From da3e713f4c3f253c8785c9a47caa925b0d6e7e8f Mon Sep 17 00:00:00 2001 From: moabu <47318409+moabu@users.noreply.github.com> Date: Thu, 9 Feb 2023 07:04:20 +0000 Subject: [PATCH] refactor: remove gluu flex previous chart --- assets/gluu/gluu-5.0.0.tgz | Bin 117432 -> 0 bytes assets/gluu/gluu-5.0.10.tgz | Bin 105771 -> 0 bytes assets/gluu/gluu-5.0.101.tgz | Bin 119331 -> 0 bytes assets/gluu/gluu-5.0.302.tgz | Bin 111456 -> 0 bytes charts/gluu/gluu/Chart.yaml | 102 - charts/gluu/gluu/README.md | 603 ---- charts/gluu/gluu/app-readme.md | 35 - charts/gluu/gluu/charts/admin-ui/.helmignore | 21 - charts/gluu/gluu/charts/admin-ui/Chart.yaml | 20 - charts/gluu/gluu/charts/admin-ui/README.md | 58 - .../charts/admin-ui/templates/_helpers.tpl | 98 - .../templates/admin-ui-destination-rules.yaml | 22 - .../admin-ui/templates/admin-ui-pdb.yaml | 11 - .../templates/admin-ui-virtual-services.yaml | 37 - .../charts/admin-ui/templates/deployment.yml | 167 - .../gluu/charts/admin-ui/templates/hpa.yaml | 37 - .../charts/admin-ui/templates/service.yml | 29 - .../templates/user-custom-secret-envs.yaml | 21 - charts/gluu/gluu/charts/admin-ui/values.yaml | 81 - .../auth-server-key-rotation/.helmignore | 21 - .../auth-server-key-rotation/Chart.yaml | 18 - .../charts/auth-server-key-rotation/README.md | 48 - .../templates/_helpers.tpl | 68 - .../templates/cronjobs.yaml | 127 - .../templates/service.yaml | 25 - .../templates/user-custom-secret-envs.yaml | 20 - .../auth-server-key-rotation/values.yaml | 48 - .../gluu/gluu/charts/auth-server/.helmignore | 21 - .../gluu/gluu/charts/auth-server/Chart.yaml | 22 - charts/gluu/gluu/charts/auth-server/README.md | 60 - .../charts/auth-server/templates/_helpers.tpl | 98 - .../auth-server-destination-rules.yaml | 22 - .../templates/auth-server-pdb.yaml | 11 - ...uth-server-protected-virtual-services.yaml | 53 - .../auth-server-virtual-services.yaml | 137 - .../auth-server/templates/deployment.yml | 262 -- .../charts/auth-server/templates/hpa.yaml | 37 - .../charts/auth-server/templates/service.yml | 29 - .../templates/user-custom-secret-envs.yaml | 21 - .../gluu/gluu/charts/auth-server/values.yaml | 87 - charts/gluu/gluu/charts/casa/.helmignore | 22 - charts/gluu/gluu/charts/casa/Chart.yaml | 22 - charts/gluu/gluu/charts/casa/README.md | 65 - .../gluu/charts/casa/templates/_helpers.tpl | 109 - .../templates/casa-destination-rules.yaml | 22 - .../gluu/charts/casa/templates/casa-pdb.yaml | 11 - .../casa/templates/casa-virtual-services.yaml | 38 - .../charts/casa/templates/deployment.yaml | 176 - .../gluu/gluu/charts/casa/templates/hpa.yaml | 37 - .../gluu/charts/casa/templates/service.yaml | 30 - .../templates/user-custom-secret-envs.yaml | 21 - charts/gluu/gluu/charts/casa/values.yaml | 98 - .../gluu/charts/cn-istio-ingress/.helmignore | 22 - .../gluu/charts/cn-istio-ingress/Chart.yaml | 19 - .../gluu/charts/cn-istio-ingress/README.md | 25 - .../cn-istio-ingress/templates/_helpers.tpl | 63 - .../cn-istio-ingress/templates/gateway.yaml | 36 - .../gluu/charts/cn-istio-ingress/values.yaml | 4 - .../gluu/gluu/charts/config-api/.helmignore | 21 - charts/gluu/gluu/charts/config-api/Chart.yaml | 22 - charts/gluu/gluu/charts/config-api/README.md | 64 - .../charts/config-api/templates/_helpers.tpl | 98 - .../config-api-destination-rules.yaml | 22 - .../config-api/templates/config-api-pdb.yaml | 11 - .../config-api-virtual-services.yaml | 38 - .../config-api/templates/deployment.yaml | 165 - .../gluu/charts/config-api/templates/hpa.yaml | 37 - .../charts/config-api/templates/service.yaml | 29 - .../gluu/gluu/charts/config-api/values.yaml | 96 - charts/gluu/gluu/charts/config/.helmignore | 22 - charts/gluu/gluu/charts/config/Chart.yaml | 21 - charts/gluu/gluu/charts/config/README.md | 100 - .../gluu/charts/config/templates/_helpers.tpl | 97 - .../config/templates/clusterrolebinding.yaml | 45 - .../charts/config/templates/configmaps.yaml | 417 --- .../config/templates/load-init-config.yml | 133 - .../charts/config/templates/ob-secrets.yaml | 71 - .../charts/config/templates/rolebinding.yaml | 23 - .../gluu/charts/config/templates/roles.yaml | 19 - .../gluu/charts/config/templates/secrets.yaml | 127 - .../gluu/charts/config/templates/service.yaml | 27 - .../config/templates/user-custom-envs.yaml | 64 - charts/gluu/gluu/charts/config/values.yaml | 160 - charts/gluu/gluu/charts/fido2/.helmignore | 21 - charts/gluu/gluu/charts/fido2/Chart.yaml | 22 - charts/gluu/gluu/charts/fido2/README.md | 61 - .../gluu/charts/fido2/templates/_helpers.tpl | 98 - .../charts/fido2/templates/deployment.yml | 174 - .../templates/fido2-destination-rules.yaml | 22 - .../charts/fido2/templates/fido2-pdb.yaml | 11 - .../templates/fido2-virtual-services.yaml | 40 - .../gluu/gluu/charts/fido2/templates/hpa.yaml | 37 - .../gluu/charts/fido2/templates/service.yml | 29 - .../templates/user-custom-secret-envs.yaml | 21 - charts/gluu/gluu/charts/fido2/values.yaml | 85 - .../gluu/charts/nginx-ingress/.helmignore | 21 - .../gluu/gluu/charts/nginx-ingress/Chart.yaml | 20 - .../gluu/gluu/charts/nginx-ingress/README.md | 62 - .../nginx-ingress/templates/_helpers.tpl | 32 - .../templates/admin-ui-ingress.yaml | 53 - .../auth-server-protected-ingress.yaml | 115 - .../nginx-ingress/templates/casa-ingress.yaml | 54 - .../nginx-ingress/templates/certificate.yaml | 18 - .../nginx-ingress/templates/ingress.yaml | 681 ---- .../gluu/charts/nginx-ingress/values.yaml | 77 - charts/gluu/gluu/charts/opendj/.helmignore | 21 - charts/gluu/gluu/charts/opendj/Chart.yaml | 22 - charts/gluu/gluu/charts/opendj/README.md | 71 - .../gluu/charts/opendj/templates/_helpers.tpl | 98 - .../charts/opendj/templates/cronjobs.yaml | 95 - .../gluu/charts/opendj/templates/hpa.yaml | 36 - .../templates/opendj-destination-rules.yaml | 23 - .../charts/opendj/templates/opendj-pdb.yaml | 11 - .../gluu/charts/opendj/templates/service.yaml | 30 - .../charts/opendj/templates/statefulset.yaml | 133 - .../charts/opendj/templates/storageclass.yaml | 57 - .../templates/user-custom-secret-envs.yaml | 20 - charts/gluu/gluu/charts/opendj/values.yaml | 134 - .../gluu/gluu/charts/oxpassport/.helmignore | 21 - charts/gluu/gluu/charts/oxpassport/Chart.yaml | 21 - charts/gluu/gluu/charts/oxpassport/README.md | 66 - .../charts/oxpassport/templates/_helpers.tpl | 98 - .../oxpassport/templates/deployment.yaml | 181 -- .../gluu/charts/oxpassport/templates/hpa.yaml | 36 - .../oxpassport-destination-rules.yaml | 21 - .../oxpassport/templates/oxpassport-pdb.yaml | 11 - .../oxpassport-virtual-services.yaml | 37 - .../charts/oxpassport/templates/service.yaml | 29 - .../templates/user-custom-secret-envs.yaml | 20 - .../gluu/gluu/charts/oxpassport/values.yaml | 97 - .../gluu/gluu/charts/oxshibboleth/.helmignore | 21 - .../gluu/gluu/charts/oxshibboleth/Chart.yaml | 20 - .../gluu/gluu/charts/oxshibboleth/README.md | 67 - .../oxshibboleth/templates/_helpers.tpl | 144 - .../charts/oxshibboleth/templates/hpa.yaml | 37 - .../oxshibboleth-destination-rules.yaml | 22 - .../templates/oxshibboleth-pdb.yaml | 11 - .../oxshibboleth-virtual-services.yaml | 33 - .../oxshibboleth/templates/service.yaml | 33 - .../oxshibboleth/templates/statefulset.yaml | 169 - .../templates/user-custom-secret-envs.yaml | 21 - .../gluu/gluu/charts/oxshibboleth/values.yaml | 96 - .../gluu/gluu/charts/persistence/.helmignore | 22 - .../gluu/gluu/charts/persistence/Chart.yaml | 18 - charts/gluu/gluu/charts/persistence/README.md | 51 - .../charts/persistence/templates/_helpers.tpl | 79 - .../charts/persistence/templates/jobs.yml | 126 - .../charts/persistence/templates/service.yaml | 27 - .../templates/user-custom-secret-envs.yaml | 20 - .../gluu/gluu/charts/persistence/values.yaml | 48 - charts/gluu/gluu/charts/scim/.helmignore | 21 - charts/gluu/gluu/charts/scim/Chart.yaml | 20 - charts/gluu/gluu/charts/scim/README.md | 60 - .../gluu/charts/scim/templates/_helpers.tpl | 98 - .../gluu/charts/scim/templates/deployment.yml | 172 - .../gluu/gluu/charts/scim/templates/hpa.yaml | 37 - .../templates/scim-destination-rules.yaml | 22 - .../gluu/charts/scim/templates/scim-pdb.yaml | 11 - .../scim/templates/scim-virtual-services.yaml | 54 - .../gluu/charts/scim/templates/service.yml | 29 - .../templates/user-custom-secret-envs.yaml | 21 - charts/gluu/gluu/charts/scim/values.yaml | 84 - charts/gluu/gluu/openbanking-values.yaml | 700 ---- charts/gluu/gluu/questions.yaml | 1287 -------- charts/gluu/gluu/templates/_helpers.tpl | 32 - charts/gluu/gluu/values.schema.json | 2888 ----------------- charts/gluu/gluu/values.yaml | 1675 ---------- index.yaml | 444 --- packages/gluu/flex/overlay/app-readme.md | 35 - packages/gluu/flex/overlay/questions.yaml | 1287 -------- packages/gluu/flex/upstream.yaml | 9 - 171 files changed, 18520 deletions(-) delete mode 100644 assets/gluu/gluu-5.0.0.tgz delete mode 100644 assets/gluu/gluu-5.0.10.tgz delete mode 100644 assets/gluu/gluu-5.0.101.tgz delete mode 100644 assets/gluu/gluu-5.0.302.tgz delete mode 100644 charts/gluu/gluu/Chart.yaml delete mode 100644 charts/gluu/gluu/README.md delete mode 100644 charts/gluu/gluu/app-readme.md delete mode 100644 charts/gluu/gluu/charts/admin-ui/.helmignore delete mode 100644 charts/gluu/gluu/charts/admin-ui/Chart.yaml delete mode 100644 charts/gluu/gluu/charts/admin-ui/README.md delete mode 100644 charts/gluu/gluu/charts/admin-ui/templates/_helpers.tpl delete mode 100644 charts/gluu/gluu/charts/admin-ui/templates/admin-ui-destination-rules.yaml delete mode 100644 charts/gluu/gluu/charts/admin-ui/templates/admin-ui-pdb.yaml delete mode 100644 charts/gluu/gluu/charts/admin-ui/templates/admin-ui-virtual-services.yaml delete mode 100644 charts/gluu/gluu/charts/admin-ui/templates/deployment.yml delete mode 100644 charts/gluu/gluu/charts/admin-ui/templates/hpa.yaml delete mode 100644 charts/gluu/gluu/charts/admin-ui/templates/service.yml delete mode 100644 charts/gluu/gluu/charts/admin-ui/templates/user-custom-secret-envs.yaml delete mode 100644 charts/gluu/gluu/charts/admin-ui/values.yaml delete mode 100644 charts/gluu/gluu/charts/auth-server-key-rotation/.helmignore delete mode 100644 charts/gluu/gluu/charts/auth-server-key-rotation/Chart.yaml delete mode 100644 charts/gluu/gluu/charts/auth-server-key-rotation/README.md delete mode 100644 charts/gluu/gluu/charts/auth-server-key-rotation/templates/_helpers.tpl delete mode 100644 charts/gluu/gluu/charts/auth-server-key-rotation/templates/cronjobs.yaml delete mode 100644 charts/gluu/gluu/charts/auth-server-key-rotation/templates/service.yaml delete mode 100644 charts/gluu/gluu/charts/auth-server-key-rotation/templates/user-custom-secret-envs.yaml delete mode 100644 charts/gluu/gluu/charts/auth-server-key-rotation/values.yaml delete mode 100644 charts/gluu/gluu/charts/auth-server/.helmignore delete mode 100644 charts/gluu/gluu/charts/auth-server/Chart.yaml delete mode 100644 charts/gluu/gluu/charts/auth-server/README.md delete mode 100644 charts/gluu/gluu/charts/auth-server/templates/_helpers.tpl delete mode 100644 charts/gluu/gluu/charts/auth-server/templates/auth-server-destination-rules.yaml delete mode 100644 charts/gluu/gluu/charts/auth-server/templates/auth-server-pdb.yaml delete mode 100644 charts/gluu/gluu/charts/auth-server/templates/auth-server-protected-virtual-services.yaml delete mode 100644 charts/gluu/gluu/charts/auth-server/templates/auth-server-virtual-services.yaml delete mode 100644 charts/gluu/gluu/charts/auth-server/templates/deployment.yml delete mode 100644 charts/gluu/gluu/charts/auth-server/templates/hpa.yaml delete mode 100644 charts/gluu/gluu/charts/auth-server/templates/service.yml delete mode 100644 charts/gluu/gluu/charts/auth-server/templates/user-custom-secret-envs.yaml delete mode 100644 charts/gluu/gluu/charts/auth-server/values.yaml delete mode 100644 charts/gluu/gluu/charts/casa/.helmignore delete mode 100644 charts/gluu/gluu/charts/casa/Chart.yaml delete mode 100644 charts/gluu/gluu/charts/casa/README.md delete mode 100644 charts/gluu/gluu/charts/casa/templates/_helpers.tpl delete mode 100644 charts/gluu/gluu/charts/casa/templates/casa-destination-rules.yaml delete mode 100644 charts/gluu/gluu/charts/casa/templates/casa-pdb.yaml delete mode 100644 charts/gluu/gluu/charts/casa/templates/casa-virtual-services.yaml delete mode 100644 charts/gluu/gluu/charts/casa/templates/deployment.yaml delete mode 100644 charts/gluu/gluu/charts/casa/templates/hpa.yaml delete mode 100644 charts/gluu/gluu/charts/casa/templates/service.yaml delete mode 100644 charts/gluu/gluu/charts/casa/templates/user-custom-secret-envs.yaml delete mode 100644 charts/gluu/gluu/charts/casa/values.yaml delete mode 100644 charts/gluu/gluu/charts/cn-istio-ingress/.helmignore delete mode 100644 charts/gluu/gluu/charts/cn-istio-ingress/Chart.yaml delete mode 100644 charts/gluu/gluu/charts/cn-istio-ingress/README.md delete mode 100644 charts/gluu/gluu/charts/cn-istio-ingress/templates/_helpers.tpl delete mode 100644 charts/gluu/gluu/charts/cn-istio-ingress/templates/gateway.yaml delete mode 100644 charts/gluu/gluu/charts/cn-istio-ingress/values.yaml delete mode 100644 charts/gluu/gluu/charts/config-api/.helmignore delete mode 100644 charts/gluu/gluu/charts/config-api/Chart.yaml delete mode 100644 charts/gluu/gluu/charts/config-api/README.md delete mode 100644 charts/gluu/gluu/charts/config-api/templates/_helpers.tpl delete mode 100644 charts/gluu/gluu/charts/config-api/templates/config-api-destination-rules.yaml delete mode 100644 charts/gluu/gluu/charts/config-api/templates/config-api-pdb.yaml delete mode 100644 charts/gluu/gluu/charts/config-api/templates/config-api-virtual-services.yaml delete mode 100644 charts/gluu/gluu/charts/config-api/templates/deployment.yaml delete mode 100644 charts/gluu/gluu/charts/config-api/templates/hpa.yaml delete mode 100644 charts/gluu/gluu/charts/config-api/templates/service.yaml delete mode 100644 charts/gluu/gluu/charts/config-api/values.yaml delete mode 100644 charts/gluu/gluu/charts/config/.helmignore delete mode 100644 charts/gluu/gluu/charts/config/Chart.yaml delete mode 100644 charts/gluu/gluu/charts/config/README.md delete mode 100644 charts/gluu/gluu/charts/config/templates/_helpers.tpl delete mode 100644 charts/gluu/gluu/charts/config/templates/clusterrolebinding.yaml delete mode 100644 charts/gluu/gluu/charts/config/templates/configmaps.yaml delete mode 100644 charts/gluu/gluu/charts/config/templates/load-init-config.yml delete mode 100644 charts/gluu/gluu/charts/config/templates/ob-secrets.yaml delete mode 100644 charts/gluu/gluu/charts/config/templates/rolebinding.yaml delete mode 100644 charts/gluu/gluu/charts/config/templates/roles.yaml delete mode 100644 charts/gluu/gluu/charts/config/templates/secrets.yaml delete mode 100644 charts/gluu/gluu/charts/config/templates/service.yaml delete mode 100644 charts/gluu/gluu/charts/config/templates/user-custom-envs.yaml delete mode 100644 charts/gluu/gluu/charts/config/values.yaml delete mode 100644 charts/gluu/gluu/charts/fido2/.helmignore delete mode 100644 charts/gluu/gluu/charts/fido2/Chart.yaml delete mode 100644 charts/gluu/gluu/charts/fido2/README.md delete mode 100644 charts/gluu/gluu/charts/fido2/templates/_helpers.tpl delete mode 100644 charts/gluu/gluu/charts/fido2/templates/deployment.yml delete mode 100644 charts/gluu/gluu/charts/fido2/templates/fido2-destination-rules.yaml delete mode 100644 charts/gluu/gluu/charts/fido2/templates/fido2-pdb.yaml delete mode 100644 charts/gluu/gluu/charts/fido2/templates/fido2-virtual-services.yaml delete mode 100644 charts/gluu/gluu/charts/fido2/templates/hpa.yaml delete mode 100644 charts/gluu/gluu/charts/fido2/templates/service.yml delete mode 100644 charts/gluu/gluu/charts/fido2/templates/user-custom-secret-envs.yaml delete mode 100644 charts/gluu/gluu/charts/fido2/values.yaml delete mode 100644 charts/gluu/gluu/charts/nginx-ingress/.helmignore delete mode 100644 charts/gluu/gluu/charts/nginx-ingress/Chart.yaml delete mode 100644 charts/gluu/gluu/charts/nginx-ingress/README.md delete mode 100644 charts/gluu/gluu/charts/nginx-ingress/templates/_helpers.tpl delete mode 100644 charts/gluu/gluu/charts/nginx-ingress/templates/admin-ui-ingress.yaml delete mode 100644 charts/gluu/gluu/charts/nginx-ingress/templates/auth-server-protected-ingress.yaml delete mode 100644 charts/gluu/gluu/charts/nginx-ingress/templates/casa-ingress.yaml delete mode 100644 charts/gluu/gluu/charts/nginx-ingress/templates/certificate.yaml delete mode 100644 charts/gluu/gluu/charts/nginx-ingress/templates/ingress.yaml delete mode 100644 charts/gluu/gluu/charts/nginx-ingress/values.yaml delete mode 100644 charts/gluu/gluu/charts/opendj/.helmignore delete mode 100644 charts/gluu/gluu/charts/opendj/Chart.yaml delete mode 100644 charts/gluu/gluu/charts/opendj/README.md delete mode 100644 charts/gluu/gluu/charts/opendj/templates/_helpers.tpl delete mode 100644 charts/gluu/gluu/charts/opendj/templates/cronjobs.yaml delete mode 100644 charts/gluu/gluu/charts/opendj/templates/hpa.yaml delete mode 100644 charts/gluu/gluu/charts/opendj/templates/opendj-destination-rules.yaml delete mode 100644 charts/gluu/gluu/charts/opendj/templates/opendj-pdb.yaml delete mode 100644 charts/gluu/gluu/charts/opendj/templates/service.yaml delete mode 100644 charts/gluu/gluu/charts/opendj/templates/statefulset.yaml delete mode 100644 charts/gluu/gluu/charts/opendj/templates/storageclass.yaml delete mode 100644 charts/gluu/gluu/charts/opendj/templates/user-custom-secret-envs.yaml delete mode 100644 charts/gluu/gluu/charts/opendj/values.yaml delete mode 100644 charts/gluu/gluu/charts/oxpassport/.helmignore delete mode 100644 charts/gluu/gluu/charts/oxpassport/Chart.yaml delete mode 100644 charts/gluu/gluu/charts/oxpassport/README.md delete mode 100644 charts/gluu/gluu/charts/oxpassport/templates/_helpers.tpl delete mode 100644 charts/gluu/gluu/charts/oxpassport/templates/deployment.yaml delete mode 100644 charts/gluu/gluu/charts/oxpassport/templates/hpa.yaml delete mode 100644 charts/gluu/gluu/charts/oxpassport/templates/oxpassport-destination-rules.yaml delete mode 100644 charts/gluu/gluu/charts/oxpassport/templates/oxpassport-pdb.yaml delete mode 100644 charts/gluu/gluu/charts/oxpassport/templates/oxpassport-virtual-services.yaml delete mode 100644 charts/gluu/gluu/charts/oxpassport/templates/service.yaml delete mode 100644 charts/gluu/gluu/charts/oxpassport/templates/user-custom-secret-envs.yaml delete mode 100644 charts/gluu/gluu/charts/oxpassport/values.yaml delete mode 100644 charts/gluu/gluu/charts/oxshibboleth/.helmignore delete mode 100644 charts/gluu/gluu/charts/oxshibboleth/Chart.yaml delete mode 100644 charts/gluu/gluu/charts/oxshibboleth/README.md delete mode 100644 charts/gluu/gluu/charts/oxshibboleth/templates/_helpers.tpl delete mode 100644 charts/gluu/gluu/charts/oxshibboleth/templates/hpa.yaml delete mode 100644 charts/gluu/gluu/charts/oxshibboleth/templates/oxshibboleth-destination-rules.yaml delete mode 100644 charts/gluu/gluu/charts/oxshibboleth/templates/oxshibboleth-pdb.yaml delete mode 100644 charts/gluu/gluu/charts/oxshibboleth/templates/oxshibboleth-virtual-services.yaml delete mode 100644 charts/gluu/gluu/charts/oxshibboleth/templates/service.yaml delete mode 100644 charts/gluu/gluu/charts/oxshibboleth/templates/statefulset.yaml delete mode 100644 charts/gluu/gluu/charts/oxshibboleth/templates/user-custom-secret-envs.yaml delete mode 100644 charts/gluu/gluu/charts/oxshibboleth/values.yaml delete mode 100644 charts/gluu/gluu/charts/persistence/.helmignore delete mode 100644 charts/gluu/gluu/charts/persistence/Chart.yaml delete mode 100644 charts/gluu/gluu/charts/persistence/README.md delete mode 100644 charts/gluu/gluu/charts/persistence/templates/_helpers.tpl delete mode 100644 charts/gluu/gluu/charts/persistence/templates/jobs.yml delete mode 100644 charts/gluu/gluu/charts/persistence/templates/service.yaml delete mode 100644 charts/gluu/gluu/charts/persistence/templates/user-custom-secret-envs.yaml delete mode 100644 charts/gluu/gluu/charts/persistence/values.yaml delete mode 100644 charts/gluu/gluu/charts/scim/.helmignore delete mode 100644 charts/gluu/gluu/charts/scim/Chart.yaml delete mode 100644 charts/gluu/gluu/charts/scim/README.md delete mode 100644 charts/gluu/gluu/charts/scim/templates/_helpers.tpl delete mode 100644 charts/gluu/gluu/charts/scim/templates/deployment.yml delete mode 100644 charts/gluu/gluu/charts/scim/templates/hpa.yaml delete mode 100644 charts/gluu/gluu/charts/scim/templates/scim-destination-rules.yaml delete mode 100644 charts/gluu/gluu/charts/scim/templates/scim-pdb.yaml delete mode 100644 charts/gluu/gluu/charts/scim/templates/scim-virtual-services.yaml delete mode 100644 charts/gluu/gluu/charts/scim/templates/service.yml delete mode 100644 charts/gluu/gluu/charts/scim/templates/user-custom-secret-envs.yaml delete mode 100644 charts/gluu/gluu/charts/scim/values.yaml delete mode 100644 charts/gluu/gluu/openbanking-values.yaml delete mode 100644 charts/gluu/gluu/questions.yaml delete mode 100644 charts/gluu/gluu/templates/_helpers.tpl delete mode 100644 charts/gluu/gluu/values.schema.json delete mode 100644 charts/gluu/gluu/values.yaml delete mode 100644 packages/gluu/flex/overlay/app-readme.md delete mode 100644 packages/gluu/flex/overlay/questions.yaml delete mode 100644 packages/gluu/flex/upstream.yaml diff --git a/assets/gluu/gluu-5.0.0.tgz b/assets/gluu/gluu-5.0.0.tgz deleted file mode 100644 index 766ef3eef99a297079e34f812fd96e45de1812b0..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 117432 zcmV*0KzY9(iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMX@a~nyvD8`w0{o+2paKyE}us4p#$DS7>^$;LPQR;5oJJSP^ zR5#W98Uk$1OslVys7e4SR%Mnlvq+*FintM8dgG=4g~MBKz40IL&f&HHf>(CrS5+2J z0IC3xBBjDi3q)1s$#YJAojiFy`av9T?F}Fk^&t#{wcGeK8jZ%Y-CgzFXf(#ZpMJHo zySBZ%z58_g$+NGXK3QvQ?`%JNwgwuvg3Z_`<^r;{#?oz#6Zb$qkPs@Mz?AUjIslLf z+=HGN#N9fkTiyVYKH^O4SaD1;gD~LaBpRECw}> z*cD;`5+8V!^l-lhBV0E?E+QWa9Fd68cgPc4PPyiG zy-{zx>2B{#gH*dj!x}T}oe9=MOoWiY{#3BQ3os%=vT-(~q}UWdx;tW~kgAzRXM;>? z(COGEom>Fa4D5Q?r#mx2s1j3Z%aP*0%T||TsfT=|3Et90nom`IA6;eYM~HFE1tK1r ziGx$F7EtICMbI0d+D^SOStw$Np#VWyE*bV76fmIu zx(9^_keVt;R>R0|f(SA}RJTtS^D&PCIIL+3)P&y)XzYVS9}$7YP|fO==ONC)u^K-i zA|e--LCe6BU9k=${G((aB~5U(vks#u`KdZ(-AA&E5b-eL&GnibT0R!4KtG^e7}WJB zsv`os0rJ;DW@N7ez)(av7L*N}U_H&a7@g)pjn&1nu*Mt6*RI3IUH}mgB&hD0yCTF ztl>Dm+b*;UFbx4sE&}$=qL7n)c@ng{vo8YM*^VZFXScLPpkppDt*7JNAWdrOMTv>v zBknOAY2a#KF`J0oPm;|g-BFZ``P|5uz9VC<52!@JN{iRm*L5o~u47L^&le=+FEd!S zdhkjXtz(a_U&dXOY(l^P(;u(4>)YSd8@0yo*F%Vve2JLai%4Q7=;Y#gkicjX;5~Pz~v>S|4L{8TntG|E^#V zBYtZKz?tX2?Pp)@>@>#Df4e)o)%ou(K3{-Z4V;o-2x5+W&>aFXKmZdiU=Scy2b}@p z2yi3>CVdWk3J4Vd_Ik(@fKUb?Lz%kX05Y+jK&aWO@_6aRj3FYD$)=WxIO;R#qoxv+ z1!R3RR=^6+Mv|UbXLP;3`2{@>MdHW`&gz+*kvxK){cYsZ6E#tF3Aw8u>a|QaG+Aa6 z4xv6W#nr2%;4hRozi?##Hm6VZRL)+D^R;;vbUVW+Z4WYHsWuC{Lo#Hf<%N5QiR9r` z(`;~%#@z7-(JiG4PW2@ zon9fvu%ANdLhmw;ED@M^Os(xOXnOcv6cV}^v>8z|}E(0$GYWw4Lh_?PtQ z7huoQ3gmf5_M*}?T%w`YGVr)7PhPD+Af}hm3?DoihLmI;WngO70l8FyJ|ak+ic{!< z3K*QkVHdH}-oZ_TJc0ZRF1HU0F1JXBLBgS@^e|_LwUL+hDGlNfIm1FfIAin*%SqA} z3<}h@lOgb-VRsk@0`F;r4}IPQKmBYuz|s2{5n*0V>8zaYNRJkok#tOx9*-y&auPLj z2g>*;l!7dhMBk&^T^Wp;Kd$(V(0yYd+r>w2+m#bTheWR&4w)UFQNN&whY>!*}@ z4)?(xB}6W)2m?r?jmn;f~IY&`|J;@0)d0?y4aS6vw$5=m3!`*&l9S$&Hh< z19D}?{1hPhHD&QD$gpJRb`vQ1PjgRKGl)$>or%wMsJhw|a(%)npkYdsV~#+NGT@^qphGn_W%;yF6CCzVs5oPYYqeGe z*bES^Tryp4JP8o?X8=`lO;)++R6dJ?0O-Y#CuEr4P4E-=*>bRL<|orL0}!?U)b**& znLetp-Sz>GkjHhQC~ktCr;SGF7CS~EWy5UAP(9Oy zkFjCp`xx<@Cd`XMjf|C@XeMV33h)&o@<=*BFc1T8fV@l9EApl6L|`s9a1RiKeB?{$ zw$>S=U3d5$+#oL&NH4L`Pz)$};zF*QqB*C&mwNo1nepRO?-H?^991=EENyiI+T9AF z+=I9D;hJx`4Man|Zr&izvQi2-kofi|05yx6^JEJ~(JX+NV1Z$iftC&|{SAN!Et~UBe;3ME&f^%}mKVzlK8vpb0j@A&jC8xm~2lA1UBX@GJO` z)3kF(x^VmQFk)}p)HNjMu@YSaBsd}-8%ClQG3t+D)^hG=6?%4sjws={8|Y1gA#)ay zqJ|pW@a+dB(Gz50|siQLpa1Y5zqlYR` z507vUHNo!JtCvciln_duEGCmoX<~{<@+4m(sg~|faOu_;>X1Y5XhVK&JeKE32sjFQ zHG7P{MqLn5CSahZBqDw-=7^~!Ph+B1d3hT5^fZ!dHOwdmB8Ga1A>tu!1t`n_^gP*D zl1!*^(F%n6x(7L|j^@?T{8Qf<#|(nZEp_QFF>68efX?J)j^qoT$jcqb7dem1UYmOe zmuJH7kjS7cpQT_USy(Qw5yfUe0T4kkXaY4b%qgv=8n&+~6Z(d^mW-WSIl0Y04^MI- z@0>c74Jq(j<-@Xifl3Ve1jV3Z?E3+_h75t$*`eg=00j|%ky`nb0OO-86wpYDJsu1s z5&G_A(_WEKrtU+Gr5gAfjX?;9;F=O2F>pN?0(&V!kcT*jY*+_}0)+4qaexItkYmL3 zf})IY+&0bnZ`$IxPt@U>_`nb=aqJ-|Vutu8xW-~YV*$FzqoKNQk!2`AHxXjO-jhgL zBYmU80jD7X1Kb~gKsKAqKh?HR^?TY=9Wg-gN-okpp|&B%%(oKRDv|9I7ulxTxPMlc zDcg+_lH2ZLlH0U4rigC4_v#S>XJvT{=JP{XsxI7z`*E&98TNpG?X<_wD8* zPv8??)TZ8LD)MPjO%gPnhG)~U&6i;-Decpj()L_uArL_ZLnNedB*!I3B963Oh#pW` z-y*xar9NOFfJ0f?S_>-mliBcieO(t?_&%b(_#R%rolSf;*t}gl#FER}mPi5%XkYcQ z277T>SA7;@Wz???jyi~o?VTsPUnCO;i(wsHNFFP}R(t(;P$1wjq|NBp0r0RGHbE=q z0uyVp)DNxgn1b{Y2{Dw*krbyn{za+iyF3rT{L=t!zYq4i`?^>Ys8Um4$(0+#%(xnw zn%~Ri9E8J~bw^SV>OShhI1qJy<<*TLTU{;xQ(((gGz0fcEvrwSG@ebVL12h7HBO9! z4&hU3#2m4SS{Gc-;2E{#qWudc*;*a*un8_Yd)bP~5bNPU@+|PBP@O(yG|Y4IXul79 zg^V42z-iDvdw~Pg1Y1aWTM}dC^0&p`2X8F+DX0KU-YHW^0Qr>0-6q_ovq)v9gq;*} zQvhNZp*nbb(&`-kc<|=z;JkglMlIK}pe3k6IB{%hDcVVvjV(-B4#E=N#r&iQ*)NX+s6^ z>|)}}-A{RVX&kg14zA_KizC34=QHpiQ5NN9<8_e8#T;_*rQPuaqd}l|ItWgXxTfs# z%%03L_&>+QKa5%$9c4HEV-*DSI=P+#TvF*x7+Y(}&Poj_I3mCztlZH~O@Am!=8b>J@A{Jtzw^79*wT4De47BkpBEDuu25KD~5)gKd+7{_V zGew0uTw$i=`3wbeFgxq1oI`R!b>KRKJ7f25r<%DE6hpuTljmUFXVy#?5symIGUjpv zkhP!fnj&i82VAkfM`I=Bfgz2V(?J)9!1~>TKY?>f1=vd)Uyx?Gr?y|c5S{Rw#@~KC z2|V)m=x;keKL6X!$(8@=Y2z|~l8(pYwZWK|SE4~;dI5T@tG0QUzLr|k)r9!j_;acC5IP0+|2HtF_nW+Ov# z%&09{iY2*jpSHH#fPrQsmNQZyqURAN9Q(+Xin*RPNpp(1=9s29?BhNbo9fRviV*W8 zb^#IsG5s{4*GOFf*~e-vk#G1g?9u>Ca3GZp&i>5#b;FfHBr<`s97t4Cu9RkirK{lL zkQIw^P_}6rm++H8 zGrda-j=o8dd4u5M{Ky69sk2b0cQW{eo=Pi=Hv1fY~zluuZYymA(=%T(wxV8(fO!Gb36 zy2`z`z|nGQ?=Q`&3B=SCRqn`1>-*G;m5((Sl<9+!t2a*r5U6p*!OOjtY~<*4uXR)h zC&`|Pd+L?)01EW+O-CvLFB4a>M2#h9aNT{O~cLEk}vrG^Y+rF;2#P`c9p34*iLhEN|ZCK}@FXB+S{V(d?aVRdGc-Kks?uV9dzPxVT}hr|Pqtja-9@TAcIT;F&+ zo@7dUNIVNk8Sv(!n(Qbs3*@rNLKpWy8XSI^cwe&kx#L>8!n@ej2s)higl798?mL5>{{y?t}`dFBp6*C7( zE0<}BKS$V?xG)60!8Db`)a_0cZTT=VuIfq-%e>Tgv!;mNgH+FH##pXu9%MX*4I5gT z3(FigjdKx@d$69rx^ZCcstqsH4T0e*=%Rpq5!DeI+YNUrD@~`Q)m%&}f-%Ww zY?k)E_NVXZrQHPeQN_)dm4OrW)14D9p;={U_AsC#gbf%p!hbR9Gt0krQqWd$#z@Xb z$xkVX=}RTK8cuQj1|CtO?(j^9 zY$|QfCh(v)K%0PLfi`u_l}(`bTP~;4KLh7TV*Y%bXkajR@6_~&7RtIA=>T2xy4&q< ztxHOJ+$k$N{}@IQCjF*GBIUq2@-YW(LFXUa~+MB~4D^f+qsU}8})HXiNP z@lnmn>DE=?pTWf;2oZ@l0TNy!ufZ^ww!}CW{$@i{<^a}iC%ffcq9J$J`a;{6qust9 zU~gapNsTEeboCUSwlQIIjRuY=^t&*SXDyZ}(&e7tdev5500X2o_sKFARdCR4 z`95>))%WBfoehCUeN@D-O&8x&TfjxzLOBQ_PBr`Hu&xvwm8|#zF)cCfDWOA29gg_#2B9@!=q7JnxdnX6`jFVGJAD^9m+6%C zPm-AA>zQR~62(PkwOU_Xq+xPbykb-S`yGLxEwq(Zq3OnD;U?((^%F4(zfF%CO~rvk zWbXtV<9>QfF+rrq`H% zc*iN(w2HMqz$->Ko%t zK#Bdg2`aRiN)C{y2%9ytT22XQ2_BuEJysn!EvO}U)M`JregT!QBdB~GKSN)~Y+{|t z*YVT$b(|ZbVl1G8iPNA08>Yi$Oa6DYZ9EvaBs^PQdjmGU+Eou$P#0dc#`T!=WV5M-h|ogq-$C9+@ic;wQO%k4Kks(gu~@y_XL$wZcfwWdb=b7{|F> z7-!Rn8HG;gpE$l!3I7wHTDeaa1I1zbxlctiDNQ{3FuNW03q$- z02ylveko{_@t~`(>s*-Cp}0B}f8x7pUJlsL>O6dJgEmfXzvJ%8s%Xj{@0l`3z1&nya|{RF=GDm2!APz3FVbiUZLlY(rmQ|i2G{I~A`sAiUk5)`H*m?# zn{P}3<(c7nfb4cf`{_tx$X8dsx~v?ds)&j*N_#;0<6vTM>|B#Yll|RVm5=13CfGPUd2yPlDR+Q3Mk0B` zbP^OaiGwWW;_%||=%64R7aId+DmDonZ(QS-32dB~Gm)AO&P6Hb(*J16!r6h_&Gpa zR1z3V-~nSFi!!`Y6>=u5115`3cHy4LIaF+A9b4RMnba{JqvRd!nk6^8oLU1I)yR)Z zV6q8gwYNL&8Mmp{tF{%!>N*u~TbI+eu$XQa1M`a%@_fuMH5mER05X1t#Yu7!JviJuF14D1h>_)X&j0@V%ETT7#pn_fQd@)g(=BLe6+_N0jtl)y- zDAjHxng_)a6Io5!skzduQOqDN4wPCmR6Zb?nLD#lV+r@p^|wyqDk)bH<=<>w!j*Bb z<7Ay=KhCsxHfg)2e3)aRy_OV6xfzTSQ?-%yoEY)ZTbL} z()@0Ta2+O#lGAE~R)8T-9Y!Iz#J)Zy*7Lh&QK_LM0AWudWnc~ zNx^jl{(5z>1mxMnD}#ILZl-&;lf+0gF2g3VC-PGd z>eJ@{a~?}rd#z3RQ-@w`somC$E3nscr~b^DZzui=``FE(pXS8xmy`Uno=rxxqHsyr zlhLtskt5!XYgUrW2@?pxZtl={LybjH&2dpS@k+Ea?kM${N~m*Ohnpbtev!uAC=Ih( z%{X=CwflT5fJ-(AjE)b)q3+)Syh1Z#!I-7bxM-VLA!^u}I!64l!IxB^I_rq%ibfiO z8@QJt9}$6Jz$d~-o2VsTTBQDt(==@PtTRbcp!k_Y_htT>B*z@L@Ian=CV5c0KaETN ziNtbl-iagwB6A>dAWR%cT+_J{yiZJk=IRMv#Bxb_AHx9mF!F&mJ95T#xw}qPIx~>Ru2Bo{ zQMdTuhp!@Ia_FkZbB1kN)g7|7=2T^zDzF+AaXzTx>R|=syS;-cx+b%%TV+$|P?f6jAr~l2O-2-iX69w)e)ASD%cozL--iqHnOEk((WsT% zY8_3S5!PQ&210qb!9*jgqe+7Sy_SnN&Yq{#__dk1>_)idQ;%<%kXlk8+uE(~Y`I%+ ztsi3_*+;ch0N(oInlgFjs>$h5a{_0A!yYi0`+(lG(|ETg=(^mAVlsOUx%;sb^s(rs zEYUgF!6eppr$aM6^1{*5eT3RLBX3~^uHx1`JwPj}p6mL7NG}e0BV5uH5 z5baEyC$8)D!pB@N+>P~^;faGeWGD$%G?JZQ^e+;kTgQ!PdRaKba`~VX!YZ=XgBRx2^|Yit@1h-tMeIfNyekjn(T7HZJDP;MfZPWEpZ7+bF+n6Fsbaz9(6W{J= z#>O!t4R|qQh=^dAWIWQo}KxxB@gPRBv zu2$q^5mK*_-=Pr=Xdk209VDbN5jsGd0aXJ&>c;(a@k+5UYi`fPH?#59E|mp^{S{Ff zq`!EM?S_3P++R*B)_zjST#^zgfrr>*^zv&irE+;zjG);S8S(;%L+d7Sjs!HR2ediL zbF2cY=vaoYAQmqudx04jdz8rY7h4A)j`|GxQ#Y$L%o&S`x)snBbPg3pIKS0 z^U21#wwZR;j8k~2FK#^=Mga;D5s(c5PJU$a7wnxU_o7BIdMJ$l9P0Jdofl2(D*X%8 z#?C6RAY$sENCX&Q#31tq*fXx!vUob4)X-4(u-qJmW8x>Mgw#ijfNRPEzvihG@fvki zludnKK~=ICAITwaqUedSq=kI_i{v!woE@P`aH5W;?>x4pvUb%6A`I5E=jI$IipnXk za?1N;obtw&^RZkTWnJ@@cXt0+p=!$b=503?j8#+4J1=R*+|as7o%6C6jU}O*lAR|v zO!}0>EYm@br<2L#5P$ z$FL6ePLB^yz60&k(-Wgpl7%kt!4%Dx1!3{A`-ADTy0T7#QKVue!%IXmP;>8m40aYN zuvNcCK~TFS^qOqRLpJua2@JHJRlU$7bPBS0b&DfD(Mm4z#oBi^ts&Lm+B!R& zAb8ApF|oCqGB3>gvl3fi7H%%}d()xLVnG6Q>ABFuKF!-cc6zgSkDcCvn}-FQzjw?4 zJ9F#U>8*qlc{{0kK6_m-#(<0P!-1a5k=dYU@x*~#f;TNEKI{05fw9rmr@;cIiHmNO z*HZjQLFd~E%>q1&8!6lp%m_P2Z9qvbQyiXbF~r5y_LlO%8EegCVM2aKzMOQpbRb8z zsBz_4lyTW6=dy8bv&Gn&ZM8g;3v=0~NSW5YwI{q=UfWhnu-g){G{Z2pSlQ`Y`3l^2u?@Prp=8sX3sSBLMqL8hMC*vZC}hrS4S?Fup68`d;Tl`Bq@ zYwy1Hl+~J>6xV1>^o1nS?oh}F9&|C{WpJ>1_zjhuT0U_gSww8sHrb{^+JEK<4Jriz6-=f+5I+q$$*}1mepG)obWoUz#Cqa%r;`*x;3pYS%%WsWj_ft0EOU*01Q;ZJWs`M;`vY-}QQ}vWfOc^%Xq#CF!6#|k==`fK;N5UNIc__eze~@yLtk;u>dgO)EccRWo_D) zz0Wv?>@tqP5hVQ>_7Qlr-#$LN+Id`m#jwz6w^h2uO-nKD^$_DAj01sdAyg}_xdPGd zwNO(b=N_Yh$)WYh5d&{EQFXWe+w3$Q6HrZqZNz#2`d4zX=P2=^<8iNtZ}P+=LAC9uZqP1n z)*c4e5ja0MI%u^IYA3DZgPJZ@lj5h`G` $)U77lQ}apVn_V||t|C8mVwVEAA~)kc1o)76 zRxUI_PON$ev7Yj&|NGPJ?z6N04;S0VfB)*~$==^jJKudry~fem&gqLM@2_4w(ickH~`22mRoTU&}%Drs=Grd1Y+TxkE}1i zVb3Nj+}_jz1e8LDvJkhCb|tqqfk|qa$#E%>xVC21MVW4wFFCDL{!P1=njXL$U|-#Y za_bpO@cS4gGt_ELECg|*)nP*x+I?EQ7(52Kk7x?y*ufHh>JSl2{ z^ZC%9J$Y6Xx-BZ9%Xu&t_}AYQMm;Gify>!H7x-7->=wm5DH{9B0KeFu0sO(3TkYJ9 zxmD6k87m}vJaw&cQhU=r7K6B3_h`8FT@c4FQpwS$-X&sY5#Q#zy{FP z);iI!kWrJ|Cx&7`$&*Q2A9RB}%Qa&op6>sqR`PobM$vRcR%HzYKo8;|W~eh@h!1Gs z%T6e37j=g{kY{E!#fBrj1fY};>J*7~Z1sP)Za zlGcb$kR4_s>8tCZ2|9qnuv9vZ^!nIsQMF-zavSzo zvRtRbYXOD6o7e6xGv_X~6T5rllM?&zlf|~-DNRh-g`eba!qr0j2`lGd;sn8b6~wC>x&gKIUuxBu|C&le4R+ zqvN^RONAnJQnP1!+0D#e3gW_v*|lTstsZ6*$KlzT$_?@#?QlEEiCa+MuY?!XX}1!x zTp??%`rPS9ImumVt7PsCPzY6OrIohPXfztnc6ZfxqtVEI?`}VPvh!?hdv|;H>GqRn zUp;-Y){x)N)<9#WSWNlETtK$gSh}ro;vUH7SGmw`{7!fMMsp*HcgZQKnE|1aFfiB? zTRV-NMs0g%OTYMHV^h@@!w79OH)vPNdgfWgXoQ%+h;KB1HT%JalgT-KDqr|WTh3uh zHkuo!%6qt_bCK#(hf!#4CK34$_vKPekSD;I&TwE}UL3b_tJZ45#8j1~^qGwaWpoXC z(9f|sv4zt>Skt+^C{oJ;a4u>qDX z0PAru)_7g>&F~|KqvlPPujz{q=FbnCIn2%^-=4+!bDatwcLObxGh{T5D*2`asN8)b z#J~+0(3tU+qwPTsXQ8Onn|qK$@aXl1{C>UhSo?T#6!dDA&DW@_%kD%$wQEbIEQSg!up2r z5-E2X1UW`bamhGMJ8hano@vYGN|pRJl7Wg-j-ZGc;@ZQ7#&VK)G*t6amZ1RMNWR(m zBxyCdO*r5*L|}mX1Cv`IjpHFG@Tq=p&LRT@ujKixCvIih>BIS~4%^E_P;)}1OYSL; z7^B(8j%wc)Hwp+yh;NntO0mzAfbH2NPz%uqoX-ZdAwb99Oj4#}=Gn-flK0x6)Ck2F zhi;n&!tWUBZ8SH&*mB|u^YO_hm8i*b08 z&yT_(e;+&^-bVAM{MP`0Deao-xsxSk zLCq3AwRSGa3pa_Q0xjmh`MGR=oKdz&f5^>$-e|%^pgv-yhsX&G(E=#hq_|oGrxSA! zzPceVmzG+i_RYlFQh=ljJ|>gTAt|9nk|6gUCW*Qqv~+NYexamP7bWxvTX}UW(Rat4 z(M4x(bgHYPUP1lXhoxeApR%FQ2zNqci#6NoRB{%eOnDgLY?hC}Ev+=5np>W^Y_7+4^-U|+xP z*1s&t3SUhO%aEeXI7>L7Q&h0YT%yjjt52n*glsgMl0E1RR0`Lk6sQV7^1BXBTAjlm z58j*|oVO3#or9CTgH3RLuz%RD%gyfaB>R?}M@s-d$S!sn6Y7+QJAv8*m zDL3ZjG1A2KE6N}fF+Xib-x?RYZ@p9UIWY#7Qw~niQN;`S3*Nd_Nd17p^k$-;ojX zBpGiL+Up(@ZxfOe;Gn(#gXUJifj}(8B#{x(R1q-)wGIx64y0<>C!8#X484yrL;mV` zS^qNAdTCKI-q>=;fcpcB)ArnsUqIcGbjuV4bZ%dy6DM*HV%ls*jy@HPc-pxvsV&cDKz9+A%d?u;t_Y&>w00OYYiK3SrqkNxmxMINvxrg8oGCt; z>78Nz$C=}4N0goDs;4FVWLDmakeAcW; z3?pTUKNxly_5pSF`iV0wCg8YBSxy;z=9+k&!EDqvet z<>b`5VAotf^#WJ3mV=jjElKv#>0axo4o(vB7WdREWdarGJP<9FLD|hoX-!V$a$L{k zD3u46@tDKL7ecq|q)M>Tm@-FM>1Ovxku`d`*D9x39?PV9SXjTDm!|dO4x|ZEmfbpX zGtt^zW3su~J4Bjv^o;`cW|i!!f0+Zm^nQ?&Rd?kqOhgnXU%ANvJjv6uLVNE7>9?`* zPHkifF55)I`{ru5%&on{*vMuz&RpN$m$_((EMv8j=4ocZ-E7Fyvp=tJ1|%Joy?~xG z6UGsmJsE5pw=xMPfUjWim$9D7OXYn_W;BzCmJ!vaIp6C~;_UbBo*4K+FOu1hP=&F0hwr*3WN+g4sZb zsQG&9_15EWf6@xzTC-%=eMf0OK-zm$yKgh&Hrmox?1hbB%$>iznO92&qp~N}zgv0% zvVKx}%ho#jL~)RSbcRzBwF9p#u{D&YQuuecG?ohx?_@*IZXy<>)iZ#_QL$pC5m@$iksfvSQ}KoUi~sK1&>qlw*h< zuI_sJqYi#ioGH3m5;ViPG}rDCHfvzI&}9wJ0w@sI3FeIAi`ZQV2G?-N0T*y+j2__d z0nE*Ree_eK_RY^DOZ-3!0esb{^)BzI+L_T<)1P2 z&6idEBp0Ojze5%f4|8M;dEz)5FvtrZfK+T=Rii{_WCRIqf~cLYj1QKNlAkK7SdYt4V1e{F2;e0cQwbzT0wy}9$@@wcPxMngVn zeEay@lAa_U4o${xOvy3zi#wC-9Uj}X;gax>`Usr1E;`?jItT5}=;FAwLb|hn%h70~ z<(Kpxc&;t*bw*8LFSxdR%#~L`5`*6x!1?O81I0`TG=i}r? z5p&o6RJzfxmZ|b-AGb8k`#^j?uWV!MCajY*nD@*1@ULBuV-;pK`1;RKFo2WZXKMO)b;n7+%nhsn#v@MiSq1v+wQbZ z_FG4%CkJok1bn-9bkXh{oZo357nxM;?_1~l2m7NG-;qIeWXI(K)2f8HqPcf*exxKV zwKf~0*nf#x@Tca#$VY#=UA8Ua{5_j~j@rC13+$d{Y(V6E!2~EkcQRZS*yh?W3>Ne2 zYqyS%YBsUI4NdaT;NlR3h{T%!3GY@AR#JQF<)eQW#XYTO&lAewXFvmOHIq4UT%sYb zXY$h)I6XK9UDpHb4Qx22)!*xsRhK1(m__OST$)F%H5p1}ZFH27vw8_H2QyJVZ5+#M}Kq$|dn35c#O2srO z63_&N5a%s6;}cL88_!{_Zptth3<~8@9m60PEqBB~;I)^*t*##hV>ji;fE(wc3wwAs8mpVQ0}yUdXNY9Q7FDgL4z4)&$atkY_?*>S*dJ zXbvS(P}WLhz;r!837|Jh_vgf3x4!XkDEaE6h)H;2>=3sSN_*I+JF}>Kakzg9cIplA zNdC3+*y+9T06<(o;zQl z!7HV!QykOlrm^@f<63g!1mSUsDUcpz^@rh^8~qgGqv(kC`-n~J@A;Bn5wTA(`H1#A zDhJg}=`hP*m6k+St_QSlQdrH9e+mmq*$auz{^><$^y2X7AphcF@-s~ww1gg^D>Pjh zKaWlo_j=`IzG!t?N27!D^V9RutJe9+=1hAp`Nemm&UtHZ9`RFY9taUF(z&wU z8zTX~VLDnpdI+6t2rk>n`Sd=p&UO@9OHJrEu4e3kOztf03(xTh(jV>+*f%#&D;o-L zd~0#}@WzD0jFpUyEH56|APIaJ$+JCQ-O!LA-z26t{Gp5xmlLZQ7kP|$V8cTbx!l;$ zPan!KNGM)>3^)Wou0|n=y^mvBo#d|%a`JQ(AT&>08I*jSbuCf&07lp={ z9zdcGEc(D>l)R%|qv^OqozOLJ3(8=BTF9Vrvvrl?5^%vN?3-XgxM!k}wqCVu`phLY z@{cgx9$~sO>PI^xF1AP9+a4ck6QukSGh~P{{@f*LQdP%kl2Cz<`Q_3ywT-&>&Cz*# zbjDDK<52x=U$oo%>i0z;7&Jf1Q2hfY1#ZhVMV8u2O#EDGmn2qu$@ufopOX44+u#y; zifridm1yx&Wbc&{FaPFt^^2E7{_@LIF3xwQa!iKBA`*uaOa6ff8!owJWsNavKNB&- z3uv6XlrFs@3B<*Lx`_)*c#CCbC+?Zq>1#hi$?GUhY@ei@SGRvAJ%V!fb#K`2P{weh z&Fq=*kaKsbnH1|EPQ)jGNfPi{IgzP|EH-A)jEy^&%1HvooQvk8?^FO?=v^YBuKHO_ zw5zGYPoC9BN%+W-c2XMg_rYj-sE1OU@Z1LGZqMYjdvGJ#I+f?k>q~yYa(C)Ur%%v@ zefclYL1JMdnSV|?I!jo*L6cfMPG6>bYCuxA+a0~-E-3mi`~ zoN+lK$rBXxC^OkAT5an}U@XXb*h?y?ktiv=E#f*166L&Ies__G+uA_oxLJH1yXO-l z;ZpexAj2iqou37l7GAc;`IWy^PjdCs;oc%^Z^{f+dm{16%O8(dAde;}D$CXO6tDHd zy_@>4%jr;$ws%aZ|8&Dhq7Io{=g3b3KAk=XnDbbI-D_>ipE?0lOPv_adJXnk?mj(p zo3^|3CptqXGyP{VyiYd_S?6D4IH}m5j0j^wX~I!;ksMBQ;ey=Y(+`;b+$tE10n<$kb9}$6J zP++BgJ{B@J8+KPm@a9l2ECYCjW<=jLlA;OaWdek&_0H5W8W$V}P%!-KdCP{TY0fK6Nbh&T2yXu1? z+~SVCq(gx334HcOC&?U>gGwtgWJB%=jfCX4P%laSph3PSlFA!_b^`liN)PcE!bkgN z{NcNou|$_zLj3T{bTqZc&6gH%GQ()SI+W>+A^I+^DDSN~ME&zPUMye5vxjt>pTMr< zDr-harZGh{wk>f``3s-1lD~8u#~x;?@#%h`fPjvJrXoG>1dfE#cOM&($Pgh`e8sCg zD}j{p8Z0@=YtdmjZdp9{qXh_Hn^Jp?eDzH z#SBlxX9gr^$@j5W4G#7(-S)>JcQ~)=JU^kvt3a7h*E+qezzaPPCx7!hjjLnjc2wC6 zAPGN4r(LxiJ)1kfJAxa4nB+D@7P&ywjaMz zVb?m(ud|yTWHZo+F~17#tpx7E{*Y?s1rP{$9CQV;3){Pz5NaeKBmn@G*Gl37eiF3g zMQ+4d2<)`K3IQ|%8P`Z_BW)7-9g3bfl_rJbhX+)V7%XqlguB5N&O& z%U^$zo?5-m?`RUgg0u-*nl*RU9AYh+eWJXL@Rk&_&zI3wlC%xxYky1Mj`J9@a+p1* zeaU?@&Pbg{vMREYZN@RGByciEqQ#p(5$0=5@q+L(Ru*8tKKA+1Loj(0(#uPlhuf&m zRy&|y2W!#697kqdgO!9}9{rHH9gA`NIA7{P*=o5Kfo^7x?9OO;dOrrc@=p7Ch-ldB z4KBonbWQXI=Q)+>(oqU@;9mFqKoT|ro4Md4I3x9`jAnsVLfg(0%zgc3g$?(Vly2Dcv{`Jy2N8~m*BCn*wV}2P-DkNU=th=0ZP-_vctl7_}^3Z~WZ<~a99sL7c(Z35tSQ)~@IJmLoiA@nAwF*FZPG zvE}$kVPa`9AR7j?XHq+-g1A@Z1ATuKQ-uJX2@E14OtV2d*W$_3BYFl0)CE8r0XC*> zDZ#A)tr#A?_(rZCfllGe+I(*g~6c6+KOgtm<)dGq4(d2}6l9eOzA4X+9hFhXcR=RYH0h%(qm4O}I5Pa6M``Z|wu2HHh`6U2D6SKjjV>8{ zr;nUDxgR(hv`-%$x_EBk(asOO@KV(TH$;TPtL^Lsk|%Clc*rG4|JeNRoGo?x1{Wd~VD)@I$|izm!TWQDgy7I>FbG zqg~9tutgWJ^;^7p=Zdw~-!II3=MMr@_r{DoYb`$T&~PT>eu{873OmvgmK|%N8;y>| zxL3|iF9IfwkHP_Im}GfI)Qfve_IZPN0pG_Q^X>Oh>^yQ$=wcEDeKO1YDwb|hw!9i) z10>Z!sFc0>^`nc?gbXp+yTv?fnySh1v;6@8%UZ|6Vab_qiE_Zk7IMK5+l5H*f%$;o zUbn@=)4t-a=`~P?5C$Nn)ch_Rt}1T zQP~A08QK;UMDajQzr1cZ^nHbYQ`1g^81k4^BK>B?@%qYU%x$##?KO_ZH_$7z8O|pw z!RsA~k%qMTdp)Nxfq%Iu0tiQqw%^Q zkoOj88$+3M7dY#9PRZ-f!#~;aJ=M`uByMIhU1_vCY+iwC;N~Xpr3zZaDok6B&>hY? z@y^EoS(^VY>vnbfMAwoCq5$N28mXYymYYo;ZTzocK=v@M9p?b6vYA$@Dv55&Pl0c< zxiU=P5jRL;L8gC~;ur4*MGH8{$wC7sh>=LA!?RU}78<|ij0Rr#@{i=4OzN4Dem>dJ zo_so?ksYDEOnNb8hwmc%GD+qrBAT4;>Ku$%$aP*$PcLGsu>*pEL$HXBExFco&FD}W zM~>8FzUv*uT>EcWoP0h!!vbMUOOecde~9cjJ3k~4@3mol`FB(y1Ot3U6crNaf9}38 zz?1qvhLAvB=q~0lf=)uYOeNUy*!xPKLeh5Vp}Xk`SovfKnGR?<^d~yAI_HP&ef<7x zDQeN?;MKWgA^<{m1{moWgGw7tp2r#{nv*zjN*?ZW-`%}DTok27ie+dpgK~Y7 z>}lI01x${LC6l&91c!*C4PXD&BLUE;pM@vma?v;N3(!k;DjTDDA*7&==28l<$Y<1@ zE#ZCmP9!D+G>_cI7sY-!J-#ydd>+NKFM6$ee7c|B|EGZF@%7&E{D6ns?W4`+%lkce zvGQb#$D-T&{B!%dAy%RHF)_NstJ5V$Hy!KuW^Ai<=#`M2g{^b((in<;alLVs_gjN{ ze@ZPBi*?EQUM%DJa&LN2Ds1_9kc(btxH?#=y@>VozRy?R8|~HX zI*}~{K+x(3_}IO@%z0MW?k8Q)Xk)7vn_MhBCQ+bKcSb5sU!fhgF^xENUP!+aGa|EuB0%3t7wkx^quY=_9z5gReJEQdv;yC#~;( zczu5uC`k;2NU4KaohT~*&SCtFOyUY)I&U=)Xa^6ZXs85KJKeu+5k2vO^}SEG2R9k& za@^1l-WdL`BPG=gZObd!xxQ|EbGa|L+h>H#Cp0M}{7=BUl$t+4zZT+cE#LASa1*$( zyxssP*L*v%SZZgNPCx|>b{DmTN$parVI3Eyh`!K<(q6}{m4ZBzqHSHoV|^dh(S^Up zBoi>oxa`i`a=oBiZwYaDs72_I(w>&B<<_<9)GSN#WtmvzNPLXMEL^|ztsMpf`bpfK zQI!?Rd*DRte1>?13|qM4yFzB~IT}1cBK8i5Dd+1BDzg72DH54jlq@N4PI;qEWAR2N z(&%rT2Qp;ytrJyveo6wAI#;y=tC&5)BpzysT?$tyl5QMO-5sH45=QE`*GUtF@)Qo^ zA4AjKCS`<`Imiw{E2mYi{QW3`m@xHOo$UlFN&vx!BN*)KOiK2|Gcq{Fa!gxV zrzxt0*%jq&{5-8!4d`k2Iw)wAX^z6&owJao$FZ-}6riKs<%cofqF0%A+kGp!YY*Fg za0=>Xb4chnZTQf~DCuuL*D3jpF+7iVmZz^(Vz;Ba{aaCcv1J~@fMQrO zzlBxqj6F6IA4M?_`X zv~zKId)t@ooGl4M272E7v~vjR{es`S_Z<44=ufVf`YR93;)0(N(PTRkSLglkAzHCITv#!L^2NVZa>gwMGlu*KI9&@2_ zOU7HF(7bAh@D4pZpfQ z-?@+8zWr~QQgQB+*MV1d4L(1<^u_-_CzW4-!G5DUqYYyQ`lHGZ|8pPw8)Iia`oJ_f z3lOyz;6~h?fDCs=h2c?ECNgvt3zLtN28&}3>h4qpn-jXFf_rPOOxn zzNFgekfk;H-#cc_5||`o38-w;zjs@IzOU~}T5IRjubNa^!_}a4J=)Y2k$d5}T*&@# zXi)p7T&TQ4HX2?ok%N|(7(=Ss)* zO^OxDlF5?g`zcjPl!-FGF$ay>e+fkj70P1CV&!^r70F~dQ;^@};oT!s)adNxoDbC> z%0pv^KFc=(Qq#DHXi{>Dx*~pnBzgWQZv=tqT8f90nSVPBiyLM(UiC-6_9}ItBTb1X zl0S&4T}z9N)~MtuOEn6uDa=lzTd7T*Zt$e|*T%n1*U;8B6UkdV+bQXA z&AN|u&(P5q_o*Zh+BMsVA>nZl&0o$P3*<`;mqj{lN31uK{kUdb;N-1kHjb=QA~MVe z92XUVRX;A%(~KlG{|G!Q!5tj+Cf!(*z2O(C&nvyc;GOp#@Dcq8yANM{b#F5gSUM?HG`0Z&ir;fr4W2;(n!w+C z=se9vf7);;WA{na4@7Lpa8P`aQ1ojB3-3D4{#~}9E;>P0h5?O-T3&sYlVYVN?`4~e z#j}|Q{2!y}-}Ctr`nzLUpYZ1)!cnnoWPN^MyhPsDo&^re!0tbBM3TkzZNh{5Xh@Ye zeGbc(#WfZ4l%Sz!AgaUvWGYchxvCoei7V48HU3&6Zm`gs2k@*= zP`{zzzbi$}N)ZWvy1oq0ix?`Ux2^J}GTWyQPtU9!RE@)@ew5!28WX6z?U~H09EC2# zmR8%S__R^-Z7Ld7SrMz^E+>aR8I6q(dNhRpzWgp#t)b4pgtE+|vzil2`*^+=pgm?m zqaPAG3IKv91so@^v_Ktz4}R7;SOjpuV95#B@DS{wAu*V)rO>es=-sRAj2`@D%Qv+I z4eaLM>DL1t_?@KVP<>&ndR)IhxPCpgizg1B73gy%iBfR8BxfIh$-1s61gU0bocBnu zPb7f9MxXpXT$liYU7`K83m~BlX}R}}ylWVOmazTwC;lLWM(-duoGc^|!Xavk7ydgf zKM~gxFf4)*2DGqEZ?F2`E|jS(uU*^-CC|WyPFIQl#y#OE@OB<@SN{S zi}&}24`@~<+9;5Zz9hVXj(39)W!(7GSzMknz5!X$ExAx<`^~d>G z>YLWnhP48I+=jnQKC`ZHt5D%q(Qb(-{X49*M6PnD{GVc1+D%KE=5T~VhIt5z$p zhYNQTc`m%KcqaXy&`FmtH8S>7Qzog9reP`?2WX`0bvXUT@AkiON`+*p=9v>!w$0!6 z`7>3{Ey>ake5a0NNRwjMn#bwnZ4Qz0c`jd0qPBT1ve=t+NYWR(Hp+#G=j}avV~6w) z%jw|$j`x$nzfTmeXW;f-B=YE>^7uVZCVl}B3_55Ebq%bT(V_=y*ER1p%$Nr|T)!OD z=Bur%t4D!<^S@mU;DzFeY9GwD_8q)LYB!_V9-f7qyzY0aVzmfMP(u zm5sxMyHWXuVXQpTSBHziP-hK`uivuGkQy|K{U0h@fb_E3Ob3>BcKv|95V7-yRj{&R zy2A?4bI*#9zqjXn1Nfp^$=uz7QTllPhzQiAxNgtFU*SU8`B+wqih5zM=eE)7xI*&y z0Ew&~_6RWjALw9hq4Dr~C=^8(7qxLAHRI50A;f-xwD)=3cn+9^w?dmDQTYCCq|KoU zyN&=D^Nhsz&3|DXZ_BuptycNWCmPZomoSd(y}#+ab0nnRDzUNtdz z{_Jd9GrNpF|6J9!wV4rd095X@U=-d+iiN# z{g$(gknIv({$y!#VTzvK`Ft^K`(d+mqWLRiX;j?_w(@ViIABh#-fXBN3)mV^%R9`!2TJzuzN2|xq0JA?fz8Y7-|Khl0y-bPS8|I8mS!|s zk;?%rW#70LjXU4D50*wAHdlDx-aZtqKi{q2KZYNqtwp+ZMkRDh2$~s#9UEphz=zA*E%RQj%*EBE@4>APxs!zTw1f}Fd9DX?2z zO)r8#Z+xWsxl>(iOeK)_`>As!@9QzKt)FbXrsr7r^L$?}>&dR4jkT?Bi&6%kpBJYO z4d)+Mv|KtrY`}|)pEEK;iCGZ2i)fF76ER={!tKrV0sY=-@Ns~Wm@`$hckd=+s1@Zk zOj4e4!J~S}K-+e7u+!LXfCx-qJfRTWz@JAYst8GzxD>k8k@t630qns4pu5SiBl)pm zeFhLQznc&gLc%`tpns14@r;4-9Q*CqQt($+dOz(` z-+lk;{_I2B!PGPA3q;k{#`-ZR{L(w%`XIFG0HT(~@>DCA{JtA}%T5S_x6q>iVhh6< z?@Xbwq5#k-UahZA>%_d9dam^hq-=f($meR&L@vRrxs1hizpUjBu|b-#ShRm)(hSxU zzntI|2$WZ-rMTE5A(^>$m!?#h{fmq8D<$Nvum2zCR#W22ecuNJX&xCl=}BSgEs9b1 zzSdcS$gdt9eX?IX7L@+2!X-R}MKpN8yDJNvBg^fNp0F^isM|hlx&AMKSAX8r!7i#- zt;g|~$hpT5jgIL%H^{q%;rj~bkqYC|sUFo!;4N)aLLlf5ogD)~O;`|3)MhOX=8Sh4*!KNvLGzfZFl z+O)%YV`W|HY`Je{k!inn$NJqT|MH*}BrZ}0{i0>ArdsN0Fn&rpyBqKH9f|tX!tkeO z(61^==3ws+Tg3(ukbDc@7DSm*fF*ORtZc0M$=Bz3`dh&uzzlX_<6JdjL$LUyfFS;$ zgMEjZ80y5^b(Zf6^=l8g}LT5!cW^K>4mZeI6*y+{0&-TELn`bBHAfY z1*Q845G}UAcuvQzrV90i!#5wz;Qw{!!NCpRv|qr$4FN#)#f4$)@y|*Lzmop8XCFMf z0}VO@1*Z`crye*@|Ao-_(H{dj&AA;o)3Y9oratU1_&z<%{(`e5iPIS2>HaH^;I5lp z`|y}n@nB%_$d$x4QHZFqPERAo{>S4qBU1}`4=bC>{rtJ?_H^A~Z6W9N{ZQI1Gu@In zR=;O5ujF9rtz4I_T&xv!Val%gHV6wMUPkFhD8gx;a_xo2f(IfNk8dz4T{x~{k`dN3 zwB>&Blp9vG>v%Qvsyrwuo(k7qXK+3`R56u@Qd=2Gu~rd>jO*< zorvPI3DcC*TX@)?%&|a^7@RtA&FqR{e%)PzEeG&Nx&@&^mfV5yapeP0Z)@pD zmMzj=KbEfs-AK+x#)Sjzm?yZ>5GWF|A?r)Up>E%yHi5Z{xv!8O!Ez5{y&ke8X)Q%& z6~=V7@o;^>$43ycwW}Sq;2%14*a2RBe+LM1n@m`5&?+ujE&m-WVb!VONd;zW`fgO%o!&8O_UJlcDi9oLJ?3nQhJMv-a+KLx`Mopa2?&VPNGf`AlIfJ@SocYja?J1T45`Sjg7E{=D7+3(M*R{ z<3&mWUQV$OGwI91yK1?~3Y#3RWRqCFfO9WQleM8bZT*nu8n`Ib8!v~G#q@{F4@-8k zZ1mDb*_jRoe?(^8TOe%gxrQD4qcf>;Eg2X<>UJ6i4`#21lxyfMXk)| z4uXECLkYhvBvtXn5uUkYu%QTpKxqXxwiiZiMat!!wFR()YI^B7LtaQIdStarO3KPT>op~3Ql89`+73%hj@IN1FEb`yu1Kr@9V}EQ zAzyP-mK0Y3O6csA`Yc0^f|9QwDX{P_gAyiE9*@Hn17Zwak2*Dsu0u=*7j*;DA4PXf zRE#k5Uw-_a{!6Ua)Ryl7ZxeY}BBi8R#bdpBV9dLa^O?CPJ18r2fV!ued3*)Lfby zisFs{R>Z&1G~#lHKl@E11J&W-pB{~RoI(V6s(e@UEpo%I>3{7+Z*hE^NzJGI&KK${ z$V~v%Merv8Kc|Nnq3@mt(zm?72>-(Q1_oqU#SMnX20Q^WgQYRqUg$lxb_$EO)c+7~^s8X({PQo8fzkB<~ zXB7{YABUIFn;9Xxch}Fs?-$*#I$xiYUhn#kt#2#VoR7VwjT_g|PF<6q@0jnw5QZqP z`#tVVsg%}*on~Gv&;9!!Mwi~qR~%DdWcx7VqYYxQZ|y1ojczdw=>$vB1XryD5IsdwN&J!A(G7w6{QH@18-CrV}cjU{kaVC6w;62Z4Q9mkR3UUBIZ7}vz z`{H}pxmR6%Q#aZY^5zKd@n=tC8d1PIJD*MM9oTcXcNj>Ue}=EoI)RWR7KX9&dRu^T@pwT=Z+ zv9B>=4)8Nv-f`SZ@;|Wl!L5V~n8Ux~5gViKP6h~(2pG0ua=azOq-RwN< zeG+_;P>4TkdG30PRjzxvUq7V^!HJ0eV7A5Ha#JfY-v_)I3o7m3jowDRV+Tg|KP|BV zNM_w0#cH){4-=8`9>;Eq-^ZQ@V|ByFj*bGtg^&7X)2)8c|KPiRdCet@pm)sv;*O!T zpZXK%NIuC~Z~FVMrM?za=*fC#!&*kb0(7DqENU83q==nj(T{lT+Hd?#h-tzc-i6pV5&d-$%KC} zq>$Zn|5P*8hB_kRx!YX~K;|Z+IJs_LoEFa*CX7)!MTj$HNgaT)#ZP}gpmQ@-sR!cL zEBY)5GGwCsjy21gdt_stW`}v-Wy}Iz-}~`xC1a7`!VYM;^{xMS+Y^;$GHyDr-$(cp zJ-aS0{z7Iv94{IwfQ>!^4KLOaCMWqMLG;&^v|G4!?u+`?WOwdao8>Tp1zY2e(${+-qmrvae)FlPerYqo|M_0Wc<*yZ&_Ys}#-n;DKh?EEsPV$j?o zXTna^R29*%{jvehn173tgXg7`cXUfUR7UcJs{gYJq|GsY>cRdqkt5N<`<2D1nTf%| zc8&h?H_9a@oR?~yF~jkvV9mDBMl_CFbv}jL`~tY$HaeDDSk=D$DN@ zw^=jSNR9EVIsxj+Q2F2&Y0+RTsUTiT9)_}ck>3vLsT23drG_~S08yahG~aUCF@OtR zVqOo4-&~50fY4+cs6?8aXVAw$$Tdw-k9ZriI5O>VR;GPwinYVt(SaL#>k&a_cIx(X zYi(?8I1|stgVG+|3R_K0Ik2E*CvRsqP0p_mW7K>WUP4+tU>KM6dIqYCMBeR{;DHnM;O zLh-89-e?VSSp_+?D}d?4Zb+U&8~+OvQogzPD0|W)tQU4EF^5{RRCO#6#TtmfHr*=1 zfRS?dXq zI&Z|ttP0K-2BaaFO-Wchx)gB$M6`s5oOsZu9+1CRUls^tG=5}x*ekS>0?GdafpuiTV2n5M!$^t7yysbZ!H3F)ctTlEs0EbQ9sK&>0Vqj=k1_!x%ZqBg zzDG&)+W4q>X*8ssO)$zS{BZ7bWIW@j*eTCm?j)IA4hW2@;~43WCrU))vZXcyLw6aV z3+V&qwr?mMZ)R5z2DW%pl9hou2-{;)`nhpME=88x{L;34@Sc){_KyK!pu7wuIHa-} zxNxM}P`LCDKJ>8j)~}X-Mv3p(T?izU62f$aJmm1-<-cH7P<{q}A2$SR=_Zi65qVHj z{^X~yLC0K!Bdg1sTx}}bZ{r4Ou9Y%hzGY!W7#tWvNGyh(WdSlhlQ-pf2On4&>Y%jwwO5iVA5)Nk#13MiDRR9 zvDN$5)v`5YyqIE(DGqJRU_61{b-CsEb=;KD%d9QKpLgQ5V2}mETQCx>gA^G6(fxk? ziXGndPM9hfckjtb;P`z$3v$fKykp^CxT&Qmtu#V6$@`qQjNP#6SZln&Hy3gzn+ZynB$VgAFU|d8)~wb;VFzy-8JLauIN z)hqw>B}tc~0jdPx#)v&Z{*uEhMVCS148^GQdl7C_d7O4aPedIkpis1)yKP%iFe&gQ z5hO{Srd%H27RkGr2sp>uJ|qA8G1BfOTA9O&Mu{1DzxqU%X1H5o#NyLe>8*j4SjLfp zozkRGXEF3wvFCBG=B4Aei`Ud^q5nZXs?MHYR|+b$?lx;nPW5kns>^L}Ss~C=f}~RQ z=1jA5-neuJjH-%^_$1_wT}rhhO!Lbi6~U5WC$*p<0%cVf8}|}TRavg0tbZQGCOx)% zoB6E+G}$3xgN$?ZQx7c(_C0VuB|J5kh7g`d3F<4UAaG0j8-MPf=?vDSYIu6}Z96SO ziTfZmBu61pa+4%it@_^hUH0|{$CU1+H-&0ss}Pf!Ke{cFuvyoxl_^4U76Bz#BX*Cq zLH|o8JV>yE9vO7yuBBHfA}YcCmhV^Pj6TdXOlnRL~^q)R{2N9_#Ji z#=nEjb5;WZ$rcgkcxw=!@+eT|cP>Vkyw3~ADFEF!Dlq-9 zjO@u+{YN{>Hq{MSJ%KX*qT`(X!LEAtz*|Y&=dzuW&#p zWa!p)&3)vRmNdpD=mIRpg-S{1COl4v(2=jlcT^LKqFO>Rd9;6ts%G6YvFbSRvUOr> zWVg8oyi%@v!TSGjV6526`j3SGQ?Zo%WRmRhef&)LzMl~7!r$RKzeFXey`?}9`oDYqgTZppE7b2Z z6*2;c*^5{44iLm}C7Nu~bUgxFiR?mh5%Z&#kC!Po~&aL!d%@rjC2j(6h4yyr(4 zt_k{);GvRE5jEJBPt~C&I_I8@mnJ2~Fq1F`NS2x;8PJDe#nAcS!_I~i6Ubj1up4 zd=VmlAW_b!4CXtCby59VKwl;8R4H23V2ix%c_1UlB$r8ZZ|VB+iw5}Gwv;;V+#pxX z;9*iumqZz=C=?CG@a6uH-a!x`iS|E=(R^x7X4Kx=r6QHnQEF3%Dl2i0ZK1gEUV@lq zbO9KsF+x{aauzD6%(L@ztG1wog0x(eH2ZY7ETSM;9ObYY)q$$DU z4>h|aILZu1^Sbj!BE#0H&~Oo%sMu^?^F;;IeA&_Kt1^sg$#Mb|UVuXIC}lnyw-91E=TA4Y~kkR|Loa$it)4Y?MNggU0;MDWq)`u zgjOoa<&nUZuv=c2%CA)_7i4NGDFd+^FIh+*c7F?ImzZ}3Gj+xe5$?oj)JhRuy;`B; zBd&IM>9m8|#yR)$lKfZnV3V^_dfV{|(ir4)s(wV|m1fPL(NpNFp^Xc(evtIh`7{}{ zOGR;n``CJm(KN~}6nf17JBd{SWg%ozG~ECM*V?k2=UqrS=l-4ggT=8&5DIhYZcHi% z6~SElp{l@lqrg;zzEYW|GH9;nG9BQFy&#Td*<=XcGb}oc-yn<(!FST1jr<*gEyW<= z(~i2rTn2d{tqI*{^BP?P^vxA}wA6`{C!{FF=`sc1v%OEUoHjjgt8XmH35Sp3eJYfvf1A;AdDp~d%3K+fM~Y!-)^B$vF>``)C| z$xr1?MZD;lnz2R;x}@VlX!GNTIi-Pl94`btPH&#yB zAa7(oEkJTUUn$f*u%Dj?Dgi`x_;h&{zO8kOy?-GxdOPeEcKV~}8JRNByjuHj07p9x zL!0l82oQBCS#xepoNTxc5-ktPXQrc5;Wc=hNZ`k1dlNgc&f{rjh7^&j&7HHI_;$U9 z*^$-!<3)7rDvCAyawnMbd}wzLsdS_9B2VOF4CHc6%E)fK1^TiQ;N5UTi%f~}b3G2{ zTWgzEZz!$BOgoY5)NZ~`qo3gy48f>j%cw%zzU*vV3AxFrM{u=LyOdIC)FqFxIf$r7 z0mFU0i3V(_*Q0cP|0VCakuSW8E#SY;E*+${)|WBuVnS^TSt6{Zyu9ZD@w&;q3xLL< zte;fp$>F+PV#fNQpWTSCi_XL@tJ=j6b?NDBNB2IY@}+fdd%re&#jP_z4G-_;U5WT< z1Y_UZF~$f|v!WcbzvH$|Cc-nspl`zMqXyUx^%gL|o-yM~ZVk5sB5wBkp1m4n$#C&m zyWT(E310doWMkuNsXX*aonE0;q0MGv7*m8TYOy{FVox?df57fpIf|XJ_CocgOZ|y- ziwt~3mC*r(l!`SQYT%IQo5ztuzU;i|KFU~%B^>#C(gU8$-7gUeZJPEG737FWMRKHc z#v3zeFPEd5YP#7c708u^6arSNORzP2s@vbu?Ap4JuO0ljhfS@h7oR$NYRdVi=#i5C z?1-$MT>X=Rh`T-tpp!C2fqX@bbY4EEL6HA(j5rLUBNwr_xlpM@hzn^yus7c#oH)6wIoTTvd>QILZp&)|T6TOd_Oyc8)jB`~bK zLCjyHQ4CQDda$TLEYSY`t1~Jp1q59z4}Bi2G#{puVfmP$qA!EZoy=MK25GfJjTq7in_ zIaRlkqE1vd_*unFCwVbh+)6Cn`;3lcysa){UdfGj*^R7&Svk0iJfxxG6wt`a@)G#4 zuV50#9;^k>(I|$_JrB>UWT6kqUyX8LOewLwqN)- z54#J8f~FRBwc4Mm3$ldK=1m@(*tglXGW4A_49ezPG8?=Kj9-4%)?E|L3Ars4;~Evk z4-}kX(r%3nhH2A93LPVhN@H0iIU*Oo@QAoojj(Q?mw_sy(`aBu@ZXv9%YwTcd>EWH2}$*PDKr9sk$Ve%D%OX8#h+?+~D zlSQFIWlv4CMD@H8@N%4lTIq_4C_6PRZM7GfrtSy?uu+tHo&^*tez``Thy4*V5gqgV7yi5tW9z4 ze*)x7cti9UAK$M~4ZMDem5WsTvycR0^L)3q;eFjZ*||S&T~Iu13mbQbJ_y}@NH%^t zGRVzC%w(2lURt9TRC9aRWONd{rcJzlWNML~E{Nsr%~+_&s!6Gk-KCZV=E2A-Bn4Iz zTG(e4{=plfDBk=TE&$7((c}hoUy-Q8RET@Zvq*;$;-og50ArD3K#^2rv@b;VN}6)v6x zFK>NO7eT|J(pSQ0F86OFH3u%$1uqmjJMo`%y~91=vLY!581~=CB8*@({ zDlUUy(IT)h`j^3=%9Ei?2+IbqGshH2%4e03IVygc6nRqS8 z4KnOS4lO96p3@hbAkJE%_&85ZlsIqLrpRjH~FjEpBtJz{Xys9D*7 zqA>@cPPA_AXzF-Y40Wp+YODfwhNjIlMwYT^Mp0W?kq@oAd!3j%;mw+)$c{TIUOXdh zrWPf};GAg)uPx4`=W#iufeuJBH#7kKn2z~Atsb`{&ij%!P8adQBXoZB`~6o6T# z8%1wwut(fAjXyy>5Cy=WjgNJk36f`X&MqCy}v4526+9m zEKMQAUxdKqhGpFw;A>NeV zQ)*>@=hhznVIaHwl1%_;W!xEqo8jUTvNZ{iv}l;W6VYQS>4FhZeF!UKKHudZrljn9 zN>34F<`V;5gzzklfP<-Wg8}=rMMgM?xGwUU5=|8I}Ejn z*UZpf1wQA;Q8Uw~FU)&ZLa8^2H3DRqvT;M3VkKAw6?7xIhtw4rq@{8u)-}!#7OeA$ ztzEf$ycE#eUd7c$p@UM%-l)-N5Zr=@GKak7y^bNNlSwm57${)o?NORAN#^T2Gz3v0 zuEjjo?FGEjx=eOaV{tkv8lrkeZjUr!^+CEag>)3@4^}D67UvQxuCp!`dmG4eYrY05m?h> z4_`UyWimwwwlJS<8qp188tJj!nf6WdgRq2k1doX&?e~NP6_M_c-B2fwG@Rt5(a!+nDub&d!zGI}%ba=l(*N?Z^Eh$JvK zY+DrF#COc4GBX2~lBc3$Gdd!RvEs1sR^QC2b8oCssfpPcALS zs4BeW7>$CooAZ4BUOsp(z8>FeV7U-=U+2bdAHRy88WDTcL-JwtH$? z2^4`0T$E9rYXqTHDBa?<3oSzVfw1|^=En&gItRByrMNKiV>z?)k_qHZfe))eLk+Fa zvsJGZyO#@@`zg`|)!HIy3kEXFZqR0>7=7@@EJsRjlMEE}X$l~Xme@Xye@$wj2Y5s( zh6I4M_J>((MN)5=nn&07`-o3A#`ly&G|4#T+tdVxl`yLC7;WYw!`%k&W!+on%1X)6 zEbxSwYAPXDkI@}$F3T|n+H;WL=X`?agV>~vOT-z|{bJFkJ_6h!p?e_5r{h5ue-t8204419r-0;408gf( zjXaUbDTUaHU`(VlM0!MxWxW%GPjg7~cb@$0d&vyRpUF47DUuRiAWvjP1SJ^&rnOhn zTjJHJfz3_EL=;{|EWw<4UmPm8GlEhlAUB*P2%o3Z=D1K4f^XFUC^+y@6(G`a&v{95y zTGuMYZB>E$k~9=^4rCopK$X)j?P}TA4Y-O-LlpqD)#tiuJ+q52g1Z`jUfqu>z=%-W z`CJLw*3U1K2O+2HNB<9D_Y@p?_cr`Kp4c`zwr$(Ct%+^hwmr!t6Wf~Dwr%g+f7J85 zZ`I!WsH?iG54(Q7*7|&}B@*!SZs?PXLZ~B&v3q(k^p2xKa2(W*jKADCI|cy7I^+>3 zQ&2L)o=!LaI6%QCpoNtb#}H1O!7V}cawlKrE+h1D#uHu}gp%cx(yayO^677+{n5Lj zlWIi9H=iSo!-9hEuZ41A;UsD=+1MDs84nLaVUQPwiy6}!rA)ICLA{alZ1M=y&0}cn z=x+B3aMljc_oq}~;Ll)CC9}3{bK6VuV{E_G*QK3gqx>3=>!uUWIk{cT;k#O3EfnA; z@LRn!c|##Le06hLwuy~Wrq(_~FuU_&dIUY3;ZCH1#+#52p-UpnOl7P5c&^OdrJJ;i8^7OoDF2fn$l`bKmf$#cx~$-o@mf;3~k{v zUrsPXp36;MPvNaDz; zz@nJ~u6CV{bp=`x&*}7DHZTGmgaSSk)H%_dm<={C#3Yma-Rtg_G-M~$4y{1o@_c#8 zvRZ7kw{$h7(5N}Qm`x9)LEv%-gFBoP*Cdg772m%leW`1JJ@cTD25G?S?Ci+K^MxHl zNB7rjJghte3`$F}ti^znoEP$Gz!7$E|AscgN}ReYjg`f8Rx%dAsc9ij{$j}@#i|M6 zT!CvXV^EYpjsHwqK2Vu9Vf~9S8;pIYp>zBsPd_IXF^2ev3v>Ke5@PD+#RUM{1V_Z5 zL^D=Y88A@XG`u~!SlVO3$q-LVr;Xc_c{9eNGr50+ve8a%xZD|Y>;tHraK32i7XwvG zqyUXwbc4pTF@50OD^>EhkTJ{9c9}j2ZiV-hj&?W`JwU`p(cZ7sg?4tp*4~Q5uJ(en zWw5%b0gC(WIT9x(hOO0i-9HFhK!aN8p=$GyRaG^P#Dxts4E~BR(x?!ls;Fe?rS|+{ z+u;Gd8)rQG`(u>rr~{zYL>dQbA*Uy(=QP7UY~6W*+h?GSjHMyn{$#SgkdGa!Az8X& zq3f)LY@S7B$Ny7HnMMgh;$CvF@hlcsVXu=fbA-8|kaNIoK?34Yzn zINcrDzFwVfk5^Or*#sYNyQgP$70q6rt$sJB+aDWMY3D}>TQptVuRD(f4SS@({2c^_ zwrxhDZC2HncFms4hj@?fVR>Vu$Tn9A>12JI$)1iF1M)i(yGhcOxNISg7uVOEwMB#Cm|;dp4_xGB+=I0eyG$k zJ4et_D58QXi!Ozlf@Cl@7}4B{;2nsJD@!!L%aZaMAC%_K%~^X36+cLb0NyXLx(+$P*JG69AouEu$(#M_#zlV@Bm>=cn74|NKqKpUOI z8eZ9*Lzs*j(%J+yua|Z}N&<(h*Yo%|$*M!DlG`|)eh}mg5lNV@v>eU6{9Q6k?HpU` zFWaP*1f>0DhCgu^*WpETR{LulH>E@Qp?fCTm=kUWHX3VcP8<%Z8ac~rw8cOkevMnC{{5pUg7QhwOHim+ zC$5A5M@|7qLQU|Z=2RI&LJe4KoV#~{Gcetp`7tcT!}L8%Wmq` zP!3MSEFnqn!uQ?@J!MZNq*^PAmbv&+i@XEt`cotkst-DTCNxxgIMLEj!R<3Jot%J;|jCH!y0s z(G8+DaQn7-qs|G84p?gxss&q$IasF$f4F%8--g+@CWMh~caCb<9mG$~dLQn!;jp#g zGhZx_M_q$iIN(ilTm5c{DN&>?lB(r)?4mEHiZz!wu%8C)UBO9Elkv5s+)jk|)nf|iNeTFf}}=1T}XUqx#$ zCfk+z6q**O>KMiesGB*bAjI9Pv)~&Hw)NwFLOg`k3a*|aMlocbB3*z*jk`pA6PiN# ziGaluRQ{Q_wh*(K5lu}`D8$2uj<-AxGjp z8`0i>;KA7Tk{i~@es)*htODpsd|a{>mRC<>APQs#)ZSAHX132!;o|6L08u=S$*_*& z5|y2mJ*Gh#lKV^o@0-DNI1gw8wIKd*ka|OqS*V@a{f+2dQVQ5n`XM$~aA3b?HO`QF zVSl*@Ef?uE(cZ0ToZLu9`=SN7Wb={N6bP95*P&J5KU7#yQwT1+v}IV+0cyBhE@ahR zzd|9ZA3CBI3KL+;te6+=N}RuMf^|{Lf_7jftJ%QDs=!}_&akD4k0Yf>30qGt-^a8R z?n`8xO$wJTxnZYZ$T*N#9g((1)bSlcG6p1OpT`DBvKKFtN1*FJZj0hyT|~i@h8pry z=&=4+SW*(5dpKAsHl}zY`#6n{Q>LjQe3w*uZ>)`EPc-~H6gWba8{(psU`a2a5n#?v zWD{HA95{l~vepqwqVPb+JyYSGiXc^Y`;)NN z{3`!Y(iODIHvxf)V4pM|n@A1n+ELGVI6TWES{KxIpO)>1XJAF<9DL@bOkrm&Gw>Tro|NSps-n5u!u;M zc;5GwV+;33+>MAtP>b&7DunS!@A%U;5Ku5(Km9SOke}A1C6_I(2LORh+%FBFtwcu_ zPxgIGmz>k9E-&1)(L!Wa!QDh-Z%8*yi^u7|W#KSEuq*gd*#g~MX@r!^ssPjfdnx2J<0qWACD z=I5=Tji9No2DcWsXQQj_gClzQ&xZEquid-O?);61BBjrydQ@`16`yMj(OqA1KfX6u zxFVJUUkG1lZS_C&K~&NJ`Ak(|lo_Z@fC%b}h?KS{`3bKar03(Q5sN4MRN+tdFdT)_ zx^x`kAqR)YjxaIIxIYIqzioT>H+Z=6lEB_qu0}Ngo%wr&09Rfj1aSo;ww-sJKNJZI z(TPG@dl$H!gvcINqM0!x>V;wQ9Rm9c%d1?0Qo%jQp6}bEHblkUO$(w$gqfjW^#<53 zmch9(Vi;3MLfX2{WR6YDR8jUp;|0cQ&uLX&t2qYrC8EVMzdzK2j=nz!n-fi)x>#!mHy{tHH9~i+%^FikT1#H|6 z_(ZNXoSH1sn4jm+UVK1b{AQ1JOGrrIQB@3U^I+v+WxLe|^pYP0{!87$KIX_s8na?}?eXKW%Wow|KaD@pZ;%Z$c+5seZ!aWSw*L z7`kCXC8BLTpHFVPyYqU|p}TV&QHK;IOQ(xeM`AT^9eELKArJU_siCFL#4NY;(u4U3 z_i-Xy_F-WsLCHEt^x*`PQx2R%Y}QDj(5-klGpoduLq5w}MkC8PBXs5@K+;--UV{9b z`brEhZ2g&TiyFo8NP|4VedQY$#8S6H9hqw=p~MFTN^eRGp?3{Jb0LK~6Fr;#!X6_o zG>tlUuZ!;997z>>g)<>8H~paC&l~ElIWPc@teAHlM78ELqSn<_EAxqR+Zr%CAF}9u zlMhh~(POeL_)galgM5#9_xOu-UbPsjcnMJgOe6Z&&-2q93i#dD?4l z`*C5vHO(1ulYIa6$bR1q-TLndB(MC-;){;Vbuy6NU%SMcyj$|*;FYrx*fuD z*IwA?k_HK^p>QACF$JPnn`LY3Q>A=(KQqby<=DKm_SVt7w$ZsW-^J+Ckm%ehm(8R6 z{4x28@U@0shLp|{!TBnC4i4b=P-Hi-6o^R_dvr6kb$DMLbX0g(s*W@9Y2>w^C+8y| zW``kHFIH>S8t52h%-E)p*|8^%3Xycl(2+*#`O!rAHO0WPxPk`fiIa&zkW6m+aX9!; z^c(4J*OyXwG|KAE$aL?a)aTY4WUD~UvA(SVAP z5-83DRG^gFDu$M6R2&>%(LD>`K4>;2l)kHR6|J6*roqN#zl%_1C;!P6`HiARmZH=E zmd4UdH&>D(E01EAWi{Dy9O?O&@)^8kiV|f81U2Nh@)Z_5+OBwF_g{X!4CWJ_9^GGqT;-IO3&qe4Ds3; z9=*iN44w%MTwyF#6gP$`S;ujBT%YNlT(=Wn3%0M{?d9$Mqy2Pq9J_F)_H|6M0|Gy@ibZn(GXdPY6bg1w2|Bu+2f z0g@}RWqeN^09t2%jq#Z^^^=A7@eP75euU2Bts8{5Ex(8U&zGF9$H7atx8E!7mtpGm z-CKB9z8N2H+^+~YLkzd0VRtrk8J^{HM&4|X!L=cmHU`A-t0rBtKlisPh)-Ov6w#CR zGZTvEFuZ>4IxQ?#TeiUx4RM=91JKHK$%*s_7%A4h3+_+qx#bVgu0rPf4GZG(MXrjB zPfeYWONx@oPXF5`07!t|tf0G{Nf9<>Ez@?mXH_F>M$!&!HQ7rbAnOG~Tv7g4ns8{a z?NJDrvhtDyiFHIx*vBlxd`zK%QF(?%FaJ&xFd{$u|JxjPdU6yEO zV1KPMc9`RPbcewUtW+{Y#m}798kpA4+wX`gGAGwfGR5K?cH2mTTp}paSBH{0Xyp}2 zPtzgAl*;5ATSI@V5LXLvG#oS+b(i#>lux+hcM$Se!9me_{cDW z*fBV*+vva*t?ql$VYd;$u=AMrSpWp`v0RPLS%iya2J!pOLPE@_Ez@?x!ksGD$ zG>Ifn=vndnZ&1)i+G|;rft+svlD(IYOEUWc4(rtw7twn=2hq8Y1wri0+cd#a2g6Rf z6O#8R|IfeV|3n8OK0PM?LIM&kKI{qtSnqzlj2MozPGQ{Y z=eSt@j;kI^TjdvNX$vPNBrfM*D2!BfqKt$5!M5E+RGeNAjYJTG(MKR0Nuh-JXF~G} zORNyhwaw&$068i3Ke+)K<#%p?1h{_LAsH-PFdihL!7g~Ri2yt_gPm{zNiRGkb*DCpNg*iZ)duvtLRW)*_e@BfUIY?Ah%O9^8+;_P1sI%NG z1F8MG#su=!hrq|VS$xb9dTPpYgMH5WeaZ2|(sG@$*TQ0r(QZ+!G-sCM?AJM_fO6IFV)%|jZiHykGc!Zii|3HaAD?8 z&5~8gY@}p_C9spi2us#^Ckks)1I|zI-)S))TaglRK_luVH-P^Z2K5xhv;aCRX$W=y zfP^U6iRrE6TH)X_|5(r>r^L;<{l^B1{^f!B^y4v2ivY40#WDvcD*Zr6sQkpR)XVJ% zADhxXeT7s@xI$E~igN7}u*yo2F{<3#f6@X4Rml^~u*9x_xV>b+Hr-^|@GC`pqAa32 zc3&tWTfu2b9h=H(5@}OsU<$~(DjkOAyW0P2S77oX)3Lm5!!yakJ<$;YL!3AmayMK4 z-n0Lqu*q1*#8p&Kx2a|v6%hFgnWVcm zC1K2(s%TEUd|wdcK`;l^R?oL(5zOMv!u6>(jm(ssXo4?t%W$2MeVst0{o@%ZX#^w5 zOz@(>F!)ftj6^j1Rx8#5`rST$S;!E)L;-w?u%XFAjlsZ^GHLUy>2Q3531#L~OxNL>c(_7_TL0gI^k%eHl9Zs3_v!F{7{ zj%HK}sprf@PTo6e#4 zT|FvuT+rqTu@ltr@}6H5Xal2oqx+HkT%EdX}O53r9}~JFUdosv9dyVke*gaun%D9ag{{v&Egxd;hl8&Q<`6 z-3yj~G8IRO+>y4=3v#lK=V@_grmfZXx((Sq8>=Kk;9oQ>MLY4yFy!%i_`*#T$*SW$3Z6~ zHeNW>$5&dU z8A=aJN3S4o=@p2G+7yG$@3C1j&j%oHC#6=x8-&JXTjA=vr9Z7xK3MS9aIuLNpap;9 zw*e&tApj671L@+K9I$h;_2H)EC1f7A8H9 ziP6zhCim2Rqu_>@a0T(qXsa>*LHC-t|AX$+dm%Pk{)O&MKbrxn$WLEplFw70U$=Rm zFObhc!VVj}BrkYfq=6FKor;aHar@ZPGZqf6tFjUlx4Ovx1j&BlOTsMVihp7xPF3R+ z_BPh1fv$m4x@F2iCi&4wyVrQvDm>X#CXu}qM5Zh#mX)OYz5fT*|C#=D30gRskpzJX0Nq#Q0Mc5Dkb#xg}ezxAg+)_}(&aXH3go?rnOC?q@t4Scay(4D!VL=hANQJHDhej&=#=WDR5mt<}3MyLH zt5vy9Ykzx{PtF%~t4q$_s@>-TcF)f_?0|kDDDasnA@6}|s2enj@OaSSGe4<%{vo1R zo8u$Tf?Yr?+-Q8|Dqb%(*`;Os`=$6wWKc2gh;n5W66cDu(30hHz!0Ubm_ zH-j|{@^pU`*Kc2s+%YM{f2hEqeeqLHy`gCT=*qY}P9!{v_d#5#bnA zK-B5+0Nk>mcyH#EBnZ7ZT>MtAZiT_UqzrKjrlkof2afSos)#Q_%)kv{mx`qTf2e~H zVpwMm^~vXvxmb}c>D?DXm-I2)m@wvnxx_$+!j~((-jq&2-=sY)#POqZpO(w;9s|n} z0*mz!0~6S2=v&h+B7GudZ1SpJhr%R63)+Or`sp%53RHbT#}dJSj~@v5QDk~!IjcHC zzHLq`a<;0}ges_|zOGzfp#N`>|KR$Es&8EHsIKvi>+gdu7P!i5N1PCsdX?e60j1xs=+O6$#ZH4~$j8iAPYB#p8Ynu|PE+Ze<13L=#5Z0OLS>*)X6N(rezJV}dX4aw`y+Ouc5{UdkNyR(bRAC@ zpot|Yr6F{y3{OHz!wXz-i2$GcZm7g{3^G z?=ds@yf4fJU8;yE`@_&bBa)K+U+kH{%8(_x+Vt(;MgcWw`3QjBBF% zzu2?j7bnx+ISjP%_OU}X%8bUEqTTmE>LeU73o|MEe&7Dao~^L z!>AqVEeS=vBi0r?MI)bK-(tZQSBIi(4uQ4Nno0)Je&{GU})@ zsK<>rH;?=)al`Zl;5)*Lh$R{w4%tN3D)b`ZTPa_g5DE# z33irO9Lqo1@kcQZP8`;YBCklB-w6cJ`!;P!IcQV^*yxiOD0d-eSNWyC zZ+?dBI2lNtO8Svfq(LGL%Qoft%GI`#BwIRR2$RL&i_IWKngS|0+W^kMevOAmkj3p^m7N+Xg3vJNBG2;-G`MkQ&$0Qzp}`m7w$!?WBE<QV~RDOA6sEh(2!)Aanp{=!Hdju^p)d&hV2{Rg|Y-hqfU2heluZZ+aCS#rJjRhVE>h z(RA4LLF)KQyztYNP2ShhN_x2apxtX+c%y6|wchQv!REH}OexnV4?rHXR+D4W`XB51 zv&m9YJNs?-dJZvUzFo9_q-pyOU0!h01-V)bHQm25wSu8IC_|5}+@s-z@j#tTw)ppx zLGdLDjr0Rp?j;b)sJzv0VXM2_|58`nKl*-tYK5E0(5byg$tOgFcDumj1<-L2Ve@^U zX3os+Ec{xc(d)w%(NCb)tFf>{`JxQT-Y{uevya? zz#Ub$`}suy9-r26-FzQsTFr%PS++WfkEi1eRyp+Fz_kwncs-+)@HR`W?2C*i+t>K2 ze=9wTdwSQRPRoWi{nH8R&q(QE-s;Z^2z+Yh3UF9Jo))$V9wcvlJch;a`1xA4-hs+H z%L0RWXq4I#+=i9xidC@z@qgIrxG%G(R+i!IW?Up)EIix~f^*fOvEi+ z?NcR4bMTG{rQn}V6ePb+7U9g(4D1ibhRNz_D%EYGWo2O|#%7=rxqzKGFMpgCvE>^^BpYEr@{geV*c%qh)${5q%`Wl_7VMkQ_4a5 zY_s`ZKkC{95T{tKddRW0j+xyVd?@9WetEvi!jw;-Vy znUNAYQIE}A0V4QYhsb+BA_7~Z5v_AnLucp?Bs=MbbpwZW025?0 zM4?~ZZc*!RI5!%z8$^-FX6E7ie`qc4s*?8wtMZih!9TA-?f*=pxZVeg%WV{7?ya*t zODdW~>m;3-g*X(@0-`af^JB*e>Qr#YL1hlb$(z9M5sk>2>oxxZL|gw4*81BQ%aGW5 zGuoZ5`%+h%YL=D!bug@-R`l0-TcB*p%LOjw=h2@0T8@q1ES|81ZWrB2! zF__dzjJbKI6)~~idzL-n-&SjE40$@|`*#lTnTL`bGr2cqmn+|TDJPaPv8yRG?V(Uc zn75*G@<>GhI%MjCyOcndLDvPYiQ`fUm2;U!a!4}+R6E}*#vvTHhR5;P81-hxPzyXF z4OE|_vKPZ|@9hCaMt=8*Co+=;9`FWDL9UIUBYdal2mKHzI23Xd7Nay~mO|G$;6`lN z(QfRP=cSERKo5#xSC?`{vQ%uoAD^(ISuQq{FChL8isoHCj_WTPQN=ItoE&DYZlc6} zXNI{0ZDFx=e?yP-i)ID~J?vi)S(69_sZWz>)&5E%I1h8g63P77N-TG6-1X8FPD0Aa zIy&5(2|34(QIbss*0uVBjk0X9ANj)d_S$t^tm?CxK?TkP_KwcGdXW#9G;)5f^g=J&hLLVA9&Cam7u$;E|JNE~##MW7kTbgoa-kI$YBE(wa2uRmW+yAG`8dcG0 zrfhEfY!ind+lV*HQ<;BR^+v0Cn7{Ur9X1F~mLnwIR7f6UqB1@Bqorv%tb=G-L03H& zc{2nKNezaVg~+B(G{h@44!Oq^A8I%htGi6G+`_ZXMI0+zo+rRjjFN-Sm@ppD7!&0T zs!huA6RP+TDUqyaxZ-*T(~+5!PY2Ytcqoi>8YP$`HEc^Gdrz%-A+JU-bvDqiVA^j= zGIFN^sSB0=uLQ@{>%8%?UENb*^V{5S&CH?d?%&LCvzly|9?o4TGyAzpUq^Twp5kP& zhTMf~cQxJb;-A1xjfTdTeV4|a;JIOE*v9|+l=pfo?ak{)nBNNbI=6Sd+x6`o#t*-h z4eodEt8ID@tQyKm-paYx9TJa@{#rg)VL`JGJEL(<1cl{pXv~!f z1v1TNKQCS?pa`Z0N^Ji6R^D@r)7}mHE0Qve+ig`mGlSlhO%zEs^xci%BivVsSwnHz z9_C~WV)t2K4}={)1`tO@rhYxOdv!{4rUJNCr~mtE@jYeea^1#^ap5*-+f{V$w}4#9 zcCfTCMQQUWVaT5nLtM9MXjbxO#D*~$?6s?X(3^(jaB8-H`M~seuZD^saZlREI2p>$ zJ>{!ZfUfOXf|sQ^?(EH9-0#s2+|Nwanz7VM@NF{GEtOJ#!Vu9*VE6#WG;jSXuc3oZ)moPev{iGT z_+E{!q=N`7GUru6SnmcNMdezdHMm%-R_<`d^0nup>(G7?4Oc=vC6ZYZ{Ie{tJ_eRN zn7}`Bmji28oe?INX7$o#_I!SrF&Kv*w!@qb`?{aenOLqhcRd)HEg)U}f-jR3Sbmp-%+;qA+^hyn#6+-^s20 z=?Kc5H=KucW^6u!*ee^qT}Z|{)DmynPXj2s^^BC#k0sXkXw(HC%#v=TJ(^WC6Ojv& zQC$?bg}FRHd97H~skc}HH+wCYRm|w)OLClmd(%4LhMprqir9 zis-!F9X1?L!u1H22Z4ONL?Y0l8Dw?Vs~*H`Gg6z1i`p{G-5l-wJu_NYhndwb?ROhu zyuhtQ#h71p_;W}-d5ksg)=$JEKx+5y71~E&I{%%&HCO3@I=<}0feF(OT|tknjMcOv z3zwlx<@t?nTbGj&Ev)V{m7W)3aI1Y|QM3*as>WNxhb-Fov%Kb1TQG(Kbq}D*qu_#B zB_oZD>`h)JC7Irp*)H@@(>1b}Q1mF7=99>he5Sr4GfaZ&-oU_kCfmy3F(D;KW+c=& z7Dm1MKv9w*6I`40D=srRj*1{fHpQZ0I!H*dgk+`^caAHrQjxSWcy2C@q5-qONRw1J z_R^I=>8I#&5usm%C8Le9F1WKxn}#%jZX9azgDTUC5ad|dy<)wIRLROuR_P+m)_qHv zn3^a78zR8C)O`TsO2cJ7>%0fhTa2PkVVtvI#6uPjf|dpkf*P~C8myw>6%WH?&Lj+} z4bjMXpU0iw$FOF~;)UmRS#Ra6fhi3=_CNqq<~~-Olhi|!NMuD`^W77;__cxSfnkk9 ziqI4tT^{J3(g9saE}Ym@ifL8U-nM*RF~3jZrvabj%b_1O-%iB$(!f=lXF9BkcUsk0 zrDHlQ?jW8;dXD1<)?M8zU#MC~?-D>&WQZf@!4%T6OV{=JYwJQ1Ar%i^zUjx^1x9-w zf!f>e#z*9zt(*Jv`|!fn#9^R1jrm6iCwX_|-O5u})jHwE(v9BnzbDPDCsH209yfY- zmPJ-on?>-gpWBrRu5?Bb@S#~~ z(APY!o`*P7c^G^j>v~F+sb6aoxQM9_V=SrXoNoH3Y`i3Y&5P&kyi~zdk^2d5j+(#e z3TeoYh>dYvn~}lSg_e=S?W8YDFr+M7d{4dXH6pc%{>JC3LCgsa1x@`IIdwG7E)w|T zViyTbJL(3u{`L_*$9vCs`^~17+x1LH3ZGPil-j^97!FAwD6XI#A^MJ3qBmZ`@34eq zRM4{fYwQcc90 z8^!y|NIyR=U*oFLRk8y++!M3Ic-TrZw(sM$*yL^`x%2Bf)nZEjI)tB+oV`&6(N{

0CA|;Rj+ux=SIH< zr{jPhOBBu}Xw(~P7EBikf-0b37FZIeb7>5j-tQ!MNTA*;=&R6FEusyM987#2p@?r( zZO{3vHdCoJYYb7S=Sk+1R)8$KZPKhrPw+8=(bJLF?ieY-6CKR2N;yM;;{6pk-OQJ1 zzgDJ{ZvjK(%LCXmERnMr_M@SeRGBod*7&l8(e!yOo!dz*p|Td2XoXi~Job-Ze$q!&M(6#0 zD>>|*$P}8LH=4IRB~i~Hv%F-3W_?H~p99mEO38d3Q7yNGsYn!7^*Wt_Mr*a#P&}{N z2&JEYw7MLBqcw+)!Zm~{$$L<=2vggXH++mFv-n%mO^D1U=eueVY<8c^Y#u=C&{tE4 zVj;n1@&ozzs05Wn^7o{WEk>-o|2Blkeg8Cs0qe+x5Aw9d>h|naOeAk+shJ+V9e7;Ca8G8x3JB8mB3v~_SyiH1u~Q*Fs0L972FSuse6#u{ej&Koj|xqI`gLmUX!-}DqVAKjyk^9*2X$WOYbbeG zRt@;2Xx1+_!R1#K*$F8o`)a@i%~JevlCEO>H3wB{4$D~nsA9>ccrbA_U7xJj#UV*; z>Q3+P`d5Z_yA5gwkAMe{>w&Y8zSNjrt`9n5*0$v@R(XJyc=zSwwxmPJn7T0P+%9Hz`GN{++`f;vwnK+tslH5gFzfxyRpirHL(Ju~i>iOpS9WL{|a%`&&6^nd? zO|pYb%w1e`DcfYbSTrmBW&e#QF}USbYh%BL)C`A>!UH7{Qr>Z^kbubP9A+hiHaj`k z5!ypDO;%pIwQTTl34*&XMzC7n=y*#h5&U$|_e<9dT+KvaA>ipZl|0-|$k=NPT z-`^i3^pO|Ti9!EW{dI@wcR%~o%qRRs@v-s>i-&WF%pz-n-mdM+$~~jrrBzxI;sn$; z08$vhHthUoKp7=nPPWh3Uj)lfW#1OkX4Mg?(4iNEK3uLs6k%d->=N`+_m)ZBGQIs< zIlAJ3wW=}&1_nX-CeXQ(WfR^qr;vG_k@cfCKXu~@-6X0rBpG$kH%LBtuWjV^xwHZD!sAqzC;2n50N!k(X{FW%{VQt>BJ~ner8ShPOjV2$T9d$JnXlY)-w3E zFSQ!EUJ(AN+0{*wFKDRZae&VnSYpkN4K47@+BTSo9}{mcSi-_yy>z6GT{keoPjb;P zKR*Q}J4BbTV_=lOZnLMG__Khc8zh$Hwu0pP%EJ7Thy3>qlS#ZO8NRSnWg}MQw#Eui zy2L>LKxZu}w)*g_G?!WMPUCr9Yf2lKh+LS+eAv0j@nw(BCj_3mB8S#t}y;cQWi660lCDPs}B4B77kx-pDC7ilYg@g*JY*TIK#pNlz-%t3kP z!Cy{`=@=9It(}})*tscWE?_h1`N_Oe6vnz(n7k?>+oCR*UBc7M@H?%wOTV|)TyLJ5u0P_}_k#V~?WJa-gBklg3W0t1B_xcI^aw(|2?R^NY@0$X zK)gh4T6nl_a>cy)H>S`fQm*5|#WDLw3&TPwGxxN8Wt2r2U?hl{{=m3l8OujC`;y9x$_xfrcRxM1xNuL z=O>Rl1yQ`5u_*GGkM7Y@_@P(vU6wdxT~u%V(Us0Xz?~B-c6QF=MEpLCH?^}ae$FtF zjx&d5zQ7l#n$G3xlDK`NoY?I^ze*RS2@|kf?x7D+88Et~dchdHWDg^u)C>(Flw61A zHq=!`GW%4g1(5nQFyo1Q{Qp_15^lfdMkB%W9MRq)$(jQM`7-t-(1HShqh%*Nxd`Vq z9B_^8#R$3X&FNR5i1WOUCucpvJ;xidAyBb8*NuDWMLkZht&iXdz`J`EjA){bm4chY zBlj*B?BB0yhQ{SB`R-ki(SIE>o64$uMQzZ#>IRSCG6JL|jY2QXBrSHVG1pjzAa1_r zudNxtVvJAI8^9fHgcM^XAh-z)NhtAWiD6(ykB9dqoW;U~Uv*%~efNl;Uj&X%X?dSV z-Q2A0!W`x)P%SJapV_dwoWGDLrCff==_2^hr*bEDPA|Wi=;HqhI%L z?BxC)5<~SHR?~!3ReaLXRpbQbe37mAW!2uSk6-20^k{y@T+V1U z)+p`FZ?_X-<~t>Kzj}xW3Qf)l?PA^%Zg-MwOBh$P#%gxPOzmTP(AXNoA7ay#dJ)!% zkk$^U7-a@>fzFkRJ#Q;H(UOPIORGb=D#nX(HvfnMD*UnpLjF2*y2j%AmfLM)3j36r zAxm@a8{`C8t3MHR89y+>{ zDGvXAI3NFetaL35SI-w(MX9ZUO={>yz#Ym$;EpB;b_=QsOu$`?1Q8REyLKIJPZAeJ zzeWgU3sVO^=yh%{4xl#f9wa$>me+t+&@?5I%IxK12YFCiH}w*tQrfYLpWJO!cLC) z6JX!^Vl9PF=cIt>E}dm6>E%JTgFWZzO!ZSb0E-y3X+0)rB#TVE32IJf7_pr!Ey0B8 z`br`ZA{y44AImgJ^17fWfYgL)46}-`=Ck)QEsS2X#9Ol-QLer8t`sN1B=DDzjCr4l ze-1TMU^mWkmL%~41WGNny_}ppL{ZY^%l3IOHMTRF>p%|1D0X;(G&jJ zBKVKuH6O_<1@=Pr!U2H@WK@*$*TDBgWj}G;QCks)FMYAz5u};mFL4=)(+5w$!!t;z zNg^>*+#L9pB3BketTz`s9){=Qgg(r^j>HQb{g^bd(a6N;$4#B=Q$P#zS6htM{qi2K zuh!dcZwzWu2NPRBc3Zr!vVP9uIj5(MPpH^d4&C0n*j4}DjibNtZb{bO)Aw7%C4vH7 zjG3YjZe^_&^f(XGlit0XVTDw_JO_Sgl4j&A8RNVAlv_p$AgbhIy7BkjI@#zzbGRry z)+6+S<77!MaHfwke=&4DLR<`=bEQJmsGRlLSH=f1n$RXJ_d69J1SwdPYP4#+sOT(> zWCy>;U5{fU52CCDwrTX%6-PH~u&XMOXV5crBXBLGFXazo`ILYN`5uhUEAzl{01p3sR_n;0Wd8t|MC^BST*=(BC01oS0%&4Of3ksYz1r*`$T&mHo5= zS#KbXc*$1j9z5~Y!L<^SiI+J1$RmL{U#a!u+XlwI<7GCMuO-O;Izc+kHCAQPLXI_Q zjct;DERm4AiN_;lOpDL7Dekb8PUQRE0y;9CKM55djcgYa)<7OxCX|86bmtJ_Fd_a2mQY1UT@-Mo0lb8B$pmhPUBKkRC!Wo{;I)DgjG9b-Sygl zw_2>KdZQ&aGUQ#zh^| zRcdh>6cTh9lb=$H=$M;4tPfHSW|#%6LW=QLbZ~vOSf50+i>DzA*$FQZ(rwUaFaXd% z6W`}fp?p(Cd=EPn!5Eu37gNdkO%&zumAH^nq^#(2rP|9ycN7!)%CuVy_mdEgR^DUc zM<<)sXv0}u+IT2und7f|2c;}eontB_(g6-srxC}sg)SmKiTYhE#1_yW1^62K=Y>Q2 zYoKKoat;Fu43wJ#R*pNxQ~#MeT*34CJv+arFo>a^{rjInsl%$a3kgfcpRzTiA{sJD zNuhZ@{20A;EXGHUJs`nb;VGbr?@_?MHRDBaUuxj^?_a~4?N80N#vXfb?E2uLf9;a0 zB_+H5WJ=}@8@J;%-yGEE{Jnf!k_SnMA4n(03T!Bf=&bvA>Wu-DxGs!3;2{09Fox#f z-~fWRJIcOdF%x9z7zpZOP$1t>-}!Lg=omAd%8jGCN6S%VRt!(FD1BpEVcCWJC7E@G zCq%g<4BH+FTp;2o!M1OsE3KJ7mo=|(#Ti44${lP>KnfMPqR!tz;%%0f zL2Ka;lq(BSpzi{24**@i4*sOjE-tAxY&aYYpMby?O5y!~csk3VIHGQA;}YE6A-EIV z-Q6KL!9BPP4#C~s-GjTkYjAgWoB4R(d++zB|8!N?bWQa+XRl}NweegW4BcGtBx#Or zyHEakrd=APY=9@v46ANwIz8Xx{=9uzV4@EH7Z9(|;h2_}x6_xMAtdmG3HcP5$gr}v zAy8;YQMSF`=JglFgKm4+K`+c zzcTDF$DbQBIq4i}t-xAH!8**$#L&a;82=*H>_nFhQKWm#+Jd6iv8xd2k*i*5kmr1f ztM4N=L)q@`Xcz4MFbWbIyG*eU>kX>_e-z=2-ruxLnT+>YKb10Y@yod9HSPCdzebBj z`uvz5#R*SAoY9{o?*NKiKmECII)rx5GJo4C99Nf@F(l^_^dXj0EIJhz+RC~_tyt=Y z^d}|I^+^@3qEVOjGL;i}i3s`(vWuYNQAg!B6-+m0^FVI1#el-b_awl<2-_JeBlwVOO)#+eFVG2Bih2V;~JbWmXKE74#B5^t;& z%Z`?qgahQMlpjhf*gMOyu}*_1_VS48@8~!kP#fxDQ9D)eiR4Mt5rQ zWSf7&)8^-v5RWW0=D9#!{k1mF`qnp!E{yUOl1i6^IjaNyqOR|Xa$_uvx)-U@3mCuX zLKl%dBhd&HfutxbYjiC_*j{K-<3M~tF zIN+&^z||?NjxPoYhW-YWrd%zmsUW!Em{~OK5Brv<{3qgZk|f+s)og58^g9|uROjm#<193v=WEIycu>3DlmU&I7eJsh`-1r2}KU4Vu5B=KZ*PGHHgD#`|? zh?0tIr-tPmQ|P;oSlRkx#DFATy*x!>cE5AKzaCul7%U|*ZZypH|7~F?w^!_RL|dWN zjdUxo$jEX&VfmFHh6kn&&ckvPOYmyv_bV$F&B0LD=mC!(johNsh^V0e#qrCO7khH-@=H-O{xD9x)!MP@1RqIN$jWw#iMEJ9OHV0s{o<(n~? zrMN6HdI>tm3_|iyL}B}k64$7@*d}UZ28r*k*HnU08LUw&+>d%n71nFGt_s!vb|{!b z9Pvkg)qPJcw^R01CiHOC@@5T$nA|UzHL>;s+whBro*XuGrF){w;?5Ft;j7tuFNu;$ zjeWbXr(0QLu8hupL61za+1)YAEBWo`x<4bK47Zobe*;C&y$d}O<|U;& z7FP&+tUGiYF*%5+UXzV-L<;&VX3*N&@*gN?BbTHd(I!6%Sa3wQ45e#Q@v=U+zUu}s z8`5pQl0BbOMG-mNAx(PBM-6@VsW%fV7r^lRNtBa?y$sn8P!TTHxnJ=ah6xH>78AfF z_?^|@X_Ev-w2CRPJ}o-M>9LSVK~Cqtg1)&&d&>(OH6~ou7(vA|y4J~&>BA$fSA8kc zW>>Lf@)wGY=4P1F01u~J+?jMwfl`?6Ncu#ByfyAMv1X3Zi1@|bF?5Zwh1R84C_8^0 zy|z{&B)NA^f1h%Q#etUrox6e%B`TmeG>D(Cx7N~aES`5fqee8a%K0BR4YvL0<6S(r z9dF11xtu&TBdPqOZMS+N$C~oY33R3S6I8^90U2Y4?m`Aebyh@=~iB((#0bGSPk7%G9$aD9E=F> zd#e27Tx(!olvLI^6^}ckv+7AIbmkm=J<37dSgh$xJuIoUA;;7+V8i*Q0LVIJNsZGK zK#J%eoeDMqapfYmr`Soi>I`Yt_{k_=c}+kmw@?r4+j^rB@jk{A`dWD*)|p_1WBxGZ zOsZ{hQ3`MO9?pDdU)R2qx8x9L$DiZMxE2>sFN-Rz$y26b7Hg77MHsz)g zlH#Lkt0uYXMU?xh^jNm;Oa!wb3SH|~-lSqbJO0og)if`uxCA?@;!O+QMO@zP*v7X9 z!%z5OKXDiih}pSslLiXJ*kdvKY>ov#y%_2$R!07%MkRAGcZ3+o>|0-#(AOMjZZ|*h zn*Xq)?=gE#S=V$6XuA7epBb3UVKMg}l-wf2`&3UehO%HEo`ckp%qxW8|=cWq{OT>>CCu@--3mT(8$_PD0j&~LX|Bp4lhN=`GI zm2BAKu|&)Zok|4dPZk>*`MEMhwR7T~i_o;>Nod~Mb8s^T*6U3#K z34YIx3E!D_5`$gn;YJBPj$2+lI!D}P9JBUTwA{#B`-$7p>Yz>Pa3kA{#kBw~YyP|$ z>tOHgb`9HM`dt&Z0Rnp;`do-*r0L*3w91pu(aXs z!TQvwQpk09>TDS}ShXOmBtkXrQMPhLwG$k-&`#;=IgQ$s@8%n`Z6ftcWhXPh-*0Me zdNKq0+Tik?dS+xRg(Qi%`O{Ddu01NqQ*&j_>nctZ8cQ%VrBDw|H z8nTsT20O1sAM1OYgKbgc=hfA8DBADgaBJ0Ew4v-4>aYsE?87N?LQqW-sVRAD&RTU0sWo_+x)u+Z>?`GTud=`_?BNrO3J^>7sk@Pjx} zqff~==Rw;b)TA216YoB_Sw32n`0R7A=-q0ZVc(m>K9(|Fp&kjRi?;CgDU{M~!3ft}{-jaVv!%Xc^>NCMnJ_4O;2cr3F|k2qDQnOQVv)$JY$5zLB9aYAis5tWt6@sBr&f2EU5VoIXME}RX= ziF-7|=qK!*)E$S%D?fqnUU;RT!dLq2;S#*h2tVs)L!jhK|LKFWlH9jy3; zT~<3xf(7px0eOL_z3t?-fv8_-f@oNV#AkbRo7G=9hg(!I>nB+Q{;uHa_ix;y^*HTk zErXePju}NH?ymjOXurEWi#xpVifxOCID01HqIJab?JluHBzv$zz9w><6wn_mw0@_z#ekTcng9%1^T71)QBsgT3)zaiRE2QI1n|^;42{KxtJ$s+{2SGglX) zEiE|8B4@ic@u)&Xu+|19o7$m8hL9>;C)6Pm5c4{PvqtYE(+RQ-m5+`w{W*srR%0X# zWKP8E$zY>q$CWq=ivO|4SY3wF?H>k#fmsp0@5yl}uGST_H;9h<$6)oAC8wYjMV^ET z7g~`&5}iImY{jRp4=E#_9b>JA@&*PPy%H9WFKWAVtESm%sQlm~HM?ayHl8FOcU`9G zM5XTNqor$QQ)338w|RAC?+w(Gdb=yW$KUWu6pU67eDFz{B!BoNI=C05LehD~&yP!) zDuO1gADZ{wA>~A)zVBW~o|W84_F4lo3RhbPrhx~7v%^e~qUmCLH6+NV8T|R+1Do5( zArrWesjmKQDVMl}UGi7F zr~TrP)1ySl`pn!G5AybE4MK)E0%Y|1I54qPjvCyvWXbpYJ0#HQnCsv&;!1q24|0kJ zC@9OR%)JPNfU`5q5F}#aDAqe_PU6PDf6(W!cAWF6j4;>Ml36#O9Ge^%QBLKJA^4;X z1s|H`GtERRln;n~GD2l!Q%05KLN3SjZCKPi(W!4M$cFrfUZ!A@I}lEiW$XD?od$FE zR>|??fi8$aXb{Zyv$hzWts#QxO(ubN>!g{6pI`qVwor%Pt7v4LlKtcP)+%aWS+5Zu(+^F6INC=NqH=@48iglC%^L zV5X8X9{aueAHQaur201L2V*ejjeyhVyhU%ro^1i#o12~Ad$OBxAa%@`ZivN*wp8tD!xIA30?&crra z-4{9n5h#A#=}TlJM9d|mPCv?%$UY-~j?*0`6h9_JGk0x#tJiM-`JkhWG0a)QQ1I~8 zD{boV<|D&js23Op%eNibq&12HT|@)vPZ>Ipe|$6Hg>5{mw7;Sxiu2evw)8mm`o7@4 za*eztyCL)#rSDL&1iBb94h$Tc3aEGlIM{q0H*!Jl&)(HQLn$x1A>=|hcYE)0WSk)R z+HP0gAAC>$DSWhVhPrMo5_LrBhOQfxtgOHHIxbNZ5{N7-H#p~&!0*$01QrH z@XISh5xtwC*<_}{aNB|ZnI3Om{*MFRD1f7Jp1A=1qHQ$5sk!{m+|LWD6VeEvldrEx zZWxVMv+xzx(%n@)hX+nQ35{^*4$Xb}%{ z;dw;0g5Y@e=q@uiTp0MbtcT)Uu<+78aKA8>4cIRG7QK&421KR-W#ss*bD`*y`xq_j ziI*}ee4sh%_o3a&uaZY=#~e2(^+Zk30#BTiWoZK0BaD%w_o(tUJQ(fUtiNjBI?w$Q z{a-Rg?)2VX4QT6t>0Sh0kF0lV9@6JSgV)TWY0QzPCJzRsZ3jHI6rme(zKj46O-isz z(l5y`U8YQ+s=7`Ex6)r|YtIK`Uc^Tv*A1|`wpKpfM*@%#?Xz<$&&R~~DpbRjSs~D= z5TNA2D3_l;5Z1)+3`!EM~8=arhKN#T#4pIBINBU7Ol z%gd#Z|1Cd4+{z+5I!YX}J1X_|s@yv*SKm0faYHS@ONP{%cLXv2p(OJuPtQAwXpCYi z{_jwPg@>9VV);S znKYs#?nSRaVsqY?M34a(afW$y0{ahJS(#Xz%*29%A6L#Xsb!~5_PYX>l#p%}6l~Hu zWvSw`dE@P4zZ4QaZ zQ~v%+V9droWX$kTB;4{*%H%+HLhm!P4dfZ>pHS-Tr7&q$6|KFCjIPr*!>*7G@`>Vj z_dF{xqK2a$>8r*GJMiG8o=ezxD^^^+pRE4|KR|oxpQm$Kf!%(+q!umuDYMK~X~MI| z**6|;wmmKT%;L$Lp~=)Os8OX5d6Pk*Hhh+`l6&{pBA)Z8oT08NiHR2BjsjzDoWJz8 zJD$pP?2ueQz3h%jNWro!Df;HS>eM&1Y`~5;Dg}K0a^!D4(})d*F=3-O+Ekb!6U-eQ zF3OxP5wpur5O?52d%#jB$llKG@B-xZ-qn@;1OyQMslGL7O`OL5w&K-qVL1A;z0)X3 z06mGvml0?(+YLSWh%J2RtKhpeA4$2HiTrBdv7)jZD%n-&aVf)_j;MOdm80`?GGQ_8 zXPWL3Na<;<|GKIs9vy2`^Y1&Q>j=s?n>(AC-F{6_=&!Kc3H^qN?Raa93A^1`LWF*- zcynnYjES_kM&{w6+(&qzjN0WJbLU3ND&*oC;L^=o;vHn)0j#AESo)S*bG9)lr8C6E zMjbSUNqwP^?s+CtPn7g%X7ygM?7!p0i8RlbIwXKyY{9r3^ao=}XjTvR{Ttrtr42Eg z*&ucmHg*ev#~FO58QmP{3HKGl0W+9Yw>t*^b9?jha0bxfefjDjUEE|_|C1Rv0FIZ-F}Tjo_QsKj!4VC{Bg%&a)owz)2`7qE{16LK3N&Tdso>$*09MUo?d!d2q+ z^5$EsK@^hr0Tt1k;c&Mx3J}Zv1TYkKTP6mi01mc@P*ZUDPfu|abUUni*zI?Wdf1`t zMBn~X{2qV%28c$wA&Ba7jOZJiW976Z{@Yh4fYXOOffGiOyKk;M_R+&H$jvLzOnpUn zR+bKW@95xreciU(2UStqjq>5_Gxt=^Z38`MpWL_1%=TGb0ZmtJb1I35VbN7wm?1?-=6mhnD0f%?6CZfHy-Weiq?NNZB%_*bu|xJ!R(58 z9H5E};1v-GM54GCx(Y&3mF`2~U|vs4yn4f$>J`XS@_60}@7PTM6xS2TaLpN*g0Mhp zKnW1rRY3S1_>~AZDFo#6&OmAy$`0}D*7OBuBwo{8s(AS#Q<4N9b+Npf8r|M&ly{z! z(lk!VYZ84Kx!$X?o)wV0DO8tFrPn-w~e)zg^Dlkvjh;0^2h z`lf;!{O*8YIhxNTkcsG6E-Z!KMc13K_b<&AXtyfH!ecc=6(Tq?PYkZg)Tw}SFDE-PGamj$!> zt(P#h8J|@S37R&T^zs|$-79rYTh01QaWz*=)(rI*D=>av6-}G^2U;~NS;tO7=((i! zGl`duhP^3m<+AWpFk%)ly0l1pDO!GAd4cgr%=D_d(OE=(WMTWsx*eEbpoxK!F~p$J zo_m5+$zAqCUGdrA@k?b-`6-hRxe)H-`~(l^T(7+dA|Hc5dX%2;8ax0y1<}!X$lxDZ zY{(@t+@j!klB3WA+*vn{40~V0CRp)ydJ+XXBoq~Pnk}x!k7Z=oVT^rnLa#;?Gdc!{ z#vH@2ydO0TP{u6KzKzxYn+0(!4Fg7dK#y*2Zn~iDzeTTmAkc5;-^k4uOdc}8zmKx* z-FY2wU!$B$V0NHjn4*4idatn}K$2`0;KtxCCJ$U0{uF<}T+%~F5(grGedekfl8}tZ z{bq>YcYE)3%&2g7Gby9O&+hkF@?b4GXiHF1G#<$X@d-R(eKg_Mssmo z^Pn+2u8bgT58pYRpfdX5CZow`3B~j9LcuPB`!!(SdAXeZ=L>OyOH}39z51=s-mf-p zAgeNTcfk8?Bxwp(3is@q=#~Z6J$BMt*_tdb83@dE(fS+WuZ}}uX`1|ESb+4F|Mo^< z?WBR6lmG>~E07lcTXsptC+O))u@6+)(YSpDT8SrS2J%6^*opPj@;~rl*b+Q`5=6gE zw?EsUyiB)d@hx{$VV?DO(g#{nbeE?RCkb2&6FK?k!v6Z$Y(*C4O;uFa3n zYoMYHs4M4Tau0O$EJzRcIWfI8B>Nla^~J=t{_TBYyFuKCzD+&ny>we%<{@3Y%R{`M zLEt3+KH0l<_9WaH>IbtJ$mfS~^n}`pcwMUr=!`vy&sd!P~B76 zFnzR@KGs~T6aW6*C;(xYttQH>Q<-r8jAnS-{-nP`!2dTlP3-SV=}da##(($7kz^3HqL)8GKPnOjA(xi=2GQ`s+cXeYWXZ11lw=X!4qxZ ztX(*fll8l*1X@}PF2o47+K{e4EKsfyQ!FgIU#7Q5vCHRRPSJw+a1P!Uxi;-1^fH`~gM5^&F&0{H2MmtXr*oNpcRv zpwdB;x}UwdP}ikJT)Jhs*k`2*O7RuTAj~(5F-GCb&uhOeAi$w#y#{0>V@L&5>MN_i zdRS-&t8!dhF@zTZ2`N^;XclFDh%~JuaqYa@Lvt1gocZz(VF^GYlxr z@idgGmO0kQbp8zWOH2ermB6eBB zoq=}w-*58@eH=D{*D2(=o=lMtlw?^>_FBkJngF45VZ>uF2k(tgCSK=C^WtG{>Y0@U){{OtU+ zy}5b0476Z8y}j8!m|N`cttN(1jCY8Hd5$jVqwV@Q$a8cpbNtrg5;S1NAxR{erO3~y zt}ju_uQ%8#O0T=qs!;^<-cvl#yLbU=ZoYf(*#a66fXoF>Gh;!j4GI;AkcAry$>G5gDXq!0Wx}T<`e>!0j6l)SxVJmYr?mb2%Td>E&4o9dNmGn!sE)1@vpQ;4m{DCoW2cFxz-@pBLzx-Py z(y4a{vWIiIMaoGmaV>$hi^Lqu*3_q^ zT*kT%SZXYc(*;?>2f94`6l!koSl7FJ>xp^58g#cI1~ulF*lOL?a&TKl+>L8hCL$zI z3m5l^5rm;=ATj+&Z_I5ZkHv6ly1>e`qp;-p#CS-Y1bu(YHQY9B$`dmB3%tIxy?nfT zQR3tK&nHVEu!cYaprY$WWxUT?srVf6dYHgo%_;&5cb&1TzndQ^z)aVd6G@0`(L((}>5VD@YVGdM zO zDnZ6siOe&>3?n})eez5IGNg7+Eo0iETc$VZpIUg_!~aSlaO}lFfqJk0O0ZEWVT(6% z_T~<9N98rGwoV#~RG01wsaSiehb-?s;2U<-S@K3Z(z$CfrAKWT_=iVe~hv z?{)WC;In71gU$yKJf$tZYP3|$7=5+@)AEny*yQ@GKa2L!Y)jC!*h>u#E{kKe-{ow9 zO$oJTbd8<*|J|=W9uCxl3-puWcn>*Acr_9$RpG>hs&zWnOq_T6X~+_tFheOwPD|@B z^y9uJXe;lK;(yEzq9HlgdhLm-m#qb!-{-Q2=+Qpc% zkbwt1)Kpjft3M`msVuBlll1unMUTIS1_h*!a>BKL=MG3VZ_eYp4b1pHhh4A6Y^9?4 zCcs#|uW$7;5kf=3_v)O$vSBwK`4Js=b%M0FujA0_AGRnV#EL$yH zhm1T0aytlD#)5@;zIp?=Lz#d_Dsjpf-`Q2=6~FAv$X`*s{lmMU;&S#GYcbah$4tXk z*CPqpJh0Kh;!tmzFuNhg&=N^Y~x!WW89qXiV!CN>8oHDZb%9w0q@n7V18sSRHksNrwd zip{0aN`mf3&(mvd2;|3oiRx#MC~hzQXKf#7eSOR7614oEyVxKlK9Ck1q&7R~xyAkN zcH77AR2~R zP$=Yb^jzs5;#B5NOx~PUpLWN8x}pM$s^@p_~n=R6-wj-44CX4H}?0%jCXn-E#K z+7FGtmmJ|94B{?6bL2RatHK-drAI1CuXd4%M+VCy53hK2BP66Sgur$eMz6K+IOU)a zIqSPAcvZ9LOV7XOp3N;kAkd=67o?|@fdabzFv^Gme^tW0FGTD)TP>p7Eb~q~$`ob>qZSd3T{40rDnQP1L=OS~cEToy{K3gB z(>)L|PW3JFt&mF1E!Q^)q7&Zl_4v{KVpkRF0u0p@bHRM_Nb6tLpjiY)!MXENElO(~ z99%I(L#ucX%!8;5-=aSbu)lYMnLCY7;wD9oi*~RUkdf@Wh(Ox*jupX&`wf=Bq9o!hM`SPbhuu!cU@JzN z8gYuE-?2gz78#@^e?v^0#Ft9&jy?1#|GNJ#8!TUMl4s38Gyl*L7anbM*9(k%a2Nu$ z3tL{Egi-DN?23!1i-@If;)%n|g#y(L(Poj9-n}CoEE`ouqz8>gp;a4JEnevN6eO@2#!jlu5C zmF}Ji#AjJkX2-(2?O831!Cc(5Rmmf!ohk+4hycF$g7>C9@S~@3Vcp>o#5;e#0+QPi zDreS<05V%=XudOtd@K?^mm@#I+k(NukY;(vc;O8#LpadDfyWwTnyPZY6Pfh>(0;2a z4v1r;XDK4b^k70^oG92^3X)DIdPjckcEt#G7m*@kHCJMcNdkG{x|;2Mti#wU@MzX*kE z4M%NoPCCl`f%Q9MzePY~dlLR&xlAi7&(m;J!5g?|&1n{9z=A%N?cRA5F~cQ&AClWx zhJ&BJP`#@v>vPifb?r>*ZCS(u%wsrY9;gF=7Mi{on3PYptfn_-_n_rvpgr+d+1;`| z4A7N(Dyn~qq`fHK4D-X~-oGzFi{VcGu{IQeH@q(N++|Kt# zH3%ncSZQjLWU&%bpQw6Rg?g^SgAxYHM+NZH!-PtZ`$}S-JaOcV1ka52GQN zaX+2ig8&kZ2;sLw+@aiDvy_9ujz;-2e?oM4&i6Nwn(b$!V5(y+RV3^^J*Z)f3(@N- zn3ca3lX7CcrdS_$R%iCeyo#DDB-}G@6%FwF8!9B;#R*4eBr&Tm7sPo}_IFRZ>hpk}J4UaB01f;hCxYW9y*}+gfx=cp_ugBiMXWBbwQ_CM3g=NXbbQ z5}V6LM)b}Uf5)R6MuzG#{7q-Msk+L)IX%+G2EICj?Q$&Fi zCWGPne%Kb^Yr-OJUwEonD2D=$47FHZk)mE`Ei-R4^S|nEF=K z-hzl=s0yAM39YIjO@`A-Y_0ks4O=HHf*rbP@9FgOq(- z)|P~fL`)f#M-^+8KZnzVE<~<9etYmL}+Obu+fxWU)9iJnARZ*%Cln3aln+AGsaI#Cz{hNGbTG=+y#}GYsWoHCYt>_ zAD(etHcc29%OIAHV`tX)_yEx_(~Lz9Ya&natiD(=x$n^ngwG1Py;e8ebxTxFhL2Bx zeK;mOnC4-SgN+TJ1!!e``}FS)QFL;#E zcBwD~g(R;84ucf-dM@k_FG1dX|6Pu?{I3mnTY8ExG|n+@wBNx#qY)lpE1>xYCb$uP z{zjW`%qw_St5lDKjjO3=v@>d|;3a1;K1boan}$>pP$QvUItQ#BsW%Yj?#pYJf?AsI z-vHj;4y8+=bLq3!T1&Z4tSXe?BZ_7M|w1^op+?f%^olOX)Le0m0G4Qt?5N!8S$|Z|NLJNCo z8KB?sV&%MuPyKxYzjIO3OsfPz#l-o2HhR$`%TSGCk1*HG$?fPOm0Bi%AA+! zOzB7DMcY~`ug@A@H!v#^N_M}6+x#%{Ye?2#ZbG&ep*_iUi0X~w(S+l_`~kA%BnSn) zwiyqAuliyY3AZ0ba%g6gL%fu@g)ohC6tBB^DxCljLQj&luhbV zs-a@k8)!}PMT-%S<5b7_RHeVtk8|TqpL){xt^Lx5W|bQ2aq{9?unZT3uy=z+V43*+P`6F^9M1i(rC%jXd0{neYbC!u;L9`g7U^R> zZx~7XE|4(V^i~3upNKQ2uW1I(&aX(fXKDSU5D{x-pMeOK2;hF43{y}uvgI6=4@n&W z*I2958EVE*Sc0FiRNXBd&3h}TS~fXVi^bMb7IVQAS39e~Y0Wbq%B;^*R@stH3Z(s@ zX6$fIQz>?n{Z1sX?cP&LKV#xin8ecaYciS%+kW5z;JM1N22J_u?q@Rx7o=Sy5qw*= zQI`aXfg=)(wU-qpyNBg-_J`hB;11zx{Fb?xF7j_YQS1Nb33J;2y7S*g*io_K$dOjd;l0LM`HJmRTU(*SFf}11u zZN-AHUoYWnl=N(?NMi?!o6~k37*TR4Rp2|p!9!-lYxZyF&*?O?RHP!x4B?q;oGXNR zslmO=K=59Ur}yG#c*!%)f=Mij$L+rv(u3A@N_v++g#&ge0az9r6#}3|u|@?O>Et(1 ziohvT2iRg4=<&(z?g_N{+4Ua*!mbF%tE%zzHo+6_&#@p1BpmR4=b?J2X6Q6!@*ZvM z%PdDSy!IXQzS;zeRg!7#I?M=Lai1fYzByX6-bbR`8CVMk)%gqPaD8!bOX97!e)(Z2 z=f(fwP$I5-aGgv6VDD>A+uo)*;yT}=mUyobdHY2;j=PP;y(#NrYyU0%T|?WhN8yq_ z7lY*)>$qFe;8jvr7x~N7(LnqYcUPZJ_dY{^gGO`&zEq??w{v`5%!QQn zl{G!mLC#rhY8$p(w}0(;8MHIT(80{yk5{2dNpTMLkMh(LDFviwz{in!eWB6j=l0c= zfib9MVe9KyItAZMR|CvQ-?vE1MiQv6$ouhI^D&(jFt^&(?x<$^j!t*4yTwJScI{pL z!l|O_+gn=EiU<86k=D*->wm+Jl#|$|eQSh@$CgGWm14vk$l*7&xZfl0loqUb^4up> zQ_FlZg1Laj5q?LVZ@)l4BX{7%>df{VPQZeXZykEME~U7#*uzA6M~k`?$04>4#wb*% ziW3#a7C;hWMVQDC$b{gN@UrTxoaG@FOH9q#i%K<(8|QGbd3NMIX?Pt~I~P`^3aTB2 z&szopY-%09-f9oxRtB8_Oj-{X5!-1Tq{I}D~#?z9A0U-mKi6(ccnpWc@Mj|=e^yjMjR z*z1Hkyc0-rezL@~DM60&KP;_t%t3rCs<4(qk^7Gi3Jh`qpERU@ixezQ%eoPZ0@#BS z%>$|L{IoTOds`{X_x0`;7F>m0xPVkCtx^Yv7K1fVR2QWPc%G9BAfUxjt%;8iStY8^ z?2I~R2s4ev@B7^vRNUV|_#jGT-}Yl@4BSbux2!xcHH*rUUutrC3TRHa*vFqXb?GK= z5;n9NHdWIRHQTlkS|3yRa#jzZh$_DZ^=go}-e%zEjJ?Ab*=S2?ntov-=xxw!39j-2 z*ZI7=#f^kb&OiIEj*a6=ICt)OHIcT}LPz$)`?W5;%RY!Swd1E(hpi5RC)-zNf8R9# zPS(>z_=WC(LGBk>y2{ z^6~V&F3|g%cfmN`h8=gb<9-t+Qu-zLQ7tfF^|N+t9%HCZi*AFrl6=gDQ3%?w+=xm4 z7)Hu4WJocl^@A(L9Rr%rNhNmmVVZw$g7kxKK=Q;yh7pg{>57>GvF{Ah42hB zr7gDm)eyyUOL+3m?r#wQnTHW34$c-@H+BArHTAXwaPto8ikz#x_9_K6_ISI!2pz8o zfe3jwTX6J_h3o+BpH?VY87o!m} z2$$b1I!r#cD3?XH1g+RB%&`F;l@c_x%Yo;R03G}hdkby5F8N37V5iU+VwO_&R|Ag` zA|zMV3wzv_X#CtbJ+ITLbMM-W!CV(9c#e$?0hC1Ii{-hl&}^IVAY>U@{B`3B-rW!1 zIt$rjB1tB1Jd?G08j;J+H7_YI1&R_G=@vQ`Fyr3Q;wGiQ;HDxQaXd3gp;EqdQ?lNz zo^VYn(0R~it^ni>3dRo zRS>=4e64cAD>uGX)BNCW?1B7GDE@ZZYvf+j^s9@D3*0lC$44@6Aq&1@1RjF?(+-I1 z{9rSO_jeNfxPvt)8GQv82k%;Vg_P)7N{q6EgJ&TQlSB&&%0C5Vlx?5^MGPj-=JF2Q zF?T5{$|385dp9ll56TjpG^>;(r!j?17e`xd^j2AZ712lji& z>!51;7Vk5a>S6vtm*5a;4_y=IVeY8s0y8t93b=bCusry?S=jXh;UaO*o$W;y6yG`UU|#qq;kl4Y_Z{u}!2a;;#fmL-*kFikpdbM#Re>&kNVhpn@}erI3aY6zXAEN%jo z>~+|!xSv;60u7IROM;%2-hO%S3QtSapY)8v!!X;Zy5fU7ZYFU;v4Z2~(ttV&(sMjK zb%7{!r`i#vKj{is)RQmY+s7V5eU&8w56Z|N5e)E)k$PR;scHX z{hiXZe>lss!d*E_d$LHNtA5(}nF#<^yvcYbN&JE`ue# z-lld1FIv9(;pd;FWaw&HDW$K%0qJU0c|)QeQeOwT(Rf37U}_nmk|lVptkdD&O`q)6 zhdF||*?%C!1#Y=>ZHR&r8mv8TjE~rRHOST)T9AkcviJ&m?9iqHp*K(RPmMZ$AJ4p1 zBUD_S3qJ&6O{qSJjsZ?X>=(PsU@`NJ!YoS`t8kXpYM+MG+d!t&!|+iljWFenAo@YT z8aed8&uv~+`}MreZE4gwC1l9oG^p`EYQnrG9WYU<;qq~3q9ICk{08x#MV%Mk-2wo? z9_)C!X_(GmR>+6(uA6!$->1TvaYvAha$eRjVC z3cY^?JbwLb+ESA=<_$F~znZgsmKQ2Qn)6<;@6)X=>jZgFPu8eC2qUHujWfF6!F6Ke z`5ra+WwyM+SRIENN4@>L=C0)TaiOQ>(_}s|haqQvfW6=%*SsF=u1`sKatClg=)#;b zgJcuTPN-O^C`hDz>eT&>r)RN>^hqIqo**nS8nfSPoHUKuhYxlm5wnvt(-Yt#L@HH&4wY z4(<`|^E8U+oyLlM$dpxdocO%cma(AP@0D`OMN^&soE8m@b_wvddVpf@D{T})+7>hf zi}y59^k19eFR$3taGW&Aw@%Z3e(T`Q*Q8ND-w+u?98%oJYG|w$f>bn0)qGRqMk?!q zEgqy{M-Uor$tDKaQXAQtxd*QKsVf)>xywelkUE>gOPVT@B|bkr2-s1`t48P+$ghT^W{tbtFF=4avcN4>`U=hRsDP z9joktXwXxLi%fip_7srh8G*tKVjU#M=vA{Oks=YD{JJ~$PNWTjIErNMoQ{rOVP;FH zC6T`wF&qm==p~iBIjS`}`NSf%AcVNjos}!Q7RN;((75^=A6zAw*hDYfmO|gm>D=N5 zV=&vd-|s#_>(kCG?E~3~CUd{8bUlq+t28}RLpOotH%Q|NLfh(pW+C29t?k9JlX75@ z3bl#~7rsVyGy?1Ylj@JML3It;>lpr#-rP#UI}2;|!$BTguV{+#(EFC^b01tA^l11A z@(G*EU!~V~a=^M9p#AXibj;u}?DV`nJZ`z(>Jk!oseMj`Exl%rVMd9asX_4*^aJ}S zHAME~^8omXglMj+{Bcur*<>Yuhjv6T^%vWr5?^{D`<>qWCM*?rxQF78hixU3Ka;d_ zAGzOHXsEpjn<`}36`!e1^P+sgQqJW%u=8^9cGtr^tu!4WSE|}@bAB-VXksMMHg>YH zV`8v{{V#kwhPhU8dSbj0?+qP}nwr$%J+nU%D+qOBeC&t81`sDl8 z-e;Zb^dG3Ys=KS+dT_te8^Cn8A5D*kfe-!sL7trbZ_s|v?*PkQz#;F=_WDr{XAk3p zF=Y3e&&#!XQYVwSYV6{5LB`rbb!LvjO&^dg6wh=@QA(JqP3>@bODkuydjV0DrSd5_ zbdxVFg$$3OGV#g$(zrk##9*Yn$XZ4U3pzWCWc(thTG~w#WHsvzp?HYewu5Ka4?