. + The key to the data must be `certs`. + This applies to both the Dynatrace Operator and the OneAgent. Doesn't apply to ActiveGate. + type: string + required: + - apiUrl + type: object + status: + description: DynaKubeStatus defines the observed state of DynaKube + properties: + activeGate: + description: Observed state of ActiveGate + properties: + connectionInfoStatus: + description: Information about Active Gate's connections + properties: + endpoints: + description: Available connection endpoints + type: string + lastRequest: + description: Time of the last connection request + format: date-time + type: string + tenantUUID: + description: UUID of the tenant, received from the tenant + type: string + type: object + imageID: + description: Image ID + type: string + lastProbeTimestamp: + description: Indicates when the last check for a new version was + performed + format: date-time + type: string + serviceIPs: + description: The ClusterIPs set by Kubernetes on the ActiveGate + Service created by the Operator + items: + type: string + type: array + source: + description: Source of the image (tenant-registry, public-registry, + ...) + type: string + type: + description: Image type + type: string + version: + description: Image version + type: string + type: object + codeModules: + description: Observed state of Code Modules + properties: + imageID: + description: Image ID + type: string + lastProbeTimestamp: + description: Indicates when the last check for a new version was + performed + format: date-time + type: string + source: + description: Source of the image (tenant-registry, public-registry, + ...) + type: string + type: + description: Image type + type: string + version: + description: Image version + type: string + type: object + conditions: + description: Conditions includes status about the current state of + the instance + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + dynatraceApi: + description: Observed state of Dynatrace API + properties: + lastTokenScopeRequest: + description: Time of the last token request + format: date-time + type: string + type: object + kubeSystemUUID: + description: KubeSystemUUID contains the UUID of the current Kubernetes + cluster + type: string + kubernetesClusterMEID: + description: KubernetesClusterMEID contains the ID of the monitored + entity that points to the Kubernetes cluster + type: string + kubernetesClusterName: + description: KubernetesClusterName contains the display name (also + know as label) of the monitored entity that points to the Kubernetes + cluster + type: string + metadataEnrichment: + description: Observed state of Metadata-Enrichment + properties: + rules: + items: + properties: + enabled: + type: boolean + source: + type: string + target: + type: string + type: + type: string + type: object + type: array + type: object + oneAgent: + description: Observed state of OneAgent + properties: + connectionInfoStatus: + description: Information about OneAgent's connections + properties: + communicationHosts: + description: List of communication hosts + items: + properties: + host: + description: Host domain + type: string + port: + description: Connection port + format: int32 + type: integer + protocol: + description: Connection protocol + type: string + type: object + type: array + endpoints: + description: Available connection endpoints + type: string + lastRequest: + description: Time of the last connection request + format: date-time + type: string + tenantUUID: + description: UUID of the tenant, received from the tenant + type: string + type: object + healthcheck: + description: Commands used for OneAgent's readiness probe + type: object + x-kubernetes-preserve-unknown-fields: true + imageID: + description: Image ID + type: string + instances: + additionalProperties: + properties: + ipAddress: + description: IP address of the pod + type: string + podName: + description: Name of the OneAgent pod + type: string + type: object + description: List of deployed OneAgent instances + type: object + lastInstanceStatusUpdate: + description: Time of the last instance status update + format: date-time + type: string + lastProbeTimestamp: + description: Indicates when the last check for a new version was + performed + format: date-time + type: string + source: + description: Source of the image (tenant-registry, public-registry, + ...) + type: string + type: + description: Image type + type: string + version: + description: Image version + type: string + type: object + phase: + description: Defines the current state (Running, Updating, Error, + ...) + type: string + updatedTimestamp: + description: UpdatedTimestamp indicates when the instance was last + updated + format: date-time + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.16.4 + name: edgeconnects.dynatrace.com +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: dynatrace-webhook + namespace: {{.Release.Namespace}} + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: dynatrace.com + names: + categories: + - dynatrace + kind: EdgeConnect + listKind: EdgeConnectList + plural: edgeconnects + shortNames: + - ec + - ecs + singular: edgeconnect + preserveUnknownFields: false + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.apiServer + name: ApiServer + type: string + - jsonPath: .status.phase + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: EdgeConnect is the Schema for the EdgeConnect API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: EdgeConnectSpec defines the desired state of EdgeConnect. + properties: + annotations: + additionalProperties: + type: string + description: Adds additional annotations to the EdgeConnect pods + type: object + apiServer: + description: Location of the Dynatrace API to connect to, including + your specific environment UUID + type: string + autoUpdate: + default: true + description: 'Enables automatic restarts of EdgeConnect pods in case + a new version is available (the default value is: true)' + type: boolean + caCertsRef: + description: Adds custom root certificate from a configmap. Put the + certificate under certs within your configmap. + type: string + customPullSecret: + description: Pull secret for your private registry + type: string + env: + description: Adds additional environment variables to the EdgeConnect + pods + items: + description: EnvVar represents an environment variable present in + a Container. + properties: + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. Cannot + be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified + API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + hostPatterns: + description: Host patterns to be set in the tenant, only considered + when provisioning is enabled. + items: + type: string + type: array + hostRestrictions: + description: Restrict outgoing HTTP requests to your internal resources + to specified hosts + example: internal.example.org,*.dev.example.org + type: string + imageRef: + description: Overrides the default image + properties: + repository: + description: Custom EdgeConnect image repository + example: docker.io/dynatrace/edgeconnect + type: string + tag: + description: Indicates version of the EdgeConnect image to use + type: string + type: object + kubernetesAutomation: + description: KubernetesAutomation enables Kubernetes Automation for + Workflows + properties: + enabled: + description: Enables Kubernetes Automation for Workflows + type: boolean + type: object + labels: + additionalProperties: + type: string + description: Adds additional labels to the EdgeConnect pods + type: object + nodeSelector: + additionalProperties: + type: string + description: Node selector to control the selection of nodes for the + EdgeConnect pods + type: object + oauth: + description: EdgeConnect uses the OAuth client to authenticate itself + with the Dynatrace platform. + properties: + clientSecret: + description: Name of the secret that holds oauth clientId/secret + type: string + endpoint: + description: Token endpoint URL of Dynatrace SSO + type: string + provisioner: + description: Determines if the operator will create the EdgeConnect + and light OAuth client on the cluster using the credentials + provided. Requires more scopes than default behavior. + type: boolean + resource: + description: URN identifying your account. You get the URN when + creating the OAuth client + type: string + required: + - clientSecret + - endpoint + - resource + type: object + proxy: + description: General configurations for proxy settings. + properties: + authRef: + description: |- + Secret name which contains the username and password used for authentication with the proxy, using the + "Basic" HTTP authentication scheme. + type: string + host: + description: Server address (hostname or IP address) of the proxy. + type: string + noProxy: + description: |- + NoProxy represents the NO_PROXY or no_proxy environment + variable. It specifies a string that contains comma-separated values + specifying hosts that should be excluded from proxying. + type: string + port: + description: Port of the proxy. + format: int32 + type: integer + type: object + replicas: + default: 1 + description: 'Amount of replicas for your EdgeConnect (the default + value is: 1)' + format: int32 + type: integer + resources: + description: Defines resources requests and limits for single pods + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + serviceAccountName: + default: dynatrace-edgeconnect + description: ServiceAccountName that allows EdgeConnect to access + the Kubernetes API + type: string + tolerations: + description: Sets tolerations for the EdgeConnect pods + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: Sets topology spread constraints for the EdgeConnect + pods + items: + description: TopologySpreadConstraint specifies how to spread matching + pods among the given topology. + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + format: int32 + type: integer + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + format: int32 + type: integer + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + required: + - apiServer + - oauth + type: object + status: + description: EdgeConnectStatus defines the observed state of EdgeConnect. + properties: + conditions: + description: Conditions includes status about the current state of + the instance + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + kubeSystemUID: + description: kube-system namespace uid + type: string + phase: + description: Defines the current state (Running, Updating, Error, + ...) + type: string + updatedTimestamp: + description: Indicates when the resource was last updated + format: date-time + type: string + version: + description: Version used for the Edgeconnect image + properties: + imageID: + description: Image ID + type: string + lastProbeTimestamp: + description: Indicates when the last check for a new version was + performed + format: date-time + type: string + source: + description: Source of the image (tenant-registry, public-registry, + ...) + type: string + type: + description: Image type + type: string + version: + description: Image version + type: string + type: object + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.apiServer + name: ApiServer + type: string + - jsonPath: .status.phase + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha2 + schema: + openAPIV3Schema: + description: EdgeConnect is the Schema for the EdgeConnect API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: EdgeConnectSpec defines the desired state of EdgeConnect. + properties: + annotations: + additionalProperties: + type: string + description: Adds additional annotations to the EdgeConnect pods + type: object + apiServer: + description: Location of the Dynatrace API to connect to, including + your specific environment UUID + type: string + autoUpdate: + default: true + description: 'Enables automatic restarts of EdgeConnect pods in case + a new version is available (the default value is: true)' + type: boolean + caCertsRef: + description: Adds custom root certificate from a configmap. Put the + certificate under certs within your configmap. + type: string + customPullSecret: + description: Pull secret for your private registry + type: string + env: + description: Adds additional environment variables to the EdgeConnect + pods + items: + description: EnvVar represents an environment variable present in + a Container. + properties: + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. Cannot + be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified + API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must + be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + hostPatterns: + description: Host patterns to be set in the tenant, only considered + when provisioning is enabled. + items: + type: string + type: array + hostRestrictions: + description: Restrict outgoing HTTP requests to your internal resources + to specified hosts + example: internal.example.org,*.dev.example.org + items: + type: string + type: array + imageRef: + description: Overrides the default image + properties: + repository: + description: Custom EdgeConnect image repository + example: docker.io/dynatrace/edgeconnect + type: string + tag: + description: Indicates version of the EdgeConnect image to use + type: string + type: object + kubernetesAutomation: + description: KubernetesAutomation enables Kubernetes Automation for + Workflows + properties: + enabled: + description: Enables Kubernetes Automation for Workflows + type: boolean + type: object + labels: + additionalProperties: + type: string + description: Adds additional labels to the EdgeConnect pods + type: object + nodeSelector: + additionalProperties: + type: string + description: Node selector to control the selection of nodes for the + EdgeConnect pods + type: object + oauth: + description: EdgeConnect uses the OAuth client to authenticate itself + with the Dynatrace platform. + properties: + clientSecret: + description: Name of the secret that holds oauth clientId/secret + type: string + endpoint: + description: Token endpoint URL of Dynatrace SSO + type: string + provisioner: + description: Determines if the operator will create the EdgeConnect + and light OAuth client on the cluster using the credentials + provided. Requires more scopes than default behavior. + type: boolean + resource: + description: URN identifying your account. You get the URN when + creating the OAuth client + type: string + required: + - clientSecret + - endpoint + - resource + type: object + proxy: + description: General configurations for proxy settings. + properties: + authRef: + description: |- + Secret name which contains the username and password used for authentication with the proxy, using the + "Basic" HTTP authentication scheme. + type: string + host: + description: Server address (hostname or IP address) of the proxy. + type: string + noProxy: + description: |- + NoProxy represents the NO_PROXY or no_proxy environment + variable. It specifies a string that contains comma-separated values + specifying hosts that should be excluded from proxying. + type: string + port: + description: Port of the proxy. + format: int32 + type: integer + type: object + replicas: + default: 1 + description: 'Amount of replicas for your EdgeConnect (the default + value is: 1)' + format: int32 + type: integer + resources: + description: Defines resources requests and limits for single pods + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + serviceAccountName: + default: dynatrace-edgeconnect + description: ServiceAccountName that allows EdgeConnect to access + the Kubernetes API + type: string + tolerations: + description: Sets tolerations for the EdgeConnect pods + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: Sets topology spread constraints for the EdgeConnect + pods + items: + description: TopologySpreadConstraint specifies how to spread matching + pods among the given topology. + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + format: int32 + type: integer + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + format: int32 + type: integer + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + required: + - apiServer + - oauth + type: object + status: + description: EdgeConnectStatus defines the observed state of EdgeConnect. + properties: + conditions: + description: Conditions includes status about the current state of + the instance + items: + description: Condition contains details for one aspect of the current + state of this API Resource. + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: type of condition in CamelCase or in foo.example.com/CamelCase. + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + kubeSystemUID: + description: kube-system namespace uid + type: string + phase: + description: Defines the current state (Running, Updating, Error, + ...) + type: string + updatedTimestamp: + description: Indicates when the resource was last updated + format: date-time + type: string + version: + description: Version used for the Edgeconnect image + properties: + imageID: + description: Image ID + type: string + lastProbeTimestamp: + description: Indicates when the last check for a new version was + performed + format: date-time + type: string + source: + description: Source of the image (tenant-registry, public-registry, + ...) + type: string + type: + description: Image type + type: string + version: + description: Image version + type: string + type: object + type: object + type: object + served: true + storage: true + subresources: + status: {} +{{- end -}} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/clusterrole-csi.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/clusterrole-csi.yaml new file mode 100644 index 000000000..213bd73b0 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/clusterrole-csi.yaml @@ -0,0 +1,47 @@ +{{ if eq (include "dynatrace-operator.needCSI" .) "true" }} +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: dynatrace-oneagent-csi-driver + labels: + {{- include "dynatrace-operator.csiLabels" . | nindent 4 }} +rules: + {{- if (eq (include "dynatrace-operator.platform" .) "openshift") }} + - apiGroups: + - security.openshift.io + resourceNames: + - privileged + resources: + - securitycontextconstraints + verbs: + - use + {{ end }} +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: dynatrace-oneagent-csi-driver + labels: + {{- include "dynatrace-operator.csiLabels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: dynatrace-oneagent-csi-driver + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: dynatrace-oneagent-csi-driver + apiGroup: rbac.authorization.k8s.io +{{- end -}} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/csidriver.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/csidriver.yaml new file mode 100644 index 000000000..dbef0127a --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/csidriver.yaml @@ -0,0 +1,29 @@ +{{ if eq (include "dynatrace-operator.needCSI" .) "true" }} +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: storage.k8s.io/v1 +kind: CSIDriver +metadata: + name: csi.oneagent.dynatrace.com + labels: + {{- if eq (include "dynatrace-operator.platform" .) "openshift" }} + security.openshift.io/csi-ephemeral-volume-profile: "restricted" + {{- end }} + {{- include "dynatrace-operator.csiLabels" . | nindent 4 }} +spec: + attachRequired: false + podInfoOnMount: true + volumeLifecycleModes: + - Ephemeral +{{- end -}} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/daemonset.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/daemonset.yaml new file mode 100644 index 000000000..c24305ed4 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/daemonset.yaml @@ -0,0 +1,280 @@ +{{ if eq (include "dynatrace-operator.needCSI" .) "true" }} +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: apps/v1 +kind: DaemonSet +metadata: + annotations: + {{- if .Values.csidriver.annotations }} + {{- toYaml .Values.csidriver.annotations | nindent 4 }} + {{- end }} + labels: + {{- include "dynatrace-operator.csiLabels" . | nindent 4 }} + {{- if .Values.csidriver.labels }} + {{- toYaml .Values.csidriver.labels | nindent 4 }} + {{- end}} + name: dynatrace-oneagent-csi-driver + namespace: {{ .Release.Namespace }} +spec: + revisionHistoryLimit: 10 + selector: + matchLabels: + {{- include "dynatrace-operator.csiSelectorLabels" . | nindent 6 }} + template: + metadata: + annotations: + dynatrace.com/inject: "false" + kubectl.kubernetes.io/default-container: provisioner + cluster-autoscaler.kubernetes.io/enable-ds-eviction: "false" + {{- if and (eq (default false .Values.apparmor) true) (ne (include "dynatrace-operator.platform" .) "openshift") }} + container.apparmor.security.beta.kubernetes.io/csi-init: runtime/default + container.apparmor.security.beta.kubernetes.io/server: runtime/default + container.apparmor.security.beta.kubernetes.io/provisioner: runtime/default + container.apparmor.security.beta.kubernetes.io/registrar: runtime/default + container.apparmor.security.beta.kubernetes.io/liveness-probe: runtime/default + {{- end}} + {{- if .Values.csidriver.annotations }} + {{- toYaml .Values.csidriver.annotations | nindent 8 }} + {{- end }} + labels: + {{- include "dynatrace-operator.csiLabels" . | nindent 8 }} + {{- include "dynatrace-operator.csiSelectorLabels" . | nindent 8 }} + {{- if .Values.csidriver.labels }} + {{- toYaml .Values.csidriver.labels | nindent 8 }} + {{- end }} + spec: + initContainers: + - name: csi-init + image: {{ include "dynatrace-operator.image" . }} + imagePullPolicy: Always + args: + - csi-init + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + resources: + {{- if .Values.csidriver.csiInit.resources }} + {{- toYaml .Values.csidriver.csiInit.resources | nindent 10 }} + {{- end }} + securityContext: + {{- toYaml .Values.csidriver.csiInit.securityContext| nindent 10 }} + volumeMounts: + - mountPath: /data + name: data-dir + containers: + # Used to receive/execute gRPC requests (NodePublishVolume/NodeUnpublishVolume) from kubelet to mount/unmount volumes for a pod + # - Needs access to the csi socket, needs to read/write to it, needs root permissions to do so. + # - Needs access to the filesystem of pods on the node, and mount stuff to it,needs to read/write to it, needs root permissions to do so + # - Needs access to a dedicated folder on the node to persist data, needs to read/write to it. + - name: server + image: {{ include "dynatrace-operator.image" . }} + imagePullPolicy: Always + args: + - csi-server + - --endpoint=unix://csi/csi.sock + - --node-id=$(KUBE_NODE_NAME) + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + - name: KUBE_NODE_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: spec.nodeName + livenessProbe: + failureThreshold: 3 + httpGet: + path: /healthz + port: healthz + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 1 + ports: + - containerPort: 9808 + name: healthz + - containerPort: 8080 + name: metrics + resources: + {{- if .Values.csidriver.server.resources }} + {{- toYaml .Values.csidriver.server.resources | nindent 10 }} + {{- end }} + securityContext: + {{- toYaml .Values.csidriver.server.securityContext | nindent 10 }} + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + volumeMounts: + - mountPath: /csi + name: plugin-dir + - mountPath: {{ include "dynatrace-operator.CSIMountPointDir" . }} + mountPropagation: Bidirectional + name: mountpoint-dir + - mountPath: /data + name: data-dir + mountPropagation: Bidirectional + - name: tmp-dir + mountPath: /tmp + - name: provisioner + image: {{ include "dynatrace-operator.image" . }} + imagePullPolicy: Always + args: + - csi-provisioner + - --health-probe-bind-address=:10090 + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + {{- if .Values.csidriver.maxUnmountedVolumeAge }} + - name: MAX_UNMOUNTED_VOLUME_AGE + value: "{{ .Values.csidriver.maxUnmountedVolumeAge}}" + {{- end }} + {{- include "dynatrace-operator.startupProbe" . | nindent 8 }} + livenessProbe: + failureThreshold: 3 + httpGet: + path: /livez + port: livez + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 1 + ports: + - name: livez + containerPort: 10090 + - name: metrics + containerPort: 8090 + resources: + {{- if .Values.csidriver.provisioner.resources }} + {{- toYaml .Values.csidriver.provisioner.resources | nindent 10 }} + {{- end }} + securityContext: + {{- toYaml .Values.csidriver.provisioner.securityContext | nindent 10 }} + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + volumeMounts: + - mountPath: /data + name: data-dir + mountPropagation: Bidirectional + - mountPath: /tmp + name: tmp-dir + + # Used to make a gRPC request (GetPluginInfo()) to the driver to get driver name and driver contain + # - Needs access to the csi socket, needs to read/write to it, needs root permissions to do so. + # Used for registering the driver with kubelet + # - Needs access to the registration socket, needs to read/write to it, needs root permissions to do so. + - name: registrar + image: {{ include "dynatrace-operator.image" . }} + imagePullPolicy: Always + env: + - name: DRIVER_REG_SOCK_PATH + value: {{ include "dynatrace-operator.CSISocketPath" . }} + args: + - --csi-address=/csi/csi.sock + - --kubelet-registration-path=$(DRIVER_REG_SOCK_PATH) + command: + - csi-node-driver-registrar + resources: + {{- if .Values.csidriver.registrar.resources }} + {{- toYaml .Values.csidriver.registrar.resources | nindent 10 }} + {{- end }} + securityContext: + {{- toYaml .Values.csidriver.registrar.securityContext | nindent 10 }} + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + volumeMounts: + - mountPath: /csi + name: plugin-dir + - mountPath: /registration + name: registration-dir + - mountPath: {{ include "dynatrace-operator.CSIPluginDir" . }} + name: lockfile-dir + # Used to make a gRPC request (Probe()) to the driver to check if its running + # - Needs access to the csi socket, needs to read/write to it, needs root permissions to do so. + - name: liveness-probe + image: {{ include "dynatrace-operator.image" . }} + imagePullPolicy: Always + args: + - --csi-address=/csi/csi.sock + - --health-port=9808 + command: + - livenessprobe + resources: + {{- if .Values.csidriver.livenessprobe.resources }} + {{- toYaml .Values.csidriver.livenessprobe.resources | nindent 10 }} + {{- end }} + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + securityContext: + {{- toYaml .Values.csidriver.livenessprobe.securityContext| nindent 10 }} + volumeMounts: + - mountPath: /csi + name: plugin-dir + dnsPolicy: ClusterFirst + restartPolicy: Always + schedulerName: default-scheduler + securityContext: {} + serviceAccountName: dynatrace-oneagent-csi-driver + terminationGracePeriodSeconds: 30 + priorityClassName: {{ include "dynatrace-operator.CSIPriorityClassName" . }} + volumes: + # This volume is where the registrar registers the plugin with kubelet + - name: registration-dir + hostPath: + path: {{ include "dynatrace-operator.CSIRegistrationDir" . }} + type: Directory + # This volume is where the socket for kubelet->driver communication is done + - name: plugin-dir + hostPath: + path: {{ include "dynatrace-operator.CSIPluginDir" . }} + type: DirectoryOrCreate + - name: data-dir + hostPath: + path: {{ include "dynatrace-operator.CSIDataDir" . }} + type: DirectoryOrCreate + # This volume is where the driver mounts volumes + - name: mountpoint-dir + hostPath: + path: {{ include "dynatrace-operator.CSIMountPointDir" . }} + type: DirectoryOrCreate + # Used by the registrar to create its lockfile + - name: lockfile-dir + emptyDir: {} + # A volume for the driver to write temporary files to + - name: tmp-dir + emptyDir: {} + {{- if .Values.customPullSecret }} + imagePullSecrets: + - name: {{ .Values.customPullSecret }} + {{- end }} + {{- if .Values.csidriver.nodeSelector }} + nodeSelector: {{- toYaml .Values.csidriver.nodeSelector | nindent 8 }} + {{- end }} + {{- include "dynatrace-operator.nodeAffinity" . | nindent 6 }} + tolerations: + {{- if .Values.csidriver.tolerations }} + {{- toYaml .Values.csidriver.tolerations | nindent 8 }} + {{- end }} + {{- include "dynatrace-operator.defaultTolerations" . | nindent 8 }} + - key: ToBeDeletedByClusterAutoscaler + operator: Exists + effect: NoSchedule + updateStrategy: + {{- toYaml .Values.csidriver.updateStrategy | nindent 4 }} +{{- end -}} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/priority-class.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/priority-class.yaml new file mode 100644 index 000000000..c668ac4d6 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/priority-class.yaml @@ -0,0 +1,23 @@ +{{ if (eq (include "dynatrace-operator.needPriorityClass" .) "true") }} + +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +kind: PriorityClass +apiVersion: scheduling.k8s.io/v1 +metadata: + name: dynatrace-high-priority +value: {{ default 1000000 (int (.Values.csidriver).priorityClassValue) }} +globalDefault: false +description: "This priority class is used for Dynatrace Components in order to make sure they are not evicted in favor of other pods" +{{- end -}} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/role-csi.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/role-csi.yaml new file mode 100644 index 000000000..654ab04e1 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/role-csi.yaml @@ -0,0 +1,70 @@ +{{ if eq (include "dynatrace-operator.needCSI" .) "true" }} +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: dynatrace-oneagent-csi-driver + namespace: {{ .Release.Namespace }} + labels: + {{- include "dynatrace-operator.csiLabels" . | nindent 4 }} +rules: + - apiGroups: + - dynatrace.com + resources: + - dynakubes + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: dynatrace-oneagent-csi-driver + namespace: {{ .Release.Namespace }} + labels: + {{- include "dynatrace-operator.csiLabels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: dynatrace-oneagent-csi-driver + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: dynatrace-oneagent-csi-driver + apiGroup: rbac.authorization.k8s.io +{{- end -}} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/serviceaccount-csi.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/serviceaccount-csi.yaml new file mode 100644 index 000000000..7485d2644 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/csi/serviceaccount-csi.yaml @@ -0,0 +1,22 @@ +{{ if eq (include "dynatrace-operator.needCSI" .) "true" }} +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: dynatrace-oneagent-csi-driver + namespace: {{ .Release.Namespace }} + labels: + {{- include "dynatrace-operator.csiLabels" . | nindent 4 }} +{{- end -}} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/edge-connect/serviceaccount-operator.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/edge-connect/serviceaccount-operator.yaml new file mode 100644 index 000000000..45f1d9ac6 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/edge-connect/serviceaccount-operator.yaml @@ -0,0 +1,20 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: dynatrace-edgeconnect + namespace: {{ .Release.Namespace }} + labels: + {{- include "dynatrace-operator.operatorLabels" . | nindent 4 }} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/kubernetes-monitoring/clusterrole-kubernetes-monitoring.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/kubernetes-monitoring/clusterrole-kubernetes-monitoring.yaml new file mode 100644 index 000000000..fab70e877 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/kubernetes-monitoring/clusterrole-kubernetes-monitoring.yaml @@ -0,0 +1,114 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: dynatrace-kubernetes-monitoring + labels: + {{- include "dynatrace-operator.activegateLabels" . | nindent 4 }} +rules: + - apiGroups: + - "" + resources: + - nodes + - pods + - namespaces + - replicationcontrollers + - events + - resourcequotas + - pods/proxy + - nodes/proxy + - nodes/metrics + - services + verbs: + - list + - watch + - get + - apiGroups: + - batch + resources: + - jobs + - cronjobs + verbs: + - list + - watch + - get + - apiGroups: + - apps + resources: + - deployments + - replicasets + - statefulsets + - daemonsets + verbs: + - list + - watch + - get + - apiGroups: + - apps.openshift.io + resources: + - deploymentconfigs + verbs: + - list + - watch + - get + - apiGroups: + - config.openshift.io + resources: + - clusterversions + verbs: + - list + - watch + - get + - apiGroups: + - dynatrace.com + resources: + - dynakubes + verbs: + - list + - watch + - get + - nonResourceURLs: + - /metrics + - /version + - /readyz + - /livez + verbs: + - get + {{- if (eq (include "dynatrace-operator.openshiftOrOlm" .) "true") }} + - apiGroups: + - security.openshift.io + resourceNames: + - privileged + - nonroot-v2 + resources: + - securitycontextconstraints + verbs: + - use + {{ end }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: dynatrace-kubernetes-monitoring + labels: + {{- include "dynatrace-operator.activegateLabels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: dynatrace-kubernetes-monitoring +subjects: + - kind: ServiceAccount + name: dynatrace-kubernetes-monitoring + namespace: {{ .Release.Namespace }} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/kubernetes-monitoring/serviceaccount-kubernetes-monitoring.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/kubernetes-monitoring/serviceaccount-kubernetes-monitoring.yaml new file mode 100644 index 000000000..bd1e9c443 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/kubernetes-monitoring/serviceaccount-kubernetes-monitoring.yaml @@ -0,0 +1,20 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: dynatrace-kubernetes-monitoring + namespace: {{ .Release.Namespace }} + labels: + {{- include "dynatrace-operator.activegateLabels" . | nindent 4 }} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/oneagent/clusterrole-oneagent.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/oneagent/clusterrole-oneagent.yaml new file mode 100644 index 000000000..3e0616725 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/oneagent/clusterrole-oneagent.yaml @@ -0,0 +1,45 @@ +{{- if (eq (include "dynatrace-operator.openshiftOrOlm" .) "true") }} +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: dynatrace-dynakube-oneagent + labels: + {{- include "dynatrace-operator.oneagentLabels" . | nindent 4 }} +rules: + - apiGroups: + - security.openshift.io + resourceNames: + - privileged + resources: + - securitycontextconstraints + verbs: + - use +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: dynatrace-dynakube-oneagent + labels: + {{- include "dynatrace-operator.oneagentLabels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: dynatrace-dynakube-oneagent + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: dynatrace-dynakube-oneagent +{{ end }} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/oneagent/serviceaccount-oneagent.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/oneagent/serviceaccount-oneagent.yaml new file mode 100644 index 000000000..18d3a9ae2 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/oneagent/serviceaccount-oneagent.yaml @@ -0,0 +1,21 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: dynatrace-dynakube-oneagent + namespace: {{ .Release.Namespace }} + labels: + {{- include "dynatrace-operator.oneagentLabels" . | nindent 4 }} +automountServiceAccountToken: false diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/clusterrole-operator.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/clusterrole-operator.yaml new file mode 100644 index 000000000..a9098dd3d --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/clusterrole-operator.yaml @@ -0,0 +1,109 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: dynatrace-operator + labels: + {{- include "dynatrace-operator.operatorLabels" . | nindent 4 }} +rules: + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch + - update + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - apiGroups: + - "" + resources: + - secrets + resourceNames: + - dynatrace-dynakube-config + - dynatrace-metadata-enrichment-endpoint + verbs: + - get + - update + - delete + - list + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + resourceNames: + - dynatrace-webhook + verbs: + - get + - update + - apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + resourceNames: + - dynatrace-webhook + verbs: + - get + - update + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + resourceNames: + - dynakubes.dynatrace.com + - edgeconnects.dynatrace.com + verbs: + - get + - update + {{- if (eq (include "dynatrace-operator.openshiftOrOlm" .) "true") }} + - apiGroups: + - security.openshift.io + resourceNames: + - privileged + - nonroot-v2 + resources: + - securitycontextconstraints + verbs: + - use + {{ end }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: dynatrace-operator + labels: + {{- include "dynatrace-operator.operatorLabels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: dynatrace-operator + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: dynatrace-operator + apiGroup: rbac.authorization.k8s.io diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/deployment-operator.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/deployment-operator.yaml new file mode 100644 index 000000000..10143d58e --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/deployment-operator.yaml @@ -0,0 +1,111 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: dynatrace-operator + namespace: {{ .Release.Namespace }} + annotations: + {{- if .Values.operator.annotations }} + {{- toYaml .Values.operator.annotations | nindent 4 }} + {{- end }} + labels: + dynatrace.com/install-source: {{ include "dynatrace-operator.installSource" . }} + {{- include "dynatrace-operator.operatorLabels" . | nindent 4 }} + {{- if .Values.operator.labels }} + {{- toYaml .Values.operator.labels | nindent 4 }} + {{- end }} +spec: + replicas: 1 + revisionHistoryLimit: 1 + selector: + matchLabels: + {{- include "dynatrace-operator.operatorSelectorLabels" . | nindent 6 }} + strategy: + type: RollingUpdate + template: + metadata: + annotations: + dynatrace.com/inject: "false" + {{- if (.Values.operator).apparmor}} + container.apparmor.security.beta.kubernetes.io/operator: runtime/default + {{- end }} + {{- if .Values.operator.annotations }} + {{- toYaml .Values.operator.annotations | nindent 8 }} + {{- end }} + labels: + {{- include "dynatrace-operator.operatorLabels" . | nindent 8 }} + {{- include "dynatrace-operator.operatorSelectorLabels" . | nindent 8 }} + {{- if .Values.operator.labels }} + {{- toYaml .Values.operator.labels | nindent 8 }} + {{- end }} + spec: + containers: + - name: operator + args: + - operator + # Replace this with the built image name + image: {{ include "dynatrace-operator.image" . }} + imagePullPolicy: Always + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + ports: + - containerPort: 10080 + name: livez + - containerPort: 8080 + name: metrics + resources: + requests: + {{- toYaml (.Values.operator).requests | nindent 14 }} + limits: + {{- toYaml (.Values.operator).limits | nindent 14 }} + volumeMounts: + - name: tmp-cert-dir + mountPath: /tmp/dynatrace-operator + livenessProbe: + httpGet: + path: /livez + port: livez + scheme: HTTP + initialDelaySeconds: 15 + periodSeconds: 10 + {{- include "dynatrace-operator.startupProbe" . | nindent 10 }} + securityContext: + {{- toYaml .Values.operator.securityContext | nindent 12 }} + {{- include "dynatrace-operator.nodeAffinity" . | nindent 6 }} + volumes: + - emptyDir: { } + name: tmp-cert-dir + serviceAccountName: dynatrace-operator + securityContext: + {{- toYaml .Values.operator.podSecurityContext | nindent 8 }} + {{- if .Values.customPullSecret }} + imagePullSecrets: + - name: {{ .Values.customPullSecret }} + {{- end }} + {{- if .Values.operator.nodeSelector }} + nodeSelector: {{- toYaml .Values.operator.nodeSelector | nindent 8 }} + {{- end }} + tolerations: + {{- if .Values.operator.tolerations }} + {{- toYaml .Values.operator.tolerations | nindent 8 }} + {{- end }} + {{- include "dynatrace-operator.defaultTolerations" . | nindent 8 }} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/role-operator.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/role-operator.yaml new file mode 100644 index 000000000..d966ec8c0 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/role-operator.yaml @@ -0,0 +1,170 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: dynatrace-operator + namespace: {{ .Release.Namespace }} + labels: + {{- include "dynatrace-operator.operatorLabels" . | nindent 4 }} +rules: + - apiGroups: + - dynatrace.com + resources: + - dynakubes + - edgeconnects + verbs: + - get + - list + - watch + - update + - create + - apiGroups: + - dynatrace.com + resources: + - dynakubes/finalizers + - dynakubes/status + - edgeconnects/finalizers + - edgeconnects/status + verbs: + - update + - apiGroups: + - apps + resources: + - statefulsets + verbs: + - get + - list + - watch + - create + - update + - delete + - apiGroups: + - apps + resources: + - daemonsets + verbs: + - get + - list + - watch + - create + - update + - delete + - apiGroups: + - apps + resources: + - replicasets + - deployments + verbs: + - get + - list + - watch + - create + - update + - delete + - apiGroups: + - apps + resources: + - deployments/finalizers + verbs: + - update + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - delete + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - create + - update + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - get + - list + - apiGroups: + - "" + resources: + - services + verbs: + - create + - update + - delete + - get + - list + - watch + - apiGroups: + - "" + resources: + - pods/log + verbs: + - get + - apiGroups: + - networking.istio.io + resources: + - serviceentries + - virtualservices + verbs: + - get + - list + - create + - update + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - update + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: dynatrace-operator + namespace: {{ .Release.Namespace }} + labels: + {{- include "dynatrace-operator.operatorLabels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: dynatrace-operator +roleRef: + kind: Role + name: dynatrace-operator + apiGroup: rbac.authorization.k8s.io diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/serviceaccount-operator.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/serviceaccount-operator.yaml new file mode 100644 index 000000000..0dfb23aed --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/operator/serviceaccount-operator.yaml @@ -0,0 +1,20 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: dynatrace-operator + namespace: {{ .Release.Namespace }} + labels: + {{- include "dynatrace-operator.operatorLabels" . | nindent 4 }} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/clusterrole-webhook.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/clusterrole-webhook.yaml new file mode 100644 index 000000000..953802aeb --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/clusterrole-webhook.yaml @@ -0,0 +1,102 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: dynatrace-webhook + labels: + {{- include "dynatrace-operator.webhookLabels" . | nindent 4 }} +rules: + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch + - update + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - apiGroups: + - "" + resources: + - secrets + resourceNames: + - dynatrace-dynakube-config + - dynatrace-metadata-enrichment-endpoint + verbs: + - get + - list + - watch + - update + # metadata-enrichment workload owner lookup + - apiGroups: + - "" + resources: + - replicationcontrollers + verbs: + - get + - apiGroups: + - apps + resources: + - replicasets + - statefulsets + - daemonsets + - deployments + verbs: + - get + - apiGroups: + - batch + resources: + - jobs + - cronjobs + verbs: + - get + - apiGroups: + - apps.openshift.io + resources: + - deploymentconfigs + verbs: + - get + {{- if (eq (include "dynatrace-operator.openshiftOrOlm" .) "true") }} + - apiGroups: + - security.openshift.io + resourceNames: + - privileged + - nonroot-v2 + resources: + - securitycontextconstraints + verbs: + - use + {{ end }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: dynatrace-webhook + labels: + {{- include "dynatrace-operator.webhookLabels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: dynatrace-webhook + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: dynatrace-webhook + apiGroup: rbac.authorization.k8s.io diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/deployment-webhook.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/deployment-webhook.yaml new file mode 100644 index 000000000..f63530e86 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/deployment-webhook.yaml @@ -0,0 +1,138 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: dynatrace-webhook + namespace: {{ .Release.Namespace }} + annotations: + {{- if .Values.webhook.annotations}} + {{- toYaml .Values.webhook.annotations | nindent 4 }} + {{- end }} + labels: + {{- include "dynatrace-operator.webhookLabels" . | nindent 4 }} + {{- if .Values.webhook.labels }} + {{- toYaml .Values.webhook.labels | nindent 4 }} + {{- end }} +spec: + replicas: {{ (default false (.Values.webhook).highAvailability) | ternary 2 1 }} + revisionHistoryLimit: 1 + selector: + matchLabels: + {{- include "dynatrace-operator.webhookSelectorLabels" . | nindent 6 }} + strategy: + type: RollingUpdate + template: + metadata: + annotations: + dynatrace.com/inject: "false" + kubectl.kubernetes.io/default-container: webhook + {{- if (.Values.webhook).apparmor}} + container.apparmor.security.beta.kubernetes.io/webhook: runtime/default + {{- end }} + {{- if .Values.webhook.annotations}} + {{- toYaml .Values.webhook.annotations | nindent 8 }} + {{- end }} + labels: + {{- include "dynatrace-operator.webhookLabels" . | nindent 8 }} + {{- include "dynatrace-operator.webhookSelectorLabels" . | nindent 8 }} + {{- if .Values.webhook.labels }} + {{- toYaml .Values.webhook.labels | nindent 8 }} + {{- end }} + spec: + {{- if (.Values.webhook).highAvailability }} + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: "topology.kubernetes.io/zone" + whenUnsatisfiable: ScheduleAnyway + labelSelector: + matchLabels: + {{- include "dynatrace-operator.webhookSelectorLabels" . | nindent 14 }} + - maxSkew: 1 + topologyKey: "kubernetes.io/hostname" + whenUnsatisfiable: DoNotSchedule + labelSelector: + matchLabels: + {{- include "dynatrace-operator.webhookSelectorLabels" . | nindent 14 }} + {{- end }} + volumes: + - emptyDir: {} + name: certs-dir + {{- include "dynatrace-operator.nodeAffinity" . | nindent 6 }} + containers: + - name: webhook + args: + - webhook-server + # OLM mounts the certificates here, so we reuse it for simplicity + - --certs-dir=/tmp/k8s-webhook-server/serving-certs/ + image: {{ include "dynatrace-operator.image" . }} + imagePullPolicy: Always + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + readinessProbe: + httpGet: + path: /readyz + port: livez + scheme: HTTP + initialDelaySeconds: 15 + periodSeconds: 10 + livenessProbe: + httpGet: + path: /livez + port: livez + scheme: HTTP + initialDelaySeconds: 15 + periodSeconds: 10 + ports: + - name: server-port + containerPort: 8443 + - name: livez + containerPort: 10080 + - name: metrics + containerPort: 8080 + resources: + requests: + {{- toYaml (.Values.webhook).requests | nindent 14 }} + limits: + {{- toYaml (.Values.webhook).limits | nindent 14 }} + volumeMounts: + - name: certs-dir + mountPath: /tmp/k8s-webhook-server/serving-certs/ + securityContext: + {{- toYaml .Values.webhook.securityContext | nindent 12 }} + serviceAccountName: dynatrace-webhook + {{- if (.Values.webhook).hostNetwork }} + hostNetwork: true + {{- end }} + securityContext: + {{- toYaml .Values.webhook.podSecurityContext | nindent 8 }} + {{- if .Values.customPullSecret }} + imagePullSecrets: + - name: {{ .Values.customPullSecret }} + {{- end }} + {{- if .Values.webhook.nodeSelector }} + nodeSelector: {{- toYaml .Values.webhook.nodeSelector | nindent 8 }} + {{- end }} + tolerations: + {{- if .Values.webhook.tolerations }} + {{- toYaml .Values.webhook.tolerations | nindent 8 }} + {{- end }} + {{- include "dynatrace-operator.defaultTolerations" . | nindent 8 }} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/mutatingwebhookconfiguration.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/mutatingwebhookconfiguration.yaml new file mode 100644 index 000000000..c7ec1baa5 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/mutatingwebhookconfiguration.yaml @@ -0,0 +1,58 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: dynatrace-webhook + labels: + {{- include "dynatrace-operator.webhookLabels" . | nindent 4 }} +webhooks: + - name: webhook.pod.dynatrace.com + reinvocationPolicy: IfNeeded + failurePolicy: {{.Values.webhook.mutatingWebhook.failurePolicy}} + timeoutSeconds: {{.Values.webhook.mutatingWebhook.timeoutSeconds}} + rules: + - apiGroups: [ "" ] + apiVersions: [ "v1" ] + operations: [ "CREATE" ] + resources: [ "pods" ] + scope: Namespaced + namespaceSelector: + matchExpressions: + - key: dynakube.internal.dynatrace.com/instance + operator: Exists + clientConfig: + service: + name: dynatrace-webhook + namespace: {{ .Release.Namespace }} + path: /inject + admissionReviewVersions: [ "v1beta1", "v1" ] + sideEffects: None + - name: webhook.ns.dynatrace.com + reinvocationPolicy: IfNeeded + failurePolicy: {{.Values.webhook.mutatingWebhook.failurePolicy}} + timeoutSeconds: {{.Values.webhook.mutatingWebhook.timeoutSeconds}} + rules: + - apiGroups: [ "" ] + apiVersions: [ "v1" ] + operations: [ "CREATE", "UPDATE"] + resources: [ "namespaces" ] + scope: Cluster + clientConfig: + service: + name: dynatrace-webhook + namespace: {{ .Release.Namespace }} + path: /label-ns + admissionReviewVersions: [ "v1beta1", "v1" ] + sideEffects: None diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/poddisruptionbudget-webhook.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/poddisruptionbudget-webhook.yaml new file mode 100644 index 000000000..cc188e449 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/poddisruptionbudget-webhook.yaml @@ -0,0 +1,11 @@ +# v1 version supported since k8s 1.21 +apiVersion: {{ .Capabilities.APIVersions.Has "policy/v1" | ternary "policy/v1" "policy/v1beta1" }} +kind: PodDisruptionBudget +metadata: + name: dynatrace-webhook + namespace: {{ .Release.Namespace }} +spec: + minAvailable: 1 + selector: + matchLabels: + app.kubernetes.io/component: webhook diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/role-webhook.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/role-webhook.yaml new file mode 100644 index 000000000..1251ae47c --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/role-webhook.yaml @@ -0,0 +1,70 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: dynatrace-webhook + namespace: {{ .Release.Namespace }} + labels: + {{- include "dynatrace-operator.webhookLabels" . | nindent 4 }} +rules: + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + - apiGroups: + - "" + resources: + - secrets + - pods + - configmaps + verbs: + - get + - list + - watch + - apiGroups: + - dynatrace.com + resources: + - dynakubes + verbs: + - get + - list + - watch + - apiGroups: + - apps + resources: + - daemonsets + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: dynatrace-webhook + namespace: {{ .Release.Namespace }} + labels: + {{- include "dynatrace-operator.webhookLabels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: dynatrace-webhook + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: dynatrace-webhook + apiGroup: rbac.authorization.k8s.io diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/service.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/service.yaml new file mode 100644 index 000000000..5e0c94c1b --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/service.yaml @@ -0,0 +1,27 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: v1 +kind: Service +metadata: + name: dynatrace-webhook + namespace: {{ .Release.Namespace }} + labels: + {{- include "dynatrace-operator.webhookLabels" . | nindent 4 }} +spec: + selector: + {{- include "dynatrace-operator.webhookLabels" . | nindent 4 }} + ports: + - port: 443 + protocol: TCP + targetPort: server-port diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/serviceaccount-webhook.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/serviceaccount-webhook.yaml new file mode 100644 index 000000000..d932bcca1 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/serviceaccount-webhook.yaml @@ -0,0 +1,21 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: dynatrace-webhook + namespace: {{ .Release.Namespace }} + labels: + {{- include "dynatrace-operator.webhookLabels" . | nindent 4 }} + diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/validatingwebhookconfiguration.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/validatingwebhookconfiguration.yaml new file mode 100644 index 000000000..f6c6cc868 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/Common/webhook/validatingwebhookconfiguration.yaml @@ -0,0 +1,104 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: dynatrace-webhook + labels: + {{- include "dynatrace-operator.webhookLabels" . | nindent 4 }} +webhooks: + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: dynatrace-webhook + namespace: {{ .Release.Namespace }} + path: /validate-dynatrace-com-v1beta1-dynakube + rules: + - operations: + - CREATE + - UPDATE + apiGroups: + - dynatrace.com + apiVersions: + - v1beta1 + resources: + - dynakubes + name: v1beta1.dynakube.webhook.dynatrace.com + timeoutSeconds: {{.Values.webhook.validatingWebhook.timeoutSeconds}} + sideEffects: None + matchPolicy: Exact + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: dynatrace-webhook + namespace: {{ .Release.Namespace }} + path: /validate-dynatrace-com-v1beta2-dynakube + rules: + - operations: + - CREATE + - UPDATE + apiGroups: + - dynatrace.com + apiVersions: + - v1beta2 + resources: + - dynakubes + name: v1beta2.dynakube.webhook.dynatrace.com + timeoutSeconds: {{.Values.webhook.validatingWebhook.timeoutSeconds}} + sideEffects: None + matchPolicy: Exact + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: dynatrace-webhook + namespace: {{ .Release.Namespace }} + path: /validate-dynatrace-com-v1alpha1-edgeconnect + rules: + - operations: + - CREATE + - UPDATE + apiGroups: + - dynatrace.com + apiVersions: + - v1alpha1 + resources: + - edgeconnects + name: v1alpha1.edgeconnect.webhook.dynatrace.com + timeoutSeconds: {{.Values.webhook.validatingWebhook.timeoutSeconds}} + sideEffects: None + matchPolicy: Exact + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: dynatrace-webhook + namespace: {{ .Release.Namespace }} + path: /validate-dynatrace-com-v1alpha2-edgeconnect + rules: + - operations: + - CREATE + - UPDATE + apiGroups: + - dynatrace.com + apiVersions: + - v1alpha2 + resources: + - edgeconnects + name: v1alpha2.edgeconnect.webhook.dynatrace.com + timeoutSeconds: {{.Values.webhook.validatingWebhook.timeoutSeconds}} + sideEffects: None + matchPolicy: Exact diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/NOTES.txt b/charts/dynatrace/dynatrace-operator/1.3.1/templates/NOTES.txt new file mode 100644 index 000000000..48d4f09fc --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/NOTES.txt @@ -0,0 +1,10 @@ +Thank you for installing {{ .Chart.Name }}. + +Your release is named {{ .Release.Name }}. + +To find more information about the Dynatrace Operator, try: +https://github.com/Dynatrace/dynatrace-operator + +To verify the current state of the deployments, try: + $ kubectl get pods -n {{ .Release.Namespace }} + $ kubectl logs -f deployment/dynatrace-operator -n {{ .Release.Namespace }} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/_csidriver.tpl b/charts/dynatrace/dynatrace-operator/1.3.1/templates/_csidriver.tpl new file mode 100644 index 000000000..08ee79fb5 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/_csidriver.tpl @@ -0,0 +1,74 @@ +// Copyright 2020 Dynatrace LLC + +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 + +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +{{/* +Check if we need the csi driver. +*/}} +{{- define "dynatrace-operator.needCSI" -}} + {{- if or (.Values.csidriver.enabled) -}} + {{- printf "true" -}} + {{- end -}} +{{- end -}} + +{{/* +CSI PriorityClassName +*/}} +{{- define "dynatrace-operator.CSIPriorityClassName" -}} + {{- default "dynatrace-high-priority" .Values.csidriver.existingPriorityClassName -}} +{{- end -}} + +{{/* +Check if we need the csi default priority class +*/}} +{{- define "dynatrace-operator.needPriorityClass" -}} + {{- if and (eq (include "dynatrace-operator.needCSI" .) "true") (not .Values.csidriver.existingPriorityClassName) -}} + {{- printf "true" -}} + {{- end -}} +{{- end -}} + +{{/* +CSI plugin-dir path +*/}} +{{- define "dynatrace-operator.CSIPluginDir" -}} + {{ printf "%s/plugins/csi.oneagent.dynatrace.com/" (trimSuffix "/" (default "/var/lib/kubelet" .Values.csidriver.kubeletPath)) }} +{{- end -}} + + +{{/* +CSI data-dir path +*/}} +{{- define "dynatrace-operator.CSIDataDir" -}} + {{ printf "%s/data" (trimSuffix "/" (include "dynatrace-operator.CSIPluginDir" .)) }} +{{- end -}} + +{{/* +CSI socket path +*/}} +{{- define "dynatrace-operator.CSISocketPath" -}} + {{ printf "%s/csi.sock" (trimSuffix "/" (include "dynatrace-operator.CSIPluginDir" .)) }} +{{- end -}} + +{{/* +CSI mountpoint-dir path +*/}} +{{- define "dynatrace-operator.CSIMountPointDir" -}} + {{ printf "%s/pods/" (trimSuffix "/" (default "/var/lib/kubelet" .Values.csidriver.kubeletPath)) }} +{{- end -}} + +{{/* +CSI registration-dir path +*/}} +{{- define "dynatrace-operator.CSIRegistrationDir" -}} + {{ printf "%s/plugins_registry/" (trimSuffix "/" (default "/var/lib/kubelet" .Values.csidriver.kubeletPath)) }} +{{- end -}} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/_helpers.tpl b/charts/dynatrace/dynatrace-operator/1.3.1/templates/_helpers.tpl new file mode 100644 index 000000000..1f17f8068 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/_helpers.tpl @@ -0,0 +1,53 @@ +// Copyright 2020 Dynatrace LLC + +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 + +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "dynatrace-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Check if default image or imageref is used +*/}} +{{- define "dynatrace-operator.image" -}} +{{- if .Values.image -}} + {{- printf "%s" .Values.image -}} +{{- else -}} + {{- if (.Values.imageRef).repository -}} + {{- .Values.imageRef.tag | default (printf "v%s" .Chart.AppVersion) | printf "%s:%s" .Values.imageRef.repository -}} + {{- else if eq (include "dynatrace-operator.platform" .) "openshift" -}} + {{- printf "%s:v%s" "registry.connect.redhat.com/dynatrace/dynatrace-operator" .Chart.AppVersion }} + {{- else if eq (include "dynatrace-operator.platform" .) "google-marketplace" -}} + {{- printf "%s:%s" "gcr.io/dynatrace-marketplace-prod/dynatrace-operator" .Chart.AppVersion }} + {{- else if eq (include "dynatrace-operator.platform" .) "azure-marketplace" -}} + {{- printf "%s/%s@%s" .Values.global.azure.images.operator.registry .Values.global.azure.images.operator.image .Values.global.azure.images.operator.digest }} + {{- else -}} + {{- printf "%s:v%s" "public.ecr.aws/dynatrace/dynatrace-operator" .Chart.AppVersion }} + {{- end -}} +{{- end -}} +{{- end -}} + +{{- define "dynatrace-operator.startupProbe" -}} +startupProbe: + exec: + command: + - /usr/local/bin/dynatrace-operator + - startup-probe + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 1 +{{- end -}} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/_labels.tpl b/charts/dynatrace/dynatrace-operator/1.3.1/templates/_labels.tpl new file mode 100644 index 000000000..e66473db0 --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/_labels.tpl @@ -0,0 +1,102 @@ +// Copyright 2020 Dynatrace LLC + +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 + +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +{{/* +Selector labels +*/}} +{{- define "dynatrace-operator.futureSelectorLabels" -}} +app.kubernetes.io/name: dynatrace-operator +{{- if not (.Values).manifests }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} +{{- end -}} + +{{/* +Common labels +*/}} +{{- define "dynatrace-operator.commonLabels" -}} +{{ include "dynatrace-operator.futureSelectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +{{- if not (.Values).manifests }} +helm.sh/chart: {{ include "dynatrace-operator.chart" . }} +{{- end -}} +{{- if eq (include "dynatrace-operator.platform" .) "azure-marketplace" }} +azure-extensions-usage-release-identifier: {{ .Release.Name | quote }} +{{- end -}} +{{- end -}} + +{{/* +Operator labels +*/}} +{{- define "dynatrace-operator.operatorLabels" -}} +{{ include "dynatrace-operator.commonLabels" . }} +app.kubernetes.io/component: operator +{{- end -}} + +{{/* +Operator selector labels +*/}} +{{- define "dynatrace-operator.operatorSelectorLabels" -}} +name: {{ .Release.Name }} +{{- end -}} + +{{/* +Webhook labels +*/}} +{{- define "dynatrace-operator.webhookLabels" -}} +{{ include "dynatrace-operator.commonLabels" . }} +app.kubernetes.io/component: webhook +{{- end -}} + +{{/* +Webhook selector labels +*/}} +{{- define "dynatrace-operator.webhookSelectorLabels" -}} +internal.dynatrace.com/component: webhook +internal.dynatrace.com/app: webhook +{{- end -}} + +{{/* +CSI labels +*/}} +{{- define "dynatrace-operator.csiLabels" -}} +{{ include "dynatrace-operator.commonLabels" . }} +app.kubernetes.io/component: csi-driver +{{- end -}} + +{{/* +CSI selector labels +*/}} +{{- define "dynatrace-operator.csiSelectorLabels" -}} +internal.oneagent.dynatrace.com/app: csi-driver +internal.oneagent.dynatrace.com/component: csi-driver +{{- end -}} + +{{/* +ActiveGate labels +*/}} +{{- define "dynatrace-operator.activegateLabels" -}} +{{ include "dynatrace-operator.commonLabels" . }} +app.kubernetes.io/component: activegate +{{- end -}} + +{{/* +OneAgent labels +*/}} +{{- define "dynatrace-operator.oneagentLabels" -}} +{{ include "dynatrace-operator.commonLabels" . }} +app.kubernetes.io/component: oneagent +{{- end -}} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/_platform.tpl b/charts/dynatrace/dynatrace-operator/1.3.1/templates/_platform.tpl new file mode 100644 index 000000000..2080d801e --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/_platform.tpl @@ -0,0 +1,84 @@ +// Copyright 2020 Dynatrace LLC + +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at + +// http://www.apache.org/licenses/LICENSE-2.0 + +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +{{/* +Auto-detect the platform (if not set), according to the available APIVersions +*/}} +{{- define "dynatrace-operator.platform" -}} + {{- if .Values.platform}} + {{- printf .Values.platform -}} + {{- else if .Capabilities.APIVersions.Has "security.openshift.io/v1" }} + {{- printf "openshift" -}} + {{- else }} + {{- printf "kubernetes" -}} + {{- end -}} +{{- end }} + +{{/* +Set install source how the Operator was installed +*/}} +{{- define "dynatrace-operator.installSource" -}} + {{- if .Values.olm }} + {{- printf "operatorhub" -}} + {{- else if .Values.manifests }} + {{- printf "manifest" -}} + {{- else if (and (.Values.platform) (not (has .Values.platform (list "kubernetes" "openshift")))) }} + {{- printf .Values.platform -}} + {{- else }} + {{- printf "helm" -}} + {{- end -}} +{{- end }} + +{{/* +Exclude Kubernetes manifest not running on OLM +*/}} +{{- define "dynatrace-operator.openshiftOrOlm" -}} +{{- if and (or (eq (include "dynatrace-operator.platform" .) "openshift") (.Values.olm)) -}} + {{ default "true" }} +{{- end -}} +{{- end -}} + +{{- define "dynatrace-operator.nodeAffinity" -}} +affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - amd64 + - arm64 + - ppc64le + - s390x + - key: kubernetes.io/os + operator: In + values: + - linux +{{- end -}} + +{{- define "dynatrace-operator.defaultTolerations" -}} +- key: kubernetes.io/arch + value: arm64 + effect: NoSchedule +- key: kubernetes.io/arch + value: amd64 + effect: NoSchedule +- key: kubernetes.io/arch + value: ppc64le + effect: NoSchedule +- key: kubernetes.io/arch + value: s390x + effect: NoSchedule +{{- end -}} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/templates/application.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/templates/application.yaml new file mode 100644 index 000000000..1dd17410d --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/templates/application.yaml @@ -0,0 +1,98 @@ +{{- if eq (include "dynatrace-operator.platform" .) "google-marketplace" }} +# Copyright 2020 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# http://www.apache.org/licenses/LICENSE-2.0 +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: app.k8s.io/v1beta1 +kind: Application +metadata: + name: {{ .Release.Name }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "dynatrace-operator.operatorLabels" . | nindent 4 }} + annotations: + kubernetes-engine.cloud.google.com/icon: data:image/png;base64,{{ .Files.Get "logo.png" | b64enc }} + marketplace.cloud.google.com/deploy-info: '{"partner_id": "dynatrace-marketplace-prod", "product_id": "dynatrace-operator", "partner_name": "Dynatrace LLC"}' +spec: + descriptor: + type: "Dynatrace Operator" + version: {{ .Chart.AppVersion }} + maintainers: + - name: Dynatrace LLC + url: https://www.dynatrace.com/ + keywords: + - "dynatrace" + - "operator" + - "activegate" + - "k8s" + - "monitoring" + - "apm" + description: | + # Dynatrace Operator + + The Dynatrace Operator supports rollout and lifecycle management of various Dynatrace components in Kubernetes and OpenShift. + + * OneAgent + * `classicFullStack` rolls out a OneAgent pod per node to monitor pods on it and the node itself + * `applicationMonitoring` is a webhook based injection mechanism for automatic app-only injection + * CSI Driver can be enabled to cache OneAgent downloads per node + * `hostMonitoring` is only monitoring the hosts (i.e. nodes) in the cluster without app-only injection + * `cloudNativeFullStack` is a combination of `applicationMonitoring` with CSI driver and `hostMonitoring` + * ActiveGate + * `routing` routes OneAgent traffic through the ActiveGate + * `kubernetes-monitoring` allows monitoring of the Kubernetes API + * `metrics-ingest` routes enriched metrics through ActiveGate + + For more information please have a look at [our DynaKube Custom Resource examples](config/samples) and + our [official help page](https://www.dynatrace.com/support/help/setup-and-configuration/setup-on-container-platforms/kubernetes/). + links: + - description: Dynatrace Website + url: https://www.dynatrace.com/ + - description: Operator Deploy Guide + url: ToDo + - description: Kubernetes Monitoring Info + url: https://www.dynatrace.com/technologies/kubernetes-monitoring + selector: + matchLabels: + app.kubernetes.io/name: dynatrace-operator + componentKinds: + - group: apps/v1 + kind: DaemonSet + - group: v1 + kind: Pod + - group: v1 + kind: ConfigMap + - group: apps/v1 + kind: Deployment + - group: v1 + kind: Secret + - group: batch/v1 + kind: Job + - group: v1 + kind: Service + - group: v1 + kind: ServiceAccount + - group: admissionregistration.k8s.io/v1 + kind: ValidatingWebhookConfiguration + - group: admissionregistration.k8s.io/v1 + kind: MutatingWebhookConfiguration + - group: apps/v1 + kind: StatefulSet + - group: storage.k8s.io/v1 + kind: CSIDriver + - group: rbac.authorization.k8s.io/v1 + kind: ClusterRole + - group: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + - group: rbac.authorization.k8s.io/v1 + kind: Role + - group: rbac.authorization.k8s.io/v1 + kind: RoleBinding +{{ end }} diff --git a/charts/dynatrace/dynatrace-operator/1.3.1/values.yaml b/charts/dynatrace/dynatrace-operator/1.3.1/values.yaml new file mode 100644 index 000000000..0c484e7ba --- /dev/null +++ b/charts/dynatrace/dynatrace-operator/1.3.1/values.yaml @@ -0,0 +1,196 @@ +# Copyright 2021 Dynatrace LLC + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# special handling for "openshift" and "gke-autopilot" (deprecated) +platform: "" + +#image qualifier; OBSOLETE -> use imageref instead! +# supply either image or imageref; if both supplied, imageref will be disregarded +image: "" +#image description using tags +#resulting image will be named :v +imageRef: + repository: "" #path to repo + tag: "" #defaults to chart version + +customPullSecret: "" +installCRD: true + +operator: + nodeSelector: {} + tolerations: [] + labels: {} + annotations: {} + apparmor: false + securityContext: + privileged: false + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 + runAsGroup: 1001 + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + podSecurityContext: + seccompProfile: + type: RuntimeDefault + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 100m + memory: 128Mi + +webhook: + hostNetwork: false + nodeSelector: {} + tolerations: [] + labels: {} + annotations: {} + apparmor: false + securityContext: + privileged: false + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 1001 + runAsGroup: 1001 + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + podSecurityContext: + seccompProfile: + type: RuntimeDefault + requests: + cpu: 300m + memory: 128Mi + limits: + cpu: 300m + memory: 128Mi + highAvailability: true + validatingWebhook: + timeoutSeconds: 10 + mutatingWebhook: + failurePolicy: Ignore + timeoutSeconds: 10 + +csidriver: + enabled: true + nodeSelector: {} + kubeletPath: "/var/lib/kubelet" + existingPriorityClassName: "" # if defined, use this priorityclass instead of creating a new one + priorityClassValue: "1000000" + maxUnmountedVolumeAge: "" # defined in days, must be a plain number + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/master + operator: Exists + - effect: NoSchedule + key: node-role.kubernetes.io/control-plane + operator: Exists + labels: {} + annotations: {} + updateStrategy: + rollingUpdate: + maxSurge: 0 + maxUnavailable: 1 + type: RollingUpdate + csiInit: + securityContext: + runAsUser: 0 + privileged: false + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: false + seLinuxOptions: + level: s0 + seccompProfile: + type: RuntimeDefault + resources: + requests: + cpu: 50m + memory: 100Mi + limits: + cpu: 50m + memory: 100Mi + server: + securityContext: + runAsUser: 0 + privileged: true # Needed for mountPropagation + allowPrivilegeEscalation: true # Needed for privileged + readOnlyRootFilesystem: true + runAsNonRoot: false + seLinuxOptions: + level: s0 + seccompProfile: + type: RuntimeDefault + resources: + requests: + cpu: 50m + memory: 100Mi + limits: + cpu: 50m + memory: 100Mi + provisioner: + securityContext: + runAsUser: 0 + privileged: true # Needed for mountPropagation + allowPrivilegeEscalation: true # Needed for privileged + readOnlyRootFilesystem: true + runAsNonRoot: false + seLinuxOptions: + level: s0 + seccompProfile: + type: RuntimeDefault + resources: + requests: + cpu: 300m + memory: 100Mi + registrar: + securityContext: + runAsUser: 0 + privileged: false + readOnlyRootFilesystem: true + runAsNonRoot: false + seccompProfile: + type: RuntimeDefault + resources: + requests: + cpu: 20m + memory: 30Mi + limits: + cpu: 20m + memory: 30Mi + livenessprobe: + securityContext: + runAsUser: 0 + privileged: false + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: false + seccompProfile: + type: RuntimeDefault + resources: + requests: + cpu: 20m + memory: 30Mi + limits: + cpu: 20m + memory: 30Mi + diff --git a/charts/paravela/chronicle/0.1.27/.helmignore b/charts/paravela/chronicle/0.1.27/.helmignore new file mode 100644 index 000000000..0e8a0eb36 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/paravela/chronicle/0.1.27/Chart.lock b/charts/paravela/chronicle/0.1.27/Chart.lock new file mode 100644 index 000000000..039d8e027 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/Chart.lock @@ -0,0 +1,9 @@ +dependencies: +- name: standard-defs + repository: https://btp-charts-stable.s3.amazonaws.com/charts/ + version: 0.1.3 +- name: sawtooth + repository: https://btp-charts-stable.s3.amazonaws.com/charts/ + version: 0.2.13 +digest: sha256:f8164930eb503fba87eb6c67a76b8eeeabb3d27be185a7f250bb68c6f6091111 +generated: "2024-10-07T17:04:51.159012+01:00" diff --git a/charts/paravela/chronicle/0.1.27/Chart.yaml b/charts/paravela/chronicle/0.1.27/Chart.yaml new file mode 100644 index 000000000..9db1b067b --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/Chart.yaml @@ -0,0 +1,25 @@ +annotations: + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Chronicle + catalog.cattle.io/release-name: chronicle +apiVersion: v2 +appVersion: 0.7.3 +dependencies: +- name: standard-defs + repository: https://btp-charts-stable.s3.amazonaws.com/charts/ + version: ~0.1.0 +- name: sawtooth + repository: https://btp-charts-stable.s3.amazonaws.com/charts/ + version: 0.2.13 +description: 'Chronicle is an open-source, blockchain-backed, domain-agnostic provenance + product. Chronicle makes it easy for users to record and query immutable provenance + information on a distributed ledger - about any asset, in any domain, and across + multiple parties. ' +home: https://docs.btp.works/chronicle +icon: file://assets/icons/chronicle.png +keywords: +- provenance +- blockchain +name: chronicle +type: application +version: 0.1.27 diff --git a/charts/paravela/chronicle/0.1.27/README.md b/charts/paravela/chronicle/0.1.27/README.md new file mode 100644 index 000000000..048e29825 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/README.md @@ -0,0 +1,76 @@ +# Chronicle + +| field | description | default | +|-|-|-| +| `imagePullSecrets.enabled`| if true use the list of named imagePullSecrets | false | +| `imagePullSecrets.value`| a list if named secret references of the form `- name: secretName`| [] | +| `image.repository` | the repository of the image | blockchaintp/chronicle | +| `image.tag`| the tag of the image to use | latest | +| `image.pullPolicy` | the image pull policy to use | IfNotPresent | +| `logLevel` | log level for chronicle | info | +| `webUi` | If true serve the graphql playground interface | false | +| `replicas` | number of Chronicle replicas to run | 1 | +| `affinity`| custom affinity rules for the chronicle pod | {} | +| `extraVolumes` | a list of additional volumes to add to chronicle | [] | +| `extraVolumeMounts` | a list of additional volume mounts to add to chronicle | [] | +| `port` | the port on which the chronicle service listens | 9982 | +| `serviceAccount.create` | true to create a service account | false | +| `serviceAccount.name` | name of the service account | nil (defaults to based on release name) | +| `ingress.apiVersion` | if necessary the apiVersion of the ingress may be overridden | "" | +| `ingress.enabled` | true to enable the ingress to the main service rest-api | false | +| `ingress.certManager` | true to enable the acme certmanager for this ingress | false | +| `ingress.hostname` | primary hostname for the ingress | false | +| `ingress.path` | path for the ingress's primary hostname | / | +| `ingress.pathType` | pathType for the ingress's primary hostname | nil | +| `ingress.annotations` | annotations for the ingress | {} | +| `ingress.tls` | true to enable tls on the ingress with a secrete at hostname-tls | false | +| `ingress.extraHosts` | list of extra hosts to add to the ingress | [] | +| `ingress.extraPaths` | list of extra paths to add to the primary host of the ingress | [] | +| `ingress.extraTls` | list of extra tls entries | [] | +| `ingress.hosts`| list of ingress host and path declarations for the chronicle ingress| [] | +| `sawtooth` | sawtooth options may be configured | see [Sawtooth](../sawtooth/README.md) | +| `tp.args` | a string of arguments to pass to the tp container| nil | +| `tp.image.pullPolicy` | the image pull policy | IfNotPresent | +| `tp.image.repository` | the image repository | blockchaintp/chronicle-tp | +| `tp.image.tag` | the image tag | BTP2.1.0 | +| `tp.extraVolumes` | extra volumes declarations for the chronicle-tp deployment | list | nil +| `tp.extraVolumeMounts` | extra volume mounts for chronicle-tp deployment | list | nil +| `tp.resources` | resources | map | nil | +| `tp.maxUnavailable` | maximum unavailable nodes during a rolling upgrade | +| `tp.minReadySeconds` | minimum time before node becomes available | +| `postgres.enabled` | if true create an internal postgres instance | boolean | true | +| `postgres.env` | postgres environment variables | map | N/A | +| `postgres.image.repository` | postgres image repository | string | "postgres" | +| `postgres.image.tag` | postgres image tag | string | "11" | +| `postgres.user` | user for the postgres database | string | "postgres" | +| `postgres.host` | host for the postgres database | string | "localhost" | +| `postgres.database` | database for the postgres database | string | "postgres" | +| `postgres.port` | port for the postgres database | int | 5432 | +| `postgres.password` | password for the postgres database | string | "postgres" | +| `postgres.existingPasswordSecret` | name of a secret containing the postgres password | string | nil | +| `postgres.existingPasswordSecret` | name of the key in a secret containing the postgres password | string | nil | +| `postgres.tls` | postgres TLS configuration | string | nil | +| `postgres.persistence` | postgres persistence settings | map | N/A | +| `postgres.persistence.enabled` | if true allocate a PVC for the postgres instance | boolean | false | +| `postgres.persistence.annotations` | any custom annotations to the postgres PVC's | map | {} | +| `postgres.persistence.accessModes` | postgres PVC access modes | list | [ "ReadWriteOnce" ] | +| `postgres.persistence.storageClass` | postgres PVC storageClass | string | nil | +| `postgres.persistence.size` | postgres PVC volume size | string | "40Gi" | +| `postgres.resources` | resources | map | nil | +| `resources` | resources | map | nil | +| `livenessProbe.enabled` | if true, enables the liveness probe | false | +| `livenessProbe.initialDelaySeconds` | delay before liveness probe is initiated | 30 | +| `livenessProbe.periodSeconds` | how often to perform the probe | 10 | +| `livenessProbe.timeoutSeconds` | when the probe times out | 1 | +| `livenessProbe.failureThreshold` | how many times to retry the probe before giving up | 3 | +| `livenessProbe.successThreshold` | how many times the probe must report success to be considered successful after having failed | 1 | +| `livenessProbe.namespaceName` | the namespace name for the liveness probe | "default" | +| `livenessProbe.namespaceUuid` | the namespace UUID for the liveness probe | "fd717fd6-70f1-44c1-81de-287d5e101089" | +| `startupProbe.enabled` | if true, enables the startup probe | false | +| `startupProbe.initialDelaySeconds` | delay before startup probe is initiated | 10 | +| `startupProbe.periodSeconds` | how often to perform the probe | 10 | +| `startupProbe.timeoutSeconds` | when the probe times out | 1 | +| `startupProbe.failureThreshold` | how many times to retry the probe before giving up | 3 | +| `startupProbe.successThreshold` | how many times the probe must report success to be considered successful after having failed | 1 | +| `startupProbe.namespaceName` | the namespace name for the startup probe | "default" | +| `startupProbe.namespaceUuid` | the namespace UUID for the startup probe | "fd717fd6-70f1-44c1-81de-287d5e101089" | diff --git a/charts/paravela/chronicle/0.1.27/app-readme.md b/charts/paravela/chronicle/0.1.27/app-readme.md new file mode 100644 index 000000000..eb862a2fa --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/app-readme.md @@ -0,0 +1,12 @@ +Chronicle records provenance information of any physical or digital asset on a distributed ledger. + +- Chronicle is available with Hyperledger Sawtooth as its default backing ledger. +- Chronicle is built on the established W3C PROV Ontology standard; it uses the lightweight JSON-LD linked data format, and the data query language GraphQL. +- Chronicle is easily adaptable to enable users to model, capture, and query provenance information pertinent to their industry, application and use case. + +You can find example domains and further instructions at https://examples.btp.works + +## *Important* + +*As Chronicle uses Sawtooth as its backing ledger, a minimum of 4 nodes is required for deployment.* +*This helm chart will deploy and configure a 4 node Sawtooth network on your target cluster, so less than 4 nodes will result in the deployment failing.* diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/.helmignore b/charts/paravela/chronicle/0.1.27/charts/sawtooth/.helmignore new file mode 100644 index 000000000..98229532e --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/.helmignore @@ -0,0 +1,25 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ + +tests/ diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/Chart.lock b/charts/paravela/chronicle/0.1.27/charts/sawtooth/Chart.lock new file mode 100644 index 000000000..e3ceb6776 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: standard-defs + repository: https://btp-charts-stable.s3.amazonaws.com/charts/ + version: 0.1.3 +digest: sha256:0bd30f96641f446698badcad08af454ec79134c427a9f3ab057560dca4f77313 +generated: "2024-09-20T10:53:00.267465+01:00" diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/Chart.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/Chart.yaml new file mode 100644 index 000000000..fd2477e8a --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +appVersion: 1.2.5p4 +dependencies: +- name: standard-defs + repository: https://btp-charts-stable.s3.amazonaws.com/charts/ + version: ~0.1.0 +description: BTP's Sawtooth distribution based on Hyperledger Sawtooth 1.2 +name: sawtooth +type: application +version: 0.2.13 diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/README.md b/charts/paravela/chronicle/0.1.27/charts/sawtooth/README.md new file mode 100644 index 000000000..124e1ea70 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/README.md @@ -0,0 +1,96 @@ +# Sawtoooth + +| field | description | default | +|-|-|-| +| `affinity.enabled` | false: no effect true: then validators will be deployed only to k8s nodes with the label `app={{ .sawtooth.networkName }}-validator` | false | +| `commonLabels` | +| `imagePullSecrets.enabled` | if true use the list of named imagePullSecrets | false | +| `imagePullSecrets.value` | a list if named secret references of the form ```- name: secretName```| [] | +| `ingress.apiVersion` | if necessary the apiVersion of the ingress may be overridden | "" | +| `ingress.enabled` | true to enable the ingress to the main service rest-api | false | +| `ingress.certManager` | true to enable the acme certmanager for this ingress | false | +| `ingress.hostname` | primary hostname for the ingress | false | +| `ingress.path` | path for the ingress's primary hostname | / | +| `ingress.pathType` | pathType for the ingress's primary hostname | nil | +| `ingress.annotations` | annotations for the ingress | {} | +| `ingress.tls` | true to enable tls on the ingress with a secrete at hostname-tls | false | +| `ingress.extraHosts` | list of extra hosts to add to the ingress | [] | +| `ingress.extraPaths` | list of extra paths to add to the primary host of the ingress | [] | +| `ingress.extraTls` | list of extra tls entries | [] | +| `pagerduty.enabled` | if true send pagerduty alerts | false | +| `pagerduty.token` | pagerduty user token | nil | +| `pagerduty.serviceid` | pagerduty serviceid | nil | +| `sawtooth.opentsdb.db` | name of the opentsdb database to be used | metrics | +| `sawtooth.opentsdb.url` | url of the opentsdb database to be used | nil | +| `sawtooth.opentsdb.enabled` | whether to enable the opentsdb metrics | false | +| `sawtooth.minReadySeconds` | the minimum time a pod must be Running before proceeding on a rolling update | 120 | +| `sawtooth.maxUnavailable` | maximum number of pods allowed down on a rollout or update | 1 | +| `sawtooth.containers.block_info.args` | extra args for block-info-tp | nil | +| `sawtooth.containers.identity_tp.args` | extra args for identity-tp | nil | +| `sawtooth.containers.rest_api.args` | extra args for rest-api | nil | +| `sawtooth.containers.settings_tp.args` | extra args for settings-tp | nil | +| `sawtooth.containers.validator.args` | extra args for validator | nil | +| `sawtooth.containers.validator.env` | list of environment name/value dicts | nil | +| `sawtooth.ports.sawnet` | port for the sawtooth validator network | 8800 | +| `sawtooth.ports.consensus` | port for the sawtooth consensus network | 5050 | +| `sawtooth.ports.sawcomp` | port for the sawtooth component network | 4004 | +| `sawtooth.ports.rest` | port for the sawtooth rest-api | 8008 | +| `sawtooth.livenessProbe.enabled` | whether to run the livenessProbe on the validator | false | +| `sawtooth.livenessProbe.initialDelaySeconds` | seconds to wait before running the liveness probe the first time | 300 | +| `sawtooth.livenessProbe.periodSeconds` | interval in seconds to re-run the liveness probe | 120 | +| `sawtooth.livenessProbe.active` | if false, the liveness probe will run and evaluate the the situation, but always return successfully | string | "false" +| `sawtooth.livenessProbe.exitSignals` | when restarting due to a livenessProbe failure, the validator pod has a "signal" system which will cause it to restart the named containers in this var | "block-info-tp" | +| `sawtooth.heartbeat.interval` | interval in seconds to issue a heartbeat | 300 | +| `sawtooth.permissioned` | Whether to run this chain as a permissioned chain or not | false | +| `sawtooth.namespace` | namespace to render these templates into (deprecated) | "prod" | +| `sawtooth.networkName` | name of this sawtooth network (deprecated) | "mynetwork" | +| `sawtooth.scheduler` | name of the sawtooth transaction scheduler to use | string | "serial" +| `sawtooth.consensus` | id of the the consensus algorithm to use< valid values: 100:DevMode, 200, PoET, 300 - Raft, 400, PBFT | int | 200 +| `sawtooth.genesis.enabled` | If true, and the cluster is starting for the first time, then a node will be selected to create and submit the genesis block | true | +| `sawtooth.genesis.seed` | The seed is an arbitrary string which identifies a given genesis If the data of a given set of nodes is to be wiped out, change this value. | "9a2de774-90b5-11e9-9df0-87e889b0f1c9" | +| `sawtooth.dynamicPeering` | Dynamic Peering should default to false, since it is a bit unreliable | false | +| `sawtooth.externalSeeds` | a list of maps defining validator endpoints external to this deployment | [] | +| `sawtooth.seth.enabled` | enabled sawtooth-seth | false | +| `sawtooth.xo.enabled` | enabled sawtooth-xo-tp | false | +| `sawtooth.smallbank.enabled` | enabled sawtooth-smallbank-tp | false | +| `sawtooth.hostPathBaseDir` | all sawtooth hostPath directories will be based here | string | /var/lib/btp +| `sawtooth.client_wait` | arbitrary delay to validator client startup, such as the rest-api | 90 | +| `sawtooth.customTPs` | a list of [custom tp definitions](#custom-tp-definitions) | nil | +| `sawtooth.affinity` | custom affinity rules for the sawtooth validator deamonset | nil | +| `images` | a map containing all of the image urls used by this template| N/A | + +## Images + +| field | default | +|- |- | +| `images.devmode_engine` | blockchaintp/sawtooth-devmode-engine-rust:BTP2.1.0 +| `images.pbft_engine` | blockchaintp/sawtooth-pbft-engine:BTP2.1.0 +| `images.poet_cli` | blockchaintp/sawtooth-poet-cli:BTP2.1.0 +| `images.poet_engine` | blockchaintp/sawtooth-poet-engine:BTP2.1.0 +| `images.poet_validator_registry_tp` | blockchaintp/sawtooth-poet-validator-registry-tp:BTP2.1.0 +| `images.raft_engine` | blockchaintp/sawtooth-raft-engine:BTP2.1.0 +| `images.block_info_tp` | blockchaintp/sawtooth-block-info-tp:BTP2.1.0 +| `images.identity_tp` | blockchaintp/sawtooth-identity-tp:BTP2.1.0 +| `images.intkey_tp` | blockchaintp/sawtooth-intkey-tp-go:BTP2.1.0 +| `images.settings_tp` | blockchaintp/sawtooth-settings-tp:BTP2.1.0 +| `images.shell` | blockchaintp/sawtooth-shell:BTP2.1.0 +| `images.smallbank_tp` | blockchaintp/sawtooth-smallbank-tp-go:BTP2.1.0 +| `images.validator` | blockchaintp/sawtooth-validator:BTP2.1.0 +| `images.xo_tp` | blockchaintp/sawtooth-xo-tp-go:BTP2.1.0 +| `images.rest_api` | blockchaintp/sawtooth-rest-api:BTP2.1.0 +| `images.seth_rpc` | blockchaintp/sawtooth-seth-rpc:BTP2.1.0 +| `images.seth_tp` | blockchaintp/sawtooth-seth-tp:BTP2.1.0 +| `images.xo_demo` | blockchaintp/xo-demo:BTP2.1.0 + +## Custom TP Definitions + +Custom TP definitions are describe using maps with the following fields + +| field | description | default | +|-|-|-| +| `name` | name of the custom tp container(must be unique within the pod) | nil | +| `image` | url of the image for this tp | nil | +| `command` | list of command tokens for this tp | list | nil +| `arg` | list of arguments to the command | nil] | +| `extraVolumes` | a list of additional volumes to add to all StatefulSets, Deployments, and DaemonSets | `[]` | +| `extraVolumeMounts` | a list of additional volume mounts to add to all StatefulSet, Deployment, and DaemonSet containers | `[]` | diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/Chart.lock b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/Chart.lock new file mode 100644 index 000000000..1527b8ebd --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: common + repository: https://raw.githubusercontent.com/bitnami/charts/pre-2022/bitnami + version: 1.8.0 +digest: sha256:bdd898d81e711e825f3bfc9e0b0e0668382ff1ff02d74874b6b6997ae0bbc9ce +generated: "2022-06-17T20:57:49.357553367Z" diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/Chart.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/Chart.yaml new file mode 100644 index 000000000..459af8bc2 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +appVersion: 0.1.0 +dependencies: +- name: common + repository: https://raw.githubusercontent.com/bitnami/charts/pre-2022/bitnami + version: ~1.8.0 +description: BTP Standard Template definitions and dependencies +name: standard-defs +type: library +version: 0.1.3 diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/README.md b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/README.md new file mode 100644 index 000000000..e69de29bb diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/.helmignore b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/.helmignore new file mode 100644 index 000000000..50af03172 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/.helmignore @@ -0,0 +1,22 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/Chart.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/Chart.yaml new file mode 100644 index 000000000..344c40384 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/Chart.yaml @@ -0,0 +1,23 @@ +annotations: + category: Infrastructure +apiVersion: v2 +appVersion: 1.8.0 +description: A Library Helm Chart for grouping common logic between bitnami charts. + This chart is not deployable by itself. +home: https://github.com/bitnami/charts/tree/master/bitnami/common +icon: https://bitnami.com/downloads/logos/bitnami-mark.png +keywords: +- common +- helper +- template +- function +- bitnami +maintainers: +- email: containers@bitnami.com + name: Bitnami +name: common +sources: +- https://github.com/bitnami/charts +- http://www.bitnami.com/ +type: library +version: 1.8.0 diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/README.md b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/README.md new file mode 100644 index 000000000..054e51f96 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/README.md @@ -0,0 +1,327 @@ +# Bitnami Common Library Chart + +A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for grouping common logic between bitnami charts. + +## TL;DR + +```yaml +dependencies: + - name: common + version: 0.x.x + repository: https://charts.bitnami.com/bitnami +``` + +```bash +$ helm dependency update +``` + +```yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "common.names.fullname" . }} +data: + myvalue: "Hello World" +``` + +## Introduction + +This chart provides a common template helpers which can be used to develop new charts using [Helm](https://helm.sh) package manager. + +Bitnami charts can be used with [Kubeapps](https://kubeapps.com/) for deployment and management of Helm Charts in clusters. This Helm chart has been tested on top of [Bitnami Kubernetes Production Runtime](https://kubeprod.io/) (BKPR). Deploy BKPR to get automated TLS certificates, logging and monitoring for your applications. + +## Prerequisites + +- Kubernetes 1.12+ +- Helm 3.1.0 + +## Parameters + +The following table lists the helpers available in the library which are scoped in different sections. + +### Affinities + +| Helper identifier | Description | Expected Input | +|-------------------------------|------------------------------------------------------|------------------------------------------------| +| `common.affinities.node.soft` | Return a soft nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | +| `common.affinities.node.hard` | Return a hard nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | +| `common.affinities.pod.soft` | Return a soft podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | +| `common.affinities.pod.hard` | Return a hard podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | + +### Capabilities + +| Helper identifier | Description | Expected Input | +|----------------------------------------------|------------------------------------------------------------------------------------------------|-------------------| +| `common.capabilities.kubeVersion` | Return the target Kubernetes version (using client default if .Values.kubeVersion is not set). | `.` Chart context | +| `common.capabilities.cronjob.apiVersion` | Return the appropriate apiVersion for cronjob. | `.` Chart context | +| `common.capabilities.deployment.apiVersion` | Return the appropriate apiVersion for deployment. | `.` Chart context | +| `common.capabilities.statefulset.apiVersion` | Return the appropriate apiVersion for statefulset. | `.` Chart context | +| `common.capabilities.ingress.apiVersion` | Return the appropriate apiVersion for ingress. | `.` Chart context | +| `common.capabilities.rbac.apiVersion` | Return the appropriate apiVersion for RBAC resources. | `.` Chart context | +| `common.capabilities.crd.apiVersion` | Return the appropriate apiVersion for CRDs. | `.` Chart context | +| `common.capabilities.policy.apiVersion` | Return the appropriate apiVersion for policy | `.` Chart context | +| `common.capabilities.supportsHelmVersion` | Returns true if the used Helm version is 3.3+ | `.` Chart context | + +### Errors + +| Helper identifier | Description | Expected Input | +|-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------| +| `common.errors.upgrade.passwords.empty` | It will ensure required passwords are given when we are upgrading a chart. If `validationErrors` is not empty it will throw an error and will stop the upgrade action. | `dict "validationErrors" (list $validationError00 $validationError01) "context" $` | + +### Images + +| Helper identifier | Description | Expected Input | +|-----------------------------|------------------------------------------------------|---------------------------------------------------------------------------------------------------------| +| `common.images.image` | Return the proper and full image name | `dict "imageRoot" .Values.path.to.the.image "global" $`, see [ImageRoot](#imageroot) for the structure. | +| `common.images.pullSecrets` | Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global` | +| `common.images.renderPullSecrets` | Return the proper Docker Image Registry Secret Names (evaluates values as templates) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $` | + +### Ingress + +| Helper identifier | Description | Expected Input | +|-------------------------------------------|----------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.ingress.backend` | Generate a proper Ingress backend entry depending on the API version | `dict "serviceName" "foo" "servicePort" "bar"`, see the [Ingress deprecation notice](https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/) for the syntax differences | +| `common.ingress.supportsPathType` | Prints "true" if the pathType field is supported | `.` Chart context | +| `common.ingress.supportsIngressClassname` | Prints "true" if the ingressClassname field is supported | `.` Chart context | + +### Labels + +| Helper identifier | Description | Expected Input | +|-----------------------------|------------------------------------------------------|-------------------| +| `common.labels.standard` | Return Kubernetes standard labels | `.` Chart context | +| `common.labels.matchLabels` | Return the proper Docker Image Registry Secret Names | `.` Chart context | + +### Names + +| Helper identifier | Description | Expected Inpput | +|-------------------------|------------------------------------------------------------|-------------------| +| `common.names.name` | Expand the name of the chart or use `.Values.nameOverride` | `.` Chart context | +| `common.names.fullname` | Create a default fully qualified app name. | `.` Chart context | +| `common.names.chart` | Chart name plus version | `.` Chart context | + +### Secrets + +| Helper identifier | Description | Expected Input | +|---------------------------|--------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.secrets.name` | Generate the name of the secret. | `dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $` see [ExistingSecret](#existingsecret) for the structure. | +| `common.secrets.key` | Generate secret key. | `dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName"` see [ExistingSecret](#existingsecret) for the structure. | +| `common.passwords.manage` | Generate secret password or retrieve one if already created. | `dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $`, length, strong and chartNAme fields are optional. | +| `common.secrets.exists` | Returns whether a previous generated secret already exists. | `dict "secret" "secret-name" "context" $` | + +### Storage + +| Helper identifier | Description | Expected Input | +|-------------------------------|---------------------------------------|---------------------------------------------------------------------------------------------------------------------| +| `common.affinities.node.soft` | Return a soft nodeAffinity definition | `dict "persistence" .Values.path.to.the.persistence "global" $`, see [Persistence](#persistence) for the structure. | + +### TplValues + +| Helper identifier | Description | Expected Input | +|---------------------------|----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.tplvalues.render` | Renders a value that contains template | `dict "value" .Values.path.to.the.Value "context" $`, value is the value should rendered as template, context frequently is the chart context `$` or `.` | + +### Utils + +| Helper identifier | Description | Expected Input | +|--------------------------------|------------------------------------------------------------------------------------------|------------------------------------------------------------------------| +| `common.utils.fieldToEnvVar` | Build environment variable name given a field. | `dict "field" "my-password"` | +| `common.utils.secret.getvalue` | Print instructions to get a secret value. | `dict "secret" "secret-name" "field" "secret-value-field" "context" $` | +| `common.utils.getValueFromKey` | Gets a value from `.Values` object given its key path | `dict "key" "path.to.key" "context" $` | +| `common.utils.getKeyFromList` | Returns first `.Values` key with a defined value or first of the list if all non-defined | `dict "keys" (list "path.to.key1" "path.to.key2") "context" $` | + +### Validations + +| Helper identifier | Description | Expected Input | +|--------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.validations.values.single.empty` | Validate a value must not be empty. | `dict "valueKey" "path.to.value" "secret" "secret.name" "field" "my-password" "subchart" "subchart" "context" $` secret, field and subchart are optional. In case they are given, the helper will generate a how to get instruction. See [ValidateValue](#validatevalue) | +| `common.validations.values.multiple.empty` | Validate a multiple values must not be empty. It returns a shared error for all the values. | `dict "required" (list $validateValueConf00 $validateValueConf01) "context" $`. See [ValidateValue](#validatevalue) | +| `common.validations.values.mariadb.passwords` | This helper will ensure required password for MariaDB are not empty. It returns a shared error for all the values. | `dict "secret" "mariadb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mariadb chart and the helper. | +| `common.validations.values.postgresql.passwords` | This helper will ensure required password for PostgreSQL are not empty. It returns a shared error for all the values. | `dict "secret" "postgresql-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use postgresql chart and the helper. | +| `common.validations.values.redis.passwords` | This helper will ensure required password for Redis™ are not empty. It returns a shared error for all the values. | `dict "secret" "redis-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use redis chart and the helper. | +| `common.validations.values.cassandra.passwords` | This helper will ensure required password for Cassandra are not empty. It returns a shared error for all the values. | `dict "secret" "cassandra-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use cassandra chart and the helper. | +| `common.validations.values.mongodb.passwords` | This helper will ensure required password for MongoDB® are not empty. It returns a shared error for all the values. | `dict "secret" "mongodb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mongodb chart and the helper. | + +### Warnings + +| Helper identifier | Description | Expected Input | +|------------------------------|----------------------------------|------------------------------------------------------------| +| `common.warnings.rollingTag` | Warning about using rolling tag. | `ImageRoot` see [ImageRoot](#imageroot) for the structure. | + +## Special input schemas + +### ImageRoot + +```yaml +registry: + type: string + description: Docker registry where the image is located + example: docker.io + +repository: + type: string + description: Repository and image name + example: bitnami/nginx + +tag: + type: string + description: image tag + example: 1.16.1-debian-10-r63 + +pullPolicy: + type: string + description: Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + +pullSecrets: + type: array + items: + type: string + description: Optionally specify an array of imagePullSecrets (evaluated as templates). + +debug: + type: boolean + description: Set to true if you would like to see extra information on logs + example: false + +## An instance would be: +# registry: docker.io +# repository: bitnami/nginx +# tag: 1.16.1-debian-10-r63 +# pullPolicy: IfNotPresent +# debug: false +``` + +### Persistence + +```yaml +enabled: + type: boolean + description: Whether enable persistence. + example: true + +storageClass: + type: string + description: Ghost data Persistent Volume Storage Class, If set to "-", storageClassName: "" which disables dynamic provisioning. + example: "-" + +accessMode: + type: string + description: Access mode for the Persistent Volume Storage. + example: ReadWriteOnce + +size: + type: string + description: Size the Persistent Volume Storage. + example: 8Gi + +path: + type: string + description: Path to be persisted. + example: /bitnami + +## An instance would be: +# enabled: true +# storageClass: "-" +# accessMode: ReadWriteOnce +# size: 8Gi +# path: /bitnami +``` + +### ExistingSecret + +```yaml +name: + type: string + description: Name of the existing secret. + example: mySecret +keyMapping: + description: Mapping between the expected key name and the name of the key in the existing secret. + type: object + +## An instance would be: +# name: mySecret +# keyMapping: +# password: myPasswordKey +``` + +#### Example of use + +When we store sensitive data for a deployment in a secret, some times we want to give to users the possibility of using theirs existing secrets. + +```yaml +# templates/secret.yaml +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }} + labels: + app: {{ include "common.names.fullname" . }} +type: Opaque +data: + password: {{ .Values.password | b64enc | quote }} + +# templates/dpl.yaml +--- +... + env: + - name: PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "common.secrets.name" (dict "existingSecret" .Values.existingSecret "context" $) }} + key: {{ include "common.secrets.key" (dict "existingSecret" .Values.existingSecret "key" "password") }} +... + +# values.yaml +--- +name: mySecret +keyMapping: + password: myPasswordKey +``` + +### ValidateValue + +#### NOTES.txt + +```console +{{- $validateValueConf00 := (dict "valueKey" "path.to.value00" "secret" "secretName" "field" "password-00") -}} +{{- $validateValueConf01 := (dict "valueKey" "path.to.value01" "secret" "secretName" "field" "password-01") -}} + +{{ include "common.validations.values.multiple.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} +``` + +If we force those values to be empty we will see some alerts + +```console +$ helm install test mychart --set path.to.value00="",path.to.value01="" + 'path.to.value00' must not be empty, please add '--set path.to.value00=$PASSWORD_00' to the command. To get the current value: + + export PASSWORD_00=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-00}" | base64 --decode) + + 'path.to.value01' must not be empty, please add '--set path.to.value01=$PASSWORD_01' to the command. To get the current value: + + export PASSWORD_01=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-01}" | base64 --decode) +``` + +## Upgrading + +### To 1.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +**What changes were introduced in this major version?** + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- Use `type: library`. [Here](https://v3.helm.sh/docs/faq/#library-chart-support) you can find more information. +- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts + +**Considerations when upgrading to this version** + +- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 + +**Useful links** + +- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ +- https://helm.sh/docs/topics/v2_v3_migration/ +- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_affinities.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_affinities.tpl new file mode 100644 index 000000000..189ea403d --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_affinities.tpl @@ -0,0 +1,102 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Return a soft nodeAffinity definition +{{ include "common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes.soft" -}} +preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: {{ .key }} + operator: In + values: + {{- range .values }} + - {{ . | quote }} + {{- end }} + weight: 1 +{{- end -}} + +{{/* +Return a hard nodeAffinity definition +{{ include "common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes.hard" -}} +requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: {{ .key }} + operator: In + values: + {{- range .values }} + - {{ . | quote }} + {{- end }} +{{- end -}} + +{{/* +Return a nodeAffinity definition +{{ include "common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes" -}} + {{- if eq .type "soft" }} + {{- include "common.affinities.nodes.soft" . -}} + {{- else if eq .type "hard" }} + {{- include "common.affinities.nodes.hard" . -}} + {{- end -}} +{{- end -}} + +{{/* +Return a soft podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods.soft" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "context" $) -}} +*/}} +{{- define "common.affinities.pods.soft" -}} +{{- $component := default "" .component -}} +{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} +preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 10 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := $extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + namespaces: + - {{ .context.Release.Namespace | quote }} + topologyKey: kubernetes.io/hostname + weight: 1 +{{- end -}} + +{{/* +Return a hard podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods.hard" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "context" $) -}} +*/}} +{{- define "common.affinities.pods.hard" -}} +{{- $component := default "" .component -}} +{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} +requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 8 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := $extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + namespaces: + - {{ .context.Release.Namespace | quote }} + topologyKey: kubernetes.io/hostname +{{- end -}} + +{{/* +Return a podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.pods" -}} + {{- if eq .type "soft" }} + {{- include "common.affinities.pods.soft" . -}} + {{- else if eq .type "hard" }} + {{- include "common.affinities.pods.hard" . -}} + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_capabilities.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_capabilities.tpl new file mode 100644 index 000000000..ae45d5e35 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_capabilities.tpl @@ -0,0 +1,117 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Return the target Kubernetes version +*/}} +{{- define "common.capabilities.kubeVersion" -}} +{{- if .Values.global }} + {{- if .Values.global.kubeVersion }} + {{- .Values.global.kubeVersion -}} + {{- else }} + {{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} + {{- end -}} +{{- else }} +{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for policy. +*/}} +{{- define "common.capabilities.policy.apiVersion" -}} +{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "policy/v1beta1" -}} +{{- else -}} +{{- print "policy/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for cronjob. +*/}} +{{- define "common.capabilities.cronjob.apiVersion" -}} +{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "batch/v1beta1" -}} +{{- else -}} +{{- print "batch/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for deployment. +*/}} +{{- define "common.capabilities.deployment.apiVersion" -}} +{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for statefulset. +*/}} +{{- define "common.capabilities.statefulset.apiVersion" -}} +{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apps/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for ingress. +*/}} +{{- define "common.capabilities.ingress.apiVersion" -}} +{{- if .Values.ingress -}} +{{- if .Values.ingress.apiVersion -}} +{{- .Values.ingress.apiVersion -}} +{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end }} +{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for RBAC resources. +*/}} +{{- define "common.capabilities.rbac.apiVersion" -}} +{{- if semverCompare "<1.17-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "rbac.authorization.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "rbac.authorization.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for CRDs. +*/}} +{{- define "common.capabilities.crd.apiVersion" -}} +{{- if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apiextensions.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "apiextensions.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if the used Helm version is 3.3+. +A way to check the used Helm version was not introduced until version 3.3.0 with .Capabilities.HelmVersion, which contains an additional "{}}" structure. +This check is introduced as a regexMatch instead of {{ if .Capabilities.HelmVersion }} because checking for the key HelmVersion in <3.3 results in a "interface not found" error. +**To be removed when the catalog's minimun Helm version is 3.3** +*/}} +{{- define "common.capabilities.supportsHelmVersion" -}} +{{- if regexMatch "{(v[0-9])*[^}]*}}$" (.Capabilities | toString ) }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_errors.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_errors.tpl new file mode 100644 index 000000000..a79cc2e32 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_errors.tpl @@ -0,0 +1,23 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Through error when upgrading using empty passwords values that must not be empty. + +Usage: +{{- $validationError00 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password00" "secret" "secretName" "field" "password-00") -}} +{{- $validationError01 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password01" "secret" "secretName" "field" "password-01") -}} +{{ include "common.errors.upgrade.passwords.empty" (dict "validationErrors" (list $validationError00 $validationError01) "context" $) }} + +Required password params: + - validationErrors - String - Required. List of validation strings to be return, if it is empty it won't throw error. + - context - Context - Required. Parent context. +*/}} +{{- define "common.errors.upgrade.passwords.empty" -}} + {{- $validationErrors := join "" .validationErrors -}} + {{- if and $validationErrors .context.Release.IsUpgrade -}} + {{- $errorString := "\nPASSWORDS ERROR: You must provide your current passwords when upgrading the release." -}} + {{- $errorString = print $errorString "\n Note that even after reinstallation, old credentials may be needed as they may be kept in persistent volume claims." -}} + {{- $errorString = print $errorString "\n Further information can be obtained at https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues/#credential-errors-while-upgrading-chart-releases" -}} + {{- $errorString = print $errorString "\n%s" -}} + {{- printf $errorString $validationErrors | fail -}} + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_images.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_images.tpl new file mode 100644 index 000000000..42ffbc722 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_images.tpl @@ -0,0 +1,75 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Return the proper image name +{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" $) }} +*/}} +{{- define "common.images.image" -}} +{{- $registryName := .imageRoot.registry -}} +{{- $repositoryName := .imageRoot.repository -}} +{{- $tag := .imageRoot.tag | toString -}} +{{- if .global }} + {{- if .global.imageRegistry }} + {{- $registryName = .global.imageRegistry -}} + {{- end -}} +{{- end -}} +{{- if $registryName }} +{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- else -}} +{{- printf "%s:%s" $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) +{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }} +*/}} +{{- define "common.images.pullSecrets" -}} + {{- $pullSecrets := list }} + + {{- if .global }} + {{- range .global.imagePullSecrets -}} + {{- $pullSecrets = append $pullSecrets . -}} + {{- end -}} + {{- end -}} + + {{- range .images -}} + {{- range .pullSecrets -}} + {{- $pullSecrets = append $pullSecrets . -}} + {{- end -}} + {{- end -}} + + {{- if (not (empty $pullSecrets)) }} +imagePullSecrets: + {{- range $pullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names evaluating values as templates +{{ include "common.images.renderPullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $) }} +*/}} +{{- define "common.images.renderPullSecrets" -}} + {{- $pullSecrets := list }} + {{- $context := .context }} + + {{- if $context.Values.global }} + {{- range $context.Values.global.imagePullSecrets -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} + {{- end -}} + {{- end -}} + + {{- range .images -}} + {{- range .pullSecrets -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} + {{- end -}} + {{- end -}} + + {{- if (not (empty $pullSecrets)) }} +imagePullSecrets: + {{- range $pullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_ingress.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_ingress.tpl new file mode 100644 index 000000000..f905f2005 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_ingress.tpl @@ -0,0 +1,55 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Generate backend entry that is compatible with all Kubernetes API versions. + +Usage: +{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }} + +Params: + - serviceName - String. Name of an existing service backend + - servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer. + - context - Dict - Required. The context for the template evaluation. +*/}} +{{- define "common.ingress.backend" -}} +{{- $apiVersion := (include "common.capabilities.ingress.apiVersion" .context) -}} +{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}} +serviceName: {{ .serviceName }} +servicePort: {{ .servicePort }} +{{- else -}} +service: + name: {{ .serviceName }} + port: + {{- if typeIs "string" .servicePort }} + name: {{ .servicePort }} + {{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }} + number: {{ .servicePort | int }} + {{- end }} +{{- end -}} +{{- end -}} + +{{/* +Print "true" if the API pathType field is supported +Usage: +{{ include "common.ingress.supportsPathType" . }} +*/}} +{{- define "common.ingress.supportsPathType" -}} +{{- if (semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .)) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if the ingressClassname field is supported +Usage: +{{ include "common.ingress.supportsIngressClassname" . }} +*/}} +{{- define "common.ingress.supportsIngressClassname" -}} +{{- if semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_labels.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_labels.tpl new file mode 100644 index 000000000..252066c7e --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_labels.tpl @@ -0,0 +1,18 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Kubernetes standard labels +*/}} +{{- define "common.labels.standard" -}} +app.kubernetes.io/name: {{ include "common.names.name" . }} +helm.sh/chart: {{ include "common.names.chart" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} + +{{/* +Labels to use on deploy.spec.selector.matchLabels and svc.spec.selector +*/}} +{{- define "common.labels.matchLabels" -}} +app.kubernetes.io/name: {{ include "common.names.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_names.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_names.tpl new file mode 100644 index 000000000..adf2a74f4 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_names.tpl @@ -0,0 +1,32 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "common.names.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "common.names.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "common.names.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_secrets.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_secrets.tpl new file mode 100644 index 000000000..60b84a701 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_secrets.tpl @@ -0,0 +1,129 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Generate secret name. + +Usage: +{{ include "common.secrets.name" (dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $) }} + +Params: + - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user + to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. + +info: https://github.com/bitnami/charts/tree/master/bitnami/common#existingsecret + - defaultNameSuffix - String - Optional. It is used only if we have several secrets in the same deployment. + - context - Dict - Required. The context for the template evaluation. +*/}} +{{- define "common.secrets.name" -}} +{{- $name := (include "common.names.fullname" .context) -}} + +{{- if .defaultNameSuffix -}} +{{- $name = printf "%s-%s" $name .defaultNameSuffix | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- with .existingSecret -}} +{{- if not (typeIs "string" .) -}} +{{- with .name -}} +{{- $name = . -}} +{{- end -}} +{{- else -}} +{{- $name = . -}} +{{- end -}} +{{- end -}} + +{{- printf "%s" $name -}} +{{- end -}} + +{{/* +Generate secret key. + +Usage: +{{ include "common.secrets.key" (dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName") }} + +Params: + - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user + to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. + +info: https://github.com/bitnami/charts/tree/master/bitnami/common#existingsecret + - key - String - Required. Name of the key in the secret. +*/}} +{{- define "common.secrets.key" -}} +{{- $key := .key -}} + +{{- if .existingSecret -}} + {{- if not (typeIs "string" .existingSecret) -}} + {{- if .existingSecret.keyMapping -}} + {{- $key = index .existingSecret.keyMapping $.key -}} + {{- end -}} + {{- end }} +{{- end -}} + +{{- printf "%s" $key -}} +{{- end -}} + +{{/* +Generate secret password or retrieve one if already created. + +Usage: +{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - key - String - Required - Name of the key in the secret. + - providedValues - List - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value. + - length - int - Optional - Length of the generated random password. + - strong - Boolean - Optional - Whether to add symbols to the generated random password. + - chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart. + - context - Context - Required - Parent context. +*/}} +{{- define "common.secrets.passwords.manage" -}} + +{{- $password := "" }} +{{- $subchart := "" }} +{{- $chartName := default "" .chartName }} +{{- $passwordLength := default 10 .length }} +{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }} +{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }} +{{- $secret := (lookup "v1" "Secret" $.context.Release.Namespace .secret) }} +{{- if $secret }} + {{- if index $secret.data .key }} + {{- $password = index $secret.data .key }} + {{- end -}} +{{- else if $providedPasswordValue }} + {{- $password = $providedPasswordValue | toString | b64enc | quote }} +{{- else }} + + {{- if .context.Values.enabled }} + {{- $subchart = $chartName }} + {{- end -}} + + {{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}} + {{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}} + {{- $passwordValidationErrors := list $requiredPasswordError -}} + {{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}} + + {{- if .strong }} + {{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }} + {{- $password = randAscii $passwordLength }} + {{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }} + {{- $password = printf "%s%s" $subStr $password | toString | shuffle | b64enc | quote }} + {{- else }} + {{- $password = randAlphaNum $passwordLength | b64enc | quote }} + {{- end }} +{{- end -}} +{{- printf "%s" $password -}} +{{- end -}} + +{{/* +Returns whether a previous generated secret already exists + +Usage: +{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - context - Context - Required - Parent context. +*/}} +{{- define "common.secrets.exists" -}} +{{- $secret := (lookup "v1" "Secret" $.context.Release.Namespace .secret) }} +{{- if $secret }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_storage.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_storage.tpl new file mode 100644 index 000000000..60e2a844f --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_storage.tpl @@ -0,0 +1,23 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Return the proper Storage Class +{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }} +*/}} +{{- define "common.storage.class" -}} + +{{- $storageClass := .persistence.storageClass -}} +{{- if .global -}} + {{- if .global.storageClass -}} + {{- $storageClass = .global.storageClass -}} + {{- end -}} +{{- end -}} + +{{- if $storageClass -}} + {{- if (eq "-" $storageClass) -}} + {{- printf "storageClassName: \"\"" -}} + {{- else }} + {{- printf "storageClassName: %s" $storageClass -}} + {{- end -}} +{{- end -}} + +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_tplvalues.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_tplvalues.tpl new file mode 100644 index 000000000..2db166851 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_tplvalues.tpl @@ -0,0 +1,13 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Renders a value that contains template. +Usage: +{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }} +*/}} +{{- define "common.tplvalues.render" -}} + {{- if typeIs "string" .value }} + {{- tpl .value .context }} + {{- else }} + {{- tpl (.value | toYaml) .context }} + {{- end }} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_utils.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_utils.tpl new file mode 100644 index 000000000..ea083a249 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_utils.tpl @@ -0,0 +1,62 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Print instructions to get a secret value. +Usage: +{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }} +*/}} +{{- define "common.utils.secret.getvalue" -}} +{{- $varname := include "common.utils.fieldToEnvVar" . -}} +export {{ $varname }}=$(kubectl get secret --namespace {{ .context.Release.Namespace | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 --decode) +{{- end -}} + +{{/* +Build env var name given a field +Usage: +{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }} +*/}} +{{- define "common.utils.fieldToEnvVar" -}} + {{- $fieldNameSplit := splitList "-" .field -}} + {{- $upperCaseFieldNameSplit := list -}} + + {{- range $fieldNameSplit -}} + {{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}} + {{- end -}} + + {{ join "_" $upperCaseFieldNameSplit }} +{{- end -}} + +{{/* +Gets a value from .Values given +Usage: +{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }} +*/}} +{{- define "common.utils.getValueFromKey" -}} +{{- $splitKey := splitList "." .key -}} +{{- $value := "" -}} +{{- $latestObj := $.context.Values -}} +{{- range $splitKey -}} + {{- if not $latestObj -}} + {{- printf "please review the entire path of '%s' exists in values" $.key | fail -}} + {{- end -}} + {{- $value = ( index $latestObj . ) -}} + {{- $latestObj = $value -}} +{{- end -}} +{{- printf "%v" (default "" $value) -}} +{{- end -}} + +{{/* +Returns first .Values key with a defined value or first of the list if all non-defined +Usage: +{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }} +*/}} +{{- define "common.utils.getKeyFromList" -}} +{{- $key := first .keys -}} +{{- $reverseKeys := reverse .keys }} +{{- range $reverseKeys }} + {{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }} + {{- if $value -}} + {{- $key = . }} + {{- end -}} +{{- end -}} +{{- printf "%s" $key -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_warnings.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_warnings.tpl new file mode 100644 index 000000000..ae10fa41e --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/_warnings.tpl @@ -0,0 +1,14 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Warning about using rolling tag. +Usage: +{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }} +*/}} +{{- define "common.warnings.rollingTag" -}} + +{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} + +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_cassandra.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_cassandra.tpl new file mode 100644 index 000000000..8679ddffb --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_cassandra.tpl @@ -0,0 +1,72 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate Cassandra required passwords are not empty. + +Usage: +{{ include "common.validations.values.cassandra.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where Cassandra values are stored, e.g: "cassandra-passwords-secret" + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.cassandra.passwords" -}} + {{- $existingSecret := include "common.cassandra.values.existingSecret" . -}} + {{- $enabled := include "common.cassandra.values.enabled" . -}} + {{- $dbUserPrefix := include "common.cassandra.values.key.dbUser" . -}} + {{- $valueKeyPassword := printf "%s.password" $dbUserPrefix -}} + + {{- if and (not $existingSecret) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "cassandra-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.cassandra.values.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.cassandra.values.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.cassandra.dbUser.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.dbUser.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled cassandra. + +Usage: +{{ include "common.cassandra.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.cassandra.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.cassandra.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key dbUser + +Usage: +{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.cassandra.values.key.dbUser" -}} + {{- if .subchart -}} + cassandra.dbUser + {{- else -}} + dbUser + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_mariadb.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_mariadb.tpl new file mode 100644 index 000000000..bb5ed7253 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_mariadb.tpl @@ -0,0 +1,103 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate MariaDB required passwords are not empty. + +Usage: +{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret" + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.mariadb.passwords" -}} + {{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}} + {{- $enabled := include "common.mariadb.values.enabled" . -}} + {{- $architecture := include "common.mariadb.values.architecture" . -}} + {{- $authPrefix := include "common.mariadb.values.key.auth" . -}} + {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} + {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} + {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} + {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} + + {{- if and (not $existingSecret) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} + + {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} + {{- if not (empty $valueUsername) -}} + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + {{- end -}} + + {{- if (eq $architecture "replication") -}} + {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mariadb.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mariadb. + +Usage: +{{ include "common.mariadb.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mariadb.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mariadb.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mariadb.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.key.auth" -}} + {{- if .subchart -}} + mariadb.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_mongodb.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_mongodb.tpl new file mode 100644 index 000000000..1e5bba981 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_mongodb.tpl @@ -0,0 +1,108 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate MongoDB® required passwords are not empty. + +Usage: +{{ include "common.validations.values.mongodb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where MongoDB® values are stored, e.g: "mongodb-passwords-secret" + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.mongodb.passwords" -}} + {{- $existingSecret := include "common.mongodb.values.auth.existingSecret" . -}} + {{- $enabled := include "common.mongodb.values.enabled" . -}} + {{- $authPrefix := include "common.mongodb.values.key.auth" . -}} + {{- $architecture := include "common.mongodb.values.architecture" . -}} + {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} + {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} + {{- $valueKeyDatabase := printf "%s.database" $authPrefix -}} + {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} + {{- $valueKeyReplicaSetKey := printf "%s.replicaSetKey" $authPrefix -}} + {{- $valueKeyAuthEnabled := printf "%s.enabled" $authPrefix -}} + + {{- $authEnabled := include "common.utils.getValueFromKey" (dict "key" $valueKeyAuthEnabled "context" .context) -}} + + {{- if and (not $existingSecret) (eq $enabled "true") (eq $authEnabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mongodb-root-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} + + {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} + {{- $valueDatabase := include "common.utils.getValueFromKey" (dict "key" $valueKeyDatabase "context" .context) }} + {{- if and $valueUsername $valueDatabase -}} + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mongodb-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + {{- end -}} + + {{- if (eq $architecture "replicaset") -}} + {{- $requiredReplicaSetKey := dict "valueKey" $valueKeyReplicaSetKey "secret" .secret "field" "mongodb-replica-set-key" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredReplicaSetKey -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mongodb.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mongodb. + +Usage: +{{ include "common.mongodb.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mongodb.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mongodb.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.key.auth" -}} + {{- if .subchart -}} + mongodb.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mongodb.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_postgresql.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_postgresql.tpl new file mode 100644 index 000000000..992bcd390 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_postgresql.tpl @@ -0,0 +1,131 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate PostgreSQL required passwords are not empty. + +Usage: +{{ include "common.validations.values.postgresql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where postgresql values are stored, e.g: "postgresql-passwords-secret" + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.postgresql.passwords" -}} + {{- $existingSecret := include "common.postgresql.values.existingSecret" . -}} + {{- $enabled := include "common.postgresql.values.enabled" . -}} + {{- $valueKeyPostgresqlPassword := include "common.postgresql.values.key.postgressPassword" . -}} + {{- $valueKeyPostgresqlReplicationEnabled := include "common.postgresql.values.key.replicationPassword" . -}} + + {{- if and (not $existingSecret) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredPostgresqlPassword := dict "valueKey" $valueKeyPostgresqlPassword "secret" .secret "field" "postgresql-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}} + + {{- $enabledReplication := include "common.postgresql.values.enabled.replication" . -}} + {{- if (eq $enabledReplication "true") -}} + {{- $requiredPostgresqlReplicationPassword := dict "valueKey" $valueKeyPostgresqlReplicationEnabled "secret" .secret "field" "postgresql-replication-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlReplicationPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to decide whether evaluate global values. + +Usage: +{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }} +Params: + - key - String - Required. Field to be evaluated within global, e.g: "existingSecret" +*/}} +{{- define "common.postgresql.values.use.global" -}} + {{- if .context.Values.global -}} + {{- if .context.Values.global.postgresql -}} + {{- index .context.Values.global.postgresql .key | quote -}} + {{- end -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.postgresql.values.existingSecret" (dict "context" $) }} +*/}} +{{- define "common.postgresql.values.existingSecret" -}} + {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}} + + {{- if .subchart -}} + {{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}} + {{- else -}} + {{- default (.context.Values.existingSecret | quote) $globalValue -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled postgresql. + +Usage: +{{ include "common.postgresql.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.postgresql.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.postgresql.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key postgressPassword. + +Usage: +{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.key.postgressPassword" -}} + {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}} + + {{- if not $globalValue -}} + {{- if .subchart -}} + postgresql.postgresqlPassword + {{- else -}} + postgresqlPassword + {{- end -}} + {{- else -}} + global.postgresql.postgresqlPassword + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled.replication. + +Usage: +{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.enabled.replication" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.postgresql.replication.enabled -}} + {{- else -}} + {{- printf "%v" .context.Values.replication.enabled -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key replication.password. + +Usage: +{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.key.replicationPassword" -}} + {{- if .subchart -}} + postgresql.replication.password + {{- else -}} + replication.password + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_redis.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_redis.tpl new file mode 100644 index 000000000..18d9813c5 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_redis.tpl @@ -0,0 +1,76 @@ + +{{/* vim: set filetype=mustache: */}} +{{/* +Validate Redis™ required passwords are not empty. + +Usage: +{{ include "common.validations.values.redis.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where redis values are stored, e.g: "redis-passwords-secret" + - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.redis.passwords" -}} + {{- $enabled := include "common.redis.values.enabled" . -}} + {{- $valueKeyPrefix := include "common.redis.values.keys.prefix" . -}} + {{- $standarizedVersion := include "common.redis.values.standarized.version" . }} + + {{- $existingSecret := ternary (printf "%s%s" $valueKeyPrefix "auth.existingSecret") (printf "%s%s" $valueKeyPrefix "existingSecret") (eq $standarizedVersion "true") }} + {{- $existingSecretValue := include "common.utils.getValueFromKey" (dict "key" $existingSecret "context" .context) }} + + {{- $valueKeyRedisPassword := ternary (printf "%s%s" $valueKeyPrefix "auth.password") (printf "%s%s" $valueKeyPrefix "password") (eq $standarizedVersion "true") }} + {{- $valueKeyRedisUseAuth := ternary (printf "%s%s" $valueKeyPrefix "auth.enabled") (printf "%s%s" $valueKeyPrefix "usePassword") (eq $standarizedVersion "true") }} + + {{- if and (not $existingSecretValue) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $useAuth := include "common.utils.getValueFromKey" (dict "key" $valueKeyRedisUseAuth "context" .context) -}} + {{- if eq $useAuth "true" -}} + {{- $requiredRedisPassword := dict "valueKey" $valueKeyRedisPassword "secret" .secret "field" "redis-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRedisPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled redis. + +Usage: +{{ include "common.redis.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.redis.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.redis.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right prefix path for the values + +Usage: +{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false +*/}} +{{- define "common.redis.values.keys.prefix" -}} + {{- if .subchart -}}redis.{{- else -}}{{- end -}} +{{- end -}} + +{{/* +Checks whether the redis chart's includes the standarizations (version >= 14) + +Usage: +{{ include "common.redis.values.standarized.version" (dict "context" $) }} +*/}} +{{- define "common.redis.values.standarized.version" -}} + + {{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}} + {{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }} + + {{- if $standarizedAuthValues -}} + {{- true -}} + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_validations.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_validations.tpl new file mode 100644 index 000000000..9a814cf40 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/templates/validations/_validations.tpl @@ -0,0 +1,46 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate values must not be empty. + +Usage: +{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}} +{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}} +{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} + +Validate value params: + - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" + - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" + - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" +*/}} +{{- define "common.validations.values.multiple.empty" -}} + {{- range .required -}} + {{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}} + {{- end -}} +{{- end -}} + +{{/* +Validate a value must not be empty. + +Usage: +{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }} + +Validate value params: + - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" + - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" + - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" + - subchart - String - Optional - Name of the subchart that the validated password is part of. +*/}} +{{- define "common.validations.values.single.empty" -}} + {{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }} + {{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }} + + {{- if not $value -}} + {{- $varname := "my-value" -}} + {{- $getCurrentValue := "" -}} + {{- if and .secret .field -}} + {{- $varname = include "common.utils.fieldToEnvVar" . -}} + {{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}} + {{- end -}} + {{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}} + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/values.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/values.yaml new file mode 100644 index 000000000..f2df68e5e --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/charts/common/values.yaml @@ -0,0 +1,5 @@ +## bitnami/common +## It is required by CI/CD tools and processes. +## @skip exampleValue +## +exampleValue: common-chart diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_ingress.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_ingress.tpl new file mode 100644 index 000000000..e1b16d928 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_ingress.tpl @@ -0,0 +1,101 @@ +{{/* +include "ingress" (dict "ingressName" "myingress" "ingress" path.to.ingress "serviceName" "the-service" "servicePort" 9090 "context" $) + +ingress: + enabled: true + certManager: false + pathType: ImplementationSpecific + apiVersion: "" + hostname: theservice.local + path: / + annotations: {} + tls: false + extraHosts: [] + extraPaths: [] + extraTls: [] + secrets: [] +*/}} +{{- define "lib.ingress" -}} +{{- $ctx := .context -}} +{{- $ingressName := .ingressName -}} +{{- $serviceName := .serviceName -}} +{{- $servicePort := .servicePort -}} +{{- $extraPaths := .ingress.extraPaths -}} +{{- if .ingress.enabled -}} +apiVersion: {{ include "common.capabilities.ingress.apiVersion" $ctx }} +kind: Ingress +metadata: + name: {{ $ingressName }} + namespace: {{ $ctx.Release.Namespace | quote }} + labels: {{- include "common.labels.standard" $ctx | nindent 4 }} + {{- if $ctx.Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" $ctx.Values.commonLabels "context" $ctx ) | nindent 4 }} + {{- end }} + annotations: + {{- if .ingress.certManager }} + kubernetes.io/tls-acme: "true" + {{- end }} + {{- if .ingress.annotations }} + {{- include "common.tplvalues.render" ( dict "value" .ingress.annotations "context" $ctx ) | nindent 4 }} + {{- end }} + {{- if $ctx.Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" $ctx.Values.commonAnnotations "context" $ctx ) | nindent 4 }} + {{- end }} +spec: + rules: + {{- if .ingress.hostname }} + - host: {{ .ingress.hostname }} + http: + paths: + - path: {{ .ingress.path }} + {{- if eq "true" (include "common.ingress.supportsPathType" $ctx) }} + pathType: {{ default "ImplementationSpecific" .ingress.pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" $serviceName "servicePort" $servicePort "context" $ctx) | nindent 14 }} + {{- include "lib.safeToYaml" $extraPaths | nindent 10 }} + {{- end }} + {{- range .ingress.extraHosts }} + - host: {{ .name | quote }} + http: + paths: + - path: {{ default "/" .path }} + {{- if eq "true" (include "common.ingress.supportsPathType" $ctx) }} + pathType: {{ default "ImplementationSpecific" .pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" $serviceName "servicePort" $servicePort "context" $ctx) | nindent 14 }} + {{- include "lib.safeToYaml" $extraPaths | nindent 10 }} + {{- end }} + {{/* .ingress.hosts is deprecated */}} + {{- range .ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- if .path }} + - path: {{ default "/" .path }} + {{- if eq "true" (include "common.ingress.supportsPathType" $ctx) }} + pathType: {{ default "ImplementationSpecific" .pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" $serviceName "servicePort" $servicePort "context" $ctx) | nindent 14 }} + {{- end }} + {{- range .paths }} + - path: {{ . | quote }} + {{- if eq "true" (include "common.ingress.supportsPathType" $ctx) }} + pathType: ImplementationSpecific + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" $serviceName "servicePort" $servicePort "context" $ctx) | nindent 14 }} + {{- end }} + {{- end }} + {{/* .ingress.hosts is deprecated */}} + {{- if or .ingress.tls .ingress.extraTls }} + tls: + {{- if .ingress.tls }} + - hosts: + - {{ .ingress.hostname }} + secretName: {{ printf "%s-tls" .ingress.hostname }} + {{- end }} + {{- if .ingress.extraTls }} + {{- include "common.tplvalues.render" ( dict "value" .ingress.extraTls "context" $ctx ) | nindent 4 }} + {{- end }} + {{- end }} +{{- end }} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_lib.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_lib.tpl new file mode 100644 index 000000000..deaa325c4 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_lib.tpl @@ -0,0 +1,51 @@ + +{{/* +Call a template function in the context of a sub-chart, as opposed to the +current context of the caller +{{ include "lib.call-nested" (list . "subchart" "template_name") }} +*/}} +{{- define "lib.call-nested" }} +{{- $dot := index . 0 }} +{{- $subchart := index . 1 | splitList "." }} +{{- $template := index . 2 }} +{{- $values := $dot.Values }} +{{- range $subchart }} +{{- $values = index $values . }} +{{- end }} +{{- include $template (dict "Chart" (dict "Name" (last $subchart)) "Values" $values "Release" $dot.Release "Capabilities" $dot.Capabilities) }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "lib.labels" -}} +helm.sh/chart: {{ include "common.names.chart" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{ include "common.labels.matchLabels" . }} +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "lib.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + + +{{/* +Given a variable, if it is not false, output as Yaml + +include "lib.safeToYaml" .Values.something +*/}} +{{- define "lib.safeToYaml" -}} +{{- if . -}} +{{ toYaml . }} +{{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_lib_image.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_lib_image.tpl new file mode 100644 index 000000000..8f8e00231 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_lib_image.tpl @@ -0,0 +1,50 @@ +{{/* +Given a setup like the following: + +# global and on down are optional +global: + image: + registry: my-registry.com + tag: latest + +# This is the imageRoot +somecomponent: + image: + registry: my-other-registry.com + tag: 1.0.0 + repository: bobs/coolthing + +*/}} +{{/* +{{ include "lib.image.url" (dict "imageRoot" .Values.sawtooth.containers.validator.image "global" .Values.global)}} +*/}} +{{- define "lib.image.url" -}} + {{- $globalRegistryName := "" -}} + {{- $globalTag := "latest" -}} + {{- if .global -}} + {{- if .global.image -}} + {{- if .global.image.registry -}} + {{- $globalRegistryName = .global.image.registry -}} + {{- end -}} + {{- if .global.image.tag -}} + {{- $globalTag = .global.image.tag -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- $repository := .imageRoot.repository -}} + {{- $registry := default $globalRegistryName .imageRoot.registry -}} + {{- $tag := default $globalTag .imageRoot.tag -}} + {{- if $registry -}} + {{- printf "%s/%s:%s" $registry $repository $tag -}} + {{- else -}} + {{- printf "%s:%s" $repository $tag -}} + {{- end -}} +{{- end -}} + +{{/* +{{ include "utils.image" (dict "imageRoot" .Values.sawtooth.containers.validator.image "global" .Values.global)}} +*/}} +{{- define "lib.image" -}} +image: {{ include "lib.image.url" . }} +imagePullPolicy: {{ default "IfNotPresent" .imageRoot.pullPolicy }} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_lib_volumes.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_lib_volumes.tpl new file mode 100644 index 000000000..93f1139b1 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/templates/_lib_volumes.tpl @@ -0,0 +1,34 @@ + + +{{/* +given a variable list, create a list of volumes + +extraVolumes: + - name: pv-data + persistentVolumeClaim: + claimName: pvc-persistent-cfg + - name: scratch + emptyDir: {} + +include "lib.volumes" .Values.extraVolumes + +*/}} +{{- define "lib.volumes" -}} +{{ include "lib.safeToYaml" . }} +{{- end -}} + +{{/* +given a variable list, create a list of volumeMounts + +extraVolumeMounts: + - name: pv-data + mountPath: /data + - name: scratch + mountPath: /scratch + +include "lib.volumeMounts" .Values.extraVolumeMounts + +*/}} +{{- define "lib.volumeMounts" -}} +{{ include "lib.safeToYaml" . }} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/values.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/values.yaml new file mode 100644 index 000000000..1ff659769 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/charts/standard-defs/values.yaml @@ -0,0 +1 @@ +exampleValue: example diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/details.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/details.yaml new file mode 100644 index 000000000..83bb5c290 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/details.yaml @@ -0,0 +1,27 @@ +apiVersion: v2 +name: sawtooth +description: Uses BTP Paralos open source distribution of Hyperledger Sawtooth + +# Replaces the index.js in the deployment templates directory, sawtooth/index +# The deploymentType and deploymentVersion help build the object structure +deploymentType: sawtooth +deploymentVersion: 1.1 + +# absolute path to form.js +form: sawtooth/sextant/form.js + +# absolute path to summary.jst +summary: sawtooth/sextant/summary.js + +# paths to be used in the getField function +namePath: sawtooth.networkName +namespacePath: sawtooth.namespace + +# additional fields for the button +# form: +title: Hyperledger Sawtooth +sextantVersion: sawtooth 1.2, paralos 2.1 +buttonIcon: /thirdParty/hyperledger-sawtooth.png +features: [] + +# documentation pull down mark down diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/form.js b/charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/form.js new file mode 100644 index 000000000..293e50f6a --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/form.js @@ -0,0 +1,330 @@ +const randomString = require('randomstring') +const options = require('./options') + +const form = [ + + 'Hyperledger Sawtooth Deployment', + + [ + { + id: 'sawtooth.networkName', + title: 'Deployment Name', + helperText: 'The name of the deployment', + component: 'text', + editable: { + new: true, + }, + validate: { + type: 'string', + methods: [ + ['required', 'Required'], + ['matches', ['^[a-z]([-a-z0-9]*[a-z0-9])*$'], "a DNS-1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character"], + ], + }, + }, + { + id: 'sawtooth.namespace', + title: 'Kubernetes Namespace', + helperText: 'The Kubernetes namespace', + component: 'text', + editable: { + new: true, + }, + validate: { + type: 'string', + methods: [ + ['required', 'Required'], + ['matches', ['^[a-z]([-a-z0-9]*[a-z0-9])*$'], "a DNS-1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character"], + ], + }, + }, + + ], + + [ + { + id: 'sawtooth.dynamicPeering', + title: 'Peering Type', + helperText: 'Peering type for the validator', + component: 'radio', + default: true, + dataType: 'boolean', + row: true, + options: options.peering, + validate: { + type: 'string', + methods: [ + ['required', 'Required'], + ], + }, + }, + { + id: 'sawtooth.genesis.enabled', + title: 'Genesis Block', + helperText: 'Should this network create the genesis block?', + component: 'radio', + default: true, + dataType: 'boolean', + row: true, + options: options.activated, + validate: { + type: 'string', + methods: [ + ['required', 'Required'], + ], + }, + }, + ], + [ + { + id: 'sawtooth.permissioned', + title: 'Permissioned Network', + helperText: 'Should this network be permissioned?', + component: 'radio', + default: false, + dataType: 'boolean', + row: true, + options: options.activated, + validate: { + type: 'string', + methods: [ + ['required', 'Required'], + ], + }, + }, + { + id: 'sawtooth.consensus', + title: 'Consensus Algorithm', + helperText: 'Which consensus algorithm should this network use?', + component: 'select', + alternateText: true, + default: 400, + dataType: 'number', + options: options.consensus, + validate: { + type: 'number', + methods: [ + ['required', 'Required'], + ], + }, + }, + ], + + { + id: 'affinity.enabled', + title: 'Affinity', + helperText: 'If enabled - pods will only deploy to nodes that have the label: app={{ .Release.Name }}-validator', + component: 'radio', + default: false, + dataType: 'boolean', + row: true, + options: options.activated, + validate: { + type: 'string', + methods: [ + ['required', 'Required'], + ], + }, + }, + + // hostname, IP, port + { + id: 'sawtooth.externalSeeds', + title: 'External Seeds', + helperText: 'The list of external addresses to connect to', + list: { + mainField: 'hostname', + schema: [{ + id: 'hostname', + title: 'Hostname', + helperText: 'Type the hostname of a new external seed.', + component: 'text', + validate: { + type: 'string', + methods: [ + ['required', 'Required'], + ['matches', ['^[a-z]([.]*[-a-z0-9]*[a-z0-9])*$'], 'Must use a DNS-1123 safe label.'], + ], + }, + }, + { + id: 'ip', + title: 'IP Address', + helperText: 'Type the IP address of a new external seed.', + component: 'text', + validate: { + type: 'string', + methods: [ + ['required', 'Required'], + ['matches', ['^[0-9]+[.0-9]*[0-9]$'], 'Must be an IPv4 compatible address.'], + ], + }, + }, { + id: 'port', + title: 'Port', + helperText: 'Type the port of a new external seed.', + component: 'text', + validate: { + type: 'string', + methods: [ + ['required', 'Required'], + ['matches', ['^[0-9]+$'], 'Must be a number.'], + ], + }, + }, + ], + table: [{ + title: 'Hostname', + name: 'hostname', + }, { + title: 'IP Address', + name: 'ip', + }, { + title: 'Port', + name: 'port', + }], + }, + }, + + 'Custom Containers', + + { + id: 'sawtooth.customTPs', + title: 'Custom Containers', + skip: true, + helperText: 'Custom containers can connect to the validator on tcp://localhost:4004', + list: { + mainField: 'name', + schema: [{ + id: 'name', + title: 'Name', + helperText: 'The name of your custom container', + component: 'text', + validate: { + type: 'string', + methods: [ + ['required', 'Required'], + ], + }, + }, { + id: 'image', + title: 'Image', + helperText: 'The docker image for your container', + component: 'text', + validate: { + type: 'string', + methods: [ + ['required', 'Required'], + ], + }, + }, { + id: 'command', + title: 'Command', + helperText: 'The command for your container', + component: 'text', + validate: { + type: 'string', + methods: [ + + ], + }, + }, { + id: 'args', + title: 'Arguments', + helperText: 'The arguments for your container', + component: 'text', + validate: { + type: 'string', + methods: [ + + ], + }, + }], + table: [{ + title: 'Name', + name: 'name', + }, { + title: 'Image', + name: 'image', + }, { + title: 'Command', + name: 'command', + }, { + title: 'Arguments', + name: 'args', + }], + }, + }, + + 'Image Pull Secrets', + + { + id: 'imagePullSecrets.enabled', + title: 'Do you need to enable image pull secrets?', + helperText: 'Provide secrets to be injected into the namespace and used to pull images from your secure registry', + component: 'radio', + default: false, + dataType: 'boolean', + row: true, + options: options.yesNo, + validate: { + type: 'string', + methods: [ + ['required', 'Required'], + ], + }, + }, { + id: 'imagePullSecrets.value', + title: 'Image Pull Secrets', + helperText: null, + default: null, + linked: { + linkedId: 'imagePullSecrets.enabled', + visibilityParameter: 'true', // for what value of linkedId, will this component be visible + }, + list: { + mainField: 'name', + schema: [{ + id: 'name', + title: 'Name', + helperText: 'The name of the secret', + component: 'text', + validate: { + type: 'string', + methods: [ + ['required', 'Required'], + ['matches', ['^[a-z]([-a-z0-9]*[a-z0-9])*$'], "a DNS-1123 label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character"], + ], + }, + }], + table: [{ + title: 'Name', + name: 'name', + }], + }, + }, + + 'Advanced Options', + + [ + { + id: 'sawtooth.genesis.seed', + title: 'Genesis Seed', + hidden: true, + default: randomString.generate(24), + warning: true, + helperText: 'WARNING: Changing the Genesis Seed will cause any exisiting data on the deployment to be deleted.', + component: 'text', + validate: { + type: 'string', + methods: [ + ['required', 'Required'], + ], + }, + }, + '', // emptry string acts as space in UI + ], + +] + +module.exports = form diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/options.js b/charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/options.js new file mode 100644 index 000000000..c1ecf9f7f --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/options.js @@ -0,0 +1,48 @@ +const activated = [{ + value: true, + title: 'Enabled', +}, { + value: false, + title: 'Disabled', +}] + +const yesNo = [{ + value: true, + title: 'Yes', +}, { + value: false, + title: 'No', +}] + +const consensus = [{ + value: 100, + title: 'DevMode', + blurb: 'DevMode is useful for development purposes only. This mechanism useful only on single node networks which provide no real consensus guarantees.', +}, { + value: 400, + title: 'PBFT', + blurb: 'PBFT is a byzantine fault tolerant consensus mechanism offering good scale, and performance. It is tolerant of up to f=(n-1)/3 byzantine or other faults on the network. PBFT is a non-forking algorithm.', +}, { + value: 200, + title: 'PoET-CFT', + blurb: 'PoET-CFT is a time based consensus mechanism based on a fair lottery system. It has low resource utilization, is crash fault tolerant and can support very large scale networks. PoET-CFT is a forking consensus algorithm.', +}, { + value: 300, + title: 'Raft', + blurb: 'Raft is a consensus mechanism based on an elected leader. It offers good performance, but is not tolerant of Byzantine failures. It works best with low latency networks, and is tolerant of f=(n-1)/2 non-byzantine failures. Raft is a non-forking algorithm.', +}] + +const peering = [{ + value: true, + title: 'Dynamic', +}, { + value: false, + title: 'Static', +}] + +module.exports = { + activated, + consensus, + peering, + yesNo, +} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/summary.js b/charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/summary.js new file mode 100644 index 000000000..438003fd8 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/sextant/summary.js @@ -0,0 +1,43 @@ +const options = require('./options') + +const getConsensusTitle = (value) => { + const option = options.consensus.find((o) => o.value === value) + return option ? option.title : 'unknown' +} + +const summary = (values) => { + const { + sawtooth, + } = values + + return [{ + title: 'Deployment Name', + value: sawtooth.networkName, + }, { + title: 'Namespace', + value: sawtooth.namespace, + }, { + title: 'Peering Type', + value: sawtooth.dynamicPeering ? 'Dynamic' : 'Static', + }, { + title: 'Genesis Block', + value: sawtooth.genesis.enabled ? 'Yes' : 'No', + }, { + title: 'Permissioned', + value: sawtooth.permissioned ? 'Yes' : 'No', + }, { + title: 'Consensus Algorithm', + value: getConsensusTitle(sawtooth.consensus), + }, { + title: 'External Seeds', + value: (sawtooth.externalSeeds || []).map((seed) => seed.ip), + }, { + title: 'Sawtooth Validator Port', + value: '8800', + }, { + title: 'Custom Transaction Processors', + value: (sawtooth.customTPs || []).map((tp) => `${tp.name} (${tp.image})`), + }] +} + +module.exports = summary diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/NOTES.txt b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/NOTES.txt new file mode 100644 index 000000000..e69de29bb diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/_sawtooth.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/_sawtooth.tpl new file mode 100644 index 000000000..568d535e2 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/_sawtooth.tpl @@ -0,0 +1,361 @@ + +{{/* +Sawtooth Selector labels +*/}} +{{- define "sawtooth.labels" -}} +{{ include "lib.labels" . }} +app: {{ include "common.names.fullname" . }} +{{- end -}} + +{{- define "sawtooth.kind" -}} +{{ $consensus := .Values.sawtooth.consensus | int }} +{{- if or .Values.sawtooth.statefulset.enabled (eq $consensus 100) -}} +StatefulSet +{{- else -}} +DaemonSet +{{- end -}} +{{- end -}} + +{{/* +Sawtooth Selector labels +*/}} +{{- define "sawtooth.labels.matchLabels" -}} +{{ include "common.labels.matchLabels" . }} +app: {{ include "common.names.fullname" . }} +component: sawtooth +{{- end -}} + +{{/* if the consensus type is devmode replicas is always 1 */}} +{{- define "sawtooth.replicas" -}} +{{- $consensus := .Values.sawtooth.consensus | int -}} +{{- if eq $consensus 100 -}} +{{- 1 | int -}} +{{- else -}} +{{- default 4 .Values.sawtooth.statefulset.replicas | int -}} +{{- end -}} +{{- end -}} + +{{/* +Sawtooth networking specifications +*/}} +{{- define "sawtooth.bind.component" -}} +component:tcp://0.0.0.0:{{ include "sawtooth.ports.sawcomp" . }} +{{- end -}} + +{{/* +Consensus binding should always be local under normal circumstances +*/}} +{{- define "sawtooth.bind.consensus" -}} +{{- if .Values.sawtooth.ports.consensus_local -}} +consensus:tcp://127.0.0.1:{{ include "sawtooth.ports.consensus" . }} +{{- else -}} +consensus:tcp://0.0.0.0:{{ include "sawtooth.ports.consensus" . }} +{{- end -}} +{{- end -}} + +{{- define "sawtooth.bind.network" -}} +network:tcp://0.0.0.0:{{ include "sawtooth.ports.sawnet" . }} +{{- end -}} + +{{- define "sawtooth.binds" -}} +--bind {{ include "sawtooth.bind.component" . }} \ +--bind {{ include "sawtooth.bind.consensus" . }} \ +--bind {{ include "sawtooth.bind.network" . }} +{{- end -}} + +{{- define "sawtooth.opentsdb" -}} +{{- if .Values.sawtooth.opentsdb.enabled -}} +--opentsdb-db {{ .Values.sawtooth.opentsdb.db }} \ +--opentsdb-url {{ .Values.sawtooth.opentsdb.url }} +{{- end -}} +{{- end -}} + +{{- define "sawtooth.peering" -}} +{{- $peering:= .Values.sawtooth.dynamicPeering -}} +--peering {{ if ($peering)}}dynamic{{ else }}static{{end }} \ +{{ range .Values.sawtooth.externalSeeds }}{{ if ($peering) }}--seeds{{ else }}--peers{{ end }} tcp://{{ .hostname }}:{{ .port }} {{end }} \ +{{ if ($peering)}}${SEEDS}{{ else }}${PEERS}{{end }} \ +--maximum-peer-connectivity 255 +{{- end -}} + +{{- define "sawtooth.network" -}} +{{ include "sawtooth.binds" . }} \ +{{ include "sawtooth.peering" . }} \ +{{ include "sawtooth.opentsdb" . }} +{{- end -}} + +{{/* +Genesis Templates +*/}} +{{- define "sawtooth.genesis.create" -}} +{{- if .Values.sawtooth.genesis.enabled -}} +{{- $consensus := .Values.sawtooth.consensus | int -}} +if [ ! -r /etc/sawtooth/initialized ]; then + if [ $RUN_GENESIS -eq 1 ]; then + {{- if eq $consensus 400 }} + bash -x /usr/local/bin/pbft_genesis_config.sh {{ .Release.Namespace }} + {{- else if eq $consensus 300 }} + bash -x /usr/local/bin/raft_genesis_config.sh {{ .Release.Namespace }} + {{- else if eq $consensus 200 }} + bash -x /usr/local/bin/poet_genesis_config.sh {{ .Release.Namespace }} + {{- else }} + bash -x /usr/local/bin/devmode_genesis_config.sh {{ .Release.Namespace }} + {{- end }} + {{ if .Values.sawtooth.permissioned -}} + /usr/local/bin/identity_genesis_config.sh {{ .Release.Namespace }} + {{- end -}} + sawset genesis -k /etc/sawtooth/keys/validator.priv \ + -o /etc/sawtooth/genesis/000-genesis.batch + cd /etc/sawtooth/genesis + sawadm genesis `ls |sort` + cd - + fi + touch /etc/sawtooth/initialized; +fi +{{- end -}} +{{- end -}} +{{- if not .Values.sawtooth.genesis.enabled -}} +touch /etc/sawtooth/initialized +{{- end -}} + +{{- define "sawtooth.genesis.reset" -}} +{{- if .Values.sawtooth.genesis.enabled -}} +if [ -r /etc/sawtooth/genesis.seed ]; then + OLD_SEED=`cat /etc/sawtooth/genesis.seed` + if [ "$OLD_SEED" != "{{ .Values.sawtooth.genesis.seed }}" ]; then + echo "${OLD_SEED} != {{ .Values.sawtooth.genesis.seed }} -- resetting environment" + rm -rf /var/lib/sawtooth/* + rm -f /etc/sawtooth/genesis/* + rm -f /etc/sawtooth/initialized + echo {{ .Values.sawtooth.genesis.seed }} > /etc/sawtooth/genesis.seed + fi +else + echo "No genesis seed. Resetting environment and setting Seed to {{ .Values.sawtooth.genesis.seed }}" + rm -rf /var/lib/sawtooth/* + rm -f /etc/sawtooth/genesis/* + rm -f /etc/sawtooth/initialized + echo {{ .Values.sawtooth.genesis.seed }} > /etc/sawtooth/genesis.seed +fi +{{- end -}} +{{- end -}} +{{/* +END Genesis Templates +*/}} + +{{- define "sawtooth.hostpath" -}} +{{ .Values.sawtooth.volumes.hostPathBaseDir | trimSuffix "/" }}/{{.Release.Namespace}}/{{.Release.Name }} +{{- end -}} + +{{- define "sawtooth.etc.volume.name" -}} +sawtooth-etc +{{- end -}} + +{{- define "sawtooth.etc.volume" -}} +- name: {{ include "sawtooth.etc.volume.name" . }} + hostPath: + type: DirectoryOrCreate + path: {{ include "sawtooth.hostpath" . }}/{{ include "sawtooth.data.volume.name" . }} +{{- end -}} + +{{- define "sawtooth.etc.volume.vct" -}} +- metadata: + name: {{ include "sawtooth.etc.volume.name" . }} + {{- if .Values.sawtooth.persistence.annotations }} + annotations: {{- toYaml .Values.sawtooth.persistence.annotations | nindent 10 }} + {{- end }} + spec: + accessModes: {{- toYaml .Values.sawtooth.persistence.accessModes | nindent 10 }} + {{ if .Values.sawtooth.persistence.storageClass }} + storageClassName: {{ .Values.sawtooth.persistence.storageClass | quote }} + {{ end }} + resources: + requests: + storage: 1Gi +{{- end -}} + +{{- define "sawtooth.etc.mount" -}} +- mountPath: /etc/sawtooth + name: {{ include "sawtooth.etc.volume.name" . }} +{{- end -}} + +{{- define "sawtooth.scripts.volume" -}} +- name: {{ include "sawtooth.scripts.volume.name" . }} + configMap: + name: {{ include "common.names.fullname" . }}-scripts +{{- end -}} + +{{- define "sawtooth.scripts.volume.name" -}} +chart-scripts +{{- end -}} + +{{- define "sawtooth.scripts.mount" -}} +- mountPath: /opt/chart/scripts + name: {{ include "sawtooth.scripts.volume.name" . }} +{{- end -}} + +{{- define "sawtooth.data.volume.name" -}} +sawtooth-data +{{- end -}} + +{{- define "sawtooth.data.volume" -}} +- name: {{ include "sawtooth.data.volume.name" . }} + hostPath: + type: DirectoryOrCreate + path: {{ include "sawtooth.hostpath" . }}/{{ include "sawtooth.data.volume.name" . }} +{{- end -}} + +{{- define "sawtooth.data.volume.vct" -}} +- metadata: + name: {{ include "sawtooth.data.volume.name" . }} + {{- if .Values.sawtooth.persistence.annotations }} + annotations: {{- toYaml .Values.sawtooth.persistence.annotations | nindent 8 }} + {{- end }} + spec: + accessModes: {{- toYaml .Values.sawtooth.persistence.accessModes | nindent 6 }} + {{ if .Values.sawtooth.persistence.storageClass }} + storageClassName: {{ .Values.sawtooth.persistence.storageClass | quote }} + {{ end }} + resources: + requests: + storage: {{ .Values.sawtooth.persistence.size | quote }} +{{- end -}} + +{{- define "sawtooth.data.mount" -}} +- mountPath: /var/lib/sawtooth + name: {{ include "sawtooth.data.volume.name" . }} +{{- end -}} + +{{/* +Sawtooth Signals Templates +*/}} +{{/* +Use as in +{{ include "sawtooth.signal.postStart" "pbft-engine" } +*/}} +{{- define "sawtooth.signal.postStart" -}} +postStart: + exec: + command: + - sh + - -c + - | + rm -f {{ include "sawtooth.signals.dir" . }}/{{ . }} +{{- end -}} + +{{- define "sawtooth.signal.livenessProbe" -}} +livenessProbe: + exec: + command: + - sh + - -c + - | + if [ -r {{ include "sawtooth.signals.dir" . }}/{{ . }} ]; then + exit 1 + else + exit 0 + fi +{{- end -}} + +{{- define "sawtooth.signal.fire" -}} +exit_code=$? +export EXIT_SIGNALS="{{ .Values.sawtooth.livenessProbe.exitSignals }}" +for signal in ${EXIT_SIGNALS}; do + touch "{{ include "sawtooth.signals.dir" . }}/$signal" +done +exit $exit_code +{{- end -}} + +{{- define "sawtooth.signals.volume.name" -}} +sawtooth-signals +{{- end -}} + +{{- define "sawtooth.signals.dir" -}} +/var/run/sawtooth +{{- end -}} + +{{- define "sawtooth.signals.mount" -}} +- mountPath: {{ include "sawtooth.signals.dir" . }} + name: {{ include "sawtooth.signals.volume.name" . }} +{{- end -}} + +{{- define "sawtooth.signals.volume" -}} +- name: {{ include "sawtooth.signals.volume.name" . }} + emptyDir: {} +{{- end -}} +{{/* +END Sawtooth Signals Templates +*/}} + +{{- define "sawtooth.affinity" -}} +{{- if .Values.affinity.enabled -}} +nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: app + operator: In + values: + - {{- include "common.names.fullname" . -}} +{{- else -}} +{{- if .Values.sawtooth.affinity -}} +{{- toYaml .Values.sawtooth.affinity }} +{{- end -}} +{{- end -}} +{{- end -}} + +{{- define "sawtooth.hostaliases" -}} +{{ range .Values.sawtooth.externalSeeds }} +- ip: {{ .ip }} + hostnames: + - {{ .hostname }} +{{ end }} +{{ include "utils.hostaliases" . }} +{{- end -}} + +{{- define "sawtooth.containers" -}} +{{- $consensus := .Values.sawtooth.consensus | int -}} +{{- if eq $consensus 400 -}} +{{- include "sawtooth.container.pbft-engine" . | nindent 0 }} +{{- else if eq $consensus 300 -}} +{{- include "sawtooth.container.raft-engine" . | nindent 0 }} +{{- else if eq $consensus 200 -}} +{{- include "sawtooth.container.poet-engine" . | nindent 0 }} +{{- else -}} +{{- include "sawtooth.container.devmode-engine" . | nindent 0 }} +{{- end -}} +{{- include "sawtooth.container.settings-tp" . | nindent 0 }} +{{- include "sawtooth.container.block-info-tp" . | nindent 0 }} +{{- include "sawtooth.container.intkey-tp" . | nindent 0 }} +{{- include "sawtooth.container.identity-tp" . | nindent 0 }} +{{- include "sawtooth.container.seth-tp" . | nindent 0 }} +{{- include "sawtooth.container.seth-rpc" . | nindent 0 }} +{{- include "sawtooth.container.smallbank-tp" . | nindent 0 }} +{{- include "sawtooth.container.xo-tp" . | nindent 0 }} +{{- $ctx := .Values -}} +{{- range .Values.sawtooth.customTPs -}} +{{- include "sawtooth.container.customtp" (dict "tp" . "values" $ctx) | nindent 0 }} +{{- end -}} +{{- include "sawtooth.container.rest-api" . | nindent 0 }} +{{- include "sawtooth.container.monitor" . | nindent 0 }} +{{- include "sawtooth.container.validator" . | nindent 0 }} +{{- end -}} + +{{/* +{{ include "sawtooth.loglevel" "container" .Values.sawtooth.containers.validator "global" .Values.global }} +*/}} +{{- define "sawtooth.logLevel" -}} +{{- $defaultLevel := "WARN" -}} +{{- if .global.logLevel -}} +{{- $defaultLevel = (default $defaultLevel .global.logLevel) | upper -}} +{{- end -}} +{{- $level := (default $defaultLevel .container.logLevel) | upper -}} +{{- if eq $level "INFO" -}} +-v +{{- else if eq $level "DEBUG" -}} +-vv +{{- else if eq $level "TRACE" -}} +-vvv +{{- end -}} +{{- end -}} + + diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/_sawtooth_containers.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/_sawtooth_containers.tpl new file mode 100644 index 000000000..d154ed0d5 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/_sawtooth_containers.tpl @@ -0,0 +1,449 @@ + +{{- define "sawtooth.ports.sawcomp" -}} +{{ .Values.sawtooth.ports.sawcomp }} +{{- end -}} + +{{- define "sawtooth.ports.consensus" -}} +{{ .Values.sawtooth.ports.consensus }} +{{- end -}} + +{{- define "sawtooth.ports.rest" -}} +{{ .Values.sawtooth.ports.rest }} +{{- end -}} + +{{- define "sawtooth.ports.sawnet" -}} +{{ .Values.sawtooth.ports.sawnet }} +{{- end -}} + + +{{- define "sawtooth.container.env.nodename" -}} +{{- $consensus := .values.sawtooth.consensus | int -}} +{{- if .values.sawtooth.multi_cluster.enabled }} +- name: LOCAL_NODES_START + value: "{{ .values.sawtooth.multi_cluster.local_nodes.start }}" +{{- end }} +- name: POD_INDEX + valueFrom: + fieldRef: + fieldPath: metadata.labels['apps.kubernetes.io/pod-index'] +- name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name +- name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP +- name: NODE_NAME + # Since this a stateful set we use the pod name as the node name + valueFrom: + fieldRef: +{{- if or .values.sawtooth.statefulset.enabled (eq $consensus 100) }} + fieldPath: metadata.name +{{- else }} + fieldPath: spec.nodeName +{{- end }} +{{- end -}} + +{{/* +{{ include "sawtooth.container.env" (dict "container" .Values.sawtooth.containers.validator "values" .Values)}} +*/}} +{{- define "sawtooth.container.env" -}} +env: + {{- include "sawtooth.container.env.nodename" . | nindent 2 -}} + {{- if .values.pagerduty.enabled }} + - name: ALERT_TOKEN + value: {{ .values.pagerduty.token | quote }} + - name: SERVICE_ID + value: {{ .values.pagerduty.serviceid | quote }} + {{ end -}} +{{- if .container.env -}} + {{- toYaml .container.env | nindent 2 }} +{{- end -}} +{{- end -}} + +{{- define "sawtooth.container.resources" -}} +{{- if .container.resources -}} +resources: {{- toYaml .container.resources | nindent 2 }} +{{- end -}} +{{- end -}} + +{{/* +{{ include "sawtooth.container" (dict "container" .Values.sawtooth.containers.validator "values" .Values "global" .Values.global)}} +*/}} +{{- define "sawtooth.container" -}} +{{- include "lib.image" (dict "imageRoot" .container.image "values" .values "global" .global ) |nindent 0 }} +{{- include "sawtooth.container.command" . | nindent 0 }} +{{- include "sawtooth.container.env" . | nindent 0 }} +{{- include "sawtooth.container.resources" . | nindent 0 }} +{{- end -}} + +{{- define "sawtooth.container.command" -}} +command: [ "bash", "-xc"] +{{- end -}} + +{{- define "sawtooth.container.pbft-engine" -}} +{{ $ctx := dict "container" .Values.sawtooth.containers.pbft_engine "values" .Values "global" .Values.global }} +{{- $signal := "pbft-engine" -}} +- name: pbft-engine + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + rm -f /var/lib/sawtooth/pbft.log + pbft-engine {{ include "sawtooth.logLevel" $ctx }} \ + -C tcp://127.0.0.1:{{ include "sawtooth.ports.consensus" . }} \ + --storage-location disk+/var/lib/sawtooth/pbft.log + lifecycle: + {{- include "sawtooth.signal.postStart" "pbft-engine" | nindent 4 }} + {{- include "sawtooth.signal.livenessProbe" "pbft-engine" | nindent 2 }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "sawtooth.data.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} +{{- end -}} + +{{- define "sawtooth.container.raft-engine" -}} +{{- $ctx := dict "container" .Values.sawtooth.containers.raft_engine "values" .Values "global" .Values.global -}} +- name: raft-engine + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + raft-engine {{ include "sawtooth.logLevel" $ctx }} \ + -C tcp://127.0.0.1:{{ include "sawtooth.ports.consensus" . }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "sawtooth.etc.mount" . | nindent 4 }} + {{- include "sawtooth.data.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} +{{- end -}} + +{{- define "sawtooth.container.poet-engine" -}} +{{- $ctx := dict "container" .Values.sawtooth.containers.poet_engine "values" .Values "global" .Values.global -}} +- name: poet-engine + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + poet-engine {{ include "sawtooth.logLevel" $ctx }} \ + --connect tcp://127.0.0.1:{{ include "sawtooth.ports.consensus" . }} \ + --component tcp://127.0.0.1:{{ include "sawtooth.ports.sawcomp" . }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "sawtooth.etc.mount" . | nindent 4 }} + {{- include "sawtooth.data.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} +- name: poet-validator-registry-tp + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + poet-validator-registry-tp {{ include "sawtooth.logLevel" $ctx }} \ + -C tcp://127.0.0.1:{{ include "sawtooth.ports.sawcomp" . }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "sawtooth.etc.mount" . | nindent 4 }} + {{- include "sawtooth.data.mount" .| nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} +{{- end -}} + +{{- define "sawtooth.container.devmode-engine" -}} +{{- $ctx := dict "container" .Values.sawtooth.containers.devmode_engine "values" .Values "global" .Values.global -}} +- name: devmode-engine + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + devmode-engine-rust {{ include "sawtooth.logLevel" $ctx }} \ + -C tcp://127.0.0.1:{{ include "sawtooth.ports.consensus" . }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} +{{- end -}} + +{{- define "sawtooth.container.settings-tp" -}} +{{- $ctx := dict "container" .Values.sawtooth.containers.settings_tp "values" .Values "global" .Values.global -}} +- name: settings-tp + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + settings-tp {{ include "sawtooth.logLevel" $ctx }} \ + {{ .Values.sawtooth.containers.settings_tp.args }} \ + --connect tcp://127.0.0.1:{{ include "sawtooth.ports.sawcomp" . }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} +{{- end -}} + +{{- define "sawtooth.container.intkey-tp" -}} +{{- $ctx := dict "container" .Values.sawtooth.containers.intkey_tp "values" .Values "global" .Values.global -}} +- name: intkey-tp + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + intkey-tp-go {{ include "sawtooth.logLevel" $ctx }} \ + --connect tcp://127.0.0.1:{{ include "sawtooth.ports.sawcomp" . }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} +{{- end -}} + +{{- define "sawtooth.container.identity-tp" -}} +{{- $ctx := dict "container" .Values.sawtooth.containers.identity_tp "values" .Values "global" .Values.global -}} +{{- if .Values.sawtooth.permissioned -}} +- name: identity-tp + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + identity-tp {{ include "sawtooth.logLevel" $ctx }} \ + {{ .Values.sawtooth.containers.identity_tp.args }} \ + -C tcp://127.0.0.1:{{ include "sawtooth.ports.sawcomp" . }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} +{{- else -}} +# no identity-tp +{{- end -}} +{{- end -}} + +{{- define "sawtooth.container.block-info-tp" -}} +{{- $ctx := dict "container" .Values.sawtooth.containers.block_info "values" .Values "global" .Values.global -}} +- name: block-info-tp + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + block-info-tp {{ include "sawtooth.logLevel" $ctx }} \ + {{ .Values.sawtooth.containers.block_info.args }} \ + -C tcp://127.0.0.1:{{ include "sawtooth.ports.sawcomp" . }} + lifecycle: + {{- include "sawtooth.signal.postStart" "block-info-tp" | nindent 4 }} + {{- include "sawtooth.signal.livenessProbe" "block-info-tp" | nindent 2 }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} +{{- end -}} + +{{- define "sawtooth.container.monitor" -}} +{{- $ctx := dict "container" .Values.sawtooth.containers.monitor "values" .Values "global" .Values.global -}} +- name: monitor + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + sawtooth keygen && \ + sleep {{ .Values.sawtooth.client_wait }} && \ + /usr/local/bin/heartbeat_loop.sh \ + http://127.0.0.1:{{ include "sawtooth.ports.rest" . }} \ + test-$RANDOM {{ .Values.sawtooth.heartbeat.interval }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "sawtooth.etc.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} +{{- end -}} + +{{- define "sawtooth.container.xo-tp" -}} +{{- $ctx := dict "container" .Values.sawtooth.containers.xo_tp "values" .Values "global" .Values.global -}} +{{- if .Values.sawtooth.xo.enabled -}} +- name: xo-tp + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + xo-tp-go {{ include "sawtooth.logLevel" $ctx }} \ + --connect tcp://127.0.0.1:{{ include "sawtooth.ports.sawcomp" . }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} +{{- else -}} +# no xo-tp +{{- end -}} +{{- end -}} + +{{- define "sawtooth.container.smallbank-tp" -}} +{{- $ctx := dict "container" .Values.sawtooth.containers.smallbank_tp "values" .Values "global" .Values.global -}} +{{- if .Values.sawtooth.smallbank.enabled -}} +- name: smallbank-tp + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + smallbank-tp-go {{ include "sawtooth.logLevel" $ctx }} \ + --connect tcp://127.0.0.1:{{ include "sawtooth.ports.sawcomp" . }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} +{{- else -}} +# no smallbank-tp +{{- end -}} +{{- end -}} + +{{- define "sawtooth.container.rest-api" -}} +{{- $ctx := dict "container" .Values.sawtooth.containers.rest_api "values" .Values "global" .Values.global -}} +- name: rest-api + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + sleep {{ .Values.sawtooth.client_wait }} + sawtooth-rest-api {{ include "sawtooth.logLevel" $ctx }} \ + {{ .Values.sawtooth.containers.rest_api.args }} \ + --bind 0.0.0.0:{{ include "sawtooth.ports.rest" . }} \ + --connect tcp://127.0.0.1:{{ include "sawtooth.ports.sawcomp" . }} \ + {{ include "sawtooth.opentsdb" . | indent 8 }} + ports: + - containerPort: {{ include "sawtooth.ports.rest" . }} + name: sawrest + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} +{{- end -}} + +{{- define "sawtooth.container.customtp" -}} +- name: {{ .tp.name }} + image: {{ .tp.image }} + {{ if .tp.command }}command: [ {{ range .tp.command }}"{{ . }}",{{ end }} ]{{end }} + {{ if .tp.args }}args: [ {{ range .tp.args }}"{{ . }}", {{ end }} ]{{end }} + env: + {{- include "sawtooth.container.env.nodename" (dict "values" .values) | nindent 4 }} + lifecycle: {{- include "sawtooth.signal.postStart" .tp.name | nindent 4 }} + {{- include "sawtooth.signal.livenessProbe" .tp.name | nindent 2 }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .values.extraVolumeMounts | nindent 4 }} + resources: {{- default (dict) .tp.resources | toYaml | nindent 4 }} +{{- end -}} + +{{- define "sawtooth.container.poet-registration" -}} +{{- $consensus := .Values.sawtooth.consensus | int -}} +{{- $ctx := dict "container" .Values.sawtooth.containers.poet_registration "values" .Values "global" .Values.global -}} +{{ if eq $consensus 200 }} +- name: poet-registration + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + mkdir -p /etc/sawtooth/poet + cp /etc/sawtooth/simulator_rk_pub.pem /etc/sawtooth/; + if [ ! -f /etc/sawtooth/poet/poet-enclave-measurement ]; then + poet enclave measurement > /etc/sawtooth/poet/poet-enclave-measurement; + fi + if [ ! -f /etc/sawtooth/poet/poet-enclave-basename ]; then + poet enclave basename > /etc/sawtoothetc/poet/poet-enclave-basename; + fi + if [ ! -f /etc/sawtooth/initialized ]; then + poet registration create --enclave-module simulator \ + -k /etc/sawtooth/keys/validator.priv \ + -o /etc/sawtooth/genesis/200.poet.batch + fi + volumeMounts: + {{- include "sawtooth.etc.mount" . | nindent 4 }} + {{- include "sawtooth.data.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} +{{- end -}} +{{- end -}} + +{{- define "sawtooth.container.seth-tp" -}} +{{- $ctx := dict "container" .Values.sawtooth.containers.seth_tp "values" .Values "global" .Values.global -}} +{{- if .Values.sawtooth.seth.enabled -}} +- name: seth-tp + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + seth-tp {{ include "sawtooth.logLevel" $ctx }} \ + --connect tcp://127.0.0.1:{{ include "sawtooth.ports.sawcomp" . }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} +{{- else -}} +# no seth-tp +{{- end -}} +{{- end -}} + +{{- define "sawtooth.container.seth-rpc" -}} +{{- $ctx := dict "container" .Values.sawtooth.containers.seth_rpc "values" .Values "global" .Values.global -}} +{{- if .Values.sawtooth.seth.enabled -}} +- name: seth-rpc + {{- include "sawtooth.container" $ctx | nindent 2 }} + args: + - | + sleep {{ .Values.sawtooth.client_wait }} && \ + seth-rpc {{ include "sawtooth.logLevel" $ctx }} \ + --bind 0.0.0.0:3030 \ + --connect tcp://127.0.0.1:{{ include "sawtooth.ports.sawcomp" . }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} + ports: + - containerPort: 3030 + name: seth-rpc +{{- else -}} +# no seth-rpc +{{- end -}} +{{- end -}} + +{{- define "sawtooth.container.validator.livenessProbe" -}} +{{if .Values.sawtooth.livenessProbe.enabled }} +exec: + command: + - /bin/bash + - -c + - | + export SIGNALS_DIR={{ include "sawtooth.signals.dir" . }} + export EXIT_SIGNALS="{{ .Values.sawtooth.livenessProbe.exitSignals }}" + export LIVENESS_PROBE_ACTIVE="{{ .Values.sawtooth.livenessProbe.active }}" + /usr/local/bin/liveness_probe.sh +initialDelaySeconds: {{ .Values.sawtooth.livenessProbe.initialDelaySeconds }} +periodSeconds: {{ .Values.sawtooth.livenessProbe.periodSeconds }} +{{- end -}} +{{- end -}} + +{{- define "sawtooth.container.validator.lifecycle" -}} +preStop: + exec: + command: + - bash + - -c + - | + export EXIT_SIGNALS="{{ .Values.sawtooth.livenessProbe.exitSignals }}" + for signal in ${EXIT_SIGNALS}; do + touch "{{ include "sawtooth.signals.dir" . }}/$signal" + done +postStart: + exec: + command: + - bash + - -c + - | + RUN_DIR=/var/run/sawtooth + rm -f $RUN_DIR/probe.* + rm -f $RUN_DIR/catchup.started + rm -f $RUN_DIR/last* + rm -f $RUN_DIR/pbft_seq* +{{- end -}} + +{{- define "sawtooth.container.validator" -}} +{{- $ctx := dict "container" .Values.sawtooth.containers.validator "values" .Values "global" .Values.global -}} +- name: validator + {{- include "sawtooth.container" $ctx | nindent 2 }} + lifecycle: + {{- include "sawtooth.container.validator.lifecycle" . | nindent 4 }} + args: + - | + source /opt/chart/scripts/validator-env + {{- include "sawtooth.genesis.create" . | nindent 6 }} + sawtooth-validator {{ include "sawtooth.logLevel" $ctx }} \ + {{ .Values.sawtooth.containers.validator.args}} --scheduler {{ .Values.sawtooth.scheduler }} \ + --endpoint tcp://${ADJUSTED_NODE_NAME}:{{ include "sawtooth.ports.sawnet" . }} \ + {{- include "sawtooth.network" . | nindent 8 -}} \ + ; + {{- include "sawtooth.signal.fire" . | nindent 6 }} + volumeMounts: + {{- include "sawtooth.signals.mount" . | nindent 4 }} + {{- include "sawtooth.etc.mount" . | nindent 4 }} + {{- include "sawtooth.data.mount" . | nindent 4 }} + {{- include "sawtooth.scripts.mount" . | nindent 4 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 4 }} + livenessProbe: + {{- include "sawtooth.container.validator.livenessProbe" . | nindent 4 }} + ports: + - containerPort: {{ include "sawtooth.ports.sawcomp" . }} + name: sawcomp + - containerPort: {{ include "sawtooth.ports.sawnet" . }} + {{- if not .Values.sawtooth.statefulset.enabled }} + hostPort: {{ include "sawtooth.ports.sawnet" . }} + {{- end }} + name: sawnet + - containerPort: {{ include "sawtooth.ports.consensus" . }} + name: consensus +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/_utils.tpl b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/_utils.tpl new file mode 100644 index 000000000..59e89945a --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/_utils.tpl @@ -0,0 +1,16 @@ + + +{{/* */}} +{{- define "utils.hostaliases" -}} +{{- if .Values.hostAliases -}} +{{ toYaml .Values.hostAliases }} +{{- end -}} +{{- end -}} + +{{- define "utils.is_eks" -}} +{{- if and .Values.serviceAccount.annotations (index .Values.serviceAccount.annotations "eks.amazonaws.com/role-arn") -}} +true +{{- else -}} +false +{{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/ingress.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/ingress.yaml new file mode 100644 index 000000000..c21fa1b8c --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/ingress.yaml @@ -0,0 +1,6 @@ +{{- if .Values.ingress.enabled -}} +{{- $serviceName := include "common.names.fullname" . -}} +{{- $ingressName := printf "%s-rest" $serviceName -}} +{{- $servicePort := include "sawtooth.ports.rest" . | int -}} +{{ include "lib.ingress" (dict "ingressName" $ingressName "ingress" .Values.ingress "serviceName" $serviceName "servicePort" $servicePort "context" $) }} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/peered-nodes.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/peered-nodes.yaml new file mode 100644 index 000000000..ecedbf406 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/peered-nodes.yaml @@ -0,0 +1,30 @@ +{{- if .Values.sawtooth.multi_cluster.enabled }} +{{- $ctx := . -}} +{{- range .Values.sawtooth.multi_cluster.peered_nodes }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "common.names.fullname" $ctx }}-{{ .index }} + namespace: {{ $.Release.Namespace }} + labels: + app: {{ include "common.names.fullname" $ctx }} + role: external-validator +spec: + type: ExternalName + externalName: {{ .cname }} + ports: + - port: {{ include "sawtooth.ports.rest" $ctx }} + protocol: TCP + targetPort: {{ include "sawtooth.ports.rest" $ctx }} + name: rest-api + - port: {{ include "sawtooth.ports.sawnet" $ctx }} + protocol: TCP + targetPort: {{ include "sawtooth.ports.sawnet" $ctx }} + name: sawnet + - port: {{ include "sawtooth.ports.sawcomp" $ctx }} + protocol: TCP + targetPort: {{ include "sawtooth.ports.sawcomp" $ctx }} + name: sawcomp +--- +{{- end }} +{{- end }} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/pernode-services.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/pernode-services.yaml new file mode 100644 index 000000000..25bd9f803 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/pernode-services.yaml @@ -0,0 +1,62 @@ +{{- /* +This template generates per-node services for Sawtooth nodes. +When multi_cluster.enabled is true, services are created only for local nodes. +*/ -}} + +{{- $consensus := int .Values.sawtooth.consensus -}} +{{- $statefulsetEnabled := .Values.sawtooth.statefulset.enabled -}} +{{- if or $statefulsetEnabled (eq $consensus 100) -}} + +{{- $multiClusterEnabled := .Values.sawtooth.multi_cluster.enabled | default false -}} +{{- $replicas := int (include "sawtooth.replicas" .) -}} + +{{- $localNodesStart := int (default 0 .Values.sawtooth.multi_cluster.local_nodes.start) -}} + +{{- /* Calculate the end index based on localNodesStart and replicas */ -}} +{{- $localNodesEnd := add $localNodesStart $replicas | int -}} + +# Generating {{ $replicas }} per-node services starting from index {{ $localNodesStart }} +{{- $ctx := . }} +{{- range $i := until $replicas }} +--- +apiVersion: v1 +kind: Service +metadata: + labels: + {{- include "sawtooth.labels" $ctx | nindent 4 }} + per-node: {{ include "common.names.fullname" $ctx }}-{{ $i }} + component: sawtooth + name: {{ include "common.names.fullname" $ctx }}-{{ add $i $localNodesStart }} + namespace: {{ $.Release.Namespace }} + {{- if and $multiClusterEnabled (include "utils.is_eks" $) }} + annotations: + service.beta.kubernetes.io/aws-load-balancer-internal: "true" + {{- end }} +spec: + selector: + {{- include "sawtooth.labels.matchLabels" $ctx | nindent 4 }} + statefulset.kubernetes.io/pod-name: {{ include "common.names.fullname" $ctx }}-{{ $i }} + {{ if $multiClusterEnabled }} + type: LoadBalancer + {{ else }} + type: ClusterIP + {{ end }} + publishNotReadyAddresses: true + ports: + - port: {{ include "sawtooth.ports.rest" $ctx }} + protocol: TCP + targetPort: {{ include "sawtooth.ports.rest" $ctx }} + name: rest-api + - port: {{ include "sawtooth.ports.sawnet" $ctx }} + protocol: TCP + targetPort: {{ include "sawtooth.ports.sawnet" $ctx }} + name: sawnet + - port: {{ include "sawtooth.ports.sawcomp" $ctx }} + protocol: TCP + targetPort: {{ include "sawtooth.ports.sawcomp" $ctx }} + name: sawcomp + +{{- end }} +--- +# no enodes +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/serviceaccount.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/serviceaccount.yaml new file mode 100644 index 000000000..65c669296 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "lib.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +automountServiceAccountToken: false +{{ if .Values.imagePullSecrets.enabled }} +imagePullSecrets: +{{range .Values.imagePullSecrets.value }} + - name: {{ .name }} +{{ end }} +{{ end }} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-clusterroles.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-clusterroles.yaml new file mode 100644 index 000000000..c161b1b90 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-clusterroles.yaml @@ -0,0 +1,24 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .Release.Namespace}}-{{include "common.names.fullname" .}} + labels: {{ include "sawtooth.labels" . | nindent 4 }} +rules: + - apiGroups: ["","apps/v1"] # "" refers to the core API group + resources: ["nodes"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .Release.Namespace}}-{{include "common.names.fullname" .}} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ .Release.Namespace}}-{{include "common.names.fullname" .}} +subjects: +- kind: ServiceAccount + name: {{ include "lib.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-env-configmap.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-env-configmap.yaml new file mode 100644 index 000000000..342d80382 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-env-configmap.yaml @@ -0,0 +1,143 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "common.names.fullname" . }}-scripts + namespace: {{ .Release.Namespace }} + labels: + {{ include "sawtooth.labels" . | nindent 4 }} +data: + validator-env: |- + #!/bin/bash + + BIN_DIR="/usr/local/bin" + + function get_genesis_node() { + kubectl get configmap {{ include "common.names.fullname" . }}-genesis -o jsonpath='{.data.node}' + } + + # Function to extract the numeric index from a pod name + function extract_index() { + local name="$1" + # Extract the number after the last hyphen + echo "${name##*-}" + } + + # Function to get the node name for a pod + function get_node_for_pod() { + local pod_name="$1" + local index=$(extract_index "$pod_name") + LOCAL_NODES_START={{ .Values.sawtooth.multi_cluster.local_nodes.start | default 0 }} + OFFSET_INDEX=$((index + LOCAL_NODES_START)) + echo "{{ include "common.names.fullname" . }}-$OFFSET_INDEX" + } + + # Function to get all local pods + function get_local_pods() { + kubectl get pods -l 'app={{ include "common.names.fullname" . }},component=sawtooth' \ + -o custom-columns=NAME:.metadata.name --no-headers=true | sort -t '-' -k3 -n + } + + # Function to get all local nodes + function get_all_local_nodes() { + get_local_pods | while read -r pod; do + get_node_for_pod "$pod" + done + } + + function get_all_peered_nodes() { + {{- $root := . }} + {{- if and (default false $root.Values.sawtooth.multi_cluster.enabled) (gt (len (default (list) $root.Values.sawtooth.multi_cluster.peered_nodes)) 0) }} + {{- range $peer := $root.Values.sawtooth.multi_cluster.peered_nodes }} + NODE_INDEX={{ $peer.index }} + echo "{{ include "common.names.fullname" $root }}-$NODE_INDEX" + {{- end }} + {{- else }} + # No peered nodes + : + {{- end }} + } + + + # Build local_host_list + local_host_list=() + while read -r node; do + local_host_list+=("$node") + done < <(get_all_local_nodes) + + # Build peered_host_list + peered_host_list=() + while read -r node; do + if [ -n "$node" ]; then + peered_host_list+=("$node") + fi + done < <(get_all_peered_nodes) + + # Combine to create host_list + host_list=("${local_host_list[@]}" "${peered_host_list[@]}") + + # Identify current pod's node name using hostname + MY_NODE_NAME=$(get_node_for_pod "$(hostname)") + + echo "Current Node Name: $MY_NODE_NAME" + + # Initialize SEEDS and PEERS + SEEDS="" + PEERS="" + export DELAY=0 + + # Populate SEEDS and PEERS excluding the current node + for node in "${host_list[@]}"; do + if [ "$node" != "$MY_NODE_NAME" ]; then + SEEDS="$SEEDS --seeds tcp://$node:{{ .Values.sawtooth.ports.sawnet }}" + PEERS="$PEERS --peers tcp://$node:{{ .Values.sawtooth.ports.sawnet }}" + else + ((DELAY += 1)) + fi + done + + export SEEDS + export PEERS + + echo "SEEDS: $SEEDS" + echo "PEERS: $PEERS" + + # Set ADJUSTED_NODE_NAME + export ADJUSTED_NODE_NAME="$MY_NODE_NAME" + + SET_GENESIS_NODE=${host_list[0]} + + GENESIS_NODE=$(get_genesis_node) + while [ -z "$GENESIS_NODE" ]; do + sleep "$(echo $RANDOM | cut -c1-2)" + GENESIS_NODE=$(get_genesis_node) + if [ -z "$GENESIS_NODE" ]; then + "${BIN_DIR}/upsert_cm.sh" {{ include "common.names.fullname" . }}-genesis node "$SET_GENESIS_NODE" + fi + done + GENESIS_NODE=$(get_genesis_node) + + # Upsert validator public and secret keys + "${BIN_DIR}/upsert_cm.sh" validator-public "$MY_NODE_NAME" "$(cat /etc/sawtooth/keys/validator.pub)" + "${BIN_DIR}/upsert_cm.sh" validator-secret "$MY_NODE_NAME" "$(cat /etc/sawtooth/keys/validator.priv)" + + {{- if .Values.sawtooth.genesis.enabled }} + if [ "$GENESIS_NODE" = "$NODE_NAME" ]; then + export RUN_GENESIS=1 + echo "This node ($NODE_NAME) is the Genesis node." + if [ ! -r /etc/sawtooth/initialized ]; then + PODCOUNT=$(get_local_pods | wc -l) + KEYCOUNT=$("${BIN_DIR}/get_local_public_keys.sh" "{{ .Release.Namespace }}" | wc -l) + echo "Waiting for all pods to be ready. Current PODCOUNT: $PODCOUNT, KEYCOUNT: $KEYCOUNT" + while [ "$PODCOUNT" != "$KEYCOUNT" ]; do + sleep "$DELAY" + PODCOUNT=$(get_local_pods | wc -l) + KEYCOUNT=$("${BIN_DIR}/get_local_public_keys.sh" "{{ .Release.Namespace }}" | wc -l) + echo "Still waiting. PODCOUNT: $PODCOUNT, KEYCOUNT: $KEYCOUNT" + done + echo "All pods are ready. PODCOUNT: $PODCOUNT, KEYCOUNT: $KEYCOUNT" + fi + else + export RUN_GENESIS=0 + echo "This node ($NODE_NAME) is not the Genesis node." + fi + {{- end }} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-roles.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-roles.yaml new file mode 100644 index 000000000..305b01809 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-roles.yaml @@ -0,0 +1,30 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{include "common.names.fullname" .}} + namespace: {{ .Release.Namespace }} + labels: {{ include "sawtooth.labels" . | nindent 4 }} +rules: + - apiGroups: ["","apps/v1"] # "" refers to the core API group + resources: ["services", "pods"] + verbs: ["get", "list", "watch"] + - apiGroups: ["","apps/v1"] # "" refers to the core API group + resources: ["configmaps"] + verbs: ["get", "create", "list", "watch", "patch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{include "common.names.fullname" .}} + namespace: {{ .Release.Namespace }} + labels: {{ include "sawtooth.labels" . | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{include "common.names.fullname" .}} +subjects: +- kind: ServiceAccount + name: {{ include "lib.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +--- diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-set.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-set.yaml new file mode 100644 index 000000000..806016ba9 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validator-set.yaml @@ -0,0 +1,67 @@ +{{ $consensus := .Values.sawtooth.consensus | int }} +--- +apiVersion: apps/v1 +kind: {{ include "sawtooth.kind" . }} +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: {{ include "sawtooth.labels" . | nindent 4}} +spec: + {{ if or .Values.sawtooth.statefulset.enabled (eq $consensus 100) -}} + replicas: {{ include "sawtooth.replicas" . | int }} + serviceName: {{ include "common.names.fullname" . | quote }} + podManagementPolicy: Parallel + {{- end }} + updateStrategy: + type: RollingUpdate + {{ if not (or .Values.sawtooth.statefulset.enabled (eq $consensus 100)) }} + rollingUpdate: + maxUnavailable: {{ .Values.sawtooth.maxUnavailable | int }} + {{- end }} + {{ if (semverCompare "^1.22" .Capabilities.KubeVersion.Version) -}} + minReadySeconds: {{ .Values.sawtooth.minReadySeconds | int }} + {{- end }} + selector: + matchLabels: {{- include "sawtooth.labels.matchLabels" . | nindent 6 }} + template: + metadata: + labels: {{- include "sawtooth.labels.matchLabels" . | nindent 8 }} + annotations: {{- toYaml .Values.sawtooth.statefulset.podAnnotations | nindent 8 }} + spec: + serviceAccountName: {{ include "lib.serviceAccountName" . }} + automountServiceAccountToken: true + affinity: {{- include "sawtooth.affinity" . | nindent 8 }} + hostAliases: {{- include "sawtooth.hostaliases" . | nindent 8 }} + containers: {{- include "sawtooth.containers" . | nindent 8 }} + initContainers: + - name: setup + {{- include "lib.image" (dict "imageRoot" .Values.sawtooth.containers.validator.image "global" .Values.global ) |nindent 10 }} + volumeMounts: + {{- include "sawtooth.etc.mount" . | nindent 12 }} + {{- include "sawtooth.data.mount" . | nindent 12 }} + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 12 }} + {{- include "sawtooth.container.command" . | nindent 10 }} + {{- include "sawtooth.container.env" (dict "container" .Values.sawtooth.containers.validator "values" .Values "global" .Values.global) | nindent 10 }} + args: + - | + {{- include "sawtooth.genesis.reset" . | nindent 14 }} + mkdir -p /etc/sawtooth/genesis + mkdir -p /etc/sawtooth/keys + if [ ! -r /etc/sawtooth/keys/validator.priv ]; then + sawadm keygen --force + fi + {{ if .Values.sawtooth.genesis.enabled }} + {{- include "sawtooth.container.poet-registration" . | nindent 8 }} + {{ end }} + volumes: + {{- include "sawtooth.signals.volume" . | nindent 8 }} + {{- include "sawtooth.scripts.volume" . | nindent 8 }} + {{- include "lib.volumes" .Values.extraVolumes | nindent 8 }} +{{ if or .Values.sawtooth.statefulset.enabled (eq $consensus 100) }} + volumeClaimTemplates: + {{- include "sawtooth.data.volume.vct" . | nindent 4 }} + {{- include "sawtooth.etc.volume.vct" . | nindent 4 }} +{{ else }} + {{- include "sawtooth.etc.volume" . | nindent 8 }} + {{- include "sawtooth.data.volume" . | nindent 8 }} +{{ end }} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validators-svcs.