_mT z+4xz--TWS2beuKuwx85Zy=8yR`(5;I^j9}N5w=2^Lm2Au=6%%*hB;s$Bl>!~yZ}oR zn}?j2&89u$RrRW{KQ3Tr<8nfKV^YKHB!b1B$+ba>8!pd zVH7jcW{X@8{%dqT%P2tQ&X|PV`#j zrOIqos!U^=D?lp%=IJ z2~q3#a@F<5+#iP3I&JYfpToy3;rLSZ6to01w5-}62G){0UwyyCkiVrSWL+SYQgpLW zf3=-;F|io3PxIx$o6NBru8gRE!NAGm4EG95mJJ*&OTwEPE#(YJA7D-^MQc!9^@_DI z5>vMHQWP{HMZ=Ohs7;7FWMsXpz5H(Yu`AdUPD&dH7a=;gFG+a}$U;Q)|0Ytne0@D^ zKX!$-`Aqee=Z(Ua%Y4pVPiG*2tCs`1-o*h4R~%nUI*UAy_CvZ1HJ^mA*NaLgDqStO zY_==b8jLaFPXDNpB{(n8OGhfEy@m^LTmMFgavjC4TB6EvKIi(^2sHtJ?a{9R-w#}! z&%X5L(a%5|q!ws{t&lHVCU}%NNXEx#$@nGF799{O{Heyg9h{$zTxmyJ9aoNAR@MfSuu_V8BuGC4oB>W09r1xi~YnyzC z8Rs5(Mk=_&%rFrZt1ucwUf@VW}>mT#Vny~v15i2_tt)`mvsRhr%)a0 zOKqzKeabiu0+A&NP*Y78+o~|vHqm`xRVXev{8b%oXf+cp4$BIAAk~1+(14kat7q?* zJ0VmR5-7_GeKZ_^K?0J!pN>p@JlW$*8yKDFg(>E<3?%=m4X&X3SBLB|?0C83y$gO4=&AhJat5Or=x>-E>|WqLXIt zr4`6_+LEj&__f!EdS68rgC)c1S#~f$L5S(6z;Wj#wE$mLWjd_SKU`PK^?=+j_++LNTTK(>GpFfI?e;< zbVthW4{7Y6(!Gni_fM;MF1np_563I6%Z5zqvu*0kAp4mCi%?0Hi3L&onA}XWv1}%8 zn7+_Fkwt-ehKBP-E&m%g$;W5yyI9`3`f;vBHy~~HF`v&sRsdaEh*RADwEGHjH{ql1 zblGr!wl3@Vta~2*%ue7o=_lj()|cV(%V%GO$HyFZy=w3YmZE6ML=HOpA7O7{ZVqkl zSMM=z3aj%FPj|o9rT5U{f1VVIweh=zc=-A>_|v3~S#Jy$W!dJQ@zhpg%A1TKy9@d6 zK1+1A?2rCQy8b>c8V??r_WAE3oz^{n=6+TAocR5=()oLIJF=NF6nc?zKdCYI+HaIz zHvsgqgT&1`CV7_{W#X0=#+{Z7K0TN0bOPR&v*kFy1y**zb4tQ84CVVb%AmP8>otN; zU7hl(ssaz4rv@uNw4)KN*^XGjNQ3#EL$M~-N*hV2rv2CYWDyesbpklolsH4yv%9c~ z=Z+J3X|N2N-p(<}wkC57xyJ^TEXM{=KXpow3dz(!i6(y)&Xxk5G#hc-l=1 z^Xl}=7N2dLB>F}q=^`dxDrYVj8!R|p6Hs%TVdbr2X%(u=?rb%+NKQ=+`+$q|x^^Ke zf~1wd3pO6s>`ZX@m$3_A9zNT7;vAOZeS6K!Z*)2%wM4~I#gz8x$)#>mM-75*smpw6 z#jIV1(=nKo#&D9S^AT8^%6L0IYp|ebpsokp&R+NYaizTfQ_0bERoMrlFxcCcgB+Kk z?or911@ggaEG9F$?n|pnGJ)HK9-MG?x)|9HW9#M?x1U9!hV_e(SjwkP6eaXQMUIRW zEIXKur{%{U?-GY@no4J}yriC&JV=RE8;;<)=ntTFzWjtmpH=;Z4UMhc z!NjWobGf!CTWyk*ExRTH)pobK^9VLo?F}fLajoFO3j8luZ4|FF;R(jyCwcZrk<$s=nK)+&TS&zd|Kokdi`>fLTZ&2z#0%%N$j?QhCor#m z=^A0`m=R#|EjzZve5De`5M|?dHwp?jmTPwMGF3iRVT8l!lAybS1-3%UrlZ9o66`LX zmn3c%rZTZguWkZT5A6RrYQO|yA__H|!W{jVFP0;CN=StIEg4Y~h@$@)1k49y4$n2W zRUQJ9L}LW)DO7sQTzMmGON@b`S-@P5KwORSU3To{j5f5W#>3cRMr zd_F5b3=g^HQE%C`GcH>|$O8q@imGs2riN84D|2MHgr!{@;kcHJGJvI^B*Him^Cl_F zM_;Ha=7&q2qHpz`bw`nUDj8u$_*>6*q_sobTh_5~Vn&JCZQ|_lQc!Vh@uvW`t$)r2 zE72#ZkFY5OGF}wnWYrvmWTX~G8ymXSzk=c6S2@^#RssGIswsCTd6gdjhM4i`GkCS? z#2yu%TEVy8bJ-Y2^23~n2fh0Y2HE6N?9G$WsmI7o=4ZVv6}k)(3$r#^PZUK}YkXL8 z4q7=U*GZC)Ks5usrA8v66>gF*zCr=wPC@-zp~R(4%%jYLhVjU4?7D77|oGmgl7MviQO70qXx5j7IJEZuhr=PAvBeIfaO*uz}fwSUn(t zuRrmLjZ=9hSJZ^=bXA@x+|7h)W^j^@9M=$r_Kc_a;fRz4@%(~GiErL_r2iB{!=NOe z%(^1)D*X_>`HdTg>Y>RX%!xPOrs_1{e|k!hQ>FZ;%rVg`<*x=c#L)6{FscH{ZYXe% zl)@<6+shRPmK-XOKOPLb{PQV|T-XVb6O3um;|rr-g%f;s3SN?$wN(Ti08 z6eU#%>2lyF&WF4k;)3Xd*UB332NDF2?<{21zK($C}nucGyC z%@v*k?KUuAbUwHa7dOy@GzUOu4}E{AXSqwhbu;4KFJXn=H-fpQM%BFh{q>*rmgV|{ z_9^8blJI2_9M@12hul}wCYI&aewb4n8{*c&zhulJ_!JKcY{fFXU1!Op9;AVb)aPy# z!?F+7=OcDzI1&(ti;#o?ey*EMzJhD|zutq7&Aa?bY%xBgb^^CUNf939zec7%si+#A z6~$-2XurxoV!q6`EG5qO2*N-cqeFae_NRs*oe&Z9IKdGSm^eef-PiB53hEn@E22PV zS()1KJ@)hW`p`T^xqE76hZsBk2BGC37a>MdFKlBpH$(_ysnPw2e@kC@`I+1e+o6d6 z7_wt8J&?T-*5SJVBJ5#LM=jL6%-~Nlv^-LB8gb=W8jbTB;_UQ|nKgPXS6UQ)?7SZn z;;~FHC^Xxs$@o(1DM)h6ML1Cd5?%x2v&t9&nBLAzCYWOPrP_-j$ph_!C|NK=b`A~e zM7J7K${><7;++cJo(nZ1;PEt6M{%_!z!pVwsUMF)zy#8y!;a4O1- zj`%74(4ZF$A%4VU`p}c3Y)mC2M!{(n&K%w#(v#!Fk9%-p^ zC^#W3B$Xc?*14HKaC!;KtHVWsE6~G$YcJ z@=5XD+M0KXC_;^~-U7VFBDna~6#I{EHxEO9nO1J#Wkonm+1nBh^9T7Ql4z=*J*eSra70jg|=9c3|3rCs*ffS-daOMfEx0oHj**`<* zx7#@DZsIthnkNPSlG;QjMvGw(UxPRSE}{_yi!a0DT-U(ZM&!ygIW{i9px24wB*v(3 zN)(f9IIkhwN65Z8Ksb-28v@l9k?9~3{GDM?=Ck`4E*~azw}Pq@o#GUR>x>fb#9ug? zn~LpBYtD%52EhJ)-9XGuZd{ho-KGItPUxhl!)f*E?T6trmJXi9jd=S>WpGz&_`Fs- zfGibAo3YXtMP&IeZLyKQ)%_z@$g74?v%DWa?*Hhpwh)k^`|cuAgNUXnpW6olMB&Mk z#f!pZrLXM&t|V=2?i`kkH!4en{H%ECI^*>iKmS`<^=3e?(9Vgsie9mZiwnfwBKX$D4fY z{#0svaE-J)-XMQwD^Dc%UP-z;M3LWlM4cs2Jyl*5Yg)(xoft&_#>A~yfuev*gaW$6 zs4_Q{jwwX#=%Z!jw`l9*bGY$LT5PB_iiObrcUjZv#le^c^gCS9x;r+WujO!R^l!R? z6Ips4?7wZz1k3-VE9P?StEBIA2P99ohMkyhk`Y*obby~u`q=9Mn~ZyXm)F;=|0L0( zXSUOU?-47)b9(L{1{lwvfKP71`9l^hrQRyQ4z-`2CayPLK4%ysGTgkM!#`T)Ie@qd z=l7X_thnGzeK=FoArf~(Un6Txk)zLs>=J_-B22J&P3M9I)ECHnJphhCokQ6sK9Car zE`!#4WtVaym?OaLu%^4_*UWne@IX%}!_~M$X0axFMbIT>!$mNl%@V3};s+_@{QLG!56l;{vZERtsPJ>dA$4^YP>#|Xo30{<5HsJo{}KNo5EN=z zN`^tvjiX)Zzd^g$DVGarN+PJIub+cm);5XSe&+1oWUGL_2mKWzaB>V)PveVQa$ELY zH(ObALi4HL2?)m1;`vw3EVsDojT@MTQLAK*F2-9`DP3xSdnC+X+CVlBfE@!)M?ll+ zRqG3*t@K6n-cnJ=(~dH9=;owx=kPo?+mk|Tso6(qJ83j!BKa|m@FpD|JvPu&sO&$ zmU=5n7lbn`7;+^iK%`=Bj0nAb(DhOm4xJI)XQu4*;HaZZtZi5uDM3hM;H0S<>wUlN zZVsG(?QXlX!hh^;`8t!To)u(l>eZf%+y^F zEyf3otVg%t(+b7djoak>uT>R}jeH14{0fS#3Fj}0=we(>!~~mgNm!;jw^irHBc!FF zV|a^r7G-+zoO6FL&e-bugd&vX!IDHWuZ!XUaS5j%2AQ?*^*sg$QI9WmKsmESBiE9U z-_6vZ8jQ(riwk7&`x7Xn$F%!r7?5m`%SMxah_QH`;p@_ zwFBAJd7Nh0l+ngWxPP96+rCZDkr?pHe(yjtIy~}R_V=QM+DR`4d+M5B34v$;R{505 z4iu~IFAZB}b34B1nbf2WKjqOl_<~_nvSPVW;Ka6e3~ZQhbI~k6U}}UV6+^tN(v|qI z1U1WLhdudSd3-+$M`j;n0I!G6l6=A~p9F&NzGGQ?#z_~Movfae4wyBI(uW4?g4j9;_FY8f}LPgI?P=^C`O@C|+qAq;8Ko z`n~@_IYfDHxQVKvh|3MVmTXsUbVD@{ATtYC{~Ua0z9U65<&7eM1eA6)>D~aYpFB3+ zzgyjmhCFoxHJoRv_uYjjq>T+;ti&eHqZNn-o)t?DCoRIDZ0&9c<2lScUUs1;P2&jT zut-d$scH$gs^I@gE#Xwe!bpojVW`xGK z>Hc!+hn_;oGIuoPWBbGWNagZZR24{TC8cjd3Z3HfQ6jiqrWQr<~TvMG}ZepyS?r%g^&enUYOZSVgF34O0(;$1k{qUOH2q@!5p#+pADNdd`b#4Nlq(P zL!9EDi|Qoi3E8$`J6-f>AoHxF>U#6mxD=rctmn8s=p~0af735|)&}edE@Hkft1l_c z$G%S#1=B{KMco=s3#^3Uv{W{tpG*=@lIcqVA<%e2v0l=`6+?ipg%{lj%`ejuA9MO8+>58itxoxTYOe(3~1`^lIS@T*fErw3*%Dg$Y zVr?FuqluBPnS4i}rkCLVOQI?ewq|3$#+vc4Nb8RNc820QvC<@tq(JS_G{A9Wm4~~F z*(u}(vnCz&}ihgtd*`D-4s$Y7~R(33*iCvOvA)YfL_TOe4| zD4lQBTEgU+qnC2{Xgo7UXX~!x(f*L&uCxU6H9|e4GcfQbR8tQ6q>fhB92s;%)Yyl{ zwlPbpHfE9?$xrk{YF!&H$iXxjA{*rgRKqifF2ZM1vkOWa?S@x+00iUr8s~!8-vKpO z1`dGT&0U*kz=gEU2j%*&6`#RV#Y903?*XcqHQlFNb^LD4F6CC*baLxr<4_eKu^AjI z0Ck8&sZf~M%j$zQ<4QhHwOkbvtXEcat-iS-bwZ{}W>2>w+Z3Ik(=n@T-X=?SL2mi6 zdCHHTYHyYq_06ynymw{etiF!M*4qpzi|LAu3Ex>QiUAzY)Fv` z!gBtaN9MQjOCg+Z`sq5Q#!XIDCg4a!r-nb0-8u_o2Qp^{cA-*jLdS~co{DV9gb)L| zO90)IKz;*5q59!DMu)nR)z__1-+OnRxE}Bv!bF~tq#;Uq3zb6@Yiku}ck_F@0z7Y8 z_3_SCYrZVY|CGiDxu5jycYPuA#vdRjS!9w2SGf2 z97^Qant=m;QFJjC0`KW?#o*P7}HtQtp8$F_4;hEzeW}B zBBFCmO+hN8ci69@gOo!TgDG+?Y!YiFxEST*?jI^czC+p0@{4Gubw{I(jUwi{XV=aUf3Q^=e)1p>R*cUi(08$hjgKL z+_2>pD$8lTt;=b_O|}p9b9**`L4gVriL7e%1`AN`(gPzn@$r0eEV1Fku@Q8chK(eDT?(RpTb>$%7d zIM%>LKDAQ<;jm`U2(x{9Fl>sf1GShhuZdZAHr6RD$*fe3BG+b;khl+$r{94X|JTj5w2xrYAGsLtn(8my_{JZn>UJkG4Mj_ES&xc z(&9F9)hY%$-Mq9VDa&Y!L`;*Clc~pG?Qw>VbV0rcSV77}IWX0935&5&ut`0CMPoAU zrUtbysL@HSS+VTX?Ay}N50w8DK&{fVX01;&$yKvn4_q3xf*8-5)v$gaMHJGN-X9dL zOUJBE9#TIIJnoA_1m)h-rL6y^;=S(GsJ->sKFFP54`diA?<^`D-e;B_G+LwXNzzE0 zck7o~wKSBHpZ!JkOGm9;W2LQxFUJD|EzYPMYRaSDM{>xIl)SaiZ(psky{Th?0-||b z@@v*yI_LffcAsv{r54?LOxOFR6t`VZPVqByx`WCV>c|=M!R^He+VsYSfM{Dq?r+C@ z^b~OqdRCMdC|!RT*;X!kCf3=XdW&!T6x}2YyvJg00Y`and81X~(V)B}kSc$KzyrnV zK|t^+&98cT#%Ia2=hmtSzs{D#N2-)=lvS=H1?WQ}feB^Imz(3-cb-nRbmxG-eaXOy z%4x7o^qE0nER%0FS|tO>JZ?uI__E9Uwga&J+0Xgg+XtV9j(t7f zv^$@wcfms84v5sEp}qBtTo8Zap4sX6!ECyq zA|oRzY?FDd+^z<-o=PTjMGiF&W9kOo8zhzg5no zfxfSmv7-s;XZ(K^Zi~pyQ`g26R~VgKd;zMe4s7nzLHe5}9EcKwKM5k$d%=fcOGF(E zs7TZv>f@7A^*_bk3k~^4I;?^{QWay5PSYz~9+xqH6z*aIbICwR4uE3+BW5^6TiIny zAN7QA>Jy8^{+tI~FGQA=FJttDs}zC}qo#;2=2%^?xRa%Bm2mZp@+62km7XuUSU4dj z-(XIIf+TW~JoChg2;zBHgiTthPd_}K(`k*w7luaPL#{<9khLXL$0CYFMoy^Z& zo#eMx6~D7rm`hOE>Oon9vkOtS=5&0O9=kZfguQZVnXAE*gf`$3FHG%vq;)nv{jkQj z&6tsLMe?^@3QL{;m+p0Sd~5jR>GADo$2S8rP%$_OIjU$SG!>YJR-P=KJ|Md}>_HiC zt{D|ha)Cho%l1nAL}~)R4_TmyOq$aGc3Dj89qMQ25DJpG1UdO1w%4Wi8)KcF6Tu5B z5(G$9CNcZ_|2Aqo&d1k~7AgaHyFqF(O@|1)r6ayF8XVU`14q6IU$@45=ZSzw!CU+J z2`KmiSJpVIOHsS-)?0nE?pDZ~Q7?PSlyR@mzEKEpDyVX-Ts(Z!(91bN5=v&fIq~|T zyOI5|I`4eVbeaDO-hjZTot{2>+;!Z*uiwA=S-KRjs>x-0%QjN@1=TfFTY78A+qRdM z5=8#9aRj8fSpLrUY7P=JnFz{&Z0e5u5BKIc850&n(UmNVt>Y{mPG6LN0VIjZebsH@f+ok#Wa?aQw(j$xP_e!LCt zdXj{o+Yy_4jDc|GLfIi8Qg5A!-E!FY*n?FCv0VNWKFc=f0#TtjEgKiBf*r1>XR2!f z-(vKtC@9BglZNjjOzud5TFVAzKWWI*ai{pljO}ijR@|dc55k(@KH{4|oHBTC2~tge zhTJgC%?}o4qb^|m)v%Tgi7EyR6@nU?q&m1*xrq=0n1*QfTl5bsEdhLx3XK@ko7Mqe z;QUK|`6&ys5=thlcVf_Ff&D_Oi8`ono&(SZ@mkcUv7a$LIG`h89YvxWE;DIdY-|}MvGpiug2<25GwEzYLT?*VLI{2Xh?A`_@kF)v&fWWG$c1lXX!(?NmLP< zKxWP*%5Gt?Az9M(sZr;oH=5(u=3W#6Ykzc>>7;A5N%7^$Y$b|GW zBKD@#N|PQ)R;gmxhQ-Oz;mY*I*3N>jYDT*X!WSzV)F|iD27OYU-vNPaldT2VV%LBE zHVwUMBOtUBoDm6;$ui;uVfVQRLYexZFh%wqVkA*QRG$9>lA3AL4YwaJ9g@D4koEi~ zWMl(vKvii))otBd7(a9FWfR+ez~x!g3!T`kl|&wIOW70SnNDX3oIsz1-IVnsksG`h zBV*iCsw8;kn#THS&d`(XH}kmTIw2#t5p_DsPVnU8U6V5X5>zVmcYjCkfZMMsiqe62 zV&`PTc`}S7gRutgH_nU7uayiRo1Z{k3x4o&ex9?)B!fQ{kcbu+zKE8NI?r&Rwpwu_ z4qVci1U>Ztv+gs9UCQVB@!X*v-vp<}^JXqY&$9IU%2`M1zm5LO?nFYE*Wba#sh2tR zk7s!PseM3x3IWKV?jP>Udyl5n&0)txirx$oH7uZ4hpIfmSF6 zh*n>4ypS>&xx5QH3#bRK=X~o0XT0ypWha3fUCNjZR3=1SLkwQ}M6M=zN|oOccDjsK z`k7Jf-%>3KMprC^W1clwPm*+Fwz4j|98V{{hFt0gTOhH%v}tj}j03vK7CO^N2awgj zd+iQ7<4%smBcDB?ho^IN9K~Q$E;#0T+1f+d?X)}5T?%=>l%klSC{e60i5 zklVuU$w?=gO=7*(ivTHsEX-M`^4}eo#8Vo&GITiqoYga{5OpkcD$Aw~=o`52?SEA*k3j}@qyRW8m=C=pb3|=Dcnh}nw3y3WKCL<4NjAX8}y9LjuQPTxaE*NRF&fj6Km;sAX@b*xuA4v2i zd68BU?L=wD<&7^tG=lXwM#emLR&UJa0KXxD4VeI&wq-Z@*^=+*UrQ2s5krBB3YRoc zFD;_|l;C=W{et9ZFYF|tlsT_S{R4!$^6GP-{N|T|YtI_`Ftcrd2;Z6>i^(s|=RS`6 zR4u@#wkJ}^tWJ7R%4*zDe5uyd9~`KUG_5jM2c4pePVKTf5wa}z|`*NM9>&vC4(89koWHc2etG>eR= z8`9C?Xd65jFj4k#i}i_rG}SCvP(?hpBPjTjQ{eJbGp6ph6=OOP-J50=30s3(ckM7v z4OG=aGba@Fo~;Ez2=-NR8jrVS`3ueNUUVb<{1%WMsQ|RFLE!9T=xSnACA}jNaVYu zG5(w4us7V+;IJh$CKvu0Ur+vLHL5*?;sb3G%!+O@27-;n?Zq4I3sbiP)v26~TY__M zVPI(lH~=K`uVOkdN4eyb4R#r8OZk%@e0ja4)~H?dM1J@}>ND|ujBIHwoW;&pg9)_Y zPb+>8mJ~mOp*kairY7~#29|j2QDyJOB9^#l18TxkuikWJzA_an%)?>DAsQJ=qdVCY zR8057*)((}e;O3ZF!Y8H zDR@SU6T(N>HDElqk-^?YyPgJ zwP>Z{Qrw&o=ITd2JJ+kJH8ic( z_jd{_QIeiUJ<0dgQdP-9`5xXMW<_yRtJym;qfQgzEo*G`uV0MdEeT5#!RA&sz4{@&1`@wkCiHB ziQWA$Q0D=gy>E#=CldT|oMhoklFp3IN!8cwb~nj$4B>z96cYdqzvd%v%5jEb-y7mh zH?5yFF)4SPIT2@wkcdG>jd zB$`o2Bar4^L!(Mc>ACS+W#{LI)mUc1zTabn-Zq!-|80oeC>d@q44L3i=qQh|$LKh) z*SUEG53#w|gy_7-yI0TwNGRbcu@@9UilBe@?U9{uD@+KM!XOcSF5qSXtj_VTDCt_pq?I*!zM0ez$!?e@V7y5 zEpL7o!b=M;P}xzjj;YPQ{x{J#poaM?p-&co+nXuxIT1K0xKPuCi%O!ybwl+8T-D=H zz+3m!$^6^VrViKZdc^<$Xwlr$+-}FWzXnVw{_4V*(DOdW%M_s~Hc4v%P;xH=8KbI%qy#eq z6{&(@BSDJ}GK$O9<3;`!_rn9V-9LT$Uq}}(`7Im2H23HvXlqw`f#Tg3axT*0dxO45 zb*1C~j_U9RaJ?l3@dFuhRHpxq>M!d5jOy9rzRV%Ff+G*VOt1i~#q;omSWW5eA%vh) z5w533YQILPnCx#1`ZEF)mskXI+141HfO~-!EeA57u2Mgug_@;B7d%V>@BrzLqQLK? zgVVqc3N%a@_WR2FBK87pT#MfuV0Q?Tsy3?>3BB!t0c8!RNA|(=1~ptHGv5%r1Cz<6 zg}JCB&s3f+_SZ_k$wu}*x7%4BU02z84~oHk`OEioSTPlG(qS&t7bC2=(bWu#Pn?%7A>MWC#Q`-nL$ z`KugtEr?Gp9SQhOy%{>1@!iTp(?vbXsZSA_dh7!EMPck=ruwL8e81ZC4LL2!n3aag zjH$o2m$!~c);e&$4f{AVWx?xM zHh-#=0w>FjKKoicorr1x_?Lv57lF9m!}m08zU=x2+`qDJ7sYYmFrbFG#lbI=*8{fQ zPCAc*dZF>{_QAP|z4pF;8};HJsaH_AQaFFvK7nmtd~i0D<*x z&*~}sYKUcHLQ*|$CK7i+Xz-eNLJ#v2c|=i}=l>-DPlw7vsqtLBtx}p<>kRtY*;tQ` zv3<HuPW(!o0+rK?^VQaVkJFr5fGprXFzgp247cW^XHHCY)*PO^m z9)<9jfo}3V3ju@xd8EjKClbbd0V2ChZaj296TyT(RHga2q((&I{SV_FcknJ5^3E?H{Uc0^tb-Q`;h$4mbuy&!%46et))#p#lq zj8=ZDa12)eLVHWbv={ao2bR(q@hmIg7yK7c;9b&aiK6o^z353q2M)X8>E}LO$`jIN zw(kCdAjd32-TD-Szoi#2Hqp#6pMnd-No^mJ>dYB#`pt9^$t#vnD#^4VX0k#_N+c}h zkyZLW980sm=O9mk@yyvihtGJJqwqq;ek`Wm;yP)2@H{961kZNMB4`fAI38Eg;kn6$ zK1#F+@=?Wts>dbWPm#Fw-}G+d(}57~xO1`CYz|g+1sDFm!MKpJ=k1mU!!mk#%hV}9 zdP21l8NE?aAEXAY28uB9WaNeqC14Nol0q(;|LC~UG4Xv!dfvIcgKfN-07b&6=pR8?JyZa1g8Qy3okNLI$s5Twjhzv5K&dS-s#i8Qs`x3z=3R?)XQ zJ(wc=6w}nwE5ew;ct(fwvI{vL^_oVPRECtJ&$Dp3+A~}CCB_i6B+?VoQ7gAfpMpqd z8ZQ}~?s0ZxMMU-#`gfc5G7*ZXT*C)=6L zVb)Shq6xQ;tK7(u%mEIs9$7@MzrD4O0^Y-$!^v@_Kg*R5&(7`IMKPee2du?bj^FMy@q~{oeXJ8_lj61eFhUn(94Uqf>i}-{SLjEO)-9 zlu5xVOzpi%Rra76v0F&HT>_GygoTwhik^Zzg?F3n)x{Q?=g92^(%e`0wwp+yYrO@+OY5UnLc{Jl!_7*{LQ1SJ;aqa=uGD0{;JM!i5?7F z&9yiDs|LYfr>T&6$3mphLDZaQm9_XqT$mb7jFYfb`)P97U^i5gfB~5|%!#qLKBdrn zfxS~h^yU3Y1+1}#Vc*=AQv?&sf5ig(&!|LU9`R;m6yMKkC;Xi)jfRTT6>VqF z^=O{lPBMIT@H?KdJe%|}NRl011tBuPMmu=>!Kgg|wK3mcJ2x!l==l@IB~BEH?g$15 zsR~~~^Azk)1FCpQHltsU$$F5X4u;rVD7Friu7lS)mqIQKmXLj%xrpfV5T7#NLj1`m z8=k?UI4xmIaQJ7?n40`{8Un6Jdpq8?SKfu{8j^;OsmE!#tT8;-L6j177sLw)-p-ff zV0Y!OjX|BRdGMmPJM%NNj0F_G5HiCwOkSI*7trU7blU_c3n#0h~etGspBd)9z0L47`+~9-wo}%*|uzt2Y>XfXP?4xtL@T z$amOIj%_5F6HsFMck?6eHn`oRLQ4yV!Mu1&94(bRKERd>-J-x_q>@PWtpv&@KAMe4 z*^%{%3}P}HlUV!7mQJrMr{5H+T3L0}8v~2s{<&i{Ku5mAl=1;V_Y-s3iXZ=qW9!yg zWx$@a#{KNhx+XWmK?>Ttz!g_fTg%%{@?P#aEDF}wM8S-73|Kd|Ly7gr-V$qNyVjFK z6btrDwRW;fYlqy3>+<`A33xBcJ3&+!G%O_r>^9YpDEdniIk9@3CcmxzYV) z_i_$3ThXBovUv8vd1j&>{|aJ7PrOq~No)LR=)(**L^}Mgb*G&L5uRJ^>RQCJ0l006 z35Qv;xy&k3{g;psX4;@YHWQRML@6lgnp7BdwK( z!kz#ty?p(L1%jky&ss;DDxFAZnfkA-E7SNC^69SLfSNH224)J>qGJyQTH?0Yq(ldg zA^6yJEy<&ZK|AIrdey0lGUjyOn4-RVbCgBHqJy*^iBrzAutri2;K=}yGQ^L06^gO& z1Yv_CDqeF0^_9?#nhBCxIMyWR`~| z6NNx2_f}n^A836?a)(?yR^kj{DycsLshvmh z_K484)Ndn(MZ6}$$RlfW&6tTP4C7*6PE0R)&nH>{4;+=y$gOx7-U*|o1_R_&oq!(3 zUBHel{$I_fKvKn>Z`h5gFP)@NkW%E+ilc7l)y%`^>7~@NXdMV{)pqa$+)uY_?p9@Y zKQnseOD&Ycsl&ADP*8c0K%C zs4>9A&4a)DI#3=@V<;Fd18K_2ud1M|J@yJ{B$oaNef!JwJp!0_v(G zT((tIK2=TJiBEOSA%5FHR0Q2U3zzYPd%lTCWi>C29Lm$lJwUW2Y%yXrsze+awT@lNsO@}Qa z9YuBtcYzc^2ls(ZAAR&VvS zZ`Hj*IDg{uhRXYK$>S;Sb+$;qI&5O-=F>PkM1__cOy}Ir;(cY5=K8g#Zl*`zJI!B8 zDG7*)p!`94Ff|7h^8hfA?F6*6tyW(L+8;|_14`#01cBd$w5YjjV*dU;-rB9M7SiaD zt1JXn8ePBib3(l&&fWAPz835;fw@JJr_`4>;)8D)WTSG1yBMq#3 zvVvWf;OV9UAXt&CU0h+O6{BNCNM5GisJh{M*@!uCK25hJLkLu5iIdU}6v&~)k%_{% zVm>B90XczXOyi8^>uZ+^--&N*Jimq-4sZu^(hvsp|{^N9v~S>2X!F|S7lY}c&@ zr<;JLxheOp`$UJAcA1f$%H8(b_^8b@Gnvp^T_QmC2dKvKRjZV}SxE(47KT=UPg9z0lRny4Qi zVxv@L95Y?N+qcPu>NKGD0+lAb=uTe8Qf)hBx zU&WQ#B)c@CY)wde{pRyu05dfi5Sj6~PZ4`SMlX0C|~4;wOCx@!5@E zf_$~JfsTLHxxQ9mC`v+leXi#}QRZr6wF=X4SCMF|ut z3Bf*f45It^=@qIxeIH*4{3#Id@}eXF@bpvq3D_LJcX|=j?x`FE(-EXlDyyc=Ex?RM zOL;@|%ZJD1N0{nOL8+WRJ6g{>#7i?z(Foz_vLi<*!ihyMfAKr6o`e4RDG z0%b0Av+LWGQkDrQ!K>u1o#s`eVzi0r0^c4-=R{F?NoOCIl3SLLdvq2dJQYEaw9>a2se7-9|8u zqb-)X9A*#5#q9wluzP?y9{181K1$9NI6j~RmQNZnCdFME)Q3H)D7IxhJdk)ec#pOk zdXFYilR$UkS`~AshT}O(bG!_}OrRbG-Bsa_*rNu+2>E@4XyS15C^lx>$t@i1)KLwH!*a=t-@I-}enBxA?e3d-(6OaLL0aidk z$*KAM{EPx0V^#hY zhIWOtBve8chIs*SoT0^B$Ml+yqAj0snu|I_i`_L_$WmHywzQ^kL);=dJ+|9i%S zD;WO=dwa)H{I}zy<7)oDk>^$RNvA3%T)CKVE8J-Ow&K8LTwi~bAZ=N_{pkd53-8D& zBC~)^2X=ez;mU;Gw&|#4(dK6qeCXf}6?XYMsg#a*t1_!gh#S0OTq1T!Rcn9N3@^~y z+J3V+*LE~^>y-U{W@%q{wD68VT!zKM9J>FI#I#U!Mk_{=a4zyG#~j-R?sQ(tyTwnKXz($5T4MqAwo|f z_7r7K6=zBzn=+B4xEs&wylKas7F$J`TKALE|M!gbqo*`$oE+jU|3s(}&)mLrP2vP2L${${n|X9!jGvEb1MCOHrU@a#+n_~W#KFtk zpw+B_f;i-DaM%pP9IX<(yavK-G~5oSB!^$G0T2djSH_>J!fQSG@LEJ`PXtS=)APVf z#nqzra%95W72;}T1ih~LLhoNLgccioQ4H)jRMue_DvPE_gt<;c&^lB`+lt7BQK<_E zCz2&e^Bxy9yBI>6$iGYo=~{fE>Pm0hi4x*NT+CHd=(Ws1^|Y8c#(FIg zq`u98v)_g1iz(&2`13TCM=t^~=R%CTUW*Ty#moYr2rAzOdxu1HVpMtlE*Vz74GvY+ z&5tWD*EtzeKBv-I;o{d;>-}cB*7RLrt)E@!I3WTM)x~n;A^NiBQ9%U0g%@2iTl<6~ zi!nj(d^hmgV6WM1)@mptnW207*s?8bL2kMLFn!kxf7e0h^pyT4t$X3vi!0Z~KUy|K z6!|Bz^{;>*I30BEIwXPo`Wiu>f_*ouD0fdG%3bwjJ*oNMJ!Ac;p2Gcq8UMF+bbL_F z|2FbGT>L+}z*fcjTYIcOD%UEm-wTcFM_cz%WB3)s@1qPZ9ji}J21RlCLO$ZGtD zR*Fc`KwBbeA+5!;jZheI|BXZ=te#CjIsQNSvu;9!Er%Vq^aFdPouR`0{{#8{Z|mr& zivPHgXD#=CAMP5M1M!{f-&oEx4#s!e(rs_1@AC^{CvgwG3ha#g!|8Yjq;t=)jpR6y z=`fKwQ6lN;UCMd+#_o)TSBYmX!pfLz)S=Un&YdCN1dXhioDFnqGz@m}w_&@6Zr1?7 zzCM{)2H!uS&4BGFgv{JEVH@-Z!~VtS?0R_JIj!ysmwSrz|E=ZYK)1u4*_93k6zTtC zdH;W}by(s5ZRW|-|CTfLAwo}F|NqK*s49E}o#t4sGqmOqVSVnkffLwvu3@0XgxfNe zWmt=4nCckb=?f~PdS39jDZb-|L`a+Lnv;*F!+0fqilr*qntU6UX|<_Tj{aw7 z2IkPY?{VOK{ogt`YVOJR{|>7Af17z8OR?*ohjybN4<}JqD+vE1FG}4%(0iq*1w|bn z;1SeXgnUm6P6qs;3iVVFY{?iv@_KNTb*YtJIncWt4+e#xluWg^BGMT>tU5)0Q$ zmBe!b>1PMgFAAWa3S}rC8c|Z>9HozL9Ii4rLz!&J5mVO}EI$<} zKM~VDxdxw&7m%GXGw?mhA7@U-4<+VoOBrDE$B(9S1*aDAyPyfS!Pc^Yhm)gTze9C6 zM(XgR*+g6qI&e%WQ0GtE-j?wa=5yUKWw3u*; z^a^pti(-sF0H0Y{7Ar#)lnXqqGVmXCKa9fIt+gzf6Xw7Gry@SRe%fyUSyMJVre374bfbus-st^89UUjw>e2F~5GT$EGn) z?A$hL&o#FByiJerm})r$uub|@*@&a%3Re5&)tbC<3NEd4=S1p zCS{#H2TW1P5^EWWMtO*B>e!Z!1WckjusqeI!XEd%gz_hu>HdRIhx~m@iSNhV|H;|^ zn|b;`C zQ?VdOhg57ClB($pWtm6$V0GiMJ8FsV%02-q=H>0W#xtT4o4PAtjj4`REPG<-v4`k`J~{e-C9E&iQ>6d* zS_d-zV{`AQ(*K)yzG3{Y$_iBQU*G(b(*O6w`cgdw`oDRYj{kaiRGt6d$W!5etr7pL zaf=MsguBnkWlW9#dt!a5o`Ugzyx)??|Ne1nuNwcGcwRBbr^5OwhxPSjqgR(h6r&^j zIbeyYxGsejCV&(?3ceUC_^DutZ4xU?5mZjjOw%Pc5z=hQ(aNJd;lAV-Fm_$iN8e*V zfC;kV22cdM)oLcw@J$pMT4|Md>oHMbn<_3iQEmazDA!@k?z2N*Q-meI7wlRTqr5!q zntaYughS(ToVE66jUGj8Yw7sR+KxtanAX;!@XXrR9ZeCRS!?ed?r4ed%Ni(tkA{H8~(1zg!(m*B@X%j>t z{?$2InW@ZY7R{Xq|1S{;t5HyR7~wxFcPR!EMAG*ymBS*josl3P_i~bWt#AN|k|~j> zW4&p>&iqvko{i%_uE&I|+kmX!d_0ixs8A{^l*;FVQu%?| zX1-f4n#3isDqD0Nc--21+E|sXW=XKhgJr=g)s&TJm5lZ>ppWFE9^e_*r@8o#ly2`6 zGy+VQ4Il`^NC{LM)O8L+%Si#O>c9wmJNl!36a5TL3B6`YgR8zdIM|ob6W5HCSiBOP zA(}KyBsRPOaXe=f&agM)RON1?lqf7$CdxTiRS_F|DxVhp#VMr3ScbV3JdV1 zVgbf&{HTb4#G5HX1&mo;9ve_r6om+ZDY<+TIDyNc-o+AnzSwukI#dXF5AqcHfAPze zvEYjK{|@#f{D-}RR;%*=Hu8M4_-}EyzCQ|Fys(vFroORjgegQglI~MT4QQ;FX`+at zKRTYp&a?}6{Iv=$?xCJS{l5kjpnUz`+CMyK%JcuDW~Ki(@;o>EAJw#X9VkGR3V&=w zAmuEO5#Y-wYX<=mH>B3YY9X`W38Mcz65h@efgEBvO9S=fHvR@dbre(lWuSGkXV-aD za>0oF!0DiC1bwz)nf`X}I#;fXqoW83nXQBm^FpHNE)DYoq&H6k=SPXwBf;;yIXE~d zOtGIF28DP#sXA0}JNK2-%6vXeEQCh_0jiL3zC~o53fbkwAiKOE7h?&3wiMt|=p&Sq zYz0K4B3c2_R6sOK@LCdxrb2dkOk|fAV>0e(F7A)+@^JVrW#L^E=q^ivyFB?D$%Xqr zYe0c1*#F<#+mrEMj$6lv)&9>Wo|ljRlCxt}?FBtLB1}%}RJbq|E==`2@Kb32`3Wp` z7jZRDpy>SHaZ`%_y4Tu2sNz3wr7XzMvBG~^;muU7wZ2tpnw(W|HHl1 z`M>5-75{r9&lA9RN#lRLiZ2* z6(6wUz~Hm#9 z75-PHz$+}UZ}-X2|7%47E71SVLplCO>+q=B|Jlq_;eV|W|Ld_EbA=~k{I3-StYG{f zw^I1uhZX+ohMrfV<5Qu4l|uomVwm15hG{vhGWV1D9FWS&hOf>-BP$ia`f;GlgyNqH zpjj9tFbid6lYnOxklBj`GRurydoMV%D2(lT;LPABXi(55c6Cr||DhRyZ)-bR{YKl- zN`zC@{(Jyjtrg4;j zJ_mw0@TmFV9uS{mg~_?H)*Z7JUJe4bz98Adn7DK+k!x_2kCY`MVMSQ!yOHkYaURg_ z{o%C4O4P!r59moCYcbpp6{^;1vRWEqOO#C*)BZ8gwwNHEG}6}7d=&bBt=M1xr%?az z9q%8d_WxSd`M=FPo5la)ONb`%*e&06=#BZ%Q)i`d-;}tZku@L_*n~-04GpTX8XQz( z-FQ&h1k->}bBown7Hxx&vE3$w80P}+}hhec*W6OEWBudYhqvN zP670>HL)n_f#E}{BpWq@;;wW8ge|AWBs^!=b}5aYA;t?ZgSrWQfUN&O!ohffVFa!s zEHx0@?$8`pZ07nC%{Q?A1KZ$D>-z}9Y4ER8K;|1`9YJ7Px(yB70Pp7u^wE9~Tpzsm zrsO9jIQVFvj89miHlS&gbY?EXAn>h5oa-kVgm%8D^NC5F=5B;o)~e{SX}ZL43p81v zs{Q@ukuo*IY=}~`yXC}SDpLmt`ce)SL@hH1w&w6Zt|R6c@>gweJ?x5^qRun1Y$Bg< zPd|K1CxEoc8&S(QC{dHL5%w$)6&Akv(XwG12wvH>iIxDgEFLS3*}KwNB+9kHW_ z&{;(L0OA8Q!29#gu>WgsblJNa^asPLzi)*5 z5_F)dvT`nH32YBDohU-bqRacBt0NsuY<(K#MS3rU;+yC;f)U@*>N49R47c;>z)p@> zc3^>a7Jd|C<_5M2#t_(Wf4sqy1Pm%Nti!b@ zVa7#gSBx?GKBf{8X#>L%3uUKrNU>3D5HJpm8yM{Z&!Fugc4!AdG6keX5sLuv9fS@r ztqGlCVA0Am&qB9t_YOrX)QG|1gynEG%$K{uIblqWPB0PSjd%vUw}iQWpiEv;_LHjf z)a8BEoq+d=m{9MdLLxF?aPkY|&qmZG;-TdmR610LvU5!V!t|sh6-0t+1N0p*AD#|E zhNF#q7t`fj;sHtAlMXKEQ$>`ksKdwN5{4czz^-rM1z$_%ZAG~pLjWDaHKECu_DJrd z1D=Eq1{+b4Puzgc-oe5Re4$~k`(VHWe}aF4E7!%K8yCJ(eTn@X{PrUr&cAQ|``2^Z zaQ?^p_uj8R{Cn^G*8J_T`LDg%Y&*cbhorAi zQ_R3w(#AN-O-wIfBDBZ|#L!`5$8wNmLeaZLY^X%VQNeP>N2P08Qw#6VpMmE=-yq!C z5M$`Gx3+sn*oj|L-9f&f#eD4AK&pN06I}j(2;DVf&x0^x3&WqV8B1ho0fcobsSHF% zNWrc!-t)roiFJv2M*->XlSfx zOLQcGmplFis_f{Kpr~SZDE)|?T`XaFS?!61~`vwqBWtPNR!ZG z56}c1x{?Ea){PrqACDz;!iM;P`VQFVQ%XzC~w~q8%7=je&j>+#_qdImI zy^Dv&Ez!&Pu~)$5Og=M*fp5VJdnVy}5fx;Zn-v85CrddroWDeKvsZl%%1WxQX&I%3 zI(~h{h7^TjGh}&wlKe_#Gva;a0R_&pg;2r5Di}LmLBA%(YI5P4?u}zcp83{JsMK`( zPG2B^u)g4{hWg@xyE;oF4s?E4f;Ir-Rf`8LU3H9h8+m0dM=jE1y{VrL`V*$Q`B?{= zoc|O0uFR#=Vj2_ zw4NuGzND2_Osn&Uz;o#P4=Yc$Y`@~5Ql7?IWr$f0)(t+=ltec>;L<`-4!C@ME-C%w z+j^beq&xXJwXDzpr%=CzqQl54OY8YQ%T&D=s`B18b?-f^%BiV)%)@j&=$Iect)u;; zs6pwaDmuYnM(1b!RtGM-LskF%_x73o>8f)U-^HOM$xD6CU$%jEeAsA46n}7C8|n_* zr^Mkre%G`R-NPhBkr@CxAxz0#@>lAu%z+0DYqDUPhYq%Qm4`SsbaUbKq;m%p*hwQkX{)u*_yBv02@r&L4H zA;I@){wwh9f42XNy!z*wnPG~+CqEnPzp2HE_R;?F_o>m$7Xe8_S`OoV-K-%vK(;ja z`N4-l=j^l|y2jxZ<9~qbKA1x%*Z~k5+)>i!wpxt{yWQNP(7o{R@JiC=+`t7Am2N5f zAuIvk%`9U^J_$z?L{BbeX24Hp#XIJwu5ONXn@nf?Xr-AL+|F+UdI56=+0u5j8ycb$ zkP_^1$25J~_rs-R2m1>^X7t5pwpijWg|faLFbeEabjS#w|I+mW3t?Z!t`7nf5Vxq1 ze%7I7hHn`y*5q7;WazQ{ekI$I7w=R?jp+I^wX7?VGzRyy4Wf&b$&BJ9&l&*2t$x6DOsNt!twm>oVUF=!A;+6Kel!vS~yD_FG#Bof6 z{XmDP-&bJ3bQ?7JOqpgyK=&cAO>43f@5TN719F|6aCPbL`mOKo2-^qzGw}`R;Zpi{ zL*!n^`j3=+o06{84Cmq#^|JWvg`awM9S)95Z+KkXLf^Mc<{nJ~+dh|HMhzVHF&3mw zI2tylyQ9z)x8dTuye6da6zExRewLR@(4BzK^93c>2HJd~d!F{SCWozSgU{e=iU}bQ zU1?4f#gj1{UMgu=?yiMU0ExY{Ax3=Jqwe{xseNq_Hvs6KM-91t1D%>O+#Tchu@Bup zp+|B5Bfe)dnn9Zko(A?F5dY_J@3wWTwhQrd)RN8qOHJ+}{R0_qGqh1ROja!dD()qg>r8A5jDQZ0M zg{VQt07v`ur!^l0lZo{SX!V#FbQnqzW3NjWn}8mbK@{c!d<=Bknpi~bcpl$Z{tYtf zG(9F|kV+shhK5eOP8z#Nn1s;kPH5aHW*vyD6IyBufvxd^isIyaK++PkLwu|4My)>q z{MrE{!i_rOcdqF>>2w9q5zr~~oZBqP#(+8XbePcaV93Ug_S^D} zD)1Qzf>B9Ea*cRRyj_|>&$k>r0ovbC{clK1J8K6Wvc}S29?_m25q};~I?_ zW~;N?mnPCOYazB2AVO8BtbvBQJhbEi@_DIR`yV+6>jVU9KaxlF9y7&%@5 zeB=>(Yk=L-h$Hu=gA<2PheezV7vggH7ovR;eOfW?nLlw3ksE?;2<$Z$P~Xq=Et35AIVG%XVl_^Si&PA!CqTxgV$xU&m*pvnaV zpwU$W4M>#U5_?IwjoxgrwMZ@M`r81AA)9NtaKP&ZpDp4wrXKRUEpuB}U^=sXmoP?K ziE?aH_m(SSVwvvV5+%^|%N2nPYraGYBzZvrr4TlFiE^h@Hjj|+i@IEZ-Jg-`#JMVr zxb;7|^FO}V;JY>)TXZ>PrKkV}^S`~ry?q(~?eL(A|FV(ivG5)Iv2HZ@tu?l8F5t^C z zd|0P0v2E{=-+?#vbrYu3*6*M-onfsFG+_)&;_nvLzgDl;Yik~T;*beveK|8cI=NeE%nHV5o$U@y3k%I1 zHg@t9a+Eqg=urYA?6Fn)Qcu494<`)wiw2Z${}1-}4x94&@9}XJ|9>OTqvJb8kqBb- z0&+D4KO1k%?~B;?ZJPJi(>L!i4CJzrhq~vZpL@gMzeiWSe_i(m!_iN@&PnfTH0b|N zFM-c4E`_Lr6^RRcgq0HuVc!}D9D1^QK04_ShFAR`u7~}L^8|4|2{(ltNoq;ZwP?NL zV%+=erwp?OQB;_k48m!>ITBa5U(@JMW*r8~yy-FN4wbRbN%EnoxoPMzAv& z4X--qgUgGn;iz-k?+miY4Sn6A$38o@MWaTiXo<|_l8QM~(0WA_4iALT8H9&`bh?{j zO)MiqvbceZsOZ74GwgRqzw}SC${dg`XYgWwfs0=(Q*Mw1Bz?{@mf}>I#?B0vUd7_4 z2-q^#(l^H5U0l37?TtE@m#6)1hxENs_o{c&J0JEtrx{XbnZjV?Qb!R1d^ok6y}$i383t~BC-j4rQwKlXoLqDt|#hEyrti}N4* z@0OQa&V`b4Wt6E&-UW@!PMv*ABhj~sg#UFqI{9IA((j!1y2EUF3LymLygywG3NrrW zqEs$oH}i8{x;{?#2$q|9p?SH(ZA&rN^`Li^pNqy4k#Y_DXTATqI4>wKj3JoFO$Nko z7gr~vAN!}d`4dt5q(0L*>0Aya#xpMgNh7B)Z&HCtCI52$L+|RmH|!0lzz3I|ZZB)H zkTG=cLn6%udvn&gEEq0|SZz6su{Q;}L_WzbayjhuiFrEf4Lig{Wl>VauS-?>tn>Tm zs&h8F>|J$x=flps?0%EDos^bdr~6ZHH2n8vHi38_Gv$C-6ME)e>N7$_h7gD;Ebio@ zdwteBAC3mYi>t6)8ZIT&IyQp&sWZ4tg*eG^m&hEZ)BWYD^TQAQ;b`#h^X{mBKI~on z+Bwah!YCsjC`FQ={o1!xTwGt3DVsvErRpWhOhMAnaTHHM16w)GMSfnfO2*LrU>j&G z_(D|l7vQ+U>^~vglZ&%XUpZTwd^DX@2kcxAe;N&XSHJeIMn81Azx2*eBBr-8_e9B@ zl!sgAe+}p#0^3?K-(m5c%gfQ}#k+UCs{vnSEmf-Lox0O0^bwiwf8l$n^k;N9h~zkR zr$Y+p#VL$zcRFGaUz#%YDZGWYn3%%LU*_3(ekaCn*MOiq@EfyfW&MqgJ zH!M!hT2Sf$L5k4$cn$PIZpLgZ~W4`Rl!WGSDjJO%|J z7RKIW7Zl|POA#`tO3(w-!l^3Jw|QMt$P{3)5-M@2vkkFvI_(qf-?{9E z8bVZQ+1epN)d&N|W@(6ngZ(@WAu#bn|NLaszZ`W=POf@`L2r<4Gc%&prtNP`y{r~W z)UJ#YiX#f)K_OZjpeUYH)|_W~Y^C8HN`2X`3}i3CfDh`Gp;i0I1# z5eXS15he32B_c9s-%|Kg7W(m{>0CvZ8^Jc%Qm>yO?E3l?c5NM@2E~#klTGLYEqQ8E zze9C6M(Q=SY$C1)9XO^G=>1r2n=i7R{y@h?#*knaG1b195aB!R<7KX7iBc>+ z9u0?3%F&C;-Q0;p(g>wmAr25MHU(8C*WI7!>R_In#Wbf?k{bi z?H@Ips_*g4RXcdY6AT8Yyz#Cs&iKm3pba$a2Voh)f<&i(E-aPFo58}QhmJpXIvPbM zHg*F9{as{XxJyHe>=OUhLfA4&jnp_StE@3g>y$`CEM)^|Yk*fQ0Av&@UuQuIn1YN# zWH|a9aS(yTY#y5L>PSd3ylr zpsA(khWms|&=%w3%G)YZDdnVY=ow-L=NCiJKf65bo%PO#z0{`6E6@qzkO2IIN)$Pl z-mVNIk%kMsgU+aT-udCQm$O$DBj}_=NVn}Su7-s~r1(|2OQfOF{1k`MPOTXaI%lVa zg$j{w@^xNv!X0n$6TRL&FP_k+Aaio3^i&g-ryYX@sdVcy_lzhf^v_&JH;jUmssziL zyW$>&bIQnkP28$MQQ0)iQ3eI##!w4I*Z=bgC4yaL(c|I1M(?gJuCsTC(jmNZk6x%c zH1U7jR8NlG&A3*)XGUGuKpX`Vo5aQjUtDc;zN@;fAD3E|yyJyroi_I$kK{iK}JsZ)O?1 zcnL1=E@9M%f9#)J>=kulmbFALrU}K$(ihov4bz8JjgvomPtKHY`ijJDD>{dYZ8YMr zq^{ra7H#mQP7l%25Jy5NIcv_MWm1i^!-3^!O8&)mr&G(B*62IJ8;^GL7JT=&Egc!y zn!{}b>fmo%WbU>7hW(~Bpf3*Di#bF{pTceQT}X+LZH#qf8Ehi7#VEgx3)umb%-b+= z|NO^`?I=6+!P|(=6k^sXwlr*`dQ^99yT-4u1SkWXA5sNH4iq3zV z{J;!>?|adHA^`8YD%#@br%X)OI)yL0HJ! zbJu}F*{ZKg6iK=v&9vQ)a%q}&Nn{~_s)y$t;3o@V9(p%Q-={Pw{lJk{%FUu~K zAU=IBe-Wgl`X)#tyVQbo;o#&ieTW0!NeC$V{R*)2nb^`X>$d#-i%YNnMCrz^xrjU9 zuPv5}_fSBC&#_Z4VxkL5;|yY*_Pw`sm?lUzcoyVO6t%0!!!ysziTihDVMRGB+q(T^a_45pohc0;6sEP9nb2~w>;_# zOxBT1lp4gj2oQMt792DWfa|ki%U`!snjs~ql)!SeAyame)ZV5=rxYQJP!XNf{rr_i zeIlJHEmTQ{LSM@kXi~6X=m#+MeR(NMRe@pBEtp&Sk30r#c>;-y(Iru6+>nNz3i14@ zQbv&-n?gLI7@u2QN^-YLDzY+)mn%R35VC3XOKKBt;DUK60y9XdBoVSHOW-XawkGkO zP?28K5Kg@N`A|0%ov*NJQn4%2qsr-z??OV~{h6ZA*uOvd8@TxH&$uyoLUvAR)zlhiXN;$*m41l&Q7N((N{L5Q7%qc&eVqp35-jkQ)O~;#25z_NpxXhoFw~Y zIZu1f08z@*jXd}sJgu34MU4KhEcM~CmU7wDbI~~O!$swRyI4iOyU_|@LXhdwgHX4!P zKN@LqIZPkavai01H(%v@sM3xc8Fg$Gq4Y)ACw8GUchVhrrjDUKwmfmh{pv5f0rGdp zma_|;Ti`A5%yss|kkPN}z;I0p%@E*8{SA2&n&oRsk9z<8%P@8&nUaDyfO~-5xsEME zx9tVX7g@;r+>)jQmboYmM7z(I4v=fyz{FyLi&RSs!YgdeVXbh6&jek!$92oo#07x{ zf|#zUY^9eBjF~`efPJXXf6^V(hCZJzP3Blg!D1g{=x==|u4b^sjO4mUytEOPMEHma zOy)Sjq;8sF$;ND3u)Sm5xCy+inTs$IOfV_Raqqxe`m2GkKOsN1w7(hJb|MwR`rIS- z?FUK;xP}qn@Vg!Go&NXlwu!?#N$Rdio5lJ1BX+)MCdGT*LS!OJdo$^VgeDbOM86sRe_RVv z10SNmriewlCDnj)&|q=KwphwP>a9QjX#Tma;FJ8bg&^MIueOsVSsp2ce@m96nsjzuTssIO%X` zOPwEaCso}6Q&|vpy<}$-8?IoYFBAf`CcuWy7D>Ae{_>XoAuBiW5%eFeO7U!8`^~o~aGV401f8Ye1!O5I(z16- z6(v5hJ}MA3uRZUZj!T=7CnQfe)apAy|eCdvkLnUvc9IvG+dPQ}cW4WYNS-xO3L zUl#cVF2=6zoAlC`A9z^l)!ym8V>#0;txH@Tn?)iH5cK~6;3wAT%nUt@E1NpE7khUl zo!7^Xlk-xa-1tw#J!Zj~`4nWaQV^(u_>afw_>aw_{lhB$(epl?h;$k zlQt-#fF)%}6QUoGD^V`bT4GTze2mb!N^*7&ni~#rm6QU7mLDXUIspI_j9F<}r6gHmLk;c9r^ePb zb`vb+6!IuzToT68!RQjCK#sx?n}vNgVlr|ADLN8#ZeuVI#&@J<1xOI7wQ_@ziei^) zoyI7Mi)HVYD3j65!XHuAHkYXw|K)zNSb;AAdQ{X2oX;2>FiS^-v9lBX4_l6vcu}7w z|Ewqeq?<`-mP}$K{`?{>%1AD81oN0Yh?{t*rV3R9bg;khT+6`?G~+0d5Y%IA%era# z;^2u(5CJj88#(p52!C0SHA16Qoe&UPE4sK{wl0zHD^rryI3pD94H~}*k;dbk=x!2tN7+5&`Utvvrh_LSC(8)fBx6prHOI5k+ zKlcUx;7<|$N2_@tum7~F^`Ff=n_T~4OFbf@Kxs^ZdjfxmAOh8r(aQt{NrO3X;hppdP2?avwjx6mKcBvXjVH`_w=-#cPi$q#l! zocvTL(w`M=AXOy$b(nBhRDbKe0vVl}^CR zn{Abfe~D;N^b#>(SFLLZ`<633;Tc`O-1&%MqqBVU6!(@qG9_emIzlJDJO3HE zPRI9kBHs_L43<4jc8D z;%=LYeVgdEwQR(d)UMpxdYR$ls*^pVPS!AdTq0Vtk0q+Ad!nn@+rWc9JDyN!sAt!C zMp5%Ep{r5>uuIt54IGzRj|LRaMOFRyiTC4-Q)*;{* zxDG$zItS&gf4I9r#3t8o;G*u)`>+T~sB)rDX5z)-+8gh+t+9gUVc8Iu;obHg$ zS*|CD`4pWXE<2|S2T=mQ_l-CN6XY@&`Hh3f6p<`jgFZl=l2|*hg*!A1%z3$806n>(ze<{@Du?Kn1ldJ!E zw_?V>)oj&2=*|kKL2~u~-a)H%D4+jt9UL|*{lAGveUXMYytrt;IoJ5nkEARc%*Oph z#>LCu#eE^mb76x<3e7gHNgI6mJLTMT+Q4w$B4Y;U?7}IF5>L@)+W@;>`Xz-C3C8p) zT>2{t#sW3NX#?R;9b?}b2bc~7)COCi)!1(wHCl}W^1nC7t!9I~X#wKAfbR&y9fVxN z(lIoZRU09z=J+=9Wtb^&pP0WpN0ej zh#Mi%-oLIpr~To-fk_-fXBt>&22IkT&va~rmnH}QJ|A{|PjKEkI67*yT8E9+UW@#> z$CLhEzqsnZ>z{+~e%2ktVG7Jx4Bvt6rR1{5zXiCM?*)jKXqI`S-I;U2E!}i;~*HbV@PO885};44E94A@S${~W0;ggmwy4| z6I(7IYBZdd0v{rXfe$|h5Mh)O3_E9KTmOOP&|0?X_YQc{i>s5~RsZ~*Ozy%rArYrY zcHJU65QfhQoX{geNf8Zw-MC?chF|@mCyuC`bO*2t&EYtr`O|}B?7BA8o#o_n{6JMc z6g39M{;w9i8!o(Ltp^@7tjPjc4uGGSExMbzz|b9VYr#8G^QgQXK#!dfeGwq&znI~3 zBngVR63YmR9s2$zM0G5QiWma5oOB0RbfarxK|dTsQ85j0rZ2!4f_Y$Lt4q_IFX9NTSu0M3EA}iH>y!@j_h3c*HVin`*o<1gus&z?-?)-2qN8hrVU(08{Wi zp1-hKlCZAPG^@j0qv?M$8HFOc@SxK_c{#$^6NJ&F?$8;F)t;0`Xdb!8bO&w2okK8B zrhWe6*cZg{qkd}{uG62Vq``X!-E2hQ`s$R7stHT}a%3U8*FW)F7m^%i5QO(J!b|A1 z@BszyXCTpz@q+q?=zsUUj%oVR?DP`ors+e3z72VZZuY5;@U>?q1#;#(7Iu9EY#lN1 ziU?v7`V@MF!ii%S7_Q?$1CyUL$(-e+`{&fMr#+YFKZR|H&iAQ1brsr%ypB!-go>DY zd3;W5yY3Bhn<2Dcj(^t@J!W=V&b;uay2CG&qokPV)+2TSrgMJkAK%R^V+LF?PrO2A ziT?D<5!&}Dq4{b#p>Xm$iDg1(W@PNKjKFv8m!quqnrYFz^F4)h=p>(a8kbC+=<;GD zGYcYNA(s52m(Ky7=@?KMvV{WAw{9&Pn$v;_*ppp`6+Pt(4_^dW8gswREDV9ClNv@; z5sjecTLxw-D;#g}B8%s{6hwq|vpI~{yPtn26CLUce|pKPdN!4o^w}mHU~_f)Gc6P_ zfjSO+D2VQ9uTJjmCo4agxjt4bCz02{ge)$gk-6`?P^eKFy z-DF?%aIbwkDF#|bxC8;NuTEc1y+cRUa)NoX(!XEzfmL^c`S=Cx*zJc-<{XlGT}+5IggqTqOC$`kbyPzMQ5KJ-x22Tl2I(e9iUr2R1;7a{3TB20hzB*D=V4uspg) zid`_*Jzx-e^ahDA`LY~vdeXUkInMHa;?RTVr8aA*+&Z2IgfGv()}eE#2YBWTExFUM zN|SFu{P=>_M)!{e3H(Pq+$BgL5n>V;FX{x?8(DRzdH}{gNPK+$^%i})cfLn!hZJ>x z=X*l^5!k|hK$lb|x{cuW(_Sk%XeL_M!F^LvMe+eyFK2oBAoSD>+xa#syq9X`K0*OB zJ2^tbZ94F{tUlIblrJ5yxrF0CR9kNxadN=_c!w1O(&%g2alOj0NKXv3oO;P>N^iQCpI6`VU7*3(TWDj_- zdpDr~d_aT04+lS~7N2^b(hE;7peu)t+SFIiPN%;9vSw?CM~S5e-AP|1;42TL;xB2r z@$fiq>u;vcqHESShc`~oF|Hu;I`&i{fc^;>-Z-G=7=R=KLaOI4itjT-(Q{O;sw@g2 z)w37HQBxMhz?wSHEbJI8*~{x2N8&NSzGGoa$MDphT8?_+9wq@a&5N4CABoQ0&v!RS zErFkZ`vtwMdhbj1&ZzXusc^JrcZaXwM`d+~K=|_fYkVl(L{N8adKuwGb?wmQbCj0O zabMDXoukCbI*905GS$qCd;^J(&%f@Xw|5EsxrLDBI@GO&=9#YYdE;b&rvpO5=P#1) zlOkd9oAA%S4b`&X-+_?e*~{QqboUtMyIS+HZ!b#s9k(Q%A7t#syu`ZirRq+U-W3lH zu$&N{)X9S5{X~yOnAPqInwAfZ%oau%u!JB?`Lfzu+=b1T#mlV!VWR$13t@Kpxnmd* zq2Y~cFH%egSVADAeEvc?N(hBU_A?c6q^K}_{+-8=dU^Lzj*k=4_;@k?FtDcTHIFO! z5nPNvfPpoAQHveNZ&EVoIYzz=dXDk3WbnO82I`eSQ3fw*74S_nDT6Fa@$p3&i8rle zt%)nt3GgiA_%TnBcMSPSc}8#c64gT)N6G05?n~O}c(b3lXs9-C^dxQKcf^Dpqx_|X1 zae4N}@`$^=)n_1FOuT`d`@sbuSTTRi=>wUt$E?%S& zugpitIxjQ~POB+8cht{)Ne+Fh89HgY@p9}{t9c+@70ZbDkm$27E8;_|nYbFuFG&rp zIYd~WOWt^5Zx+AI5FoAQQBtX0zaV4YYKkt}#qhGL8#6gnCJQmIvsi8y!%Ki&;Q8bJ4%c6w&bN+1%F5K{mHfOga-cipdWzvBHQ&%z5y03;>ZmK<9Z*J@*tAc(yI zY;0@*zaQAA<2X_{qELg^<|fV{C>_fNbd>>?7*ZX*bC$A0R~A($A;8H zLq@S{Aka9bOgD*ZL{?|Zb~|H1NeariBKTv1Eb^iilDh5DG?WaPD}|`mb~sB8`qIC1 zW!5|<;OO97Me}8y2dTHPlK!qkTXGaoQow#x%>W0KfFysk0)lTjXSH0Jk5;j_rw$_b zO`O`Xzmg(5RDS&Jt!LrB*C9wSz$jA02AG7hzawxvLSlrNfxZQpYcC4&(hclSDwNrF zh(QW6zy0+RFcdSyrF*ALn}Pl{vQh@9l>HWS1U}q~QtCLJc7=-;&P&)EjzNb?)f!eMo_i>5!HnX)0Yr^4aRD!aL~k3r4qy zX-afY8FZ*fVi8+aXUSpcI7uRb6;o-rCq!}7d|HEo!>>`q5w`EFKs{}F!XAZ%6={8Y zrPia{4l#y4b99kJUR9g3NcMvjklb6p)k5|Hc0dYS7-Ovfy=)5(iuUQLu3@%ac8l`! zx2tvXw%u_t@Dd_?QnHc#Bs&C>kRo%6o44^A%8n?TMWyd{jD`%Lf3)ag;71JfjVB zZHGg`h*&;k7sOoA>A%A+A%)i6dx}y*m0(r%vDK=;1t@C7*>SR34&9b}@Rieq1)e4R ziE;sAm@hW2fYhB5se7m#?3J14fTNYdd~I*JuHFsiRtHa8zI*qndaVxC#4)---ZHRr z>&XhS?a`v@_55cLpWSi^UA-8GI(4f!!UIYK#Du5etC#Uaj3{{pKENAjZWif_o^J=+ zb=BgB^LknfX6f=#+^Zj>Bw2)HuU*Ls0qW{H7n2x)m#8^xf)%g*H?EEp$;V7B4KU*Z zAek22j&R`mrb8q^m@u>95q&~IvRYo5LmSZ>ixQ{3cXD~Ys!r*)?T+=7+hLo3qX6xW zsKzs(vH@X@>99h2a89Y>;JTDFOE?c!Kx&61HW2vciQ~$&w{5>`FAU3wyPj`#YjVG=7W%BfDz)3!?%9!w;Pv4r7>Ekd)U#gF?>#Ze z9JYorSNuV%Q*jOh!wC{_UuU^O61F`Fk0BQ)D+I66c9;^Bgfv(&C)FWEkRtw4vF-X9 zT9_Sw^VJWOjiFerPUvj38c~8)&5rK40t&i9qq{?8aL(ueN9gL}c!dOXkZ9>D?Hh4; z2QH=SxjM4#dY}|5wKsLwJ#0uQ!vh?gGc>@TR!GWDnUuX`uv${u?#p)T%|2p6%DGZI zPaV|%azL|{LO^XhF#lI$m^0Xvh@Olghzki;Knbbi6K9+?{*v~2$&;@rxJ9mWbO0FQ zh~1!2g|&NoC&zc!z^#$*U0 zNQMb4;U9j!@~6%fv$pFT6pk4@-ZB(_M*WT1tL0H=!2KKr42eC$Z~Y?{ zJ@o{*k5)kPjwAU$62wJev@^2%4_82X2iczvL{$vxc}kahZ-PO>amg@#S$wbpVy8ab zN?~#V6HI0D)ull0Sv*K4&o^M+ab^ z5`qE&+RYZ|2}nZ7La-k}Jifbba=2E4gKOewCcoqAWgqecMoKR!ro|x%8&~`(*tI3- z$k~q0(BO)*;>qsbh%zyPBm__7jQ8Rdks#zco%y8V3hppca&$RM24wirvX<`0tb;Oa}C? z;I9IYk^JeKaalqjAAk@F*oPeD8deaVxi6$qn^fW^_<=HjKEZJup;zEAVKhb?=a6A8 z8|~g0F&w~+W6Iy{ks*qn#MZ#rD+6SQ?U8jx6Dxw}o9Oe^z@`>9pL#s>8!iMQHdWf^txht&U5D zD&$K+!3~VC)M5TLHQ20X%X3aoP#OvBDas%P3;j&$r;h+1(OUv2Q7!Q5DR4e5K{d|a zMH(g%I+uO}6BAcM`WcA5htEE6*D26Vl*=!ltfKVJ8C%48@px6)lNAtr$3i+GaQ?Yzxx2S8HQX$DxZT0v(q1>FVTfbqj+9{o9b!CWjgI0&xuvAxn-IQ(TZ( zl-l0-@XJR;#et6L5EFl2uzCU_`AB{Ojbp(|%0rCB99BR@c69Ol{OF+SfB`s% zSTA-Qsbx>#hVxcPBb(lMTsyTUwRh>tF>$uS=I+-Z2Aw$L!0Mso@m^zgI*W;+gTMSei`M+S-T_qe2? z5t9aZiJqu!cGxRUad2JSQeO6C1sd*Ffz;uYnq%#ynC6F{1R@~{L7earAXeH{_0}@p ziy#`8#R0V&vO@CO&e#FwupjxIyeFVY)Ltyj2>R4}x9xfTiuymJ3GX2xq}EF+^jFje zGRbP8Gj=vz>}49G!)&{gSH1F~wHa!Kbl{&JLX4sC#97rbjKQjFLk>X$q>0V)kDQJr z9I4Pm!V&XG(^p4Z4%Nlk<+&aoc(tP5a!N{gmd`HF4Jin3f_*xUHFPFq6RAprHhG2Z zqOOh(9ppmV#}T@(8prDGDVj71R#A(#2O5@z$-~8^{ICZO$$+vz^$}nwV5QZ58i!*SrJmG371!i@67HAr zGRYANG{EIG0pDX1Vlo6rA@~XM)gkBUIAkJMB*Nqxg@-0=dWFL&2KN|qAuViT-U5pI zKLRjN>v$Zz#0Z4O6}ASfCvgsaQR>@uK;#t-{x#X-Z*NN=^i6w`O(}pvQBELr_)k#4 zkVqKG$nxnmA^>vm_SefNK231QNiq%e@Nh30R;s`elj9+geG5iI%CH!XSEzZssh~Y8 z=YXtA@%$CxFpbD@s9XX5lNAuW?GOR>BOLsUCS|@@$-@;8zf)!%sw2F%VR-5R-fbTh z$*)y;ZzXsAIYcB9iPrpA>O)CLi3@=Bk?>`%ZLl8HGU97K@wlJ)T? zCa<&F8(~;7ad&P%e{PF9IJz2k77STgTNMA!?iha`+C_PvjSrqr1O z`#s>lxB@EMDp#4DS&<9$v1(%OC`u&;7w9AC;UTcnuYi8G%k^``nRI>5A%kNiN{{i_ z8oJ^P$n>D_!egmuX#=ps=VHmM7hvoVMfom6TTS{M;GjU4?KynD&1rXPbDFait&l!! zZ}or%JwaK?M&+ufE1-Z3#U~M?3-r;C324*G(8mPvXF+hU=MMXN?ocK8R?`V{nUe^` z&`0m;9J~aA#u-Xh@ABem|MKc$@7UZpx$0elm-dt;OM9~S8+fS}5{^Rf0+gM;G`HnQ zpQX9t>?q7KsgT?H-W?_Pw)t5AON)|rkE@jxfkNfMyZ`}s0Yc2<2u@Dn7=agHh;I-v zf2%cfNZ=5KXKV-w{#_YfZXTV*;w%yAFEe?30We9%-~~`PjW56$jr)k54ZsUPP0IYJ z$=hEqQ$0)V$&mn$5f^YAoBL*Gg8AU(xjvYne;z|FN%yTOjVFmI$C!O1)_b&oFK4n{gO2#hmY2{N%iHC9Qk)ODUiAAlIWyg&5tR97r-VYk(HUjLxUF}MMTbun}Gq#7Y)SgiwxxT z1u(d$;018NK4qiRc$P0f2IvT0fE0lcyZ{;@Pi9uccmppoaIzO5!|YN;F#C&+QwY2l zfN2%ltOME46m4JKKzk9FU*_^>Apd7!y2}r#MwxKLq{40~lRvpo|6>TrKhnllIKh}T zLPn!Vwn63pnWkqB_oYfbKRPgf{+ML_z}q=x3R0}ge9utYB<&3_S-*8x^wU;VvVvDHvOYP(t8!C`;>qD0#G)DV0 zqAah-XzD;#HE7xWK>>2T05RnPMy8{?c0!;CS$0j{G1fir@oB`)m0#UiT1&9!w|jAH zd)JF<1T>kW0sKU{u*MnLMXutow3^S@(2SZVLy`8)0FObV04R^K4F;Obx$0ottmZyRfzPdQFes-*%-iV|6 zLJ|plBi+eRW@kB`N1>H(fXCXVT8VlzVF5BX@_{O0BsXb?pVBN0Hl_KMAC_NUo7nY$ zG%gTF;sSkKs6jH;{2+IrjL(&m(k)LycX3Xz$wHgG)6nr!1#!STqC6tLcsbn8Y;}aa zIJUcx}2>DEzelDTmGT6MTZ;@&>-!k)0{8MdaLA~>y$lW2P8A7u|c3ntz`N~ zK#6wMKNwD7W$5g8(<;tw{PHy1t^}D`XbhVxPsQ_L{4uQ5R$Os*a0*_iV|2E?P~9Z6 zr`-8nIE9`n*6K(3Uxm~sFdGNS4UKNJmE_jPlq_7(a93E==TBy5mEobK*eA5%uu1%rvIL( zz)ujVAxVK;%H(=ZoqIUTQ}mA4sm?E#rRh``MJ;FgOV#$l=k-sOw>&-UIzG)p<42C0 z!t%dlQ(2xs4vc8RM|<%?S2&7cu&m~+d*;JxLb5zj-*}?x1*S!NOjlOp%>FO}TEFzi zttr@2tJwkh)DgPnwBBh^l+u=MG{Wfcn55GcmxRR{O1)dh=q4L@J;%h2%J%}M;??Pp z8)3M_fz<&FEv{lN#YLZ`cU_F1(c~vc!fbh8-~9>lk>#Z1?X*~SdkLWwQ7G-(22IIH zYpp%2b?bcMoCch=o!2(s3XB%!9+mTrr?JlIz@c7s1`7@*d;a-H`)_|vr5ndwYF(Z> zHVZr>i&RHK@W%udc2{MDHkm~TtzS+UH{(7jwlrIH9}HWF`ST~rm+0EMNUCXEZE4M@ zWG`BAimzuj%M*Ef4#tATTFru;EXF{MW|k+l=USidFVwZ3!=3)%f|f2()LkDPc%gPc zPn$}@4$GW^I`F4I;E;Ay1a{%eY+0Kv846u%|G_^X>0A8|)*1FkiZwXss7gz=SMg}d zD%o8%Q+0)V(p}0N`Rp`&nUZ~^gn2xtQqO34d)w@Jf!dvd!n6K|YyXLoz^FRk|O?(XJaKx?t0mR|`Mko~3g;BWcD zJ(ElJPCRI8*S0x~XdgyRQ}0b=qC{W5)V=}7I6#CWAP^gK07(b}N6Bj024U_16!$~!vm1&5{6oO z7#*t@bP^!wZ*Uw{rz+-Y>?i<`5UMdTc~@EE`UpkiCLe8#D7~(CLCjDpY4LgE7UAJY z)VrYGsh2zsQG^6)#A?O9-UWR$pbRzCvvjPhmT@mH+blutq?OY07zI+u)EH@j?W&ho zW%ZX=y}Z(j1?GZre5V}Jf&m~)dyB;=6A_Q$5H;f@iu86iuB%O6>d|@rB>%q5B~=yp z42aRk>-1fx1;{H*w~y)eYrdV`1)sskgbHN8@02psv0^-QvedV_cE#nDQ(c%F8YN?t ziBtHPd7f78G(k&p2dZKQfHLqBeFUDB(iNo@x);J&P7CToN{11ue_Q$j$&SAT>I^8T z^B59>Sp8f3qYcxpbY2Y(vnRluSL#}K(tD?ATXal{Y(K?(3X(D;har(x>?yj*8f-v` zfS4ebX}NKqc5m8X7u2m*xfsWdr zsW2%z;S{^lZrQn4sG?D#iw`ikX0YGK!uEgijMCm0kVc-g0mCsSjTmz7sAw#Uc@D*> z3pS7lHss7o`Pm!!yYJMy?_zVL#5FBRU%x#&d9{G^S;CJ|ymUuhIf#B?D7q-W@+G|hmCStV||nN~C*?-ny#@YK|&;XCo!(+Weo zTzBw3_WBOidX{T9Ba5oy-pl$R?qTUF?c6=3w=*fN;&tSC?rVDd*Yn@+83mpm|7~q`+HE)f+iAC3?REV3F|Il1 zs9!7mn+1OL=u;m1y~Fg=j{fbPpT9fZJ2~vS^nH!7#x;0;p4$;E zBt~6u7Q>GTs-+b#pEIboA6%o!EAZk5Mxgt*c_J-;{Gr|fU%sf8qu%@s`a4^Q1ZfKO z@w^yXjCo=vjYgxq@$RP~ly&?4leOP_Hd#9kSJq_bY^lW_P}xN9WMAdIed#k~ch*hy z**DdDncBtK*stvf{YkG9|Gz04DOLcbi}}V3|G%}p>F@v8Zg*O1|Nk+rZ@@Ve0x`mY zpg`9;xE&z^`U#E{U0w`>YdA!_S^EZDjxYy2iDSwH2YiI02*|MujG+idm<(S5h9d3$ z$54!{`;dgSZva6a z?YkzwjceaE`|!Hq)I`MJ z4G}>M3d)-CRZhHNHtFyiC|BrHgV?452?LYpN zd4=1}Rt|2G$t2>opkLDAqJ z6UflF;6MI#sr(C=ubIvGfK1=8lF##vy*R#;5PAAJ<*3#6Z3h;_DNc-zfp8>}SOrJ0 z!iS1nf7b*z)9A?n4?zSc^5vB2M+H$hVw&f;R{QR|pXeCHaEQ9!eFy$K6-M@26+j7T zz}2sYdG2{ZVjd-HW>UGjbj39xy6;qYY)ke|k>bfz=O$r>lR{J@7zYE^~{cktz zX8TRE)o8s}X|)F~tMF$u0iS_dfA|az&;TZpP=Dp8w?5ZCtD4mRPyccLQom}Sfm+zg z@GU|$$ z6Xc(pT3T!S!~@El=d#d}Pbv8Kn1n~MM!4r{E!-;hcYbO6n1m@zx+zJ7$5?Q1JAwk> zSWmDy2w+YfJaUUtR({CAcj-tX7>y!5f2^?G3f+CwN@*`!Ycr7bjwI4Z zDPhdREXZFvreOkfrY4jG3_P&gCzO2$M*}Sa)I|WD5xxYl9@JJKvyd| z4^?PW$vOZSO#qB;;e-P&-~(kkhD?uT@eKv&R2@5?muu))S=1kd;HvTV+YI-2tGlUQN6A2t_g1(^`(C zhp4`e3Fsqnix2@J9w=u<07PyuqeQb|NTtFkqPNjEG zt@F$GzjaP;!e6&r|LBZH{c#vw{`yO+-+Gh$&p+tjv?0%RZw)R`18Ith$=_7GlBSOU zA^{Ci2of&8E#KbRGD(z?kGQJ80Zr6Q0ZeGZtXjT0lBOh4`TreUP%3~$F!4~m9FY)x zI!(qGNDZ7SAS^ZYzLoVf4Tet#fax?`MPjggF*n8MYE3|X73r=goL6;fLPM16g%SjY z>V4U|At`+&{iakH6kv=X;Q$YOC8b?K8LJWGpyPaULKCTLsgpQ@0rEbT38s6}2oFbT znc7oySMC;{|8LH3TP*Y%Oy(JB${#Zt7=L%U zEpvVq-JyY&><(URQ_U56*Y;X0+LUIZf;o;m)mIL)4oB|zZQ!No;A+0Y%V>y;kra7nVp;wpDG^dnuN)Dxc z>53|*azf8HI=0z>1rX%8%)sgSmWkK-GcB{b*DSs? z1Z{A5gVJ+Xkc16AYvc_<&Ae5m1XAO=x9Ti_$-)exYSLyRfS`{eN`}%ec*Mz&Jg0l|RLu~Jn8=A0>x>y0Dr&gqk8-L0TfXA&|cG2ucqqJNkN(x939-rMwp%QmE!BiM}!MVg7T6S zUd=nK3K9A*<-UyFvsExK!6gGsA-kDlYvK4Bt{zg$%8-qw#cxj^IZHk~Q=Yj!hRQ>E z^UId`M%FPFW5%irc1Mw`J%v2~bIQe#A)dBcvn=EULDIB-ONq_9%3P=>ubti5UsD)? z&R5dBK1R*-&k8ps%>yK?=mr))HFu?^pS@FMW-7>CZ26rTmFkymdc773HjjqSsS1Ob zDgO4>X2+|%OpUQhIWxnek5t_-@+!i`309u2HzC21bm8<)F;mvfmI_E@57OY7_A2;< z1mI;FycZN~wpw!Nqa@_tPE$<5CmsnAcQ>rQ+0v72sH)S3uBfL|y^4 z_OCG3{|i`+(){^t=5J$ehkUh1AmFuhi3bDek}CJ$eU*Rk9$0SDdp(XmWg#dMhWLMht0OQ* zBzXmp2uiY6PQrs0XCJT}Yqr~{%;T`f3{sNMwY zt|VTg2{*bZs-a3!D-v}(!of&BvUVVpsNiFC&_BR1k^_TN=JAAo)LwA!AIG`d9qP1A z@Lna*RwW*)KT9(&`rqS;Y_te+)KGcMh!r}YAIaPjR$f?W;E)zvM43*-{n2}Tfs-)j=CmLxp z&F?ZgE(<~TK1N~RSve>zo0n!v2+Ao7z~qAtAwpj9bw}#Lx6`eCC*~YdvCZVYsI1FJ z{k2K!}i&Lr^@X9_@Z~#g=q{mB&j0Pw=$SFUqtV%IN$$+%;rw(4S&m~%0X`e zO|@fYxhjUBahfRu2~Xt2XD$&3NfgNnJi9@RVPA21^%ZgRK7$A=%k=(V|5lSgMZ$KT zL=ni6WG`BHWrZ%u5i!BujogA$R?joFW9A`>BRWy*`FZvNdXtHEv(;?9>$f{jE_&)x zky8}Hc>3D0Zp~`i;RS~90G!2$kb}2Q&^FFz2KpOgJj^ykS`Dgh02%6C<)OT)XXy^0 zfIp~Jn0mJ!g?Lc6A7WPT);9vw$ZpkD+uT2ta_*mklk9sO1?eW!yc8J_#M~1;O9ExR z_7A-rOG@s!0#XS1fjlQ^L>gwTDMWHcEE7{=>rb5kK_qN~p6(SWG?8!h9tV&iAoG5e zFWda*2TsYWG+6te@P^S>AP-)d$I=T@!>Ib*tds|PCd<{kTJ2G^3$l%;rXEI-tuYl9 zk@=H3dK_iLqGkOtbt%u-5R!ByR}Wuv^ma9esA}ZU+99Fm62(@2KhNBTB(j^m-eXzs z{!tI&q~5J>wpwG^z|okpiT-_p>t9~gnGVj(PWnX`-tay07zNxbLQ{XV8N`XJ0F|Ta zJ?B??_h-eM`kRH9PxKzx6aBO_gH((eA2-P=-=3=gP9|J&le!+lKecNh^hVq{M?~-N z^VDI{q(S6{ryF_ATTYs1qAqN7rK6&@A&HPSGL-4s)YuxFo?InVmvu`MMKUKUg zJyLFV!~JW7qH!an0S7nj=C*xA$2xIAD7&RJ{IHRw-Z0Y=zM)_H_8A~#F|znfcY{P#z>959GZ4f+S@Y8D4nSD%bAzYP16i8QRS(P z=oodu%;RD;9LVy{K2|o+EYD3G(AqVcNMD3^YYj)znw)cHYWb^m66>$EaekUkzNThc z-NJ#m3{9hWe69vS!lG{Ffw`K&PD}e{EyHJQ%psngsPa6UITx3IVxE^4d&; zrv7qq`k)S6Rr>lhGiB)30I0~I>@AtNFiDUDfO@41{`gXo-;`2R(t_$3SDZwV2|kuax@y2m(gjC@Q!36G;)n=0qsrIwNM2Vh zMh&dtCL18Utg7N}HTBF48t+1M3HVY7X!(@NcatZ?a#rz>$GD#Hk^obj!}> z_Uc{`Ctc8KwZ?f0XZ~&oO~y*vj+|mE4d{8emu))Xo{_PW%+1=grmRX&tw)K)O-N8F8Bj{ zDHOtjUYollC7%xv6Dg!a6VnaMd4gCM)FULg+3ehi84c@Sn&28uq_?RSW8pO-wNltL zRo<^XRxjf!_y2NF{oM#fu^e1Qyd?g&)~0m!eEzqs&f5QbjO&j-HogNlc-&RN^#P8M zoPhmpEY%W>P#1i+pW~MKzPIp-lq<^{h1+QlduwTy2lD5hPPM zL2vCsu!IC)XH)%&$Gv1Qz@I?9k!OZTsQ%U^+*i9)0L;E2ZQlfZOkjiuSXz)c)(aZ7 zUy;sTr5ExWQVtIKD1g$L;B@R9GglH16nv0g4w7SdYLYPrFZ&avjf2ykOpD1-ISt=7 zYexfMLYF!dW4*ZvkE(m#2^%>~K~;ED+9}G-iS8OjbWGp&XK5-E%%${*=Q+Jl0(Ad2 zf4y4e%ygl1ae+p&vO0I~T)>!NA_k!Tzj)(+@w%6r{_b5`TGii93$&_Mc9|3r0_H$Z zSFSjN+4|Oh=VVt5>C?~k|Ez=hyZSx)lyoHxP@eV?rj;}WZI!R5#Cm1u zu{qeQXC#{7%a>XTlB(qPXwH14s25-yH}g1?8uHEYn9>qty+ms(2LUV3D~mtnu(#GL z7NM90rdrHJ`y*kaKXJ=soMg=xhA0FlUTEq@8j(JY&d!SlbuL^*? z#QeMbzIUee^+3s0wp5^6`NzHz7Wur;-yUZ9!nk+!d2q@M_bwE{=-6S;z5fue-#317 z`5--u`?re7_r8UhSsZ=&twu+@*1W)OVTz=+6|}X}>Z6phb_PdnIVr93mRz1G)wznr z$h;<7&UVKqb)53H?XXPCB&+(8TFYCEsXXV+0%0wfLDUNFNL&l6Ktf%X0rqB|O%c)pV-pli`h5FocU{(=k z(rn(3Xmdt&a6uUyqWuVR-i#T&!O}@W4AjRsVD$R6nn8{z7cms0Iw-B7>P*c0V@$A| zlQy!9JlflQc}p)+Is!!;mGm{W3#2I!7l-Ott2)(sw@fQi&rLr%t1~=mM|cz-)Fly0 zf(pV$ut>(nTp0Oly_x50U$f@_=|bv5wgS!C|GBfdTU`HH@Bev}>j@A$>TNFN%wxu0 zrme7K=fQnv{|}ok&K;Tt^UNzph+&~-Iu(&&unt$u4p%5nB3-!+vyG&r38_6J*-#ow zMFuqLg3JALKk)0nO0p_*BO?!MN>f|M()<4``)|*7teNed#)Fyr|2y9Le`mARS+D;; z$~B8H@(GL&k3>wlHmXmD4f1REia*a)ZvPic0Xf6|x3=5c{{H{%HUHb=TxO945f|8H;l{$G1*x3%{F9_9MRTE<*cK+Z`4`8Y?ID$l^)nHBO`6F<&L z%IF_r{W@HZ`PZKco#SKTOqJ{=o&oq&_7VHwm<6#k>-gC+p`@w~qdf>mDm$4rKaSKq z%AFSwr{kgAbgBVyDv~|`5U2AHK%CA40dYDH1;i;7zy-va60CNSC!J<=?-O~>M@iu; z?(w!#I=uy*sB;PuJ5Y_UTd%h?X#3p{1uhUAXsOshYiOV~G|;oVZ107BN}<*l3jj1T z{=Z#_|LpASuIGP`aor97M}_(o6~aJqDpHWb`!_!*b7&?6fKxROis%p%!-wD3Y?mP- z0*lGxA^BJ(tTn)qDaVm1N38*RR#~3{)KA_GOR;_`r!qQ9v6-=#MkozqY{o;-jN zVzp7MRxk}HaTf@dpc(*UObib)?}E0x0Y6zcS_(ym4UyPCzq%4Q(KF zkzhDbWX028NqQrmM!aH2P|&zGYU zS$X=wlskXU!Y9gFONq^k@C_n}b1*_M5~E;*f@{@ytPkRWn%ASSSxb|jGul^rkstUm z-PNt~mv{1PW0?>j62=r0y^%XsCm=R5e?fn_p+2n>C{4LV2PsSR0gB+Hr^(v7U{fkH zMhw%?y(jP((L`i7w`%|lAdV7-E=LUU5sktw=(Ngo!VnB`sZzX}uoRQMGfOjh=1W#h zXS=8xb??5aSy41ALPOL`_hd?YUlTMkrq<*H2MV!jq93o}uh#Ha>#KVHw@?7E8S}r* zowmRKx7FEM&;K6fS|0va-kR0`V2cL;v$VTL09#Q6FsqKgIt17(3^1##cLo6~Sc+LF zU`55OVZbV@XIik^3(PPxt@Yo4eb-|JQD{*Z$w5Tu%i5 zD{Evk0KiJ!o_isHRpeTB%xiT|d8J2Z^8m1Q>@~evcI5TGU|{7#eTx0@*l1wWN;4N6 zm{)HGA_Q}RX%my7qEXEfJ5`r~XW$S8kfra?4Tf$R7HBVyf4aOpSCL4@yPz&ug6idn zAZzHc>Cj_kz+=;^eo?q%1=O*$DCc{<-uca}V zZzORD1&aDOZpIVvfBEmhIL?wHBG^Q&J2b7Ym!Jh%zzBs7QH^nsUs;bjpAS^Qe6<8x zp%lArIwITMaO>`jS~mr=?jcBU6&PT5M60{6X6{wKg`?E9W}?(-g;XGODarNNv=_oy z$nH6$bQsMK%w^b_eVns~jr(S`<}9Nh)o1qdjcEG}sZA#^;(jyNwV(^u;Lt_JN}=M+ z;~>wb`GHe1tF-7;#Y41{ROa;bu_wzxA|HS|IU~c;lyf6a7L;3tH#v{V%ifV%*^4mb zIc6ki034SMPf`CUcDjLlS;aoAQM*y{;^1RQrl3kL7qjxK4E2pEqw{@`Ed6|{>i%AX z_LL#}K4tZ?sVeGoAD$mLIA{KKx5TL{Q)?lYCxJJ+Bt%$$1i8!TyhIGy3Z+{&3dYOc zAeO)7Y#X~1Ibbpx@?@M=_Juqi$D_fqqy}xb#{EPAbnd?8J7(VnE$c+6zo%XJO z{$qD@cWb@=^B9*KlaQ62_T|P`ME`^4;07kce37W?Xvh6mjMi&GWvnk!tC#BhN)~h~ zTe*|>3#)g|;5kzPSxpU&|U=g)FnL9cDkIF_T=nP!~#@jg3GmSqze zRb+EuNXur90o6)|055Tc|GnklDOUXOijW>F(h0IdMpcEdli#lt`JZ3g^sTRX#{c|g zBSc(aqLH{*63u-+bk_O*%`Kn*ZEL%|KL7tH*R&OE%d7udjsQX8ma=P1hWQHlO&dn> z2ySM3N3vFVkwjHM^8SRvYSv>BaewC`tIMmsf!cg3rgSR^A9qQ0*OH3(15{C02qeh$Vf_io^S1b{|hC6n$iDvx3;%@{O``@+W&i$>l+(xdQAW|9|6=NF>F_o%xON1^1CrR$L zWNIou+)-(TZ10W5uR{Kvn}W>QZC_!V3TM~8UL|$53zZ~q%~MJDfEg~4{sC201x0MW zQfidSQNZs+9=Gc;!o8^`kE=-f0P?uqhmgm;c_4Y*?nBAr3I!-7kE`Hub1dr8pvR{Y zxxH!mL~i%U+&u&sSZ)sn4+O*pN)y;HVL-|$dG%{Nj?5U6iuv!*~-~_S9 zqkpqM9WxX^1%@}POfx9n-a^7TBIi2boQ6U^K*AeVCXI-~5V5bo-eya(rf++OSC#!= zBmvwE``;%a!{}|V!^S>={2wAhBJ$Du~d-%8`4O&};1^eyJJ!sJGNpGfZ zDH5{HIoZuN@5*jgnsF(+na=u|(>oO~Xyx5GIiJ=PPK%&$sv7?nNdPos{NLK_wEg}6 zn>+3G`2QH!^7wzO*0d%7T08-et==^Q(26nu*_HfNDS&3M|JdccGyPA|P|V{0DN)Ox zf&j=jz3CDG3Mu!40Hh+8KhX&)nAs@iUsrYZB?Gcs)ek# zdb!ulAN9F1nbjrlK%is`^K2QEd?D5pO6$wJX8ZpiXrDJH4+#TK_y61NcBg>IF!FT5r|B)E!0F@jLrty!G|@xcSFk2#@(RO{G_@iv&?&mfR6QSO z)6@!H9BC6rLBg<@>{BApCkKp!C1j6Zal{n(M$3P4O34MKqARCYD0}FUK>cBpFqOKQ zb5l4?^Y5xNnG^CYOHZ|nIdTpq9awdghin7PjG(LyVRI58yY2C zfwr`_Tb^pa1CAuRgQ6(eM{rP?>sdwh)BD$Y0?oqC(3Wz;KMoRQeQ;JtcqloqD&78^xj~nVr0{uGch6Uzu#DqW#Rn zwv!VyErxB!`Z!Nw#O_%H^{(vQ^B1Q0N_nxC&*xL!7@jZZ*2BnbmdyZjcQbnjBRh*# zVn!B!Zo-$!sH-cXA6!_&xe(E03kn;tG*CF4>2>C7xj#8qYg7YP74!~VCnJB9OK?cMeHuSdDo_>T+3e{A0HfQD$}8HGTq z`u`#UAZMNb*xvN}|Mun@|M79IZ=A#EYXHdk03a85h;_yBAMXTU@Kt~vtztYKWXGq7 z-1yw_2(5~K5FlZ8@_2qgLVrtNIp)YgMlQ6954J|73%hJ^<_v0Mzg)w*UYD diff --git a/assets/gluu/gluu-5.0.10.tgz b/assets/gluu/gluu-5.0.10.tgz deleted file mode 100644 index c889b29227b248035dee8ef859991a4a57ee33bf..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 105771 zcmaHyQ;;T2pl#c>ZQHiLwmogzJ#E{zZQHgnZQJf?-}%qOJr6hHR#at0Mbt~aWbNE* z6=4(<8qj~o4>b_2p_DR{v6LK#tOqx{5vw|ri3+==whA|gg1S0~oQ92+p`D3`s**jw zl&Os^&{dC@*Ct0J*Os5YAI#@6{~X0HnbaH^ot*7!CEGIBi%o5(Ca=s~FcM;DcIbK_ z3!R$B?OjMvf6RzvDlNCG;0;^4gnk1vhb&x(BBIzfw=vD~Rj{xDO!s@sw$1CbxxArW zw=Vv#*JHPj5zNiGydLj+*N@{rjPAV__O~{DpYO2Cy{I;&0u8E~-V431I!nX+iHK&= zwAEDRjZFba7?B7KWuy1`;%}*(qc&nDklQvy!HTFo1FA|KBBBiOK3a-VtRd7%{0Ad} zl@lIE#w7)8$>9LwRuFi{TJ%uSMPV-W!&0(?M5y1fNXeJ^yG%)m^-_1c;bpBX$2^-g zZkLzt0v&Wg%iTmtrS)WU;Frh+BGY%}Xw_ru@v%n0^_i_#-su2%J&0uy+k8tGVU4@OV|4K|U7DFxd{X{s#R? zoAU(+2C`rI)kXEg&VU7QX{Z5TDJ|Ag=gTgU`R~>cX7+K=3uFoaq$}xF48XZ;C6^uz znnX&do*``-1CbW*PHAdL8XU|FYhi`zo|kG+gc-}NX~dhR2uL9_G?6fnOQH)n&c|gB zwX{5wXxe-EnU92=C-5E@r4+{S*D&Z}_j1pO7Ub7+-cS3M-L*~I#>|U8?350R&1R-P zE?1!-FHjmUE>~n?UjGMt-WjoYx@5$a4coKoT}2>Bkw2otJWElpI2Hle@UBotMteX! z5ptTUBl7|(5m8P}O{(5VaH0;NV9KUy^O_s}{9J7@Jtsd3w;8;O&B|<9HfTaO`;Vq_ zxwL2oxMOL{XCrUjg!hE>^@az_rUlQ`NozVr)gm691FLOEh@+lpt!#?=(;(|o_^;ZN z7Q-l2%fJ|_E<0ro6tT&SRwsK*HlAOti}l^9#ynVe{^j>qd(+*zY+{e%RqXhN)T9im z!b3MJgJ!JYv@NJV}CS6rk zmAbQ_tsBizUKY@QLsjE8s-GfhG3LC4qR!!S&(6B-D0aPJ`Vc&J9R2?y!~|HH<=nk+W5Fv`X& z*ova!r~d8#?H3W0KF-SuG`;fUzA=~A=gnR7Bj~4o`SbelhQgk877UJxCUa0U09L^) zoD2vF@(;(jh>IYTLMeInjqr}e(ttt?8&(N-45%mS=&XmaCqv4twUVrYZa@mIFgdsO zXYPNLDn`ih1e<#bq#(WO*j3Ns3U!@Lo)4T3(AwwC&z?!m2pMWuuyOpIg7z8IG|h<9 zal6U}tPr7)GW0en01NR2NNx=SztoglxXGHJ{k{G?_=`mK;g03Ot%8xKe8Fzur*$L$ z{(cP?u^9uZq?;%;GQ1<1811f#)hP7`bm%KNw_;b14joZ{!9QCUg}6LV1l!=2Bo+@j z*#pE)2=A$z`To$~1PW(Vc)?gWc}JN0a*63fmxkdk{OOGFe2H_zwpgNwohpc}Q*h;D93@LO2)pjlSft z%CKOX=d0@;Ow<#&8H$$y7cY6CWOuWI2T~XrE8TRE$^c^p!3#fmJxNi75ANT!M&7x1 zkP``A8vZ@rkQ^R3$pCz-1~UEw=)&0Q^QjrZJarp&+CtE21}fYP7-Ks3 z^$8%Z(vbAt@RAE^hGvFPP)j&5J;#KlYkc}1eaC$>6pIy-s}9qV!8QLBIMcupccJMmJ& zrGu5iNnN}bC9%L&X@bcM;rfRYR0H>rTon-Wi78zzxfPiT!@-h>oGpw=?SV3~atH;F=jPt8tYq=U=pqE@Y=1}x+j zFHhfE3!xu>@WW&%1$!UTMPbH`^H1mql;xyw1WeVXA$3Gw!1R1GI{TrD1wY~?AU0ox zig|OA3Ps&oY^_8rG7A70CI`>qO*P89R?eVoqJvH*bxi@@2HCY){c0k58$s8Kx%1#ys$ zjV}{aXHuNmUyv|tT|@)w16HDvGO~r9Fj$4c}849%@k9u!pm& zh33GQq@gRM6Xl4MzkG+RB<6@1?$|enaZH}oj~d#YyJ)(wl!PkgATYWD(Ba!|BBr%|!}l@lG6mh{2=im$JS+;~<5E4m-o( zE1bS1R=4}~V^uxL=GY+(07EJ*v8F)WcNWX~D(@qk-i zQssjYw%YMXWTiBK)UdX3IBofP!GP9i7e6BHm8$)|f#@AM2 zt^%LGcNI}gC9cBEjLa4uL|_f3K~>BKd#-zHk^@O@y3#|AZ%jHajM%LABSLYhAl0KW zq{xDxUnJ#7t4r$bw|Z?kU7bqGbAQfby_9_yVeQSd$~lcg%j&6su+L5OcsMHnGGLtr ztbu`t-lBi6mk6~2624Qym;kmz31fY^VkB-(=yM$G*bnZ$C`+ro#rF(?@NbfmP?(qk zHmf2sA7AmmSUK0H)hGL41D$ZRZiNB>ppt`3G#Pmm>$M9GgluM$_oEb1!hevZjjl2bwblu;(&~^Rvc0Nyj)-bV|h&BL{nk@!Uti1oJDr zrcj{b>PA!7wE$CcTajwnl2yf+v?Nq>B(5l5j5(Z8p2DZ0DeR-^KE4?@#nKz&=`3)x zW?R~zPo>{9g`6<;to+3Dv;+70rUu5i7}8&eWpC^UD+aH$2N`H;dI3;z-0B7tYWLZa z5}YYHl1EZ2v>4E|qNUg4LHbk#wpK+ns>t&4r5m%No@46!iIucB=Z$e^>9Ga7u@zMc z2Hc94z^7r+_9AMprWx+&zj;Jm&km(6pA-?JYGJhOb!&;Eeo7yj5UL18r%?R1NnrfBgWx_`6?;!mt#r_ zr^Wr_L@+rJu(gPfbYHzwkp z%+L)B8Cw=-UzbR4nuc6Pcf*vTc#zUb@`F-xnaa?U5ZQ zylZ-W)`U;Lw!KG8Xi7HfGjfSe3gEB^aTs&e?DWokz$*Y^+Gk&mZGLx;-(5>zO*_JM zeSY0tKfb6vf}6X%XFc}9V+448yc>c%+#hov7#pnoK$oIQD`2P=L)lIl^r?l5gt)m~ zOPGS>G;O~c;vACKg-7}Bw$0MD@(kJC;D@r%oC7jL=<5$mi z$5I0Wsboq1jloVP2%4dU

=09nKO~a)_vY~ zQNPoP@uY-Y#*Np=7lOw~L}%ZCo!-3X1sAYSVXjMK+U9{p4S(uS$DKmiYM8C5b6`m2 zPb{`poLgQ`QZB-FTYnxO9rqf3V!oRmA76jgxqF{>yDfgK&G`s|edqlioxSG2Ilg!O z?)_xp=@lK>Fmob7cSt6^ooru_4%+6atC?}Iam&h_)Z{F=aMSCfSOX;#^mO2)3@)vKi&2wIFZt^uE6#2ir+d7|WCw#1&7<_&1_RXVHTIX7sbfEttenf(rW# zv$D>JFXJq|00sAJ{A}>LX+yRXmoGj_#w*rA=n};5nQY9vsRD(})TNoIl^ARn6c9|Ywmpx?+ftxW(bChr09EY}PnZc-I#Y7RU;iduL zOQHh{e-TQ)Sg^yLZpj!MH;E$!TLmTCV;yo?{Ep{kw_cxT*KMC6Ffa0rzu_kp$~cLC z4mS@LyHr8lvo$20$?z)NCh^#Fzq%|Psjc{}av-zlQc<72+l*qXa$n&{K{}0vj6Ryh z9=ZWWPhw^^NX)->Q&#t~QNFs(AS0v6Ff{ff0 zl>bsN+3}*(6Lo%<)?;1;5n{tw>lCO|%G3Fl`vlSiBW8gI5sBtMO*fVqs$PRV? z>GG%eKpSUB_C8Sv8)HJe$t;s-()S2N&-|^CVV6vOwXUTB_0&tbOJ^)ivHPj!YsQ-H z5nFe(MPKkynntg^9PP8~v*Zj|Wf&KmVm0%}F%%aaCi-Kiv?~>}I$+s#8g1|slOI{! zYdrHWOS1|6OYB=OWm!%5*_N*S^cw)4o!zjR9C)ZIl;`!x{>DQL zbEF11TIsnciW*=1ZMVO3fWS|AVthZI3$?6U5RNGx84Z(DeKIP$-~WUCq8SuNof9KX zos&-f$mg+UGw89=^M@739u^t0XQ)N7GF~-##$6J2?9Hq{CdB4Wb zwdhk01$I;r{{fccGWQ|4^YrTVmGxLui|WRQlS=^}$8|Inn5gBzWKAi76OcmDB5FYn zRb3h8wXO0bHs>thGQAmWYJuvphMOcuRzZ?=0(MUUGN5_Ef7_=tI%m=+5YjJ>+nU~> zkhNZZ2c8g~u4)_ANwLW}s%zkNIweRSQEsTSVtjuaLA)>VdK9C^YIk%yAc&g#BG-hnNBEEa6R~6vrfv4Ly$- zIHm-f<6k1`9&+9YVoao(ouSn8b@)AS|Goe3lf^z-$(4~5Vt|4uj}Yw&r=^`w9Y$i1 zu3=9P-y>QqMu%<@Nbh1ag!Csa0`48aE1phPb{}(F_2-u0))i49_H`z*&+GTjP7jw(ZYt1Jw8WTbJ+CTnnj5s>=B0D$CETCN?i)p3j$UXwa@R z0n*ir{F&+`-1nuVLSimlBlI3nNVNNWs`b>A46}o8mtq!{``roxO~W z1#w+`X410pV?N5{OoM27^%@X)m*g)J4h}VBrnXErXf`F%NLVBll^v z1XmMV(af;-HwrKPz0r@t^e*X8LfEWg9GtCkyIhw}i3m3lScWHj%%e@s@rSz6u}QeN z98Oc?bfHz#BASSeQisDzFIxD@7t{tmEgclD`v@05AE*(O-BaT>q9eT$Ca+ld3rbcD z4O(ZSuW;{NZC`MptlM&b{j?V~|H|3`oY;ug1*Z+MX!g)1$<~=2kW7f@`-hJx<6g?o z^6BH)k|?3;n=@0-vQ|SZZm1UWxuIduc0}z1fM8#=CA`9)rlAw-<2XJ-J zm!`z!%;oXzOPxT?;;&mRHKr1;RL&+Q&Q;F(8{t&X0Bx_!;3UjoL3iUq8e6VjaP`6sxA5y1lt!V(Mt{x+ijYbLSr_=8Kz(H90T{JO z7J$il|0-sfH-Cs>h{bW(k)o})(ACfmyw+7wEB@mDI~*CG5ucNvJS7VTB=n%p29{6az@u51JrGea?SpRsbTJXK)d(v?v&Jh3a#RF7hj z+wS-Vo3WXQ(2d6+HJy~4L{#pNgMk*g@n7Zvm#Wd8DOWGETtsv@O!tpBIB*ycj<*sq zMhTV>NUecac~F1j>t!Qe6tF->x->sjG6D!~N&QVKJU-%`-(nf(KY1eJ!ZJyCLF*Zg zlv?KhBq-r@B7NoW=vy#@ZAfFDeTKGwQ^jfRXiqhhmDA4*db^n=aVMiLq=Gp>W{+J0 zam2#moxL)HUas7PQ{^gCw`01;?U3oQc&XLKEH~EOqR5zh6CT9{Wbl^5xMz?uOvkh# z$nGH8E?RjS-yBVV<$ZM*={j@!WyvC6TSi{lcuzS819N&1;?a`<;#F zN(@17N(UE-J9*+}!x^dAFG*^U==ex+^J_PB$!diVr3S0OKhA`rC=$^TytJCYKrvW1 zQK$(HAy4^aYjC|@KW~z%9~JX9r08ruUx^I{M4-{|rBef*&HOP!Y;n8uTF>wHsQb2F z)wqijlA{N@um%q|i$aU{eN6ECUZHtuXWi27md$;`;^T7m(Vmx4&&K!blbeUj*VU+j zrRF7h&e(NalHsDapkrg)D3`3j-ts7B^>kFfdNj;?Im{e?nTcwy0{(MaLtr_Mr@TOE zYGoN^ke9Zh7nLG{D`P|$bL!ykV$Y$EB%6){LzbEY8vnMj!H{*$L~mBS5>FSSg0K15 z!Rxfk+4M1ft0^Q^k^`|1>=N!Tc>|(1UQd$eM_Qz(Q!3Q2{IdE)+I&4QJ{e&QH}LM6 z=`8UDzPfOI2q}yduu=NE{sx5=mhM0pa8wRZGYoux;50E#+f;n#An7fWff#Od6;)yr?vYx7v#7Mw9?o9hPa(#??Va`V&7a$r(GnfMLA^wOGmGgm!l z*0!6s?iiIIp;JSP0yYCXTDOJ~2UXVScZ0Wh>emtG@>n7azP)^3e}oBHQwa>P+XK@;2T)C z_cjQ5=U2=_hr@pqvR=`ECUvz`(nz zt1c*DTA%?&s%?xeQ(yo>L50M~7Nv5(`7~HED|2ku)EE-N8fiF%Dk`ln2f68a^X$6^ z(ZWt5OC9y>dnE@znI@(1paG#-Zc`@UGa9Da6tWW=*I!Z@?;3KlKi51NsO4`0D0KTZa zK%c7}yW=4K{n8D3v>TZ*(GENXmK`S-H@$h~jk_(%8tQu626%Aehtt>1-Ar=A*T*sEEe%}Y4Z2Nq+&5= z5aR68CuyAUtxR0HF0d17kWIojbP@JpJ=Pid)dWp`#jJ~?*|}Ga>iJa~SDgD6ne_?m zaFyOF1^e}JaIqK1nRGh$ub2b5h375&*x`J7wLhLkWJLp(FHtpV_)|_*n}(j%(!A*` z1Mj9K+g%Lu1Z}{InUIUY$saYPVDfrzv< z?ZIl)xqYC;6tyj_sfx8|$;xD5_R!z^{bm92@VTEd#6LrAz|)pzg5LU8d*zxitgz&l z;~iI?+z{HbxxFkX*Lc8i_2Q;kux;mdGneyjcT(37MI0u~m^4JxqhJ6{%;1i-<0%c4 z7R=9`H{oy6{KqnakvWVpvTqs2s=om-E_qK_D0oYmre9QiIG%-OYr3@w$@^Uu)tsgQTi4hdaAKm=a#<^9ck(cL$!veAxj$uE9)>r_uoC2x zcJd4uawl)VY&LU2O1r7W&5)HyZu%wcJ%~0EaFtJA$XD;tFPuo9g|;jc)$E&OaL@df z3}OeG`^&6?d6mbxw0nU!ryRaWFrUakMkLX(O415ee*y#Ho-ljhdO}aAO}4b1z9uf( z=mPbNiCG|lB7C5x0Vb%dW)kj9Z-O8{gZLBu$UBpSV3ARH!kt?9)+MXtX>;MXKAXnv z^G!+&E?voTv!Xn~yh)L+3Cb_?MT7M{XsfGJmvE*mz7`pr<)taQG@A5w9|-ZlP^`i~ z67^_ZXgcxtdDK!Xd15h^$-8MK8}H9Pu-kGJO(knO=`&T{x*3bNbcDNF0u+~VyfV5b zj#4nHZM;|lV$J;v`Ys054+IdJbR3f2xfrd%qFS8C_-kAF_;?E-Ls^%v;;U_V;n~m( zpaok98dB#MzE9kD>JG)2qB=#CJ<_0U4kc;+`bmsF&}TBdORV+w`*Mt-$_qJmK^2{O zH^X7%T+p7Z15T_Ewo{>z-V9)Ahyqf3YG?woX|PuX(-H{yaF&XH(X>TB&3gK} zg&``kBg63GfiF0;@1r`%8^tLrt0e_Mo0`o>7q6WP`xUmx&1`z1Dhv)i(yR$f8DgDm zIJ=QX2E^MnIdlllBBjmF>-=kG(G&uvTJnktq9uCRaksba0V?Kz3;j1MdU3*I)K`6% z{=u)dRp?VaLXV^6xsD&wzH@ng`{|rwDmH*x4gm%n0*Q%o+mLh`gwm z=71**Q4Q`hQjCEQY$G+kDQwP~^czn;@dkMuS;0ftE-pCYU9g8O^N4!0f5tVnCm;|y z(K8`^V%wZWWbiYNlyKG|ZU#P59$enGN=WVIZ=D`+x%YF|+-#z3lI5TNdTMrNGllf5 zUX~$Q&OcA}^-=xP%6iFBw%C7fY{EBxZH1DMT9IpT8+O69ePmS}4Pw+l37V$Nr|oGK#Vfl<1ld%si2NeciWiHqM?h z8Eg1K=Lex0=Pw%jMK*FdV2MH4^!{MNpWD@ompxhiA+iqY5*PA5 zRp)@;+_dEMvnvD6tHWCe9yJ zIr@f^ZK7L_Qjn;hw*iu(BU5#>DVte2O{_tjRB0H>`^f{pK~++aHtMQcMpDBjF1fL% z>|;x;%}4X}R}?v`Pqu|WsievA;X=(Am0i#EV_Wpg^ylj8NY>9|iJy1XPuO5nET-q{ zcFu2J|J{6h`|D^C4he~#jQD$6tfESX^?9O{Q>gJS{KYO)*~tksPc<@)*tjuLw; z&zZg$vpX9 zuR=Qz8T^}9NOR1q{8dv zd*V*ZoqOA^SW*XaJ^njPAoU6*C@x4@U&<66z70h9ZNobj(l)9=dd7{ei6Xe%whkRW z?AGYnO{Ow&q2yVizG@y#^C8Yz!M^oqgATjWwgBqpV*hP~_d`1bORITtYaaM2yhT~7 z(=?ZIzMs1chUQV@gpfUTehhASo9!`@)1kiWhH>n(OFj%O=)YEDB*0I$apLlz6;xJy za8sEQy$-yqjM7(DOYw&EIjtX*w2i=OHrY)lt=m8{=O_E_9&5I(a>T|pCJ_5=lpd#dXnG}tbBgzIbm8;$~4uCqg5@oaO3p(Jq0=q=uquN2FX zl1-o_|I*-a1eglSzayN0&Tc3jH5nwvel{2Gmf7%B<-Hhg_GkW(0t*IWub>Lgkr7&& z;*De3QDS6V3hc@IWu)B2TTU}sNCM=W6J<)qwSP7Gng|yrGGb_~CQ5`i#pWiC0}>Jk z2x|!m)=l*)Ol?OKyK%^*4x#pqeZd42L|I0>_Tp5l@u9MEGEc{hqt!Q7Pzv{Gi#3A? zkH6%^CyQXr>6FbmDgo}qAeOIUct#J`m|i%W?PnyvI~cL;;Nv1l0(^vn?>APTSaY7)wX| zME4FK*@Q^7fYN#EH-Kf)cp^k>8k`UD70nL)Q-3{anu>d}n+%&(vH-TCVsV za0O0A#$Kgp__U-ZAy3nep2&oG#|NX_?jGmIeIiq&3$BHm=+rq}YR2(FmRt|DyX{o| z7%%Uyu5I8JN?Xgw&?0>Qzyf)-wPI?n32u!$)(EqM?dL~)@+dr~zlS=mW-)%Et{EH5 z<|EQj=0dR7!J-J#2J_ved0-mGo7(=n7;`X_cf4VE%8A=)g5t_!P^}|Zp{SuA5radg zM&Y5x*Jb0E;wZ{d7aMWgiNAFh3Ti5pPQS2Xxv_6GQs~8BI^5ZK2)#@dt|iH#B`;hX zM@22v6%M~r1gGk9Ar8if{2{@4eSj1D})lLJqTxWiE7@k7nrWmeTcG6 z`e;#J-AWU5VsS^c`@H{{?$We?es$J(5r4=XYFip!DFnDqezj5ZWosox@a3b7zj+hf zXduB+n1X{=JiebT$D9sM<(K&kJT{ti!kQGqLFT3%^FvY<+jXG{K1C;iE^;7KXQ6;F zNE7n!WQ22z>e}#cPG@BEKaWqk%dp6=?SNuhDWHEY#-f59$z(SXL}S=Ldmt`MNr?F| z{5~D;##MnauRypO34zR=fs+Zo#I~dOT2fPY7@23-2JH}8SmDJ}GAxZ(LB}3U4JOs; z2}l1xPLi1rAtIhC8dN-sI28R)ZUu|^O+&#Tfk(?9MY)^nIvhe5j|&e5s=_ zP(v-dl~A;}!L9FW=oq!H)jx6+7|LiFd(%qTlt=CM(>S#L`4uj?-~R*;-+bH?ZD`*5 zWK8w}$Nf~|o@7%Ni-IGJ$kVwzL3hOJyG7xzZIzGd>Cz={CHP;A%&-CWf*&WFk^M=9 z2<^IXU&l>pY6V?|IGq?C7$83I^?z zZ3zs{nDeuh|L*R%^RqN<2|P6Pjn~-hqj48>01gXvb#K9 z>LM^{jpVt+P}xtev@jHKCL<7-R1Cg?I zXeVlFPsb^NSN<6X(Xlu`JarEuRo@d@ zOt%4#L9d0@(@FvNnm6yB;Dg6&D^G=g6y9pCjn;xcL$oBS7BQ!jo|XHV{gq>3c;-lA zJn)0f8T6c(no@<*A+1M;?O1(dxToIwd`jIK{Fqf;k)^EZdV6(Z4|01X*!okgQ1A5& z3I8gm&~Ta$bis=Jjdia@Px+F(Mem{EIT5A3MPB)mEU#8xIT`op(3;%+Hr|r4AkC)k zBA(i^Sd4XDZ-hAMdSE371e>VE`6Trnam%+w=&@s|_l=LIaJ5=Mc;sMh4E__MFzfPW+Wpps73)p=hkN9t>U zfBABv+n(_Nuz%eHfE*}GuLm7|FmSc;FN8{O(15N2gv*0W@1cWaY@sn5Yt(3&Y$ykL13kXmrnBy|@K zB_3hp^4&~pJM^n5RbWxU#|RJ1fzo>Di05baSaQCPI zpzmF;FK9zSWo9rp@Bp^ha^}~}VN%cPc06JkS6`V#?3=VR}cb}Oohi_ zhRn+aP2H(Y$)`NU@E_ebmf@~;nExUAS24HKY2NCbbR!OzkO`f4tgtYuX_?4(#h zP6raJyxzCxnwT`tuc-<>!+1^KrTR-RRHdj;aj~GXao*!@W|%vw#W-F}uJ0PZepMlr37};+s09+!y;M;LAB^ zeDkKNyp8`!m?~jv0|adKs^T**LM-xcE~0#vsvH{!wSlrfY!8jJ;dj2qCN6 zB8#DE*8DvAWBPHJ9HsUydP^B4fod8V9j@saj&~Se?VlKj9!l14u&_||Wj%fL9@?#^ zoq2uI#%e7Co;Z7)oZjYN9E>3cvIUkO;fdA!WGVH%XH&r-eWq0V@UC7+82iro&jiW( z+WwyT_WddKTJ2lEeX);y`QRM;_{v%u`koQ4^LzC9cRAPjHErJRcHcbPcXoYc-TZs| z&*d)O>pQ0;Ou<5HONKdBj4sz@^_9ae!_IpXhYZMKp@xrErJ+@G5kJEo%E^yij z-xe$&59QU6220iCPqQr#aD0PwjK>}?sE&jLaDr=3)JP)i2t!;?L+;(~*gu8uWH#TF zij$MTa)Tcd1|BF?g=CB@{EA&N(V{{&gYVNqXc?Ut?#%^?2KIMZ`QEe{>T;(X(p{BU zg0ONEx9u3K28T%<8KEr8o=`-5gwZDxR*#Mk?yekljx_ybNa_jvVCsy#B<1v>!2NYf zXXne*X=`{`1|XGdev{#d%fMpLIAQ<%4fq0?5#sNUn0YpBa~8*r2qav{*HG?Z&Eys| z>G&-(`mjD}QJ(jox020I{jJZU?avo`oxbn4&!MF{GlCoMzhi=S4{^CZf5(=N>YLE7SDlCyIl<2@^K2gs5tIPnQs_ml{zX**$xE&yea=9peTS%!&J3% zxY`?sh!l#W@MPZ@a$4`rUNEOxQ2sdz9`npULx=&fxm9K$nwITk#*e|5--PA$1s7&L zPeobjs%Kn`Ks9wYKJ;HKLKIP*+vFSd) zg!A21e6kVha#`hZ-R;9`;nRXLG$&sFi6tn=+YBMLrm=_O<`vU1Ccji}RTF*|z?TaL z_KZAtB|Cc_uiFQ}_I$4EF+Qya&uZ^TRft!-&D9lxgv_vO>B`ChnZ+@+haZ_P4hDH` z@JZ2{TEY^6H0v-F_}n&sgcFJ4?i)_j;YqaLh9`8L`3iVc5|Wil?(v!(62SFB!5(BYIqF;ED_8Q%B4xin1ys60*-KgYcEg=B2vzwTyKT^tBC1iU= zF4^gSRTOK=p(IHr&Y#-}#(%3=-wxJfDqdj|e_@2y?1`ClnK`B{rDEt76bItfPR4Cq zLIfgqrq{I8?M%h?B9e?1tYu2+}Yn*-G4tgkXP2;;#X}vk- zfJi=~Exm5weV9OO>ioekjyvj=_7DWv!)mXO)t{!Gj>r9p%{KZk zA1~+Ap`}~9)=k^5;;-$c+f)~GFScflAEnvYc71*tgV(+BZNYMA#14gdz-#xF6QCfojL#A}LPY6lJe0ysPf|zh$LV5sY#+Tl;#iX#D$dTRm>t zHi6rw|7&Vc%(|flWYaxEJnz=F6G*>Ys&LiXAkvz5=b2?F{SA~73l*(dVaRk@*D|l> zNjcp{;S(SgNZ}tuGbQtfy{vM=v?9?!7v9F;0XB{t-JI7j2nmT~g_W`YY4>yJ_WLW) z;VvkjS}MW>z!F1%3r5(&FEW|OY*1BpRPq?ql6Xd#k&9Jq3z5Ha+zXSvVG*VXog@>% z50u+^ecwLpx!Iq%|Muc{+_@#leSQBhf87{UQ?J;G+ivRl>d8Xe#f`d%!A+Z@|J5Hu z?q)O8^VlSc#IZ+I?7HyHk1-&~>-Q(_+oR1!haAdT;4AUT#1zAO&O?aF8Pf6Dy8sS2 z-wT@obm{xy-4Dmg#8-oytLBtUHJryOE$GB_4VEQA%d#esFZ14St&4w#8-?=AN34V& z%f+X!(f%mj*v}tyx?5JPQJuKc-ZP%SKsMT(IzpG(op>(lmzHI_g5Z>3dW>sa21?Sl z(Yej)PZ2C>+=qMuSPLgAHCSfUs;@nEr9QcQUT`|b%roFR*a-7+6OE==k9L@L-)hNGVh}Rr~>GCyZ+S49~WfWnI~qi1>pAf?j@3Mro5KSXF$XRXLysMye~?ykAG*cPehQ#VhS*TH1OlIS2#T01ufM2QoS$^tr=Y>ExoI@3`H z9=EWq^jQMRI=ZivkzV-74$K~8L!-MF_BJEi6Lro8`)LtR7LHx^vv-d z=C-k$?#z`*2UoP9_DW3Z_d%VPMDk)yQ_ewVC^W@t zl=t!P-G#v|*md*9S;TkiBb(^b6Tt1?64r1Rv%hi_l|)69CbpL#=Yr%E>YX^OZA#P+ z9+wTCY&zILB??+QN_7N^gLJ8%f*C2<5kzr$8l}{F%6!7cpAC07una}PU=5EDm>kOt zEs`YVNPoH(G>~(~l^oM7uc5|z<{7DHBu;ig;2WoVth1(@suMNY=vf_w%dx-TI9hFJ zz(%g(GgYSiGgFITM%4VDEWlOwOvWs7ojy2?b&xNDcdCp*x0kLZXJc~AQsx)OdV1J6 ztU6xP>Wl7p^P(Z*jfVfQ5FXz6tw)Ebh8*fY@gJ~%N^v$V6_Y!BA7UuUFvFbbK=g{_&{+E-3h5WlSh^PjYpe>!m__ z$O*`SKql@qT(9SkN+zL28Dq0H8da{0w%SWg3$nZytlnfW`qiuRLy@Ts=m+c-0l8*S z3Mfmt_K=Vj$F{U*dnUj;R&B`p1pCHA4C^`Otrds5WSI+QUi~r>O!zVIp0?E#XB;wn zuFM*H5kt}3rmSm=(zpx?BfVSi^*=*v6$xtsp%Y?CC3hU*-H>hJ@m>Ol*+}M(QyV zE)zieDx})Y+FjMaQ7q7R+mN~&as_}qczpvmtg3~LKaFe}^r3E|w}mEIIex(a``rCQ zqA7Bl0dLYxK9OSS7LasF-u2gX!uZwc{Tk#)LFwR)uM%SCzAqQvaiE~O6=tH?+@*Dp#>dF~un7{*= zdEb3N&d2K+VP7Ku2slBCX>5)F4YWHraRt~IsdFymLV=vf`aezJ6=|Er>=gQVlQa2t zE4nZTx1!a)xQ)NYZ7%*nk}jNl^aM#ek)oVOF6keBqhYj@Q<)3x?dIjX+|GtUS>y`7 zy%Dc#gY26FC9nT#fLjq%QYX$`RXi&1$)9E{en}n9Oj`dYdFt^W3*p-Je4rs&5eWVX zmcav`oiXHb!PL$aJ;=PH>WO6RAVU<1m4&LEIEshA>=>KibJljbHyBqH0=@c$1R-oq zVs?ThV6p_`jkitaF=RJgv4s2P<)D%aVO}xNSRW8F6n^cCL+G^3q2jyZO2@m zahw?+?zhk~*251V7(v0UE3B;q-Jh=X)TG|8#?xh(3b&`XGyb$tF*JvNFAgI8*I9>b z?KQKXWq$r{EdyC3xEv$U`E%!)Ii6ylQTA~n7iO7|9>J-dy|B>{iYE=3?5rt|1$kL5 zZ2PS|+E(k&pA2_fN6b$#8eMFa8rbG;C$CVy_s`rcBMZ}6NlP4(9*KtkVf+aLy$tsm ztbMqOy8Cpq-l6VZPGzd!+f`?AFmu`iXRmzD&>gu)); zF0QL@Ktal|{LmF8v9%(RtJtPBM(}r7s=fIWBK{D?<;TxxES7BHvW;l3nB@5$3#c#WUc#Iwzm2x}p5@l{M9Cv+UY9y;{5PJ?>#Z4YH5l50Pmaw-HJ0%<`J;1Am^=cJW@?8XepJ zfPTHU#3H#v3u!FS%o<~Q>6<{F_Lza=Z>_L@e|@Cv>nzD|199eI>J~E%jh%n^J=W|V zkSNjJ(|_6F3HJNyy1*UD&f2r`G@xyTVcFkpA1gA0TOz;DpwEEEH{ZtHAA~!gW+uz z)qIXfvh%mh2xsvqgl~Mq%VZ$gy<(uznE(AROk~aD0?oIL56w`K(D6N;$tQiNo7%%~ zA3B}UE&4K2bNt)iTjm_!z&kattKc(X>Pl#sMu$Sxo3635$Y~v(nfxK(#DQ8MOXx9P=5)c59mQlCclH8kF z!?oWnn2855m^@r&G%$`(xOj^Y#VZU$Klc2e;yL>pxou8V5{A^XFcmGPw+$RMU^=dZ zx*#3>B5%5g%$x+0Wb7ktMpyC1CJaD!KI=Um%3*3QU5a@6M;k*QFfVd63Oo~FtWkHT z0d&Zt_V_4}H~1OeXHx(ZR1@w+Wygv$T3dFu=hiy{0g(Cx@U)u-$T@ zi2HvMaJd^c`FJhjy_68f0w&`3WGkEIOVg*JMp-6I1_dIu#`YrV6?Z=D7_kwLf1X8G zjcXJ-DTMys8*WVt>d|@1GKUj^4?4NSoW#LEdv7g}ZWIVGBVDFaAnWC6&Yb#P^TT+R zw{e6pB|ISA=XU^sp10fV7>o7VkR1VvjR1L%PZb^rBQg*eEoSIrYpn-siYSAZ+yU z*7mob$GJghbsD}l^Y)xZ?>PBy$g^Q`nXNZ+l3v$=M1Z|^+iEmytvhy-Sm%+x3%$AYn6Y>8<7^B159Np73bj4uFB$|VkXIS*&$}2{%Kt0ZF@1d4QpH1qW3;N z)W{e=7~qgDK%JSls?DA9P~!SuDxkjq4_E@|@!-$x-ym0g1_8-fG>IVrB$2>tH1qk=_8iou(QP;gI1m9$1FT|8T}{v9wS!b~5x^UQ=B zvg)Kec(=(#$jFG1V0ZR-RQ&F23yY9?!v4b2u{Ob9IstX~!%J01TIfSt$4h#8oRU0U zb%$Kju(36lEND-m`&(Kz50;%NHOEP^-?CegjNfr9sKy>@V_2Gsl9pAg@pMhc272Wp>;nwWZ_x$BiB z5(r3T0Y9?3R3^695+r#|fE}ZPBL7FoL+q;h#Oz)gRAuwPkB!OZ%a{66^1lVZU>L;# zR*2Y<0n*%5w?PnKtp8U5jMSKOpXP-V-KaMOl{DI57M_lj~-_A zF~J3bH`(R+{&x;ie_*d z3LIm1$R0yZ%K~QimX%m8C+g(;41&6V@*VyXYmFi1aF!ZZRA*%wFNuP3gcY_o}s*I4X7w{)XO;n*YD0{PBPM~ z9HQ4>u2P-7aiI)u;9RV+D1$n_(JQ)Av6N>>{C>{M+m=&Z_493hEK_XRp25NhUEMkg zeE>U2yw=7X;78R=T1;4Y8Cx5tJ>HXsW+yM}^ltAKKy=SW*X}MF>R-92__wbgB%a+~ z(jU9)?wsgX9_PuPZ~muySWYm|1mBMl>bPv#9(0^D7)8A&F2PpTu)`by&$TRoS->;g zM-(0Q0HF)S4A#R4Ey^(U0oPOqcg=d+Id|7$q{2CE^7Goh{@H56+v~lh#YSU?>#Wo3;^*qj zMJ8AGrlMqrORGy{W(F?q>xi=5o%>8$T5))J;4)8g^lQs`_J_;uWgR=XcfoKZgT=KSN}Q*m~md=N?9Ya{lg0qciYY8t`*?=`v9XaEF_u ziJV%)bgt0lV1|)2WIEs26WJlaR0F=if-}kGq#Ifm*~Om3)WQ3=v1Jkz;%!ZYV1QQ8$&2gs;ZM`b2 zDVjNA$Z78v(W~nXBjwHks^s|Ea(E9s+pa2#C!)bmCL7eX_ zBZu*!83B8ADkc7+{fpsJvMY^fu+l4PU zzrfq&d6Nm$F0!oBe1A-KstQ$=_Ns7IOgN~9)e->mu_y;yM|K4#!Wm1f(2Wcax?8PE z!Q=bMbD*dG=9Hn{NGYm z36)EOQ|22{@f!k@H6KN-Hh1*1bW=zpxDEWdE=EUU#DvSA2Mqq&1ja|Og8-7y%rP-^ zY8dNYOIOKO|GMfsI8eWrLXKi-T$=yGvTTl@fH&I zmSgMjoEw5xV%oFzR$|rv8?cgW7$R>a_U$NaYbBQb@@h>r7Gwg26RpM;qGM&?tg~Wb zP~E#L?xmceW!^ARHCj4F-LzJO;A!Pt_Mg@fL8{iTwh()M@3W1)DSpuWQvO9V7Si57 z=o{}>sShF-Jj{vu&?(YHcHC@56X8dtlc8^}AUQX&j?55}Dq{|^Qk?1*GeHlt&5S*9 zr2_4;@Bh+My~UX*f$$V3#fOoyetFQnJ%6b%J;`2N8%?IUXpN)gv zGOMPVYARx@($q+|kZ|~K7nRq_tlMZ~LSJ{{_jl{_nveC(j5B!02^f7%MQ+;%Pa5eD zEhFBB1Pr(e8!1~W8tW-1wh!D=6GlXt-P*VB(o!=`~uLo*=B#qE$Qus*2-}!<} zfIB!jSvh+9TF&5>Xy*a|G~-JBiN+Tsl7IEDJ&!oPDlm8b4_f48A_N2*T5NJaCDmLu zKDbR#Wf$sVEmQ`kOQi-M-%CONSDqPPU+6vl9X^RYM?6LciB2u67i2J?P|lr^QNXe1 zzBr9!Zc!lc4Y5QruWA_u(*GFrK*drbU`A$fys-)oiH*p5==$Oc83_KcEnH#C$UVB&9;!Fbz2k-jzx0 zj1xr@Q3kPRh6X|dcqtAzG%@&9b(H59vNxyt`X*(SEmf*Q0I{xJ;|FINbPl)4Q2jn-Nh@xqs|J=a%zHTUH(AgSCR^zLy zmh5cm*vjW>3U4)t*8i0|Dlqf^kNPF#F4%XL22Ed94OY_wobtd>xofVfpE|9p6t&r? z?$o}(-h$mXW)iowm0WK6&SK(PzE-oKUg3%k6*&b>H8oZOG?$~ViyH&+;NwBsY#AVB zHTe5Pm5t&{zGOJyW;@FFCrubB@dsSRq0p5TB2otf?L&ES1)XDz z8Fok4W2{tSH-vPiB(?uX6NtU`TS0Qy)u_Div-0!C2mS!WR4Ef_7RbY1Q`%PfyXG&b zWJ&+jOWl`?y~@UkJ>8ouILV3|5xxxE@i)L-_vF^~FEGdRgdnvo@_aTxFoh6d%^lXDt+t4&IF%SzD(f^z0ekX-SCmJ?@*o92iEwS*GZjM|99?*OwS_Uwk}lga}&96nAHtFUUS zxnj%zet;FNBYmAk?ye(cacUbjbeNbW>Ex(89JeE3mLObEjs*3Tcl`OEu;$Yi6N*f_ zNutlIt4Tr+QNf~wUn#7^nf$M4lR};|dG7izY~SikPAQ>urC6E;)uez|rOAO}Uc&$1 zE-LSpV(b4_E$N{3GTFy^XY$GaTeTGM+&*_Rp}Gch+qhf!p&Fbik-y8&RYwhH+)2HI z$|1YVTli5Q-m>arODt~5SUoAw}_^e!jcIto~#6hjxJj2>*p~|Y=>}b7MW5dxRw;xuZsR|5(c0Q-6}fQEC!0JZNb5l0JEi*J9i zl?sB0SYMQ{Yh~5AarMhFnAx-G*vkHO@v!ds)c<&ENTKQeZM`2&qg`E{&}esl0yV7! z_hrgZqM+(D+H5T|+Ql3`oaAWez`kRIFHBk)8co}*S=cU&(6e&M4?FU z@bJ&aP&FaeWB!u0Rf~_;|G5QHVMMFj!*J+E+*biUix^HMTc`I+jR$K6?t%>UxyVZa z-N)$pDk*$p8}Mc4|GY@BgxgC|n&VNyM^RcE7#xJ)M$4@{geKNP;k*Wtl@p&rFmU4I z>6sfGRMdDM;)UIYI(EN9eQoX8Iyo)PSDM<;tD%?Lz;)3x*Yq}UG4+YZ5m<{ zD)gYVi^#T(wTv(?a#2&>kAott+{uwJ&pWvk}S53h$&4Hn?v@+ zRQy?3_a77B4{oM}`iayl>b29)H$8@jbJ+>bXR~ELQ*ZVjwSqdcfUx>L7#!w>SIjCd zn_~gh=8X(9-VvG}>tkSxW)?KC>`qgkRY}iaHXdz)3rGvg{tj%`3M&P*A7ufVMLl+C ztPYHfVYJ0n>n07F^o=O^j3{4iB;i6%6ih}Y0tIOPD>kRe05M`G{RT;i-gkNph;P7J z*2y&|Fgp4erz5}ox{YTaGe^)q?yu6}sV>?HZ7pxNu{LF=_v3k0C!_Z?U&> ztFZ}BLmq%{AKjQ4rzzc(`=+T<(#%%LGhN@t%r%h(Ik}zIdbZHxA-8#tQ604RnIobZNv%@p2Ezb9F~R{QBBur6 z*5@mMjn!Wf1ZiSP1c|uqTHlNTQAE&>0#8~gDHJ?=yZEiiUDyg3_yaRN4-a+#=<99; z7BLmOE7I|M?#sxbz6FrElUs!}m}c7h#E2sX2tNI~1s02#c>j3nN=n9RL`7Je2(yIJ zB;4NJblab2Ib>{*&-G2$U8EyFoX4a&emN zV}h5B91ZUfvl@C&QK0;dPNwaqL8+FOHg#%JTO@0xgvffKW5%R0(ZZ0 z+R(h!gB@WKF00_y0`TGDUW8!Q5BUh1KP+7Eji5F;5BF0(++7C)op<7_69XT{s$ckp?vLB4#IwRTMIZ~a7 zS~kpQKvKLPzmLhGnI5yE5GBE4zpsCK0D+-r?yU$>YB9CJBx-6H^_M1UFdD0oR#kx_ zh0)_py2h6?b)EY@r&T(7A)~D~uyGW@=3(*c#W9~E(_V)`@D-!18kxNr z0N4cS@IZ)vsVg&M_nQ%v?WQcc{69u+%h{A3^qK$Gz9R`{qKsa zar#TjJznNlWdV_^n_Xw>!IiYmU$J@jVOlmlubfjA$JZ4z&Fi*a1%xmtd-P{ma)v1cuP`(zf#;H+? zt9jXkj$Yzy`1&8|TG@yML%_o_?ruO8f`pJDBoc$+c9#Uz!m4J?x=3R;)s;R4Hvh}I zU4`qN{SpQH{jz~&Wp0P!-BFinWsRcaNmprcf#SnyS80BVqVxGwt}@h}!`+3EXtzt$ z#dcz)$3g{nJ-O4%dO{Rq^_NG4fHqSFQbBjvx{vnh>O#T?_`e$erPet!UabxZCcTXL zC;>|7L~Ec+Cf8x>i)9U#a|u_%3XZ2@mua>ROR>2R`_sO(C@rp`Y{ti&VTA@UQ6!iQ zYs6o}ze4nIV1#sthm5+#2*3T&zbLw5xRP=+f3=^=BOR){|7-bYhBqXxt%!T+hQZba ztQQbr2iY87_M=KktkCMsr~tWJmmW2!q}9g?q=b{AG?>@f$VOP!>dXPb+sy$yiu_7M zg_E|9B4DbwRb_ZF+M7*h-|AIa9|!C^)nM(}xMc&m0Vc|&02Zazub!NkTud<23>5G9 z(9XYZ4zh_i8N*tdRUOCCLcmMm01JU*m7}xlDZ8%VcCUO{-gs5tt={LTd!f{TUdfkC z)_`_+N6LhpxCR+sfo8V%a0#p+I}Qtc@&mFc2TkpZZ&nyiNNh0S@L~2bkCgGW0>Lw$4s`*+N!0i;u%xfKMA3 zTeCSwmAsDPg!Ot?b~l|MKazg9F2ro~`fP-ez7umR=C|XgwWB8;b~H`Q3|tIgAV%%Y-;6iGK5`Ky%aWX&083nrq*{#P zn6;%InIcsV>)edNYfpc+H)dy>P|?_~5x^N{*1!SJ&*!FAP0xjoqY{Q4*l(84quml4 zA2!yGr|s^`FIUPa7*Ea!Gb&CJy1Bfj2Fh z`}(gDJJEa!>3nIOsgm%Viej~O#i&XSKTjZH=zl#=0s4A)sLbk}4Y~X9j$sFAs>I-*s+$9B_Sj?rcjBtF(V! zUUay8K)Gb@MxZ-qQ>vwV9+o6Zz2Ob$a7+ls9N`4@28fqO^N5XdfJT7i7Nh`0V3J z$CSJLqvEYa`3BDOwdXOsv{EfSvJ?bHfePZNRED_V1;icAd*Jik`9l82=zL=6HwDpK zBGHc9Q^)Jv)6OZ`bMa&p@JP%wv6chFDf1kQK{NSd>Q+kV&2(K^PniH(Y~T7ICVC&Y zHC51(fOcN_2^kVH5RWB&-=53hL^G4B^HeDAoe2HFw3>Q|d3(C}OLih?4T-acx?Hdh z5n|wy-zjSYeP9;=lXhOe3Q2VE1HH81abY$h;+iA`gRl!k6BGp%(+0vDh;Y}>rOs~S z1X5o}fNe}ZI4HWbluz*6QlRiTHa0X7d|P;$bJP>{V{%_p)Yk%F@rE*%`QEwe?oPfD zg9vNeyVzEt;SNBP79u`(i$zF|N?je7DEayv*!@aZ8BB`88K=v?Ithp+W=4zF#3XFP z2bEZ68zX^Q6LN7lpWaKy;^oe-ZuVB>jOCY^5t-4AD0L?c%7z=Bxz89tJHR9>c)imk zBxAB*7pDhUwo54l=%y_Z3%-4>POyBL;*gbp)o?6G#522)92+owS0&*(PG?iTcfH0D zF!!@OGju!s3WLPq_YWQes)VwVPX4B@5TD~ zeKmGi{_LAHuXG-=UMK0T5KcS|Sigt*MU1T0JZ03|={dn&bPA#Z=rv~_SB%XYmqiS4 zFFBJ)h;zd(tWx*d}o+N#0=BDV~O&kqT6RI|GoJ30plAxAi*PsQtG))%Qwd|>{wzgL%zk>}jmK?a| z?Vl?vG9f#|5*R&?c~6eHKW;}TfWPlC>b!X5otmCmN9Vk=ud~7>?-ha_eU2q}L%$sD zVi>JS-OU-*rVc(#5Gf*>Ygr10wzV8a48bvyjgj(bwR&Dkn>vNER(zvDJKj{;exi+U#z@nK*&UPFdTbFkv;l9`cfdUvw@);{6L3uWPouj*vw_?e z;7ffY`el0-d#T7ggtlp%?E2Jp6WcY~r^M872+wS{tVVRHPjm4@aYSJid77Sdy+0)F zx{|pA$ZY|^fa;prkx_z?!sxVs>{LvejT~bX((& zLbbk-Sp;H+?d8jW52EDQs0fS!-}d;sxs4HhWJkfE>Ij&=W5gsB3>LacGjt;0=!p`j z5^)l9r9kBQnRHBN$BxV_j8`?NdT(*ruU`!dBy3Alk1?T_hft{`gylnyME^+dNd^<#oKAMQ{ZdJ%fiReD)@O z1rJUk_S}(p6c{MCy2mQy|EM!4$T)+TXLfO9iNvV>y+)arB%=WfT6NO}Te1PG%PtGz zRG@R=x*fF^*^7eB9P$$O5mR3QAoF!`1!Uk&m~9OPAI65DvX)W$s>wiO&ZQ;GJ@s5 z;m>6{zraXG$N^<&>*4NXR{oc!*m7x9A=@NQ4NXx4p7M??&1mSw5QJ&x7s46;xiA1! zU^a-_jPP*F4Qysa(7>E4i4I)umI7*SIOy5G^m9!{meJ8YE?u=)B3Lp`swupEE=b7+ zLv(=Hcik!O;LXT)La-#x>1k|ST0Gh)G*F<-0jBbmftWZvTt#d;;Ft)$R}_A>^09*{ zN}h|AE&x4f^oLC%**;}C7=2?!-cM5G(I~Ak-~$)OOw_-CC5WJ(j|5}~spGvW9yoNj zT^wv>8MEz~3sYMq9RH6}Y7rt343V8I1cV}pQLRUS4V`}Zwam*&&Ii))?&7_%@@_el z;$;5USAu#Up52*aSu?Gy+5CbUHjZr;8yiOCtU{SZZCTtbb*5v-=+JfMCB8K1nv$8K z3!)&KowV9*OW|dq?s3gbuVXdr$#Rzb6uX}dgoq(~68J3n+Xis%^qd9w7u-<{pi)T; zyN^ut63^k^uRN1qjaIslUf`JxeB~8e{EINgM)^Ny|ufsrU1Aq)4#s*P{edf#=U<%45&<;J*}8b z4*n3v8^f`~C-u30Jfd9HDEHck>&EA(uIVf=ujpEFakgRTVC!)Dazb~Q1&|&lMpZ=o zVb#m?P4CYA;fntBdH$j1`Fa364dFF?1W%`RaNCF27YdQl!D z7uGict@N+g)8NL;7H86A5rSSr_5MD%clCT5Svt!_5|iR|5fFIil00eu#AE!?j67nB zyRg8RU^3AOoa$62eIxyn?`Sp}S&j@y@|gCNA<}3`y8Tyw*!;X0s(hiHEyyq4MKd>C zo?4rYWGJRm1Eovo!wGl=#%Lwec-*Cs1df= z0eFwh%@xDr)WJ#Rtyaf=P z6?Q#zx@cjYk|${|BC#dpqDWuRhuc<6TSy$XBe8mry;VrwwlJqAs~rM7NM0RXzGC5f zkPa5YTTDh}ivZX4Y^X2RendW`XKQnupPQFV(2n8n$DLPZ{SHz^4xXRgi=3ij5D|vY z4$oUm50HB^=F7g=NUXWg)>`Dq^8l}%WSl1kzl&(^v*e(Uthx4?0(7{@3{k7QDHWIF zDNXNUg9*JdYlERO?;43I6WLc>8Lluu8$rKM6@e;gWh|D6B1Vme{*4@y(z zC)twhPKR|EqP=N<H z*=O9PVG~A#ojVUAw^I(bR2_jxOG&Cmzvj@RIRLxop!ds<(ye5t?JxZEPM09s0pE+K zE$2MFidnXO!x)CkR`@g$DL9QzUc}u)jZSXF-NYBLBaBY;-UOW|dS42nC;Ax8(*k|o zKI;bY7auqW;tl_Y=bsi;u?z_m=(2yL3diXCK&|BUpb@u|g!@I7I?-D; zc7l)a?3z1-kW0qtE+l9NngckdyH4*|C`F)V=5!-Nu)N;CPy1KX6MM3`ts;mCH`;OY zU_w??JB-|uU;=D-M$SdUY61^*{}5ej0%~miQYb1CZiSv#6%zFg;$D9fz~_?3Yjlso zajZ*hTpP8CJrf8P%boPa;SGM4;TmtoL8xm8;+-h&4XRUY?imM*Sw_6m;HIiQiOBk7 zV#32fUsw{13jz?JeYx6cc!DJatoqwzb9@mXHuxFcIlxj`|JNkKTwkenox5RytvmN0FZ#Ycf<`VU{;Z z7aEa366D+@%Ux+_owUAFCQ%LLVICz-bx?uv&?|pUe&FQEzNeZ8Yk0FMZ#+t!-Gb_V zpbXm*E}LI54ku9%C;`qL{$rSdk!5z9;i1vY^Xvr%O@!cpj?b-s1R(~soEIrtVwuv; zd`dbz_xv`9mF~>;ALl-yA%RQ(bv!%gw|MCK*m?IE;*|cC;i^8x*i$B0(j1B18IP{5 zXdd+7Ebo)uUb>&2h7Cw##@E%R!<3!##emBC#QEA>hJn0|acvxd$+r4c6p#8Cf-j3| zpLJ;6Ted98RGC4~fE4@`&`gkgeS_&Q^?9`|#j5Pu_N9sW$>t&&k!l$+-1?m|75fBv zoCpcgakdRFz;MRBwHo<%Oq$Qj6z09mP_PEd*cj-XKP%tL^cia-cJzU7 zdCg!i3dR(q89|#x5z84%Xx@M4gw_!HR`v-&A~Wsi{%mcbPGNUKi63cNgof; zVaM+-!p;n>%#HTy&q=cSugp!0o{Ig(5+ zzxz>~QlSPG^o_MZ8g}>urR8}+*eVaJ)sFfKSr7WZSmqnvD9Y{^YM5^$zn84tJ#_o@ z7D5XgUhFNPD@hvm)Vq2ZiUa3kZ<6jXW!PO9MS zA%*wqWR#v=4?99Gk*C(=rzc+ngs%m;hihl$&M-4q$Ct|=*9R;!sw15P!pQSr>`joq zQL=0_>{Z8ma~Y{s4X^#Dpw&KJFRI(8_OC3kW`1rA)f_IBw1HOKS(42F*~{2EtnFF& z{kZC%Q~gI`{Qr!09cMXMPp@$t;oVJtD!wCZ-f48My`T0$2plim#m2wS7x=6@w7SE1!Q=gPfY+#aXb@x z){Zzj5lip?M%H>h!}#RK5t10>sD{|f+9$bMJQW2cx_XmmKgk4jwxFUu7GBV!3VEFg zZe^7RrIy4T)t?YYWxlww8V7L?39VBxk^(NUgGbwElRr=M+a7+En%GuQ}Ws z{xi$+^32|26w#pye*@yn^r>@{w<{7GyA1!BN0-x+pv@U`1FfYRfPt(rYrQOpFFWHm5Ha7xH%(c`T@}c=mYwsqN5}@f$Ug)bV5P>D<`Ql#gi| zOxi!HFWy?MS9{N#R>n>q~eWuI`Dwd!WHZD0Fp+>4r_OP%Jzc zJ50vu$)hZ36N5;O(bWjp~z{) zj|uG*MGi`-rcV610e04~>QF!DOpyiS7#^9a2On2}p8uE>?j{H55$1lDcOSb7S5+Ar z(Pz7+mcPG`s~2J&swghXidlJLP&T7la_yVVX6RJs)E0<0)qlw=*oHj1#yC#iz&1iI z@%f9`rdy7u<7Ac25ZcAhFM2t~YbVG;-Aktph7kMN#D6n;>Gp~BmSv(AU6lMKRlRqA z|{P^d&47`3P2$h|Q;K@l3 zZgkLpyR$1%a3BkN(NmO93~N6($L2b?r%S8b_3rL!)nx~)nMz$|d6p#(%FJ;naHS6|g0;rbkmUC7{n&2>VL6L>7=xEJ!cvP)d%BszvDRyoDQi z1#j!)3X0v?;f^~2-HehQD0XJzrcD07FA5>fYH|_=%AXt;%L{q1K|JD2u7v~dxX&qX zTmXpH>2jRi>)i%0U-7B`WMQ&?EBsp13}oj!FHMbvEvFpx8wZ1NK@?@oKE_fRTmIR_ z`Q)Kj0+63fgLsY4^Zk9Ls_8mL7uy&5UK-~Jw3z@?qzPQRWc^Cg)8>+~eZC`PYngGj zxQYGzIsHRhu15*we)oBMVy_rMq9P2EKdFDXgd+6i6IuoFsYJB~>}}1=YnN^HgtZ5o z4;agPAm;|#`hB!bovNAZ`$N=lk5Q!J*(yiST(wr8Y^nFsIvIHPcx$qsP7mIvNagr2 zAKMW!W5l>xRNEe0hp?hF+x0Ua8;anf$WbF-cQk~u;8CSu59*9XeLHqU6{`huqQPF- z?{L37GKwZSHq_|z7H75uhxf~BT~}$8xaQ-N#OM$7JOwCm$vLukr~t<|g+42cA}8&~ zj|WT4nslpHG$NHI$-&9MQrv2RGd)I@|$Em}gfFQ!zmFr2& zB{Sp-$K{!mw^NhS*CV4BbW!qw@k)?|sjxGfgmj z(s6+pB^FMK3R01Cj{z#H$r9VS5{xwlZus7zbuuN1uA>Ifl1goUo^lkc(`LP(&t4nb zrceo~QIyM1WJ>7DUY&`o<`3|@4agfddwaBOoYkQXbJbJ)xl-R>o*C(A?fAvPhcdx< z@=cTSZ|2~9qny+u*quAHFpd&6?P~DAAxAqHv04X_2O& zMmplu$581wR74KJ*~2k(SA`qq+Z9-1aB3?8qlVG zO<1aB3fy;7HYH|UNx|9f=CS>CdVEjVk_=x*l20&1Z;KV-unEp;RcKlQvCS&~+sRJe zInZ6Z%1d8b(O|23wCT?EplzvCKEZ*yHL3;09Txh=9rl`yz@401g7KIw1!x(C9(@&w z6TJ5)xT_Fk)z)x^$SJe_(6?$!EQG+iV>@s<68g!!vJ3t5a17d2X{L(SGEI~4Wx<0! zH!)pi30q|`NO3vdgS&s(skFTBq`oLosf+ql9m7<@h+-<=9zGie;>)%N)6)z)1=GY# zJcZN6?B*G>*iTo(wddO;IMvE1^i7lcXe>z@h2kQ!$9ro{C~GBPqA%=o;%;c@E$DM% zqi-nfvt}R1DLT5R>s|W$=w9E}b(2pV4kH{J9#pKEujN?Dli;=KWuDT1 z->VTyV9mX3kB>zsBxSxyWk3p1$)UOuMRh>(FP%!Za@A_>id~Tx0elzR(X+EG(um$; zG&;(I>wc?c9SKU^${@k{KDkruKO`rsR~dPxt_o$F>w1c$aLBtgtV&SVOC;Ly6!Rzk z{S?t=1b@NuTSrU?Q~~{CFis|WP0_d|H%et79kx94EEM$H7X=c>eM+ng&3whxQu2Ds zBY1s^J>@%6X}m_RNGp!zE=T4KD~-d{4#&FYtv6_Rw^eiE+LAtPK&Q#XQX{l03xe{pl2uc4Offpy&5hKV#JuU3Z~bUf6A?R?DePbxEef zp>0cLy1B^PNnxd&B~rlk!0F;OAzlP0bv~lgVE*bQNPyR_=%Ks4+s1QF%9ql{@tsy7 zk_f4M1>Ewc2qFH`=UU|0Dq-OGDH1bZDQcaTsqyB-9i#(prCgT&ZS2xb<_F>#$b8w!ncf_YuVs{Y4wLV}pJkup3I08xX#QlIH zwQ9GBVZ(z}W}ZWOCKrSr32|M93RXlsVoebDdoIo#fr!DEGn_$b!J9}$?-w?dvOY^{>rd7YOrYaC zDpAky{F8535sqTfY{wx=C=8PBC$V;TWXetz<-#cE2=0wy6)*`Mx20xEBuudc4zf`~ zfuLzre=_dfVmYwlQDCb%s9gZMYPrBdpt7Zp&f!!+oXI+D&hJLupH{QtIc1!_ z;)Rd2pwX)^`p6&E0Wt4ongU?7ENiKcTfsmI$?7sPS~uId$Ns={#CyjlmlvC?k6xP( zQ7%0;sT*FF;`CcN_=+BgUWi&+p=qVk7TmPYM@WYC| zk&sT(K$<(NugHCp3keDzf@2TFg{i9ZN2=%=8&-t0$qozAv{dNJ*i*v&C?z1d*Y=*z zuj{7nqtFz~*Bd9uOZ^9lY6MUqwQ&dcJD?#azi5F{){R`kNN6oF0i%vxPnW>3zGKQj zrM4PyQDoe3(=^_ikhbb=krH0M0>A#9kp{1oaW5xt{P49dqFjAqT1`qgD%Vje7>JsP zMWo0ZR>18H?XNudvTntS@c6C97%@wqwe*5nL|yoqFlk1a9EB(pEP|oEpS3bIin@kD zxgvKi6=b!#P$!MoKg6`6Xm0;ba;Keo_ubS3DG0pZ1dc#0q(PmjtA6uMSFzrzs?XpV zNY;P4O1K5Ah2k2O==I98<)1FAkBwP`9c;FWR=Bw6EREsfKqsuNR;yjpa2x85)U^Xq zV&^iJ+`Iz=J!uzxb(jyV+u|lWjw~6uw$+MocQ6dO%@mQKFNq~EW=(6jir)6-`Gn5H zhQ6l4G<>k+YnluGON$~v96RVy=G*T4*Y~|Wqi_gtYpkCNq`aq+f|AiCDWa$+?bfdC z$t5Y(T@~Js_&+K1bI|R>zWA1(#-Y~VYmJg1VqEoN?sJ~AU&1(Z&sqO=UFWE-@3kcwkK?6e-wUbbY9*UtVf_7{d}x8;9Qa9 zXVX4BDyLy-8LUiRC#mnfFvBhgEPMi?5j9Z4@h zn1AJp?B_VWXQfEboOL~nQnkXJQ9(kS6og78Hk=aJDG}Wc0fA?4P7M^LHtf2Yv^0ba z*vbU`z3XD@>rU-(*xzQ|tADsC*_uXH;E5hR;>6dq-p%^vvuOcdCc4By#G!dIXq5hO zgXfnbd!Ww&(Lz9tINX?!>BySRKpwyKKdtd6B+Xsep+UVq8ZY_0=YUf3QX}k@Alj^j zX2w@yS|Tt@@=_vvABsSu!9^CLO?mspz3y!n=>}ND(>>QgWrsi1!OVW%R(2|V2{Tk< zU5QFnW^}56p3dJWV9D|GbU@E8Y?P6RGE7A?1sBLgb-W(*QKag}O17jgn*tr36rmt9 zn^z0c*f#XnyU3+G0#bTUQ`=Y&=Jdxt6y5?OFNLxQ2~xC_pzKw7^fu32o^_txpW$3DI5_k)&h4O(fmV)UJpP2(llb$Ofz!wP(W5^iViGrg7vo6!g<>j2sARmI zH_UXeZ?yS-7bCg1GKM>1w3>muLw-_9$d6-ldQKnMG6sINGiegYz;hZDv^Xdsvi43$ zA*UeV4d^ov9v;lRJZ(H~$DL87@OtTjwzo9fEZ7ZaiNe@42D-D?Kmni%aP_{OdusN1 zJ6+d6Xi(VH1d5Cxy=P2He6^o~+udlTUX7|Z>4?s$Ck0sRSr=t>)X@+|*&>*gWdc?N z(n`MX^t5!lqA61@D&S6I1I1b=@-0$aGeVgM5Be-om8pmLUNeO6SWqC(Vv|^d{`P1e z?f>K?8x2RPJM`OEQxpKoY-9^oWjp3*z{Aiz*#L?yJC<3#*$)}=}$X00F4Lh;kO!e&T4&m&8B8x*3W6SWAUbSw!3 z7hlEphy6>ZR9qX=rl3tuWh8S-mrmzJ;-XVsh24>be0y8!*d}NNKAb}qI~>Mpw^4%>(jM)Sr!5)-9^5U_Hn&rF`k%Y_Ume>O(j3(_)Ha&$#`V;GApfG3Y#U% zrJ-qsdmkJuu!DB&2iUo+k96yXHsVkg-1N8{vWmu8%Op?xYs=dM%)%thrf zY9*t3=Gn|l%Fn{sosz;M&MtD9NXd<=7(^UV*@aC{QXndTVaNpVB~mB!n5`1=f~i2G zz#3@Vir@*lOwGbeeC7^FSBbvDED6+*{@&3b8$nw3aH45&oX0QkSDH7 zY`xmCO79$Y=HE7J;nBDIECu6{2|GjEc;=H%1&eidOUg8^E%83(819SOtkW^x$7dAV zrh6913Sm81?4H6FgNP^?Hu+<0{67|i(mptM9>0CEP?vM98Awqg7_|>{ObTio$j;f8 zN^C_ILKrd5Dr5YG6)*c2s1wA-+~G3P>K5&e6)uT#1oY#2g_u)o)xOcrHz2PT8W1_X zC|DC2!|`UK;}sf;&53~Za2`be>_Rcw8$sCG9*?^0be0hX^@uo%VZ=9+#&Aa#o5WbT zG%pp$aA!xQ@+ssxlg7?G-dgEH)FE!Gqpffvu&48g-6vOQYfKkQ+$Jg@_){m4J#jcy zT_H)u zfW92X{amHNUJ11Cv(BEr#$MUz_XD^mEwV9eIw~8Xm#TAJxK;B&sl?(;b z34r-=N=5QRYw$KyxH~2vxPT`TFW3+q0QOD(F30KRJ z$|rjxDo6EZ6Gev2<;Z)0R9-X=L;-^YWlt0pm1a_Poh;6W3nP`b%Or{FmWxMKM|Tb0s_3ZI3r5^;CHjE@AprQkD>U_JcW zkjMjMsU*}pB0Z*@?zZHn%&!%wN zvS<=Ot!ZWZ3F#(A2#xLngX)-D6_QED(= zCLCZvumKfnaNj)yX)x67siXpCYQ$ z%1#|Omp5Epx;e>%rXbYqhLfH>Da<?PEwY@*x^B%RA}w!Z0T$_%?5aH z=TG#fswZ&v`KyPUQ*+Nb*l5-+3!bC zVaXuqZ~u3$QwYmgH2HJK0Dqm84YwQ}nAkwY9TQ9MKoB+sHUu)gz+&m?dN4o%-3f0u zL1;j;?fX7+~kC#H|~86!RmkGPMBA!+O1QMOC$?7olMh z)r8RF$f6Y$u5ab};JUO55wR^nTpUU$}?bc2^ z(=fE}V!Oo)AKk8hPY!$~KV7fqZ+$uMJ3^oC{_V%RSgR!^yxFb^SA(1odDB&<-kqE{ zi7rI?y_kN*t4SMe6Q~4GhixOpwJaQFqDABtnVe~bd> zmMt0rVp)qH6|JH!ncCg^f`N9F*<{oZENFO^@EN&h3^f-vURTt3u%(-LN*scY`~ z+hAH~8siNE%8P1A%HoDl`&Nyj3mpQ{|^S{{>KLBo8IE7@)0 zrR4Qk{}14NODTz{))~X(OYaLj@w{(>vFyACrm($x${jpy`JLYqq^${%N1(uCy|o$L zsXjoS_q-^^TP#OXp3hEAHkgshMLaGA1GwmiB*n}aZdZ6vUt+S`yc*8V_$UA$6Jqt` z{_}3usEoGiUHW7?+G0^xRmy%@RWbAGl;TM*B7B_S5V19WKJLEh!m9%TFi$d;7G;7L zb5LuR{~Kwrxi@d<35#%0;o1rp9nYJ{p;$WEpIAr4G9$haIR`);BsAbJs^HxBe7{8RV;q**;7>XO>%$mVn~RUg?mO#~1;0#kOW93s7|S1xzM*QW7zE?vh*Y`O z_Z=PJ+eMRx;rwX)C5ZZ@abXkx&wUl>47%ak!atD@7kHKvb{^9?S+i=4!)Blf2 zpPe*Cy382w!G#44I|K>FVSXr3*mFh#X|V*nsrR*H3Y7#auVSQ)yU`V{VfXg|7(GsOoc3*+kOP5;{~GWxQj>u z(n_CV$j#`v0rnRw6=M-afro4S2iC!(+@-MT1l_?Umii;;@GBT3Ssm341M z{nAt8?KTDC!_{r3W3kv=8r z?sx5OJM_aI*N#&%cQW894II$l|MX>C=)?1{3%a_RsUjorjo{ZmG0Z3+lGBAI{cD?VvDAf}0FOEz|-9Vr05R!rfG z$_(=cP06s7n3r?EfsH>ZhYu*D1ntv&t;q^Up2g zI<6G(Z@li10lr7bAMl^upN58v$JodwGg@`qIc$*Se4f!p7!JvM8P9+74MXu)FZg4M z*ul)HPk&Ed?XfClYr{IUD2t-qz7zWGAL0a{m%s$X2Xt4+e9NgD&-&jb)M+zy)r`X%W-MqCb;JZ zr%TiE`u&_(SmmS9Qr{s3-p650V8?%F@qvcJ3aXaA0pfaINEoktxrw!ADrb7yGi2$} z)Sk#Cr|!%Heqs3lM0*xvwPwXu(K{5{BO2G^#fhmvXHHd1Ko_h{aM9ml-%V)l8Lrd3 zwtE>~zrlvhKq5h=&uv$!I8g9j4J>`e2fXc{Z#&aJO=s|7eA<>WT9#(;^M}raYyt~) z-C?a5DNRRG+cGg|*!&>Qs&vcYv9ynm{~n>80?TV@AD!sEO)~AYvFG^=OTHts-r*v$ zB*}gZ%^+itIYDOvGjM0nRT zu$#R{ zw2AQGV-@ylXH!bV0o;&@?8?mZ z1VhXjCr+&Wuctx7EmdiAZ%g6!i`{GVL_iwU`8^?0eV>|M-wJ*gbnBEKOb6f=rCpbJ z{`+<;FI1?EB+vn_)9z|PepF?y(3pQyFY*{5I`<&$nFFH1)Am;|HNvwgb-qEhPPQW_ z)M4H2;{A?}ZX}#ew;vQ~G%d@Go2`<`n zl|%kq_Wyyh0JiTH=&&;LxGHiMMM^mAVn!1>E*NJT6?I|L#L|V*=0m0N88hsnO_@`j z-?AREFJzBT6dx`;CP#kJ;qms*JemX6U9R7gORpFOH89?%20VH}AO6t8o=Z2O0vc&C3gZJ|M>_eKa8=gb$?4A{VN_ zG#F-Xo|dGnzW;?D>b|xl04SSPa_aCR`i}{dhh%BnEP#SP^-+VTQ1X_zuD0g3W4(N= zpZ{hk=*`-oktKigw1v1lg1DZXFTNtT;vQ(Ith4m_?$zolB{B5Bk&*JO@ISd$Js7Dw z`w&ixSfHZcioo*%o1EkPrUve=4sosjly!k$g28ksHnCTK@#ZHP$s`<*qeeK-udoFSd1zqA%$A7ZZQTq zo8y#m>{?;jQB`*)w4STCXpB+2LttH^t6ky?RBSSeAXi#Mb>Lr<)uoC^55*It7}-fk z021h;Q<9<#9mp$-{_40pW8XClXyvi+P-oJqOzd*>LG-Y73?( zyp*O0j2!GBazLX*N^-asu`8UPH4J(30=cPrDFI~!*00Sa9-;>^T_#n4LosA6&vrO* zQ|4x-KbZa1k9y?*U)pfs=o0qd@pi5}hlv1@w;JhX>Q(V2^sw2k;^acAbEHjaNphzm zFLTGNV2IOS-3QRRtJA3ssllUhH0hyyK?p48&;al5HmvVwm$&_)kru-pFRaXY!xzi< zJuL5AZ9k&ivUsQr4~cL+2Tl7W1bXz0DzFPHiA5RC-c$gVrohn&EN2!PzStwU#R_84 z{Rle%(33c zq@F&4V7Jve6u1oDd7C^NV<4)gBs4RL!GyXO*-&TW(F>C>1P5hIBX_!6jOX2i>GI*1 zz*~Zs%|x)onXs0YfLTx0Hso#>N!Y`hnx`6gN|RU}(n?}V&}D?&wv;jwTc$@LnWsN{ zF^Sj0h07UXyyKtUunr&Y8aT_+_?8&kwvKeF4K=zrxej{2-{F_W2qrFaxH{PnQw~c zKcRWxjs~q~pJqY&c>ckm?6MvHGXv~udg=4`f_o9-NDTf4zv{YT=>>=`7;r|C}w|iU)!Wr9BE%n<69_R(!*57dN3k&3B1t&V-?}P73tmdh< z9SH)UJEEZa4sVzvOK}$~%MM+m<`82k09DKMY!Nllxk1m>4auScN$P;%4xjFQ>(6^X z>K_;5hVVXEmu)6pHUdjIE&Ez^R|i?e6hiXP+*y_~(z$t=?jRC`H+%!`pN>6ivGx_H zzK2S+j#+KmK`pjYM!{{Ks%cYA(dGe2&*3HwhUSH9$OuZYL)9Cm=G!C*5uM=#TvxS3 zV7DUI-JBrLJ9C`Xw-GwwQ#sZ*O-fbUR`BG30=Zu3GN9l3JIIWBX@nVsXRs|F#{n$o zN>;ts?o-XSs5oM@%YD_KIY3VRGBe3K-Uq$9R{w28_pOAB>RS_uF0}v>ln`80i@PZd zG;HeLXD^)A{yIIVF~CmN4S~@66}-+}LU+g%SQzPyam$KBxw(lawK8+kIcII`Gvd9V zt2&PabFiI3-E^D{tNBc!*$NAzV)i2wAu?PDbJ$~R8n3k}VH(afi5#-2Lk*yv&c40{ z=`Uva70wTD*s6AH#%-!o$UyI7G0TiC3u-H8=F1a!I87`BOBkW&xDz|0d8*tog&SMy zwL1&dTf0H)f`r++n_Je|b);VQOyM@sK&GE%Y4o;`$GJW~!|xy1ag!2T)5kF2>7K^pv=UCk^pA;*KI zAmCER;o!k3DDyULkwRPc*8xEqf_1NVR&6efp^7b_h6}O9O6}`;k)ca-4QE?1?YJ{S zCe7bd1VrdOiSCCm7P+0eL1b1WL42>!br}pW>w*a1xBy0DRI;xMDcOUgT^_zN)glBCq=r=RH;E58^Gf z#Fj1<(fgdDXq;n$9vf1RqR-)Hzd>W~L?KA5w}8=+&G4oN#u!a}B696b0~d;<%O}Gi zU`PY8JyY+@V22W@2!#Zm0-YK*L{g?$z&T-z^uBugL9xc?Nsn#G-17RQB}}g zFDZT6GGuLA29z50$8=FG?0Wv~Rl=wBD{3}S$MPFlfeKp6)iEpr;Gx05vyQ|9!mrhQL?c|Tr0vjg!qA9Y`?D?zU@v*s7W1IWaEu~e4gD!i191Vf{umURt@tSB^7h0q zjb7)*61$Aq9}RGW0%F7t609KcYXzJ1+%m&*-y%rcJ0LuCDo?KB`P(}M8w%z=jqw-ZKpmADBxNYGR%YyF8me7n7NfrF6!5sCGEu z6q{EIx-#yT@fq+HUYZ4{A(&3GU+>0`xGF+bM4W)@W&s?j)onegDHul^QZTFQTSt29 zffiTrnjtn5V}B*xc~0M9c>Oj5!9T3Uxlrf9@sE!8ID4Boe=DXTzd}+Enip^!wRjh# z^p|8EChavTLXO)aVJEd!&)3BGsYdij)=doKhu%*+vE-DXo~M{fJf(VfZHNO=yD=|6 zid-{B?l+iAN~+*aBoO=d6cI!Fu_77^>uq4sxWteSi~{HK*8f9* z-cXH!SG3xrr2*{loSz?vXU$Ooqb~!u>_0&K`$`vycQAuN^`cU zXK0J8cjn#;_U-iPX07u{5}8I;7a8iwfUV!q(TN#4u>+X&<^K~(es@pF={=O-eB>R6 z$!Zo>CsslP1nJaA3dNl5JEQDytIJo#{9EVj@!c1p+ND$d{qgXn z`r)(e;}gm^Hv8h5o$G`AeaS5#mb?Km^*b3jqUjiWTVdM^Y95imRUh|)Yq#1@KEEv8 ziW60d^mSN>#ZUgo)#=Su#XcgSG{tYt<_toGWuJ`vfdWE&`ZgQ~bpbEX-;WQ8NM6=j zjFa+N(4S|;#&lyqo12d-oN;0azwtF>CKa638|H#9OtiNr36h%ZVG<-yGG_!s{A$7U z5(Q!Dk{m90WYJ6eT!@p@nT;!=tkC~Ub7(%8pN6zU+;g)QM|yK(!;iS8-+rR`D$B@M z`2JfHTNj)sDWBzpyC$UG`+a-`XXxb2uqhBav$n;>88jiM&-z2e7U0fZrxK674c5=M z=%-TF$Q4!}ixF+|Sw(O%Lq*_gAQ*K;_ze1Fp1ax-eC>_Rf|HIndVd#kTsMztWrnSA zuPM&smH*{F`V$w=xGJRg$E}hLhyr-lMuR#io%SRbUbmC^5S3Pwssqrwn(!cNAyquUm)EULl` znVs5%9ZLm-^w~Dp<;(GT`F0m&Xoa*QGb#_)~m~w0CBs9;5 z{jE7U^vi`wY~ApYFb~u?j%f#w#2jx8Y^<4+nql#S1j_h0Nc4;6<-(m=OAv^ z@mF_uyeZ%;-E)d-^>aig!(#qv>}7LMMGDoEl_;bnuW03mDq$tH&^j(AIjK#tI%Ci7l)lCaGDsnn5sy^8ZZ^S*fXA;E|v|WO(ZEPT(bbMV)38 z2uO3xIcTeVZpNI6U6-JgAchUd3{IA9s<&(h0_I*nF#A^@8&I?@zXc+QDksWM zp_LG1uv7o^f!o1`kS$&6R{Hco+Sf|qMNieklr$w$U2(VjI9Lat@A$6(7BPiJ5Ra7; zn+8GV8<42l^ebZ^VlcVJnnEZ~PLDCmA2hVci@*~}B?ApV^>19v z;HJbpfF^LX(B*X4K>pgcC);{~pBOKvW8H0B!#Jjmz?|G~QLWF!PMYpNRnCEtN48as zN&s(&IK6C=X!S8FK+rhIm ztA_}NBu(jxw2mNui+lQUeN&0GQ)%*8<+G9@4a&=P86%V^OZaor>MsQ_#fMBAJ;oT8 z85LEBswa#~Hh!DpDyc6DZ@~QoR0I#1CQRuRAsAw`BI5b7UG`=_<%VEg!F}v_7Fk+6 zUy=b89OkI<>)0UlE!_9Hyb2LFlsp;Qo`ynPDSq{o5)Ea<-=wT~fTcpmdl5j1Z*xF} zpJYZif7xiT0!F}cCAW*ybq@C`cB)IKVTBb1b;olu?SxFfta`;_da7?g|DS?;Q=$PB z&84sqp`sk)f#R;0udiSBaY?j~6*=XYmJo_Gba^oRdq+AVQ;KB@+8hx!X!4-QVI20G zPjB$&qNkZ!xFRF*q-;DmBd*MOhLV%#roruqlK#y#VwwC)4*_@HuaAA|efX~G-UK+X zgxVJ>px6-&_D=h7{9=N3Gtfo3ah=uxVL#Au+`osQLOSF7f=OJwbOCDJ6nt<9ihe5g zEU{Hkj8X;i2h+TVYf)F3$o`5s%uTKdwM|_<&W5^I_MUE+%(~RgqV@f^-`-!=P*=Xt zS!osa2xUSGib+vSPWD#Te9PfuBT+|-RiX73m2@Kf*+ZtEHMtcB{n_aiM~or$s9Gwu z)23c2gM7;QkA0dQM_4iNO|r1R1LJL{8Ma)>qoFKt#3(fFpE1kD?}u$RI-R@m591+z z=38rvy=Vz$kyZF)qrMYNI8~=^$<$>>O;k;gPL|zB7AOmQ&2+_MV?< zP*fw#4+oN<$%P?!KCkodZ?5;AX}Q%HNLyl-$1_DTy!!g^6fna=cMc=_Sg5BBI{VKm zI*(B%n9d0=Stv$50SkqCVo*|zq_0(h5rumNCsG`Tv9`dzU2fxFdLl85Vo)&F>@Id7 zAXu?M|C%a-rJtN|JP`2|y3`^5h7d=vU|3S~fcTxuk$cnx)WLJBUt>%CbtauZ-0pb)~`7d&^!FwRz+Gk%{(`Y7mW+?k7R=n^vq5sj3 z1DI^IugE>0WbUXvHlY@WFK^l(?T5tT4gNsj7@A98HZr0&DiJM=zd8d^4#JC$>YA-T z@0JVhxzCe5*ZHVC&&DyjY`ku@L_vYV=Gp+@S>Ump>}#A%^HgVb4mW$KI8eIhZG`O zqZFw0`XtUeh<85Y%rpSWX3_vPdEFp184wSi!wvCT)EypB7eF2(g{H?X)oaMuIc=*o zNYCdN5ov##(T(Yl2M&fX^)pm5P=~~gRpf;4{tJSEi8v3n>eDvcRdpcMv`VM4PLKvy zy9Up)7`Gfv2=A`*OX@Ktx9(OnP20q-z^%1NqoI<%{Vl(&N&(#{8mhG}+dLdKKR6;4 ztsW{pL$DklMN-VPN0BQ3jI!Z|ZteAx3f9>Rk|jDmOy*ojB1RE5#*Jrt-22N?(he3= z3;I>PA&Jhp{`hHa8U=fav-v{Mq*0|v z)cF&65pCV@Z$y4UneP?-iUWpacbp0KnMMH?+OxRvUfWFMe4?ee45`9;BZ-t8Y}A-L zimSxHfZ3FK0>9cFNO#|Zj@kY`{}M#nDLI(?g<3tkU>FXLHq2aV>u*X|iT77Lq3bL? zf5dM^OMB)mb9i`|a9e4P@l>h>D`nZu?zYQnU}dKWRyFoD@vf!2+}dW4tfX(D=SJ3P9k zFKo(?-y+!(74bvD(_@3%j8!R@wP9mV)D{+@D8gT`l6>#@4Uuq9IS4O=42=jgAbAU|0>JxI|*kKYHv1qJe;A&tLeIwE{y^dB=8iiWO)xs?)M_IDql0 z#A{EXFFqd5oIVaN{&FT0M5^Q2jzk|J2>Zh}NIYCH7sf@ljD3QLzxg?<2=E~NC1i8q zVLs4P=DmGA6ermY0!bzV-GSYmuKJKN^>_Q_x=lIH_Ov=Zynj=8p^Gj_hA2E%qp@u+ zF4lplu-s{y@Um}$r!2O@k%j;;xn+6+)N-?ciPB}S#vVO>RJmy`5I^qyyn#!?^j&?( z9}MK~$e{nT-P4T-<2IP>v8q)3g>j(pQbf2KY!szRYnW3iuwJV^R+zJiATukZ49rmu zrqqK)Wxg45V}>=@;A4W8EHnv;NZZAVQe1xYGcJ(N+B1y6bV?-o!0jPGGXaS%3~)ka zH9qq!^a929#xj545=cE-S(MU}k*TP5(-Qga$)14#clu#0UBchEu*>>QcYoMAE;{XcDmJ&Z zI`}^K|0gaq1KbHW{gq^c3j!~q1W=wPkNvbg^uYs7TNfJ-W@H8S73}{?1)Pn`N2$j7 zjRiDER^iaKz=pm(gvzase6I7hK?C#=;2v)pv`&km12_F$0zNbxtV6n`28W=?2!_p) z#K(k@s1>f(1AgHO*AzuzJ7vY^Vb_O{sUA!mL|B63Xv8E6;0UfbBb~3qMlB4imZ=fB zZ|@ZhXX+kfni7ZEK6?}r2X}WdyI)sH6md69K3~OM75GejS%L#t-%zy0h^N;keqZCgpw1~p}NmWTgg+Or}))Kd{;_;rEpmn4* zlf7!8$|^@mq`(c@>r+y4*aV)`0InI+7jl;KSBnhN2;ATu^BS`~Bi4PVLsP?#Gy>y6 zi`7+wVdvj+z^IBCrbZx>rMYWA(_;_W1^x337M2tOHuP0(QB%o|_P?n~cq}bZNoXRkkA_1g#4G-#KWxBI@HXWzQ59-S zO1Z_qF^1~{>ZC6v#`C7hzU1s&P5nMR4OD*^ImR7Jyc$jH`Q8OBwo+#m)NN2@kcmL} zP=0VK6%6WgE}4CoqAG9Q(SVPHyCBm>5TM{YCl;PWo%;WTP8HGS z6F_X3u4d@rfz!T1%sA&*q1En?FeI4tXZ@>4Fq2^16JHE8&{oE&M{N5YCi{f7Mg-)e z9?OAcqnUS9n@YwCP*5-zoxde9hyg0HqgoMQ_~Mi~P0^lGYowK2YzKH))D}t%&hFVC z)J;CCw3K=t14+Eee!B#Mdc#cbXU1Q6I%)Vwj5lakY?t)k*7k0dMKNa36&GqZ>v*gE zi&k?#lV}^|W%#^#*@U;|qxrP`hsAKw;7;|?H{H|JKFbvld8tP~0dNLwz%0r5J&;U?IWk56;1 zMbFr8nyQL=Y@3=~^W+R!kAkQC9JM6NTqfuc01$!|A5DyV3df@2&D@TcEWM|2zW=sZJWK&gcBh1ij0A6wGDOthGp^hjbJ9FFykqtepLW7MW4 zwLc+llPg3xaUk$Pa!>pyI%IV!BVc!hHbhCAN(b*>o`C{k{aX!-d+7ixS&?iKe!Uiz zQgd_cCPsEV);DyWcsa71DVq`69#(fnr{JpCBnkVfvc1F%r?LrRfsl8GjtFt@J}l6O ztS6Uszo)w$9zV?zD-#s`%RGAxcX>_(Z%0&U6@DXS+?s>0N1?W2%;Kl2sXdQPPXnm~ zC9aVSu_|(ugtJ98pTsk>r)iZ{qX8VvNp=u%ZZ@ZuB0{4h8Hs~gt-jeg%$(Uw8&UU8 z7v!pTZAs`^dy<&f#defY?tL&WV+?mV2=aUN1h>LWG1A|lDe=eCNwP%d6OOa_MCBNV zl&yHPx6@4r@%5E1q68a3CCA|j54L!}bo_u=-dq5uI={YAPVd=mPwZQpbnLds7g3yy zs=I(Q)B3@ZMZ*i)JA)n3$pf`X<@;Um!);l;Y&>oWd5o2ccjnm{{4#g%(v1tVCi# z*0E#;@R3ThxfG=fQ#y0Q)MKynS?flpu~?lBkpAU|1hG|v*+gQvFyX)%22w%jZT(~Z z5n^oUUx?HTVfy;B25b%OMU2;9E-k62%uq3xFDq^%{3Ye$kJPSug?s(YW2TO)Ac)Je zE=v|B(2T`NAmP4_;(k~?v<^(eXL`Ewiv|`GUv$af!j0xL^z5H&6b$Ex{AzU}j>GYX zBpB!9rw|QfjAlyIK%0i4p;-;?3z`6(1d7;8zMZ(p|<8} zKxMKBvT_C0VNHsfn+)z^;$8=Jewx~JXYigDZ6gxa$Uo1xW_M~@$u)_IQ&rRv$3W&> zTe{0Qyr>&%7&cKB2WMLS14tDnYQZ^;E^DGQNz(2mh%PV;O-P*PiykUyl=Vq4#@SCH z>3ba8RK@PeZ&#B~O@oa=*1UA_n~0-R0mm1);d~!{&{Q(QEptP9d*!=37JoYkFI}q8 zg1qbGdFEL!;F{3GGgT`?fG#%F5vu|lql)B_#cf!SPxv1|{|;{NEAG&^p*3_&AbOx2PcUMCBM;B2Q(Y3uX~hoV>&$K9!Zk(U@C!{Wyl=~Z55aaE-4yCn4_KXfvBO3*yOF&{u}rpSG8e`uzCTtHetRpjC)UMi4J z1`S{2#Sf4bBdbX)1<9;CAdfm!KV6Kai|B2uHfsSCDSJ|4c;$xW>^1+J-?+3f?r%Yw z)L71P#ci{u-&}*t#yA;H=t#_vRvv)1UEb)7x_&|3te&Y=Jrb*>%3qpv?@-?evu#l0 z85I%Wo<$^=%>9RhEL@v3R9ju!T>FCtnxKt0#4+a zU;^ozIYNw4J;XZr1xvMwf%x#B6Q-M>K7($g>|jydMWVz}k;+BC#5j%<)(K=MWz;Dl?`|WzATnMhKc1t+mg0Mq4U2CcFwkmGVggtP`;{ zUe^A}cGS422P16*w*FNO)r}~}B3oLlz0yP82i+fK#h8`B4pj;VEK}6!tEgHHm-L^b zxSz>S_U(ZCWA5L+4z56l6RFNyHvfW^izl5fH^85(Cy%$E>lYobr<55{m~LyNOpUdV=IAoGg{%%4^K~0nCo6Dq@Cbj=BsrH{8G|0! zh#H1|WEu$^EbO&5XZpWe9 z9VZ8;NEyd0m#VcYH38!XIZ)|$vj9-4m2R4(h=>&v%%L%-cXWweD%8_#1W>Yl2Sl!Slu${NuCn7Iigdic7D zYtdp6p92Zkd{BOwJYG^ydDSJT8UL{tYCMigUc<&yFm%uT>UXV_HeDflm;_{9HTNxy= zreCl(2cM<`K5 zhTlh+S!2KvMabywM7Cj1mTZ=9Wg4iCNXGe<*O4@I`oicsa?BhzM5;s?a4oxJk*%u_HM79JTfU7-1ASKI&?qT5c6l!39qkk~2>O zztkWurx#FiBNXC7Es@Ldb|qwSfibBWF^_*nwtHM#tPMX7Za=3~{pQma21g2Mn=>Oh zuiUvM*2kF9YF5uOZ^jpn6o`o#ip7(2FWn4sR=zb`;{YJGiPf8t@++c+0kN>qfUtUp zPX++LaApEH+;-grhyIIry=_06_`wVHTGuc^fBRk=1Bt#8w zK{t^T@hf8^IjhP@(=WAC3sFrAo(r;LW)VpZ^}y&w=$#TO*qio=?Vf6SC>e{!NlKeE1hqHd3*Y|*q{ zBN);yi@gEv_J2k|t5IEHNAy};9SwKY!1V9$$&t$G8xp1sv8b~}b~r~{1*(eVdUa&< zj`$MVmWneXZR?0X*xGjo8FsXLiSKwIs_*Uzoci{7-%jadlNZW~nZb8qz+Ig51c_HYlGNDCuzU4*lO-zS7H7)YB2vtq_}<#}HsY7#rI# zHW(Dv)LEpkFmgcyCc#}6d-KDT3}Z|%xw9ae#ly@tyoR#anoWz2O7lgS2ui$G0AI@A z^sph8k|aSg_nCC9G0wXp17+3x!d$B@8H-I|qdwg^c&S7+_V6)6Vp;Zp|3%hW0L9U7 z+aA~89xS+r;10pv-QC@tf#49_-95MmcMI+g!3n`#rXSxq_nv#-dsS22HB~(`HB-~w zYp>th`@b{G)42v6_c$Jidp|gPcH10v{rAvO2#FZX5vy@FGiYRqi$|@63ojUnE1i9 zat2wgb^mRa^z{pQeZI$Ao`D+KiycZh3Iyl>G#@*31XDv=1BV?YO! z4E&>w^n>(Ro;=~Z;pjXSaiwPPF%r!DQ{rjG=xm<`_7Jt_B@zFcBGb4Z*;VvCBa?DB z``6g*`@OHcBzIeT8Kv2CD`zJ}RkQFx0ew2FMHJsVp80vTlr&P+FZZZMzA+W9thllA zDO&MhBju6ldZ~NJ(|)!Und6TTc=Y;{%v<~qwrVqiCSKx7K7jQ6;oxrD3B-Lm1!}=e zrV5T74%Ojk&-#imKS9g$FhCG~6YYZseO-D+coc9P(-+;@+Gz+kqt&}`m7Sc8YJOv5 z95KPWPL6^eEv>~GH9KY+kM_e3LV#CL(AW3&u*3Gwym^wBz2z{M=+!o?q(HsWA0Y^Y{P9S`+pICqOFG+t{g8P$Irwfzb;m5sE-`yfJ zX}b~-V;6zk-JYNG~bftNepzd?zUibwpa5z8?EOhIv614e%NxwfA zK`(+y&*FYQfe3}OlXAEv+Wi4?+h?4~X9sA@y++4#aeBG#*IoPC2#B3Ms3fM_sPC%C z2duf=3k$L?^+~A{=6PBwc*%|!w?C=oF zEbR{vml6d+=!Mob%BZcq{2{LHtSivxeAy=UtEyL> z%2novT}+YtTbUwdlYAEKtTI_@B;>5i(+#vPDcCQfi%+E*+A%-dw~ZAP3|X3RetuHA zVkqWR+T}z#VXt=;@^Erx`}~^C%chLS(Dw6TrFbU zWBJ#*@WVN_iIi>wvtlAMV}J$AX(dx3yd;P3XTa9EoJkXN0X{4WIF}f_vB+#+JQ+Q_xf)JiR;bS%9)IV zRvWytzchlo^$rtlW_s$I2Hi~fud}&_E;3xTuWeXmv_HnFK}0jS%OW$@O^qnkUSM!3iwKf}X!Xn$1EXAYWhR;J8|;kb)qW!J-4+I*A0E!W1L zgwmR;5P|eKyQL576|2Vz`(nLWA3(NBbkJHJidtIBQkfn~Rv zvWo=f4=*_dTb-=ZiJeSb_A3^`*5n*QHM86?_0Ua5BrgU0YBPDk*gu!Dk3XWPosLa>5lw#lC@dyrdTv&7xB7=(&3yHPz>MYf7)dfqWmoS zP3LZ~jStzu4_D6SIr*!RIpN^XdB4|Ar$T0VSd=yKZzJ<_d9 zgWMc#2Dh|7;l9X?wM0s7&SjMULLaeO#g9!d(7vEckX`bFpWEzBWR5~2O8YJ`sx&^H zj9ye*Dt`2M7ZZ~Clt;Q*eg3+*1KzgcR=F}ng(C(}XnYF+CM@q{(*C4$sq%%_O%g)- zDALlTj|M1V&pg=g_w7aeC@pao;=60bPu7}T^@lElSVgv1_hhc4@QTIx^oJd(yv}X4 ziCR8^s$Sf%9217GT2alJzUxogPw{es_i;;5eZ=LPnRO1Y%v%5f32Mj7_WSSgTzgER z$||&zN4PaQR_{t*r}C4m$78h2^s!^*$rTaB;P2mEr$C7J*7#>RR5YVwDA-oY7q{iN zCgfJEroA44@V@@MP-Q5t1j)^}i`lQufaFW~fWzyy#0unyLS{cDB|=}*B;p)KI^$dK z%>Y3J@xw-juo)rWj@vnfLPiio=D;V2mE&SOlvk$~cuaim3J~O2Q10ahqJSxUh?4{y z?`8T{VlYYbWVf$Lu&1#TY+-!yAbk)%^`}cwE5iHeq{bw6nNP;(6oGC%0z#0vd7lPy zpRD6vOHK*z_l2b6UJuX?8%e+eJ%!PAX~>z}=TEHf3zLklG|!sbovmRVZLBoUi`$)n z^Xj1kTrq`o$S+TaWX)E-AJ5kLqwxxSWR4URpzMf)|N8=f4`!penE!^hX7Jl=0cGKe zi*G>itkX;vu#Ujjo?!0xaK)8zcS_5pgza-?>-?e{nxyga)>PIow$7+8n>5 z1Ne^n#lym>vjZ7yAnSIUWPJ9XTHxVJFxG<(^LTdIeO%#viHF%)YlBNQ*A4^^2*n?X zH;_A_fNNX`-$F=J>+#-TY9h&Ll2doQ_k{;m7Ka_b>ffq17H82g7dDS&nnMm?6G))$ z^TB}-vXwybZ3}9{DPRUjYsxM3WdcM9aI&(|?l`r(B5(~VR@~2WMj1bQvHC`X_Wlu% zE;sOP-Ht22zb*;rqNUOn(Vi#S|5sWws()0KPbDk3t2#zL^yU zCKA^l$`qMV6PUj??lL(Uj7cmbQmo@E77;{?kUD1`^jN_>B=-+;CQm>KWS zWAA@`r|TyIv0UjH#pd1R-8tUNWuWvE#j$VJFdf0sDfMBz2&R;CyudMF^3`|41xU%T zeyUB){S!_#mXkk(l>bXm%ah9>(=_SJ-*m5ET4G~3zL&#X@9#3TH2;Z}uA-lovdVb= zyFHh|IPp6Z=16h=aFR5q7hSPE!zJ;XRE6@gaKU_epqhf)&cbo>o_ui>20sd^Cssj!7CiG6!aE;=j42x#tU1yh3w*cIW=8xVvm~ zFUH54vv75OXwZR$)-_|pHxY&MxfLilLwyZ_VZ=DEBfY8|>i;9;#8L+j?QBo~BcY$R z{X6-EDs%LfDK>fe$eh6Hf2HI&)@X0fO4CK3902 zo%%@NebuFesXo)^WKq#?vfN}?rC8_#NMR&ASE6n{ebFk=5SAHJ#_0|I#H?*Rq>Jf*|*n}Ws|NKrPW+o)AoJ3p|t+2?WCf41}8J<34Tr;=Z-GvOZX3iOaEhc2A zBnGQWh{u4~7{9zejn<7~M}QDNi97^_XVRAKq6`MQF_#s0%FK!E&<+4aQ z(Oo4f7Z1@TTg$F`T;x?Xn|x6e7Y?*_;^%6t6qVW4`vn+DQSnarPn`ndJ(RPoB*Df# z+gu-TY7!(}b5=4QgYur^3D6k*(U$I16~+bp#rk1@gYn2?1oD<-X3X*v>q3LlNASd=b0 zLf(poSj0C5OA)-olvvmne_?FnYkdv6(hmhuMKi+lKuIV{UVu@;eqMoyw>(Ks&jHf23%q*} z8XquS9b$joQ^kk0Bk1(LQ{7&{SAPK44!lf>PQD18J%m@jaeeeS64FI9%)IIOBZqL$ z@YLV7)hc&4wE@HH>kNHwvS_lCd)>lSP{cgfvFuSseS6-;=z#3-FznG*gH|iEr$DMN z0^(GRya~Pf(udShccsJvL~mT!Rzp-C0e!~6NkJ6Acj|c$X!OH9Zo6B&`6%^lCi~%K zU!2O&%C4Q>`n#t-+VSeE?y0-MJ;bYnx6nKPggS=rbtmiViSlc?ePb$H>(H-!UK==C zv_8FCP%?KEp%Un5!Bn?r8I&guzkWYTE(3raQx(6L|3eA0?{`&XBi~MHPiL zw91H=s+(GhG3M%sB}#B+)LK}sj|{*e^_JqSk#*7%`Nk#ncRO*Thp7wr2?NN}f(a8| z9n%kcm}Wt;m4N(R4%4A#BZ_7ZToXU@v8w{^X9d;HCv0#@=+P}!_lvef79;4tDrv}@y;3PN5PHg8 zsA{Y;bdn-(%aacu<|RA^r(VFz_FRgR_Bd)#OZh9_-oE+hh;GsSkDeY0Gfr>8*1^=> zrstuwFr6seTY*1qj5Y1qThUyv*;@g55xrb5?ebE-*e=PA)Ej!IH**BMRR-iQSf#>c zK}!Z*pqF