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validators-svcs.yaml new file mode 100644 index 000000000..e5a034dc4 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/templates/validators-svcs.yaml @@ -0,0 +1,26 @@ +--- + +apiVersion: v1 +kind: Service +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: {{ include "sawtooth.labels" . | nindent 4}} + component: sawtooth +spec: + type: ClusterIP + clusterIP: None + ports: + - port: {{ include "sawtooth.ports.rest" . }} + protocol: TCP + targetPort: {{ include "sawtooth.ports.rest" . }} + name: rest-api + - port: {{ include "sawtooth.ports.sawnet" . }} + protocol: TCP + targetPort: {{ include "sawtooth.ports.sawnet" . }} + name: sawnet + - port: {{ include "sawtooth.ports.sawcomp" . }} + protocol: TCP + targetPort: {{ include "sawtooth.ports.sawcomp" . }} + name: sawcomp + selector: {{- include "sawtooth.labels.matchLabels" . | nindent 4 }} diff --git a/charts/paravela/chronicle/0.1.27/charts/sawtooth/values.yaml b/charts/paravela/chronicle/0.1.27/charts/sawtooth/values.yaml new file mode 100644 index 000000000..1ff5bc7da --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/sawtooth/values.yaml @@ -0,0 +1,488 @@ +--- +## @md # Sawtoooth +## @md +## @md | field | description | default | +## @md |-|-|-| + +affinity: + ## @md | `affinity.enabled` | false: no effect true: then validators will be deployed only to k8s nodes with the label `app={{ .sawtooth.networkName }}-validator` | false | + # Normally set this as disabled. + # If false - no effect, validators are run on every ( or in the case of devmode any one) + # node in the cluster. + # If True, then validators will be deployed only to k8s nodes with the label + # app={{ .sawtooth.networkName }}-validator + enabled: false + +global: + logLevel: warn + image: + registry: + tag: + +## @md | `commonLabels` | +commonLabels: {} +commonAnnotations: {} +# This is optional, +# if false the values are ignored, +# if true then there should exist a secret within the namespace +# of the given names, multiple values are acceptable +hostAliases: +imagePullSecrets: + ## @md | `imagePullSecrets.enabled` | if true use the list of named imagePullSecrets | false | + enabled: false + ## @md | `imagePullSecrets.value` | a list if named secret references of the form ```- name: secretName```| [] | + value: [] +ingress: + ## @md | `ingress.apiVersion` | if necessary the apiVersion of the ingress may be overridden | "" | + apiVersion: "" + ## @md | `ingress.enabled` | true to enable the ingress to the main service rest-api | false | + enabled: false + ## @md | `ingress.certManager` | true to enable the acme certmanager for this ingress | false | + certManager: false + ## @md | `ingress.hostname` | primary hostname for the ingress | false | + hostname: "sawtooth.local" + ## @md | `ingress.path` | path for the ingress's primary hostname | / | + path: / + ## @md | `ingress.pathType` | pathType for the ingress's primary hostname | nil | + pathType: + ## @md | `ingress.annotations` | annotations for the ingress | {} | + annotations: {} + ## @md | `ingress.tls` | true to enable tls on the ingress with a secrete at hostname-tls | false | + tls: false + ## @md | `ingress.extraHosts` | list of extra hosts to add to the ingress | [] | + extraHosts: [] + ## @md | `ingress.extraPaths` | list of extra paths to add to the primary host of the ingress | [] | + extraPaths: [] + ## @md | `ingress.extraTls` | list of extra tls entries | [] | + extraTls: [] +pagerduty: + ## @md | `pagerduty.enabled` | if true send pagerduty alerts | false | + enabled: false + ## @md | `pagerduty.token` | pagerduty user token | nil | + token: + ## @md | `pagerduty.serviceid` | pagerduty serviceid | nil | + serviceid: +sawtooth: + opentsdb: + ## @md | `sawtooth.opentsdb.db` | name of the opentsdb database to be used | metrics | + db: metrics + ## @md | `sawtooth.opentsdb.url` | url of the opentsdb database to be used | nil | + url: + ## @md | `sawtooth.opentsdb.enabled` | whether to enable the opentsdb metrics | false | + enabled: false + statefulset: + enabled: true + replicas: + podAnnotations: + ## @md | `sawtooth.minReadySeconds` | the minimum time a pod must be Running before proceeding on a rolling update | 120 | + minReadySeconds: 120 + ## @md | `sawtooth.maxUnavailable` | maximum number of pods allowed down on a rollout or update | 1 | + maxUnavailable: 1 + containers: + block_info: + ## @md | `sawtooth.containers.block_info.args` | extra args for block-info-tp | nil | + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-block-info-tp + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "250m" + requests: + cpu: "50m" + devmode_engine: + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-devmode-engine-rust + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "250m" + requests: + cpu: "50m" + identity_tp: + ## @md | `sawtooth.containers.identity_tp.args` | extra args for identity-tp | nil | + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-identity-tp + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "250m" + requests: + cpu: "50m" + intkey_tp: + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-intkey-tp-go + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "250m" + requests: + cpu: "50m" + monitor: + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-shell + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "100m" + requests: + cpu: "100m" + pbft_engine: + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-pbft-engine + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "250m" + requests: + cpu: "50m" + poet_engine: + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-poet-engine + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "250m" + requests: + cpu: "50m" + poet_validator_registry_tp: + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-poet-validator-registry-tp + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "250m" + requests: + cpu: "50m" + poet_registration: + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-poet-cli + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "250m" + requests: + cpu: "50m" + raft_engine: + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-raft-engine + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "250m" + requests: + cpu: "50m" + rest_api: + ## @md | `sawtooth.containers.rest_api.args` | extra args for rest-api | nil | + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-rest-api + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "250m" + requests: + cpu: "50m" + seth_rpc: + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-seth-rpc + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "250m" + requests: + cpu: "50m" + seth_tp: + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-seth-tp + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "250m" + requests: + cpu: "50m" + settings_tp: + ## @md | `sawtooth.containers.settings_tp.args` | extra args for settings-tp | nil | + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-settings-tp + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "250m" + requests: + cpu: "50m" + smallbank_tp: + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-smallbank-tp-go + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "250m" + requests: + cpu: "50m" + validator: + ## @md | `sawtooth.containers.validator.args` | extra args for validator | nil | + args: + ## @md | `sawtooth.containers.validator.env` | list of environment name/value dicts | nil | + env: + - name: RUST_BACKTRACE + value: "1" + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-validator + tag: BTP2.1.0 + logLevel: + resources: {} + xo_tp: + args: + env: + image: + pullPolicy: + registry: + repository: blockchaintp/sawtooth-xo-tp-go + tag: BTP2.1.0 + logLevel: + resources: + limits: + cpu: "250m" + requests: + cpu: "50m" + perNodeServiceType: ClusterIP + perNodeSessionAffinity: ClientIP + persistence: + enabled: true + annotations: + accessModes: + - "ReadWriteOnce" + storageClass: + size: 40Gi + ports: + ## @md | `sawtooth.ports.sawnet` | port for the sawtooth validator network | 8800 | + sawnet: 8800 + ## @md | `sawtooth.ports.consensus` | port for the sawtooth consensus network | 5050 | + consensus: 5050 + ## @md | `sawtooth.ports.sawcomp` | port for the sawtooth component network | 4004 | + sawcomp: 4004 + ## @md | `sawtooth.ports.rest` | port for the sawtooth rest-api | 8008 | + rest: 8008 + livenessProbe: + ## @md | `sawtooth.livenessProbe.enabled` | whether to run the livenessProbe on the validator | false | + enabled: false + ## @md | `sawtooth.livenessProbe.initialDelaySeconds` | seconds to wait before running the liveness probe the first time | 300 | + initialDelaySeconds: 300 + ## @md | `sawtooth.livenessProbe.periodSeconds` | interval in seconds to re-run the liveness probe | 120 | + periodSeconds: 120 + ## @md | `sawtooth.livenessProbe.active` | if false, the liveness probe will run and evaluate the the situation, but always return successfully | string | "false" + active: "false" + ## @md | `sawtooth.livenessProbe.exitSignals` | when restarting due to a livenessProbe failure, the validator pod has a "signal" system which will cause it to restart the named containers in this var | "block-info-tp" | + exitSignals: "block-info-tp pbft-engine" + heartbeat: + ## @md | `sawtooth.heartbeat.interval` | interval in seconds to issue a heartbeat | 300 | + interval: 300 + + ## @md | `sawtooth.permissioned` | Whether to run this chain as a permissioned chain or not | false | + permissioned: false + # This MUST be chosen by the user + # Follows DNS naming rules + ## @md | `sawtooth.namespace` | namespace to render these templates into (deprecated) | "prod" | + namespace: prod + # This MUST be chosen by the user. + # Follows DNS naming rules + ## @md | `sawtooth.networkName` | name of this sawtooth network (deprecated) | "mynetwork" | + networkName: mynetwork + # serial or parallel + ## @md | `sawtooth.scheduler` | name of the sawtooth transaction scheduler to use | string | "serial" + scheduler: serial + # 100 - DevMode, 200 - PoET,300 - Raft, 400 - pbft + # Engines can be enabled, but they aren't active unless they are selected + # as the consensus algorithm. + ## @md | `sawtooth.consensus` | id of the the consensus algorithm to use< valid values: 100:DevMode, 200, PoET, 300 - Raft, 400, PBFT | int | 200 + consensus: 200 + genesis: + ## @md | `sawtooth.genesis.enabled` | If true, and the cluster is starting for the first time, then a node will be selected to create and submit the genesis block | true | + enabled: true + ## @md | `sawtooth.genesis.seed` | The seed is an arbitrary string which identifies a given genesis If the data of a given set of nodes is to be wiped out, change this value. | "9a2de774-90b5-11e9-9df0-87e889b0f1c9" | + seed: "9a2de774-90b5-11e9-9df0-87e889b0f1c9" + ## @md | `sawtooth.dynamicPeering` | Dynamic Peering should default to false, since it is a bit unreliable | false | + dynamicPeering: false + ## @md | `sawtooth.externalSeeds` | a list of maps defining validator endpoints external to this deployment | [] | + externalSeeds: [] + ## @md | `multi_cluster.enabled` | false: multi-cluster support is disabled, true: multi-cluster support is enabled | false | + multi_cluster: + ## @md | `multi_cluster.peers` | list of peer clusters for multi-cluster support | [] | + enabled: false + ## @md | `multi_cluster.local_nodes` | range of local nodes, index will start here and increment until the number of replicas is reached | [] | + local_nodes: + start: 0 + peered_nodes: [] + seth: + # This should default to false, there appear to be problems with the required + # block_info block injector that this depends upon + ## @md | `sawtooth.seth.enabled` | enabled sawtooth-seth | false | + enabled: false + xo: + # default this to false since you probably don't want it in real life + ## @md | `sawtooth.xo.enabled` | enabled sawtooth-xo-tp | false | + enabled: false + smallbank: + # default this to false since you probably don't want it in real life + ## @md | `sawtooth.smallbank.enabled` | enabled sawtooth-smallbank-tp | false | + enabled: false + volumes: + # This MUST be set, and SHOULD be presented to the user as an option, as it is a likely area + # of customization + ## @md | `sawtooth.hostPathBaseDir` | all sawtooth hostPath directories will be based here | string | /var/lib/btp + hostPathBaseDir: /var/lib/btp/ + # This is an arbitrary cool down period to wait for validators to initialize + # before starting any client operations + ## @md | `sawtooth.client_wait` | arbitrary delay to validator client startup, such as the rest-api | 90 | + client_wait: 90 + ## @md | `sawtooth.customTPs` | a list of [custom tp definitions](#custom-tp-definitions) | nil | + customTPs: + # A list of basic container definitions + # - name: intkey-tp + # image: "blockchaintp/sawtooth-intkey-tp-go:1.0.5" + # command: [ "bash", "-c" ] + # args: [ "intkey-tp-go -v --connect tcp://localhost:4004" ] + ## @md | `sawtooth.affinity` | custom affinity rules for the sawtooth validator deamonset | nil | + affinity: {} + +serviceAccount: + create: true + name: +# The below are mostly controlled by BTP, although an "advanced" option to customize them may be +# presented +## @md | `images` | a map containing all of the image urls used by this template| N/A | +images: + ## @md + ## @md ## Images + ## @md + ## @md | field | default | + ## @md |- |- | + ## @md | `images.devmode_engine` | blockchaintp/sawtooth-devmode-engine-rust:BTP2.1.0 + devmode_engine: + ## @md | `images.pbft_engine` | blockchaintp/sawtooth-pbft-engine:BTP2.1.0 + pbft_engine: + ## @md | `images.poet_cli` | blockchaintp/sawtooth-poet-cli:BTP2.1.0 + poet_cli: + ## @md | `images.poet_engine` | blockchaintp/sawtooth-poet-engine:BTP2.1.0 + poet_engine: + ## @md | `images.poet_validator_registry_tp` | blockchaintp/sawtooth-poet-validator-registry-tp:BTP2.1.0 + poet_validator_registry_tp: + ## @md | `images.raft_engine` | blockchaintp/sawtooth-raft-engine:BTP2.1.0 + raft_engine: + ## @md | `images.block_info_tp` | blockchaintp/sawtooth-block-info-tp:BTP2.1.0 + block_info_tp: + ## @md | `images.identity_tp` | blockchaintp/sawtooth-identity-tp:BTP2.1.0 + identity_tp: + ## @md | `images.intkey_tp` | blockchaintp/sawtooth-intkey-tp-go:BTP2.1.0 + intkey_tp: + ## @md | `images.settings_tp` | blockchaintp/sawtooth-settings-tp:BTP2.1.0 + settings_tp: + ## @md | `images.shell` | blockchaintp/sawtooth-shell:BTP2.1.0 + shell: + ## @md | `images.smallbank_tp` | blockchaintp/sawtooth-smallbank-tp-go:BTP2.1.0 + smallbank_tp: + ## @md | `images.validator` | blockchaintp/sawtooth-validator:BTP2.1.0 + validator: + ## @md | `images.xo_tp` | blockchaintp/sawtooth-xo-tp-go:BTP2.1.0 + xo_tp: + ## @md | `images.rest_api` | blockchaintp/sawtooth-rest-api:BTP2.1.0 + rest_api: + ## @md | `images.seth_rpc` | blockchaintp/sawtooth-seth-rpc:BTP2.1.0 + seth_rpc: + ## @md | `images.seth_tp` | blockchaintp/sawtooth-seth-tp:BTP2.1.0 + seth_tp: + ## @md | `images.xo_demo` | blockchaintp/xo-demo:BTP2.1.0 + xo_demo: + +## @md +## @md ## Custom TP Definitions +## @md +## @md Custom TP definitions are describe using maps with the following fields +## @md +## @md | field | description | default | +## @md |-|-|-| +## @md | `name` | name of the custom tp container(must be unique within the pod) | nil | +## @md | `image` | url of the image for this tp | nil | +## @md | `command` | list of command tokens for this tp | list | nil +## @md | `arg` | list of arguments to the command | nil] | + +## @md | `extraVolumes` | a list of additional volumes to add to all StatefulSets, Deployments, and DaemonSets | `[]` | +extraVolumes: [] +## @md | `extraVolumeMounts` | a list of additional volume mounts to add to all StatefulSet, Deployment, and DaemonSet containers | `[]` | +extraVolumeMounts: [] diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/Chart.lock b/charts/paravela/chronicle/0.1.27/charts/standard-defs/Chart.lock new file mode 100644 index 000000000..1527b8ebd --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: common + repository: https://raw.githubusercontent.com/bitnami/charts/pre-2022/bitnami + version: 1.8.0 +digest: sha256:bdd898d81e711e825f3bfc9e0b0e0668382ff1ff02d74874b6b6997ae0bbc9ce +generated: "2022-06-17T20:57:49.357553367Z" diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/Chart.yaml b/charts/paravela/chronicle/0.1.27/charts/standard-defs/Chart.yaml new file mode 100644 index 000000000..459af8bc2 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +appVersion: 0.1.0 +dependencies: +- name: common + repository: https://raw.githubusercontent.com/bitnami/charts/pre-2022/bitnami + version: ~1.8.0 +description: BTP Standard Template definitions and dependencies +name: standard-defs +type: library +version: 0.1.3 diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/README.md b/charts/paravela/chronicle/0.1.27/charts/standard-defs/README.md new file mode 100644 index 000000000..e69de29bb diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/.helmignore b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/.helmignore new file mode 100644 index 000000000..50af03172 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/.helmignore @@ -0,0 +1,22 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/Chart.yaml b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/Chart.yaml new file mode 100644 index 000000000..344c40384 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/Chart.yaml @@ -0,0 +1,23 @@ +annotations: + category: Infrastructure +apiVersion: v2 +appVersion: 1.8.0 +description: A Library Helm Chart for grouping common logic between bitnami charts. + This chart is not deployable by itself. +home: https://github.com/bitnami/charts/tree/master/bitnami/common +icon: https://bitnami.com/downloads/logos/bitnami-mark.png +keywords: +- common +- helper +- template +- function +- bitnami +maintainers: +- email: containers@bitnami.com + name: Bitnami +name: common +sources: +- https://github.com/bitnami/charts +- http://www.bitnami.com/ +type: library +version: 1.8.0 diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/README.md b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/README.md new file mode 100644 index 000000000..054e51f96 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/README.md @@ -0,0 +1,327 @@ +# Bitnami Common Library Chart + +A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for grouping common logic between bitnami charts. + +## TL;DR + +```yaml +dependencies: + - name: common + version: 0.x.x + repository: https://charts.bitnami.com/bitnami +``` + +```bash +$ helm dependency update +``` + +```yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "common.names.fullname" . }} +data: + myvalue: "Hello World" +``` + +## Introduction + +This chart provides a common template helpers which can be used to develop new charts using [Helm](https://helm.sh) package manager. + +Bitnami charts can be used with [Kubeapps](https://kubeapps.com/) for deployment and management of Helm Charts in clusters. This Helm chart has been tested on top of [Bitnami Kubernetes Production Runtime](https://kubeprod.io/) (BKPR). Deploy BKPR to get automated TLS certificates, logging and monitoring for your applications. + +## Prerequisites + +- Kubernetes 1.12+ +- Helm 3.1.0 + +## Parameters + +The following table lists the helpers available in the library which are scoped in different sections. + +### Affinities + +| Helper identifier | Description | Expected Input | +|-------------------------------|------------------------------------------------------|------------------------------------------------| +| `common.affinities.node.soft` | Return a soft nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | +| `common.affinities.node.hard` | Return a hard nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | +| `common.affinities.pod.soft` | Return a soft podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | +| `common.affinities.pod.hard` | Return a hard podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | + +### Capabilities + +| Helper identifier | Description | Expected Input | +|----------------------------------------------|------------------------------------------------------------------------------------------------|-------------------| +| `common.capabilities.kubeVersion` | Return the target Kubernetes version (using client default if .Values.kubeVersion is not set). | `.` Chart context | +| `common.capabilities.cronjob.apiVersion` | Return the appropriate apiVersion for cronjob. | `.` Chart context | +| `common.capabilities.deployment.apiVersion` | Return the appropriate apiVersion for deployment. | `.` Chart context | +| `common.capabilities.statefulset.apiVersion` | Return the appropriate apiVersion for statefulset. | `.` Chart context | +| `common.capabilities.ingress.apiVersion` | Return the appropriate apiVersion for ingress. | `.` Chart context | +| `common.capabilities.rbac.apiVersion` | Return the appropriate apiVersion for RBAC resources. | `.` Chart context | +| `common.capabilities.crd.apiVersion` | Return the appropriate apiVersion for CRDs. | `.` Chart context | +| `common.capabilities.policy.apiVersion` | Return the appropriate apiVersion for policy | `.` Chart context | +| `common.capabilities.supportsHelmVersion` | Returns true if the used Helm version is 3.3+ | `.` Chart context | + +### Errors + +| Helper identifier | Description | Expected Input | +|-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------| +| `common.errors.upgrade.passwords.empty` | It will ensure required passwords are given when we are upgrading a chart. If `validationErrors` is not empty it will throw an error and will stop the upgrade action. | `dict "validationErrors" (list $validationError00 $validationError01) "context" $` | + +### Images + +| Helper identifier | Description | Expected Input | +|-----------------------------|------------------------------------------------------|---------------------------------------------------------------------------------------------------------| +| `common.images.image` | Return the proper and full image name | `dict "imageRoot" .Values.path.to.the.image "global" $`, see [ImageRoot](#imageroot) for the structure. | +| `common.images.pullSecrets` | Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global` | +| `common.images.renderPullSecrets` | Return the proper Docker Image Registry Secret Names (evaluates values as templates) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $` | + +### Ingress + +| Helper identifier | Description | Expected Input | +|-------------------------------------------|----------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.ingress.backend` | Generate a proper Ingress backend entry depending on the API version | `dict "serviceName" "foo" "servicePort" "bar"`, see the [Ingress deprecation notice](https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/) for the syntax differences | +| `common.ingress.supportsPathType` | Prints "true" if the pathType field is supported | `.` Chart context | +| `common.ingress.supportsIngressClassname` | Prints "true" if the ingressClassname field is supported | `.` Chart context | + +### Labels + +| Helper identifier | Description | Expected Input | +|-----------------------------|------------------------------------------------------|-------------------| +| `common.labels.standard` | Return Kubernetes standard labels | `.` Chart context | +| `common.labels.matchLabels` | Return the proper Docker Image Registry Secret Names | `.` Chart context | + +### Names + +| Helper identifier | Description | Expected Inpput | +|-------------------------|------------------------------------------------------------|-------------------| +| `common.names.name` | Expand the name of the chart or use `.Values.nameOverride` | `.` Chart context | +| `common.names.fullname` | Create a default fully qualified app name. | `.` Chart context | +| `common.names.chart` | Chart name plus version | `.` Chart context | + +### Secrets + +| Helper identifier | Description | Expected Input | +|---------------------------|--------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.secrets.name` | Generate the name of the secret. | `dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $` see [ExistingSecret](#existingsecret) for the structure. | +| `common.secrets.key` | Generate secret key. | `dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName"` see [ExistingSecret](#existingsecret) for the structure. | +| `common.passwords.manage` | Generate secret password or retrieve one if already created. | `dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $`, length, strong and chartNAme fields are optional. | +| `common.secrets.exists` | Returns whether a previous generated secret already exists. | `dict "secret" "secret-name" "context" $` | + +### Storage + +| Helper identifier | Description | Expected Input | +|-------------------------------|---------------------------------------|---------------------------------------------------------------------------------------------------------------------| +| `common.affinities.node.soft` | Return a soft nodeAffinity definition | `dict "persistence" .Values.path.to.the.persistence "global" $`, see [Persistence](#persistence) for the structure. | + +### TplValues + +| Helper identifier | Description | Expected Input | +|---------------------------|----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.tplvalues.render` | Renders a value that contains template | `dict "value" .Values.path.to.the.Value "context" $`, value is the value should rendered as template, context frequently is the chart context `$` or `.` | + +### Utils + +| Helper identifier | Description | Expected Input | +|--------------------------------|------------------------------------------------------------------------------------------|------------------------------------------------------------------------| +| `common.utils.fieldToEnvVar` | Build environment variable name given a field. | `dict "field" "my-password"` | +| `common.utils.secret.getvalue` | Print instructions to get a secret value. | `dict "secret" "secret-name" "field" "secret-value-field" "context" $` | +| `common.utils.getValueFromKey` | Gets a value from `.Values` object given its key path | `dict "key" "path.to.key" "context" $` | +| `common.utils.getKeyFromList` | Returns first `.Values` key with a defined value or first of the list if all non-defined | `dict "keys" (list "path.to.key1" "path.to.key2") "context" $` | + +### Validations + +| Helper identifier | Description | Expected Input | +|--------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.validations.values.single.empty` | Validate a value must not be empty. | `dict "valueKey" "path.to.value" "secret" "secret.name" "field" "my-password" "subchart" "subchart" "context" $` secret, field and subchart are optional. In case they are given, the helper will generate a how to get instruction. See [ValidateValue](#validatevalue) | +| `common.validations.values.multiple.empty` | Validate a multiple values must not be empty. It returns a shared error for all the values. | `dict "required" (list $validateValueConf00 $validateValueConf01) "context" $`. See [ValidateValue](#validatevalue) | +| `common.validations.values.mariadb.passwords` | This helper will ensure required password for MariaDB are not empty. It returns a shared error for all the values. | `dict "secret" "mariadb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mariadb chart and the helper. | +| `common.validations.values.postgresql.passwords` | This helper will ensure required password for PostgreSQL are not empty. It returns a shared error for all the values. | `dict "secret" "postgresql-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use postgresql chart and the helper. | +| `common.validations.values.redis.passwords` | This helper will ensure required password for Redis™ are not empty. It returns a shared error for all the values. | `dict "secret" "redis-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use redis chart and the helper. | +| `common.validations.values.cassandra.passwords` | This helper will ensure required password for Cassandra are not empty. It returns a shared error for all the values. | `dict "secret" "cassandra-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use cassandra chart and the helper. | +| `common.validations.values.mongodb.passwords` | This helper will ensure required password for MongoDB® are not empty. It returns a shared error for all the values. | `dict "secret" "mongodb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mongodb chart and the helper. | + +### Warnings + +| Helper identifier | Description | Expected Input | +|------------------------------|----------------------------------|------------------------------------------------------------| +| `common.warnings.rollingTag` | Warning about using rolling tag. | `ImageRoot` see [ImageRoot](#imageroot) for the structure. | + +## Special input schemas + +### ImageRoot + +```yaml +registry: + type: string + description: Docker registry where the image is located + example: docker.io + +repository: + type: string + description: Repository and image name + example: bitnami/nginx + +tag: + type: string + description: image tag + example: 1.16.1-debian-10-r63 + +pullPolicy: + type: string + description: Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + +pullSecrets: + type: array + items: + type: string + description: Optionally specify an array of imagePullSecrets (evaluated as templates). + +debug: + type: boolean + description: Set to true if you would like to see extra information on logs + example: false + +## An instance would be: +# registry: docker.io +# repository: bitnami/nginx +# tag: 1.16.1-debian-10-r63 +# pullPolicy: IfNotPresent +# debug: false +``` + +### Persistence + +```yaml +enabled: + type: boolean + description: Whether enable persistence. + example: true + +storageClass: + type: string + description: Ghost data Persistent Volume Storage Class, If set to "-", storageClassName: "" which disables dynamic provisioning. + example: "-" + +accessMode: + type: string + description: Access mode for the Persistent Volume Storage. + example: ReadWriteOnce + +size: + type: string + description: Size the Persistent Volume Storage. + example: 8Gi + +path: + type: string + description: Path to be persisted. + example: /bitnami + +## An instance would be: +# enabled: true +# storageClass: "-" +# accessMode: ReadWriteOnce +# size: 8Gi +# path: /bitnami +``` + +### ExistingSecret + +```yaml +name: + type: string + description: Name of the existing secret. + example: mySecret +keyMapping: + description: Mapping between the expected key name and the name of the key in the existing secret. + type: object + +## An instance would be: +# name: mySecret +# keyMapping: +# password: myPasswordKey +``` + +#### Example of use + +When we store sensitive data for a deployment in a secret, some times we want to give to users the possibility of using theirs existing secrets. + +```yaml +# templates/secret.yaml +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }} + labels: + app: {{ include "common.names.fullname" . }} +type: Opaque +data: + password: {{ .Values.password | b64enc | quote }} + +# templates/dpl.yaml +--- +... + env: + - name: PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "common.secrets.name" (dict "existingSecret" .Values.existingSecret "context" $) }} + key: {{ include "common.secrets.key" (dict "existingSecret" .Values.existingSecret "key" "password") }} +... + +# values.yaml +--- +name: mySecret +keyMapping: + password: myPasswordKey +``` + +### ValidateValue + +#### NOTES.txt + +```console +{{- $validateValueConf00 := (dict "valueKey" "path.to.value00" "secret" "secretName" "field" "password-00") -}} +{{- $validateValueConf01 := (dict "valueKey" "path.to.value01" "secret" "secretName" "field" "password-01") -}} + +{{ include "common.validations.values.multiple.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} +``` + +If we force those values to be empty we will see some alerts + +```console +$ helm install test mychart --set path.to.value00="",path.to.value01="" + 'path.to.value00' must not be empty, please add '--set path.to.value00=$PASSWORD_00' to the command. To get the current value: + + export PASSWORD_00=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-00}" | base64 --decode) + + 'path.to.value01' must not be empty, please add '--set path.to.value01=$PASSWORD_01' to the command. To get the current value: + + export PASSWORD_01=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-01}" | base64 --decode) +``` + +## Upgrading + +### To 1.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +**What changes were introduced in this major version?** + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- Use `type: library`. [Here](https://v3.helm.sh/docs/faq/#library-chart-support) you can find more information. +- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts + +**Considerations when upgrading to this version** + +- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 + +**Useful links** + +- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ +- https://helm.sh/docs/topics/v2_v3_migration/ +- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_affinities.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_affinities.tpl new file mode 100644 index 000000000..189ea403d --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_affinities.tpl @@ -0,0 +1,102 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Return a soft nodeAffinity definition +{{ include "common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes.soft" -}} +preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: {{ .key }} + operator: In + values: + {{- range .values }} + - {{ . | quote }} + {{- end }} + weight: 1 +{{- end -}} + +{{/* +Return a hard nodeAffinity definition +{{ include "common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes.hard" -}} +requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: {{ .key }} + operator: In + values: + {{- range .values }} + - {{ . | quote }} + {{- end }} +{{- end -}} + +{{/* +Return a nodeAffinity definition +{{ include "common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes" -}} + {{- if eq .type "soft" }} + {{- include "common.affinities.nodes.soft" . -}} + {{- else if eq .type "hard" }} + {{- include "common.affinities.nodes.hard" . -}} + {{- end -}} +{{- end -}} + +{{/* +Return a soft podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods.soft" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "context" $) -}} +*/}} +{{- define "common.affinities.pods.soft" -}} +{{- $component := default "" .component -}} +{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} +preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 10 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := $extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + namespaces: + - {{ .context.Release.Namespace | quote }} + topologyKey: kubernetes.io/hostname + weight: 1 +{{- end -}} + +{{/* +Return a hard podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods.hard" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "context" $) -}} +*/}} +{{- define "common.affinities.pods.hard" -}} +{{- $component := default "" .component -}} +{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} +requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 8 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := $extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + namespaces: + - {{ .context.Release.Namespace | quote }} + topologyKey: kubernetes.io/hostname +{{- end -}} + +{{/* +Return a podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.pods" -}} + {{- if eq .type "soft" }} + {{- include "common.affinities.pods.soft" . -}} + {{- else if eq .type "hard" }} + {{- include "common.affinities.pods.hard" . -}} + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_capabilities.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_capabilities.tpl new file mode 100644 index 000000000..ae45d5e35 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_capabilities.tpl @@ -0,0 +1,117 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Return the target Kubernetes version +*/}} +{{- define "common.capabilities.kubeVersion" -}} +{{- if .Values.global }} + {{- if .Values.global.kubeVersion }} + {{- .Values.global.kubeVersion -}} + {{- else }} + {{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} + {{- end -}} +{{- else }} +{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for policy. +*/}} +{{- define "common.capabilities.policy.apiVersion" -}} +{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "policy/v1beta1" -}} +{{- else -}} +{{- print "policy/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for cronjob. +*/}} +{{- define "common.capabilities.cronjob.apiVersion" -}} +{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "batch/v1beta1" -}} +{{- else -}} +{{- print "batch/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for deployment. +*/}} +{{- define "common.capabilities.deployment.apiVersion" -}} +{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for statefulset. +*/}} +{{- define "common.capabilities.statefulset.apiVersion" -}} +{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apps/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for ingress. +*/}} +{{- define "common.capabilities.ingress.apiVersion" -}} +{{- if .Values.ingress -}} +{{- if .Values.ingress.apiVersion -}} +{{- .Values.ingress.apiVersion -}} +{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end }} +{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for RBAC resources. +*/}} +{{- define "common.capabilities.rbac.apiVersion" -}} +{{- if semverCompare "<1.17-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "rbac.authorization.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "rbac.authorization.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for CRDs. +*/}} +{{- define "common.capabilities.crd.apiVersion" -}} +{{- if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apiextensions.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "apiextensions.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if the used Helm version is 3.3+. +A way to check the used Helm version was not introduced until version 3.3.0 with .Capabilities.HelmVersion, which contains an additional "{}}" structure. +This check is introduced as a regexMatch instead of {{ if .Capabilities.HelmVersion }} because checking for the key HelmVersion in <3.3 results in a "interface not found" error. +**To be removed when the catalog's minimun Helm version is 3.3** +*/}} +{{- define "common.capabilities.supportsHelmVersion" -}} +{{- if regexMatch "{(v[0-9])*[^}]*}}$" (.Capabilities | toString ) }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_errors.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_errors.tpl new file mode 100644 index 000000000..a79cc2e32 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_errors.tpl @@ -0,0 +1,23 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Through error when upgrading using empty passwords values that must not be empty. + +Usage: +{{- $validationError00 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password00" "secret" "secretName" "field" "password-00") -}} +{{- $validationError01 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password01" "secret" "secretName" "field" "password-01") -}} +{{ include "common.errors.upgrade.passwords.empty" (dict "validationErrors" (list $validationError00 $validationError01) "context" $) }} + +Required password params: + - validationErrors - String - Required. List of validation strings to be return, if it is empty it won't throw error. + - context - Context - Required. Parent context. +*/}} +{{- define "common.errors.upgrade.passwords.empty" -}} + {{- $validationErrors := join "" .validationErrors -}} + {{- if and $validationErrors .context.Release.IsUpgrade -}} + {{- $errorString := "\nPASSWORDS ERROR: You must provide your current passwords when upgrading the release." -}} + {{- $errorString = print $errorString "\n Note that even after reinstallation, old credentials may be needed as they may be kept in persistent volume claims." -}} + {{- $errorString = print $errorString "\n Further information can be obtained at https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues/#credential-errors-while-upgrading-chart-releases" -}} + {{- $errorString = print $errorString "\n%s" -}} + {{- printf $errorString $validationErrors | fail -}} + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_images.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_images.tpl new file mode 100644 index 000000000..42ffbc722 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_images.tpl @@ -0,0 +1,75 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Return the proper image name +{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" $) }} +*/}} +{{- define "common.images.image" -}} +{{- $registryName := .imageRoot.registry -}} +{{- $repositoryName := .imageRoot.repository -}} +{{- $tag := .imageRoot.tag | toString -}} +{{- if .global }} + {{- if .global.imageRegistry }} + {{- $registryName = .global.imageRegistry -}} + {{- end -}} +{{- end -}} +{{- if $registryName }} +{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- else -}} +{{- printf "%s:%s" $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) +{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }} +*/}} +{{- define "common.images.pullSecrets" -}} + {{- $pullSecrets := list }} + + {{- if .global }} + {{- range .global.imagePullSecrets -}} + {{- $pullSecrets = append $pullSecrets . -}} + {{- end -}} + {{- end -}} + + {{- range .images -}} + {{- range .pullSecrets -}} + {{- $pullSecrets = append $pullSecrets . -}} + {{- end -}} + {{- end -}} + + {{- if (not (empty $pullSecrets)) }} +imagePullSecrets: + {{- range $pullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names evaluating values as templates +{{ include "common.images.renderPullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $) }} +*/}} +{{- define "common.images.renderPullSecrets" -}} + {{- $pullSecrets := list }} + {{- $context := .context }} + + {{- if $context.Values.global }} + {{- range $context.Values.global.imagePullSecrets -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} + {{- end -}} + {{- end -}} + + {{- range .images -}} + {{- range .pullSecrets -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} + {{- end -}} + {{- end -}} + + {{- if (not (empty $pullSecrets)) }} +imagePullSecrets: + {{- range $pullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_ingress.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_ingress.tpl new file mode 100644 index 000000000..f905f2005 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_ingress.tpl @@ -0,0 +1,55 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Generate backend entry that is compatible with all Kubernetes API versions. + +Usage: +{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }} + +Params: + - serviceName - String. Name of an existing service backend + - servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer. + - context - Dict - Required. The context for the template evaluation. +*/}} +{{- define "common.ingress.backend" -}} +{{- $apiVersion := (include "common.capabilities.ingress.apiVersion" .context) -}} +{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}} +serviceName: {{ .serviceName }} +servicePort: {{ .servicePort }} +{{- else -}} +service: + name: {{ .serviceName }} + port: + {{- if typeIs "string" .servicePort }} + name: {{ .servicePort }} + {{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }} + number: {{ .servicePort | int }} + {{- end }} +{{- end -}} +{{- end -}} + +{{/* +Print "true" if the API pathType field is supported +Usage: +{{ include "common.ingress.supportsPathType" . }} +*/}} +{{- define "common.ingress.supportsPathType" -}} +{{- if (semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .)) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if the ingressClassname field is supported +Usage: +{{ include "common.ingress.supportsIngressClassname" . }} +*/}} +{{- define "common.ingress.supportsIngressClassname" -}} +{{- if semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_labels.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_labels.tpl new file mode 100644 index 000000000..252066c7e --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_labels.tpl @@ -0,0 +1,18 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Kubernetes standard labels +*/}} +{{- define "common.labels.standard" -}} +app.kubernetes.io/name: {{ include "common.names.name" . }} +helm.sh/chart: {{ include "common.names.chart" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} + +{{/* +Labels to use on deploy.spec.selector.matchLabels and svc.spec.selector +*/}} +{{- define "common.labels.matchLabels" -}} +app.kubernetes.io/name: {{ include "common.names.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_names.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_names.tpl new file mode 100644 index 000000000..adf2a74f4 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_names.tpl @@ -0,0 +1,32 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "common.names.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "common.names.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "common.names.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_secrets.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_secrets.tpl new file mode 100644 index 000000000..60b84a701 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_secrets.tpl @@ -0,0 +1,129 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Generate secret name. + +Usage: +{{ include "common.secrets.name" (dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $) }} + +Params: + - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user + to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. + +info: https://github.com/bitnami/charts/tree/master/bitnami/common#existingsecret + - defaultNameSuffix - String - Optional. It is used only if we have several secrets in the same deployment. + - context - Dict - Required. The context for the template evaluation. +*/}} +{{- define "common.secrets.name" -}} +{{- $name := (include "common.names.fullname" .context) -}} + +{{- if .defaultNameSuffix -}} +{{- $name = printf "%s-%s" $name .defaultNameSuffix | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- with .existingSecret -}} +{{- if not (typeIs "string" .) -}} +{{- with .name -}} +{{- $name = . -}} +{{- end -}} +{{- else -}} +{{- $name = . -}} +{{- end -}} +{{- end -}} + +{{- printf "%s" $name -}} +{{- end -}} + +{{/* +Generate secret key. + +Usage: +{{ include "common.secrets.key" (dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName") }} + +Params: + - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user + to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. + +info: https://github.com/bitnami/charts/tree/master/bitnami/common#existingsecret + - key - String - Required. Name of the key in the secret. +*/}} +{{- define "common.secrets.key" -}} +{{- $key := .key -}} + +{{- if .existingSecret -}} + {{- if not (typeIs "string" .existingSecret) -}} + {{- if .existingSecret.keyMapping -}} + {{- $key = index .existingSecret.keyMapping $.key -}} + {{- end -}} + {{- end }} +{{- end -}} + +{{- printf "%s" $key -}} +{{- end -}} + +{{/* +Generate secret password or retrieve one if already created. + +Usage: +{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - key - String - Required - Name of the key in the secret. + - providedValues - List - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value. + - length - int - Optional - Length of the generated random password. + - strong - Boolean - Optional - Whether to add symbols to the generated random password. + - chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart. + - context - Context - Required - Parent context. +*/}} +{{- define "common.secrets.passwords.manage" -}} + +{{- $password := "" }} +{{- $subchart := "" }} +{{- $chartName := default "" .chartName }} +{{- $passwordLength := default 10 .length }} +{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }} +{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }} +{{- $secret := (lookup "v1" "Secret" $.context.Release.Namespace .secret) }} +{{- if $secret }} + {{- if index $secret.data .key }} + {{- $password = index $secret.data .key }} + {{- end -}} +{{- else if $providedPasswordValue }} + {{- $password = $providedPasswordValue | toString | b64enc | quote }} +{{- else }} + + {{- if .context.Values.enabled }} + {{- $subchart = $chartName }} + {{- end -}} + + {{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}} + {{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}} + {{- $passwordValidationErrors := list $requiredPasswordError -}} + {{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}} + + {{- if .strong }} + {{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }} + {{- $password = randAscii $passwordLength }} + {{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }} + {{- $password = printf "%s%s" $subStr $password | toString | shuffle | b64enc | quote }} + {{- else }} + {{- $password = randAlphaNum $passwordLength | b64enc | quote }} + {{- end }} +{{- end -}} +{{- printf "%s" $password -}} +{{- end -}} + +{{/* +Returns whether a previous generated secret already exists + +Usage: +{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - context - Context - Required - Parent context. +*/}} +{{- define "common.secrets.exists" -}} +{{- $secret := (lookup "v1" "Secret" $.context.Release.Namespace .secret) }} +{{- if $secret }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_storage.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_storage.tpl new file mode 100644 index 000000000..60e2a844f --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_storage.tpl @@ -0,0 +1,23 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Return the proper Storage Class +{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }} +*/}} +{{- define "common.storage.class" -}} + +{{- $storageClass := .persistence.storageClass -}} +{{- if .global -}} + {{- if .global.storageClass -}} + {{- $storageClass = .global.storageClass -}} + {{- end -}} +{{- end -}} + +{{- if $storageClass -}} + {{- if (eq "-" $storageClass) -}} + {{- printf "storageClassName: \"\"" -}} + {{- else }} + {{- printf "storageClassName: %s" $storageClass -}} + {{- end -}} +{{- end -}} + +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_tplvalues.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_tplvalues.tpl new file mode 100644 index 000000000..2db166851 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_tplvalues.tpl @@ -0,0 +1,13 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Renders a value that contains template. +Usage: +{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }} +*/}} +{{- define "common.tplvalues.render" -}} + {{- if typeIs "string" .value }} + {{- tpl .value .context }} + {{- else }} + {{- tpl (.value | toYaml) .context }} + {{- end }} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_utils.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_utils.tpl new file mode 100644 index 000000000..ea083a249 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_utils.tpl @@ -0,0 +1,62 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Print instructions to get a secret value. +Usage: +{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }} +*/}} +{{- define "common.utils.secret.getvalue" -}} +{{- $varname := include "common.utils.fieldToEnvVar" . -}} +export {{ $varname }}=$(kubectl get secret --namespace {{ .context.Release.Namespace | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 --decode) +{{- end -}} + +{{/* +Build env var name given a field +Usage: +{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }} +*/}} +{{- define "common.utils.fieldToEnvVar" -}} + {{- $fieldNameSplit := splitList "-" .field -}} + {{- $upperCaseFieldNameSplit := list -}} + + {{- range $fieldNameSplit -}} + {{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}} + {{- end -}} + + {{ join "_" $upperCaseFieldNameSplit }} +{{- end -}} + +{{/* +Gets a value from .Values given +Usage: +{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }} +*/}} +{{- define "common.utils.getValueFromKey" -}} +{{- $splitKey := splitList "." .key -}} +{{- $value := "" -}} +{{- $latestObj := $.context.Values -}} +{{- range $splitKey -}} + {{- if not $latestObj -}} + {{- printf "please review the entire path of '%s' exists in values" $.key | fail -}} + {{- end -}} + {{- $value = ( index $latestObj . ) -}} + {{- $latestObj = $value -}} +{{- end -}} +{{- printf "%v" (default "" $value) -}} +{{- end -}} + +{{/* +Returns first .Values key with a defined value or first of the list if all non-defined +Usage: +{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }} +*/}} +{{- define "common.utils.getKeyFromList" -}} +{{- $key := first .keys -}} +{{- $reverseKeys := reverse .keys }} +{{- range $reverseKeys }} + {{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }} + {{- if $value -}} + {{- $key = . }} + {{- end -}} +{{- end -}} +{{- printf "%s" $key -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_warnings.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_warnings.tpl new file mode 100644 index 000000000..ae10fa41e --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/_warnings.tpl @@ -0,0 +1,14 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Warning about using rolling tag. +Usage: +{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }} +*/}} +{{- define "common.warnings.rollingTag" -}} + +{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} + +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_cassandra.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_cassandra.tpl new file mode 100644 index 000000000..8679ddffb --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_cassandra.tpl @@ -0,0 +1,72 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate Cassandra required passwords are not empty. + +Usage: +{{ include "common.validations.values.cassandra.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where Cassandra values are stored, e.g: "cassandra-passwords-secret" + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.cassandra.passwords" -}} + {{- $existingSecret := include "common.cassandra.values.existingSecret" . -}} + {{- $enabled := include "common.cassandra.values.enabled" . -}} + {{- $dbUserPrefix := include "common.cassandra.values.key.dbUser" . -}} + {{- $valueKeyPassword := printf "%s.password" $dbUserPrefix -}} + + {{- if and (not $existingSecret) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "cassandra-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.cassandra.values.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.cassandra.values.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.cassandra.dbUser.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.dbUser.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled cassandra. + +Usage: +{{ include "common.cassandra.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.cassandra.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.cassandra.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key dbUser + +Usage: +{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.cassandra.values.key.dbUser" -}} + {{- if .subchart -}} + cassandra.dbUser + {{- else -}} + dbUser + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_mariadb.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_mariadb.tpl new file mode 100644 index 000000000..bb5ed7253 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_mariadb.tpl @@ -0,0 +1,103 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate MariaDB required passwords are not empty. + +Usage: +{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret" + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.mariadb.passwords" -}} + {{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}} + {{- $enabled := include "common.mariadb.values.enabled" . -}} + {{- $architecture := include "common.mariadb.values.architecture" . -}} + {{- $authPrefix := include "common.mariadb.values.key.auth" . -}} + {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} + {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} + {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} + {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} + + {{- if and (not $existingSecret) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} + + {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} + {{- if not (empty $valueUsername) -}} + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + {{- end -}} + + {{- if (eq $architecture "replication") -}} + {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mariadb.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mariadb. + +Usage: +{{ include "common.mariadb.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mariadb.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mariadb.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mariadb.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.key.auth" -}} + {{- if .subchart -}} + mariadb.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_mongodb.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_mongodb.tpl new file mode 100644 index 000000000..1e5bba981 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_mongodb.tpl @@ -0,0 +1,108 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate MongoDB® required passwords are not empty. + +Usage: +{{ include "common.validations.values.mongodb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where MongoDB® values are stored, e.g: "mongodb-passwords-secret" + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.mongodb.passwords" -}} + {{- $existingSecret := include "common.mongodb.values.auth.existingSecret" . -}} + {{- $enabled := include "common.mongodb.values.enabled" . -}} + {{- $authPrefix := include "common.mongodb.values.key.auth" . -}} + {{- $architecture := include "common.mongodb.values.architecture" . -}} + {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} + {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} + {{- $valueKeyDatabase := printf "%s.database" $authPrefix -}} + {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} + {{- $valueKeyReplicaSetKey := printf "%s.replicaSetKey" $authPrefix -}} + {{- $valueKeyAuthEnabled := printf "%s.enabled" $authPrefix -}} + + {{- $authEnabled := include "common.utils.getValueFromKey" (dict "key" $valueKeyAuthEnabled "context" .context) -}} + + {{- if and (not $existingSecret) (eq $enabled "true") (eq $authEnabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mongodb-root-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} + + {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} + {{- $valueDatabase := include "common.utils.getValueFromKey" (dict "key" $valueKeyDatabase "context" .context) }} + {{- if and $valueUsername $valueDatabase -}} + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mongodb-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + {{- end -}} + + {{- if (eq $architecture "replicaset") -}} + {{- $requiredReplicaSetKey := dict "valueKey" $valueKeyReplicaSetKey "secret" .secret "field" "mongodb-replica-set-key" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredReplicaSetKey -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mongodb.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mongodb. + +Usage: +{{ include "common.mongodb.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mongodb.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mongodb.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.key.auth" -}} + {{- if .subchart -}} + mongodb.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mongodb.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_postgresql.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_postgresql.tpl new file mode 100644 index 000000000..992bcd390 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_postgresql.tpl @@ -0,0 +1,131 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate PostgreSQL required passwords are not empty. + +Usage: +{{ include "common.validations.values.postgresql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where postgresql values are stored, e.g: "postgresql-passwords-secret" + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.postgresql.passwords" -}} + {{- $existingSecret := include "common.postgresql.values.existingSecret" . -}} + {{- $enabled := include "common.postgresql.values.enabled" . -}} + {{- $valueKeyPostgresqlPassword := include "common.postgresql.values.key.postgressPassword" . -}} + {{- $valueKeyPostgresqlReplicationEnabled := include "common.postgresql.values.key.replicationPassword" . -}} + + {{- if and (not $existingSecret) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredPostgresqlPassword := dict "valueKey" $valueKeyPostgresqlPassword "secret" .secret "field" "postgresql-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}} + + {{- $enabledReplication := include "common.postgresql.values.enabled.replication" . -}} + {{- if (eq $enabledReplication "true") -}} + {{- $requiredPostgresqlReplicationPassword := dict "valueKey" $valueKeyPostgresqlReplicationEnabled "secret" .secret "field" "postgresql-replication-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlReplicationPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to decide whether evaluate global values. + +Usage: +{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }} +Params: + - key - String - Required. Field to be evaluated within global, e.g: "existingSecret" +*/}} +{{- define "common.postgresql.values.use.global" -}} + {{- if .context.Values.global -}} + {{- if .context.Values.global.postgresql -}} + {{- index .context.Values.global.postgresql .key | quote -}} + {{- end -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.postgresql.values.existingSecret" (dict "context" $) }} +*/}} +{{- define "common.postgresql.values.existingSecret" -}} + {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}} + + {{- if .subchart -}} + {{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}} + {{- else -}} + {{- default (.context.Values.existingSecret | quote) $globalValue -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled postgresql. + +Usage: +{{ include "common.postgresql.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.postgresql.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.postgresql.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key postgressPassword. + +Usage: +{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.key.postgressPassword" -}} + {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}} + + {{- if not $globalValue -}} + {{- if .subchart -}} + postgresql.postgresqlPassword + {{- else -}} + postgresqlPassword + {{- end -}} + {{- else -}} + global.postgresql.postgresqlPassword + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled.replication. + +Usage: +{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.enabled.replication" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.postgresql.replication.enabled -}} + {{- else -}} + {{- printf "%v" .context.Values.replication.enabled -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key replication.password. + +Usage: +{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.key.replicationPassword" -}} + {{- if .subchart -}} + postgresql.replication.password + {{- else -}} + replication.password + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_redis.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_redis.tpl new file mode 100644 index 000000000..18d9813c5 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_redis.tpl @@ -0,0 +1,76 @@ + +{{/* vim: set filetype=mustache: */}} +{{/* +Validate Redis™ required passwords are not empty. + +Usage: +{{ include "common.validations.values.redis.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where redis values are stored, e.g: "redis-passwords-secret" + - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.redis.passwords" -}} + {{- $enabled := include "common.redis.values.enabled" . -}} + {{- $valueKeyPrefix := include "common.redis.values.keys.prefix" . -}} + {{- $standarizedVersion := include "common.redis.values.standarized.version" . }} + + {{- $existingSecret := ternary (printf "%s%s" $valueKeyPrefix "auth.existingSecret") (printf "%s%s" $valueKeyPrefix "existingSecret") (eq $standarizedVersion "true") }} + {{- $existingSecretValue := include "common.utils.getValueFromKey" (dict "key" $existingSecret "context" .context) }} + + {{- $valueKeyRedisPassword := ternary (printf "%s%s" $valueKeyPrefix "auth.password") (printf "%s%s" $valueKeyPrefix "password") (eq $standarizedVersion "true") }} + {{- $valueKeyRedisUseAuth := ternary (printf "%s%s" $valueKeyPrefix "auth.enabled") (printf "%s%s" $valueKeyPrefix "usePassword") (eq $standarizedVersion "true") }} + + {{- if and (not $existingSecretValue) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $useAuth := include "common.utils.getValueFromKey" (dict "key" $valueKeyRedisUseAuth "context" .context) -}} + {{- if eq $useAuth "true" -}} + {{- $requiredRedisPassword := dict "valueKey" $valueKeyRedisPassword "secret" .secret "field" "redis-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRedisPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled redis. + +Usage: +{{ include "common.redis.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.redis.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.redis.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right prefix path for the values + +Usage: +{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false +*/}} +{{- define "common.redis.values.keys.prefix" -}} + {{- if .subchart -}}redis.{{- else -}}{{- end -}} +{{- end -}} + +{{/* +Checks whether the redis chart's includes the standarizations (version >= 14) + +Usage: +{{ include "common.redis.values.standarized.version" (dict "context" $) }} +*/}} +{{- define "common.redis.values.standarized.version" -}} + + {{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}} + {{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }} + + {{- if $standarizedAuthValues -}} + {{- true -}} + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_validations.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_validations.tpl new file mode 100644 index 000000000..9a814cf40 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/templates/validations/_validations.tpl @@ -0,0 +1,46 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate values must not be empty. + +Usage: +{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}} +{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}} +{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} + +Validate value params: + - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" + - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" + - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" +*/}} +{{- define "common.validations.values.multiple.empty" -}} + {{- range .required -}} + {{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}} + {{- end -}} +{{- end -}} + +{{/* +Validate a value must not be empty. + +Usage: +{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }} + +Validate value params: + - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" + - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" + - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" + - subchart - String - Optional - Name of the subchart that the validated password is part of. +*/}} +{{- define "common.validations.values.single.empty" -}} + {{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }} + {{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }} + + {{- if not $value -}} + {{- $varname := "my-value" -}} + {{- $getCurrentValue := "" -}} + {{- if and .secret .field -}} + {{- $varname = include "common.utils.fieldToEnvVar" . -}} + {{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}} + {{- end -}} + {{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}} + {{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/values.yaml b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/values.yaml new file mode 100644 index 000000000..f2df68e5e --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/charts/common/values.yaml @@ -0,0 +1,5 @@ +## bitnami/common +## It is required by CI/CD tools and processes. +## @skip exampleValue +## +exampleValue: common-chart diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_ingress.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_ingress.tpl new file mode 100644 index 000000000..e1b16d928 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_ingress.tpl @@ -0,0 +1,101 @@ +{{/* +include "ingress" (dict "ingressName" "myingress" "ingress" path.to.ingress "serviceName" "the-service" "servicePort" 9090 "context" $) + +ingress: + enabled: true + certManager: false + pathType: ImplementationSpecific + apiVersion: "" + hostname: theservice.local + path: / + annotations: {} + tls: false + extraHosts: [] + extraPaths: [] + extraTls: [] + secrets: [] +*/}} +{{- define "lib.ingress" -}} +{{- $ctx := .context -}} +{{- $ingressName := .ingressName -}} +{{- $serviceName := .serviceName -}} +{{- $servicePort := .servicePort -}} +{{- $extraPaths := .ingress.extraPaths -}} +{{- if .ingress.enabled -}} +apiVersion: {{ include "common.capabilities.ingress.apiVersion" $ctx }} +kind: Ingress +metadata: + name: {{ $ingressName }} + namespace: {{ $ctx.Release.Namespace | quote }} + labels: {{- include "common.labels.standard" $ctx | nindent 4 }} + {{- if $ctx.Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" $ctx.Values.commonLabels "context" $ctx ) | nindent 4 }} + {{- end }} + annotations: + {{- if .ingress.certManager }} + kubernetes.io/tls-acme: "true" + {{- end }} + {{- if .ingress.annotations }} + {{- include "common.tplvalues.render" ( dict "value" .ingress.annotations "context" $ctx ) | nindent 4 }} + {{- end }} + {{- if $ctx.Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" $ctx.Values.commonAnnotations "context" $ctx ) | nindent 4 }} + {{- end }} +spec: + rules: + {{- if .ingress.hostname }} + - host: {{ .ingress.hostname }} + http: + paths: + - path: {{ .ingress.path }} + {{- if eq "true" (include "common.ingress.supportsPathType" $ctx) }} + pathType: {{ default "ImplementationSpecific" .ingress.pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" $serviceName "servicePort" $servicePort "context" $ctx) | nindent 14 }} + {{- include "lib.safeToYaml" $extraPaths | nindent 10 }} + {{- end }} + {{- range .ingress.extraHosts }} + - host: {{ .name | quote }} + http: + paths: + - path: {{ default "/" .path }} + {{- if eq "true" (include "common.ingress.supportsPathType" $ctx) }} + pathType: {{ default "ImplementationSpecific" .pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" $serviceName "servicePort" $servicePort "context" $ctx) | nindent 14 }} + {{- include "lib.safeToYaml" $extraPaths | nindent 10 }} + {{- end }} + {{/* .ingress.hosts is deprecated */}} + {{- range .ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- if .path }} + - path: {{ default "/" .path }} + {{- if eq "true" (include "common.ingress.supportsPathType" $ctx) }} + pathType: {{ default "ImplementationSpecific" .pathType }} + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" $serviceName "servicePort" $servicePort "context" $ctx) | nindent 14 }} + {{- end }} + {{- range .paths }} + - path: {{ . | quote }} + {{- if eq "true" (include "common.ingress.supportsPathType" $ctx) }} + pathType: ImplementationSpecific + {{- end }} + backend: {{- include "common.ingress.backend" (dict "serviceName" $serviceName "servicePort" $servicePort "context" $ctx) | nindent 14 }} + {{- end }} + {{- end }} + {{/* .ingress.hosts is deprecated */}} + {{- if or .ingress.tls .ingress.extraTls }} + tls: + {{- if .ingress.tls }} + - hosts: + - {{ .ingress.hostname }} + secretName: {{ printf "%s-tls" .ingress.hostname }} + {{- end }} + {{- if .ingress.extraTls }} + {{- include "common.tplvalues.render" ( dict "value" .ingress.extraTls "context" $ctx ) | nindent 4 }} + {{- end }} + {{- end }} +{{- end }} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_lib.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_lib.tpl new file mode 100644 index 000000000..deaa325c4 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_lib.tpl @@ -0,0 +1,51 @@ + +{{/* +Call a template function in the context of a sub-chart, as opposed to the +current context of the caller +{{ include "lib.call-nested" (list . "subchart" "template_name") }} +*/}} +{{- define "lib.call-nested" }} +{{- $dot := index . 0 }} +{{- $subchart := index . 1 | splitList "." }} +{{- $template := index . 2 }} +{{- $values := $dot.Values }} +{{- range $subchart }} +{{- $values = index $values . }} +{{- end }} +{{- include $template (dict "Chart" (dict "Name" (last $subchart)) "Values" $values "Release" $dot.Release "Capabilities" $dot.Capabilities) }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "lib.labels" -}} +helm.sh/chart: {{ include "common.names.chart" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{ include "common.labels.matchLabels" . }} +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "lib.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + + +{{/* +Given a variable, if it is not false, output as Yaml + +include "lib.safeToYaml" .Values.something +*/}} +{{- define "lib.safeToYaml" -}} +{{- if . -}} +{{ toYaml . }} +{{- end -}} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_lib_image.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_lib_image.tpl new file mode 100644 index 000000000..8f8e00231 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_lib_image.tpl @@ -0,0 +1,50 @@ +{{/* +Given a setup like the following: + +# global and on down are optional +global: + image: + registry: my-registry.com + tag: latest + +# This is the imageRoot +somecomponent: + image: + registry: my-other-registry.com + tag: 1.0.0 + repository: bobs/coolthing + +*/}} +{{/* +{{ include "lib.image.url" (dict "imageRoot" .Values.sawtooth.containers.validator.image "global" .Values.global)}} +*/}} +{{- define "lib.image.url" -}} + {{- $globalRegistryName := "" -}} + {{- $globalTag := "latest" -}} + {{- if .global -}} + {{- if .global.image -}} + {{- if .global.image.registry -}} + {{- $globalRegistryName = .global.image.registry -}} + {{- end -}} + {{- if .global.image.tag -}} + {{- $globalTag = .global.image.tag -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- $repository := .imageRoot.repository -}} + {{- $registry := default $globalRegistryName .imageRoot.registry -}} + {{- $tag := default $globalTag .imageRoot.tag -}} + {{- if $registry -}} + {{- printf "%s/%s:%s" $registry $repository $tag -}} + {{- else -}} + {{- printf "%s:%s" $repository $tag -}} + {{- end -}} +{{- end -}} + +{{/* +{{ include "utils.image" (dict "imageRoot" .Values.sawtooth.containers.validator.image "global" .Values.global)}} +*/}} +{{- define "lib.image" -}} +image: {{ include "lib.image.url" . }} +imagePullPolicy: {{ default "IfNotPresent" .imageRoot.pullPolicy }} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_lib_volumes.tpl b/charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_lib_volumes.tpl new file mode 100644 index 000000000..93f1139b1 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/templates/_lib_volumes.tpl @@ -0,0 +1,34 @@ + + +{{/* +given a variable list, create a list of volumes + +extraVolumes: + - name: pv-data + persistentVolumeClaim: + claimName: pvc-persistent-cfg + - name: scratch + emptyDir: {} + +include "lib.volumes" .Values.extraVolumes + +*/}} +{{- define "lib.volumes" -}} +{{ include "lib.safeToYaml" . }} +{{- end -}} + +{{/* +given a variable list, create a list of volumeMounts + +extraVolumeMounts: + - name: pv-data + mountPath: /data + - name: scratch + mountPath: /scratch + +include "lib.volumeMounts" .Values.extraVolumeMounts + +*/}} +{{- define "lib.volumeMounts" -}} +{{ include "lib.safeToYaml" . }} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/charts/standard-defs/values.yaml b/charts/paravela/chronicle/0.1.27/charts/standard-defs/values.yaml new file mode 100644 index 000000000..1ff659769 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/charts/standard-defs/values.yaml @@ -0,0 +1 @@ +exampleValue: example diff --git a/charts/paravela/chronicle/0.1.27/questions.yaml b/charts/paravela/chronicle/0.1.27/questions.yaml new file mode 100644 index 000000000..cb151f091 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/questions.yaml @@ -0,0 +1,130 @@ +questions: + +# Chronicle +- variable: image.repository + default: "" + required: false + type: string + label: Chronicle docker repository + description: The Chronicle docker repository to use. This may be domain specific, see https://docs.btp.works/chronicle + group: "Chronicle Settings" +- variable: image.tag + default: "" + required: false + type: string + label: Chronicle Image tag + description: The Chronicle docker image tag to use. + group: "Chronicle Settings" +- variable: webUi + default: false + required: false + type: boolean + label: Enable Web UI + description: Enables the graphql playground interface for development use. + group: "Chronicle Settings" + +# Ingress Settings +- variable: ingress.enabled + default: "false" + required: false + type: boolean + label: Enable Chronicle ingress + description: Enable an ingress for the Chronicle service. + group: "Ingress Settings" + show_subquestion_if: true + subquestions: + - variable: ingress.hostname + default: "" + required: false + type: string + label: Ingress hostname + description: Primary hostname for the ingress. + group: "Ingress Settings" + - variable: ingress.path + default: "" + required: false + type: string + label: Hostname Path + description: Path for the ingress's primary hostname. + group: "Ingress Settings" + - variable: ingress.pathType + default: "" + required: false + type: string + label: Hostname PathType + description: PathType for the ingress's primary hostname. + group: "Ingress Settings" + - variable: ingress.certManager + default: "false" + required: false + type: boolean + label: Enable the acme certmanager for this ingress + description: Enable the acme certmanager for this ingress. + group: "Ingress Settings" + - variable: ingress.annotations + default: "" + required: false + type: string + label: Ingress annotations + description: Annotations for the ingress. + group: "Ingress Settings" + - variable: ingress.tls + default: false + required: false + type: boolean + label: Ingress TLS + description: Enable tls on the ingress with a secrete at hostname-tls. + group: "Ingress Settings" + +# Chronicle database settings +- variable: postgres.persistence.enabled + default: "true" + type: boolean + required: true + label: Postgres persistance + description: Allocate a PVC for the internal Postgres instance + group: "Database settings" +- variable: postgres.enabled + default: "true" + required: true + type: boolean + label: Use internal postgres database + description: Create an internal Postgres instance for Chronicle, or if not supply details of an external Postgres. + group: "Database settings" + show_subquestion_if: false + subquestions: + - variable: postgres.user + default: "postgres" + required: true + type: string + label: Postgres user + description: User for the Postgres database + group: "Database settings" + - variable: postgres.host + default: "localhost" + required: true + type: string + label: Postgres host + description: Host for the Postgres database + group: "Database settings" + - variable: postgres.database + default: "postgres" + required: true + type: string + label: Database name + description: Database name for the Postgres database + group: "Database settings" + - variable: postgres.port + default: "5432" + required: true + type: int + label: Postgres port + description: Port for the Postgres database + group: "Database settings" + - variable: postgres.password + default: "postgres" + required: true + type: password + label: Postgres password + description: Password for the Postgres database + group: "Database settings" diff --git a/charts/paravela/chronicle/0.1.27/replicate.sh b/charts/paravela/chronicle/0.1.27/replicate.sh new file mode 100644 index 000000000..42ce8bb77 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/replicate.sh @@ -0,0 +1,193 @@ +#!/bin/sh + +# Script to synchronize data from a source PVC to existing target PVCs in Kubernetes. +# Usage: ./replicate.sh [Target_PVC_2 ...] [Namespace] +# Example: ./replicate.sh sawtooth-data-chronicle-sawtooth-0 sawtooth-data-chronicle-sawtooth-1 default + +set -eu + +# Constants +LOG_FILE="./replicate.log" +MAX_RETRIES=10 +RSYNC_TIMEOUT=300 # in seconds + +# Variable to keep track of created pods for cleanup +CREATED_PODS="" + +# Function to display usage information +usage() { + echo "Usage: $0 [Target_PVC_2 ...] [Namespace]" + echo "Example: $0 sawtooth-data-chronicle-sawtooth-0 sawtooth-data-chronicle-sawtooth-1 default" + exit 1 +} + +# Function to log messages with timestamps +log() { + local message="$1" + echo "$(date '+%Y-%m-%d %H:%M:%S') - $message" | tee -a "$LOG_FILE" +} + +# Function to check if a namespace exists +namespace_exists() { + local namespace="$1" + kubectl get namespace "$namespace" >/dev/null 2>&1 +} + +# Function to create a temporary pod for rsync +create_temp_pod() { + local source_pvc="$1" + local target_pvc="$2" + local namespace="$3" + local pod_name="replication-temp-pod-${target_pvc}" + + log "Creating temporary pod '$pod_name' in namespace '$namespace'." + + kubectl apply -f - </dev/null 2>&1 + + # Check the pod status + pod_status=$(kubectl get pod "$pod_name" -n "$namespace" -o jsonpath='{.status.phase}') + + if [ "$pod_status" = "Succeeded" ]; then + log "Rsync succeeded for '$pod_name'." + return 0 + else + log "Rsync failed for '$pod_name' with status: $pod_status." + return 1 + fi +} + +# Function to delete a temporary pod +delete_temp_pod() { + local pod_name="$1" + local namespace="$2" + + log "Deleting temporary pod '$pod_name' in namespace '$namespace'." + kubectl delete pod "$pod_name" -n "$namespace" --ignore-not-found=true + log "Temporary pod '$pod_name' deleted." +} + +# Function to perform rsync with retries +perform_rsync() { + local target_pvc="$1" + local namespace="$2" + + local attempt=1 + while [ "$attempt" -le "$MAX_RETRIES" ]; do + log "Attempt $attempt of $MAX_RETRIES for rsync to '$target_pvc'." + create_temp_pod "$SOURCE_PVC" "$target_pvc" "$namespace" + + if wait_for_pod "replication-temp-pod-$target_pvc" "$namespace"; then + log "Rsync succeeded on attempt $attempt for '$target_pvc'." + break + else + log "Rsync failed on attempt $attempt for '$target_pvc'." + if [ "$attempt" -lt "$MAX_RETRIES" ]; then + log "Retrying rsync after delay..." + sleep 10 # Delay before next attempt + else + log "Exceeded maximum retries for rsync to '$target_pvc'. Skipping to next PVC." + fi + fi + + attempt=$((attempt + 1)) + done + + # Delete temporary pod if it exists + delete_temp_pod "replication-temp-pod-$target_pvc" "$namespace" +} + +# Function to handle cleanup on script exit or interruption +cleanup() { + log "Cleanup initiated. Deleting all temporary pods." + for pod in $CREATED_PODS; do + delete_temp_pod "$pod" "$NAMESPACE" + done + log "Cleanup completed." + exit 0 +} + +# Trap SIGINT (Ctrl-C) to perform cleanup +trap cleanup INT + +# Function to parse the provided arguments +parse_arguments() { + if [ "$#" -lt 2 ]; then + log "Error: Insufficient arguments provided." + usage + fi + + SOURCE_PVC="$1" + shift + TARGET_PVCS="$@" + + # Determine if the last argument is a namespace + LAST_ARG=$(echo "$TARGET_PVCS" | awk '{print $NF}') + if namespace_exists "$LAST_ARG"; then + NAMESPACE="$LAST_ARG" + # Remove the namespace from TARGET_PVCS + TARGET_PVCS=$(echo "$TARGET_PVCS" | awk '{$NF=""; print $0}' | sed 's/ *$//') + else + NAMESPACE="default" + fi + + # Convert TARGET_PVCS string to a space-separated list + TARGET_PVCS_ARRAY="$TARGET_PVCS" + + if [ -z "$TARGET_PVCS_ARRAY" ]; then + log "Error: At least one target PVC must be specified." + usage + fi +} + +# Main Script Execution + +# Parse the provided arguments +parse_arguments "$@" + +log "Starting PVC synchronization from '$SOURCE_PVC' in namespace '$NAMESPACE'." + +for TARGET_PVC in $TARGET_PVCS_ARRAY; do + log "Synchronizing from '$SOURCE_PVC' to '$TARGET_PVC'." + perform_rsync "$TARGET_PVC" "$NAMESPACE" + log "--------------------------------------------" +done + +log "PVC synchronization for all replicas completed." diff --git a/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-0-keys/validator.priv b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-0-keys/validator.priv new file mode 100644 index 000000000..958df32fa --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-0-keys/validator.priv @@ -0,0 +1 @@ +7b38377617463fa972241ee62f24c190ee5fb51db284decae7dc7ddcd83f7e72 diff --git a/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-0-keys/validator.pub b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-0-keys/validator.pub new file mode 100644 index 000000000..8a52e3865 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-0-keys/validator.pub @@ -0,0 +1 @@ +026e13d08c01aad20a7b23c621efca70e65b7d4eb79e63ff3e3c7b2ca0b30fe286 diff --git a/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-1-keys/validator.priv b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-1-keys/validator.priv new file mode 100644 index 000000000..61778df3f --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-1-keys/validator.priv @@ -0,0 +1 @@ +57afd227fa46eed5ba93b2eb654e21e658f4c355ad3d15ff19ed7e29ccb54f0a diff --git a/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-1-keys/validator.pub b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-1-keys/validator.pub new file mode 100644 index 000000000..f4c282154 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-1-keys/validator.pub @@ -0,0 +1 @@ +02a9c5fb01838f22fb35cda223d279c73e707f523dada24ce61e84414246c843bd diff --git a/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-2-keys/validator.priv b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-2-keys/validator.priv new file mode 100644 index 000000000..76df2d7d3 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-2-keys/validator.priv @@ -0,0 +1 @@ +d8330e3dcf138860f180e7faec25ac2c5208ed30649b1a4e08d853bf49a775fd diff --git a/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-2-keys/validator.pub b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-2-keys/validator.pub new file mode 100644 index 000000000..17d976db6 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-2-keys/validator.pub @@ -0,0 +1 @@ +024b461a485dac687e9b7750584bd58a5dc106be9769e34b5395037fd4e319538e diff --git a/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-3-keys/validator.priv b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-3-keys/validator.priv new file mode 100644 index 000000000..16384dbab --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-3-keys/validator.priv @@ -0,0 +1 @@ +3c93e7065d13705a7f895121d9c0635bd8fd4ed5bb7168ee40a17476362db223 diff --git a/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-3-keys/validator.pub b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-3-keys/validator.pub new file mode 100644 index 000000000..3c63aea95 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-3-keys/validator.pub @@ -0,0 +1 @@ +027a772f60db0a1e91f5b5192276454ff218a0e4c996ca73ac14ab75f6bd84287a diff --git a/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-4-keys/validator.priv b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-4-keys/validator.priv new file mode 100644 index 000000000..c8f6733b3 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-4-keys/validator.priv @@ -0,0 +1 @@ +4420442b4e109e0fbde581f1e7da26f764d59bb09b4d7853fdc416b766ad837d diff --git a/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-4-keys/validator.pub b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-4-keys/validator.pub new file mode 100644 index 000000000..f612cb18a --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/secrets/chronicle-sawtooth-4-keys/validator.pub @@ -0,0 +1 @@ +0301a363d0e3eb53d1eec81a9a10399bee8fc496d8ac99f7a4005992b41511ffd8 diff --git a/charts/paravela/chronicle/0.1.27/secrets/exported_configmaps.yaml b/charts/paravela/chronicle/0.1.27/secrets/exported_configmaps.yaml new file mode 100644 index 000000000..e3a5aed3d --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/secrets/exported_configmaps.yaml @@ -0,0 +1,43 @@ +apiVersion: v1 +items: +- apiVersion: v1 + data: + chronicle-sawtooth-0: 026e13d08c01aad20a7b23c621efca70e65b7d4eb79e63ff3e3c7b2ca0b30fe286 + chronicle-sawtooth-1: 02a9c5fb01838f22fb35cda223d279c73e707f523dada24ce61e84414246c843bd + chronicle-sawtooth-2: 024b461a485dac687e9b7750584bd58a5dc106be9769e34b5395037fd4e319538e + chronicle-sawtooth-3: 027a772f60db0a1e91f5b5192276454ff218a0e4c996ca73ac14ab75f6bd84287a + chronicle-sawtooth-4: 0301a363d0e3eb53d1eec81a9a10399bee8fc496d8ac99f7a4005992b41511ffd8 + kind: ConfigMap + metadata: + creationTimestamp: "2024-10-01T09:28:48Z" + name: validator-public + namespace: default + resourceVersion: "2788713" + uid: 11e26411-50f1-4afe-b69f-7e4bc94dcff0 +- apiVersion: v1 + data: + chronicle-sawtooth-0: 7b38377617463fa972241ee62f24c190ee5fb51db284decae7dc7ddcd83f7e72 + chronicle-sawtooth-1: 57afd227fa46eed5ba93b2eb654e21e658f4c355ad3d15ff19ed7e29ccb54f0a + chronicle-sawtooth-2: d8330e3dcf138860f180e7faec25ac2c5208ed30649b1a4e08d853bf49a775fd + chronicle-sawtooth-3: 3c93e7065d13705a7f895121d9c0635bd8fd4ed5bb7168ee40a17476362db223 + chronicle-sawtooth-4: 4420442b4e109e0fbde581f1e7da26f764d59bb09b4d7853fdc416b766ad837d + kind: ConfigMap + metadata: + creationTimestamp: "2024-10-01T09:28:48Z" + name: validator-secret + namespace: default + resourceVersion: "2788714" + uid: 0f6a346c-d605-432a-9c1e-00af93742a79 +- apiVersion: v1 + data: + node: chronicle-sawtooth-0 + kind: ConfigMap + metadata: + creationTimestamp: "2024-10-01T09:28:41Z" + name: chronicle-sawtooth-genesis + namespace: default + resourceVersion: "2788649" + uid: 69a0223b-57a2-4da9-9c76-829224a32235 +kind: List +metadata: + resourceVersion: "" diff --git a/charts/paravela/chronicle/0.1.27/templates/_chronicle.tpl b/charts/paravela/chronicle/0.1.27/templates/_chronicle.tpl new file mode 100644 index 000000000..a7d95ec39 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/_chronicle.tpl @@ -0,0 +1,128 @@ +{{- define "chronicle.replicas" -}} +{{ .Values.replicas }} +{{- end -}} + +{{- define "tp.replicas" -}} +{{ include "lib.call-nested" (list . "sawtooth" "sawtooth.replicas") | int }} +{{- end -}} + +{{- define "chronicle.service.name" -}} +{{- $svc := include "common.names.fullname" . -}} +{{ printf "%s" $svc }} +{{- end -}} + +{{- define "chronicle.labels.matchLabels" -}} +{{ include "common.labels.matchLabels" . }} +{{ include "chronicle.labels.appLabels" . }} +{{- end -}} + +{{- define "chronicle.labels.appLabels" -}} +app: {{ include "common.names.fullname" . }} +chronicle: {{ include "common.names.fullname" . }} +{{- end -}} + +{{- define "chronicle.labels" -}} +{{ include "lib.labels" . }} +{{ include "chronicle.labels.appLabels" . }} +{{- end -}} + +{{- define "chronicle.sawtooth.sawcomp" -}} +{{ include "lib.call-nested" (list . "sawtooth" "sawtooth.ports.sawcomp") | int }} +{{- end -}} + +{{- define "chronicle.sawtooth.rest" -}} +{{ include "lib.call-nested" (list . "sawtooth" "sawtooth.ports.rest") | int }} +{{- end -}} + +{{- define "chronicle.sawtooth.service" -}} +{{- $svc := include "lib.call-nested" (list . "sawtooth" "common.names.fullname") -}} +{{ printf "%s" $svc }} +{{- end -}} + +{{- define "chronicle.affinity" -}} +{{- if .Values.affinity -}} +{{- toYaml .Values.affinity }} +{{- end -}} +{{- end -}} + +{{- define "chronicle.api.service" -}} +{{ include "chronicle.service.name" . }}-chronicle-api +{{- end -}} + +{{- define "chronicle.id-provider.service" -}} +{{ include "common.names.fullname" . }}-test-id-provider +{{- end -}} + +{{- define "chronicle.id-provider.service.jwks.url" -}} +http://{{ include "chronicle.id-provider.service" . }}:8090/jwks +{{- end -}} + +{{- define "chronicle.id-provider.service.userinfo.url" -}} +http://{{ include "chronicle.id-provider.service" . }}:8090/userinfo +{{- end -}} + +{{- define "chronicle.id-claims" -}} +{{- if .Values.auth.id.claims -}} +--id-claims {{ .Values.auth.id.claims }} \ +{{- else -}} +{{- /* Do nothing */ -}} +{{- end -}} +{{- end -}} + +{{/* The JWKS and userinfo URLs are connected. */}} +{{/* If either is provided Chronicle will use the user-provided options. */}} +{{/* If neither is provided Chronicle should fall back to using the 'devIdProvider'.*/}} +{{- define "chronicle.jwks-url.url" -}} +{{- if or (.Values.auth.jwks.url) (.Values.auth.userinfo.url) -}} +{{- if .Values.auth.jwks.url -}} +{{ .Values.auth.jwks.url }} +{{- end -}} +{{- else -}} +{{- if .Values.devIdProvider.enabled -}} +{{ include "chronicle.id-provider.service.jwks.url" . }} +{{- end -}} +{{- end -}} +{{- end -}} + +{{- define "chronicle.jwks-url.cli" -}} +{{- if or (.Values.auth.jwks.url) (.Values.auth.userinfo.url) -}} +{{- if .Values.auth.jwks.url -}} +--jwks-address {{ include "chronicle.jwks-url.url" . }} \ +{{- end -}} +{{- else -}} +{{- if .Values.devIdProvider.enabled -}} +--jwks-address {{ include "chronicle.jwks-url.url" . }} \ +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* The JWKS and userinfo URLs are connected. */}} +{{/* If either is provided Chronicle will use the user-provided options. */}} +{{/* If neither is provided Chronicle should fall back to using the 'devIdProvider'.*/}} +{{- define "chronicle.userinfo-url" -}} +{{- if or (.Values.auth.jwks.url) (.Values.auth.userinfo.url) -}} +{{- if .Values.auth.userinfo.url -}} +{{ .Values.auth.userinfo.url }} +{{- end -}} +{{- else -}} +{{- if .Values.devIdProvider.enabled -}} +{{ include "chronicle.id-provider.service.userinfo.url" . }} +{{- end -}} +{{- end -}} +{{- end -}} + +{{- define "chronicle.userinfo-url.cli" -}} +{{- if or (.Values.auth.jwks.url) (.Values.auth.userinfo.url) -}} +{{- if .Values.auth.userinfo.url -}} +--userinfo-address {{ include "chronicle.userinfo-url" . }} \ +{{- end -}} +{{- else -}} +{{- if .Values.devIdProvider.enabled -}} +--userinfo-address {{ include "chronicle.userinfo-url" . }} \ +{{- end -}} +{{- end -}} +{{- end -}} + +{{- define "chronicle.root-key.secret" -}} +{{ include "common.names.fullname" . }}-root-key +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/templates/_utils.tpl b/charts/paravela/chronicle/0.1.27/templates/_utils.tpl new file mode 100644 index 000000000..b8d2b5030 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/_utils.tpl @@ -0,0 +1,44 @@ + +{{/* +{{ include "utils.image.url" (dict "imageRoot" .Values.sawtooth.containers.validator.image "global" .Values.global)}} +*/}} +{{- define "utils.image.url" -}} +{{- $globalRegistryName := default "index.docker.io" .global.image.registry -}} +{{- $repository := .imageRoot.repository -}} +{{- $registryName := default $globalRegistryName .imageRoot.registry -}} +{{- $tag := default .global.image.tag .imageRoot.tag -}} +{{- printf "%s/%s:%s" $registryName $repository $tag -}} +{{- end -}} + +{{/* +{{ include "utils.image" (dict "imageRoot" .Values.sawtooth.containers.validator.image "global" .Values.global)}} +*/}} +{{- define "utils.image" -}} +image: {{ include "utils.image.url" . }} +imagePullPolicy: {{ default "IfNotPresent" .imageRoot.pullPolicy }} +{{- end -}} + +{{/* */}} +{{- define "utils.hostaliases" -}} +{{- if .Values.hostAliases -}} +{{ toYaml .Values.hostAliases }} +{{- end -}} +{{- end -}} + +{{- define "utils.k8s.image" -}} +{{- include "utils.image" (dict "imageRoot" .Values.utils.k8s.image "global" .Values.global) -}} +{{- end -}} + +{{/* +{{ include "utils.call-nested" (list . "subchart" "template_name") }} +*/}} +{{- define "utils.call-nested" }} +{{- $dot := index . 0 }} +{{- $subchart := index . 1 | splitList "." }} +{{- $template := index . 2 }} +{{- $values := $dot.Values }} +{{- range $subchart }} +{{- $values = index $values . }} +{{- end }} +{{- include $template (dict "Chart" (dict "Name" (last $subchart)) "Values" $values "Release" $dot.Release "Capabilities" $dot.Capabilities) }} +{{- end }} diff --git a/charts/paravela/chronicle/0.1.27/templates/check_metrics_available.yaml b/charts/paravela/chronicle/0.1.27/templates/check_metrics_available.yaml new file mode 100644 index 000000000..f9965fe87 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/check_metrics_available.yaml @@ -0,0 +1,23 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "common.names.fullname" . }}-scripts +data: + first_depth_charge.sh: | + #!/bin/bash + metrics=$(curl -s http://localhost:9000/metrics) + count=$(echo "$metrics" | grep '^depth_charge_round_trip_count' | awk '{print $2}') + if [[ -z "$count" ]] || [[ $count -eq 0 ]]; then + exit 1 + fi + check_timeouts.sh: | + #!/bin/bash + metrics=$(curl -s http://localhost:9000/metrics) + timeouts=$(echo "$metrics" | grep '^depth_charge_timeouts' | awk '{print $2}' | tr -d '\r') + if [[ "$timeouts" =~ ^[0-9]+$ ]] && [[ "$timeouts" -ne 0 ]]; then + echo "Non-zero depth_charge_timeouts detected: $timeouts" + exit 1 + else + echo "No non-zero depth_charge_timeouts detected." + exit 0 + fi diff --git a/charts/paravela/chronicle/0.1.27/templates/chronicle-config.yaml b/charts/paravela/chronicle/0.1.27/templates/chronicle-config.yaml new file mode 100644 index 000000000..f0f114b48 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/chronicle-config.yaml @@ -0,0 +1,17 @@ +--- +{{$stlServiceName := include "lib.call-nested" (list . "sawtooth" "common.names.fullname")}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{.Release.Name}}-chronicle-config +data: + config.toml: | + [secrets] + path = "/var/lib/chronicle/secrets/" + [store] + path = "/var/lib/chronicle/store/" + address = "postgresql://{{ .Values.postgres.user }}@{{ .Values.postgres.host }}:5432/{{ .Values.postgres.database }}" + [validator] + address = "tcp://{{ include "chronicle.sawtooth.service" . }}:{{ include "chronicle.sawtooth.sawcomp" . }}" + [namespace_bindings] + default = "fd717fd6-70f1-44c1-81de-287d5e101089" diff --git a/charts/paravela/chronicle/0.1.27/templates/chronicle-init.yaml b/charts/paravela/chronicle/0.1.27/templates/chronicle-init.yaml new file mode 100644 index 000000000..dd9a7a95b --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/chronicle-init.yaml @@ -0,0 +1,228 @@ +{{$stlServiceName := include "lib.call-nested" (list . "sawtooth" "common.names.fullname")}} +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + name: {{ include "common.names.fullname" . }}-init + labels: {{ include "chronicle.labels" . | nindent 4 }} + component: chronicle +spec: + template: + metadata: + labels: {{ include "chronicle.labels" . | nindent 8 }} + component: chronicle + spec: + restartPolicy: Never + serviceAccountName: {{ include "lib.serviceAccountName" . }} + automountServiceAccountToken: true + volumes: {{- include "lib.volumes" .Values.opa.tp.extraVolumes | nindent 8 }} + - name: shared-data + emptyDir: {} + initContainers: + - name: get-secret + image: alpine/k8s:1.24.13 + command: [ "sh", "-ec" ] + args: + - | + if kubectl get secret {{ include "chronicle.root-key.secret" . }} -n {{.Release.Namespace}} >/dev/null 2>&1; then + echo "Secret found." + kubectl get secret {{ include "chronicle.root-key.secret" . }} -n {{.Release.Namespace}} -o jsonpath='{.data.*}' | base64 -d > /shared-data/root.pem + touch /shared-data/secret-found + else + echo "Secret not found." + fi + volumeMounts: + - name: shared-data + mountPath: /shared-data + - name: generate-secret + {{- include "lib.image" (dict "imageRoot" .Values.opa.opaInit.image "global" .Values.global ) | nindent 10 }} + command: [ "bash", "-ec"] + args: + - | + if [[ ! -f "/shared-data/root.pem" ]]; then + echo "Generating new root key." + opactl generate --output /shared-data/root.pem + else + echo "Root key already exists." + fi + env: {{ include "lib.safeToYaml" .Values.env | nindent 12 }} + - name: RUST_LOG + value: {{ .Values.logLevel }} + - name: RUST_BACKTRACE + value: {{ .Values.backtraceLevel }} + volumeMounts: + - name: shared-data + mountPath: /shared-data + - name: create-secret + image: alpine/k8s:1.24.13 + command: [ "sh", "-ec" ] + args: + - | + if [ -f "/shared-data/secret-found" ]; then + echo "Secret already exists." + else + echo "Creating k8s secret from key." + kubectl create secret generic {{ include "chronicle.root-key.secret" . }} \ + -n {{ .Release.Namespace }} \ + --from-file=/shared-data/root.pem + fi + volumeMounts: + - name: shared-data + mountPath: /shared-data + {{ if .Values.opa.enabled }} + - name: opa-bootstrap-root + {{- include "lib.image" (dict "imageRoot" .Values.opa.opaInit.image "global" .Values.global ) | nindent 10 }} + command: [ "bash", "-ec"] + args: + - | + wait-for-it $HOST:$PORT --timeout=0 + echo "Waiting to ensure Sawtooth validator is ready ..." + sleep 100 + + if [[ -f "/shared-data/secret-found" ]]; then + echo "Skipping root key bootstrap." + else + opactl \ + --sawtooth-address tcp://$HOST:$PORT \ + bootstrap \ + --root-key /shared-data/root.pem + fi + env: {{ include "lib.safeToYaml" .Values.env | nindent 12 }} + - name: HOST + value: {{ $stlServiceName }}.{{ .Release.Namespace }}.svc.cluster.local + - name: PORT + value: "{{ include "chronicle.sawtooth.sawcomp" . }}" + - name: RUST_LOG + value: {{ .Values.logLevel }} + - name: RUST_BACKTRACE + value: {{ .Values.backtraceLevel }} + volumeMounts: + - name: shared-data + mountPath: /shared-data + {{ if .Values.opa.policy.url }} + - name: wait-for-sawtooth-rest-api + {{- include "lib.image" (dict "imageRoot" .Values.opa.opaInit.image "global" .Values.global ) | nindent 10 }} + command: [ "bash", "-ec"] + args: + - | + wait-for-it $HOST:$PORT --timeout=0 + echo "Sawtooth rest API is ready." + env: + - name: HOST + value: {{ $stlServiceName }}.{{ .Release.Namespace }}.svc.cluster.local + - name: PORT + value: "{{ include "chronicle.sawtooth.rest" . }}" + - name: RUST_LOG + value: {{ .Values.logLevel }} + - name: RUST_BACKTRACE + value: {{ .Values.backtraceLevel }} + volumeMounts: + - name: shared-data + mountPath: /shared-data + - name: opa-settings + {{- include "lib.image" (dict "imageRoot" .Values.sawset.image "global" .Values.global ) | nindent 10 }} + command: [ "bash", "-ec"] + args: + - | + if sawtooth settings list --url http://$HOST:$PORT | grep -q "chronicle.opa.policy_name"; then + echo "Skipping setting Sawtooth OPA settings." + exit 0 + else + echo "Creating Sawtooth settings batch." + sawset proposal create \ + -k /etc/sawtooth/keys/{{ $stlServiceName }}-0 \ + chronicle.opa.policy_name={{ required "opa.policy.id required!" .Values.opa.policy.id }} \ + chronicle.opa.entrypoint={{ required "opa.policy.entrypoint required!" .Values.opa.policy.entrypoint }} \ + -o /shared-data/opa-settings.batch + + echo "Submitting Sawtooth OPA settings batch." + sawtooth batch submit \ + -f /shared-data/opa-settings.batch \ + --url http://$HOST:$PORT \ + --wait 60 + fi + env: + - name: HOST + value: {{ $stlServiceName }}.{{ .Release.Namespace }}.svc.cluster.local + - name: PORT + value: "{{ include "chronicle.sawtooth.rest" . }}" + volumeMounts: + - name: shared-data + mountPath: /shared-data + - name: validator-secret + mountPath: /etc/sawtooth/keys + readOnly: true + - name: get-policy + {{- include "lib.image" (dict "imageRoot" .Values.opa.opaInit.image "global" .Values.global ) | nindent 10 }} + command: [ "bash", "-ec"] + args: + - | + if opactl \ + --sawtooth-address tcp://$HOST:$PORT \ + get-policy \ + --id {{ .Values.opa.policy.id }} \ + --output policy.bin >/dev/null 2>&1; then + echo "Policy already set." + touch /shared-data/policy-already-set + else + echo "Policy not found." + exit 0 + fi + env: {{ include "lib.safeToYaml" .Values.env | nindent 12 }} + - name: HOST + value: {{ $stlServiceName }}.{{ .Release.Namespace }}.svc.cluster.local + - name: PORT + value: "{{ include "chronicle.sawtooth.sawcomp" . }}" + - name: RUST_LOG + value: {{ .Values.logLevel }} + - name: RUST_BACKTRACE + value: {{ .Values.backtraceLevel }} + volumeMounts: + - name: shared-data + mountPath: /shared-data + - name: set-policy + {{- include "lib.image" (dict "imageRoot" .Values.opa.opaInit.image "global" .Values.global ) | nindent 10 }} + command: [ "bash", "-ec"] + args: + - | + if [[ -f "/shared-data/policy-already-set" ]]; then + echo "Skipping setting policy." + exit 0 + else + echo "Policy not found on chain. Setting policy." + opactl \ + --sawtooth-address tcp://$HOST:$PORT \ + set-policy \ + --id {{ .Values.opa.policy.id }} \ + -p {{ .Values.opa.policy.url }} \ + --root-key /shared-data/root.pem + fi + env: {{ include "lib.safeToYaml" .Values.env | nindent 12 }} + - name: HOST + value: {{ $stlServiceName }}.{{ .Release.Namespace }}.svc.cluster.local + - name: PORT + value: "{{ include "chronicle.sawtooth.sawcomp" . }}" + - name: RUST_LOG + value: {{ .Values.logLevel }} + - name: RUST_BACKTRACE + value: {{ .Values.backtraceLevel }} + volumeMounts: + - name: shared-data + mountPath: /shared-data + {{ end }} + {{ end }} + containers: + - name: chronicle-init + image: busybox:1.36 + command: [ "sh", "-c"] + args: + - | + echo "Chronicle bootstrap and OPA settings initialization complete." + volumes: + - name: shared-data + emptyDir: {} + - name: validator-secret + configMap: + name: validator-secret diff --git a/charts/paravela/chronicle/0.1.27/templates/chronicle-secret-volume.yaml b/charts/paravela/chronicle/0.1.27/templates/chronicle-secret-volume.yaml new file mode 100644 index 000000000..417380c01 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/chronicle-secret-volume.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: chronicle-secrets + annotations: + "helm.sh/resource-policy": keep +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Gi diff --git a/charts/paravela/chronicle/0.1.27/templates/id-provider-service.yaml b/charts/paravela/chronicle/0.1.27/templates/id-provider-service.yaml new file mode 100644 index 000000000..eceaf7059 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/id-provider-service.yaml @@ -0,0 +1,20 @@ +{{- if .Values.devIdProvider.enabled }} +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ include "chronicle.id-provider.service" . }} + labels: {{ include "chronicle.labels" . | nindent 4 }} + component: test-id-provider +spec: + type: ClusterIP + clusterIP: None + sessionAffinity: ClientIP + ports: + - port: 8090 + protocol: TCP + targetPort: 8090 + name: {{ include "chronicle.id-provider.service" . }} + selector: {{ include "chronicle.labels.matchLabels" . | nindent 4 }} + component: test-id-provider +{{- end }} diff --git a/charts/paravela/chronicle/0.1.27/templates/id-provider-statefulset.yaml b/charts/paravela/chronicle/0.1.27/templates/id-provider-statefulset.yaml new file mode 100644 index 000000000..d25eb3295 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/id-provider-statefulset.yaml @@ -0,0 +1,28 @@ +{{- if .Values.devIdProvider.enabled }} +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ include "chronicle.id-provider.service" . }} + labels: {{ include "chronicle.labels" . | nindent 4 }} + component: test-id-provider +spec: + selector: + matchLabels: {{ include "chronicle.labels.matchLabels" . | nindent 6 }} + component: test-id-provider + serviceName: {{ include "chronicle.id-provider.service" . }} + template: + metadata: + labels: {{ include "chronicle.labels" . | nindent 8 }} + component: test-id-provider + spec: + serviceAccountName: {{ include "lib.serviceAccountName" . }} + affinity: {{ include "lib.safeToYaml" .Values.affinity | nindent 8 }} + containers: + - name: id-provider + {{- include "lib.image" (dict "imageRoot" .Values.devIdProvider.image "global" .Values.global ) | nindent 10 }} + ports: + - name: jwks + containerPort: 8090 + protocol: TCP +{{- end }} diff --git a/charts/paravela/chronicle/0.1.27/templates/ingress.yaml b/charts/paravela/chronicle/0.1.27/templates/ingress.yaml new file mode 100644 index 000000000..67a67d09e --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/ingress.yaml @@ -0,0 +1,4 @@ +{{- $serviceName := (include "chronicle.api.service" . ) -}} +{{- $ingressName := printf "%s" $serviceName -}} +{{- $servicePort := .Values.port | int -}} +{{ include "lib.ingress" (dict "ingressName" $ingressName "ingress" .Values.ingress "serviceName" $serviceName "servicePort" $servicePort "context" $) }} diff --git a/charts/paravela/chronicle/0.1.27/templates/pernode-opa-tp-service.yaml b/charts/paravela/chronicle/0.1.27/templates/pernode-opa-tp-service.yaml new file mode 100644 index 000000000..c0a893188 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/pernode-opa-tp-service.yaml @@ -0,0 +1,20 @@ +{{- if .Values.opa.enabled }} +{{- $ctx := . -}} +{{ range untilStep 0 ((include "tp.replicas" $ctx) | int) 1 }} +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ include "common.names.fullname" $ctx }}-opa-tp-{{ . }} + labels: {{- include "lib.labels" $ctx | nindent 4 }} + per-node: {{ include "common.names.fullname" $ctx }}-{{ . }} + component: opa-tp +spec: + type: ClusterIP + clusterIP: None + sessionAffinity: ClientIP + selector: {{- include "common.labels.matchLabels" $ctx | nindent 4 }} + component: opa-tp + statefulset.kubernetes.io/pod-name: {{ include "common.names.fullname" $ctx }}-{{ . }} +{{- end -}} +{{- end }} diff --git a/charts/paravela/chronicle/0.1.27/templates/pernode-tp-service.yaml b/charts/paravela/chronicle/0.1.27/templates/pernode-tp-service.yaml new file mode 100644 index 000000000..2bdfcce24 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/pernode-tp-service.yaml @@ -0,0 +1,18 @@ +{{- $ctx := . -}} +{{ range untilStep 0 ((include "tp.replicas" $ctx) | int) 1 }} +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ include "common.names.fullname" $ctx }}-tp-{{ . }} + labels: {{- include "lib.labels" $ctx | nindent 4 }} + per-node: {{ include "common.names.fullname" $ctx }}-{{ . }} + component: chronicle-tp +spec: + type: ClusterIP + clusterIP: None + sessionAffinity: ClientIP + selector: {{- include "common.labels.matchLabels" $ctx | nindent 4 }} + component: chronicle-tp + statefulset.kubernetes.io/pod-name: {{ include "common.names.fullname" $ctx }}-{{ . }} +{{- end -}} diff --git a/charts/paravela/chronicle/0.1.27/templates/secrets-roles.yaml b/charts/paravela/chronicle/0.1.27/templates/secrets-roles.yaml new file mode 100644 index 000000000..e56f3e083 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/secrets-roles.yaml @@ -0,0 +1,28 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "common.names.fullname" . }}-secrets-role + namespace: {{.Release.Namespace}} +rules: + - apiGroups: + - "" # "" refers to the core API group + resources: + - secrets + verbs: + - create + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "common.names.fullname" . }}-secrets-role-rb + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "common.names.fullname" . }}-secrets-role +subjects: +- kind: ServiceAccount + name: {{ include "lib.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} diff --git a/charts/paravela/chronicle/0.1.27/templates/service.yaml b/charts/paravela/chronicle/0.1.27/templates/service.yaml new file mode 100644 index 000000000..b7f9f06bd --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/service.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ include "chronicle.api.service" . }} + labels: {{ include "chronicle.labels" . | nindent 4 }} + component: chronicle +spec: + type: ClusterIP + sessionAffinity: ClientIP + ports: + - port: {{ .Values.port }} + protocol: TCP + targetPort: {{ .Values.port }} + name: chronicle + selector: {{ include "chronicle.labels.matchLabels" . | nindent 4 }} + component: chronicle diff --git a/charts/paravela/chronicle/0.1.27/templates/serviceaccount.yaml b/charts/paravela/chronicle/0.1.27/templates/serviceaccount.yaml new file mode 100644 index 000000000..c67cc27fd --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "lib.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{ if .Values.imagePullSecrets.enabled }} +imagePullSecrets: +{{range .Values.imagePullSecrets.value }} + - name: {{ .name }} +{{ end }} +{{ end }} diff --git a/charts/paravela/chronicle/0.1.27/templates/statefulset.yaml b/charts/paravela/chronicle/0.1.27/templates/statefulset.yaml new file mode 100644 index 000000000..e3cb37602 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/statefulset.yaml @@ -0,0 +1,218 @@ +{{$stlServiceName := include "lib.call-nested" (list . "sawtooth" "common.names.fullname")}} +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ include "common.names.fullname" . }}-chronicle + labels: {{ include "chronicle.labels" . | nindent 4 }} + component: chronicle +spec: + replicas: {{ include "chronicle.replicas" . }} + selector: + matchLabels: {{ include "chronicle.labels.matchLabels" . | nindent 6 }} + component: chronicle + serviceName: {{ include "common.names.fullname" . }} + template: + metadata: + labels: {{ include "chronicle.labels" . | nindent 8 }} + component: chronicle + spec: + serviceAccountName: {{ include "lib.serviceAccountName" . }} + affinity: {{ include "lib.safeToYaml" .Values.affinity | nindent 8 }} + initContainers: + - name: chronicle-permissions + image: busybox:1.36 + command: [ "sh", "-c"] + args: + - | + chown -R 999:999 /var/lib/chronicle || true + volumeMounts: + - name: chronicle-config + mountPath: /etc/chronicle/config/ + - name: chronicle-secrets + mountPath: /var/lib/chronicle/secrets/ + readOnly: false + - name: chronicle-keystore + {{- include "lib.image" (dict "imageRoot" .Values.image "global" .Values.global ) | nindent 10 }} + command: [ "bash", "-c"] + args: + - | + /usr/local/bin/chronicle \ + -c /etc/chronicle/config/config.toml \ + verify-keystore + env: {{ include "lib.safeToYaml" .Values.env | nindent 12 }} + - name: RUST_LOG + value: {{ .Values.logLevel }} + volumeMounts: + - name: chronicle-config + mountPath: /etc/chronicle/config/ + - name: chronicle-secrets + mountPath: /var/lib/chronicle/secrets/ + readOnly: false + {{- if and .Values.opa.enabled .Values.opa.policy.url }} + - name: wait-for-opa-settings + {{- include "lib.image" (dict "imageRoot" .Values.sawset.image "global" .Values.global ) | nindent 10 }} + command: [ "bash", "-exc"] + args: + - | + keepTrying=true + while [ $keepTrying = "true" ]; do + if sawtooth settings list --url http://$HOST:$PORT | grep -q "chronicle.opa.policy_name"; then + break + else + echo "Waiting for OPA policy id." + sleep 10 + fi + done + env: + - name: HOST + value: {{ $stlServiceName }}.{{ .Release.Namespace }}.svc.cluster.local + - name: PORT + value: "{{ include "chronicle.sawtooth.rest" . }}" + {{- end }} + containers: + {{- if .Values.postgres.enabled }} + - name: postgres + {{- include "lib.image" (dict "imageRoot" .Values.postgres.image "global" .Values.global ) | nindent 10 }} + ports: + - containerPort: {{.Values.postgres.port }} + resources: {{- include "lib.safeToYaml" .Values.postgres.resources | nindent 12 }} + env: + - name: PGDATA + value: /data/chronicle + - name: POSTGRES_PASSWORD + {{- if .Values.postgres.existingPasswordSecret }} + valueFrom: + secretKeyRef: + name: {{ .Values.postgres.existingPasswordSecret }} + key: {{ .Values.postgres.existingPasswordSecretKey }} + {{- else }} + value: {{ .Values.postgres.password }} + {{- end }} + {{- include "lib.safeToYaml" .Values.postgres.env | nindent 12 }} + volumeMounts: + - mountPath: /data + name: "pgdata" + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 12 }} + {{- end }} + - name: chronicle + {{- include "lib.image" (dict "imageRoot" .Values.image "global" .Values.global ) | nindent 10 }} + ports: + - containerPort: {{ .Values.port }} + command: [ "bash", "-c"] + args: + - | + {{ if .Values.auth.required }} + {{ if and (not .Values.auth.jwks.url) (not .Values.auth.userinfo.url) (not .Values.devIdProvider.enabled) }} + {{ required "If 'auth.required' you need to provide at least 'auth.jwks.url' or 'auth.userinfo.url', or 'devIdProvider.enabled' must be 'true'!" .Values.auth.jwks.url }} + {{ end }} + {{ end }} + + echo "Waiting 20 seconds for postgres to start"; + sleep 20; + chronicle \ + -c /etc/chronicle/config/config.toml \ + --console-logging json \ + --sawtooth tcp://{{ include "chronicle.sawtooth.service" . }}:{{ include "chronicle.sawtooth.sawcomp" . }} \ + --remote-database \ + --database-name {{ .Values.postgres.database }} \ + --database-username {{ .Values.postgres.user }} \ + --database-host {{ .Values.postgres.host }} \ + {{- if not .Values.opa.enabled }} + --embedded-opa-policy \ + {{- end }} + serve-api \ + --interface 0.0.0.0:{{ .Values.port }} \ + {{- if .Values.livenessProbe.enabled }} + --liveness-interval {{ .Values.livenessProbe.periodSeconds }} + --liveness-deadline {{ .Values.livenessProbe.timeoutSeconds }} + {{- end }} + {{- if .Values.auth.required }} + --require-auth \ + {{- end }} + {{ include "chronicle.jwks-url.cli" . }} + {{ include "chronicle.userinfo-url.cli" . }} + {{ include "chronicle.id-claims" . }}; + env: {{ include "lib.safeToYaml" .Values.env | nindent 12 }} + - name: RUST_LOG + value: {{ .Values.logLevel }} + - name: PGPASSWORD + {{- if .Values.postgres.existingPasswordSecret }} + valueFrom: + secretKeyRef: + name: {{ .Values.postgres.existingPasswordSecret }} + key: {{ .Values.postgres.existingPasswordSecretKey }} + {{- else }} + value: {{ .Values.postgres.password }} + {{- end }} + {{- include "lib.safeToYaml" .Values.postgres.env | nindent 12 }} + resources: {{- include "lib.safeToYaml" .Values.resources | nindent 12 }} + {{- if .Values.livenessProbe.enabled }} + livenessProbe: + exec: + command: + - /bin/bash + - /scripts/check_timeouts.sh + initialDelaySeconds: 1 + periodSeconds: 1 + failureThreshold: 1 + {{- end}} + {{- if .Values.readinessProbe.enabled }} + readinessProbe: + exec: + command: + - /bin/bash + - /scripts/first_depth_charge.sh + initialDelaySeconds: 1 + periodSeconds: 1 + failureThreshold: 600 + {{- end}} + volumeMounts: + - name: chronicle-config + mountPath: /etc/chronicle/config/ + - name: chronicle-secrets + mountPath: /var/lib/chronicle/secrets/ + readOnly: true + - name: chronicle-data + mountPath: /var/lib/chronicle/store/ + - name: check-metrics-available + mountPath: /scripts/ + readOnly: true + {{- include "lib.volumeMounts" .Values.extraVolumeMounts | nindent 12 }} + volumes: + - name: chronicle-secrets + persistentVolumeClaim: + claimName: chronicle-secrets + - name: chronicle-data + persistentVolumeClaim: + claimName: chronicle-data + - name: chronicle-config + configMap: + name: {{ .Release.Name }}-chronicle-config + - name: check-metrics-available + configMap: + name: {{ include "common.names.fullname" . }}-scripts + {{- if not .Values.postgres.persistence.enabled }} + - name: "pgdata" + emptyDir: {} + {{- end }} + volumeClaimTemplates: + - metadata: + name: chronicle-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 6Gi + {{- if .Values.postgres.persistence.enabled }} + - metadata: + name: "pgdata" + annotations: {{- include "lib.safeToYaml" .Values.postgres.persistence.annotations | nindent 10 }} + spec: + accessModes: {{- include "lib.safeToYaml" .Values.postgres.persistence.accessModes | nindent 10 }} + storageClassName: {{ .Values.postgres.persistence.storageClass | quote }} + resources: + requests: + storage: {{ .Values.postgres.persistence.size | quote }} + {{- end }} diff --git a/charts/paravela/chronicle/0.1.27/templates/test-token-getter-roles.yaml b/charts/paravela/chronicle/0.1.27/templates/test-token-getter-roles.yaml new file mode 100644 index 000000000..0eaf4423a --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/test-token-getter-roles.yaml @@ -0,0 +1,35 @@ +{{- if or (.Values.test.api.enabled) (.Values.test.auth.enabled) }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "common.names.fullname" . }}-test-token-getter-role + namespace: {{.Release.Namespace}} +rules: + - apiGroups: + - "" # "" refers to the core API group + resources: + - pods/exec + verbs: + - create + - apiGroups: + - "" # "" refers to the core API group + resources: + - pods + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "common.names.fullname" . }}-test-token-getter-rb + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "common.names.fullname" . }}-test-token-getter-role +subjects: +- kind: ServiceAccount + name: {{ include "lib.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/paravela/chronicle/0.1.27/templates/tests/api-test.yaml b/charts/paravela/chronicle/0.1.27/templates/tests/api-test.yaml new file mode 100644 index 000000000..354a69d7f --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/tests/api-test.yaml @@ -0,0 +1,130 @@ +{{- if .Values.test.api.enabled }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "common.names.fullname" . }}-api-test + labels: {{ include "chronicle.labels" . | nindent 4 }} + component: api-test + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": hook-succeeded +spec: + backoffLimit: 0 + template: + spec: + restartPolicy: Never + serviceAccountName: {{ include "lib.serviceAccountName" . }} + automountServiceAccountToken: true + {{- if .Values.auth.required }} + {{ if not .Values.test.auth.token }} + {{ if not .Values.devIdProvider.enabled }} + {{ required "If 'auth.required' when using the api-test 'test.auth.token' must be provided or 'devIdProvider.enabled' must be set to 'true'!" .Values.devIdProvider.enabled }} + {{ end }} + initContainers: + - name: wait-for-id-provider + {{- include "lib.image" (dict "imageRoot" .Values.test.api.image "global" .Values.global ) | nindent 10 }} + command: [ "sh", "-c" ] + args: + - | + URL="{{ include "chronicle.id-provider.service.jwks.url" . }}" + + wait_for_url() { + local url=$1 + scheme=$(echo "$url" | cut -f 1 -d :) + hostAndPort=$(echo "$url" | cut -f 3 -d /) + HOST=$(echo "$hostAndPort" | cut -f 1 -d :) + port=$(echo "$hostAndPort" | awk -F: '{print $2}') + + case $scheme in + "http") + defaultPort=80 + ;; + "https") + defaultPort=443 + ;; + *) + defaultPort=80 + ;; + esac + + PORT=${port:-$defaultPort} + wait-for-it "$HOST:$PORT" --timeout=120 + } + + echo "Waiting for id-provider to be ready ..." + wait_for_url "$URL" + + if [ $? -eq 0 ]; then + echo "Id-provider is ready. Exiting." + exit 0 + else + echo "Timeout occurred. Please check if the correct URL has been provided." + exit 1 + fi + - name: token-loader + image: alpine/k8s:1.24.13 + command: [ "sh", "-ec" ] + args: + - | + echo "Waiting to ensure id-provider is ready ..." + sleep 20 + echo "Getting token from id-provider ..." + kubectl exec {{ include "chronicle.id-provider.service" . }}-0 -c id-provider -- oauth-token > /shared-data/jwks-token + echo "Token loaded. Exiting." + volumeMounts: + - name: shared-data + mountPath: /shared-data + {{ end }} + {{- end }} + containers: + - name: test + {{- include "lib.image" (dict "imageRoot" .Values.test.api.image "global" .Values.global ) | nindent 10 }} + command: [ "sh", "-ec" ] + args: + - | + {{ if not .Values.test.auth.token }} + {{ if or .Values.auth.jwks.url .Values.auth.userinfo.url }} + echo "Auth endpoints provided but no token provided." + echo "Please provide 'test.auth.token' in the values.yaml file." + exit 1 + {{ end }} + {{ end }} + + API={{ include "chronicle.api.service" . }} + export PORT={{ .Values.port }} + echo "Waiting for API to be ready ..." + wait-for-it $API:$PORT --timeout=0 + echo "Getting IP address for API ..." + getent hosts $API | cut -f 1 -d \ | head -n 1 > /shared-data/api-ip || exit 1 + + {{- if .Values.test.auth.token }} + echo "{{ .Values.test.auth.token }}" > /shared-data/jwks-token + {{- end }} + + if [ -f "/shared-data/jwks-token" ]; then + echo "Found token." + sleep 5 + export TOKEN=$(cat "/shared-data/jwks-token") + fi + + export HOST=$(cat /shared-data/api-ip) + echo "Testing API with subscribe-submit-test..." + subscribe-submit-test + exit_code=$? + if [ $exit_code -eq 0 ]; then + echo "Test complete." + exit $exit_code + else + echo "Test failed." + exit $exit_code + fi + env: + - name: REQUIRE_AUTH + value: {{ .Values.auth.required | quote }} + volumeMounts: + - name: shared-data + mountPath: /shared-data + volumes: {{- include "lib.volumes" .Values.opa.tp.extraVolumes | nindent 8 }} + - name: shared-data + emptyDir: {} +{{- end }} diff --git a/charts/paravela/chronicle/0.1.27/templates/tests/auth-endpoints-test.yaml b/charts/paravela/chronicle/0.1.27/templates/tests/auth-endpoints-test.yaml new file mode 100644 index 000000000..79f80f9e9 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/tests/auth-endpoints-test.yaml @@ -0,0 +1,160 @@ +{{- if .Values.test.auth.enabled }} +{{ if not (or (.Values.devIdProvider.enabled) (or (.Values.auth.jwks.url) (.Values.auth.userinfo.url)))}} +{{ required "If 'test.auth.enabled' you need to provide 'auth.jwks.url', 'auth.userinfo.url', or enable the `devIdProvider`!" .Values.devIdProvider.enabled }} +{{ end }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "common.names.fullname" . }}-auth-endpoints-test + labels: {{ include "chronicle.labels" . | nindent 4 }} + component: auth-endpoints-test + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": hook-succeeded +spec: + backoffLimit: 0 + template: + spec: + restartPolicy: Never + serviceAccountName: {{ include "lib.serviceAccountName" . }} + {{- if .Values.devIdProvider.enabled }} + automountServiceAccountToken: true + initContainers: + - name: wait + {{- include "lib.image" (dict "imageRoot" .Values.test.api.image "global" .Values.global ) | nindent 10 }} + command: [ "sh", "-c" ] + args: + - | + URL="{{ include "chronicle.id-provider.service.jwks.url" . }}" + + wait_for_url() { + local url=$1 + scheme=$(echo "$url" | cut -f 1 -d :) + hostAndPort=$(echo "$url" | cut -f 3 -d /) + HOST=$(echo "$hostAndPort" | cut -f 1 -d :) + port=$(echo "$hostAndPort" | awk -F: '{print $2}') + + case $scheme in + "http") + defaultPort=80 + ;; + "https") + defaultPort=443 + ;; + *) + defaultPort=80 + ;; + esac + + PORT=${port:-$defaultPort} + wait-for-it "$HOST:$PORT" --timeout=120 + } + + echo "Waiting for id-provider to be ready ..." + wait_for_url "$URL" + + if [ $? -eq 0 ]; then + echo "Id-provider is ready. Exiting." + exit 0 + else + echo "Timeout occurred. Please check if the correct URL has been provided." + exit 1 + fi + - name: tok + image: alpine/k8s:1.24.13 + command: [ "sh", "-ec" ] + args: + - | + echo "Waiting to ensure id-provider is ready ..." + sleep 20 + echo "Getting token from id-provider ..." + kubectl exec {{ include "chronicle.id-provider.service" . }}-0 -c id-provider -- oauth-token > /shared-data/jwks-token + echo "Token loaded. Exiting." + volumeMounts: + - name: shared-data + mountPath: /shared-data + {{- end }} + containers: + - name: jwks + image: alpine/k8s:1.24.13 + command: [ "sh", "-c"] + args: + - | + {{ if or (.Values.auth.jwks.url) (.Values.devIdProvider.enabled) }} + {{ if .Values.auth.jwks.url }} + echo "Checking provided JWKS endpoint: {{ .Values.auth.jwks.url }}." + endPoint="{{ .Values.auth.jwks.url }}" + {{ else if .Values.auth.userinfo.url }} + echo "JWKS endpoint not set but userinfo url is set - skipping JWKS check." + exit 0 + {{ else }} + echo "Checking JWKS endpoint from id-provider: {{ include "chronicle.id-provider.service.jwks.url" . }}." + endPoint="{{ include "chronicle.id-provider.service.jwks.url" . }}" + {{ end }} + + time curl -s -o /shared-data/jwks.json $endPoint + + cat /shared-data/jwks.json | jq . > /dev/null \ + || { echo "JWKS endpoint did not return a valid JSON object."; echo "DEBUG: $(cat /shared-data/jwks.json)"; exit 1; } + echo "JWKS endpoint returned a valid JSON object:" + cat /shared-data/jwks.json + echo + {{ else }} + echo "Skipping JWKS endpoint check." + {{ end }} + + echo -e "Exiting." + volumeMounts: + - name: shared-data + mountPath: /shared-data + - name: userinfo + image: alpine/k8s:1.24.13 + command: [ "sh", "-c"] + args: + - | + {{ if or (.Values.auth.userinfo.url) (.Values.devIdProvider.enabled) }} + {{ if .Values.auth.userinfo.url }} + {{ if not .Values.test.auth.token }} + {{ required "If providing 'auth.userinfo.url' you need to provide a 'test.auth.token'!" .Values.test.auth.token}} + {{ end }} + echo "Checking user-provided userinfo endpoint: $endPoint" + endPoint="{{ .Values.auth.userinfo.url }}" + {{ else if .Values.auth.jwks.url }} + echo "Userinfo endpoint not set but JWKS url is set - skipping userinfo check." + exit 0 + {{ else }} + echo "Checking id-provider userinfo endpoint: $endPoint" + endPoint="{{ include "chronicle.id-provider.service.userinfo.url" . }}" + {{ end }} + + {{ if .Values.test.auth.token }} + {{ if not .Values.auth.userinfo.url }} + {{ required "If providing 'test.auth.token' you need to provide a 'auth.userinfo.url'!" .Values.auth.userinfo.url }} + {{ end }} + echo "Using 'test.auth.token' to check userinfo endpoint." + time curl -s -H "Authorization: Bearer {{ .Values.test.auth.token }}" -o /shared-data/userinfo.json $endPoint + {{ else }} + echo "Using token from id-provider to check userinfo endpoint." + time curl -s -H "Authorization: Bearer $(cat /shared-data/jwks-token)" -o /shared-data/userinfo.json $endPoint + {{ end }} + + if jq -e 'has("error")' /shared-data/userinfo.json > /dev/null; then + echo "Userinfo endpoint returned an error:" + echo "DEBUG: $(cat /shared-data/userinfo.json)" + exit 1 + else + echo "Userinfo endpoint returned a valid JSON object: $(cat /shared-data/userinfo.json)" + echo + fi + {{ else }} + echo "Skipping userinfo endpoint check." + {{ end }} + + echo -e "Exiting." + volumeMounts: + - name: shared-data + mountPath: /shared-data + volumes: + - name: shared-data + emptyDir: {} +{{- end }} diff --git a/charts/paravela/chronicle/0.1.27/templates/tp-service.yaml b/charts/paravela/chronicle/0.1.27/templates/tp-service.yaml new file mode 100644 index 000000000..de0d5c7cd --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/tp-service.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ include "common.names.fullname" . }}-tp + labels: {{ include "chronicle.labels" . | nindent 4 }} + component: chronicle-tp +spec: + type: ClusterIP + clusterIP: None + sessionAffinity: ClientIP + selector: {{ include "chronicle.labels.matchLabels" . | nindent 4 }} + component: chronicle-tp diff --git a/charts/paravela/chronicle/0.1.27/templates/tp-statefulset.yaml b/charts/paravela/chronicle/0.1.27/templates/tp-statefulset.yaml new file mode 100644 index 000000000..cfc8e77b7 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/templates/tp-statefulset.yaml @@ -0,0 +1,93 @@ +{{- define "chronicle.getHostOffset" -}} +{{- .Values.tp_offset | int -}} +{{- end -}} + +{{$stlServiceName := include "lib.call-nested" (list . "sawtooth" "common.names.fullname")}} +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ include "common.names.fullname" . }}-tp + labels: {{ include "chronicle.labels" . | nindent 4 }} + component: chronicle-tp +spec: + replicas: {{ include "tp.replicas" . }} + serviceName: {{ include "common.names.fullname" . }}-tp + podManagementPolicy: Parallel + updateStrategy: + type: RollingUpdate + {{ if (semverCompare "^1.22" .Capabilities.KubeVersion.Version) -}} + minReadySeconds: {{ .Values.tp.minReadySeconds | int }} + {{- end }} + selector: + matchLabels: {{ include "chronicle.labels.matchLabels" . | nindent 6 }} + component: chronicle-tp + template: + metadata: + labels: {{- include "chronicle.labels" . | nindent 8 }} + component: chronicle-tp + annotations: {{- include "lib.safeToYaml" .Values.podAnnotations | nindent 8 }} + spec: + serviceAccountName: {{ include "lib.serviceAccountName" . }} + affinity: {{ include "lib.safeToYaml" .Values.affinity | nindent 8 }} + hostAliases: + containers: + - name: chronicle-tp + {{- include "lib.image" (dict "imageRoot" .Values.tp.image "global" .Values.global ) | nindent 10 }} + command: [ "bash", "-c"] + args: + - | + # Extract the ordinal index from the pod name + ORDINAL=$(echo $POD_NAME | awk -F '-' '{print $NF}') + # Calculate the HOST using ordinal and offset + HOST={{ $stlServiceName }}-$(($ORDINAL + {{ include "chronicle.getHostOffset" . }})) + PORT={{ include "chronicle.sawtooth.sawcomp" . }} + echo tcp://$HOST:$PORT && + /usr/local/bin/chronicle_sawtooth_tp \ + --console-logging json \ + --connect tcp://$HOST:$PORT + resources: {{- include "lib.safeToYaml" .Values.tp.resources | nindent 12 }} + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: RUST_LOG + value: {{ .Values.tp.logLevel }} + - name: HOST + valueFrom: + fieldRef: + fieldPath: metadata.name + {{- include "lib.safeToYaml" .Values.tp.env | nindent 12 }} + volumeMounts: {{- include "lib.volumeMounts" .Values.tp.extraVolumeMounts | nindent 12 }} + {{- if .Values.opa.enabled }} + - name: opa-tp + {{- include "lib.image" (dict "imageRoot" .Values.opa.tp.image "global" .Values.global ) | nindent 10 }} + command: [ "bash", "-xc"] + args: + - | + ORDINAL=$(echo $POD_NAME | awk -F '-' '{print $NF}') + HOST={{ $stlServiceName }}-$(($ORDINAL + {{ include "chronicle.getHostOffset" . }})).{{ .Release.Namespace }}.svc.cluster.local + PORT={{ include "chronicle.sawtooth.sawcomp" . }} + wait-for-it $HOST:$PORT --timeout=0 + echo tcp://$HOST:$PORT && + /usr/local/bin/opa-tp \ + -C tcp://$HOST:$PORT \ + --console-logging json + resources: {{- include "lib.safeToYaml" .Values.opa.tp.resources | nindent 12 }} + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: RUST_LOG + value: {{ .Values.logLevel }} + - name: RUST_BACKTRACE + value: {{ .Values.backtraceLevel }} + - name: HOST + valueFrom: + fieldRef: + fieldPath: metadata.name + {{- include "lib.safeToYaml" .Values.tp.env | nindent 12 }} + volumeMounts: {{- include "lib.volumeMounts" .Values.opa.tp.extraVolumeMounts | nindent 12 }} + {{- end }} + volumes: {{- include "lib.volumes" .Values.tp.extraVolumes | nindent 8 }} diff --git a/charts/paravela/chronicle/0.1.27/values.yaml b/charts/paravela/chronicle/0.1.27/values.yaml new file mode 100644 index 000000000..620449d46 --- /dev/null +++ b/charts/paravela/chronicle/0.1.27/values.yaml @@ -0,0 +1,272 @@ +--- +## @md # Chronicle +## @md +## @md | field | description | default | +## @md |-|-|-| + +global: + image: + tag: + +## @md | `affinity`| custom affinity rules for the chronicle pod | {} | +affinity: {} + +auth: + ## @md | `auth.required` | if true require authentication, rejecting 'anonymous' requests | false | + required: false + id: + ## @md | `auth.id.claims` | Chronicle provides default values ["iss", "sub"] | nil | + claims: + jwks: + url: + userinfo: + url: + +## @md | `livenessProbe.enabled` | if true, enables the liveness probe | false | +livenessProbe: + enabled: true + ## @md | `livenessProbe.timeoutSeconds` | number of seconds after which the probe times out | 10 | + timeoutSeconds: 20 + ## @md | `livenessProbe.periodSeconds` | how often (in seconds) to perform the probe | 60 | + periodSeconds: 60 + +## @md | `readinessProbe.enabled` | if true, enables the readiness probe | false | +readinessProbe: + enabled: true + +## @md | `startUpProbe.enabled` | if true, enables the startup probe | true | +startUpProbe: + enabled: false + ## @md | `startUpProbe.initialDelaySeconds` | number of seconds after which the probe starts | 5 | + initialDelaySeconds: 5 + ## @md | `startUpProbe.failureThreshold` | when a probe fails, Kubernetes will try failureThreshold times before giving up | 30 | + failureThreshold: 30 + ## @md | `startUpProbe.periodSeconds` | how often (in seconds) to perform the probe | 10 | + periodSeconds: 10 + ## @md | `startUpProbe.timeoutSeconds` | number of seconds after which the probe times out | 3 | + timeoutSeconds: 30 + ## @md | `startUpProbe.namespaceName` | the Chronicle namespace in which the probe operates | default | + namespaceName: default + ## @md | `startUpProbe.namespaceUuid` | the UUID of the Chronicle namespace in which the probe operates | fd717fd6-70f1-44c1-81de-287d5e101089 | + namespaceUuid: fd717fd6-70f1-44c1-81de-287d5e101089 + +## @md | `backtraceLevel` | backtrace level for Chronicle | nil | +backtraceLevel: full + +devIdProvider: + enabled: true + ## @md | `devIdProvider.image` | the image to use for the id-provider container | blockchaintp/id-provider | + image: + ## @md | `devIdProvider.image.pullPolicy` | the image pull policy | IfNotPresent | + pullPolicy: IfNotPresent + ## @md | `devIdProvider.image.repository` | the image repository | blockchaintp/id-provider | + repository: blockchaintp/id-provider-amd64 + ## @md | `devIdProvider.image.tag` | the image tag | latest | + tag: BTP2.1.0-0.7.7 + +## @md | `extraVolumes` | a list of additional volumes to add to chronicle | [] | +extraVolumes: [] +## @md | `extraVolumeMounts` | a list of additional volume mounts to add to chronicle | [] | +extraVolumeMounts: [] + +image: + ## @md | `image.repository` | the repository of the image | blockchaintp/chronicle | + repository: blockchaintp/chronicle-amd64 + ## @md | `image.tag`| the tag of the image to use | latest | + tag: BTP2.1.0-0.7.7 + ## @md | `image.pullPolicy` | the image pull policy to use | IfNotPresent | + pullPolicy: IfNotPresent + +imagePullSecrets: + ## @md | `imagePullSecrets.enabled`| if true use the list of named imagePullSecrets | false | + enabled: false + ## @md | `imagePullSecrets.value`| a list if named secret references of the form `- name: secretName`| [] | + value: [] + +ingress: + ## @md | `ingress.apiVersion` | if necessary the apiVersion of the ingress may be overridden | "" | + apiVersion: "" + ## @md | `ingress.enabled` | true to enable the ingress to the main service rest-api | false | + enabled: false + ## @md | `ingress.certManager` | true to enable the acme certmanager for this ingress | false | + certManager: false + ## @md | `ingress.hostname` | primary hostname for the ingress | false | + hostname: + ## @md | `ingress.path` | path for the ingress's primary hostname | / | + path: / + ## @md | `ingress.pathType` | pathType for the ingress's primary hostname | nil | + pathType: + ## @md | `ingress.annotations` | annotations for the ingress | {} | + annotations: {} + ## @md | `ingress.tls` | true to enable tls on the ingress with a secrete at hostname-tls | false | + tls: false + ## @md | `ingress.extraHosts` | list of extra hosts to add to the ingress | [] | + extraHosts: [] + ## @md | `ingress.extraPaths` | list of extra paths to add to the primary host of the ingress | [] | + extraPaths: [] + ## @md | `ingress.extraTls` | list of extra tls entries | [] | + extraTls: [] + ## @md | `ingress.hosts`| list of ingress host and path declarations for the chronicle ingress| [] | + hosts: [] + # - host: chart-example.local + # paths: + # - / + +## @md | `logLevel` | log level for Chronicle | info | +logLevel: info + +opa: + ## @md | `opa.enabled` | if true set up a full OPA enabled setup | true | + enabled: false + opaInit: + ## @md | `opa.init.image` | the image to use for the chronicle-init container | blockchaintp/chronicle-opa-init | + image: + ## @md | `image.pullPolicy` | the image pull policy to use | IfNotPresent | + pullPolicy: IfNotPresent + ## @md | `image.repository` | the repository of the image | blockchaintp/chronicle | + repository: blockchaintp/opactl-amd64 + ## @md | `image.tag`| the tag of the image to use | latest | + tag: BTP2.1.0-0.7.7 + policy: + entrypoint: allow_transactions.allowed_users + id: allow_transactions + url: file:///app/policies/bundle.tar.gz + tp: + image: + ## @md | `image.repository` | the repository of the image | blockchaintp/chronicle | + repository: blockchaintp/opa-tp-amd64 + ## @md | `image.tag`| the tag of the image to use | latest | + tag: BTP2.1.0-0.7.3 + ## @md | `image.pullPolicy` | the image pull policy to use | IfNotPresent | + pullPolicy: IfNotPresent + ## @md | `opa.tp.resources` | resources | map | nil | + resources: + ## @md | `opa.tp.extraVolumes` | extra volumes declarations for the opa-tp deployment | list | nil + extraVolumes: + ## @md | `opa.tp.extraVolumeMounts` | extra volume mounts for opa-tp deployment | list | nil + extraVolumeMounts: + +## @md | `port` | the port on which the chronicle service listens | 9982 | +port: 9982 + +## @md | `replicas` | number of Chronicle replicas to run | 1 | +replicas: 1 + +## @md | `tp_offset` | offset for service name of the tp services, to ensure correct addressing in multi-cluster | 0 | +tp_offset: 0 + +serviceAccount: + ## @md | `serviceAccount.create` | true to create a service account | false | + create: true + ## @md | `serviceAccount.name` | name of the service account | nil (defaults to based on release name) | + name: + +test: + ## @md | `test.api` | test the chronicle GraphQL server API | + api: + ## @md | `test.api.enabled` | true to enable api-test Jobs and Services | true | + enabled: false + ## @md | `test.api.image` | the image to use for the api-test container | blockchaintp/chronicle-helm-api-test | + image: + ## @md | `test.api.image.pullPolicy` | the image pull policy | IfNotPresent | + pullPolicy: IfNotPresent + ## @md | `test.api.image.repository` | the image repository | blockchaintp/chronicle-helm-api-test | + repository: blockchaintp/chronicle-helm-api-test-amd64 + ## @md | `test.api.image.tag` | the image tag | latest | + tag: BTP2.1.0-0.7.7 + ## @md | `test.auth` | test the chronicle auth server API | + auth: + ## @md | `test.auth.enabled` | true to enable auth-related testing | true | + enabled: true + ## @md | `test.auth.token` | provide a token for auth-related testing | nil | + token: + +postgres: + # if enabled we allocate a postgres database here + ## @md | `postgres.enabled` | if true create an internal postgres instance | boolean | true | + enabled: true + ## @md | `postgres.env` | postgres environment variables | map | N/A | + env: + image: + registry: + ## @md | `postgres.image.repository` | postgres image repository | string | "postgres" | + repository: postgres + ## @md | `postgres.image.tag` | postgres image tag | string | "11" | + tag: "11" + ## @md | `postgres.user` | user for the postgres database | string | "postgres" | + user: postgres + ## @md | `postgres.host` | host for the postgres database | string | "localhost" | + host: localhost + ## @md | `postgres.database` | database for the postgres database | string | "postgres" | + database: postgres + ## @md | `postgres.port` | port for the postgres database | int | 5432 | + port: 5432 + ## @md | `postgres.password` | password for the postgres database | string | "postgres" | + password: postgres + ## @md | `postgres.existingPasswordSecret` | name of a secret containing the postgres password | string | nil | + existingPasswordSecret: + ## @md | `postgres.existingPasswordSecret` | name of the key in a secret containing the postgres password | string | nil | + existingPasswordSecretKey: + ## @md | `postgres.tls` | postgres TLS configuration | string | nil | + tls: + ## @md | `postgres.persistence` | postgres persistence settings | map | N/A | + persistence: + ## @md | `postgres.persistence.enabled` | if true allocate a PVC for the postgres instance | boolean | false | + enabled: false + ## @md | `postgres.persistence.annotations` | any custom annotations to the postgres PVC's | map | {} | + annotations: {} + ## @md | `postgres.persistence.accessModes` | postgres PVC access modes | list | [ "ReadWriteOnce" ] | + accessModes: + - "ReadWriteOnce" + ## if set to "-" (empty string) then storageClassName: "", which disables dynamic provisioning + ## if undefined or set to null, no storageClassName is set and the clusters default StorageClass will be used + ## if a storageClass name is set then storageClassName: "setValue" + ## @md | `postgres.persistence.storageClass` | postgres PVC storageClass | string | nil | + storageClass: + ## @md | `postgres.persistence.size` | postgres PVC volume size | string | "40Gi" | + size: "40Gi" + ## @md | `postgres.resources` | resources | map | nil | + resources: + +## @md | `resources` | resources | map | nil | +resources: + +sawset: + image: + ## @md | `sawset.image.pullPolicy` | the image pull policy | IfNotPresent | + pullPolicy: IfNotPresent + ## @md | `sawset.image.repository` | the image repository | blockchaintp/sawtooth-validator | + repository: blockchaintp/sawtooth-validator + ## @md | `sawset.image.tag` | the image tag | latest | + tag: BTP2.1.0 + +tp: + ## @md | `tp.args` | a string of arguments to pass to the tp container| nil | + args: + image: + ## @md | `tp.image.pullPolicy` | the image pull policy | IfNotPresent | + pullPolicy: IfNotPresent + ## @md | `tp.image.repository` | the image repository | blockchaintp/chronicle-tp | + repository: blockchaintp/chronicle-tp-amd64 + ## @md | `tp.image.tag` | the image tag | latest | + tag: BTP2.1.0-0.7.7 + ## @md | `tp.extraVolumes` | extra volumes declarations for the chronicle-tp deployment | list | nil + extraVolumes: + ## @md | `tp.extraVolumeMounts` | extra volume mounts for chronicle-tp deployment | list | nil + extraVolumeMounts: + ## @md | `tp.resources` | resources | map | nil | + resources: + ## @md | `tp.maxUnavailable` | maximum unavailable nodes during a rolling upgrade | + maxUnavailable: 1 + ## @md | `tp.minReadySeconds` | minimum time before node becomes available | + minReadySeconds: 0 + logLevel: info + +volumes: {} + +## @md | `sawtooth` | sawtooth options may be configured | see [Sawtooth](../sawtooth/README.md) | +sawtooth: + sawtooth: + consensus: 400 + statefulset: + enabled: true diff --git a/charts/redpanda/redpanda/5.9.7/.helmignore b/charts/redpanda/redpanda/5.9.7/.helmignore new file mode 100644 index 000000000..d5bb5e6ba --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/.helmignore @@ -0,0 +1,28 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +README.md.gotmpl +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ + +*.go +testdata/ +ci/ diff --git a/charts/redpanda/redpanda/5.9.7/Chart.lock b/charts/redpanda/redpanda/5.9.7/Chart.lock new file mode 100644 index 000000000..b3c6c0a2a --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/Chart.lock @@ -0,0 +1,9 @@ +dependencies: +- name: console + repository: https://charts.redpanda.com + version: 0.7.29 +- name: connectors + repository: https://charts.redpanda.com + version: 0.1.13 +digest: sha256:3023f8ca61cf80050d0f0e73f9e86b73ae796717c651be8765c9db90996e5462 +generated: "2024-09-26T22:13:55.854012+02:00" diff --git a/charts/redpanda/redpanda/5.9.7/Chart.yaml b/charts/redpanda/redpanda/5.9.7/Chart.yaml new file mode 100644 index 000000000..d278d7236 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/Chart.yaml @@ -0,0 +1,38 @@ +annotations: + artifacthub.io/images: | + - name: redpanda + image: docker.redpanda.com/redpandadata/redpanda:v24.2.7 + - name: busybox + image: busybox:latest + artifacthub.io/license: Apache-2.0 + artifacthub.io/links: | + - name: Documentation + url: https://docs.redpanda.com + - name: "Helm (>= 3.10.0)" + url: https://helm.sh/docs/intro/install/ + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Redpanda + catalog.cattle.io/kube-version: '>=1.21-0' + catalog.cattle.io/release-name: redpanda +apiVersion: v2 +appVersion: v24.2.7 +dependencies: +- condition: console.enabled + name: console + repository: https://charts.redpanda.com + version: '>=0.5 <1.0' +- condition: connectors.enabled + name: connectors + repository: https://charts.redpanda.com + version: '>=0.1.2 <1.0' +description: Redpanda is the real-time engine for modern apps. +icon: file://assets/icons/redpanda.svg +kubeVersion: '>=1.21-0' +maintainers: +- name: redpanda-data + url: https://github.com/orgs/redpanda-data/people +name: redpanda +sources: +- https://github.com/redpanda-data/helm-charts +type: application +version: 5.9.7 diff --git a/charts/redpanda/redpanda/5.9.7/LICENSE b/charts/redpanda/redpanda/5.9.7/LICENSE new file mode 100644 index 000000000..261eeb9e9 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/charts/redpanda/redpanda/5.9.7/README.md b/charts/redpanda/redpanda/5.9.7/README.md new file mode 100644 index 000000000..1c129c160 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/README.md @@ -0,0 +1,1214 @@ +# Redpanda Helm Chart Specification +--- +description: Find the default values and descriptions of settings in the Redpanda Helm chart. +--- + +![Version: 5.9.7](https://img.shields.io/badge/Version-5.9.7-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v24.2.7](https://img.shields.io/badge/AppVersion-v24.2.7-informational?style=flat-square) + +This page describes the official Redpanda Helm Chart. In particular, this page describes the contents of the chart’s [`values.yaml` file](https://github.com/redpanda-data/helm-charts/blob/main/charts/redpanda/values.yaml). Each of the settings is listed and described on this page, along with any default values. + +For instructions on how to install and use the chart, including how to override and customize the chart’s values, refer to the [deployment documentation](https://docs.redpanda.com/docs/deploy/deployment-option/self-hosted/kubernetes/kubernetes-deploy/). + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.13.1](https://github.com/norwoodj/helm-docs/releases/v1.13.1) + +## Source Code + +* + +## Requirements + +Kubernetes: `>= 1.25.0-0` + +| Repository | Name | Version | +|------------|------|---------| +| https://charts.redpanda.com | connectors | >=0.1.2 <1.0 | +| https://charts.redpanda.com | console | >=0.5 <1.0 | + +## Settings + +### [affinity](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=affinity) + +Affinity constraints for scheduling Pods, can override this for StatefulSets and Jobs. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity). + +**Default:** `{}` + +### [auditLogging](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auditLogging) + +Audit logging for a redpanda cluster, must have enabled sasl and have one kafka listener supporting sasl authentication for audit logging to work. Note this feature is only available for redpanda versions >= v23.3.0. + +**Default:** + +``` +{"clientMaxBufferSize":16777216,"enabled":false,"enabledEventTypes":null,"excludedPrincipals":null,"excludedTopics":null,"listener":"internal","partitions":12,"queueDrainIntervalMs":500,"queueMaxBufferSizePerShard":1048576,"replicationFactor":null} +``` + +### [auditLogging.clientMaxBufferSize](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auditLogging.clientMaxBufferSize) + +Defines the number of bytes (in bytes) allocated by the internal audit client for audit messages. + +**Default:** `16777216` + +### [auditLogging.enabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auditLogging.enabled) + +Enable or disable audit logging, for production clusters we suggest you enable, however, this will only work if you also enable sasl and a listener with sasl enabled. + +**Default:** `false` + +### [auditLogging.enabledEventTypes](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auditLogging.enabledEventTypes) + +Event types that should be captured by audit logs, default is [`admin`, `authenticate`, `management`]. + +**Default:** `nil` + +### [auditLogging.excludedPrincipals](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auditLogging.excludedPrincipals) + +List of principals to exclude from auditing, default is null. + +**Default:** `nil` + +### [auditLogging.excludedTopics](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auditLogging.excludedTopics) + +List of topics to exclude from auditing, default is null. + +**Default:** `nil` + +### [auditLogging.listener](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auditLogging.listener) + +Kafka listener name, note that it must have `authenticationMethod` set to `sasl`. For external listeners, use the external listener name, such as `default`. + +**Default:** `"internal"` + +### [auditLogging.partitions](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auditLogging.partitions) + +Integer value defining the number of partitions used by a newly created audit topic. + +**Default:** `12` + +### [auditLogging.queueDrainIntervalMs](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auditLogging.queueDrainIntervalMs) + +In ms, frequency in which per shard audit logs are batched to client for write to audit log. + +**Default:** `500` + +### [auditLogging.queueMaxBufferSizePerShard](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auditLogging.queueMaxBufferSizePerShard) + +Defines the maximum amount of memory used (in bytes) by the audit buffer in each shard. + +**Default:** `1048576` + +### [auditLogging.replicationFactor](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auditLogging.replicationFactor) + +Defines the replication factor for a newly created audit log topic. This configuration applies only to the audit log topic and may be different from the cluster or other topic configurations. This cannot be altered for existing audit log topics. Setting this value is optional. If a value is not provided, Redpanda will use the `internal_topic_replication_factor cluster` config value. Default is `null` + +**Default:** `nil` + +### [auth](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auth) + +Authentication settings. For details, see the [SASL documentation](https://docs.redpanda.com/docs/manage/kubernetes/security/sasl-kubernetes/). + +**Default:** + +``` +{"sasl":{"bootstrapUser":{"mechanism":"SCRAM-SHA-256"},"enabled":false,"mechanism":"SCRAM-SHA-512","secretRef":"redpanda-users","users":[]}} +``` + +### [auth.sasl.bootstrapUser](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auth.sasl.bootstrapUser) + +Details about how to create the bootstrap user for the cluster. The secretKeyRef is optionally specified. If it is specified, the chart will use a password written to that secret when creating the "kubernetes-controller" bootstrap user. If it is unspecified, then the secret will be generated and stored in the secret "releasename"-bootstrap-user, with the key "password". + +**Default:** + +``` +{"mechanism":"SCRAM-SHA-256"} +``` + +### [auth.sasl.bootstrapUser.mechanism](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auth.sasl.bootstrapUser.mechanism) + +The authentication mechanism to use for the bootstrap user. Options are `SCRAM-SHA-256` and `SCRAM-SHA-512`. + +**Default:** `"SCRAM-SHA-256"` + +### [auth.sasl.enabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auth.sasl.enabled) + +Enable SASL authentication. If you enable SASL authentication, you must provide a Secret in `auth.sasl.secretRef`. + +**Default:** `false` + +### [auth.sasl.mechanism](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auth.sasl.mechanism) + +The authentication mechanism to use for the superuser. Options are `SCRAM-SHA-256` and `SCRAM-SHA-512`. + +**Default:** `"SCRAM-SHA-512"` + +### [auth.sasl.secretRef](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auth.sasl.secretRef) + +A Secret that contains your superuser credentials. For details, see the [SASL documentation](https://docs.redpanda.com/docs/manage/kubernetes/security/sasl-kubernetes/#use-secrets). + +**Default:** `"redpanda-users"` + +### [auth.sasl.users](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=auth.sasl.users) + +Optional list of superusers. These superusers will be created in the Secret whose name is defined in `auth.sasl.secretRef`. If this list is empty, the Secret in `auth.sasl.secretRef` must already exist in the cluster before you deploy the chart. Uncomment the sample list if you wish to try adding sample sasl users or override to use your own. + +**Default:** `[]` + +### [clusterDomain](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=clusterDomain) + +Default Kubernetes cluster domain. + +**Default:** `"cluster.local"` + +### [commonLabels](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=commonLabels) + +Additional labels to add to all Kubernetes objects. For example, `my.k8s.service: redpanda`. + +**Default:** `{}` + +### [config](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=config) + +This section contains various settings supported by Redpanda that may not work correctly in a Kubernetes cluster. Changing these settings comes with some risk. Use these settings to customize various Redpanda configurations that are not covered in other sections. These values have no impact on the configuration or behavior of the Kubernetes objects deployed by Helm, and therefore should not be modified for the purpose of configuring those objects. Instead, these settings get passed directly to the Redpanda binary at startup. For descriptions of these properties, see the [configuration documentation](https://docs.redpanda.com/docs/cluster-administration/configuration/). + +**Default:** + +``` +{"cluster":{},"node":{"crash_loop_limit":5},"pandaproxy_client":{},"rpk":{},"schema_registry_client":{},"tunable":{"compacted_log_segment_size":67108864,"kafka_connection_rate_limit":1000,"log_segment_size_max":268435456,"log_segment_size_min":16777216,"max_compacted_log_segment_size":536870912}} +``` + +### [config.cluster](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=config.cluster) + +[Cluster Configuration Properties](https://docs.redpanda.com/current/reference/properties/cluster-properties/) + +**Default:** `{}` + +### [config.node](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=config.node) + +[Broker (node) Configuration Properties](https://docs.redpanda.com/docs/reference/broker-properties/). + +**Default:** `{"crash_loop_limit":5}` + +### [config.node.crash_loop_limit](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=config.node.crash_loop_limit) + +Crash loop limit A limit on the number of consecutive times a broker can crash within one hour before its crash-tracking logic is reset. This limit prevents a broker from getting stuck in an infinite cycle of crashes. User can disable this crash loop limit check by the following action: * One hour elapses since the last crash * The node configuration file, redpanda.yaml, is updated via config.cluster or config.node or config.tunable objects * The startup_log file in the node’s data_directory is manually deleted Default to 5 REF: https://docs.redpanda.com/current/reference/broker-properties/#crash_loop_limit + +**Default:** `5` + +### [config.tunable](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=config.tunable) + +Tunable cluster properties. Deprecated: all settings here may be specified via `config.cluster`. + +**Default:** + +``` +{"compacted_log_segment_size":67108864,"kafka_connection_rate_limit":1000,"log_segment_size_max":268435456,"log_segment_size_min":16777216,"max_compacted_log_segment_size":536870912} +``` + +### [config.tunable.compacted_log_segment_size](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=config.tunable.compacted_log_segment_size) + +See the [property reference documentation](https://docs.redpanda.com/docs/reference/cluster-properties/#compacted_log_segment_size). + +**Default:** `67108864` + +### [config.tunable.kafka_connection_rate_limit](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=config.tunable.kafka_connection_rate_limit) + +See the [property reference documentation](https://docs.redpanda.com/docs/reference/cluster-properties/#kafka_connection_rate_limit). + +**Default:** `1000` + +### [config.tunable.log_segment_size_max](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=config.tunable.log_segment_size_max) + +See the [property reference documentation](https://docs.redpanda.com/docs/reference/cluster-properties/#log_segment_size_max). + +**Default:** `268435456` + +### [config.tunable.log_segment_size_min](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=config.tunable.log_segment_size_min) + +See the [property reference documentation](https://docs.redpanda.com/docs/reference/cluster-properties/#log_segment_size_min). + +**Default:** `16777216` + +### [config.tunable.max_compacted_log_segment_size](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=config.tunable.max_compacted_log_segment_size) + +See the [property reference documentation](https://docs.redpanda.com/docs/reference/cluster-properties/#max_compacted_log_segment_size). + +**Default:** `536870912` + +### [connectors](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=connectors) + +Redpanda Managed Connectors settings For a reference of configuration settings, see the [Redpanda Connectors documentation](https://docs.redpanda.com/docs/deploy/deployment-option/cloud/managed-connectors/). + +**Default:** + +``` +{"deployment":{"create":false},"enabled":false,"test":{"create":false}} +``` + +### [console](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=console) + +Redpanda Console settings. For a reference of configuration settings, see the [Redpanda Console documentation](https://docs.redpanda.com/docs/reference/console/config/). + +**Default:** + +``` +{"config":{},"configmap":{"create":false},"deployment":{"create":false},"enabled":true,"secret":{"create":false}} +``` + +### [enterprise](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=enterprise) + +Enterprise (optional) For details, see the [License documentation](https://docs.redpanda.com/docs/get-started/licenses/?platform=kubernetes#redpanda-enterprise-edition). + +**Default:** + +``` +{"license":"","licenseSecretRef":{}} +``` + +### [enterprise.license](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=enterprise.license) + +license (optional). + +**Default:** `""` + +### [enterprise.licenseSecretRef](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=enterprise.licenseSecretRef) + +Secret name and key where the license key is stored. + +**Default:** `{}` + +### [external](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=external) + +External access settings. For details, see the [Networking and Connectivity documentation](https://docs.redpanda.com/docs/manage/kubernetes/networking/networking-and-connectivity/). + +**Default:** + +``` +{"enabled":true,"service":{"enabled":true},"type":"NodePort"} +``` + +### [external.enabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=external.enabled) + +Enable external access for each Service. You can toggle external access for each listener in `listeners..external..enabled`. + +**Default:** `true` + +### [external.service](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=external.service) + +Service allows you to manage the creation of an external kubernetes service object + +**Default:** `{"enabled":true}` + +### [external.service.enabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=external.service.enabled) + +Enabled if set to false will not create the external service type You can still set your cluster with external access but not create the supporting service (NodePort/LoadBalander). Set this to false if you rather manage your own service. + +**Default:** `true` + +### [external.type](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=external.type) + +External access type. Only `NodePort` and `LoadBalancer` are supported. If undefined, then advertised listeners will be configured in Redpanda, but the helm chart will not create a Service. You must create a Service manually. Warning: If you use LoadBalancers, you will likely experience higher latency and increased packet loss. NodePort is recommended in cases where latency is a priority. + +**Default:** `"NodePort"` + +### [fullnameOverride](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=fullnameOverride) + +Override `redpanda.fullname` template. + +**Default:** `""` + +### [image](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=image) + +Redpanda Docker image settings. + +**Default:** + +``` +{"pullPolicy":"IfNotPresent","repository":"docker.redpanda.com/redpandadata/redpanda","tag":""} +``` + +### [image.pullPolicy](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=image.pullPolicy) + +The imagePullPolicy. If `image.tag` is 'latest', the default is `Always`. + +**Default:** `"IfNotPresent"` + +### [image.repository](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=image.repository) + +Docker repository from which to pull the Redpanda Docker image. + +**Default:** + +``` +"docker.redpanda.com/redpandadata/redpanda" +``` + +### [image.tag](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=image.tag) + +The Redpanda version. See DockerHub for: [All stable versions](https://hub.docker.com/r/redpandadata/redpanda/tags) and [all unstable versions](https://hub.docker.com/r/redpandadata/redpanda-unstable/tags). + +**Default:** `Chart.appVersion`. + +### [imagePullSecrets](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=imagePullSecrets) + +Pull secrets may be used to provide credentials to image repositories See the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/). + +**Default:** `[]` + +### [license_key](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=license_key) + +DEPRECATED Enterprise license key (optional). For details, see the [License documentation](https://docs.redpanda.com/docs/get-started/licenses/?platform=kubernetes#redpanda-enterprise-edition). + +**Default:** `""` + +### [license_secret_ref](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=license_secret_ref) + +DEPRECATED Secret name and secret key where the license key is stored. + +**Default:** `{}` + +### [listeners](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners) + +Listener settings. Override global settings configured above for individual listeners. For details, see the [listeners documentation](https://docs.redpanda.com/docs/manage/kubernetes/networking/configure-listeners/). + +**Default:** + +``` +{"admin":{"external":{"default":{"advertisedPorts":[31644],"port":9645,"tls":{"cert":"external"}}},"port":9644,"tls":{"cert":"default","requireClientAuth":false}},"http":{"authenticationMethod":null,"enabled":true,"external":{"default":{"advertisedPorts":[30082],"authenticationMethod":null,"port":8083,"tls":{"cert":"external","requireClientAuth":false}}},"kafkaEndpoint":"default","port":8082,"tls":{"cert":"default","requireClientAuth":false}},"kafka":{"authenticationMethod":null,"external":{"default":{"advertisedPorts":[31092],"authenticationMethod":null,"port":9094,"tls":{"cert":"external"}}},"port":9093,"tls":{"cert":"default","requireClientAuth":false}},"rpc":{"port":33145,"tls":{"cert":"default","requireClientAuth":false}},"schemaRegistry":{"authenticationMethod":null,"enabled":true,"external":{"default":{"advertisedPorts":[30081],"authenticationMethod":null,"port":8084,"tls":{"cert":"external","requireClientAuth":false}}},"kafkaEndpoint":"default","port":8081,"tls":{"cert":"default","requireClientAuth":false}}} +``` + +### [listeners.admin](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.admin) + +Admin API listener (only one). + +**Default:** + +``` +{"external":{"default":{"advertisedPorts":[31644],"port":9645,"tls":{"cert":"external"}}},"port":9644,"tls":{"cert":"default","requireClientAuth":false}} +``` + +### [listeners.admin.external](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.admin.external) + +Optional external access settings. + +**Default:** + +``` +{"default":{"advertisedPorts":[31644],"port":9645,"tls":{"cert":"external"}}} +``` + +### [listeners.admin.external.default](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.admin.external.default) + +Name of the external listener. + +**Default:** + +``` +{"advertisedPorts":[31644],"port":9645,"tls":{"cert":"external"}} +``` + +### [listeners.admin.external.default.tls](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.admin.external.default.tls) + +The port advertised to this listener's external clients. List one port if you want to use the same port for each broker (would be the case when using NodePort service). Otherwise, list the port you want to use for each broker in order of StatefulSet replicas. If undefined, `listeners.admin.port` is used. + +**Default:** `{"cert":"external"}` + +### [listeners.admin.port](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.admin.port) + +The port for both internal and external connections to the Admin API. + +**Default:** `9644` + +### [listeners.admin.tls](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.admin.tls) + +Optional TLS section (required if global TLS is enabled) + +**Default:** + +``` +{"cert":"default","requireClientAuth":false} +``` + +### [listeners.admin.tls.cert](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.admin.tls.cert) + +Name of the Certificate used for TLS (must match a Certificate name that is registered in tls.certs). + +**Default:** `"default"` + +### [listeners.admin.tls.requireClientAuth](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.admin.tls.requireClientAuth) + +If true, the truststore file for this listener is included in the ConfigMap. + +**Default:** `false` + +### [listeners.http](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.http) + +HTTP API listeners (aka PandaProxy). + +**Default:** + +``` +{"authenticationMethod":null,"enabled":true,"external":{"default":{"advertisedPorts":[30082],"authenticationMethod":null,"port":8083,"tls":{"cert":"external","requireClientAuth":false}}},"kafkaEndpoint":"default","port":8082,"tls":{"cert":"default","requireClientAuth":false}} +``` + +### [listeners.kafka](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.kafka) + +Kafka API listeners. + +**Default:** + +``` +{"authenticationMethod":null,"external":{"default":{"advertisedPorts":[31092],"authenticationMethod":null,"port":9094,"tls":{"cert":"external"}}},"port":9093,"tls":{"cert":"default","requireClientAuth":false}} +``` + +### [listeners.kafka.external.default.advertisedPorts](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.kafka.external.default.advertisedPorts) + +If undefined, `listeners.kafka.external.default.port` is used. + +**Default:** `[31092]` + +### [listeners.kafka.external.default.port](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.kafka.external.default.port) + +The port used for external client connections. + +**Default:** `9094` + +### [listeners.kafka.port](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.kafka.port) + +The port for internal client connections. + +**Default:** `9093` + +### [listeners.rpc](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.rpc) + +RPC listener (this is never externally accessible). + +**Default:** + +``` +{"port":33145,"tls":{"cert":"default","requireClientAuth":false}} +``` + +### [listeners.schemaRegistry](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=listeners.schemaRegistry) + +Schema registry listeners. + +**Default:** + +``` +{"authenticationMethod":null,"enabled":true,"external":{"default":{"advertisedPorts":[30081],"authenticationMethod":null,"port":8084,"tls":{"cert":"external","requireClientAuth":false}}},"kafkaEndpoint":"default","port":8081,"tls":{"cert":"default","requireClientAuth":false}} +``` + +### [logging](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=logging) + +Log-level settings. + +**Default:** + +``` +{"logLevel":"info","usageStats":{"enabled":true}} +``` + +### [logging.logLevel](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=logging.logLevel) + +Log level Valid values (from least to most verbose) are: `warn`, `info`, `debug`, and `trace`. + +**Default:** `"info"` + +### [logging.usageStats](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=logging.usageStats) + +Send usage statistics back to Redpanda Data. For details, see the [stats reporting documentation](https://docs.redpanda.com/docs/cluster-administration/monitoring/#stats-reporting). + +**Default:** `{"enabled":true}` + +### [monitoring](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=monitoring) + +Monitoring. This will create a ServiceMonitor that can be used by Prometheus-Operator or VictoriaMetrics-Operator to scrape the metrics. + +**Default:** + +``` +{"enabled":false,"labels":{},"scrapeInterval":"30s"} +``` + +### [nameOverride](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=nameOverride) + +Override `redpanda.name` template. + +**Default:** `""` + +### [nodeSelector](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=nodeSelector) + +Node selection constraints for scheduling Pods, can override this for StatefulSets. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector). + +**Default:** `{}` + +### [post_install_job.affinity](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=post_install_job.affinity) + +**Default:** `{}` + +### [post_install_job.enabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=post_install_job.enabled) + +**Default:** `true` + +### [post_install_job.podTemplate.annotations](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=post_install_job.podTemplate.annotations) + +Additional annotations to apply to the Pods of this Job. + +**Default:** `{}` + +### [post_install_job.podTemplate.labels](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=post_install_job.podTemplate.labels) + +Additional labels to apply to the Pods of this Job. + +**Default:** `{}` + +### [post_install_job.podTemplate.spec](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=post_install_job.podTemplate.spec) + +A subset of Kubernetes' PodSpec type that will be merged into the final PodSpec. See [Merge Semantics](#merging-semantics) for details. + +**Default:** + +``` +{"containers":[{"env":[],"name":"post-install","securityContext":{}}],"securityContext":{}} +``` + +### [rackAwareness](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=rackAwareness) + +Rack Awareness settings. For details, see the [Rack Awareness documentation](https://docs.redpanda.com/docs/manage/kubernetes/kubernetes-rack-awareness/). + +**Default:** + +``` +{"enabled":false,"nodeAnnotation":"topology.kubernetes.io/zone"} +``` + +### [rackAwareness.enabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=rackAwareness.enabled) + +When running in multiple racks or availability zones, use a Kubernetes Node annotation value as the Redpanda rack value. Enabling this requires running with a service account with "get" Node permissions. To have the Helm chart configure these permissions, set `serviceAccount.create=true` and `rbac.enabled=true`. + +**Default:** `false` + +### [rackAwareness.nodeAnnotation](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=rackAwareness.nodeAnnotation) + +The common well-known annotation to use as the rack ID. Override this only if you use a custom Node annotation. + +**Default:** + +``` +"topology.kubernetes.io/zone" +``` + +### [rbac](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=rbac) + +Role Based Access Control. + +**Default:** + +``` +{"annotations":{},"enabled":false} +``` + +### [rbac.annotations](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=rbac.annotations) + +Annotations to add to the `rbac` resources. + +**Default:** `{}` + +### [rbac.enabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=rbac.enabled) + +Enable for features that need extra privileges. If you use the Redpanda Operator, you must deploy it with the `--set rbac.createRPKBundleCRs=true` flag to give it the required ClusterRoles. + +**Default:** `false` + +### [resources](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=resources) + +Pod resource management. This section simplifies resource allocation by providing a single location where resources are defined. Helm sets these resource values within the `statefulset.yaml` and `configmap.yaml` templates. The default values are for a development environment. Production-level values and other considerations are documented, where those values are different from the default. For details, see the [Pod resources documentation](https://docs.redpanda.com/docs/manage/kubernetes/manage-resources/). + +**Default:** + +``` +{"cpu":{"cores":1},"memory":{"container":{"max":"2.5Gi"}}} +``` + +### [resources.cpu](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=resources.cpu) + +CPU resources. For details, see the [Pod resources documentation](https://docs.redpanda.com/docs/manage/kubernetes/manage-resources/#configure-cpu-resources). + +**Default:** `{"cores":1}` + +### [resources.cpu.cores](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=resources.cpu.cores) + +Redpanda makes use of a thread per core model. For details, see this [blog](https://redpanda.com/blog/tpc-buffers). For this reason, Redpanda should only be given full cores. Note: You can increase cores, but decreasing cores is not currently supported. See the [GitHub issue](https://github.com/redpanda-data/redpanda/issues/350). This setting is equivalent to `--smp`, `resources.requests.cpu`, and `resources.limits.cpu`. For production, use `4` or greater. To maximize efficiency, use the `static` CPU manager policy by specifying an even integer for CPU resource requests and limits. This policy gives the Pods running Redpanda brokers access to exclusive CPUs on the node. See https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/#static-policy. + +**Default:** `1` + +### [resources.memory](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=resources.memory) + +Memory resources For details, see the [Pod resources documentation](https://docs.redpanda.com/docs/manage/kubernetes/manage-resources/#configure-memory-resources). + +**Default:** + +``` +{"container":{"max":"2.5Gi"}} +``` + +### [resources.memory.container](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=resources.memory.container) + +Enables memory locking. For production, set to `true`. enable_memory_locking: false It is recommended to have at least 2Gi of memory per core for the Redpanda binary. This memory is taken from the total memory given to each container. The Helm chart allocates 80% of the container's memory to Redpanda, leaving the rest for the Seastar subsystem (reserveMemory) and other container processes. So at least 2.5Gi per core is recommended in order to ensure Redpanda has a full 2Gi. These values affect `--memory` and `--reserve-memory` flags passed to Redpanda and the memory requests/limits in the StatefulSet. Valid suffixes: k, M, G, T, P, Ki, Mi, Gi, Ti, Pi To create `Guaranteed` Pod QoS for Redpanda brokers, provide both container max and min values for the container. For details, see https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed * Every container in the Pod must have a memory limit and a memory request. * For every container in the Pod, the memory limit must equal the memory request. + +**Default:** `{"max":"2.5Gi"}` + +### [resources.memory.container.max](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=resources.memory.container.max) + +Maximum memory count for each Redpanda broker. Equivalent to `resources.limits.memory`. For production, use `10Gi` or greater. + +**Default:** `"2.5Gi"` + +### [serviceAccount](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=serviceAccount) + +Service account management. + +**Default:** + +``` +{"annotations":{},"create":false,"name":""} +``` + +### [serviceAccount.annotations](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=serviceAccount.annotations) + +Annotations to add to the service account. + +**Default:** `{}` + +### [serviceAccount.create](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=serviceAccount.create) + +Specifies whether a service account should be created. + +**Default:** `false` + +### [serviceAccount.name](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=serviceAccount.name) + +The name of the service account to use. If not set and `serviceAccount.create` is `true`, a name is generated using the `redpanda.fullname` template. + +**Default:** `""` + +### [statefulset.additionalRedpandaCmdFlags](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.additionalRedpandaCmdFlags) + +Additional flags to pass to redpanda, + +**Default:** `[]` + +### [statefulset.additionalSelectorLabels](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.additionalSelectorLabels) + +Additional labels to be added to statefulset label selector. For example, `my.k8s.service: redpanda`. + +**Default:** `{}` + +### [statefulset.annotations](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.annotations) + +DEPRECATED Please use statefulset.podTemplate.annotations. Annotations are used only for `Statefulset.spec.template.metadata.annotations`. The StatefulSet does not have any dedicated annotation. + +**Default:** `{}` + +### [statefulset.budget.maxUnavailable](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.budget.maxUnavailable) + +**Default:** `1` + +### [statefulset.extraVolumeMounts](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.extraVolumeMounts) + +**Default:** `""` + +### [statefulset.extraVolumes](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.extraVolumes) + +**Default:** `""` + +### [statefulset.initContainerImage.repository](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainerImage.repository) + +**Default:** `"busybox"` + +### [statefulset.initContainerImage.tag](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainerImage.tag) + +**Default:** `"latest"` + +### [statefulset.initContainers.configurator.extraVolumeMounts](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainers.configurator.extraVolumeMounts) + +**Default:** `""` + +### [statefulset.initContainers.configurator.resources](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainers.configurator.resources) + +To create `Guaranteed` Pods for Redpanda brokers, provide both requests and limits for CPU and memory. For details, see https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed * Every container in the Pod must have a CPU limit and a CPU request. * For every container in the Pod, the CPU limit must equal the CPU request. + +**Default:** `{}` + +### [statefulset.initContainers.extraInitContainers](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainers.extraInitContainers) + +**Default:** `""` + +### [statefulset.initContainers.fsValidator.enabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainers.fsValidator.enabled) + +**Default:** `false` + +### [statefulset.initContainers.fsValidator.expectedFS](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainers.fsValidator.expectedFS) + +**Default:** `"xfs"` + +### [statefulset.initContainers.fsValidator.extraVolumeMounts](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainers.fsValidator.extraVolumeMounts) + +**Default:** `""` + +### [statefulset.initContainers.fsValidator.resources](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainers.fsValidator.resources) + +To create `Guaranteed` Pods for Redpanda brokers, provide both requests and limits for CPU and memory. For details, see https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed * Every container in the Pod must have a CPU limit and a CPU request. * For every container in the Pod, the CPU limit must equal the CPU request. + +**Default:** `{}` + +### [statefulset.initContainers.setDataDirOwnership.enabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainers.setDataDirOwnership.enabled) + +In environments where root is not allowed, you cannot change the ownership of files and directories. Enable `setDataDirOwnership` when using default minikube cluster configuration. + +**Default:** `false` + +### [statefulset.initContainers.setDataDirOwnership.extraVolumeMounts](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainers.setDataDirOwnership.extraVolumeMounts) + +**Default:** `""` + +### [statefulset.initContainers.setDataDirOwnership.resources](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainers.setDataDirOwnership.resources) + +To create `Guaranteed` Pods for Redpanda brokers, provide both requests and limits for CPU and memory. For details, see https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed * Every container in the Pod must have a CPU limit and a CPU request. * For every container in the Pod, the CPU limit must equal the CPU request. + +**Default:** `{}` + +### [statefulset.initContainers.setTieredStorageCacheDirOwnership.extraVolumeMounts](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainers.setTieredStorageCacheDirOwnership.extraVolumeMounts) + +**Default:** `""` + +### [statefulset.initContainers.setTieredStorageCacheDirOwnership.resources](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainers.setTieredStorageCacheDirOwnership.resources) + +To create `Guaranteed` Pods for Redpanda brokers, provide both requests and limits for CPU and memory. For details, see https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed * Every container in the Pod must have a CPU limit and a CPU request. * For every container in the Pod, the CPU limit must equal the CPU request. + +**Default:** `{}` + +### [statefulset.initContainers.tuning.extraVolumeMounts](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainers.tuning.extraVolumeMounts) + +**Default:** `""` + +### [statefulset.initContainers.tuning.resources](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.initContainers.tuning.resources) + +To create `Guaranteed` Pods for Redpanda brokers, provide both requests and limits for CPU and memory. For details, see https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed * Every container in the Pod must have a CPU limit and a CPU request. * For every container in the Pod, the CPU limit must equal the CPU request. + +**Default:** `{}` + +### [statefulset.livenessProbe.failureThreshold](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.livenessProbe.failureThreshold) + +**Default:** `3` + +### [statefulset.livenessProbe.initialDelaySeconds](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.livenessProbe.initialDelaySeconds) + +**Default:** `10` + +### [statefulset.livenessProbe.periodSeconds](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.livenessProbe.periodSeconds) + +**Default:** `10` + +### [statefulset.nodeSelector](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.nodeSelector) + +Node selection constraints for scheduling Pods of this StatefulSet. These constraints override the global `nodeSelector` value. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector). + +**Default:** `{}` + +### [statefulset.podAffinity](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.podAffinity) + +Inter-Pod Affinity rules for scheduling Pods of this StatefulSet. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity). + +**Default:** `{}` + +### [statefulset.podAntiAffinity](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.podAntiAffinity) + +Anti-affinity rules for scheduling Pods of this StatefulSet. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity). You may either edit the default settings for anti-affinity rules, or specify new anti-affinity rules to use instead of the defaults. + +**Default:** + +``` +{"custom":{},"topologyKey":"kubernetes.io/hostname","type":"hard","weight":100} +``` + +### [statefulset.podAntiAffinity.custom](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.podAntiAffinity.custom) + +Change `podAntiAffinity.type` to `custom` and provide your own podAntiAffinity rules here. + +**Default:** `{}` + +### [statefulset.podAntiAffinity.topologyKey](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.podAntiAffinity.topologyKey) + +The topologyKey to be used. Can be used to spread across different nodes, AZs, regions etc. + +**Default:** `"kubernetes.io/hostname"` + +### [statefulset.podAntiAffinity.type](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.podAntiAffinity.type) + +Valid anti-affinity types are `soft`, `hard`, or `custom`. Use `custom` if you want to supply your own anti-affinity rules in the `podAntiAffinity.custom` object. + +**Default:** `"hard"` + +### [statefulset.podAntiAffinity.weight](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.podAntiAffinity.weight) + +Weight for `soft` anti-affinity rules. Does not apply to other anti-affinity types. + +**Default:** `100` + +### [statefulset.podTemplate.annotations](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.podTemplate.annotations) + +Additional annotations to apply to the Pods of the StatefulSet. + +**Default:** `{}` + +### [statefulset.podTemplate.labels](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.podTemplate.labels) + +Additional labels to apply to the Pods of the StatefulSet. + +**Default:** `{}` + +### [statefulset.podTemplate.spec](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.podTemplate.spec) + +A subset of Kubernetes' PodSpec type that will be merged into the final PodSpec. See [Merge Semantics](#merging-semantics) for details. + +**Default:** + +``` +{"containers":[{"env":[],"name":"redpanda","securityContext":{}}],"securityContext":{}} +``` + +### [statefulset.priorityClassName](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.priorityClassName) + +PriorityClassName given to Pods of this StatefulSet. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass). + +**Default:** `""` + +### [statefulset.readinessProbe.failureThreshold](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.readinessProbe.failureThreshold) + +**Default:** `3` + +### [statefulset.readinessProbe.initialDelaySeconds](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.readinessProbe.initialDelaySeconds) + +**Default:** `1` + +### [statefulset.readinessProbe.periodSeconds](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.readinessProbe.periodSeconds) + +**Default:** `10` + +### [statefulset.readinessProbe.successThreshold](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.readinessProbe.successThreshold) + +**Default:** `1` + +### [statefulset.replicas](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.replicas) + +Number of Redpanda brokers (Redpanda Data recommends setting this to the number of worker nodes in the cluster) + +**Default:** `3` + +### [statefulset.securityContext](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.securityContext) + +DEPRECATED: Prefer to use podTemplate.spec.securityContext or podTemplate.spec.containers[0].securityContext. + +**Default:** + +``` +{"fsGroup":101,"fsGroupChangePolicy":"OnRootMismatch","runAsUser":101} +``` + +### [statefulset.sideCars.configWatcher.enabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.sideCars.configWatcher.enabled) + +**Default:** `true` + +### [statefulset.sideCars.configWatcher.extraVolumeMounts](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.sideCars.configWatcher.extraVolumeMounts) + +**Default:** `""` + +### [statefulset.sideCars.configWatcher.resources](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.sideCars.configWatcher.resources) + +To create `Guaranteed` Pods for Redpanda brokers, provide both requests and limits for CPU and memory. For details, see https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed * Every container in the Pod must have a memory limit and a memory request. * For every container in the Pod, the memory limit must equal the memory request. * Every container in the Pod must have a CPU limit and a CPU request. * For every container in the Pod, the CPU limit must equal the CPU request. To maximize efficiency, use the `static` CPU manager policy by specifying an even integer for CPU resource requests and limits. This policy gives the Pods running Redpanda brokers access to exclusive CPUs on the node. For details, see https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/#static-policy + +**Default:** `{}` + +### [statefulset.sideCars.configWatcher.securityContext](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.sideCars.configWatcher.securityContext) + +**Default:** `{}` + +### [statefulset.sideCars.controllers.createRBAC](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.sideCars.controllers.createRBAC) + +**Default:** `true` + +### [statefulset.sideCars.controllers.enabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.sideCars.controllers.enabled) + +**Default:** `false` + +### [statefulset.sideCars.controllers.healthProbeAddress](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.sideCars.controllers.healthProbeAddress) + +**Default:** `":8085"` + +### [statefulset.sideCars.controllers.image.repository](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.sideCars.controllers.image.repository) + +**Default:** + +``` +"docker.redpanda.com/redpandadata/redpanda-operator" +``` + +### [statefulset.sideCars.controllers.image.tag](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.sideCars.controllers.image.tag) + +**Default:** `"v2.2.4-24.2.5"` + +### [statefulset.sideCars.controllers.metricsAddress](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.sideCars.controllers.metricsAddress) + +**Default:** `":9082"` + +### [statefulset.sideCars.controllers.resources](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.sideCars.controllers.resources) + +To create `Guaranteed` Pods for Redpanda brokers, provide both requests and limits for CPU and memory. For details, see https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed * Every container in the Pod must have a CPU limit and a CPU request. * For every container in the Pod, the CPU limit must equal the CPU request. * Every container in the Pod must have a CPU limit and a CPU request. * For every container in the Pod, the CPU limit must equal the CPU request. To maximize efficiency, use the `static` CPU manager policy by specifying an even integer for CPU resource requests and limits. This policy gives the Pods running Redpanda brokers access to exclusive CPUs on the node. For details, see https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/#static-policy + +**Default:** `{}` + +### [statefulset.sideCars.controllers.run[0]](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.sideCars.controllers.run[0]) + +**Default:** `"all"` + +### [statefulset.sideCars.controllers.securityContext](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.sideCars.controllers.securityContext) + +**Default:** `{}` + +### [statefulset.startupProbe](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.startupProbe) + +Adjust the period for your probes to meet your needs. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes). + +**Default:** + +``` +{"failureThreshold":120,"initialDelaySeconds":1,"periodSeconds":10} +``` + +### [statefulset.terminationGracePeriodSeconds](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.terminationGracePeriodSeconds) + +Termination grace period in seconds is time required to execute preStop hook which puts particular Redpanda Pod (process/container) into maintenance mode. Before settle down on particular value please put Redpanda under load and perform rolling upgrade or rolling restart. That value needs to accommodate two processes: * preStop hook needs to put Redpanda into maintenance mode * after preStop hook Redpanda needs to handle gracefully SIGTERM signal Both processes are executed sequentially where preStop hook has hard deadline in the middle of terminationGracePeriodSeconds. REF: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#hook-handler-execution https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination + +**Default:** `90` + +### [statefulset.tolerations](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.tolerations) + +Taints to be tolerated by Pods of this StatefulSet. These tolerations override the global tolerations value. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/). + +**Default:** `[]` + +### [statefulset.topologySpreadConstraints[0].maxSkew](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.topologySpreadConstraints[0].maxSkew) + +**Default:** `1` + +### [statefulset.topologySpreadConstraints[0].topologyKey](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.topologySpreadConstraints[0].topologyKey) + +**Default:** + +``` +"topology.kubernetes.io/zone" +``` + +### [statefulset.topologySpreadConstraints[0].whenUnsatisfiable](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.topologySpreadConstraints[0].whenUnsatisfiable) + +**Default:** `"ScheduleAnyway"` + +### [statefulset.updateStrategy.type](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=statefulset.updateStrategy.type) + +**Default:** `"RollingUpdate"` + +### [storage](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage) + +Persistence settings. For details, see the [storage documentation](https://docs.redpanda.com/docs/manage/kubernetes/configure-storage/). + +**Default:** + +``` +{"hostPath":"","persistentVolume":{"annotations":{},"enabled":true,"labels":{},"nameOverwrite":"","size":"20Gi","storageClass":""},"tiered":{"config":{"cloud_storage_cache_size":5368709120,"cloud_storage_enable_remote_read":true,"cloud_storage_enable_remote_write":true,"cloud_storage_enabled":false},"credentialsSecretRef":{"accessKey":{"configurationKey":"cloud_storage_access_key"},"secretKey":{"configurationKey":"cloud_storage_secret_key"}},"hostPath":"","mountType":"emptyDir","persistentVolume":{"annotations":{},"labels":{},"storageClass":""}}} +``` + +### [storage.hostPath](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage.hostPath) + +Absolute path on the host to store Redpanda's data. If unspecified, then an `emptyDir` volume is used. If specified but `persistentVolume.enabled` is true, `storage.hostPath` has no effect. + +**Default:** `""` + +### [storage.persistentVolume](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage.persistentVolume) + +If `persistentVolume.enabled` is true, a PersistentVolumeClaim is created and used to store Redpanda's data. Otherwise, `storage.hostPath` is used. + +**Default:** + +``` +{"annotations":{},"enabled":true,"labels":{},"nameOverwrite":"","size":"20Gi","storageClass":""} +``` + +### [storage.persistentVolume.annotations](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage.persistentVolume.annotations) + +Additional annotations to apply to the created PersistentVolumeClaims. + +**Default:** `{}` + +### [storage.persistentVolume.labels](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage.persistentVolume.labels) + +Additional labels to apply to the created PersistentVolumeClaims. + +**Default:** `{}` + +### [storage.persistentVolume.nameOverwrite](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage.persistentVolume.nameOverwrite) + +Option to change volume claim template name for tiered storage persistent volume if tiered.mountType is set to `persistentVolume` + +**Default:** `""` + +### [storage.persistentVolume.storageClass](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage.persistentVolume.storageClass) + +To disable dynamic provisioning, set to `-`. If undefined or empty (default), then no storageClassName spec is set, and the default dynamic provisioner is chosen (gp2 on AWS, standard on GKE, AWS & OpenStack). + +**Default:** `""` + +### [storage.tiered.config](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage.tiered.config) + +Tiered Storage settings Requires `enterprise.licenseKey` or `enterprised.licenseSecretRef` For details, see the [Tiered Storage documentation](https://docs.redpanda.com/docs/manage/kubernetes/tiered-storage/). For a list of properties, see [Object Storage Properties](https://docs.redpanda.com/current/reference/properties/object-storage-properties/). + +**Default:** + +``` +{"cloud_storage_cache_size":5368709120,"cloud_storage_enable_remote_read":true,"cloud_storage_enable_remote_write":true,"cloud_storage_enabled":false} +``` + +### [storage.tiered.config.cloud_storage_cache_size](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage.tiered.config.cloud_storage_cache_size) + +Maximum size of the disk cache used by Tiered Storage. Default is 20 GiB. See the [property reference documentation](https://docs.redpanda.com/docs/reference/object-storage-properties/#cloud_storage_cache_size). + +**Default:** `5368709120` + +### [storage.tiered.config.cloud_storage_enable_remote_read](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage.tiered.config.cloud_storage_enable_remote_read) + +Cluster level default remote read configuration for new topics. See the [property reference documentation](https://docs.redpanda.com/docs/reference/object-storage-properties/#cloud_storage_enable_remote_read). + +**Default:** `true` + +### [storage.tiered.config.cloud_storage_enable_remote_write](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage.tiered.config.cloud_storage_enable_remote_write) + +Cluster level default remote write configuration for new topics. See the [property reference documentation](https://docs.redpanda.com/docs/reference/object-storage-properties/#cloud_storage_enable_remote_write). + +**Default:** `true` + +### [storage.tiered.config.cloud_storage_enabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage.tiered.config.cloud_storage_enabled) + +Global flag that enables Tiered Storage if a license key is provided. See the [property reference documentation](https://docs.redpanda.com/docs/reference/object-storage-properties/#cloud_storage_enabled). + +**Default:** `false` + +### [storage.tiered.hostPath](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage.tiered.hostPath) + +Absolute path on the host to store Redpanda's Tiered Storage cache. + +**Default:** `""` + +### [storage.tiered.persistentVolume.annotations](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage.tiered.persistentVolume.annotations) + +Additional annotations to apply to the created PersistentVolumeClaims. + +**Default:** `{}` + +### [storage.tiered.persistentVolume.labels](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage.tiered.persistentVolume.labels) + +Additional labels to apply to the created PersistentVolumeClaims. + +**Default:** `{}` + +### [storage.tiered.persistentVolume.storageClass](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=storage.tiered.persistentVolume.storageClass) + +To disable dynamic provisioning, set to "-". If undefined or empty (default), then no storageClassName spec is set, and the default dynamic provisioner is chosen (gp2 on AWS, standard on GKE, AWS & OpenStack). + +**Default:** `""` + +### [tests.enabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=tests.enabled) + +**Default:** `true` + +### [tls](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=tls) + +TLS settings. For details, see the [TLS documentation](https://docs.redpanda.com/docs/manage/kubernetes/security/kubernetes-tls/). + +**Default:** + +``` +{"certs":{"default":{"caEnabled":true},"external":{"caEnabled":true}},"enabled":true} +``` + +### [tls.certs](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=tls.certs) + +List all Certificates here, then you can reference a specific Certificate's name in each listener's `listeners..tls.cert` setting. + +**Default:** + +``` +{"default":{"caEnabled":true},"external":{"caEnabled":true}} +``` + +### [tls.certs.default](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=tls.certs.default) + +This key is the Certificate name. To apply the Certificate to a specific listener, reference the Certificate's name in `listeners..tls.cert`. + +**Default:** `{"caEnabled":true}` + +### [tls.certs.default.caEnabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=tls.certs.default.caEnabled) + +Indicates whether or not the Secret holding this certificate includes a `ca.crt` key. When `true`, chart managed clients, such as rpk, will use `ca.crt` for certificate verification and listeners with `require_client_auth` and no explicit `truststore` will use `ca.crt` as their `truststore_file` for verification of client certificates. When `false`, chart managed clients will use `tls.crt` for certificate verification and listeners with `require_client_auth` and no explicit `truststore` will use the container's CA certificates. + +**Default:** `true` + +### [tls.certs.external](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=tls.certs.external) + +Example external tls configuration uncomment and set the right key to the listeners that require them also enable the tls setting for those listeners. + +**Default:** `{"caEnabled":true}` + +### [tls.certs.external.caEnabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=tls.certs.external.caEnabled) + +Indicates whether or not the Secret holding this certificate includes a `ca.crt` key. When `true`, chart managed clients, such as rpk, will use `ca.crt` for certificate verification and listeners with `require_client_auth` and no explicit `truststore` will use `ca.crt` as their `truststore_file` for verification of client certificates. When `false`, chart managed clients will use `tls.crt` for certificate verification and listeners with `require_client_auth` and no explicit `truststore` will use the container's CA certificates. + +**Default:** `true` + +### [tls.enabled](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=tls.enabled) + +Enable TLS globally for all listeners. Each listener must include a Certificate name in its `.tls` object. To allow you to enable TLS for individual listeners, Certificates in `auth.tls.certs` are always loaded, even if `tls.enabled` is `false`. See `listeners..tls.enabled`. + +**Default:** `true` + +### [tolerations](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=tolerations) + +Taints to be tolerated by Pods, can override this for StatefulSets. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/). + +**Default:** `[]` + +### [tuning](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=tuning) + +Redpanda tuning settings. Each is set to their default values in Redpanda. + +**Default:** `{"tune_aio_events":true}` + +### [tuning.tune_aio_events](https://artifacthub.io/packages/helm/redpanda-data/redpanda?modal=values&path=tuning.tune_aio_events) + +Increase the maximum number of outstanding asynchronous IO operations if the current value is below a certain threshold. This allows Redpanda to make as many simultaneous IO requests as possible, increasing throughput. When this option is enabled, Helm creates a privileged container. If your security profile does not allow this, you can disable this container by setting `tune_aio_events` to `false`. For more details, see the [tuning documentation](https://docs.redpanda.com/docs/deploy/deployment-option/self-hosted/kubernetes/kubernetes-tune-workers/). + +**Default:** `true` + +## Merging Semantics + +The redpanda chart implements a form of object merging that's roughly a +middleground of [JSON Merge Patch][k8s.jsonmp] and [Kubernetes' Strategic Merge +Patch][k8s.smp]. This is done to aid end users in setting or overriding fields +that are not directly exposed via the chart. + +- Directives are not supported. +- List fields that are merged by a unique key in Kubernetes' SMP (e.g. + `containers`, `env`) will be merged in a similar awy. +- Only fields explicitly allowed by the chart's JSON schema will be merged. +- Additional containers that are not present in the original value will NOT be added. + +[k8s.smp]: https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/#use-a-strategic-merge-patch-to-update-a-deployment +[k8s.jsonmp]: https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/#use-a-json-merge-patch-to-update-a-deployment diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/.helmignore b/charts/redpanda/redpanda/5.9.7/charts/connectors/.helmignore new file mode 100644 index 000000000..2e271ea0f --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/.helmignore @@ -0,0 +1,29 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +README.md.gotmpl +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ + +*.go +testdata/ +ci/ +examples/ \ No newline at end of file diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/Chart.yaml b/charts/redpanda/redpanda/5.9.7/charts/connectors/Chart.yaml new file mode 100644 index 000000000..0dd2396e5 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/Chart.yaml @@ -0,0 +1,25 @@ +annotations: + artifacthub.io/images: | + - name: connectors + image: docker.redpanda.com/redpandadata/connectors:v1.0.31 + - name: rpk + image: docker.redpanda.com/redpandadata/redpanda:latest + artifacthub.io/license: Apache-2.0 + artifacthub.io/links: | + - name: Documentation + url: https://docs.redpanda.com + - name: "Helm (>= 3.6.0)" + url: https://helm.sh/docs/intro/install/ +apiVersion: v2 +appVersion: v1.0.31 +description: Redpanda managed Connectors helm chart +icon: https://images.ctfassets.net/paqvtpyf8rwu/3cYHw5UzhXCbKuR24GDFGO/73fb682e6157d11c10d5b2b5da1d5af0/skate-stand-panda.svg +kubeVersion: ^1.21.0-0 +maintainers: +- name: redpanda-data + url: https://github.com/orgs/redpanda-data/people +name: connectors +sources: +- https://github.com/redpanda-data/helm-charts +type: application +version: 0.1.13 diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/LICENSE b/charts/redpanda/redpanda/5.9.7/charts/connectors/LICENSE new file mode 100644 index 000000000..261eeb9e9 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/README.md b/charts/redpanda/redpanda/5.9.7/charts/connectors/README.md new file mode 100644 index 000000000..2cb143856 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/README.md @@ -0,0 +1,574 @@ +# Redpanda Connectors Helm Chart Specification +--- +description: Find the default values and descriptions of settings in the Redpanda Connectors Helm chart. +--- + +![Version: 0.1.13](https://img.shields.io/badge/Version-0.1.13-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v1.0.31](https://img.shields.io/badge/AppVersion-v1.0.31-informational?style=flat-square) + +This page describes the official Redpanda Connectors Helm Chart. In particular, this page describes the contents of the chart’s [`values.yaml` file](https://github.com/redpanda-data/helm-charts/blob/main/charts/connectors/values.yaml). Each of the settings is listed and described on this page, along with any default values. + +For instructions on how to install and use the chart, including how to override and customize the chart’s values, refer to the [deployment documentation](https://docs.redpanda.com/current/deploy/deployment-option/self-hosted/kubernetes/k-deploy-connectors/). + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.13.1](https://github.com/norwoodj/helm-docs/releases/v1.13.1) + +## Source Code + +* + +## Requirements + +Kubernetes: `^1.21.0-0` + +## Settings + +### [auth](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=auth) + +Authentication settings. For details, see the [SASL documentation](https://docs.redpanda.com/docs/manage/kubernetes/security/sasl-kubernetes/). The first line of the secret file is used. So the first superuser is used to authenticate to the Redpanda cluster. + +**Default:** + +``` +{"sasl":{"enabled":false,"mechanism":"scram-sha-512","secretRef":"","userName":""}} +``` + +### [auth.sasl.mechanism](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=auth.sasl.mechanism) + +The authentication mechanism to use for the superuser. Options are `scram-sha-256` and `scram-sha-512`. + +**Default:** `"scram-sha-512"` + +### [auth.sasl.secretRef](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=auth.sasl.secretRef) + +A Secret that contains your SASL user password. + +**Default:** `""` + +### [commonLabels](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=commonLabels) + +Additional labels to add to all Kubernetes objects. For example, `my.k8s.service: redpanda`. + +**Default:** `{}` + +### [connectors.additionalConfiguration](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.additionalConfiguration) + +A placeholder for any Java configuration settings for Kafka Connect that are not explicitly defined in this Helm chart. Java configuration settings are passed to the Kafka Connect startup script. + +**Default:** `""` + +### [connectors.bootstrapServers](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.bootstrapServers) + +A comma-separated list of Redpanda broker addresses in the format of IP:Port or DNS:Port. Kafka Connect uses this to connect to the Redpanda/Kafka cluster. + +**Default:** `""` + +### [connectors.brokerTLS.ca.secretNameOverwrite](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.brokerTLS.ca.secretNameOverwrite) + +If `secretRef` points to a Secret where the certificate authority (CA) is not under the `ca.crt` key, use `secretNameOverwrite` to overwrite it e.g. `corp-ca.crt`. + +**Default:** `""` + +### [connectors.brokerTLS.ca.secretRef](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.brokerTLS.ca.secretRef) + +The name of the Secret where the ca.crt file content is located. + +**Default:** `""` + +### [connectors.brokerTLS.cert.secretNameOverwrite](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.brokerTLS.cert.secretNameOverwrite) + +If secretRef points to secret where client signed certificate is not under tls.crt key then please use secretNameOverwrite to overwrite it e.g. corp-tls.crt + +**Default:** `""` + +### [connectors.brokerTLS.cert.secretRef](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.brokerTLS.cert.secretRef) + +The name of the secret where client signed certificate is located + +**Default:** `""` + +### [connectors.brokerTLS.enabled](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.brokerTLS.enabled) + +**Default:** `false` + +### [connectors.brokerTLS.key.secretNameOverwrite](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.brokerTLS.key.secretNameOverwrite) + +If secretRef points to secret where client private key is not under tls.key key then please use secretNameOverwrite to overwrite it e.g. corp-tls.key + +**Default:** `""` + +### [connectors.brokerTLS.key.secretRef](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.brokerTLS.key.secretRef) + +The name of the secret where client private key is located + +**Default:** `""` + +### [connectors.groupID](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.groupID) + +A unique string that identifies the Kafka Connect cluster. It's used in the formation of the internal topic names, ensuring that multiple Kafka Connect clusters can connect to the same Redpanda cluster without interfering with each other. + +**Default:** `"connectors-cluster"` + +### [connectors.producerBatchSize](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.producerBatchSize) + +The number of bytes of records a producer will attempt to batch together before sending to Redpanda. Batching improves throughput. + +**Default:** `131072` + +### [connectors.producerLingerMS](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.producerLingerMS) + +The time, in milliseconds, that a producer will wait before sending a batch of records. Waiting allows the producer to gather more records in the same batch and improve throughput. + +**Default:** `1` + +### [connectors.restPort](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.restPort) + +The port on which the Kafka Connect REST API listens. The API is used for administrative tasks. + +**Default:** `8083` + +### [connectors.schemaRegistryURL](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.schemaRegistryURL) + +**Default:** `""` + +### [connectors.secretManager.connectorsPrefix](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.secretManager.connectorsPrefix) + +**Default:** `""` + +### [connectors.secretManager.consolePrefix](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.secretManager.consolePrefix) + +**Default:** `""` + +### [connectors.secretManager.enabled](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.secretManager.enabled) + +**Default:** `false` + +### [connectors.secretManager.region](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.secretManager.region) + +**Default:** `""` + +### [connectors.storage.remote](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.storage.remote) + +Indicates if read and write operations for the respective topics are allowed remotely. + +**Default:** + +``` +{"read":{"config":false,"offset":false,"status":false},"write":{"config":false,"offset":false,"status":false}} +``` + +### [connectors.storage.replicationFactor](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.storage.replicationFactor) + +The number of replicas for each of the internal topics that Kafka Connect uses. + +**Default:** + +``` +{"config":-1,"offset":-1,"status":-1} +``` + +### [connectors.storage.replicationFactor.config](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.storage.replicationFactor.config) + +Replication factor for the configuration topic. + +**Default:** `-1` + +### [connectors.storage.replicationFactor.offset](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.storage.replicationFactor.offset) + +Replication factor for the offset topic. + +**Default:** `-1` + +### [connectors.storage.replicationFactor.status](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.storage.replicationFactor.status) + +Replication factor for the status topic. + +**Default:** `-1` + +### [connectors.storage.topic.config](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.storage.topic.config) + +The name of the internal topic that Kafka Connect uses to store connector and task configurations. + +**Default:** + +``` +"_internal_connectors_configs" +``` + +### [connectors.storage.topic.offset](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.storage.topic.offset) + +The name of the internal topic that Kafka Connect uses to store source connector offsets. + +**Default:** + +``` +"_internal_connectors_offsets" +``` + +### [connectors.storage.topic.status](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=connectors.storage.topic.status) + +The name of the internal topic that Kafka Connect uses to store connector and task status updates. + +**Default:** + +``` +"_internal_connectors_status" +``` + +### [container.javaGCLogEnabled](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=container.javaGCLogEnabled) + +**Default:** `"false"` + +### [container.resources](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=container.resources) + +Pod resource management. + +**Default:** + +``` +{"javaMaxHeapSize":"2G","limits":{"cpu":"1","memory":"2350Mi"},"request":{"cpu":"1","memory":"2350Mi"}} +``` + +### [container.resources.javaMaxHeapSize](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=container.resources.javaMaxHeapSize) + +Java maximum heap size must not be greater than `container.resources.limits.memory`. + +**Default:** `"2G"` + +### [container.securityContext](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=container.securityContext) + +Security context for the Redpanda Connectors container. See also `deployment.securityContext` for Pod-level settings. + +**Default:** + +``` +{"allowPrivilegeEscalation":false} +``` + +### [deployment.annotations](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.annotations) + +Additional annotations to apply to the Pods of this Deployment. + +**Default:** `{}` + +### [deployment.budget.maxUnavailable](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.budget.maxUnavailable) + +**Default:** `1` + +### [deployment.create](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.create) + +**Default:** `true` + +### [deployment.extraEnv](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.extraEnv) + +Additional environment variables for the Pods. + +**Default:** `[]` + +### [deployment.extraEnvFrom](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.extraEnvFrom) + +Configure extra environment variables from Secrets and ConfigMaps. + +**Default:** `[]` + +### [deployment.livenessProbe](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.livenessProbe) + +Adjust the period for your probes to meet your needs. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes). + +**Default:** + +``` +{"failureThreshold":3,"initialDelaySeconds":10,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":1} +``` + +### [deployment.nodeAffinity](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.nodeAffinity) + +Node Affinity rules for scheduling Pods of this Deployment. The suggestion would be to spread Pods according to topology zone. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity). + +**Default:** `{}` + +### [deployment.nodeSelector](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.nodeSelector) + +Node selection constraints for scheduling Pods of this Deployment. These constraints override the global `nodeSelector` value. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector). + +**Default:** `{}` + +### [deployment.podAffinity](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.podAffinity) + +Inter-Pod Affinity rules for scheduling Pods of this Deployment. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity). + +**Default:** `{}` + +### [deployment.podAntiAffinity](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.podAntiAffinity) + +Anti-affinity rules for scheduling Pods of this Deployment. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity). You may either edit the default settings for anti-affinity rules, or specify new anti-affinity rules to use instead of the defaults. + +**Default:** + +``` +{"custom":{},"topologyKey":"kubernetes.io/hostname","type":"hard","weight":100} +``` + +### [deployment.podAntiAffinity.custom](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.podAntiAffinity.custom) + +Change `podAntiAffinity.type` to `custom` and provide your own podAntiAffinity rules here. + +**Default:** `{}` + +### [deployment.podAntiAffinity.topologyKey](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.podAntiAffinity.topologyKey) + +The `topologyKey` to be used. Can be used to spread across different nodes, AZs, regions etc. + +**Default:** `"kubernetes.io/hostname"` + +### [deployment.podAntiAffinity.type](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.podAntiAffinity.type) + +Valid anti-affinity types are `soft`, `hard`, or `custom`. Use `custom` if you want to supply your own anti-affinity rules in the `podAntiAffinity.custom` object. + +**Default:** `"hard"` + +### [deployment.podAntiAffinity.weight](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.podAntiAffinity.weight) + +Weight for `soft` anti-affinity rules. Does not apply for other anti-affinity types. + +**Default:** `100` + +### [deployment.priorityClassName](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.priorityClassName) + +PriorityClassName given to Pods of this Deployment. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass). + +**Default:** `""` + +### [deployment.progressDeadlineSeconds](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.progressDeadlineSeconds) + +The maximum time in seconds for a deployment to make progress before it is considered to be failed. The deployment controller will continue to process failed deployments and a condition with a ProgressDeadlineExceeded reason will be surfaced in the deployment status. Note that progress will not be estimated during the time a deployment is paused. + +**Default:** `600` + +### [deployment.readinessProbe.failureThreshold](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.readinessProbe.failureThreshold) + +**Default:** `2` + +### [deployment.readinessProbe.initialDelaySeconds](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.readinessProbe.initialDelaySeconds) + +**Default:** `60` + +### [deployment.readinessProbe.periodSeconds](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.readinessProbe.periodSeconds) + +**Default:** `10` + +### [deployment.readinessProbe.successThreshold](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.readinessProbe.successThreshold) + +**Default:** `3` + +### [deployment.readinessProbe.timeoutSeconds](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.readinessProbe.timeoutSeconds) + +**Default:** `5` + +### [deployment.restartPolicy](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.restartPolicy) + +**Default:** `"Always"` + +### [deployment.revisionHistoryLimit](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.revisionHistoryLimit) + +The number of old ReplicaSets to retain to allow rollback. This is a pointer to distinguish between explicit zero and not specified. + +**Default:** `10` + +### [deployment.schedulerName](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.schedulerName) + +**Default:** `""` + +### [deployment.securityContext.fsGroup](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.securityContext.fsGroup) + +**Default:** `101` + +### [deployment.securityContext.fsGroupChangePolicy](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.securityContext.fsGroupChangePolicy) + +**Default:** `"OnRootMismatch"` + +### [deployment.securityContext.runAsUser](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.securityContext.runAsUser) + +**Default:** `101` + +### [deployment.strategy.type](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.strategy.type) + +**Default:** `"RollingUpdate"` + +### [deployment.terminationGracePeriodSeconds](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.terminationGracePeriodSeconds) + +**Default:** `30` + +### [deployment.tolerations](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.tolerations) + +Taints to be tolerated by Pods of this Deployment. These tolerations override the global tolerations value. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/). + +**Default:** `[]` + +### [deployment.topologySpreadConstraints[0].maxSkew](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.topologySpreadConstraints[0].maxSkew) + +**Default:** `1` + +### [deployment.topologySpreadConstraints[0].topologyKey](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.topologySpreadConstraints[0].topologyKey) + +**Default:** + +``` +"topology.kubernetes.io/zone" +``` + +### [deployment.topologySpreadConstraints[0].whenUnsatisfiable](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=deployment.topologySpreadConstraints[0].whenUnsatisfiable) + +**Default:** `"ScheduleAnyway"` + +### [fullnameOverride](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=fullnameOverride) + +Override `connectors.fullname` template. + +**Default:** `""` + +### [image](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=image) + +Redpanda Docker image settings. + +**Default:** + +``` +{"pullPolicy":"IfNotPresent","repository":"docker.redpanda.com/redpandadata/connectors","tag":""} +``` + +### [image.pullPolicy](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=image.pullPolicy) + +The imagePullPolicy. If `image.tag` is 'latest', the default is `Always`. + +**Default:** `"IfNotPresent"` + +### [image.repository](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=image.repository) + +Docker repository from which to pull the Redpanda Docker image. + +**Default:** + +``` +"docker.redpanda.com/redpandadata/connectors" +``` + +### [image.tag](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=image.tag) + +The Redpanda version. See DockerHub for: [All stable versions](https://hub.docker.com/r/redpandadata/redpanda/tags) and [all unstable versions](https://hub.docker.com/r/redpandadata/redpanda-unstable/tags). + +**Default:** `Chart.appVersion`. + +### [imagePullSecrets](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=imagePullSecrets) + +Pull secrets may be used to provide credentials to image repositories See https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + +**Default:** `[]` + +### [logging](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=logging) + +Log-level settings. + +**Default:** `{"level":"warn"}` + +### [logging.level](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=logging.level) + +Log level Valid values (from least to most verbose) are: `error`, `warn`, `info` and `debug`. + +**Default:** `"warn"` + +### [monitoring](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=monitoring) + +Monitoring. When set to `true`, the Helm chart creates a PodMonitor that can be used by Prometheus-Operator or VictoriaMetrics-Operator to scrape the metrics. + +**Default:** + +``` +{"annotations":{},"enabled":false,"labels":{},"namespaceSelector":{"any":true},"scrapeInterval":"30s"} +``` + +### [nameOverride](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=nameOverride) + +Override `connectors.name` template. + +**Default:** `""` + +### [service](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=service) + +Service management. + +**Default:** + +``` +{"annotations":{},"name":"","ports":[{"name":"prometheus","port":9404}]} +``` + +### [service.annotations](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=service.annotations) + +Annotations to add to the Service. + +**Default:** `{}` + +### [service.name](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=service.name) + +The name of the service to use. If not set, a name is generated using the `connectors.fullname` template. + +**Default:** `""` + +### [serviceAccount](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=serviceAccount) + +ServiceAccount management. + +**Default:** + +``` +{"annotations":{},"create":false,"name":""} +``` + +### [serviceAccount.annotations](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=serviceAccount.annotations) + +Annotations to add to the ServiceAccount. + +**Default:** `{}` + +### [serviceAccount.create](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=serviceAccount.create) + +Specifies whether a ServiceAccount should be created. + +**Default:** `false` + +### [serviceAccount.name](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=serviceAccount.name) + +The name of the ServiceAccount to use. If not set and `serviceAccount.create` is `true`, a name is generated using the `connectors.fullname` template. + +**Default:** `""` + +### [storage.volumeMounts[0].mountPath](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=storage.volumeMounts[0].mountPath) + +**Default:** `"/tmp"` + +### [storage.volumeMounts[0].name](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=storage.volumeMounts[0].name) + +**Default:** `"rp-connect-tmp"` + +### [storage.volume[0].emptyDir.medium](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=storage.volume[0].emptyDir.medium) + +**Default:** `"Memory"` + +### [storage.volume[0].emptyDir.sizeLimit](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=storage.volume[0].emptyDir.sizeLimit) + +**Default:** `"5Mi"` + +### [storage.volume[0].name](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=storage.volume[0].name) + +**Default:** `"rp-connect-tmp"` + +### [test.create](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=test.create) + +**Default:** `true` + +### [tolerations](https://artifacthub.io/packages/helm/redpanda-data/connectors?modal=values&path=tolerations) + +Taints to be tolerated by Pods. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/). + +**Default:** `[]` + diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_deployment.go.tpl b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_deployment.go.tpl new file mode 100644 index 000000000..f785c1ad9 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_deployment.go.tpl @@ -0,0 +1,136 @@ +{{- /* Generated from "deployment.go" */ -}} + +{{- define "connectors.Deployment" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.deployment.create) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $topologySpreadConstraints := (coalesce nil) -}} +{{- range $_, $spread := $values.deployment.topologySpreadConstraints -}} +{{- $topologySpreadConstraints = (concat (default (list ) $topologySpreadConstraints) (list (mustMergeOverwrite (dict "maxSkew" 0 "topologyKey" "" "whenUnsatisfiable" "" ) (dict "labelSelector" (mustMergeOverwrite (dict ) (dict "matchLabels" (get (fromJson (include "connectors.PodLabels" (dict "a" (list $dot) ))) "r") )) "maxSkew" ($spread.maxSkew | int) "topologyKey" $spread.topologyKey "whenUnsatisfiable" $spread.whenUnsatisfiable )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $ports := (list (mustMergeOverwrite (dict "containerPort" 0 ) (dict "containerPort" ($values.connectors.restPort | int) "name" "rest-api" "protocol" "TCP" ))) -}} +{{- range $_, $port := $values.service.ports -}} +{{- $ports = (concat (default (list ) $ports) (list (mustMergeOverwrite (dict "containerPort" 0 ) (dict "name" $port.name "containerPort" ($port.port | int) "protocol" "TCP" )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $podAntiAffinity := (coalesce nil) -}} +{{- if (ne $values.deployment.podAntiAffinity (coalesce nil)) -}} +{{- if (eq $values.deployment.podAntiAffinity.type "hard") -}} +{{- $podAntiAffinity = (mustMergeOverwrite (dict ) (dict "requiredDuringSchedulingIgnoredDuringExecution" (list (mustMergeOverwrite (dict "topologyKey" "" ) (dict "topologyKey" $values.deployment.podAntiAffinity.topologyKey "namespaces" (list $dot.Release.Namespace) "labelSelector" (mustMergeOverwrite (dict ) (dict "matchLabels" (get (fromJson (include "connectors.PodLabels" (dict "a" (list $dot) ))) "r") )) ))) )) -}} +{{- else -}}{{- if (eq $values.deployment.podAntiAffinity.type "soft") -}} +{{- $podAntiAffinity = (mustMergeOverwrite (dict ) (dict "preferredDuringSchedulingIgnoredDuringExecution" (list (mustMergeOverwrite (dict "weight" 0 "podAffinityTerm" (dict "topologyKey" "" ) ) (dict "weight" $values.deployment.podAntiAffinity.weight "podAffinityTerm" (mustMergeOverwrite (dict "topologyKey" "" ) (dict "topologyKey" $values.deployment.podAntiAffinity.topologyKey "namespaces" (list $dot.Release.Namespace) "labelSelector" (mustMergeOverwrite (dict ) (dict "matchLabels" (get (fromJson (include "connectors.PodLabels" (dict "a" (list $dot) ))) "r") )) )) ))) )) -}} +{{- else -}}{{- if (eq $values.deployment.podAntiAffinity.type "custom") -}} +{{- $podAntiAffinity = $values.deployment.podAntiAffinity.custom -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "selector" (coalesce nil) "template" (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "containers" (coalesce nil) ) ) "strategy" (dict ) ) "status" (dict ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "apps/v1" "kind" "Deployment" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "connectors.Fullname" (dict "a" (list $dot) ))) "r") "labels" (merge (dict ) (get (fromJson (include "connectors.FullLabels" (dict "a" (list $dot) ))) "r") $values.deployment.annotations) )) "spec" (mustMergeOverwrite (dict "selector" (coalesce nil) "template" (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "containers" (coalesce nil) ) ) "strategy" (dict ) ) (dict "replicas" $values.deployment.replicas "progressDeadlineSeconds" ($values.deployment.progressDeadlineSeconds | int) "revisionHistoryLimit" $values.deployment.revisionHistoryLimit "selector" (mustMergeOverwrite (dict ) (dict "matchLabels" (get (fromJson (include "connectors.PodLabels" (dict "a" (list $dot) ))) "r") )) "strategy" $values.deployment.strategy "template" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "containers" (coalesce nil) ) ) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "annotations" $values.deployment.annotations "labels" (get (fromJson (include "connectors.PodLabels" (dict "a" (list $dot) ))) "r") )) "spec" (mustMergeOverwrite (dict "containers" (coalesce nil) ) (dict "terminationGracePeriodSeconds" $values.deployment.terminationGracePeriodSeconds "affinity" (mustMergeOverwrite (dict ) (dict "nodeAffinity" $values.deployment.nodeAffinity "podAffinity" $values.deployment.podAffinity "podAntiAffinity" $podAntiAffinity )) "serviceAccountName" (get (fromJson (include "connectors.ServiceAccountName" (dict "a" (list $dot) ))) "r") "containers" (list (mustMergeOverwrite (dict "name" "" "resources" (dict ) ) (dict "name" "connectors-cluster" "image" (printf "%s:%s" $values.image.repository (get (fromJson (include "connectors.Tag" (dict "a" (list $dot) ))) "r")) "imagePullPolicy" $values.image.pullPolicy "securityContext" $values.container.securityContext "command" $values.deployment.command "env" (get (fromJson (include "connectors.env" (dict "a" (list $values) ))) "r") "envFrom" $values.deployment.extraEnvFrom "livenessProbe" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "httpGet" (mustMergeOverwrite (dict "port" 0 ) (dict "path" "/" "port" "rest-api" "scheme" "HTTP" )) )) (dict "initialDelaySeconds" ($values.deployment.livenessProbe.initialDelaySeconds | int) "timeoutSeconds" ($values.deployment.livenessProbe.timeoutSeconds | int) "periodSeconds" ($values.deployment.livenessProbe.periodSeconds | int) "successThreshold" ($values.deployment.livenessProbe.successThreshold | int) "failureThreshold" ($values.deployment.livenessProbe.failureThreshold | int) )) "readinessProbe" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "httpGet" (mustMergeOverwrite (dict "port" 0 ) (dict "path" "/connectors" "port" "rest-api" "scheme" "HTTP" )) )) (dict "initialDelaySeconds" ($values.deployment.readinessProbe.initialDelaySeconds | int) "timeoutSeconds" ($values.deployment.readinessProbe.timeoutSeconds | int) "periodSeconds" ($values.deployment.readinessProbe.periodSeconds | int) "successThreshold" ($values.deployment.readinessProbe.successThreshold | int) "failureThreshold" ($values.deployment.readinessProbe.failureThreshold | int) )) "ports" $ports "resources" (mustMergeOverwrite (dict ) (dict "requests" $values.container.resources.request "limits" $values.container.resources.limits )) "terminationMessagePath" "/dev/termination-log" "terminationMessagePolicy" "File" "volumeMounts" (get (fromJson (include "connectors.volumeMountss" (dict "a" (list $values) ))) "r") ))) "dnsPolicy" "ClusterFirst" "restartPolicy" $values.deployment.restartPolicy "schedulerName" $values.deployment.schedulerName "nodeSelector" $values.deployment.nodeSelector "imagePullSecrets" $values.imagePullSecrets "securityContext" $values.deployment.securityContext "tolerations" $values.deployment.tolerations "topologySpreadConstraints" $topologySpreadConstraints "volumes" (get (fromJson (include "connectors.volumes" (dict "a" (list $values) ))) "r") )) )) )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "connectors.env" -}} +{{- $values := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $env := (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "CONNECT_CONFIGURATION" "value" (get (fromJson (include "connectors.connectorConfiguration" (dict "a" (list $values) ))) "r") )) (mustMergeOverwrite (dict "name" "" ) (dict "name" "CONNECT_ADDITIONAL_CONFIGURATION" "value" $values.connectors.additionalConfiguration )) (mustMergeOverwrite (dict "name" "" ) (dict "name" "CONNECT_BOOTSTRAP_SERVERS" "value" $values.connectors.bootstrapServers ))) -}} +{{- if (not (empty $values.connectors.schemaRegistryURL)) -}} +{{- $env = (concat (default (list ) $env) (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "SCHEMA_REGISTRY_URL" "value" $values.connectors.schemaRegistryURL )))) -}} +{{- end -}} +{{- $env = (concat (default (list ) $env) (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "CONNECT_GC_LOG_ENABLED" "value" $values.container.javaGCLogEnabled )) (mustMergeOverwrite (dict "name" "" ) (dict "name" "CONNECT_HEAP_OPTS" "value" (printf "-Xms256M -Xmx%s" $values.container.resources.javaMaxHeapSize) )) (mustMergeOverwrite (dict "name" "" ) (dict "name" "CONNECT_LOG_LEVEL" "value" $values.logging.level )))) -}} +{{- if (get (fromJson (include "connectors.Auth.SASLEnabled" (dict "a" (list $values.auth) ))) "r") -}} +{{- $env = (concat (default (list ) $env) (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "CONNECT_SASL_USERNAME" "value" $values.auth.sasl.userName )) (mustMergeOverwrite (dict "name" "" ) (dict "name" "CONNECT_SASL_MECHANISM" "value" $values.auth.sasl.mechanism )) (mustMergeOverwrite (dict "name" "" ) (dict "name" "CONNECT_SASL_PASSWORD_FILE" "value" "rc-credentials/password" )))) -}} +{{- end -}} +{{- $env = (concat (default (list ) $env) (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "CONNECT_TLS_ENABLED" "value" (printf "%v" $values.connectors.brokerTLS.enabled) )))) -}} +{{- if (not (empty $values.connectors.brokerTLS.ca.secretRef)) -}} +{{- $ca := (default "ca.crt" $values.connectors.brokerTLS.ca.secretNameOverwrite) -}} +{{- $env = (concat (default (list ) $env) (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "CONNECT_TRUSTED_CERTS" "value" (printf "ca/%s" $ca) )))) -}} +{{- end -}} +{{- if (not (empty $values.connectors.brokerTLS.cert.secretRef)) -}} +{{- $cert := (default "tls.crt" $values.connectors.brokerTLS.cert.secretNameOverwrite) -}} +{{- $env = (concat (default (list ) $env) (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "CONNECT_TLS_AUTH_CERT" "value" (printf "cert/%s" $cert) )))) -}} +{{- end -}} +{{- if (not (empty $values.connectors.brokerTLS.key.secretRef)) -}} +{{- $key := (default "tls.key" $values.connectors.brokerTLS.key.secretNameOverwrite) -}} +{{- $env = (concat (default (list ) $env) (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "CONNECT_TLS_AUTH_KEY" "value" (printf "key/%s" $key) )))) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (concat (default (list ) $env) (default (list ) $values.deployment.extraEnv))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "connectors.connectorConfiguration" -}} +{{- $values := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $lines := (list (printf "rest.advertised.port=%d" ($values.connectors.restPort | int)) (printf "rest.port=%d" ($values.connectors.restPort | int)) "key.converter=org.apache.kafka.connect.converters.ByteArrayConverter" "value.converter=org.apache.kafka.connect.converters.ByteArrayConverter" (printf "group.id=%s" $values.connectors.groupID) (printf "offset.storage.topic=%s" $values.connectors.storage.topic.offset) (printf "config.storage.topic=%s" $values.connectors.storage.topic.config) (printf "status.storage.topic=%s" $values.connectors.storage.topic.status) (printf "offset.storage.redpanda.remote.read=%t" $values.connectors.storage.remote.read.offset) (printf "offset.storage.redpanda.remote.write=%t" $values.connectors.storage.remote.write.offset) (printf "config.storage.redpanda.remote.read=%t" $values.connectors.storage.remote.read.config) (printf "config.storage.redpanda.remote.write=%t" $values.connectors.storage.remote.write.config) (printf "status.storage.redpanda.remote.read=%t" $values.connectors.storage.remote.read.status) (printf "status.storage.redpanda.remote.write=%t" $values.connectors.storage.remote.write.status) (printf "offset.storage.replication.factor=%d" ($values.connectors.storage.replicationFactor.offset | int)) (printf "config.storage.replication.factor=%d" ($values.connectors.storage.replicationFactor.config | int)) (printf "status.storage.replication.factor=%d" ($values.connectors.storage.replicationFactor.status | int)) (printf "producer.linger.ms=%d" ($values.connectors.producerLingerMS | int)) (printf "producer.batch.size=%d" ($values.connectors.producerBatchSize | int)) "config.providers=file,secretsManager,env" "config.providers.file.class=org.apache.kafka.common.config.provider.FileConfigProvider") -}} +{{- if $values.connectors.secretManager.enabled -}} +{{- $lines = (concat (default (list ) $lines) (list "config.providers.secretsManager.class=com.github.jcustenborder.kafka.config.aws.SecretsManagerConfigProvider" (printf "config.providers.secretsManager.param.secret.prefix=%s%s" $values.connectors.secretManager.consolePrefix $values.connectors.secretManager.connectorsPrefix) (printf "config.providers.secretsManager.param.aws.region=%s" $values.connectors.secretManager.region))) -}} +{{- end -}} +{{- $lines = (concat (default (list ) $lines) (list "config.providers.env.class=org.apache.kafka.common.config.provider.EnvVarConfigProvider")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (join "\n" $lines)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "connectors.volumes" -}} +{{- $values := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $volumes := (coalesce nil) -}} +{{- if (not (empty $values.connectors.brokerTLS.ca.secretRef)) -}} +{{- $volumes = (concat (default (list ) $volumes) (list (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "secret" (mustMergeOverwrite (dict ) (dict "defaultMode" (0o444 | int) "secretName" $values.connectors.brokerTLS.ca.secretRef )) )) (dict "name" "truststore" )))) -}} +{{- end -}} +{{- if (not (empty $values.connectors.brokerTLS.cert.secretRef)) -}} +{{- $volumes = (concat (default (list ) $volumes) (list (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "secret" (mustMergeOverwrite (dict ) (dict "defaultMode" (0o444 | int) "secretName" $values.connectors.brokerTLS.cert.secretRef )) )) (dict "name" "cert" )))) -}} +{{- end -}} +{{- if (not (empty $values.connectors.brokerTLS.key.secretRef)) -}} +{{- $volumes = (concat (default (list ) $volumes) (list (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "secret" (mustMergeOverwrite (dict ) (dict "defaultMode" (0o444 | int) "secretName" $values.connectors.brokerTLS.key.secretRef )) )) (dict "name" "key" )))) -}} +{{- end -}} +{{- if (get (fromJson (include "connectors.Auth.SASLEnabled" (dict "a" (list $values.auth) ))) "r") -}} +{{- $volumes = (concat (default (list ) $volumes) (list (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "secret" (mustMergeOverwrite (dict ) (dict "defaultMode" (0o444 | int) "secretName" $values.auth.sasl.secretRef )) )) (dict "name" "rc-credentials" )))) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (concat (default (list ) $volumes) (default (list ) $values.storage.volume))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "connectors.volumeMountss" -}} +{{- $values := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $mounts := (coalesce nil) -}} +{{- if (get (fromJson (include "connectors.Auth.SASLEnabled" (dict "a" (list $values.auth) ))) "r") -}} +{{- $mounts = (concat (default (list ) $mounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "mountPath" "/opt/kafka/connect-password/rc-credentials" "name" "rc-credentials" )))) -}} +{{- end -}} +{{- if (not (empty $values.connectors.brokerTLS.ca.secretRef)) -}} +{{- $mounts = (concat (default (list ) $mounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "truststore" "mountPath" "/opt/kafka/connect-certs/ca" )))) -}} +{{- end -}} +{{- if (not (empty $values.connectors.brokerTLS.cert.secretRef)) -}} +{{- $mounts = (concat (default (list ) $mounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "cert" "mountPath" "/opt/kafka/connect-certs/cert" )))) -}} +{{- end -}} +{{- if (not (empty $values.connectors.brokerTLS.key.secretRef)) -}} +{{- $mounts = (concat (default (list ) $mounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "key" "mountPath" "/opt/kafka/connect-certs/key" )))) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (concat (default (list ) $mounts) (default (list ) $values.storage.volumeMounts))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_helpers.go.tpl b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_helpers.go.tpl new file mode 100644 index 000000000..49b711538 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_helpers.go.tpl @@ -0,0 +1,131 @@ +{{- /* Generated from "helpers.go" */ -}} + +{{- define "connectors.Name" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $name := (default $dot.Chart.Name $values.nameOverride) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "connectors.trunc" (dict "a" (list $name) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "connectors.Fullname" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not (empty $values.fullnameOverride)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "connectors.trunc" (dict "a" (list $values.fullnameOverride) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- $name := (default $dot.Chart.Name $values.nameOverride) -}} +{{- if (contains $name $dot.Release.Name) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "connectors.trunc" (dict "a" (list $dot.Release.Name) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "connectors.trunc" (dict "a" (list (printf "%s-%s" $dot.Release.Name $name)) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "connectors.FullLabels" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (merge (dict ) (dict "helm.sh/chart" (get (fromJson (include "connectors.Chart" (dict "a" (list $dot) ))) "r") "app.kubernetes.io/managed-by" $dot.Release.Service ) (get (fromJson (include "connectors.PodLabels" (dict "a" (list $dot) ))) "r"))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "connectors.PodLabels" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $_is_returning = true -}} +{{- (dict "r" (merge (dict ) (dict "app.kubernetes.io/name" (get (fromJson (include "connectors.Name" (dict "a" (list $dot) ))) "r") "app.kubernetes.io/instance" $dot.Release.Name "app.kubernetes.io/component" (get (fromJson (include "connectors.Name" (dict "a" (list $dot) ))) "r") ) $values.commonLabels)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "connectors.Chart" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $chart := (printf "%s-%s" $dot.Chart.Name $dot.Chart.Version) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "connectors.trunc" (dict "a" (list (replace "+" "_" $chart)) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "connectors.Semver" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (trimPrefix "v" (get (fromJson (include "connectors.Tag" (dict "a" (list $dot) ))) "r"))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "connectors.ServiceAccountName" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if $values.serviceAccount.create -}} +{{- $_is_returning = true -}} +{{- (dict "r" (default (get (fromJson (include "connectors.Fullname" (dict "a" (list $dot) ))) "r") $values.serviceAccount.name)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (default "default" $values.serviceAccount.name)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "connectors.ServiceName" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $_is_returning = true -}} +{{- (dict "r" (default (get (fromJson (include "connectors.Fullname" (dict "a" (list $dot) ))) "r") $values.service.name)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "connectors.Tag" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $tag := (default $dot.Chart.AppVersion $values.image.tag) -}} +{{- $matchString := "^v(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$" -}} +{{- if (not (mustRegexMatch $matchString $tag)) -}} +{{- $_ := (fail "image.tag must start with a 'v' and be a valid semver") -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $tag) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "connectors.trunc" -}} +{{- $s := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (trimSuffix "-" (trunc (63 | int) $s))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_helpers.tpl b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_helpers.tpl new file mode 100644 index 000000000..89c888eee --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_helpers.tpl @@ -0,0 +1,79 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{/* +Expand the name of the chart. +*/}} +{{- define "connectors.name" -}} +{{- get ((include "connectors.Name" (dict "a" (list .))) | fromJson) "r" }} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "connectors.fullname" }} +{{- get ((include "connectors.Fullname" (dict "a" (list .))) | fromJson) "r" }} +{{- end }} + +{{/* +full helm labels + common labels +*/}} +{{- define "full.labels" -}} +{{- (get ((include "connectors.FullLabels" (dict "a" (list .))) | fromJson) "r") | toYaml }} +{{- end -}} + +{{/* +pod labels merged with common labels +*/}} +{{- define "connectors-pod-labels" -}} +{{- (get ((include "connectors.PodLabels" (dict "a" (list .))) | fromJson) "r") | toYaml }} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "connectors.chart" -}} +{{- get ((include "connectors.Chart" (dict "a" (list .))) | fromJson) "r" }} +{{- end }} + +{{/* +Get the version of redpanda being used as an image +*/}} +{{- define "connectors.semver" -}} +{{- get ((include "connectors.Tag" (dict "a" (list .))) | fromJson) "r" }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "connectors.serviceAccountName" -}} +{{- get ((include "connectors.ServiceAccountName" (dict "a" (list .))) | fromJson) "r" }} +{{- end }} + +{{/* +Create the name of the service to use +*/}} +{{- define "connectors.serviceName" -}} +{{- get ((include "connectors.ServiceName" (dict "a" (list .))) | fromJson) "r" }} +{{- end }} + +{{/* +Use AppVersion if image.tag is not set +*/}} +{{- define "connectors.tag" -}} +{{- get ((include "connectors.Tag" (dict "a" (list .))) | fromJson) "r" }} +{{- end -}} diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_pod-monitor.go.tpl b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_pod-monitor.go.tpl new file mode 100644 index 000000000..4e12b2008 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_pod-monitor.go.tpl @@ -0,0 +1,18 @@ +{{- /* Generated from "podmonitor.go" */ -}} + +{{- define "connectors.PodMonitor" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.monitoring.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "podMetricsEndpoints" (coalesce nil) "selector" (dict ) "namespaceSelector" (dict ) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "monitoring.coreos.com/v1" "kind" "PodMonitor" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "connectors.Fullname" (dict "a" (list $dot) ))) "r") "labels" $values.monitoring.labels "annotations" $values.monitoring.annotations )) "spec" (mustMergeOverwrite (dict "podMetricsEndpoints" (coalesce nil) "selector" (dict ) "namespaceSelector" (dict ) ) (dict "namespaceSelector" $values.monitoring.namespaceSelector "podMetricsEndpoints" (list (mustMergeOverwrite (dict "bearerTokenSecret" (dict "key" "" ) ) (dict "path" "/" "port" "prometheus" ))) "selector" (mustMergeOverwrite (dict ) (dict "matchLabels" (get (fromJson (include "connectors.PodLabels" (dict "a" (list $dot) ))) "r") )) )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_service.go.tpl b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_service.go.tpl new file mode 100644 index 000000000..54a7ce8a0 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_service.go.tpl @@ -0,0 +1,20 @@ +{{- /* Generated from "service.go" */ -}} + +{{- define "connectors.Service" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $ports := (list (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" "rest-api" "port" ($values.connectors.restPort | int) "targetPort" ($values.connectors.restPort | int) "protocol" "TCP" ))) -}} +{{- range $_, $port := $values.service.ports -}} +{{- $ports = (concat (default (list ) $ports) (list (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" $port.name "port" ($port.port | int) "targetPort" ($port.port | int) "protocol" "TCP" )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict ) "status" (dict "loadBalancer" (dict ) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "Service" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "connectors.ServiceName" (dict "a" (list $dot) ))) "r") "labels" (merge (dict ) (get (fromJson (include "connectors.FullLabels" (dict "a" (list $dot) ))) "r") $values.service.annotations) )) "spec" (mustMergeOverwrite (dict ) (dict "ipFamilies" (list "IPv4") "ipFamilyPolicy" "SingleStack" "ports" $ports "selector" (get (fromJson (include "connectors.PodLabels" (dict "a" (list $dot) ))) "r") "sessionAffinity" "None" "type" "ClusterIP" )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_serviceaccount.go.tpl b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_serviceaccount.go.tpl new file mode 100644 index 000000000..31b5ac2ac --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_serviceaccount.go.tpl @@ -0,0 +1,18 @@ +{{- /* Generated from "serviceaccount.go" */ -}} + +{{- define "connectors.ServiceAccount" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.serviceAccount.create) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "ServiceAccount" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "annotations" $values.serviceAccount.annotations "labels" (get (fromJson (include "connectors.FullLabels" (dict "a" (list $dot) ))) "r") "name" (get (fromJson (include "connectors.ServiceAccountName" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_shims.tpl b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_shims.tpl new file mode 100644 index 000000000..e3bb40e41 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_shims.tpl @@ -0,0 +1,289 @@ +{{- /* Generated from "bootstrap.go" */ -}} + +{{- define "_shims.typetest" -}} +{{- $typ := (index .a 0) -}} +{{- $value := (index .a 1) -}} +{{- $zero := (index .a 2) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (typeIs $typ $value) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $zero false)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.typeassertion" -}} +{{- $typ := (index .a 0) -}} +{{- $value := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (not (typeIs $typ $value)) -}} +{{- $_ := (fail (printf "expected type of %q got: %T" $typ $value)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $value) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.dicttest" -}} +{{- $m := (index .a 0) -}} +{{- $key := (index .a 1) -}} +{{- $zero := (index .a 2) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (hasKey $m $key) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (index $m $key) true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $zero false)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.compact" -}} +{{- $args := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $out := (dict ) -}} +{{- range $i, $e := $args -}} +{{- $_ := (set $out (printf "T%d" ((add (1 | int) $i) | int)) $e) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $out) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.deref" -}} +{{- $ptr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (eq $ptr (coalesce nil)) -}} +{{- $_ := (fail "nil dereference") -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $ptr) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.len" -}} +{{- $m := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (eq $m (coalesce nil)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (0 | int)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (len $m)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.ptr_Deref" -}} +{{- $ptr := (index .a 0) -}} +{{- $def := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (ne $ptr (coalesce nil)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $ptr) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $def) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.ptr_Equal" -}} +{{- $a := (index .a 0) -}} +{{- $b := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (and (eq $a (coalesce nil)) (eq $b (coalesce nil))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" true) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (eq $a $b)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.lookup" -}} +{{- $apiVersion := (index .a 0) -}} +{{- $kind := (index .a 1) -}} +{{- $namespace := (index .a 2) -}} +{{- $name := (index .a 3) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $result := (lookup $apiVersion $kind $namespace $name) -}} +{{- if (empty $result) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (coalesce nil) false)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $result true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.asnumeric" -}} +{{- $value := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (typeIs "float64" $value) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (typeIs "int64" $value) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (typeIs "int" $value) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (0 | int) false)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.asintegral" -}} +{{- $value := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (or (typeIs "int64" $value) (typeIs "int" $value)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (and (typeIs "float64" $value) (eq (floor $value) $value)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (0 | int) false)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.parseResource" -}} +{{- $repr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (typeIs "float64" $repr) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (float64 $repr) 1.0)) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (not (typeIs "string" $repr)) -}} +{{- $_ := (fail (printf "invalid Quantity expected string or float64 got: %T (%v)" $repr $repr)) -}} +{{- end -}} +{{- if (not (regexMatch `^[0-9]+(\.[0-9]{0,6})?(k|m|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$` $repr)) -}} +{{- $_ := (fail (printf "invalid Quantity: %q" $repr)) -}} +{{- end -}} +{{- $reprStr := (toString $repr) -}} +{{- $unit := (regexFind "(k|m|M|G|T|P|Ki|Mi|Gi|Ti|Pi)$" $repr) -}} +{{- $numeric := (float64 (substr (0 | int) ((sub ((get (fromJson (include "_shims.len" (dict "a" (list $reprStr) ))) "r") | int) ((get (fromJson (include "_shims.len" (dict "a" (list $unit) ))) "r") | int)) | int) $reprStr)) -}} +{{- $tmp_tuple_1 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list (dict "" 1.0 "m" 0.001 "k" (1000 | int) "M" (1000000 | int) "G" (1000000000 | int) "T" (1000000000000 | int) "P" (1000000000000000 | int) "Ki" (1024 | int) "Mi" (1048576 | int) "Gi" (1073741824 | int) "Ti" (1099511627776 | int) "Pi" (1125899906842624 | int) ) $unit (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok := $tmp_tuple_1.T2 -}} +{{- $scale := ($tmp_tuple_1.T1 | float64) -}} +{{- if (not $ok) -}} +{{- $_ := (fail (printf "unknown unit: %q" $unit)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $numeric $scale)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.resource_MustParse" -}} +{{- $repr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_2 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.parseResource" (dict "a" (list $repr) ))) "r")) ))) "r") -}} +{{- $scale := ($tmp_tuple_2.T2 | float64) -}} +{{- $numeric := ($tmp_tuple_2.T1 | float64) -}} +{{- $strs := (list "" "m" "k" "M" "G" "T" "P" "Ki" "Mi" "Gi" "Ti" "Pi") -}} +{{- $scales := (list 1.0 0.001 (1000 | int) (1000000 | int) (1000000000 | int) (1000000000000 | int) (1000000000000000 | int) (1024 | int) (1048576 | int) (1073741824 | int) (1099511627776 | int) (1125899906842624 | int)) -}} +{{- $idx := -1 -}} +{{- range $i, $s := $scales -}} +{{- if (eq ($s | float64) ($scale | float64)) -}} +{{- $idx = $i -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- if (eq $idx -1) -}} +{{- $_ := (fail (printf "unknown scale: %v" $scale)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "%s%s" (toString $numeric) (index $strs $idx))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.resource_Value" -}} +{{- $repr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_3 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.parseResource" (dict "a" (list $repr) ))) "r")) ))) "r") -}} +{{- $scale := ($tmp_tuple_3.T2 | float64) -}} +{{- $numeric := ($tmp_tuple_3.T1 | float64) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (int64 (ceil ((mulf $numeric $scale) | float64)))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.resource_MilliValue" -}} +{{- $repr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_4 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.parseResource" (dict "a" (list $repr) ))) "r")) ))) "r") -}} +{{- $scale := ($tmp_tuple_4.T2 | float64) -}} +{{- $numeric := ($tmp_tuple_4.T1 | float64) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (int64 (ceil ((mulf ((mulf $numeric 1000.0) | float64) $scale) | float64)))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.render-manifest" -}} +{{- $tpl := (index . 0) -}} +{{- $dot := (index . 1) -}} +{{- $manifests := (get ((include $tpl (dict "a" (list $dot))) | fromJson) "r") -}} +{{- if not (typeIs "[]interface {}" $manifests) -}} +{{- $manifests = (list $manifests) -}} +{{- end -}} +{{- range $_, $manifest := $manifests -}} +{{- if ne $manifest nil }} +--- +{{toYaml (unset (unset $manifest "status") "creationTimestamp")}} +{{- end -}} +{{- end -}} +{{- end -}} diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_values.go.tpl b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_values.go.tpl new file mode 100644 index 000000000..9b304d4bf --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/_values.go.tpl @@ -0,0 +1,15 @@ +{{- /* Generated from "values.go" */ -}} + +{{- define "connectors.Auth.SASLEnabled" -}} +{{- $c := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $saslEnabled := (not (empty $c.sasl.userName)) -}} +{{- $saslEnabled = (and $saslEnabled (not (empty $c.sasl.mechanism))) -}} +{{- $saslEnabled = (and $saslEnabled (not (empty $c.sasl.secretRef))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $saslEnabled) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/deployment.yaml b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/deployment.yaml new file mode 100644 index 000000000..ee78b69eb --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/deployment.yaml @@ -0,0 +1,17 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- include "_shims.render-manifest" (list "connectors.Deployment" .) -}} diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/pod-monitor.yaml b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/pod-monitor.yaml new file mode 100644 index 000000000..42c145754 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/pod-monitor.yaml @@ -0,0 +1,17 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- include "_shims.render-manifest" (list "connectors.PodMonitor" .) -}} diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/service.yaml b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/service.yaml new file mode 100644 index 000000000..0b8825bef --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/service.yaml @@ -0,0 +1,17 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- include "_shims.render-manifest" (list "connectors.Service" .) -}} diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/serviceaccount.yaml b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/serviceaccount.yaml new file mode 100644 index 000000000..eda755fb1 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/serviceaccount.yaml @@ -0,0 +1,17 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- include "_shims.render-manifest" (list "connectors.ServiceAccount" .) -}} diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/tests/01-mm2-values.yaml b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/tests/01-mm2-values.yaml new file mode 100644 index 000000000..c369806c8 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/templates/tests/01-mm2-values.yaml @@ -0,0 +1,176 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- define "curl-options" -}} +{{- print " -svm3 --fail --retry \"120\" --retry-max-time \"120\" --retry-all-errors -o - -w \"\\nstatus=%{http_code} %{redirect_url} size=%{size_download} time=%{time_total} content-type=\\\"%{content_type}\\\"\\n\" "}} +{{- end -}} +{{- if .Values.test.create -}} +apiVersion: v1 +kind: Pod +metadata: + name: {{ include "connectors.fullname" . }}-mm2-test + namespace: {{ .Release.Namespace | quote }} + labels: +{{- with include "full.labels" . }} + {{- . | nindent 4 }} +{{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + containers: + - name: create-mm2 + image: docker.redpanda.com/redpandadata/redpanda:latest + command: + - /bin/bash + - -c + - | + set -xe + + trap connectorsState ERR + + connectorsState () { + echo check connectors expand status + curl {{ template "curl-options" . }} http://{{ include "connectors.serviceName" . }}:{{ .Values.connectors.restPort }}/connectors?expand=status + echo check connectors expand info + curl {{ template "curl-options" . }} http://{{ include "connectors.serviceName" . }}:{{ .Values.connectors.restPort }}/connectors?expand=info + echo check connector configuration + curl {{ template "curl-options" . }} http://{{ include "connectors.serviceName" . }}:{{ .Values.connectors.restPort }}/connectors/$CONNECTOR_NAME + echo check connector topics + curl {{ template "curl-options" . }} http://{{ include "connectors.serviceName" . }}:{{ .Values.connectors.restPort }}/connectors/$CONNECTOR_NAME/topics + } + + curl {{ template "curl-options" . }} http://{{ include "connectors.serviceName" . }}:{{ .Values.connectors.restPort }}/connectors + + SASL_MECHANISM="PLAIN" + {{- if .Values.auth.sasl.enabled }} + set -e + set +x + + IFS=: read -r CONNECT_SASL_USERNAME KAFKA_SASL_PASSWORD CONNECT_SASL_MECHANISM < $(find /mnt/users/* -print) + CONNECT_SASL_MECHANISM=${CONNECT_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + if [[ -n "$CONNECT_SASL_USERNAME" && -n "$KAFKA_SASL_PASSWORD" && -n "$CONNECT_SASL_MECHANISM" ]]; then + rpk profile set user=$CONNECT_SASL_USERNAME pass=$KAFKA_SASL_PASSWORD sasl.mechanism=$CONNECT_SASL_MECHANISM + SASL_MECHANISM=$CONNECT_SASL_MECHANISM + JAAS_CONFIG_SOURCE="\"source.cluster.sasl.jaas.config\": \"org.apache.kafka.common.security.scram.ScramLoginModule required username=\\\\"\"${CONNECT_SASL_USERNAME}\\\\"\" password=\\\\"\"${KAFKA_SASL_PASSWORD}\\\\"\";\"," + JAAS_CONFIG_TARGET="\"target.cluster.sasl.jaas.config\": \"org.apache.kafka.common.security.scram.ScramLoginModule required username=\\\\"\"${CONNECT_SASL_USERNAME}\\\\"\" password=\\\\"\"${KAFKA_SASL_PASSWORD}\\\\"\";\"," + fi + + set -x + set +e + {{- end }} + + rpk profile create test + rpk profile set tls.enabled={{.Values.connectors.brokerTLS.enabled}} brokers={{ .Values.connectors.bootstrapServers }} + {{- if .Values.connectors.brokerTLS.ca.secretRef }} + rpk profile set tls.ca={{ printf "/redpanda-certs/%s" (default "ca.crt" .Values.connectors.brokerTLS.ca.secretNameOverwrite) }} + {{- end }} + + {{- if .Values.connectors.brokerTLS.enabled }} + CONNECT_TLS_ENABLED=true + {{- else }} + CONNECT_TLS_ENABLED=false + {{- end }} + SECURITY_PROTOCOL=PLAINTEXT + if [[ -n "$CONNECT_SASL_MECHANISM" && $CONNECT_TLS_ENABLED == "true" ]]; then + SECURITY_PROTOCOL="SASL_SSL" + elif [[ -n "$CONNECT_SASL_MECHANISM" ]]; then + SECURITY_PROTOCOL="SASL_PLAINTEXT" + elif [[ $CONNECT_TLS_ENABLED == "true" ]]; then + SECURITY_PROTOCOL="SSL" + fi + + rpk topic list + rpk topic create test-topic + rpk topic list + echo "Test message!" | rpk topic produce test-topic + + CONNECTOR_NAME=mm2-$RANDOM + cat << 'EOF' > /tmp/mm2-conf.json + { + "name": "CONNECTOR_NAME", + "config": { + "connector.class": "org.apache.kafka.connect.mirror.MirrorSourceConnector", + "topics": "test-topic", + "replication.factor": "1", + "tasks.max": "1", + "source.cluster.bootstrap.servers": {{ .Values.connectors.bootstrapServers | quote }}, + "target.cluster.bootstrap.servers": {{ .Values.connectors.bootstrapServers | quote }}, + "target.cluster.alias": "test-only", + "source.cluster.alias": "source", + "key.converter": "org.apache.kafka.connect.converters.ByteArrayConverter", + "value.converter": "org.apache.kafka.connect.converters.ByteArrayConverter", + "source->target.enabled": "true", + "target->source.enabled": "false", + "sync.topic.configs.interval.seconds": "5", + "sync.topics.configs.enabled": "true", + "source.cluster.ssl.truststore.type": "PEM", + "target.cluster.ssl.truststore.type": "PEM", + "source.cluster.ssl.truststore.location": {{ printf "/opt/kafka/connect-certs/ca/%s" (default "ca.crt" .Values.connectors.brokerTLS.ca.secretNameOverwrite) | quote }}, + "target.cluster.ssl.truststore.location": {{ printf "/opt/kafka/connect-certs/ca/%s" (default "ca.crt" .Values.connectors.brokerTLS.ca.secretNameOverwrite) | quote }}, + JAAS_CONFIG_SOURCE + JAAS_CONFIG_TARGET + "source.cluster.security.protocol": "SECURITY_PROTOCOL", + "target.cluster.security.protocol": "SECURITY_PROTOCOL", + "source.cluster.sasl.mechanism": "SASL_MECHANISM", + "target.cluster.sasl.mechanism": "SASL_MECHANISM", + "offset-syncs.topic.replication.factor": 1 + } + } + EOF + + sed -i "s/CONNECTOR_NAME/$CONNECTOR_NAME/g" /tmp/mm2-conf.json + sed -i "s/SASL_MECHANISM/$SASL_MECHANISM/g" /tmp/mm2-conf.json + sed -i "s/SECURITY_PROTOCOL/$SECURITY_PROTOCOL/g" /tmp/mm2-conf.json + set +x + sed -i "s/JAAS_CONFIG_SOURCE/$JAAS_CONFIG_SOURCE/g" /tmp/mm2-conf.json + sed -i "s/JAAS_CONFIG_TARGET/$JAAS_CONFIG_TARGET/g" /tmp/mm2-conf.json + set -x + + curl {{ template "curl-options" . }} -H 'Content-Type: application/json' http://{{ include "connectors.serviceName" . }}:{{ .Values.connectors.restPort }}/connectors -d @/tmp/mm2-conf.json + + # The rpk topic consume could fail for the first few times as kafka connect needs + # to spawn the task and copy one message from the source topic. To solve this race condition + # the retry should be implemented in bash for rpk topic consume or other mechanism that + # can confirm source connectors started its execution. As a fast fix fixed 30 second fix is added. + sleep 30 + + rpk topic consume source.test-topic -n 1 | grep "Test message!" + + curl {{ template "curl-options" . }} -X DELETE http://{{ include "connectors.serviceName" . }}:{{ .Values.connectors.restPort }}/connectors/$CONNECTOR_NAME + + curl {{ template "curl-options" . }} http://{{ include "connectors.serviceName" . }}:{{ .Values.connectors.restPort }}/connectors + + rpk topic delete test-topic source.test-topic mm2-offset-syncs.test-only.internal + volumeMounts: + {{- if .Values.connectors.brokerTLS.ca.secretRef }} + - mountPath: /redpanda-certs + name: redpanda-ca + {{- end }} + {{- toYaml .Values.storage.volumeMounts | nindent 8 }} + volumes: + {{- if .Values.connectors.brokerTLS.ca.secretRef }} + - name: redpanda-ca + secret: + defaultMode: 0444 + secretName: {{ .Values.connectors.brokerTLS.ca.secretRef }} + {{- end }} + {{- toYaml .Values.storage.volume | nindent 4 }} +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/charts/connectors/values.yaml b/charts/redpanda/redpanda/5.9.7/charts/connectors/values.yaml new file mode 100644 index 000000000..f230a84d3 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/connectors/values.yaml @@ -0,0 +1,311 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# This file contains values for variables referenced from yaml files in the templates directory. +# +# For further information on Helm templating see the documentation at: +# https://helm.sh/docs/chart_template_guide/values_files/ + +# +# >>> This chart requires Helm version 3.6.0 or greater <<< +# + +# Common settings +# +# -- Override `connectors.name` template. +nameOverride: "" +# -- Override `connectors.fullname` template. +fullnameOverride: "" +# -- Additional labels to add to all Kubernetes objects. +# For example, `my.k8s.service: redpanda`. +commonLabels: {} +# -- Taints to be tolerated by Pods. +# For details, +# see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/). +tolerations: [] + +# -- Redpanda Docker image settings. +image: + # -- Docker repository from which to pull the Redpanda Docker image. + repository: docker.redpanda.com/redpandadata/connectors + # -- The Redpanda version. + # See DockerHub for: + # [All stable versions](https://hub.docker.com/r/redpandadata/redpanda/tags) + # and [all unstable versions](https://hub.docker.com/r/redpandadata/redpanda-unstable/tags). + # @default -- `Chart.appVersion`. + tag: "" + # -- The imagePullPolicy. + # If `image.tag` is 'latest', the default is `Always`. + pullPolicy: IfNotPresent + +# -- Pull secrets may be used to provide credentials to image repositories +# See https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ +imagePullSecrets: [] + +test: + create: true + +connectors: + # -- The port on which the Kafka Connect REST API listens. The API is used for administrative tasks. + restPort: 8083 + # -- A comma-separated list of Redpanda broker addresses in the format of IP:Port or DNS:Port. Kafka Connect uses this to connect to the Redpanda/Kafka cluster. + bootstrapServers: "" + # A comma-separated list of Schema Registry addresses in the format IP:Port or DNS:Port. The Schema Registry is a service that manages the schemas used by producers and consumers. + schemaRegistryURL: "" + # -- A placeholder for any Java configuration settings for Kafka Connect that are not explicitly defined in this Helm chart. Java configuration settings are passed to the Kafka Connect startup script. + additionalConfiguration: "" + secretManager: + enabled: false + region: "" + consolePrefix: "" + connectorsPrefix: "" + # -- The number of bytes of records a producer will attempt to batch together before sending to Redpanda. Batching improves throughput. + producerBatchSize: 131072 + # -- The time, in milliseconds, that a producer will wait before sending a batch of records. Waiting allows the producer to gather more records in the same batch and improve throughput. + producerLingerMS: 1 + storage: + # -- The number of replicas for each of the internal topics that Kafka Connect uses. + replicationFactor: + # -- Replication factor for the offset topic. + offset: -1 + # -- Replication factor for the configuration topic. + config: -1 + # -- Replication factor for the status topic. + status: -1 + # -- Indicates if read and write operations for the respective topics are allowed remotely. + remote: + read: + offset: false + config: false + status: false + write: + offset: false + config: false + status: false + topic: + # -- The name of the internal topic that Kafka Connect uses to store source connector offsets. + offset: _internal_connectors_offsets + # -- The name of the internal topic that Kafka Connect uses to store connector and task configurations. + config: _internal_connectors_configs + # -- The name of the internal topic that Kafka Connect uses to store connector and task status updates. + status: _internal_connectors_status + # -- A unique string that identifies the Kafka Connect cluster. It's used in the formation of the internal topic names, ensuring that multiple Kafka Connect clusters can connect to the same Redpanda cluster without interfering with each other. + groupID: connectors-cluster + brokerTLS: + enabled: false + ca: + # -- The name of the Secret where the ca.crt file content is located. + secretRef: "" + # -- If `secretRef` points to a Secret where the certificate authority (CA) is not under the + # `ca.crt` key, use `secretNameOverwrite` to overwrite it e.g. `corp-ca.crt`. + secretNameOverwrite: "" + cert: + # -- The name of the secret where client signed certificate is located + secretRef: "" + # -- If secretRef points to secret where client signed certificate is not under + # tls.crt key then please use secretNameOverwrite to overwrite it e.g. corp-tls.crt + secretNameOverwrite: "" + key: + # -- The name of the secret where client private key is located + secretRef: "" + # -- If secretRef points to secret where client private key is not under + # tls.key key then please use secretNameOverwrite to overwrite it e.g. corp-tls.key + secretNameOverwrite: "" + +# -- Authentication settings. +# For details, +# see the [SASL documentation](https://docs.redpanda.com/docs/manage/kubernetes/security/sasl-kubernetes/). +# The first line of the secret file is used. So the first superuser is used to authenticate to the Redpanda cluster. +auth: + sasl: + enabled: false + # -- The authentication mechanism to use for the superuser. Options are `scram-sha-256` and `scram-sha-512`. + mechanism: scram-sha-512 + # -- A Secret that contains your SASL user password. + secretRef: "" + userName: "" + +# -- Log-level settings. +logging: + # -- Log level + # Valid values (from least to most verbose) are: `error`, `warn`, `info` and `debug`. + level: warn + +# -- Monitoring. +# When set to `true`, the Helm chart creates a PodMonitor that can be used by Prometheus-Operator or VictoriaMetrics-Operator to scrape the metrics. +monitoring: + enabled: false + scrapeInterval: 30s + labels: {} + annotations: {} + namespaceSelector: + any: true + +container: + # + # -- Security context for the Redpanda Connectors container. + # See also `deployment.securityContext` for Pod-level settings. + securityContext: + allowPrivilegeEscalation: false + # -- Pod resource management. + resources: + request: + # Numeric values here are also acceptable. + cpu: "1" + memory: 2350Mi + limits: + cpu: "1" + memory: 2350Mi + # -- Java maximum heap size must not be greater than `container.resources.limits.memory`. + javaMaxHeapSize: 2G + javaGCLogEnabled: "false" + +deployment: + # Replicas can be used to scale Deployment + # replicas + + create: true + # Customize the command to use as the entrypoint of the Deployment. + # command: [] + strategy: + type: RollingUpdate + schedulerName: "" + budget: + maxUnavailable: 1 + # -- Additional annotations to apply to the Pods of this Deployment. + annotations: {} + # -- Adjust the period for your probes to meet your needs. + # For details, + # see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes). + livenessProbe: + initialDelaySeconds: 10 + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + readinessProbe: + initialDelaySeconds: 60 + failureThreshold: 2 + periodSeconds: 10 + successThreshold: 3 + timeoutSeconds: 5 + + # -- Additional environment variables for the Pods. + extraEnv: [] + # - name: RACK_ID + # value: "1" + + # -- Configure extra environment variables from Secrets and ConfigMaps. + extraEnvFrom: [] + # - secretRef: + # name: my-secret + # - configMapRef: + # name: my-configmap + + # -- The maximum time in seconds for a deployment to make progress before it is + # considered to be failed. The deployment controller will continue to process + # failed deployments and a condition with a ProgressDeadlineExceeded reason + # will be surfaced in the deployment status. Note that progress will not be + # estimated during the time a deployment is paused. + progressDeadlineSeconds: 600 + + # -- The number of old ReplicaSets to retain to allow rollback. This is a pointer + # to distinguish between explicit zero and not specified. + revisionHistoryLimit: 10 + + # -- Inter-Pod Affinity rules for scheduling Pods of this Deployment. + # For details, + # see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity). + podAffinity: {} + # -- Node Affinity rules for scheduling Pods of this Deployment. + # The suggestion would be to spread Pods according to topology zone. + # For details, + # see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity). + nodeAffinity: {} + # -- Anti-affinity rules for scheduling Pods of this Deployment. + # For details, + # see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity). + # You may either edit the default settings for anti-affinity rules, + # or specify new anti-affinity rules to use instead of the defaults. + podAntiAffinity: + # -- The `topologyKey` to be used. + # Can be used to spread across different nodes, AZs, regions etc. + topologyKey: kubernetes.io/hostname + # -- Valid anti-affinity types are `soft`, `hard`, or `custom`. + # Use `custom` if you want to supply your own anti-affinity rules in the `podAntiAffinity.custom` object. + type: hard + # -- Weight for `soft` anti-affinity rules. + # Does not apply for other anti-affinity types. + weight: 100 + # -- Change `podAntiAffinity.type` to `custom` and provide your own podAntiAffinity rules here. + custom: {} + # -- Node selection constraints for scheduling Pods of this Deployment. + # These constraints override the global `nodeSelector` value. + # For details, + # see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector). + nodeSelector: {} + # -- PriorityClassName given to Pods of this Deployment. + # For details, + # see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass). + priorityClassName: "" + # -- Taints to be tolerated by Pods of this Deployment. + # These tolerations override the global tolerations value. + # For details, + # see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/). + tolerations: [] + # For details, + # see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/). + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: topology.kubernetes.io/zone + whenUnsatisfiable: ScheduleAnyway + securityContext: + fsGroup: 101 + runAsUser: 101 + fsGroupChangePolicy: OnRootMismatch + terminationGracePeriodSeconds: 30 + restartPolicy: Always + +storage: + volume: + - emptyDir: + medium: Memory + sizeLimit: 5Mi + name: rp-connect-tmp + volumeMounts: + - mountPath: /tmp + name: rp-connect-tmp + +# -- ServiceAccount management. +serviceAccount: + # -- Specifies whether a ServiceAccount should be created. + create: false + # -- Annotations to add to the ServiceAccount. + annotations: {} + # -- The name of the ServiceAccount to use. + # If not set and `serviceAccount.create` is `true`, + # a name is generated using the `connectors.fullname` template. + name: "" + +# -- Service management. +service: + # -- Annotations to add to the Service. + annotations: {} + # -- The name of the service to use. + # If not set, a name is generated using the `connectors.fullname` template. + name: "" + ports: + - name: prometheus + port: 9404 diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/.helmignore b/charts/redpanda/redpanda/5.9.7/charts/console/.helmignore new file mode 100644 index 000000000..04ecd888b --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +README.md.gotmpl +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/Chart.yaml b/charts/redpanda/redpanda/5.9.7/charts/console/Chart.yaml new file mode 100644 index 000000000..dd51b48d8 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/Chart.yaml @@ -0,0 +1,23 @@ +annotations: + artifacthub.io/images: | + - name: redpanda + image: docker.redpanda.com/redpandadata/console:v2.7.0 + artifacthub.io/license: Apache-2.0 + artifacthub.io/links: | + - name: Documentation + url: https://docs.redpanda.com + - name: "Helm (>= 3.6.0)" + url: https://helm.sh/docs/intro/install/ +apiVersion: v2 +appVersion: v2.7.0 +description: Helm chart to deploy Redpanda Console. +icon: https://images.ctfassets.net/paqvtpyf8rwu/3cYHw5UzhXCbKuR24GDFGO/73fb682e6157d11c10d5b2b5da1d5af0/skate-stand-panda.svg +kubeVersion: '>= 1.21.0-0' +maintainers: +- name: redpanda-data + url: https://github.com/orgs/redpanda-data/people +name: console +sources: +- https://github.com/redpanda-data/helm-charts +type: application +version: 0.7.29 diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/README.md b/charts/redpanda/redpanda/5.9.7/charts/console/README.md new file mode 100644 index 000000000..9bd93425f --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/README.md @@ -0,0 +1,353 @@ +# Redpanda Console Helm Chart Specification +--- +description: Find the default values and descriptions of settings in the Redpanda Console Helm chart. +--- + +![Version: 0.7.29](https://img.shields.io/badge/Version-0.7.29-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v2.7.0](https://img.shields.io/badge/AppVersion-v2.7.0-informational?style=flat-square) + +This page describes the official Redpanda Console Helm Chart. In particular, this page describes the contents of the chart’s [`values.yaml` file](https://github.com/redpanda-data/helm-charts/blob/main/charts/console/values.yaml). +Each of the settings is listed and described on this page, along with any default values. + +The Redpanda Console Helm chart is included as a subchart in the Redpanda Helm chart so that you can deploy and configure Redpanda and Redpanda Console together. +For instructions on how to install and use the chart, refer to the [deployment documentation](https://docs.redpanda.com/docs/deploy/deployment-option/self-hosted/kubernetes/kubernetes-deploy/). +For instructions on how to override and customize the chart’s values, see [Configure Redpanda Console](https://docs.redpanda.com/docs/manage/kubernetes/configure-helm-chart/#configure-redpanda-console). + +---------------------------------------------- +Autogenerated from chart metadata using [helm-docs v1.13.1](https://github.com/norwoodj/helm-docs/releases/v1.13.1) + +## Source Code + +* + +## Requirements + +Kubernetes: `>= 1.21.0-0` + +## Settings + +### [affinity](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=affinity) + +**Default:** `{}` + +### [annotations](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=annotations) + +Annotations to add to the deployment. + +**Default:** `{}` + +### [automountServiceAccountToken](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=automountServiceAccountToken) + +Automount API credentials for the Service Account into the pod. + +**Default:** `true` + +### [autoscaling.enabled](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=autoscaling.enabled) + +**Default:** `false` + +### [autoscaling.maxReplicas](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=autoscaling.maxReplicas) + +**Default:** `100` + +### [autoscaling.minReplicas](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=autoscaling.minReplicas) + +**Default:** `1` + +### [autoscaling.targetCPUUtilizationPercentage](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=autoscaling.targetCPUUtilizationPercentage) + +**Default:** `80` + +### [commonLabels](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=commonLabels) + +**Default:** `{}` + +### [configmap.create](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=configmap.create) + +**Default:** `true` + +### [console.config](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=console.config) + +Settings for the `Config.yaml` (required). For a reference of configuration settings, see the [Redpanda Console documentation](https://docs.redpanda.com/docs/reference/console/config/). + +**Default:** `{}` + +### [deployment.create](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=deployment.create) + +**Default:** `true` + +### [enterprise](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=enterprise) + +Settings for license key, as an alternative to secret.enterprise when a license secret is available + +**Default:** + +``` +{"licenseSecretRef":{"key":"","name":""}} +``` + +### [extraContainers](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=extraContainers) + +Add additional containers, such as for oauth2-proxy. + +**Default:** `[]` + +### [extraEnv](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=extraEnv) + +Additional environment variables for the Redpanda Console Deployment. + +**Default:** `[]` + +### [extraEnvFrom](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=extraEnvFrom) + +Additional environment variables for Redpanda Console mapped from Secret or ConfigMap. + +**Default:** `[]` + +### [extraVolumeMounts](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=extraVolumeMounts) + +Add additional volume mounts, such as for TLS keys. + +**Default:** `[]` + +### [extraVolumes](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=extraVolumes) + +Add additional volumes, such as for TLS keys. + +**Default:** `[]` + +### [fullnameOverride](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=fullnameOverride) + +Override `console.fullname` template. + +**Default:** `""` + +### [image](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=image) + +Redpanda Console Docker image settings. + +**Default:** + +``` +{"pullPolicy":"IfNotPresent","registry":"docker.redpanda.com","repository":"redpandadata/console","tag":""} +``` + +### [image.pullPolicy](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=image.pullPolicy) + +The imagePullPolicy. + +**Default:** `"IfNotPresent"` + +### [image.repository](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=image.repository) + +Docker repository from which to pull the Redpanda Docker image. + +**Default:** `"redpandadata/console"` + +### [image.tag](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=image.tag) + +The Redpanda Console version. See DockerHub for: [All stable versions](https://hub.docker.com/r/redpandadata/console/tags) and [all unstable versions](https://hub.docker.com/r/redpandadata/console-unstable/tags). + +**Default:** `Chart.appVersion` + +### [imagePullSecrets](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=imagePullSecrets) + +Pull secrets may be used to provide credentials to image repositories See https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + +**Default:** `[]` + +### [ingress.annotations](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=ingress.annotations) + +**Default:** `{}` + +### [ingress.className](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=ingress.className) + +**Default:** `nil` + +### [ingress.enabled](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=ingress.enabled) + +**Default:** `false` + +### [ingress.hosts[0].host](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=ingress.hosts[0].host) + +**Default:** `"chart-example.local"` + +### [ingress.hosts[0].paths[0].path](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=ingress.hosts[0].paths[0].path) + +**Default:** `"/"` + +### [ingress.hosts[0].paths[0].pathType](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=ingress.hosts[0].paths[0].pathType) + +**Default:** `"ImplementationSpecific"` + +### [ingress.tls](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=ingress.tls) + +**Default:** `[]` + +### [initContainers](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=initContainers) + +Any initContainers defined should be written here + +**Default:** `{"extraInitContainers":""}` + +### [initContainers.extraInitContainers](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=initContainers.extraInitContainers) + +Additional set of init containers + +**Default:** `""` + +### [livenessProbe](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=livenessProbe) + +Settings for liveness and readiness probes. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes). + +**Default:** + +``` +{"failureThreshold":3,"periodSeconds":10,"successThreshold":1,"timeoutSeconds":1} +``` + +### [nameOverride](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=nameOverride) + +Override `console.name` template. + +**Default:** `""` + +### [nodeSelector](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=nodeSelector) + +**Default:** `{}` + +### [podAnnotations](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=podAnnotations) + +**Default:** `{}` + +### [podLabels](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=podLabels) + +**Default:** `{}` + +### [podSecurityContext.fsGroup](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=podSecurityContext.fsGroup) + +**Default:** `99` + +### [podSecurityContext.runAsUser](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=podSecurityContext.runAsUser) + +**Default:** `99` + +### [priorityClassName](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=priorityClassName) + +PriorityClassName given to Pods. For details, see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass). + +**Default:** `""` + +### [readinessProbe.failureThreshold](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=readinessProbe.failureThreshold) + +**Default:** `3` + +### [readinessProbe.initialDelaySeconds](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=readinessProbe.initialDelaySeconds) + +Grant time to test connectivity to upstream services such as Kafka and Schema Registry. + +**Default:** `10` + +### [readinessProbe.periodSeconds](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=readinessProbe.periodSeconds) + +**Default:** `10` + +### [readinessProbe.successThreshold](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=readinessProbe.successThreshold) + +**Default:** `1` + +### [readinessProbe.timeoutSeconds](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=readinessProbe.timeoutSeconds) + +**Default:** `1` + +### [replicaCount](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=replicaCount) + +**Default:** `1` + +### [resources](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=resources) + +**Default:** `{}` + +### [secret](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=secret) + +Create a new Kubernetes Secret for all sensitive configuration inputs. Each provided Secret is mounted automatically and made available to the Pod. If you want to use one or more existing Secrets, you can use the `extraEnvFrom` list to mount environment variables from string and secretMounts to mount files such as Certificates from Secrets. + +**Default:** + +``` +{"create":true,"enterprise":{},"kafka":{},"login":{"github":{},"google":{},"jwtSecret":"","oidc":{},"okta":{}},"redpanda":{"adminApi":{}}} +``` + +### [secret.kafka](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=secret.kafka) + +Kafka Secrets. + +**Default:** `{}` + +### [secretMounts](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=secretMounts) + +SecretMounts is an abstraction to make a Secret available in the container's filesystem. Under the hood it creates a volume and a volume mount for the Redpanda Console container. + +**Default:** `[]` + +### [securityContext.runAsNonRoot](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=securityContext.runAsNonRoot) + +**Default:** `true` + +### [service.annotations](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=service.annotations) + +**Default:** `{}` + +### [service.port](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=service.port) + +**Default:** `8080` + +### [service.targetPort](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=service.targetPort) + +Override the value in `console.config.server.listenPort` if not `nil` + +**Default:** `nil` + +### [service.type](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=service.type) + +**Default:** `"ClusterIP"` + +### [serviceAccount.annotations](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=serviceAccount.annotations) + +Annotations to add to the service account. + +**Default:** `{}` + +### [serviceAccount.automountServiceAccountToken](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=serviceAccount.automountServiceAccountToken) + +Specifies whether a service account should automount API-Credentials + +**Default:** `true` + +### [serviceAccount.create](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=serviceAccount.create) + +Specifies whether a service account should be created. + +**Default:** `true` + +### [serviceAccount.name](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=serviceAccount.name) + +The name of the service account to use. If not set and `serviceAccount.create` is `true`, a name is generated using the `console.fullname` template + +**Default:** `""` + +### [strategy](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=strategy) + +**Default:** `{}` + +### [tests.enabled](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=tests.enabled) + +**Default:** `true` + +### [tolerations](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=tolerations) + +**Default:** `[]` + +### [topologySpreadConstraints](https://artifacthub.io/packages/helm/redpanda-data/console?modal=values&path=topologySpreadConstraints) + +**Default:** `[]` + diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/chart_test.go b/charts/redpanda/redpanda/5.9.7/charts/console/chart_test.go new file mode 100644 index 000000000..0e652c13e --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/chart_test.go @@ -0,0 +1,158 @@ +package console + +import ( + "encoding/json" + "fmt" + "os" + "regexp" + "slices" + "testing" + + fuzz "github.com/google/gofuzz" + "github.com/redpanda-data/helm-charts/pkg/helm" + "github.com/redpanda-data/helm-charts/pkg/testutil" + "github.com/santhosh-tekuri/jsonschema/v5" + "github.com/stretchr/testify/require" + "golang.org/x/tools/txtar" + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "sigs.k8s.io/yaml" +) + +// TestValues asserts that the chart's values.yaml file can be losslessly +// loaded into our type [Values] struct. +// NB: values.yaml should round trip through [Values], not [PartialValues], as +// [Values]'s omitempty tags are models after values.yaml. +func TestValues(t *testing.T) { + var typedValues Values + var unstructuredValues map[string]any + + require.NoError(t, yaml.Unmarshal(DefaultValuesYAML, &typedValues)) + require.NoError(t, yaml.Unmarshal(DefaultValuesYAML, &unstructuredValues)) + + typedValuesJSON, err := json.Marshal(typedValues) + require.NoError(t, err) + + unstructuredValuesJSON, err := json.Marshal(unstructuredValues) + require.NoError(t, err) + + require.JSONEq(t, string(unstructuredValuesJSON), string(typedValuesJSON)) +} + +func TestTemplate(t *testing.T) { + ctx := testutil.Context(t) + client, err := helm.New(helm.Options{ConfigHome: testutil.TempDir(t)}) + require.NoError(t, err) + + casesArchive, err := txtar.ParseFile("testdata/template-cases.txtar") + require.NoError(t, err) + + generatedCasesArchive, err := txtar.ParseFile("testdata/template-cases-generated.txtar") + require.NoError(t, err) + + goldens := testutil.NewTxTar(t, "testdata/template-cases.golden.txtar") + + for _, tc := range append(casesArchive.Files, generatedCasesArchive.Files...) { + tc := tc + t.Run(tc.Name, func(t *testing.T) { + var values PartialValues + require.NoError(t, yaml.Unmarshal(tc.Data, &values)) + + out, err := client.Template(ctx, ".", helm.TemplateOptions{ + Name: "console", + Values: values, + Set: []string{ + // jwtSecret defaults to a random string. Can't have that + // in snapshot testing so set it to a static value. + "secret.login.jwtSecret=SECRETKEY", + }, + }) + require.NoError(t, err) + goldens.AssertGolden(t, testutil.YAML, fmt.Sprintf("testdata/%s.yaml.golden", tc.Name), out) + }) + } +} + +// TestGenerateCases is not a test case (sorry) but a test case generator for +// the console chart. +func TestGenerateCases(t *testing.T) { + // Nasty hack to avoid making a main function somewhere. Sorry not sorry. + if !slices.Contains(os.Args, fmt.Sprintf("-test.run=%s", t.Name())) { + t.Skipf("%s will only run if explicitly specified (-run %q)", t.Name(), t.Name()) + } + + // Makes strings easier to read. + asciiStrs := func(s *string, c fuzz.Continue) { + const alphabet = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" + var x []byte + for i := 0; i < c.Intn(25); i++ { + x = append(x, alphabet[c.Intn(len(alphabet))]) + } + *s = string(x) + } + smallInts := func(s *int, c fuzz.Continue) { + *s = c.Intn(501) + } + + fuzzer := fuzz.New().NumElements(0, 3).SkipFieldsWithPattern( + regexp.MustCompile("^(SELinuxOptions|WindowsOptions|SeccompProfile|TCPSocket|HTTPHeaders|VolumeSource)$"), + ).Funcs( + asciiStrs, + smallInts, + func(t *corev1.ServiceType, c fuzz.Continue) { + types := []corev1.ServiceType{ + corev1.ServiceTypeClusterIP, + corev1.ServiceTypeExternalName, + corev1.ServiceTypeNodePort, + corev1.ServiceTypeLoadBalancer, + } + *t = types[c.Intn(len(types))] + }, + func(s *corev1.ResourceName, c fuzz.Continue) { asciiStrs((*string)(s), c) }, + func(_ *any, c fuzz.Continue) {}, + func(_ *[]corev1.ResourceClaim, c fuzz.Continue) {}, + func(_ *[]metav1.ManagedFieldsEntry, c fuzz.Continue) {}, + ) + + schema, err := jsonschema.CompileString("", string(ValuesSchemaJSON)) + require.NoError(t, err) + + nilChance := float64(0.8) + + files := make([]txtar.File, 0, 50) + for i := 0; i < 50; i++ { + // Every 5 iterations, decrease nil chance to ensure that we're biased + // towards exploring most cases. + if i%5 == 0 && nilChance > .1 { + nilChance -= .1 + } + + var values PartialValues + fuzzer.NilChance(nilChance).Fuzz(&values) + + out, err := yaml.Marshal(values) + require.NoError(t, err) + + merged, err := helm.MergeYAMLValues(t.TempDir(), DefaultValuesYAML, out) + require.NoError(t, err) + + // Ensure that our generated values comply with the schema set by the chart. + if err := schema.Validate(merged); err != nil { + t.Logf("Generated invalid values; trying again...\n%v", err) + i-- + continue + } + + files = append(files, txtar.File{ + Name: fmt.Sprintf("case-%03d", i), + Data: out, + }) + } + + archive := txtar.Format(&txtar.Archive{ + Comment: []byte(fmt.Sprintf(`Generated by %s`, t.Name())), + Files: files, + }) + + require.NoError(t, os.WriteFile("testdata/template-cases-generated.txtar", archive, 0o644)) +} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/configmap.go b/charts/redpanda/redpanda/5.9.7/charts/console/configmap.go new file mode 100644 index 000000000..c4fa38291 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/configmap.go @@ -0,0 +1,61 @@ +// Licensed to the Apache Software Foundation (ASF) under one or more +// contributor license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright ownership. +// The ASF licenses this file to You under the Apache License, Version 2.0 +// (the "License"); you may not use this file except in compliance with +// the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +// +gotohelm:filename=_configmap.go.tpl +package console + +import ( + "fmt" + + "github.com/redpanda-data/helm-charts/pkg/gotohelm/helmette" + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +func ConfigMap(dot *helmette.Dot) *corev1.ConfigMap { + values := helmette.Unwrap[Values](dot.Values) + + if !values.ConfigMap.Create { + return nil + } + + data := map[string]string{ + "config.yaml": fmt.Sprintf("# from .Values.console.config\n%s\n", helmette.Tpl(helmette.ToYaml(values.Console.Config), dot)), + } + + if len(values.Console.Roles) > 0 { + data["roles.yaml"] = helmette.Tpl(helmette.ToYaml(map[string]any{ + "roles": values.Console.Roles, + }), dot) + } + + if len(values.Console.RoleBindings) > 0 { + data["role-bindings.yaml"] = helmette.Tpl(helmette.ToYaml(map[string]any{ + "roleBindings": values.Console.RoleBindings, + }), dot) + } + + return &corev1.ConfigMap{ + TypeMeta: metav1.TypeMeta{ + APIVersion: "v1", + Kind: "ConfigMap", + }, + ObjectMeta: metav1.ObjectMeta{ + Name: Fullname(dot), + Labels: Labels(dot), + }, + Data: data, + } +} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/deployment.go b/charts/redpanda/redpanda/5.9.7/charts/console/deployment.go new file mode 100644 index 000000000..47537d40d --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/deployment.go @@ -0,0 +1,535 @@ +// Licensed to the Apache Software Foundation (ASF) under one or more +// contributor license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright ownership. +// The ASF licenses this file to You under the Apache License, Version 2.0 +// (the "License"); you may not use this file except in compliance with +// the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +// +gotohelm:filename=_deployment.go.tpl +package console + +import ( + "fmt" + + "github.com/redpanda-data/helm-charts/pkg/gotohelm/helmette" + appsv1 "k8s.io/api/apps/v1" + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/util/intstr" + "k8s.io/utils/ptr" +) + +// Console's HTTP server Port. +// The port is defined from the provided config but can be overridden +// by setting service.targetPort and if that is missing defaults to 8080. +func ContainerPort(dot *helmette.Dot) int32 { + values := helmette.Unwrap[Values](dot.Values) + + listenPort := int32(8080) + if values.Service.TargetPort != nil { + listenPort = *values.Service.TargetPort + } + + configListenPort := helmette.Dig(values.Console.Config, nil, "server", "listenPort") + if asInt, ok := helmette.AsIntegral[int](configListenPort); ok { + return int32(asInt) + } + + return listenPort +} + +func Deployment(dot *helmette.Dot) *appsv1.Deployment { + values := helmette.Unwrap[Values](dot.Values) + + if !values.Deployment.Create { + return nil + } + + var replicas *int32 + if !values.Autoscaling.Enabled { + replicas = ptr.To(values.ReplicaCount) + } + + var initContainers []corev1.Container + if values.InitContainers.ExtraInitContainers != nil { + initContainers = helmette.UnmarshalYamlArray[corev1.Container](helmette.Tpl(*values.InitContainers.ExtraInitContainers, dot)) + } + + volumeMounts := []corev1.VolumeMount{ + { + Name: "configs", + MountPath: "/etc/console/configs", + ReadOnly: true, + }, + } + + if values.Secret.Create { + volumeMounts = append(volumeMounts, corev1.VolumeMount{ + Name: "secrets", + MountPath: "/etc/console/secrets", + ReadOnly: true, + }) + } + + for _, mount := range values.SecretMounts { + volumeMounts = append(volumeMounts, corev1.VolumeMount{ + Name: mount.Name, + MountPath: mount.Path, + SubPath: ptr.Deref(mount.SubPath, ""), + }) + } + + volumeMounts = append(volumeMounts, values.ExtraVolumeMounts...) + + return &appsv1.Deployment{ + TypeMeta: metav1.TypeMeta{ + APIVersion: "apps/v1", + Kind: "Deployment", + }, + ObjectMeta: metav1.ObjectMeta{ + Name: Fullname(dot), + Labels: Labels(dot), + Namespace: dot.Release.Namespace, + Annotations: values.Annotations, + }, + Spec: appsv1.DeploymentSpec{ + Replicas: replicas, + Selector: &metav1.LabelSelector{ + MatchLabels: SelectorLabels(dot), + }, + Strategy: values.Strategy, + Template: corev1.PodTemplateSpec{ + ObjectMeta: metav1.ObjectMeta{ + Annotations: helmette.Merge(map[string]string{ + "checksum/config": helmette.Sha256Sum(helmette.ToYaml(ConfigMap(dot))), + }, values.PodAnnotations), + Labels: helmette.Merge(SelectorLabels(dot), values.PodLabels), + }, + Spec: corev1.PodSpec{ + ImagePullSecrets: values.ImagePullSecrets, + ServiceAccountName: ServiceAccountName(dot), + AutomountServiceAccountToken: &values.AutomountServiceAccountToken, + SecurityContext: &values.PodSecurityContext, + NodeSelector: values.NodeSelector, + Affinity: &values.Affinity, + TopologySpreadConstraints: values.TopologySpreadConstraints, + PriorityClassName: values.PriorityClassName, + Tolerations: values.Tolerations, + Volumes: consolePodVolumes(dot), + InitContainers: initContainers, + Containers: append([]corev1.Container{ + { + Name: dot.Chart.Name, + Command: values.Deployment.Command, + Args: append([]string{ + "--config.filepath=/etc/console/configs/config.yaml", + }, values.Deployment.ExtraArgs...), + SecurityContext: &values.SecurityContext, + Image: containerImage(dot), + ImagePullPolicy: values.Image.PullPolicy, + Ports: []corev1.ContainerPort{ + { + Name: "http", + ContainerPort: ContainerPort(dot), + Protocol: corev1.ProtocolTCP, + }, + }, + VolumeMounts: volumeMounts, + LivenessProbe: &corev1.Probe{ + InitialDelaySeconds: values.LivenessProbe.InitialDelaySeconds, // TODO what to do with this?? + PeriodSeconds: values.LivenessProbe.PeriodSeconds, + TimeoutSeconds: values.LivenessProbe.TimeoutSeconds, + SuccessThreshold: values.LivenessProbe.SuccessThreshold, + FailureThreshold: values.LivenessProbe.FailureThreshold, + ProbeHandler: corev1.ProbeHandler{ + HTTPGet: &corev1.HTTPGetAction{ + Path: "/admin/health", + Port: intstr.FromString("http"), + }, + }, + }, + ReadinessProbe: &corev1.Probe{ + InitialDelaySeconds: values.ReadinessProbe.InitialDelaySeconds, + PeriodSeconds: values.ReadinessProbe.PeriodSeconds, + TimeoutSeconds: values.ReadinessProbe.TimeoutSeconds, + SuccessThreshold: values.ReadinessProbe.SuccessThreshold, + FailureThreshold: values.ReadinessProbe.FailureThreshold, + ProbeHandler: corev1.ProbeHandler{ + HTTPGet: &corev1.HTTPGetAction{ + Path: "/admin/health", + Port: intstr.FromString("http"), + }, + }, + }, + Resources: values.Resources, + Env: consoleContainerEnv(dot), + EnvFrom: values.ExtraEnvFrom, + }, + }, values.ExtraContainers...), + }, + }, + }, + } +} + +// ConsoleImage +func containerImage(dot *helmette.Dot) string { + values := helmette.Unwrap[Values](dot.Values) + + tag := dot.Chart.AppVersion + if !helmette.Empty(values.Image.Tag) { + tag = *values.Image.Tag + } + + image := fmt.Sprintf("%s:%s", values.Image.Repository, tag) + + if !helmette.Empty(values.Image.Registry) { + return fmt.Sprintf("%s/%s", values.Image.Registry, image) + } + + return image +} + +type PossibleEnvVar struct { + Value any + EnvVar corev1.EnvVar +} + +func consoleContainerEnv(dot *helmette.Dot) []corev1.EnvVar { + values := helmette.Unwrap[Values](dot.Values) + + if !values.Secret.Create { + vars := values.ExtraEnv + + if !helmette.Empty(values.Enterprise.LicenseSecretRef.Name) { + vars = append(values.ExtraEnv, corev1.EnvVar{ + Name: "LICENSE", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: values.Enterprise.LicenseSecretRef.Name, + }, + Key: helmette.Default("enterprise-license", values.Enterprise.LicenseSecretRef.Key), + }, + }, + }) + } + + return vars + } + + possibleVars := []PossibleEnvVar{ + { + Value: values.Secret.Kafka.SASLPassword, + EnvVar: corev1.EnvVar{ + Name: "KAFKA_SASL_PASSWORD", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: Fullname(dot), + }, + Key: "kafka-sasl-password", + }, + }, + }, + }, + { + Value: values.Secret.Kafka.ProtobufGitBasicAuthPassword, + EnvVar: corev1.EnvVar{ + Name: "KAFKA_PROTOBUF_GIT_BASICAUTH_PASSWORD", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: Fullname(dot), + }, + Key: "kafka-protobuf-git-basicauth-password", + }, + }, + }, + }, + { + Value: values.Secret.Kafka.AWSMSKIAMSecretKey, + EnvVar: corev1.EnvVar{ + Name: "KAFKA_SASL_AWSMSKIAM_SECRETKEY", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: Fullname(dot), + }, + Key: "kafka-sasl-aws-msk-iam-secret-key", + }, + }, + }, + }, + { + Value: values.Secret.Kafka.TLSCA, + EnvVar: corev1.EnvVar{ + Name: "KAFKA_TLS_CAFILEPATH", + Value: "/etc/console/secrets/kafka-tls-ca", + }, + }, + { + Value: values.Secret.Kafka.TLSCert, + EnvVar: corev1.EnvVar{ + Name: "KAFKA_TLS_CERTFILEPATH", + Value: "/etc/console/secrets/kafka-tls-cert", + }, + }, + { + Value: values.Secret.Kafka.TLSKey, + EnvVar: corev1.EnvVar{ + Name: "KAFKA_TLS_KEYFILEPATH", + Value: "/etc/console/secrets/kafka-tls-key", + }, + }, + { + Value: values.Secret.Kafka.SchemaRegistryTLSCA, + EnvVar: corev1.EnvVar{ + Name: "KAFKA_SCHEMAREGISTRY_TLS_CAFILEPATH", + Value: "/etc/console/secrets/kafka-schemaregistry-tls-ca", + }, + }, + { + Value: values.Secret.Kafka.SchemaRegistryTLSCert, + EnvVar: corev1.EnvVar{ + Name: "KAFKA_SCHEMAREGISTRY_TLS_CERTFILEPATH", + Value: "/etc/console/secrets/kafka-schemaregistry-tls-cert", + }, + }, + { + Value: values.Secret.Kafka.SchemaRegistryTLSKey, + EnvVar: corev1.EnvVar{ + Name: "KAFKA_SCHEMAREGISTRY_TLS_KEYFILEPATH", + Value: "/etc/console/secrets/kafka-schemaregistry-tls-key", + }, + }, + { + Value: values.Secret.Kafka.SchemaRegistryPassword, + EnvVar: corev1.EnvVar{ + Name: "KAFKA_SCHEMAREGISTRY_PASSWORD", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: Fullname(dot), + }, + Key: "kafka-schema-registry-password", + }, + }, + }, + }, + { + Value: true, + EnvVar: corev1.EnvVar{ + Name: "LOGIN_JWTSECRET", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: Fullname(dot), + }, + Key: "login-jwt-secret", + }, + }, + }, + }, + { + Value: values.Secret.Login.Google.ClientSecret, + EnvVar: corev1.EnvVar{ + Name: "LOGIN_GOOGLE_CLIENTSECRET", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: Fullname(dot), + }, + Key: "login-google-oauth-client-secret", + }, + }, + }, + }, + + { + Value: values.Secret.Login.Google.GroupsServiceAccount, + EnvVar: corev1.EnvVar{ + Name: "LOGIN_GOOGLE_DIRECTORY_SERVICEACCOUNTFILEPATH", + Value: "/etc/console/secrets/login-google-groups-service-account.json", + }, + }, + { + Value: values.Secret.Login.Github.ClientSecret, + EnvVar: corev1.EnvVar{ + Name: "LOGIN_GITHUB_CLIENTSECRET", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: Fullname(dot), + }, + Key: "login-github-oauth-client-secret", + }, + }, + }, + }, + { + Value: values.Secret.Login.Github.PersonalAccessToken, + EnvVar: corev1.EnvVar{ + Name: "LOGIN_GITHUB_DIRECTORY_PERSONALACCESSTOKEN", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: Fullname(dot), + }, + Key: "login-github-personal-access-token", + }, + }, + }, + }, + { + Value: values.Secret.Login.Okta.ClientSecret, + EnvVar: corev1.EnvVar{ + Name: "LOGIN_OKTA_CLIENTSECRET", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: Fullname(dot), + }, + Key: "login-okta-client-secret", + }, + }, + }, + }, + { + Value: values.Secret.Login.Okta.DirectoryAPIToken, + EnvVar: corev1.EnvVar{ + Name: "LOGIN_OKTA_DIRECTORY_APITOKEN", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: Fullname(dot), + }, + Key: "login-okta-directory-api-token", + }, + }, + }, + }, + { + Value: values.Secret.Login.OIDC.ClientSecret, + EnvVar: corev1.EnvVar{ + Name: "LOGIN_OIDC_CLIENTSECRET", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: Fullname(dot), + }, + Key: "login-oidc-client-secret", + }, + }, + }, + }, + { + Value: values.Secret.Enterprise.License, + EnvVar: corev1.EnvVar{ + Name: "LICENSE", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: Fullname(dot), + }, + Key: "enterprise-license", + }, + }, + }, + }, + { + Value: values.Secret.Redpanda.AdminAPI.Password, + EnvVar: corev1.EnvVar{ + Name: "REDPANDA_ADMINAPI_PASSWORD", + ValueFrom: &corev1.EnvVarSource{ + SecretKeyRef: &corev1.SecretKeySelector{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: Fullname(dot), + }, + Key: "redpanda-admin-api-password", + }, + }, + }, + }, + { + Value: values.Secret.Redpanda.AdminAPI.TLSCA, + EnvVar: corev1.EnvVar{ + Name: "REDPANDA_ADMINAPI_TLS_CAFILEPATH", + Value: "/etc/console/secrets/redpanda-admin-api-tls-ca", + }, + }, + { + Value: values.Secret.Redpanda.AdminAPI.TLSKey, + EnvVar: corev1.EnvVar{ + Name: "REDPANDA_ADMINAPI_TLS_KEYFILEPATH", + Value: "/etc/console/secrets/redpanda-admin-api-tls-key", + }, + }, + { + Value: values.Secret.Redpanda.AdminAPI.TLSCert, + EnvVar: corev1.EnvVar{ + Name: "REDPANDA_ADMINAPI_TLS_CERTFILEPATH", + Value: "/etc/console/secrets/redpanda-admin-api-tls-cert", + }, + }, + } + + vars := values.ExtraEnv + for _, possible := range possibleVars { + if !helmette.Empty(possible.Value) { + vars = append(vars, possible.EnvVar) + } + } + + return vars +} + +func consolePodVolumes(dot *helmette.Dot) []corev1.Volume { + values := helmette.Unwrap[Values](dot.Values) + + volumes := []corev1.Volume{ + { + Name: "configs", + VolumeSource: corev1.VolumeSource{ + ConfigMap: &corev1.ConfigMapVolumeSource{ + LocalObjectReference: corev1.LocalObjectReference{ + Name: Fullname(dot), + }, + }, + }, + }, + } + + if values.Secret.Create { + volumes = append(volumes, corev1.Volume{ + Name: "secrets", + VolumeSource: corev1.VolumeSource{ + Secret: &corev1.SecretVolumeSource{ + SecretName: Fullname(dot), + }, + }, + }) + } + + for _, mount := range values.SecretMounts { + volumes = append(volumes, corev1.Volume{ + Name: mount.Name, + VolumeSource: corev1.VolumeSource{ + Secret: &corev1.SecretVolumeSource{ + SecretName: mount.SecretName, + DefaultMode: mount.DefaultMode, + }, + }, + }) + } + + return append(volumes, values.ExtraVolumes...) +} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/examples/console-enterprise.yaml b/charts/redpanda/redpanda/5.9.7/charts/console/examples/console-enterprise.yaml new file mode 100644 index 000000000..dc3f29197 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/examples/console-enterprise.yaml @@ -0,0 +1,94 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +image: + tag: master-8fcce39 + +resources: + limits: + cpu: 1 + memory: 2Gi + requests: + cpu: 100m + memory: 512Mi + +console: + config: + kafka: + brokers: + - bootstrap.mybrokers.com:9092 + clientId: redpanda-console + sasl: + enabled: true + mechanism: SCRAM-SHA-256 + username: console + # password: set via Helm secret / Env variable + tls: + enabled: false + login: + google: + enabled: true + clientId: redacted.apps.googleusercontent.com + # clientSecret: set via Helm secret / Env variable + directory: + # serviceAccountFilepath: set via Helm secret / Env variable + targetPrincipal: admin@mycompany.com + enterprise: + rbac: + enabled: true + roleBindingsFilepath: /etc/console/configs/role-bindings.yaml + roleBindings: + - roleName: viewer + metadata: + # Metadata properties will be shown in the UI. You can omit it if you want to + name: Developers + subjects: + # You can specify all groups or users from different providers here which shall be bound to the same role + - kind: group + provider: Google + name: engineering@mycompany.com + - kind: user + provider: Google + name: singleuser@mycompany.com + - roleName: admin + metadata: + name: Admin + subjects: + - kind: user + provider: Google + name: adminperson@mycompany.com + +secret: + create: true + kafka: + saslPassword: "redacted" + enterprise: + license: "redacted" + login: + google: + clientSecret: "redacted" + groupsServiceAccount: | + { + "type": "service_account", + "project_id": "redacted", + "private_key_id": "redacted", + "private_key": "-----BEGIN PRIVATE KEY-----\nREDACTED\n-----END PRIVATE KEY-----\n", + "client_email": "redacted@projectid.iam.gserviceaccount.com", + "client_id": "redacted", + "auth_uri": "https://accounts.google.com/o/oauth2/auth", + "token_uri": "https://oauth2.googleapis.com/token", + "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs", + "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/redacted.iam.gserviceaccount.com" + } diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/helpers.go b/charts/redpanda/redpanda/5.9.7/charts/console/helpers.go new file mode 100644 index 000000000..eed4aa711 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/helpers.go @@ -0,0 +1,84 @@ +// Licensed to the Apache Software Foundation (ASF) under one or more +// contributor license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright ownership. +// The ASF licenses this file to You under the Apache License, Version 2.0 +// (the "License"); you may not use this file except in compliance with +// the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +// +gotohelm:filename=_helpers.go.tpl +package console + +import ( + "fmt" + "strings" + + "github.com/redpanda-data/helm-charts/pkg/gotohelm/helmette" +) + +// Expand the name of the chart. +func Name(dot *helmette.Dot) string { + values := helmette.Unwrap[Values](dot.Values) + + name := helmette.Default(dot.Chart.Name, values.NameOverride) + return cleanForK8s(name) +} + +// Create a default fully qualified app name. +// We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +// If release name contains chart name it will be used as a full name. +func Fullname(dot *helmette.Dot) string { + values := helmette.Unwrap[Values](dot.Values) + + if values.FullnameOverride != "" { + return cleanForK8s(values.FullnameOverride) + } + + name := helmette.Default(dot.Chart.Name, values.NameOverride) + + if helmette.Contains(name, dot.Release.Name) { + return cleanForK8s(dot.Release.Name) + } + + return cleanForK8s(fmt.Sprintf("%s-%s", dot.Release.Name, name)) +} + +// Create chart name and version as used by the chart label. +func Chart(dot *helmette.Dot) string { + chart := fmt.Sprintf("%s-%s", dot.Chart.Name, dot.Chart.Version) + return cleanForK8s(strings.ReplaceAll(chart, "+", "_")) +} + +// Common labels +func Labels(dot *helmette.Dot) map[string]string { + values := helmette.Unwrap[Values](dot.Values) + + labels := map[string]string{ + "helm.sh/chart": Chart(dot), + "app.kubernetes.io/managed-by": dot.Release.Service, + } + + if dot.Chart.AppVersion != "" { + labels["app.kubernetes.io/version"] = dot.Chart.AppVersion + } + + return helmette.Merge(labels, SelectorLabels(dot), values.CommonLabels) +} + +func SelectorLabels(dot *helmette.Dot) map[string]string { + return map[string]string{ + "app.kubernetes.io/name": Name(dot), + "app.kubernetes.io/instance": dot.Release.Name, + } +} + +func cleanForK8s(s string) string { + return helmette.TrimSuffix("-", helmette.Trunc(63, s)) +} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/hpa.go b/charts/redpanda/redpanda/5.9.7/charts/console/hpa.go new file mode 100644 index 000000000..3b0458cff --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/hpa.go @@ -0,0 +1,82 @@ +// Licensed to the Apache Software Foundation (ASF) under one or more +// contributor license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright ownership. +// The ASF licenses this file to You under the Apache License, Version 2.0 +// (the "License"); you may not use this file except in compliance with +// the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +// +gotohelm:filename=_hpa.go.tpl +package console + +import ( + "github.com/redpanda-data/helm-charts/pkg/gotohelm/helmette" + autoscalingv2 "k8s.io/api/autoscaling/v2" + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/utils/ptr" +) + +func HorizontalPodAutoscaler(dot *helmette.Dot) *autoscalingv2.HorizontalPodAutoscaler { + values := helmette.Unwrap[Values](dot.Values) + + if !values.Autoscaling.Enabled { + return nil + } + + metrics := []autoscalingv2.MetricSpec{} + + if values.Autoscaling.TargetCPUUtilizationPercentage != nil { + metrics = append(metrics, autoscalingv2.MetricSpec{ + Type: "Resource", + Resource: &autoscalingv2.ResourceMetricSource{ + Name: corev1.ResourceCPU, + Target: autoscalingv2.MetricTarget{ + Type: autoscalingv2.UtilizationMetricType, + AverageUtilization: values.Autoscaling.TargetCPUUtilizationPercentage, + }, + }, + }) + } + + if values.Autoscaling.TargetMemoryUtilizationPercentage != nil { + metrics = append(metrics, autoscalingv2.MetricSpec{ + Type: "Resource", + Resource: &autoscalingv2.ResourceMetricSource{ + Name: corev1.ResourceMemory, + Target: autoscalingv2.MetricTarget{ + Type: autoscalingv2.UtilizationMetricType, + AverageUtilization: values.Autoscaling.TargetMemoryUtilizationPercentage, + }, + }, + }) + } + + return &autoscalingv2.HorizontalPodAutoscaler{ + TypeMeta: metav1.TypeMeta{ + APIVersion: "autoscaling/v2", + Kind: "HorizontalPodAutoscaler", + }, + ObjectMeta: metav1.ObjectMeta{ + Name: Fullname(dot), + Labels: Labels(dot), + }, + Spec: autoscalingv2.HorizontalPodAutoscalerSpec{ + ScaleTargetRef: autoscalingv2.CrossVersionObjectReference{ + APIVersion: "apps/v1", + Kind: "Deployment", + Name: Fullname(dot), + }, + MinReplicas: ptr.To(values.Autoscaling.MinReplicas), + MaxReplicas: values.Autoscaling.MaxReplicas, + Metrics: metrics, + }, + } +} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/ingress.go b/charts/redpanda/redpanda/5.9.7/charts/console/ingress.go new file mode 100644 index 000000000..926c286f1 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/ingress.go @@ -0,0 +1,88 @@ +// Licensed to the Apache Software Foundation (ASF) under one or more +// contributor license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright ownership. +// The ASF licenses this file to You under the Apache License, Version 2.0 +// (the "License"); you may not use this file except in compliance with +// the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +// +gotohelm:filename=_ingress.go.tpl +package console + +import ( + "github.com/redpanda-data/helm-charts/pkg/gotohelm/helmette" + networkingv1 "k8s.io/api/networking/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +func Ingress(dot *helmette.Dot) *networkingv1.Ingress { + values := helmette.Unwrap[Values](dot.Values) + + if !values.Ingress.Enabled { + return nil + } + + var tls []networkingv1.IngressTLS + for _, t := range values.Ingress.TLS { + var hosts []string + for _, host := range t.Hosts { + hosts = append(hosts, helmette.Tpl(host, dot)) + } + tls = append(tls, networkingv1.IngressTLS{ + SecretName: t.SecretName, + Hosts: hosts, + }) + } + + var rules []networkingv1.IngressRule + for _, host := range values.Ingress.Hosts { + var paths []networkingv1.HTTPIngressPath + for _, path := range host.Paths { + paths = append(paths, networkingv1.HTTPIngressPath{ + Path: path.Path, + PathType: path.PathType, + Backend: networkingv1.IngressBackend{ + Service: &networkingv1.IngressServiceBackend{ + Name: Fullname(dot), + Port: networkingv1.ServiceBackendPort{ + Number: values.Service.Port, + }, + }, + }, + }) + } + + rules = append(rules, networkingv1.IngressRule{ + Host: helmette.Tpl(host.Host, dot), + IngressRuleValue: networkingv1.IngressRuleValue{ + HTTP: &networkingv1.HTTPIngressRuleValue{ + Paths: paths, + }, + }, + }) + } + + return &networkingv1.Ingress{ + TypeMeta: metav1.TypeMeta{ + Kind: "Ingress", + APIVersion: "networking.k8s.io/v1", + }, + ObjectMeta: metav1.ObjectMeta{ + Name: Fullname(dot), + Labels: Labels(dot), + Annotations: values.Ingress.Annotations, + }, + Spec: networkingv1.IngressSpec{ + IngressClassName: values.Ingress.ClassName, + TLS: tls, + Rules: rules, + }, + } +} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/notes.go b/charts/redpanda/redpanda/5.9.7/charts/console/notes.go new file mode 100644 index 000000000..1f652dbaf --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/notes.go @@ -0,0 +1,67 @@ +// Licensed to the Apache Software Foundation (ASF) under one or more +// contributor license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright ownership. +// The ASF licenses this file to You under the Apache License, Version 2.0 +// (the "License"); you may not use this file except in compliance with +// the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +// +gotohelm:filename=_notes.go.tpl +package console + +import ( + "fmt" + + "github.com/redpanda-data/helm-charts/pkg/gotohelm/helmette" +) + +func Notes(dot *helmette.Dot) []string { + values := helmette.Unwrap[Values](dot.Values) + + commands := []string{ + `1. Get the application URL by running these commands:`, + } + if values.Ingress.Enabled { + scheme := "http" + if len(values.Ingress.TLS) > 0 { + scheme = "https" + } + for _, host := range values.Ingress.Hosts { + for _, path := range host.Paths { + commands = append(commands, fmt.Sprintf("%s://%s%s", scheme, host.Host, path.Path)) + } + } + } else if helmette.Contains("NodePort", string(values.Service.Type)) { + commands = append( + commands, + fmt.Sprintf(` export NODE_PORT=$(kubectl get --namespace %s -o jsonpath="{.spec.ports[0].nodePort}" services %s)`, dot.Release.Namespace, Fullname(dot)), + fmt.Sprintf(` export NODE_IP=$(kubectl get nodes --namespace %s -o jsonpath="{.items[0].status.addresses[0].address}")`, dot.Release.Namespace), + " echo http://$NODE_IP:$NODE_PORT", + ) + } else if helmette.Contains("NodePort", string(values.Service.Type)) { + commands = append( + commands, + ` NOTE: It may take a few minutes for the LoadBalancer IP to be available.`, + fmt.Sprintf(` You can watch the status of by running 'kubectl get --namespace %s svc -w %s'`, dot.Release.Namespace, Fullname(dot)), + fmt.Sprintf(` export SERVICE_IP=$(kubectl get svc --namespace %s %s --template "{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}")`, dot.Release.Namespace, Fullname(dot)), + fmt.Sprintf(` echo http://$SERVICE_IP:%d`, values.Service.Port), + ) + } else if helmette.Contains("ClusterIP", string(values.Service.Type)) { + commands = append( + commands, + fmt.Sprintf(` export POD_NAME=$(kubectl get pods --namespace %s -l "app.kubernetes.io/name=%s,app.kubernetes.io/instance=%s" -o jsonpath="{.items[0].metadata.name}")`, dot.Release.Namespace, Name(dot), dot.Release.Name), + fmt.Sprintf(` export CONTAINER_PORT=$(kubectl get pod --namespace %s $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")`, dot.Release.Namespace), + ` echo "Visit http://127.0.0.1:8080 to use your application"`, + fmt.Sprintf(` kubectl --namespace %s port-forward $POD_NAME 8080:$CONTAINER_PORT`, dot.Release.Namespace), + ) + } + + return commands +} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/secret.go b/charts/redpanda/redpanda/5.9.7/charts/console/secret.go new file mode 100644 index 000000000..d23951cbd --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/secret.go @@ -0,0 +1,84 @@ +// Licensed to the Apache Software Foundation (ASF) under one or more +// contributor license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright ownership. +// The ASF licenses this file to You under the Apache License, Version 2.0 +// (the "License"); you may not use this file except in compliance with +// the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +// +gotohelm:filename=_secret.go.tpl +package console + +import ( + "github.com/redpanda-data/helm-charts/pkg/gotohelm/helmette" + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/utils/ptr" +) + +func Secret(dot *helmette.Dot) *corev1.Secret { + values := helmette.Unwrap[Values](dot.Values) + + if !values.Secret.Create { + return nil + } + + jwtSecret := values.Secret.Login.JWTSecret + if jwtSecret == "" { + jwtSecret = helmette.RandAlphaNum(32) + } + + return &corev1.Secret{ + TypeMeta: metav1.TypeMeta{ + APIVersion: "v1", + Kind: "Secret", + }, + ObjectMeta: metav1.ObjectMeta{ + Name: Fullname(dot), + Labels: Labels(dot), + }, + Type: corev1.SecretTypeOpaque, + StringData: map[string]string{ + // Set empty defaults, so that we can always mount them as env variable even if they are not used. + // For this reason we can't use `with` to change the scope. + + // Kafka + "kafka-sasl-password": ptr.Deref(values.Secret.Kafka.SASLPassword, ""), + "kafka-protobuf-git-basicauth-password": ptr.Deref(values.Secret.Kafka.ProtobufGitBasicAuthPassword, ""), + "kafka-sasl-aws-msk-iam-secret-key": ptr.Deref(values.Secret.Kafka.AWSMSKIAMSecretKey, ""), + "kafka-tls-ca": ptr.Deref(values.Secret.Kafka.TLSCA, ""), + "kafka-tls-cert": ptr.Deref(values.Secret.Kafka.TLSCert, ""), + "kafka-tls-key": ptr.Deref(values.Secret.Kafka.TLSKey, ""), + "kafka-schema-registry-password": ptr.Deref(values.Secret.Kafka.SchemaRegistryPassword, ""), + "kafka-schemaregistry-tls-ca": ptr.Deref(values.Secret.Kafka.SchemaRegistryTLSCA, ""), + "kafka-schemaregistry-tls-cert": ptr.Deref(values.Secret.Kafka.SchemaRegistryTLSCert, ""), + "kafka-schemaregistry-tls-key": ptr.Deref(values.Secret.Kafka.SchemaRegistryTLSKey, ""), + + // Login + "login-jwt-secret": jwtSecret, + "login-google-oauth-client-secret": ptr.Deref(values.Secret.Login.Google.ClientSecret, ""), + "login-google-groups-service-account.json": ptr.Deref(values.Secret.Login.Google.GroupsServiceAccount, ""), + "login-github-oauth-client-secret": ptr.Deref(values.Secret.Login.Github.ClientSecret, ""), + "login-github-personal-access-token": ptr.Deref(values.Secret.Login.Github.PersonalAccessToken, ""), + "login-okta-client-secret": ptr.Deref(values.Secret.Login.Okta.ClientSecret, ""), + "login-okta-directory-api-token": ptr.Deref(values.Secret.Login.Okta.DirectoryAPIToken, ""), + "login-oidc-client-secret": ptr.Deref(values.Secret.Login.OIDC.ClientSecret, ""), + + // Enterprise + "enterprise-license": ptr.Deref(values.Secret.Enterprise.License, ""), + + // Redpanda + "redpanda-admin-api-password": ptr.Deref(values.Secret.Redpanda.AdminAPI.Password, ""), + "redpanda-admin-api-tls-ca": ptr.Deref(values.Secret.Redpanda.AdminAPI.TLSCA, ""), + "redpanda-admin-api-tls-cert": ptr.Deref(values.Secret.Redpanda.AdminAPI.TLSCert, ""), + "redpanda-admin-api-tls-key": ptr.Deref(values.Secret.Redpanda.AdminAPI.TLSKey, ""), + }, + } +} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/service.go b/charts/redpanda/redpanda/5.9.7/charts/console/service.go new file mode 100644 index 000000000..65214bf3e --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/service.go @@ -0,0 +1,60 @@ +// Licensed to the Apache Software Foundation (ASF) under one or more +// contributor license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright ownership. +// The ASF licenses this file to You under the Apache License, Version 2.0 +// (the "License"); you may not use this file except in compliance with +// the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +// +gotohelm:filename=_service.go.tpl +package console + +import ( + "github.com/redpanda-data/helm-charts/pkg/gotohelm/helmette" + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/util/intstr" +) + +func Service(dot *helmette.Dot) *corev1.Service { + values := helmette.Unwrap[Values](dot.Values) + + port := corev1.ServicePort{ + Name: "http", + Port: int32(values.Service.Port), + Protocol: corev1.ProtocolTCP, + } + + if values.Service.TargetPort != nil { + port.TargetPort = intstr.FromInt32(*values.Service.TargetPort) + } + + if helmette.Contains("NodePort", string(values.Service.Type)) && values.Service.NodePort != nil { + port.NodePort = *values.Service.NodePort + } + + return &corev1.Service{ + TypeMeta: metav1.TypeMeta{ + APIVersion: "v1", + Kind: "Service", + }, + ObjectMeta: metav1.ObjectMeta{ + Name: Fullname(dot), + Namespace: dot.Release.Namespace, + Labels: Labels(dot), + Annotations: values.Service.Annotations, + }, + Spec: corev1.ServiceSpec{ + Type: values.Service.Type, + Selector: SelectorLabels(dot), + Ports: []corev1.ServicePort{port}, + }, + } +} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/serviceaccount.go b/charts/redpanda/redpanda/5.9.7/charts/console/serviceaccount.go new file mode 100644 index 000000000..c23e5c92c --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/serviceaccount.go @@ -0,0 +1,60 @@ +// Licensed to the Apache Software Foundation (ASF) under one or more +// contributor license agreements. See the NOTICE file distributed with +// this work for additional information regarding copyright ownership. +// The ASF licenses this file to You under the Apache License, Version 2.0 +// (the "License"); you may not use this file except in compliance with +// the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +// +gotohelm:filename=_serviceaccount.go.tpl +package console + +import ( + "github.com/redpanda-data/helm-charts/pkg/gotohelm/helmette" + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/utils/ptr" +) + +// Create the name of the service account to use +func ServiceAccountName(dot *helmette.Dot) string { + values := helmette.Unwrap[Values](dot.Values) + + if values.ServiceAccount.Create { + if values.ServiceAccount.Name != "" { + return values.ServiceAccount.Name + } + return Fullname(dot) + } + + return helmette.Default("default", values.ServiceAccount.Name) +} + +func ServiceAccount(dot *helmette.Dot) *corev1.ServiceAccount { + values := helmette.Unwrap[Values](dot.Values) + + if !values.ServiceAccount.Create { + return nil + } + + return &corev1.ServiceAccount{ + TypeMeta: metav1.TypeMeta{ + Kind: "ServiceAccount", + APIVersion: "v1", + }, + ObjectMeta: metav1.ObjectMeta{ + Name: ServiceAccountName(dot), + Labels: Labels(dot), + Namespace: dot.Release.Namespace, + Annotations: values.ServiceAccount.Annotations, + }, + AutomountServiceAccountToken: ptr.To(values.ServiceAccount.AutomountServiceAccountToken), + } +} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/NOTES.txt b/charts/redpanda/redpanda/5.9.7/charts/console/templates/NOTES.txt new file mode 100644 index 000000000..7541881fc --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/NOTES.txt @@ -0,0 +1,20 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- $notes := (get ((include "console.Notes" (dict "a" (list .))) | fromJson) "r") -}} +{{- range $_, $note := $notes }} +{{ $note }} +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/_configmap.go.tpl b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_configmap.go.tpl new file mode 100644 index 000000000..14673b024 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_configmap.go.tpl @@ -0,0 +1,25 @@ +{{- /* Generated from "configmap.go" */ -}} + +{{- define "console.ConfigMap" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.configmap.create) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $data := (dict "config.yaml" (printf "# from .Values.console.config\n%s\n" (tpl (toYaml $values.console.config) $dot)) ) -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $values.console.roles) ))) "r") | int) (0 | int)) -}} +{{- $_ := (set $data "roles.yaml" (tpl (toYaml (dict "roles" $values.console.roles )) $dot)) -}} +{{- end -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $values.console.roleBindings) ))) "r") | int) (0 | int)) -}} +{{- $_ := (set $data "role-bindings.yaml" (tpl (toYaml (dict "roleBindings" $values.console.roleBindings )) $dot)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "ConfigMap" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") "labels" (get (fromJson (include "console.Labels" (dict "a" (list $dot) ))) "r") )) "data" $data ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/_deployment.go.tpl b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_deployment.go.tpl new file mode 100644 index 000000000..71696bb25 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_deployment.go.tpl @@ -0,0 +1,133 @@ +{{- /* Generated from "deployment.go" */ -}} + +{{- define "console.ContainerPort" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $listenPort := ((8080 | int) | int) -}} +{{- if (ne $values.service.targetPort (coalesce nil)) -}} +{{- $listenPort = $values.service.targetPort -}} +{{- end -}} +{{- $configListenPort := (dig "server" "listenPort" (coalesce nil) $values.console.config) -}} +{{- $tmp_tuple_1 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.asintegral" (dict "a" (list $configListenPort) ))) "r")) ))) "r") -}} +{{- $ok_2 := $tmp_tuple_1.T2 -}} +{{- $asInt_1 := ($tmp_tuple_1.T1 | int) -}} +{{- if $ok_2 -}} +{{- $_is_returning = true -}} +{{- (dict "r" ($asInt_1 | int)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $listenPort) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "console.Deployment" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.deployment.create) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $replicas := (coalesce nil) -}} +{{- if (not $values.autoscaling.enabled) -}} +{{- $replicas = ($values.replicaCount | int) -}} +{{- end -}} +{{- $initContainers := (coalesce nil) -}} +{{- if (ne $values.initContainers.extraInitContainers (coalesce nil)) -}} +{{- $initContainers = (fromYamlArray (tpl $values.initContainers.extraInitContainers $dot)) -}} +{{- end -}} +{{- $volumeMounts := (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "configs" "mountPath" "/etc/console/configs" "readOnly" true ))) -}} +{{- if $values.secret.create -}} +{{- $volumeMounts = (concat (default (list ) $volumeMounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "secrets" "mountPath" "/etc/console/secrets" "readOnly" true )))) -}} +{{- end -}} +{{- range $_, $mount := $values.secretMounts -}} +{{- $volumeMounts = (concat (default (list ) $volumeMounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" $mount.name "mountPath" $mount.path "subPath" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $mount.subPath "") ))) "r") )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $volumeMounts = (concat (default (list ) $volumeMounts) (default (list ) $values.extraVolumeMounts)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "selector" (coalesce nil) "template" (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "containers" (coalesce nil) ) ) "strategy" (dict ) ) "status" (dict ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "apps/v1" "kind" "Deployment" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") "labels" (get (fromJson (include "console.Labels" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace "annotations" $values.annotations )) "spec" (mustMergeOverwrite (dict "selector" (coalesce nil) "template" (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "containers" (coalesce nil) ) ) "strategy" (dict ) ) (dict "replicas" $replicas "selector" (mustMergeOverwrite (dict ) (dict "matchLabels" (get (fromJson (include "console.SelectorLabels" (dict "a" (list $dot) ))) "r") )) "strategy" $values.strategy "template" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "containers" (coalesce nil) ) ) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "annotations" (merge (dict ) (dict "checksum/config" (sha256sum (toYaml (get (fromJson (include "console.ConfigMap" (dict "a" (list $dot) ))) "r"))) ) $values.podAnnotations) "labels" (merge (dict ) (get (fromJson (include "console.SelectorLabels" (dict "a" (list $dot) ))) "r") $values.podLabels) )) "spec" (mustMergeOverwrite (dict "containers" (coalesce nil) ) (dict "imagePullSecrets" $values.imagePullSecrets "serviceAccountName" (get (fromJson (include "console.ServiceAccountName" (dict "a" (list $dot) ))) "r") "automountServiceAccountToken" $values.automountServiceAccountToken "securityContext" $values.podSecurityContext "nodeSelector" $values.nodeSelector "affinity" $values.affinity "topologySpreadConstraints" $values.topologySpreadConstraints "priorityClassName" $values.priorityClassName "tolerations" $values.tolerations "volumes" (get (fromJson (include "console.consolePodVolumes" (dict "a" (list $dot) ))) "r") "initContainers" $initContainers "containers" (concat (default (list ) (list (mustMergeOverwrite (dict "name" "" "resources" (dict ) ) (dict "name" $dot.Chart.Name "command" $values.deployment.command "args" (concat (default (list ) (list "--config.filepath=/etc/console/configs/config.yaml")) (default (list ) $values.deployment.extraArgs)) "securityContext" $values.securityContext "image" (get (fromJson (include "console.containerImage" (dict "a" (list $dot) ))) "r") "imagePullPolicy" $values.image.pullPolicy "ports" (list (mustMergeOverwrite (dict "containerPort" 0 ) (dict "name" "http" "containerPort" ((get (fromJson (include "console.ContainerPort" (dict "a" (list $dot) ))) "r") | int) "protocol" "TCP" ))) "volumeMounts" $volumeMounts "livenessProbe" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "httpGet" (mustMergeOverwrite (dict "port" 0 ) (dict "path" "/admin/health" "port" "http" )) )) (dict "initialDelaySeconds" ($values.livenessProbe.initialDelaySeconds | int) "periodSeconds" ($values.livenessProbe.periodSeconds | int) "timeoutSeconds" ($values.livenessProbe.timeoutSeconds | int) "successThreshold" ($values.livenessProbe.successThreshold | int) "failureThreshold" ($values.livenessProbe.failureThreshold | int) )) "readinessProbe" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "httpGet" (mustMergeOverwrite (dict "port" 0 ) (dict "path" "/admin/health" "port" "http" )) )) (dict "initialDelaySeconds" ($values.readinessProbe.initialDelaySeconds | int) "periodSeconds" ($values.readinessProbe.periodSeconds | int) "timeoutSeconds" ($values.readinessProbe.timeoutSeconds | int) "successThreshold" ($values.readinessProbe.successThreshold | int) "failureThreshold" ($values.readinessProbe.failureThreshold | int) )) "resources" $values.resources "env" (get (fromJson (include "console.consoleContainerEnv" (dict "a" (list $dot) ))) "r") "envFrom" $values.extraEnvFrom )))) (default (list ) $values.extraContainers)) )) )) )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "console.containerImage" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $tag := $dot.Chart.AppVersion -}} +{{- if (not (empty $values.image.tag)) -}} +{{- $tag = $values.image.tag -}} +{{- end -}} +{{- $image := (printf "%s:%s" $values.image.repository $tag) -}} +{{- if (not (empty $values.image.registry)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "%s/%s" $values.image.registry $image)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $image) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "console.consoleContainerEnv" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.secret.create) -}} +{{- $vars := $values.extraEnv -}} +{{- if (not (empty $values.enterprise.licenseSecretRef.name)) -}} +{{- $vars = (concat (default (list ) $values.extraEnv) (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "LICENSE" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" $values.enterprise.licenseSecretRef.name )) (dict "key" (default "enterprise-license" $values.enterprise.licenseSecretRef.key) )) )) )))) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $vars) | toJson -}} +{{- break -}} +{{- end -}} +{{- $possibleVars := (list (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.kafka.saslPassword "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "KAFKA_SASL_PASSWORD" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) (dict "key" "kafka-sasl-password" )) )) )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.kafka.protobufGitBasicAuthPassword "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "KAFKA_PROTOBUF_GIT_BASICAUTH_PASSWORD" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) (dict "key" "kafka-protobuf-git-basicauth-password" )) )) )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.kafka.awsMskIamSecretKey "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "KAFKA_SASL_AWSMSKIAM_SECRETKEY" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) (dict "key" "kafka-sasl-aws-msk-iam-secret-key" )) )) )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.kafka.tlsCa "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "KAFKA_TLS_CAFILEPATH" "value" "/etc/console/secrets/kafka-tls-ca" )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.kafka.tlsCert "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "KAFKA_TLS_CERTFILEPATH" "value" "/etc/console/secrets/kafka-tls-cert" )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.kafka.tlsKey "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "KAFKA_TLS_KEYFILEPATH" "value" "/etc/console/secrets/kafka-tls-key" )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.kafka.schemaRegistryTlsCa "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "KAFKA_SCHEMAREGISTRY_TLS_CAFILEPATH" "value" "/etc/console/secrets/kafka-schemaregistry-tls-ca" )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.kafka.schemaRegistryTlsCert "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "KAFKA_SCHEMAREGISTRY_TLS_CERTFILEPATH" "value" "/etc/console/secrets/kafka-schemaregistry-tls-cert" )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.kafka.schemaRegistryTlsKey "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "KAFKA_SCHEMAREGISTRY_TLS_KEYFILEPATH" "value" "/etc/console/secrets/kafka-schemaregistry-tls-key" )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.kafka.schemaRegistryPassword "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "KAFKA_SCHEMAREGISTRY_PASSWORD" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) (dict "key" "kafka-schema-registry-password" )) )) )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" true "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "LOGIN_JWTSECRET" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) (dict "key" "login-jwt-secret" )) )) )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.login.google.clientSecret "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "LOGIN_GOOGLE_CLIENTSECRET" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) (dict "key" "login-google-oauth-client-secret" )) )) )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.login.google.groupsServiceAccount "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "LOGIN_GOOGLE_DIRECTORY_SERVICEACCOUNTFILEPATH" "value" "/etc/console/secrets/login-google-groups-service-account.json" )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.login.github.clientSecret "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "LOGIN_GITHUB_CLIENTSECRET" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) (dict "key" "login-github-oauth-client-secret" )) )) )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.login.github.personalAccessToken "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "LOGIN_GITHUB_DIRECTORY_PERSONALACCESSTOKEN" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) (dict "key" "login-github-personal-access-token" )) )) )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.login.okta.clientSecret "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "LOGIN_OKTA_CLIENTSECRET" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) (dict "key" "login-okta-client-secret" )) )) )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.login.okta.directoryApiToken "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "LOGIN_OKTA_DIRECTORY_APITOKEN" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) (dict "key" "login-okta-directory-api-token" )) )) )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.login.oidc.clientSecret "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "LOGIN_OIDC_CLIENTSECRET" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) (dict "key" "login-oidc-client-secret" )) )) )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.enterprise.License "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "LICENSE" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) (dict "key" "enterprise-license" )) )) )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.redpanda.adminApi.password "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "REDPANDA_ADMINAPI_PASSWORD" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) (dict "key" "redpanda-admin-api-password" )) )) )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.redpanda.adminApi.tlsCa "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "REDPANDA_ADMINAPI_TLS_CAFILEPATH" "value" "/etc/console/secrets/redpanda-admin-api-tls-ca" )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.redpanda.adminApi.tlsKey "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "REDPANDA_ADMINAPI_TLS_KEYFILEPATH" "value" "/etc/console/secrets/redpanda-admin-api-tls-key" )) )) (mustMergeOverwrite (dict "Value" (coalesce nil) "EnvVar" (dict "name" "" ) ) (dict "Value" $values.secret.redpanda.adminApi.tlsCert "EnvVar" (mustMergeOverwrite (dict "name" "" ) (dict "name" "REDPANDA_ADMINAPI_TLS_CERTFILEPATH" "value" "/etc/console/secrets/redpanda-admin-api-tls-cert" )) ))) -}} +{{- $vars := $values.extraEnv -}} +{{- range $_, $possible := $possibleVars -}} +{{- if (not (empty $possible.Value)) -}} +{{- $vars = (concat (default (list ) $vars) (list $possible.EnvVar)) -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $vars) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "console.consolePodVolumes" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $volumes := (list (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "configMap" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) (dict )) )) (dict "name" "configs" ))) -}} +{{- if $values.secret.create -}} +{{- $volumes = (concat (default (list ) $volumes) (list (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "secret" (mustMergeOverwrite (dict ) (dict "secretName" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) )) (dict "name" "secrets" )))) -}} +{{- end -}} +{{- range $_, $mount := $values.secretMounts -}} +{{- $volumes = (concat (default (list ) $volumes) (list (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "secret" (mustMergeOverwrite (dict ) (dict "secretName" $mount.secretName "defaultMode" $mount.defaultMode )) )) (dict "name" $mount.name )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (concat (default (list ) $volumes) (default (list ) $values.extraVolumes))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/_helpers.go.tpl b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_helpers.go.tpl new file mode 100644 index 000000000..88b00025d --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_helpers.go.tpl @@ -0,0 +1,82 @@ +{{- /* Generated from "helpers.go" */ -}} + +{{- define "console.Name" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $name := (default $dot.Chart.Name $values.nameOverride) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "console.cleanForK8s" (dict "a" (list $name) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "console.Fullname" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (ne $values.fullnameOverride "") -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "console.cleanForK8s" (dict "a" (list $values.fullnameOverride) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- $name := (default $dot.Chart.Name $values.nameOverride) -}} +{{- if (contains $name $dot.Release.Name) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "console.cleanForK8s" (dict "a" (list $dot.Release.Name) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "console.cleanForK8s" (dict "a" (list (printf "%s-%s" $dot.Release.Name $name)) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "console.Chart" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $chart := (printf "%s-%s" $dot.Chart.Name $dot.Chart.Version) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "console.cleanForK8s" (dict "a" (list (replace "+" "_" $chart)) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "console.Labels" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $labels := (dict "helm.sh/chart" (get (fromJson (include "console.Chart" (dict "a" (list $dot) ))) "r") "app.kubernetes.io/managed-by" $dot.Release.Service ) -}} +{{- if (ne $dot.Chart.AppVersion "") -}} +{{- $_ := (set $labels "app.kubernetes.io/version" $dot.Chart.AppVersion) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (merge (dict ) $labels (get (fromJson (include "console.SelectorLabels" (dict "a" (list $dot) ))) "r") $values.commonLabels)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "console.SelectorLabels" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (dict "app.kubernetes.io/name" (get (fromJson (include "console.Name" (dict "a" (list $dot) ))) "r") "app.kubernetes.io/instance" $dot.Release.Name )) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "console.cleanForK8s" -}} +{{- $s := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (trimSuffix "-" (trunc (63 | int) $s))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/_helpers.tpl b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_helpers.tpl new file mode 100644 index 000000000..ee2ab5d9b --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_helpers.tpl @@ -0,0 +1,25 @@ +{{/* +Expand the name of the chart. +Used by tests/test-connection.yaml +*/}} +{{- define "console.name" -}} +{{- get ((include "console.Name" (dict "a" (list .))) | fromJson) "r" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +Used by tests/test-connection.yaml +*/}} +{{- define "console.fullname" -}} +{{- get ((include "console.Fullname" (dict "a" (list .))) | fromJson) "r" }} +{{- end }} + +{{/* +Common labels +Used by tests/test-connection.yaml +*/}} +{{- define "console.labels" -}} +{{- (get ((include "console.Labels" (dict "a" (list .))) | fromJson) "r") | toYaml -}} +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/_hpa.go.tpl b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_hpa.go.tpl new file mode 100644 index 000000000..5957633d2 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_hpa.go.tpl @@ -0,0 +1,25 @@ +{{- /* Generated from "hpa.go" */ -}} + +{{- define "console.HorizontalPodAutoscaler" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.autoscaling.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $metrics := (list ) -}} +{{- if (ne $values.autoscaling.targetCPUUtilizationPercentage (coalesce nil)) -}} +{{- $metrics = (concat (default (list ) $metrics) (list (mustMergeOverwrite (dict "type" "" ) (dict "type" "Resource" "resource" (mustMergeOverwrite (dict "name" "" "target" (dict "type" "" ) ) (dict "name" "cpu" "target" (mustMergeOverwrite (dict "type" "" ) (dict "type" "Utilization" "averageUtilization" $values.autoscaling.targetCPUUtilizationPercentage )) )) )))) -}} +{{- end -}} +{{- if (ne $values.autoscaling.targetMemoryUtilizationPercentage (coalesce nil)) -}} +{{- $metrics = (concat (default (list ) $metrics) (list (mustMergeOverwrite (dict "type" "" ) (dict "type" "Resource" "resource" (mustMergeOverwrite (dict "name" "" "target" (dict "type" "" ) ) (dict "name" "memory" "target" (mustMergeOverwrite (dict "type" "" ) (dict "type" "Utilization" "averageUtilization" $values.autoscaling.targetMemoryUtilizationPercentage )) )) )))) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "scaleTargetRef" (dict "kind" "" "name" "" ) "maxReplicas" 0 ) "status" (dict "desiredReplicas" 0 "currentMetrics" (coalesce nil) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "autoscaling/v2" "kind" "HorizontalPodAutoscaler" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") "labels" (get (fromJson (include "console.Labels" (dict "a" (list $dot) ))) "r") )) "spec" (mustMergeOverwrite (dict "scaleTargetRef" (dict "kind" "" "name" "" ) "maxReplicas" 0 ) (dict "scaleTargetRef" (mustMergeOverwrite (dict "kind" "" "name" "" ) (dict "apiVersion" "apps/v1" "kind" "Deployment" "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") )) "minReplicas" ($values.autoscaling.minReplicas | int) "maxReplicas" ($values.autoscaling.maxReplicas | int) "metrics" $metrics )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/_ingress.go.tpl b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_ingress.go.tpl new file mode 100644 index 000000000..0df05e870 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_ingress.go.tpl @@ -0,0 +1,46 @@ +{{- /* Generated from "ingress.go" */ -}} + +{{- define "console.Ingress" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.ingress.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $tls := (coalesce nil) -}} +{{- range $_, $t := $values.ingress.tls -}} +{{- $hosts := (coalesce nil) -}} +{{- range $_, $host := $t.hosts -}} +{{- $hosts = (concat (default (list ) $hosts) (list (tpl $host $dot))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $tls = (concat (default (list ) $tls) (list (mustMergeOverwrite (dict ) (dict "secretName" $t.secretName "hosts" $hosts )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $rules := (coalesce nil) -}} +{{- range $_, $host := $values.ingress.hosts -}} +{{- $paths := (coalesce nil) -}} +{{- range $_, $path := $host.paths -}} +{{- $paths = (concat (default (list ) $paths) (list (mustMergeOverwrite (dict "pathType" (coalesce nil) "backend" (dict ) ) (dict "path" $path.path "pathType" $path.pathType "backend" (mustMergeOverwrite (dict ) (dict "service" (mustMergeOverwrite (dict "name" "" "port" (dict ) ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") "port" (mustMergeOverwrite (dict ) (dict "number" ($values.service.port | int) )) )) )) )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $rules = (concat (default (list ) $rules) (list (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "http" (mustMergeOverwrite (dict "paths" (coalesce nil) ) (dict "paths" $paths )) )) (dict "host" (tpl $host.host $dot) )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict ) "status" (dict "loadBalancer" (dict ) ) ) (mustMergeOverwrite (dict ) (dict "kind" "Ingress" "apiVersion" "networking.k8s.io/v1" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") "labels" (get (fromJson (include "console.Labels" (dict "a" (list $dot) ))) "r") "annotations" $values.ingress.annotations )) "spec" (mustMergeOverwrite (dict ) (dict "ingressClassName" $values.ingress.className "tls" $tls "rules" $rules )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/_notes.go.tpl b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_notes.go.tpl new file mode 100644 index 000000000..6b58b21ef --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_notes.go.tpl @@ -0,0 +1,40 @@ +{{- /* Generated from "notes.go" */ -}} + +{{- define "console.Notes" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $commands := (list `1. Get the application URL by running these commands:`) -}} +{{- if $values.ingress.enabled -}} +{{- $scheme := "http" -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $values.ingress.tls) ))) "r") | int) (0 | int)) -}} +{{- $scheme = "https" -}} +{{- end -}} +{{- range $_, $host := $values.ingress.hosts -}} +{{- range $_, $path := $host.paths -}} +{{- $commands = (concat (default (list ) $commands) (list (printf "%s://%s%s" $scheme $host.host $path.path))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- else -}}{{- if (contains "NodePort" (toString $values.service.type)) -}} +{{- $commands = (concat (default (list ) $commands) (list (printf ` export NODE_PORT=$(kubectl get --namespace %s -o jsonpath="{.spec.ports[0].nodePort}" services %s)` $dot.Release.Namespace (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r")) (printf ` export NODE_IP=$(kubectl get nodes --namespace %s -o jsonpath="{.items[0].status.addresses[0].address}")` $dot.Release.Namespace) " echo http://$NODE_IP:$NODE_PORT")) -}} +{{- else -}}{{- if (contains "NodePort" (toString $values.service.type)) -}} +{{- $commands = (concat (default (list ) $commands) (list ` NOTE: It may take a few minutes for the LoadBalancer IP to be available.` (printf ` You can watch the status of by running 'kubectl get --namespace %s svc -w %s'` $dot.Release.Namespace (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r")) (printf ` export SERVICE_IP=$(kubectl get svc --namespace %s %s --template "{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}")` $dot.Release.Namespace (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r")) (printf ` echo http://$SERVICE_IP:%d` ($values.service.port | int)))) -}} +{{- else -}}{{- if (contains "ClusterIP" (toString $values.service.type)) -}} +{{- $commands = (concat (default (list ) $commands) (list (printf ` export POD_NAME=$(kubectl get pods --namespace %s -l "app.kubernetes.io/name=%s,app.kubernetes.io/instance=%s" -o jsonpath="{.items[0].metadata.name}")` $dot.Release.Namespace (get (fromJson (include "console.Name" (dict "a" (list $dot) ))) "r") $dot.Release.Name) (printf ` export CONTAINER_PORT=$(kubectl get pod --namespace %s $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")` $dot.Release.Namespace) ` echo "Visit http://127.0.0.1:8080 to use your application"` (printf ` kubectl --namespace %s port-forward $POD_NAME 8080:$CONTAINER_PORT` $dot.Release.Namespace))) -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $commands) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/_secret.go.tpl b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_secret.go.tpl new file mode 100644 index 000000000..49e628993 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_secret.go.tpl @@ -0,0 +1,22 @@ +{{- /* Generated from "secret.go" */ -}} + +{{- define "console.Secret" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.secret.create) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $jwtSecret := $values.secret.login.jwtSecret -}} +{{- if (eq $jwtSecret "") -}} +{{- $jwtSecret = (randAlphaNum (32 | int)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "Secret" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") "labels" (get (fromJson (include "console.Labels" (dict "a" (list $dot) ))) "r") )) "type" "Opaque" "stringData" (dict "kafka-sasl-password" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.kafka.saslPassword "") ))) "r") "kafka-protobuf-git-basicauth-password" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.kafka.protobufGitBasicAuthPassword "") ))) "r") "kafka-sasl-aws-msk-iam-secret-key" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.kafka.awsMskIamSecretKey "") ))) "r") "kafka-tls-ca" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.kafka.tlsCa "") ))) "r") "kafka-tls-cert" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.kafka.tlsCert "") ))) "r") "kafka-tls-key" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.kafka.tlsKey "") ))) "r") "kafka-schema-registry-password" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.kafka.schemaRegistryPassword "") ))) "r") "kafka-schemaregistry-tls-ca" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.kafka.schemaRegistryTlsCa "") ))) "r") "kafka-schemaregistry-tls-cert" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.kafka.schemaRegistryTlsCert "") ))) "r") "kafka-schemaregistry-tls-key" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.kafka.schemaRegistryTlsKey "") ))) "r") "login-jwt-secret" $jwtSecret "login-google-oauth-client-secret" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.login.google.clientSecret "") ))) "r") "login-google-groups-service-account.json" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.login.google.groupsServiceAccount "") ))) "r") "login-github-oauth-client-secret" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.login.github.clientSecret "") ))) "r") "login-github-personal-access-token" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.login.github.personalAccessToken "") ))) "r") "login-okta-client-secret" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.login.okta.clientSecret "") ))) "r") "login-okta-directory-api-token" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.login.okta.directoryApiToken "") ))) "r") "login-oidc-client-secret" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.login.oidc.clientSecret "") ))) "r") "enterprise-license" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.enterprise.License "") ))) "r") "redpanda-admin-api-password" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.redpanda.adminApi.password "") ))) "r") "redpanda-admin-api-tls-ca" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.redpanda.adminApi.tlsCa "") ))) "r") "redpanda-admin-api-tls-cert" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.redpanda.adminApi.tlsCert "") ))) "r") "redpanda-admin-api-tls-key" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.secret.redpanda.adminApi.tlsKey "") ))) "r") ) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/_service.go.tpl b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_service.go.tpl new file mode 100644 index 000000000..64cef3f8d --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_service.go.tpl @@ -0,0 +1,20 @@ +{{- /* Generated from "service.go" */ -}} + +{{- define "console.Service" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $port := (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" "http" "port" (($values.service.port | int) | int) "protocol" "TCP" )) -}} +{{- if (ne $values.service.targetPort (coalesce nil)) -}} +{{- $_ := (set $port "targetPort" $values.service.targetPort) -}} +{{- end -}} +{{- if (and (contains "NodePort" (toString $values.service.type)) (ne $values.service.nodePort (coalesce nil))) -}} +{{- $_ := (set $port "nodePort" $values.service.nodePort) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict ) "status" (dict "loadBalancer" (dict ) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "Service" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "console.Labels" (dict "a" (list $dot) ))) "r") "annotations" $values.service.annotations )) "spec" (mustMergeOverwrite (dict ) (dict "type" $values.service.type "selector" (get (fromJson (include "console.SelectorLabels" (dict "a" (list $dot) ))) "r") "ports" (list $port) )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/_serviceaccount.go.tpl b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_serviceaccount.go.tpl new file mode 100644 index 000000000..5a49ba3fd --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_serviceaccount.go.tpl @@ -0,0 +1,39 @@ +{{- /* Generated from "serviceaccount.go" */ -}} + +{{- define "console.ServiceAccountName" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if $values.serviceAccount.create -}} +{{- if (ne $values.serviceAccount.name "") -}} +{{- $_is_returning = true -}} +{{- (dict "r" $values.serviceAccount.name) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "console.Fullname" (dict "a" (list $dot) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (default "default" $values.serviceAccount.name)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "console.ServiceAccount" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.serviceAccount.create) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) ) (mustMergeOverwrite (dict ) (dict "kind" "ServiceAccount" "apiVersion" "v1" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "console.ServiceAccountName" (dict "a" (list $dot) ))) "r") "labels" (get (fromJson (include "console.Labels" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace "annotations" $values.serviceAccount.annotations )) "automountServiceAccountToken" $values.serviceAccount.automountServiceAccountToken ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/_shims.tpl b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_shims.tpl new file mode 100644 index 000000000..e3bb40e41 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/_shims.tpl @@ -0,0 +1,289 @@ +{{- /* Generated from "bootstrap.go" */ -}} + +{{- define "_shims.typetest" -}} +{{- $typ := (index .a 0) -}} +{{- $value := (index .a 1) -}} +{{- $zero := (index .a 2) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (typeIs $typ $value) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $zero false)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.typeassertion" -}} +{{- $typ := (index .a 0) -}} +{{- $value := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (not (typeIs $typ $value)) -}} +{{- $_ := (fail (printf "expected type of %q got: %T" $typ $value)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $value) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.dicttest" -}} +{{- $m := (index .a 0) -}} +{{- $key := (index .a 1) -}} +{{- $zero := (index .a 2) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (hasKey $m $key) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (index $m $key) true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $zero false)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.compact" -}} +{{- $args := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $out := (dict ) -}} +{{- range $i, $e := $args -}} +{{- $_ := (set $out (printf "T%d" ((add (1 | int) $i) | int)) $e) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $out) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.deref" -}} +{{- $ptr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (eq $ptr (coalesce nil)) -}} +{{- $_ := (fail "nil dereference") -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $ptr) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.len" -}} +{{- $m := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (eq $m (coalesce nil)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (0 | int)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (len $m)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.ptr_Deref" -}} +{{- $ptr := (index .a 0) -}} +{{- $def := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (ne $ptr (coalesce nil)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $ptr) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $def) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.ptr_Equal" -}} +{{- $a := (index .a 0) -}} +{{- $b := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (and (eq $a (coalesce nil)) (eq $b (coalesce nil))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" true) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (eq $a $b)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.lookup" -}} +{{- $apiVersion := (index .a 0) -}} +{{- $kind := (index .a 1) -}} +{{- $namespace := (index .a 2) -}} +{{- $name := (index .a 3) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $result := (lookup $apiVersion $kind $namespace $name) -}} +{{- if (empty $result) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (coalesce nil) false)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $result true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.asnumeric" -}} +{{- $value := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (typeIs "float64" $value) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (typeIs "int64" $value) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (typeIs "int" $value) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (0 | int) false)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.asintegral" -}} +{{- $value := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (or (typeIs "int64" $value) (typeIs "int" $value)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (and (typeIs "float64" $value) (eq (floor $value) $value)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (0 | int) false)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.parseResource" -}} +{{- $repr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (typeIs "float64" $repr) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (float64 $repr) 1.0)) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (not (typeIs "string" $repr)) -}} +{{- $_ := (fail (printf "invalid Quantity expected string or float64 got: %T (%v)" $repr $repr)) -}} +{{- end -}} +{{- if (not (regexMatch `^[0-9]+(\.[0-9]{0,6})?(k|m|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$` $repr)) -}} +{{- $_ := (fail (printf "invalid Quantity: %q" $repr)) -}} +{{- end -}} +{{- $reprStr := (toString $repr) -}} +{{- $unit := (regexFind "(k|m|M|G|T|P|Ki|Mi|Gi|Ti|Pi)$" $repr) -}} +{{- $numeric := (float64 (substr (0 | int) ((sub ((get (fromJson (include "_shims.len" (dict "a" (list $reprStr) ))) "r") | int) ((get (fromJson (include "_shims.len" (dict "a" (list $unit) ))) "r") | int)) | int) $reprStr)) -}} +{{- $tmp_tuple_1 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list (dict "" 1.0 "m" 0.001 "k" (1000 | int) "M" (1000000 | int) "G" (1000000000 | int) "T" (1000000000000 | int) "P" (1000000000000000 | int) "Ki" (1024 | int) "Mi" (1048576 | int) "Gi" (1073741824 | int) "Ti" (1099511627776 | int) "Pi" (1125899906842624 | int) ) $unit (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok := $tmp_tuple_1.T2 -}} +{{- $scale := ($tmp_tuple_1.T1 | float64) -}} +{{- if (not $ok) -}} +{{- $_ := (fail (printf "unknown unit: %q" $unit)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $numeric $scale)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.resource_MustParse" -}} +{{- $repr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_2 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.parseResource" (dict "a" (list $repr) ))) "r")) ))) "r") -}} +{{- $scale := ($tmp_tuple_2.T2 | float64) -}} +{{- $numeric := ($tmp_tuple_2.T1 | float64) -}} +{{- $strs := (list "" "m" "k" "M" "G" "T" "P" "Ki" "Mi" "Gi" "Ti" "Pi") -}} +{{- $scales := (list 1.0 0.001 (1000 | int) (1000000 | int) (1000000000 | int) (1000000000000 | int) (1000000000000000 | int) (1024 | int) (1048576 | int) (1073741824 | int) (1099511627776 | int) (1125899906842624 | int)) -}} +{{- $idx := -1 -}} +{{- range $i, $s := $scales -}} +{{- if (eq ($s | float64) ($scale | float64)) -}} +{{- $idx = $i -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- if (eq $idx -1) -}} +{{- $_ := (fail (printf "unknown scale: %v" $scale)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "%s%s" (toString $numeric) (index $strs $idx))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.resource_Value" -}} +{{- $repr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_3 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.parseResource" (dict "a" (list $repr) ))) "r")) ))) "r") -}} +{{- $scale := ($tmp_tuple_3.T2 | float64) -}} +{{- $numeric := ($tmp_tuple_3.T1 | float64) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (int64 (ceil ((mulf $numeric $scale) | float64)))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.resource_MilliValue" -}} +{{- $repr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_4 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.parseResource" (dict "a" (list $repr) ))) "r")) ))) "r") -}} +{{- $scale := ($tmp_tuple_4.T2 | float64) -}} +{{- $numeric := ($tmp_tuple_4.T1 | float64) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (int64 (ceil ((mulf ((mulf $numeric 1000.0) | float64) $scale) | float64)))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.render-manifest" -}} +{{- $tpl := (index . 0) -}} +{{- $dot := (index . 1) -}} +{{- $manifests := (get ((include $tpl (dict "a" (list $dot))) | fromJson) "r") -}} +{{- if not (typeIs "[]interface {}" $manifests) -}} +{{- $manifests = (list $manifests) -}} +{{- end -}} +{{- range $_, $manifest := $manifests -}} +{{- if ne $manifest nil }} +--- +{{toYaml (unset (unset $manifest "status") "creationTimestamp")}} +{{- end -}} +{{- end -}} +{{- end -}} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/configmap.yaml b/charts/redpanda/redpanda/5.9.7/charts/console/templates/configmap.yaml new file mode 100644 index 000000000..cffd69938 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/configmap.yaml @@ -0,0 +1,17 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- include "_shims.render-manifest" (list "console.ConfigMap" .) -}} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/deployment.yaml b/charts/redpanda/redpanda/5.9.7/charts/console/templates/deployment.yaml new file mode 100644 index 000000000..48a149041 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/deployment.yaml @@ -0,0 +1,17 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- include "_shims.render-manifest" (list "console.Deployment" .) -}} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/hpa.yaml b/charts/redpanda/redpanda/5.9.7/charts/console/templates/hpa.yaml new file mode 100644 index 000000000..9cfc4a132 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/hpa.yaml @@ -0,0 +1,17 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- include "_shims.render-manifest" (list "console.HorizontalPodAutoscaler" .) -}} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/ingress.yaml b/charts/redpanda/redpanda/5.9.7/charts/console/templates/ingress.yaml new file mode 100644 index 000000000..ef3867869 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/ingress.yaml @@ -0,0 +1,17 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- include "_shims.render-manifest" (list "console.Ingress" .) -}} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/secret.yaml b/charts/redpanda/redpanda/5.9.7/charts/console/templates/secret.yaml new file mode 100644 index 000000000..aeeeba25e --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/secret.yaml @@ -0,0 +1,17 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- include "_shims.render-manifest" (list "console.Secret" .) -}} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/service.yaml b/charts/redpanda/redpanda/5.9.7/charts/console/templates/service.yaml new file mode 100644 index 000000000..0f1621faf --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/service.yaml @@ -0,0 +1,17 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- include "_shims.render-manifest" (list "console.Service" .) -}} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/serviceaccount.yaml b/charts/redpanda/redpanda/5.9.7/charts/console/templates/serviceaccount.yaml new file mode 100644 index 000000000..9215af70e --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/serviceaccount.yaml @@ -0,0 +1,17 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- include "_shims.render-manifest" (list "console.ServiceAccount" .) -}} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/templates/tests/test-connection.yaml b/charts/redpanda/redpanda/5.9.7/charts/console/templates/tests/test-connection.yaml new file mode 100644 index 000000000..de17fb2b1 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/templates/tests/test-connection.yaml @@ -0,0 +1,22 @@ +{{- if .Values.tests.enabled }} +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "console.fullname" . }}-test-connection" + namespace: {{ .Release.Namespace | quote }} + labels: + {{- include "console.labels" . | nindent 4 }} + annotations: + "helm.sh/hook": test +spec: +{{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} +{{- end }} + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['{{ include "console.fullname" . }}:{{ .Values.service.port }}'] + restartPolicy: Never + priorityClassName: {{ .Values.priorityClassName }} +{{- end }} \ No newline at end of file diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/testdata/template-cases-generated.txtar b/charts/redpanda/redpanda/5.9.7/charts/console/testdata/template-cases-generated.txtar new file mode 100644 index 000000000..7fd56f9de --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/testdata/template-cases-generated.txtar @@ -0,0 +1,22208 @@ +Generated by TestGenerateCases +-- case-000 -- +affinity: {} +annotations: + Q9AVJD4: G9TEnp +autoscaling: + maxReplicas: 206 + minReplicas: 312 + targetCPUUtilizationPercentage: 41 + targetMemoryUtilizationPercentage: 72 +commonLabels: + "": 31q1Pbz +extraEnv: +- name: Z2BpO + value: 0ggF3ha7D +extraVolumes: +- name: 7iCCax +- name: meEH +- name: xYVSV +fullnameOverride: hvGoJL +livenessProbe: + failureThreshold: 1028486626 + httpGet: + host: AOZs + path: YKi + port: Q8C3tKEBBI + scheme: ćpʔS欻鯡 + initialDelaySeconds: 1713123405 + periodSeconds: -1411200119 + successThreshold: -1362510905 + timeoutSeconds: 1375594715 +nameOverride: "n" +podAnnotations: + lyW: mn + pjq6fDr: YA2w301 + uXvFB: VQ5gP9 +priorityClassName: vQhDS +replicaCount: 387 +resources: + limits: + x0StjCjt: "0" +securityContext: {} +serviceAccount: + automountServiceAccountToken: false + create: true + name: HRoLg +strategy: + type: Ò泆A +-- case-001 -- +automountServiceAccountToken: true +extraContainers: +- image: LlCU3if + imagePullPolicy: RɷVȄ×ʤǫĠ侻Ɏźx跻Å榜 + lifecycle: {} + name: l0 + resources: {} + securityContext: + allowPrivilegeEscalation: true + privileged: true + startupProbe: + exec: {} + failureThreshold: -1510490758 + initialDelaySeconds: 112782468 + periodSeconds: -738545847 + successThreshold: -1801864225 + timeoutSeconds: 1026753125 + terminationMessagePath: gCG + terminationMessagePolicy: hmƂÚÕʏ疅耪鯉瓉Ɏ煐8qĺ + tty: true + workingDir: ixD7Jq +extraEnv: +- name: 3Nf + value: vATdo0CH + valueFrom: + configMapKeyRef: + key: IRw5 + name: fa + fieldRef: + apiVersion: 93Fjhay + fieldPath: LRa2I +- name: T0 + value: trXO4 +- name: P9hPooVH + value: yii5lolb + valueFrom: + configMapKeyRef: + key: spAKa + name: U0EYAAe0 +fullnameOverride: T50cZi +initContainers: + extraInitContainers: qur +nameOverride: Sh +priorityClassName: NyOpfr +replicaCount: 414 +resources: {} +tolerations: +- effect: Mǣ鍙x奬Ø裗Ʈ唿踣ʘ)ɒâÄ + key: AWx + operator: yīÄLJʑʢ避 + value: cO +- effect: ï楡ɜƐf鱖À夹ǙȤK + key: Gk23T + operator: è6槈$_ȋ6}rvĕ曉¸顋ŀÓ + value: DCkzy +- effect: 蠯u牰ŇɔnÜȎĤ原H + key: qSC + operator: "n" + tolerationSeconds: -7696192156323826068 + value: z +-- case-002 -- +deployment: {} +enterprise: {} +extraEnvFrom: +- prefix: cfVf + secretRef: + name: ha +- prefix: i2E2Jvnc +extraVolumeMounts: +- mountPath: Y40 + mountPropagation: $寕洦敬苖ēRõøȀ + name: vn5hd + readOnly: true + subPath: oXCY9 + subPathExpr: p +fullnameOverride: xZty +imagePullSecrets: +- {} +- name: YPVBzxvx +nameOverride: vN4yH7I +podAnnotations: + 8vRMfVroYC2: QXbUbLea + VV4w: s4sL + upwTMuIqflmD: 9J0H45zXX +priorityClassName: TeCy +replicaCount: 417 +resources: + limits: + 27ywV: "0" + nMnjjF4kM: "0" + xar2JX: "0" +service: + nodePort: 292 + port: 413 + targetPort: 267 + type: ILpSX2Cy +serviceAccount: + automountServiceAccountToken: true + name: R1Yar8 +tolerations: +- effect: ǩ趥螏|F8ǻĬ嵍Ğ错ʂĺƠǷ俆峻噸 + key: b + operator: wąȹV{İ刡嚮ȜJ + value: ZuTw +- effect: D稕栥[Ǟ$焫昲 + key: NnhmxYy + operator: Xʀ + value: v65W +- effect: 岂bĤ晏#DĢº + key: MOgT + operator: 礩懜蹻ǍBȟvɸ堊 + value: 3iXh +-- case-003 -- +annotations: + 6HCwaF8XIH: uIbMN + MRwga: Fq5s + mgpV: 4f +autoscaling: + maxReplicas: 411 + minReplicas: 432 + targetCPUUtilizationPercentage: 169 + targetMemoryUtilizationPercentage: 155 +configmap: + create: false +deployment: + create: false +extraVolumes: +- name: 1CIX +fullnameOverride: 8nE +ingress: + className: EqUYi + enabled: true + hosts: + - host: bKQCmfZ + - host: djItx5GtejC6 + - host: 2wLaQU8 + tls: + - hosts: + - V8BpuMCig + - 7LqG4w92 + - el3u4v + secretName: nUlu5bMwB8 + - hosts: + - 4HLzq + - 2i4g + secretName: lSgQIKwj5 +nameOverride: w6 +podSecurityContext: + fsGroup: 1512968668502336058 + runAsUser: -2578305880243425477 +priorityClassName: HNqN9h2 +replicaCount: 17 +resources: {} +secret: + create: true + kafka: + awsMskIamSecretKey: SrYY84t + protobufGitBasicAuthPassword: Fb + saslPassword: xCc3TeVY + schemaRegistryPassword: ovCqxwz9Bf + schemaRegistryTlsCa: JL + schemaRegistryTlsCert: cS + schemaRegistryTlsKey: UMwYx4F + tlsCa: HFpsnPdw + tlsCert: hseIt + tlsPassphrase: Wc0 +-- case-004 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: {} + weight: -1713447377 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: null + podAntiAffinity: {} +commonLabels: + "": PtQ7JxIAdPjt +fullnameOverride: "" +nameOverride: YMl +podAnnotations: + 1iK8Ic: Qo3FCg9qi + 63SsVxDT: v + A1Q4J4: U9jygY2t1F +priorityClassName: JT0MK +replicaCount: 261 +secretMounts: +- defaultMode: 197 + name: QmzFlXE + path: Oj + secretName: 7gi +service: + nodePort: 366 + port: 112 + targetPort: 173 + type: dO7eovC +strategy: + type: ɡv?ĨJ姯ɚƟć匪cb +-- case-005 -- +autoscaling: + enabled: false + maxReplicas: 26 + minReplicas: 380 + targetCPUUtilizationPercentage: 395 + targetMemoryUtilizationPercentage: 140 +configmap: + create: false +deployment: {} +extraVolumeMounts: +- mountPath: JU4z + name: QEJyD + subPath: ZBEy2m0m + subPathExpr: S1Kk +- mountPath: RjUw5sX7NP + name: ett1n + subPath: NmZKwz + subPathExpr: QOMT +fullnameOverride: pN +image: + registry: 7iw15D + repository: RnJFs0 + tag: OQDirE +imagePullSecrets: +- name: ATcT6Hd +- name: l15Hhw +initContainers: + extraInitContainers: Me +livenessProbe: + exec: + command: + - AJd + - HZf + - YHivxIsAJ738b5Q + failureThreshold: -1921365096 + initialDelaySeconds: -1548958176 + periodSeconds: -1952555242 + successThreshold: -1289242499 + timeoutSeconds: -265051013 +nameOverride: MW +priorityClassName: KnLhcy2cw +replicaCount: 396 +secret: + create: true + login: + github: + clientSecret: R4Zj + personalAccessToken: N85av + jwtSecret: g + oidc: + clientSecret: enei1WIcV +tests: {} +-- case-006 -- +affinity: + podAffinity: {} + podAntiAffinity: {} +configmap: + create: true +console: {} +enterprise: {} +extraVolumeMounts: +- mountPath: 5uhd1qMX + mountPropagation: ȵS鈛ZQì暗 + name: "N" + readOnly: true + subPath: lbeciOZZ + subPathExpr: Pd88cwE +- mountPath: yVo + mountPropagation: ÑƇ[嫨ĸŁ幵鿯它(ȡ~嘶ƌO情=į臺 + name: Z + readOnly: true + subPath: Nrqx + subPathExpr: Q4ChfT +fullnameOverride: rzd +image: + registry: zT38Q + repository: V + tag: iSGm6MT1 +ingress: + className: XOZv8 + enabled: false + hosts: + - host: WGn + paths: + - path: NVV + pathType: 0DK + - host: "" +initContainers: + extraInitContainers: SCgmJTj +nameOverride: gCH15URsJZr +podAnnotations: + s2D: DMU7 +podLabels: + CoBI: 20aOZaZvs + e0xqmoOD: Nb5V + ylGQE: p +priorityClassName: 1x11c0q +replicaCount: 176 +resources: + requests: + PY: "0" +secret: + enterprise: + licenseSecretRef: + key: eF + name: fQ02KR + kafka: + awsMskIamSecretKey: 1tq + protobufGitBasicAuthPassword: G + saslPassword: K8kPgIp6 + schemaRegistryPassword: "" + schemaRegistryTlsCa: Zr + schemaRegistryTlsCert: KN + schemaRegistryTlsKey: t + tlsCa: CQ + tlsCert: 6xZ8 + tlsPassphrase: JpScAmVx6 +serviceAccount: + automountServiceAccountToken: false + create: true + name: nd7TSb2mNTS +tests: + enabled: false +-- case-007 -- +commonLabels: + cV05TKdtF: 55lItpeJD + h: 1Y7dqm4wZL +configmap: {} +console: + roleBindings: + - "": null + 5w1YcAu: null +extraEnv: +- name: qY0f + value: Wu +- name: 9zVp + value: g +extraEnvFrom: +- configMapRef: + name: OUS + optional: true + prefix: YWvtgT +- configMapRef: + name: 4xZZ + prefix: Djbp99U +extraVolumes: +- name: dCz +fullnameOverride: "y" +initContainers: + extraInitContainers: RiAu +livenessProbe: + exec: + command: + - 3Ujf + - EOmDk + failureThreshold: 1105213631 + grpc: + port: -199686432 + service: H + initialDelaySeconds: -1727299217 + periodSeconds: -579129147 + successThreshold: -1278687101 + terminationGracePeriodSeconds: 7570283898099180047 + timeoutSeconds: -603846855 +nameOverride: HWL +nodeSelector: + CAy: 19kW + R2z: OpcDywz9x +podSecurityContext: + fsGroupChangePolicy: 驸Ǩiµ慷泱世 + runAsGroup: 6873387834465682841 + runAsUser: 7937848737866681002 + sysctls: + - name: mp + value: SkIvFN + - name: E + value: RknyuPB + - name: kcY + value: us1 +priorityClassName: rs +readinessProbe: + failureThreshold: 114758306 + grpc: + port: 774513900 + service: GICRd2O + initialDelaySeconds: 457836757 + periodSeconds: -1914503008 + successThreshold: 1926018786 + timeoutSeconds: 458769630 +replicaCount: 103 +resources: + requests: + 4P1f3: "0" + DmuY: "0" +secret: + login: + google: + clientSecret: Ln0 + groupsServiceAccount: gp + jwtSecret: 2j6NF + okta: + clientSecret: 3A593BjCuu + directoryApiToken: mSSz8MZ + redpanda: + adminApi: + password: t + tlsCa: QD1x71f + tlsCert: 744Ysvi + tlsKey: 56VaHh +service: + nodePort: 238 + port: 286 + targetPort: 404 + type: Vvrvx +serviceAccount: + automountServiceAccountToken: false + name: RFjc7 +-- case-008 -- +annotations: + hfXF: v4uLEC6f8m +automountServiceAccountToken: false +console: {} +deployment: {} +fullnameOverride: GbgHqD +ingress: + className: XfqwM +livenessProbe: + failureThreshold: 1421249778 + initialDelaySeconds: 1194618095 + periodSeconds: 1245060237 + successThreshold: -641096828 + timeoutSeconds: -617099936 +nameOverride: RW +podAnnotations: + BTlN: z8t + a: Pqjhw +podSecurityContext: + fsGroupChangePolicy: ǶȚ/廻 + runAsGroup: 3241750191956122115 + runAsNonRoot: false + runAsUser: 2693812519144067821 + supplementalGroups: + - -7558357415363805139 + - -9152494874115651655 + - -906805565867492888 + sysctls: + - name: CBe8XsS + value: bh + - name: pUYyG9c + value: xPm1 +priorityClassName: 0fXQqWA96 +readinessProbe: + failureThreshold: -10750427 + httpGet: + host: yftc + path: 7MDOtCNf + port: -1919050774 + scheme: ȧ楢谚 + initialDelaySeconds: 208988771 + periodSeconds: -2096658971 + successThreshold: -233405863 + timeoutSeconds: 2042765580 +replicaCount: 475 +secret: + create: false + enterprise: + licenseSecretRef: + key: "" + name: vGB +securityContext: + procMount: ȃ蘗ʮǺ踰蒐佛桸gɋ + readOnlyRootFilesystem: false + runAsGroup: 5367218369967093267 +serviceAccount: + create: true + name: YcV5zP8 +strategy: + rollingUpdate: {} + type: 堯飉J侚桤 合w犌ŝ|#è:(蹝Ƀy輐 +topologySpreadConstraints: +- maxSkew: -722842418 + nodeTaintsPolicy: uã链掎ŏȅ噘籥邟澶N3-昃嗽(七|犘 + topologyKey: vq + whenUnsatisfiable: Ȭť'Ùt苷ŲĤ蘝 +- labelSelector: {} + maxSkew: 1436245353 + nodeAffinityPolicy: 0ʠƃ氁ʆZ + topologyKey: t + whenUnsatisfiable: x叾džʜƽ耨 +- labelSelector: {} + matchLabelKeys: + - 6T2 + - FqrwFd + maxSkew: -172720268 + nodeAffinityPolicy: 觏败TʙȎ喧5婬ȑªgȢ'!ÅWp襎 + nodeTaintsPolicy: ÛB¹]ʐ梳Ě + topologyKey: VyU9 + whenUnsatisfiable: 烹wɹȐN坿¨叻ʊ鴥/Ŭ屎釽C欼 +-- case-009 -- +affinity: + nodeAffinity: {} + podAffinity: {} + podAntiAffinity: {} +automountServiceAccountToken: true +configmap: + create: false +deployment: {} +fullnameOverride: l1Bnpx +imagePullSecrets: +- name: x42RbB4KLm +livenessProbe: + failureThreshold: -1420734522 + httpGet: + host: fFkzqM8 + path: aVVHbe + port: TkNE + scheme: ǂɷ烷Į~鼹ǵǃ楅ǰ + initialDelaySeconds: 753838163 + periodSeconds: -444344576 + successThreshold: -1003403229 + timeoutSeconds: -172453343 +nameOverride: BKV +nodeSelector: + OBRBvRK: hMXDLGN5 + ky: sv +podSecurityContext: + fsGroupChangePolicy: 灆Zeɪ霅ǭɒ<ǖ韆 + runAsGroup: -2394155475284911371 + runAsNonRoot: true + supplementalGroups: + - 802667379359895872 + - 8316082600801371691 +priorityClassName: p0ShP6Yru +readinessProbe: + failureThreshold: -286281002 + initialDelaySeconds: 138566964 + periodSeconds: -361700659 + successThreshold: 422528479 + terminationGracePeriodSeconds: 495828610939530481 + timeoutSeconds: 352721839 +replicaCount: 315 +secret: {} +secretMounts: +- defaultMode: 414 + name: yWBr98zs1 + path: xShE + secretName: YMpib3J +- defaultMode: 402 + name: qUQ5 + path: Wnbf + secretName: Pw8 +- defaultMode: 410 + name: hpqapQJQ + path: fgV + secretName: 1JLIOjZI8 +service: + annotations: + efgehQaV5UI0y: GymqDudh + nodePort: 75 + port: 229 + targetPort: 85 + type: yZy +topologySpreadConstraints: +- maxSkew: -73453467 + minDomains: 326628755 + nodeAffinityPolicy: "" + topologyKey: zWgGRC + whenUnsatisfiable: 黚堳ʈ¡ +-- case-010 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: hu5a9Q0m + operator: Ʊ飁Ɲŗʫf + values: + - fDVpOP + - fUBu2Zhz + matchFields: + - key: zOA + operator: 豔|Ĺ霱鑕yȮM錕陰蔆 + - key: uqlr1 + operator: ʏ + weight: -157546286 + - preference: + matchExpressions: + - key: yI2tB1c6Om + operator: 槼湝@)萢=\Ɇ剋Ś>(.aC俥?蔔 + values: + - 5QB3 + - C + - key: IhL2k3 + operator: "" + matchFields: + - key: Kn1 + operator: q'ʏC効L¶ƋMʐģƥƝnĤe + weight: -1818860211 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - {} + podAffinity: {} +configmap: + create: false +console: + roles: + - null +deployment: + create: true +enterprise: + licenseSecretRef: + key: 6Y + name: juyv +extraContainers: +- env: + - name: nE8 + value: hFfGzdv + valueFrom: + configMapKeyRef: + key: 9Sc + name: kviW + fieldRef: + fieldPath: bzL + resourceFieldRef: + containerName: ky9X6 + divisor: "0" + resource: RgwF + image: mEMnGhDi + imagePullPolicy: <Ǐ(嬘箓閁1_Y.脯鮉娇腾1 + name: ZyDivTyKOX + readinessProbe: + failureThreshold: 368214623 + initialDelaySeconds: 1711545214 + periodSeconds: -1669571514 + successThreshold: 830602444 + timeoutSeconds: -1406663042 + resources: + requests: + Ta: "0" + restartPolicy: M#L粓Ojw+ĸɊcƗ镃聆琮ǘ滂W + stdin: true + terminationMessagePath: 7hyobl + terminationMessagePolicy: gŜĶ蔓林驲%嶄ʚ轿竷 + volumeDevices: + - devicePath: zlgauG + name: Uy7Ds5N + - devicePath: pturCrgNMxS + name: "1" + volumeMounts: + - mountPath: 2ftw3U97pI + mountPropagation: ǮmW + name: NeLq9zvIQ + subPath: 5XYnpNAb + subPathExpr: rAeHuQk + - mountPath: aOj5TCBKn + name: DWFR + subPath: G + - mountPath: ovoJMYcQZ7 + mountPropagation: ɷ&娈瘱 + name: o6QaPD8 + subPath: rIo + subPathExpr: j0F1wa + workingDir: tj +- env: + - name: KO7zek + value: AE8r + valueFrom: {} + envFrom: + - prefix: T4nvtH0yCoJCx + - prefix: KaMGNcK + image: m + imagePullPolicy: 牀 + lifecycle: + preStop: + exec: {} + sleep: + seconds: -1229802121654850448 + livenessProbe: + failureThreshold: 1036399450 + grpc: + port: 1383801223 + service: nm0jd39Ta + httpGet: + host: VhafGy + path: CP9 + port: BnhNd + scheme: hxu崚奵Y + initialDelaySeconds: 141265356 + periodSeconds: 251484282 + successThreshold: 257415096 + terminationGracePeriodSeconds: 3476093234934519616 + timeoutSeconds: -1657896181 + name: UCZJ + ports: + - containerPort: 574867450 + hostPort: 156179933 + name: 0re + protocol: 頶韜»釟ţKFƂƄp錴畗~[禬B琡9 + - containerPort: -374880824 + hostPort: 1342282100 + name: OeyfSkg3EJIuD + protocol: 佃ŦŬ穷唂&2ŌĜ,gF躊貀j寝ô + readinessProbe: + failureThreshold: 978947885 + httpGet: + host: A + path: Ngfyt + port: "" + scheme: Í蠕窩獙 + initialDelaySeconds: 60101484 + periodSeconds: 1102760384 + successThreshold: 1260060937 + terminationGracePeriodSeconds: 1157546254675437089 + timeoutSeconds: -465800822 + resizePolicy: + - resourceName: P6b56 + restartPolicy: 冿÷Ý萦{[P貍ȕ,Sɕ錼 + - resourceName: azLsfqbuYlr + restartPolicy: 蒃Ký阹ǒ1T獽蛍峸伦ƨ(Ƭ-央á + - resourceName: skOpL + restartPolicy: 鸿dŶ徥w^ȏ嘳Ƙ唓Ęɸ-ɫ鷠C + resources: {} + terminationMessagePath: vmp + terminationMessagePolicy: Ƒh庛ʘ$8L藑奾ń4說 + workingDir: rgrA +extraVolumeMounts: +- mountPath: C3nMA + name: 0sxSVsP + readOnly: true + subPath: V + subPathExpr: 1E5cYdMw +fullnameOverride: ivK +image: + pullPolicy: "" + registry: 4A + repository: 0YeLdES + tag: 1a4iH +nameOverride: JFcK +priorityClassName: x0ISc2 +readinessProbe: + exec: {} + failureThreshold: 1992527736 + initialDelaySeconds: 1233698472 + periodSeconds: 1177961840 + successThreshold: -1634725396 + terminationGracePeriodSeconds: 236063688080704715 + timeoutSeconds: -1493252430 +replicaCount: 250 +secret: + create: false + enterprise: {} + kafka: + awsMskIamSecretKey: K + protobufGitBasicAuthPassword: HMiCm9 + saslPassword: dlWblwkM + schemaRegistryPassword: DQXNeX + schemaRegistryTlsCa: Xe1cT2AuIi + schemaRegistryTlsCert: gaHcYjD + schemaRegistryTlsKey: 96V + tlsCa: "" + tlsCert: WEDNhiC + tlsPassphrase: lP2w1T + login: + github: + clientSecret: vpO + personalAccessToken: pn05iLc53z + google: + clientSecret: OX + groupsServiceAccount: LB64mTpyF + jwtSecret: GQ0Yw + redpanda: {} +serviceAccount: + annotations: + TTsn5: s3xEhO + tZiUN: CtjX + create: true + name: kIzbDF +-- case-011 -- +affinity: + podAffinity: {} + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: {} + matchLabelKeys: + - E9nCu6aLM + topologyKey: PfPCGvStt + weight: -1379963896 + - podAffinityTerm: + namespaceSelector: {} + topologyKey: CgA4 + weight: -726546395 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: ijh1hJb + operator: ƏŧD續筚朊 + values: + - BOfF5xB + - 3iu4 + - key: "93" + operator: Dij%{欬ɽ + - key: NEd + operator: ÿD + values: + - r + - B7E1BoYQ4Njb + - BTV + matchLabelKeys: + - FuyLvc + - Lh60qi + namespaceSelector: + matchExpressions: + - key: w + operator: 嘑 + - key: eQ6nY99xw + operator: H辄萟蘎Ÿ塪²;暃 + - key: 8JrCFA + operator: "" + values: + - wVO + topologyKey: ByO + - namespaceSelector: {} + topologyKey: b21 + - namespaces: + - Ifv + topologyKey: F9j5 +annotations: + pJ: f0brcnhV +automountServiceAccountToken: true +autoscaling: + enabled: false + maxReplicas: 239 + minReplicas: 83 + targetCPUUtilizationPercentage: 68 + targetMemoryUtilizationPercentage: 468 +commonLabels: + JwK5MKTa: WW + v7E: 1g6JB +console: {} +deployment: {} +extraEnv: +- name: XW + value: PCPsJt + valueFrom: + configMapKeyRef: + key: Zk0vTu6kC + name: d9zm3 + optional: false + secretKeyRef: + key: mRF + name: CW + optional: false +- name: loir2K + value: Ti0q +- name: lAxIKF7cbLlc + value: 1ksS + valueFrom: + fieldRef: + apiVersion: 8i2Z + fieldPath: vD7H + resourceFieldRef: + containerName: yqY + divisor: "0" + resource: ebRDAl + secretKeyRef: + key: E9514U + name: g3Rbzs + optional: false +extraEnvFrom: +- configMapRef: + name: d + prefix: Fl1 + secretRef: + name: X8xDu + optional: true +- prefix: M + secretRef: + name: 10or1C2m + optional: false +- configMapRef: + name: BBj + optional: false + prefix: Xy + secretRef: + name: ZA3 +extraVolumeMounts: +- mountPath: O + mountPropagation: ŜQLhlkU穒´宕Ïůŝƪ + name: JeSPIB + readOnly: true + subPath: RTiJ + subPathExpr: wad +- mountPath: QV6Kf + name: Pj7R + subPath: qBOd + subPathExpr: kN3Uujt +fullnameOverride: hbe +image: + registry: gjR + repository: U + tag: Tl0EP +initContainers: + extraInitContainers: OgPf +livenessProbe: + failureThreshold: 653767212 + grpc: + port: -53435273 + service: fv5J + initialDelaySeconds: 832425522 + periodSeconds: -1810991482 + successThreshold: 1954581711 + terminationGracePeriodSeconds: 1550995604326825538 + timeoutSeconds: -574178850 +nameOverride: Cy9eHCiP +nodeSelector: + HC7: EI8 +podLabels: + "2": RgUAFm + D2V: V80aQ +podSecurityContext: + fsGroup: 4103142176308445041 + fsGroupChangePolicy: Ő6­撱悤ÅC`碸 + runAsUser: 9170579519391070953 + sysctls: + - name: 4OKA + value: P7ouRq + - name: iD9Oz + value: gL6ARE +priorityClassName: sJXoA3V +readinessProbe: + exec: {} + failureThreshold: 1745353710 + grpc: + port: -2051399147 + service: G + initialDelaySeconds: 1504484890 + periodSeconds: -846859037 + successThreshold: -1564014824 + terminationGracePeriodSeconds: 7625838354502176909 + timeoutSeconds: 888372342 +replicaCount: 65 +resources: + requests: + "Y": "0" +secretMounts: +- defaultMode: 12 + name: n4BPeF + path: 2Qy8k + secretName: auIr +service: + annotations: + "": NbuyvXjW + 2CTz: vRGLHMO53rD + yLzpKqz: uBjXvD + nodePort: 83 + port: 478 + targetPort: 90 + type: sl +-- case-012 -- +affinity: {} +annotations: + v: D +configmap: {} +console: {} +enterprise: + licenseSecretRef: + key: oG0N9s8 + name: fmqBE +extraContainers: +- command: + - "" + - 7yJE + envFrom: + - prefix: kRXk + secretRef: + name: TJsCapqoxl + - prefix: ucUEP + secretRef: + name: 1zCfpPiVt9o + optional: true + image: hwJ + imagePullPolicy: dh + name: Ody4zqt + readinessProbe: + exec: {} + failureThreshold: 1607990521 + grpc: + port: 2033135747 + service: "" + initialDelaySeconds: -889776869 + periodSeconds: -35190825 + successThreshold: -958310065 + terminationGracePeriodSeconds: 3166888730011246345 + timeoutSeconds: 806015074 + resources: + requests: + mg2KyOVo97: "0" + restartPolicy: 档媘řĖ焘傐Yʮ,+Ƽ梽讫ƭ焇 + securityContext: + readOnlyRootFilesystem: true + runAsGroup: -2035296945120192462 + stdinOnce: true + terminationMessagePolicy: '*.Q' + workingDir: 0g9 +- command: + - ktel2 + - 2gO + image: Kq1K2HexLL + imagePullPolicy: 蟫黳jª0狫ĝ| + lifecycle: + postStart: + exec: + command: + - I + name: XmcrosJ9Art + resizePolicy: + - resourceName: 8dOXgKMh + restartPolicy: T@罞 + resources: + limits: + Qf424: "0" + UkBWyCgR: "0" + yS9FH: "0" + securityContext: + allowPrivilegeEscalation: true + capabilities: + drop: + - Ǐ蟯ƛU賊稁uv/u讎胗< + - 1湹 + privileged: false + readOnlyRootFilesystem: false + runAsGroup: -281571585037868414 + runAsUser: 8469885005475493831 + stdin: true + stdinOnce: true + terminationMessagePath: 6ii28 + terminationMessagePolicy: ȊGī3慺Ŏ + volumeDevices: + - devicePath: "" + name: lqvpF + - devicePath: 3vTez + name: pD6EOo + workingDir: QEqnPlY6YE +- args: + - eiyTiCxBp + envFrom: + - configMapRef: + name: uxUzs + prefix: 0Oq + secretRef: + name: ahghhjB + - configMapRef: + name: yjx + prefix: cOCr6ajjpSTT + - configMapRef: + name: "4" + prefix: 0XtWv + secretRef: + name: oKDQ + image: PV + imagePullPolicy: d?遼gŜT纬ɷšǧ餝Ƨ + livenessProbe: + exec: {} + failureThreshold: 746140291 + grpc: + port: 1197495917 + service: "" + httpGet: + host: x78yAB + path: P5mSLs + port: Cb2 + scheme: 儰试9ȷǴ燀ǃ¦籇射,ǠöcƲ伙 + initialDelaySeconds: 1418617842 + periodSeconds: 187037501 + successThreshold: -1821323321 + timeoutSeconds: -894994792 + name: ToH + resizePolicy: + - resourceName: 7Ut8kM + restartPolicy: gěǏ* + - resourceName: gvoJz7 + restartPolicy: ł0Iɷ»u诎żȋ貏C炭 + - resourceName: VpTvtNnJOw + restartPolicy: 阠eR'k.Ơ糦啮ŋ睷N譺 + resources: + limits: + cYhO6a: "0" + startupProbe: + exec: {} + failureThreshold: -1040244189 + grpc: + port: 1921669257 + service: Me + httpGet: + host: 5fL4Z + path: BwLac + port: SKrb2z + scheme: ľ<Ƽ浳s剪ɍ + initialDelaySeconds: -1064995957 + periodSeconds: 230643461 + successThreshold: -1865926881 + timeoutSeconds: 1102271416 + terminationMessagePath: ZbnnI + terminationMessagePolicy: 阳壀ɀS强pŇȆDž鹩 + tty: true + volumeDevices: + - devicePath: pP2eHwth + name: S9Sy + workingDir: Z +extraEnvFrom: +- prefix: RyT9JuZ +fullnameOverride: tmn2Kt +initContainers: + extraInitContainers: SIhGa +livenessProbe: + failureThreshold: 666524470 + grpc: + port: 1398516128 + service: "" + httpGet: + host: bR1aDlNV + path: yDJgyD4 + port: PU8gXWTBf + scheme: 8BƔ7, + initialDelaySeconds: 1841184951 + periodSeconds: 465079780 + successThreshold: -1928046688 + terminationGracePeriodSeconds: -4709298711736612221 + timeoutSeconds: 1377323766 +nameOverride: Qr03ts +podLabels: + "": S7BNyT + r1F: Fsc + yeY4LjT: MRlwtd +priorityClassName: vMcB +replicaCount: 407 +resources: {} +securityContext: + allowPrivilegeEscalation: false + privileged: true + readOnlyRootFilesystem: false + runAsGroup: -6536894786619939509 + runAsNonRoot: false +strategy: + rollingUpdate: {} + type: 9Cɠ+餌µ骽O惠LƬɇɦ鉍挶 +tests: {} +-- case-013 -- +automountServiceAccountToken: true +enterprise: {} +extraContainers: +- env: + - name: bNyX + value: DpJ + valueFrom: + secretKeyRef: + key: r3ZL + name: GM2zRN8 + optional: false + - name: dS + value: u2CpI14PZ + - name: JVoNndPj + value: eCfRy + image: 9nkfM + imagePullPolicy: v洓p褾NJ翛Y/笸i洞偀fX綤鰐 + livenessProbe: + exec: + command: + - TzQ + - 5tBBhynsjV + failureThreshold: -1613952147 + httpGet: + host: gYV + path: 9qC2GovT + port: Gh + initialDelaySeconds: 1651935443 + periodSeconds: -1307313312 + successThreshold: 1553368137 + terminationGracePeriodSeconds: -4575724788805099082 + timeoutSeconds: -499895377 + name: aOBSLF + readinessProbe: + failureThreshold: 687754614 + initialDelaySeconds: -1880005074 + periodSeconds: 794268536 + successThreshold: -1510519942 + terminationGracePeriodSeconds: 3334702514671978014 + timeoutSeconds: -178867660 + resources: + requests: + hiWTQ: "0" + m7CDU: "0" + stdin: true + terminationMessagePath: Yj9V + terminationMessagePolicy: js$昦夁糎fț + tty: true + volumeMounts: + - mountPath: Xaoy + name: XuLXzMm + readOnly: true + subPath: NI8v + subPathExpr: nPRuyC + - mountPath: S + mountPropagation: ĜX鴮璫ȓĢ + name: c2o + readOnly: true + subPath: DEcziG + subPathExpr: 7UjF6H + workingDir: yPE +extraVolumeMounts: +- mountPath: DVlVa1jiDIh5G + name: zaV + subPath: lXnque8 + subPathExpr: aFzzfyzr +- mountPath: 7VmD + name: bNuYmK + readOnly: true + subPath: zsTvmtU0 + subPathExpr: uNyQSZ +- mountPath: p + name: q3 + readOnly: true + subPathExpr: k4yfc0H +fullnameOverride: RttlJN +initContainers: + extraInitContainers: Gnt +nameOverride: dDkIKgMwXv +priorityClassName: BDUfm1wSRDI +readinessProbe: + exec: {} + failureThreshold: -225696508 + initialDelaySeconds: 1573121125 + periodSeconds: -1561542711 + successThreshold: 1804677264 + terminationGracePeriodSeconds: 5224127779959308812 + timeoutSeconds: -1540252725 +replicaCount: 412 +resources: + limits: + f7Jr: "0" + fl: "0" + requests: + Q4O7nA: "0" +secret: + enterprise: {} + redpanda: {} +securityContext: + privileged: true + readOnlyRootFilesystem: false + runAsUser: -8804799239371185443 +tolerations: +- effect: ƞ嬂 + key: wnH + operator: Ā蔥ąʏƅȑǚ缗'r~熐{Ǎ楯&鑫咂] + value: LYZYjeFUmK29wdL +- effect: 硞撤幅娰tȬ婒ĎɕÏǜ蚭馸諄W)偒½ + key: e2 + operator: bƤrZ + value: 8ssobF8u +-- case-014 -- +autoscaling: + maxReplicas: 297 + minReplicas: 375 + targetCPUUtilizationPercentage: 161 + targetMemoryUtilizationPercentage: 154 +console: + roleBindings: + - null +deployment: + create: false +extraContainers: +- args: + - Z62Is + - Hbh02LW4 + env: + - name: YW1G + value: 0GWAuZSLomGzW + valueFrom: + configMapKeyRef: + key: G23Iugy + name: TkEMhJ + secretKeyRef: + key: BTU + name: g1 + optional: false + - name: uL + value: FFIE5os + valueFrom: + configMapKeyRef: + key: "Y" + name: auRMap + resourceFieldRef: + containerName: q0II1T + divisor: "0" + resource: HT + secretKeyRef: + key: dzuljE + name: G7WQLg + envFrom: + - prefix: gP + secretRef: + name: OVJe + optional: false + image: rJIHfr2OEa135 + imagePullPolicy: YÙ姯?斕_9xŠɏɉɬ脸埫窿 + name: AH0Q + ports: + - containerPort: 228562644 + hostIP: IoQ1 + hostPort: -1878543188 + name: Rfal + - containerPort: -894592742 + hostIP: WL1wuF + hostPort: -1156574467 + name: kaBC3xQ4W + protocol: ǀw黽Ɂ態y歳饏S鰚醭 + readinessProbe: + exec: + command: + - SSKDo + failureThreshold: 2133132404 + grpc: + port: 1749726411 + service: mXvc + httpGet: + host: pc5My + path: Xb4w6 + port: 478437545 + scheme: X甡蓸^qĠ屘g槛雍d伨ɾ + initialDelaySeconds: -966001365 + periodSeconds: 714178271 + successThreshold: -1714884162 + timeoutSeconds: 152300629 + resources: + limits: + QD: "0" + eQShuVrO: "0" + requests: + xWdhFr9: "0" + restartPolicy: 吥蓔ȫ唿瀘V輇f蓵犆Ȑ]œʢ鶍MƧ樤_ + startupProbe: + exec: {} + failureThreshold: 623319858 + grpc: + port: -1442127150 + service: C6 + initialDelaySeconds: 128345274 + periodSeconds: -1861677604 + successThreshold: 1112169900 + timeoutSeconds: 120934069 + stdin: true + stdinOnce: true + terminationMessagePath: CVFCc8 + terminationMessagePolicy: 欥ɻ斩隫0撊GƲ{ + tty: true + workingDir: IZB +- image: DOt5K + imagePullPolicy: Q燢Ƈʃǻĝ + lifecycle: + postStart: + sleep: + seconds: -2443463859616450892 + preStop: + exec: + command: + - 74I + - RU + sleep: + seconds: -3090258659267849140 + livenessProbe: + failureThreshold: -1269681865 + grpc: + port: -1568193429 + service: X1LyDnjv64JEDb + initialDelaySeconds: -1309179527 + periodSeconds: -1814451145 + successThreshold: -2073223886 + terminationGracePeriodSeconds: -7380892635099163371 + timeoutSeconds: 2123408205 + name: QbUkrjO + readinessProbe: + failureThreshold: -1858848657 + grpc: + port: 349774039 + service: jxJ + httpGet: + path: aAkRuN + port: AGGDH + scheme: Aʝ詷Cţm憻菁裰ś + initialDelaySeconds: -1986091889 + periodSeconds: -775693671 + successThreshold: 930243436 + terminationGracePeriodSeconds: -4158765076015214976 + timeoutSeconds: -1930165730 + resources: + limits: + QL: "0" + startupProbe: + failureThreshold: 79584809 + httpGet: + host: IYI + path: jpfp + port: h + scheme: ÎŲ媱5\æ}QQǤoƲ^8%嵕_踽 + initialDelaySeconds: 1384447753 + periodSeconds: 364207137 + successThreshold: 1778504178 + timeoutSeconds: 1437969450 + stdinOnce: true + terminationMessagePath: z + terminationMessagePolicy: ūJ + tty: true + workingDir: RQkvQON +fullnameOverride: htymHJ +image: + pullPolicy: 袪Ȓ緶Ð菝ȋ擮@Ŧ + registry: ulLeWQWUJdjnk + repository: J + tag: KQ +initContainers: + extraInitContainers: JvUWbM +nameOverride: Vi2vH +podAnnotations: + Tt: CHbO7BF +podSecurityContext: + fsGroupChangePolicy: A%Âȁµ郞星懐,t语Ā詘IJÊ铮Q + runAsUser: -4832235381641550418 +priorityClassName: rcxHoi +replicaCount: 424 +resources: + limits: + AS: "0" +service: + nodePort: 66 + port: 41 + targetPort: 168 + type: Oiwzbmtjpb +serviceAccount: + create: true + name: h6eHrUr +tests: {} +tolerations: +- effect: 鞼CÞŲɮȧɖņ魉**護Å岴hFʎ篅2 + key: ffSN + operator: 葓C巰qĩŹ脠~蒵 + value: fkh +- effect: ȯ绸 + key: meTpNZ + operator: ĥ恃精hw"蘄谇H潔ʎȴ豅©嫗笨 + value: uyTD +-- case-015 -- +affinity: + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 7eVqbmnw4 + operator: 屈ǧȔŗS#~¸Dd馔uÈ飏ƌĔ魼ȓ + values: + - eZapFDhb + - dBr2cD + - key: Z13Kq48NE0 + operator: ª + values: + - 03LE6GE + - key: s + operator: 箱+ʑ圼;0丢顃M媆熋熼妄瞬 + values: + - E + - jC2mNBN + matchLabels: + 4tdQRoO: Tgv + 7Apxz: EPl5 + bPvG5Bf: sCS + namespaceSelector: {} + namespaces: + - bkN0U + topologyKey: haPJ + weight: -1043017794 + - podAffinityTerm: + labelSelector: + matchLabels: + PP8DxAPJwUzY: z9RL6 + U1a: J + due4: eRc0tKn + namespaceSelector: + matchExpressions: + - key: "y" + operator: 霮ʡ`罵瀖Kʓa嚃*Q`UV邠想ɷġ + namespaces: + - M2GNeyD + - eDNVdz1ne46 + topologyKey: kQ + weight: -1134437930 + - podAffinityTerm: + namespaceSelector: + matchExpressions: + - key: SnD + operator: 6愔ȶ獧:öȰ浻珼»ǰs睑,s頀旓eX + - key: yt197hBb + operator: ȒǦ^(á咟獐赠5ĺĜ嶜庌愖V揺ɞ\Ș + values: + - pu5 + - Ywv1TEhK + - pAo + matchLabels: + "": rZ + topologyKey: WSD + weight: 613733383 + requiredDuringSchedulingIgnoredDuringExecution: + - topologyKey: 4b6nMCalUl1 +annotations: + 2V: 50l + jFB7K: 5ZqGXdsD94 +autoscaling: + maxReplicas: 483 + minReplicas: 178 + targetCPUUtilizationPercentage: 362 + targetMemoryUtilizationPercentage: 33 +commonLabels: + B0Pmybnj: gh8 + MdyMnFBP0Cd1: UUVRKbjhv + ShHkukRGF9k: KlIyX6upO +enterprise: + licenseSecretRef: + key: 5MWDqlE + name: UoZ4 +extraEnv: +- name: iQE + value: Aj6RWPJE +- name: QwMCc + value: N9g6bDNI +- name: U5Qg5Qc0NWE + valueFrom: + configMapKeyRef: + key: R + name: n8 + optional: false + fieldRef: + apiVersion: zg0 + fieldPath: fNjpqJ + secretKeyRef: + key: MlF + name: h +extraVolumeMounts: +- mountPath: y5BZm9v9L5 + name: mE9WF + readOnly: true + subPathExpr: 3vKqLj2 +fullnameOverride: 9RweMGWqBs +image: + pullPolicy: '&Ŕ<駄AG' + registry: FezgEM + repository: b4CZb + tag: OoX +ingress: + annotations: + "": ZKQ6I + ES: uo + className: x7Um + enabled: true + tls: + - secretName: Ye6 + - hosts: + - nNQW2NL + - g + - "N" + secretName: YQl +initContainers: + extraInitContainers: FZnnB +nameOverride: KD8DmV +nodeSelector: + vy4h: rk +podLabels: + FlwBgvWNMrbg5: YKgnz8q + TGDbR: 4egH + Xr8XMOk: 1DAii +podSecurityContext: + fsGroupChangePolicy: ¶鮬眴帘ʥb豚DIĂ + runAsGroup: 4190388773600423895 + supplementalGroups: + - 6652209348598506050 + - 5521245057591625878 + - 6754698685787706527 + sysctls: + - name: "7" + value: vp +priorityClassName: "68" +readinessProbe: + exec: {} + failureThreshold: 398655641 + httpGet: + host: NaspK + path: Bgdl + port: 1587383135 + scheme: ǰ|鬩E橴s + initialDelaySeconds: 1516319657 + periodSeconds: -635156272 + successThreshold: 1338596793 + terminationGracePeriodSeconds: 6302545905526400855 + timeoutSeconds: -905426079 +replicaCount: 128 +resources: + requests: + I: "0" + b7jbi: "0" + r1cN: "0" +securityContext: + privileged: false + procMount: d聉l蝲ɓH>狱(Ȁ胄hʍy龝Ȼ埓Y + readOnlyRootFilesystem: false + runAsGroup: 2951274493718237098 + runAsUser: -1772317555576666168 +serviceAccount: + annotations: + IH: 3W + K5hNNf: "" + r: 9cmm + automountServiceAccountToken: true + name: zmr +tests: {} +tolerations: +- effect: '#U媷ɑɥ±箑妌RɱfÈB矅蒟(' + key: g + operator: Řg~歟1ƹ,纙蝝垺 + tolerationSeconds: -9038490283678033542 + value: x6T1NM +- effect: ė{ɼ 5;^ʤàOKv泣0ƫ¢ + key: wdW6LI1a5 + operator: ú4ʫ-哖ýȻȣŦiĩġ膳". + tolerationSeconds: -5247520709138794849 + value: NXt +topologySpreadConstraints: +- labelSelector: + matchExpressions: + - key: dme + operator: )\鹮İ又Ȥ鏥Ĝ + matchLabels: + Cdk: atEBel + PhEVPxOjN: QTW4 + fC0YTiwm: fdAQN8t + maxSkew: 472867304 + minDomains: 1802867157 + nodeAffinityPolicy: ʈǔ聿ŶŹ&y鰜# + nodeTaintsPolicy: '"篍Ɛɰl鄱' + topologyKey: fqmSu + whenUnsatisfiable: äƟĻ鍣ųø啼ǫǷ" +- labelSelector: + matchExpressions: + - key: BEj + operator: Ɠ墳 + values: + - qBJ + - KZbk + - key: 9wxm2wFXlY + operator: ì蠁{\媽;ě8ɠ + values: + - yiuVv9DzzRse + - "N" + - z + - key: SWu + operator: Ī½曖1șWb3 + maxSkew: 774109577 + minDomains: -110979462 + nodeAffinityPolicy: 醿卨¬婾豜ʦKd` + topologyKey: 4iskW3Hbv + whenUnsatisfiable: ǮXƞ棤Ǘ +-- case-016 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: 2Ldss9 + operator: ?霏ƦxǰA7ȇ(堃R + values: + - Ce7pGgB5o + - B8EWZ + - key: pJKw3VVY5 + operator: 2wq6JK?Ȏ惙徵r儊ǒ嵀匫W + matchFields: + - key: EQvFQjoLm1 + operator: «/o咑澇ƉɑȨŞƙ|5時 + weight: -508343495 + - preference: + matchExpressions: + - key: VRoHsoMNa + operator: cƄábŊɕg追ĦǙȿ男)hŬ + values: + - tcCIpd9m + - FsoFrK + - key: ReH4ocoZ + operator: "" + values: + - bnUyPckbz + - AE + - njW + - key: fZBGR + operator: 租ǜ藇錼 + weight: -1003115262 + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + namespaceSelector: + matchLabels: + qGlBCw: zUBwqj2xV + zlHLG: TDTkLQOC + namespaces: + - QWFH + - TEzgQKPSQ + topologyKey: "" + weight: 682123393 + - podAffinityTerm: + labelSelector: {} + matchLabelKeys: + - 1MiHrQ + namespaceSelector: + matchExpressions: + - key: JUYumiiJFrY + operator: .ƽCDZo& + values: + - t3wDXa + - 70HCTbI6g + - C + - key: ik + operator: Œ8v + values: + - Wp + - Zf + - c2q7e + topologyKey: Sc1Q + weight: 869908297 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: ore + operator: ?ɴ$瀜蝪ĪźȀŐƌS莣幮屒n×U锇Ľ + values: + - mJM + - oc + - aU + - key: SQmv + operator: ȥī+ūĬ诧犂¹ + - key: Hh1r9 + operator: h蓟x蹵D¨谧罬 + matchLabelKeys: + - mDk + - Hki8 + topologyKey: x2q0Rx1f1N + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + namespaceSelector: + matchExpressions: + - key: H1Ni + operator: Ȧ厜OŊ + values: + - UWzAFu2 + - key: M + operator: 罐hĹ;'ǫ貉yĊ啉刉DzQį + - key: zZ + operator: 颉śĴJ|@W補A篐S献;ɾ[_鶙ȱ + values: + - 4BL + namespaces: + - Thgfgf7Z + topologyKey: XBju19e + weight: 1392601493 +automountServiceAccountToken: false +console: + roleBindings: + - Q0kslM: null + - null +deployment: {} +extraContainers: +- command: + - opIk + - v9eJ + - 4V + env: + - name: 5Q + value: o + envFrom: + - prefix: eBWmLK + secretRef: + name: FedJi + optional: false + - configMapRef: + name: M + optional: false + prefix: vUvV7W8k0 + secretRef: + name: IA + image: T4SYV + imagePullPolicy: Ƈ祃ǗǤɈ遖竀壙/ + livenessProbe: + failureThreshold: 20929095 + grpc: + port: -1775507003 + service: UZ6BT7NDI + httpGet: + host: QFkZxI6kA + path: tzQ + port: "" + scheme: Ƞ揞á惗É莏6XȪ/ʡ忨償 + initialDelaySeconds: 1046895310 + periodSeconds: -1971173139 + successThreshold: -476756841 + terminationGracePeriodSeconds: 144861231583008737 + timeoutSeconds: 814968592 + name: gEB + ports: + - containerPort: 2060914354 + hostIP: 9IXWKx38q5 + hostPort: -1191426039 + name: 5Mw7k + protocol: 悛ķ鳉ɍ恽j頔Œ6Eʮnx + resources: {} + restartPolicy: 樦ýȃ梪ĵ + stdin: true + stdinOnce: true + terminationMessagePath: c0e +fullnameOverride: 6maz +image: + registry: PYDGV + repository: HV3 + tag: cI8TzaYkws +ingress: + className: JpoCC + hosts: + - host: mE + paths: + - path: znvL + pathType: u4c1 +livenessProbe: + exec: + command: + - 1aqSw0 + - A277oB + failureThreshold: 713465020 + grpc: + port: 1803086428 + service: h1wwv + initialDelaySeconds: 1849009003 + periodSeconds: 2079209425 + successThreshold: 1679782943 + terminationGracePeriodSeconds: 4331994492414219168 + timeoutSeconds: 2000039211 +nameOverride: SC +podAnnotations: + JYLUc483y: gTnWiG +podSecurityContext: + fsGroup: -1425599568169885252 + fsGroupChangePolicy: ƶ Ÿ恢 + runAsGroup: -8737472966684836915 + supplementalGroups: + - 809809813702093180 + - 6124706841582844730 + - 6159358527003037747 +priorityClassName: XtKq +replicaCount: 331 +securityContext: + allowPrivilegeEscalation: false + procMount: 垮Ř2 + readOnlyRootFilesystem: true + runAsGroup: 5797501600954334245 + runAsUser: -8444673787636983397 +serviceAccount: + automountServiceAccountToken: true + name: DdF7ALq +strategy: + rollingUpdate: {} + type: ŀ剭º(;ƍ4兖ȇ +tests: {} +topologySpreadConstraints: +- labelSelector: {} + maxSkew: 972537130 + minDomains: -499606767 + topologyKey: q5 + whenUnsatisfiable: 鳯°ôŕƨʪuɘ"h貇榧0?cɉjA蜝 +- labelSelector: + matchExpressions: + - key: lAV + operator: 嵖xߟ擱ʄ衯"xɂ + - key: U6 + operator: =换J+Ř:嫚ʥ畠餐ǒŃ + values: + - Vj + - snF6cyZ + - 0sW9y4T5 + matchLabelKeys: + - 2wCjBs + maxSkew: -324080521 + minDomains: 695322418 + nodeAffinityPolicy: ʖ[兘Ũ鬎盦İƲ + topologyKey: z5y4Q8jyHH + whenUnsatisfiable: =Y~É.J樢ȃŤƫ甶Ȍ* +- labelSelector: {} + maxSkew: -1720129802 + minDomains: 1017048856 + nodeTaintsPolicy: 龨9猶e僦ɻ髧Ȍc + topologyKey: qKf6Ef3o + whenUnsatisfiable: ʂ?$鳴寘ŧ6脹餗ſ媷,峇埽 +-- case-017 -- +annotations: + J5Z: aLYd149 + LCqYvOjK: Qsk + bU: "" +automountServiceAccountToken: false +autoscaling: + enabled: false + maxReplicas: 164 + minReplicas: 101 + targetCPUUtilizationPercentage: 355 + targetMemoryUtilizationPercentage: 310 +console: + roles: + - JlwOk: null + QUzHpm: null + ch3WnNF: null + - {} + - null +extraContainers: +- args: + - Bd + command: + - QwtEp + - lLi7 + - kxB1 + image: RpMWaJ + imagePullPolicy: ~崆Ǭe侊k + livenessProbe: + exec: {} + failureThreshold: -2101638962 + grpc: + port: -208999597 + service: jICxjA + initialDelaySeconds: 925230214 + periodSeconds: -996383814 + successThreshold: 152844544 + terminationGracePeriodSeconds: -7802949917649733275 + timeoutSeconds: -188255799 + name: qwOkQZ + ports: + - containerPort: -255758148 + hostIP: R + hostPort: 316791912 + name: 09i3b5oQR + protocol: 腴醗9-鐶 + - containerPort: 247145105 + hostIP: L4 + hostPort: 1727912240 + name: bz7Y1N7 + protocol: 暄璎 + readinessProbe: + exec: + command: + - 2fQQ + failureThreshold: -873648342 + grpc: + port: 889903834 + service: C3 + httpGet: + host: IPHal + path: 5Nb6iW9 + port: tkqo + scheme: m说Ď盐2Ƹ,约h鰥Ȕť3 + initialDelaySeconds: 1391319902 + periodSeconds: -1638942635 + successThreshold: 644454270 + timeoutSeconds: -553602240 + resources: + requests: + 0XxId: "0" + VsY2R9: "0" + ZLtS2: "0" + restartPolicy: ų蓶Lj,g珯i'Sû竒 + terminationMessagePath: Mx7V + terminationMessagePolicy: =Jƈ乚貃庪ș¯ÑVȯ6筌巨华ɀ(v + tty: true + workingDir: nKFDPLJvOh +- args: + - AV3kjV + - Gwq78lY2 + - wq + command: + - D + - EI + - fY5J + env: + - name: eCtpNU + value: jLkcq8S + - name: rynLbx + value: CdqgJabHhM + valueFrom: + configMapKeyRef: + key: uBUH5 + name: Uxei4G1 + optional: false + fieldRef: + apiVersion: Ul9al + fieldPath: vtGid + resourceFieldRef: + containerName: Oc + divisor: "0" + resource: "" + - name: GmDNpa0 + value: 7VJM2XsPm8N + valueFrom: + configMapKeyRef: + key: x3J0PMWE + resourceFieldRef: + containerName: x9Q + divisor: "0" + resource: EKFgoq + secretKeyRef: + key: lOZRvK9 + name: V + image: 1xn6 + imagePullPolicy: ɀ稤¼Mɻ«鐾6Ú{ŬtŮ鄖SSɌ戲 + lifecycle: + postStart: + exec: {} + httpGet: + host: sT2dWyT + path: vvbIxNVANZ + port: aCK8 + scheme: 昿孊卿昤軒JYƜÁ嶠şe灶 + sleep: + seconds: -3542823673709563150 + preStop: + exec: + command: + - "N" + - qkHmJ + - HupYy + httpGet: + host: 137dx + path: y3u7HE + port: -1357399425 + scheme: '@济ɉ鳛讧跕(#7NJɓũǸ]ɨ梊sj' + sleep: + seconds: -2408406850575106311 + name: J6VFtJd3giFt + resources: + requests: + 3dqK0M: "0" + restartPolicy: 70ʆ氶応爱怙鉉塼tƗhY嚇 + securityContext: + allowPrivilegeEscalation: false + capabilities: {} + privileged: false + procMount: ȚƼ提瀴t8oƥc + startupProbe: + exec: {} + failureThreshold: 1782005431 + grpc: + port: 676289916 + service: 3xqeCsf + httpGet: + host: YDL1TP + path: "8" + port: lLWR + scheme: BKō筹 + initialDelaySeconds: 134613881 + periodSeconds: 1547524591 + successThreshold: 1778605907 + terminationGracePeriodSeconds: -7593859121613942317 + timeoutSeconds: 2026260743 + terminationMessagePath: E + terminationMessagePolicy: 碓 + workingDir: kl +- command: + - "" + env: + - name: TG1HQA + value: 5X + valueFrom: + fieldRef: + apiVersion: Vhn + fieldPath: jluMkQnv9 + resourceFieldRef: + containerName: rLfbH + divisor: "0" + resource: "" + - name: "" + value: TOTyqqGn + valueFrom: + fieldRef: + apiVersion: 0CAdSa + fieldPath: LWMRC + resourceFieldRef: + divisor: "0" + resource: G5eZP4R + secretKeyRef: + key: xYOgJL + name: vMTywG + image: 2Z + imagePullPolicy: z.