X%#|Gn!`b$B4+PaZq`+XRpxnBa(+(9^k6ZgkUw_5tA^ z0hINR06N2X7eIpMR4?`lDnqI#2v_p*mFYulH9>Gi`trXjUU4*x13rp*hpsx;@F*lv zZLq!b8dv_~i;Odf2_n#||GONz|8-?F{X%(QD?F5NaOPXmWRxkP+o?$VSq z<%cJZ1ZPmUVH+2JwbIivMigD*Q8D1^>EqF4;m3HAH+Wx*)%ctgl;toMR}Na z$i+wjfdBvpe&F`m;!mY~(8RONY}nt8^4Kfk;goy>_YXp!kjvB@KX3`wXioWQ5~eH^ z^#7u%GMblr7e(~7EU8kNpNdZB%Zj~mF?+70Z6b#iF?yqwlXxso8Dux5Af=_Q=zrcf z$D@`|UU@T*Byh?6p*fHXF(dw?4QP`dwIY!gP-+NtCyw89B9YN8X(~`?sZ;Qp{@ULF zJyxqqGW5Sl8n)gY!$)e^CFzglZ9$a|<820vv&}#e}=m^`sAR8V7v51=5x{L%fdwA1AY(oX}z1G&bdGo!}2j(=1Y<^cCXu3k)+4^ zB|!WE9v0l%7w~>tP5G2_fr=uz`IW8HZ`=5TLIW6bg~ZEZ3DH-1o5IQE_K?Ht?l-<% zT7j$~hfr5TjQ3!LQ#2v}BjKuWaO7?WcgLDnSA}a((ONel!O`U@s|-IoCu5=zm}Y*N z+fczsqv;~_E$t#kyc;8IzCUyi-ZbCA+&p|^D2Ew3&>R!tnVwJ|PM)^gP{KoXZjMUT zqpWaRL^_kwh|owSR({UjflzLoSN$O%2HCsy2{I?$PrtzJwI@FoCMzAnW*C_5%ijUK zXD)_;Y8VO9p7XYv-PF$=A6erf;gQ$Vemw@25W+*h2M_YMcTjt2O`QzQb(Ng%;YmS9 zi3`Niv&5u+V<*A7t9Nj09c-u164d;WdUZ{R^;imtEIbp}^i8x$Bj@p_QE84UgizcC z);1J#0!|d+M1z=gHbk0DtKF55A+)BS&Zow|$s`?hRGQ|W70Y0ykXPG@Cc6z2uq90K zdy&y#w|Zop6Cq;w!F(6!H2X6q71A0grp6ie0n!|DhM15Nz3%Ac>wX3yGu`Grc^tX@ zef)@Wz$rf90NchOH>Z_qparAb@8s_{WDpBA_4opskq^!Q zDPEh-1`iRm#E*@24ugQ$s|JY@2AUkn0W;=%YLCr{@gnppDU$|EF1%!lo29e6XvrykQY@=~~WcU#xAtlZ% z1%JID@LRwD|6*G!2K~4%|6*HqdAUf&Y)~fQkoy^VabdD{i9870V&0|p?r(>9j~x3K zu$tr~W$YqFK1XU7j}sIsVOMdJSsF8JRjBmh-NMNy^aA$PM%jqpW(B4-^taQsm zBu8A9hKvdRW@?+JgNG*Cc&Xs%f=rBHJ@lLbBjX~ToKmw}B>lUU+bx|A^Fgco+eR8C{%ww5dq7a~)GspQenvUIh;Cbg zGQsVTv4HsLNNGT4JMgELA-v9fF`u2h4HPYMz_mAyoKloKztYps0NKx{Sn_8v?vz;o zGZ}Yk0)$$tqp`_cE9A%hvOMc3X?YQ=XxQcJ3uVy#7W3ne34DU7Ia+Bf=~pzE*&j9Z z-W$ua-xn#ou)P$%|CwT6Js6Wjj)-RqmI@fRbJ%z&Ia2;0y3YvpWSuQmPY%J1xVjW} zOEfgNE$)-bRJK2ohX?u10sJH6mjZnw)<|v9>WB4~w(|GAtrsNpCtP5}F1^{{(ZCLV zma#WMDvA_{3T*em{cS&SSb5EDxYy3>xZ_9jk`>5n@nIu~A`}RRY=MU>| z`Xv67kf<_Me!7E}pU-(?)R}&-xbOphdd7~GD^K2vm}_BpDL8scBAhot+9vi=)Dk=# z8aqWzQ^n=vy*5S_>envXM!SB3JmF~>yVi~HnB^be`p^u;kQ@5u1FP!(F;zyE|+S{2CL2)FTM_yxtz%-C1eZX(|nZO&kg8Hci8BK^i9T*x(g;zce$Bw7ahKu13vAqBh(LP=b%sRd6#%-CI z+8X3eir;3K{kN<#Q*TbGSo($^BHVxGIgeO&?Z2_oLMN)H;i^dL7DMV_iM6m1(94B+ zhctbtSJ{l1a$@bS)nEF^`P0dsOREr@n$uXnFUj?{Tv_*o27htJoL_x=1V1-i?K_?6 z;`6=Py&ahSO%QfKjcLHhk({dM{6-Mv(ZUk0_gPb`5J{t6jB6H9I( zlTyhx2wlaMa50F6*f$mK49xXEy^^_oCK4L;Xc0Tu&vQp#z{%2P;34%ppio|a0Qwc@ zO0b-Y8zt}tPtSS=`jnc1XT^>O5JSN@7;EN0cMa4tYoIbok>4F7hR+4%A3$2h2H`jh z@e2X6l6%`i0f{+>fzAO@{f)893=h`HtjgWAaX0IzN$xc}Blhnku zbc@X%D^rn}iD7Z;&xQ#JZoPj>$uWQ0y(w*|kKX~?o8E;OKymSd zGpr#v`~@dOAx!j>wdxwv<20dCtA;VexW#&ZR0bVY3;#6C6Ny_6rJ(@LCF_-{7xoCi zFCajTSA)e4XOYQRP+^IDl=GEs8XGc#&3#mH1d1qB?74;qCt!F!KzVE&_7SZhI#O#n z!?QqRf=E^uTbpMug`ucPy5#5+oBVj;sCwZAw|Z=hPACWcQER_M9LLbb4+H_z$5klF$4l zSxl4z>{oc9I{dik7D#tgpB4~Kv|3$7(D)tt*8mv)SjATN7r7*cZ=Z~j+wlxYt%X&*K;w95-lGP+b9a%Q>BjBU${*X6 zzrdAE#|(-1BNuFBwo6E!4>y)f>+FwtoXgadS=)B2 zRJ=Cq{ENzA{tRO!l6H-Qk<&fLEFoM=OHHrvkV4YIbwjZ=e; zu5uH8hjND_FuLNRql6^-g-Pv6UoX6&oQ3^pz6!kv@1pE1#!2FcVQM*~_GdmrsudO; zgdCpg6|!aiW>j?6keU@!<=tDZ7}@&Hn`70qh;2-b;VLm$zWl<5)hU&40xw~XaW4x+{ zDx=6&NBkS2xUoNzKMotKl?f^m!{01IhCGuLdK{fN#Re4H`r<~Mmsmok&8I=(N#FHX zo5V+h`o{X~X8E$V;*-WEcETGGtvhpC3f-5+EnwxFWF2A&xdStlxn1;s5eV()i|3s z*N5XvRkBmgSUSqu>+~h|eKTk4Q{07$NpT)6gup=g%M>qs&LL&An5n7DY?ARrohFMn zVPl?T-}BeTzFTBZy;KVjUk!1$Qpb0#Qmdygvy1RMUfQH)?68yGbQ92zSJCLuZFp9* zEshz}v^lSy`-4rkX49^Um!peu0TcnHT@b-JDJt)~#|GogT-(;D z^_w&V*G(RJ)#Ra7{@FklHM6uBnPqklbRP> zJWfKH5s)uxaHtS+5ll_iJCDkHpO}5!a~21;`PdUv2OXQk9x5&6^k(gg6+-Yu`#I<+ zoDH4tyqzt0l+&a4WJ5BW02z`!To|IRS>jFdfAJ_239s{z+ZEa|#jnl2g!YJpp&c7O{%<{5tT<^8)- z5NZ#5l7f;lR$a(tKrD^3**k`NDSrpAEb2x~blDpY!m-Qp(%FFExhe=SH%j(`2qp!J@!E-jFH5DrSUo%e0w$xgUpro&c&}Zl zXO}bsE31%>E)60BZEzn@UJm-N>hJE!5E0NS&9!m!flIV~?}QF?z2KfIwQ!-`aC5UT zp&;ABQA8>#9}@4GFCNWT3|b#RHmPC*rYm0#{(d2tm!AF zZ=R+6%+c$t`X+-OFs2|iwf0@e944zRQYw13=auvX>&ZedxIsNQtoK21))7Mc!7f3) z;Qp^lno_7sls(gs*ZB{vvH0wy+$*&VwqlvL+5IG*d>7!qy<{vb6Z|PIVEK2Ie*2F76t9;CM#5uu9SlK_odCDG#%jvfUmsa_5)2nd> zEENCL{Ea=IY(s&QyJ_17w~z5?`gIsvppRTOF>gA0QRW2Ox%%hT98p%t*34k=!MiK7 z68!GUs3;_?d}6Km8ak}3F;Ggd?(m+=4H~CJiO1kO{Wq$5q-+;^E|=O7ub9Z4=S`(@ zEd53)em#?d86|*UW)NPeJRa3{XQ6-ak0BG?qyABb4s_R&uXft1j3DjY<8nA!`EfQw zhq}ynur`ZV1fx>&IkkF(o6ed_Pm$>s7gITZhe7U+5^CLDQ$|FfxFSK~Veg$?rP_&6 zG9LB|)G{zFxOnW6W7Sb+pD59FiYRtDjiKpQ_r)|aBWbrxS0e^f8sO_ze+#PKC-~sZ z^^L^emW~u#NEceRfBzbzR)&e$1)~jrB{-<9i0ntu!2jSYt~I5&5?}HQl_=y*ZlT(X zS*#BEx}N1c097LV6f6X8UkBDj;-@^r!-^cT2@JXgSm1yt>b9O65@ac~AyMo`=BHCU z!f*Yb@zH&75waQ5SBCk2Cy%9M8H8Q@{%*T>S2_h7YxCk@mOW54L3=f`Qdj(A4`z7y z$pxyBHGuhS+0T*jx{D(l`(0V$L%Vx2^8NknP)Y#7nDkXibCr+HN<^53;)cB0tpa=y zg3x!Fe*WcNkcaHIugPO0l~lvG(JQ0EG*{a!Qxjzscgy9r_=iN&-;iUPB;&&X@+ntc z0%E?!D=Eo6{OP062C2v1dtB_mYHO!$iYHHZwH}U*Z6uq!J7G+Q9FI}9zdk7G3toV_ zK`5^Ib-FHDYMIOgmm|uqMCU(_iw^s>@3|IvSN|lAeap5L1lc%#L`P~v{@nhP!yY~@ z-}m3~H3$sr#FUROjV$;p{=Q}?`)0obXjHQY&;sKEovRr-D8ih&pl0NeDbc4beaZF{ z2$@HWdbSPsF^V@)uhY-vtMr#NmFCcOleA@ho zvx$}R+?_m#vvbzoH=A&~XDtF^6VU7{lzuv`7tb>yZ{Uly+qh;h@FJQ5bo2mC1Hh_` zRhx7@w81;a#DJlb!;Q$c>QI(y{XDy}GL}8X%*aU8*)YB^3g z&blL6W;uJ$Z#TWa~=PQu?+w$(ca@WL(1oDEKnZ{Q`I|&uV{z&M!Rgw>A1> z-3YpZ0Xrn1y^pYQ8v@BQ8Ew2lp0Hl#2V- z0<;r{^|w-`z!#*p?EoHhBk2VWBZvoN+Q3O+h==7thz&zLsJi?>%3^5gKVRq0d8F1f ziOlkER)i4<0|`SxRhs~5Y}o1Z#ig|;V98KG3?|ebdo)H$s@M~G)gWyoF$Iwi5a@n| zz;5@#z!qZ@GMgxrZW;tIkE(BNd?B2^g@wTyun4?AJ|Jf!{M>?fYkTGR0U55kBvQ=U zP%N)vc7{}~VxOo@HqkZ^+mWTj3Uhr5D41+ZjW6#z`u6QNxFDl0ar+ z*9-T1n2Em#c`B#6)R!o&hq}$lE$fvE(KI5C;D;PPw-){0+0#5UI*+tuvadY*W8K`I z+4SY6z6`OUJK-h&Ev79K!(03dAZLLw-ed03PMTeEpIS@QnD-qX(*vBIoPY-sID0E} z3ji|Q*l?ry(8sYMyfnO)E(m{)l_e8MSUqJI4aPqjIXQeU5c7hsM3Daex+TioSZXze zJGM5uNxdjoOlD0G?7vY(m5O^WR~?i9`JQeLHiuF?LKM59y&N`LSzeST_K&VHG5ehw zl{pr=?Xvhma;TDQTBABMJZy0lJyn&GkQ}R)?2D$7w8Fi}ULGIOG<^78yA7>2V2=rI z40!XrY;ppMwx9mtfh1tdtt{Th>B#{QQuBHND4^sxPlRxr?vaM2%@+MDtiCREAg)9d z@9VV5kRR4%9@7p(=trN+;}jX~ZmLTef;Wz+qEDInIfGuIcl=1oncRW~VlaX-RSdCZ z&FIp0?cS%JjSH=PsxNXk;!br1E3bbTR)iv*5wm^aW+XGmr$YdwS}$m+=|Nnz-!dq>Fjt+{vO9}3+q1@e9oVD| zm;BTESr$wv3eukHH+XsD?F?7C`_=wQ7i+(mQJVh<{ao$}+&w-2wD_l|@7Srl27r4* z1>E_BZvm&@_y?D@%nf0+?SZxWQ9odybjj5{pKktiy^PiF932Tk4Qffa%d<+zAI0MQ za-4cW+58;%aYbGzn+hEf-%e%TJf5o?UY};yy3hcM8A~Ws()o3I ze%`bJ$jN8cZFY}Gd7XduJZ`ZA9wKy=JTNK#doIYkCahKJg|4ndaSh6@^Z7`@g$qz-w z5SJ3Ax$WKiA`@NvI1TdI_2s@%M#4G{qS>h@(M2v%{{3s`rdN10HtD#31nZMrARY5k z&U=bj8WF~@J)SmGYU5#5L1kG!izyualBu@et1OK}^FOWxmq-|T4cwGHJjKRG zsWvDXFX9;kdxj=BY=bTfjkya{qfkDhT~sYEruVH*8(GukGABmsm(w49GAWhHR!o8= z8uEp@Vz1ci3=>-GT2y{8>R$_5ArAC(496*kgk*!S7>8(cWYs*WnY5blOVkn{Im?@) zee)mas$5mDlraeA4mpKvI5Y?YvB~ z3bHM0?~Up6NMq*7`k<)&QIF{#Qcna)q}3beF6#Wn8%MSlSwXI)1EynSjxrm35{knx zjT%H$KFterjT)q9-+>zBCjjH(o$PmLj*YedtrcE{8C2i&W<3wjnj%T#fCDk1{ zKdqc&VXaH9%(an2>yzFnS;vP2QYfdRBMvHLgT>zx9_Kcjdf=rgz-AhBRNr{cG4t^s z5_73`0Pr6_blhy)!+7&yaB-57Gs3ZK#p{3-V+GXu+9yL#y$j8M*-Xu0%o7#2I*XcZipv* z-iKK!_3x-?@geBjC%{R$lQQ_kxxaqOhZ)6!8eJAm6~bCTnMp^4z1ZjCvWe_6oT z=O9$neX>PB4*U{xpDY8_)BhqB5}8k$bJrSn zCpp|xd2>{mn#V)e`9AfF1uS1yAgEosiynd3fMc!KgE>8*?PL8uu=R#L#<~(WCt?!O zjkB(o_38#1MMjtn<`wR9_>}YV3kt>#Nq?AziD5A)9!S7;kt1x-ri&4#W=TbE7ve zTyVg)m2_S8uEFPzsq zEX0q+1*(@@t@wi))$jq(4*{!>1~&nklbbbAx7iYGI0m2Bk5f4(Wlf@&b7bO=n~qwC zCf`R4R_KPTU4i_cm*HM(-=&&6kiQ44%e0NW)^4ATZrAsC80!|8y>3&!*$TV|wbgn- z7neW_7B6@i<+^9f-LwW>W($y?>si|E`S2VL3(niEYXn*_J;Z)y#DbgY-u_S{vUNj( zm+4Cj!{lmVYYMB`2BWk+Vd@RZgzY@o^2wbswvTq`ReVzPms>dMphY{wu3fkE1Z5Se%Nhj4z?mO zsM5*#?fj!PH$6M%dl8?Y@riCWIUuH#o`Ti5z0Mb9IglR;^kEdel*-jcoc&GBI1a4K zGwb#)^&(31a3e}(RZb&vffnld+j;klQe-44k>VQ$x}1$P=Vx8h_(XQH$OhEgA3&?% zl&?D{qjZ}OK6T2YJ+{j5eQkDQWu=7MaQ0Ya>7{IGtV)PkRJZ;gXMK$7!9RsM_s_8e zU8WKj>9ZY9S;8ATPN^r^_AJ^*m*X-kf_*>jF5QoS;NSr$U|#sW;VI=k>iH%h=8R1a z!klR~hFU!ih9{WwpW4MCKjO^mj&OX_jh#Tx!e|B|Te%eH*sr7F91E1uRKAjE%GbtLo>j0#xu1sNRs<%;e0 z6h^wOyZ$ad@APCThjh0w@~Ihwjh3t}+S_Yvm2@=F$SztiAaX3OIuEcuK$!{m?_&?g z$rW`Z=wvon$8x{g|dOG?WI)SAG3t%bIjUX>Qrm<@FvMQhq3 zbr{dyfYFzcFm7~ftDz7nQ9i-JL!Gon^2*9oX9}C!D)Qf}w2CGLyo7aBr>Bh=J+U5Q zke(yCD|LeFPP9>X6_zS$Hnp*e^}?IgQYn=L?(}S{BmyxtXVt3+-g{AY9GPKOigM-b zMg#)J!5NYvc4VF8>ZT^6oX`bHzh?0L*iAdvI3CJ}!hz-=vaUQ_^%e&yctjl~k#8|wURkUTRmWt@)=)W}iHX}Oi*1ENTGmW8I{F`tOPbZa(!VD2 zN{@R&ZuKLl<9m8t&ba^}D)yb9FQfyai-70j?Z2+7R--`U|EhnrIvud*^ex#rJsPqQ z($dmeu=vi25?=`apZeE4KM^N?fPskX_!AXj3Ai*Cg3`!HXS0oJH9|b$Tb}cG=csz; zUnGem44)vl)+I{QWO7xxZ#74@q3}lZLsItu8LM9RJrH1&{~ZW_dq3;jQ=HpvNhna%g>|M4Y=?{$0a0VL19llcH*$0sU(1;Q2iUK|;W z%Ql*8M4=s`;5z&7P8=a_TL~hDmW=%-o_*m@*Mpw7Sj#VhMRS-WKWHI)r1rtH!{5-Fn{Tf*ay(BPa7z_q3OzZChvYNsMJ1?1)N<~6}CFN@dfLF zoJVUU(VcKO2*BlYwt&I874Oi%n+ZX2ce9fc5*F%h%pXfM?j}kv8>zy;Gw&c+l84zHb-5!pp*=bj=+rhs{C)#FRu4Iu)qGE?YPxl-)3MAbZ z6EOX9Oqd_GWAQ=4A9bV^i6Iu!ixmoagt8)p9}XhBTQWLvCFtvxFS=BURK%1s(-kS( zR=x*9yz}{a)*_@Y#)%F7CqSsp{8GsD%kvNygfH~A7>StaB?&J{K-z9cJUdxVR%6hP zz6gtvRd8LZAhl(Rn?@0WYyg6S3Qg#|xf9g9AC;romQw|xZfxtN=;<;ptB(KNO1tSs zUtb^O+c;c13%7rOU3rZQO}B1Rn(X8xP3PG!Hb zheIVve1IH7t~7-_5BxVjGL>;{PFH?E9FL0p#H-BwqW+!GXRSjf%vF%>&5=zb>>L{n zVn|A3M}7(CKm1xe(2d*7j`fSq;Z#ia3VSyb@kcUw^g0s3N#f4y`b_MF{5PvPzPblr zH~UB*5o!-Vb15_3Ri&$IHn%joRo387-7-hYZOoP7(Qrbp2nbv{jM+1L-PMeOFH5e! z+ZbIT*yS`#>*9_yBgdlzlC({Rjm#kO6YX|0mlj=kMix0MwJpX?_O=jl`)b6c_QG2< zP$z7@R#X_z>v$WXcaVFK5%{b960;zEr9PM1yT_saWE##C!=yK~V`98h%Pja-nlIS) z;Scoaa<;E>_H{EM8}C<-zbS~NK6~|JH)WY~UuQ44n+*bFXB{AR6VZ1vARx8<y@!N${R63fd{BSN_>oLZ;k1a32PJtaB z%agygecXIpS{yr09wHd$eaLQFZe(@YV9Lin#NXcY8VD3)l5&QJFZNU59cg9djVy&?$g`A;8<0Z606laJquwoKT zFK(7oL|(OP7(6(zj8HGHPb8?MR}aIltYV@+zl$!~YXo)k@hqB^hH6iyByMZf1^j}OY%S{1XHIKAV^IZeKNrB zcEx?Jf6OAzM|^FT)&Cm$lTpBosP%P`H*a{9EV*3ohA=3{i zdi`!g584|WUuf~#eNDe@gL(x%!z97*9tj1$FR&eW&JT6iL;Qajd&`(O*tT64D-@?V z6nB^6I>n2-yHko4cXxM(DemqRcXxMpcb_%S^M3DMYwxTdn-Ic~KqiwRxv%p+&f@~= zFlURy^Ih(Jr2iCkVE^4Bj0LG;AAy$9@GriBldWyDJ?)e;;L;VtZ{hv=+`D>MRJGAA zP$E+VX(Tf#$b&PH20mBpQg1~x=C~9i?tUX3>PtaumiwF=1oQ`_hP)9&@F?Tz{7it0 zJB1+`J&;JCoG}c9X5GkRUQYRH@O}x32E9W2PqtLp^}MNEquORpUdC+f*`xpjUv5TE zQHduu2;MK3U-P)k2bnhk;HdlVC?$o<_x-LaZ!>yggD^pgUPGmA?Q@|CxBvF1W;=9W zvaKT5VtBH_yu5khd}Ej$`10m?u^u!+tuy$)}V};)yZr+E>Tx@+j?{HI~H9Wbz zpJsiKyEyEaCjIW&o<4R#oBXfu9#`+HkAM&EC*g^wO^iYh-I8F#J-+ebbxRN`nRcrNT@ll;@tq3CJLFVcU0+ zUHm&=T~YaPDrqGciL(3<@|5wZD);-hwTs8sApH&EcCYJ;@#R%i+o#WG-4Pq#ehV{e z#qJ^+v=BXY*hY20EgGN@qG~YV^3(pv4ept~)dvs&-``H|M~ROu2i+6R4b3;0j1(e- zUlW6Np(03%6QGH170n_ux@v!P@^N!>LnH@LPvY3RA(@q@o`o25QeOj~8Kk^j)*Nu% ztMp<8?j98rp(0FVh6GgrSsUaHkzKVjCSfyqBxvCUVp;Fu&NZ#omc?tJjKK-2O33*q zAEZ|=EYRWApTD4%ERtQo4(y?aPqP2VQMELKH}|ROk66=19knHN1|dHclr&;^?l67k zJ>w3>6PT++D>l!hjPxls#`jMhe*%C9&K$MjCi7D+&FikI0y26+5s_iB1@US{K z8mro*unMjo^)%>)-`FO!bMxO)PdJ|ZwQ7;NJl&ULix>(pzB<{voBvzKMJxv(X#bG% zVr%@89to=9()@*|!S?Y8zLhHl4bFZP|AWKr-4oj!*WMGiKV>t&N0VO$#l%zo2EGi= zWF)ad&6V>%rPkUB`h3np97O$Q&Zo%uY|h)9Q~2S8Rq43-nD`D5P) zpMQOm_#Y2P&%#;fL#BL8IzCP*R#Ee;y|OW($b}-CbS1x57HyH_@?3J66-jW z+=AkW5m%oBuvp_JnC{vay&I==y~KVCmK5=UA%fxwhB;@vh6IN3n`5ZX57y+JXi6_9 z9^`r4wgQP0_l>d;u1S>`kQLjP?uILp(>EVfR8*CZm~HUMwkFArdKa+S$Yi70#7;u& zlm}|f15sI7bmb&(By*%;@_dm;A=+2j*h%v{%Vu;&B!H6a4dxA34s!lFf@%&g>W@>c zvY&S7|Bq1PhOq=jkIEY%X6Ff5R5S=9MJZ%#P&ka9{xU4)$RRPMOXckjz8g?}(%j0E z{m-@IH`suVEgGTh&Zr*n``rw}p8F{WD9GF#s4bRKm0OpxcVOxV0ZEV6j_m!1cFoNZ z59(Av(IOHQ8rOBt;UIVG8RKfID?Z%v93V$<55hHd`v$xnM%R_ioizRi%D<@^g!;Uq zXm_l$A5Ak>_d8k^=NJAbBAHk$-5tx+*A~9~Y(K%EVgGZ|4!_UanKY%LaLn#KF=}Yz zrRdkEaAYYDK~UTAkHNWVK@@ytpCQTl!nMgDMpBq%0<#2E+D4uYMs~L^r7-I=O=c#x zRqyu$&J<4KWPSn5v<9p5dMQXY^I^&Y$1}UF>Pg1icsHZ9jn$L!dv^` z`6cr-9$+U}=We(B`Z?ewN;~CW?>R=vi}ALEU^vr-u8dGSJgXl~`eMC{RmAE0>scyr}5IC5nf! z1x!N2k@CsqA`&wb8$yl!Cv*3&XN^(7=R015k=K$kgu?bd0y0xijZg^0MU=7Oi^-F5 zNN|NFXGb9~rECWQMGaL{X#Tvf2=D0#z_TX-&{^e{Uq!y!>Cl098~c4aHDePX#i6Gv9MwTFvPo>vXO$c` z6WuGecm;60`s70}l~m7jLHwHV5zpIJ01vBxvp2A#=)wdPb5Ebq?%X41@X=F# zB+Ov@Y2h43suwXpxRXmxF#Vl60orst?`Vy{_;%e$T{faqJ2AeS0NP=5?(M7_qHrqr z@Z|tkW{X|wY6;B2*+9|GODfCfHRwh_w1g!}e8RvLO@S$8hdM+Xz-$9@Vv~rVUnK`B z+2Kv14+e0$rc4;xACou3wNdU}wa<2?K~hu7%oubXGobaVZsehPdoqpud9pZny(?v^ z;v$MrT}h>(dLZLfkux|c{%ksA#Nvh>#s+&Z2amQ&GIm%#pp1QyZYOMl(NtnpitcSk zXrdVCd7=5q_f+9)s)XSh%;LySdVBbjz(kY{0{j5A1Z6*fK$LT0?g)HB&7sp$lFB&` z@;`1Hk)kK{fy)BhhJ-$6Eb5oQFH1=U!7nSt&T0RPx@swpAi1biHJ~x4ldOt$oIkSx zocxD^#3P`<#9Us9a*8>>GN$8thIO|b2_;NlTSuOLHRN=S z|5#t{Z&#ZjtU~9XjyfOaeP1ArMxU7X)~_LNGYtM!njIR10Rqd0da;B{^eL8&uy#$Ede++^% zlD}CbuORHle(AM`t4U;L?LC%Otf`W9WW;3Vthmko381va)rfVBA7Y@Fo8rG9R{Y{8VBSByv6iI&a*hw07G=r|b;C2L zpP9|inhz(C(6gnX%m%o*zkGMVg@MqPp8Gw9YVMJ^JKO0CQ56t$D0hU%M-s@^+J4I| zw>1Ys5^!I;U&r{`h8RGP7DPd*2H(d*`j@lOu#=mo*O?#8IMTiU|6m+x=#aKMz7JGJ zF&P^#W^*47RAw<589#y|39m8|o~F_L)S30jptUc7e=_hJFNKOEb}6Te;LKj){ysk+HK6_|hI(}^4NDhBh9ck5vOaa~nOa+HGUNUcoqWXvQCucDcv zATl!Zhm!6>pA8&9WDzXfNV_cM`54kw9T%wchg^DlH=9&xu^hjy?liaLwj00p_L)pP zvN^B?ocd&{X(Wyriu4?J zp(qa8Tc^aCj*#dO>t9byj?y#e>f&xPZ~fGY%f8>)VA-?dxeKt^ta%89?o$AHYy+r_~Svw8*-H(1I*#e3epmrE80AS((KTyk^TH9 zm*R-G!xTcN!*Xi&(V#xD1I32*ASQp4ocvHL!;J2sAWfASr4V>u70Qz19vRPWxzmz* zxe}%ii~M_rf57@v``}H^mHJ(w%`C&?FriYxZUOsMG{Wtwni~~GBEOQRh@Z)bp+O=5 zulAG3M}a>E>0iD`SQ^;fqydIP5iwa1(`NjXEG3kX)l012Pf;Menl$3HvQfB*P zcf)mOUIC+**m|bfHnTUb5}RM`z*>NJbdKMOokMN*RM%=^wz+GnW4s)Dz;kB)Ff0 zbs_~L_4vKLI_bH+X6P~Mw^Xy;n*q{X*5+71L9?P2M74~6%|tWFYY(`A+s-fUTr&)= z5^>sSLPey64kmk1N%l7@9tm3&R0|Pm@_eUDnVmIv{gp9lU!r{PJJ=ixUd+6>v=~%+ z4b-)0_xcDa68l)}RRsO{XV8fxG|+6=<$X1^g6ML-WZS}v|DbgH@nDfh`*~~ZcU9N) zHGLOe3JlHR*~}tL;e>B>QjPJ5=MW^c$5o`_VcaR71rZ}O>Z%vKjwsF)H0fKW*-l#A zr%VzA^E(EWi?L_40XUsfisOw&$kYkr?@ar+zT8!jLNPdK%(z}L+lY2M06qQXbyD{& zWq!VI5E$Ppbb_m3I(##nZwSxhQnSJUGlUhA&#q{b1j%3Bs*_&W*Kdac@b~G1l20>7 z%NJkG0e%>3J(yN-8GF`qz}h`cOIg}<6GgpLVU&AQEhYk%y+M0xsX86*-kIz`9|kO~ zN`RbN)eU8)%)1?Ig4&B&3HyoK4+eEk>A4@qlM*(LkO^gtQs(gY?&?DoDgx3j5i8`2 z`iahQ35Qi12rJzl8yZV57nkqZEsfsd)w&-8(M5CvP9P3nCY|`XqDe?$J3^dLLCR1ZrS_93s^KlGb z#vq*PZa5e}du3orU)Ay8sN~jPDjxe0rYMZ%`Qsmuvf{}-cFz3Gpkj(@kS_vC_}#$XQD6XM)c#R7UuB&jtg;V|9sw)6?F3s^c?o& z3=u-YFe$p0(iY-)1@wM&EB~8|?D{N8J>3*EAu_%7r#_L&y+ahLv%dZIE9=kdWnDUt zL-cRg4bXvo9P$)?Gs>mS(jMZ8>)z3HOb@Yo+iedcbX!g*9>Oj zUZW;{?;p13y$3+gjs$hb#?LD-E|;H~xS_RrT^-KAzm>!s`f^jftPXUNCdus-aii*B z!%$5*C4Ytj+jobu@_&{T?Lk4NZ4LeA0{Gp1apljsy^3g}=4RrARzO;(ZoIZkw^sZ@ zI;LQ-`s*$Yn4!>T+AGwRWAmZ1nvO6L7hAq_Kkt9a^sjig|6lPgrqP@6Z6ns**hzp? z+$EZMtCYMp{SVjmqOLdk+K+G?j$N@!|>msxmt+lB+4FJ09@@%K0kX>-Dxkf4|*BxcDIoJs6d z(fi_GvG3v6NQoEm$s289RxKIUXDibw-y96=6evSL@}va{R(`9qXUy1^PaLob7l}h8 zv7TaJX0`lU-#v2A=%hhnP=iJ976?V}cbA-x$;}ZY1*DUvXgAFIpAQ^)q!^()uo_wI z;@|ja%t^T*NcLvt(-EcOx}klj^I-AFMBl7heD9*DY7k#0XH~v;4emw-0<5lk4QA9S zENtJP+vh!HrjYW9siQqm#8$BMc=|jfycqm47orEsR}uJK3lWM?a8o^4$-CN;2DiWk zh|auFP_hX5t8LmunnX63enVKtbZ3n0<^=(#{YF5X_(;4TO%;Lougtb?%P?cnmCj^~y+SRdT1tv#8if_2>j343 zN>d7bF2o>jf?jsG+`?|4|6mLn!o(5$0iHk*%;x)NIYEA(kDI+c_^0?T$F#t$Kb@ce zE6BJ;fC$Sz<7?-F1K9zOj1ozB(2$eSQC16!q|Z_0*>y5{H?=aJ)IZTls)B{#-b zkxwkylwBI?Z5}SnE~^|KuwnOYouN8UIlNUZYC*faLz?$zm;cDcU_+oyLFO#HXIFqG zbdxt1x&3_->aTKFIL-@?c8uaWp;XSKVJ?7jK)F;xWT30{S&I~CmG*kB10R|ze8Nk^ zXAJI(pF+WOMN7bevG2jeA8V-DDKI(9lJpUb0VX94ZiU4&&D7^9Kh zhb^t+sbToF{q_^5u(!GqY48xt6!}wU2a_qxRvTMb(mPYqc6hr!YKd(FSeIMz2YL3P zWUY;c3VvqRTxfgMJY>cj+Om|wBTbM=_Vxe>Gs*hM#i?VQOm7S+MWIIz=0C$vodYw# zz>{kq_A>zEl@GD=Dd;?KJ~~O1Jt5>0j=`^reVH;AV=d;~pR7y9DLDNJb∾$#gg_ zD6MO>PoDH>IfdnO`7KLpzQx0*??i?kf0-`wAX6!(ctAON%*mZ%q+Wy8_9Yic^k-@+ zlxGk0t?vkiow<#+Cy(Dc!Z3(;YHL>J(({Z2-ojKNV1Iq92%o+j%rEW9Ry9`-eXo!& zCS%EDDVrWNe{x7<(IfE4X5wTsPnN8*-NiZ>ZS7mnTpmyB$)rUMUB6rMc4ydP5PZ{& z#~IeT`o@vQz)^BBn5pUCpqcecGuPG&ma(xmi0NGZN9NVYj+GfNW5P!BvwEuP*O4Qt zMH_o8s>PY?mGSzrv3j17t6redZ%wVU%l|wdVL|o(JfFNBy`-t;bT8e5MxDs|wB>pg zPu1QkmVjjHQ>t;B8HVNl`MVLD6CKl&v8!X^kFhkYg5kC_i4NkrLScS|tPK2?47S@i zQuCiQJegx;Rv&A1jmoNZLhM#|;KkrnqiP8S+$_!xdr}T2;?_5+G6|YL@h1}9-aObe z=>oYLM2he`GrrwkLq11v`!?rPWcC!9gwOV`zloNP7D$?FSZh^)|9Q&S$F#oHS-$?{ z8rDjWXdSx8(R|&1(_y|{#YeU0?5F%$qf0N|N$gM})v1=HOX|!OgODc#UfHvT`au&IMtO~}SeWJyNE70`N}V#0SCe>_sZH*?AHTbo3k!R+&; z9NMtmz#~d{dE(#t4)ni2^D;Osi=xI_Y12q;zF6&C6o!@(O7U82$uZ1kP7O+2tABTl zPpSR_t3>qbJw~o6&F(LvL}u$Ep3|}m4%Q2k%JtN`SxV(rWm(o?^5j@%VjWgzW%A+# zPWv)eIz8O&UIkM#EkCv=g+{mQqu|W``71&Q$39LrmU}h;=FO7S7d@3zZ_UVh#mCXy zr*Jd<{?}RtRW4;`Hq&90>_Yhy>IvJ!vC%32*`08F1ofb{A035Pc11swl7)#a>@cPx zf*(!NG1K#w8vq>cT&g1?{vV}K&q0%B8Cle$Vq6xtNf$5k`4o+;Igs4U9xYsD*eh8=0dxUe(7B`Tk~ zz;CHX%=odcx zdJ@%~#CgrZ95&AS%y+gW210AVl|Tq$+z<_dpT;jJq16G9dF}@TD|e#*{Tms=WY!d$ z^Y_o@j-;>LRJ{~;N8IoKpM(d}k63uMT0b*0D_;>RitvhGiy;^7?coi^)!QG*HdTY3TNukWBQCbF^Vhm4nbzTD4tSN^GiO{!FW*)r>5rB2i&k3 zmwdAb>ng)xjx!vTyn}BoF?=O*bZ6H?_i_&vF?#+#+^Wt*^Oqn4A9j@|V%WUt*=Ud# zy&>F>3LD%_udxLS^1rsIFP(sa;4k=(?jJ^Gc`c~WF{w`&gBjgK5!TZ~$;5JbCff?y z4?YU+SY5^xuQ?L`o~9q}G_=)ZNq zyC0OpF0~yeq4?CZZYaZs{%bhvG&365iUE4J;V$+1tv9{=BYhPgw0@v(gIa`e(Y8a@ z>nf>3Qo4a}2_sHezFcXhl9l*>?5|)2`Cr6TijEM|T=s5^TaKq*b`Zp(FT22H*dj^# z)-pWkt$&V*Vf-4W&Ir&&Q1|W&W?2u{@Fium0#ZxG(G%>mQ-7y3Y-ejW zImlpOMdJnzdcs-BJiIT9@Tg&sw8l5*lGN&P3=+$tGLbzkYxY6bKc8BF3%Rg%2hHkf zR9M_+Dh6LVfP#bKDLkAW2ick@Uu29I);JZ(-+j)&>Y7!~8=5x&;8XI3*DrHftsBbo zlf}C?744sMFS!kS&VPBlFhc_=1~7-w{t#N9-7as!LC3;WNa(3U1`LBLQ_0iEHJ%09U{i34Ds2+^wg>Q_A zx^fxPW!Y}a`{)~fVVa&XLK_TJ$VOuoL zJIkOzaAS;J(06dyp&=F#NHJ5+s;7IN*X^mgIGR@9;m(=SfWiHDIc#|B@WwPVoi=OO zLRbg1AgZ2NuHXze-RH!RC2vq~S3cGG5uA>dN|o+xI=ru*(Cq3OA5^aaRgE%(BTWGF z;)Pw26n+Ag{3T;B0N)r5olcZbX9R65oT`jAr=Ij;CtMaDJ*nKQp<=#!?pC%8@_=}* zJwEpRSHpC%K5}LAZIp15lqKh}X4=nw_X_q)Z7Vm25UP&J7~0G4k=wFAHYU`4EuvhV zxA=(i#8~LBJZb!qjo}Z!dNI=H<{yZ_<3ulvKJ%q2Ay?#|L{#3-2P0IU7zIZ^uLV*YhUK%1N)`Swo#KZpL>}5;E z?n7TYfd?h|LokKX%BwP$|F<*-uYkpOX*P3#@)q$t&BNssTW8lbfQLqv8XqvF@g5gj z75$N9Gnmd7;P07q^*lJp+J&#Z>1jOuai@4km!4ELD_plR*B8ae-q;nhnk&_VnNsgZ z)FQ$WCRV>u|7)gc=12o*=v;+lpfOX3wEr~ay`O7RIsM%_M(wnj-MB*HRD2BhB_=SH z_@pqWGgjhksrIv2V$-#=+***~E4CPyb=|sJLx1?r^lh*9X4B>+W&h)zv-qP)dlp~~ zE4CCOD3*Hg?J+>PJz22q#-~Z2Xb;?&K-JE8+nl^9=5*tF#h=*Buy8JIxcIXj|E<s3X_Jb`VF^9VWC(GGwSIg*AWQUSl}meNO+OYz%k4`p54Nq9X-hk8$F`X4 z;7!A?+O~U<3}<#|3XJhB`-%av`Fsg|TB+BndNKFe9{RXX&TA+mn@JP{A^l}o$T>8Q zSfUPGwCTm4J0AR@g+(a)efo$B`o4yGm{zkWz1@9Pukkuf4;%iTI)UH5z=pUdPI|mSmA*L}1X}89c(12hxuTr79^IGH(&@oue zcV*2Ks)+cPV(tKP$zimt4aLY%lsynT+C|dWbPC1t7UwDNCbxi;VofC)PF;QMx2fJB zBs}8|D?d4*V;>?U6=IL@VD3;_WpUppg-P>J^nnb_dETRQTh{!XAYCR>6wk#P0%49o zDwAki0>IfH`N!N{-Bocl(X`I**~CoW-5Ynm!tSj5nkF?n`mWkA<{D1^h1{J%fG}-v z-Tq3zn`w8B;_oynU$>jMXYY!Rz^i_YI)m|&U0?!91lTn3p|jJFsd@VHDuk?6{RSX}G=0}9AH zhMGcnr+1by6ZlIWwrBWzcb(J^q)Fal>&7wiysQe&P#qj(KW7yq2GGf$rX#MF37B&p zVNXlxI&Eddq!waevVnK=L{C^nZ9m;tov;+DwmSb%<`}hKao9ZMhyb0^0_-bsOnwJn z5@Ir8MBn{W@Di_m`!1{uv*K^*7-)ZD0a&w>_Sgo&NGkw0Xeee=Sq$XB=&STt2p%NE zX7=tlL}Y}t@Cc4zUT0_&MeAHV_Ue%6ifl*)t12P*-MX!{$ImD7(=#zsj1ODuQ2H36 zpNe|z!j8U3XEtrehAH}r9B9Nv^gf9*du+mL*ykd7e*I!K-c48IjFl^TOjr+{ft;^^f2D=6- zu~RRZI{cC=|D};3yv`#=M9Nts%gDt2`5j(HNKoFJL?-Rr(WZZ{VzqCPI&vgLsfdVju}Peb~dpEL(D zLf=?+4;zh3!nH3!cUHCIXk8k2p>i@%Pj&CHa%fJV@kfPjl@?xMan8t-Xr~DeBQ=iK znCr{EPxcJeO^rf79Ww+^JDzxow#Gq`XMesYjZJ9O<^E}m-*SQO685r zpdadsvX5sQ;Nq7HU&Dg)QqoC6({PWKmF3^f9r~L@WAHUVWcoo=!zn8h)lHMhY1&tV zuW$iKg|h)6YC~C5K-}h_^g!^t8$~$~(k;xIM^_nOm3I`PRgD`xs)B7HYMW9R`*9)( zxE>HG-AaoU`p(MyDN1x7W^rt_;R}-Rps{j3C<@;v&mAS*!X-;m?VgYAIZ<&Rk#Zr{ zfKFUZ4nq;a`Jr?=h|JwoUqvZmQ>i!VV#_3q(f_XV^at@Ns)nRaUqZH`aC*siCC|A6 z^G>^_$@u4w4G0`HJjw5dpQ&0q7Z3V$QyrO{iI2}qv6EDMYq>vdgUhtOZFSjzVeAQ&@=5Z=C5K2@QP(FfyW3BnVqFIz6CbslAoPMdb3ICr zgJ>F@%_*){CfZQmgSa8WW&m;flxYJ+ll5xLXy9vaz z0EinvkPzmP=qnZjJ?EpKC~=;4uhQ43>beq{l_c!U z=>Xgt@JFEqINmQ!N}7xTjS5y_?*I#7T=BVU27j9sDgtE6Gz8>+To5K|#SNKtsX{5j z+Igm{I#K^vj0}W7+QzwPxr4xd%0oKzX9D(Z5|5=*cd@nMt-v@J3E-DfN?Tz0d9L`Q!Aj( zP(drz;^*rC1$U18KB5Ty@Zg`bS>}w_1Uac#Kbl79g<8lxs7jth z9`Cb^L~JIQHmH`#ny{eWW;yiR>aQ@i;(3r3qayfx^htxP;c&w6bcv$mT3dLmNo5_F zgiq`WOpq9v+=;H1fB5!>uR&Cm+Mo0CbsFfDN!&6}O;ozRwfK$uMlzcvhNa65Sen=y zE78l3XlIv_X~vrz3TLHihg-mxmh1@H3>WX{1(g&b8Ni><{#GyeQlKY!e20R+zUhJh z#LF&GpsC4K&;hdEuwvBGMz%4v=Tcy*S3ZN=8ZO7L3^nCwsMj_sxMKd)a8gOF=kHcX zB{!BQ@RhBNncPct(~XC9JEh+5-49H|V>yw5ed2r;tEkhQ&k8@tdf(6{hiW2dIRd6S ze?MJ_2`4&G^fk?qV3b~#!}XztN>D*`-!q<_@bOu4G5FMUE&tGiUCH3yAj&e|z*9Sz z{Hrrn(HG}k|1#{N)*>*)C7AJ>Hr1Y^QAU)GfB>J0}c!r&P zD$zLn*;L?i0N#tm&=RG(KEJT`%0wdCc19_A!)71ndoUm@LnR0qzn>(p1}i{4ls4V2 z$&b0g{F&FlBu?m0q~L}xM$ovVC|nBytDull&lby9(rE}!c%e|21UhRNgr3MFB)ISs zaemsGo7|wWS3|~=SG_sPg7I*dU-h&GYR6$x9@-Hqr4=3oj6}Zb2kCsuEad9N{YKjj zqScx$2rzgfEzw6cu{o`rD7c4MPmTU%qnOOO1Zdxr#}$5evl97Mh%5)5Z_I2Hg!Bob zz^4L?QaYU1)^0Fh4n2^9dV-S@ISZqu6LZ?X2_t59>+iUgTj8CB?aM?YCqTUX zqH*_MQ+CSh$M;?vF6R>@R9N=n`ag>$Nxg*b7;AcFGJjy+njgHfrKre|+IGeCCVrVD zL+g(B%vgh4sRl;x zh}BRU6NcHjCWVP3v(Q|{Q`$+qU=6cc(i8S;i50Q=V3Y9UX2$k=pyiM4>jPDx^@0&b%D5fClHT}ljz)dujufjVCqC1Om zWv2%TL%Zxa^P8N!TcxPl(cfL{%FBi(Lbr<1$iLMW4N#+jf1V55?N7Zfn3An8`@NG8 zA%C5(PYOEI?*+tnmsMOp1>LaEh(@7ZL7*RQ7rRUyXB@7cWZP7U#N^A^3^L5yCe!kR zzV6YeQ2wAioG1*LfJ%hY?7VAVJoq9%{(i~dCBF;X+VkPksTvA;t6k?^0&iLxOqdtC zCZ(3bZy!6acHD7n({z{A**|!W{kl7@dsX_^faKz{jur;8!SW|TAN}S&iQ;DkleOPT z2}nTVk*1}OBV(uSJMDo~NyfS!33VN@D!Y$yj#U_wu2wm)YT}W7-N;ZqW?|L;M7ndqG&W8E^mp{QDQ>DltX6O#vUv9dRs${ zfft`|{v1F-4G*HusGlh(Ym~HQn6)SO9^u&b9d_AAlP`*5L`xwo z0je*+DpZu)o6XS$vv#uyPX@xgv1L4n!HF=yyTgu^n-~Y5m9JjWx z^hU1jEbTLVlp*!rSi%Rt{%~5H5Q?}iV=>C8S+y$M;x@JAIbhl7H`o=pj~>==5FUvV zALD=)%gM_}3XV)}A-I=v;t*?h6b+?!;I`b#idAr)tt>wSFRg^8HFv!CH}jhAZ0?|g z0p$+{Irg-O_UyD!PFPKJ>3Ib`lv(Z(v6vylNz0d19)@WPtxU=-@oP$lYDp^Xn`3%C*$V#fC2f_nAus3wIowI((97uV;t zrs40n$L3E~JC+7RPuBDVu=uWICX@Q8JXSf3!^McC@X}yg4B^HD-w;M-YF15{Tj5;y$C*udjHx5z4Obfft2q;OO}YA4uc0<*$d@l z8Is1C6y_@pPH`YV(7rGhKD;Q}$D$KUAm6aLx&7cr+!s!#= zwa*UVII1ZHD&63e7lGt~a$Ya>j&n*c6~nWlon@J9O79I|jrblZG8jX10=z3W8`-)} zKVE{l471MxeZ8(eUq@Gg zbwAx_FfAsG%w~A{033uqw*KdM%LxU@ic5C&R; z_c5R=Ec{Zq5_e=*jt*wkD=f$vQ3*BIQDr?$N-@v-Be*{NVO+&|nf3nIs#CSR$jvr3 zPHCo>NzGowMux3u8-yVKR?k7Cy+i6{iG7lPgWkYVR?p$Pvlg74cX=~aWh%RzA|&~S znf4a#m0__GF>})}T;8FbrzDuAs=7XzJ|#7!fAIA%Pl|&P8D&lAGBMNW@=tke_cO~o zj1Xxz;Q^B*L$?nl?flbKmqnP*F37~YTYrVHl$U$XgbE}e>Mx!#?7Ju@xOw6Jk;B25_8h*);4ojR1lg+s#@usc1df?LACS6Vy z9hvq_EI=BcXaD{kWHuaVAG_PE>y{tE=*;Pl`5-^;(QI=`%JAsrAFs$aHZz8#``3F zKWo%Dhz~nUOE-{$kP^r4r3#JWPY_N7fAUtyj6zW0eG~lc=7Bm~mIRs6**JW64j%9w zPvx_n%A(0kjY5fvMt07qCecV_7X<8r22D?)%JWOP7dt`)Df=*TL=QS|XB6`sLoDfk ztCVS_mGQzEvFaPbHuvRVyCP@rcd;o}-Wc^H6s0Pq>vT3y{jBBuImZ?AQaq?jP~(=V z^-4S2Rn-a-usl5TSp{#E;CkqsyeUrsz2|*aWm`l7y^Gy+W z*+mC^c!o-5R`+AgTn8iOBA3_)&r8fO!QP0F5C>j3mQcp6fK-TqY=rx8jKfw?`@~(2 zBpz)j7V}*ozec^e_htDExxqO>s`SFvbbYcALPh(-fvT};2PB^c>-`A?aCZamv9{`5 z>jSwaOHiPCX?1+u>Ac@w-N~-JfIk6JD=(fK?oQ?}x&>7s{wYe-u)}P{&%T)tuM)@( zE4Tiq`}NFly6LleQ2I%;8=#?(yg$JSRf`k9CVwUEH|Qg7P}RK?^VSJ~QX@Ixeh#}oT{Uqt|Gad#VAS50^OopN8P<<<<@E;S_wtO3v#A}jtsPPalui1Ktip*y>zRUTd{Q65-i8-< z2hbzK03I_J>eimv*y0CHZngjwFZhRPbzS|pvuK6b&20)DJn(u-=5b87}A9n;6r30PC%gj=@TLF!Q+se{S0`g z@Mw8g=puMR>>}|V;eZjfaTihy5H)Wf-8il)j({y%-`&WFm`&K&XA8z)0=Cz5Y6le(-&%Y4}Bi`2;`NHsJtTzqsBqQY?s7?Y(@AhyI{^Dbm`;sz~k!Rcbt& zFl{!^2DF+BQjbO-OL~lBO{I|S_+$NYbyaaY-ouDt47MvMXDxHl3zJzLqP%~2U$V0H z#jK5f@HJVcFq(^e`=vKa#cRpnu(Ya9`>>2tUf}N2zyqsh7!hk}qX;7?IB*mW*-Giv z&{#T4YzrM_Xh=xQJoVQfEAcj^;l>YFZB#}74|v!e+Q!lM;{X@%mpsnV664pHB?kI3 zP@F`)^G|_-6^DiodG1)|&_SYf_)0xclTWixGw>1Q{(L_Qj>mY2RBJ*4dM@8d;4_4c!PAbGq*1bz2A zVTJ~`jOvR0>oIJ1#M72XdtXqR}>62irBE^ z;jrYjtPa;Azp#`mhN)h$;wXlEf)c}Q@e$q73X)G<|;+`@^N|DL)M8tXE#? zim@70;mR#Z5;YWQa!pxoSjle!;}#3l6Qu>t)yk4U_7@&09h31I(rJ=G0$;5?1nDcE z7KyExJCdk5SA7JEhIrMaA4Wg3=7+fTd8NZRYuCxjgm`(WsPV+H)|JvlSPcw{^A` z4sdAVLl(08mg22p<(_}}pBWjk4~d|vt(Rk;XnxYkqscqvCaJVFKiR`ICAv;~c!Wta z&AQC+e}1T4B%O!mk$71gMNJm*i{Ap4s^Qn6zFSGiL)mZJg>&I`PkQG2KTPGR7C&+D zC#x}ATAx+*PK0!EgT9!?p4Mr~<1)*Wavix7Dp{rrdH6VOmeTPD#j@PKr%BW8!PtHm z9+79y79+{Xl!HEVqtMY-dxA_qE)*)qO3U%YzzoI1OqrGNmJ@>pM+G0@K~F{8Jr!yw zG$T{59^?YCs^iK6f^o;Dd!w^eM)p{T;rkK`p8h{?mpSz1ga@$`=&Mjtb7xpbpCeKj zR^bnMid!#_$z;(E#zdKcE@|I*2&50RFI1TV3*9ke2}g^R=mA7~5cg41Gbcu z2Htf6wX)(gr*2#*03Q!4WZweHQ3)upF;b*^0p9lDCX;~6JHnXp`ONB?iZXL2uo z;Sf~_TvVk}IV<8#P^a9*MK|qx6gn=SE0yB~FP|4R4wvYRea(4b+xV(bc;krpc(%@l zC&0l2AJ2LkX)YHBFKz_2g?l`wT6PeyJz~G;+_Q5;3hx(T9?<7ZjbKh1wyIIQUl?rZ zZeAF^A{8z3rHi&`2~Z9g2r0KUmtZ$fu?j#T2j|oh|ltvWvH`=Fu2%(Gi zmM|Gpub?p2s^-BfLs=M)o=44Bf?X3CQuZ>NL@O#^g8rfWm!K?>NnhubXbZ#A&d0VsAz7 z3)6~Bpv}dQSBbB$n}@Eo9^Z&hOP_2t%z7Q#G%YD~l9(^QVE2C2-r}(K^V=gI!cE0p zNlbIPef%_gf#hPt`8_Q^B-}n;o@hUVp`1!|3`efBzmi_uo3nB#kVYm>Jzrz&pClx$ z6<;Bl2VZQ{C&yesMN9hK#olL6A(V|L97( zju*r}4AKh)ty^|l**<^{UB5kV?&`L4+DwvX?Q;qW0i{uB9{sv6C{7{CZ&HD;oOqv4 zkB~Oyt=f>&gdBqkoS`wU%E@QQJ-w#X7Tk(sFX~{TJf$X097e4Yu?kf6Q^U`I1%j;o z$oJCBw;&1Hc~nq zR&V%#oYuaz@t?_>>Z7P3L7$ZJJSn~B*Ue3=t6H#E!MQC8gil9NI4Hwmhbc4dFl2Aq zx_k>%k>{)jdaP~tY2N;4;>>|Giwq>%Q^J8pIUbv$u-93=HlyiU;K=@BX{l|&?n0BR z2w_B)>#)-rikRNhxpr;#mxhALYy#PDRA^t|!O9xZ%>OuPlzOgb7!hTcf{C^SlPVte2ZM$dej%`~V+qTuQ*|F2HZFOvPI_%i&B-OE1 zv2EAX`_8xbo|%(5U3Ik9ub$`D|GMr7d1vU02>yZPHRLoFsEZNMeCy0KpT~Q2$)|jh zy*2vlRm=$2d?Vr()`0}*<4Sj;HW0kQ{C^eLSS^i|pUz#2B7izj>BmsQCrH1bE3&rM4Kk~CBrNRO zF)%LJ=L5^*+@G`&pAZ~eEyl>|r#j2Ezd&=y3t}sZSCGP%~p1e&qUi;C(z#9y1|%FQ8@@G|>#Er=ssGYjSuYnqsI& z(ozH4tL@l~yKnHQ`#I-)Z=ik^IMQ_l2f)1x|%tM?O@}+o;S;vVti=7W>@B3Wmfj3!*BB(!Q zvF2~_{E^92Oa9vlfPr@LIA52VH%`w4Vfd$GI+N=K5PoMoQ7g4?bv8i0R#^J1{q*W|)eWf|Uw;gTL6q z)#D4_^LDwYyuRW5lcn?lbs}~inyj&qT#*IeX`>h`Xa6S%6O}3XO|L5~1Pe3@8h;P% zYZ27)+`pmA^EyWDdGi3FZWe#nP!X1jIU%7_9BWl}46mE1#5P-2{sDpRCZvaJ&T#i| zJ5EW#DfM`Ot|6&On9>mDk;Sec#AFBuK#%|~T`3Q%%JLzY^6xr88A;L54HLGE?6iCx zO>SJq=wYVp(}QaN9}Y*DJUtSe!%>eno~zsCVJs_1465O}O}RyFo%qSuiDk}T&It9d z>fAqj$zKI@0v8V!8@J5Nq`W*20#&bCzIAnWqt6RE2dyt=)JpWsZ!MnHAKXu=Bfoku zQ}tkwtB!oQ$2Ks+Qc7mN+CiQ zMO3j77JZEr>-Is{&-(Q#Q|O0husVM^RV7ftT?+3OI;9d|fM@Ak6F zl5jMdvYh1@9rSlR3g)H1Ap!m83JnRDZc6m9uVP+U-L`2#<2Tueo89`{c-_zw0q93xIob=d%j7-C^0oe-W#qJ? zlgG&wzfwCJt6{wIBZlac`J(R=dxIA2Sv;mZ@B-V@*`|m;0(H^GqoQYIB0_w!n&c5& zWZZ4DOU&kxO3vNz*h8Mfm|)5oYhrcc{!9~B1=5OSNkn%w)%fcFZt~;A=1}9{HOh$% zsEA%^>b|s95fh%`brtCuz7Ia*p84@N-?%rixCF9lc9xq0(hYx*oYZB2X}#r-CZ&F@D@_4AUZ>5OGh6$Ns9)2dnG?^eRt{eGh`Al9NR~vy&GC2ycc*!Za^&3Q(^#0QXK|^zUEWG&l z0pb)c6uIaTZJ(wUCtP{+ zHok=4{{3sQjbTNT7*%K&SH!)pSnplUOE#kqtp~bV6VDLh@0>OVD*W)ou?jg55%;Ie z193~AUxL|${(lIPw{)`uMQNnP068<;10js^ZH_iKpW=AqRf3GA-8LaK3fIcu|4oqS zD-N=&Y#8gB;S(9(*}o5)&2_BEHT^Ejxy+tB7kJ`+MCVs_?8snX>CDPKMyS2-2SiHA zO|eyXbZAJA`r-mBsIL+-zuqNWbSmBqRqPqU-<3ysvD0wLS`ESL(=& z1-F?0g?i49erF$ppSz>e`QUc{Q0I8yy?gzoxTk$MkS2hNL*j7C#Orxp9o+OgOBI^E zc2CIiogPvPe!QH}K_;c;8-#8ROZY{^9zjaltNTQefL*7&a>5K1>+g95gjBCrKwCgt z*jBs@v=9FigQofV5`2}F9Vy?8uQBF2VoV0D7vtFZ^>tA&A&a!#GkqRzud;yciYQUu z;|wk)tz!wdtHZfkSs8``Ra-2C2B17rTH;WNgiqD6n89p`_{Mv8?edj~k&W#S(2Tv* z;1eXJBF6L)^k{PU5L8#H{5fso%kwF!dJMAIQk!fW-y)N<{AC1E-G^yW`1J1pP60ue z;DZNlNju^=bMUH&Ddz__E$=u8j-7v~cU#yCTmwFtU&cEtG$%(9m_U}%$TF^~Ru5?+ zwa*}Nkx$LH>$8urFQA}A8{xOY6-SL|7f95bPhw`);Ph z^tc^9hZD~Gqeu}wDS#M9YnC|e@a-@A(jx~u_X#XHS7tf7Lha2Q>}1fCW^p0_ zClg*TN)|_qK(YWjeH%9s9#^@7o1pS?DuqGA1SW;STta|;GU&O$z=GPub7t{auP$AQ zbl)dH6IPR-pGdq@E_h|eaaAdGJF$_Q4t-%(>T0U1^mDrBrpTNB98I?8Zf~p0=>D?F zdycG^)9m^6Xs>x|b>yJ_3b1mErX!)RP2CWTI~>!aC#TtTS~#wmLhjTVHdb{=vV)EF zbC1tCc$Z1^$w=_ANqtxjodDMSS|lPB;)HxslL)6qX3H_P6iS)$EEmh5itA|jOVx~& z#^8a0ZEQXL;CIBEBl*Gj!i&RV?iA2#`A&_>%o>G5<+= zDJ^}HCKE%vk_?yES+2~(VPA$wt6{XJ_xd$?y9%N0>h~%;`r3o152O>6xR2;w4CMR| zROq`A2i9vDwIYO=Oi<6jVnv|MF`v_h)DJWknaZJdMOS95X`5}n@uzG(iu z0xrn*su5yXe%kKZN(elcOcz7 z;wpo$IuyCaurF+K(~aZvlm=a*GQ5=lMID?!$N2uZ@1MI@9nDINY9ANrxOP(iqARGU z*l~yTLAUX9`;#-CXuvz60*h4no? zG&mf0Y>Fm6MXlTO<6EN2E1?b%NFpmP=BmW-N|ToV*+jwlTXEe~dO8%>t|rWD=a;wp z#AoQ09=$KuZB*0cUNGP5HCAG%9fJ>>T+ z5~3h-Ew!TWLkchB2i57JrdIuRnpREZQ)LuJ=)lpr^S)ad`%Bs1|FWX?ikCq`{7HKi zE&^ClH#p#;$pjP_Emoq&U!_-=syD}m&$k;+4rqfMjez8RDFZxuWW^0wGPsQ--7LXO z?J<@A#4g_`3E;|cle419X`{qj$W|Qbqi|u2R1`AXW#mCl;S)+RbIUYuaE%lZW$o|t zmxzy{y6Cr0ep7BjwDPL*kwDJW7*yt?Eq3`}%|c+5*OKFy1PgLnS);>XN1a2NL%m8s zCHpzYOY9ahkJmqx7&QtaO5dt^}s^R1X?xvHISab*(;V1O)VI)TXNJ~})H7zxzJX=M6 z>poSyQ`q`pRBwAhEdnp3-~3god=<%{pwO}p%4yW?cYsXjq6<5xHPGl9Fw7ho zxk#6!v$p#M7FfKlwnai>$f*W0Bh=Fh&^$+44t|Q+6c=9AwAOel=x%lJpl-$d&RgSy zAi!%v^qDh`kdWNGifr;n(e5juy`1Dy7R-`(Dl>5YF+n+?81AB3Q zLmd9Ej0HOn3Rjl#&0QSk9+#XB&JKQtN3`L2zJ08VTHUO>|r!!UsM3ENmVd-|EP9I&o*Qx!DAo|553u@6~;NOybA@y8^B< zL$;JdE+mz9BiQkbUIzVIb3`!)bd6n(7^Ccgf#6#v|Lzw87rK(I=?509Ax$EKSiv+;iEtGd!ZBsuETz<*yd%cWF!4P8I7gfG- z-oXa?`d&YXVov-AYS6ylnJEyo?QSsrfQlyn`<>086UA@5tvFL3QU7~I( zX6BeWcb_kb!+9Xz!$~llfXG2j2$wbGVBPZJ%TM|M6jBIXNl5XP&5`K8(ERl5#1s9a zkkVYcZfgq9+FoSnq}&~UYvU?vDAGr5aqu7%442|}q)`pD4YlR6_|M1*;<&#lf5EDy zC>zeW_>b~Hyl6h{QVgAXkx4)komXs24d#axG7tCEd>o?zW3X{J=lMvdVsW&QxS?oX zj6W?agFTW3eM#%*S}4wM%D8d~{nj+ZsA`%W>X+=;>u5s*M*qEo(#q1z=59Q(dS6VyC|CN+da@BlX13!=;?3c z)^82l`dmUeT^o4e;>I;yQ?V;@U_ngCcgvXLTQk7)73BWHcPW1T*WKd~Fb55%N6oU! zOTyA6u4L4x1751Gp^_JtT% z6I3?y2NB|aA2OKQiWejJvkW76cW)vK1#&nEiD?i*o@>)l=;z{iK4<*EzDY;4Rl7** z85E*b_3gGCUr=M9n&aV-^!URS8Ae!s5XZt-e`#%EL#Gby=g3<#)X= z;E%yA>!{zCQOM+9v|_saC@Ig=qvAbB-L|;tOY(~Bnu%Kuo>wVyTv$S>TpL*3J=fPZ z6Wkr;GS6o&Q{}Q{bVnNmiqXTQ)t6}*`XE@r7SEUnyZN80jh;XkAJ31gicn)SEk==( zq>~Fwi2IE^sU|wzT7RpOd?@o4M5rDQ!GdoQN4rJ(=K8rVx*`e~ z0|^MM0rNlwd+HxSLx`-#WD)bd_HdVpv}APq2%V3r+QPx~*MQ)F(( zDDBfB(#&>kUd7k5V05f7w-hzcjkHA#oAuo$+j-b4o8#ZEd?t5|ih?4JWHWoHNp9t5 zO2O-gs0g{x6j65|NOVKgFJ~TH8yQ?YT7%0QIxG;CnQtSN)zCj9LeRIkNHY=ME`O@; zL|B0iPBvG2cQ;8rv&YLfR#%0(Jv+AV70bdWMu|}$K~Dnqj!N3FYL{fcPg(gGll3{4 ztWYI_#8>j9us?hr*}`pLd>(IJd|Z58mxy{!jJ}M8#Z9VLQj=F6lrO@A@0hu{o0sP@ zQDURVzCOYSwy8;o6;!KY&KNxvGI+2_9BS{@NZC`$m;9U~pJp=W`V;MA>I9&y}C@+CL>l zvRGEZB8QhWiz9gIoW+}Ct>Xv<$0-l9-3>h!>N=EgV_PTqHZoS$K)#Cv@PEb*)INE% z_52Jj9R$f9x+-zB@G`pWAaeJpl^nlAP~Q(6j3o8!&GN}=c=8_#)$7c;v&`)?-09~x zCr*zwtq+Mmy?1-_UlyXtZi0)D(@#9Z1|$b6_}4PQ(?B2z4}5;7{y~;Pew%hPWK|9z zLZ)EA?(8{0=$yplQ3i2#*hKV+H7cNBIr-Npe+@fjxl^9!beHHo>sZ*O3!jhsDv6G> z)E^PPe+GNE!#*yn{+pm>LL-G9cBDFDlf1r5P=m;({kuu-pV=}x&rj-%w9d6^YR)$P z2#~LU$V;G*P~g1anNHdrxLhMJaBu1#`HG3I^13;{byGzejzXVS|8{8JUb0J6h-;5y znIuuCF)q1;t6^t!@ocSL=gEC;w6qMR`e|6F4*Kt5kMM-uP$Pv@2S zKxb;AQy(tV;ia9)$|t*XhkDn>c0Mh~QXk+V;SfK_24G{3B|o;&rYs8jtk*9u0BdjIzd zUeXVND!6206x`vvxV_rutruG%Vk5&$G5NA&EMP3|umyU57sBcO?yq$=oNEfppx)KX z#p8cID_!p$-u$1v{_mPshAt+^oGmQSwQ_uNc)=cJcXuf$A@m@^K{5>>_1y9~`G46# z9lvtlC?OO6*3o}=RA(n6U|UVrD2<)vszq|X2OCaI4I{~8l`YYM>0#5bW$+U!;wgkQ z^wHmcDo9!4I)Jc6xb)@43(K?7e+RX{ zZ6Blrnza6WpS((#Q47u}P7BeF%yQTZE{v**{Sw4q@$STpYCqC`VA#|2DCMK`=j%;H zXK|U#Myy8hFIeJLR3;C^ttDmUat#6TJprqW=(tUa=8tF#x_vz1K+%e8Nc*^8;}U_0 zjGE$m(|si-JWJvVN*B!bR^t^V_>WO0A?Sv2sH}C@?Wz`RwlO}J8pIl%_>-L4HvK%% zkGQ*P+yuAm2%O=hr1gU7ScZ7xpoX5wVPv$6q6;@|RMCW80)DTr<=_z@cufCvP35vA zfeO?JQ?l*wt0ep%WToBYR8Rxx{`%4G@1{W$ikvi%8c0@H>-xoEIHy}fy4=9Rg05j* ze|?HUWLR3>1IorAlFyBPm&GMO>HvF$gF@BshAx~>_yl!SH>)y3!_2U_D&38N0iJ5V z+0CC$�OjE)*XI6U?|EapJE15OLsiF?Qxavcnehq&Kba5D0{htq~BYbsbK3V*LI3 zv3R4}Gi(1KCeJsHY5Q@Pw$(R!q-(P`NlGuOD+!P$X67%T>G>syV*`zX%Y;@B*E4C2 zKBwkeuJ~TLRlheGmojtK+uOcRr%dvGdY=k4=Il2n>X{sP-L%N~wk1mTz#4Q};FTQs zoM3Edp)JJ8Z-c5jHr6va`}}Y)k|Sh+svVA`SW^RsT-p*kXL7K=dQr$knD9BcBzxVz%#c6Ww4BCUPZ{q|v3fB$<7gl~%U zq}7OHjS+@fx|HN`sYKhWxFS@YrF49`YWE|JCS$oBS>J9SMX$f`Paa<)l)9;FiG3X^ z4Wf;@`b%tc`%XJ11uUq&n0j`Fi#a zpGtGx8RXX3Xa6O-<_j()ww4_%Ta7$URuV%7F6e_fe41M*L%}JBti4ElU1Bq>`Ln}y zaXI;!zxOnZM%fJlM%vBBSv81JTeyr0YR8j}I(@U{X$xpPF96$HvQLy}{4pbXwClc6 zX*6~0WtQ$e(CF~h!mU(ZfZASIOz`h|yIZI7cSxz(_|A+zLRoI4!4{2@@7ibS_Fgm! zDHjcMqdE+}%@4>IB1yg8uqKV{Bl=(mpv11B-;pzDmAbkXpZ+*uJM1;uo!PtbJb0Rh zrDHhdSUBGe+v6p`Ei^UQFKjhtV+R)7b~iRfK?Cid75Ulh99fB0m=vO1VOH>)1g7r{ z8kUv6AE%(8I%6W5g`JSd=m@I;Ax730Mxd-fZiWQR5bF#kF}v} zWU}=R)&<w|?{Ji!l*!f>^E6LNgG&TZb7 zDar9H%i{IaivSBzYSFf?kY*O5KjYZ2+4^^lWQo#M^RDLg4vJ~$IdA%3MR#m8#t~1xYdA<{OLH%5NEs8o3=37? zJ*7K*Tqm+9%+!yq5YpebBnF|9__Jf|m{^DdT(;#Vlmq;8RQe0oOVaa-5eAdS0o4k{ z$ic2M_>mn?NSStUWel~~AZoIGQ!D?J`WuGJ05j&xW)}MB5z%JYXSpKX)Ap)tt&~oF zkr$eoYQiyWS6tR+mJy+T?AmU7C%P+d$hLeGlz|B)aHhF#GOjLDc$u%dKsuZjq0N+|_W$I|;fAd$49 zrjW&2F`0NH!h*%>Oc_I!XKEI%W*wfug2~azQk`Dt zr7yD-exm>vjb6?=EE+Dnlgk{DUP3OZm_uF8S`=)BTC& zpNQ=r;3YdPMRNkU0R#zoJ}?!bluS0oO<}R6Fr5Pw|L);>B*>{4F?cgxI$>p9<+#u& z#&+=20&wUGG%{)c$-l`9sEqV!>LcUr&cgxNI!p3i#yn|UA$7m0CawHR*blhHhfApG zdh8<3VjAAZuYmQY#=j7$sgP~{QD!SHk228FN&oFordbuS_dT1dTKx?rsi1mdZ+|VXA z@sxP#Xx-Z#6>NO$CWGa%9?s_r@mm4DP8v%M^~CI5U|hk$D)Kz_gz*{QAVcf-ehGP} z;^FSyaW;?HM%o@2C>4#SLc5)3SFnhZ1(=u~>aBQYl^8ei7Yg9sJp29(M^0%;Q*|I% z=9cGmLs5sH`s)52;WTF2ZFfZepR=>GGO?+H3VBy2)An4?{HN+pem*hC`$V3S>m%?ty}fRJDSI z3gn7(^bl_X#I`;S90rM`RPBy3gN$~XL|G)$PE!KvMyD~BZ+9eC>xKVO_p}~~SZS?( z_-Yme#TgH9Ttvov| z&+RN3m2v@d@hco~RC(sJeTRG2@+~ink=iq~kqL^v zNBKacO6!(XFugFujOWhouNl+;=5yVCkR6*3nuG)uUel8)-7<7c2m=(KQ(UTZ!lSeE zx4w(??Qu}EGU9q>y;lnzj0rlxhy&cfDGxl?IxoJWrjIu;2-HLW4D56e&HfLjbU zsH|*PiBL?rZdHry+j^w=oaz1RS`t2(Yed<$$ums`vMkkp37m;{a>3OF@d))=V+hx; zbga;Sv$7;5X12?fs*!<9DdY@*yuo#QzOTDC%(LPx3=~zI(yTYFzN;knS-RJ<1s&B% zgP?5`nGv3Q-?HP-I#b3?r~O0EgF`lwYnrEpQP2)lE5a00l>JK) zx!A)^(ArzwP-(z>VHUiJ^Daneth4|~3yvjR*Q-gN`xKR@$|yyZLRRy^dM+VT8x+Up zw%!wR&ucft0(4$Eb%Xvv9E@x%=<&;KMco2}2#fJeCA_{@s+M-1C=R1vKi`j^w~6JH zFpE=Q#Az!aESESky0xpfa7DhP$LkRESPRJ=qx!m0_r{!AD=9sfS|Vsv6?XqSi$~U@ zjS1r*w_>I6oG63BDmftBk5x5MUHRJ;278NBrFm^A|HU&p%R00)1>tSxK1N(KZiecEU>h z1b6%xx_-y4s?fD>F$-CjCHHhjv-M3HImKy++mbujmf@D8IU9H+f+2HyC0wi}TKL^- zgb@*`8m52Ne0O9?Ijx8N`+e#m{)O~b2BNyTFK`gvJU8y{iQ_iQ_6HmynCdek=)sL7 z?JDM80g5Y$#zdfkThbqp*yK z^(%plah9<JP2K+g$Ns@9rSm#?YEz8EOzpNuJj-<5~SyyQ%PW@$H2xwudp*=C1 zL}^`^RR}ow`ADNKxKDAg+75xe&MUVb83}0SgIe5b%o&T7z#{-jgvIS3$O9RpBRQTJ z&RUWT-s*bLQigUx_2=?(^g|SJ4@5`%k>NiB8iKYebwF3D<`~DEqabIJRy4G`7n8m% z;C|4L%u2Je`#to>=Q&46iDP>o&tp}T+Y|y0K>N+-V=kf2-*|^6E-3cFl@06);*N1? zBp(Ed9odW(pw+me0Y{GYyz6&jaZn{+o%!zpzBe;>2pV;vTrC|a$*dg=K4S}^+oB0h zZk>|M@arrtE|fjHCFD3rXWR)JeR{+nXPNSW9u9}L8d^rgc2wMorFzY)HEL%W%+W0u zxd&?Sd&NwUg8;Dw;B*VQ9_E;JGigDfF#SGv*yHC!P8!K2ux@aJN*JHf%tgUTWt;%yn z*;K|JlMw7cI#J-OM^VO2!lwHym`#1L%SO@|C(cpfmxDZ2!}#ecF)S#`{130gSVJGJ zLKp56Dpa_k1K|$;4LyS^CNnVnJBffSKsF$f@{srJAj=ql=A&~98mkW61}n7J+0brZ z$v%CDK!rQf7g3YYkZFHjcl5^v8HqL z;P4WP>H47at*o8?F<}}{NWB^>DShn1ijZY7+2)ROkhSMHyjwNDRTj-auwkt@v<_Kuzl3(tWREV!YZBM@s}>t`y*R?)y7f09nD_d(6ryWo_2I(9 ziW);U<%S6K;*5O$2gnv__wy^B1~GfkWa-XC#)oqo)!rc6Mr!6dL0@pyQSE(DjSw?M zXs(x26G&~^mKWJ#C$pDOJHl~|vp1p+NPXuy1&l6R%0GBEjY>O;cvy?x*q0-RLDLpI zkoOBu*T67yh?#mTv51mmauNcTOFpq+G8dv5kr z2)}Wqc6V{rt53}x+Wltw6=N3R=q{-KCusy*Nv72WQMVKBfW>fgWZ{TsE-?2+eRr`b zhv5r#f&JvY)VuGuuQ8o%9_X*=8_0l_1RX!2&0ZYM6qgBEKkkj4l5T)Xu#W&9@S zDg*GyxX|yco@KET4pF61aS)ryJ(nyQ7Tk)jK8{tTc118iBLSiE69WXqtr(`At0oIx znte}VvA3RM!{d{ZyZWoXPvwieNr5`YAk&c_#vdlNKW11rK*TM)PoU}Bzva4efE<3* zfy@qVBI(9br#c*JS7amCCHU{TKelvmDzV0INpYhrOLYvX1`#Ae$Z8T>8f!VobVi)R zvrdbgwN%Yg;w;HU|Ei|951R*OLj|NBlSy?iG2m2=oxiecVSC^F3hbC` zPygwA8vr;sX`jg2f(HF8#C(~~!}8t%2#Hdw&W|F!)O&hdb9jG>+Fv>E28m2IN5G-y z0HI0B@jX2R=}2>>5*-A$P+(U&M>!>wofPTW?6CXQF=qK)jno{G&g{p2UX&!aQ-(zT!pfcVqVXhH%U|Z_Y>@u;3%&zH~)Fd zlQNbF$XxyY(MrN}pEm+1bB}80$qrU+5T^2PYN0?PN~ELw6TEN}ME|XGe{o?1P((&a zoC;1w+o;evT?pyyq>;P3i?N;OWOxxc{-2@%J`7TRvM>*~@Dw%b)Z%dIkiRsi{D6Vq zln%GM3Qg)akYEsuX^dA~G@9AH=&`J#qQ~cE)Fc^VTJC5B`QB+GhtGSc;NlzhXKJLd zzv-E>P~17qEPQzc-4b44gOJF{=)+p`bmkElzC6bilkQVSq$?juaT zzxvvK(n@K%5A;9_g&7}wfU*R1YE*4h2qS)gmNC}PX!VVso%?&F$cU@oOl9Bg^a>!u z`tX=Tsw-Bzu@eaK>Kll@&E-J!iVEj5k~UeYCD}7=XSb+j)5pB=Z#o8+&pO2A5VVo z^syDLWX^|>EQv9+4AU8{fNH>P8^>vE5%0tif%DH_Un;N>#)YJeEt3!7-akfdNkBWh z!Nu_&qxe@(kV|_xatm%^mZ5~3JmA4*CjNS*{q!e<8sQkDODBd^BD`24Nh{aLAEYBG z`%7*YfJ=a?ggQ%212>)9ExqaV{|6c?unool=F)9u515e9)5+4(jmrVcH^~r$bYC;!;Pk0O z5Q{&tJ1i&8*d4$6*rh`yR3=}CG#-fc(}+gTXW&`|FjakZ-?`;63r64G2v>5GJv%xi zZXk#ANG0jRfE}1kiDp5lNL(9W)`me5%boi8`zK`vw?i>}^ILaWG)H%OEfSk36+uBx zFN2^;dba+lfjLg18)}7JkJei?dw$2&+8l#oz7{!lx+ vc9BW4ucaqP{3JCp<#?T zi_~o05=5=?IaDjKmt8CtK8;~|$Px*fGC~*4uw*M|1W6V}jvA5|9XX?y5lBZ)IC-qV zTfj;7uu8Xb$+9{)tS8lNBQQ8ZXLWfm*{X~0{eYW@<#YD+;mCdY_LJnj6Lj~~cUcHr z=_CI0*&$k}irXsqdT_K<_KvgBO2*Beu+ze(MT!?ptI$RAUFLK=bfrvX*$uOrdylxkY-W~r(76F z%V6|O@B<99%~<>wW~0Lg!))w8{z_lUkvkZjTVlUU*fkP$is0$MqDV@9@vKeF}s z8(Y|Loi>QozQuNkxvl5$JK_b(h>Jbvwnpgxi*8SMvQ4%AK zIEN|YC759Y{fA*IG}~sBhpGGn;NgNCkdAa>KS{8fps|)PoguFK&8o`OHWx}k4P@`f z#(bH;%p77F2|?VC@c)=jyVDanEEOZ>$r??i#9`kqakC03rKV}UNLCxL>d>2Nqn452 zbNZ_~@hY!sfXG{2p=%aN*JKf^^gTqhK+M-8yn$A=%=fEu?t}sj*k(6umk84z(R5m6 zHbBec6J(cn6skTJI;x8v-M)Y#b*}!sk zGNLtF^Ex4^TUsAo$JBQ_i%99zAe9;*`#ip>yd4ZE9`8ttb*GUb|JstOgaM+5iz7mJ<#Lf8 zb{y@FbEcmW4mVRPFIxkf&nz8CMHd}sSonx zi@(eX53wnmi4I*RS|J8=S<%+%k0P6Ko&@NVIjpdvXoCq%7T8Lr+5d1U+y#al#*>+-5Z5_Y$eIS`jQdhz~pi< zBEmQM)cDEwyHHY5JrLr zx}a|F*D0wniNV;^2Q4JpSxoEx;hNrCR(0?6@T6atbJy4m>a?>F9@L-l(Ks3TL+VfO zW&VDyTbk@?>pH*Al_tBP7Y}bv7F`y)-t(}TuN4u*$OqA}4_>Dx!|FlB+d*Jx?9FmJ zidlp`h$!OHJKy=G_DY0qHywom|MU6%ICM+7Q4vx0!XN032=~K63NgNS4>4R6O+8UF4|6)h6UfX>!vv1+gL_6Oc3-ut(i1AFC$} zDl`g~^I0G1JwX*YIYCX&ln}xqB9>xasLUowqOyeU7Oqn%As><|U9p@TPNXWPe8$gZ z#!tWM3r54FLsA~>3tCn&hn!(TVjLg4ehZX_dY{@B4(p1RS0#E<`K>9yjMk5C-{-xZ z&2so2po;7?tb1fLH`OW!@{p0>hJZSW+P zf8_T;4FS4I{FP44SEp+8Pgs)j3m#SITt{4|b;>*E(h=lsHK`?&-MSl}+MIV}ptg-t zGlnTdRxn|S4H1cniG`+5`syLfTM_LE75;6wmvAaXekahEyNqQrE1~FvZUQ-aEaa$P z;1<9_A2KVIAbO(|FqYpg)>f4x`3mikBK#s_h`7WNr(u^xo)y?Im*ibR7+XMwq~@bY zvn*wt!knfedA5cvML7AAit%il>#8 zg;#S10pYPYg<2yK#dsU)lj5`@UM(Lp{g>;qOJXTI0H%H0Hc#a9S4U=$TcF=~uAsmB zO#F9|lS@qweEDz8nX(Fe<*0ONz%;Hgt$BWS|3U z<5a(b9=Q6sclJCaUDRZoqZ+k8)}#*HxY{+4+}`;;3)Hxp_Ty`i)iC4aY1DTf9m$TT z^85X|tyNeye$YRb;dIaQgIU`;XFc%wFkqw}#jSZi&dB(#(ZWx5>!%ozP{r`KeMrUM zXZJ+0w1ZjY?z@Z($jX%U?7Pwk^Gl<*^tu(7y~ghLaV1GD>%)QDKPDTx%L+jZEdbux zjhm6LP~Q*;yUzq*ayb5yoZQD=K;D)H2qzd+)TKrBL}k*C9zHkof5CEhBz=5Ss&u8t6#9?jPo-H24@8C>uwc?bj4Gqd()SRvPlD@# z>CvGWLOmfD;M+2{kbqQ#fbs0xM0yQWf-LIeGDdqT|58VmqwzgaRFv4IU-wqug!<(V zc@2P57#~x8Lt5Sx_U~%+PpJ$Cwj@n@hXbi-rEg(h_4tjU;A1_QJsy!xv}sr}e<#D9 zDVAM-Pzxptj_)YVT;ExGNbX5mv*(Fz4}bL?-#`h`HE*)WYAum^9|Yih3B7d(NVbwY0sx}Q51?oH_zF8F>$ zbe$fQOK}xv&rfmM=R2XYN41A++hQ3OFCBbWoi!xJ26M ziqk;D%URE(*F^@t4E2)}ep;F~pFqDqHq20vdg>=K--{Tkm3z8g0QxCaJh^bAU%IIb zuwnIe9YrExRoK{2nyggTFX6|{-ry~A_&3rPJWBcCUJu!O&U2p{cp>B{RT&!()tno` zSCJjdn1^-LODMB^#_dMW(p}#ctkgPC==0 zg2+g|M83WUaR^-=f?s%#pn=(IW`LE#(1iZe@DuH;`$_DHB7*f4_KW*Zn#p_3630&^ zYpaqKzpM~N4>=)EA$)?k z3%kyXexM}EQ5&Sv#8YvVf0i%CgdboGWm}G?CJej*!^>)`_b?7J2_Z0s;UKWuU3BQ9 zN4M|7%+#aAgih(U`y1aQf6;LvvUnRCOEXODH&SaA zu(EJQ5>~&Y^GK;n1s<{gnbL?^K+o36TYVoKzH4V_ow>DvV3+`R){WtBtYE(0TWG7< z-2#5|!$q_zbynCmO`xQB0H(%*iP#n`o6It@eg+YRJ#F(YsSUEl3G&>feOr$%(~Xc> zh^Lkr-7$x-?%A%wJ6BeAqP$<_QW`b&S-4_rrjOkT6S4L}!o9&MaT;O9&owoxsluuo zo)5oE$@1z8OrShN_A2=iw+kzJkQ}Jc_P9~~0XK+Vq~}GV@Q1l1U+;w#m-o1x zMpA(Wmb-t(1@_rm-OM1pqFXcsC*rYHAoKOe=XY7PadMR|p&zeB%DEH3ra9{Myu(z= zqpaT8`{1!bfz&eX=c6BDnU;OSRH>h~hLLG|Qhuyhe4{BTu*Mt`gjS0Ig*QSFCE!^U zF>MIfcz^L(D;R5k;OOp2OMwgrz3|`Xb+v4wj&tA-BEbHBRdU`gEg4NH+AC?T>-ykP zh)eO(d*h+vxFqCRyQT-)-s|_yq70!K`p{gXRO6zbU_>Nxv>t<)IzKoVG}8Y4~)3JQk-L+hb0dCARRe9y&z%} zjj+5c;jEe)upkmD7}@&7R!E4aMLo3tzXD(spX+52sD>qjw+T=&?O-*I5`PMg59vp= zyh>&>^a+?&CJg#6{mhDZM!o8QljcFTW_RFY;&^C=$Se_t?6lSRH)PUj{FvlHDuTfT zP937y<6x;=-lbKZQS=aYR!#I|F`ps~o^urU^Ve4-E=7b7;dIY7E@ptAcQ7G*>c#v} zg+4>sbVg064h9Y_JTGlk>t?XWRvtr6-Dtck(-f8=eN$M2Wk5j1vQisz20JMwksvW8T*bT;rg*s4 z2KM0DX|;}JOhGT?mxf;#ty*9pF*%2*mSd&frzRZi4v!bO45TYt6Z!y zakmTTU;EgJ5uQ<_D2twZoQW<;A!k4*$}0sWpQ0uHB0<(>p!tQPu6z#tb3x;$!v6*D zL!;hX%W zwfyo>yZ_4`S}w#f@);B#iXUF=`Y{J{Q0eiHuHbzPS)}Wsl)#sjZSp_mtnv2|JX@TsTxQRi&@{&rhRs}-%Gg~ zE(7-*;V7Yc(LWM*UPjzdH2G>&U1D-tI-jn6XXPL-)u!d5sXwz>5;s+#*RVl+2NO`6 z_kV?=IB`5H#Vcz#8PvT0!@;4(|2I558Flvmodm9qIKB&>7b=0spGOemJ@CAd!oZ`; zs>4fuIc{$aMePL^gp1hP3_ zlLmlQ#Thk^Z{<=m#aBwEmSFbL^?9^74q2>L1B@>{Z1h+liBQIS$Y5CW-V2PMJ4j+E zl1V%4Ecuo-_M*{WsIN;K@We>~97|Bw4e-TJ?aAg{+x7~)L7KTkV;ZM9xocZ+QW-OAh6gp>IKOAA?w zg#75cA^^nfz@Xv3^n;QkZE=eR6Nl|sUm(k!ylFCr6+TsU>2Oc#ydZG>WY z8iqf=dv{6w5+ghYW*jBZl(J1#3;;4RW%2_B)f6Sl<8P$Jp+8+p{@`huh!insz&-H! z$ao>rYS{xI`QA%|Lk2XFxEl*fnE|HAB83;PG=#HZT3#5fPb!ZQxl3?a6tzi;hE3HO zXJK&*3Y>XG=4r5-k5=BHV_-^MkV8>WbN`2OhrQ^G5gIb_BL4FS}w5Qe-Xix5y?tn<6Wx@-#D0s5=Vp+u=CBLR_IOR`XV zI5u5MX|y{I@?ya&pu~_C5dD?bz3&S|sZlCqDgNZzXi?T01!;q;It7cJF2As~+3+ZS zt&70-Oy{=b{mp|7^0>LNwIn6Kq!$y4#?0w0zFIgDbk8D4DuNsj|AaiK3lhCfW)(~m zSkp9xHA5cMqT^)3a&>O;2bSVPmf}M$MU#@U6~3-`d=S=^iA7tlAY29FH$lm)9r*Rl z#sTrU5^O~*S!KJiBp-N^5BVh98D|WDvSg^`kh)C{cD2TEW5}MT*|m3R*p;;%ry9Uc zSxfN<+33RdA2{%fTPeRJm$Xy9+9~E&Ab6NYv02uHO04>2qwwJq(s5cS)K;dXly`_wQku1_XhOY042nJ-9BZ`R z5>2Dv<^`?!BEWIz#0wL&Y(1WSiF`zQ!%79|t(e{RWp}%kihCFq=}KOZxONP2{F36j zQ&{(QLQ7&7YYQ1zBU)?*@A zeF0DmmsnRXE#`jQP-_6`t;+@ptXd^u=T$6ILezQ{#j;vy7Q64eTFoWbd6g+Pe^Iuf z<5(3c$vRD}%gO60yVX%t`&ByyrBpdtr(rZ9g+@DV?R+B2$A*eWx^q|CyL`)DAf?Pi z+N4#pL_{q(^^k+JwbBA8EZP@%lZ#Mp1Co>;%E$)Js`GID-TBf7R$bU?s6GE(gwCcg zV0Hdq{Uh!CcW^Q|>HPn95>&G)>FhH9PlqFVA%C775|?3qt$$+Nodvf#3#RS;jzXTL z2IZnNeeyhauCFX#je17`ZIhM_GH|5d#O1P2<&m@Bl$&aDoEjuIb`)I$5vOI_L}bw( zniiR3%(1$028{{^Jl z20B39{lDYB?*HBIA9w!WI|&N@vsl%O+^wHwz%P{Fn)(zmh%gChS6NRs_Ezm2$R0;& zkdEjr4wWXI$g>`dr(wN=mW8pWh>?!%+lX1jahUU3+sJP$2XZJW0%A(jfeh2dPgzJy zV#{7qC76eW-ctDm_lv&&CG)?%fZh_#{UCyy=TUe6?`V+2|35xC?B@SnglFK=iDMY~ z6eX1PIAboHB#4n9h0gTGnL}(F&p0wP1FpvaFQDg9ibJ*>Ab)-UBIr3WT0v@mmYzGl zYdix!oHOA5=j>JlblKbXr#&0I@x40`_%tOc5(r@gJmf>$u+OhPT*W~Ijb{Ri=-0C= z;Gzf{_8i4M`j-{ouqXc$_2^&mU@`BJKjJH1`Mpfg#F^eCA!Bzk_HBF{8vFLdxiR+b zco`b||7$!0zd8{L5)3ZRUt+`N0KtZhTzYTndih7{+Kus+yj4l|4t`osL6rEx1{Jz@;KE=OltDT;?s)M*TXQjL4>k> z8Wcu?V(jn#94ukz%;9){AN;MB=Hy4ic=imu%1BBK;~sFRy_cNSl9Evy_rS6&3$TCU z1AU(7ECKi6Z#u=vkK|z)iOG-Po)+YawZd88Lc`cEjNgF2l)X$Nh^Ui*c57fo4uVr93{Q!)X7pzv7?riGDNg zLD>$YfO73?0_p{7+0zYKMX?_j@@NP**RNn0q$oZjpZVAG`2utRb+gDDfMX_ zCGfzM?7HT7&_6J_A=Dhd|Lwq(OvL7Ra9~!OW6kkV|3T%!tKbqJ<>G7 zT&pwit-~v#vF#T1jm%RaG2GU%UF@94ms)9d%i^m!tjhzB1Hzl*&n9(>8=DO<^vwg4 zEJ5b@MgL^0sLk z{*8%oWib7+nJ{x*?gyB(cAdp8*2EsZ#3XjqU=}pj-4u3%BzG7yXRs_G4 z*F~o7W$Z1*6u+gBHz4_CGS_AKUks_VV6l6E#ebA>5N_4|sgU$GMXsIMBlAJ2A8`9@3ay~yQ z<#WgQ+%Z0PK?$<`VTRmbxLxXJ8tTsfM}xj*{~e8vI{&|&gm(PTKV6)^0YkeFo|8|* zJ;``UHC*V&+)fK{?D(z|xopN_Rssw>xPp;0NB-Pk*WCjjxR9a=k{L{r0m=8k_mH1X z-_+1D3E~A<1{35lW(^nOn>Yx`bdRFIr^Yh7DG_vUVXf{=rXGaNL7V`7|R;iz9sG0wd4iEM7|Ix{?oBwwb7|q@m=k>>& z)xTfX>5feLTPKrd3(-^Lk#0&O-I_(ZIf-;L4r$s2Im;M(+L}39=}!s@q~y{}o^YCc z(eLP|zft;W*4?$l(`3wKf}lhVO)>-=ev*Xms!>gK<-)EA=2>Zoj^Vke{l9r~=d2nXuX9sgXVzvNrSlV~be5;e zj?KAabAFsqwf~c;e>OP`thxVpG(5`f|3-%=-TrSEVGH~}`hH{!)IZGVm(QdKui@## zHSCPMT9$a`ZG{=#h137Bq4mndDT1 zyYUrvHBd>DBhrK#H%@ELo_fBXjktOWppA1ZJyi@nZPz=n-WZAN3E%M|_ zD{7!^jHvC<0&SHPsEQJ(F(FV99nce5@T(L@Y4=;sTcgkj@s-=G9#vn2pj;>jd8#4Fh}7@g)KM zS;v>u@g?bf*YPEN*L+D}!DqTz z4)Rj3OSx3)&yVW#@?FhP_3!@*MRDSImVj$$KN-}#|HENld;f=n4*z3ELEfuYxmfMx zerE3t|CxPb=YucV1hTh=-uNpUYeoE15*8;*OE?7bWiL&dC|`+7!aTk;6sy7_jzgAez2U`I9YLj)L@2X%Fn*gc z=-Ic>^Q;>`xb=HwVz@`5NKFJOx8x&;8iO23;VnqGg=oHrsl%G_wJ>0P-=S*#-vaeB4Rz~(f2jNa9}kW?|NotYFT(#^ za$}%dh`$Kmb4hP>RL>pNa~Ga^s9OJ1>gNqrfV%Ua(ea7C{&)NT9fijH&$){NbsLE8 z3g8x({o<{)<4x2na17`8b>PBFc5OnL?9-JXgOxzXhIGcAL zs^)+B28VRDYwPF#{n0=_{~rvy{ohW4y8p}HPbyg-$j=SUvl*IB1%^tu29)Q^CiOR= z^D%*jXz%v;I6y+ik@0;d$0O)Zfre$0e)`e_vzssCxHJO9t~|BsH3hu!?Y zi_r1^cl`hA`@dD{e;TUa|3UxgIQRbd2c7@tPQo*;WOda4O{xFC6|R*1{hxy+44pX~ z@5@B?r9@DSbpBPwRAm_VfMc(|Tsnv-i`S7y`3p1l|MUZWo+qvX_uy|j&()9QVHuOv zkKmpb)W3wtt{J4Bptf$_>j|qw(?Qg@#@QTOacZqxK zcN&-N3P^|kivm>A`!*SAEBTbtypfJ%{Qs8xPx(Z@DHQwaR;Gey|7!q^2Wr{VonJ+< z9~W?c=k)&_t^apP>rbbTubMKya5pn%5c3h3+*|RztVibGrh=q^RrE3I6XtKB znGgH9W+sm|C(JKw=SQTr*U9QDi0wCr1l$g+HXW@pUp^Hrt4BNr&7{E x^P>NvPjXy~wyWdD|Ax5nJL>z6`o5#S??M;4(1n8Ve*pjh|NoWn!oL9W3;=uzGIIa` diff --git a/assets/gluu/gluu-5.0.101.tgz b/assets/gluu/gluu-5.0.101.tgz deleted file mode 100644 index 578520eec6ca697970bf530783bed8c8e1a9b7d3..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 119331 zcmV)_K!3jDc zVQyr3R8em|NM&qo0PMX>a~nyvFvgjC?U>8Y5x%w;_P20Ee(d>Tq#gnUsYiF?-kBbV zq|{XNH3Zn2nO2XKs7e4SR%Mnlvq+*F3f~AXy>NKvf8eFO&X?Yd7&}G#ZVkj~}bQjYebq@6+w= zr)%4fx1T(Ey!~Y7(e_$nduRJeV+}NJ1e>u>%mrj?jiuWfC+?nnAR$yhfhpn5bpRj} zxCcEkh`V)6x4Z!)eZ-q!v4QDY1;gD~LaBpRECw}> z*d<~B5+8V!^l-lhBV0E?&LbZR9Fd68cgPc4PPyiG zy-{z}x=6tK_M>UgY8Pl&V}`{uL3@aa5E9s*2^x3-Mnp(<&W4s0n*mIBP0SQ>HPiTP zut^O%8_T5A3xJ!0We@vwXC@d`Vg>{`g8X+`5OR$5kdHL+Te?W|iG=aSN0*uU5n>#3 zfry7@;^CC51r+)-dy;!NoC!@9n5aKCngi@1!ch~nBIpfJZKvLtEEF-sP=KH;mrM%} z3K-CS-Gf2|NKGXqt6}6fK?Io~YA8$=^D&PCIIL+Z)Pk@Z(AWnDJ|Y5(p_=tA&qJJp zBQ>T%L_{tugO-6MyJQ_k_y@^GN}AwuXB|dS@>6xrx{qX6A>v`go9i_>)O;*dfqp={ zFsSQMRYwGN1LUuR%xGT+fT4(TEGQc`!G`3;rQ5>x447&a%ZF>m`XaFP*qeZxjM_zD zzJuNcgWWC`6L8a43&M7mw+Z0cg>)h4euzmep5(KAu^?QvNK62=i_0Pql!9~hB%)9oO!$GNW10(-0ji;iNWM}b6%E(Z>F676T+zOkyFTdM48y1XeKgm zR?x^UE2Umt zUDd6mx{f^wJzs#8zsz9S>cLA{w2nQxei3(3vbp{4kAJw_uJ3Hu8@0yo)4QO{HP$dg-qjX;4f zQ4Q&?TF)}NvAzDWPczl0>_?sdFJTZPeq#!NndkrQuO2`B>Z|ed|Kms1`TtfvUw~Q- zoRDA$Vvc;!9Re{x023}?5Fl0uodMzqa3lmKeGYsI2o(VKddL%iPzE4FnY!KpGO?aO zsM)Gbc>;(TLqsHto?5QssL!B}n(8nlAnT*C0``DpPD>N(y{^|czo6%#NF3UOk$NUq zMjk=W{x;{1W3^!F5>mQ4(0ht*XtK;C9726$imO*i!JjE{e&NV|H`)jFRIZ{H=PUCp z=yrxt+8$)YQf)R^hh)e|%L{iA6UoEN$lJv}Yl4kNUHxyXq0V|V_6A*f{!^vAAm#$G znUnz#(5o|~_mKnLnJGPEzrC0X8a~GXI=MuQVLye^h2BLRSt2m;nA&4u(Dnw%j|1co z)Qf|>#|#O%M^n_w$(x?+8TyEnQTyBvLgM>p* z>ETWhYa=i1QyRn}a)yO|aLVW@f0ynPT)Rjf+r0# zL25M+BEhi70q)JI1~6A!2uDIUtSctNQ$cHcFp%Q+DGjiPje@v~2JjM7)&#$Nu*_)r zzFB_cW)#9eN%dTf4}i!e2ZAa-Np50w7>POCCzocZOaYQ#Qx?C33`=%yH-QqHH1~8h zgV-e0nfOeHs;f;Q*C!lAl0Cz9Ab%)U*;OE~aH9Y63D;xDKz4RlRqsIl22mUY8m2@! z=12`!A4LHjV$#>j{IpOL9Q2NOVGB;DWhF0`*~5DdKXAo^yNC+1lvy^ zJvGZZ78nM5D1gH@@+gs;+EcSs;SkYSB#)oyZbb}JKY6&LpY|XQVum^chWLO6eiQ68 z^66p-`nV)vNu4`O86-mheSL<9fsrRT5CbR_9dc@Q5r9HKx&7M}E24fPec0u?5ac5o z6EPpYxynO~C(Y=Zsx4 z2AInoTb2qTCg6Zb!5InAgPz=>JsL)oAfjk`5yWvF9Ejg>caPH?Vo1bHvWs3I!Z*Ro zSDoK!9UM+BjyOk55hl-_m?r?jmvBvA`?tN?}A64?vCoUgNw??Q$qOL6zu(LkD*gDhI}cPu$mlMHD^3+bpzVn3ZXpS zZ|VCJzU4L$4fWc2jXcXrkA@*6zWoV6&7$T!*@96t3t+A&^r(?1^gNm_AeEQpruD#$ z^Ds|dydAFY%n~IFaJ7;nKS4S24DpB(j=O>0I2bZ&PAP7v!F_>-Tn-v=4F)u3e0|zw zc(W2hJ_8}dv0MCjLP*P5zAw-a*deGi^B}-IBqxp@u0TCJ#68pmkH22MWb&wlVDe}& zxnxQcQ^b--`BF)>e1C$=x3nFj@I|W9SMcSt6l^35%jGqq z*bFEDA}9t;pazCHsnt}&nVSI#rP>0fRS4HlmO$SOBB#Ziaj0-BoX=!Wz$}jP^RuhjH3hiD~&-2 zhv145A2Dz>7y^4aLXd|zhiq5}2Lgof0&#!^K#*g^^n#*nt=%@w`fu9exKGppoA|&G zD{<^0C}M{ACb+_4Kw|;A$fKdUcadc%K-Ups!rqriS|fe4!vUuu0t4J1fIv2z%soZ^ zIhuJdW`XmwcH#W6_Xq*?U@)LuG{1iQ_|c^7bJuP_N*J_Af~M0@+MuP9)INPlZ8u~8 z8bJm_B&2{O$0bK1jmJC z+Hu^20s)U9?J>CyfQQAf30g51m{_amerV0p6{MF)h@o7Lq)5&2&q__-9m-|c3_NF9 zQq?@7>YVA_;yYDSy8wK>{mqUe%l-Kf_)tJ)w(nyYAWzi6+i=L=2XCcp|2FE&uLfxQ zeX!Tv)5V%Vm6`%euG}DICYpt*`JG(OK{%{gk9Gy2?xP-z15xLfUftNr*VXbr1-4v8 zGjLDUvij&z5CK+CNj0t<^CPo8Y{&o2{4( zu^tX2&jMcx*6CA5!#sc9_WQtB$k@>boCfW)=Qu!3u!V%TB{5b}B)0hb;Ee@81r>nF zJLPQwAfM8>+l1S67OCu%u#-Y=3P21aR0nU5Tb+X+_TQZDpS2I#o&Dq8{kNOo?b-g` zLHli8jlP59H%I$NCue_sTL*i3n5fB}S2e*zwV_=>CW|?uj5>PhYk*z=`%eADUD|bQ z(D)}}udyXGXI5?HnwjIuM@A1lW2ZNuap22+BtSi37ZWr3^@`-U8>i@~N395}WoZ{N zu}hlc5l&_!=N#x)iQ*)NX+s6^>|)}}-A_65YaFy34zA?JizC2Pa2?=5qMX*u#_J%F zi#g=rOS|IfvkIbmFH5y0H{4E#C$xh`3UL z0FI=Hpqi6A1rk>X5#ZyVx{OkLBxaO^NJ?(%)+z|-RdPiIxTMmX@aNK!os}9=a7qB- ziD_#>oT>jzp?RtZ7+*dQsh9ZlyiHoHdrZ7d8cH3@+I!z?9Hn50Scr+oyTR@+Vi-wh{421*IEWbejS`DSwJFVY@kJ^sxGa3NE3EZf3 zX-+ZM9McqsecZ=lQ+h14~WeXQ0J`Gya}E)Bp02U6MK^iP~$ zHC!n~A`>{vfkZXsN@*rox(Y51S+OVwWoQ1YZ~#i4no>QXC&iz~a_B46A1Gnrq5k1) zzUntN$1*>b%Y;4AS$hIGNGF)umY}t4svs8{R1Q9~Sed|12bGJSc7xBL7%}RZ&HP3O z*HkXdls{KD$WqRf9cha75`Hphrgv$<(KiV)ZxEcH9hw8FTI{X{h$Ink$Y~mjM#|2z zrw79>!#<$SaycPwVFI52dGFY&K9r>l7IG0}D3nV&Ws2d!q<^>>BS!jD8(kLxC}kGq zb{-_JoW<)R6}k+Vao(M?pb5OLisVw@XgRg_muA%jVrq)2$TLand(?|nI2|r1(+4A0 zcb>+YQsat)m%A<5$l=Lu>#z=vlRXpn)GOr;6zJod4t57#Cf?|Y8cWXLy8A-O7y2rS zgMdPH3^i&M-LBDj!5~Ps4|Q{wE=QIUm4InmOHM zF)G$mwv8D*G!8JglP2Kgc22@d6Jc&jLrSmqfbFrpzQsDULW+aFgYt`4w6SDG8RiTPBQXO-g;9j@>DjGRvFf(L^uIOKo}I5e6{IK1(}uS>bp-$X7` z9ig$^aHq1;bV^#y#iSw_lYGWzY42;_`kr3eP5eex-2AaJaH4*?b>by7s|?K^22?QE z0fR>PFGhW4`PYsL+A_`<%K0eyDJ3y|sU%m!De!K87m#G1DzbBr?6arCeV7L~%~O4C zu@BL+R)b~N~Q)p7Abq;X0{z65BG+8kyCRz zRZ>aWO5K|r?zK+A14`5#p6QTHrR~`S9`pui6L2ihrjEa|3Dkbe54va<7!U=(4}Z(1Z$4xAw$bI?XaV1fehg3&mt zgA;WkkgzolIXX>MabnoD_m4XV$NPtG>tI)_=Hg`F=7LG?-7{d!b-p1+HDys$7-q#l zLqq!z2o`gpB&IqziL`Ol>M`L#Cut`SlO#BgwpeI)TE}~>!;|BEZ5^|Fc;4>ppRJxn zT7i}}H;&i&*`Zn#)ig2JQU4mV;E&CJm5=_oa)k7nqrykl^}iGPl;+b%UwxA^%Z)x$ zb}A+s|J9?%QJV)7i-NK7Xt$0IYgSIT?gIY;&JRF{NW2M<@Dh0qhQYKY#<}n}8=5i) zuy#AyE$;#ixx3aE+P)m^_SFD;0~=IoOhKWmr|7he37cy)a7dxwg@HV4u|$zB_x#qY zw(x2t4YeB8F|c_^#Rl&f6Bseh6`@*|(uQ z{SXt(g$@)O^H@r01=^S%@;%>henDGzC!fzG#M`oVS9{l(rWp5>;GrZB=Lq2D95B&t zCvRT41$@H#kl5=xeIGfO@s#zClhiirnWbqG#YJYeT4P+KVRB!*Vsrkx9f_bVw53*| zDaU2uCg}X-6EO?FNzWQh#lA#j_ZS@EetJ|fIZ8tNO!e^$!8I+ZPuJSY5KZhN`o<44 z?Y{~yFw~Z&`mV{@^Yp=k@ zSC7?$)p$1M`6H&(%#1pbOU`U+B)nk>a;l(;mB=$G@9|}G@{C`j z=C6vuMTuOdwcZvmT~A89^jhikoZhh3_HZZ(^ijklJRzrjk~*-8!}v*V;p35}oJ^6W zckt!IO|3ApbD6--3&wRW7uMM{Vn(6U`NxjWRKownH`n@qTp$zyoMVo~)LMXy;B!2Y z@Uz+)KK-rX`N7@^*r_+b1Nm*|p>whw55mX=BtB%m#yl}c~dcF3y3V ztgk5vFmX)hFacdE1|Xze93W#=!7l`jGM;qxb)90pIv7_6<4=579XlA?{NSJ0nfT5I zah%+O$6c3Ihw01XD=Y?f`BqPhZp=E7vWh)8*8isxZlnW+GW*+QyQ#XF3 zSIunkA)gbFF=fg}icFcqj{>17Z-CS)_+%y0O^9@-X%HiIpP}s|f?=+!*#HHhwg%(% zbzO3)_(Wf5(`_I1FwvG_#ylhDNC_PYe^RtAAr91SpOhFK!bbgV*Cb1_{{|x&S*$Z(AX2&q`(D#s$Xb(onlD4ux4TIfS!%M0r*A& zoY5{HK&I1GXS-89F2VE^&MfQ`u(NU3z~*pYFQ3XtbR7GmT58YDD{gDmFa@ciI#zaShJ8v|x4HVGYXT$8s6Y@C-fk(v(9 zMJfxe9ByxX>#8yf$vso3JhEB%Q?Pcxm&88sVf2PeVU7#z@kt_Nfwq8xFMxU;aF+rX zb^*L~qPIyD_49)GIY3-g5*SP10b?JFGQ3h1awe<;CW}sX;hxAkRzhscLP--xd5n^G zv}=~!e0fbZ@`E}aDGx~4H*qd-&p1rBUbXGfO9j@v;%!|{Tft+xT@1|6@<``nexbq0 zp9YZeFg8~8MnnAO@GP-P)^#o13rzf6xMN_y$HZ?M&nS7;wCQ{DEJYF@+P}&Dn0pV7SxQ1u?#u zcma+5X)_h~EJrmfxL`O+b(x8tQL)6tR8-cf?%CC-Vi6bn>LMdl-d~xSJF`(^|N732 zw2(wpQ%+(kvVjc-q1*zT@Cv)S>Cf;3La23H;n_Xi9+U*wj0S4GlT^z_scmGNBiB@|~puj237YHDjaW$+b&SyC|TO<5@qEslrvP8*!VtEo)M1eX{ zEkZ$*x?~FqViHjA!X^*V2hdw3!gZA{N=~Z{S^9 z2p4&Yi9E4UW}+{)+V)z>SO)d5msC()B9WPihm@DFXHfYb4Zp|!R9s|p3=-p!%EU6m z*)-p=@Mg`dOuLG#)wMfoK8&|3=fK;^Nid1tLTD5i(P=Yk&`iX$eEGxC1mxMnD}#IL zXsUa+lSD@~!2(QbU*xB;6HcB1%y}$f?Y1`MPaSl%rFL60uE1`~o%%CpzMc3h>|E-CM0 z7~md8KJaM>vGz(GkNl!$C?;IMAaEB+>sstayG)~>jpaH4p!eP ztbn}O-JhasGRwMEHuXJp>SvT;kzcbGj=3jv$0=0@3b8laLH8g6I%bdhEyul;q9W>Z zAourx#=bESFozuFQ;a=;BQ@y)C#nFigA-FHTSbLGfi{bRy`4UMrf**qny&T$8g;4~ zZJxlFNJ!1W`OvaI~%ryr(*$mf_H65`~5d~vGLrH)ND6kFy=Fi{z?kZItsOCJ#Oy-4&3ws~CK1j$v0kyU1~_Y+!UDb3HGGNV6a! zUomN*lqiP#vYItwsOMelgK={)9zhS;Hn_3iQ}U@6SzIwtm8$U}7br{(#1w>P=4Hm3 z;Ra1(rW?oH1@oAh1~S0WsFmAl9Zj4O)}K=bLV38sL?f%?$b$jBl8ZOao~P9KwK@3g zM!4luk8hb^dQu?UdR*Vxa<|@EKgK??k7}s^y!FKuW%A5blhdQ-gv`cLCipR2uL53Ye1QqDzjJ8 zgH!GvGKDeEQ-Ly^wOQ$c66+&|I1MiC%#~|-6YT8N?f=(-#-V0sbg4m;sj7totmncE zS;K@ME7gz*l2+ta!0lO6t!S^RdqTHAHL4QlYa3c@icCkZZJ4pbt)*46Z6-~rcGE!a zQ(JasK=HQIN@K034VLO51JTaJdE&ZWFMP}e!`)bq8J>idfD9#J%0{vijQ&MJbnCdW z%pB>d+}LvCT+A4@+{59NE|9MZvtAa?uv|VUg|LdLckhLHbv-R<&%0>HVG%o&q;~d( zT~(fazb*@{(DEY}+@h8rc;(a@k+5U zYi`d(HnfozFO&s^{S{Ffq`!EM?S_3P++R*B)>>N0T#^zgfrr>*^x|tSrE+;zjG);S z8S(;%L+coIh6FT8N3=Q0GpxcW=_sbJAQsOldyW|wyOhZD7h4A)j`|GxQ#Y$Lz#)r? zx)snBboL}h=Uvfz{!tHR*c=V-`ap!idiG3~1XhyIXwW)XE_(-O% zk7M)VBe{A`qjzc)sGB9Ya`>zqJ|`SLkCl>is+MtmLV-D{%QWG<6ECPFGG-m@o*W$< zzX0u%ljDrr)3jLL2@H#n-5^Y-)s^WJj3O0+8(yHSH&yP1f;^;Qe=POI1bmp=Nm)<7 zSyuyDURV}@t@;%Tg4zY4S7a*>6Rj~+FZ6ua&sR7VqhcDDCR({6PH6~BGb#?@P7a&o z=HFueB@Gt@)UH^b)b5Z6bLvoh3<;@?1%(PGigr*mHQ3)LfoD9u9M+jC?#cWyUkK zD24YTb0&qI%b1yfXYnP4TY@X9wKOL4R-!UYK;8@krjuTp=DE}wQVp)H(}M|u$IS2& ztFbBb!n{8%vEOFl=2E{q9qKF=BtVy*3q9=9yzOJBH+%Qk=`FZPenwxdA??_MeBePBBVGmvtM%Vd3D)Hk2a-j^W*(GnDx_^FQXfTPVEH@A8>RTb zi||ANZi0>NaTIVb+W=&4F333If*}}!OmLM#4ND*{?KMGb7F-i-$o*?$Y}96Fk-3)D z!R6FGT6GxpL`mbt<{0t}MAvMxHr{eieb@?R(aPs{V$FLxf+Uok9n>UfnhbkkBydp*QB2;)HDS_svOYc5>0qbSr=$hpU8V6p%~ zGE|PJ%9w!H*HdG`F@0>{!$`Se#gPpru@20GX*Z^_+)LVRdjsUh0cwJcFSnk21HRP% z+ouxr&Z@t}XS+yqE5DpW9saZeVLdtBzSUV}>m?Szk)g~?%XvjfKe8j+8 zO;p{j|28{K#{^WmU>fc~Xi>^Vxj!Fb&3;p;r{NKkDBsT;J5n+>9f>j<3fAMUr> z`?cfN(SA)At4Z-w?sBzXeoz3Srl8o z&)OQh4>2m|<#cvdbn;X15(2(g~> z4*%Pe?e5dl{`cqGM}Pb3$?@*rPC74MP_J=#x^wdU(fiBiPx-s+?}mTg{p-aa#+r{% znsO8=FCk^DWLrubIz^5-X-!L66AW(DW>Q_U;&zr@%F{)s&!s&(1PCR@Y)KAer+d|^ zr0xFeU|$Xz+27U?zm%z6aL}{KHn%sm00E`Y zp=_OPglNgFO<*ExX7aR3B(AK1a8ah)BqA|ySH^{M9fW@(*ep&?~XGnIuG)zn3%o!Nx?=#(a* zEX@c8lL$M%7df}5bTdupC(0qHbbR6>_h<6Pj|kG}qH91l3u!GVwM9Vm+um4y@y2{hg9tIeJQ08 zDV%g^EdQ$5F=AL>&pKjO>Y7Sj^Es(&T-V?`V@ZG0ves86M6GWYleDHZF-6e&W&t_N z@eiM8S3Z_jN3}9H?ND+b(vr3`_#FrB*3lt2*gFNin0OkZk%O{LTGfja^OS>nWP-sRvx`V0)v7+Qfl)cBXxU{6{0*rYUF&ZHzFyb4{U(5ox zp-g9MF-{-Jr#{m5V3?AP=7x@5^y2(LtgeVMK{MG0~n$nsFe0$6e`KFG>uFn8_82ULe9Z!OK^j-|6_F)>H{V&LvMMv0-{G z0Bh|()_DCUnVm`DJd5*ZI-xr523i(o$Y}di3P%Z0x!OdCfom|JG2<&o+k+g=LQ$y} zcOi%1!RrnA_w~j@?O(}J(5qQCU!ktr^I@O}LBy}c95HoT(tE?0i?QlHm>D<`Lp{V0 z@esGt3}!a@nsy~{6rHQ@!8HBvEQTCm-w)6gWJm>E5flti5V;X+fsZaxAY0|YgMr*- zftq8Rb}CV(=8YaLX>8~#s(h-h218&c4?!N{9I~Mb;2XjVq+C@Hc9~582uq9u~v-NbSnyILRp(MpBlh3}E8pOYFxmNRwwei=AHc<${9y1o^Ied=3$Y zu{v*Y&U@{*C9(PYkFfT0tM<2_e*fD!#M$Ik1t^?0ph6f$##518a=l{d!bdQgPR8W; zuw+afB^GJYejn_0_b?13gxo@t__zOj2z*mzqS0a;p5*g`aLC^W568HyKOgeyTjal^ zycFifnLqJ(V*uyy)>MaNc+%Tw{+Rz705GLpQ$2UG#4M;;!l%~GC3)c{aa5qi{5L<9 z?T=H+7U>VU`Oh0omY%?arvR+Zna?JEL~HGdgZ}Mn?yo(RcEB zyE8hK{~dQmN3wjoGum%=Mh6nsS!c9++!?iAbVkqiJEPrJr}P?VV{kvm!6L&v+5c5$ z#ejNlmR0pEf?}W#LWuah6A$6!zp)W&Bb`cZ1r0`fuj^7{Cb9oe-O27;Ex5k)x|0!zXD)5 zp>IvW)c^{BBOOyqXTmd)r_$hR5=1`#AO~Nn`Dnsa1^S2$!7&n7lwIhX>T>J%Y}t7# zv((PHUv8PLGDS4Pf>QYjc#J66gL6&ia3DV{xxy$d8x8S3Hd zGL%QEhNRuIpg>o_vg2idg2*Ie=188Qg^n!`x=36hM1YTbY7tge7no6EVz$YVr{c6E zH=Zh*M%s=Irs3qF?+zVsO69{7o%7vbv|PB#$bW}M%#&oiO=z!sOuS7(?;EYlM zcGJdhndyIj@NM(QR_$-F_H(25&F{B<`sMM5hhI)S-1+c_Ka8@E9)0-3!*3TG_y@#C z*T->aY}ZOHuSq~CYtN%@N>nO18|^8vI3ZM++a!^xs!J2NsO}p?c59 zeJnQB*Eot0^CWfwk|SL|4d|6bCw;8b5fTLWFznI*+`=Kz<#pNfe`k;$^-~eU_Csm5 zTl@>|2sfcRm;}D~s^5+y#LB4HIvMtHSzUAPfjTuk)IS`-U;Va8`TbZ@X>XA1DN@e( zJ0e{q{8-Vnb{I5kXeG_2)7s^igfzyph*8g+DL$F$onijRnd50kl%43RrzQMkR^Et^ zm($MTv;Uk0<;VE>*`c|ZR6Dha-$%PJsC(oz^{43!BV_?U7w;Y~`P2hj%~}p#?zSY^hbOzO z!#X%l#9Q1`uapT?pmQ*^RIX$<`=mAVl*@5FlZ{j!SjOZ18XpARu9K#~N@L0#Wu=?l z14Y*8Oo=sa$Z8#k2{biNLhC4$jv!xca6#BX73PbdeJuu*qc?dtNvvU z_|p49PX64LvoH}+oXq4V+wUY#PYdn66Qtk7#yhofK4r3#mzc_P! ze^=(BC9;gwN}7?G1-G*yPtWtb!WocsRQ3XT&P*6bX!c~VZQRHtm;kr4^oim=qt&+x3axz1(L2g9 z!BnvODc5#W4=*M~A&dlKa%WTuiOfsQ5K~0U?`jP86}#@InqPPIsdfi0E{&TCK%VUM zzN49tgl}`QiJ9I7T@+B#mpyb3`e1?S55Yqh!U*g*jmXe0-KT94W^TJzU-O^amYuqBv7@wIo=Db7`*KBW%XL zbfL={o&``Ku9LeN#TT)=5Dc#1kOMB@&=@_y;XRm}e}C{}qxQ{DBTZS!Av)P3l9+M^ z6uNX8*vWJPCcuth{lM&<+5YHjKRS~zMdf}m_01ov`bjQG?|z3YARgw(81lq%I$)3& zJ^-n>xT;2p&d3N7+5}NMT^S!NA0BOGBlPl}GUU42C97RZ+gE>eE1 zl--i>kopLmw9Y%uP2Y<^HvIXsnEBz zt6VIsvTh_P9Z3pDirNtuP+%^wS8jlvAs_QLA_5Z>ykImgZ1AmW0$UZRx^-}(G)a4OyYBt0i*nM3NySkqj=C^F&FB}x+J68 zhdT4Ss#^yqCT;v(Cb!IWzNRt>W1>8}-nKif$3-Sp z`@7cJ-u~Vw#dl;-9occYz_cnMu4wL^pB*YmORdeuDE41t7W}dKukz6!Zk|`r56d!Q_!-bZTg_xn92aQF>zUlJ1x^o+LD$s)djlIzY4!IyrBy6J zx8?hVZx9bD^t&*C#B)M7$OB*NRa-@z9UyHgmpC`{r4TXGy+1%pC) zRL3v~h6~V?+eHeonzo6YO@fMRn@7UZfm70$wS{ktr-#8^{n7W$R;jrtVBxdGycoPU zKudiZE#>B7;KOJ}V1V%jM;?d9Y_xDs#l%v25Jx}j1j{cxhKmJEqO3o~2x?qA!}^d| z8+h$yaHH!-!I(%)3LC|Fu7$Qqrk52>R@(_lbmt-jWKtE}M8qcTCOv(&&S{`vGp3jq z#k1b$Y+*^9>uF7A(VV>+SY(}n*Qk9HPFW80XGYwl4ISgU97UOs+&4$m5uQy|{+qnV z`768)8Ge@sj*UqEi4C2bCu@a+r`(px1r!B#r?$|+FK%3{owhBlPkbGZ|2Qvbr@p2F ztq41@Dm~{AEogFHL*sFIH`BuxB!EVU)XY9HB{D8}aB})kX)dNk#{~~s?T0rI43p`w zvuGwS{CoWr2US{{WMcL%<@;I0+E&L0qvXAQ8VP9!h%xv zLZY*Ga^4v|KRDdazj&DZOcMt!p@--aO;^Uxqf^DbUOAc1TbD zIDURI+S`A2{$kWQYwgY>ek#oaA)-Y(SJr!DB;YqpN2^Eop_2{4Wji^a-h0;BjzVjx z3H`>^jNOyTouz%@IX*%9{T%{(<_2nIL*b2YEiUihm~fb}lChEH#XTD&fe#~jw&$xG z8WQB2#Po*Wml5J}Vm0F;j}iB5cxWP*8youReHjJ`#fy&thv0kG-7xmCSiy3j;M|uU z&k((MuctKM(N3SMwOCw-F+JH;mg2jj&=}JLNc4e4A9#$CceHCX9k-|xy5em?8SGCB z88mLTuF^^ZE*OP<6D$b#Occ`AtF}#9xuiz^0jAp{Om{~8XlKO5_K17i<3nwNl%HdU z3^B%^yChAj>NrgjD)2GCSemA`QTM(%JZq0m847V6s_*tiyS=A=p9g|L^P>#a-(ynX zwp>$WslC9&&!u)rVzrlyKM(yWsn4N*1<-}w1tRLIpT$JGnkxL{S$&j*j~rR~of`gdhG#_KT-2y+r z0Q&{4IZEQ3AB(>{&aL*G2>ny&DG<3o-I)Edh^F+}LM3jdct|Rc5i>rg5Ukx8WzJApXyjSE1 z?|Wb4_uufH7t620Z2<-L3}e1W!|!o{<7tL7E=MGJf`T4gy;G1aT@x+Zwr$(CZQJH< z+qP}n+HKqJ-fi2qPJjQo5%GF>WtmIjYxE;dI3$^iaQ>fb{7UFpE-K()6OMpeYrNZ zO|E1!3asQwd_8{IDNu*=Afl%2>$&^QdTnmXKQ5fO=kw38kWYEG7?MkbNf$V8mVISO z<^WE3()FD+vTw@d{#F&pMVfW}wv$_B=C+HjY2PB|rzWL8G@)*1p@bKo)-dF#A4!OY zG8D2Lm2`=NmbTs*sFlDYL0HpykU7EihYYYWv-cWGgV`K%WIUB{;Ve?TS!p;9l=%r@ zye~AoXAa$t6EWPcIfQG$gHFgLOozlo3@}jDOS2kDZlm`40*+=)7Qbum-XTx(HS6gAUDJo?VD&y5)NX58J@n&{!qn3GLh>X zG{We5Gf<34+e$-?n70#KPTahi6^Cn>5G$eHOp=*Y&~yTph-}YKm-$D04&;2iwMQK$ z`G|M=E<1|v2$%U%77e3!ekfmVO*z=3g4z9YSiU!l#_BTijnBDHoUV2m{Jyuz%_Scj z62Xwh2jGQp_m@LGpgX`3=Kw30?b@@npUgyj;3xnmRzs|P0^7%dCxZHbIh5|jc108q zTRQKmpY*i+{>e5qr zktrW{mrBh5wg?G)WNHCT%?4(+nc(Hxy`aef1jod=@N$|UsV7rOK%j)P!P1n`Dn6Y! zV)pTv!88EgfX=TO%9dgJ- zddUX^^;$_M$Ra*$W(n{oYtKg(yB@#i^ zA#>bR#NCC@_ky2i~5Zxqj{LJk>f<$_0^;wZv; zG#Wub>{p;p?G*OWlaDLND5{6^#~vuSbHxIpKMo8fkRqlQwtb9YPZR+H1MFVdQ+lo= zmT>>h;M>sgNJ3hJy60vo1iYF>`Ih~q{c>b`=Jo@HG%dnSP0z5~{5{&oUr2|@QM>Ia z$c-&-53eKJ6Si};9sHBT9Fg6CC53?g*5IJFB_nb+wd^W7eM@8*tF~3HVaO~EuOdd@ zpyTV9LlH^DOnVZ6E`XD}0N};E;7kjl3qJOX^TkQ}xi%iY(I#)~?3d3P_=>g1RYpiR zNj9ca>@cH#@8nlC5(w;TQvi+DP!`?X#n7aHYi~6%EE((GfvpD9FM;b zt+22UBv;)rrg9h!LUzr`?cl){0fdA@jD-S_^FL1iZ4cbymEO#YVZ04s&?Hx=EBges z)KbUX?i1M9MZgycub8wY>H{DK%V6)z9Umr)D#N@;wlCVOabX(6i;2j~M^eIP1gfQg z{>&^3F8u8rZqIAZgGB`%@{cpo&tyrd1We}wzw>k~xYqF-gzy9|wq4or_ydiMue$pc};_C7^|%Mf95Nf2*ZTOS7yR9yEs z8P>*+pf2$Z{hYW?JDYTv!$egs4tzy#+E}7x&E5maa2KfIVnq)J#B0S!k{dDT)V9La z?G4h=0Kl-jw0&BBm)v5Se6S1A7{vh;7XN6xD!$vV_i=jbcw+d4Iw(W{#Gtr#&t799 z>%~j?9_m0~Pa8}Hfgn7dzYe0HObCus)L&Xi6l_usL{CBZ42D!VcQIz-mPYz>mUmy* z!GIY4lwT(EX~XsU&TYzPzBW`L6-#VtSZF_5OkIZ8HxVZTV+ZthNox-GepL(*j*((h z@tq7ER4DV2_!V1)(z$DJgYsxp2q($VhL}BCd+4a(E7>`LvfwUq(e<2JFi?ztzUO;x zXsATi&ThWmX zYS@vRPaS7Y-W_uscbw8maD-J!@iVCvZLKDPQRd4BLT+^~<=>WIj2?C>2$xo#1M*KB zNNnG_4Fu)_t(gPDG`7e6$+=1&N6c(T4<~xtG_5?3=6$kHVr6@{fFtVPzQAE4i=y`T zmn1!?+?op0TKGLutE~W&b6N}}j7)=vD>flnSoq^n%i|MGRcv?yB-(sT9rtLf(>+!N}7r z+iIR`#`bR$kh3HW{c5LkqbVs-jttUE@OXWJtoajUDmv<1mWGR&+;rlT4M_+ukYpq8 zw}TMFzTZfG2<9!K9gZl{@V%Q0_pIn|u>xK!Wk=|JvRW(Jk(*QQ5KWt6Y?+MD?aTbd z%I97XxD@j*#{BdPqSdwH`F|ezFnv`)d5}`%~eD0eHVo_gP$JK!Ublz~}z{Gu*49h$6+( zGJ89tp!AB+>B)Yr`g06E=DI(TTbC&FkY%L2Qf)fBsw9<~A!Rx^$z4k6%oy2U)K1=b z`4Jm4oV-j~1=wcV&!c6=T0mj-{Jd;w^NzB!gjpbK2%L>dFd2JA^Y@7xo& zvr3x~auqv~phtKxrQy|JItAFHSy-75bzq6J(UZ)?TRCfR)SGlQ=h~)#NHAWaW3zC&%J92*>9R2?aIZ3*`82xk=YEit9Toue zj5)r*Trt%x;J}oF<{ zuse7UI!x}Zct)em{kjH>ZgG$HF(T#}NiA5G%Wct~Iv0iV(TcZ&6=-?3q>Rc-ih<0O zsaF|gI%=TJT?-!>Sx8r78kLXHP8I9C}J9Es+ou}ni5w&u>l)Cn_pDmwYO8?Kr#G9L7i z(5O?KM7g;aGO7>a-l@rf2iq!+;(kTXvK)517qgchb^>7(G=EPs_BHS0RF2~M0*H0u zL7gI}y!qWG=guasKVDg#z5fxv8sF}^j@*hbaTod*#grN_YT)KTG~^|I+jS*vWzc|Yph9Bvy7*Zc{G}oNap@2{Ef2w z4gHOhO46}Rq?T}(WWghChjCB^N&Fre5rC+TqpQS@Hv?=7NTBS){ zHKJgqtd}Tt9tPGe(f!Zz25FuI#kv>X%;HraRZG->`GZji%>trUAJ5MLVGj=|)8{|( z=iilLNu*}WRU=0FeF{~n((qw-wF)D1_*=15CW zhKBlNMPL`Ec!H2s2npk5q%%L>S_say-!m4$+9>``m%SEbmHrs^b;_Hesjqv`mD+Jw z(^=&d{L{h2XFZK-3SQSjkh8G*4KG8`H$q zXGzBb%L%)lWu|niwq>UIqN-))(}C2YPHN@vhh-+Utdmyz0*iX)@&CTU`b#Z#nQWLc zG93MSN-Sr*G=CpLc#w?Qm0IMvxP!IG%z*QWypAqhBT_lbxLPrNnrhRiw|~%kC$Af;uU1k~iHsaiOer*K zjF3`fEIXRjRaDgdt3Ht|m7zqbtdvY;I#I?PNNp;0{~AlFyfkjBnwflpr15(+`K787 zbr0u>4&&OXv5BfG6{%Pv-=LqiR5oR7S)x*rOqHTEOsh$$N|sfgOy#6i``?WcrAig4 z6sZa$#mZ!={}wx$YW(2L93!q^t>{aPMrCaB(0}D#SVoTU1Y1@?$v`pyfTF-3PvO-e+AbZP3}7j<0c7ID-JJLNL3v{+d8OV z)e~x|y9}n5Q8FD_gg`#DT1_4tX7!E_5U!Ic{X#l;W!}S4>8_2h=cR{2hpjAz)u;zR z?{>~o1o20V2xfal@8l=*n5g2(<97;VCSkv+)5$KEsWO-2cBk z<$bPPR1gJb6x;zisEJ82NK&(A05w%0Akca^x;cbC3ZQggKzam9xy^gQlzX)#(9Wr6 zl+{Z80)lc~1W(ZxXJFP@kOSqQFE;L3Qu}_qDdGZmyKN(LIl4#cD=EnD0~Zsi&A=@R zz;x~u?lmvujcX}x`T*Z7pH!9(gEZ2o8>=u`2tMj7=GZ|Bf&Ylfq_A6#FQiv=+d+`w z+-niPB!Af245ZIdZD!?tw9B67>;8FNJ!aAX>E|pW#ssGRf7}x8vIE^$v09~3*G4-s z+4pFd1k9gWW#GtLhaiJJ!!uG4+V!I{UyDfMfg319qw*Wny6|4BW%!DrfB(`_30*&4 zo8(a*%wk_R$5Fg(vc1YSR7h)x8z$A~;86jU3|2b4+C4*FqqLRfix~_j^ zRCQ@Hzz@wCWXmUMrO&C|GzyQJyrN~)m-SHo$}DjM?Z(mc7f^K3@8DK^qgy!$>C8q| zV%%}B%Olh;xNCRzt{v&=B3l&#WB>&o0)Vm)2?B6N^zVuD2H+Lr1ZRLia^-m02S7e5 znJ=OV2Aacr9Tt{Z5|S{$Z{RA`PJh5?Aan0VBHMS8k%2`n3B+a$3)37O*ioA+_T#rA$|Ql71m?!`PkTi3rAA-)J#>&xNzx zhCwUnVYred4c%P*YskI-oT_;9&I}1%6!2L zwsERstJHs5L$0tgnFg~iP||#$;om64j|&ipKU=yD&hx7(WOUCLiDYz5t8biM*{W}Q zj{K^=Z8XJH{F^czm7n(ScYl{_Cg9bN!n7lQD~F+p!H)a-TpCRe4S6<24~<#Nw}YQr>l9^-+n}ogK#k zyGVR?itaCBi4K8aWySUK3wlWW8}bQJR)Yi?K)fY*ymSpLvd$#^ke70ZhR_swn()FA zj9TIle%p`&1%lH_kKibBq3chdHw}n~IF5l5Hsa`8;?oK2coPd z2#*fDzJJLN$`epH?TxP}SxTb3w?&`~6onm>K|n=;o`3rgxuQm_Fbh}(qnsrmU1^%( zW)M}n%h6sLD#2R%JFr&4PRW_-Zv^U7txU90Did@MeF74u6;wprbYL$jF;sxLgGRS7 zSMM#fVgCfVu-3!QdGXa7_hPMLR#yes_;0@jbTf6!qRKZ%mQ_xw-KkW$S7Mb=<(~g; z(Z6OB-j09Gn+phMTH;dV<#acu8E*(o0IR=!3thVk&Z@Gop#%Ar{J&S8v#SXJpDr0w z|J;uXn7O8SD&WTqXH~G%cL!5{z0}GHfNmy%I+(e|i4;K3-#eK3JHWt?Qlz>S#V%|A zyRiOl;_r)?{V7sh9z62qZj%dC-7S?{s-*Jrgld>ePJXDp>bw7sf@MyG$-(a5!pRV- z+-dJpwKOPE((7|2LE%a|)Jkbk1zjo`o?1H82_;osDwQ;-#c%L$r9y{l_P^wLu0-hJeL{!29wFr9vI0dpb#6rXqCOu5N*?`Bw_TkA zYptq7&7LuDi_*!XBTyTZy89TVZC*M+N>{z&B9*8}X+`zCL+3W7qxOGRTw!gMiXrKL zSz1-21ZvVtvtr=?{*V+Z+r`~EE5+}ormL7Ep+l7u@zqg0W5UHujXYH-q-h#hL8wZW zo&s4at^RA{tCOXhR#ZB7q{y`{oRy|f=h&7k);M>(2$gAP7^r!kNZsh1@6JRDWBwD#U(9gONKKfdaknwqCy;aMb#XdnuN9ZzNf!C;KK zC<+bj<+6DTmRvsH>Tfozn7dx?n32W*KXLSRyolU7zkvzH%-e{LK--#T>mP^1%i+T$ zy|#X!G!7e}IMAcL|DnmNFvZ$FtOBxk`_tZF2TgO2AFkkjRfTxAJt)$)=) zgu7+8m~}c~1p=uppC3KOmWu<0CQmh@xFNg!s#}jTjkFxx9wzO`eVxDSACD~95Bq8swChY1tJ1+ zEoW(-VZoxfTLO>ko8wv_lt+*ap8C-RjkyE8VX;pJ!(wWNRz5;2aIVmM%|O>%*go$0 zZU%#(a7CUa+}Q+VZAMuMVl)O>AvoJNaov}A4_;x9r(E8Iq+e z75ndzR7VDz+0D;J9Cpm8@yE}zdd!v8PjAU=UGDJr^ZGh}T}{oGne5NkC?)lP-IO14 zo_<#EPe^c?L3s1~x;<=dh;@9SB{T0O4!=Q zrsn&nBChf!uhv5nmrw24FGrQ_)UNecE%1EW?z@Zso3Gf*3+$iW_l@5V|M$_(5B-n1 zbz?Mts|<_%`rGVJE2}8E9A4tO#y4;Kiwc}lPjVA)4Jt< zVAdA28qh1})_a-!U`Ku!LHGLdA&%`}D}l}Kur+rT9ACZ0bKjO%e{B3}np;|3|F-0< zeAj&-vkqZtL9Y}x8^BiH82db5{8;T%Y?j`Xp&HT@C*f{rr5s z{EYwb)R>ggFC%Dw(2sJAs_smB+Sl|v+s4$*vnH0@;k%Ane7cFY{lNcxXw=A`JWzj~ zu>V{e6D#>t%0IO`;kWYvJiN#s-}IjK_A=f0*?fN&DWBv`>l=K3kAHr#f4!)eZq`lj z__6r;8GnB_y+Kdy@MrY?l>TIjUZ@}6-cc{!*G)klssH@>2Ks#w`(W0&vd{I$3I1cA zU+Txt_v3@#?}99!Ab)?Jvo&Vk6E z$Gktw!-ENlbhS5!4EpB4Cj-jhF4oXJeppPR)K)aI%6KM+OrRrz?Km>R%;9?iqOgAR zg~ITH{OpaYp_pP>Oj#1p)~#Di*%n=4D-e!gwTuSB z!Nmo!fsD$ta5yjn&v?-ou-_Iv>W;lQZv2U*_`hQX+x;^alcX%!F3BX0m|iC$ z#@OC{Jh&Wl$7G8^I!=fl@x~YKK?ybHTEBB`ql&EPka0nU$>@ZqDfhY55d)Cz??yl$ zUJ=7NqM=9j9gFXK!$l7lh)xOydEFm@uf>jGn?HXtH2`bt?!%^+zVzxbY|MCFSA1-QXCC#qVrVuy7Bd|K!6@@}I6ss0lh^HcW4keeHnR7&kp~p_Udt*OM>?5STr-p55og6+p}a%Z zn04mtGK>HzSxy;9D8YTsvh&qi4;T*ssZ>m}HlBU#F~fow;M4D7ce&w8epiV2U`x2! zLY%5;UjO0vb5wRECv*~ABKhxqm|T$W`3zavKqeVeG6kG+oFQsvJIdE@du?U_Za0j1 z9gsj%WUO%{uO)`zj;HT^(G{|!P+==ZhgiXuwFqa?bfLX$vD#g;8u92`%w@eU#sq6%T zk#aFpcs19H)7W%{%2NpbslGEv z@IO++>rjw)5&FARJzadv|CsjGj%0J8PvJ#`4J^^wD!E(QSJk%)LkQRALa0uuf|=Fl z7L!mOyC|Ah+Cbof(ubeu0tnA2f;f{lW}xD0fJ)kR#Ny$UbfC&G6>aUMs3@m2L;RK6 zYOs!K9SSchYMb3GU63%H!;GnHyS4y3khMl@v7-tr(WGIIr0dfMw9YJMTS?*2Dbh^h zkxo_ELeBC8Ay)lHm~OCL@^lkjT)1$_@C&)wx6)!ILQrBm>D^^ zN5Y#Gy2r%#`yED)op9cB`ss5l5~eiTcGj*hcPZ8rxR`es;U4w=o_@Yp?CY)3?@;fT znR%|hk0ZKeUSxjAD^1XaS~3am`vt4eq%KRzkx|TVN)Du57no6ok|h>130FXACgoQ*rvuq9u8}T&BeUf=@JrGrLuZD z?k0uyl_D=@=6H1-2il^iY5zJu(wuj;iF%;jLxkqU1y?eP8&3|-X9-s3^b4d%Nx<+C zVNN}-Dm60eO;-;-dgR}#5<<11?qOQ;*FIV^GrR#W1c%MK{4Ukn#)9jUg0-WxNx|CjO&M6h zD3)GXuUq^{6|VgU{!+Evk7j_KunF@{Y#AjzXD8vM6Y9deZi4!+Y>w{2(gVll0XmtU zk2zs~PibfnG>m@Q$WVEE+d}cQ*S9kyU{`UdzF9)=Dwy^Gu%xEGne(mkU*cVG9lOmm zRw#gm_g9@!3;8OweHTz!;KD)NkTf#UEZg#YaZ?!1x1`k&k)ehv8nfw*IOB-Wjk~pM&%_YR#(=quEdNbKa%*D^%0GK zlBW4w!1npv^*{yfTo5tf-)o@9=5*`Ge?>0HixbJqORg$iSXQ+Ok)_sNnc!iM!VUDf zE<=7?vmu*th~)jnRr0Z3Okzeu_5dqg`@yjhq_hk7OOwwRX@$|~7Cub0IHwx2U;lK~=Q;~6(n{>D6Sb|^ zHAkDPRslSmI$Qv~rAyXNx8`sW;QonO{RQkS=08c3H{QbRTc(_rcQtKR$Pm<^JRLV3 z@r+E#-5tc^0G9^pK8-hyF>sbR6^BtFk11B;^=XuDsd3ce3}y48hBJ!o^hD97F0IsO zj&X(!6iH#TT2!nERkJL(zNW*ill!0%s8HjsYM!A&h>@Ta_QYXb6luo%S{SHD97bZ` z2@tc~-72QC488oSP++sSn*h5stc}pa0?)aUQ`cd5Phd2_gENaJ53>6uHeW4zGRsB6 zJC~uG@Nv-mY1QXgfUlJQscf-cB%Uq50YAhW1%aiPAF|CzAQ0jJvK0V+9LI&!AbG9` z19pIusvEYs${sVi6;Y`ZJT*@(duak)xDF@0gE-;Pdz_ODJbq2J7eN+b zC?iQ-K&D|wE<-{`rIRZobk7UnQ(Di?cM!5q90|57^2(gj$joQF!%&g&XM;(ILySPa zDxh$WDW)e)GsQG><`NDN$QlRs-!Q-LjEv7h^d_(EkW7@WS%Z5sa@Ip1mM?odUaBtt z(E?DL4|D?1PpA8XxUEOr(pjfZKeK12!0k$CSw)O)$l`K8Nk3}#?ua8S&K4J2`zh2byT5dM67>WX%MereRqJpVggZIc$v>P4#31&YQB{5PYo^ zXPw{1vKYigx&~UMrP^ZI$hxT|5p!A@_#)xy1i2Ub_k<~T`gD#nw`{IBYL&f0o_nbI zxq}6ST+e9cM)T4QEQfj^X{-AysE%s`H;&B64_-NUPT>=qVa5R@OwgTTtRqnrZ8l7u zoFBKhm&ccz3sV<24<9e;d5`e;Rb$cy8OI)|cYp$x7|MeYPBI%OG)HiB!EIWtUF`4Q zs~46>`ND#m(O{>7KQ29~u>OxL(Xzlq!*NbLN+VgTpf?S9}z{@DeMTWVm zlHVUP(Xyk^s!2;(F^uFpW&2R$@sN@uwgju5qQH#t+$47dfdMz}?@qH(NkZW6WO&_P zDLT`=7eAki9=jnwk-pm>XCHYlGdG`Z^zT2bS<@p<{B52u%6^+abYCm{t2=)%$P488 za?6}Z$=$$wE}9z1=zh{3K723TvSDQg2ye1A$T;tAh+)Uhd8LSv^qr90z#L)Kylb^G zS!L4@heX4YliC9RUT`2JafB}EbZk=eK6vWI-vw3W5+YZ1WI0j7cSoD1z(Trp#hfd6E zjl&CD%ILY!QuZOj2_xa}f&8LuN8CDl50YcZIG!UX?3%SS9N@dcJt$K8TZ@_Go1XAK zJIXuD-M%)-{uVU8j=qX;h+GZ<*~=$OVvX z<{Xh09KQ}LdEuAVp)zlgf#6UQcibkHg-K=Ky?)i~``{>_KR&->0GwHQ__1>Jvhh#y zNWdFjt>wS%EK|YhUwYqWPW#8h!NIPGdEh5-VtBZEqcw$i958bk^%d+HyL#RM1;%lE zJ`<^1tJ)3^M?Vv>DFc*u?2F+0=U>D3{oVIh-U9s~?%}PLXVG<48JeMCQ*kQhST{7z zOM~%`_P2I!dZ&Cl3Z3q`p+z??ss_6(TVfx+Yhg)xCSiy8L7ulUeIPy^ra@7nL*fb5 zhR6vqN(_7fn_-JK0xdWaa;TPNAVT`szY4J)(e)Exl@(;6lOFuxf++^zBSL+T{_ zTvlI@{>(|8qU~YKN)o966`VUI7AHinr@_OAeA-D3BElw%;O~Z zw;CI}={|f>Mj?vaz~oCBoz7{ypdAW##W! zn>G8#uC}sX4DHmY{jw(0qorz#$wq)`qsa+CZ^IUvsN3fjn$C}R8%@qn*!4yoiS_ly zNQTVy#`}$m4BD!2bDNfG9D8Z~xzQes6^rr8T}>|zG_d~;B071-o|Y82?z%hd|a@oM!#N4I$6P^v<0gw!gSvu4!_zZ+e> z5NdewJ+`%KdwU)Ra(PslV*Z=u;xSaY`QVdgSaj^Ff?Vo1{2K{KOGW}>7hNVDTNJ05_*%TdY9T*1sGwON$(VFWL=+}`p}l)Bnl;d z-8Q96?WZD+LW3Y)ke{nAK+ERX*?>Ykp~!(D{Xko@65*wQ*arf4?2it~@feYy z5qk}MQiUqWAeNGbf)d>3PfP09J6HWmWKfiWKv!;+S_xg%3zrtmZ-2qX2jT}JvK=X9 zL7;z=OMJYRy1g+g%4|J_@>wec5L;cC9mpG>mRb zb!FoR6$`5w%@0Ky0kiU_%Hu}nRPDYnA&KDN&cc%*sEI7XM@ZVqNksT^1pcr>xUiTJ zCXXiyt_t>DH-%ddf!=W9nbtF*ue%%i2c7ulmObl^G`fCK49%%}1cVcEnChu<9gn3HnJzl~lfHDM`~ez~K(;^`_8{%MRVTMVPSAoG?FzHe;sjj$|R`+}njD zv-AbC$({7WP@?_JqOz{e1Cn@hu8`$4s-VvcOw7{CX;E*Ifz8Z{5owW;MFS}Y!d9H( zA?2}iZEwM=K&$$JI`M>tUpConWzT}X!I!3PzpiABWF>tqg%AOWb5Zcjd1Wtkug86b3-P_?_a zOVvO1)@vkyS+O-LFIbJrAAQO_X5|2v^4iGFC&_1dd~ys~BepQaD*qReB2{NfSB!nu z{zl3LoB46Ys+uX&AE`ho-!av~koG8*@s@Ms?XxW%uhDj#oT^$jbV^KA)6FOLbYKVN z7A*bUWw_NC%_)*poYcmvTdM&r$DYUiS~paBK1&n1e<4Rj-R*{91DUBnmd3^W40?0T zS?#%l6-5bU4khJkH@SM;i>C5VV9eRD5_GW8Jkn+z653xTX%N`4_YX-LpLy-V;#s}z|$%& zyheZmg)NVz{u;C%D8rG}S9f%=4=ztG;EEYCml0F#it-WR<8;Ae zg{GZmC_t@=$nUX@?QM)9FPyXOvk-1HzOJzWiCfK3LjPc6QY(Btd5{4p+wz@CArb_b zkee_e4iJt3v#SF2!!nViU{fCLsL<6oUWNAA0de}RAIz4~AB91mc`?N+NOm1@cdPWKUvs!;X{OGs9@jDX4Z%E$H59FOt zqT)JR@x4+5i6zo@AU&dcCACw|tbb8G^5e4ieOO`q823zwTo$^I51D zr#kP~;xrEM?yR4RZ#C&hWj7V8v|z={Zv+4sY%a)zB<7kS(*>L8uY4P|q&xa(w1M9e z0QTS$RerU`jcsh(Av&%V8I}={KCpt1p%JPZ5V01lTGnZ-=Mx6my6L3>LbR&i!Nk@Fc$jQ(y6UwB<)@gd3 z8UVsP6F0oW^_U{J!8yP~vbfJDNWue&U&obhD7FU`;^uXfY6=~NnLrLl6Qz_75n2wt z0T+{~M#3!+($*dl|3ku7XdXJ(aW!=x4**(r%OpyUK#7Le-JoYtqyyfdV5<0cSjFff zY9?gZkEV@}NBnoZTdfHOIwS9b+Kvb(vAqT^UMC>;D@B_RWGX>21u(_TUTveu8wn91 zPAm-zIBHCTo3v1Gn3!V}f_}G;Fn_GQOuT=0j<(bH1^di^%@@a~{wtl?28Ex9a$ZOq z@C)_l2CoON6If(MuH&)^#sX11k|6( zP>>Oih_-GywmkoaLaqV=$hy}d;#oyAXaw&~2+86Q^pGY4TZR#aSjo9o1z0I$+d4^9 zY{owI8sPL~r+M6zSE=fq^DRHoBoy~Nsj$W6_TC3BhH-jGlhSY3v~{a>(8MFd%N+H` zOhH28H7La7`Cbb(o{`hoKOo@aMhX|J4I;n<|40fm>c`ZW6dlkuQ5(3Ez`gE2c8$bsh%q#CYdVq7NWt|Fa)b`bBIL86R8PtwH^9%*lIzhK*4^eEkq=O8@dGZ zMGOjnerH4R-5PAhyw{7FS%xqTHO5YnBU?WE{4FE6OaY1-y^Pf;515VHv+L44NYXe; zh2BBe!M8I}5Xyinb+%?eE?;wJ<7ZR&Sd~-+{deV}$b8?tuaVNpdc0Q6utJ+lt!kB{UVyBb#+W zN#^vTv0fs*iX_)_io2o9(VAIa60suQX`~ZzbY%Qp)@0-7QYM_XM@Q)sNBsVsN^`HbP@o|3!$0C+QDnYb%-%Xxx`eoxK!RG(=f*Bj3KWP5X0MZlg3dOJGW2Ec~ z4sN7T;GBgl8@u!=rmcjj3ksAq>N8i3{viuGAlQc8_5|gC+R^QJ&@~R0~Mk< zNAP5M{LDdI$i*c(D9sb-bMWmUMlR8@0s@J3K9R)qr8(oBB*me;-gXhy=j!Cf zqwhhrM&PkR#}rlx2i?dheo_KW1UF3ioVTe1!oy(Jhc=xwD<}VWQptIe>fGqsDOc$m zc|&`7S(`#bi&=m8%Jw45i4LGZ?Nag-Gv5 zDqF;-Qp0WWM!VAs=kFI=-l}B-I4HC z=Os}@{hbMSDQkvky}TCg{#TN77%nd_-mf3-jU0Qa!MLsHSn~wAqr3MFc z#*_p@+Ft$nyr?LI|EsyfZSyNF>?B$L zl1lceV~n(cO>8M=D`-wFAgYZ!`%+J8HZ`jPXDOTTe73dpxK3m*>}U!de#VT}j3zKtF-& z--el203Xlv!1tag0-*m(Tk3lBIAL94pn@6=<=Tfp>faSc*X=Kh%1WCsR?yhcSH7lk zI0uv|@?_ypuHQSkYBBEL02*nDV8EVi$X>d>DTb;NMRt=ydh8?PJ|rZk?<^GW^dIi_FCbVy$ z2kNHkwu`EYx?wez`D0FhBH6)!^{C9=r}|FDnKu=^So2`3i)8M2M{Dvg7^>-+gvAhS zFfnp(Vt}uir5cyNL!ElX_cFegr7TSPNvnikmtbcyNPGk$+DVaUI(JF3Ds8J)#m6#KcMXeEzztiuU%17Q=6Y z%yQcF;1W$xaH9|?TWzk*u2y82Ts#@1S^`ES#F3u#`XHEEQe`yo{Oj>Unygq2X^om@ z9aAOXvVspG^>{unXFX4wNvv3`spAM{4>5%q;2!tAsyz3*6sdMQQf0I_6(|Wq`Fr_N zEte+rq4PXv<<#Fg%u&)P{R;FMXu>y+>d4)R{|Y3TxKhuf9{E zx6h+|+t#d=V1{I%To$WHzPL)c90aGQD1omhWVRDs>i+`9R^F?