鎸ƦʖFNj棪Ƃ鯌b抵#Dzr + lifecycle: + postStart: + exec: {} + httpGet: + host: k8z + path: TxNa2e + port: -573570086 + scheme: oɌdǹ[M灙螮伪芛探塢庖Njȕ仸 + sleep: + seconds: 4118046687980193779 + preStop: + exec: + command: + - 6iZbF + - OeZTW + httpGet: + host: rbqq + path: sno + port: -429531729 + scheme: s璙Ȼȗ榛ǵ0ƿ.忋闳溨 + name: Cms + ports: + - containerPort: -211101225 + hostIP: 8v + hostPort: 1994344080 + name: kyMvksZa + protocol: fȞ蚊悘ū錩Ȩ龒ċŴ + - containerPort: -806313867 + hostIP: Ky2F2 + hostPort: 1605736520 + name: oe0nMMl + protocol: 慿)"Ǒ3浹襈}(VE-B³閪叒k1绝 + readinessProbe: + exec: {} + failureThreshold: 1398486074 + grpc: + port: 1157090744 + service: oFrTS0 + httpGet: + host: 5pfrE + port: TJb4 + scheme: 畢î + initialDelaySeconds: -1830121652 + periodSeconds: -1398007905 + successThreshold: 1183454316 + timeoutSeconds: 1797763090 + resizePolicy: + - resourceName: hzxTj + restartPolicy: 渣箢樳掯ȉÏǼ店喘©g + resources: + limits: + zGvF9poISMtK: "0" + requests: + lUp3T: "0" + restartPolicy: '}賩6''V霟足''È''*F÷ƙǕ' + stdin: true + terminationMessagePath: 4tn + terminationMessagePolicy: ɢ荵鯴庡ǁ婛埽猜犝笖á7譃ǁ¦GɖC + volumeDevices: + - devicePath: eGfD9B + name: G3Bd + - devicePath: x + name: TB + workingDir: iKksE1 +extraEnv: +- name: Z + value: 1PasJFATvz + valueFrom: + configMapKeyRef: + key: Out + name: Z +- name: pUN + value: QTGN + valueFrom: + configMapKeyRef: + key: BLzs5FKV + name: xsgY3vBvZ + optional: true + fieldRef: + apiVersion: 5Ng + fieldPath: Psowh + resourceFieldRef: + containerName: pMz + divisor: "0" + resource: "" + secretKeyRef: + key: IY9s0 + optional: false +extraEnvFrom: +- prefix: oK16T1 +- configMapRef: + name: GxM9 + optional: false + prefix: Hj8 + secretRef: + name: o5P67 +fullnameOverride: 9XG3SZW +image: + pullPolicy: k痿蹒 + registry: 3s + repository: kPWhaC + tag: BcBi +ingress: + className: N91gS + hosts: + - host: ucSBH + - host: "" + - host: tmOhOR +nameOverride: tPiY +podLabels: + LBQpbD: AHB4hNVL + ey1GpAHh: fA +priorityClassName: qcIlT +readinessProbe: + exec: {} + failureThreshold: 738983906 + grpc: + port: 832752600 + service: 3tLbx + initialDelaySeconds: -1729478206 + periodSeconds: 902558671 + successThreshold: 989047880 + timeoutSeconds: -402268186 +replicaCount: 173 +resources: + limits: + 0fvc8: "0" + W19cC: "0" + loZ4: "0" +secret: + create: true + enterprise: + licenseSecretRef: + key: cjqTR + name: e + login: + github: + clientSecret: jw6tY22 + personalAccessToken: JvG1jx + jwtSecret: DwgaGI + oidc: + clientSecret: MalR2 + okta: + clientSecret: mDILgPMjOS9 + directoryApiToken: M2ywAiP +secretMounts: +- defaultMode: 442 + name: 3SwG7HrS + path: TLaWLIiD + secretName: VR +- defaultMode: 383 + name: Bfv9SGjlbgN + path: dXXPfK + secretName: T +- defaultMode: 13 + name: wz4K9oIYM + path: YEOA49 + secretName: WzM +securityContext: + capabilities: + add: + - "" + - 鸼ǀɛ_Y + - 利ƯǢ謼Ŀʇ佔4銣 + privileged: false + procMount: 頿ū詁ǎTɁ¯PlFd只鶗ƝǛƤ臃 + readOnlyRootFilesystem: true + runAsNonRoot: true +tests: + enabled: false +tolerations: +- effect: 懻 + key: JifsKW + operator: 檧űÊǮȡ廄儱RəȏĮ顪ÅÞ + tolerationSeconds: 4501363800484543116 + value: KkCBzwToBMjJ +- effect: B囧ƉOß + key: Q3cj + operator: ɲ朁ß栢 + tolerationSeconds: 4944598504260379086 + value: Z5 +- effect: 敘愰ɰuƪ晐 + key: K8wM + operator: ș + tolerationSeconds: 8375376960471889043 + value: TnWS +-- case-018 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: {} + weight: -37659402 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: [] + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + matchLabelKeys: + - ajbCE + - Y0MRgpE8 + namespaceSelector: + matchExpressions: + - key: Auai + operator: ùfƽÜQķɨ逑ʒÅģ + values: + - Q + - key: 1S2Nfq + operator: 臺瑷tƎ鍤p}滳`竦ÙǾ晖ǃʏȵ + namespaces: + - 4GTSAZF + topologyKey: NS733 + weight: -968286112 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: eyt3TPSYPBWDt + operator: e偁&蔄癳.ŚƘ + matchLabelKeys: + - eE7PA8D + - cKalkvb + mismatchLabelKeys: + - Lan + topologyKey: v + weight: -2133598054 + - podAffinityTerm: + mismatchLabelKeys: + - "5" + namespaceSelector: + matchExpressions: + - key: UrrD + operator: ƞ + - key: rkfCsnUcx + operator: ȇ睾¦棌鉝-m糤LPjX.;Ğ× + - key: kla + operator: '"竮壣祠ł9抵墙' + namespaces: + - gyF + topologyKey: ZG + weight: -428742233 + requiredDuringSchedulingIgnoredDuringExecution: + - matchLabelKeys: + - tZZj + namespaces: + - VuG + - I5XU + topologyKey: V2CZqa + - labelSelector: {} + mismatchLabelKeys: + - "" + - q9L4 + - C4YJ57 + namespaces: + - 8xRk06ngy + - WeZO2 + - 7tbTFK + topologyKey: rnpto +annotations: + "": 3E5rtKA +automountServiceAccountToken: false +autoscaling: + maxReplicas: 140 + minReplicas: 91 + targetCPUUtilizationPercentage: 499 + targetMemoryUtilizationPercentage: 324 +configmap: + create: false +console: + roleBindings: + - "": null + DlOD: null + - null + - cDJiV: null + eO: null + qlokva4: null + roles: + - 0E2l1K3: null + pIu5qwn: null +enterprise: + licenseSecretRef: + key: oqyc + name: HL +extraContainers: +- envFrom: + - prefix: EVZ + secretRef: + name: MxD + optional: true + - configMapRef: + name: A + optional: false + prefix: HuqxI + secretRef: + name: A + optional: true + image: SU + imagePullPolicy: 禵7璙p + lifecycle: + postStart: + httpGet: + host: YZMjhOUO8IS + path: nzYfH + port: Fcx + scheme: 矪Q9 + sleep: + seconds: 3463625415546708077 + livenessProbe: + failureThreshold: -560403806 + grpc: + port: 1751268094 + service: I + httpGet: + host: 0Sb + path: Utm2X + port: 395973041 + scheme: 醆蚎忨ŕ縨ƍ爋釬šÒ暺ƒŎO記岣 + initialDelaySeconds: -1011110535 + periodSeconds: -1229381750 + successThreshold: 260149510 + timeoutSeconds: 74546945 + name: e + resizePolicy: + - resourceName: XNKV + restartPolicy: ì焹.¬哄ȾŢȎȴe$p尶m`飻Ȭ + - resourceName: "" + restartPolicy: 閭I哗.寢荨ʪɛ侭ȵ(8 + resources: + requests: + 3nUsL: "0" + securityContext: + allowPrivilegeEscalation: false + privileged: false + readOnlyRootFilesystem: false + runAsGroup: -8616852535795885155 + terminationMessagePath: FjZ + terminationMessagePolicy: ÿb熿3,ćp寫ʃ#叺渍ƣș + volumeDevices: + - devicePath: Xvjm + name: 7yLA + - devicePath: 1Ci + name: Y0AloAQS + - devicePath: Gt + name: ZMKKc + workingDir: Mh +extraEnvFrom: +- prefix: hg + secretRef: + name: eLM59WyoAXO +fullnameOverride: ExFU3 +image: + pullPolicy: 螣暛擂ɾ#鏲*胭8饭1胠 + registry: iCFSIwyDtoG + repository: 6V6 + tag: 6uR +imagePullSecrets: +- name: vlnGQbo3y +nameOverride: 1qyLP36T +nodeSelector: + Vckw: ifBZ9p7 +priorityClassName: 6jxv +replicaCount: 297 +resources: + limits: + QZqMxIAt: "0" + SUsu9: "0" + requests: + EMOXCuje: "0" + EzKKMIR: "0" +secret: + kafka: + awsMskIamSecretKey: 8GlUc + protobufGitBasicAuthPassword: IsvQ9 + saslPassword: Vb + schemaRegistryPassword: UJ7Zl + schemaRegistryTlsCa: T1Q + schemaRegistryTlsCert: 17r + schemaRegistryTlsKey: O44 + tlsCa: n8k9 + tlsCert: aK + tlsPassphrase: Qk8 + login: + github: + clientSecret: t6z0n + personalAccessToken: "" + google: + clientSecret: h + groupsServiceAccount: fpuCEFLL + jwtSecret: 7J + oidc: + clientSecret: t + okta: + clientSecret: 3CcKl + directoryApiToken: AZt8H77 + redpanda: + adminApi: + password: NUkb3zIpwAR + tlsCa: t + tlsCert: zttTAvj + tlsKey: "" +service: + nodePort: 270 + port: 415 + targetPort: 489 + type: 2cM +serviceAccount: + annotations: + X7E: CRSzr + lPi: bGP + name: uAvlOXf +strategy: + rollingUpdate: {} + type: ɬ搢.Ƒ躂ɻɅȄ莨qc婔Åå +tolerations: +- effect: č喅Ȳ崥ï{禙ÊÿC逻準?霘2 + key: YJE + operator: 珟 + tolerationSeconds: 3838637075734495592 + value: 1VemeDTEk1 +- effect: 艋Ƿ淛襀|Ǽ&矠Ģ凍J賜ɰō + key: ggxS8L + operator: 閞判ŏ + tolerationSeconds: -2249155605077506227 + value: m3c +- effect: 'Ljə]IŴ:' + key: 4BkJSo + value: Le +topologySpreadConstraints: +- matchLabelKeys: + - uyTA + - rJcqdY3 + maxSkew: 1887613958 + nodeAffinityPolicy: u鞝侠轁蛃6Ơfrt迄ʇQ勭ĶÇǻě + topologyKey: 3f9j + whenUnsatisfiable: µ +-- case-019 -- +annotations: + lgiIA: u + wK8: JrSfKH +automountServiceAccountToken: true +configmap: + create: true +console: {} +enterprise: + licenseSecretRef: + key: Nr8uSKR + name: nucerZE +extraEnv: +- name: pJ + value: whmTukCTD + valueFrom: + configMapKeyRef: + key: OHk + name: "3" + fieldRef: + apiVersion: TSp7 + fieldPath: mEUVMSp7vUo + resourceFieldRef: + containerName: bBDw + divisor: "0" + resource: tIcs3z + secretKeyRef: + key: jIR5V + name: "9" +- name: ZCEPmHP + value: FhwE4R + valueFrom: + fieldRef: + apiVersion: Nv + fieldPath: WMXeIjk + resourceFieldRef: + containerName: Hbt + divisor: "0" + resource: mo7F +extraVolumeMounts: +- mountPath: UF6 + mountPropagation: ĻsŸ氂ǐ钋鮠Ĺ咳渼.pɫ + name: W1LIZa3 + subPath: qdDtjk + subPathExpr: Ew +fullnameOverride: NZ7h9 +image: + pullPolicy: 韃ĝ + registry: GNXgFQ + repository: W3 + tag: 2vPed +initContainers: + extraInitContainers: "" +livenessProbe: + exec: + command: + - Vc01z + failureThreshold: -1736131786 + initialDelaySeconds: 538755540 + periodSeconds: -937262167 + successThreshold: 2014961170 + timeoutSeconds: -614674118 +nameOverride: 8MIg +priorityClassName: FERw +readinessProbe: + exec: + command: + - 96w + failureThreshold: -1936056692 + grpc: + port: 939760843 + service: "" + httpGet: + host: K + path: dIrFM + port: GfrdWiqgUZBPW + scheme: 芧ʒȔ堌 + initialDelaySeconds: -2019126091 + periodSeconds: -1696700553 + successThreshold: 398361977 + timeoutSeconds: -184667912 +replicaCount: 79 +securityContext: + allowPrivilegeEscalation: true + capabilities: + drop: + - 狞濮噞饅烥H}湛m=U+卓Ǭï呣8Ú + privileged: true + runAsUser: -471077223001866506 +strategy: + type: 鎦v財ɕŪ +tests: {} +tolerations: +- effect: 飝壊%ǂP胅ɂǏ趸疷擁鹒DŽ营風顺z拇 + key: Ku2m + operator: ŲǪFTǗǔȟʥȰȎǎo玼Ü + value: 1u +- effect: 雾Ź歘ɇƇ昨OČƑɎ騨Ŗ=Ì楯 + key: 12vKa + operator: ( + value: u +-- case-020 -- +affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - {} + - matchExpressions: + - key: a23jbG + operator: yb庇ɍ闒ǰPâƟVsJu + values: + - "" + - 1lQmmGa8 + - XzVleDXV4YoRc + - key: 3Gwd9r + operator: 4Nj7Ġ$Ea狆Ö絞Ƙ殈廔as知 + - key: 7C4FjM + operator: ɩ.叧¬ʧ倒 + matchFields: + - key: H + operator: Ğų* + values: + - 0i + - qK + - key: 7ocDt + operator: 餯ǚ璗汭槰<ƤƐ評ź膹棅珢ȹ3鮑 + values: + - g5Aa1Hm + - LKNvXrtO + - key: o + operator: ŎJ甧鷓 + values: + - vJQQjLRrqIK + - Isj + - 6EBsy + - matchFields: + - key: H0oh1dBCg + operator: 鉔qƿ氵[' + initialDelaySeconds: 1994767434 + periodSeconds: 1832245274 + successThreshold: 598112607 + timeoutSeconds: 1119900418 + name: "" + ports: + - containerPort: -330026000 + hostIP: lrMGYnI5Nd + hostPort: -823142941 + name: zuZWb + protocol: Ȳ + resources: + requests: + 4gK: "0" + restartPolicy: 腼癋ğÑ;漘傩鶷 + securityContext: + privileged: true + procMount: ʍ/O9*:zb飯Gɱ朵醴#ŌKp9嬡 + readOnlyRootFilesystem: true + runAsNonRoot: false + startupProbe: + exec: + command: + - "4" + failureThreshold: -950017148 + grpc: + port: -1475121627 + service: 8veUJnWU5 + initialDelaySeconds: 2007069941 + periodSeconds: -1193308189 + successThreshold: 22288729 + timeoutSeconds: -1492112511 + stdin: true + terminationMessagePath: HIj0kQ + terminationMessagePolicy: ȔNj + volumeDevices: + - devicePath: M + name: sDeN + workingDir: V +- args: + - "" + - ihLoishU + command: + - 8Jx + - j + env: + - name: IDOQ6d + value: 12G + image: b4Wv84l + imagePullPolicy: n暨e懔)k + lifecycle: + postStart: + exec: {} + httpGet: + host: Zl2z + path: pzUIO + port: faRx + scheme: 痣甘 + sleep: + seconds: -632399399483384435 + preStop: + exec: {} + httpGet: + host: pklCf2clqD + path: wk27n2gw1L + port: Ufz19 + scheme: ɷņƑG m刡Ęj敂鏸eāa + livenessProbe: + exec: + command: + - Ar2msVeG + - Uzq6cRL + - dujaQs + failureThreshold: -1776611485 + grpc: + port: 835455646 + service: t + httpGet: + host: hri + path: "Y" + port: 1115673796 + scheme: ʟɏķLYÆŨŔ+Č`4Đl + initialDelaySeconds: -739643640 + periodSeconds: -343509466 + successThreshold: -1698086578 + terminationGracePeriodSeconds: 1800922741783400611 + timeoutSeconds: 1182031959 + name: Bq5FHOsB11r + readinessProbe: + exec: + command: + - XaJ8ft + - 57jh + - sAD + failureThreshold: -1798651306 + grpc: + port: -1714447694 + service: ETY + httpGet: + host: V5DSH + path: g8Ygrn + port: Yp9d22 + initialDelaySeconds: 1612392972 + periodSeconds: 1418157100 + successThreshold: -1106593780 + timeoutSeconds: -1970400805 + resizePolicy: + - resourceName: 93At9v + restartPolicy: 涭ɍƍ蕂 + resources: + limits: + 9g69: "0" + h20A4o: "0" + jh: "0" + requests: + h: "0" + ub364wL: "0" + restartPolicy: Ǎ\ƽţ(鄑鴋Őńy餲ÍwWÅ + startupProbe: + failureThreshold: -513807271 + grpc: + port: -788679788 + service: 3vt1qVexq + httpGet: + host: As + path: gG3Jyf6fQ5R + port: 1058443669 + scheme: I?ʐɡ湚犭檚蚗į*o + initialDelaySeconds: 2034517113 + periodSeconds: 2103822699 + successThreshold: 343263788 + timeoutSeconds: 264518020 + stdin: true + stdinOnce: true + terminationMessagePath: AAYYpB1c + terminationMessagePolicy: 贌.[ĉ熶7dzRVç^'谣蔨d搇ĺÎ + tty: true + volumeDevices: + - devicePath: "8" + name: KZo0u22qdit + - devicePath: Fahm + name: lmO + workingDir: tGNhx3deFLdC +extraEnvFrom: +- prefix: 7DB9SS + secretRef: + name: 5rl + optional: true +- configMapRef: {} + prefix: hPVGtWNNR +- configMapRef: + name: FYMIJ1 + prefix: TEtFB3 +extraVolumes: +- name: 2LSr +- name: J +fullnameOverride: Wpq +image: + pullPolicy: M鉃裹Ú&蚑ƈñĎdzɢ/Ɲ9Ws棝 + registry: 0aw5q + repository: PTy + tag: fclX4 +imagePullSecrets: +- name: p95GzFm3JP +ingress: + annotations: + aH: YQ3 + className: IPc + tls: + - secretName: Ec4sB + - secretName: txdIkdw4sg8IB4i9 + - hosts: + - ypg9XtRg8 + - "3" + secretName: DNdM +livenessProbe: + exec: {} + failureThreshold: 913752382 + grpc: + port: 1322195744 + service: iQNfI + initialDelaySeconds: -1439870739 + periodSeconds: 178258715 + successThreshold: -1591263857 + terminationGracePeriodSeconds: 2751522374216629585 + timeoutSeconds: -1117637199 +nameOverride: aD +nodeSelector: + WUADh: 2ruBNaWxT +podLabels: + Avs0UCvd6: "" + LSaZFj: "" + N3gEYOpkd: zqsd +priorityClassName: 2v89v +readinessProbe: + failureThreshold: 1842275861 + grpc: + port: -1389426650 + service: 0bSW249 + httpGet: + host: 0T + path: RnP5zy + port: -514153800 + scheme: k*x"!掫瘑Ʀ扄]Ĝʅƭȑ + initialDelaySeconds: -1077422490 + periodSeconds: 666536934 + successThreshold: 1405066396 + terminationGracePeriodSeconds: -3980601911100433183 + timeoutSeconds: 665413705 +replicaCount: 330 +secret: + create: false + kafka: + awsMskIamSecretKey: 48EJ + protobufGitBasicAuthPassword: U4TfI + saslPassword: xbKdWIc + schemaRegistryPassword: C + schemaRegistryTlsCa: vACi + schemaRegistryTlsCert: l2SQ + schemaRegistryTlsKey: QXTWL2 + tlsCa: sxqA + tlsCert: MZR + tlsPassphrase: Bf18k +secretMounts: +- defaultMode: 278 + name: Vk + path: HIDtODq + secretName: ycVDxFmgC +service: + nodePort: 413 + port: 310 + targetPort: 265 + type: uvupqC6hE4 +strategy: + rollingUpdate: {} + type: ü +tests: {} +tolerations: +- effect: ƛ=åM綁塈'Ʈ7 + key: X + operator: Y葞ęŊ6ùųŗQ膼芏棔ĿF綩 + tolerationSeconds: -7958891124471630696 + value: iw +-- case-025 -- +affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - {} + - matchFields: + - key: Jdk + operator: '''妋ū摺wȋ½骭枰ux' + values: + - L3vrBo + - key: AJyvPdo + operator: QBǏ揅饹\欤ĩ# + values: + - KA4X87 + - kAynjW + - key: INtaCgB9Suw + operator: '"' + values: + - sT5QAUbIK + - matchExpressions: + - key: B1ivFyT + operator: ıD芌ʪÌʡ6坨LʞQ蓠kl + values: + - ZM3ncD + - MaDZJN23 + - nQDH + - key: j1 + operator: ^{Q唤涭 + - key: FMwYRC4 + operator: 構ÁHƲ)ǹō + values: + - tc + - 5w4tJ + - gNCNm5J4 + matchFields: + - key: pIsVqr + operator: j@RUȃfǘ·ɏ!Ǖ灃Ņǟ + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + matchLabelKeys: + - oNBV + - ZW2Upd + mismatchLabelKeys: + - XpmujYp + - zQUvv + - o + namespaces: + - xAojOZ + - 53d1p + topologyKey: wupaWwF + weight: -813250565 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: hRMf + operator: 璢ɂo豢埆o + - key: gByq + operator: '|藐Ç钃[qȂřÜ{南湹裻ßŗyŪ赉' + mismatchLabelKeys: + - 4aBT9oEi8 + topologyKey: "" + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - matchLabelKeys: + - qDyyFpFgn0 + - qAR2Fz8Jbiq9oz + namespaceSelector: {} + namespaces: + - NKeVvij2 + topologyKey: 7OPEY5MMS +annotations: + 7YN: WjRdnTY + J0Eg: alDk +automountServiceAccountToken: false +configmap: + create: false +console: + roles: + - BU: null + - {} +deployment: {} +enterprise: + licenseSecretRef: + key: 3UhYW + name: Ooxn6uesqBg8 +extraContainers: +- args: + - zj + - Z5D + command: + - QfnH4gn + - B1xl + env: + - name: 4X + value: Bw + valueFrom: + configMapKeyRef: + key: Pdqw0Fl3V + name: v3KgbGdzsLvC + optional: true + fieldRef: + apiVersion: NUZjeNE + fieldPath: 9HRTR + resourceFieldRef: + containerName: p + divisor: "0" + resource: shkxnjmC2 + - name: 2i + value: Zxb + valueFrom: + configMapKeyRef: + key: w + name: WzK6UiO + fieldRef: + apiVersion: GnFqZ3 + fieldPath: W + resourceFieldRef: + containerName: 7JDYpnHIpM + divisor: "0" + resource: vt2RbP + secretKeyRef: + key: yl + name: 36xB2Q + optional: true + envFrom: + - configMapRef: + name: V2xmAgfwBn1 + optional: true + prefix: seW + secretRef: + name: Nt + optional: true + - configMapRef: + name: IluKDPq + prefix: N6Uhe + secretRef: + name: TvN6Z3p + image: 3fh + imagePullPolicy: Ǜmʥ薑ōB愌熹g樿ƒ畬ʙ襫,PD + lifecycle: + postStart: + exec: + command: + - wIfuPiat + sleep: + seconds: 6128979882442257912 + name: 0U + ports: + - containerPort: -975012330 + hostIP: nNpK2 + hostPort: -554886438 + name: aE + - containerPort: -2098096147 + hostIP: FeG8 + hostPort: -651932845 + name: xKI1Tv + protocol: :鿅Ǐ!Ʋ卫_ʕȼʗ壷薮蒰NJŌ + - containerPort: 520035268 + hostIP: GyA + hostPort: -1998834660 + name: PR61 + protocol: ŗ蜥aɝWCb锨ȐsO忷ODž)Ŗʃ觃輘 + readinessProbe: + failureThreshold: 1975710195 + grpc: + port: 8949492 + service: USXa + httpGet: + host: 6J2Mk51 + path: FL4SJXOTR + port: c2vVT + scheme: B哰Hȼ涪Ÿȣę + initialDelaySeconds: 1164971701 + periodSeconds: -1267122769 + successThreshold: -102609571 + terminationGracePeriodSeconds: 6799552209277780019 + timeoutSeconds: -995107635 + resources: + requests: + 2j: "0" + restartPolicy: V牜(p + securityContext: + allowPrivilegeEscalation: true + privileged: false + procMount: '@' + readOnlyRootFilesystem: true + runAsGroup: 8605999305673537166 + runAsUser: 1347603438902927360 + startupProbe: + exec: + command: + - JZX + failureThreshold: 1080874840 + grpc: + port: 1467429214 + service: NWBu1S + httpGet: + host: 4ta7S + path: RcBu6 + port: RapJB5x + scheme: ']襰騊缜ă4蘆Ȓ0礓厨獸枓8D' + initialDelaySeconds: -2008822207 + periodSeconds: -614674587 + successThreshold: -402818223 + terminationGracePeriodSeconds: -7949916801988602426 + timeoutSeconds: 209096121 + stdin: true + stdinOnce: true + terminationMessagePath: KRYz + terminationMessagePolicy: Âǚ凍ʄĒ(#Ñ狶8脍ÅdɅș妙觶.祍 + volumeMounts: + - mountPath: LdSrOQ + mountPropagation: Ɗ?ǚ[澆槱ɢ丗7鍚6A + name: sqOobya + subPath: JZEkD + subPathExpr: eJU + - mountPath: K4kwb + mountPropagation: "" + name: YNNb + readOnly: true + subPath: Z0mne + subPathExpr: ngxE + - mountPath: E2GSzT0 + mountPropagation: ȝ註鴔 + name: fRhgta + subPath: y6Y3BdtA + subPathExpr: P0gcNQL + workingDir: rCAtq +- args: + - tJjzGKfki2 + - "" + - furHsPXM1J + command: + - DK3Wlo2n + env: + - name: ud + value: FOyG7u4mv + - name: YM + value: T8mzKDDU + valueFrom: + configMapKeyRef: + key: "" + name: YlrM + optional: true + fieldRef: + apiVersion: TysS9Olq + fieldPath: RX4 + resourceFieldRef: + containerName: o + divisor: "0" + resource: HVzew + secretKeyRef: + key: moOz + name: 9IePG + optional: true + image: hy6X7dY + imagePullPolicy: 秊q魷讍暳ɁiitǦ梒Ʀ疗ǘt + lifecycle: + postStart: + exec: {} + httpGet: + host: 1bv + path: 3IXIEBTRQc + port: dHTyBrOPT + scheme: hƉǤ\ɯ竔}gŘ + sleep: + seconds: 3802753693240438477 + name: mieVkOhQ4 + ports: + - containerPort: 1406294206 + hostIP: XrMHc + hostPort: 1756733537 + name: xrlM3Cv9 + protocol: ^箅瑦|ȭ,Ī憘ʓ焯 + - containerPort: 1867162726 + hostIP: p8Zguos + hostPort: 1052086554 + name: NCa4 + protocol: Ǽ丝等I塸)kɹ~颁!跼S薒SrM + - containerPort: 1770363328 + hostIP: WPUeJ + hostPort: -1882733223 + name: gAUfp + protocol: u舨[ķ獚m灑朷ƶ慹Ʀ + resources: + requests: + CK: "0" + c6WG16NOR: "0" + restartPolicy: 欣ƎȄŚ&廚FË倔Ŋ寬Lw秮x捨 + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - Ƶəʣ饅ōǧ营Sȑ粴ƞȜj嬷俋箊ʫ + - Yǻ)Iƕƺ:檂躡J勬垒ď%ɦ + drop: + - f{2Ƭɢ~lĕ猆å~? + - 曣晜Ȅ笛 + - 牧 =鄅銣閦ʜ(lȏ + privileged: true + procMount: Âȼ + readOnlyRootFilesystem: true + runAsGroup: -5895892166477051871 + runAsNonRoot: false + startupProbe: + exec: {} + failureThreshold: 1512924080 + grpc: + port: -55537357 + service: 9KQ + initialDelaySeconds: 1472203720 + periodSeconds: 1367361112 + successThreshold: -1486557603 + terminationGracePeriodSeconds: 2382050275815801400 + timeoutSeconds: 246291848 + stdin: true + terminationMessagePath: E7wMC + terminationMessagePolicy: h僊冢ʐȑ + volumeMounts: + - mountPath: "" + mountPropagation: uÞ揶椬=L>ȕ凭Śȅ3džȿȳ + name: xYM + subPath: nMMkHAUoYIsN + subPathExpr: 579Yn2LXk + - mountPath: 5z + mountPropagation: Ƀ陪7k惿Ɏǚ霤ƨƱ«ɤ»ȣ薥頠媉fʠ + name: KIX5g + readOnly: true + subPath: CGOswgk + subPathExpr: oxiB23ZW2KX + workingDir: IzOAr +- args: + - jrZTvs + env: + - name: jxl5Q + value: fm2F7DzZA + image: r7sTpTP8N + imagePullPolicy: 眒弿 + lifecycle: + preStop: + httpGet: + host: WEBUk + path: "1" + port: -377365982 + scheme: 娖阋顿|儴Éȱ鋦 + livenessProbe: + exec: + command: + - 2j + failureThreshold: -1631622345 + grpc: + port: -188887701 + service: s + httpGet: + host: "6" + path: 07rm4AD + port: DCtZ5 + scheme: ʼnK襡5殛鯙ȋʛ稲(C姓 + initialDelaySeconds: -1011676147 + periodSeconds: -1141844037 + successThreshold: -1528778970 + terminationGracePeriodSeconds: 422553046190448128 + timeoutSeconds: 99607263 + name: rhg + ports: + - containerPort: 1265703793 + hostIP: lYiq + hostPort: -931710582 + name: r2OdlKyZ + protocol: ŌK4Ʒ霖R婧,Ģ墤ʠ_Ƒ亽vĨO + - containerPort: -1093198499 + hostIP: xHuDhI2 + hostPort: 1423992590 + name: WdH + protocol: K嚜pn犓ɯ`劮ƫķPLm + resizePolicy: + - resourceName: M3EK5NW + restartPolicy: Ɲ囩 + resources: + limits: + 4zeCyo: "0" + PgUjG: "0" + requests: + IseC3: "0" + WHgRSz: "0" + yzZn: "0" + restartPolicy: ijƞ墫噌L诠=脳%Ɗ + securityContext: + privileged: false + readOnlyRootFilesystem: false + runAsGroup: -1074724161449891976 + runAsUser: 8255497511479977438 + startupProbe: + exec: {} + failureThreshold: -1172398717 + grpc: + port: 1919051215 + service: "" + initialDelaySeconds: 2020291403 + periodSeconds: 450860281 + successThreshold: 193397000 + timeoutSeconds: -665894379 + stdin: true + terminationMessagePath: MCVu + terminationMessagePolicy: ŷÍ:+壩ùI賎Rɜ卮cɣS惕mIɭ + tty: true + workingDir: 2L97y +extraEnvFrom: +- configMapRef: + name: Es + optional: false + prefix: sb4Y + secretRef: + name: 5boSPUJ +extraVolumeMounts: +- mountPath: "" + mountPropagation: ė1)ʩ瀚汋跁撯 + name: jFvwz + readOnly: true + subPath: JP5wgP3 + subPathExpr: J +extraVolumes: +- name: Jq0CSftnp +- name: QMHGzzYC2HW +- name: 1PkbzhfK +fullnameOverride: Uo +image: + registry: gFOwHIo + repository: tdq9GJrg + tag: J +imagePullSecrets: +- name: iA1C +- name: ZOdo +- name: qTOK0W +initContainers: + extraInitContainers: UHL +livenessProbe: + exec: {} + failureThreshold: 1473046311 + httpGet: + host: z + path: qQEf + port: -1047428780 + scheme: ȭ龙ğ疹ǜ"ȹȫ怆Ȉiʊ泹牫綖K + initialDelaySeconds: 272400025 + periodSeconds: -1682707125 + successThreshold: -2007433775 + terminationGracePeriodSeconds: 7823760182761119586 + timeoutSeconds: 2024118005 +nameOverride: Mh +podAnnotations: + bHXzf: nOiRsvEXH +podSecurityContext: + fsGroup: -6946946538076897241 + fsGroupChangePolicy: 呆ɔȂwijà + runAsGroup: 3944693697856007637 + runAsNonRoot: true + runAsUser: -732766343758518304 + supplementalGroups: + - -5691922089175975080 +priorityClassName: 0bGHQk7gL +readinessProbe: + exec: {} + failureThreshold: 1554150391 + grpc: + port: -2094102439 + service: 0dg5DO + initialDelaySeconds: -564389480 + periodSeconds: -266349500 + successThreshold: -428571163 + terminationGracePeriodSeconds: -4351299803972335390 + timeoutSeconds: 1803246595 +replicaCount: 345 +resources: + limits: + LxNMXlMD: "0" +secret: + create: false + enterprise: {} + kafka: + awsMskIamSecretKey: SDPuUt + protobufGitBasicAuthPassword: nq + saslPassword: TLAP + schemaRegistryPassword: AFn + schemaRegistryTlsCa: KbZhZV + schemaRegistryTlsCert: dGfweV + schemaRegistryTlsKey: X2B + tlsCa: Zmu + tlsCert: Lv4BgewmU + tlsPassphrase: bCygOn9yJR + redpanda: + adminApi: + password: AE + tlsCa: CEhIkvxe10u + tlsCert: mjaN + tlsKey: j2mDL +serviceAccount: + automountServiceAccountToken: true + name: H5TDAALUdD +tolerations: +- effect: 媄 + key: IQD9Yww8 + operator: bǾå鱍 + tolerationSeconds: -7454358062612206872 + value: odxS1Q2Sd +- effect: Ɣv璔}oȡʞ¤ + key: ySGX + operator: ƪ渺¸貗ȹV廋ȉňu増嬎Ë韍ǘz茩Ƹ怯 + tolerationSeconds: -1083807005557333468 + value: bAy +-- case-026 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: GP94 + operator: 駑Ŀ峇[ɕdž0 + values: + - jjNFKv8 + - uG7Rs + - ApO075 + weight: -549077137 + - preference: + matchExpressions: + - key: R88 + operator: Dzv)bôȏ磜覐橮波赘T^ + values: + - DscaGMdgXV + - uy + - N3d + - key: "" + operator: 誮Vw!/毴Z匌忶ª渆 + values: + - 4mX0s + - key: byy + operator: 鿟y馡錥HJ鶟b左Ő*čt顭塶 + values: + - 6oQ + - 9r22TM + matchFields: + - key: fNLkt + operator: "" + values: + - tW + - M03GnpfhQn + - key: WQQs + operator: 騡(Í芝x焍麅ɰ窓ɶÜò鵹 + weight: 579622465 + podAffinity: {} + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: {} + namespaceSelector: + matchLabels: + IYAfjz: GloAc + namespaces: + - hfFjlR + - KWIdaP11Y + - 3Dn + topologyKey: UB + - labelSelector: + matchExpressions: + - key: B7LSh + operator: ɉ邦夝ɷ1傹Þ袳@ɲ鉴 + matchLabelKeys: + - "n" + namespaceSelector: {} + namespaces: + - 88M + - fIEJUewFK + topologyKey: i +autoscaling: + maxReplicas: 86 + minReplicas: 445 + targetCPUUtilizationPercentage: 362 + targetMemoryUtilizationPercentage: 8 +commonLabels: + "": h0uSAPIi + kuKPk7: "" +configmap: + create: false +console: + roleBindings: + - null + - 9T: null + fxu2XaR: null +extraVolumeMounts: +- mountPath: q + mountPropagation: 跐ʩ4鄧SD炿ɜǚhU + name: "" + subPath: SCLzbAMUW3x + subPathExpr: nzFw +- mountPath: cX8U + mountPropagation: b幈簇@艭K + name: b + readOnly: true + subPath: u5fY + subPathExpr: TRymQ +extraVolumes: +- name: LeIYAb +- name: 176OvjD +- name: b6NpMGfVo1N +fullnameOverride: qhaD +ingress: + annotations: + Lftu: PjroKEh + qvZJNWSzR: Jpoyc0 + className: cAir + enabled: true + hosts: + - host: o + - host: i18Wi + paths: + - path: apsXYvp + pathType: 7q5 + - host: 8eBXg + paths: + - path: cMbMbCQl + pathType: gJT + - path: XvfTwH + pathType: 4se + tls: + - hosts: + - fqD + - JDOgIG + secretName: vzUD + - hosts: + - M6H + - T + - twxgtsi + secretName: lg5siLdo +initContainers: + extraInitContainers: 9KiOC +livenessProbe: + exec: + command: + - 0gsq + - "" + failureThreshold: 1372450161 + grpc: + port: 347104155 + service: Vtf + httpGet: + host: 3Is + path: mFQXEnm + port: -207107285 + scheme: u + initialDelaySeconds: -913177144 + periodSeconds: 912808843 + successThreshold: -765941931 + terminationGracePeriodSeconds: 220495921853460964 + timeoutSeconds: 1174210794 +nameOverride: vLjrafvp +nodeSelector: + ggwC: SQ + rIwToCbB: tUBM5 +podAnnotations: + LtAjph: 8Q + MiPvJub: 0x + j: xR98FRh +podSecurityContext: + fsGroup: -2594082004410587315 + fsGroupChangePolicy: 'ċV1鯍E ' + runAsGroup: -880388195249084168 + runAsNonRoot: false + runAsUser: -9051010573896129766 + supplementalGroups: + - -2777109499517677979 +priorityClassName: JnI8 +readinessProbe: + exec: + command: + - GZAhRFJb + failureThreshold: 1666039794 + grpc: + port: 1689867278 + service: eUJ + httpGet: + host: 6M6GMp + path: hr5gg + port: -751083361 + scheme: 戉窻¦ǃ楓Ëʆ張ǛȤʊLȉŐX5 + initialDelaySeconds: 989921147 + periodSeconds: 536392931 + successThreshold: 1020018972 + terminationGracePeriodSeconds: -955330372102946036 + timeoutSeconds: 1790731281 +replicaCount: 78 +secret: + create: false + enterprise: + licenseSecretRef: + key: yi3 + name: "" + kafka: + awsMskIamSecretKey: J36kR7z6r + protobufGitBasicAuthPassword: xf + saslPassword: jW + schemaRegistryPassword: Z5gF2 + schemaRegistryTlsCa: eGSsHDQm + schemaRegistryTlsCert: NmVf1RW + schemaRegistryTlsKey: DKqtW + tlsCa: 8WuqzUG + tlsCert: yrd + tlsPassphrase: swQ7r + redpanda: + adminApi: + password: mN1ZSR + tlsCa: hrjyEhM + tlsCert: YozBWkwcZ + tlsKey: 1p2 +secretMounts: +- defaultMode: 45 + name: ooYxXE + path: U6f3w + secretName: LyH9zvv +- defaultMode: 429 + name: Hmms9 + path: qzOMXCl + secretName: zvR +- defaultMode: 39 + name: "" + path: dXa6uPxR + secretName: PC2Ms7 +securityContext: + capabilities: + drop: + - ɿX齀蹪 + privileged: true + procMount: Ƚ[孠犥ƶʒ)遷U竕 + runAsGroup: 5229411704597623894 + runAsNonRoot: true +serviceAccount: + annotations: + "": tWl + 5mzy: 4t87VKeHA + a: UqD3iv5LoNYP + automountServiceAccountToken: false + create: true + name: Utu8ZHG2 +strategy: + rollingUpdate: {} + type: I6终j2炅ȲbȻ +tests: + enabled: false +topologySpreadConstraints: +- labelSelector: {} + maxSkew: -154369657 + minDomains: -319419210 + nodeTaintsPolicy: '#Vʅ糗斬ƈ橮IJȶ纀' + topologyKey: dTnKex + whenUnsatisfiable: '@OȤ驮Ʀ琓' +-- case-027 -- +automountServiceAccountToken: true +autoscaling: + maxReplicas: 432 + minReplicas: 265 + targetCPUUtilizationPercentage: 239 + targetMemoryUtilizationPercentage: 130 +commonLabels: + Q0: "" + T4ZmAFi: nfIb0b +configmap: + create: false +console: + roleBindings: + - ElN: null + roles: + - DZcCdT: null + imlLddN: null + - null + - 0MFHoDlkID: null + Xe: null + daS: null +deployment: + create: false +enterprise: {} +extraContainers: +- command: + - WY + - F9X2FePO + env: + - name: MbWT2gynlq + value: S + valueFrom: + fieldRef: + apiVersion: 4msaX + fieldPath: XvlI + resourceFieldRef: + containerName: LEQ + divisor: "0" + resource: oHigE + secretKeyRef: + key: feJnSFqmYy + name: m3lrGM + optional: false + - name: omlZ5 + value: w + valueFrom: + configMapKeyRef: + key: w3iwXnte + name: LqORIZ + fieldRef: + apiVersion: D + fieldPath: bG + secretKeyRef: + key: UeU9m8 + name: 1asSl0l + optional: true + envFrom: + - prefix: HYy4 + secretRef: + name: Q2DTvNx + optional: false + image: jqvBPfz + imagePullPolicy: 庛Ƴ2ɥÔǦ /d2&xȉLJǸAƟ + lifecycle: + postStart: + exec: {} + sleep: + seconds: -1579243177624029331 + livenessProbe: + exec: {} + failureThreshold: 1986638671 + grpc: + port: -1841897347 + service: iUEc + httpGet: + host: CN + path: Dg + port: SYkYMHB + scheme: Ě緷8ĸ)=©ʢ昆ſ9 + initialDelaySeconds: 1029653594 + periodSeconds: 1999066162 + successThreshold: 1106634015 + terminationGracePeriodSeconds: -9022596879374385638 + timeoutSeconds: -809472655 + name: 4D + readinessProbe: + exec: + command: + - iBTD4t + - MY + - Nf + failureThreshold: -1222179068 + httpGet: + host: kgZUkVZPDf + path: hM0yLfiTS7 + port: 846109331 + initialDelaySeconds: 1673719989 + periodSeconds: 1380685354 + successThreshold: -606822450 + terminationGracePeriodSeconds: 2325612573519357970 + timeoutSeconds: 1351631713 + resizePolicy: + - resourceName: KQTh + restartPolicy: 變ȶjȤðʂȈE9ȹɵ礌蓍p殗Ɏ$蟙預 + - resourceName: BATAmUasox + restartPolicy: G寄7]^v腘 + resources: + limits: + 1mn: "0" + 8dnmgn7Vur: "0" + QUXI: "0" + restartPolicy: Ė + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - 餋Ƹ + - ǂnlș + - VLJ2範足诮ÈƋʡĻ + procMount: u¸`TE擴弌/yƦ6帜ǏT鱷潈ř蚒 + readOnlyRootFilesystem: true + runAsGroup: -2334732936143374752 + runAsNonRoot: true + runAsUser: 8673583599260752552 + stdin: true + terminationMessagePath: M934 + terminationMessagePolicy: VF¾弎6a巭ġʥţƟ贯Ǐ飙卮ǥĤȸ + tty: true + volumeMounts: + - mountPath: DzNFL + mountPropagation: 单嶃ɠȕƢ砩寢烕TnǣɅƩ帳 + name: "75" + subPath: Up5FB + subPathExpr: 6nD + - mountPath: qj1c9JPX8 + name: 1K + readOnly: true + subPath: H + subPathExpr: LEVSxozubwU + - mountPath: Ll8X + mountPropagation: '@ï禺pƱ=庶ŊJĤ那[:晙dYĸ獘' + name: PGcOpQ3CM + subPath: 1eBZtMIP + subPathExpr: CRyBKRO + workingDir: s +extraEnv: +- name: k7DjEACXyN + value: Pa4mYEUC + valueFrom: + configMapKeyRef: + key: "" + name: RHdV76r + optional: false + fieldRef: + apiVersion: wxIgM + fieldPath: aBDwplYtr + resourceFieldRef: + containerName: xIL7REN8 + divisor: "0" + resource: QCgp9k + secretKeyRef: + key: ag7Jr1e0 + name: I8vGzsJX + optional: true +- name: pG + value: yTh3djvsV +- name: fjV8k4J8 + value: KHKYS + valueFrom: + configMapKeyRef: + key: DFyBHQO + name: s + resourceFieldRef: + containerName: vd0tsh + divisor: "0" + resource: IgH + secretKeyRef: + key: F + name: a34HcjMyaQ +extraVolumes: +- name: "n" +fullnameOverride: 61hunk +imagePullSecrets: +- name: jkqm +ingress: + annotations: + "": ZtbWlWc + y1ML9Hmg: d6h9 + className: Ijdd3 + enabled: true + tls: + - secretName: x + - secretName: aSf1 +initContainers: + extraInitContainers: vN +livenessProbe: + exec: {} + failureThreshold: 302661968 + grpc: + port: -418561550 + service: kQV1xc + httpGet: + host: UlBEGBj3 + path: qjxTH + port: n7 + scheme: '''(旆PT馷J溠F斃ɦ娴含Q嘱\t9' + initialDelaySeconds: -1367097431 + periodSeconds: 2073795341 + successThreshold: -1800407036 + terminationGracePeriodSeconds: -3519876905947517853 + timeoutSeconds: 1644960855 +nameOverride: h9P +nodeSelector: + B1PiWrl0VUETb: x + DhTxFTV: 3O4Y106 + i8QiXusZ: YBeiJfZK9g +podLabels: + Zrl6: 0D0M + wbG: ZcWnb +podSecurityContext: + fsGroup: 3334237787347678751 + runAsGroup: -5325418670707949502 + runAsNonRoot: true + supplementalGroups: + - -2717337443247240979 + sysctls: + - name: "" + value: R +priorityClassName: bpi +readinessProbe: + exec: + command: + - xz + - e2gf + failureThreshold: -1765420422 + grpc: + port: 879468582 + service: bqFsvC9nR0 + httpGet: + host: CrL + path: 9Jt + port: 7Y + scheme: )ǔ軛醲]8z傏$荸觖稄鱑Í朹s狑Ȱ螪;ǃ嘲 + values: + - gIlS + - 5lD7AvT7I + - "8" + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: hi0zfFEN + operator: 裧禿 + values: + - SymXRnv + - iKr + mismatchLabelKeys: + - wesfXhv + - Z78yvK + namespaceSelector: + matchExpressions: + - key: jqHt + operator: ûų:碃;ė燱5ìb-垢xźɆ + values: + - u8cOuqy + matchLabels: + "8": nCrnu + Fd: 5YhLJD3 + r5sMi70hp4TeB: KrDX7d + namespaces: + - LOH + - 9EvOI7HWh + - 5sHJp + topologyKey: "" + weight: 403248696 + - podAffinityTerm: + mismatchLabelKeys: + - Vrf + namespaceSelector: + matchExpressions: + - key: 5w + operator: '|泀ŏ咙ƚ' + matchLabels: + 4vRvwhR: Nz + T6uTCUGiwx: lS + ZuFER: Db8xhFevK + topologyKey: K7NA + weight: 249855905 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: No2 + operator: Ɗ]鿇躠骐 + matchLabels: + 7nohEoAMei: WrMV + ddLK: 2ehkh + qtrhf: EAAqHFcrjgT + mismatchLabelKeys: + - DrrBoq + - Nh + namespaceSelector: + matchExpressions: + - key: BEXHPr1wQ + operator: 傝魦voȪwć撈 + values: + - i3 + - gUU + - 7nmbvkGs + matchLabels: + Rh65F: rKR + namespaces: + - 1x9DGG + - xKj137E + topologyKey: CSNQy1M + - labelSelector: + matchExpressions: + - key: psq4G + operator: ɓƦ + - key: 3IlNf + operator: ćȬ4鏉1, + values: + - L0 + namespaceSelector: + matchExpressions: + - key: nVgt + operator: ɤ湿ŭò-ɋ鼴)箥Ȅ鋖ʄBK + - key: GD7 + operator: 峄9ƚ涙閉ʃ謩云飠:鎂玚wƁȖ] + values: + - i8cg6A + - TeOYSsj + topologyKey: rEB + - labelSelector: + matchLabels: + s0PrY366si5H: Qwj + ytBgNf0: e + mismatchLabelKeys: + - eylzvu + - q + namespaceSelector: + matchExpressions: + - key: os4H6DpxQ + operator: 5õċ鋵葿葄痄ɍ览逪ȋ`j + matchLabels: + vL3arho: gPmLG + namespaces: + - PjQTIWTFeK + - g5HCelWpMjnF + - QN3mXW + topologyKey: I5osiWTrzhb +annotations: + WVwaqt: gTMC + s6HZpOA: bc0 + sZaCXy: LXRQNTghxb1 +automountServiceAccountToken: true +autoscaling: + maxReplicas: 404 + minReplicas: 186 + targetCPUUtilizationPercentage: 200 + targetMemoryUtilizationPercentage: 383 +commonLabels: + HzuQ: mCfbHBQ + xi7L: ibI45 +console: + roles: + - null + - null +deployment: + create: true +enterprise: + licenseSecretRef: + key: 8MG + name: 83OH +extraContainers: +- args: + - K9 + - 02olyp + env: + - name: F + value: rhVGTadjT + valueFrom: + configMapKeyRef: + key: 3TA0cg2R2 + name: DLZ + fieldRef: + apiVersion: s + fieldPath: Ux + resourceFieldRef: + containerName: avop + divisor: "0" + resource: itl5J4xK4 + secretKeyRef: + key: Av9eKok + optional: false + - name: QaOLYDLT + value: FQu + image: 1MFnpZG + imagePullPolicy: 脓 + livenessProbe: + exec: + command: + - lH4S + failureThreshold: 1311534645 + grpc: + port: 1048835191 + service: p5EtELTs + httpGet: + path: Zjrv + port: Ypah5av + scheme: þʙ龠ȉ%Vę皓ŏ蟝ǙĿìɋN + initialDelaySeconds: 1980070741 + periodSeconds: -728109708 + successThreshold: 1412960079 + terminationGracePeriodSeconds: 4797597904045467368 + timeoutSeconds: -1164059804 + name: oron + readinessProbe: + failureThreshold: -1734715333 + grpc: + port: -673781482 + service: 20iHh + initialDelaySeconds: 270804414 + periodSeconds: 1240219458 + successThreshold: 957649997 + terminationGracePeriodSeconds: -7921460752123720147 + timeoutSeconds: 2069469191 + resizePolicy: + - resourceName: M29 + restartPolicy: tL + - resourceName: WK + restartPolicy: T軂>ȋ1觫蚴Ș + resources: + limits: + KS: "0" + ZDx: "0" + kIjQHQZ: "0" + requests: + BSB: "0" + restartPolicy: LJW獮 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ɺ嚹晐囕胐ƻ + - ņɹ桴O塾q6賤呋f铰}Ʒ輽ʁ[顝 + runAsGroup: 6868723237582569296 + runAsNonRoot: true + runAsUser: 433131246318901172 + startupProbe: + exec: + command: + - mB6 + - Om9w + - "" + failureThreshold: -1184477652 + grpc: + port: -1276243610 + service: m6d + httpGet: + host: VzPuwIiTpY + path: C + port: 0NYj1C + scheme: V=@彆鈂t³Ɉµs斾m蛊ɲ + initialDelaySeconds: -898287287 + periodSeconds: -413255468 + successThreshold: -1510482870 + terminationGracePeriodSeconds: 4884332649151510354 + timeoutSeconds: -1445193311 + stdinOnce: true + terminationMessagePath: DQTH7 + terminationMessagePolicy: ÈɁ;ň);ɑI×ĕ觫'ɣ + volumeDevices: + - devicePath: v + name: AZ6wCimJFM + - devicePath: ZtIx + name: GFe3 + volumeMounts: + - mountPath: tt + mountPropagation: 侮E墝調cé攊疀" + name: UJ + readOnly: true + subPath: JlqP + subPathExpr: lA2v + workingDir: OV90 +- command: + - 8jHRuz + envFrom: + - configMapRef: + optional: false + prefix: yfl3PI + secretRef: + name: r7eR + optional: true + image: m4Etaoz8Bf + imagePullPolicy: okÛļ閷YƗzƄǧ + lifecycle: + postStart: + exec: {} + httpGet: + host: zu9aQLsX + path: xIFogzAoC + port: 1MjUE + scheme: 斔疏ʟn菝 + preStop: + exec: {} + livenessProbe: + failureThreshold: -1399917612 + grpc: + port: -876522011 + service: 2y + httpGet: + host: X9nNdf + path: 8mVJlz + port: 220487349 + scheme: 兇)hr裳ǔ湟钑>ȓn厠tū晣颊 + initialDelaySeconds: -968878635 + periodSeconds: 411754743 + successThreshold: 2083381130 + terminationGracePeriodSeconds: 2736468416107855115 + timeoutSeconds: -423937148 + name: Or + readinessProbe: + failureThreshold: 1628351372 + grpc: + port: -1466105410 + service: b + httpGet: + host: 8kOz + path: IhSlrBw8tiX + port: 1Vd + scheme: qV·dƖ> + initialDelaySeconds: 735135195 + periodSeconds: -175995819 + successThreshold: 1379601279 + terminationGracePeriodSeconds: 386635447886660712 + timeoutSeconds: 125503732 + resources: + limits: + LuudLJ9i: "0" + iXpYUWY: "0" + mHi: "0" + requests: + XLnFU: "0" + mSq9e3u: "0" + t6WYwzmga: "0" + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - ɭ鎣肪綢ȀNj8)屫鈄骸嗢æ憰qWTƶ剡 + - "n" + - OwkʙƝk}ɾ丧< + drop: + - Ť<嶼ȯ愉9宆嵧pɡ%ɐxė鹞鸵鏞 + - ƅgʆ炊ƞąÙ$Ǯ帶SȔ黌畕ǦƖȫV9 + - Ŏʠ羮ɍ痘摬 + privileged: true + runAsGroup: 5710532895986022625 + runAsUser: -7207500526873245606 + startupProbe: + failureThreshold: 2053062827 + grpc: + port: -1076044334 + service: s8s7 + initialDelaySeconds: 7348194 + periodSeconds: 889500482 + successThreshold: -645465298 + terminationGracePeriodSeconds: 4356974427366499939 + timeoutSeconds: 136481601 + stdinOnce: true + terminationMessagePath: t4pW + terminationMessagePolicy: ƣ + volumeDevices: + - devicePath: Df8O3UFZ + name: QL93u + - devicePath: WKg + name: nD4H + volumeMounts: + - mountPath: xs9 + mountPropagation: e羝ș+oũ蘘汉 + name: grr + readOnly: true + subPath: aUYSuUM6f + subPathExpr: mm773yL + workingDir: o +extraVolumeMounts: +- mountPath: P + name: zBgE7HVQ + subPath: hw6PBLgv5R + subPathExpr: YAI5mPj5 +extraVolumes: +- name: "" +- name: SXJ +fullnameOverride: HK +image: + registry: nZ5PG + repository: 5q2qCT + tag: z10JAfCu +ingress: + className: fq2w +initContainers: + extraInitContainers: DVbGC0v6g +livenessProbe: + exec: {} + failureThreshold: -1989869025 + grpc: + port: -580257384 + service: xF + httpGet: + host: EFelM2 + path: NL + port: -1619787350 + scheme: eƌ閽2溧估槞 + initialDelaySeconds: 56050789 + periodSeconds: 193173949 + successThreshold: -1606638368 + terminationGracePeriodSeconds: 9170924509557781641 + timeoutSeconds: -1117024654 +nameOverride: 3Wh +nodeSelector: + Jy9: v + VcMeUW2U: xOwcDQYY + wkI: TbemvxUUg +podAnnotations: + IVy: ho3qpcI +podSecurityContext: + runAsGroup: -9040107238323408835 + runAsNonRoot: false +priorityClassName: sLkcwZ +readinessProbe: + exec: {} + failureThreshold: -509957017 + grpc: + port: -1088874416 + service: kVlcoq + httpGet: + host: yJj + path: SWu6bW + port: V + initialDelaySeconds: 1816814831 + periodSeconds: 406466643 + successThreshold: 450108513 + timeoutSeconds: -1862950899 +replicaCount: 385 +resources: {} +securityContext: + allowPrivilegeEscalation: true + capabilities: + drop: + - 邻ȸNJ"纴ý汫篤訙铵寄貹Z[逗ą弣 + - lǀ敕ɖ + privileged: true + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 3375680259081538534 +service: + annotations: + 33Yi: tesf5 + nodePort: 286 + port: 389 + targetPort: 52 + type: sIQBZD +serviceAccount: + annotations: + 0E6ZFg: nO7Yr55 + 8JN3: B + create: false + name: 43zobnL +strategy: + rollingUpdate: {} +tolerations: +- effect: 蜆³Ə抴璖獍ä鷲炥/=霒0ǷU伀稂ı + key: EMvrrkeG3 + operator: Ȓǒs夃Ȑɉ鋄蛓m÷,旂 + value: yd +- effect: 旌;"ȡ媟窐:ljʥh蓭殰Ȩƴ邃ȬIȻL + key: n87GpiB + operator: '偵~ȥʢȈ珎ſ龕5sʠŇưT4-§Ƀ ' + value: TUaznROmQffrRe1 +-- case-030 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: i3NrGin + operator: LȜɯı偎鵬ćƾ輨ɒ诏Ƞ韾ʂɅ袅 + values: + - ceEnH + - hk + - key: NcZdG + operator: 4# + matchFields: + - key: iJJ + operator: 椤甏Q"dč膌嶁ŵ + values: + - pqbO2v + weight: -888291486 + - preference: + matchExpressions: + - key: 6yk + operator: +[`¥鯦Kqlǣ詆繉ĔNjUƆ + values: + - 9jizdnZ + - 1HUyNhM + - qxDTvf + matchFields: + - key: hCPEY + operator: Ɇ>隣,讽鬓捍+瞶媘暺ɭEƙ + values: + - Ripsc + - CqS + - key: DVFDiRmz7 + operator: U[ + weight: 1468051205 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: v + operator: 舘LJwMa煗 + values: + - 8yax8 + - acSVUNTfJ + - "" + - key: oeJI7K + operator: Ȩ岵Ư塠ŕ惆^ȹ]Ǥ(蓂心[6 + values: + - VT3avr + - 1sP4V + - key: INgeGc + operator: 7ȋ_ƫ俾NīÂ缷 + values: + - K6yWR + - matchExpressions: + - key: s + operator: ǖ鱝U9y,ijO<ǯŹ斔ɥɍQŝŘ + values: + - V7Cj8gd672O + - Jxq7EqU + - "" + - key: gYq6n + operator: J30ǂ涉Ǖ絜拃Ȃ隰韤Ko + values: + - cFfLM2a + - cmwJ5 + - NvVSgzPk0K + - key: ha1vIvxMS + operator: 鹶ƦÍR\Y + values: + - kno2LivX + - ZBSIfmJ1 + - Xy + - matchFields: + - key: cGJbcb + operator: M$铯但ƙ崍0塁7ɔ籇ȏč3ţħ + - key: t9tN + operator: ĴĹApŰƎyģ+7ɬ5 + - key: q + operator: ĂǮȅ魥ď疪@ɓ擼 + values: + - GHyvS63U + - lupcwbTbly + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + q: oY6el1mi0 + w: C7Cxyx + matchLabelKeys: + - HMg6IP + namespaceSelector: + matchExpressions: + - key: Crz + operator: əɃ笕P頔ɾ絿ɟ秜Ć冦Ǒ钹圤|讪ɩ + values: + - Dtei + - 1zhZl + - bd + - key: RjH6F + operator: æ監F箂Ñ9 + values: + - n91j6BXw + - 3RLy + - m + namespaces: + - N0Oqq32Q + - TJpJ52Je1Ikj + - "" + topologyKey: HeJdmR + weight: -259316091 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: R + operator: 麦谐ƺɐqNJ7篐瘘ƊƧR菴qȃ + values: + - 8p + matchLabels: + WW: GL0oC8Fkf + mismatchLabelKeys: + - cdHA3 + namespaceSelector: + matchExpressions: + - key: ar9Y3Br + operator: pK屨鑊聫翶鲔举腏熝ɴ鷏žŝ + namespaces: + - U9UV + topologyKey: cpw + weight: -400075332 + - podAffinityTerm: + labelSelector: + matchLabels: + hYm: "" + mismatchLabelKeys: + - fCOHEas + - uHnZlu + - zhGS + namespaceSelector: + matchExpressions: + - key: HZEOkit1i + operator: '@ÍȪ蟔ʖ' + values: + - t9Xj + matchLabels: + "": so + topologyKey: "" + weight: 2103394856 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: 5LP9ZW14 + operator: "" + values: + - O4Urq + - key: f3f + operator: õǷ膀3堢ƧŸ + values: + - GJnsN0 + - key: MOJiCs9Qi + operator: Ȥ:危L昝×秲d3ğd曱窸 + values: + - 3keSh + - Uyy + matchLabels: + R: dUyJ0OOVapc + mismatchLabelKeys: + - Xjqx8f + - I5k + - wq0 + namespaceSelector: + matchExpressions: + - key: UP + operator: ȡ畅fȐiú鍿6+襄懬Uċ + values: + - NmZvVOQ + - key: P0hfM + operator: 黣`倴Ŝʪ鰷淸 + values: + - 0GsglT + - MMOe + - uU7Q9 + - key: qnv + operator: æ钹eťǧI薶瘃預ʑ歪yʖb7IwɄ + values: + - McuTAiUq + - XvSAD + - 4e9Vd4vq4 + matchLabels: + "": 4O2glzZ + namespaces: + - wblXzeT2 + - qKILJo + - lPV + topologyKey: Jnwfpfk + - labelSelector: {} + matchLabelKeys: + - tMph8mi + - Ry31wp + mismatchLabelKeys: + - tBHze4gtm0s + namespaceSelector: + matchExpressions: + - key: RpYdzfZ + operator: 攆KRɮõ涸WæĥŽ¡犇fʼn利$蘁干 + values: + - 8Pxd + - V50 + - key: I0O + operator: w"ʈö褥屑ɣAR(憍Nj松趯ĩȁ + values: + - "" + - 6yt2J + - key: fR7 + operator: GǼ舿 + values: + - gP + - LxpC1 + - brLBqM + matchLabels: + "": D5eSOeauL + namespaces: + - xrd20T0 + - GVD45 + - UU3YxE + topologyKey: augu3G + - labelSelector: + matchExpressions: + - key: c17UgoCbg + operator: -蟁楉mƸ赢UȇEŏ + values: + - cr + - CSYe + - key: FM6GBGy + operator: ;疩Ȯ慫ʂy_Ɛ碷ʩʀđ忮 + matchLabels: + Q4hS: 2Z + w: pvyR + matchLabelKeys: + - PLi + - G2W4IV + namespaceSelector: + matchExpressions: + - key: 8Z + operator: Ȩ卭閃N弲ʠǠ驯Ɩ8Ýʊ + values: + - rEFXZ1 + - oXxjjBM + - iovjqaN7g + matchLabels: + 3ZwMBixAo: QeYp0O + topologyKey: AH3A + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + 7hX7: uCFlimRES0ZJ + matchLabelKeys: + - CxxMt + namespaceSelector: + matchExpressions: + - key: Xra0M + operator: ʙƤ潯ɔ + - key: "" + operator: 8媮­Ů籌<ǫ + values: + - RsIq + - wqR2cm + - key: ottvJh4 + operator: ¢M&<叇誆戛!Ʒ"(Z氇z錉¬$ + values: + - 5sMUIY + - SV + matchLabels: + iciKwm: xkq + vPG: oQs + namespaces: + - AtM4 + - rZdQ + topologyKey: 9FnG + weight: 1109931313 +annotations: + 5ya: nNowhQY2Bp +automountServiceAccountToken: false +autoscaling: + enabled: true + maxReplicas: 10 + minReplicas: 306 + targetCPUUtilizationPercentage: 227 + targetMemoryUtilizationPercentage: 477 +commonLabels: + T: f0 + jwrBMvwfg: K6I5HsI5 + nk8eJc: nS +configmap: + create: false +console: + roleBindings: + - E: null + W67WBz: null + nYCT7q9: null + - 2S0: null + Nx24C: null + WacOKFS1: null + roles: + - i5oc: null + - {} +deployment: + create: false +enterprise: + licenseSecretRef: + key: ZJGo + name: oxACi6X0cy +extraContainers: +- env: + - name: rV6MouQf3 + value: E21XoHIB + valueFrom: + configMapKeyRef: + key: LDu + name: Flu + optional: false + fieldRef: + apiVersion: Rc8broTqb + fieldPath: "6" + resourceFieldRef: + containerName: VPb + divisor: "0" + resource: PUL + secretKeyRef: + key: xwKJr5 + name: 8K3IIl70g + optional: false + image: d3e1 + imagePullPolicy: 梅E垉丿ȁƘg/§Oaq嵌艷ɖ½飚 + lifecycle: + postStart: + exec: {} + httpGet: + host: WyIob + path: sVvxO + port: SivnsYEe + scheme: Ǖɜsk煨a% + sleep: + seconds: -5241114468416153504 + preStop: + exec: + command: + - h0 + - PbwM + - xML1a5IbGl + httpGet: + host: i8l7K + path: v0TIlzugj + port: UO1j5 + scheme: 痍´荭鲪 + sleep: + seconds: -5262918982231100330 + livenessProbe: + exec: + command: + - MAKziqqn2 + - RtC + failureThreshold: 301723627 + grpc: + port: 1522990624 + service: Y2uF8U + httpGet: + host: 8E6hLWDfL + path: ptr + port: -819495670 + scheme: 畊傲Ā5ʇġ杭ăïƺƢh]薰 + initialDelaySeconds: 975121998 + periodSeconds: 1462200965 + successThreshold: -1868145610 + terminationGracePeriodSeconds: 438373319570860757 + timeoutSeconds: -992167018 + name: xGfw + ports: + - containerPort: 1210092140 + hostIP: aXzKT + hostPort: -1118392417 + name: A5VIRuB0ki + protocol: 巔B兓汳LDŽ5ǒʛ岹璜ʂá&Ɠ + - containerPort: -1184047055 + hostIP: nLlzZ + hostPort: 1916025056 + name: CSeXd7M + protocol: 朿! + readinessProbe: + exec: + command: + - AfVsN7lM + - SoZ + - yZ2uB93C + failureThreshold: -1305050809 + grpc: + port: -1574571534 + service: vhf8x + httpGet: + host: 2zqRpIh + path: ZRe + port: 1109632462 + scheme: '*h嶳椗痢%īƺ' + initialDelaySeconds: 157767030 + periodSeconds: -538159566 + successThreshold: -909232559 + terminationGracePeriodSeconds: -1089882796882580867 + timeoutSeconds: 1392958383 + resizePolicy: + - resourceName: JCDaktfU + restartPolicy: 鈇Hƣv蘺 + - resourceName: "" + restartPolicy: 魔ţv毇俺ɚ + resources: + requests: + DA9: "0" + XdW14: "0" + lUcQG: "0" + restartPolicy: 淣遦髺tMőƤ橷僟 + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - 兪q6赀覱勯痜.I膴6+V旱Ő佀 + - 焤Ċʐæ舁ŕ齸Ġ + - uo妿Iǥ2JǟAŊ訖ʆD + privileged: true + procMount: Ɋ胘ſȾ鞣殦ơɧ­ǶǴU譶 + readOnlyRootFilesystem: false + runAsGroup: 5199515302292266073 + runAsNonRoot: false + runAsUser: -7335995488954570305 + startupProbe: + exec: {} + failureThreshold: -777300462 + grpc: + port: 2095052331 + service: bfVTOPN1hv + httpGet: + host: Kp + path: b1bcG9oDl + port: 1383634294 + scheme: 谳涿v衃$Ơʓȳ浲呯 + initialDelaySeconds: -1373123738 + periodSeconds: -1183287381 + successThreshold: 685684993 + terminationGracePeriodSeconds: -4093444870298300516 + timeoutSeconds: -1903691809 + terminationMessagePath: olo1u + terminationMessagePolicy: 怚PʢŸiųŞv嶷宇ƏȌ¥ƀ + volumeDevices: + - devicePath: qFB10P + name: "" + volumeMounts: + - mountPath: YW9lWgZeNE + mountPropagation: 鰛8Ȗ×ʞ + name: Tot + subPath: Ty + subPathExpr: spiOgT0A + - mountPath: SgUmz6Q + mountPropagation: Ă別Z醰棘纀C蘂× + name: ddMHT + readOnly: true + subPath: 8J3YB + subPathExpr: K + workingDir: OQ4 +- args: + - bAsse7O + - u + command: + - MzlyVYHO2w + - oRBJF + - Nafr + env: + - name: U + value: RNGsZ + valueFrom: + configMapKeyRef: + key: YX6H + name: ab92 + optional: true + fieldRef: + fieldPath: 1SR7mfWfzFL + resourceFieldRef: + containerName: C92ipM + divisor: "0" + resource: x4S7 + secretKeyRef: + key: WhzPa + name: lAvfz + optional: true + image: nP + imagePullPolicy: ǫyɮȯ + lifecycle: + postStart: + exec: + command: + - ucft + - K8XaCG + httpGet: + host: rza + path: JhnYc + port: e0 + sleep: + seconds: 6253871176572388811 + preStop: + exec: + command: + - Uiuiougu + - "" + - 3Gx5Gu + httpGet: + host: VQzMXk + path: ws + port: -474919374 + scheme: w媦÷帹ȅW閫ĭ# + sleep: + seconds: 4571098797230986244 + livenessProbe: + exec: + command: + - pHp + - MDPb7 + failureThreshold: 871873843 + grpc: + port: -422130433 + service: nC + httpGet: + host: M + path: p00iJRicrG + port: bS0X1wo + scheme: m鈎Z趟樥R%飅 + initialDelaySeconds: -604803912 + periodSeconds: 1886242291 + successThreshold: -1386436865 + terminationGracePeriodSeconds: 3067492874024630757 + timeoutSeconds: -1583378445 + name: Si46O7YRR + ports: + - containerPort: 1700510643 + hostPort: 251260843 + name: JkZyRGNq + protocol: ȅz,ǹ昉 + - containerPort: -1859013382 + hostIP: NHKaXL + hostPort: 831309722 + name: y9vWUO + protocol: ʡƊX| + - containerPort: -2125300283 + hostIP: jj3qc4 + hostPort: -278349921 + name: Aa + protocol: 耛v6]jç錛洘¶緛uȁ竿 + readinessProbe: + exec: + command: + - "" + failureThreshold: -784645974 + grpc: + port: 1390591548 + service: "" + httpGet: + host: lNyXDdzed + path: W9q4gnCB + port: 4YUq5drSLjLPw + scheme: 唡家調Ô蘓狥ć4^謋遭ŧ厑Ƕ¤ + initialDelaySeconds: -315867707 + periodSeconds: -1221044118 + successThreshold: -2057597685 + terminationGracePeriodSeconds: 8064296597671882818 + timeoutSeconds: -1128414965 + resizePolicy: + - resourceName: MA + restartPolicy: tÜ榋ɼ + - resourceName: bwI + restartPolicy: 斪4瓏鍣ĊYƞ睽%ü劘ĥÑC­ + resources: {} + restartPolicy: ǫ歩ʏ朄DŽ8Ǫȩ;毆|ȕ潆Zʚ輘殈ɔ + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - '*驲' + - 纒寻$KŞ菤Ľ恎eɈ鏽 + - ě宭`羧\LƝ攅嫜ɫʡɞǍ緭p誂 + privileged: true + procMount: 楛钞óŰ)5鞊tY榋肦Ȓ + readOnlyRootFilesystem: true + runAsGroup: -3200847944437364683 + runAsNonRoot: true + runAsUser: -5188355058620722927 + startupProbe: + exec: {} + failureThreshold: -718122732 + grpc: + port: -2045013242 + service: Zg34 + httpGet: + host: slqfokZ + path: SlStyexr + port: 101605170 + scheme: Ȅ.隊ou纾ƙŨ`aʭ + initialDelaySeconds: -467990622 + periodSeconds: 446042771 + successThreshold: -504446684 + terminationGracePeriodSeconds: 1811254130314346303 + timeoutSeconds: -1983992134 + stdin: true + terminationMessagePath: zLDb + terminationMessagePolicy: ōe谕ńg"qy暵ȵ抷¬Ʃ蔚盓 + values: + - tQP + - lAyg + - "" + - key: qaIUADOI + operator: '&Ɗ³ĵLJ鎌ɝǏ縉j' + values: + - 6ot8DTU + weight: 969637277 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: j9Rzed0C + operator: Ò + - key: 02b + operator: "" + matchFields: + - key: "0" + operator: 9Š篅)笕Õ^ɤ疫ɜȬ + values: + - "n" + - key: 96k + operator: 觱踊ĝğOɎʁ胳}$g鄈ʮ誦Ň鱝炠抡凓 + values: + - pJdgL + - 00uMch + - key: pz1WHTJ + operator: 濐r! + values: + - i4rsr5 + - PI8GPtiCkkahh + - matchFields: + - key: oTjdt + operator: $ƹȔLj硍čȒŪ涏ȰŞdų悋ĶA + values: + - KOyvX + - 6JNFdnH + - e59WgamF + - key: lu3OH + operator: ǽəơȽĬt嶫cŭ + values: + - 9SKaOYPiL + - 1ioL + - pZde + - key: Jd6LB + operator: ']洔璗3NZ貦ʞ%ȮǵȺ絥ņ' + values: + - dKyLtzFaqg + - yCg + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: siTiGS + operator: ʐȱe峫LJ鐻cȚEqkwt!ģ + values: + - "" + matchLabels: + Aj: V + P5zpV: 8hC + mismatchLabelKeys: + - 4wtTpNGnV + namespaceSelector: + matchExpressions: + - key: K2ZsAt + operator: 妗巪Wɱ鲵Ǯ洭 + values: + - jxl5gm5E + - X2 + matchLabels: + ly6r: 9k + o0G: "Y" + namespaces: + - Q + - XpXqm + topologyKey: Qrt + weight: -1221853228 + - podAffinityTerm: + labelSelector: + matchLabels: + Jc9: Ftx4sR + Zi0PNgVi: EUuTsR + dQt607d6aSO: RSEoObj9yY + matchLabelKeys: + - odAAyA + - ZUwkRz709gR + namespaceSelector: + matchLabels: + Ag0Kix1n: laC2fYO + topologyKey: izD + weight: 600976747 + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: {} + matchLabelKeys: + - QRHiPYut + - KfMAojY + - Vww + mismatchLabelKeys: + - TTnksi7Ob70 + - gGyPv + namespaceSelector: + matchExpressions: + - key: XYpda + operator: q砐ʌƭʩ烬P§Ǩ + values: + - k7 + - SKn + - eefGAA + namespaces: + - ZYe + - nivMj26 + - OhZ6 + topologyKey: xIpuYH7 + weight: -1130732649 + - podAffinityTerm: + labelSelector: + matchLabels: + ApF: Gsyd94h39Q + H: r + mismatchLabelKeys: + - aWHz7q + - xuzLo + - 5ASY1R + namespaceSelector: + matchExpressions: + - key: Zg + operator: 篃b + values: + - vh + - Rgd3V6 + - key: PNqIEbD + operator: \Ų叢T'ɰď乁ʤ駧ɧ + matchLabels: + ugZKNnsp: bUttL + topologyKey: GRNlK86 + weight: 1964668305 + - podAffinityTerm: + labelSelector: + matchLabels: + t2lvLczlk: um + wjQbQIYB: zsr5i + matchLabelKeys: + - "" + - 7H2Kg1N + - NE + namespaceSelector: + matchExpressions: + - key: 2AEBOqKWel + operator: É$íĨ鯖 + values: + - "7" + - S6PWc + - key: c9NGgT2 + operator: Dǥž駗驕咜2 + values: + - WFDcdOBg + - 8akPt + - key: v5V + operator: 苯Dzŏ趘Ɏ蹰ƦȃDz俑I^ģ鄔ĥƁ鲎硹. + values: + - Ro + namespaces: + - rrn + - Gko + - D + topologyKey: 5GfcY + weight: 1374611901 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: 9BEvWF + operator: 箁梄òǣf舢ɉ N + - key: DoJZDVpdUKV + operator: '|痤"纇繁Ơ¹Rnl' + values: + - M1FUy7H + - PmETea + - key: fZB9p + operator: 艨ë寨t^ + values: + - 6SbUQEl9IF + - grOZ + - awRdbXsbbO + matchLabelKeys: + - QbnYiVnjIDt + mismatchLabelKeys: + - dzq3fg + - EHB2 + - E + namespaceSelector: + matchExpressions: + - key: C + operator: 泤煇JĀȅs滚硚ƾĐLJɚ<嗢 + values: + - qweN + - cmGvYLL9 + - key: ftTKd17 + operator: ïǸfǛD + values: + - 3Qp + - 97WXhHH + - QLVxS + - key: X + operator: x Ƙš + values: + - X7mWp + - 4YUDIL + matchLabels: + 2pOyqtJ: X5kt + DqZU: lA7g + yydzgHSxH: mX + namespaces: + - PnB + topologyKey: O2bIu + - labelSelector: + matchExpressions: + - key: lR5v3DP + operator: 8ȈDŽG弪żf[j盠zğ? + values: + - oX28u + - fcVl + - l + matchLabels: + D1CEy: o9m2rVKHK1i + q9TAhY: UxxABL + matchLabelKeys: + - gZSueHOl + mismatchLabelKeys: + - yKwrju + - OmHbxfoV + - p + namespaceSelector: + matchExpressions: + - key: y4jen13nM + operator: '}J;ƴȳ鹓ÿ莂ú' + values: + - 4Fe5y + - BrR + - key: O47QYt11Bl + operator: ıCƾ?9Ìx毧Ƿ + values: + - co + - A7y9 + matchLabels: + "8": 7mV4YD + namespaces: + - vi + topologyKey: sRbXgEn +annotations: + lZ: e +automountServiceAccountToken: true +autoscaling: + enabled: true + maxReplicas: 25 + minReplicas: 20 + targetCPUUtilizationPercentage: 460 + targetMemoryUtilizationPercentage: 169 +commonLabels: + q4ZdG9q: IJWaYu9mhun + sFTTcyl: qVyaa0ULC +configmap: + create: true +console: + roleBindings: + - {} + - {} + roles: + - {} +deployment: + create: false +enterprise: + licenseSecretRef: + key: qYIzRhBP + name: lkd8afL +extraEnv: +- name: 6aAK + value: C + valueFrom: + configMapKeyRef: + key: hSSIqC + name: QPNl + optional: true + fieldRef: + apiVersion: LhfAND6hW + fieldPath: g2J7 + resourceFieldRef: + containerName: BDRH4s + divisor: "0" + resource: "" + secretKeyRef: + key: LfIX + name: vI2UB + optional: true +- name: qUw9kXv + value: WEGTagf + valueFrom: + configMapKeyRef: + key: ejuXsJ1 + name: MYu4 + optional: false + fieldRef: + apiVersion: 9PzuPIkT3 + fieldPath: oa8Oe + resourceFieldRef: + containerName: IuMHr6gt9 + divisor: "0" + resource: dazyeM + secretKeyRef: + key: ludRIp + name: 1RhUa7B + optional: false +- name: UIdv4fEDhnwvUs + value: ZhJ + valueFrom: + configMapKeyRef: + key: 9CIrVsxQ + name: bYh + optional: false + fieldRef: + apiVersion: Fv + fieldPath: W3lmjz5mnuz + resourceFieldRef: + divisor: "0" + resource: 8sULBf + secretKeyRef: + key: mjbYsz + name: ZzZ4TUcp + optional: false +extraVolumeMounts: +- mountPath: TpG9eA0 + mountPropagation: "" + name: XFmsoqjlB + readOnly: true + subPath: rJznnSzpn + subPathExpr: kYhNPw7T1 +- mountPath: rhHVxSG + mountPropagation: Ħɔq + name: zucf + readOnly: true + subPath: rhOyK4f + subPathExpr: dxfS2ISRGUw +extraVolumes: +- name: Py +- name: Wq +- name: "N" +fullnameOverride: 59cQ0qKLI +image: + pullPolicy: 賅5尬Ƕktʈ漻`楾Ő抚@瞹%Ř忞崗Y + registry: gAh7r + repository: VvT9aH5 + tag: "" +imagePullSecrets: +- name: 2Ry3vDGf6 +- name: PE5R +- name: uWsoZ +ingress: + annotations: + Q: 3KXvHleq + YUY: BD + mdCRk: Ilk9wDjAw + className: GuB1VTCp + enabled: true + hosts: + - host: WsTbK7W + paths: + - path: MKCR56 + pathType: hEV + - path: "6" + pathType: pv + - path: rNv + pathType: L0CY1c8 + - host: OxFD + - host: Ojx + tls: + - hosts: + - C + - wxjmQWXDn + secretName: ESgom5IBQR +initContainers: + extraInitContainers: AN4 +livenessProbe: + exec: + command: + - 5m + - 1hj + failureThreshold: 1710421008 + grpc: + port: -1758154628 + service: "" + httpGet: + host: AbGz9Ql + path: 6HPb6FQP + port: 1834140801 + initialDelaySeconds: -1805305530 + periodSeconds: 580837556 + successThreshold: 1568498137 + terminationGracePeriodSeconds: 6055624087283515610 + timeoutSeconds: 1393862090 +nameOverride: xknw +nodeSelector: + "": O +podAnnotations: + IserdW: Y8zC + rKlqh6W: s9dR +podLabels: + 7yc3n: Cmh + bASmPL: XHGF + e1: s0B +podSecurityContext: + fsGroup: -6352604564338413284 + fsGroupChangePolicy: ¥ɬ屛ɀ裕量7ȅLJI/煿I庮\LÌ0 + runAsGroup: -629752081807497066 + runAsNonRoot: false + runAsUser: -7150506011583335552 + supplementalGroups: + - -2079681094590514497 + - 4310353567816636623 + sysctls: + - name: "" + value: 6bg1 + - name: v54yJPXG + value: BNnF0A + - name: DU + value: J +priorityClassName: mFg +readinessProbe: + exec: + command: + - 1A7AuNqZgrO + - 0Dv9uT + - mi + failureThreshold: -1374895470 + grpc: + port: -974870340 + service: rLr6 + httpGet: + host: ZjH9W0Mw2N7wDlEl + path: A1mi + port: VL + scheme: '''Z悁Ţ瘿ª簳Ʀx.ʞ鳃峚5ƫw牑諥ǁ' + initialDelaySeconds: -1507178072 + periodSeconds: 59289443 + successThreshold: 873349641 + terminationGracePeriodSeconds: 3372950661886875571 + timeoutSeconds: -77680726 +replicaCount: 424 +resources: {} +secret: + create: false + enterprise: + licenseSecretRef: + key: 8NBr7XfH + name: UG4to + kafka: + awsMskIamSecretKey: iq3sT9 + protobufGitBasicAuthPassword: TmKaYoY + saslPassword: 41jeqaQ + schemaRegistryPassword: lo1 + schemaRegistryTlsCa: 6ugJXi + schemaRegistryTlsCert: Dfxzy + schemaRegistryTlsKey: s6Wq0 + tlsCa: xiXLxgIB1uY + tlsCert: BoJ + tlsPassphrase: ERo + login: + github: + clientSecret: 6FsPPUCqFaQN9Z + personalAccessToken: mQjpC + google: + clientSecret: zEoO + groupsServiceAccount: sJYwU + jwtSecret: nN8l8K5 + oidc: + clientSecret: t + okta: + clientSecret: uW9S + directoryApiToken: UF7 + redpanda: + adminApi: + password: hkp2 + tlsCa: Hv + tlsCert: YIT6XYEg + tlsKey: gVxUg +secretMounts: +- defaultMode: 217 + name: 84iLClLVXmt + path: z5a16ev9 + secretName: DBNf +securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - Ò4^|wƙJ3ɀªʭ÷齹æc8ǺơG + drop: + - 罩Ɵ + - 凘~蹆縇W偓Ȓ鵇膓咰ɲ俹îS泑 + privileged: true + procMount: 'č #m繰:¿ċY3扙缗_MǮJw' + readOnlyRootFilesystem: true + runAsGroup: -3419647664540135091 + runAsNonRoot: true + runAsUser: -7389132079103631330 +service: + nodePort: 398 + port: 112 + targetPort: 375 + type: N9chrF +serviceAccount: + annotations: + 4Fkdkgg: xGzY0KvisI + WBAEgggZ: v + sCN: cru + automountServiceAccountToken: true + create: false + name: REj +strategy: + rollingUpdate: {} + type: rÂ秘鲊ơ煥ËI5ɠv蜺 +tests: + enabled: true +tolerations: +- effect: Ɍ + key: P5n9NT + operator: hKW塀Bʊ祆aTɋw + tolerationSeconds: 4112555560826291604 + value: WHYsAK +- effect: Ŵ夀D朩儿 + key: QW09kcw + operator: K嗂ɩ + tolerationSeconds: 1977367920031301876 + value: FxI4 +- effect: 虻~ƤɟŪm繒敏嗕?ʅ着é殮领 + key: nkzGJU9 + operator: M鏫ɮ噀屗pq)ɋɎN + tolerationSeconds: 1704904114127412585 + value: AgyEeU +-- case-032 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: {} + weight: 735732238 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: cFkyLM + operator: 岊B + - key: V3cKSq + operator: ǟ濈1ɑÎ"孲ȀŨFhŲ + values: + - hz + - matchExpressions: + - key: 8N + operator: 9´敤T + values: + - amWROpS + matchFields: + - key: 7hmWbsKS + operator: "" + values: + - lS + - slkOyX + - YlwPcdVh + - matchExpressions: + - key: n5YD + operator: Əüʢ軾ŚũɳnŒ + values: + - 5s4eD6x + - WMkZIzS40rxp + - zCnW + - key: JawyIOLo + operator: 巳c習Gnƛ{ɩ¯Ĭ枺lȜʩ泿趏ǙĊi + values: + - Fvzyw13fUZC + - 4w9T3GeG + - mVj9N + matchFields: + - key: 4amyTWvhx + operator: Ąŵ8雌%ɸ*W褒卒S + values: + - cPr0Nm2WFo1dBq + - a + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: XgsMMBS + operator: ȗ諹 + values: + - foI + - NN1yiUNR + matchLabels: + Qq: VB19aUlI + mismatchLabelKeys: + - hcD + namespaceSelector: + matchLabels: + vMT90cNq3PYf2z: upe + topologyKey: RSVn9W + weight: 603398420 + - podAffinityTerm: + labelSelector: {} + mismatchLabelKeys: + - 4IL0rEe9 + - yY0RMU2 + namespaceSelector: + matchExpressions: + - key: tIka9jS + operator: 7怘xə4ÏɦW + values: + - l + - ajs6c + - hkYj + - key: Qu + operator: ʊ鏀ɑ蒀刹gE + values: + - 2UvY + - hRB1wKXyHi9 + topologyKey: ZKWyn5kI + weight: -1674108352 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: KQfZ4 + operator: ġȁAu盝ȭƈŦ齬{z + values: + - itNS0T + - jL + - key: q0HemjU + operator: e銳ȇ葁õDÏ筃 + values: + - M5yeE + - gJJY + - HInHzXgX + - key: d1LKZ1 + operator: Q + matchLabels: + XElv: QGJ + nD: kNCk5qe + wUtw34v: sCjj5z + matchLabelKeys: + - ej9hOPjp7W + mismatchLabelKeys: + - lhU9gP + - T7rMlvu + namespaceSelector: {} + namespaces: + - ii3aa + topologyKey: 8U7 + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: CkQsu4fS + operator: 鄦&ɲȅ + values: + - RVnwZ + - EVk + - key: yt + operator: 傓N嬅宠H^÷ + values: + - 1L + - rVQPs + - dUHOKQ + - key: hQ1Tl + operator: ɣë筁尻!絜辩^riʨ莠8dƋ + values: + - 4D6Y + - 5TXh + - 8RH + matchLabels: + "9": jb2X + IdL: PQj0N + iB09Upiijt: JpN + matchLabelKeys: + - rKS9p8 + - sK8p + namespaceSelector: + matchExpressions: + - key: KQ6 + operator: '篛I6ÝBŘ F媍/:' + values: + - NXP47Fm + - Z0Qh2Y4 + - JeWX + - key: Yh + operator: '!j3W' + values: + - mTm5dkO58H + - "" + - key: 6q + operator: 景¨Sŝvo/ + values: + - TrgtrP + - zqIsId + matchLabels: + 7E3A1K: "7" + 63IlVL: aSxc + W1hP: 1H9k3O + namespaces: + - "" + - 2Ma + topologyKey: FFqt + - labelSelector: + matchLabels: + "": wklJJ + C8JZ: LP + U1pz: kAE1l4 + matchLabelKeys: + - shj5V + - oU074y + - Ufq2w + mismatchLabelKeys: + - oBzMiOSgd + - iSF + namespaceSelector: + matchExpressions: + - key: fCbLu + operator: 塊衅m鑀ȣ戢ŭ阻蹯ȟ獇ɨ + values: + - B6TgQ75 + - FAHTEOSesQ + - Ms2Kw7XQ + - key: 133fMqId + operator: "" + values: + - pJc0Zu8 + - T1PEuV0uism + matchLabels: + 1rfPa2b4Ny: cemR + Np9l: lcX + SjNYy4: VZX + namespaces: + - 7W + - umFBWrpUDHv + - "" + topologyKey: pPUIqPXo +annotations: + xpNWT: MpOZ +automountServiceAccountToken: true +autoscaling: + enabled: true + maxReplicas: 459 + minReplicas: 198 + targetCPUUtilizationPercentage: 497 + targetMemoryUtilizationPercentage: 146 +commonLabels: + B19ue: 8W + Kxm5R1: R + e3Cx: MIAO +configmap: + create: true +console: + roleBindings: + - K8wnWSD: null + bwYE7: null + y4j: null + - GvFfKdgL: null + enU8G4: null + wvnJcOn: null + - td7: null + roles: + - YQBucbbDX2R: null + - 2UuDKjR: null + IV0Yus9: null + ci20SljQkhw: null +deployment: + create: true +enterprise: + licenseSecretRef: + key: bujGpO7D0C + name: V +extraContainers: +- args: + - T + - Pvf1yAamEa + - jQE8UakuY + env: + - name: 3g + value: JexRP + valueFrom: + configMapKeyRef: + key: QZ + name: QcC + optional: true + fieldRef: + apiVersion: Iv + fieldPath: d7xQ + resourceFieldRef: + containerName: jLpJ + divisor: "0" + resource: m + secretKeyRef: + key: Quhh + name: HUhzPAEo85 + optional: true + - name: ehSBff + value: nHu + valueFrom: + configMapKeyRef: + key: v3Icanu + name: dNPJ8 + optional: false + fieldRef: + apiVersion: xO7UQDq0 + fieldPath: gAyGB6Nj4 + resourceFieldRef: + containerName: Bs2D + divisor: "0" + resource: xJCQsH + secretKeyRef: + key: 3T6tjIQWa0C + name: 8TvRbhP + optional: false + envFrom: + - configMapRef: + name: mf + optional: false + prefix: pZxp + secretRef: + name: v + optional: true + - configMapRef: + name: wosjc9 + optional: true + prefix: ehhmFeLY + secretRef: + name: Ll + optional: false + image: kZ8UUm + imagePullPolicy: Ɓ + lifecycle: + postStart: + exec: {} + httpGet: + host: K29SzZPo + path: y2bQL8 + port: Cr + scheme: 轂Ì蕏ʋ + sleep: + seconds: -3765902632580054640 + preStop: + exec: + command: + - 1pT5X + httpGet: + host: NouEQF + path: WITzSW + port: 1565482371 + scheme: ƒ塒廛鎐藽瀫 + sleep: + seconds: 1831382645860081979 + livenessProbe: + exec: {} + failureThreshold: -1525719681 + grpc: + port: 99688681 + service: xa0sl3k5KM + httpGet: + host: prjHPqf + path: RHwZIE + port: 2UZ7hXI + scheme: 瑀ċ廤ȵ + initialDelaySeconds: -1367665605 + periodSeconds: -1023789296 + successThreshold: 206844073 + terminationGracePeriodSeconds: -3901072071078889022 + timeoutSeconds: 1670691424 + name: t + ports: + - containerPort: 2046398071 + hostIP: pJg + hostPort: -1247541550 + name: DrYeHQ6 + protocol: ²ȑBŸ + readinessProbe: + exec: {} + failureThreshold: 852505381 + grpc: + port: 8093048 + service: "N" + httpGet: + host: uuaPC + path: Mpxk6p + port: -297149767 + scheme: 這伦礗鯪àe]雚腴k£ɂ闧ɦĚH鏰浳 + initialDelaySeconds: 296244720 + periodSeconds: 1237321103 + successThreshold: 722306410 + terminationGracePeriodSeconds: 7739978307238029730 + timeoutSeconds: -2129506856 + resizePolicy: + - resourceName: NBfNOBC + restartPolicy: ƞdWǝi鎠R殩杜Ś晚尒尧ǐ; + - resourceName: oDw8xEb + restartPolicy: ja侬ƕ + resources: + limits: + BJcVkW: "0" + Ub5Spt: "0" + nWi63TNlCyM: "0" + requests: + e5vcw0H: "0" + eKz0z: "0" + gK: "0" + restartPolicy: 嗈ǒɟNǭ臥穥Ť + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - $拷霒Ø耖} + - ijĸN藬?w粯痵餒薃辕5勅ů + - 幒Ƹʁòĺǂ浼GX + drop: + - 宖 + privileged: true + procMount: 凝 + readOnlyRootFilesystem: false + runAsGroup: -7000080292188880782 + runAsNonRoot: false + runAsUser: 9107304642056618949 + startupProbe: + exec: {} + failureThreshold: -208121509 + grpc: + port: 133215347 + service: pj4Kw + httpGet: + path: hGLW3 + port: -239286046 + scheme: YsÌǮŦʁ¡ē峪3 + initialDelaySeconds: -817672524 + periodSeconds: 1846655614 + successThreshold: -243958761 + terminationGracePeriodSeconds: 4190490525804645179 + timeoutSeconds: -973067987 + terminationMessagePath: 9vMe3Y + terminationMessagePolicy: 雍Wȯ嘷台厃$Țʍ13b霞两e + tty: true + volumeMounts: + - mountPath: yZbL + mountPropagation: 鲫絎Q(銞ÎÕX堙Ľ銃曅注t锋ɮj覧« + name: UFfAqsgd + subPath: wSo + subPathExpr: bIsBP3O + workingDir: DYBcINRq +- command: + - wgBryFN + image: NorbK + imagePullPolicy: 鉓Ĕʠ;兮)Frë + lifecycle: + postStart: + exec: {} + httpGet: + host: Z + path: 3v + port: W1vDkt + scheme: ŷ索gp=ŵāǼ餆嬦Ƹl媓R}豟ɠĖ. + sleep: + seconds: 1583583004300077159 + preStop: + exec: + command: + - XztEol6So + - GveA + - H4aUl + httpGet: + host: 75LDW + path: nu + port: I + scheme: 胛Uȁ¬ + sleep: + seconds: 4617693270470586770 + livenessProbe: + exec: {} + failureThreshold: 1423393786 + grpc: + port: 2097410769 + service: "" + httpGet: + host: W7 + path: PyPprD6 + port: dHwCyz + initialDelaySeconds: -1439644816 + periodSeconds: 182024489 + successThreshold: -1861505070 + terminationGracePeriodSeconds: -4166230023615503394 + timeoutSeconds: -704907360 + name: sFz5 + ports: + - containerPort: 1977465061 + hostIP: kxqRig + hostPort: 393211643 + name: DRO + protocol: ķǔȈ + readinessProbe: + exec: + command: + - mn + - 4TZCjrWPW18 + failureThreshold: 972699487 + grpc: + port: -1384519737 + service: IY5quWWV4JC + httpGet: + host: wq91i + path: Zy + port: -1192576969 + scheme: Á^_ + initialDelaySeconds: 2107832874 + periodSeconds: 1041520026 + successThreshold: -118135340 + terminationGracePeriodSeconds: -4946782594204672541 + timeoutSeconds: -1933961678 + resizePolicy: + - resourceName: MG7PMkMMObJJU + restartPolicy: §觫困Ȏ龝ƃȃɩ芴ÎĽ + resources: + requests: + I4: "0" + zLy: "0" + restartPolicy: 粛醑綇蝙Ɣò犁鶓A + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - 掀ǃA颺LnFąɏ動 + drop: + - 输6sĺ宯hĢ + - ĨƨO檔暰z + - Neɬ慿Ȁ0ɳ蠈ǚǦO¸Ğ崔ʂ¢剚 + privileged: false + procMount: 翄怉DžǬ?胉獄ǙƊɚx虉F + readOnlyRootFilesystem: false + runAsGroup: -1943526545280953812 + runAsNonRoot: true + runAsUser: -7089742793545456579 + startupProbe: + exec: + command: + - hDj + - ONyz91fkTFY9t3 + - ynDWkO + failureThreshold: -5561223 + grpc: + port: -1069825885 + service: oQmy + httpGet: + path: l4sWc + port: 53AhP + scheme: ȩ + initialDelaySeconds: -6165070 + periodSeconds: 1844899228 + successThreshold: 903779261 + terminationGracePeriodSeconds: -3909221818854749789 + timeoutSeconds: 746670574 + stdinOnce: true + terminationMessagePath: egr00cLki + terminationMessagePolicy: ɯ2鰌^坪yN蠏Ĵ + tty: true + volumeMounts: + - mountPath: YOyu1MjxN2 + mountPropagation: :鸛o鮓L`<]ơ1b忙n鲃{< + name: dODfVz + subPath: ZknFq + subPathExpr: oX1n + - mountPath: 4TEsoc + mountPropagation: 帺Õ斯剅ƫf鳌麓HƸŘÂ瘖?謾軌 + name: hau + subPath: w24Wq4e + subPathExpr: i2TEix + - mountPath: uuujj + mountPropagation: 氻ʃ2NFJ啼铗"O{À-ŧLJ弟 + name: klnXhhnxKk + subPath: SEx + subPathExpr: CK2FmmyYThL + workingDir: NCvZAa +extraEnvFrom: +- configMapRef: + name: nJXDn + optional: true + prefix: g3ZpAEUJC + secretRef: + name: 5Yin + optional: true +- configMapRef: + name: spYG9o0 + optional: false + prefix: Wv01 + secretRef: + name: BxDbe + optional: true +extraVolumes: +- name: 1zZI6J +- name: D +- name: OUqOnvjvba +fullnameOverride: llK4G +image: + pullPolicy: "" + registry: mU + repository: xY76Tj + tag: AgKh6S1 +ingress: + annotations: + Lhm: f24CRNEJvs + pk6fq: "2" + className: EXqR + enabled: true + tls: + - hosts: + - xEciJGskt + - pBxfBltrqACoat + - INyj + secretName: Qy + - hosts: + - F6sf + - EHuJ + - 95my0 + secretName: XOIr +initContainers: + extraInitContainers: nNSsTt6 +livenessProbe: + exec: + command: + - poXliUr + - PT + failureThreshold: 1396135036 + grpc: + port: -224883306 + service: 3pE97 + httpGet: + host: aUivZn75m + path: ELvTnGaV + port: uLGz4AgHb + scheme: ʟ#ĭ輑槳桓ȡȰ-o廕óʒÉ帇ʗ + initialDelaySeconds: 1526591550 + periodSeconds: -972224922 + successThreshold: -39437670 + terminationGracePeriodSeconds: 2216517890191965292 + timeoutSeconds: -1229662908 +nameOverride: wB +nodeSelector: + ih: xT3Dk3PXT + xhq: vu + zLR9: wFjrfu +podLabels: + So: waKMMvnY + VXPE0: 8ExVsj + ip1RGEzt4t6: "1" +podSecurityContext: + fsGroup: 7101468120327600630 + fsGroupChangePolicy: ȴ鳁ƨ殳h`熡ƍʊ0ŀ擳琗图.AƱX滋 + runAsGroup: 4262945102741076844 + runAsNonRoot: false + runAsUser: -9214274730002703336 + supplementalGroups: + - 4135587743067906306 + - -2908166639165702539 + sysctls: + - name: Yo9 + value: zak2 +priorityClassName: WeB9y8 +readinessProbe: + exec: {} + failureThreshold: 1061708880 + grpc: + port: 241985990 + service: 4id9HdK + httpGet: + host: PcSuBI + path: X5YjgFI2n + port: -1395013021 + scheme: Ȁ/ŚDŽR²庭$ê-d蟄Ä + initialDelaySeconds: 1618839364 + periodSeconds: -2098998213 + successThreshold: -846859522 + terminationGracePeriodSeconds: -4028618433241851907 + timeoutSeconds: 1824930679 +replicaCount: 371 +resources: {} +secret: + create: false + enterprise: + licenseSecretRef: + key: "" + name: be + kafka: + awsMskIamSecretKey: fs + protobufGitBasicAuthPassword: pUSXv + saslPassword: 1tdj + schemaRegistryPassword: iEgQQMH + schemaRegistryTlsCa: TlBV301 + schemaRegistryTlsCert: fRDnVgKC + schemaRegistryTlsKey: 0yblU + tlsCa: 4tIzJcND + tlsCert: NLnN + tlsPassphrase: iI + login: + github: + clientSecret: WHD + personalAccessToken: 9B7Wu + google: + clientSecret: UZnD3r + groupsServiceAccount: 9b + jwtSecret: cdvBine + oidc: + clientSecret: rQyq1alKY + okta: + clientSecret: ED1 + directoryApiToken: p + redpanda: + adminApi: + password: CWqwAXxFtl + tlsCa: gDQRbrAC8l + tlsCert: EDjU6 + tlsKey: Zm +securityContext: + allowPrivilegeEscalation: true + capabilities: + drop: + - 退晦Ţ鲛 + - '}ʄ攏嫫;Mǐ豒ɇf,搅Ð貑ș|Óf' + privileged: false + procMount: D + readOnlyRootFilesystem: false + runAsGroup: 1564095685271138849 + runAsNonRoot: true + runAsUser: -3929576237300142573 +service: + nodePort: 312 + port: 418 + targetPort: 486 + type: aaIqePq +serviceAccount: + annotations: + QHMG: ur9Qr + ZQRGr8gxPSL: BzNE1Ja0avq + yKwL8DJSG: SRC + automountServiceAccountToken: false + create: false + name: zpH +strategy: + rollingUpdate: {} + type: ȁ进辫fu +tests: + enabled: true +-- case-033 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchFields: + - key: 1O + operator: 拺5ř(Ƅ餕ʟ{鐻Ƈ + weight: -2070567569 + - preference: + matchFields: + - key: JlGR + operator: 脱?ĶA蛜頒ǽGǷ藸 , + values: + - 8zZEVom + - TY + - FSSQQ + - key: w3C + operator: sɯeM^筘褑 + values: + - Q + - i48uKb + weight: -1969968900 + - preference: + matchExpressions: + - key: ZsgVr + operator: Eȗ + - key: RfMZL + operator: "" + - key: r + operator: džɬ毿鵮V町iAÉ橁zy题ʔu7ÆO9 + values: + - uj8h + matchFields: + - key: "" + operator: :止褮Ȃ宸 + values: + - 9h + - Do + weight: 1160212382 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: nmW + operator: '%U<Ȫk7家fƥ降]:' + values: + - e4hDXWb9G8Qi + - SynNDfUn + - C8kz + matchFields: + - key: QO0Q + operator: l!m0ʒbƹ豫ň + values: + - eh + - key: VE5mZtP + operator: ~x蹵#ÂvǗRɩ啭Ö澭肞¤7跜庛Ɍ + values: + - yT + - key: 1Cony + operator: 阃 + values: + - ahj6j + - matchExpressions: + - key: TvhlZutK + operator: 5叹ùz + values: + - rog + - key: qLPNTFw8 + operator: 藘鸘Œé溇ʄsoɷƱǺȾ蹾K混īl軇 + - key: F + operator: 則Yǹ郰饉貓伜ſ0|麊 az襽准 + matchFields: + - key: VcfFwmb + operator: WJMU狰槃žiǶq挿} + values: + - b7G + - "" + - wzxeij27DD + - key: "" + operator: 殀ǥ + values: + - "9" + - 0E3EkrfSX + - vzth + - key: omoz + operator: e´Ģ桇适TŽǤʈ + values: + - TVj0W7 + - 7HjUt2w + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: nN1614M7 + operator: '鰺/堅ý髉铊ɇƴ2友凇3 ' + values: + - D0tt + - sG9E + matchLabelKeys: + - l + mismatchLabelKeys: + - vqTKCL2D + namespaceSelector: + matchLabels: + LIgB: qqC9YL + namespaces: + - BLdVDzfY + - eq + - qB + topologyKey: qwces + weight: 899210618 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: hIz8wo + operator: ĥ\{ė + values: + - ZwYh1 + - 4l9U + - Q5Io + - key: sd3eCUDob + operator: 蒴ǚ<灁Q柷娸颂嘃üĸƢı + values: + - U0 + - "" + - WXJjoBRKrfEY + matchLabels: + QSrEl7t0: hxsiSGCubb + mismatchLabelKeys: + - PiUy + - VhBWFCyx6C + namespaceSelector: + matchLabels: + G: 07tU6 + ZCO1QQK: b + uq: HISLIo9ZC + topologyKey: 87eQuI + weight: 1750437304 + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: nK0RSDE + operator: R(陛m诜ȯơȴ豨躻 + matchLabels: + CE9: u8FukDT + U5N: "y" + matchLabelKeys: + - 5I6wiiY + - JDZsP + - zGyW + mismatchLabelKeys: + - 4WZHZ + namespaceSelector: + matchExpressions: + - key: N9E9 + operator: ȅ)礯占鷨ʫɩfǡnʎə掅Ux曶HŁ遐 + values: + - JdC + - 3NS25HFHxU + - key: "" + operator: ı獗& + - key: q + operator: 髢£Ȋ泽ZwVfc剻Ţ嬊j + topologyKey: "" + - labelSelector: + matchExpressions: + - key: Tof0 + operator: ĥM:ɑȏF叆綯炩藁û漄f + values: + - jTpj + - gYZ8IIq + - key: avL + operator: ɼƌ壟.敾¦ + matchLabels: + P1w: Nb9t3e + matchLabelKeys: + - TkIx94Dmu + - 8KVE + - UEJW + namespaceSelector: + matchExpressions: + - key: gQOOR5Pz + operator: Ȁ蛝畆粔辧殤,ǔžɨʜ + values: + - MiGt + topologyKey: nn1x + - labelSelector: + matchExpressions: + - key: C + operator: 瘎%瑧¹$兤 + values: + - p5TR + matchLabels: + c9PNRTZ: L + matchLabelKeys: + - 9xrNO + - saFgUzTD530EV + namespaceSelector: + matchExpressions: + - key: "" + operator: 琨j貙ŰĤ煾骣ƢƐ肾Q`ĥ?舶 + values: + - "7" + - T4pSI + - key: u0lbHcT + operator: čÉ壶霻*ǻ蠦Źê潡%!Ȱʁr.ň沀痊 + values: + - voUu0X + namespaces: + - tX + - uDgtoDt + topologyKey: "1" +automountServiceAccountToken: true +autoscaling: + enabled: false + maxReplicas: 264 + minReplicas: 267 + targetCPUUtilizationPercentage: 341 + targetMemoryUtilizationPercentage: 404 +commonLabels: + gZ85uw3T: e + qO: F4dqLo67vKYZ +configmap: + create: true +console: + roleBindings: + - 7x: null + Ia1K2tdRuYi: null + j6c9: null + roles: + - {} + - 6Vndf: null + f: null +deployment: + create: true +enterprise: + licenseSecretRef: + key: 9y6KmPZ + name: QM +extraContainers: +- args: + - 3OUsoZkVHy + - Gn3 + command: + - NLtY + env: + - name: 51Xcm68sAs + value: PUTq + valueFrom: + configMapKeyRef: + key: udLx6h9 + name: wSgnPbc + optional: false + fieldRef: + apiVersion: oVPbc + fieldPath: CGK + resourceFieldRef: + containerName: Ind7j + divisor: "0" + resource: 9tlZc + secretKeyRef: + key: z2i + name: aloI0W + optional: true + - name: nGb + value: I91 + valueFrom: + configMapKeyRef: + key: Ft8IZO4DX + name: 7PY9CO1 + optional: false + fieldRef: + apiVersion: DysSUO + fieldPath: M + resourceFieldRef: + containerName: i + divisor: "0" + resource: mbVAnrQ + secretKeyRef: + key: ZVD + name: 4gLX + optional: true + - name: SEd7KC2 + value: I0 + valueFrom: + configMapKeyRef: + key: 71k + name: B + optional: true + fieldRef: + apiVersion: vJE + fieldPath: nvSzEcQ + resourceFieldRef: + divisor: "0" + resource: fYaXGkFYlrz + secretKeyRef: + key: xDT4Uhi + name: a + optional: false + image: NLoqH + imagePullPolicy: U肵銨龋搁}ŗ=;ī篱ɺ頁掆薑 + lifecycle: + postStart: + exec: + command: + - NAmBp8Ijy9vgKS + httpGet: + path: GukCZ + port: umdXEe + scheme: ɭL莒ƠĦZ¢.0tȠȴF梩¯牏GȐ + sleep: + seconds: 2463489515348869616 + preStop: + exec: + command: + - RAP7lxh + - 0WRf37xLvaEE + httpGet: + host: Xi + port: 395093084 + scheme: '}Ä*諓懚泾ıɥ磀>ȃÓ愍瘞5' + sleep: + seconds: -2989387296528249021 + livenessProbe: + exec: + command: + - AondI + - CvX + - X9Dwm + failureThreshold: -1669443788 + grpc: + port: 1602861347 + service: 5dF71q + httpGet: + host: yOYLS + path: m99M + port: 1421693426 + scheme: cǶ嫙x勬´筮 + initialDelaySeconds: -348887387 + periodSeconds: -855526929 + successThreshold: -1868658835 + terminationGracePeriodSeconds: 7220662525875543964 + timeoutSeconds: -893266456 + name: 62y7 + ports: + - containerPort: 41082986 + hostIP: H + hostPort: -671022955 + name: Q + protocol: Ģ + - containerPort: -676585553 + hostIP: jdTqIIXMX + hostPort: 441858691 + name: bam + protocol: ã鯑 + readinessProbe: + exec: {} + failureThreshold: -1607827734 + grpc: + port: -732628448 + service: d + httpGet: + host: q2uSglvPX + path: 5YB9kNfy37 + port: -425352890 + scheme: ZʇįʔÌ玫Ʊ儝$緀ƥǣ鮀 + initialDelaySeconds: 1646541382 + periodSeconds: 597275764 + successThreshold: 1444783765 + terminationGracePeriodSeconds: -4224719974242331571 + timeoutSeconds: 1778484407 + resizePolicy: + - resourceName: YWwAdc + restartPolicy: 蓊ƽqs洊蛀Ƴ澠誉 + resources: + limits: + 9c5: "0" + DJI: "0" + uyw: "0" + requests: + 7livK1: "0" + PWZFD5fFpVA: "0" + restartPolicy: ǐ踊丸y苡汎0塛yM眗酊L攚dzyÚmG + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - țƒ摨1娣Q札遢ʌā4魯 + drop: + - W~ + - ȮnLv|麬O稕Ʉ幖0Ţ&揵¸ + - àPĪɉɯ鋹芨ȲƿƛĞx + privileged: false + procMount: ɉq$|ŀ蘨寱彣ɎȈORe]O掓I + readOnlyRootFilesystem: false + runAsGroup: -2438856757446632999 + runAsNonRoot: false + runAsUser: -8511671649189408390 + startupProbe: + exec: + command: + - "" + failureThreshold: 157629836 + grpc: + port: -20533111 + service: vASy4b + httpGet: + host: 94HpH + path: t70 + port: W59mpID + scheme: ħ6琏 + initialDelaySeconds: -146258274 + periodSeconds: 47385732 + successThreshold: -1646222325 + terminationGracePeriodSeconds: -5575789846018254584 + timeoutSeconds: -351943504 + terminationMessagePath: r0ZY2 + terminationMessagePolicy: 傂G嶃a橢抴=Ȃĺ庆ɏ鬹揖絴鹥ɣ¸Ȫs + tty: true + workingDir: XFFilzd +- command: + - VSuU6yfyc8y + - gLgP + env: + - name: PSOr4 + value: m2ujo1f4 + valueFrom: + configMapKeyRef: + key: B9Gc + name: BaR3c + optional: true + fieldRef: + apiVersion: OFu + fieldPath: Pydi + resourceFieldRef: + containerName: jPiF + divisor: "0" + resource: jyp8A7uPD + secretKeyRef: + key: fcGCM + name: Hs + optional: false + - name: Ax9HfRa4p + value: S3R2 + valueFrom: + configMapKeyRef: + key: ZDzzhFD + name: soDgOej + optional: false + fieldRef: + apiVersion: iSfQ + fieldPath: Plzxy53z + resourceFieldRef: + containerName: DfBt3S + divisor: "0" + resource: 757s44h + secretKeyRef: + key: bn2IGjj + name: x8E + optional: false + - name: r + value: PmO + valueFrom: + configMapKeyRef: + key: Htzib1 + name: gfbsiTcDY + optional: true + fieldRef: + apiVersion: Frhab7p2yh + fieldPath: K6XKg + resourceFieldRef: + containerName: CLX + divisor: "0" + resource: cq + secretKeyRef: + key: R + name: zPHkUHXQ + optional: false + image: bSZCow + lifecycle: + postStart: + exec: + command: + - "y" + httpGet: + host: 2cDO + path: L5m + port: yhJI + sleep: + seconds: 6222265361848815058 + preStop: + exec: + command: + - yVT + httpGet: + host: Ibt0C5XF + path: Kf7kW1 + port: Tlj66QW + scheme: 砰僮 + sleep: + seconds: 4926532563180301873 + livenessProbe: + exec: {} + failureThreshold: 982752870 + grpc: + port: -257993986 + service: XKTDj + httpGet: + host: 7vfaAybCd + path: GuTTi + port: 1952486193 + scheme: 馾耼qȩ罔磙ɮƥŴ²叇yēņȮ藺 + initialDelaySeconds: -817095459 + periodSeconds: 603211453 + successThreshold: -1693358568 + terminationGracePeriodSeconds: 3002071779676478929 + timeoutSeconds: 992801771 + name: 9QZX + ports: + - containerPort: -1838828544 + hostIP: cQQMftB + hostPort: -321659395 + name: XBD7a + protocol: '>V>ŝO随;YƁ' + - containerPort: -439290918 + hostIP: Bp0lf + hostPort: 431013681 + name: WQ5qc + protocol: 髄Ĝ估螗ȳ鎷ʫh + readinessProbe: + exec: + command: + - PjwAB3G + - k + failureThreshold: -2015478850 + grpc: + port: 156976837 + service: RSgDfH + httpGet: + host: Yi7aQ + path: 8Ql9 + port: 1150587533 + scheme: C箿i綔ȍȢ ŅŴ娒燸孆5乬瓤Ɛ + initialDelaySeconds: -486757233 + periodSeconds: -994300453 + successThreshold: 2128356439 + terminationGracePeriodSeconds: 4683705418302064343 + timeoutSeconds: 1635565784 + resizePolicy: + - resourceName: deutsepb + restartPolicy: õ崑o¾oɞø°ŮƑ欩Ʋ + - resourceName: WaO + restartPolicy: ±蜊ư蕭材y昍U + resources: + limits: + XiOokB: "0" + gxJ8zn4y: "0" + requests: + "": "0" + RFaH: "0" + restartPolicy: 7岻ðȸɉo熮燍ȉ=n + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - 迠譚綞撪颫,ʖʃ佞诌Ŧ丞śɧ璯PʥT + privileged: false + procMount: 荞£DS + readOnlyRootFilesystem: true + runAsGroup: 6728166770219183734 + runAsNonRoot: true + runAsUser: 2918288689668335051 + startupProbe: + exec: + command: + - o + failureThreshold: -949081542 + grpc: + port: 220928812 + service: EIuHGNT4 + httpGet: + host: 21BmFcJ50ov + path: WC7WP + port: njQtxPF + scheme: 鲰ʌȱ卹烛橇淃ō雀)缅tb憅棔JǓ*ɒ + initialDelaySeconds: 1631334347 + periodSeconds: -785602818 + successThreshold: -1111896125 + terminationGracePeriodSeconds: -8014749222013301241 + timeoutSeconds: 795835881 + stdinOnce: true + terminationMessagePath: m08AZSt + terminationMessagePolicy: 盛P1砦ǚ瀱#Ʌ穇嘜\Ɍ + volumeDevices: + - devicePath: NdQPZme + name: uHcdGnKv + volumeMounts: + - mountPath: IX + mountPropagation: diȔiN6ļɃƐ釭卬O + name: fPg + subPath: iY + subPathExpr: U + - mountPath: E + mountPropagation: 1ĵ氓ŝ瘛o扬=[蟗 + name: xt + readOnly: true + subPath: 2KRhR + subPathExpr: Vm0HMwn + workingDir: jusEo +- args: + - Ejt + - DYgNM8X + env: + - name: HkwQ + value: fpHbv + valueFrom: + configMapKeyRef: + key: 3e + name: Q + optional: true + fieldRef: + apiVersion: lh + fieldPath: "" + resourceFieldRef: + containerName: E1uEhn3 + divisor: "0" + resource: 0Pa + secretKeyRef: + key: co85cv7H + name: KL1I3G + optional: false + - name: 5MQMJhqUni + value: 34PEKwUkR + valueFrom: + configMapKeyRef: + key: ABhM + name: qq5b + optional: false + fieldRef: + apiVersion: vCLN + fieldPath: tge3Z + resourceFieldRef: + containerName: ST + divisor: "0" + resource: qFS8 + secretKeyRef: + key: Am + name: BLI353a5GI + optional: false + envFrom: + - configMapRef: + name: KBum1 + optional: false + prefix: 56g + secretRef: + name: zt5 + optional: true + image: XgUFG + imagePullPolicy: 锄ģnj[眈例ƚ淍ƁĐ~ + lifecycle: + postStart: + exec: {} + httpGet: + host: Yp7F87b + path: "y" + port: OtElY + scheme: ǐʮŕ + sleep: + seconds: 640752187186511134 + preStop: + exec: + command: + - 4GYkI2pQ + - QB + httpGet: + host: DFjlmWGAFM + path: qLfFaRePdtA + port: GTUH4 + scheme: 罛&ĥ顱Ƌ + sleep: + seconds: -1289822532228205848 + livenessProbe: + exec: + command: + - youyR + - J + - IiK3AJ + failureThreshold: 527043957 + grpc: + port: -1790391516 + service: wFKNeu + httpGet: + host: TjItsuCL + path: Lo07CoiEpmJ + port: 1449812891 + scheme: 聗œdz_x忔8 + initialDelaySeconds: -923296146 + periodSeconds: -920279093 + successThreshold: 1372003156 + terminationGracePeriodSeconds: 4545671926845562588 + timeoutSeconds: -1730135112 + name: ouxZOTiA7 + ports: + - containerPort: 365499724 + hostIP: c3z3 + hostPort: -1622732613 + name: jfpQ + protocol: 鬍匤<ɔɟǜ鼴`ʃ荞ɗ线亮Ô¼ + - containerPort: 387750436 + hostIP: 7OF + hostPort: -922470687 + name: 20ZoNWnefc + - containerPort: -1003650010 + hostIP: yK31 + hostPort: -479225666 + name: 1Up + protocol: 郣-齡^c艃7ɑU牌驀墭:煞 + readinessProbe: + exec: {} + failureThreshold: -189409295 + grpc: + port: -880806937 + service: N1zEO + httpGet: + host: vN9 + path: n8TKqPF + port: -995680865 + initialDelaySeconds: -2090855365 + periodSeconds: 1849358636 + successThreshold: 811072097 + terminationGracePeriodSeconds: -5833095732594202880 + timeoutSeconds: -65186305 + resizePolicy: + - resourceName: 9rUpDkTFnW + restartPolicy: KSʮ1ĩ`乀_Ɠ颩紵 慒¨ƶ挢¸s诡 + resources: + limits: + MYEa: "0" + ngW: "0" + requests: + 174vfq: "0" + restartPolicy: 軵ƿǽ嚢遳E + securityContext: + allowPrivilegeEscalation: true + capabilities: {} + privileged: true + procMount: Ő\烔Z座畄睸zɩCɎx簫S悍a + readOnlyRootFilesystem: false + runAsGroup: -6410700953715650696 + runAsNonRoot: true + runAsUser: -8187102783441071897 + startupProbe: + exec: {} + failureThreshold: 1640672315 + grpc: + port: -799307372 + service: w9KE22PLk + httpGet: + host: e6Zo4rWs + path: tscGwI + port: 2071839677 + scheme: '&ǂȞ<辳)9撆ʚ6&U}P%捸`y' + initialDelaySeconds: 652003075 + periodSeconds: 1077051101 + successThreshold: 1528128815 + terminationGracePeriodSeconds: -2176015428967645191 + timeoutSeconds: -998563216 + stdinOnce: true + terminationMessagePath: P + terminationMessagePolicy: 8痃v7ȱ噣愜Å%Ġ3 + volumeDevices: + - devicePath: k8uvc + name: GL + - devicePath: 31O9l + name: ivY + workingDir: PtgSFsc1GvC +extraEnv: +- name: RTz9f + value: kK5WtZCFpsl + valueFrom: + configMapKeyRef: + key: CB1UV + name: 0pF + optional: false + fieldRef: + apiVersion: xO4s + fieldPath: n2G + resourceFieldRef: + containerName: GmnwMQ + divisor: "0" + resource: yX30Dke4u + secretKeyRef: + key: vPbHh + name: oBAn1EoZmPzN + optional: true +extraEnvFrom: +- configMapRef: + name: lo + optional: false + prefix: mSdySXyKqEkl + secretRef: + name: t4daT3 + optional: true +- configMapRef: + name: IFTvBGq + optional: false + prefix: qKk6o + secretRef: + name: "4" + optional: true +extraVolumeMounts: +- mountPath: gRGvu + mountPropagation: Ŋ4ǔ盍薟惮睌ȿ濍ȯȀüƳ$ + name: oJv65V + readOnly: true + subPath: P20XHtoR + subPathExpr: SzD +- mountPath: xhuwGvn + mountPropagation: 搛悈nj鰣*颵俠Ʀ慫灗岵ȆǴ騔Ė栢č)q + name: ebDa1q2nKt + readOnly: true + subPath: "6" + subPathExpr: N0xOT +- mountPath: xHTM + mountPropagation: 0關ɮUeŪ + name: P8noEsWy3t + subPath: y5E + subPathExpr: oP2A6C +extraVolumes: +- name: MqQb15NA +fullnameOverride: foGC +image: + pullPolicy: 躂Qʢ瞶CǁȮ + registry: JWsGq + repository: JAUpWzFL + tag: 3WF1aV +imagePullSecrets: +- name: s1B +- name: R54rm +ingress: + annotations: + "71": 1aSj + B3N4dn: hsJR8Fl + S9: x8u + className: xm + enabled: false + tls: + - hosts: + - 6PBjnokDE5 + - df + - SMIi + secretName: VVeSdJP + - hosts: + - kY + - VSdS4nZ + secretName: rR5tuP +initContainers: + extraInitContainers: DZkf1 +livenessProbe: + exec: + command: + - b5k + - "8" + - 74zV7hI + failureThreshold: 604102540 + grpc: + port: 1351493068 + service: a + httpGet: + host: pbTe + path: l3E3mpnq + port: nBQsx + scheme: . + initialDelaySeconds: 93396392 + periodSeconds: 1323534907 + successThreshold: 2044410955 + terminationGracePeriodSeconds: -5171571423145940595 + timeoutSeconds: -725304614 +nameOverride: bCPeYVWao +nodeSelector: + TDma3: eGasO + cs6G: CyEFp0L + r: xdylcKb +podLabels: + 1bb6: "" + 3U: mfPv + T: Q +podSecurityContext: + fsGroup: -4412504815274791692 + fsGroupChangePolicy: Ȯƭhjb糯妔ȂǑʜ胴}轣 + runAsGroup: 3860793197532219812 + runAsNonRoot: true + runAsUser: -1963293898483195295 + supplementalGroups: + - 2429921255984048344 + - -2773566751575632894 + - 5629450590441918989 + sysctls: + - name: h + value: zKVw + - name: D5ekUqS2 + value: 5FxU + - name: dgHyyau + value: o +priorityClassName: uHKqx +readinessProbe: + exec: {} + failureThreshold: -1216486926 + grpc: + port: -173591622 + service: CPUt + httpGet: + host: hry + path: KRRaps9O + port: W + scheme: ƈ;黷ç駵P!瘠瘀/ǹ + initialDelaySeconds: -1636119248 + periodSeconds: -1587206371 + successThreshold: 1085720843 + terminationGracePeriodSeconds: 788084162692446331 + timeoutSeconds: 1603673472 +replicaCount: 390 +resources: + limits: + HS: "0" + sspp8OAsyF: "0" +secret: + create: false + enterprise: + licenseSecretRef: + key: enS + name: "" + kafka: + awsMskIamSecretKey: 6Rpozk + protobufGitBasicAuthPassword: b9bAHSr + saslPassword: xFMbXwVAO + schemaRegistryPassword: wMc7l + schemaRegistryTlsCa: Iqy + schemaRegistryTlsCert: B2Y5 + schemaRegistryTlsKey: ooeFo3mZ4 + tlsCa: YCVA9R6f + tlsCert: b5AAaCcgXX + tlsPassphrase: HVdFrCml + login: + github: + clientSecret: JWVOWiL + personalAccessToken: B6DA + google: + clientSecret: lk1l + groupsServiceAccount: KFTHdrXBq + jwtSecret: IfZ3S + oidc: + clientSecret: 33jad4PG + okta: + clientSecret: pEYKMXqE + directoryApiToken: S5N6 + redpanda: + adminApi: + password: cNTmA + tlsCa: Ymp + tlsCert: 5Xquj + tlsKey: f2AsWMK +secretMounts: +- defaultMode: 64 + name: v1bEam0d + path: WfYQ + secretName: FOCtz7x +- defaultMode: 494 + name: 2keqwtlu + path: hpZaUwi + secretName: 1dug +- defaultMode: 354 + name: RAI0g6yvn + path: bCeiaipj + secretName: "2" +securityContext: + allowPrivilegeEscalation: true + capabilities: + drop: + - ɇǎȬ+丰DZ}薞ɎƐ + privileged: false + procMount: Ȧ杖煃a/ɓ<3ő+笽pȗdzSj + readOnlyRootFilesystem: true + runAsGroup: 8336843233603802952 + runAsNonRoot: true + runAsUser: 956863148985923497 +service: + annotations: + lrtdFF: 60R7 + nodePort: 446 + port: 229 + targetPort: 59 + type: 2K35 +serviceAccount: + annotations: + M: 37JLL + TSllzWgI: ZA + gOSHO: 00aEHRLh + automountServiceAccountToken: false + create: false + name: S9Bk +strategy: + rollingUpdate: {} + type: 呇弰$腕煴贔棳軀+œʃǀŖ* +tests: + enabled: false +tolerations: +- effect: 酼駘宁ì<^ʉ逐GM¼韹宅劑圦ȢN鵸; + key: LjdOPUZjJ + operator: 窃銥ɺ嘭t緯ȇw,[t捻S麨vɂ閰 + tolerationSeconds: 1714321621775966634 + value: Uvm9nY3 +topologySpreadConstraints: +- labelSelector: + matchExpressions: + - key: AUro1 + operator: 聘 + values: + - x5E03owNK1 + - 61u06hoBRErcl + matchLabels: + HMA: 7iZSaiF + jCP15v: ksLC1iD + matchLabelKeys: + - cp + - CZpJKgP + maxSkew: 644443933 + minDomains: 1722624609 + nodeAffinityPolicy: ú(ʆɴȾ狍lfĒHȉ嫔7ix壿 + nodeTaintsPolicy: 遡lşř门Ǣl + topologyKey: qP + whenUnsatisfiable: "" +- labelSelector: + matchExpressions: + - key: i8xDfgO + operator: ʖĝ#烕ɋřĊI + values: + - bOA4n + - ByUsK + - key: 6fCdAFtmFF + operator: 靕ƭ錒Ĕ + values: + - JIMC2Pc + - a7wA08 + - key: xMn + operator: "" + values: + - gSa5XT + - 50IS6 + - "8" + matchLabels: + DoGCwvltR: vVXQcZcxdz + JLmhsQlh: L3AY0Pv + X9: U + maxSkew: -2038040013 + minDomains: -1884001920 + nodeAffinityPolicy: 嵋磋ɹ:ɢ慚TA烁.X幰 + nodeTaintsPolicy: 奒)ʅm=矕郔o鬻鴊ȵɯt债CŔ儤 + topologyKey: qkx4gKx7 + whenUnsatisfiable: 匊aO卞肝喚覕Ȭnr說ɉƢ/Æȧ婡賛 +-- case-034 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: {} + weight: -982889256 + - preference: + matchFields: + - key: XhG + operator: 萎Nc汏帞 + values: + - CY + - key: SQm3as + operator: :g憓痳ʑ^荔ĚE慮ǫ鶉 + values: + - gKNU + - "4" + weight: -2081315042 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchFields: + - key: "" + operator: '[棉' + - matchExpressions: + - key: YgpJq + operator: ës曬¡岹V瀈ȭ岅mK + - key: HKYARp + operator: '完RQ\u穩[憄籎禨 ' + values: + - 2wfWZQ9 + - key: M0 + operator: 酺縿Ȼ慭苾Ʉ6Ʀ + values: + - xr7e9 + matchFields: + - key: O + operator: 笿眷ē睡党ǎf鴋Ɗ給 + values: + - HjtABxYy + - key: TD8D + operator: Ȃ顈筻ůȳM!剢nZÁx.}鯡L颗eĵ + values: + - xDTUGq1 + - 9xI + - key: 2B + operator: ']ţ峝輴{ȳ鬻ŶøU)ŢŤ' + values: + - 8hQz + - BtJ6XJwj8 + - bB1HqX + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: QrP50c0 + operator: 2蕦!#ɺĠȿLy2ǽǃƝFʡ + - key: sh4AX + operator: '"ă粸Ǘ筽齣zƪƭŰ''鴚ǝʠƲy>A' + - key: AyAj1WrXn2nZbf + operator: 郥m,攃 + values: + - xuX0t + mismatchLabelKeys: + - 94CSmERwUUu + - "" + - 3lJqWyss + namespaceSelector: + matchLabels: + XPKK9buQTkk: hK + c6yMPKCuDUW: NaXtSSb31Vtc + topologyKey: 4IWq1 + weight: 1215591736 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: bKgv7w5BLU9 + operator: 佱$Ɛɯȳǚ½ȴk + values: + - Rc6Akw + matchLabelKeys: + - nj2vCk + - GT7VEmkOiP + - D81b9yrN + mismatchLabelKeys: + - xrrln + - "" + namespaceSelector: + matchExpressions: + - key: Okpa0 + operator: ȳɃ互B¸砂霿枹蔪 + - key: bG + operator: "" + values: + - 9Az3OOsKzxT + - qufp1g + - hPp0e + namespaces: + - ia + - wpgLWCg + topologyKey: t9 + weight: 1536631188 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: xCMZF2V + operator: p仯F寃Rm慽財Ū-宩>ɗ呈3嚱Y + values: + - 2IrEZ + - ox + - S1NOR4go + - key: M + operator: ƙ岉 ʛZ3 + values: + - 61kg + - gCY32n2G + - key: z7jqw + operator: '´鋁k透 ' + values: + - 3bI7Mo + - V15M6 + - Elw2un19FO + matchLabels: + "1": jTzLL + E3HVo8p: 8mRx + tHPA: X + mismatchLabelKeys: + - sA + - eKQcaD + - 67tHuF + namespaceSelector: + matchExpressions: + - key: CrZYZ + operator: FWɺŮ + - key: K7SRYb + operator: .ØƣƎ 對猣#倳s7Ǵ栔Ħn4 + - key: k2Bz + operator: "" + matchLabels: + r6: SsE6YhO00w + namespaces: + - bECP + - nZT + topologyKey: ATU + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: T8nB5f + operator: 虁Iɂ飇ě + values: + - bTYBHU + - PWWBtWcP + - key: BJo + operator: 焜Eâ簋@ʘ芮暸UĖ + values: + - DI + - dh9e + - 0hiMkvD + matchLabels: + 7TSrj3: t4aVDF0 + P8L: liB + TkxKc: 4k + matchLabelKeys: + - C + - Uxzu6ju3L0 + mismatchLabelKeys: + - 7JBQmr5 + - K2WwmaMb + - ZGo5q7x + namespaceSelector: + matchExpressions: + - key: "603" + operator: 溝ʫ"zNĂ + values: + - 217W38 + - DjaFqo + - 34Dd6xS + matchLabels: + Le1shqQ: q6Ra + jocxC9: 1wwizZ9OUc3 + t9v: p7 + namespaces: + - tNw7r0z + topologyKey: WB + weight: -695352638 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: Et + operator: "N" + values: + - iXi + - AZpWUZE + - bB + - key: 6e8xewD + operator: 拒D挼霘%Ǧ珕 + values: + - cLLOT + - LzhXzKVG + matchLabelKeys: + - v1hg0Fb0 + mismatchLabelKeys: + - i + - vh3C0ZF + - i694fjp + namespaceSelector: + matchExpressions: + - key: Rt + operator: 4%{ź*妻=舉佸EǩɛW杚察ű + values: + - gx + - x + - M0 + - key: S1J9kEl0 + operator: 湻膴L鮠#桽 + values: + - Lpx + - key: QzUh3 + operator: 閛V;Ĝ棱碗闃{竀%狮闀ʩE腡¹#C + values: + - qh0l + - Jgu1EIM + matchLabels: + tZ: y7 + u7: jkFA4i + namespaces: + - httsx + topologyKey: wNV2 + weight: -441999969 +annotations: + "": kBVzs + JKJQy: g8k + Zcnpm: TWUNV +automountServiceAccountToken: false +autoscaling: + enabled: false + maxReplicas: 23 + minReplicas: 122 + targetCPUUtilizationPercentage: 266 + targetMemoryUtilizationPercentage: 92 +commonLabels: + 0fz: qRhpB + blGSa: Hnim0SflkfpF +configmap: + create: true +console: + roleBindings: + - zktoFv: null + - BnTf: null + N30: null + O: null + - "5": null + up6oELWDxO: null + roles: + - 3vFSt6CV6h: null + - zwoEunAfS: null + - "": null + Kz: null +deployment: + create: false +enterprise: + licenseSecretRef: + key: wTtzVK + name: f +extraContainers: +- command: + - fbGgvGkx + - edBIWrM + env: + - name: 8jJnT7Zj + value: Mq + valueFrom: + configMapKeyRef: + key: JC + name: sVkSiknR2xCa3 + optional: true + fieldRef: + apiVersion: wANryBKXLB + fieldPath: NyZCECkxJ + resourceFieldRef: + containerName: OZ8 + divisor: "0" + resource: cmCxr + secretKeyRef: + key: DwO8j5 + name: B + optional: false + - name: EHh + value: QCji0tC6i + valueFrom: + configMapKeyRef: + key: WAw2dVgj1 + name: Ay + optional: false + fieldRef: + apiVersion: Qi + fieldPath: gpyTLtuoWjh2y + resourceFieldRef: + containerName: lU + divisor: "0" + resource: eblZRy9ULY2IzA + secretKeyRef: + key: mv + name: j + optional: false + - name: aUVmiB + value: kpqOP + valueFrom: + configMapKeyRef: + key: s + name: bQ6 + optional: false + fieldRef: + apiVersion: SdqbUuwjM + fieldPath: 2l + resourceFieldRef: + containerName: tw3t5LDN + divisor: "0" + resource: rwu + secretKeyRef: + key: 4BhlrEVh0 + optional: true + envFrom: + - configMapRef: + name: Hjuj9nlmmK + optional: false + prefix: 1f + secretRef: + name: ZAvqr + optional: true + - configMapRef: + name: xM7XvJNDv + optional: true + prefix: a3u3 + secretRef: + name: cvRqlow + optional: true + - configMapRef: + name: bRyp + optional: false + prefix: 5mEO + secretRef: + name: axWGwhmN + optional: false + image: EszTqv + imagePullPolicy: 輧脙ĭr恐荌ǩ\ȓȫ訷鿍湲瑁u楊禅ɤ& + lifecycle: + postStart: + exec: + command: + - WMJ1Vj + - bt + - UpuoW2L + httpGet: + host: ZQUCS + path: XvmuYh + port: p + scheme: 瘿ā|^k*雗 + sleep: + seconds: -4794985278116558932 + preStop: + exec: + command: + - fNY + - Rk + httpGet: + path: vcHj + port: 94X + scheme: ʕ煤}f + sleep: + seconds: -572101244460663065 + livenessProbe: + exec: + command: + - HoQxW7Nhx + - 1vL7TCk + failureThreshold: 1202856974 + grpc: + port: -177653984 + service: dd + httpGet: + host: cFj8k7 + path: l91YUo + port: -205856494 + scheme: '''朔6嚍¹*¢ɰȯK' + initialDelaySeconds: -1838390355 + periodSeconds: -2089935919 + successThreshold: 745930955 + terminationGracePeriodSeconds: 651854435833106407 + timeoutSeconds: -451727064 + name: LUkN + ports: + - containerPort: 52213129 + hostIP: pBen4iN + hostPort: -1605812710 + name: embL6 + protocol: 隠:ʀǙƴ茝鞝剟蚓遆積ǯ槦黽虼m + - containerPort: -1355336717 + hostIP: Vq9h1OAN6 + hostPort: 1469157628 + name: DgLmxr8 + protocol: ơ阆Ƃ + readinessProbe: + exec: {} + failureThreshold: 1404262379 + grpc: + port: 617847874 + service: wZ + httpGet: + host: 7f + path: 4gU9kDN5 + port: MXWfnK + scheme: 鬮ŵVƉ + initialDelaySeconds: -498539377 + periodSeconds: 1569378042 + successThreshold: 1909376148 + terminationGracePeriodSeconds: -3310812073755566654 + timeoutSeconds: 957960925 + resources: + limits: + 5k: "0" + wIlp6Km9XNo: "0" + requests: + RaT: "0" + restartPolicy: 车WđƜ嚓Ŭ罀ǑȪ + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - w}ɼ簖#s>腭hWɘnj嗠/ʜ墭呣lj + - dT劍Il捝s+;暷ƻņʖ馺ª贐 + drop: + - '*¢炐96ʑ叛z¢á5ɏeEɢ@Ƨ' + - ƭ樯Ɉ>ƈ@Ɨ + - ńɜʢnij咓ƹ灀}¿\ + privileged: false + procMount: 堲渢)#珯犠ƙYĮ鷝Ƈ蚈_ + readOnlyRootFilesystem: true + runAsGroup: 5272751894835649479 + runAsNonRoot: true + runAsUser: -777021971579066284 + startupProbe: + exec: {} + failureThreshold: 48102716 + grpc: + port: -1093646129 + service: bIKooEs + httpGet: + host: Mv + path: fstI2uQ + port: Qd + scheme: dzLBʖ飐吃ê傧靲dz + initialDelaySeconds: -187921670 + periodSeconds: -217914776 + successThreshold: -664446049 + terminationGracePeriodSeconds: 8083333456613274947 + timeoutSeconds: 399455066 + terminationMessagePath: jqUx + tty: true + volumeDevices: + - devicePath: LLB2W + name: kDDD + - devicePath: 9DhP1 + name: aW0PgFJODCAEF + volumeMounts: + - mountPath: "4" + mountPropagation: ;bŊcN啲;蜩½ǒ朒Q"EƙȌ{甐岊 + name: c + subPath: c + subPathExpr: cXqUzbd + - mountPath: NY + mountPropagation: ʋS溸呖Ä翫ɧȐ{豒lÔș:ľ玠3íw + name: 7nseZUY + readOnly: true + subPath: itHF + subPathExpr: eHexIOW + workingDir: BZZ6 +- args: + - 5cCg + - E7 + - iFP6rZ + env: + - name: qEiC5K + value: HE + valueFrom: + configMapKeyRef: + key: Q4ff + name: c6s + optional: false + fieldRef: + apiVersion: jBI6X + fieldPath: zpTUfYD + resourceFieldRef: + containerName: mzmkl8 + divisor: "0" + resource: 81k8LI + secretKeyRef: + key: "" + name: N9yqj + optional: false + envFrom: + - configMapRef: + optional: false + prefix: WYG + secretRef: + name: DFBRLWb + optional: false + image: Z + imagePullPolicy: ǂAM鳘墊šéDz!迒A + lifecycle: + postStart: + exec: + command: + - r + - RbH + httpGet: + host: FG + path: gzf4kd + port: 813947014 + scheme: '&X垮Ą:S褦慺ʛ竆閃_m鑙òó' + sleep: + seconds: -1141547218815402249 + preStop: + exec: {} + httpGet: + host: ZA8qVd + path: 9ooQ + port: -271801527 + scheme: 鏡稂;ňȓRH愦Ƚ + sleep: + seconds: -8502483422139801966 + livenessProbe: + exec: + command: + - I4WNnF + failureThreshold: -637772395 + grpc: + port: -1513640963 + service: CpWh0e + httpGet: + host: JrZk + path: YCnQ4z + port: 13mIiI + scheme: 鏘 + initialDelaySeconds: -200843985 + periodSeconds: -502259067 + successThreshold: 1719668769 + terminationGracePeriodSeconds: 6044193620909725026 + timeoutSeconds: -388757192 + name: Vem + readinessProbe: + exec: {} + failureThreshold: 1932036046 + grpc: + port: 940655155 + service: h5HN + httpGet: + host: H + path: G1p4WFvGD + port: iMuM + scheme: ŗ颁njNą筵 + initialDelaySeconds: 271733079 + periodSeconds: 1483111043 + successThreshold: -1186732202 + terminationGracePeriodSeconds: 8539189418162863572 + timeoutSeconds: 1565787262 + resources: + limits: + AfrFB6Ne: "0" + UFzEjwa: "0" + regGR: "0" + requests: + 30st: "0" + restartPolicy: Ǫ豥ɗ槻T+Ĕʓȣ+卮Ȱ + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - 1蒟顨ƽėȰ + values: + - TGv + - VVtqHApm + - 7Mub + matchLabels: + PI: elzxW + Wd1Q: MYEPScu1su + i: uENdc + topologyKey: QlwUBoDWM +automountServiceAccountToken: true +autoscaling: + enabled: false + maxReplicas: 367 + minReplicas: 105 + targetCPUUtilizationPercentage: 126 + targetMemoryUtilizationPercentage: 500 +commonLabels: + 5NU: UG7t + 6NmZI: QxuTdplvdDdc + BYcISWrd5: YZbXA +configmap: + create: true +console: + roles: + - CSJ: null + - 0hM2tbS5: null + ZhG3M: null +deployment: + create: true +enterprise: + licenseSecretRef: + key: xLO4B2BCZUJ + name: BQR2Y +extraContainers: +- command: + - DlBCuc8xa + - X2hi8Mp + image: 00GQ5 + imagePullPolicy: 賎ʂG}Ƌ煚6ūaĠ腻f + lifecycle: + postStart: + exec: + command: + - mVlE + - cFmlozRTJ + - "" + httpGet: + host: RIzcOYFo + path: eZge9wzJjW + port: ugY08 + scheme: 讣Ɨƶ"ɇǘƓƮ + sleep: + seconds: -5362042555365295319 + preStop: + exec: + command: + - "" + httpGet: + host: hLxRfJhv + path: JA8kOIY + port: tpH1 + scheme: '''k:嘡葊佒ďȏǓɡ毫/视倴ĩ}Ɓ u' + sleep: + seconds: -915316715834475044 + livenessProbe: + exec: {} + failureThreshold: 1628387875 + grpc: + port: -119747124 + service: 3cnWKI + httpGet: + host: 6Wzb9 + path: Af + port: RAzYX + scheme: 嘾Q經f + initialDelaySeconds: 4951530 + periodSeconds: 1309655668 + successThreshold: 918641827 + terminationGracePeriodSeconds: -3073080783253286451 + timeoutSeconds: -1896420637 + name: yML27O + ports: + - containerPort: 509868797 + hostIP: XMFIjyy7MNejY + hostPort: 2083818454 + name: gd + protocol: 槏 R¨ƽT³簑ƤA$<猿.0d + - containerPort: -164866787 + hostIP: eh + hostPort: 1842390272 + name: H7 + protocol: y擫`/洄]ʢÓ7Ā紐ǟ塋 + readinessProbe: + exec: + command: + - 5MrELPMn + - 23x1a + failureThreshold: 1394382122 + grpc: + port: -96138878 + service: DBq + httpGet: + host: 60SrHkgc + path: OwZeja1P + port: 721461548 + scheme: ' `$ħ' + initialDelaySeconds: -2125734502 + periodSeconds: 66441733 + successThreshold: 130216629 + terminationGracePeriodSeconds: -7113768241875088710 + timeoutSeconds: -977567736 + resizePolicy: + - resourceName: 8VNf4C + restartPolicy: Ě} + resources: + limits: + 2TX: "0" + Yd3: "0" + avcFFX: "0" + restartPolicy: Ę<彪6 + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - ūW銹fn|óOB¶őǝ:ɛ暙- 嫴 + - 韣噺Ȑ主鋥Ɣ睩熾@Ĥvƈ + - 気ʎɭ愢勈īɔ垆ŀ槌,q儇p顼ǯ歳 + drop: + - EģIJ>筡|n譌ɶd2鍇$X/ȴ偎穾7 + - "赻探ǞiN胂a + name: 79CeZyd + subPath: xMQ + subPathExpr: NvU + - mountPath: smgfnmvP + mountPropagation: ʈ + name: CuKUC + subPath: hZ8KJ3 + subPathExpr: CK4WsX + - mountPath: zm + mountPropagation: 傩骟Ⱥ|尤fŇɓ呣ɘĩŽ + name: wRtUU + readOnly: true + subPath: T1 + subPathExpr: cidBhX8I + workingDir: M0jsi8 +- args: + - rQ7QBmZ4 + - Q32wY3lGUA + - VGeP + command: + - "6" + - 5vVr2Q + - 4YDd + env: + - name: DY1 + value: sge + valueFrom: + configMapKeyRef: + key: O8RUTpJ + name: SCF5ph + optional: true + fieldRef: + apiVersion: NY0hb + fieldPath: ViZ0f + resourceFieldRef: + containerName: "Y" + divisor: "0" + resource: sCX + secretKeyRef: + key: Ma + name: 6s6lc5 + optional: false + - name: m19lk2eiDtcdB7 + value: 0JaB + valueFrom: + configMapKeyRef: + key: VolU + name: jnFjMLIQ19 + optional: true + fieldRef: + apiVersion: "6" + fieldPath: N0wIEnFmQ + resourceFieldRef: + containerName: QwDG86d + divisor: "0" + resource: pda + secretKeyRef: + key: Uc7x1XF + name: efgc + optional: true + - name: 8A + value: 1kUmljHSb + valueFrom: + configMapKeyRef: + key: "" + name: z18yxT + optional: true + fieldRef: + apiVersion: 1qaE + fieldPath: vEzPx + resourceFieldRef: + containerName: GYhSz + divisor: "0" + resource: Ttq + secretKeyRef: + key: aaGRQS + name: C + optional: false + envFrom: + - configMapRef: + name: "0" + optional: false + prefix: 5cqcw + secretRef: + name: O7Gex12 + optional: false + - configMapRef: + name: DHEYwZ + optional: false + prefix: wSbyGx + secretRef: + name: 9nM86dZi + optional: false + image: E + imagePullPolicy: 栧Z + lifecycle: + postStart: + exec: + command: + - 6775E + httpGet: + host: hIoYmpbc + path: qEf + port: rnJpXG69m + scheme: 赙¯6a腚 + sleep: + seconds: 4894208532244895909 + preStop: + exec: + command: + - mHtY + - 0hh1Tr + - "" + httpGet: + host: BuElf + path: fJPDiyG + port: PybmIT + scheme: M*Ķ + sleep: + seconds: 7544543348205057985 + livenessProbe: + exec: + command: + - z7IJ + failureThreshold: -360493877 + grpc: + port: -1395908290 + service: zV1i + httpGet: + host: GLn + port: -279409955 + scheme: ǃU螄骰褃Ʀ诐Ɯ{,ɍb萎Ɲʢ鰪\U + initialDelaySeconds: 1831688310 + periodSeconds: -280461011 + successThreshold: 84363106 + terminationGracePeriodSeconds: 7513815341722354757 + timeoutSeconds: 442815657 + name: pGthpc + readinessProbe: + exec: + command: + - T39QO5 + - "" + - DbSsPel + failureThreshold: -1901163919 + grpc: + port: 1255815597 + service: xeTv + httpGet: + host: bipPJGJ + path: nghEbF + port: uyLPK + scheme: 翁渹牯澖 + initialDelaySeconds: 1295268788 + periodSeconds: 17921235 + successThreshold: -212369586 + terminationGracePeriodSeconds: 1061046207943693656 + timeoutSeconds: -1707711843 + resizePolicy: + - resourceName: RLHi + restartPolicy: 掳?帐(Ǖčĭ纜 + - resourceName: H1Bv + restartPolicy: Ɉ駃愝ɲƁ2*ʍJ蕦ʃĹr}尕5J埉g + - resourceName: f + restartPolicy: ɧ帨y晒ʪäǗ«ǤǞugT埤X澇寿Ù\ + resources: {} + restartPolicy: 7Y熀7rúǬ轘 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - Ǒn%Aʙ]m* + privileged: false + procMount: 鼷R珍沌 + readOnlyRootFilesystem: false + runAsGroup: -287129322294347273 + runAsNonRoot: true + runAsUser: 3942212766283409661 + startupProbe: + exec: + command: + - gN + - zpmlcJ + - DeLJ4s + failureThreshold: 102924404 + grpc: + port: -1304933194 + service: 0iK + httpGet: + host: jbg + path: ZqaSpx8C + port: UPJqfy9dOO + scheme: 韼QY岩沴ì釪儇9ĩN + initialDelaySeconds: -46268668 + periodSeconds: -1126074804 + successThreshold: -2093938118 + terminationGracePeriodSeconds: -3498490773203628311 + timeoutSeconds: -736335366 + terminationMessagePath: "7" + terminationMessagePolicy: 辺OB¯悱楆3Ǫ首傭ɟ鮛ïƇ豙ǁUȵ + tty: true + volumeDevices: + - devicePath: DSh1 + name: 1OMawuQAlZD7 + - devicePath: "Y" + name: liCI2j + volumeMounts: + - mountPath: JPO9Ewk3kgaeuBD + mountPropagation: k釂Żɮ>ɸêW箁B| + name: QGO7HtoR + readOnly: true + subPath: oYudCrOqA + subPathExpr: Z1oG + - mountPath: iH6 + mountPropagation: dP帗俪Ťŷ/6¤þ剛&Ģ趽qi + name: 9Ro4aQU5yby + readOnly: true + subPath: piBl3 + subPathExpr: nfDFn + - mountPath: uU2H4 + mountPropagation: ljQ + name: "" + subPath: rj2 + subPathExpr: E + workingDir: BveK3 +extraEnv: +- name: 14jKCyMC + value: Mb95Ivlchi + valueFrom: + configMapKeyRef: + key: FMRh9 + name: VwME2dRYnb + optional: true + fieldRef: + apiVersion: NlY1uxRPgql + fieldPath: NDrKU5 + resourceFieldRef: + containerName: gPQ1TD3MX + divisor: "0" + resource: r6HOpjj + secretKeyRef: + key: "n" + name: RQLa2rQL7Y + optional: false +extraVolumeMounts: +- mountPath: pqfdKzb + mountPropagation: "" + name: 6btv + subPath: xLjoA + subPathExpr: UseM +- mountPath: EYXxm + mountPropagation: 煊`ś蠶+蓲慅4曌Ƥ4臜.魼簌m缽荈巇 + name: 6ut6g + subPath: 7N + subPathExpr: ypY +extraVolumes: +- name: 00PT1WRWHX +- name: P4 +- name: fn +fullnameOverride: Bv0I +image: + pullPolicy: 垿儣Ƈ#WMƻ + registry: XB9ke7yB + repository: EwU0pzhz + tag: SmZAnO7 +imagePullSecrets: +- name: ygWNP7C0W9 +- name: lo0PU +ingress: + className: vg + enabled: true + hosts: + - host: daRMGxIy7gKoE + paths: + - path: GVhF41Ue + pathType: TeM8 + - path: UontjIzl + pathType: MN + - path: "" + pathType: xN + - host: YCgI + paths: + - path: MPhdfahEcn + pathType: ECPrn + - host: GDOlAVRM + paths: + - path: H5pExfzke + pathType: v8 + tls: + - hosts: + - dQiMWdJ8cYKS + - 35K + - 8Kin + secretName: C + - hosts: + - zPo + - Z7 + secretName: SiZz +initContainers: + extraInitContainers: ITIY +livenessProbe: + exec: {} + failureThreshold: 724782955 + grpc: + port: -2055628426 + service: kYxAdPiz + httpGet: + host: JfFu5eafS + path: S8lsKuv + port: 45830231 + scheme: 嵋6ǞkĤ閾8_Tu鍓 + initialDelaySeconds: 1633166106 + periodSeconds: 2105675880 + successThreshold: 225361138 + terminationGracePeriodSeconds: -5739612377473505352 + timeoutSeconds: -1665363921 +nameOverride: "" +nodeSelector: + LAqpO: N7lh0C2 + RqG8qj: ltTa5 + X3q: F5c +podLabels: + Klzm: we + e: C2swj + s: vw1lrq +podSecurityContext: + fsGroup: -8750452531563962174 + fsGroupChangePolicy: RȗɻÎ + runAsGroup: 3754171381447903160 + runAsNonRoot: false + runAsUser: 2565919490422334632 + supplementalGroups: + - 2907772986244331938 + - -4686580881125536152 + - -7134026849524391427 + sysctls: + - name: 8gezWufB + value: 2Jv + - name: 4nhjhT6P + value: 32ZuT + - name: cQk5tljX + value: Aimzt8kirN +priorityClassName: F +readinessProbe: + exec: {} + failureThreshold: -1128918125 + grpc: + port: -1566880140 + service: wMGGUi + httpGet: + host: EwUYUz5 + path: qC4K0 + port: frlhx + scheme: 2鳳ǿ{ǿN + initialDelaySeconds: -116128728 + periodSeconds: -1936485392 + successThreshold: -1735161598 + terminationGracePeriodSeconds: -4458812029359989949 + timeoutSeconds: -1293939870 +replicaCount: 464 +resources: + limits: + 0PRJ1bi: "0" + JUjtrq: "0" + WN9h: "0" + requests: + TCeGWCB: "0" + x5O0IxuN: "0" +secret: + create: false + enterprise: + licenseSecretRef: + key: Sfb6 + name: Fkoh + kafka: + awsMskIamSecretKey: Bof21IpUS + protobufGitBasicAuthPassword: fIQwt + saslPassword: KBS + schemaRegistryPassword: TehF8FK + schemaRegistryTlsCa: 40HTol + schemaRegistryTlsCert: cgz0Y9o + schemaRegistryTlsKey: QUpyP + tlsCa: naM + tlsCert: cC23TMJ + tlsPassphrase: NxVcNj + login: + github: + clientSecret: IDQ0 + personalAccessToken: "4" + google: + clientSecret: P + groupsServiceAccount: oKbW15 + jwtSecret: "5" + oidc: + clientSecret: YcYiIJm + okta: + clientSecret: CtRNDaLkEFXR + directoryApiToken: pH3E2YC7xP + redpanda: + adminApi: + password: "y" + tlsCa: 4ieHo3L + tlsCert: pQ6AshR + tlsKey: s9 +securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - '@晏駚T!UɎȉépg鎘Ȉ' + drop: + - ÚơĊ猴渋ĭ8膔櫔ż択ůĦ抹 + privileged: true + procMount: 偖躪 + readOnlyRootFilesystem: false + runAsGroup: -543916493751029755 + runAsNonRoot: false + runAsUser: 7772713475568767829 +service: + annotations: + C3p: uCspVMX + nodePort: 441 + port: 51 + targetPort: 456 + type: ZQQlqx7Np +serviceAccount: + annotations: + 7lpi: QQ + RK: "" + od3x: "3" + automountServiceAccountToken: true + create: true + name: HMyYp +strategy: + rollingUpdate: {} + type: Ʉ>朄崍ʡƥɼ戋\IJĹ +tests: + enabled: true +tolerations: +- effect: aƻƀi + key: 7II7D0fA + operator: 跳<ȴŤƇ梐ȸŷR + tolerationSeconds: -92963183946417046 + value: U +- effect: p鸿xś冣9ɩ揊Ů忁琺ȖP壡o繊堮 + key: 5sC + operator: XɦǨ燖Ż綯逆挤ʦ斝蟏滣ʣ + tolerationSeconds: -6405135249548565002 + value: c2m6hlo +topologySpreadConstraints: +- labelSelector: + matchExpressions: + - key: bsO + operator: Ⱥ8欟慡Ƿţ6氙絿鐘黬聠ç + values: + - hbuLC + - SdAZnchI + - key: b4Pjya + operator: jɀh5湧,Ȳǣ6謉<ɦ + - key: gXEm + operator: ',k涃栏岴g橚甇ȳ0禰餝榖睌ěB縩侾F' + values: + - q9VqX4l + - zoMoc9Vb5 + matchLabels: + B0T: uiIEpLD2 + V: jdhpTcaa + pz: V1dJXS8 + matchLabelKeys: + - yoFhTrxV + - o + maxSkew: -1837539887 + minDomains: 2144009248 + nodeAffinityPolicy: 怓覷環ʤ苷疿ʡB聧!]LJƱĿGť + nodeTaintsPolicy: V~0韾¾Ȣû&嵙纠&ȠVƧ鍌 + topologyKey: GldA + whenUnsatisfiable: Ƀk纩{寍HƋ&庝僟D徼聊 +-- case-036 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: bkwD5 + operator: B砟摫ʟ]估ȽÓĖ頒ʙǯ + - key: 4n + operator: "" + - key: DDWUTPllaee + operator: ǒ@訹Ðđɤ軗ɲǃZ袓6悔ʙ[x] + values: + - bHwxZg + - iPWF3DQz + - yhiFQZ98w6h + weight: -551427274 + - preference: + matchExpressions: + - key: kZ + operator: "" + values: + - BMfDa + - key: l + operator: unɚʀɂ7Ǩ蘕 + values: + - 1vsAjW + - lEGj0 + matchFields: + - key: EYCyU + operator: 袒雬Ǐ蔡|骐pOĆƍbʌʝl + - key: e9QdJHV + operator: Ɏ鼛鏗擌-悝Ű + values: + - DToToJ + - Gq4 + - key: M4b3wwVy + operator: 煛苅=İ哋ońɢ\Głh斳hɷ韙 + values: + - fMIoNrUiyJdi + - tcNEhOds + - N0 + weight: -906035045 + - preference: + matchExpressions: + - key: 05VafuKQo + operator: ƃèĢC篘 + values: + - McUwm + - oMXVW + matchFields: + - key: "" + operator: 9ȮLǟ3V廉\5膏ɩ袴 + values: + - t + - r8d6G + - FevHe + - key: KeJd9X4 + operator: \Y#uɆɫwĉɎ卲S + weight: -773391374 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: PiRY + operator: 週畯嘰Œ铖'ȸ0Į5k,逊 + values: + - Fo9oE + - KLfm4 + - PiZJC + - key: 6HCuuj + operator: Ȋ!ʈh牅HŹ蓓% + values: + - PU34U + - bZ12kwJ4s1 + matchFields: + - key: CCVSIZH + operator: (铴Njʦ釖Ĩ鎅ƒ獞p)唓u¸::2 + values: + - DjvLD + - key: 9gy6tFM + operator: ø + values: + - lPjPu0 + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 2oL + operator: Ì溄祤BNjɎ_ )jðZF + - key: Tl1mGP + operator: r0ȨȵeēP眼饾j + - key: 98uL + operator: "" + matchLabels: + "": H0F + IGfr: 8iR8 + pTjU: 2vy5Ol + matchLabelKeys: + - l2d3an + mismatchLabelKeys: + - gomcuJ + - UMhaBnQUuSH4 + namespaceSelector: + matchExpressions: + - key: CyYjfraf + operator: 鸫ʊűoǪĞ3 + values: + - uPW + - key: vuREiHB + operator: ^ĄçȂ挌 + matchLabels: + tlcI6jz: 87JK + namespaces: + - eUszN + topologyKey: yJ + weight: 1657692208 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 3d3mr + operator: 鿈Ė聭焚歉Ð(币帄Ⱥ + values: + - h + - key: Z5c + operator: ma琓 + values: + - i5Ae6oUo + - EWixIB + - "y" + namespaceSelector: + matchExpressions: + - key: XFYbW + operator: M~ + - key: lWHcsQ + operator: 铿X异~<ÿ缇ī*^ĩ + matchLabels: + s: l6sxM + vFiVA7j: WEOy1jtU + topologyKey: JW85dr45m2G + weight: 444678250 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: bMT + operator: ^)4ɊDZǸDŽ + values: + - CG9Onrt + - key: T + operator: ƞ傏 + values: + - bXs59oj + matchLabels: + 6BRwn: Pdm + Yy: aaoLnp + myN: rwJGrW + mismatchLabelKeys: + - "n" + - c + namespaceSelector: + matchLabels: + 5QMzPp: AP + D: "2" + u: Dca + namespaces: + - 8Af + - NYfxoYf + - R4G + topologyKey: yY + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 2uhHhqog + operator: Ȧ + values: + - YgsgGf + - key: EaR + operator: 愅YVǵ楔¢4Ʋ + values: + - xaEk + - key: NV5iPi5Kw + operator: ' 軕氡#晉Ʀ筜篧e蹶ʀSɟʂÊʕT' + values: + - BY4 + matchLabelKeys: + - 9fTYFH7s + - aK6HB6 + mismatchLabelKeys: + - 13L + namespaceSelector: + matchExpressions: + - key: 3FT + operator: Tğ枕Ōo*a種JU-ɶƠdz鱓fƑS + values: + - 4ISUCT + - po8yM2L + - T5Q0UARu + - key: RhB + operator: "" + values: + - Re7 + - 7id + - 91GFPdrt + - key: ShRTzNRj + operator: ʬ吇Ȭ?搰Ç + values: + - HiGOGJE + - wOi + - HmllR83Dbvoz + namespaces: + - "" + - TBCPW + topologyKey: 0H + weight: 1493754197 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: CESaz + operator: ŢaæX#暁鲸'媩俛5齗aw'ĥ煆W + values: + - "" + - key: YtpoWP + operator: 瀽LƠ' + values: + - uS13z + - ip0h + - o8m9MWnmr92 + matchLabels: + 7o4tt: QX9gjN + KScJOoR95: Dpu + wfAk1b: rH5Z + matchLabelKeys: + - Yh1S1nZ7hm + - Fwx + - 6mhp + mismatchLabelKeys: + - ihvyNa7 + - m8 + - Q + namespaceSelector: + matchLabels: + 2KH67NR4: Vy8qZyy + topologyKey: w0KJ + weight: 1592497187 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + 1UcAh: h + namespaceSelector: + matchExpressions: + - key: yxz + operator: ',酵ýhȿ鲹芫澥 Ǧ_Ź躄_莯ʊ傡硬M' + values: + - Fof + - key: 8KwNEN + operator: 8炮逴8`M鞵ȍȟ蟷盱 + - key: N0 + operator: Ì崌爷矉&佷* JQȴ躀厇退ƿƍ肙 + values: + - kjlwyKc + - DDz + - Yf8Vf5Ar7w7 + topologyKey: n5cRtvXjK +annotations: + GvX4jkWw: xAyNk + MdtXxfH: "" + WyrWx: 8QO +automountServiceAccountToken: false +autoscaling: + enabled: false + maxReplicas: 213 + minReplicas: 211 + targetCPUUtilizationPercentage: 270 + targetMemoryUtilizationPercentage: 495 +commonLabels: + Nv: YHcp9u + RMi5: o4 + ViLr0: zrEw3 +configmap: + create: false +console: + roleBindings: + - cwSnKnhS: null + mzA9: null + oRCBU: null + - 4VfdtEVC: null + UF: null + - 785va: null + Cmlc: null + NyhDjFL: null +deployment: + create: true +enterprise: + licenseSecretRef: + key: teD + name: fP2IA +extraContainers: +- args: + - gfDaDhh + command: + - Eu + envFrom: + - configMapRef: + name: 9LtiYU + optional: false + prefix: dS5JDbtZJ + secretRef: + name: 3X5 + optional: false + - configMapRef: + name: vpOLCCmA + optional: true + prefix: IJpeUVYk3 + secretRef: + name: TaghAr + optional: true + image: Nw59jHFBw + imagePullPolicy: Eźz购綗映ò#ZuS絇溾^飷 + lifecycle: + postStart: + exec: + command: + - N2F2q + - XKeJn + - CfoVd + httpGet: + host: 0u3Kgf + port: PVA8u + scheme: ȧX[噦摼鎥憈ǴńƘŅ + sleep: + seconds: 9185496374723367536 + preStop: + exec: + command: + - lrWSClt + httpGet: + host: uS + path: 51Gzg9s + port: -1680102290 + scheme: 8涒齃ɠĬ諛鰅jyr塸ȷg× + sleep: + seconds: -302278202696680147 + livenessProbe: + exec: + command: + - fmu + - wJR3 + - 60zV6s4327rKb9 + failureThreshold: 2122798666 + grpc: + port: 1914605377 + service: ES + httpGet: + host: 7LAmwy8 + path: o2XAC + port: S5 + scheme: 犘ßħɚÂ剐*鬰ȇxȺ錎 + initialDelaySeconds: 343978803 + periodSeconds: -1725283583 + successThreshold: 1055506692 + terminationGracePeriodSeconds: -737021961431151273 + timeoutSeconds: 1721351711 + name: r + ports: + - containerPort: -341996687 + hostIP: zR + hostPort: -641414216 + name: AGa7X6lnw + protocol: 阧 + - containerPort: -1616018360 + hostIP: 8q + hostPort: -2060443566 + name: B + protocol: 位ŲȟHbfp餪魹| + - containerPort: -321829785 + hostIP: S + hostPort: 850049722 + protocol: ĢŔ=ɦŊ鳺醩hĂ踻鉀 + readinessProbe: + exec: + command: + - VRq0lZK + - nCUDH3Zgc + - f2h2C + failureThreshold: -444080905 + grpc: + port: -1484737838 + service: UL8hSUw + httpGet: + host: 8DDb + path: Z + port: It67aEO18 + scheme: 蹐疒Į浤 + initialDelaySeconds: -1225398553 + periodSeconds: -1497056806 + successThreshold: -1256842388 + terminationGracePeriodSeconds: -3265344141862786392 + timeoutSeconds: 1127947387 + resources: + limits: + "36": "0" + Oaiu: "0" + v: "0" + requests: + F0olO: "0" + tvGpYtd: "0" + restartPolicy: Ě卿ɫȰLZ懁 + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - "" + drop: + - Ę螅7O5Ɵ駢Ó宮緂 + privileged: true + procMount: ʤ敠æx漭fƈŸʄ + readOnlyRootFilesystem: true + runAsGroup: -1779689763650765955 + runAsNonRoot: true + runAsUser: -1786517016760367110 + startupProbe: + exec: + command: + - Mcn36l + - "n" + - OMT3J + failureThreshold: 1137002720 + grpc: + port: -2106637755 + service: OYW + httpGet: + path: K + port: STUmUBT + scheme: 貪iɐ巶ɿiɲbɎ;Ŏċ2橺汲ŋ刢g + initialDelaySeconds: -648188998 + periodSeconds: -278768915 + successThreshold: 890955082 + terminationGracePeriodSeconds: 5660177701724482122 + timeoutSeconds: 959596283 + stdin: true + terminationMessagePath: h2a2mAm + terminationMessagePolicy: pjĉ + volumeDevices: + - devicePath: cZ95 + name: wLm + - devicePath: P9RW + name: PjzHR + volumeMounts: + - mountPath: b + mountPropagation: 脣Į + name: bOY + readOnly: true + subPath: mBuB + subPathExpr: 0io + - mountPath: DYp + mountPropagation: 9鹺t"Ĭij(?NB4ɖ鴼B屈桲ȋ噤ǁ + name: O + readOnly: true + subPath: EcI7mF + subPathExpr: HKfaS + - mountPath: NTgHw + mountPropagation: (ńÆ;裉嵀 + name: U6TGXB + subPath: wjpyjQ + subPathExpr: nqq + workingDir: NpjQN3dM +- args: + - m + - fmRfLPl + command: + - okKsRu + env: + - name: y8FxBu + valueFrom: + configMapKeyRef: + key: 1kdTq + name: NGzFHD + optional: false + fieldRef: + apiVersion: WDoDm + fieldPath: HTHz + resourceFieldRef: + containerName: aWk + divisor: "0" + resource: RcTwrpd4PaqW + secretKeyRef: + key: 27uDnW9fM1 + name: diwId6SMC + optional: true + - name: NZ1pEV + value: Xq7fA + valueFrom: + configMapKeyRef: + key: cYo + name: IhK1oKNNr + optional: true + fieldRef: + apiVersion: 0C + fieldPath: "" + resourceFieldRef: + containerName: OywKEud3 + divisor: "0" + resource: E4 + secretKeyRef: + key: gGTl + name: V + optional: false + envFrom: + - configMapRef: + name: fJ + optional: true + prefix: zFUU1PguE + secretRef: + name: S7Jre + optional: false + image: gbZ4mqT + imagePullPolicy: '*罖Ē掙*uĕĥ世û煨o曁ɖ)嬫噩肖Ñ' + lifecycle: + postStart: + exec: + command: + - nxKsxt + - F25ka4x + httpGet: + host: "0" + path: 9k0yMphk + port: GJdG + scheme: 婁箅蝼đ杣Ɗ°VAƭ0ĺ钘1 + sleep: + seconds: 8039264634100238529 + preStop: + exec: + command: + - NuJoJm + - gykEI + - "6" + httpGet: + host: UnkqD3SS + path: BhN + port: 712546393 + scheme: u + sleep: + seconds: 409536667065008471 + livenessProbe: + exec: {} + failureThreshold: 204373937 + grpc: + port: 1803358082 + service: VXsxSeh + httpGet: + host: Ht64jf7Eo + path: u1jjW9Qu + port: 556487018 + scheme: 熖Ű存ŖT磇ɘ外 + initialDelaySeconds: -1152834471 + periodSeconds: -1133396594 + successThreshold: -1385193405 + terminationGracePeriodSeconds: 2915006546098799012 + timeoutSeconds: -1401054296 + name: dfD716 + ports: + - containerPort: 691082006 + hostIP: b + hostPort: 636825973 + name: S5FmEWKv + protocol: g]se墰掀媸晓櫚驟憽hbƥsư° + readinessProbe: + exec: {} + failureThreshold: 152987910 + grpc: + port: 642951905 + service: q2qfom8L + httpGet: + host: GaxyfqlQ + path: Oh0t + port: -766612198 + scheme: UÂ_ + initialDelaySeconds: -1382761032 + periodSeconds: 967018272 + successThreshold: -178373997 + terminationGracePeriodSeconds: 6605400648980208248 + timeoutSeconds: -1404918452 + resources: + limits: + 7cu: "0" + 22n7v: "0" + XsU5mrE: "0" + requests: + kyXuqf: "0" + mBk4P9DWW: "0" + restartPolicy: ʓdT>NȚks_q祈 + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - ȸŏ脸(Yǃ¯~垇耗A) + - T翱ĥ + drop: + - 商ʏ軒Ƣ厢 + - Ⱥãt\跋þ漙苣ű吡憕鿶0傜om + privileged: false + procMount: Ŷ% + readOnlyRootFilesystem: true + runAsGroup: -1052699124096043871 + runAsNonRoot: false + runAsUser: 3737016357651072730 + startupProbe: + exec: + command: + - jefRNS + failureThreshold: -9144267 + grpc: + port: 642233169 + service: WjvgDkGG + httpGet: + host: 8hzgS0q + path: z + port: -885964296 + scheme: ɸliŵ + initialDelaySeconds: 1014078949 + periodSeconds: 1410148112 + successThreshold: 1164669668 + terminationGracePeriodSeconds: -3385668069040237914 + timeoutSeconds: -1723583731 + stdin: true + terminationMessagePath: zbCh + terminationMessagePolicy: 4攨2õė+軩Ç + tty: true + volumeDevices: + - devicePath: Nx + name: QLHA + - devicePath: 9JAgFLSdSqQ + name: "5" + volumeMounts: + - mountPath: KXG1 + mountPropagation: ȁ捄ɺ絒馢A¥`Èť + name: aghWO + readOnly: true + subPath: el7KEVsV + subPathExpr: tdksniBM + - mountPath: 5nus8 + mountPropagation: N饢杼M7X尅扐ǗÃɱNƞeuĦg儡 + name: TS4kHG + readOnly: true + subPath: i + subPathExpr: ktDaTCGG + - mountPath: CSkt9N0i + mountPropagation: 爕ɐYYȁ<獱椂@椗áʇ憣>\Ɋ筙纉Ë + name: KIKRXUR + readOnly: true + subPath: bWYTiq + subPathExpr: cgxlHqVV + workingDir: F +extraEnv: +- name: 0iCX + value: UfKNkXj6I + valueFrom: + configMapKeyRef: + key: GGYmdb5PBtUx + name: Zl1rWu9 + optional: true + fieldRef: + apiVersion: 1pKgni + fieldPath: 8Zmv + resourceFieldRef: + containerName: nK + divisor: "0" + resource: Yizp + secretKeyRef: + key: Dxqh + name: td + optional: false +- name: bm + value: K06vl + valueFrom: + configMapKeyRef: + key: dOTjzfwtRPzX + name: YleYOzRS + optional: true + fieldRef: + apiVersion: xl + fieldPath: 6NM2 + resourceFieldRef: + containerName: jreT + divisor: "0" + resource: "" + secretKeyRef: + key: B7 + name: cu + optional: true +- name: F4Vp + value: 9q + valueFrom: + configMapKeyRef: + key: dAPalKT0 + name: UXC7S + optional: false + fieldRef: + apiVersion: bTxwQmS + fieldPath: XW + resourceFieldRef: + containerName: iqnl + divisor: "0" + resource: e9 + secretKeyRef: + key: c1WJ + name: sg2TuPSW + optional: false +extraEnvFrom: +- configMapRef: + name: 3PT + optional: true + prefix: l + secretRef: + name: zakko + optional: false +- configMapRef: + name: RdxlkV + optional: false + prefix: 9Ae4W + secretRef: + name: UiJ + optional: true +- configMapRef: + name: bp + optional: true + prefix: SU + secretRef: + name: fy + optional: true +extraVolumeMounts: +- mountPath: Oly + mountPropagation: ƈįlñ + name: QuM + readOnly: true + subPath: NPJ + subPathExpr: vn +- mountPath: xsiqpcicm + mountPropagation: Ŝȃ燩čƃʤǸ儼 + name: blYv + readOnly: true + subPath: 8f + subPathExpr: I +- mountPath: "" + mountPropagation: 犒k洐ɨ3UʓďȏUm8/x艂" + name: i2 + readOnly: true + subPath: G + subPathExpr: Wo47OrA +extraVolumes: +- name: HUa7xM +fullnameOverride: AumW +image: + pullPolicy: ǫtŖŮƘ瓧ù¹勍u + registry: ai + repository: f54I + tag: iO +imagePullSecrets: +- name: bbjdn +- name: VI +ingress: + annotations: + RX47S: lb0 + Ton: ukp + className: R3Ykmr + enabled: false + hosts: + - host: bybyr6XsLFPDg + paths: + - path: c9F + pathType: TyYv +initContainers: + extraInitContainers: q +livenessProbe: + exec: + command: + - dRbj + failureThreshold: 864346345 + grpc: + port: -568790446 + service: 9WyiSW + httpGet: + host: EbFlYW + path: HC + port: C1Fv7 + scheme: 軔ǷʧP + initialDelaySeconds: -1341055636 + periodSeconds: 2055603833 + successThreshold: -175204389 + terminationGracePeriodSeconds: -2333626465204273709 + timeoutSeconds: -589897727 +nameOverride: 9mG8n4Wu4 +nodeSelector: + U3Rfg9: WSTvjvP + hODw: LSv + iwleZ: fD +podAnnotations: + jLE31lUP: LWc +podLabels: + 6W: FQvOa + YwkBSNWK: 0qqd + jP3: iNkD +podSecurityContext: + fsGroup: 8205502301244812774 + fsGroupChangePolicy: "" + runAsGroup: -8440674019915815616 + runAsNonRoot: true + runAsUser: 4432310384984167581 + supplementalGroups: + - 7965846110903121951 + - -9174375158887062481 + sysctls: + - name: OkeQ + value: A + - name: 24y + value: fIPA + - name: "" + value: b3 +priorityClassName: gPB +readinessProbe: + exec: + command: + - NjJ7Lit5 + - 29odviV2mnb + failureThreshold: 1075627654 + grpc: + port: 364618769 + service: g1wc + httpGet: + host: 40i + path: OTDO + port: -2089902693 + scheme: $Gȇ表匾ʞG絁娚彰ŝê<ĭ + initialDelaySeconds: 333726894 + periodSeconds: 1376975278 + successThreshold: 112483424 + terminationGracePeriodSeconds: 1389336444380098948 + timeoutSeconds: 669945326 +replicaCount: 24 +resources: + limits: + 7VHN3: "0" +secret: + create: true + enterprise: + licenseSecretRef: + key: jPpQY + name: uRkzw + kafka: + awsMskIamSecretKey: B + protobufGitBasicAuthPassword: EfQbyB + saslPassword: w + schemaRegistryPassword: qiltVq + schemaRegistryTlsCa: kyT4j + schemaRegistryTlsCert: Tu4varJ + schemaRegistryTlsKey: bmT + tlsCa: UyskLmDZ + tlsCert: "" + tlsPassphrase: IdsCzt + login: + github: + clientSecret: hPt + personalAccessToken: vRbRqD0 + google: + clientSecret: "" + groupsServiceAccount: lcc9 + jwtSecret: tf0x + oidc: + clientSecret: A9RDbO6GzTtHYG + okta: + clientSecret: HktzleLAg + directoryApiToken: qX + redpanda: + adminApi: + password: 5imX8ztdqjU + tlsCa: opQQ + tlsCert: PGcfJC3zH + tlsKey: IhqyTvQn4T +securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - '*·戌ɳKõʚK(懷ë蟅ȣg' + - vOpɔm&ɞ法槪ųf + drop: + - l¤0ɖK樌ŕDĪ箰ɬȓũ梫h揼 + - 躟OBZş互鹫Íʨƶ`ã + privileged: false + procMount: 9®俠ɳ屑ŏO'pe,Q+膿麣 + readOnlyRootFilesystem: false + runAsGroup: -289823929905824069 + runAsNonRoot: true + runAsUser: -4392330066259666500 +service: + nodePort: 249 + port: 113 + targetPort: 414 + type: XHYb2qmrk +serviceAccount: + automountServiceAccountToken: true + create: false + name: Jg +strategy: + rollingUpdate: {} + type: LJėwǮ甧 +tests: + enabled: false +-- case-037 -- +affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: IPWU1 + operator: 魡燸"趵p砮ƘċÈ3ljDŽ + values: + - i + matchFields: + - key: "" + operator: 廋46齄aā[傡ŤXjğ@ɫ聱昣ȞA + values: + - hrjhAJC + - RGJEJ + - key: 9XRD + operator: 鏖Ų姓萲1蜓舆 + - key: nmlhnezDL + operator: =WF»圻礼鍕4u-瘸]NJ + values: + - MlE9xcsLb + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: vxH0 + operator: kűŐ鄴 + matchLabels: + YR: ZYyx + matchLabelKeys: + - lrfi + - 9s + - "2" + mismatchLabelKeys: + - "" + - vc + - rz4SvG + namespaceSelector: + matchExpressions: + - key: ybBiR8Fm + operator: UlƜ寻眅崈O+聁ȴ + values: + - xxao + - key: UpNi + operator: v韠Ʀ.Ɓ氩諑ʊ0ɔ凹 + values: + - ECPGYavF2 + matchLabels: + 7qRB: 56MM + tcHg1: kpR + topologyKey: "7" + weight: 212582037 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + 6PJt: OILe3j + mismatchLabelKeys: + - PB + namespaceSelector: + matchExpressions: + - key: "1" + operator: ǯVɳCĬ鷹儉ïXǐʐ楏ċŇǽ + - key: aFA + operator: ƣ諔&ȵ%ǼQ傠ûQ& + values: + - tdkCJmsLj + - 2WF + - nlO + matchLabels: + "": JgBcTwL + gUx2lrPlU: 2MEiay0i + namespaces: + - iUHz + - F + - C + topologyKey: 0DqLIsLvEJ + - labelSelector: + matchLabels: + D65k: m + v: Wf73pl + namespaceSelector: + matchExpressions: + - key: Mql8T + operator: Ȳ + values: + - kiCXA + matchLabels: + QJPP2Wmbc: MGiu + tm: POZGk072F + v: OdyUJaKz8sW + topologyKey: CaAJ + - labelSelector: + matchExpressions: + - key: kJFGWDPIX + operator: '`園bsN唲幈ùÄ!鑢' + values: + - x + - key: PQktimeqK + operator: Í Ho亜q毂EɌ39蓷 + values: + - rYZ + - key: L6Wp + operator: '&去鉼晆Äě菉' + values: + - BPX5 + - 7Ows + matchLabelKeys: + - PhOMWnct + - 4Iar + mismatchLabelKeys: + - SfvAwYYqtwPc + - w9 + namespaceSelector: + matchExpressions: + - key: VmRQ2 + operator: 錛ȋʤ`搲ZL婨ƅ\鴃m闬ǿ戺ƨĤs@ + values: + - Ah8tj + matchLabels: + JBFf5vLf4: q2X6daLRz + VuZT: gmluiWbT + p64cMTP: B9 + namespaces: + - Ri6BSDl1 + topologyKey: nACF7H8 + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: ZZaxS + operator: 黦ƒ©瀂 + values: + - "" + - 20OCN + - IZ86eI1 + - key: RXLfn + operator: .惊ŝ4ni`ræseȕƌ筬NJ@pŻ + values: + - Fuy + - 6ZIkwShr + matchLabels: + RJHcF0aLL9: avVll8hJB + Spsji: hW + mismatchLabelKeys: + - RDiUdFmoEZ + namespaceSelector: + matchExpressions: + - key: RmcZbbc + operator: uŒ¶鱸K + values: + - 90lQUM5B + - J07lI + matchLabels: + 6hQX9h: Sr5NoqB + L0vc: i + iJ6hIS: yLkpjBIU + namespaces: + - i1uGAcY9Xxf + - DO5c + topologyKey: uVcRZ + weight: 608820709 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: Mgdm + operator: 惋¯ʢÝǒ=h佅茆接 + - key: "n" + operator: 系¦澜C2騗ā穩 + values: + - yelaWfaB + - Cq + - Va + - key: Ymvr + operator: 7 ^»ðq> + values: + - GES + - gPThP + matchLabels: + zj9Ud7LvFtg: trcgDo5 + matchLabelKeys: + - X + mismatchLabelKeys: + - peo1 + - zVPvCpJUM + - "" + namespaceSelector: + matchLabels: + "1": qRCy + namespaces: + - Eczjbhs + - F8 + topologyKey: Az + weight: -470853400 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: {} + matchLabelKeys: + - VWM7 + namespaceSelector: + matchLabels: + Q4BC: BojBLo + Vz06Yne: "" + namespaces: + - yEEmKNg + - iGJzcn + - G1bhP4 + topologyKey: pcOSh + - labelSelector: + matchExpressions: + - key: lCW5OK2A6HKOaC7 + operator: 蚿~2婈 ʝ似矉k + values: + - 5IOGWj + - UwmQ + - Ser + matchLabels: + "4": PB0Pb9 + Ykh3k: oX8w + matchLabelKeys: + - SfZ9pUjA + mismatchLabelKeys: + - i16lOT + - 8iU + namespaceSelector: + matchExpressions: + - key: ZxE + operator: 恇3 + values: + - "" + - 43TqLr + - key: ikCzWLGa + operator: E + values: + - W1 + - ZqA + matchLabels: + "": YJaQ + 7h: dybADQ + topologyKey: "" + - labelSelector: + matchExpressions: + - key: 0bZO + operator: '[ ' + values: + - DPm + matchLabelKeys: + - "" + namespaceSelector: + matchExpressions: + - key: b8XGJRAsiP7 + operator: ']眆寜眴z' + values: + - MsgI + - dhrJF0b + - key: SMx + operator: JɦĈ + values: + - o + - yknE + - key: rfxn3qvEK + operator: 綐岮~2熗昕Ñ占Wm员Ƴ橝灃Ɗ + values: + - "" + - K + matchLabels: + 2Jd: g3du2W + ZHju0: u7DvsT5e + zUssA7: ZKAL + namespaces: + - Qpqer2VPQ6oA + - zR0okqL + - nuH + topologyKey: i +annotations: + 1B8qie: FSPYCLoT + I: hpwL4TH + Z: 0LFy +automountServiceAccountToken: false +autoscaling: + enabled: false + maxReplicas: 370 + minReplicas: 221 + targetCPUUtilizationPercentage: 463 + targetMemoryUtilizationPercentage: 49 +commonLabels: + BJ: Gq0Rw + FPcPYvmbB7dAZe: Cy7WaeI + uEVMkDkYRvnn: zvptNai +configmap: + create: true +console: + roleBindings: + - 2m: null + VNrY1fwY: null + eaGm2c: null + - Ng0sM: null + Txhv6: null + e2uo: null + roles: + - Dd: null + H0QLXtA: null +deployment: + create: false +enterprise: + licenseSecretRef: + key: HqS5hb + name: 3sA8DqHdr +extraContainers: +- args: + - UaqwQ7 + image: 9gJVF + imagePullPolicy: 5傅c諹ɕ ƅƬDr1鰹瀣n怌ʡ + lifecycle: + postStart: + exec: + command: + - EJfXoz + - pxAl7T7 + httpGet: + host: 4dtyQHxp + path: 9i + port: BmGAi + scheme: ¼ů + sleep: + seconds: 2333336810403167963 + preStop: + exec: + command: + - EF + httpGet: + host: gc + path: 5IcdjR2 + port: Ln1 + scheme: Ȱʛ{`Ɓʛ劽Ŋ劧Yǥ + sleep: + seconds: -8338094784810815040 + livenessProbe: + exec: {} + failureThreshold: -1009316117 + grpc: + port: 434468004 + service: hOHaw7yL5 + httpGet: + host: r0OfO9Tjf + path: rvqaH + port: 1861701721 + scheme: 蓫AȚ%Țx痷 + initialDelaySeconds: -1210592458 + periodSeconds: -1685889023 + successThreshold: -1513585658 + terminationGracePeriodSeconds: -2039599439532369874 + timeoutSeconds: 615837494 + name: 0z + ports: + - containerPort: 920384597 + hostIP: amIbTg + hostPort: -1446796645 + name: H + protocol: tsė歟ū$B,qʐ医枝 + - containerPort: 533680030 + hostIP: AQrcm57h + hostPort: 436553418 + name: zI + protocol: mĖ}ʘá~滬 + - containerPort: -88474612 + hostIP: 5Q7z7DzPSmu1KQ + hostPort: -894572877 + name: Ie31rl + protocol: Z尤汸 + readinessProbe: + exec: + command: + - Ig53IR5s + - X + - MD + failureThreshold: -697650972 + grpc: + port: -1408023460 + service: q3NQW + httpGet: + host: NClmq + path: "y" + port: 4KJj4nVotN + scheme: ®顫jV/懔e + initialDelaySeconds: 1925202911 + periodSeconds: 1008375062 + successThreshold: -1515262628 + terminationGracePeriodSeconds: -9135279372752511888 + timeoutSeconds: -757546061 + resizePolicy: + - resourceName: BhTx + restartPolicy: O憢%ȔnjŸƓx汮$ + resources: + limits: + 0R8h7mczbiK0u: "0" + ngcoDm: "0" + requests: + FvPC8: "0" + restartPolicy: 竴xJ飊µ + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - eF + drop: + - '#泪<1饤ǯȲ78狎外龬郄晛頯6汐嫏' + privileged: true + procMount: bűƍȓ2C޵舕秗騛^ĪĪ溫Nȇ + readOnlyRootFilesystem: true + runAsGroup: -3343110605261139689 + runAsNonRoot: true + runAsUser: 7479178344552716344 + startupProbe: + exec: + command: + - 4mbBa0iSAgQ + - 9Vb + - B5u + failureThreshold: 753806032 + grpc: + port: 1382157718 + service: Sbk + httpGet: + host: bVoIiYzvoi0B2 + path: H7pGt3 + port: TTVi + scheme: 厪$dıQǵ_ƀÁ釔ɵ徣 + initialDelaySeconds: 849023271 + periodSeconds: -1908074475 + successThreshold: 328769480 + terminationGracePeriodSeconds: 5149904224053969297 + timeoutSeconds: 1277324377 + terminationMessagePath: 00uJXyD + terminationMessagePolicy: 禣儛x~靰ɿ`šŀǼŋP^n + tty: true + volumeDevices: + - devicePath: TMbZU + name: hFJz + - devicePath: yr + name: O0NQRcuq + - devicePath: UHqeq + name: Ydaqo + workingDir: TzR +- args: + - 1EEFNaNA + - U2l + command: + - CsMZk + - 4HgTHX + - Sqt9at + envFrom: + - configMapRef: + name: RRMDeJ + optional: false + secretRef: + name: lcA + optional: false + image: GQ69 + imagePullPolicy: Ɉǥ + lifecycle: + postStart: + exec: + command: + - 3YpG + - vZTzHN + httpGet: + host: cPtKCkyO + path: "4" + port: -1049236742 + scheme: 硺=ɸǖɵ恆Žd0 + sleep: + seconds: -7566729856608460688 + preStop: + exec: + command: + - y2fpvM + - VG + - hhX3m + httpGet: + host: o + path: "7" + port: nl5CZNKB + scheme: Ȉ + sleep: + seconds: -9000479934802388409 + livenessProbe: + exec: {} + failureThreshold: 115197733 + grpc: + port: 418872789 + service: mK04M1 + httpGet: + host: tYy4jqPpZ + path: om7u1 + port: 6vYh + scheme: 鬧ĕ,b嫲ʞÈȅɼ瑀\-ŤÔĞ{ + initialDelaySeconds: -1996330627 + periodSeconds: -2123682197 + successThreshold: -274102072 + terminationGracePeriodSeconds: -4086669261853017280 + timeoutSeconds: 1671175282 + name: MN + ports: + - containerPort: -581773322 + hostIP: w + hostPort: -1918799357 + name: NUQc5 + protocol: lɡFàW6ǼC7騰僮氁繸{Ȏ + readinessProbe: + exec: + command: + - IYC3M + failureThreshold: 178025639 + grpc: + port: -205038391 + service: EGqI + httpGet: + host: oGjb56 + path: mnq + port: pb9x + initialDelaySeconds: -1053907742 + periodSeconds: -777502604 + successThreshold: -350871959 + terminationGracePeriodSeconds: -6813701492426236069 + timeoutSeconds: -1712603807 + resources: + limits: + TwWe: "0" + requests: + 4FGQT: "0" + 57DEge: "0" + zBEzXaq: "0" + restartPolicy: 焂ś(Z緌挄ǥȪȑq*刾 + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - Ư#æ9NF犔帙錈 + - N範3>ȖlǖɥöS竾ƾÔŸ烠dk弸 + privileged: false + procMount: ı.ĔtQ+p銍/盂pJr替àŽ + readOnlyRootFilesystem: true + runAsGroup: -9023516459602390407 + runAsNonRoot: false + runAsUser: 2513546243926544067 + startupProbe: + exec: + command: + - C + - 9o + failureThreshold: -1595663358 + grpc: + port: 879782754 + service: E3 + httpGet: + host: j + path: ZwGu + port: -1183682475 + scheme: ȉʬ|Ȗ-胨\GǴ酥âïŀ + initialDelaySeconds: -320635887 + periodSeconds: -1762048755 + successThreshold: -1206942688 + terminationGracePeriodSeconds: 2874889772540953352 + timeoutSeconds: 201190682 + terminationMessagePath: D5nhSA2KK + terminationMessagePolicy: '|Áʊv~' + tty: true + volumeDevices: + - devicePath: fl + name: "" + - devicePath: Pivii + name: SAJBTs + volumeMounts: + - mountPath: os + mountPropagation: 霤ņd碤 + name: Wma3F + readOnly: true + subPath: J + subPathExpr: rp + - mountPath: 7p + mountPropagation: ʜ塖ɥw阒ɠ·閐駔址遥铣C龂ȵ槂瑷 + name: EKv9jGIV + readOnly: true + subPath: YjGj1 + subPathExpr: goeN5mMZVyE + workingDir: 9pZ +- env: + - name: jUF3n5Y + value: 5Oas + valueFrom: + configMapKeyRef: + key: NjvBzcrV9 + name: kjnqdL + optional: true + fieldRef: + apiVersion: EKxzT + fieldPath: keiWEt + resourceFieldRef: + containerName: 6ei + divisor: "0" + resource: 5SYJ0LG + secretKeyRef: + key: khTsQnn + name: R22Yc + optional: true + - name: Eqsqk + value: ZbUl8L + valueFrom: + configMapKeyRef: + key: LBJ9Co8gX + name: 5F + optional: false + fieldRef: + apiVersion: BBXJwlU6ov + fieldPath: tR7Z2 + resourceFieldRef: + divisor: "0" + resource: Kw7UxsTdNB + secretKeyRef: + key: x1Ijg6T + name: qqT6Y + optional: true + - name: 7zUt + value: 92wkXugDh + valueFrom: + configMapKeyRef: + key: JfY0lIp0Jdtpv + name: nYzr + optional: false + fieldRef: + apiVersion: IDhOF + fieldPath: aTWd + resourceFieldRef: + containerName: m4s0LUsO + divisor: "0" + resource: jJSLfi + secretKeyRef: + key: KzYvK2KKl0 + name: sR + optional: true + envFrom: + - configMapRef: + name: LuhmK + optional: true + prefix: z3 + secretRef: + name: bhwKfwEMY + optional: true + - configMapRef: + name: ZLn6PrNZ + optional: true + prefix: CZK + secretRef: + name: ln + optional: false + image: 40twCh1 + lifecycle: + postStart: + exec: + command: + - "" + - 4qZLs + - OKN + httpGet: + host: L1rE + path: zDyVFyy + port: kQZa + scheme: l + sleep: + seconds: -7109845505283004784 + preStop: + exec: + command: + - HBLUwI5qG + httpGet: + host: vM5bd + path: "y" + port: 1065237668 + scheme: 働ı愊GƜǻo4qtHŢ*獊K[w + sleep: + seconds: -1099871671561452384 + livenessProbe: + exec: + command: + - K1 + - O5Tdq + failureThreshold: 1326476911 + grpc: + port: 1266228568 + service: 0yovH + httpGet: + host: feV + path: HDTE + port: "1" + scheme: '!@ȄKh8淫~ǿ%硬睇鵤嵤' + initialDelaySeconds: 1175577649 + periodSeconds: 1877040036 + successThreshold: -1354358221 + terminationGracePeriodSeconds: -925123122471881643 + timeoutSeconds: 1464454545 + name: W8b6OOS + readinessProbe: + exec: + command: + - i + failureThreshold: 1781656452 + grpc: + port: -1606887908 + service: RrbvDP + httpGet: + host: mKx + path: HD + port: hiq5RvT05 + scheme: 鱑Ȍ¾ĵ覓{>鿼钇 + initialDelaySeconds: -1803086365 + periodSeconds: 450703172 + successThreshold: -1624696013 + terminationGracePeriodSeconds: -5286538260023923986 + timeoutSeconds: -528162423 + resizePolicy: + - resourceName: um0g1naPII7 + restartPolicy: ¹俞Wƌ甝 + resources: + limits: + EDhQ2V: "0" + OQ: "0" + WtnTV: "0" + requests: + jQaF: "0" + restartPolicy: '{鉪蟏E喧t庛Þa¦ʕ' + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - Ň鰍坸Ñ霰ʁ攽$Ơ + - 蟒磁砈Z芥EDZ + drop: + - ċ6洌扼雚nj墣l睧奟*躾ƛƌ秡t + privileged: true + procMount: 蜵5>MU + readOnlyRootFilesystem: true + runAsGroup: -7704085956113873818 + runAsNonRoot: false + runAsUser: 5730999299228810722 + startupProbe: + exec: + command: + - ImPt + - cIB + - e58MzW + failureThreshold: 310737712 + grpc: + port: 1849024783 + service: B1W + httpGet: + host: 1nU5qLkMA + path: Oo7nHt + port: hxGSeC + scheme: ƇĒɔmĦɦ齋貢 + initialDelaySeconds: -1797908483 + periodSeconds: -761708273 + successThreshold: -1316915468 + terminationGracePeriodSeconds: 8128903938581944374 + timeoutSeconds: -1573011089 + terminationMessagePath: FYPtlxf + terminationMessagePolicy: Pʏɉ{ů囏Ì4鰸曘Ʃ氕峵 + tty: true + volumeDevices: + - devicePath: "93" + name: t3A + workingDir: w +extraEnv: +- name: fXB4uyH + value: GPmKm1YgQuvB8 + valueFrom: + configMapKeyRef: + key: BYyG6 + name: Kr8iKZ + optional: true + fieldRef: + apiVersion: sSt + fieldPath: 7r3LBO + resourceFieldRef: + containerName: B8G + divisor: "0" + resource: 3cRQ + secretKeyRef: + key: nQtb + name: B8Snqwl0U0 + optional: true +extraEnvFrom: +- configMapRef: + name: C1P + optional: true + prefix: KcZH45pd2 + secretRef: + name: N7Yt + optional: true +extraVolumeMounts: +- mountPath: twfjF9 + mountPropagation: ȶ唗蠤S柋ɖȈƻ + name: MMcC8 + subPath: UwT0sYVo + subPathExpr: 9ugOBQ +- mountPath: 6cj + mountPropagation: "" + name: 3iQ + subPath: SaQ + subPathExpr: QQI +extraVolumes: +- name: xbuLqNQHFY +fullnameOverride: ADIhC +image: + pullPolicy: '|í' + registry: CIzpk + repository: O + tag: F +imagePullSecrets: +- name: Yi +- name: 6XnEhUN +- name: oeoW +ingress: + annotations: + "8": SeJ + className: PHr + enabled: true + hosts: + - host: PXAcFs520n + paths: + - path: 1uGP0 + pathType: dWpX + - path: hAH + pathType: LjzFf + - path: 7Qy + pathType: vjB + - host: z9QAJ5 + - host: "" + paths: + - path: Hc0IpaX + pathType: bc0T + - path: dzn1ldJ5h + pathType: M +initContainers: + extraInitContainers: 7DdMwNg +livenessProbe: + exec: + command: + - XRPuLpEO + - nplEP2IP3 + - 9jrKdj2 + failureThreshold: 1516033986 + grpc: + port: -531236004 + service: 11bsOMf + httpGet: + host: 9PMyxMco + path: RI3zx + port: -2029405965 + scheme: G隠Ī:ŁuƠ禲oŇO鿈Ⱥȡ + initialDelaySeconds: 1774510914 + periodSeconds: 1308551645 + successThreshold: 752675362 + terminationGracePeriodSeconds: 8661862683503969755 + timeoutSeconds: 437106483 +nameOverride: u2r6 +nodeSelector: + CrYMUu1pg: "" + ftZ: dKqEwc + pNPla: Cc +podAnnotations: + dApB5noz: fJm84 +podLabels: + 9c2: 3fwyB6m1 + MyocWENxGGa: TrRadg +podSecurityContext: + fsGroup: 5618615494228351604 + fsGroupChangePolicy: ʩrXù济延唇ė袡 ʊ + runAsGroup: -3861060047548570674 + runAsNonRoot: false + runAsUser: 3602747950735365650 + supplementalGroups: + - -5665823160677538937 + - 2942720231280319982 + - -7811581565559124250 + sysctls: + - name: X + value: sWo + - name: MI521Dolo + value: ETgcRWsr + - name: 4gVCXpSch + value: csKV +priorityClassName: U7wS +readinessProbe: + exec: + command: + - cYKp + - vP + failureThreshold: 670800660 + grpc: + port: 1721771977 + service: y69H + httpGet: + host: mtLvsm + path: hd4c + port: 326683785 + scheme: X½鼅餕嚶渭闬脮ƧŗŠ#7êk.] + initialDelaySeconds: 713201976 + periodSeconds: 1611391820 + successThreshold: 604905966 + terminationGracePeriodSeconds: 8452879830155323173 + timeoutSeconds: 981065048 +replicaCount: 471 +resources: + limits: + avG: "0" + q: "0" + w8p: "0" + requests: + AZ: "0" + fGW: "0" + vom84xUd0: "0" +secret: + create: false + enterprise: + licenseSecretRef: + key: 41x + name: HHI4WeIS + kafka: + awsMskIamSecretKey: vvbXmwn + protobufGitBasicAuthPassword: uJNU2 + saslPassword: 1wgp7riu8 + schemaRegistryPassword: nKfA7t + schemaRegistryTlsCa: dsi + schemaRegistryTlsCert: 85xiT + schemaRegistryTlsKey: "1e0" + tlsCa: hEe0gyNOx + tlsCert: "" + tlsPassphrase: Jktiu0 + login: + github: + clientSecret: BDnf + personalAccessToken: MrWfu + google: + clientSecret: tkAac + groupsServiceAccount: w6hg3 + jwtSecret: zpS + oidc: + clientSecret: d + okta: + clientSecret: "" + directoryApiToken: a + redpanda: + adminApi: + password: raQeh15W + tlsCa: Ax453qH + tlsCert: 5cvfDAz7XB + tlsKey: ve +securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - Ȏ煣+ȗ爸詤rȱoCö:踕v;D'茈% + - 斉 + - 劝 + drop: + - 6儌 + privileged: false + procMount: G + readOnlyRootFilesystem: true + runAsGroup: 6433461052261949548 + runAsNonRoot: false + runAsUser: -8726272423258831483 +service: + nodePort: 150 + port: 226 + targetPort: 87 + type: At +serviceAccount: + automountServiceAccountToken: true + create: true + name: ItYso +strategy: + rollingUpdate: {} + type: 匏ǛǢ²Ƴ屣EǙ9Gʡy +tests: + enabled: true +topologySpreadConstraints: +- labelSelector: {} + matchLabelKeys: + - ImKkR6l + - oUu1w + maxSkew: 373901521 + minDomains: -938191316 + nodeAffinityPolicy: "" + nodeTaintsPolicy: 梄焑ȅƗH + topologyKey: Mh1K + whenUnsatisfiable: CǑ庬Kf鄊珪t忒訾Ɗ壚pv餲(ɯŕT铈藘SȂ臏閏@ȗ云Ȧ + weight: -1530606902 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: [] + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: R8 + operator: 茔íȟÁ嗮敚S顕DZ躨ijȱ厎ɬɏl蜶拼 + values: + - PRc + - svCs + - key: LBaaOWdWW + operator: 0ŧĸ荕fR焌禗#ȰȶŁA + values: + - G0FXBn + - IpnG + - NM8oL + matchLabels: + lrB: NtdoEuXoTr2r + y1BSzp: ivK7CU + matchLabelKeys: + - 6ZNJrk5JxOHW + - B9Q + mismatchLabelKeys: + - "48" + - nm1WD5nM + - vLqhDh + namespaceSelector: + matchExpressions: + - key: GF6EQ8mKus + operator: B"(ň枣<吰檰戱R&狅Ɍ鋋Ļ飮 + values: + - f0plBpNy + - Gzl + - key: x4 + operator: Dz謶ʮ_ūKNdv· 壼×z朤 + values: + - zo + namespaces: + - QMv + topologyKey: r1z + weight: 1950038583 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: x3pdwI + operator: ǿLȴ8涣ÎƶǛ醌Õ纺網(đ倠樓纗Ǯg + values: + - xJlJ3H5 + - iza5 + - 4rszgB8v9aH + - key: 9j5f + operator: ǘ賊ƾA迌磡m摾烊 + values: + - EMECS8f + - oveu + - He + matchLabelKeys: + - 33y4E5v + - 5XIM + - "" + mismatchLabelKeys: + - 37I + - a02Re + - GVqKNcGgl + namespaceSelector: + matchExpressions: + - key: Rtiwm + operator: 萱J矻軚fC + matchLabels: + 8ipw: G + JwDA: 8EVkJ + oiQ2p: mYGgaz + topologyKey: 5l6PI + weight: -1824427504 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: "" + operator: 晑2%·QHVJTM錈 + values: + - CTU + - X5a + matchLabels: + WdJU6: I + bN: "" + uoTcuu: w1Y3yLW2rz + matchLabelKeys: + - O80Pf1RfMp + - WRJOT6B + mismatchLabelKeys: + - "" + - "6" + - nwQikpclV + namespaceSelector: + matchExpressions: + - key: CNaHfk + operator: 蕵Qmƀʁ6鲿)żȯ+ɩ玙9 + values: + - OuxZv + - key: dS + operator: 炧踮P-.壨ġ + values: + - 6ZJp7y + - key: jiLGGAQ + operator: 蟾Ɵ餌|ƨ綁訲bǝɋ圼 + values: + - mQ + - Fk3eA81t + - YR3WT + topologyKey: "5" + weight: 1634860618 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: "" + operator: (冁粄Ƴ\Ē4ǀ9峖樾t燠熂鷸ȿź蛼* + values: + - fnrA + - g + - gptz8 + - key: 4Hue + operator: oğ魀Ʌ¦榴 + values: + - InPtpb + - rxTpo + - HXnghAhWU1 + - key: EE2p + operator: á儬倏qȼ療ƚ + matchLabels: + YvCi: 1Tg + oLQ9OhyY: pFYpYKV + matchLabelKeys: + - J7 + - VR5 + namespaceSelector: + matchExpressions: + - key: cwgATYQvdj + operator: ÷Zá磋舫棹瑗-神ĕ嘟泦猵 + matchLabels: + Inz: BpiLQXOvEh + topologyKey: 5sHov5x + - labelSelector: + matchExpressions: + - key: vLI2 + operator: 歑ūĿɒ + values: + - FiQIMCFX2 + - vqhAaV5N7 + matchLabels: + 6DNwSiVsen: 1fRK + V: 3L49A8YEn + matchLabelKeys: + - K0sPcZWy + - fqn0luLnrF + - "" + namespaceSelector: + matchLabels: + O9bMG: CvBa11UI9OL + cm56v: Z83nkLc + gLJIEvg5: tUJq + namespaces: + - yP + topologyKey: 3RN + - labelSelector: {} + matchLabelKeys: + - vMX6FV1t + - vP + - TU8VLc + mismatchLabelKeys: + - ZAaEBYk + - Y0F4V0C + namespaceSelector: {} + namespaces: + - LwoHgQ + - qAJ + topologyKey: "0" + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: afwQ + operator: X(^Ȓ蘘}例 + values: + - 2ak8Yfa6P + - key: T4 + operator: ȵë_-Òŝ/c諒M攕窸 + values: + - Vktm + - trH51Z3 + - key: in74thKl + operator: HþČ謼ijƉË + values: + - NK2D3 + - NUsncshnv + - YDiqn6 + matchLabels: + T1: "" + nQFxJe: tdqf + matchLabelKeys: + - KI + - 6LjhIKmlnlhpI + - 88DArl53wb + mismatchLabelKeys: + - Bn30p + - zjq + namespaceSelector: {} + topologyKey: LrLYm2oYCgO + weight: -1318876164 + - podAffinityTerm: + labelSelector: + matchLabels: + T837hItO1qv: mCNMYnPq + gDh4Dxx2O: JUZxy4z + matchLabelKeys: + - sTn + - 4nu + - CSgSC + namespaceSelector: + matchExpressions: + - key: A5z + operator: "" + values: + - PJ6Zh + - S + - key: VufLBVvFECvIW + operator: ʝcƘʣ]筍ġ0Ğ鎏£<艻錯瀢 + values: + - tz64EN + - i + - key: 8Q2s + operator: E1戠天:ɺ勎sȸɾ + matchLabels: + XTI: 7cIZ + jpH49wkR: D5u5c + namespaces: + - XyGPkW + - CERSWYSVu + - Ms80R + topologyKey: 57PFRYX + weight: -1558645933 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: ZGO5iRhr + operator: 堭ŷz + values: + - IfLuRt6FZf7 + - 03fn3j1 + - key: HL + operator: M螎õ}shƏ檅葜0<瘼Ɗț夡J偦ʆ + values: + - "96" + - 4uInca + - KsWaAE + - key: nKr + operator: ʋƲ~uè蟪ʗƁʬȌ势ȃVÄ穵Ą + matchLabels: + DVRktk1U: 1XFlhcXH + matchLabelKeys: + - kJMI + - Js8qeQ + mismatchLabelKeys: + - lnn1G + - A4nlWqCrE3 + - BzU + namespaceSelector: + matchExpressions: + - key: "" + operator: ɍįmŐ冹?E蹣ƋH肥=ɭuR訷$ + values: + - faDMJv + - b0VUPX + - lOsWCl + - key: 7iy + operator: 0:H碼\b黵禧鐃 + - key: nbn + operator: 疬厼掚Ƿ蛬ƞÜ9懎拖ų洜 + values: + - byjrbi + - RqfcIc + - dLaAUt + topologyKey: BUfQ +annotations: + He: OemFaO9 + QE5O: 6CBP +automountServiceAccountToken: false +autoscaling: + enabled: false + maxReplicas: 400 + minReplicas: 455 + targetCPUUtilizationPercentage: 64 + targetMemoryUtilizationPercentage: 472 +configmap: + create: true +console: + roleBindings: + - zn: null + - WCQKaiaj: null + py: null + roles: + - {} +deployment: + create: false +enterprise: + licenseSecretRef: + key: 4F + name: k +extraEnv: +- name: fqLRMsbtI + value: VzzHe + valueFrom: + configMapKeyRef: + key: "" + name: 1au8QkGsYcK + optional: true + fieldRef: + apiVersion: "38" + fieldPath: rM + resourceFieldRef: + containerName: Moz + divisor: "0" + resource: V + secretKeyRef: + key: IQ7AC3i60u + name: BCb + optional: false +extraEnvFrom: +- configMapRef: + name: twq36B + optional: false + secretRef: + name: OLKXh + optional: true +- configMapRef: + name: Pyr + optional: true + prefix: nyu + secretRef: + name: HDmfly7EP + optional: true +- configMapRef: + name: 2TmUL8GD + optional: false + prefix: R5 + secretRef: + name: TyS + optional: false +extraVolumeMounts: +- mountPath: 4zQSAo1Lj + mountPropagation: 檛ȂWg + name: eeS + subPath: iaw3G + subPathExpr: N02q4 +extraVolumes: +- name: "" +fullnameOverride: j1dUk8TGy8Np +image: + pullPolicy: 谝鞛榜ɸ暐ɸ刀x喋 + registry: zi + repository: MTSoVvJ + tag: a25lJOfGpG +imagePullSecrets: +- name: OlRQO +- name: Hkuk3 +- name: fP +ingress: + annotations: + ADJxl: n5EK4WzM0 + M: Zoud6 + eWXUqq: "" + className: "27" + enabled: false + hosts: + - host: 6PclZ7Q + paths: + - path: RqbF29XX + pathType: WB + - path: npV1GL + pathType: zxvm + tls: + - secretName: Q + - hosts: + - EvjYI + secretName: gRDta + - hosts: + - zlgJP1 + - g367Bgr1 + secretName: eQ +initContainers: + extraInitContainers: d5lM +livenessProbe: + exec: + command: + - S + - eqi + failureThreshold: -574948042 + grpc: + port: -653621031 + service: ir + httpGet: + host: qboin0qudh2Y + path: 4jFbHK + port: 9APWoaII + scheme: ćdž埭]KU + initialDelaySeconds: 1217073146 + periodSeconds: 2084735603 + successThreshold: -1091703574 + terminationGracePeriodSeconds: -4975007928507132892 + timeoutSeconds: -203727359 +nameOverride: ld +podAnnotations: + Scdn: fLH1yCm + lCp: Hi +podLabels: + 6AmpBMD: yDh + lPb: vi6tx4 + u: Vai7 +podSecurityContext: + fsGroup: -4268923634359973318 + fsGroupChangePolicy: 椶'ɏ4Ŝʘþf¸ǚļţRď0 + runAsGroup: -5513988494785819878 + runAsNonRoot: true + runAsUser: 3348050323720255791 + supplementalGroups: + - -9211346208910065015 +priorityClassName: 89gnK9rXyDXui +readinessProbe: + exec: + command: + - WCCn1 + failureThreshold: 1866953941 + grpc: + port: -978078521 + service: Gk8q + httpGet: + host: 4aDbYIp + path: sFssnZ8D + port: b9TEE2n + scheme: n8鞘呷2ef嫰髡箩棔螇džNj雤 + initialDelaySeconds: -1624688782 + periodSeconds: -231284043 + successThreshold: 1609785496 + terminationGracePeriodSeconds: -564252460349465292 + timeoutSeconds: 767134266 +replicaCount: 444 +resources: + limits: + wjrESvfqh: "0" + requests: + fSPJBFEwK58: "0" + j: "0" +secret: + create: false + enterprise: + licenseSecretRef: + key: iKQ6Nz + name: OD68lA + kafka: + awsMskIamSecretKey: "" + protobufGitBasicAuthPassword: GKaL + saslPassword: J6S + schemaRegistryPassword: 8PuilRN + schemaRegistryTlsCa: "" + schemaRegistryTlsCert: "" + schemaRegistryTlsKey: LsoxQcg + tlsCa: rGkjDT + tlsCert: gzs + tlsPassphrase: "70" + login: + github: + clientSecret: BGgKCBXeA + personalAccessToken: S + google: + clientSecret: KQXew + groupsServiceAccount: Ll + jwtSecret: 95jKDcdtX + oidc: + clientSecret: "" + okta: + clientSecret: b + directoryApiToken: "" + redpanda: + adminApi: + password: y2jU08n6KI + tlsCa: 6YyBT + tlsCert: ZkxE + tlsKey: MpUTYb4y +securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - Ƹłš硇¹,9菧ȉŪ転Ǹï7ĭɜ + privileged: false + procMount: 榷ŋĦƨÈ俟ţUȫ桊fLŊƐbƼɤ襐 + readOnlyRootFilesystem: true + runAsGroup: 2134851813508950156 + runAsNonRoot: false + runAsUser: 1677623433130194771 +service: + nodePort: 470 + port: 46 + targetPort: 43 + type: uqFB +serviceAccount: + automountServiceAccountToken: true + create: true + name: fP77cJ3T +strategy: + rollingUpdate: {} + type: '>Ƒ梚ǩ' +tests: + enabled: true +topologySpreadConstraints: +- labelSelector: + matchLabels: + IoAy: C6rMwI0 + eM8D7JD5PJ: "n" + lFmG: gJ3l + maxSkew: 839777044 + minDomains: -1438737093 + nodeAffinityPolicy: Ƭ氄ɿ[閾pʙ9 + nodeTaintsPolicy: j珙%!溌BN + topologyKey: 2GZ + whenUnsatisfiable: 屄ɧȄ +- labelSelector: + matchExpressions: + - key: UQkB4Vn + operator: D86i溨F'>亖÷ + values: + - pH + - LHgYM1W9 + - gO + matchLabels: + bw52WaG7: 5zm31oU + t99k: AF0 + matchLabelKeys: + - lkYaHo + - 4tzd + maxSkew: -1948819142 + minDomains: -1754532325 + nodeAffinityPolicy: 酝ʪ+彨緱Y塞雾}捋嗭0]ȰʤĖé横 + nodeTaintsPolicy: '#騅Ɵ$F圃拱鿎鵅xq' + topologyKey: z2NL + whenUnsatisfiable: uȤÝ酑 +-- case-039 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: OiH + operator: Eʤ#/7諨 + values: + - iYzfGpa4 + - PaMqxj5fj8 + - sWaI + - key: Pw + operator: Kw[o0鿚 + values: + - Gnm + matchFields: + - key: YO9QL + operator: ȏ网牙鍩橷潗D9騭ŗʈ求U縷讒Ƴ漏哟 + values: + - XV65fSG5o + weight: 144962453 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: [] + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: p2uqgWn7p + operator: ǙmX窀ʄʙ婘m.Ƈ谱qŴĆ揿 + values: + - IQGwhE + - Hiut + - key: mrN9GbREak + operator: oʟ + values: + - GZkF1BV + matchLabels: + 8bOT0: pvv + VYd3OWm: 0gW5 + matchLabelKeys: + - thrYIp + namespaceSelector: + matchExpressions: + - key: sonam3I + operator: "" + values: + - a9M + - bM + - key: ZFAy + operator: yW揚ɻʖî床哲ɯǮ^DzǓ + - key: ZwHE + operator: sǍ逘璿Ǧ5u軟DZ鞏綇鏑Ɲ` + values: + - 1D6 + matchLabels: + MoK3: j4Rw + namespaces: + - yS + - F2VMFv + topologyKey: wNv3 + weight: -1334539094 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: Hp + operator: QɃ蒜§Ɩ5SyǸ鎧ȝ)ɒ獬v氮n兡Ĝ + values: + - "" + - y3ufRu75J + matchLabels: + Sbhb4LC: p + U1NMpjoLa: BC1D + eIgw: tBbWDRZ7j + mismatchLabelKeys: + - iWKlUgr + namespaceSelector: + matchExpressions: + - key: 9HkK + operator: ȃĕ送 + - key: P9rh1yxLN + operator: ŋľ&謮稠Ÿ珀胔俨ʎŰ + values: + - 16yHoCooS + - r3ym6YAoy + matchLabels: + PrnS8: K2h + namespaces: + - s + - US2hE + topologyKey: 5SbLzS + weight: 1219402233 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: 082AGo10x + operator: pȁij~搣ɢDĝ偩ʣȘ'oIʓ?憏圽U + - key: CXjEgRK + operator: 颭镃Ș蠮S闬耧涐²ǒ圡窽ǹ(ǁ + values: + - zIVWI7jXh + - HE8UDiZnhVG + - "" + matchLabels: + FRgh: MUBtKVc + iu: K3 + jV: 5jM + mismatchLabelKeys: + - h2 + namespaceSelector: + matchExpressions: + - key: "" + operator: mHɻȐĪ$ + values: + - GFueB + - 5prw02 + matchLabels: + KgBnfc: t9Hb4 + SxGw: 4qCJppj + h3m2: gRc + namespaces: + - 1maI + topologyKey: UCy + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: 08Q + operator: $鏪轟ſ俨+嬯呦ĄȕɓJp + matchLabels: + kSy3s8nE: Q0 + matchLabelKeys: + - bf0Tpn + - I + mismatchLabelKeys: + - 0Bm09lf + - P7 + - lyb2 + namespaceSelector: + matchExpressions: + - key: 6zTBp0G7 + operator: 氯¥+Dz睧勪娳Ƨ伮慒{ąɫ`瑛稃5绨 + values: + - 1YVGovQ + - bJ + - key: Cxm + operator: 芼 + topologyKey: f + - labelSelector: + matchExpressions: + - key: jNrAref + operator: 接ʼnĎ + values: + - N0 + - ZNwtHjxR + - key: 33k8BGf + operator: rĴr+qȩȃ休3Ȳȅ + values: + - "" + - E8yL4W + - 9anWnm + matchLabels: + WyV0Ct: 6BVL + vLUV: mvMLwn + matchLabelKeys: + - 9O + mismatchLabelKeys: + - CO + namespaceSelector: + matchExpressions: + - key: Jiyaq + operator: ɯ唺饓9 + values: + - qogYf + - key: UXg6 + operator: à! + values: + - phW2 + - BItew + - c09DZ9v + - key: hPhLpBwJ + operator: g«疻:糄Ś$q + namespaces: + - jAvA + - 0V6Uv6PU + - AOoh3 + topologyKey: d2QYa +annotations: + IJC774: 5hK + P1Py: YYAic7jN + REyW: 7LdLtJYMz +automountServiceAccountToken: false +autoscaling: + enabled: false + maxReplicas: 461 + minReplicas: 403 + targetCPUUtilizationPercentage: 297 + targetMemoryUtilizationPercentage: 161 +configmap: + create: true +console: + roleBindings: + - 6O4d: null + EY: null + oPTMvYGp: null +deployment: + create: false +enterprise: + licenseSecretRef: + key: KvJNskb5ptO + name: vVsE +extraContainers: +- args: + - fajfbgt + - 1XG4cARu + envFrom: + - configMapRef: + name: F5n + optional: false + prefix: Prg + secretRef: + name: vq2FHcobO + optional: false + - configMapRef: + name: Mfdidfx + optional: false + prefix: eggfGpU + secretRef: + name: gX5GT + optional: false + image: H + imagePullPolicy: 玣ɟ踣 + lifecycle: + postStart: + exec: + command: + - 5ABG2Ao + httpGet: + host: D4S2dPB + path: QCCIL6 + port: wu + scheme: eSÉĝ嶤ʮ牑 + sleep: + seconds: -6736232898620818377 + preStop: + exec: + command: + - "" + - 9oy + httpGet: + host: vIPKpEbM + path: l4HaTS9 + port: -180983347 + scheme: h儷#PX盩ʋÈ + sleep: + seconds: -3654571329064470871 + livenessProbe: + exec: + command: + - zGWiFCpvJyG + - 2A + failureThreshold: 130427535 + grpc: + port: -458689504 + service: keBJI3 + httpGet: + host: fkJ + path: MFy2 + port: 1638404838 + scheme: ƵĜRóM螻作仄ĨgŋƷ蔶慅Ƹ + initialDelaySeconds: -1024094942 + periodSeconds: -1045387639 + successThreshold: 966241980 + terminationGracePeriodSeconds: 43907789703605006 + timeoutSeconds: -2115548430 + name: n65z1Le + ports: + - containerPort: -496460005 + hostIP: m9e0LZZ + hostPort: 557092727 + name: hG + protocol: 奀x儋韖ȃ嶍射擋- + readinessProbe: + exec: {} + failureThreshold: 1620135876 + grpc: + port: -1149097195 + service: 7KtLa + httpGet: + host: Mel9pu + path: J + port: Bl + scheme: 臹欔 + initialDelaySeconds: -750113074 + periodSeconds: 820678693 + successThreshold: 1708685033 + terminationGracePeriodSeconds: 6351250062493105403 + timeoutSeconds: -89282235 + resizePolicy: + - resourceName: Cm2W + restartPolicy: o^Cǐɬ醒ÛQȌ帧圷孩Ą + - resourceName: jhEz4gNWQKP + restartPolicy: DV庴 + - resourceName: EgwUKXikbg + restartPolicy: 瑚 + resources: + limits: + 2jSTU8: "0" + 7OI: "0" + FIfseL: "0" + requests: + EPF86: "0" + GcwO1SNT: "0" + restartPolicy: '>Ǥ摔ȶ蘭ɘʜɩ' + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - J + - 8垺ŭihȸ£gJĠǐ!İ0 + - ƶ害Ƈ§孶邸 + drop: + - 龈PeęIJ傮ȅ溣E忬鮷蜆GÊ霌 + - þƢ^ + - RTmī07ý謐ɩ噎 + privileged: true + procMount: (朴頲碞!0¿搻ź)磑[哈YǓěNG$ + readOnlyRootFilesystem: false + runAsGroup: 3606686082741296584 + runAsNonRoot: true + runAsUser: -9076124251416402294 + startupProbe: + exec: {} + failureThreshold: -2038237600 + grpc: + port: -992723564 + service: bMQIm4Y6fY + httpGet: + host: w0Z6WQWwn + path: Kw + port: KdZFUIvpm + scheme: L媰 + initialDelaySeconds: 266050830 + periodSeconds: -879749840 + successThreshold: 1098563171 + terminationGracePeriodSeconds: -3577990655544091297 + timeoutSeconds: -838391922 + stdinOnce: true + terminationMessagePath: bh7 + terminationMessagePolicy: 餔Ŵ婜 + tty: true + volumeDevices: + - devicePath: 5EA9lR0y + name: wCP0dl2Uf + - devicePath: IKOQwmn + name: connmB4Ve + - devicePath: hssHEiwb + name: vP68uD + volumeMounts: + - mountPath: 9Yvkg + mountPropagation: Q众XM娪08菫 + name: XP + readOnly: true + subPath: Mk + subPathExpr: LV + - mountPath: 381fE + mountPropagation: ǚ钍jǍŏh濢n1ŕǼ姕ŗđċCʏ(漇 + name: 4prce + subPath: tvkrRPN + subPathExpr: Otc + workingDir: D4 +extraEnvFrom: +- configMapRef: + name: zdN8iNs1e + optional: true + prefix: z + secretRef: + name: tGw + optional: false +- configMapRef: + name: qRSvRtA6 + optional: false + prefix: dE0dDLvy + secretRef: + name: m + optional: false +extraVolumeMounts: +- mountPath: nTxUyaL + mountPropagation: "" + name: cwkJrEER + readOnly: true + subPath: FKU9h + subPathExpr: 12vLerk +- mountPath: DuUpWysEh2r + mountPropagation: IƏ + name: YlcuH + readOnly: true + subPath: 1faJ4ypp7 + subPathExpr: ZDct +extraVolumes: +- name: bdnliW +- name: Tr +- name: cd +fullnameOverride: bbshm +image: + pullPolicy: ɴ烚庻阐狘:ŭ(M$tY炜ī崞Ž + registry: QxUvz + repository: Gr + tag: hrAYj1i +imagePullSecrets: +- name: MTOK84IL +- name: YAl +ingress: + className: qyKUEOUT4u + enabled: true + tls: + - hosts: + - F7m23 + - "7" + secretName: M +initContainers: + extraInitContainers: aSeq42klM +livenessProbe: + exec: + command: + - ajpIBjdV + failureThreshold: -1650923727 + grpc: + port: -598400902 + service: NoUl1T + httpGet: + host: "1" + path: T + port: -1011339684 + initialDelaySeconds: -1047122153 + periodSeconds: 300714247 + successThreshold: 1660165948 + terminationGracePeriodSeconds: -6817463041894309382 + timeoutSeconds: 497385152 +nameOverride: o2F37Lr +nodeSelector: + Md8w5MD: cTipUm6 + Y31W: uQ5xyo +podAnnotations: + 5oGD5: wKq + Qi815eSQdI7wJ: SwgPh + vAJU: z +podSecurityContext: + fsGroup: -1210907643611065698 + fsGroupChangePolicy: IJ鄔ȫ荪癓椥%k矜椒ʊ0宻lƑɜIɇ + runAsGroup: -4059110951032458810 + runAsNonRoot: false + runAsUser: -6169453912741831517 + supplementalGroups: + - 5292690601828357137 + sysctls: + - name: xY9WN + value: JL + - name: v7R + value: q1nexB5KTD3SE + - name: PN + value: neE5ismaY +priorityClassName: aDlP +readinessProbe: + exec: + command: + - 2xO + - BlUV + failureThreshold: -2130189853 + grpc: + port: 996585883 + service: qWavRHqQOBBP + httpGet: + host: U + path: MJdmT7Y + port: aujUU + scheme: ¹Ť碏譽> + initialDelaySeconds: -781516024 + periodSeconds: 241739148 + successThreshold: 912206192 + terminationGracePeriodSeconds: 1472699093368179429 + timeoutSeconds: -1948646722 +replicaCount: 122 +resources: + limits: + g51: "0" + requests: + Wd: "0" +secret: + create: false + enterprise: + licenseSecretRef: + key: PXlML + name: 1ZXP + kafka: + awsMskIamSecretKey: Q8ZB + protobufGitBasicAuthPassword: 6x8Cv + saslPassword: kPhPSQWJJ + schemaRegistryPassword: JK + schemaRegistryTlsCa: SnQ + schemaRegistryTlsCert: nrxxx8 + schemaRegistryTlsKey: aizaszl + tlsCa: tKnCvE97 + tlsCert: XQGOjdnSY + tlsPassphrase: UIS + login: + github: + clientSecret: RAo + personalAccessToken: YJtxt19kpv + google: + clientSecret: V0kmwLq + groupsServiceAccount: AaiW + jwtSecret: FGWF3nXjDA4 + oidc: + clientSecret: rnv + okta: + clientSecret: ZE5mxhO6s + directoryApiToken: 7z + redpanda: + adminApi: + password: YwKgntj3 + tlsCa: ywmMdJU + tlsCert: OK6C5sNI0 + tlsKey: eNdF9knNN +secretMounts: +- defaultMode: 368 + name: GaEvNh0Ifo + path: 8c1 + secretName: "" +- defaultMode: 412 + name: Dy8Ef + path: X2Ct + secretName: QRQFk +- defaultMode: 211 + name: cLEkHy + path: alMc11eGER + secretName: 8miR +securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - ƕE仍腽ʨLJ甴Z´:涟 + - mŠ'菴h饘ǦŃ2 + privileged: false + procMount: 麤绊噃ȳ{ɚƪ秥ȧG + readOnlyRootFilesystem: false + runAsGroup: -8188439767627968973 + runAsNonRoot: true + runAsUser: 2990782549155496077 +service: + annotations: + 4yhZo: zLVEslN + Amz4VM: QAvK + IPCS: b1R + nodePort: 233 + port: 400 + targetPort: 329 + type: dPOD9Kzb +serviceAccount: + annotations: + PPZDrdmxKV: UBjiSx + automountServiceAccountToken: false + create: true + name: 8s2qVhKEW +strategy: + rollingUpdate: {} + type: '!蘃«2狺čH' +tests: + enabled: false +topologySpreadConstraints: +- labelSelector: + matchExpressions: + - key: K98063hAMXd + operator: 閃ŘDZƳwųA旰C汔§挦塳¹@ē + matchLabels: + y9: GJEjaj + matchLabelKeys: + - 4xZpqk + maxSkew: -659297182 + minDomains: 1124395321 + nodeAffinityPolicy: ʬC8 + nodeTaintsPolicy: 鱯禓瞝 + topologyKey: mq + whenUnsatisfiable: A´ʕɭNÀȜ龎q擞u貒槂轌v +- labelSelector: + matchExpressions: + - key: Yd + operator: "" + values: + - dCWo2pjVuA + - hl8G3Kp + - M + - key: VYxo + operator: _k?Ř + matchLabels: + 3kRK: xOzJ6 + KUwsC: FN5bAqvV + QPay: w0lIH + matchLabelKeys: + - gkJFY + maxSkew: 501038978 + minDomains: -2011840701 + nodeAffinityPolicy: Łdz倾僚ʒ屆9ÐE釤Ŏo + nodeTaintsPolicy: Ǩʖ#Ŭǧ¦Ûũ°啑 + topologyKey: JCJYk4 + whenUnsatisfiable: 暛ūZɆǗ絜皼bȇĀ簁搿WXƪçɗÁ +- labelSelector: + matchExpressions: + - key: gyZMV + operator: ƲƬ釒橙ȋ齸鑝鷳ĔǸɊZ聻趁õÈc + matchLabels: + T1YT: SJYt + W: ZaF + WdGxif: 3EKPjb9 + matchLabelKeys: + - ukD8HM + - mD + - Z + maxSkew: 1774410820 + minDomains: 36391976 + nodeAffinityPolicy: "" + nodeTaintsPolicy: ŵɎļ%鋏[ʞô + topologyKey: oGrtNcnUje + whenUnsatisfiable: ƓǪĈɏ荥蟗Ș鉢A +-- case-040 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: 7RRFnuao + operator: 鑿梞e璺瀧敢tȱ + - key: 3qz030r9N4 + operator: 脟óȨq駥Ƽx垤R$L + - key: 4egJ + operator: 敕ƒ洀ņ+Ō轲C丼Ʒij.ƾ蚯ƺ痻3皆咒 + values: + - "" + - J66saNw8 + - xBRUfDKhiA + matchFields: + - key: Kgp4qFm + operator: 桋iz<ïŃǃ襶D齿 + - key: 7F + operator: "" + values: + - iquNT + - aFPIw + - lYMJn4Un3 + weight: -954635927 + - preference: + matchExpressions: + - key: ePHgEs + operator: 撹ł + weight: -2109244754 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: gK + operator: 垭ʮȌ)"彛 + values: + - Vvo + - "" + - key: n0 + operator: 挪VɱȒ + values: + - 595ST + - sHQoTQgQ + - ZyYxnGB + matchFields: + - key: "8" + operator: 餒ơ鋦r)锟壃m汇 + values: + - H8 + - matchExpressions: + - key: nErJm + operator: Ûɟ敀淽 + values: + - sbjW + - 1l + - go + matchFields: + - key: ozzkD4D + operator: Ʌ\h崭蠒ȓ旉蹖楚_掁S5 + values: + - NrN0Id15O + - VrahPz + - YJfhO + - {} + podAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: qiGNj + operator: jƯȨ穞ɿPȧ + - key: HPRR + operator: ž8ƃKKDz蠽ƚ0ƻ + values: + - NAx + - Pr2F + matchLabels: + LY: ZRjD + matchLabelKeys: + - ikCO + - n25 + - IY0AqNStYm + mismatchLabelKeys: + - uO6G + - EFKfLOM0 + namespaceSelector: + matchExpressions: + - key: frBwUGG + operator: ǧ啯ʖ6džȡ衺Z莋æȘzv + values: + - 68q + - PrId4k5Nk + - 1Izg6c + - key: H5neR + operator: "" + values: + - gf2 + - "" + - key: LTEiVQV + operator: ʅďl$y韙bO儺e籾吕ŃV + values: + - LccIflVn3 + - QX + - kRZLtn + matchLabels: + lccn5: lx6 + topologyKey: AE + - labelSelector: + matchExpressions: + - key: ljGag0 + operator: "" + values: + - 3AlcF9eOiK + - key: XPoIj + operator: ĻĵN稙²x鸴ʊ + - key: "" + operator: m[ɻD«ʯĢĥɖHÃú锺N蓍!f + values: + - cwRFs + - wJtpMgyV1I + matchLabels: + 6gzmw2BW: v1eC + QI6Gl: Ckzyw0v + uRw21: 36kl + mismatchLabelKeys: + - XiX9Mrhv + - Xk2Ri + namespaceSelector: + matchExpressions: + - key: Roq9G + operator: 槓G{? + values: + - YCBJEhS + matchLabels: + 9X5C: TU1y + PG1k: 8j76iX8R + iYq9QLUSh3bk: Mvl2WRQ + namespaces: + - Pp + - z1O9mW5rB + topologyKey: U + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: pqtCgWlk + operator: eŭñZ) + values: + - 6eUrtsX + - GmGeP7 + - pBhe0 + - key: gctw + operator: L?岤紎!蠾黅誽帯÷Ʉ坏q + values: + - G + - "" + - "" + matchLabelKeys: + - IGYc + mismatchLabelKeys: + - C + - XlxD2Y5h + - Eut + namespaceSelector: + matchExpressions: + - key: QNvJq6Uc + operator: Ǔƀ閝遨垛簙UdĢ7ȍ騽¹DŽ + values: + - m4wq + - TmuqVB1 + - key: PTVC + operator: 珙'ɀɒ虃龓楼ƺ譄êǿ + values: + - w + - K + matchLabels: + GQp: tw + namespaces: + - t + topologyKey: I9Ng7D + weight: -278680619 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: IaZiqfV6 + operator: 幋x:Ȗ + values: + - XmaYG80 + - aaEScB + - DxB + matchLabels: + J3Ny9zUJ2DOTKO: eiUL0RR + lt: bqOs + matchLabelKeys: + - XYHp1S + - JKj1 + namespaceSelector: + matchLabels: + WopugltEP1J: eaGpkiS + namespaces: + - H9w9Q + - A8D + topologyKey: pvkKW + weight: 252280673 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: lSi + operator: 襚ǫAŇþ腦W[ĕ嘱ʌſœɃ槏Z岪 + matchLabels: + OzmceOBQ: F2mtk + QcoH: qt3OR6ZcjY + t5Cqg1: 1x9WW8EUyyn + matchLabelKeys: + - 0XGJ + mismatchLabelKeys: + - K6T + namespaceSelector: + matchExpressions: + - key: KoofEA + operator: ' íɀ馩Ȭɫġo娤螗暴Û漷ʦO腔' + values: + - nj + - U + - onkfJ4 + - key: 0aO + operator: Ŷű輖+¶)罩ƌ×螂 + matchLabels: + 2hf: GeFfROs4 + pA23: kqkG + rZ: DH6cT + namespaces: + - yvfsu + - L3Pu + topologyKey: BBBCjZel + weight: 392487334 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + 0hp: sd9 + mwTeR: D3HlJbmoK8 + matchLabelKeys: + - MwDkniC + - "" + mismatchLabelKeys: + - VuQB + namespaceSelector: + matchLabels: + 1x: Pj + D3J: 4gFps + bQU: weT0tI + namespaces: + - y9zrYKWApO + - rq0K3 + - 5XUeP7 + topologyKey: P7V + - labelSelector: + matchExpressions: + - key: Jv + operator: 啽ŃŐø + matchLabelKeys: + - s + namespaceSelector: + matchExpressions: + - key: Fy5Deb + operator: 旉錛!荕Ɂ! + values: + - nbiy + - "" + - 6QORDbd6zn + matchLabels: + bba0KJ: NE1j + nYif5xu0Hy9XW: 0s + qAoT: "46" + namespaces: + - 4JHyx + topologyKey: 7621t +automountServiceAccountToken: false +autoscaling: + enabled: false + maxReplicas: 470 + minReplicas: 361 + targetCPUUtilizationPercentage: 160 + targetMemoryUtilizationPercentage: 475 +commonLabels: + X: zjmrl + "Y": yG0 +configmap: + create: true +console: {} +deployment: + create: true +enterprise: + licenseSecretRef: + key: a7Ph + name: zsHNWVcS9 +extraContainers: +- args: + - jlI16Xnnb0 + - x0Z + - Tv6z + command: + - 3MnkZe0L + - OK + - cKvaGI + env: + - name: 7RtgX9 + value: TQH + valueFrom: + configMapKeyRef: + key: "" + name: GE2 + optional: false + fieldRef: + apiVersion: x2H + fieldPath: iVYVzT + resourceFieldRef: + containerName: 3QSG + divisor: "0" + resource: AgMtPE + secretKeyRef: + key: BhGA6 + name: LKemd3Cs9 + optional: false + - name: 9dFxchX + value: huoZj + valueFrom: + configMapKeyRef: + key: skdmo + name: gSEkUx + optional: true + fieldRef: + apiVersion: ymAcwLzaJ00G + fieldPath: de9Q + resourceFieldRef: + containerName: ZgwwQvA + divisor: "0" + resource: OTraA + secretKeyRef: + key: Pe8 + name: 39mCZV7ERv + optional: true + envFrom: + - configMapRef: + name: l + optional: false + prefix: kGdnbCakM + secretRef: + name: JrDM + optional: true + - configMapRef: + name: 0iH67 + optional: true + prefix: 3JVMhcII7 + secretRef: + name: PS1J + optional: true + image: Bx3IW17kjF7 + imagePullPolicy: È8秏糇 + lifecycle: + postStart: + exec: {} + httpGet: + host: EeLx + path: JC + port: 638412697 + scheme: 翔ĩñɁɬj局³喪Eů磘Ʒ唡嬤 + sleep: + seconds: -2739564842418698030 + preStop: + exec: + command: + - zjNyV + - 3i + httpGet: + host: RxhMCXQN + path: Dq + port: -821303664 + scheme: 髒xD>?ǠĆ踃w¬ + sleep: + seconds: 8925361607851382825 + livenessProbe: + exec: {} + failureThreshold: -2015695369 + grpc: + port: 102189788 + service: VG2k6Atq + httpGet: + host: 0dxm + path: Pix7SytH + port: 284583441 + scheme: 畝ǂƬƜ聞|b + initialDelaySeconds: 1150668189 + periodSeconds: 1279412097 + successThreshold: 337444728 + terminationGracePeriodSeconds: -665826210809930777 + timeoutSeconds: -802810999 + name: 1KSo0a + readinessProbe: + exec: + command: + - 3cCL4 + - en + - VN0 + failureThreshold: 448729232 + grpc: + port: -174942651 + service: paUcCUtV8A6 + httpGet: + host: tSEChhvGgDsf + path: Jrr + port: 516172996 + scheme: c{Ƭ臾斡:Ɣ?Í + initialDelaySeconds: -714126900 + periodSeconds: -88316167 + successThreshold: -1820867160 + terminationGracePeriodSeconds: 272130190949654337 + timeoutSeconds: 1803351679 + resources: + limits: + f9GQWFTKPFP: "0" + g5: "0" + requests: + 4A89zLoFG: "0" + SmOBH: "0" + restartPolicy: Ű高ǙG%7BČCaďʥyď + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - H鞕ă鶅镀秀 + - Ŏ昮0yƤɯ斺R妕Je芓BɜCĵ + privileged: false + procMount: ÿʑ鎆乭cŇ陛ǼȠn + readOnlyRootFilesystem: true + runAsGroup: 5591360478943231672 + runAsNonRoot: false + runAsUser: 6381588597473822835 + startupProbe: + exec: + command: + - rV83LKQ + - 87Vc + failureThreshold: -2022114361 + grpc: + port: 1348736621 + service: Gx8f9phR + httpGet: + host: fWnW4CGV + path: yQl0PNEE3g + port: TYi + scheme: 絅xn,ȵ6ʎ癙 + initialDelaySeconds: 205090742 + periodSeconds: -1401542741 + successThreshold: -2130268569 + terminationGracePeriodSeconds: 4104437343850793050 + timeoutSeconds: 604054255 + terminationMessagePath: ec8kHaD + terminationMessagePolicy: 甎i + tty: true + volumeDevices: + - devicePath: NFjF + name: AH + - devicePath: "" + name: u + - devicePath: 0q6A + name: nFe3FY4 + volumeMounts: + - mountPath: ad7JXhGN + mountPropagation: =廄殞+ + name: qVHWCUHp + readOnly: true + subPath: m3RBekA0 + subPathExpr: 7F0F8Ge + workingDir: LmnqIVV +- args: + - 3g94Jb + - "n" + - HxatWli7Qe + env: + - name: yKfn + value: fni0 + valueFrom: + configMapKeyRef: + key: cQjxg02ud + name: DqLUCO + optional: false + fieldRef: + apiVersion: dS + fieldPath: aH + resourceFieldRef: + containerName: BVSH2Bxu + divisor: "0" + resource: ZLW3 + secretKeyRef: + key: J + name: APYyG5qY + optional: false + - name: b4i9WEf + value: Ru + valueFrom: + configMapKeyRef: + key: mzxgZ + name: XgDd + optional: false + fieldRef: + apiVersion: U1l + fieldPath: sG2pcjz + resourceFieldRef: + containerName: Vlc1Ru + divisor: "0" + resource: hZpqB + secretKeyRef: + key: X0W3QpdAhux + name: I3L + optional: true + envFrom: + - configMapRef: + name: DJjN7Phe + optional: true + prefix: 4K2MBzNl + secretRef: + name: s4GF + optional: true + - configMapRef: + name: td0aZ + optional: true + prefix: CYvFW + secretRef: + name: WaBWGCRa8 + optional: true + - configMapRef: + name: ehHs9m + optional: false + prefix: n1x + secretRef: + name: TdUJ + optional: true + image: UNJ6E6 + imagePullPolicy: 砓³绔丬A + lifecycle: + postStart: + exec: + command: + - Qs8Sd + - JGX4Qj + - eCw00uq + httpGet: + host: NNLSd + path: y4tS + port: QzOfwe3a + scheme: º猗ĥɮƅLɘ隮术ƒ赥;,ǝ髳Ĝ7Ĭ嬳 + sleep: + seconds: 1170469124057922158 + preStop: + exec: + command: + - TN62uDLAuIx + - ndI + httpGet: + host: t7H6l2 + port: RHeYpAvJ8 + scheme: KǠɀƴ杔¸Ɉ$毕削peýfv! + sleep: + seconds: -5232306180460338099 + livenessProbe: + exec: {} + failureThreshold: -1900233123 + grpc: + port: -1323381498 + service: wJ + httpGet: + host: pAHsn3 + path: k31zW1 + port: 2elbrK + scheme: 痯秿丌 + initialDelaySeconds: 537756270 + periodSeconds: 1139432456 + successThreshold: -289377675 + terminationGracePeriodSeconds: -709025030374540888 + timeoutSeconds: 254134433 + name: zWs + readinessProbe: + exec: + command: + - x093a + - v1 + - Ef + failureThreshold: 75768089 + grpc: + port: -237977747 + service: "y" + httpGet: + host: EBEth + path: C + port: 790399211 + scheme: ær堹mhʢ + initialDelaySeconds: -157687184 + periodSeconds: 1071897332 + successThreshold: 824432298 + terminationGracePeriodSeconds: -54575953702939670 + timeoutSeconds: -1190752843 + resizePolicy: + - resourceName: R9fM + restartPolicy: ?ʖȒƅƀ逎v鐰wģ籫 + - resourceName: 7C + restartPolicy: óʌF鿯薸k} + - resourceName: Bqy + restartPolicy: E吻X秤} + resources: + limits: + UMJnobyO: "0" + qJmAwr: "0" + requests: + ZktW7e51vRUG: "0" + restartPolicy: '>ŀ鎙莸鼔茷蝼薼Ƽƅ°3貦罌臣洴軟處姼' + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - 儜vƝ¾ + - 輝Ġ$琑+檂 + - 飂 + privileged: false + procMount: ɓĎʙʗG0瑑娄K坢Ö&Ù + readOnlyRootFilesystem: true + runAsGroup: 2234167178876811137 + runAsNonRoot: true + runAsUser: -1191472066985646967 + startupProbe: + exec: + command: + - KGi9U + - D6 + - HZ3aC1 + failureThreshold: -2057203764 + grpc: + port: -1203229903 + service: Xd + httpGet: + host: tTW + path: oWk + port: -1347841801 + scheme: 檸`sȝBULj懄 + initialDelaySeconds: 1386184157 + periodSeconds: 2110004457 + successThreshold: -692279219 + terminationGracePeriodSeconds: -7060466210747559086 + timeoutSeconds: -905577521 + terminationMessagePath: g + terminationMessagePolicy: 頨Ĥ° òȯǤū暓坐ƚă杋鍄 + volumeMounts: + - mountPath: FmQht + mountPropagation: 饌^ǩ朳ųW磀ĥAijƨ+= + name: j5 + subPath: aoEWb7k + subPathExpr: 0ra + workingDir: zmwmt +- command: + - oFEaN2U1 + - HuBj9vk17eCjI + - "" + env: + - name: n3JVvVY + value: U14PEXs + valueFrom: + configMapKeyRef: + key: Ai0Xg3owIe7XlG + name: U4 + optional: false + fieldRef: + apiVersion: ZyO4Jpwkp2hV + fieldPath: roNil + resourceFieldRef: + containerName: gx + divisor: "0" + resource: Z + secretKeyRef: + key: AcP + name: qMy + optional: false + - name: oSWakHA + value: eR + valueFrom: + configMapKeyRef: + key: qsSVOr + name: o + optional: false + fieldRef: + apiVersion: SeP3aPXfjLIcfE + fieldPath: 091i + resourceFieldRef: + containerName: T5hI + divisor: "0" + resource: KxGi43CVGe + secretKeyRef: + key: "" + name: 5uI + optional: true + envFrom: + - configMapRef: + name: MujT + optional: false + prefix: cVRH + secretRef: + name: mpF + optional: true + - configMapRef: + name: MeO3F + optional: false + prefix: w3C4 + secretRef: + name: hnYx + optional: false + - configMapRef: + name: NT5MFmC65 + optional: true + prefix: "7" + secretRef: + name: yl2ze1 + optional: false + image: A8o + imagePullPolicy: ?晐T鴭Xp + lifecycle: + postStart: + exec: + command: + - zaLOG2 + httpGet: + host: kA51kbv + path: LMnFclIJczBo + port: 402299955 + scheme: :踖坯(Iȷ碨劅 + sleep: + seconds: 245674034851902981 + preStop: + exec: + command: + - Tz87qO + httpGet: + host: Xr6sP + path: xxE + port: 1901089000 + scheme: 3媧ş>La芸`Lzuŀɽ坤¦.痻Jǻ + sleep: + seconds: 6906639179439192094 + livenessProbe: + exec: + command: + - yxk0313sz + failureThreshold: 385001414 + grpc: + port: 1589713469 + service: UA + httpGet: + host: ZWfT + path: vTNYug5RZh + port: -192111662 + scheme: e¢dYÜdz + initialDelaySeconds: 1708942834 + periodSeconds: 1356452566 + successThreshold: 1750780088 + terminationGracePeriodSeconds: -1272770054640188829 + timeoutSeconds: 1656218869 + name: FxzTg + ports: + - containerPort: 63673829 + hostIP: 4xjED0VKV0G + hostPort: 2007665826 + name: xbwJ + protocol: ¼vb皪螯ʉwʒR玔È覦劙 + readinessProbe: + exec: + command: + - 0S + - "" + - GkPj + failureThreshold: 1405674719 + grpc: + port: -1659132742 + service: gIFP + httpGet: + host: jYnI3ins7 + path: bIEaFAc1 + port: UHfz + scheme: ʼn + initialDelaySeconds: 1531278754 + periodSeconds: -238235402 + successThreshold: -1690388514 + terminationGracePeriodSeconds: -2788228502880198888 + timeoutSeconds: -567709755 + resizePolicy: + - resourceName: nxpzTS + restartPolicy: ƫŀMs+,ǼƞȒ + - resourceName: 61uCVQ1 + restartPolicy: /澰ɍ½鑀a帷[鞺鏨攬姟壃F$R犬 + resources: + requests: + YfM: "0" + restartPolicy: œ|F彟S崘Ȑ貸1Ũȷ+齳 + securityContext: + allowPrivilegeEscalation: true + capabilities: + drop: + - 鸎dĉç荧 + privileged: true + procMount: "" + readOnlyRootFilesystem: false + runAsGroup: 5795239965908151493 + runAsNonRoot: true + runAsUser: 2409160731771391054 + startupProbe: + exec: + command: + - D6j2Q + failureThreshold: 975103738 + grpc: + port: -2081980063 + service: Nh + httpGet: + host: vdLm3FUXIs + path: jqCqF + port: "" + scheme: Ű"ƆĩNÙ襔冠ʈ + initialDelaySeconds: 524220215 + periodSeconds: 923596095 + successThreshold: 547119693 + terminationGracePeriodSeconds: 7382309226647739877 + timeoutSeconds: -1902082444 + terminationMessagePath: 2i5 + terminationMessagePolicy: 踑ĆĦ荷ýA/ǎ桫 + tty: true + volumeDevices: + - devicePath: KlUUX + name: NWO + - devicePath: W1JLM + name: qNw + - devicePath: BVE + name: c + volumeMounts: + - mountPath: yCztpht + mountPropagation: 巧苄;钽肇謌ʭɿw刄wɰM迵. + name: Mv9 + subPath: RWmlw + subPathExpr: Oy + - mountPath: Gf + mountPropagation: ɩ + name: On78O + readOnly: true + subPath: s7p + subPathExpr: 57aJIvpEm + - mountPath: m + mountPropagation: 崌蠿Ƣ湺 + name: CXSu + subPath: F8oe + subPathExpr: S +extraEnv: +- name: cD + value: JW + valueFrom: + configMapKeyRef: + key: "" + name: 8Ri7OfQ + optional: false + fieldRef: + apiVersion: Qc + fieldPath: 6ZYFg + resourceFieldRef: + containerName: qkUV + divisor: "0" + resource: yEf5zz13U + secretKeyRef: + key: xozuxs + name: z + optional: true +- name: "" + value: gea3 + valueFrom: + configMapKeyRef: + key: hwe3l3k2h + name: QX + optional: true + fieldRef: + apiVersion: kx + fieldPath: m7f + resourceFieldRef: + containerName: 0XEGE + divisor: "0" + resource: y4ce5 + secretKeyRef: + key: hmvX + name: 18Z + optional: true +extraEnvFrom: +- configMapRef: + name: DR3hdrvZIv + optional: true + prefix: kGV4HZ8 + secretRef: + name: tR3Yu1G + optional: true +- configMapRef: + name: 6pMd0VA0 + optional: true + prefix: Csp + secretRef: + name: ceqZBJ7fdqP + optional: true +extraVolumes: +- name: iPeR +- name: ZgdCb2kUB +fullnameOverride: KchYZFsbB3 +image: + pullPolicy: -0Ź桛ɼ訚Ņ;秵ňĝ苒9麡ñà臸ʫ + registry: cwfXN2KlU + repository: qYQHJ + tag: RIG +imagePullSecrets: +- name: V1 +- name: AyLzRkaGE +- name: 3pZ8 +ingress: + annotations: + 7KBv: R6qBYfCa + aBRf1: ygsbc + yL0ht8k8h: e + className: N8nne2Adwe5AYa + enabled: false + hosts: + - host: FyKy + paths: + - path: Cgcwa4F + pathType: pcConNItFmo +initContainers: + extraInitContainers: uND1 +livenessProbe: + exec: + command: + - 6VSzmxYwHC + failureThreshold: -1894321442 + grpc: + port: 487517384 + service: INsH + httpGet: + host: JNW + path: QZgsr + port: 228553774 + scheme: 躀廗裲繄鄸爖ž + initialDelaySeconds: 1986051838 + periodSeconds: 541607099 + successThreshold: -1968479306 + terminationGracePeriodSeconds: -7878496327638757142 + timeoutSeconds: 1374945691 +nameOverride: 6sW +nodeSelector: + y63G: wNiNvOMv +podSecurityContext: + fsGroup: 2302511509023017096 + fsGroupChangePolicy: 闦ñ禢`J鉤 + runAsGroup: -2347956389924856743 + runAsNonRoot: true + runAsUser: 1720952380350228641 + supplementalGroups: + - -621944387099711210 + sysctls: + - name: CvGz + value: "" + - name: dO + value: qwZyE +priorityClassName: 3A +readinessProbe: + exec: + command: + - "" + - KEndqzRiV + failureThreshold: 467513555 + grpc: + port: -1573796455 + service: ErWB + httpGet: + host: lLC + path: HH5gzp + port: -1970119534 + scheme: 酥梕ʄE訳 + initialDelaySeconds: -6410364 + periodSeconds: -623380707 + successThreshold: 1641270972 + terminationGracePeriodSeconds: -4383611239728405989 + timeoutSeconds: 1203716236 +replicaCount: 291 +resources: + limits: + "1": "0" + MrwIP: "0" + hgaW: "0" + requests: + 1lF: "0" +secret: + create: false + enterprise: + licenseSecretRef: + key: yoQYDK + name: xU86MHgk + kafka: + awsMskIamSecretKey: b1dpxuu + protobufGitBasicAuthPassword: bNLttpx0UHrQ + saslPassword: WLiPGk4IafDZkx8 + schemaRegistryPassword: d7In271W + schemaRegistryTlsCa: JYJZN + schemaRegistryTlsCert: muZOO19 + schemaRegistryTlsKey: 7cUIM + tlsCa: NWid + tlsCert: v843II + tlsPassphrase: ks1QSKsS + login: + github: + clientSecret: Bh26we + personalAccessToken: yKlBsX + google: + clientSecret: luzCc89Wm0 + groupsServiceAccount: qpX + jwtSecret: ojb + oidc: + clientSecret: cze + okta: + clientSecret: uuUR + directoryApiToken: WOW1d + redpanda: + adminApi: + password: rVI + tlsCa: yMec + tlsCert: YYHCeTg + tlsKey: 4Qv3y5Dl +secretMounts: +- defaultMode: 83 + name: ieSo8V + path: d + secretName: mD0jl +securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - 阊 + - DIȜO吽解诎-曅 + drop: + - 贎秨Ůɭ懾Ù盾| + privileged: true + procMount: ʪ勪įOew\Ǡ礓 + readOnlyRootFilesystem: true + runAsGroup: -6230225082797374618 + runAsNonRoot: true + runAsUser: -2569068293811684873 +service: + nodePort: 314 + port: 424 + targetPort: 17 + type: oZi +serviceAccount: + automountServiceAccountToken: true + create: false + name: Cj +strategy: + rollingUpdate: {} + type: G阏发6s +tests: + enabled: true +topologySpreadConstraints: +- labelSelector: + matchExpressions: + - key: pPoL + operator: ǭȉćŴ讶Y + values: + - "69" + - UC9 + - "7" + - key: 6toZoG + operator: Ġ+kʫȸ颷ʅÓ欽V譵; + values: + - go8adRXrn + - key: S + operator: ĕȻ*Gɝ靿暛_洳瑼Ĩ + matchLabelKeys: + - "" + - V7xIs1 + - eqq + maxSkew: 983843814 + minDomains: 854272231 + nodeAffinityPolicy: '>S篐ö抏茄(6' + nodeTaintsPolicy: e3äTȦ硷B捕萑Ǵ吷Ǿ邂Ǝièø + topologyKey: NoEcMWkg + whenUnsatisfiable: 幗鞲&渶Ÿɪ`鹵N +-- case-041 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: gRchHJ + operator: g>騿b鈐ʃB¾偡医選ȍ恋 + values: + - I + - Ei + - "" + - key: hyf + operator: 斒ʃǜƆƲ + values: + - QUyyD + - key: Bkmx + operator: ư酰姺醪芄堑 + weight: 751548356 + - preference: + matchExpressions: + - key: oLam + operator: 蟹 + values: + - ouUaVpYnKDUI + - key: vjw6GPYYTKt + operator: 竣iN¸嚿×ɮib + values: + - ZTaqp + - key: d8VuBX6qV + operator: 脼Ȩ + values: + - a8aOe1 + matchFields: + - key: twbeCR + operator: óçøG靼Ɏȸ­乷ɍ + values: + - fJAm6rm + - 2h8IU + - zE9 + weight: 291395585 + - preference: + matchExpressions: + - key: qC6uf99en + operator: 鼢犖龆醑喐蠿鯌ʛB契p + initialDelaySeconds: -879591831 + periodSeconds: 1110714898 + successThreshold: -1301180826 + terminationGracePeriodSeconds: 3872467306429462875 + timeoutSeconds: 674947774 + terminationMessagePath: bm28lY3K2pwh + terminationMessagePolicy: Ȇƍ@¦Ț'±0ž + tty: true + volumeDevices: + - devicePath: o8dr + name: XmhFb + workingDir: 5wQN +- args: + - o0cO9clz7 + - HMSb + - 6uV0c + env: + - name: M3V9WePpx + value: ysO25 + valueFrom: + configMapKeyRef: + key: UqaJg4r + name: RfxtXP + optional: true + fieldRef: + apiVersion: lwe4YmNPx + fieldPath: tQj57vj + resourceFieldRef: + containerName: ZQ + divisor: "0" + resource: T + secretKeyRef: + key: x + name: ny4NEtt3z + optional: false + - name: cc2 + value: L0hw + valueFrom: + configMapKeyRef: + key: 385Ue36 + name: mmjoQw + optional: false + fieldRef: + apiVersion: 6oECJJ + fieldPath: viT + resourceFieldRef: + containerName: gwdJxK + divisor: "0" + resource: ck7 + secretKeyRef: + key: UuNsYAQvXJ0 + name: 1NAqDCU3 + optional: true + envFrom: + - configMapRef: + name: ZFk + optional: true + prefix: bXa4IzYR + secretRef: + name: aAJU + optional: false + image: JPgUP + imagePullPolicy: Q ¶ + lifecycle: + postStart: + exec: + command: + - r1uMNf + - M + - 8G + httpGet: + host: cuhhh + path: lXMriYoe + port: -988033465 + scheme: ',轄kzĒfť' + sleep: + seconds: -8820103652541681769 + preStop: + exec: + command: + - bElmX + httpGet: + host: bCNS + path: A0F + port: "" + scheme: 砘ɁA甜猷14ʣ)ǨƿŊ\ + sleep: + seconds: 821413986956195833 + livenessProbe: + exec: + command: + - M9y + - ay + - sRaY + failureThreshold: 600887441 + grpc: + port: 1597779369 + service: ua8K + httpGet: + host: 0XuF + path: V3 + port: -703127215 + scheme: 舷$趺É螳P阁]嚂驶钋琦袳$ƸO侎 + initialDelaySeconds: -1230549565 + periodSeconds: -335663932 + successThreshold: -1184112514 + terminationGracePeriodSeconds: 9077275487127832448 + timeoutSeconds: 1992088322 + name: pz + readinessProbe: + exec: + command: + - lVaA + - E9DNIWT7reP + - NW1Cc5O2 + failureThreshold: 1119300491 + grpc: + port: 2061347792 + service: fUXdOYJ9On + httpGet: + host: "0" + path: Us3pM3OkquAEW2 + port: -1693856749 + scheme: 鞡|鬟扝}肾~ + initialDelaySeconds: 1307857751 + periodSeconds: 1903760018 + successThreshold: 612917619 + terminationGracePeriodSeconds: -4296518247806248606 + timeoutSeconds: 1025631498 + resizePolicy: + - resourceName: "8" + restartPolicy: ȯy髚ʦ=ǰɮ瓿b:劀ǴáiO3IĮ + - resourceName: 8mFXK1FTs + restartPolicy: ėv|冿瀱Ƥ鐻D[ƼŮ/ + resources: + limits: + TVwPaoBqGL: "0" + juxQS6V3mr: "0" + requests: + igiG: "0" + restartPolicy: 皷ƴȿOvJ郦'欝 + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - ǐ缠]館ʚƾó|őɤ + - 6 銨dN_ZɻǦ絛顆麓 + - u鹍u鼓练gʘɍK]痰痁鶄Ȼ咶嚅俊ǙǕ + drop: + - 沎闸埲dz + privileged: false + procMount: "" + readOnlyRootFilesystem: false + runAsGroup: -265773045457612130 + runAsNonRoot: true + runAsUser: -6489119899323828796 + startupProbe: + exec: + command: + - 95NULc + - cCLaGfz + failureThreshold: -414102461 + grpc: + port: 339886942 + service: 7hdbpU + httpGet: + host: bN6EBrngIW + path: Luv09 + port: plsGDEJ + scheme: ʔ垃桪抴痺MM温ǹ + initialDelaySeconds: 2135898388 + periodSeconds: 1107416140 + successThreshold: -648919802 + terminationGracePeriodSeconds: 4653203112295127978 + timeoutSeconds: 1294917615 + terminationMessagePath: C + terminationMessagePolicy: 擎:Ȓ + volumeDevices: + - devicePath: TGjb8dLs + name: QN5Dj50Kuoc + - devicePath: aRIfAur + name: wQ47Fq7W3WPNDG + - devicePath: 2Smu + name: 1Q3d5wRJf6 + volumeMounts: + - mountPath: 5Trbk9 + mountPropagation: 秮驇穁 + name: YvM + readOnly: true + subPath: pFKsUV + subPathExpr: mhIjzA + - mountPath: F3lqb + mountPropagation: 窆f + name: NJXDvoxv + subPath: zVGgP + subPathExpr: H + workingDir: IEObw8N +extraEnv: +- name: 4R567pw + value: mWumx + valueFrom: + configMapKeyRef: + key: zDKgXG8 + name: Murbi95HW + optional: false + fieldRef: + apiVersion: FE + fieldPath: WAoZL + resourceFieldRef: + containerName: KyYyulloT + divisor: "0" + resource: fqVTn + secretKeyRef: + key: "2" + name: MHnd7TscnRWwYy + optional: false +- name: fm + value: 8fbdsVIUd + valueFrom: + configMapKeyRef: + key: "" + name: 6dU18hENH + optional: false + fieldRef: + apiVersion: Z + fieldPath: yt6csyy + resourceFieldRef: + containerName: c1WXMV + divisor: "0" + resource: NJVUoKSuC7pJDm + secretKeyRef: + key: "" + name: JptOa + optional: false +- name: WjWJX + value: 9VpkkQa + valueFrom: + configMapKeyRef: + key: Rpe79 + name: os5FYjLzS + optional: true + fieldRef: + apiVersion: "0" + fieldPath: j + resourceFieldRef: + containerName: NYuP + divisor: "0" + resource: EWUuGe739oa + secretKeyRef: + key: CFh + name: 8zez51Q + optional: true +extraVolumeMounts: +- mountPath: cIK + mountPropagation: 爂 YLƝ«煘?沀#朚ń鮾+ğÔ + name: orwvhF0 + subPath: ivP1ha4I + subPathExpr: VPCFJYVRHf +- mountPath: s + mountPropagation: m椥扶ȟqÈ倕{峙刷} + name: O35 + subPath: AN + subPathExpr: vm7 +- mountPath: 7P72D19W + mountPropagation: 堂窜B,Ś贃腔Ʈ£顽ąfYR + name: 6Z + readOnly: true + subPath: d7MJ + subPathExpr: LF +extraVolumes: +- name: "4" +- name: Kry +fullnameOverride: eHZ +image: + pullPolicy: ź,Î斎殉媰Fƅ + registry: l0qIdHu + repository: 5OO0wF5p + tag: i +ingress: + annotations: + fDuBFTYK9Q: 5XXu + wYD: 6p + "y": "" + className: Zp11 + enabled: false + tls: + - hosts: + - "" + - I + secretName: yCke +initContainers: + extraInitContainers: GXh2uupW81kt +livenessProbe: + exec: {} + failureThreshold: 1618833311 + grpc: + port: -1505397275 + service: IUgXOa3 + httpGet: + host: 99a94 + path: YFX41J + port: -636645896 + scheme: ƣ[ɐ虪ǸI + initialDelaySeconds: -1510068452 + periodSeconds: -1728837159 + successThreshold: -1832841689 + terminationGracePeriodSeconds: -2499091687248362302 + timeoutSeconds: 254335269 +nameOverride: 84QIe +nodeSelector: + JDRn7n: tOGfx + lKq0V88a: uR3S + vXzm2Hny: tURxvlp +podAnnotations: + JkW1: feghYA7 + okSVM8H: 7Pau + yYrmYn: uT +podLabels: + b4I: j707zvg + eyn1: gqdp7 + sWR: MV07t +podSecurityContext: + fsGroup: 3426922926776119440 + fsGroupChangePolicy: 橣 + runAsGroup: 8316915980597683441 + runAsNonRoot: false + runAsUser: 6270039107728700969 + supplementalGroups: + - -2399342924686736516 + - 620655430084388100 +priorityClassName: 6ZbHC +readinessProbe: + exec: + command: + - u4wSt + failureThreshold: -992972964 + grpc: + port: -940292781 + service: zh5 + httpGet: + host: 1Tg + path: FfFHRfo + port: -94900838 + scheme: țcPÞ + initialDelaySeconds: 2051362912 + periodSeconds: -288287188 + successThreshold: -404266702 + terminationGracePeriodSeconds: -123318567100123885 + timeoutSeconds: 31934256 +replicaCount: 378 +resources: + limits: + 0Yl63: "0" + BUorG9: "0" + requests: + JNdWuFZf5nnT: "0" + aszsvHn: "0" + qC76cU: "0" +secret: + create: false + enterprise: + licenseSecretRef: + key: "5" + name: X2lLLdu + kafka: + awsMskIamSecretKey: RoyDigH4v7A0 + protobufGitBasicAuthPassword: 3m + saslPassword: 5E + schemaRegistryPassword: "2" + schemaRegistryTlsCa: DSr2uQnBZ2 + schemaRegistryTlsCert: mji + schemaRegistryTlsKey: EcukHN + tlsCa: HwarCHVf + tlsCert: tsx + tlsPassphrase: owRWr + login: + github: + clientSecret: 3QP + personalAccessToken: RFXhu + google: + clientSecret: KbrHoAQ + groupsServiceAccount: tSLR4 + jwtSecret: gQSZ8AC + oidc: + clientSecret: O + okta: + clientSecret: tv58V + directoryApiToken: C3j + redpanda: + adminApi: + password: OZVk + tlsCa: F4wK + tlsCert: nkKfJ + tlsKey: ewWdsq +secretMounts: +- defaultMode: 210 + name: gcTdF + path: ctE5Qa + secretName: MPU +- defaultMode: 186 + name: "4" + path: n8KpOJZ + secretName: s6 +- defaultMode: 412 + name: lBE0nAE + path: 3Ka7 + secretName: RG +securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - 憑 + - 贁 + - cÝ琦ŝʛD緪娥t諰ɤɼʠßʏ + drop: + - Hē粙 S綽ESFľĞóǂ + privileged: false + procMount: '>IÐ肣ɚòĺIGʖƟ穿ź' + readOnlyRootFilesystem: true + runAsGroup: -6867300864246942363 + runAsNonRoot: true + runAsUser: 972586500223089794 +service: + nodePort: 310 + port: 190 + targetPort: 396 + type: uTyclgj9tVV +serviceAccount: + annotations: + 1vh4t: 2P6FHr47JPz + JPV: tx0p + automountServiceAccountToken: true + create: false + name: gIkiPRSc53Eb4w +strategy: + rollingUpdate: {} + type: ĸ鍽3ɨ勍Ȱ¦T搟 +tests: + enabled: true +tolerations: +- effect: ć`湇Ȏ2篤螕巴蛬>@ø£鞌q + key: E7p + operator: 畁鼄瓈貔Ĕ釲ĸȚ貺|ǴĄl蔺İɽ糹 + tolerationSeconds: 3092681449541780742 + value: Zmrz8 +-- case-043 -- +affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: [] + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: x2q + operator: B肖HOʀ + values: + - "" + - Ys3JeXs5q + - key: kTV1 + operator: ɑɸ&楥ÃFŎł + values: + - UQJ1b + - PSnF + matchLabels: + x3: OyQXZWg + matchLabelKeys: + - c7l + - QL52 + mismatchLabelKeys: + - upadP + namespaceSelector: + matchExpressions: + - key: ve00EK + operator: 'ɗY莶ʥV蔈ƀ廜ȶƹŀLjÓ%õɽ ' + values: + - KsFwEq9un + matchLabels: + pZaTZ4dEyKe: Zr + y2udi: nOeICOHiSN + namespaces: + - eh3 + - Tk + topologyKey: sDRodPzb + weight: 950808176 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: "5" + operator: 豗ŵǕ + values: + - CXc + - lamtTG39Nn + - key: PAiD + operator: 靑 + values: + - Xc2 + - 0vCS1b + - MsAd + - key: V5SqAAs0jK + operator: tŇ + values: + - "" + matchLabels: + sN: eS9 + zyhZtMI: vk + mismatchLabelKeys: + - "9" + - 8kmgYkR + namespaceSelector: {} + namespaces: + - rttEi + - LsPL05A + - vt + topologyKey: RI9Fz + weight: 735869102 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 3wYP8eoC3 + operator: Ĭ囁缯盦鍎Șe宧冸'Pțl諷鵣 + values: + - tjW4s6vTm + - dAFd + matchLabels: + MYd: Xsox8 + vdIPmBzGHW: u + vtRD: cJZSpnJ + mismatchLabelKeys: + - ysVrZBCS + namespaceSelector: + matchLabels: + LLN: an + zhG0GzF: ebgXWsq + namespaces: + - Tc7JW + - l5 + topologyKey: XvVTKe + weight: 284965413 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: snHS61E + operator: ŁjĈ偔Ĵgä缬ɏ魜竿Ȍ匊ȡf + - key: GF64H + operator: N?+痱+龟嗙糨(;籄µ_ȤP榡Ȁ + values: + - sBC5mout + - gLNrAHCql + matchLabelKeys: + - I6T + - cfQ + - bj1O + mismatchLabelKeys: + - DOsKcbZ + namespaceSelector: + matchExpressions: + - key: wabhpRnnMK + operator: 昶Ǝ傪Ȃß + values: + - 6A + matchLabels: + AWV: wH5n597Z5ZD + MO5x: gCiuzkb + namespaces: + - SE6wLN + topologyKey: i + - labelSelector: + matchExpressions: + - key: hyV52PjMCdDTPM3Xj + operator: t.卆痘惠Ú皙駼ɥ飑蝪 + values: + - df + - QinuCr3k + matchLabels: + "4": xjs7u + 26YT8Kwl: 6Fn7QaX + IyQVKh: FT + matchLabelKeys: + - 43p + - 7wOCOZltU + mismatchLabelKeys: + - 69P + - KGelm4KjR + namespaceSelector: + matchExpressions: + - key: lc1l + operator: 圼酭蟶ƿʕNȎ褷K0¢戜ŰĨ矤磓 + values: + - F5sJcyG + - gSLP4 + - key: VUC9 + operator: 伂Nxŧ}_Ť + values: + - fdEFxj + - key: TtWF1erkH + operator: 鿐ȖP薈廰ǿÅʋ + values: + - 8fCxCdw018mnN + namespaces: + - MI7v + - 4d + topologyKey: t6NgG + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: D + operator: 棎 + values: + - 20fifD + - FrMdPhx9xo + - key: UGNn3lb + operator: 佛Ǥ3 + - key: Z2RLUvJbK + operator: "" + values: + - FdkgDft + - TefWIg2 + - bpqycNdCB + matchLabels: + HS3J6YWoEqk: Z6wgyP + doC4E: kBDLOXELx + matchLabelKeys: + - AcWh + - wz1OjMAc + mismatchLabelKeys: + - TzAtxmFj + namespaceSelector: + matchExpressions: + - key: 0PcmdJ + operator: h + values: + - cUMRXCqpYKF + - key: CNiL1smGnM + operator: cSŦ胪ǟ婟魳!M + values: + - nn + - J + - DT + namespaces: + - 115aP7 + - NIr + topologyKey: pAC + - labelSelector: + matchExpressions: + - key: N5YJ + operator: '`ȺDŽ窿U澩Û' + values: + - c6b9k + - kBiQmy4m0 + matchLabels: + I7ZhU9r: mVYody9U + kY71: tu + r0veMW: zYM + matchLabelKeys: + - iswu + mismatchLabelKeys: + - CANmp649B + namespaceSelector: + matchExpressions: + - key: 9dVeM + operator: "" + values: + - j4ohdLhch + - l + - "" + - key: Dg0F + operator: wŴǂ&;计DzP.觰髬uþ + values: + - gaIEZk1 + - W + - ox3 + - key: eem + operator: F铃ø睤榺蠯ƺDZ2s瘨澌秠%晸 + values: + - gQvNAvyI + - oime + - 4Sq9 + matchLabels: + J9W: R8 + o3EOEfEW: doLp + namespaces: + - kkkj1owvoXiU0 + - yfKU6aK + - LAx8rxmN8 + topologyKey: Z +automountServiceAccountToken: true +autoscaling: + enabled: false + maxReplicas: 400 + minReplicas: 207 + targetCPUUtilizationPercentage: 127 + targetMemoryUtilizationPercentage: 234 +configmap: + create: false +console: + roles: + - Ei: null + v4ACJLz: null + - isAtO9ew4: null + yruh: null + - 51fb5in: null + ILAz4wr: null + l90: null +deployment: + create: false +enterprise: + licenseSecretRef: + key: lN0R + name: Is29uweE +extraContainers: +- args: + - lXv3W4h + command: + - 0hlaE + env: + - name: 2R4HDOw + value: Ow63m2 + valueFrom: + configMapKeyRef: + key: W + name: K4xi + optional: true + fieldRef: + apiVersion: Jky + fieldPath: 53aQO + resourceFieldRef: + containerName: FnyzXcJW0Y + divisor: "0" + resource: CEeuoM3B + secretKeyRef: + key: d1k + name: gqHwwuuW7YCi + optional: false + - name: ixNGgU + value: zzCXF + valueFrom: + configMapKeyRef: + key: pAT30it + name: t + optional: false + fieldRef: + apiVersion: yp + fieldPath: Mh1WcPCbP + resourceFieldRef: + containerName: IswD1IBE9 + divisor: "0" + resource: Ro + secretKeyRef: + key: yFZxBVZdODt + name: X + optional: true + - name: WTnCxkS + value: pEk + valueFrom: + configMapKeyRef: + key: 11H + name: QATfCX3IsDv + optional: true + fieldRef: + apiVersion: vN4 + fieldPath: qMFch + resourceFieldRef: + containerName: uO0O + divisor: "0" + resource: N0cJGosw + secretKeyRef: + key: fDMU + name: hps + optional: true + envFrom: + - configMapRef: + name: 0OJJ5YVIX03 + optional: true + prefix: qMb + secretRef: + name: Q + optional: true + - configMapRef: + name: xbFZU + optional: false + prefix: a1 + secretRef: + name: x + optional: false + - configMapRef: + name: k37 + optional: false + prefix: YoFy + secretRef: + name: ogUiKqk + optional: true + image: 0pe + imagePullPolicy: 娒菐皎X噴粗嘍»ƪ~ + lifecycle: + postStart: + exec: {} + httpGet: + host: lO6z + path: Ocry6h + port: ZXfKF + scheme: ə朕IH尹ğ殤鍻O艚Ʃj"羈 + sleep: + seconds: 5751106255636900299 + preStop: + exec: {} + httpGet: + host: 7QkaR + path: F + port: 1848101873 + scheme: 7Õ嚎c煣擢?ǙȬžREWƿY#¡DZ + sleep: + seconds: -6692990274650219794 + livenessProbe: + exec: + command: + - uNT + failureThreshold: -829813283 + grpc: + port: -567104846 + service: LDcJp + httpGet: + host: g20utb + path: SiqR + port: hDMLQykO + scheme: Ŧ螵n^ʑ柁ɼĥh韁傧厬džƑ + initialDelaySeconds: -564429238 + periodSeconds: -1564220228 + successThreshold: 358143040 + terminationGracePeriodSeconds: -3271131206023471117 + timeoutSeconds: 1743016683 + name: 0dQgH + ports: + - containerPort: 1592798281 + hostIP: Ob6i + hostPort: 1226080714 + name: owTN2e7 + - containerPort: -909719890 + hostIP: LU4ibkw2 + hostPort: -291412037 + protocol: ț榌餬<孋蔣熰瘞;癘, + - containerPort: -1320944614 + hostIP: FALEX24mB + hostPort: -2067901656 + name: 3x2T + protocol: 鑴桄ɵ珧Ū + readinessProbe: + exec: + command: + - oc + failureThreshold: -784903530 + grpc: + port: -2046315075 + service: OUsbY + httpGet: + host: s50gn + path: gPyB + port: -2077437763 + scheme: 撫ƄǥǞ + initialDelaySeconds: 1983356613 + periodSeconds: 1988783141 + successThreshold: 2066305810 + terminationGracePeriodSeconds: 2348593211159662414 + timeoutSeconds: -418402994 + resizePolicy: + - resourceName: yW + restartPolicy: 9從O9籿c绉ȠýH + - resourceName: 9WLZ + restartPolicy: 酎!8 + - resourceName: ISSu7K + restartPolicy: RǷ巫錬$e幅"Ȅ + resources: + requests: + ZAHXO: "0" + cT: "0" + ftA: "0" + restartPolicy: 箕赳箨J顏 + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - 厍F>%甾灵讝 dɌ撑礙Oo_ʦ + - ǮI埁艏:řŴi/隰6Ň + privileged: false + procMount: 籟ɔ矎C趶椰ʓ + readOnlyRootFilesystem: true + runAsGroup: -1819068651107678420 + runAsNonRoot: true + runAsUser: -4446960001037568719 + startupProbe: + exec: {} + failureThreshold: 1529697760 + grpc: + port: 2086810289 + service: LFhs + httpGet: + host: y7 + path: 7Q5PcVes + port: i + scheme: 阀ÿ¼+砵S麦ƺ'nǥ恪qżZǹ + initialDelaySeconds: -2048008543 + periodSeconds: -1559576850 + successThreshold: -655600930 + terminationGracePeriodSeconds: -8913842277118830912 + timeoutSeconds: -857654009 + terminationMessagePath: 9TOoj + terminationMessagePolicy: ¦ƫʇȬ儤f^_U躭 + tty: true + workingDir: cGeaEyJc6A9 +extraEnv: +- name: 1qcxFe + value: CddCzg + valueFrom: + configMapKeyRef: + key: uetPc0pnjv + name: CvmkK + optional: true + fieldRef: + apiVersion: FHMfGqk + fieldPath: 2P + resourceFieldRef: + containerName: bD1 + divisor: "0" + resource: kcSi + secretKeyRef: + key: pUu0 + name: 31uIu28D + optional: false +extraEnvFrom: +- configMapRef: + name: sJl8l + optional: false + secretRef: + name: ULPPuBUveK + optional: false +- configMapRef: + name: r4KbQIM + optional: true + prefix: vFNhdrDV + secretRef: + name: b + optional: false +extraVolumeMounts: +- mountPath: BsnW + mountPropagation: 撾<¥燩Uáb魩2wdz携W駟c韀羸â閹 + name: kS + readOnly: true + subPath: MQkyaubVs + subPathExpr: Bc +extraVolumes: +- name: FK5aYrlt +- name: BuMd +fullnameOverride: y0pa6pm83 +image: + pullPolicy: ā + registry: frvkIce + repository: Eyf5QN + tag: NF +imagePullSecrets: +- name: kBoh0Lyd +ingress: + annotations: + GOF: Fk7wcu + J2: ViiBwn6 + WODaheluZ: jCoFdBnr + className: 4Z1r6JSTY + enabled: true + tls: + - hosts: + - hAi45 + - N3wGXf + - 2Og0 + secretName: 11BdzGx + - hosts: + - MPqkMom + - mBwetJrK + - PcEKgK + secretName: HtA + - secretName: jRYKg +initContainers: + extraInitContainers: "" +livenessProbe: + exec: + command: + - 5l + - TPa5xuR1 + - pL3 + failureThreshold: -665161597 + grpc: + port: -1993107785 + service: u6KPs + httpGet: + host: R4Get + path: 0V + port: 1160926320 + scheme: ǨĄBW躼uQ劢Z + initialDelaySeconds: -958442622 + periodSeconds: 1883059027 + successThreshold: 1933410843 + terminationGracePeriodSeconds: 6283661173054068495 + timeoutSeconds: -1835273944 +nameOverride: "" +podLabels: + ZUMXq: 1paitbyR + o5jSmwn: "1" +podSecurityContext: + fsGroup: -2194962218839547968 + fsGroupChangePolicy: Ƃ搵Ņů羁nʇ雵Ri摿TǛø!ʣa饪詹 + runAsGroup: -8349123147211058668 + runAsNonRoot: false + runAsUser: -7634316416044162316 + supplementalGroups: + - -8005115528631553908 + - 3338610853164048033 + sysctls: + - name: KolWq + value: HzqTwBK4G4 + - name: rWyCA7 + value: DXY + - name: ukO43edoA + value: EVLsuF +priorityClassName: vW +readinessProbe: + exec: + command: + - 0X8tCVJI + - Sm4 + failureThreshold: -1604827341 + grpc: + port: 42051403 + service: H + httpGet: + host: 0gB9WjO + path: 0sPD + port: -849836679 + initialDelaySeconds: -1237987229 + periodSeconds: -2089146286 + successThreshold: 1944965466 + terminationGracePeriodSeconds: 6313366685724995629 + timeoutSeconds: -421565232 +replicaCount: 180 +resources: + limits: + pWciOVB3: "0" + requests: + CokuM: "0" +secret: + create: false + enterprise: + licenseSecretRef: + key: KGprr + name: w + kafka: + awsMskIamSecretKey: "" + protobufGitBasicAuthPassword: SerI + saslPassword: GKTX + schemaRegistryPassword: 4e + schemaRegistryTlsCa: "" + schemaRegistryTlsCert: 5V + schemaRegistryTlsKey: WFfrAH2a + tlsCa: kdCuX + tlsCert: j8Y2S + tlsPassphrase: jzecZl + login: + github: + clientSecret: cRkCl + personalAccessToken: 7XzR7g4 + google: + clientSecret: 1h + groupsServiceAccount: PpzN + jwtSecret: "" + oidc: + clientSecret: r + okta: + clientSecret: om + directoryApiToken: vYqev5 + redpanda: + adminApi: + password: X0 + tlsCa: MadMnzee10AL + tlsCert: SXxHZ + tlsKey: HYAn +secretMounts: +- defaultMode: 257 + name: mbhBeHK + path: 4B + secretName: "3" +securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - ɓ秈Ǽ霏*苇ȋɇ燡ƲɔċɈx + - 畼#QȲȬ懹脆俼[葓箘Ⱥ¿ + - ƭ + drop: + - 鉉C餱芕鳧ǥƔʚŰ + - ǖ瞱祈)售歜ŃȀƖ厀Ʃ9茡ɥq + privileged: false + procMount: '''³編Ź~莽WS2孲j禺' + readOnlyRootFilesystem: false + runAsGroup: -7898786566866618408 + runAsNonRoot: false + runAsUser: 5048177807031045156 +service: + nodePort: 402 + port: 11 + targetPort: 465 + type: 9TsjJQkJZ +serviceAccount: + automountServiceAccountToken: true + create: true + name: Gma +strategy: + rollingUpdate: {} + type: I讗烉Ð-Ǵ +tests: + enabled: false +topologySpreadConstraints: +- labelSelector: + matchExpressions: + - key: 8oHl6iWalV + operator: 嗌ƕþ]eěk歄兠惴5]nj鿵ų|暫\ + matchLabelKeys: + - n2lT + - nr + maxSkew: 565546972 + minDomains: 1026506021 + nodeAffinityPolicy: _攊v + nodeTaintsPolicy: 踠~Ë?¶嘬 + topologyKey: OZKwm9I + whenUnsatisfiable: 艽ʧj +- labelSelector: + matchExpressions: + - key: e + operator: 貙wɡȗ扊l橠,ȶ^ + values: + - "2" + - 1aeU + - X1mzNz + matchLabels: + Kw: L0rDwe + hFD: 9Kbm7CtaSg + matchLabelKeys: + - lw1gZ + maxSkew: 131623139 + minDomains: 1034504401 + nodeAffinityPolicy: NƎ乮+却ŷƑIf.L焚 + nodeTaintsPolicy: "" + topologyKey: dpa7OA + whenUnsatisfiable: 貧uƻläʯlÓʐȮ竇dʐ疮儾 +-- case-044 -- +affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: AFOKvXU + operator: ¸藬 + values: + - vIFxLM + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + ZpWVx: agTJ2kP3DWNYN + matchLabelKeys: + - "4" + mismatchLabelKeys: + - 0qG + namespaceSelector: + matchExpressions: + - key: D8 + operator: d|ɬ曖 + values: + - p3iQYi6Y + - key: c + operator: ǵmV逛鲳鈐譮稹ÚȾČXú + values: + - a + - 3C55L6S7 + - SQaxr + matchLabels: + "5": jC + namespaces: + - oDKjy + - "" + topologyKey: C9jgFk + weight: 1276231314 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: lGp2 + operator: "" + matchLabels: + "": sKP1q2 + 44krG: UrYUSMsisV + unYZqLh67: tMKQ + matchLabelKeys: + - orDt3ZdEA + - LIBJK3 + mismatchLabelKeys: + - bgz2i + - CNqlQJ + namespaceSelector: + matchExpressions: + - key: 35CZTXLY + operator: 掟0笝润ɲDGĪ1Ɋ乧鴹ǥ + values: + - OOB1s + - o4H + - key: f21 + operator: nȿqh + namespaces: + - L0w7 + - DB9 + - T1mom4CrS + topologyKey: OWKJz + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: WaOHp + operator: Ƥ熅ǒe²敹Ņ0ľ(Ȯɩ6ÿ + - key: 0X + operator: be3蚛鷿_鴈y+圚ʀF虹D + values: + - ZIZDTnyfwD + - B4NWO9ffPz + - 1jsu + matchLabelKeys: + - mXhYg + mismatchLabelKeys: + - mp6 + namespaceSelector: + matchExpressions: + - key: xE + operator: ʩ畕 + values: + - uc7IZ + - Hxl1 + - key: Xb41Q + operator: cʓʁ卡嵷韻 + values: + - pA + namespaces: + - edcrY + topologyKey: sP2BdI + - labelSelector: + matchExpressions: + - key: U0 + operator: 卢ʩ + values: + - OBtefl + - yMIZlx + - key: X + operator: Ǔ%é鵔:ß侙鞅 + values: + - s1qg3meB + - e6J6ZH89 + - key: dhFO + operator: ƋŎ頖,é襺枣Ť卩骏ɰ抟篧JɂǛȝȵ + values: + - R9sJoCz + matchLabels: + 2T: 84ZhksfB + matchLabelKeys: + - Yc41 + mismatchLabelKeys: + - zgncb + - pCwXYOK + - hViR + namespaceSelector: + matchExpressions: + - key: 3hWtuB6Y + operator: ʪ+ʜǻ拎奜跁ª4鶒鲒[ʒJi\ʝ)皡 + values: + - s + - key: xGSn + operator: 羥/Br=Z擧Ŀ泀Ą舨cïŕɘʡȽIJ鉽 + values: + - lOZtQ2cI + - Vk6 + - Ri3t + - key: Z6UDhR9VLqSA + operator: 淸c欨pɝo腛ı廓齩鄬檏繑郭>Ö呡 + values: + - s6hp + topologyKey: wZZTf + - labelSelector: {} + matchLabelKeys: + - afDo + mismatchLabelKeys: + - S + namespaceSelector: + matchExpressions: + - key: AWObA + operator: ĝf表OS厅啬児0~L槩华L稙訐\Tȼ + values: + - M39 + matchLabels: + 0D9: u5 + T1: xiLiZn + v6: nSQp5 + topologyKey: mr +annotations: + 4i: zwiMMKf + ZTKUDg2t: qHc7 + fGsx: dIpd +automountServiceAccountToken: false +autoscaling: + enabled: false + maxReplicas: 220 + minReplicas: 54 + targetCPUUtilizationPercentage: 269 + targetMemoryUtilizationPercentage: 205 +commonLabels: + BvJq2xZ: jY6O0 +configmap: + create: true +console: + roleBindings: + - UiHg9: null + - "": null + mAYLjAybA: null + roles: + - 0NpG04j: null + UxtPt: null + l5dMdK: null + - J9: null + MzWfEl: null + yNu: null + - "": null + Pv: null + tGJIDyXG: null +deployment: + create: true +enterprise: + licenseSecretRef: + key: x8ik3q + name: K7c7oe +extraContainers: +- args: + - CCdc + - xnWsPf + - K9Lp8whZH + envFrom: + - configMapRef: + name: eRd + optional: true + prefix: jF9v + secretRef: + name: QS0dQM4 + optional: false + image: UEbFmY + imagePullPolicy: ɂǖ耒ȯ+Ǎ妸ÄĊ wʠB堯¥ƿɤp + lifecycle: + postStart: + exec: + command: + - 89MtW + - LOaqkcP + - JzjyxNZS + httpGet: + host: "3" + path: V + port: RUOELw + scheme: u*暪÷鰦ʭ,0噱D #干 + sleep: + seconds: 7312334685976474890 + preStop: + exec: + command: + - Cmo91luAq + - DTCwI + - d3Q8xly + httpGet: + host: e + port: -1761554680 + scheme: '|' + sleep: + seconds: -8572473558022233717 + livenessProbe: + exec: + command: + - 1K0Fir + - Ws + - jWym + failureThreshold: 1492079208 + grpc: + port: -1612320137 + service: wk3AYU + httpGet: + host: U + path: yLWf + port: dE + scheme: (魠ʫ倳|岺溻IJħu|æ粅 + initialDelaySeconds: -1551121242 + periodSeconds: 101556636 + successThreshold: -690762638 + terminationGracePeriodSeconds: -7606489989577612357 + timeoutSeconds: -947750725 + name: GKPhj2 + ports: + - containerPort: 690563670 + hostIP: mVXvug29A + hostPort: -1389446008 + name: pcUz3a8NWF + protocol: o& + readinessProbe: + exec: {} + failureThreshold: 816403475 + grpc: + port: 2090385753 + service: pp5W00 + httpGet: + host: sP9DV + path: cpLL + port: TNUIzm + scheme: '!