%9@0)AYe#KifK7FZ zCeUQoY{TH^bzh{{j-V7zRA!a}Nrff&Vk$YAN7+!BNTXFvP!1;W&8mby1$%0OV@Nb8 zXW1xih#O#PM%dEEWhp%+vGeDow6S-?ruL&}n^NRM%mcd$q2j`_RfvK|pPHRo^fX7J zL|i#5Z_Aqw;0qXBFU&`F@X(iM4^&k%B}(mclM+Ul>WSrqeeZjTaLR*L5AL>ixP(VWcTGwodB ze+u7%yG4*^1WCm#G#1)Tos|D=TfIubs8-U-*KM9@M0sV(84kQr&~yY@))NO!A$1d= zs-Rgb`$r`$H#%X54+@2Y6(uG0Vh_TlST+Et&CE?(J(|jxU`J!hH5FX^4*+{xg9}9f z^Xw6BnCi{EAh)0hfgFY9vVy174}(%j`f$}!bVVZmKFUr+5)JuVpqo{iL_rUv6jr%p=uzkSK{tYh;MHsJ&W_f7~hh3npIXaQ~U+prV6Xr9I0ErzWJ` z_+5Gs4So!1`t;64!Nq;+J1K@$Udt9mWt;n40{Mae1h-@$9hc_%<1wP_Nr^>is`}7j zkp6l-+=*9K~C*d$)j>0~1-ZW!M1!z=>n_3h!J`QrJZ}c4h5e}y7)wFbJ9lD?76d-1sFh+%sM3uNhjEBRz0Dc z@HW-q2Gx{A^=t{tL*Y#Sj49Y@Qz9eb72s0)%=&f%0kWiKF}8wB>2Y`k!H1+0$of-D zZ;z}9g2P5|0Ep75!G_8ho$d{i9xU(@vsaeZcY!%`fD?pUGHgql$>h$ zu{?32bCl}otXqZZvzwib6UFcX*R;}S-0ZZAlC|D(y_lzc39|@grV&d0Q)kwqCa7!6 zq6TXTEme1~N-fY8jaG}P1z8E+o#E+(ku)92_TtLpYYWaCg)@T_v5$X&15q`=mVKlt zI}qqyU>SU2zr2+UM!^{zHd^es2uJ>XKQ&0AHWp^mjgTbz{bt#NCRsPdsZ;*wGFTQlAtoRdf$1i}h}A>%yk0WL z7my01Om1j2N<-&{Q9_7GLjqQtJ#CmQYjz?FU?%WucmafVTP#dy1y<9-j$Ox-C(^r7 z25h^&b>Qd4hYh|EC8_{DD~bZ4ScRmCFKEh-7|}IR{s0NY^4B2s5<y%5eqW7pHKL`Tx7Dcl>Li*6A<3>IHK z?R;I_HxxqNcokkBb5J*KV%?q_Ua>|I)bL}25!s2pGt1jsoD3qChQZ<+#>dM49i!q@ z<15o)&F?`G$-DJdnjO;*&7RgUf5#bmM1vn0#0@h#Gcz|hIp72NRil)jmD-b0_Xgq( zBg6&wM}aKQm3TOz77X$@cICp*@tpz09gQ16pQ-g8KR~p%$lQHoKk}>INHL~MUkT5M zZxo&eMGhcnDz%p0&Mw_0*B#SM>K?u9Am z_*By%7lW-ThSNbp)cZlBt>gJ5M>eP`;irVTSHmm&$;N& z))Fy#c&V!jCU@jF^j=HZ`x^mbxhc(Dse{R z)ofN1hG!^X^cF<#496>RfSpk31jcMuM7@=);SOAvrj0#jfnlGiRkx1X6Ht#irk&<} zS3W&-x1TfGnW5~;@L1Z=DMgXtT9H|x%WSw+CE0FKINvxQ&MdXONqKi9gvd5I+@&S$ z*|uII8>g|#j-qL7)bD@;(noi9M^vM0QQ|yi`E)Gf0?tR272-E_X!5wnqN7&?5aR9r z(=sQsZgfW;i(%8r&-@nZ^{PhqPsJc6XQIL*p=@i0@F&$hOxBUya1#i$fLwyFZ9I(P~xIo+;?7%mB@ zxla16Sli$6@fOw}Z4SGr$VO@mi{s){N5nO`it^6yac*U;V90cgr{sC%GMt~}f>Q24 z=MCX(*a8_`aZ%MI9YmI*n0nh#)LoMA zHqV%kA7ayyRKexLdb%W6TdIF|yl_|CqP@6ZY(b=k&oy+Q{z6K*REd$5+~Ohpg(3TQ zxe@9{R-{fy3ukKISelM#Lwd~_GCS%(mhGBb0OSGr5#CgxrOO~3L;mq~@fBLw465=R zk|x>)Snb2of6UQzL0}vk4cHWagPzVP`A1#>w8W|`ylM8mqpIo80Na(GF*D_}<())$ z7;zG^BQlgS+RJ=yDNDbIX{oj;9JI8lp45}Un(AcJ4B_{~6kj@geD{;GmUZGC9U{xl zyVLJ#teveak7qN3J(TuslbAAVzl&4dNjuXE{5zpcu!GDf$1!Fz&P@Sy(OT8d%7>Ca zd&XX~!@q&mB=zH-AhqFmsjgGVHvYG$+NvfV2^xXTLR!9ptKRAfc962_|ZDq zI)Q5m4kAuSoV<@4c4|DEGy_rE|8vw35;vf~ti5>mNEM@y85;#lLCWjEAOU6zt_F;Q zKUeDtl??)$BBK2dD6wU+7cvPGPrxCA-)ixN8)Pi#!s_JgTo^p+FqpBhyHg30oMAu_ z3Pe~2A1 za9)B&;Br>#^?~iT0Lx!3I6~=!XF)*T-?d~SPpHCHELnWDIs+Hb+U50{K9ybA!~^~# zqa_?kbG#7ibp&NXz3XU4mU=PDPF>xonUCZB9Xv#}6`s2c6alRyRM97X#2yFOHCv#OhF)98Y@3TtR=)^_L; zra-qWx1%yHl+5fLbDu=h7wzc5rgSbs@ce_AfH`}2k4Z!eLM?OYuoHMGKNj-x^dS~M zDvG!k&j$ZfmnceeE{NL*_&MR--o=GOFjPn$Yd4FRieL z7}@OCzKWJxzUAl!OoGnK`=KDu@Oh_!l$@1~m@1GtZ+-And-Ho0eX|rkC@yoV_Y%WM zbjnb3|3oiNm8aa$W@e))CRJ#A_T=JF`;q&CjQ`)-VufZr-E{;9S!qy!OQ7bU;>GVV z_KQ#tgyYM<-^DbWwY6KLZ`a)(*L~BwZ}eW|msn=B3bz+isL^elTfI6d7<$+_nTNn5>3osnWx4e%=wbovgbEGm)>a3uz^+fBi05?%Xi@Y2Fg+-1 ziewXRXq4IF9Cs}IdS+>TQuZ)1p)c9ru$ge)e0W6(&>t&U&W4P^B+1a&fghi)kaS%2 zG1S(tH5eWHDJk>#HLla250eph{k}TdT|SeYpQndggB2e?Tx)c1w|PHnpNDs+TYQyp z>7axB-a(w^lbGffTiZWuS=Nqle~ECFeB<1Oz^k_jJ9KVV{ zNJzV3=32ICNFQ@w5Q}LcZKQVAk zx;OW5zl@haV0VumaN?Ej?6IzV*? zanN3rxrXeoGYgimXBN9j&NLLvuAXjg-EDQGl0tU^<+D8_*jYud8Vedm@9ted zzczv#u4HXDYH34sYfua)04+fon?Q#NJi1QW3ssha+ zV7`q`sQ^OC}r7Ecg^ew*FiHrYEy#)EXz48vQFyk@M`qgZO4<6b#%ro`5kX z9z6f033-3U%!#SSn?;Ysf;h3d=4k6LxW6lJh+&}Ndo33d+nBT zypffbySRX!nVt z54=+=IP%z(Z3eT{|iMuGzlyiHQ zDZcaR>XV!lM2eewDo`ziF7e~s0%{==XD3LQLpw{R!B~bZWk#?mVmPo|K$R#Z=FZ{- z2fw5v1Mpjn2}64&XCj_|-ZuhOvZB;%@vhE?Qixf9!V?>j{Un~c13b-$KuOp$AENJ? z-d3MsA~%JE-w?rw+BmQ6pB>xuE#PTssuP0HoVOX?uYTw2sLYy)Sgwg>s|eVGyIw4c zWF-Mrp*pC-7hws|>c^mnn-Hx_BdP!oi-MG*Mw3Bh*VEh4+f&L#znL|snucU>XV^3C zN4aZ6!sF`EwW$u37+oQs;5|0x#CfDg`QHZ6OmQ`VMAr2E!OUZvdk zTom4&r#m@VsJc79sZ)3F$!`LSt`>dwLeJph^4vFUa@X#fWhuDuBElL;bY4w^EBNC! zW%XxvQ|HtX|GBO?-~3zkAXk+FT5c?$&=SfcyeoUBN?vAtvY0^3d93WWJ~dNLE=W6C z;tE+$%Q~rv1@mQaA$7$MFWK?>IJ-QI6fQQUsAYm?tV5yh59Ha&_YRe|%I3g+Og*!?y= zq6}4`O@j6Eum?sKB_@d(b8@(;tc7{lsoBC}G`rim$(G5e#07qHDBHq84 zg|46>-pFR0`_-*|9Y*mxTbJG3NtVn-AAK*4dfv$@%sP5mP^=-6w_`b|FYLWzTV$6E zG(l$IPhyn8kqi;Qx+e{r&QY&|jU;TNa>dkX2bINCXatqHlxc{pWaAxmji`s?{N=v_ch$#bgdPMMT{wlCSZ%Oqt z$l_5@6=2Wo0kNR_rUwKV`BA?GNb|{J1IA9+$iYUPIemF&*$~@vHEoMh7Z2QdrSu#7 zF*a;WKAXR6zUuJK@x`Z(Kb&itTdU7Xx5XBSH8-kGlYDzo7(?Ig<)L(Rz8g~Tvtf=( zLiGfs3zVL$oZK9q)mD4?UAlbhk$T~cnz;|71IoEZEHBEgIs){;)p|?oU8HRf8Qx0{ z7j_TdP`sn}Hx%!`b+RcRKRs4Pm$V7La*n)aV)Fj$>MF(szsW5sMFMc)dcbJqGCj;9 z&ElZ~VQquIhks6K^G2=5kvW;OpAl(R)sot`{OYdzp!EX1vDx!5?+QF2DYvCUuj+ON zA>WS5HPE2heuHlluf^fv*j9Wx+TPJiIqt+4@!#nb<`_EXXW?iTu3JY@es* z&tNGy2!bI_H&{d3r&^0IX2GIhBdXOzZ!IhX4kwqJgYCvvoNDW$^|6XvFPj_&^o{YT zxo8{__g=?mI@XE!q{ZoPJ){lKZrWan)O?*YiEWsV?0F8oZ~v-a;-U=5yc)5cZuz`D z&Y9l(f$G+)uz=<|lX-vi`RZ{0_VGC$2>NW-vrYHu+SBtjsrT#0FTKC`f4f)Kw?CwO zU9Scs>^=it&&i73$qu2Tzvg`DtA9G_jpWpH3z8WiGx34Pv{g~9SI92osF7jbmbFq3 zTjY;<${7k0WTKvinz2e;I!Mnns9_Y$I>i<`7h-KtQ|_*8%pA#um`!_{2i=%!WgV@f zOV3Uk-Eo8wCSGJmnxr$b76aG8279s#1Gf>?A->cNhEXcvVZboh93RZemya_tXr5R_ zEt26SrOh-qBdmH&3C{fFcE~Mzw>7S9S`;C|mIV!9&kE5&&o?WW9drtsQN_rj(7eEw zzg@q+9bll`8(-u(m#s~y{W*KGx>d1zS4GPiwEJ^>_*ovVejuf*^x#t->eJfB`(aV- zBq?TKvr*tUo z7-S@Y{?p!N9F<@{u<&3S>K8g?=WEGc%t2kWqh>?h7$j8j6^NzP--lOAL$C)ju{~LY z-~~e8PIM{pZjl#G$lR0LzpvKM+D*V>%Ftr(6(8ftf1l3|PC#@*@1q9*kmhvvvs7)^ z**aHU9@Sbc`@+bk&}ni5qAC~Q##Aa!YDHFX11nG*Rchums+TuU1-D`=?uw0| z40+*SqPEFTZ!P=p_b(LG<%*?|M^;TGh|>3*S3K*BXMa@AK_o z&h56*`wL9HvyIJ1k6t3ncdWtvYuBcBUBR72%rrT)7kL`{&}ZV`cVZmZ-u*T!C|UOB zuRCL;*d7^>Oy`$S)Zqh;SKl7Ef)g?n0bl5VPH!QAmX>{UnU*ZTw)#y45V<{`WII}~ zrKRWl0h*BjB{#ZrUNie;zIS+8RL3>UMzD>cUcm2u23Bxv__Mn&U-8_uOao-5q40UV5tY&;4!h%ePat)Z#h!xHq@C+ z(4Y2Fe(rybd0tQ6K?-6P;dm9Q1~24wH%Pe+Vk}r{{?NfG1N8iI5RT9b5ALXnY5vOp zBpwnXwLtkh2C!0#5NGCykFmLCOS>66XrHKl82A~xmYH$oq*o2gpEbC>(-OSna?`~z}S@*SOb4eO7nYOj5 zuBo{*&X0|~H|f+7$I~5Yp=0Wfay!K6%4b;#V6`G%Pd=11#b@bi7K-;GS{^Ra#HU0u zR}EL2-C!mu9W|{g_=BR`WrGV&Y5I?3))eEn*_BrDnob-=>FPozk+cQtsj{kS)yvM5 z*jXfIUpXtGi<)zJ>7%rr+y$Q%8#?eD;(3q&i7;{ZXA#N#i=kM#lJy~GnLzUKd( ztdn}@iT?JDdxT#byV`y2R80LEE(lv`?@uISM*V^Sa?-*R z(Zy^>%ZjQEABPU-d%OMS;H6czx$Eoqi>LQj+;_spi)ZJ6;|h$13dqFot=80|TgP!Su z73WTQ7KyG^Os8A#v(0#7A<`+Y4uAb~v|vI0ZyVoC#kLT>y@Rl`e_FL~_N6zd1r|W6YXYZ$JKRdMd?G1Mp zRWIJyF;-3#i^EG#=Ju0O&%U)jGD6LmVcNk!PYg3b#S?jyxYwk_2G$6R`c0dq#S*iQ zC?W=~qU;{bT=hP`^d2VOR$~cT&z*B#obDfP0P3r_Y`u%~K&P{8pK)TX`c)iTsL(U1 zS_(3lzK+apN_BkycMr@)wWNY2%ma$O!PsYF(2D{2=6QK#iKWKKtQmyY>9YY{XV|md!Z)5p z6tvwN%}~12PxWsZM{wd_GLFFLn4N16Xt=C5K!Si#g#(qxFWc;SUyEDq)!l67 zU||(^e0jp;bB1asdzU1~{x$$+xRRBpwgooJ}bInceMBH+Ht5vyCy@#HF zf2U<#7$oc+9K{PJwoeoex)-K*4Esqq!dGg-qvxEIp@)G@&B2ss)$FvO0>wAB*w(Y{ zoA%)>a(v*59^SmH7V184op>ot74dmL9fuSXmO@bag^ci}@E_?W z?MGrH=Xn0p2tcV0D*PzhP&05y!Py{xb_?L9U4Ar~;%fRAWx*2_h`DOrf5ARN0EZvIZO{=7jXls<7~C84<mw{}TQcWj`r(Zz=F)pYbU?bfH){QOpUt-ZF60(@9n zU2*YIqd5tclp3hximP=q{2hF4#)lF|?C2Gg=_;NXRtVZ&8?ED{S^Hml?DfkiZ>?q zV3??FD}MmqRomRgBQTvV`p&ZPp6J`U=nt3~Y1mFW96fB;g}kQjv{^Cq%)-c}@dZf{ zZq{}gW%u~XEE^W7`gCz3RayKlvUncM2Wl2h?3{6L~Cdhf(6T`WWj!~qv7}oN$w+_Qby9HoSY9Z-b z+cRgIrs9%r_W>huI*A{A$Zs)BpE4Wy*IcO@h4m^Kum~W4I%(XEkAxY6vI?Xzpho3Y zY`roe3sdey{eKM_X>n=mGR5M)g$_tVz5 zLc^MdQD3dBF+GTw$>@UD0Nq~4yKM|+ay@%;A~q`ZN8!6k1ixsCNW_7ZN_YzU43;pH z5@;%Lk(Yot`Q33(=eQUI)Po)9VXsRXfS1Hl59rr7m8rt$uS#RK#KC0Bpu==)LafcE z1>xO=)x`7v-lF@VjM9n#g3!Pb=OQA6C7U|^@({*us_6ISdY@behI=%!%*+kW7NTwR z*Q`SxUBL(?u`DTWW5!OKlud za|dy&5XPwJ2{O}+X<{}z*s)iU;lR*59|)$W9V=noO0{`#?Ow&FgMv`8;5ihCWEcLnL!-EcU3+){zhZvZ{(K~ebV@pIO25j6x zjGD=}X)iM?(vo&?lj5@MZZqQPIRY8SxA-B-uwTVvBZnnGiafoiWG;0JDRKg%T_v*X z6&l45lar!9wTek$MG4wXiNe!Lf{rI?mzRhZ4Hr4R@|QY%?i_47evcQ@=rJQkSwNeN zceedqbozK~RP1K{kmS$9aGW;;DB&~g3)7W}FbmgwIyhG=Ifc7OnE#wQRW~)zXNYvs z-&%|pZE8(SFNW7=PYnJ;m{j&^oLSJ)_NR<4rKn$(6PWR#+;It?R~AhPDN`>qB2?eTJY2%+sU~M`dk&U4p+ZO^K$g>EOx!`;G zVe)Jk(1q%hSo4&z8e9Isl09@D-a9z?9lMWlHDh+yxT;|W@=rNm04U6UrhaN||B4;^ z6A#Ld>^i?4dENxmQM+GWW4q8QYKbb)8s*pQn;14njbucfC#9LRwcNYn<5zeN%zh!i zJeWI$r-S5sNnfKJaHei-4#MVbaU9ZPZLsh=qW<)RIgRywO=T0K6o0*PbMaHK;e#C@ zOI}y8?~|f9wEppEFVmD~8&N-HyG?E_)7CV}kr`$T{U61I{}Ayvv4F}9i2{U7!Tw!E z!rlIS1|BE#yBttBiuB`-o&RjjCuiKa5EoZbs9Yo@*vNJFia#o);LhTr7g z^}UC)%ljkJPy;a>>-EIsYO9ZDxntj8*i!2kSyW)pk594p`zNtn{LH}fDJ+t!-y{M; z5>KL|jGYNq)FK7Ds}^je{u4Bk|9JUdZ0)=PPRPaUzln8OLa^nILm>PhxnI7&=$UsX z_XF1sORk*ks1j2V9&X`jb%H^~^Wc|c>ejvD330Tl5Zkzy6)e>XOHw#r#|-CFO@yZv zKG|Ia(7b^Z8_yF6?2!VZ^gg|F`}aR?&;mwu56Eatz%)@6QFdu^o`dHd;4z#tnx`|m&UnXKUN1BK#+F*WJ^OC`B> z$wYdYitQ?t3(i&Xk(&OA4FhXj_~89-mBb4VZx8m3fNup)A+0qsy67Y#gW4zskD~~t zpNjMldO$5Vv4kB;^TmUECd>&9QWgzvt}ob$=rV(c>14o0Fg6tI1aIYWI1j~s2q9)m zeXK=ed|WtbFbkDQw303x9Q~_q=k*$pW%A5^ao2V z598~5~BZovD;Uqp(nfW7Gr4MoJ=ir&3X*9$WkkBpwDGEC5(~#P^jJb;h2v=Y%6a;vCv|zdrg*9*@MIlH-dP znIxm43u>5kk-n4LOU=)IeI?R(7yo$QSBVsIYom=#|FBg^`>;eZ|2)g5c|)+vC1Sel zzBY$L{?SG) zRHFl+A6By)#t#DNGN!Ozejh9Fdx&Pf{6oQap%L{|z*0E>9}511J|UYBqlQX)gIBjX zPmuhZe_sb6KRcGX69mB%g$9AfKfkILC)Seoo;+A|phU_kb3#xR)L7-4bVFfK)`?mZ zmsg!UFtq&O3SEg!(^1beOs&9A+4sTJm!M@A`vfEVxEY2D1(<4NgZzhI@24NcqR@L7 z{13m5=SxfCM{epWUjmlAk?FzE@qw;rIgKetU@A4@qw9Cd9Wmu2HL$rjOW3llB#$y> z91!T5N?N1-9zMj)VN57@OpM;2Bs!1zcKOi3z4Mg7JZ0K@mwPd~POZ*V)JTfh?$C_w)q=1M< zAgWb?Kh5j_T?KD$jz)T$DT;*JPZ?)uA$oCiEPJ%azn=DGq*7$!32=1#hK)ZHt;jXw zAx@RRQT>XorfOtFFM_q+MAcoMKo)lz)7|SW3s94P{=To+Rp-Q?yv7w^fQ8zQ8&_R^ zND9yNfKpfjJJbP&E9V{iS&c8a+ohagDsAOH7eG=cSI+vgH4!kGm;ji8RSO5aAOu=**W+COfDG20;)7$vQ{~S9;82a(%b9 za^62}9qg}fHp#EIg3az%-jaQuqp!NEO(i90{||laowWIv<;H*&9*?a{a<0axJn1$) zO(|gMKk)H}jpi--;U~KxTM+P_tpc$V?Q{O1QmrfQ{9-Byll&qxnmlLFsfqYx7EN;* zd%Z>_pgWYvJ6m6+FZ4g`u~xF4sA|5}_Aj!8el^ALXn`mO z7$9xvzz|mPr)cEM(;(PDvFdafTp|CR)NWfvO&UB#%P_nv0vA2J#w=q4c9s&NhZq$S zD?{NuY+3q^p=Y*+iIG%M8h{!p_mem)^Y%u?)pfutdf*q5WUfb`YChH;K^Fmb?=yJF zHt=&T1IkE{gKCf=vC>9Fh&uU&u(jfk(4C_p9Uf2OdQ9p`IQfpew*kms&W0bMoPMl4x zDIgJAO8Jtfoa};#SaTP))?qRyzkkp^5tDUt@vs0S&_knZIJaYJ>@PJ|YrI^t4M$YA zR@CQVpGq>cD8_M^7ML~CYMI`}fTH+$pxbs*I;9-2!wdWg4b=sQD66OYjxMkOKM=zW zpa3NsXd9mcn|9H zb4cVZIB^EU7{)n6I+Om2vtz+CJzP?hhRx>tJOy3?!JCV0zmXJ_3FPY|u$b&Z0VawXlO-~-460vJeMRun!f7Dtxx8`X1Kt*3Xc3Afrm(9RI=u^T>?8OW@HJnKrfzRmC zcozji33SqDYsY5A^mwnQME(nnLu{#6(vH-l`(_6YW7Ct`WXm_pe`xRBI++f15MyC~pWgXPE z7oaC7S?EbYbUI`nKPM~`i%TqTXmFAVX@vdDurHxwGm9N`H3TtMJXvWr5sJh7g2Ju7 zjRHy&0Y*7u937_?LQf;40_)u?*Yk-Os=bA<9#IIgY)YbHbCk~9a{ZlJvdFEr&UB2XT_R?u!L@!J!hKS`vE@g(5)Zpk@Ro-qS z8(y!9ab!8zx(^bB77!x?l~IAdKQzZU*9uo?&{}6i!V1GlOQfxKPzU|O1Qp>NKmU`} zkt4SGCeBvB0!)I|e}PwV?t7TN$P2(^Q@ZRAHYa-El@^vmJX06#sdF2yvaR6L>Ss0p z=M#EC;3b0&ITw9ZerF`=?L23SDd^bTiqQR9Hftabd)7BIlT6UyymYtjMyY?!X83B! zs(gr+{Mqkn+;Xht`||Va&s~Fo)MekmSO?4MF!y{+LB-h{s0f}7Rl>U)&Vtyvu5 z>}SMdF)A#`9XeSfI*lN{+~ioe@nABwWK8mtMCgL~{8?9D|B6fGWydp&FLW3=l*0S> zFh?b1Lmuiu0v*cfdwPLxc?Av6|MrX?`_vp6Th@y%NRJ#9j$up498r4`=zKp91f2!p z!!SmQFjM_bQPaTA-{JjS)s4Oj)D=7FSFR$7DLGKT5A<jdQ+`w=h2WF2iE3a{+H|ihv7wTwkXx z1j9JeF=Wq-@|fqnW$q_klm}G_AxyjS?VhBvsrq8+C(Tr;UOM|x`*%V8QRZM&UFd;4 z!MLx$8w?lp(IT%fCTKxqrWN0q5g*NS^ec*_{;Ga*O8zDMaVByKbkTM4bZp8bWv_}~ zC`^Tuqrj4>xJHvV6JUcv9NbL89PMNtjGdqbrC~x6MdJ32Q(FigFyPR{W5GVjjPNWj z5JGmvS&0|LZr!B0O6}R2E-Rc{m;q{UrT}+A16*?rDOagb`N7;=e8_S?iX0#3zJyCF zB$#|wdli%+XB5_*{2mVlER&ule441d5N2SXzz!ZLwI=@z4bN0BakvdAYdfw_W{#ksBM%U#-j?8y35+u-RZg-0jdotve%sa--Cr;!w)3llSt_r zQjn#jGFIReRVW2Vr8fBxMwFcA#~AWfuIM$FgJ9J zK384r`aVh3C!9~Lzwg~E(-`=EvBF`EfQ?dH&gnMP-#Ol2FyT@sJ+sx2dQLb*zGwfJ&Dq9G%6dvqYMr6O&4rwXe|{OHdgFhWVq!Wp+x=NsjsDy7IW za(eM2$U)&IiEupa>)zsFXcjR6+9bt`wK6PdZWZI<4RA9L;zAmFhw(H)x!PkuXi|mB z>9lGMtm#RT*;5-U?I-={g5{9|KtTyK=KxJ19mv{U%t2xZaw>v4pN3-}*oxy%OVMc< zR5aFU@A-q(PWnFd0BKr5-mhcdOcRSuS}0%aD#|F;q5FIT;V60H>DFA7WF4u()H8Rk z9wU3G6jL>uC72Y7f5o6d(W%%f{S$+xt<}=bp6~lg`f-|Z?>oUpq4zFFM#UXxHD}v1 zNa9_)Mxqm3u$Rp1Mm=1p5iiU!@;$|zGBzi{?j#K}W$YWZ&g~PuBWd_oOq+ZCUnsYB zo>YgP3tuPsi{-gBt&zik1g8WpgsL!HVEfsCoUa5QPTw)^2gd2KLAGY&aY&9$uco1Q zbG`Z>KM;mUXR9?yEVcT#AC$sREV!zvpnjB!g79a8%R`Kul6A%z5~DFz0J6yifiq+W z<5l|HNfZ0?2vShmbCA4Q>MXkBgQ9WIjR|T+^Pt;^{4p8rg>&=Jk5FVzF>h}~zo{}Z zT!2VPJluKlWG9;^a0VrZx;I8ocKs>ZJ1c+I?BeX;gGxy|o4koDFB%`b{PDs2V(_BU z2Eo;0(+4jpw;>^!3AQj(LWmk!$uRtG>H;}^(t@#9CmU$L$Oji}7!NnGr?)ma-RG&)*rtJ^>Wv7ifEtuS1&f zi>J^l904f>RwU$%zfumV%@7PHJ8LEI5a}>)YZXX%;1HSBu04i)Y)C+7YH&|o9jD{P zzH(2$)Hwl^w8qa{uuc`{pa00o=tE#|9nt$h3eD?q6IX&GfzC%jLpo0meiQXEY3jh< zo9=V)t>CrajUIgR{@Pexo(YG+4{~0XZcGuQb4gS_sAmn6QA%o!z@t`5DGdZT`>Ny! z0g=tVXGYq!%(PqdsUh1@7cD;nTRjxv8+!ksJryn&9+#OyMN<`hs=phWg_IdSx?Boy zP4$ZT9Cu;Pe>;_%+I#zyX(cuPv=+yc`c>=@vhmOLXswyzsX9XMaGm{0y)x9(u3{il z3KcxH8(&abM0aw$Ceo-J>P1mOtT61mN3|N8GE*q689l>w;*Y4>z~5=Dffg%Z>h6%P^q(6b^O z)3{`ql+xnRQ?18LYD%ddYi05xg&cY9hPfp%DQB!qHj9P5GE;^9Mdd2|3!{rhL_-C& zeNr@6mTVN8d0E1FPAf%ruXdqI5$qDy=PjYJl_j29=NdU`0K|ZT7$PWMF#mj{g#_BFGdI2G$GCotsK`q*BIVL64naY8j*`e%1E!t~LpM!O_#*t> zBxvvkrCf7T_|4+wTnSD0as7RsA;Hbq!$YBrk`SgkJ`LzGMAhNqp{^B^*ieFI zN5_&|xYFD!6?#G2jIB9&7+L@`>}=#_M1RH_3|i$jb!cQev@5|^E(~dqHUnf=7w+BV zg{;yU%7+qLil1wDyBR~_3(9&yMgpXQ(pnsTT}%NMZj1(hd|GS0AVj!qX2^r*NM~%+ z>n|BQ6M-qMlW&-ZBdK`rx(zjOLr^^P5VWyndH%~6cJ-xvohIGHg`lFT4K3o*mat;_ zPvqxHz3t4e$ixUfPKjf@EH!Z#dAQuuTcoI}U?LxLk=jc9>p>}J4P5Y)wxp>HHzMOM z8!js6>X!O&QLDx;uHGukFFFvdmX991Poax1l9ThsFE)_w^bdS~zJ*Ucu(^@XnmtM0 zbC^oRiFhS)w)%?KsvBxWO1}(_*$ftYl2Y0L&eoS*6I8n-K3U~IMF>D$;9TvWY6I%A zUlCl?&#zjBpX1a>6`d!M^&OxGbTXn}WZ+57OS}F2@w( zW6-_Vh8VuctBd!#l-os&Z;pNip;@xjWDvVe{w;1SA`3q&QnWI1`;#?~7?z`~8}~b( zT)d=F(ph=Yrvfp>3M>Q7&*s=Qq?|`UEer?q663q|4!1>u=`vVV5EsQKG zU!8Z1ftV`Mky4-rI~99HYKZi_&DqU4P7f{9-CeO9MXi<_P09#k*f_X7l2!ZI9H1&x zg%b{U5||>8jS2vlwcH`Zo{ho)TRL1{J64`QE5V~U1HuAWO|CNTa{~q)b1pF zCa@e82HZBdLS4~EMfYr|vK>FT7`b7^f;XtxJ;=7j`KO6d0-|M5zfv)(*>AF%OACEx zNx`le{cz4eJG^Kzkb8?ALEqiL2wu*B3f=t-G2@&sYt%^(! zJUpjiEvQR+IJgNKu}+iT4p=@~0~F=k`3+4BJb9OM5(Ds`Z-58(nxC2p2bXg;7u(;MC-X$=KY4yytQg$cCSTY{wBV?`IfU!m<0Kr5D z!Ob6BrbL$l0i7f~5*pE@GOU6LB$&@kVYsnhrxH`qSF+5g&lPipMHcUs5vY7LN z@~L!3#_iJ8?eYcO27=B!QhHAPmikdv_0`((HhH;aoAD$~bC>Fv2En}1{dYQcW_Z8Q?M06gR#8%oO07QY4NzJACpibIoA6GCPSt2zYR6Pqo zumnIOlw7Av72_&G=b_KA=)imyC=ZlN**QU=llvA6XYLYri0!;yI~?s;cV}kg+>z-# z0`AKs_usJDMTz2xnKN$@QeUWudO3<$0Z{kbRQF4W3-^u_p-d}-ET1pZ z7RL=*^|3F%;mc7R;OpJir0g25OlelP?4DZaksq0P=;s;|s(ujigu2N_T9jg!%63Oj zlu;Y_-dzqOwflJ12P5Xxy?uuowyRmNd{xy3xO1}picj5w2=v92iX+9pkR>frpP!BF zK^uCxgKws__x*kw+GpBX2;1F6dhZYzbR@fomqr4}rk3>!oD?6;VMQ`T9G zZZ$u*tu8KQ{*)2zG5yPi4xFubw7Sz4Qtj8Xd7;hF{>%AR^`>$(RDPWhk3B>Nqyz^+ ztRM5Qj5xh%?R!Di%sJevoogE!0~==QFe>g+TG9?Ms1q#p_a#~DrVcdfQUYJzBCd{* zXolx%oZOCu=q(?KT))u?U{RB^^zkgssSu@FwWm&*@^KBRr6f~#a$QQy=C_>jN62E2s&ihvi#N`I714aDa z!R|N`H;r0Z31Y@G^*quo10#5}@8slY=lAU5^&tIhe%dI#SG=Yc%S&~@^(hLk7q<|h?6<4BLLWtd99CBnW4Vr&ea=RWR@|!DSGVWnL74)+)#ONIMano0?a4;q z`7{`!X;+QD*y#gTG%9wYX9U^f??8YpAzFZ16IYhNvb2fl-T^)J2;fE0i6R>r?%I5+ zpqWvSG2yjjnG|uYmdH2}k`cskDx5m;t^KhkZe~C3@d}5DV_1_I;Q2mf!irE=Bii3E zpN-Yz?QeHj(KCFc00fB}jq%&`%MWY$MI2$deZMQ5zTY|JD?R_!@2T8N<%**WzKvOhv=Tgf#3BY zCjFj_5vSlS8~TVPGZG`8%yFnoq5=YA5%XS_6ULZu9AR%pAVJJ;Uc5s?pM31il6io7 z%ieblC@R3a$La4yE%4yAbA|tZ?7iuF+qkkQx_;{^u$8PGrpilg+if*KK@g% z7Gq)@NV&3N#nZC=L3Fs9Juz%rAAfX4K`hWcn zYk&UnkNed*)FDkeivXON`p*oEG=Kh5plBuPBE_l`AYcu_R;QZK=!jgTMwP9O$u(89 z^kb<5xg*ZW<$M)<9q^vP*6Y?o7dtJo_vhO1eR+=B)2g;u$AMqO9_G@ojwYWH)oMhn z2eBF*Tea3l${LmuYF-JR8xV7$ZsjHuai~Jgo@f@80g!>eEEGC!?Gn<;!s_LE@X9^F zIfZ$sU7!VbA6}xwuiNPpR$0Vi2%T&Q^VV>FxP?`A3)vyuMuL@lR*HsFw7IXra~T<| zTX6azSZtiBk!Lhi&Dm@^GDsBAwVo^!E~`skDK)uFE2mFnBk510A^Dr*;2tMpd)A+F{C81;*F+NB6mrcMfTHSp5n--PCVI@|6I)YfBxq!BhjeF z@p&wx%33%z&RNB4ysufjd==<8wnc4}@&FW$X+i~>g{`CTO5V?k7Pg{L92nF%x5XyD z4Lp8)*%l|EZE1hC4I%<4q7+BrKXq{xUXOo$DB>U?shTnO4q@rdglYzjM#y8z_O1;1 z?|_+_U(Uq4`Z6}$nbg9W1!fsz5#Xf11Uy+m3Dc6RPgBM{aGV4Trx|@XLFr_~!Wi5n z9YvhtzD3EFx6h{3;xaoG2i^j)EGVzmq+nyIB0Z8ppTs>xBGhv496-KXW~nYCG|v-= zUC5<~j9UH`A`Da1@_o`zMkD+&CxH<(76*mYz4KtN@ofJwEj?eBOvDnmbqcwCL`DGW zfu-@-sTiHhpNj7r(3>bAHGxSZzFz03)9QC>C#~a7O%|wWkZPYkQ3e?rB>`VaapbF< z*p#OFL3AmsfiGXGc_WNPuq-i03YK=1ggN82rsFE>=BO6|n+5Eg&nZNP zQJATe3`_|Xt&Cn<2OW-ijyfIA*0C=^p>Q5WK@eR_6;liuLu7iF(*wFA%`lr%V+|l6 zNUBgm6~dJh`8H5SA#$#iHja0Ht+xje$~ZsVMy;?`ERwh}j+dYl#bFCtnQKH@$sy=# zhy_!Cec`Q1by|fGe@IZe6f>Xrl=1MM-;In{wLsr+y)5pe`zExIl_qWKN6v! zUauqO@d*sjhygT>*^E&*k7;gYuVTlxIkKo|?%0{lT(yAbIA4 zZLmU(Ca>|w+9ywNq!=NR1=z2H(@?}dPFbggJx7hoJ<$Kx(IUyO{~95b8@*Xj|LZ6_+N(l!@NPPzAA)yWXnPlr`Bxd1eiV@@Ck_fI<0KYF%!o=o zL+n3Xl9p&Jm6$|(OUg^4Sr zL#jzzSm4yXgu|*R;=vHWfQl1|uwvk+j#-otkm}LFc^CANmx%WNOZjtTo!3D(lo0~O z;e=*ZR1r&si}_Tx98k;6N_Kbf)q2=;Sb2@MIC6NyklvEenBk*TV$6yN{kCw95h_uk z1ucV|Pm2VeOYkYG6fI=RTpWUz|2jO;(RD@<0SF7D6{S=cdC5E&m{TXwK;?lz>jIPk zC=9tgDgA2nE5n(wc+Ol>cDjw(evx>Wh@BB66;4I@B*#UHyeAfQK{PTJ(NMIi4f`f2 zh*kbFiei`sCI>^rt`Q1>k4Ga!P-xvi%F9D2l|p<{M0hkfMMgjRoNnZ99L|j9)FO>W znc@D5ieMYUb{@jNZsNM3k3OCx)1Ew&n{(I59c$+4^3;)@iu1iNvC^8lG(Ax$uOuLo z$(+)vvUC{vC}X}+h`?CX7b$N;XBFKiClAQL6v2=JJj!!oJ-K3~Pap-mR+qCV(W$)R z04mpQ2VjymCU`v2V`|=%5SBsPUq=!BBu1ogLQHKumfCSA$e?k`8x$u$uqB##D1UIa zu9mj=t#iEj36bH1FvBp=2I_qJ=JBjWK92Z%95rtl}O>&1DoLqM`(fy|bN3 zFkdMFm9NIqv8_Y*a~o4}`^zqeh=qiaExTyMP*{j%k(xi<_7Vg28!oaO#Ot5jIZ@tH z8!$V~8HY?+Trcn@pJN?nrX{Nz$-8Woxg(F4W4&mql9t_b&0{S<>~2>zRhnlnyVwKV zg5Q;q&Az}&Z;0}?6i(=!cS|k|C|h`Bbh>D)RtmM;Et|}zX5NFTyP>ZeWwA@^K1bZ) z9HIbe0~zrk8_Oby3aQ_6P`UEJeHDzw(U*52UU#Qcd&3 zLI%$(7A!bVT7&M-or|+huixztIw$SU@&=u4ZNFsR4vL4x-9U_*w^9f1ihaJ@2Jd>E z!*2gwUEB?JPcDu-$EUsD-qpdO9IH5XxT*rD6_y(=IS;z=^oi)Y)Y`{*y_yAl5BZoX zjGH*`4_YUOt)tVE&Rha)XXar=l~9Uw-pR*Q6U?&SY=eGZSg&P;>fl{A40$2jK05CY zI=y#w&^Fv|g*XJ>%_FFHrfHm-#%jqL$-^!ls-E-9T=hx#;Ft3raoEtWj!l~LH7UiX zT}-5dUL8$Kl2OrXNuWg{r>I9fc)a)ISvjG@WRKRo*2hdEP;VuFP^EYYEqwT6>tk6qJD`{ln5Pm1vb zk|3CY4+#wL2=h~>blDaLQ-)S9P2*r1ek&bBeQnS z$EkYWpM#2mBv*!rwrpKQXK|ey(wFL3COoDM&A!kJ$vD4`r6X**?8D2i>lk&PiN0N9 z&R*SU#2#idYrw69GAZ?ZHL7*f7K$;O-Dsd_3bB2ap^S9?dx@2@^q4zoFP1$pf10-u z6dV{+Mj#U&wFwM@n}HUQalxSAmC`|cEkLJa3`3Y@t7=(JoVL+daQfN!eW7TXX&}LYs*vASH=R#;7-3CLIz)o%i^4n z8~AuM|B#did#-q&A;X6Z)<$NRcDxuzIpCuh$%qS4Xr;|k?uey_o(u}x#qb~RsUEcH zTKErmMIz&|_Lcn*>Ur)($|X)4Gx=V#~c*!eTWJ2SVU$HY^U$i zy+rl zxmC?uoM!AWX_6xb00aZ_AfZ__OjFFyjPof{@TE1rJ{G3Lfy&Tl(^sB?Tx!o06H6G> zFNY1C=t-ZG^wEe?kzGp`(zzxvO@lu8g2_+Bx>mafuXY8oa2d(@Ii#rUrjVB+hYNQ! zhF)GBB;MAj2-UT~``|l8lSGjT|6G-a+-!4Ls+J+bhFW%IN(#>9)KTf&qv;1jB7aY^-BOB_CAi1jMCx)db|!Ue!LM9n;U+ zmihe-p?4+ar$$zO7u1XDEU~wX5YPFkUVVRGDxRbv2syX<1;?+2Q|;IamZg&XPOu7* zoRNqjk0E~$U82yT5&TN*8R>u4gF)fu5rt0jF{o#UAj+2I3?LQv18*Y`n5jq!{UrP9kKs`D^S0!FwH$@hMG*^%D}htf~<4tc!+3MS1O8Ul(aq3w3u`5h5__fO>0s%#Q3{`FDJam>DG{=gB4eTb8C=^`Aj%v0>O1I0@0!y zVA1_N+Lr}ZrF$z0qGK*i81IPMO-S98Zh(3#RK5yQZh^K<1lV+K&hgST?Skf>nJ}v) zGs!v$+s^n=1ldU1F^9y>R5dHod8rHTT;T7B;tSBb$vzMMt5OoWypnw#6DHLd7 z>GelXNb5i$1qDAL5zi=-UNdosnb39LxO zyw0_u?<$KRi~Gts%RszemHy2{(vG<_z`G-gH=uNrdIsjL(D?EQxdo~=fVaunnA@f4 z*a1nw2c>ck^mNoax7Ye|*V{UDo(XVs>Co(Y2)T<6)p$C>qSLdACZT#)e*f-#Ve@V$ z7v6HL9lT6Cy%yjW>a6Fe>DCWhs$N+SY~@OqO@^&Zp|p08q}E_9;M`P~uy&Y?P6Ge=pL5c&X*;Yk5oqneiXCq)pt|Lj)qUlG`%XSE#y|5@8DINXyA>G6=})0TsaV{>4#pHi0;h-}A_I<#=;6Y1 zR0YfhmNl$SMgc|oU*%L1z!|TuLy_BV&6PyyGdQho>yh*Q09A3FhhA73=ga3Md z)vWI}>y29DL1hZD8ir^=MAkU~`EWWFAiQP|z;QHz(<$^pYnb?OHbavN00{|*`}C9Z0&9^c4gv`T@&Tf9W1X88Z4W*d&md`4epDp(QM zqZUGjuTTy7SUh9|p`9t@o8nG96C5cE`oF`_G!7vDHbKF3r^v7>a^Hh-mI?LBq~Yd| zJ*oWT;Qv=L5#;(dfcgA?_sQOqW{&?qYVJS!!T;~#a}OM04}}x~hR9S#4)&r@u1uN* zqHBwQJSSq|f{uKBP`Q^b`RnWJI*g$=L4xfBvQfHo)NOZ8`kmTty&*IrQf9TXHEVfS z_NJ0f;&7bp1|n&IxusO@fm#i;d>?oTWziIb5t+h3j9zUsD7;F81gRaRUP&nFgjYh9 zRnmg98ZWI!**pMZfp8IA);R#5zBn43H;%FfWgXF=YHne;t%?;L>;RB7ovQMGlzZj3Fw9GLh+c)J*ZcJrp(gWFyL6i+X+h zCprL6o6mN2tIH;l6b+imFAsny<7`Lg#HnYsUPn|^SvIw!vt7P%8*QFNBukQ5EUnWo z7|HDTsXV04(mGzeQRAE9YOFA|?$hx(MV-mXR=2pWHi&3N@ zOb?;`A6?eXQezzA(AQB&RQ~~d#u(tQDTh!1rGgg+|tqN z4nXy%syy{bk^2}i$d|KZ4Vkp7!4m0nR2FSM#noiA$%i*@1>rz<%y z@jPoKZR7xWq1owol%7ff=E%%tv(BSP(P|`OIP0t)9%1j&PO|h4{lm9%d;t|A5f0Pf zyGZiT7_y1XKY>DDBEo8QxukdY=sAHK{FJXM&QOh3Q-c3allEr<5}`Q|B9Yli{sxsC6|rPTy`^= z(=10Wo0O@=hCY)C&iqaJd@PP!z@@H1|td$Xi7vB4x<3E ziHxxd-n3i1gQL@S>!=P+(mfH6#4C}MA&^J2meAywm%V1Tfx7uZ$PPOAWDr4dyi_U> z*)Q}+M5ze-s<#M$AjO*XXgK;D40*bG({8282cs)-AWE>J^X!c{$8`N1$8xPvS8M6= zEVej*DQ0)q7oxF?(vdkAo}>CoLr)o^afhxhCyKC~EyY|4L$WzbNt??-m**)4JURxl zOM{XXJ5!}}GIy<3No^oh!@3+uNKn#*)Cpywm+Sg#`8r=PB`FBDzGcDG=em1Uzc<4D;T8bNy$a%EcC#Z zRvoYi>@^yIA}f^f z3>rUp+IZTiie7#niP7fKGTt0YL#jk4Ww;G~1#`svmP@`WH$1=Op@rWF_Tvhlrl#iz!hWlx|+qO3Q~aLxe9tAxT*;`(m)Fh>_|?qDA6U!Y@l6ORy9Y zS`r60KOE{z{d_l-t5kLjlo_zXgV4<@jDjHwqHxTyawl-BA@U7NzO1RS)mT)c@Cv1I z6+^$K*hY;-7Imp;@=H(|kOKn>&-}F%7}OQKac83SMFNq!w(JOW4_6Xs)cCCFmXAb| zq|ieg{A#tNH_hYM*R5{R=(YrxCx`Z1ftw3OE4PSnRZZPp=hH!{8rE9171!dDoXO^; zY#nN*28Gc!pbXBG))3Banbc(&bD=9^2{8e3tkrDM3aw*$+o*uWp&O+(+(J$V-H~M7 z%GN;?SAVqZnyQ8F7;xT}R!o`#Jm03{34uyrUk-AM!Hc6(=#g10E=>7&eU$#>(v-a5 z;XJRTy}Rb~9OyFvwBuMke+hgKw12z!lxq7ME-I%r)=ice4jJ^+N^>@Pw+pU_6z77Q z&(CvA-+o%FrCxzKwL%>nA$WyMfl&f0;CxrMRaq$z10TlkBq&EdjHQGr4TcYzkM|y@ z6Z*5bFXLjn+;rZ+E2zA4K<(FG502r-UhDV_5f6n7j*)1RKZH~D@BmbwJgPU+7Tt+~ zc6?059VYKeqENJ#A3^|JY295mkS~Z*H#pY%PobqZI#j8 zgWd#f1Bw~i1|qoYHV~U1%&x)fvIIyBFK%wOGE)0jkx5uXim&YkqQ|# zEk;Q`L&q`))`1>^hF<2&?4yw35Cz~BiITVuPK6N8+m-##%Oz{kMZa@0=$>?r)|0bU z03tfl1AL`S#H+dS_m2Q031vcPse@BNU@%zsC}=Q9dnu0MF4Ng&gOb{(tTTH|cajM; z8;oQG%VmPKRHUa|L_OEjY<(_L!+FjTFlT#Ba7<+IPc3A)|W@KQf9O)TqRS} zFzHcgs-1ll2hj|NltTfQ~9897^IaC`tPe^0yeSrP` zMGafU?53sQv2>E&ibx@R00zJ6MJMTy3!fstB$nHqO4qOQR)$E5TtfsPV;u3mwq}YW zzoN<>fZzXEuGM3{dKb5y+6z(Dg{+tLW7wPeAyqEj6+fiXC@JGDxq`}!)(@2>P-b%4 z?(ojrCq{ZdiacRepC;`)sLT@|i+Lq0>P^PyD;wQK&rLg_p!G2!P&4fC*}xFJQpc@>wgc)sU}d-o_z z?RgajqY?Ntohi4$>U0LjZo&WK$?lUM{vUVp`SfY$Cvb(Q2SR}09G9QCo=-Viya_r0Kka<^QsJd4 zosTi+ZY*b-Du}0EQRQlqogh$E5(_U{1-0y@IKS7Wlc`Yp)PI%^M<%xepE(N*J@9x> ze8tm#G8*BJpjyisL!mFe%i*}Z)Cyl0-$*ll)gi+wDoq>xvdY8r&Yz=1u6^AE%UY2h;T&{XpuXIO1xgE$x)P_za z*5tFCbp?PFKrwhV+A_@YA~tsMC`G1znIcq|DJ`%R#siwQbYG1A;Q8{CYK${QglwhW zlUS0K)3I7lR~}$YaL7iW`gdCUJFVtgll`tjW@Xe)$NhzII&(K(8AjYxF0 zQeS6xTd5N%Z>mt`Gx(51ENzx!&)JHUUHsZ`W{*i<`p+XKX*{T;c7b&t2#2!L$w(-v z@d8!#T6jEw`2xBNG}cf>`E3h;5EK3 z9J%2TH+TH9+{$36=I4U(l0;K^0F|ZRqFE1(bTap>mWzJxn=9_iml_ALCP5TqRgGMt znbq?W$cmJP6;LmV5d{IJtQ14Ka9@;_2m<#*bbW*=<9Ok<4Pr+hQcO9O2cRl6233%2 z={eso`DoK8TT&NUO-cVDFrbpv@d!i&Y#E)F-qvTC@~aP*tRa>1)rZTBHEUgu_hEjt z)`sbf-m*kLfe+)=y0BvTEYX7uPQ6kWW?+^jdJvKE=64|d7F0Jn08ABBjm#pTs(Q>5 zrE_|WdY|3>0v5fYQJB@Tme5}j?)gvMHIOJkLo8G&H;M|d;QY7ysL`;`f4j{` zyFbo;q3>iYNuDsTy&b)s4REk~A$|Vl{1EAt$^`Zd1kknV1D!0jlim_X} zHf!q{jiC^0b%4JpFeyrJTfB9EbhJDA(0S+lfX&IOdP1Y@i&k4vYq0zhFF(@C@D zp+b}4d*m?{U{uyRr@}4{fP4I`#DzaBt~Z2(9rRcN18pw*PjR9W*Hzm8V}zK{q6@1$ z)r{0D20?T!uMnqG$UAyB79nW>4o4CA48{b-K-r+at7Jl9wbgE)o}Ub=;@L9rS8BCd zWz8gS(y2ab%{f+y6V;6tiox+Wf!>ghnL%cn$ZV72v~*_G5o(+i(Wg=MSM%?${mkG0 z^?~8*q5;j{|M&NIAMfS$zfYbtf9(Hv@%gLv|BU77NCX+D19O>{vW@qq%Pr6!+xv3t zR_`(QRu1>mKDl_)84P~A=ym>e-sul6UUyoDo!&*i`#&8yFAn{KJ3^4DRpUcBG_qOC zo({YHL9hGbe9%2Tu^M;ezqVVG+KGaa;dI#f$ohC3;&A-t`jVa#EX%h~E>2%ubbcLN z^t-Q4x+kwL-u&{me{tUHy83lDWDP(z*y>*ldaaZG*=cWZ(K_n3`en@x2n>a-Wh=mt zy4o@aH@B&5WRAA(@l~#(548H)@&<}43_QXfpt35sM68qp8MeFSBsM~IF+Pi4? zI)|N;LAP~Of^}Kh3}QnNUwIe?xd~9MpY=}PblQW997@eqlk*>1h|iT!lgG@hx)`-j zE)>}Pv)0K;r+3jk=?_{b?apHO3ywsEwUKN3ur+ACX!VzGI&&7vFO_*dL(5IT9AYkX zatE$Q?URdsr`_ueQl!aWKX-b4PUmw_Hpj)MFeA=Bj$0?KSDoI)S*zbad);gG%lC`9 zo+Qil#<%^8vtH+A_tzCb%6th5y|hnHUUpxtj<-2p9Lx2w3?%csB1(z6+%>|YZI0o8 z9bFv0xH#;#jyml@IX;cJefhetPx}ihzK&?27T-7L*E)*`D^i54Ek(b1we?-0S?j#t z>CLYt0(j(V4Z6pj|2aKb(4P+6XVvBl;+NCj;l<1D(cJo0sJtA_v<_QmgWSMNJ#TU= zXJK8Nf#rIBd;X%+JLwEMeSz@)S*zVClh8|+?$O`MeMcOuR9lm z-_FV#$Sw~H0tg-nL-!ob6tg^}-5s8`&yPDNgNy#)w5R(OF-kPo2`HLhx@44vxFU1J zC4Po!wcqwyFJ5#97yaK(+85oEL8td~>!|z);|w?8M9KW>=Ol2A;=H#^-@I}WE)!>t zCOyc~AO=;iHD|i`*PaAYYRd%iJp@%5@gVK`GYBK&$Za9_@btLVb)MEnAN;UDfUWbv z>x+J;_j9Lr@uJm!+c`N*2fbB#5ou&0Qom$kC1cpt#pBl9x6aNkj!s{_>h$_b%eqvr zaeNew$B2k@8=ut$rudp#+0_ERTuPnsGNPudiT})rG{ZN<{FOGmTO#r4`Y6~ zrRHe(!wbrvmXE=#sC&-UbM+_lFPNRlC*>WbHFPgV1y>I+@i8laB%aPAO`}pqpt_FH z4;4$T0xXuel0iYXIURL5_ivqbHHR=+S~+*HTJ?04)-n#UzrQz+Ll}d2(LFi5=$>7) z4i9^se!tT%-!n@>!xs17to3ENkOkc`Oen>GIp6Z(1&nd|q?;A>oagGzop|GTJf8|w z0F)9cPy+5MC^8#d3Pn;x&Y?&=T!12@Vu~WW-byIqXZ9_JOoi#o4}RE7Jqp1?u;tdD zQ5F$6M(qGnT8~L|h52C<5m2>F72!3lp&@na)XE!)VicmGXhAroRv#)Q+tCZLE=rb! z^nP^9Vn$f)qKsFn$uhCFv=y4L-&)xKO`n{TG_V04xdsj}1-u779$9(5P^ba`q=+~= zY@N*&1a*b^BB0fb=H49l(UUMo0GdXX+7TUpi zcs7GW8hl7seR1A?+Zim@$vA>lJ6h|W9Cm)aI5|JQ=yim~d2x%m2*8draSG);WriK^ zwph8{=?&&9B?=*}=L}^zHHR~B?wnTp=VzVXa!_W$SLZad>M)&QSLdHS-*$ex=$#Ja z&BDvmUb}MuswyvFu|WHEr~UQ-RQDb?8m{-*$+f!wR2As=kJRM#PLGx5qJIFYGHYL6 zA<^od7^<@T4XknK5$jJU2-cPpI|)T(hhm0yL_CijF5hCxu(#Ao&0?YEIp)$lCFKw+ z?Ezvoz&#mtF^x|TWn=)!Ak(-MA)F$GwvM>S8x(bm^I7YcFW}y%Pe5B+fT|Z7Ez#oR-c``-4}#PJce9b_dj4s@+xb z;0i0cR7Z0){O+i%%Kd#%o55)F*DASQmczOSOVA8XP6wcSe0J11 z?wkxdg-aQcO+59%7miRtkcO)jE{!_;r&jd#TNj;^){CRgoV%(lZA}4%;@a-CH(1z6 zE@;$T6{%*LAG7$?1)Xufb$qn2QzN|0e4b|?xU&m>&ez)~ix2dLJT-HV^nw#D-*%Rv z$HiM$aqbZ#5kKb&x;pew0SH-juEsr$p;S`&oQqZcMSY9dLM1J5F-GiALjOO%AuGaE zS$itR*2Syd>3R9>P%&=ST+<5|L38;hDo}DJZe~y^%FaoE@(8C9n7vw}YttJjTSM*c zv2zW%Ditp2c;&O+>7dgVYvuU#aLzTQho@&GVls-zapXHL{djwMRgP;wndYWcal^~m z%2GU?rz#btGexN?{6h`?Z=(iZtb&{8z?ahS%kJUn?jjIM_R-pTw*utXi}S9q&vagIuI0{9Bsmmk-yMP|yK3&dzrLh% z?+G$B_1V$+tL_OuaBG;hh0~>tkb=v|RWr5AWdXfVxltohk7ozqb4^$@ix^8rJUcv< zAv*;J-d5S|L`n4~h{j_ajw|9BpDPt^=Q()r_bo_0hNtKu1vT*ZEq)e#_*8xuGb$cD zk`JbcQaDBr=>y#oZ?-;!6npYuxFuVDo^`SfL^IEI;qJ-H(}!twM8Na3oiSo^k!)32 zKx--N)rS@3(vwgts=e~#0GCfG7~?A$6xvqx+Cac2vcu<47-p|w;rk@1YLLm z2G14N>g|Z2pPQ{1Z>dgwGy*YX-sB=87c#us&1=f2)dK!CsBxuzFluu=#rD6sPyn4tyQg7 z&p0lO%NgcgF*@ArVTS7jJ7Nw&%!C=zZ-X}MwK&oTo1xhYF23I!tiowNcn3!REKjuC@` z_MVGnYBgC`RrsIug_BJYw<^w>x$Aeb^u_pvcz7b4N}*E14C7S{ z5CBR85q?wb372Rlr4(Z@)X5|%4aAVZbHMi+>p5>F_gKV{QshSv^c}>v5VTykH*8NZ zr{5pwh93M;XkQNh>zltsvj=}8El7SNT)loOK$Y?o+ubJ%hXULs@1Ljlcg8k*M=5|ORyNo2(^ zj)+(@*N|qJnsrt=eJa8ua3SdA;)3t()r$+h{4Xx5SwE5=RLcEtP50ZpS8VQvlCL_c zRaw~^_lL{v-1B}C`;ehvh-34xfA2qb5=wT4INU+u6^LhS5`}v@T=q{j;6=VjO_8us z?J0kvC4zI&o;Y}P&vfigei{Z@0Q-bRQ^>FfgJ34>rJM8Dc!`S!R&f*urpTeR7BuoM zk)_9os7tG1JYsl?Dhrhh64A9_Si^DE)J4=OVnV&ORn%5^6Qi*{BM44k!_W^9Q75(0 zlo=&t+-HW!)&o*ai>aKOQ{fvi8Vko1^+Q z!3=Gs!?q=4PM-k|g(JIYuPCYO7I-lei(EVrRkniR1@wKg4g836Py?knz6fNTv)?nh zPgHU|hnVs+u%Kp6hP+LIu(bU~`dyQWY*ECv)T4)XPdMhisCRZx(DwyCz;j;eAD{}V;2#PlR>2H@Jt|%GVL^J$%FYp6 z3n$R)2`4CiS}RVcLMC_)B3f5jfjG9es>&#}x(%w;;z3LT;;1HlSa>ZTO(XOXPU8U8 zbyf^VOB|*PLGsTF2^NfonJz5sMFtjmbO zyUPJ7Xz)^XbuX}01rnu#atcq&+tCBpR8ke9jRT>01OgOp@v;xWe>@jI^32Wr82nFw zvRKhj{e@tWI4?xk2G4Sg1(Y!=KC{s0>sl5s{9~l&GF0j5)4ayKFv>J*m(`?7 zRupz}s9cS*!CJkw` zOw+v4_cY42y!_BCHK+b~TIRDy_7!d3aS${c3$m>mg{xt{uoR2!6sRIgYp0u@GZhxM zH`d|-s2ZzBuG}o&B>3{>pzxYOzGSNAwN^qfo3*2mp^p}vBnex>qv8NG8;wT(%}EsY zqKK(PZTb}ougo?CAJ0LPCg?C%XLHwtuDqg|8KbE%LROHIttp2O**GD$CI#$DOiSBU4Lmw&uo&HPN1fx|lj9 z>sCHnp-MmAWJC#Z2|`5Mc3gpRIm(I3MhwjR{R_RpI2 zQ`~XUiCx6AetypBigI#unt9VU)wVu@Q)$+KLPlnBghN)R6P36Vfm)VswB}=CE}pCh zGe@cEvsJ5^8A%sZO%sH=Y$nXvN?rSxg(a1J^DX7sxNJyYF{E|I>V&&;PmGXzu;c|J=#vF7-cB)ng{NSUNq%S0;Wj^I7~*8Ld-gR7k3!GPlS{ zqBF|S^guaisDv#CWk^5JiA3)KF{79Q4^jju3MuALSnQ|Rnf?1S+YfL910XzkNl5!^7+g2KS^!p zjf~Ipw>m#q{MuN&aGC|uwYWkV!QuE&&5osRPYu&QDb-7L5>Y1RXo+~=+Nq){&IM$4 z;YEI~qI%P|qlTmvDdVi)sv#aZJHc$0YaFwgtEBMJzlg8x($EYC=Bg%wSmbN*hx00l zoZ5w2;_19F8zIPZH2n}< z#EMYoWh(K9W=Kr%84MrqqtMH{#AMfF%Mpi>=KbNabyRdn@Nj)pb=E4TDXs(ye^7|IeWcgf&muR+J zhiL2c(n%27c2wPa{%n&EY?7p5Eju~2Shp``eow@mW0JBLQo zqUPerI+?RHiZz#86=prhg2?)wvmEBNanqF`!Ul`9fw#0ESQ?l3$9h=*dN9yikDI#- zDaW4fA|CD_mk_71d!QYK6#Iw(f~L_G4##O^#Sxc+)ibS81T0b!k?LSD!4zOBQ)`GM z8^f8reC|J^5z zANT)v@lmX_kPpz(p$j$Id`p2}e+92^0Jtnn z4+@Ty)5*>xiY}`MASS4$sG|73c8&0O!m0>Ed24R z2VjUs5kWQaPT29{C|r8~TiYovWoUtqM+e~ZKg7uW@Bnz>bLvgdRC+ec1Pvnb^#Nc} zTzn`p8YM&Fb6I>#lcCX?7ajoPCuEG^VZy{hpa)9`9(qz*_h?? zIEN@MO00q?>3{NXfvP7tRPl|#jVBlaEUZ697!kdQ(r)VD7|y^DfoT#jTob|a0l1zZ zV&hSy$YIx!l&rQvfG?5A?G*~yi%W(hOem}I_r>-2y`uSP4$Y?ok8$WmH0M})BNtMK z$E6McQyD?-_Pm%up4lGYV;To=2I7Ro5k=IX@XbN!vm8SE!Y|pm&mBe(70xy~(Fty8m z|LE8=(D4#pVJ`~1(*iaWbqMPM3eI~+d{vEP@y)@7DPF%;4q!PvOc2nnVLBdy=v-!8 zmHFyJZ-eN=l)t-i%lAp{bb1D$?-NAnzXv`{G5ZKob{_jSLXM*lvxra-Kq`~Bq}g2& z5m}GmP-YPEqA)}r<6lLQsjMjsX2i~3lw7|5BW%+YzK^1DCHjf zvjWnH8&6apen%Nj#L0}WJy{WuDA*ikwc9A7<`sz@*b#?(MKlpVItle+iZhI;p@`+* zL>vsjCXfMvL#Zf;3BJMs^2ZAfVBf47)|8Y_V|JRb+?xAkf*Ara6lIUb6MVmupra*m4#%B`L<8e-wfF_ zsCnM&=8)7nJ_1dU5NsXUHwOieawyn!qhNP~QD92XeGgAN@@C$B^zOI2$06Ety z2f1@0=GNGVDHQi<(D@i+GIP*|u<-{y6iC@_f@8xD3~$g`eAg6(`y!ir4jnS_yAnr) zyt1918Ky9tnR;YYybSzq5o3zGg9)0Vb`(U!y@G;h%%w6oMjJ{dd!~eYP68VZq7SWt z0O!4<&4F7BsyIxhHqgKJx&YV0WIEiS8@oL%WKI!>>vZ(p94Yop39&VO9nqXz45vb) zxH(g0N_y=8;%QMHK39DDy(3*-YraXm(m3JEmj7-d=FZiBLwa5<&Yq~m&*`f zzy1E9-*-aa`55PEKp65Wb8hr8#>8<_|Ni&&{YN=`6cm3MDHyN5e>yPLeeEb59nL}r z+=sJJIIC<9+)r|FcL<4yYeSbWHVpcwIq3TgGVD2^moGL9`e!-le?h~yXy%&yU(gWn zSDOI2Kt{iXfJY4*0StQ1eb0XL{ezuq1dLMOKPsM;prRAHMAbYhj8fk{DjqlTsOaNyi2Q|wA&YGuZ9F#30J|Y( z7&3GejdAEcxa%T7l-Z~w{9{wNdvkqB-57ZD%UilxaPQ^dE&+OT08Vvw*Q|#=IKdqN zo^{EO@eKQ8Z-|x*qZ|L0;($QwC%~pi6Gn ze4Dqh^Kr46@ISKPA7jd-^>fSf5T%1l*IlGp4#q_C{LbP*!XZdeBZ}ox6Y%7K7iBVd(g+@jZ$_zd0N0hC-mmypc8tVg@b1<9Jn=s zCJr`93;48Q`~>1s*LiB^MgpO}glK zx@S2Wy0@sXS9f}5*;bsMrerC#a;$q*ABOEfm3XTz*L@r&Iyxo@tg?I<-qTfGOcFVC+ zdgv`;Wz&wo&-SwQ;pPe)2OGr^OugVBD!I`goc1?LFnDIli6V@KEAM~=UA_h8>u>XT z_skUk&Zp3E(mC&S0YM`~Q0R$}l~R|dV-ZE06C>c6Df*pLa(LpH+jB}l_Trn59`H;_ za$6}>UH<`ikjTFei|{2BkxjBsefG?r)NVMMYqH4aw;PT&(`K>RXp~{Yt*b0xW0Mq? z&4wxGbv`lzO-CBjWj@WUv!P*dnhjI96LRh*3G~f|7Sf=%Ir~+!v7d7lD~b4E(d=eL zd}uZ-*I4BwHNaCu8Jy;%aqDiDZDt6NX5+EV)Xq0(GjBFb5$$wv)`s3BA1YIZn1?c! z+v(s8un5EiU7?Tx2qw_GLc0Lq?HHz|b^~h$M+i6mE{mb~DX_k`$0} z9^wxPGLjc<5Y)|Fng+*~xls|-npVz|!y%XNY?x&p6VN?86WV+}=bn}pHd5ZT(w20+ zC@jQ&6l8$CCd4^DItS>~AEWK)GDD?`U|5-=<> zmHI8lio52wwJBKnHHvYB%_kc$Py0DwyMEzDT0Y*W`{<^X7(@CT^^zbr)yfyie6azL z=k9MMkbRFFh6NMGSRz1P+k(R)fBIJMFq?LE3%CF6W_jK=ckLK>Nyzd^$s8}f(MV8D zE9FEhcG$=m55NDpvvNutqATnn^X9>Q$2h;-1|X$bK+0P*dksTBV*Z?%_7SQk- z(uw=x&i(#dUFBAy3TFh6O$z?e+_Sx7Ke)oZS&ugWgRYMX5 z!4!qey>i{}HvkEyBzBh2iE}sSF93|=Kwlz!M+S3ED~E&v(Y<9Cz}(Q|zm;8r11*>L z9HjW7z^3A3zflqwpokI6;$*V~x_#U6l|~8ia-8sWL>Y)-cGzF8n1<ER8Us3?N<>Tu-oP%cf(*fS(X$@Q6Ml zFWD@q%t{;4pE8Hg-aj6kZK_cE$P~x=LhLZvze0c%M+EVVB2GY9#&p;qJXl_;*t>Kl z&0^Mz4S?E866-O1^^M1sX+ARLu9ok+5_f&S)A1ZJ3a1B}L#M{#;^q{T*_c$9dzcml2slwpokNGPIgR zA=)%P`q&1LMH{rcTd54rNHoF$I`18A5P()B+GvyPMy$L811@@Q4s1_yK`A!MHuZ_^ zY#2rakFa+}&2HAFTN=fmM0vyP&623o!2J|?1hG~~uk$Vzeenj^uQmYkT?_JmC5W=Z zZl_?+zuW-mt;qh-h?VJ}zE9}1^u`DbDRyk*gW`(~09(s&8x^Y~4bGpCOd z5KmXfO%|>-#NK6SVJ3TG#H+PSEI_lA>pKe-aTk zfuRq+5g+gMBO;B=A4^?s?zko&f*6hwIPV>4()eZ$FSme@X1aP}?6HLK#S>2=7B%y0 zCdG~{_wRxrE%{xeA;tOg%`a#usU;#{7)0ZL7o=!`5KSQtente3a6X&qfFuZDi3(KX zwd&!3H6iDxe8;yPNd$)hefBk>| z&;QGR{{epc?YG}*$H%q9LogB-%HNdI;T914IOXAgMj^uCD0%=MFg!*4XP%Ao5d!`K z_>jRNq$tC%2;rH@LNaQTC|n0GBLdJzIE@3e4LS*lVzhGx38tKATT?`^2X~GldeI8U zDEKB!6K?_4nIIlS9$%@csClG*+t`**7m+l0(LURM0)FqkY(ILu|M-toVF(!f7DDOY z0wT5kG@e8uI!UHOL>BKOqA&jv@mo0)cER;H4mfw@xHF;|Dhj%W6a-Hf(3rapz+(G<*_3zA133qa2|k@+FJF6$~)PVb+`2 zY&MhfEboaZ3K-5IN<|80@*T&|5CJ-gu0s%of&$OKg`7{ffEvqoG4hiDopHH=u$he^ z`3}Unm*2hOZnuzb!VN!vvx(4KKDLO`qI;F=%?1Ge*p9wNSn+C9Jl@nh(cOma`QaDg z?}Yy5LjTk@+9ud5m<7qln`IcZYo&`Q20A+Z^;?kx)&y^w4Z??P(?M-oTbYmA6Bq<2 z9HRo@XK&jbkuwQ+`7#@T2QBY;lOS*Nv+=O+nXn({Q)0Nm2h+_;>bq;@gUBa{8#RUS_xXI48u4u(___MUIynFvD7qqcn6z zY!WF!9N|>HUx+Q!PDp9zV_Xzp`3unb7z-J8-X#Ut%I+f`ev20p>q6VJeE8*VDD*%_ z(HMt$yI}DK1pF260!?E^fyZlY4k1~oA-cz{v!Xyem|!a8M4`Vnb(3%yB@E1>gaAB+ zG4P~XW|Qm+cddjGKTDlq!K!i*iZT^rv4sslk*QrgJL?{nIT(O5h~;HRS6q7nTb;K- z7}?A1$K|`yChfykq6(42vly&NJl@b~O}kdcilb;O^UCBM{`Ka}CV)i%ePoD)FyI@_ z{`=kf$LZ#ny6#$uEV`i=2qiu3hFyPf>2k#4Wuzvbe+OM380EfE>D$U7JqRw@j}NN)12N8dlVX(|j@xGdQ;NbMWu z5kYh^xD1c*D4#nGkAw*gk!55~;Q}7MtpKyTR@#cpLG~4aAGCP#c7Uy!Q|y1o_9-t&YkVES5H;5Y&J!tge6faV()os3sDMNG@sm z=3vW8b#Xd4llucLN7Ne{g^oPSr-L(<6ol46JDSEabS5M-j!G46@*JB(-5eZRkqe_C z4$w`}I2E<$U{V#>L@b&TsP9sf`5UDovr=rd5;lnl{uBA91dnm(+Ox7UAXjJukYQa? zGZKYk4zA30TE2>QU$#Ie97V(vYXqniu$*gu8_u!oLXVbD*=6`5^xLkyOnip|H88jg z!3!MvI2?nn4_-sMImvl;tz;tSVSvL+kW$C}_%{Zxb=w3b2|u`dEwd#{W!vT>7#%t;d5Zt1Nn*@ zfUu$9lnfLUI^m?{dlm7$3ySqE5Apj|eH-!C~mnM+PfQqczC!<1GJBd^aQ z;xJS$d%FP$NTc{9Y|=v?@;U*@S_%4)Ao^V-xR+;#wmdtO0lr_i)LhCFp{V-kpPzv( zz@j*flGPvd&fA0YUh7CbI6m(Wz?OMrNy{F$egj+LBBASp`@rRWsUGv4J}q-jN!L#s zDS_MQZ$-#+W`0J1rFB8uqT*(SAzw%^_kjoQ10T~kfU^@gMc_Ud<0}-Z@8ZrJhH#Ah zQ!<7j{!=hss$QMO>@;EempVM&2RKZo;64y>8t;QCnhp^;9fA8GQYAB2lQ+K%G@d#3 z_)dVQh%z{h)pKQ;pgJ6!Nyh~F^9WMLk20c?dM4BF>K`I#m2OE5=zT7MXx33W&pJh= zMnRU+(RiX#Aev8<2Z8bE=ai7Fq;wh)X%e^W0gLpAvLs>ZK`#n)L6L+iqsqZd<13fs zDF0L@1yWD#Bs#j+%uNy82WCPNKACBFXmB6sh{)-1(_p~7q6+bPKMnGFAE>ye;6AW| zeR86c@htCyG@v864|D`Va39DBdAzY=j5lyU4Ni6+q%ph15R`q(f$_=h0Gzi47Bcrd0!NTML%G$`ah zMS9A)Pb2lLd#Jv?O44&h2BJn!;reKkXdIZOcI&6mNE+UAMB?#bk zM47SA@Fj8{`_5@TC1bT~9*>z`n;xDjZMQ=b=ucU!rbzsxLFZ$P$t=IH1xqABMj4t0 zIO9Cd`1j$EKgee7XN;~9ksgNGQ`_TEQm<5Gw8s1E_?Tq^6@QW|AT9ii z2mKjkXj-h7{Srim zH`?{^RPt1#P(MnDhtz{?qe@7av9!)d-GquwseWb7^0!A5PjZ1YdWa&{Lm$@4kQ6sR z%mgSUb7e{CZVy8Ha*mPNTFKrbbbPCTSiw7jOe4O2IPAr2EQD4Zn@f+2>|II|buQ2k zRg$gzgU-iT6hngCeH0iavh~-FLIyou`w)#<9+6(d*`s6lv6adr!VxbUmGG?YgkBHP zxD|{YPdlM!KJDXii2Pjf5Ho(77pIDBY;UeFsr}24BC;1!+&6#A<8;Cd=iqet7oTJ@ zPHK*mzWZ=Gd@nButVf;Db3Do*?V%554<8at5Z_OY13t%q$;_e{nLJiM&uMcE#_7Og zKM@p{H7jO8Ug(JZT_3X??<^<>k%9ODNob~NQ783oI4aD#^*BRD=OZJ~*!=T;+lD-( zCIC<8sYVJxwNfg|IsB)XHvMQdS!*lYjG_{AFyeO~Q9XOQpr0yN3g+}&;MJznx{PK2 znty1a+%g3-#H38Im<^EO5rP-R_XY{ibFZtgC%SfK1Ku~^c+LMuHkr#C{k$E=%; zyi?k`RgQ;fq!;Nt;mhFOqIgbpN?(z~FlDH*ia?>cr2gVXp%m5MtDM4u(V2Di6lXmC z_AuNm4KlM<9X1t`N=}B!?_o|}aZbtM3AiuZ=uCbgmPyJ_sr9?yg{~26tfTB(q4Y6K z_rdTg3a%uVq()~#6urGk*|oDy_Yf5V@GZ++nJ(zPOBt^QWA14VMMtK?NGV=4 zk&Ak3 z;V7!X(wQ@!sgA{g_BiOA@vlZl1YUpl`NM7(z-$r^T_GR|w9CLV9hhXi8RD(~lyZvQ^-Aera-?+qXJJJK~+(NP7KOsV3|kmazhT8O&BGcGQrf_&-? z??Q4uQo=HllT$LfJ=-?(Tp+AdkbgRSe>==pEKGBG-ukh}j@`P}gRKSD?Ezp)l5ISM zYZfI_`+r06k}9QK`u;m1$~`+TA-g^PAZZf1F9co%Nm2&Rr%yG2LLYqjVtoDEkIy&v z83#$S<4qu8bVo+9-C<}N2aqAUlTbuzo=}I>PBoi@%LVBmZ}A z?@{A#&Hd)1z5V8+-M!}D8oSNLlik08#%%zc|0I+_^0&rU_mv0kJNbP21n>ydrD$6p z2hk7)^@NfRpKfWK&lmAMaD+V+QUn+xQwm_{11}1FES*wD5dnf7w1X(|!3h+eARYPo zpmGmP7>nt_&d&AqbsffBw5>;Eyc5Vq>CREN-8t!ZYPbcvM5Zv{m20({n_{G)?=g&j5Y1f> z%?;@!n@BgEEJ+?kvMZ&Fl{g81*5qNj3E+Iz#<@L9b8XP2!;s`M7Z1-dY5pFXuWa| zh&+BYiQ|Yc3g`p{0pJ`ROd<0oI2>;Sf&wZ2#gI*m=P>ju_dtlo@~&ws7GAQ*2iKTQ zz<)ffgVQjWfhZI;`H(=22ncY9>XrIo|3Y}=RPKRxG@V8v__^H&J|?tMA7i#7{*}Y8 z)Q5kP9r3SzFd6UgfAmj!74BpW4WW0L#9)L2L@Phl>2+NBsXm04m7nTt8drY$zbp5^ z&ye6Kp`d%%p_O_}B7WMf)Ul7?jx0x__Z1e<3z@Z(MWi0jz5}k~SpU6F>+rZ!pZe?S zWB&Tz+iNuTa_fJ8clXEozmv~BC8ty>|M7b&D?O?=>dim4^q~z;$8|cvDDY_=M>|94 zkI{}QToYw$Mn+E<{BO!;0eU_PAgj?22_)zt_>bQQLI8kq94M{sf)053no)e2K3Z{X z0nu2{M^;|I(OB3=rP4N2{eW28iOVxEMJ$QM;TQ}5kigCiq`ckr>3M|5Ab>MoSx5R4 zhiHn3%yUqw{Pff7Xo_MuMh8Fr1pb!>hOb(2fc7JgieEKe36UM)o{mBf@zu;A4!N`{ zx}rP(RjJ&&2aX|DFKDIm83?)dGmws%pTRi^z~{pER#Pj250;f~xgVr$d z;cSK`;IrNk{#y?Vd`=JiW6UPWuci=Nx! zz%>p6Fhsm9U0L< zxcWs6Xo|zsNBA?4QGWPnsslt>b9e9mXYb$p;>MNyas2bQABD!u?j%|4zCc4x&(7?R z1!jhsKv*Di&e{CtMclT!+re!+mJR6>*vI~T>0(=wcY zL#J%bT)c{~oN)lWU_z=1NKNmKOhV9hE6C(R=JU78RyoBII$mW7kq?Z(o zivRX=93?2Gi`cJpt3oCU2_T9I$58??QCfiHn^~c0`{Y8J%{GpYlf8?hKMyZY56{kz z&Myv6_75pfBv=eS^qJs8G0%rh@Zs$6;OP8=34#cGI6ApJK0JPV_RkMyI+e+WR8FnzZFj8CxDAZK1CyotQhP)G10P;-V&&q;K&EFi#O+Kt76=@E&_fKllX;hgja;}CPuN?y7RyP5?{>z*8S(7 zC!X#9Z}`vtpa1>O{>ioT_d)l6`qSxX=6Dx>|Fb*l{w?|6{|SDg3whr6oN%$IGjcp< z^x43Z){G#4z8&B_S%Prgxb)68%R&};50UX32MIZCfq9Tb+$g_0!b?d)=>H7Pf*=N5 zkgogo%aQNE&nL<33=+XfwBBU1+0DK*8c>Mf9g{qWXtP{gFkgyK$!!C!71B>H7K+l` ze&E2oUjiS32`P_fx8*B~q;=vBvtlrV7T&y$sMU((c_OjDkE6@91P7N7qA5W49`jx=GiopJgxM-UgXV=^;fDiKU&P4939+OIDD zpkwIMugvw4>(J(8XKlJJrPYz%W(Q5u<&HaX<4y8s5{59cF?Sw}V;Iq=UT}li$sd!Y z2){w|*(mT-yEwT^N>&qkYz+KyzM@>FoMua^$1N?mVR;`e++`{4h6_!`OL+s&lMqIP zw$M7VSI%0HbBu6y%Ipi0=Oz8YZA8g$mnlx1gpg!97Zx>*%<76x&v|Fda}kFpZO?q9T0Hqbm8pc`rw!UIXFr65O^j+ zmw?bkaE4_`5Yf1uyy&GovgwqD?Zl#Vgtwvu?Ij{w9rlV_By){cCNj$VtMHX)XQ0w? zzJCYF>>LDkf;WWZ&Zwxg_DNk0 z07ildQF3TwIy^9fUf@sgzF>`qA^w=jj?H-0I-N#%!c{EoI9Et>WvBDn^Y{hZFJ>oG zrl%wjh`s|HnEiCD*aG7yn31k3q4${GbWUf~9!30I!G6E2($MmK7#&!#MfT9r)FegI z?x9&hnim`$EVM=-TE4XT^!1UCV#~MHoD_=YA1qN3%7ya14F6>lWnkhe1WbWkt!(|6 zmAE8yFWqvHs^TG&rp3CeC8wg|+V(WwF%*c`ZWjt|%l1Y&EoL!<${Aa*$>lqRoc?Km z;z6L8d(2?AF&t{49l9Qd*xpGyStkV5~_Gp9Vw?!jAZZ?XA8vcv&}wBxfzb;vT7dV&p^Q z77ti?zVo?nAK@(=HHTxoZgq)5B72c4&*-iK&3zlZNR{_-0JgeaEcyc9K`*O1rm!cT z#&J08aNqLqb@z2wZc4VrOd=2Oo|t+z)x@Ve>SDz(j^}3-ZR0m+IWRhR{{{0_zV7{v zjtI^NrX&YIIE(9p(Hw7E*~J|}E~XdCg<9S?R#<3Q5JKPiIPC3g?Wm=~vGw`Pnw`SP zhO+G39hkHWD9iw!agbc`{cc@bAfPw2#y|cs#5DGf84YU!3zd*9N)W{rS6u&1@&D-c zR-A4pI}Ev-R8A%*xqU8Hkc&{<4aZg((pGTIVZ%eU^dYp}@tp2$$PPF^oZt;5(a60y z*gFL;@HsOWr-Mr{4Wmt94~Sb zN#}1soMkh?+mK$KKOkepQ`-5(-pRqy!s3K^S$FY2C*l_rz~j2Nd(c4;N20JK|k39Ft!z>$tK}mm$Ub{j%6lG zB>SUZz!tlr{sOjyNPb($`a*TZ$XzM2wv!9TX+RB$#hb({I7h56irrAwQce?fGj;7L zu>;C25ENbT$vYSwxRyt)fjFLLbM%Ssg3tfwO}_1RXkHV1AQ|YY5>CjUO5(-+_iT(}vb);bTssb7H;en74ce7ht-JL>dybzU?zHn#oUs$FK zOuW0;FY*wxtR<9Gn_yK_@P?tZIW;E|Op%^Q&?iqkjNm%NgGM?{^QTcTQ>mcOKY7kb zxH(YrCgrJ6K?%G7*Z)XWh!!fTU1)Wo?$kW;n0YuA=S=<;sXlpcwC6aHVr%dwu$+$1DBrXh+aCoNS)w)7k8DK_;EBRv9!eLbDrvl@p}SJ-pHQK@tMto z+TbtMp*nurk!h*auBXsMsZ^NT|3GFS%axGLUI_(iNSpQ!JLM7`0*!SML?A&4KKL|h z;yCd}?5@=<%h5n&((y z_5CrO(d6hMDTmxKcpF0BKloix+=lt-fYvc{Cz(+sH>q@bqH^>h*`;jiS-t}+wkW)u zKGZ$O9qar{H`0fC$A(7sNGJ1i{}8ux{{$Ro^&x1dR=YVDCS3H;$F+d0VEcy>MFr>5 zb^td5SCCV}3yHz*n;eKw#W-`|^ZiFWX`t_z;GBLL&|%tdQVsztf&kOr%&%_#<0A_E z%~WCgAJ%mgY=T^Y#a`o`5D}&1w^`aAS6a5jekV6RBzzT~=jn29c^=&Mj^D3#DYmHHSI7FJAhCmU(e|~Y5`hOlGa%$ zd`#_NkLg<_fwUPlm9uQ6r5iCI5J4oyySPjE2i+dT)EKv+RFqt+D@7yA1O0218uPLP zwh6AS$i?ePZ%7S$djfTo9s??zYe@)29NPZpeVso*Bg8?nsY|~tQ2C!h(5}P zRM$3wz=~r$`<;}9Y=eZjDi^Pz^$ek3ngtYi38?C2-7Vn(b=UA>&znV{SqtU~jJ{^c4wM=f19S+^bAy=F{v$PmBZ{+ga<%dUBAPpJ zbZ`pBiEq<&(~ak*HVtNQ2x`6kG}p$})q4ewDM*Lu+JSZj=XeW*hMGa@$Ny#gYWU2X zHSGt^t?mbHmU~3vvgD*UEI2i0aYBkNkQx9<|`t&gKneJuO`YS)6laVv)&BbBcI*E9mlDg;2y`oF!qJ&@P`tv3GKdeS-r zyKMl&xW5P?RPxO^F8Eszx&OkudhaxF@CF*$mIotk8j>hOOoK86ag;y}fSKzv#|<%suF80K`@_f${$7yLYjh8f51e^g}SfnFuE{5*(d)S5y~DwW0{dxJp`V2;Tpd zQaZOS5AW=Wa?*uJ17HNF*0mc%L-6H}HoSOtBOY(12Q7`A*M?~=jShb#bK!)BB_Jt6 z*eTMh;G&EkEuw5*u7A}sjqMQVx-ugRVv#9?2}PoN%o~aZVme)XMapWHL_JZtT*5*J43lpUZe>zlPvF_=|mW z?9QBd?67NRQ;WE-fMk@kGFqnCz`aOSD>Td*{RlH940&dU3I2Mz-C3SR(6o@pR53y` z9=oK!sLDhloa#pENDKKS;%xS1Q$Tis8$Ge}TP*~5XVxe>G+x3s;sg)F|ES?s76%?%FBv6kOagGs z>Fad$Ur#g-O%5$G1Yf{ifr+OO2}M&za3TCw?Egyl|M{`*atgf=M#zlA<&FY%@t=3( z_<#NGpg(B$|LaI!zI0xJYj-vzmqKILgZP~O(+qcuJ%vN?szc&vc3x?RpF_OYj3psT zCXcDHdk#KgM<7rXVnawuSd$D3}RR5=f)R zB!U>d$;6wQbTxDlcrluj4mmhE$9eHq9&e*wn%dDAFs(Z!!WK@%H2dV4LX{e?z)Njn=!!WGnkyn1tNu;twZ{X=3H!-m>q9im|#;CRz2;Ht}6f|7HqLa7(uS zmJNaaA3D%4^(DS6g8sllW>TSB!)+Si7?ZHVur$DO78qHvVwm9WPMbn+W}+z-Q-qAV z26acwMg-UwI7|lhV z(&Jjy+@kK$>;O!9-vQ+0T{9>Nib&XMon>kgeVGfko`=e2F_<+#5A#CAZYBChJ^!5k zpg}8W?u8q}MF=l#%r8+eqo)Cy`wuujgX1AXK*>v~X7l&;@xpPsf^(r}b(cN7{BN-T zn}*i?)W9|Szka_E|9N+3tJVLmC5d75@ldDsX2v7JeppP0>-v*U7P!Am%d3p!ua*$` zHp!%)yE=5gprZ4;8&hE-xGy>-vLg_i1wNFKLah9$QQ(*VVSRAkdk=o|iCik*PjV3}p3QFN%o z!a1_WW7lRkxMY~(bi4qV1r8j7qw|ZSx0lE7F5d0E`L@N)qU-;)8^wv`8Cl%K1}DS1 z^IvyM#(x}i2krX5mQ=O=yZ(eYu|4he|4%w2*^<$4`6t9uA>gJ48La?#Kmovd%uvXI z@h8Wp)laM#-dJ-XZwXN2B)(yH_c*h$@L&UqO_kP^L~bf00Ex}?S_xt5*2TV z?sJ{jF8dF4>6Z&wsiy#lRM%~haL*<#qvYK6h8u(xtgJO_D*)+w##rDc8BU(SP3g2q zU$21OT843IsGVU<@gtvBf?NmMR+MW`*hzLT41c@0I3+gl5gGzLjuNPI)n>vNfOHZl zF8qpNhcb4^t5eP&CF7~&R`7LNR;nHV&i{v-VtgE@%-~ANWgaJrC&@g8_>Uz25Xza! zt=`iX8FlNFV(_VN641H!6e2O*-3<$`V+%Jz&*(t^nm^!^38Um8GyLLP+3WK>)fMM0 zuF9!od#sg7?k0es6XK%GK9{;jOj1snP`9+ZonyV>nbW9Qs4+4ZZ(2L{cCwhCYFu_16x6s z^cE!}S`o`&=cLS!DDdlhiL8{(TKvh=i;boHp--L>S_nz(aXnEPMYF6`e5Qs?k=nt9 z{O4>CR86pbBhPG*SZFm(Y6?G5*19GIs+#)T{nWQ|wO9?4**gmXKJ>ljyIm)7!Y%7jY? zPkJbM9rMD2wNS{x3zV*Sm=e8u6@WzTah1i3Sq8>%F?H#!P=25?cLCE~Z2RX5T~u2YX{?!979RJ9#?T|xa( zc0oqPriDf65I%5}h1M_Ga!Pc{Mt-SXOvMgn8D1qaWvni=OIcutQpa))i86Md`%YsO zyNv9x)bylOpi?59@G_MpHWsCuiY58si75NLHB5Pk)ZqS)*BWptz~*;> zb@m_qt!?T4Z)>O9+JCMkiR!1KGVBT1hhSD3nsw&x*cI-#?e$;d>pyD7@iw$RB~VMd ze{oN1z;ERr@zX3ia2h&Lh|C9bi*M27_G_vfgB&5h6+A9;? zgxV`}WL;^m%y<@Rul`Tl0DoGM8zcxE9ULOfWPwXH({-TLq4}cV<8$1bmVWq#5p#z*_^y%7Jsm!nF!vx$kOB>WXVv5zcg0y`|T zLGl`|PlMT!4aR?=c<#ZU#-0@$=u=`v@Fn=}{e>I_yru%2-{7)0sbfzLVqa57o}aX% zTU&>w-8+i0_UhGd!3>7h1P))l0{>YX>i%a<+t>idd8m3#y9F#3)*-_td&f|`4Z|=1 z{V)B4JTFGB2e*Yd_u#fPjy<>~Oq|mgvHO7oHI3)JQT+O!n-x(+uy0uM;bPd+F*t*t z5;uY~=*LLY@&Iu|@PUIB_(1Z~EioRdKj0kP0tRx+@I%R88N31>A~It1-}FD>FY-&f z1!enq1sKm$ictwf-m_y*1=|lB-;*-L0*opcSv$<2A{3tzc}$43QDjSwC7zWjqRGWk z0tK>sl#~o7wAU5$ut*~^Xwov#&~u_(ESJ1uq23yzIY@t3fsCjc4nDv)heKEwCj22W z7b}8>-wSgwiy*!L-lBB($^*l(sLA^9i%za6hkD0#LVZ)m(nKHXTr_0;Zc|r;L)M2| z-A!GHhD;xc!I1Ug;7$bOS~kXYu}vmxg-H%8B6c8d%?Bn8%Ys2SMhfKP9G9&#g$wFc zcXxkK=x+R|Np~+4V_VUhm2`BZUL8up+b;xbNP^4rV1+b64JplKu?-mm z%Yz$=)h~l?SY$zjH{`8Hg@XLdC1~vT2$3&T6$(h#ue+~_P|V_4GywGxX1@Zi)_InTd>GBJxJn@x^`ql_=pHs z3I5pR{&%M@>;Ja4TK(Tz(qj0J1V;J{jw6VsXH1)bPjVL7>$sMeua|gXn*}~T-vApI z0}(B!0TB2g_&tT`A#JD5Ry7>O`dytcVM;b(0Cl6*^_0(NBfZ7P8y zOPjX{SY%$s`jH~@x?7mYwI=oYze4cG2KX=AgKc^JAM9?o>;F2^+VLM(Awn7m5MFqg zEp+0uhfd4|#2RrE?+=IAZ-|E2Ula^cNmz-6*jGX!p701xY2P*kA+#g%;lgu1C`4g^ zcr^~u4=#wJxLt@sh0%MqNxlDDA^2Yt{J(Ai|7Ewe z|65ObIQ+kCHnre?s|WwfJGVvt`%01j@*#e7*uNUozns&BA^+q>q7Lt`&?zn0U)fkZ zTckg+3Eu+D-y`ZY>-K++1!sZ3bm&i#YW9CSz1>|o{&Rn@+wT9?k)B5U&jT{c>Z5QMD0|Hcv^m?Av^EOOrwCD#aTl&UTu)fx*(bAcn+20 zvAQUkg*cf~s7uAJsVYonW$9*7GMA5&sR)n=Y61g-1p_65#e*e+s(^{r_16U_R8Fu4 zOcsMD-mjmQ=JSz4DXuY0NnY(!3z;T{DFN#Uezy2|)1b+@atb3iM~+u$hC!>Ys8?4kgBqoZK>skXP^DApaWSFl z*8h74e`{j@-`|nrzjb@<{r_508~?3cRNKgJ-)>T`|0@jswp9GL!C z--_S=3WL8jxc~2NOZd;d?VX)L`~9yYZE)9^ZSc2d!Qa;8!c^)5`&Gt{D|KOAEM8nT zn;#`u99MfADefzb6!#P(!9Dl*X4yBh?%-xkI=5-~sJ;{ss$U*FswC?@LPz!Q6FI7X z&%jar`^JqbFrW+@rPBNhWW;H-w0mQdSXE+G59FR$9m#524wTi@!?F$e)P{U&Lq4@B zP5kcFpSb>KgW<}rFa}iJ{ZDTo-~aFQ`>p-|TGC?ipHA=$0c?f{J7_Y6))t+K%v8-t zIe7{JnuL!>8KfyM#~mhF0V8cunp<=pBOPN0z74}Tv&lh*596C4x^n$VN~c-Cr}9JZ zwz;*~iC1iP8@%bcrSkQEbupl7*8jowZUO&iyN&;}p0wWhPpLMG&MiV+m~>{-@FiS0 z8@lG~dkKnRbacvxkm+iSZWi|Dkc7Vnd(O=D!Mmd@yfiYw{@dfDlV8F4+qWmC1^|Is zedp2w&Je^=0`tI4tavI3)1xlaK^4_m97R3=ipW(K>$+p!K+iL-{NTp#1R?ZYhk0ov zbOqM{ppWSxM9HM8Tyut{8Wv?bnOXe;%lKgh!^zA7{ZwzZ2%|aOMcKT8qp|BxV59+% z{jFp!d%F;4S*b-CL+&i}pm767hT|eTxQ5Z3(#w99v6*F9l+&!>!pz$4tT5R4p)}ZI z%R~3)G$&ln=lTB8asF+C&PU5f1}@0Tt69QtmYILJoXiVjgi+f&Ju0xn+^($9)l!_| zy->a0u(ziREI2&PMaOgOIzjQ{?T@Rz-Tru~FE=H+42#7DhCHpBbR@$vjB=FAS=~!m zka`#uM%zkae3HQbQEVu+VBsh%!DUXpoXOe6n{yEON@h7;I}t?jb*~c#GU?MOh@l-r z=K{ZyI+&*#rWpYtvSdrd>T287xM2~)KUY_lqNA^`d1ufeH7Z)TjJ;J*9N-pai#r5& zg1ZJMxVyW%yE}~scM0z9?(Ptr;2tcvJM?tUxifce-I}U-?k9@suKn$`zWtvNrJwq3 zQ%Die=(Qi(Eg4>|xxrc#ulSiQaw;9adeOe{Q4z;JYWg$8bt6X?gpeax!xU2(h58t`9oK{zqfVb zI&mEL1$cI$0!_>}m?PZ@?K84P+7M?oILOl>JlRy@g`o-o!w65ANr#z~q&aUjHFC6Qg1Hh2 zL_-SCkcE%m0_^cZ`N)Ig2!wgRLgZwhJglq02TMRvU%UEzuVF-!7&z`g6Q25pTYQ9i zqPtaVu=v;4T*1G^G@q&Cd6iiih|aW5`Frf^osrqt-R4w1JGDR}BDGsBk~b5K?8|Lf zyFJ3qET*&ife_V;$uxgxf62Ink*)5?NW{yd{#olU zU^%1H^Fg__UVrnh^k#mlrvGt6`wXUG(tyJ4r|;TNhH0c2tTe{eiM&_dEao>vqu6}q zNE9^*DkF`F;)?%`MR!}L&A>=)G6^lAFTHm(B-Bd~u7!Up$G5yga)*D@*}e1BPZPZS zJO05BYuNQpr;>UIowc#jh@MOrZ6b0U<`D#qyr0(^|G;8rO7od7C!FK-aQWaDHW|&| z_(4-!HY|wQ-LB<@&!yBDRaVg-I6zyZJ|yi!bo{jDaA{2O``yn>`gJP0Wv~G&j&e}h zdSxX_VgwY#;PdLt4q_>64^47ktfj;!AeuTkd0go+uu2=vEjt;8PUE9nlIf=ELkX*C zHxPz2aMR#K1B~s=^Iw}%rhn(P;2y}|WJwM30h7_flM(?J3pB@$;wCN05*cu+hx$GF zYMrs{Kar*)r!)6!4(uo`BM%sy9c{wOO$@LJD{|}L4hcsxrIZBT7E$vXue9CW!!~QK zt6lI9Ht$s^t-dYxm|JkXyapMHs4ZhTK%3LkOhJ`Qwmb%n6vxn8bg|tkg1a3y6z?^q zhjjD0kkdYg4jZZtwAmy|!loELgjk7)>EWYT!nx@=tHK`-%{C;4(!}L+5I_(~D5HW? z-3Fc+>gJy5DHI&`NBDK6hd6M36y<$3q<%K&+Z;w_=&0B<-xj9gwA=<8%BvL`r?%!O z>Tr$=W9D`QqC$u*MZtHBFDBrsAVr<7AN)E?C2IDdcgxELn|L*cr&UpH#iFdCNfeK) zzvOEcqFtOglrs~26!BE|>Dao!S{0B1ch0SAmVW&s&Om&(sVF)sB^+95o6Ocm*HPK7 zh|o1`Qkt5{PiLZ-`sIyPBi_73M|xFe5S=oc^=qaKOTe9{`UsfatR`Kh=&#>Vk}Bts zQllbEou{u+Yr226@LUomm~W}DjH<9=4~q$6UeNa&THWZWbiZknQmtGPlF(AXf4SeG zE=Xb+e)H?SP1x{ek8&I|2jDL##l`8U=4AW!tV;#tJuTfQdap2GbQG65(HrT2liN~g zUz?@UXv^*Kb3TjO~s*!Fi{*9*YR}c84eO=7wAaKpbB^K7E;;H4J7(i%A}b-Po!j z9yv^i`JfDT{@w^=d4$jK#~lfzMohF1o9k#c#sscTZc~%`nzMkVl6)Sy=V8%67-rEN z)nlZkjN*k+(Z zNUX3AjIM}Qx&Cip?cWjnsolWu{xLxnkuNDaoUCvCxp_-u5BcmQQm0@TD&`7H)F~41 zv;gJk?}!4Cmom%{geuYR>ThLpH1KlhO(>?c0roavhyA?!e-T_mR|Y63R=K2n%?q=X ze9hyk=`T|8W<@T31FZ>m73p0Gbwnw?M@F4*sd?2N9u-Xb8T2m6#@|YR6;(L z(T_4^m(U%4rW(lI`1Zk!Im`dNxY}d_=`T|a*9*1N)0aRxXiL}sg3RQb{Qc1k^DXoH z?RzoN*7|q$8Wea#--pvSBN$Ozh#z$ZLBQ&fPN4Q8CuhHNoJO5>TOcVB(G0^1WZSO( zL6GhRHg32v*sI|ythWJF9c&wPxv!Hhg83H*c#LDrJ|{t^{L-8574lW!uVX{(q0i$a znUzozMag}n0GUm=nS5e$`6=c8@ZF(VLH(y+0kh}$TVE)cx8VPPzd_CnF!sA*Z(3Nb zJTsd~I!Hn7)Og5_#(rjfQooA_ShooUO@{5mO&#c73$F+U>I#kaTpr-X)VB|Y^=_(T zPP$>ad~$#*$=JdFWN9@mVq*&fE%TSMLzp51&FlmK?rDV|Ex-olL6`F%rp&T zlczKnu#~BXuOXmU2zpO22@GNqn@>*Y2j|P_Y3%P@0w2S4P6?C{91Qc-C(l%*o*-UU zhm!9Nno<*Y?;9Y{;L|#^dUpfccGWc7d1)uoANN`FpG>fzpF^Ru^5N9#N)5NeGoUX! zOezZfm{w8DDMlKpwY# zbl2(V(PGUKBC1q{u&76%sgYI3)>`YVvDgB6fiUA3JT5FcO~Okt4dz=WxvtI{tQ{S& z%g!YTG7VS45eG63eTITN8Q5ZJ=~mdmlEw+rDi_&x5<-s(qIoK$5_5#la~FJ}nF{0Q z^Kq)@IH)4eggPTzMA{b1v8n6pjLc~0bw&PiHr3~A$z4fQ#+t|0doWt%Z$N*5s~Ugw zl~SQpVS;g-0UwR3>OZgUJvSZzL>1tlTn6A85T8BZNPl|CLg!X3slQ68P4+=2zSZ@| zGycQR9vJ_{&*(!EQl7V>fn3-4U~DUbA!aqgqH{xEs%JMtYGJ@02DSwKpO`%OpA5~E zzlS9vf2?Nqlj82mg(l<0kgrJe6RltlZg>brfCqo8O~NJ!egc%F%-By2z3qZ*R(l*W z_8Y{EXN zNA-umvQ?3xZKV>OBVS1*$JMoPlx6VC^!mz8%^!igbH0Mw4GUemS>ga^E@hr@w(UL^_L{hJjfuTdM5wtVdZDI~Oy?^fyfrUJQEh z+?mmuG*2wMNt0ZhsWjnyRfwfDdCtRfcsK?(v)-2GmWBTzSk)yMN)t7_KQ>6*p|*OM z9BVh=bgKEaNZCR?`1 zx4rX>I~okQ?^3djU#dHs-ZZlO6Ga$QbKJy{Atg<{Bd@K*9=N66+jCoq%t~RKNf;$h zC(^dUE`yp<&F8a>AOVA2?%7OeI>0(7ts@(ge+;o_vi#yT7pd zIx2w+9T%XfHe@|1>p6I3dUcUmJoqUnSfj5{fHMe};q28{BsBdAu&r0G2X5LwfL5*l zlYkHNs+vGX#{UtVc4}Ky<%X*JK0MrcC&T+rxW8q=FrmrnEf;&pc2b67&ESyi!;1Gp zZ-Q#7LP_3nCvAU9Depl@*^BJaI-YlV&W9JjH7msBVlr1Yz)s`(hSqEXS6vhFf&{-&`sgWDk^KIx7Lp4*2(6j18$)yeDR^`D2d9Ue+-M+{aObRax;#!0 zP7%-Fh>&F0Y#hgZWw?vidyU4(Q9K7<4;|ZNDs+S(R zset`I82sWN1{b(9vE?f!%+uylqC3L7AlKpkKY(zGe<0j%vwZ&xC4Z|xmF6*~@^ zmwAzF<4KAAURUPlG<)`Ln%zAk0mO%(TfX6`te>>k@eo5%MFO*NQtwj64(Y=?M%T;b z49Paxuh~RhR5>TlGWh~7w)qqp;v=m=OY=f)wL`CTj(c1c2L%8uhLGYj(LsD)W36`G6FiG<=7D0A}i$NTHtACq3G{Q=O& zS-WqxQ-6BIGEn->U_ZNfr+2&gZvw)-mJ(EX{5|BGQlI;mZ>DJ>=-SIVupOYt4b~zI z3ymaZA=#gZodRISDt;&%$Z+WP9rx9C@j`OV0JT zUDWHYdfoo}_i$qShO{e(UM&%UEBS7N(V;ohyMp;5$KceLfhSf|y+bIJ9?YeN1V@|M zUy5F0F2sXSteGIvbA_PR@Qwrw(HyNN=UdDVQm0 zi^TnDnhi(qF|yj3$VyjPhbsD{11G#sUoRUyOg%JQD849EoP*Jez6^4p1I1EcjLjB8 zUSTS$Nz@?6<#i{9T8=UYe;51N?%lA=9C2nLyEZ2aVoh~TzoXy0G#E#UwT4en`EEjM zMy@tNM%OHb5kBnZz(;&Ozne|F>%b*yv%`XT^FQ3vc2HG#PJxUo_X;)uNf7aJT6zDf zz!OeFEsU{`2mZZ@B%JD?c9j7NvzHj(oLdvM_6?)!x&M}krMVnA(%{sA$x4Ge+PodhC1ZC z^oiEDdkF`taM$ZA7an?~rs}!)BA$8KEWL|!QJTk(!Vex0yfYdwECr7erO!Pz8u&E( z54yYg#wsGxc9br4?~z~&FOY_lu3;i&GKxC#IPdbL`M5czCd})~OJdlvq$7KLO#*NGT#73h zA`eW4$!vQX?e|`<5Aj88RqI}mF&Wc0B#kP^S8jl855#n=Rz~tCK)(_t3QM~hl6sdxW*LgfOM0s_ zxi{MYrm8ijZGdZ&qNtJgAt< z#2L4?;eQ)5ClX;AY1^_L)FAKhDP@*}@_L}ZzsV(ha8jvpjfY?Vxp`whIz%iQEpz`v)f9DNh5Y=xIj{hCt$ zYg5u{NP)KMBq+$IpO9 zZ9BCfV-5KtH~0D#NS#w)XK&s9j$s0Wb6VNIjhpn1L?CDS3FH)C{o zrpDQk>)ayeK9R{&R=NzclOhMH>I9{O4O4%>b2!-rwLA$}9eru}zH{*2raA|_yl>Na z>5IG93g%xt)tI`FK-8k|(xmG8y&*hB5GirZZnh%5+rJp7*MTtE`^#s+h!oStj)VYL zGs*#WYV{=~R<51zk?Sc%W#o01K+%P2KROTWY#A7!cndsz>Z$>*_#}A&HJgzGAa22% z7Ou6@->x*C9a~lMs|`A<`;coC;g=S+4K~?uoN^mFL~j^zFYH8ju$e+{Uv)XQii!tc z`@XOCG5oFuBE0uq3^+ss+tQZyfi2H~!KeRz;s@;7@CQBY@Ov9rOKU$DtBClvg7kQm zJ8#?PqSoKYazvKDLl*RFDj&>NBx8p_*lEq^ND-E|o)&u-1F;NFY+DmXy4{UNW>D$t zve1O|H*9AeI>amz@+KNlqGXleRQ-nUJPK|aFdC)}6WB?3sB(4mN5&fAZT+tB0v|t~ z0DDMNVx2RQE*{z5BO*Nmf6A`YwJbcf~fOE;T`#9qldx0pUkZ`%(~3)!Q* z8txlpqY%GMQzBTi+;yHVmLHmrWHpc|p*cu|25SepsCbkJ&k^KDFk&F*B$%&@{-rN8 zCb{2B?~>0s#k$#PY`2FB>R(9;PcO&ZKWv8+M}iFE{!@_T1)XQJFVYUL4Ohc=&82y` z-@*ZJunjTJ-!M#UR85gvYT2MZ*#CPAi0spq^l4eYVgJx)D;>Sp*F&kb@SI0t;_D{V zP|h`h^T`?dIS+0?>(>pDD>2Y=R?NIZbQLMi(T_j?1793F8>k9bE;157QGgf2NC4RK zU_pc=eifVCHSLCv+b2$_58i+HA@(f>qjI)4SYREh5BRYU>*M^lR0kiC6gQDPe?o0N zW|%?vn?Yys>2!gdb?cjCT5nx=(sWXJ(t<4ZsA1pT8&FFo?@a zf=u}is8W5v9O@#9r5@6vg1kx9x zmP)7&ar`j9`5$!AJZhy4whI-N&AxKFby7?`<-;{h4<= z%L;~#z;n;HF5Zh5N20%b*TD9*r9rUTuP_N$+t|q0^x}{QurC!M5Vze-G00ka45uUz zSo(`(&}s4GP0&aw1oQhawd}vIfbC_n5+PMxz^$|!;Oj=ng$L*xd|xvP_+$BiFxY?d zeSwv>! zm^=nvTwLbs16LArfvk_ja&t%YjAq5NNwON# zdv=#kMMlQ`*ptriSS`k;EgCcBH3#wtm(RXEM&9WxPyyzw$&O<6^bXM1$9ppI1mxx2 zdVB}{3|qk&A_-K25vj)>mGnMvUJ*mJ@(-qe-6O}^)u14;kKEIaY!4W6cO8nTp-k@w zD~?7ZpPfd{<|`;|6qeuFj>iC-G&#T~!O(JlPblUiSqW;zI;3N4{kDcUw8O-t5cy#C zpD`TjRIi0_#^U>TgzQ?A`=}VA+tZY$mKm?g5G(T(k5&8K%3RbbQhl z@Uyeqe&K0s$yvrnlIN$ti&(1lj%n7_BRI&?RS%8^1OM0D9rVf3=S|)uH{#`yJo_Y9 z_XVo_dUD|%%ZCRI>Vm@M&r87W*mYBVLkv3LOOL3RNl2) zHh-I-PtA0W(9dGg<=zoWT`)4=9!Ajp;Ezs3B%mAlnmm|c-7yDVvphmB`iO`E;%2uZ zuU?aP9Bb!5nazgO?RzW(g?uv-@+MbsBDmlfOyOZnJeTHpd$216_t&ICk-lk`r!oyb zqF_*IIS%>8S%ShOyp|bLWFi8)V%)RNgK52UB#Q!v&K5n-@rCLl+R)oR*^A|IR6YqY zm7@avZ%?5#PU0bXw-HBfgtLxG1>Vop+HAn7-c)OqGe|HI`R%8AtWyckfx+k~@&_-C zO_QTs za{N)zA^GckzM=u=jr)VzZWFte(8QRsT__R7qnla5k>Qw|K$KqDvvd8S=~DjTi%X)q z;mW6p#LFrl%;XD`wiqo>YZ0!RtDNR_3_OGNDQ>En#)Ou1JjIT6faWYdl_a?O)xCMT z0d#=~->+LX(Z8W|z+TH*B52LJ30MJSCAmVIU}zk8jew(9CIh#am^s;o8tXYQe7fK> zJ@_ucoF#(RHUI&dyF>|AQ_ zw2p3=w@AB%V!)Za*D8kI6umNo^-bRqs;CDYrR(&n+-n5UC(4}V>?DaSER zB|5CExsLF%JWba~8`jXACk)WX85j8vj};4C)z;EZGACyn?%S~o8sg}q@}}FQeA4v4;PbetJA(PQnNxx!z0U3 zSj%T{hp6QSG7VLUmB#$$$a9}k?3`*=E^QoEZha@|q7Y5BS!z`Fy2LMozL(FJ+e^_$ z?EB7eY!TbmOmXCr8gn2xkX0FJ3q7;2rJJN zUC0L-11p~DaqaBEahjni^aF%NMlF^R>6#SYyN%Xq8H}f4q#}H#Dw55VXfre7Bj_!U z^6OZ^OstPqLI+DqBRIZ!l-Oh?sL|qjQ!uS_V*6;ST8$L{qRect?}ubge^1aFcN&)p zXQ+3?!|;1NY`5}9U(P-~1lSz56yE@npP55??SMNQ>o$iVSq!89sqT8CuM9)|4C7kq z4XkB!Y1So@C}!PSHu*spK0{y)|F zKJPfovJamjEC)Lu`uZsAfV#RN0bL;BJ@UA(knsT{;mgm|aAW=3@)#`V=k<}^JrhOE ztG0p%+8~|vmuOf$D82q6KD~qgXI_p2^Zo!GQR1(#``{{@%j&=ojM(itE7t~gg>2^s z0+;NcfVR>EyGv1~QsD7mL{3g@VFI|6wa4wBP@!r5=JF)0Ey$qPp&JfSg;Y7e1Pocn?s%}unGM?8mlV_AY=8%^Zy0-`;W0o(J-6%I4Q@xE zz~ic+B>C{PbM}bv3KZ_!3HbL{4*thj1p}^4eRJFThy2h#x7|W!#$BlDhgbh@kS zi9^p>J`qP;zkISkR<8=>q0m1KG#YC!>qG7k6kce}>P%NN6qaRWco zKZSE~Ze#}R!M9StXR7982N;d_vj;;iU{RLXbDu`*O9Z*-H6ZkKG<@{uO5A8>cFTri zcadJdEi@Bun!pJ-{cI$bGU&`3BY%X=4$&1t!gCk^5Ao^;n2+~+6_5AN0~UdyedEj* z*eOIJnB{*J;Tz#1x-BhR5n73{FC$q}V3o^5b7tpZ7FDzpU@#@U%sZfo-Sm~|%wC#x zNj9%BtCAB*npppa-7?}rgMS_fg6u2jL4?g;!ysVoim2O;NA*Nq4B?fE&EdhRG$CD8)zh+SEStjnIk9r&4Sc z;5TXMlit8?h~x(3rEz{l3M|2|miJbuiYY(tuKvE_e88-47PeUMMlY`%50|Fr1T|Cz zePoi|0$`ddnPhAk(*!)Eoxy|E3llg?YF{zUTB^O+u%YM%OOlmXhEyocHRIOkmK4U# znvUI{I1&Y>g4)mr{_DL;-~bsNnel_Z-?bDwE7Nf?9!kxMt6BVS5hxo| z`=pjoE~Tnbi$Guj_djja5cvC>DCqz2L(#9YSL#B+*X#lDv#2lvV?k%RJiD_qo3F>P z^YWjKezQ) z!h6>GPbaxsW+vy|{@8_6{Blh{qBU1497SSK0exy!8;iJNNvONRUG?AIDQI1mUtj^o zO3y(K?KxMQg!XIoJ!nzyJ%8H89D@noGVKf*@wML;v!`b3nh^e{nSKOb-35QJ2cPoOM3kjyxN+0RDZ^0S%nZp?|meSh{s4+I@i z(S|cLv$+_&4OKaO>LWva&b$KH`s$7X&mZ0{p8C@6ou04U(5w@8G~?bCcw0yOfHL29 z{$2~vt@|P`@E#_NdDZn><7Aq$s%rhUw`l=VHP!hm^q(Kcyk&kS5m?jk(7a0Co}Dbf zJx#9B)g4qoEHz$`+?aZZYHoi`@{P9;pw*2Uwkwsd;%pT9TzkC{vH5n4_}UngIm`9! z#S;jGcLk2>R?E5Hg@(3~c*-3S3UYhT4!<2TX5%bNRI# zp6jJPM@Lr|wV6?La;~J`UeP2DpDNDJjGs{P)Pv)<0arn4lxI_k2Yn8a)!t?oxXT8g zo6@z~U_`>hnmsCsU4ZkGB0zb+k;@o!IEctg^m=1tgx33~@oO-Q@>iZE_rhDgkbl0K zB&@P)Yfq255i+gz_dXm&O!&|Dljr+s(p9h}jmTvfh`h_IA(Cj*WJ#scAV-rgcp$Xp zd7kuV7zTG}H5cMN#-K^RN8-Fu**8ic6!b5R$`-Qu5Pao@{@Bro2KJ^cy#lJ|fJ5C9 z9=rWBZ0oEV0YG{ehzih?cQo&P9_#-UZ;2bKCU*$yBPcS1aOQKud2f_$G^}5O!Ga-t z>NsvTR`#V)(kBK8?G|B|l?(u@N?l;v!5zS{p8urfpQ3H@CBr~>(w9*9%H5K3f{3&H;`7@b z>72WKZyWU&>o1I_@de*JBaJ5&$X5`PI(A8e#Bpc`1LMqmu=G;qO-aYT@n`5 zfix52ZTJ-Dyusd(r(NcCeM$jKone0#ilPJLQs)Hqz|3KmlJ6e|Y&*=izfh7%Nouvd zu?PC1`AWC7*#9)h`oz3iONXigs=qIY2t;yc0oEuIwpwn{Xxr_a>+roatp_g6W(^1WZEbBWgDJHK zpbTIeghKBqKFYa$5(WoVx~AWJE@|vYvKDT$`iEQpBJj`wD4nz4RJo>U1*mh zMM1{5Bu_F;<0rE~-}zbB-UU=W_##3|$`ovW6?N1PNhR`hEr4#UXzhW!`f z4y#6Z6wqFk)Aq&pnAJ(G>uYZoBqbQ$U1|p$H7K0In*;&F*r{zxhTvF3*yNF>7mM{ zYa}0+V1+8QD6srdKS2%JIoq5b2lTd#ih#>Yc9iiLamQt_-?InG+0m`Z=d(I9JgG{Q zK)vx7@yx^@c}$L@|7x^9nEushXN6+9o0hNCo1WfYx&J^x!q0?d{?2)bxb5=*rVFwY zMwqOWQQ<1@bMz8}er&fcr*434pcM{ipstwQ%m|6_W55lBq52E^Qq3pZjZTt5_T5~d z#*!el%rvOVtvv$XE=FthHZ!M8_N& zrwGi(2Xi)y9jl#Ad9W$E`v25UErP~uRshsPSGup9?LHq@7x$eTw=aM>(Ar!&KKyzj zkPML|@wZj(q-mWupuEllo>_a494p^~g2Xy1Kzeu=h`cg^Y}~$7CX@h;V!YI`7L-h_ z<~CbtWzvcNkfAJ8so{_b_0BekF34m}IqsfsFaAS1}m*xyglLl(D!yXTh4 zuN`$$_#p*8s*Qw^-S7`HY7Rh%v_Ul7ag6)fP)b=}-sWTx`Z@hQSE@c>{bDekY_@X$ zjyY3i&BOM>KUX(>nLeYted@*>i0$Loa4%oTIs+xha28;~})STwvN zdW9Mjp1*S85q+fq0c3!4;o=GEQ=LIA=!dr)|0mfEXpV`>o4`jC*#ypvKk!=7@pIUb z@ONMZ{8^G#5|b&zIb7SakE?R{2LMNs{Gd!v#^$qEhcY1u!a5MZU<1aR(&YD5U25Li zE-o%k3D5Vr64z^%cmBdAOgTD#{rB{wsrjft`iWoIYx0_nOJvoT-p za=LIj0sSw`wXld{i)iwQcy??OC|w{RZ7wkpv8;G&NOf6))tTdUeWAelezUnP^Emik{IQ?;5ZMeu%tO$3oNlE0Sv9wo-! z#8eFBgXn&uYnaj@czk|JXT;KGH6;m+nR5&U-S>N=(j95ujAY_jxkUDhNDTf1_;0|j zz_?cVRiudqDYb34OFZRYby@DVra;J&n2m%=J6!5gqLGL9OxC@H0eZgosKrOT8y^9p_DmP2g( z1JZKt7xW)r*}`cA?(4Q_`b~_53n@E(XAKg<7u^IfaxfpnEkyYn|4zGZ@%qFm-*Ke2 zV&AF%R^??}IuF_uba`b|E3L-vAx&69gly|-IKT;8ROw{aH0x9Hc8yucenykL|11w6d@^L#Ek zIL?g%bYu(PvhG!n_jF<<+20y}%C`Mm0tB&^T^%yQ=;#KHKqTyc_L2x(t%)a1mO=_L zue!szG|ZpC8N6llB{}gi~7n&-D~#W`CyEWD>>}Vy1N|_W}vf7Gxc%@zq4t|zRl2MpVp9Ors5x*WAizLemyh|P1?4{wpJ_5?sS^i zQbxL+z&hwog-Vn86X){&+XYJ(Be4=SR4rc(yEjECnP0p;va~5b;$NAv8uN!w2zSzJ zX`FbRz`yyTcVh_)9PMFG!&4P!pL9Xegj>v?o5b~F`-UePnL~TA7>0R6=9jsB^Q^jL z14WHZW6Cu+Y#;1S?l{{ z7P1TG3;&DVbTan(4yR>{ybk;rtuZSn8I`>gZcT)o|KHFVY+A4xLLYBFrQYFXFTa1Y zkD(o%e*Zwd$8g#)7rzn@Y$hKA{6%hsz4&JnnLI0w)&B9i9*rVd<>eoo8o~4-t(${H z=?*tQ-RGDD^@FBh9iNiCIy2~6gQXzFeu#5PQ9WBG1ZHr+as^%W!)?kPvlr3{3=0#G znTfk%5RMpG=nIF2;WQ^8k~eM@x@tiB^_=$)oQhr!k4>SZ3CM*7z7UGiE09HSM(!dd z;l|_>CA8O2DCUEM3I1S-LKCGOU_`0lM47*?SM_9t{#yG}6?_!j3F0+Z`joc0_U6)* z5Mwu-E}?R_$ra#4w@#@Dn@XpvktSR+iO3uyqpo^y{NUq#sED6h3Hq8*e=a^c^y&5k zPC=PM2UPpa(;yeoU=-3|7WgXV<=14S#W?!AX{>!xe19d{`S%&;aQnIe=Dv))HoUXA zwcz(&%=c`V@?}RBko2N!r#S*KTO} zf$Z{v{l`ZQycJ#>6!i%CSwdTDWvdG8Y-^%jIm$QS!#;5QG4I2{ljT2$aK1zUlc!6u zfydz2fZJ{R8$hqdd!AoR9^a?p%<2BK;H`*qG*I;<9UEBY#+}Ouldu$y4SOQ2a`DLw zXjgd8Gicia)=>I4Jqx}x_X>V0)~?cl2Dpib#z@se? z*tAg#TAR%x10~(h^`So%yFvvyKjUvPrQnx@ZW&5G?)u-kl#ZHzNSSUhp(FGcHNl3&DUiCtisU2wv7 zmm)*Fe+hn2T{rhBjGC!2W?fmUDFt;!o1i0-V5-AF(lAkBpdxm^QECBCA|{%#!a3o;TlsB6V-T`;RDsqDQ8a z`5R(7(6xPl)eZ6beSd||LhLjKIBV_O&b8sNV5wF~5uNEV*m!xNeL3~5*d zj95Oa#@wye=pJM`7eojw}TGSauwgZ?yIv%s`s zn2S5?1FnO#=Vw8e_xOM|-jmjU$yPHCxVYKd&OxF_@Hu;?^G;lnln4>3h^|T1+Je-O z0JVBQ0ntN2m=JYs3Yd*9U4O{q0^6$|#!iHF2b~9(H2}8x=>EIsLU9U=!d6ri5&#`L z@Oe1s&A|Hfx`5cW0xvT@+YVnYgR-$+VZQW$=WZL@w7kcT@n|h@M3l+z{yc7r6IfAe z{1p8Dsp|`D%3a#;Yk78zx&p*LJ8o^|;qK35VspJNrHfy+q1npk6>I^5D} zlGEVX8BH+xbbq}mp~c_W2C8sp*qOCqrM^a1o!BmySwY!T?zf6aE+_%voWjk8y+2>C zdmN|}%N$QfQ+q48BIK)p4`#y0PJfCYx2tldjgB=Sz{}3(a!h`pU$?S@F@whxp*n4B z=z4yEJA3SBv7@+Ti?43gj~moTd-_UZmvYcZVz==$Y=mKJ2oqA%A0$*9#&2sp+iShb z7BEB{I_D`+i~R;#K{WtRCP1a{t}P8vkGL84b7ced6}As!&Ifc_0qyUd8U?G+oA${( z8(DpS?3s{b)ykFBdZ%&6yr_<8LWLHFV8z| zV*fbEG~i#kwU=7L!3T3hc~q!t>!*nfIxHaJKg4*+SxK8bFs1L55xE|{rH0?;?&and z3~=27Sby@n{K0+gf8YQMXsfN6Zr&R3ioq$+-XEzIj$f*<8vAI1XIMw?HWCk#blWxx z*Cc=D2^YB3P>ThQ?D=jHz#@76uwdEFgFwaAH?$GzmqB&5o`3k`)ex1(9=_tAWb$E1 z`?vzEiU+P-VLt$SKxl>E`r_G;9)q+Bo1_Yd_zNkY&U+m;@T_AOV7$gU1I>m}f@lIr z)ITYKtiu`lAj?}5h(*W_(MVJz{UCW^prBysI>Pr|4)y1N^9mBzhyfk1Bq8;5CAJck z>wSm)6eZC88f=|Y-RO!N8+52QMB{-re~?TQA7R2w)BNrXmT#`OR!XZ+D<`tdLCVeR z=i2TWV3mDNMBI3hh&BMvbAxZ#o4*>h$9;nuGXX-GxeGrZe(6Lz21OdNZ_DCsx@Jf0 ziPYofO{Rx6<{ju>Fm+QaMzNhIl^Zf~7##*$70>wh(d_C=W8gzWh!>3`u zgoix&_Zw{XmjNJ(Pf^a|1o4&67_f_%dkwhLhST?nzq-X$_R-d7=im8h4(tE^zVQxt z1bROtE4jlNr+9FQQF)z-nrJ3T#8{+e4>H^qfx9*Kr17@csx`Y0nDF;T!!-)x5i{(s z2EGL;5<1kNEE{ilEAOAu)epVp|Z8_~p9Qe0}%0v|}_ zZutB#pg4HP+fxV}Q1S($)Ov7r^ka9x8EKax=9mv%$?Qde)o zu>e9XG33g(ROH45s)n^?j!%hR=uQ5>z!I;o9ESahY@TqPC*7iR1!>0YyfU&v)IH8( zUQ3u;?1T;3u}1&-yq>CK^j9lsTqzYI3O9 ztvTf|079u0hQJ!MECvFqNSr8{q%OdQ!ystRTTYX^pe35w-a}%!J#J|7%6!k!4@#a~o(QJ@ysa$gaZx zeIVKzYM%X?aC0$QIH|TMi@+qSF>J4QwRGC&Fhe-^_NS-WLt?|@YS5+PCkk>rGj(7y zaw{pj6HdrkMmXTB-@9s*rEOFBu~5`JZm4tRifP&KrfM8oso$TL3Fk3UC2@%3axzpo zCFCHZU^+PNqSO7E@7R0)iYo)&_!#)8et9`&a@XsrwdeEe| zaoX}JXe<5Y2XLy{jPdbmvH_qy+uGh|NPEdlup>G4UIY1I?#G1mOka)UZq#RD*(}sI zN$S-~(nknn?7uQCp8O!@|29*79k5K|4icV%KgKRE9c)2f4~0EJ=vx+bATTQod`&SV zlAbK6T=a0r$}SXD0@`k8eOv+ICV8^`s>2J<(D5X`+4oL>9hJ!pgD;O%l;F?c7Iy8& zxI5jpEmR*lomJjF-Sb81>4PA`d;GvjZ)+gOBVcRmLgfAFV(UMoR9Y4(Hta@=UQqY6 zs2|9W3-4lNHuBi)x1HP$C3O>86iKtaBluk@%9E1s3K|eEcZjk1s)6gOyT*;=S`gFkCOYb< z&luzR~(Oce417xG~A z+U4LiPW2ak0F3YPF#zD}QUAeAYY&7I%n1`I#} z?!pHrTEF;_=oW+{7x4NSW2-tNv zI_yanp+ca3)Pe@vEJ4&Z^+RPUb$r=;bs2N3^ST_)u?IXrCV790`AXrDIc_^QTQiNm zTa2am-AZ3KU4vbi*&vvCGH5$L4oO-}N!Nj-o{<=ejSGhOr|dRtVD-2Aqse`WYKZa5 z7ir6|1A8QSz22)nGr`Nin|J^c@DEY&+h2pdZ11XFoU!HOrk+2WFZ*RzeebVFTV0@< z2S6|Pg2*uUYwiVcuHN~Fj~DD})y~uBW|yC@%=eo5BAE^OU+!h7S2+DGSm2moT%)qF zI9e$BH3A74M%*Wm`QhR+D%Wg#4;O#;CI+sWFMFB{X94?JS~Omoge(s1>WjPA2m9xF zWsdO*QH82B+Fra}E}L+;pohHHHOqgdw}i3p&ki-+6}3?d`U4@_AaVabC<2cGS3$Z) zTYBJsaIS~mfPDckD_?ehBsb*+ocfdE@b12SZhc{nUShlV*rvG{bunej#&J#l^3H1% zBmBch#ciL2^hoBsNh2=25e4O$Urq4<7~kW$*3t zYqG{V4w0-v9-Fo{3LK`i76}++zS+pKcitWT@x)9efs%UpU@Ru>TDkV(|6uAYgW8I_ zt&daOU5mRr6e~_~in|nd*WeUyad&rj*W%jZ1d6*BC+FpP?!7bb`EX{EPst>+&)#eO z{(Jo#s5E>qZ0iAuvFOc|W4c{1u8A5UPJNG~cH9o-z{7JuCo6EOXDXn^(5b_#zL(mJ zM+_ZgcTzDD1KpmyoqE-!BY5t71u0e6UHcK$lM=jInkYeFdV^@24NU}19*ZfX>~WQI z-)=WoU-FcVdmn#hdsbiGu=r*m;ZfLb4Ni=|BXOVSC3T@D%{IdOU)k1&vicjZoO#DW zhi3DBd%hI9+@GIAl}J|I-Y$Q^-$ZMmm^msO3;Z_81KIRsGu_S=9jp87G{gaq&-Pcv zS}?h0@)JU@bQx2rLeF2X6= z9r)Tt{F*RCO$6*5)i(jFN{=T`6e-K9o9458D`Y<0mifhAOT2-y=PPQ$o;#vp3;*)g zCb~G}dxD@i#_aky`Q&IJi`zPXK}1UN^qbFpG2$(unSn+Fz-5*$!Aau777%LwFt;w&H^w#)Hwg{pTw(56<@#hHD zogmheN>WFAw0#f53dXGvFmc?)eO&H;sG&rYKLK{Jr2y z#X>xO_=*MW=ZccA4ewLT^9^N5Uwso}eAuYYE9X>5drP^O7 zo|l4jov;3KyVU1hLvXuHTw|)k9_Rh*b;8HEA$aYR%D(q({gt_c%5t-$o607@ai8wo zZv2;+hzl12su@C+^eaVv*!B*m=V)kA=WMh=TLV`dqFA%sw06+vB~8tun%7F9wx5~H z9rvHBOJ@jU6?E5A6FV|nl2q;46(bD)G6(TxMBli%R0(Z+hoUp!M(xP{X2l+gTWglH zh=F8IFdRK{RsFq8{x(t_(E;y5vx07S7XE~sMnZAu&~GWxXZbVTl}fCM4kmgh6@_s$ zajPdB#3k3wz2v(BrSzz~=LtU78~#Ur8}}zhjn(wTyr_20+Dp@KERiDr^pdFcKzKI1+%?J2Ti#4HXi9{jP%Jqyvca^D$4(8b*iSGjnKf_4!639aRce1U$7 zZFMQ71hv)&sM!?q1 zB~7zq8taUaPyWlGvPZG?WnJfa%*Si7q<`HJ0e`)Qv%%whj?3$lD`?Xl< zX&eFY*T*-I_QfN+VErya8gi~g@pTp+){S`Hk1@K%GAE&#+lWy%??d)2$Q@+wsg8Zi zC_A^$8+7yfq+bxqNR?G_VP;lY(d9NJM;*P^iv}8NzW!HQQN?>7uw(aja_2F>p7Xos zI^2EJe_m{M^2Xt@T8$sv#y(?|D=OR}5TK!V8i9dY8iGC4(X2(1xKR znUq5eV=9N>^_%*8pbJ!b$Z0;xJm%*Szl1w8_D)XFVOix-v0=o7TH#`}GwE-+lq%VW{Kk&Sn3N(8#}#r`1-g%EJOPH=(d)RiQYe~*4Erfz?#5axQVb4Q zjK*w2kvIu-=sCt`MWu5rPjk#@sv(7J8@tdtGI{E)AdzO2ku2xwt#G4To_O>gM)dZa=2+Ur zd!N>bu%9rUc{XZjvW!sCi-^v~qD&D-#D*apS;r^Xt0Px}Iq6QSnvMGC<5au>tOmd; zC_BZuq4<9K^h0g8fI&g@a$0$8g^lItrK;UC4*bnjTMr&ARZ)V?4R2Vc84_RA-p?-H7x&#f#9O&T0wQAH4`-%L==&BfSZHK8qKBkx=EG2K_^t58J%Z%G=!@c zHouY`LX;iJxiGj>5?-O$!%==t+|a-d*H6jgqsb8(=p9#)AnA-`Dz(BQZv|Zq3F?aP zF@au*!0eV!3!+kV@8u)RYL7!Z99yAwT|CO`ojk0DJJDKl~ zBMZJmGb0r#1)?5-%a;_qax_CO;=YO*z|ciC`g4H zzC)ATR>Sr;jDL)kF4$W#F1C{q!kZVFQ3=>P31wYWkM3JX5}6dUnt##u{1R=A#Mse$ z$W+=Gu)rrNiug0y9~DNY@2xp&RYqNbuL%tvsc58EnMFX6FS$`1_O}DeFq)P8tbBLw zDQoxA{b$5AiCHA=I9j~XqllWDL!pS&Q`$5O`KYrMqXAswM1p?_>fWi6CEt(u5((CA zZ7W}}o$rfBI311YHqdr#;1PPra=BL&>SVaDSBn^TFM-m}&0@NSM8oXg|Vqo3YpAl0-7W7LgX zl6*s+ly_H{C{+jx`-yW5?&<#*GQxZoX85t<2TWAdJk@axZuuG$mZW_$DR{d(ityId z$5ynl-#_T|!)6Qz@|*L{fUR0MuGd(xsxM@hJ*k7fzEpOA3Ao(3mKy~KDagDI`wZc* zfT~9wR}6!5Vu8TJWJ6kar5r`?48`^n(~@j26lV-UK~us@j$BqEA4m@E!`lbsH}GeA zRVS=4&JAU9yk`&x(Znlz(oX$T0aV2_6T}d#aHR5L$wH^}}D6^xauTVKk9haWl#0lb11bY+vF1SM-4@jMRXm{Ye zyZ)^HK4{Y*jY6v652KHCC02L2d3~~ecGe}H}#g8&h_f{KY zz@#V(LBO5ZS>E{9xmkFuA4XFFS%lz+#M57oz5Gq=ahHC_OkBMHc$E68ip+0E2)b<6 zm+@&9B{EUsR@B4pe0Q3)+5} zlgLDNRXR9da96Z{dx%8zUjsk3Vvz)0o!3!zaGw@jA_agV?_gb5t=-Z?ZuEXGDrQ~f6@)QQF>dB$({BzhmNcn ziC;ZFJyoS?7t!~CMvO8Cp}e6VM|vAE2vz+A-lZAnmDFLqRe5Cd{*F)NbBAX3=(v%h zT8}1{i2P823LiyR=|2rULS8^&%!I2b0&ft%EA2m@xr<@S?0NxxPEW9N@E<27$hbKwyKX`d3}XC%cW2(U}>H8T_mHFl@^ zek+DLpj1QE72wm5JO>hgUZIcMN^q=Sm~ra#9(FvcdzQ{oCcb8UZNE3;;zFY?bIAx1 zgWT`_uIDGdNBFaiL7H}UucnW4NAC~(gBK~&1Rt@RT|~H{u)XQEkBlf^l< zxr~KxB^!RAN9c%Ba7SlD(XZ|i_=y~-WZLoc^w6+1+(yleG>OE&+BNLk7>k<4(bgin zD5_T@lTj`r&>ZbL)ovjtXwFDi)A&k5EY-b1x`c)DZ?eR71(d0Xestu)#{CpS!Gw`8 zbRg*7wCxXlZ}C+1ms{O1rx_gdCF!R$I1>`;heRk(S|6s>m2Upxf7uPk|CG~*zSu-a z$06r(np=1j6q6falC!M_^8qoEfWfbQ(<}e=E`DOOERn3u6z@PQ8(CYft~KDa~;D6 z<86os8~3jssO+hnUs4M$GZ*K#`-j~Y?(;r_dj%tv3EQIt$uQ8TK8zY2A?K+(!4G+4 z24rnx&9-+@<}Ox01~Eg|(yePx9qYTOv=FDTvcF|e%sfZ-G?XTe{5drx#%n;*=OL@y zi&2@=E#nyQu<+;d|B~IcMk`Su{~?O62b!2N3+|$iiJ;IN*W_j|} zGPu&y4+cXtpP=SsfUK}ncOR$_4jJHMFJ}Jo>A(_nncMb|5ArsXf>Ti1sly=rE_iRs zJ{lR1moU&{Y&sNV7BE#d_@ODe35^5;lQB#ksb!qDTb_Y>o#HMvQ3a4~AT3lBul21z z7?0DK(`GMEMX|qASt|)lB*9^wvT2Rc)Z!%o{f~K92LQzK0C~s5^d|5RpG3_vd@`B zOQr=n57_1ux6hhlKWn#x&*0D^e2!jrc**`gMwr2G^?E=3-FprH_q_KT3ju;9h`Vea&-=-}*hrt`-v&G{7>8e@*Bl2DhZNVB|Rq%P+lJ_1cZh3UvD?BeuF691%{VPegZLoR46pf zs)%1KPR!`dJ=y>9E+GrJJ_8v-zGuO=jnQ@&aO0dyxxAfw5Emv@gbI=+W%Zkq$P0yH zk7Vz3tTd4Y>9#G}SdsC_aY!Kr&YoaN5H_)e%VTsSQECyPhLfbV&$KokO-f`ix_O~- z+RX3u#@7dtvIq)>M7dXd@X{({xu{n7MQ16l_`MbPXzXMu%i^+Yt6P~m-}`q6ACr8$ zoNWq?0nP6a+cYUFEcW666o&`nhO|Nc;3D}Lw5^evn_2QYUis0W;Uw&`z3Lg-nOe}+ z@az@W*nYIr&4`jogm^gLB5L$>cIH7a(M}&a#{2ap;>kjJI>yTCAUH$V|0hEmBHicJ z1$pB5Jc#N?BL+zw>=dXvAMcDwh3?L)U3>FnZnp}_BBtVg z<-~q28XaI{-pEx}Zg_?XGAvujJB}}uP1>6g_Sbmcnozvv@GNW*;TqU|zhNA?Q-F#IOMLXY)=z_H@ z|HwnMRbGVjEB=R#t@(kjUI?jW$Yi6BW6D#$!yCa+Ju&>QMNWj^>9YvBb}~xNDp{~c z2*SFP;!zz7zdN=w@0rpgBAxOooT)!q#6@HvewRvum3$tJpR4g!ba-2c%Fi4cIqruj ztl#+UVn9vA8`xUC9(eCE?kR+kLZ&x=)$b!}4o!o7N{5$bQPc@%9T34IIrCVHFF_t? zer{hR$C?7RBT?A;;H&LtSfQm-E)O8Ej|WBzLj5 z3?dt{zM#dh7nlZX=*4U3p%1|v8tBGN{zLu7dPQ)dd&WM>1PYaM-I=(5wb>!!Y*Jwn z6(WYJHV0J(eB((M7R-u}IrwDvdu4HZ^jG2^`2kOfJmQkI8(7O+A13_|gxVp}g8}my z#u{@+AY_+@9QgbRz>9-u@^yA79`NBeO}pPr2(onWKpKDbATmEdTQQ7EyI3A2&7kf7rHpSA2mo- zI%PQENHJXTI7*C`tP#GYAq=1L>!}P}o77L3e|Ug-qBlNTn6^7WS1%7^c zI!K-!yWv9G?C9#xH%j$}r(WfP+h#s^gNUc|^p68@(AfjCs9HFavc|3rSiR_B!6e~E z;^kY^Fm}o31adR@GnrETthD%KP$M2YxUp*H$PeLnS>CJy@HntgPsFasGO%B>j_OcK za<_?PB0ep&eqno!&-%v0$cF~`(`vJ3TuF#ZgU_nbQq0#&$OTuj1u zAcNU?mHpA2I>4#8K;lxkGgc$uSm#6ynPYktgtpe1ZO1BArm|7W7VSxURF%nJJD$T z;4wl(7a-mh>%nX3;jA$rL^XKjXQcAkK=4dO)MIn(A8R@HbHg~EV;Bs-BmzRDgyQoG zMO3A+IYQ&(_`ve*A(U-D>A&Wh16U?wKh7*ynGR^Tug?(p$8MJo8Q6q+3Z`$9a$ST7 z;+l>^(&h*dUgMg0hcBBwVeJ3zODO37=@ev3`RY!`mhR9bu=b%vZ&Srp9=t>R1yl`g zFc54SrBs(nxTvlkTpopwHDi}M?0-!deoh!pE)F1AN|leyyl^u8;2ID^ht~5;>Mi;u z4ILjF_N&rmJ+x1IE7^xBU>5GcuW6)u@Pp!#ZlZm%!sJBu5o_!) zzRjn9Zijxl8Ycd{5uxE#Y|xE(#HF$(U@9UcW;u0XRp{pHz=z@yS7VNr>N7SWM566P z=l*yRIt2;j)wGU3XEH1}!Wn6C6&^6VXQi-hT`||qlU>xXy=7`A0uP7fOR30J8HEm< z+8|a>OUvU9yTS>fE5cW_%EVpVqpC#M#H1Ax;Z{^ z1@9^-xqOuuX&q3X{ZZf|^iOXyS<7yBK{GXSXrUYAuk}*gR5|<2gWf`m_c&IeE7zQ^ zl9JALSTUJk|7`E|^=x`Q=7Amj`U=^PF*fc_w$>v27eg@hITuR8fJjDNwY z?v6{-K*ggx*ZXLR@=FZ&L0N+1Rchm?IDrUs!f%dwR#heb5LtgJ4tS0ml3=((vD=Wq zM%-TA_^VlV^~?KZ`Pd{*?eVD_Z?Xq^1J{LxXWDZ>GR{_Va1S0)5aFt_19Cn#c79`aRl8?$kE&Wb z6_)Bts?AqX-r0Cb{Wh}-#sZmz?Sb9Qq?Y61mLgoGS!qHxe;pDW(Wo=ZpoU-fYTIv& z$j?MpZiys?pJG1p2{pV)DOpM(f1_>991Mq??U|imFDz9Z%7QgD7HKE~UVoKSmwrSQ zp*W)~c)!0rFhD#AyGkSUBV*KyU@#2#`By}BI&S`8L#yo@7VX$B(g^IV>CT)LL%O#+ zu%rLEf8&k#qP&)DY0T>!jkRAhPRf9YyhfCU%^}D=8Kt3WWQI6ullZY>h{NIP9}*7$A#Gh zVefWfIR0+MMLML|6qgr~5jx5uRrAu*XAK3<$fsY-S9hFJ^c{o)sm!>ee?kK?k%Jks~S;E z5$ATLs@N_$s@p9=R||A9u3gd}qn_dV=ss4JR}ViMYpB&de(Ve|$#0gE{3y_YDgKrD z_E6B@lK&K`8HQSkBl{~m);)Z?sEt_~a@hOTnBb%uc#@qAmp_4rixoC{X?gox^$Ltd zjwQa0?O4n`0hct%Jtl5l&jAi_FzH5-*ChljHv~6T1?RGge%Y(>7DYGbYmvMeA?>C; z3U5+;6pVTa?j#7C5vD|R6(@z!cIg}7=rzFw$D?CZ58v^WAxtyBSXG|5`JWR7Dzn~o zKM(jQn5VG4{(tw#(@x35x)7-A7BF1zl{OBr8-mq526lIJ{s6l}5@moFmaQJgruiGd zOq8P8u%rp-5MBnZ+5l+HVt)qqRnSp{!*eYyc3Gp=@-ZrOsdO<}>f?J} z6Mxn#DFtT;9wd(S2^erENuoHDY>4d7r1I;{ao}IbM8yPNxT8Z+zH(}CkfQSOk=HE& zQ^QuF!u?EdAORtkXTam#iP|B*@=HBFAJwRBf(1)uRC&R+is95`AgM0fMXNI#-#Z^f z;KK`-^AJ^=CNL1^J6VGbZP$A)1v@5HD}c6sXu}d9a;y=U^%fC5xdYfF$ADJ{J4ih2 z^Ex{5Ti;joBjmTbZICE2smBYD6BZA2?1HqWfErivv{_)sL}we68;cOR`3ipbxrUUy zNay|u=TEO{L?(H+vNZZ8MePoKUj$%ivU>-I8?LgtJ zu;=qgvnOBFktfka#dQEVHp@)O-B{2Ad7<8~@z zpyg|@$E%m&96aQ^@WY04v*C#tDbqO!;pPpzvvbtm1*}V3j{*;i$G7|@OC&*KM|JZ! z?tx9PU$W57JUYW96r4`P6W4<6#@N(!_WCoRD2xVHjJyX1DXsNPp$xv)ME!)>wb-_6 z;kfFdT-)v_@8wkMLVp# zi)M51Go7j{Vfae1DFO5Q<+XiqqIf6U#reoWFxbtvFizhOYmV z!~1y+unJU+vkKTuu$JRi@8M@NbinTm(`;acpHknnaKh%#RlUZk;rPV%UsWXXsQ4-7 zT4{_@>qH8vnk*G*`aJP9CAL&Z+VqRKMZqb1kgb))UeAMxpZ7I&SG4{swpp5RJd|4eivw zANZsa;ehb_TrNgGqbY49H8nldsTlQ`sC*mw(#t9~m%}}P=Lw@kw6#ZW0bV~q7ZPnl zoH{H$p1Y5=Oopi?gEbH(&2NhDxjWD$EWS#DI>V_8P1-YrF-P6w{sHnKLwI-Mr;U>2 zetg)6ljOHi)XDmw+(WQP4=AL=lB1_($AkA}o$M*eOr!)KK)#pC=6DQKjKft^R>VCR zy83+!vSUH$g7;_tvYokgB-byDeZ_W0om>MD{R2nn2TiOmH<04w&tJ!J4=O@XG<`@&$l81F+#C_JkOBA%Qsn z<2D3$_aLx8!wFEM4(z;tSG-qHq-PauDhABVu>WBV>> zOWs?GUzF^h@u!o%NEqYwHiaPIs7-y&~%(dW|!+ z$J$51eDB%A#HM_{u~T03M#K1W!8)Cdj)+JX;Llao_ZDd4I_rAi?roAP7M!s-E%eck!AI1D3RNEIHj2g@!$2(5?gKpg(f07N>bL=9TC+%4(i80mSA;5eeHVu zNE5~fFd5%1f_?0Ceri_Jrh12%CUMjXvknHOLPd0NuzT1WK#Qv{602#&Pt60)_`z^38 z|6cg+75OClNnWtQ0Z{Y?(xRe2*RIj78bRCUv|k(gMEqjXq@9%6WqlE#${2e@f^P-Y z$86He5cpa}rB2|hCg1H42E1aEytbcM* zR_SAeA!3D&Z20ezoIjo87uB(-M$Kst47t;GDn7H?^?J)w)dfoe@o3E_S%~FJXejc* zph}Nr=gmXE-&jfu!c&e6;FJPa`(8E4(9kX4K>i!oedjc1sQ@d5X^=SFM|jNQM;|of z1e}AEb5?Gz=3g7r*wic>2J3&+dB}_n$Fv_*A5Z2Axo4Nf97kZ#bWg9y|Mj5MUGST4 z*0Wh|I?p9HDYNRy>&b@G3yL;ZJ2-gl!<(FU1bv2e4-pwfiguO(WhFi$3tE{bvYDkP zN13^}+E@W8G|QnYHG98zQ?Z^BzrR#)4&`#7qwx5}(YhJdFd#X+yTm?U;18>W95(6{aaqI++zRkvgOj0fx%<^gO3CQ7=pXm>VB9ZQ%RJo<(!7k=PZv7BzddO!c{D zM|5d<>O8gs49pi1t%VhT!^iSB4uvP24CkSNCHyp^V`Ny4g$jjW z9;0v`ckfXMx4c9?4SRwvQ={MjHL)8mjoD#x{Jsx=y=*(l{pfV)!E4`F>|fEhz>d^C zK!O%gbOG_A-?@0C=+Ll}h3W9XmaFv;ru+3W4EMynDKs|?_v;>GrI$O}Wcxs$aihbX zI(b{o6+RTVUj@rugapmdK01%><685`4|{(q3MNk(r0AHoVGI3m_KeydxR6ul^Db-a zohn3;TxD2Ca}i$1bL@HT2E}yWHR%DjD2gZT2$~#y ztm!3e)T*Cj+5MC0!?9XX)bp>~nNqPQXRc@TM#=CM^|cs(@q`oY51y`J^%Yb4E| zk5L{4f#n832gye37tF8sdD4)`&v$u_Z(xZ>ttX0h)6EdL!gZu2lYnhvgtsSrVD(yT zqwc*C9cT0@qBi;cN8H zXjkL@tBn+hMH2O|dDIvtGc8dlOJ!n^VP8&IPtVo- zVZq?FW2Lsan`hnsg4ji3=}mKrwDUDxvyKV{BWMqOLhse~?zX`+!BulDP2-g#M# znUF%PGh(`Kvg);Y)mj?uv)R0gWTSgEVh4NiChsG#dUCZ;o>)<$ymYGVN8zoTA@=ot z`JmJjPR0%fX1MXkB3nWC`Y=v!RIv&3h-U|}|HE+#c2Q!3J8rTCy8WZkdeTf2&AgSa ziZd`X1NY&#_I(j*zRck?OcQQFL8osMYd6A}QxpnQU&IjZ@f8DC%F zv|$g2`TO=A#`z83WlV`{dedrfnJ{tbAdT^4Z#QtNws7-_&B#aydNerTuNuM8RcY-D zQ^$M7XE}RoCr09lR zNT`Pk-SF7ufz~s^#aq@-n(@CR4xIkP|ByI(KL-^jqdpE`RQo}9T*nm^wkC+@Vo&8$ z7@0dp{^-9n0c$Np4h!S8+r{$t#N#)d50ZNik(yxyDRRhgWQRJj2j!UMGIGEzE6(bg zec_75bravPS=IXJwm=uRkL^$UC-$Ai8Tt>4)BYWMMBq8`(#%Zl&?ba{AO77|#qsS~ zHZ#VO;RxbpA<VDe|vexkqjt!=wfU&kP`M*Ku?z?-T`SVYn~k#|a{SDR*#xTs+m@i?`icaqEE468mLnXn{0@%N)3$4E2MtS1F|gjwUi%U!RR z2*L}*ETKp<2h^^_TLZ+p>G-7y*J-_c*cr2!u&`y6k3bI`g~!bHF~oCk>x_J-!3u8>y<`=IsSV3Ll!yD=cm%Ib<)B{CRNxAzYBh@qV#oa zj2QEdKmEZRxeS@@{27^)0)2&8YhQhY_I4dHf$n zV2p3_DH+i$+hMVM@`F9qPdEG$N$XVGM1qF_tY*8X1U@sH+4dhN+|5;JG99jmo&{z` zzMj$kP}(T$*q;f$K$u3<%C|b^iZ{kk8DfY`AL&_873=i z7i@v|d!7gBr(wg4f}t)^C_ElM@pr89nJdFpli7j2pE$<*#X*xV*Ls?H{%lkF)$VC^ zhX9MK2lAi|kwSP{vIeWc)pDX&p1zg)Zlis!KAD!#)d)wm%z%JynW?7{?5%)-8XMX@ z9qJz>V(UKEg1*L$Ir;u~B4vji(w-Gd8Cy3r_ck|c_P{8tvOqtcD>Cf&+8W#!88w&7 zFK@ctFX|%=Mgkt31sHEYDs-D~09%NO8z-0j)6ItS?MoBmBW-p;$J96K{w9nHW1~C-itl@hW&EFi!!q78N^N`aznVKV|FY#cR8{0aAiII8iTv<6Rf5=(^Ox4?=zu z6B13l1|`T8p#uT*@0MXe*psiHqTJXkFqZ*5?H7H#1u*-5n;Tc|w8OuE6xBh0Y4K{x zObn71KpV;P#*8}hM=DZc&ZAc_C%Dgg2{PS+Y0c*^8%JXwGrkvr(0WZ8(GGrH#?3oI3~I<8b@cI1q{bnU+ud(8LT8?bR5yq?PpDVLi3_m z#yf2NDH6ATf|9SP0;03ZOiDS1lQR``8gAdJu%PrDsjDdWJK0{ma!UJPppj`Z<;Xgv zi!%J=4TyA3y>sO2K&ZX~2uUdtEFpE{_5US7(?FL~$~l(kFL#OpRpNdN)oczsxymy$ zTYaKF|0KQNJ6?uP|F5+JB{N+Z>-^~-SxYNaSf`Z_7-K; zaxKO07Xr)YW}39u;O_}^1FQt0 ze=sVKCal9Cy+N@TZuTR3Mb2pI*V~w&xAnH7aurm#L{Zd*M>^yl%5x+xDCa*77}WsM z%vQGXHm&&@y$N5su%`e~EW%rY9lIr996`BZng>QayZy8sS9J(`_`5V6_kpCyV0GD+ z(srT7qD0W;oFSZ(gTS=?s-OZc$1|kK;MAl}fcw90$pbxS-&Vm_Ym%--V= z<>d14F{Y=ioct*e6YfagiljlUoSXd@r%_#nQ=79trF_yhbMp<~ul5PfdUUqhy*=H# z+rK_EEH;e=s6JHk(8r~&S(+0wQN*Q8{v$<93mg=NDUT+Jw7+uxLhgioc-&k!d! zm~Ez)%WG=`Zy?Y85hRSni;=Ov95#&x4W>nXJjS*B9YWl`HDcnmzkD%KC+;}XjD7M= z8NiI+E_+2oaoH9t5}V7D`YTr-E-Y;30Ey*9AtBS3uTrf6_z{C@7J#Aw@lnvHvqz8@ zj?n9}li|MChkCH<+%ez))30>|3|P3+ya4|pCXvY?r})>#e%etuo%KLa><{-_P!?1@ z-YtkLlXMaS-ZixX-qkBPXPFBq6FZoG$JwX`&ghfRK@twf{k;TtYPE!5sMn*-&YVqn zx?>qOzX$xy+X8bf*Z0-cP&S9QLT!ch1!uiN&!RF?CUD6H3d`Ks==i zgNc6&Q^T>FvDlyhD&z-xM%CwolOG-T_>Vc5oUJ;3`tU%d3m_(tdTmTMblooeE_Lz@ z0fVY}+lO9dpIQ}_p?W63WQEJ)LWYCslA$E{-Z%r>cO9k$uA7MN?0j)d`8`V;XzkEk zNL`3`6O9*h-MvxyOTaoDP#FwxX8(EslCE96fVQNo5802R-lwdoHX-Qra{oHF0SE;L zacl(YTB+2rB8P-E`%?nPJw)n73t(}d$LDmhrx+dO8dQl{s$_8M-4Xa$YVuul?+jOi zW0?F~Nj9bi2N4HUIo}yBg2_0?9cBv6tsNm02Om1EkT#;I=jFhd#a)Aa%{u2@I>PbR z_YRwSBpISeTE5IBDaOxOSp&%x(#$Rs<<3H{jhvLbRoo_zFr7kA1qk;(tv*A}7p}lf z`iZX5zhapV!7Rz$6fSKG!F>^wh<@E*Lwll0Nk@Nv_@ScfpU^=eVrIzk^+veXl%*yi z3KK~R`KA0&>Fc?D@jD}25#wBUn~a2vr)tVX1(o0B@Egi9&){2YLv!uWKP~4FT^Oof z0BuMR?H+(aCEgOUygUBi|AVvFBgme|V;i*oo}s?h`uV>Z>W$=E%x4s917F1fOL&La z7kb9;Omku#(!EH-eF)z@bYDbt+Jy=b$h0<u&urzd){$mV5Z5?}`#0|yor&zL&SuUUgm(l#0JfiEo0SppA1yOegqW$Ic^5IohRr|sG9^$i*-Ve z`NWR^~~l|mD)(% z&<+hRCE(Cgeo$I@i@ocE|I?7Ri-Gyj#K;j9Pd&fuJnj5tzJX@FbZ^|VN6wW4g>)3g zhqD+%orE<8?>SE-u-4>NHlZzf;K&|lLtl=3bSKR5i`Y?Jr-YvK$fl zrbE%~8VX_v>RN&eTKIE)k=A8;N}EQ|4Xy+}EdFhNIxZsV4oAUoP|Qck4H~n>m7IV8 zQ*BAb1S2~sk$=z#VKutZ+v;#oX0UlV3XJ3k2cTx^;kx;`@J9iQ~%Pdbc~Ad+E@I5j2_B7fT*~pNQ31DmndVo|WiI z*qK1g{?+y1=?n2D;W>NhLoxSFqXyk=bo{n9t=dwL&?O7swd#3K3<7iC$R7je(2H({ z4P^c9dN%te%U9pd2xkn|wcp!6DII7Ww&A&2q{i@CY^V1Wq0UZg#N^%Kgd|G}kf@PbE18&0kmDAKM*CP4UwD_GJN+H_G;_=ONRjIyliHzs14Ot1)*Dw=a zc;PMIt&jPJ&%8xOwPQzY_!|WyKwHmC1=&4o;jCZxp;`Bby7k(@1MogLPyX6^uaWP5 zI?sEZ1>)n;6FMLA4B@Ub;XL>?2(^l=Kv~aEz5`Ssngt)2wgAqPtq|Kj_?^_=ezv*Q zfYcLSjCULT2%6TZtk)Qhz|nE`dj!q{N!(PI*W}Mzuyr1L2}Y2fyXqG2PL)4a1=d;j6$Eg>*zGA0ivhb z_ZbT#Vz(d`a2L6_>hr=msk`#9@zKka_CWZ!4u&hgRI~@ttw~^(mn|2d%u4zv;@kz^ z%h{+|L88k>iJj65@f7skFs|h4Nmn1f_@=+xhfc~6jnD6TSK}M_=zosZY2E_OIusYt z4P_cnWHBlPt;EUCpsYPHk4KONK=EqzABS8BlE-=joON;Q!|lI<>7G>ny^4|ldgP!mcM-gkor;8R@_hHiO1#UB1#?u;=1zKkJnm(9p^B1)&dQ*Q4&umj3KJ0sC=P8Y z_5BC=)_r*&=S)Yrsl}WMl1TA|Nx!=s;r#q^J&&*|Krr!XaR2`ZZvjNs z$2+NvJW)b<`q|j+D%A=m|~MWoocR9FlQtB zmD6F{o{{K>g_Lie?GoWis+PQ21Se>w@#XHc~pc zyFCw#AEzm=si;{Jg>^LFjuCJMLd$b`vQ>M zxXBhRWy{!PJ@@^2?)ylgI`S+gn)(EiDcXGpTiTPHBVWZb=a;UbH=!wh)Yb?G=GUcA z$Sv?4;Zs+1SP3kMctl07&-MNHV<#a&_WZUBNVg#I6_rY}M!9za7o z&LXK#6bNIxjzC*X{p1V9U-CN^^ibo$jBR0_CJn3AKH@@iNIf!np>JIiT9C`8G=IN| zu}-2RQn}h6rzv4Z*%BQ|uk#^B4#e#j(LaM{6XM81Y=IVtUvqxcXjI)6P^7g4$j9tBUyra z)q;TvKIjKeBr^B+NuWVFV^!+uc2Z#rASnox5DSY?!bRUZw1&R$(b{02co|ilU{^Nu zCq&aaQmMvZ*8W(>XU~D-Rp4a4G{W>+Y`a1-QMqN=D6wDa*Si1Brbq6 zObyc_Y*Kefk!!-kvq!V2Asj5pID=i&vJb%PuPMDg9okSZR7Lh==8@t4wJxb7^8syP-xJ~a#kTHie`jWfkf%Q0 z?DshId|lA1-6*NLN7zpaw|ObK;*5~D9b*)Jr+BqF_=IBmA~A`#fN$PG>%$;ovhjz$ zqTP7FgshaJCs1@!W?;Zc+kazv@$oPY`~&%n7r7?c40ZxFA%j z_bWd&f$MuxRRo;ABkB|YF^{040gI*McL)a^s2c*RvH_C6(C;YD(C)bSC?FTn!BDALn>K1gEF< z&{?VKMXI=jE_+>#xOx+O-K;N1+2uJ9&Jqj6Q`ig`Ndb4CgS00aC&gsMCvq z?Ko)uBaLp8(wt+>-z&wL!UJ1Em_pxrS+wiOLK*`GX+K@U6(pN)oDThu4s;6rW>{eK z(}`gLW})fBB)JdRQ@C&{oGC@y)IpM>+jv^%U2oiRwjIjUwnIVxZ;17z3KjZ)G8z^5 zAC3m2PXF&B>>U4TOH0W17Z3>}2W{?j{ME|{zl%}(m?=o(HI!+Phceaia8QGocrsuR zM{V%lIR;|z+wV-0j9AZe1gr3;I(V&n53eNw+2ggbA+8qQ-Mx3=RSQfl4Fb9mbECf* zd={B}84`I8lQm&5SvZCOHZGuNO_WGmnOKGmULjbBCW@vbF6(w4zZ`N391D|?#~b938*!1XnnJH>0se6|ISRfZuoR%GBe6d-`(i8^eaQtz82ldwZWMZy zNIt@jKxA`4^0RP;Ms8r17Zv~oDZmtrCaCFnRsi}<1pl9ciK@Eg=>Kw^MIwWeO6Owl zsMg~_vDWxoWvw3^Y#fIGgmtluJcK_Q5pIZe?4>u)&}r>cnynb~_Gxei81vP!9Zr|A$A%;olW=$VfB1r} z!}{Ag)*o)y4%hE1#r4CzyH^aq3j97?z{Xg8oHD4w<>Oo6o50|c6)L*~V^>w=7_aFG z8u^68eXUaoVziz^a<-@!=jYGaJbofuoeH`yK@5z zV0seh0V)1 z<}=1ziI-uLDlyschR#lGx*4Kf(9>aZ_L3{7=Mcx=o*z24Zvc?S_I&O+^!)^PL+WP` zGON&qQ*e5Iar)-{t9KXgPF{BY!u3Lx{=f3#bZz_WWww=JK$ZSKmf!zJ!%4^gx0_I= z|Gi)l!z8)q`u|rlLRIh)_?Y8`!G*ViNoud6DG1iSU%D{hY}m6*w=!&HWmwoLytZ#} zBUxqOaf|etE+kxBacIszx&bLG8dD@z&E5pW8wjYG zCHemyPCERborHZUb~}oaeg^XJJR52i@IUgU)aF3%oucLxb#B1JsWtYIWGn*yV1@dU zYuK6?K=OTXmbB4LuMG4qgS`7f!3w?3K5tOsHf07m^k3Dsi)Nw1sV`vE$M8D#Qg{+Y z|G2m~!^SIdG6iNDuQSAY3B8YpuWyJNUk5S13N8LAFO1!nDutH->FYuCs{r&1P=>P6 zh*AxNfJsWc@^w8fGUQ@00}UjWJ%Fzv-Vcs*Z$KA{%)9;MF{ z7x6>Ua`spWu=&$RH+Tyd9@=+77d!!vn*tAuv);Z=EI3Ql@S}PmVFUv>!xHf3&wTPk z=1W+u?7)@D68bYQ=qF3*tK~=^z7&8!`|BjeiKClz83tp}C;mN2e;v7Y3jLWE^`aZ_ zpT(4R6lIZNkj6LI+^r{+LWvLBo{NBkr^_pqZ}-Kwr0fw%EO#~q32>bv9m=JUEQ-T4 zbV7d$E}ormShz9c1?{R7!fj|b;UnjwR!`R*`7f1zQ zcYO|!ec*Ao~KaC9+V|vi*WtvRJk$t0YEO)JB`V1{=MqB3Fpe6?ez$kACfG z(Ebof6z z3E~wF>T;$jtv#B3*c5BQ3l{k!p$?6q&5L387FdI;+4kWDhMvf7>Qpbd=zHN6S5V^> zeIdYRaEcQRM(#HnnTOPnBj>;65cAULuE5eDkBSu_9a6S+M5>N6xX2XcgVc>;cNmHj zgA`eFYB&Tuw7%vaQV|#y2#Js(gXjvuM{ie(&NA~Jg_8BZ71x(4RM~$X%J%=mqvLUB z|GATJ5BOb5Xus-N)^!#@+gtV3R~fcH6U|Zx5Z~+2g=Zl?_6o{gAQg+sUS0DOQH@94 z7F=U0vx=q`JNurZcN$9ce=DvpRjAVcqv4^<|2P;PcKUx8;Tz`v>Q;e{{_C3$1^vGv z*Ow|(=zmQ1CE>qL4mTgJlt-;nD|6)OCH27|GD{vRJ5 zb?5(`ghyoK({X*(Ba zp0SW`h0rY3BrooRV_#EXyl+IimI1!kr(BbbR(UEk3W{w`KbzRDb7~gBuFV4zEePh+ z%&@M_+XGVpc5O~alLJ%0x+b4QsB3dNxfN-(ryQ=;5=9&|Hez{6QBq9o#vg zm#Z;rmCl12B09;|_b$6&JScPl`c$V28bPcpYSywNbP((`2c;6xkQX%K{hLT+eiJ?K zpC+o7_b)3#k7U|&qO~-Ukwn}D8DD}rCCRgp_?3rK3tS4409K8P%o$yRE_JN}2tta^ ztIBC1ybTHB^HGi>ZDc zVQyr3R8em|NM&qo0PMYcf7>>)Fx-D%e+oS6d48L8Em^)K+v=R%KC11cYJFQvZg#in zNgxuEP?G=yfVR~t-~IjJ#*0K!q$E3bLhUw|NMJBC00uLI!C>r#;m+X%GSQks-}~x5 zKJ9k9{qo>I{cX3~^M7CLzx>-*y9ax_2m3D$+Peo|wRiV+U%dPZwC@F*xlhOiWM8${ zZfl;nC-Q-WPyq#|gm<<8fK1>Kbi^bawlLjsCXkE~?||7B001<>Rp3H_0Q7F*lxLKu zL_kb zIAjXBrfIwwY*d35W2wq5$1*Bb0BnR^x>pEBl_-Ef14P{4(;%c68X*^H;&*hB&I<|S zor`W#^#jB><^mB172=U7*YqfK3wx3~*e`@83oO*18_gbe5aFl;x&d@1sJYi_FBS?I zV#q^KmW!r^0|oTxxaB}0Jfx-)lGQMBJ0O5e5H%DQi@BHw9-KBc6|cQ81cx3CUC?t8 z5m-zCBrfPW4&oe~sxjpwA~Inav}VTqL^+5eFmQ z*=ow6=3=1=j6FJpUQ3Uv79w!yA$JR;M*9{339LD{qe8j=?`$rkntV9Jr21J{i8 zRbcC}w*WU9wX48Ph@b_)X<@e#bl1nE87}g|zE}~in#c=4tpHdBqMSqv0L|1}1s)k= za@WLU%n;`bfKzW*9SwJUf`>!uAu(AT6N#5A!w(?m0c9csx_!0kEP)&@&JW1p`lC3t zkQNQ;`4x91I-=Eck(%WCy9(^YBC!BGz0j-z9dm(cD;|LcY0^|LDhy2*afjhR16NYs zh;%94BT=7_?-MFpng|i_&d$#5?QKiS^A=^}E$m1j_LY6S<5GvKU#91FM({=!ZDEIQ zU57&yN&dh5wZLG4I076A zfytNymjXfsfTIy|1R#_F$WW@TGl5KOMG%^{sx&X1kTFC=BuSL03xhF(F6t=tTR=8O za|NtQZuIj7S*h!d%`fOUC=e%B6<5!sxZweG>~Ev#o+&A$OGsUzr{%G3XtB&9970`W zimO*q!9OTT{KA3#ZtPw46uDSfoNvuDZ#b9+aeI&vOSM^?5+p-Lx{iN{n1~+U1kNFL zSqC)QE%m>hwz4j0=uC#v;!vd=FXRHTLdpQ}=cJM*Wl37 z3Zw-kdl3rcf@`Gw6#(#XDDAnfClDi0;G1+0JJk0nNj*xz)T{$iRDv-gNZH;obU_95 z&O(2P*!k%AE|J+9pd zPIi%t-94#>-%@7hp0Y5R-?wtjz}Qlv6m+G{1zunEz=*Q6PY2MEl8{M@&zfiwQw8AA z)Ih4}kCfp*sGKhs)a{0XatC_KP@DwNh!HCo1Pe7KJ|>qa@UR1U2kh!c@GkMFoe;H$ z7gtvTd-xB9;ss)koStLU0WaES_&1xtM}lF813X$%4PdSo2#$nqSXYb&pMutRpohsA zTu=`?80o1qL=$*}DeHhgKU!vVUDpT~xzza3Q~EAf;{zaa!-1fRPm-Hhsp%nS$K=Kg zl^h`1HD&P|$gpJRZU-o(NOMnDGl(rhEyO1us;-tpu1h!wBzvY?K>kpyvU5DEaO6*M z3D;xDKu)Zks$Nh220`d~8m2@!(xL}BD?@tWLm=~oQnJc@{OosUJ@C_o;%$y+TiHS2o&b8_jCB~Gb3$YXm1R)o>611&y z!RXNHbWYHx&NUJieJNo(;M?}MZ6naJz|cEF9-Q`(w4!+jyfi`z`-p}jdi+9nD`J?s z(ZfCcbOf;%GBlVl#3$5qJ7BM!O&3GZ#T5yQ>O5M?AejQ_Y8M3bjGn-Om_VWEkdtbN z02BhsW!=iEfVz=ZVFh(5$fq^^n@usnT&~r!ln*fhJt7riB)|wda&2~~A5embqUp64hAq$& zf8oj1O>>AL5i-dxdW{I*20y(S{6+hvaI^)%Ibw=1X-{Gv0q{dEBzNZ;Z*3)a_G-1K9qLo*OR5#S%zD83n2MxFb6B;tUmA8%Csg;l~KnY1iz{n1s_E*zOa+=6dOZKz1l3IL!hT>aC_CXH8vxfZBcrNWp z2srXaO>0iyqM`CYK~GIfMBHY`5mRDMW1=Lzw8|YljikJWDF;Eo&g&Ba3 zBl}8{2{kU-kRl})$0STuWjhuV2-IiO#i(JUE zRCC!71HV^3tm_%5m7vd12|C5D>!Dl75a?d?Bu^*E3jhq1y z9h7amQ9_y86*0m1;NLU^KAeJEN?gRi?PLn<)(Alk;vBMR3-ko=;Wgp_3xFWUh-rbM zqK}hp8tHG^;&@Dyc}-kkh?O{w5ELOpd>h~8#(IR!Ql&>LgpoYHm?&u>@I>w9q3Ic7oBep4)zyypU1ZUQ6-$^ z;9x(WhRWeAwWjv@Yift7xYqzO=p!K&BsnhCnH(JWhbc>79v!Pb)?lxCE!Af}CKpjG^8j(N zySIPvbu@9Xn6|)`f);Z%xYGw>2(NmX-*s&lDViyu`@9oYZv?st0$UGASJz=Z;;V0;%t4>_U* z-uqMj!Fw-t`}e_Eeli&NFWljwOeUz%94MVDh^Y9&L8KNqGyzG(auz{;WIb{c`;7 z;`p-P>kp344v*h&gZG!mN4@_0mg?Bv*}K!@)AP%Jzi)vf-2-agWL1qYQElk66N|+X zs6@)4iMKPBosI-e%>;EmM0b#hWt-5@bEUNP&`8)RXU2%0w~1q_F=pyfH^6H09wH_V zNoPKvL@{y+vv-pyE@BurR1(i2Cazo~)Uj-hgVt8Ttz4dP0GLWF0vt%xfi1H!=?RdZ6FB5{il0WKb?4I8zRU`C0Lq<*7zc07;XM%y@mODdg(vrJn5v1@A#PA$_s z3jd6VGxdK^XkI7+=7mi95SAU7W}`_=0T)c#SDHc_1d515rMePwX|2oJFAq!+HB3CN z5FOD_X%1jYLzW=tst0V^8SoEqNvQybapNt}BfuY=^etJDmxl^vq+q7?;uMXCQcm~Z zyb=TdyY|0-IrALypWxqnzx?p;y|Wwl&5QOw_a>8}?|OqbzqE(#@52B5lm2~fXek>{ za?#p&D#ij67v1S~6}c^Nq1G3PjESlhsj9lPI&B!SixLFJs=n-9NHVL~HYFdS06v05 zxmD(PXNLkM-V{tA2Yaa|r!Ujv2M$$feHAzE-4tv=U9ol?P}xVmW>VB6@gZ!m*2znwDZrqB+G}qxvfj zyLgPnw)z?d0b-8C&O<^Vrk{HB7OAZT`&i99`G!yZA@#rl2jWHX;{S1e+h%Th#Kc_S zp&TlT-e+nldai#YM7#QpjcV+Ma#~rf+V1GePF+BvFF|YlKtV3m2?>0P_#eTJJ0Xdl zK46?eF<{g&OU1o*MlKhM6_r@VT%H&WSl+vZuO#9iIIODuWts- zJXfxm*8$E@Wnn0x>&9r!P13blwSbr!uPSSVZv9t%a`c_Fp?(9>f{PCPDu#TAnS{BIO(<+p192nPY!bC7p zC=3jdN6A=n=7DH8NcP;0dEGSFH3e;Qc!QcYaTIZz#-3>kIycUE00}{?#CS9QV3U$X zDOp@lX1hP>l89AD9qD80>!v{OsM0ht7|wOPeyEP|69@I&#M$=67LTlTxWT3^%v94k zTs=FQf3NuT&WxRVWxlCs^2H=oW9_(7Z&NckZH!8ExOQC`39p?%-qhqw1YE$WF(=^k z-Uq)fm7M-2wT9{ljcp@2m6bUnX*E7JMKC7Wj7`%%)`!GK+Eg=HdsK1r$9g3rt@pu+ zm(Z-ml2}G0<&g7W!l2m$Do1@v{OgE2y~%6#d|ed%bfJJ?#Hg>NVGg{9Uj-!D7mDmm z&8K)eJcW61-#pc}{mK(8)A7B^bi+hI$IQA+pbtIy78#Q>`HH3d!eTK0yxCOI7DqoV zD7`Ikg5V7TkXu)mAzIP|pCIYI=fdE(xmyK zm!zNI4Fpujd^G>{ug)pFyX>CE(F+Ewd<=c_xC0u0d(mnqp!N@Yr&5&?NTr7XK6Mc| z?_LdloDGiqgW1(-*UCEw`xjBcQ>xPNsFF!=0dnwYss)mof3Ybd^&sV1IXUWHfM?Qf zq9e<^ZKcz10|z=2v<)~GXj>op-3DrHfqBwNrAMDofi*}c zlv>s`$-dDRL)1Hova+L2VGv+4?pP#Z4qPG^bI?abV1hjGn$a+5fpew3OV}ER3g4gC`!SjdIaZd%|x z(0g*5$Ao)>sGTfKq7&iTo8KRF&yKn$=V!-yQ|9pGsy{fs+&qi4Yd>yo9$k+sFk4og-9ZR_o`FFix*L7Jkxam-uz-$VnabIQ! zR2M%~0`{tJp&a`V#~v4(>&f*o!CdG(VIdEt4pgFz{4|=`5mqY(MI{o5f4Zl9ef)-I>M|2b{y1v75brmx6(8~0bi*GItq9l8dfSa40HpWh+TIQYL1|h!hz=VC2q&s10*Wb zW79~>oIFV2+4;qD)q#1rkifHU|G5n!tApb~9UT7!2FIr_h^d3)zl`AcrRN&wP63+3 zeJUSLJY;s{e>b}(fAfE%Cn&I zyy_jDgS}Q8Jd@w{o+s3o`GgEyK;lB?YRt7l!PQYe2FE5Zqp#07+R%ao1SEe`;$f1A zKEMPFsh9wt4zY*K#uUF6G)P4Zwzl-eUA6X8Yd>F>_7h)e_a!Mlk2a-)8M29yG9RL? zI!ycYZ?TwI@vWZPBQ!Ro_8Or8V3FJf)KdxC3zC|1{eL0hrdlcsGnM_hs`jRvx_7-z zHM7H~d`WtSm?@tqPelelN+hbd2U6=)6tzmXpweB$M;evWN^gRBQ;Q4qyjTO9AkWwL zBJtLiF1gle#jkbrn~O%6=nZ?b2N!arl#Yl$FWegN^^dcb~Yy6VmXVzmR)C5g)3|nhqL*+K4lZ;{;R~%+hjLLoUeMo+*hj-j9jB>3V1ibKci^} z+{K^e5P+{jsy*sNJ2!IxUtte*zz!0QlF`cZq;CRw7vgs?!0)cnw4fn5K|@FAeWN7! z3;jZG%9cYq39AV61n6S)4ZwF2U_rZl0-3&&D&3vxaRsKwaEh>xz!u}Kfi2;_A6+oH zfPH-TWCaS+@QSENfiI>c2CAr$vps#AK-LtDOO&65p_u3`g!DwrO5VOixFnlbvPCB* zvZ0emqa}0%m7rRfv~sL&&FUZk9vzQ$A|$oB5^buuCN>Kb1a2qDDyMWDuNw@xYBx`p zm4Z$cQ5lEm2&lshnApvjWDJ?PklF@Yz#ur$XrwHLD5ZAGqhn*qoA>hR2^|mAvkqwV z2S?{ugGPRBg;l!piG0)njo#U-^Hfc#@4Ykj$2+D|BBMndWU(X;uX-oPCE+BoF<^4B ziRgHjjB8lHCh@WmseEurq|(r;;r7n8(Y{4U9+^Vbkxj$T!8!rHBKDpOgLhmib6jAD zFA^aO^aT`r1=O>ECn-q6E`hgB`o4&weqIv41dt>u5sWqPfT4>;6<(lVK7D`L-+S>AT=w_BJph;e7rT4lSUovbPma}- z3-#neJ-Lui-an6JJ0Aaxro00hD?zG6Kq5Qb91Y#wcQ3$YzuP?T9$zG|J0?zqU8+oD zZpB+j-CjZ8O+$&ZZ##^V-|5h-RoRNJ4vAKFrM;?Cg@;O$ULV%!zUf<=wWTjX?dx(n zsuR=Qa$x?Dwy=x&wFV=98bIcBn~4%NuJv~(mr=}~u5005W8!AQodf$bCT_<>Z1DMmR+X8_DXH_qWu8flwmAww6+N)u6riWrNc z5%x4xokUKH1tA*oZi&J(2O}v!lOX2hr{mGk&71OgWI3u?!3D!X>`jh5y^19!dxr`F zOL`BCGaPYothSPTb%Y@$0*a7KRu^0iS&f11VpRQ3yd*!-2ivqr8`qaRTfAD6B1B(ks4LU&Q3es_;0V2R$ zDGSh@Ic8!Po!@V-xk??R!x%9E{eBnx0zK@;A;aW+czh@Ny2?+t*Zhj%l0znF;Tq2UlOH8D3Oqoeh((PMG z1J!<+oH|hj)g=;{LOi5uiXDT>&uIEHc5`u&&Djg2fy2Z)!+C4&Lh7QKm18CT%2o1FTEGv7}94fb*JKJ@s8^Kms>A$>;3II$Ei z5qnbZtRYJ1ar1g=wCiiU>UMF5=3LQSIpxyHwnax`Te;p;qDuZ4~I5u?SU*_)?`)tIk|7S&0QlxA^4O8b!w9G**w7tTA!b}hP?pj zbTI0-9QW4b38>3~RK`6Tx+ZYScqG(;TI>KEs7dD~j@0uOI5&0DRaCYPXtU_rsGXA^ z^scl*Q;ju)C^W)XjW$Q%8zfBtIdB&aP3sf+YD|WKtHRhPIwdz(PQj!Nr-*`~puQwP zou=Oc0P|NLTyhzm^pAaza+RXFrc5%(UU!u$4^(pwWG3_Of_TaIMwf$c!_=(AvqFw@ z6&t7vnXn~k@fm@LT*ah`@^~8V%W5{bOQSXy?gZw;Xw`O-{!Ln?ddFV@&P><}f_cT=tG0Vk}ZUZEoDh(P2c`E;yS{@BGZqa7BUS^Vz zxJ>{fr4>U_GOJmlX$dh|CzS^(BMYZSihNKBVU;EA z$?MR{yCG@MGKaBWCM+(hoi>A2<>GK3S!jb!noMx32BOUa+jJmWG5mD{(H5X@G7zm4 z@YMp*6zFvW(dL1aa?hyh#zH#uAm=uFjnbIS8g5Qhr1T#rWDF7EO`{7fiY2wZ|C5`v zh~{`g;>Ie-6DN>(0wq0j)g2o;KI!-_fP^a%97!GZ8o2`+P>+r=iVvWwU}v4N&wy$I z7Y)O4EUjWJjF26fgm*Rp-?a)vvcCdKz4#Z;2!XQiMDkan6?Kr(9G;){&R&E5`T1EY2L3oN0LsF!2-zSW zV}G@Dz+n)mqY^NuBq~&7L<~BU4TXS< zsE^^U#DNiJXsGUHL!7G=2~B?6`kfp1tbTcF-{o-Sl_>|Jf)$yw&`>6i$~05Ns)bh8 zo?M|1_cErId|WuOWC6QBUX4>R=u8$B0xsf>thhEiZqaar$=ICSiGJlUA$nht1yQ|B z4irEwqCcv(HWN7Z0}nNC(Xi=a?$8^=rnZUbK|V{OBGtJPRn22e0qiBbiE6IT9tZmw zQ${|Xn=*6Dv^G&!nKLo$OvV%fF5*iJw*psGYjNhjok+=#K;91n@=32u^HORJsRq~X zMQ?%Nx!{s079wX}nD-YIbhI?wOzIEwp%$?q0=o8G7-5%YEgyTM;?-kswBq7n0cWor z1z-!8j=j-FIFYrIs^`UW!R-I8!jA;>OpX+TE><-n$Q5|gO=O^(pD{2rW@CJAHfMMw zp;Y5X3_5#js0eVOEfc}5zzlWtC&7j2FpvC_Hy93OrHV2Fa+ob1GGP@;2FPIr3e|m@ zlw@{$qStpA;^Jm^N5z28@zdN_f!u+7xoFxZAP2Un2_|24Xr!B5I#8B2TW;W_TdmII z(pDV=%^Sq-<~ly9(fmUE7(V zcvg=$(djmG{EvgdMIRh?6|rigEy_0{ya*;6|D3 zjZiWhda|CmT^rnD7wKEf<%~MPhalBBG zJqkS!IMfe342gqcr}fP~7=}XcS(`0kwG$GzWwQvLLUtVn-~^I!2*(IKJL;dF-0VGX zyh_sY=y4=KKwXoe_2b9ppMQe? zYN>1gc#4h|M{Lx!D0W?!^)+@MKbrBJ`C8o^rdy4cr_O%+yMyE{gNpq47^PIe6}hRH zSiq;mv3g;2TX@vAI@S4~7rVok7vrC=c2EEFw-;xJ|2ZGLeodYB$;ICJtNjl*uU_)s z?|z*A^YGu-f1hhUK=IXENCgb5{Z!jh+|UI|gt#=dmbJj(cC(P`iWPU$>{3Cm`rrdh9gNum$8ylf{J5Kt-|D*nnQ(UsiV1}6Dn>b^3G#H|flD$8^$zT~tz)YpmcCVK#L zfL#?u!R>Jmfn}sWLqvh@{h(2v|24B zoala3PgY3AeH$Z#%O1>Nm#=bbOdtW2Sb!1y9#I#cx3_Xb0*z?BF?n|IA6o3n zFCFmWHQv$*bInv1PS8}_`*vm%>Y@u89Z?5Se%*tEg9H1(Xu%yYIJ_{=w1RYzE-Il* zt#K*v-TiOBD+xR*YJv0R&|mJqEDPNhmC)rpSPJ~x?@FT{6_vo{>|YA}Z{Ho1#XKq+ zy6XVHIw}BemyJ(yyGxZU=X>oHuXm}I=R9gA!-&bv5N^%WWIF7xRf0j@+1VLmF$sq) zhx$9Oy)b+gYmP2;t`Rdrd}rv<;f}WPc698W&5f;EY6a7RtmDUb$O#29(Nj|~p=3Xa zr-_%kLyqN|3CN1qe^V>^y#s?FACXPv;|5>^u@^Elm@vdA)N^GgRLx2LfIX0v=Ug~J zUqXsAou@@lCaYc+F(o^9dpTCsIn6)AoaW}}tw3x9bx@=|jnevEX*kyN#HoWN^Qbx% zOr&x$q@nz)az2P@Yb$*^rgqoV?wT*jU6XNM>w#Q01so)SplW@$nx>W0M2@2M z-3oeE;?Ul*t61i49#O3$-{#p>`Qn;d zCHjI@qQvP}b6Z$6_?5P#BMttd50HZ1(FGWV#L*Cq9+W;~TWdnKCiF#VLRlxiKfNw= z|Bk0B*9z~h>UgSlukh|Fj;Dnz0QajFVK-P@)%7UapbAu3(^0XUtLr%TM|yqVaILj0 zXe~d{p-Ks5cD8^E1vGvdIf86Jc$99fZ$d8=x{~yKoa7-t;JR zlb2XM^u@Sqt;Wf9a=*e_yuaE~oYO?kO1z)F5ZA)^GZe;sl^#t^l|$Kh(J)QaI6i-FK8V~CxCjaSF(SW*5UH|*Hvz>`Rms!CHzX< zzMk&saSx9CjqswjdTT{1sc3ywe^&gc zV{bP)&X_wB985eIRr#$je}i_&K(5+2^o_h5W6X%RzC zvFm#17BZxA=?DrY$O{0BZ-NQQoR6bj&0kiM46g5dbGrOJ8!8vOm;h& z0y}vKauDZ`P37DGKD=z0`i47dCN-x zIlraM)rmjH`m!`7ntRDM4TS$L5zTQbBRoJm08mZzR)3qB87SrWO9ZGQ=U4rHZ z(ukl8VB+E%?1s>bZ~IFKJ1z62K*3{z++<#W3?d9;^+l^0@AZK-iOv813Y&j)oB#Rk zum81#ID3Id2@3NDln;Zz9ML2B6jh5r^BA=i6Q~tqwKF4MK`IuGTBL5@hl`uD145Fic4B!mjn(B~D&qs~U zui38w06FcN>Y0-zWM0z}o?APU|K!B-6y5}Pmu7<4S6YAn(gLy3$mpINmqPMCtpHRM2jRru02c=^*Cr5U?2TK zNu@4|=n=N^<|NVU)4}X&a5y_Y9L$c72ea-7h-ANqsY zFa5#na4?wt)E~^chl5%7crfet2eY&OV0PLY%zl*5`-9nq{O@cqJC)`8gV}L^FzZQJ zmxI~i*%NtUKuaa{TV%__E*Y501|ckGH|)@lmhek`lgm_U`of^!)PQEpVj$ z1f|np2Twq74bF^y|BElL@RG>ibk* zMraM;=-Li-cHHQOX1hV}(t(8KvssB!QJlm)O5D%88BQh4v(J!UKVahag04+su>!Y- zSltS(02of_9YAn9fdb$_=ZDfa&6q4oaiTB@BAb7ZgKw05Wl}DA+G>K}42fIHuJx{K zHR)8W4&^dS$;F?ebOW(wUXok$JBJZ~`CGIXuMk%@<7UT7)uBQ|XChbJA42CEi3^5C z_^t}&fvO>CcPuC{RIu!LnIJDPcMNhQ%_5<14*)|XZV@8D#Uth5Q4s`~QDX9s$&sgW zjzqh6DlXAD@4-@NnKKidEJ_vhcQ)}@E3kEBh2NAo>wXN|h+ zbOJfpOEo#Ap&Tf(Ljw<*J2*24)01w3#}kXw?$VB5!P1MmCCB%b*%$G|36kot4iAu{ zPbFW?(~hIsQbPv1i?9?U0ue1`5_h#mEH4WhZzVeMVSO%s^2B)X)w*Ibe5u=c9dZ#z+z+OKijkd6hYY)bCRU~eO92z`>Yqnv zHk?N7AYw65$y@?%%{`cq=-eMFxW~Lo$nwRUW7UTF=z~jE zGeHsyPIcDLjpVhv;giZ-eT}>hSk+PE%tWf1TmDMB6U`R1-6&QQlTi_rn3d8t^-?p$6agxbK{+AD zid|1rVw`w!wM~w`U-f```?mSp^KVuW92%t~vyZScCoF(Z&yoa3sxd?l z*Q7lCMW4AT&lFuPI;)fLv*;iRdtpH==+d5e4+_L}ZhNz;>ysqj6hQA5PC4KLPK}=o zPM^Ts{NHE4wwvGmHq(?<9HNUoB8jQybJL~cbFHQmFadT1>j!4-O!voFN7I>nu`2bg zsc-(+0O!b8@%TGrGdhN}EiNVu^3v9YN(-cFROpP9BB3MVbm*0d#Bx#eQypj?G3x6~ zEZOiLyn8li-bpm>Q93;ZvGfF{*E;fUv5(i6cbRc`t4Kdg1ayoL%mn(_WMKuypSUon zV8z?CuXCnx3!ET$gObP466w3&=cz&O6BNGpTo}CHyf)PAR22EA@a_`&=9q3-zNp;v ziK~Zxf;SN88=OG%U;pYzpxx8>?C%C=-P^bBpY83vkI&w|ZOQMu+j}3Me?Qx8x8;-e z_s_qt7*FD0-&_`kDLJKX`LLYB-l@H@OcL%>7lHHc)!@h3;J81SU7dC}NOu}=H5wD+ zP)>kT7zDD}vUHl;r_{QuM1Smv;_ya?rmD;JpHZSVd(EWSR$iBF;6P`BwgJZiZR;}$ z+dyf_TrN-l9mNU=YQH{jfit}cgn4rBQwtfPqPo#&ByHMdQ!Y8@v`=S~v+kKecqS>G zNeX9*+8Gy6U@ovzt*0)Li+LXrfeG?nGa8oOY*#gbtqN4#7C2Wf8A-q9Q-&{BRa_8H z{o}Ji@9g;GeG43F7hxC)xJ)onG*b$UiU2Cj@XCzh-hhQ%a6wt=X=@nOKhZbHsk$w2 zZmyqu%;Z*y71LBkr-D?>*!%vVdv?@4IX^poFDKyp!;`E2;P~=E`?$=c>i^iiJUTv_ z#rVz)sxvz-SD026)_u*rtIHFmvZ%xEW~29iLgxLW^FQ*@Kkk=ptHe?l)6Y?#muA5a zlzIpfdpJhU7fgTx^dQ4!sN1jZMTi5I^zX6+$Mvk9t74bzrG#ls_!>=lD|KZ{39UA< zi(>8+;R=-eEbR&>cb#5+`x6KpG<5H+_`|W`gwoR22WB?_e#8fLUp{ z&p%5)SUj>462Yd2**f0hE|M$^9CfMLRb)ITVt4Pu!F_Zi9S?v*zv`*2l8g z{IyPM2M2S(pirUDp)}}MpeeJ96k<)i5m`)vN;i{5!rI4r;#4waM{q%Qn$4SJ?{+H9 zMFC5z=F3v!+ygDGJX)&FMQQ#PMDWiG9BEy^^yxi3QYSXey{(aVE0M#l^cXI8oR6|` z&cT{_uK^oFVgpZfXwSXMkCG?$m|VNd^IYpdi%hS&(r>mCqNGb@2uNiRypQvQI^sKj zwk~O)WHY9i6NE+YGnTL@{ZwAlX*7$afkiek@Y>Dq{2XzhKLw}y8ank@-2f*tDL4t6RM5y?L-ScKn z#{_vka3+wgifd{HKyP?2HV!6ZY15Up47!fMH&7rBx+gyXTX_wiOEp=Pmq}?;+%Tza zt2(pPwd5+@gsi^fVy^FTjP^)m%kk1gW!aY$B5JGXmv*XLl z^UK+r?&aC6clPRhc69v1)$7^dvU|9U_*|MNLIkUHuB`XY=!Nf?&M=0aLMI!7t9EiW zy-%#O6K^$CpI%KvKaBihKD9{y|JO6K9yk*QM~#XND%zQx*LWr z78?);3eHpM@f6Xk_j*k8BklC1UW=+ejI4y!X$l{W1H+*D>AV*bfh)YO>q2cdK2E2_ z(y^240L#yAoksex45m3Jl0+X^^nt@D`JE2UKzl%k;w|qB%HTLJW8Qp(y1GCEaKR`X z>i|fAM<(}A_f6kk&avhu$1_ZKXPEBI#=+ijj~(d~*fsjBld zNvOcZ{CaJg`ev`--N|KtcEOO3LtlNjFZ%r>_4~>b44NNRsQwv~5&;OBB1`QxCT=FR zYZ9vu#JJ1Q&&hS3Zg7pn#5OVAMqI!#vX4rbW^aaXUU((QUtdgR;`~tl>S$Q3qOK+~ z4L%V~HA!w&MRktaFGNRmJQ`+-(zPX$KwKQFZCt;?!LZcq#3OqJr9Lt!c^$;p=0z9U zsjXv^JX4+PO>WOVppLO{dT99?m8bxQ(78rL1s|}G=tG$*w~FV&U>0SOndwtVGycJw z(Z)#ET`vu zczh@N`YMl~Zm;;$*^ZQuhM>ipWX}rmn)2*`rNQOl80Le{OkI*_s5&*!NJ{|zURClr})_U7JvAT z@4a4M3ikyR*fEUx8BKr2C9KsHXObL| z+BZ(QIdK1INH&S^lDFzGq^{0|UI|J4!(6i5bi!SofSE%rSSIiW73AGDnxaYKrAugs znWL$N9T*)2*+uT>?2=caH>e_+{>n zNWvd_`!?rXSGu`1#)Fp4o7z5$ko__TNKF1y-#)X$Vx{dfRrx9Ho+YTQynB`+_Q`IZ zWsf!;oAh93jC6CW4>>jSqKK}*3&)s%Co%?O;#V7ixwJphA-RMP-O$A=MHd%vL&ae} zvGHK}u)#qQv*D2rjpfp6tC|iq`ru}U56+zl52daAA%q?tVdMgr`Vi|hH1mm|mFa~E z7tr&P4iB3?%I5jCN9y$z9{Kn88+0JA{m!l`%jVr?x^L0(fgR4~3swNO+3#5F=i z#3}+=ReUO%prx{^xQ&T?q%t*kwybv=RMGwAodnG$`;m5iiRHBT_1rQucF=`eDWv@M z;c-qhvhmJsA{;qzn>JO;EO479%clCy`O+w5%wK(Q$z_yovxKWMQ}6>{rwF%sO}$|+ z0Q#l?^;@pycDE^@E(eqV6^h8Ud)EY30ChOf0XR_lhL=bi%3I*v)Ja!S8NQ*tnA=__ ze)5ApzM{}ndWk_40!@udSmOwMgS;u=4kU}$7U~?Q%6A$Du1ab%L103;;QGG8#P*pY z3WkFEk^q%2GrwaqSG&co5tu%{&6s31AU&8BqCj!Nfy~@by-evV!H`V0SmsnqZc~ng zF%;+)P9s&@hoo4LGYBvyjvXRYGFLiSsK&R6EolzxA z2se2@)lR0~V@U3vsZvcob_{|&Bsz(*w921qzn z8Z?8#Q+FaMHO)}7{7UD|P5dNEC3JbI&m^mGz{4P*OmYM=)Un)~CCFYk*e3(zGKD^2 zoIR1jo51+th5wz39i&V&Iv|f*pd7mv>!C92FA8BOMQm^gfA1laixP#RIucqREKPN9uCC zCvS5^`9ixWJAtHTPgCMm(|Mv1aZ;#gZ>6 z_uxFikF>j&nz5Cy^-x=mhaSv!2hZQ`5tjzs+)O;8%zE<7JqIa=w-Yjki14O5(q}kb z;_vx44S^4*=J4tiI3X9*2SI%40_4VvelNE!LC>SNIvLjST>uHscKM{6s~(afT>N8@ zWzW+E3b$?B?w+=7+wPvWZJX1!ZQHhO+nTm-&+q@d@!q&!YFAd}K0D&%j+3Wytz23H z*M4A&1qXuGJIsKXfeYHeV9~zCT%wN2);j=62yex|cag8WbUx3MI$qx3lZcVPo46uFXb1ahKw{3f22L2%-A<3k z#eg`wxMLe3tWMAI}M|uTTRY)v><*p@I@#3-9c0Yg0 zW*YH9arJTMug>B>;MdI(OUO_>UP7!I#vQ9=OPI=AafP`wcl+P3b zy+ejH%}Xov5D1P=W>LZde2=HU3<&Pj!`=Vu0-CxFV`tZy8$JK)@ODEgrVB$r#IaPt%-Z1UHhUt6A@f zX)#4tfjJbqWO1e{tDkHtay|lOSQf`s?}X1&Vy84bevU(!e~Y#9eVi#^>IH?yMPxh_ zokI(w2swKmr%?cZLJ95_;T3U}PZz7I`)Ru!N2_`fV~`U(-l85cEarXRS=(s&cx^C6 zCItHO{wb7Ywb;65`+i?+w6sj^e7#*>Z6v?Gebm_QGoxqxxW2*<@u=cdH;FeVyiXtz4@(PeS80{*>y5q3V^W558sjNdMEyF)<-7sh=TWv z1|e9ssdA!ON;PYsWEN0wT260x06oQtVo$NRg4tdq*m1KL6?aeyOvvCSXBG>GMf(C4>;=9;03v&vWM}b_QYS`R0t#xRU4LY*_a9Gt6ZRb15)j37z zKx75AKhH;~gQGUVF#*wGu8%w#L0_#>$j8Gh%Oe1uzkx-iOE2^Q=e*Nd)Fw+QRz75B zAG0qXbxdV9Fi+V)DJ*qnQX>PnF%u{ob>4lD+UOcX8|5}^c1Os#vvp7)uXGs=azY(a zT*m32`fz_A{k#JE@=dKsWffx5gj|-8tm6|-qsm3%rLomjaVJQ<`W7wme{J_ppE9BR zxM_}(p}M1>1~v2tXZW_YsUPBP>_P@EqLArF!@{TvzNslWtt5|RJ@#j3s)#~Wq)8AS zYll{Ff-_pYRMLCQt{zBw2*BdoLj`gnrue@n@+{6`>oCZ{WYvmHva|BA2Ti)>Fj3KA z?1cv-2;++(Lx9HXa;;Q~jq3M#IqDviy&g2muTf+Xl&CUHywgvAhw=-%Rs8*3Wo+v} zPDPy;I(CFBBg4B*s^ekJzF8;^~iUOjTP;RAp?U+?7zY zLiyI{(?z?@p)q$A&sY<=yGBP7dD|1oNnhDN^WQ9?t}ag9Gu~3}uff=QLg%XRm4xoR z!<9t!|2eE=8$~K!Nql*U+FeP|dU*9@A5J=k$Ba~E_SZZyY}91jGo#wQABM&{Jz6_jVDQ( z_BL2e5H5A~RHwJ%^nS?H5KUQW2$j;LHG;Ct@Y88_p4z|Oro+{8|L=9G%-U#j^sFR&0*fr*PE%+i&}4 zngHjzFx9NNsK7|Su1{%qq&4U++Z+QK@KzxH7?F58ff??1Z)6UVi+HFtFE7`~YnXrEA3!NrE z#AEuSpPipOJv2Pip~GG)f1+ki>(S{hcmGp`x~XGNLuG98UGvdd=+W+-BFF6OBwTT{ zj#w#v`H4P?o>e~UP)ehA#(oo}?*9#FMe8WvKf$+-5Q|A!qld4oqMDelEHa&?LxzmI z{;dHy8@JBpP3ph4wSd-oi*N{`O^gCS18~^8WHJ_bN|&*si#Hf4IGno4!hp#%_-c4p zTo_y4MfG%%uA79Uy_Hy!FTIkK{KIYHEyjUG=&OE0#L3vE)x8(OzgD62jSL}{9u7;Q zz5XAo@W{dpT!gKc^lk@RMF2mpETF#0W9<$Zdh2o{4ElA0-KC|2{|WyVmtB)wr0%ZpufAL{yV( z^%WOsJJAlmyH3$!kk3J+-{SKa9eiM7!{ z4{4%&Rp)e)F!#Z8vFZ!EA>IdYa&LYK6FstahfqRV8yD9>2eu>cN6YkW*aruFKp>GN zrL*hNqYmAelxqjo@gc99E}wAi;Ng_{yEMFa)aVf`3V>mKzf^ueo4ON!LZDgaIOyB~ ziW2}2-9b3?DEhv3Fft26H{mpR&|Ko%lE756x7c0=gJ06F^e2P{xVO!FgnfwitIP;f zehSal2M556vNsZm(JXT(M=ANCpns)A(>~CJ3Pelp9%Tc3xeDNE&DW={Ncoo`n-wxx zi^ADD{#rJYt1{p}3S2=xYD*9Aj`Z#3!^3s(M^iXAe__c?*os?q16PO;s;rksR3zdQ zL#rndvsJ5RU$;)L6SKe3M2;~ONrHi$A%7j^Ywc@R3=;Sc$tM=sQ_Pis%;g-^5n>VS ze|@PF=`gc8hedw2n}kUra`hZ02szJ}Ps(LAQo)wVYO082K~kI{{Gb|padthM+ClUVpx*|a{JEBqYH~_zm76O6Vq8S{y(kqi(9^f9j&?&0SI zue85<1tg@k7k>JldksX`9C45q#qWpE;2q=!orw$rG)O}k(|e~KAOi22$-w`|kQTxH zg*Xc5Tj3Lc_MMH1p+hHW>b;ZSC$V=rq5e2vr0x>M{bl1Rn{NTbg&E0KL?SS2^Qd~ zg*nQxkf1)oBe~E$@W2!H;(2TbVcHyCq zoh#?1A8Nx>tE9dHyaC|-0PJb#lfg-6l7+66Qgv^z?9RX<>8v|BV+yk3&hYcAE>!ud z^TY5-Un~e`i=i(!oW5FdHk?kWZH(rkt0-QwKfzMOb=4ioB0noXn0`FqyzZn@ao%+Q zZ*3&$qV@h~C7R0@$o`~>y!}b|qW-^&Wuk@L!wFM>rJU1)TiVREf0K%b>+j99jP_#6 z5cQp<#Mg=s7oeQoy;u)%X}p;b!9Pk}MfyF}T}8Ej${vdaHKIDUm1kqmWr97F02ec$ zpkpp%g3FbcGN67oyUGyMs@YKg+sxZmrU&?$v20XF_*3fHQvEn<(ET|7FLBvY3CG}X z6$|n?nAzB95r$~k(inYFb=1XB91p3+upEZ?O6rfG!gC##H~BS^!R!Sz)N(I+@95vIP`;|6H_WXBS%cPGmno1g4> zw#>V=Uh+=j)$R;oa^+h6Io-6wAzJpt<;zRl`otv`gRcQW=33iRHaqcibZdlboBU`p z8qk;eyuYh>yHDgZq=Rt<`3wAm54#G(@nYZ2YDE{k?-+4OL;%lmFzJ$>wSxx63! zf7AfsbuaO~K-aMca(9s(0N2#6nl{qOufx5*J{(W5?E*jHcE$Y=pJEdYeV<9SG9l0X zen?S1oAE`>(KkTi+N3NJf&rY!qr#RGiI$S#;gCSEp^Zj$U}nQ~g%qGwLMlQMd&_jQ z(1>cJGqwnZt0MYfAkg8!y4Mvot1B(Rfuc-cAz>BWmWyzh0YHElO$<;xwotr5vjfC` zv;hM73Affg0-2pubVpf90C8aAfQ#nF%VK(G_7E5XK=#uY5k<2n0FA_{n@5+rc_;fC z_LS@PPAlmq3>Z~I7Vei-Z9y>Rp(B9y<%tN$v>m1S1_bq9c!cK-T#h1uQU8K%&{U7F zm{0F342r)q8WjIZ(8@(=;lUGnqYHLFxjEuu_BR~_fh}?_<0zySYc0-J6{Xit4MQ~h z(A)m#>0|(xY0)wcJMxx;?Gnxzmv9Kg7)c!cQvS363#UEmBm7(cu8L}Qs2Fe5`1KWO zZdRNLH7k&Nw*qF?X{k(frzDm4c3;M8@!7+DjhBVj;`QvaPNDt%tlR7g|8%_ky@h_& z#9HKb75cY!S`>6OMpad<=wbv^9}r9@ z!Cbe6LC_TMq9C!0@)8+XUS!z%6!JptVmNodf_=mc?L9p;lVZ;0TYbb-Rn_!>l^|3k zK{0eUu>hNpay}70^}=W~z)v=t;vr zJjS-0SyKCl|7!bB5>UoGo9HP{J1hC9Z z5!_vz_O6yzUBCk1&G+4N#@6z-O~sZ~PfDY%C^kL;5x1skv&qz;Y4RI!kF^98pp&_LO zsR^HSP}?76Nw)9UpCajmr9W6$YY!cFRQ0-s7qaPOhHnb{6YF;b*Qy+Mf=;yx!&(6! z@mf-#IYC95x9a0Bhe%=Ej@5!G~FJEH`H& zXZ(BSHp~j&b)HdC!wnD&^KWB zK)lbjD^|fA0nb~mY)Sor{>i6NeeM?sOAkG zw4oq~d-vAZi`fWI&16qMI&i^3BAVEgr+b*Agblwk{}ldwdBL0HS9_v$^IlTg$che! zUyPqnAEnGoN#(1W#7xLmDTdX8>lGGY@UMG?&{12Dfh)+YP#uxa)nW%tEzR+GOr-cc zBOpuf)d`(~uKuP3nhT8eg#y;cO&fPRDr&%B zV3^k)u9gaTRiCtk9rfqjpE9MA7jifA!Bd@sbdCl!vfa;Rf+)SOwOxSaGkGI~>z~Zs;US3wmJYo~pw9dMQJIyoebljOc?Urr z!sKn3=>wus9{!P;5fsoSE$Lvia>>8?l?0__+(Lv$3n9g75cf8AOV|Q?%xXxRb)`l* z3@m6{dihzc0AC2v6%{90w$ss(?{ynJ6EQP#I_E`M$Sl4NyF`_I0>nz^I9^=F0Jd_l z9o}CDm`YBE!A?l`0ZDP-d8+D|m_>y#VT~%^<>ot!y;f?18r4oL&=ti z4R*0)1V~DjHlK}PrN<|~>Q%SFK=iAFTToiGBW?L+cBx?*CzjXg>c5kPrdz?QDxM8xj+@>nD<=%J@rKvE0^Wv*l_-~2h?doGve%SDxdTis&b_Et|qs(-d5~~VZAcH1WdDjqw0KCs!$&vqYF%s-t)vu_Ve-G9o-G)_#dq*mheLukLc8Ac z62wec@x|E?)u5=VbyNl^emhnmYg~GYi4dr&4^H%Z*>&j)Oap>1 z{`55n{{C|ILKfGsCH)1zmrxn8IZK82`qQ4o_#9JM>T4YUnw!eZ39GUJaaA0@Uhj@7 zo-4_Q`VeKcGI@h%jg=;;rD6OWeVh^!U`+B8H0^t;pbz=!NK@F?k~{75PXxOk9=fW- zWKrc*rQ~l5F-m>2APgdhG?sQ?69CR=VcGRm z`Gb7dY|S|@Z>r%Joa&rOC^ffA6Q7N8>ea3C^99D%U*k!?u1fcZWvoD7zpO4eZc(Go zg|FiG{3L6W84HkW(JxQj?kKIfsO>~V@5#05sZu8;HPRXq&><}`6*c3dnGYDn?{2D;fQSblg^B=DVgQ?)`+y0*r$$ur+1>JVYFn;42_4Bm8ne=ZTS(!nMM`gjj{;c zSI%CZYq09ZJ#v7P?p#i`aNhGL3K}EM52U7z6} zz>XvB$si6aL(4b`9RA&X-DVb(E3Nphe2T(2XdN&{cA>WQU=UJ3GTeO-wZ2TC@n&SWsC6gAEvdN zjD*f$_ruM{juwv%WDm7k2jT(ra*JZ`1tJ(_Fwpc=9Qd_Xtbi_~g%cAV!And_znnQ} zAM_6<+}K5ngoFjfAPOzVAuopkJ*DNBUWE{mu*@~2Y?Ccy>^p$GHEM|C&0TjX^Rbm3 zl|kr?liCs=)U;$4%KkHz5qwwD;ALo~+UTnUpjsDT2p~6!CQGQhMI@`X)2V|q&?9!i zUJ+N$`j`7py@1c%zWTIowymjB$24RwDq9x5kIweylOx`eluJ%Ug0>C52V9Y$(nmK+ z9IQ1kU9933p6oKMDXOh7!+299)9qMOG|L0ceJg-uvayG}5s7KvI9t*Jd(p2=LGhy7 z@xW((mwUm$XCofEW=B3&r_Je-+QJj99yw1=A)N{vsfvMc^w@i?@lDYZ27c|!>nnV( ztyLR#_0iX@AB{obFV$af^z!|FIFgNEoCQ}JuCwn)FIz)*#yu zlK>A880^KdvP8%0Ws)PTbBc`rCx*9T9Oh`Q%F;atiV|N#iR&p&jb%D3h7J>To3++B zMQJ*Z{z!tYT&xsFfk7@b-y=tgjs?dcB52AOg!75;_5J@7G57jw^J6;)Y5(A=^;my>ntk0~DABNS}%c zV{-UA4u;G**(wn4#TEQ!Cv4%YVk*a%`(bN$XK!YM&*%OAX)o#dYv>q$BVo+${I%r9 zcN52^JL3Bj*fT454xZb=5ksyiVB_4%gjXxU{i7#S&sJ2o`I`Vv!f9Ay@x1h`=0&@S zYW}AclrD`v$V-_Fnz6?LS53vpe%ET|Q306zKG%dllpXM9R*kL(4?Ct^&l2YE9OT!F-lBzrFvxvLbGu${ zj%9`C%LlI0!eZMmTDsI56vSx@uD9(-$`UB9QE9zzvP#?v~J zka*yPnJ*}xvSBsvGb@ZD$}%^+rrST>r;lZ)NidNrJpHfsYK5yMB1)VpY32If&AmW8 za7poxT)cp<5jd{!aMyTT%|U*IjIw|_bZqO)D#=f(G-YcOnap;DySKjw6lrS#%zxyU zRA@(a$&gjTh`C7x&l%@M{X6~6+v@659l|RbEy%FVR0csxXy$r_-KS zaQPRm>UMGY$BdZJ|Y7pQa@Gu7xPV@Mk`fRuejJaX0O$^H}H0e(j8 zjG?U)mm9vo_fC);(#;bVc{G=tls?UAZ(V3}$Y*z`8~@FdV8EL(Z(W=dpUsmq_M8Fl zZ2ZsdtrNZE@wXENwXDf50hh?)?czw1XJ<1_s1PsKkhw*#%*U&$i&o`Bm(Fe6aO|DNVEis(+{;`<>&NuZ@@WMec7ObOpWoq7Nm^)+_@KrH{Ttb zBEhx{S~QQSK5{7_jIg688y6ob--Qt8hAv=aq!;sL<7Gi)*iq|d{sR}@YBG0Zzil;v zq~!Rj;^hX!d=}%t=RZ)rI3@;M=x5O&kRlacU*TODj~R_Z%8amzdTZE$Qi>>1>s+J? zjhzAd1*0P;?l;VfZJ@WX@@PjP?qn8WYRpSj=!6Vnj__NcG^6mmtfm`il2K|0nPLjj zj;*O<5fhmlX{?xO0tZy+48>wR32Ao*A!Pj_44QkPA8Y114m&4wiWI$+12E6%!@Sxl zSH*}+h9r6ADZ9Af7Yh|V8T8b2(q^SP3nhKs{s^8Ip{TuiYYtTkwB_J&^nl31lihZGs5%@L+!p5P;@PoUP% ziY;|1WLo2|OBw$~AfD?20n7dvW_=AXP`T%Kw*Ce%?dc>v#QDJlCxq07#FYafK=fEK zQw_<@z|1#roTT?+#cAXd6`~wgIa)6|q@Vhj^fzSUI09NOZ;I(Lvcm>^PLS~4&83`58RxX@G12)+W3At7wx0zivYI>+jGh?{z8V!&Q?M+F*K? z($pPrB>Ra2wj`3SKh`j^;B%p3Ne264yX5faM5t+NsiB%BD>2fQQ+wEh!s> zbSo&aFNx!r9cL9vJFlN(^yb2?hjxo0$eM%`k-4lL0ckI`zt(o0ZVmxoG!V#PfdZ8n zr)8h^!u%Oq*F`_oa9($uzDRxFjsb5&SB)MZVbdDnXF)+yBw>1tC&}6A{UIGBX8HHL zYs^ps3mRZl?dJ&+JwAcULeGoMs5bgfD9WCLyy%j7LHo+@B? zcgml}NX|v(L&^7VdU8PKcJ$@dG}Bwzww{Th)}PALfqsHSRLgJTDY%Rwp_ z4{|pG$xk`HzCLz=Xr4GROjDZ{5whAv;(wCszfLr`5Y2Krf*1`EU%R3tcE;y(LZi+W z9p<}R5mr?YYtIl3@x6O7qiE0MgPDl-5~2V|f2ZYD>{Gh1 zxj@gzc(0pf{X~Iz*uRZVKA`)RY^L*SoX**5ONX+euyy&SaPu1y%ISzfqZLOD)lVeS z7Il|K$)W;lbU(O>na0gGWdXuRvD{A{Q8E&@K3zRVyFVlv-IJ;qW@whBV6ys$ql6}TV3n0kdC)| zTYC+7ob7Xqxbey=zvQpp#!Tf%?5p&L_HOS$TuF1)IyMdxil|#9HM^XOi>PCgi2%W0 zTeKJETAK|szYuBZ*+kefxrZ+D9u%6%!9b2Olov&yh5J#T=2oZRQ3qCwc~?kemB-Ke zZ5c9lx(_49tG2%@@lX$+Jc*M7db6o59c+z9N$i$JgB!DI#sk!;6P=-6qfGXF;Bk^7 z<2=DMd5vS#qaveL4={>*b!LQq;C$EUQ_AWC_oUlu>CrhndcJUR!N^Z)4|>dozIc<2 zl<(BPX|fyi{27bY+)mVe6eTgO)<=>nne?PO%d&PK1NRYe zvz{qXZp5d4B8mz7&h`zEh3C6)WZvY!IKcLl_^+HdCPMg0XQu{2%YE4J5I)N*>KLGwldU+MJUVx|5^$@ML;ap4nRW>#@2^mV z-TS7Da`-)B_+%N^lb1jhgVSN~POVd{2>o^cS zljJv_ggnSm0Ao`ITIa9vP&K2bVrRRVdxQ?Vh%tqAuVK)%e%y&#{GZq5%6jDEyXsMu zzPL|@3s5N$@|;0Hqgi#84RiRcxqd|^j6-cY))h@lgyI4v^_~&s&fjy`SoU*RIASm*kzD+C8Jrpqnn&(FPer;9GDfX z7eMvaEzCnR8u+h^q=0IVleA-%fcoaANBu#^>eJ4^M5*d-=jkC@%71d|%Fqkxn(9vC zHR!i86fzq2vGwa9u9EY52#(foSNdqDLd;~HhpXsaKSU^+g(b!g-d!p`@gZvnNHEcAZ6|OLv+dvZBgSLn9U)Mr{bm{^NAENpV75P;SV%$drjMjz-?PDq=QmW)1o=^_s z?t7>QS3Y9}(pL^8ba?SP*M=lL*!-8;(?}RNpqhMe)1;n3E+2If<(y09-~J;qj# z!1Tu0NGEh(Uq~ymZ;)sl{H2{wb%TsFfb^Z2*P39Sm3{rHWBtm2<47K{k$iv( zi3Vam^Xx3hP@l#8So&Ug@fF5YzCvf{biKNc#DJFQ7D8Di13^LM?B>H8e~(2_c3a= zhz?+4IeKA-iK;j!0MYTRb*luEK=b1~QfW(48z}dXoliIU+-ZJn{pz9H-7q9?~Mp9=Dh4I!6g!K4q5f)(m?rE<0MmO zb1h*Gcv9+J*XH1j$MS5HzjD+cifj-s_oy7HVZXuKj(G2JhhOl(PG>B4i z#bz`ODlS~y4pBE$9w9!-)HgSC=z~noR*vNCQ{=urPLpAvxbr{Tbaln=EnHkQ^!rLF zEljiYCsb$w6yd&H%)upn4A=X4awkSvcno4g;-dK{BH*5D`40B{P1 zI2(zRp|1;^uUH5GR_>q_nE5Oh}jMCgZQEY0xK00IJ2S62kJ^i?(8=I>+t1e*AL#TCKX*pJ_Q!c@Vo z<9b)v&}k!a+@4-&o^KM(F5X1)B09oCyE(STJx6ey^WOD31a&O37Eb4(o9{d26IT4l zFO`Tx;%CSNmf8X}Vcd6xtL5Y4)TD|y9id03b@o`{L-PmD|=9o#}4-CI^@nQT+6bevYH!xmalm z6l{M5>uGLhK{ic2L?&$1Qr{e6k(3icHQH`r-lLMUa)p|fAndZJA#j4u;bxa1tqIcd zewUaIH{koG?J>GnzK@Xo=EIss=!6rZnGaip4*6ne@h%lS$?>$UpI`BIKcC-@R7%}m+Ogk$@D%jEsWH8Yg+$qBc8@B0G@S$i_ohQ^s#T63 zJfZn1CS3RVa1nL4D-fs;BJO<)n|d>o3Uo$?*`Z^~GmVB4$=c;wSae#zsdT1I$|XK} z)w8Qm28obQENk90mRy0X4_OcEa8|MQcH5EPcXeNUAZz|<8`Gv~*KyI^%+g{z{Giwq zHAK5=`pA_UZa^2UaouIbc81J9akH@;)(II84%dn(4QX8UbizZNLYTR{c`KoVoF#K( zjj93{U35>N7GN`SsKUnd+c|6XtJg$55xze1xNhGpTIh$Q@YQ}eY|!gF(S!N|=MD=c ziDwNj77t~vY&^Hnt=T{ez!pP<4C0fLJX)#X=4-%^xswJ*o|2B}Otc#F<+?J4e8;VD zp3{}(bFl(=>+&^(W%@;oJ_HyPL;-=2!5ps6ot;W#h=Zhj(Ayv+I=`$BQ4#Q~Gxr?= z%m?Ge+tTp@j4IfO!q=}J6hMy>6rnf%kM!cKD3drc4h9z{GYHp|0OFlzxnC^yp$`=S zhONNju`mSIA84%|X9%TJKUp-M%B=GXgxTkjso0JmD@XF}D*Ty)4MA@s);MYNJbv1kQy-@__fYaV#VFdo0 zNhMC@zVjVcKadZWkPd=O35fqo%vmDn@=ost+akG`8c9TH3Ji3mlJCpqI!VygM$g8W z&EYLWZS#c?Mq#cR39cBu|EG|+r6==x2c&>N@CyS>Km>k*8UJSbuqjTV1$A6x$aB0j z>9CW#z>@fuh(z%)w^od%Yry3k)lsxqaGD}~=%bQD$9DQ~cP`J+dUweT2p&AgD?$SQ zDP6mLw8Sp#S;?7?LyogG*8uxkjyseTmP6##d5&)_|ECf;)Vv}#qjM7YDXy(`1|xTS zKj?8+IkyQ}K}4B#;a_3ZDu7YO%Q>w8UO$71f z;3LQ4cwrFGj3LzomeB#59I2!5cCYr7wv8Bf7&tlVsL*igAjbKZ-DNdo7vJMh1k^VR z{bi-n@;W+vW_2kO8%9J6R_bFLgPe8}1zlEu^B#maq;))#+>W0}M2gyFh=rlLjtT63 z#2w_>IGNS0%uWqrE)1eA`A277DdT#K`BUwpIN6J3Y*^>RXgkJXQFcxlVix(Ov5)wR z@vTzr(pDGt;F9>ORNc#~z3A;;!VLa>=5)T(Fk_QgTk}*{l;!Y~F_ObiXv0=WU1&`Fvj4bNIN+95>HL zb*(QxWiFn64iTL^<$XNccuDoNuUn#2+51Pne<##riq`$Ak~Lhz1gJBa2g!OFL2 zz*oK!1G)42T2=i>tt04{ZYcSUQE>Ws_V)`P~G_r>7==-Q7QI*AZ*r`Dk~!JATPId=qkS`8bW*dT$Cz;trOrlJZQ_=5;h zP)1TnN^z@nUum%UmR0XR5H6!$7gn5} zP^u#h?ONO`c4sBYrWi+g2mYvN`jWOj(2rE;2N)|Z)4+(A7(o7d>A*81MW0~M3(;vx zwpkl3AFv$;7}u%Fl6=CTvF_qp~uy8FA`E=SxmmpE_vF$;(H%sBRWF^$RjOnkkat0p>IpB|53yn0b~Q_Mh~Y zTY|rZcz*-q2tTC5dpbNV0VT2uE&9D6d|s{}9^CvqbnGw$2n6HxyKpL~LTw?1_OIrk zR;;&Ee#-ChVkQSF8IJOF;+sebI%glW*d7sTWxFUi7m*ICKxWfxnJqpFZ^^q?n-zXY zIG4N?`VM0}1Nm0R$~G@gESSwoi|JA7W9J@>DF@C|N8%h{ z7N`n*6O(j>#_!44=mOU(y z1k;8>s}6dyhXV>luC%hO_TC?pReE$`lOS>8Ob^4{gds~{KLJLC6FTi!v!)zlv<2K^ zb(nAkLv6w;&i4f%^0<8l(o$>nOPaRVdw;j)30lfzIh3MY2Q@6)wp>&p7W?4DEl3Er za@%WVT}^eMQO}5ym!&6h%2T5EC)cPi!v|S4KyJo0%o^Gg=##OBi|X7+mP2Pc@z7xn z79e(+J8L3h4j@UPL`_d0SDeskmB*A9zTBW|4Wx`5+{`q?eSI!P4s7?t$nJC-Umt(n zJN+=oH&_XME1Szy58yc9SMpy+BXRXikr7#;oXCtHx_~5B;^a*J9wzSlxf3 z+Zo(`Mi{9)=d>4M-HNW@T*U1#DXpAK)$sK3dVhj&_fz5gP%Uv@=dwvt@ycXw(*c(! zo2`VIU!Gp6Ip&X-p%L#yTAavAx##cNbT1Pa3$F=yc&um>A0xwx&m5!@*X#1&g(qJ- zbm>C%gcju7_!SJoVA^ivTknj%>P;8fVfzk>z^Q*t3UZ_Q(fw;DCGOWoJadQq8Lir& zFSTB}uV+L1A7A4G(WF^vY##YVcPFj7RV2moigpZb8Ey%li}d%9Yl#OL&?IT zpgERDh#xFBB<$0hGds+Z=$md`#=})dE!%6v<6K!)`;&2od-3EV46GVIkd!gP8^6s8 z>kS2*R$`#O#$}cs?L04M8U;w<=1l#~8IZGg&KM`(8|RN9H`(dg^{)Q6#e3R4Z@!@4 zJAT)In%kEAq$n|xJqS<}&yd|rp{WADu6AXqodyBXaSbr463!$6Dg`&m>|2zKq_w8#TI8pI_&Qw=usu+F6=F1yG&gIRJLulA)BEr437kBPqX z68pwA%&lnZ&Kbm#p-py!-KU+z0NB>71nR&hGPRai;=rS^qY+CBQhdepw?uhfKfthk zJh?z0cXB_qdHhWdRe=V`#N#}Qh0+HIo+)4nRTZps*LFF0>YT6R#e-Z46naX%0KNvs zs$AhIg?lG6BGF-1R1^bhg4=1URr}p?%mLe(m)qadn8xZhhKDsfp)5pHC)K}mahcSG zx7w-U`rX?IY-qxK%8Izw222U&*if!?G|`{%(e7py0)NY@^nwk<4H!05N^{vP+TNTaEAQFh@2D{&qYW%H7udM1yQJ2 zw5`&`qB(EG2@oDL6{igc-T`z+bElrDQQ{$@?je(QSB&`Ioii*fN|ffn8Ap^9SyPlK z=IQ$Y4g96b+pM*sDgPe;$3Qs0aa&1Z6@@Vy8D~bo0wj+UJd`uR1r}r!`&^1i!E_=N z2kprf7BVl%jAF7er^!nY=5mFMnD4V|z5KBdB$}d=z5TuJV6T1HJ=iN)h95s#gTfdJ z$J^WX$B*c-^CR|S!m~tHSi|V{RxVj66~xfix>8Xw(yv`q5-c_X=C31N%~R#N(hpnZ z@Ym)wep5rXaxSXS%*O zvOP^TpIi=>`|&tPtjtSMcq7isv2oP+jvL0=WurjDTpXXNqC@o%6b`u@TM8WskG55`H-b=~#O=l{yZO`6}V+2u|72_t3s zTYYBew|WMymeFkx(uo%udbE?VZ|{DE)6`jgU#QB%v+O**lUMtz+^O-Z`h=-yx-yTp z&OIwgG{P#2he?0u{0{QRIFdPYDfW@ip!`T6?W7@#<^MwEIH6-Qii@`le~;eSvOyO0$mU@*^~z?GYR>n}=Eqry zcQyrD=b`HSiWZ_}NU@w?M9jsvWcKV4*j*j}f z$7mD>uG$KgeQTvK|6(lMQk*}djcehvtd*Muv6P)_f%wua-7M-$*t$6Y_h9W>BiyIG zTRP0b7HWl>i?`5h@w+e)OQSf$l{OvIqJMT2OKLdsKo{I-S2<^bM3QD1=q1W;Joo zCkc!;_>7m|GJn1K_2xr4>+guppWAh>x45bAV*Dd|5;N4T$jcA4hv7W!Nu{f;3$OQe zm>N>0Z>A&==;@%>KX_)UU!iShGuez^inf}=^|Ps|fX8zBsp-0eVhUZqEZ@CBd10S@ z(sAX!dVqX?dVLQ3f(pIWyP+nZR7#wyyIZhVrL?P}my7w|AL=|>z#FfUIA;CGMbhfr z$2CMX@+!kL^{*Enmsb=I;0={H%=@)8j4dp4a`Bc7d1oU)c4X1GALNy9&k< zu5MMZRTo_h3e{RuB`10Cn=ji6A%xddOw5DhMQXWbhSv{c^n}Um->7&?sV4U6pA{1O`uX%;gsOWkURE z+hZ}z+rYUiz z-s;EL+}zxJ`TRNj@8;%a{(pBicfR_st>@cY&v#xt-`slsUz=OoFJ8R-FSNOOREqz_ zT;S-xHt#%Ep13dMzekTyKM)b~Vu+(#JI%)0sYGgtT+3A0mPgkpBB}&8GVW+L64y8) z=;@oI!QdI_SLXd0oHsfR+0?S}``v?Q4jN!QSl2RsJp)sAbJ=uCB6#3-O@=CY85>fc zARH!1&Ny;$00rkGX$as9B@&aElPFi5Z9PSg2Fi$5>Cytv*s&gQsmhPGw$_81#9&*v zQq1YBZ=|!f)g&yu{CvMoA&~Z*A?-qetkCoYEu7{()luz)WfR;*j%< zLLUpsJm7M_d*CQo0OmazqJc@1SAZdBY)G_`rcO8Wpi#Lse4ky*6G^QI0|y4m&!qfY z8ut26O&>{LK&oj?c$G2;rtb*K?QA=ndSWE@{atxd2T~VNKc2}Yq&!rf$qXpFJUu(; zKGSU=JXOJwe=Y9sQXSv)caP9nK(9!|v5&R`54};V;py4-n`fql9B4ywS)w1TwHszJ ze7e8eJ=RO&giM)G1;eaGwo9?!?gxrwV}Lw8>F)N=2G7(4_os5Ea3D~?1W~hMr}gQ` zwT~|e;$Vg`oty|=sD(@aAm}^dPmwBi$kC9DSdKTg`PWqzfkQU(m_yb<=W`!VfBkpQ|AGED zCgNP~4~I|gV~l$JZ~Mi|?dN&@Z|C_}f9Zb@@!zBW-iUd$F{Hr;39ir(^U2!UBh+Kz z3}h*IMnFV&;c(^7+M~5cXrH|e6uKgX@2ovSKWh+dD7912Q^T2YsOWYG3qV-@Ck@!n z#>VyawSxg!hehKJUp3?#`~BYD;b5=5?QBAqv%psg??1#eQpNJMt|?D2A73M>f{Y_= zqSF9fM^w;Yyq;*mYmZWmIm0Z29p#w@EI>Fwt?mHz2QBn%chDcKuRTKV`={R>ot>ih z-IJ5<;c0(wfR0X3@91#1f7(Af9H65&sC)P``o4d-yN(DI@@OG9p~}}5LB?ZBJjt^G zAsGbB$)!#L>LTA{93HbP5%4AB@z=VA4`+kD^TFBfQRlU)1+0GE-TU_JZRd3h zGBWDle%w3hzxnyR_uXFa`@z{kwuAmS=)XPeo}QiT4RW2o+uJ`l?;j3MyZig+yZw{S z>lSQ9pSjqV8&bD>d;IqN`0U%0{-GQ`jE4~o#?IyNrggiv_FZ>y-a9+lf8BcgRLnwx zT5cTqE%diR+D1@Wqy~Dx4 zLPKinoG*;Y+vB$>jBz+#r2pC@&<(qhJ3*!rh`K7pkvpM+xI!wSYQhnp?dI#3=J%biUs}JOTOFoe+JU|-?Ll`+ekL5dYqy4VM}r*W zSO^AUFxJc}XWr33v+ii{`tehklM7(q#U~M=C%<&!FeFjuwVg z)<4tV!_a;C+$ZKwzVmAH=GQ<^t^(0g)9~MF=eHhzOc1(lp-*TWkr1^%$PY(@+xFv+ za=G8Otm#nw4w)oZGD#SY$#s_L<+Q90r%bU_9Zt$GwT{M29{eSzkUUM`|7aLDRG=+2 z*=8NJ9)C2#`?iJtJ6$_c$R(epWX^sr(6XnFdnxzj^h)V17lu(=YB9(iV7D#wx&jd` z;OF4d4-kt$9bkGv>vbG!mmcT7N{Bn6kxGl3r1j14TVH@B7PIckAT2Y>q5T?80I7h1 z9ZP~M8nIw17jqNp(-S&NzeSxrV{eb&R&t?+51ftzEDs>Qj>h454i_r;AUkGxkRm^q z3l<-M6Eg-kh5|*B@e)xk*Iq;d;m;5Y{Fx<_Sb+8=z;deU$Y7CS9B8Kr z^P~lqtZ46Z^td>(k)lr~5gEO1l?=Ke@Oa~D$N6Qm{pz>B>;L(+ z^#pxFQj2fzp(lL9`TMWX%lu!{`B&Nd*NvxFvfHoDZ~u7Ka{j*Y>(<6t_MZ^!q4w4@ zwQGHwFf9q|2?OC*MpXLs+Jv`tj37 z5DYc#wjk3`&g$#d$B)P{q~G4Qo+TSVE)?BCt&+#5-M2X`jQjzA#^aB=`7LaGrSyTJ zmzji4TP>$sBX1%i;wV6ydX4J&%Yi=azP-)L6V#JzhU!345E$B0ES%f`TP3T+`easy z$F2jPVebv~N%DtMdllkF!7)ZOsK7qg5excsUVEffdu-Y}Yc^!P0$|Q|`-4+uFt;U- z+mDY1Z7_};fg@-9hooco=>6gTQFr$oY|})R5#eY*daD0ApbOZ+L^ir-2)b<3dcjJ^NQTr$O?^&kToBsaZ>(=88lpG%Lhs0w}TMH>Q z@4K2=a)LAHx5^d1ayh01^MLQ8)?=F`E!39UZU(znp+{y|tB0Xo86b^?DhSi|2Pr%A zL+8<}XrBz6N3LM^!0J_Mg)Rs(_^!MC;$^Zxjl(FrnAaY`a)tyk$8T*lL9XT@GZ!}2 z(oX=6s4x3J^+-qpm^T(kl|-7mQf%59)H7ohS$m<84sEeh0qB_xr?>Xvx~MkK5>hQ* z>g5m2)c;n@1gT{9wbjbr)~5%@#RYE(WI1WmOOHmV9a2XLw|lvU$@g#j zht^;li3mxICaow&B*YN12M$)H1lvd<8VFY6Oap11*zd@-F_we3%->d@0=3%4%np|p zA&~>mfnlw1Gx1BTa@msqIhigD>E7g z-*u6uy?~F$h>C=tV&P64)E%-&ZqO3LE|tUqaWbq=_lmwM$Q+N~@BKVb7Y}eSzop{4 zc!=PJei-4vok$_0-6)u6%@O2a?m}m-dS_he8kE)zwKF@g7l8Kd7^?tBf{rlUHIqmU zqwgI69~Fc11nPGrZkmL)%2km{#q7GcBr|?4aS!m6ylzQ8q#u>paSm-V_DF=U9rZEh zByw3Gq=lI^Pb9J%k3VJxxLx`n{FuY#R-bJjGqUQobiiegyScDS@iGfhvoIXXZ&G}{ zE<)5_oN+jAWx7n*lz22M=`s#t)i@Eu?J3&)YI75iNxR-=0dnDyC_4AZ6?Mt$R^m;! zCj@RcDp^wnMg5kLJr2jH-5$!FirVcDF_jE$Tl8dbMC~?(=#fV3-u}iAnLz|d&5j$e zwhoqVYaXL^@~<2c8=31Bz=_-dPRVe(=WStYEN-oD7>#;E83=dY5f%!!Dg;*nZf6~t zN-ftatCUz38)y*-E5hjx$Y?B9wZj);-wLK+1sL546^(->uSgWJ=vBsJVU;g9SlV^#a zgl4S7QRu-pk(KU&Ma07nAI&&5Bhth${!008 zu47n@8R`0z1W<%=nuN(xxWKz+(WO)n*DMfvvN#dwA4J>JuUn6wnyc;hRff`MmWJ^^ za6i3OW`Jd;LK<5m76+b#`n+i1BBt+`T2CGycTd0jpC=^?Q{vYqiUD$#%w%#DGR~>o zC$3Mk^*@uDUxOZ+QiWjGbx9}`x2z?CBhpFibTx;+wA-@#r}hN>hT7kJqs$?$jxhP9 z*k1czKeeyWzx0jJx&G~&-;j2&lh|G;eoUwzF@zB+d zv*~Oi7Rgz2u{8LL$OWv;V~_oYfEcry<#u7QfY<`P^Yt1;f=HbjF0{ca6%64kM!njl zta2FejqO)oeYK_`Wqtl$K`eLLc^`i?MeQi#1(NM-U!SV@OIfhC_Glnjs6`aqSOoA6 z4usSiNU&BSqFQM0r~c`hUR4mpCTC+9k0p9~&eockG63RcZA2xMV;sR#HyVVou$I+R zke9P(YuXgZiJ#XxbOT_;Yu6L%6F4p&q4rpyO<;=0lCYsI6Wa15nfoW7+E>rC#6o;R zN5cG}Po76Qz$7P2^?fH`mAj^pSZyVD6t+l288N4?UiF47y9RYovxRCQM1{T%N#!a+ zNXH#LNmlWbgk}>nVc%#EHP^cO+wsJijPWN z(}9pw6QF4F({!{jvJ%>K(3TQh^$B1)=*6avA8EIj${V8wRvkO&m)}xo`P?<|#pJr_ zppUnP8H*+iSVKs^1vxZP6 z5sF+)$JE$T-Coe z;Og>8PozSvTI*x25#)t4xFo}q4*H00ONM^nT!tCUtb~gSy|v6F zC^ay7ORb`DI1zEE^ORF7QMqZZ&vBLP0a6b_mU1qSA-DvGx6Ary=gyjH)LB+pahBIs zocmE%>cJNEl^&G5I^*i?2a4%sT|NT%b6jj@|P+#-UqVJLB2_!7;hB_?7Fp zek?_*1Gg3xu%Y&!4fmKuqJwsJHeXis2=J6-dK}^@Q7TtOkC>CF(CduL%~#V)3f4bZ zknMG`mp) z!<@W)j!57#DalpRI&IZbEf3j9kO0wu8!w&_j1rfKV0ThQu@)KdQsa6;0yOs75c`g5 z+VyZKNF>)U2++(&rNZkb@cN9v)rDe=nMB0{)mEi8i8LF!iVGbyc>hM6PG4>Q{NthT z2LBF!-v061pSKUMy!S6Qf7qT(hEvZ!egEU;aPw9C?;qIfl%ZN}Lew*puLe&F1}a{F zj5W`Nhs0;WSaRlpXxB*gy^j9e*4VWLYjb=>+6rbH2VPt6#7A z!=D0@>|-FiRKcj<4qw7PxNn{+tz_v9R%&l8v)yPQu&Z}nDbR=Bd_~4oY`%IaUpNf% zzqi}yM`@CQVy%vXclZkHyke;R(@&iPd~?!0NL}(8L-{kF>YqEP_0^iIbRcjvGKnc_?03%()os9iH|N_x3Lw)KmHOU>^aL zQZR|)odKiuc})TgWl#hRvnRWzVX%)x6mtQGpo5M=e*=v&iqD zRwV!FsQ+8AggY;HzItVG@LR@wf&+64ASaau3jfuk$H{>E9hJu=MZq%av{V6;Pa1RT z?$DMymt@AZlqm|BDj9N_j-Z~;>bpwgFUXwiDLMn~iAfB@b{p+8>uNZ|5yHVGxAn{L$6434sP-n$66h9Gxvtp zh2DC4#^3-F+O+j%t%$BcPmhkDfuc|qVS}D_2hYq!NE?UruP~Os!dU)~g|VcI|MTez zpDBt3%IGvbq@OQ$NLP(faY{dbs2G;I;#AN|*J(0DhFDBGNR?l*269!>eiqkk;Gy@rgo9s0Um^C;N3ObXLWlFho8ZkL8lp%6X!cgHTY*30+T! zIhxowT}jf$j#Q|GTtPa!kWa3NFIfgR>ohRRyfBy!3GyfpeLOQR9UO-H3XRN3n*{nf zJ{xO2Sbvwl?z8bJ{MJFO!RhYN*=eh~H(-_Ryf1(1pjQ9z%~7VOJVDO&v3(v99beUQ zCWvT|HW4Idrz0Hz(S1KK%9wR_mT!)Dcl^`?`hz5Ocf{fQWIC4kMdLFgHbll9EtJ=cp*+nAdHKqY?P!y z^Rb{yH>4#eaSCpsG=+xPy(9rJI*J1o4FI8tQZ#>Z zS?o@Rn3GSF*)XEsC;q|zWCd6i0&}7@|AKTma}waAKB3PgV@C!fMPL zK@)PR|PI*Qc1Lfmj$_Qcu}zPWjZVLkoRR4yBDGT@bK^-n~CXT&Mnk zXRQzyKpld9y1efH@qYIF`OW)*@4gQX=$`vE{qTx!zbz01C{+?+BQG(L_7jU-C5*cR z;~m9m%0kltrbHrBi-*)+sH;)=p3J_dUL`JaxCjRvq8?mn=PkdS_3)<#Ufs^hj0fs5iMD5AF%8Vy!-It(ltwJfaw@^?QT6d>0xuMF;K%#WH~vrCdtyj<03 zcvt={Bo33Xdfj#TCuD2wb>ZyO>k9R{_SUc6`DWv9yXkf({rSFawP^>b+D%#Hh zxFqb!csz#0QnvDbj^qi14lp){JJta%xrYxWp?~@vfC_T^l!n11)L9{U9hCXL%;0wP zbKR(!IGwU_zs)_2$Ud%c056W!{7&!{sd;0eMV}6RG%sT0veSLE`eUBnKn+wA4P~oF z3PLw6Lfngpr_$r`4%#5X1vfohRBh`*%smljMWX3Wfn32;zvi*j!<5gL8)f)4V?l#v@e4SnKR;b9}{vF(a=4c{6s zX=t5U$neWTd{iTT`35e~QCz$5^PF{?cD2{6=~?L;g9fYd*p`E8?yXgCiF$h#t{*Me zjqhjdl4CF9n+mSKJdWf6FYSMQgJ&{r zfq&FRG=yE}Tk)dYK}WhzwhP3|>wQR)>!bZ|b*)s1Cag7$C^iK&fLPggQqWsMVFE~lUSkuizxuC34vPt?B zzFbcgv_~+Uiz8iTyC7excWE>D=DyU3JR{{ehf8YJNZ+3o%I2U6cu_R>vt^=C@!k#P z->LEtyTpva(^~g5P&$jP2STg1DX%C&B@jB9kD2Snd%U}@zP`B!GWND0zG+uM%$|JP8q zy!&EmL8hxZlBk-28VwDAt6i4VABH|@?KUhe9)0+JvNFU;fOek_vOcb5B<2tsqElp`>;$_I-A( z?o{_~LL6|A!-@3`pNV(MLguqEC28dJl*NHiPx3UVw#uZNN~;tLEoDdgMVonHcL|rL z=C6=3KmCiBT-%y&!v4z|#e`15Nh>Llr~Q<=5xe}FOASEkr6Cp*XcZCH$8>5Uicg5Z zI=`;EiT;*CF|Px72=yLQ@rFfjXv9U21ya|G)(~Phd_spq<`Xel?2KYJ1KCq`HIBSP zCL}$=97EL;|Ghkmtb<7Dpgw1b&N}EG?6*y(fe}%4d;W>e`e;gmcpVYpE;67#1AT(8 zh%y^AHD1M$B|&+=FUAzTGw#lga+JVf*N*9ep%1#3!b(*=1ka!RNoQsVDGL2~OoNJ% z<8T~duTqUkA3#QN0Iq7)0le*#h{fZiA}2Sg*h)uIp_YfBhgK?bYXu##s4ng)ORx)s zp7qmbDh}!$9rO?1qQTM8q1Fauqcgf!rL-6r1|f4pt!)ekE;Vonr3M7PBtZsjsih!S z0`+oF#tZOqsXdW_-mTO5v%D}YKpW0A@%{E?z^;RhGEAVW`k+FO_sZRx&8Vp2Qel*P z;*^4LXGXM}N}o&P?ER8v3MtO@?ica+h6^Xl8~;eyCj>&uE|_+ddWy4;Of2e?)zN#HKPjOpqA0I{HyDHcyQBErSh)&@ifm;krX zsr*<};4H|YX{tkwmStRa$hmBsJ8UzyW=CC|$&I;evT{_7Z>~EYme*#~1=wu}xiiPj z*iD$e$TbA^{ZdQkb6rU^$7j*&iBw-umA>*(sw5CPa6~r;Gtbe;IB5`!91P<5h0k?S zy|#kcK`o}UESVHOJ-FVmlVR#-kjgeCDqM?r$i+5Bd=VVX6SWr9kdePwkPIRN?c$PS zs=~*LSmcpVObmaEyaA(^F2fT5+(E6aJPLG_9RNpm9jJUh_keQIvc2#V zm^{gn)f%SlvYmEsY?IQQL;818h9}m(F_Uzk98i@w?Hu(5FuzV<}J8N%UrXzH2E#_ zcZLb2JWb|64*#tlKEr~VUM2HU`evex|LIJb0!Ei)rV_eZSPOa7uxRYWm&td#mZbCh z^(Am3J56_dFxX1ghtyC5JSEmNR57ZRt|NOY3!}e#|NQ`+o%Eq(D7!wVBd~7@tNC?q z1@m}l?Ibz94Vd4Hl-iJTyOn4HndxXo-x7TObG@2WM5wu)#=f9F4HWs-)ZLAurc?7h znSK7L`CM;5S2PbP`U`M9eaQCb;QwcOxoS^=$r`)d45S1=|0xa5eG-htq=Q~InHP8h zn46257pf09O@E3Px%NaQi@o7A83L+~>XPTRnX|bXqXPe%aKDE4_x6xDJ^D@4%Q#Ah`i!KEvr=_6~nF&+r#IqifJuISYAYQ~d+kab zm@JyrK9)+u-UPckIzE4NFZT9l7WoWYP&_-=O>CibQy9rt$GRgwEHPU?AG(bZp zCTPlr)F-;iBfk_ZLj%E((3pB--QmP3=FsCF^WxG`9 zpEag-ChD<_r6t#|sd&qRm z5WgFEh=~b_kVmFCFjYZe0BaF*2bmxSYr=7e-3f76G~W2#jW%fDksD_srap4!dBZIz z`nkKq=^uHU`T5(@6+WPUfM~HMri3Y1nRMw+{ld@YR-eC1)1l8IKZmvCREANVuQ$Km zEF(m}EGK~=k;M`eM}7uhD@Y^3*dqSyWPcHiL9q0_9M-Vk%aF7N(k>`YqIzyxU9?@w zbx`UR_NjO7PH@CKsP+GT!RpOuNzqIiF8Lh+kR)Dz>F z3>g>Wi14}Mp?3WqYbeR0T5J&;Bo_~%7&JT)w~crODyI>-?e2XVpr#PJv1UJ zB_JigDHSGJYy)j&Zujb2gSAIUN($QrFz3#o+<0NJ=VU7gEV79Kg}oGox;>mnx3J6Z zp+G`;Nafn2OkIRZwv`7B0ZIO}0I9zv4<4cY-R^N2166LBWpwQvzvi43b~an7YpMJ+^^2}aW}8;oDN|S# zuYvKODnA<@&Jk7n9uAd$mJOTse(!9(+<93W1>2Ban!1QgnIKvdE8hQRTI8-&)5L}* z=~c))UdpHJU&`b{D{l>>)y znzfJPD|MR<5T3FC3>=HQ2z57WMz4N~ru62r2L*$-uvq4_*LxDgSaR*aR2nL{ zwTZzkcTqy*MU$=CL}{*5h|8GENi^zuS0oaYldk7QgLpKeH#rR~B4aQVk_V@qoy}Lz zU-C-(vSK0{+-+*+4oEaY*dUf9LFa&7*$XduZeVw!i8KpLg*=|@?eBF5d+o#S!CqT6 zXd9B+A3t(|1sTP@+({wxblK?J+xEwg=&|!7_G7{uaSh$xw(=n>^Jr->N1B!%i-TOK z-&V=R-}0=7EXhE-lyjPq0Si)>lEo=-(W>OV4%(BPm#j0{d`r$H3=ZcJ^L=)$TudPr zf<)7YoF3F48G*T_Jk|)Kh$t6IpflLYMZS)72#uO6?TwSeUz_7WHY=dJ*)Hsr%#v7| z#|_qrmaqk{%r)Vn!U(#{Vxb&S58jV*Q_CQrA7YYh#q^baBK+YpYnnL^I1zF9Pb86C zM+D3N%Nbm91T2#OqZo=D$05R%6X=tXKx7(0h=EGMV4wiaP+7~U~yJo%Mt zgo5KU7yEV0o^QUGrC_sB_Chf{UaVoZX|-xr9J46Hik+R!mo+4+BXR-iLIb~>CC) zRB4}NI>AyNw5l<$K~F0B#s^mZo}sk)TAgQdb)@r`Qng!j<9@&e4qVdr3NLgT5hq3JSQq(H5S4pKTIl`V zYD#qh8I1+%r+pfdY+PfD5NnQ-6%w1w)&j)trhV>(Sh!12;WnlynNAqKJlVNga9YQ9 zT}XbmP!%{GKLyosHdwSkJ-C#?c9?59k2T#$6OMElxRo>eSS8xI%Zk#NYe-ENQrdJu zk{Wi8dH8$YK&WO# zl|f*90Xke32U4F@uaL|q>*;6F&TObV-N$Ty8@rc897jYsoQnEMPKp#|PY8Vx8(EuZ z2vAL6--P&~E*i#3h?7+5Xh_60Ap!E}2*O-5H<0S`5G$vU4t_-(Pl+{-vD2-BiNl!% zPH$2+N}o9_=m^eI*vnJ+`6jL(c;x0Vo}MV1+@8D5oLN)n%hM)32m2mEtc<5FsZ0^5 zD+w%AEvuxfY8^0-q{5d41dX9T)R_%RyO=TM^1uR32@W`-qr4 zBcwKMZgwQ3+zhE2lTb$mg%OhqxjNSp6kvPnyj-xyJvydh9sU`IA&Fd7!bS)Zsb76| zE%8i$RDJ2ny|C}jRf!k_MYiy>#pO_rm0^^;qZ z6EBGY%T{@llSSk5CW0 zlhQ3aSHR1Tg$T~W?rHzWz4PO}lRxxRFu*&ID^I(7{zrfIy(LUDa#UkKO zh)22RxXtsyY4>oqyMJ`JSGxdvX?R%CC6q8-4sw%tf<-!7HlW{w=(V(wgDz4u)P-zs z|7>u&cXHvNp7lr>)FE_Hx1cWU&^SGft%^O8ryYLOBj>ld9y5~2H+wx&5<|Z@H+k-@ zNhLqC&7d0g;%sWTjEb+8fGvtSML%Na<<3{Hs;RAsBD46E;facrEoa2p$-a64$0A`& z`hUfd|4rv#@~3ZBw4$n#HTN$%h(|SmKn;ppzGmeLGD1%@4bW z#q0~Q@6XVO82fZYrIo3kY(v15<&{ecOW1+mrog{;k(zKFlWib^P$B4LJsBuXqYwuo zn)PyToLXmt8delExhh8V6m-aCQ)V|LAGKKqFQzTeKKO-HR^*bc12J7$7@0HHlQ;sred}fqGXC`_9{aM>HKelozfWRy=0V3Jh1#V zA0r47m~s(e0WWG}?EA}+#-ec{px~|cLEM#~qiBo+?HVe+Hn2WwKj0GRd>svz)WDz7*vpG)TMbAxMB129@Z;*W$^p!;6jU zPtH!5b$_hxkxZFHru@wZFEEwKvJv{4yozO7jM%SQr+pPF3|Dt*Sbt_k6*qiKWS)N* z%>7|MghDyiiEF$!A@ew50fKjV|DU~gUys{H_C@D!J_SN~O>8fb-K}fVvom{ZNpeOL zOV+mR%&hUrXQN4UH!a>mkS+IETJLjS<2>2=o#S~o+qD$?%$<8lVZTV{x1%qMXE_vBCjaqQSm7% zkrg{LSh?uQT9LnE_@AG#sI+{w@IT=!3Z&QKuI%q_F#~l$ zO<%U;wNt!=-LsI9er{ScD14$7eNf`}i4!3!4x+h&+v&G7oEvmqdFVMV!cBXe+7>wD zu?%Uwo}ZCHxD76TKD+qmi-x?VT^5?TahD~P&9M_Kb9IWAqEuCNlT$`oV=g(g0)Pr2 z3r0A@4wcRP%sC$;-o7-)>d2vt2RvqAetZ>2kZRjAu0mLh~;S%Ofxv-m!3+IF>bAEm0aHgglOaMQSGJhIQ_GrP60t;Dn{ zmdSjeAx8}na#Z}Eqqv?fE?HAPl@(bV&Xrjspiaf|Cq++_C2M7(1{tbueGnqwv2&5q z7d}o(`OrdO)JAh>mC1*5&&~0LbGPCF!wo$SZ1f-;V8t6&V59oRN(o!FYwSdbSb*mU zV+xe|Ak7oCFg#HW1K*gRaeZ5>ahi8?MUTiU(|f9EHvX8Nh=L99>H4he!R- zz>!sLZ|og`Ue4R9@i2*}3_N&)t(O7Ji=9U*q-u3jo)-2Q1vM{r z_2M>KD@;(yn5{N+b13VnBTvKXx^WZ~B)us(7*8GiUD^C=O{fKjEr{XcV66-hzBFek zk=E=ZsdI_jEE&@2cNqmSvSMVv3$Br`*e_p^c~U5`ItI396TJi#_{xbX&C6bda6B9I zQoNu%`<9`y9ACwH^4nu=#9LO$-GwQ&;4rov?=i_z8RdR0qLdI^ha_#H(~{Rup37Iq zXXho&P3bkTwPnWQhP$=}&OA7&2-c--(K*3ngjNxu#dHV(GXs5Yak?&JllmAVKV%ne zdlKF9e$Bf=XmeU~32j>9ik!?zlgZokwAIRfm)n-_#d;2eiR-4Guh5ToYanly;E?cZPYFt+qNgRZA@(2w(U%8+qN-5Pi!X>XJXsxo%j3p zuK(~q>gt2O>#nDtTDY(ltVUE?#1Pg7u3uofV?(5N+rnmMr!=c1XaCLux;UNAY_&2M z%~^8Wffy-&L3Pc&{LWJ87)OnX=neZbH!haNtjl8Ijs*+`RR87+BvfCwM6&@%f8nbx zkzS3>!f}aLovN`GHJTF6w2DZzweBIQrM5^CwQ1)vybR_nk??S;_e!mUj9ic7atq~? zV516cLYp~;8X;4=R%!jF^$+d7232{~5F3LzEhCQm_y9wt+U$;^aq>150o7)U z?a5ZF*+hw7?*VytN!fYC|5O^GV0VD4*u}bWYf{A@)a(M!zY}n zh;yoIV&(Kzp&D5E4l~bkeFcoXsn~TxvlyC58^d9Yh`f6%EepPe$Q42q>zPE=d< zrxtrij-6uVV|8+Bzhszz^IN7Ts{PwS%iRdTFeRGi0s*9MBuySE#mIug$ zCojz`E6;NwQj5C*tuNh8vuO0ZSL(+D>h_y+RvEh0M5ijM*XF5Ae^PyMHdw*$_I0lI zS4?%5vl)0+tR$2=+>tK)8e3gb%DgN&#Ps6tI(E4m#F?t>KO!Xksvggb4eh>qV?PgZ z+>u)fhf+V(sN=#{?u(kkb;&R?$9IQ;oDO0RL*emqM!?bP0v7D_M`E#h5wazHN;#|BZt*G%S0ZD1D|><9zL9SsV_U2uCrd>tL}H$oQ_4a!WQ`DD$j55@7ln8 ztgg37&9R}Ziq`(C0y==wA^E||%auNF?jhcK;GXAUlOuKh`uQE&*Y^SV8PNX%1Y7~O z3!r@YLVLG9d%ujX6+Z!A--gu!;Xp)lE0iQC}+MrPWf2Bw#q$}uPgD_AE6M9{SD zS`IG4Fm}o5pfV69X~AZ9^!f@(@ULeRDz$ON!6@VL+d%k*x_ye|!I2RG?D1m!7mpBV zhOt*p+=59rleC(B{`z0<9?&0UhOv0mA%bpqIuL($M2x6l;R_pk?3 zL}ZNmX|2^KLVo`6hX+$ZTfD>|_V--)K?99TZ@!L)wOsumGyJ1q%CCp3(8!S{$5z#unw|gM-?VV2K}s+z%_GiRDHZ2zFAR z8X7swC92Bp8e#?0w{4A=*5+tI9Zi6*ELZHj*IkwoD<;*BSPL;44E;fJS17xTgUlZF zp&dOnHb349Ayx79z3f6AMd^?%Dx8oX2aMMjR#qEJ=bE)QTSsl)RGYe&jALWeuSBuM zf9mOhnp_PwtCSRW4W$_4bX#lv#txV`j|Siz6@jqB=mzA*i;?`Gv6q(#qiwN#ZxmBH zZBi>84kAr^FyY1x*%UMuyf@$L4hk0@{{8f^isA>-&*Gt8OWXQ0o0 zMAaVjfIC0c(Qb@gpFy7`llc_o*s7U<}vc=ERV9)48$i*qHMFkTxpkJl{RJ*muwQm!hW znZt)JCj^!oewG<-w5rikxx0z&%IpOwkGt5TvcFrc2>4bWb2XA8*F*!zG;6BvwPzxr z6n_Ydzye638WJ&IIMY6a9^SuqsPeKMkjDZrM7Z*GRL%4&jKd4vV7G9=iAnL-$|>*k zBmva;8Wo0#X+x359})LncrQJy>M4|VoQ7S8_*fXkqmuTiV#bdA+A3bED z&+1cgD6M%CT|EIrWy?SL?40va@$S>*HrANf;`->=;B-ll^iU<^)=}`} zDpHh^aC3?jQL_k>3A*_Q5T$%52@XjSjR?eSv!x@M8#(gR)90hlyb}}Ez0vK7&=4dt zu>p5Y?J&a(KNmll6;#7igWBWlKITSxg&oY_0%v^pa{f%tu=nf?ed@`&~^ap}ibPUAct707To#-QDyD(*= zb5F`nN!R9F3Nprs)v=6fpH%f<%g;rZuM!2(kB03FU)&N7kz{rw|C(h15sy1pB7s8v zUmK^-&mP^6JCykihQ3UIsoRL9C0stn=ws5iadNw+aw`~vr>iUWWSNqrO*<@D&GzvV zji!-BT)S=ZLfK<8iY}yBdeF8yx%P2C5v#2JW<+RjTu6s;mHCbV0ORN4ZGH0X-&Zg< za`FhjoUiF>FS)@3u*`H8M)5?_#msQuPiT`R>$l8Q5pcy2)MgTv3+G+Z8(A#*98T{G zlGTx=*b=Pf#8M=vSt-|v_>>sBYF2AMwqs1$+U4N9-Zq*Y(_ejGe+Q(Q50NiT@Wx6 ztxi3}`pAcHmPx-+ln&1#XlKbjKBvI?a2Jb)j6BStPQB(V?BP1RGFoZR+8rZ-b^GE8 z`GN?xT(#;$%%3ilrL4;=^xGdl=#lgE%m!qP8TK#GA7C2kid<~P{zzG;`&`p|y@tJ^wCQM=@yOb`5F(j0 zBfqcAHH(IT(>{TbNyva8ui$7#l+Nv!k{V?vWV|D}5R`ABoe1V?89i)dC@>;lH?LYw zHTzlSZb2s*md3h{ua@Dv+t+4nl01!&2?`f%o5vQB=dL%K$x* z{)O|S;&IJ<+#ds6H3~l1k_3Ga39gc=U;P$#0q5@Xbt{?d3p{m9OEQgoS^-Pt)(!bN@jUO zLoQPU5swNC+cCvJ1QhOEXY}hsd~J{C-q%O zFCy_>p10miwC{vVb@DeHCx;!5I_Z=e%qIXEY}*JtuJOx+g-j&UkG&Y9lBc5IE6Fhu z(~Icgl3xsQ4xc9gSrOh55gucE^C%#tB4ao52n)LPG>a6T?<_ud4&iur_Ar+jVR2|I zp@hd>g~N53I!=868Ns;;_LQWrbTmrn>hf~AVi!7oPvnb!!+Ojdk1xd)N5&UvZL#xb zGe3>uzf4^$yx*a&G!!DNf5%-5y+CS6(iBz1=sZicjQkaj#$dxIRAG9_{LQiNVAb0? zrRRf!XEHi`1cgrV5|$2<^Ep;)Qz%sUc{h|#K0=Nf2(Z&4qlqxH5LTNK6HxUp3`)F7 zSrjB|{j$GI_x!?&?wc|lUb77(gY&d*osCL{tMQv-$$o44=XviXlnqU4e%Qc~n=wt9 z%eAzbu*-H!8Wb!F7@9~i>De<)uUDUG--$lbS-@pc+t~jJLuiqVx5F6`hn5R5+9PW_ zq7J`N5PLae%BIwcTAFPwESU;@=N1(QC&K#(0|67t}hHa=L4BWw&?Cakb3x81ibRwRT2jS@+*x*-KIp)yp-eE})s)WAQeu za96NSQxVIj@npO7n;{v>WazAMM=&C(4}CZVG8b*J{K$E|Dkc@6vKVLuNx4q@LlGQD{ z5ByK{xTtJ(9~G`v>M8ce#*+GOhwkFGP4+JEW%Z0Gq!*piG6*F&H&GceHX=%G!ewfv zm~dO#Z)*m#O;ELd>NTNkrpTb5)jX6aK{{h*{rJg5si`ii(5J`1i=FHEZoLHDW4(mq z6ixviiv%|K0WIfFf%5!3hy^z8S4SC(d%A1W#7qE|dm7^ou^*Lbxq{kj{f(|9-NYp# zyvLj`4BDq!Igdtm;nPUGP$LfUv2IVjFj>|FzkW27rF}%mJa7CE6CP{bBYaYOJ;bn< zuvwEW-|OyK&@HcZB6j)G91C=f)|<_G5ed^^DiQg5eujRR_$UbdRQPf{SOd#oj#oZV z^@Ca2-?fPLW0oOU_4t5=DRM`og2`FOl7ccBFvr=YanTos;9G=>7g~ctbuqq}LfN89 z+ZNkdX%9-EMCiQq#wlvLhg`F3_J95Z;ppdy1XgfFp$(3W9w5xzbNoNpg!V0Hl-69l)xtl}Tn|?eIM&LJmrMt@?TDjD!JHVt<;4|k8 zVDKXD+STZRj4;Lt`c(W7*~vhq1K7jvplxdGX@=C-AiuJ#v?7EX!3atZ6cFR3$2p9iyUtqe zZ7w&z;7_7^JhPmq{mH1Wc>w3ldx=GjLL8lC-E9qX-!?z&Q7ri3(~;L*h_FvBveDgI zRD%rtX`go;bT)|GZ-2h9-6%+4cmDX^_~z8FxUmgqtg^(paYfJ81aqEwg!+tF%g!gf^fz-xVckUrS^N*hSCJ}R@#_)6|aJ=WOI`SOYT9{ zkyzPSYV`m*OkZ{E` z^26{Hi`5sG)rlo!Pk21kNvTaBYBDsN`205YjKlg1dToqg#Pi*L`;k@d1j^bD-9bD* z?u)1esfTECplV3#7IdUZQh$U7QSN4Phr_WJ5?f5L06FhG=lATwbr>?pK*DS;|JqQW zvtGExb2o@F+-Cb!M;+G}VDfZ&l*(6)4a?ewV##1Fj)*2m+MUAQjWdgK=ENdo%MpNt zK%{8j2G{B#@-;GNB2I~UJ4!4V1)yv}1b=pAlwaMxZ*-0}_j*O^mhBvnUyJ@!W?RJr zsXYA%Y&7Hr@@!r|1#;cd;{d5}P({eaAq$IxPoNy+Vy0nD9v3pv{47=QvNgeP|eP?@;tqJ(IMtA)(zy>xD@zAfGjV)Y^&wkHm-p~G|eASiI{AEac$7!nQKD?#ZJc3ciQtDeZS zu0ze=c8EAX)N@Qw+U~W475H7NGDxFG}7uS@P2sEcsT~ql0E?2FW9}C zUgq<$;J;vrWWpo0YTVg5eGX8})%wsx>?|ALZW!b;gxKIuP#jv*=ag$PS?htEFk`QY zoq@Y(&z3Py2ipABDmJi%*1P5cdlN*7e9$2+JqIb(9hA}(`>+Q?Xc{BL-C!oRF?I$y zfqJo&7|a;hx^zS`dES89^P4Nu6u8llT)s$udA?(B0BS-9eZM-JTWbsjK=+pfd~cog z7TsMAF;ys*Xnr|G_OZRif0OHVOQ$zSMuw#)-EU(o4)=Yem>6bHW!)x_VB+) z!Cv-bF_wwKZ2$t14xYwcTj46y6r^iBN-16tCn*onTj`idi7yrWjp$l~Pav+G0v4o_ zvy6O&e-864UYVGLOF8bq-U_9^o;{;)g*=}<-t#_ohEfbC(y>?6le7FBahG}c80&a; zQA4^@23z$gx3o*}G5hGPm=K~I0v^V$D~ED04j(B&cNuKiF5`3labeeG8O8Gw4- z+1cTtegh&SdGLLwxQaobF8Nmh&)_#Fw~fADRGAGthXAq51it&0z4rHSxrL=A*zB?3e+os~HzAntp%N-EJU{v)d$0d?|){Ch2 zO${FKRvJCaW15)KnghM-3;=^Rsor&c)CU_+^{E;aNEdNlw_>EcN--**N-54T@q?wd z5Mb*XP>8w?2-QRQH7l7vd=nTy1_LV8FT@s}6bmZ!Z;POKRvAq(>3gab0#ar@ZmB^6 z=$4dR36vEv#|)LZu#9nwmY{VLVd5oO1OwXRM1_@KBw^0=pI@l5_||anQ0oND>a? zBU$86n+2Jl6biY>{cZ>t|7xrQgGvz$rUhFE>J;L*qSN&+c4S4{wKVvui!Np)qx|>1 zR;yv6OXG@PYyN3y{*o&ljHy7I3GsfhD@G4Ec~;M^5X1^SxkU&toP;zk?4Yf?iN@J; zK7z>d=pi#2Kp{~2RIA(-#AR{80A+<_2N{`jPJ!vok%UnMUnL45H0Q$;g{8(zPRO_s zX7ENSZAP-Ub8cm^{w!|=uEKsT+X1hyh_P-9ke@yIfWSEZ=U>1dlB&>OZ2>n8sU3uO zt6b3^X-_wye*#b^i$LG#>Q4T28bX53L%gXUj1hy~+JX*MrwS=z)zhwqAl2BAD~5hj z8Q^mMY1(Ha{!Q(Sy-w)B3*4Z&`bI0R++G@TymfYfwHuV_$f*7pI}r12`-%|uWYh0OeOyxu;7}Ze>SC5{(C@D%*o^N>SB8I{`q>F zxc92wYkP1}<7+mTTA|SP=5iq%2|DKh_^;3n=sI_O1++WxhIs|j;mfwIzRT_vprv#? zxZd^CyYrs*cRp0)vSN72e76||n1aD9-NCLj=8z7{6n&t&4~b+qx!hYECU^i`c+r8P z_xguK@^>VbT`($v0#fzZ{lv7%h$sUA1^NPGocVLhS|DPgxI%=`Kz#vX@QfLOED>Z> zkQ~Ki@{-(mv%QYA3^P312pAvB!TT#+)iBgI2qGkKFiIypurdh*?A|mQ4h7=6J@<3o zw_;x~BREGO`X(dALU~~gYaHU;81tdlqx{PP22lVOt#(^?`H|q$;u~Cd>t(MuIYeeO zOvhw+{SSGApduAU3&de$VS>8ye+G{e;A=BaAY{U9i7Uj$|G9Cz-qv4WTY*6iCX#|( zSjMp<^sCd$^1x|Z_NR50oUdHauV!t$bm?rbGqRe*Z>VFjqVwdhp{d0;%9zDE+1TwO z9y+wXKl9uOjG;tgkxfK22s*Y=6Cr>`%`G&=HnEFPW_FF-7Dk=B-}rX}g>MzMEF8Kl z9)j{}B~GKX@iXwY7}d(t_&^WD2R7cS-HAvMJP^B7xLew45T}crihYph#g)a7?Z^SD zm26wh$WA&`S*xFHN9@707CNG2gQfaZ`=IFyP*5TcCIXW%iq(| zOr;hNGc$%of4Jut2p8k|EQ`{UCM3*z1ZWc7sLnriz^hVlYObs@&v{H=pv;&#k96Hf z<;CLJ?J182h8|ED`hzyJ6JDT`fF<|G_XJDaChcFLVa<)_~yBHBhQ zYP{lS7CNNaa5o5`Em%j>l)WQ~Uz_qzI{9iaj&yn}dUaSWA20kNTw<-;G=naPyRZL* zj_1jyB3xb%e-Cz2?sMd^J^%}|Aiq1rp(bA>EkHqjvE9QuN+zn!1lV8<^u+tK+yKg% z3%qtVBH+LizKaCR&fZe3Q93Wn514z#_Vn(q_ySTFuTLU-G`QC(a$!fa|T{O9W#DpMFo#HFf8(z~>&h(k@wuaxXIW?r%OK|DoF#Ol( zPK=bQA8{#YZ@dVo$Q$EeqG{qt`SK`jM-zwBM*3FKi}=X4RinAw9oo$E?D?@NhJGoA z25y>u%mTgu4!2*kSH{P{mZXZ_2uJ*MQ|XS#D`Brs$)Gn1jP8;T9_movE*LvE+_^_> zg{z8R-$DTKb*H7dJp}SVxZVqAroYJw@v<3dn3&WCKNXgB6eKiC(`QBLt{CZN#V4yD ziYolBtP_DX&_F9vAoOQ35I7^!-vjJQs-XEAReAf@7ZU15)(?-fAYkjCdKZ`n5LzDs z{+B18JfFK?6!E>gUx;mEfwyycT|*_gz;lGJd43==GE($A(D(gw2IxyZt6?GO{{1sZ zVCAsb$H<^}D@fgz*GGKqE~A$e_HWa&UBX2atUZ*-K{TwWpn|xwL2jA3c1A+Y(?O9y z-Q#1vx0^x7jc&KQGGyotpHG?;!OiQPLy;%j0W}Hxmcd+B*Jzk>Ya(Yj^{{6{DE`Ns zNb_U|1tDRQl;VT}{+DQK-#4d<{yMt3_lJMq2hM^%o(|@Hevi}!UHWC{UX1kc5BZb$ z&2z(t=v0yTiVkY0*ejZ!`X^xZhNaEQ*i2%ZB7o8#o}i%JOqePYZ`8f0k`+TjJsxwg zQDxcLoEE(SMLS}CDm=YvtQzj}4_%|5Qbz%a()tC~!q`OcBP7WY0J8w}ThYa5qOft+{rSis}uwQ>AL(NHA zcT51Gyv2BB*{K2Lj_5-q&ykmHclt9R!G-~d+E--vuw=Ulj-xI{$tp)f6c2#zJAbLV zD6}0>Mo|pLjwQ$_vR#KU92NO#7KaWgsQ=s%FR`S{gM*sKmJOPmcWW9cFjQRv$FDXG zW}Zl@zNvxNsLt*crPaWpeQoa=nYISWUhOk+7dQ(KRuE2(mZoEfB;{5hzj2w7(_RyAu|!L+oWs1L-&i8$?zYAF zSNSH)TmgS z4nOLb94@LlP(eW6ZKX*2CA6lbsQuW(t%&@#v=(R!8t51d3~=hyYz00+ZGFzh@t+5I zG2v0z4tQFgf4Y!X>*noTmCeL~_hc;H-&J0jj9RoUi2OSK3cKB;<9#RsY_1{}89*Z$ zHZJOr57r=-o?Yy~sF^_TZv#3#nXd?AeerRg9p#^vPv;&(IZu( z>VZfgFZadGe;JlvZ_Ow&kn@cGN`BJe+TkF02qa6ATE4|lQIKZ0!!Yp}u|vffwB`!JNfsldAH@9$9M z2jV{TJnl&5m%k_?VHE(tupq#gpZLxmVHf!5cBF~HWWiWuP1aNxu&kOMl< zrVqHrG#a=qz)#?IABaAS)zQ?wt9ThAB!F2uB{8VzCA?G-4NP=|&_j97P-@5S&5(afdF|y;wz6e9=2zBb{ z5jA9|a3Y-=(SSA^nEEtwr#g%vx)fPkC>sOjhZPsMo=#o;%{s=b6`ehYI`FjD1k4^= z!i3*{9;o7h!@FM)wz1$VZeM(VzxOEsFD~3}4gV+loQK4sknk%Uq%jhT+7CL^5xB?1 zt4*VDcq1frxTHwo2GdPa*}vQ%L|7&L%WvC}3IjVyHo)Ke?V5FShBb9+elKkgtv=tfPWn7AkZ5AdO^ZkXhpw4EyJDsKFEQQ57 z6wg+kj>YS4`}lcZH-R>JD{~+Gn|=zqs8nNLN>U3DSF_)8|ASIovW0`rN;-rXM~Tu& z<_s!@X%Yq`xuLoYp3`|afQZjSDczTEpSP)l%|PY^wwN|cQ>g*}2yVOw?LH6}yu8c2WDPGl} zXF+ZfLUd9^x&Bf4W0iC^)Qbj%#H`uVTaA^fzidR7C>@BXy))I+OL}GHdb(?|#1obh zkTC*=#7}rkj}p>79ZRB4$z(T$=^*})j>r8S9zl?p@p52}7Au4%wf(IieFMXKQ5lkN zaB~mlu^=wy{tstuAjHMq>HSV3*EsLWJ&_BIP$Q}aMSCVw!m@Z7Q_znSZog{RHH*s4 z|AKx7Ud99FL8Q;iGM6e}XjfL0KnljkFS(T|H8F9+ZYY>EQd$Igi4@~Bj(~_f(aX8qH z8@P6QO^9^`d_?x>{_OwmPO*V3T-n{+iRTI6S(Z-N$ana0&{@|<(9!U(b0*ckSEtq` zz@kf@z9jBb61^L_MiJmO5>oVAprvO+53ntXDiCPs#(a7EJW~Y$`TR)dCD}RziG6<> z_d&~HW>Fm+_&e-Yt*@Bz?wc#4535BpV;5jKI03iZ+!BTrN>snQnn5A&0AVIEl3B8b z?`GSV#%B+nSh81!gwvm^r{}RY7m42WYO`fJN)~lCveC#Qa9T9#pou7awyR)49;rtq z-H1w*SUGf?ly#g+Gcpsm3h6rldt5$*DcPOej6`Wgyt3ehcys7);9}PAN?EE#UgE*N ze*ZCH2&Pe4{Gv7Fut#@>U{lQcLz`Fj{6vrFO_2EKzjIBvtt5D@N*E`lSn;IKdeDYN zkV0d)Gh0UW=xFM@oC!+WNDA>H%U3AYE)ms?GbUjto@lz*3U1=Dcs|Uzrn`@)wV30h zN$f5w6bjHDYF}x`(PP2*Lif14rdynpN-nKicchbfNka(epqa)Jw?gk^)r(IGHSDahPk2;K3Y&e4T&WYuLtSI_Tz352(!^)IFk>w>jLORP}) zqNPLykZVh9UHAUr?+Q4{ha!SX4Qx=e1;!TvW>U7qYqvNrS5!`qUoS5YXJ?QvctzY% zevPX;pR(H|MgBn460L^|Aw-Yoa~uhl#Bnk^0LmIM1IBRRsol=6R{zspQ`RR53MkSL zb;+AkY^&jCJ8;>Bh)(FI@OsxmoLt=7K&70Hz?Lb5;2+o`B^pny0aa?^0gD-`PGpn zW$&3x6nOV5uoTt4RyzC2`EP6~tvy`w0)q+Uicd_r2zD(=r-#x#DN(2ai;Zim!-@#`>dFw2c5eBK(XU36F8o|MOhKdkQI`CJRDkoC89ug#Ru|nY4qeo2M6n?Bg|Eg3m zu5LZoOr3DTWPloUv1uXot>EFC)-K|q`%~>EqsGE0Tcn;}50@r7+B#qO-{pm4=B>_R z=*q5AE%k9o>zBr$n_zVmTAOETsdhGRWh*Djr}By~FwE16)gU*zEjhG1BPFVZfon?= zwUYKP@+W|HxEoaKzINVgkwU|tfCQxbGFAj#HgrDq`KoA1^&}m3Or3v3*T;g4Z3Ait z$}bP|yV|k{IPHHzzyE9`fg}%cy0A#my=fZ+4PJyisR~Y&K6>zTrGgGsk~}aP+Qi(k zE=LZPHrNbxvQK9W-t+ZHzD-^IQ4G@^L4CrMi&$)D_o?rL2vsAo_5OQ?9nhNCd)ogZ zwG>)4grp=gPtP0-N2Z%-H7j8G|U^Q4M# zWt9)kC+VoJTTKn%DjPuOm_&o?G&wX<9OjQ@^;2xewyMSzcj6b*!8DFox&+ zUux?lIZ-{=2AR8Y*E1r!i@BvTB;u$}gv43d-Y$=~v`A#7_TR+uJs9!F|3Ar2O17Vj z5=)3}d|4LdD0*4O6SBH4%l0ICc?h)9-POe55eWgTjnk}5F~bRx)2+yjN;ZxzNC1v2 zsI{w)fg6h@Dfg<2Et-ra0bj^SQ2((DfpgQ}=&~-!>Us9l)-SiJ7RRUQt(|=IdoW~Q zfzg~yuQQU>@`yW_b@ZkED8%d)rw?Zo??l`%ApWQ;_9wfCvEA+tI!+PxZqN7nh9Kh; zUM%^)N+8mXKgTyxoiQT1Bp>i6#ugSm9`GmUTH*h240J)+iHBM$ZDc4=%KN_FIR^g{ zlmDn2!$fz6Ub_kP~YgCG}yd&qBJ{F$P&p`6@!KR9z|=P@?ntUm+A$9J(x)13FLSy}4_&b>hie(a`e z?9u)tga5xIy?|_fUDij%aDMRNELTy7SxI#jkY(G3ba0<*^2wTG zl6FF+Tpsfo1_Y!__l1K2cUNPT{8I1Q>LR0x? zax!kn_qr@=PG(Oii=C6eV(Y9V*|&3ScIb{E1Z^jHg*hBb2RYy$je{_?>n)p(){VdY zdx2g3Crp=EkpeMXY#0*p@>YA?WVEkXehZI^yI6A$*d;eu5ah)fW5*5MF6QOP{bwBT zHvVJSOW$~sbAm8&zz@gsjND;yzY0m>5#^8rWY%dYj2V++uxTb?ee>% z7{OBf<1R%PmWMW0dqH*lf!65Ois5wXq8BZT?(U^u#BTWBpl@Kka}wp5FK^#)*njO$ z1xFnK+!6va7(`rR0_L6`p5^_aXnV2aQN~g?z4_mrB#Uy=^e~^WwvW0DkG$O1%S~IB z{@Ncy;$*#u@Z!I?=;~n)Jv;4>)#OeZ3iEXmjrF_S0Cde@DD#5lAvh;hdhdP01(#;9 ztvkd+c3H$qF;e-g@>noYv>jBIl|p%Q8qKbKipf3=vUrT#Hj!;Fh+B-2-4SPfW>JuJ z&SucoVh~dheNAn}QRrI?Pz%l=BZR)>A``Ep2NA8O!FJ)@WQ7YCK$D*~NTzlt zcSD0L+(4=ET~WYwn5e|;znc`X%bKsY8mIg@rP@btvq+7#xvQ(BE>8A+M6{mmJK{uP z8IYMQmx_`T6UeADlEv6JDQfVNOgz$SZ=fq&(4C5v**#qcqka8bE?t*7v4YL1gs(1_5CTfK0iONYvv5cEkQtFXto+#v6dJHXvoV zm+BX$C$0mtHBitfa2(;~2~|UZ=$mof^~NkCaYSn>&%j}#X1u0@kUlb?scx-voXe7y7^`Wf%OoWdg{2ca>k)P5rvn?i1{#G z)k;%!^?IA1&GyM^Y&g*+byO(qoic=}S*SCHmmin>3)Q#egH=#2=^XbvYBJ+z{<^cy za(mf>o|i}YTi|PbM#NR+lwj_Ai!s{|JW23FkgVl>cfHR1(Bb{tvS)n*#JzZahC2rO z{`w5P`Upf%xLD`km^ZpT&}(UFnI!c>Cj%Z_i#v%7)Tcwt>)AQp1iWP2W zeIrPN6W+NF6#Z#ykl%tl-MN<`%4pyxdv^2ONMu#)SJp5y#%_6GyBrTxu(>2R9|vb2 zk9No5uivw*OvP8&@IV58v2`-66UL5G{~3_o{L8{0X^IgHQ&tbV0n(hV6-+D@EbE^i z1pUb)Y-n;|T3yy^y<0?T?t6awlE+W(X34G-jkb^rG8{kduXZlE)Rx;c?}5Ed`QKRI$`NX+>_3x|6@;+w4g zB!R*~4WDX3{2!{E4!*n8mJxili6D#vMA8b*QUL`Ku*$b`L%so}5wbr39`K#j-8qEh zCBI^Quv)+^)@5}l?Suc_7k$5Ld;>;kh7B_>>k@egBCv_`dDQ#FRxXKzYpo_}MM zgrYXnwmpGH^+>Gnd?Jisb@1tXS$1mieo`MArT}@raAqfCi9|vki@*m2C)}3N)eE{R zxJoi9_y77@neX=bizY5m;lM8vvsfX-cN5s`$KCaUk#f}*qW^{EL=fAvPg?$_V0($a zL%!F!Hx#=8{V1Qe_PC%l%Py1Kt#J}0J){_bx1(^pZP5-5#uuh#sh=kZ9qLeq5NwLb zboo-e6EERQFP1a-iy1uvvd)Gvj8wh>=LU#R`8H=1^Y+Ap2NiN0rpG2?Q2sd2g!wJt z@9*R0Zlm|DwRg!Gj+_f~P{%Rs-@_TP%I(A%CPA9Sl9!TuQB+yl9ey>PcWb9aXt>WcubdrQ>b;8 zIA>D~a=r@zVShm2`3ib zFrvc{i=OTX8>j^3f^*^v%VOYfWC8>N{1=$D)Io9xw4GN0kyE);B#75tQeGlfp5(sb z5uq}lP^aIBC=|dwlBkLe@!&*YlMm=3yRsdsV5b!U_(Aw>u3H)k1nR@(fa@{ImJWGI z8n&B-s{24qAgDl?m=)>n3yYJT>KX}k_K=kB&P&n^;1@yC&LLsRMfezOMI z4|$lB-#WAZ>%beE5R*Ba=MrmNyndb~q+JeBL}5fdYQUF1Ucii`(;%p46BA4tR)yH| zvXM`6m!IZp>cm%V5<6I4DaL2&O~Q}$@jY@#u!q{qSBu1*;ZS}t$B1QBc7B7@hE3v8 z);AR^J?{5mMyP><4)Q@3eTL|A3J9+q=(t6>NQP97 zB%^A)zkcEPdN}NZ8o=RoKr8ZGg!yN^yB@Yk%P19@nU6et)cTM*+k|O=iuU2+rVv2g z<)Snk3|8T>?h;NPQ3lRaj@@}o^)F1x)fu6V=6zfqGOnVGZbn0GHY#{dj&B+HKR?>M z%YiE=t$%cf-Al-oCJp(ep){zq?j{L4OblRZacnka)`e(+*ba8gXN265X-(pTBzD+B zHyV@1LzBl?!;vh<&XOO(o#JOSFBkxV3k8OLD zpP!+BzOMgW8C7fmw}$Q?ZLfc1@@ywEzK_JmM23H%Yd4`K@j@{9VhENztMGlIiSCr| zYu7?lHI|JI<0)D;uKfy{;WEQHNlx-F^(2$`7?Zp1h&HzYfRn|e?SMh|JSdLtPpWN= zMUobX2sfSG=Fl@Ugu*=Wya)u>vw4gmAd2ZYtG@p~ZyH`O07jb`0JA$FM$&UXp3PUD z5pnth)#d@#ec$NDZ|JHqS5GggHD0L5;s{=q5C2$mR*x;pSN!UQ_M~Z|Ou~=W?A$WLMu}@`ppfy=Z9XUO|GlT`)V+1<-md+jtGcT{ z^{(1`uk~AtIEFAuej@$1az7($Bp}@m-W!f;T&@&qU&&=vPnL#ngRDqOlk|oRM!8HT z*xYR$d-C2H6>h1WDM=r_m;xqgnLSS&J6SjGzXV!3!6e@|AZ>kP1*MC#8I#+U_EC0t zCC5UV#BFFlQ!Uv3*|#;R(E!U?T#_Lz&e;6;_Y~6xib8KaN?mb>i6*P~3vzP1px!TW z%%NQDlEuAXa}%d19Lkconufw5`lu~oal*sQTF=MgQlN$NR=+iaKMYUbRdq4}j+wfP_lLmm_>!Rez%M53*q^wyjXUXY<#+1*% z2;K4~-aw6~DDW6h6r(WFFrmRIq&SPV1jwOZOuCurCyX)+7|qcDR8S=uYl@8sJ+j2$ z{dTU?%)7FwHC3edV!VQzOBkhKu_q<|B*}MOyS`eC|=vjzF)cS zr7VRO`#vw(ODVy9Y^7{4!9MyX>oA5D4M2OA&{xAV#S4#A8#Ewm+!Asp!+Tc5mj2^?{tN>79`#liBtaqgksh^{>;uR`yEm1?%2CY)%=@kDO>%Tuy5jkh|OSu5(zI1b`f(<@PDiq+=TO^;+DuC79grcaxh;MJorb!K=A#jh= zl_2)gRDmHVcas#9L%~59Sq>?U=d8_9|JBqazcyf?^!PIgwQz#>pGN1TldPc@f2CN9 zV(Mz4#a)zZir#H{&8`k!2qD3CxPTlu{<3S&VJ1KqdP5I7ZdGF&6zJ??e|LLOa31)6 z0)8=YvOjWb-I2vEfDltt^L2Z4Il8x*w-%$gtWNeJNrzyFrLa=m{uFopy&T4xvjVka zan|v`_4@+50MW8`Fa^z0FpT50;MEQb$uB!hzT3QYBv=iew=>) zDL>uy_3`%k9(ybf{CIgf`Pe@^UEiONbQKrK-2(kOy%z8O>FwnxnXcAQCel&fafFWI z2|A$ik{HjM&F_OXS(ba?PNEBl zaMtL>$Ky1(9o)_&8{;4UYk?1ex8dzB=xx1!pQok0>K^s)4Q@j50wR5^Ve%7cM=&a5;l7%;v1v`H z9f06PKv98VLordGp5}egHt#y?V>`8;b$oW#>Mi=LyB}|KbnuUgHrsP z@ZD;bnZIQZK63Kpi?iDX{(^$4-lHi%jNB6K{3}Wh)}PlCCtg!|fX5fA%i#F*ef@M! zjErpkG26@FfX$D1==2rhH8-z#1!pV zv|aL#*fMc{kw&_!IZxY%Z}wc(m10xC&5Vnk5NsMqrAoB%!wAc82mbp@K-^IdR`=uH z(N&??nva>X$dOQ1Q8^F0O9kUFX%B(j_qUZX#HS*YGxqNKfCfxzA*r8!zJXc1kz zEqLIdqsjbyd{dJkT51%sxhuJv>+JmkVJ;Cm=f$KgBS|2WGFNXyp_mEM3%cCjhUsc+S~h3*t` zjSj2UFC0W4e81hH1$O0iPA7(iqN5R?;%uvbJ>eb+VC+7ByZ)exKXdyxeK>#|cUCiB z(%!Z$y^T27Ul6DQE;=_ld_yJ@$lU&hf~VLaio4Mh2r*fldy~qx<;U!|#o8crvbZ>* zhpV*Ropq$6dlr1x#Gh8){Bv`!VsKj^ApLR8YHi5_E%7;V3-N;4M7Ld6yr$uXtzltP80RK+0Ocs#)+H8shdp(-sh(*j*PTrwQJW7RjAQ#ER>H21g=uI*V^U&XfG$Ei{rq$1*%4%T>N zxr;`96a{!dlmwUR?gq=VvY??Z>XjmN(Z=5>oih?PFA!bQ$DGzWEm^VRzJ>9S3MsV2 z;^x5wy1cb@c*_n+lcVaO1Sy(ws^kQvin4+##)unDcPSGgRYq+wl${E#OG>|*iqm2R z1M2u15V*>cqzH;&E7gellpqJxdVl1^kVC5U+~CK=-l~7gZ!?i;SDJ6-dceOY36&S1 ztQ)|!O&-df?u!Rk7j9r|H1GG}ID^iwu`47R8weF185IpIj7p#f_htg{l;QPWYay_n z?NGuH(y}9)!CX4iX^>ut%c6z8O@FNP$;|QUsVdCD@8xw&tl?TwiiX;qpxAjr?;(lo zyD(J8mTpZC?#B9%U%6wMUcqNnwRvS}WAtB`K}s~TI}}XDN_{+J;YA$35Jx;(VIkwk zdWUN&dKGgY@mHJ2W!h$k>}Gb(Aw!Ck-JPcQNvSl98UM0Eu<`=Z*dR6K=7aZ=+af?m zevnV^G^X~>$JW^yg0p0x#>*Vcym1ZmB6KYIZBJNdV)XzkL2gGC}w>X=P%J= z_aQS6$n&#@%gR`Bitd~)Z&w%Rx7(A01M8YVE}4{?E5joJ_2%QWfT7glPv)1;{$K#d zV};s$2a-eO^fdh#AX{`DYb(x1oBq{ZRsAYp7}t8-+tcIq?c(KRb2W2Kjlr!aPyJjU zMCWf*Rofx4`&bZ4dqiM>#3)E(qqxp71fi3Ut;{x*$JJR{^awJ^;=9B_0nXIp_Ca|@ zcae7Jm;%ZCm>v9u&u_`Gl%Dm5fYlCBDHD;(xYeYKnp!oeXaKQ5N|`2To8jy{WO;jJ zpQ;L&Dy0P%%`e?$Rm@`xZLu+WHQl~&abhpAPpA~S!Z1>`6FzipUS5NpSkFGcIgAU+bu&~fsTB3h04X;k)j>>IfMGA0P-I=z zs+eWn9IpO~=Sl`K(i7CD|L>^AyUv*=rZZBh-kiv&U(q>Dnr)=X!WChkwFOD?$~@eS zvfad<_V^-p0WrE^^*Ca^6TNafg+ESmj6{1MkasZZX$76ePw) zNq-J9X~3N7Mr=?6Uq7=A!&C4`TX0D5bKh7fV0q_mp3sx2Xj*A+HnnAa$pvF{Pu#%5 zA_z+`07MJOZ|*YGTdTR%qliOYk}BR^NU#P+^igCViLmqSkx{7db?{i7^3h(Zb@$buf}zoaNTp%LMi6Yw zP7*Z1J5Uw*)g@ET3* zvsyP|BMQ-!)MI12T7}G!y^t%}mmruA9w-hNAO0Au`=J<%@ROo9&pbr1lt|K29yNE!=vP7j=SrR`uJ;QmDdwFg_5H zseR&4>8K|Qc0Dz2Tb9zcG=lOgzbZ3PX5b8<*Kw!t>7$a>6sthVXo6mXl0$0;fqmvj zt%QjXR7EEv3J?jXu#yrrHjjOgXEV`Zo}q_yeaUur^%^#sGp3eO~si z;o}>jax8;D;UF<-kd~Eo)&m>OZQ>o;MMx>Zm*yF|HnVsj+oJKqqSYhdr#!P{sh=s< zt(f+p{`E*KAYh6UOB+c$wXMn&X52wdWZOdiT2x|FArpkH9siZOzaAsNRhnvtN15z^%#5O#5K}6s zsun*|Oul-GIF+d&!e2Q}M=?dTJy=d9nSL=pHfkKALj$GUUGT1o ziSeOp&W3NRI1x~`Va1u;2RZ*SX*LL0CqTIc+#-bk_TR?;h12Qd6pNP!Xlm55px-O* zwGLQ;6E)TBLKrBo8!{fH<>MOpm5w-rGNq)=SMJNV{0`E==3#*tVb<_K^44Al~Opg&vk)fNngNFXI1T-IHhSfJVSPy(nNKpmF&>Dm-yQTZ#8GQS<%NWLMk!x+6;G z)-5@C&fE>aIGj7+3F6VsFtCITKR39w#AWLLNxOqpIC;O$CL=Yh3L$lAZwq0r7eQ(O$gRKSv0^){r3d7$0znXP({;#~b9B6{4`8qG~LQWXZ z-7MG(D`8nNOR<_|nsLXW9>B@-K={gcWB{$!2(s7PxqPF48w=yR7!XZ%91|mG8s0d} zrg1X>?dMVY$KXF$b3vWUl!nazgZ7uA#741(wdpObbLU?BpWjfN19kH7NUD1Dd!ZB(X^r-n^xC&`0Q;nn2;t_cv)yPve!x!1nn3dqr0#h5y-pSz zL3&erKSSKMKxDeM{o@r+_O2g$<39`zhLaZml5)i*41-EA5-|G>dfR=3Yv$3?PodLH zhUubuCy-0BNc{x1QKJyCOp#(HvM6ohTB7$$<`6G-{YUdr^iRZ<60PNOU&&_}nfoSa zuCS_+$huGdX+Qk$@HFMrlMZWdcmj^_nGW-y8&*4O@7DS4rBjIDD;S5}4_HlqTO;q* z_3b5LbT0pFPYj-)unC;rfLiSIf;YhmQ0o###-R_dHI?#WZoYZEw%#(p-zzoNh6%pJ zkgJhKJD8<-u^gY@YN#YK>y(CRBUI+6XO_sY^?iM&t4SD6!Q4W>ZnL*ncliUB(2d&_ zcJPpKU^Q`0X)5@85&CY~1>-&<14(mizy-oafGeMH`WfUA-vSC0J?=1wy8$n>9QlCe z2a0QsD7Z4K#7ps3fFd&T`vDr?Y3W6Nt_b0H8)XGmESeYrCN>7P6At`-k8>a%|G=qQF!WYV7e8M+ zHyeG-l>A_4?*8(1?N)XdA5XmPv&7*1oQ8F3$F1-X6#@|5ua{jLLa@P35Se5RCkQ48 zxbCNhxyIf(i4&!{368e`5pJ2Nrj(ee&RcCG@Hsy*abW1GvdF-ZDeV-}@k#iMctU#I zxC<+41Ol1g)R3mAyrLuoc4KqY-v<#Bp7d$2*O_>w?fz)->bg-K`sF^gdlGnk>#GM8SrvMR zCJ8(4BCC?(53Dns8oBLOh7+`1KmFI(f;GbU3&%%#9fcS@oL+S0J3~c8G(^y+gw4jt zDCIi##w=_VBi?JNA=4MnkYC$C%E`fIwVCunF|&Q8kes-3!M`kSOe-#SvQ3?8t2x^q zk37z4GDxjLlCihi0#(M2C4Y&n{H|~M&^t2k^IHI)#oMkJk1CaGQdtI1J~NNnAqzgK*)04Qa0$T}EF8|S`LB1`&LV9~tG zke=SX<+qpk4j^ZB2+w#veSjOY*DcQW!lj~yV~v2mY@E=MzF>>AD*bub#D8x3-^UpY z+u#`$#56Q)xtZ#I#sYtHlhH+#Ga`;psT%>6LNTz1c5}EZGrgqe?qnP*dA5TrZ=7GY%omb zk>4E6g;jnf-&iduP@pN$676HpnU(&7!f6OrIoK;^OA(%U)0Sny^k^z1MQo7R-lx2A z`>@_Uhd`BqS`Vdi;Oj@Eg*OGiSKv2K2#O{Y;rOlZdsSTS>E#~cNxL2i&Ci-L4Oe&Q z#&=ZS98wm$I)4D<;H3Ocl>7M~nE38s~ zgjuU2vDt2jQ>Qp^o$l`+XD=5YkP?M-ncmj8Ze~AlV?S7jiG$fn&ZBpuNZANzW@=_X z$iu977vKe@mf-E2+)H#RNRnDkJWtEcJtxPf&?U(aeh(9*#6T)958V+JKnbF@^^X|| zN9#ob@a3gzH*hNsd_(z%M!JoC$U3KIh93w6kF2wU@mLVJt}p+^W8z@NzBX%4Rqs%7 zk9zgXOMW@xM>|vdmArQc_WxG=BD`?=`pPp~i(V#()YCFy@03SQ2lr%yGIH21m!28Sb52x&e$%w7G;$5{aAfn-DY*st zVcpV;-LSUJ0Zp%B5zn%k9e>-kA=mibGws+HZxs**y@Pba#t}Arh-AN!}+*&v;{4ezh-wbYoO|<<@Bqs*{t*WfB(5Ipvk+DG3!;jyo^) zvPYMp`Y5+OTP<&B@{>lHQf$`nD0-jO(51GGpfYdRqQ4ozbBVEcP*OhV;TP*H@w$I) zwo@}06QV*OhKvL%og6zw2)+sZ0q0RlA(8S^CU*YEqL0WP$`TybpV&o9b4d4-_*&Gu zkjFvKC|x!vlLj)`l#gBot1%9|?2_lfEb=y^y|d!TI@xi$d7rr$GNsS8XFesTvYzmt zrjJy$J-OLTbt}~Vs7Cez9ulK*S{O>%2UhJDR;{s?r(BB7JhJBMHsY;jBQ=&(6_NkZ z*k)Wfeeu&n!>Xz%b#dKF*^)0F0>=zsenvR&4gg!GqheE^P-OR)mZTY9nR#S|w!6Zs zBe=K)7|zu_h@4d0vQnB7u;hGYYLs7+Jshm*s}%$%5wY=ab?F_KuRLAdUOPO5+gVj# zwSGf*El1U%+Kgzl7V+;@+TQ*b?_4;iVfdYh!M8HiHXfJDImMAa&Iv8isihw2#fN9B zTVLs?w4Dk!Y<-$_6t(rV(nMKJ!I1Gu zi8|<&ce|s+=rBzVU2eRH1>Y&UTd%)U=D>Uec-??mVS0LW1sl!T-r2qM z**_5u*V^xKS|Kp4?x9gspK%FvbN1qZtVD1sFB*>b9}wB1zbWMDhxKc5f& z8PQOVU5MgSV#1t4LF2FJf6i@&2)9StClBK|xU_ae&aw<+bp>c#AJGwp2-Wm674L)4 zT_WX%#vu=EsAhz_CD|TjpA{wZms_$F{XFXVg~ltn{|BjJET3SK1X0I`xw9$Ur2mHZ zQMN=yu0DqTZXovp9rG>gMZ&Z&4R89g!~laA*FBNwV0=D-K$~dZa+g#R)J;xB+E(K+ zjS?IO#&%p-=BC;>k1aM_3MH6}40G4))J)P9llD}sKH-RnRrt}ItPKYM2H!?d039kC z$%E}8?77iU!Ogk;F4whok|+<`zjzYVFjMb}!Sy6>kl^UHz6a9u+DSPdQ@!)SqIR=M zXK)jpHp&)3m+O!zu-vrMSNJ{xFVVh&l-~2$8!!4+3+tZ*R#hC2g6&$Oqk24;UdeIN z3!<_NIAjqs>f*T1TreXsY1}uL4o~8$IGQy{MYMWmZHb!yzQ({y|1dbFgTee z@IRQ4fChMNGhk*j(1QIb^Zb1q`t?Y+UQ--F9Ql`oj2Nh83tV@Xp)3zLzWTN(zJMUBWp7+5HAl8f|l zUN$)5PSl(VWW~*|JWmgMFMdv2g6ik=;U~I1pn6*P4=7bfSqGZ_9ns_N>}-7C_GV@6 zD^S==n!mo43JBCpjNYY_Ztz`9+k%L?J@LS69k=cg$<8g6`zh>SvpYep=@8C=xxAC! zpj4zxi&_Y>ujqo#QAE&fK{L!s=%D{1Wte9kwdmB%L4tC>CpqndAp&12#Ytd%1Y)&V zqlm1+0MkjXt@bFv)2nbeIiJ_sU^UzlU=$WvDQ0ehTdZ2ygPLg_y)((N&pViEH3&11 zWP;wc_K&lEaXvTZcmB@~+UPqndtJ$Rwb8v22$tuVR9ZDyJ42%b^UmGR6x*#Y+ms^! z-&L`l*uWh49V8<5Z5~%<3cE2~*m+$ecuPqwT^{=aMHPAE8 zmH_BV09@7ty8irh&HuFRT%D)^UVb`%T!+5qnB!Oye7d%sbZ?(fIu90ZPdOXuVt%>c zh%X`izlhlTNC$ zx^2yC!82)UYmL7mM>&h~Lw#fWi8l%zh9r4Kvc;G~Gb9h+`25Cr`>52D0M+_`#%1m2 zYUm&A@bFn46^7ZWu?d(vZKFQACg95G2{7aF@<4xvg%^+(&%oI>*hu*BP zeI})}fy~Ny=T8MT9}3W0zK!}4x{XR%19mf!&jft>din}@epy~|JTJX}Pq=S1xHKwb ziOK(ppIm{eX4yVKja5$JG)mxU<##c7w>@t@B)q9&RK6&-&M<+N!(NURZ9yCIr|2Hq z=6A&?HW}gRjcI!xAuHP;J0t{%S#iJ3PqM5Si4>3(ek6(Bf{Mm_F}{ZJ z+JjJ&VA~~m5Ch)-X^#A4g)A5fCngVJk_y%#yDE2AUY^$$Oga-emcc}4zZ13^W86jjQ^Vg#f%go}-k|JP}>(sSkQtK0w|JWwqJi=Lm zqvkVp?n~o0o6!;V-#I(ZODcN%`0{GbX_*44u3)6rL)IT}isss$_ZKFTUOs`@qJwj_&TxBOuZ(A3M<2QucEVeB;ft^?zm;|1RbY@E;Ih>J4b?0(!^U zUIMMZ$L#YX-a?d$Ze< z72noo*QK~U0?WtKF9d&Xplm2Vo0-zB3-s4(I!LFzP^`HZBX|8H$hR1738Eo^dnaFT z2`@x|qk;BS`Nvp+uhMex zxMFQpd+kejur7g4*p*bvR4Bs79erpqxkeYP)>nWse)GEC22rs&MWJw6lMR;4k@gJB zIw;bXoa`B7MV@C=oIHb&<7$bgkix|xir52UKWk=l&C4RESC_Wf)3)(I>T`zcbb}rOld?rZWU3#K7mK~~;_5s{Fa;rnPRhuKKaP-EhRf&8 z`Kh>gzP~*S>bB^%8Kr#*-2X8$-;3-3;RS!F*apS_-DazN1F8VUA7u1eYEcKI;>7=X zCIl^*Ol9>~s0{?Azqx5CmU`#fNsVndtfE3UlJ5r=1TXxGUekvhs9c;J&c|3exTnzC<*Yoy_T9;c3)#i{4rNBV zXM*k-rEosOTDrzjs034uTzR-6Cet+PuWGg1qh!7-7n(|tZSv4GfgPImQZH{l->t^$ ze-48V68bg^t&Uike@rw*m%3m95?mO9??u?Xh8_jwkJ(DZIotcuoHI-Ct}XLnvl2m| zL+B@E1zK@9WK<|MBTbdOVp!MEHAV-dx?Bkxm;;eF+ZoQlIA6(&`Qf2Y&1X$!egNV& zaHXP0H*S-Nb*_)?p6Xy=ej%fP?BIPr5zjkZRznIcx`#^y=EbYz&`{?p`gw%`1=@KO z4)Ct&Y#sQ-ZZS#Xy6q*mmXmDLiIKf33ennIvt9f(E%VDcbFpb2k=8JoHiwzkRBYHH zFH=kh1OlwdDp%_7z3IBzG9Dz znX}${cT#iD``^w_a)Eia_zp_H!AYMID8chlMZ6v~ud_$wb>`8iqZ-|IRThh39u*^~ zrI4{J-yGD4sH#w(sqBA1rV&f1I3>bw8KUNqruoAh4Y{zH+LyUZU=VeW^+d7MbGuT4}4@OKB38k6@B7dum>5$nx zKpVL>uS;(;G&sTqhv>(l@|GGrXT@DKQSf2PY64YkrV=Ch_`zWP%Y{h(HxTNKSdwpT z&K1$4afW<7e8R#;JMVZl>_mgaPtl!M1-Ln9XzAr!70lncO_~|kC_D&Jttkb{5l>>k zEhb(sq7Xr>y0CJVJ;2{`ly)!aFsCTas>OQ6`q5q#b2qUl4iXv0{31P!BP?L*Ikx{P-S?%B!Y-njF;bjEfQyIX$U^4MDHILbm z&f1WIdNv$xY|k8k@uQxx3>jy6iNODAH##L6CzoZDyWCR8OY(*$IbjQN-*G$J84qCQ ztQ|0(D9oY0d(<~G#z(xN5=pS6NnEo8tkn5i-5x4aJc!ZmKH1ycK%NGQt<#SKt<#gv zh1#>qm-t;}$lz2srH+<2tR;z6&8;NC84V=^8Y#&nrQ5n_1JX|7jn1;>rn>Qg*6k-r zx&jTQ(}I!9onS2_gusPF0iU6cGyeOE(XE;2{8;#m3;)(XHX-+nSW8zMX{R*S47`ViHzPx4^*4Jcc z61(KkL~gs9-qWuUu!rw^L*nBC*XZm1a}s2lbhvF4oRR%~H?^s)*l$ zEWTK!k4AO-LO?{eDhP=oWQDxJEa=7tKnE73eo*dV8HuTG5jM#oYKxar5O~+l@^fD! zad&ozMK5KRX15t}UlUNp6c{q#V$1+VXkXrYfg?rT+qe1;eI|F)8DF+nW*&8bP9S&h zhPD(qgyaXavK%S7$Av2&Ys?!jC&*a3-bQCJBfFP&c_M`h9(h~V=l3pVaxGxfNB;Edt(E8fH@+!OJx6j~2GT;YgB`29s>xTAF+>H8cg4;G`w+1h zVDz4pPM{_~OG*2mw%Va)A;yAkk`%n|hkA;I8W1W$^;L1@ty* z`d%E4e7V+cjjRFLpYhJ0eUWZA^*#tm%Bu=LH{6>D16Q4`axtPW(Z*k5c@tuBj-vOU zIHU5(9gB685GWsx2hZ*68)BxEIdSCKF=N@jx`hr1pfwjxgh8Lp!djVs(G4o-wAPMU zK=>a+=n@*xlm1D1HJ7?b$=nhu1}&qM{S9fXDORxAadcJ|^3De&%fDL2G*bhJGU|IfYVj62MT9+?H1t9DGRA)d@ChJoBa^ zV)?!8C^e^rXz(%moj`t{J13wSOL#xL5w{ap2@6 zV<9N6VX;v6B4V8%kOPpZ3CxY&ylnou{>>kn+(`6bF;pUVZ$vA?56SmsgPLkV)0%_BfA)ibSMfgeODgz5t zRX)$EEbRf|1>X|M9;t7)R6CNNK|_Hzg!2cgS=dCd#j2T@*H+kLrSi1@oxh zc9bbqaCtDO0wV&I5kvO^H3|{Z&)M`{k&r)2R_pNg@L?`XTLF*U-7ZtB#B-IoW6vIX ztL18^FFtBt6sljjp`O9JtFIfOC1+k9Bc{sckJ2U%xX7JU$(`Zw1;%2CZ66^Re|>e& zTbVushrYhHraXYYVYM%msTyjfS%?!RS}t}2wlKHXiLHZft%0SVr9EvIFhgj+jLdBhHSvBT3wAGA&z-rTxcEyk5Mln@ z7WQ`a@UW?PT;S~DvS1A$z0_^;%|S)3?er&XJuV zY??a8TRCz_u8+uc%FxN--7Bm#c}6=_9r-}_W%I&<)nSI1b+X5#o|2^1Q z_bKu8we%j4y(RhG&0_c!36KiTAd8 zy2JBwdq3CApHFv>+j}DPlW_ke8KS`h@nQm8o=qR%WL4RV41;5IFErVq%-jaYm}ybb zdI!}g=wl(O1ZcYui+)}SP&$vC_}6Yd%dYm6nT8*L_traZ-^?Vw9l8J?&$ zhKO8TT8{01SR&hYP=sP_HbyS(8r05TyS^P-wG1R1hzG5B?O8+u-5lc<@hDzh)8_^eg_Dc^cg zwe>=eLDi#mQ(?99MUHd<-ESoQJuqu+tJUvlO5MS8g=Z zNA{(B42ax16|@}o<-8n4^A%0kQip|Y^1W#CvmhJL^oc?+N9{@b%?V*gbDs*x&Wgh}S2m4~Q|Nh-fbS)lGzo;~u>Kta7iBMty z86&0n5rwrG&t4O?=`{qK=yP7+IOpNHK-D!CfInmk(k5DlzFgYb`w!~m7}>!&R((Sz z+nv+ZY-cg<_ba*qfDVuwh zp?$V9JU$*b{Ef@iHjDuC&~HZd*kT!VTAD0*nr!}(;Y{0|l-m4vL+|hFe*y|x?XL)2 zKILO;EIDoTTaR+n4*%ppP{N$!LIdG1UYEz-!YY$ z-wI?W*w$jx)CVXf#B7LH9&aM#0snDcS8zy;<||OWBDJ(oyE;b~fZb57xQwQfF>2D}0Z+^cY**mMj)| zwqB-EX~dH*8yPOBYZS$G1^Co#lOt)7yg2~UqAy({kvma9J4$^!A zzy!%I&Vs1+@MC7-zH~PdtXkNE@IBu=T$KSI3(s3HNA|1UEqMboNcS z2j#;t^z20UYE{ePytU23-jSlC-n102e!N~DY>M4~u%3=g$~hZqb~K97(njJ^rNv{o0r*h7SfiT%HL! zX@SkIV2_FSi+I{9GdW|`WKlg3kPJzu#fq?s7BJj#bi7@>?8VjiDAg96f^ajMj^s;V zR$&mxxj^Nl%p7*w37Fi-G5o18U-{3Edk7wB@>C>R#5}Np=mpr zP|}(WjyS8#QOk^iAe=}^MykyeItA$|N>#l#Lgb_Fc_9#6AZ^Q>rwz$64R`3KBe6s$ zSjgK#Gt8S?4Sa)HUyr&QGp@j?=Gsu;<)mK0sw+^AqF=^m<958YHd^IRx{wSzUD*8L z9n{CI_^W4kEmdYyNHO*10bfp`=xpxK@}UtS>LwQj?e_W zw|y|>Je{XX60L+vB-daIMwuaadm9Aa!1e+uV?w!{YUNEc(IePkotv_w8apSq)+A@q8pm*bvSpr1$ABN18n=%dk;QV)b8H;V@+D z^&}71l|6-Buo$TS3&21>zll-xl}w2xf^*fLI(T%?V(+Z-Gz`+v1d*UqD6j{EV5aLO zoAZ%&!~+CkQyzy3_Km~nBt%bJ8Rnlrfv*tg=xjrH6Cpx=u(fr4eO-eg^d_iA*?7x1 z_~Bbe-FD}s->Eih^`vK8Yr&~^i5xu!s$5d7O5BqiN7}$>Dx5(= z-;aCtCNHdQe+a$HDBPS-F1WS(%dQB$25;0~H7?jl{;^s4FR${#Da8exhH`6tt6Boo z^CHHO5B`gT|3fO^zv8wwGTci^?Wz_gV-STZ#5-5+gMpx63kh#aCDr5@L9JG^dRDcO_ffY4NGL&s9geC3QlmAblkPtA$ zqd-Nxf;a<#89_~Zpxe|X|5a`L`(O2czbF`|{AZIRv1yWCxIN)e_G0qfo}lk5e1JEy z)Zah_RKVX1N}Pfz{PC#bsxNZVYg%@W*qS?mUQZ-J$1qXu7G4roC`mZ}+5_+|xYlq$-}rIxo74?L!l ziV|%K5Q;}2Kx9*veF6USjrx&gZuV#KKLyHSMMLEmhE?D}g03x|RWKG%#;D}XUKg?` z`^)m91*kUA8`>mPO{1(ozY55)wRz)Nf;_T~>czZF$;$sBC0JZsN^esELgD6i-C~JG zBl8oQ4Jl-Pmk7jI6pBKD`WiBV$#}EUmZDCeeQie^vHu3>vz~Ol4c(6voqODtN_T6y z`KEI7pY0UoFZ9jz|053%+Bv%+!`ZEz04?zUx8K;`&-nkV?=|<={(m0ga}K9ND7;DP z`0PC$-bQ7xb^&ykDg+)PPrVKhL0>7FcxxmO`vDWoC&)hljix+K$BR~D)1EZ|=FFU> z==n&8rnEgTbLJ+_{^p<$vXK}}twL3jSBx+fX|QHR@JkiVD(lRO?dK?BW5k0mfEet) zit9Shf8=MyO0%@zNorQfof~BmLd|K?L{+oNAf4*+!NhUoHd0`m&f=JKhE(POTF^QG z)uq*cQyLLb9V1ee609Y7X|-hLmL>6Vu}ssl(T|*FT3&u=j%G6cyjVJ?2cTlD9=&qY;Gf{@*MnTPfO5%H?3<{F zVKHk{BG6|CP8N|CKj(-YfJVJu&*q#^(xX%y0Ab(nB64N7q4;%mRCzOkW#%{e?-})3` z5&v%?Bn-)uwupu76Lf{xIy~#2{ms??(BU^m{?Xq8{m)KgXD8?Xx!zpse;(pn(j#x1 zsh#-S;%^p7PCQ^l0k!JJ2=)$=eba%{9*i z(_D6*m-f{BQyg9~(_tKrXZZ#S9Jel0*>XTyG>#CHrN@zNsyK3E>Ch5a(FTXrYV~f` zi-;RuFO+*(C<%V&EtBl*&Y{tysJ%GSPUb9)e9h%ng;L8N`pSq}5sxa~?%X79>B zwiS#NCD*Yf{E ze1-+v!L61KkM)g#-|To+>nr2CyfV%O)iROW^d#{a7ifB5Y^qJbwu3UH9~kpx@C>LK z#TeP6#@=(?I~-BbQ)!a@xpEvRFEk0a@wCNOJ*_APPgI* z@&#Rj8I8a-<`W<&kQ538T@K1Wdo|zuTgd;vP4%O`Mf|_9m(~C5?eDJN|2)WN@&5;7 z{AO{knf{$dW{d))IDX8g_yPD=rSfm^3{)zBp%G%rU54a&o)pnrXI(Is1vl)wCGf9G z8uhR85>$)=xbp7}0Im=lsv=_~WL|)|`uAFLR{4jvVw8XB=dbdwFwXQ*fCQ@id#&_; zMBiNge;3OC#r%J7uhGov|F_ri{~zYNxkl!Oue#PO{?1suqp;zEVKP26v*SFsNo+~~ zFjudY3FSh~(Gu}sVms)HIv23ng-88NMU&HZT_`3Mxsa^isiBezJHcX>X&j4LQAzD_ zE4+3~tJE{d`88#JQ8ne!FI!6{&a1?bk9n?^N}X3t#k+Rv=n&WiWhon9tXETMJ99xw z{AJIZt+Xi~g@{EQvE>>~oN(U+VLFTu$K#7jG~<<<1UQPsq>slx$!diQLpF?vcdLdw z#4BxB`{Rbe1@~x(Ow-D~bTi9|1E6Q% zT=FYr`qGtsm9Zxsx#V_csB5jl4Gc^H2r09TlVbBPIjz>~ZdvL8yt1vYwBzhElVP$r z3Xmr#JGfgzQ7saf+q&-A`kBeMeRKJL6pk76k>2+k^+xq0B)8B8&*lHkokqRh$h`k( z>@;`Q{Qn`oV&f1q@%Cx>;iTf?o#3YaSLkO+tWVhYN`}vCJuV8SH9pyzPNUdSiKrZaO1)B$t*_&%p|Z!R9DpGjQHH82Pu=5TN|xS~?o578xJ=;V(E<4K zH#Ksf8~~5J;obyIwPmCBsjdQN9sohZe4+~P5)GBjRX&$TL#s89902Pl6oTPlBouY> z1F#7iwe8wotx?;N|9iFHsMlml14xMid?yFo;+%RI3gou~BEB=5-eITT2Hz!l>Tu?( zFldl~(^e!VP2+J|i$V~Dh;d5fIy*mZfu6aT1$`uHaig7ooVSj;gWrHJr8F{*lqU#D z(8o}Cv2|Ymx06BZS7+pnoxQzUqp@3SG#m0~(-i%+dfMy0>z;t`-b2ETQ-422!*}4t zjquVmcu}Y8nTv~V{}gOD_V%g`&1UH z0Ly> zizw-)29Dtj3=x<{fxuPe-x`4H31TiDRa6UcO|@k85(M}Xsc<|*$zG87V1yYLRhge( zk53iNuQF&pWq6E9F`^~MiZ^m4b$C+h05Fje^lmSUS>&1S0Y2to0B0bKSV%eI7KN`4 zLSJVP+E?$A3m5v}^zal^0T(z3)Q*T5^8eS$V4_japdyEWLnxpQh$2PDbj6w*Udi!> z2xzEYf^b3weF;c3MGSi{fp5tkPaj#046@GoxQt-V`S^cn9K|R)4H4-ct`0Jq7BbpO z96HwS#a(>F+oO?~u2JC8DFRcs?9)fbwuO!#;1%{L=}vRlFw~(;)i^ls9m!QS(#2N? z7q)o)qj><9!NUZB_-R;d51~5O;U{(IZsM&Fec1AMH*EPn%bZTn0Q7x^IR9(l!xpoT zAQ$JM?;_-w5-cd=Ab?!QTSx*jBBlbBs37lx0*?}cJR$#7MW(u@y3bZSdtP#R`bXG? zEqou*F)iRWGC8@Oj~TI&^30hwp!8CU%?JgnBi}V_iCI6q@K4zo5@S%pT{NltKtX{} zXMQCgUr(?%0o1OOYRIrHPp=NrUgwa;it)tb!|y1?i8`6dwWlirMuXL1R?T`IHSbth zfE{(nH$+3_(MhQn6P#hhEk&&SOWDByF@XXo9BM^D$nX^okUw5<0DH7*SX)v)4aI3B zGHdRa2^I*1P(qlr%9X1whCQKKR=nO)B}>StihH5SY>HBS_tPgbTcAE=<1-EF@i?Q> z*EeH8pVif$d8B|5f+AwbLfzxmPByn);QJHGM1eXo@n#(A%sK~n4Z2sA*%uybTz9Teyn70$e50bhtt{cH6O# zIYkn#)6tVTQf%82Vr%*%%`WO*Uz3otX z44D!4r|w7v1ydLTPqwElI;_JNCgA9>b+$Uf^0xEnAq;buH41O7Fa%c4(}y}14q+rF zWPr0oqk)!rz|LGD-RSndg@NDg$6Xc%92YadTd5adud=M8hysLQz{!02aN9E7I~FSF zcmeG1SZKk|!KPr5QmKq!z|o7xtt;87JF`nf*DnB3W&pf8>gk+gSx=u1Y;|9olF{Le6u^BrBg$B1b>QC5z};btvZ4)LXRH|XuQJg01r*pT zfL>>;81%0*(EoylKcQLCz0tEC5_dPe~>4TkUlw(0{%!*H^V+L32w6?qFs2(86n-Un!g9Ln))Q!9Q>0JM1V75iG zu0OaW9pd#64_m>w00G@YFt{Y3Lp&f00jt#0N5$(BRCGv@sG3EERqDy3Vy~V>MIVm| z@)r_@F1C8Kv1dO6>=G<66zGVKF)2Q{$3=iDvry;>Da#=dBd)+izreepGT7vx=}cbFfRM*E7xmZia+M^|D}p+o5PKG;}@W zV}`ua8Ri1$f*>xrTJvq+!p_IVYQn$kz(2-Z=-1CJ&qJIKE{pCW?Q%dD1XjtXkCZ(J zDax~-U*JbdA%mHG<3noo>{0gj9c+9$9e(WNak0*$hdzPR;YZNNwQ%sd2nWTQKpO|Eqy>CccX3d*Q+!&fP2yFBto*$bM^PV9;D#_?o z(*ci{JSA5e+*P{hc(v^q8WwMF>Lsm{`SjtAWj^i|nhdNU#Jky<&XM@(uNL6SC)nyh z?-AiRxG?^>46TXhcI&n$bg$6}~OR`#yq+i=Iox0ffLyC!ztKb-k2`$of>Dzr> zP>FZIE&BAa(k#bH>7h4|l~p_bzTQsPM=@8BI9Mr;VCw}3wB$yAaN1uf!QizmCn`4@ zMR5l-=sFkJ*^l#h_u3Z!&Zn^8q;uZu>R9%Oc*%i0JD02zYIae&?JWo)paO zIcFfvc=X-_UK>enGl8n>e+Ryc^uI6i@I@T4ReGQL`n5Z$T{4>cWKqsRZ>_s>b9KM`79W;4QXtX`6RN=in_sR)NSET$+@c}&^PL_kOsZg*{>S) zos6kiiN^?GOL!<7P#u_830iGf*;4~wRJ9o2UHC=!->U%CzJ71yAyivDBw9~;^ z8+wzht4!@;9%^51r-L&fC+DY#U0qnR*iEu`Z(*g_^ooA!V8*E)iLs zC)CB4h@Jwm*<(zx5 zw6K!$t`oMT>rs;P{iw(Qdz64E%~}D#cN|+S7v}CNuJ%|!wL@ACvFS(+@mDXx!%+=y7<7#P@M4;E1cs%BD zZ|?b)%mYwA=v~#bqZ98#0(?Zrw7`?5!bKqSRu>f+Lyw;^x<*WgM9(0Dj#ZFY#8y>U zaw2pbM}fd9QmNk(BEM@su1&#-uaWm7Y^SWiJndwF?fSVJX`Q@M_t6a}Fow1{>P10j zs*Np@ov{LtXYOw`kbRFGlH3!0&MX~+uYFXYknywGLh=^=Z zvVx39>Itghgq&!F1#e`m#HT-ZPE3hIbcH=+-#irGG0rcy0!V4(kn$6n{RoMlWz=&D ztNqE4Mg*1(0A%VrLPb6z=9S1Hdp0;!A`l^kA;x#E>u`7H`=(Fjw^W z??ji7K5F2D>M0kqm}ac+SqYLy(`SE1s+qroBCL#RwvZN5xPQ|YhWko(E_oX35%-l^Phlz zcE=6qn$dA6t6LQ#+@nN5On9um+6-r6Ldi?;5ne%)m=9m{bQjpZi*-F%ZpJX9P)(u&u&&mj(1`}o znL@lmFDG~R9R;AkLfZqH#5oZd zj*)>$CsKlfka{a7q&h(nB#1wkJiC5^9A+>3`05ABrckWb zB6J>FO(;RD#z*&D00mv4-Q5XgaK`8e2k5+av_b$no@nVRy&G}j4h*E|xjL}zXPi>3 z)Z5g3*VvFyhDX>tV`zjwuMm{YA}IUOXtkiU#h2as>o#IS!nsl}PaUuS#SYC@$^&Y{ zar1vZg=qwv0??x=1Yxeg3LqgCe8MDVP4-IrtRUx41l$U)(>(+Xam22WuhiQ8*74EJ zF|co8fRZkWrdb=fXbR{EC<5RsHTkbx!Ek&;GB!>jqhkiAQ%uGnfMguOg80Kv7yekd zV%Bq=!*Tzsy9pAMG%-k4u%L3aAn&0Z_BID2nPJ#-euhbVq#fxjEJ8-8@*F$8R!vK-lIln z3Ijz(^54}Ynpof*VkRbjPFL_&C(m32y-ZzDX|Gz4fNuX3yxOZb4x07)4)|BMe=2|d zfB(<_D}VnR{Px>#zg3TqtA~eRq%M>nmD1rJ5WAP~@ZTvxn2hLm;5&h*NdC;SaXCUD zGk^~T972v#3@aC&sVtQ+PuLaLlQ@vvQR2?>W@sqr8gdXoE`VvG2KvaO#OK=c zb>sDZy;^Tn>y1JEpng#Q=W6dN&AMx>I_`YVyM~VfC^rR3bzCA;dA<}BT)_ZK9Hzag z&1N+z&#|7MG!Qt0DB~$u=sby^Ap(3tuL+<;QQ-Mwi1~C6sBzvdQa=jNnUoutn7J6z zc_7SWK6%AmGZ${67=D?viqJbYwutk*c~w!)3IM+6dS7EAe>JL-SM^S`S$8cz{5<>} z;;%0BuiQu5412j}K{|Q09tJg?a1nV&N2k9&7CGRK;7y`I_)x4ms10W;^HF;Og8-2+ z$^m}%Q@f*LCIK&7W(DvN%X{7=$iDemdDypY*pIUzF^a(l)71*<+jQbVWCOq#Jb=ta ze_tU~IMyxtd0{)y0giv?1-LL}RGe4fmU^6enPy`zBg87Vxkb*43Nlw~m?w7kn>4A>u z7?bR~V3h*`nI*eG(@=2W$y%#JNKR;o?s4lZFAxtVm@7F^>91|wBplL6fEkS#z*86k zPpf5C>0M#d2^jIS)*0qrRW3qNs$$HyumUKuwTowG-NP~i18@ehzU=6#Yfs>+^HvBW z+nN2id{O6IAI)N;@#0!*?o_9&tA6yn0V#zXElP~`UT_0HG9;x*0#IaCgSLXAXqlL-< zZq5o!@T)BBJ>+ACJaOLZ79k+c23GzGpuq`+Aq2}zzLWIy!A(M8z}#iYszK`BFpn7G zlffl9!lP{LG(1vIXqYaeV+!Z+@VFezHl45)se$Y}28qbNafwwUrVPjwdZfJBiC%Gn zz03TQ@}is-Al#i?P=^z0%-Rcmns+`6M116fFya$Htg@>rttD|UykJ_S2h?K73c+g& zV~3c-VUS(qeE~(J-eT#9ppSiZ+mhEWX!sMF@jenlV!dEOe?dbai>#J+#^$!`dzpr) zlRS6IOs~we9z(4V4zkumh%w|JJGVL}Vz64;kV8-faba`)BadSdM@lsjal|q~(^m&u zPN<91!I|D4csZipb4m*0ET0a}Oi&PB18q7Dwd+jCW)hXg+vGX6hq^jAbUYW*Ar8=O z(KuDL=U~zlSVb(_5~yFKCi7QHMdpOqXhmW|8U7vlrworVDcZBrG9XiE1(4xfQVT}O zSc0pgotCen<_|5wMKvm0V}!o<1miBEA+(jskkI>iQg`Y%OrOwPz8fa0^VZc zV=@L^AN&aU>ICO$I>AKFNr1^E@;gRtdXD`$4EG3gAvtVhY5^7dKLF5E_jnv^Vg!66 z3R@f2qp(B2EA;I{7cf}@2?A7=o@;Hq~t-NLQWuM{3j@2NJNYz!Sd-PA^>vm z{+GccKPEWANfHe7@wgR?OHtr}$?=%TwFQGQWmrt6D?}czOTwNN$ABy=@$?blL>iI% zP%#3sIV%8o!wCd946yeTnia`n1(_=VezS->lxuix#_-q`yt`SiNZDDHX)F2a&j~~# zp;WKlrj}02LO?EW1>m=@qI;nz+3&MCk8}rj0+2WlyKPZ7dEuLR+&d`}hacNYjiod{ z8>-MR2vqpUX2*#yLgwm~m8%UR*zBdY#2n7R6q1=S5B37cdBOeoBZJqu?F}$2IJi5> zPoJGQkw}i{n4ZDx%le|66#(28j(&hw*rTKv_JYh60N)ml-a_xvn?OQPFt{X#D8N^U z&5jF0r30(5QcuLi!SO1EPH#G~Pb`?*0TK3vYlrwD#aZbihbd)qVAliLiYtJ!onn;9 zlNITqPh|&l2T`gp=%G)bkH^3&zXJH#Eym9|XHxVzgA7iQC^X}-F?7xukmW(H!b73x z-Zo$-o{I&uzJRe+6veL$Z8YgR!0`fI^ycvClGFZNa$1s#RtO)qw0cOrzM!n&p>kR7 z3Lqfy;uDEU4}Hq&1T<@9=u?FFlL&CH&kk*Ub|?dUr{<`+j3q)|_0c~+1Din5F!7Sr zAN0=KgY#bN$Rr$}_Xl9pKC&cbk6XWiO?8pb^}%ycWPNFp1#OF~n-zh4CBZxg9(WFX%)^S zFSSOGz#sg1If?W+rCOb zt$@p(x%}zL|5!fVWk-rABaWCv*fnMHCl~5J3?cbPOl&y|#)JqN4FXAnO8zsXXN>z| zq@HyT&7be0WF2H)PMLw^=Q4dW6qBU=047moH|7nEPX$_VMl= z3-6L|Di(>j$8cza&^tU87Xp?9Z0Kt@e3# zj5yaz*izzjr)iSh2<+c_-(v2scP!?Ur);d8lv^DQCTNP!`>p?l> zdJaO$1q{qWclm@s0kZg-OflR&UGcHT&V^s4+#4m>=i62o+S2u15dn>sAb=k!7uG%_ zm&keO7f$mj8=GD8cr4EWr-b{9wj{iz7e6sey)=zI<_n`IZaVu>tBDI=x<$vBTw z{(U%<3F)l;jL|h>+QKkRbuA8KYKl!UZY4-? zuxBNh*VrZ{^ETTm*9ueGzQW3~smjX*3Zn2qt-$c2z({QNnbW+37%cwYS+V4 z%~P#HeHt+jnS^wsiWo^*TIX}zgz-&jex=6p_eT@^8AlpD#F6NsPj||Y3^zYa1t=qP zr9tWL4?_2HPO#aXlD$Ld_+9~VoOcANM*QyKa2K<+5L#hqFFh%;cR7#Dxgbt7LAJ69 zozI~vh7`H`D6mST>#t3TfL>ht5RF=I$ z4)N^NJ{}X~XNnUn9 zbUOT~F9@8Z4)F?-Qb>E~likCo2s0%2Q|o{)F<>(@8X}v=#_1Vtj>R|&@Ys(O#ih-v zSdsVkv$moyN`H0dvQTOQLf~k(@TLjemWhOao)dX6CIR0 zPr)oPDOKzxGSkQG8>1Ld^SZ{`iVKdqnY+|{fwH^Ad`b5Tt@OB@+z8ztvu@P0Mrn7g zay&$%c#+N%zAWyoif2TpB#RxAgrSDU14Yaw<3Bt~w5a~k#1vMH&aN9zamwTG55tX8 zCo^}d!{$m-$;dF-J*<#doO5<~0-h@~I-6gpWs>ky?)=VKp~r}|)=~ObuJkcX_Caz* zgDcG?xz(8xMelD?nr_tT9^y&>zGs;$)dhVlQpTIX*n3)mq9fH|BorSHKYK(o`;fa^ zrdFqNSTHN<*o*Z3@V{M*|9tfCyO@dWD#+kiZn2gIHXchKrF)3IB@D24nTU<%7%$x{hk9aAnIS}DgBE+87l9!@xRAP@#6(*OHxiQWpRC`P9>cCL-bx| zQJoF$3)3+!@>ovr7o+WCHm-k+y!*q$z9ZAzss6|jQ&{?!B$fLE$Z;bY@kuMZ(;JSw z8Z4PPE6sGQ4kY&n>gx=s`hw}MC8l$WIFmmNfYvYFxpf4)*J*Z~d}0Qw2j^Jftogj=`Icfd zclIbfZ#<5BPRAYUd2@8f%H)iE{>lD3d#2LFu@qYG4;|aNI3st7j)>q-5z4);N&?y> z9KpAKIcnS__DP=7Y}9=;(L&6hKT>{=qOI#mHP)-$8yOY6Mav)Y^~vV`K;B&V z%^aW1>p%@=?hopWXnoecQ_*?}ar&d{wDcZ9-OqXlzEeJ+k4*(?hxp% z4eXs?vn4cJuob%8{$tiaGRyTpS~lztq-$`zqbe-fQpJNItKfCjLe%Bbq_~s_@`*Kk z5t6f>5|)vi3MHfad)sE83)JfrH8mqD7W3XgyR1AgQiJXd?D~Ih@vuZ{`jK`5b?p+uhyUcvHt$b z-#Cb(EpGyu;9J^Z?v_B)Fn|K_t%xI5^_1qNipUkO&EPb+c^~z9y}q}zqyDYe>)C&| z8~eNe(b#D=cD8qS>W!WMs5cw+{k{JH_4@!g`$b$p_8;|c?kfx26Z!u51K<&;X(_rk z4(JdDwTQEhoNjFgAo;}x4Drv1aZJepxN2-%V&WeF{Xl4AiUjnbfCn1@5I98#;Ez8* zt%m{xIjSkalc6K2d>4D|GnX(NzOyUKRk3dCd)O4*1 zsDUp46M5zWJ27jsK!U!H<&FS@BUM2c0fPPpr$KqCe47^MENs3-2o=U2=s_9ZSzkuQ1 z4kBJ$LUo=FLu0O-TnJ@T7|6=iYPFbR^h4ic7_N!tA&BOdbdpYFF`X<)9(l4WrHdPJ z5}DSPTUL^?rjG|?DtE_C{_M?f{T0c7wFwHQSlL3~O&<&7zxwX>o-6+~b{qBGwfy%G z-!pIqg+PpOASlqY4z4GNfMJ9K<(W5x-X$C(UfXyERLDRcg&}2v13p1P0OaNYrcihj zOvWz(LjhDa#~~CGD;*Ml;~5}mtgp2;LuHVQd~l7$1pMcV8aO4v3{awK${~ReF%V#a zY8$n~{)ICB*?0!pbULL3{M_yXA2YsD8)LDh{;P+-Q5*iww$y*)gvoeI{wMy)ugF%~ z&=7i;Q3ysjKz!r-8ov%VzON18<;M3lF%37q|Gzh$fuAA6G~%Fp*x?(skWqQC-l$<8 z!7W{m(T^J<;1@bTsGzJC&Yl2+D_H-%PV4ZvQ=9sC)yMqx-`v~Vt!LK%PIG&Iz5XBK zduBwUjg9~OS0a|}*6OwGe{W8N2>HR*7M_l4e1cKn^BSgGL+FpumML6SWvf>3P#F9# zE@lCGGYX)n@=p^?u#b(6 zwjEUngz=Mft{k~@B%)AqI)IfaO5g?|GKTf4fX)B`oXN_uQ$eM^j~UGc5IZ)`k!296;% z8GK{o3s55T7ocrGzkqWVfG-ok zwt7yCaftH2v9a+}QvU#a`1_lyMy=VX)vNUns;rj6<<$LzX5b5u>jZoOhiC+&K&Zdc z3*s*uU(^ih|Hl6~f2m&^UqIQ>K`W8L7x3YauOGk{&`QeLhY=tqP=IS31Yn3{TgV5{ zW0Z3Mg8(q|h?oO_iSnkY*BPKA@P~((s7|%vvRs>(^9Zp6PzjLWhZs(L!_)>MNY7BjbTD+s*yGpvl=*; zJVbIK&vJYbUx=7i6wOUxSo4Uw%QnPgHG9$;bbsz#oOOErZhz1@X?JuN%Fm2EFV?_^ ze3=g~!G~Vwu-pGo1C)Ue-II&s&hcsQw-2?LGL?W?R23AAO@;Alg;=4djhJW?cbGcR zR~3d>4=?!%PL;vA&e!wcB18*)1Wr-Sh_e$K1->ML0F6Y9c;BoiWj_qk?&gj*-L1Z5 z%xNokI`TOKe~XFV4Yhk9j<`GQ@3W&FV&ca>X3R(eJjH^8Yq_LwsMQA?crcB-FmZ=c zG=9jz_wn8+7!3lwCqi(7#5HA?#ve-#3ibCpO2+}xdL+508Gks1gx!K)y7rWXv}ZS6`fhNRGxg)smo~MblsK@LxHrp zy~K-?sRw0>NOs7PB7w0QbHQZi&}2lPZiYdr{Yof28Njb}LD~8cX<0?_85=+sE4mFe zXfw%Lrx?rt46fmf11{jquwXd5M>ISze$%}>QFUjSfM(f)2~sOLb}pUPOLgSd4mF{H zuh)=6R7!d*7)j(!hLEGTk#~ti(MpiwPcjaD5?A39aKEf`X9igE~i2=2g98 z0)|LjBSe6YM@l>s0Ff)qDABIOBvN4z&}%IoO8~e8I_<{`A}(~GmYB4LGpjizSSc6W z@6?Z^sl-95CPtxDk!i!2rx? z#4Hq?cjY>ZRQrDiJxT?zTvydVmw@Tus2`(3$aXOYgbL;D5Hra}O7YSqKKgtTO?yb~ zDoPiu#G-mahT6@JiUO?4aHV*`vSP}o&Xf*b_KGxJ3a6?rO{kAjyikI`Sk;$P4@qH_ zxKD{ND8Lj!DQ1nbNQ&u1t>g*hpy_luqmjh5#7P)H4`sSa0MleP!Q)9hrp6rH6$@}@ z|C{scI`cCGlgMx}r86Wec|uVJirHnYu%~lbK;solY8Qy;#efONz6K{b7V1SCcc-vz z&O{33J|1K7QvDf)A!42!U4Vo@Os59)S`H^oR_j#e@Y!@ogCY?p9%w%b5mTdeaH8a_ zgrTHJ;j*{}e^Zrtp?_FHjQWku5!jDZljihnTy3dIUuI0p2;6ff%o^;xxk^!xOqe}( z*-~cwA)}s=mF{=qN>QYa_0BdlRDz3<6>I#;tC=NMQ_cl5xH|70m2RaZ@n7lb^Mu?m zWU5lld?KKm6nHBtA^ZSwL7t?P6#u*$idc(V@+i^%xB*V?T$I%gQqxQQN40R_~Zw4^EG(+U!(M&TXC5WV3tK13H zQRC>abp|%2gg{3zT2u%l_7Zr|o1m9~V}V}kxNt9ly2DUr>HnSRkpzwZd{F}@TK>n} zKIm!U67UjnfJP&^mn=fMjdi^j7T~>ye9ZfZ2ux7$j?pMAAb3>>#HD~LRs*MszsMf+ zND2fxRWU~b{m#jtd(t`jPy=l(RzwLA6*iOTQJrRDWoR)-JW$TCxS$M`gVa9)A}Lk_ zr=iwg-{ZjY>frvMb#mA`Iz8!FBQv}@RtKkLJ}BjH`{=ws==AOrgE=O_WNJ}~JAw#I+nJ5rlNNSTOFiT@L^;O__jBa{Aqp9ANp&(+%~D&=+XVFUw?wY@=mFo)c=T@gO?uOB(3G0HJyrZq*Nx^;@vXX11JaXFkrrbk)kqphi`1Bw+R{L* zl$sN&pANa=+a;QDdrw|!kk+Z~dV;-)y7)_PISNMqDL5P+Vi@S_KWog>8ULgYw*7w` zseMz)Xud9610PfY&BMa6`m?ZcWkj86xytk-)v9V^!MWP$ej;0oSi$v->df5F7wK-D zX0%47u!%FObfZR6+upA4HDTqUELG~OH3$|O^|kUW53V-3JXa91UGG70{qb(Q^3J~u$}Y!c}w^& zyn_%5@$u?qxeN)5S|O=?s8&}6Z%-<#Gn=-(>A^Dd%NF1T_>4<;Ma4lEmGa1p3*ItQ zgGx4UVO z#47@NA$G-Ob}xZ{CoH0^9)o8Ad!talmIG=}jiY78DlAp@4p*w8lqxFT>mV~P;Zn#( zBSZoyiR=|ci{UQ7{{L6a7FidOJ@#yQR@3t4Iyv` ze2>iXKR*42qfx}Ui`4f)9wkp0!ze^v62`0Y@J29T_bYwg+{7$|W-C6f$_z$+xFW~p zLVV&#$AAH`Rhq)Y=?#trNzS}R8b00BUun}3O%4r?Xqez#lXDk2cyV_nQL(S5c`Us- z)AqukG9ksbF(+idb79cud+U#q_)I%$2EFIa3=6L&sKQH_xTp{d`Kro&|=nw@w}{Ef6n%rJlO_Y-CE3e zassFtinNTl%X~Kvs>0%vrR` z)U6622tfplRoo5yU%CxQsPRn8RgrnONc~8+=H}$v{h>*B4*1{lQpx~h$tS;!`HwW?i#SsbOT8z=U#+8Ru#z0W|9jL8jfs0Z*Xu^6ME@GF5a(+ zkwr+K-0{~F1fNA_;8oEzz>}9^$*6fFr3G7$&qGKvVG4z zSId_21^{X7PbzKW4Vti+h6Y<0adyq7>7+68q-|0#TX-(RHmSB}0?%cf$lf8wjo^*) z1YD_}WT?>pH`LX4I}1RA{vVGAvi?6F3(FTA1i zFTxq#J0aKcVQefS;&9H+=o65{DKr3BdI7UmL=!N;ADpk;2ipK3apE~lUS53sn0T3) zRq?hu0b?AAlw?V8GKooHeWL8%4Z#FwNs~>$r{6M3m#*XEO&z)Z@*pw*n8Jl~B#=XmKMNl0Gx9sZ2{27%MCN3e zUpW$qn7w8>bh9jxb;Yq zRdugMhT@#Gnx8~M2zHz7T_ zQ@9H{1M@RJ`Q}FH1f1CRvWOv^>Z$Uc65`5 zw@H>fS~4Fzc0=?o3?Misrp(~h3COpl^92G#6{ADm2LpO-MB*prYl_h zgj%wCL{U)JpYsc%4~WDwCU8RPm{lJOT{>UAWxC9>Mv3QsS&<@Q6)dI4I=5OnQx$ZW zu~-v^c!vcNW-T`iW@J@3wQWPS`1sxp3?M>a0UbYCxC`ihA+wn4dGDIs5x`l`$f94w z;gk$e+|xh9gqs8SOCdJG5dmc6RwP#BB#Q~?=esGIvqiF|5y+60#}Km`eg%DJl~?Qt zkLn1Q8jUr76u3_>tO)XOh-*M9n z$K|FW-_~uK_3w}j7MJW7T1oAE4`%S!ZX_Rrzhoy%?{(_?rH@7s&fq1{3T&rhB%#mN zJSNG>Cp7*!Tfz6^Fl)%(yA$vY+?NXR7@Um_rIR!%??Z3o*9;Zszv9sT`vUqAj8QL% z);$U~;XfV^B>bPDJsc19`EMWL+qeEt;Ko}{$fo7m^I@`z;9r-xS=vVvaA1- z@%n3o&oYU$w<3e5XRvq{o&6A)#c1l`=q9j=2xOPUW4LA5V$!o=5~qO+j*rMcz2#+k zeeHb(rd0@o!HoQy7LgFpL*V3jV1>8>f2NM_U3*wdL=k;UH2w*xbP_+odEkm5Fomvz z_xUJX3SOC{%GU%xgucY$ZF8olJp_K7u1IsddUuKA;{6ler@!bK=huK;=Tjj}r6cxa zK)!i}IwNoE4gwA-JS%No>t;&7XcP`gPF@l6IF%7vwYrZAN&il2F!^iyj^)akHwKj= zV*TZ16~1;ZU=({nat+M?K-PaCQ<6sW?K0G={w)kau5a|og9z!{%;>afa7(d2=#MJ-dB0g zt8sZ%>Q$X(R8?=(?dcE^=?;+&k&9kgwi10-QCUM>=*y{ zy<^<_d4GAHvB%hZ%{hN-t>%~HV;|ZB&K*!GGrCOg8|w06E-Y8}%wc0-Tm7WC|CzfD zu8+0fY)1x##xyDW@PND`u{n~5?35jjv=X8Yx71Qjs0_y;)cvXp6PL^aq$ z++(ySu?NFN&kw?paC0XLo&8o8-0jiaqu)9iHI%(e^YZIDc+bvmZekz0Ot|1Ja7xCv z>&%5@%xVk^MczUdDkaTrx7vBPOE6B;sn~E+5~7(MQ4v0QDAqTq-oiP?axC9(j5b}7 zN7f|;d-Aezv?cCHd9o)|V5sSvnse73;)mxS9k^hBY*|bi`FVCmUzCH3s?|NR)3sh~ zrP;|qXqlQycqXF%4BLJF3xRk(A06?CH~6fXdUd;5IYZ*HOG+g>Z#GG-KW;N?(=qo*;>)j-xGB)#*6w|8Md!iY=jIK;f~x3{}KfsBKtPH?bNA0 z-^-qEd&c`iqthTqVC;zWIDLtJGi9|)GoIt6!loMlBu(+DBuNL0;rtwMbB`VF;G*0Y z;=vi#r&_H~8Kfvg5QCWivfw>U^yuGp`sJdJJ$g=2=jl^Fvz@DpBT5f~LwYVG(J~uHba!x1p+%*EjRbbi3x49Y z`mc}cF5~M8G4p@yGieE-Nap{THjjf(v@_pqZr1g^9LW6mXbW7h^J$zDg3%b zkSTt!Ykt@d)}9-Y3dxXkiavT@Iu5O-EUq_1P`S)l*L&*`d5e(DKEtZd`&xsi`Xj=j zR9)e>ORi=OG#5dZ6f6vnc)351Q&%!+D7@@^5EtgyA{me8J(jnTj7b9CBzt~ZECy~B zv)0kqs5;e^8TcXTBjF@ep<1Q$q%zJ!@_#vXJU;1vyUd=GtX-}kX{0H#(LC`s)-}~B zH%yu(c2<|`XxtD^vS0jnvEFF7?CrV7|eQ*f0xx1Zp{Ydoq>2T zqwj#ofrV+z+-{hu6_z#FDKr|tJ*_Iw3 z_UB<26tns{jC#bmBB(8R{rgIzM${+Aark0 z6%OLBRFHj~52H*bSG(2t%1A@*d6zqj5`PbG^HhMVTbnFCo79_JSzxL6y(~aUj`<7d zHw?UoseKx%)TKN>V{N(#hUiDfCe1?iJJpjRu~{N&R%V#XD;t=OZ!CkGR>{*SVvW{c z$yE$|{W|QUl_w6|5sZKJx}u8O*!ASv2YU+=4c~)r?Kj{+FoNtJN>5&m7;aGFea7hTg2JQkM-mU)O3wK9EpT@ddLAU6GM_bRL zZUtnp07t1N3*a^%brlsBQIjs!AQKcae}^#7>Gksi7^2WaM1q=5|M-)Qt$QRgej?Lb zHV2wYu(tmNz`q*=*JDL`QUdf(xGPA{;^Wg!kV5P~)jWQOc}oNLWjt=3L?Sl{=4Q}q zAPVuk0@vF(qU)hzZeX8X9JOF?GM^n9njAs#k>;l7* z(-ejt{W_x|c;s|5xkrF5l`s?UG`&M4TieWU8r)I{sc{%62va&V=GiqSS_+cq_Io@? zbwqz}`G#KP842e8e*6YZ+Sd*5q35qc+DC5G#qg7O^i5tr=c&KB4nZz33=`{2tu5;| zKp%YR$fDNxE}$AFA0hp~ktNomOZ zHQ%z_2aE9B?{#Hi> zXN1y~jsM1T6d8SzP=kkBE5;m4sC7LT=19&fxo~JkO*mN9?0DU2XM1hCzMnKNJGw>H zldgDcsyAhhPC}J$Jv?tTE5WDl<&~>=35=Q!2H)wW~c%SN#vF4aPj0(;AWi3a8u%vHR5m0$_X;- zWe;RO(u)Z206K~ja#KTPV zA{%sQrVzKD@-W3A)4f=KHe=kZ%zgL4?>amsHnuL;kt$S*6}8%o>{Eu@shvZfP6_ zEHTi(#)X26o{C&C1N)qj10lr=%+v0_8kHaKr0)Jux{!qEh*>96SP8Oig&3$eBi82> zpHJcWt?>k}N#$Kan_f;7aE zjgA!zR4lj2pmllt$THA}!cLD*Y!7Z4RMUo3+GmrWti24?f&_PFymn%#6CH>RGyqc@EM|88>t;1UD2RWE}t89=!R9fXKgmrqR{RB6!nVco@l(bD!VI$;*O1y`JH5=kPF4 zTfg55VT498uZ+%Y3?;xMn-NiE=g&J414kGG0=z5vjaN8T#ucy;LKN$nqSwtJuVYkx zL2awme%OQeX;vqCT4C!ZTgf-ke{iNGXw(fX!uXuU+l*uJ0TqP@3LpEL$eh^OmaH@7 z`@65j#oO(~3cr%t*YFKA#U-~UeZ46ft{j^6`Maae@G!1R49BH0HZpf!fmhL!4&koV z@Dj}?m~?`=vG>*XJf_*gcD*NFK})j6!t({0UMF~b_M!38KP`I4dfY5;+Un)5ALOH| z?$GsTg@2g)P2xD_GkUX^XE)YC4^u=6E&bM>U4d0;=S`k9i~Hb=UY>%6_N`9iwO**; z!i;+GyOg>eTMUh~Ui(=B+a&pO%6RplTzzE!tV14fa(R5+2#JJHm37B~iSs9yd?ckl zPogp3(jPqzjsfnO3;_Wc=mh2A)bwaZcAat3`N%2F2!y}GOMNcZQA84>#$IU$q_We@ zfn#FLjCGX8dvpfk{XQQgS^TDM4lZ4_#6uaax@O^`wW@b@)`LEIS17+M=XUN$WrUI^Biatz?fxivwvmB<+6-b^hjyO~-KC6~kPP;?`h{ z*Mo1TXs&U)5ts*FZpFNzD~F4;ljoHg2MAr?mY>=t8Z2y;qf ztHw!#)Z=#+3(e8R-Y$Y5bVW!<#VVhSbGa9+j7@4uJM1!BXUSeiR!-yS)H*&P*)kQs z+}Tana#~hAY4mdY{;czEd=myX{rB1Z`s6`%1w<<~JntFym~H`xkB?vL5f5vcl*@po z0l4{GKm!VvUIaiQVpo7QOk@YTMvZ9n{W;W^Bjp*~Utk&yw5K{!oz`+88VR6uMZ>=g zM_d$HWockOqCCuS<{_HRcu?X5tan95p?7g3;NVYQ3d`VE2z(#{Sy!iqb8qwO3Ne?H zzN1jvD-UgGstjJbF|y0 z$l5vaN+W*ca-GiDt&W$q*!mWKj!?!7ma|nz(lX*@4zpYs7W1<22QGYG9S(f*k~;Y_dF0-aw#w7JdIF5 zxs*~Kvn}@?r%3D1IvFf)x}VTc_I`>Iy$pW#@kZJ2(8Pi&r3Dt%BQzO*{LbENP`RHG z5DOX)M&r9EM;*hhJABvPDURy-kuFn_-vYC1Z#agXMPz#vQ82zn*xVhjIcsiQc9JMx zqOLX68liX`6WxaMWgie+*H7#y-06b96wQ6Vy{u8NkwXnVu8_~2`W_mSwuLbc&g>*= z{l_p@!3Oj}0>v?iY*7BCw5J&E@L&umk=5C&Uz4Icesb;6?+G98o_0#)7$~s+p#rQ|^Tm+)vpS z5O1bq_nZUWK||ID{POpAEB=DXipHDQDE)tf0EY&N$F}%{=hO7Bw}O6w&DBsx#i0){ zBYk-+>FrL~s}-(y?r3k#gnP55DfrCHVxS4Bb;!$Hw^t&SY!4#!tSlGlRA?3@1rsVc zuNuR)Lvs@f@)uq|iYjP3! z;n!8mA2Keh>I8nUY-FmVez|K*9B&3*a<4znmk`|xNS4eKWWp%-S>zUn0w2KOnN>e# zGv6O4*;YO^sW&;fA6pKQZ)f9Ool_wBXg!zdgS!LH`b=?Swehjz%NK;J*Wv}R5<)