敓GĜƝ塀ȏ@{8嶤ɍ|' + initialDelaySeconds: 911169006 + periodSeconds: 257542772 + successThreshold: 1702435185 + terminationGracePeriodSeconds: -4557510245814657403 + timeoutSeconds: -581799810 + resources: + limits: + 5UdZ91O: "0" + TXdC: "0" + bK0pEj0Mb: "0" + requests: + s8hZFXOGF: "0" + tCP: "0" + restartPolicy: Ǩ轡´@ǂȟ + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - 鿞;P粜鬌)Ǭ郑&鑉k!f] + - Ċ + drop: + - ?孡渄:Ơ廔晞!ē8瞅@rDZ_ + - cfdú¯'ƱơÅś祏侪 + privileged: true + procMount: ȝ?A@û2蝓撕%o摤絡) + readOnlyRootFilesystem: true + runAsGroup: -2314751572399378702 + runAsNonRoot: true + runAsUser: 989961539055775316 + startupProbe: + exec: {} + failureThreshold: 971752114 + grpc: + port: -1594677871 + service: O + httpGet: + host: EIXRs + path: EA1CukJtUZ + port: g9g0 + scheme: 遱O靑課淁hɕ怡ņ鲥 + initialDelaySeconds: -1020857297 + periodSeconds: 1332161137 + successThreshold: -1412285197 + terminationGracePeriodSeconds: -7087737322486666596 + timeoutSeconds: 563432789 + stdin: true + terminationMessagePath: S + terminationMessagePolicy: =ɑ_èʊâ錯Ɛ窾O亇_ + tty: true + volumeDevices: + - devicePath: 2EtZS + name: "" + - devicePath: glBRF4 + name: e8K + volumeMounts: + - mountPath: L4U + mountPropagation: '}6ʓ蓱9峖3疖售Ʉ朞' + name: 4oVeDs + subPath: RoA + subPathExpr: b + - mountPath: b3TFcP + mountPropagation: ʘʟ| + name: jg4Ya + subPath: F + subPathExpr: flS + workingDir: VZi6ElPHw +- command: + - 3xxCjTRw + env: + - name: 1n + value: cHl + valueFrom: + configMapKeyRef: + key: "95" + name: gi + optional: true + fieldRef: + apiVersion: sQA8hZeZu + fieldPath: xgpJlFJ2 + resourceFieldRef: + containerName: fLR0HyM + divisor: "0" + resource: Sanx4 + secretKeyRef: + key: XgKm5 + name: gvoS9jB + optional: false + - name: s2cwze + value: hu + valueFrom: + configMapKeyRef: + key: fDoUz3 + name: XKG + optional: true + fieldRef: + apiVersion: q0CUy1W + fieldPath: B3Lkh + resourceFieldRef: + containerName: V1gnkr8hpTmU + divisor: "0" + resource: 7PEJNYX + secretKeyRef: + key: IiBIw + name: kiXa5 + optional: false + envFrom: + - configMapRef: + name: JayMLn + optional: true + prefix: Iyk + secretRef: + name: I8 + optional: true + image: uuJKCAGoiYb + imagePullPolicy: '&mɈ{DC鹪ŘƖ暢C镯VĪɮJ樟' + lifecycle: + postStart: + exec: {} + httpGet: + host: TlUl + path: v9nd + port: Khf + scheme: 雦G'獲ɕ垑Ɠ奚 + sleep: + seconds: 3204757101293724426 + preStop: + exec: + command: + - s8505Cg5U + httpGet: + host: hAMBGK + port: LNxGid + scheme: 9?Ɉ + sleep: + seconds: -7512312074000843110 + livenessProbe: + exec: {} + failureThreshold: -1252597876 + grpc: + port: -544919593 + service: "N" + httpGet: + host: xfP + path: ByIZxFF1w + port: 465839308 + scheme: ôȔʄǽȕ$Ɨ嫸% + initialDelaySeconds: 1827740835 + periodSeconds: 1434348082 + successThreshold: 1145653124 + terminationGracePeriodSeconds: -9056662989967493169 + timeoutSeconds: -741454610 + name: pkN5 + readinessProbe: + exec: + command: + - pmJ6cF + failureThreshold: -182850181 + grpc: + port: -30654612 + service: q + httpGet: + host: Vra + path: tovB7 + port: -934938952 + scheme: Ⱥǵ1茆鯨ț]ų1ơñ澂 + initialDelaySeconds: -1966697414 + periodSeconds: -1866944455 + successThreshold: -259752087 + terminationGracePeriodSeconds: -4535014313385885341 + timeoutSeconds: -1545912021 + resizePolicy: + - resourceName: RxDBqX + restartPolicy: 韌ʮ濅& + - resourceName: spCee + restartPolicy: 腋+桯PɆ誎z4µ&ȁou-囈鵼夵v| + resources: + limits: + rElH: "0" + requests: + "": "0" + restartPolicy: 7GK¦碦ǒ抩Z芍緜 + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - NjǗA窇ţ + - 逈%Ǵ7QǚƶƜr + drop: + - 鹭Iv0蠤'Ɵ皝ƨ=¨ + privileged: false + procMount: èįƤ;L虥u籖ʄƎ}橃V炖 + readOnlyRootFilesystem: false + runAsGroup: -1041723617216276814 + runAsNonRoot: false + runAsUser: -3933065726531016441 + startupProbe: + exec: {} + failureThreshold: -983644738 + grpc: + port: 1827183629 + service: X7oC1 + httpGet: + host: vGk + path: ohKaYc + port: l1rVsh9 + initialDelaySeconds: -648569392 + periodSeconds: 873065120 + successThreshold: -612441773 + terminationGracePeriodSeconds: 6808330544454597158 + timeoutSeconds: 1534439066 + terminationMessagePath: VYh + terminationMessagePolicy: 唌Üi+ + volumeDevices: + - devicePath: DGsn + name: Ia + volumeMounts: + - mountPath: "14" + mountPropagation: 渉seǝ蕟厪ë嵎ǥ墮@ + name: "" + readOnly: true + subPath: C1G4VS1 + subPathExpr: eU + workingDir: odPxO +extraEnv: +- name: Ahlf + value: UEv + valueFrom: + configMapKeyRef: + key: uwaRvb + name: M8Iklu7qx + optional: true + fieldRef: + apiVersion: H + fieldPath: 43xb + resourceFieldRef: + containerName: t8wgC87mO + divisor: "0" + resource: Z + secretKeyRef: + key: "" + name: EQfJ3z7tv + optional: false +- name: xj + value: lwmxmxP + valueFrom: + configMapKeyRef: + key: "" + name: cdBhO + optional: true + fieldRef: + apiVersion: U + fieldPath: Dj1sswKP + resourceFieldRef: + containerName: 1p3yUdrvd + divisor: "0" + resource: 5A + secretKeyRef: + key: DDcgdcu + name: oD38 + optional: true +extraEnvFrom: +- configMapRef: + name: 2ECaB + optional: true + prefix: bao + secretRef: + name: CA5S95 + optional: false +extraVolumeMounts: +- mountPath: v + mountPropagation: ?IJ純ʈxɧʅ + name: 9AiRaE35OlCv + readOnly: true + subPath: 2dv5RZ + subPathExpr: H7f +- mountPath: "4" + mountPropagation: 涾頴tOĜʥ朤 + name: ePEz + readOnly: true + subPath: BY + subPathExpr: w +- mountPath: n5FPgiJmk + mountPropagation: Ǵ棢__@ŗɆ4瞑5ŗ­L/ķ{篦ǯ + name: NryERK9Q + readOnly: true + subPath: tINFMAR5 + subPathExpr: VrBKy +extraVolumes: +- name: Kt6NIoVzEY +- name: O +fullnameOverride: resP +image: + pullPolicy: 讘ɂȴɩF壜î栒p + registry: UqWwteW0x + repository: TZqk + tag: 0fpMB +ingress: + annotations: + 7CEw: nk8 + bqg: H5 + x1S7: Pu + className: 6IuECM + enabled: false + hosts: + - host: gDc + paths: + - path: len9tdPYcpq + pathType: XETm5mmK3Es + - path: zn5u + pathType: p5jlQul + - host: "" + tls: + - hosts: + - Th5w + - xssK + - xFW9 + secretName: wA + - hosts: + - bR + - U73RtLKOI + secretName: jEnKU +initContainers: + extraInitContainers: 0VCU +livenessProbe: + exec: + command: + - wV + - eooUnSLpW + failureThreshold: 1147871047 + grpc: + port: 483952618 + service: Ca + httpGet: + host: pXrlUHltqchNl + path: kMP5 + port: -1823407150 + scheme: Ò壻«Ƭ魠?ǣ×Ç + initialDelaySeconds: -470682176 + periodSeconds: 842863336 + successThreshold: 2078067842 + terminationGracePeriodSeconds: 8174922400865091455 + timeoutSeconds: 1252398573 +nameOverride: tvDI +nodeSelector: + 2i: dRi6btw6 + R4: UsW + fFNJXGk: XBkx +podAnnotations: + N0F: vSjZxkjW +podLabels: + K1uahi: UMygEU2O2 + ecdKkB: "1" +podSecurityContext: + fsGroup: -3027126285888130862 + fsGroupChangePolicy: 袺芥ŵ罋o郘渢e堫柝dž + runAsGroup: -3172565869747057973 + runAsNonRoot: true + runAsUser: 5739747577453985710 + supplementalGroups: + - -1289730562709624524 + - 2918948066534341347 + - 8836988143915675306 + sysctls: + - name: ZSspAgrV + value: ES11 +priorityClassName: 8KMLup9vb +readinessProbe: + exec: + command: + - 50jwjhoUN3n + failureThreshold: 1026367217 + grpc: + port: -238173978 + service: Ju + httpGet: + host: wDDq9i + path: w7hRVdP6kmTaLN + port: -919313657 + scheme: 闡ś + initialDelaySeconds: -233395254 + periodSeconds: -96619339 + successThreshold: -2083481091 + terminationGracePeriodSeconds: -7352799244112409845 + timeoutSeconds: 1827269276 +replicaCount: 410 +resources: + limits: + eYVLCq: "0" + requests: + P: "0" + VsuQcjg: "0" + jwq: "0" +secret: + create: false + enterprise: + licenseSecretRef: + key: zvbci + name: W0 + kafka: + awsMskIamSecretKey: SFtL8nb + protobufGitBasicAuthPassword: "" + saslPassword: "" + schemaRegistryPassword: p + schemaRegistryTlsCa: 0m5L + schemaRegistryTlsCert: fqb + schemaRegistryTlsKey: whFm7 + tlsCa: 2Ir + tlsCert: JBVRtfzSurH + tlsPassphrase: OSDd + login: + github: + clientSecret: mCF8qeqhA + personalAccessToken: 7MnYqfh + google: + clientSecret: uo83GiVX2X + groupsServiceAccount: LCEQJi + jwtSecret: cmCx + oidc: + clientSecret: jW3Syrm + okta: + clientSecret: RDyL5FTb + directoryApiToken: BmJgmq2h + redpanda: + adminApi: + password: 6pe + tlsCa: gzJP1h + tlsCert: GRhBENFNa + tlsKey: qKQ +securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - ɐ毻sǨ斩麀|髦 + - (波F= + - 2鱶ɥǚ蘃齯ʃE桹蹝Ȓ畸蘋桙0 + drop: + - c掁轖e9\Ǟ¦ + - ȽT下Zź%賂蕄3 + - 乯`ŤĊŸ眸ʞ缔Ň妌嵳楕ǐwč*ǩ妩ɴ + privileged: true + procMount: ŃE诩Ŗś僆 + readOnlyRootFilesystem: true + runAsGroup: 6580465723841053659 + runAsNonRoot: true + runAsUser: -56006153890553620 +service: + annotations: + CRHNsVY: Nl04 + nodePort: 437 + port: 103 + targetPort: 329 + type: "" +serviceAccount: + automountServiceAccountToken: true + create: true + name: W9k +strategy: + rollingUpdate: {} + type: ɬdW5f +tests: + enabled: true +topologySpreadConstraints: +- labelSelector: + matchLabels: + 435gSB: cXqM + XuT: nA + sKWX6pPX: YyYe + maxSkew: -1347306472 + minDomains: 1890499147 + nodeAffinityPolicy: 扒Ŕ + nodeTaintsPolicy: 諹uɔM_灢ʫ6ªWŢ庿ɛ + topologyKey: 34nlpPe2Tl + whenUnsatisfiable: šĉ鎨嶕鯖Ťȯ蝲萤ɪeCŒ5ő3|押 +-- case-045 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchFields: + - key: MyOwAD1 + operator: 啜0Ȕ + values: + - ZGn4YX + - key: jDkjMmXqE + operator: NŤ~鷚ȃÐ醩@鿘.礡PdL + values: + - N3K + - ow + - PzPEWA + weight: -72104605 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: JvUcVrA7 + operator: Žx"ơ + - key: xqi + operator: 1匹层舕ƒ僜ʓ + values: + - e + - key: eLiG + operator: '[r-!"ĻŻ艂酁嵍鏺]髠' + values: + - EKgA + - 2tR + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + 7EKjs: lal36 + matchLabelKeys: + - DsNc + - EF + - MxSx7 + namespaceSelector: + matchExpressions: + - key: AJRciio + operator: I鎴 3ɡƞK慳hĉ + values: + - dh + - key: O8 + operator: ʤ喜牅ƫ]Ȉʚ廆Ƨ椬訐儹9ȡ趿 + values: + - QIR + - 4QIg3r + - key: xEKeM + operator: 嬕 + values: + - R0qm21j + topologyKey: yN7rFb + weight: 371178507 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: 6m + operator: "" + values: + - sEP + - r + - 916oARGpag + - key: YtLdy2vWFRG + operator: "" + values: + - NbAvpL8G + - 0a3vqv + - key: TOiWxWC + operator: ǝ椦誄ȟ2沾ʩɁǢɶ攧Ţ胑< + values: + - BDKh + - NFb9UYct3p + - TFdQLF + matchLabelKeys: + - TACd + - RFCD1IMt + mismatchLabelKeys: + - CLaySswMot + - S3sEweRaY + - tC6pZ + namespaceSelector: + matchExpressions: + - key: pDz + operator: "" + - key: iRP7TsiyE + operator: 8šiƛPċŞ貲I轒ĮÜ + matchLabels: + 4IVb55JZf: "" + XokO: FntMc + namespaces: + - BOohC67i + - tv + topologyKey: Wc36G + - labelSelector: + matchExpressions: + - key: 2swiyf9 + operator: X + values: + - "2" + - Mmu6iYl3 + - XsZhnelID + matchLabels: + zf: IJlhUxrQg + namespaceSelector: + matchExpressions: + - key: RMLd0ptomdzoSd + operator: ƋŲǯ-'Dð獿礘ĘQ蕲螙x + values: + - rz5QKfx + - key: smO + operator: DɴK*4瘢齮 + matchLabels: + "": crZm + R7TX: 7hcjy + Yh: dyM1 + namespaces: + - PqubN + - elFz + - 5Iah6Cz + topologyKey: QE + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: faWSc + operator: ʚʉŝwʊ寭跼Z + values: + - dgKap + matchLabelKeys: + - sEXCWO + mismatchLabelKeys: + - BqB + - QSJQOy + namespaceSelector: + matchExpressions: + - key: 9zT + operator: 锂遼9ɎVn嵕缰~ + - key: bJi68gZ + operator: 己樚僚%隓馦d + values: + - LT + - "" + matchLabels: + yt: Z + zMv4Ez: NSxkcn + namespaces: + - bfc + topologyKey: pUFg7ZP + weight: -962989660 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: {} + matchLabelKeys: + - "" + mismatchLabelKeys: + - Mfh + namespaceSelector: + matchExpressions: + - key: 6Ax1cf + operator: ʆ骜ʣ蘧F栮,C + values: + - 1WljmgAmSY + matchLabels: + 174k: 7or9Mr + F4YETWGCg: Rt46e + cMQyYT: RTaOOxz3Li + topologyKey: 9j +annotations: + 12kkcHLZdTIn: FQ4am + LQDfr: q +automountServiceAccountToken: false +autoscaling: + enabled: true + maxReplicas: 305 + minReplicas: 326 + targetCPUUtilizationPercentage: 344 + targetMemoryUtilizationPercentage: 186 +commonLabels: + M1diW: PVb +configmap: + create: false +console: + roles: + - tvT4mf0wFe: null +deployment: + create: false +enterprise: + licenseSecretRef: + key: kMfu2CiNvgC34 + name: oa9a +extraContainers: +- args: + - HP10TO + - kuCNcTLL + command: + - m + - Nww8 + - 98Rn + env: + - name: SSO + value: dOiVAD + valueFrom: + configMapKeyRef: + key: rG6s + name: ZIOGFg7 + optional: true + fieldRef: + apiVersion: 5QpSAgTC + fieldPath: wvXbuBkn + resourceFieldRef: + containerName: ZRxTJ6p + divisor: "0" + resource: lxXIfgo + secretKeyRef: + key: a4I + name: fdAC + optional: true + - name: t + value: lhJB5Gu + valueFrom: + configMapKeyRef: + key: 9sIY7ap56C + name: jxSPO + optional: true + fieldRef: + apiVersion: 7y + fieldPath: TVs + resourceFieldRef: + containerName: Bk7GMS + divisor: "0" + resource: KghhcLY + secretKeyRef: + key: "4" + name: Q0xn + optional: true + envFrom: + - configMapRef: + name: xkM + optional: false + prefix: 6Hmq + secretRef: + name: 2W7 + optional: false + - configMapRef: + name: nw + optional: true + prefix: ZF8q + secretRef: + name: Hazz + optional: true + - configMapRef: + name: C0TBIATG + optional: true + prefix: Wm + secretRef: + name: Yg2 + optional: true + image: vXSldD9 + imagePullPolicy: .Ś.l庥抁臚蚋巸_ȧʟ[R榶E + lifecycle: + postStart: + exec: + command: + - oN + - eEYgTnILd + httpGet: + host: mg7llOt105m + path: dtlR4G + port: wD90f + scheme: ʖ两ĕ¤¬瞮U? + sleep: + seconds: -2237517267526569736 + preStop: + exec: + command: + - GMjypvCI + httpGet: + host: T8pa05 + path: u9bCqIg + port: M9zgB + scheme: '*蛬ŻĈ' + sleep: + seconds: 475574192596548942 + livenessProbe: + exec: + command: + - dUJeULUg + failureThreshold: 1485223326 + grpc: + port: 701458966 + service: CQKKuIS4d + httpGet: + host: E2fjZ + path: XvuU + port: NoCTx + scheme: 蜼烀ȏǓɦMDn糆ƥHʼn/瓏ìȢŷ + initialDelaySeconds: -1475170089 + periodSeconds: 1989433587 + successThreshold: 1386111224 + terminationGracePeriodSeconds: 5430499533574282933 + timeoutSeconds: 1740226413 + name: wG4ZxvZMuJ + readinessProbe: + exec: + command: + - "6" + - obo + failureThreshold: 2126666969 + grpc: + port: 521888256 + service: z + httpGet: + host: Fpq + path: ghrc2 + port: -314576227 + scheme: 瓰vp烫ǁĴŰDȐ插研Ǽʜ + initialDelaySeconds: 1330937719 + periodSeconds: 78230226 + successThreshold: -351220698 + terminationGracePeriodSeconds: 6147801770047971409 + timeoutSeconds: 1906635539 + resizePolicy: + - resourceName: Waf + restartPolicy: ʑ艜ɾ蘩Ƈ`7ɫ坓弎Ȗƈ + resources: + limits: + WfxZ: "0" + gZ: "0" + oup1P0j: "0" + requests: + D0AyOZ87h: "0" + Wmp9uU8: "0" + mowWvEm: "0" + restartPolicy: ǔ輋篐棶耏īʡm0Ñ!ř$曤Qʢ瞪Ļ + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - Ì酃`sŬ硪W#鿻Gƃu + - 先ĜtàX + privileged: false + procMount: Ĕʤj螹țȞVa + readOnlyRootFilesystem: true + runAsGroup: 5877071704122825347 + runAsNonRoot: true + runAsUser: 607897543692979281 + startupProbe: + exec: + command: + - 1R1GIynL2u + failureThreshold: 197417586 + grpc: + port: 581882770 + service: jrlDhPYYcBk + httpGet: + host: btMskta + path: iy + port: -1405181644 + scheme: ­劲襇板ƶ2豣Ă輒" + initialDelaySeconds: -317632223 + periodSeconds: 1128778719 + successThreshold: -878681442 + terminationGracePeriodSeconds: -5809012571377279815 + timeoutSeconds: 326998121 + stdin: true + terminationMessagePath: vlSz + tty: true + volumeDevices: + - devicePath: jpSm + name: A1S8F + volumeMounts: + - mountPath: zH + mountPropagation: Œib抪黠wƱ軭 + name: vY1XOHYYy + subPath: Tui26JLZyP + subPathExpr: 2T0bhLFBv + - mountPath: qLd4 + mountPropagation: = + name: MlJNiuK + subPath: Gt + subPathExpr: 1br + workingDir: qaJz +extraEnv: +- name: "" + value: 8qqxpUmb + valueFrom: + configMapKeyRef: + key: nyn + name: 2a6 + optional: true + fieldRef: + apiVersion: 4VL + fieldPath: mLkq5SaY + resourceFieldRef: + containerName: q58NCY4 + divisor: "0" + resource: iTwPTz + secretKeyRef: + key: fymwKG2di + name: jP + optional: false +extraEnvFrom: +- configMapRef: + name: kjk + optional: true + prefix: bXXh + secretRef: + name: ksMoUzjV + optional: true +- configMapRef: + name: 8AWI + optional: false + prefix: hqwWp6 + secretRef: + name: a + optional: false +extraVolumeMounts: +- mountPath: g + mountPropagation: ƎÀ虰|墫} + name: izh4Kt + subPath: l3Jx + subPathExpr: bgpu9UdSPr4CF +extraVolumes: +- name: UQKug +- name: giK +fullnameOverride: 9gCm5xz +image: + pullPolicy: "" + registry: I + repository: utUA + tag: 3NaFJMnq7cwb +imagePullSecrets: +- name: rTO7I +- {} +ingress: + className: y6u9o + enabled: true + hosts: + - host: V + paths: + - path: VRp3 + pathType: WX + - path: ZXqa + pathType: LXDjotJK + - path: b + pathType: 6l3svu + tls: + - hosts: + - SzMunki + secretName: OT +initContainers: + extraInitContainers: Gaa +livenessProbe: + exec: + command: + - w + - 4y0unO7q + - fUMv46yk + failureThreshold: 564680295 + grpc: + port: -274686900 + service: SZ + httpGet: + host: "97" + path: R + port: sw2f4 + scheme: ǖe灻膃爌|rQʮ` + initialDelaySeconds: -1623540175 + periodSeconds: 2083875877 + successThreshold: 1467697726 + terminationGracePeriodSeconds: 1240720412315600394 + timeoutSeconds: 514813622 +nameOverride: tOoxEiwdVpT +nodeSelector: + 4X: PJ6v +podAnnotations: + TImM2rpn: ixT +podLabels: + jAyDz: vW2 +podSecurityContext: + fsGroup: 8841428564051369991 + fsGroupChangePolicy: '''諢憭捽鉚ƾ邓鈽6M_s' + runAsGroup: 5877981406957979012 + runAsNonRoot: false + runAsUser: -2714811370596686768 + supplementalGroups: + - 3627757755693767927 + - 3933990106793080427 +priorityClassName: Op +readinessProbe: + exec: + command: + - Rvxle1 + failureThreshold: -1544911058 + grpc: + port: 1480625343 + service: iUWGjn1Yq + httpGet: + host: 0Wg8b + path: qrDi3 + port: -689203177 + scheme: 馨PƆȣdfTNʫ*ɀLɐ3} + initialDelaySeconds: -386708604 + periodSeconds: -1196967535 + successThreshold: -658970667 + terminationGracePeriodSeconds: -8534050677682835111 + timeoutSeconds: 1352482566 +replicaCount: 218 +resources: + requests: + Nh6YX: "0" + z: "0" +secret: + create: true + enterprise: + licenseSecretRef: + key: "9" + name: Pd + kafka: + awsMskIamSecretKey: "" + protobufGitBasicAuthPassword: naFpMBw + saslPassword: nKEzr + schemaRegistryPassword: xU + schemaRegistryTlsCa: pc + schemaRegistryTlsCert: fF1z9FE + schemaRegistryTlsKey: tx + tlsCa: bhhbwypQ + tlsCert: Dw1477 + tlsPassphrase: zRD + login: + github: + clientSecret: 1UD4N + personalAccessToken: LmFkP6BgmLQ + google: + clientSecret: m + groupsServiceAccount: "" + jwtSecret: 9ejQZ6 + oidc: + clientSecret: cXdjG + okta: + clientSecret: eF90RohF + directoryApiToken: 1zXLSJEQ + redpanda: + adminApi: + password: rr4c4 + tlsCa: Eonnpq + tlsCert: aPCNgYI + tlsKey: vlrLQ9I9 +secretMounts: +- defaultMode: 266 + name: omIzst + path: "" + secretName: Pn +- defaultMode: 133 + name: "1" + path: gIWg + secretName: gi4zM +- defaultMode: 451 + name: lrUYguc + path: D9pR + secretName: 3FH +securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - m优ķNJ噓+Pð + - 橯O燁 + drop: + - 褈墄ȃ杵 + - 娨Î + - rƴ}Ɇ橮ʕ*m敼ʎhǰ.ʔcZ + privileged: true + procMount: 攏O婑 + readOnlyRootFilesystem: true + runAsGroup: 8829730151763757512 + runAsNonRoot: false + runAsUser: 64441908715087607 +service: + nodePort: 325 + port: 314 + targetPort: 398 + type: C +serviceAccount: + annotations: + "": zL + EANkzh: rmy + automountServiceAccountToken: false + create: true + name: nX5G +strategy: + rollingUpdate: {} + type: ɬ(ìɅ +tests: + enabled: true +tolerations: +- effect: ɥ)藖朡YȖɌGǼRŗ迼@醹F6鎚 + key: 7Nq + operator: "4" + tolerationSeconds: 3766411560743927749 + value: TCksEtpTf +- effect: ȷ^?3HʉɚŢȾL + key: mj5pit + operator: 隱瀆J纝ɽÄ:憹欓 + tolerationSeconds: -3549323835306297633 + value: CN0gSHK7T +topologySpreadConstraints: +- labelSelector: + matchLabels: + N5pfvDQM4ZnP: "" + ZDk6ppZLAO: nn + f1Z: 2Molvtunvm + matchLabelKeys: + - cUf4VG + maxSkew: 2039905438 + minDomains: -1795353257 + nodeAffinityPolicy: 啚FLjʐəǪɠ梎Ň沮<^Zæ + nodeTaintsPolicy: Å扯R + topologyKey: qVloCmz + whenUnsatisfiable: ūh挕ŀ靕土伔澍鄓 +- labelSelector: + matchExpressions: + - key: sgB0Jx + operator: "y" + matchLabels: + Dhp: chzEB + matchLabelKeys: + - TBO + - g5M + - h + maxSkew: -825758940 + minDomains: 1383227075 + nodeAffinityPolicy: 婬ȴ羉Ā蕲k<ǯŘ`貉ì攘窼ȶ{黺( + nodeTaintsPolicy: 晓}從磹砛鬀D + topologyKey: MXei + whenUnsatisfiable: Ē舐ɒ'Q|ȃ#Y\厾h +-- case-046 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: 2Nsqe + operator: 阴闤Bǘ尚僞熐蘐槄TČ鉇拍Ɣ唉f钡 + values: + - EQslZWcPKU3 + - key: clrdH7j + operator: 鹓ī郖漖8ĬwƓ + values: + - zsB2 + - HGN2A + matchFields: + - key: Is7w3FDS5zse + operator: -ĉYd + values: + - U4nF56qPTw + - mm38x0AQL5c + weight: -1981921933 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: mRa + operator: ȥǮĬʩɄeƩ蟤确= + values: + - ooR1 + - QIho6keUV5fIUe + - jrOsTe + matchFields: + - key: miXl + operator: ʯ5yɶȁ/z>Ǡb_Ȉ撿÷đ湕ǭ + - matchFields: + - key: yXFe + operator: ȁ!Ńǩ浉F蕊ƕ倉輴Q¬ß巩ɿ + - key: qEUUleUJCe + operator: dz楥Qɗ鎽嚬t轮黑<ƻ眄 + values: + - pXk + - l22 + - l6 + - key: DiInxf + operator: lťõ祟X鬀ò嬬uġ + values: + - CtW2vs2 + - x + - rT + podAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: 0oFNd + operator: 喯z芡I钷)bę%匾蟨 + values: + - i6xl9Mn + - "Y" + - Dnn1nA + matchLabels: + ACWAVtod: 5MsAi + W7L46x: Iohx + matchLabelKeys: + - tZcagyiX + - 5w + - SMP + mismatchLabelKeys: + - b + - f + - bqCBIIfcdw + namespaceSelector: + matchLabels: + H3qd: 6DBRkuQvCde + namespaces: + - Y3j7k + - 8i2rf + topologyKey: 290Z + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: j8OASVi + operator: Ų驐Ĥ>Ȳ`1)o}嵊袀d + values: + - DE + - key: Iir + operator: WqȊ晝ɛ唊ɵk抩Ǟ紅銫Ş秠Ś~ą + matchLabels: + 8RiTX5m: lU1nenIq2B + B1: gskcNQo6g + D1kq67: "" + matchLabelKeys: + - ii9Ab3 + mismatchLabelKeys: + - 4X2zohLQD + namespaceSelector: + matchExpressions: + - key: HyU35bXzWF + operator: 尽ǰ + values: + - "" + - sB3pY + - 4r + namespaces: + - vW + - LYI + - mhQ0 + topologyKey: pjisw + weight: 1962236401 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 9GtVGXjE + operator: 镭鱆ʁ;崽DȔ3Ĭ鐓敝 + values: + - igW0 + - Qiyx + - zMm24In + matchLabels: + AWiVWW: gPF0Yh + matchLabelKeys: + - 01T9Mphw + - qcecz73o + - o6bBrV + mismatchLabelKeys: + - uJJWe + - 8On4IIB31 + - p4t46HL8K + namespaceSelector: + matchLabels: + h: iExiiF + topologyKey: ZhTV + weight: -2130387111 +annotations: + cflWrdcz: jJe +automountServiceAccountToken: false +autoscaling: + enabled: false + maxReplicas: 451 + minReplicas: 241 + targetCPUUtilizationPercentage: 434 + targetMemoryUtilizationPercentage: 89 +commonLabels: + "": WcYTY + rHtDM6k: ZY6Kw +configmap: + create: false +console: + roleBindings: + - 0RZs: null + 3MoL: null + DS: null +deployment: + create: false +enterprise: + licenseSecretRef: + key: "" + name: mP +extraContainers: +- args: + - TLL + command: + - "" + - kyr + envFrom: + - configMapRef: + name: cGxJkM382 + optional: false + prefix: 8ZYix + secretRef: + name: sptdX + optional: true + - configMapRef: + name: sv + optional: true + prefix: juf4E1 + secretRef: + name: WrvN + optional: true + - configMapRef: + name: stixRM6Z1c + optional: false + prefix: eHg4 + secretRef: + name: kJK + optional: false + image: Q + imagePullPolicy: 榲µʪ + lifecycle: + postStart: + exec: + command: + - AHw4N6lX4 + httpGet: + host: CuJ + path: kY9OI68 + port: I6fEdljwf7WI + scheme: 0Tæ + sleep: + seconds: 8747859025599270243 + preStop: + exec: + command: + - SAiYloe + - rxrb8 + - U1 + httpGet: + host: D + path: Ck4D + port: 1235678776 + scheme: 讅º頼 + sleep: + seconds: 2255567287221174216 + livenessProbe: + exec: + command: + - rlPo + - TpvecI + - c + failureThreshold: -1194959675 + grpc: + port: 1286950474 + service: l03Ttx + httpGet: + host: iZbpkGTG + port: -104521289 + scheme: ǘɚƃŊ1_蛺ƥ篯 + initialDelaySeconds: -1041934050 + periodSeconds: 1858129919 + successThreshold: 812913269 + terminationGracePeriodSeconds: -6125486107996409317 + timeoutSeconds: -1767574186 + name: "5" + readinessProbe: + exec: {} + failureThreshold: 596482569 + grpc: + port: 1150156757 + service: qaPYsPWRM + httpGet: + host: iNasZ6 + path: CpVj + port: GC + scheme: 謭¤GȫȇƄ聭Dłʬ + initialDelaySeconds: -1604058483 + periodSeconds: -603768209 + successThreshold: 1589218932 + terminationGracePeriodSeconds: 4819160591653315271 + timeoutSeconds: 2047446198 + resizePolicy: + - resourceName: Or + restartPolicy: OȜ)漢ɨ酳h + - resourceName: i6roWBCG + restartPolicy: Ćʊ赆ʒ + resources: + limits: + ZTOf: "0" + requests: + "5": "0" + restartPolicy: ȱTǣıN飿 + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - c + - Ɛ絜-Ȭ狆ǚƫȼ)ɦȗ欌3Z + drop: + - '*`N}柁番贝鍝陂±Ǖ弊' + privileged: true + procMount: 湅ʨɩƗ吞硩Ǘɵ櫜5 + readOnlyRootFilesystem: true + runAsGroup: 2454233763446715277 + runAsNonRoot: true + runAsUser: 1349777568495231591 + startupProbe: + exec: + command: + - tEiO0Gf + failureThreshold: 1955219951 + grpc: + port: -4890683 + service: 4tTWT + httpGet: + host: 5h5p4Uk + path: JX2HU + port: b6yI + scheme: 娂儯庬Xǿƫ + initialDelaySeconds: 1159427409 + periodSeconds: -1534574298 + successThreshold: 1143094739 + terminationGracePeriodSeconds: -2223019815025430450 + timeoutSeconds: -1544667872 + stdin: true + stdinOnce: true + terminationMessagePath: 1FuR + volumeDevices: + - devicePath: "Y" + name: EahA503T0 + volumeMounts: + - mountPath: QxOZw9E + mountPropagation: N"賬 + name: k4sw3lfzmj4 + subPath: 9a + subPathExpr: q5p0 + - mountPath: 9FHN + mountPropagation: o~ʆ容Ĺkjɋ5cȔcƼ诔楞 + name: wmkq + subPath: M1UIiHV + subPathExpr: IhSh2 + - mountPath: KTgxDgARv + mountPropagation: 篪k矲PƊ$ʇ謞šS婝耻遄 + name: nvW2 + readOnly: true + subPath: u6 + subPathExpr: C3n82 + workingDir: F2B +extraEnvFrom: +- configMapRef: + name: s4S + optional: true + prefix: g8JM + secretRef: + name: Km8n + optional: false +extraVolumeMounts: +- mountPath: VW + mountPropagation: gjɲi呒>[ɻ + name: HRTFVpU6YN + readOnly: true + subPath: J + subPathExpr: Zx9CYV +extraVolumes: +- name: ldO +fullnameOverride: fB6TF +image: + pullPolicy: '&Q眫' + registry: HjNl + repository: z9WL9QV + tag: jKgmVjE +imagePullSecrets: +- name: DL1OBpd0 +- name: jM +ingress: + annotations: + A4M6T: IUmZ9 + AHN: gcT00IU6 + S: lzi1Q + className: aU0xOzsFN + enabled: true + tls: + - hosts: + - PV + secretName: aHG1 + - hosts: + - bX + - Cu + - xuscoJ + secretName: fBCynrlb +initContainers: + extraInitContainers: aF +livenessProbe: + exec: + command: + - mWA8 + failureThreshold: -2111746605 + grpc: + port: -159496093 + service: 5BzT + httpGet: + host: Pgb + path: W + port: FTodWK + scheme: '@ĝȗɰ*8Eȑ' + initialDelaySeconds: 1224736641 + periodSeconds: 1490424943 + successThreshold: 2012886943 + terminationGracePeriodSeconds: 1140281843739171103 + timeoutSeconds: 1910690397 +nameOverride: "" +podAnnotations: + P10bx: 4As + RWk: E + e: rh7XI +podLabels: + SnZ: mnX + aL0TsomY: aVv4hsuMJ7Aiq + luPi3E6: iCt +podSecurityContext: + fsGroup: -137977092678744094 + fsGroupChangePolicy: ʅ翄ąIJU÷[Ɉ<Ǧ兰巒鄂 + runAsGroup: 2453672470118860 + runAsNonRoot: false + runAsUser: -2867620198524252040 + sysctls: + - name: p + value: "" +priorityClassName: wQ +readinessProbe: + exec: + command: + - bmfgcwd + failureThreshold: -1418487663 + grpc: + port: -468793496 + service: MhQm3 + httpGet: + host: nQSr0S + path: M8 + port: 1657726276 + scheme: 鶉阑 $ý + initialDelaySeconds: 1895968402 + periodSeconds: -1686229865 + successThreshold: 1934722351 + terminationGracePeriodSeconds: 2537915062001973026 + timeoutSeconds: 1366589097 +replicaCount: 376 +resources: + limits: + 87w5tBp: "0" + AmXXE: "0" + QH55ZH: "0" + requests: + EbalAlq: "0" + RpvkPX: "0" +secret: + create: true + enterprise: + licenseSecretRef: + key: ellF2F + name: K3 + kafka: + awsMskIamSecretKey: Xs8UvJPyL + protobufGitBasicAuthPassword: BKbdr + saslPassword: xW3EDKA + schemaRegistryPassword: Vewx + schemaRegistryTlsCa: te + schemaRegistryTlsCert: JxH + schemaRegistryTlsKey: jhxioPhQ + tlsCa: eP + tlsCert: H9 + tlsPassphrase: Gz + login: + github: + clientSecret: Q + personalAccessToken: akEcq + google: + clientSecret: vj6 + groupsServiceAccount: pJ8NQ + jwtSecret: jUc4rQpG + oidc: + clientSecret: 8SCyi + okta: + clientSecret: Yd + directoryApiToken: q1rSa + redpanda: + adminApi: + password: mON + tlsCa: rNzsp + tlsCert: UStA + tlsKey: 3E +secretMounts: +- defaultMode: 305 + name: smBrE0cI + path: "2" + secretName: zeb +securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - pij*fƤ + privileged: false + procMount: 罽İ耲,衧駕R=k{ŝ{躈瑮L + readOnlyRootFilesystem: true + runAsGroup: 3478202026348193011 + runAsNonRoot: false + runAsUser: -5521479784565460908 +service: + annotations: + aDeGG7F9S: 5d + nodePort: 439 + port: 271 + targetPort: 481 + type: PK7oH1pcU3 +serviceAccount: + automountServiceAccountToken: false + create: false + name: "" +strategy: + rollingUpdate: {} + type: żb給ū裬M +tests: + enabled: false +tolerations: +- effect: 瑟bĕʫFuěG盲ÿ + key: d + operator: 秸ƿ + tolerationSeconds: -7614909558910242428 + value: h2U4 +topologySpreadConstraints: +- labelSelector: + matchExpressions: + - key: 60k + operator: ʉ赳Ɇǂt硴煟讒ib + values: + - M755avF + - He6fTmtHDXC + matchLabels: + c4BN5BiYtjB: tyUmvwGkL + matchLabelKeys: + - E4G8mM3 + - G1C9Cjj + maxSkew: -1527756346 + minDomains: 432090734 + nodeAffinityPolicy: qǗ阵W&喁CE®ņpPȂ\Ç苗ĈȄ + nodeTaintsPolicy: ȉ珉@:x凝謽Q釀ļn适c顦 + topologyKey: V + whenUnsatisfiable: 瀥 +-- case-047 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: {} + weight: 182966451 + - preference: {} + weight: -2028220392 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: [] + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 5a5MXO + operator: kƎǦƙ«嚄ƭr騥邜Fċʐ叧F& + values: + - BRA + - Ywt7JHE + - key: TjE3wFb6 + operator: O`6ƥ縈L:Ckʄ鹟瑧 + values: + - "" + - dxDLfiL + - 0IgsneLlLo + - key: tuBbSOMR + operator: 桛ʫ褛ʒɩWkv濱瘛#Ěi邱CNǖ4孳 + values: + - 9zJ + - 7T3iJAwX + matchLabelKeys: + - ZYcvinlq + - PwQO9 + - M3gb + mismatchLabelKeys: + - e + - K1XrVh + - D1CkR8 + namespaceSelector: + matchExpressions: + - key: uqnyV6k + operator: rĮ'示嶠ĵ攛Ņ + - key: 0ONfMVB + operator: n梷E8ʟ菛晉 + values: + - Q + matchLabels: + IqH8n: pCJ16S + mUE: HyxdirX0F + namespaces: + - gptVP + - L + - 7CmPHtA + topologyKey: XDhewcrvK + weight: 2033587292 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: jcAfZ5VF + operator: 饀re + - key: sj + operator: U姑R° + values: + - p8zbO + - key: 2LmP5 + operator: ŸȢ庾塁BƖ + values: + - NN + matchLabels: + ApvKyKe: kHE9lIIleR + mismatchLabelKeys: + - n3VRcT5qX + - zGNqgUGNX + - hDZ + namespaceSelector: + matchExpressions: + - key: "7" + operator: 砃=G墈赞飍鵝7d + values: + - Uiz9BnY + - key: hd76 + operator: '{緶ɡnW' + values: + - vc1yj10y + - Je + - eg + - key: 06pjmB + operator: =帛胏 + values: + - RQ10 + - Z5WWhGqt + namespaces: + - seMTT1 + topologyKey: E + - labelSelector: + matchLabels: + oplIL: 67Fs0Yu4 + mismatchLabelKeys: + - T1 + namespaceSelector: + matchExpressions: + - key: hOQWYMD + operator: vǑ壞2â飿"Xʝ簮倏c + values: + - "0" + - key: WWGKqAgL + operator: '''OƼŪ祰ǑŗiU嘏ɮ?Ī語' + values: + - yU5IOsL + - koP + namespaces: + - lDs + - xQZsD + - J + topologyKey: j0k4ds + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 9nDdXGQwP + operator: '[痵lǝ,ǶÜÂD' + values: + - th + - u8xZ + - ucr3vqZeG + - key: QWVrK8k + operator: ʀăɼy耯#運+3坽« + values: + - 2lcZKn + - G2IQ + - YbYwv + - key: N4bc7Wn + operator: '%7`iɊȑ槦醒}' + values: + - NiSH90 + - 98iHVkt + - 0r3Yu9i + matchLabelKeys: + - zrV + - Ey + - R + namespaceSelector: + matchExpressions: + - key: gEbVS1wo + operator: z + matchLabels: + 2YURuF: "" + CJTjm6: nOFN + oUtlWUD: 0k14ag + topologyKey: M1yF5YA + weight: 477520510 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: mdjoxbr + operator: V2SŨǰ8嫟淦 + values: + - 3ww0Ei + - 2PjudE + - pmpvETB0n + - key: NFqQGo + operator: 处;Ƕk鎹û絹褡Sy + values: + - V + - key: HuZ + operator: ȓő&ś>S怭ť]E榕 + values: + - sUume + matchLabels: + ef2q: 4ZL0O9b + r8xqG: MJ + matchLabelKeys: + - "" + - "Y" + mismatchLabelKeys: + - djn6fDf + - ukZi8 + namespaceSelector: {} + namespaces: + - dOU1F + - 1ygQdj3xZ3YIf + - wvpeJx + topologyKey: Rq4K6z6 + weight: -1277100698 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: b + operator: "" + values: + - tmuB5 + - 9qE9GM + - oJpaRDn2 + - key: WY + operator: u酘b + values: + - RhO + - Cs2rDIRrPlii + - nG4bqoAkQU + - key: eMae + operator: ǟĕȴnjI覿9¥H艞ɋ + matchLabels: + ToIBbWL: 4k8X + i2qGkWjvF7QJ: pb0sZq + u12o4B4: Ybz + matchLabelKeys: + - HCKtJC7hm + mismatchLabelKeys: + - 21r0Z + - "" + namespaceSelector: + matchLabels: + 2BNgnKr7Ob: 5RffK5NB3ghhfO + bJC: WTOgH + uA: bxdRwsU + topologyKey: 2CsbupZ + - labelSelector: + matchExpressions: + - key: RIP + operator: Oȝ(氧罻 + values: + - 1bx3Fix9 + - key: eqQoi + operator: 68+ʈĘ + values: + - FgfwmYrR + - mznlyr2aLTGF + - GfAoC8M + matchLabels: + FKwNoJ: aJZxa + cEeo8ix: 3dHunLjp5 + ihSd: qG7x + matchLabelKeys: + - F6LQK + mismatchLabelKeys: + - ULcGW + - RYv + - fF + namespaceSelector: + matchExpressions: + - key: Tkp5 + operator: ȴ潺谡Ƣh躈ŮâÿȒũĔ + values: + - fY9NuWB + - O84 + matchLabels: + 09fI: EDSEVi + Dl: 4u38aD4O + vZCciR: neqAXd7k + namespaces: + - ozziI6FZ + - URQlLJF + topologyKey: SeSq4K +annotations: + Bx5i3M: s + svlaTGpSHD: 7P9k +automountServiceAccountToken: true +autoscaling: + enabled: true + maxReplicas: 122 + minReplicas: 449 + targetCPUUtilizationPercentage: 218 + targetMemoryUtilizationPercentage: 488 +configmap: + create: false +console: + roleBindings: + - eaLPMN8qOPT: null + xb: null + xnt: null + - 3Mgk: null + roHIFBN: null + - TtzrP: null +deployment: + create: true +enterprise: + licenseSecretRef: + key: nj + name: rl +extraContainers: +- args: + - lW + - lpUVzUh + command: + - 3mEGtoKbEWE2Jw5T + - b1GBFA + env: + - name: hsiWF93 + value: zBco + valueFrom: + configMapKeyRef: + key: 8hvvaoHB + name: "y" + optional: false + fieldRef: + apiVersion: WPT5J + fieldPath: sc + resourceFieldRef: + containerName: 0xbTU4O + divisor: "0" + resource: tPBV2ObG + secretKeyRef: + key: YEKZukl + name: px + optional: false + - name: PM0MyyH3R6R + value: yOzX + valueFrom: + configMapKeyRef: + key: I3pi + name: DC + optional: true + fieldRef: + apiVersion: "25" + fieldPath: "" + resourceFieldRef: + containerName: aZj1E7LU + divisor: "0" + resource: sxs0nE31 + secretKeyRef: + key: Ktb3c4 + name: g98T + optional: true + - name: 6kDq8UgFIS8 + value: L0i4 + valueFrom: + configMapKeyRef: + key: 9WUe9 + name: tZrRUK + optional: false + fieldRef: + apiVersion: GIc + fieldPath: AXTmU + resourceFieldRef: + containerName: E2 + divisor: "0" + resource: a63tq + secretKeyRef: + key: luWp + name: lPdowo + optional: true + envFrom: + - configMapRef: + name: vzVk + optional: true + prefix: DONFyRd + secretRef: + name: 9uct + optional: false + - configMapRef: + name: z5nC9D + optional: true + prefix: 5epUyS1iy5m8 + secretRef: + name: zqRFC + optional: true + - configMapRef: + name: awjfJlZxN + optional: true + prefix: LhArOQgbq1OCR2L + secretRef: + name: mb5axzX5 + optional: true + image: qPLiX + imagePullPolicy: '{Ĩ檽]ĻĹňɋ偌Ȏ.阛魉' + lifecycle: + postStart: + exec: + command: + - yAeOM + - s53um + - 3m + httpGet: + host: GJWsJm + path: iDQ + port: 1781170742 + scheme: 皐ű葺ȝĬ麐&ʉ執dz0娸叹 + sleep: + seconds: -4230531115544534394 + preStop: + exec: + command: + - sIGb5 + httpGet: + host: AbxhPKar + path: 3ZZ5 + port: 88852320 + scheme: 砨Ĝ_筀¤痟氻劊űI俼员z幛F + sleep: + seconds: -4758564920159898567 + livenessProbe: + exec: + command: + - ty6JMTW6vA + failureThreshold: -1459976999 + grpc: + port: -1689493187 + service: ihsDMVYd + httpGet: + host: e9NNlO5d + path: iBo4 + port: 334788778 + scheme: ƿ:ħȠL$ + initialDelaySeconds: 1625633184 + periodSeconds: 1327859251 + successThreshold: 1766792721 + terminationGracePeriodSeconds: -3971501657411371216 + timeoutSeconds: 557348614 + name: U3U + readinessProbe: + exec: + command: + - "Y" + failureThreshold: 391027623 + grpc: + port: -1858356724 + service: hnqm + httpGet: + host: g + path: C48 + port: F + scheme: 苎lɲÁ频×ȊDžȀ9Ď"昽 + initialDelaySeconds: -1404160881 + periodSeconds: 521131323 + successThreshold: 2005094455 + terminationGracePeriodSeconds: -5942417190535485186 + timeoutSeconds: 2118365394 + resources: + limits: + Ms1A: "0" + WkWhM: "0" + requests: + b4kR9nm9BfQZy: "0" + eLg: "0" + huME: "0" + restartPolicy: ľ慔/PpǏ銢9滖ɝ韍I鍌$ʪ辫Uz + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - wą&嘪研Z`ȧȢfʘ*ō + drop: + - ƿ`ĉĎ苦Ǧ蘈NJ她笻Ƞ + - 磨3踦煨1JƸc錚捁 ĊZe)ám \ + privileged: true + procMount: 鋶XJm/覹ɋ¶ȉĒȤ瀶|ƻŒ(咡 + readOnlyRootFilesystem: false + runAsGroup: -8452021579348253718 + runAsNonRoot: true + runAsUser: 5983932912975749110 + startupProbe: + exec: + command: + - sZhTLr + - GK + - kqL9aDDm + failureThreshold: 1004086477 + grpc: + port: 1266077274 + service: l1ji1IW1ic + httpGet: + host: rJI + path: H731Dr + port: 1333462733 + scheme: 项鰚ɽ洍êƳ + initialDelaySeconds: 1806670133 + periodSeconds: 1290098703 + successThreshold: -490255445 + terminationGracePeriodSeconds: -206080146769410314 + timeoutSeconds: 270060590 + terminationMessagePath: P1HCGJEbJiD4 + terminationMessagePolicy: ʇ鞯BC鸼樁÷ǹ楺 + tty: true + volumeDevices: + - devicePath: a4 + name: 0bA + - devicePath: VeRXU9 + name: A0XbFJhG + - devicePath: fdim + name: RJf + workingDir: ZoDFb +extraEnv: +- name: "" + value: YbKo + valueFrom: + configMapKeyRef: + key: bIruuA + name: x8 + optional: true + fieldRef: + apiVersion: EqX + fieldPath: ZOh + resourceFieldRef: + containerName: IDJTm5lv + divisor: "0" + resource: QDC8v + secretKeyRef: + key: "8" + name: LcSdNiKff4 + optional: false +- name: RZHq9C + value: m + valueFrom: + configMapKeyRef: + key: PZVqf + name: x + optional: true + fieldRef: + apiVersion: xQi + fieldPath: vxeo + resourceFieldRef: + divisor: "0" + resource: l7 + secretKeyRef: + key: i3lK + optional: true +extraVolumeMounts: +- mountPath: OO0aO6h + mountPropagation: "" + name: kDKM + readOnly: true + subPath: AlRCH + subPathExpr: 7UemLsIe +- mountPath: Z8zdlU + mountPropagation: 醗¡°v:胡 + name: aedAMG + subPath: zo5P1xa + subPathExpr: WmuiME +- mountPath: ufiUx + mountPropagation: '`ʡÔ关Ľ?' + name: PWBh + subPath: 2hslJ + subPathExpr: pUtN3 +fullnameOverride: YUi5JpG +image: + pullPolicy: ȕ蚧竔/´苅oC + registry: zUsK + repository: lQjo + tag: p +ingress: + annotations: + CImW98Gx2v: otj + fP: SRGkm + className: lM + enabled: false + hosts: + - host: AYT + - host: oulge + paths: + - path: 3bi + pathType: ixqeQz + - path: nG + pathType: 5LwYGxvMr + - host: "" + paths: + - path: jJrUpe + pathType: 72AAc + - path: B0K + pathType: kxnm8kN + - path: tQDn + pathType: IxAmHD + tls: + - hosts: + - n9Np8ftRtFhzi + - g + secretName: C + - hosts: + - CMhuwA + - wYA0tSvo + secretName: z + - hosts: + - 34mbP + secretName: 80Z +initContainers: + extraInitContainers: PRtnaAy8 +livenessProbe: + exec: {} + failureThreshold: -1392926461 + grpc: + port: 257623603 + service: us + httpGet: + port: L9CrR58RHnS + scheme: ʅ²7kp + initialDelaySeconds: -1384385388 + periodSeconds: -1660079876 + successThreshold: 680842396 + terminationGracePeriodSeconds: 6050526356201491316 + timeoutSeconds: 213455290 +nameOverride: nEojiMtRc +podAnnotations: + Mfsd: hmi +podLabels: + 6dZAs: xJPaLHKS1Y2 +podSecurityContext: + fsGroup: -6567182940167159103 + fsGroupChangePolicy: 6iɰ堂:齐ǪÈ + runAsGroup: -1787219330993537800 + runAsNonRoot: true + runAsUser: -5627543087390804845 + supplementalGroups: + - -3306962996817147613 + - 975882030005456556 + - -5263492609498468245 + sysctls: + - name: YC + value: 7JlDTCP6hs +priorityClassName: 0P6RnoBeb5 +readinessProbe: + exec: {} + failureThreshold: 1689894479 + grpc: + port: 222105741 + service: D + httpGet: + host: vyj + path: JoV4VZMz2Bv + port: vRf9ZHgc4j + scheme: 条om競娷Njʑ + initialDelaySeconds: -1753994274 + periodSeconds: -1189421015 + successThreshold: 1278527365 + terminationGracePeriodSeconds: -6266260075166332402 + timeoutSeconds: -209775227 +replicaCount: 391 +resources: + limits: + 8ycM: "0" + requests: + CvglPI: "0" + s5: "0" + uiHB: "0" +secret: + create: false + enterprise: + licenseSecretRef: + key: Iq + name: Tb8RGi + kafka: + awsMskIamSecretKey: gj + protobufGitBasicAuthPassword: kO + saslPassword: IB3qNjrV + schemaRegistryPassword: 4wnp6Qi + schemaRegistryTlsCa: gFBJq + schemaRegistryTlsCert: LUubckiv + schemaRegistryTlsKey: 9Op + tlsCa: 94x0v + tlsCert: h4lSMbv + tlsPassphrase: CVT4wjw + login: + github: + clientSecret: YaYETggo1hi + personalAccessToken: d + google: + clientSecret: tDqsIg + groupsServiceAccount: FSUAkU004n0k + jwtSecret: 2dWKNqarwb + oidc: + clientSecret: i2n + okta: + clientSecret: XytR0yn + directoryApiToken: m3WEq4zKv + redpanda: + adminApi: + password: ozo + tlsCa: 0g + tlsCert: hQ + tlsKey: xfpkmy +secretMounts: +- defaultMode: 184 + name: L8dbWip + path: g + secretName: LF0O +securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - «Ƙz损 + - ɟE鄱Į惪Y桦ŗɘoȍ蠣4ƪ呀R> + - "" + drop: + - 娤b + privileged: false + procMount: ʍ曏(ƶæ + readOnlyRootFilesystem: true + runAsGroup: -406748533537085799 + runAsNonRoot: false + runAsUser: 3238073083343117470 +service: + annotations: + 8v2: JbH + 95cxbjjD7C: JBMaJ + VY: yRV7d + nodePort: 18 + port: 168 + targetPort: 227 + type: WAAXkZY +serviceAccount: + annotations: + DQxrtk8: buiWLPbYq + HHbP: sAY + Y0DKOcTa: D82Nfh + automountServiceAccountToken: true + create: true + name: DSw7 +strategy: + rollingUpdate: {} + type: żʧȟ +tests: + enabled: false +-- case-048 -- +affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchFields: + - key: v + operator: ė + values: + - ln + - lU4zX8iz + - t0Xc + - key: s3fpu + operator: ɥ娿ăʄĠ mʓ銈E'袭ĵ + values: + - ljJlhx + - matchExpressions: + - key: qPBvuBghor + operator: 泱诅ʫt + values: + - a05XZwN + - SiAvFWs + - FhW1 + - key: MVFTcW + operator: º囜N赧0索d + values: + - c + - ghZI + - AjB0J + matchFields: + - key: QzMSpLW + operator: :ɉùȪÇzǥC货°ÕV? + - matchExpressions: + - key: pA7a1gYdV + operator: '[ĪtOK' + values: + - 2bE4Bw + - fyMOYi + - key: wshbw7Ix + operator: J槭~撑MS=ÑƎ薽饵a緗 + values: + - 9jt6 + matchFields: + - key: s1 + operator: 犫茬睶ňv + values: + - XhyH + - Ng1r1 + - nqis + - key: mHLiT + operator: ȁ佝L郗s稷tŻ+f舭拳鰵2e{a + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: jdvk + operator: ƶ + values: + - NV + - y4 + - V2XRZS + - key: 9VvAl5 + operator: <坎陸$§¤_ã檠奙Å饉J夗ɓ翩锸辸 + values: + - x26kYkJ + matchLabels: + DziixIJYd: yCXzPc + matchLabelKeys: + - XNuk + - RGLu + mismatchLabelKeys: + - aF3 + - R + - Tnj6SmTq + namespaceSelector: + matchExpressions: + - key: e1XR + operator: Kɞ窏ǿ,鸣ŰcNc + values: + - Yrq + matchLabels: + F2Pe7J: dlwTdhs + lK: nolQ + ys9z: euXWPiaJ3Bv + namespaces: + - tAzvw4OH1G + topologyKey: 6y + weight: -1640008169 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: XbjQvP + operator: V嶙NZ谡筩ǒ抂 + - key: i + operator: ɔŃ旓Ɍ鬺X + values: + - Zvx + - 7HWJ + - e4ucTP + matchLabelKeys: + - 0LSTZ + - ESk2r + mismatchLabelKeys: + - CKhfvR0Sg + namespaceSelector: + matchExpressions: + - key: A0tc + operator: 辛§ʢ垝V矋n握匞~嶯筪溆¸ + values: + - ML + matchLabels: + K1pr: ROFIwZhJYYo + ODc: 48WQ + namespaces: + - Wv7 + - zenLPw + topologyKey: tIVDde5U + weight: 1977587462 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 3YyUamlR + operator: 橯F + values: + - dHitre + - 90jUjk + - key: NtnSL + operator: 臰sR=坵Ěcñ黪:ɻ寊â9dƎ\V + values: + - qqzycK + - key: ICXJGRFS + operator: $貕^eėǭD鳅ʇ + values: + - txX + - SFrkJ9r + - 3jOnwEW1 + matchLabels: + Uwj1kpV: oUXOYkF + o: ts5wRqjTyCy + matchLabelKeys: + - V2DNNCORe7ZRA + - pglXe4D + - w3881 + mismatchLabelKeys: + - xbi5KtUmR + - eZenitLdd + namespaceSelector: + matchExpressions: + - key: fxd5Y + operator: 頣R熗!A麳Ƚ6r爤暓 + values: + - oe46YF + - rT30v + matchLabels: + 4WA: EH + nRhlLLx1yHy: 5UFrj + namespaces: + - 7j92oP + - 2hf + topologyKey: "" + weight: 92207265 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: wBvol + operator: Ɂüɯ + values: + - eKmyok + - key: B2uj69 + operator: "" + - key: hLrZlh + operator: ȕ嵠味 ɼ_ + mismatchLabelKeys: + - W + namespaceSelector: + matchExpressions: + - key: Qu + operator: 亣i拴ÿ + values: + - OeiUsmYu + - oGXa6Ma + matchLabels: + "": Li + oDV7yR: NP + namespaces: + - PQjQb3LP + topologyKey: Gs1 + - labelSelector: + matchLabels: + "": nF + mismatchLabelKeys: + - YG6aQj + namespaceSelector: + matchExpressions: + - key: HpxPVtw + operator: z畘ŠƽǢ蘟\ɡ忕ɋ蜹5B + values: + - EQ + - RP3fBi + - key: Lv60cZut + operator: 裰ƈ + values: + - I9JbN + - dt + - Cya + - key: 0MGm8N + operator: 遍Ż + matchLabels: + nELvnrAFr: DClM + topologyKey: N57yxG + - labelSelector: + matchExpressions: + - key: "" + operator: KǞ}ɣȿ嚶宗荝«Dž + values: + - CGw32z4JHya + - E + - u5CDtdc + matchLabels: + J5LzcLei: kBwTCGZ + iLpqu: j4bqBNDjAK + jN: jUZ0u + matchLabelKeys: + - lNM + - K3nOO5 + - 9norFQpMiC + namespaceSelector: + matchExpressions: + - key: y4teb + operator: 蚯 + values: + - P + - O0 + - MvxOu + - key: v8w1Ok + operator: 8ƴņŨƊ¹艗胲ƦpYƿ9d脙~Ë + values: + - "4" + - "66" + namespaces: + - OtWsVW + - p + topologyKey: GeF + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: GRLHy + operator: Ä椶 + - key: Z + operator: ė牫ȃ汥Ƈ娍q\桕ɄNǴ + values: + - S1hMkP + - K + - x5coDg + - key: kJzBQ + operator: ʉĻ孺bɧɬʬ柿娤e¯]每) + values: + - DbD1 + - C5dyvNew + matchLabelKeys: + - 8G + - 7cCVU + - lN + mismatchLabelKeys: + - xJ5l + namespaceSelector: + matchExpressions: + - key: U89y + operator: ȓ2浿澰V缐厧钎wň莁願菶ʈ杈 + values: + - 9m6ydjpHu + - CatqpZmUCL + - dJz + - key: SIePbOJc6H + operator: ljR2qɟ$s櫮c雕Ů幔莁沥ʫľƙŝ + values: + - 75tj75r + - XiO + - key: "" + operator: 舄或崙Ĭɐ耼Ī弋禽$ + values: + - HWwXVr4o + - WEkwi8ZNDQ + - f + matchLabels: + fi8w0BX: Z48LRdXmkJ + namespaces: + - Yaw2NnfJ + topologyKey: ElKfd7Eo + weight: 1078166465 +annotations: + Dgw3Wl: 7aofTp +automountServiceAccountToken: true +autoscaling: + enabled: true + maxReplicas: 1 + minReplicas: 224 + targetCPUUtilizationPercentage: 468 + targetMemoryUtilizationPercentage: 256 +commonLabels: + 4kU: mkn8 + Ro: NFx1P + Z1p: WE +configmap: + create: true +console: + roleBindings: + - FZ5NQS6: null + - 0ToI: null + RTwav: null + mWwdgyM: null + - {} +deployment: + create: true +enterprise: + licenseSecretRef: + key: "" + name: 3VGefRh +extraContainers: +- args: + - 3QF + - k1BJBm + command: + - PMW + - j + - V7MAcfomz + env: + - name: rAzI53 + value: WlHlq + valueFrom: + configMapKeyRef: + key: zzIBsb + name: Bh261F + optional: false + fieldRef: + apiVersion: SlA + fieldPath: "6" + resourceFieldRef: + containerName: q0BBEv + divisor: "0" + resource: JE + secretKeyRef: + key: FvrZgBz + name: ZTBeic + optional: false + - name: uPptX + value: i9 + valueFrom: + configMapKeyRef: + key: JeHwi + name: TiQHOG1EsFUgIE + optional: true + fieldRef: + apiVersion: i7dd + fieldPath: Tu + resourceFieldRef: + containerName: ChdvA + divisor: "0" + resource: Eq1V33RTZQSJRJFg3V + secretKeyRef: + key: ojxn54r + name: L + optional: false + - name: Sl9Py25FX + value: e9 + valueFrom: + configMapKeyRef: + key: Zq80J9tyR0opcz + name: gy00dyvHFa + optional: true + fieldRef: + apiVersion: UJLSQy7zL + fieldPath: Xm4sg5H + resourceFieldRef: + containerName: ZmY7Fno6Fcop3 + divisor: "0" + resource: gqZwW + secretKeyRef: + key: v + name: hJDoWtjkfL + optional: true + envFrom: + - configMapRef: + name: RdWA + optional: true + prefix: Dq + secretRef: + name: BOBOO0sLIWw0e + optional: false + - configMapRef: + name: MoMnWNTC + optional: false + prefix: "3" + secretRef: + name: B58Vvj3 + optional: false + image: Vn5V + imagePullPolicy: 筥ǏŤČ癳嶧GĒH挕ÄHɡ + lifecycle: + postStart: + exec: + command: + - hTIx + - lslygl + - lSgx5G2IfU + httpGet: + host: GNVKz7 + path: d0Y + port: Igi + scheme: 莵łEǐ嫖ʒʔvŊ>ry5贛 + sleep: + seconds: -184172880642712439 + preStop: + exec: {} + httpGet: + host: tD1TkKV0ES + path: s6 + port: OpK5riOe96 + scheme: 琊*i#欱E唂ȧ鐄膶詃7 + sleep: + seconds: -4889549574266894064 + livenessProbe: + exec: {} + failureThreshold: 1591130939 + grpc: + port: -540029946 + service: aoAN2Lx03 + httpGet: + host: vWu + path: Lo + port: 1468671948 + scheme: ȯ煐IŢ + initialDelaySeconds: -1879733088 + periodSeconds: 1106663448 + successThreshold: 240850805 + terminationGracePeriodSeconds: -7405296717602935730 + timeoutSeconds: 524743651 + name: AInfx2Rak + readinessProbe: + exec: + command: + - oIA3 + - H + - 96Uj2 + failureThreshold: -1855887857 + grpc: + port: -495541010 + service: X + httpGet: + host: ZplmMg + path: tAAr + port: 1950182935 + scheme: ʂ綽oa;n轮ęB觼Z=G泇跢揌韇锶 + initialDelaySeconds: 1057136331 + periodSeconds: -2025421367 + successThreshold: -812558156 + terminationGracePeriodSeconds: 4314843605692522234 + timeoutSeconds: -1609986779 + resizePolicy: + - resourceName: EvmpG + restartPolicy: 4ɱ + - resourceName: hTB20ObO1 + restartPolicy: ½ŏ伐Q蔏ʝ噙漃袩J]Ɣ蒘岇 + resources: + limits: + KWlx2c: "0" + O: "0" + requests: + ZCJwGBL: "0" + restartPolicy: 1nĔ:蹮>s蹬ÍǺ + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - 迠寈搣弝渎İ- + drop: + - 檹Ɩ + - ɧ麧ç2ā兛杧蔙團载^P蚡5缿ʒU襩 + - cLD|ƶ虌Ȗ + privileged: false + procMount: ïƋ圏滜ľ転謀ĤP蹥ȅ|髃蒃Q癎æ + readOnlyRootFilesystem: false + runAsGroup: -4850605470374303682 + runAsNonRoot: false + runAsUser: 7731251064648990624 + startupProbe: + exec: + command: + - LqYoUQy3c4BE + - 5N + - Ug + failureThreshold: -1290004088 + grpc: + port: -1721281251 + service: H2p + httpGet: + host: 02CP5 + path: F609y + port: JjwFH + scheme: 珑 + initialDelaySeconds: -402608647 + periodSeconds: -1520214127 + successThreshold: 209058699 + terminationGracePeriodSeconds: -1900030585542850396 + timeoutSeconds: 1686394545 + terminationMessagePath: qixKzKz + terminationMessagePolicy: Ǥ衚蔁ʙ剠Ǡɭf~ + volumeDevices: + - devicePath: zM1 + name: jmc + - devicePath: IZ + name: PS + - devicePath: kN24U + name: Apu0r1U2 + workingDir: WgB +- args: + - 2Z37 + - 75kO + - TjvjkZTrc8s + command: + - M0NtzJ + env: + - name: 2EH + value: O + valueFrom: + configMapKeyRef: + key: J1ozKsuji + name: glLvAIHP7i + optional: true + fieldRef: + apiVersion: 3gAjGu + fieldPath: sNpuR8m + resourceFieldRef: + containerName: oxx + divisor: "0" + resource: PuKq + secretKeyRef: + key: Iua2L1LoCWMs2 + name: YfKwS8s + optional: true + image: PKNM + imagePullPolicy: ÍĪ0魣Ŋʒ + lifecycle: + postStart: + exec: {} + httpGet: + host: fsZ + path: EGnu + port: 765491661 + scheme: ?ğ叆ɂ&pʠ溶Ǚu + sleep: + seconds: 4688626474961012693 + preStop: + exec: {} + httpGet: + host: TB + path: "6" + port: -50369560 + scheme: ~Ǚɇ>ƃ\7]歉sh羘y4 + sleep: + seconds: -5293607398165581925 + livenessProbe: + exec: + command: + - 1g8dewdj + - lRmD + failureThreshold: -125369558 + grpc: + port: -1490211482 + service: R + httpGet: + host: CSGThzhG + path: 9NBKzoiFzs + port: -272474300 + scheme: ŀ + initialDelaySeconds: -1094670881 + periodSeconds: 1768141210 + successThreshold: -985604418 + terminationGracePeriodSeconds: -1297054466922920616 + timeoutSeconds: -1289231356 + name: KtKv6dg + ports: + - containerPort: -632764671 + hostIP: 8CU + hostPort: 917138107 + name: 1VgOx + protocol: 典ȫ窃ÛǪ3m患 + - containerPort: 739656218 + hostIP: dQQ3 + hostPort: -1348301133 + name: "3" + protocol: '?Ū慾ŘLº桒J:茦扰絥ǗȑĎ:' + readinessProbe: + exec: + command: + - qZ2J + failureThreshold: 293719665 + grpc: + port: 1235836411 + service: ig3 + httpGet: + host: Ws + path: FVnJhZq7I + port: -1075951148 + initialDelaySeconds: 321800409 + periodSeconds: -556535717 + successThreshold: -625124830 + terminationGracePeriodSeconds: -4084380722124342213 + timeoutSeconds: -904900305 + resizePolicy: + - resourceName: GKINnuJx + restartPolicy: Řl©=嬈牍]佧& + resources: + requests: + omO: "0" + uga5: "0" + xnRsp6C: "0" + restartPolicy: ʝdŌİ蒘傥>晑|癶x&ĭmŭƙŵ + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - 約nɤưHĞ4WƳǤȣ糥蠇t + - ¾ʃŔ冻楟?¿揈h嘼œ + drop: + - 7忭譺屩嫕ƞʅ袬/氼Xg养ȸ陣萓 + - 胨`鯵ƪĽ藹 + privileged: true + procMount: Ulƙxȿƌ乜溬噕瀆储铐\纬 + readOnlyRootFilesystem: true + runAsGroup: 4589112012742886931 + runAsNonRoot: true + runAsUser: 3204614620414442288 + startupProbe: + exec: + command: + - TFJ + failureThreshold: -585814509 + grpc: + port: 178002023 + service: lAuHCrE + httpGet: + host: "88" + path: Th + port: In + scheme: 鷵菭g顲Ⱦ穪 + initialDelaySeconds: -1856697198 + periodSeconds: 1469578394 + successThreshold: 160563852 + terminationGracePeriodSeconds: -4442318275257517382 + timeoutSeconds: -16211809 + terminationMessagePath: 513sVbgA + terminationMessagePolicy: 隓Ǽ屼Å7嗟Ʈ麝0{ȦDžĐ! + tty: true + volumeDevices: + - devicePath: ugQAJ + name: Jf + - devicePath: BFfnTD + name: kfF6CZ + volumeMounts: + - mountPath: C3 + mountPropagation: 呍婻厦ǒ絶偂蠛ƺ蠖蕍v貰Ė + name: DQvHajhHx + subPath: aYHGugq + subPathExpr: MSs + workingDir: OE +extraEnv: +- name: rd10f1l + value: GtUE + valueFrom: + configMapKeyRef: + key: C1N + name: bi + optional: true + fieldRef: + apiVersion: 9GWlMsB + fieldPath: l2 + resourceFieldRef: + containerName: 4t + divisor: "0" + resource: eyjvzsf + secretKeyRef: + key: xBMOaej + name: O8AG + optional: false +- name: C + value: fYlde + valueFrom: + configMapKeyRef: + key: 4HvhDAkW + name: 5bgA7leE7 + optional: false + fieldRef: + fieldPath: zY6rf + resourceFieldRef: + containerName: S3 + divisor: "0" + resource: 3sD + secretKeyRef: + key: s43 + name: LpaQ + optional: true +extraVolumeMounts: +- mountPath: M5 + mountPropagation: 稤Bơ觓Ð琋 + name: yQHj49RtdzN + subPath: GdQkAKF + subPathExpr: Gvswh +- mountPath: QRg + mountPropagation: 搚Kƕ欕K貵蠜d旓ĀÝ虩釓 + name: qCEH27RF + readOnly: true + subPath: nHB05RuTZ + subPathExpr: K0yH +fullnameOverride: 3um +image: + pullPolicy: Ƀşb?師Ğ`3H觉趟糯襖 + registry: VHbf77MFq + repository: 9Gz + tag: Tg +ingress: + className: ob + enabled: false + hosts: + - host: gH + paths: + - path: Ts + pathType: CGb + - path: "" + pathType: zZQ + - host: iiV3 + tls: + - hosts: + - tHQ4 + secretName: fnmcizOYm + - hosts: + - iPP + - 6ESVwf0d + - ziZck0N + secretName: O7mKv7 + - hosts: + - 8YGvchGJ + - wN + - XtvjzH0 + secretName: VlbaTuVK +initContainers: + extraInitContainers: thAoOYwQDaAt +livenessProbe: + exec: + command: + - nCg + - T6fzKjCjD + failureThreshold: 279778022 + grpc: + port: -995356959 + service: 9yOO2 + httpGet: + host: PYJSaHej + path: fr7 + port: 8Ij + scheme: QɄ揆ѧ鶹i骡l僴Ǎ植烤ĕǘqɦ + initialDelaySeconds: 1098820524 + periodSeconds: 414174316 + successThreshold: 1178515566 + terminationGracePeriodSeconds: -5729352865043664628 + timeoutSeconds: 873461419 +nameOverride: W7q3X +nodeSelector: + Bm9U: oTYglG6dh +podAnnotations: + eG: vxInc0 + g: BI6yk + xCtSP: rQ +podLabels: + ZEXh: zufy +podSecurityContext: + fsGroup: -3794452885502571644 + fsGroupChangePolicy: 欲飹Rɦ薕µL<Ĕ + runAsGroup: -3171560656159467191 + runAsNonRoot: true + runAsUser: -4412205905842408558 + supplementalGroups: + - -7215185124091152595 + - 5139656417921062736 + - 600742233156257714 + sysctls: + - name: Te + value: cKzihj +priorityClassName: l4Mowg +readinessProbe: + exec: + command: + - "" + - c8G + failureThreshold: 37001950 + grpc: + port: 1211428387 + service: UUKg3TJGP2 + httpGet: + host: eznD + path: aBohoOMPU + port: -2044766681 + scheme: 讻;Ǩ办鈁癃靟èʣ¾fǖ^Ǟ + initialDelaySeconds: -396024246 + periodSeconds: -1467409206 + successThreshold: -1328773613 + terminationGracePeriodSeconds: -8721653473984246810 + timeoutSeconds: -1781454259 +replicaCount: 46 +resources: + limits: + 8cdWaeK7jVrR: "0" + HYBi6o: "0" + requests: + NOz: "0" + gH: "0" +secret: + create: false + enterprise: + licenseSecretRef: + key: wNZRnHu3m + name: ULOBG + kafka: + awsMskIamSecretKey: RfMF + protobufGitBasicAuthPassword: julgURa4B + saslPassword: uuq + schemaRegistryPassword: "54" + schemaRegistryTlsCa: 0rjT0gsnw3 + schemaRegistryTlsCert: kpA9ZJQgp1 + schemaRegistryTlsKey: 4rfN + tlsCa: NhTEC0A + tlsCert: iN0W + tlsPassphrase: Id1ovgK + login: + github: + clientSecret: LWyKxwgV + personalAccessToken: Nkq1DyJixsC + google: + clientSecret: tJv + groupsServiceAccount: 9jqz4h + jwtSecret: PWdr6CcxS + oidc: + clientSecret: RMxiMIY + okta: + clientSecret: SJ6I + directoryApiToken: 1wIf + redpanda: + adminApi: + password: C9I2x + tlsCa: Qpp + tlsCert: "" + tlsKey: 7uh28L +secretMounts: +- defaultMode: 80 + name: Mt1 + path: WsSL4vxNxCkXP + secretName: ZxXI0Hhv +securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - Ɋ闻ǃɗʀd撪 + - 蘑ǪY桼ɮǚɳ爥ňB + drop: + - 乄}ñ0詘蛾牪坣缰ƩǏ薷©瓚`Ʋ虯r + - ǓJğ&ĊƯʝbǠCŪzgì + - ńǜ[ɪ判Uʋ]泘狔 + privileged: false + procMount: 媹:堏_ɟ榧禙Ɲ'瞟 + readOnlyRootFilesystem: false + runAsGroup: 2759228957449300312 + runAsNonRoot: true + runAsUser: -812867783664200775 +service: + annotations: + c: DNy + kDPtPpnL: kFmmx + nodePort: 377 + port: 311 + targetPort: 29 + type: l5gj +serviceAccount: + automountServiceAccountToken: true + create: true + name: sKa +strategy: + rollingUpdate: {} + type: 顓ǝSm +tests: + enabled: false +tolerations: +- effect: 嫜ʎ愤wßj硭 + key: JO1 + operator: ȼ¾Pȇ挮ƶȋ'蹑鶚嗵ïG + tolerationSeconds: -6027642013843151183 + value: a3XbyS +-- case-049 -- +affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: L + operator: 域%Ɠ礇!ʘl.ǷŠ该貹&N + values: + - oAk8rvkey + - Fb08GpumY + - key: YJGr + operator: '|4\i事!ų藦x鳜Ǫ' + values: + - 63Yvc + - key: j + operator: ¸瀖čņ!彅搀 + values: + - RnzdW + - Nxs + - unZuno + matchFields: + - key: wLP0QqdHBmd9e + operator: ȑwȼ嶢vC`ȖĜƐ桡牆ēIa,謧ŗ + - key: mdgmMZ + operator: Ō§ȶƔ>#Z骻5S洝岛Ċ啞. + values: + - Fvf6 + - key: GQsV + operator: 涥ȕêȩȋ婍0毙舺糩\DŽŅ饒 + values: + - XccQkxG + weight: -1172839714 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: JpS0BkW + operator: 聣耥ʒ昼|Ȏ)ß瞖a癨櫒缮{v + - key: HLL3gv + operator: 铡ÞC腢z蟒Á + - key: iDGQV8Bjyu5Q + operator: 舢脛歛ƻ68 + values: + - eLCH7Nc + - QQqPUN + - "" + matchFields: + - key: AY2q9fnL + operator: ȏ伌鎩5桀ʁ + values: + - Uac + - K0q + - bY71A + - key: rBwZz + operator: '*ĴȉǼ矼SN]ʛ源' + values: + - 5yMkn + - key: S1C + operator: ÿƙ彋,嘲樦 + values: + - OXH + - vl1 + - uCYaO8Cn + - {} + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: mZ3rAF9 + operator: yŲĺȫ阁笵W®詃Œ + values: + - bhvFz + - key: uiaNXZcXT + operator: "" + - key: AAM + operator: 閸鬼駝洁c奊(Ƅ謍MǍ辰T堍癩)丗 + values: + - "9" + - ESiN3 + matchLabels: + kCSDZtsm5: vVk + oBlyCq: jlh + matchLabelKeys: + - BCZ8FFbh + - A + namespaceSelector: + matchExpressions: + - key: Lsf + operator: L + values: + - a0HB + - C + - key: eoj6ic3 + operator: ż伌oA汄俔ɿ7巪娻% + matchLabels: + Cx: wwPPM + namespaces: + - 9xhG + - JAutZqe4gGeuf + - "" + topologyKey: 1a + weight: 223935020 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: LtGRhs + operator: 棺ǔ'ɘ砒Æ擑Ɵģ + values: + - GhM4BSJqNOf + matchLabels: + "": 7Ni + matchLabelKeys: + - yxF4 + - 22RoWr + - etRteovEh9 + mismatchLabelKeys: + - 7NOfe + namespaceSelector: + matchExpressions: + - key: 3KCX2 + operator: 臞ʀ¯弄Ɨ橎琜ġ鍳¶ȣ2墛.ɮ濎ɕ磞 + values: + - 5YiE0xEC + - 4spxMd + - vUPA + matchLabels: + YHIq: nS + topologyKey: F4 + weight: 716052627 + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: "9" + operator: ĠƑȥ兾3ŶJ + - key: pPvuyWZ + operator: ;bļo刲+圊}MǏŅ惤ć + values: + - 9pMXT + - Ezwo11 + matchLabels: + 66347W: ccFxZoF9 + X: VrN5kt + mismatchLabelKeys: + - u4LyY1 + - zT + namespaceSelector: + matchExpressions: + - key: qwhutJo + operator: 垴ǞƼ + matchLabels: + OFxMkYx: lhxtM + topologyKey: WN8qbUgigF + weight: -1609734055 + - podAffinityTerm: + labelSelector: {} + matchLabelKeys: + - "" + mismatchLabelKeys: + - XnhP + - "" + - Bk + namespaceSelector: + matchExpressions: + - key: M + operator: Ǽ糨ʡ毺Ɇw + values: + - ntvI + - vs + matchLabels: + "4": 2Y2FBpcbg + namespaces: + - 1S8c + topologyKey: jxiZ4d + weight: 1993833508 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: EpKkdimp + operator: 额ƀ箰L禼aÅ顙)C舉 + - key: e2Zu7Kb + operator: t潱髦pö鵺b澁6銹 + values: + - z9n + - LdMQ + - r + matchLabels: + F: Nc + Qa2h5toVwd: GGxZ3BQ + l: Z6Rh + matchLabelKeys: + - LsCC + - dgmxxZW + mismatchLabelKeys: + - e + - Cb + - e0DAEluN + namespaceSelector: + matchLabels: + oJ56D: 33m + tkP8tO: mIkfyE6E + namespaces: + - VxN + - hbwB9 + - t + topologyKey: qag0unul +annotations: + BceQMZiOm: E1uakdHPkLNL +automountServiceAccountToken: true +autoscaling: + enabled: true + maxReplicas: 292 + minReplicas: 381 + targetCPUUtilizationPercentage: 255 + targetMemoryUtilizationPercentage: 99 +commonLabels: + 0HYkOrz: JCwpSW + 0TgDztQSY: P + ztm: qegfb80 +configmap: + create: false +console: + roleBindings: + - K: null + nGSYV: null + roles: + - {} +deployment: + create: true +enterprise: + licenseSecretRef: + key: yAo51i + name: blNvk6O7Urx +extraContainers: +- args: + - kn0F9 + command: + - M + - Hph3 + - lZfWKF + env: + - name: HBWtNh10A + value: 8guE + valueFrom: + configMapKeyRef: + key: Chnm + name: UlwzEQ + optional: false + fieldRef: + apiVersion: 8pq9 + fieldPath: qpnfP4p + resourceFieldRef: + divisor: "0" + resource: L0tn + secretKeyRef: + key: J + name: gbfgF + optional: true + envFrom: + - configMapRef: + name: n32MM + optional: true + prefix: cp3 + secretRef: + name: Uc + optional: true + - configMapRef: + name: VGBL + optional: true + prefix: NTMU + secretRef: + name: CEg + optional: true + image: zIWYBi7 + imagePullPolicy: 蘂ȱʃ& + lifecycle: + postStart: + exec: + command: + - QpTcv + - MS0T0N + - wiE + httpGet: + host: ZCUJOIH + path: UsXT + port: 8nExSP2u + scheme: 'uŊ6熀: 焆 烷ʫ-Ŗ亾ɣʖ氝"肰' + sleep: + seconds: -2519616411083819638 + preStop: + exec: + command: + - rmQ7 + - GxRXQk + httpGet: + host: UIVpXMrzW + path: 4tHQ + port: 8xLK1VyM + scheme: ƳǃóɃȊ{回żz闓葊G嚥 + sleep: + seconds: 3595323074300269449 + livenessProbe: + exec: {} + failureThreshold: -882825879 + grpc: + port: 503069299 + service: W + httpGet: + host: FilCCd + path: NPZrCEq + port: 6NoPho8wIsxe + scheme: āȹ顺悩錣Xƕ灄ĿG乒 + initialDelaySeconds: 781680731 + periodSeconds: 205458 + successThreshold: 1115648780 + terminationGracePeriodSeconds: 4579765768791485272 + timeoutSeconds: -676867842 + name: 2tf + readinessProbe: + exec: + command: + - edKf + - 0U + - MFr2Oh + failureThreshold: 1812906550 + grpc: + port: -791379232 + service: IAqADBco + httpGet: + host: 55GZ + path: AQC + port: sxTXcp + scheme: ƷMg靚珨嘸ȗʒ鑉Ȝ梒ŗǐkōĕĵ鞍 + initialDelaySeconds: -130429301 + periodSeconds: 876742351 + successThreshold: -1424043483 + terminationGracePeriodSeconds: -1574530902871555383 + timeoutSeconds: 764935409 + resources: + limits: + 9eHi: "0" + rO52puR: "0" + requests: + UF8LV7N: "0" + ao: "0" + cRVsAz8v: "0" + restartPolicy: ɥ]×璳 + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - ɖ膵7&ʞíXĦx-ǰİɾ榩聨ŗ% + - DŽ熲鴼玜覲杷ȆƠ沺伤{拢 + - ɉȋʠRÂo霾噜奩ƻv$Áő + drop: + - ɑ摿愻J«ʘA宜ƹ¶ + - 餫aJ矐sǁ隑z36渢X赼 + - )ǜ鄰挺溒ŒV栜Ù涸JH-_d + privileged: false + procMount: Ito縎 + readOnlyRootFilesystem: false + runAsGroup: 2484782727894659713 + runAsNonRoot: false + runAsUser: -6936271037843914749 + startupProbe: + exec: + command: + - X + failureThreshold: -256045507 + grpc: + port: 376282302 + service: wdQrDn0 + httpGet: + host: teaO6 + path: DBHpGkYdgAJ + port: -1625640156 + scheme: Ʌ + initialDelaySeconds: 673272264 + periodSeconds: -1050905915 + successThreshold: 282500457 + terminationGracePeriodSeconds: 5768805478519709604 + timeoutSeconds: -601307290 + stdinOnce: true + terminationMessagePath: POO + terminationMessagePolicy: '#d鿂Hk閎=ɰ蜐ġOʡ蠁żǖ' + tty: true + workingDir: Z3pdGL +- args: + - a7Tqs + - UuID5t + - gRCnbjyp + env: + - name: ZV1KP + value: WrT0 + valueFrom: + configMapKeyRef: + key: zZzTgax + name: 3z3eoets + optional: true + fieldRef: + apiVersion: 88zo + fieldPath: z0vE72 + resourceFieldRef: + containerName: DF4t + divisor: "0" + resource: hfVfYFW4 + secretKeyRef: + key: I6JwpO5 + name: I88w22gsx3 + optional: true + - name: z8 + value: sgj8UHZ + valueFrom: + configMapKeyRef: + key: Q85vN + name: lYGl4 + optional: true + fieldRef: + apiVersion: oQu7 + fieldPath: TYd + resourceFieldRef: + containerName: "Y" + divisor: "0" + resource: Yx + secretKeyRef: + key: f + name: 0Pjf9YBj + optional: false + envFrom: + - configMapRef: + name: fAH + optional: false + prefix: vjjU + secretRef: + name: 9A8OgEQ9 + optional: false + image: R7L + imagePullPolicy: '}m6铤<豎ŵ,#M狥ʬo' + lifecycle: + postStart: + exec: + command: + - 2E + - gzntg + httpGet: + host: BOoVI + path: ns7ZMdNwQC + port: XF + scheme: ky咊ʅ ʂ娼ȟƐ橽ǿ唔ARɨ罙 + sleep: + seconds: -3978858376823543730 + preStop: + exec: + command: + - Hns + httpGet: + host: Lw8 + path: wdo + port: -239095421 + scheme: ƹ禍OÇ + sleep: + seconds: 3838288160382433952 + livenessProbe: + exec: + command: + - 8E + failureThreshold: -1052479375 + grpc: + port: 82058135 + service: S3UA2HwQaN + httpGet: + host: T0 + path: wYV6 + port: cEf + scheme: 斡1{嘫b葎剜屙唯皎図Ǜ錮ơxȒt駦Ƨ + initialDelaySeconds: -1976610733 + periodSeconds: 436460884 + successThreshold: -949159248 + terminationGracePeriodSeconds: 1786907735670591108 + timeoutSeconds: -2035324376 + name: 0ygO + readinessProbe: + exec: + command: + - "" + - YQ + failureThreshold: 1469514474 + grpc: + port: -1835111333 + service: 5WmTypZfT + httpGet: + host: BDf + path: ZY + port: tyrBXIqhX + scheme: 趬扬鉰昵 + initialDelaySeconds: -683847692 + periodSeconds: -95594828 + successThreshold: -1707399501 + terminationGracePeriodSeconds: 3256417681193515380 + timeoutSeconds: -2088454060 + resources: + limits: + zVX: "0" + restartPolicy: 晄d塮@ʥO%驮ÆgǍô + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ' 吓zǘa畷' + - 鲃ʍ瑘ƴɛjV艑ǔpMK杣Ġ + privileged: true + procMount: zɱÙŭǫäƿ诧聉ń醽Ƥ裩5 + readOnlyRootFilesystem: true + runAsGroup: -2381715627246700598 + runAsNonRoot: false + runAsUser: 6590063474480015904 + startupProbe: + exec: + command: + - "9" + - oRMM2F + - "" + failureThreshold: -1711876939 + grpc: + port: 1138187974 + service: OvdS + httpGet: + host: GZWJ + path: vzJeBCvGMHn7 + port: h9p1Pak + initialDelaySeconds: 447733263 + periodSeconds: 1805541821 + successThreshold: -1114184264 + terminationGracePeriodSeconds: 2730048172651207780 + timeoutSeconds: -1850805595 + terminationMessagePath: GK8 + terminationMessagePolicy: ɾDŽ÷郃ɻ玗璺,4 + volumeDevices: + - devicePath: bLf + name: UVN1o + - devicePath: fIT + name: Qiswb + - devicePath: 9b8i + name: h1 + workingDir: 1IOT +extraEnvFrom: +- configMapRef: + name: GTjM + optional: true + prefix: GSbKp + secretRef: + name: vhsV8Pl5 + optional: true +- configMapRef: + name: cvXs + optional: false + prefix: cBFtb + secretRef: + name: x9N + optional: false +- configMapRef: + name: rDSrOmdL + optional: false + prefix: 0u3 + secretRef: + name: A6PG37zBJfwNR + optional: false +extraVolumeMounts: +- mountPath: De7 + mountPropagation: 1k噟霞ƁĹ + name: 1Z2WnghTc + subPath: Ts5Ful + subPathExpr: YyidD +- mountPath: onM7c3 + mountPropagation: m=Cɬ + name: GC5ZsY07Mr + readOnly: true + subPath: Xt + subPathExpr: r6gZk +- mountPath: 8gPjX7hc + mountPropagation: ƃ柅珚ȭ能 + name: oN + subPath: auYcD + subPathExpr: aheb25w +fullnameOverride: 0BIfuN +image: + pullPolicy: õ鴀铑û + registry: RCYS61Exfql + repository: 8ZLfmymq + tag: 4BSL9iL +imagePullSecrets: +- name: h5x +ingress: + annotations: + q5IN: ehJ3uPo + zL3YTK: "3" + className: aflhQOHWYOXuZ3 + enabled: false + hosts: + - host: obOeJZKpH + - host: u1ac0 + paths: + - path: Riz + pathType: Oa0rGRl + - path: w2xzu + pathType: n2bXr + - path: a68 + pathType: S + tls: + - hosts: + - pgmng + - hosts: + - rxpJYOgPS + secretName: dMa7jxJF +initContainers: + extraInitContainers: N4zG +livenessProbe: + exec: + command: + - "8" + - hRb + - cFB + failureThreshold: -567921134 + grpc: + port: -512457609 + service: F01OY6OLj + httpGet: + host: C04PqGy + path: lMqUJbF + port: 381786117 + scheme: c隢ƖȂ賒Q'd{X旝ĤɪI,k4Ú + initialDelaySeconds: -507660572 + periodSeconds: 1912372611 + successThreshold: -232304560 + terminationGracePeriodSeconds: -4579383330955987300 + timeoutSeconds: 582403024 +nameOverride: 8dJzE +nodeSelector: + ra78: fJ +podAnnotations: + "": cuRn + qBdeU: EQv +podLabels: + O2n4u: kpFpu + g1c: XEOMg +podSecurityContext: + fsGroup: 6449559755791185949 + fsGroupChangePolicy: 慩梱ʂcƎƱ\火ɘ²ɉ_ + runAsGroup: 841256803887707704 + runAsNonRoot: true + runAsUser: -2824253868920734938 + supplementalGroups: + - 8145086042470336086 + - -5005570809576723279 +priorityClassName: JhGfjGXQ +readinessProbe: + exec: {} + failureThreshold: 1010917423 + grpc: + port: 1307350058 + service: TfOG + httpGet: + host: dKWY + path: Qr + port: -837347685 + scheme: C_ + initialDelaySeconds: -986314779 + periodSeconds: 1763110639 + successThreshold: 1473932979 + terminationGracePeriodSeconds: -4633283219964217670 + timeoutSeconds: 1291669389 +replicaCount: 308 +resources: + limits: + x6: "0" + requests: + eeR: "0" + l: "0" + xppI8xB: "0" +secret: + create: true + enterprise: + licenseSecretRef: + key: 6LDJ8t + name: 4n4q72vaO + kafka: + awsMskIamSecretKey: INqD5 + protobufGitBasicAuthPassword: SBJl + saslPassword: 78E + schemaRegistryPassword: YMuFCG7qR + schemaRegistryTlsCa: 1y5yRb6O2b + schemaRegistryTlsCert: NuhkhpMV7b + schemaRegistryTlsKey: 9zcrFj + tlsCa: 0PF + tlsCert: wArD + tlsPassphrase: bj3xqz + login: + github: + clientSecret: jdPGF7 + personalAccessToken: y6xqv + google: + clientSecret: m6FeI + groupsServiceAccount: xi1j27Lipj8 + jwtSecret: pg + oidc: + clientSecret: zbsTootC + okta: + clientSecret: rHSfT + directoryApiToken: rOXaN + redpanda: + adminApi: + password: 8c + tlsCa: CJbHIM + tlsCert: uO + tlsKey: uhB0L +secretMounts: +- defaultMode: 500 + name: 99SgdOsZD + path: AQpWvptFEk7y + secretName: B6Fq +- defaultMode: 337 + name: U + path: p44 + secretName: DddF02 +- defaultMode: 246 + name: WFd + path: UiI + secretName: tz +securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - 趩燡º嗂{踦 + - CƮ + drop: + - 殟kĔ=ņŧɋ] + privileged: false + procMount: aŻ釯fȠ埱ɺȚ + readOnlyRootFilesystem: true + runAsGroup: 4284419790643993066 + runAsNonRoot: true + runAsUser: -4828746969388386674 +service: + annotations: + L: CP + Yf: K4waOjMg + tIYLLgy: d1szIPW6xt + nodePort: 291 + port: 269 + targetPort: 479 + type: IfYfRoHRG +serviceAccount: + annotations: + 5bpPp: ponDVyZ + Ml1: "" + lt: 6VN8BRlJd + automountServiceAccountToken: true + create: true + name: z12W +strategy: + rollingUpdate: {} + type: 擺m鷾DžPĨ +tests: + enabled: true +tolerations: +- key: ka + tolerationSeconds: 2857628758439265098 + value: Ohni9QGx +topologySpreadConstraints: +- labelSelector: + matchLabels: + 3Ym: o2h5aVp + yR4PPZO: 3X + matchLabelKeys: + - vCKujB + - UqCFKCN + - Xnjfai + maxSkew: -943395897 + minDomains: 1955399000 + nodeAffinityPolicy: 噙撢馥櫱m>Q脕擏w梪 + nodeTaintsPolicy: 蝚溄鑝刉=歱Mr踄 + topologyKey: cHyq + whenUnsatisfiable: Q輒ƗȈʑǯƐ| +- labelSelector: + matchLabels: + E: lyK5b9t + UuSjduy: NcK4 + fty: iP6ai + maxSkew: 1881677866 + minDomains: -561571142 + nodeAffinityPolicy: ȫ寴ī嘌.樥'ǹs + nodeTaintsPolicy: ɇ剀ǨUǜ!俛dz餂~匹呃 + topologyKey: pCHj + whenUnsatisfiable: 尘I:Ƒ匌,騸 diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/testdata/template-cases.golden.txtar b/charts/redpanda/redpanda/5.9.7/charts/console/testdata/template-cases.golden.txtar new file mode 100644 index 000000000..cf65330d4 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/testdata/template-cases.golden.txtar @@ -0,0 +1,24705 @@ +-- testdata/autoscaling-cpu.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + replicas: null + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: 4f717eb67ef3f4c7e8737af0264bfe0922c76494c9ee31f7f52c63a13b02de86 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console + name: configs + - name: secrets + secret: + secretName: console +--- +# Source: console/templates/hpa.yaml +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +spec: + maxReplicas: 100 + metrics: + - resource: + name: cpu + target: + averageUtilization: 80 + type: Utilization + type: Resource + - resource: + name: memory + target: + averageUtilization: 10 + type: Utilization + type: Resource + minReplicas: 1 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: console +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console:8080'] + restartPolicy: Never + priorityClassName: +-- testdata/autoscaling-memory.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + replicas: null + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: 4f717eb67ef3f4c7e8737af0264bfe0922c76494c9ee31f7f52c63a13b02de86 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console + name: configs + - name: secrets + secret: + secretName: console +--- +# Source: console/templates/hpa.yaml +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +spec: + maxReplicas: 100 + metrics: + - resource: + name: cpu + target: + averageUtilization: 14 + type: Utilization + type: Resource + minReplicas: 1 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: console +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console:8080'] + restartPolicy: Never + priorityClassName: +-- testdata/autoscaling-nulls.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + replicas: null + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: 4f717eb67ef3f4c7e8737af0264bfe0922c76494c9ee31f7f52c63a13b02de86 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console + name: configs + - name: secrets + secret: + secretName: console +--- +# Source: console/templates/hpa.yaml +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +spec: + maxReplicas: 100 + metrics: + - resource: + name: cpu + target: + averageUtilization: 80 + type: Utilization + type: Resource + minReplicas: 1 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: console +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console:8080'] + restartPolicy: Never + priorityClassName: +-- testdata/case-000.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: false +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + "": 31q1Pbz + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: "n" + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: HRoLg + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + "": 31q1Pbz + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: "n" + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: hvGoJL +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + "": 31q1Pbz + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: "n" + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: hvGoJL +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + "": 31q1Pbz + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: "n" + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: hvGoJL + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: "n" + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + Q9AVJD4: G9TEnp + creationTimestamp: null + labels: + "": 31q1Pbz + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: "n" + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: hvGoJL + namespace: default +spec: + replicas: 387 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: "n" + strategy: + type: Ò泆A + template: + metadata: + annotations: + checksum/config: a2b60d22337ad49c09f2108d08f05fc6590bc4b45c804adc901467f348d564e1 + lyW: mn + pjq6fDr: YA2w301 + uXvFB: VQ5gP9 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: "n" + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: Z2BpO + value: 0ggF3ha7D + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: hvGoJL + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 1028486626 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 1713123405 + periodSeconds: -1411200119 + successThreshold: -1362510905 + timeoutSeconds: 1375594715 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: + limits: + x0StjCjt: "0" + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: vQhDS + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: HRoLg + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: hvGoJL + name: configs + - name: secrets + secret: + secretName: hvGoJL + - name: 7iCCax + - name: meEH + - name: xYVSV +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "hvGoJL-test-connection" + namespace: "default" + labels: + "": 31q1Pbz + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: "n" + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['hvGoJL:8080'] + restartPolicy: Never + priorityClassName: vQhDS +-- testdata/case-001.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Sh + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: T50cZi + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Sh + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: T50cZi +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Sh + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: T50cZi +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Sh + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: T50cZi + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: Sh + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Sh + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: T50cZi + namespace: default +spec: + replicas: 414 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: Sh + strategy: {} + template: + metadata: + annotations: + checksum/config: 6eb5d8456a652d5006051c8425191238a1a7d39e93a9336b0cc8ca98963c2dbd + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: Sh + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: 3Nf + value: vATdo0CH + valueFrom: + configMapKeyRef: + key: IRw5 + name: fa + fieldRef: + apiVersion: 93Fjhay + fieldPath: LRa2I + - name: T0 + value: trXO4 + - name: P9hPooVH + value: yii5lolb + valueFrom: + configMapKeyRef: + key: spAKa + name: U0EYAAe0 + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: T50cZi + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - image: LlCU3if + imagePullPolicy: RɷVȄ×ʤǫĠ侻Ɏźx跻Å榜 + lifecycle: {} + name: l0 + resources: {} + securityContext: + allowPrivilegeEscalation: true + privileged: true + startupProbe: + exec: {} + failureThreshold: -1510490758 + initialDelaySeconds: 112782468 + periodSeconds: -738545847 + successThreshold: -1801864225 + timeoutSeconds: 1026753125 + terminationMessagePath: gCG + terminationMessagePolicy: hmƂÚÕʏ疅耪鯉瓉Ɏ煐8qĺ + tty: true + workingDir: ixD7Jq + imagePullSecrets: [] + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: {} + priorityClassName: NyOpfr + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: T50cZi + tolerations: + - effect: Mǣ鍙x奬Ø裗Ʈ唿踣ʘ)ɒâÄ + key: AWx + operator: yīÄLJʑʢ避 + value: cO + - effect: ï楡ɜƐf鱖À夹ǙȤK + key: Gk23T + operator: è6槈$_ȋ6}rvĕ曉¸顋ŀÓ + value: DCkzy + - effect: 蠯u牰ŇɔnÜȎĤ原H + key: qSC + operator: "n" + tolerationSeconds: -7696192156323826000 + value: z + topologySpreadConstraints: [] + volumes: + - configMap: + name: T50cZi + name: configs + - name: secrets + secret: + secretName: T50cZi +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "T50cZi-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Sh + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['T50cZi:8080'] + restartPolicy: Never + priorityClassName: NyOpfr +-- testdata/case-002.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: vN4yH7I + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: R1Yar8 + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: vN4yH7I + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: xZty +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: vN4yH7I + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: xZty +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: vN4yH7I + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: xZty + namespace: default +spec: + ports: + - name: http + port: 413 + protocol: TCP + targetPort: 267 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: vN4yH7I + type: ILpSX2Cy +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: vN4yH7I + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: xZty + namespace: default +spec: + replicas: 417 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: vN4yH7I + strategy: {} + template: + metadata: + annotations: + 8vRMfVroYC2: QXbUbLea + VV4w: s4sL + checksum/config: 69703ab54946efe744831224dacdb980663f666d8fa5be794fb800135f91d11f + upwTMuIqflmD: 9J0H45zXX + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: vN4yH7I + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: xZty + envFrom: + - prefix: cfVf + secretRef: + name: ha + - prefix: i2E2Jvnc + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 267 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: + limits: + 27ywV: "0" + nMnjjF4kM: "0" + xar2JX: "0" + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - mountPath: Y40 + mountPropagation: $寕洦敬苖ēRõøȀ + name: vn5hd + readOnly: true + subPath: oXCY9 + subPathExpr: p + imagePullSecrets: + - {} + - name: YPVBzxvx + initContainers: [] + nodeSelector: {} + priorityClassName: TeCy + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: R1Yar8 + tolerations: + - effect: ǩ趥螏|F8ǻĬ嵍Ğ错ʂĺƠǷ俆峻噸 + key: b + operator: wąȹV{İ刡嚮ȜJ + value: ZuTw + - effect: D稕栥[Ǟ$焫昲 + key: NnhmxYy + operator: Xʀ + value: v65W + - effect: 岂bĤ晏#DĢº + key: MOgT + operator: 礩懜蹻ǍBȟvɸ堊 + value: 3iXh + topologySpreadConstraints: [] + volumes: + - configMap: + name: xZty + name: configs + - name: secrets + secret: + secretName: xZty +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "xZty-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: vN4yH7I + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - {} + - name: YPVBzxvx + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['xZty:413'] + restartPolicy: Never + priorityClassName: TeCy +-- testdata/case-003.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: w6 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 8nE + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: w6 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 8nE +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: Fb + kafka-sasl-aws-msk-iam-secret-key: SrYY84t + kafka-sasl-password: xCc3TeVY + kafka-schema-registry-password: ovCqxwz9Bf + kafka-schemaregistry-tls-ca: JL + kafka-schemaregistry-tls-cert: cS + kafka-schemaregistry-tls-key: UMwYx4F + kafka-tls-ca: HFpsnPdw + kafka-tls-cert: hseIt + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: w6 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 8nE + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: w6 + type: ClusterIP +--- +# Source: console/templates/ingress.yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: w6 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 8nE +spec: + ingressClassName: EqUYi + rules: + - host: bKQCmfZ + http: + paths: null + - host: djItx5GtejC6 + http: + paths: null + - host: 2wLaQU8 + http: + paths: null + tls: + - hosts: + - V8BpuMCig + - 7LqG4w92 + - el3u4v + secretName: nUlu5bMwB8 + - hosts: + - 4HLzq + - 2i4g + secretName: lSgQIKwj5 +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "8nE-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: w6 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['8nE:8080'] + restartPolicy: Never + priorityClassName: HNqN9h2 +-- testdata/case-004.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + "": PtQ7JxIAdPjt + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: YMl + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console-YMl + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + "": PtQ7JxIAdPjt + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: YMl + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console-YMl +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + "": PtQ7JxIAdPjt + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: YMl + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console-YMl +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + "": PtQ7JxIAdPjt + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: YMl + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console-YMl + namespace: default +spec: + ports: + - name: http + port: 112 + protocol: TCP + targetPort: 173 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: YMl + type: dO7eovC +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + "": PtQ7JxIAdPjt + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: YMl + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console-YMl + namespace: default +spec: + replicas: 261 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: YMl + strategy: + type: ɡv?ĨJ姯ɚƟć匪cb + template: + metadata: + annotations: + 1iK8Ic: Qo3FCg9qi + 63SsVxDT: v + A1Q4J4: U9jygY2t1F + checksum/config: 5f83295c905c2d3c9fea06172a38428a89334248aea9df0ebd8b589a29afeb4f + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: YMl + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: {} + weight: -1713447377 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: null + podAntiAffinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console-YMl + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 173 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - mountPath: Oj + name: QmzFlXE + subPath: "" + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: JT0MK + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console-YMl + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console-YMl + name: configs + - name: secrets + secret: + secretName: console-YMl + - name: QmzFlXE + secret: + defaultMode: 197 + secretName: 7gi +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-YMl-test-connection" + namespace: "default" + labels: + "": PtQ7JxIAdPjt + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: YMl + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console-YMl:112'] + restartPolicy: Never + priorityClassName: JT0MK +-- testdata/case-005.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: MW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: pN + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: MW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: pN +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: R4Zj + login-github-personal-access-token: N85av + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: enei1WIcV + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: MW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: pN + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: MW + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: MW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: pN + namespace: default +spec: + replicas: 396 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: MW + strategy: {} + template: + metadata: + annotations: + checksum/config: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: MW + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: pN + - name: LOGIN_GITHUB_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-github-oauth-client-secret + name: pN + - name: LOGIN_GITHUB_DIRECTORY_PERSONALACCESSTOKEN + valueFrom: + secretKeyRef: + key: login-github-personal-access-token + name: pN + - name: LOGIN_OIDC_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-oidc-client-secret + name: pN + envFrom: [] + image: 7iw15D/RnJFs0:OQDirE + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: -1921365096 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -1548958176 + periodSeconds: -1952555242 + successThreshold: -1289242499 + timeoutSeconds: -265051013 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - mountPath: JU4z + name: QEJyD + subPath: ZBEy2m0m + subPathExpr: S1Kk + - mountPath: RjUw5sX7NP + name: ett1n + subPath: NmZKwz + subPathExpr: QOMT + imagePullSecrets: + - name: ATcT6Hd + - name: l15Hhw + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: {} + priorityClassName: KnLhcy2cw + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: pN + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: pN + name: configs + - name: secrets + secret: + secretName: pN +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "pN-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: MW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - name: ATcT6Hd + - name: l15Hhw + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['pN:8080'] + restartPolicy: Never + priorityClassName: KnLhcy2cw +-- testdata/case-006.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: false +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: gCH15URsJZr + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: nd7TSb2mNTS + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: gCH15URsJZr + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: rzd +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: G + kafka-sasl-aws-msk-iam-secret-key: 1tq + kafka-sasl-password: K8kPgIp6 + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: Zr + kafka-schemaregistry-tls-cert: KN + kafka-schemaregistry-tls-key: t + kafka-tls-ca: CQ + kafka-tls-cert: 6xZ8 + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: gCH15URsJZr + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: rzd +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: gCH15URsJZr + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: rzd + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: gCH15URsJZr + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: gCH15URsJZr + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: rzd + namespace: default +spec: + replicas: 176 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: gCH15URsJZr + strategy: {} + template: + metadata: + annotations: + checksum/config: f55f3fdc49a4774db4d2377ea9b69fd8da2a190ef99f7fb31aeb393215f878cc + s2D: DMU7 + creationTimestamp: null + labels: + CoBI: 20aOZaZvs + app.kubernetes.io/instance: console + app.kubernetes.io/name: gCH15URsJZr + e0xqmoOD: Nb5V + ylGQE: p + spec: + affinity: + podAffinity: {} + podAntiAffinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: KAFKA_SASL_PASSWORD + valueFrom: + secretKeyRef: + key: kafka-sasl-password + name: rzd + - name: KAFKA_PROTOBUF_GIT_BASICAUTH_PASSWORD + valueFrom: + secretKeyRef: + key: kafka-protobuf-git-basicauth-password + name: rzd + - name: KAFKA_SASL_AWSMSKIAM_SECRETKEY + valueFrom: + secretKeyRef: + key: kafka-sasl-aws-msk-iam-secret-key + name: rzd + - name: KAFKA_TLS_CAFILEPATH + value: /etc/console/secrets/kafka-tls-ca + - name: KAFKA_TLS_CERTFILEPATH + value: /etc/console/secrets/kafka-tls-cert + - name: KAFKA_SCHEMAREGISTRY_TLS_CAFILEPATH + value: /etc/console/secrets/kafka-schemaregistry-tls-ca + - name: KAFKA_SCHEMAREGISTRY_TLS_CERTFILEPATH + value: /etc/console/secrets/kafka-schemaregistry-tls-cert + - name: KAFKA_SCHEMAREGISTRY_TLS_KEYFILEPATH + value: /etc/console/secrets/kafka-schemaregistry-tls-key + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: rzd + envFrom: [] + image: zT38Q/V:iSGm6MT1 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: + requests: + PY: "0" + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - mountPath: 5uhd1qMX + mountPropagation: ȵS鈛ZQì暗 + name: "N" + readOnly: true + subPath: lbeciOZZ + subPathExpr: Pd88cwE + - mountPath: yVo + mountPropagation: ÑƇ[嫨ĸŁ幵鿯它(ȡ~嘶ƌO情=į臺 + name: Z + readOnly: true + subPath: Nrqx + subPathExpr: Q4ChfT + imagePullSecrets: [] + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: {} + priorityClassName: 1x11c0q + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: nd7TSb2mNTS + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: rzd + name: configs + - name: secrets + secret: + secretName: rzd +-- testdata/case-007.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: false +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: HWL + app.kubernetes.io/version: v2.7.0 + cV05TKdtF: 55lItpeJD + h: 1Y7dqm4wZL + helm.sh/chart: console-0.7.29 + name: RFjc7 + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: HWL + app.kubernetes.io/version: v2.7.0 + cV05TKdtF: 55lItpeJD + h: 1Y7dqm4wZL + helm.sh/chart: console-0.7.29 + name: "y" +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: gp + login-google-oauth-client-secret: Ln0 + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: 3A593BjCuu + login-okta-directory-api-token: mSSz8MZ + redpanda-admin-api-password: t + redpanda-admin-api-tls-ca: QD1x71f + redpanda-admin-api-tls-cert: 744Ysvi + redpanda-admin-api-tls-key: 56VaHh +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + role-bindings.yaml: |- + roleBindings: + - "": null + 5w1YcAu: null +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: HWL + app.kubernetes.io/version: v2.7.0 + cV05TKdtF: 55lItpeJD + h: 1Y7dqm4wZL + helm.sh/chart: console-0.7.29 + name: "y" +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: HWL + app.kubernetes.io/version: v2.7.0 + cV05TKdtF: 55lItpeJD + h: 1Y7dqm4wZL + helm.sh/chart: console-0.7.29 + name: "y" + namespace: default +spec: + ports: + - name: http + port: 286 + protocol: TCP + targetPort: 404 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: HWL + type: Vvrvx +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: HWL + app.kubernetes.io/version: v2.7.0 + cV05TKdtF: 55lItpeJD + h: 1Y7dqm4wZL + helm.sh/chart: console-0.7.29 + name: "y" + namespace: default +spec: + replicas: 103 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: HWL + strategy: {} + template: + metadata: + annotations: + checksum/config: 37ddb9195e66f6743cc901bea8e2e2db0492fbf3e78355ffe8c7f2395ece1e90 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: HWL + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: qY0f + value: Wu + - name: 9zVp + value: g + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: "y" + - name: LOGIN_GOOGLE_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-google-oauth-client-secret + name: "y" + - name: LOGIN_GOOGLE_DIRECTORY_SERVICEACCOUNTFILEPATH + value: /etc/console/secrets/login-google-groups-service-account.json + - name: LOGIN_OKTA_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-okta-client-secret + name: "y" + - name: LOGIN_OKTA_DIRECTORY_APITOKEN + valueFrom: + secretKeyRef: + key: login-okta-directory-api-token + name: "y" + - name: REDPANDA_ADMINAPI_PASSWORD + valueFrom: + secretKeyRef: + key: redpanda-admin-api-password + name: "y" + - name: REDPANDA_ADMINAPI_TLS_CAFILEPATH + value: /etc/console/secrets/redpanda-admin-api-tls-ca + - name: REDPANDA_ADMINAPI_TLS_KEYFILEPATH + value: /etc/console/secrets/redpanda-admin-api-tls-key + - name: REDPANDA_ADMINAPI_TLS_CERTFILEPATH + value: /etc/console/secrets/redpanda-admin-api-tls-cert + envFrom: + - configMapRef: + name: OUS + optional: true + prefix: YWvtgT + - configMapRef: + name: 4xZZ + prefix: Djbp99U + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 1105213631 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -1727299217 + periodSeconds: -579129147 + successThreshold: -1278687101 + timeoutSeconds: -603846855 + name: console + ports: + - containerPort: 404 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 114758306 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 457836757 + periodSeconds: -1914503008 + successThreshold: 1926018786 + timeoutSeconds: 458769630 + resources: + requests: + 4P1f3: "0" + DmuY: "0" + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: + CAy: 19kW + R2z: OpcDywz9x + priorityClassName: rs + securityContext: + fsGroup: 99 + fsGroupChangePolicy: 驸Ǩiµ慷泱世 + runAsGroup: 6873387834465682000 + runAsUser: 7937848737866681000 + sysctls: + - name: mp + value: SkIvFN + - name: E + value: RknyuPB + - name: kcY + value: us1 + serviceAccountName: RFjc7 + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: "y" + name: configs + - name: secrets + secret: + secretName: "y" + - name: dCz +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "y-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: HWL + app.kubernetes.io/version: v2.7.0 + cV05TKdtF: 55lItpeJD + h: 1Y7dqm4wZL + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['y:286'] + restartPolicy: Never + priorityClassName: rs +-- testdata/case-008.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: RW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: YcV5zP8 + namespace: default +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: RW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: GbgHqD +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: RW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: GbgHqD + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: RW + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + hfXF: v4uLEC6f8m + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: RW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: GbgHqD + namespace: default +spec: + replicas: 475 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: RW + strategy: + rollingUpdate: {} + type: 堯飉J侚桤 合w犌ŝ|#è:(蹝Ƀy輐 + template: + metadata: + annotations: + BTlN: z8t + a: Pqjhw + checksum/config: 1ba99bb938e262d91c73069e0caf6c1ce45d5e92491a50db9d1af5d59db59aed + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: RW + spec: + affinity: {} + automountServiceAccountToken: false + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: [] + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 1421249778 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 1194618095 + periodSeconds: 1245060237 + successThreshold: -641096828 + timeoutSeconds: -617099936 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: -10750427 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 208988771 + periodSeconds: -2096658971 + successThreshold: -233405863 + timeoutSeconds: 2042765580 + resources: {} + securityContext: + procMount: ȃ蘗ʮǺ踰蒐佛桸gɋ + readOnlyRootFilesystem: false + runAsGroup: 5367218369967094000 + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: 0fXQqWA96 + securityContext: + fsGroup: 99 + fsGroupChangePolicy: ǶȚ/廻 + runAsGroup: 3241750191956122000 + runAsNonRoot: false + runAsUser: 2693812519144067600 + supplementalGroups: + - -7558357415363805000 + - -9152494874115652000 + - -906805565867492900 + sysctls: + - name: CBe8XsS + value: bh + - name: pUYyG9c + value: xPm1 + serviceAccountName: YcV5zP8 + tolerations: [] + topologySpreadConstraints: + - maxSkew: -722842418 + nodeTaintsPolicy: uã链掎ŏȅ噘籥邟澶N3-昃嗽(七|犘 + topologyKey: vq + whenUnsatisfiable: Ȭť'Ùt苷ŲĤ蘝 + - labelSelector: {} + maxSkew: 1436245353 + nodeAffinityPolicy: 0ʠƃ氁ʆZ + topologyKey: t + whenUnsatisfiable: x叾džʜƽ耨 + - labelSelector: {} + matchLabelKeys: + - 6T2 + - FqrwFd + maxSkew: -172720268 + nodeAffinityPolicy: 觏败TʙȎ喧5婬ȑªgȢ'!ÅWp襎 + nodeTaintsPolicy: ÛB¹]ʐ梳Ě + topologyKey: VyU9 + whenUnsatisfiable: 烹wɹȐN坿¨叻ʊ鴥/Ŭ屎釽C欼 + volumes: + - configMap: + name: GbgHqD + name: configs +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "GbgHqD-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: RW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['GbgHqD:8080'] + restartPolicy: Never + priorityClassName: 0fXQqWA96 +-- testdata/case-009.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: BKV + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: l1Bnpx + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: BKV + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: l1Bnpx +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: + efgehQaV5UI0y: GymqDudh + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: BKV + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: l1Bnpx + namespace: default +spec: + ports: + - name: http + port: 229 + protocol: TCP + targetPort: 85 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: BKV + type: yZy +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: BKV + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: l1Bnpx + namespace: default +spec: + replicas: 315 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: BKV + strategy: {} + template: + metadata: + annotations: + checksum/config: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: BKV + spec: + affinity: + nodeAffinity: {} + podAffinity: {} + podAntiAffinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: l1Bnpx + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: -1420734522 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 753838163 + periodSeconds: -444344576 + successThreshold: -1003403229 + timeoutSeconds: -172453343 + name: console + ports: + - containerPort: 85 + name: http + protocol: TCP + readinessProbe: + failureThreshold: -286281002 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 138566964 + periodSeconds: -361700659 + successThreshold: 422528479 + timeoutSeconds: 352721839 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - mountPath: xShE + name: yWBr98zs1 + subPath: "" + - mountPath: Wnbf + name: qUQ5 + subPath: "" + - mountPath: fgV + name: hpqapQJQ + subPath: "" + imagePullSecrets: + - name: x42RbB4KLm + initContainers: [] + nodeSelector: + OBRBvRK: hMXDLGN5 + ky: sv + priorityClassName: p0ShP6Yru + securityContext: + fsGroup: 99 + fsGroupChangePolicy: 灆Zeɪ霅ǭɒ<ǖ韆 + runAsGroup: -2394155475284911600 + runAsNonRoot: true + runAsUser: 99 + supplementalGroups: + - 802667379359895800 + - 8316082600801372000 + serviceAccountName: l1Bnpx + tolerations: [] + topologySpreadConstraints: + - maxSkew: -73453467 + minDomains: 326628755 + nodeAffinityPolicy: "" + topologyKey: zWgGRC + whenUnsatisfiable: 黚堳ʈ¡ + volumes: + - configMap: + name: l1Bnpx + name: configs + - name: secrets + secret: + secretName: l1Bnpx + - name: yWBr98zs1 + secret: + defaultMode: 414 + secretName: YMpib3J + - name: qUQ5 + secret: + defaultMode: 402 + secretName: Pw8 + - name: hpqapQJQ + secret: + defaultMode: 410 + secretName: 1JLIOjZI8 +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "l1Bnpx-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: BKV + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - name: x42RbB4KLm + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['l1Bnpx:229'] + restartPolicy: Never + priorityClassName: p0ShP6Yru +-- testdata/case-010.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: + TTsn5: s3xEhO + tZiUN: CtjX + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: JFcK + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: kIzbDF + namespace: default +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: JFcK + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: ivK + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: JFcK + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: JFcK + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: ivK + namespace: default +spec: + replicas: 250 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: JFcK + strategy: {} + template: + metadata: + annotations: + checksum/config: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: JFcK + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: hu5a9Q0m + operator: Ʊ飁Ɲŗʫf + values: + - fDVpOP + - fUBu2Zhz + matchFields: + - key: zOA + operator: 豔|Ĺ霱鑕yȮM錕陰蔆 + - key: uqlr1 + operator: ʏ + weight: -157546286 + - preference: + matchExpressions: + - key: yI2tB1c6Om + operator: 槼湝@)萢=\Ɇ剋Ś>(.aC俥?蔔 + values: + - 5QB3 + - C + - key: IhL2k3 + operator: "" + matchFields: + - key: Kn1 + operator: q'ʏC効L¶ƋMʐģƥƝnĤe + weight: -1818860211 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - {} + podAffinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LICENSE + valueFrom: + secretKeyRef: + key: 6Y + name: juyv + envFrom: [] + image: 4A/0YeLdES:1a4iH + imagePullPolicy: "" + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 1992527736 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 1233698472 + periodSeconds: 1177961840 + successThreshold: -1634725396 + timeoutSeconds: -1493252430 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: C3nMA + name: 0sxSVsP + readOnly: true + subPath: V + subPathExpr: 1E5cYdMw + - env: + - name: nE8 + value: hFfGzdv + valueFrom: + configMapKeyRef: + key: 9Sc + name: kviW + fieldRef: + fieldPath: bzL + resourceFieldRef: + containerName: ky9X6 + divisor: "0" + resource: RgwF + image: mEMnGhDi + imagePullPolicy: <Ǐ(嬘箓閁1_Y.脯鮉娇腾1 + name: ZyDivTyKOX + readinessProbe: + failureThreshold: 368214623 + initialDelaySeconds: 1711545214 + periodSeconds: -1669571514 + successThreshold: 830602444 + timeoutSeconds: -1406663042 + resources: + requests: + Ta: "0" + restartPolicy: M#L粓Ojw+ĸɊcƗ镃聆琮ǘ滂W + stdin: true + terminationMessagePath: 7hyobl + terminationMessagePolicy: gŜĶ蔓林驲%嶄ʚ轿竷 + volumeDevices: + - devicePath: zlgauG + name: Uy7Ds5N + - devicePath: pturCrgNMxS + name: "1" + volumeMounts: + - mountPath: 2ftw3U97pI + mountPropagation: ǮmW + name: NeLq9zvIQ + subPath: 5XYnpNAb + subPathExpr: rAeHuQk + - mountPath: aOj5TCBKn + name: DWFR + subPath: G + - mountPath: ovoJMYcQZ7 + mountPropagation: ɷ&娈瘱 + name: o6QaPD8 + subPath: rIo + subPathExpr: j0F1wa + workingDir: tj + - env: + - name: KO7zek + value: AE8r + valueFrom: {} + envFrom: + - prefix: T4nvtH0yCoJCx + - prefix: KaMGNcK + image: m + imagePullPolicy: 牀 + lifecycle: + preStop: + exec: {} + sleep: + seconds: -1229802121654850600 + livenessProbe: + failureThreshold: 1036399450 + grpc: + port: 1383801223 + service: nm0jd39Ta + httpGet: + host: VhafGy + path: CP9 + port: BnhNd + scheme: hxu崚奵Y + initialDelaySeconds: 141265356 + periodSeconds: 251484282 + successThreshold: 257415096 + terminationGracePeriodSeconds: 3476093234934520000 + timeoutSeconds: -1657896181 + name: UCZJ + ports: + - containerPort: 574867450 + hostPort: 156179933 + name: 0re + protocol: 頶韜»釟ţKFƂƄp錴畗~[禬B琡9 + - containerPort: -374880824 + hostPort: 1342282100 + name: OeyfSkg3EJIuD + protocol: 佃ŦŬ穷唂&2ŌĜ,gF躊貀j寝ô + readinessProbe: + failureThreshold: 978947885 + httpGet: + host: A + path: Ngfyt + port: "" + scheme: Í蠕窩獙 + initialDelaySeconds: 60101484 + periodSeconds: 1102760384 + successThreshold: 1260060937 + terminationGracePeriodSeconds: 1157546254675437000 + timeoutSeconds: -465800822 + resizePolicy: + - resourceName: P6b56 + restartPolicy: 冿÷Ý萦{[P貍ȕ,Sɕ錼 + - resourceName: azLsfqbuYlr + restartPolicy: 蒃Ký阹ǒ1T獽蛍峸伦ƨ(Ƭ-央á + - resourceName: skOpL + restartPolicy: 鸿dŶ徥w^ȏ嘳Ƙ唓Ęɸ-ɫ鷠C + resources: {} + terminationMessagePath: vmp + terminationMessagePolicy: Ƒh庛ʘ$8L藑奾ń4說 + workingDir: rgrA + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: x0ISc2 + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: kIzbDF + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: ivK + name: configs +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "ivK-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: JFcK + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['ivK:8080'] + restartPolicy: Never + priorityClassName: x0ISc2 +-- testdata/case-011.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + JwK5MKTa: WW + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Cy9eHCiP + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + v7E: 1g6JB + name: hbe + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + JwK5MKTa: WW + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Cy9eHCiP + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + v7E: 1g6JB + name: hbe +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + JwK5MKTa: WW + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Cy9eHCiP + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + v7E: 1g6JB + name: hbe +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: + "": NbuyvXjW + 2CTz: vRGLHMO53rD + yLzpKqz: uBjXvD + creationTimestamp: null + labels: + JwK5MKTa: WW + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Cy9eHCiP + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + v7E: 1g6JB + name: hbe + namespace: default +spec: + ports: + - name: http + port: 478 + protocol: TCP + targetPort: 90 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: Cy9eHCiP + type: sl +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + pJ: f0brcnhV + creationTimestamp: null + labels: + JwK5MKTa: WW + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Cy9eHCiP + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + v7E: 1g6JB + name: hbe + namespace: default +spec: + replicas: 65 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: Cy9eHCiP + strategy: {} + template: + metadata: + annotations: + checksum/config: 0ebeace369c9c96d75109609694bd464d6c28c2e8d1fcbd96529ef96d4ba0ec5 + creationTimestamp: null + labels: + "2": RgUAFm + D2V: V80aQ + app.kubernetes.io/instance: console + app.kubernetes.io/name: Cy9eHCiP + spec: + affinity: + podAffinity: {} + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: {} + matchLabelKeys: + - E9nCu6aLM + topologyKey: PfPCGvStt + weight: -1379963896 + - podAffinityTerm: + namespaceSelector: {} + topologyKey: CgA4 + weight: -726546395 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: ijh1hJb + operator: ƏŧD續筚朊 + values: + - BOfF5xB + - 3iu4 + - key: "93" + operator: Dij%{欬ɽ + - key: NEd + operator: ÿD + values: + - r + - B7E1BoYQ4Njb + - BTV + matchLabelKeys: + - FuyLvc + - Lh60qi + namespaceSelector: + matchExpressions: + - key: w + operator: 嘑 + - key: eQ6nY99xw + operator: H辄萟蘎Ÿ塪²;暃 + - key: 8JrCFA + operator: "" + values: + - wVO + topologyKey: ByO + - namespaceSelector: {} + topologyKey: b21 + - namespaces: + - Ifv + topologyKey: F9j5 + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: XW + value: PCPsJt + valueFrom: + configMapKeyRef: + key: Zk0vTu6kC + name: d9zm3 + optional: false + secretKeyRef: + key: mRF + name: CW + optional: false + - name: loir2K + value: Ti0q + - name: lAxIKF7cbLlc + value: 1ksS + valueFrom: + fieldRef: + apiVersion: 8i2Z + fieldPath: vD7H + resourceFieldRef: + containerName: yqY + divisor: "0" + resource: ebRDAl + secretKeyRef: + key: E9514U + name: g3Rbzs + optional: false + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: hbe + envFrom: + - configMapRef: + name: d + prefix: Fl1 + secretRef: + name: X8xDu + optional: true + - prefix: M + secretRef: + name: 10or1C2m + optional: false + - configMapRef: + name: BBj + optional: false + prefix: Xy + secretRef: + name: ZA3 + image: gjR/U:Tl0EP + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 653767212 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 832425522 + periodSeconds: -1810991482 + successThreshold: 1954581711 + timeoutSeconds: -574178850 + name: console + ports: + - containerPort: 90 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 1745353710 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 1504484890 + periodSeconds: -846859037 + successThreshold: -1564014824 + timeoutSeconds: 888372342 + resources: + requests: + "Y": "0" + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - mountPath: 2Qy8k + name: n4BPeF + subPath: "" + - mountPath: O + mountPropagation: ŜQLhlkU穒´宕Ïůŝƪ + name: JeSPIB + readOnly: true + subPath: RTiJ + subPathExpr: wad + - mountPath: QV6Kf + name: Pj7R + subPath: qBOd + subPathExpr: kN3Uujt + imagePullSecrets: [] + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: + HC7: EI8 + priorityClassName: sJXoA3V + securityContext: + fsGroup: 4103142176308445000 + fsGroupChangePolicy: Ő6­撱悤ÅC`碸 + runAsUser: 9170579519391071000 + sysctls: + - name: 4OKA + value: P7ouRq + - name: iD9Oz + value: gL6ARE + serviceAccountName: hbe + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: hbe + name: configs + - name: secrets + secret: + secretName: hbe + - name: n4BPeF + secret: + defaultMode: 12 + secretName: auIr +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "hbe-test-connection" + namespace: "default" + labels: + JwK5MKTa: WW + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Cy9eHCiP + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + v7E: 1g6JB + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['hbe:478'] + restartPolicy: Never + priorityClassName: sJXoA3V +-- testdata/case-012.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Qr03ts + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: tmn2Kt + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Qr03ts + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: tmn2Kt +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Qr03ts + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: tmn2Kt +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Qr03ts + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: tmn2Kt + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: Qr03ts + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + v: D + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Qr03ts + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: tmn2Kt + namespace: default +spec: + replicas: 407 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: Qr03ts + strategy: + rollingUpdate: {} + type: 9Cɠ+餌µ骽O惠LƬɇɦ鉍挶 + template: + metadata: + annotations: + checksum/config: f03a44f92485e3dfb6772dc84dec7c868a151f08fa5c04332bebe63251290ce5 + creationTimestamp: null + labels: + "": S7BNyT + app.kubernetes.io/instance: console + app.kubernetes.io/name: Qr03ts + r1F: Fsc + yeY4LjT: MRlwtd + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: tmn2Kt + envFrom: + - prefix: RyT9JuZ + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 666524470 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 1841184951 + periodSeconds: 465079780 + successThreshold: -1928046688 + timeoutSeconds: 1377323766 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + allowPrivilegeEscalation: false + privileged: true + readOnlyRootFilesystem: false + runAsGroup: -6536894786619940000 + runAsNonRoot: false + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - command: + - "" + - 7yJE + envFrom: + - prefix: kRXk + secretRef: + name: TJsCapqoxl + - prefix: ucUEP + secretRef: + name: 1zCfpPiVt9o + optional: true + image: hwJ + imagePullPolicy: dh + name: Ody4zqt + readinessProbe: + exec: {} + failureThreshold: 1607990521 + grpc: + port: 2033135747 + service: "" + initialDelaySeconds: -889776869 + periodSeconds: -35190825 + successThreshold: -958310065 + terminationGracePeriodSeconds: 3166888730011246600 + timeoutSeconds: 806015074 + resources: + requests: + mg2KyOVo97: "0" + restartPolicy: 档媘řĖ焘傐Yʮ,+Ƽ梽讫ƭ焇 + securityContext: + readOnlyRootFilesystem: true + runAsGroup: -2035296945120192500 + stdinOnce: true + terminationMessagePolicy: '*.Q' + workingDir: 0g9 + - command: + - ktel2 + - 2gO + image: Kq1K2HexLL + imagePullPolicy: 蟫黳jª0狫ĝ| + lifecycle: + postStart: + exec: + command: + - I + name: XmcrosJ9Art + resizePolicy: + - resourceName: 8dOXgKMh + restartPolicy: T@罞 + resources: + limits: + Qf424: "0" + UkBWyCgR: "0" + yS9FH: "0" + securityContext: + allowPrivilegeEscalation: true + capabilities: + drop: + - Ǐ蟯ƛU賊稁uv/u讎胗< + - 1湹 + privileged: false + readOnlyRootFilesystem: false + runAsGroup: -281571585037868400 + runAsUser: 8469885005475494000 + stdin: true + stdinOnce: true + terminationMessagePath: 6ii28 + terminationMessagePolicy: ȊGī3慺Ŏ + volumeDevices: + - devicePath: "" + name: lqvpF + - devicePath: 3vTez + name: pD6EOo + workingDir: QEqnPlY6YE + - args: + - eiyTiCxBp + envFrom: + - configMapRef: + name: uxUzs + prefix: 0Oq + secretRef: + name: ahghhjB + - configMapRef: + name: yjx + prefix: cOCr6ajjpSTT + - configMapRef: + name: "4" + prefix: 0XtWv + secretRef: + name: oKDQ + image: PV + imagePullPolicy: d?遼gŜT纬ɷšǧ餝Ƨ + livenessProbe: + exec: {} + failureThreshold: 746140291 + grpc: + port: 1197495917 + service: "" + httpGet: + host: x78yAB + path: P5mSLs + port: Cb2 + scheme: 儰试9ȷǴ燀ǃ¦籇射,ǠöcƲ伙 + initialDelaySeconds: 1418617842 + periodSeconds: 187037501 + successThreshold: -1821323321 + timeoutSeconds: -894994792 + name: ToH + resizePolicy: + - resourceName: 7Ut8kM + restartPolicy: gěǏ* + - resourceName: gvoJz7 + restartPolicy: ł0Iɷ»u诎żȋ貏C炭 + - resourceName: VpTvtNnJOw + restartPolicy: 阠eR'k.Ơ糦啮ŋ睷N譺 + resources: + limits: + cYhO6a: "0" + startupProbe: + exec: {} + failureThreshold: -1040244189 + grpc: + port: 1921669257 + service: Me + httpGet: + host: 5fL4Z + path: BwLac + port: SKrb2z + scheme: ľ<Ƽ浳s剪ɍ + initialDelaySeconds: -1064995957 + periodSeconds: 230643461 + successThreshold: -1865926881 + timeoutSeconds: 1102271416 + terminationMessagePath: ZbnnI + terminationMessagePolicy: 阳壀ɀS强pŇȆDž鹩 + tty: true + volumeDevices: + - devicePath: pP2eHwth + name: S9Sy + workingDir: Z + imagePullSecrets: [] + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: {} + priorityClassName: vMcB + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: tmn2Kt + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: tmn2Kt + name: configs + - name: secrets + secret: + secretName: tmn2Kt +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "tmn2Kt-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Qr03ts + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['tmn2Kt:8080'] + restartPolicy: Never + priorityClassName: vMcB +-- testdata/case-013.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: dDkIKgMwXv + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: RttlJN + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: dDkIKgMwXv + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: RttlJN +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: dDkIKgMwXv + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: RttlJN +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: dDkIKgMwXv + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: RttlJN + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: dDkIKgMwXv + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: dDkIKgMwXv + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: RttlJN + namespace: default +spec: + replicas: 412 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: dDkIKgMwXv + strategy: {} + template: + metadata: + annotations: + checksum/config: 80fd97b611d09c692bd5e12a12d43f51c7486213c5798a4f57bb8f0866119572 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: dDkIKgMwXv + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: RttlJN + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: -225696508 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 1573121125 + periodSeconds: -1561542711 + successThreshold: 1804677264 + timeoutSeconds: -1540252725 + resources: + limits: + f7Jr: "0" + fl: "0" + requests: + Q4O7nA: "0" + securityContext: + privileged: true + readOnlyRootFilesystem: false + runAsNonRoot: true + runAsUser: -8804799239371185000 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - mountPath: DVlVa1jiDIh5G + name: zaV + subPath: lXnque8 + subPathExpr: aFzzfyzr + - mountPath: 7VmD + name: bNuYmK + readOnly: true + subPath: zsTvmtU0 + subPathExpr: uNyQSZ + - mountPath: p + name: q3 + readOnly: true + subPathExpr: k4yfc0H + - env: + - name: bNyX + value: DpJ + valueFrom: + secretKeyRef: + key: r3ZL + name: GM2zRN8 + optional: false + - name: dS + value: u2CpI14PZ + - name: JVoNndPj + value: eCfRy + image: 9nkfM + imagePullPolicy: v洓p褾NJ翛Y/笸i洞偀fX綤鰐 + livenessProbe: + exec: + command: + - TzQ + - 5tBBhynsjV + failureThreshold: -1613952147 + httpGet: + host: gYV + path: 9qC2GovT + port: Gh + initialDelaySeconds: 1651935443 + periodSeconds: -1307313312 + successThreshold: 1553368137 + terminationGracePeriodSeconds: -4575724788805099000 + timeoutSeconds: -499895377 + name: aOBSLF + readinessProbe: + failureThreshold: 687754614 + initialDelaySeconds: -1880005074 + periodSeconds: 794268536 + successThreshold: -1510519942 + terminationGracePeriodSeconds: 3334702514671978000 + timeoutSeconds: -178867660 + resources: + requests: + hiWTQ: "0" + m7CDU: "0" + stdin: true + terminationMessagePath: Yj9V + terminationMessagePolicy: js$昦夁糎fț + tty: true + volumeMounts: + - mountPath: Xaoy + name: XuLXzMm + readOnly: true + subPath: NI8v + subPathExpr: nPRuyC + - mountPath: S + mountPropagation: ĜX鴮璫ȓĢ + name: c2o + readOnly: true + subPath: DEcziG + subPathExpr: 7UjF6H + workingDir: yPE + imagePullSecrets: [] + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: {} + priorityClassName: BDUfm1wSRDI + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: RttlJN + tolerations: + - effect: ƞ嬂 + key: wnH + operator: Ā蔥ąʏƅȑǚ缗'r~熐{Ǎ楯&鑫咂] + value: LYZYjeFUmK29wdL + - effect: 硞撤幅娰tȬ婒ĎɕÏǜ蚭馸諄W)偒½ + key: e2 + operator: bƤrZ + value: 8ssobF8u + topologySpreadConstraints: [] + volumes: + - configMap: + name: RttlJN + name: configs + - name: secrets + secret: + secretName: RttlJN +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "RttlJN-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: dDkIKgMwXv + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['RttlJN:8080'] + restartPolicy: Never + priorityClassName: BDUfm1wSRDI +-- testdata/case-014.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Vi2vH + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: h6eHrUr + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Vi2vH + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: htymHJ +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + role-bindings.yaml: |- + roleBindings: + - null +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Vi2vH + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: htymHJ +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Vi2vH + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: htymHJ + namespace: default +spec: + ports: + - name: http + port: 41 + protocol: TCP + targetPort: 168 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: Vi2vH + type: Oiwzbmtjpb +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "htymHJ-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Vi2vH + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['htymHJ:41'] + restartPolicy: Never + priorityClassName: rcxHoi +-- testdata/case-015.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: + IH: 3W + K5hNNf: "" + r: 9cmm + creationTimestamp: null + labels: + B0Pmybnj: gh8 + MdyMnFBP0Cd1: UUVRKbjhv + ShHkukRGF9k: KlIyX6upO + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: KD8DmV + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: zmr + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + B0Pmybnj: gh8 + MdyMnFBP0Cd1: UUVRKbjhv + ShHkukRGF9k: KlIyX6upO + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: KD8DmV + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 9RweMGWqBs +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + B0Pmybnj: gh8 + MdyMnFBP0Cd1: UUVRKbjhv + ShHkukRGF9k: KlIyX6upO + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: KD8DmV + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 9RweMGWqBs +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + B0Pmybnj: gh8 + MdyMnFBP0Cd1: UUVRKbjhv + ShHkukRGF9k: KlIyX6upO + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: KD8DmV + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 9RweMGWqBs + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: KD8DmV + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + 2V: 50l + jFB7K: 5ZqGXdsD94 + creationTimestamp: null + labels: + B0Pmybnj: gh8 + MdyMnFBP0Cd1: UUVRKbjhv + ShHkukRGF9k: KlIyX6upO + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: KD8DmV + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 9RweMGWqBs + namespace: default +spec: + replicas: 128 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: KD8DmV + strategy: {} + template: + metadata: + annotations: + checksum/config: c07b76ad8263a0560734a09b913b4c726efe461a7f519da293467d20a90d78bf + creationTimestamp: null + labels: + FlwBgvWNMrbg5: YKgnz8q + TGDbR: 4egH + Xr8XMOk: 1DAii + app.kubernetes.io/instance: console + app.kubernetes.io/name: KD8DmV + spec: + affinity: + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 7eVqbmnw4 + operator: 屈ǧȔŗS#~¸Dd馔uÈ飏ƌĔ魼ȓ + values: + - eZapFDhb + - dBr2cD + - key: Z13Kq48NE0 + operator: ª + values: + - 03LE6GE + - key: s + operator: 箱+ʑ圼;0丢顃M媆熋熼妄瞬 + values: + - E + - jC2mNBN + matchLabels: + 4tdQRoO: Tgv + 7Apxz: EPl5 + bPvG5Bf: sCS + namespaceSelector: {} + namespaces: + - bkN0U + topologyKey: haPJ + weight: -1043017794 + - podAffinityTerm: + labelSelector: + matchLabels: + PP8DxAPJwUzY: z9RL6 + U1a: J + due4: eRc0tKn + namespaceSelector: + matchExpressions: + - key: "y" + operator: 霮ʡ`罵瀖Kʓa嚃*Q`UV邠想ɷġ + namespaces: + - M2GNeyD + - eDNVdz1ne46 + topologyKey: kQ + weight: -1134437930 + - podAffinityTerm: + namespaceSelector: + matchExpressions: + - key: SnD + operator: 6愔ȶ獧:öȰ浻珼»ǰs睑,s頀旓eX + - key: yt197hBb + operator: ȒǦ^(á咟獐赠5ĺĜ嶜庌愖V揺ɞ\Ș + values: + - pu5 + - Ywv1TEhK + - pAo + matchLabels: + "": rZ + topologyKey: WSD + weight: 613733383 + requiredDuringSchedulingIgnoredDuringExecution: + - topologyKey: 4b6nMCalUl1 + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: iQE + value: Aj6RWPJE + - name: QwMCc + value: N9g6bDNI + - name: U5Qg5Qc0NWE + valueFrom: + configMapKeyRef: + key: R + name: n8 + optional: false + fieldRef: + apiVersion: zg0 + fieldPath: fNjpqJ + secretKeyRef: + key: MlF + name: h + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: 9RweMGWqBs + envFrom: [] + image: FezgEM/b4CZb:OoX + imagePullPolicy: '&Ŕ<駄AG' + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 398655641 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 1516319657 + periodSeconds: -635156272 + successThreshold: 1338596793 + timeoutSeconds: -905426079 + resources: + requests: + I: "0" + b7jbi: "0" + r1cN: "0" + securityContext: + privileged: false + procMount: d聉l蝲ɓH>狱(Ȁ胄hʍy龝Ȼ埓Y + readOnlyRootFilesystem: false + runAsGroup: 2951274493718237000 + runAsNonRoot: true + runAsUser: -1772317555576666000 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - mountPath: y5BZm9v9L5 + name: mE9WF + readOnly: true + subPathExpr: 3vKqLj2 + imagePullSecrets: [] + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: + vy4h: rk + priorityClassName: "68" + securityContext: + fsGroup: 99 + fsGroupChangePolicy: ¶鮬眴帘ʥb豚DIĂ + runAsGroup: 4190388773600424000 + runAsUser: 99 + supplementalGroups: + - 6652209348598506000 + - 5521245057591626000 + - 6754698685787706000 + sysctls: + - name: "7" + value: vp + serviceAccountName: zmr + tolerations: + - effect: '#U媷ɑɥ±箑妌RɱfÈB矅蒟(' + key: g + operator: Řg~歟1ƹ,纙蝝垺 + tolerationSeconds: -9038490283678034000 + value: x6T1NM + - effect: ė{ɼ 5;^ʤàOKv泣0ƫ¢ + key: wdW6LI1a5 + operator: ú4ʫ-哖ýȻȣŦiĩġ膳". + tolerationSeconds: -5247520709138794000 + value: NXt + topologySpreadConstraints: + - labelSelector: + matchExpressions: + - key: dme + operator: )\鹮İ又Ȥ鏥Ĝ + matchLabels: + Cdk: atEBel + PhEVPxOjN: QTW4 + fC0YTiwm: fdAQN8t + maxSkew: 472867304 + minDomains: 1802867157 + nodeAffinityPolicy: ʈǔ聿ŶŹ&y鰜# + nodeTaintsPolicy: '"篍Ɛɰl鄱' + topologyKey: fqmSu + whenUnsatisfiable: äƟĻ鍣ųø啼ǫǷ" + - labelSelector: + matchExpressions: + - key: BEj + operator: Ɠ墳 + values: + - qBJ + - KZbk + - key: 9wxm2wFXlY + operator: ì蠁{\媽;ě8ɠ + values: + - yiuVv9DzzRse + - "N" + - z + - key: SWu + operator: Ī½曖1șWb3 + maxSkew: 774109577 + minDomains: -110979462 + nodeAffinityPolicy: 醿卨¬婾豜ʦKd` + topologyKey: 4iskW3Hbv + whenUnsatisfiable: ǮXƞ棤Ǘ + volumes: + - configMap: + name: 9RweMGWqBs + name: configs + - name: secrets + secret: + secretName: 9RweMGWqBs +--- +# Source: console/templates/ingress.yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + "": ZKQ6I + ES: uo + creationTimestamp: null + labels: + B0Pmybnj: gh8 + MdyMnFBP0Cd1: UUVRKbjhv + ShHkukRGF9k: KlIyX6upO + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: KD8DmV + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 9RweMGWqBs +spec: + ingressClassName: x7Um + rules: + - host: chart-example.local + http: + paths: + - backend: + service: + name: 9RweMGWqBs + port: + number: 8080 + path: / + pathType: ImplementationSpecific + tls: + - hosts: null + secretName: Ye6 + - hosts: + - nNQW2NL + - g + - "N" + secretName: YQl +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "9RweMGWqBs-test-connection" + namespace: "default" + labels: + B0Pmybnj: gh8 + MdyMnFBP0Cd1: UUVRKbjhv + ShHkukRGF9k: KlIyX6upO + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: KD8DmV + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['9RweMGWqBs:8080'] + restartPolicy: Never + priorityClassName: 68 +-- testdata/case-016.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: SC + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: DdF7ALq + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: SC + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 6maz +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + role-bindings.yaml: |- + roleBindings: + - Q0kslM: null + - null +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: SC + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 6maz +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: SC + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 6maz + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: SC + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: SC + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 6maz + namespace: default +spec: + replicas: 331 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: SC + strategy: + rollingUpdate: {} + type: ŀ剭º(;ƍ4兖ȇ + template: + metadata: + annotations: + JYLUc483y: gTnWiG + checksum/config: e4b69acb9132e0c7dea94f0e868bb2c5850883e5487d4cca28762798c1b9dda6 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: SC + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: 2Ldss9 + operator: ?霏ƦxǰA7ȇ(堃R + values: + - Ce7pGgB5o + - B8EWZ + - key: pJKw3VVY5 + operator: 2wq6JK?Ȏ惙徵r儊ǒ嵀匫W + matchFields: + - key: EQvFQjoLm1 + operator: «/o咑澇ƉɑȨŞƙ|5時 + weight: -508343495 + - preference: + matchExpressions: + - key: VRoHsoMNa + operator: cƄábŊɕg追ĦǙȿ男)hŬ + values: + - tcCIpd9m + - FsoFrK + - key: ReH4ocoZ + operator: "" + values: + - bnUyPckbz + - AE + - njW + - key: fZBGR + operator: 租ǜ藇錼 + weight: -1003115262 + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + namespaceSelector: + matchLabels: + qGlBCw: zUBwqj2xV + zlHLG: TDTkLQOC + namespaces: + - QWFH + - TEzgQKPSQ + topologyKey: "" + weight: 682123393 + - podAffinityTerm: + labelSelector: {} + matchLabelKeys: + - 1MiHrQ + namespaceSelector: + matchExpressions: + - key: JUYumiiJFrY + operator: .ƽCDZo& + values: + - t3wDXa + - 70HCTbI6g + - C + - key: ik + operator: Œ8v + values: + - Wp + - Zf + - c2q7e + topologyKey: Sc1Q + weight: 869908297 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: ore + operator: ?ɴ$瀜蝪ĪźȀŐƌS莣幮屒n×U锇Ľ + values: + - mJM + - oc + - aU + - key: SQmv + operator: ȥī+ūĬ诧犂¹ + - key: Hh1r9 + operator: h蓟x蹵D¨谧罬 + matchLabelKeys: + - mDk + - Hki8 + topologyKey: x2q0Rx1f1N + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + namespaceSelector: + matchExpressions: + - key: H1Ni + operator: Ȧ厜OŊ + values: + - UWzAFu2 + - key: M + operator: 罐hĹ;'ǫ貉yĊ啉刉DzQį + - key: zZ + operator: 颉śĴJ|@W補A篐S献;ɾ[_鶙ȱ + values: + - 4BL + namespaces: + - Thgfgf7Z + topologyKey: XBju19e + weight: 1392601493 + automountServiceAccountToken: false + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: 6maz + envFrom: [] + image: PYDGV/HV3:cI8TzaYkws + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 713465020 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 1849009003 + periodSeconds: 2079209425 + successThreshold: 1679782943 + timeoutSeconds: 2000039211 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + allowPrivilegeEscalation: false + procMount: 垮Ř2 + readOnlyRootFilesystem: true + runAsGroup: 5797501600954334000 + runAsNonRoot: true + runAsUser: -8444673787636984000 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - command: + - opIk + - v9eJ + - 4V + env: + - name: 5Q + value: o + envFrom: + - prefix: eBWmLK + secretRef: + name: FedJi + optional: false + - configMapRef: + name: M + optional: false + prefix: vUvV7W8k0 + secretRef: + name: IA + image: T4SYV + imagePullPolicy: Ƈ祃ǗǤɈ遖竀壙/ + livenessProbe: + failureThreshold: 20929095 + grpc: + port: -1775507003 + service: UZ6BT7NDI + httpGet: + host: QFkZxI6kA + path: tzQ + port: "" + scheme: Ƞ揞á惗É莏6XȪ/ʡ忨償 + initialDelaySeconds: 1046895310 + periodSeconds: -1971173139 + successThreshold: -476756841 + terminationGracePeriodSeconds: 144861231583008740 + timeoutSeconds: 814968592 + name: gEB + ports: + - containerPort: 2060914354 + hostIP: 9IXWKx38q5 + hostPort: -1191426039 + name: 5Mw7k + protocol: 悛ķ鳉ɍ恽j頔Œ6Eʮnx + resources: {} + restartPolicy: 樦ýȃ梪ĵ + stdin: true + stdinOnce: true + terminationMessagePath: c0e + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: XtKq + securityContext: + fsGroup: -1425599568169885200 + fsGroupChangePolicy: ƶ Ÿ恢 + runAsGroup: -8737472966684837000 + runAsUser: 99 + supplementalGroups: + - 809809813702093200 + - 6124706841582845000 + - 6159358527003038000 + serviceAccountName: DdF7ALq + tolerations: [] + topologySpreadConstraints: + - labelSelector: {} + maxSkew: 972537130 + minDomains: -499606767 + topologyKey: q5 + whenUnsatisfiable: 鳯°ôŕƨʪuɘ"h貇榧0?cɉjA蜝 + - labelSelector: + matchExpressions: + - key: lAV + operator: 嵖xߟ擱ʄ衯"xɂ + - key: U6 + operator: =换J+Ř:嫚ʥ畠餐ǒŃ + values: + - Vj + - snF6cyZ + - 0sW9y4T5 + matchLabelKeys: + - 2wCjBs + maxSkew: -324080521 + minDomains: 695322418 + nodeAffinityPolicy: ʖ[兘Ũ鬎盦İƲ + topologyKey: z5y4Q8jyHH + whenUnsatisfiable: =Y~É.J樢ȃŤƫ甶Ȍ* + - labelSelector: {} + maxSkew: -1720129802 + minDomains: 1017048856 + nodeTaintsPolicy: 龨9猶e僦ɻ髧Ȍc + topologyKey: qKf6Ef3o + whenUnsatisfiable: ʂ?$鳴寘ŧ6脹餗ſ媷,峇埽 + volumes: + - configMap: + name: 6maz + name: configs + - name: secrets + secret: + secretName: 6maz +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "6maz-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: SC + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['6maz:8080'] + restartPolicy: Never + priorityClassName: XtKq +-- testdata/case-017.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tPiY + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 9XG3SZW + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tPiY + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 9XG3SZW +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: jw6tY22 + login-github-personal-access-token: JvG1jx + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: MalR2 + login-okta-client-secret: mDILgPMjOS9 + login-okta-directory-api-token: M2ywAiP + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + roles.yaml: |- + roles: + - JlwOk: null + QUzHpm: null + ch3WnNF: null + - {} + - null +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tPiY + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 9XG3SZW +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tPiY + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 9XG3SZW + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: tPiY + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + J5Z: aLYd149 + LCqYvOjK: Qsk + bU: "" + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tPiY + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 9XG3SZW + namespace: default +spec: + replicas: 173 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: tPiY + strategy: {} + template: + metadata: + annotations: + checksum/config: a9353e622b2ed64d835d05830dc4357d8eb982e89685498d39ac88a30931fb87 + creationTimestamp: null + labels: + LBQpbD: AHB4hNVL + app.kubernetes.io/instance: console + app.kubernetes.io/name: tPiY + ey1GpAHh: fA + spec: + affinity: {} + automountServiceAccountToken: false + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: Z + value: 1PasJFATvz + valueFrom: + configMapKeyRef: + key: Out + name: Z + - name: pUN + value: QTGN + valueFrom: + configMapKeyRef: + key: BLzs5FKV + name: xsgY3vBvZ + optional: true + fieldRef: + apiVersion: 5Ng + fieldPath: Psowh + resourceFieldRef: + containerName: pMz + divisor: "0" + resource: "" + secretKeyRef: + key: IY9s0 + optional: false + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: 9XG3SZW + - name: LOGIN_GITHUB_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-github-oauth-client-secret + name: 9XG3SZW + - name: LOGIN_GITHUB_DIRECTORY_PERSONALACCESSTOKEN + valueFrom: + secretKeyRef: + key: login-github-personal-access-token + name: 9XG3SZW + - name: LOGIN_OKTA_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-okta-client-secret + name: 9XG3SZW + - name: LOGIN_OKTA_DIRECTORY_APITOKEN + valueFrom: + secretKeyRef: + key: login-okta-directory-api-token + name: 9XG3SZW + - name: LOGIN_OIDC_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-oidc-client-secret + name: 9XG3SZW + envFrom: + - prefix: oK16T1 + - configMapRef: + name: GxM9 + optional: false + prefix: Hj8 + secretRef: + name: o5P67 + image: 3s/kPWhaC:BcBi + imagePullPolicy: k痿蹒 + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 738983906 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -1729478206 + periodSeconds: 902558671 + successThreshold: 989047880 + timeoutSeconds: -402268186 + resources: + limits: + 0fvc8: "0" + W19cC: "0" + loZ4: "0" + securityContext: + capabilities: + add: + - "" + - 鸼ǀɛ_Y + - 利ƯǢ謼Ŀʇ佔4銣 + privileged: false + procMount: 頿ū詁ǎTɁ¯PlFd只鶗ƝǛƤ臃 + readOnlyRootFilesystem: true + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - mountPath: TLaWLIiD + name: 3SwG7HrS + subPath: "" + - mountPath: dXXPfK + name: Bfv9SGjlbgN + subPath: "" + - mountPath: YEOA49 + name: wz4K9oIYM + subPath: "" + - args: + - Bd + command: + - QwtEp + - lLi7 + - kxB1 + image: RpMWaJ + imagePullPolicy: ~崆Ǭe侊k + livenessProbe: + exec: {} + failureThreshold: -2101638962 + grpc: + port: -208999597 + service: jICxjA + initialDelaySeconds: 925230214 + periodSeconds: -996383814 + successThreshold: 152844544 + terminationGracePeriodSeconds: -7802949917649734000 + timeoutSeconds: -188255799 + name: qwOkQZ + ports: + - containerPort: -255758148 + hostIP: R + hostPort: 316791912 + name: 09i3b5oQR + protocol: 腴醗9-鐶 + - containerPort: 247145105 + hostIP: L4 + hostPort: 1727912240 + name: bz7Y1N7 + protocol: 暄璎 + readinessProbe: + exec: + command: + - 2fQQ + failureThreshold: -873648342 + grpc: + port: 889903834 + service: C3 + httpGet: + host: IPHal + path: 5Nb6iW9 + port: tkqo + scheme: m说Ď盐2Ƹ,约h鰥Ȕť3 + initialDelaySeconds: 1391319902 + periodSeconds: -1638942635 + successThreshold: 644454270 + timeoutSeconds: -553602240 + resources: + requests: + 0XxId: "0" + VsY2R9: "0" + ZLtS2: "0" + restartPolicy: ų蓶Lj,g珯i'Sû竒 + terminationMessagePath: Mx7V + terminationMessagePolicy: =Jƈ乚貃庪ș¯ÑVȯ6筌巨华ɀ(v + tty: true + workingDir: nKFDPLJvOh + - args: + - AV3kjV + - Gwq78lY2 + - wq + command: + - D + - EI + - fY5J + env: + - name: eCtpNU + value: jLkcq8S + - name: rynLbx + value: CdqgJabHhM + valueFrom: + configMapKeyRef: + key: uBUH5 + name: Uxei4G1 + optional: false + fieldRef: + apiVersion: Ul9al + fieldPath: vtGid + resourceFieldRef: + containerName: Oc + divisor: "0" + resource: "" + - name: GmDNpa0 + value: 7VJM2XsPm8N + valueFrom: + configMapKeyRef: + key: x3J0PMWE + resourceFieldRef: + containerName: x9Q + divisor: "0" + resource: EKFgoq + secretKeyRef: + key: lOZRvK9 + name: V + image: 1xn6 + imagePullPolicy: ɀ稤¼Mɻ«鐾6Ú{ŬtŮ鄖SSɌ戲 + lifecycle: + postStart: + exec: {} + httpGet: + host: sT2dWyT + path: vvbIxNVANZ + port: aCK8 + scheme: 昿孊卿昤軒JYƜÁ嶠şe灶 + sleep: + seconds: -3542823673709563400 + preStop: + exec: + command: + - "N" + - qkHmJ + - HupYy + httpGet: + host: 137dx + path: y3u7HE + port: -1357399425 + scheme: '@济ɉ鳛讧跕(#7NJɓũǸ]ɨ梊sj' + sleep: + seconds: -2408406850575106600 + name: J6VFtJd3giFt + resources: + requests: + 3dqK0M: "0" + restartPolicy: 70ʆ氶応爱怙鉉塼tƗhY嚇 + securityContext: + allowPrivilegeEscalation: false + capabilities: {} + privileged: false + procMount: ȚƼ提瀴t8oƥc + startupProbe: + exec: {} + failureThreshold: 1782005431 + grpc: + port: 676289916 + service: 3xqeCsf + httpGet: + host: YDL1TP + path: "8" + port: lLWR + scheme: BKō筹 + initialDelaySeconds: 134613881 + periodSeconds: 1547524591 + successThreshold: 1778605907 + terminationGracePeriodSeconds: -7593859121613943000 + timeoutSeconds: 2026260743 + terminationMessagePath: E + terminationMessagePolicy: 碓 + workingDir: kl + - command: + - "" + env: + - name: TG1HQA + value: 5X + valueFrom: + fieldRef: + apiVersion: Vhn + fieldPath: jluMkQnv9 + resourceFieldRef: + containerName: rLfbH + divisor: "0" + resource: "" + - name: "" + value: TOTyqqGn + valueFrom: + fieldRef: + apiVersion: 0CAdSa + fieldPath: LWMRC + resourceFieldRef: + divisor: "0" + resource: G5eZP4R + secretKeyRef: + key: xYOgJL + name: vMTywG + image: 2Z + imagePullPolicy: z.鎸ƦʖFNj棪Ƃ鯌b抵#Dzr + lifecycle: + postStart: + exec: {} + httpGet: + host: k8z + path: TxNa2e + port: -573570086 + scheme: oɌdǹ[M灙螮伪芛探塢庖Njȕ仸 + sleep: + seconds: 4118046687980194000 + preStop: + exec: + command: + - 6iZbF + - OeZTW + httpGet: + host: rbqq + path: sno + port: -429531729 + scheme: s璙Ȼȗ榛ǵ0ƿ.忋闳溨 + name: Cms + ports: + - containerPort: -211101225 + hostIP: 8v + hostPort: 1994344080 + name: kyMvksZa + protocol: fȞ蚊悘ū錩Ȩ龒ċŴ + - containerPort: -806313867 + hostIP: Ky2F2 + hostPort: 1605736520 + name: oe0nMMl + protocol: 慿)"Ǒ3浹襈}(VE-B³閪叒k1绝 + readinessProbe: + exec: {} + failureThreshold: 1398486074 + grpc: + port: 1157090744 + service: oFrTS0 + httpGet: + host: 5pfrE + port: TJb4 + scheme: 畢î + initialDelaySeconds: -1830121652 + periodSeconds: -1398007905 + successThreshold: 1183454316 + timeoutSeconds: 1797763090 + resizePolicy: + - resourceName: hzxTj + restartPolicy: 渣箢樳掯ȉÏǼ店喘©g + resources: + limits: + zGvF9poISMtK: "0" + requests: + lUp3T: "0" + restartPolicy: '}賩6''V霟足''È''*F÷ƙǕ' + stdin: true + terminationMessagePath: 4tn + terminationMessagePolicy: ɢ荵鯴庡ǁ婛埽猜犝笖á7譃ǁ¦GɖC + volumeDevices: + - devicePath: eGfD9B + name: G3Bd + - devicePath: x + name: TB + workingDir: iKksE1 + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: qcIlT + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: 9XG3SZW + tolerations: + - effect: 懻 + key: JifsKW + operator: 檧űÊǮȡ廄儱RəȏĮ顪ÅÞ + tolerationSeconds: 4501363800484543000 + value: KkCBzwToBMjJ + - effect: B囧ƉOß + key: Q3cj + operator: ɲ朁ß栢 + tolerationSeconds: 4944598504260379000 + value: Z5 + - effect: 敘愰ɰuƪ晐 + key: K8wM + operator: ș + tolerationSeconds: 8375376960471889000 + value: TnWS + topologySpreadConstraints: [] + volumes: + - configMap: + name: 9XG3SZW + name: configs + - name: secrets + secret: + secretName: 9XG3SZW + - name: 3SwG7HrS + secret: + defaultMode: 442 + secretName: VR + - name: Bfv9SGjlbgN + secret: + defaultMode: 383 + secretName: T + - name: wz4K9oIYM + secret: + defaultMode: 13 + secretName: WzM +-- testdata/case-018.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: + X7E: CRSzr + lPi: bGP + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 1qyLP36T + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: uAvlOXf + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 1qyLP36T + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: ExFU3 +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: IsvQ9 + kafka-sasl-aws-msk-iam-secret-key: 8GlUc + kafka-sasl-password: Vb + kafka-schema-registry-password: UJ7Zl + kafka-schemaregistry-tls-ca: T1Q + kafka-schemaregistry-tls-cert: 17r + kafka-schemaregistry-tls-key: O44 + kafka-tls-ca: n8k9 + kafka-tls-cert: aK + kafka-tls-key: "" + login-github-oauth-client-secret: t6z0n + login-github-personal-access-token: "" + login-google-groups-service-account.json: fpuCEFLL + login-google-oauth-client-secret: h + login-jwt-secret: SECRETKEY + login-oidc-client-secret: t + login-okta-client-secret: 3CcKl + login-okta-directory-api-token: AZt8H77 + redpanda-admin-api-password: NUkb3zIpwAR + redpanda-admin-api-tls-ca: t + redpanda-admin-api-tls-cert: zttTAvj + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 1qyLP36T + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: ExFU3 + namespace: default +spec: + ports: + - name: http + port: 415 + protocol: TCP + targetPort: 489 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 1qyLP36T + type: 2cM +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + "": 3E5rtKA + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 1qyLP36T + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: ExFU3 + namespace: default +spec: + replicas: 297 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 1qyLP36T + strategy: + rollingUpdate: {} + type: ɬ搢.Ƒ躂ɻɅȄ莨qc婔Åå + template: + metadata: + annotations: + checksum/config: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 1qyLP36T + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: {} + weight: -37659402 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: [] + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + matchLabelKeys: + - ajbCE + - Y0MRgpE8 + namespaceSelector: + matchExpressions: + - key: Auai + operator: ùfƽÜQķɨ逑ʒÅģ + values: + - Q + - key: 1S2Nfq + operator: 臺瑷tƎ鍤p}滳`竦ÙǾ晖ǃʏȵ + namespaces: + - 4GTSAZF + topologyKey: NS733 + weight: -968286112 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: eyt3TPSYPBWDt + operator: e偁&蔄癳.ŚƘ + matchLabelKeys: + - eE7PA8D + - cKalkvb + mismatchLabelKeys: + - Lan + topologyKey: v + weight: -2133598054 + - podAffinityTerm: + mismatchLabelKeys: + - "5" + namespaceSelector: + matchExpressions: + - key: UrrD + operator: ƞ + - key: rkfCsnUcx + operator: ȇ睾¦棌鉝-m糤LPjX.;Ğ× + - key: kla + operator: '"竮壣祠ł9抵墙' + namespaces: + - gyF + topologyKey: ZG + weight: -428742233 + requiredDuringSchedulingIgnoredDuringExecution: + - matchLabelKeys: + - tZZj + namespaces: + - VuG + - I5XU + topologyKey: V2CZqa + - labelSelector: {} + mismatchLabelKeys: + - "" + - q9L4 + - C4YJ57 + namespaces: + - 8xRk06ngy + - WeZO2 + - 7tbTFK + topologyKey: rnpto + automountServiceAccountToken: false + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: KAFKA_SASL_PASSWORD + valueFrom: + secretKeyRef: + key: kafka-sasl-password + name: ExFU3 + - name: KAFKA_PROTOBUF_GIT_BASICAUTH_PASSWORD + valueFrom: + secretKeyRef: + key: kafka-protobuf-git-basicauth-password + name: ExFU3 + - name: KAFKA_SASL_AWSMSKIAM_SECRETKEY + valueFrom: + secretKeyRef: + key: kafka-sasl-aws-msk-iam-secret-key + name: ExFU3 + - name: KAFKA_TLS_CAFILEPATH + value: /etc/console/secrets/kafka-tls-ca + - name: KAFKA_TLS_CERTFILEPATH + value: /etc/console/secrets/kafka-tls-cert + - name: KAFKA_SCHEMAREGISTRY_TLS_CAFILEPATH + value: /etc/console/secrets/kafka-schemaregistry-tls-ca + - name: KAFKA_SCHEMAREGISTRY_TLS_CERTFILEPATH + value: /etc/console/secrets/kafka-schemaregistry-tls-cert + - name: KAFKA_SCHEMAREGISTRY_TLS_KEYFILEPATH + value: /etc/console/secrets/kafka-schemaregistry-tls-key + - name: KAFKA_SCHEMAREGISTRY_PASSWORD + valueFrom: + secretKeyRef: + key: kafka-schema-registry-password + name: ExFU3 + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: ExFU3 + - name: LOGIN_GOOGLE_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-google-oauth-client-secret + name: ExFU3 + - name: LOGIN_GOOGLE_DIRECTORY_SERVICEACCOUNTFILEPATH + value: /etc/console/secrets/login-google-groups-service-account.json + - name: LOGIN_GITHUB_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-github-oauth-client-secret + name: ExFU3 + - name: LOGIN_OKTA_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-okta-client-secret + name: ExFU3 + - name: LOGIN_OKTA_DIRECTORY_APITOKEN + valueFrom: + secretKeyRef: + key: login-okta-directory-api-token + name: ExFU3 + - name: LOGIN_OIDC_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-oidc-client-secret + name: ExFU3 + - name: REDPANDA_ADMINAPI_PASSWORD + valueFrom: + secretKeyRef: + key: redpanda-admin-api-password + name: ExFU3 + - name: REDPANDA_ADMINAPI_TLS_CAFILEPATH + value: /etc/console/secrets/redpanda-admin-api-tls-ca + - name: REDPANDA_ADMINAPI_TLS_CERTFILEPATH + value: /etc/console/secrets/redpanda-admin-api-tls-cert + envFrom: + - prefix: hg + secretRef: + name: eLM59WyoAXO + image: iCFSIwyDtoG/6V6:6uR + imagePullPolicy: 螣暛擂ɾ#鏲*胭8饭1胠 + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 489 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: + limits: + QZqMxIAt: "0" + SUsu9: "0" + requests: + EMOXCuje: "0" + EzKKMIR: "0" + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - envFrom: + - prefix: EVZ + secretRef: + name: MxD + optional: true + - configMapRef: + name: A + optional: false + prefix: HuqxI + secretRef: + name: A + optional: true + image: SU + imagePullPolicy: 禵7璙p + lifecycle: + postStart: + httpGet: + host: YZMjhOUO8IS + path: nzYfH + port: Fcx + scheme: 矪Q9 + sleep: + seconds: 3463625415546708000 + livenessProbe: + failureThreshold: -560403806 + grpc: + port: 1751268094 + service: I + httpGet: + host: 0Sb + path: Utm2X + port: 395973041 + scheme: 醆蚎忨ŕ縨ƍ爋釬šÒ暺ƒŎO記岣 + initialDelaySeconds: -1011110535 + periodSeconds: -1229381750 + successThreshold: 260149510 + timeoutSeconds: 74546945 + name: e + resizePolicy: + - resourceName: XNKV + restartPolicy: ì焹.¬哄ȾŢȎȴe$p尶m`飻Ȭ + - resourceName: "" + restartPolicy: 閭I哗.寢荨ʪɛ侭ȵ(8 + resources: + requests: + 3nUsL: "0" + securityContext: + allowPrivilegeEscalation: false + privileged: false + readOnlyRootFilesystem: false + runAsGroup: -8616852535795885000 + terminationMessagePath: FjZ + terminationMessagePolicy: ÿb熿3,ćp寫ʃ#叺渍ƣș + volumeDevices: + - devicePath: Xvjm + name: 7yLA + - devicePath: 1Ci + name: Y0AloAQS + - devicePath: Gt + name: ZMKKc + workingDir: Mh + imagePullSecrets: + - name: vlnGQbo3y + initContainers: [] + nodeSelector: + Vckw: ifBZ9p7 + priorityClassName: 6jxv + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: uAvlOXf + tolerations: + - effect: č喅Ȳ崥ï{禙ÊÿC逻準?霘2 + key: YJE + operator: 珟 + tolerationSeconds: 3838637075734495700 + value: 1VemeDTEk1 + - effect: 艋Ƿ淛襀|Ǽ&矠Ģ凍J賜ɰō + key: ggxS8L + operator: 閞判ŏ + tolerationSeconds: -2249155605077506300 + value: m3c + - effect: 'Ljə]IŴ:' + key: 4BkJSo + value: Le + topologySpreadConstraints: + - matchLabelKeys: + - uyTA + - rJcqdY3 + maxSkew: 1887613958 + nodeAffinityPolicy: u鞝侠轁蛃6Ơfrt迄ʇQ勭ĶÇǻě + topologyKey: 3f9j + whenUnsatisfiable: µ + volumes: + - configMap: + name: ExFU3 + name: configs + - name: secrets + secret: + secretName: ExFU3 +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "ExFU3-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 1qyLP36T + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - name: vlnGQbo3y + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['ExFU3:415'] + restartPolicy: Never + priorityClassName: 6jxv +-- testdata/case-019.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 8MIg + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: NZ7h9 + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 8MIg + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: NZ7h9 +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 8MIg + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: NZ7h9 +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 8MIg + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: NZ7h9 + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 8MIg + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + lgiIA: u + wK8: JrSfKH + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 8MIg + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: NZ7h9 + namespace: default +spec: + replicas: 79 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 8MIg + strategy: + type: 鎦v財ɕŪ + template: + metadata: + annotations: + checksum/config: 9960ac5c5faddbc59ee9638bfac7f4fd7513b7e295e3fcc28b0fdfabc2aba1d3 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 8MIg + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: pJ + value: whmTukCTD + valueFrom: + configMapKeyRef: + key: OHk + name: "3" + fieldRef: + apiVersion: TSp7 + fieldPath: mEUVMSp7vUo + resourceFieldRef: + containerName: bBDw + divisor: "0" + resource: tIcs3z + secretKeyRef: + key: jIR5V + name: "9" + - name: ZCEPmHP + value: FhwE4R + valueFrom: + fieldRef: + apiVersion: Nv + fieldPath: WMXeIjk + resourceFieldRef: + containerName: Hbt + divisor: "0" + resource: mo7F + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: NZ7h9 + envFrom: [] + image: GNXgFQ/W3:2vPed + imagePullPolicy: 韃ĝ + livenessProbe: + failureThreshold: -1736131786 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 538755540 + periodSeconds: -937262167 + successThreshold: 2014961170 + timeoutSeconds: -614674118 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: -1936056692 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -2019126091 + periodSeconds: -1696700553 + successThreshold: 398361977 + timeoutSeconds: -184667912 + resources: {} + securityContext: + allowPrivilegeEscalation: true + capabilities: + drop: + - 狞濮噞饅烥H}湛m=U+卓Ǭï呣8Ú + privileged: true + runAsNonRoot: true + runAsUser: -471077223001866500 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - mountPath: UF6 + mountPropagation: ĻsŸ氂ǐ钋鮠Ĺ咳渼.pɫ + name: W1LIZa3 + subPath: qdDtjk + subPathExpr: Ew + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: FERw + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: NZ7h9 + tolerations: + - effect: 飝壊%ǂP胅ɂǏ趸疷擁鹒DŽ营風顺z拇 + key: Ku2m + operator: ŲǪFTǗǔȟʥȰȎǎo玼Ü + value: 1u + - effect: 雾Ź歘ɇƇ昨OČƑɎ騨Ŗ=Ì楯 + key: 12vKa + operator: ( + value: u + topologySpreadConstraints: [] + volumes: + - configMap: + name: NZ7h9 + name: configs + - name: secrets + secret: + secretName: NZ7h9 +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "NZ7h9-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 8MIg + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['NZ7h9:8080'] + restartPolicy: Never + priorityClassName: FERw +-- testdata/case-020.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: + Cs0Tv: PNgn + tawhZGj4: yuBQ1 + xdl: jbYUlUI + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: zzmAR9 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: HMpc + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: zzmAR9 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: Om7 +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: XhRg8T + login-github-personal-access-token: oB8xbs + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: saEi + login-okta-directory-api-token: tq8L + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: zzmAR9 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: Om7 +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: zzmAR9 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: Om7 + namespace: default +spec: + ports: + - name: http + port: 310 + protocol: TCP + targetPort: 28 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: zzmAR9 + type: "" +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + 0lA: PZvwfKrip + AUm: KY + KBFrJC: hkdfq + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: zzmAR9 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: Om7 + namespace: default +spec: + replicas: 344 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: zzmAR9 + strategy: + rollingUpdate: {} + type: x&N涮ĶJ­ɕ + template: + metadata: + annotations: + checksum/config: 2881fbe0f4a9d0f2f17dbbbe515c08d46dd6d4a6d2c84c3482c94ace8ee6b09f + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: zzmAR9 + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - {} + - matchExpressions: + - key: a23jbG + operator: yb庇ɍ闒ǰPâƟVsJu + values: + - "" + - 1lQmmGa8 + - XzVleDXV4YoRc + - key: 3Gwd9r + operator: 4Nj7Ġ$Ea狆Ö絞Ƙ殈廔as知 + - key: 7C4FjM + operator: ɩ.叧¬ʧ倒 + matchFields: + - key: H + operator: Ğų* + values: + - 0i + - qK + - key: 7ocDt + operator: 餯ǚ璗汭槰<ƤƐ評ź膹棅珢ȹ3鮑 + values: + - g5Aa1Hm + - LKNvXrtO + - key: o + operator: ŎJ甧鷓 + values: + - vJQQjLRrqIK + - Isj + - 6EBsy + - matchFields: + - key: H0oh1dBCg + operator: 鉔qƿ氵[ȕ凭Śȅ3džȿȳ + name: xYM + subPath: nMMkHAUoYIsN + subPathExpr: 579Yn2LXk + - mountPath: 5z + mountPropagation: Ƀ陪7k惿Ɏǚ霤ƨƱ«ɤ»ȣ薥頠媉fʠ + name: KIX5g + readOnly: true + subPath: CGOswgk + subPathExpr: oxiB23ZW2KX + workingDir: IzOAr + - args: + - jrZTvs + env: + - name: jxl5Q + value: fm2F7DzZA + image: r7sTpTP8N + imagePullPolicy: 眒弿 + lifecycle: + preStop: + httpGet: + host: WEBUk + path: "1" + port: -377365982 + scheme: 娖阋顿|儴Éȱ鋦 + livenessProbe: + exec: + command: + - 2j + failureThreshold: -1631622345 + grpc: + port: -188887701 + service: s + httpGet: + host: "6" + path: 07rm4AD + port: DCtZ5 + scheme: ʼnK襡5殛鯙ȋʛ稲(C姓 + initialDelaySeconds: -1011676147 + periodSeconds: -1141844037 + successThreshold: -1528778970 + terminationGracePeriodSeconds: 422553046190448100 + timeoutSeconds: 99607263 + name: rhg + ports: + - containerPort: 1265703793 + hostIP: lYiq + hostPort: -931710582 + name: r2OdlKyZ + protocol: ŌK4Ʒ霖R婧,Ģ墤ʠ_Ƒ亽vĨO + - containerPort: -1093198499 + hostIP: xHuDhI2 + hostPort: 1423992590 + name: WdH + protocol: K嚜pn犓ɯ`劮ƫķPLm + resizePolicy: + - resourceName: M3EK5NW + restartPolicy: Ɲ囩 + resources: + limits: + 4zeCyo: "0" + PgUjG: "0" + requests: + IseC3: "0" + WHgRSz: "0" + yzZn: "0" + restartPolicy: ijƞ墫噌L诠=脳%Ɗ + securityContext: + privileged: false + readOnlyRootFilesystem: false + runAsGroup: -1074724161449892000 + runAsUser: 8255497511479977000 + startupProbe: + exec: {} + failureThreshold: -1172398717 + grpc: + port: 1919051215 + service: "" + initialDelaySeconds: 2020291403 + periodSeconds: 450860281 + successThreshold: 193397000 + timeoutSeconds: -665894379 + stdin: true + terminationMessagePath: MCVu + terminationMessagePolicy: ŷÍ:+壩ùI賎Rɜ卮cɣS惕mIɭ + tty: true + workingDir: 2L97y + imagePullSecrets: + - name: iA1C + - name: ZOdo + - name: qTOK0W + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: {} + priorityClassName: 0bGHQk7gL + securityContext: + fsGroup: -6946946538076897000 + fsGroupChangePolicy: 呆ɔȂwijà + runAsGroup: 3944693697856007700 + runAsNonRoot: true + runAsUser: -732766343758518300 + supplementalGroups: + - -5691922089175975000 + serviceAccountName: H5TDAALUdD + tolerations: + - effect: 媄 + key: IQD9Yww8 + operator: bǾå鱍 + tolerationSeconds: -7454358062612207000 + value: odxS1Q2Sd + - effect: Ɣv璔}oȡʞ¤ + key: ySGX + operator: ƪ渺¸貗ȹV廋ȉňu増嬎Ë韍ǘz茩Ƹ怯 + tolerationSeconds: -1083807005557333500 + value: bAy + topologySpreadConstraints: [] + volumes: + - configMap: + name: Uo + name: configs + - name: Jq0CSftnp + - name: QMHGzzYC2HW + - name: 1PkbzhfK +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "Uo-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: Mh + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - name: iA1C + - name: ZOdo + - name: qTOK0W + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['Uo:8080'] + restartPolicy: Never + priorityClassName: 0bGHQk7gL +-- testdata/case-026.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: false +kind: ServiceAccount +metadata: + annotations: + "": tWl + 5mzy: 4t87VKeHA + a: UqD3iv5LoNYP + creationTimestamp: null + labels: + "": h0uSAPIi + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: vLjrafvp + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + kuKPk7: "" + name: Utu8ZHG2 + namespace: default +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + "": h0uSAPIi + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: vLjrafvp + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + kuKPk7: "" + name: qhaD + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: vLjrafvp + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + "": h0uSAPIi + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: vLjrafvp + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + kuKPk7: "" + name: qhaD + namespace: default +spec: + replicas: 78 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: vLjrafvp + strategy: + rollingUpdate: {} + type: I6终j2炅ȲbȻ + template: + metadata: + annotations: + LtAjph: 8Q + MiPvJub: 0x + checksum/config: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b + j: xR98FRh + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: vLjrafvp + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: GP94 + operator: 駑Ŀ峇[ɕdž0 + values: + - jjNFKv8 + - uG7Rs + - ApO075 + weight: -549077137 + - preference: + matchExpressions: + - key: R88 + operator: Dzv)bôȏ磜覐橮波赘T^ + values: + - DscaGMdgXV + - uy + - N3d + - key: "" + operator: 誮Vw!/毴Z匌忶ª渆 + values: + - 4mX0s + - key: byy + operator: 鿟y馡錥HJ鶟b左Ő*čt顭塶 + values: + - 6oQ + - 9r22TM + matchFields: + - key: fNLkt + operator: "" + values: + - tW + - M03GnpfhQn + - key: WQQs + operator: 騡(Í芝x焍麅ɰ窓ɶÜò鵹 + weight: 579622465 + podAffinity: {} + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: {} + namespaceSelector: + matchLabels: + IYAfjz: GloAc + namespaces: + - hfFjlR + - KWIdaP11Y + - 3Dn + topologyKey: UB + - labelSelector: + matchExpressions: + - key: B7LSh + operator: ɉ邦夝ɷ1傹Þ袳@ɲ鉴 + matchLabelKeys: + - "n" + namespaceSelector: {} + namespaces: + - 88M + - fIEJUewFK + topologyKey: i + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: [] + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 1372450161 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -913177144 + periodSeconds: 912808843 + successThreshold: -765941931 + timeoutSeconds: 1174210794 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 1666039794 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 989921147 + periodSeconds: 536392931 + successThreshold: 1020018972 + timeoutSeconds: 1790731281 + resources: {} + securityContext: + capabilities: + drop: + - ɿX齀蹪 + privileged: true + procMount: Ƚ[孠犥ƶʒ)遷U竕 + runAsGroup: 5229411704597624000 + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: U6f3w + name: ooYxXE + subPath: "" + - mountPath: qzOMXCl + name: Hmms9 + subPath: "" + - mountPath: dXa6uPxR + name: "" + subPath: "" + - mountPath: q + mountPropagation: 跐ʩ4鄧SD炿ɜǚhU + name: "" + subPath: SCLzbAMUW3x + subPathExpr: nzFw + - mountPath: cX8U + mountPropagation: b幈簇@艭K + name: b + readOnly: true + subPath: u5fY + subPathExpr: TRymQ + imagePullSecrets: [] + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: + ggwC: SQ + rIwToCbB: tUBM5 + priorityClassName: JnI8 + securityContext: + fsGroup: -2594082004410587000 + fsGroupChangePolicy: 'ċV1鯍E ' + runAsGroup: -880388195249084200 + runAsNonRoot: false + runAsUser: -9051010573896130000 + supplementalGroups: + - -2777109499517678000 + serviceAccountName: Utu8ZHG2 + tolerations: [] + topologySpreadConstraints: + - labelSelector: {} + maxSkew: -154369657 + minDomains: -319419210 + nodeTaintsPolicy: '#Vʅ糗斬ƈ橮IJȶ纀' + topologyKey: dTnKex + whenUnsatisfiable: '@OȤ驮Ʀ琓' + volumes: + - configMap: + name: qhaD + name: configs + - name: ooYxXE + secret: + defaultMode: 45 + secretName: LyH9zvv + - name: Hmms9 + secret: + defaultMode: 429 + secretName: zvR + - name: "" + secret: + defaultMode: 39 + secretName: PC2Ms7 + - name: LeIYAb + - name: 176OvjD + - name: b6NpMGfVo1N +--- +# Source: console/templates/ingress.yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + Lftu: PjroKEh + qvZJNWSzR: Jpoyc0 + creationTimestamp: null + labels: + "": h0uSAPIi + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: vLjrafvp + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + kuKPk7: "" + name: qhaD +spec: + ingressClassName: cAir + rules: + - host: o + http: + paths: null + - host: i18Wi + http: + paths: + - backend: + service: + name: qhaD + port: + number: 8080 + path: apsXYvp + pathType: 7q5 + - host: 8eBXg + http: + paths: + - backend: + service: + name: qhaD + port: + number: 8080 + path: cMbMbCQl + pathType: gJT + - backend: + service: + name: qhaD + port: + number: 8080 + path: XvfTwH + pathType: 4se + tls: + - hosts: + - fqD + - JDOgIG + secretName: vzUD + - hosts: + - M6H + - T + - twxgtsi + secretName: lg5siLdo +-- testdata/case-027.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: + "": ta51q + RW5sX: LXvP + creationTimestamp: null + labels: + Q0: "" + T4ZmAFi: nfIb0b + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: h9P + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 55C9f3 + namespace: default +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: + Gi0OSuP5jF: ARBECJB + qId: Bo + wPKI: "" + creationTimestamp: null + labels: + Q0: "" + T4ZmAFi: nfIb0b + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: h9P + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 61hunk + namespace: default +spec: + ports: + - name: http + port: 376 + protocol: TCP + targetPort: 473 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: h9P + type: G2gqK +--- +# Source: console/templates/ingress.yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + "": ZtbWlWc + y1ML9Hmg: d6h9 + creationTimestamp: null + labels: + Q0: "" + T4ZmAFi: nfIb0b + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: h9P + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 61hunk +spec: + ingressClassName: Ijdd3 + rules: + - host: chart-example.local + http: + paths: + - backend: + service: + name: 61hunk + port: + number: 376 + path: / + pathType: ImplementationSpecific + tls: + - hosts: null + secretName: x + - hosts: null + secretName: aSf1 +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "61hunk-test-connection" + namespace: "default" + labels: + Q0: "" + T4ZmAFi: nfIb0b + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: h9P + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - name: jkqm + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['61hunk:376'] + restartPolicy: Never + priorityClassName: bpi +-- testdata/case-028.yaml.golden -- +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + BKrxjHNg8: qlqPhj + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 5XQu4RW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: odFI2M4 +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: aM + kafka-sasl-aws-msk-iam-secret-key: pcNJ4lPh + kafka-sasl-password: OT9m4 + kafka-schema-registry-password: 4VybIhiIU + kafka-schemaregistry-tls-ca: FVWvaL5HS3DE + kafka-schemaregistry-tls-cert: UqZl + kafka-schemaregistry-tls-key: ch + kafka-tls-ca: 0h0Ac6CS + kafka-tls-cert: pNm4uHVMn + kafka-tls-key: "" + login-github-oauth-client-secret: 5XbGmlDmls + login-github-personal-access-token: y0PF13 + login-google-groups-service-account.json: w3 + login-google-oauth-client-secret: lEvrgxa + login-jwt-secret: SECRETKEY + login-oidc-client-secret: VfRrL3 + login-okta-client-secret: 1Gm + login-okta-directory-api-token: hgmY7AyguR + redpanda-admin-api-password: WvzP1D53 + redpanda-admin-api-tls-ca: dxtnG + redpanda-admin-api-tls-cert: Rs3rHA8Qdb + redpanda-admin-api-tls-key: 7hsD +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + BKrxjHNg8: qlqPhj + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 5XQu4RW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: odFI2M4 +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + BKrxjHNg8: qlqPhj + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 5XQu4RW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: odFI2M4 + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 5XQu4RW + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + VLzukyGLL5H: "" + creationTimestamp: null + labels: + BKrxjHNg8: qlqPhj + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 5XQu4RW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: odFI2M4 + namespace: default +spec: + replicas: 278 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 5XQu4RW + strategy: + rollingUpdate: {} + type: 砓涶rƀł庫x烮ȯ~茤įêŎZ姮Ⱦ + template: + metadata: + annotations: + YefFO9J: uVUZra + checksum/config: cc3f7478d926a8c80ab516ac0060a56c87bbbfdd227b765567fa8644fbee7f09 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 5XQu4RW + n8PG: NEb + sINjD1zSK: exkAcWK3 + yG: T + spec: + affinity: + podAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + 9yhGd: kXTYKV + xb5Co: trB98 + matchLabelKeys: + - gTre + - 3SLXY + namespaceSelector: {} + namespaces: + - q + - j3 + - k76qB + topologyKey: gz6KtIn43 + - labelSelector: + matchLabels: + 9slaN: 9Cv + M: NcJRMIAxd6 + f4JK: QX + matchLabelKeys: + - BGI9Dr + mismatchLabelKeys: + - SZUKIlPB + - WzTTmXWoFc + - wXLg9viobEw + namespaceSelector: + matchLabels: + MZx: u + NztFyV3: EvzmJzLQcn + topologyKey: iLs + - labelSelector: + matchExpressions: + - key: d3S + operator: ò洏ʓ暝歆Ű鈰钌鸔栵ù舁Tb曯ƫ貊ȵ + values: + - sanCz + - lZ + - 5rZ0 + matchLabels: + MEoILl9k: Jd + hVfX4: "" + "n": yhV + matchLabelKeys: + - HOI + namespaceSelector: + matchLabels: + fodO5ovc74m: lvF + mlCh: E1 + ve7: r4P5biTA + topologyKey: CtXr + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: wti + value: AYZm + valueFrom: + configMapKeyRef: + key: Sxryl + name: xXe78 + fieldRef: + apiVersion: HoyJsUxLKd + fieldPath: 2Ns + secretKeyRef: + key: w7WydZL + name: CgxV7 + optional: true + - name: eEKnv + value: BBAXaggk0n + valueFrom: + secretKeyRef: + key: GRP + name: dYBHtrO + optional: true + - name: KAFKA_SASL_PASSWORD + valueFrom: + secretKeyRef: + key: kafka-sasl-password + name: odFI2M4 + - name: KAFKA_PROTOBUF_GIT_BASICAUTH_PASSWORD + valueFrom: + secretKeyRef: + key: kafka-protobuf-git-basicauth-password + name: odFI2M4 + - name: KAFKA_SASL_AWSMSKIAM_SECRETKEY + valueFrom: + secretKeyRef: + key: kafka-sasl-aws-msk-iam-secret-key + name: odFI2M4 + - name: KAFKA_TLS_CAFILEPATH + value: /etc/console/secrets/kafka-tls-ca + - name: KAFKA_TLS_CERTFILEPATH + value: /etc/console/secrets/kafka-tls-cert + - name: KAFKA_SCHEMAREGISTRY_TLS_CAFILEPATH + value: /etc/console/secrets/kafka-schemaregistry-tls-ca + - name: KAFKA_SCHEMAREGISTRY_TLS_CERTFILEPATH + value: /etc/console/secrets/kafka-schemaregistry-tls-cert + - name: KAFKA_SCHEMAREGISTRY_TLS_KEYFILEPATH + value: /etc/console/secrets/kafka-schemaregistry-tls-key + - name: KAFKA_SCHEMAREGISTRY_PASSWORD + valueFrom: + secretKeyRef: + key: kafka-schema-registry-password + name: odFI2M4 + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: odFI2M4 + - name: LOGIN_GOOGLE_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-google-oauth-client-secret + name: odFI2M4 + - name: LOGIN_GOOGLE_DIRECTORY_SERVICEACCOUNTFILEPATH + value: /etc/console/secrets/login-google-groups-service-account.json + - name: LOGIN_GITHUB_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-github-oauth-client-secret + name: odFI2M4 + - name: LOGIN_GITHUB_DIRECTORY_PERSONALACCESSTOKEN + valueFrom: + secretKeyRef: + key: login-github-personal-access-token + name: odFI2M4 + - name: LOGIN_OKTA_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-okta-client-secret + name: odFI2M4 + - name: LOGIN_OKTA_DIRECTORY_APITOKEN + valueFrom: + secretKeyRef: + key: login-okta-directory-api-token + name: odFI2M4 + - name: LOGIN_OIDC_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-oidc-client-secret + name: odFI2M4 + - name: REDPANDA_ADMINAPI_PASSWORD + valueFrom: + secretKeyRef: + key: redpanda-admin-api-password + name: odFI2M4 + - name: REDPANDA_ADMINAPI_TLS_CAFILEPATH + value: /etc/console/secrets/redpanda-admin-api-tls-ca + - name: REDPANDA_ADMINAPI_TLS_KEYFILEPATH + value: /etc/console/secrets/redpanda-admin-api-tls-key + - name: REDPANDA_ADMINAPI_TLS_CERTFILEPATH + value: /etc/console/secrets/redpanda-admin-api-tls-cert + envFrom: + - configMapRef: + name: I6Dbq + optional: false + secretRef: + name: fhgE + optional: false + - prefix: L0m + - configMapRef: + name: pVHt + optional: true + prefix: 0xFYui3Ke2pJ + secretRef: + name: IBHH4sd + optional: false + image: qnkfx/ARBa:BetSp + imagePullPolicy: ȸ才TkâĆ8o + livenessProbe: + failureThreshold: -544797053 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 1464359845 + periodSeconds: -775253635 + successThreshold: -2065370772 + timeoutSeconds: 3873767 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 286014638 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -1755094379 + periodSeconds: 712612179 + successThreshold: 1265199044 + timeoutSeconds: 939664799 + resources: + limits: + H2g: "0" + requests: + i0vpd: "0" + piR58NXU: "0" + securityContext: + privileged: true + procMount: '`4乬+ʍÿȦ!常ʥ_' + readOnlyRootFilesystem: false + runAsNonRoot: true + runAsUser: 8119235947749130000 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - mountPath: hHTC4sQ + mountPropagation: ƭ埢Ş@ʮ擈Ɓsmďĝ + name: mVbo + subPath: bI + subPathExpr: q6R + - mountPath: "" + name: gC + readOnly: true + subPath: 5xyS + subPathExpr: Ju9L6o + imagePullSecrets: + - name: Nu2 + - name: j0 + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: + fD: q5Hun + priorityClassName: u8cTjKLB + securityContext: + fsGroup: -9123846953160880000 + fsGroupChangePolicy: UƻA竘锵]湞ȊM + runAsNonRoot: false + runAsUser: 2594597056592417300 + sysctls: + - name: 4eRaw + value: HnWeNFR + - name: 4hP + value: UoCU8Ni + - name: d + value: TpLFHKFo + serviceAccountName: 5zV + tolerations: + - effect: x)|綻%ŴC¸÷G) + key: 6c + operator: 皐łʨɆ挓R衯Ǫ诌ƍ爂vĂB麧尣Ć* + tolerationSeconds: 341291117142213700 + value: 45gIZCr + - effect: ɿ鎅ɸƱɿ韆頟R躦0P^,豐ƨe祠攇覙 + operator: ß¼ʐȻ*溃N妞 + tolerationSeconds: -7034164218355111000 + value: xb5 + topologySpreadConstraints: [] + volumes: + - configMap: + name: odFI2M4 + name: configs + - name: secrets + secret: + secretName: odFI2M4 + - name: 0nP + - name: 5Mq +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "odFI2M4-test-connection" + namespace: "default" + labels: + BKrxjHNg8: qlqPhj + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 5XQu4RW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - name: Nu2 + - name: j0 + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['odFI2M4:8080'] + restartPolicy: Never + priorityClassName: u8cTjKLB +-- testdata/case-029.yaml.golden -- +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + HzuQ: mCfbHBQ + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 3Wh + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + xi7L: ibI45 + name: HK +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + roles.yaml: |- + roles: + - null + - null +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + HzuQ: mCfbHBQ + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 3Wh + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + xi7L: ibI45 + name: HK +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: + 33Yi: tesf5 + creationTimestamp: null + labels: + HzuQ: mCfbHBQ + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 3Wh + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + xi7L: ibI45 + name: HK + namespace: default +spec: + ports: + - name: http + port: 389 + protocol: TCP + targetPort: 52 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 3Wh + type: sIQBZD +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + WVwaqt: gTMC + s6HZpOA: bc0 + sZaCXy: LXRQNTghxb1 + creationTimestamp: null + labels: + HzuQ: mCfbHBQ + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 3Wh + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + xi7L: ibI45 + name: HK + namespace: default +spec: + replicas: 385 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 3Wh + strategy: + rollingUpdate: {} + template: + metadata: + annotations: + IVy: ho3qpcI + checksum/config: ed80a6573dafe73ab884b6322e9c75c1018d618e61286f9e61f445266092293d + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 3Wh + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: hPtYq9oSSQ + operator: ŗ妃Mīú玢盛 + values: + - T0M + - aywAkbl + - key: F7yCY + operator: '2Pl@äEɜś`PȾ槯c:' + values: + - n7sIXrD6 + - 5EPSQgq3v + matchFields: + - key: wOOgY + operator: 乾Ǧ + values: + - GqfE + - key: gRF5bu + operator: DŸQ95ʊÊj蕵髪OHōM4Ľɝ钣 + values: + - 2rEXM1C + - BB + - key: TK75p + operator: 譌嵡荀Ș枻賿ė + values: + - MHB + - sI + weight: -1638497382 + - preference: + matchExpressions: + - key: sgUr6t + operator: ʁE'[剳嫯Ȧ梳*&櫺窟ľ幣ɥ{紌 + values: + - 6x + - NRmDb1X + - key: VrZW4eZ + operator: 蘨ȘÚ籘J嬋JƒÎhUl田U + values: + - 0cG6ed0 + - I + - key: Ui + operator: 遂樸tUŏǞF)橷嵱 + values: + - mUT9H9 + matchFields: + - key: zzI6 + operator: ƈ肶帅ʒb漄i + values: + - 9Xi0r + - key: Bm + operator: 嚏鈻峓霙ʊcʔ暏g圖鹔夺mą¹跑 + values: + - tvOC + weight: 1006541829 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: ZlUi + operator: ʯ鼙%淹ȏ č>稄鱑Í朹s狑Ȱ螪;ǃ嘲 + values: + - gIlS + - 5lD7AvT7I + - "8" + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: hi0zfFEN + operator: 裧禿 + values: + - SymXRnv + - iKr + mismatchLabelKeys: + - wesfXhv + - Z78yvK + namespaceSelector: + matchExpressions: + - key: jqHt + operator: ûų:碃;ė燱5ìb-垢xźɆ + values: + - u8cOuqy + matchLabels: + "8": nCrnu + Fd: 5YhLJD3 + r5sMi70hp4TeB: KrDX7d + namespaces: + - LOH + - 9EvOI7HWh + - 5sHJp + topologyKey: "" + weight: 403248696 + - podAffinityTerm: + mismatchLabelKeys: + - Vrf + namespaceSelector: + matchExpressions: + - key: 5w + operator: '|泀ŏ咙ƚ' + matchLabels: + 4vRvwhR: Nz + T6uTCUGiwx: lS + ZuFER: Db8xhFevK + topologyKey: K7NA + weight: 249855905 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: No2 + operator: Ɗ]鿇躠骐 + matchLabels: + 7nohEoAMei: WrMV + ddLK: 2ehkh + qtrhf: EAAqHFcrjgT + mismatchLabelKeys: + - DrrBoq + - Nh + namespaceSelector: + matchExpressions: + - key: BEXHPr1wQ + operator: 傝魦voȪwć撈 + values: + - i3 + - gUU + - 7nmbvkGs + matchLabels: + Rh65F: rKR + namespaces: + - 1x9DGG + - xKj137E + topologyKey: CSNQy1M + - labelSelector: + matchExpressions: + - key: psq4G + operator: ɓƦ + - key: 3IlNf + operator: ćȬ4鏉1, + values: + - L0 + namespaceSelector: + matchExpressions: + - key: nVgt + operator: ɤ湿ŭò-ɋ鼴)箥Ȅ鋖ʄBK + - key: GD7 + operator: 峄9ƚ涙閉ʃ謩云飠:鎂玚wƁȖ] + values: + - i8cg6A + - TeOYSsj + topologyKey: rEB + - labelSelector: + matchLabels: + s0PrY366si5H: Qwj + ytBgNf0: e + mismatchLabelKeys: + - eylzvu + - q + namespaceSelector: + matchExpressions: + - key: os4H6DpxQ + operator: 5õċ鋵葿葄痄ɍ览逪ȋ`j + matchLabels: + vL3arho: gPmLG + namespaces: + - PjQTIWTFeK + - g5HCelWpMjnF + - QN3mXW + topologyKey: I5osiWTrzhb + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: HK + envFrom: [] + image: nZ5PG/5q2qCT:z10JAfCu + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: -1989869025 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 56050789 + periodSeconds: 193173949 + successThreshold: -1606638368 + timeoutSeconds: -1117024654 + name: console + ports: + - containerPort: 52 + name: http + protocol: TCP + readinessProbe: + failureThreshold: -509957017 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 1816814831 + periodSeconds: 406466643 + successThreshold: 450108513 + timeoutSeconds: -1862950899 + resources: {} + securityContext: + allowPrivilegeEscalation: true + capabilities: + drop: + - 邻ȸNJ"纴ý汫篤訙铵寄貹Z[逗ą弣 + - lǀ敕ɖ + privileged: true + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 3375680259081538600 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - mountPath: P + name: zBgE7HVQ + subPath: hw6PBLgv5R + subPathExpr: YAI5mPj5 + - args: + - K9 + - 02olyp + env: + - name: F + value: rhVGTadjT + valueFrom: + configMapKeyRef: + key: 3TA0cg2R2 + name: DLZ + fieldRef: + apiVersion: s + fieldPath: Ux + resourceFieldRef: + containerName: avop + divisor: "0" + resource: itl5J4xK4 + secretKeyRef: + key: Av9eKok + optional: false + - name: QaOLYDLT + value: FQu + image: 1MFnpZG + imagePullPolicy: 脓 + livenessProbe: + exec: + command: + - lH4S + failureThreshold: 1311534645 + grpc: + port: 1048835191 + service: p5EtELTs + httpGet: + path: Zjrv + port: Ypah5av + scheme: þʙ龠ȉ%Vę皓ŏ蟝ǙĿìɋN + initialDelaySeconds: 1980070741 + periodSeconds: -728109708 + successThreshold: 1412960079 + terminationGracePeriodSeconds: 4797597904045468000 + timeoutSeconds: -1164059804 + name: oron + readinessProbe: + failureThreshold: -1734715333 + grpc: + port: -673781482 + service: 20iHh + initialDelaySeconds: 270804414 + periodSeconds: 1240219458 + successThreshold: 957649997 + terminationGracePeriodSeconds: -7921460752123720000 + timeoutSeconds: 2069469191 + resizePolicy: + - resourceName: M29 + restartPolicy: tL + - resourceName: WK + restartPolicy: T軂>ȋ1觫蚴Ș + resources: + limits: + KS: "0" + ZDx: "0" + kIjQHQZ: "0" + requests: + BSB: "0" + restartPolicy: LJW獮 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ɺ嚹晐囕胐ƻ + - ņɹ桴O塾q6賤呋f铰}Ʒ輽ʁ[顝 + runAsGroup: 6868723237582569000 + runAsNonRoot: true + runAsUser: 433131246318901200 + startupProbe: + exec: + command: + - mB6 + - Om9w + - "" + failureThreshold: -1184477652 + grpc: + port: -1276243610 + service: m6d + httpGet: + host: VzPuwIiTpY + path: C + port: 0NYj1C + scheme: V=@彆鈂t³Ɉµs斾m蛊ɲ + initialDelaySeconds: -898287287 + periodSeconds: -413255468 + successThreshold: -1510482870 + terminationGracePeriodSeconds: 4884332649151511000 + timeoutSeconds: -1445193311 + stdinOnce: true + terminationMessagePath: DQTH7 + terminationMessagePolicy: ÈɁ;ň);ɑI×ĕ觫'ɣ + volumeDevices: + - devicePath: v + name: AZ6wCimJFM + - devicePath: ZtIx + name: GFe3 + volumeMounts: + - mountPath: tt + mountPropagation: 侮E墝調cé攊疀" + name: UJ + readOnly: true + subPath: JlqP + subPathExpr: lA2v + workingDir: OV90 + - command: + - 8jHRuz + envFrom: + - configMapRef: + optional: false + prefix: yfl3PI + secretRef: + name: r7eR + optional: true + image: m4Etaoz8Bf + imagePullPolicy: okÛļ閷YƗzƄǧ + lifecycle: + postStart: + exec: {} + httpGet: + host: zu9aQLsX + path: xIFogzAoC + port: 1MjUE + scheme: 斔疏ʟn菝 + preStop: + exec: {} + livenessProbe: + failureThreshold: -1399917612 + grpc: + port: -876522011 + service: 2y + httpGet: + host: X9nNdf + path: 8mVJlz + port: 220487349 + scheme: 兇)hr裳ǔ湟钑>ȓn厠tū晣颊 + initialDelaySeconds: -968878635 + periodSeconds: 411754743 + successThreshold: 2083381130 + terminationGracePeriodSeconds: 2736468416107855400 + timeoutSeconds: -423937148 + name: Or + readinessProbe: + failureThreshold: 1628351372 + grpc: + port: -1466105410 + service: b + httpGet: + host: 8kOz + path: IhSlrBw8tiX + port: 1Vd + scheme: qV·dƖ> + initialDelaySeconds: 735135195 + periodSeconds: -175995819 + successThreshold: 1379601279 + terminationGracePeriodSeconds: 386635447886660740 + timeoutSeconds: 125503732 + resources: + limits: + LuudLJ9i: "0" + iXpYUWY: "0" + mHi: "0" + requests: + XLnFU: "0" + mSq9e3u: "0" + t6WYwzmga: "0" + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - ɭ鎣肪綢ȀNj8)屫鈄骸嗢æ憰qWTƶ剡 + - "n" + - OwkʙƝk}ɾ丧< + drop: + - Ť<嶼ȯ愉9宆嵧pɡ%ɐxė鹞鸵鏞 + - ƅgʆ炊ƞąÙ$Ǯ帶SȔ黌畕ǦƖȫV9 + - Ŏʠ羮ɍ痘摬 + privileged: true + runAsGroup: 5710532895986022000 + runAsUser: -7207500526873246000 + startupProbe: + failureThreshold: 2053062827 + grpc: + port: -1076044334 + service: s8s7 + initialDelaySeconds: 7348194 + periodSeconds: 889500482 + successThreshold: -645465298 + terminationGracePeriodSeconds: 4356974427366500000 + timeoutSeconds: 136481601 + stdinOnce: true + terminationMessagePath: t4pW + terminationMessagePolicy: ƣ + volumeDevices: + - devicePath: Df8O3UFZ + name: QL93u + - devicePath: WKg + name: nD4H + volumeMounts: + - mountPath: xs9 + mountPropagation: e羝ș+oũ蘘汉 + name: grr + readOnly: true + subPath: aUYSuUM6f + subPathExpr: mm773yL + workingDir: o + imagePullSecrets: [] + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: + Jy9: v + VcMeUW2U: xOwcDQYY + wkI: TbemvxUUg + priorityClassName: sLkcwZ + securityContext: + fsGroup: 99 + runAsGroup: -9040107238323409000 + runAsNonRoot: false + runAsUser: 99 + serviceAccountName: 43zobnL + tolerations: + - effect: 蜆³Ə抴璖獍ä鷲炥/=霒0ǷU伀稂ı + key: EMvrrkeG3 + operator: Ȓǒs夃Ȑɉ鋄蛓m÷,旂 + value: yd + - effect: 旌;"ȡ媟窐:ljʥh蓭殰Ȩƴ邃ȬIȻL + key: n87GpiB + operator: '偵~ȥʢȈ珎ſ龕5sʠŇưT4-§Ƀ ' + value: TUaznROmQffrRe1 + topologySpreadConstraints: [] + volumes: + - configMap: + name: HK + name: configs + - name: secrets + secret: + secretName: HK + - name: "" + - name: SXJ +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "HK-test-connection" + namespace: "default" + labels: + HzuQ: mCfbHBQ + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 3Wh + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + xi7L: ibI45 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['HK:389'] + restartPolicy: Never + priorityClassName: sLkcwZ +-- testdata/case-030.yaml.golden -- +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + T: f0 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: J + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + jwrBMvwfg: K6I5HsI5 + nk8eJc: nS + name: G9 +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: DtIy + kafka-sasl-aws-msk-iam-secret-key: 9xCf7 + kafka-sasl-password: 8F + kafka-schema-registry-password: krNk2 + kafka-schemaregistry-tls-ca: 5I73C + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "34" + kafka-tls-ca: DaT + kafka-tls-cert: LaU0jwOpGv + kafka-tls-key: "" + login-github-oauth-client-secret: BoOjni + login-github-personal-access-token: uUxZ + login-google-groups-service-account.json: NulwlJ + login-google-oauth-client-secret: oeL6p7fcL + login-jwt-secret: SECRETKEY + login-oidc-client-secret: yRSh2 + login-okta-client-secret: xKLBJ9ZAR + login-okta-directory-api-token: HTZWfHt + redpanda-admin-api-password: 5DQTqKD + redpanda-admin-api-tls-ca: m5pg + redpanda-admin-api-tls-cert: yfP + redpanda-admin-api-tls-key: gzG +type: Opaque +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + T: f0 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: J + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + jwrBMvwfg: K6I5HsI5 + nk8eJc: nS + name: G9 + namespace: default +spec: + ports: + - name: http + port: 250 + protocol: TCP + targetPort: 475 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: J + type: QAVsE +--- +# Source: console/templates/hpa.yaml +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + creationTimestamp: null + labels: + T: f0 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: J + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + jwrBMvwfg: K6I5HsI5 + nk8eJc: nS + name: G9 +spec: + maxReplicas: 10 + metrics: + - resource: + name: cpu + target: + averageUtilization: 227 + type: Utilization + type: Resource + - resource: + name: memory + target: + averageUtilization: 477 + type: Utilization + type: Resource + minReplicas: 306 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: G9 +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "G9-test-connection" + namespace: "default" + labels: + T: f0 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: J + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + jwrBMvwfg: K6I5HsI5 + nk8eJc: nS + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - name: wu1 + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['G9:250'] + restartPolicy: Never + priorityClassName: KuRS +-- testdata/case-031.yaml.golden -- +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + role-bindings.yaml: |- + roleBindings: + - {} + - {} + roles.yaml: |- + roles: + - {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: xknw + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + q4ZdG9q: IJWaYu9mhun + sFTTcyl: qVyaa0ULC + name: 59cQ0qKLI +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: xknw + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + q4ZdG9q: IJWaYu9mhun + sFTTcyl: qVyaa0ULC + name: 59cQ0qKLI + namespace: default +spec: + ports: + - name: http + port: 112 + protocol: TCP + targetPort: 375 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: xknw + type: N9chrF +--- +# Source: console/templates/hpa.yaml +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: xknw + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + q4ZdG9q: IJWaYu9mhun + sFTTcyl: qVyaa0ULC + name: 59cQ0qKLI +spec: + maxReplicas: 25 + metrics: + - resource: + name: cpu + target: + averageUtilization: 460 + type: Utilization + type: Resource + - resource: + name: memory + target: + averageUtilization: 169 + type: Utilization + type: Resource + minReplicas: 20 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: 59cQ0qKLI +--- +# Source: console/templates/ingress.yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + Q: 3KXvHleq + YUY: BD + mdCRk: Ilk9wDjAw + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: xknw + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + q4ZdG9q: IJWaYu9mhun + sFTTcyl: qVyaa0ULC + name: 59cQ0qKLI +spec: + ingressClassName: GuB1VTCp + rules: + - host: WsTbK7W + http: + paths: + - backend: + service: + name: 59cQ0qKLI + port: + number: 112 + path: MKCR56 + pathType: hEV + - backend: + service: + name: 59cQ0qKLI + port: + number: 112 + path: "6" + pathType: pv + - backend: + service: + name: 59cQ0qKLI + port: + number: 112 + path: rNv + pathType: L0CY1c8 + - host: OxFD + http: + paths: null + - host: Ojx + http: + paths: null + tls: + - hosts: + - C + - wxjmQWXDn + secretName: ESgom5IBQR +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "59cQ0qKLI-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: xknw + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + q4ZdG9q: IJWaYu9mhun + sFTTcyl: qVyaa0ULC + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - name: 2Ry3vDGf6 + - name: PE5R + - name: uWsoZ + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['59cQ0qKLI:112'] + restartPolicy: Never + priorityClassName: mFg +-- testdata/case-032.yaml.golden -- +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + role-bindings.yaml: |- + roleBindings: + - K8wnWSD: null + bwYE7: null + y4j: null + - GvFfKdgL: null + enU8G4: null + wvnJcOn: null + - td7: null + roles.yaml: |- + roles: + - YQBucbbDX2R: null + - 2UuDKjR: null + IV0Yus9: null + ci20SljQkhw: null +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + B19ue: 8W + Kxm5R1: R + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: wB + app.kubernetes.io/version: v2.7.0 + e3Cx: MIAO + helm.sh/chart: console-0.7.29 + name: llK4G +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + B19ue: 8W + Kxm5R1: R + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: wB + app.kubernetes.io/version: v2.7.0 + e3Cx: MIAO + helm.sh/chart: console-0.7.29 + name: llK4G + namespace: default +spec: + ports: + - name: http + port: 418 + protocol: TCP + targetPort: 486 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: wB + type: aaIqePq +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + xpNWT: MpOZ + creationTimestamp: null + labels: + B19ue: 8W + Kxm5R1: R + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: wB + app.kubernetes.io/version: v2.7.0 + e3Cx: MIAO + helm.sh/chart: console-0.7.29 + name: llK4G + namespace: default +spec: + replicas: null + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: wB + strategy: + rollingUpdate: {} + type: ȁ进辫fu + template: + metadata: + annotations: + checksum/config: ae52af057e6331e5caa1d321881f906df93659aa45a5458c4dd4ae890cf7695b + creationTimestamp: null + labels: + So: waKMMvnY + VXPE0: 8ExVsj + app.kubernetes.io/instance: console + app.kubernetes.io/name: wB + ip1RGEzt4t6: "1" + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: {} + weight: 735732238 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: cFkyLM + operator: 岊B + - key: V3cKSq + operator: ǟ濈1ɑÎ"孲ȀŨFhŲ + values: + - hz + - matchExpressions: + - key: 8N + operator: 9´敤T + values: + - amWROpS + matchFields: + - key: 7hmWbsKS + operator: "" + values: + - lS + - slkOyX + - YlwPcdVh + - matchExpressions: + - key: n5YD + operator: Əüʢ軾ŚũɳnŒ + values: + - 5s4eD6x + - WMkZIzS40rxp + - zCnW + - key: JawyIOLo + operator: 巳c習Gnƛ{ɩ¯Ĭ枺lȜʩ泿趏ǙĊi + values: + - Fvzyw13fUZC + - 4w9T3GeG + - mVj9N + matchFields: + - key: 4amyTWvhx + operator: Ąŵ8雌%ɸ*W褒卒S + values: + - cPr0Nm2WFo1dBq + - a + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: XgsMMBS + operator: ȗ諹 + values: + - foI + - NN1yiUNR + matchLabels: + Qq: VB19aUlI + mismatchLabelKeys: + - hcD + namespaceSelector: + matchLabels: + vMT90cNq3PYf2z: upe + topologyKey: RSVn9W + weight: 603398420 + - podAffinityTerm: + labelSelector: {} + mismatchLabelKeys: + - 4IL0rEe9 + - yY0RMU2 + namespaceSelector: + matchExpressions: + - key: tIka9jS + operator: 7怘xə4ÏɦW + values: + - l + - ajs6c + - hkYj + - key: Qu + operator: ʊ鏀ɑ蒀刹gE + values: + - 2UvY + - hRB1wKXyHi9 + topologyKey: ZKWyn5kI + weight: -1674108352 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: KQfZ4 + operator: ġȁAu盝ȭƈŦ齬{z + values: + - itNS0T + - jL + - key: q0HemjU + operator: e銳ȇ葁õDÏ筃 + values: + - M5yeE + - gJJY + - HInHzXgX + - key: d1LKZ1 + operator: Q + matchLabels: + XElv: QGJ + nD: kNCk5qe + wUtw34v: sCjj5z + matchLabelKeys: + - ej9hOPjp7W + mismatchLabelKeys: + - lhU9gP + - T7rMlvu + namespaceSelector: {} + namespaces: + - ii3aa + topologyKey: 8U7 + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: CkQsu4fS + operator: 鄦&ɲȅ + values: + - RVnwZ + - EVk + - key: yt + operator: 傓N嬅宠H^÷ + values: + - 1L + - rVQPs + - dUHOKQ + - key: hQ1Tl + operator: ɣë筁尻!絜辩^riʨ莠8dƋ + values: + - 4D6Y + - 5TXh + - 8RH + matchLabels: + "9": jb2X + IdL: PQj0N + iB09Upiijt: JpN + matchLabelKeys: + - rKS9p8 + - sK8p + namespaceSelector: + matchExpressions: + - key: KQ6 + operator: '篛I6ÝBŘ F媍/:' + values: + - NXP47Fm + - Z0Qh2Y4 + - JeWX + - key: Yh + operator: '!j3W' + values: + - mTm5dkO58H + - "" + - key: 6q + operator: 景¨Sŝvo/ + values: + - TrgtrP + - zqIsId + matchLabels: + 7E3A1K: "7" + 63IlVL: aSxc + W1hP: 1H9k3O + namespaces: + - "" + - 2Ma + topologyKey: FFqt + - labelSelector: + matchLabels: + "": wklJJ + C8JZ: LP + U1pz: kAE1l4 + matchLabelKeys: + - shj5V + - oU074y + - Ufq2w + mismatchLabelKeys: + - oBzMiOSgd + - iSF + namespaceSelector: + matchExpressions: + - key: fCbLu + operator: 塊衅m鑀ȣ戢ŭ阻蹯ȟ獇ɨ + values: + - B6TgQ75 + - FAHTEOSesQ + - Ms2Kw7XQ + - key: 133fMqId + operator: "" + values: + - pJc0Zu8 + - T1PEuV0uism + matchLabels: + 1rfPa2b4Ny: cemR + Np9l: lcX + SjNYy4: VZX + namespaces: + - 7W + - umFBWrpUDHv + - "" + topologyKey: pPUIqPXo + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LICENSE + valueFrom: + secretKeyRef: + key: bujGpO7D0C + name: V + envFrom: + - configMapRef: + name: nJXDn + optional: true + prefix: g3ZpAEUJC + secretRef: + name: 5Yin + optional: true + - configMapRef: + name: spYG9o0 + optional: false + prefix: Wv01 + secretRef: + name: BxDbe + optional: true + image: mU/xY76Tj:AgKh6S1 + imagePullPolicy: "" + livenessProbe: + failureThreshold: 1396135036 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 1526591550 + periodSeconds: -972224922 + successThreshold: -39437670 + timeoutSeconds: -1229662908 + name: console + ports: + - containerPort: 486 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 1061708880 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 1618839364 + periodSeconds: -2098998213 + successThreshold: -846859522 + timeoutSeconds: 1824930679 + resources: {} + securityContext: + allowPrivilegeEscalation: true + capabilities: + drop: + - 退晦Ţ鲛 + - '}ʄ攏嫫;Mǐ豒ɇf,搅Ð貑ș|Óf' + privileged: false + procMount: D + readOnlyRootFilesystem: false + runAsGroup: 1564095685271138800 + runAsNonRoot: true + runAsUser: -3929576237300142600 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - args: + - T + - Pvf1yAamEa + - jQE8UakuY + env: + - name: 3g + value: JexRP + valueFrom: + configMapKeyRef: + key: QZ + name: QcC + optional: true + fieldRef: + apiVersion: Iv + fieldPath: d7xQ + resourceFieldRef: + containerName: jLpJ + divisor: "0" + resource: m + secretKeyRef: + key: Quhh + name: HUhzPAEo85 + optional: true + - name: ehSBff + value: nHu + valueFrom: + configMapKeyRef: + key: v3Icanu + name: dNPJ8 + optional: false + fieldRef: + apiVersion: xO7UQDq0 + fieldPath: gAyGB6Nj4 + resourceFieldRef: + containerName: Bs2D + divisor: "0" + resource: xJCQsH + secretKeyRef: + key: 3T6tjIQWa0C + name: 8TvRbhP + optional: false + envFrom: + - configMapRef: + name: mf + optional: false + prefix: pZxp + secretRef: + name: v + optional: true + - configMapRef: + name: wosjc9 + optional: true + prefix: ehhmFeLY + secretRef: + name: Ll + optional: false + image: kZ8UUm + imagePullPolicy: Ɓ + lifecycle: + postStart: + exec: {} + httpGet: + host: K29SzZPo + path: y2bQL8 + port: Cr + scheme: 轂Ì蕏ʋ + sleep: + seconds: -3765902632580054500 + preStop: + exec: + command: + - 1pT5X + httpGet: + host: NouEQF + path: WITzSW + port: 1565482371 + scheme: ƒ塒廛鎐藽瀫 + sleep: + seconds: 1831382645860082000 + livenessProbe: + exec: {} + failureThreshold: -1525719681 + grpc: + port: 99688681 + service: xa0sl3k5KM + httpGet: + host: prjHPqf + path: RHwZIE + port: 2UZ7hXI + scheme: 瑀ċ廤ȵ + initialDelaySeconds: -1367665605 + periodSeconds: -1023789296 + successThreshold: 206844073 + terminationGracePeriodSeconds: -3901072071078889000 + timeoutSeconds: 1670691424 + name: t + ports: + - containerPort: 2046398071 + hostIP: pJg + hostPort: -1247541550 + name: DrYeHQ6 + protocol: ²ȑBŸ + readinessProbe: + exec: {} + failureThreshold: 852505381 + grpc: + port: 8093048 + service: "N" + httpGet: + host: uuaPC + path: Mpxk6p + port: -297149767 + scheme: 這伦礗鯪àe]雚腴k£ɂ闧ɦĚH鏰浳 + initialDelaySeconds: 296244720 + periodSeconds: 1237321103 + successThreshold: 722306410 + terminationGracePeriodSeconds: 7739978307238029000 + timeoutSeconds: -2129506856 + resizePolicy: + - resourceName: NBfNOBC + restartPolicy: ƞdWǝi鎠R殩杜Ś晚尒尧ǐ; + - resourceName: oDw8xEb + restartPolicy: ja侬ƕ + resources: + limits: + BJcVkW: "0" + Ub5Spt: "0" + nWi63TNlCyM: "0" + requests: + e5vcw0H: "0" + eKz0z: "0" + gK: "0" + restartPolicy: 嗈ǒɟNǭ臥穥Ť + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - $拷霒Ø耖} + - ijĸN藬?w粯痵餒薃辕5勅ů + - 幒Ƹʁòĺǂ浼GX + drop: + - 宖 + privileged: true + procMount: 凝 + readOnlyRootFilesystem: false + runAsGroup: -7000080292188881000 + runAsNonRoot: false + runAsUser: 9107304642056619000 + startupProbe: + exec: {} + failureThreshold: -208121509 + grpc: + port: 133215347 + service: pj4Kw + httpGet: + path: hGLW3 + port: -239286046 + scheme: YsÌǮŦʁ¡ē峪3 + initialDelaySeconds: -817672524 + periodSeconds: 1846655614 + successThreshold: -243958761 + terminationGracePeriodSeconds: 4190490525804645400 + timeoutSeconds: -973067987 + terminationMessagePath: 9vMe3Y + terminationMessagePolicy: 雍Wȯ嘷台厃$Țʍ13b霞两e + tty: true + volumeMounts: + - mountPath: yZbL + mountPropagation: 鲫絎Q(銞ÎÕX堙Ľ銃曅注t锋ɮj覧« + name: UFfAqsgd + subPath: wSo + subPathExpr: bIsBP3O + workingDir: DYBcINRq + - command: + - wgBryFN + image: NorbK + imagePullPolicy: 鉓Ĕʠ;兮)Frë + lifecycle: + postStart: + exec: {} + httpGet: + host: Z + path: 3v + port: W1vDkt + scheme: ŷ索gp=ŵāǼ餆嬦Ƹl媓R}豟ɠĖ. + sleep: + seconds: 1583583004300077000 + preStop: + exec: + command: + - XztEol6So + - GveA + - H4aUl + httpGet: + host: 75LDW + path: nu + port: I + scheme: 胛Uȁ¬ + sleep: + seconds: 4617693270470586000 + livenessProbe: + exec: {} + failureThreshold: 1423393786 + grpc: + port: 2097410769 + service: "" + httpGet: + host: W7 + path: PyPprD6 + port: dHwCyz + initialDelaySeconds: -1439644816 + periodSeconds: 182024489 + successThreshold: -1861505070 + terminationGracePeriodSeconds: -4166230023615503400 + timeoutSeconds: -704907360 + name: sFz5 + ports: + - containerPort: 1977465061 + hostIP: kxqRig + hostPort: 393211643 + name: DRO + protocol: ķǔȈ + readinessProbe: + exec: + command: + - mn + - 4TZCjrWPW18 + failureThreshold: 972699487 + grpc: + port: -1384519737 + service: IY5quWWV4JC + httpGet: + host: wq91i + path: Zy + port: -1192576969 + scheme: Á^_ + initialDelaySeconds: 2107832874 + periodSeconds: 1041520026 + successThreshold: -118135340 + terminationGracePeriodSeconds: -4946782594204673000 + timeoutSeconds: -1933961678 + resizePolicy: + - resourceName: MG7PMkMMObJJU + restartPolicy: §觫困Ȏ龝ƃȃɩ芴ÎĽ + resources: + requests: + I4: "0" + zLy: "0" + restartPolicy: 粛醑綇蝙Ɣò犁鶓A + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - 掀ǃA颺LnFąɏ動 + drop: + - 输6sĺ宯hĢ + - ĨƨO檔暰z + - Neɬ慿Ȁ0ɳ蠈ǚǦO¸Ğ崔ʂ¢剚 + privileged: false + procMount: 翄怉DžǬ?胉獄ǙƊɚx虉F + readOnlyRootFilesystem: false + runAsGroup: -1943526545280953900 + runAsNonRoot: true + runAsUser: -7089742793545457000 + startupProbe: + exec: + command: + - hDj + - ONyz91fkTFY9t3 + - ynDWkO + failureThreshold: -5561223 + grpc: + port: -1069825885 + service: oQmy + httpGet: + path: l4sWc + port: 53AhP + scheme: ȩ + initialDelaySeconds: -6165070 + periodSeconds: 1844899228 + successThreshold: 903779261 + terminationGracePeriodSeconds: -3909221818854749700 + timeoutSeconds: 746670574 + stdinOnce: true + terminationMessagePath: egr00cLki + terminationMessagePolicy: ɯ2鰌^坪yN蠏Ĵ + tty: true + volumeMounts: + - mountPath: YOyu1MjxN2 + mountPropagation: :鸛o鮓L`<]ơ1b忙n鲃{< + name: dODfVz + subPath: ZknFq + subPathExpr: oX1n + - mountPath: 4TEsoc + mountPropagation: 帺Õ斯剅ƫf鳌麓HƸŘÂ瘖?謾軌 + name: hau + subPath: w24Wq4e + subPathExpr: i2TEix + - mountPath: uuujj + mountPropagation: 氻ʃ2NFJ啼铗"O{À-ŧLJ弟 + name: klnXhhnxKk + subPath: SEx + subPathExpr: CK2FmmyYThL + workingDir: NCvZAa + imagePullSecrets: [] + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: + ih: xT3Dk3PXT + xhq: vu + zLR9: wFjrfu + priorityClassName: WeB9y8 + securityContext: + fsGroup: 7101468120327600000 + fsGroupChangePolicy: ȴ鳁ƨ殳h`熡ƍʊ0ŀ擳琗图.AƱX滋 + runAsGroup: 4262945102741077000 + runAsNonRoot: false + runAsUser: -9214274730002703000 + supplementalGroups: + - 4135587743067906600 + - -2908166639165702700 + sysctls: + - name: Yo9 + value: zak2 + serviceAccountName: zpH + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: llK4G + name: configs + - name: 1zZI6J + - name: D + - name: OUqOnvjvba +--- +# Source: console/templates/hpa.yaml +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + creationTimestamp: null + labels: + B19ue: 8W + Kxm5R1: R + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: wB + app.kubernetes.io/version: v2.7.0 + e3Cx: MIAO + helm.sh/chart: console-0.7.29 + name: llK4G +spec: + maxReplicas: 459 + metrics: + - resource: + name: cpu + target: + averageUtilization: 497 + type: Utilization + type: Resource + - resource: + name: memory + target: + averageUtilization: 146 + type: Utilization + type: Resource + minReplicas: 198 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: llK4G +--- +# Source: console/templates/ingress.yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + Lhm: f24CRNEJvs + pk6fq: "2" + creationTimestamp: null + labels: + B19ue: 8W + Kxm5R1: R + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: wB + app.kubernetes.io/version: v2.7.0 + e3Cx: MIAO + helm.sh/chart: console-0.7.29 + name: llK4G +spec: + ingressClassName: EXqR + rules: + - host: chart-example.local + http: + paths: + - backend: + service: + name: llK4G + port: + number: 418 + path: / + pathType: ImplementationSpecific + tls: + - hosts: + - xEciJGskt + - pBxfBltrqACoat + - INyj + secretName: Qy + - hosts: + - F6sf + - EHuJ + - 95my0 + secretName: XOIr +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "llK4G-test-connection" + namespace: "default" + labels: + B19ue: 8W + Kxm5R1: R + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: wB + app.kubernetes.io/version: v2.7.0 + e3Cx: MIAO + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['llK4G:418'] + restartPolicy: Never + priorityClassName: WeB9y8 +-- testdata/case-033.yaml.golden -- +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + role-bindings.yaml: |- + roleBindings: + - 7x: null + Ia1K2tdRuYi: null + j6c9: null + roles.yaml: |- + roles: + - {} + - 6Vndf: null + f: null +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: bCPeYVWao + app.kubernetes.io/version: v2.7.0 + gZ85uw3T: e + helm.sh/chart: console-0.7.29 + qO: F4dqLo67vKYZ + name: foGC +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: + lrtdFF: 60R7 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: bCPeYVWao + app.kubernetes.io/version: v2.7.0 + gZ85uw3T: e + helm.sh/chart: console-0.7.29 + qO: F4dqLo67vKYZ + name: foGC + namespace: default +spec: + ports: + - name: http + port: 229 + protocol: TCP + targetPort: 59 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: bCPeYVWao + type: 2K35 +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: bCPeYVWao + app.kubernetes.io/version: v2.7.0 + gZ85uw3T: e + helm.sh/chart: console-0.7.29 + qO: F4dqLo67vKYZ + name: foGC + namespace: default +spec: + replicas: 390 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: bCPeYVWao + strategy: + rollingUpdate: {} + type: 呇弰$腕煴贔棳軀+œʃǀŖ* + template: + metadata: + annotations: + checksum/config: b3a4b261d0705e207d46ac15067d5c7d7c951cf0c0fa7736607331369bd47b6d + creationTimestamp: null + labels: + 1bb6: "" + 3U: mfPv + T: Q + app.kubernetes.io/instance: console + app.kubernetes.io/name: bCPeYVWao + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchFields: + - key: 1O + operator: 拺5ř(Ƅ餕ʟ{鐻Ƈ + weight: -2070567569 + - preference: + matchFields: + - key: JlGR + operator: 脱?ĶA蛜頒ǽGǷ藸 , + values: + - 8zZEVom + - TY + - FSSQQ + - key: w3C + operator: sɯeM^筘褑 + values: + - Q + - i48uKb + weight: -1969968900 + - preference: + matchExpressions: + - key: ZsgVr + operator: Eȗ + - key: RfMZL + operator: "" + - key: r + operator: džɬ毿鵮V町iAÉ橁zy题ʔu7ÆO9 + values: + - uj8h + matchFields: + - key: "" + operator: :止褮Ȃ宸 + values: + - 9h + - Do + weight: 1160212382 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: nmW + operator: '%U<Ȫk7家fƥ降]:' + values: + - e4hDXWb9G8Qi + - SynNDfUn + - C8kz + matchFields: + - key: QO0Q + operator: l!m0ʒbƹ豫ň + values: + - eh + - key: VE5mZtP + operator: ~x蹵#ÂvǗRɩ啭Ö澭肞¤7跜庛Ɍ + values: + - yT + - key: 1Cony + operator: 阃 + values: + - ahj6j + - matchExpressions: + - key: TvhlZutK + operator: 5叹ùz + values: + - rog + - key: qLPNTFw8 + operator: 藘鸘Œé溇ʄsoɷƱǺȾ蹾K混īl軇 + - key: F + operator: 則Yǹ郰饉貓伜ſ0|麊 az襽准 + matchFields: + - key: VcfFwmb + operator: WJMU狰槃žiǶq挿} + values: + - b7G + - "" + - wzxeij27DD + - key: "" + operator: 殀ǥ + values: + - "9" + - 0E3EkrfSX + - vzth + - key: omoz + operator: e´Ģ桇适TŽǤʈ + values: + - TVj0W7 + - 7HjUt2w + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: nN1614M7 + operator: '鰺/堅ý髉铊ɇƴ2友凇3 ' + values: + - D0tt + - sG9E + matchLabelKeys: + - l + mismatchLabelKeys: + - vqTKCL2D + namespaceSelector: + matchLabels: + LIgB: qqC9YL + namespaces: + - BLdVDzfY + - eq + - qB + topologyKey: qwces + weight: 899210618 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: hIz8wo + operator: ĥ\{ė + values: + - ZwYh1 + - 4l9U + - Q5Io + - key: sd3eCUDob + operator: 蒴ǚ<灁Q柷娸颂嘃üĸƢı + values: + - U0 + - "" + - WXJjoBRKrfEY + matchLabels: + QSrEl7t0: hxsiSGCubb + mismatchLabelKeys: + - PiUy + - VhBWFCyx6C + namespaceSelector: + matchLabels: + G: 07tU6 + ZCO1QQK: b + uq: HISLIo9ZC + topologyKey: 87eQuI + weight: 1750437304 + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: nK0RSDE + operator: R(陛m诜ȯơȴ豨躻 + matchLabels: + CE9: u8FukDT + U5N: "y" + matchLabelKeys: + - 5I6wiiY + - JDZsP + - zGyW + mismatchLabelKeys: + - 4WZHZ + namespaceSelector: + matchExpressions: + - key: N9E9 + operator: ȅ)礯占鷨ʫɩfǡnʎə掅Ux曶HŁ遐 + values: + - JdC + - 3NS25HFHxU + - key: "" + operator: ı獗& + - key: q + operator: 髢£Ȋ泽ZwVfc剻Ţ嬊j + topologyKey: "" + - labelSelector: + matchExpressions: + - key: Tof0 + operator: ĥM:ɑȏF叆綯炩藁û漄f + values: + - jTpj + - gYZ8IIq + - key: avL + operator: ɼƌ壟.敾¦ + matchLabels: + P1w: Nb9t3e + matchLabelKeys: + - TkIx94Dmu + - 8KVE + - UEJW + namespaceSelector: + matchExpressions: + - key: gQOOR5Pz + operator: Ȁ蛝畆粔辧殤,ǔžɨʜ + values: + - MiGt + topologyKey: nn1x + - labelSelector: + matchExpressions: + - key: C + operator: 瘎%瑧¹$兤 + values: + - p5TR + matchLabels: + c9PNRTZ: L + matchLabelKeys: + - 9xrNO + - saFgUzTD530EV + namespaceSelector: + matchExpressions: + - key: "" + operator: 琨j貙ŰĤ煾骣ƢƐ肾Q`ĥ?舶 + values: + - "7" + - T4pSI + - key: u0lbHcT + operator: čÉ壶霻*ǻ蠦Źê潡%!Ȱʁr.