A2Rz;6T; zG)?O2m`6}MqwJYnqnm7qkkKAaLw(R#CBOTen7|x82=zokvC3M3QUv#2L;NOUYW=mZ zllWb^w0PDb zS|bt?IWbZNeMHimTyHmW#SmX}?4w~|wn|8R=l9rugl6WZF_SiNs$W~2G<@UZ@efQ+ z8kI7tNnpXWd>&Y@9G266&kjNiCl)NxsO=@NGq5{%8}Ft>_Ho5uy^?x6$r_~j+X0hi zrI44K;fgMIgoLM=)}cmyyQG?#XF4%cLJNfQ3LyHp@vCgrL1OC}pmzS`hG^>nkT04p z0C#4Nc1KTuFVe+*gn)qF8y@B)P_dH@A%X$U>V#r(ET2ZB;W5g#g|hB)Cgr_34O(Q&#Nkfomb20lX3nk42bjwv z?-#!;gGR4ALW+fjtxqvV*s+s=+h1|C-f<8f6%GdGC2q&~da`S@=LhcPq*r;AY`S{jz8w-JJm_!PHgZu@H6ZXM7=*c6<8oL52v$sbY+zMU^%uTH&!uY_dpE9 zp(ClaH$%}Bf2UkyJS>Cwpd-VpH6x)_&QZbb$CLxP-}0^9dI_WF7pJO z(h54jc&fSrcKxP|LtkVyDE`@=9M*JkaiRPorIAK~;)gZ7D{$m7XcP+Cx(F8pP6GZJ z7QE|s+8NJP*X=$;~|3a-<6+orP`DM{H_1Z(gylZOY z+Zt-U0WI2vRQops>Wgp9C+k}KI2mk*=vIot=?)}MyLr~W>{z1&qLsU#r`>k7-Wn!` zGsm5mP4Qn2!-p5bJle={1kJxwq>?7pESg)@2XVy4ZEsAjfxe$r7gya4e&IP3{lepA zWYIeD9d{~OE_b_V%FI4Cv+|2ejrE(xz3%SYI5FNszJY}gSEQI<&LGl=gD}gF{F7&p zC-jy3HNV>_ymr?(L_e+zV1!VcRlozjwUNW#1*7Em>)#iHpU_b_FV`dYb;DxEP^d`h ziD(wwh&3DTafR(C*i>HsG=7cPPHNJ|%7zkiWb)@bR?{0+%wMGCmKyI7^AaPSw|Q40%e7|E^(&XM)ysez0^nCus@+_La$c2^?C8PGV<*g$Mb73 z7&Z4gR>d}0C>aA5aj|HhAsV|pBqY}&p2x}8K&{a1KP~jp-A=X&^tH^^g!@b7t$Nr@ z4PD0vO_4eaw?g&z0@Z7l=etf*Wzl+dWzlVQWsJzogVTL-9NazgKPD24+-3uF*9JOx zj;DO`zYdboYZJvt8OkjT%Y~Bdhr9-*v-s%?UJV!QeTGT3w#8gvx}W_e=6w|(1;Imj z?;M-mk*L;B{mNhRlOc|`-Y1p^v4U+W(sIx7#-4q;xfX>TO_c-j;~1L`;nfh|^go7Ifz2y9nETcw426koxfBg}7(&QtqLi*>jqxnEVGZ5R{=N>un9ts-QbvhBcF@Q0 zA#8W36CeGsTxZMfWv)Dd%W_E^{ZuVS8#dwfVRT{0>F&xCS}>1A2AhgxGKQZ!eIQHv zopDTQ!TjzEZWRVDMfIPlovvZIp9^QM^RlH2z?R6|E_6#`>Iqmc3<6vQXYZA~(PJY4 ztk~w!bbxG|sEGWJ`!0i_$x~u?!Qh8su{WX3`RLD`knutQ)XpnQF5-=BIQ;R&ID0XD zfHfmKTi|a;P)enx!42@!b-vWGu>8d=Oj&ufeTLvai@4)>990sve#I;q7i=*fMkZ`} zRp=W}gB?9n$3whsh{BiLXBg0m3gLI?S^YlH&#S<>D(Ztbqoi2E7Mq!O`RkRr`4^s6g`?wC(?X8=k+k2+q=`? z7$QK0N2lk0>uNUu4^uFQjnGLcr&2}5%%Ras4sWv zPfp<~vM9C~-8C*Qb7_*ve&TJZ;3llv&G(JaZ(x=BS)8A|bWp|?Y@gCiJ~@6G5!A?y zQ56x=NQ!kLu{L$eG`$Rf0v?h>Lhjb`gp!^iu_pz%z5pclTon3q=%1~9PG$FVsB>KK zXU3jJ=pLobEWr8^m>9PLxDy^kVw9v7VeV{sLcrI9K*;K@lpdTNXhus!K>()ilTwVP zbJj!LjyA}srF{Ep3=*N0x(PSEsbWbUBmAe{=8n*NbiXNDxd3SDf=Wvy!kVP(p3lZ9 ztbntQAn7rnL<@fOp``bXge(9`euxc0c?QLX_H)3tJPQ9+JzT&V!2{sMGk|GX1Elfz zs4|QKRU9uzGXg+4ucaoTFLufV6!1nzb&V}b2Nu}@A>G2|Z&_YuAtK0{LK7Q0>57Wk~Ij+GWpOF;xmJ+&H+8@0OE19_jVK76)^88PeOH?r+C+p-5IzmZ>A zIB#4*CjE%}tp`_g+HN$aw1;$+8+T2cdX7{J_d-K*#Xl6(j*hwJAwkl4QOx2~gdoG> zQ&k*%PC*;SCdC)it|99F&XSsjQoH1~Ec!|hHQcZsOZeTb*q0BbgUC6EExC? z^-S{wghpFWXXlcQFA$3j4Dz2{wddjCpTk(J%(_DX8_xedz;R{h_M0g~h=U1}8IjWq zZ`*59-)YI9RJN3sKuIWR7)d~Jn2k<6l=Pn2LNgDzj(~@mlqAf0Lmnvpo z)a@Bwc3p_P*k0P#8A*1Qf|Q$RKXZ?^roI-8-AfZKwY1u~3==2JdoCK*RXP2NF3ejRmY&t?nO5C1*S)L1a z`IPCW=E00r~cW5~0C^6x79!q?s%ry}_e; zTUV;IJUd(mD^28t-rqe8lRY^Lx^z#) z3T8Nm`@^-|56|HL(H~LSTmOVa-V z>F~HBA%nBw`s`A0mO??jGn{Mc@=+*)Bk6v?**ME%j)G5#%-=Sx8N(kkA)Uik5+;;G z3@3Q)$`-8q459rRcM7AVzm4|;7Uaial#4)tGYm9HSZEEn3la^SK@dlQnjA-EzrpEF zsuLfv-~H#`-Vj0GpC?}RzQurm_Fh@1eRFN_Na+*ML-WBEu&x_;beAs{q2c-g$U}jx zE!+-ZNq*k~xPq~KAy`*9S1+Kj3f)Gz@J0H5rL|7W&4EnlPuo}- zB*djQtiT4hCnjFZ(fmzcaAMh!I2c}-B6RNeRTb)3B4wQ8%kMTT=zNEUapkXH06aeu z7}%S^3R~{?-ri5C^#A@=xIP&Eu$Gk-w^l&~p;&pWb8dFl+Ek5xS@a`_D)QI9X^qEb z!}rPgGMStIqZ(aPmw{uXflak0+27Fn#iEsk{N6pNpnY-qHISkJma!TKwoD&j?v8>) z*3h{Qq%An@*_4~d+h30kuKZNsh!-o5HvnTl|Cllhni>7p4fNOJw5oa6ZLH@7ug^H0fk@ zlj-S+qpr}2;;v5c=oCSYEOfg`C_LxrP$|;N9?)1=OS&kvoS{8RKQeqNHfCFJ z2`;<4$@{fshHU?h`Nq`Gc-?BzKE*NST$_5a4a9DIiAa{6=3nxIJrW#0AzT?#JtYNy zbt*|}ADZ7Icw-cD|2mN_l7)FSyE0KQ;%Y$KHoVmGl%p6S

MIVAl^iyMcASc^sT zwt>bgcjIP#x>2J-v1pA0#(ri` ze!M5KUebIMWNhrZ8^IU0Qo4*PTRJ+7mk{K>)�xkxL}9jR|I6ntG5kMyy7a-dTeF zMEeqmCf&zsF8UK$DrvM2Gmmax>G!6$s)!DQVt?P>uR01pY_?J2VM#Q?rTK%_JJrMb z{rycCP7tj;n>vA?FV)fDb!HIV)7e&D5FpeLO8@x$V$izZt}RTQ03YOY$@2R0Pzv)(^|p=YCS_kt49{~;x;jr}(ePoUrT*MISC^v9R@_Ca*~8YV!tGzkN7 zQCPpM;|}6?v5bkH+P9*Il@l>gszM@Uq<%<4mG$U^U&eWaK;BpB@^^B62pCE6!Opi6 z%I^M|&Sf+S;|cy`0-lg2kJ;`=y1VNrS3JlgZQ6TelyiI^TD?UIM^o$Kd(v_&r*9wb z`~O9_m1Y81EB_neTFUgZu7#3b1A~rSNjHF1?gQi&=UX8FEX)|vO*Zl>LgXGx;L1Fv4>jsvA{?gSpgT2ZZZQtS4m>)7z z#0-M1I$hh-W)SJ3jMhh49vy8bQw8Xq2#M!(NW77cIB)pV;Of`ff;&OJ=siohY+*77 zH^Rwy{|FZ&I=Ep33**UYO}R7zj`Ib&HS&wBMXY*;J=R`6<3UA}mP{hJrtwU+1azYL zZ*8aPV)~zkUupy2y(Ap&8^kZ?ZE*Q(dNlGYusOrmC2s;}aj3UPI&yo-7)ySQ+n;gT z%+X_(LAHctQ^y?N2me9eFRV5ROUM*+yF6=Fa@cU)eaF)taADJ-D7MOR`HsL$HlekW znp-tuwQN5#^q9EiD_+NBi_&tguhMqa!)ua?6~~U-K)$Fs(hAkf4~XiDk4dCnRVwLk ze)6cU&aJX6i+XC&ffdQ~Kz_Hl8E4>9_yZgiS{$;)w+E*f{v}l9^ zigM!d8bciY^QOJwc0RJk6WnL(~y zjG917lg+A=M-Mlq^sjWsqq#D7F8vQ28k-e<0f&09M^NpQvjWL>6$U8a#vlQtgo0Q) z4tcpO=G`uRk(EVlKR+lK!*s|PkA6v)>9zE!Ojk(m(3YtE-qmhA{SO?n9Fq^|#)MeE zD^SolUv3WsrFX{>&ctOj*_IMePi&r>NB(CQc_?w$*z3V|42XQtdJ)`Y(>^JFL=-_W zR{bFYesUr3@pr*G+h2d(4kr@Aevb`f?3a`!5^%YnbbovJ`Q`VtL5uvt3Vr#SrDxX7 z$nn(`7f0%&zZ!Lb9rGw5+r35namj)5ky1x)EI|*?Fg~mu_Y@m$zl4EqkYnm$d6z%h zLh)sQ1K~|R{=E_(Ip_!GcN#f`CE^Evr^xx)UV*bNJ2v)&qL$->VG2%W{F_gXz>d!yz&~`#Y)y$ zhEyXIHc7ncnyw$cpWq_gjEo}P9Ohm-ocldK+BzSMBC@3c&$k$lsQL!HXa+1MsIrKx zq{$9O!D<+OUsxokbaFrtsv``2o%rv{k_oR)8h;l-925Q^UH?OS!u}HF#~E%Ti&G~l zS|?<9kj~WGp0sMoDynPH3a>tDcrlJ$_A#~aB^ZP<4ThJO|L#9hEvlGDf2*log=&&e zq-~3|TV~sz!#~@4V`Gq6tx-w}I@Gq+$TQBx*RT@miRhV$W^=3jRqlvi!tjp4`NSq+ z{XQ&r%&p>WY8@eF$f#R|oU+cB8@i|uCf9gQ{}L8Z_O3DSU7lC(4hrG@aV!o|bKF~{ zOa|vbxV~MCmgr`i)M%9Db<2cN9r)M_4(TDu{8BsFBINqG0td=l7x?CIuN;;6kJveX z92y_8ey`Lmuj&0+ZLrD8SlFFb=gwL7!~b3(sJZ;njZh8s7o|bu4A-rNtK%Sjfo<+F z=OB(OyM2lFp8sJhVImjXM@_n7uVr+nLJp?B%xhWa;T;}_N)wLMIxkLo??@)3WQKr> zrr_jkT_LH|AEcpQ6$hydf*9WY?#bN}wLC~QT;B*c-3c@da~pMpXCOhEYZeY=!_{Ags*xKqq<1wg|43;?t0i% zDj?l!K^$7@*VOJ1DZ4bJSduP1ZF2dhvF=Yq7->V=qkruw-yJr0K~_T@ab(y@X6+%_ z_$gkE1vC2Qto4t>_aWoFQEFV7oN zA4?Yxa$B7wk_$DbP5)Y|RP5e2D`uPX?R=j=B#)fs#nYe+pS31tD)ReTu?Q8uxpEJk z;wk0#+dD(Ir^J<0m8)vQeTubs%K5x)hlaSg4sbX0)52oot1fcxaDEq|-MJNOvMiho z8#|`G_^44q<#3!lHAIt*q6Xo4j)`Bf2gac{s^+u7kW_^>q^jxa??}^Xr`7PW6sJ4{ z>C%$P?+GCj1FG_yyqL!(y5b8EGfbKo=%paTyncklQdOQmlp7v3 zb>v<7H=?i32#eYy9^I==Af(_Bw_{kI2VRoA@)Bv1Gi`|a(rC^aH7hBxjcMoG9bhG> zFaD^3Cn0q;O2}iJR~a_C)T0RpFxi_7V;oBSy(%BC1U#=kjmiA#O|N<3h-hJJ1uwW+ zZ4T8BV8|j<;|Ots(;oFmMRaGzzrfmjO?5%-JReHujm}A*<0rt?!Xxg&!OL~Dwly+1Pv>UyXF4sp(c_khCq^MQtz>ZZ z=+yu0UBdblh_{=6Budh1P|U!}`rQ=O3F^b#Hlgx!GKfv~-#Aq>6C{Qlo@{wP+z`U1iy^al zK}#x$>{p=z>&S&gD3TIojGuH8dKiO2MslUH8N4rjJF;jWzEpap8n>HJu6pf0=cUJ+ zHHImWC{bVHMNSkD-z_uX(+efbl8BVts?!&>q^Ln|WSj$T)e_<~iWr}w=Ifa}+o;i0 zgF-*NGag%$opi{iS0Bg@8_NQ66~5QG zU&nMn>A;26eb*}q{Md=vyRhd+(e{_=v1.21.0-0' - catalog.cattle.io/release-name: gluu -apiVersion: v2 -appVersion: 5.0.0 -dependencies: -- condition: global.config.enabled - name: config - repository: file://./charts/config - version: 5.0.10 -- condition: global.config-api.enabled - name: config-api - repository: file://./charts/config-api - version: 5.0.10 -- condition: global.opendj.enabled - name: opendj - repository: file://./charts/opendj - version: 5.0.10 -- condition: global.auth-server.enabled - name: auth-server - repository: file://./charts/auth-server - version: 5.0.10 -- condition: global.admin-ui.enabled - name: admin-ui - repository: file://./charts/admin-ui - version: 5.0.10 -- condition: global.fido2.enabled - name: fido2 - repository: file://./charts/fido2 - version: 5.0.10 -- condition: global.scim.enabled - name: scim - repository: file://./charts/scim - version: 5.0.10 -- condition: global.nginx-ingress.enabled - name: nginx-ingress - repository: file://./charts/nginx-ingress - version: 5.0.10 -- condition: global.oxshibboleth.enabled - name: oxshibboleth - repository: file://./charts/oxshibboleth - version: 5.0.10 -- condition: global.oxpassport.enabled - name: oxpassport - repository: file://./charts/oxpassport - version: 5.0.10 -- condition: global.casa.enabled - name: casa - repository: file://./charts/casa - version: 5.0.10 -- condition: global.auth-server-key-rotation.enabled - name: auth-server-key-rotation - repository: file://./charts/auth-server-key-rotation - version: 5.0.10 -- condition: global.persistence.enabled - name: persistence - repository: file://./charts/persistence - version: 5.0.10 -- condition: global.istio.ingress - name: cn-istio-ingress - repository: file://./charts/cn-istio-ingress - version: 5.0.10 -description: Gluu Access and Identity Management -home: https://www.gluu.org -icon: https://gluu.org/docs/gluu-server/favicon.ico -kubeVersion: '>=v1.21.0-0' -maintainers: -- email: support@gluu.org - name: moabu -name: gluu -sources: -- https://gluu.org/docs/gluu-server -- https://github.com/GluuFederation/flex/flex-cn-setup -version: 5.0.10 diff --git a/charts/gluu/gluu/README.md b/charts/gluu/gluu/README.md deleted file mode 100644 index 0742a0f51..000000000 --- a/charts/gluu/gluu/README.md +++ /dev/null @@ -1,603 +0,0 @@ -# gluu - -![Version: 5.0.10](https://img.shields.io/badge/Version-5.0.10-informational?style=flat-square) ![AppVersion: 5.0.0](https://img.shields.io/badge/AppVersion-5.0.0-informational?style=flat-square) - -Gluu Access and Identity Management - -**Homepage:** - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| moabu | | | - -## Source Code - -* -* - -## Requirements - -Kubernetes: `>=v1.21.0-0` - -| Repository | Name | Version | -|------------|------|---------| -| | admin-ui | 5.0.10 | -| | auth-server | 5.0.10 | -| | auth-server-key-rotation | 5.0.10 | -| | casa | 5.0.10 | -| | cn-istio-ingress | 5.0.10 | -| | config | 5.0.10 | -| | config-api | 5.0.10 | -| | fido2 | 5.0.10 | -| | nginx-ingress | 5.0.10 | -| | opendj | 5.0.10 | -| | oxpassport | 5.0.10 | -| | oxshibboleth | 5.0.10 | -| | persistence | 5.0.10 | -| | scim | 5.0.10 | - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| admin-ui | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"gluufederation/admin-ui","tag":"1.0.5-1"},"livenessProbe":{"failureThreshold":20,"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":8080},"timeoutSeconds":5},"pdb":{"enabled":true,"maxUnavailable":"90%"},"readinessProbe":{"failureThreshold":20,"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":8080},"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"2000m","memory":"2000Mi"},"requests":{"cpu":"2000m","memory":"2000Mi"}},"topologySpreadConstraints":{},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Admin GUI for configuration of the auth-server | -| admin-ui.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | -| admin-ui.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | -| admin-ui.dnsConfig | object | `{}` | Add custom dns config | -| admin-ui.dnsPolicy | string | `""` | Add custom dns policy | -| admin-ui.hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| admin-ui.hpa.behavior | object | `{}` | Scaling Policies | -| admin-ui.hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| admin-ui.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| admin-ui.image.pullSecrets | list | `[]` | Image Pull Secrets | -| admin-ui.image.repository | string | `"gluufederation/admin-ui"` | Image to use for deploying. | -| admin-ui.image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| admin-ui.livenessProbe | object | `{"failureThreshold":20,"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":8080},"timeoutSeconds":5}` | Configure the liveness healthcheck for the admin ui if needed. | -| admin-ui.pdb | object | `{"enabled":true,"maxUnavailable":"90%"}` | Configure the PodDisruptionBudget | -| admin-ui.readinessProbe | object | `{"failureThreshold":20,"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":8080},"timeoutSeconds":5}` | Configure the readiness healthcheck for the admin ui if needed. | -| admin-ui.replicas | int | `1` | Service replica number. | -| admin-ui.resources | object | `{"limits":{"cpu":"2000m","memory":"2000Mi"},"requests":{"cpu":"2000m","memory":"2000Mi"}}` | Resource specs. | -| admin-ui.resources.limits.cpu | string | `"2000m"` | CPU limit. | -| admin-ui.resources.limits.memory | string | `"2000Mi"` | Memory limit. | -| admin-ui.resources.requests.cpu | string | `"2000m"` | CPU request. | -| admin-ui.resources.requests.memory | string | `"2000Mi"` | Memory request. | -| admin-ui.topologySpreadConstraints | object | `{}` | Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ | -| admin-ui.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| admin-ui.usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| admin-ui.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| admin-ui.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| admin-ui.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| auth-server | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/auth-server","tag":"1.0.5-1"},"livenessProbe":{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"pdb":{"enabled":true,"maxUnavailable":"90%"},"readinessProbe":{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"2500m","memory":"2500Mi"},"requests":{"cpu":"2500m","memory":"2500Mi"}},"topologySpreadConstraints":{},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Gluu. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing. | -| auth-server-key-rotation | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/certmanager","tag":"1.0.5-1"},"keysLife":48,"resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Responsible for regenerating auth-keys per x hours | -| auth-server-key-rotation.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | -| auth-server-key-rotation.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | -| auth-server-key-rotation.dnsConfig | object | `{}` | Add custom dns config | -| auth-server-key-rotation.dnsPolicy | string | `""` | Add custom dns policy | -| auth-server-key-rotation.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| auth-server-key-rotation.image.pullSecrets | list | `[]` | Image Pull Secrets | -| auth-server-key-rotation.image.repository | string | `"janssenproject/certmanager"` | Image to use for deploying. | -| auth-server-key-rotation.image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| auth-server-key-rotation.keysLife | int | `48` | Auth server key rotation keys life in hours | -| auth-server-key-rotation.resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. | -| auth-server-key-rotation.resources.limits.cpu | string | `"300m"` | CPU limit. | -| auth-server-key-rotation.resources.limits.memory | string | `"300Mi"` | Memory limit. | -| auth-server-key-rotation.resources.requests.cpu | string | `"300m"` | CPU request. | -| auth-server-key-rotation.resources.requests.memory | string | `"300Mi"` | Memory request. | -| auth-server-key-rotation.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| auth-server-key-rotation.usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| auth-server-key-rotation.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| auth-server-key-rotation.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| auth-server-key-rotation.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| auth-server.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | -| auth-server.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | -| auth-server.dnsConfig | object | `{}` | Add custom dns config | -| auth-server.dnsPolicy | string | `""` | Add custom dns policy | -| auth-server.hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| auth-server.hpa.behavior | object | `{}` | Scaling Policies | -| auth-server.hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| auth-server.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| auth-server.image.pullSecrets | list | `[]` | Image Pull Secrets | -| auth-server.image.repository | string | `"janssenproject/auth-server"` | Image to use for deploying. | -| auth-server.image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| auth-server.livenessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. | -| auth-server.livenessProbe.exec | object | `{"command":["python3","/app/scripts/healthcheck.py"]}` | Executes the python3 healthcheck. https://github.com/JanssenProject/docker-jans-auth-server/blob/master/scripts/healthcheck.py | -| auth-server.pdb | object | `{"enabled":true,"maxUnavailable":"90%"}` | Configure the PodDisruptionBudget | -| auth-server.readinessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the auth server if needed. https://github.com/JanssenProject/docker-jans-auth-server/blob/master/scripts/healthcheck.py | -| auth-server.replicas | int | `1` | Service replica number. | -| auth-server.resources | object | `{"limits":{"cpu":"2500m","memory":"2500Mi"},"requests":{"cpu":"2500m","memory":"2500Mi"}}` | Resource specs. | -| auth-server.resources.limits.cpu | string | `"2500m"` | CPU limit. | -| auth-server.resources.limits.memory | string | `"2500Mi"` | Memory limit. | -| auth-server.resources.requests.cpu | string | `"2500m"` | CPU request. | -| auth-server.resources.requests.memory | string | `"2500Mi"` | Memory request. | -| auth-server.topologySpreadConstraints | object | `{}` | Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ | -| auth-server.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| auth-server.usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| auth-server.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| auth-server.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| auth-server.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| casa | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"gluufederation/casa","tag":"5.0.0-4"},"livenessProbe":{"httpGet":{"path":"/casa/health-check","port":"http-casa"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"pdb":{"enabled":true,"maxUnavailable":"90%"},"readinessProbe":{"httpGet":{"path":"/casa/health-check","port":"http-casa"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"500m","memory":"500Mi"},"requests":{"cpu":"500m","memory":"500Mi"}},"topologySpreadConstraints":{},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Gluu Casa ("Casa") is a self-service web portal for end-users to manage authentication and authorization preferences for their account in a Gluu Server. | -| casa.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | -| casa.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | -| casa.dnsConfig | object | `{}` | Add custom dns config | -| casa.dnsPolicy | string | `""` | Add custom dns policy | -| casa.hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| casa.hpa.behavior | object | `{}` | Scaling Policies | -| casa.hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| casa.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| casa.image.pullSecrets | list | `[]` | Image Pull Secrets | -| casa.image.repository | string | `"gluufederation/casa"` | Image to use for deploying. | -| casa.image.tag | string | `"5.0.0-4"` | Image tag to use for deploying. | -| casa.livenessProbe | object | `{"httpGet":{"path":"/casa/health-check","port":"http-casa"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the liveness healthcheck for casa if needed. | -| casa.livenessProbe.httpGet.path | string | `"/casa/health-check"` | http liveness probe endpoint | -| casa.pdb | object | `{"enabled":true,"maxUnavailable":"90%"}` | Configure the PodDisruptionBudget | -| casa.readinessProbe | object | `{"httpGet":{"path":"/casa/health-check","port":"http-casa"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the readiness healthcheck for the casa if needed. | -| casa.readinessProbe.httpGet.path | string | `"/casa/health-check"` | http readiness probe endpoint | -| casa.replicas | int | `1` | Service replica number. | -| casa.resources | object | `{"limits":{"cpu":"500m","memory":"500Mi"},"requests":{"cpu":"500m","memory":"500Mi"}}` | Resource specs. | -| casa.resources.limits.cpu | string | `"500m"` | CPU limit. | -| casa.resources.limits.memory | string | `"500Mi"` | Memory limit. | -| casa.resources.requests.cpu | string | `"500m"` | CPU request. | -| casa.resources.requests.memory | string | `"500Mi"` | Memory request. | -| casa.topologySpreadConstraints | object | `{}` | Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ | -| casa.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| casa.usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| casa.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| casa.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| casa.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| config | object | `{"additionalAnnotations":{},"additionalLabels":{},"adminPassword":"Test1234#","city":"Austin","configmap":{"cnAwsAccessKeyId":"","cnAwsDefaultRegion":"us-west-1","cnAwsProfile":"gluu","cnAwsSecretAccessKey":"","cnAwsSecretsEndpointUrl":"","cnAwsSecretsNamePrefix":"gluu","cnAwsSecretsReplicaRegions":[],"cnCacheType":"NATIVE_PERSISTENCE","cnConfigGoogleSecretNamePrefix":"gluu","cnConfigGoogleSecretVersionId":"latest","cnConfigKubernetesConfigMap":"cn","cnCouchbaseBucketPrefix":"jans","cnCouchbaseCrt":"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo=","cnCouchbaseIndexNumReplica":0,"cnCouchbasePassword":"P@ssw0rd","cnCouchbaseSuperUser":"admin","cnCouchbaseSuperUserPassword":"Test1234#","cnCouchbaseUrl":"cbgluu.default.svc.cluster.local","cnCouchbaseUser":"gluu","cnGoogleProjectId":"google-project-to-save-config-and-secrets-to","cnGoogleSecretManagerPassPhrase":"Test1234#","cnGoogleSecretManagerServiceAccount":"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo=","cnGoogleSpannerDatabaseId":"","cnGoogleSpannerInstanceId":"","cnJettyRequestHeaderSize":8192,"cnLdapUrl":"opendj:1636","cnMaxRamPercent":"75.0","cnPersistenceHybridMapping":"{}","cnRedisSentinelGroup":"","cnRedisSslTruststore":"","cnRedisType":"STANDALONE","cnRedisUrl":"redis.redis.svc.cluster.local:6379","cnRedisUseSsl":false,"cnScimProtectionMode":"OAUTH","cnSecretGoogleSecretNamePrefix":"gluu","cnSecretGoogleSecretVersionId":"latest","cnSecretKubernetesSecret":"cn","cnSqlDbDialect":"mysql","cnSqlDbHost":"my-release-mysql.default.svc.cluster.local","cnSqlDbName":"jans","cnSqlDbPort":3306,"cnSqlDbSchema":"","cnSqlDbTimezone":"UTC","cnSqlDbUser":"jans","cnSqldbUserPassword":"Test1234#","lbAddr":""},"countryCode":"US","dnsConfig":{},"dnsPolicy":"","email":"support@gluu.org","image":{"pullSecrets":[],"repository":"janssenproject/configurator","tag":"1.0.5-1"},"ldapPassword":"P@ssw0rds","migration":{"enabled":false,"migrationDataFormat":"ldif","migrationDir":"/ce-migration"},"orgName":"Gluu","redisPassword":"P@assw0rd","resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"state":"TX","usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Configuration parameters for setup and initial configuration secret and config layers used by Gluu services. | -| config-api | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/config-api","tag":"1.0.5-1"},"livenessProbe":{"httpGet":{"path":"/jans-config-api/api/v1/health/live","port":8074},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"pdb":{"enabled":true,"maxUnavailable":"90%"},"readinessProbe":{"httpGet":{"path":"jans-config-api/api/v1/health/ready","port":8074},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"1000Mi"},"requests":{"cpu":"1000m","memory":"1000Mi"}},"topologySpreadConstraints":{},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Config Api endpoints can be used to configure the auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS). | -| config-api.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | -| config-api.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | -| config-api.dnsConfig | object | `{}` | Add custom dns config | -| config-api.dnsPolicy | string | `""` | Add custom dns policy | -| config-api.hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| config-api.hpa.behavior | object | `{}` | Scaling Policies | -| config-api.hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| config-api.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| config-api.image.pullSecrets | list | `[]` | Image Pull Secrets | -| config-api.image.repository | string | `"janssenproject/config-api"` | Image to use for deploying. | -| config-api.image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| config-api.livenessProbe | object | `{"httpGet":{"path":"/jans-config-api/api/v1/health/live","port":8074},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. | -| config-api.livenessProbe.httpGet | object | `{"path":"/jans-config-api/api/v1/health/live","port":8074}` | http liveness probe endpoint | -| config-api.pdb | object | `{"enabled":true,"maxUnavailable":"90%"}` | Configure the PodDisruptionBudget | -| config-api.readinessProbe.httpGet | object | `{"path":"jans-config-api/api/v1/health/ready","port":8074}` | http readiness probe endpoint | -| config-api.replicas | int | `1` | Service replica number. | -| config-api.resources | object | `{"limits":{"cpu":"1000m","memory":"1000Mi"},"requests":{"cpu":"1000m","memory":"1000Mi"}}` | Resource specs. | -| config-api.resources.limits.cpu | string | `"1000m"` | CPU limit. | -| config-api.resources.limits.memory | string | `"1000Mi"` | Memory limit. | -| config-api.resources.requests.cpu | string | `"1000m"` | CPU request. | -| config-api.resources.requests.memory | string | `"1000Mi"` | Memory request. | -| config-api.topologySpreadConstraints | object | `{}` | Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ | -| config-api.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| config-api.usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| config-api.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| config-api.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| config-api.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| config.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | -| config.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | -| config.adminPassword | string | `"Test1234#"` | Admin password to log in to the UI. | -| config.city | string | `"Austin"` | City. Used for certificate creation. | -| config.configmap.cnCacheType | string | `"NATIVE_PERSISTENCE"` | Cache type. `NATIVE_PERSISTENCE`, `REDIS`. or `IN_MEMORY`. Defaults to `NATIVE_PERSISTENCE` . | -| config.configmap.cnConfigGoogleSecretNamePrefix | string | `"gluu"` | Prefix for Gluu configuration secret in Google Secret Manager. Defaults to gluu. If left intact gluu-configuration secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google. | -| config.configmap.cnConfigGoogleSecretVersionId | string | `"latest"` | Secret version to be used for configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google. Used only when global.configAdapterName and global.configSecretAdapter is set to google. | -| config.configmap.cnConfigKubernetesConfigMap | string | `"cn"` | The name of the Kubernetes ConfigMap that will hold the configuration layer | -| config.configmap.cnCouchbaseBucketPrefix | string | `"jans"` | The prefix of couchbase buckets. This helps with separation in between different environments and allows for the same couchbase cluster to be used by different setups of Gluu. | -| config.configmap.cnCouchbaseCrt | string | `"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo="` | Couchbase certificate authority string. This must be encoded using base64. This can also be found in your couchbase UI Security > Root Certificate. In mTLS setups this is not required. | -| config.configmap.cnCouchbaseIndexNumReplica | int | `0` | The number of replicas per index created. Please note that the number of index nodes must be one greater than the number of index replicas. That means if your couchbase cluster only has 2 index nodes you cannot place the number of replicas to be higher than 1. | -| config.configmap.cnCouchbasePassword | string | `"P@ssw0rd"` | Couchbase password for the restricted user config.configmap.cnCouchbaseUser that is often used inside the services. The password must contain one digit, one uppercase letter, one lower case letter and one symbol . | -| config.configmap.cnCouchbaseSuperUser | string | `"admin"` | The Couchbase super user (admin) username. This user is used during initialization only. | -| config.configmap.cnCouchbaseSuperUserPassword | string | `"Test1234#"` | Couchbase password for the superuser config.configmap.cnCouchbaseSuperUser that is used during the initialization process. The password must contain one digit, one uppercase letter, one lower case letter and one symbol | -| config.configmap.cnCouchbaseUrl | string | `"cbgluu.default.svc.cluster.local"` | Couchbase URL. Used only when global.cnPersistenceType is hybrid or couchbase. This should be in FQDN format for either remote or local Couchbase clusters. The address can be an internal address inside the kubernetes cluster | -| config.configmap.cnCouchbaseUser | string | `"gluu"` | Couchbase restricted user. Used only when global.cnPersistenceType is hybrid or couchbase. | -| config.configmap.cnGoogleProjectId | string | `"google-project-to-save-config-and-secrets-to"` | Project id of the Google project the secret manager belongs to. Used only when global.configAdapterName and global.configSecretAdapter is set to google. | -| config.configmap.cnGoogleSecretManagerPassPhrase | string | `"Test1234#"` | Passphrase for Gluu secret in Google Secret Manager. This is used for encrypting and decrypting data from the Google Secret Manager. Used only when global.configAdapterName and global.configSecretAdapter is set to google. | -| config.configmap.cnGoogleSecretManagerServiceAccount | string | `"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo="` | Service account with roles roles/secretmanager.admin base64 encoded string. This is used often inside the services to reach the configuration layer. Used only when global.configAdapterName and global.configSecretAdapter is set to google. | -| config.configmap.cnGoogleSpannerDatabaseId | string | `""` | Google Spanner Database ID. Used only when global.cnPersistenceType is spanner. | -| config.configmap.cnGoogleSpannerInstanceId | string | `""` | Google Spanner ID. Used only when global.cnPersistenceType is spanner. | -| config.configmap.cnJettyRequestHeaderSize | int | `8192` | Jetty header size in bytes in the auth server | -| config.configmap.cnLdapUrl | string | `"opendj:1636"` | OpenDJ internal address. Leave as default. Used when `global.cnPersistenceType` is set to `ldap`. | -| config.configmap.cnMaxRamPercent | string | `"75.0"` | Value passed to Java option -XX:MaxRAMPercentage | -| config.configmap.cnPersistenceHybridMapping | string | `"{}"` | Specify data that should be saved in LDAP (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType` is set to `hybrid`. { "default": "", "user": "", "site": "", "cache": "", "token": "", "session": "", } | -| config.configmap.cnRedisSentinelGroup | string | `""` | Redis Sentinel Group. Often set when `config.configmap.cnRedisType` is set to `SENTINEL`. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. | -| config.configmap.cnRedisSslTruststore | string | `""` | Redis SSL truststore. Optional. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. | -| config.configmap.cnRedisType | string | `"STANDALONE"` | Redis service type. `STANDALONE` or `CLUSTER`. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. | -| config.configmap.cnRedisUrl | string | `"redis.redis.svc.cluster.local:6379"` | Redis URL and port number :. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. | -| config.configmap.cnRedisUseSsl | bool | `false` | Boolean to use SSL in Redis. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. | -| config.configmap.cnScimProtectionMode | string | `"OAUTH"` | SCIM protection mode OAUTH|TEST|UMA | -| config.configmap.cnSecretGoogleSecretNamePrefix | string | `"gluu"` | Prefix for Gluu secret in Google Secret Manager. Defaults to gluu. If left gluu-secret secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google. | -| config.configmap.cnSecretGoogleSecretVersionId | string | `"latest"` | Secret version to be used for secret configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google. | -| config.configmap.cnSecretKubernetesSecret | string | `"cn"` | Kubernetes secret name holding configuration keys. Used when global.configSecretAdapter is set to kubernetes which is the default. | -| config.configmap.cnSqlDbDialect | string | `"mysql"` | SQL database dialect. `mysql` or `pgsql` | -| config.configmap.cnSqlDbHost | string | `"my-release-mysql.default.svc.cluster.local"` | SQL database host uri. | -| config.configmap.cnSqlDbName | string | `"jans"` | SQL database name. | -| config.configmap.cnSqlDbPort | int | `3306` | SQL database port. | -| config.configmap.cnSqlDbSchema | string | `""` | Schema name used by SQL database (default to empty-string; if using MySQL, the schema name will be resolved as the database name, whereas in PostgreSQL the schema name will be resolved as `"public"`). | -| config.configmap.cnSqlDbTimezone | string | `"UTC"` | SQL database timezone. | -| config.configmap.cnSqlDbUser | string | `"jans"` | SQL database username. | -| config.configmap.cnSqldbUserPassword | string | `"Test1234#"` | SQL password injected the secrets . | -| config.configmap.lbAddr | string | `""` | Load balancer address for AWS if the FQDN is not registered. | -| config.countryCode | string | `"US"` | Country code. Used for certificate creation. | -| config.dnsConfig | object | `{}` | Add custom dns config | -| config.dnsPolicy | string | `""` | Add custom dns policy | -| config.email | string | `"support@gluu.org"` | Email address of the administrator usually. Used for certificate creation. | -| config.image.pullSecrets | list | `[]` | Image Pull Secrets | -| config.image.repository | string | `"janssenproject/configurator"` | Image to use for deploying. | -| config.image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| config.ldapPassword | string | `"P@ssw0rds"` | LDAP admin password if OpenDJ is used for persistence. | -| config.migration | object | `{"enabled":false,"migrationDataFormat":"ldif","migrationDir":"/ce-migration"}` | CE to CN Migration section | -| config.migration.enabled | bool | `false` | Boolean flag to enable migration from CE | -| config.migration.migrationDataFormat | string | `"ldif"` | migration data-format depending on persistence backend. Supported data formats are ldif, couchbase+json, spanner+avro, postgresql+json, and mysql+json. | -| config.migration.migrationDir | string | `"/ce-migration"` | Directory holding all migration files | -| config.orgName | string | `"Gluu"` | Organization name. Used for certificate creation. | -| config.redisPassword | string | `"P@assw0rd"` | Redis admin password if `config.configmap.cnCacheType` is set to `REDIS`. | -| config.resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. | -| config.resources.limits.cpu | string | `"300m"` | CPU limit. | -| config.resources.limits.memory | string | `"300Mi"` | Memory limit. | -| config.resources.requests.cpu | string | `"300m"` | CPU request. | -| config.resources.requests.memory | string | `"300Mi"` | Memory request. | -| config.state | string | `"TX"` | State code. Used for certificate creation. | -| config.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service. | -| config.usrEnvs.normal | object | `{}` | Add custom normal envs to the service. variable1: value1 | -| config.usrEnvs.secret | object | `{}` | Add custom secret envs to the service. variable1: value1 | -| config.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| config.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| fido2 | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/fido2","tag":"1.0.5-1"},"livenessProbe":{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"pdb":{"enabled":true,"maxUnavailable":"90%"},"readinessProbe":{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"500m","memory":"500Mi"},"requests":{"cpu":"500m","memory":"500Mi"}},"service":{"name":"http-fido2","port":8080},"topologySpreadConstraints":{},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments. | -| fido2.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | -| fido2.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | -| fido2.dnsConfig | object | `{}` | Add custom dns config | -| fido2.dnsPolicy | string | `""` | Add custom dns policy | -| fido2.hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| fido2.hpa.behavior | object | `{}` | Scaling Policies | -| fido2.hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| fido2.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| fido2.image.pullSecrets | list | `[]` | Image Pull Secrets | -| fido2.image.repository | string | `"janssenproject/fido2"` | Image to use for deploying. | -| fido2.image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| fido2.livenessProbe | object | `{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the liveness healthcheck for the fido2 if needed. | -| fido2.livenessProbe.httpGet | object | `{"path":"/jans-fido2/sys/health-check","port":"http-fido2"}` | http liveness probe endpoint | -| fido2.pdb | object | `{"enabled":true,"maxUnavailable":"90%"}` | Configure the PodDisruptionBudget | -| fido2.readinessProbe | object | `{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the readiness healthcheck for the fido2 if needed. | -| fido2.replicas | int | `1` | Service replica number. | -| fido2.resources | object | `{"limits":{"cpu":"500m","memory":"500Mi"},"requests":{"cpu":"500m","memory":"500Mi"}}` | Resource specs. | -| fido2.resources.limits.cpu | string | `"500m"` | CPU limit. | -| fido2.resources.limits.memory | string | `"500Mi"` | Memory limit. | -| fido2.resources.requests.cpu | string | `"500m"` | CPU request. | -| fido2.resources.requests.memory | string | `"500Mi"` | Memory request. | -| fido2.service.name | string | `"http-fido2"` | The name of the fido2 port within the fido2 service. Please keep it as default. | -| fido2.service.port | int | `8080` | Port of the fido2 service. Please keep it as default. | -| fido2.topologySpreadConstraints | object | `{}` | Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ | -| fido2.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| fido2.usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| fido2.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| fido2.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| fido2.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| global | object | `{"admin-ui":{"adminUiServiceName":"admin-ui","enabled":true,"ingress":{"adminUiEnabled":false}},"alb":{"ingress":false},"auth-server":{"appLoggers":{"auditStatsLogLevel":"INFO","auditStatsLogTarget":"FILE","authLogLevel":"INFO","authLogTarget":"STDOUT","enableStdoutLogPrefix":"true","httpLogLevel":"INFO","httpLogTarget":"FILE","ldapStatsLogLevel":"INFO","ldapStatsLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"authEncKeys":"RSA1_5 RSA-OAEP","authServerServiceName":"auth-server","authSigKeys":"RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512","enabled":true,"ingress":{"authServerEnabled":true,"authServerProtectedRegister":false,"authServerProtectedToken":false,"deviceCodeEnabled":true,"firebaseMessagingEnabled":true,"openidConfigEnabled":true,"u2fConfigEnabled":true,"uma2ConfigEnabled":true,"webdiscoveryEnabled":true,"webfingerEnabled":true}},"auth-server-key-rotation":{"enabled":false},"awsStorageType":"io1","azureStorageAccountType":"Standard_LRS","azureStorageKind":"Managed","casa":{"appLoggers":{"casaLogLevel":"INFO","casaLogTarget":"STDOUT","enableStdoutLogPrefix":"true","timerLogLevel":"INFO","timerLogTarget":"FILE"},"casaServiceName":"casa","enabled":true,"ingress":{"casaEnabled":false}},"cloud":{"testEnviroment":false},"cnAwsConfigFile":"/etc/jans/conf/aws_config_file","cnAwsSecretsReplicaRegionsFile":"/etc/jans/conf/aws_secrets_replica_regions","cnAwsSharedCredentialsFile":"/etc/jans/conf/aws_shared_credential_file","cnDocumentStoreType":"LOCAL","cnGoogleApplicationCredentials":"/etc/jans/conf/google-credentials.json","cnObExtSigningAlias":"","cnObExtSigningJwksCrt":"","cnObExtSigningJwksKey":"","cnObExtSigningJwksKeyPassPhrase":"","cnObExtSigningJwksUri":"","cnObStaticSigningKeyKid":"","cnObTransportAlias":"","cnObTransportCrt":"","cnObTransportKey":"","cnObTransportKeyPassPhrase":"","cnObTransportTrustStore":"","cnPersistenceType":"sql","cnPrometheusPort":"","config":{"enabled":true},"config-api":{"adminUiAppLoggers":{"adminUiAuditLogLevel":"INFO","adminUiAuditLogTarget":"FILE","adminUiLogLevel":"INFO","adminUiLogTarget":"FILE","enableStdoutLogPrefix":"true"},"appLoggers":{"configApiLogLevel":"INFO","configApiLogTarget":"STDOUT","enableStdoutLogPrefix":"true","ldapStatsLogLevel":"INFO","ldapStatsLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"configApiServerServiceName":"config-api","enabled":true,"ingress":{"configApiEnabled":true}},"configAdapterName":"kubernetes","configSecretAdapter":"kubernetes","distribution":"default","fido2":{"appLoggers":{"enableStdoutLogPrefix":"true","fido2LogLevel":"INFO","fido2LogTarget":"STDOUT","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE"},"enabled":true,"fido2ServiceName":"fido2","ingress":{"fido2ConfigEnabled":false}},"fqdn":"demoexample.gluu.org","gcePdStorageType":"pd-standard","isFqdnRegistered":false,"istio":{"additionalAnnotations":{},"additionalLabels":{},"enabled":false,"gateways":[],"ingress":false,"namespace":"istio-system"},"jobTtlSecondsAfterFinished":300,"lbIp":"22.22.22.22","nginx-ingress":{"enabled":true},"opendj":{"enabled":false,"ldapServiceName":"opendj"},"oxpassport":{"enabled":false,"oxPassportServiceName":"oxpassport"},"oxshibboleth":{"appLoggers":{"auditStatsLogLevel":"INFO","auditStatsLogTarget":"FILE","consentAuditLogLevel":"INFO","consentAuditLogTarget":"FILE","containerLogLevel":"","encryptionLogLevel":"","httpclientLogLevel":"","idpLogLevel":"INFO","idpLogTarget":"STDOUT","ldapLogLevel":"","messagesLogLevel":"","opensamlLogLevel":"","propsLogLevel":"","scriptLogLevel":"INFO","scriptLogTarget":"FILE","springLogLevel":"","xmlsecLogLevel":""},"enabled":false,"oxShibbolethServiceName":"oxshibboleth"},"persistence":{"enabled":true},"scim":{"appLoggers":{"enableStdoutLogPrefix":"true","ldapStatsLogLevel":"INFO","ldapStatsLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scimLogLevel":"INFO","scimLogTarget":"STDOUT","scriptLogLevel":"INFO","scriptLogTarget":"FILE"},"enabled":true,"ingress":{"scimConfigEnabled":false,"scimEnabled":false},"scimServiceName":"scim"},"storageClass":{"allowVolumeExpansion":true,"allowedTopologies":[],"mountOptions":["debug"],"parameters":{},"provisioner":"microk8s.io/hostpath","reclaimPolicy":"Retain","volumeBindingMode":"WaitForFirstConsumer"},"usrEnvs":{"normal":{},"secret":{}}}` | Parameters used globally across all services helm charts. | -| global.admin-ui.adminUiServiceName | string | `"admin-ui"` | Name of the admin-ui service. Please keep it as default. | -| global.admin-ui.enabled | bool | `true` | Boolean flag to enable/disable the admin-ui chart and admin ui config api plugin. | -| global.admin-ui.ingress.adminUiEnabled | bool | `false` | Enable Admin UI endpoints in either istio or nginx ingress depending on users choice | -| global.alb.ingress | bool | `false` | Activates ALB ingress | -| global.auth-server-key-rotation.enabled | bool | `false` | Boolean flag to enable/disable the auth-server-key rotation cronjob chart. | -| global.auth-server.appLoggers | object | `{"auditStatsLogLevel":"INFO","auditStatsLogTarget":"FILE","authLogLevel":"INFO","authLogTarget":"STDOUT","enableStdoutLogPrefix":"true","httpLogLevel":"INFO","httpLogTarget":"FILE","ldapStatsLogLevel":"INFO","ldapStatsLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"}` | App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. | -| global.auth-server.appLoggers.auditStatsLogLevel | string | `"INFO"` | jans-auth_audit.log level | -| global.auth-server.appLoggers.auditStatsLogTarget | string | `"FILE"` | jans-auth_script.log target | -| global.auth-server.appLoggers.authLogLevel | string | `"INFO"` | jans-auth.log level | -| global.auth-server.appLoggers.authLogTarget | string | `"STDOUT"` | jans-auth.log target | -| global.auth-server.appLoggers.enableStdoutLogPrefix | string | `"true"` | Enable log prefixing which enables prepending the STDOUT logs with the file name. i.e auth-server-script ===> 2022-12-20 17:49:55,744 INFO | -| global.auth-server.appLoggers.httpLogLevel | string | `"INFO"` | http_request_response.log level | -| global.auth-server.appLoggers.httpLogTarget | string | `"FILE"` | http_request_response.log target | -| global.auth-server.appLoggers.ldapStatsLogLevel | string | `"INFO"` | jans-auth_persistence_ldap_statistics.log level | -| global.auth-server.appLoggers.ldapStatsLogTarget | string | `"FILE"` | jans-auth_persistence_ldap_statistics.log target | -| global.auth-server.appLoggers.persistenceDurationLogLevel | string | `"INFO"` | jans-auth_persistence_duration.log level | -| global.auth-server.appLoggers.persistenceDurationLogTarget | string | `"FILE"` | jans-auth_persistence_duration.log target | -| global.auth-server.appLoggers.persistenceLogLevel | string | `"INFO"` | jans-auth_persistence.log level | -| global.auth-server.appLoggers.persistenceLogTarget | string | `"FILE"` | jans-auth_persistence.log target | -| global.auth-server.appLoggers.scriptLogLevel | string | `"INFO"` | jans-auth_script.log level | -| global.auth-server.appLoggers.scriptLogTarget | string | `"FILE"` | jans-auth_script.log target | -| global.auth-server.authEncKeys | string | `"RSA1_5 RSA-OAEP"` | space-separated key algorithm for encryption (default to `RSA1_5 RSA-OAEP`) | -| global.auth-server.authServerServiceName | string | `"auth-server"` | Name of the auth-server service. Please keep it as default. | -| global.auth-server.authSigKeys | string | `"RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512"` | space-separated key algorithm for signing (default to `RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512`) | -| global.auth-server.enabled | bool | `true` | Boolean flag to enable/disable auth-server chart. You should never set this to false. | -| global.auth-server.ingress | object | `{"authServerEnabled":true,"authServerProtectedRegister":false,"authServerProtectedToken":false,"deviceCodeEnabled":true,"firebaseMessagingEnabled":true,"openidConfigEnabled":true,"u2fConfigEnabled":true,"uma2ConfigEnabled":true,"webdiscoveryEnabled":true,"webfingerEnabled":true}` | Enable endpoints in either istio or nginx ingress depending on users choice | -| global.auth-server.ingress.authServerEnabled | bool | `true` | Enable Auth server endpoints /jans-auth | -| global.auth-server.ingress.authServerProtectedRegister | bool | `false` | Enable mTLS onn Auth server endpoint /jans-auth/restv1/register. Currently not working in Istio. | -| global.auth-server.ingress.authServerProtectedToken | bool | `false` | Enable mTLS on Auth server endpoint /jans-auth/restv1/token. Currently not working in Istio. | -| global.auth-server.ingress.deviceCodeEnabled | bool | `true` | Enable endpoint /device-code | -| global.auth-server.ingress.firebaseMessagingEnabled | bool | `true` | Enable endpoint /firebase-messaging-sw.js | -| global.auth-server.ingress.openidConfigEnabled | bool | `true` | Enable endpoint /.well-known/openid-configuration | -| global.auth-server.ingress.u2fConfigEnabled | bool | `true` | Enable endpoint /.well-known/fido-configuration | -| global.auth-server.ingress.uma2ConfigEnabled | bool | `true` | Enable endpoint /.well-known/uma2-configuration | -| global.auth-server.ingress.webdiscoveryEnabled | bool | `true` | Enable endpoint /.well-known/simple-web-discovery | -| global.auth-server.ingress.webfingerEnabled | bool | `true` | Enable endpoint /.well-known/webfinger | -| global.awsStorageType | string | `"io1"` | Volume storage type if using AWS volumes. | -| global.azureStorageAccountType | string | `"Standard_LRS"` | Volume storage type if using Azure disks. | -| global.azureStorageKind | string | `"Managed"` | Azure storage kind if using Azure disks | -| global.casa.appLoggers | object | `{"casaLogLevel":"INFO","casaLogTarget":"STDOUT","enableStdoutLogPrefix":"true","timerLogLevel":"INFO","timerLogTarget":"FILE"}` | App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. | -| global.casa.appLoggers.casaLogLevel | string | `"INFO"` | casa.log level | -| global.casa.appLoggers.casaLogTarget | string | `"STDOUT"` | casa.log target | -| global.casa.appLoggers.enableStdoutLogPrefix | string | `"true"` | Enable log prefixing which enables prepending the STDOUT logs with the file name. i.e casa ===> 2022-12-20 17:49:55,744 INFO | -| global.casa.appLoggers.timerLogLevel | string | `"INFO"` | casa timer log level | -| global.casa.appLoggers.timerLogTarget | string | `"FILE"` | casa timer log target | -| global.casa.casaServiceName | string | `"casa"` | Name of the casa service. Please keep it as default. | -| global.casa.enabled | bool | `true` | Boolean flag to enable/disable the casa chart. | -| global.casa.ingress | object | `{"casaEnabled":false}` | Enable endpoints in either istio or nginx ingress depending on users choice | -| global.casa.ingress.casaEnabled | bool | `false` | Enable casa endpoints /casa | -| global.cloud.testEnviroment | bool | `false` | Boolean flag if enabled will strip resources requests and limits from all services. | -| global.cnDocumentStoreType | string | `"LOCAL"` | Document store type to use for shibboleth files LOCAL. | -| global.cnGoogleApplicationCredentials | string | `"/etc/jans/conf/google-credentials.json"` | Base64 encoded service account. The sa must have roles/secretmanager.admin to use Google secrets and roles/spanner.databaseUser to use Spanner. Leave as this is a sensible default. | -| global.cnObExtSigningAlias | string | `""` | Open banking external signing AS Alias. This is a kid value.Used in SSA Validation, kid used while encoding a JWT sent to token URL i.e. XkwIzWy44xWSlcWnMiEc8iq9s2G | -| global.cnObExtSigningJwksCrt | string | `""` | Open banking external signing jwks AS certificate authority string. Used in SSA Validation. This must be encoded using base64.. Used when `.global.cnObExtSigningJwksUri` is set. | -| global.cnObExtSigningJwksKey | string | `""` | Open banking external signing jwks AS key string. Used in SSA Validation. This must be encoded using base64. Used when `.global.cnObExtSigningJwksUri` is set. | -| global.cnObExtSigningJwksKeyPassPhrase | string | `""` | Open banking external signing jwks AS key passphrase to unlock provided key. This must be encoded using base64. Used when `.global.cnObExtSigningJwksUri` is set. | -| global.cnObExtSigningJwksUri | string | `""` | Open banking external signing jwks uri. Used in SSA Validation. | -| global.cnObStaticSigningKeyKid | string | `""` | Open banking signing AS kid to force the AS to use a specific signing key. i.e. Wy44xWSlcWnMiEc8iq9s2G | -| global.cnObTransportAlias | string | `""` | Open banking transport Alias used inside the JVM. | -| global.cnObTransportCrt | string | `""` | Open banking AS transport crt. Used in SSA Validation. This must be encoded using base64. | -| global.cnObTransportKey | string | `""` | Open banking AS transport key. Used in SSA Validation. This must be encoded using base64. | -| global.cnObTransportKeyPassPhrase | string | `""` | Open banking AS transport key passphrase to unlock AS transport key. This must be encoded using base64. | -| global.cnObTransportTrustStore | string | `""` | Open banking AS transport truststore crt. This is normally generated from the OB issuing CA, OB Root CA and Signing CA. Used when .global.cnObExtSigningJwksUri is set. Used in SSA Validation. This must be encoded using base64. | -| global.cnPersistenceType | string | `"sql"` | Persistence backend to run Gluu with ldap|couchbase|hybrid|sql|spanner. | -| global.cnPrometheusPort | string | `""` | Port used by Prometheus JMX agent (default to empty string). To enable Prometheus JMX agent, set the value to a number. | -| global.config-api.adminUiAppLoggers.adminUiAuditLogLevel | string | `"INFO"` | config-api admin-ui plugin audit log level | -| global.config-api.adminUiAppLoggers.adminUiAuditLogTarget | string | `"FILE"` | config-api admin-ui plugin audit log target | -| global.config-api.adminUiAppLoggers.adminUiLogLevel | string | `"INFO"` | config-api admin-ui plugin log target | -| global.config-api.adminUiAppLoggers.adminUiLogTarget | string | `"FILE"` | config-api admin-ui plugin log level | -| global.config-api.adminUiAppLoggers.enableStdoutLogPrefix | string | `"true"` | Enable log prefixing which enables prepending the STDOUT logs with the file name. i.e config-api_persistence ===> 2022-12-20 17:49:55,744 INFO | -| global.config-api.appLoggers | object | `{"configApiLogLevel":"INFO","configApiLogTarget":"STDOUT","enableStdoutLogPrefix":"true","ldapStatsLogLevel":"INFO","ldapStatsLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scriptLogLevel":"INFO","scriptLogTarget":"FILE"}` | App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. | -| global.config-api.appLoggers.configApiLogLevel | string | `"INFO"` | configapi.log level | -| global.config-api.appLoggers.configApiLogTarget | string | `"STDOUT"` | configapi.log target | -| global.config-api.appLoggers.enableStdoutLogPrefix | string | `"true"` | Enable log prefixing which enables prepending the STDOUT logs with the file name. i.e config-api_persistence ===> 2022-12-20 17:49:55,744 INFO | -| global.config-api.appLoggers.ldapStatsLogLevel | string | `"INFO"` | config-api_persistence_ldap_statistics.log level | -| global.config-api.appLoggers.ldapStatsLogTarget | string | `"FILE"` | config-api_persistence_ldap_statistics.log target | -| global.config-api.appLoggers.persistenceDurationLogLevel | string | `"INFO"` | config-api_persistence_duration.log level | -| global.config-api.appLoggers.persistenceDurationLogTarget | string | `"FILE"` | config-api_persistence_duration.log target | -| global.config-api.appLoggers.persistenceLogLevel | string | `"INFO"` | config-api_persistence.log level | -| global.config-api.appLoggers.persistenceLogTarget | string | `"FILE"` | config-api_persistence.log target | -| global.config-api.appLoggers.scriptLogLevel | string | `"INFO"` | config-api_script.log level | -| global.config-api.appLoggers.scriptLogTarget | string | `"FILE"` | config-api_script.log target | -| global.config-api.configApiServerServiceName | string | `"config-api"` | Name of the config-api service. Please keep it as default. | -| global.config-api.enabled | bool | `true` | Boolean flag to enable/disable the config-api chart. | -| global.config-api.ingress | object | `{"configApiEnabled":true}` | Enable endpoints in either istio or nginx ingress depending on users choice | -| global.config.enabled | bool | `true` | Boolean flag to enable/disable the configuration chart. This normally should never be false | -| global.configAdapterName | string | `"kubernetes"` | The config backend adapter that will hold Gluu configuration layer. aws|google|kubernetes | -| global.configSecretAdapter | string | `"kubernetes"` | The config backend adapter that will hold Gluu secret layer. aws|google|kubernetes | -| global.distribution | string | `"default"` | Gluu distributions supported are: default|openbanking. | -| global.fido2.appLoggers | object | `{"enableStdoutLogPrefix":"true","fido2LogLevel":"INFO","fido2LogTarget":"STDOUT","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE"}` | App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. | -| global.fido2.appLoggers.enableStdoutLogPrefix | string | `"true"` | Enable log prefixing which enables prepending the STDOUT logs with the file name. i.e fido2 ===> 2022-12-20 17:49:55,744 INFO | -| global.fido2.appLoggers.fido2LogLevel | string | `"INFO"` | fido2.log level | -| global.fido2.appLoggers.fido2LogTarget | string | `"STDOUT"` | fido2.log target | -| global.fido2.appLoggers.persistenceLogLevel | string | `"INFO"` | fido2_persistence.log level | -| global.fido2.appLoggers.persistenceLogTarget | string | `"FILE"` | fido2_persistence.log target | -| global.fido2.enabled | bool | `true` | Boolean flag to enable/disable the fido2 chart. | -| global.fido2.fido2ServiceName | string | `"fido2"` | Name of the fido2 service. Please keep it as default. | -| global.fido2.ingress | object | `{"fido2ConfigEnabled":false}` | Enable endpoints in either istio or nginx ingress depending on users choice | -| global.fido2.ingress.fido2ConfigEnabled | bool | `false` | Enable endpoint /.well-known/fido2-configuration | -| global.fqdn | string | `"demoexample.gluu.org"` | Fully qualified domain name to be used for Gluu installation. This address will be used to reach Gluu services. | -| global.gcePdStorageType | string | `"pd-standard"` | GCE storage kind if using Google disks | -| global.isFqdnRegistered | bool | `false` | Boolean flag to enable mapping global.lbIp to global.fqdn inside pods on clouds that provide static ip for load balancers. On cloud that provide only addresses to the LB this flag will enable a script to actively scan config.configmap.lbAddr and update the hosts file inside the pods automatically. | -| global.istio.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | -| global.istio.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | -| global.istio.enabled | bool | `false` | Boolean flag that enables using istio side-cars with Gluu services. | -| global.istio.gateways | list | `[]` | Override the gateway that can be created by default. This is used when istio ingress has already been setup and the gateway exists. | -| global.istio.ingress | bool | `false` | Boolean flag that enables using istio gateway for Gluu. This assumes istio ingress is installed and hence the LB is available. | -| global.istio.namespace | string | `"istio-system"` | The namespace istio is deployed in. The is normally istio-system. | -| global.jobTtlSecondsAfterFinished | int | `300` | https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ | -| global.lbIp | string | `"22.22.22.22"` | The Loadbalancer IP created by nginx or istio on clouds that provide static IPs. This is not needed if `global.fqdn` is globally resolvable. | -| global.nginx-ingress.enabled | bool | `true` | Boolean flag to enable/disable the nginx-ingress definitions chart. | -| global.opendj.enabled | bool | `false` | Boolean flag to enable/disable the OpenDJ chart. | -| global.opendj.ldapServiceName | string | `"opendj"` | Name of the OpenDJ service. Please keep it as default. | -| global.oxpassport.enabled | bool | `false` | Boolean flag to enable/disable passport chart | -| global.oxpassport.oxPassportServiceName | string | `"oxpassport"` | Name of the oxPassport service. Please keep it as default. | -| global.oxshibboleth.appLoggers | object | `{"auditStatsLogLevel":"INFO","auditStatsLogTarget":"FILE","consentAuditLogLevel":"INFO","consentAuditLogTarget":"FILE","containerLogLevel":"","encryptionLogLevel":"","httpclientLogLevel":"","idpLogLevel":"INFO","idpLogTarget":"STDOUT","ldapLogLevel":"","messagesLogLevel":"","opensamlLogLevel":"","propsLogLevel":"","scriptLogLevel":"INFO","scriptLogTarget":"FILE","springLogLevel":"","xmlsecLogLevel":""}` | App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. log levels are "OFF", "FATAL", "ERROR", "WARN", "INFO", "DEBUG", "TRACE" Targets are "STDOUT" and "FILE" | -| global.oxshibboleth.appLoggers.auditStatsLogLevel | string | `"INFO"` | idp-audit.log level | -| global.oxshibboleth.appLoggers.auditStatsLogTarget | string | `"FILE"` | idp-audit.log target | -| global.oxshibboleth.appLoggers.consentAuditLogLevel | string | `"INFO"` | idp-consent-audit.log level | -| global.oxshibboleth.appLoggers.consentAuditLogTarget | string | `"FILE"` | idp-consent-audit.log target | -| global.oxshibboleth.appLoggers.idpLogLevel | string | `"INFO"` | idp-process.log level | -| global.oxshibboleth.appLoggers.idpLogTarget | string | `"STDOUT"` | idp-process.log target | -| global.oxshibboleth.appLoggers.ldapLogLevel | string | `""` | https://github.com/GluuFederation/docker-oxshibboleth#additional-logger-configuration The below are very noisy logs and are better left untouched | -| global.oxshibboleth.appLoggers.scriptLogLevel | string | `"INFO"` | idp-script.log level | -| global.oxshibboleth.appLoggers.scriptLogTarget | string | `"FILE"` | idp-script.log target | -| global.oxshibboleth.enabled | bool | `false` | Boolean flag to enable/disable the oxShibbboleth chart. | -| global.oxshibboleth.oxShibbolethServiceName | string | `"oxshibboleth"` | Name of the oxShibboleth service. Please keep it as default. | -| global.persistence.enabled | bool | `true` | Boolean flag to enable/disable the persistence chart. | -| global.scim.appLoggers | object | `{"enableStdoutLogPrefix":"true","ldapStatsLogLevel":"INFO","ldapStatsLogTarget":"FILE","persistenceDurationLogLevel":"INFO","persistenceDurationLogTarget":"FILE","persistenceLogLevel":"INFO","persistenceLogTarget":"FILE","scimLogLevel":"INFO","scimLogTarget":"STDOUT","scriptLogLevel":"INFO","scriptLogTarget":"FILE"}` | App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. | -| global.scim.appLoggers.enableStdoutLogPrefix | string | `"true"` | Enable log prefixing which enables prepending the STDOUT logs with the file name. i.e jans-scim ===> 2022-12-20 17:49:55,744 INFO | -| global.scim.appLoggers.ldapStatsLogLevel | string | `"INFO"` | jans-scim_persistence_ldap_statistics.log level | -| global.scim.appLoggers.ldapStatsLogTarget | string | `"FILE"` | jans-scim_persistence_ldap_statistics.log target | -| global.scim.appLoggers.persistenceDurationLogLevel | string | `"INFO"` | jans-scim_persistence_duration.log level | -| global.scim.appLoggers.persistenceDurationLogTarget | string | `"FILE"` | jans-scim_persistence_duration.log target | -| global.scim.appLoggers.persistenceLogLevel | string | `"INFO"` | jans-scim_persistence.log level | -| global.scim.appLoggers.persistenceLogTarget | string | `"FILE"` | jans-scim_persistence.log target | -| global.scim.appLoggers.scimLogLevel | string | `"INFO"` | jans-scim.log level | -| global.scim.appLoggers.scimLogTarget | string | `"STDOUT"` | jans-scim.log target | -| global.scim.appLoggers.scriptLogLevel | string | `"INFO"` | jans-scim_script.log level | -| global.scim.appLoggers.scriptLogTarget | string | `"FILE"` | jans-scim_script.log target | -| global.scim.enabled | bool | `true` | Boolean flag to enable/disable the SCIM chart. | -| global.scim.ingress | object | `{"scimConfigEnabled":false,"scimEnabled":false}` | Enable endpoints in either istio or nginx ingress depending on users choice | -| global.scim.ingress.scimConfigEnabled | bool | `false` | Enable endpoint /.well-known/scim-configuration | -| global.scim.ingress.scimEnabled | bool | `false` | Enable SCIM endpoints /jans-scim | -| global.scim.scimServiceName | string | `"scim"` | Name of the scim service. Please keep it as default. | -| global.storageClass | object | `{"allowVolumeExpansion":true,"allowedTopologies":[],"mountOptions":["debug"],"parameters":{},"provisioner":"microk8s.io/hostpath","reclaimPolicy":"Retain","volumeBindingMode":"WaitForFirstConsumer"}` | StorageClass section for OpenDJ charts. This is not currently used by the openbanking distribution. You may specify custom parameters as needed. | -| global.storageClass.parameters | object | `{}` | parameters: fsType: "" kind: "" pool: "" storageAccountType: "" type: "" | -| global.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service. Envs defined in global.userEnvs will be globally available to all services | -| global.usrEnvs.normal | object | `{}` | Add custom normal envs to the service. variable1: value1 | -| global.usrEnvs.secret | object | `{}` | Add custom secret envs to the service. variable1: value1 | -| installer-settings | object | `{"acceptLicense":"","aws":{"arn":{"arnAcmCert":"","enabled":""},"lbType":"","vpcCidr":"0.0.0.0/0"},"confirmSettings":false,"couchbase":{"backup":{"fullSchedule":"","incrementalSchedule":"","retentionTime":"","storageSize":""},"clusterName":"","commonName":"","customFileOverride":"","install":"","lowResourceInstall":"","namespace":"","subjectAlternativeName":"","totalNumberOfExpectedTransactionsPerSec":"","totalNumberOfExpectedUsers":"","volumeType":""},"currentVersion":"","google":{"useSecretManager":""},"images":{"edit":""},"ldap":{"backup":{"fullSchedule":""}},"namespace":"","nginxIngress":{"namespace":"","releaseName":""},"nodes":{"ips":"","names":"","zones":""},"openbanking":{"cnObTransportTrustStoreP12password":"","hasCnObTransportTrustStore":false},"postgres":{"install":"","namespace":""},"redis":{"install":"","namespace":""},"releaseName":"","sql":{"install":"","namespace":""},"volumeProvisionStrategy":""}` | Only used by the installer. These settings do not affect nor are used by the chart | -| nginx-ingress | object | `{"certManager":{"certificate":{"enabled":false,"issuerGroup":"cert-manager.io","issuerKind":"ClusterIssuer","issuerName":""}},"ingress":{"additionalAnnotations":{},"additionalLabels":{},"adminUiAdditionalAnnotations":{},"adminUiLabels":{},"authServerAdditionalAnnotations":{},"authServerLabels":{},"authServerProtectedRegisterAdditionalAnnotations":{},"authServerProtectedRegisterLabels":{},"authServerProtectedTokenAdditionalAnnotations":{},"authServerProtectedTokenLabels":{},"casaAdditionalAnnotations":{},"casaLabels":{},"configApiAdditionalAnnotations":{},"configApiLabels":{},"deviceCodeAdditionalAnnotations":{},"deviceCodeLabels":{},"fido2ConfigAdditionalAnnotations":{},"fido2ConfigLabels":{},"firebaseMessagingAdditionalAnnotations":{},"firebaseMessagingLabels":{},"hosts":["demoexample.gluu.org"],"openidAdditionalAnnotations":{},"openidConfigLabels":{},"path":"/","scimAdditionalAnnotations":{},"scimConfigAdditionalAnnotations":{},"scimConfigLabels":{},"scimLabels":{},"tls":[{"hosts":["demoexample.gluu.org"],"secretName":"tls-certificate"}],"u2fAdditionalAnnotations":{},"u2fConfigLabels":{},"uma2AdditionalAnnotations":{},"uma2ConfigLabels":{},"webdiscoveryAdditionalAnnotations":{},"webdiscoveryLabels":{},"webfingerAdditionalAnnotations":{},"webfingerLabels":{}}}` | Nginx ingress definitions chart | -| nginx-ingress.ingress.additionalAnnotations | object | `{}` | Additional annotations that will be added across all ingress definitions in the format of {cert-manager.io/issuer: "letsencrypt-prod"} Enable client certificate authentication nginx.ingress.kubernetes.io/auth-tls-verify-client: "optional" Create the secret containing the trusted ca certificates nginx.ingress.kubernetes.io/auth-tls-secret: "gluu/tls-certificate" Specify the verification depth in the client certificates chain nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1" Specify if certificates are passed to upstream server nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true" | -| nginx-ingress.ingress.additionalLabels | object | `{}` | Additional labels that will be added across all ingress definitions in the format of {mylabel: "myapp"} | -| nginx-ingress.ingress.adminUiAdditionalAnnotations | object | `{}` | openid-configuration ingress resource additional annotations. | -| nginx-ingress.ingress.adminUiLabels | object | `{}` | Admin UI ingress resource labels. key app is taken. | -| nginx-ingress.ingress.authServerAdditionalAnnotations | object | `{}` | Auth server ingress resource additional annotations. | -| nginx-ingress.ingress.authServerLabels | object | `{}` | Auth server ingress resource labels. key app is taken | -| nginx-ingress.ingress.authServerProtectedRegisterAdditionalAnnotations | object | `{}` | Auth server protected register ingress resource additional annotations. | -| nginx-ingress.ingress.authServerProtectedRegisterLabels | object | `{}` | Auth server protected token ingress resource labels. key app is taken | -| nginx-ingress.ingress.authServerProtectedTokenAdditionalAnnotations | object | `{}` | Auth server protected token ingress resource additional annotations. | -| nginx-ingress.ingress.authServerProtectedTokenLabels | object | `{}` | Auth server protected token ingress resource labels. key app is taken | -| nginx-ingress.ingress.casaAdditionalAnnotations | object | `{}` | Casa ingress resource additional annotations. | -| nginx-ingress.ingress.casaLabels | object | `{}` | Casa ingress resource labels. key app is taken | -| nginx-ingress.ingress.configApiAdditionalAnnotations | object | `{}` | ConfigAPI ingress resource additional annotations. | -| nginx-ingress.ingress.configApiLabels | object | `{}` | configAPI ingress resource labels. key app is taken | -| nginx-ingress.ingress.deviceCodeAdditionalAnnotations | object | `{}` | device-code ingress resource additional annotations. | -| nginx-ingress.ingress.deviceCodeLabels | object | `{}` | device-code ingress resource labels. key app is taken | -| nginx-ingress.ingress.fido2ConfigAdditionalAnnotations | object | `{}` | fido2 config ingress resource additional annotations. | -| nginx-ingress.ingress.fido2ConfigLabels | object | `{}` | fido2 config ingress resource labels. key app is taken | -| nginx-ingress.ingress.firebaseMessagingAdditionalAnnotations | object | `{}` | Firebase Messaging ingress resource additional annotations. | -| nginx-ingress.ingress.firebaseMessagingLabels | object | `{}` | Firebase Messaging ingress resource labels. key app is taken | -| nginx-ingress.ingress.openidAdditionalAnnotations | object | `{}` | openid-configuration ingress resource additional annotations. | -| nginx-ingress.ingress.openidConfigLabels | object | `{}` | openid-configuration ingress resource labels. key app is taken | -| nginx-ingress.ingress.scimAdditionalAnnotations | object | `{}` | SCIM ingress resource additional annotations. | -| nginx-ingress.ingress.scimConfigAdditionalAnnotations | object | `{}` | SCIM config ingress resource additional annotations. | -| nginx-ingress.ingress.scimConfigLabels | object | `{}` | SCIM config ingress resource labels. key app is taken | -| nginx-ingress.ingress.scimLabels | object | `{}` | SCIM config ingress resource labels. key app is taken | -| nginx-ingress.ingress.tls | list | `[{"hosts":["demoexample.gluu.org"],"secretName":"tls-certificate"}]` | Secrets holding HTTPS CA cert and key. | -| nginx-ingress.ingress.u2fAdditionalAnnotations | object | `{}` | u2f config ingress resource additional annotations. | -| nginx-ingress.ingress.u2fConfigLabels | object | `{}` | u2f config ingress resource labels. key app is taken | -| nginx-ingress.ingress.uma2AdditionalAnnotations | object | `{}` | uma2 config ingress resource additional annotations. | -| nginx-ingress.ingress.uma2ConfigLabels | object | `{}` | uma2 config ingress resource labels. key app is taken | -| nginx-ingress.ingress.webdiscoveryAdditionalAnnotations | object | `{}` | webdiscovery ingress resource additional annotations. | -| nginx-ingress.ingress.webdiscoveryLabels | object | `{}` | webdiscovery ingress resource labels. key app is taken | -| nginx-ingress.ingress.webfingerAdditionalAnnotations | object | `{}` | webfinger ingress resource additional annotations. | -| nginx-ingress.ingress.webfingerLabels | object | `{}` | webfinger ingress resource labels. key app is taken | -| opendj | object | `{"additionalAnnotations":{},"additionalLabels":{},"backup":{"cronJobSchedule":"*/59 * * * *","enabled":true},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"gluufederation/opendj","tag":"5.0.0_dev"},"livenessProbe":{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"failureThreshold":20,"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"pdb":{"enabled":true,"maxUnavailable":1},"persistence":{"size":"5Gi"},"ports":{"tcp-admin":{"nodePort":"","port":4444,"protocol":"TCP","targetPort":4444},"tcp-ldap":{"nodePort":"","port":1389,"protocol":"TCP","targetPort":1389},"tcp-ldaps":{"nodePort":"","port":1636,"protocol":"TCP","targetPort":1636},"tcp-repl":{"nodePort":"","port":8989,"protocol":"TCP","targetPort":8989},"tcp-serf":{"nodePort":"","port":7946,"protocol":"TCP","targetPort":7946},"udp-serf":{"nodePort":"","port":7946,"protocol":"UDP","targetPort":7946}},"readinessProbe":{"failureThreshold":20,"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":1636},"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1500m","memory":"2000Mi"},"requests":{"cpu":"1500m","memory":"2000Mi"}},"topologySpreadConstraints":{},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | OpenDJ is a directory server which implements a wide range of Lightweight Directory Access Protocol and related standards, including full compliance with LDAPv3 but also support for Directory Service Markup Language (DSMLv2).Written in Java, OpenDJ offers multi-master replication, access control, and many extensions. | -| opendj.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | -| opendj.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | -| opendj.backup | object | `{"cronJobSchedule":"*/59 * * * *","enabled":true}` | Configure ldap backup cronjob | -| opendj.dnsConfig | object | `{}` | Add custom dns config | -| opendj.dnsPolicy | string | `""` | Add custom dns policy | -| opendj.hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| opendj.hpa.behavior | object | `{}` | Scaling Policies | -| opendj.hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| opendj.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| opendj.image.pullSecrets | list | `[]` | Image Pull Secrets | -| opendj.image.repository | string | `"gluufederation/opendj"` | Image to use for deploying. | -| opendj.image.tag | string | `"5.0.0_dev"` | Image tag to use for deploying. | -| opendj.livenessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"failureThreshold":20,"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for OpenDJ if needed. https://github.com/GluuFederation/docker-opendj/blob/master/scripts/healthcheck.py | -| opendj.livenessProbe.exec | object | `{"command":["python3","/app/scripts/healthcheck.py"]}` | Executes the python3 healthcheck. | -| opendj.pdb | object | `{"enabled":true,"maxUnavailable":1}` | Configure the PodDisruptionBudget | -| opendj.persistence.size | string | `"5Gi"` | OpenDJ volume size | -| opendj.readinessProbe | object | `{"failureThreshold":20,"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":1636},"timeoutSeconds":5}` | Configure the readiness healthcheck for OpenDJ if needed. https://github.com/GluuFederation/docker-opendj/blob/master/scripts/healthcheck.py | -| opendj.replicas | int | `1` | Service replica number. | -| opendj.resources | object | `{"limits":{"cpu":"1500m","memory":"2000Mi"},"requests":{"cpu":"1500m","memory":"2000Mi"}}` | Resource specs. | -| opendj.resources.limits.cpu | string | `"1500m"` | CPU limit. | -| opendj.resources.limits.memory | string | `"2000Mi"` | Memory limit. | -| opendj.resources.requests.cpu | string | `"1500m"` | CPU request. | -| opendj.resources.requests.memory | string | `"2000Mi"` | Memory request. | -| opendj.topologySpreadConstraints | object | `{}` | Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ | -| opendj.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| opendj.usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| opendj.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| opendj.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| opendj.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| oxpassport | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"gluufederation/oxpassport","tag":"5.0.0_dev"},"livenessProbe":{"failureThreshold":20,"httpGet":{"path":"/passport/health-check","port":"http-passport"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"pdb":{"enabled":true,"maxUnavailable":"90%"},"readinessProbe":{"failureThreshold":20,"httpGet":{"path":"/passport/health-check","port":"http-passport"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"700m","memory":"900Mi"},"requests":{"cpu":"700m","memory":"900Mi"}},"topologySpreadConstraints":{},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Gluu interface to Passport.js to support social login and inbound identity. | -| oxpassport.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | -| oxpassport.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | -| oxpassport.dnsConfig | object | `{}` | Add custom dns config | -| oxpassport.dnsPolicy | string | `""` | Add custom dns policy | -| oxpassport.hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| oxpassport.hpa.behavior | object | `{}` | Scaling Policies | -| oxpassport.hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| oxpassport.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| oxpassport.image.pullSecrets | list | `[]` | Image Pull Secrets | -| oxpassport.image.repository | string | `"gluufederation/oxpassport"` | Image to use for deploying. | -| oxpassport.image.tag | string | `"5.0.0_dev"` | Image tag to use for deploying. | -| oxpassport.livenessProbe | object | `{"failureThreshold":20,"httpGet":{"path":"/passport/health-check","port":"http-passport"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for oxPassport if needed. | -| oxpassport.livenessProbe.httpGet.path | string | `"/passport/health-check"` | http liveness probe endpoint | -| oxpassport.pdb | object | `{"enabled":true,"maxUnavailable":"90%"}` | Configure the PodDisruptionBudget | -| oxpassport.readinessProbe | object | `{"failureThreshold":20,"httpGet":{"path":"/passport/health-check","port":"http-passport"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the oxPassport if needed. | -| oxpassport.readinessProbe.httpGet.path | string | `"/passport/health-check"` | http readiness probe endpoint | -| oxpassport.replicas | int | `1` | Service replica number | -| oxpassport.resources | object | `{"limits":{"cpu":"700m","memory":"900Mi"},"requests":{"cpu":"700m","memory":"900Mi"}}` | Resource specs. | -| oxpassport.resources.limits.cpu | string | `"700m"` | CPU limit. | -| oxpassport.resources.limits.memory | string | `"900Mi"` | Memory limit. | -| oxpassport.resources.requests.cpu | string | `"700m"` | CPU request. | -| oxpassport.resources.requests.memory | string | `"900Mi"` | Memory request. | -| oxpassport.topologySpreadConstraints | object | `{}` | Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ | -| oxpassport.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| oxpassport.usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| oxpassport.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| oxpassport.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| oxpassport.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| oxshibboleth | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"gluufederation/oxshibboleth","tag":"5.0.0_dev"},"livenessProbe":{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"failureThreshold":20,"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"pdb":{"enabled":true,"maxUnavailable":1},"readinessProbe":{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"failureThreshold":20,"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"1000Mi"},"requests":{"cpu":"1000m","memory":"1000Mi"}},"topologySpreadConstraints":{},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Shibboleth project for the Gluu Server's SAML IDP functionality. | -| oxshibboleth.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | -| oxshibboleth.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | -| oxshibboleth.dnsConfig | object | `{}` | Add custom dns config | -| oxshibboleth.dnsPolicy | string | `""` | Add custom dns policy | -| oxshibboleth.hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| oxshibboleth.hpa.behavior | object | `{}` | Scaling Policies | -| oxshibboleth.hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| oxshibboleth.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| oxshibboleth.image.pullSecrets | list | `[]` | Image Pull Secrets | -| oxshibboleth.image.repository | string | `"gluufederation/oxshibboleth"` | Image to use for deploying. | -| oxshibboleth.image.tag | string | `"5.0.0_dev"` | Image tag to use for deploying. | -| oxshibboleth.livenessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"failureThreshold":20,"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for oxshibboleth if needed. https://github.com/GluuFederation/docker-oxshibboleth/blob/master/scripts/healthcheck.py | -| oxshibboleth.livenessProbe.exec | object | `{"command":["python3","/app/scripts/healthcheck.py"]}` | Executes the python3 healthcheck. | -| oxshibboleth.pdb | object | `{"enabled":true,"maxUnavailable":1}` | Configure the PodDisruptionBudget | -| oxshibboleth.readinessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"failureThreshold":20,"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the readiness healthcheck for the casa if needed. | -| oxshibboleth.readinessProbe.exec | object | `{"command":["python3","/app/scripts/healthcheck.py"]}` | Executes the python3 healthcheck. | -| oxshibboleth.replicas | int | `1` | Service replica number. | -| oxshibboleth.resources | object | `{"limits":{"cpu":"1000m","memory":"1000Mi"},"requests":{"cpu":"1000m","memory":"1000Mi"}}` | Resource specs. | -| oxshibboleth.resources.limits.cpu | string | `"1000m"` | CPU limit. | -| oxshibboleth.resources.limits.memory | string | `"1000Mi"` | Memory limit. | -| oxshibboleth.resources.requests.cpu | string | `"1000m"` | CPU request. | -| oxshibboleth.resources.requests.memory | string | `"1000Mi"` | Memory request. | -| oxshibboleth.topologySpreadConstraints | object | `{}` | Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ | -| oxshibboleth.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| oxshibboleth.usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| oxshibboleth.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| oxshibboleth.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| oxshibboleth.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| persistence | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/persistence-loader","tag":"1.0.5-1"},"resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Job to generate data and initial config for Gluu Server persistence layer. | -| persistence.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | -| persistence.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | -| persistence.dnsConfig | object | `{}` | Add custom dns config | -| persistence.dnsPolicy | string | `""` | Add custom dns policy | -| persistence.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| persistence.image.pullSecrets | list | `[]` | Image Pull Secrets | -| persistence.image.repository | string | `"janssenproject/persistence-loader"` | Image to use for deploying. | -| persistence.image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| persistence.resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. | -| persistence.resources.limits.cpu | string | `"300m"` | CPU limit | -| persistence.resources.limits.memory | string | `"300Mi"` | Memory limit. | -| persistence.resources.requests.cpu | string | `"300m"` | CPU request. | -| persistence.resources.requests.memory | string | `"300Mi"` | Memory request. | -| persistence.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| persistence.usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| persistence.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| persistence.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| persistence.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| scim | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/scim","tag":"1.0.5-1"},"livenessProbe":{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"pdb":{"enabled":true,"maxUnavailable":"90%"},"readinessProbe":{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"1000Mi"},"requests":{"cpu":"1000m","memory":"1000Mi"}},"service":{"name":"http-scim","port":8080},"topologySpreadConstraints":{},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | System for Cross-domain Identity Management (SCIM) version 2.0 | -| scim.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | -| scim.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | -| scim.dnsConfig | object | `{}` | Add custom dns config | -| scim.dnsPolicy | string | `""` | Add custom dns policy | -| scim.hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| scim.hpa.behavior | object | `{}` | Scaling Policies | -| scim.hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| scim.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| scim.image.pullSecrets | list | `[]` | Image Pull Secrets | -| scim.image.repository | string | `"janssenproject/scim"` | Image to use for deploying. | -| scim.image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| scim.livenessProbe | object | `{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for SCIM if needed. | -| scim.livenessProbe.httpGet.path | string | `"/jans-scim/sys/health-check"` | http liveness probe endpoint | -| scim.pdb | object | `{"enabled":true,"maxUnavailable":"90%"}` | Configure the PodDisruptionBudget | -| scim.readinessProbe | object | `{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the SCIM if needed. | -| scim.readinessProbe.httpGet.path | string | `"/jans-scim/sys/health-check"` | http readiness probe endpoint | -| scim.replicas | int | `1` | Service replica number. | -| scim.resources.limits.cpu | string | `"1000m"` | CPU limit. | -| scim.resources.limits.memory | string | `"1000Mi"` | Memory limit. | -| scim.resources.requests.cpu | string | `"1000m"` | CPU request. | -| scim.resources.requests.memory | string | `"1000Mi"` | Memory request. | -| scim.service.name | string | `"http-scim"` | The name of the scim port within the scim service. Please keep it as default. | -| scim.service.port | int | `8080` | Port of the scim service. Please keep it as default. | -| scim.topologySpreadConstraints | object | `{}` | Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ | -| scim.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| scim.usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| scim.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| scim.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| scim.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/gluu/gluu/app-readme.md b/charts/gluu/gluu/app-readme.md deleted file mode 100644 index 84d58ba8c..000000000 --- a/charts/gluu/gluu/app-readme.md +++ /dev/null @@ -1,35 +0,0 @@ -## Introduction -The Gluu Server is a container distribution of free open source software (FOSS) for identity and access management (IAM). SaaS, custom, open source and commercial web and mobile applications can leverage a Gluu Server for user authentication, identity information, and policy decisions. - -Common use cases include: - -- Single sign-on (SSO) -- Mobile authentication -- API access management -- Two-factor authentication (2FA) -- Customer identity and access management (CIAM) -- Identity federation - -### Free Open Source Software -The Gluu Server is a FOSS platform for IAM. - -### Open Web Standards -The Gluu Server can be deployed to support the following open standards for authentication, authorization, federated identity, and identity management: - -- OAuth 2.0 -- OpenID Connect -- User Managed Access 2.0 (UMA) -- SAML 2.0 -- System for Cross-domain Identity Management (SCIM) -- FIDO Universal 2nd Factor (U2F) -- FIDO 2.0 / WebAuthn -- Lightweight Directory Access Protocol (LDAP) -- Remote Authentication Dial-In User Service (RADIUS) - -### Important notes for installation: -- Make sure to enable `Customize Helm options before install` after clicking the initial `Install` on the top right. When you view your helm options, please uncheck the wait parameter as that conflicts with the post-install hook for the persistence image. - -### Quick install on Rancher UI with Docker single node -- Install the nginx-ingress-controller chart. -- Install the OpenEBS chart. -- Install Gluu chart and specify your persistence as ldap. \ No newline at end of file diff --git a/charts/gluu/gluu/charts/admin-ui/.helmignore b/charts/gluu/gluu/charts/admin-ui/.helmignore deleted file mode 100644 index f0c131944..000000000 --- a/charts/gluu/gluu/charts/admin-ui/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/charts/gluu/gluu/charts/admin-ui/Chart.yaml b/charts/gluu/gluu/charts/admin-ui/Chart.yaml deleted file mode 100644 index 1cea033a9..000000000 --- a/charts/gluu/gluu/charts/admin-ui/Chart.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: v2 -appVersion: 5.0.0 -description: Admin GUI. Requires license. -home: https://gluu.org/docs/gluu-server -icon: https://gluu.org/docs/gluu-server/favicon.ico -keywords: -- Authorization -- OpenID -- GUI -kubeVersion: '>=v1.21.0-0' -maintainers: -- email: support@gluu.org - name: Mohammad Abudayyeh - url: https://github.com/moabu -name: admin-ui -sources: -- https://github.com/GluuFederation/docker-gluu-admin-ui -- https://github.com/GluuFederation/flex/tree/main/flex-cn-setup/pygluu/kubernetes/templates/helm/gluu/charts/admin-ui -type: application -version: 5.0.10 diff --git a/charts/gluu/gluu/charts/admin-ui/README.md b/charts/gluu/gluu/charts/admin-ui/README.md deleted file mode 100644 index 49e0317b5..000000000 --- a/charts/gluu/gluu/charts/admin-ui/README.md +++ /dev/null @@ -1,58 +0,0 @@ -# admin-ui - -![Version: 5.0.10](https://img.shields.io/badge/Version-5.0.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0](https://img.shields.io/badge/AppVersion-5.0.0-informational?style=flat-square) - -Admin GUI. Requires license. - -**Homepage:** - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| Mohammad Abudayyeh | | | - -## Source Code - -* -* - -## Requirements - -Kubernetes: `>=v1.21.0-0` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| additionalAnnotations | object | `{}` | Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken | -| additionalLabels | object | `{}` | Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} | -| dnsConfig | object | `{}` | Add custom dns config | -| dnsPolicy | string | `""` | Add custom dns policy | -| hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| hpa.behavior | object | `{}` | Scaling Policies | -| hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| image.pullSecrets | list | `[]` | Image Pull Secrets | -| image.repository | string | `"gluufederation/admin-ui"` | Image to use for deploying. | -| image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| livenessProbe | object | `{"failureThreshold":20,"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":8080},"timeoutSeconds":5}` | Configure the liveness healthcheck for the admin ui if needed. | -| readinessProbe | object | `{"failureThreshold":20,"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":8080},"timeoutSeconds":5}` | Configure the readiness healthcheck for the admin ui if needed. | -| replicas | int | `1` | Service replica number. | -| resources | object | `{"limits":{"cpu":"2500m","memory":"2500Mi"},"requests":{"cpu":"2500m","memory":"2500Mi"}}` | Resource specs. | -| resources.limits.cpu | string | `"2500m"` | CPU limit. | -| resources.limits.memory | string | `"2500Mi"` | Memory limit. | -| resources.requests.cpu | string | `"2500m"` | CPU request. | -| resources.requests.memory | string | `"2500Mi"` | Memory request. | -| service.name | string | `"http-admin-ui"` | The name of the admin ui port within the admin service. Please keep it as default. | -| service.port | int | `8080` | Port of the admin ui service. Please keep it as default. | -| service.sessionAffinity | string | `"None"` | Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP | -| service.sessionAffinityConfig | object | `{"clientIP":{"timeoutSeconds":10800}}` | the maximum session sticky time if sessionAffinity is ClientIP | -| usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| volumes | list | `[]` | | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/gluu/gluu/charts/admin-ui/templates/_helpers.tpl b/charts/gluu/gluu/charts/admin-ui/templates/_helpers.tpl deleted file mode 100644 index 3fa0c5985..000000000 --- a/charts/gluu/gluu/charts/admin-ui/templates/_helpers.tpl +++ /dev/null @@ -1,98 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "admin-ui.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "admin-ui.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "admin-ui.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* - Common labels -*/}} -{{- define "admin-ui.labels" -}} -app: {{ .Release.Name }}-{{ include "admin-ui.name" . }} -helm.sh/chart: {{ include "admin-ui.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Create user custom defined envs -*/}} -{{- define "admin-ui.usr-envs"}} -{{- range $key, $val := .Values.usrEnvs.normal }} -- name: {{ $key }} - value: {{ $val | quote }} -{{- end }} -{{- end }} - -{{/* -Create user custom defined secret envs -*/}} -{{- define "admin-ui.usr-secret-envs"}} -{{- range $key, $val := .Values.usrEnvs.secret }} -- name: {{ $key }} - valueFrom: - secretKeyRef: - name: {{ $.Release.Name }}-{{ $.Chart.Name }}-user-custom-envs - key: {{ $key | quote }} -{{- end }} -{{- end }} - -{{/* -Create topologySpreadConstraints lists -*/}} -{{- define "admin-ui.topology-spread-constraints"}} -{{- range $key, $val := .Values.topologySpreadConstraints }} -- maxSkew: {{ $val.maxSkew }} - {{- if $val.minDomains }} - minDomains: {{ $val.minDomains }} # optional; beta since v1.25 - {{- end}} - {{- if $val.topologyKey }} - topologyKey: {{ $val.topologyKey }} - {{- end}} - {{- if $val.whenUnsatisfiable }} - whenUnsatisfiable: {{ $val.whenUnsatisfiable }} - {{- end}} - labelSelector: - matchLabels: - app: {{ $.Release.Name }}-{{ include "admin-ui.name" $ }} - {{- if $val.matchLabelKeys }} - matchLabelKeys: {{ $val.matchLabelKeys }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeAffinityPolicy }} - nodeAffinityPolicy: {{ $val.nodeAffinityPolicy }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeTaintsPolicy }} - nodeTaintsPolicy: {{ $val.nodeTaintsPolicy }} # optional; alpha since v1.25 - {{- end}} -{{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/admin-ui/templates/admin-ui-destination-rules.yaml b/charts/gluu/gluu/charts/admin-ui/templates/admin-ui-destination-rules.yaml deleted file mode 100644 index ecf4699b2..000000000 --- a/charts/gluu/gluu/charts/admin-ui/templates/admin-ui-destination-rules.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- if .Values.global.istio.enabled }} -apiVersion: networking.istio.io/v1alpha3 -kind: DestinationRule -metadata: - name: {{ .Release.Name }}-admin-ui-mtls - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: admin-ui -{{ include "admin-ui.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - host: {{ index .Values "global" "admin-ui" "adminUiServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local - trafficPolicy: - tls: - mode: ISTIO_MUTUAL -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/admin-ui/templates/admin-ui-pdb.yaml b/charts/gluu/gluu/charts/admin-ui/templates/admin-ui-pdb.yaml deleted file mode 100644 index 5d81cf14b..000000000 --- a/charts/gluu/gluu/charts/admin-ui/templates/admin-ui-pdb.yaml +++ /dev/null @@ -1,11 +0,0 @@ -{{ if .Values.pdb.enabled -}} -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ include "admin-ui.fullname" . }} -spec: - maxUnavailable: {{ .Values.pdb.maxUnavailable }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "admin-ui.name" . }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/admin-ui/templates/admin-ui-virtual-services.yaml b/charts/gluu/gluu/charts/admin-ui/templates/admin-ui-virtual-services.yaml deleted file mode 100644 index 2b0fc58df..000000000 --- a/charts/gluu/gluu/charts/admin-ui/templates/admin-ui-virtual-services.yaml +++ /dev/null @@ -1,37 +0,0 @@ -{{- if and (.Values.global.istio.ingress) (index .Values "global" "admin-ui" "ingress" "adminUiEnabled") }} -apiVersion: networking.istio.io/v1alpha3 -kind: VirtualService -metadata: - name: {{ .Release.Name }}-istio-admin-ui - namespace: {{.Release.Namespace}} - labels: - APP_NAME: admin-ui -{{ include "admin-ui.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - hosts: - - {{ .Values.global.fqdn }} -{{- if .Values.global.istio.gateways }} - gateways: -{{ toYaml .Values.global.istio.gateways | indent 2 }} -{{- else }} - gateways: - - {{ .Release.Name }}-global-gtw -{{- end }} - http: - - name: "{{ .Release.Name }}-istio-cn" - match: - - uri: - prefix: "/admin" - route: - - destination: - host: {{ index .Values "global" "admin-ui" "adminUiServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local - port: - number: 8080 -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/admin-ui/templates/deployment.yml b/charts/gluu/gluu/charts/admin-ui/templates/deployment.yml deleted file mode 100644 index 2503bee46..000000000 --- a/charts/gluu/gluu/charts/admin-ui/templates/deployment.yml +++ /dev/null @@ -1,167 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "admin-ui.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: admin-ui -{{ include "admin-ui.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - replicas: {{ .Values.replicas }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "admin-ui.name" . }} - template: - metadata: - labels: - APP_NAME: admin-ui - app: {{ .Release.Name }}-{{ include "admin-ui.name" . }} - {{- if .Values.global.istio.ingress }} - annotations: - sidecar.istio.io/rewriteAppHTTPProbers: "true" - {{- end }} - spec: - {{- with .Values.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - dnsPolicy: {{ .Values.dnsPolicy | quote }} - {{- with .Values.dnsConfig }} - dnsConfig: -{{ toYaml . | indent 8 }} - {{- end }} - {{- if .Values.topologySpreadConstraints }} - topologySpreadConstraints: - {{- include "admin-ui.topology-spread-constraints" . | indent 8 }} - {{- end }} - containers: - - name: {{ include "admin-ui.name" . }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} - env: - {{- include "admin-ui.usr-envs" . | indent 12 }} - {{- include "admin-ui.usr-secret-envs" . | indent 12 }} - securityContext: - runAsUser: 1000 - runAsNonRoot: true - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - command: - - /bin/sh - - -c - - | - /usr/bin/python3 /scripts/updatelbip.py & - /app/scripts/entrypoint.sh - {{- end}} - ports: - - name: {{ .Values.service.name }} - containerPort: {{ .Values.service.port }} - envFrom: - - configMapRef: - name: {{ .Release.Name }}-config-cm - {{ if .Values.global.usrEnvs.secret }} - - secretRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - {{ if .Values.global.usrEnvs.normal }} - - configMapRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - volumeMounts: - {{- with .Values.volumeMounts }} -{{- toYaml . | nindent 10 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }} - name: aws-shared-credential-file - subPath: aws_shared_credential_file - - mountPath: {{ .Values.global.cnAwsConfigFile }} - name: aws-config-file - subPath: aws_config_file - - mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }} - name: aws-secrets-replica-regions - subPath: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - mountPath: {{ .Values.global.cnGoogleApplicationCredentials }} - name: google-sa - subPath: google-credentials.json - {{- end }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "admin-ui.fullname" .}}-updatelbip - mountPath: "/scripts" - {{- end }} - - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - mountPath: "/etc/certs/couchbase.crt" - subPath: couchbase.crt - {{- end }} - {{- end }} - livenessProbe: -{{- toYaml .Values.livenessProbe | nindent 10 }} - readinessProbe: -{{- toYaml .Values.readinessProbe | nindent 10 }} - {{- if and ( .Values.global.opendj.enabled ) (or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath")) }} - resources: {} - {{- else if .Values.global.cloud.testEnviroment }} - resources: {} - {{- else }} - resources: -{{- toYaml .Values.resources | nindent 10 }} - {{- end }} - {{- if not .Values.global.isFqdnRegistered }} - hostAliases: - - ip: {{ .Values.global.lbIp }} - hostnames: - - {{ .Values.global.fqdn }} - {{- end }} - volumes: - {{- with .Values.volumes }} -{{- toYaml . | nindent 8 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - name: aws-shared-credential-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_shared_credential_file - path: aws_shared_credential_file - - name: aws-config-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_config_file - path: aws_config_file - - name: aws-secrets-replica-regions - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_secrets_replica_regions - path: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - name: google-sa - secret: - secretName: {{ .Release.Name }}-google-sa - {{- end }} - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - secret: - secretName: {{ .Release.Name }}-cb-crt - {{- end }} - {{- end }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "admin-ui.fullname" . }}-updatelbip - configMap: - name: {{ .Release.Name }}-updatelbip - {{- end }} - \ No newline at end of file diff --git a/charts/gluu/gluu/charts/admin-ui/templates/hpa.yaml b/charts/gluu/gluu/charts/admin-ui/templates/hpa.yaml deleted file mode 100644 index 4720b2c49..000000000 --- a/charts/gluu/gluu/charts/admin-ui/templates/hpa.yaml +++ /dev/null @@ -1,37 +0,0 @@ -{{ if .Values.hpa.enabled -}} -apiVersion: autoscaling/v1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "admin-ui.fullname" . }} - labels: - APP_NAME: admin-ui -{{ include "admin-ui.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "admin-ui.fullname" . }} - minReplicas: {{ .Values.hpa.minReplicas }} - maxReplicas: {{ .Values.hpa.maxReplicas }} - {{- if .Values.hpa.targetCPUUtilizationPercentage }} - targetCPUUtilizationPercentage: {{ .Values.hpa.targetCPUUtilizationPercentage }} - {{- else if .Values.hpa.metrics }} - metrics: - {{- with .Values.hpa.metrics }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} - {{- if .Values.hpa.behavior }} - behavior: - {{- with .Values.hpa.behavior }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/admin-ui/templates/service.yml b/charts/gluu/gluu/charts/admin-ui/templates/service.yml deleted file mode 100644 index 54b311c2e..000000000 --- a/charts/gluu/gluu/charts/admin-ui/templates/service.yml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ index .Values "global" "admin-ui" "adminUiServiceName" }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: admin-ui -{{ include "admin-ui.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - {{- if .Values.global.alb.ingress }} - type: NodePort - {{- end }} - ports: - - port: {{ .Values.service.port }} - name: {{ .Values.service.name }} - selector: - app: {{ .Release.Name }}-{{ include "admin-ui.name" . }} #admin-ui - sessionAffinity: {{ .Values.service.sessionAffinity }} - {{- with .Values.service.sessionAffinityConfig }} - sessionAffinityConfig: -{{ toYaml . | indent 4 }} - {{- end }} diff --git a/charts/gluu/gluu/charts/admin-ui/templates/user-custom-secret-envs.yaml b/charts/gluu/gluu/charts/admin-ui/templates/user-custom-secret-envs.yaml deleted file mode 100644 index 02fd969b7..000000000 --- a/charts/gluu/gluu/charts/admin-ui/templates/user-custom-secret-envs.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{ if .Values.usrEnvs.secret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-{{ .Chart.Name }}-user-custom-envs - labels: - APP_NAME: admin-ui -{{ include "admin-ui.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -data: - {{- range $key, $val := .Values.usrEnvs.secret }} - {{ $key }}: {{ $val | b64enc }} - {{- end}} -{{- end}} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/admin-ui/values.yaml b/charts/gluu/gluu/charts/admin-ui/values.yaml deleted file mode 100644 index a52b003e0..000000000 --- a/charts/gluu/gluu/charts/admin-ui/values.yaml +++ /dev/null @@ -1,81 +0,0 @@ -# -- Admin GUI. Requires license. -# -- Configure the HorizontalPodAutoscaler -hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} -# -- Add custom normal and secret envs to the service -usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} -# -- Add custom dns policy -dnsPolicy: "" -# -- Add custom dns config -dnsConfig: {} -image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: gluufederation/admin-ui - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] -# -- Service replica number. -replicas: 1 -# -- Resource specs. -resources: - limits: - # -- CPU limit. - cpu: 2500m - # -- Memory limit. - memory: 2500Mi - requests: - # -- CPU request. - cpu: 2500m - # -- Memory request. - memory: 2500Mi -service: - # -- The name of the admin ui port within the admin service. Please keep it as default. - name: http-admin-ui - # -- Port of the admin ui service. Please keep it as default. - port: 8080 - # -- Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP - sessionAffinity: None - # -- the maximum session sticky time if sessionAffinity is ClientIP - sessionAffinityConfig: - clientIP: - timeoutSeconds: 10800 -# -- Configure the liveness healthcheck for the admin ui if needed. -livenessProbe: - tcpSocket: - port: 8080 - initialDelaySeconds: 60 - timeoutSeconds: 5 - periodSeconds: 25 - failureThreshold: 20 -# -- Configure the readiness healthcheck for the admin ui if needed. -readinessProbe: - tcpSocket: - port: 8080 - initialDelaySeconds: 60 - timeoutSeconds: 5 - periodSeconds: 25 - failureThreshold: 20 -volumes: [] -# -- Configure any additional volumesMounts that need to be attached to the containers -volumeMounts: [] - -# -- Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} -additionalLabels: { } -# -- Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken -additionalAnnotations: { } diff --git a/charts/gluu/gluu/charts/auth-server-key-rotation/.helmignore b/charts/gluu/gluu/charts/auth-server-key-rotation/.helmignore deleted file mode 100644 index f0c131944..000000000 --- a/charts/gluu/gluu/charts/auth-server-key-rotation/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/charts/gluu/gluu/charts/auth-server-key-rotation/Chart.yaml b/charts/gluu/gluu/charts/auth-server-key-rotation/Chart.yaml deleted file mode 100644 index 08a5305c6..000000000 --- a/charts/gluu/gluu/charts/auth-server-key-rotation/Chart.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: v2 -appVersion: 5.0.0 -description: Responsible for regenerating auth-keys per x hours -home: https://gluu.org/docs/gluu-server -icon: https://gluu.org/docs/gluu-server/favicon.ico -keywords: -- Auth keys Rotation -kubeVersion: '>=v1.21.0-0' -maintainers: -- email: support@gluu.org - name: Mohammad Abudayyeh - url: https://github.com/moabu -name: auth-server-key-rotation -sources: -- https://github.com/JanssenProject/docker-jans-certmanager -- https://github.com/GluuFederation/flex/tree/main/flex-cn-setup/pygluu/kubernetes/templates/helm/gluu/charts/auth-server-key-rotation -type: application -version: 5.0.10 diff --git a/charts/gluu/gluu/charts/auth-server-key-rotation/README.md b/charts/gluu/gluu/charts/auth-server-key-rotation/README.md deleted file mode 100644 index a6ee79d31..000000000 --- a/charts/gluu/gluu/charts/auth-server-key-rotation/README.md +++ /dev/null @@ -1,48 +0,0 @@ -# auth-server-key-rotation - -![Version: 5.0.10](https://img.shields.io/badge/Version-5.0.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0](https://img.shields.io/badge/AppVersion-5.0.0-informational?style=flat-square) - -Responsible for regenerating auth-keys per x hours - -**Homepage:** - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| Mohammad Abudayyeh | | | - -## Source Code - -* -* - -## Requirements - -Kubernetes: `>=v1.21.0-0` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| additionalAnnotations | object | `{}` | Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken | -| additionalLabels | object | `{}` | Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} | -| affinity | object | `{}` | | -| dnsConfig | object | `{}` | Add custom dns config | -| dnsPolicy | string | `""` | Add custom dns policy | -| image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| image.pullSecrets | list | `[]` | Image Pull Secrets | -| image.repository | string | `"janssenproject/certmanager"` | Image to use for deploying. | -| image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| keysLife | int | `48` | Auth server key rotation keys life in hours | -| nodeSelector | object | `{}` | | -| resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. | -| tolerations | list | `[]` | | -| usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/gluu/gluu/charts/auth-server-key-rotation/templates/_helpers.tpl b/charts/gluu/gluu/charts/auth-server-key-rotation/templates/_helpers.tpl deleted file mode 100644 index e76631f29..000000000 --- a/charts/gluu/gluu/charts/auth-server-key-rotation/templates/_helpers.tpl +++ /dev/null @@ -1,68 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "auth-server-key-rotation.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "auth-server-key-rotation.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "auth-server-key-rotation.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* - Common labels -*/}} -{{- define "auth-server-key-rotation.labels" -}} -app: {{ .Release.Name }}-{{ include "auth-server-key-rotation.name" . }} -helm.sh/chart: {{ include "auth-server-key-rotation.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Create user custom defined envs -*/}} -{{- define "auth-server-key-rotation.usr-envs"}} -{{- range $key, $val := .Values.usrEnvs.normal }} -- name: {{ $key }} - value: {{ $val | quote }} -{{- end }} -{{- end }} - -{{/* -Create user custom defined secret envs -*/}} -{{- define "auth-server-key-rotation.usr-secret-envs"}} -{{- range $key, $val := .Values.usrEnvs.secret }} -- name: {{ $key }} - valueFrom: - secretKeyRef: - name: {{ $.Release.Name }}-{{ $.Chart.Name }}-user-custom-envs - key: {{ $key | quote }} -{{- end }} -{{- end }} diff --git a/charts/gluu/gluu/charts/auth-server-key-rotation/templates/cronjobs.yaml b/charts/gluu/gluu/charts/auth-server-key-rotation/templates/cronjobs.yaml deleted file mode 100644 index 3736a8d2c..000000000 --- a/charts/gluu/gluu/charts/auth-server-key-rotation/templates/cronjobs.yaml +++ /dev/null @@ -1,127 +0,0 @@ -kind: CronJob -apiVersion: batch/v1 -metadata: - name: {{ include "auth-server-key-rotation.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: auth-server-key-rotation - release: {{ .Release.Name }} -{{ include "auth-server-key-rotation.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - schedule: "0 */{{ .Values.keysLife }} * * *" - concurrencyPolicy: Forbid - jobTemplate: - spec: - template: - metadata: - annotations: - sidecar.istio.io/inject: "false" - spec: - {{- with .Values.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - dnsPolicy: {{ .Values.dnsPolicy | quote }} - {{- with .Values.dnsConfig }} - dnsConfig: -{{ toYaml . | indent 12 }} - {{- end }} - containers: - - name: {{ include "auth-server-key-rotation.name" . }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - env: - {{- include "auth-server-key-rotation.usr-envs" . | indent 16 }} - {{- include "auth-server-key-rotation.usr-secret-envs" . | indent 16 }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - volumeMounts: - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }} - name: aws-shared-credential-file - subPath: aws_shared_credential_file - - mountPath: {{ .Values.global.cnAwsConfigFile }} - name: aws-config-file - subPath: aws_config_file - - mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }} - name: aws-secrets-replica-regions - subPath: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - mountPath: {{ .Values.global.cnGoogleApplicationCredentials }} - name: google-sa - subPath: google-credentials.json - {{- end }} - {{- with .Values.volumeMounts }} -{{- toYaml . | nindent 16 }} - {{- end }} - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - mountPath: "/etc/certs/couchbase.crt" - subPath: couchbase.crt - {{- end }} - {{- end }} - envFrom: - - configMapRef: - name: {{ .Release.Name }}-config-cm - {{ if .Values.global.usrEnvs.secret }} - - secretRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - {{ if .Values.global.usrEnvs.normal }} - - configMapRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - {{- if and ( .Values.global.opendj.enabled ) (or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath")) }} - resources: {} - {{- else if .Values.global.cloud.testEnviroment }} - resources: {} - {{- else }} - resources: -{{- toYaml .Values.resources | nindent 16 }} - {{- end }} - args: ["patch", "auth", "--opts", "interval:{{ .Values.keysLife }}"] - volumes: - {{- with .Values.volumes }} -{{- toYaml . | nindent 12 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - name: aws-shared-credential-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_shared_credential_file - path: aws_shared_credential_file - - name: aws-config-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_config_file - path: aws_config_file - - name: aws-secrets-replica-regions - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_secrets_replica_regions - path: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - name: google-sa - secret: - secretName: {{ .Release.Name }}-google-sa - {{- end }} - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - secret: - secretName: {{ .Release.Name }}-cb-crt - {{- end }} - {{- end }} - restartPolicy: Never - diff --git a/charts/gluu/gluu/charts/auth-server-key-rotation/templates/service.yaml b/charts/gluu/gluu/charts/auth-server-key-rotation/templates/service.yaml deleted file mode 100644 index 4b1f6ff07..000000000 --- a/charts/gluu/gluu/charts/auth-server-key-rotation/templates/service.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if .Values.global.istio.enabled }} -# License terms and conditions: -# https://www.apache.org/licenses/LICENSE-2.0 -apiVersion: v1 -kind: Service -metadata: - name: {{ include "auth-server-key-rotation.fullname" . }} - labels: -{{ include "auth-server-key-rotation.fullname" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - ports: - - name: http - port: 80 - targetPort: 8080 - selector: - app: {{ .Release.Name }}-{{ include "auth-server-key-rotation.name" . }} - type: ClusterIP -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/auth-server-key-rotation/templates/user-custom-secret-envs.yaml b/charts/gluu/gluu/charts/auth-server-key-rotation/templates/user-custom-secret-envs.yaml deleted file mode 100644 index 5ed268ebb..000000000 --- a/charts/gluu/gluu/charts/auth-server-key-rotation/templates/user-custom-secret-envs.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{ if .Values.usrEnvs.secret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-{{ .Chart.Name }}-user-custom-envs - labels: -{{ include "auth-server-key-rotation.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -data: - {{- range $key, $val := .Values.usrEnvs.secret }} - {{ $key }}: {{ $val | b64enc }} - {{- end}} -{{- end}} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/auth-server-key-rotation/values.yaml b/charts/gluu/gluu/charts/auth-server-key-rotation/values.yaml deleted file mode 100644 index 1e682e1cb..000000000 --- a/charts/gluu/gluu/charts/auth-server-key-rotation/values.yaml +++ /dev/null @@ -1,48 +0,0 @@ - -# -- Responsible for regenerating auth-keys per x hours -# -- Add custom normal and secret envs to the service -usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} -# -- Add custom dns policy -dnsPolicy: "" -# -- Add custom dns config -dnsConfig: {} -image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: janssenproject/certmanager - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] -# -- Auth server key rotation keys life in hours -keysLife: 48 -# -- Resource specs. -resources: - limits: - cpu: 300m - memory: 300Mi - requests: - cpu: 300m - memory: 300Mi -# -- Configure any additional volumes that need to be attached to the pod -volumes: [] -# -- Configure any additional volumesMounts that need to be attached to the containers -volumeMounts: [] - -nodeSelector: {} - -tolerations: [] - -affinity: {} - -# -- Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} -additionalLabels: { } -# -- Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken -additionalAnnotations: { } \ No newline at end of file diff --git a/charts/gluu/gluu/charts/auth-server/.helmignore b/charts/gluu/gluu/charts/auth-server/.helmignore deleted file mode 100644 index f0c131944..000000000 --- a/charts/gluu/gluu/charts/auth-server/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/charts/gluu/gluu/charts/auth-server/Chart.yaml b/charts/gluu/gluu/charts/auth-server/Chart.yaml deleted file mode 100644 index 4807573e5..000000000 --- a/charts/gluu/gluu/charts/auth-server/Chart.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: v2 -appVersion: 5.0.0 -description: OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization - Server--this is the main Internet facing component of Gluu. It's the service that - returns tokens, JWT's and identity assertions. This service must be Internet facing. -home: https://gluu.org/docs/gluu-server -icon: https://gluu.org/docs/gluu-server/favicon.ico -keywords: -- Autherization -- OpenID -kubeVersion: '>=v1.21.0-0' -maintainers: -- email: support@gluu.org - name: Mohammad Abudayyeh - url: https://github.com/moabu -name: auth-server -sources: -- https://github.com/JanssenProject/jans-auth-server -- https://github.com/JanssenProject/docker-jans-auth-server -- https://github.com/GluuFederation/flex/tree/main/flex-cn-setup/pygluu/kubernetes/templates/helm/gluu/charts/auth-server -type: application -version: 5.0.10 diff --git a/charts/gluu/gluu/charts/auth-server/README.md b/charts/gluu/gluu/charts/auth-server/README.md deleted file mode 100644 index d0060dcae..000000000 --- a/charts/gluu/gluu/charts/auth-server/README.md +++ /dev/null @@ -1,60 +0,0 @@ -# auth-server - -![Version: 5.0.10](https://img.shields.io/badge/Version-5.0.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0](https://img.shields.io/badge/AppVersion-5.0.0-informational?style=flat-square) - -OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Gluu. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing. - -**Homepage:** - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| Mohammad Abudayyeh | | | - -## Source Code - -* -* -* - -## Requirements - -Kubernetes: `>=v1.21.0-0` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| additionalAnnotations | object | `{}` | Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken | -| additionalLabels | object | `{}` | Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} | -| dnsConfig | object | `{}` | Add custom dns config | -| dnsPolicy | string | `""` | Add custom dns policy | -| hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| hpa.behavior | object | `{}` | Scaling Policies | -| hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| image.pullSecrets | list | `[]` | Image Pull Secrets | -| image.repository | string | `"janssenproject/auth-server"` | Image to use for deploying. | -| image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| livenessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. | -| livenessProbe.exec | object | `{"command":["python3","/app/scripts/healthcheck.py"]}` | Executes the python3 healthcheck. https://github.com/GluuFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py | -| readinessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the auth server if needed. https://github.com/GluuFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py | -| replicas | int | `1` | Service replica number. | -| resources | object | `{"limits":{"cpu":"2500m","memory":"2500Mi"},"requests":{"cpu":"2500m","memory":"2500Mi"}}` | Resource specs. | -| resources.limits.cpu | string | `"2500m"` | CPU limit. | -| resources.limits.memory | string | `"2500Mi"` | Memory limit. | -| resources.requests.cpu | string | `"2500m"` | CPU request. | -| resources.requests.memory | string | `"2500Mi"` | Memory request. | -| service.name | string | `"http-auth"` | The name of the oxauth port within the oxauth service. Please keep it as default. | -| service.port | int | `8080` | Port of the oxauth service. Please keep it as default. | -| service.sessionAffinity | string | `"None"` | Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP | -| service.sessionAffinityConfig | object | `{"clientIP":{"timeoutSeconds":10800}}` | the maximum session sticky time if sessionAffinity is ClientIP | -| usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| volumes | list | `[]` | | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/gluu/gluu/charts/auth-server/templates/_helpers.tpl b/charts/gluu/gluu/charts/auth-server/templates/_helpers.tpl deleted file mode 100644 index 2712f9870..000000000 --- a/charts/gluu/gluu/charts/auth-server/templates/_helpers.tpl +++ /dev/null @@ -1,98 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "auth-server.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "auth-server.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "auth-server.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* - Common labels -*/}} -{{- define "auth-server.labels" -}} -app: {{ .Release.Name }}-{{ include "auth-server.name" . }} -helm.sh/chart: {{ include "auth-server.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Create user custom defined envs -*/}} -{{- define "auth-server.usr-envs"}} -{{- range $key, $val := .Values.usrEnvs.normal }} -- name: {{ $key }} - value: {{ $val | quote }} -{{- end }} -{{- end }} - -{{/* -Create user custom defined secret envs -*/}} -{{- define "auth-server.usr-secret-envs"}} -{{- range $key, $val := .Values.usrEnvs.secret }} -- name: {{ $key }} - valueFrom: - secretKeyRef: - name: {{ $.Release.Name }}-{{ $.Chart.Name }}-user-custom-envs - key: {{ $key | quote }} -{{- end }} -{{- end }} - -{{/* -Create topologySpreadConstraints lists -*/}} -{{- define "auth-server.topology-spread-constraints"}} -{{- range $key, $val := .Values.topologySpreadConstraints }} -- maxSkew: {{ $val.maxSkew }} - {{- if $val.minDomains }} - minDomains: {{ $val.minDomains }} # optional; beta since v1.25 - {{- end}} - {{- if $val.topologyKey }} - topologyKey: {{ $val.topologyKey }} - {{- end}} - {{- if $val.whenUnsatisfiable }} - whenUnsatisfiable: {{ $val.whenUnsatisfiable }} - {{- end}} - labelSelector: - matchLabels: - app: {{ $.Release.Name }}-{{ include "auth-server.name" $ }} - {{- if $val.matchLabelKeys }} - matchLabelKeys: {{ $val.matchLabelKeys }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeAffinityPolicy }} - nodeAffinityPolicy: {{ $val.nodeAffinityPolicy }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeTaintsPolicy }} - nodeTaintsPolicy: {{ $val.nodeTaintsPolicy }} # optional; alpha since v1.25 - {{- end}} -{{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/auth-server/templates/auth-server-destination-rules.yaml b/charts/gluu/gluu/charts/auth-server/templates/auth-server-destination-rules.yaml deleted file mode 100644 index 708ce616c..000000000 --- a/charts/gluu/gluu/charts/auth-server/templates/auth-server-destination-rules.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- if .Values.global.istio.enabled }} -apiVersion: networking.istio.io/v1alpha3 -kind: DestinationRule -metadata: - name: {{ .Release.Name }}-auth-server-mtls - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: auth-server -{{ include "auth-server.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local - trafficPolicy: - tls: - mode: ISTIO_MUTUAL -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/auth-server/templates/auth-server-pdb.yaml b/charts/gluu/gluu/charts/auth-server/templates/auth-server-pdb.yaml deleted file mode 100644 index 5ca61a625..000000000 --- a/charts/gluu/gluu/charts/auth-server/templates/auth-server-pdb.yaml +++ /dev/null @@ -1,11 +0,0 @@ -{{ if .Values.pdb.enabled -}} -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ include "auth-server.fullname" . }} -spec: - maxUnavailable: {{ .Values.pdb.maxUnavailable }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "auth-server.name" . }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/auth-server/templates/auth-server-protected-virtual-services.yaml b/charts/gluu/gluu/charts/auth-server/templates/auth-server-protected-virtual-services.yaml deleted file mode 100644 index 522f6757b..000000000 --- a/charts/gluu/gluu/charts/auth-server/templates/auth-server-protected-virtual-services.yaml +++ /dev/null @@ -1,53 +0,0 @@ -{{- if .Values.global.istio.ingress }} -# NEEDS WORK TO ALLOW CLIENT SIDE AUTHENTICATION. THIS IS MERELY A PLACEHOLDER -apiVersion: networking.istio.io/v1alpha3 -kind: VirtualService -metadata: - name: {{ .Release.Name }}-istio-auth-server-protected-endpoints - namespace: {{.Release.Namespace}} - labels: - APP_NAME: auth-server -{{ include "auth-server.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - hosts: - - {{ .Values.global.fqdn }} -{{- if .Values.global.istio.gateways }} - gateways: -{{ toYaml .Values.global.istio.gateways | indent 2 }} -{{- else }} - gateways: - - {{ .Release.Name }}-global-gtw -{{- end }} - http: - {{ if index .Values "global" "auth-server" "ingress" "authServerProtectedToken" -}} - - name: "{{ .Release.Name }}-istio-auth-server-protected-token" - match: - - uri: - prefix: "/jans-auth/restv1/token" - route: - - destination: - host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local - port: - number: 8080 - weight: 100 - {{- end }} - {{ if index .Values "global" "auth-server" "ingress" "authServerProtectedRegister" -}} - - name: "{{ .Release.Name }}-istio-auth-server-protected-register" - match: - - uri: - prefix: "/jans-auth/restv1/register" - route: - - destination: - host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local - port: - number: 8080 - weight: 100 - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/auth-server/templates/auth-server-virtual-services.yaml b/charts/gluu/gluu/charts/auth-server/templates/auth-server-virtual-services.yaml deleted file mode 100644 index 55cc39724..000000000 --- a/charts/gluu/gluu/charts/auth-server/templates/auth-server-virtual-services.yaml +++ /dev/null @@ -1,137 +0,0 @@ -{{- if .Values.global.istio.ingress }} -apiVersion: networking.istio.io/v1alpha3 -kind: VirtualService -metadata: - name: {{ .Release.Name }}-istio-auth-server - namespace: {{.Release.Namespace}} - labels: - APP_NAME: auth-server -{{ include "auth-server.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - hosts: - - {{ .Values.global.fqdn }} -{{- if .Values.global.istio.gateways }} - gateways: -{{ toYaml .Values.global.istio.gateways | indent 2 }} -{{- else }} - gateways: - - {{ .Release.Name }}-global-gtw -{{- end }} - http: - {{ if index .Values "global" "auth-server" "ingress" "openidConfigEnabled" -}} - - name: "{{ .Release.Name }}-istio-openid-config" - match: - - uri: - prefix: "/.well-known/openid-configuration" - rewrite: - uri: "/jans-auth/.well-known/openid-configuration" - route: - - destination: - host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local - port: - number: 8080 - weight: 100 - {{- end }} - {{ if index .Values "global" "auth-server" "ingress" "deviceCodeEnabled" -}} - - name: "{{ .Release.Name }}-istio-device-code" - match: - - uri: - prefix: "/device-code" - rewrite: - uri: "/jans-auth/device_authorization.htm" - route: - - destination: - host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local - port: - number: 8080 - weight: 100 - {{- end }} - {{ if index .Values "global" "auth-server" "ingress" "firebaseMessagingEnabled" -}} - - name: "{{ .Release.Name }}-istio-firebase-messaging" - match: - - uri: - prefix: "/firebase-messaging-sw.js" - rewrite: - uri: "/jans-auth/firebase-messaging-sw.js" - route: - - destination: - host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local - port: - number: 8080 - weight: 100 - {{- end }} - {{ if index .Values "global" "auth-server" "ingress" "uma2ConfigEnabled" -}} - - name: "{{ .Release.Name }}-istio-uma2-config" - match: - - uri: - prefix: "/.well-known/uma2-configuration" - rewrite: - uri: "/jans-auth/restv1/uma2-configuration" - route: - - destination: - host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local - port: - number: 8080 - weight: 100 - {{- end }} - {{ if index .Values "global" "auth-server" "ingress" "webfingerEnabled" -}} - - name: "{{ .Release.Name }}-istio-webfinger" - match: - - uri: - prefix: "/.well-known/webfinger" - rewrite: - uri: "/jans-auth/.well-known/webfinger" - route: - - destination: - host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local - port: - number: 8080 - weight: 100 - {{- end }} - {{ if index .Values "global" "auth-server" "ingress" "webdiscoveryEnabled" -}} - - name: "{{ .Release.Name }}-istio-webdiscovery" - match: - - uri: - prefix: "/.well-known/simple-web-discovery" - rewrite: - uri: "/jans-auth/.well-known/simple-web-discovery" - route: - - destination: - host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local - port: - number: 8080 - weight: 100 - {{- end }} - {{ if index .Values "global" "auth-server" "ingress" "authServerEnabled" -}} - - name: "{{ .Release.Name }}-istio-cn" - match: - - uri: - prefix: "/jans-auth" - route: - - destination: - host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local - port: - number: 8080 - {{- end }} - {{ if index .Values "global" "auth-server" "ingress" "u2fConfigEnabled" -}} - - name: "{{ .Release.Name }}-istio-u2f-config" - match: - - uri: - prefix: "/.well-known/fido-configuration" - rewrite: - uri: "/jans-auth/restv1/fido-configuration" - route: - - destination: - host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local - port: - number: 8080 - weight: 100 - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/auth-server/templates/deployment.yml b/charts/gluu/gluu/charts/auth-server/templates/deployment.yml deleted file mode 100644 index 9318c9dc5..000000000 --- a/charts/gluu/gluu/charts/auth-server/templates/deployment.yml +++ /dev/null @@ -1,262 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "auth-server.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: auth-server -{{ include "auth-server.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - replicas: {{ .Values.replicas }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "auth-server.name" . }} - template: - metadata: - labels: - APP_NAME: auth-server - app: {{ .Release.Name }}-{{ include "auth-server.name" . }} - {{- if .Values.global.istio.ingress }} - annotations: - sidecar.istio.io/rewriteAppHTTPProbers: "true" - {{- end }} - spec: - {{- with .Values.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - dnsPolicy: {{ .Values.dnsPolicy | quote }} - {{- with .Values.dnsConfig }} - dnsConfig: -{{ toYaml . | indent 8 }} - {{- end }} - {{- if .Values.topologySpreadConstraints }} - topologySpreadConstraints: - {{- include "auth-server.topology-spread-constraints" . | indent 8 }} - {{- end }} - containers: - - name: {{ include "auth-server.name" . }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} - env: - {{- include "auth-server.usr-envs" . | indent 12 }} - {{- include "auth-server.usr-secret-envs" . | indent 12 }} - securityContext: - runAsUser: 1000 - runAsNonRoot: true - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - command: - - /bin/sh - - -c - - | - /usr/bin/python3 /scripts/updatelbip.py & - /app/scripts/entrypoint.sh - {{- end}} - ports: - - name: {{ .Values.service.name }} - containerPort: {{ .Values.service.port }} - {{ if .Values.global.cnPrometheusPort }} - - name: prometheus-port - containerPort: {{ .Values.global.cnPrometheusPort }} - {{- end }} - envFrom: - - configMapRef: - name: {{ .Release.Name }}-config-cm - {{ if .Values.global.usrEnvs.secret }} - - secretRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - {{ if .Values.global.usrEnvs.normal }} - - configMapRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - volumeMounts: - {{- with .Values.volumeMounts }} -{{- toYaml . | nindent 10 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }} - name: aws-shared-credential-file - subPath: aws_shared_credential_file - - mountPath: {{ .Values.global.cnAwsConfigFile }} - name: aws-config-file - subPath: aws_config_file - - mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }} - name: aws-secrets-replica-regions - subPath: aws_secrets_replica_regions - {{- end }} - {{ if .Values.global.cnObExtSigningJwksKeyPassPhrase }} - - name: cn-ob-ext-signing-jwks-key-passphrase - mountPath: /etc/certs/ob-ext-signing.pin - subPath: ob-ext-signing.pin - {{- end }} - {{ if .Values.global.cnObExtSigningJwksKey }} - - name: cn-ob-ext-signing-jwks-key - mountPath: /etc/certs/ob-ext-signing.key - subPath: ob-ext-signing.key - {{- end }} - {{ if .Values.global.cnObExtSigningJwksCrt }} - - name: cn-ob-ext-signing-jwks-crt - mountPath: /etc/certs/ob-ext-signing.crt - subPath: ob-ext-signing.crt - {{- end }} - {{ if .Values.global.cnObTransportKeyPassPhrase }} - - name: cn-ob-transport-key-passphrase - mountPath: /etc/certs/ob-transport.pin - subPath: ob-transport.pin - {{- end }} - {{ if .Values.global.cnObTransportKey }} - - name: cn-ob-transport-key - mountPath: /etc/certs/ob-transport.key - subPath: ob-transport.key - {{- end }} - {{ if .Values.global.cnObTransportCrt }} - - name: cn-ob-transport-crt - mountPath: /etc/certs/ob-transport.crt - subPath: ob-transport.crt - {{- end }} - {{ if .Values.global.cnObTransportTrustStore }} - - name: cn-ob-transport-truststore - mountPath: /etc/certs/ob-transport-truststore.p12 - subPath: ob-transport-truststore.p12 - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - mountPath: {{ .Values.global.cnGoogleApplicationCredentials }} - name: google-sa - subPath: google-credentials.json - {{- end }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "auth-server.fullname" .}}-updatelbip - mountPath: "/scripts" - {{- end }} - - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - mountPath: "/etc/certs/couchbase.crt" - subPath: couchbase.crt - {{- end }} - {{- end }} - livenessProbe: -{{- toYaml .Values.livenessProbe | nindent 10 }} - readinessProbe: -{{- toYaml .Values.readinessProbe | nindent 10 }} - {{- if and ( .Values.global.opendj.enabled ) (or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath")) }} - resources: {} - {{- else if .Values.global.cloud.testEnviroment }} - resources: {} - {{- else }} - resources: -{{- toYaml .Values.resources | nindent 10 }} - {{- end }} - {{- if not .Values.global.isFqdnRegistered }} - hostAliases: - - ip: {{ .Values.global.lbIp }} - hostnames: - - {{ .Values.global.fqdn }} - {{- end }} - volumes: - {{- with .Values.volumes }} -{{- toYaml . | nindent 8 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - name: aws-shared-credential-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_shared_credential_file - path: aws_shared_credential_file - - name: aws-config-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_config_file - path: aws_config_file - - name: aws-secrets-replica-regions - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_secrets_replica_regions - path: aws_secrets_replica_regions - {{- end }} - {{ if .Values.global.cnObExtSigningJwksCrt }} - - name: cn-ob-ext-signing-jwks-crt - secret: - secretName: {{ .Release.Name }}-ob-ext-signing-jwks-crt-key-pin - items: - - key: ob-ext-signing.crt - path: ob-ext-signing.crt - {{- end }} - {{ if .Values.global.cnObExtSigningJwksKey }} - - name: cn-ob-ext-signing-jwks-key - secret: - secretName: {{ .Release.Name }}-ob-ext-signing-jwks-crt-key-pin - items: - - key: ob-ext-signing.key - path: ob-ext-signing.key - {{- end }} - {{ if .Values.global.cnObExtSigningJwksKeyPassPhrase }} - - name: cn-ob-ext-signing-jwks-key-passphrase - secret: - secretName: {{ .Release.Name }}-ob-ext-signing-jwks-crt-key-pin - items: - - key: ob-ext-signing.pin - path: ob-ext-signing.pin - {{- end }} - {{ if .Values.global.cnObTransportCrt }} - - name: cn-ob-transport-crt - secret: - secretName: {{ .Release.Name }}-ob-transport-crt-key-pin - items: - - key: ob-transport.crt - path: ob-transport.crt - {{- end }} - {{ if .Values.global.cnObTransportKey }} - - name: cn-ob-transport-key - secret: - secretName: {{ .Release.Name }}-ob-transport-crt-key-pin - items: - - key: ob-transport.key - path: ob-transport.key - {{- end }} - {{ if .Values.global.cnObTransportKeyPassPhrase }} - - name: cn-ob-transport-key-passphrase - secret: - secretName: {{ .Release.Name }}-ob-transport-crt-key-pin - items: - - key: ob-transport.pin - path: ob-transport.pin - {{- end }} - {{ if .Values.global.cnObTransportTrustStore }} - - name: cn-ob-transport-truststore - secret: - secretName: {{ .Release.Name }}-ob-transport-truststore - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - name: google-sa - secret: - secretName: {{ .Release.Name }}-google-sa - {{- end }} - - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - secret: - secretName: {{ .Release.Name }}-cb-crt - {{- end }} - {{- end }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "auth-server.fullname" . }}-updatelbip - configMap: - name: {{ .Release.Name }}-updatelbip - {{- end }} - \ No newline at end of file diff --git a/charts/gluu/gluu/charts/auth-server/templates/hpa.yaml b/charts/gluu/gluu/charts/auth-server/templates/hpa.yaml deleted file mode 100644 index 7a35d4338..000000000 --- a/charts/gluu/gluu/charts/auth-server/templates/hpa.yaml +++ /dev/null @@ -1,37 +0,0 @@ -{{ if .Values.hpa.enabled -}} -apiVersion: autoscaling/v1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "auth-server.fullname" . }} - labels: - APP_NAME: auth-server -{{ include "auth-server.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "auth-server.fullname" . }} - minReplicas: {{ .Values.hpa.minReplicas }} - maxReplicas: {{ .Values.hpa.maxReplicas }} - {{- if .Values.hpa.targetCPUUtilizationPercentage }} - targetCPUUtilizationPercentage: {{ .Values.hpa.targetCPUUtilizationPercentage }} - {{- else if .Values.hpa.metrics }} - metrics: - {{- with .Values.hpa.metrics }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} - {{- if .Values.hpa.behavior }} - behavior: - {{- with .Values.hpa.behavior }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/auth-server/templates/service.yml b/charts/gluu/gluu/charts/auth-server/templates/service.yml deleted file mode 100644 index 07b0de589..000000000 --- a/charts/gluu/gluu/charts/auth-server/templates/service.yml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ index .Values "global" "auth-server" "authServerServiceName" }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: auth-server -{{ include "auth-server.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - {{- if .Values.global.alb.ingress }} - type: NodePort - {{- end }} - ports: - - port: {{ .Values.service.port }} - name: {{ .Values.service.name }} - selector: - app: {{ .Release.Name }}-{{ include "auth-server.name" . }} #auth-server - sessionAffinity: {{ .Values.service.sessionAffinity }} - {{- with .Values.service.sessionAffinityConfig }} - sessionAffinityConfig: -{{ toYaml . | indent 4 }} - {{- end }} diff --git a/charts/gluu/gluu/charts/auth-server/templates/user-custom-secret-envs.yaml b/charts/gluu/gluu/charts/auth-server/templates/user-custom-secret-envs.yaml deleted file mode 100644 index 19b24ab92..000000000 --- a/charts/gluu/gluu/charts/auth-server/templates/user-custom-secret-envs.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{ if .Values.usrEnvs.secret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-{{ .Chart.Name }}-user-custom-envs - labels: - APP_NAME: auth-server -{{ include "auth-server.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -data: - {{- range $key, $val := .Values.usrEnvs.secret }} - {{ $key }}: {{ $val | b64enc }} - {{- end}} -{{- end}} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/auth-server/values.yaml b/charts/gluu/gluu/charts/auth-server/values.yaml deleted file mode 100644 index aed67472d..000000000 --- a/charts/gluu/gluu/charts/auth-server/values.yaml +++ /dev/null @@ -1,87 +0,0 @@ - -# -- OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Gluu. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing. -# -- Configure the HorizontalPodAutoscaler -hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} -# -- Add custom normal and secret envs to the service -usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} -# -- Add custom dns policy -dnsPolicy: "" -# -- Add custom dns config -dnsConfig: {} -image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: janssenproject/auth-server - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] -# -- Service replica number. -replicas: 1 -# -- Resource specs. -resources: - limits: - # -- CPU limit. - cpu: 2500m - # -- Memory limit. - memory: 2500Mi - requests: - # -- CPU request. - cpu: 2500m - # -- Memory request. - memory: 2500Mi -service: - # -- The name of the oxauth port within the oxauth service. Please keep it as default. - name: http-auth - # -- Port of the oxauth service. Please keep it as default. - port: 8080 - # -- Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP - sessionAffinity: None - # -- the maximum session sticky time if sessionAffinity is ClientIP - sessionAffinityConfig: - clientIP: - timeoutSeconds: 10800 -# -- Configure the liveness healthcheck for the auth server if needed. -livenessProbe: - # -- Executes the python3 healthcheck. - # https://github.com/GluuFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py - exec: - command: - - python3 - - /app/scripts/healthcheck.py - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 -# -- Configure the readiness healthcheck for the auth server if needed. -# https://github.com/GluuFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py -readinessProbe: - exec: - command: - - python3 - - /app/scripts/healthcheck.py - initialDelaySeconds: 25 - periodSeconds: 25 - timeoutSeconds: 5 -volumes: [] -# -- Configure any additional volumesMounts that need to be attached to the containers -volumeMounts: [] - -# -- Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} -additionalLabels: { } -# -- Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken -additionalAnnotations: { } diff --git a/charts/gluu/gluu/charts/casa/.helmignore b/charts/gluu/gluu/charts/casa/.helmignore deleted file mode 100644 index 50af03172..000000000 --- a/charts/gluu/gluu/charts/casa/.helmignore +++ /dev/null @@ -1,22 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/charts/gluu/gluu/charts/casa/Chart.yaml b/charts/gluu/gluu/charts/casa/Chart.yaml deleted file mode 100644 index 79af60035..000000000 --- a/charts/gluu/gluu/charts/casa/Chart.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: v2 -appVersion: 5.0.0 -description: Gluu Casa ("Casa") is a self-service web portal for end-users to manage - authentication and authorization preferences for their account in a Gluu Server. -home: https://gluu.org/docs/casa/ -icon: https://casa.gluu.org/wp-content/themes/gluucasa/casafavicon.ico -keywords: -- casa -- 2FA -- passwordless -kubeVersion: '>=v1.21.0-0' -maintainers: -- email: support@gluu.org - name: Mohammad Abudayyeh - url: https://github.com/moabu -name: casa -sources: -- https://gluu.org/docs/casa/ -- https://github.com/GluuFederation/docker-casa -- https://github.com/GluuFederation/flex/tree/main/flex-cn-setup/pygluu/kubernetes/templates/helm/gluu/charts/casa -type: application -version: 5.0.10 diff --git a/charts/gluu/gluu/charts/casa/README.md b/charts/gluu/gluu/charts/casa/README.md deleted file mode 100644 index c6fbd2bc3..000000000 --- a/charts/gluu/gluu/charts/casa/README.md +++ /dev/null @@ -1,65 +0,0 @@ -# casa - -![Version: 5.0.10](https://img.shields.io/badge/Version-5.0.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0](https://img.shields.io/badge/AppVersion-5.0.0-informational?style=flat-square) - -Gluu Casa ("Casa") is a self-service web portal for end-users to manage authentication and authorization preferences for their account in a Gluu Server. - -**Homepage:** - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| Mohammad Abudayyeh | | | - -## Source Code - -* -* -* - -## Requirements - -Kubernetes: `>=v1.21.0-0` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| additionalAnnotations | object | `{}` | Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken | -| additionalLabels | object | `{}` | Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} | -| dnsConfig | object | `{}` | Add custom dns config | -| dnsPolicy | string | `""` | Add custom dns policy | -| fullnameOverride | string | `""` | | -| hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| hpa.behavior | object | `{}` | Scaling Policies | -| hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| image.pullSecrets | list | `[]` | Image Pull Secrets | -| image.repository | string | `"gluufederation/casa"` | Image to use for deploying. | -| image.tag | string | `"5.0.0-3"` | Image tag to use for deploying. | -| livenessProbe | object | `{"httpGet":{"path":"/casa/health-check","port":"http-casa"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the liveness healthcheck for casa if needed. | -| livenessProbe.httpGet.path | string | `"/casa/health-check"` | http liveness probe endpoint | -| nameOverride | string | `""` | | -| podSecurityContext | object | `{}` | | -| readinessProbe | object | `{"httpGet":{"path":"/casa/health-check","port":"http-casa"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the readiness healthcheck for the casa if needed. | -| readinessProbe.httpGet.path | string | `"/casa/health-check"` | http readiness probe endpoint | -| replicas | int | `1` | Service replica number. | -| resources | object | `{"limits":{"cpu":"500m","memory":"500Mi"},"requests":{"cpu":"500m","memory":"500Mi"}}` | Resource specs. | -| resources.limits.cpu | string | `"500m"` | CPU limit. | -| resources.limits.memory | string | `"500Mi"` | Memory limit. | -| resources.requests.cpu | string | `"500m"` | CPU request. | -| resources.requests.memory | string | `"500Mi"` | Memory request. | -| securityContext | object | `{}` | | -| service.name | string | `"http-casa"` | The name of the casa port within the casa service. Please keep it as default. | -| service.port | int | `8080` | Port of the casa service. Please keep it as default. | -| service.sessionAffinity | string | `"None"` | Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP | -| service.sessionAffinityConfig | object | `{"clientIP":{"timeoutSeconds":10800}}` | the maximum session sticky time if sessionAffinity is ClientIP | -| usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/gluu/gluu/charts/casa/templates/_helpers.tpl b/charts/gluu/gluu/charts/casa/templates/_helpers.tpl deleted file mode 100644 index 4fc7d069e..000000000 --- a/charts/gluu/gluu/charts/casa/templates/_helpers.tpl +++ /dev/null @@ -1,109 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "casa.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "casa.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "casa.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Common labels -*/}} -{{- define "casa.labels" -}} -app: {{ .Release.Name }}-{{ include "casa.name" . }} -helm.sh/chart: {{ include "casa.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Create the name of the service account to use -*/}} -{{- define "casa.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} - {{ default (include "casa.fullname" .) .Values.