ň沀痊 + values: + - voUu0X + namespaces: + - tX + - uDgtoDt + topologyKey: "1" + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: RTz9f + value: kK5WtZCFpsl + valueFrom: + configMapKeyRef: + key: CB1UV + name: 0pF + optional: false + fieldRef: + apiVersion: xO4s + fieldPath: n2G + resourceFieldRef: + containerName: GmnwMQ + divisor: "0" + resource: yX30Dke4u + secretKeyRef: + key: vPbHh + name: oBAn1EoZmPzN + optional: true + - name: LICENSE + valueFrom: + secretKeyRef: + key: 9y6KmPZ + name: QM + envFrom: + - configMapRef: + name: lo + optional: false + prefix: mSdySXyKqEkl + secretRef: + name: t4daT3 + optional: true + - configMapRef: + name: IFTvBGq + optional: false + prefix: qKk6o + secretRef: + name: "4" + optional: true + image: JWsGq/JAUpWzFL:3WF1aV + imagePullPolicy: 躂Qʢ瞶CǁȮ + livenessProbe: + failureThreshold: 604102540 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 93396392 + periodSeconds: 1323534907 + successThreshold: 2044410955 + timeoutSeconds: -725304614 + name: console + ports: + - containerPort: 59 + name: http + protocol: TCP + readinessProbe: + failureThreshold: -1216486926 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -1636119248 + periodSeconds: -1587206371 + successThreshold: 1085720843 + timeoutSeconds: 1603673472 + resources: + limits: + HS: "0" + sspp8OAsyF: "0" + securityContext: + allowPrivilegeEscalation: true + capabilities: + drop: + - ɇǎȬ+丰DZ}薞ɎƐ + privileged: false + procMount: Ȧ杖煃a/ɓ<3ő+笽pȗdzSj + readOnlyRootFilesystem: true + runAsGroup: 8336843233603803000 + runAsNonRoot: true + runAsUser: 956863148985923500 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: WfYQ + name: v1bEam0d + subPath: "" + - mountPath: hpZaUwi + name: 2keqwtlu + subPath: "" + - mountPath: bCeiaipj + name: RAI0g6yvn + subPath: "" + - mountPath: gRGvu + mountPropagation: Ŋ4ǔ盍薟惮睌ȿ濍ȯȀüƳ$ + name: oJv65V + readOnly: true + subPath: P20XHtoR + subPathExpr: SzD + - mountPath: xhuwGvn + mountPropagation: 搛悈nj鰣*颵俠Ʀ慫灗岵ȆǴ騔Ė栢č)q + name: ebDa1q2nKt + readOnly: true + subPath: "6" + subPathExpr: N0xOT + - mountPath: xHTM + mountPropagation: 0關ɮUeŪ + name: P8noEsWy3t + subPath: y5E + subPathExpr: oP2A6C + - args: + - 3OUsoZkVHy + - Gn3 + command: + - NLtY + env: + - name: 51Xcm68sAs + value: PUTq + valueFrom: + configMapKeyRef: + key: udLx6h9 + name: wSgnPbc + optional: false + fieldRef: + apiVersion: oVPbc + fieldPath: CGK + resourceFieldRef: + containerName: Ind7j + divisor: "0" + resource: 9tlZc + secretKeyRef: + key: z2i + name: aloI0W + optional: true + - name: nGb + value: I91 + valueFrom: + configMapKeyRef: + key: Ft8IZO4DX + name: 7PY9CO1 + optional: false + fieldRef: + apiVersion: DysSUO + fieldPath: M + resourceFieldRef: + containerName: i + divisor: "0" + resource: mbVAnrQ + secretKeyRef: + key: ZVD + name: 4gLX + optional: true + - name: SEd7KC2 + value: I0 + valueFrom: + configMapKeyRef: + key: 71k + name: B + optional: true + fieldRef: + apiVersion: vJE + fieldPath: nvSzEcQ + resourceFieldRef: + divisor: "0" + resource: fYaXGkFYlrz + secretKeyRef: + key: xDT4Uhi + name: a + optional: false + image: NLoqH + imagePullPolicy: U肵銨龋搁}ŗ=;ī篱ɺ頁掆薑 + lifecycle: + postStart: + exec: + command: + - NAmBp8Ijy9vgKS + httpGet: + path: GukCZ + port: umdXEe + scheme: ɭL莒ƠĦZ¢.0tȠȴF梩¯牏GȐ + sleep: + seconds: 2463489515348869600 + preStop: + exec: + command: + - RAP7lxh + - 0WRf37xLvaEE + httpGet: + host: Xi + port: 395093084 + scheme: '}Ä*諓懚泾ıɥ磀>ȃÓ愍瘞5' + sleep: + seconds: -2989387296528249000 + livenessProbe: + exec: + command: + - AondI + - CvX + - X9Dwm + failureThreshold: -1669443788 + grpc: + port: 1602861347 + service: 5dF71q + httpGet: + host: yOYLS + path: m99M + port: 1421693426 + scheme: cǶ嫙x勬´筮 + initialDelaySeconds: -348887387 + periodSeconds: -855526929 + successThreshold: -1868658835 + terminationGracePeriodSeconds: 7220662525875544000 + timeoutSeconds: -893266456 + name: 62y7 + ports: + - containerPort: 41082986 + hostIP: H + hostPort: -671022955 + name: Q + protocol: Ģ + - containerPort: -676585553 + hostIP: jdTqIIXMX + hostPort: 441858691 + name: bam + protocol: ã鯑 + readinessProbe: + exec: {} + failureThreshold: -1607827734 + grpc: + port: -732628448 + service: d + httpGet: + host: q2uSglvPX + path: 5YB9kNfy37 + port: -425352890 + scheme: ZʇįʔÌ玫Ʊ儝$緀ƥǣ鮀 + initialDelaySeconds: 1646541382 + periodSeconds: 597275764 + successThreshold: 1444783765 + terminationGracePeriodSeconds: -4224719974242331600 + timeoutSeconds: 1778484407 + resizePolicy: + - resourceName: YWwAdc + restartPolicy: 蓊ƽqs洊蛀Ƴ澠誉 + resources: + limits: + 9c5: "0" + DJI: "0" + uyw: "0" + requests: + 7livK1: "0" + PWZFD5fFpVA: "0" + restartPolicy: ǐ踊丸y苡汎0塛yM眗酊L攚dzyÚmG + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - țƒ摨1娣Q札遢ʌā4魯 + drop: + - W~ + - ȮnLv|麬O稕Ʉ幖0Ţ&揵¸ + - àPĪɉɯ鋹芨ȲƿƛĞx + privileged: false + procMount: ɉq$|ŀ蘨寱彣ɎȈORe]O掓I + readOnlyRootFilesystem: false + runAsGroup: -2438856757446633000 + runAsNonRoot: false + runAsUser: -8511671649189409000 + startupProbe: + exec: + command: + - "" + failureThreshold: 157629836 + grpc: + port: -20533111 + service: vASy4b + httpGet: + host: 94HpH + path: t70 + port: W59mpID + scheme: ħ6琏 + initialDelaySeconds: -146258274 + periodSeconds: 47385732 + successThreshold: -1646222325 + terminationGracePeriodSeconds: -5575789846018255000 + timeoutSeconds: -351943504 + terminationMessagePath: r0ZY2 + terminationMessagePolicy: 傂G嶃a橢抴=Ȃĺ庆ɏ鬹揖絴鹥ɣ¸Ȫs + tty: true + workingDir: XFFilzd + - command: + - VSuU6yfyc8y + - gLgP + env: + - name: PSOr4 + value: m2ujo1f4 + valueFrom: + configMapKeyRef: + key: B9Gc + name: BaR3c + optional: true + fieldRef: + apiVersion: OFu + fieldPath: Pydi + resourceFieldRef: + containerName: jPiF + divisor: "0" + resource: jyp8A7uPD + secretKeyRef: + key: fcGCM + name: Hs + optional: false + - name: Ax9HfRa4p + value: S3R2 + valueFrom: + configMapKeyRef: + key: ZDzzhFD + name: soDgOej + optional: false + fieldRef: + apiVersion: iSfQ + fieldPath: Plzxy53z + resourceFieldRef: + containerName: DfBt3S + divisor: "0" + resource: 757s44h + secretKeyRef: + key: bn2IGjj + name: x8E + optional: false + - name: r + value: PmO + valueFrom: + configMapKeyRef: + key: Htzib1 + name: gfbsiTcDY + optional: true + fieldRef: + apiVersion: Frhab7p2yh + fieldPath: K6XKg + resourceFieldRef: + containerName: CLX + divisor: "0" + resource: cq + secretKeyRef: + key: R + name: zPHkUHXQ + optional: false + image: bSZCow + lifecycle: + postStart: + exec: + command: + - "y" + httpGet: + host: 2cDO + path: L5m + port: yhJI + sleep: + seconds: 6222265361848815000 + preStop: + exec: + command: + - yVT + httpGet: + host: Ibt0C5XF + path: Kf7kW1 + port: Tlj66QW + scheme: 砰僮 + sleep: + seconds: 4926532563180302000 + livenessProbe: + exec: {} + failureThreshold: 982752870 + grpc: + port: -257993986 + service: XKTDj + httpGet: + host: 7vfaAybCd + path: GuTTi + port: 1952486193 + scheme: 馾耼qȩ罔磙ɮƥŴ²叇yēņȮ藺 + initialDelaySeconds: -817095459 + periodSeconds: 603211453 + successThreshold: -1693358568 + terminationGracePeriodSeconds: 3002071779676479000 + timeoutSeconds: 992801771 + name: 9QZX + ports: + - containerPort: -1838828544 + hostIP: cQQMftB + hostPort: -321659395 + name: XBD7a + protocol: '>V>ŝO随;YƁ' + - containerPort: -439290918 + hostIP: Bp0lf + hostPort: 431013681 + name: WQ5qc + protocol: 髄Ĝ估螗ȳ鎷ʫh + readinessProbe: + exec: + command: + - PjwAB3G + - k + failureThreshold: -2015478850 + grpc: + port: 156976837 + service: RSgDfH + httpGet: + host: Yi7aQ + path: 8Ql9 + port: 1150587533 + scheme: C箿i綔ȍȢ ŅŴ娒燸孆5乬瓤Ɛ + initialDelaySeconds: -486757233 + periodSeconds: -994300453 + successThreshold: 2128356439 + terminationGracePeriodSeconds: 4683705418302065000 + timeoutSeconds: 1635565784 + resizePolicy: + - resourceName: deutsepb + restartPolicy: õ崑o¾oɞø°ŮƑ欩Ʋ + - resourceName: WaO + restartPolicy: ±蜊ư蕭材y昍U + resources: + limits: + XiOokB: "0" + gxJ8zn4y: "0" + requests: + "": "0" + RFaH: "0" + restartPolicy: 7岻ðȸɉo熮燍ȉ=n + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - 迠譚綞撪颫,ʖʃ佞诌Ŧ丞śɧ璯PʥT + privileged: false + procMount: 荞£DS + readOnlyRootFilesystem: true + runAsGroup: 6728166770219184000 + runAsNonRoot: true + runAsUser: 2918288689668335000 + startupProbe: + exec: + command: + - o + failureThreshold: -949081542 + grpc: + port: 220928812 + service: EIuHGNT4 + httpGet: + host: 21BmFcJ50ov + path: WC7WP + port: njQtxPF + scheme: 鲰ʌȱ卹烛橇淃ō雀)缅tb憅棔JǓ*ɒ + initialDelaySeconds: 1631334347 + periodSeconds: -785602818 + successThreshold: -1111896125 + terminationGracePeriodSeconds: -8014749222013301000 + timeoutSeconds: 795835881 + stdinOnce: true + terminationMessagePath: m08AZSt + terminationMessagePolicy: 盛P1砦ǚ瀱#Ʌ穇嘜\Ɍ + volumeDevices: + - devicePath: NdQPZme + name: uHcdGnKv + volumeMounts: + - mountPath: IX + mountPropagation: diȔiN6ļɃƐ釭卬O + name: fPg + subPath: iY + subPathExpr: U + - mountPath: E + mountPropagation: 1ĵ氓ŝ瘛o扬=[蟗 + name: xt + readOnly: true + subPath: 2KRhR + subPathExpr: Vm0HMwn + workingDir: jusEo + - args: + - Ejt + - DYgNM8X + env: + - name: HkwQ + value: fpHbv + valueFrom: + configMapKeyRef: + key: 3e + name: Q + optional: true + fieldRef: + apiVersion: lh + fieldPath: "" + resourceFieldRef: + containerName: E1uEhn3 + divisor: "0" + resource: 0Pa + secretKeyRef: + key: co85cv7H + name: KL1I3G + optional: false + - name: 5MQMJhqUni + value: 34PEKwUkR + valueFrom: + configMapKeyRef: + key: ABhM + name: qq5b + optional: false + fieldRef: + apiVersion: vCLN + fieldPath: tge3Z + resourceFieldRef: + containerName: ST + divisor: "0" + resource: qFS8 + secretKeyRef: + key: Am + name: BLI353a5GI + optional: false + envFrom: + - configMapRef: + name: KBum1 + optional: false + prefix: 56g + secretRef: + name: zt5 + optional: true + image: XgUFG + imagePullPolicy: 锄ģnj[眈例ƚ淍ƁĐ~ + lifecycle: + postStart: + exec: {} + httpGet: + host: Yp7F87b + path: "y" + port: OtElY + scheme: ǐʮŕ + sleep: + seconds: 640752187186511100 + preStop: + exec: + command: + - 4GYkI2pQ + - QB + httpGet: + host: DFjlmWGAFM + path: qLfFaRePdtA + port: GTUH4 + scheme: 罛&ĥ顱Ƌ + sleep: + seconds: -1289822532228205800 + livenessProbe: + exec: + command: + - youyR + - J + - IiK3AJ + failureThreshold: 527043957 + grpc: + port: -1790391516 + service: wFKNeu + httpGet: + host: TjItsuCL + path: Lo07CoiEpmJ + port: 1449812891 + scheme: 聗œdz_x忔8 + initialDelaySeconds: -923296146 + periodSeconds: -920279093 + successThreshold: 1372003156 + terminationGracePeriodSeconds: 4545671926845562400 + timeoutSeconds: -1730135112 + name: ouxZOTiA7 + ports: + - containerPort: 365499724 + hostIP: c3z3 + hostPort: -1622732613 + name: jfpQ + protocol: 鬍匤<ɔɟǜ鼴`ʃ荞ɗ线亮Ô¼ + - containerPort: 387750436 + hostIP: 7OF + hostPort: -922470687 + name: 20ZoNWnefc + - containerPort: -1003650010 + hostIP: yK31 + hostPort: -479225666 + name: 1Up + protocol: 郣-齡^c艃7ɑU牌驀墭:煞 + readinessProbe: + exec: {} + failureThreshold: -189409295 + grpc: + port: -880806937 + service: N1zEO + httpGet: + host: vN9 + path: n8TKqPF + port: -995680865 + initialDelaySeconds: -2090855365 + periodSeconds: 1849358636 + successThreshold: 811072097 + terminationGracePeriodSeconds: -5833095732594203000 + timeoutSeconds: -65186305 + resizePolicy: + - resourceName: 9rUpDkTFnW + restartPolicy: KSʮ1ĩ`乀_Ɠ颩紵 慒¨ƶ挢¸s诡 + resources: + limits: + MYEa: "0" + ngW: "0" + requests: + 174vfq: "0" + restartPolicy: 軵ƿǽ嚢遳E + securityContext: + allowPrivilegeEscalation: true + capabilities: {} + privileged: true + procMount: Ő\烔Z座畄睸zɩCɎx簫S悍a + readOnlyRootFilesystem: false + runAsGroup: -6410700953715651000 + runAsNonRoot: true + runAsUser: -8187102783441072000 + startupProbe: + exec: {} + failureThreshold: 1640672315 + grpc: + port: -799307372 + service: w9KE22PLk + httpGet: + host: e6Zo4rWs + path: tscGwI + port: 2071839677 + scheme: '&ǂȞ<辳)9撆ʚ6&U}P%捸`y' + initialDelaySeconds: 652003075 + periodSeconds: 1077051101 + successThreshold: 1528128815 + terminationGracePeriodSeconds: -2176015428967645200 + timeoutSeconds: -998563216 + stdinOnce: true + terminationMessagePath: P + terminationMessagePolicy: 8痃v7ȱ噣愜Å%Ġ3 + volumeDevices: + - devicePath: k8uvc + name: GL + - devicePath: 31O9l + name: ivY + workingDir: PtgSFsc1GvC + imagePullSecrets: + - name: s1B + - name: R54rm + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: + TDma3: eGasO + cs6G: CyEFp0L + r: xdylcKb + priorityClassName: uHKqx + securityContext: + fsGroup: -4412504815274792000 + fsGroupChangePolicy: Ȯƭhjb糯妔ȂǑʜ胴}轣 + runAsGroup: 3860793197532220000 + runAsNonRoot: true + runAsUser: -1963293898483195400 + supplementalGroups: + - 2429921255984048000 + - -2773566751575633000 + - 5629450590441919000 + sysctls: + - name: h + value: zKVw + - name: D5ekUqS2 + value: 5FxU + - name: dgHyyau + value: o + serviceAccountName: S9Bk + tolerations: + - effect: 酼駘宁ì<^ʉ逐GM¼韹宅劑圦ȢN鵸; + key: LjdOPUZjJ + operator: 窃銥ɺ嘭t緯ȇw,[t捻S麨vɂ閰 + tolerationSeconds: 1714321621775966700 + value: Uvm9nY3 + topologySpreadConstraints: + - labelSelector: + matchExpressions: + - key: AUro1 + operator: 聘 + values: + - x5E03owNK1 + - 61u06hoBRErcl + matchLabels: + HMA: 7iZSaiF + jCP15v: ksLC1iD + matchLabelKeys: + - cp + - CZpJKgP + maxSkew: 644443933 + minDomains: 1722624609 + nodeAffinityPolicy: ú(ʆɴȾ狍lfĒHȉ嫔7ix壿 + nodeTaintsPolicy: 遡lşř门Ǣl + topologyKey: qP + whenUnsatisfiable: "" + - labelSelector: + matchExpressions: + - key: i8xDfgO + operator: ʖĝ#烕ɋřĊI + values: + - bOA4n + - ByUsK + - key: 6fCdAFtmFF + operator: 靕ƭ錒Ĕ + values: + - JIMC2Pc + - a7wA08 + - key: xMn + operator: "" + values: + - gSa5XT + - 50IS6 + - "8" + matchLabels: + DoGCwvltR: vVXQcZcxdz + JLmhsQlh: L3AY0Pv + X9: U + maxSkew: -2038040013 + minDomains: -1884001920 + nodeAffinityPolicy: 嵋磋ɹ:ɢ慚TA烁.X幰 + nodeTaintsPolicy: 奒)ʅm=矕郔o鬻鴊ȵɯt债CŔ儤 + topologyKey: qkx4gKx7 + whenUnsatisfiable: 匊aO卞肝喚覕Ȭnr說ɉƢ/Æȧ婡賛 + volumes: + - configMap: + name: foGC + name: configs + - name: v1bEam0d + secret: + defaultMode: 64 + secretName: FOCtz7x + - name: 2keqwtlu + secret: + defaultMode: 494 + secretName: 1dug + - name: RAI0g6yvn + secret: + defaultMode: 354 + secretName: "2" + - name: MqQb15NA +-- testdata/case-034.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: false +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + 0fz: qRhpB + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: zE + app.kubernetes.io/version: v2.7.0 + blGSa: Hnim0SflkfpF + helm.sh/chart: console-0.7.29 + name: QxrM + namespace: default +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + role-bindings.yaml: |- + roleBindings: + - zktoFv: null + - BnTf: null + N30: null + O: null + - "5": null + up6oELWDxO: null + roles.yaml: |- + roles: + - 3vFSt6CV6h: null + - zwoEunAfS: null + - "": null + Kz: null +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + 0fz: qRhpB + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: zE + app.kubernetes.io/version: v2.7.0 + blGSa: Hnim0SflkfpF + helm.sh/chart: console-0.7.29 + name: l +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: + W8Ix4: 4kOonr2 + g93: wNXcKSBg + creationTimestamp: null + labels: + 0fz: qRhpB + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: zE + app.kubernetes.io/version: v2.7.0 + blGSa: Hnim0SflkfpF + helm.sh/chart: console-0.7.29 + name: l + namespace: default +spec: + ports: + - name: http + port: 421 + protocol: TCP + targetPort: 214 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: zE + type: d2QGeqxiX +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "l-test-connection" + namespace: "default" + labels: + 0fz: qRhpB + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: zE + app.kubernetes.io/version: v2.7.0 + blGSa: Hnim0SflkfpF + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - name: AGiMf + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['l:421'] + restartPolicy: Never + priorityClassName: ER4 +-- testdata/case-035.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: + 7lpi: QQ + RK: "" + od3x: "3" + creationTimestamp: null + labels: + 5NU: UG7t + 6NmZI: QxuTdplvdDdc + BYcISWrd5: YZbXA + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: HMyYp + namespace: default +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + roles.yaml: |- + roles: + - CSJ: null + - 0hM2tbS5: null + ZhG3M: null +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + 5NU: UG7t + 6NmZI: QxuTdplvdDdc + BYcISWrd5: YZbXA + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: Bv0I +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: + C3p: uCspVMX + creationTimestamp: null + labels: + 5NU: UG7t + 6NmZI: QxuTdplvdDdc + BYcISWrd5: YZbXA + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: Bv0I + namespace: default +spec: + ports: + - name: http + port: 51 + protocol: TCP + targetPort: 456 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: ZQQlqx7Np +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + 5NU: UG7t + 6NmZI: QxuTdplvdDdc + BYcISWrd5: YZbXA + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: Bv0I + namespace: default +spec: + replicas: 464 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: + rollingUpdate: {} + type: Ʉ>朄崍ʡƥɼ戋\IJĹ + template: + metadata: + annotations: + checksum/config: 6556f5b75614fc7b5556cf3e548fa463f543604a0e97446ccd74584bf794de97 + creationTimestamp: null + labels: + Klzm: we + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + e: C2swj + s: vw1lrq + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: Zjc3H + operator: ~IJʚ伥ʜ1鷦鄪脳= + - key: AI40kXKS + operator: Tr^ǘõ8ù<鹶ĉ崱 + values: + - fCyDs + - nJRkjROTjd + matchFields: + - key: yFbZ + operator: Ĉ8%Sp + - key: AUDzh + operator: 礉 + values: + - agJ0f + - MD + - key: hREcH + operator: Ǻŀɏʉ紸戳禰ȸ酲 + values: + - JUaNJ + - CXFmegvU + weight: 1536882470 + - preference: + matchExpressions: + - key: pXW + operator: '@ļ矏鮯ɭ碊Gɽt蜮閻ƃǖ#ũ' + values: + - I8SZLF + - key: Rz + operator: '''p麛ȧ' + - key: mvD0aV1 + operator: 狴ȸ溂辷0Ġ + values: + - JpJWDh + matchFields: + - key: OB4 + operator: "" + values: + - tnWLH4yB + - "" + weight: 410194565 + - preference: + matchFields: + - key: 2C + operator: 屮少Ļɶ賊滺W + values: + - 28ZwpH + - ybv8 + - 8qy7 + - key: bs + operator: ŝ鮱芬Ǧ脸ƍ蠎Ā + weight: -1129044572 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: [] + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: ayaEl + operator: Ɗ琫 + values: + - WGZPb + - EzYpfj + - key: Isb + operator: '@£驍' + matchLabelKeys: + - 2NNt + - NCBB22ja0 + - retU + mismatchLabelKeys: + - x3 + namespaceSelector: + matchExpressions: + - key: iQ + operator: u倲鹩?úʈ腄跛[¤O + values: + - 5y4bG + topologyKey: STnAVX + weight: -1894745290 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: R + operator: xʣcǦ:槠ʒ鄊喁蠨 + values: + - P + - 348OOM + - "0" + - key: hpIVL + operator: 鷭ʚ櫹hȅɩ&嘨Ād旌³ƑǫʄcǶ + matchLabels: + h6hNi: II1Z29P + t: 8wxT + matchLabelKeys: + - P + - axCJXjr + - ICeVp + mismatchLabelKeys: + - ljKwc + - mr6kl5v + - e + namespaceSelector: + matchExpressions: + - key: C + operator: =ĥĕ壚_隈]Ȑ釀侹ʩʎ痿c揜 + values: + - K1K + - c8fwp + - 8vQ4EPywlatl + - key: 28EpNe + operator: 鼓頳'ʛ1挂ō緕当gToʇ接遫 + - key: "" + operator: ƝZĂ 寑=愝奚Ĩw桟t摧pŸ + values: + - BuqtJnV + - 0hpJEbg + matchLabels: + 4lNwC: NEzAktH + h3ErklId8G: qClR4lO9e + namespaces: + - AYtMy3oUrS + - aX5P8O + topologyKey: 6D + weight: -1152164451 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: F6jo11z + operator: 亊路+M + values: + - h + - mmuiW + - GIV7E3H + - key: C + operator: v2佉鱉v辑ɞȠXɎʫǸú81Ɵ + values: + - QL + - MPxVd + - dqj9PPnthc + - key: 6JaPa + operator: 8dž貒ɑzןlȍH琧3ɞ + values: + - 1vJUmwXUq + matchLabels: + CIFj: YwH + Y2kn8RCwh: 90KzxhieelQ + y05g7PKLJ: 75bPN + matchLabelKeys: + - bYiD + mismatchLabelKeys: + - IiTYx5K5t + namespaceSelector: {} + namespaces: + - rZw0zlprDr + topologyKey: sxEn3K + weight: -1384321177 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: VgaK0hEji + operator: Ĺ礇紈銠噐ɴ諠2稇Ɠ鸈ý藁 + - key: S + operator: 鋸ɢǎ"膤ƭU軖tg埞鴤駩蹡 + - key: 9CwIty + operator: '`\糖ť8弤娹)覇gƲ妒墲9n' + values: + - 3j6O7C1tYz8 + matchLabels: + 0gEuFD: 74yF5 + matchLabelKeys: + - C + - IaGS + mismatchLabelKeys: + - W1 + - x + namespaceSelector: + matchExpressions: + - key: WXQ4P + operator: eĈ峧ʔƟ±ps缆D戭ǟ + values: + - "" + - EyV7u6ShG55 + topologyKey: DHgv6 + - labelSelector: + matchExpressions: + - key: RrGr5 + operator: 苭 + values: + - s + - Uk9D + - qTA4 + matchLabels: + yvalC: zQDHWOCId + matchLabelKeys: + - j1mN0G + mismatchLabelKeys: + - VdCZU8 + namespaceSelector: + matchExpressions: + - key: YzPO7z + operator: Lȇ杦娀 + values: + - 4UCJLskm4 + - VY + - key: arPd + operator: 燔佰馛{I諵Gƣ_*e + matchLabels: + g3PzQTKu: EtFrI + namespaces: + - ZXe + - ik9z + topologyKey: Os0u + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: DTU + operator: 鷚OíDzRě¤觹J闬#6U脥狍 + values: + - "" + - A5o + - gC + matchLabels: + Dm: WpOLJ + matchLabelKeys: + - z + mismatchLabelKeys: + - ICMl + namespaceSelector: + matchLabels: + XY9q9YY6uD: CiedBn + namespaces: + - vZ6M + topologyKey: OpLnLGsE + weight: 538966601 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: kEha + operator: Ę沌`f帞qA'躚S郻Ɏ珍韄 + values: + - etjdRyp + - zavjaM + - OYvYj + matchLabels: + KVwZfB: KEPzsU59 + RkZ: 0VcRQYQ + YpbOAE: DLjKEd + mismatchLabelKeys: + - djF + - SUMMj + - TGSC2G8I1Up + namespaceSelector: + matchExpressions: + - key: menWm + operator: k÷餌Ō + values: + - x9N + - mtsmYut + - key: szQb + operator: °« + values: + - hkxKeWqC + - key: YJUom + operator: ź²%FÔ縥:嗚K + values: + - NiQwKD + matchLabels: + 4AI5GYaY: ALH1BY + Bu43TOQ: WD + H: iujH1 + namespaces: + - Lc1PZ + - Z7LIE + - s4c0o + topologyKey: P7xmm2 + weight: 1130067767 + - podAffinityTerm: + labelSelector: {} + matchLabelKeys: + - yJiUSi + mismatchLabelKeys: + - 3ulP + - "66" + - "4" + namespaceSelector: + matchExpressions: + - key: eK + operator: 钕Ŧ + values: + - yRj + - Ukm + - "" + - key: "" + operator: 锧BȾLF譨Ɣ? + values: + - MtLk2 + - mUrlwRAdRoNX + - key: rlSqK0xlaaI + operator: 'Ɏƶʗ疇ȵMÇŕ翸鑉d劯kʦĺʄ4 ' + matchLabels: + FGHX9SlJz: MRMXuk + topologyKey: 4morNsk6TdYi + weight: -971499940 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: zosngP + operator: ʒ蠜¡ȂŧIH闦º弓鳾蠖Ą批9}_ + matchLabels: + "": wEhn + P1O8tGwJ: ZC + matchLabelKeys: + - IN0 + namespaceSelector: + matchLabels: + wMID0: aOr1UxM + topologyKey: krnVB + - labelSelector: + matchExpressions: + - key: mE + operator: 虵xǯ6熋湧ƳʝŅU节擎隆X鏯 + values: + - k + - bcx + - ks + matchLabels: + nYs: Hv5tuwQ + zAVu: G1PF + matchLabelKeys: + - u + - Gi6tJR + - "60" + namespaceSelector: + matchExpressions: + - key: bqRj + operator: ĭ啞&/sFş(墠O1Ÿ( + values: + - fe2dTLTbB + - QLUYqgc + - XBuCBfk27 + - key: exMkm + operator: m輚ɮ凪哇褚 + values: + - EQROy + - XQDPF7uw + - key: MwOO + operator: 鹗u仏兤o*>蒟顨ƽėȰ + values: + - TGv + - VVtqHApm + - 7Mub + matchLabels: + PI: elzxW + Wd1Q: MYEPScu1su + i: uENdc + topologyKey: QlwUBoDWM + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: 14jKCyMC + value: Mb95Ivlchi + valueFrom: + configMapKeyRef: + key: FMRh9 + name: VwME2dRYnb + optional: true + fieldRef: + apiVersion: NlY1uxRPgql + fieldPath: NDrKU5 + resourceFieldRef: + containerName: gPQ1TD3MX + divisor: "0" + resource: r6HOpjj + secretKeyRef: + key: "n" + name: RQLa2rQL7Y + optional: false + - name: LICENSE + valueFrom: + secretKeyRef: + key: xLO4B2BCZUJ + name: BQR2Y + envFrom: [] + image: XB9ke7yB/EwU0pzhz:SmZAnO7 + imagePullPolicy: 垿儣Ƈ#WMƻ + livenessProbe: + failureThreshold: 724782955 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 1633166106 + periodSeconds: 2105675880 + successThreshold: 225361138 + timeoutSeconds: -1665363921 + name: console + ports: + - containerPort: 456 + name: http + protocol: TCP + readinessProbe: + failureThreshold: -1128918125 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -116128728 + periodSeconds: -1936485392 + successThreshold: -1735161598 + timeoutSeconds: -1293939870 + resources: + limits: + 0PRJ1bi: "0" + JUjtrq: "0" + WN9h: "0" + requests: + TCeGWCB: "0" + x5O0IxuN: "0" + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - '@晏駚T!UɎȉépg鎘Ȉ' + drop: + - ÚơĊ猴渋ĭ8膔櫔ż択ůĦ抹 + privileged: true + procMount: 偖躪 + readOnlyRootFilesystem: false + runAsGroup: -543916493751029760 + runAsNonRoot: false + runAsUser: 7772713475568768000 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: pqfdKzb + mountPropagation: "" + name: 6btv + subPath: xLjoA + subPathExpr: UseM + - mountPath: EYXxm + mountPropagation: 煊`ś蠶+蓲慅4曌Ƥ4臜.魼簌m缽荈巇 + name: 6ut6g + subPath: 7N + subPathExpr: ypY + - command: + - DlBCuc8xa + - X2hi8Mp + image: 00GQ5 + imagePullPolicy: 賎ʂG}Ƌ煚6ūaĠ腻f + lifecycle: + postStart: + exec: + command: + - mVlE + - cFmlozRTJ + - "" + httpGet: + host: RIzcOYFo + path: eZge9wzJjW + port: ugY08 + scheme: 讣Ɨƶ"ɇǘƓƮ + sleep: + seconds: -5362042555365295000 + preStop: + exec: + command: + - "" + httpGet: + host: hLxRfJhv + path: JA8kOIY + port: tpH1 + scheme: '''k:嘡葊佒ďȏǓɡ毫/视倴ĩ}Ɓ u' + sleep: + seconds: -915316715834475000 + livenessProbe: + exec: {} + failureThreshold: 1628387875 + grpc: + port: -119747124 + service: 3cnWKI + httpGet: + host: 6Wzb9 + path: Af + port: RAzYX + scheme: 嘾Q經f + initialDelaySeconds: 4951530 + periodSeconds: 1309655668 + successThreshold: 918641827 + terminationGracePeriodSeconds: -3073080783253286400 + timeoutSeconds: -1896420637 + name: yML27O + ports: + - containerPort: 509868797 + hostIP: XMFIjyy7MNejY + hostPort: 2083818454 + name: gd + protocol: 槏 R¨ƽT³簑ƤA$<猿.0d + - containerPort: -164866787 + hostIP: eh + hostPort: 1842390272 + name: H7 + protocol: y擫`/洄]ʢÓ7Ā紐ǟ塋 + readinessProbe: + exec: + command: + - 5MrELPMn + - 23x1a + failureThreshold: 1394382122 + grpc: + port: -96138878 + service: DBq + httpGet: + host: 60SrHkgc + path: OwZeja1P + port: 721461548 + scheme: ' `$ħ' + initialDelaySeconds: -2125734502 + periodSeconds: 66441733 + successThreshold: 130216629 + terminationGracePeriodSeconds: -7113768241875088000 + timeoutSeconds: -977567736 + resizePolicy: + - resourceName: 8VNf4C + restartPolicy: Ě} + resources: + limits: + 2TX: "0" + Yd3: "0" + avcFFX: "0" + restartPolicy: Ę<彪6 + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - ūW銹fn|óOB¶őǝ:ɛ暙- 嫴 + - 韣噺Ȑ主鋥Ɣ睩熾@Ĥvƈ + - 気ʎɭ愢勈īɔ垆ŀ槌,q儇p顼ǯ歳 + drop: + - EģIJ>筡|n譌ɶd2鍇$X/ȴ偎穾7 + - "赻探ǞiN胂a + name: 79CeZyd + subPath: xMQ + subPathExpr: NvU + - mountPath: smgfnmvP + mountPropagation: ʈ + name: CuKUC + subPath: hZ8KJ3 + subPathExpr: CK4WsX + - mountPath: zm + mountPropagation: 傩骟Ⱥ|尤fŇɓ呣ɘĩŽ + name: wRtUU + readOnly: true + subPath: T1 + subPathExpr: cidBhX8I + workingDir: M0jsi8 + - args: + - rQ7QBmZ4 + - Q32wY3lGUA + - VGeP + command: + - "6" + - 5vVr2Q + - 4YDd + env: + - name: DY1 + value: sge + valueFrom: + configMapKeyRef: + key: O8RUTpJ + name: SCF5ph + optional: true + fieldRef: + apiVersion: NY0hb + fieldPath: ViZ0f + resourceFieldRef: + containerName: "Y" + divisor: "0" + resource: sCX + secretKeyRef: + key: Ma + name: 6s6lc5 + optional: false + - name: m19lk2eiDtcdB7 + value: 0JaB + valueFrom: + configMapKeyRef: + key: VolU + name: jnFjMLIQ19 + optional: true + fieldRef: + apiVersion: "6" + fieldPath: N0wIEnFmQ + resourceFieldRef: + containerName: QwDG86d + divisor: "0" + resource: pda + secretKeyRef: + key: Uc7x1XF + name: efgc + optional: true + - name: 8A + value: 1kUmljHSb + valueFrom: + configMapKeyRef: + key: "" + name: z18yxT + optional: true + fieldRef: + apiVersion: 1qaE + fieldPath: vEzPx + resourceFieldRef: + containerName: GYhSz + divisor: "0" + resource: Ttq + secretKeyRef: + key: aaGRQS + name: C + optional: false + envFrom: + - configMapRef: + name: "0" + optional: false + prefix: 5cqcw + secretRef: + name: O7Gex12 + optional: false + - configMapRef: + name: DHEYwZ + optional: false + prefix: wSbyGx + secretRef: + name: 9nM86dZi + optional: false + image: E + imagePullPolicy: 栧Z + lifecycle: + postStart: + exec: + command: + - 6775E + httpGet: + host: hIoYmpbc + path: qEf + port: rnJpXG69m + scheme: 赙¯6a腚 + sleep: + seconds: 4894208532244896000 + preStop: + exec: + command: + - mHtY + - 0hh1Tr + - "" + httpGet: + host: BuElf + path: fJPDiyG + port: PybmIT + scheme: M*Ķ + sleep: + seconds: 7544543348205058000 + livenessProbe: + exec: + command: + - z7IJ + failureThreshold: -360493877 + grpc: + port: -1395908290 + service: zV1i + httpGet: + host: GLn + port: -279409955 + scheme: ǃU螄骰褃Ʀ诐Ɯ{,ɍb萎Ɲʢ鰪\U + initialDelaySeconds: 1831688310 + periodSeconds: -280461011 + successThreshold: 84363106 + terminationGracePeriodSeconds: 7513815341722355000 + timeoutSeconds: 442815657 + name: pGthpc + readinessProbe: + exec: + command: + - T39QO5 + - "" + - DbSsPel + failureThreshold: -1901163919 + grpc: + port: 1255815597 + service: xeTv + httpGet: + host: bipPJGJ + path: nghEbF + port: uyLPK + scheme: 翁渹牯澖 + initialDelaySeconds: 1295268788 + periodSeconds: 17921235 + successThreshold: -212369586 + terminationGracePeriodSeconds: 1061046207943693700 + timeoutSeconds: -1707711843 + resizePolicy: + - resourceName: RLHi + restartPolicy: 掳?帐(Ǖčĭ纜 + - resourceName: H1Bv + restartPolicy: Ɉ駃愝ɲƁ2*ʍJ蕦ʃĹr}尕5J埉g + - resourceName: f + restartPolicy: ɧ帨y晒ʪäǗ«ǤǞugT埤X澇寿Ù\ + resources: {} + restartPolicy: 7Y熀7rúǬ轘 + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - Ǒn%Aʙ]m* + privileged: false + procMount: 鼷R珍沌 + readOnlyRootFilesystem: false + runAsGroup: -287129322294347260 + runAsNonRoot: true + runAsUser: 3942212766283409400 + startupProbe: + exec: + command: + - gN + - zpmlcJ + - DeLJ4s + failureThreshold: 102924404 + grpc: + port: -1304933194 + service: 0iK + httpGet: + host: jbg + path: ZqaSpx8C + port: UPJqfy9dOO + scheme: 韼QY岩沴ì釪儇9ĩN + initialDelaySeconds: -46268668 + periodSeconds: -1126074804 + successThreshold: -2093938118 + terminationGracePeriodSeconds: -3498490773203628500 + timeoutSeconds: -736335366 + terminationMessagePath: "7" + terminationMessagePolicy: 辺OB¯悱楆3Ǫ首傭ɟ鮛ïƇ豙ǁUȵ + tty: true + volumeDevices: + - devicePath: DSh1 + name: 1OMawuQAlZD7 + - devicePath: "Y" + name: liCI2j + volumeMounts: + - mountPath: JPO9Ewk3kgaeuBD + mountPropagation: k釂Żɮ>ɸêW箁B| + name: QGO7HtoR + readOnly: true + subPath: oYudCrOqA + subPathExpr: Z1oG + - mountPath: iH6 + mountPropagation: dP帗俪Ťŷ/6¤þ剛&Ģ趽qi + name: 9Ro4aQU5yby + readOnly: true + subPath: piBl3 + subPathExpr: nfDFn + - mountPath: uU2H4 + mountPropagation: ljQ + name: "" + subPath: rj2 + subPathExpr: E + workingDir: BveK3 + imagePullSecrets: + - name: ygWNP7C0W9 + - name: lo0PU + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: + LAqpO: N7lh0C2 + RqG8qj: ltTa5 + X3q: F5c + priorityClassName: F + securityContext: + fsGroup: -8750452531563962000 + fsGroupChangePolicy: RȗɻÎ + runAsGroup: 3754171381447903000 + runAsNonRoot: false + runAsUser: 2565919490422334500 + supplementalGroups: + - 2907772986244332000 + - -4686580881125536000 + - -7134026849524392000 + sysctls: + - name: 8gezWufB + value: 2Jv + - name: 4nhjhT6P + value: 32ZuT + - name: cQk5tljX + value: Aimzt8kirN + serviceAccountName: HMyYp + tolerations: + - effect: aƻƀi + key: 7II7D0fA + operator: 跳<ȴŤƇ梐ȸŷR + tolerationSeconds: -92963183946417040 + value: U + - effect: p鸿xś冣9ɩ揊Ů忁琺ȖP壡o繊堮 + key: 5sC + operator: XɦǨ燖Ż綯逆挤ʦ斝蟏滣ʣ + tolerationSeconds: -6405135249548566000 + value: c2m6hlo + topologySpreadConstraints: + - labelSelector: + matchExpressions: + - key: bsO + operator: Ⱥ8欟慡Ƿţ6氙絿鐘黬聠ç + values: + - hbuLC + - SdAZnchI + - key: b4Pjya + operator: jɀh5湧,Ȳǣ6謉<ɦ + - key: gXEm + operator: ',k涃栏岴g橚甇ȳ0禰餝榖睌ěB縩侾F' + values: + - q9VqX4l + - zoMoc9Vb5 + matchLabels: + B0T: uiIEpLD2 + V: jdhpTcaa + pz: V1dJXS8 + matchLabelKeys: + - yoFhTrxV + - o + maxSkew: -1837539887 + minDomains: 2144009248 + nodeAffinityPolicy: 怓覷環ʤ苷疿ʡB聧!]LJƱĿGť + nodeTaintsPolicy: V~0韾¾Ȣû&嵙纠&ȠVƧ鍌 + topologyKey: GldA + whenUnsatisfiable: Ƀk纩{寍HƋ&庝僟D徼聊 + volumes: + - configMap: + name: Bv0I + name: configs + - name: 00PT1WRWHX + - name: P4 + - name: fn +--- +# Source: console/templates/ingress.yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: {} + creationTimestamp: null + labels: + 5NU: UG7t + 6NmZI: QxuTdplvdDdc + BYcISWrd5: YZbXA + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: Bv0I +spec: + ingressClassName: vg + rules: + - host: daRMGxIy7gKoE + http: + paths: + - backend: + service: + name: Bv0I + port: + number: 51 + path: GVhF41Ue + pathType: TeM8 + - backend: + service: + name: Bv0I + port: + number: 51 + path: UontjIzl + pathType: MN + - backend: + service: + name: Bv0I + port: + number: 51 + path: "" + pathType: xN + - host: YCgI + http: + paths: + - backend: + service: + name: Bv0I + port: + number: 51 + path: MPhdfahEcn + pathType: ECPrn + - host: GDOlAVRM + http: + paths: + - backend: + service: + name: Bv0I + port: + number: 51 + path: H5pExfzke + pathType: v8 + tls: + - hosts: + - dQiMWdJ8cYKS + - 35K + - 8Kin + secretName: C + - hosts: + - zPo + - Z7 + secretName: SiZz +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "Bv0I-test-connection" + namespace: "default" + labels: + 5NU: UG7t + 6NmZI: QxuTdplvdDdc + BYcISWrd5: YZbXA + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - name: ygWNP7C0W9 + - name: lo0PU + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['Bv0I:51'] + restartPolicy: Never + priorityClassName: F +-- testdata/case-036.yaml.golden -- +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + Nv: YHcp9u + RMi5: o4 + ViLr0: zrEw3 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 9mG8n4Wu4 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: AumW +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: EfQbyB + kafka-sasl-aws-msk-iam-secret-key: B + kafka-sasl-password: w + kafka-schema-registry-password: qiltVq + kafka-schemaregistry-tls-ca: kyT4j + kafka-schemaregistry-tls-cert: Tu4varJ + kafka-schemaregistry-tls-key: bmT + kafka-tls-ca: UyskLmDZ + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: hPt + login-github-personal-access-token: vRbRqD0 + login-google-groups-service-account.json: lcc9 + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: A9RDbO6GzTtHYG + login-okta-client-secret: HktzleLAg + login-okta-directory-api-token: qX + redpanda-admin-api-password: 5imX8ztdqjU + redpanda-admin-api-tls-ca: opQQ + redpanda-admin-api-tls-cert: PGcfJC3zH + redpanda-admin-api-tls-key: IhqyTvQn4T +type: Opaque +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + Nv: YHcp9u + RMi5: o4 + ViLr0: zrEw3 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 9mG8n4Wu4 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: AumW + namespace: default +spec: + ports: + - name: http + port: 113 + protocol: TCP + targetPort: 414 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 9mG8n4Wu4 + type: XHYb2qmrk +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + GvX4jkWw: xAyNk + MdtXxfH: "" + WyrWx: 8QO + creationTimestamp: null + labels: + Nv: YHcp9u + RMi5: o4 + ViLr0: zrEw3 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 9mG8n4Wu4 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: AumW + namespace: default +spec: + replicas: 24 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 9mG8n4Wu4 + strategy: + rollingUpdate: {} + type: LJėwǮ甧 + template: + metadata: + annotations: + checksum/config: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b + jLE31lUP: LWc + creationTimestamp: null + labels: + 6W: FQvOa + YwkBSNWK: 0qqd + app.kubernetes.io/instance: console + app.kubernetes.io/name: 9mG8n4Wu4 + jP3: iNkD + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: bkwD5 + operator: B砟摫ʟ]估ȽÓĖ頒ʙǯ + - key: 4n + operator: "" + - key: DDWUTPllaee + operator: ǒ@訹Ðđɤ軗ɲǃZ袓6悔ʙ[x] + values: + - bHwxZg + - iPWF3DQz + - yhiFQZ98w6h + weight: -551427274 + - preference: + matchExpressions: + - key: kZ + operator: "" + values: + - BMfDa + - key: l + operator: unɚʀɂ7Ǩ蘕 + values: + - 1vsAjW + - lEGj0 + matchFields: + - key: EYCyU + operator: 袒雬Ǐ蔡|骐pOĆƍbʌʝl + - key: e9QdJHV + operator: Ɏ鼛鏗擌-悝Ű + values: + - DToToJ + - Gq4 + - key: M4b3wwVy + operator: 煛苅=İ哋ońɢ\Głh斳hɷ韙 + values: + - fMIoNrUiyJdi + - tcNEhOds + - N0 + weight: -906035045 + - preference: + matchExpressions: + - key: 05VafuKQo + operator: ƃèĢC篘 + values: + - McUwm + - oMXVW + matchFields: + - key: "" + operator: 9ȮLǟ3V廉\5膏ɩ袴 + values: + - t + - r8d6G + - FevHe + - key: KeJd9X4 + operator: \Y#uɆɫwĉɎ卲S + weight: -773391374 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: PiRY + operator: 週畯嘰Œ铖'ȸ0Į5k,逊 + values: + - Fo9oE + - KLfm4 + - PiZJC + - key: 6HCuuj + operator: Ȋ!ʈh牅HŹ蓓% + values: + - PU34U + - bZ12kwJ4s1 + matchFields: + - key: CCVSIZH + operator: (铴Njʦ釖Ĩ鎅ƒ獞p)唓u¸::2 + values: + - DjvLD + - key: 9gy6tFM + operator: ø + values: + - lPjPu0 + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 2oL + operator: Ì溄祤BNjɎ_ )jðZF + - key: Tl1mGP + operator: r0ȨȵeēP眼饾j + - key: 98uL + operator: "" + matchLabels: + "": H0F + IGfr: 8iR8 + pTjU: 2vy5Ol + matchLabelKeys: + - l2d3an + mismatchLabelKeys: + - gomcuJ + - UMhaBnQUuSH4 + namespaceSelector: + matchExpressions: + - key: CyYjfraf + operator: 鸫ʊűoǪĞ3 + values: + - uPW + - key: vuREiHB + operator: ^ĄçȂ挌 + matchLabels: + tlcI6jz: 87JK + namespaces: + - eUszN + topologyKey: yJ + weight: 1657692208 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 3d3mr + operator: 鿈Ė聭焚歉Ð(币帄Ⱥ + values: + - h + - key: Z5c + operator: ma琓 + values: + - i5Ae6oUo + - EWixIB + - "y" + namespaceSelector: + matchExpressions: + - key: XFYbW + operator: M~ + - key: lWHcsQ + operator: 铿X异~<ÿ缇ī*^ĩ + matchLabels: + s: l6sxM + vFiVA7j: WEOy1jtU + topologyKey: JW85dr45m2G + weight: 444678250 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: bMT + operator: ^)4ɊDZǸDŽ + values: + - CG9Onrt + - key: T + operator: ƞ傏 + values: + - bXs59oj + matchLabels: + 6BRwn: Pdm + Yy: aaoLnp + myN: rwJGrW + mismatchLabelKeys: + - "n" + - c + namespaceSelector: + matchLabels: + 5QMzPp: AP + D: "2" + u: Dca + namespaces: + - 8Af + - NYfxoYf + - R4G + topologyKey: yY + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 2uhHhqog + operator: Ȧ + values: + - YgsgGf + - key: EaR + operator: 愅YVǵ楔¢4Ʋ + values: + - xaEk + - key: NV5iPi5Kw + operator: ' 軕氡#晉Ʀ筜篧e蹶ʀSɟʂÊʕT' + values: + - BY4 + matchLabelKeys: + - 9fTYFH7s + - aK6HB6 + mismatchLabelKeys: + - 13L + namespaceSelector: + matchExpressions: + - key: 3FT + operator: Tğ枕Ōo*a種JU-ɶƠdz鱓fƑS + values: + - 4ISUCT + - po8yM2L + - T5Q0UARu + - key: RhB + operator: "" + values: + - Re7 + - 7id + - 91GFPdrt + - key: ShRTzNRj + operator: ʬ吇Ȭ?搰Ç + values: + - HiGOGJE + - wOi + - HmllR83Dbvoz + namespaces: + - "" + - TBCPW + topologyKey: 0H + weight: 1493754197 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: CESaz + operator: ŢaæX#暁鲸'媩俛5齗aw'ĥ煆W + values: + - "" + - key: YtpoWP + operator: 瀽LƠ' + values: + - uS13z + - ip0h + - o8m9MWnmr92 + matchLabels: + 7o4tt: QX9gjN + KScJOoR95: Dpu + wfAk1b: rH5Z + matchLabelKeys: + - Yh1S1nZ7hm + - Fwx + - 6mhp + mismatchLabelKeys: + - ihvyNa7 + - m8 + - Q + namespaceSelector: + matchLabels: + 2KH67NR4: Vy8qZyy + topologyKey: w0KJ + weight: 1592497187 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + 1UcAh: h + namespaceSelector: + matchExpressions: + - key: yxz + operator: ',酵ýhȿ鲹芫澥 Ǧ_Ź躄_莯ʊ傡硬M' + values: + - Fof + - key: 8KwNEN + operator: 8炮逴8`M鞵ȍȟ蟷盱 + - key: N0 + operator: Ì崌爷矉&佷* JQȴ躀厇退ƿƍ肙 + values: + - kjlwyKc + - DDz + - Yf8Vf5Ar7w7 + topologyKey: n5cRtvXjK + automountServiceAccountToken: false + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: 0iCX + value: UfKNkXj6I + valueFrom: + configMapKeyRef: + key: GGYmdb5PBtUx + name: Zl1rWu9 + optional: true + fieldRef: + apiVersion: 1pKgni + fieldPath: 8Zmv + resourceFieldRef: + containerName: nK + divisor: "0" + resource: Yizp + secretKeyRef: + key: Dxqh + name: td + optional: false + - name: bm + value: K06vl + valueFrom: + configMapKeyRef: + key: dOTjzfwtRPzX + name: YleYOzRS + optional: true + fieldRef: + apiVersion: xl + fieldPath: 6NM2 + resourceFieldRef: + containerName: jreT + divisor: "0" + resource: "" + secretKeyRef: + key: B7 + name: cu + optional: true + - name: F4Vp + value: 9q + valueFrom: + configMapKeyRef: + key: dAPalKT0 + name: UXC7S + optional: false + fieldRef: + apiVersion: bTxwQmS + fieldPath: XW + resourceFieldRef: + containerName: iqnl + divisor: "0" + resource: e9 + secretKeyRef: + key: c1WJ + name: sg2TuPSW + optional: false + - name: KAFKA_SASL_PASSWORD + valueFrom: + secretKeyRef: + key: kafka-sasl-password + name: AumW + - name: KAFKA_PROTOBUF_GIT_BASICAUTH_PASSWORD + valueFrom: + secretKeyRef: + key: kafka-protobuf-git-basicauth-password + name: AumW + - name: KAFKA_SASL_AWSMSKIAM_SECRETKEY + valueFrom: + secretKeyRef: + key: kafka-sasl-aws-msk-iam-secret-key + name: AumW + - name: KAFKA_TLS_CAFILEPATH + value: /etc/console/secrets/kafka-tls-ca + - name: KAFKA_SCHEMAREGISTRY_TLS_CAFILEPATH + value: /etc/console/secrets/kafka-schemaregistry-tls-ca + - name: KAFKA_SCHEMAREGISTRY_TLS_CERTFILEPATH + value: /etc/console/secrets/kafka-schemaregistry-tls-cert + - name: KAFKA_SCHEMAREGISTRY_TLS_KEYFILEPATH + value: /etc/console/secrets/kafka-schemaregistry-tls-key + - name: KAFKA_SCHEMAREGISTRY_PASSWORD + valueFrom: + secretKeyRef: + key: kafka-schema-registry-password + name: AumW + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: AumW + - name: LOGIN_GOOGLE_DIRECTORY_SERVICEACCOUNTFILEPATH + value: /etc/console/secrets/login-google-groups-service-account.json + - name: LOGIN_GITHUB_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-github-oauth-client-secret + name: AumW + - name: LOGIN_GITHUB_DIRECTORY_PERSONALACCESSTOKEN + valueFrom: + secretKeyRef: + key: login-github-personal-access-token + name: AumW + - name: LOGIN_OKTA_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-okta-client-secret + name: AumW + - name: LOGIN_OKTA_DIRECTORY_APITOKEN + valueFrom: + secretKeyRef: + key: login-okta-directory-api-token + name: AumW + - name: LOGIN_OIDC_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-oidc-client-secret + name: AumW + - name: REDPANDA_ADMINAPI_PASSWORD + valueFrom: + secretKeyRef: + key: redpanda-admin-api-password + name: AumW + - name: REDPANDA_ADMINAPI_TLS_CAFILEPATH + value: /etc/console/secrets/redpanda-admin-api-tls-ca + - name: REDPANDA_ADMINAPI_TLS_KEYFILEPATH + value: /etc/console/secrets/redpanda-admin-api-tls-key + - name: REDPANDA_ADMINAPI_TLS_CERTFILEPATH + value: /etc/console/secrets/redpanda-admin-api-tls-cert + envFrom: + - configMapRef: + name: 3PT + optional: true + prefix: l + secretRef: + name: zakko + optional: false + - configMapRef: + name: RdxlkV + optional: false + prefix: 9Ae4W + secretRef: + name: UiJ + optional: true + - configMapRef: + name: bp + optional: true + prefix: SU + secretRef: + name: fy + optional: true + image: ai/f54I:iO + imagePullPolicy: ǫtŖŮƘ瓧ù¹勍u + livenessProbe: + failureThreshold: 864346345 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -1341055636 + periodSeconds: 2055603833 + successThreshold: -175204389 + timeoutSeconds: -589897727 + name: console + ports: + - containerPort: 414 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 1075627654 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 333726894 + periodSeconds: 1376975278 + successThreshold: 112483424 + timeoutSeconds: 669945326 + resources: + limits: + 7VHN3: "0" + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - '*·戌ɳKõʚK(懷ë蟅ȣg' + - vOpɔm&ɞ法槪ųf + drop: + - l¤0ɖK樌ŕDĪ箰ɬȓũ梫h揼 + - 躟OBZş互鹫Íʨƶ`ã + privileged: false + procMount: 9®俠ɳ屑ŏO'pe,Q+膿麣 + readOnlyRootFilesystem: false + runAsGroup: -289823929905824060 + runAsNonRoot: true + runAsUser: -4392330066259666400 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - mountPath: Oly + mountPropagation: ƈįlñ + name: QuM + readOnly: true + subPath: NPJ + subPathExpr: vn + - mountPath: xsiqpcicm + mountPropagation: Ŝȃ燩čƃʤǸ儼 + name: blYv + readOnly: true + subPath: 8f + subPathExpr: I + - mountPath: "" + mountPropagation: 犒k洐ɨ3UʓďȏUm8/x艂" + name: i2 + readOnly: true + subPath: G + subPathExpr: Wo47OrA + - args: + - gfDaDhh + command: + - Eu + envFrom: + - configMapRef: + name: 9LtiYU + optional: false + prefix: dS5JDbtZJ + secretRef: + name: 3X5 + optional: false + - configMapRef: + name: vpOLCCmA + optional: true + prefix: IJpeUVYk3 + secretRef: + name: TaghAr + optional: true + image: Nw59jHFBw + imagePullPolicy: Eźz购綗映ò#ZuS絇溾^飷 + lifecycle: + postStart: + exec: + command: + - N2F2q + - XKeJn + - CfoVd + httpGet: + host: 0u3Kgf + port: PVA8u + scheme: ȧX[噦摼鎥憈ǴńƘŅ + sleep: + seconds: 9185496374723368000 + preStop: + exec: + command: + - lrWSClt + httpGet: + host: uS + path: 51Gzg9s + port: -1680102290 + scheme: 8涒齃ɠĬ諛鰅jyr塸ȷg× + sleep: + seconds: -302278202696680100 + livenessProbe: + exec: + command: + - fmu + - wJR3 + - 60zV6s4327rKb9 + failureThreshold: 2122798666 + grpc: + port: 1914605377 + service: ES + httpGet: + host: 7LAmwy8 + path: o2XAC + port: S5 + scheme: 犘ßħɚÂ剐*鬰ȇxȺ錎 + initialDelaySeconds: 343978803 + periodSeconds: -1725283583 + successThreshold: 1055506692 + terminationGracePeriodSeconds: -737021961431151200 + timeoutSeconds: 1721351711 + name: r + ports: + - containerPort: -341996687 + hostIP: zR + hostPort: -641414216 + name: AGa7X6lnw + protocol: 阧 + - containerPort: -1616018360 + hostIP: 8q + hostPort: -2060443566 + name: B + protocol: 位ŲȟHbfp餪魹| + - containerPort: -321829785 + hostIP: S + hostPort: 850049722 + protocol: ĢŔ=ɦŊ鳺醩hĂ踻鉀 + readinessProbe: + exec: + command: + - VRq0lZK + - nCUDH3Zgc + - f2h2C + failureThreshold: -444080905 + grpc: + port: -1484737838 + service: UL8hSUw + httpGet: + host: 8DDb + path: Z + port: It67aEO18 + scheme: 蹐疒Į浤 + initialDelaySeconds: -1225398553 + periodSeconds: -1497056806 + successThreshold: -1256842388 + terminationGracePeriodSeconds: -3265344141862786600 + timeoutSeconds: 1127947387 + resources: + limits: + "36": "0" + Oaiu: "0" + v: "0" + requests: + F0olO: "0" + tvGpYtd: "0" + restartPolicy: Ě卿ɫȰLZ懁 + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - "" + drop: + - Ę螅7O5Ɵ駢Ó宮緂 + privileged: true + procMount: ʤ敠æx漭fƈŸʄ + readOnlyRootFilesystem: true + runAsGroup: -1779689763650766000 + runAsNonRoot: true + runAsUser: -1786517016760367000 + startupProbe: + exec: + command: + - Mcn36l + - "n" + - OMT3J + failureThreshold: 1137002720 + grpc: + port: -2106637755 + service: OYW + httpGet: + path: K + port: STUmUBT + scheme: 貪iɐ巶ɿiɲbɎ;Ŏċ2橺汲ŋ刢g + initialDelaySeconds: -648188998 + periodSeconds: -278768915 + successThreshold: 890955082 + terminationGracePeriodSeconds: 5660177701724483000 + timeoutSeconds: 959596283 + stdin: true + terminationMessagePath: h2a2mAm + terminationMessagePolicy: pjĉ + volumeDevices: + - devicePath: cZ95 + name: wLm + - devicePath: P9RW + name: PjzHR + volumeMounts: + - mountPath: b + mountPropagation: 脣Į + name: bOY + readOnly: true + subPath: mBuB + subPathExpr: 0io + - mountPath: DYp + mountPropagation: 9鹺t"Ĭij(?NB4ɖ鴼B屈桲ȋ噤ǁ + name: O + readOnly: true + subPath: EcI7mF + subPathExpr: HKfaS + - mountPath: NTgHw + mountPropagation: (ńÆ;裉嵀 + name: U6TGXB + subPath: wjpyjQ + subPathExpr: nqq + workingDir: NpjQN3dM + - args: + - m + - fmRfLPl + command: + - okKsRu + env: + - name: y8FxBu + valueFrom: + configMapKeyRef: + key: 1kdTq + name: NGzFHD + optional: false + fieldRef: + apiVersion: WDoDm + fieldPath: HTHz + resourceFieldRef: + containerName: aWk + divisor: "0" + resource: RcTwrpd4PaqW + secretKeyRef: + key: 27uDnW9fM1 + name: diwId6SMC + optional: true + - name: NZ1pEV + value: Xq7fA + valueFrom: + configMapKeyRef: + key: cYo + name: IhK1oKNNr + optional: true + fieldRef: + apiVersion: 0C + fieldPath: "" + resourceFieldRef: + containerName: OywKEud3 + divisor: "0" + resource: E4 + secretKeyRef: + key: gGTl + name: V + optional: false + envFrom: + - configMapRef: + name: fJ + optional: true + prefix: zFUU1PguE + secretRef: + name: S7Jre + optional: false + image: gbZ4mqT + imagePullPolicy: '*罖Ē掙*uĕĥ世û煨o曁ɖ)嬫噩肖Ñ' + lifecycle: + postStart: + exec: + command: + - nxKsxt + - F25ka4x + httpGet: + host: "0" + path: 9k0yMphk + port: GJdG + scheme: 婁箅蝼đ杣Ɗ°VAƭ0ĺ钘1 + sleep: + seconds: 8039264634100238000 + preStop: + exec: + command: + - NuJoJm + - gykEI + - "6" + httpGet: + host: UnkqD3SS + path: BhN + port: 712546393 + scheme: u + sleep: + seconds: 409536667065008450 + livenessProbe: + exec: {} + failureThreshold: 204373937 + grpc: + port: 1803358082 + service: VXsxSeh + httpGet: + host: Ht64jf7Eo + path: u1jjW9Qu + port: 556487018 + scheme: 熖Ű存ŖT磇ɘ外 + initialDelaySeconds: -1152834471 + periodSeconds: -1133396594 + successThreshold: -1385193405 + terminationGracePeriodSeconds: 2915006546098799000 + timeoutSeconds: -1401054296 + name: dfD716 + ports: + - containerPort: 691082006 + hostIP: b + hostPort: 636825973 + name: S5FmEWKv + protocol: g]se墰掀媸晓櫚驟憽hbƥsư° + readinessProbe: + exec: {} + failureThreshold: 152987910 + grpc: + port: 642951905 + service: q2qfom8L + httpGet: + host: GaxyfqlQ + path: Oh0t + port: -766612198 + scheme: UÂ_ + initialDelaySeconds: -1382761032 + periodSeconds: 967018272 + successThreshold: -178373997 + terminationGracePeriodSeconds: 6605400648980209000 + timeoutSeconds: -1404918452 + resources: + limits: + 7cu: "0" + 22n7v: "0" + XsU5mrE: "0" + requests: + kyXuqf: "0" + mBk4P9DWW: "0" + restartPolicy: ʓdT>NȚks_q祈 + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - ȸŏ脸(Yǃ¯~垇耗A) + - T翱ĥ + drop: + - 商ʏ軒Ƣ厢 + - Ⱥãt\跋þ漙苣ű吡憕鿶0傜om + privileged: false + procMount: Ŷ% + readOnlyRootFilesystem: true + runAsGroup: -1052699124096043900 + runAsNonRoot: false + runAsUser: 3737016357651072500 + startupProbe: + exec: + command: + - jefRNS + failureThreshold: -9144267 + grpc: + port: 642233169 + service: WjvgDkGG + httpGet: + host: 8hzgS0q + path: z + port: -885964296 + scheme: ɸliŵ + initialDelaySeconds: 1014078949 + periodSeconds: 1410148112 + successThreshold: 1164669668 + terminationGracePeriodSeconds: -3385668069040238000 + timeoutSeconds: -1723583731 + stdin: true + terminationMessagePath: zbCh + terminationMessagePolicy: 4攨2õė+軩Ç + tty: true + volumeDevices: + - devicePath: Nx + name: QLHA + - devicePath: 9JAgFLSdSqQ + name: "5" + volumeMounts: + - mountPath: KXG1 + mountPropagation: ȁ捄ɺ絒馢A¥`Èť + name: aghWO + readOnly: true + subPath: el7KEVsV + subPathExpr: tdksniBM + - mountPath: 5nus8 + mountPropagation: N饢杼M7X尅扐ǗÃɱNƞeuĦg儡 + name: TS4kHG + readOnly: true + subPath: i + subPathExpr: ktDaTCGG + - mountPath: CSkt9N0i + mountPropagation: 爕ɐYYȁ<獱椂@椗áʇ憣>\Ɋ筙纉Ë + name: KIKRXUR + readOnly: true + subPath: bWYTiq + subPathExpr: cgxlHqVV + workingDir: F + imagePullSecrets: + - name: bbjdn + - name: VI + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: + U3Rfg9: WSTvjvP + hODw: LSv + iwleZ: fD + priorityClassName: gPB + securityContext: + fsGroup: 8205502301244812000 + fsGroupChangePolicy: "" + runAsGroup: -8440674019915816000 + runAsNonRoot: true + runAsUser: 4432310384984167400 + supplementalGroups: + - 7965846110903122000 + - -9174375158887063000 + sysctls: + - name: OkeQ + value: A + - name: 24y + value: fIPA + - name: "" + value: b3 + serviceAccountName: Jg + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: AumW + name: configs + - name: secrets + secret: + secretName: AumW + - name: HUa7xM +-- testdata/case-037.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + BJ: Gq0Rw + FPcPYvmbB7dAZe: Cy7WaeI + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: u2r6 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + uEVMkDkYRvnn: zvptNai + name: ItYso + namespace: default +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + role-bindings.yaml: |- + roleBindings: + - 2m: null + VNrY1fwY: null + eaGm2c: null + - Ng0sM: null + Txhv6: null + e2uo: null + roles.yaml: |- + roles: + - Dd: null + H0QLXtA: null +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + BJ: Gq0Rw + FPcPYvmbB7dAZe: Cy7WaeI + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: u2r6 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + uEVMkDkYRvnn: zvptNai + name: ADIhC +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + BJ: Gq0Rw + FPcPYvmbB7dAZe: Cy7WaeI + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: u2r6 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + uEVMkDkYRvnn: zvptNai + name: ADIhC + namespace: default +spec: + ports: + - name: http + port: 226 + protocol: TCP + targetPort: 87 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: u2r6 + type: At +--- +# Source: console/templates/ingress.yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + "8": SeJ + creationTimestamp: null + labels: + BJ: Gq0Rw + FPcPYvmbB7dAZe: Cy7WaeI + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: u2r6 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + uEVMkDkYRvnn: zvptNai + name: ADIhC +spec: + ingressClassName: PHr + rules: + - host: PXAcFs520n + http: + paths: + - backend: + service: + name: ADIhC + port: + number: 226 + path: 1uGP0 + pathType: dWpX + - backend: + service: + name: ADIhC + port: + number: 226 + path: hAH + pathType: LjzFf + - backend: + service: + name: ADIhC + port: + number: 226 + path: 7Qy + pathType: vjB + - host: z9QAJ5 + http: + paths: null + - host: "" + http: + paths: + - backend: + service: + name: ADIhC + port: + number: 226 + path: Hc0IpaX + pathType: bc0T + - backend: + service: + name: ADIhC + port: + number: 226 + path: dzn1ldJ5h + pathType: M + tls: null +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "ADIhC-test-connection" + namespace: "default" + labels: + BJ: Gq0Rw + FPcPYvmbB7dAZe: Cy7WaeI + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: u2r6 + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + uEVMkDkYRvnn: zvptNai + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - name: Yi + - name: 6XnEhUN + - name: oeoW + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['ADIhC:226'] + restartPolicy: Never + priorityClassName: U7wS +-- testdata/case-038.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: ld + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: fP77cJ3T + namespace: default +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + role-bindings.yaml: |- + roleBindings: + - zn: null + - WCQKaiaj: null + py: null + roles.yaml: |- + roles: + - {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: ld + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: j1dUk8TGy8Np +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: ld + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: j1dUk8TGy8Np + namespace: default +spec: + ports: + - name: http + port: 46 + protocol: TCP + targetPort: 43 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: ld + type: uqFB +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "j1dUk8TGy8Np-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: ld + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - name: OlRQO + - name: Hkuk3 + - name: fP + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['j1dUk8TGy8Np:46'] + restartPolicy: Never + priorityClassName: 89gnK9rXyDXui +-- testdata/case-039.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: false +kind: ServiceAccount +metadata: + annotations: + PPZDrdmxKV: UBjiSx + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: o2F37Lr + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 8s2qVhKEW + namespace: default +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + role-bindings.yaml: |- + roleBindings: + - 6O4d: null + EY: null + oPTMvYGp: null +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: o2F37Lr + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: bbshm +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: + 4yhZo: zLVEslN + Amz4VM: QAvK + IPCS: b1R + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: o2F37Lr + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: bbshm + namespace: default +spec: + ports: + - name: http + port: 400 + protocol: TCP + targetPort: 329 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: o2F37Lr + type: dPOD9Kzb +--- +# Source: console/templates/ingress.yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: o2F37Lr + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: bbshm +spec: + ingressClassName: qyKUEOUT4u + rules: + - host: chart-example.local + http: + paths: + - backend: + service: + name: bbshm + port: + number: 400 + path: / + pathType: ImplementationSpecific + tls: + - hosts: + - F7m23 + - "7" + secretName: M +-- testdata/case-040.yaml.golden -- +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + X: zjmrl + "Y": yG0 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 6sW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: KchYZFsbB3 +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + X: zjmrl + "Y": yG0 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 6sW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: KchYZFsbB3 + namespace: default +spec: + ports: + - name: http + port: 424 + protocol: TCP + targetPort: 17 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 6sW + type: oZi +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + X: zjmrl + "Y": yG0 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 6sW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: KchYZFsbB3 + namespace: default +spec: + replicas: 291 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 6sW + strategy: + rollingUpdate: {} + type: G阏发6s + template: + metadata: + annotations: + checksum/config: 6f40381c972fd418dd311a992b76c4181a57129add8096d427da1c5284bcdd8a + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 6sW + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: 7RRFnuao + operator: 鑿梞e璺瀧敢tȱ + - key: 3qz030r9N4 + operator: 脟óȨq駥Ƽx垤R$L + - key: 4egJ + operator: 敕ƒ洀ņ+Ō轲C丼Ʒij.ƾ蚯ƺ痻3皆咒 + values: + - "" + - J66saNw8 + - xBRUfDKhiA + matchFields: + - key: Kgp4qFm + operator: 桋iz<ïŃǃ襶D齿 + - key: 7F + operator: "" + values: + - iquNT + - aFPIw + - lYMJn4Un3 + weight: -954635927 + - preference: + matchExpressions: + - key: ePHgEs + operator: 撹ł + weight: -2109244754 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: gK + operator: 垭ʮȌ)"彛 + values: + - Vvo + - "" + - key: n0 + operator: 挪VɱȒ + values: + - 595ST + - sHQoTQgQ + - ZyYxnGB + matchFields: + - key: "8" + operator: 餒ơ鋦r)锟壃m汇 + values: + - H8 + - matchExpressions: + - key: nErJm + operator: Ûɟ敀淽 + values: + - sbjW + - 1l + - go + matchFields: + - key: ozzkD4D + operator: Ʌ\h崭蠒ȓ旉蹖楚_掁S5 + values: + - NrN0Id15O + - VrahPz + - YJfhO + - {} + podAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: qiGNj + operator: jƯȨ穞ɿPȧ + - key: HPRR + operator: ž8ƃKKDz蠽ƚ0ƻ + values: + - NAx + - Pr2F + matchLabels: + LY: ZRjD + matchLabelKeys: + - ikCO + - n25 + - IY0AqNStYm + mismatchLabelKeys: + - uO6G + - EFKfLOM0 + namespaceSelector: + matchExpressions: + - key: frBwUGG + operator: ǧ啯ʖ6džȡ衺Z莋æȘzv + values: + - 68q + - PrId4k5Nk + - 1Izg6c + - key: H5neR + operator: "" + values: + - gf2 + - "" + - key: LTEiVQV + operator: ʅďl$y韙bO儺e籾吕ŃV + values: + - LccIflVn3 + - QX + - kRZLtn + matchLabels: + lccn5: lx6 + topologyKey: AE + - labelSelector: + matchExpressions: + - key: ljGag0 + operator: "" + values: + - 3AlcF9eOiK + - key: XPoIj + operator: ĻĵN稙²x鸴ʊ + - key: "" + operator: m[ɻD«ʯĢĥɖHÃú锺N蓍!f + values: + - cwRFs + - wJtpMgyV1I + matchLabels: + 6gzmw2BW: v1eC + QI6Gl: Ckzyw0v + uRw21: 36kl + mismatchLabelKeys: + - XiX9Mrhv + - Xk2Ri + namespaceSelector: + matchExpressions: + - key: Roq9G + operator: 槓G{? + values: + - YCBJEhS + matchLabels: + 9X5C: TU1y + PG1k: 8j76iX8R + iYq9QLUSh3bk: Mvl2WRQ + namespaces: + - Pp + - z1O9mW5rB + topologyKey: U + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: pqtCgWlk + operator: eŭñZ) + values: + - 6eUrtsX + - GmGeP7 + - pBhe0 + - key: gctw + operator: L?岤紎!蠾黅誽帯÷Ʉ坏q + values: + - G + - "" + - "" + matchLabelKeys: + - IGYc + mismatchLabelKeys: + - C + - XlxD2Y5h + - Eut + namespaceSelector: + matchExpressions: + - key: QNvJq6Uc + operator: Ǔƀ閝遨垛簙UdĢ7ȍ騽¹DŽ + values: + - m4wq + - TmuqVB1 + - key: PTVC + operator: 珙'ɀɒ虃龓楼ƺ譄êǿ + values: + - w + - K + matchLabels: + GQp: tw + namespaces: + - t + topologyKey: I9Ng7D + weight: -278680619 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: IaZiqfV6 + operator: 幋x:Ȗ + values: + - XmaYG80 + - aaEScB + - DxB + matchLabels: + J3Ny9zUJ2DOTKO: eiUL0RR + lt: bqOs + matchLabelKeys: + - XYHp1S + - JKj1 + namespaceSelector: + matchLabels: + WopugltEP1J: eaGpkiS + namespaces: + - H9w9Q + - A8D + topologyKey: pvkKW + weight: 252280673 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: lSi + operator: 襚ǫAŇþ腦W[ĕ嘱ʌſœɃ槏Z岪 + matchLabels: + OzmceOBQ: F2mtk + QcoH: qt3OR6ZcjY + t5Cqg1: 1x9WW8EUyyn + matchLabelKeys: + - 0XGJ + mismatchLabelKeys: + - K6T + namespaceSelector: + matchExpressions: + - key: KoofEA + operator: ' íɀ馩Ȭɫġo娤螗暴Û漷ʦO腔' + values: + - nj + - U + - onkfJ4 + - key: 0aO + operator: Ŷű輖+¶)罩ƌ×螂 + matchLabels: + 2hf: GeFfROs4 + pA23: kqkG + rZ: DH6cT + namespaces: + - yvfsu + - L3Pu + topologyKey: BBBCjZel + weight: 392487334 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + 0hp: sd9 + mwTeR: D3HlJbmoK8 + matchLabelKeys: + - MwDkniC + - "" + mismatchLabelKeys: + - VuQB + namespaceSelector: + matchLabels: + 1x: Pj + D3J: 4gFps + bQU: weT0tI + namespaces: + - y9zrYKWApO + - rq0K3 + - 5XUeP7 + topologyKey: P7V + - labelSelector: + matchExpressions: + - key: Jv + operator: 啽ŃŐø + matchLabelKeys: + - s + namespaceSelector: + matchExpressions: + - key: Fy5Deb + operator: 旉錛!荕Ɂ! + values: + - nbiy + - "" + - 6QORDbd6zn + matchLabels: + bba0KJ: NE1j + nYif5xu0Hy9XW: 0s + qAoT: "46" + namespaces: + - 4JHyx + topologyKey: 7621t + automountServiceAccountToken: false + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: cD + value: JW + valueFrom: + configMapKeyRef: + key: "" + name: 8Ri7OfQ + optional: false + fieldRef: + apiVersion: Qc + fieldPath: 6ZYFg + resourceFieldRef: + containerName: qkUV + divisor: "0" + resource: yEf5zz13U + secretKeyRef: + key: xozuxs + name: z + optional: true + - name: "" + value: gea3 + valueFrom: + configMapKeyRef: + key: hwe3l3k2h + name: QX + optional: true + fieldRef: + apiVersion: kx + fieldPath: m7f + resourceFieldRef: + containerName: 0XEGE + divisor: "0" + resource: y4ce5 + secretKeyRef: + key: hmvX + name: 18Z + optional: true + - name: LICENSE + valueFrom: + secretKeyRef: + key: a7Ph + name: zsHNWVcS9 + envFrom: + - configMapRef: + name: DR3hdrvZIv + optional: true + prefix: kGV4HZ8 + secretRef: + name: tR3Yu1G + optional: true + - configMapRef: + name: 6pMd0VA0 + optional: true + prefix: Csp + secretRef: + name: ceqZBJ7fdqP + optional: true + image: cwfXN2KlU/qYQHJ:RIG + imagePullPolicy: -0Ź桛ɼ訚Ņ;秵ňĝ苒9麡ñà臸ʫ + livenessProbe: + failureThreshold: -1894321442 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 1986051838 + periodSeconds: 541607099 + successThreshold: -1968479306 + timeoutSeconds: 1374945691 + name: console + ports: + - containerPort: 17 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 467513555 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -6410364 + periodSeconds: -623380707 + successThreshold: 1641270972 + timeoutSeconds: 1203716236 + resources: + limits: + "1": "0" + MrwIP: "0" + hgaW: "0" + requests: + 1lF: "0" + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - 阊 + - DIȜO吽解诎-曅 + drop: + - 贎秨Ůɭ懾Ù盾| + privileged: true + procMount: ʪ勪įOew\Ǡ礓 + readOnlyRootFilesystem: true + runAsGroup: -6230225082797374000 + runAsNonRoot: true + runAsUser: -2569068293811685000 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: d + name: ieSo8V + subPath: "" + - args: + - jlI16Xnnb0 + - x0Z + - Tv6z + command: + - 3MnkZe0L + - OK + - cKvaGI + env: + - name: 7RtgX9 + value: TQH + valueFrom: + configMapKeyRef: + key: "" + name: GE2 + optional: false + fieldRef: + apiVersion: x2H + fieldPath: iVYVzT + resourceFieldRef: + containerName: 3QSG + divisor: "0" + resource: AgMtPE + secretKeyRef: + key: BhGA6 + name: LKemd3Cs9 + optional: false + - name: 9dFxchX + value: huoZj + valueFrom: + configMapKeyRef: + key: skdmo + name: gSEkUx + optional: true + fieldRef: + apiVersion: ymAcwLzaJ00G + fieldPath: de9Q + resourceFieldRef: + containerName: ZgwwQvA + divisor: "0" + resource: OTraA + secretKeyRef: + key: Pe8 + name: 39mCZV7ERv + optional: true + envFrom: + - configMapRef: + name: l + optional: false + prefix: kGdnbCakM + secretRef: + name: JrDM + optional: true + - configMapRef: + name: 0iH67 + optional: true + prefix: 3JVMhcII7 + secretRef: + name: PS1J + optional: true + image: Bx3IW17kjF7 + imagePullPolicy: È8秏糇 + lifecycle: + postStart: + exec: {} + httpGet: + host: EeLx + path: JC + port: 638412697 + scheme: 翔ĩñɁɬj局³喪Eů磘Ʒ唡嬤 + sleep: + seconds: -2739564842418698000 + preStop: + exec: + command: + - zjNyV + - 3i + httpGet: + host: RxhMCXQN + path: Dq + port: -821303664 + scheme: 髒xD>?ǠĆ踃w¬ + sleep: + seconds: 8925361607851383000 + livenessProbe: + exec: {} + failureThreshold: -2015695369 + grpc: + port: 102189788 + service: VG2k6Atq + httpGet: + host: 0dxm + path: Pix7SytH + port: 284583441 + scheme: 畝ǂƬƜ聞|b + initialDelaySeconds: 1150668189 + periodSeconds: 1279412097 + successThreshold: 337444728 + terminationGracePeriodSeconds: -665826210809930800 + timeoutSeconds: -802810999 + name: 1KSo0a + readinessProbe: + exec: + command: + - 3cCL4 + - en + - VN0 + failureThreshold: 448729232 + grpc: + port: -174942651 + service: paUcCUtV8A6 + httpGet: + host: tSEChhvGgDsf + path: Jrr + port: 516172996 + scheme: c{Ƭ臾斡:Ɣ?Í + initialDelaySeconds: -714126900 + periodSeconds: -88316167 + successThreshold: -1820867160 + terminationGracePeriodSeconds: 272130190949654340 + timeoutSeconds: 1803351679 + resources: + limits: + f9GQWFTKPFP: "0" + g5: "0" + requests: + 4A89zLoFG: "0" + SmOBH: "0" + restartPolicy: Ű高ǙG%7BČCaďʥyď + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - H鞕ă鶅镀秀 + - Ŏ昮0yƤɯ斺R妕Je芓BɜCĵ + privileged: false + procMount: ÿʑ鎆乭cŇ陛ǼȠn + readOnlyRootFilesystem: true + runAsGroup: 5591360478943232000 + runAsNonRoot: false + runAsUser: 6381588597473823000 + startupProbe: + exec: + command: + - rV83LKQ + - 87Vc + failureThreshold: -2022114361 + grpc: + port: 1348736621 + service: Gx8f9phR + httpGet: + host: fWnW4CGV + path: yQl0PNEE3g + port: TYi + scheme: 絅xn,ȵ6ʎ癙 + initialDelaySeconds: 205090742 + periodSeconds: -1401542741 + successThreshold: -2130268569 + terminationGracePeriodSeconds: 4104437343850793000 + timeoutSeconds: 604054255 + terminationMessagePath: ec8kHaD + terminationMessagePolicy: 甎i + tty: true + volumeDevices: + - devicePath: NFjF + name: AH + - devicePath: "" + name: u + - devicePath: 0q6A + name: nFe3FY4 + volumeMounts: + - mountPath: ad7JXhGN + mountPropagation: =廄殞+ + name: qVHWCUHp + readOnly: true + subPath: m3RBekA0 + subPathExpr: 7F0F8Ge + workingDir: LmnqIVV + - args: + - 3g94Jb + - "n" + - HxatWli7Qe + env: + - name: yKfn + value: fni0 + valueFrom: + configMapKeyRef: + key: cQjxg02ud + name: DqLUCO + optional: false + fieldRef: + apiVersion: dS + fieldPath: aH + resourceFieldRef: + containerName: BVSH2Bxu + divisor: "0" + resource: ZLW3 + secretKeyRef: + key: J + name: APYyG5qY + optional: false + - name: b4i9WEf + value: Ru + valueFrom: + configMapKeyRef: + key: mzxgZ + name: XgDd + optional: false + fieldRef: + apiVersion: U1l + fieldPath: sG2pcjz + resourceFieldRef: + containerName: Vlc1Ru + divisor: "0" + resource: hZpqB + secretKeyRef: + key: X0W3QpdAhux + name: I3L + optional: true + envFrom: + - configMapRef: + name: DJjN7Phe + optional: true + prefix: 4K2MBzNl + secretRef: + name: s4GF + optional: true + - configMapRef: + name: td0aZ + optional: true + prefix: CYvFW + secretRef: + name: WaBWGCRa8 + optional: true + - configMapRef: + name: ehHs9m + optional: false + prefix: n1x + secretRef: + name: TdUJ + optional: true + image: UNJ6E6 + imagePullPolicy: 砓³绔丬A + lifecycle: + postStart: + exec: + command: + - Qs8Sd + - JGX4Qj + - eCw00uq + httpGet: + host: NNLSd + path: y4tS + port: QzOfwe3a + scheme: º猗ĥɮƅLɘ隮术ƒ赥;,ǝ髳Ĝ7Ĭ嬳 + sleep: + seconds: 1170469124057922000 + preStop: + exec: + command: + - TN62uDLAuIx + - ndI + httpGet: + host: t7H6l2 + port: RHeYpAvJ8 + scheme: KǠɀƴ杔¸Ɉ$毕削peýfv! + sleep: + seconds: -5232306180460338000 + livenessProbe: + exec: {} + failureThreshold: -1900233123 + grpc: + port: -1323381498 + service: wJ + httpGet: + host: pAHsn3 + path: k31zW1 + port: 2elbrK + scheme: 痯秿丌 + initialDelaySeconds: 537756270 + periodSeconds: 1139432456 + successThreshold: -289377675 + terminationGracePeriodSeconds: -709025030374540900 + timeoutSeconds: 254134433 + name: zWs + readinessProbe: + exec: + command: + - x093a + - v1 + - Ef + failureThreshold: 75768089 + grpc: + port: -237977747 + service: "y" + httpGet: + host: EBEth + path: C + port: 790399211 + scheme: ær堹mhʢ + initialDelaySeconds: -157687184 + periodSeconds: 1071897332 + successThreshold: 824432298 + terminationGracePeriodSeconds: -54575953702939670 + timeoutSeconds: -1190752843 + resizePolicy: + - resourceName: R9fM + restartPolicy: ?ʖȒƅƀ逎v鐰wģ籫 + - resourceName: 7C + restartPolicy: óʌF鿯薸k} + - resourceName: Bqy + restartPolicy: E吻X秤} + resources: + limits: + UMJnobyO: "0" + qJmAwr: "0" + requests: + ZktW7e51vRUG: "0" + restartPolicy: '>ŀ鎙莸鼔茷蝼薼Ƽƅ°3貦罌臣洴軟處姼' + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - 儜vƝ¾ + - 輝Ġ$琑+檂 + - 飂 + privileged: false + procMount: ɓĎʙʗG0瑑娄K坢Ö&Ù + readOnlyRootFilesystem: true + runAsGroup: 2234167178876811300 + runAsNonRoot: true + runAsUser: -1191472066985646800 + startupProbe: + exec: + command: + - KGi9U + - D6 + - HZ3aC1 + failureThreshold: -2057203764 + grpc: + port: -1203229903 + service: Xd + httpGet: + host: tTW + path: oWk + port: -1347841801 + scheme: 檸`sȝBULj懄 + initialDelaySeconds: 1386184157 + periodSeconds: 2110004457 + successThreshold: -692279219 + terminationGracePeriodSeconds: -7060466210747559000 + timeoutSeconds: -905577521 + terminationMessagePath: g + terminationMessagePolicy: 頨Ĥ° òȯǤū暓坐ƚă杋鍄 + volumeMounts: + - mountPath: FmQht + mountPropagation: 饌^ǩ朳ųW磀ĥAijƨ+= + name: j5 + subPath: aoEWb7k + subPathExpr: 0ra + workingDir: zmwmt + - command: + - oFEaN2U1 + - HuBj9vk17eCjI + - "" + env: + - name: n3JVvVY + value: U14PEXs + valueFrom: + configMapKeyRef: + key: Ai0Xg3owIe7XlG + name: U4 + optional: false + fieldRef: + apiVersion: ZyO4Jpwkp2hV + fieldPath: roNil + resourceFieldRef: + containerName: gx + divisor: "0" + resource: Z + secretKeyRef: + key: AcP + name: qMy + optional: false + - name: oSWakHA + value: eR + valueFrom: + configMapKeyRef: + key: qsSVOr + name: o + optional: false + fieldRef: + apiVersion: SeP3aPXfjLIcfE + fieldPath: 091i + resourceFieldRef: + containerName: T5hI + divisor: "0" + resource: KxGi43CVGe + secretKeyRef: + key: "" + name: 5uI + optional: true + envFrom: + - configMapRef: + name: MujT + optional: false + prefix: cVRH + secretRef: + name: mpF + optional: true + - configMapRef: + name: MeO3F + optional: false + prefix: w3C4 + secretRef: + name: hnYx + optional: false + - configMapRef: + name: NT5MFmC65 + optional: true + prefix: "7" + secretRef: + name: yl2ze1 + optional: false + image: A8o + imagePullPolicy: ?晐T鴭Xp + lifecycle: + postStart: + exec: + command: + - zaLOG2 + httpGet: + host: kA51kbv + path: LMnFclIJczBo + port: 402299955 + scheme: :踖坯(Iȷ碨劅 + sleep: + seconds: 245674034851902980 + preStop: + exec: + command: + - Tz87qO + httpGet: + host: Xr6sP + path: xxE + port: 1901089000 + scheme: 3媧ş>La芸`Lzuŀɽ坤¦.痻Jǻ + sleep: + seconds: 6906639179439192000 + livenessProbe: + exec: + command: + - yxk0313sz + failureThreshold: 385001414 + grpc: + port: 1589713469 + service: UA + httpGet: + host: ZWfT + path: vTNYug5RZh + port: -192111662 + scheme: e¢dYÜdz + initialDelaySeconds: 1708942834 + periodSeconds: 1356452566 + successThreshold: 1750780088 + terminationGracePeriodSeconds: -1272770054640189000 + timeoutSeconds: 1656218869 + name: FxzTg + ports: + - containerPort: 63673829 + hostIP: 4xjED0VKV0G + hostPort: 2007665826 + name: xbwJ + protocol: ¼vb皪螯ʉwʒR玔È覦劙 + readinessProbe: + exec: + command: + - 0S + - "" + - GkPj + failureThreshold: 1405674719 + grpc: + port: -1659132742 + service: gIFP + httpGet: + host: jYnI3ins7 + path: bIEaFAc1 + port: UHfz + scheme: ʼn + initialDelaySeconds: 1531278754 + periodSeconds: -238235402 + successThreshold: -1690388514 + terminationGracePeriodSeconds: -2788228502880198700 + timeoutSeconds: -567709755 + resizePolicy: + - resourceName: nxpzTS + restartPolicy: ƫŀMs+,ǼƞȒ + - resourceName: 61uCVQ1 + restartPolicy: /澰ɍ½鑀a帷[鞺鏨攬姟壃F$R犬 + resources: + requests: + YfM: "0" + restartPolicy: œ|F彟S崘Ȑ貸1Ũȷ+齳 + securityContext: + allowPrivilegeEscalation: true + capabilities: + drop: + - 鸎dĉç荧 + privileged: true + procMount: "" + readOnlyRootFilesystem: false + runAsGroup: 5795239965908151000 + runAsNonRoot: true + runAsUser: 2409160731771391000 + startupProbe: + exec: + command: + - D6j2Q + failureThreshold: 975103738 + grpc: + port: -2081980063 + service: Nh + httpGet: + host: vdLm3FUXIs + path: jqCqF + port: "" + scheme: Ű"ƆĩNÙ襔冠ʈ + initialDelaySeconds: 524220215 + periodSeconds: 923596095 + successThreshold: 547119693 + terminationGracePeriodSeconds: 7382309226647739000 + timeoutSeconds: -1902082444 + terminationMessagePath: 2i5 + terminationMessagePolicy: 踑ĆĦ荷ýA/ǎ桫 + tty: true + volumeDevices: + - devicePath: KlUUX + name: NWO + - devicePath: W1JLM + name: qNw + - devicePath: BVE + name: c + volumeMounts: + - mountPath: yCztpht + mountPropagation: 巧苄;钽肇謌ʭɿw刄wɰM迵. + name: Mv9 + subPath: RWmlw + subPathExpr: Oy + - mountPath: Gf + mountPropagation: ɩ + name: On78O + readOnly: true + subPath: s7p + subPathExpr: 57aJIvpEm + - mountPath: m + mountPropagation: 崌蠿Ƣ湺 + name: CXSu + subPath: F8oe + subPathExpr: S + imagePullSecrets: + - name: V1 + - name: AyLzRkaGE + - name: 3pZ8 + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: + y63G: wNiNvOMv + priorityClassName: 3A + securityContext: + fsGroup: 2302511509023017200 + fsGroupChangePolicy: 闦ñ禢`J鉤 + runAsGroup: -2347956389924857000 + runAsNonRoot: true + runAsUser: 1720952380350228700 + supplementalGroups: + - -621944387099711200 + sysctls: + - name: CvGz + value: "" + - name: dO + value: qwZyE + serviceAccountName: Cj + tolerations: [] + topologySpreadConstraints: + - labelSelector: + matchExpressions: + - key: pPoL + operator: ǭȉćŴ讶Y + values: + - "69" + - UC9 + - "7" + - key: 6toZoG + operator: Ġ+kʫȸ颷ʅÓ欽V譵; + values: + - go8adRXrn + - key: S + operator: ĕȻ*Gɝ靿暛_洳瑼Ĩ + matchLabelKeys: + - "" + - V7xIs1 + - eqq + maxSkew: 983843814 + minDomains: 854272231 + nodeAffinityPolicy: '>S篐ö抏茄(6' + nodeTaintsPolicy: e3äTȦ硷B捕萑Ǵ吷Ǿ邂Ǝièø + topologyKey: NoEcMWkg + whenUnsatisfiable: 幗鞲&渶Ÿɪ`鹵N + volumes: + - configMap: + name: KchYZFsbB3 + name: configs + - name: ieSo8V + secret: + defaultMode: 83 + secretName: mD0jl + - name: iPeR + - name: ZgdCb2kUB +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "KchYZFsbB3-test-connection" + namespace: "default" + labels: + X: zjmrl + "Y": yG0 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 6sW + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - name: V1 + - name: AyLzRkaGE + - name: 3pZ8 + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['KchYZFsbB3:424'] + restartPolicy: Never + priorityClassName: 3A +-- testdata/case-041.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: false +kind: ServiceAccount +metadata: + annotations: + 5DCBJ96u: 12Himnm + ZQrRxpb: Aa + abcRNo3AHIw: gH1 + creationTimestamp: null + labels: + T1: pMf7C + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: x + app.kubernetes.io/version: v2.7.0 + cxAL7zvwvb: tmEjSXwTK6 + helm.sh/chart: console-0.7.29 + name: 0Z71mJNQUx + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + T1: pMf7C + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: x + app.kubernetes.io/version: v2.7.0 + cxAL7zvwvb: tmEjSXwTK6 + helm.sh/chart: console-0.7.29 + name: Wq +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: 4uTKbvRNSh + kafka-sasl-aws-msk-iam-secret-key: tfc + kafka-sasl-password: NAMo + kafka-schema-registry-password: 5LUUey + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: i + kafka-tls-ca: Fydyp8 + kafka-tls-cert: R4y + kafka-tls-key: "" + login-github-oauth-client-secret: Y0 + login-github-personal-access-token: xyn + login-google-groups-service-account.json: zFJbYJ + login-google-oauth-client-secret: CsVVc6 + login-jwt-secret: SECRETKEY + login-oidc-client-secret: dsx + login-okta-client-secret: wr9eIA + login-okta-directory-api-token: Dy + redpanda-admin-api-password: O7kPq + redpanda-admin-api-tls-ca: 7ORz + redpanda-admin-api-tls-cert: IT + redpanda-admin-api-tls-key: KR25cT +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + role-bindings.yaml: |- + roleBindings: + - EQY9390E: null + WXyS: null + roles.yaml: |- + roles: + - {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + T1: pMf7C + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: x + app.kubernetes.io/version: v2.7.0 + cxAL7zvwvb: tmEjSXwTK6 + helm.sh/chart: console-0.7.29 + name: Wq +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: + Sxsz0HWh: z9cj + creationTimestamp: null + labels: + T1: pMf7C + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: x + app.kubernetes.io/version: v2.7.0 + cxAL7zvwvb: tmEjSXwTK6 + helm.sh/chart: console-0.7.29 + name: Wq + namespace: default +spec: + ports: + - name: http + port: 359 + protocol: TCP + targetPort: 363 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: x + type: tJUW +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + I4K: K1yz + creationTimestamp: null + labels: + T1: pMf7C + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: x + app.kubernetes.io/version: v2.7.0 + cxAL7zvwvb: tmEjSXwTK6 + helm.sh/chart: console-0.7.29 + name: Wq + namespace: default +spec: + replicas: null + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: x + strategy: + rollingUpdate: {} + type: 稫启玩ɡʂ56 龪o + template: + metadata: + annotations: + checksum/config: 2e1f5f5401bac9a6ca8b2205a50f20ebc4a08fcafa78467ca458eb9e8411b634 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: x + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: gRchHJ + operator: g>騿b鈐ʃB¾偡医選ȍ恋 + values: + - I + - Ei + - "" + - key: hyf + operator: 斒ʃǜƆƲ + values: + - QUyyD + - key: Bkmx + operator: ư酰姺醪芄堑 + weight: 751548356 + - preference: + matchExpressions: + - key: oLam + operator: 蟹 + values: + - ouUaVpYnKDUI + - key: vjw6GPYYTKt + operator: 竣iN¸嚿×ɮib + values: + - ZTaqp + - key: d8VuBX6qV + operator: 脼Ȩ + values: + - a8aOe1 + matchFields: + - key: twbeCR + operator: óçøG靼Ɏȸ­乷ɍ + values: + - fJAm6rm + - 2h8IU + - zE9 + weight: 291395585 + - preference: + matchExpressions: + - key: qC6uf99en + operator: 鼢犖龆醑IÐ肣ɚòĺIGʖƟ穿ź' + readOnlyRootFilesystem: true + runAsGroup: -6867300864246943000 + runAsNonRoot: true + runAsUser: 972586500223089800 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: ctE5Qa + name: gcTdF + subPath: "" + - mountPath: n8KpOJZ + name: "4" + subPath: "" + - mountPath: 3Ka7 + name: lBE0nAE + subPath: "" + - mountPath: cIK + mountPropagation: 爂 YLƝ«煘?沀#朚ń鮾+ğÔ + name: orwvhF0 + subPath: ivP1ha4I + subPathExpr: VPCFJYVRHf + - mountPath: s + mountPropagation: m椥扶ȟqÈ倕{峙刷} + name: O35 + subPath: AN + subPathExpr: vm7 + - mountPath: 7P72D19W + mountPropagation: 堂窜B,Ś贃腔Ʈ£顽ąfYR + name: 6Z + readOnly: true + subPath: d7MJ + subPathExpr: LF + - args: + - M5GoLEac + command: + - "" + env: + - name: xn + value: gHloqKCZA0M + valueFrom: + configMapKeyRef: + key: 9EasdvqH1 + name: 3Jm5qlVRdb + optional: false + fieldRef: + apiVersion: IEuh0S + fieldPath: yGW + resourceFieldRef: + containerName: 6ytjPS + divisor: "0" + resource: Z + secretKeyRef: + key: a1KfCCp1 + name: OspUW + optional: false + - name: 1jMB + value: gsvW9h + valueFrom: + configMapKeyRef: + key: lEB1Z + name: sB + optional: true + fieldRef: + fieldPath: zsUJ + resourceFieldRef: + containerName: 11SE1A + divisor: "0" + resource: OFZYobDs5 + secretKeyRef: + key: wwZ + name: 0z + optional: false + envFrom: + - configMapRef: + name: AuPTaMX7 + optional: true + prefix: YNB9WA + secretRef: + name: QyV6 + optional: true + - configMapRef: + name: N5izN44MJ + optional: true + prefix: 103jYU2pj + secretRef: + name: IsJ + optional: true + image: f + imagePullPolicy: ']L7掻钏ĚxǢRʃd×?ŠɓT{' + lifecycle: + postStart: + exec: + command: + - 1Kv + - F2E + - uX1vDFV + httpGet: + host: XQ5sY + path: 5X8E + port: ZEAsx0C5i + scheme: 巇L嶤n蔢ȥ.&h喵趶旃 + sleep: + seconds: 3646722142291548000 + preStop: + exec: + command: + - "98" + httpGet: + host: MWUlhjhJA + path: JM3LkEQY + port: I4x4q + scheme: ʄȀ%ʎ兒餐oc-c + sleep: + seconds: 2358122019278204000 + livenessProbe: + exec: + command: + - dyqr + - 79j + - 6N2YiU + failureThreshold: 1763651267 + grpc: + port: 1387074657 + service: m + httpGet: + host: G + path: 9kp6wlF5 + port: 5zuLtPI + scheme: d輢殣ſē诧Wɹ讏 + initialDelaySeconds: -1520109712 + periodSeconds: -1170771093 + successThreshold: -1383663641 + terminationGracePeriodSeconds: -1296467687071372800 + timeoutSeconds: 1017261975 + name: xf5VXbM9DX + ports: + - containerPort: -1245943187 + hostIP: iVo + hostPort: -1606480480 + protocol: à唿Ň癫俤健ǛƵ虰響 + - containerPort: 1088776251 + hostIP: mN + hostPort: 2006200810 + name: izfW + protocol: 蠣狓j霎緦(Lǫ[ + readinessProbe: + exec: + command: + - w + - ZZzn + failureThreshold: -841549142 + grpc: + port: -1318693763 + service: z3 + httpGet: + host: DK8AT0w + path: TQEPNMTrmL26 + port: -1446467943 + scheme: ś檊:& + initialDelaySeconds: -768827532 + periodSeconds: -2057604270 + successThreshold: -1558550931 + terminationGracePeriodSeconds: 6890017506404353000 + timeoutSeconds: -1558365951 + resizePolicy: + - resourceName: BhJ20rFM28sOexT + restartPolicy: 槟"äÅ緦Xjê荀谆 + resources: + limits: + 3yphxx: "0" + requests: + "71": "0" + qj1cwc9x: "0" + xIH2: "0" + restartPolicy: 兜藄墲皀 + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - 翇ƒ\Ý琂麌褶犗錀Ć姉溬[I珵巖â迍Õ + - ȖnS¦ºǀʼndz&ü1 + privileged: false + procMount: ǻ\頧ADȜ[ʋɺɗ鬌ʢ栵鏆W剨 + readOnlyRootFilesystem: true + runAsGroup: -8217745538717204000 + runAsNonRoot: false + runAsUser: 8409092840666673000 + startupProbe: + exec: {} + failureThreshold: 514371514 + grpc: + port: 1386630692 + service: 5k9JljF + httpGet: + host: Yxa + path: KKzxL + port: 1749552838 + scheme: ǁ1钥`岺ȱ$ + initialDelaySeconds: 198009978 + periodSeconds: 1269387330 + successThreshold: 150401625 + terminationGracePeriodSeconds: 756942197968954200 + timeoutSeconds: -1507606503 + stdin: true + stdinOnce: true + terminationMessagePath: Yuuqhx + tty: true + workingDir: cNvZ0 + - args: + - EBJwKsy + - 88iT6Xcn + - XcT28aSWj + command: + - KYgqdbR + envFrom: + - configMapRef: + name: N30BWF9jx + optional: true + prefix: b + secretRef: + name: g + optional: true + - configMapRef: + name: vkY + optional: false + prefix: gn67ft + secretRef: + name: 9bmgS + optional: true + image: mhs + imagePullPolicy: agŒJ!Ǽƴ硴ĘBjp¸ǟ鏔ȫv + lifecycle: + postStart: + exec: {} + httpGet: + host: k1oZic + port: kWma + scheme: /A縊$/Ðl脿ʅK\Yû¡DȜ + sleep: + seconds: 4880710696024837000 + preStop: + exec: + command: + - mE1S + httpGet: + host: wmLvZ + path: P8Lw + port: 2130804875 + scheme: Aɷĝ/éȏ圳%)n帣 + sleep: + seconds: 5681554568621785000 + livenessProbe: + exec: + command: + - g + - 1tbHYej2 + failureThreshold: 721918154 + grpc: + port: 977234381 + service: K8 + httpGet: + host: o1a + path: EL + port: 606530945 + scheme: ɬ憋} + initialDelaySeconds: 527377871 + periodSeconds: 1831783866 + successThreshold: -925249104 + terminationGracePeriodSeconds: -5462814855858063000 + timeoutSeconds: 1067001478 + name: Cyr + ports: + - containerPort: -1582092218 + hostIP: HefrxT + hostPort: -1694778841 + name: "5" + protocol: 5訙奆Ņ蘹Ǭ馲ǧõsg + - containerPort: -1709296974 + hostIP: S + hostPort: -12435236 + name: RQIJVqVp + protocol: ı+=Ŷ\褭昊 + readinessProbe: + exec: + command: + - LxHQI2 + failureThreshold: -1670032382 + grpc: + port: 2038020216 + service: uS1pHYQuE + httpGet: + host: dFCk9 + path: 2YYVJoTxFI + port: 1533020718 + scheme: 侅弴噉讀ŲĨ趚ʉB + initialDelaySeconds: 753694711 + periodSeconds: -620933924 + successThreshold: 1935472803 + terminationGracePeriodSeconds: -1414957386950590200 + timeoutSeconds: 1810571120 + resources: + limits: + SwVZL: "0" + m6OD8E: "0" + requests: + bZQK: "0" + h9G0: "0" + hCGxGGtFgSx: "0" + restartPolicy: 毄鶏疡ɍʛ啔l鹯ą9掇悋ƦjþË + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - '*6珛åǪ' + drop: + - qć纣cȈʊ«Ȯ¤u俳糐郭ȉHT5į軌 + - ³R语 + privileged: false + procMount: GɛFȖ黸ȋȤá峠缂蛞·NN + readOnlyRootFilesystem: true + runAsGroup: 2219217566755129900 + runAsNonRoot: false + runAsUser: -6958635490019934000 + startupProbe: + exec: + command: + - VqKEGlA + - h1eQQmyq + failureThreshold: 1344510971 + grpc: + port: 1296412500 + service: 0FZIq + httpGet: + host: Gk + path: J1ncBCi + port: yqdEt689 + scheme: Ƹ陳ƨj>喐蠿鯌ʛB契p + initialDelaySeconds: -879591831 + periodSeconds: 1110714898 + successThreshold: -1301180826 + terminationGracePeriodSeconds: 3872467306429463000 + timeoutSeconds: 674947774 + terminationMessagePath: bm28lY3K2pwh + terminationMessagePolicy: Ȇƍ@¦Ț'±0ž + tty: true + volumeDevices: + - devicePath: o8dr + name: XmhFb + workingDir: 5wQN + - args: + - o0cO9clz7 + - HMSb + - 6uV0c + env: + - name: M3V9WePpx + value: ysO25 + valueFrom: + configMapKeyRef: + key: UqaJg4r + name: RfxtXP + optional: true + fieldRef: + apiVersion: lwe4YmNPx + fieldPath: tQj57vj + resourceFieldRef: + containerName: ZQ + divisor: "0" + resource: T + secretKeyRef: + key: x + name: ny4NEtt3z + optional: false + - name: cc2 + value: L0hw + valueFrom: + configMapKeyRef: + key: 385Ue36 + name: mmjoQw + optional: false + fieldRef: + apiVersion: 6oECJJ + fieldPath: viT + resourceFieldRef: + containerName: gwdJxK + divisor: "0" + resource: ck7 + secretKeyRef: + key: UuNsYAQvXJ0 + name: 1NAqDCU3 + optional: true + envFrom: + - configMapRef: + name: ZFk + optional: true + prefix: bXa4IzYR + secretRef: + name: aAJU + optional: false + image: JPgUP + imagePullPolicy: Q ¶ + lifecycle: + postStart: + exec: + command: + - r1uMNf + - M + - 8G + httpGet: + host: cuhhh + path: lXMriYoe + port: -988033465 + scheme: ',轄kzĒfť' + sleep: + seconds: -8820103652541682000 + preStop: + exec: + command: + - bElmX + httpGet: + host: bCNS + path: A0F + port: "" + scheme: 砘ɁA甜猷14ʣ)ǨƿŊ\ + sleep: + seconds: 821413986956195800 + livenessProbe: + exec: + command: + - M9y + - ay + - sRaY + failureThreshold: 600887441 + grpc: + port: 1597779369 + service: ua8K + httpGet: + host: 0XuF + path: V3 + port: -703127215 + scheme: 舷$趺É螳P阁]嚂驶钋琦袳$ƸO侎 + initialDelaySeconds: -1230549565 + periodSeconds: -335663932 + successThreshold: -1184112514 + terminationGracePeriodSeconds: 9077275487127833000 + timeoutSeconds: 1992088322 + name: pz + readinessProbe: + exec: + command: + - lVaA + - E9DNIWT7reP + - NW1Cc5O2 + failureThreshold: 1119300491 + grpc: + port: 2061347792 + service: fUXdOYJ9On + httpGet: + host: "0" + path: Us3pM3OkquAEW2 + port: -1693856749 + scheme: 鞡|鬟扝}肾~ + initialDelaySeconds: 1307857751 + periodSeconds: 1903760018 + successThreshold: 612917619 + terminationGracePeriodSeconds: -4296518247806248400 + timeoutSeconds: 1025631498 + resizePolicy: + - resourceName: "8" + restartPolicy: ȯy髚ʦ=ǰɮ瓿b:劀ǴáiO3IĮ + - resourceName: 8mFXK1FTs + restartPolicy: ėv|冿瀱Ƥ鐻D[ƼŮ/ + resources: + limits: + TVwPaoBqGL: "0" + juxQS6V3mr: "0" + requests: + igiG: "0" + restartPolicy: 皷ƴȿOvJ郦'欝 + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - ǐ缠]館ʚƾó|őɤ + - 6 銨dN_ZɻǦ絛顆麓 + - u鹍u鼓练gʘɍK]痰痁鶄Ȼ咶嚅俊ǙǕ + drop: + - 沎闸埲dz + privileged: false + procMount: "" + readOnlyRootFilesystem: false + runAsGroup: -265773045457612130 + runAsNonRoot: true + runAsUser: -6489119899323829000 + startupProbe: + exec: + command: + - 95NULc + - cCLaGfz + failureThreshold: -414102461 + grpc: + port: 339886942 + service: 7hdbpU + httpGet: + host: bN6EBrngIW + path: Luv09 + port: plsGDEJ + scheme: ʔ垃桪抴痺MM温ǹ + initialDelaySeconds: 2135898388 + periodSeconds: 1107416140 + successThreshold: -648919802 + terminationGracePeriodSeconds: 4653203112295128000 + timeoutSeconds: 1294917615 + terminationMessagePath: C + terminationMessagePolicy: 擎:Ȓ + volumeDevices: + - devicePath: TGjb8dLs + name: QN5Dj50Kuoc + - devicePath: aRIfAur + name: wQ47Fq7W3WPNDG + - devicePath: 2Smu + name: 1Q3d5wRJf6 + volumeMounts: + - mountPath: 5Trbk9 + mountPropagation: 秮驇穁 + name: YvM + readOnly: true + subPath: pFKsUV + subPathExpr: mhIjzA + - mountPath: F3lqb + mountPropagation: 窆f + name: NJXDvoxv + subPath: zVGgP + subPathExpr: H + workingDir: IEObw8N + imagePullSecrets: [] + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: + JDRn7n: tOGfx + lKq0V88a: uR3S + vXzm2Hny: tURxvlp + priorityClassName: 6ZbHC + securityContext: + fsGroup: 3426922926776119300 + fsGroupChangePolicy: 橣 + runAsGroup: 8316915980597683000 + runAsNonRoot: false + runAsUser: 6270039107728701000 + supplementalGroups: + - -2399342924686736400 + - 620655430084388100 + serviceAccountName: gIkiPRSc53Eb4w + tolerations: + - effect: ć`湇Ȏ2篤螕巴蛬>@ø£鞌q + key: E7p + operator: 畁鼄瓈貔Ĕ釲ĸȚ貺|ǴĄl蔺İɽ糹 + tolerationSeconds: 3092681449541781000 + value: Zmrz8 + topologySpreadConstraints: [] + volumes: + - configMap: + name: eHZ + name: configs + - name: gcTdF + secret: + defaultMode: 210 + secretName: MPU + - name: "4" + secret: + defaultMode: 186 + secretName: s6 + - name: lBE0nAE + secret: + defaultMode: 412 + secretName: RG + - name: "4" + - name: Kry +--- +# Source: console/templates/hpa.yaml +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + creationTimestamp: null + labels: + "": vWjW + G: qF + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 84QIe + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: eHZ +spec: + maxReplicas: 165 + metrics: + - resource: + name: cpu + target: + averageUtilization: 42 + type: Utilization + type: Resource + - resource: + name: memory + target: + averageUtilization: 454 + type: Utilization + type: Resource + minReplicas: 187 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: eHZ +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "eHZ-test-connection" + namespace: "default" + labels: + "": vWjW + G: qF + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 84QIe + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['eHZ:190'] + restartPolicy: Never + priorityClassName: 6ZbHC +-- testdata/case-043.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: Gma + namespace: default +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: y0pa6pm83 + namespace: default +spec: + ports: + - name: http + port: 11 + protocol: TCP + targetPort: 465 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: 9TsjJQkJZ +--- +# Source: console/templates/ingress.yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + GOF: Fk7wcu + J2: ViiBwn6 + WODaheluZ: jCoFdBnr + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: y0pa6pm83 +spec: + ingressClassName: 4Z1r6JSTY + rules: + - host: chart-example.local + http: + paths: + - backend: + service: + name: y0pa6pm83 + port: + number: 11 + path: / + pathType: ImplementationSpecific + tls: + - hosts: + - hAi45 + - N3wGXf + - 2Og0 + secretName: 11BdzGx + - hosts: + - MPqkMom + - mBwetJrK + - PcEKgK + secretName: HtA + - hosts: null + secretName: jRYKg +-- testdata/case-044.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + BvJq2xZ: jY6O0 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tvDI + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: W9k + namespace: default +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + role-bindings.yaml: |- + roleBindings: + - UiHg9: null + - "": null + mAYLjAybA: null + roles.yaml: |- + roles: + - 0NpG04j: null + UxtPt: null + l5dMdK: null + - J9: null + MzWfEl: null + yNu: null + - "": null + Pv: null + tGJIDyXG: null +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + BvJq2xZ: jY6O0 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tvDI + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: resP +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: + CRHNsVY: Nl04 + creationTimestamp: null + labels: + BvJq2xZ: jY6O0 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tvDI + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: resP + namespace: default +spec: + ports: + - name: http + port: 103 + protocol: TCP + targetPort: 329 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: tvDI + type: "" +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + 4i: zwiMMKf + ZTKUDg2t: qHc7 + fGsx: dIpd + creationTimestamp: null + labels: + BvJq2xZ: jY6O0 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tvDI + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: resP + namespace: default +spec: + replicas: 410 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: tvDI + strategy: + rollingUpdate: {} + type: ɬdW5f + template: + metadata: + annotations: + N0F: vSjZxkjW + checksum/config: 8ebe1d816245b967e7ea3109d93ad79599a2b8a33eed8e72fc85166d6ffa7aaf + creationTimestamp: null + labels: + K1uahi: UMygEU2O2 + app.kubernetes.io/instance: console + app.kubernetes.io/name: tvDI + ecdKkB: "1" + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: AFOKvXU + operator: ¸藬 + values: + - vIFxLM + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + ZpWVx: agTJ2kP3DWNYN + matchLabelKeys: + - "4" + mismatchLabelKeys: + - 0qG + namespaceSelector: + matchExpressions: + - key: D8 + operator: d|ɬ曖 + values: + - p3iQYi6Y + - key: c + operator: ǵmV逛鲳鈐譮稹ÚȾČXú + values: + - a + - 3C55L6S7 + - SQaxr + matchLabels: + "5": jC + namespaces: + - oDKjy + - "" + topologyKey: C9jgFk + weight: 1276231314 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: lGp2 + operator: "" + matchLabels: + "": sKP1q2 + 44krG: UrYUSMsisV + unYZqLh67: tMKQ + matchLabelKeys: + - orDt3ZdEA + - LIBJK3 + mismatchLabelKeys: + - bgz2i + - CNqlQJ + namespaceSelector: + matchExpressions: + - key: 35CZTXLY + operator: 掟0笝润ɲDGĪ1Ɋ乧鴹ǥ + values: + - OOB1s + - o4H + - key: f21 + operator: nȿqh + namespaces: + - L0w7 + - DB9 + - T1mom4CrS + topologyKey: OWKJz + podAntiAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: WaOHp + operator: Ƥ熅ǒe²敹Ņ0ľ(Ȯɩ6ÿ + - key: 0X + operator: be3蚛鷿_鴈y+圚ʀF虹D + values: + - ZIZDTnyfwD + - B4NWO9ffPz + - 1jsu + matchLabelKeys: + - mXhYg + mismatchLabelKeys: + - mp6 + namespaceSelector: + matchExpressions: + - key: xE + operator: ʩ畕 + values: + - uc7IZ + - Hxl1 + - key: Xb41Q + operator: cʓʁ卡嵷韻 + values: + - pA + namespaces: + - edcrY + topologyKey: sP2BdI + - labelSelector: + matchExpressions: + - key: U0 + operator: 卢ʩ + values: + - OBtefl + - yMIZlx + - key: X + operator: Ǔ%é鵔:ß侙鞅 + values: + - s1qg3meB + - e6J6ZH89 + - key: dhFO + operator: ƋŎ頖,é襺枣Ť卩骏ɰ抟篧JɂǛȝȵ + values: + - R9sJoCz + matchLabels: + 2T: 84ZhksfB + matchLabelKeys: + - Yc41 + mismatchLabelKeys: + - zgncb + - pCwXYOK + - hViR + namespaceSelector: + matchExpressions: + - key: 3hWtuB6Y + operator: ʪ+ʜǻ拎奜跁ª4鶒鲒[ʒJi\ʝ)皡 + values: + - s + - key: xGSn + operator: 羥/Br=Z擧Ŀ泀Ą舨cïŕɘʡȽIJ鉽 + values: + - lOZtQ2cI + - Vk6 + - Ri3t + - key: Z6UDhR9VLqSA + operator: 淸c欨pɝo腛ı廓齩鄬檏繑郭>Ö呡 + values: + - s6hp + topologyKey: wZZTf + - labelSelector: {} + matchLabelKeys: + - afDo + mismatchLabelKeys: + - S + namespaceSelector: + matchExpressions: + - key: AWObA + operator: ĝf表OS厅啬児0~L槩华L稙訐\Tȼ + values: + - M39 + matchLabels: + 0D9: u5 + T1: xiLiZn + v6: nSQp5 + topologyKey: mr + automountServiceAccountToken: false + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: Ahlf + value: UEv + valueFrom: + configMapKeyRef: + key: uwaRvb + name: M8Iklu7qx + optional: true + fieldRef: + apiVersion: H + fieldPath: 43xb + resourceFieldRef: + containerName: t8wgC87mO + divisor: "0" + resource: Z + secretKeyRef: + key: "" + name: EQfJ3z7tv + optional: false + - name: xj + value: lwmxmxP + valueFrom: + configMapKeyRef: + key: "" + name: cdBhO + optional: true + fieldRef: + apiVersion: U + fieldPath: Dj1sswKP + resourceFieldRef: + containerName: 1p3yUdrvd + divisor: "0" + resource: 5A + secretKeyRef: + key: DDcgdcu + name: oD38 + optional: true + - name: LICENSE + valueFrom: + secretKeyRef: + key: x8ik3q + name: K7c7oe + envFrom: + - configMapRef: + name: 2ECaB + optional: true + prefix: bao + secretRef: + name: CA5S95 + optional: false + image: UqWwteW0x/TZqk:0fpMB + imagePullPolicy: 讘ɂȴɩF壜î栒p + livenessProbe: + failureThreshold: 1147871047 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -470682176 + periodSeconds: 842863336 + successThreshold: 2078067842 + timeoutSeconds: 1252398573 + name: console + ports: + - containerPort: 329 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 1026367217 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -233395254 + periodSeconds: -96619339 + successThreshold: -2083481091 + timeoutSeconds: 1827269276 + resources: + limits: + eYVLCq: "0" + requests: + P: "0" + VsuQcjg: "0" + jwq: "0" + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - ɐ毻sǨ斩麀|髦 + - (波F= + - 2鱶ɥǚ蘃齯ʃE桹蹝Ȓ畸蘋桙0 + drop: + - c掁轖e9\Ǟ¦ + - ȽT下Zź%賂蕄3 + - 乯`ŤĊŸ眸ʞ缔Ň妌嵳楕ǐwč*ǩ妩ɴ + privileged: true + procMount: ŃE诩Ŗś僆 + readOnlyRootFilesystem: true + runAsGroup: 6580465723841054000 + runAsNonRoot: true + runAsUser: -56006153890553620 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: v + mountPropagation: ?IJ純ʈxɧʅ + name: 9AiRaE35OlCv + readOnly: true + subPath: 2dv5RZ + subPathExpr: H7f + - mountPath: "4" + mountPropagation: 涾頴tOĜʥ朤 + name: ePEz + readOnly: true + subPath: BY + subPathExpr: w + - mountPath: n5FPgiJmk + mountPropagation: Ǵ棢__@ŗɆ4瞑5ŗ­L/ķ{篦ǯ + name: NryERK9Q + readOnly: true + subPath: tINFMAR5 + subPathExpr: VrBKy + - args: + - CCdc + - xnWsPf + - K9Lp8whZH + envFrom: + - configMapRef: + name: eRd + optional: true + prefix: jF9v + secretRef: + name: QS0dQM4 + optional: false + image: UEbFmY + imagePullPolicy: ɂǖ耒ȯ+Ǎ妸ÄĊ wʠB堯¥ƿɤp + lifecycle: + postStart: + exec: + command: + - 89MtW + - LOaqkcP + - JzjyxNZS + httpGet: + host: "3" + path: V + port: RUOELw + scheme: u*暪÷鰦ʭ,0噱D #干 + sleep: + seconds: 7312334685976475000 + preStop: + exec: + command: + - Cmo91luAq + - DTCwI + - d3Q8xly + httpGet: + host: e + port: -1761554680 + scheme: '|' + sleep: + seconds: -8572473558022234000 + livenessProbe: + exec: + command: + - 1K0Fir + - Ws + - jWym + failureThreshold: 1492079208 + grpc: + port: -1612320137 + service: wk3AYU + httpGet: + host: U + path: yLWf + port: dE + scheme: (魠ʫ倳|岺溻IJħu|æ粅 + initialDelaySeconds: -1551121242 + periodSeconds: 101556636 + successThreshold: -690762638 + terminationGracePeriodSeconds: -7606489989577612000 + timeoutSeconds: -947750725 + name: GKPhj2 + ports: + - containerPort: 690563670 + hostIP: mVXvug29A + hostPort: -1389446008 + name: pcUz3a8NWF + protocol: o& + readinessProbe: + exec: {} + failureThreshold: 816403475 + grpc: + port: 2090385753 + service: pp5W00 + httpGet: + host: sP9DV + path: cpLL + port: TNUIzm + scheme: '!敓GĜƝ塀ȏ@{8嶤ɍ|' + initialDelaySeconds: 911169006 + periodSeconds: 257542772 + successThreshold: 1702435185 + terminationGracePeriodSeconds: -4557510245814657500 + timeoutSeconds: -581799810 + resources: + limits: + 5UdZ91O: "0" + TXdC: "0" + bK0pEj0Mb: "0" + requests: + s8hZFXOGF: "0" + tCP: "0" + restartPolicy: Ǩ轡´@ǂȟ + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - 鿞;P粜鬌)Ǭ郑&鑉k!f] + - Ċ + drop: + - ?孡渄:Ơ廔晞!ē8瞅@rDZ_ + - cfdú¯'ƱơÅś祏侪 + privileged: true + procMount: ȝ?A@û2蝓撕%o摤絡) + readOnlyRootFilesystem: true + runAsGroup: -2314751572399379000 + runAsNonRoot: true + runAsUser: 989961539055775400 + startupProbe: + exec: {} + failureThreshold: 971752114 + grpc: + port: -1594677871 + service: O + httpGet: + host: EIXRs + path: EA1CukJtUZ + port: g9g0 + scheme: 遱O靑課淁hɕ怡ņ鲥 + initialDelaySeconds: -1020857297 + periodSeconds: 1332161137 + successThreshold: -1412285197 + terminationGracePeriodSeconds: -7087737322486666000 + timeoutSeconds: 563432789 + stdin: true + terminationMessagePath: S + terminationMessagePolicy: =ɑ_èʊâ錯Ɛ窾O亇_ + tty: true + volumeDevices: + - devicePath: 2EtZS + name: "" + - devicePath: glBRF4 + name: e8K + volumeMounts: + - mountPath: L4U + mountPropagation: '}6ʓ蓱9峖3疖售Ʉ朞' + name: 4oVeDs + subPath: RoA + subPathExpr: b + - mountPath: b3TFcP + mountPropagation: ʘʟ| + name: jg4Ya + subPath: F + subPathExpr: flS + workingDir: VZi6ElPHw + - command: + - 3xxCjTRw + env: + - name: 1n + value: cHl + valueFrom: + configMapKeyRef: + key: "95" + name: gi + optional: true + fieldRef: + apiVersion: sQA8hZeZu + fieldPath: xgpJlFJ2 + resourceFieldRef: + containerName: fLR0HyM + divisor: "0" + resource: Sanx4 + secretKeyRef: + key: XgKm5 + name: gvoS9jB + optional: false + - name: s2cwze + value: hu + valueFrom: + configMapKeyRef: + key: fDoUz3 + name: XKG + optional: true + fieldRef: + apiVersion: q0CUy1W + fieldPath: B3Lkh + resourceFieldRef: + containerName: V1gnkr8hpTmU + divisor: "0" + resource: 7PEJNYX + secretKeyRef: + key: IiBIw + name: kiXa5 + optional: false + envFrom: + - configMapRef: + name: JayMLn + optional: true + prefix: Iyk + secretRef: + name: I8 + optional: true + image: uuJKCAGoiYb + imagePullPolicy: '&mɈ{DC鹪ŘƖ暢C镯VĪɮJ樟' + lifecycle: + postStart: + exec: {} + httpGet: + host: TlUl + path: v9nd + port: Khf + scheme: 雦G'獲ɕ垑Ɠ奚 + sleep: + seconds: 3204757101293724700 + preStop: + exec: + command: + - s8505Cg5U + httpGet: + host: hAMBGK + port: LNxGid + scheme: 9?Ɉ + sleep: + seconds: -7512312074000843000 + livenessProbe: + exec: {} + failureThreshold: -1252597876 + grpc: + port: -544919593 + service: "N" + httpGet: + host: xfP + path: ByIZxFF1w + port: 465839308 + scheme: ôȔʄǽȕ$Ɨ嫸% + initialDelaySeconds: 1827740835 + periodSeconds: 1434348082 + successThreshold: 1145653124 + terminationGracePeriodSeconds: -9056662989967493000 + timeoutSeconds: -741454610 + name: pkN5 + readinessProbe: + exec: + command: + - pmJ6cF + failureThreshold: -182850181 + grpc: + port: -30654612 + service: q + httpGet: + host: Vra + path: tovB7 + port: -934938952 + scheme: Ⱥǵ1茆鯨ț]ų1ơñ澂 + initialDelaySeconds: -1966697414 + periodSeconds: -1866944455 + successThreshold: -259752087 + terminationGracePeriodSeconds: -4535014313385885000 + timeoutSeconds: -1545912021 + resizePolicy: + - resourceName: RxDBqX + restartPolicy: 韌ʮ濅& + - resourceName: spCee + restartPolicy: 腋+桯PɆ誎z4µ&ȁou-囈鵼夵v| + resources: + limits: + rElH: "0" + requests: + "": "0" + restartPolicy: 7GK¦碦ǒ抩Z芍緜 + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - NjǗA窇ţ + - 逈%Ǵ7QǚƶƜr + drop: + - 鹭Iv0蠤'Ɵ皝ƨ=¨ + privileged: false + procMount: èįƤ;L虥u籖ʄƎ}橃V炖 + readOnlyRootFilesystem: false + runAsGroup: -1041723617216276900 + runAsNonRoot: false + runAsUser: -3933065726531016000 + startupProbe: + exec: {} + failureThreshold: -983644738 + grpc: + port: 1827183629 + service: X7oC1 + httpGet: + host: vGk + path: ohKaYc + port: l1rVsh9 + initialDelaySeconds: -648569392 + periodSeconds: 873065120 + successThreshold: -612441773 + terminationGracePeriodSeconds: 6808330544454598000 + timeoutSeconds: 1534439066 + terminationMessagePath: VYh + terminationMessagePolicy: 唌Üi+ + volumeDevices: + - devicePath: DGsn + name: Ia + volumeMounts: + - mountPath: "14" + mountPropagation: 渉seǝ蕟厪ë嵎ǥ墮@ + name: "" + readOnly: true + subPath: C1G4VS1 + subPathExpr: eU + workingDir: odPxO + imagePullSecrets: [] + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: + 2i: dRi6btw6 + R4: UsW + fFNJXGk: XBkx + priorityClassName: 8KMLup9vb + securityContext: + fsGroup: -3027126285888131000 + fsGroupChangePolicy: 袺芥ŵ罋o郘渢e堫柝dž + runAsGroup: -3172565869747058000 + runAsNonRoot: true + runAsUser: 5739747577453986000 + supplementalGroups: + - -1289730562709624600 + - 2918948066534341000 + - 8836988143915676000 + sysctls: + - name: ZSspAgrV + value: ES11 + serviceAccountName: W9k + tolerations: [] + topologySpreadConstraints: + - labelSelector: + matchLabels: + 435gSB: cXqM + XuT: nA + sKWX6pPX: YyYe + maxSkew: -1347306472 + minDomains: 1890499147 + nodeAffinityPolicy: 扒Ŕ + nodeTaintsPolicy: 諹uɔM_灢ʫ6ªWŢ庿ɛ + topologyKey: 34nlpPe2Tl + whenUnsatisfiable: šĉ鎨嶕鯖Ťȯ蝲萤ɪeCŒ5ő3|押 + volumes: + - configMap: + name: resP + name: configs + - name: Kt6NIoVzEY + - name: O +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "resP-test-connection" + namespace: "default" + labels: + BvJq2xZ: jY6O0 + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tvDI + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['resP:103'] + restartPolicy: Never + priorityClassName: 8KMLup9vb +-- testdata/case-045.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: false +kind: ServiceAccount +metadata: + annotations: + "": zL + EANkzh: rmy + creationTimestamp: null + labels: + M1diW: PVb + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tOoxEiwdVpT + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: nX5G + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + M1diW: PVb + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tOoxEiwdVpT + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 9gCm5xz +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: naFpMBw + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: nKEzr + kafka-schema-registry-password: xU + kafka-schemaregistry-tls-ca: pc + kafka-schemaregistry-tls-cert: fF1z9FE + kafka-schemaregistry-tls-key: tx + kafka-tls-ca: bhhbwypQ + kafka-tls-cert: Dw1477 + kafka-tls-key: "" + login-github-oauth-client-secret: 1UD4N + login-github-personal-access-token: LmFkP6BgmLQ + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: m + login-jwt-secret: SECRETKEY + login-oidc-client-secret: cXdjG + login-okta-client-secret: eF90RohF + login-okta-directory-api-token: 1zXLSJEQ + redpanda-admin-api-password: rr4c4 + redpanda-admin-api-tls-ca: Eonnpq + redpanda-admin-api-tls-cert: aPCNgYI + redpanda-admin-api-tls-key: vlrLQ9I9 +type: Opaque +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + M1diW: PVb + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tOoxEiwdVpT + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 9gCm5xz + namespace: default +spec: + ports: + - name: http + port: 314 + protocol: TCP + targetPort: 398 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: tOoxEiwdVpT + type: C +--- +# Source: console/templates/hpa.yaml +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + creationTimestamp: null + labels: + M1diW: PVb + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tOoxEiwdVpT + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 9gCm5xz +spec: + maxReplicas: 305 + metrics: + - resource: + name: cpu + target: + averageUtilization: 344 + type: Utilization + type: Resource + - resource: + name: memory + target: + averageUtilization: 186 + type: Utilization + type: Resource + minReplicas: 326 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: 9gCm5xz +--- +# Source: console/templates/ingress.yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: {} + creationTimestamp: null + labels: + M1diW: PVb + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tOoxEiwdVpT + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 9gCm5xz +spec: + ingressClassName: y6u9o + rules: + - host: V + http: + paths: + - backend: + service: + name: 9gCm5xz + port: + number: 314 + path: VRp3 + pathType: WX + - backend: + service: + name: 9gCm5xz + port: + number: 314 + path: ZXqa + pathType: LXDjotJK + - backend: + service: + name: 9gCm5xz + port: + number: 314 + path: b + pathType: 6l3svu + tls: + - hosts: + - SzMunki + secretName: OT +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "9gCm5xz-test-connection" + namespace: "default" + labels: + M1diW: PVb + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: tOoxEiwdVpT + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - name: rTO7I + - {} + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['9gCm5xz:314'] + restartPolicy: Never + priorityClassName: Op +-- testdata/case-046.yaml.golden -- +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + "": WcYTY + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + rHtDM6k: ZY6Kw + name: fB6TF +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: BKbdr + kafka-sasl-aws-msk-iam-secret-key: Xs8UvJPyL + kafka-sasl-password: xW3EDKA + kafka-schema-registry-password: Vewx + kafka-schemaregistry-tls-ca: te + kafka-schemaregistry-tls-cert: JxH + kafka-schemaregistry-tls-key: jhxioPhQ + kafka-tls-ca: eP + kafka-tls-cert: H9 + kafka-tls-key: "" + login-github-oauth-client-secret: Q + login-github-personal-access-token: akEcq + login-google-groups-service-account.json: pJ8NQ + login-google-oauth-client-secret: vj6 + login-jwt-secret: SECRETKEY + login-oidc-client-secret: 8SCyi + login-okta-client-secret: Yd + login-okta-directory-api-token: q1rSa + redpanda-admin-api-password: mON + redpanda-admin-api-tls-ca: rNzsp + redpanda-admin-api-tls-cert: UStA + redpanda-admin-api-tls-key: 3E +type: Opaque +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: + aDeGG7F9S: 5d + creationTimestamp: null + labels: + "": WcYTY + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + rHtDM6k: ZY6Kw + name: fB6TF + namespace: default +spec: + ports: + - name: http + port: 271 + protocol: TCP + targetPort: 481 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: PK7oH1pcU3 +--- +# Source: console/templates/ingress.yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + A4M6T: IUmZ9 + AHN: gcT00IU6 + S: lzi1Q + creationTimestamp: null + labels: + "": WcYTY + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + rHtDM6k: ZY6Kw + name: fB6TF +spec: + ingressClassName: aU0xOzsFN + rules: + - host: chart-example.local + http: + paths: + - backend: + service: + name: fB6TF + port: + number: 271 + path: / + pathType: ImplementationSpecific + tls: + - hosts: + - PV + secretName: aHG1 + - hosts: + - bX + - Cu + - xuscoJ + secretName: fBCynrlb +-- testdata/case-047.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: + DQxrtk8: buiWLPbYq + HHbP: sAY + Y0DKOcTa: D82Nfh + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: nEojiMtRc + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: DSw7 + namespace: default +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: + 8v2: JbH + 95cxbjjD7C: JBMaJ + VY: yRV7d + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: nEojiMtRc + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: YUi5JpG + namespace: default +spec: + ports: + - name: http + port: 168 + protocol: TCP + targetPort: 227 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: nEojiMtRc + type: WAAXkZY +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + Bx5i3M: s + svlaTGpSHD: 7P9k + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: nEojiMtRc + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: YUi5JpG + namespace: default +spec: + replicas: null + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: nEojiMtRc + strategy: + rollingUpdate: {} + type: żʧȟ + template: + metadata: + annotations: + Mfsd: hmi + checksum/config: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b + creationTimestamp: null + labels: + 6dZAs: xJPaLHKS1Y2 + app.kubernetes.io/instance: console + app.kubernetes.io/name: nEojiMtRc + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: {} + weight: 182966451 + - preference: {} + weight: -2028220392 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: [] + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 5a5MXO + operator: kƎǦƙ«嚄ƭr騥邜Fċʐ叧F& + values: + - BRA + - Ywt7JHE + - key: TjE3wFb6 + operator: O`6ƥ縈L:Ckʄ鹟瑧 + values: + - "" + - dxDLfiL + - 0IgsneLlLo + - key: tuBbSOMR + operator: 桛ʫ褛ʒɩWkv濱瘛#Ěi邱CNǖ4孳 + values: + - 9zJ + - 7T3iJAwX + matchLabelKeys: + - ZYcvinlq + - PwQO9 + - M3gb + mismatchLabelKeys: + - e + - K1XrVh + - D1CkR8 + namespaceSelector: + matchExpressions: + - key: uqnyV6k + operator: rĮ'示嶠ĵ攛Ņ + - key: 0ONfMVB + operator: n梷E8ʟ菛晉 + values: + - Q + matchLabels: + IqH8n: pCJ16S + mUE: HyxdirX0F + namespaces: + - gptVP + - L + - 7CmPHtA + topologyKey: XDhewcrvK + weight: 2033587292 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: jcAfZ5VF + operator: 饀re + - key: sj + operator: U姑R° + values: + - p8zbO + - key: 2LmP5 + operator: ŸȢ庾塁BƖ + values: + - NN + matchLabels: + ApvKyKe: kHE9lIIleR + mismatchLabelKeys: + - n3VRcT5qX + - zGNqgUGNX + - hDZ + namespaceSelector: + matchExpressions: + - key: "7" + operator: 砃=G墈赞飍鵝7d + values: + - Uiz9BnY + - key: hd76 + operator: '{緶ɡnW' + values: + - vc1yj10y + - Je + - eg + - key: 06pjmB + operator: =帛胏 + values: + - RQ10 + - Z5WWhGqt + namespaces: + - seMTT1 + topologyKey: E + - labelSelector: + matchLabels: + oplIL: 67Fs0Yu4 + mismatchLabelKeys: + - T1 + namespaceSelector: + matchExpressions: + - key: hOQWYMD + operator: vǑ壞2â飿"Xʝ簮倏c + values: + - "0" + - key: WWGKqAgL + operator: '''OƼŪ祰ǑŗiU嘏ɮ?Ī語' + values: + - yU5IOsL + - koP + namespaces: + - lDs + - xQZsD + - J + topologyKey: j0k4ds + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 9nDdXGQwP + operator: '[痵lǝ,ǶÜÂD' + values: + - th + - u8xZ + - ucr3vqZeG + - key: QWVrK8k + operator: ʀăɼy耯#運+3坽« + values: + - 2lcZKn + - G2IQ + - YbYwv + - key: N4bc7Wn + operator: '%7`iɊȑ槦醒}' + values: + - NiSH90 + - 98iHVkt + - 0r3Yu9i + matchLabelKeys: + - zrV + - Ey + - R + namespaceSelector: + matchExpressions: + - key: gEbVS1wo + operator: z + matchLabels: + 2YURuF: "" + CJTjm6: nOFN + oUtlWUD: 0k14ag + topologyKey: M1yF5YA + weight: 477520510 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: mdjoxbr + operator: V2SŨǰ8嫟淦 + values: + - 3ww0Ei + - 2PjudE + - pmpvETB0n + - key: NFqQGo + operator: 处;Ƕk鎹û絹褡Sy + values: + - V + - key: HuZ + operator: ȓő&ś>S怭ť]E榕 + values: + - sUume + matchLabels: + ef2q: 4ZL0O9b + r8xqG: MJ + matchLabelKeys: + - "" + - "Y" + mismatchLabelKeys: + - djn6fDf + - ukZi8 + namespaceSelector: {} + namespaces: + - dOU1F + - 1ygQdj3xZ3YIf + - wvpeJx + topologyKey: Rq4K6z6 + weight: -1277100698 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: b + operator: "" + values: + - tmuB5 + - 9qE9GM + - oJpaRDn2 + - key: WY + operator: u酘b + values: + - RhO + - Cs2rDIRrPlii + - nG4bqoAkQU + - key: eMae + operator: ǟĕȴnjI覿9¥H艞ɋ + matchLabels: + ToIBbWL: 4k8X + i2qGkWjvF7QJ: pb0sZq + u12o4B4: Ybz + matchLabelKeys: + - HCKtJC7hm + mismatchLabelKeys: + - 21r0Z + - "" + namespaceSelector: + matchLabels: + 2BNgnKr7Ob: 5RffK5NB3ghhfO + bJC: WTOgH + uA: bxdRwsU + topologyKey: 2CsbupZ + - labelSelector: + matchExpressions: + - key: RIP + operator: Oȝ(氧罻 + values: + - 1bx3Fix9 + - key: eqQoi + operator: 68+ʈĘ + values: + - FgfwmYrR + - mznlyr2aLTGF + - GfAoC8M + matchLabels: + FKwNoJ: aJZxa + cEeo8ix: 3dHunLjp5 + ihSd: qG7x + matchLabelKeys: + - F6LQK + mismatchLabelKeys: + - ULcGW + - RYv + - fF + namespaceSelector: + matchExpressions: + - key: Tkp5 + operator: ȴ潺谡Ƣh躈ŮâÿȒũĔ + values: + - fY9NuWB + - O84 + matchLabels: + 09fI: EDSEVi + Dl: 4u38aD4O + vZCciR: neqAXd7k + namespaces: + - ozziI6FZ + - URQlLJF + topologyKey: SeSq4K + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: "" + value: YbKo + valueFrom: + configMapKeyRef: + key: bIruuA + name: x8 + optional: true + fieldRef: + apiVersion: EqX + fieldPath: ZOh + resourceFieldRef: + containerName: IDJTm5lv + divisor: "0" + resource: QDC8v + secretKeyRef: + key: "8" + name: LcSdNiKff4 + optional: false + - name: RZHq9C + value: m + valueFrom: + configMapKeyRef: + key: PZVqf + name: x + optional: true + fieldRef: + apiVersion: xQi + fieldPath: vxeo + resourceFieldRef: + divisor: "0" + resource: l7 + secretKeyRef: + key: i3lK + optional: true + - name: LICENSE + valueFrom: + secretKeyRef: + key: nj + name: rl + envFrom: [] + image: zUsK/lQjo:p + imagePullPolicy: ȕ蚧竔/´苅oC + livenessProbe: + failureThreshold: -1392926461 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -1384385388 + periodSeconds: -1660079876 + successThreshold: 680842396 + timeoutSeconds: 213455290 + name: console + ports: + - containerPort: 227 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 1689894479 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -1753994274 + periodSeconds: -1189421015 + successThreshold: 1278527365 + timeoutSeconds: -209775227 + resources: + limits: + 8ycM: "0" + requests: + CvglPI: "0" + s5: "0" + uiHB: "0" + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - «Ƙz损 + - ɟE鄱Į惪Y桦ŗɘoȍ蠣4ƪ呀R> + - "" + drop: + - 娤b + privileged: false + procMount: ʍ曏(ƶæ + readOnlyRootFilesystem: true + runAsGroup: -406748533537085800 + runAsNonRoot: false + runAsUser: 3238073083343117300 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: g + name: L8dbWip + subPath: "" + - mountPath: OO0aO6h + mountPropagation: "" + name: kDKM + readOnly: true + subPath: AlRCH + subPathExpr: 7UemLsIe + - mountPath: Z8zdlU + mountPropagation: 醗¡°v:胡 + name: aedAMG + subPath: zo5P1xa + subPathExpr: WmuiME + - mountPath: ufiUx + mountPropagation: '`ʡÔ关Ľ?' + name: PWBh + subPath: 2hslJ + subPathExpr: pUtN3 + - args: + - lW + - lpUVzUh + command: + - 3mEGtoKbEWE2Jw5T + - b1GBFA + env: + - name: hsiWF93 + value: zBco + valueFrom: + configMapKeyRef: + key: 8hvvaoHB + name: "y" + optional: false + fieldRef: + apiVersion: WPT5J + fieldPath: sc + resourceFieldRef: + containerName: 0xbTU4O + divisor: "0" + resource: tPBV2ObG + secretKeyRef: + key: YEKZukl + name: px + optional: false + - name: PM0MyyH3R6R + value: yOzX + valueFrom: + configMapKeyRef: + key: I3pi + name: DC + optional: true + fieldRef: + apiVersion: "25" + fieldPath: "" + resourceFieldRef: + containerName: aZj1E7LU + divisor: "0" + resource: sxs0nE31 + secretKeyRef: + key: Ktb3c4 + name: g98T + optional: true + - name: 6kDq8UgFIS8 + value: L0i4 + valueFrom: + configMapKeyRef: + key: 9WUe9 + name: tZrRUK + optional: false + fieldRef: + apiVersion: GIc + fieldPath: AXTmU + resourceFieldRef: + containerName: E2 + divisor: "0" + resource: a63tq + secretKeyRef: + key: luWp + name: lPdowo + optional: true + envFrom: + - configMapRef: + name: vzVk + optional: true + prefix: DONFyRd + secretRef: + name: 9uct + optional: false + - configMapRef: + name: z5nC9D + optional: true + prefix: 5epUyS1iy5m8 + secretRef: + name: zqRFC + optional: true + - configMapRef: + name: awjfJlZxN + optional: true + prefix: LhArOQgbq1OCR2L + secretRef: + name: mb5axzX5 + optional: true + image: qPLiX + imagePullPolicy: '{Ĩ檽]ĻĹňɋ偌Ȏ.阛魉' + lifecycle: + postStart: + exec: + command: + - yAeOM + - s53um + - 3m + httpGet: + host: GJWsJm + path: iDQ + port: 1781170742 + scheme: 皐ű葺ȝĬ麐&ʉ執dz0娸叹 + sleep: + seconds: -4230531115544534500 + preStop: + exec: + command: + - sIGb5 + httpGet: + host: AbxhPKar + path: 3ZZ5 + port: 88852320 + scheme: 砨Ĝ_筀¤痟氻劊űI俼员z幛F + sleep: + seconds: -4758564920159899000 + livenessProbe: + exec: + command: + - ty6JMTW6vA + failureThreshold: -1459976999 + grpc: + port: -1689493187 + service: ihsDMVYd + httpGet: + host: e9NNlO5d + path: iBo4 + port: 334788778 + scheme: ƿ:ħȠL$ + initialDelaySeconds: 1625633184 + periodSeconds: 1327859251 + successThreshold: 1766792721 + terminationGracePeriodSeconds: -3971501657411371000 + timeoutSeconds: 557348614 + name: U3U + readinessProbe: + exec: + command: + - "Y" + failureThreshold: 391027623 + grpc: + port: -1858356724 + service: hnqm + httpGet: + host: g + path: C48 + port: F + scheme: 苎lɲÁ频×ȊDžȀ9Ď"昽 + initialDelaySeconds: -1404160881 + periodSeconds: 521131323 + successThreshold: 2005094455 + terminationGracePeriodSeconds: -5942417190535485000 + timeoutSeconds: 2118365394 + resources: + limits: + Ms1A: "0" + WkWhM: "0" + requests: + b4kR9nm9BfQZy: "0" + eLg: "0" + huME: "0" + restartPolicy: ľ慔/PpǏ銢9滖ɝ韍I鍌$ʪ辫Uz + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - wą&嘪研Z`ȧȢfʘ*ō + drop: + - ƿ`ĉĎ苦Ǧ蘈NJ她笻Ƞ + - 磨3踦煨1JƸc錚捁 ĊZe)ám \ + privileged: true + procMount: 鋶XJm/覹ɋ¶ȉĒȤ瀶|ƻŒ(咡 + readOnlyRootFilesystem: false + runAsGroup: -8452021579348254000 + runAsNonRoot: true + runAsUser: 5983932912975749000 + startupProbe: + exec: + command: + - sZhTLr + - GK + - kqL9aDDm + failureThreshold: 1004086477 + grpc: + port: 1266077274 + service: l1ji1IW1ic + httpGet: + host: rJI + path: H731Dr + port: 1333462733 + scheme: 项鰚ɽ洍êƳ + initialDelaySeconds: 1806670133 + periodSeconds: 1290098703 + successThreshold: -490255445 + terminationGracePeriodSeconds: -206080146769410300 + timeoutSeconds: 270060590 + terminationMessagePath: P1HCGJEbJiD4 + terminationMessagePolicy: ʇ鞯BC鸼樁÷ǹ楺 + tty: true + volumeDevices: + - devicePath: a4 + name: 0bA + - devicePath: VeRXU9 + name: A0XbFJhG + - devicePath: fdim + name: RJf + workingDir: ZoDFb + imagePullSecrets: [] + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: {} + priorityClassName: 0P6RnoBeb5 + securityContext: + fsGroup: -6567182940167159000 + fsGroupChangePolicy: 6iɰ堂:齐ǪÈ + runAsGroup: -1787219330993537800 + runAsNonRoot: true + runAsUser: -5627543087390805000 + supplementalGroups: + - -3306962996817147400 + - 975882030005456500 + - -5263492609498468000 + sysctls: + - name: YC + value: 7JlDTCP6hs + serviceAccountName: DSw7 + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: YUi5JpG + name: configs + - name: L8dbWip + secret: + defaultMode: 184 + secretName: LF0O +--- +# Source: console/templates/hpa.yaml +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: nEojiMtRc + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: YUi5JpG +spec: + maxReplicas: 122 + metrics: + - resource: + name: cpu + target: + averageUtilization: 218 + type: Utilization + type: Resource + - resource: + name: memory + target: + averageUtilization: 488 + type: Utilization + type: Resource + minReplicas: 449 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: YUi5JpG +-- testdata/case-048.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + 4kU: mkn8 + Ro: NFx1P + Z1p: WE + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: W7q3X + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: sKa + namespace: default +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + role-bindings.yaml: |- + roleBindings: + - FZ5NQS6: null + - 0ToI: null + RTwav: null + mWwdgyM: null + - {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + 4kU: mkn8 + Ro: NFx1P + Z1p: WE + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: W7q3X + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 3um +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: + c: DNy + kDPtPpnL: kFmmx + creationTimestamp: null + labels: + 4kU: mkn8 + Ro: NFx1P + Z1p: WE + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: W7q3X + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 3um + namespace: default +spec: + ports: + - name: http + port: 311 + protocol: TCP + targetPort: 29 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: W7q3X + type: l5gj +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + Dgw3Wl: 7aofTp + creationTimestamp: null + labels: + 4kU: mkn8 + Ro: NFx1P + Z1p: WE + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: W7q3X + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 3um + namespace: default +spec: + replicas: null + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: W7q3X + strategy: + rollingUpdate: {} + type: 顓ǝSm + template: + metadata: + annotations: + checksum/config: 1f1200550e8f17e44439daf44ec8c9721945fe5e499d9d558666a7a6516a4bd3 + eG: vxInc0 + g: BI6yk + xCtSP: rQ + creationTimestamp: null + labels: + ZEXh: zufy + app.kubernetes.io/instance: console + app.kubernetes.io/name: W7q3X + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchFields: + - key: v + operator: ė + values: + - ln + - lU4zX8iz + - t0Xc + - key: s3fpu + operator: ɥ娿ăʄĠ mʓ銈E'袭ĵ + values: + - ljJlhx + - matchExpressions: + - key: qPBvuBghor + operator: 泱诅ʫt + values: + - a05XZwN + - SiAvFWs + - FhW1 + - key: MVFTcW + operator: º囜N赧0索d + values: + - c + - ghZI + - AjB0J + matchFields: + - key: QzMSpLW + operator: :ɉùȪÇzǥC货°ÕV? + - matchExpressions: + - key: pA7a1gYdV + operator: '[ĪtOK' + values: + - 2bE4Bw + - fyMOYi + - key: wshbw7Ix + operator: J槭~撑MS=ÑƎ薽饵a緗 + values: + - 9jt6 + matchFields: + - key: s1 + operator: 犫茬睶ňv + values: + - XhyH + - Ng1r1 + - nqis + - key: mHLiT + operator: ȁ佝L郗s稷tŻ+f舭拳鰵2e{a + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: jdvk + operator: ƶ + values: + - NV + - y4 + - V2XRZS + - key: 9VvAl5 + operator: <坎陸$§¤_ã檠奙Å饉J夗ɓ翩锸辸 + values: + - x26kYkJ + matchLabels: + DziixIJYd: yCXzPc + matchLabelKeys: + - XNuk + - RGLu + mismatchLabelKeys: + - aF3 + - R + - Tnj6SmTq + namespaceSelector: + matchExpressions: + - key: e1XR + operator: Kɞ窏ǿ,鸣ŰcNc + values: + - Yrq + matchLabels: + F2Pe7J: dlwTdhs + lK: nolQ + ys9z: euXWPiaJ3Bv + namespaces: + - tAzvw4OH1G + topologyKey: 6y + weight: -1640008169 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: XbjQvP + operator: V嶙NZ谡筩ǒ抂 + - key: i + operator: ɔŃ旓Ɍ鬺X + values: + - Zvx + - 7HWJ + - e4ucTP + matchLabelKeys: + - 0LSTZ + - ESk2r + mismatchLabelKeys: + - CKhfvR0Sg + namespaceSelector: + matchExpressions: + - key: A0tc + operator: 辛§ʢ垝V矋n握匞~嶯筪溆¸ + values: + - ML + matchLabels: + K1pr: ROFIwZhJYYo + ODc: 48WQ + namespaces: + - Wv7 + - zenLPw + topologyKey: tIVDde5U + weight: 1977587462 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: 3YyUamlR + operator: 橯F + values: + - dHitre + - 90jUjk + - key: NtnSL + operator: 臰sR=坵Ěcñ黪:ɻ寊â9dƎ\V + values: + - qqzycK + - key: ICXJGRFS + operator: $貕^eėǭD鳅ʇ + values: + - txX + - SFrkJ9r + - 3jOnwEW1 + matchLabels: + Uwj1kpV: oUXOYkF + o: ts5wRqjTyCy + matchLabelKeys: + - V2DNNCORe7ZRA + - pglXe4D + - w3881 + mismatchLabelKeys: + - xbi5KtUmR + - eZenitLdd + namespaceSelector: + matchExpressions: + - key: fxd5Y + operator: 頣R熗!A麳Ƚ6r爤暓 + values: + - oe46YF + - rT30v + matchLabels: + 4WA: EH + nRhlLLx1yHy: 5UFrj + namespaces: + - 7j92oP + - 2hf + topologyKey: "" + weight: 92207265 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: wBvol + operator: Ɂüɯ + values: + - eKmyok + - key: B2uj69 + operator: "" + - key: hLrZlh + operator: ȕ嵠味 ɼ_ + mismatchLabelKeys: + - W + namespaceSelector: + matchExpressions: + - key: Qu + operator: 亣i拴ÿ + values: + - OeiUsmYu + - oGXa6Ma + matchLabels: + "": Li + oDV7yR: NP + namespaces: + - PQjQb3LP + topologyKey: Gs1 + - labelSelector: + matchLabels: + "": nF + mismatchLabelKeys: + - YG6aQj + namespaceSelector: + matchExpressions: + - key: HpxPVtw + operator: z畘ŠƽǢ蘟\ɡ忕ɋ蜹5B + values: + - EQ + - RP3fBi + - key: Lv60cZut + operator: 裰ƈ + values: + - I9JbN + - dt + - Cya + - key: 0MGm8N + operator: 遍Ż + matchLabels: + nELvnrAFr: DClM + topologyKey: N57yxG + - labelSelector: + matchExpressions: + - key: "" + operator: KǞ}ɣȿ嚶宗荝«Dž + values: + - CGw32z4JHya + - E + - u5CDtdc + matchLabels: + J5LzcLei: kBwTCGZ + iLpqu: j4bqBNDjAK + jN: jUZ0u + matchLabelKeys: + - lNM + - K3nOO5 + - 9norFQpMiC + namespaceSelector: + matchExpressions: + - key: y4teb + operator: 蚯 + values: + - P + - O0 + - MvxOu + - key: v8w1Ok + operator: 8ƴņŨƊ¹艗胲ƦpYƿ9d脙~Ë + values: + - "4" + - "66" + namespaces: + - OtWsVW + - p + topologyKey: GeF + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: GRLHy + operator: Ä椶 + - key: Z + operator: ė牫ȃ汥Ƈ娍q\桕ɄNǴ + values: + - S1hMkP + - K + - x5coDg + - key: kJzBQ + operator: ʉĻ孺bɧɬʬ柿娤e¯]每) + values: + - DbD1 + - C5dyvNew + matchLabelKeys: + - 8G + - 7cCVU + - lN + mismatchLabelKeys: + - xJ5l + namespaceSelector: + matchExpressions: + - key: U89y + operator: ȓ2浿澰V缐厧钎wň莁願菶ʈ杈 + values: + - 9m6ydjpHu + - CatqpZmUCL + - dJz + - key: SIePbOJc6H + operator: ljR2qɟ$s櫮c雕Ů幔莁沥ʫľƙŝ + values: + - 75tj75r + - XiO + - key: "" + operator: 舄或崙Ĭɐ耼Ī弋禽$ + values: + - HWwXVr4o + - WEkwi8ZNDQ + - f + matchLabels: + fi8w0BX: Z48LRdXmkJ + namespaces: + - Yaw2NnfJ + topologyKey: ElKfd7Eo + weight: 1078166465 + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: rd10f1l + value: GtUE + valueFrom: + configMapKeyRef: + key: C1N + name: bi + optional: true + fieldRef: + apiVersion: 9GWlMsB + fieldPath: l2 + resourceFieldRef: + containerName: 4t + divisor: "0" + resource: eyjvzsf + secretKeyRef: + key: xBMOaej + name: O8AG + optional: false + - name: C + value: fYlde + valueFrom: + configMapKeyRef: + key: 4HvhDAkW + name: 5bgA7leE7 + optional: false + fieldRef: + fieldPath: zY6rf + resourceFieldRef: + containerName: S3 + divisor: "0" + resource: 3sD + secretKeyRef: + key: s43 + name: LpaQ + optional: true + - name: LICENSE + valueFrom: + secretKeyRef: + key: enterprise-license + name: 3VGefRh + envFrom: [] + image: VHbf77MFq/9Gz:Tg + imagePullPolicy: Ƀşb?師Ğ`3H觉趟糯襖 + livenessProbe: + failureThreshold: 279778022 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 1098820524 + periodSeconds: 414174316 + successThreshold: 1178515566 + timeoutSeconds: 873461419 + name: console + ports: + - containerPort: 29 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 37001950 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -396024246 + periodSeconds: -1467409206 + successThreshold: -1328773613 + timeoutSeconds: -1781454259 + resources: + limits: + 8cdWaeK7jVrR: "0" + HYBi6o: "0" + requests: + NOz: "0" + gH: "0" + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - Ɋ闻ǃɗʀd撪 + - 蘑ǪY桼ɮǚɳ爥ňB + drop: + - 乄}ñ0詘蛾牪坣缰ƩǏ薷©瓚`Ʋ虯r + - ǓJğ&ĊƯʝbǠCŪzgì + - ńǜ[ɪ判Uʋ]泘狔 + privileged: false + procMount: 媹:堏_ɟ榧禙Ɲ'瞟 + readOnlyRootFilesystem: false + runAsGroup: 2759228957449300500 + runAsNonRoot: true + runAsUser: -812867783664200800 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: WsSL4vxNxCkXP + name: Mt1 + subPath: "" + - mountPath: M5 + mountPropagation: 稤Bơ觓Ð琋 + name: yQHj49RtdzN + subPath: GdQkAKF + subPathExpr: Gvswh + - mountPath: QRg + mountPropagation: 搚Kƕ欕K貵蠜d旓ĀÝ虩釓 + name: qCEH27RF + readOnly: true + subPath: nHB05RuTZ + subPathExpr: K0yH + - args: + - 3QF + - k1BJBm + command: + - PMW + - j + - V7MAcfomz + env: + - name: rAzI53 + value: WlHlq + valueFrom: + configMapKeyRef: + key: zzIBsb + name: Bh261F + optional: false + fieldRef: + apiVersion: SlA + fieldPath: "6" + resourceFieldRef: + containerName: q0BBEv + divisor: "0" + resource: JE + secretKeyRef: + key: FvrZgBz + name: ZTBeic + optional: false + - name: uPptX + value: i9 + valueFrom: + configMapKeyRef: + key: JeHwi + name: TiQHOG1EsFUgIE + optional: true + fieldRef: + apiVersion: i7dd + fieldPath: Tu + resourceFieldRef: + containerName: ChdvA + divisor: "0" + resource: Eq1V33RTZQSJRJFg3V + secretKeyRef: + key: ojxn54r + name: L + optional: false + - name: Sl9Py25FX + value: e9 + valueFrom: + configMapKeyRef: + key: Zq80J9tyR0opcz + name: gy00dyvHFa + optional: true + fieldRef: + apiVersion: UJLSQy7zL + fieldPath: Xm4sg5H + resourceFieldRef: + containerName: ZmY7Fno6Fcop3 + divisor: "0" + resource: gqZwW + secretKeyRef: + key: v + name: hJDoWtjkfL + optional: true + envFrom: + - configMapRef: + name: RdWA + optional: true + prefix: Dq + secretRef: + name: BOBOO0sLIWw0e + optional: false + - configMapRef: + name: MoMnWNTC + optional: false + prefix: "3" + secretRef: + name: B58Vvj3 + optional: false + image: Vn5V + imagePullPolicy: 筥ǏŤČ癳嶧GĒH挕ÄHɡ + lifecycle: + postStart: + exec: + command: + - hTIx + - lslygl + - lSgx5G2IfU + httpGet: + host: GNVKz7 + path: d0Y + port: Igi + scheme: 莵łEǐ嫖ʒʔvŊ>ry5贛 + sleep: + seconds: -184172880642712450 + preStop: + exec: {} + httpGet: + host: tD1TkKV0ES + path: s6 + port: OpK5riOe96 + scheme: 琊*i#欱E唂ȧ鐄膶詃7 + sleep: + seconds: -4889549574266894000 + livenessProbe: + exec: {} + failureThreshold: 1591130939 + grpc: + port: -540029946 + service: aoAN2Lx03 + httpGet: + host: vWu + path: Lo + port: 1468671948 + scheme: ȯ煐IŢ + initialDelaySeconds: -1879733088 + periodSeconds: 1106663448 + successThreshold: 240850805 + terminationGracePeriodSeconds: -7405296717602936000 + timeoutSeconds: 524743651 + name: AInfx2Rak + readinessProbe: + exec: + command: + - oIA3 + - H + - 96Uj2 + failureThreshold: -1855887857 + grpc: + port: -495541010 + service: X + httpGet: + host: ZplmMg + path: tAAr + port: 1950182935 + scheme: ʂ綽oa;n轮ęB觼Z=G泇跢揌韇锶 + initialDelaySeconds: 1057136331 + periodSeconds: -2025421367 + successThreshold: -812558156 + terminationGracePeriodSeconds: 4314843605692522000 + timeoutSeconds: -1609986779 + resizePolicy: + - resourceName: EvmpG + restartPolicy: 4ɱ + - resourceName: hTB20ObO1 + restartPolicy: ½ŏ伐Q蔏ʝ噙漃袩J]Ɣ蒘岇 + resources: + limits: + KWlx2c: "0" + O: "0" + requests: + ZCJwGBL: "0" + restartPolicy: 1nĔ:蹮>s蹬ÍǺ + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - 迠寈搣弝渎İ- + drop: + - 檹Ɩ + - ɧ麧ç2ā兛杧蔙團载^P蚡5缿ʒU襩 + - cLD|ƶ虌Ȗ + privileged: false + procMount: ïƋ圏滜ľ転謀ĤP蹥ȅ|髃蒃Q癎æ + readOnlyRootFilesystem: false + runAsGroup: -4850605470374304000 + runAsNonRoot: false + runAsUser: 7731251064648991000 + startupProbe: + exec: + command: + - LqYoUQy3c4BE + - 5N + - Ug + failureThreshold: -1290004088 + grpc: + port: -1721281251 + service: H2p + httpGet: + host: 02CP5 + path: F609y + port: JjwFH + scheme: 珑 + initialDelaySeconds: -402608647 + periodSeconds: -1520214127 + successThreshold: 209058699 + terminationGracePeriodSeconds: -1900030585542850300 + timeoutSeconds: 1686394545 + terminationMessagePath: qixKzKz + terminationMessagePolicy: Ǥ衚蔁ʙ剠Ǡɭf~ + volumeDevices: + - devicePath: zM1 + name: jmc + - devicePath: IZ + name: PS + - devicePath: kN24U + name: Apu0r1U2 + workingDir: WgB + - args: + - 2Z37 + - 75kO + - TjvjkZTrc8s + command: + - M0NtzJ + env: + - name: 2EH + value: O + valueFrom: + configMapKeyRef: + key: J1ozKsuji + name: glLvAIHP7i + optional: true + fieldRef: + apiVersion: 3gAjGu + fieldPath: sNpuR8m + resourceFieldRef: + containerName: oxx + divisor: "0" + resource: PuKq + secretKeyRef: + key: Iua2L1LoCWMs2 + name: YfKwS8s + optional: true + image: PKNM + imagePullPolicy: ÍĪ0魣Ŋʒ + lifecycle: + postStart: + exec: {} + httpGet: + host: fsZ + path: EGnu + port: 765491661 + scheme: ?ğ叆ɂ&pʠ溶Ǚu + sleep: + seconds: 4688626474961013000 + preStop: + exec: {} + httpGet: + host: TB + path: "6" + port: -50369560 + scheme: ~Ǚɇ>ƃ\7]歉sh羘y4 + sleep: + seconds: -5293607398165582000 + livenessProbe: + exec: + command: + - 1g8dewdj + - lRmD + failureThreshold: -125369558 + grpc: + port: -1490211482 + service: R + httpGet: + host: CSGThzhG + path: 9NBKzoiFzs + port: -272474300 + scheme: ŀ + initialDelaySeconds: -1094670881 + periodSeconds: 1768141210 + successThreshold: -985604418 + terminationGracePeriodSeconds: -1297054466922920700 + timeoutSeconds: -1289231356 + name: KtKv6dg + ports: + - containerPort: -632764671 + hostIP: 8CU + hostPort: 917138107 + name: 1VgOx + protocol: 典ȫ窃ÛǪ3m患 + - containerPort: 739656218 + hostIP: dQQ3 + hostPort: -1348301133 + name: "3" + protocol: '?Ū慾ŘLº桒J:茦扰絥ǗȑĎ:' + readinessProbe: + exec: + command: + - qZ2J + failureThreshold: 293719665 + grpc: + port: 1235836411 + service: ig3 + httpGet: + host: Ws + path: FVnJhZq7I + port: -1075951148 + initialDelaySeconds: 321800409 + periodSeconds: -556535717 + successThreshold: -625124830 + terminationGracePeriodSeconds: -4084380722124342300 + timeoutSeconds: -904900305 + resizePolicy: + - resourceName: GKINnuJx + restartPolicy: Řl©=嬈牍]佧& + resources: + requests: + omO: "0" + uga5: "0" + xnRsp6C: "0" + restartPolicy: ʝdŌİ蒘傥>晑|癶x&ĭmŭƙŵ + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - 約nɤưHĞ4WƳǤȣ糥蠇t + - ¾ʃŔ冻楟?¿揈h嘼œ + drop: + - 7忭譺屩嫕ƞʅ袬/氼Xg养ȸ陣萓 + - 胨`鯵ƪĽ藹 + privileged: true + procMount: Ulƙxȿƌ乜溬噕瀆储铐\纬 + readOnlyRootFilesystem: true + runAsGroup: 4589112012742887000 + runAsNonRoot: true + runAsUser: 3204614620414442500 + startupProbe: + exec: + command: + - TFJ + failureThreshold: -585814509 + grpc: + port: 178002023 + service: lAuHCrE + httpGet: + host: "88" + path: Th + port: In + scheme: 鷵菭g顲Ⱦ穪 + initialDelaySeconds: -1856697198 + periodSeconds: 1469578394 + successThreshold: 160563852 + terminationGracePeriodSeconds: -4442318275257517600 + timeoutSeconds: -16211809 + terminationMessagePath: 513sVbgA + terminationMessagePolicy: 隓Ǽ屼Å7嗟Ʈ麝0{ȦDžĐ! + tty: true + volumeDevices: + - devicePath: ugQAJ + name: Jf + - devicePath: BFfnTD + name: kfF6CZ + volumeMounts: + - mountPath: C3 + mountPropagation: 呍婻厦ǒ絶偂蠛ƺ蠖蕍v貰Ė + name: DQvHajhHx + subPath: aYHGugq + subPathExpr: MSs + workingDir: OE + imagePullSecrets: [] + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: + Bm9U: oTYglG6dh + priorityClassName: l4Mowg + securityContext: + fsGroup: -3794452885502571500 + fsGroupChangePolicy: 欲飹Rɦ薕µL<Ĕ + runAsGroup: -3171560656159467000 + runAsNonRoot: true + runAsUser: -4412205905842408400 + supplementalGroups: + - -7215185124091152000 + - 5139656417921063000 + - 600742233156257700 + sysctls: + - name: Te + value: cKzihj + serviceAccountName: sKa + tolerations: + - effect: 嫜ʎ愤wßj硭 + key: JO1 + operator: ȼ¾Pȇ挮ƶȋ'蹑鶚嗵ïG + tolerationSeconds: -6027642013843151000 + value: a3XbyS + topologySpreadConstraints: [] + volumes: + - configMap: + name: 3um + name: configs + - name: Mt1 + secret: + defaultMode: 80 + secretName: ZxXI0Hhv +--- +# Source: console/templates/hpa.yaml +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + creationTimestamp: null + labels: + 4kU: mkn8 + Ro: NFx1P + Z1p: WE + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: W7q3X + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: 3um +spec: + maxReplicas: 1 + metrics: + - resource: + name: cpu + target: + averageUtilization: 468 + type: Utilization + type: Resource + - resource: + name: memory + target: + averageUtilization: 256 + type: Utilization + type: Resource + minReplicas: 224 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: 3um +-- testdata/case-049.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: + 5bpPp: ponDVyZ + Ml1: "" + lt: 6VN8BRlJd + creationTimestamp: null + labels: + 0HYkOrz: JCwpSW + 0TgDztQSY: P + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 8dJzE + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + ztm: qegfb80 + name: z12W + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + 0HYkOrz: JCwpSW + 0TgDztQSY: P + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 8dJzE + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + ztm: qegfb80 + name: 0BIfuN +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: SBJl + kafka-sasl-aws-msk-iam-secret-key: INqD5 + kafka-sasl-password: 78E + kafka-schema-registry-password: YMuFCG7qR + kafka-schemaregistry-tls-ca: 1y5yRb6O2b + kafka-schemaregistry-tls-cert: NuhkhpMV7b + kafka-schemaregistry-tls-key: 9zcrFj + kafka-tls-ca: 0PF + kafka-tls-cert: wArD + kafka-tls-key: "" + login-github-oauth-client-secret: jdPGF7 + login-github-personal-access-token: y6xqv + login-google-groups-service-account.json: xi1j27Lipj8 + login-google-oauth-client-secret: m6FeI + login-jwt-secret: SECRETKEY + login-oidc-client-secret: zbsTootC + login-okta-client-secret: rHSfT + login-okta-directory-api-token: rOXaN + redpanda-admin-api-password: 8c + redpanda-admin-api-tls-ca: CJbHIM + redpanda-admin-api-tls-cert: uO + redpanda-admin-api-tls-key: uhB0L +type: Opaque +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: + L: CP + Yf: K4waOjMg + tIYLLgy: d1szIPW6xt + creationTimestamp: null + labels: + 0HYkOrz: JCwpSW + 0TgDztQSY: P + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 8dJzE + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + ztm: qegfb80 + name: 0BIfuN + namespace: default +spec: + ports: + - name: http + port: 269 + protocol: TCP + targetPort: 479 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 8dJzE + type: IfYfRoHRG +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + BceQMZiOm: E1uakdHPkLNL + creationTimestamp: null + labels: + 0HYkOrz: JCwpSW + 0TgDztQSY: P + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 8dJzE + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + ztm: qegfb80 + name: 0BIfuN + namespace: default +spec: + replicas: null + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: 8dJzE + strategy: + rollingUpdate: {} + type: 擺m鷾DžPĨ + template: + metadata: + annotations: + "": cuRn + checksum/config: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b + qBdeU: EQv + creationTimestamp: null + labels: + O2n4u: kpFpu + app.kubernetes.io/instance: console + app.kubernetes.io/name: 8dJzE + g1c: XEOMg + spec: + affinity: + nodeAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: L + operator: 域%Ɠ礇!ʘl.ǷŠ该貹&N + values: + - oAk8rvkey + - Fb08GpumY + - key: YJGr + operator: '|4\i事!ų藦x鳜Ǫ' + values: + - 63Yvc + - key: j + operator: ¸瀖čņ!彅搀 + values: + - RnzdW + - Nxs + - unZuno + matchFields: + - key: wLP0QqdHBmd9e + operator: ȑwȼ嶢vC`ȖĜƐ桡牆ēIa,謧ŗ + - key: mdgmMZ + operator: Ō§ȶƔ>#Z骻5S洝岛Ċ啞. + values: + - Fvf6 + - key: GQsV + operator: 涥ȕêȩȋ婍0毙舺糩\DŽŅ饒 + values: + - XccQkxG + weight: -1172839714 + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: JpS0BkW + operator: 聣耥ʒ昼|Ȏ)ß瞖a癨櫒缮{v + - key: HLL3gv + operator: 铡ÞC腢z蟒Á + - key: iDGQV8Bjyu5Q + operator: 舢脛歛ƻ68 + values: + - eLCH7Nc + - QQqPUN + - "" + matchFields: + - key: AY2q9fnL + operator: ȏ伌鎩5桀ʁ + values: + - Uac + - K0q + - bY71A + - key: rBwZz + operator: '*ĴȉǼ矼SN]ʛ源' + values: + - 5yMkn + - key: S1C + operator: ÿƙ彋,嘲樦 + values: + - OXH + - vl1 + - uCYaO8Cn + - {} + podAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: mZ3rAF9 + operator: yŲĺȫ阁笵W®詃Œ + values: + - bhvFz + - key: uiaNXZcXT + operator: "" + - key: AAM + operator: 閸鬼駝洁c奊(Ƅ謍MǍ辰T堍癩)丗 + values: + - "9" + - ESiN3 + matchLabels: + kCSDZtsm5: vVk + oBlyCq: jlh + matchLabelKeys: + - BCZ8FFbh + - A + namespaceSelector: + matchExpressions: + - key: Lsf + operator: L + values: + - a0HB + - C + - key: eoj6ic3 + operator: ż伌oA汄俔ɿ7巪娻% + matchLabels: + Cx: wwPPM + namespaces: + - 9xhG + - JAutZqe4gGeuf + - "" + topologyKey: 1a + weight: 223935020 + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: LtGRhs + operator: 棺ǔ'ɘ砒Æ擑Ɵģ + values: + - GhM4BSJqNOf + matchLabels: + "": 7Ni + matchLabelKeys: + - yxF4 + - 22RoWr + - etRteovEh9 + mismatchLabelKeys: + - 7NOfe + namespaceSelector: + matchExpressions: + - key: 3KCX2 + operator: 臞ʀ¯弄Ɨ橎琜ġ鍳¶ȣ2墛.ɮ濎ɕ磞 + values: + - 5YiE0xEC + - 4spxMd + - vUPA + matchLabels: + YHIq: nS + topologyKey: F4 + weight: 716052627 + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchExpressions: + - key: "9" + operator: ĠƑȥ兾3ŶJ + - key: pPvuyWZ + operator: ;bļo刲+圊}MǏŅ惤ć + values: + - 9pMXT + - Ezwo11 + matchLabels: + 66347W: ccFxZoF9 + X: VrN5kt + mismatchLabelKeys: + - u4LyY1 + - zT + namespaceSelector: + matchExpressions: + - key: qwhutJo + operator: 垴ǞƼ + matchLabels: + OFxMkYx: lhxtM + topologyKey: WN8qbUgigF + weight: -1609734055 + - podAffinityTerm: + labelSelector: {} + matchLabelKeys: + - "" + mismatchLabelKeys: + - XnhP + - "" + - Bk + namespaceSelector: + matchExpressions: + - key: M + operator: Ǽ糨ʡ毺Ɇw + values: + - ntvI + - vs + matchLabels: + "4": 2Y2FBpcbg + namespaces: + - 1S8c + topologyKey: jxiZ4d + weight: 1993833508 + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchExpressions: + - key: EpKkdimp + operator: 额ƀ箰L禼aÅ顙)C舉 + - key: e2Zu7Kb + operator: t潱髦pö鵺b澁6銹 + values: + - z9n + - LdMQ + - r + matchLabels: + F: Nc + Qa2h5toVwd: GGxZ3BQ + l: Z6Rh + matchLabelKeys: + - LsCC + - dgmxxZW + mismatchLabelKeys: + - e + - Cb + - e0DAEluN + namespaceSelector: + matchLabels: + oJ56D: 33m + tkP8tO: mIkfyE6E + namespaces: + - VxN + - hbwB9 + - t + topologyKey: qag0unul + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: KAFKA_SASL_PASSWORD + valueFrom: + secretKeyRef: + key: kafka-sasl-password + name: 0BIfuN + - name: KAFKA_PROTOBUF_GIT_BASICAUTH_PASSWORD + valueFrom: + secretKeyRef: + key: kafka-protobuf-git-basicauth-password + name: 0BIfuN + - name: KAFKA_SASL_AWSMSKIAM_SECRETKEY + valueFrom: + secretKeyRef: + key: kafka-sasl-aws-msk-iam-secret-key + name: 0BIfuN + - name: KAFKA_TLS_CAFILEPATH + value: /etc/console/secrets/kafka-tls-ca + - name: KAFKA_TLS_CERTFILEPATH + value: /etc/console/secrets/kafka-tls-cert + - name: KAFKA_SCHEMAREGISTRY_TLS_CAFILEPATH + value: /etc/console/secrets/kafka-schemaregistry-tls-ca + - name: KAFKA_SCHEMAREGISTRY_TLS_CERTFILEPATH + value: /etc/console/secrets/kafka-schemaregistry-tls-cert + - name: KAFKA_SCHEMAREGISTRY_TLS_KEYFILEPATH + value: /etc/console/secrets/kafka-schemaregistry-tls-key + - name: KAFKA_SCHEMAREGISTRY_PASSWORD + valueFrom: + secretKeyRef: + key: kafka-schema-registry-password + name: 0BIfuN + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: 0BIfuN + - name: LOGIN_GOOGLE_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-google-oauth-client-secret + name: 0BIfuN + - name: LOGIN_GOOGLE_DIRECTORY_SERVICEACCOUNTFILEPATH + value: /etc/console/secrets/login-google-groups-service-account.json + - name: LOGIN_GITHUB_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-github-oauth-client-secret + name: 0BIfuN + - name: LOGIN_GITHUB_DIRECTORY_PERSONALACCESSTOKEN + valueFrom: + secretKeyRef: + key: login-github-personal-access-token + name: 0BIfuN + - name: LOGIN_OKTA_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-okta-client-secret + name: 0BIfuN + - name: LOGIN_OKTA_DIRECTORY_APITOKEN + valueFrom: + secretKeyRef: + key: login-okta-directory-api-token + name: 0BIfuN + - name: LOGIN_OIDC_CLIENTSECRET + valueFrom: + secretKeyRef: + key: login-oidc-client-secret + name: 0BIfuN + - name: REDPANDA_ADMINAPI_PASSWORD + valueFrom: + secretKeyRef: + key: redpanda-admin-api-password + name: 0BIfuN + - name: REDPANDA_ADMINAPI_TLS_CAFILEPATH + value: /etc/console/secrets/redpanda-admin-api-tls-ca + - name: REDPANDA_ADMINAPI_TLS_KEYFILEPATH + value: /etc/console/secrets/redpanda-admin-api-tls-key + - name: REDPANDA_ADMINAPI_TLS_CERTFILEPATH + value: /etc/console/secrets/redpanda-admin-api-tls-cert + envFrom: + - configMapRef: + name: GTjM + optional: true + prefix: GSbKp + secretRef: + name: vhsV8Pl5 + optional: true + - configMapRef: + name: cvXs + optional: false + prefix: cBFtb + secretRef: + name: x9N + optional: false + - configMapRef: + name: rDSrOmdL + optional: false + prefix: 0u3 + secretRef: + name: A6PG37zBJfwNR + optional: false + image: RCYS61Exfql/8ZLfmymq:4BSL9iL + imagePullPolicy: õ鴀铑û + livenessProbe: + failureThreshold: -567921134 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -507660572 + periodSeconds: 1912372611 + successThreshold: -232304560 + timeoutSeconds: 582403024 + name: console + ports: + - containerPort: 479 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 1010917423 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: -986314779 + periodSeconds: 1763110639 + successThreshold: 1473932979 + timeoutSeconds: 1291669389 + resources: + limits: + x6: "0" + requests: + eeR: "0" + l: "0" + xppI8xB: "0" + securityContext: + allowPrivilegeEscalation: false + capabilities: + add: + - 趩燡º嗂{踦 + - CƮ + drop: + - 殟kĔ=ņŧɋ] + privileged: false + procMount: aŻ釯fȠ埱ɺȚ + readOnlyRootFilesystem: true + runAsGroup: 4284419790643993000 + runAsNonRoot: true + runAsUser: -4828746969388386000 + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + - mountPath: AQpWvptFEk7y + name: 99SgdOsZD + subPath: "" + - mountPath: p44 + name: U + subPath: "" + - mountPath: UiI + name: WFd + subPath: "" + - mountPath: De7 + mountPropagation: 1k噟霞ƁĹ + name: 1Z2WnghTc + subPath: Ts5Ful + subPathExpr: YyidD + - mountPath: onM7c3 + mountPropagation: m=Cɬ + name: GC5ZsY07Mr + readOnly: true + subPath: Xt + subPathExpr: r6gZk + - mountPath: 8gPjX7hc + mountPropagation: ƃ柅珚ȭ能 + name: oN + subPath: auYcD + subPathExpr: aheb25w + - args: + - kn0F9 + command: + - M + - Hph3 + - lZfWKF + env: + - name: HBWtNh10A + value: 8guE + valueFrom: + configMapKeyRef: + key: Chnm + name: UlwzEQ + optional: false + fieldRef: + apiVersion: 8pq9 + fieldPath: qpnfP4p + resourceFieldRef: + divisor: "0" + resource: L0tn + secretKeyRef: + key: J + name: gbfgF + optional: true + envFrom: + - configMapRef: + name: n32MM + optional: true + prefix: cp3 + secretRef: + name: Uc + optional: true + - configMapRef: + name: VGBL + optional: true + prefix: NTMU + secretRef: + name: CEg + optional: true + image: zIWYBi7 + imagePullPolicy: 蘂ȱʃ& + lifecycle: + postStart: + exec: + command: + - QpTcv + - MS0T0N + - wiE + httpGet: + host: ZCUJOIH + path: UsXT + port: 8nExSP2u + scheme: 'uŊ6熀: 焆 烷ʫ-Ŗ亾ɣʖ氝"肰' + sleep: + seconds: -2519616411083819500 + preStop: + exec: + command: + - rmQ7 + - GxRXQk + httpGet: + host: UIVpXMrzW + path: 4tHQ + port: 8xLK1VyM + scheme: ƳǃóɃȊ{回żz闓葊G嚥 + sleep: + seconds: 3595323074300269600 + livenessProbe: + exec: {} + failureThreshold: -882825879 + grpc: + port: 503069299 + service: W + httpGet: + host: FilCCd + path: NPZrCEq + port: 6NoPho8wIsxe + scheme: āȹ顺悩錣Xƕ灄ĿG乒 + initialDelaySeconds: 781680731 + periodSeconds: 205458 + successThreshold: 1115648780 + terminationGracePeriodSeconds: 4579765768791485400 + timeoutSeconds: -676867842 + name: 2tf + readinessProbe: + exec: + command: + - edKf + - 0U + - MFr2Oh + failureThreshold: 1812906550 + grpc: + port: -791379232 + service: IAqADBco + httpGet: + host: 55GZ + path: AQC + port: sxTXcp + scheme: ƷMg靚珨嘸ȗʒ鑉Ȝ梒ŗǐkōĕĵ鞍 + initialDelaySeconds: -130429301 + periodSeconds: 876742351 + successThreshold: -1424043483 + terminationGracePeriodSeconds: -1574530902871555300 + timeoutSeconds: 764935409 + resources: + limits: + 9eHi: "0" + rO52puR: "0" + requests: + UF8LV7N: "0" + ao: "0" + cRVsAz8v: "0" + restartPolicy: ɥ]×璳 + securityContext: + allowPrivilegeEscalation: true + capabilities: + add: + - ɖ膵7&ʞíXĦx-ǰİɾ榩聨ŗ% + - DŽ熲鴼玜覲杷ȆƠ沺伤{拢 + - ɉȋʠRÂo霾噜奩ƻv$Áő + drop: + - ɑ摿愻J«ʘA宜ƹ¶ + - 餫aJ矐sǁ隑z36渢X赼 + - )ǜ鄰挺溒ŒV栜Ù涸JH-_d + privileged: false + procMount: Ito縎 + readOnlyRootFilesystem: false + runAsGroup: 2484782727894659600 + runAsNonRoot: false + runAsUser: -6936271037843915000 + startupProbe: + exec: + command: + - X + failureThreshold: -256045507 + grpc: + port: 376282302 + service: wdQrDn0 + httpGet: + host: teaO6 + path: DBHpGkYdgAJ + port: -1625640156 + scheme: Ʌ + initialDelaySeconds: 673272264 + periodSeconds: -1050905915 + successThreshold: 282500457 + terminationGracePeriodSeconds: 5768805478519710000 + timeoutSeconds: -601307290 + stdinOnce: true + terminationMessagePath: POO + terminationMessagePolicy: '#d鿂Hk閎=ɰ蜐ġOʡ蠁żǖ' + tty: true + workingDir: Z3pdGL + - args: + - a7Tqs + - UuID5t + - gRCnbjyp + env: + - name: ZV1KP + value: WrT0 + valueFrom: + configMapKeyRef: + key: zZzTgax + name: 3z3eoets + optional: true + fieldRef: + apiVersion: 88zo + fieldPath: z0vE72 + resourceFieldRef: + containerName: DF4t + divisor: "0" + resource: hfVfYFW4 + secretKeyRef: + key: I6JwpO5 + name: I88w22gsx3 + optional: true + - name: z8 + value: sgj8UHZ + valueFrom: + configMapKeyRef: + key: Q85vN + name: lYGl4 + optional: true + fieldRef: + apiVersion: oQu7 + fieldPath: TYd + resourceFieldRef: + containerName: "Y" + divisor: "0" + resource: Yx + secretKeyRef: + key: f + name: 0Pjf9YBj + optional: false + envFrom: + - configMapRef: + name: fAH + optional: false + prefix: vjjU + secretRef: + name: 9A8OgEQ9 + optional: false + image: R7L + imagePullPolicy: '}m6铤<豎ŵ,#M狥ʬo' + lifecycle: + postStart: + exec: + command: + - 2E + - gzntg + httpGet: + host: BOoVI + path: ns7ZMdNwQC + port: XF + scheme: ky咊ʅ ʂ娼ȟƐ橽ǿ唔ARɨ罙 + sleep: + seconds: -3978858376823544000 + preStop: + exec: + command: + - Hns + httpGet: + host: Lw8 + path: wdo + port: -239095421 + scheme: ƹ禍OÇ + sleep: + seconds: 3838288160382434000 + livenessProbe: + exec: + command: + - 8E + failureThreshold: -1052479375 + grpc: + port: 82058135 + service: S3UA2HwQaN + httpGet: + host: T0 + path: wYV6 + port: cEf + scheme: 斡1{嘫b葎剜屙唯皎図Ǜ錮ơxȒt駦Ƨ + initialDelaySeconds: -1976610733 + periodSeconds: 436460884 + successThreshold: -949159248 + terminationGracePeriodSeconds: 1786907735670591200 + timeoutSeconds: -2035324376 + name: 0ygO + readinessProbe: + exec: + command: + - "" + - YQ + failureThreshold: 1469514474 + grpc: + port: -1835111333 + service: 5WmTypZfT + httpGet: + host: BDf + path: ZY + port: tyrBXIqhX + scheme: 趬扬鉰昵 + initialDelaySeconds: -683847692 + periodSeconds: -95594828 + successThreshold: -1707399501 + terminationGracePeriodSeconds: 3256417681193515500 + timeoutSeconds: -2088454060 + resources: + limits: + zVX: "0" + restartPolicy: 晄d塮@ʥO%驮ÆgǍô + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ' 吓zǘa畷' + - 鲃ʍ瑘ƴɛjV艑ǔpMK杣Ġ + privileged: true + procMount: zɱÙŭǫäƿ诧聉ń醽Ƥ裩5 + readOnlyRootFilesystem: true + runAsGroup: -2381715627246700500 + runAsNonRoot: false + runAsUser: 6590063474480016000 + startupProbe: + exec: + command: + - "9" + - oRMM2F + - "" + failureThreshold: -1711876939 + grpc: + port: 1138187974 + service: OvdS + httpGet: + host: GZWJ + path: vzJeBCvGMHn7 + port: h9p1Pak + initialDelaySeconds: 447733263 + periodSeconds: 1805541821 + successThreshold: -1114184264 + terminationGracePeriodSeconds: 2730048172651207700 + timeoutSeconds: -1850805595 + terminationMessagePath: GK8 + terminationMessagePolicy: ɾDŽ÷郃ɻ玗璺,4 + volumeDevices: + - devicePath: bLf + name: UVN1o + - devicePath: fIT + name: Qiswb + - devicePath: 9b8i + name: h1 + workingDir: 1IOT + imagePullSecrets: + - name: h5x + initContainers: + - 'error unmarshaling JSON: while decoding JSON: json: cannot unmarshal string + into Go value of type []interface {}' + nodeSelector: + ra78: fJ + priorityClassName: JhGfjGXQ + securityContext: + fsGroup: 6449559755791186000 + fsGroupChangePolicy: 慩梱ʂcƎƱ\火ɘ²ɉ_ + runAsGroup: 841256803887707600 + runAsNonRoot: true + runAsUser: -2824253868920734700 + supplementalGroups: + - 8145086042470337000 + - -5005570809576723000 + serviceAccountName: z12W + tolerations: + - key: ka + tolerationSeconds: 2857628758439265300 + value: Ohni9QGx + topologySpreadConstraints: + - labelSelector: + matchLabels: + 3Ym: o2h5aVp + yR4PPZO: 3X + matchLabelKeys: + - vCKujB + - UqCFKCN + - Xnjfai + maxSkew: -943395897 + minDomains: 1955399000 + nodeAffinityPolicy: 噙撢馥櫱m>Q脕擏w梪 + nodeTaintsPolicy: 蝚溄鑝刉=歱Mr踄 + topologyKey: cHyq + whenUnsatisfiable: Q輒ƗȈʑǯƐ| + - labelSelector: + matchLabels: + E: lyK5b9t + UuSjduy: NcK4 + fty: iP6ai + maxSkew: 1881677866 + minDomains: -561571142 + nodeAffinityPolicy: ȫ寴ī嘌.樥'ǹs + nodeTaintsPolicy: ɇ剀ǨUǜ!俛dz餂~匹呃 + topologyKey: pCHj + whenUnsatisfiable: 尘I:Ƒ匌,騸 + volumes: + - configMap: + name: 0BIfuN + name: configs + - name: secrets + secret: + secretName: 0BIfuN + - name: 99SgdOsZD + secret: + defaultMode: 500 + secretName: B6Fq + - name: U + secret: + defaultMode: 337 + secretName: DddF02 + - name: WFd + secret: + defaultMode: 246 + secretName: tz +--- +# Source: console/templates/hpa.yaml +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + creationTimestamp: null + labels: + 0HYkOrz: JCwpSW + 0TgDztQSY: P + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 8dJzE + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + ztm: qegfb80 + name: 0BIfuN +spec: + maxReplicas: 292 + metrics: + - resource: + name: cpu + target: + averageUtilization: 255 + type: Utilization + type: Resource + - resource: + name: memory + target: + averageUtilization: 99 + type: Utilization + type: Resource + minReplicas: 381 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: 0BIfuN +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "0BIfuN-test-connection" + namespace: "default" + labels: + 0HYkOrz: JCwpSW + 0TgDztQSY: P + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: 8dJzE + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + ztm: qegfb80 + annotations: + "helm.sh/hook": test +spec: + imagePullSecrets: + - name: h5x + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['0BIfuN:269'] + restartPolicy: Never + priorityClassName: JhGfjGXQ +-- testdata/console-config-listen-and-target-port.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + server: + listenPort: 3333 +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 4444 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: f57fffad24d8562b91b674515ee68bfe758dbbfe634dcd2bb3497934f70538c9 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 3333 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console + name: configs + - name: secrets + secret: + secretName: console +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console:8080'] + restartPolicy: Never + priorityClassName: +-- testdata/console-config-listen-port.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + server: + listenPort: 3333 +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: f57fffad24d8562b91b674515ee68bfe758dbbfe634dcd2bb3497934f70538c9 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 3333 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console + name: configs + - name: secrets + secret: + secretName: console +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console:8080'] + restartPolicy: Never + priorityClassName: +-- testdata/console-with-role-bindings.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + role-bindings.yaml: |- + roleBindings: + - metadata: + name: Redpanda POC + roleName: admin + subjects: + - kind: user + name: e2euser + provider: Plain +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: fb8e6e138b819f5ea3ae5c413e14f624501b139f2294e15c4f188ec463049755 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console + name: configs + - name: secrets + secret: + secretName: console +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console:8080'] + restartPolicy: Never + priorityClassName: +-- testdata/console-with-roles-and-bindings.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + role-bindings.yaml: |- + roleBindings: + - metadata: + name: Redpanda POC + roleName: admin + subjects: + - kind: user + name: e2euser + provider: Plain + roles.yaml: |- + roles: + - name: my-role + permissions: + - allowedActions: + - '*' + excludes: + - '*' + includes: + - '*' + resource: 1234 +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: a586a304567f15fd4a79d95e15044439368fd8985e42a1a93cdcb6d0b540ed57 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console + name: configs + - name: secrets + secret: + secretName: console +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console:8080'] + restartPolicy: Never + priorityClassName: +-- testdata/console-with-roles.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} + roles.yaml: |- + roles: + - name: my-role + permissions: + - allowedActions: + - '*' + excludes: + - '*' + includes: + - '*' + resource: 1234 +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: 1afc8dfaddbbe103d0707800bfc71b4cc8f14e12334b3e22484d2b73ef5d57c0 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console + name: configs + - name: secrets + secret: + secretName: console +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console:8080'] + restartPolicy: Never + priorityClassName: +-- testdata/custom-tag-no-registry.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: 4f717eb67ef3f4c7e8737af0264bfe0922c76494c9ee31f7f52c63a13b02de86 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console + envFrom: [] + image: redpandadata/console:my-custom-tag + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console + name: configs + - name: secrets + secret: + secretName: console +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console:8080'] + restartPolicy: Never + priorityClassName: +-- testdata/default-values.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: 4f717eb67ef3f4c7e8737af0264bfe0922c76494c9ee31f7f52c63a13b02de86 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console + name: configs + - name: secrets + secret: + secretName: console +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console:8080'] + restartPolicy: Never + priorityClassName: +-- testdata/extra-init-containers.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: 4f717eb67ef3f4c7e8737af0264bfe0922c76494c9ee31f7f52c63a13b02de86 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: + - args: + - |- + set -xe + echo "Hello 3!" + command: + - /bin/bash + - -c + image: mintel/docker-alpine-bash-curl-jq:latest + name: test-init-container + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console + name: configs + - name: secrets + secret: + secretName: console +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console:8080'] + restartPolicy: Never + priorityClassName: +-- testdata/ingress-templating.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: 4f717eb67ef3f4c7e8737af0264bfe0922c76494c9ee31f7f52c63a13b02de86 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console + name: configs + - name: secrets + secret: + secretName: console +--- +# Source: console/templates/ingress.yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + ingress: test + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +spec: + ingressClassName: null + rules: + - host: '"a-host"' + http: + paths: + - backend: + service: + name: console + port: + number: 8080 + path: / + pathType: Exact + tls: + - hosts: + - '"blah"' + secretName: my-secret +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console:8080'] + restartPolicy: Never + priorityClassName: +-- testdata/no-registry.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: ClusterIP +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: 4f717eb67ef3f4c7e8737af0264bfe0922c76494c9ee31f7f52c63a13b02de86 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console + envFrom: [] + image: redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console + name: configs + - name: secrets + secret: + secretName: console +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console:8080'] + restartPolicy: Never + priorityClassName: +-- testdata/service-nodeport.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + ports: + - name: http + port: 8080 + protocol: TCP + targetPort: 2000 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: NodePort +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: 4f717eb67ef3f4c7e8737af0264bfe0922c76494c9ee31f7f52c63a13b02de86 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 2000 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console + name: configs + - name: secrets + secret: + secretName: console +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console:8080'] + restartPolicy: Never + priorityClassName: +-- testdata/service-with-nodeport.yaml.golden -- +--- +# Source: console/templates/serviceaccount.yaml +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +--- +# Source: console/templates/secret.yaml +apiVersion: v1 +kind: Secret +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +stringData: + enterprise-license: "" + kafka-protobuf-git-basicauth-password: "" + kafka-sasl-aws-msk-iam-secret-key: "" + kafka-sasl-password: "" + kafka-schema-registry-password: "" + kafka-schemaregistry-tls-ca: "" + kafka-schemaregistry-tls-cert: "" + kafka-schemaregistry-tls-key: "" + kafka-tls-ca: "" + kafka-tls-cert: "" + kafka-tls-key: "" + login-github-oauth-client-secret: "" + login-github-personal-access-token: "" + login-google-groups-service-account.json: "" + login-google-oauth-client-secret: "" + login-jwt-secret: SECRETKEY + login-oidc-client-secret: "" + login-okta-client-secret: "" + login-okta-directory-api-token: "" + redpanda-admin-api-password: "" + redpanda-admin-api-tls-ca: "" + redpanda-admin-api-tls-cert: "" + redpanda-admin-api-tls-key: "" +type: Opaque +--- +# Source: console/templates/configmap.yaml +apiVersion: v1 +data: + config.yaml: | + # from .Values.console.config + {} +kind: ConfigMap +metadata: + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console +--- +# Source: console/templates/service.yaml +apiVersion: v1 +kind: Service +metadata: + annotations: + hello: world + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + ports: + - name: http + nodePort: 1000 + port: 8080 + protocol: TCP + targetPort: 0 + selector: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + type: NodePort +--- +# Source: console/templates/deployment.yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: {} + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + name: console + namespace: default +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + strategy: {} + template: + metadata: + annotations: + checksum/config: 4f717eb67ef3f4c7e8737af0264bfe0922c76494c9ee31f7f52c63a13b02de86 + creationTimestamp: null + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/name: console + spec: + affinity: {} + automountServiceAccountToken: true + containers: + - args: + - --config.filepath=/etc/console/configs/config.yaml + command: null + env: + - name: LOGIN_JWTSECRET + valueFrom: + secretKeyRef: + key: login-jwt-secret + name: console + envFrom: [] + image: docker.redpanda.com/redpandadata/console:v2.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 0 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + name: console + ports: + - containerPort: 8080 + name: http + protocol: TCP + readinessProbe: + failureThreshold: 3 + httpGet: + path: /admin/health + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + resources: {} + securityContext: + runAsNonRoot: true + volumeMounts: + - mountPath: /etc/console/configs + name: configs + readOnly: true + - mountPath: /etc/console/secrets + name: secrets + readOnly: true + imagePullSecrets: [] + initContainers: [] + nodeSelector: {} + priorityClassName: "" + securityContext: + fsGroup: 99 + runAsUser: 99 + serviceAccountName: console + tolerations: [] + topologySpreadConstraints: [] + volumes: + - configMap: + name: console + name: configs + - name: secrets + secret: + secretName: console +--- +# Source: console/templates/tests/test-connection.yaml +apiVersion: v1 +kind: Pod +metadata: + name: "console-test-connection" + namespace: "default" + labels: + app.kubernetes.io/instance: console + app.kubernetes.io/managed-by: Helm + app.kubernetes.io/name: console + app.kubernetes.io/version: v2.7.0 + helm.sh/chart: console-0.7.29 + annotations: + "helm.sh/hook": test +spec: + containers: + - name: wget + image: busybox + command: ['wget'] + args: ['console:8080'] + restartPolicy: Never + priorityClassName: diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/testdata/template-cases.txtar b/charts/redpanda/redpanda/5.9.7/charts/console/testdata/template-cases.txtar new file mode 100644 index 000000000..804cca4a6 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/testdata/template-cases.txtar @@ -0,0 +1,136 @@ +Manually crafted test cases for TestTemplate +-- default-values -- +# Intentionally left blank. (test of default values) + +-- console-with-roles -- +# console.roles specified +console: + roles: + - name: my-role + permissions: + - resource: 1234 + includes: + - "*" + excludes: + - "*" + allowedActions: ["*"] + +-- console-with-role-bindings -- +# console.roleBindings specified +console: + roleBindings: + - roleName: admin + metadata: + name: Redpanda POC + subjects: + - kind: user + provider: Plain + name: "e2euser" + +-- console-with-roles-and-bindings -- +# console.roles and console.roleBindings both specified +console: + roles: + - name: my-role + permissions: + - resource: 1234 + includes: + - "*" + excludes: + - "*" + allowedActions: ["*"] + roleBindings: + - roleName: admin + metadata: + name: Redpanda POC + subjects: + - kind: user + provider: Plain + name: "e2euser" + +-- autoscaling-nulls -- +# Autoscaling w/ explicit nulls +autoscaling: + enabled: true + targetCPUUtilizationPercentage: null + targetMemoryUtilizationPercentage: null + +-- autoscaling-cpu -- +# Autoscaling w/ memory no cpu +autoscaling: + enabled: true + targetCPUUtilizationPercentage: null + targetMemoryUtilizationPercentage: 10 + +-- autoscaling-memory -- +# Autoscaling w/ cpu no memory +autoscaling: + enabled: true + targetCPUUtilizationPercentage: 14 + targetMemoryUtilizationPercentage: null + +-- service-nodeport -- +# Service type NodePort +service: + type: "NodePort" + targetPort: 2000 + +-- service-with-nodeport -- +# Service w/ NodePort +service: + type: "NodePort" + nodePort: 1000 + annotations: + hello: world + +-- ingress-templating -- +ingress: + enabled: true + annotations: + ingress: test + hosts: + - host: '{{ "a-host" | quote }}' + paths: + - path: / + pathType: Exact + tls: + - secretName: my-secret + hosts: + - '{{ "blah" | quote }}' + +-- no-registry -- +image: + registry: "" + +-- custom-tag-no-registry -- +image: + registry: "" + tag: my-custom-tag + +-- console-config-listen-port -- +console: + config: + server: + listenPort: 3333 + +-- console-config-listen-and-target-port -- +service: + targetPort: 4444 +console: + config: + server: + listenPort: 3333 + +-- extra-init-containers -- +# NB: Many of the generated tests have an invalid value for extraInitContainers +# as it's just a string and render an error message. This case showcases what +# valid YAML looks like. +initContainers: + extraInitContainers: |- + - name: {{ "test-init-container" | quote }} + image: "mintel/docker-alpine-bash-curl-jq:latest" + command: [ "/bin/bash", "-c" ] + args: + - | + set -xe + echo "Hello {{ add 1 2 }}!" diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/values.go b/charts/redpanda/redpanda/5.9.7/charts/console/values.go new file mode 100644 index 000000000..0a855af59 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/values.go @@ -0,0 +1,215 @@ +// +gotohelm:ignore=true +package console + +import ( + _ "embed" + + appsv1 "k8s.io/api/apps/v1" + corev1 "k8s.io/api/core/v1" + networkingv1 "k8s.io/api/networking/v1" +) + +var ( + //go:embed values.yaml + DefaultValuesYAML []byte + + //go:embed values.schema.json + ValuesSchemaJSON []byte +) + +type Values struct { + ReplicaCount int32 `json:"replicaCount"` + Image Image `json:"image"` + ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets"` + NameOverride string `json:"nameOverride"` + FullnameOverride string `json:"fullnameOverride"` + AutomountServiceAccountToken bool `json:"automountServiceAccountToken"` + ServiceAccount ServiceAccountConfig `json:"serviceAccount"` + CommonLabels map[string]string `json:"commonLabels"` + Annotations map[string]string `json:"annotations"` + PodAnnotations map[string]string `json:"podAnnotations"` + PodLabels map[string]string `json:"podLabels"` + PodSecurityContext corev1.PodSecurityContext `json:"podSecurityContext"` + SecurityContext corev1.SecurityContext `json:"securityContext"` + Service ServiceConfig `json:"service"` + Ingress IngressConfig `json:"ingress"` + Resources corev1.ResourceRequirements `json:"resources"` + Autoscaling AutoScaling `json:"autoscaling"` + NodeSelector map[string]string `json:"nodeSelector"` + Tolerations []corev1.Toleration `json:"tolerations"` + Affinity corev1.Affinity `json:"affinity"` + TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints"` + PriorityClassName string `json:"priorityClassName"` + Console Console `json:"console"` + ExtraEnv []corev1.EnvVar `json:"extraEnv"` + ExtraEnvFrom []corev1.EnvFromSource `json:"extraEnvFrom"` + ExtraVolumes []corev1.Volume `json:"extraVolumes"` + ExtraVolumeMounts []corev1.VolumeMount `json:"extraVolumeMounts"` + ExtraContainers []corev1.Container `json:"extraContainers"` + InitContainers InitContainers `json:"initContainers"` + SecretMounts []SecretMount `json:"secretMounts"` + Secret SecretConfig `json:"secret"` + Enterprise Enterprise `json:"enterprise"` + LivenessProbe corev1.Probe `json:"livenessProbe"` + ReadinessProbe corev1.Probe `json:"readinessProbe"` + ConfigMap Creatable `json:"configmap"` + Deployment DeploymentConfig `json:"deployment"` + Strategy appsv1.DeploymentStrategy `json:"strategy"` + Tests Enableable `json:"tests"` +} + +type DeploymentConfig struct { + Create bool `json:"create"` + Command []string `json:"command,omitempty"` + ExtraArgs []string `json:"extraArgs,omitempty"` +} + +type Enterprise struct { + LicenseSecretRef SecretKeyRef `json:"licenseSecretRef"` +} + +type ServiceAccountConfig struct { + Create bool `json:"create"` + AutomountServiceAccountToken bool `json:"automountServiceAccountToken"` + Annotations map[string]string `json:"annotations"` + Name string `json:"name"` +} + +type ServiceConfig struct { + Type corev1.ServiceType `json:"type"` + Port int32 `json:"port"` + NodePort *int32 `json:"nodePort,omitempty"` + TargetPort *int32 `json:"targetPort"` + Annotations map[string]string `json:"annotations"` +} + +type IngressConfig struct { + Enabled bool `json:"enabled"` + ClassName *string `json:"className"` + Annotations map[string]string `json:"annotations"` + Hosts []IngressHost `json:"hosts"` + TLS []networkingv1.IngressTLS `json:"tls"` +} + +type IngressHost struct { + Host string `json:"host"` + Paths []IngressPath `json:"paths"` +} + +type IngressPath struct { + Path string `json:"path"` + PathType *networkingv1.PathType `json:"pathType"` +} + +type AutoScaling struct { + Enabled bool `json:"enabled"` + MinReplicas int32 `json:"minReplicas"` + MaxReplicas int32 `json:"maxReplicas"` + TargetCPUUtilizationPercentage *int32 `json:"targetCPUUtilizationPercentage"` + TargetMemoryUtilizationPercentage *int32 `json:"targetMemoryUtilizationPercentage,omitempty"` +} + +// TODO the typing of these values are unclear. All of them get marshalled to +// YAML and then run through tpl which gives no indication of what they are +// aside from YAML marshal-able. +type Console struct { + Config map[string]any `json:"config"` + Roles []map[string]any `json:"roles,omitempty"` + RoleBindings []map[string]any `json:"roleBindings,omitempty"` +} + +type InitContainers struct { + ExtraInitContainers *string `json:"extraInitContainers"` // XXX Templated YAML +} + +type SecretConfig struct { + Create bool `json:"create"` + Kafka KafkaSecrets `json:"kafka"` + Login LoginSecrets `json:"login"` + Enterprise EnterpriseSecrets `json:"enterprise"` + Redpanda RedpandaSecrets `json:"redpanda"` +} + +type SecretMount struct { + Name string `json:"name"` + SecretName string `json:"secretName"` + Path string `json:"path"` + SubPath *string `json:"subPath,omitempty"` + DefaultMode *int32 `json:"defaultMode"` +} + +type KafkaSecrets struct { + SASLPassword *string `json:"saslPassword,omitempty"` + AWSMSKIAMSecretKey *string `json:"awsMskIamSecretKey,omitempty"` + TLSCA *string `json:"tlsCa,omitempty"` + TLSCert *string `json:"tlsCert,omitempty"` + TLSKey *string `json:"tlsKey,omitempty"` + TLSPassphrase *string `json:"tlsPassphrase,omitempty"` + SchemaRegistryPassword *string `json:"schemaRegistryPassword,omitempty"` + SchemaRegistryTLSCA *string `json:"schemaRegistryTlsCa,omitempty"` + SchemaRegistryTLSCert *string `json:"schemaRegistryTlsCert,omitempty"` + SchemaRegistryTLSKey *string `json:"schemaRegistryTlsKey,omitempty"` + ProtobufGitBasicAuthPassword *string `json:"protobufGitBasicAuthPassword,omitempty"` +} + +type LoginSecrets struct { + JWTSecret string `json:"jwtSecret"` + Google GoogleLoginSecrets `json:"google"` + Github GithubLoginSecrets `json:"github"` + Okta OktaLoginSecrets `json:"okta"` + OIDC OIDCLoginSecrets `json:"oidc"` +} + +type GoogleLoginSecrets struct { + ClientSecret *string `json:"clientSecret,omitempty"` + GroupsServiceAccount *string `json:"groupsServiceAccount,omitempty"` +} + +type GithubLoginSecrets struct { + ClientSecret *string `json:"clientSecret,omitempty"` + PersonalAccessToken *string `json:"personalAccessToken,omitempty"` +} + +type OktaLoginSecrets struct { + ClientSecret *string `json:"clientSecret,omitempty"` + DirectoryAPIToken *string `json:"directoryApiToken,omitempty"` +} + +type OIDCLoginSecrets struct { + ClientSecret *string `json:"clientSecret,omitempty"` +} + +type EnterpriseSecrets struct { + License *string `json:"License,omitempty"` +} + +type RedpandaSecrets struct { + AdminAPI RedpandaAdminAPISecrets `json:"adminApi"` +} + +type RedpandaAdminAPISecrets struct { + Password *string `json:"password,omitempty"` + TLSCA *string `json:"tlsCa,omitempty"` + TLSCert *string `json:"tlsCert,omitempty"` + TLSKey *string `json:"tlsKey,omitempty"` +} + +type SecretKeyRef struct { + Name string `json:"name"` + Key string `json:"key"` +} + +type Enableable struct { + Enabled bool `json:"enabled"` +} + +type Creatable struct { + Create bool `json:"create"` +} + +type Image struct { + Registry string `json:"registry"` + Repository string `json:"repository"` + PullPolicy corev1.PullPolicy `json:"pullPolicy"` + Tag *string `json:"tag"` +} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/values.schema.json b/charts/redpanda/redpanda/5.9.7/charts/console/values.schema.json new file mode 100644 index 000000000..f4f369e98 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/values.schema.json @@ -0,0 +1,323 @@ +{ + "$schema": "http://json-schema.org/schema#", + "type": "object", + "required": [ + "image" + ], + "properties": { + "affinity": { + "type": "object" + }, + "autoscaling": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "maxReplicas": { + "type": "integer" + }, + "minReplicas": { + "type": "integer" + }, + "targetCPUUtilizationPercentage": { + "type": "integer" + } + } + }, + "configmap": { + "type": "object", + "properties": { + "create": { + "type": "boolean" + } + } + }, + "console": { + "type": "object" + }, + "deployment": { + "type": "object", + "properties": { + "create": { + "type": "boolean" + } + } + }, + "extraContainers": { + "type": "array" + }, + "extraEnv": { + "type": "array" + }, + "extraEnvFrom": { + "type": "array" + }, + "extraVolumeMounts": { + "type": "array" + }, + "extraVolumes": { + "type": "array" + }, + "fullnameOverride": { + "type": "string" + }, + "image": { + "type": "object", + "required": [ + "repository" + ], + "properties": { + "pullPolicy": { + "type": "string" + }, + "registry": { + "type": "string" + }, + "repository": { + "type": "string", + "minLength": 1 + }, + "tag": { + "type": "string" + } + } + }, + "imagePullSecrets": { + "type": "array" + }, + "ingress": { + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "className": { + "type": ["string", "null"] + }, + "enabled": { + "type": "boolean" + }, + "hosts": { + "type": "array", + "items": { + "type": "object", + "properties": { + "host": { + "type": "string" + }, + "paths": { + "type": "array", + "items": { + "type": "object", + "properties": { + "path": { + "type": "string" + }, + "pathType": { + "type": "string" + } + } + } + } + } + } + }, + "tls": { + "type": "array" + } + } + }, + "livenessProbe": { + "type": "object", + "properties": { + "failureThreshold": { + "type": "integer" + }, + "initialDelaySeconds": { + "type": "integer" + }, + "periodSeconds": { + "type": "integer" + }, + "successThreshold": { + "type": "integer" + }, + "timeoutSeconds": { + "type": "integer" + } + } + }, + "nameOverride": { + "type": "string" + }, + "nodeSelector": { + "type": "object" + }, + "annotations": { + "type": "object" + }, + "podAnnotations": { + "type": "object" + }, + "podSecurityContext": { + "type": "object", + "properties": { + "fsGroup": { + "type": "integer" + }, + "runAsUser": { + "type": "integer" + } + } + }, + "readinessProbe": { + "type": "object", + "properties": { + "failureThreshold": { + "type": "integer" + }, + "initialDelaySeconds": { + "type": "integer" + }, + "periodSeconds": { + "type": "integer" + }, + "successThreshold": { + "type": "integer" + }, + "timeoutSeconds": { + "type": "integer" + } + } + }, + "replicaCount": { + "type": "integer" + }, + "resources": { + "type": "object" + }, + "secret": { + "type": "object", + "properties": { + "create": { + "type": "boolean" + }, + "enterprise": { + "type": "object" + }, + "kafka": { + "type": "object" + }, + "login": { + "type": "object", + "properties": { + "jwtSecret": { + "type": "string" + }, + "github": { + "type": "object" + }, + "google": { + "type": "object" + }, + "oidc": { + "type": "object" + }, + "okta": { + "type": "object" + } + } + }, + "redpanda": { + "type": "object", + "properties": { + "adminApi": { + "type": "object" + } + } + } + } + }, + "secretMounts": { + "type": "array" + }, + "securityContext": { + "type": "object", + "properties": { + "runAsNonRoot": { + "type": "boolean" + } + } + }, + "service": { + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "port": { + "type": "integer" + }, + "nodePort": { + "type": "integer" + }, + "targetPort": { + "anyOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ] + }, + "type": { + "type": "string" + } + } + }, + "automountServiceAccountToken": { + "type": "boolean" + }, + "serviceAccount": { + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "create": { + "type": "boolean" + }, + "automountServiceAccountToken": { + "type": "boolean" + }, + "name": { + "type": "string" + } + } + }, + "tolerations": { + "type": "array" + }, + "initContainers": { + "type": "object", + "properties": { + "extraInitContainers": { + "type": "string" + } + } + }, + "strategy": { + "type": "object" + }, + "tests": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + } + } + } +} diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/values.yaml b/charts/redpanda/redpanda/5.9.7/charts/console/values.yaml new file mode 100644 index 000000000..4825fc487 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/values.yaml @@ -0,0 +1,279 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Default values for console. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +replicaCount: 1 + +# -- Redpanda Console Docker image settings. +image: + registry: docker.redpanda.com + # -- Docker repository from which to pull the Redpanda Docker image. + repository: redpandadata/console + # -- The imagePullPolicy. + pullPolicy: IfNotPresent + # -- The Redpanda Console version. + # See DockerHub for: + # [All stable versions](https://hub.docker.com/r/redpandadata/console/tags) + # and [all unstable versions](https://hub.docker.com/r/redpandadata/console-unstable/tags). + # @default -- `Chart.appVersion` + tag: "" + +# -- Pull secrets may be used to provide credentials to image repositories +# See https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ +imagePullSecrets: [] + +# -- Override `console.name` template. +nameOverride: "" +# -- Override `console.fullname` template. +fullnameOverride: "" + +# -- Automount API credentials for the Service Account into the pod. +automountServiceAccountToken: true + +serviceAccount: + # -- Specifies whether a service account should be created. + create: true + # -- Specifies whether a service account should automount API-Credentials + automountServiceAccountToken: true + # -- Annotations to add to the service account. + annotations: {} + # -- The name of the service account to use. + # If not set and `serviceAccount.create` is `true`, + # a name is generated using the `console.fullname` template + name: "" + +# Common labels to add to all the pods +commonLabels: {} + +# -- Annotations to add to the deployment. +annotations: {} + +podAnnotations: {} + +podLabels: {} + +podSecurityContext: + runAsUser: 99 + fsGroup: 99 + +securityContext: + runAsNonRoot: true + # capabilities: + # drop: + # - ALL + # readOnlyRootFilesystem: true + # runAsNonRoot: true + # runAsUser: 1000 + +service: + type: ClusterIP + port: 8080 + # nodePort: 30001 + # -- Override the value in `console.config.server.listenPort` if not `nil` + targetPort: + annotations: {} + +ingress: + enabled: false + className: + annotations: {} + # kubernetes.io/ingress.class: nginx + # kubernetes.io/tls-acme: "true" + hosts: + - host: chart-example.local + paths: + - path: / + pathType: ImplementationSpecific + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as minikube. If you want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +nodeSelector: {} + +tolerations: [] + +affinity: {} + +topologySpreadConstraints: [] + +# -- PriorityClassName given to Pods. +# For details, +# see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass). +priorityClassName: "" + +console: + # -- Settings for the `Config.yaml` (required). + # For a reference of configuration settings, + # see the [Redpanda Console documentation](https://docs.redpanda.com/docs/reference/console/config/). + config: {} + # roles: + # roleBindings: + +# -- Additional environment variables for the Redpanda Console Deployment. +extraEnv: [] + # - name: KAFKA_RACKID + # value: "1" + +# -- Additional environment variables for Redpanda Console mapped from Secret or ConfigMap. +extraEnvFrom: [] +# - secretRef: +# name: kowl-config-secret + +# -- Add additional volumes, such as for TLS keys. +extraVolumes: [] +# - name: kafka-certs +# secret: +# secretName: kafka-certs +# - name: config +# configMap: +# name: console-config + +# -- Add additional volume mounts, such as for TLS keys. +extraVolumeMounts: [] +# - name: kafka-certs # Must match the volume name +# mountPath: /etc/kafka/certs +# readOnly: true + +# -- Add additional containers, such as for oauth2-proxy. +extraContainers: [] + +# -- Any initContainers defined should be written here +initContainers: + # -- Additional set of init containers + extraInitContainers: |- +# - name: "test-init-container" +# image: "mintel/docker-alpine-bash-curl-jq:latest" +# command: [ "/bin/bash", "-c" ] +# args: +# - | +# set -xe +# echo "Hello World!" + +# -- SecretMounts is an abstraction to make a Secret available in the container's filesystem. +# Under the hood it creates a volume and a volume mount for the Redpanda Console container. +secretMounts: [] +# - name: kafka-certs +# secretName: kafka-certs +# path: /etc/console/certs +# defaultMode: 0755 + +# -- Create a new Kubernetes Secret for all sensitive configuration inputs. +# Each provided Secret is mounted automatically and made available to the +# Pod. +# If you want to use one or more existing Secrets, +# you can use the `extraEnvFrom` list to mount environment variables from string and secretMounts to mount files such as Certificates from Secrets. +secret: + create: true + + # Secret values in case you want the chart to create a Secret. All Certificates are mounted + # as files and the path to those files are configured through environment variables so + # that Console can automatically pick them up. + # -- Kafka Secrets. + kafka: {} + # saslPassword: + # awsMskIamSecretKey: + # tlsCa: + # tlsCert: + # tlsKey: + # tlsPassphrase: + # schemaRegistryPassword: + # schemaRegistryTlsCa: + # schemaRegistryTlsCert: + # schemaRegistryTlsKey: + # protobufGitBasicAuthPassword + # Enterprise version secrets + # - SSO secrets (Enterprise version). + login: + # Configurable JWT value + jwtSecret: "" + google: {} + # clientSecret: + # groupsServiceAccount: + github: {} + # clientSecret: + # personalAccessToken: + okta: {} + # clientSecret: + # directoryApiToken: + oidc: {} + # clientSecret: + + enterprise: {} + # license: + + redpanda: + adminApi: {} + # password: + # tlsCa: + # tlsCert: + # tlsKey: + +# -- Settings for license key, as an alternative to secret.enterprise when +# a license secret is available +enterprise: + licenseSecretRef: + name: "" + key: "" + +# -- Settings for liveness and readiness probes. +# For details, +# see the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes). +livenessProbe: + # initialDelaySeconds: 0 + periodSeconds: 10 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 3 + +readinessProbe: + # -- Grant time to test connectivity to upstream services such as Kafka and Schema Registry. + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 3 + +configmap: + create: true +deployment: + create: true + +strategy: {} + +tests: + enabled: true diff --git a/charts/redpanda/redpanda/5.9.7/charts/console/values_partial.gen.go b/charts/redpanda/redpanda/5.9.7/charts/console/values_partial.gen.go new file mode 100644 index 000000000..723065a25 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/charts/console/values_partial.gen.go @@ -0,0 +1,206 @@ +//go:build !generate + +// +gotohelm:ignore=true +// +// Code generated by genpartial DO NOT EDIT. +package console + +import ( + appsv1 "k8s.io/api/apps/v1" + corev1 "k8s.io/api/core/v1" + networkingv1 "k8s.io/api/networking/v1" +) + +type PartialValues struct { + ReplicaCount *int32 "json:\"replicaCount,omitempty\"" + Image *PartialImage "json:\"image,omitempty\"" + ImagePullSecrets []corev1.LocalObjectReference "json:\"imagePullSecrets,omitempty\"" + NameOverride *string "json:\"nameOverride,omitempty\"" + FullnameOverride *string "json:\"fullnameOverride,omitempty\"" + AutomountServiceAccountToken *bool "json:\"automountServiceAccountToken,omitempty\"" + ServiceAccount *PartialServiceAccountConfig "json:\"serviceAccount,omitempty\"" + CommonLabels map[string]string "json:\"commonLabels,omitempty\"" + Annotations map[string]string "json:\"annotations,omitempty\"" + PodAnnotations map[string]string "json:\"podAnnotations,omitempty\"" + PodLabels map[string]string "json:\"podLabels,omitempty\"" + PodSecurityContext *corev1.PodSecurityContext "json:\"podSecurityContext,omitempty\"" + SecurityContext *corev1.SecurityContext "json:\"securityContext,omitempty\"" + Service *PartialServiceConfig "json:\"service,omitempty\"" + Ingress *PartialIngressConfig "json:\"ingress,omitempty\"" + Resources *corev1.ResourceRequirements "json:\"resources,omitempty\"" + Autoscaling *PartialAutoScaling "json:\"autoscaling,omitempty\"" + NodeSelector map[string]string "json:\"nodeSelector,omitempty\"" + Tolerations []corev1.Toleration "json:\"tolerations,omitempty\"" + Affinity *corev1.Affinity "json:\"affinity,omitempty\"" + TopologySpreadConstraints []corev1.TopologySpreadConstraint "json:\"topologySpreadConstraints,omitempty\"" + PriorityClassName *string "json:\"priorityClassName,omitempty\"" + Console *PartialConsole "json:\"console,omitempty\"" + ExtraEnv []corev1.EnvVar "json:\"extraEnv,omitempty\"" + ExtraEnvFrom []corev1.EnvFromSource "json:\"extraEnvFrom,omitempty\"" + ExtraVolumes []corev1.Volume "json:\"extraVolumes,omitempty\"" + ExtraVolumeMounts []corev1.VolumeMount "json:\"extraVolumeMounts,omitempty\"" + ExtraContainers []corev1.Container "json:\"extraContainers,omitempty\"" + InitContainers *PartialInitContainers "json:\"initContainers,omitempty\"" + SecretMounts []PartialSecretMount "json:\"secretMounts,omitempty\"" + Secret *PartialSecretConfig "json:\"secret,omitempty\"" + Enterprise *PartialEnterprise "json:\"enterprise,omitempty\"" + LivenessProbe *corev1.Probe "json:\"livenessProbe,omitempty\"" + ReadinessProbe *corev1.Probe "json:\"readinessProbe,omitempty\"" + ConfigMap *PartialCreatable "json:\"configmap,omitempty\"" + Deployment *PartialDeploymentConfig "json:\"deployment,omitempty\"" + Strategy *appsv1.DeploymentStrategy "json:\"strategy,omitempty\"" + Tests *PartialEnableable "json:\"tests,omitempty\"" +} + +type PartialImage struct { + Registry *string "json:\"registry,omitempty\"" + Repository *string "json:\"repository,omitempty\"" + PullPolicy *corev1.PullPolicy "json:\"pullPolicy,omitempty\"" + Tag *string "json:\"tag,omitempty\"" +} + +type PartialServiceAccountConfig struct { + Create *bool "json:\"create,omitempty\"" + AutomountServiceAccountToken *bool "json:\"automountServiceAccountToken,omitempty\"" + Annotations map[string]string "json:\"annotations,omitempty\"" + Name *string "json:\"name,omitempty\"" +} + +type PartialServiceConfig struct { + Type *corev1.ServiceType "json:\"type,omitempty\"" + Port *int32 "json:\"port,omitempty\"" + NodePort *int32 "json:\"nodePort,omitempty\"" + TargetPort *int32 "json:\"targetPort,omitempty\"" + Annotations map[string]string "json:\"annotations,omitempty\"" +} + +type PartialIngressConfig struct { + Enabled *bool "json:\"enabled,omitempty\"" + ClassName *string "json:\"className,omitempty\"" + Annotations map[string]string "json:\"annotations,omitempty\"" + Hosts []PartialIngressHost "json:\"hosts,omitempty\"" + TLS []networkingv1.IngressTLS "json:\"tls,omitempty\"" +} + +type PartialAutoScaling struct { + Enabled *bool "json:\"enabled,omitempty\"" + MinReplicas *int32 "json:\"minReplicas,omitempty\"" + MaxReplicas *int32 "json:\"maxReplicas,omitempty\"" + TargetCPUUtilizationPercentage *int32 "json:\"targetCPUUtilizationPercentage,omitempty\"" + TargetMemoryUtilizationPercentage *int32 "json:\"targetMemoryUtilizationPercentage,omitempty\"" +} + +type PartialConsole struct { + Config map[string]any "json:\"config,omitempty\"" + Roles []map[string]any "json:\"roles,omitempty\"" + RoleBindings []map[string]any "json:\"roleBindings,omitempty\"" +} + +type PartialInitContainers struct { + ExtraInitContainers *string "json:\"extraInitContainers,omitempty\"" +} + +type PartialSecretConfig struct { + Create *bool "json:\"create,omitempty\"" + Kafka *PartialKafkaSecrets "json:\"kafka,omitempty\"" + Login *PartialLoginSecrets "json:\"login,omitempty\"" + Enterprise *PartialEnterpriseSecrets "json:\"enterprise,omitempty\"" + Redpanda *PartialRedpandaSecrets "json:\"redpanda,omitempty\"" +} + +type PartialEnterprise struct { + LicenseSecretRef *PartialSecretKeyRef "json:\"licenseSecretRef,omitempty\"" +} + +type PartialCreatable struct { + Create *bool "json:\"create,omitempty\"" +} + +type PartialDeploymentConfig struct { + Create *bool "json:\"create,omitempty\"" + Command []string "json:\"command,omitempty\"" + ExtraArgs []string "json:\"extraArgs,omitempty\"" +} + +type PartialEnableable struct { + Enabled *bool "json:\"enabled,omitempty\"" +} + +type PartialSecretMount struct { + Name *string "json:\"name,omitempty\"" + SecretName *string "json:\"secretName,omitempty\"" + Path *string "json:\"path,omitempty\"" + SubPath *string "json:\"subPath,omitempty\"" + DefaultMode *int32 "json:\"defaultMode,omitempty\"" +} + +type PartialKafkaSecrets struct { + SASLPassword *string "json:\"saslPassword,omitempty\"" + AWSMSKIAMSecretKey *string "json:\"awsMskIamSecretKey,omitempty\"" + TLSCA *string "json:\"tlsCa,omitempty\"" + TLSCert *string "json:\"tlsCert,omitempty\"" + TLSKey *string "json:\"tlsKey,omitempty\"" + TLSPassphrase *string "json:\"tlsPassphrase,omitempty\"" + SchemaRegistryPassword *string "json:\"schemaRegistryPassword,omitempty\"" + SchemaRegistryTLSCA *string "json:\"schemaRegistryTlsCa,omitempty\"" + SchemaRegistryTLSCert *string "json:\"schemaRegistryTlsCert,omitempty\"" + SchemaRegistryTLSKey *string "json:\"schemaRegistryTlsKey,omitempty\"" + ProtobufGitBasicAuthPassword *string "json:\"protobufGitBasicAuthPassword,omitempty\"" +} + +type PartialLoginSecrets struct { + JWTSecret *string "json:\"jwtSecret,omitempty\"" + Google *PartialGoogleLoginSecrets "json:\"google,omitempty\"" + Github *PartialGithubLoginSecrets "json:\"github,omitempty\"" + Okta *PartialOktaLoginSecrets "json:\"okta,omitempty\"" + OIDC *PartialOIDCLoginSecrets "json:\"oidc,omitempty\"" +} + +type PartialEnterpriseSecrets struct { + License *string "json:\"License,omitempty\"" +} + +type PartialRedpandaSecrets struct { + AdminAPI *PartialRedpandaAdminAPISecrets "json:\"adminApi,omitempty\"" +} + +type PartialSecretKeyRef struct { + Name *string "json:\"name,omitempty\"" + Key *string "json:\"key,omitempty\"" +} + +type PartialIngressHost struct { + Host *string "json:\"host,omitempty\"" + Paths []PartialIngressPath "json:\"paths,omitempty\"" +} + +type PartialGoogleLoginSecrets struct { + ClientSecret *string "json:\"clientSecret,omitempty\"" + GroupsServiceAccount *string "json:\"groupsServiceAccount,omitempty\"" +} + +type PartialGithubLoginSecrets struct { + ClientSecret *string "json:\"clientSecret,omitempty\"" + PersonalAccessToken *string "json:\"personalAccessToken,omitempty\"" +} + +type PartialOktaLoginSecrets struct { + ClientSecret *string "json:\"clientSecret,omitempty\"" + DirectoryAPIToken *string "json:\"directoryApiToken,omitempty\"" +} + +type PartialOIDCLoginSecrets struct { + ClientSecret *string "json:\"clientSecret,omitempty\"" +} + +type PartialRedpandaAdminAPISecrets struct { + Password *string "json:\"password,omitempty\"" + TLSCA *string "json:\"tlsCa,omitempty\"" + TLSCert *string "json:\"tlsCert,omitempty\"" + TLSKey *string "json:\"tlsKey,omitempty\"" +} + +type PartialIngressPath struct { + Path *string "json:\"path,omitempty\"" + PathType *networkingv1.PathType "json:\"pathType,omitempty\"" +} diff --git a/charts/redpanda/redpanda/5.9.7/templates/NOTES.txt b/charts/redpanda/redpanda/5.9.7/templates/NOTES.txt new file mode 100644 index 000000000..6992f8e36 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/NOTES.txt @@ -0,0 +1,26 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- $warnings := (get ((include "redpanda.Warnings" (dict "a" (list .))) | fromJson) "r") }} +{{- range $_, $warning := $warnings }} +{{ $warning }} +{{- end }} + +{{- $notes := (get ((include "redpanda.Notes" (dict "a" (list .))) | fromJson) "r") }} +{{- range $_, $note := $notes }} +{{ $note }} +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/templates/_cert-issuers.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_cert-issuers.go.tpl new file mode 100644 index 000000000..f1188ce7b --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_cert-issuers.go.tpl @@ -0,0 +1,57 @@ +{{- /* Generated from "cert_issuers.go" */ -}} + +{{- define "redpanda.CertIssuers" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_1 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "redpanda.certIssuersAndCAs" (dict "a" (list $dot) ))) "r")) ))) "r") -}} +{{- $issuers := $tmp_tuple_1.T1 -}} +{{- $_is_returning = true -}} +{{- (dict "r" $issuers) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RootCAs" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_2 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "redpanda.certIssuersAndCAs" (dict "a" (list $dot) ))) "r")) ))) "r") -}} +{{- $cas := $tmp_tuple_2.T2 -}} +{{- $_is_returning = true -}} +{{- (dict "r" $cas) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.certIssuersAndCAs" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $issuers := (coalesce nil) -}} +{{- $certs := (coalesce nil) -}} +{{- if (not (get (fromJson (include "redpanda.TLSEnabled" (dict "a" (list $dot) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $issuers $certs)) | toJson -}} +{{- break -}} +{{- end -}} +{{- range $name, $data := $values.tls.certs -}} +{{- if (or (not (empty $data.secretRef)) (not (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $data.enabled true) ))) "r"))) -}} +{{- continue -}} +{{- end -}} +{{- if (eq (toJson $data.issuerRef) "null") -}} +{{- $issuers = (concat (default (list ) $issuers) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict ) "status" (dict ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "cert-manager.io/v1" "kind" "Issuer" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (printf `%s-%s-selfsigned-issuer` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") $name) "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") )) "spec" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "selfSigned" (mustMergeOverwrite (dict ) (dict )) )) (dict )) )))) -}} +{{- end -}} +{{- $issuers = (concat (default (list ) $issuers) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict ) "status" (dict ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "cert-manager.io/v1" "kind" "Issuer" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (printf `%s-%s-root-issuer` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") $name) "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") )) "spec" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "ca" (mustMergeOverwrite (dict "secretName" "" ) (dict "secretName" (printf `%s-%s-root-certificate` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") $name) )) )) (dict )) )))) -}} +{{- $certs = (concat (default (list ) $certs) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "secretName" "" "issuerRef" (dict "name" "" ) ) "status" (dict ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "cert-manager.io/v1" "kind" "Certificate" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (printf `%s-%s-root-certificate` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") $name) "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") )) "spec" (mustMergeOverwrite (dict "secretName" "" "issuerRef" (dict "name" "" ) ) (dict "duration" (default "43800h" $data.duration) "isCA" true "commonName" (printf `%s-%s-root-certificate` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") $name) "secretName" (printf `%s-%s-root-certificate` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") $name) "privateKey" (mustMergeOverwrite (dict ) (dict "algorithm" "ECDSA" "size" (256 | int) )) "issuerRef" (mustMergeOverwrite (dict "name" "" ) (dict "name" (printf `%s-%s-selfsigned-issuer` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") $name) "kind" "Issuer" "group" "cert-manager.io" )) )) )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $issuers $certs)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_certs.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_certs.go.tpl new file mode 100644 index 000000000..086186e44 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_certs.go.tpl @@ -0,0 +1,71 @@ +{{- /* Generated from "certs.go" */ -}} + +{{- define "redpanda.ClientCerts" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (not (get (fromJson (include "redpanda.TLSEnabled" (dict "a" (list $dot) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list )) | toJson -}} +{{- break -}} +{{- end -}} +{{- $values := $dot.Values.AsMap -}} +{{- $fullname := (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") -}} +{{- $service := (get (fromJson (include "redpanda.ServiceName" (dict "a" (list $dot) ))) "r") -}} +{{- $ns := $dot.Release.Namespace -}} +{{- $domain := (trimSuffix "." $values.clusterDomain) -}} +{{- $certs := (coalesce nil) -}} +{{- range $name, $data := $values.tls.certs -}} +{{- if (or (not (empty $data.secretRef)) (not (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $data.enabled true) ))) "r"))) -}} +{{- continue -}} +{{- end -}} +{{- $names := (coalesce nil) -}} +{{- if (or (eq (toJson $data.issuerRef) "null") (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $data.applyInternalDNSNames false) ))) "r")) -}} +{{- $names = (concat (default (list ) $names) (list (printf "%s-cluster.%s.%s.svc.%s" $fullname $service $ns $domain))) -}} +{{- $names = (concat (default (list ) $names) (list (printf "%s-cluster.%s.%s.svc" $fullname $service $ns))) -}} +{{- $names = (concat (default (list ) $names) (list (printf "%s-cluster.%s.%s" $fullname $service $ns))) -}} +{{- $names = (concat (default (list ) $names) (list (printf "*.%s-cluster.%s.%s.svc.%s" $fullname $service $ns $domain))) -}} +{{- $names = (concat (default (list ) $names) (list (printf "*.%s-cluster.%s.%s.svc" $fullname $service $ns))) -}} +{{- $names = (concat (default (list ) $names) (list (printf "*.%s-cluster.%s.%s" $fullname $service $ns))) -}} +{{- $names = (concat (default (list ) $names) (list (printf "%s.%s.svc.%s" $service $ns $domain))) -}} +{{- $names = (concat (default (list ) $names) (list (printf "%s.%s.svc" $service $ns))) -}} +{{- $names = (concat (default (list ) $names) (list (printf "%s.%s" $service $ns))) -}} +{{- $names = (concat (default (list ) $names) (list (printf "*.%s.%s.svc.%s" $service $ns $domain))) -}} +{{- $names = (concat (default (list ) $names) (list (printf "*.%s.%s.svc" $service $ns))) -}} +{{- $names = (concat (default (list ) $names) (list (printf "*.%s.%s" $service $ns))) -}} +{{- end -}} +{{- if (ne (toJson $values.external.domain) "null") -}} +{{- $names = (concat (default (list ) $names) (list (tpl $values.external.domain $dot))) -}} +{{- $names = (concat (default (list ) $names) (list (tpl (printf "*.%s" $values.external.domain) $dot))) -}} +{{- end -}} +{{- $duration := (default "43800h" $data.duration) -}} +{{- $issuerRef := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $data.issuerRef (mustMergeOverwrite (dict "name" "" ) (dict "kind" "Issuer" "group" "cert-manager.io" "name" (printf "%s-%s-root-issuer" $fullname $name) ))) ))) "r") -}} +{{- $certs = (concat (default (list ) $certs) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "secretName" "" "issuerRef" (dict "name" "" ) ) "status" (dict ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "cert-manager.io/v1" "kind" "Certificate" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (printf "%s-%s-cert" $fullname $name) "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace )) "spec" (mustMergeOverwrite (dict "secretName" "" "issuerRef" (dict "name" "" ) ) (dict "dnsNames" $names "duration" $duration "isCA" false "issuerRef" $issuerRef "secretName" (printf "%s-%s-cert" $fullname $name) "privateKey" (mustMergeOverwrite (dict ) (dict "algorithm" "ECDSA" "size" (256 | int) )) )) )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $name := $values.listeners.kafka.tls.cert -}} +{{- $tmp_tuple_1 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $values.tls.certs $name (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok := $tmp_tuple_1.T2 -}} +{{- $data := $tmp_tuple_1.T1 -}} +{{- if (not $ok) -}} +{{- $_ := (fail (printf "Certificate %q referenced but not defined" $name)) -}} +{{- end -}} +{{- if (or (not (empty $data.secretRef)) (not (get (fromJson (include "redpanda.ClientAuthRequired" (dict "a" (list $dot) ))) "r"))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $certs) | toJson -}} +{{- break -}} +{{- end -}} +{{- $issuerRef := (mustMergeOverwrite (dict "name" "" ) (dict "group" "cert-manager.io" "kind" "Issuer" "name" (printf "%s-%s-root-issuer" $fullname $name) )) -}} +{{- if (ne (toJson $data.issuerRef) "null") -}} +{{- $issuerRef = $data.issuerRef -}} +{{- $_ := (set $issuerRef "group" "cert-manager.io") -}} +{{- end -}} +{{- $duration := (default "43800h" $data.duration) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (concat (default (list ) $certs) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "secretName" "" "issuerRef" (dict "name" "" ) ) "status" (dict ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "cert-manager.io/v1" "kind" "Certificate" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (printf "%s-client" $fullname) "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") )) "spec" (mustMergeOverwrite (dict "secretName" "" "issuerRef" (dict "name" "" ) ) (dict "commonName" (printf "%s-client" $fullname) "duration" $duration "isCA" false "secretName" (printf "%s-client" $fullname) "privateKey" (mustMergeOverwrite (dict ) (dict "algorithm" "ECDSA" "size" (256 | int) )) "issuerRef" $issuerRef )) ))))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_chart.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_chart.go.tpl new file mode 100644 index 000000000..88bb1f8d2 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_chart.go.tpl @@ -0,0 +1,61 @@ +{{- /* Generated from "chart.go" */ -}} + +{{- define "redpanda.render" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $manifests := (list (get (fromJson (include "redpanda.NodePortService" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.PodDisruptionBudget" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.ServiceAccount" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.ServiceInternal" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.ServiceMonitor" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.SidecarControllersRole" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.SidecarControllersRoleBinding" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.StatefulSet" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.PostInstallUpgradeJob" (dict "a" (list $dot) ))) "r")) -}} +{{- range $_, $obj := (get (fromJson (include "redpanda.ConfigMaps" (dict "a" (list $dot) ))) "r") -}} +{{- $manifests = (concat (default (list ) $manifests) (list $obj)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- range $_, $obj := (get (fromJson (include "redpanda.CertIssuers" (dict "a" (list $dot) ))) "r") -}} +{{- $manifests = (concat (default (list ) $manifests) (list $obj)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- range $_, $obj := (get (fromJson (include "redpanda.RootCAs" (dict "a" (list $dot) ))) "r") -}} +{{- $manifests = (concat (default (list ) $manifests) (list $obj)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- range $_, $obj := (get (fromJson (include "redpanda.ClientCerts" (dict "a" (list $dot) ))) "r") -}} +{{- $manifests = (concat (default (list ) $manifests) (list $obj)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- range $_, $obj := (get (fromJson (include "redpanda.ClusterRoleBindings" (dict "a" (list $dot) ))) "r") -}} +{{- $manifests = (concat (default (list ) $manifests) (list $obj)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- range $_, $obj := (get (fromJson (include "redpanda.ClusterRoles" (dict "a" (list $dot) ))) "r") -}} +{{- $manifests = (concat (default (list ) $manifests) (list $obj)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- range $_, $obj := (get (fromJson (include "redpanda.LoadBalancerServices" (dict "a" (list $dot) ))) "r") -}} +{{- $manifests = (concat (default (list ) $manifests) (list $obj)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- range $_, $obj := (get (fromJson (include "redpanda.Secrets" (dict "a" (list $dot) ))) "r") -}} +{{- $manifests = (concat (default (list ) $manifests) (list $obj)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $manifests) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_configmap.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_configmap.go.tpl new file mode 100644 index 000000000..5f234bfec --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_configmap.go.tpl @@ -0,0 +1,504 @@ +{{- /* Generated from "configmap.tpl.go" */ -}} + +{{- define "redpanda.ConfigMaps" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $cms := (list (get (fromJson (include "redpanda.RedpandaConfigMap" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.RPKProfile" (dict "a" (list $dot) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $cms) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RedpandaConfigMap" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) ) (mustMergeOverwrite (dict ) (dict "kind" "ConfigMap" "apiVersion" "v1" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") )) "data" (dict "bootstrap.yaml" (get (fromJson (include "redpanda.BootstrapFile" (dict "a" (list $dot) ))) "r") "redpanda.yaml" (get (fromJson (include "redpanda.RedpandaConfigFile" (dict "a" (list $dot true) ))) "r") ) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.BootstrapFile" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $bootstrap := (dict "kafka_enable_authorization" (get (fromJson (include "redpanda.Auth.IsSASLEnabled" (dict "a" (list $values.auth) ))) "r") "enable_sasl" (get (fromJson (include "redpanda.Auth.IsSASLEnabled" (dict "a" (list $values.auth) ))) "r") "enable_rack_awareness" $values.rackAwareness.enabled "storage_min_free_bytes" ((get (fromJson (include "redpanda.Storage.StorageMinFreeBytes" (dict "a" (list $values.storage) ))) "r") | int64) ) -}} +{{- $bootstrap = (merge (dict ) $bootstrap (get (fromJson (include "redpanda.AuditLogging.Translate" (dict "a" (list $values.auditLogging $dot (get (fromJson (include "redpanda.Auth.IsSASLEnabled" (dict "a" (list $values.auth) ))) "r")) ))) "r")) -}} +{{- $bootstrap = (merge (dict ) $bootstrap (get (fromJson (include "redpanda.Logging.Translate" (dict "a" (list $values.logging) ))) "r")) -}} +{{- $bootstrap = (merge (dict ) $bootstrap (get (fromJson (include "redpanda.TunableConfig.Translate" (dict "a" (list $values.config.tunable) ))) "r")) -}} +{{- $bootstrap = (merge (dict ) $bootstrap (get (fromJson (include "redpanda.ClusterConfig.Translate" (dict "a" (list $values.config.cluster) ))) "r")) -}} +{{- $bootstrap = (merge (dict ) $bootstrap (get (fromJson (include "redpanda.Auth.Translate" (dict "a" (list $values.auth (get (fromJson (include "redpanda.Auth.IsSASLEnabled" (dict "a" (list $values.auth) ))) "r")) ))) "r")) -}} +{{- $bootstrap = (merge (dict ) $bootstrap (get (fromJson (include "redpanda.TieredStorageConfig.Translate" (dict "a" (list (deepCopy (get (fromJson (include "redpanda.Storage.GetTieredStorageConfig" (dict "a" (list $values.storage) ))) "r")) $values.storage.tiered.credentialsSecretRef) ))) "r")) -}} +{{- $tmp_tuple_1 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $values.config.cluster "default_topic_replications" (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok_1 := $tmp_tuple_1.T2 -}} +{{- if (and (not $ok_1) (ge ($values.statefulset.replicas | int) (3 | int))) -}} +{{- $_ := (set $bootstrap "default_topic_replications" (3 | int)) -}} +{{- end -}} +{{- $tmp_tuple_2 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $values.config.cluster "storage_min_free_bytes" (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok_2 := $tmp_tuple_2.T2 -}} +{{- if (not $ok_2) -}} +{{- $_ := (set $bootstrap "storage_min_free_bytes" ((get (fromJson (include "redpanda.Storage.StorageMinFreeBytes" (dict "a" (list $values.storage) ))) "r") | int64)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (toYaml $bootstrap)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RedpandaConfigFile" -}} +{{- $dot := (index .a 0) -}} +{{- $includeSeedServer := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $redpanda := (dict "empty_seed_starts_cluster" false ) -}} +{{- if $includeSeedServer -}} +{{- $_ := (set $redpanda "seed_servers" (get (fromJson (include "redpanda.Listeners.CreateSeedServers" (dict "a" (list $values.listeners ($values.statefulset.replicas | int) (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.InternalDomain" (dict "a" (list $dot) ))) "r")) ))) "r")) -}} +{{- end -}} +{{- $redpanda = (merge (dict ) $redpanda (get (fromJson (include "redpanda.NodeConfig.Translate" (dict "a" (list $values.config.node) ))) "r")) -}} +{{- $_ := (get (fromJson (include "redpanda.configureListeners" (dict "a" (list $redpanda $dot) ))) "r") -}} +{{- $redpandaYaml := (dict "redpanda" $redpanda "schema_registry" (get (fromJson (include "redpanda.schemaRegistry" (dict "a" (list $dot) ))) "r") "schema_registry_client" (get (fromJson (include "redpanda.kafkaClient" (dict "a" (list $dot) ))) "r") "pandaproxy" (get (fromJson (include "redpanda.pandaProxyListener" (dict "a" (list $dot) ))) "r") "pandaproxy_client" (get (fromJson (include "redpanda.kafkaClient" (dict "a" (list $dot) ))) "r") "rpk" (get (fromJson (include "redpanda.rpkNodeConfig" (dict "a" (list $dot) ))) "r") "config_file" "/etc/redpanda/redpanda.yaml" ) -}} +{{- if (and (and (get (fromJson (include "redpanda.RedpandaAtLeast_23_3_0" (dict "a" (list $dot) ))) "r") $values.auditLogging.enabled) (get (fromJson (include "redpanda.Auth.IsSASLEnabled" (dict "a" (list $values.auth) ))) "r")) -}} +{{- $_ := (set $redpandaYaml "audit_log_client" (get (fromJson (include "redpanda.kafkaClient" (dict "a" (list $dot) ))) "r")) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (toYaml $redpandaYaml)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RPKProfile" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.external.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) ) (mustMergeOverwrite (dict ) (dict "kind" "ConfigMap" "apiVersion" "v1" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (printf "%s-rpk" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") )) "data" (dict "profile" (toYaml (get (fromJson (include "redpanda.rpkProfile" (dict "a" (list $dot) ))) "r")) ) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.rpkProfile" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $brokerList := (list ) -}} +{{- range $_, $i := untilStep (((0 | int) | int)|int) (($values.statefulset.replicas | int)|int) (1|int) -}} +{{- $brokerList = (concat (default (list ) $brokerList) (list (printf "%s:%d" (get (fromJson (include "redpanda.advertisedHost" (dict "a" (list $dot $i) ))) "r") (((get (fromJson (include "redpanda.advertisedKafkaPort" (dict "a" (list $dot $i) ))) "r") | int) | int)))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $adminAdvertisedList := (list ) -}} +{{- range $_, $i := untilStep (((0 | int) | int)|int) (($values.statefulset.replicas | int)|int) (1|int) -}} +{{- $adminAdvertisedList = (concat (default (list ) $adminAdvertisedList) (list (printf "%s:%d" (get (fromJson (include "redpanda.advertisedHost" (dict "a" (list $dot $i) ))) "r") (((get (fromJson (include "redpanda.advertisedAdminPort" (dict "a" (list $dot $i) ))) "r") | int) | int)))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $kafkaTLS := (get (fromJson (include "redpanda.rpkKafkaClientTLSConfiguration" (dict "a" (list $dot) ))) "r") -}} +{{- $tmp_tuple_3 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $kafkaTLS "ca_file" (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok_3 := $tmp_tuple_3.T2 -}} +{{- if $ok_3 -}} +{{- $_ := (set $kafkaTLS "ca_file" "ca.crt") -}} +{{- end -}} +{{- $adminTLS := (get (fromJson (include "redpanda.rpkAdminAPIClientTLSConfiguration" (dict "a" (list $dot) ))) "r") -}} +{{- $tmp_tuple_4 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $adminTLS "ca_file" (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok_4 := $tmp_tuple_4.T2 -}} +{{- if $ok_4 -}} +{{- $_ := (set $adminTLS "ca_file" "ca.crt") -}} +{{- end -}} +{{- $ka := (dict "brokers" $brokerList "tls" (coalesce nil) ) -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $kafkaTLS) ))) "r") | int) (0 | int)) -}} +{{- $_ := (set $ka "tls" $kafkaTLS) -}} +{{- end -}} +{{- $aa := (dict "addresses" $adminAdvertisedList "tls" (coalesce nil) ) -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $adminTLS) ))) "r") | int) (0 | int)) -}} +{{- $_ := (set $aa "tls" $adminTLS) -}} +{{- end -}} +{{- $result := (dict "name" (get (fromJson (include "redpanda.getFirstExternalKafkaListener" (dict "a" (list $dot) ))) "r") "kafka_api" $ka "admin_api" $aa ) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.advertisedKafkaPort" -}} +{{- $dot := (index .a 0) -}} +{{- $i := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $externalKafkaListenerName := (get (fromJson (include "redpanda.getFirstExternalKafkaListener" (dict "a" (list $dot) ))) "r") -}} +{{- $listener := (index $values.listeners.kafka.external $externalKafkaListenerName) -}} +{{- $port := (($values.listeners.kafka.port | int) | int) -}} +{{- if (gt (($listener.port | int) | int) ((1 | int) | int)) -}} +{{- $port = (($listener.port | int) | int) -}} +{{- end -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $listener.advertisedPorts) ))) "r") | int) (1 | int)) -}} +{{- $port = ((index $listener.advertisedPorts $i) | int) -}} +{{- else -}}{{- if (eq ((get (fromJson (include "_shims.len" (dict "a" (list $listener.advertisedPorts) ))) "r") | int) (1 | int)) -}} +{{- $port = ((index $listener.advertisedPorts (0 | int)) | int) -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $port) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.advertisedAdminPort" -}} +{{- $dot := (index .a 0) -}} +{{- $i := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $keys := (keys $values.listeners.admin.external) -}} +{{- $_ := (sortAlpha $keys) -}} +{{- $externalAdminListenerName := (first $keys) -}} +{{- $listener := (index $values.listeners.admin.external (get (fromJson (include "_shims.typeassertion" (dict "a" (list "string" $externalAdminListenerName) ))) "r")) -}} +{{- $port := (($values.listeners.admin.port | int) | int) -}} +{{- if (gt (($listener.port | int) | int) (1 | int)) -}} +{{- $port = (($listener.port | int) | int) -}} +{{- end -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $listener.advertisedPorts) ))) "r") | int) (1 | int)) -}} +{{- $port = ((index $listener.advertisedPorts $i) | int) -}} +{{- else -}}{{- if (eq ((get (fromJson (include "_shims.len" (dict "a" (list $listener.advertisedPorts) ))) "r") | int) (1 | int)) -}} +{{- $port = ((index $listener.advertisedPorts (0 | int)) | int) -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $port) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.advertisedHost" -}} +{{- $dot := (index .a 0) -}} +{{- $i := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $address := (printf "%s-%d" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") ($i | int)) -}} +{{- if (ne (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.external.domain "") ))) "r") "") -}} +{{- $address = (printf "%s.%s" $address (tpl $values.external.domain $dot)) -}} +{{- end -}} +{{- if (le ((get (fromJson (include "_shims.len" (dict "a" (list $values.external.addresses) ))) "r") | int) (0 | int)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $address) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (eq ((get (fromJson (include "_shims.len" (dict "a" (list $values.external.addresses) ))) "r") | int) (1 | int)) -}} +{{- $address = (index $values.external.addresses (0 | int)) -}} +{{- else -}} +{{- $address = (index $values.external.addresses $i) -}} +{{- end -}} +{{- if (ne (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.external.domain "") ))) "r") "") -}} +{{- $address = (printf "%s.%s" $address $values.external.domain) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $address) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.getFirstExternalKafkaListener" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $keys := (keys $values.listeners.kafka.external) -}} +{{- $_ := (sortAlpha $keys) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "_shims.typeassertion" (dict "a" (list "string" (first $keys)) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.BrokerList" -}} +{{- $dot := (index .a 0) -}} +{{- $replicas := (index .a 1) -}} +{{- $port := (index .a 2) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $bl := (coalesce nil) -}} +{{- range $_, $i := untilStep (((0 | int) | int)|int) ($replicas|int) (1|int) -}} +{{- $bl = (concat (default (list ) $bl) (list (printf "%s-%d.%s:%d" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") $i (get (fromJson (include "redpanda.InternalDomain" (dict "a" (list $dot) ))) "r") $port))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $bl) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.rpkNodeConfig" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $brokerList := (get (fromJson (include "redpanda.BrokerList" (dict "a" (list $dot ($values.statefulset.replicas | int) ($values.listeners.kafka.port | int)) ))) "r") -}} +{{- $adminTLS := (coalesce nil) -}} +{{- $tls_5 := (get (fromJson (include "redpanda.rpkAdminAPIClientTLSConfiguration" (dict "a" (list $dot) ))) "r") -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $tls_5) ))) "r") | int) (0 | int)) -}} +{{- $adminTLS = $tls_5 -}} +{{- end -}} +{{- $brokerTLS := (coalesce nil) -}} +{{- $tls_6 := (get (fromJson (include "redpanda.rpkKafkaClientTLSConfiguration" (dict "a" (list $dot) ))) "r") -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $tls_6) ))) "r") | int) (0 | int)) -}} +{{- $brokerTLS = $tls_6 -}} +{{- end -}} +{{- $result := (dict "overprovisioned" (get (fromJson (include "redpanda.RedpandaResources.GetOverProvisionValue" (dict "a" (list $values.resources) ))) "r") "enable_memory_locking" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.resources.memory.enable_memory_locking false) ))) "r") "additional_start_flags" (get (fromJson (include "redpanda.RedpandaAdditionalStartFlags" (dict "a" (list $dot ((get (fromJson (include "redpanda.RedpandaSMP" (dict "a" (list $dot) ))) "r") | int64)) ))) "r") "kafka_api" (dict "brokers" $brokerList "tls" $brokerTLS ) "admin_api" (dict "addresses" (get (fromJson (include "redpanda.Listeners.AdminList" (dict "a" (list $values.listeners ($values.statefulset.replicas | int) (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.InternalDomain" (dict "a" (list $dot) ))) "r")) ))) "r") "tls" $adminTLS ) ) -}} +{{- $result = (merge (dict ) $result (get (fromJson (include "redpanda.Tuning.Translate" (dict "a" (list $values.tuning) ))) "r")) -}} +{{- $result = (merge (dict ) $result (get (fromJson (include "redpanda.Config.CreateRPKConfiguration" (dict "a" (list $values.config) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.rpkKafkaClientTLSConfiguration" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $tls := $values.listeners.kafka.tls -}} +{{- if (not (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $tls $values.tls) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (dict )) | toJson -}} +{{- break -}} +{{- end -}} +{{- $result := (dict "ca_file" (get (fromJson (include "redpanda.InternalTLS.ServerCAPath" (dict "a" (list $tls $values.tls) ))) "r") ) -}} +{{- if $tls.requireClientAuth -}} +{{- $_ := (set $result "cert_file" (printf "/etc/tls/certs/%s-client/tls.crt" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r"))) -}} +{{- $_ := (set $result "key_file" (printf "/etc/tls/certs/%s-client/tls.key" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r"))) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.rpkAdminAPIClientTLSConfiguration" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $tls := $values.listeners.admin.tls -}} +{{- if (not (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $tls $values.tls) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (dict )) | toJson -}} +{{- break -}} +{{- end -}} +{{- $result := (dict "ca_file" (get (fromJson (include "redpanda.InternalTLS.ServerCAPath" (dict "a" (list $tls $values.tls) ))) "r") ) -}} +{{- if $tls.requireClientAuth -}} +{{- $_ := (set $result "cert_file" (printf "/etc/tls/certs/%s-client/tls.crt" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r"))) -}} +{{- $_ := (set $result "key_file" (printf "/etc/tls/certs/%s-client/tls.key" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r"))) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.kafkaClient" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $brokerList := (list ) -}} +{{- range $_, $i := untilStep (((0 | int) | int)|int) (($values.statefulset.replicas | int)|int) (1|int) -}} +{{- $brokerList = (concat (default (list ) $brokerList) (list (dict "address" (printf "%s-%d.%s" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") $i (get (fromJson (include "redpanda.InternalDomain" (dict "a" (list $dot) ))) "r")) "port" ($values.listeners.kafka.port | int) ))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $kafkaTLS := $values.listeners.kafka.tls -}} +{{- $brokerTLS := (coalesce nil) -}} +{{- if (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $values.listeners.kafka.tls $values.tls) ))) "r") -}} +{{- $brokerTLS = (dict "enabled" true "require_client_auth" $kafkaTLS.requireClientAuth "truststore_file" (get (fromJson (include "redpanda.InternalTLS.ServerCAPath" (dict "a" (list $kafkaTLS $values.tls) ))) "r") ) -}} +{{- if $kafkaTLS.requireClientAuth -}} +{{- $_ := (set $brokerTLS "cert_file" (printf "/etc/tls/certs/%s-client/tls.crt" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r"))) -}} +{{- $_ := (set $brokerTLS "key_file" (printf "/etc/tls/certs/%s-client/tls.key" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r"))) -}} +{{- end -}} +{{- end -}} +{{- $cfg := (dict "brokers" $brokerList ) -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $brokerTLS) ))) "r") | int) (0 | int)) -}} +{{- $_ := (set $cfg "broker_tls" $brokerTLS) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $cfg) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.configureListeners" -}} +{{- $redpanda := (index .a 0) -}} +{{- $dot := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $_ := (set $redpanda "admin" (get (fromJson (include "redpanda.AdminListeners.Listeners" (dict "a" (list $values.listeners.admin) ))) "r")) -}} +{{- $_ := (set $redpanda "kafka_api" (get (fromJson (include "redpanda.KafkaListeners.Listeners" (dict "a" (list $values.listeners.kafka $values.auth) ))) "r")) -}} +{{- $_ := (set $redpanda "rpc_server" (get (fromJson (include "redpanda.rpcListeners" (dict "a" (list $dot) ))) "r")) -}} +{{- $_ := (set $redpanda "admin_api_tls" (coalesce nil)) -}} +{{- $tls_7 := (get (fromJson (include "redpanda.AdminListeners.ListenersTLS" (dict "a" (list $values.listeners.admin $values.tls) ))) "r") -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $tls_7) ))) "r") | int) (0 | int)) -}} +{{- $_ := (set $redpanda "admin_api_tls" $tls_7) -}} +{{- end -}} +{{- $_ := (set $redpanda "kafka_api_tls" (coalesce nil)) -}} +{{- $tls_8 := (get (fromJson (include "redpanda.KafkaListeners.ListenersTLS" (dict "a" (list $values.listeners.kafka $values.tls) ))) "r") -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $tls_8) ))) "r") | int) (0 | int)) -}} +{{- $_ := (set $redpanda "kafka_api_tls" $tls_8) -}} +{{- end -}} +{{- $tls_9 := (get (fromJson (include "redpanda.rpcListenersTLS" (dict "a" (list $dot) ))) "r") -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $tls_9) ))) "r") | int) (0 | int)) -}} +{{- $_ := (set $redpanda "rpc_server_tls" $tls_9) -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.pandaProxyListener" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $pandaProxy := (dict ) -}} +{{- $_ := (set $pandaProxy "pandaproxy_api" (get (fromJson (include "redpanda.HTTPListeners.Listeners" (dict "a" (list $values.listeners.http (get (fromJson (include "redpanda.Auth.IsSASLEnabled" (dict "a" (list $values.auth) ))) "r")) ))) "r")) -}} +{{- $_ := (set $pandaProxy "pandaproxy_api_tls" (coalesce nil)) -}} +{{- $tls_10 := (get (fromJson (include "redpanda.HTTPListeners.ListenersTLS" (dict "a" (list $values.listeners.http $values.tls) ))) "r") -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $tls_10) ))) "r") | int) (0 | int)) -}} +{{- $_ := (set $pandaProxy "pandaproxy_api_tls" $tls_10) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $pandaProxy) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.schemaRegistry" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $schemaReg := (dict ) -}} +{{- $_ := (set $schemaReg "schema_registry_api" (get (fromJson (include "redpanda.SchemaRegistryListeners.Listeners" (dict "a" (list $values.listeners.schemaRegistry (get (fromJson (include "redpanda.Auth.IsSASLEnabled" (dict "a" (list $values.auth) ))) "r")) ))) "r")) -}} +{{- $_ := (set $schemaReg "schema_registry_api_tls" (coalesce nil)) -}} +{{- $tls_11 := (get (fromJson (include "redpanda.SchemaRegistryListeners.ListenersTLS" (dict "a" (list $values.listeners.schemaRegistry $values.tls) ))) "r") -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $tls_11) ))) "r") | int) (0 | int)) -}} +{{- $_ := (set $schemaReg "schema_registry_api_tls" $tls_11) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $schemaReg) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.rpcListenersTLS" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $r := $values.listeners.rpc -}} +{{- if (and (not ((or (or (get (fromJson (include "redpanda.RedpandaAtLeast_22_2_atleast_22_2_10" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.RedpandaAtLeast_22_3_atleast_22_3_13" (dict "a" (list $dot) ))) "r")) (get (fromJson (include "redpanda.RedpandaAtLeast_23_1_2" (dict "a" (list $dot) ))) "r")))) ((or (and (eq (toJson $r.tls.enabled) "null") $values.tls.enabled) (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $r.tls.enabled false) ))) "r")))) -}} +{{- $_ := (fail (printf "Redpanda version v%s does not support TLS on the RPC port. Please upgrade. See technical service bulletin 2023-01." (trimPrefix "v" (get (fromJson (include "redpanda.Tag" (dict "a" (list $dot) ))) "r")))) -}} +{{- end -}} +{{- if (not (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $r.tls $values.tls) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (dict )) | toJson -}} +{{- break -}} +{{- end -}} +{{- $certName := $r.tls.cert -}} +{{- $_is_returning = true -}} +{{- (dict "r" (dict "enabled" true "cert_file" (printf "/etc/tls/certs/%s/tls.crt" $certName) "key_file" (printf "/etc/tls/certs/%s/tls.key" $certName) "require_client_auth" $r.tls.requireClientAuth "truststore_file" (get (fromJson (include "redpanda.InternalTLS.TrustStoreFilePath" (dict "a" (list $r.tls $values.tls) ))) "r") )) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.rpcListeners" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $_is_returning = true -}} +{{- (dict "r" (dict "address" "0.0.0.0" "port" ($values.listeners.rpc.port | int) )) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.createInternalListenerTLSCfg" -}} +{{- $tls := (index .a 0) -}} +{{- $internal := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (not (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $internal $tls) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (dict )) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (dict "name" "internal" "enabled" true "cert_file" (printf "/etc/tls/certs/%s/tls.crt" $internal.cert) "key_file" (printf "/etc/tls/certs/%s/tls.key" $internal.cert) "require_client_auth" $internal.requireClientAuth "truststore_file" (get (fromJson (include "redpanda.InternalTLS.TrustStoreFilePath" (dict "a" (list $internal $tls) ))) "r") )) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.createInternalListenerCfg" -}} +{{- $port := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (dict "name" "internal" "address" "0.0.0.0" "port" $port )) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RedpandaAdditionalStartFlags" -}} +{{- $dot := (index .a 0) -}} +{{- $smp := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $chartFlags := (dict "smp" (printf "%d" ($smp | int)) "memory" (printf "%dM" (((get (fromJson (include "redpanda.RedpandaMemory" (dict "a" (list $dot) ))) "r") | int64) | int)) "reserve-memory" (printf "%dM" (((get (fromJson (include "redpanda.RedpandaReserveMemory" (dict "a" (list $dot) ))) "r") | int64) | int)) "default-log-level" $values.logging.logLevel ) -}} +{{- if (eq (index $values.config.node "developer_mode") true) -}} +{{- $_ := (unset $chartFlags "reserve-memory") -}} +{{- end -}} +{{- range $flag, $_ := $chartFlags -}} +{{- range $_, $userFlag := $values.statefulset.additionalRedpandaCmdFlags -}} +{{- if (regexMatch (printf "^--%s" $flag) $userFlag) -}} +{{- $_ := (unset $chartFlags $flag) -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $keys := (keys $chartFlags) -}} +{{- $_ := (sortAlpha $keys) -}} +{{- $flags := (list ) -}} +{{- range $_, $key := $keys -}} +{{- $flags = (concat (default (list ) $flags) (list (printf "--%s=%s" $key (index $chartFlags $key)))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (concat (default (list ) $flags) (default (list ) $values.statefulset.additionalRedpandaCmdFlags))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_console.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_console.go.tpl new file mode 100644 index 000000000..f8498e998 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_console.go.tpl @@ -0,0 +1,60 @@ +{{- /* Generated from "console.tpl.go" */ -}} + +{{- define "redpanda.ConsoleConfig" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $schemaURLs := (coalesce nil) -}} +{{- if $values.listeners.schemaRegistry.enabled -}} +{{- $schema := "http" -}} +{{- if (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $values.listeners.schemaRegistry.tls $values.tls) ))) "r") -}} +{{- $schema = "https" -}} +{{- end -}} +{{- range $_, $i := untilStep (((0 | int) | int)|int) (($values.statefulset.replicas | int)|int) (1|int) -}} +{{- $schemaURLs = (concat (default (list ) $schemaURLs) (list (printf "%s://%s-%d.%s:%d" $schema (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") $i (get (fromJson (include "redpanda.InternalDomain" (dict "a" (list $dot) ))) "r") ($values.listeners.schemaRegistry.port | int)))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- $schema := "http" -}} +{{- if (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $values.listeners.admin.tls $values.tls) ))) "r") -}} +{{- $schema = "https" -}} +{{- end -}} +{{- $c := (dict "kafka" (dict "brokers" (get (fromJson (include "redpanda.BrokerList" (dict "a" (list $dot ($values.statefulset.replicas | int) ($values.listeners.kafka.port | int)) ))) "r") "sasl" (dict "enabled" (get (fromJson (include "redpanda.Auth.IsSASLEnabled" (dict "a" (list $values.auth) ))) "r") ) "tls" (get (fromJson (include "redpanda.KafkaListeners.ConsolemTLS" (dict "a" (list $values.listeners.kafka $values.tls) ))) "r") "schemaRegistry" (dict "enabled" $values.listeners.schemaRegistry.enabled "urls" $schemaURLs "tls" (get (fromJson (include "redpanda.SchemaRegistryListeners.ConsoleTLS" (dict "a" (list $values.listeners.schemaRegistry $values.tls) ))) "r") ) ) "redpanda" (dict "adminApi" (dict "enabled" true "urls" (list (printf "%s://%s:%d" $schema (get (fromJson (include "redpanda.InternalDomain" (dict "a" (list $dot) ))) "r") ($values.listeners.admin.port | int))) "tls" (get (fromJson (include "redpanda.AdminListeners.ConsoleTLS" (dict "a" (list $values.listeners.admin $values.tls) ))) "r") ) ) ) -}} +{{- if $values.connectors.enabled -}} +{{- $port := (dig "connectors" "connectors" "restPort" (8083 | int) $dot.Values.AsMap) -}} +{{- $tmp_tuple_1 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.asintegral" (dict "a" (list $port) ))) "r")) ))) "r") -}} +{{- $ok := $tmp_tuple_1.T2 -}} +{{- $p := ($tmp_tuple_1.T1 | int) -}} +{{- if (not $ok) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $c) | toJson -}} +{{- break -}} +{{- end -}} +{{- $connectorsURL := (printf "http://%s.%s.svc.%s:%d" (get (fromJson (include "redpanda.ConnectorsFullName" (dict "a" (list $dot) ))) "r") $dot.Release.Namespace (trimSuffix "." $values.clusterDomain) $p) -}} +{{- $_ := (set $c "connect" (mustMergeOverwrite (dict "enabled" false "clusters" (coalesce nil) "connectTimeout" 0 "readTimeout" 0 "requestTimeout" 0 ) (dict "enabled" $values.connectors.enabled "clusters" (list (mustMergeOverwrite (dict "name" "" "url" "" "tls" (dict "enabled" false "caFilepath" "" "certFilepath" "" "keyFilepath" "" "insecureSkipTlsVerify" false ) "username" "" "password" "" "token" "" ) (dict "name" "connectors" "url" $connectorsURL "tls" (mustMergeOverwrite (dict "enabled" false "caFilepath" "" "certFilepath" "" "keyFilepath" "" "insecureSkipTlsVerify" false ) (dict "enabled" false "caFilepath" "" "certFilepath" "" "keyFilepath" "" "insecureSkipTlsVerify" false )) "username" "" "password" "" "token" "" ))) ))) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (merge (dict ) $values.console.console.config $c)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.ConnectorsFullName" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (ne (dig "connectors" "connectors" "fullnameOverwrite" "" $dot.Values.AsMap) "") -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.cleanForK8s" (dict "a" (list $values.connectors.connectors.fullnameOverwrite) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.cleanForK8s" (dict "a" (list (printf "%s-connectors" $dot.Release.Name)) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_example-commands.tpl b/charts/redpanda/redpanda/5.9.7/templates/_example-commands.tpl new file mode 100644 index 000000000..9a5c695e3 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_example-commands.tpl @@ -0,0 +1,58 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + + +{{/* +Any rpk command that's given to the user in NOTES.txt must be defined in this template file +and tested in a test. +*/}} + +{{/* tested in tests/test-kafka-sasl-status.yaml */}} +{{- define "rpk-acl-user-create" -}} +{{- $cmd := (get ((include "redpanda.RpkACLUserCreate" (dict "a" (list .))) | fromJson) "r") }} +{{- $cmd }} +{{- end -}} + +{{/* tested in tests/test-kafka-sasl-status.yaml */}} +{{- define "rpk-acl-create" -}} +{{- $cmd := (get ((include "redpanda.RpkACLCreate" (dict "a" (list .))) | fromJson) "r") }} +{{- $cmd }} +{{- end -}} + +{{/* tested in tests/test-kafka-sasl-status.yaml */}} +{{- define "rpk-cluster-info" -}} +{{- $cmd := (get ((include "redpanda.RpkClusterInfo" (dict "a" (list .))) | fromJson) "r") }} +{{- $cmd }} +{{- end -}} + +{{/* tested in tests/test-kafka-sasl-status.yaml */}} +{{- define "rpk-topic-create" -}} +{{- $cmd := (get ((include "redpanda.RpkTopicCreate" (dict "a" (list .))) | fromJson) "r") }} +{{- $cmd }} +{{- end -}} + +{{/* tested in tests/test-kafka-sasl-status.yaml */}} +{{- define "rpk-topic-describe" -}} +{{- $cmd := (get ((include "redpanda.RpkTopicDescribe" (dict "a" (list .))) | fromJson) "r") }} +{{- $cmd }} +{{- end -}} + +{{/* tested in tests/test-kafka-sasl-status.yaml */}} +{{- define "rpk-topic-delete" -}} +{{- $cmd := (get ((include "redpanda.RpkTopicDelete" (dict "a" (list .))) | fromJson) "r") }} +{{- $cmd }} +{{- end -}} \ No newline at end of file diff --git a/charts/redpanda/redpanda/5.9.7/templates/_helpers.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_helpers.go.tpl new file mode 100644 index 000000000..58805d14c --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_helpers.go.tpl @@ -0,0 +1,535 @@ +{{- /* Generated from "helpers.go" */ -}} + +{{- define "redpanda.ChartLabel" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.cleanForK8s" (dict "a" (list (replace "+" "_" (printf "%s-%s" $dot.Chart.Name $dot.Chart.Version))) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Name" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_1 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.typetest" (dict "a" (list "string" (index $dot.Values "nameOverride") "") ))) "r")) ))) "r") -}} +{{- $ok_2 := $tmp_tuple_1.T2 -}} +{{- $override_1 := $tmp_tuple_1.T1 -}} +{{- if (and $ok_2 (ne $override_1 "")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.cleanForK8s" (dict "a" (list $override_1) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.cleanForK8s" (dict "a" (list $dot.Chart.Name) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Fullname" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_2 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.typetest" (dict "a" (list "string" (index $dot.Values "fullnameOverride") "") ))) "r")) ))) "r") -}} +{{- $ok_4 := $tmp_tuple_2.T2 -}} +{{- $override_3 := $tmp_tuple_2.T1 -}} +{{- if (and $ok_4 (ne $override_3 "")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.cleanForK8s" (dict "a" (list $override_3) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.cleanForK8s" (dict "a" (list $dot.Release.Name) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.FullLabels" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $labels := (dict ) -}} +{{- if (ne (toJson $values.commonLabels) "null") -}} +{{- $labels = $values.commonLabels -}} +{{- end -}} +{{- $defaults := (dict "helm.sh/chart" (get (fromJson (include "redpanda.ChartLabel" (dict "a" (list $dot) ))) "r") "app.kubernetes.io/name" (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r") "app.kubernetes.io/instance" $dot.Release.Name "app.kubernetes.io/managed-by" $dot.Release.Service "app.kubernetes.io/component" (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r") ) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (merge (dict ) $labels $defaults)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.ServiceAccountName" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $serviceAccount := $values.serviceAccount -}} +{{- if (and $serviceAccount.create (ne $serviceAccount.name "")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $serviceAccount.name) | toJson -}} +{{- break -}} +{{- else -}}{{- if $serviceAccount.create -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) | toJson -}} +{{- break -}} +{{- else -}}{{- if (ne $serviceAccount.name "") -}} +{{- $_is_returning = true -}} +{{- (dict "r" $serviceAccount.name) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" "default") | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Tag" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $tag := (toString $values.image.tag) -}} +{{- if (eq $tag "") -}} +{{- $tag = $dot.Chart.AppVersion -}} +{{- end -}} +{{- $pattern := "^v(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$" -}} +{{- if (not (regexMatch $pattern $tag)) -}} +{{- $_ := (fail "image.tag must start with a 'v' and be a valid semver") -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $tag) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.ServiceName" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (and (ne (toJson $values.service) "null") (ne (toJson $values.service.name) "null")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.cleanForK8s" (dict "a" (list $values.service.name) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.InternalDomain" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $service := (get (fromJson (include "redpanda.ServiceName" (dict "a" (list $dot) ))) "r") -}} +{{- $ns := $dot.Release.Namespace -}} +{{- $domain := (trimSuffix "." $values.clusterDomain) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "%s.%s.svc.%s." $service $ns $domain)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.TLSEnabled" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if $values.tls.enabled -}} +{{- $_is_returning = true -}} +{{- (dict "r" true) | toJson -}} +{{- break -}} +{{- end -}} +{{- $listeners := (list "kafka" "admin" "schemaRegistry" "rpc" "http") -}} +{{- range $_, $listener := $listeners -}} +{{- $tlsCert := (dig "listeners" $listener "tls" "cert" false $dot.Values.AsMap) -}} +{{- $tlsEnabled := (dig "listeners" $listener "tls" "enabled" false $dot.Values.AsMap) -}} +{{- if (and (not (empty $tlsEnabled)) (not (empty $tlsCert))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" true) | toJson -}} +{{- break -}} +{{- end -}} +{{- $external := (dig "listeners" $listener "external" false $dot.Values.AsMap) -}} +{{- if (empty $external) -}} +{{- continue -}} +{{- end -}} +{{- $keys := (keys (get (fromJson (include "_shims.typeassertion" (dict "a" (list (printf "map[%s]%s" "string" "interface {}") $external) ))) "r")) -}} +{{- range $_, $key := $keys -}} +{{- $enabled := (dig "listeners" $listener "external" $key "enabled" false $dot.Values.AsMap) -}} +{{- $tlsCert := (dig "listeners" $listener "external" $key "tls" "cert" false $dot.Values.AsMap) -}} +{{- $tlsEnabled := (dig "listeners" $listener "external" $key "tls" "enabled" false $dot.Values.AsMap) -}} +{{- if (and (and (not (empty $enabled)) (not (empty $tlsCert))) (not (empty $tlsEnabled))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" true) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" false) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.ClientAuthRequired" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $listeners := (list "kafka" "admin" "schemaRegistry" "rpc" "http") -}} +{{- range $_, $listener := $listeners -}} +{{- $required := (dig "listeners" $listener "tls" "requireClientAuth" false $dot.Values.AsMap) -}} +{{- if (not (empty $required)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" true) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" false) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.DefaultMounts" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (concat (default (list ) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "base-config" "mountPath" "/etc/redpanda" )))) (default (list ) (get (fromJson (include "redpanda.CommonMounts" (dict "a" (list $dot) ))) "r")))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.CommonMounts" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $mounts := (list ) -}} +{{- $sasl_5 := $values.auth.sasl -}} +{{- if (and $sasl_5.enabled (ne $sasl_5.secretRef "")) -}} +{{- $mounts = (concat (default (list ) $mounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "users" "mountPath" "/etc/secrets/users" "readOnly" true )))) -}} +{{- end -}} +{{- if (get (fromJson (include "redpanda.TLSEnabled" (dict "a" (list $dot) ))) "r") -}} +{{- $certNames := (keys $values.tls.certs) -}} +{{- $_ := (sortAlpha $certNames) -}} +{{- range $_, $name := $certNames -}} +{{- $cert := (index $values.tls.certs $name) -}} +{{- if (not (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $cert.enabled true) ))) "r")) -}} +{{- continue -}} +{{- end -}} +{{- $mounts = (concat (default (list ) $mounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" (printf "redpanda-%s-cert" $name) "mountPath" (printf "/etc/tls/certs/%s" $name) )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $adminTLS := $values.listeners.admin.tls -}} +{{- if $adminTLS.requireClientAuth -}} +{{- $mounts = (concat (default (list ) $mounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "mtls-client" "mountPath" (printf "/etc/tls/certs/%s-client" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) )))) -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $mounts) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.DefaultVolumes" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (concat (default (list ) (list (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "configMap" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") )) (dict )) )) (dict "name" "base-config" )))) (default (list ) (get (fromJson (include "redpanda.CommonVolumes" (dict "a" (list $dot) ))) "r")))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.CommonVolumes" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $volumes := (list ) -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (get (fromJson (include "redpanda.TLSEnabled" (dict "a" (list $dot) ))) "r") -}} +{{- $certNames := (keys $values.tls.certs) -}} +{{- $_ := (sortAlpha $certNames) -}} +{{- range $_, $name := $certNames -}} +{{- $cert := (index $values.tls.certs $name) -}} +{{- if (not (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $cert.enabled true) ))) "r")) -}} +{{- continue -}} +{{- end -}} +{{- $volumes = (concat (default (list ) $volumes) (list (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "secret" (mustMergeOverwrite (dict ) (dict "secretName" (get (fromJson (include "redpanda.CertSecretName" (dict "a" (list $dot $name $cert) ))) "r") "defaultMode" (0o440 | int) )) )) (dict "name" (printf "redpanda-%s-cert" $name) )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $adminTLS := $values.listeners.admin.tls -}} +{{- $cert := (index $values.tls.certs $adminTLS.cert) -}} +{{- if $adminTLS.requireClientAuth -}} +{{- $secretName := (printf "%s-client" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) -}} +{{- if (ne (toJson $cert.clientSecretRef) "null") -}} +{{- $secretName = $cert.clientSecretRef.name -}} +{{- end -}} +{{- $volumes = (concat (default (list ) $volumes) (list (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "secret" (mustMergeOverwrite (dict ) (dict "secretName" $secretName "defaultMode" (0o440 | int) )) )) (dict "name" "mtls-client" )))) -}} +{{- end -}} +{{- end -}} +{{- $sasl_6 := $values.auth.sasl -}} +{{- if (and $sasl_6.enabled (ne $sasl_6.secretRef "")) -}} +{{- $volumes = (concat (default (list ) $volumes) (list (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "secret" (mustMergeOverwrite (dict ) (dict "secretName" $sasl_6.secretRef )) )) (dict "name" "users" )))) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $volumes) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.CertSecretName" -}} +{{- $dot := (index .a 0) -}} +{{- $certName := (index .a 1) -}} +{{- $cert := (index .a 2) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (ne (toJson $cert.secretRef) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" $cert.secretRef.name) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "%s-%s-cert" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") $certName)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.PodSecurityContext" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $sc := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.statefulset.podSecurityContext $values.statefulset.securityContext) ))) "r") -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict ) (dict "fsGroup" $sc.fsGroup "fsGroupChangePolicy" $sc.fsGroupChangePolicy ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.ContainerSecurityContext" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $sc := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.statefulset.podSecurityContext $values.statefulset.securityContext) ))) "r") -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict ) (dict "runAsUser" $sc.runAsUser "runAsGroup" (get (fromJson (include "redpanda.coalesce" (dict "a" (list (list $sc.runAsGroup $sc.fsGroup)) ))) "r") "allowPrivilegeEscalation" (get (fromJson (include "redpanda.coalesce" (dict "a" (list (list $sc.allowPrivilegeEscalation $sc.allowPriviledgeEscalation)) ))) "r") "runAsNonRoot" $sc.runAsNonRoot ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RedpandaAtLeast_22_2_0" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.redpandaAtLeast" (dict "a" (list $dot ">=22.2.0-0 || <0.0.1-0") ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RedpandaAtLeast_22_3_0" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.redpandaAtLeast" (dict "a" (list $dot ">=22.3.0-0 || <0.0.1-0") ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RedpandaAtLeast_23_1_1" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.redpandaAtLeast" (dict "a" (list $dot ">=23.1.1-0 || <0.0.1-0") ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RedpandaAtLeast_23_1_2" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.redpandaAtLeast" (dict "a" (list $dot ">=23.1.2-0 || <0.0.1-0") ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RedpandaAtLeast_22_3_atleast_22_3_13" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.redpandaAtLeast" (dict "a" (list $dot ">=22.3.13-0,<22.4") ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RedpandaAtLeast_22_2_atleast_22_2_10" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.redpandaAtLeast" (dict "a" (list $dot ">=22.2.10-0,<22.3") ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RedpandaAtLeast_23_2_1" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.redpandaAtLeast" (dict "a" (list $dot ">=23.2.1-0 || <0.0.1-0") ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RedpandaAtLeast_23_3_0" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.redpandaAtLeast" (dict "a" (list $dot ">=23.3.0-0 || <0.0.1-0") ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.redpandaAtLeast" -}} +{{- $dot := (index .a 0) -}} +{{- $constraint := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $version := (trimPrefix "v" (get (fromJson (include "redpanda.Tag" (dict "a" (list $dot) ))) "r")) -}} +{{- $tmp_tuple_3 := (get (fromJson (include "_shims.compact" (dict "a" (list (list (semverCompare $constraint $version) nil)) ))) "r") -}} +{{- $err := $tmp_tuple_3.T2 -}} +{{- $result := $tmp_tuple_3.T1 -}} +{{- if (ne (toJson $err) "null") -}} +{{- $_ := (fail $err) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.cleanForK8s" -}} +{{- $in := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (trimSuffix "-" (trunc (63 | int) $in))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RedpandaSMP" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $coresInMillies := ((get (fromJson (include "_shims.resource_MilliValue" (dict "a" (list $values.resources.cpu.cores) ))) "r") | int64) -}} +{{- if (lt $coresInMillies (1000 | int64)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (1 | int64)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" ((get (fromJson (include "_shims.resource_Value" (dict "a" (list $values.resources.cpu.cores) ))) "r") | int64)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.coalesce" -}} +{{- $values := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- range $_, $v := $values -}} +{{- if (ne (toJson $v) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" $v) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.StrategicMergePatch" -}} +{{- $overrides := (index .a 0) -}} +{{- $original := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (ne (toJson $overrides.labels) "null") -}} +{{- $_ := (set $original.metadata "labels" (merge (dict ) $overrides.labels (default (dict ) $original.metadata.labels))) -}} +{{- end -}} +{{- if (ne (toJson $overrides.annotations) "null") -}} +{{- $_ := (set $original.metadata "annotations" (merge (dict ) $overrides.annotations (default (dict ) $original.metadata.annotations))) -}} +{{- end -}} +{{- if (ne (toJson $overrides.spec.securityContext) "null") -}} +{{- $_ := (set $original.spec "securityContext" (merge (dict ) $overrides.spec.securityContext (default (mustMergeOverwrite (dict ) (dict )) $original.spec.securityContext))) -}} +{{- end -}} +{{- $overrideContainers := (dict ) -}} +{{- range $i, $_ := $overrides.spec.containers -}} +{{- $container := (index $overrides.spec.containers $i) -}} +{{- $_ := (set $overrideContainers (toString $container.name) $container) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $merged := (coalesce nil) -}} +{{- range $_, $container := $original.spec.containers -}} +{{- $tmp_tuple_4 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $overrideContainers $container.name (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok_8 := $tmp_tuple_4.T2 -}} +{{- $override_7 := $tmp_tuple_4.T1 -}} +{{- if $ok_8 -}} +{{- $env := (concat (default (list ) $container.env) (default (list ) $override_7.env)) -}} +{{- $container = (merge (dict ) $override_7 $container) -}} +{{- $_ := (set $container "env" $env) -}} +{{- end -}} +{{- if (eq (toJson $container.env) "null") -}} +{{- $_ := (set $container "env" (list )) -}} +{{- end -}} +{{- $merged = (concat (default (list ) $merged) (list $container)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_ := (set $original.spec "containers" $merged) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $original) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_helpers.tpl b/charts/redpanda/redpanda/5.9.7/templates/_helpers.tpl new file mode 100644 index 000000000..a885f9dcd --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_helpers.tpl @@ -0,0 +1,368 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{/* +Expand the name of the chart. +*/}} +{{- define "redpanda.name" -}} +{{- get ((include "redpanda.Name" (dict "a" (list .))) | fromJson) "r" }} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "redpanda.fullname" -}} +{{- get ((include "redpanda.Fullname" (dict "a" (list .))) | fromJson) "r" }} +{{- end -}} + +{{/* +Create a default service name +*/}} +{{- define "redpanda.servicename" -}} +{{- get ((include "redpanda.ServiceName" (dict "a" (list .))) | fromJson) "r" }} +{{- end -}} + +{{/* +full helm labels + common labels +*/}} +{{- define "full.labels" -}} +{{- (get ((include "redpanda.FullLabels" (dict "a" (list .))) | fromJson) "r") | toYaml }} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "redpanda.chart" -}} +{{- get ((include "redpanda.Chart" (dict "a" (list .))) | fromJson) "r" }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "redpanda.serviceAccountName" -}} +{{- get ((include "redpanda.ServiceAccountName" (dict "a" (list .))) | fromJson) "r" }} +{{- end }} + +{{/* +Use AppVersion if image.tag is not set +*/}} +{{- define "redpanda.tag" -}} +{{- get ((include "redpanda.Tag" (dict "a" (list .))) | fromJson) "r" }} +{{- end -}} + +{{/* Generate internal fqdn */}} +{{- define "redpanda.internal.domain" -}} +{{- get ((include "redpanda.InternalDomain" (dict "a" (list .))) | fromJson) "r" }} +{{- end -}} + +{{/* ConfigMap variables */}} +{{- define "admin-internal-tls-enabled" -}} +{{- toJson (dict "bool" (get ((include "redpanda.InternalTLS.IsEnabled" (dict "a" (list .Values.listeners.admin.tls .Values.tls))) | fromJson) "r")) -}} +{{- end -}} + +{{- define "kafka-internal-tls-enabled" -}} +{{- $listener := .Values.listeners.kafka -}} +{{- toJson (dict "bool" (and (dig "tls" "enabled" .Values.tls.enabled $listener) (not (empty (dig "tls" "cert" "" $listener))))) -}} +{{- end -}} + +{{- define "kafka-external-tls-cert" -}} +{{- dig "tls" "cert" .Values.listeners.kafka.tls.cert .listener -}} +{{- end -}} + +{{- define "http-internal-tls-enabled" -}} +{{- $listener := .Values.listeners.http -}} +{{- toJson (dict "bool" (and (dig "tls" "enabled" .Values.tls.enabled $listener) (not (empty (dig "tls" "cert" "" $listener))))) -}} +{{- end -}} + +{{- define "schemaRegistry-internal-tls-enabled" -}} +{{- $listener := .Values.listeners.schemaRegistry -}} +{{- toJson (dict "bool" (and (dig "tls" "enabled" .Values.tls.enabled $listener) (not (empty (dig "tls" "cert" "" $listener))))) -}} +{{- end -}} + +{{- define "tls-enabled" -}} +{{- $tlsenabled := get ((include "redpanda.TLSEnabled" (dict "a" (list .))) | fromJson) "r" }} +{{- toJson (dict "bool" $tlsenabled) -}} +{{- end -}} + +{{- define "sasl-enabled" -}} +{{- toJson (dict "bool" (dig "enabled" false .Values.auth.sasl)) -}} +{{- end -}} + +{{- define "admin-api-urls" -}} +{{ printf "${SERVICE_NAME}.%s" (include "redpanda.internal.domain" .) }}:{{.Values.listeners.admin.port }} +{{- end -}} + +{{- define "admin-api-service-url" -}} +{{ include "redpanda.internal.domain" .}}:{{.Values.listeners.admin.port }} +{{- end -}} + +{{- define "sasl-mechanism" -}} +{{- dig "sasl" "mechanism" "SCRAM-SHA-512" .Values.auth -}} +{{- end -}} + +{{- define "fail-on-insecure-sasl-logging" -}} +{{- if (include "sasl-enabled" .|fromJson).bool -}} + {{- $check := list + (include "redpanda-atleast-23-1-1" .|fromJson).bool + (include "redpanda-22-3-atleast-22-3-13" .|fromJson).bool + (include "redpanda-22-2-atleast-22-2-10" .|fromJson).bool + -}} + {{- if not (mustHas true $check) -}} + {{- fail "SASL is enabled and the redpanda version specified leaks secrets to the logs. Please choose a newer version of redpanda." -}} + {{- end -}} +{{- end -}} +{{- end -}} + +{{- define "fail-on-unsupported-helm-version" -}} + {{- $helmVer := (fromYaml (toYaml .Capabilities.HelmVersion)).version -}} + {{- if semverCompare "<3.8.0-0" $helmVer -}} + {{- fail (printf "helm version %s is not supported. Please use helm version v3.8.0 or newer." $helmVer) -}} + {{- end -}} +{{- end -}} + +{{- define "redpanda-atleast-22-2-0" -}} +{{- toJson (dict "bool" (get ((include "redpanda.RedpandaAtLeast_22_2_0" (dict "a" (list .))) | fromJson) "r")) }} +{{- end -}} +{{- define "redpanda-atleast-22-3-0" -}} +{{- toJson (dict "bool" (get ((include "redpanda.RedpandaAtLeast_22_3_0" (dict "a" (list .))) | fromJson) "r")) }} +{{- end -}} +{{- define "redpanda-atleast-23-1-1" -}} +{{- toJson (dict "bool" (get ((include "redpanda.RedpandaAtLeast_23_1_1" (dict "a" (list .))) | fromJson) "r")) }} +{{- end -}} +{{- define "redpanda-atleast-23-1-2" -}} +{{- toJson (dict "bool" (get ((include "redpanda.RedpandaAtLeast_23_1_2" (dict "a" (list .))) | fromJson) "r")) }} +{{- end -}} +{{- define "redpanda-22-3-atleast-22-3-13" -}} +{{- toJson (dict "bool" (get ((include "redpanda.RedpandaAtLeast_22_3_atleast_22_3_13" (dict "a" (list .))) | fromJson) "r")) }} +{{- end -}} +{{- define "redpanda-22-2-atleast-22-2-10" -}} +{{- toJson (dict "bool" (get ((include "redpanda.RedpandaAtLeast_22_2_atleast_22_2_10" (dict "a" (list .))) | fromJson) "r")) }} +{{- end -}} +{{- define "redpanda-atleast-23-2-1" -}} +{{- toJson (dict "bool" (get ((include "redpanda.RedpandaAtLeast_23_2_1" (dict "a" (list .))) | fromJson) "r")) }} +{{- end -}} +{{- define "redpanda-atleast-23-3-0" -}} +{{- toJson (dict "bool" (get ((include "redpanda.RedpandaAtLeast_23_3_0" (dict "a" (list .))) | fromJson) "r")) }} +{{- end -}} + +{{- define "redpanda-22-2-x-without-sasl" -}} +{{- $result := (include "redpanda-atleast-22-3-0" . | fromJson).bool -}} +{{- if or (include "sasl-enabled" . | fromJson).bool .Values.listeners.kafka.authenticationMethod -}} +{{- $result := false -}} +{{- end -}} +{{- toJson (dict "bool" $result) -}} +{{- end -}} + +{{- define "pod-security-context" -}} +{{- get ((include "redpanda.PodSecurityContext" (dict "a" (list .))) | fromJson) "r" | toYaml }} +{{- end -}} + +{{- define "container-security-context" -}} +{{- get ((include "redpanda.ContainerSecurityContext" (dict "a" (list .))) | fromJson) "r" | toYaml }} +{{- end -}} + +{{- define "admin-tls-curl-flags" -}} + {{- $result := "" -}} + {{- if (include "admin-internal-tls-enabled" . | fromJson).bool -}} + {{- $path := (printf "/etc/tls/certs/%s" .Values.listeners.admin.tls.cert) -}} + {{- $result = (printf "--cacert %s/tls.crt" $path) -}} + {{- if .Values.listeners.admin.tls.requireClientAuth -}} + {{- $result = (printf "--cacert %s/ca.crt --cert %s/tls.crt --key %s/tls.key" $path $path $path) -}} + {{- end -}} + {{- end -}} + {{- $result -}} +{{- end -}} + +{{- define "admin-http-protocol" -}} + {{- $result := "http" -}} + {{- if (include "admin-internal-tls-enabled" . | fromJson).bool -}} + {{- $result = "https" -}} + {{- end -}} + {{- $result -}} +{{- end -}} + +{{- /* +advertised-port returns either the only advertised port if only one is specified, +or the port specified for this pod ordinal when there is a full list provided. + +This will return a string int or panic if there is more than one port provided, +but not enough ports for the number of replicas requested. +*/ -}} +{{- define "advertised-port" -}} + {{- $port := dig "port" .listenerVals.port .externalVals -}} + {{- if .externalVals.advertisedPorts -}} + {{- if eq (len .externalVals.advertisedPorts) 1 -}} + {{- $port = mustFirst .externalVals.advertisedPorts -}} + {{- else -}} + {{- $port = index .externalVals.advertisedPorts .replicaIndex -}} + {{- end -}} + {{- end -}} + {{ $port }} +{{- end -}} + +{{- /* +advertised-host returns a json string with the data needed for configuring the advertised listener +*/ -}} +{{- define "advertised-host" -}} + {{- $host := dict "name" .externalName "address" .externalAdvertiseAddress "port" .port -}} + {{- if .values.external.addresses -}} + {{- $address := "" -}} + {{- if gt (len .values.external.addresses) 1 -}} + {{- $address = (index .values.external.addresses .replicaIndex) -}} + {{- else -}} + {{- $address = (index .values.external.addresses 0) -}} + {{- end -}} + {{- if ( .values.external.domain | default "" ) }} + {{- $host = dict "name" .externalName "address" (printf "%s.%s" $address .values.external.domain) "port" .port -}} + {{- else -}} + {{- $host = dict "name" .externalName "address" $address "port" .port -}} + {{- end -}} + {{- end -}} + {{- toJson $host -}} +{{- end -}} + +{{- define "is-licensed" -}} +{{- toJson (dict "bool" (or (not (empty (include "enterprise-license" . ))) (not (empty (include "enterprise-secret" . ))))) -}} +{{- end -}} + +{{- define "seed-server-list" -}} + {{- $brokers := list -}} + {{- range $ordinal := until (.Values.statefulset.replicas | int) -}} + {{- $brokers = append $brokers (printf "%s-%d.%s" + (include "redpanda.fullname" $) + $ordinal + (include "redpanda.internal.domain" $)) + -}} + {{- end -}} + {{- toJson $brokers -}} +{{- end -}} + +{{/* +return license checks deprecated values if current values is empty +*/}} +{{- define "enterprise-license" -}} +{{- if dig "license" dict .Values.enterprise -}} + {{- .Values.enterprise.license -}} +{{- else -}} + {{- .Values.license_key -}} +{{- end -}} +{{- end -}} + +{{/* +return licenseSecretRef checks deprecated values entry if current values empty +*/}} +{{- define "enterprise-secret" -}} +{{- if ( dig "licenseSecretRef" dict .Values.enterprise ) -}} + {{- .Values.enterprise.licenseSecretRef -}} +{{- else if not (empty .Values.license_secret_ref ) -}} + {{- .Values.license_secret_ref -}} +{{- end -}} +{{- end -}} + +{{/* +return licenseSecretRef.name checks deprecated values entry if current values empty +*/}} +{{- define "enterprise-secret-name" -}} +{{- if ( dig "licenseSecretRef" dict .Values.enterprise ) -}} + {{- dig "name" "" .Values.enterprise.licenseSecretRef -}} +{{- else if not (empty .Values.license_secret_ref ) -}} + {{- dig "secret_name" "" .Values.license_secret_ref -}} +{{- end -}} +{{- end -}} + +{{/* +return licenseSecretRef.key checks deprecated values entry if current values empty +*/}} +{{- define "enterprise-secret-key" -}} +{{- if ( dig "licenseSecretRef" dict .Values.enterprise ) -}} + {{- dig "key" "" .Values.enterprise.licenseSecretRef -}} +{{- else if not (empty .Values.license_secret_ref ) -}} + {{- dig "secret_key" "" .Values.license_secret_ref -}} +{{- end -}} +{{- end -}} + +{{/* mounts that are common to all containers */}} +{{- define "common-mounts" -}} +{{- $mounts := get ((include "redpanda.CommonMounts" (dict "a" (list .))) | fromJson) "r" }} +{{- if $mounts -}} +{{- toYaml $mounts -}} +{{- end -}} +{{- end -}} + +{{/* mounts that are common to most containers */}} +{{- define "default-mounts" -}} +{{- $mounts := get ((include "redpanda.DefaultMounts" (dict "a" (list .))) | fromJson) "r" }} +{{- if $mounts -}} +{{- toYaml $mounts -}} +{{- end -}} +{{- end -}} + +{{/* volumes that are common to all pods */}} +{{- define "common-volumes" -}} +{{- $volumes := get ((include "redpanda.CommonVolumes" (dict "a" (list .))) | fromJson) "r" }} +{{- if $volumes -}} +{{- toYaml $volumes -}} +{{- end -}} +{{- end -}} + +{{/* the default set of volumes for most pods, except the sts pod */}} +{{- define "default-volumes" -}} +{{- $volumes := get ((include "redpanda.DefaultVolumes" (dict "a" (list .))) | fromJson) "r" }} +{{- if $volumes -}} +{{- toYaml $volumes -}} +{{- end -}} +{{- end -}} + +{{/* support legacy storage.tieredConfig */}} +{{- define "storage-tiered-config" -}} +{{- $cfg := get ((include "redpanda.StorageTieredConfig" (dict "a" (list .))) | fromJson) "r" }} +{{- if $cfg -}} +{{- toYaml $cfg -}} +{{- end -}} +{{- end -}} + +{{/* + rpk sasl environment variables + + this will return a string with the correct environment variables to use for SASL based on the + version of the redpada container being used +*/}} +{{- define "rpk-sasl-environment-variables" -}} +{{- if (include "redpanda-atleast-23-2-1" . | fromJson).bool -}} +RPK_USER RPK_PASS RPK_SASL_MECHANISM +{{- else -}} +REDPANDA_SASL_USERNAME REDPANDA_SASL_PASSWORD REDPANDA_SASL_MECHANISM +{{- end -}} +{{- end -}} + +{{- define "curl-options" -}} +{{- print " -svm3 --fail --retry \"120\" --retry-max-time \"120\" --retry-all-errors -o - -w \"\\nstatus=%{http_code} %{redirect_url} size=%{size_download} time=%{time_total} content-type=\\\"%{content_type}\\\"\\n\" "}} +{{- end -}} + +{{- define "advertised-address-template" -}} + {{- $prefixTemplate := dig "prefixTemplate" "" .externalListener -}} + {{- if empty $prefixTemplate -}} + {{- $prefixTemplate = dig "prefixTemplate" "" .externalVals -}} + {{- end -}} + {{ quote $prefixTemplate }} +{{- end -}} + +{{/* check if client auth is enabled for any of the listeners */}} +{{- define "client-auth-required" -}} +{{- $requireClientAuth := get ((include "redpanda.ClientAuthRequired" (dict "a" (list .))) | fromJson) "r" }} +{{- toJson (dict "bool" $requireClientAuth) -}} +{{- end -}} diff --git a/charts/redpanda/redpanda/5.9.7/templates/_memory.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_memory.go.tpl new file mode 100644 index 000000000..015a771b4 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_memory.go.tpl @@ -0,0 +1,63 @@ +{{- /* Generated from "memory.go" */ -}} + +{{- define "redpanda.RedpandaReserveMemory" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $rpMem_1 := $values.resources.memory.redpanda -}} +{{- if (and (ne (toJson $rpMem_1) "null") (ne (toJson $rpMem_1.reserveMemory) "null")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" ((div ((get (fromJson (include "_shims.resource_Value" (dict "a" (list $rpMem_1.reserveMemory) ))) "r") | int64) ((mul (1024 | int) (1024 | int)))) | int64)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" ((add (((mulf (((get (fromJson (include "redpanda.ContainerMemory" (dict "a" (list $dot) ))) "r") | int64) | float64) 0.002) | float64) | int64) (200 | int64)) | int64)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RedpandaMemory" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $memory := ((0 | int64) | int64) -}} +{{- $containerMemory := ((get (fromJson (include "redpanda.ContainerMemory" (dict "a" (list $dot) ))) "r") | int64) -}} +{{- $rpMem_2 := $values.resources.memory.redpanda -}} +{{- if (and (ne (toJson $rpMem_2) "null") (ne (toJson $rpMem_2.memory) "null")) -}} +{{- $memory = ((div ((get (fromJson (include "_shims.resource_Value" (dict "a" (list $rpMem_2.memory) ))) "r") | int64) ((mul (1024 | int) (1024 | int)))) | int64) -}} +{{- else -}} +{{- $memory = (((mulf ($containerMemory | float64) 0.8) | float64) | int64) -}} +{{- end -}} +{{- if (eq $memory (0 | int64)) -}} +{{- $_ := (fail "unable to get memory value redpanda-memory") -}} +{{- end -}} +{{- if (lt $memory (256 | int64)) -}} +{{- $_ := (fail (printf "%d is below the minimum value for Redpanda" $memory)) -}} +{{- end -}} +{{- if (gt ((add $memory ((get (fromJson (include "redpanda.RedpandaReserveMemory" (dict "a" (list $dot) ))) "r") | int64)) | int64) $containerMemory) -}} +{{- $_ := (fail (printf "Not enough container memory for Redpanda memory values where Redpanda: %d, reserve: %d, container: %d" $memory ((get (fromJson (include "redpanda.RedpandaReserveMemory" (dict "a" (list $dot) ))) "r") | int64) $containerMemory)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $memory) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.ContainerMemory" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (ne (toJson $values.resources.memory.container.min) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" ((div ((get (fromJson (include "_shims.resource_Value" (dict "a" (list $values.resources.memory.container.min) ))) "r") | int64) ((mul (1024 | int) (1024 | int)))) | int64)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" ((div ((get (fromJson (include "_shims.resource_Value" (dict "a" (list $values.resources.memory.container.max) ))) "r") | int64) ((mul (1024 | int) (1024 | int)))) | int64)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_notes.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_notes.go.tpl new file mode 100644 index 000000000..e547ce092 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_notes.go.tpl @@ -0,0 +1,167 @@ +{{- /* Generated from "notes.go" */ -}} + +{{- define "redpanda.Warnings" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $warnings := (coalesce nil) -}} +{{- $w_1 := (get (fromJson (include "redpanda.cpuWarning" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne $w_1 "") -}} +{{- $warnings = (concat (default (list ) $warnings) (list (printf `**Warning**: %s` $w_1))) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $warnings) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.cpuWarning" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $coresInMillis := ((get (fromJson (include "_shims.resource_MilliValue" (dict "a" (list $values.resources.cpu.cores) ))) "r") | int64) -}} +{{- if (lt $coresInMillis (1000 | int64)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "%dm is below the minimum recommended CPU value for Redpanda" $coresInMillis)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" "") | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Notes" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $anySASL := (get (fromJson (include "redpanda.Auth.IsSASLEnabled" (dict "a" (list $values.auth) ))) "r") -}} +{{- $notes := (coalesce nil) -}} +{{- $notes = (concat (default (list ) $notes) (list `` `` `` `` (printf `Congratulations on installing %s!` $dot.Chart.Name) `` `The pods will rollout in a few seconds. To check the status:` `` (printf ` kubectl -n %s rollout status statefulset %s --watch` $dot.Release.Namespace (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")))) -}} +{{- if (and $values.external.enabled (eq $values.external.type "LoadBalancer")) -}} +{{- $notes = (concat (default (list ) $notes) (list `` `If you are using the load balancer service with a cloud provider, the services will likely have automatically-generated addresses. In this scenario the advertised listeners must be updated in order for external access to work. Run the following command once Redpanda is deployed:` `` (printf ` helm upgrade %s redpanda/redpanda --reuse-values -n %s --set $(kubectl get svc -n %s -o jsonpath='{"external.addresses={"}{ range .items[*]}{.status.loadBalancer.ingress[0].ip }{.status.loadBalancer.ingress[0].hostname}{","}{ end }{"}\n"}')` (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r") $dot.Release.Namespace $dot.Release.Namespace))) -}} +{{- end -}} +{{- $profiles := (keys $values.listeners.kafka.external) -}} +{{- $_ := (sortAlpha $profiles) -}} +{{- $profileName := (index $profiles (0 | int)) -}} +{{- $notes = (concat (default (list ) $notes) (list `` `Set up rpk for access to your external listeners:`)) -}} +{{- $profile := (index $values.listeners.kafka.external $profileName) -}} +{{- if (get (fromJson (include "redpanda.TLSEnabled" (dict "a" (list $dot) ))) "r") -}} +{{- $external := "" -}} +{{- if (and (ne (toJson $profile.tls) "null") (ne (toJson $profile.tls.cert) "null")) -}} +{{- $external = $profile.tls.cert -}} +{{- else -}} +{{- $external = $values.listeners.kafka.tls.cert -}} +{{- end -}} +{{- $notes = (concat (default (list ) $notes) (list (printf ` kubectl get secret -n %s %s-%s-cert -o go-template='{{ index .data "ca.crt" | base64decode }}' > ca.crt` $dot.Release.Namespace (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") $external))) -}} +{{- if (or $values.listeners.kafka.tls.requireClientAuth $values.listeners.admin.tls.requireClientAuth) -}} +{{- $notes = (concat (default (list ) $notes) (list (printf ` kubectl get secret -n %s %s-client -o go-template='{{ index .data "tls.crt" | base64decode }}' > tls.crt` $dot.Release.Namespace (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) (printf ` kubectl get secret -n %s %s-client -o go-template='{{ index .data "tls.key" | base64decode }}' > tls.key` $dot.Release.Namespace (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")))) -}} +{{- end -}} +{{- end -}} +{{- $notes = (concat (default (list ) $notes) (list (printf ` rpk profile create --from-profile <(kubectl get configmap -n %s %s-rpk -o go-template='{{ .data.profile }}') %s` $dot.Release.Namespace (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") $profileName) `` `Set up dns to look up the pods on their Kubernetes Nodes. You can use this query to get the list of short-names to IP addresses. Add your external domain to the hostnames and you could test by adding these to your /etc/hosts:` `` (printf ` kubectl get pod -n %s -o custom-columns=node:.status.hostIP,name:.metadata.name --no-headers -l app.kubernetes.io/name=redpanda,app.kubernetes.io/component=redpanda-statefulset` $dot.Release.Namespace))) -}} +{{- if $anySASL -}} +{{- $notes = (concat (default (list ) $notes) (list `` `Set the credentials in the environment:` `` (printf ` kubectl -n %s get secret %s -o go-template="{{ range .data }}{{ . | base64decode }}{{ end }}" | IFS=: read -r %s` $dot.Release.Namespace $values.auth.sasl.secretRef (get (fromJson (include "redpanda.RpkSASLEnvironmentVariables" (dict "a" (list $dot) ))) "r")) (printf ` export %s` (get (fromJson (include "redpanda.RpkSASLEnvironmentVariables" (dict "a" (list $dot) ))) "r")))) -}} +{{- end -}} +{{- $notes = (concat (default (list ) $notes) (list `` `Try some sample commands:`)) -}} +{{- if $anySASL -}} +{{- $notes = (concat (default (list ) $notes) (list `Create a user:` `` (printf ` %s` (get (fromJson (include "redpanda.RpkACLUserCreate" (dict "a" (list $dot) ))) "r")) `` `Give the user permissions:` `` (printf ` %s` (get (fromJson (include "redpanda.RpkACLCreate" (dict "a" (list $dot) ))) "r")))) -}} +{{- end -}} +{{- $notes = (concat (default (list ) $notes) (list `` `Get the api status:` `` (printf ` %s` (get (fromJson (include "redpanda.RpkClusterInfo" (dict "a" (list $dot) ))) "r")) `` `Create a topic` `` (printf ` %s` (get (fromJson (include "redpanda.RpkTopicCreate" (dict "a" (list $dot) ))) "r")) `` `Describe the topic:` `` (printf ` %s` (get (fromJson (include "redpanda.RpkTopicDescribe" (dict "a" (list $dot) ))) "r")) `` `Delete the topic:` `` (printf ` %s` (get (fromJson (include "redpanda.RpkTopicDelete" (dict "a" (list $dot) ))) "r")))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $notes) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RpkACLUserCreate" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf `rpk acl user create myuser --new-password changeme --mechanism %s` (get (fromJson (include "redpanda.SASLMechanism" (dict "a" (list $dot) ))) "r"))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SASLMechanism" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (ne (toJson $values.auth.sasl) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" $values.auth.sasl.mechanism) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" "SCRAM-SHA-512") | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RpkACLCreate" -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" `rpk acl create --allow-principal 'myuser' --allow-host '*' --operation all --topic 'test-topic'`) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RpkClusterInfo" -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" `rpk cluster info`) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RpkTopicCreate" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf `rpk topic create test-topic -p 3 -r %d` (min (3 | int64) (($values.statefulset.replicas | int) | int64)))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RpkTopicDescribe" -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" `rpk topic describe test-topic`) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RpkTopicDelete" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" `rpk topic delete test-topic`) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RpkSASLEnvironmentVariables" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (get (fromJson (include "redpanda.RedpandaAtLeast_23_2_1" (dict "a" (list $dot) ))) "r") -}} +{{- $_is_returning = true -}} +{{- (dict "r" `RPK_USER RPK_PASS RPK_SASL_MECHANISM`) | toJson -}} +{{- break -}} +{{- else -}} +{{- $_is_returning = true -}} +{{- (dict "r" `REDPANDA_SASL_USERNAME REDPANDA_SASL_PASSWORD REDPANDA_SASL_MECHANISM`) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_poddisruptionbudget.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_poddisruptionbudget.go.tpl new file mode 100644 index 000000000..763b7b0bd --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_poddisruptionbudget.go.tpl @@ -0,0 +1,21 @@ +{{- /* Generated from "poddisruptionbudget.go" */ -}} + +{{- define "redpanda.PodDisruptionBudget" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $budget := ($values.statefulset.budget.maxUnavailable | int) -}} +{{- $minReplicas := ((div ($values.statefulset.replicas | int) (2 | int)) | int) -}} +{{- if (and (gt $budget (1 | int)) (gt $budget $minReplicas)) -}} +{{- $_ := (fail (printf "statefulset.budget.maxUnavailable is set too high to maintain quorum: %d > %d" $budget $minReplicas)) -}} +{{- end -}} +{{- $maxUnavailable := ($budget | int) -}} +{{- $matchLabels := (get (fromJson (include "redpanda.StatefulSetPodLabelsSelector" (dict "a" (list $dot) ))) "r") -}} +{{- $_ := (set $matchLabels "redpanda.com/poddisruptionbudget" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict ) "status" (dict "disruptionsAllowed" 0 "currentHealthy" 0 "desiredHealthy" 0 "expectedPods" 0 ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "policy/v1" "kind" "PodDisruptionBudget" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") )) "spec" (mustMergeOverwrite (dict ) (dict "selector" (mustMergeOverwrite (dict ) (dict "matchLabels" $matchLabels )) "maxUnavailable" $maxUnavailable )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_post-install-upgrade-job.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_post-install-upgrade-job.go.tpl new file mode 100644 index 000000000..f71579edb --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_post-install-upgrade-job.go.tpl @@ -0,0 +1,123 @@ +{{- /* Generated from "post_install_upgrade_job.go" */ -}} + +{{- define "redpanda.bootstrapYamlTemplater" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $env := (get (fromJson (include "redpanda.TieredStorageCredentials.AsEnvVars" (dict "a" (list $values.storage.tiered.credentialsSecretRef (get (fromJson (include "redpanda.Storage.GetTieredStorageConfig" (dict "a" (list $values.storage) ))) "r")) ))) "r") -}} +{{- $image := (printf `%s:%s` $values.statefulset.sideCars.controllers.image.repository $values.statefulset.sideCars.controllers.image.tag) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "name" "" "resources" (dict ) ) (dict "name" "bootstrap-yaml-envsubst" "image" $image "command" (list "/redpanda-operator" "envsubst" "/tmp/base-config/bootstrap.yaml" "--output" "/tmp/config/.bootstrap.yaml") "env" $env "resources" (mustMergeOverwrite (dict ) (dict "limits" (dict "cpu" (get (fromJson (include "_shims.resource_MustParse" (dict "a" (list "100m") ))) "r") "memory" (get (fromJson (include "_shims.resource_MustParse" (dict "a" (list "25Mi") ))) "r") ) "requests" (dict "cpu" (get (fromJson (include "_shims.resource_MustParse" (dict "a" (list "100m") ))) "r") "memory" (get (fromJson (include "_shims.resource_MustParse" (dict "a" (list "25Mi") ))) "r") ) )) "securityContext" (mustMergeOverwrite (dict ) (dict "allowPrivilegeEscalation" false "readOnlyRootFilesystem" true "runAsNonRoot" true )) "volumeMounts" (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "config" "mountPath" "/tmp/config/" )) (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "base-config" "mountPath" "/tmp/base-config/" ))) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.PostInstallUpgradeJob" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.post_install_job.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $image := (printf `%s:%s` $values.statefulset.sideCars.controllers.image.repository $values.statefulset.sideCars.controllers.image.tag) -}} +{{- $job := (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "template" (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "containers" (coalesce nil) ) ) ) "status" (dict ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "batch/v1" "kind" "Job" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (printf "%s-configuration" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) "namespace" $dot.Release.Namespace "labels" (merge (dict ) (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") (default (dict ) $values.post_install_job.labels)) "annotations" (merge (dict ) (dict "helm.sh/hook" "post-install,post-upgrade" "helm.sh/hook-delete-policy" "before-hook-creation" "helm.sh/hook-weight" "-5" ) (default (dict ) $values.post_install_job.annotations)) )) "spec" (mustMergeOverwrite (dict "template" (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "containers" (coalesce nil) ) ) ) (dict "template" (get (fromJson (include "redpanda.StrategicMergePatch" (dict "a" (list $values.post_install_job.podTemplate (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "containers" (coalesce nil) ) ) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "generateName" (printf "%s-post-" $dot.Release.Name) "labels" (merge (dict ) (dict "app.kubernetes.io/name" (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r") "app.kubernetes.io/instance" $dot.Release.Name "app.kubernetes.io/component" (printf "%.50s-post-install" (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r")) ) (default (dict ) $values.commonLabels)) )) "spec" (mustMergeOverwrite (dict "containers" (coalesce nil) ) (dict "nodeSelector" $values.nodeSelector "affinity" (get (fromJson (include "redpanda.postInstallJobAffinity" (dict "a" (list $dot) ))) "r") "tolerations" (get (fromJson (include "redpanda.tolerations" (dict "a" (list $dot) ))) "r") "restartPolicy" "Never" "securityContext" (get (fromJson (include "redpanda.PodSecurityContext" (dict "a" (list $dot) ))) "r") "imagePullSecrets" (default (coalesce nil) $values.imagePullSecrets) "initContainers" (list (get (fromJson (include "redpanda.bootstrapYamlTemplater" (dict "a" (list $dot) ))) "r")) "automountServiceAccountToken" false "containers" (list (mustMergeOverwrite (dict "name" "" "resources" (dict ) ) (dict "name" "post-install" "image" $image "env" (get (fromJson (include "redpanda.PostInstallUpgradeEnvironmentVariables" (dict "a" (list $dot) ))) "r") "command" (list "/redpanda-operator" "sync-cluster-config" "--redpanda-yaml" "/tmp/base-config/redpanda.yaml" "--bootstrap-yaml" "/tmp/config/.bootstrap.yaml") "resources" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.post_install_job.resources (mustMergeOverwrite (dict ) (dict ))) ))) "r") "securityContext" (merge (dict ) (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.post_install_job.securityContext (mustMergeOverwrite (dict ) (dict ))) ))) "r") (get (fromJson (include "redpanda.ContainerSecurityContext" (dict "a" (list $dot) ))) "r")) "volumeMounts" (concat (default (list ) (get (fromJson (include "redpanda.CommonMounts" (dict "a" (list $dot) ))) "r")) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "config" "mountPath" "/tmp/config" )) (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "base-config" "mountPath" "/tmp/base-config" )))) ))) "volumes" (concat (default (list ) (get (fromJson (include "redpanda.CommonVolumes" (dict "a" (list $dot) ))) "r")) (list (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "configMap" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "name" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") )) (dict )) )) (dict "name" "base-config" )) (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "emptyDir" (mustMergeOverwrite (dict ) (dict )) )) (dict "name" "config" )))) "serviceAccountName" (get (fromJson (include "redpanda.ServiceAccountName" (dict "a" (list $dot) ))) "r") )) ))) ))) "r") )) )) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $job) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.postInstallJobAffinity" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not (empty $values.post_install_job.affinity)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $values.post_install_job.affinity) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (merge (dict ) $values.post_install_job.affinity $values.affinity)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.tolerations" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $result := (coalesce nil) -}} +{{- range $_, $t := $values.tolerations -}} +{{- $result = (concat (default (list ) $result) (list (merge (dict ) $t))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.PostInstallUpgradeEnvironmentVariables" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $envars := (list ) -}} +{{- $license_1 := (get (fromJson (include "redpanda.GetLicenseLiteral" (dict "a" (list $dot) ))) "r") -}} +{{- $secretReference_2 := (get (fromJson (include "redpanda.GetLicenseSecretReference" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne $license_1 "") -}} +{{- $envars = (concat (default (list ) $envars) (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "REDPANDA_LICENSE" "value" $license_1 )))) -}} +{{- else -}}{{- if (ne (toJson $secretReference_2) "null") -}} +{{- $envars = (concat (default (list ) $envars) (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "REDPANDA_LICENSE" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" $secretReference_2 )) )))) -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.bootstrapEnvVars" (dict "a" (list $dot $envars) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.GetLicenseLiteral" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (ne $values.enterprise.license "") -}} +{{- $_is_returning = true -}} +{{- (dict "r" $values.enterprise.license) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $values.license_key) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.GetLicenseSecretReference" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not (empty $values.enterprise.licenseSecretRef)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" $values.enterprise.licenseSecretRef.name )) (dict "key" $values.enterprise.licenseSecretRef.key ))) | toJson -}} +{{- break -}} +{{- else -}}{{- if (not (empty $values.license_secret_ref)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" $values.license_secret_ref.secret_name )) (dict "key" $values.license_secret_ref.secret_key ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_post_upgrade_job.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_post_upgrade_job.go.tpl new file mode 100644 index 000000000..6a95bb94e --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_post_upgrade_job.go.tpl @@ -0,0 +1,87 @@ +{{- /* Generated from "post_upgrade_job.go" */ -}} + +{{- define "redpanda.PostUpgrade" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.post_upgrade_job.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $labels := (default (dict ) $values.post_upgrade_job.labels) -}} +{{- $annotations := (default (dict ) $values.post_upgrade_job.annotations) -}} +{{- $annotations = (merge (dict ) (dict "helm.sh/hook" "post-upgrade" "helm.sh/hook-delete-policy" "before-hook-creation" "helm.sh/hook-weight" "-10" ) $annotations) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "template" (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "containers" (coalesce nil) ) ) ) "status" (dict ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "batch/v1" "kind" "Job" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (printf "%s-post-upgrade" (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r")) "namespace" $dot.Release.Namespace "labels" (merge (dict ) (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") $labels) "annotations" $annotations )) "spec" (mustMergeOverwrite (dict "template" (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "containers" (coalesce nil) ) ) ) (dict "backoffLimit" $values.post_upgrade_job.backoffLimit "template" (get (fromJson (include "redpanda.StrategicMergePatch" (dict "a" (list $values.post_upgrade_job.podTemplate (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "containers" (coalesce nil) ) ) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" $dot.Release.Name "labels" (merge (dict ) (dict "app.kubernetes.io/name" (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r") "app.kubernetes.io/instance" $dot.Release.Name "app.kubernetes.io/component" (printf "%s-post-upgrade" (trunc (50 | int) (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r"))) ) $values.commonLabels) )) "spec" (mustMergeOverwrite (dict "containers" (coalesce nil) ) (dict "nodeSelector" $values.nodeSelector "affinity" (merge (dict ) $values.post_upgrade_job.affinity $values.affinity) "tolerations" $values.tolerations "restartPolicy" "Never" "securityContext" (get (fromJson (include "redpanda.PodSecurityContext" (dict "a" (list $dot) ))) "r") "serviceAccountName" (get (fromJson (include "redpanda.ServiceAccountName" (dict "a" (list $dot) ))) "r") "imagePullSecrets" (default (coalesce nil) $values.imagePullSecrets) "containers" (list (mustMergeOverwrite (dict "name" "" "resources" (dict ) ) (dict "name" "post-upgrade" "image" (printf "%s:%s" $values.image.repository (get (fromJson (include "redpanda.Tag" (dict "a" (list $dot) ))) "r")) "command" (list "/bin/bash" "-c") "args" (list (get (fromJson (include "redpanda.PostUpgradeJobScript" (dict "a" (list $dot) ))) "r")) "env" (get (fromJson (include "redpanda.rpkEnvVars" (dict "a" (list $dot $values.post_upgrade_job.extraEnv) ))) "r") "envFrom" $values.post_upgrade_job.extraEnvFrom "securityContext" (merge (dict ) (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.post_upgrade_job.securityContext (mustMergeOverwrite (dict ) (dict ))) ))) "r") (get (fromJson (include "redpanda.ContainerSecurityContext" (dict "a" (list $dot) ))) "r")) "resources" $values.post_upgrade_job.resources "volumeMounts" (get (fromJson (include "redpanda.DefaultMounts" (dict "a" (list $dot) ))) "r") ))) "volumes" (get (fromJson (include "redpanda.DefaultVolumes" (dict "a" (list $dot) ))) "r") )) ))) ))) "r") )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.PostUpgradeJobScript" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $script := (list `set -e` ``) -}} +{{- range $key, $value := $values.config.cluster -}} +{{- $tmp_tuple_1 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.asintegral" (dict "a" (list $value) ))) "r")) ))) "r") -}} +{{- $isInt64 := $tmp_tuple_1.T2 -}} +{{- $asInt64 := ($tmp_tuple_1.T1 | int64) -}} +{{- $tmp_tuple_2 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.typetest" (dict "a" (list "bool" $value false) ))) "r")) ))) "r") -}} +{{- $ok_2 := $tmp_tuple_2.T2 -}} +{{- $asBool_1 := $tmp_tuple_2.T1 -}} +{{- $tmp_tuple_3 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.typetest" (dict "a" (list "string" $value "") ))) "r")) ))) "r") -}} +{{- $ok_4 := $tmp_tuple_3.T2 -}} +{{- $asStr_3 := $tmp_tuple_3.T1 -}} +{{- $tmp_tuple_4 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.typetest" (dict "a" (list (printf "[]%s" "interface {}") $value (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok_6 := $tmp_tuple_4.T2 -}} +{{- $asSlice_5 := $tmp_tuple_4.T1 -}} +{{- if (and $ok_2 $asBool_1) -}} +{{- $script = (concat (default (list ) $script) (list (printf "rpk cluster config set %s %t" $key $asBool_1))) -}} +{{- else -}}{{- if (and $ok_4 (ne $asStr_3 "")) -}} +{{- $script = (concat (default (list ) $script) (list (printf "rpk cluster config set %s %s" $key $asStr_3))) -}} +{{- else -}}{{- if (and $isInt64 (gt $asInt64 (0 | int64))) -}} +{{- $script = (concat (default (list ) $script) (list (printf "rpk cluster config set %s %d" $key $asInt64))) -}} +{{- else -}}{{- if (and $ok_6 (gt ((get (fromJson (include "_shims.len" (dict "a" (list $asSlice_5) ))) "r") | int) (0 | int))) -}} +{{- $script = (concat (default (list ) $script) (list (printf `rpk cluster config set %s "[ %s ]"` $key (join "," $asSlice_5)))) -}} +{{- else -}}{{- if (not (empty $value)) -}} +{{- $script = (concat (default (list ) $script) (list (printf "rpk cluster config set %s %v" $key $value))) -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $tmp_tuple_5 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $values.config.cluster "default_topic_replications" (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok_7 := $tmp_tuple_5.T2 -}} +{{- if (and (not $ok_7) (ge ($values.statefulset.replicas | int) (3 | int))) -}} +{{- $script = (concat (default (list ) $script) (list "rpk cluster config set default_topic_replications 3")) -}} +{{- end -}} +{{- $tmp_tuple_6 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $values.config.cluster "storage_min_free_bytes" (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok_8 := $tmp_tuple_6.T2 -}} +{{- if (not $ok_8) -}} +{{- $script = (concat (default (list ) $script) (list (printf "rpk cluster config set storage_min_free_bytes %d" ((get (fromJson (include "redpanda.Storage.StorageMinFreeBytes" (dict "a" (list $values.storage) ))) "r") | int64)))) -}} +{{- end -}} +{{- if (get (fromJson (include "redpanda.RedpandaAtLeast_23_2_1" (dict "a" (list $dot) ))) "r") -}} +{{- $service := $values.listeners.admin -}} +{{- $caCert := "" -}} +{{- $scheme := "http" -}} +{{- if (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $service.tls $values.tls) ))) "r") -}} +{{- $scheme = "https" -}} +{{- $caCert = (printf "--cacert %q" (get (fromJson (include "redpanda.InternalTLS.ServerCAPath" (dict "a" (list $service.tls $values.tls) ))) "r")) -}} +{{- end -}} +{{- $url := (printf "%s://%s:%d/v1/debug/restart_service?service=schema-registry" $scheme (get (fromJson (include "redpanda.InternalDomain" (dict "a" (list $dot) ))) "r") (($service.port | int) | int64)) -}} +{{- $script = (concat (default (list ) $script) (list `if [ -d "/etc/secrets/users/" ]; then` ` IFS=":" read -r USER_NAME PASSWORD MECHANISM < <(grep "" $(find /etc/secrets/users/* -print))` ` curl -svm3 --fail --retry "120" --retry-max-time "120" --retry-all-errors --ssl-reqd \` (printf ` %s \` $caCert) ` -X PUT -u ${USER_NAME}:${PASSWORD} \` (printf ` %s || true` $url) `fi`)) -}} +{{- end -}} +{{- $script = (concat (default (list ) $script) (list "")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (join "\n" $script)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_rbac.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_rbac.go.tpl new file mode 100644 index 000000000..162092626 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_rbac.go.tpl @@ -0,0 +1,116 @@ +{{- /* Generated from "rbac.go" */ -}} + +{{- define "redpanda.ClusterRoles" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $crs := (coalesce nil) -}} +{{- $cr_1 := (get (fromJson (include "redpanda.SidecarControllersClusterRole" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne (toJson $cr_1) "null") -}} +{{- $crs = (concat (default (list ) $crs) (list $cr_1)) -}} +{{- end -}} +{{- if (not $values.rbac.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $crs) | toJson -}} +{{- break -}} +{{- end -}} +{{- $rpkBundleName := (printf "%s-rpk-bundle" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) -}} +{{- $crs = (concat (default (list ) $crs) (default (list ) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "rules" (coalesce nil) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "ClusterRole" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") "annotations" $values.serviceAccount.annotations )) "rules" (list (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "apiGroups" (list "") "resources" (list "nodes") "verbs" (list "get" "list") ))) )) (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "rules" (coalesce nil) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "ClusterRole" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" $rpkBundleName "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") "annotations" $values.serviceAccount.annotations )) "rules" (list (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "apiGroups" (list "") "resources" (list "configmaps" "endpoints" "events" "limitranges" "persistentvolumeclaims" "pods" "pods/log" "replicationcontrollers" "resourcequotas" "serviceaccounts" "services") "verbs" (list "get" "list") ))) ))))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $crs) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.ClusterRoleBindings" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $crbs := (coalesce nil) -}} +{{- $crb_2 := (get (fromJson (include "redpanda.SidecarControllersClusterRoleBinding" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne (toJson $crb_2) "null") -}} +{{- $crbs = (concat (default (list ) $crbs) (list $crb_2)) -}} +{{- end -}} +{{- if (not $values.rbac.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $crbs) | toJson -}} +{{- break -}} +{{- end -}} +{{- $rpkBundleName := (printf "%s-rpk-bundle" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) -}} +{{- $crbs = (concat (default (list ) $crbs) (default (list ) (list (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "roleRef" (dict "apiGroup" "" "kind" "" "name" "" ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "ClusterRoleBinding" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") "annotations" $values.serviceAccount.annotations )) "roleRef" (mustMergeOverwrite (dict "apiGroup" "" "kind" "" "name" "" ) (dict "apiGroup" "rbac.authorization.k8s.io" "kind" "ClusterRole" "name" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") )) "subjects" (list (mustMergeOverwrite (dict "kind" "" "name" "" ) (dict "kind" "ServiceAccount" "name" (get (fromJson (include "redpanda.ServiceAccountName" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace ))) )) (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "roleRef" (dict "apiGroup" "" "kind" "" "name" "" ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "ClusterRoleBinding" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" $rpkBundleName "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") "annotations" $values.serviceAccount.annotations )) "roleRef" (mustMergeOverwrite (dict "apiGroup" "" "kind" "" "name" "" ) (dict "apiGroup" "rbac.authorization.k8s.io" "kind" "ClusterRole" "name" $rpkBundleName )) "subjects" (list (mustMergeOverwrite (dict "kind" "" "name" "" ) (dict "kind" "ServiceAccount" "name" (get (fromJson (include "redpanda.ServiceAccountName" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace ))) ))))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $crbs) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SidecarControllersClusterRole" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (or (not $values.statefulset.sideCars.controllers.enabled) (not $values.statefulset.sideCars.controllers.createRBAC)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $sidecarControllerName := (printf "%s-sidecar-controllers" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "rules" (coalesce nil) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "ClusterRole" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" $sidecarControllerName "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") "annotations" $values.serviceAccount.annotations )) "rules" (list (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "apiGroups" (list "") "resources" (list "nodes") "verbs" (list "get" "list" "watch") )) (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "apiGroups" (list "") "resources" (list "persistentvolumes") "verbs" (list "delete" "get" "list" "patch" "update" "watch") ))) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SidecarControllersClusterRoleBinding" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (or (not $values.statefulset.sideCars.controllers.enabled) (not $values.statefulset.sideCars.controllers.createRBAC)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $sidecarControllerName := (printf "%s-sidecar-controllers" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "roleRef" (dict "apiGroup" "" "kind" "" "name" "" ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "ClusterRoleBinding" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" $sidecarControllerName "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") "annotations" $values.serviceAccount.annotations )) "roleRef" (mustMergeOverwrite (dict "apiGroup" "" "kind" "" "name" "" ) (dict "apiGroup" "rbac.authorization.k8s.io" "kind" "ClusterRole" "name" $sidecarControllerName )) "subjects" (list (mustMergeOverwrite (dict "kind" "" "name" "" ) (dict "kind" "ServiceAccount" "name" (get (fromJson (include "redpanda.ServiceAccountName" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace ))) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SidecarControllersRole" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (or (not $values.statefulset.sideCars.controllers.enabled) (not $values.statefulset.sideCars.controllers.createRBAC)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $sidecarControllerName := (printf "%s-sidecar-controllers" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "rules" (coalesce nil) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "Role" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" $sidecarControllerName "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") "annotations" $values.serviceAccount.annotations )) "rules" (list (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "apiGroups" (list "apps") "resources" (list "statefulsets/status") "verbs" (list "patch" "update") )) (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "apiGroups" (list "") "resources" (list "secrets" "pods") "verbs" (list "get" "list" "watch") )) (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "apiGroups" (list "apps") "resources" (list "statefulsets") "verbs" (list "get" "patch" "update" "list" "watch") )) (mustMergeOverwrite (dict "verbs" (coalesce nil) ) (dict "apiGroups" (list "") "resources" (list "persistentvolumeclaims") "verbs" (list "delete" "get" "list" "patch" "update" "watch") ))) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SidecarControllersRoleBinding" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (or (not $values.statefulset.sideCars.controllers.enabled) (not $values.statefulset.sideCars.controllers.createRBAC)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $sidecarControllerName := (printf "%s-sidecar-controllers" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "roleRef" (dict "apiGroup" "" "kind" "" "name" "" ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "rbac.authorization.k8s.io/v1" "kind" "RoleBinding" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" $sidecarControllerName "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") "annotations" $values.serviceAccount.annotations )) "roleRef" (mustMergeOverwrite (dict "apiGroup" "" "kind" "" "name" "" ) (dict "apiGroup" "rbac.authorization.k8s.io" "kind" "Role" "name" $sidecarControllerName )) "subjects" (list (mustMergeOverwrite (dict "kind" "" "name" "" ) (dict "kind" "ServiceAccount" "name" (get (fromJson (include "redpanda.ServiceAccountName" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace ))) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_secrets.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_secrets.go.tpl new file mode 100644 index 000000000..5b91c2ce6 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_secrets.go.tpl @@ -0,0 +1,419 @@ +{{- /* Generated from "secrets.go" */ -}} + +{{- define "redpanda.Secrets" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $secrets := (coalesce nil) -}} +{{- $secrets = (concat (default (list ) $secrets) (list (get (fromJson (include "redpanda.SecretSTSLifecycle" (dict "a" (list $dot) ))) "r"))) -}} +{{- $saslUsers_1 := (get (fromJson (include "redpanda.SecretSASLUsers" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne (toJson $saslUsers_1) "null") -}} +{{- $secrets = (concat (default (list ) $secrets) (list $saslUsers_1)) -}} +{{- end -}} +{{- $configWatcher_2 := (get (fromJson (include "redpanda.SecretConfigWatcher" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne (toJson $configWatcher_2) "null") -}} +{{- $secrets = (concat (default (list ) $secrets) (list $configWatcher_2)) -}} +{{- end -}} +{{- $secrets = (concat (default (list ) $secrets) (list (get (fromJson (include "redpanda.SecretConfigurator" (dict "a" (list $dot) ))) "r"))) -}} +{{- $fsValidator_3 := (get (fromJson (include "redpanda.SecretFSValidator" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne (toJson $fsValidator_3) "null") -}} +{{- $secrets = (concat (default (list ) $secrets) (list $fsValidator_3)) -}} +{{- end -}} +{{- $bootstrapUser_4 := (get (fromJson (include "redpanda.SecretBootstrapUser" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne (toJson $bootstrapUser_4) "null") -}} +{{- $secrets = (concat (default (list ) $secrets) (list $bootstrapUser_4)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $secrets) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SecretSTSLifecycle" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $secret := (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "Secret" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (printf "%s-sts-lifecycle" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") )) "type" "Opaque" "stringData" (dict ) )) -}} +{{- $adminCurlFlags := (get (fromJson (include "redpanda.adminTLSCurlFlags" (dict "a" (list $dot) ))) "r") -}} +{{- $_ := (set $secret.stringData "common.sh" (join "\n" (list `#!/usr/bin/env bash` `` `# the SERVICE_NAME comes from the metadata.name of the pod, essentially the POD_NAME` (printf `CURL_URL="%s"` (get (fromJson (include "redpanda.adminInternalURL" (dict "a" (list $dot) ))) "r")) `` `# commands used throughout` (printf `CURL_NODE_ID_CMD="curl --silent --fail %s ${CURL_URL}/v1/node_config"` $adminCurlFlags) `` `CURL_MAINTENANCE_DELETE_CMD_PREFIX='curl -X DELETE --silent -o /dev/null -w "%{http_code}"'` `CURL_MAINTENANCE_PUT_CMD_PREFIX='curl -X PUT --silent -o /dev/null -w "%{http_code}"'` (printf `CURL_MAINTENANCE_GET_CMD="curl -X GET --silent %s ${CURL_URL}/v1/maintenance"` $adminCurlFlags)))) -}} +{{- $postStartSh := (list `#!/usr/bin/env bash` `# This code should be similar if not exactly the same as that found in the panda-operator, see` `# https://github.com/redpanda-data/redpanda/blob/e51d5b7f2ef76d5160ca01b8c7a8cf07593d29b6/src/go/k8s/pkg/resources/secret.go` `` `# path below should match the path defined on the statefulset` `source /var/lifecycle/common.sh` `` `postStartHook () {` ` set -x` `` ` touch /tmp/postStartHookStarted` `` ` until NODE_ID=$(${CURL_NODE_ID_CMD} | grep -o '\"node_id\":[^,}]*' | grep -o '[^: ]*$'); do` ` sleep 0.5` ` done` `` ` echo "Clearing maintenance mode on node ${NODE_ID}"` (printf ` CURL_MAINTENANCE_DELETE_CMD="${CURL_MAINTENANCE_DELETE_CMD_PREFIX} %s ${CURL_URL}/v1/brokers/${NODE_ID}/maintenance"` $adminCurlFlags) ` # a 400 here would mean not in maintenance mode` ` until [ "${status:-}" = '"200"' ] || [ "${status:-}" = '"400"' ]; do` ` status=$(${CURL_MAINTENANCE_DELETE_CMD})` ` sleep 0.5` ` done` `` ` touch /tmp/postStartHookFinished` `}` `` `postStartHook` `true`) -}} +{{- $_ := (set $secret.stringData "postStart.sh" (join "\n" $postStartSh)) -}} +{{- $preStopSh := (list `#!/usr/bin/env bash` `# This code should be similar if not exactly the same as that found in the panda-operator, see` `# https://github.com/redpanda-data/redpanda/blob/e51d5b7f2ef76d5160ca01b8c7a8cf07593d29b6/src/go/k8s/pkg/resources/secret.go` `` `touch /tmp/preStopHookStarted` `` `# path below should match the path defined on the statefulset` `source /var/lifecycle/common.sh` `` `set -x` `` `preStopHook () {` ` until NODE_ID=$(${CURL_NODE_ID_CMD} | grep -o '\"node_id\":[^,}]*' | grep -o '[^: ]*$'); do` ` sleep 0.5` ` done` `` ` echo "Setting maintenance mode on node ${NODE_ID}"` (printf ` CURL_MAINTENANCE_PUT_CMD="${CURL_MAINTENANCE_PUT_CMD_PREFIX} %s ${CURL_URL}/v1/brokers/${NODE_ID}/maintenance"` $adminCurlFlags) ` until [ "${status:-}" = '"200"' ]; do` ` status=$(${CURL_MAINTENANCE_PUT_CMD})` ` sleep 0.5` ` done` `` ` until [ "${finished:-}" = "true" ] || [ "${draining:-}" = "false" ]; do` ` res=$(${CURL_MAINTENANCE_GET_CMD})` ` finished=$(echo $res | grep -o '\"finished\":[^,}]*' | grep -o '[^: ]*$')` ` draining=$(echo $res | grep -o '\"draining\":[^,}]*' | grep -o '[^: ]*$')` ` sleep 0.5` ` done` `` ` touch /tmp/preStopHookFinished` `}`) -}} +{{- if (and (gt ($values.statefulset.replicas | int) (2 | int)) (not (get (fromJson (include "_shims.typeassertion" (dict "a" (list "bool" (dig "recovery_mode_enabled" false $values.config.node)) ))) "r"))) -}} +{{- $preStopSh = (concat (default (list ) $preStopSh) (list `preStopHook`)) -}} +{{- else -}} +{{- $preStopSh = (concat (default (list ) $preStopSh) (list `touch /tmp/preStopHookFinished` `echo "Not enough replicas or in recovery mode, cannot put a broker into maintenance mode."`)) -}} +{{- end -}} +{{- $preStopSh = (concat (default (list ) $preStopSh) (list `true`)) -}} +{{- $_ := (set $secret.stringData "preStop.sh" (join "\n" $preStopSh)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $secret) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SecretSASLUsers" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (and (and (ne $values.auth.sasl.secretRef "") $values.auth.sasl.enabled) (gt ((get (fromJson (include "_shims.len" (dict "a" (list $values.auth.sasl.users) ))) "r") | int) (0 | int))) -}} +{{- $secret := (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "Secret" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" $values.auth.sasl.secretRef "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") )) "type" "Opaque" "stringData" (dict ) )) -}} +{{- $usersTxt := (list ) -}} +{{- range $_, $user := $values.auth.sasl.users -}} +{{- if (empty $user.mechanism) -}} +{{- $usersTxt = (concat (default (list ) $usersTxt) (list (printf "%s:%s" $user.name $user.password))) -}} +{{- else -}} +{{- $usersTxt = (concat (default (list ) $usersTxt) (list (printf "%s:%s:%s" $user.name $user.password $user.mechanism))) -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_ := (set $secret.stringData "users.txt" (join "\n" $usersTxt)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $secret) | toJson -}} +{{- break -}} +{{- else -}}{{- if (and $values.auth.sasl.enabled (eq $values.auth.sasl.secretRef "")) -}} +{{- $_ := (fail "auth.sasl.secretRef cannot be empty when auth.sasl.enabled=true") -}} +{{- else -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SecretBootstrapUser" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (or (not $values.auth.sasl.enabled) (ne (toJson $values.auth.sasl.bootstrapUser.secretKeyRef) "null")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $secretName := (printf "%s-bootstrap-user" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) -}} +{{- if $dot.Release.IsUpgrade -}} +{{- $tmp_tuple_1 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.lookup" (dict "a" (list "v1" "Secret" $dot.Release.Namespace $secretName) ))) "r")) ))) "r") -}} +{{- $ok_6 := $tmp_tuple_1.T2 -}} +{{- $existing_5 := $tmp_tuple_1.T1 -}} +{{- if $ok_6 -}} +{{- $_is_returning = true -}} +{{- (dict "r" $existing_5) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- $password := (randAlphaNum (32 | int)) -}} +{{- $userPassword := $values.auth.sasl.bootstrapUser.password -}} +{{- if (ne (toJson $userPassword) "null") -}} +{{- $password = $userPassword -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "Secret" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" $secretName "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") )) "type" "Opaque" "stringData" (dict "password" $password ) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SecretConfigWatcher" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.statefulset.sideCars.configWatcher.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $bootstrapUser := (get (fromJson (include "redpanda.BootstrapUser.Username" (dict "a" (list $values.auth.sasl.bootstrapUser) ))) "r") -}} +{{- $sasl := $values.auth.sasl -}} +{{- $secret := (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "Secret" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (printf "%s-config-watcher" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") )) "type" "Opaque" "stringData" (dict ) )) -}} +{{- $saslUserSh := (coalesce nil) -}} +{{- $saslUserSh = (concat (default (list ) $saslUserSh) (list `#!/usr/bin/env bash` `` `trap 'error_handler $? $LINENO' ERR` `` `error_handler() {` ` echo "Error: ($1) occurred at line $2"` `}` `` `set -e` `` `# rpk cluster health can exit non-zero if it's unable to dial brokers. This` `# can happen for many reasons but we never want this script to crash as it` `# would take down yet another broker and make a bad situation worse.` `# Instead, just wait for the command to eventually exit zero.` `echo "Waiting for cluster to be ready"` `until rpk cluster health --watch --exit-when-healthy; do` ` echo "rpk cluster health failed. Waiting 5 seconds before trying again..."` ` sleep 5` `done`)) -}} +{{- if (and $sasl.enabled (ne $sasl.secretRef "")) -}} +{{- $saslUserSh = (concat (default (list ) $saslUserSh) (list `while true; do` ` echo "RUNNING: Monitoring and Updating SASL users"` ` USERS_DIR="/etc/secrets/users"` `` ` new_users_list(){` ` LIST=$1` ` NEW_USER=$2` ` if [[ -n "${LIST}" ]]; then` ` LIST="${NEW_USER},${LIST}"` ` else` ` LIST="${NEW_USER}"` ` fi` `` ` echo "${LIST}"` ` }` `` ` process_users() {` ` USERS_DIR=${1-"/etc/secrets/users"}` ` USERS_FILE=$(find ${USERS_DIR}/* -print)` (printf ` USERS_LIST="%s"` $bootstrapUser) ` READ_LIST_SUCCESS=0` ` # Read line by line, handle a missing EOL at the end of file` ` while read p || [ -n "$p" ] ; do` ` IFS=":" read -r USER_NAME PASSWORD MECHANISM <<< $p` ` # Do not process empty lines` ` if [ -z "$USER_NAME" ]; then` ` continue` ` fi` ` if [[ "${USER_NAME// /}" != "$USER_NAME" ]]; then` ` continue` ` fi` ` echo "Creating user ${USER_NAME}..."` (printf ` MECHANISM=${MECHANISM:-%s}` (dig "auth" "sasl" "mechanism" "SCRAM-SHA-512" $dot.Values.AsMap)) ` creation_result=$(rpk acl user create ${USER_NAME} -p ${PASSWORD} --mechanism ${MECHANISM} 2>&1) && creation_result_exit_code=$? || creation_result_exit_code=$? # On a non-success exit code` ` if [[ $creation_result_exit_code -ne 0 ]]; then` ` # Check if the stderr contains "User already exists"` ` # this error occurs when password has changed` ` if [[ $creation_result == *"User already exists"* ]]; then` ` echo "Update user ${USER_NAME}"` ` # we will try to update by first deleting` ` deletion_result=$(rpk acl user delete ${USER_NAME} 2>&1) && deletion_result_exit_code=$? || deletion_result_exit_code=$?` ` if [[ $deletion_result_exit_code -ne 0 ]]; then` ` echo "deletion of user ${USER_NAME} failed: ${deletion_result}"` ` READ_LIST_SUCCESS=1` ` break` ` fi` ` # Now we update the user` ` update_result=$(rpk acl user create ${USER_NAME} -p ${PASSWORD} --mechanism ${MECHANISM} 2>&1) && update_result_exit_code=$? || update_result_exit_code=$? # On a non-success exit code` ` if [[ $update_result_exit_code -ne 0 ]]; then` ` echo "updating user ${USER_NAME} failed: ${update_result}"` ` READ_LIST_SUCCESS=1` ` break` ` else` ` echo "Updated user ${USER_NAME}..."` ` USERS_LIST=$(new_users_list "${USERS_LIST}" "${USER_NAME}")` ` fi` ` else` ` # Another error occurred, so output the original message and exit code` ` echo "error creating user ${USER_NAME}: ${creation_result}"` ` READ_LIST_SUCCESS=1` ` break` ` fi` ` # On a success, the user was created so output that` ` else` ` echo "Created user ${USER_NAME}..."` ` USERS_LIST=$(new_users_list "${USERS_LIST}" "${USER_NAME}")` ` fi` ` done < $USERS_FILE` `` ` if [[ -n "${USERS_LIST}" && ${READ_LIST_SUCCESS} ]]; then` ` echo "Setting superusers configurations with users [${USERS_LIST}]"` ` superuser_result=$(rpk cluster config set superusers [${USERS_LIST}] 2>&1) && superuser_result_exit_code=$? || superuser_result_exit_code=$?` ` if [[ $superuser_result_exit_code -ne 0 ]]; then` ` echo "Setting superusers configurations failed: ${superuser_result}"` ` else` ` echo "Completed setting superusers configurations"` ` fi` ` fi` ` }` `` ` # before we do anything ensure we have the bootstrap user` ` echo "Ensuring bootstrap user ${RPK_USER}..."` ` creation_result=$(rpk acl user create ${RPK_USER} -p ${RPK_PASS} --mechanism ${RPK_SASL_MECHANISM} 2>&1) && creation_result_exit_code=$? || creation_result_exit_code=$? # On a non-success exit code` ` if [[ $creation_result_exit_code -ne 0 ]]; then` ` if [[ $creation_result == *"User already exists"* ]]; then` ` echo "Bootstrap user already created"` ` else` ` echo "error creating user ${RPK_USER}: ${creation_result}"` ` fi` ` fi` `` ` # first time processing` ` process_users $USERS_DIR` `` ` # subsequent changes detected here` ` # watching delete_self as documented in https://ahmet.im/blog/kubernetes-inotify/` ` USERS_FILE=$(find ${USERS_DIR}/* -print)` ` while RES=$(inotifywait -q -e delete_self ${USERS_FILE}); do` ` process_users $USERS_DIR` ` done` `done`)) -}} +{{- else -}} +{{- $saslUserSh = (concat (default (list ) $saslUserSh) (list `echo "Nothing to do. Sleeping..."` `sleep infinity`)) -}} +{{- end -}} +{{- $_ := (set $secret.stringData "sasl-user.sh" (join "\n" $saslUserSh)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $secret) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SecretFSValidator" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.statefulset.initContainers.fsValidator.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $secret := (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "Secret" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (printf "%s-fs-validator" (substr 0 (49 | int) (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r"))) "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") )) "type" "Opaque" "stringData" (dict ) )) -}} +{{- $_ := (set $secret.stringData "fsValidator.sh" `set -e +EXPECTED_FS_TYPE=$1 + +DATA_DIR="/var/lib/redpanda/data" +TEST_FILE="testfile" + +echo "checking data directory exist..." +if [ ! -d "${DATA_DIR}" ]; then + echo "data directory does not exists, exiting" + exit 1 +fi + +echo "checking filesystem type..." +FS_TYPE=$(df -T $DATA_DIR | tail -n +2 | awk '{print $2}') + +if [ "${FS_TYPE}" != "${EXPECTED_FS_TYPE}" ]; then + echo "file system found to be ${FS_TYPE} when expected ${EXPECTED_FS_TYPE}" + exit 1 +fi + +echo "checking if able to create a test file..." + +touch ${DATA_DIR}/${TEST_FILE} +result=$(touch ${DATA_DIR}/${TEST_FILE} 2> /dev/null; echo $?) +if [ "${result}" != "0" ]; then + echo "could not write testfile, may not have write permission" + exit 1 +fi + +echo "checking if able to delete a test file..." + +result=$(rm ${DATA_DIR}/${TEST_FILE} 2> /dev/null; echo $?) +if [ "${result}" != "0" ]; then + echo "could not delete testfile" + exit 1 +fi + +echo "passed"`) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $secret) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SecretConfigurator" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $secret := (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "Secret" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (printf "%.51s-configurator" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") )) "type" "Opaque" "stringData" (dict ) )) -}} +{{- $configuratorSh := (list ) -}} +{{- $configuratorSh = (concat (default (list ) $configuratorSh) (list `set -xe` `SERVICE_NAME=$1` `KUBERNETES_NODE_NAME=$2` `POD_ORDINAL=${SERVICE_NAME##*-}` "BROKER_INDEX=`expr $POD_ORDINAL + 1`" `` `CONFIG=/etc/redpanda/redpanda.yaml` `` `# Setup config files` `cp /tmp/base-config/redpanda.yaml "${CONFIG}"`)) -}} +{{- if (not (get (fromJson (include "redpanda.RedpandaAtLeast_22_3_0" (dict "a" (list $dot) ))) "r")) -}} +{{- $configuratorSh = (concat (default (list ) $configuratorSh) (list `` `# Configure bootstrap` `## Not used for Redpanda v22.3.0+` `rpk --config "${CONFIG}" redpanda config set redpanda.node_id "${POD_ORDINAL}"` `if [ "${POD_ORDINAL}" = "0" ]; then` ` rpk --config "${CONFIG}" redpanda config set redpanda.seed_servers '[]' --format yaml` `fi`)) -}} +{{- end -}} +{{- $kafkaSnippet := (get (fromJson (include "redpanda.secretConfiguratorKafkaConfig" (dict "a" (list $dot) ))) "r") -}} +{{- $configuratorSh = (concat (default (list ) $configuratorSh) (default (list ) $kafkaSnippet)) -}} +{{- $httpSnippet := (get (fromJson (include "redpanda.secretConfiguratorHTTPConfig" (dict "a" (list $dot) ))) "r") -}} +{{- $configuratorSh = (concat (default (list ) $configuratorSh) (default (list ) $httpSnippet)) -}} +{{- if (and (get (fromJson (include "redpanda.RedpandaAtLeast_22_3_0" (dict "a" (list $dot) ))) "r") $values.rackAwareness.enabled) -}} +{{- $configuratorSh = (concat (default (list ) $configuratorSh) (list `` `# Configure Rack Awareness` `set +x` (printf `RACK=$(curl --silent --cacert /run/secrets/kubernetes.io/serviceaccount/ca.crt --fail -H 'Authorization: Bearer '$(cat /run/secrets/kubernetes.io/serviceaccount/token) "https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT_HTTPS}/api/v1/nodes/${KUBERNETES_NODE_NAME}?pretty=true" | grep %s | grep -v '\"key\":' | sed 's/.*": "\([^"]\+\).*/\1/')` (squote (quote $values.rackAwareness.nodeAnnotation))) `set -x` `rpk --config "$CONFIG" redpanda config set redpanda.rack "${RACK}"`)) -}} +{{- end -}} +{{- $_ := (set $secret.stringData "configurator.sh" (join "\n" $configuratorSh)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $secret) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.secretConfiguratorKafkaConfig" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $internalAdvertiseAddress := (printf "%s.%s" "${SERVICE_NAME}" (get (fromJson (include "redpanda.InternalDomain" (dict "a" (list $dot) ))) "r")) -}} +{{- $snippet := (coalesce nil) -}} +{{- $listenerName := "kafka" -}} +{{- $listenerAdvertisedName := $listenerName -}} +{{- $redpandaConfigPart := "redpanda" -}} +{{- $snippet = (concat (default (list ) $snippet) (list `` (printf `LISTENER=%s` (quote (toJson (dict "name" "internal" "address" $internalAdvertiseAddress "port" ($values.listeners.kafka.port | int) )))) (printf `rpk redpanda config --config "$CONFIG" set %s.advertised_%s_api[0] "$LISTENER"` $redpandaConfigPart $listenerAdvertisedName))) -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $values.listeners.kafka.external) ))) "r") | int) (0 | int)) -}} +{{- $externalCounter := (0 | int) -}} +{{- range $externalName, $externalVals := $values.listeners.kafka.external -}} +{{- $externalCounter = ((add $externalCounter (1 | int)) | int) -}} +{{- $snippet = (concat (default (list ) $snippet) (list `` (printf `ADVERTISED_%s_ADDRESSES=()` (upper $listenerName)))) -}} +{{- range $_, $replicaIndex := (until (($values.statefulset.replicas | int) | int)) -}} +{{- $port := ($externalVals.port | int) -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $externalVals.advertisedPorts) ))) "r") | int) (0 | int)) -}} +{{- if (eq ((get (fromJson (include "_shims.len" (dict "a" (list $externalVals.advertisedPorts) ))) "r") | int) (1 | int)) -}} +{{- $port = (index $externalVals.advertisedPorts (0 | int)) -}} +{{- else -}} +{{- $port = (index $externalVals.advertisedPorts $replicaIndex) -}} +{{- end -}} +{{- end -}} +{{- $host := (get (fromJson (include "redpanda.advertisedHostJSON" (dict "a" (list $dot $externalName $port $replicaIndex) ))) "r") -}} +{{- $address := (toJson $host) -}} +{{- $prefixTemplate := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $externalVals.prefixTemplate "") ))) "r") -}} +{{- if (eq $prefixTemplate "") -}} +{{- $prefixTemplate = (default "" $values.external.prefixTemplate) -}} +{{- end -}} +{{- $snippet = (concat (default (list ) $snippet) (list `` (printf `PREFIX_TEMPLATE=%s` (quote $prefixTemplate)) (printf `ADVERTISED_%s_ADDRESSES+=(%s)` (upper $listenerName) (quote $address)))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $snippet = (concat (default (list ) $snippet) (list `` (printf `rpk redpanda config --config "$CONFIG" set %s.advertised_%s_api[%d] "${ADVERTISED_%s_ADDRESSES[$POD_ORDINAL]}"` $redpandaConfigPart $listenerAdvertisedName $externalCounter (upper $listenerName)))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $snippet) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.secretConfiguratorHTTPConfig" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $internalAdvertiseAddress := (printf "%s.%s" "${SERVICE_NAME}" (get (fromJson (include "redpanda.InternalDomain" (dict "a" (list $dot) ))) "r")) -}} +{{- $snippet := (coalesce nil) -}} +{{- $listenerName := "http" -}} +{{- $listenerAdvertisedName := "pandaproxy" -}} +{{- $redpandaConfigPart := "pandaproxy" -}} +{{- $snippet = (concat (default (list ) $snippet) (list `` (printf `LISTENER=%s` (quote (toJson (dict "name" "internal" "address" $internalAdvertiseAddress "port" ($values.listeners.http.port | int) )))) (printf `rpk redpanda config --config "$CONFIG" set %s.advertised_%s_api[0] "$LISTENER"` $redpandaConfigPart $listenerAdvertisedName))) -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $values.listeners.http.external) ))) "r") | int) (0 | int)) -}} +{{- $externalCounter := (0 | int) -}} +{{- range $externalName, $externalVals := $values.listeners.http.external -}} +{{- $externalCounter = ((add $externalCounter (1 | int)) | int) -}} +{{- $snippet = (concat (default (list ) $snippet) (list `` (printf `ADVERTISED_%s_ADDRESSES=()` (upper $listenerName)))) -}} +{{- range $_, $replicaIndex := (until (($values.statefulset.replicas | int) | int)) -}} +{{- $port := ($externalVals.port | int) -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $externalVals.advertisedPorts) ))) "r") | int) (0 | int)) -}} +{{- if (eq ((get (fromJson (include "_shims.len" (dict "a" (list $externalVals.advertisedPorts) ))) "r") | int) (1 | int)) -}} +{{- $port = (index $externalVals.advertisedPorts (0 | int)) -}} +{{- else -}} +{{- $port = (index $externalVals.advertisedPorts $replicaIndex) -}} +{{- end -}} +{{- end -}} +{{- $host := (get (fromJson (include "redpanda.advertisedHostJSON" (dict "a" (list $dot $externalName $port $replicaIndex) ))) "r") -}} +{{- $address := (toJson $host) -}} +{{- $prefixTemplate := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $externalVals.prefixTemplate "") ))) "r") -}} +{{- if (eq $prefixTemplate "") -}} +{{- $prefixTemplate = (default "" $values.external.prefixTemplate) -}} +{{- end -}} +{{- $snippet = (concat (default (list ) $snippet) (list `` (printf `PREFIX_TEMPLATE=%s` (quote $prefixTemplate)) (printf `ADVERTISED_%s_ADDRESSES+=(%s)` (upper $listenerName) (quote $address)))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $snippet = (concat (default (list ) $snippet) (list `` (printf `rpk redpanda config --config "$CONFIG" set %s.advertised_%s_api[%d] "${ADVERTISED_%s_ADDRESSES[$POD_ORDINAL]}"` $redpandaConfigPart $listenerAdvertisedName $externalCounter (upper $listenerName)))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $snippet) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.adminTLSCurlFlags" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $values.listeners.admin.tls $values.tls) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" "") | toJson -}} +{{- break -}} +{{- end -}} +{{- if $values.listeners.admin.tls.requireClientAuth -}} +{{- $path := (printf "/etc/tls/certs/%s-client" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "--cacert %s/ca.crt --cert %s/tls.crt --key %s/tls.key" $path $path $path)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $path := (get (fromJson (include "redpanda.InternalTLS.ServerCAPath" (dict "a" (list $values.listeners.admin.tls $values.tls) ))) "r") -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "--cacert %s" $path)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.externalAdvertiseAddress" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $eaa := "${SERVICE_NAME}" -}} +{{- $externalDomainTemplate := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.external.domain "") ))) "r") -}} +{{- $expanded := (tpl $externalDomainTemplate $dot) -}} +{{- if (not (empty $expanded)) -}} +{{- $eaa = (printf "%s.%s" "${SERVICE_NAME}" $expanded) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $eaa) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.advertisedHostJSON" -}} +{{- $dot := (index .a 0) -}} +{{- $externalName := (index .a 1) -}} +{{- $port := (index .a 2) -}} +{{- $replicaIndex := (index .a 3) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $host := (dict "name" $externalName "address" (get (fromJson (include "redpanda.externalAdvertiseAddress" (dict "a" (list $dot) ))) "r") "port" $port ) -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $values.external.addresses) ))) "r") | int) (0 | int)) -}} +{{- $address := "" -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $values.external.addresses) ))) "r") | int) (1 | int)) -}} +{{- $address = (index $values.external.addresses $replicaIndex) -}} +{{- else -}} +{{- $address = (index $values.external.addresses (0 | int)) -}} +{{- end -}} +{{- $domain_7 := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.external.domain "") ))) "r") -}} +{{- if (ne $domain_7 "") -}} +{{- $host = (dict "name" $externalName "address" (printf "%s.%s" $address $domain_7) "port" $port ) -}} +{{- else -}} +{{- $host = (dict "name" $externalName "address" $address "port" $port ) -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $host) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.adminInternalHTTPProtocol" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $values.listeners.admin.tls $values.tls) ))) "r") -}} +{{- $_is_returning = true -}} +{{- (dict "r" "https") | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" "http") | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.adminInternalURL" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "%s://%s.%s.%s.svc.%s:%d" (get (fromJson (include "redpanda.adminInternalHTTPProtocol" (dict "a" (list $dot) ))) "r") `${SERVICE_NAME}` (get (fromJson (include "redpanda.ServiceName" (dict "a" (list $dot) ))) "r") $dot.Release.Namespace (trimSuffix "." $values.clusterDomain) ($values.listeners.admin.port | int))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_service.internal.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_service.internal.go.tpl new file mode 100644 index 000000000..0719ec5fa --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_service.internal.go.tpl @@ -0,0 +1,38 @@ +{{- /* Generated from "service_internal.go" */ -}} + +{{- define "redpanda.MonitoringEnabledLabel" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $_is_returning = true -}} +{{- (dict "r" (dict "monitoring.redpanda.com/enabled" (printf "%t" $values.monitoring.enabled) )) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.ServiceInternal" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $ports := (list ) -}} +{{- $ports = (concat (default (list ) $ports) (list (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" "admin" "protocol" "TCP" "appProtocol" $values.listeners.admin.appProtocol "port" ($values.listeners.admin.port | int) "targetPort" ($values.listeners.admin.port | int) )))) -}} +{{- if $values.listeners.http.enabled -}} +{{- $ports = (concat (default (list ) $ports) (list (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" "http" "protocol" "TCP" "port" ($values.listeners.http.port | int) "targetPort" ($values.listeners.http.port | int) )))) -}} +{{- end -}} +{{- $ports = (concat (default (list ) $ports) (list (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" "kafka" "protocol" "TCP" "port" ($values.listeners.kafka.port | int) "targetPort" ($values.listeners.kafka.port | int) )))) -}} +{{- $ports = (concat (default (list ) $ports) (list (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" "rpc" "protocol" "TCP" "port" ($values.listeners.rpc.port | int) "targetPort" ($values.listeners.rpc.port | int) )))) -}} +{{- if $values.listeners.schemaRegistry.enabled -}} +{{- $ports = (concat (default (list ) $ports) (list (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" "schemaregistry" "protocol" "TCP" "port" ($values.listeners.schemaRegistry.port | int) "targetPort" ($values.listeners.schemaRegistry.port | int) )))) -}} +{{- end -}} +{{- $annotations := (dict ) -}} +{{- if (ne (toJson $values.service) "null") -}} +{{- $annotations = $values.service.internal.annotations -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict ) "status" (dict "loadBalancer" (dict ) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "Service" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "redpanda.ServiceName" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace "labels" (merge (dict ) (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.MonitoringEnabledLabel" (dict "a" (list $dot) ))) "r")) "annotations" $annotations )) "spec" (mustMergeOverwrite (dict ) (dict "type" "ClusterIP" "publishNotReadyAddresses" true "clusterIP" "None" "selector" (get (fromJson (include "redpanda.StatefulSetPodLabelsSelector" (dict "a" (list $dot) ))) "r") "ports" $ports )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_service.loadbalancer.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_service.loadbalancer.go.tpl new file mode 100644 index 000000000..dbc754750 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_service.loadbalancer.go.tpl @@ -0,0 +1,101 @@ +{{- /* Generated from "service.loadbalancer.go" */ -}} + +{{- define "redpanda.LoadBalancerServices" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (or (not $values.external.enabled) (not $values.external.service.enabled)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (ne $values.external.type "LoadBalancer") -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $externalDNS := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.external.externalDns (mustMergeOverwrite (dict "enabled" false ) (dict ))) ))) "r") -}} +{{- $labels := (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") -}} +{{- $_ := (set $labels "repdanda.com/type" "loadbalancer") -}} +{{- $selector := (get (fromJson (include "redpanda.StatefulSetPodLabelsSelector" (dict "a" (list $dot) ))) "r") -}} +{{- $services := (coalesce nil) -}} +{{- $replicas := ($values.statefulset.replicas | int) -}} +{{- range $_, $i := untilStep (((0 | int) | int)|int) (($values.statefulset.replicas | int)|int) (1|int) -}} +{{- $podname := (printf "%s-%d" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") $i) -}} +{{- $annotations := (dict ) -}} +{{- range $k, $v := $values.external.annotations -}} +{{- $_ := (set $annotations $k $v) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- if $externalDNS.enabled -}} +{{- $prefix := $podname -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $values.external.addresses) ))) "r") | int) ($i | int)) -}} +{{- $prefix = (index $values.external.addresses $i) -}} +{{- end -}} +{{- $address := (printf "%s.%s" $prefix (tpl $values.external.domain $dot)) -}} +{{- $_ := (set $annotations "external-dns.alpha.kubernetes.io/hostname" $address) -}} +{{- end -}} +{{- $podSelector := (dict ) -}} +{{- range $k, $v := $selector -}} +{{- $_ := (set $podSelector $k $v) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_ := (set $podSelector "statefulset.kubernetes.io/pod-name" $podname) -}} +{{- $ports := (coalesce nil) -}} +{{- range $name, $listener := $values.listeners.admin.external -}} +{{- if (not (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $listener.enabled $values.external.enabled) ))) "r")) -}} +{{- continue -}} +{{- end -}} +{{- $fallbackPorts := (concat (default (list ) $listener.advertisedPorts) (list ($values.listeners.admin.port | int))) -}} +{{- $ports = (concat (default (list ) $ports) (list (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" (printf "admin-%s" $name) "protocol" "TCP" "targetPort" ($listener.port | int) "port" ((get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $listener.nodePort (index $fallbackPorts (0 | int))) ))) "r") | int) )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- range $name, $listener := $values.listeners.kafka.external -}} +{{- if (not (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $listener.enabled $values.external.enabled) ))) "r")) -}} +{{- continue -}} +{{- end -}} +{{- $fallbackPorts := (concat (default (list ) $listener.advertisedPorts) (list ($listener.port | int))) -}} +{{- $ports = (concat (default (list ) $ports) (list (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" (printf "kafka-%s" $name) "protocol" "TCP" "targetPort" ($listener.port | int) "port" ((get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $listener.nodePort (index $fallbackPorts (0 | int))) ))) "r") | int) )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- range $name, $listener := $values.listeners.http.external -}} +{{- if (not (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $listener.enabled $values.external.enabled) ))) "r")) -}} +{{- continue -}} +{{- end -}} +{{- $fallbackPorts := (concat (default (list ) $listener.advertisedPorts) (list ($listener.port | int))) -}} +{{- $ports = (concat (default (list ) $ports) (list (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" (printf "http-%s" $name) "protocol" "TCP" "targetPort" ($listener.port | int) "port" ((get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $listener.nodePort (index $fallbackPorts (0 | int))) ))) "r") | int) )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- range $name, $listener := $values.listeners.schemaRegistry.external -}} +{{- if (not (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $listener.enabled $values.external.enabled) ))) "r")) -}} +{{- continue -}} +{{- end -}} +{{- $fallbackPorts := (concat (default (list ) $listener.advertisedPorts) (list ($listener.port | int))) -}} +{{- $ports = (concat (default (list ) $ports) (list (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" (printf "schema-%s" $name) "protocol" "TCP" "targetPort" ($listener.port | int) "port" ((get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $listener.nodePort (index $fallbackPorts (0 | int))) ))) "r") | int) )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $svc := (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict ) "status" (dict "loadBalancer" (dict ) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "Service" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (printf "lb-%s" $podname) "namespace" $dot.Release.Namespace "labels" $labels "annotations" $annotations )) "spec" (mustMergeOverwrite (dict ) (dict "externalTrafficPolicy" "Local" "loadBalancerSourceRanges" $values.external.sourceRanges "ports" $ports "publishNotReadyAddresses" true "selector" $podSelector "sessionAffinity" "None" "type" "LoadBalancer" )) )) -}} +{{- $services = (concat (default (list ) $services) (list $svc)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $services) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_service.nodeport.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_service.nodeport.go.tpl new file mode 100644 index 000000000..bc199951d --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_service.nodeport.go.tpl @@ -0,0 +1,80 @@ +{{- /* Generated from "service.nodeport.go" */ -}} + +{{- define "redpanda.NodePortService" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (or (not $values.external.enabled) (not $values.external.service.enabled)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (ne $values.external.type "NodePort") -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $ports := (coalesce nil) -}} +{{- range $name, $listener := $values.listeners.admin.external -}} +{{- if (not (get (fromJson (include "redpanda.AdminExternal.IsEnabled" (dict "a" (list $listener) ))) "r")) -}} +{{- continue -}} +{{- end -}} +{{- $nodePort := ($listener.port | int) -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $listener.advertisedPorts) ))) "r") | int) (0 | int)) -}} +{{- $nodePort = (index $listener.advertisedPorts (0 | int)) -}} +{{- end -}} +{{- $ports = (concat (default (list ) $ports) (list (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" (printf "admin-%s" $name) "protocol" "TCP" "port" ($listener.port | int) "nodePort" $nodePort )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- range $name, $listener := $values.listeners.kafka.external -}} +{{- if (not (get (fromJson (include "redpanda.KafkaExternal.IsEnabled" (dict "a" (list $listener) ))) "r")) -}} +{{- continue -}} +{{- end -}} +{{- $nodePort := ($listener.port | int) -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $listener.advertisedPorts) ))) "r") | int) (0 | int)) -}} +{{- $nodePort = (index $listener.advertisedPorts (0 | int)) -}} +{{- end -}} +{{- $ports = (concat (default (list ) $ports) (list (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" (printf "kafka-%s" $name) "protocol" "TCP" "port" ($listener.port | int) "nodePort" $nodePort )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- range $name, $listener := $values.listeners.http.external -}} +{{- if (not (get (fromJson (include "redpanda.HTTPExternal.IsEnabled" (dict "a" (list $listener) ))) "r")) -}} +{{- continue -}} +{{- end -}} +{{- $nodePort := ($listener.port | int) -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $listener.advertisedPorts) ))) "r") | int) (0 | int)) -}} +{{- $nodePort = (index $listener.advertisedPorts (0 | int)) -}} +{{- end -}} +{{- $ports = (concat (default (list ) $ports) (list (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" (printf "http-%s" $name) "protocol" "TCP" "port" ($listener.port | int) "nodePort" $nodePort )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- range $name, $listener := $values.listeners.schemaRegistry.external -}} +{{- if (not (get (fromJson (include "redpanda.SchemaRegistryExternal.IsEnabled" (dict "a" (list $listener) ))) "r")) -}} +{{- continue -}} +{{- end -}} +{{- $nodePort := ($listener.port | int) -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $listener.advertisedPorts) ))) "r") | int) (0 | int)) -}} +{{- $nodePort = (index $listener.advertisedPorts (0 | int)) -}} +{{- end -}} +{{- $ports = (concat (default (list ) $ports) (list (mustMergeOverwrite (dict "port" 0 "targetPort" 0 ) (dict "name" (printf "schema-%s" $name) "protocol" "TCP" "port" ($listener.port | int) "nodePort" $nodePort )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $annotations := $values.external.annotations -}} +{{- if (eq (toJson $annotations) "null") -}} +{{- $annotations = (dict ) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict ) "status" (dict "loadBalancer" (dict ) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "Service" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (printf "%s-external" (get (fromJson (include "redpanda.ServiceName" (dict "a" (list $dot) ))) "r")) "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") "annotations" $annotations )) "spec" (mustMergeOverwrite (dict ) (dict "externalTrafficPolicy" "Local" "ports" $ports "publishNotReadyAddresses" true "selector" (get (fromJson (include "redpanda.StatefulSetPodLabelsSelector" (dict "a" (list $dot) ))) "r") "sessionAffinity" "None" "type" "NodePort" )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_serviceaccount.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_serviceaccount.go.tpl new file mode 100644 index 000000000..82ec5be75 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_serviceaccount.go.tpl @@ -0,0 +1,18 @@ +{{- /* Generated from "serviceaccount.go" */ -}} + +{{- define "redpanda.ServiceAccount" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.serviceAccount.create) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "v1" "kind" "ServiceAccount" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "redpanda.ServiceAccountName" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") "annotations" $values.serviceAccount.annotations )) "automountServiceAccountToken" $values.serviceAccount.automountServiceAccountToken ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_servicemonitor.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_servicemonitor.go.tpl new file mode 100644 index 000000000..7f5a62130 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_servicemonitor.go.tpl @@ -0,0 +1,26 @@ +{{- /* Generated from "servicemonitor.go" */ -}} + +{{- define "redpanda.ServiceMonitor" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.monitoring.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $endpoint := (mustMergeOverwrite (dict ) (dict "interval" $values.monitoring.scrapeInterval "path" "/public_metrics" "port" "admin" "enableHttp2" $values.monitoring.enableHttp2 "scheme" "http" )) -}} +{{- if (or (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $values.listeners.admin.tls $values.tls) ))) "r") (ne (toJson $values.monitoring.tlsConfig) "null")) -}} +{{- $_ := (set $endpoint "scheme" "https") -}} +{{- $_ := (set $endpoint "tlsConfig" $values.monitoring.tlsConfig) -}} +{{- if (eq (toJson $endpoint.tlsConfig) "null") -}} +{{- $_ := (set $endpoint "tlsConfig" (mustMergeOverwrite (dict "ca" (dict ) "cert" (dict ) ) (mustMergeOverwrite (dict "ca" (dict ) "cert" (dict ) ) (dict "insecureSkipVerify" true )) (dict ))) -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "endpoints" (coalesce nil) "selector" (dict ) "namespaceSelector" (dict ) ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "monitoring.coreos.com/v1" "kind" "ServiceMonitor" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace "labels" (merge (dict ) (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") $values.monitoring.labels) )) "spec" (mustMergeOverwrite (dict "endpoints" (coalesce nil) "selector" (dict ) "namespaceSelector" (dict ) ) (dict "endpoints" (list $endpoint) "selector" (mustMergeOverwrite (dict ) (dict "matchLabels" (dict "monitoring.redpanda.com/enabled" "true" "app.kubernetes.io/name" (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r") "app.kubernetes.io/instance" $dot.Release.Name ) )) )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_shims.tpl b/charts/redpanda/redpanda/5.9.7/templates/_shims.tpl new file mode 100644 index 000000000..1e6d0425c --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_shims.tpl @@ -0,0 +1,289 @@ +{{- /* Generated from "bootstrap.go" */ -}} + +{{- define "_shims.typetest" -}} +{{- $typ := (index .a 0) -}} +{{- $value := (index .a 1) -}} +{{- $zero := (index .a 2) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (typeIs $typ $value) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $zero false)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.typeassertion" -}} +{{- $typ := (index .a 0) -}} +{{- $value := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (not (typeIs $typ $value)) -}} +{{- $_ := (fail (printf "expected type of %q got: %T" $typ $value)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $value) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.dicttest" -}} +{{- $m := (index .a 0) -}} +{{- $key := (index .a 1) -}} +{{- $zero := (index .a 2) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (hasKey $m $key) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (index $m $key) true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $zero false)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.compact" -}} +{{- $args := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $out := (dict ) -}} +{{- range $i, $e := $args -}} +{{- $_ := (set $out (printf "T%d" ((add (1 | int) $i) | int)) $e) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $out) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.deref" -}} +{{- $ptr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (eq (toJson $ptr) "null") -}} +{{- $_ := (fail "nil dereference") -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $ptr) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.len" -}} +{{- $m := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (eq (toJson $m) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" (0 | int)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (len $m)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.ptr_Deref" -}} +{{- $ptr := (index .a 0) -}} +{{- $def := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (ne (toJson $ptr) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" $ptr) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $def) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.ptr_Equal" -}} +{{- $a := (index .a 0) -}} +{{- $b := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (and (eq (toJson $a) "null") (eq (toJson $b) "null")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" true) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (eq $a $b)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.lookup" -}} +{{- $apiVersion := (index .a 0) -}} +{{- $kind := (index .a 1) -}} +{{- $namespace := (index .a 2) -}} +{{- $name := (index .a 3) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $result := (lookup $apiVersion $kind $namespace $name) -}} +{{- if (empty $result) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (coalesce nil) false)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $result true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.asnumeric" -}} +{{- $value := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (typeIs "float64" $value) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (typeIs "int64" $value) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (typeIs "int" $value) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (0 | int) false)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.asintegral" -}} +{{- $value := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (or (typeIs "int64" $value) (typeIs "int" $value)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (and (typeIs "float64" $value) (eq (floor $value) $value)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $value true)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (0 | int) false)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.parseResource" -}} +{{- $repr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (typeIs "float64" $repr) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (float64 $repr) 1.0)) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (not (typeIs "string" $repr)) -}} +{{- $_ := (fail (printf "invalid Quantity expected string or float64 got: %T (%v)" $repr $repr)) -}} +{{- end -}} +{{- if (not (regexMatch `^[0-9]+(\.[0-9]{0,6})?(k|m|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$` $repr)) -}} +{{- $_ := (fail (printf "invalid Quantity: %q" $repr)) -}} +{{- end -}} +{{- $reprStr := (toString $repr) -}} +{{- $unit := (regexFind "(k|m|M|G|T|P|Ki|Mi|Gi|Ti|Pi)$" $repr) -}} +{{- $numeric := (float64 (substr (0 | int) ((sub ((get (fromJson (include "_shims.len" (dict "a" (list $reprStr) ))) "r") | int) ((get (fromJson (include "_shims.len" (dict "a" (list $unit) ))) "r") | int)) | int) $reprStr)) -}} +{{- $tmp_tuple_1 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list (dict "" 1.0 "m" 0.001 "k" (1000 | int) "M" (1000000 | int) "G" (1000000000 | int) "T" (1000000000000 | int) "P" (1000000000000000 | int) "Ki" (1024 | int) "Mi" (1048576 | int) "Gi" (1073741824 | int) "Ti" (1099511627776 | int) "Pi" (1125899906842624 | int) ) $unit (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok := $tmp_tuple_1.T2 -}} +{{- $scale := ($tmp_tuple_1.T1 | float64) -}} +{{- if (not $ok) -}} +{{- $_ := (fail (printf "unknown unit: %q" $unit)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $numeric $scale)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.resource_MustParse" -}} +{{- $repr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_2 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.parseResource" (dict "a" (list $repr) ))) "r")) ))) "r") -}} +{{- $scale := ($tmp_tuple_2.T2 | float64) -}} +{{- $numeric := ($tmp_tuple_2.T1 | float64) -}} +{{- $strs := (list "" "m" "k" "M" "G" "T" "P" "Ki" "Mi" "Gi" "Ti" "Pi") -}} +{{- $scales := (list 1.0 0.001 (1000 | int) (1000000 | int) (1000000000 | int) (1000000000000 | int) (1000000000000000 | int) (1024 | int) (1048576 | int) (1073741824 | int) (1099511627776 | int) (1125899906842624 | int)) -}} +{{- $idx := -1 -}} +{{- range $i, $s := $scales -}} +{{- if (eq ($s | float64) ($scale | float64)) -}} +{{- $idx = $i -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- if (eq $idx -1) -}} +{{- $_ := (fail (printf "unknown scale: %v" $scale)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "%s%s" (toString $numeric) (index $strs $idx))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.resource_Value" -}} +{{- $repr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_3 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.parseResource" (dict "a" (list $repr) ))) "r")) ))) "r") -}} +{{- $scale := ($tmp_tuple_3.T2 | float64) -}} +{{- $numeric := ($tmp_tuple_3.T1 | float64) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (int64 (ceil ((mulf $numeric $scale) | float64)))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.resource_MilliValue" -}} +{{- $repr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_4 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.parseResource" (dict "a" (list $repr) ))) "r")) ))) "r") -}} +{{- $scale := ($tmp_tuple_4.T2 | float64) -}} +{{- $numeric := ($tmp_tuple_4.T1 | float64) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (int64 (ceil ((mulf ((mulf $numeric 1000.0) | float64) $scale) | float64)))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "_shims.render-manifest" -}} +{{- $tpl := (index . 0) -}} +{{- $dot := (index . 1) -}} +{{- $manifests := (get ((include $tpl (dict "a" (list $dot))) | fromJson) "r") -}} +{{- if not (typeIs "[]interface {}" $manifests) -}} +{{- $manifests = (list $manifests) -}} +{{- end -}} +{{- range $_, $manifest := $manifests -}} +{{- if ne (toJson $manifest) "null" }} +--- +{{toYaml (unset (unset $manifest "status") "creationTimestamp")}} +{{- end -}} +{{- end -}} +{{- end -}} diff --git a/charts/redpanda/redpanda/5.9.7/templates/_statefulset.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_statefulset.go.tpl new file mode 100644 index 000000000..0d96b0120 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_statefulset.go.tpl @@ -0,0 +1,725 @@ +{{- /* Generated from "statefulset.go" */ -}} + +{{- define "redpanda.statefulSetRedpandaEnv" -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "SERVICE_NAME" "valueFrom" (mustMergeOverwrite (dict ) (dict "fieldRef" (mustMergeOverwrite (dict "fieldPath" "" ) (dict "fieldPath" "metadata.name" )) )) )) (mustMergeOverwrite (dict "name" "" ) (dict "name" "POD_IP" "valueFrom" (mustMergeOverwrite (dict ) (dict "fieldRef" (mustMergeOverwrite (dict "fieldPath" "" ) (dict "fieldPath" "status.podIP" )) )) )) (mustMergeOverwrite (dict "name" "" ) (dict "name" "HOST_IP" "valueFrom" (mustMergeOverwrite (dict ) (dict "fieldRef" (mustMergeOverwrite (dict "fieldPath" "" ) (dict "fieldPath" "status.hostIP" )) )) )))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.StatefulSetPodLabelsSelector" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if $dot.Release.IsUpgrade -}} +{{- $tmp_tuple_1 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.lookup" (dict "a" (list "apps/v1" "StatefulSet" $dot.Release.Namespace (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) ))) "r")) ))) "r") -}} +{{- $ok_2 := $tmp_tuple_1.T2 -}} +{{- $existing_1 := $tmp_tuple_1.T1 -}} +{{- if (and $ok_2 (gt ((get (fromJson (include "_shims.len" (dict "a" (list $existing_1.spec.selector.matchLabels) ))) "r") | int) (0 | int))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $existing_1.spec.selector.matchLabels) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- $values := $dot.Values.AsMap -}} +{{- $additionalSelectorLabels := (dict ) -}} +{{- if (ne (toJson $values.statefulset.additionalSelectorLabels) "null") -}} +{{- $additionalSelectorLabels = $values.statefulset.additionalSelectorLabels -}} +{{- end -}} +{{- $component := (printf "%s-statefulset" (trimSuffix "-" (trunc (51 | int) (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r")))) -}} +{{- $defaults := (dict "app.kubernetes.io/component" $component "app.kubernetes.io/instance" $dot.Release.Name "app.kubernetes.io/name" (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r") ) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (merge (dict ) $additionalSelectorLabels $defaults)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.StatefulSetPodLabels" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if $dot.Release.IsUpgrade -}} +{{- $tmp_tuple_2 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.lookup" (dict "a" (list "apps/v1" "StatefulSet" $dot.Release.Namespace (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) ))) "r")) ))) "r") -}} +{{- $ok_4 := $tmp_tuple_2.T2 -}} +{{- $existing_3 := $tmp_tuple_2.T1 -}} +{{- if (and $ok_4 (gt ((get (fromJson (include "_shims.len" (dict "a" (list $existing_3.spec.template.metadata.labels) ))) "r") | int) (0 | int))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $existing_3.spec.template.metadata.labels) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} +{{- $values := $dot.Values.AsMap -}} +{{- $statefulSetLabels := (dict ) -}} +{{- if (ne (toJson $values.statefulset.podTemplate.labels) "null") -}} +{{- $statefulSetLabels = $values.statefulset.podTemplate.labels -}} +{{- end -}} +{{- $defaults := (dict "redpanda.com/poddisruptionbudget" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") ) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (merge (dict ) $statefulSetLabels (get (fromJson (include "redpanda.StatefulSetPodLabelsSelector" (dict "a" (list $dot) ))) "r") $defaults (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r"))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.StatefulSetPodAnnotations" -}} +{{- $dot := (index .a 0) -}} +{{- $configMapChecksum := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $configMapChecksumAnnotation := (dict "config.redpanda.com/checksum" $configMapChecksum ) -}} +{{- if (ne (toJson $values.statefulset.podTemplate.annotations) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" (merge (dict ) $values.statefulset.podTemplate.annotations $configMapChecksumAnnotation)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (merge (dict ) $values.statefulset.annotations $configMapChecksumAnnotation)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.StatefulSetVolumes" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $fullname := (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") -}} +{{- $volumes := (get (fromJson (include "redpanda.CommonVolumes" (dict "a" (list $dot) ))) "r") -}} +{{- $values := $dot.Values.AsMap -}} +{{- $volumes = (concat (default (list ) $volumes) (default (list ) (list (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "secret" (mustMergeOverwrite (dict ) (dict "secretName" (printf "%.50s-sts-lifecycle" $fullname) "defaultMode" (0o775 | int) )) )) (dict "name" "lifecycle-scripts" )) (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "configMap" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "name" $fullname )) (dict )) )) (dict "name" "base-config" )) (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "emptyDir" (mustMergeOverwrite (dict ) (dict )) )) (dict "name" "config" )) (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "secret" (mustMergeOverwrite (dict ) (dict "secretName" (printf "%.51s-configurator" $fullname) "defaultMode" (0o775 | int) )) )) (dict "name" (printf "%.51s-configurator" $fullname) )) (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "secret" (mustMergeOverwrite (dict ) (dict "secretName" (printf "%s-config-watcher" $fullname) "defaultMode" (0o775 | int) )) )) (dict "name" (printf "%s-config-watcher" $fullname) ))))) -}} +{{- if $values.statefulset.initContainers.fsValidator.enabled -}} +{{- $volumes = (concat (default (list ) $volumes) (list (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "secret" (mustMergeOverwrite (dict ) (dict "secretName" (printf "%.49s-fs-validator" $fullname) "defaultMode" (0o775 | int) )) )) (dict "name" (printf "%.49s-fs-validator" $fullname) )))) -}} +{{- end -}} +{{- $vol_5 := (get (fromJson (include "redpanda.Listeners.TrustStoreVolume" (dict "a" (list $values.listeners $values.tls) ))) "r") -}} +{{- if (ne (toJson $vol_5) "null") -}} +{{- $volumes = (concat (default (list ) $volumes) (list $vol_5)) -}} +{{- end -}} +{{- $volumes = (concat (default (list ) $volumes) (default (list ) (get (fromJson (include "redpanda.templateToVolumes" (dict "a" (list $dot $values.statefulset.extraVolumes) ))) "r"))) -}} +{{- $volumes = (concat (default (list ) $volumes) (list (get (fromJson (include "redpanda.statefulSetVolumeDataDir" (dict "a" (list $dot) ))) "r"))) -}} +{{- $v_6 := (get (fromJson (include "redpanda.statefulSetVolumeTieredStorageDir" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne (toJson $v_6) "null") -}} +{{- $volumes = (concat (default (list ) $volumes) (list $v_6)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $volumes) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.statefulSetVolumeDataDir" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $datadirSource := (mustMergeOverwrite (dict ) (dict "emptyDir" (mustMergeOverwrite (dict ) (dict )) )) -}} +{{- if $values.storage.persistentVolume.enabled -}} +{{- $datadirSource = (mustMergeOverwrite (dict ) (dict "persistentVolumeClaim" (mustMergeOverwrite (dict "claimName" "" ) (dict "claimName" "datadir" )) )) -}} +{{- else -}}{{- if (ne $values.storage.hostPath "") -}} +{{- $datadirSource = (mustMergeOverwrite (dict ) (dict "hostPath" (mustMergeOverwrite (dict "path" "" ) (dict "path" $values.storage.hostPath )) )) -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "name" "" ) $datadirSource (dict "name" "datadir" ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.statefulSetVolumeTieredStorageDir" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not (get (fromJson (include "redpanda.Storage.IsTieredStorageEnabled" (dict "a" (list $values.storage) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $tieredType := (get (fromJson (include "redpanda.Storage.TieredMountType" (dict "a" (list $values.storage) ))) "r") -}} +{{- if (or (eq $tieredType "none") (eq $tieredType "persistentVolume")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (eq $tieredType "hostPath") -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "hostPath" (mustMergeOverwrite (dict "path" "" ) (dict "path" (get (fromJson (include "redpanda.Storage.GetTieredStorageHostPath" (dict "a" (list $values.storage) ))) "r") )) )) (dict "name" "tiered-storage-dir" ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "emptyDir" (mustMergeOverwrite (dict ) (dict "sizeLimit" (get (fromJson (include "redpanda.TieredStorageConfig.CloudStorageCacheSize" (dict "a" (list (deepCopy (get (fromJson (include "redpanda.Storage.GetTieredStorageConfig" (dict "a" (list $values.storage) ))) "r"))) ))) "r") )) )) (dict "name" "tiered-storage-dir" ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.StatefulSetVolumeMounts" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $mounts := (get (fromJson (include "redpanda.CommonMounts" (dict "a" (list $dot) ))) "r") -}} +{{- $values := $dot.Values.AsMap -}} +{{- $mounts = (concat (default (list ) $mounts) (default (list ) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "config" "mountPath" "/etc/redpanda" )) (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "base-config" "mountPath" "/tmp/base-config" )) (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "lifecycle-scripts" "mountPath" "/var/lifecycle" )) (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "datadir" "mountPath" "/var/lib/redpanda/data" ))))) -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list (get (fromJson (include "redpanda.Listeners.TrustStores" (dict "a" (list $values.listeners $values.tls) ))) "r")) ))) "r") | int) (0 | int)) -}} +{{- $mounts = (concat (default (list ) $mounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "truststores" "mountPath" "/etc/truststores" "readOnly" true )))) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $mounts) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.StatefulSetInitContainers" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $containers := (coalesce nil) -}} +{{- $c_7 := (get (fromJson (include "redpanda.statefulSetInitContainerTuning" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne (toJson $c_7) "null") -}} +{{- $containers = (concat (default (list ) $containers) (list $c_7)) -}} +{{- end -}} +{{- $c_8 := (get (fromJson (include "redpanda.statefulSetInitContainerSetDataDirOwnership" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne (toJson $c_8) "null") -}} +{{- $containers = (concat (default (list ) $containers) (list $c_8)) -}} +{{- end -}} +{{- $c_9 := (get (fromJson (include "redpanda.statefulSetInitContainerFSValidator" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne (toJson $c_9) "null") -}} +{{- $containers = (concat (default (list ) $containers) (list $c_9)) -}} +{{- end -}} +{{- $c_10 := (get (fromJson (include "redpanda.statefulSetInitContainerSetTieredStorageCacheDirOwnership" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne (toJson $c_10) "null") -}} +{{- $containers = (concat (default (list ) $containers) (list $c_10)) -}} +{{- end -}} +{{- $containers = (concat (default (list ) $containers) (list (get (fromJson (include "redpanda.statefulSetInitContainerConfigurator" (dict "a" (list $dot) ))) "r"))) -}} +{{- $containers = (concat (default (list ) $containers) (list (get (fromJson (include "redpanda.bootstrapYamlTemplater" (dict "a" (list $dot) ))) "r"))) -}} +{{- $containers = (concat (default (list ) $containers) (default (list ) (get (fromJson (include "redpanda.templateToContainers" (dict "a" (list $dot $values.statefulset.initContainers.extraInitContainers) ))) "r"))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $containers) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.statefulSetInitContainerTuning" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.tuning.tune_aio_events) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "name" "" "resources" (dict ) ) (dict "name" "tuning" "image" (printf "%s:%s" $values.image.repository (get (fromJson (include "redpanda.Tag" (dict "a" (list $dot) ))) "r")) "command" (list `/bin/bash` `-c` `rpk redpanda tune all`) "securityContext" (mustMergeOverwrite (dict ) (dict "capabilities" (mustMergeOverwrite (dict ) (dict "add" (list `SYS_RESOURCE`) )) "privileged" true "runAsUser" ((0 | int64) | int64) "runAsGroup" ((0 | int64) | int64) )) "volumeMounts" (concat (default (list ) (concat (default (list ) (get (fromJson (include "redpanda.CommonMounts" (dict "a" (list $dot) ))) "r")) (default (list ) (get (fromJson (include "redpanda.templateToVolumeMounts" (dict "a" (list $dot $values.statefulset.initContainers.tuning.extraVolumeMounts) ))) "r")))) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "base-config" "mountPath" "/etc/redpanda" )))) "resources" $values.statefulset.initContainers.tuning.resources ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.statefulSetInitContainerSetDataDirOwnership" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.statefulset.initContainers.setDataDirOwnership.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $tmp_tuple_3 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "redpanda.securityContextUidGid" (dict "a" (list $dot "set-datadir-ownership") ))) "r")) ))) "r") -}} +{{- $gid := ($tmp_tuple_3.T2 | int64) -}} +{{- $uid := ($tmp_tuple_3.T1 | int64) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "name" "" "resources" (dict ) ) (dict "name" "set-datadir-ownership" "image" (printf "%s:%s" $values.statefulset.initContainerImage.repository $values.statefulset.initContainerImage.tag) "command" (list `/bin/sh` `-c` (printf `chown %d:%d -R /var/lib/redpanda/data` $uid $gid)) "volumeMounts" (concat (default (list ) (concat (default (list ) (get (fromJson (include "redpanda.CommonMounts" (dict "a" (list $dot) ))) "r")) (default (list ) (get (fromJson (include "redpanda.templateToVolumeMounts" (dict "a" (list $dot $values.statefulset.initContainers.setDataDirOwnership.extraVolumeMounts) ))) "r")))) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" `datadir` "mountPath" `/var/lib/redpanda/data` )))) "resources" $values.statefulset.initContainers.setDataDirOwnership.resources ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.securityContextUidGid" -}} +{{- $dot := (index .a 0) -}} +{{- $containerName := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $uid := $values.statefulset.securityContext.runAsUser -}} +{{- if (and (ne (toJson $values.statefulset.podSecurityContext) "null") (ne (toJson $values.statefulset.podSecurityContext.runAsUser) "null")) -}} +{{- $uid = $values.statefulset.podSecurityContext.runAsUser -}} +{{- end -}} +{{- if (eq (toJson $uid) "null") -}} +{{- $_ := (fail (printf `%s container requires runAsUser to be specified` $containerName)) -}} +{{- end -}} +{{- $gid := $values.statefulset.securityContext.fsGroup -}} +{{- if (and (ne (toJson $values.statefulset.podSecurityContext) "null") (ne (toJson $values.statefulset.podSecurityContext.fsGroup) "null")) -}} +{{- $gid = $values.statefulset.podSecurityContext.fsGroup -}} +{{- end -}} +{{- if (eq (toJson $gid) "null") -}} +{{- $_ := (fail (printf `%s container requires fsGroup to be specified` $containerName)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list $uid $gid)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.statefulSetInitContainerFSValidator" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.statefulset.initContainers.fsValidator.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "name" "" "resources" (dict ) ) (dict "name" "fs-validator" "image" (printf "%s:%s" $values.image.repository (get (fromJson (include "redpanda.Tag" (dict "a" (list $dot) ))) "r")) "command" (list `/bin/sh`) "args" (list `-c` (printf `trap "exit 0" TERM; exec /etc/secrets/fs-validator/scripts/fsValidator.sh %s & wait $!` $values.statefulset.initContainers.fsValidator.expectedFS)) "securityContext" (get (fromJson (include "redpanda.ContainerSecurityContext" (dict "a" (list $dot) ))) "r") "volumeMounts" (concat (default (list ) (concat (default (list ) (get (fromJson (include "redpanda.CommonMounts" (dict "a" (list $dot) ))) "r")) (default (list ) (get (fromJson (include "redpanda.templateToVolumeMounts" (dict "a" (list $dot $values.statefulset.initContainers.fsValidator.extraVolumeMounts) ))) "r")))) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" (printf `%.49s-fs-validator` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) "mountPath" `/etc/secrets/fs-validator/scripts/` )) (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" `datadir` "mountPath" `/var/lib/redpanda/data` )))) "resources" $values.statefulset.initContainers.fsValidator.resources ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.statefulSetInitContainerSetTieredStorageCacheDirOwnership" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not (get (fromJson (include "redpanda.Storage.IsTieredStorageEnabled" (dict "a" (list $values.storage) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $tmp_tuple_4 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "redpanda.securityContextUidGid" (dict "a" (list $dot "set-tiered-storage-cache-dir-ownership") ))) "r")) ))) "r") -}} +{{- $gid := ($tmp_tuple_4.T2 | int64) -}} +{{- $uid := ($tmp_tuple_4.T1 | int64) -}} +{{- $cacheDir := (get (fromJson (include "redpanda.Storage.TieredCacheDirectory" (dict "a" (list $values.storage $dot) ))) "r") -}} +{{- $mounts := (get (fromJson (include "redpanda.CommonMounts" (dict "a" (list $dot) ))) "r") -}} +{{- $mounts = (concat (default (list ) $mounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "datadir" "mountPath" "/var/lib/redpanda/data" )))) -}} +{{- if (ne (get (fromJson (include "redpanda.Storage.TieredMountType" (dict "a" (list $values.storage) ))) "r") "none") -}} +{{- $name := "tiered-storage-dir" -}} +{{- if (and (ne (toJson $values.storage.persistentVolume) "null") (ne $values.storage.persistentVolume.nameOverwrite "")) -}} +{{- $name = $values.storage.persistentVolume.nameOverwrite -}} +{{- end -}} +{{- $mounts = (concat (default (list ) $mounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" $name "mountPath" $cacheDir )))) -}} +{{- end -}} +{{- $mounts = (concat (default (list ) $mounts) (default (list ) (get (fromJson (include "redpanda.templateToVolumeMounts" (dict "a" (list $dot $values.statefulset.initContainers.setTieredStorageCacheDirOwnership.extraVolumeMounts) ))) "r"))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "name" "" "resources" (dict ) ) (dict "name" `set-tiered-storage-cache-dir-ownership` "image" (printf `%s:%s` $values.statefulset.initContainerImage.repository $values.statefulset.initContainerImage.tag) "command" (list `/bin/sh` `-c` (printf `mkdir -p %s; chown %d:%d -R %s` $cacheDir $uid $gid $cacheDir)) "volumeMounts" $mounts "resources" $values.statefulset.initContainers.setTieredStorageCacheDirOwnership.resources ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.statefulSetInitContainerConfigurator" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "name" "" "resources" (dict ) ) (dict "name" (printf `%.51s-configurator` (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r")) "image" (printf `%s:%s` $values.image.repository (get (fromJson (include "redpanda.Tag" (dict "a" (list $dot) ))) "r")) "command" (list `/bin/bash` `-c` `trap "exit 0" TERM; exec $CONFIGURATOR_SCRIPT "${SERVICE_NAME}" "${KUBERNETES_NODE_NAME}" & wait $!`) "env" (get (fromJson (include "redpanda.rpkEnvVars" (dict "a" (list $dot (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "CONFIGURATOR_SCRIPT" "value" "/etc/secrets/configurator/scripts/configurator.sh" )) (mustMergeOverwrite (dict "name" "" ) (dict "name" "SERVICE_NAME" "valueFrom" (mustMergeOverwrite (dict ) (dict "fieldRef" (mustMergeOverwrite (dict "fieldPath" "" ) (dict "fieldPath" "metadata.name" )) "resourceFieldRef" (coalesce nil) "configMapKeyRef" (coalesce nil) "secretKeyRef" (coalesce nil) )) )) (mustMergeOverwrite (dict "name" "" ) (dict "name" "KUBERNETES_NODE_NAME" "valueFrom" (mustMergeOverwrite (dict ) (dict "fieldRef" (mustMergeOverwrite (dict "fieldPath" "" ) (dict "fieldPath" "spec.nodeName" )) )) )) (mustMergeOverwrite (dict "name" "" ) (dict "name" "HOST_IP_ADDRESS" "valueFrom" (mustMergeOverwrite (dict ) (dict "fieldRef" (mustMergeOverwrite (dict "fieldPath" "" ) (dict "apiVersion" "v1" "fieldPath" "status.hostIP" )) )) )))) ))) "r") "securityContext" (get (fromJson (include "redpanda.ContainerSecurityContext" (dict "a" (list $dot) ))) "r") "volumeMounts" (concat (default (list ) (concat (default (list ) (get (fromJson (include "redpanda.CommonMounts" (dict "a" (list $dot) ))) "r")) (default (list ) (get (fromJson (include "redpanda.templateToVolumeMounts" (dict "a" (list $dot $values.statefulset.initContainers.configurator.extraVolumeMounts) ))) "r")))) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "config" "mountPath" "/etc/redpanda" )) (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "base-config" "mountPath" "/tmp/base-config" )) (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" (printf `%.51s-configurator` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) "mountPath" "/etc/secrets/configurator/scripts/" )))) "resources" $values.statefulset.initContainers.configurator.resources ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.StatefulSetContainers" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $containers := (coalesce nil) -}} +{{- $containers = (concat (default (list ) $containers) (list (get (fromJson (include "redpanda.statefulSetContainerRedpanda" (dict "a" (list $dot) ))) "r"))) -}} +{{- $c_11 := (get (fromJson (include "redpanda.statefulSetContainerConfigWatcher" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne (toJson $c_11) "null") -}} +{{- $containers = (concat (default (list ) $containers) (list $c_11)) -}} +{{- end -}} +{{- $c_12 := (get (fromJson (include "redpanda.statefulSetContainerControllers" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne (toJson $c_12) "null") -}} +{{- $containers = (concat (default (list ) $containers) (list $c_12)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $containers) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.wrapLifecycleHook" -}} +{{- $hook := (index .a 0) -}} +{{- $timeoutSeconds := (index .a 1) -}} +{{- $cmd := (index .a 2) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $wrapped := (join " " $cmd) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list "bash" "-c" (printf "timeout -v %d %s 2>&1 | sed \"s/^/lifecycle-hook %s $(date): /\" | tee /proc/1/fd/1; true" $timeoutSeconds $wrapped $hook))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.statefulSetContainerRedpanda" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $internalAdvertiseAddress := (printf "%s.%s" "$(SERVICE_NAME)" (get (fromJson (include "redpanda.InternalDomain" (dict "a" (list $dot) ))) "r")) -}} +{{- $container := (mustMergeOverwrite (dict "name" "" "resources" (dict ) ) (dict "name" (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r") "image" (printf `%s:%s` $values.image.repository (get (fromJson (include "redpanda.Tag" (dict "a" (list $dot) ))) "r")) "env" (get (fromJson (include "redpanda.bootstrapEnvVars" (dict "a" (list $dot (get (fromJson (include "redpanda.statefulSetRedpandaEnv" (dict "a" (list ) ))) "r")) ))) "r") "lifecycle" (mustMergeOverwrite (dict ) (dict "postStart" (mustMergeOverwrite (dict ) (dict "exec" (mustMergeOverwrite (dict ) (dict "command" (get (fromJson (include "redpanda.wrapLifecycleHook" (dict "a" (list "post-start" ((div ($values.statefulset.terminationGracePeriodSeconds | int64) (2 | int64)) | int64) (list "bash" "-x" "/var/lifecycle/postStart.sh")) ))) "r") )) )) "preStop" (mustMergeOverwrite (dict ) (dict "exec" (mustMergeOverwrite (dict ) (dict "command" (get (fromJson (include "redpanda.wrapLifecycleHook" (dict "a" (list "pre-stop" ((div ($values.statefulset.terminationGracePeriodSeconds | int64) (2 | int64)) | int64) (list "bash" "-x" "/var/lifecycle/preStop.sh")) ))) "r") )) )) )) "startupProbe" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "exec" (mustMergeOverwrite (dict ) (dict "command" (list `/bin/sh` `-c` (join "\n" (list `set -e` (printf `RESULT=$(curl --silent --fail -k -m 5 %s "%s://%s/v1/status/ready")` (get (fromJson (include "redpanda.adminTLSCurlFlags" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.adminInternalHTTPProtocol" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.adminApiURLs" (dict "a" (list $dot) ))) "r")) `echo $RESULT` `echo $RESULT | grep ready` ``))) )) )) (dict "initialDelaySeconds" ($values.statefulset.startupProbe.initialDelaySeconds | int) "periodSeconds" ($values.statefulset.startupProbe.periodSeconds | int) "failureThreshold" ($values.statefulset.startupProbe.failureThreshold | int) )) "livenessProbe" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "exec" (mustMergeOverwrite (dict ) (dict "command" (list `/bin/sh` `-c` (printf `curl --silent --fail -k -m 5 %s "%s://%s/v1/status/ready"` (get (fromJson (include "redpanda.adminTLSCurlFlags" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.adminInternalHTTPProtocol" (dict "a" (list $dot) ))) "r") (get (fromJson (include "redpanda.adminApiURLs" (dict "a" (list $dot) ))) "r"))) )) )) (dict "initialDelaySeconds" ($values.statefulset.livenessProbe.initialDelaySeconds | int) "periodSeconds" ($values.statefulset.livenessProbe.periodSeconds | int) "failureThreshold" ($values.statefulset.livenessProbe.failureThreshold | int) )) "command" (list `rpk` `redpanda` `start` (printf `--advertise-rpc-addr=%s:%d` $internalAdvertiseAddress ($values.listeners.rpc.port | int))) "volumeMounts" (concat (default (list ) (get (fromJson (include "redpanda.StatefulSetVolumeMounts" (dict "a" (list $dot) ))) "r")) (default (list ) (get (fromJson (include "redpanda.templateToVolumeMounts" (dict "a" (list $dot $values.statefulset.extraVolumeMounts) ))) "r"))) "securityContext" (get (fromJson (include "redpanda.ContainerSecurityContext" (dict "a" (list $dot) ))) "r") "resources" (mustMergeOverwrite (dict ) (dict )) )) -}} +{{- if (not (get (fromJson (include "_shims.typeassertion" (dict "a" (list "bool" (dig `recovery_mode_enabled` false $values.config.node)) ))) "r")) -}} +{{- $_ := (set $container "readinessProbe" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "exec" (mustMergeOverwrite (dict ) (dict "command" (list `/bin/sh` `-c` (join "\n" (list `set -x` `RESULT=$(rpk cluster health)` `echo $RESULT` `echo $RESULT | grep 'Healthy:.*true'` ``))) )) )) (dict "initialDelaySeconds" ($values.statefulset.readinessProbe.initialDelaySeconds | int) "timeoutSeconds" ($values.statefulset.readinessProbe.timeoutSeconds | int) "periodSeconds" ($values.statefulset.readinessProbe.periodSeconds | int) "successThreshold" ($values.statefulset.readinessProbe.successThreshold | int) "failureThreshold" ($values.statefulset.readinessProbe.failureThreshold | int) ))) -}} +{{- end -}} +{{- $_ := (set $container "ports" (concat (default (list ) $container.ports) (list (mustMergeOverwrite (dict "containerPort" 0 ) (dict "name" "admin" "containerPort" ($values.listeners.admin.port | int) ))))) -}} +{{- range $externalName, $external := $values.listeners.admin.external -}} +{{- if (get (fromJson (include "redpanda.AdminExternal.IsEnabled" (dict "a" (list $external) ))) "r") -}} +{{- $_ := (set $container "ports" (concat (default (list ) $container.ports) (list (mustMergeOverwrite (dict "containerPort" 0 ) (dict "name" (printf "admin-%.8s" (lower $externalName)) "containerPort" ($external.port | int) ))))) -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_ := (set $container "ports" (concat (default (list ) $container.ports) (list (mustMergeOverwrite (dict "containerPort" 0 ) (dict "name" "http" "containerPort" ($values.listeners.http.port | int) ))))) -}} +{{- range $externalName, $external := $values.listeners.http.external -}} +{{- if (get (fromJson (include "redpanda.HTTPExternal.IsEnabled" (dict "a" (list $external) ))) "r") -}} +{{- $_ := (set $container "ports" (concat (default (list ) $container.ports) (list (mustMergeOverwrite (dict "containerPort" 0 ) (dict "name" (printf "http-%.8s" (lower $externalName)) "containerPort" ($external.port | int) ))))) -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_ := (set $container "ports" (concat (default (list ) $container.ports) (list (mustMergeOverwrite (dict "containerPort" 0 ) (dict "name" "kafka" "containerPort" ($values.listeners.kafka.port | int) ))))) -}} +{{- range $externalName, $external := $values.listeners.kafka.external -}} +{{- if (get (fromJson (include "redpanda.KafkaExternal.IsEnabled" (dict "a" (list $external) ))) "r") -}} +{{- $_ := (set $container "ports" (concat (default (list ) $container.ports) (list (mustMergeOverwrite (dict "containerPort" 0 ) (dict "name" (printf "kafka-%.8s" (lower $externalName)) "containerPort" ($external.port | int) ))))) -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_ := (set $container "ports" (concat (default (list ) $container.ports) (list (mustMergeOverwrite (dict "containerPort" 0 ) (dict "name" "rpc" "containerPort" ($values.listeners.rpc.port | int) ))))) -}} +{{- $_ := (set $container "ports" (concat (default (list ) $container.ports) (list (mustMergeOverwrite (dict "containerPort" 0 ) (dict "name" "schemaregistry" "containerPort" ($values.listeners.schemaRegistry.port | int) ))))) -}} +{{- range $externalName, $external := $values.listeners.schemaRegistry.external -}} +{{- if (get (fromJson (include "redpanda.SchemaRegistryExternal.IsEnabled" (dict "a" (list $external) ))) "r") -}} +{{- $_ := (set $container "ports" (concat (default (list ) $container.ports) (list (mustMergeOverwrite (dict "containerPort" 0 ) (dict "name" (printf "schema-%.8s" (lower $externalName)) "containerPort" ($external.port | int) ))))) -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- if (and (get (fromJson (include "redpanda.Storage.IsTieredStorageEnabled" (dict "a" (list $values.storage) ))) "r") (ne (get (fromJson (include "redpanda.Storage.TieredMountType" (dict "a" (list $values.storage) ))) "r") "none")) -}} +{{- $name := "tiered-storage-dir" -}} +{{- if (and (ne (toJson $values.storage.persistentVolume) "null") (ne $values.storage.persistentVolume.nameOverwrite "")) -}} +{{- $name = $values.storage.persistentVolume.nameOverwrite -}} +{{- end -}} +{{- $_ := (set $container "volumeMounts" (concat (default (list ) $container.volumeMounts) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" $name "mountPath" (get (fromJson (include "redpanda.Storage.TieredCacheDirectory" (dict "a" (list $values.storage $dot) ))) "r") ))))) -}} +{{- end -}} +{{- $_ := (set $container.resources "limits" (dict "cpu" $values.resources.cpu.cores "memory" $values.resources.memory.container.max )) -}} +{{- if (ne (toJson $values.resources.memory.container.min) "null") -}} +{{- $_ := (set $container.resources "requests" (dict "cpu" $values.resources.cpu.cores "memory" $values.resources.memory.container.min )) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $container) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.adminApiURLs" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf `${SERVICE_NAME}.%s:%d` (get (fromJson (include "redpanda.InternalDomain" (dict "a" (list $dot) ))) "r") ($values.listeners.admin.port | int))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.statefulSetContainerConfigWatcher" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.statefulset.sideCars.configWatcher.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "name" "" "resources" (dict ) ) (dict "name" "config-watcher" "image" (printf `%s:%s` $values.image.repository (get (fromJson (include "redpanda.Tag" (dict "a" (list $dot) ))) "r")) "command" (list `/bin/sh`) "args" (list `-c` `trap "exit 0" TERM; exec /etc/secrets/config-watcher/scripts/sasl-user.sh & wait $!`) "env" (get (fromJson (include "redpanda.rpkEnvVars" (dict "a" (list $dot (coalesce nil)) ))) "r") "resources" $values.statefulset.sideCars.configWatcher.resources "securityContext" $values.statefulset.sideCars.configWatcher.securityContext "volumeMounts" (concat (default (list ) (concat (default (list ) (get (fromJson (include "redpanda.CommonMounts" (dict "a" (list $dot) ))) "r")) (list (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" "config" "mountPath" "/etc/redpanda" )) (mustMergeOverwrite (dict "name" "" "mountPath" "" ) (dict "name" (printf `%s-config-watcher` (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) "mountPath" "/etc/secrets/config-watcher/scripts" ))))) (default (list ) (get (fromJson (include "redpanda.templateToVolumeMounts" (dict "a" (list $dot $values.statefulset.sideCars.configWatcher.extraVolumeMounts) ))) "r"))) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.statefulSetContainerControllers" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (or (not $values.rbac.enabled) (not $values.statefulset.sideCars.controllers.enabled)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "name" "" "resources" (dict ) ) (dict "name" "redpanda-controllers" "image" (printf `%s:%s` $values.statefulset.sideCars.controllers.image.repository $values.statefulset.sideCars.controllers.image.tag) "command" (list `/manager`) "args" (list `--operator-mode=false` (printf `--namespace=%s` $dot.Release.Namespace) (printf `--health-probe-bind-address=%s` $values.statefulset.sideCars.controllers.healthProbeAddress) (printf `--metrics-bind-address=%s` $values.statefulset.sideCars.controllers.metricsAddress) (printf `--additional-controllers=%s` (join "," $values.statefulset.sideCars.controllers.run))) "env" (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "REDPANDA_HELM_RELEASE_NAME" "value" $dot.Release.Name ))) "resources" $values.statefulset.sideCars.controllers.resources "securityContext" $values.statefulset.sideCars.controllers.securityContext ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.rpkEnvVars" -}} +{{- $dot := (index .a 0) -}} +{{- $envVars := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (and (ne (toJson $values.auth.sasl) "null") $values.auth.sasl.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (concat (default (list ) $envVars) (default (list ) (get (fromJson (include "redpanda.BootstrapUser.RpkEnvironment" (dict "a" (list $values.auth.sasl.bootstrapUser (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) ))) "r")))) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $envVars) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.bootstrapEnvVars" -}} +{{- $dot := (index .a 0) -}} +{{- $envVars := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (and (ne (toJson $values.auth.sasl) "null") $values.auth.sasl.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (concat (default (list ) $envVars) (default (list ) (get (fromJson (include "redpanda.BootstrapUser.BootstrapEnvironment" (dict "a" (list $values.auth.sasl.bootstrapUser (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r")) ))) "r")))) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $envVars) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.templateToVolumeMounts" -}} +{{- $dot := (index .a 0) -}} +{{- $template := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $result := (tpl $template $dot) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (fromYamlArray $result)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.templateToVolumes" -}} +{{- $dot := (index .a 0) -}} +{{- $template := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $result := (tpl $template $dot) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (fromYamlArray $result)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.templateToContainers" -}} +{{- $dot := (index .a 0) -}} +{{- $template := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $result := (tpl $template $dot) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (fromYamlArray $result)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.StatefulSet" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (and (not (get (fromJson (include "redpanda.RedpandaAtLeast_22_2_0" (dict "a" (list $dot) ))) "r")) (not $values.force)) -}} +{{- $sv := (get (fromJson (include "redpanda.semver" (dict "a" (list $dot) ))) "r") -}} +{{- $_ := (fail (printf "Error: The Redpanda version (%s) is no longer supported \nTo accept this risk, run the upgrade again adding `--force=true`\n" $sv)) -}} +{{- end -}} +{{- $ss := (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "selector" (coalesce nil) "template" (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "containers" (coalesce nil) ) ) "serviceName" "" "updateStrategy" (dict ) ) "status" (dict "replicas" 0 "availableReplicas" 0 ) ) (mustMergeOverwrite (dict ) (dict "apiVersion" "apps/v1" "kind" "StatefulSet" )) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (get (fromJson (include "redpanda.Fullname" (dict "a" (list $dot) ))) "r") "namespace" $dot.Release.Namespace "labels" (get (fromJson (include "redpanda.FullLabels" (dict "a" (list $dot) ))) "r") )) "spec" (mustMergeOverwrite (dict "selector" (coalesce nil) "template" (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "containers" (coalesce nil) ) ) "serviceName" "" "updateStrategy" (dict ) ) (dict "selector" (mustMergeOverwrite (dict ) (dict "matchLabels" (get (fromJson (include "redpanda.StatefulSetPodLabelsSelector" (dict "a" (list $dot) ))) "r") )) "serviceName" (get (fromJson (include "redpanda.ServiceName" (dict "a" (list $dot) ))) "r") "replicas" ($values.statefulset.replicas | int) "updateStrategy" $values.statefulset.updateStrategy "podManagementPolicy" "Parallel" "template" (get (fromJson (include "redpanda.StrategicMergePatch" (dict "a" (list $values.statefulset.podTemplate (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "containers" (coalesce nil) ) ) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "labels" (get (fromJson (include "redpanda.StatefulSetPodLabels" (dict "a" (list $dot) ))) "r") "annotations" (get (fromJson (include "redpanda.StatefulSetPodAnnotations" (dict "a" (list $dot (get (fromJson (include "redpanda.statefulSetChecksumAnnotation" (dict "a" (list $dot) ))) "r")) ))) "r") )) "spec" (mustMergeOverwrite (dict "containers" (coalesce nil) ) (dict "terminationGracePeriodSeconds" ($values.statefulset.terminationGracePeriodSeconds | int64) "securityContext" (get (fromJson (include "redpanda.PodSecurityContext" (dict "a" (list $dot) ))) "r") "serviceAccountName" (get (fromJson (include "redpanda.ServiceAccountName" (dict "a" (list $dot) ))) "r") "imagePullSecrets" (default (coalesce nil) $values.imagePullSecrets) "initContainers" (get (fromJson (include "redpanda.StatefulSetInitContainers" (dict "a" (list $dot) ))) "r") "containers" (get (fromJson (include "redpanda.StatefulSetContainers" (dict "a" (list $dot) ))) "r") "volumes" (get (fromJson (include "redpanda.StatefulSetVolumes" (dict "a" (list $dot) ))) "r") "topologySpreadConstraints" (get (fromJson (include "redpanda.statefulSetTopologySpreadConstraints" (dict "a" (list $dot) ))) "r") "nodeSelector" (get (fromJson (include "redpanda.statefulSetNodeSelectors" (dict "a" (list $dot) ))) "r") "affinity" (get (fromJson (include "redpanda.statefulSetAffinity" (dict "a" (list $dot) ))) "r") "priorityClassName" $values.statefulset.priorityClassName "tolerations" (get (fromJson (include "redpanda.statefulSetTolerations" (dict "a" (list $dot) ))) "r") )) ))) ))) "r") "volumeClaimTemplates" (coalesce nil) )) )) -}} +{{- if (or $values.storage.persistentVolume.enabled ((and (get (fromJson (include "redpanda.Storage.IsTieredStorageEnabled" (dict "a" (list $values.storage) ))) "r") (eq (get (fromJson (include "redpanda.Storage.TieredMountType" (dict "a" (list $values.storage) ))) "r") "persistentVolume")))) -}} +{{- $t_13 := (get (fromJson (include "redpanda.volumeClaimTemplateDatadir" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne (toJson $t_13) "null") -}} +{{- $_ := (set $ss.spec "volumeClaimTemplates" (concat (default (list ) $ss.spec.volumeClaimTemplates) (list $t_13))) -}} +{{- end -}} +{{- $t_14 := (get (fromJson (include "redpanda.volumeClaimTemplateTieredStorageDir" (dict "a" (list $dot) ))) "r") -}} +{{- if (ne (toJson $t_14) "null") -}} +{{- $_ := (set $ss.spec "volumeClaimTemplates" (concat (default (list ) $ss.spec.volumeClaimTemplates) (list $t_14))) -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $ss) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.semver" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (trimPrefix "v" (get (fromJson (include "redpanda.Tag" (dict "a" (list $dot) ))) "r"))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.statefulSetChecksumAnnotation" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $dependencies := (coalesce nil) -}} +{{- $dependencies = (concat (default (list ) $dependencies) (list (get (fromJson (include "redpanda.RedpandaConfigFile" (dict "a" (list $dot false) ))) "r"))) -}} +{{- if $values.external.enabled -}} +{{- $dependencies = (concat (default (list ) $dependencies) (list (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $values.external.domain "") ))) "r"))) -}} +{{- if (empty $values.external.addresses) -}} +{{- $dependencies = (concat (default (list ) $dependencies) (list "")) -}} +{{- else -}} +{{- $dependencies = (concat (default (list ) $dependencies) (list $values.external.addresses)) -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (sha256sum (toJson $dependencies))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.statefulSetTolerations" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $_is_returning = true -}} +{{- (dict "r" (default $values.tolerations $values.statefulset.tolerations)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.statefulSetNodeSelectors" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $_is_returning = true -}} +{{- (dict "r" (default $values.statefulset.nodeSelector $values.nodeSelector)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.statefulSetAffinity" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $affinity := (mustMergeOverwrite (dict ) (dict )) -}} +{{- if (not (empty $values.statefulset.nodeAffinity)) -}} +{{- $_ := (set $affinity "nodeAffinity" $values.statefulset.nodeAffinity) -}} +{{- else -}}{{- if (not (empty $values.affinity.nodeAffinity)) -}} +{{- $_ := (set $affinity "nodeAffinity" $values.affinity.nodeAffinity) -}} +{{- end -}} +{{- end -}} +{{- if (not (empty $values.statefulset.podAffinity)) -}} +{{- $_ := (set $affinity "podAffinity" $values.statefulset.podAffinity) -}} +{{- else -}}{{- if (not (empty $values.affinity.podAffinity)) -}} +{{- $_ := (set $affinity "podAffinity" $values.affinity.podAffinity) -}} +{{- end -}} +{{- end -}} +{{- if (not (empty $values.statefulset.podAntiAffinity)) -}} +{{- $_ := (set $affinity "podAntiAffinity" (mustMergeOverwrite (dict ) (dict ))) -}} +{{- if (eq $values.statefulset.podAntiAffinity.type "hard") -}} +{{- $_ := (set $affinity.podAntiAffinity "requiredDuringSchedulingIgnoredDuringExecution" (list (mustMergeOverwrite (dict "topologyKey" "" ) (dict "topologyKey" $values.statefulset.podAntiAffinity.topologyKey "labelSelector" (mustMergeOverwrite (dict ) (dict "matchLabels" (get (fromJson (include "redpanda.StatefulSetPodLabelsSelector" (dict "a" (list $dot) ))) "r") )) )))) -}} +{{- else -}}{{- if (eq $values.statefulset.podAntiAffinity.type "soft") -}} +{{- $_ := (set $affinity.podAntiAffinity "preferredDuringSchedulingIgnoredDuringExecution" (list (mustMergeOverwrite (dict "weight" 0 "podAffinityTerm" (dict "topologyKey" "" ) ) (dict "weight" ($values.statefulset.podAntiAffinity.weight | int) "podAffinityTerm" (mustMergeOverwrite (dict "topologyKey" "" ) (dict "topologyKey" $values.statefulset.podAntiAffinity.topologyKey "labelSelector" (mustMergeOverwrite (dict ) (dict "matchLabels" (get (fromJson (include "redpanda.StatefulSetPodLabelsSelector" (dict "a" (list $dot) ))) "r") )) )) )))) -}} +{{- else -}}{{- if (eq $values.statefulset.podAntiAffinity.type "custom") -}} +{{- $_ := (set $affinity "podAntiAffinity" $values.statefulset.podAntiAffinity.custom) -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- else -}}{{- if (not (empty $values.affinity.podAntiAffinity)) -}} +{{- $_ := (set $affinity "podAntiAffinity" $values.affinity.podAntiAffinity) -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $affinity) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.volumeClaimTemplateDatadir" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (not $values.storage.persistentVolume.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $pvc := (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "resources" (dict ) ) "status" (dict ) ) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" "datadir" "labels" (merge (dict ) (dict `app.kubernetes.io/name` (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r") `app.kubernetes.io/instance` $dot.Release.Name `app.kubernetes.io/component` (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r") ) $values.storage.persistentVolume.labels $values.commonLabels) "annotations" (default (coalesce nil) $values.storage.persistentVolume.annotations) )) "spec" (mustMergeOverwrite (dict "resources" (dict ) ) (dict "accessModes" (list "ReadWriteOnce") "resources" (mustMergeOverwrite (dict ) (dict "requests" (dict "storage" $values.storage.persistentVolume.size ) )) )) )) -}} +{{- if (not (empty $values.storage.persistentVolume.storageClass)) -}} +{{- if (eq $values.storage.persistentVolume.storageClass "-") -}} +{{- $_ := (set $pvc.spec "storageClassName" "") -}} +{{- else -}} +{{- $_ := (set $pvc.spec "storageClassName" $values.storage.persistentVolume.storageClass) -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $pvc) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.volumeClaimTemplateTieredStorageDir" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- if (or (not (get (fromJson (include "redpanda.Storage.IsTieredStorageEnabled" (dict "a" (list $values.storage) ))) "r")) (ne (get (fromJson (include "redpanda.Storage.TieredMountType" (dict "a" (list $values.storage) ))) "r") "persistentVolume")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $pvc := (mustMergeOverwrite (dict "metadata" (dict "creationTimestamp" (coalesce nil) ) "spec" (dict "resources" (dict ) ) "status" (dict ) ) (dict "metadata" (mustMergeOverwrite (dict "creationTimestamp" (coalesce nil) ) (dict "name" (default "tiered-storage-dir" $values.storage.persistentVolume.nameOverwrite) "labels" (merge (dict ) (dict `app.kubernetes.io/name` (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r") `app.kubernetes.io/instance` $dot.Release.Name `app.kubernetes.io/component` (get (fromJson (include "redpanda.Name" (dict "a" (list $dot) ))) "r") ) (get (fromJson (include "redpanda.Storage.TieredPersistentVolumeLabels" (dict "a" (list $values.storage) ))) "r") $values.commonLabels) "annotations" (default (coalesce nil) (get (fromJson (include "redpanda.Storage.TieredPersistentVolumeAnnotations" (dict "a" (list $values.storage) ))) "r")) )) "spec" (mustMergeOverwrite (dict "resources" (dict ) ) (dict "accessModes" (list "ReadWriteOnce") "resources" (mustMergeOverwrite (dict ) (dict "requests" (dict "storage" (index (get (fromJson (include "redpanda.Storage.GetTieredStorageConfig" (dict "a" (list $values.storage) ))) "r") `cloud_storage_cache_size`) ) )) )) )) -}} +{{- $sc_15 := (get (fromJson (include "redpanda.Storage.TieredPersistentVolumeStorageClass" (dict "a" (list $values.storage) ))) "r") -}} +{{- if (eq $sc_15 "-") -}} +{{- $_ := (set $pvc.spec "storageClassName" "") -}} +{{- else -}}{{- if (not (empty $sc_15)) -}} +{{- $_ := (set $pvc.spec "storageClassName" $sc_15) -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $pvc) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.statefulSetTopologySpreadConstraints" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $result := (coalesce nil) -}} +{{- $labelSelector := (mustMergeOverwrite (dict ) (dict "matchLabels" (get (fromJson (include "redpanda.StatefulSetPodLabelsSelector" (dict "a" (list $dot) ))) "r") )) -}} +{{- range $_, $v := $values.statefulset.topologySpreadConstraints -}} +{{- $result = (concat (default (list ) $result) (list (mustMergeOverwrite (dict "maxSkew" 0 "topologyKey" "" "whenUnsatisfiable" "" ) (dict "maxSkew" ($v.maxSkew | int) "topologyKey" $v.topologyKey "whenUnsatisfiable" $v.whenUnsatisfiable "labelSelector" $labelSelector )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.StorageTieredConfig" -}} +{{- $dot := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.Storage.GetTieredStorageConfig" (dict "a" (list $values.storage) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/_values.go.tpl b/charts/redpanda/redpanda/5.9.7/templates/_values.go.tpl new file mode 100644 index 000000000..5b802d218 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/_values.go.tpl @@ -0,0 +1,1326 @@ +{{- /* Generated from "values.go" */ -}} + +{{- define "redpanda.AuditLogging.Translate" -}} +{{- $a := (index .a 0) -}} +{{- $dot := (index .a 1) -}} +{{- $isSASLEnabled := (index .a 2) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $result := (dict ) -}} +{{- if (not (get (fromJson (include "redpanda.RedpandaAtLeast_23_3_0" (dict "a" (list $dot) ))) "r")) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- $enabled := (and $a.enabled $isSASLEnabled) -}} +{{- $_ := (set $result "audit_enabled" $enabled) -}} +{{- if (not $enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (ne (($a.clientMaxBufferSize | int) | int) (16777216 | int)) -}} +{{- $_ := (set $result "audit_client_max_buffer_size" ($a.clientMaxBufferSize | int)) -}} +{{- end -}} +{{- if (ne (($a.queueDrainIntervalMs | int) | int) (500 | int)) -}} +{{- $_ := (set $result "audit_queue_drain_interval_ms" ($a.queueDrainIntervalMs | int)) -}} +{{- end -}} +{{- if (ne (($a.queueMaxBufferSizePerShard | int) | int) (1048576 | int)) -}} +{{- $_ := (set $result "audit_queue_max_buffer_size_per_shard" ($a.queueMaxBufferSizePerShard | int)) -}} +{{- end -}} +{{- if (ne (($a.partitions | int) | int) (12 | int)) -}} +{{- $_ := (set $result "audit_log_num_partitions" ($a.partitions | int)) -}} +{{- end -}} +{{- if (ne ($a.replicationFactor | int) (0 | int)) -}} +{{- $_ := (set $result "audit_log_replication_factor" ($a.replicationFactor | int)) -}} +{{- end -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $a.enabledEventTypes) ))) "r") | int) (0 | int)) -}} +{{- $_ := (set $result "audit_enabled_event_types" $a.enabledEventTypes) -}} +{{- end -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $a.excludedTopics) ))) "r") | int) (0 | int)) -}} +{{- $_ := (set $result "audit_excluded_topics" $a.excludedTopics) -}} +{{- end -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $a.excludedPrincipals) ))) "r") | int) (0 | int)) -}} +{{- $_ := (set $result "audit_excluded_principals" $a.excludedPrincipals) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Auth.IsSASLEnabled" -}} +{{- $a := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (eq (toJson $a.sasl) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" false) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $a.sasl.enabled) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Auth.Translate" -}} +{{- $a := (index .a 0) -}} +{{- $isSASLEnabled := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (not $isSASLEnabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $users := (list (get (fromJson (include "redpanda.BootstrapUser.Username" (dict "a" (list $a.sasl.bootstrapUser) ))) "r")) -}} +{{- range $_, $u := $a.sasl.users -}} +{{- $users = (concat (default (list ) $users) (list $u.name)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (dict "superusers" $users )) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Logging.Translate" -}} +{{- $l := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $result := (dict ) -}} +{{- $clusterID_1 := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $l.usageStats.clusterId "") ))) "r") -}} +{{- if (ne $clusterID_1 "") -}} +{{- $_ := (set $result "cluster_id" $clusterID_1) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.RedpandaResources.GetOverProvisionValue" -}} +{{- $rr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (lt ((get (fromJson (include "_shims.resource_MilliValue" (dict "a" (list $rr.cpu.cores) ))) "r") | int64) (1000 | int64)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" true) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $rr.cpu.overprovisioned false) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Storage.IsTieredStorageEnabled" -}} +{{- $s := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $conf := (get (fromJson (include "redpanda.Storage.GetTieredStorageConfig" (dict "a" (list $s) ))) "r") -}} +{{- $tmp_tuple_3 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $conf "cloud_storage_enabled" (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok := $tmp_tuple_3.T2 -}} +{{- $b := $tmp_tuple_3.T1 -}} +{{- $_is_returning = true -}} +{{- (dict "r" (and $ok (get (fromJson (include "_shims.typeassertion" (dict "a" (list "bool" $b) ))) "r"))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Storage.GetTieredStorageConfig" -}} +{{- $s := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $s.tieredConfig) ))) "r") | int) (0 | int)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $s.tieredConfig) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $s.tiered.config) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Storage.GetTieredStorageHostPath" -}} +{{- $s := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $hp := $s.tieredStorageHostPath -}} +{{- if (empty $hp) -}} +{{- $hp = $s.tiered.hostPath -}} +{{- end -}} +{{- if (empty $hp) -}} +{{- $_ := (fail (printf `storage.tiered.mountType is "%s" but storage.tiered.hostPath is empty` $s.tiered.mountType)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $hp) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Storage.TieredCacheDirectory" -}} +{{- $s := (index .a 0) -}} +{{- $dot := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $values := $dot.Values.AsMap -}} +{{- $tmp_tuple_4 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.typetest" (dict "a" (list "string" (index $values.config.node "cloud_storage_cache_directory") "") ))) "r")) ))) "r") -}} +{{- $ok_3 := $tmp_tuple_4.T2 -}} +{{- $dir_2 := $tmp_tuple_4.T1 -}} +{{- if $ok_3 -}} +{{- $_is_returning = true -}} +{{- (dict "r" $dir_2) | toJson -}} +{{- break -}} +{{- end -}} +{{- $tieredConfig := (get (fromJson (include "redpanda.Storage.GetTieredStorageConfig" (dict "a" (list $values.storage) ))) "r") -}} +{{- $tmp_tuple_5 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.typetest" (dict "a" (list "string" (index $tieredConfig "cloud_storage_cache_directory") "") ))) "r")) ))) "r") -}} +{{- $ok_5 := $tmp_tuple_5.T2 -}} +{{- $dir_4 := $tmp_tuple_5.T1 -}} +{{- if $ok_5 -}} +{{- $_is_returning = true -}} +{{- (dict "r" $dir_4) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" "/var/lib/redpanda/data/cloud_storage_cache") | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Storage.TieredMountType" -}} +{{- $s := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (and (ne (toJson $s.tieredStoragePersistentVolume) "null") $s.tieredStoragePersistentVolume.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" "persistentVolume") | toJson -}} +{{- break -}} +{{- end -}} +{{- if (not (empty $s.tieredStorageHostPath)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" "hostPath") | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $s.tiered.mountType) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Storage.TieredPersistentVolumeLabels" -}} +{{- $s := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (ne (toJson $s.tieredStoragePersistentVolume) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" $s.tieredStoragePersistentVolume.labels) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $s.tiered.persistentVolume.labels) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Storage.TieredPersistentVolumeAnnotations" -}} +{{- $s := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (ne (toJson $s.tieredStoragePersistentVolume) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" $s.tieredStoragePersistentVolume.annotations) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $s.tiered.persistentVolume.annotations) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Storage.TieredPersistentVolumeStorageClass" -}} +{{- $s := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (ne (toJson $s.tieredStoragePersistentVolume) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" $s.tieredStoragePersistentVolume.storageClass) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $s.tiered.persistentVolume.storageClass) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Storage.StorageMinFreeBytes" -}} +{{- $s := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (and (ne (toJson $s.persistentVolume) "null") (not $s.persistentVolume.enabled)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (5368709120 | int)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $minimumFreeBytes := ((mulf (((get (fromJson (include "_shims.resource_Value" (dict "a" (list $s.persistentVolume.size) ))) "r") | int64) | float64) 0.05) | float64) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (min (5368709120 | int) ($minimumFreeBytes | int64))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Tuning.Translate" -}} +{{- $t := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $result := (dict ) -}} +{{- $s := (toJson $t) -}} +{{- $tune := (fromJson $s) -}} +{{- $tmp_tuple_7 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.typetest" (dict "a" (list (printf "map[%s]%s" "string" "interface {}") $tune (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok := $tmp_tuple_7.T2 -}} +{{- $m := $tmp_tuple_7.T1 -}} +{{- if (not $ok) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (dict )) | toJson -}} +{{- break -}} +{{- end -}} +{{- range $k, $v := $m -}} +{{- $_ := (set $result $k $v) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Listeners.CreateSeedServers" -}} +{{- $l := (index .a 0) -}} +{{- $replicas := (index .a 1) -}} +{{- $fullname := (index .a 2) -}} +{{- $internalDomain := (index .a 3) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $result := (coalesce nil) -}} +{{- range $_, $i := untilStep (((0 | int) | int)|int) ($replicas|int) (1|int) -}} +{{- $result = (concat (default (list ) $result) (list (dict "host" (dict "address" (printf "%s-%d.%s" $fullname $i $internalDomain) "port" ($l.rpc.port | int) ) ))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Listeners.AdminList" -}} +{{- $l := (index .a 0) -}} +{{- $replicas := (index .a 1) -}} +{{- $fullname := (index .a 2) -}} +{{- $internalDomain := (index .a 3) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.ServerList" (dict "a" (list $replicas "" $fullname $internalDomain ($l.admin.port | int)) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.ServerList" -}} +{{- $replicas := (index .a 0) -}} +{{- $prefix := (index .a 1) -}} +{{- $fullname := (index .a 2) -}} +{{- $internalDomain := (index .a 3) -}} +{{- $port := (index .a 4) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $result := (coalesce nil) -}} +{{- range $_, $i := untilStep (((0 | int) | int)|int) ($replicas|int) (1|int) -}} +{{- $result = (concat (default (list ) $result) (list (printf "%s%s-%d.%s:%d" $prefix $fullname $i $internalDomain ($port | int)))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Listeners.TrustStoreVolume" -}} +{{- $l := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $cmSources := (dict ) -}} +{{- $secretSources := (dict ) -}} +{{- range $_, $ts := (get (fromJson (include "redpanda.Listeners.TrustStores" (dict "a" (list $l $tls) ))) "r") -}} +{{- $projection := (get (fromJson (include "redpanda.TrustStore.VolumeProjection" (dict "a" (list $ts) ))) "r") -}} +{{- if (ne (toJson $projection.secret) "null") -}} +{{- $_ := (set $secretSources $projection.secret.name (concat (default (list ) (index $secretSources $projection.secret.name)) (default (list ) $projection.secret.items))) -}} +{{- else -}} +{{- $_ := (set $cmSources $projection.configMap.name (concat (default (list ) (index $cmSources $projection.configMap.name)) (default (list ) $projection.configMap.items))) -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $sources := (coalesce nil) -}} +{{- range $_, $name := (sortAlpha (keys $cmSources)) -}} +{{- $keys := (index $cmSources $name) -}} +{{- $sources = (concat (default (list ) $sources) (list (mustMergeOverwrite (dict ) (dict "configMap" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "name" $name )) (dict "items" (get (fromJson (include "redpanda.dedupKeyToPaths" (dict "a" (list $keys) ))) "r") )) )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- range $_, $name := (sortAlpha (keys $secretSources)) -}} +{{- $keys := (index $secretSources $name) -}} +{{- $sources = (concat (default (list ) $sources) (list (mustMergeOverwrite (dict ) (dict "secret" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "name" $name )) (dict "items" (get (fromJson (include "redpanda.dedupKeyToPaths" (dict "a" (list $keys) ))) "r") )) )))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- if (lt ((get (fromJson (include "_shims.len" (dict "a" (list $sources) ))) "r") | int) (1 | int)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "name" "" ) (mustMergeOverwrite (dict ) (dict "projected" (mustMergeOverwrite (dict "sources" (coalesce nil) ) (dict "sources" $sources )) )) (dict "name" "truststores" ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.dedupKeyToPaths" -}} +{{- $items := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $seen := (dict ) -}} +{{- $deduped := (coalesce nil) -}} +{{- range $_, $item := $items -}} +{{- $tmp_tuple_8 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $seen $item.key (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok_6 := $tmp_tuple_8.T2 -}} +{{- if $ok_6 -}} +{{- continue -}} +{{- end -}} +{{- $deduped = (concat (default (list ) $deduped) (list $item)) -}} +{{- $_ := (set $seen $item.key true) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $deduped) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Listeners.TrustStores" -}} +{{- $l := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tss := (get (fromJson (include "redpanda.KafkaListeners.TrustStores" (dict "a" (list $l.kafka $tls) ))) "r") -}} +{{- $tss = (concat (default (list ) $tss) (default (list ) (get (fromJson (include "redpanda.AdminListeners.TrustStores" (dict "a" (list $l.admin $tls) ))) "r"))) -}} +{{- $tss = (concat (default (list ) $tss) (default (list ) (get (fromJson (include "redpanda.HTTPListeners.TrustStores" (dict "a" (list $l.http $tls) ))) "r"))) -}} +{{- $tss = (concat (default (list ) $tss) (default (list ) (get (fromJson (include "redpanda.SchemaRegistryListeners.TrustStores" (dict "a" (list $l.schemaRegistry $tls) ))) "r"))) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $tss) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.Config.CreateRPKConfiguration" -}} +{{- $c := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $result := (dict ) -}} +{{- range $k, $v := $c.rpk -}} +{{- $_ := (set $result $k $v) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.TLSCertMap.MustGet" -}} +{{- $m := (index .a 0) -}} +{{- $name := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_9 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $m $name (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok := $tmp_tuple_9.T2 -}} +{{- $cert := $tmp_tuple_9.T1 -}} +{{- if (not $ok) -}} +{{- $_ := (fail (printf "Certificate %q referenced, but not found in the tls.certs map" $name)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $cert) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.BootstrapUser.BootstrapEnvironment" -}} +{{- $b := (index .a 0) -}} +{{- $fullname := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (concat (default (list ) (get (fromJson (include "redpanda.BootstrapUser.RpkEnvironment" (dict "a" (list $b $fullname) ))) "r")) (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "RP_BOOTSTRAP_USER" "value" "$(RPK_USER):$(RPK_PASS):$(RPK_SASL_MECHANISM)" ))))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.BootstrapUser.Username" -}} +{{- $b := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (ne (toJson $b.name) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" $b.name) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" "kubernetes-controller") | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.BootstrapUser.RpkEnvironment" -}} +{{- $b := (index .a 0) -}} +{{- $fullname := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "RPK_PASS" "valueFrom" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (get (fromJson (include "redpanda.BootstrapUser.SecretKeySelector" (dict "a" (list $b $fullname) ))) "r") )) )) (mustMergeOverwrite (dict "name" "" ) (dict "name" "RPK_USER" "value" (get (fromJson (include "redpanda.BootstrapUser.Username" (dict "a" (list $b) ))) "r") )) (mustMergeOverwrite (dict "name" "" ) (dict "name" "RPK_SASL_MECHANISM" "value" (get (fromJson (include "redpanda.BootstrapUser.GetMechanism" (dict "a" (list $b) ))) "r") )))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.BootstrapUser.GetMechanism" -}} +{{- $b := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (eq $b.mechanism "") -}} +{{- $_is_returning = true -}} +{{- (dict "r" "SCRAM-SHA-256") | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $b.mechanism) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.BootstrapUser.SecretKeySelector" -}} +{{- $b := (index .a 0) -}} +{{- $fullname := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (ne (toJson $b.secretKeyRef) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" $b.secretKeyRef) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" (printf "%s-bootstrap-user" $fullname) )) (dict "key" "password" ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.TrustStore.TrustStoreFilePath" -}} +{{- $t := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "%s/%s" "/etc/truststores" (get (fromJson (include "redpanda.TrustStore.RelativePath" (dict "a" (list $t) ))) "r"))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.TrustStore.RelativePath" -}} +{{- $t := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (ne (toJson $t.configMapKeyRef) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "configmaps/%s-%s" $t.configMapKeyRef.name $t.configMapKeyRef.key)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "secrets/%s-%s" $t.secretKeyRef.name $t.secretKeyRef.key)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.TrustStore.VolumeProjection" -}} +{{- $t := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (ne (toJson $t.configMapKeyRef) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict ) (dict "configMap" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "name" $t.configMapKeyRef.name )) (dict "items" (list (mustMergeOverwrite (dict "key" "" "path" "" ) (dict "key" $t.configMapKeyRef.key "path" (get (fromJson (include "redpanda.TrustStore.RelativePath" (dict "a" (list $t) ))) "r") ))) )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict ) (dict "secret" (mustMergeOverwrite (dict ) (mustMergeOverwrite (dict ) (dict "name" $t.secretKeyRef.name )) (dict "items" (list (mustMergeOverwrite (dict "key" "" "path" "" ) (dict "key" $t.secretKeyRef.key "path" (get (fromJson (include "redpanda.TrustStore.RelativePath" (dict "a" (list $t) ))) "r") ))) )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.InternalTLS.IsEnabled" -}} +{{- $t := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (and (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $t.enabled $tls.enabled) ))) "r") (ne $t.cert ""))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.InternalTLS.TrustStoreFilePath" -}} +{{- $t := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (ne (toJson $t.trustStore) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.TrustStore.TrustStoreFilePath" (dict "a" (list $t.trustStore) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (get (fromJson (include "redpanda.TLSCertMap.MustGet" (dict "a" (list (deepCopy $tls.certs) $t.cert) ))) "r").caEnabled -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "/etc/tls/certs/%s/ca.crt" $t.cert)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" "/etc/ssl/certs/ca-certificates.crt") | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.InternalTLS.ServerCAPath" -}} +{{- $t := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (get (fromJson (include "redpanda.TLSCertMap.MustGet" (dict "a" (list (deepCopy $tls.certs) $t.cert) ))) "r").caEnabled -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "/etc/tls/certs/%s/ca.crt" $t.cert)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "/etc/tls/certs/%s/tls.crt" $t.cert)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.ExternalTLS.GetCert" -}} +{{- $t := (index .a 0) -}} +{{- $i := (index .a 1) -}} +{{- $tls := (index .a 2) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.TLSCertMap.MustGet" (dict "a" (list (deepCopy $tls.certs) (get (fromJson (include "redpanda.ExternalTLS.GetCertName" (dict "a" (list $t $i) ))) "r")) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.ExternalTLS.GetCertName" -}} +{{- $t := (index .a 0) -}} +{{- $i := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $t.cert $i.cert) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.ExternalTLS.TrustStoreFilePath" -}} +{{- $t := (index .a 0) -}} +{{- $i := (index .a 1) -}} +{{- $tls := (index .a 2) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (ne (toJson $t.trustStore) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" (get (fromJson (include "redpanda.TrustStore.TrustStoreFilePath" (dict "a" (list $t.trustStore) ))) "r")) | toJson -}} +{{- break -}} +{{- end -}} +{{- if (get (fromJson (include "redpanda.ExternalTLS.GetCert" (dict "a" (list $t $i $tls) ))) "r").caEnabled -}} +{{- $_is_returning = true -}} +{{- (dict "r" (printf "/etc/tls/certs/%s/ca.crt" (get (fromJson (include "redpanda.ExternalTLS.GetCertName" (dict "a" (list $t $i) ))) "r"))) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" "/etc/ssl/certs/ca-certificates.crt") | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.ExternalTLS.IsEnabled" -}} +{{- $t := (index .a 0) -}} +{{- $i := (index .a 1) -}} +{{- $tls := (index .a 2) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (eq (toJson $t) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" false) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" (and (ne (get (fromJson (include "redpanda.ExternalTLS.GetCertName" (dict "a" (list $t $i) ))) "r") "") (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $t.enabled (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $i $tls) ))) "r")) ))) "r"))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.AdminListeners.ConsoleTLS" -}} +{{- $l := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $t := (mustMergeOverwrite (dict "enabled" false "caFilepath" "" "certFilepath" "" "keyFilepath" "" "insecureSkipTlsVerify" false ) (dict "enabled" (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $l.tls $tls) ))) "r") )) -}} +{{- if (not $t.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $t) | toJson -}} +{{- break -}} +{{- end -}} +{{- $adminAPIPrefix := "/mnt/cert/adminapi" -}} +{{- $_ := (set $t "caFilepath" (printf "%s/%s/ca.crt" $adminAPIPrefix $l.tls.cert)) -}} +{{- if (not $l.tls.requireClientAuth) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $t) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_ := (set $t "certFilepath" (printf "%s/%s/tls.crt" $adminAPIPrefix $l.tls.cert)) -}} +{{- $_ := (set $t "keyFilepath" (printf "%s/%s/tls.key" $adminAPIPrefix $l.tls.cert)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $t) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.AdminListeners.Listeners" -}} +{{- $l := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $admin := (list (get (fromJson (include "redpanda.createInternalListenerCfg" (dict "a" (list ($l.port | int)) ))) "r")) -}} +{{- range $k, $lis := $l.external -}} +{{- if (not (get (fromJson (include "redpanda.AdminExternal.IsEnabled" (dict "a" (list $lis) ))) "r")) -}} +{{- continue -}} +{{- end -}} +{{- $admin = (concat (default (list ) $admin) (list (dict "name" $k "port" ($lis.port | int) "address" "0.0.0.0" ))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $admin) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.AdminListeners.ListenersTLS" -}} +{{- $l := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $admin := (list ) -}} +{{- $internal := (get (fromJson (include "redpanda.createInternalListenerTLSCfg" (dict "a" (list $tls $l.tls) ))) "r") -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $internal) ))) "r") | int) (0 | int)) -}} +{{- $admin = (concat (default (list ) $admin) (list $internal)) -}} +{{- end -}} +{{- range $k, $lis := $l.external -}} +{{- if (or (not (get (fromJson (include "redpanda.AdminExternal.IsEnabled" (dict "a" (list $lis) ))) "r")) (not (get (fromJson (include "redpanda.ExternalTLS.IsEnabled" (dict "a" (list $lis.tls $l.tls $tls) ))) "r"))) -}} +{{- continue -}} +{{- end -}} +{{- $certName := (get (fromJson (include "redpanda.ExternalTLS.GetCertName" (dict "a" (list $lis.tls $l.tls) ))) "r") -}} +{{- $admin = (concat (default (list ) $admin) (list (dict "name" $k "enabled" true "cert_file" (printf "/etc/tls/certs/%s/tls.crt" $certName) "key_file" (printf "/etc/tls/certs/%s/tls.key" $certName) "require_client_auth" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $lis.tls.requireClientAuth false) ))) "r") "truststore_file" (get (fromJson (include "redpanda.ExternalTLS.TrustStoreFilePath" (dict "a" (list $lis.tls $l.tls $tls) ))) "r") ))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $admin) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.AdminListeners.TrustStores" -}} +{{- $l := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tss := (list ) -}} +{{- if (and (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $l.tls $tls) ))) "r") (ne (toJson $l.tls.trustStore) "null")) -}} +{{- $tss = (concat (default (list ) $tss) (list $l.tls.trustStore)) -}} +{{- end -}} +{{- range $_, $key := (sortAlpha (keys $l.external)) -}} +{{- $lis := (index $l.external $key) -}} +{{- if (or (or (not (get (fromJson (include "redpanda.AdminExternal.IsEnabled" (dict "a" (list $lis) ))) "r")) (not (get (fromJson (include "redpanda.ExternalTLS.IsEnabled" (dict "a" (list $lis.tls $l.tls $tls) ))) "r"))) (eq (toJson $lis.tls.trustStore) "null")) -}} +{{- continue -}} +{{- end -}} +{{- $tss = (concat (default (list ) $tss) (list $lis.tls.trustStore)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $tss) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.AdminExternal.IsEnabled" -}} +{{- $l := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (and (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $l.enabled true) ))) "r") (gt ($l.port | int) (0 | int)))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.HTTPListeners.Listeners" -}} +{{- $l := (index .a 0) -}} +{{- $saslEnabled := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $internal := (get (fromJson (include "redpanda.createInternalListenerCfg" (dict "a" (list ($l.port | int)) ))) "r") -}} +{{- if $saslEnabled -}} +{{- $_ := (set $internal "authentication_method" "http_basic") -}} +{{- end -}} +{{- $am_7 := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $l.authenticationMethod "") ))) "r") -}} +{{- if (ne $am_7 "") -}} +{{- $_ := (set $internal "authentication_method" $am_7) -}} +{{- end -}} +{{- $result := (list $internal) -}} +{{- range $k, $l := $l.external -}} +{{- if (not (get (fromJson (include "redpanda.HTTPExternal.IsEnabled" (dict "a" (list $l) ))) "r")) -}} +{{- continue -}} +{{- end -}} +{{- $listener := (dict "name" $k "port" ($l.port | int) "address" "0.0.0.0" ) -}} +{{- if $saslEnabled -}} +{{- $_ := (set $listener "authentication_method" "http_basic") -}} +{{- end -}} +{{- $am_8 := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $l.authenticationMethod "") ))) "r") -}} +{{- if (ne $am_8 "") -}} +{{- $_ := (set $listener "authentication_method" $am_8) -}} +{{- end -}} +{{- $result = (concat (default (list ) $result) (list $listener)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.HTTPListeners.ListenersTLS" -}} +{{- $l := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $pp := (list ) -}} +{{- $internal := (get (fromJson (include "redpanda.createInternalListenerTLSCfg" (dict "a" (list $tls $l.tls) ))) "r") -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $internal) ))) "r") | int) (0 | int)) -}} +{{- $pp = (concat (default (list ) $pp) (list $internal)) -}} +{{- end -}} +{{- range $k, $lis := $l.external -}} +{{- if (or (not (get (fromJson (include "redpanda.HTTPExternal.IsEnabled" (dict "a" (list $lis) ))) "r")) (not (get (fromJson (include "redpanda.ExternalTLS.IsEnabled" (dict "a" (list $lis.tls $l.tls $tls) ))) "r"))) -}} +{{- continue -}} +{{- end -}} +{{- $certName := (get (fromJson (include "redpanda.ExternalTLS.GetCertName" (dict "a" (list $lis.tls $l.tls) ))) "r") -}} +{{- $pp = (concat (default (list ) $pp) (list (dict "name" $k "enabled" true "cert_file" (printf "/etc/tls/certs/%s/tls.crt" $certName) "key_file" (printf "/etc/tls/certs/%s/tls.key" $certName) "require_client_auth" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $lis.tls.requireClientAuth false) ))) "r") "truststore_file" (get (fromJson (include "redpanda.ExternalTLS.TrustStoreFilePath" (dict "a" (list $lis.tls $l.tls $tls) ))) "r") ))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $pp) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.HTTPListeners.TrustStores" -}} +{{- $l := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tss := (coalesce nil) -}} +{{- if (and (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $l.tls $tls) ))) "r") (ne (toJson $l.tls.trustStore) "null")) -}} +{{- $tss = (concat (default (list ) $tss) (list $l.tls.trustStore)) -}} +{{- end -}} +{{- range $_, $key := (sortAlpha (keys $l.external)) -}} +{{- $lis := (index $l.external $key) -}} +{{- if (or (or (not (get (fromJson (include "redpanda.HTTPExternal.IsEnabled" (dict "a" (list $lis) ))) "r")) (not (get (fromJson (include "redpanda.ExternalTLS.IsEnabled" (dict "a" (list $lis.tls $l.tls $tls) ))) "r"))) (eq (toJson $lis.tls.trustStore) "null")) -}} +{{- continue -}} +{{- end -}} +{{- $tss = (concat (default (list ) $tss) (list $lis.tls.trustStore)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $tss) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.HTTPExternal.IsEnabled" -}} +{{- $l := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (and (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $l.enabled true) ))) "r") (gt ($l.port | int) (0 | int)))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.KafkaListeners.Listeners" -}} +{{- $l := (index .a 0) -}} +{{- $auth := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $internal := (get (fromJson (include "redpanda.createInternalListenerCfg" (dict "a" (list ($l.port | int)) ))) "r") -}} +{{- if (get (fromJson (include "redpanda.Auth.IsSASLEnabled" (dict "a" (list $auth) ))) "r") -}} +{{- $_ := (set $internal "authentication_method" "sasl") -}} +{{- end -}} +{{- $am_9 := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $l.authenticationMethod "") ))) "r") -}} +{{- if (ne $am_9 "") -}} +{{- $_ := (set $internal "authentication_method" $am_9) -}} +{{- end -}} +{{- $kafka := (list $internal) -}} +{{- range $k, $l := $l.external -}} +{{- if (not (get (fromJson (include "redpanda.KafkaExternal.IsEnabled" (dict "a" (list $l) ))) "r")) -}} +{{- continue -}} +{{- end -}} +{{- $listener := (dict "name" $k "port" ($l.port | int) "address" "0.0.0.0" ) -}} +{{- if (get (fromJson (include "redpanda.Auth.IsSASLEnabled" (dict "a" (list $auth) ))) "r") -}} +{{- $_ := (set $listener "authentication_method" "sasl") -}} +{{- end -}} +{{- $am_10 := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $l.authenticationMethod "") ))) "r") -}} +{{- if (ne $am_10 "") -}} +{{- $_ := (set $listener "authentication_method" $am_10) -}} +{{- end -}} +{{- $kafka = (concat (default (list ) $kafka) (list $listener)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $kafka) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.KafkaListeners.ListenersTLS" -}} +{{- $l := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $kafka := (list ) -}} +{{- $internal := (get (fromJson (include "redpanda.createInternalListenerTLSCfg" (dict "a" (list $tls $l.tls) ))) "r") -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $internal) ))) "r") | int) (0 | int)) -}} +{{- $kafka = (concat (default (list ) $kafka) (list $internal)) -}} +{{- end -}} +{{- range $k, $lis := $l.external -}} +{{- if (or (not (get (fromJson (include "redpanda.KafkaExternal.IsEnabled" (dict "a" (list $lis) ))) "r")) (not (get (fromJson (include "redpanda.ExternalTLS.IsEnabled" (dict "a" (list $lis.tls $l.tls $tls) ))) "r"))) -}} +{{- continue -}} +{{- end -}} +{{- $certName := (get (fromJson (include "redpanda.ExternalTLS.GetCertName" (dict "a" (list $lis.tls $l.tls) ))) "r") -}} +{{- $kafka = (concat (default (list ) $kafka) (list (dict "name" $k "enabled" true "cert_file" (printf "/etc/tls/certs/%s/tls.crt" $certName) "key_file" (printf "/etc/tls/certs/%s/tls.key" $certName) "require_client_auth" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $lis.tls.requireClientAuth false) ))) "r") "truststore_file" (get (fromJson (include "redpanda.ExternalTLS.TrustStoreFilePath" (dict "a" (list $lis.tls $l.tls $tls) ))) "r") ))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $kafka) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.KafkaListeners.TrustStores" -}} +{{- $l := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tss := (coalesce nil) -}} +{{- if (and (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $l.tls $tls) ))) "r") (ne (toJson $l.tls.trustStore) "null")) -}} +{{- $tss = (concat (default (list ) $tss) (list $l.tls.trustStore)) -}} +{{- end -}} +{{- range $_, $key := (sortAlpha (keys $l.external)) -}} +{{- $lis := (index $l.external $key) -}} +{{- if (or (or (not (get (fromJson (include "redpanda.KafkaExternal.IsEnabled" (dict "a" (list $lis) ))) "r")) (not (get (fromJson (include "redpanda.ExternalTLS.IsEnabled" (dict "a" (list $lis.tls $l.tls $tls) ))) "r"))) (eq (toJson $lis.tls.trustStore) "null")) -}} +{{- continue -}} +{{- end -}} +{{- $tss = (concat (default (list ) $tss) (list $lis.tls.trustStore)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $tss) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.KafkaListeners.ConsolemTLS" -}} +{{- $k := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $t := (mustMergeOverwrite (dict "enabled" false "caFilepath" "" "certFilepath" "" "keyFilepath" "" "insecureSkipTlsVerify" false ) (dict "enabled" (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $k.tls $tls) ))) "r") )) -}} +{{- if (not $t.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $t) | toJson -}} +{{- break -}} +{{- end -}} +{{- $kafkaPathPrefix := "/mnt/cert/kafka" -}} +{{- $_ := (set $t "caFilepath" (printf "%s/%s/ca.crt" $kafkaPathPrefix $k.tls.cert)) -}} +{{- if (not $k.tls.requireClientAuth) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $t) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_ := (set $t "certFilepath" (printf "%s/%s/tls.crt" $kafkaPathPrefix $k.tls.cert)) -}} +{{- $_ := (set $t "keyFilepath" (printf "%s/%s/tls.key" $kafkaPathPrefix $k.tls.cert)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $t) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.KafkaExternal.IsEnabled" -}} +{{- $l := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (and (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $l.enabled true) ))) "r") (gt ($l.port | int) (0 | int)))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SchemaRegistryListeners.Listeners" -}} +{{- $sr := (index .a 0) -}} +{{- $saslEnabled := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $internal := (get (fromJson (include "redpanda.createInternalListenerCfg" (dict "a" (list ($sr.port | int)) ))) "r") -}} +{{- if $saslEnabled -}} +{{- $_ := (set $internal "authentication_method" "http_basic") -}} +{{- end -}} +{{- $am_11 := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $sr.authenticationMethod "") ))) "r") -}} +{{- if (ne $am_11 "") -}} +{{- $_ := (set $internal "authentication_method" $am_11) -}} +{{- end -}} +{{- $result := (list $internal) -}} +{{- range $k, $l := $sr.external -}} +{{- if (not (get (fromJson (include "redpanda.SchemaRegistryExternal.IsEnabled" (dict "a" (list $l) ))) "r")) -}} +{{- continue -}} +{{- end -}} +{{- $listener := (dict "name" $k "port" ($l.port | int) "address" "0.0.0.0" ) -}} +{{- if $saslEnabled -}} +{{- $_ := (set $listener "authentication_method" "http_basic") -}} +{{- end -}} +{{- $am_12 := (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $l.authenticationMethod "") ))) "r") -}} +{{- if (ne $am_12 "") -}} +{{- $_ := (set $listener "authentication_method" $am_12) -}} +{{- end -}} +{{- $result = (concat (default (list ) $result) (list $listener)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SchemaRegistryListeners.ListenersTLS" -}} +{{- $l := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $listeners := (list ) -}} +{{- $internal := (get (fromJson (include "redpanda.createInternalListenerTLSCfg" (dict "a" (list $tls $l.tls) ))) "r") -}} +{{- if (gt ((get (fromJson (include "_shims.len" (dict "a" (list $internal) ))) "r") | int) (0 | int)) -}} +{{- $listeners = (concat (default (list ) $listeners) (list $internal)) -}} +{{- end -}} +{{- range $k, $lis := $l.external -}} +{{- if (or (not (get (fromJson (include "redpanda.SchemaRegistryExternal.IsEnabled" (dict "a" (list $lis) ))) "r")) (not (get (fromJson (include "redpanda.ExternalTLS.IsEnabled" (dict "a" (list $lis.tls $l.tls $tls) ))) "r"))) -}} +{{- continue -}} +{{- end -}} +{{- $certName := (get (fromJson (include "redpanda.ExternalTLS.GetCertName" (dict "a" (list $lis.tls $l.tls) ))) "r") -}} +{{- $listeners = (concat (default (list ) $listeners) (list (dict "name" $k "enabled" true "cert_file" (printf "/etc/tls/certs/%s/tls.crt" $certName) "key_file" (printf "/etc/tls/certs/%s/tls.key" $certName) "require_client_auth" (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $lis.tls.requireClientAuth false) ))) "r") "truststore_file" (get (fromJson (include "redpanda.ExternalTLS.TrustStoreFilePath" (dict "a" (list $lis.tls $l.tls $tls) ))) "r") ))) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $listeners) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SchemaRegistryListeners.TrustStores" -}} +{{- $l := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tss := (coalesce nil) -}} +{{- if (and (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $l.tls $tls) ))) "r") (ne (toJson $l.tls.trustStore) "null")) -}} +{{- $tss = (concat (default (list ) $tss) (list $l.tls.trustStore)) -}} +{{- end -}} +{{- range $_, $key := (sortAlpha (keys $l.external)) -}} +{{- $lis := (index $l.external $key) -}} +{{- if (or (or (not (get (fromJson (include "redpanda.SchemaRegistryExternal.IsEnabled" (dict "a" (list $lis) ))) "r")) (not (get (fromJson (include "redpanda.ExternalTLS.IsEnabled" (dict "a" (list $lis.tls $l.tls $tls) ))) "r"))) (eq (toJson $lis.tls.trustStore) "null")) -}} +{{- continue -}} +{{- end -}} +{{- $tss = (concat (default (list ) $tss) (list $lis.tls.trustStore)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $tss) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SchemaRegistryListeners.ConsoleTLS" -}} +{{- $sr := (index .a 0) -}} +{{- $tls := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $t := (mustMergeOverwrite (dict "enabled" false "caFilepath" "" "certFilepath" "" "keyFilepath" "" "insecureSkipTlsVerify" false ) (dict "enabled" (get (fromJson (include "redpanda.InternalTLS.IsEnabled" (dict "a" (list $sr.tls $tls) ))) "r") )) -}} +{{- if (not $t.enabled) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $t) | toJson -}} +{{- break -}} +{{- end -}} +{{- $schemaRegistryPrefix := "/mnt/cert/schemaregistry" -}} +{{- $_ := (set $t "caFilepath" (printf "%s/%s/ca.crt" $schemaRegistryPrefix $sr.tls.cert)) -}} +{{- if (not $sr.tls.requireClientAuth) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $t) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_ := (set $t "certFilepath" (printf "%s/%s/tls.crt" $schemaRegistryPrefix $sr.tls.cert)) -}} +{{- $_ := (set $t "keyFilepath" (printf "%s/%s/tls.key" $schemaRegistryPrefix $sr.tls.cert)) -}} +{{- $_is_returning = true -}} +{{- (dict "r" $t) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SchemaRegistryExternal.IsEnabled" -}} +{{- $l := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (and (get (fromJson (include "_shims.ptr_Deref" (dict "a" (list $l.enabled true) ))) "r") (gt ($l.port | int) (0 | int)))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.TunableConfig.Translate" -}} +{{- $c := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- if (eq (toJson $c) "null") -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $result := (dict ) -}} +{{- range $k, $v := $c -}} +{{- if (not (empty $v)) -}} +{{- $_ := (set $result $k $v) -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.NodeConfig.Translate" -}} +{{- $c := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $result := (dict ) -}} +{{- range $k, $v := $c -}} +{{- if (not (empty $v)) -}} +{{- $tmp_tuple_12 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.asnumeric" (dict "a" (list $v) ))) "r")) ))) "r") -}} +{{- $ok_13 := $tmp_tuple_12.T2 -}} +{{- if $ok_13 -}} +{{- $_ := (set $result $k $v) -}} +{{- else -}}{{- if (kindIs "bool" $v) -}} +{{- $_ := (set $result $k $v) -}} +{{- else -}} +{{- $_ := (set $result $k (toYaml $v)) -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.ClusterConfig.Translate" -}} +{{- $c := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $result := (dict ) -}} +{{- range $k, $v := $c -}} +{{- $tmp_tuple_13 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.typetest" (dict "a" (list "bool" $v false) ))) "r")) ))) "r") -}} +{{- $ok_15 := $tmp_tuple_13.T2 -}} +{{- $b_14 := $tmp_tuple_13.T1 -}} +{{- if $ok_15 -}} +{{- $_ := (set $result $k $b_14) -}} +{{- continue -}} +{{- end -}} +{{- if (not (empty $v)) -}} +{{- $_ := (set $result $k $v) -}} +{{- end -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $result) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SecretRef.AsSource" -}} +{{- $sr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (mustMergeOverwrite (dict ) (dict "secretKeyRef" (mustMergeOverwrite (dict "key" "" ) (mustMergeOverwrite (dict ) (dict "name" $sr.name )) (dict "key" $sr.key )) ))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.SecretRef.IsValid" -}} +{{- $sr := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $_is_returning = true -}} +{{- (dict "r" (and (and (ne (toJson $sr) "null") (not (empty $sr.key))) (not (empty $sr.name)))) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.TieredStorageCredentials.AsEnvVars" -}} +{{- $tsc := (index .a 0) -}} +{{- $config := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_14 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $config "cloud_storage_access_key" (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $hasAccessKey := $tmp_tuple_14.T2 -}} +{{- $tmp_tuple_15 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $config "cloud_storage_secret_key" (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $hasSecretKey := $tmp_tuple_15.T2 -}} +{{- $tmp_tuple_16 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $config "cloud_storage_azure_shared_key" (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $hasSharedKey := $tmp_tuple_16.T2 -}} +{{- $envvars := (coalesce nil) -}} +{{- if (and (not $hasAccessKey) (get (fromJson (include "redpanda.SecretRef.IsValid" (dict "a" (list $tsc.accessKey) ))) "r")) -}} +{{- $envvars = (concat (default (list ) $envvars) (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "REDPANDA_CLOUD_STORAGE_ACCESS_KEY" "valueFrom" (get (fromJson (include "redpanda.SecretRef.AsSource" (dict "a" (list $tsc.accessKey) ))) "r") )))) -}} +{{- end -}} +{{- if (get (fromJson (include "redpanda.SecretRef.IsValid" (dict "a" (list $tsc.secretKey) ))) "r") -}} +{{- if (and (not $hasSecretKey) (not (get (fromJson (include "redpanda.TieredStorageConfig.HasAzureCanaries" (dict "a" (list (deepCopy $config)) ))) "r"))) -}} +{{- $envvars = (concat (default (list ) $envvars) (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "REDPANDA_CLOUD_STORAGE_SECRET_KEY" "valueFrom" (get (fromJson (include "redpanda.SecretRef.AsSource" (dict "a" (list $tsc.secretKey) ))) "r") )))) -}} +{{- else -}}{{- if (and (not $hasSharedKey) (get (fromJson (include "redpanda.TieredStorageConfig.HasAzureCanaries" (dict "a" (list (deepCopy $config)) ))) "r")) -}} +{{- $envvars = (concat (default (list ) $envvars) (list (mustMergeOverwrite (dict "name" "" ) (dict "name" "REDPANDA_CLOUD_STORAGE_AZURE_SHARED_KEY" "valueFrom" (get (fromJson (include "redpanda.SecretRef.AsSource" (dict "a" (list $tsc.secretKey) ))) "r") )))) -}} +{{- end -}} +{{- end -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $envvars) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.TieredStorageConfig.HasAzureCanaries" -}} +{{- $c := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_17 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $c "cloud_storage_azure_container" (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $containerExists := $tmp_tuple_17.T2 -}} +{{- $tmp_tuple_18 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $c "cloud_storage_azure_storage_account" (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $accountExists := $tmp_tuple_18.T2 -}} +{{- $_is_returning = true -}} +{{- (dict "r" (and $containerExists $accountExists)) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.TieredStorageConfig.CloudStorageCacheSize" -}} +{{- $c := (index .a 0) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $tmp_tuple_19 := (get (fromJson (include "_shims.compact" (dict "a" (list (get (fromJson (include "_shims.dicttest" (dict "a" (list $c `cloud_storage_cache_size` (coalesce nil)) ))) "r")) ))) "r") -}} +{{- $ok := $tmp_tuple_19.T2 -}} +{{- $value := $tmp_tuple_19.T1 -}} +{{- if (not $ok) -}} +{{- $_is_returning = true -}} +{{- (dict "r" (coalesce nil)) | toJson -}} +{{- break -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $value) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + +{{- define "redpanda.TieredStorageConfig.Translate" -}} +{{- $c := (index .a 0) -}} +{{- $creds := (index .a 1) -}} +{{- range $_ := (list 1) -}} +{{- $_is_returning := false -}} +{{- $config := (merge (dict ) (dict ) $c) -}} +{{- range $_, $envvar := (get (fromJson (include "redpanda.TieredStorageCredentials.AsEnvVars" (dict "a" (list $creds $c) ))) "r") -}} +{{- $key := (lower (substr ((get (fromJson (include "_shims.len" (dict "a" (list "REDPANDA_") ))) "r") | int) -1 $envvar.name)) -}} +{{- $_ := (set $config $key (printf "$%s" $envvar.name)) -}} +{{- end -}} +{{- if $_is_returning -}} +{{- break -}} +{{- end -}} +{{- $size_16 := (get (fromJson (include "redpanda.TieredStorageConfig.CloudStorageCacheSize" (dict "a" (list (deepCopy $c)) ))) "r") -}} +{{- if (ne (toJson $size_16) "null") -}} +{{- $_ := (set $config "cloud_storage_cache_size" ((get (fromJson (include "_shims.resource_Value" (dict "a" (list $size_16) ))) "r") | int64)) -}} +{{- end -}} +{{- $_is_returning = true -}} +{{- (dict "r" $config) | toJson -}} +{{- break -}} +{{- end -}} +{{- end -}} + diff --git a/charts/redpanda/redpanda/5.9.7/templates/connectors/connectors.yaml b/charts/redpanda/redpanda/5.9.7/templates/connectors/connectors.yaml new file mode 100644 index 000000000..25343f584 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/connectors/connectors.yaml @@ -0,0 +1,109 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{ if and .Values.connectors.enabled (not .Values.connectors.deployment.create) }} + +{{ $values := .Values }} + +{{/* brokers */}} +{{ $kafkaBrokers := list }} +{{ range (include "seed-server-list" . | mustFromJson) }} + {{ $kafkaBrokers = append $kafkaBrokers (printf "%s:%d" . (int $values.listeners.kafka.port)) }} +{{ end }} + +{{ $connectorsValues := dict + "Values" (dict + "connectors" (dict + "bootstrapServers" (join "," $kafkaBrokers) + "brokerTLS" (dict + "enabled" (include "kafka-internal-tls-enabled" . | fromJson).bool + "ca" (dict + "secretRef" (ternary (printf "%s-default-cert" (include "redpanda.fullname" .)) "" (include "kafka-internal-tls-enabled" . | fromJson).bool) + ) + ) + ) + ) +}} + +{{ $extraVolumes := list }} +{{ $extraVolumeMounts := list }} +{{ $extraEnv := .Values.connectors.deployment.extraEnv }} +{{ $command := list }} +{{ if (include "sasl-enabled" . | fromJson).bool }} + {{ $command = concat $command (list "bash" "-c") }} + {{ $consoleSASLConfig := (printf "set -e; IFS=':' read -r CONNECT_SASL_USERNAME CONNECT_SASL_PASSWORD CONNECT_SASL_MECHANISM < <(grep \"\" $(find /mnt/users/* -print)); CONNECT_SASL_MECHANISM=${CONNECT_SASL_MECHANISM:-%s}; export CONNECT_SASL_USERNAME CONNECT_SASL_PASSWORD CONNECT_SASL_MECHANISM;" ( include "sasl-mechanism" . | lower )) }} + {{ $consoleSASLConfig = cat $consoleSASLConfig " [[ $CONNECT_SASL_MECHANISM == \"SCRAM-SHA-256\" ]] && CONNECT_SASL_MECHANISM=scram-sha-256;" }} + {{ $consoleSASLConfig = cat $consoleSASLConfig " [[ $CONNECT_SASL_MECHANISM == \"SCRAM-SHA-512\" ]] && CONNECT_SASL_MECHANISM=scram-sha-512;" }} + {{ $consoleSASLConfig = cat $consoleSASLConfig " export CONNECT_SASL_MECHANISM;" }} + {{ $consoleSASLConfig = cat $consoleSASLConfig " echo $CONNECT_SASL_PASSWORD > /opt/kafka/connect-password/rc-credentials/password;" }} + {{ $consoleSASLConfig = cat $consoleSASLConfig " exec /opt/kafka/bin/kafka_connect_run.sh" }} + {{ $command = append $command $consoleSASLConfig }} + + {{ $extraVolumes = concat $extraVolumes .Values.connectors.storage.volume }} + + {{ $extraVolumes = append $extraVolumes (dict + "name" (printf "%s-users" (include "redpanda.fullname" .)) + "secret" (dict + "secretName" .Values.auth.sasl.secretRef + ) + )}} + + {{ $extraVolumeMounts = concat $extraVolumeMounts .Values.connectors.storage.volumeMounts }} + + {{ $extraVolumeMounts = append $extraVolumeMounts (dict + "name" (printf "%s-users" (include "redpanda.fullname" .)) + "mountPath" "/mnt/users" + "readOnly" true + )}} + {{ $extraVolumes = append $extraVolumes (dict + "name" (printf "%s-user-password" ((include "redpanda.fullname" .)) | trunc 49) + "emptyDir" (dict) + )}} + {{ $extraVolumeMounts = append $extraVolumeMounts (dict + "name" (printf "%s-user-password" ((include "redpanda.fullname" .)) | trunc 49) + "mountPath" "/opt/kafka/connect-password/rc-credentials" + )}} + {{ $extraEnv = append $extraEnv (dict + "name" "CONNECT_SASL_PASSWORD_FILE" + "value" "rc-credentials/password" + )}} + {{ $connectorsValues := merge $connectorsValues (dict + "Values" (dict + "storage" (dict + "volumeMounts" $extraVolumeMounts + "volume" $extraVolumes + ) + "auth" (dict + "sasl" (dict + "enabled" .Values.auth.sasl.enabled + ) + ) + "deployment" (dict + "command" $command + "extraEnv" $extraEnv + ) + ) + )}} +{{ end }} + +{{ $connectorsValues := merge $connectorsValues (dict "Values" (dict "deployment" (dict "create" (not .Values.connectors.deployment.create)))) }} +{{ $connectorsValues := merge $connectorsValues (dict "Values" (dict "test" (dict "create" (not .Values.connectors.test.create)))) }} +{{ $helmVars := merge $connectorsValues .Subcharts.connectors }} +{{ $helmVars = (dict "Chart" .Subcharts.connectors.Chart "Release" .Release "Values" (merge (dict "AsMap" $helmVars.Values) $helmVars.Values)) }} +{{ include (print .Subcharts.connectors.Template.BasePath "/deployment.yaml") $helmVars }} +--- +{{ include (print .Subcharts.connectors.Template.BasePath "/tests/01-mm2-values.yaml") $helmVars }} +{{ end }} diff --git a/charts/redpanda/redpanda/5.9.7/templates/console/configmap-and-deployment.yaml b/charts/redpanda/redpanda/5.9.7/templates/console/configmap-and-deployment.yaml new file mode 100644 index 000000000..0f4de4a71 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/console/configmap-and-deployment.yaml @@ -0,0 +1,239 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{/* Secret */}} +{{ $secretConfig := dict ( dict + "create" $.Values.console.secret.create + ) +}} +{{/* if the console chart has the creation of the secret disabled, create it here instead if needed */}} +{{ if and .Values.console.enabled (not .Values.console.secret.create) }} +{{ $licenseKey := ( include "enterprise-license" . ) }} +# before license changes, this was not printing a secret, so we gather in which case to print +# for now only if we have a license do we print, however, this may be an issue for some +# since if we do include a license we MUST also print all secret items. + {{ if ( not (empty $licenseKey ) ) }} +{{/* License and license are set twice here as a work around to a bug in the post-go console chart. */}} +{{ $secretConfig = ( dict + "create" true + "enterprise" ( dict "license" $licenseKey "License" $licenseKey) + ) +}} + +{{ $config := dict + "Values" (dict + "secret" $secretConfig + )}} + +{{ $secretValues := merge $config .Subcharts.console }} +{{ $wrappedSecretValues := (dict "Chart" .Subcharts.console.Chart "Release" .Release "Values" (dict "AsMap" $secretValues.Values)) }} +--- +{{- include "_shims.render-manifest" (list "console.Secret" $wrappedSecretValues) -}} + {{ end }} +{{ end }} + +{{ $configmap := dict }} +{{/* if the console chart has the creation of the configmap disabled, create it here instead */}} +{{ if and .Values.console.enabled (not .Values.console.configmap.create) }} +{{ $consoleConfigmap := dict "create" true }} + +{{ $consoleConfig := merge .Values.console.config (get ((include "redpanda.ConsoleConfig" (dict "a" (list .))) | fromJson) "r") }} + +{{ $config := dict + "Values" (dict + "console" (dict "config" $consoleConfig) + "configmap" $consoleConfigmap + "secret" $secretConfig + ) +}} + +{{ $configMapValues := merge $config .Subcharts.console }} +--- +{{- $wrappedSecretValues := (dict + "Chart" .Subcharts.console.Chart + "Release" .Release + "Values" (dict "AsMap" $configMapValues.Values) + "Template" (dict "BasePath" "" "Name" "") +) -}} +{{- include "_shims.render-manifest" (list "console.ConfigMap" $wrappedSecretValues) -}} +{{ $configmap = include "_shims.render-manifest" (list "console.ConfigMap" $wrappedSecretValues) }} +{{ end }} + +{{/* Deployment */}} +{{ if and .Values.console.enabled (not .Values.console.deployment.create) }} + +{{ $extraVolumes := list }} +{{ $extraVolumeMounts := list }} +{{ $command := list }} +{{ if (include "sasl-enabled" . | fromJson).bool }} + {{ $command = concat $command (list "sh" "-c") }} + {{ $consoleSASLConfig := (printf "set -e; IFS=':' read -r KAFKA_SASL_USERNAME KAFKA_SASL_PASSWORD KAFKA_SASL_MECHANISM < <(grep \"\" $(find /mnt/users/* -print)); KAFKA_SASL_MECHANISM=${KAFKA_SASL_MECHANISM:-%s}; export KAFKA_SASL_USERNAME KAFKA_SASL_PASSWORD KAFKA_SASL_MECHANISM;" ( include "sasl-mechanism" . )) }} + {{ $consoleSASLConfig = cat $consoleSASLConfig " export KAFKA_SCHEMAREGISTRY_USERNAME=$KAFKA_SASL_USERNAME;" }} + {{ $consoleSASLConfig = cat $consoleSASLConfig " export KAFKA_SCHEMAREGISTRY_PASSWORD=$KAFKA_SASL_PASSWORD;" }} + {{ $consoleSASLConfig = cat $consoleSASLConfig " export REDPANDA_ADMINAPI_USERNAME=$KAFKA_SASL_USERNAME;" }} + {{ $consoleSASLConfig = cat $consoleSASLConfig " export REDPANDA_ADMINAPI_PASSWORD=$KAFKA_SASL_PASSWORD;" }} + {{ $consoleSASLConfig = cat $consoleSASLConfig " /app/console $@" }} + {{ $command = append $command $consoleSASLConfig }} + {{ $command = append $command "--" }} + {{ $extraVolumes = append $extraVolumes (dict + "name" (printf "%s-users" (include "redpanda.fullname" .)) + "secret" (dict + "secretName" .Values.auth.sasl.secretRef + ) + )}} + {{ $extraVolumeMounts = append $extraVolumeMounts (dict + "name" (printf "%s-users" (include "redpanda.fullname" .)) + "mountPath" "/mnt/users" + "readOnly" true + ) }} +{{ end }} + +{{ $kafkaTLS := list }} +{{ if (include "kafka-internal-tls-enabled" . | fromJson).bool }} + {{ $service := .Values.listeners.kafka }} + {{ $cert := get .Values.tls.certs $service.tls.cert }} + {{- $secretName := (printf "%s-%s-cert" (include "redpanda.fullname" .) $service.tls.cert) }} + {{- if $cert.secretRef }} + {{- $secretName = $cert.secretRef.name }} + {{- end }} + {{ if $cert.caEnabled }} + {{ $kafkaTLS = append $kafkaTLS (dict + "name" "KAFKA_TLS_CAFILEPATH" + "value" (printf "/mnt/cert/kafka/%s/ca.crt" $service.tls.cert) + )}} + {{ $extraVolumes = append $extraVolumes (dict + "name" (printf "kafka-%s-cert" $service.tls.cert) + "secret" (dict + "defaultMode" 0420 + "secretName" ( $secretName ) + ))}} + {{ $extraVolumeMounts = append $extraVolumeMounts (dict + "name" (printf "kafka-%s-cert" $service.tls.cert) + "mountPath" (printf "/mnt/cert/kafka/%s" $service.tls.cert) + "readOnly" true + )}} + {{ end }} +{{ end }} + +{{ $schemaRegistryTLS := list }} +{{ if (include "schemaRegistry-internal-tls-enabled" . | fromJson).bool }} + {{ $service := .Values.listeners.schemaRegistry }} + {{ $cert := get .Values.tls.certs $service.tls.cert }} + {{- $secretName := (printf "%s-%s-cert" (include "redpanda.fullname" .) $service.tls.cert) }} + {{- if $cert.secretRef }} + {{- $secretName = $cert.secretRef.name }} + {{- end }} + {{ if $cert.caEnabled }} + {{ $schemaRegistryTLS = append $schemaRegistryTLS (dict + "name" "KAFKA_SCHEMAREGISTRY_TLS_CAFILEPATH" + "value" (printf "/mnt/cert/schemaregistry/%s/ca.crt" $service.tls.cert) + )}} + {{ $extraVolumes = append $extraVolumes (dict + "name" (printf "schemaregistry-%s-cert" $service.tls.cert) + "secret" (dict + "defaultMode" 0420 + "secretName" ( $secretName ) + ))}} + {{ $extraVolumeMounts = append $extraVolumeMounts (dict + "name" (printf "schemaregistry-%s-cert" $service.tls.cert) + "mountPath" (printf "/mnt/cert/schemaregistry/%s" $service.tls.cert) + "readOnly" true + )}} + {{ end }} +{{ end }} + +{{ $adminAPI := list }} +{{ if (include "admin-internal-tls-enabled" . | fromJson).bool }} + {{ $service := .Values.listeners.admin }} + {{ $cert := get .Values.tls.certs $service.tls.cert }} + {{- $secretName := (printf "%s-%s-cert" (include "redpanda.fullname" .) $service.tls.cert) }} + {{- if $cert.secretRef }} + {{- $secretName = $cert.secretRef.name }} + {{- end }} + {{ if $cert.caEnabled }} + {{ $extraVolumes = append $extraVolumes (dict + "name" (printf "adminapi-%s-cert" $service.tls.cert) + "secret" (dict + "defaultMode" 0420 + "secretName" ( $secretName ) + ))}} + {{ $extraVolumeMounts = append $extraVolumeMounts (dict + "name" (printf "adminapi-%s-cert" $service.tls.cert) + "mountPath" (printf "/mnt/cert/adminapi/%s" $service.tls.cert) + "readOnly" true + )}} + {{ end }} +{{ end }} + +{{ $enterprise := dict }} +{{ if ( include "enterprise-secret" .) }} + {{ $enterprise = dict + "licenseSecretRef" ( dict + "name" ( include "enterprise-secret-name" . ) + "key" ( include "enterprise-secret-key" . ) + ) + }} +{{ end }} + +{{ $extraEnv := concat $kafkaTLS $schemaRegistryTLS $adminAPI .Values.console.extraEnv }} +{{ $extraVolumes = concat $extraVolumes .Values.console.extraVolumes }} +{{ $extraVolumeMounts = concat $extraVolumeMounts .Values.console.extraVolumeMounts }} +{{ $consoleValues := dict + "Values" (dict + "extraVolumes" $extraVolumes + "extraVolumeMounts" $extraVolumeMounts + "extraEnv" $extraEnv + "secret" $secretConfig + "enterprise" $enterprise + "image" $.Values.console.image + "autoscaling" .Values.console.autoscaling + "replicaCount" .Values.console.replicaCount + "strategy" .Values.console.strategy + "podAnnotations" .Values.console.podAnnotations + "podLabels" .Values.console.podLabels + "imagePullSecrets" .Values.console.imagePullSecrets + "podSecurityContext" .Values.console.podSecurityContext + "secretMounts" .Values.console.secretMounts + "initContainers" .Values.console.initContainers + "extraArgs" .Values.console.extraArgs + "securityContext" .Values.console.securityContext + "livenessProbe" .Values.console.livenessProbe + "readinessProbe" .Values.console.readinessProbe + "resources" .Values.console.resources + "extraContainers" .Values.console.extraContainers + "nodeSelector" .Values.console.nodeSelector + "affinity" .Values.console.affinity + "topologySpreadConstraints" .Values.console.topologySpreadConstraints + "priorityClassName" .Values.console.priorityClassName + "tolerations" .Values.console.tolerations +)}} + +{{ if not (empty $command) }} + {{ $consoleValues := merge $consoleValues (dict "Values" (dict "deployment" (dict "command" $command))) }} +{{ end }} +{{ $consoleValues := merge $consoleValues (dict "Values" (dict "deployment" (dict "create" (not .Values.console.deployment.create)))) }} + +{{ if and .Values.console.enabled (not .Values.console.configmap.create) }} +{{ $consoleValues := merge $consoleValues (dict "Values" (dict "podAnnotations" (dict "checksum-redpanda-chart/config" ( $configmap | toYaml | sha256sum )))) }} +{{ end }} + +{{ $deploymentValues := merge $consoleValues .Subcharts.console }} +{{ $wrappedDeploymentValues := (dict "Chart" .Subcharts.console.Chart "Release" .Release "Template" (dict "BasePath" "" "Name" "") "Values" (dict "AsMap" $deploymentValues.Values)) }} + +--- +{{- include "_shims.render-manifest" (list "console.Deployment" $wrappedDeploymentValues) -}} +{{ end }} diff --git a/charts/redpanda/redpanda/5.9.7/templates/entry-point.yaml b/charts/redpanda/redpanda/5.9.7/templates/entry-point.yaml new file mode 100644 index 000000000..6cdf646ad --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/entry-point.yaml @@ -0,0 +1,17 @@ +{{- /* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- include "_shims.render-manifest" (list "redpanda.render" .) -}} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-api-status.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-api-status.yaml new file mode 100644 index 000000000..330a2c4a4 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-api-status.yaml @@ -0,0 +1,52 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- if and .Values.tests.enabled (not (or (include "tls-enabled" . | fromJson).bool (include "sasl-enabled" . | fromJson).bool)) -}} +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "redpanda.fullname" . }}-test-api-status" + namespace: {{ .Release.Namespace | quote }} + labels: + {{- with include "full.labels" . }} + {{- . | nindent 4 }} + {{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: {{ .Values.image.repository }}:{{ template "redpanda.tag" . }} + command: + - /usr/bin/timeout + - "120" + - bash + - -c + - | + until rpk cluster info \ + --brokers {{ include "redpanda.fullname" . }}-0.{{ include "redpanda.internal.domain" . }}:{{ .Values.listeners.kafka.port }} + do sleep 2 + done + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-auditLogging.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-auditLogging.yaml new file mode 100644 index 000000000..fea34776f --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-auditLogging.yaml @@ -0,0 +1,86 @@ +{{/* + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +*/}} +{{/* + This feature is gated by having a license, and it must have sasl enabled, we assume these conditions are met + as part of setting auditLogging being enabled. +*/}} +{{- if and .Values.tests.enabled .Values.auditLogging.enabled (include "redpanda-atleast-23-3-0" . | fromJson).bool }} +{{- $sasl := .Values.auth.sasl }} +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "redpanda.fullname" . }}-test-audit-logging" + namespace: {{ .Release.Namespace | quote }} + labels: + {{- with include "full.labels" . }} + {{- . | nindent 4 }} + {{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: { { - toYaml . | nindent 4 }} + {{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: {{ .Values.image.repository }}:{{ template "redpanda.tag" . }} + command: + - /usr/bin/timeout + - "120" + - bash + - -c + - | + set -xe + old_setting=${-//[^x]/} + audit_topic_name="_redpanda.audit_log" + expected_partitions={{ .Values.auditLogging.partitions }} + + # sasl configurations + set +x + IFS=":" read -r {{ include "rpk-sasl-environment-variables" . }} < <(grep "" $(find /etc/secrets/users/* -print)) + {{- if (include "redpanda-atleast-23-2-1" . | fromJson).bool }} + RPK_SASL_MECHANISM=${RPK_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- else }} + REDPANDA_SASL_MECHANISM=${REDPANDA_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- end }} + export {{ include "rpk-sasl-environment-variables" . }} + if [[ -n "$old_setting" ]]; then set -x; fi + + # now run the to determine if we have the right results + # should describe topic without error + rpk topic describe ${audit_topic_name} + # should get the expected values + result=$(rpk topic list | grep ${audit_topic_name}) + name=$(echo $result | awk '{print $1}') + partitions=$(echo $result | awk '{print $2}') + if [ "${name}" != "${audit_topic_name}" ]; then + echo "expected topic name does not match" + exit 1 + fi + if [ ${partitions} != ${expected_partitions} ]; then + echo "expected partition size did not match" + exit 1 + fi + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + resources: +{{- toYaml .Values.statefulset.resources | nindent 12 }} + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-connector-via-console.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-connector-via-console.yaml new file mode 100644 index 000000000..67619a829 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-connector-via-console.yaml @@ -0,0 +1,166 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- if and .Values.tests.enabled .Values.connectors.enabled .Values.console.enabled }} +{{- $sasl := .Values.auth.sasl }} +{{- $values := .Values }} +{{- $consoleValues := (merge (dict) .Values.console .Subcharts.console.Values) -}} +{{- $consoleDot := dict "Values" (dict "AsMap" $consoleValues) "Release" .Release "Chart" .Subcharts.console.Chart -}} +{{- $connectorsDot := dict "Values" (merge (dict) .Values.connectors .Subcharts.connectors.Values) "Release" .Release "Chart" .Subcharts.connectors.Chart -}} +{{/* brokers */}} +{{- $kafkaBrokers := list }} +{{- range (include "seed-server-list" . | mustFromJson) }} + {{- $kafkaBrokers = append $kafkaBrokers (printf "%s:%s" . ($values.listeners.kafka.port | toString)) }} +{{- end }} +{{- $brokersString := join "," $kafkaBrokers}} +apiVersion: v1 +kind: Pod +metadata: + name: {{ include "redpanda.fullname" . | trunc 54 }}-test-connectors-via-console + namespace: {{ .Release.Namespace | quote }} + labels: + {{- with include "full.labels" . }} + {{- . | nindent 4 }} + {{- end }} + test-name: test-connectors-via-console + annotations: + test-name: test-connectors-via-console + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: {{ .Values.image.repository }}:{{ template "redpanda.tag" . }} + env: + - name: TLS_ENABLED + value: {{ (include "kafka-internal-tls-enabled" . | fromJson).bool | quote }} + command: + - /bin/bash + - -c + - | + set -xe + + trap connectorsState ERR + + connectorsState () { + echo check connectors expand status + curl {{ template "curl-options" . }} http://{{ include "connectors.serviceName" $connectorsDot }}:{{ .Values.connectors.connectors.restPort }}/connectors?expand=status + echo check connectors expand info + curl {{ template "curl-options" . }} http://{{ include "connectors.serviceName" $connectorsDot }}:{{ .Values.connectors.connectors.restPort }}/connectors?expand=info + echo check connector configuration + curl {{ template "curl-options" . }} http://{{ include "connectors.serviceName" $connectorsDot }}:{{ .Values.connectors.connectors.restPort }}/connectors/$CONNECTOR_NAME + echo check connector topics + curl {{ template "curl-options" . }} http://{{ include "connectors.serviceName" $connectorsDot }}:{{ .Values.connectors.connectors.restPort }}/connectors/$CONNECTOR_NAME/topics + } + + {{- if .Values.auth.sasl.enabled }} + set -e + set +x + + echo "SASL enabled: reading credentials from $(find /etc/secrets/users/* -print)" + IFS=":" read -r {{ include "rpk-sasl-environment-variables" . }} < <(grep "" $(find /etc/secrets/users/* -print)) + {{- if (include "redpanda-atleast-23-2-1" . | fromJson).bool }} + RPK_SASL_MECHANISM=${RPK_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- else }} + REDPANDA_SASL_MECHANISM=${REDPANDA_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + RPK_USER="${REDPANDA_SASL_USERNAME}" + RPK_PASS="${REDPANDA_SASL_PASSWORD}" + RPK_SASL_MECHANISM="${REDPANDA_SASL_MECHANISM}" + {{- end }} + export {{ include "rpk-sasl-environment-variables" . }} + + JAAS_CONFIG_SOURCE="\"source.cluster.sasl.jaas.config\": \"org.apache.kafka.common.security.scram.ScramLoginModule required username=\\\\"\"${RPK_USER}\\\\"\" password=\\\\"\"${RPK_PASS}\\\\"\";\"," + JAAS_CONFIG_TARGET="\"target.cluster.sasl.jaas.config\": \"org.apache.kafka.common.security.scram.ScramLoginModule required username=\\\\"\"${RPK_USER}\\\\"\" password=\\\\"\"${RPK_PASS}\\\\"\";\"," + set -x + set +e + {{- end }} + + {{- $testTopic := printf "test-topic-%s" (randNumeric 3) }} + rpk topic create {{ $testTopic }} + rpk topic list + echo "Test message!" | rpk topic produce {{ $testTopic }} + + SECURITY_PROTOCOL=PLAINTEXT + if [[ -n "$RPK_SASL_MECHANISM" && $TLS_ENABLED == "true" ]]; then + SECURITY_PROTOCOL="SASL_SSL" + elif [[ -n "$RPK_SASL_MECHANISM" ]]; then + SECURITY_PROTOCOL="SASL_PLAINTEXT" + elif [[ $TLS_ENABLED == "true" ]]; then + SECURITY_PROTOCOL="SSL" + fi + + CONNECTOR_NAME=mm2-$RANDOM + cat << 'EOF' > /tmp/mm2-conf.json + { + "connectorName": "CONNECTOR_NAME", + "config": { + "connector.class": "org.apache.kafka.connect.mirror.MirrorSourceConnector", + "topics": "{{ $testTopic }}", + "replication.factor": "1", + "tasks.max": "1", + "source.cluster.bootstrap.servers": {{ $brokersString | quote }}, + "target.cluster.bootstrap.servers": {{ $brokersString | quote }}, + "target.cluster.alias": "test-only-redpanda", + "source.cluster.alias": "source", + "key.converter": "org.apache.kafka.connect.converters.ByteArrayConverter", + "value.converter": "org.apache.kafka.connect.converters.ByteArrayConverter", + "source->target.enabled": "true", + "target->source.enabled": "false", + "sync.topic.configs.interval.seconds": "5", + "sync.topics.configs.enabled": "true", + "source.cluster.ssl.truststore.type": "PEM", + "target.cluster.ssl.truststore.type": "PEM", + "source.cluster.ssl.truststore.location": "/opt/kafka/connect-certs/ca/ca.crt", + "target.cluster.ssl.truststore.location": "/opt/kafka/connect-certs/ca/ca.crt", + JAAS_CONFIG_SOURCE + JAAS_CONFIG_TARGET + "source.cluster.security.protocol": "SECURITY_PROTOCOL", + "target.cluster.security.protocol": "SECURITY_PROTOCOL", + "source.cluster.sasl.mechanism": "SASL_MECHANISM", + "target.cluster.sasl.mechanism": "SASL_MECHANISM" + } + } + EOF + + sed -i "s/CONNECTOR_NAME/$CONNECTOR_NAME/g" /tmp/mm2-conf.json + sed -i "s/SASL_MECHANISM/$RPK_SASL_MECHANISM/g" /tmp/mm2-conf.json + sed -i "s/SECURITY_PROTOCOL/$SECURITY_PROTOCOL/g" /tmp/mm2-conf.json + set +x + sed -i "s/JAAS_CONFIG_SOURCE/$JAAS_CONFIG_SOURCE/g" /tmp/mm2-conf.json + sed -i "s/JAAS_CONFIG_TARGET/$JAAS_CONFIG_TARGET/g" /tmp/mm2-conf.json + set -x + + URL=http://{{ get ((include "console.Fullname" (dict "a" (list $consoleDot))) | fromJson) "r" }}:{{ get (fromJson (include "console.ContainerPort" (dict "a" (list $consoleDot) ))) "r" }}/api/kafka-connect/clusters/connectors/connectors + {{/* outputting to /dev/null because the output contains the user password */}} + echo "Creating mm2 connector" + curl {{ template "curl-options" . }} -H 'Content-Type: application/json' "${URL}" -d @/tmp/mm2-conf.json + + rpk topic consume source.{{ $testTopic }} -n 1 + + echo "Destroying mm2 connector" + curl {{ template "curl-options" . }} -X DELETE "${URL}/${CONNECTOR_NAME}" + + rpk topic list + rpk topic delete {{ $testTopic }} source.{{ $testTopic }} mm2-offset-syncs.test-only-redpanda.internal + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-console.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-console.yaml new file mode 100644 index 000000000..aeef1117a --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-console.yaml @@ -0,0 +1,49 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- if and .Values.tests.enabled .Values.console.enabled -}} +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "redpanda.fullname" . }}-test-console" + namespace: {{ .Release.Namespace | quote }} + labels: + {{- with include "full.labels" . }} + {{- . | nindent 4 }} + {{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: {{ .Values.image.repository }}:{{ template "redpanda.tag" . }} + command: + - /usr/bin/timeout + - "120" + - bash + - -c + - | + curl {{ template "curl-options" . }} http://{{ include "redpanda.fullname" . }}-console.{{ .Release.Namespace }}.svc:{{ (get (fromJson (include "console.ContainerPort" (dict "a" (list (dict "Values" (dict "AsMap" .Values.console)) )))) "r" ) }}/api/cluster + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-internal-external-tls-secrets.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-internal-external-tls-secrets.yaml new file mode 100644 index 000000000..53d75bb1b --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-internal-external-tls-secrets.yaml @@ -0,0 +1,122 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- if and .Values.tests.enabled (include "tls-enabled" . | fromJson).bool ( eq .Values.external.type "NodePort" ) }} + {{- $values := .Values }} +apiVersion: v1 +kind: Pod +metadata: + name: {{ include "redpanda.fullname" . }}-test-internal-externals-cert-secrets + namespace: {{ .Release.Namespace | quote }} + labels: + {{- with include "full.labels" . }} + {{- . | nindent 4 }} + {{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: {{ .Values.image.repository }}:{{ template "redpanda.tag" . }} + command: + - bash + - -c + - | + set -x + + retry() { + local retries="$1" + local command="$2" + + # Run the command, and save the exit code + bash -c $command + local exit_code=$? + + # If the exit code is non-zero (i.e. command failed), and we have not + # reached the maximum number of retries, run the command again + if [[ $exit_code -ne 0 && $retries -gt 0 ]]; then + retry $(($retries - 1)) "$command" + else + # Return the exit code from the command + return $exit_code + fi + } + + {{- range $name, $cert := $values.tls.certs }} + {{- if $cert.secretRef }} + echo testing cert: {{ $name | quote }} + + {{- if eq $cert.secretRef.name "internal-tls-secret" }} + echo "---> testing internal tls" + retry 5 'openssl s_client -verify_return_error -prexit + {{- if $cert.caEnabled }} + -CAfile {{ printf "/etc/tls/certs/%s" $name }}/ca.crt + {{- end }} + -key {{ printf "/etc/tls/certs/%s" $name }}/tls.key + -connect {{ include "admin-api-urls" $ }}' + {{- end }} + + {{- if eq $cert.secretRef.name "external-tls-secret" }} + echo "---> testing external tls" + + {{- if eq $values.listeners.kafka.external.default.tls.cert $name }} + echo "-----> testing external tls: kafka api" + {{- $port := ( first $values.listeners.kafka.external.default.advertisedPorts ) }} + retry 5 'openssl s_client -verify_return_error -prexit + {{- if $cert.caEnabled }} + -CAfile {{ printf "/etc/tls/certs/%s" $name }}/ca.crt + {{- end }} + -key {{ printf "/etc/tls/certs/%s" $name }}/tls.key + -connect {{ $values.external.domain }}:{{ $port }}' + {{- end }} + + {{- if and (eq $values.listeners.schemaRegistry.external.default.tls.cert $name) (include "redpanda-22-2-x-without-sasl" $ | fromJson).bool }} + echo "-----> testing external tls: schema registry" + {{- $port := ( first $values.listeners.schemaRegistry.external.default.advertisedPorts ) }} + retry 5 'openssl s_client -verify_return_error -prexit + {{- if $cert.caEnabled }} + -CAfile {{ printf "/etc/tls/certs/%s" $name }}/ca.crt + {{- end }} + -key {{ printf "/etc/tls/certs/%s" $name }}/tls.key + -connect {{ $values.external.domain }}:{{ $port }}' + {{- end }} + + {{- if and (eq $values.listeners.http.external.default.tls.cert $name) (include "redpanda-22-2-x-without-sasl" $ | fromJson).bool }} + echo "-----> testing external tls: http api" + {{- $port := ( first $values.listeners.http.external.default.advertisedPorts ) }} + retry 5 'openssl s_client -verify_return_error -prexit + {{- if $cert.caEnabled }} + -CAfile {{ printf "/etc/tls/certs/%s" $name }}/ca.crt + {{- end }} + -key {{ printf "/etc/tls/certs/%s" $name }}/tls.key + -connect {{ $values.external.domain }}:{{ $port }}' + {{- end }} + + {{- end }} + echo "----" + + {{- end }} + {{- end }} + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-internal-tls-status.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-internal-tls-status.yaml new file mode 100644 index 000000000..dcfc02cbd --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-internal-tls-status.yaml @@ -0,0 +1,62 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- if and .Values.tests.enabled (include "kafka-internal-tls-enabled" . | fromJson).bool (not (include "sasl-enabled" . | fromJson).bool) -}} + {{- $service := .Values.listeners.kafka -}} + {{- $cert := get .Values.tls.certs $service.tls.cert -}} +apiVersion: v1 +kind: Pod +metadata: + name: {{ include "redpanda.fullname" . }}-test-kafka-internal-tls-status + namespace: {{ .Release.Namespace | quote }} + labels: + {{- with include "full.labels" . }} + {{- . | nindent 4 }} + {{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: {{ .Values.image.repository }}:{{ template "redpanda.tag" . }} + command: + - /usr/bin/timeout + - "120" + - bash + - -c + - | + until rpk cluster info \ + --brokers {{ include "redpanda.fullname" .}}-0.{{ include "redpanda.internal.domain" . }}:{{ $service.port }} \ + --tls-enabled \ + {{- if $cert.caEnabled }} + --tls-truststore /etc/tls/certs/{{ $service.tls.cert }}/ca.crt + {{- else }} + {{- /* This is a required field so we use the default in the redpanda debian container */}} + --tls-truststore /etc/ssl/certs/ca-certificates.crt + {{- end }} + do sleep 2 + done + resources: {{ toYaml .Values.statefulset.resources | nindent 12 }} + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-nodelete.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-nodelete.yaml new file mode 100644 index 000000000..9b5fe4237 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-nodelete.yaml @@ -0,0 +1,100 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- if and .Values.tests.enabled (dig "kafka_nodelete_topics" "[]" $.Values.config.cluster) }} +{{- $noDeleteTopics := .Values.config.cluster.kafka_nodelete_topics }} +{{- $sasl := .Values.auth.sasl }} +apiVersion: v1 +kind: Pod +metadata: + name: {{ include "redpanda.fullname" . }}-test-kafka-nodelete + namespace: {{ .Release.Namespace | quote }} + labels: +{{- with include "full.labels" . }} + {{- . | nindent 4 }} +{{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} +{{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: {{ .Values.image.repository }}:{{ template "redpanda.tag" . }} + env: + - name: REDPANDA_BROKERS + value: "{{ include "redpanda.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain | trimSuffix "." }}:{{ .Values.listeners.kafka.port }}" + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + command: + - /usr/bin/timeout + - "120" + - bash + - -c + - | + set -e +{{- $cloudStorageFlags := "" }} +{{- if (include "storage-tiered-config" .|fromJson).cloud_storage_enabled }} + {{- $cloudStorageFlags = "-c retention.bytes=80 -c segment.bytes=40 -c redpanda.remote.read=true -c redpanda.remote.write=true"}} +{{- end }} +{{- if .Values.auth.sasl.enabled }} + old_setting=${-//[^x]/} + set +x + IFS=":" read -r {{ include "rpk-sasl-environment-variables" . }} < <(grep "" $(find /etc/secrets/users/* -print)) + {{- if (include "redpanda-atleast-23-2-1" . | fromJson).bool }} + RPK_SASL_MECHANISM=${RPK_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- else }} + REDPANDA_SASL_MECHANISM=${REDPANDA_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- end }} + export {{ include "rpk-sasl-environment-variables" . }} + if [[ -n "$old_setting" ]]; then set -x; fi +{{- end }} + + exists=$(rpk topic list | grep my_sample_topic | awk '{print $1}') + if [[ "$exists" != "my_sample_topic" ]]; then + until rpk topic create my_sample_topic {{ $cloudStorageFlags }} + do sleep 2 + done + fi + + {{- range $i := until 100 }} + echo "Pandas are awesome!" | rpk topic produce my_sample_topic + {{- end }} + sleep 2 + rpk topic consume my_sample_topic -n 1 | grep "Pandas are awesome!" + + # now check if we can delete the topic (we should not) + rpk topic delete my_sample_topic + + {{- if has "my_sample_topic" $noDeleteTopics }} + result=$(rpk topic list | grep my_sample_topic | awk '{print $1}') + if [[ "$result" != "my_sample_topic" ]]; then + echo "topic should not have been deleted" + exit 1 + fi + {{- end }} + + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + resources: {{ toYaml .Values.statefulset.resources | nindent 12 }} + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-produce-consume.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-produce-consume.yaml new file mode 100644 index 000000000..d8f0ee751 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-produce-consume.yaml @@ -0,0 +1,83 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- if .Values.tests.enabled }} +{{- $sasl := .Values.auth.sasl }} +apiVersion: v1 +kind: Pod +metadata: + name: {{ include "redpanda.fullname" . }}-test-kafka-produce-consume + namespace: {{ .Release.Namespace | quote }} + labels: +{{- with include "full.labels" . }} + {{- . | nindent 4 }} +{{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} +{{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: {{ .Values.image.repository }}:{{ template "redpanda.tag" . }} + env: + - name: REDPANDA_BROKERS + value: "{{ include "redpanda.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain | trimSuffix "." }}:{{ .Values.listeners.kafka.port }}" + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + command: + - /usr/bin/timeout + - "120" + - bash + - -c + - | + set -e +{{- $cloudStorageFlags := "" }} +{{- if (include "storage-tiered-config" .|fromJson).cloud_storage_enabled }} + {{- $cloudStorageFlags = "-c retention.bytes=80 -c segment.bytes=40 -c redpanda.remote.read=true -c redpanda.remote.write=true"}} +{{- end }} +{{- if .Values.auth.sasl.enabled }} + old_setting=${-//[^x]/} + set +x + IFS=":" read -r {{ include "rpk-sasl-environment-variables" . }} < <(grep "" $(find /etc/secrets/users/* -print)) + {{- if (include "redpanda-atleast-23-2-1" . | fromJson).bool }} + RPK_SASL_MECHANISM=${RPK_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- else }} + REDPANDA_SASL_MECHANISM=${REDPANDA_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- end }} + export {{ include "rpk-sasl-environment-variables" . }} + if [[ -n "$old_setting" ]]; then set -x; fi +{{- end }} + until rpk topic create produce.consume.test.$POD_NAME {{ $cloudStorageFlags }} + do sleep 2 + done + {{- range $i := until 100 }} + echo "Pandas are awesome!" | rpk topic produce produce.consume.test.$POD_NAME + {{- end }} + sleep 2 + rpk topic consume produce.consume.test.$POD_NAME -n 1 | grep "Pandas are awesome!" + rpk topic delete produce.consume.test.$POD_NAME + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + resources: {{ toYaml .Values.statefulset.resources | nindent 12 }} + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-sasl-status.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-sasl-status.yaml new file mode 100644 index 000000000..0519c44bb --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-kafka-sasl-status.yaml @@ -0,0 +1,79 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- if and .Values.tests.enabled (include "sasl-enabled" . | fromJson).bool }} +{{- $sasl := .Values.auth.sasl }} +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "redpanda.fullname" . }}-test-kafka-sasl-status" + namespace: {{ .Release.Namespace | quote }} + labels: +{{- with include "full.labels" . }} + {{- . | nindent 4 }} +{{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: {{ .Values.image.repository }}:{{ template "redpanda.tag" . }} + command: + - /usr/bin/timeout + - "120" + - bash + - -c + - | + set -xe + +{{- if .Values.auth.sasl.enabled }} + old_setting=${-//[^x]/} + set +x + IFS=":" read -r {{ include "rpk-sasl-environment-variables" . }} < <(grep "" $(find /etc/secrets/users/* -print)) + {{- if (include "redpanda-atleast-23-2-1" . | fromJson).bool }} + RPK_SASL_MECHANISM=${RPK_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- else }} + REDPANDA_SASL_MECHANISM=${REDPANDA_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- end }} + export {{ include "rpk-sasl-environment-variables" . }} + if [[ -n "$old_setting" ]]; then set -x; fi +{{- end }} + + until rpk acl user delete myuser + do sleep 2 + done + sleep 3 + + {{ include "rpk-cluster-info" $ }} + {{ include "rpk-acl-user-create" $ }} + {{ include "rpk-acl-create" $ }} + sleep 3 + {{ include "rpk-topic-create" $ }} + {{ include "rpk-topic-describe" $ }} + {{ include "rpk-topic-delete" $ }} + rpk acl user delete myuser + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + resources: +{{- toYaml .Values.statefulset.resources | nindent 12 }} + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-license-with-console.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-license-with-console.yaml new file mode 100644 index 000000000..1edf7a350 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-license-with-console.yaml @@ -0,0 +1,61 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + +http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- if and .Values.tests.enabled (include "is-licensed" . | fromJson).bool .Values.console.enabled }} +{{- $consolePort := (get (fromJson (include "console.ContainerPort" (dict "a" (list (dict "Values" (dict "AsMap" .Values.console)) )))) "r" ) }} +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "redpanda.fullname" . }}-test-license-with-console" + namespace: {{ .Release.Namespace | quote }} + labels: + {{- with include "full.labels" . }} + {{- . | nindent 4 }} + {{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + securityContext: + runAsUser: 65535 + runAsGroup: 65535 + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: mintel/docker-alpine-bash-curl-jq:latest + command: [ "/bin/bash", "-c" ] + args: + - | + echo "testing that we do NOT have an open source license" + set -xe + + max_iteration=10 + curl -vm3 --fail --retry "120" --retry-max-time "120" http://{{ include "redpanda.fullname" . }}-console.{{ .Release.Namespace }}.svc:{{$consolePort}}/api/cluster/overview | jq . + type=$(curl -svm3 --fail --retry "120" --retry-max-time "120" http://{{ include "redpanda.fullname" . }}-console.{{ .Release.Namespace }}.svc:{{$consolePort}}/api/cluster/overview | jq -r .console.license.type) + while [[ $max_iteration -gt 0 && ("$type" == "open_source" || "$type" == "") ]]; do + max_iteration=$(( max_iteration - 1 )) + type=$(curl -svm3 --fail --retry "120" --retry-max-time "120" http://{{ include "redpanda.fullname" . }}-console.{{ .Release.Namespace }}.svc:{{$consolePort}}/api/cluster/overview | jq -r .console.license.type) + done + if [[ "$type" == "open_source" || "$type" == "" ]]; then + curl -svm3 --fail --retry "120" --retry-max-time "120" http://{{ include "redpanda.fullname" . }}-console.{{ .Release.Namespace }}.svc:{{$consolePort}}/api/cluster/overview | jq . + exit 1 + fi + set +x + echo "license test passed." +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-lifecycle-scripts.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-lifecycle-scripts.yaml new file mode 100644 index 000000000..5c72e1d9f --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-lifecycle-scripts.yaml @@ -0,0 +1,66 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- if .Values.tests.enabled }} +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "redpanda.fullname" . }}-test-lifecycle" + namespace: {{ .Release.Namespace | quote }} + labels: + {{- with include "full.labels" . }} + {{- . | nindent 4 }} + {{- end }} + annotations: + helm.sh/hook: test + helm.sh/hook-delete-policy: before-hook-creation +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: {{ .Values.image.repository }}:{{ template "redpanda.tag" . }} + env: + - name: SERVICE_NAME + value: {{ include "redpanda.fullname" . }}-0 + command: + - /bin/timeout + - "{{ mul .Values.statefulset.terminationGracePeriodSeconds 2 }}" + - bash + - -xec + - | + /bin/timeout -v {{ div .Values.statefulset.terminationGracePeriodSeconds 2 }} bash -x /var/lifecycle/preStop.sh + ls -l /tmp/preStop* + test -f /tmp/preStopHookStarted + test -f /tmp/preStopHookFinished + + /bin/timeout -v {{ div .Values.statefulset.terminationGracePeriodSeconds 2 }} bash -x /var/lifecycle/postStart.sh + ls -l /tmp/postStart* + test -f /tmp/postStartHookStarted + test -f /tmp/postStartHookFinished + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + - name: lifecycle-scripts + mountPath: /var/lifecycle + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} + - name: lifecycle-scripts + secret: + secretName: {{ (include "redpanda.fullname" . | trunc 50 ) }}-sts-lifecycle + defaultMode: 0o775 + {{- end }} \ No newline at end of file diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-loadbalancer-tls.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-loadbalancer-tls.yaml new file mode 100644 index 000000000..4db3523d2 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-loadbalancer-tls.yaml @@ -0,0 +1,173 @@ +{{/* + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + */}} +{{- if and .Values.tests.enabled .Values.tls.enabled ( eq .Values.external.type "LoadBalancer" ) -}} + {{- $values := .Values }} +apiVersion: v1 +kind: Pod +metadata: + name: {{ include "redpanda.fullname" . }}-test-loadbalancer-tls + namespace: {{ .Release.Namespace | quote }} + labels: + {{- with include "full.labels" . }} + {{- . | nindent 4 }} + {{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + serviceAccountName: test-loadbalancer-tls-redpanda + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: mintel/docker-alpine-bash-curl-jq:latest + command: + - bash + - -c + - | + set -x + export APISERVER=https://kubernetes.default.svc + export SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount + export NAMESPACE=$(cat ${SERVICEACCOUNT}/namespace) + export TOKEN=$(cat ${SERVICEACCOUNT}/token) + export CACERT=${SERVICEACCOUNT}/ca.crt + + ip_list="" + + replicas={{ .Values.statefulset.replicas }} + if [ "${replicas}" -lt "1" ]; then + echo "replicas cannot be less than 1" + exit 1 + fi + + range=$(expr $replicas - 1) + ordinal_list=$(seq 0 $range) + + set -e + + for i in $ordinal_list + do + POD_DESC=$(curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" \ + -X GET ${APISERVER}/api/v1/namespaces/{{ .Release.Namespace }}/services/lb-{{ template "redpanda.fullname" . }}-$i) + ip=$(echo $POD_DESC | jq -r .status.loadBalancer.ingress[0].ip ) + ip_list="$ip $ip_list" + done + + echo test will be run against $ip_list + echo testing LoadBalancer connectivity + + {{- range $name, $cert := $values.tls.certs }} + {{- if $cert.secretRef }} + {{- if eq $cert.secretRef.name "external-tls-secret" }} + echo "---> testing external tls" + + {{- if eq $values.listeners.kafka.external.default.tls.cert $name }} + echo "-----> testing external tls: kafka api" + {{- $port := ( first $values.listeners.kafka.external.default.advertisedPorts ) }} + + for ip in $ip_list + do + openssl s_client -verify_return_error -prexit \ + {{- if $cert.caEnabled -}} + -CAfile {{ printf "/etc/tls/certs/%s" $name }}/ca.crt \ + {{- end -}} + -key {{ printf "/etc/tls/certs/%s" $name }}/tls.key -connect $ip:{{ $port }} + done + {{- end }} + + {{- if (include "redpanda-22-2-x-without-sasl" $ | fromJson).bool }} + {{- if eq $values.listeners.schemaRegistry.external.default.tls.cert $name }} + echo "-----> testing external tls: schema registry" + {{- $port := ( first $values.listeners.schemaRegistry.external.default.advertisedPorts ) }} + for ip in $ip_list + do + openssl s_client -verify_return_error -prexit \ + {{- if $cert.caEnabled -}} + -CAfile {{ printf "/etc/tls/certs/%s" $name }}/ca.crt \ + {{- end -}} + -key {{ printf "/etc/tls/certs/%s" $name }}/tls.key -connect $ip:{{ $port }} + done + {{- end }} + + {{- if eq $values.listeners.http.external.default.tls.cert $name }} + echo "-----> testing external tls: http api" + {{- $port := ( first $values.listeners.http.external.default.advertisedPorts ) }} + for ip in $ip_list + do + openssl s_client -verify_return_error -prexit \ + {{- if $cert.caEnabled -}} + -CAfile {{ printf "/etc/tls/certs/%s" $name }}/ca.crt \ + {{- end -}} + -key {{ printf "/etc/tls/certs/%s" $name }}/tls.key -connect $ip:{{ $port }} + done + {{- end }} + {{- end }} + + {{- end }} + {{- end }} + {{- end }} + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: test-loadbalancer-tls-redpanda + annotations: + helm.sh/hook-weight: "-100" + helm.sh/hook: test + helm.sh/hook-delete-policy: before-hook-creation +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: test-loadbalancer-tls-redpanda + annotations: + helm.sh/hook-weight: "-100" + helm.sh/hook: test + helm.sh/hook-delete-policy: before-hook-creation +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: test-loadbalancer-tls-redpanda +subjects: + - kind: ServiceAccount + name: test-loadbalancer-tls-redpanda + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: test-loadbalancer-tls-redpanda + annotations: + helm.sh/hook-weight: "-100" + helm.sh/hook: test + helm.sh/hook-delete-policy: before-hook-creation +rules: + - apiGroups: + - "" + resources: + - pods + - services + verbs: + - get + +{{- end -}} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-nodeport-tls.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-nodeport-tls.yaml new file mode 100644 index 000000000..4310eaf3a --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-nodeport-tls.yaml @@ -0,0 +1,173 @@ +{{/* + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + */}} +{{- if and .Values.tests.enabled .Values.tls.enabled ( eq .Values.external.type "NodePort" ) -}} + {{- $values := .Values }} +apiVersion: v1 +kind: Pod +metadata: + name: {{ include "redpanda.fullname" . }}-test-nodeport-tls + namespace: {{ .Release.Namespace | quote }} + labels: + {{- with include "full.labels" . }} + {{- . | nindent 4 }} + {{- end }} + annotations: + helm.sh/hook: test + helm.sh/hook-delete-policy: before-hook-creation +spec: + serviceAccountName: test-nodeport-tls-redpanda-no-a-test + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: mintel/docker-alpine-bash-curl-jq:latest + command: + - bash + - -c + - | + set -x + export APISERVER=https://kubernetes.default.svc + export SERVICEACCOUNT=/var/run/secrets/kubernetes.io/serviceaccount + export NAMESPACE=$(cat ${SERVICEACCOUNT}/namespace) + export TOKEN=$(cat ${SERVICEACCOUNT}/token) + export CACERT=${SERVICEACCOUNT}/ca.crt + + ip_list="" + + replicas={{ .Values.statefulset.replicas }} + if [ "${replicas}" -lt "1" ]; then + echo "replicas cannot be less than 1" + exit 1 + fi + + range=$(expr $replicas - 1) + ordinal_list=$(seq 0 $range) + + set -e + + for i in $ordinal_list + do + POD_DESC=$(curl --cacert ${CACERT} --header "Authorization: Bearer ${TOKEN}" \ + -X GET ${APISERVER}/api/v1/namespaces/{{ .Release.Namespace }}/pods/{{ template "redpanda.fullname" . }}-$i) + ip=$(echo $POD_DESC | jq -r .status.hostIP ) + ip_list="$ip $ip_list" + done + + echo test will be run against $ip_list + echo testing NodePort connectivity + {{- range $name, $cert := $values.tls.certs }} + {{- if $cert.secretRef }} + {{- if eq $cert.secretRef.name "external-tls-secret" }} + echo "---> testing external tls" + + {{- if eq $values.listeners.kafka.external.default.tls.cert $name }} + echo "-----> testing external tls: kafka api" + {{- $port := ( first $values.listeners.kafka.external.default.advertisedPorts ) }} + for ip in $ip_list + do + openssl s_client -verify_return_error -prexit \ + {{- if $cert.caEnabled }} + -CAfile {{ printf "/etc/tls/certs/%s" $name }}/ca.crt \ + {{- end }} + -key {{ printf "/etc/tls/certs/%s" $name }}/tls.key \ + -connect ${ip}:{{ $port }} + done + {{- end }} + + {{- if (include "redpanda-22-2-x-without-sasl" $ | fromJson).bool }} + {{- if eq $values.listeners.schemaRegistry.external.default.tls.cert $name }} + echo "-----> testing external tls: schema registry" + {{- $port := ( first $values.listeners.schemaRegistry.external.default.advertisedPorts ) }} + for ip in $ip_list + do + openssl s_client -verify_return_error -prexit \ + {{- if $cert.caEnabled }} + -CAfile {{ printf "/etc/tls/certs/%s" $name }}/ca.crt \ + {{- end }} + -key {{ printf "/etc/tls/certs/%s" $name }}/tls.key \ + -connect ${ip}:{{ $port }} + done + {{- end }} + + {{- if eq $values.listeners.http.external.default.tls.cert $name }} + echo "-----> testing external tls: http api" + {{- $port := ( first $values.listeners.http.external.default.advertisedPorts ) }} + for ip in $ip_list + do + openssl s_client -verify_return_error -prexit \ + {{- if $cert.caEnabled }} + -CAfile {{ printf "/etc/tls/certs/%s" $name }}/ca.crt \ + {{- end }} + -key {{ printf "/etc/tls/certs/%s" $name }}/tls.key \ + -connect ${ip}:{{ $port }} + done + {{- end }} + {{- end }} + + {{- end }} + {{- end }} + {{- end }} + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: test-nodeport-tls-redpanda-no-a-test + annotations: + helm.sh/hook: test + helm.sh/hook-delete-policy: before-hook-creation + helm.sh/hook-weight: "-100" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: test-nodeport-tls-redpanda-no-a-test + annotations: + helm.sh/hook: test + helm.sh/hook-delete-policy: before-hook-creation + helm.sh/hook-weight: "-100" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: test-nodeport-tls-redpanda-no-a-test +subjects: + - kind: ServiceAccount + name: test-nodeport-tls-redpanda-no-a-test + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: test-nodeport-tls-redpanda-no-a-test + annotations: + helm.sh/hook: test + helm.sh/hook-delete-policy: before-hook-creation + helm.sh/hook-weight: "-100" +rules: + - apiGroups: + - "" + resources: + - pods + - services + verbs: + - get +{{- end -}} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-pandaproxy-internal-tls-status.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-pandaproxy-internal-tls-status.yaml new file mode 100644 index 000000000..4cb6aaa0f --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-pandaproxy-internal-tls-status.yaml @@ -0,0 +1,81 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- if and .Values.tests.enabled (include "http-internal-tls-enabled" . | fromJson).bool .Values.listeners.http.enabled (include "redpanda-22-2-x-without-sasl" . | fromJson).bool -}} + {{- $service := .Values.listeners.http -}} + {{- $cert := get .Values.tls.certs $service.tls.cert -}} + {{- $sasl := .Values.auth.sasl }} +apiVersion: v1 +kind: Pod +metadata: + name: {{ include "redpanda.fullname" . }}-test-pandaproxy-internal-tls-status + namespace: {{ .Release.Namespace | quote }} + labels: + {{- with include "full.labels" . }} + {{- . | nindent 4 }} + {{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: {{ .Values.image.repository }}:{{ template "redpanda.tag" . }} + command: [ "/bin/bash", "-c" ] + args: + - | + {{- if .Values.auth.sasl.enabled }} + old_setting=${-//[^x]/} + set +x + IFS=":" read -r {{ include "rpk-sasl-environment-variables" . }} < <(grep "" $(find /etc/secrets/users/* -print)) + {{- if (include "redpanda-atleast-23-2-1" . | fromJson).bool }} + RPK_SASL_MECHANISM=${RPK_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- else }} + REDPANDA_SASL_MECHANISM=${REDPANDA_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- end }} + export {{ include "rpk-sasl-environment-variables" . }} + RPK_USER="${RPK_USER:-${REDPANDA_SASL_USERNAME}}" + RPK_PASS="${RPK_PASS:-${REDPANDA_SASL_PASSWORD}}" + if [[ -n "$old_setting" ]]; then set -x; fi + {{- end }} + + curl -svm3 --fail --retry "120" --retry-max-time "120" --retry-all-errors --ssl-reqd \ + {{- if or (include "sasl-enabled" .|fromJson).bool .Values.listeners.http.authenticationMethod }} + -u ${RPK_USER}:${RPK_PASS} \ + {{- end }} + {{- if $cert.caEnabled }} + --cacert /etc/tls/certs/{{ $service.tls.cert }}/ca.crt \ + {{- end }} + https://{{ include "redpanda.internal.domain" . }}:{{ .Values.listeners.http.port }}/brokers + + curl -svm3 --fail --retry "120" --retry-max-time "120" --retry-all-errors --ssl-reqd \ + {{- if or (include "sasl-enabled" .|fromJson).bool .Values.listeners.http.authenticationMethod }} + -u ${RPK_USER}:${RPK_PASS} \ + {{- end }} + {{- if $cert.caEnabled }} + --cacert /etc/tls/certs/{{ $service.tls.cert }}/ca.crt \ + {{- end }} + https://{{ include "redpanda.internal.domain" . }}:{{ .Values.listeners.http.port }}/topics + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + resources: {{ toYaml .Values.statefulset.resources | nindent 12 }} + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +{{- end -}} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-pandaproxy-status.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-pandaproxy-status.yaml new file mode 100644 index 000000000..4f5ee6bb7 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-pandaproxy-status.yaml @@ -0,0 +1,72 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- if and .Values.tests.enabled (not (include "http-internal-tls-enabled" . | fromJson).bool) .Values.listeners.http.enabled (include "redpanda-22-2-x-without-sasl" . | fromJson).bool -}} + {{- $sasl := .Values.auth.sasl }} +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "redpanda.fullname" . }}-test-pandaproxy-status" + namespace: {{ .Release.Namespace | quote }} + labels: + {{- with include "full.labels" . }} + {{- . | nindent 4 }} + {{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: {{ .Values.image.repository }}:{{ template "redpanda.tag" . }} + command: [ "/bin/bash", "-c" ] + args: + - | + {{- if .Values.auth.sasl.enabled }} + old_setting=${-//[^x]/} + set +x + IFS=: read -r {{ include "rpk-sasl-environment-variables" . }} < <(grep "" $(find /etc/secrets/users/* -print)) + {{- if (include "redpanda-atleast-23-2-1" . | fromJson).bool }} + RPK_SASL_MECHANISM=${RPK_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- else }} + REDPANDA_SASL_MECHANISM=${REDPANDA_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- end }} + export {{ include "rpk-sasl-environment-variables" . }} + RPK_USER="${RPK_USER:-${REDPANDA_SASL_USERNAME}}" + RPK_PASS="${RPK_PASS:-${REDPANDA_SASL_PASSWORD}}" + if [[ -n "$old_setting" ]]; then set -x; fi + {{- end }} + + curl {{ template "curl-options" . }} \ + {{- if or (include "sasl-enabled" .|fromJson).bool .Values.listeners.http.authenticationMethod }} + -u ${RPK_USER}:${RPK_PASS} \ + {{- end }} + http://{{ include "redpanda.servicename" . }}:{{ .Values.listeners.http.port }}/brokers + + curl {{ template "curl-options" . }} \ + {{- if or (include "sasl-enabled" .|fromJson).bool .Values.listeners.http.authenticationMethod }} + -u ${RPK_USER}:${RPK_PASS} \ + {{- end }} + http://{{ include "redpanda.servicename" . }}:{{ .Values.listeners.http.port }}/topics + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-prometheus-targets.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-prometheus-targets.yaml new file mode 100644 index 000000000..81f83a34e --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-prometheus-targets.yaml @@ -0,0 +1,84 @@ +{{/* + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + */}} + +{{- if and .Values.tests.enabled .Values.monitoring.enabled }} +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "redpanda.fullname" . }}-test-prometheus-targets" + namespace: {{ .Release.Namespace | quote }} + labels: + {{- with include "full.labels" . }} + {{- . | nindent 4 }} + {{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: registry.gitlab.com/gitlab-ci-utils/curl-jq:latest + command: [ "/bin/bash", "-c" ] + args: + - | + set -xe + + HEALTHY=$( curl {{ template "curl-options" . }} http://prometheus-operated.prometheus.svc.cluster.local:9090/-/healthy) + if [ $HEALTHY != 200 ]; then + echo "prometheus is not healthy, exiting" + exit 1 + fi + + echo "prometheus is healthy, checking if ready..." + + READY=$( curl {{ template "curl-options" . }} http://prometheus-operated.prometheus.svc.cluster.local:9090/-/ready) + if [ $READY != 200 ]; then + echo "prometheus is not ready, exiting" + exit 1 + fi + + echo "prometheus is ready, requesting target information..." + + + curl_prometheus() { + + # Run the command, and save the exit code + # from: https://prometheus.io/docs/prometheus/latest/querying/api/ + local RESULT=$( curl {{ template "curl-options" . }} http://prometheus-operated.prometheus.svc.cluster.local:9090/api/v1/targets?scrapePool=serviceMonitor/{{ .Release.Namespace }}/{{ include "redpanda.fullname" . }}/0 | jq '.data.activeTargets[].health | select(. == "up")' | wc -l ) + + echo $RESULT + } + for d in $(seq 1 30); do + RESULT=$(curl_prometheus) + if [ $RESULT == {{ .Values.statefulset.replicas }} ]; then + break + fi + sleep 15 + done + + set +x + if [ $RESULT != {{ .Values.statefulset.replicas }} ]; then + curl --fail http://prometheus-operated.prometheus.svc.cluster.local:9090/api/v1/targets?scrapePool=serviceMonitor/{{ .Release.Namespace }}/{{ include "redpanda.fullname" . }}/0 | jq . + echo "the number of targets unexpected; got ${RESULT} targets 'up', but was expecting {{ .Values.statefulset.replicas }}" + exit 1 + fi +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-rack-awareness.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-rack-awareness.yaml new file mode 100644 index 000000000..82a31937f --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-rack-awareness.yaml @@ -0,0 +1,61 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} +{{- if .Values.tests.enabled }} +apiVersion: v1 +kind: Pod +metadata: + name: {{ include "redpanda.fullname" . }}-test-rack-awareness + namespace: {{ .Release.Namespace | quote }} +{{- with include "full.labels" . }} + labels: {{- . | nindent 4 }} +{{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} +{{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} +{{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: {{ .Values.image.repository }}:{{ template "redpanda.tag" . }} + command: + - /bin/bash + - -c + - | + set -e +{{- if and .Values.rackAwareness.enabled (include "redpanda-atleast-22-3-0" . | fromJson).bool }} + curl {{ template "curl-options" . }} \ + {{- if (include "tls-enabled" . | fromJson).bool }} + {{- if (dig "default" "caEnabled" false .Values.tls.certs) }} + --cacert "/etc/tls/certs/default/ca.crt" \ + {{- end }} + https://{{ include "redpanda.internal.domain" . }}:{{ .Values.listeners.admin.port }}/v1/node_config | grep '"rack":"rack[1-4]"' + {{- else }} + http://{{ include "redpanda.internal.domain" . }}:{{ .Values.listeners.admin.port }}/v1/node_config | grep '"rack":"rack[1-4]"' + {{- end }} +{{- end }} + + rpk redpanda admin config print --host {{ include "redpanda.internal.domain" . }}:{{ .Values.listeners.admin.port }} | grep '"enable_rack_awareness": {{ .Values.rackAwareness.enabled }}' + + rpk cluster config get enable_rack_awareness + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +{{- end }} \ No newline at end of file diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-rpk-debug-bundle.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-rpk-debug-bundle.yaml new file mode 100644 index 000000000..3230f0881 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-rpk-debug-bundle.yaml @@ -0,0 +1,104 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{/* + +This test currently fails because of a bug where when multiple containers exist +The api returns an error. We should be requesting logs from each container. + + +{{- if and .Values.tests.enabled .Values.rbac.enabled (include "redpanda-atleast-23-1-1" .|fromJson).bool -}} + {{- $sasl := .Values.auth.sasl }} + {{- $useSaslSecret := and $sasl.enabled (not (empty $sasl.secretRef )) }} + + +apiVersion: v1 +kind: Pod +metadata: + name: {{ include "redpanda.fullname" . }}-test-rpk-debug-bundle + namespace: {{ .Release.Namespace | quote }} + labels: +{{- with include "full.labels" . }} + {{- . | nindent 4 }} +{{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + affinity: + podAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: + statefulset.kubernetes.io/pod-name: {{ include "redpanda.fullname" . }}-0 + topologyKey: kubernetes.io/hostname + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + initContainers: + - name: {{ template "redpanda.name" . }} + image: {{ .Values.image.repository}}:{{ template "redpanda.tag" . }} + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + - name: shared-data + mountPath: /usr/share/redpanda/test + - name: datadir + mountPath: /var/lib/redpanda/data + command: + - /bin/bash + - -c + - | + set -e + {{- if .Values.auth.sasl.enabled }} + old_setting=${-//[^x]/} + set +x + IFS=: read -r {{ include "rpk-sasl-environment-variables" . }} < <(grep "" $(find /etc/secrets/users/* -print)) + {{- if (include "redpanda-atleast-23-2-1" . | fromJson).bool }} + RPK_SASL_MECHANISM=${RPK_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- else }} + REDPANDA_SASL_MECHANISM=${REDPANDA_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- end }} + export {{ include "rpk-sasl-environment-variables" . }} + if [[ -n "$old_setting" ]]; then set -x; fi + {{- end }} + rpk debug bundle -o /usr/share/redpanda/test/debug-test.zip -n {{ .Release.Namespace }} + containers: + - name: {{ template "redpanda.name" . }}-tester + image: busybox:latest + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + - name: shared-data + mountPath: /test + command: + - /bin/ash + - -c + - | + set -e + unzip /test/debug-test.zip -d /tmp/bundle + + test -f /tmp/bundle/logs/{{ .Release.Namespace }}-0.txt + test -f /tmp/bundle/logs/{{ .Release.Namespace }}-1.txt + test -f /tmp/bundle/logs/{{ .Release.Namespace }}-2.txt + + test -d /tmp/bundle/controller + + test -f /tmp/bundle/k8s/pods.json + test -f /tmp/bundle/k8s/configmaps.json + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +{{- end -}} +*/}} \ No newline at end of file diff --git a/charts/redpanda/redpanda/5.9.7/templates/tests/test-sasl-updated.yaml b/charts/redpanda/redpanda/5.9.7/templates/tests/test-sasl-updated.yaml new file mode 100644 index 000000000..5f61be552 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/templates/tests/test-sasl-updated.yaml @@ -0,0 +1,71 @@ +{{/* +Licensed to the Apache Software Foundation (ASF) under one or more +contributor license agreements. See the NOTICE file distributed with +this work for additional information regarding copyright ownership. +The ASF licenses this file to You under the Apache License, Version 2.0 +(the "License"); you may not use this file except in compliance with +the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/}} + +{{- if and .Values.tests.enabled (include "sasl-enabled" . | fromJson).bool (eq .Values.auth.sasl.secretRef "some-users") -}} +apiVersion: v1 +kind: Pod +metadata: + name: "{{ include "redpanda.fullname" . }}-test-update-sasl-users" + namespace: {{ .Release.Namespace | quote }} + labels: +{{- with include "full.labels" . }} + {{- . | nindent 4 }} +{{- end }} + annotations: + "helm.sh/hook": test + "helm.sh/hook-delete-policy": before-hook-creation +spec: + restartPolicy: Never + securityContext: {{ include "pod-security-context" . | nindent 4 }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: {{- toYaml . | nindent 4 }} + {{- end }} + containers: + - name: {{ template "redpanda.name" . }} + image: {{ .Values.image.repository }}:{{ template "redpanda.tag" . }} + command: + - /usr/bin/timeout + - "120" + - bash + - -c + - | + set -e + IFS=: read -r {{ include "rpk-sasl-environment-variables" . }} < <(grep "" $(find /etc/secrets/users/* -print)) + {{- if (include "redpanda-atleast-23-2-1" . | fromJson).bool }} + RPK_SASL_MECHANISM=${RPK_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- else }} + REDPANDA_SASL_MECHANISM=${REDPANDA_SASL_MECHANISM:-{{ .Values.auth.sasl.mechanism | upper }}} + {{- end }} + export {{ include "rpk-sasl-environment-variables" . }} + + set -x + + # check that the users list did update + ready_result_exit_code=1 + while [[ ${ready_result_exit_code} -ne 0 ]]; do + ready_result=$(rpk acl user list | grep anotheranotherme 2>&1) && ready_result_exit_code=$? + sleep 2 + done + + # check that sasl is not broken + {{ include "rpk-cluster-info" $ }} + volumeMounts: {{ include "default-mounts" . | nindent 8 }} + resources: +{{- toYaml .Values.statefulset.resources | nindent 12 }} + securityContext: {{ include "container-security-context" . | nindent 8 }} + volumes: {{ include "default-volumes" . | nindent 4 }} +{{- end }} diff --git a/charts/redpanda/redpanda/5.9.7/values.schema.json b/charts/redpanda/redpanda/5.9.7/values.schema.json new file mode 100644 index 000000000..cde7a0d54 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/values.schema.json @@ -0,0 +1,5848 @@ +{ + "$id": "https://github.com/redpanda-data/helm-charts/charts/redpanda/values", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "description": "DO NOT EDIT!. This file was generated by ./cmd/genschema/genschema.go", + "properties": { + "affinity": { + "properties": { + "nodeAffinity": { + "properties": { + "preferredDuringSchedulingIgnoredDuringExecution": { + "oneOf": [ + { + "items": { + "properties": { + "preference": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchFields": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, + "weight": { + "type": "integer" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "requiredDuringSchedulingIgnoredDuringExecution": { + "properties": { + "nodeSelectorTerms": { + "oneOf": [ + { + "items": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchFields": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + } + }, + "type": "object" + }, + "podAffinity": { + "properties": { + "preferredDuringSchedulingIgnoredDuringExecution": { + "oneOf": [ + { + "items": { + "properties": { + "podAffinityTerm": { + "properties": { + "labelSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "matchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "mismatchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "namespaceSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "namespaces": { + "items": { + "type": "string" + }, + "type": "array" + }, + "topologyKey": { + "type": "string" + } + }, + "type": "object" + }, + "weight": { + "type": "integer" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "requiredDuringSchedulingIgnoredDuringExecution": { + "oneOf": [ + { + "items": { + "properties": { + "labelSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "matchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "mismatchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "namespaceSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "namespaces": { + "items": { + "type": "string" + }, + "type": "array" + }, + "topologyKey": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + }, + "podAntiAffinity": { + "properties": { + "preferredDuringSchedulingIgnoredDuringExecution": { + "oneOf": [ + { + "items": { + "properties": { + "podAffinityTerm": { + "properties": { + "labelSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "matchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "mismatchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "namespaceSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "namespaces": { + "items": { + "type": "string" + }, + "type": "array" + }, + "topologyKey": { + "type": "string" + } + }, + "type": "object" + }, + "weight": { + "type": "integer" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "requiredDuringSchedulingIgnoredDuringExecution": { + "oneOf": [ + { + "items": { + "properties": { + "labelSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "matchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "mismatchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "namespaceSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "namespaces": { + "items": { + "type": "string" + }, + "type": "array" + }, + "topologyKey": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + } + }, + "type": "object" + }, + "auditLogging": { + "properties": { + "clientMaxBufferSize": { + "type": "integer" + }, + "enabled": { + "type": "boolean" + }, + "enabledEventTypes": { + "oneOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "excludedPrincipals": { + "oneOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "excludedTopics": { + "oneOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "listener": { + "type": "string" + }, + "partitions": { + "type": "integer" + }, + "queueDrainIntervalMs": { + "type": "integer" + }, + "queueMaxBufferSizePerShard": { + "type": "integer" + }, + "replicationFactor": { + "oneOf": [ + { + "type": "integer" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + }, + "auth": { + "properties": { + "sasl": { + "properties": { + "bootstrapUser": { + "properties": { + "mechanism": { + "pattern": "^(SCRAM-SHA-512|SCRAM-SHA-256)$", + "type": "string" + }, + "name": { + "type": "string" + }, + "password": { + "type": "string" + }, + "secretKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "enabled": { + "type": "boolean" + }, + "mechanism": { + "type": "string" + }, + "secretRef": { + "type": "string" + }, + "users": { + "oneOf": [ + { + "items": { + "properties": { + "mechanism": { + "pattern": "^(SCRAM-SHA-512|SCRAM-SHA-256)$", + "type": "string" + }, + "name": { + "type": "string" + }, + "password": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + } + }, + "required": [ + "enabled" + ], + "type": "object" + } + }, + "required": [ + "sasl" + ], + "type": "object" + }, + "clusterDomain": { + "type": "string" + }, + "commonLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "config": { + "properties": { + "cluster": { + "type": "object" + }, + "node": { + "type": "object" + }, + "pandaproxy_client": { + "properties": { + "consumer_heartbeat_interval_ms": { + "type": "integer" + }, + "consumer_rebalance_timeout_ms": { + "type": "integer" + }, + "consumer_request_max_bytes": { + "type": "integer" + }, + "consumer_request_timeout_ms": { + "type": "integer" + }, + "consumer_session_timeout_ms": { + "type": "integer" + }, + "produce_batch_delay_ms": { + "type": "integer" + }, + "produce_batch_record_count": { + "type": "integer" + }, + "produce_batch_size_bytes": { + "type": "integer" + }, + "retries": { + "type": "integer" + }, + "retry_base_backoff_ms": { + "type": "integer" + } + }, + "type": "object" + }, + "rpk": { + "type": "object" + }, + "schema_registry_client": { + "properties": { + "consumer_heartbeat_interval_ms": { + "type": "integer" + }, + "consumer_rebalance_timeout_ms": { + "type": "integer" + }, + "consumer_request_max_bytes": { + "type": "integer" + }, + "consumer_request_timeout_ms": { + "type": "integer" + }, + "consumer_session_timeout_ms": { + "type": "integer" + }, + "produce_batch_delay_ms": { + "type": "integer" + }, + "produce_batch_record_count": { + "type": "integer" + }, + "produce_batch_size_bytes": { + "type": "integer" + }, + "retries": { + "type": "integer" + }, + "retry_base_backoff_ms": { + "type": "integer" + } + }, + "type": "object" + }, + "tunable": { + "additionalProperties": true, + "properties": { + "group_initial_rebalance_delay": { + "type": "integer" + }, + "log_retention_ms": { + "type": "integer" + } + }, + "type": "object" + } + }, + "required": [ + "cluster", + "node", + "tunable" + ], + "type": "object" + }, + "connectors": { + "properties": { + "connectors": { + "properties": { + "fullnameOverwrite": { + "type": "string" + }, + "restPort": { + "type": "integer" + } + }, + "type": "object" + }, + "enabled": { + "type": "boolean" + } + }, + "type": "object" + }, + "console": { + "properties": { + "console": { + "properties": { + "config": { + "type": "object" + } + }, + "type": "object" + }, + "enabled": { + "type": "boolean" + } + }, + "type": "object" + }, + "enterprise": { + "properties": { + "license": { + "type": "string" + }, + "licenseSecretRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "external": { + "properties": { + "addresses": { + "oneOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "domain": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "externalDns": { + "properties": { + "enabled": { + "type": "boolean" + } + }, + "required": [ + "enabled" + ], + "type": "object" + }, + "prefixTemplate": { + "type": "string" + }, + "service": { + "properties": { + "enabled": { + "type": "boolean" + } + }, + "required": [ + "enabled" + ], + "type": "object" + }, + "sourceRanges": { + "oneOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "type": { + "pattern": "^(LoadBalancer|NodePort)$", + "type": "string" + } + }, + "required": [ + "enabled" + ], + "type": "object" + }, + "force": { + "type": "boolean" + }, + "fullnameOverride": { + "type": "string" + }, + "image": { + "description": "Values used to define the container image to be used for Redpanda", + "properties": { + "pullPolicy": { + "description": "The Kubernetes Pod image pull policy.", + "pattern": "^(Always|Never|IfNotPresent)$", + "type": "string" + }, + "repository": { + "default": "docker.redpanda.com/redpandadata/redpanda", + "description": "container image repository", + "type": "string" + }, + "tag": { + "default": "Chart.appVersion", + "description": "The container image tag. Use the Redpanda release version. Must be a valid semver prefixed with a 'v'.", + "pattern": "^v(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$|^$", + "type": "string" + } + }, + "required": [ + "repository", + "pullPolicy" + ], + "type": "object" + }, + "imagePullSecrets": { + "oneOf": [ + { + "items": { + "properties": { + "name": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "license_key": { + "deprecated": true, + "pattern": "^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?\\.(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$|^$", + "type": "string" + }, + "license_secret_ref": { + "deprecated": true, + "properties": { + "secret_key": { + "type": "string" + }, + "secret_name": { + "type": "string" + } + }, + "type": "object" + }, + "listeners": { + "properties": { + "admin": { + "properties": { + "appProtocol": { + "type": "string" + }, + "external": { + "minProperties": 1, + "patternProperties": { + "^[A-Za-z_][A-Za-z0-9_]*$": { + "properties": { + "advertisedPorts": { + "items": { + "type": "integer" + }, + "minItems": 1, + "type": "array" + }, + "enabled": { + "type": "boolean" + }, + "nodePort": { + "type": "integer" + }, + "port": { + "type": "integer" + }, + "tls": { + "properties": { + "cert": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "requireClientAuth": { + "type": "boolean" + }, + "trustStore": { + "maxProperties": 1, + "minProperties": 1, + "properties": { + "configMapKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "secretKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "required": [ + "port" + ], + "type": "object" + } + }, + "type": "object" + }, + "port": { + "type": "integer" + }, + "tls": { + "properties": { + "cert": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "requireClientAuth": { + "type": "boolean" + }, + "trustStore": { + "maxProperties": 1, + "minProperties": 1, + "properties": { + "configMapKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "secretKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "required": [ + "cert", + "requireClientAuth" + ], + "type": "object" + } + }, + "required": [ + "port", + "tls" + ], + "type": "object" + }, + "http": { + "properties": { + "authenticationMethod": { + "oneOf": [ + { + "enum": [ + "none", + "http_basic" + ], + "type": "string" + }, + { + "type": "null" + } + ] + }, + "enabled": { + "type": "boolean" + }, + "external": { + "minProperties": 1, + "patternProperties": { + "^[A-Za-z_][A-Za-z0-9_]*$": { + "properties": { + "advertisedPorts": { + "items": { + "type": "integer" + }, + "minItems": 1, + "type": "array" + }, + "authenticationMethod": { + "oneOf": [ + { + "enum": [ + "none", + "http_basic" + ], + "type": "string" + }, + { + "type": "null" + } + ] + }, + "enabled": { + "type": "boolean" + }, + "nodePort": { + "type": "integer" + }, + "port": { + "type": "integer" + }, + "prefixTemplate": { + "type": "string" + }, + "tls": { + "properties": { + "cert": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "requireClientAuth": { + "type": "boolean" + }, + "trustStore": { + "maxProperties": 1, + "minProperties": 1, + "properties": { + "configMapKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "secretKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "required": [ + "port" + ], + "type": "object" + } + }, + "type": "object" + }, + "kafkaEndpoint": { + "pattern": "^[A-Za-z_-][A-Za-z0-9_-]*$", + "type": "string" + }, + "port": { + "type": "integer" + }, + "tls": { + "properties": { + "cert": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "requireClientAuth": { + "type": "boolean" + }, + "trustStore": { + "maxProperties": 1, + "minProperties": 1, + "properties": { + "configMapKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "secretKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "required": [ + "cert", + "requireClientAuth" + ], + "type": "object" + } + }, + "required": [ + "enabled", + "tls", + "kafkaEndpoint", + "port" + ], + "type": "object" + }, + "kafka": { + "properties": { + "authenticationMethod": { + "oneOf": [ + { + "enum": [ + "sasl", + "none", + "mtls_identity" + ], + "type": "string" + }, + { + "type": "null" + } + ] + }, + "external": { + "minProperties": 1, + "patternProperties": { + "^[A-Za-z_][A-Za-z0-9_]*$": { + "properties": { + "advertisedPorts": { + "items": { + "type": "integer" + }, + "minItems": 1, + "type": "array" + }, + "authenticationMethod": { + "oneOf": [ + { + "enum": [ + "sasl", + "none", + "mtls_identity" + ], + "type": "string" + }, + { + "type": "null" + } + ] + }, + "enabled": { + "type": "boolean" + }, + "nodePort": { + "type": "integer" + }, + "port": { + "type": "integer" + }, + "prefixTemplate": { + "type": "string" + }, + "tls": { + "properties": { + "cert": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "requireClientAuth": { + "type": "boolean" + }, + "trustStore": { + "maxProperties": 1, + "minProperties": 1, + "properties": { + "configMapKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "secretKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "required": [ + "port" + ], + "type": "object" + } + }, + "type": "object" + }, + "port": { + "type": "integer" + }, + "tls": { + "properties": { + "cert": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "requireClientAuth": { + "type": "boolean" + }, + "trustStore": { + "maxProperties": 1, + "minProperties": 1, + "properties": { + "configMapKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "secretKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "required": [ + "cert", + "requireClientAuth" + ], + "type": "object" + } + }, + "required": [ + "tls", + "port" + ], + "type": "object" + }, + "rpc": { + "properties": { + "port": { + "type": "integer" + }, + "tls": { + "properties": { + "cert": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "requireClientAuth": { + "type": "boolean" + }, + "trustStore": { + "maxProperties": 1, + "minProperties": 1, + "properties": { + "configMapKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "secretKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "required": [ + "cert", + "requireClientAuth" + ], + "type": "object" + } + }, + "required": [ + "port", + "tls" + ], + "type": "object" + }, + "schemaRegistry": { + "properties": { + "authenticationMethod": { + "oneOf": [ + { + "enum": [ + "none", + "http_basic" + ], + "type": "string" + }, + { + "type": "null" + } + ] + }, + "enabled": { + "type": "boolean" + }, + "external": { + "minProperties": 1, + "patternProperties": { + "^[A-Za-z_][A-Za-z0-9_]*$": { + "properties": { + "advertisedPorts": { + "items": { + "type": "integer" + }, + "minItems": 1, + "type": "array" + }, + "authenticationMethod": { + "oneOf": [ + { + "enum": [ + "none", + "http_basic" + ], + "type": "string" + }, + { + "type": "null" + } + ] + }, + "enabled": { + "type": "boolean" + }, + "nodePort": { + "type": "integer" + }, + "port": { + "type": "integer" + }, + "tls": { + "properties": { + "cert": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "requireClientAuth": { + "type": "boolean" + }, + "trustStore": { + "maxProperties": 1, + "minProperties": 1, + "properties": { + "configMapKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "secretKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "kafkaEndpoint": { + "pattern": "^[A-Za-z_-][A-Za-z0-9_-]*$", + "type": "string" + }, + "port": { + "type": "integer" + }, + "tls": { + "properties": { + "cert": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "requireClientAuth": { + "type": "boolean" + }, + "trustStore": { + "maxProperties": 1, + "minProperties": 1, + "properties": { + "configMapKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "secretKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "required": [ + "cert", + "requireClientAuth" + ], + "type": "object" + } + }, + "required": [ + "enabled", + "kafkaEndpoint", + "port", + "tls" + ], + "type": "object" + } + }, + "required": [ + "admin", + "http", + "kafka", + "schemaRegistry", + "rpc" + ], + "type": "object" + }, + "logging": { + "properties": { + "logLevel": { + "pattern": "^(error|warn|info|debug|trace)$", + "type": "string" + }, + "usageStats": { + "properties": { + "clusterId": { + "type": "string" + }, + "enabled": { + "type": "boolean" + } + }, + "required": [ + "enabled" + ], + "type": "object" + } + }, + "required": [ + "logLevel", + "usageStats" + ], + "type": "object" + }, + "monitoring": { + "properties": { + "enableHttp2": { + "type": "boolean" + }, + "enabled": { + "type": "boolean" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "scrapeInterval": { + "type": "string" + }, + "tlsConfig": { + "properties": { + "ca": { + "properties": { + "configMap": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "secret": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "caFile": { + "type": "string" + }, + "cert": { + "properties": { + "configMap": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "secret": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "certFile": { + "type": "string" + }, + "insecureSkipVerify": { + "type": "boolean" + }, + "keyFile": { + "type": "string" + }, + "keySecret": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "serverName": { + "type": "string" + } + }, + "type": "object" + } + }, + "required": [ + "enabled", + "scrapeInterval" + ], + "type": "object" + }, + "nameOverride": { + "type": "string" + }, + "nodeSelector": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "post_install_job": { + "properties": { + "affinity": { + "properties": { + "nodeAffinity": { + "properties": { + "preferredDuringSchedulingIgnoredDuringExecution": { + "oneOf": [ + { + "items": { + "properties": { + "preference": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchFields": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, + "weight": { + "type": "integer" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "requiredDuringSchedulingIgnoredDuringExecution": { + "properties": { + "nodeSelectorTerms": { + "oneOf": [ + { + "items": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchFields": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + } + }, + "type": "object" + }, + "podAffinity": { + "properties": { + "preferredDuringSchedulingIgnoredDuringExecution": { + "oneOf": [ + { + "items": { + "properties": { + "podAffinityTerm": { + "properties": { + "labelSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "matchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "mismatchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "namespaceSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "namespaces": { + "items": { + "type": "string" + }, + "type": "array" + }, + "topologyKey": { + "type": "string" + } + }, + "type": "object" + }, + "weight": { + "type": "integer" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "requiredDuringSchedulingIgnoredDuringExecution": { + "oneOf": [ + { + "items": { + "properties": { + "labelSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "matchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "mismatchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "namespaceSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "namespaces": { + "items": { + "type": "string" + }, + "type": "array" + }, + "topologyKey": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + }, + "podAntiAffinity": { + "properties": { + "preferredDuringSchedulingIgnoredDuringExecution": { + "oneOf": [ + { + "items": { + "properties": { + "podAffinityTerm": { + "properties": { + "labelSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "matchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "mismatchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "namespaceSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "namespaces": { + "items": { + "type": "string" + }, + "type": "array" + }, + "topologyKey": { + "type": "string" + } + }, + "type": "object" + }, + "weight": { + "type": "integer" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "requiredDuringSchedulingIgnoredDuringExecution": { + "oneOf": [ + { + "items": { + "properties": { + "labelSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "matchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "mismatchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "namespaceSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "namespaces": { + "items": { + "type": "string" + }, + "type": "array" + }, + "topologyKey": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + } + }, + "type": "object" + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "enabled": { + "type": "boolean" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "podTemplate": { + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "spec": { + "properties": { + "containers": { + "oneOf": [ + { + "items": { + "properties": { + "env": { + "items": { + "properties": { + "name": { + "type": "string" + }, + "value": { + "type": "string" + }, + "valueFrom": { + "properties": { + "configMapKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "fieldRef": { + "properties": { + "apiVersion": { + "type": "string" + }, + "fieldPath": { + "type": "string" + } + }, + "type": "object" + }, + "resourceFieldRef": { + "properties": { + "containerName": { + "type": "string" + }, + "divisor": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + }, + "resource": { + "type": "string" + } + }, + "type": "object" + }, + "secretKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "name": { + "enum": [ + "redpanda", + "post-install", + "post-upgrade" + ], + "type": "string" + }, + "securityContext": { + "properties": { + "allowPrivilegeEscalation": { + "type": "boolean" + }, + "capabilities": { + "properties": { + "add": { + "items": { + "type": "string" + }, + "type": "array" + }, + "drop": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "privileged": { + "type": "boolean" + }, + "procMount": { + "type": "string" + }, + "readOnlyRootFilesystem": { + "type": "boolean" + }, + "runAsGroup": { + "type": "integer" + }, + "runAsNonRoot": { + "type": "boolean" + }, + "runAsUser": { + "type": "integer" + }, + "seLinuxOptions": { + "properties": { + "level": { + "type": "string" + }, + "role": { + "type": "string" + }, + "type": { + "type": "string" + }, + "user": { + "type": "string" + } + }, + "type": "object" + }, + "seccompProfile": { + "properties": { + "localhostProfile": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "type": "object" + }, + "windowsOptions": { + "properties": { + "gmsaCredentialSpec": { + "type": "string" + }, + "gmsaCredentialSpecName": { + "type": "string" + }, + "hostProcess": { + "type": "boolean" + }, + "runAsUserName": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "required": [ + "name", + "env" + ], + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "securityContext": { + "properties": { + "fsGroup": { + "type": "integer" + }, + "fsGroupChangePolicy": { + "enum": [ + "OnRootMismatch", + "Always" + ], + "type": "string" + }, + "runAsGroup": { + "type": "integer" + }, + "runAsNonRoot": { + "type": "boolean" + }, + "runAsUser": { + "type": "integer" + }, + "seLinuxOptions": { + "properties": { + "level": { + "type": "string" + }, + "role": { + "type": "string" + }, + "type": { + "type": "string" + }, + "user": { + "type": "string" + } + }, + "type": "object" + }, + "seccompProfile": { + "properties": { + "localhostProfile": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "type": "object" + }, + "supplementalGroups": { + "oneOf": [ + { + "items": { + "type": "integer" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "sysctls": { + "oneOf": [ + { + "items": { + "properties": { + "name": { + "type": "string" + }, + "value": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "windowsOptions": { + "properties": { + "gmsaCredentialSpec": { + "type": "string" + }, + "gmsaCredentialSpecName": { + "type": "string" + }, + "hostProcess": { + "type": "boolean" + }, + "runAsUserName": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "required": [ + "containers" + ], + "type": "object" + } + }, + "required": [ + "labels", + "annotations", + "spec" + ], + "type": "object" + }, + "resources": { + "properties": { + "claims": { + "oneOf": [ + { + "items": { + "properties": { + "name": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "limits": { + "additionalProperties": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + }, + "type": "object" + }, + "requests": { + "additionalProperties": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + }, + "type": "object" + } + }, + "type": "object" + }, + "securityContext": { + "properties": { + "allowPrivilegeEscalation": { + "type": "boolean" + }, + "capabilities": { + "properties": { + "add": { + "oneOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "drop": { + "oneOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + }, + "privileged": { + "type": "boolean" + }, + "procMount": { + "type": "string" + }, + "readOnlyRootFilesystem": { + "type": "boolean" + }, + "runAsGroup": { + "type": "integer" + }, + "runAsNonRoot": { + "type": "boolean" + }, + "runAsUser": { + "type": "integer" + }, + "seLinuxOptions": { + "properties": { + "level": { + "type": "string" + }, + "role": { + "type": "string" + }, + "type": { + "type": "string" + }, + "user": { + "type": "string" + } + }, + "type": "object" + }, + "seccompProfile": { + "properties": { + "localhostProfile": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "type": "object" + }, + "windowsOptions": { + "properties": { + "gmsaCredentialSpec": { + "type": "string" + }, + "gmsaCredentialSpecName": { + "type": "string" + }, + "hostProcess": { + "type": "boolean" + }, + "runAsUserName": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "post_upgrade_job": { + "properties": { + "affinity": { + "properties": { + "nodeAffinity": { + "properties": { + "preferredDuringSchedulingIgnoredDuringExecution": { + "oneOf": [ + { + "items": { + "properties": { + "preference": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchFields": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, + "weight": { + "type": "integer" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "requiredDuringSchedulingIgnoredDuringExecution": { + "properties": { + "nodeSelectorTerms": { + "oneOf": [ + { + "items": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchFields": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + } + }, + "type": "object" + }, + "podAffinity": { + "properties": { + "preferredDuringSchedulingIgnoredDuringExecution": { + "oneOf": [ + { + "items": { + "properties": { + "podAffinityTerm": { + "properties": { + "labelSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "matchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "mismatchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "namespaceSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "namespaces": { + "items": { + "type": "string" + }, + "type": "array" + }, + "topologyKey": { + "type": "string" + } + }, + "type": "object" + }, + "weight": { + "type": "integer" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "requiredDuringSchedulingIgnoredDuringExecution": { + "oneOf": [ + { + "items": { + "properties": { + "labelSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "matchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "mismatchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "namespaceSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "namespaces": { + "items": { + "type": "string" + }, + "type": "array" + }, + "topologyKey": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + }, + "podAntiAffinity": { + "properties": { + "preferredDuringSchedulingIgnoredDuringExecution": { + "oneOf": [ + { + "items": { + "properties": { + "podAffinityTerm": { + "properties": { + "labelSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "matchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "mismatchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "namespaceSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "namespaces": { + "items": { + "type": "string" + }, + "type": "array" + }, + "topologyKey": { + "type": "string" + } + }, + "type": "object" + }, + "weight": { + "type": "integer" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "requiredDuringSchedulingIgnoredDuringExecution": { + "oneOf": [ + { + "items": { + "properties": { + "labelSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "matchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "mismatchLabelKeys": { + "items": { + "type": "string" + }, + "type": "array" + }, + "namespaceSelector": { + "properties": { + "matchExpressions": { + "items": { + "properties": { + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "values": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "type": "array" + }, + "matchLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "namespaces": { + "items": { + "type": "string" + }, + "type": "array" + }, + "topologyKey": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + } + }, + "type": "object" + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "backoffLimit": { + "type": "integer" + }, + "enabled": { + "type": "boolean" + }, + "extraEnv": { + "oneOf": [ + { + "items": { + "properties": { + "name": { + "type": "string" + }, + "value": { + "type": "string" + }, + "valueFrom": { + "properties": { + "configMapKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "fieldRef": { + "properties": { + "apiVersion": { + "type": "string" + }, + "fieldPath": { + "type": "string" + } + }, + "type": "object" + }, + "resourceFieldRef": { + "properties": { + "containerName": { + "type": "string" + }, + "divisor": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + }, + "resource": { + "type": "string" + } + }, + "type": "object" + }, + "secretKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "extraEnvFrom": { + "oneOf": [ + { + "items": { + "properties": { + "configMapRef": { + "properties": { + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "prefix": { + "type": "string" + }, + "secretRef": { + "properties": { + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "podTemplate": { + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "spec": { + "properties": { + "containers": { + "oneOf": [ + { + "items": { + "properties": { + "env": { + "items": { + "properties": { + "name": { + "type": "string" + }, + "value": { + "type": "string" + }, + "valueFrom": { + "properties": { + "configMapKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "fieldRef": { + "properties": { + "apiVersion": { + "type": "string" + }, + "fieldPath": { + "type": "string" + } + }, + "type": "object" + }, + "resourceFieldRef": { + "properties": { + "containerName": { + "type": "string" + }, + "divisor": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + }, + "resource": { + "type": "string" + } + }, + "type": "object" + }, + "secretKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "name": { + "enum": [ + "redpanda", + "post-install", + "post-upgrade" + ], + "type": "string" + }, + "securityContext": { + "properties": { + "allowPrivilegeEscalation": { + "type": "boolean" + }, + "capabilities": { + "properties": { + "add": { + "items": { + "type": "string" + }, + "type": "array" + }, + "drop": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "privileged": { + "type": "boolean" + }, + "procMount": { + "type": "string" + }, + "readOnlyRootFilesystem": { + "type": "boolean" + }, + "runAsGroup": { + "type": "integer" + }, + "runAsNonRoot": { + "type": "boolean" + }, + "runAsUser": { + "type": "integer" + }, + "seLinuxOptions": { + "properties": { + "level": { + "type": "string" + }, + "role": { + "type": "string" + }, + "type": { + "type": "string" + }, + "user": { + "type": "string" + } + }, + "type": "object" + }, + "seccompProfile": { + "properties": { + "localhostProfile": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "type": "object" + }, + "windowsOptions": { + "properties": { + "gmsaCredentialSpec": { + "type": "string" + }, + "gmsaCredentialSpecName": { + "type": "string" + }, + "hostProcess": { + "type": "boolean" + }, + "runAsUserName": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "required": [ + "name", + "env" + ], + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "securityContext": { + "properties": { + "fsGroup": { + "type": "integer" + }, + "fsGroupChangePolicy": { + "enum": [ + "OnRootMismatch", + "Always" + ], + "type": "string" + }, + "runAsGroup": { + "type": "integer" + }, + "runAsNonRoot": { + "type": "boolean" + }, + "runAsUser": { + "type": "integer" + }, + "seLinuxOptions": { + "properties": { + "level": { + "type": "string" + }, + "role": { + "type": "string" + }, + "type": { + "type": "string" + }, + "user": { + "type": "string" + } + }, + "type": "object" + }, + "seccompProfile": { + "properties": { + "localhostProfile": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "type": "object" + }, + "supplementalGroups": { + "oneOf": [ + { + "items": { + "type": "integer" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "sysctls": { + "oneOf": [ + { + "items": { + "properties": { + "name": { + "type": "string" + }, + "value": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "windowsOptions": { + "properties": { + "gmsaCredentialSpec": { + "type": "string" + }, + "gmsaCredentialSpecName": { + "type": "string" + }, + "hostProcess": { + "type": "boolean" + }, + "runAsUserName": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "required": [ + "containers" + ], + "type": "object" + } + }, + "required": [ + "labels", + "annotations", + "spec" + ], + "type": "object" + }, + "resources": { + "properties": { + "claims": { + "oneOf": [ + { + "items": { + "properties": { + "name": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "limits": { + "additionalProperties": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + }, + "type": "object" + }, + "requests": { + "additionalProperties": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + }, + "type": "object" + } + }, + "type": "object" + }, + "securityContext": { + "properties": { + "allowPrivilegeEscalation": { + "type": "boolean" + }, + "capabilities": { + "properties": { + "add": { + "oneOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "drop": { + "oneOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + }, + "privileged": { + "type": "boolean" + }, + "procMount": { + "type": "string" + }, + "readOnlyRootFilesystem": { + "type": "boolean" + }, + "runAsGroup": { + "type": "integer" + }, + "runAsNonRoot": { + "type": "boolean" + }, + "runAsUser": { + "type": "integer" + }, + "seLinuxOptions": { + "properties": { + "level": { + "type": "string" + }, + "role": { + "type": "string" + }, + "type": { + "type": "string" + }, + "user": { + "type": "string" + } + }, + "type": "object" + }, + "seccompProfile": { + "properties": { + "localhostProfile": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "type": "object" + }, + "windowsOptions": { + "properties": { + "gmsaCredentialSpec": { + "type": "string" + }, + "gmsaCredentialSpecName": { + "type": "string" + }, + "hostProcess": { + "type": "boolean" + }, + "runAsUserName": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "rackAwareness": { + "properties": { + "enabled": { + "type": "boolean" + }, + "nodeAnnotation": { + "type": "string" + } + }, + "required": [ + "enabled", + "nodeAnnotation" + ], + "type": "object" + }, + "rbac": { + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "enabled": { + "type": "boolean" + } + }, + "required": [ + "enabled", + "annotations" + ], + "type": "object" + }, + "resources": { + "properties": { + "cpu": { + "properties": { + "cores": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + }, + "overprovisioned": { + "type": "boolean" + } + }, + "required": [ + "cores" + ], + "type": "object" + }, + "memory": { + "properties": { + "container": { + "properties": { + "max": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + }, + "min": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + } + }, + "required": [ + "max" + ], + "type": "object" + }, + "enable_memory_locking": { + "type": "boolean" + }, + "redpanda": { + "properties": { + "memory": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + }, + "reserveMemory": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + } + }, + "type": "object" + } + }, + "required": [ + "container" + ], + "type": "object" + } + }, + "required": [ + "cpu", + "memory" + ], + "type": "object" + }, + "service": { + "properties": { + "internal": { + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "type": "object" + }, + "name": { + "type": "string" + } + }, + "type": "object" + }, + "serviceAccount": { + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "automountServiceAccountToken": { + "type": "boolean" + }, + "create": { + "type": "boolean" + }, + "name": { + "type": "string" + } + }, + "required": [ + "annotations", + "create", + "name" + ], + "type": "object" + }, + "statefulset": { + "properties": { + "additionalRedpandaCmdFlags": { + "oneOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "additionalSelectorLabels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "budget": { + "properties": { + "maxUnavailable": { + "type": "integer" + } + }, + "required": [ + "maxUnavailable" + ], + "type": "object" + }, + "extraVolumeMounts": { + "type": "string" + }, + "extraVolumes": { + "type": "string" + }, + "initContainerImage": { + "properties": { + "repository": { + "type": "string" + }, + "tag": { + "type": "string" + } + }, + "type": "object" + }, + "initContainers": { + "properties": { + "configurator": { + "properties": { + "extraVolumeMounts": { + "type": "string" + }, + "resources": { + "type": "object" + } + }, + "type": "object" + }, + "extraInitContainers": { + "type": "string" + }, + "fsValidator": { + "properties": { + "enabled": { + "type": "boolean" + }, + "expectedFS": { + "type": "string" + }, + "extraVolumeMounts": { + "type": "string" + }, + "resources": { + "type": "object" + } + }, + "type": "object" + }, + "setDataDirOwnership": { + "properties": { + "enabled": { + "type": "boolean" + }, + "extraVolumeMounts": { + "type": "string" + }, + "resources": { + "type": "object" + } + }, + "type": "object" + }, + "setTieredStorageCacheDirOwnership": { + "properties": { + "extraVolumeMounts": { + "type": "string" + }, + "resources": { + "type": "object" + } + }, + "type": "object" + }, + "tuning": { + "properties": { + "extraVolumeMounts": { + "type": "string" + }, + "resources": { + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "livenessProbe": { + "properties": { + "failureThreshold": { + "type": "integer" + }, + "initialDelaySeconds": { + "type": "integer" + }, + "periodSeconds": { + "type": "integer" + } + }, + "required": [ + "initialDelaySeconds", + "failureThreshold", + "periodSeconds" + ], + "type": "object" + }, + "nodeAffinity": { + "type": "object" + }, + "nodeSelector": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "podAffinity": { + "type": "object" + }, + "podAntiAffinity": { + "properties": { + "custom": { + "type": "object" + }, + "topologyKey": { + "type": "string" + }, + "type": { + "pattern": "^(hard|soft|custom)$", + "type": "string" + }, + "weight": { + "type": "integer" + } + }, + "required": [ + "topologyKey", + "type", + "weight" + ], + "type": "object" + }, + "podSecurityContext": { + "deprecated": true, + "properties": { + "allowPriviledgeEscalation": { + "type": "boolean" + }, + "allowPrivilegeEscalation": { + "type": "boolean" + }, + "fsGroup": { + "type": "integer" + }, + "fsGroupChangePolicy": { + "enum": [ + "OnRootMismatch", + "Always" + ], + "type": "string" + }, + "runAsGroup": { + "type": "integer" + }, + "runAsNonRoot": { + "type": "boolean" + }, + "runAsUser": { + "type": "integer" + } + }, + "type": "object" + }, + "podTemplate": { + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "spec": { + "properties": { + "containers": { + "oneOf": [ + { + "items": { + "properties": { + "env": { + "items": { + "properties": { + "name": { + "type": "string" + }, + "value": { + "type": "string" + }, + "valueFrom": { + "properties": { + "configMapKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + }, + "fieldRef": { + "properties": { + "apiVersion": { + "type": "string" + }, + "fieldPath": { + "type": "string" + } + }, + "type": "object" + }, + "resourceFieldRef": { + "properties": { + "containerName": { + "type": "string" + }, + "divisor": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + }, + "resource": { + "type": "string" + } + }, + "type": "object" + }, + "secretKeyRef": { + "properties": { + "key": { + "type": "string" + }, + "name": { + "type": "string" + }, + "optional": { + "type": "boolean" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "name": { + "enum": [ + "redpanda", + "post-install", + "post-upgrade" + ], + "type": "string" + }, + "securityContext": { + "properties": { + "allowPrivilegeEscalation": { + "type": "boolean" + }, + "capabilities": { + "properties": { + "add": { + "items": { + "type": "string" + }, + "type": "array" + }, + "drop": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "privileged": { + "type": "boolean" + }, + "procMount": { + "type": "string" + }, + "readOnlyRootFilesystem": { + "type": "boolean" + }, + "runAsGroup": { + "type": "integer" + }, + "runAsNonRoot": { + "type": "boolean" + }, + "runAsUser": { + "type": "integer" + }, + "seLinuxOptions": { + "properties": { + "level": { + "type": "string" + }, + "role": { + "type": "string" + }, + "type": { + "type": "string" + }, + "user": { + "type": "string" + } + }, + "type": "object" + }, + "seccompProfile": { + "properties": { + "localhostProfile": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "type": "object" + }, + "windowsOptions": { + "properties": { + "gmsaCredentialSpec": { + "type": "string" + }, + "gmsaCredentialSpecName": { + "type": "string" + }, + "hostProcess": { + "type": "boolean" + }, + "runAsUserName": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "required": [ + "name", + "env" + ], + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "securityContext": { + "properties": { + "fsGroup": { + "type": "integer" + }, + "fsGroupChangePolicy": { + "enum": [ + "OnRootMismatch", + "Always" + ], + "type": "string" + }, + "runAsGroup": { + "type": "integer" + }, + "runAsNonRoot": { + "type": "boolean" + }, + "runAsUser": { + "type": "integer" + }, + "seLinuxOptions": { + "properties": { + "level": { + "type": "string" + }, + "role": { + "type": "string" + }, + "type": { + "type": "string" + }, + "user": { + "type": "string" + } + }, + "type": "object" + }, + "seccompProfile": { + "properties": { + "localhostProfile": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "type": "object" + }, + "supplementalGroups": { + "oneOf": [ + { + "items": { + "type": "integer" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "sysctls": { + "oneOf": [ + { + "items": { + "properties": { + "name": { + "type": "string" + }, + "value": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "windowsOptions": { + "properties": { + "gmsaCredentialSpec": { + "type": "string" + }, + "gmsaCredentialSpecName": { + "type": "string" + }, + "hostProcess": { + "type": "boolean" + }, + "runAsUserName": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "required": [ + "containers" + ], + "type": "object" + } + }, + "required": [ + "labels", + "annotations", + "spec" + ], + "type": "object" + }, + "priorityClassName": { + "type": "string" + }, + "readinessProbe": { + "properties": { + "failureThreshold": { + "type": "integer" + }, + "initialDelaySeconds": { + "type": "integer" + }, + "periodSeconds": { + "type": "integer" + }, + "successThreshold": { + "type": "integer" + }, + "timeoutSeconds": { + "type": "integer" + } + }, + "required": [ + "initialDelaySeconds", + "failureThreshold", + "periodSeconds" + ], + "type": "object" + }, + "replicas": { + "type": "integer" + }, + "securityContext": { + "deprecated": true, + "properties": { + "allowPriviledgeEscalation": { + "type": "boolean" + }, + "allowPrivilegeEscalation": { + "type": "boolean" + }, + "fsGroup": { + "type": "integer" + }, + "fsGroupChangePolicy": { + "enum": [ + "OnRootMismatch", + "Always" + ], + "type": "string" + }, + "runAsGroup": { + "type": "integer" + }, + "runAsNonRoot": { + "type": "boolean" + }, + "runAsUser": { + "type": "integer" + } + }, + "type": "object" + }, + "sideCars": { + "properties": { + "configWatcher": { + "properties": { + "enabled": { + "type": "boolean" + }, + "extraVolumeMounts": { + "type": "string" + }, + "resources": { + "type": "object" + }, + "securityContext": { + "properties": { + "allowPrivilegeEscalation": { + "type": "boolean" + }, + "capabilities": { + "properties": { + "add": { + "oneOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "drop": { + "oneOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + }, + "privileged": { + "type": "boolean" + }, + "procMount": { + "type": "string" + }, + "readOnlyRootFilesystem": { + "type": "boolean" + }, + "runAsGroup": { + "type": "integer" + }, + "runAsNonRoot": { + "type": "boolean" + }, + "runAsUser": { + "type": "integer" + }, + "seLinuxOptions": { + "properties": { + "level": { + "type": "string" + }, + "role": { + "type": "string" + }, + "type": { + "type": "string" + }, + "user": { + "type": "string" + } + }, + "type": "object" + }, + "seccompProfile": { + "properties": { + "localhostProfile": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "type": "object" + }, + "windowsOptions": { + "properties": { + "gmsaCredentialSpec": { + "type": "string" + }, + "gmsaCredentialSpecName": { + "type": "string" + }, + "hostProcess": { + "type": "boolean" + }, + "runAsUserName": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "controllers": { + "properties": { + "createRBAC": { + "type": "boolean" + }, + "enabled": { + "type": "boolean" + }, + "healthProbeAddress": { + "type": "string" + }, + "image": { + "properties": { + "repository": { + "default": "docker.redpanda.com/redpandadata/redpanda-operator", + "type": "string" + }, + "tag": { + "default": "Chart.appVersion", + "pattern": "^v(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$|^$", + "type": "string" + } + }, + "required": [ + "tag", + "repository" + ], + "type": "object" + }, + "metricsAddress": { + "type": "string" + }, + "resources": true, + "run": { + "oneOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "securityContext": { + "properties": { + "allowPrivilegeEscalation": { + "type": "boolean" + }, + "capabilities": { + "properties": { + "add": { + "oneOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "drop": { + "oneOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ] + } + }, + "type": "object" + }, + "privileged": { + "type": "boolean" + }, + "procMount": { + "type": "string" + }, + "readOnlyRootFilesystem": { + "type": "boolean" + }, + "runAsGroup": { + "type": "integer" + }, + "runAsNonRoot": { + "type": "boolean" + }, + "runAsUser": { + "type": "integer" + }, + "seLinuxOptions": { + "properties": { + "level": { + "type": "string" + }, + "role": { + "type": "string" + }, + "type": { + "type": "string" + }, + "user": { + "type": "string" + } + }, + "type": "object" + }, + "seccompProfile": { + "properties": { + "localhostProfile": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "type": "object" + }, + "windowsOptions": { + "properties": { + "gmsaCredentialSpec": { + "type": "string" + }, + "gmsaCredentialSpecName": { + "type": "string" + }, + "hostProcess": { + "type": "boolean" + }, + "runAsUserName": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "startupProbe": { + "properties": { + "failureThreshold": { + "type": "integer" + }, + "initialDelaySeconds": { + "type": "integer" + }, + "periodSeconds": { + "type": "integer" + } + }, + "required": [ + "initialDelaySeconds", + "failureThreshold", + "periodSeconds" + ], + "type": "object" + }, + "terminationGracePeriodSeconds": { + "type": "integer" + }, + "tolerations": { + "oneOf": [ + { + "items": { + "properties": { + "effect": { + "type": "string" + }, + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "tolerationSeconds": { + "type": "integer" + }, + "value": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "topologySpreadConstraints": { + "oneOf": [ + { + "items": { + "properties": { + "maxSkew": { + "type": "integer" + }, + "topologyKey": { + "type": "string" + }, + "whenUnsatisfiable": { + "pattern": "^(ScheduleAnyway|DoNotSchedule)$", + "type": "string" + } + }, + "type": "object" + }, + "minItems": 1, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "updateStrategy": { + "properties": { + "type": { + "pattern": "^(RollingUpdate|OnDelete)$", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object" + } + }, + "required": [ + "additionalSelectorLabels", + "replicas", + "updateStrategy", + "podTemplate", + "budget", + "startupProbe", + "livenessProbe", + "readinessProbe", + "podAffinity", + "podAntiAffinity", + "nodeSelector", + "priorityClassName", + "topologySpreadConstraints", + "tolerations", + "securityContext", + "sideCars" + ], + "type": "object" + }, + "storage": { + "properties": { + "hostPath": { + "type": "string" + }, + "persistentVolume": { + "deprecated": true, + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "enabled": { + "type": "boolean" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "nameOverwrite": { + "type": "string" + }, + "size": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + }, + "storageClass": { + "type": "string" + } + }, + "required": [ + "annotations", + "enabled", + "labels", + "size", + "storageClass" + ], + "type": "object" + }, + "tiered": { + "properties": { + "config": { + "properties": { + "cloud_storage_access_key": { + "type": "string" + }, + "cloud_storage_api_endpoint": { + "type": "string" + }, + "cloud_storage_api_endpoint_port": { + "type": "integer" + }, + "cloud_storage_azure_adls_endpoint": { + "type": "string" + }, + "cloud_storage_azure_adls_port": { + "type": "integer" + }, + "cloud_storage_bucket": { + "type": "string" + }, + "cloud_storage_cache_check_interval": { + "type": "integer" + }, + "cloud_storage_cache_directory": { + "type": "string" + }, + "cloud_storage_cache_size": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + }, + "cloud_storage_credentials_source": { + "pattern": "^(config_file|aws_instance_metadata|sts|gcp_instance_metadata)$", + "type": "string" + }, + "cloud_storage_disable_tls": { + "type": "boolean" + }, + "cloud_storage_enable_remote_read": { + "type": "boolean" + }, + "cloud_storage_enable_remote_write": { + "type": "boolean" + }, + "cloud_storage_enabled": { + "type": "boolean" + }, + "cloud_storage_initial_backoff_ms": { + "type": "integer" + }, + "cloud_storage_manifest_upload_timeout_ms": { + "type": "integer" + }, + "cloud_storage_max_connection_idle_time_ms": { + "type": "integer" + }, + "cloud_storage_max_connections": { + "type": "integer" + }, + "cloud_storage_reconciliation_interval_ms": { + "type": "integer" + }, + "cloud_storage_region": { + "type": "string" + }, + "cloud_storage_secret_key": { + "type": "string" + }, + "cloud_storage_segment_max_upload_interval_sec": { + "type": "integer" + }, + "cloud_storage_segment_upload_timeout_ms": { + "type": "integer" + }, + "cloud_storage_trust_file": { + "type": "string" + }, + "cloud_storage_upload_ctrl_d_coeff": { + "type": "integer" + }, + "cloud_storage_upload_ctrl_max_shares": { + "type": "integer" + }, + "cloud_storage_upload_ctrl_min_shares": { + "type": "integer" + }, + "cloud_storage_upload_ctrl_p_coeff": { + "type": "integer" + }, + "cloud_storage_upload_ctrl_update_interval_ms": { + "type": "integer" + } + }, + "required": [ + "cloud_storage_enabled" + ], + "type": "object" + }, + "credentialsSecretRef": { + "properties": { + "accessKey": { + "properties": { + "configurationKey": { + "type": "string" + }, + "key": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "type": "object" + }, + "secretKey": { + "properties": { + "configurationKey": { + "type": "string" + }, + "key": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "type": "object" + } + }, + "type": "object" + }, + "hostPath": { + "type": "string" + }, + "mountType": { + "pattern": "^(none|hostPath|emptyDir|persistentVolume)$", + "type": "string" + }, + "persistentVolume": { + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "enabled": { + "type": "boolean" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "nameOverwrite": { + "type": "string" + }, + "size": { + "type": "string" + }, + "storageClass": { + "type": "string" + } + }, + "required": [ + "annotations", + "labels", + "storageClass" + ], + "type": "object" + } + }, + "required": [ + "mountType" + ], + "type": "object" + }, + "tieredConfig": { + "deprecated": true, + "properties": { + "cloud_storage_access_key": { + "type": "string" + }, + "cloud_storage_api_endpoint": { + "type": "string" + }, + "cloud_storage_api_endpoint_port": { + "type": "integer" + }, + "cloud_storage_azure_adls_endpoint": { + "type": "string" + }, + "cloud_storage_azure_adls_port": { + "type": "integer" + }, + "cloud_storage_bucket": { + "type": "string" + }, + "cloud_storage_cache_check_interval": { + "type": "integer" + }, + "cloud_storage_cache_directory": { + "type": "string" + }, + "cloud_storage_cache_size": { + "oneOf": [ + { + "type": "integer" + }, + { + "pattern": "^[0-9]+(\\.[0-9]){0,1}(m|k|M|G|T|P|Ki|Mi|Gi|Ti|Pi)?$", + "type": "string" + } + ] + }, + "cloud_storage_credentials_source": { + "pattern": "^(config_file|aws_instance_metadata|sts|gcp_instance_metadata)$", + "type": "string" + }, + "cloud_storage_disable_tls": { + "type": "boolean" + }, + "cloud_storage_enable_remote_read": { + "type": "boolean" + }, + "cloud_storage_enable_remote_write": { + "type": "boolean" + }, + "cloud_storage_enabled": { + "type": "boolean" + }, + "cloud_storage_initial_backoff_ms": { + "type": "integer" + }, + "cloud_storage_manifest_upload_timeout_ms": { + "type": "integer" + }, + "cloud_storage_max_connection_idle_time_ms": { + "type": "integer" + }, + "cloud_storage_max_connections": { + "type": "integer" + }, + "cloud_storage_reconciliation_interval_ms": { + "type": "integer" + }, + "cloud_storage_region": { + "type": "string" + }, + "cloud_storage_secret_key": { + "type": "string" + }, + "cloud_storage_segment_max_upload_interval_sec": { + "type": "integer" + }, + "cloud_storage_segment_upload_timeout_ms": { + "type": "integer" + }, + "cloud_storage_trust_file": { + "type": "string" + }, + "cloud_storage_upload_ctrl_d_coeff": { + "type": "integer" + }, + "cloud_storage_upload_ctrl_max_shares": { + "type": "integer" + }, + "cloud_storage_upload_ctrl_min_shares": { + "type": "integer" + }, + "cloud_storage_upload_ctrl_p_coeff": { + "type": "integer" + }, + "cloud_storage_upload_ctrl_update_interval_ms": { + "type": "integer" + } + }, + "type": "object" + }, + "tieredStorageHostPath": { + "deprecated": true, + "type": "string" + }, + "tieredStoragePersistentVolume": { + "deprecated": true, + "properties": { + "annotations": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "enabled": { + "type": "boolean" + }, + "labels": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "storageClass": { + "type": "string" + } + }, + "required": [ + "annotations", + "enabled", + "labels", + "storageClass" + ], + "type": "object" + } + }, + "required": [ + "hostPath", + "tiered", + "persistentVolume" + ], + "type": "object" + }, + "tests": { + "properties": { + "enabled": { + "type": "boolean" + } + }, + "type": "object" + }, + "tls": { + "properties": { + "certs": { + "minProperties": 1, + "patternProperties": { + "^[A-Za-z_][A-Za-z0-9_]*$": { + "properties": { + "applyInternalDNSNames": { + "type": "boolean" + }, + "caEnabled": { + "type": "boolean" + }, + "clientSecretRef": { + "properties": { + "name": { + "type": "string" + } + }, + "type": "object" + }, + "duration": { + "pattern": ".*[smh]$", + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "issuerRef": { + "properties": { + "group": { + "type": "string" + }, + "kind": { + "type": "string" + }, + "name": { + "type": "string" + } + }, + "type": "object" + }, + "secretRef": { + "properties": { + "name": { + "type": "string" + } + }, + "type": "object" + } + }, + "required": [ + "caEnabled" + ], + "type": "object" + } + }, + "type": "object" + }, + "enabled": { + "type": "boolean" + } + }, + "required": [ + "enabled", + "certs" + ], + "type": "object" + }, + "tolerations": { + "oneOf": [ + { + "items": { + "properties": { + "effect": { + "type": "string" + }, + "key": { + "type": "string" + }, + "operator": { + "type": "string" + }, + "tolerationSeconds": { + "type": "integer" + }, + "value": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + { + "type": "null" + } + ] + }, + "tuning": { + "properties": { + "ballast_file_path": { + "type": "string" + }, + "ballast_file_size": { + "type": "string" + }, + "tune_aio_events": { + "type": "boolean" + }, + "tune_ballast_file": { + "type": "boolean" + }, + "tune_clocksource": { + "type": "boolean" + }, + "well_known_io": { + "type": "string" + } + }, + "type": "object" + } + }, + "required": [ + "affinity", + "image" + ], + "type": "object" +} diff --git a/charts/redpanda/redpanda/5.9.7/values.yaml b/charts/redpanda/redpanda/5.9.7/values.yaml new file mode 100644 index 000000000..3a9287d14 --- /dev/null +++ b/charts/redpanda/redpanda/5.9.7/values.yaml @@ -0,0 +1,1131 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# This file contains values for variables referenced from yaml files in the templates directory. +# +# For further information on Helm templating see the documentation at: +# https://helm.sh/docs/chart_template_guide/values_files/ + +# +# >>> This chart requires Helm version 3.6.0 or greater <<< +# + +# Common settings +# +# -- Override `redpanda.name` template. +nameOverride: "" +# -- Override `redpanda.fullname` template. +fullnameOverride: "" +# -- Default Kubernetes cluster domain. +clusterDomain: cluster.local +# -- Additional labels to add to all Kubernetes objects. +# For example, `my.k8s.service: redpanda`. +commonLabels: {} +# -- Node selection constraints for scheduling Pods, can override this for StatefulSets. +# For details, +# see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector). +nodeSelector: {} +# -- Affinity constraints for scheduling Pods, can override this for StatefulSets and Jobs. +# For details, +# see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity). +affinity: {} +# -- Taints to be tolerated by Pods, can override this for StatefulSets. +# For details, +# see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/). +tolerations: [] + +# -- Redpanda Docker image settings. +image: + # -- Docker repository from which to pull the Redpanda Docker image. + repository: docker.redpanda.com/redpandadata/redpanda + # -- The Redpanda version. + # See DockerHub for: + # [All stable versions](https://hub.docker.com/r/redpandadata/redpanda/tags) + # and [all unstable versions](https://hub.docker.com/r/redpandadata/redpanda-unstable/tags). + # @default -- `Chart.appVersion`. + tag: "" + # -- The imagePullPolicy. + # If `image.tag` is 'latest', the default is `Always`. + pullPolicy: IfNotPresent + +# -- Redpanda Service settings. +# service: +# -- set service.name to override the default service name +# name: redpanda +# -- internal Service +# internal: +# -- add annotations to the internal Service +# annotations: {} +# +# -- eg. for a bare metal install using external-dns +# annotations: +# "external-dns.alpha.kubernetes.io/hostname": redpanda.domain.dom +# "external-dns.alpha.kubernetes.io/endpoints-type": HostIP + +# -- Pull secrets may be used to provide credentials to image repositories +# See the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/). +imagePullSecrets: [] + +# -- DEPRECATED Enterprise license key (optional). +# For details, +# see the [License documentation](https://docs.redpanda.com/docs/get-started/licenses/?platform=kubernetes#redpanda-enterprise-edition). +license_key: "" +# -- DEPRECATED Secret name and secret key where the license key is stored. +license_secret_ref: {} + # secret_name: my-secret + # secret_key: key-where-license-is-stored + +# -- Audit logging for a redpanda cluster, must have enabled sasl and have one kafka listener supporting sasl authentication +# for audit logging to work. Note this feature is only available for redpanda versions >= v23.3.0. +auditLogging: + # -- Enable or disable audit logging, for production clusters we suggest you enable, + # however, this will only work if you also enable sasl and a listener with sasl enabled. + enabled: false + # -- Kafka listener name, note that it must have `authenticationMethod` set to `sasl`. + # For external listeners, use the external listener name, such as `default`. + listener: internal + # -- Integer value defining the number of partitions used by a newly created audit topic. + partitions: 12 + # -- Event types that should be captured by audit logs, default is [`admin`, `authenticate`, `management`]. + enabledEventTypes: + # -- List of topics to exclude from auditing, default is null. + excludedTopics: + # -- List of principals to exclude from auditing, default is null. + excludedPrincipals: + # -- Defines the number of bytes (in bytes) allocated by the internal audit client for audit messages. + clientMaxBufferSize: 16777216 + # -- In ms, frequency in which per shard audit logs are batched to client for write to audit log. + queueDrainIntervalMs: 500 + # -- Defines the maximum amount of memory used (in bytes) by the audit buffer in each shard. + queueMaxBufferSizePerShard: 1048576 + # -- Defines the replication factor for a newly created audit log topic. This configuration applies + # only to the audit log topic and may be different from the cluster or other topic configurations. + # This cannot be altered for existing audit log topics. Setting this value is optional. If a value is not provided, + # Redpanda will use the `internal_topic_replication_factor cluster` config value. Default is `null` + replicationFactor: + +# -- Enterprise (optional) +# For details, +# see the [License documentation](https://docs.redpanda.com/docs/get-started/licenses/?platform=kubernetes#redpanda-enterprise-edition). +enterprise: + # -- license (optional). + license: "" + # -- Secret name and key where the license key is stored. + licenseSecretRef: {} + # name: my-secret + # key: key-where-license-is-stored + +# -- Rack Awareness settings. +# For details, +# see the [Rack Awareness documentation](https://docs.redpanda.com/docs/manage/kubernetes/kubernetes-rack-awareness/). +rackAwareness: + # -- When running in multiple racks or availability zones, use a Kubernetes Node + # annotation value as the Redpanda rack value. + # Enabling this requires running with a service account with "get" Node permissions. + # To have the Helm chart configure these permissions, + # set `serviceAccount.create=true` and `rbac.enabled=true`. + enabled: false + # -- The common well-known annotation to use as the rack ID. + # Override this only if you use a custom Node annotation. + nodeAnnotation: topology.kubernetes.io/zone + +# +# -- Redpanda Console settings. +# For a reference of configuration settings, +# see the [Redpanda Console documentation](https://docs.redpanda.com/docs/reference/console/config/). +console: + enabled: true + configmap: + create: false + secret: + create: false + deployment: + create: false + config: {} + +# +# -- Redpanda Managed Connectors settings +# For a reference of configuration settings, +# see the [Redpanda Connectors documentation](https://docs.redpanda.com/docs/deploy/deployment-option/cloud/managed-connectors/). +connectors: + enabled: false + deployment: + create: false + test: + create: false + +# -- Authentication settings. +# For details, +# see the [SASL documentation](https://docs.redpanda.com/docs/manage/kubernetes/security/sasl-kubernetes/). +auth: + sasl: + # -- Enable SASL authentication. + # If you enable SASL authentication, you must provide a Secret in `auth.sasl.secretRef`. + enabled: false + # -- The authentication mechanism to use for the superuser. Options are `SCRAM-SHA-256` and `SCRAM-SHA-512`. + mechanism: SCRAM-SHA-512 + # -- A Secret that contains your superuser credentials. + # For details, + # see the [SASL documentation](https://docs.redpanda.com/docs/manage/kubernetes/security/sasl-kubernetes/#use-secrets). + secretRef: "redpanda-users" + # -- Optional list of superusers. + # These superusers will be created in the Secret whose name is defined in `auth.sasl.secretRef`. + # If this list is empty, + # the Secret in `auth.sasl.secretRef` must already exist in the cluster before you deploy the chart. + # Uncomment the sample list if you wish to try adding sample sasl users or override to use your own. + users: [] + # - name: admin + # password: change-me + # mechanism: SCRAM-SHA-512 + # -- Details about how to create the bootstrap user for the cluster. + # The secretKeyRef is optionally specified. If it is specified, the + # chart will use a password written to that secret when creating the + # "kubernetes-controller" bootstrap user. If it is unspecified, then + # the secret will be generated and stored in the secret + # "releasename"-bootstrap-user, with the key "password". + bootstrapUser: + # -- The name used to override the name of the bootstrap user. If unspecified the bootstrap user is named + # "kubernetes-controller". This should only be specified when SASL authentication is enabled (usually installation) + # and should not be changed afterward. + # name: my-user + # -- The authentication mechanism to use for the bootstrap user. Options are `SCRAM-SHA-256` and `SCRAM-SHA-512`. + mechanism: SCRAM-SHA-256 + # secretKeyRef: + # name: my-password + # key: my-key + +# -- TLS settings. +# For details, see the [TLS documentation](https://docs.redpanda.com/docs/manage/kubernetes/security/kubernetes-tls/). +tls: + # -- Enable TLS globally for all listeners. + # Each listener must include a Certificate name in its `.tls` object. + # To allow you to enable TLS for individual listeners, + # Certificates in `auth.tls.certs` are always loaded, even if `tls.enabled` is `false`. + # See `listeners..tls.enabled`. + enabled: true + # -- List all Certificates here, + # then you can reference a specific Certificate's name + # in each listener's `listeners..tls.cert` setting. + certs: + # -- This key is the Certificate name. + # To apply the Certificate to a specific listener, + # reference the Certificate's name in `listeners..tls.cert`. + default: + # -- To use a custom pre-installed Issuer, + # add its name and kind to the `issuerRef` object. + # issuerRef: + # name: redpanda-default-root-issuer + # kind: Issuer # Can be Issuer or ClusterIssuer + # -- To use a secret with custom tls files, + # secretRef: + # name: my-tls-secret + # -- Indicates whether or not the Secret holding this certificate + # includes a `ca.crt` key. When `true`, chart managed clients, such as + # rpk, will use `ca.crt` for certificate verification and listeners with + # `require_client_auth` and no explicit `truststore` will use `ca.crt` as + # their `truststore_file` for verification of client certificates. When + # `false`, chart managed clients will use `tls.crt` for certificate + # verification and listeners with `require_client_auth` and no explicit + # `truststore` will use the container's CA certificates. + caEnabled: true + # duration: 43800h + # if you wish to have Kubernetes internal dns names (IE the headless service of the redpanda StatefulSet) included in `dnsNames` of the certificate even, when supplying an issuer. + # applyInternalDNSNames: false + # -- Example external tls configuration + # uncomment and set the right key to the listeners that require them + # also enable the tls setting for those listeners. + external: + # -- To use a custom pre-installed Issuer, + # add its name and kind to the `issuerRef` object. + # issuerRef: + # name: redpanda-default-root-issuer + # kind: Issuer # Can be Issuer or ClusterIssuer + # -- To use a secret with custom tls files, + # secretRef: + # name: my-tls-secret + # -- Indicates whether or not the Secret holding this certificate + # includes a `ca.crt` key. When `true`, chart managed clients, such as + # rpk, will use `ca.crt` for certificate verification and listeners with + # `require_client_auth` and no explicit `truststore` will use `ca.crt` as + # their `truststore_file` for verification of client certificates. When + # `false`, chart managed clients will use `tls.crt` for certificate + # verification and listeners with `require_client_auth` and no explicit + # `truststore` will use the container's CA certificates. + caEnabled: true + # duration: 43800h + # if you wish to for apply internal dns names to the certificate even when supplying an issuer + # applyInternalDNSNames: false + +# -- External access settings. +# For details, +# see the [Networking and Connectivity documentation](https://docs.redpanda.com/docs/manage/kubernetes/networking/networking-and-connectivity/). +external: + # -- Service allows you to manage the creation of an external kubernetes service object + service: + # -- Enabled if set to false will not create the external service type + # You can still set your cluster with external access but not create the supporting service (NodePort/LoadBalander). + # Set this to false if you rather manage your own service. + enabled: true + # -- Enable external access for each Service. + # You can toggle external access for each listener in + # `listeners..external..enabled`. + enabled: true + # -- External access type. Only `NodePort` and `LoadBalancer` are supported. + # If undefined, then advertised listeners will be configured in Redpanda, + # but the helm chart will not create a Service. + # You must create a Service manually. + # Warning: If you use LoadBalancers, you will likely experience higher latency and increased packet loss. + # NodePort is recommended in cases where latency is a priority. + type: NodePort + # Optional source range for external access. Only applicable when external.type is LoadBalancer + # sourceRanges: [] + # -- Optional domain advertised to external clients + # If specified, then it will be appended to the `external.addresses` values as each broker's advertised address + # domain: local + # Optional list of addresses that the Redpanda brokers advertise. + # Provide one entry for each broker in order of StatefulSet replicas. + # The number of brokers is defined in statefulset.replicas. + # The values can be IP addresses or DNS names. + # If external.domain is set, the domain is appended to these values. + # There is an option to define a single external address for all brokers and leverage + # prefixTemplate as it will be calculated during initContainer execution. + # addresses: + # - redpanda-0 + # - redpanda-1 + # - redpanda-2 + # + # annotations: + # For example: + # cloud.google.com/load-balancer-type: "Internal" + # service.beta.kubernetes.io/aws-load-balancer-type: nlb + # If you enable externalDns, each LoadBalancer service instance + # will be annotated with external-dns hostname + # matching external.addresses + external.domain + # externalDns: + # enabled: true + # prefixTemplate: "" + +# -- Log-level settings. +logging: + # -- Log level + # Valid values (from least to most verbose) are: `warn`, `info`, `debug`, and `trace`. + logLevel: info + # -- Send usage statistics back to Redpanda Data. + # For details, + # see the [stats reporting documentation](https://docs.redpanda.com/docs/cluster-administration/monitoring/#stats-reporting). + usageStats: + # Enable the `rpk.enable_usage_stats` property. + enabled: true + # Your cluster ID (optional) + # clusterId: your-helm-cluster + +# -- Monitoring. +# This will create a ServiceMonitor that can be used by Prometheus-Operator or VictoriaMetrics-Operator to scrape the metrics. +monitoring: + enabled: false + scrapeInterval: 30s + labels: {} + # Enables http2 for scraping metrics for prometheus. Used when Istio's mTLS is enabled and using tlsConfig. + # enableHttp2: true + # tlsConfig: + # caFile: /etc/prom-certs/root-cert.pem + # certFile: /etc/prom-certs/cert-chain.pem + # insecureSkipVerify: true + # keyFile: /etc/prom-certs/key.pem + +# -- Pod resource management. +# This section simplifies resource allocation +# by providing a single location where resources are defined. +# Helm sets these resource values within the `statefulset.yaml` and `configmap.yaml` templates. +# +# The default values are for a development environment. +# Production-level values and other considerations are documented, +# where those values are different from the default. +# For details, +# see the [Pod resources documentation](https://docs.redpanda.com/docs/manage/kubernetes/manage-resources/). +resources: + # + # -- CPU resources. + # For details, + # see the [Pod resources documentation](https://docs.redpanda.com/docs/manage/kubernetes/manage-resources/#configure-cpu-resources). + cpu: + # -- Redpanda makes use of a thread per core model. + # For details, see this [blog](https://redpanda.com/blog/tpc-buffers). + # For this reason, Redpanda should only be given full cores. + # + # Note: You can increase cores, but decreasing cores is not currently supported. + # See the [GitHub issue](https://github.com/redpanda-data/redpanda/issues/350). + # + # This setting is equivalent to `--smp`, `resources.requests.cpu`, and `resources.limits.cpu`. + # For production, use `4` or greater. + # + # To maximize efficiency, use the `static` CPU manager policy by specifying an even integer for + # CPU resource requests and limits. This policy gives the Pods running Redpanda brokers + # access to exclusive CPUs on the node. See + # https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/#static-policy. + cores: 1 + # + # -- Overprovisioned means Redpanda won't assume it has all of the provisioned CPU. + # This should be true unless the container has CPU affinity. + # Equivalent to: `--idle-poll-time-us 0 --thread-affinity 0 --poll-aio 0` + # + # If the value of full cores in `resources.cpu.cores` is less than `1`, this + # setting is set to `true`. + # overprovisioned: false + # + # -- Memory resources + # For details, + # see the [Pod resources documentation](https://docs.redpanda.com/docs/manage/kubernetes/manage-resources/#configure-memory-resources). + memory: + # -- Enables memory locking. + # For production, set to `true`. + # enable_memory_locking: false + # + # It is recommended to have at least 2Gi of memory per core for the Redpanda binary. + # This memory is taken from the total memory given to each container. + # The Helm chart allocates 80% of the container's memory to Redpanda, leaving the rest for + # the Seastar subsystem (reserveMemory) and other container processes. + # So at least 2.5Gi per core is recommended in order to ensure Redpanda has a full 2Gi. + # + # These values affect `--memory` and `--reserve-memory` flags passed to Redpanda and the memory + # requests/limits in the StatefulSet. + # Valid suffixes: k, M, G, T, P, Ki, Mi, Gi, Ti, Pi + # To create `Guaranteed` Pod QoS for Redpanda brokers, provide both container max and min values for the container. + # For details, see + # https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed + # * Every container in the Pod must have a memory limit and a memory request. + # * For every container in the Pod, the memory limit must equal the memory request. + # + container: + # Minimum memory count for each Redpanda broker. + # If omitted, the `min` value is equal to the `max` value (requested resources defaults to limits). + # This setting is equivalent to `resources.requests.memory`. + # For production, use 10Gi or greater. + # min: 2.5Gi + # + # -- Maximum memory count for each Redpanda broker. + # Equivalent to `resources.limits.memory`. + # For production, use `10Gi` or greater. + max: 2.5Gi + # + # This optional `redpanda` object allows you to specify the memory size for both the Redpanda + # process and the underlying reserved memory used by Seastar. + # This section is omitted by default, and memory sizes are calculated automatically + # based on container memory. + # Uncommenting this section and setting memory and reserveMemory values will disable + # automatic calculation. + # + # If you are setting the following values manually, keep in mind the following guidelines. + # Getting this wrong may lead to performance issues, instability, and loss of data: + # The amount of memory to allocate to a container is determined by the sum of three values: + # 1. Redpanda (at least 2Gi per core, ~80% of the container's total memory) + # 2. Seastar subsystem (200Mi * 0.2% of the container's total memory, 200Mi < x < 1Gi) + # 3. Other container processes (whatever small amount remains) + # redpanda: + # Memory for the Redpanda process. + # This must be lower than the container's memory (resources.memory.container.min if provided, otherwise + # resources.memory.container.max). + # Equivalent to --memory. + # For production, use 8Gi or greater. + # memory: 2Gi + # + # Memory reserved for the Seastar subsystem. + # Any value above 1Gi will provide diminishing performance benefits. + # Equivalent to --reserve-memory. + # For production, use 1Gi. + # reserveMemory: 200Mi + +# -- Persistence settings. +# For details, see the [storage documentation](https://docs.redpanda.com/docs/manage/kubernetes/configure-storage/). +storage: + # -- Absolute path on the host to store Redpanda's data. + # If unspecified, then an `emptyDir` volume is used. + # If specified but `persistentVolume.enabled` is true, `storage.hostPath` has no effect. + hostPath: "" + # -- If `persistentVolume.enabled` is true, a PersistentVolumeClaim is created and + # used to store Redpanda's data. Otherwise, `storage.hostPath` is used. + persistentVolume: + enabled: true + size: 20Gi + # -- To disable dynamic provisioning, set to `-`. + # If undefined or empty (default), then no storageClassName spec is set, + # and the default dynamic provisioner is chosen (gp2 on AWS, standard on + # GKE, AWS & OpenStack). + storageClass: "" + # -- Additional labels to apply to the created PersistentVolumeClaims. + labels: {} + # -- Additional annotations to apply to the created PersistentVolumeClaims. + annotations: {} + # -- Option to change volume claim template name for tiered storage persistent volume + # if tiered.mountType is set to `persistentVolume` + nameOverwrite: "" + # + # Settings for the Tiered Storage cache. + # For details, + # see the [Tiered Storage documentation](https://docs.redpanda.com/docs/manage/kubernetes/tiered-storage/#caching). + + tiered: + # mountType can be one of: + # - none: does not mount a volume. Tiered storage will use the data directory. + # - hostPath: will allow you to chose a path on the Node the pod is running on + # - emptyDir: will mount a fresh empty directory every time the pod starts + # - persistentVolume: creates and mounts a PersistentVolumeClaim + mountType: emptyDir + + # For the maximum size of the disk cache, see `tieredConfig.cloud_storage_cache_size`. + # + # -- Absolute path on the host to store Redpanda's Tiered Storage cache. + hostPath: "" + # PersistentVolumeClaim to be created for the Tiered Storage cache and + # used to store data retrieved from cloud storage, such as S3). + persistentVolume: + # -- To disable dynamic provisioning, set to "-". + # If undefined or empty (default), then no storageClassName spec is set, + # and the default dynamic provisioner is chosen (gp2 on AWS, standard on + # GKE, AWS & OpenStack). + storageClass: "" + # -- Additional labels to apply to the created PersistentVolumeClaims. + labels: {} + # -- Additional annotations to apply to the created PersistentVolumeClaims. + annotations: {} + + # credentialsSecretRef can be used to set `cloud_storage_secret_key` and/or `cloud_storage_access_key` from + # referenced Kubernetes Secret + credentialsSecretRef: + accessKey: + # https://docs.redpanda.com/current/reference/object-storage-properties/#cloud_storage_access_key + configurationKey: cloud_storage_access_key + # name: + # key: + secretKey: + # https://docs.redpanda.com/current/reference/object-storage-properties/#cloud_storage_secret_key + # or + # https://docs.redpanda.com/current/reference/object-storage-properties/#cloud_storage_azure_shared_key + configurationKey: cloud_storage_secret_key + # name: + # key + # -- DEPRECATED `configurationKey`, `name` and `key`. Please use `accessKey` and `secretKey` + # configurationKey: cloud_storage_secret_key + # name: + # key: + # + # -- Tiered Storage settings + # Requires `enterprise.licenseKey` or `enterprised.licenseSecretRef` + # For details, see the [Tiered Storage documentation](https://docs.redpanda.com/docs/manage/kubernetes/tiered-storage/). + # For a list of properties, see [Object Storage Properties](https://docs.redpanda.com/current/reference/properties/object-storage-properties/). + config: + # -- Global flag that enables Tiered Storage if a license key is provided. + # See the [property reference documentation](https://docs.redpanda.com/docs/reference/object-storage-properties/#cloud_storage_enabled). + cloud_storage_enabled: false + # -- Cluster level default remote write configuration for new topics. + # See the [property reference documentation](https://docs.redpanda.com/docs/reference/object-storage-properties/#cloud_storage_enable_remote_write). + cloud_storage_enable_remote_write: true + # -- Cluster level default remote read configuration for new topics. + # See the [property reference documentation](https://docs.redpanda.com/docs/reference/object-storage-properties/#cloud_storage_enable_remote_read). + cloud_storage_enable_remote_read: true + # -- Maximum size of the disk cache used by Tiered Storage. + # Default is 20 GiB. + # See the [property reference documentation](https://docs.redpanda.com/docs/reference/object-storage-properties/#cloud_storage_cache_size). + cloud_storage_cache_size: 5368709120 + +post_install_job: + enabled: true + # Resource requests and limits for the post-install batch job + # resources: + # requests: + # cpu: 1 + # memory: 512Mi + # limits: + # cpu: 2 + # memory: 1024Mi + # labels: {} + # annotations: {} + affinity: {} + + podTemplate: + # -- Additional labels to apply to the Pods of this Job. + labels: {} + # -- Additional annotations to apply to the Pods of this Job. + annotations: {} + # -- A subset of Kubernetes' PodSpec type that will be merged into the + # final PodSpec. See [Merge Semantics](#merging-semantics) for details. + spec: + securityContext: {} + containers: + - name: post-install + securityContext: {} + env: [] + +statefulset: + # -- Number of Redpanda brokers (Redpanda Data recommends setting this to the number of worker nodes in the cluster) + replicas: 3 + updateStrategy: + type: RollingUpdate + budget: + maxUnavailable: 1 + # -- DEPRECATED Please use statefulset.podTemplate.annotations. + # Annotations are used only for `Statefulset.spec.template.metadata.annotations`. The StatefulSet does not have + # any dedicated annotation. + annotations: {} + # -- Additional labels to be added to statefulset label selector. + # For example, `my.k8s.service: redpanda`. + additionalSelectorLabels: {} + podTemplate: + # -- Additional labels to apply to the Pods of the StatefulSet. + labels: {} + # -- Additional annotations to apply to the Pods of the StatefulSet. + annotations: {} + # -- A subset of Kubernetes' PodSpec type that will be merged into the + # final PodSpec. See [Merge Semantics](#merging-semantics) for details. + spec: + securityContext: {} + containers: + - name: redpanda + securityContext: {} + env: [] + # -- Adjust the period for your probes to meet your needs. + # For details, + # see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes). + startupProbe: + initialDelaySeconds: 1 + failureThreshold: 120 + periodSeconds: 10 + livenessProbe: + initialDelaySeconds: 10 + failureThreshold: 3 + periodSeconds: 10 + readinessProbe: + initialDelaySeconds: 1 + failureThreshold: 3 + periodSeconds: 10 + successThreshold: 1 + # + # StatefulSet resources: + # Resources are set through the top-level resources section above. + # It is recommended to set resource values in that section rather than here, as this will guarantee + # memory is allocated across containers, Redpanda, and the Seastar subsystem correctly. + # This automatic memory allocation is in place because Repanda and the Seastar subsystem require flags + # at startup that set the amount of memory available to each process. + # Kubernetes (mainly statefulset), Redpanda, and Seastar memory values are tightly coupled. + # Adding a resource section here will be ignored. + # + # -- Inter-Pod Affinity rules for scheduling Pods of this StatefulSet. + # For details, + # see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity). + podAffinity: {} + # -- Anti-affinity rules for scheduling Pods of this StatefulSet. + # For details, + # see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#inter-pod-affinity-and-anti-affinity). + # You may either edit the default settings for anti-affinity rules, + # or specify new anti-affinity rules to use instead of the defaults. + podAntiAffinity: + # -- The topologyKey to be used. + # Can be used to spread across different nodes, AZs, regions etc. + topologyKey: kubernetes.io/hostname + # -- Valid anti-affinity types are `soft`, `hard`, or `custom`. + # Use `custom` if you want to supply your own anti-affinity rules in the `podAntiAffinity.custom` object. + type: hard + # -- Weight for `soft` anti-affinity rules. + # Does not apply to other anti-affinity types. + weight: 100 + # -- Change `podAntiAffinity.type` to `custom` and provide your own podAntiAffinity rules here. + custom: {} + # -- Node selection constraints for scheduling Pods of this StatefulSet. + # These constraints override the global `nodeSelector` value. + # For details, + # see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector). + nodeSelector: {} + # -- PriorityClassName given to Pods of this StatefulSet. + # For details, + # see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/#priorityclass). + priorityClassName: "" + # -- Taints to be tolerated by Pods of this StatefulSet. + # These tolerations override the global tolerations value. + # For details, + # see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/). + tolerations: [] + # For details, + # see the [Kubernetes documentation](https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/). + topologySpreadConstraints: + - maxSkew: 1 + topologyKey: topology.kubernetes.io/zone + whenUnsatisfiable: ScheduleAnyway + # -- DEPRECATED: Prefer to use podTemplate.spec.securityContext or podTemplate.spec.containers[0].securityContext. + securityContext: + fsGroup: 101 + runAsUser: 101 + fsGroupChangePolicy: OnRootMismatch + sideCars: + configWatcher: + enabled: true + # -- To create `Guaranteed` Pods for Redpanda brokers, provide both requests and limits for CPU and memory. For details, see + # https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed + # * Every container in the Pod must have a memory limit and a memory request. + # * For every container in the Pod, the memory limit must equal the memory request. + # * Every container in the Pod must have a CPU limit and a CPU request. + # * For every container in the Pod, the CPU limit must equal the CPU request. + # + # To maximize efficiency, use the `static` CPU manager policy by specifying an even integer for + # CPU resource requests and limits. This policy gives the Pods running Redpanda brokers + # access to exclusive CPUs on the node. For details, see + # https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/#static-policy + resources: {} + securityContext: {} + extraVolumeMounts: |- + # Configure extra controllers to run as sidecars inside the Pods running Redpanda brokers. + # Available controllers: + # - Decommission Controller: The Decommission Controller ensures smooth scaling down operations. + # This controller is responsible for monitoring changes in the number of StatefulSet replicas and orchestrating + # the decommissioning of brokers when necessary. It also sets the reclaim policy for the decommissioned + # broker's PersistentVolume to `Retain` and deletes the corresponding PersistentVolumeClaim. + # - Node-PVC Controller: The Node-PVC Controller handles the PVCs of deleted brokers. + # By setting the PV Retain policy to retain, it facilitates the rescheduling of brokers to new, healthy nodes when + # an existing node is removed. + controllers: + image: + tag: v2.2.4-24.2.5 + repository: docker.redpanda.com/redpandadata/redpanda-operator + # You must also enable RBAC, `rbac.enabled=true`, to deploy this sidecar + enabled: false + # -- To create `Guaranteed` Pods for Redpanda brokers, provide both requests and limits for CPU and memory. For details, see + # https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed + # + # * Every container in the Pod must have a CPU limit and a CPU request. + # * For every container in the Pod, the CPU limit must equal the CPU request. + # * Every container in the Pod must have a CPU limit and a CPU request. + # * For every container in the Pod, the CPU limit must equal the CPU request. + # + # To maximize efficiency, use the `static` CPU manager policy by specifying an even integer for + # CPU resource requests and limits. This policy gives the Pods running Redpanda brokers + # access to exclusive CPUs on the node. For details, see + # https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/#static-policy + resources: {} + securityContext: {} + healthProbeAddress: ":8085" + metricsAddress: ":9082" + run: + - all + createRBAC: true + initContainers: + fsValidator: + enabled: false + expectedFS: xfs + # -- To create `Guaranteed` Pods for Redpanda brokers, provide both requests and limits for CPU and memory. For details, see + # https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed + # * Every container in the Pod must have a CPU limit and a CPU request. + # * For every container in the Pod, the CPU limit must equal the CPU request. + resources: {} + extraVolumeMounts: |- + tuning: + # -- To create `Guaranteed` Pods for Redpanda brokers, provide both requests and limits for CPU and memory. For details, see + # https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed + # * Every container in the Pod must have a CPU limit and a CPU request. + # * For every container in the Pod, the CPU limit must equal the CPU request. + resources: {} + extraVolumeMounts: |- + setDataDirOwnership: + # -- In environments where root is not allowed, you cannot change the ownership of files and directories. + # Enable `setDataDirOwnership` when using default minikube cluster configuration. + enabled: false + # -- To create `Guaranteed` Pods for Redpanda brokers, provide both requests and limits for CPU and memory. For details, see + # https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed + # * Every container in the Pod must have a CPU limit and a CPU request. + # * For every container in the Pod, the CPU limit must equal the CPU request. + resources: {} + extraVolumeMounts: |- + setTieredStorageCacheDirOwnership: + # -- To create `Guaranteed` Pods for Redpanda brokers, provide both requests and limits for CPU and memory. For details, see + # https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed + # * Every container in the Pod must have a CPU limit and a CPU request. + # * For every container in the Pod, the CPU limit must equal the CPU request. + resources: {} + extraVolumeMounts: |- + configurator: + # -- To create `Guaranteed` Pods for Redpanda brokers, provide both requests and limits for CPU and memory. For details, see + # https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed + # * Every container in the Pod must have a CPU limit and a CPU request. + # * For every container in the Pod, the CPU limit must equal the CPU request. + resources: {} + extraVolumeMounts: |- + ## Additional init containers + extraInitContainers: |- +# - name: "test-init-container" +# image: "mintel/docker-alpine-bash-curl-jq:latest" +# command: [ "/bin/bash", "-c" ] +# args: +# - | +# set -xe +# echo "Hello World!" + initContainerImage: + repository: busybox + tag: latest + # -- Additional flags to pass to redpanda, + additionalRedpandaCmdFlags: [] +# - --unsafe-bypass-fsync + # -- Termination grace period in seconds is time required to execute preStop hook + # which puts particular Redpanda Pod (process/container) into maintenance mode. + # Before settle down on particular value please put Redpanda under load and perform + # rolling upgrade or rolling restart. That value needs to accommodate two processes: + # * preStop hook needs to put Redpanda into maintenance mode + # * after preStop hook Redpanda needs to handle gracefully SIGTERM signal + # + # Both processes are executed sequentially where preStop hook has hard deadline in the + # middle of terminationGracePeriodSeconds. + # + # REF: + # https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#hook-handler-execution + # https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination + terminationGracePeriodSeconds: 90 + ## Additional Volumes that you mount + extraVolumes: |- + ## Additional Volume mounts for redpanda container + extraVolumeMounts: |- + +# -- Service account management. +serviceAccount: + # -- Specifies whether a service account should be created. + create: false + # -- Annotations to add to the service account. + annotations: {} + # -- The name of the service account to use. + # If not set and `serviceAccount.create` is `true`, + # a name is generated using the `redpanda.fullname` template. + name: "" + +# -- Role Based Access Control. +rbac: + # -- Enable for features that need extra privileges. + # If you use the Redpanda Operator, + # you must deploy it with the `--set rbac.createRPKBundleCRs=true` flag + # to give it the required ClusterRoles. + enabled: false + # -- Annotations to add to the `rbac` resources. + annotations: {} + +# -- Redpanda tuning settings. +# Each is set to their default values in Redpanda. +tuning: + # -- Increase the maximum number of outstanding asynchronous IO operations if the + # current value is below a certain threshold. This allows Redpanda to make as many + # simultaneous IO requests as possible, increasing throughput. + # + # When this option is enabled, Helm creates a privileged container. If your security profile does not allow this, you can disable this container by setting `tune_aio_events` to `false`. + # For more details, see the [tuning documentation](https://docs.redpanda.com/docs/deploy/deployment-option/self-hosted/kubernetes/kubernetes-tune-workers/). + tune_aio_events: true + # + # Syncs NTP + # tune_clocksource: false + # + # Creates a "ballast" file so that, if a Redpanda node runs out of space, + # you can delete the ballast file to allow the node to resume operations and then + # delete a topic or records to reduce the space used by Redpanda. + # tune_ballast_file: false + # + # The path where the ballast file will be created. + # ballast_file_path: "/var/lib/redpanda/data/ballast" + # + # The ballast file size. + # ballast_file_size: "1GiB" + # + # (Optional) The vendor, VM type and storage device type that redpanda will run on, in + # the format ::. This hints to rpk which configuration values it + # should use for the redpanda IO scheduler. + # Some valid values are "gcp:c2-standard-16:nvme", "aws:i3.xlarge:default" + # well_known_io: "" + # + # The following tuning parameters must be false in container environments and will be ignored: + # tune_network + # tune_disk_scheduler + # tune_disk_nomerges + # tune_disk_irq + # tune_fstrim + # tune_cpu + # tune_swappiness + # tune_transparent_hugepages + # tune_coredump + + +# -- Listener settings. +# +# Override global settings configured above for individual +# listeners. +# For details, +# see the [listeners documentation](https://docs.redpanda.com/docs/manage/kubernetes/networking/configure-listeners/). +listeners: + # -- Admin API listener (only one). + admin: + # -- The port for both internal and external connections to the Admin API. + port: 9644 + # -- Optional instrumentation hint - https://kubernetes.io/docs/concepts/services-networking/service/#application-protocol + # appProtocol: + # -- Optional external access settings. + external: + # -- Name of the external listener. + default: + port: 9645 + # Override the global `external.enabled` for only this listener. + # enabled: true + # -- The port advertised to this listener's external clients. + # List one port if you want to use the same port for each broker (would be the case when using NodePort service). + # Otherwise, list the port you want to use for each broker in order of StatefulSet replicas. + # If undefined, `listeners.admin.port` is used. + tls: + # enabled: true + cert: external + advertisedPorts: + - 31644 + # -- Optional TLS section (required if global TLS is enabled) + tls: + # Optional flag to override the global TLS enabled flag. + # enabled: true + # -- Name of the Certificate used for TLS (must match a Certificate name that is registered in tls.certs). + cert: default + # -- If true, the truststore file for this listener is included in the ConfigMap. + requireClientAuth: false + # -- Kafka API listeners. + kafka: + # -- The port for internal client connections. + port: 9093 + # default is "sasl" + authenticationMethod: + tls: + # Optional flag to override the global TLS enabled flag. + # enabled: true + cert: default + requireClientAuth: false + external: + default: + # enabled: true + # -- The port used for external client connections. + port: 9094 + # prefixTemplate: "" + # -- If undefined, `listeners.kafka.external.default.port` is used. + advertisedPorts: + - 31092 + tls: + # enabled: true + cert: external + # default is "sasl" + authenticationMethod: + # -- RPC listener (this is never externally accessible). + rpc: + port: 33145 + tls: + # Optional flag to override the global TLS enabled flag. + # enabled: true + cert: default + requireClientAuth: false + # -- Schema registry listeners. + schemaRegistry: + enabled: true + port: 8081 + kafkaEndpoint: default + # default is "http_basic" + authenticationMethod: + tls: + # Optional flag to override the global TLS enabled flag. + # enabled: true + cert: default + requireClientAuth: false + external: + default: + # enabled: true + port: 8084 + advertisedPorts: + - 30081 + tls: + # enabled: true + cert: external + requireClientAuth: false + # default is "http_basic" + authenticationMethod: + # -- HTTP API listeners (aka PandaProxy). + http: + enabled: true + port: 8082 + kafkaEndpoint: default + # default is "http_basic" + authenticationMethod: + tls: + # Optional flag to override the global TLS enabled flag. + # enabled: true + cert: default + requireClientAuth: false + external: + default: + # enabled: true + port: 8083 + # prefixTemplate: "" + advertisedPorts: + - 30082 + tls: + # enabled: true + cert: external + requireClientAuth: false + # default is "http_basic" + authenticationMethod: + +# Expert Config +# Here be dragons! +# +# -- This section contains various settings supported by Redpanda that may not work +# correctly in a Kubernetes cluster. Changing these settings comes with some risk. +# +# Use these settings to customize various Redpanda configurations that are not covered in other sections. +# These values have no impact on the configuration or behavior of the Kubernetes objects deployed by Helm, +# and therefore should not be modified for the purpose of configuring those objects. +# Instead, these settings get passed directly to the Redpanda binary at startup. +# For descriptions of these properties, +# see the [configuration documentation](https://docs.redpanda.com/docs/cluster-administration/configuration/). +config: + rpk: {} + # additional_start_flags: # List of flags to pass to rpk, e.g., ` "--idle-poll-time-us=0"` + # -- [Cluster Configuration Properties](https://docs.redpanda.com/current/reference/properties/cluster-properties/) + cluster: {} + + # -- Tunable cluster properties. + # Deprecated: all settings here may be specified via `config.cluster`. + tunable: + # -- See the [property reference documentation](https://docs.redpanda.com/docs/reference/cluster-properties/#log_segment_size_min). + log_segment_size_min: 16777216 # 16 mb + # -- See the [property reference documentation](https://docs.redpanda.com/docs/reference/cluster-properties/#log_segment_size_max). + log_segment_size_max: 268435456 # 256 mb + # -- See the [property reference documentation](https://docs.redpanda.com/docs/reference/cluster-properties/#compacted_log_segment_size). + compacted_log_segment_size: 67108864 # 64 mb + # -- See the [property reference documentation](https://docs.redpanda.com/docs/reference/cluster-properties/#max_compacted_log_segment_size). + max_compacted_log_segment_size: 536870912 # 512 mb + # -- See the [property reference documentation](https://docs.redpanda.com/docs/reference/cluster-properties/#kafka_connection_rate_limit). + kafka_connection_rate_limit: 1000 + + # -- [Broker (node) Configuration Properties](https://docs.redpanda.com/docs/reference/broker-properties/). + node: + # -- Crash loop limit + # A limit on the number of consecutive times a broker can crash within one hour before its crash-tracking logic is reset. + # This limit prevents a broker from getting stuck in an infinite cycle of crashes. + # User can disable this crash loop limit check by the following action: + # + # * One hour elapses since the last crash + # * The node configuration file, redpanda.yaml, is updated via config.cluster or config.node or config.tunable objects + # * The startup_log file in the node’s data_directory is manually deleted + # + # Default to 5 + # REF: https://docs.redpanda.com/current/reference/broker-properties/#crash_loop_limit + crash_loop_limit: 5 + + # Reference schema registry client https://docs.redpanda.com/current/reference/node-configuration-sample/ + schema_registry_client: {} + # # Number of times to retry a request to a broker + # # Default: 5 + # retries: 5 + # + # # Delay (in milliseconds) for initial retry backoff + # # Default: 100ms + # retry_base_backoff_ms: 100 + # + # # Number of records to batch before sending to broker + # # Default: 1000 + # produce_batch_record_count: 1000 + # + # # Number of bytes to batch before sending to broker + # # Defautl 1MiB + # produce_batch_size_bytes: 1048576 + # + # # Delay (in milliseconds) to wait before sending batch + # # Default: 100ms + # produce_batch_delay_ms: 100 + # + # # Interval (in milliseconds) for consumer request timeout + # # Default: 100ms + # consumer_request_timeout_ms: 100 + # + # # Max bytes to fetch per request + # # Default: 1MiB + # consumer_request_max_bytes: 1048576 + # + # # Timeout (in milliseconds) for consumer session + # # Default: 10s + # consumer_session_timeout_ms: 10000 + # + # # Timeout (in milliseconds) for consumer rebalance + # # Default: 2s + # consumer_rebalance_timeout_ms: 2000 + # + # # Interval (in milliseconds) for consumer heartbeats + # # Default: 500ms + # consumer_heartbeat_interval_ms: 500 + + # Reference panda proxy client https://docs.redpanda.com/current/reference/node-configuration-sample/ + pandaproxy_client: {} + # # Number of times to retry a request to a broker + # # Default: 5 + # retries: 5 + # + # # Delay (in milliseconds) for initial retry backoff + # # Default: 100ms + # retry_base_backoff_ms: 100 + # + # # Number of records to batch before sending to broker + # # Default: 1000 + # produce_batch_record_count: 1000 + # + # # Number of bytes to batch before sending to broker + # # Defautl 1MiB + # produce_batch_size_bytes: 1048576 + # + # # Delay (in milliseconds) to wait before sending batch + # # Default: 100ms + # produce_batch_delay_ms: 100 + # + # # Interval (in milliseconds) for consumer request timeout + # # Default: 100ms + # consumer_request_timeout_ms: 100 + # + # # Max bytes to fetch per request + # # Default: 1MiB + # consumer_request_max_bytes: 1048576 + # + # # Timeout (in milliseconds) for consumer session + # # Default: 10s + # consumer_session_timeout_ms: 10000 + # + # # Timeout (in milliseconds) for consumer rebalance + # # Default: 2s + # consumer_rebalance_timeout_ms: 2000 + # + # # Interval (in milliseconds) for consumer heartbeats + # # Default: 500ms + # consumer_heartbeat_interval_ms: 500 + + # Invalid properties + # Any of these properties will be ignored. These otherwise valid properties are not allowed + # to be used in this section since they impact deploying Redpanda in Kubernetes. + # Make use of the above sections to modify these values instead (see comments below). + # admin: "127.0.0.1:9644" # Address and port of admin server: use listeners.admin + # admin_api_tls: validate_many # TLS configuration for admin HTTP server: use listeners.admin.tls + # advertised_kafka_api: None # Address of Kafka API published to the clients + # advertised_pandaproxy_api: None # Rest API address and port to publish to client + # advertised_rpc_api: None # Address of RPC endpoint published to other cluster members + # enable_admin_api: true # Enable the admin API + # enable_sasl: false # Enable SASL authentication for Kafka connections + # kafka_api: "127.0.0.1:9092" # Address and port of an interface to listen for Kafka API requests + # kafka_api_tls: None # TLS configuration for Kafka API endpoint + # pandaproxy_api: "0.0.0.0:8082" # Rest API listen address and port + # pandaproxy_api_tls: validate_many # TLS configuration for Pandaproxy api + # rpc_server: "127.0.0.1:33145" # IP address and port for RPC server + # rpc_server_tls: validate # TLS configuration for RPC server + # superusers: None # List of superuser usernames + +tests: + enabled: true diff --git a/index.yaml b/index.yaml index f6cba922a..1f19bdc84 100644 --- a/index.yaml +++ b/index.yaml @@ -4274,6 +4274,38 @@ entries: - assets/cerbos/cerbos-0.37.0.tgz version: 0.37.0 cf-runtime: + - annotations: + artifacthub.io/changes: | + - kind: added + description: "add changelog into release" + artifacthub.io/containsSecurityUpdates: "false" + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Codefresh + catalog.cattle.io/kube-version: '>=1.18-0' + catalog.cattle.io/release-name: cf-runtime + apiVersion: v2 + created: "2024-10-15T00:35:46.72864941Z" + dependencies: + - name: cf-common + repository: oci://quay.io/codefresh/charts + version: 0.16.0 + description: A Helm chart for Codefresh Runner + digest: 36df252cc118b6479a2bcdca2dd6c899fe1148b216e030346d17a88a7211e2cd + home: https://codefresh.io/ + icon: file://assets/icons/cf-runtime.png + keywords: + - codefresh + - runner + kubeVersion: '>=1.18-0' + maintainers: + - name: codefresh + url: https://codefresh-io.github.io/ + name: cf-runtime + sources: + - https://github.com/codefresh-io/venona + urls: + - assets/codefresh/cf-runtime-6.4.5.tgz + version: 6.4.5 - annotations: artifacthub.io/changes: | - kind: security @@ -4803,6 +4835,35 @@ entries: - assets/codefresh/cf-runtime-1.0.7.tgz version: 1.0.7 chronicle: + - annotations: + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Chronicle + catalog.cattle.io/release-name: chronicle + apiVersion: v2 + appVersion: 0.7.3 + created: "2024-10-15T00:35:50.623283833Z" + dependencies: + - name: standard-defs + repository: https://btp-charts-stable.s3.amazonaws.com/charts/ + version: ~0.1.0 + - name: sawtooth + repository: https://btp-charts-stable.s3.amazonaws.com/charts/ + version: 0.2.13 + description: 'Chronicle is an open-source, blockchain-backed, domain-agnostic + provenance product. Chronicle makes it easy for users to record and query immutable + provenance information on a distributed ledger - about any asset, in any domain, + and across multiple parties. ' + digest: 4acbb069ed08c39a0bcf2fd07db961e48687c0a0ee726d606a79a02e42f8e15c + home: https://docs.btp.works/chronicle + icon: file://assets/icons/chronicle.png + keywords: + - provenance + - blockchain + name: chronicle + type: application + urls: + - assets/paravela/chronicle-0.1.27.tgz + version: 0.1.27 - annotations: catalog.cattle.io/certified: partner catalog.cattle.io/display-name: Chronicle @@ -10279,6 +10340,33 @@ entries: - assets/dh2i/dxoperator-1.0.1.tgz version: 1.0.1 dynatrace-operator: + - annotations: + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Dynatrace Operator + catalog.cattle.io/kube-version: '>=1.19.0-0' + catalog.cattle.io/release-name: dynatrace-operator + apiVersion: v2 + appVersion: 1.3.1 + created: "2024-10-15T00:35:46.96260986Z" + description: The Dynatrace Operator Helm chart for Kubernetes and OpenShift + digest: 16de6bac9e7f279540ef19123afc7078fda49382200a5ab60e6390ff696c6abb + home: https://www.dynatrace.com/ + icon: file://assets/icons/dynatrace-operator.png + kubeVersion: '>=1.19.0-0' + maintainers: + - email: marcell.sevcsik@dynatrace.com + name: 0sewa0 + - email: christoph.muellner@dynatrace.com + name: chrismuellner + - email: lukas.hinterreiter@dynatrace.com + name: luhi-DT + name: dynatrace-operator + sources: + - https://github.com/Dynatrace/dynatrace-operator + type: application + urls: + - assets/dynatrace/dynatrace-operator-1.3.1.tgz + version: 1.3.1 - annotations: catalog.cattle.io/certified: partner catalog.cattle.io/display-name: Dynatrace Operator @@ -34462,6 +34550,48 @@ entries: - assets/quobyte/quobyte-cluster-0.1.8.tgz version: 0.1.8 redpanda: + - annotations: + artifacthub.io/images: | + - name: redpanda + image: docker.redpanda.com/redpandadata/redpanda:v24.2.7 + - name: busybox + image: busybox:latest + artifacthub.io/license: Apache-2.0 + artifacthub.io/links: | + - name: Documentation + url: https://docs.redpanda.com + - name: "Helm (>= 3.10.0)" + url: https://helm.sh/docs/intro/install/ + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Redpanda + catalog.cattle.io/kube-version: '>=1.21-0' + catalog.cattle.io/release-name: redpanda + apiVersion: v2 + appVersion: v24.2.7 + created: "2024-10-15T00:35:51.139109431Z" + dependencies: + - condition: console.enabled + name: console + repository: https://charts.redpanda.com + version: '>=0.5 <1.0' + - condition: connectors.enabled + name: connectors + repository: https://charts.redpanda.com + version: '>=0.1.2 <1.0' + description: Redpanda is the real-time engine for modern apps. + digest: 6cc6c68ef2d823a4ce8e2d0d614998a1f03f5afa57c523531ead8035c360b28b + icon: file://assets/icons/redpanda.svg + kubeVersion: '>=1.21-0' + maintainers: + - name: redpanda-data + url: https://github.com/orgs/redpanda-data/people + name: redpanda + sources: + - https://github.com/redpanda-data/helm-charts + type: application + urls: + - assets/redpanda/redpanda-5.9.7.tgz + version: 5.9.7 - annotations: artifacthub.io/images: | - name: redpanda @@ -44868,4 +44998,4 @@ entries: urls: - assets/netfoundry/ziti-host-1.5.1.tgz version: 1.5.1 -generated: "2024-10-12T00:37:09.128616817Z" +generated: "2024-10-15T00:35:46.309906099Z"