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create user custom defined envs -*/}} -{{- define "casa.usr-envs"}} -{{- range $key, $val := .Values.usrEnvs.normal }} -- name: {{ $key }} - value: {{ $val | quote }} -{{- end }} -{{- end }} - -{{/* -Create user custom defined secret envs -*/}} -{{- define "casa.usr-secret-envs"}} -{{- range $key, $val := .Values.usrEnvs.secret }} -- name: {{ $key }} - valueFrom: - secretKeyRef: - name: {{ $.Release.Name }}-{{ $.Chart.Name }}-user-custom-envs - key: {{ $key | quote }} -{{- end }} -{{- end }} - -{{/* -Create topologySpreadConstraints lists -*/}} -{{- define "casa.topology-spread-constraints"}} -{{- range $key, $val := .Values.topologySpreadConstraints }} -- maxSkew: {{ $val.maxSkew }} - {{- if $val.minDomains }} - minDomains: {{ $val.minDomains }} # optional; beta since v1.25 - {{- end}} - {{- if $val.topologyKey }} - topologyKey: {{ $val.topologyKey }} - {{- end}} - {{- if $val.whenUnsatisfiable }} - whenUnsatisfiable: {{ $val.whenUnsatisfiable }} - {{- end}} - labelSelector: - matchLabels: - app: {{ $.Release.Name }}-{{ include "casa.name" $ }} - {{- if $val.matchLabelKeys }} - matchLabelKeys: {{ $val.matchLabelKeys }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeAffinityPolicy }} - nodeAffinityPolicy: {{ $val.nodeAffinityPolicy }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeTaintsPolicy }} - nodeTaintsPolicy: {{ $val.nodeTaintsPolicy }} # optional; alpha since v1.25 - {{- end}} -{{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/casa/templates/casa-destination-rules.yaml b/charts/gluu/gluu/charts/casa/templates/casa-destination-rules.yaml deleted file mode 100644 index eb2e5eaa6..000000000 --- a/charts/gluu/gluu/charts/casa/templates/casa-destination-rules.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- if .Values.global.istio.enabled }} -apiVersion: networking.istio.io/v1alpha3 -kind: DestinationRule -metadata: - name: {{ .Release.Name }}-casa-mtls - namespace: {{.Release.Namespace}} - labels: - APP_NAME: casa -{{ include "casa.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - host: {{ .Values.global.casa.casaServiceName }}.{{ .Release.Namespace }}.svc.cluster.local - trafficPolicy: - tls: - mode: ISTIO_MUTUAL -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/casa/templates/casa-pdb.yaml b/charts/gluu/gluu/charts/casa/templates/casa-pdb.yaml deleted file mode 100644 index 54ad15de5..000000000 --- a/charts/gluu/gluu/charts/casa/templates/casa-pdb.yaml +++ /dev/null @@ -1,11 +0,0 @@ -{{ if .Values.pdb.enabled -}} -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ include "casa.fullname" . }} -spec: - maxUnavailable: {{ .Values.pdb.maxUnavailable }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "casa.name" . }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/casa/templates/casa-virtual-services.yaml b/charts/gluu/gluu/charts/casa/templates/casa-virtual-services.yaml deleted file mode 100644 index b3d765949..000000000 --- a/charts/gluu/gluu/charts/casa/templates/casa-virtual-services.yaml +++ /dev/null @@ -1,38 +0,0 @@ -{{- if and (.Values.global.istio.ingress) (.Values.global.casa.ingress.casaEnabled) }} -apiVersion: networking.istio.io/v1alpha3 -kind: VirtualService -metadata: - name: {{ .Release.Name }}-istio-casa - namespace: {{.Release.Namespace}} - labels: - APP_NAME: casa -{{ include "casa.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.global.istio.gateways }} - gateways: -{{ toYaml .Values.global.istio.gateways | indent 2 }} -{{- else }} - gateways: - - {{ .Release.Name }}-global-gtw -{{- end }} - hosts: - - {{ .Values.global.fqdn }} - http: - - name: {{ .Release.Name }}-istio-casa - match: - - uri: - prefix: /casa - route: - - destination: - host: {{ .Values.global.casa.casaServiceName }}.{{.Release.Namespace}}.svc.cluster.local - port: - number: 8080 - weight: 100 -{{- end }} diff --git a/charts/gluu/gluu/charts/casa/templates/deployment.yaml b/charts/gluu/gluu/charts/casa/templates/deployment.yaml deleted file mode 100644 index 270708782..000000000 --- a/charts/gluu/gluu/charts/casa/templates/deployment.yaml +++ /dev/null @@ -1,176 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "casa.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: casa -{{ include "casa.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - replicas: {{ .Values.replicas }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "casa.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - template: - metadata: - labels: - APP_NAME: casa - app: {{ .Release.Name }}-{{ include "casa.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - {{- if .Values.global.istio.ingress }} - annotations: - sidecar.istio.io/rewriteAppHTTPProbers: "true" - {{- end }} - spec: - dnsPolicy: {{ .Values.dnsPolicy | quote }} - {{- with .Values.dnsConfig }} - dnsConfig: -{{ toYaml . | indent 8 }} - {{- end }} - - {{- with .Values.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - securityContext: - {{- toYaml .Values.podSecurityContext | nindent 8 }} - {{- if .Values.topologySpreadConstraints }} - topologySpreadConstraints: - {{- include "casa.topology-spread-constraints" . | indent 8 }} - {{- end }} - containers: - - name: {{ include "casa.name" . }} - securityContext: - {{- toYaml .Values.securityContext | nindent 12 }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - env: - {{- include "casa.usr-envs" . | indent 12 }} - {{- include "casa.usr-secret-envs" . | indent 12 }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - command: - - /bin/sh - - -c - - | - /usr/bin/python3 /scripts/updatelbip.py & - /app/scripts/entrypoint.sh - {{- end }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - ports: - - name: {{ .Values.service.name }} - containerPort: {{ .Values.service.port}} - protocol: TCP - {{ if .Values.global.cnPrometheusPort }} - - name: prometheus-port - containerPort: {{ .Values.global.cnPrometheusPort }} - {{- end }} - envFrom: - - configMapRef: - name: {{ .Release.Name }}-config-cm - {{ if .Values.global.usrEnvs.secret }} - - secretRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - {{ if .Values.global.usrEnvs.normal }} - - configMapRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - volumeMounts: - {{- with .Values.volumeMounts }} -{{- toYaml . | nindent 12 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }} - name: aws-shared-credential-file - subPath: aws_shared_credential_file - - mountPath: {{ .Values.global.cnAwsConfigFile }} - name: aws-config-file - subPath: aws_config_file - - mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }} - name: aws-secrets-replica-regions - subPath: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - mountPath: {{ .Values.global.cnGoogleApplicationCredentials }} - name: google-sa - subPath: google-credentials.json - {{- end }} - - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "casa.fullname" .}}-updatelbip - mountPath: "/scripts" - {{- end }} - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - mountPath: "/etc/certs/couchbase.crt" - subPath: couchbase.crt - {{- end }} - {{- end }} - livenessProbe: -{{- toYaml .Values.livenessProbe | nindent 12 }} - readinessProbe: -{{- toYaml .Values.readinessProbe | nindent 12 }} - {{- if and ( .Values.global.opendj.enabled ) (or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath")) }} - resources: {} - {{- else if .Values.global.cloud.testEnviroment }} - resources: {} - {{- else }} - resources: -{{- toYaml .Values.resources | nindent 12 }} - {{- end }} - volumes: - {{- with .Values.volumes }} -{{- toYaml . | nindent 8 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - name: aws-shared-credential-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_shared_credential_file - path: aws_shared_credential_file - - name: aws-config-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_config_file - path: aws_config_file - - name: aws-secrets-replica-regions - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_secrets_replica_regions - path: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - name: google-sa - secret: - secretName: {{ .Release.Name }}-google-sa - {{- end }} - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - secret: - secretName: {{ .Release.Name }}-cb-crt - {{- end }} - {{- end }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "casa.fullname" . }}-updatelbip - configMap: - name: {{ .Release.Name }}-updatelbip - {{- end }} - {{- if not .Values.global.isFqdnRegistered }} - hostAliases: - - ip: {{ .Values.global.lbIp }} - hostnames: - - {{ .Values.global.fqdn }} - {{- end }} diff --git a/charts/gluu/gluu/charts/casa/templates/hpa.yaml b/charts/gluu/gluu/charts/casa/templates/hpa.yaml deleted file mode 100644 index 0d292fd3f..000000000 --- a/charts/gluu/gluu/charts/casa/templates/hpa.yaml +++ /dev/null @@ -1,37 +0,0 @@ -{{ if .Values.hpa.enabled -}} -apiVersion: autoscaling/v1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "casa.fullname" . }} - labels: - APP_NAME: casa -{{ include "casa.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "casa.fullname" . }} - minReplicas: {{ .Values.hpa.minReplicas }} - maxReplicas: {{ .Values.hpa.maxReplicas }} - {{- if .Values.hpa.targetCPUUtilizationPercentage }} - targetCPUUtilizationPercentage: {{ .Values.hpa.targetCPUUtilizationPercentage }} - {{- else if .Values.hpa.metrics }} - metrics: - {{- with .Values.hpa.metrics }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} - {{- if .Values.hpa.behavior }} - behavior: - {{- with .Values.hpa.behavior }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/casa/templates/service.yaml b/charts/gluu/gluu/charts/casa/templates/service.yaml deleted file mode 100644 index e736cc014..000000000 --- a/charts/gluu/gluu/charts/casa/templates/service.yaml +++ /dev/null @@ -1,30 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ .Values.global.casa.casaServiceName }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: casa -{{ include "casa.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - {{- if .Values.global.alb.ingress }} - type: NodePort - {{- end }} - ports: - - port: {{ .Values.service.port }} - name: {{ .Values.service.name }} - selector: - app: {{ .Release.Name }}-{{ include "casa.name" . }} - app.kubernetes.io/instance: {{ .Release.Name }} - sessionAffinity: {{ .Values.service.sessionAffinity }} - {{- with .Values.service.sessionAffinityConfig }} - sessionAffinityConfig: -{{ toYaml . | indent 4 }} - {{- end }} diff --git a/charts/gluu/gluu/charts/casa/templates/user-custom-secret-envs.yaml b/charts/gluu/gluu/charts/casa/templates/user-custom-secret-envs.yaml deleted file mode 100644 index 8a71e1ea8..000000000 --- a/charts/gluu/gluu/charts/casa/templates/user-custom-secret-envs.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{ if .Values.usrEnvs.secret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-{{ .Chart.Name }}-user-custom-envs - labels: - APP_NAME: casa -{{ include "casa.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -data: - {{- range $key, $val := .Values.usrEnvs.secret }} - {{ $key }}: {{ $val | b64enc }} - {{- end}} -{{- end}} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/casa/values.yaml b/charts/gluu/gluu/charts/casa/values.yaml deleted file mode 100644 index 40a3c07ef..000000000 --- a/charts/gluu/gluu/charts/casa/values.yaml +++ /dev/null @@ -1,98 +0,0 @@ -# -- Gluu Casa ("Casa") is a self-service web portal for end-users to manage authentication and authorization preferences for their account in a Gluu Server. -# -- Configure the HorizontalPodAutoscaler -hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} -# -- Add custom normal and secret envs to the service -usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} -# -- Add custom dns policy -dnsPolicy: "" -# -- Add custom dns config -dnsConfig: {} -image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: gluufederation/casa - # -- Image tag to use for deploying. - tag: 5.0.0-3 - # -- Image Pull Secrets - pullSecrets: [ ] -# -- Service replica number. -replicas: 1 -# -- Resource specs. -resources: - limits: - # -- CPU limit. - cpu: 500m - # -- Memory limit. - memory: 500Mi - requests: - # -- CPU request. - cpu: 500m - # -- Memory request. - memory: 500Mi -service: - # -- Port of the casa service. Please keep it as default. - port: 8080 - # -- The name of the casa port within the casa service. Please keep it as default. - name: http-casa - # -- Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP - sessionAffinity: None - # -- the maximum session sticky time if sessionAffinity is ClientIP - sessionAffinityConfig: - clientIP: - timeoutSeconds: 10800 -# -- Configure the liveness healthcheck for casa if needed. -livenessProbe: - httpGet: - # -- http liveness probe endpoint - path: /casa/health-check - port: http-casa - initialDelaySeconds: 25 - periodSeconds: 25 - timeoutSeconds: 5 -# -- Configure the readiness healthcheck for the casa if needed. -readinessProbe: - httpGet: - # -- http readiness probe endpoint - path: /casa/health-check - port: http-casa - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 -# -- Configure any additional volumes that need to be attached to the pod -volumes: [] -# -- Configure any additional volumesMounts that need to be attached to the containers -volumeMounts: [] - -nameOverride: "" -fullnameOverride: "" - -podSecurityContext: {} - # fsGroup: 2000 - -securityContext: {} - # capabilities: - # drop: - # - ALL - # readOnlyRootFilesystem: true - # runAsNonRoot: true - # runAsUser: 1000 - -# -- Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} -additionalLabels: { } -# -- Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken -additionalAnnotations: { } \ No newline at end of file diff --git a/charts/gluu/gluu/charts/cn-istio-ingress/.helmignore b/charts/gluu/gluu/charts/cn-istio-ingress/.helmignore deleted file mode 100644 index 50af03172..000000000 --- a/charts/gluu/gluu/charts/cn-istio-ingress/.helmignore +++ /dev/null @@ -1,22 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/charts/gluu/gluu/charts/cn-istio-ingress/Chart.yaml b/charts/gluu/gluu/charts/cn-istio-ingress/Chart.yaml deleted file mode 100644 index 2c37a2460..000000000 --- a/charts/gluu/gluu/charts/cn-istio-ingress/Chart.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v2 -appVersion: 5.0.0 -description: Istio Gateway -home: https://gluu.org/docs/gluu-server/ -icon: https://gluu.org/docs/gluu-server/favicon.ico -keywords: -- istio -- gateway -kubeVersion: '>=v1.21.0-0' -maintainers: -- email: support@gluu.org - name: Mohammad Abudayyeh - url: https://github.com/moabu -name: cn-istio-ingress -sources: -- https://gluu.org/docs/gluu-server/ -- https://github.com/GluuFederation/flex/tree/main/flex-cn-setup/pygluu/kubernetes/templates/helm/gluu/charts/cn-istio-ingress -type: application -version: 5.0.10 diff --git a/charts/gluu/gluu/charts/cn-istio-ingress/README.md b/charts/gluu/gluu/charts/cn-istio-ingress/README.md deleted file mode 100644 index 5404bdd37..000000000 --- a/charts/gluu/gluu/charts/cn-istio-ingress/README.md +++ /dev/null @@ -1,25 +0,0 @@ -# cn-istio-ingress - -![Version: 5.0.10](https://img.shields.io/badge/Version-5.0.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0](https://img.shields.io/badge/AppVersion-5.0.0-informational?style=flat-square) - -Istio Gateway - -**Homepage:** - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| Mohammad Abudayyeh | | | - -## Source Code - -* -* - -## Requirements - -Kubernetes: `>=v1.21.0-0` - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/gluu/gluu/charts/cn-istio-ingress/templates/_helpers.tpl b/charts/gluu/gluu/charts/cn-istio-ingress/templates/_helpers.tpl deleted file mode 100644 index 75a5dee78..000000000 --- a/charts/gluu/gluu/charts/cn-istio-ingress/templates/_helpers.tpl +++ /dev/null @@ -1,63 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "istio.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "istio.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "istio.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Common labels -*/}} -{{- define "istio.labels" -}} -helm.sh/chart: {{ include "istio.chart" . }} -{{ include "istio.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Selector labels -*/}} -{{- define "istio.selectorLabels" -}} -app.kubernetes.io/name: {{ include "istio.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end -}} - -{{/* -Create the name of the service account to use -*/}} -{{- define "istio.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} - {{ default (include "istio.fullname" .) .Values.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.serviceAccount.name }} -{{- end -}} -{{- end -}} diff --git a/charts/gluu/gluu/charts/cn-istio-ingress/templates/gateway.yaml b/charts/gluu/gluu/charts/cn-istio-ingress/templates/gateway.yaml deleted file mode 100644 index 12a970013..000000000 --- a/charts/gluu/gluu/charts/cn-istio-ingress/templates/gateway.yaml +++ /dev/null @@ -1,36 +0,0 @@ -apiVersion: networking.istio.io/v1alpha3 -kind: Gateway -metadata: - name: {{ .Release.Name }}-global-gtw - namespace: {{ .Release.Namespace }} -{{- if .Values.global.istio.additionalLabels }} - labels: -{{ toYaml .Values.global.istio.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.global.istio.additionalAnnotations }} - annotations: -{{ toYaml .Values.global.istio.additionalAnnotations | indent 4 }} -{{- end }} -spec: - selector: - istio: ingressgateway - servers: - # admin-ui - - port: - number: 80 - name: http-admin-ui - protocol: HTTP - hosts: - - {{ .Values.global.fqdn }} - tls: - httpsRedirect: true - - port: - number: 443 - name: https - protocol: HTTPS - hosts: - - {{ .Values.global.fqdn }} - tls: - mode: SIMPLE # enable https on this port - credentialName: tls-certificate # fetch cert from k8s secret - \ No newline at end of file diff --git a/charts/gluu/gluu/charts/cn-istio-ingress/values.yaml b/charts/gluu/gluu/charts/cn-istio-ingress/values.yaml deleted file mode 100644 index 645a12131..000000000 --- a/charts/gluu/gluu/charts/cn-istio-ingress/values.yaml +++ /dev/null @@ -1,4 +0,0 @@ -# Default values for istio. -# This is a YAML-formatted file. -# Declare variables to be passed into your templates. - diff --git a/charts/gluu/gluu/charts/config-api/.helmignore b/charts/gluu/gluu/charts/config-api/.helmignore deleted file mode 100644 index f0c131944..000000000 --- a/charts/gluu/gluu/charts/config-api/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/charts/gluu/gluu/charts/config-api/Chart.yaml b/charts/gluu/gluu/charts/config-api/Chart.yaml deleted file mode 100644 index 541b7bdb6..000000000 --- a/charts/gluu/gluu/charts/config-api/Chart.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: v2 -appVersion: 5.0.0 -description: Jans Config Api endpoints can be used to configure jans-auth-server, - which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server - (AS) -home: https://gluu.org/docs/gluu-server -icon: https://gluu.org/docs/gluu-server/favicon.ico -keywords: -- configuration -- API -kubeVersion: '>=v1.21.0-0' -maintainers: -- email: support@gluu.org - name: Mohammad Abudayyeh - url: https://github.com/moabu -name: config-api -sources: -- https://github.com/JanssenProject/jans/jans-config-api -- https://github.com/JanssenProject/jans/docker-jans-config-api -- https://github.com/GluuFederation/flex/tree/main/flex-cn-setup/pygluu/kubernetes/templates/helm/gluu/charts/config-api -type: application -version: 5.0.10 diff --git a/charts/gluu/gluu/charts/config-api/README.md b/charts/gluu/gluu/charts/config-api/README.md deleted file mode 100644 index f53c12f99..000000000 --- a/charts/gluu/gluu/charts/config-api/README.md +++ /dev/null @@ -1,64 +0,0 @@ -# config-api - -![Version: 5.0.10](https://img.shields.io/badge/Version-5.0.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0](https://img.shields.io/badge/AppVersion-5.0.0-informational?style=flat-square) - -Jans Config Api endpoints can be used to configure jans-auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS) - -**Homepage:** - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| Mohammad Abudayyeh | | | - -## Source Code - -* -* -* - -## Requirements - -Kubernetes: `>=v1.21.0-0` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| additionalAnnotations | object | `{}` | Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken | -| additionalLabels | object | `{}` | Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} | -| affinity | object | `{}` | | -| dnsConfig | object | `{}` | Add custom dns config | -| dnsPolicy | string | `""` | Add custom dns policy | -| fullnameOverride | string | `""` | | -| hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| hpa.behavior | object | `{}` | Scaling Policies | -| hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| image.pullSecrets | list | `[]` | Image Pull Secrets | -| image.repository | string | `"janssenproject/config-api"` | Image to use for deploying. | -| image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| livenessProbe | object | `{"httpGet":{"path":"/jans-config-api/api/v1/health/live","port":8074},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. | -| livenessProbe.httpGet | object | `{"path":"/jans-config-api/api/v1/health/live","port":8074}` | Executes the python3 healthcheck. https://github.com/GluuFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py | -| nameOverride | string | `""` | | -| nodeSelector | object | `{}` | | -| readinessProbe | object | `{"httpGet":{"path":"/jans-config-api/api/v1/health/ready","port":8074},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the auth server if needed. https://github.com/GluuFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py | -| replicas | int | `1` | Service replica number. | -| resources | object | `{"limits":{"cpu":"2500m","memory":"2500Mi"},"requests":{"cpu":"2500m","memory":"2500Mi"}}` | Resource specs. | -| resources.limits.cpu | string | `"2500m"` | CPU limit. | -| resources.limits.memory | string | `"2500Mi"` | Memory limit. | -| resources.requests.cpu | string | `"2500m"` | CPU request. | -| resources.requests.memory | string | `"2500Mi"` | Memory request. | -| service.name | string | `"http-config-api"` | The name of the config-api port within the config-api service. Please keep it as default. | -| service.sessionAffinity | string | `"None"` | Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP | -| service.sessionAffinityConfig | object | `{"clientIP":{"timeoutSeconds":10800}}` | the maximum session sticky time if sessionAffinity is ClientIP | -| tolerations | list | `[]` | | -| usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/gluu/gluu/charts/config-api/templates/_helpers.tpl b/charts/gluu/gluu/charts/config-api/templates/_helpers.tpl deleted file mode 100644 index a32d54db3..000000000 --- a/charts/gluu/gluu/charts/config-api/templates/_helpers.tpl +++ /dev/null @@ -1,98 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "config-api.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "config-api.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "config-api.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* - Common labels -*/}} -{{- define "config-api.labels" -}} -app: {{ .Release.Name }}-{{ include "config-api.name" . }} -helm.sh/chart: {{ include "config-api.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Create user custom defined envs -*/}} -{{- define "config-api.usr-envs"}} -{{- range $key, $val := .Values.usrEnvs.normal }} -- name: {{ $key }} - value: {{ $val | quote }} -{{- end }} -{{- end }} - -{{/* -Create user custom defined secret envs -*/}} -{{- define "config-api.usr-secret-envs"}} -{{- range $key, $val := .Values.usrEnvs.secret }} -- name: {{ $key }} - valueFrom: - secretKeyRef: - name: {{ $.Release.Name }}-{{ $.Chart.Name }}-user-custom-envs - key: {{ $key | quote }} -{{- end }} -{{- end }} - -{{/* -Create topologySpreadConstraints lists -*/}} -{{- define "config-api.topology-spread-constraints"}} -{{- range $key, $val := .Values.topologySpreadConstraints }} -- maxSkew: {{ $val.maxSkew }} - {{- if $val.minDomains }} - minDomains: {{ $val.minDomains }} # optional; beta since v1.25 - {{- end}} - {{- if $val.topologyKey }} - topologyKey: {{ $val.topologyKey }} - {{- end}} - {{- if $val.whenUnsatisfiable }} - whenUnsatisfiable: {{ $val.whenUnsatisfiable }} - {{- end}} - labelSelector: - matchLabels: - app: {{ $.Release.Name }}-{{ include "config-api.name" $ }} - {{- if $val.matchLabelKeys }} - matchLabelKeys: {{ $val.matchLabelKeys }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeAffinityPolicy }} - nodeAffinityPolicy: {{ $val.nodeAffinityPolicy }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeTaintsPolicy }} - nodeTaintsPolicy: {{ $val.nodeTaintsPolicy }} # optional; alpha since v1.25 - {{- end}} -{{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/config-api/templates/config-api-destination-rules.yaml b/charts/gluu/gluu/charts/config-api/templates/config-api-destination-rules.yaml deleted file mode 100644 index 255fac728..000000000 --- a/charts/gluu/gluu/charts/config-api/templates/config-api-destination-rules.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- if .Values.global.istio.enabled }} -apiVersion: networking.istio.io/v1alpha3 -kind: DestinationRule -metadata: - name: {{ .Release.Name }}-config-api-mtls - namespace: {{.Release.Namespace}} - labels: - APP_NAME: config-api -{{ include "config-api.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - host: {{ index .Values "global" "config-api" "configApiServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local - trafficPolicy: - tls: - mode: ISTIO_MUTUAL -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/config-api/templates/config-api-pdb.yaml b/charts/gluu/gluu/charts/config-api/templates/config-api-pdb.yaml deleted file mode 100644 index 2153d9a39..000000000 --- a/charts/gluu/gluu/charts/config-api/templates/config-api-pdb.yaml +++ /dev/null @@ -1,11 +0,0 @@ -{{ if .Values.pdb.enabled -}} -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ include "config-api.fullname" . }} -spec: - maxUnavailable: {{ .Values.pdb.maxUnavailable }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "config-api.name" . }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/config-api/templates/config-api-virtual-services.yaml b/charts/gluu/gluu/charts/config-api/templates/config-api-virtual-services.yaml deleted file mode 100644 index 49bd94283..000000000 --- a/charts/gluu/gluu/charts/config-api/templates/config-api-virtual-services.yaml +++ /dev/null @@ -1,38 +0,0 @@ -{{- if and (.Values.global.istio.ingress) (index .Values "global" "config-api" "ingress" "configApiEnabled") }} -apiVersion: networking.istio.io/v1alpha3 -kind: VirtualService -metadata: - name: {{ .Release.Name }}-istio-config-api - namespace: {{.Release.Namespace}} - labels: - APP_NAME: config-api -{{ include "config-api.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.global.istio.gateways }} - gateways: -{{ toYaml .Values.global.istio.gateways | indent 2 }} -{{- else }} - gateways: - - {{ .Release.Name }}-global-gtw -{{- end }} - hosts: - - {{ .Values.global.fqdn }} - http: - - name: {{ .Release.Name }}-istio-config-api - match: - - uri: - prefix: /jans-config-api - route: - - destination: - host: {{ index .Values "global" "config-api" "configApiServerServiceName" }}.{{.Release.Namespace}}.svc.cluster.local - port: - number: 8074 - weight: 100 -{{- end }} diff --git a/charts/gluu/gluu/charts/config-api/templates/deployment.yaml b/charts/gluu/gluu/charts/config-api/templates/deployment.yaml deleted file mode 100644 index e36f7b26b..000000000 --- a/charts/gluu/gluu/charts/config-api/templates/deployment.yaml +++ /dev/null @@ -1,165 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "config-api.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: config-api -{{ include "config-api.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - replicas: {{ .Values.replicas }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "config-api.name" . }} - template: - metadata: - labels: - app: {{ .Release.Name }}-{{ include "config-api.name" . }} - release: {{ .Release.Name }} - {{- if .Values.global.istio.ingress }} - annotations: - sidecar.istio.io/rewriteAppHTTPProbers: "true" - {{- end }} - spec: - {{- with .Values.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - dnsPolicy: {{ .Values.dnsPolicy | quote }} - {{- with .Values.dnsConfig }} - dnsConfig: -{{ toYaml . | indent 8 }} - {{- end }} - {{- if .Values.topologySpreadConstraints }} - topologySpreadConstraints: - {{- include "config-api.topology-spread-constraints" . | indent 8 }} - {{- end }} - containers: - - name: {{ include "config-api.name" . }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - env: - {{- include "config-api.usr-envs" . | indent 12 }} - {{- include "config-api.usr-secret-envs" . | indent 12 }} - securityContext: - runAsUser: 1000 - runAsNonRoot: true - imagePullPolicy: {{ .Values.image.pullPolicy }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - command: - - /bin/sh - - -c - - | - /usr/bin/python3 /scripts/updatelbip.py & - /app/scripts/entrypoint.sh - {{- end }} - ports: - - containerPort: 9444 - - containerPort: 8074 - {{ if .Values.global.cnPrometheusPort }} - - name: prometheus-port - containerPort: {{ .Values.global.cnPrometheusPort }} - {{- end }} - envFrom: - - configMapRef: - name: {{ .Release.Name }}-config-cm - livenessProbe: -{{- toYaml .Values.livenessProbe | nindent 12 }} - readinessProbe: -{{- toYaml .Values.readinessProbe | nindent 12 }} - volumeMounts: - {{- with .Values.volumeMounts }} -{{- toYaml . | nindent 12 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }} - name: aws-shared-credential-file - subPath: aws_shared_credential_file - - mountPath: {{ .Values.global.cnAwsConfigFile }} - name: aws-config-file - subPath: aws_config_file - - mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }} - name: aws-secrets-replica-regions - subPath: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - mountPath: {{ .Values.global.cnGoogleApplicationCredentials }} - name: google-sa - subPath: google-credentials.json - {{- end }} - - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - mountPath: "/etc/certs/couchbase.crt" - subPath: couchbase.crt - {{- end }} - {{- end }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "config-api.name" . }}-updatelbip - mountPath: /scripts - {{- end }} - {{- if and ( .Values.global.opendj.enabled ) (or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath")) }} - resources: {} - {{- else if .Values.global.cloud.testEnviroment }} - resources: {} - {{- else }} - resources: -{{- toYaml .Values.resources | nindent 12 }} - {{- end }} - volumes: - {{- with .Values.volumes }} -{{- toYaml . | nindent 8 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - name: aws-shared-credential-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_shared_credential_file - path: aws_shared_credential_file - - name: aws-config-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_config_file - path: aws_config_file - - name: aws-secrets-replica-regions - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_secrets_replica_regions - path: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - name: google-sa - secret: - secretName: {{ .Release.Name }}-google-sa - {{- end }} - - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - secret: - secretName: {{ .Release.Name }}-cb-crt - {{- end }} - {{- end }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "config-api.name" . }}-updatelbip - configMap: - name: {{ .Release.Name }}-updatelbip - {{- end }} - {{- if not .Values.global.isFqdnRegistered }} - hostAliases: - - ip: {{ .Values.global.lbIp }} - hostnames: - - {{ .Values.global.fqdn }} - {{- end }} - diff --git a/charts/gluu/gluu/charts/config-api/templates/hpa.yaml b/charts/gluu/gluu/charts/config-api/templates/hpa.yaml deleted file mode 100644 index aed5352e7..000000000 --- a/charts/gluu/gluu/charts/config-api/templates/hpa.yaml +++ /dev/null @@ -1,37 +0,0 @@ -{{ if .Values.hpa.enabled -}} -apiVersion: autoscaling/v1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "config-api.fullname" . }} - labels: - APP_NAME: config-api -{{ include "config-api.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "config-api.fullname" . }} - minReplicas: {{ .Values.hpa.minReplicas }} - maxReplicas: {{ .Values.hpa.maxReplicas }} - {{- if .Values.hpa.targetCPUUtilizationPercentage }} - targetCPUUtilizationPercentage: {{ .Values.hpa.targetCPUUtilizationPercentage }} - {{- else if .Values.hpa.metrics }} - metrics: - {{- with .Values.hpa.metrics }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} - {{- if .Values.hpa.behavior }} - behavior: - {{- with .Values.hpa.behavior }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/config-api/templates/service.yaml b/charts/gluu/gluu/charts/config-api/templates/service.yaml deleted file mode 100644 index 1782cc7e9..000000000 --- a/charts/gluu/gluu/charts/config-api/templates/service.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - # the name must match the application - name: {{ index .Values "global" "config-api" "configApiServerServiceName" }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: config-api -{{ include "config-api.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - ports: - - port: 9444 - name: tcp-{{ include "config-api.name" . }}-ssl - - port: 8074 - name: tcp-{{ include "config-api.name" . }}-http - selector: - app: {{ .Release.Name }}-{{ include "config-api.name" . }} - sessionAffinity: {{ .Values.service.sessionAffinity }} - {{- with .Values.service.sessionAffinityConfig }} - sessionAffinityConfig: -{{ toYaml . | indent 4 }} - {{- end }} diff --git a/charts/gluu/gluu/charts/config-api/values.yaml b/charts/gluu/gluu/charts/config-api/values.yaml deleted file mode 100644 index 8da708c57..000000000 --- a/charts/gluu/gluu/charts/config-api/values.yaml +++ /dev/null @@ -1,96 +0,0 @@ - -# -- Gluu Admin UI. This shouldn't be internet facing. -# -- Configure the HorizontalPodAutoscaler -hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} - - -nameOverride: "" -fullnameOverride: "" - -# -- Add custom normal and secret envs to the service -usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} -# -- Add custom dns policy -dnsPolicy: "" -# -- Add custom dns config -dnsConfig: {} -image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: janssenproject/config-api - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] -# -- Service replica number. -replicas: 1 -# -- Resource specs. -resources: - limits: - # -- CPU limit. - cpu: 2500m - # -- Memory limit. - memory: 2500Mi - requests: - # -- CPU request. - cpu: 2500m - # -- Memory request. - memory: 2500Mi -service: - # -- The name of the config-api port within the config-api service. Please keep it as default. - name: http-config-api - # -- Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP - sessionAffinity: None - # -- the maximum session sticky time if sessionAffinity is ClientIP - sessionAffinityConfig: - clientIP: - timeoutSeconds: 10800 -# -- Configure the liveness healthcheck for the auth server if needed. -livenessProbe: - # -- Executes the python3 healthcheck. - # https://github.com/GluuFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py - httpGet: - path: /jans-config-api/api/v1/health/live - port: 8074 - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 -# -- Configure the readiness healthcheck for the auth server if needed. -# https://github.com/GluuFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py -readinessProbe: - httpGet: - path: /jans-config-api/api/v1/health/ready - port: 8074 - initialDelaySeconds: 25 - periodSeconds: 25 - timeoutSeconds: 5 - - -nodeSelector: {} - -tolerations: [] - -affinity: {} -# -- Configure any additional volumes that need to be attached to the pod -volumes: [] -# -- Configure any additional volumesMounts that need to be attached to the containers -volumeMounts: [] - -# -- Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} -additionalLabels: { } -# -- Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken -additionalAnnotations: { } diff --git a/charts/gluu/gluu/charts/config/.helmignore b/charts/gluu/gluu/charts/config/.helmignore deleted file mode 100644 index b8204d744..000000000 --- a/charts/gluu/gluu/charts/config/.helmignore +++ /dev/null @@ -1,22 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -tls_generator.py diff --git a/charts/gluu/gluu/charts/config/Chart.yaml b/charts/gluu/gluu/charts/config/Chart.yaml deleted file mode 100644 index 32c308ec3..000000000 --- a/charts/gluu/gluu/charts/config/Chart.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: v2 -appVersion: 5.0.0 -description: Configuration parameters for setup and initial configuration secret and - config layers used by Gluu services. -home: https://gluu.org/docs/gluu-server/reference/container-configs/ -icon: https://gluu.org/docs/gluu-server/favicon.ico -keywords: -- configuration -- secrets -kubeVersion: '>=v1.21.0-0' -maintainers: -- email: support@gluu.org - name: Mohammad Abudayyeh - url: https://github.com/moabu -name: config -sources: -- https://gluu.org/docs/gluu-server/reference/container-configs/ -- https://github.com/JanssenProject/jans/docker-jans-configurator -- https://github.com/GluuFederation/flex/tree/main/flex-cn-setup/pygluu/kubernetes/templates/helm/gluu/charts/config -type: application -version: 5.0.10 diff --git a/charts/gluu/gluu/charts/config/README.md b/charts/gluu/gluu/charts/config/README.md deleted file mode 100644 index e0c930c40..000000000 --- a/charts/gluu/gluu/charts/config/README.md +++ /dev/null @@ -1,100 +0,0 @@ -# config - -![Version: 5.0.10](https://img.shields.io/badge/Version-5.0.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0](https://img.shields.io/badge/AppVersion-5.0.0-informational?style=flat-square) - -Configuration parameters for setup and initial configuration secret and config layers used by Gluu services. - -**Homepage:** - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| Mohammad Abudayyeh | | | - -## Source Code - -* -* -* - -## Requirements - -Kubernetes: `>=v1.21.0-0` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| additionalAnnotations | object | `{}` | Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken | -| additionalLabels | object | `{}` | Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} | -| adminPassword | string | `"Test1234#"` | Admin password to log in to the UI. | -| city | string | `"Austin"` | City. Used for certificate creation. | -| configmap.cnCacheType | string | `"NATIVE_PERSISTENCE"` | Cache type. `NATIVE_PERSISTENCE`, `REDIS`. or `IN_MEMORY`. Defaults to `NATIVE_PERSISTENCE` . | -| configmap.cnConfigGoogleSecretNamePrefix | string | `"gluu"` | Prefix for Gluu configuration secret in Google Secret Manager. Defaults to gluu. If left intact gluu-configuration secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google. | -| configmap.cnConfigGoogleSecretVersionId | string | `"latest"` | Secret version to be used for configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google. Used only when global.configAdapterName and global.configSecretAdapter is set to google. | -| configmap.cnConfigKubernetesConfigMap | string | `"cn"` | The name of the Kubernetes ConfigMap that will hold the configuration layer | -| configmap.cnCouchbaseBucketPrefix | string | `"jans"` | The prefix of couchbase buckets. This helps with separation in between different environments and allows for the same couchbase cluster to be used by different setups of Gluu. | -| configmap.cnCouchbaseCrt | string | `"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo="` | Couchbase certificate authority string. This must be encoded using base64. This can also be found in your couchbase UI Security > Root Certificate. In mTLS setups this is not required. | -| configmap.cnCouchbaseIndexNumReplica | int | `0` | The number of replicas per index created. Please note that the number of index nodes must be one greater than the number of index replicas. That means if your couchbase cluster only has 2 index nodes you cannot place the number of replicas to be higher than 1. | -| configmap.cnCouchbasePassword | string | `"P@ssw0rd"` | Couchbase password for the restricted user config.configmap.cnCouchbaseUser that is often used inside the services. The password must contain one digit, one uppercase letter, one lower case letter and one symbol . | -| configmap.cnCouchbaseSuperUser | string | `"admin"` | The Couchbase super user (admin) user name. This user is used during initialization only. | -| configmap.cnCouchbaseSuperUserPassword | string | `"Test1234#"` | Couchbase password for the super user config.configmap.cnCouchbaseSuperUser that is used during the initialization process. The password must contain one digit, one uppercase letter, one lower case letter and one symbol | -| configmap.cnCouchbaseUrl | string | `"cbgluu.default.svc.cluster.local"` | Couchbase URL. Used only when global.cnPersistenceType is hybrid or couchbase. This should be in FQDN format for either remote or local Couchbase clusters. The address can be an internal address inside the kubernetes cluster | -| configmap.cnCouchbaseUser | string | `"gluu"` | Couchbase restricted user. Used only when global.cnPersistenceType is hybrid or couchbase. | -| configmap.cnGoogleProjectId | string | `"google-project-to-save-config-and-secrets-to"` | Project id of the google project the secret manager belongs to. Used only when global.configAdapterName and global.configSecretAdapter is set to google. | -| configmap.cnGoogleSecretManagerPassPhrase | string | `"Test1234#"` | Passphrase for Gluu secret in Google Secret Manager. This is used for encrypting and decrypting data from the Google Secret Manager. Used only when global.configAdapterName and global.configSecretAdapter is set to google. | -| configmap.cnGoogleSecretManagerServiceAccount | string | `"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo="` | Service account with roles roles/secretmanager.admin base64 encoded string. This is used often inside the services to reach the configuration layer. Used only when global.configAdapterName and global.configSecretAdapter is set to google. | -| configmap.cnGoogleSpannerDatabaseId | string | `""` | Google Spanner Database ID. Used only when global.cnPersistenceType is spanner. | -| configmap.cnGoogleSpannerInstanceId | string | `""` | Google Spanner ID. Used only when global.cnPersistenceType is spanner. | -| configmap.cnJettyRequestHeaderSize | int | `8192` | Jetty header size in bytes in the auth server | -| configmap.cnLdapUrl | string | `"opendj:1636"` | OpenDJ internal address. Leave as default. Used when `global.cnPersistenceType` is set to `ldap`. | -| configmap.cnMaxRamPercent | string | `"75.0"` | Value passed to Java option -XX:MaxRAMPercentage | -| configmap.cnPersistenceHybridMapping | string | `"{}"` | Specify data that should be saved in each persistence (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType` is set to `hybrid`. { "default": "", "user": "", "site": "", "cache": "", "token": "", "session": "", } | -| configmap.cnRedisSentinelGroup | string | `""` | Redis Sentinel Group. Often set when `config.configmap.cnRedisType` is set to `SENTINEL`. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. | -| configmap.cnRedisSslTruststore | string | `""` | Redis SSL truststore. Optional. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. | -| configmap.cnRedisType | string | `"STANDALONE"` | Redis service type. `STANDALONE` or `CLUSTER`. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. | -| configmap.cnRedisUrl | string | `"redis.redis.svc.cluster.local:6379"` | Redis URL and port number :. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. | -| configmap.cnRedisUseSsl | bool | `false` | Boolean to use SSL in Redis. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. | -| configmap.cnSecretGoogleSecretNamePrefix | string | `"gluu"` | Prefix for Gluu secret in Google Secret Manager. Defaults to gluu. If left gluu-secret secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google. | -| configmap.cnSecretGoogleSecretVersionId | string | `"latest"` | Secret version to be used for secret configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google. | -| configmap.cnSecretKubernetesSecret | string | `"cn"` | Kubernetes secret name holding configuration keys. Used when global.configSecretAdapter is set to kubernetes which is the default. | -| configmap.cnSqlDbDialect | string | `"mysql"` | SQL database dialect. `mysql` or `pgsql` | -| configmap.cnSqlDbHost | string | `"my-release-mysql.default.svc.cluster.local"` | SQL database host uri. | -| configmap.cnSqlDbName | string | `"jans"` | SQL database name. | -| configmap.cnSqlDbPort | int | `3306` | SQL database port. | -| configmap.cnSqlDbTimezone | string | `"UTC"` | SQL database timezone. | -| configmap.cnSqlDbUser | string | `"jans"` | SQL database username. | -| configmap.cnSqldbUserPassword | string | `"Test1234#"` | SQL password injected in the secrets. | -| configmap.containerMetadataName | string | `"kubernetes"` | | -| configmap.lbAddr | string | `""` | Loadbalancer address for AWS if the FQDN is not registered. | -| countryCode | string | `"US"` | Country code. Used for certificate creation. | -| dnsConfig | object | `{}` | Add custom dns config | -| dnsPolicy | string | `""` | Add custom dns policy | -| email | string | `"support@gluu.org"` | Email address of the administrator usually. Used for certificate creation. | -| fullNameOverride | string | `""` | | -| image.pullSecrets | list | `[]` | Image Pull Secrets | -| image.repository | string | `"janssenproject/configurator"` | Image to use for deploying. | -| image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| ldapPassword | string | `"P@ssw0rds"` | LDAP admin password if OpennDJ is used for persistence. | -| migration | object | `{"enabled":false,"migrationDataFormat":"ldif","migrationDir":"/ce-migration"}` | CE to CN Migration section | -| migration.enabled | bool | `false` | Boolean flag to enable migration from CE | -| migration.migrationDataFormat | string | `"ldif"` | migration data-format depending on persistence backend. Supported data formats are ldif, couchbase+json, spanner+avro, postgresql+json, and mysql+json. | -| migration.migrationDir | string | `"/ce-migration"` | Directory holding all migration files | -| nameOverride | string | `""` | | -| orgName | string | `"Gluu"` | Organization name. Used for certificate creation. | -| redisPassword | string | `"P@assw0rd"` | Redis admin password if `config.configmap.cnCacheType` is set to `REDIS`. | -| resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. | -| resources.limits.cpu | string | `"300m"` | CPU limit. | -| resources.limits.memory | string | `"300Mi"` | Memory limit. | -| resources.requests.cpu | string | `"300m"` | CPU request. | -| resources.requests.memory | string | `"300Mi"` | Memory request. | -| state | string | `"TX"` | State code. Used for certificate creation. | -| usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service. | -| usrEnvs.normal | object | `{}` | Add custom normal envs to the service. variable1: value1 | -| usrEnvs.secret | object | `{}` | Add custom secret envs to the service. variable1: value1 | -| volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/gluu/gluu/charts/config/templates/_helpers.tpl b/charts/gluu/gluu/charts/config/templates/_helpers.tpl deleted file mode 100644 index 1273a27d8..000000000 --- a/charts/gluu/gluu/charts/config/templates/_helpers.tpl +++ /dev/null @@ -1,97 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "config.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "config.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "config.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* - Common labels -*/}} -{{- define "config.labels" -}} -app: {{ .Release.Name }}-{{ include "config.name" . }}-init-load -helm.sh/chart: {{ include "config.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Create user custom defined envs -*/}} -{{- define "config.usr-envs"}} -{{- range $key, $val := .Values.usrEnvs.normal }} -- name: {{ $key }} - value: {{ $val | quote }} -{{- end }} -{{- end }} - -{{/* -Create user custom defined secret envs -*/}} -{{- define "config.usr-secret-envs"}} -{{- range $key, $val := .Values.usrEnvs.secret }} -- name: {{ $key }} - valueFrom: - secretKeyRef: - name: {{ $.Release.Name }}-{{ $.Chart.Name }}-user-custom-envs - key: {{ $key | quote }} -{{- end }} -{{- end }} - -{{/* -Create optional scopes list -*/}} -{{- define "config.optionalScopes"}} -{{ $newList := list }} -{{- if eq .Values.configmap.cnCacheType "REDIS" }} -{{ $newList = append $newList ("redis" | quote ) }} -{{- end}} -{{ if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} -{{ $newList = append $newList ("couchbase" | quote) }} -{{- end}} -{{ if eq .Values.global.cnPersistenceType "sql" }} -{{ $newList = append $newList ("sql" | quote) }} -{{- end }} -{{- if .Values.global.opendj.enabled}} -{{ $newList = append $newList ("ldap" | quote) }} -{{- end}} -{{- if .Values.global.casa}} -{{ $newList = append $newList ("casa" | quote) }} -{{- end}} -{{- if .Values.global.fido2.enabled}} -{{ $newList = append $newList ("fido2" | quote) }} -{{- end}} -{{- if .Values.global.scim.enabled}} -{{ $newList = append $newList ("scim" | quote) }} -{{- end}} -{{ toJson $newList }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/config/templates/clusterrolebinding.yaml b/charts/gluu/gluu/charts/config/templates/clusterrolebinding.yaml deleted file mode 100644 index ce43044f5..000000000 --- a/charts/gluu/gluu/charts/config/templates/clusterrolebinding.yaml +++ /dev/null @@ -1,45 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: {{ .Release.Name }}-{{ .Release.Namespace }}-cluster-admin-binding - labels: - APP_NAME: configurator -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-admin -subjects: - - kind: User - # change it to your actual account; the email can be fetched using - # the following command: `gcloud info | grep Account` - name: "ACCOUNT" - apiGroup: rbac.authorization.k8s.io - ---- - -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - labels: - app: {{ include "config.name" . }}-load - name: {{ .Release.Name }}-{{ .Release.Namespace }}-rolebinding -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: edit -subjects: -- kind: ServiceAccount - name: default - namespace: {{ .Release.Namespace }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/config/templates/configmaps.yaml b/charts/gluu/gluu/charts/config/templates/configmaps.yaml deleted file mode 100644 index 2e5061533..000000000 --- a/charts/gluu/gluu/charts/config/templates/configmaps.yaml +++ /dev/null @@ -1,417 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ .Release.Name }}-config-cm - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: configurator -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -data: - # Jetty header size in bytes in the auth server - CN_JETTY_REQUEST_HEADER_SIZE: {{ .Values.configmap.cnJettyRequestHeaderSize | quote }} - # Port used by Prometheus JMX agent - CN_PROMETHEUS_PORT: {{ .Values.global.cnPrometheusPort | quote }} - CN_DISTRIBUTION: {{ .Values.global.distribution | quote }} - {{ if .Values.global.cnObExtSigningJwksUri }} - CN_OB_EXT_SIGNING_JWKS_URI: {{ .Values.global.cnObExtSigningJwksUri | quote }} - CN_OB_AS_TRANSPORT_ALIAS: {{ .Values.global.cnObTransportAlias | quote }} - CN_OB_EXT_SIGNING_ALIAS: {{ .Values.global.cnObExtSigningAlias | quote }} - # force the AS to use a specific signing key - CN_OB_STATIC_KID: {{ .Values.global.cnObStaticSigningKeyKid | quote }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - # [google_envs] Envs related to using Google - GOOGLE_APPLICATION_CREDENTIALS: {{ .Values.global.cnGoogleApplicationCredentials | quote }} - GOOGLE_PROJECT_ID: {{ .Values.configmap.cnGoogleProjectId | quote }} - {{- end }} - {{ if eq .Values.global.cnPersistenceType "spanner" }} - # [google_spanner_envs] Envs related to using Google Secret Manager to store config and secret layer - CN_GOOGLE_SPANNER_INSTANCE_ID: {{ .Values.configmap.cnGoogleSpannerInstanceId | quote }} - CN_GOOGLE_SPANNER_DATABASE_ID: {{ .Values.configmap.cnGoogleSpannerDatabaseId | quote }} - # [google_spanner_envs] END - {{- end }} - {{ if eq .Values.global.configSecretAdapter "google" }} - # [google_secret_manager_envs] Envs related to using Google Secret Manager to store config and secret layer - CN_SECRET_GOOGLE_SECRET_VERSION_ID: {{ .Values.configmap.cnSecretGoogleSecretVersionId | quote }} - CN_SECRET_GOOGLE_SECRET_MANAGER_PASSPHRASE: {{ .Values.configmap.cnGoogleSecretManagerPassPhrase | quote }} - CN_SECRET_GOOGLE_SECRET_NAME_PREFIX: {{ .Values.configmap.cnSecretGoogleSecretNamePrefix | quote }} - CN_CONFIG_GOOGLE_SECRET_VERSION_ID: {{ .Values.configmap.cnConfigGoogleSecretVersionId | quote }} - CN_CONFIG_GOOGLE_SECRET_NAME_PREFIX: {{ .Values.configmap.cnConfigGoogleSecretNamePrefix | quote }} - # [google_secret_manager_envs] END - {{- end }} - CN_SQL_DB_SCHEMA: {{ .Values.configmap.cnSqlDbSchema | quote }} - CN_SQL_DB_DIALECT: {{ .Values.configmap.cnSqlDbDialect }} - CN_SQL_DB_HOST: {{ .Values.configmap.cnSqlDbHost }} - CN_SQL_DB_PORT: {{ .Values.configmap.cnSqlDbPort | quote }} - CN_SQL_DB_NAME: {{ .Values.configmap.cnSqlDbName }} - CN_SQL_DB_USER: {{ .Values.configmap.cnSqlDbUser }} - CN_SQL_DB_TIMEZONE: {{ .Values.configmap.cnSqlDbTimezone }} - CN_CONFIG_ADAPTER: {{ .Values.global.configAdapterName }} - CN_SECRET_ADAPTER: {{ .Values.global.configSecretAdapter }} - CN_CONFIG_KUBERNETES_NAMESPACE: {{ .Release.Namespace | quote }} - CN_SECRET_KUBERNETES_NAMESPACE: {{ .Release.Namespace | quote }} - CN_CONFIG_KUBERNETES_CONFIGMAP: {{ .Values.configmap.cnConfigKubernetesConfigMap }} - CN_SECRET_KUBERNETES_SECRET: {{ .Values.configmap.cnSecretKubernetesSecret }} - CN_CONTAINER_METADATA: {{ .Values.configmap.containerMetadataName | quote }} - CN_MAX_RAM_PERCENTAGE: {{ .Values.configmap.cnMaxRamPercent | quote }} - CN_CACHE_TYPE: {{ .Values.configmap.cnCacheType | quote }} - CN_DOCUMENT_STORE_TYPE: {{ .Values.global.cnDocumentStoreType | quote }} - DOMAIN: {{ .Values.global.fqdn | quote }} - CN_AUTH_SERVER_BACKEND: {{ cat ( index .Values "global" "auth-server" "authServerServiceName" ) ":8080" | quote | nospace }} - CN_AUTH_APP_LOGGERS: {{ index .Values "global" "auth-server" "appLoggers" - | toJson - | replace "authLogTarget" "auth_log_target" - | replace "authLogLevel" "auth_log_level" - | replace "httpLogTarget" "http_log_target" - | replace "httpLogLevel" "http_log_level" - | replace "persistenceLogTarget" "persistence_log_target" - | replace "persistenceLogLevel" "persistence_log_level" - | replace "persistenceDurationLogTarget" "persistence_duration_log_target" - | replace "persistenceDurationLogLevel" "persistence_duration_log_level" - | replace "ldapStatsLogTarget" "ldap_stats_log_target" - | replace "ldapStatsLogLevel" "ldap_stats_log_level" - | replace "scriptLogTarget" "script_log_target" - | replace "scriptLogLevel" "script_log_level" - | replace "auditStatsLogTarget" "audit_log_target" - | replace "auditStatsLogLevel" "audit_log_level" - | replace "enableStdoutLogPrefix" "enable_stdout_log_prefix" - | squote - }} - {{- if index .Values "global" "config-api" "enabled" }} - CN_CONFIG_API_APP_LOGGERS: {{ index .Values "global" "config-api" "appLoggers" - | toJson - | replace "configApiLogTarget" "config_api_log_target" - | replace "configApiLogLevel" "config_api_log_level" - | replace "persistenceLogTarget" "persistence_log_target" - | replace "persistenceLogLevel" "persistence_log_level" - | replace "persistenceDurationLogTarget" "persistence_duration_log_target" - | replace "persistenceDurationLogLevel" "persistence_duration_log_level" - | replace "ldapStatsLogTarget" "ldap_stats_log_target" - | replace "ldapStatsLogLevel" "ldap_stats_log_level" - | replace "scriptLogTarget" "script_log_target" - | replace "scriptLogLevel" "script_log_level" - | replace "enableStdoutLogPrefix" "enable_stdout_log_prefix" - | squote - }} - {{- end }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - LB_ADDR: {{ .Values.configmap.lbAddr }} - {{- end }} - CN_PERSISTENCE_TYPE: {{ .Values.global.cnPersistenceType }} - {{- if or (eq .Values.global.cnPersistenceType "ldap") (eq .Values.global.cnPersistenceType "hybrid") }} - # used only if CN_PERSISTENCE_TYPE is ldap or hybrid - {{- if .Values.configmap.cnLdapUrl }} - CN_LDAP_URL: {{ .Values.configmap.cnLdapUrl | quote }} - {{- else }} - CN_LDAP_URL: {{ cat ( .Values.global.opendj.ldapServiceName ) ":1636" | quote | nospace }} - {{- end }} - {{- else if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - # used only if CN_PERSISTENCE_TYPE is couchbase or hybrid - CN_COUCHBASE_URL: {{ .Values.configmap.cnCouchbaseUrl }} - CN_COUCHBASE_BUCKET_PREFIX: {{ .Values.configmap.cnCouchbaseBucketPrefix }} - CN_COUCHBASE_INDEX_NUM_REPLICA: {{ .Values.configmap.cnCouchbaseIndexNumReplica | quote }} - CN_COUCHBASE_USER: {{ .Values.configmap.cnCouchbaseUser }} - CN_COUCHBASE_SUPERUSER: {{ .Values.configmap.cnCouchbaseSuperUser }} - {{- end }} - CN_KEY_ROTATION_FORCE: "false" - CN_KEY_ROTATION_CHECK: "3600" - CN_KEY_ROTATION_INTERVAL: "48" - {{- if .Values.global.isFqdnRegistered }} - CN_SSL_CERT_FROM_SECRETS: "false" - {{- else }} - CN_SSL_CERT_FROM_SECRETS: "true" - {{- end }} - CN_CONTAINER_MAIN_NAME: {{ .Release.Name }}-auth-server - # options: default/user/site/cache/statistic used only if CN_PERSISTENCE_TYPE is hybrid or hybrid - {{- if or (eq .Values.global.cnPersistenceType "hybrid") (eq .Values.global.cnPersistenceType "ldap") }} - # must the same as the opendj service name - CN_CERT_ALT_NAME: {{ .Values.global.opendj.ldapServiceName }} #{{ template "cn.fullname" . }}-service - CN_HYBRID_MAPPING: {{ .Values.configmap.cnPersistenceHybridMapping | quote }} - {{- end }} - # Auto enable installation of some services - CN_PASSPORT_ENABLED: {{ .Values.global.oxpassport.enabled | quote }} - {{- if .Values.global.oxshibboleth.enabled }} - CN_SAML_ENABLED: {{ .Values.global.oxshibboleth.enabled | quote }} - {{- end }} - {{ if eq .Values.configmap.cnCacheType "REDIS" }} - CN_REDIS_URL: {{ .Values.configmap.cnRedisUrl | quote }} - CN_REDIS_TYPE: {{ .Values.configmap.cnRedisType | quote }} - CN_REDIS_USE_SSL: {{ .Values.configmap.cnRedisUseSsl | quote }} - CN_REDIS_SSL_TRUSTSTORE: {{ .Values.configmap.cnRedisSslTruststore | quote }} - CN_REDIS_SENTINEL_GROUP: {{ .Values.configmap.cnRedisSentinelGroup | quote }} - {{- end }} - {{- if .Values.global.istio.enabled }} - CN_COUCHBASE_TRUSTSTORE_ENABLE: "false" - CN_LDAP_USE_SSL: "false" - {{- end }} - {{- if .Values.global.scim.enabled }} - CN_SCIM_ENABLED: {{ .Values.global.scim.enabled | quote }} - CN_SCIM_PROTECTION_MODE: {{ .Values.configmap.cnScimProtectionMode | quote }} - CN_SCIM_APP_LOGGERS: {{ .Values.global.scim.appLoggers - | toJson - | replace "scimLogTarget" "scim_log_target" - | replace "scimLogLevel" "scim_log_level" - | replace "persistenceLogTarget" "persistence_log_target" - | replace "persistenceLogLevel" "persistence_log_level" - | replace "persistenceDurationLogTarget" "persistence_duration_log_target" - | replace "persistenceDurationLogLevel" "persistence_duration_log_level" - | replace "ldapStatsLogTarget" "ldap_stats_log_target" - | replace "ldapStatsLogLevel" "ldap_stats_log_level" - | replace "scriptLogTarget" "script_log_target" - | replace "scriptLogLevel" "script_log_level" - | replace "enableStdoutLogPrefix" "enable_stdout_log_prefix" - | squote - }} - {{- end }} - {{- if .Values.global.fido2.enabled }} - CN_FIDO2_APP_LOGGERS: {{ .Values.global.fido2.appLoggers - | toJson - | replace "fido2LogTarget" "fido2_log_target" - | replace "fido2LogLevel" "fido2_log_level" - | replace "persistenceLogTarget" "persistence_log_target" - | replace "persistenceLogLevel" "persistence_log_level" - | replace "enableStdoutLogPrefix" "enable_stdout_log_prefix" - | squote - }} - {{- end }} - {{- if index .Values "global" "admin-ui" "enabled" }} - # ADMIN-UI - ADMIN_UI_JWKS: {{ cat "http://" ( index .Values "global" "auth-server" "authServerServiceName" ) ":8080/jans-auth/restv1/jwks" | quote | nospace }} - CN_CONFIG_API_PLUGINS: "admin-ui,scim,fido2,user-mgt" - CN_ADMIN_UI_PLUGIN_LOGGERS: {{ index .Values "global" "config-api" "adminUiAppLoggers" - | toJson - | replace "adminUiLogTarget" "admin_ui_log_target" - | replace "adminUiLogLevel" "admin_ui_log_level" - | replace "adminUiAuditLogTarget" "admin_ui_audit_log_target" - | replace "adminUiAuditLogLevel" "admin_ui_audit_log_level" - | replace "enableStdoutLogPrefix" "enable_stdout_log_prefix" - | squote - }} - {{- end }} - {{- if .Values.global.casa.enabled }} - # CASA - GLUU_CASA_APP_LOGGERS: {{ .Values.global.casa - | toJson - | replace "casaLogTarget" "casa_log_target" - | replace "casaLogLevel" "casa_log_level" - | replace "timerLogTarget" "timer_log_target" - | replace "timerLogLevel" "timer_log_level" - | replace "enableStdoutLogPrefix" "enable_stdout_log_prefix" - | squote - }} - {{- end }} ---- - -apiVersion: v1 -data: - tls_generator.py: |- - from kubernetes import config, client - import logging - - log_format = '%(asctime)s - %(name)8s - %(levelname)5s - %(message)s' - logging.basicConfig(format=log_format, level=logging.INFO) - logger = logging.getLogger("tls-generator") - - # use the serviceAccount k8s gives to pods - config.load_incluster_config() - core_cli = client.CoreV1Api() - - def patch_or_create_namespaced_secret(name, literal, value_of_literal, namespace="default", - secret_type="Opaque", second_literal=None, value_of_second_literal=None, - data=None): - """Patch secret and if not exist create - :param name: - :param literal: - :param value_of_literal: - :param namespace: - :param secret_type: - :param second_literal: - :param value_of_second_literal: - :param data: - :return: - """ - # Instantiate the Secret object - body = client.V1Secret() - metadata = client.V1ObjectMeta(name=name) - body.data = data - if not data: - body.data = {literal: value_of_literal} - body.metadata = metadata - body.type = secret_type - if second_literal: - body.data = {literal: value_of_literal, second_literal: value_of_second_literal} - try: - core_cli.patch_namespaced_secret(name, namespace, body) - logger.info('Secret {} in namespace {} has been patched'.format(name, namespace)) - return - except client.rest.ApiException as e: - if e.status == 404 or not e.status: - try: - core_cli.create_namespaced_secret(namespace=namespace, body=body) - logger.info('Created secret {} of type {} in namespace {}'.format(name, secret_type, namespace)) - return True - except client.rest.ApiException as e: - logger.exception(e) - return False - logger.exception(e) - return False - - # check if gluu secret exists - def get_certs(secret_name, namespace): - """ - - :param namespace: - :return: ssl cert and key from gluu secrets - """ - ssl_cert = None - ssl_key = None - if core_cli.read_namespaced_secret(secret_name, namespace): - ssl_cert = core_cli.read_namespaced_secret(secret_name, namespace).data['ssl_cert'] - ssl_key = core_cli.read_namespaced_secret(secret_name, namespace).data['ssl_key'] - - return ssl_cert, ssl_key - - - def main(): - namespace = {{.Release.Namespace | quote}} - secret_name = {{ .Values.configmap.cnSecretKubernetesSecret | quote }} - cert, key = get_certs(secret_name, namespace) - # global vars - name = "tls-certificate" - - # if istio is enabled - {{- if.Values.global.istio.ingress}} - namespace = {{.Values.global.istio.namespace | quote}} - {{- end}} - - if cert and key: - patch_or_create_namespaced_secret(name=name, - namespace=namespace, - literal="tls.crt", - value_of_literal=cert, - secret_type="kubernetes.io/tls", - second_literal="tls.key", - value_of_second_literal=key) - else: - logger.error("No certificate or key was found in secrets.") - - if __name__ == "__main__": - main() - -kind: ConfigMap -metadata: - name: {{ include "config.fullname" . }}-tls-script - namespace: {{ .Release.Namespace }} - labels: -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} - ---- - -apiVersion: v1 -data: - updatelbip.py: |- - #!/usr/bin/env python3 - # -*- coding: utf-8 -*- - - # Update the IP of the load balancer automatically - - """ - License terms and conditions for Gluu Cloud Native Edition: - https://www.apache.org/licenses/LICENSE-2.0 - """ - - import socket - import os - import logging - import time - - logger = logging.getLogger("update-lb-ip") - logger.setLevel(logging.INFO) - ch = logging.StreamHandler() - fmt = logging.Formatter('%(levelname)s - %(asctime)s - %(message)s') - ch.setFormatter(fmt) - logger.addHandler(ch) - - - def backup(hosts): - timenow = time.strftime("%c") - timestamp = "Backup occurred %s \n" % timenow - logger.info("Backing up hosts file to /etc/hosts.back ...") - with open('/etc/hosts.back', 'a+') as f: - f.write(timestamp) - for line in hosts: - f.write(line) - - - def get_hosts(lb_addr, domain): - ip_list = [] - hosts_list = [] - ais = socket.getaddrinfo(lb_addr, 0, 0, 0, 0) - for result in ais: - ip_list.append(result[-1][0]) - ip_list = list(set(ip_list)) - for ip in ip_list: - add_host = ip + " " + domain - hosts_list.append(add_host) - - return hosts_list - - - def main(): - try: - while True: - lb_addr = os.environ.get("LB_ADDR", "") - domain = os.environ.get("DOMAIN", "demoexample.gluu.org") - host_file = open('/etc/hosts', 'r').readlines() - hosts = get_hosts(lb_addr, domain) - stop = [] - for host in hosts: - for i in host_file: - if host.replace(" ", "") in i.replace(" ", ""): - stop.append("found") - if len(stop) != len(hosts): - backup(host_file) - logger.info("Writing new hosts file") - with open('/etc/hosts', 'w') as f: - for line in host_file: - if domain not in line: - f.write(line) - for host in hosts: - f.write(host) - f.write("\n") - f.write("\n") - time.sleep(300) - except KeyboardInterrupt: - logger.warning("Canceled by user; exiting ...") - - - if __name__ == "__main__": - main() - -kind: ConfigMap -metadata: - name: {{ .Release.Name }}-updatelbip - namespace: {{ .Release.Namespace }} - labels: -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/config/templates/load-init-config.yml b/charts/gluu/gluu/charts/config/templates/load-init-config.yml deleted file mode 100644 index 43ef9a817..000000000 --- a/charts/gluu/gluu/charts/config/templates/load-init-config.yml +++ /dev/null @@ -1,133 +0,0 @@ -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ include "config.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: configurator -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - ttlSecondsAfterFinished: {{ .Values.global.jobTtlSecondsAfterFinished }} - template: - metadata: - name: {{ include "config.name" . }}-job - labels: - APP_NAME: configurator - app: {{ .Release.Name }}-{{ include "config.name" . }}-init-load - spec: - {{- with .Values.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - dnsPolicy: {{ .Values.dnsPolicy | quote }} - {{- with .Values.dnsConfig }} - dnsConfig: -{{ toYaml . | indent 8 }} - {{- end }} - volumes: - {{- with .Values.volumes }} -{{- toYaml . | nindent 8 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - name: aws-shared-credential-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_shared_credential_file - path: aws_shared_credential_file - - name: aws-config-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_config_file - path: aws_config_file - - name: aws-secrets-replica-regions - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_secrets_replica_regions - path: aws_secrets_replica_regions - {{- end }} - - name: {{ include "config.fullname" . }}-mount-gen-file - secret: - secretName: {{ include "config.fullname" . }}-gen-json-file - - name: {{ include "config.fullname" . }}-tls-script - configMap: - name: {{ include "config.fullname" . }}-tls-script - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - name: google-sa - secret: - secretName: {{ .Release.Name }}-google-sa - {{- end }} - containers: - - name: {{ include "config.name" . }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - securityContext: - runAsUser: 1000 - runAsNonRoot: true - env: - {{- include "config.usr-envs" . | indent 12 }} - {{- include "config.usr-secret-envs" . | indent 12 }} - volumeMounts: - {{- with .Values.volumeMounts }} -{{- toYaml . | nindent 10 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }} - name: aws-shared-credential-file - subPath: aws_shared_credential_file - - mountPath: {{ .Values.global.cnAwsConfigFile }} - name: aws-config-file - subPath: aws_config_file - - mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }} - name: aws-secrets-replica-regions - subPath: aws_secrets_replica_regions - {{- end }} - - mountPath: /app/db/generate.json - name: {{ include "config.fullname" . }}-mount-gen-file - subPath: generate.json - - mountPath: /scripts/tls_generator.py - name: {{ include "config.fullname" . }}-tls-script - subPath: tls_generator.py - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - mountPath: {{ .Values.global.cnGoogleApplicationCredentials }} - name: google-sa - subPath: google-credentials.json - {{- end }} - envFrom: - - configMapRef: - name: {{ .Release.Name }}-config-cm - {{ if .Values.global.usrEnvs.secret }} - - secretRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - {{ if .Values.global.usrEnvs.normal }} - - configMapRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - resources: -{{- toYaml .Values.resources | nindent 10 }} - command: - - tini - - -g - - -- - - /bin/sh - - -c - - | - {{- if .Values.migration.enabled }} - /app/scripts/entrypoint.sh migrate --migration-dir {{ .Values.migration.migrationDir | quote }} --data-format {{ .Values.migration.migrationDataFormat | quote }} - {{- else }} - /app/scripts/entrypoint.sh load - {{- end }} - /usr/bin/python3 /scripts/tls_generator.py - {{- if .Values.global.istio.enabled }} - curl -X POST http://localhost:15020/quitquitquit - {{- end }} - restartPolicy: Never diff --git a/charts/gluu/gluu/charts/config/templates/ob-secrets.yaml b/charts/gluu/gluu/charts/config/templates/ob-secrets.yaml deleted file mode 100644 index cdb1f9041..000000000 --- a/charts/gluu/gluu/charts/config/templates/ob-secrets.yaml +++ /dev/null @@ -1,71 +0,0 @@ -{{ if .Values.global.cnObExtSigningJwksCrt }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-ob-ext-signing-jwks-crt-key-pin - labels: -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} - namespace: {{ .Release.Namespace }} -type: Opaque -data: - ob-ext-signing.crt: {{ .Values.global.cnObExtSigningJwksCrt }} - {{ if .Values.global.cnObExtSigningJwksKey }} - ob-ext-signing.key: {{ .Values.global.cnObExtSigningJwksKey }} - {{- end }} - {{ if .Values.global.cnObExtSigningJwksKeyPassPhrase }} - ob-ext-signing.pin: {{ .Values.global.cnObExtSigningJwksKeyPassPhrase }} - {{- end }} -{{- end }} -{{ if .Values.global.cnObTransportCrt }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-ob-transport-crt-key-pin - labels: -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} - namespace: {{ .Release.Namespace }} -type: Opaque -data: - ob-transport.crt: {{ .Values.global.cnObTransportCrt }} - {{ if .Values.global.cnObTransportKey }} - ob-transport.key: {{ .Values.global.cnObTransportKey }} - {{- end }} - {{ if .Values.global.cnObTransportKeyPassPhrase }} - ob-transport.pin: {{ .Values.global.cnObTransportKeyPassPhrase }} - {{- end }} -{{- end }} -{{ if .Values.global.cnObTransportTrustStore }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-ob-transport-truststore - labels: -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} - namespace: {{ .Release.Namespace }} -type: Opaque -data: - ob-transport-truststore.p12: {{ .Values.global.cnObTransportTrustStore }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/config/templates/rolebinding.yaml b/charts/gluu/gluu/charts/config/templates/rolebinding.yaml deleted file mode 100644 index 7a58fd609..000000000 --- a/charts/gluu/gluu/charts/config/templates/rolebinding.yaml +++ /dev/null @@ -1,23 +0,0 @@ -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-{{ .Release.Namespace }}-rolebinding - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: configurator -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -subjects: -- kind: User - name: system:serviceaccount:{{ .Release.Namespace }}:default # Name is case sensitive - apiGroup: rbac.authorization.k8s.io -roleRef: - kind: Role # this must be Role or ClusterRole - name: {{ .Release.Name }}-{{ .Release.Namespace }}-cn-role # this must match the name of the Role or ClusterRole you wish to bind to - apiGroup: rbac.authorization.k8s.io \ No newline at end of file diff --git a/charts/gluu/gluu/charts/config/templates/roles.yaml b/charts/gluu/gluu/charts/config/templates/roles.yaml deleted file mode 100644 index ef3d0c708..000000000 --- a/charts/gluu/gluu/charts/config/templates/roles.yaml +++ /dev/null @@ -1,19 +0,0 @@ -kind: Role -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: {{ .Release.Name }}-{{ .Release.Namespace }}-cn-role - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: configurator -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -rules: -- apiGroups: [""] # "" refers to the core API group - resources: ["configmaps", "secrets"] - verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] diff --git a/charts/gluu/gluu/charts/config/templates/secrets.yaml b/charts/gluu/gluu/charts/config/templates/secrets.yaml deleted file mode 100644 index 78e9093cf..000000000 --- a/charts/gluu/gluu/charts/config/templates/secrets.yaml +++ /dev/null @@ -1,127 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "config.fullname" . }}-gen-json-file - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: configurator -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -stringData: - generate.json: |- - { - "hostname": {{ .Values.global.fqdn | quote }}, - "country_code": {{ .Values.countryCode | quote }}, - "state": {{ .Values.state | quote }}, - "city": {{ .Values.city | quote }}, - "admin_pw": {{ .Values.adminPassword | quote }}, - "ldap_pw": {{ .Values.ldapPassword | quote }}, - "redis_pw": {{ .Values.redisPassword | quote }}, - "email": {{ .Values.email | quote }}, - "org_name": {{ .Values.orgName | quote }}, - {{ if eq .Values.global.cnPersistenceType "sql" }} - "sql_pw": {{ .Values.configmap.cnSqldbUserPassword | quote }}, - {{- end }} - {{ if or ( eq .Values.global.cnPersistenceType "couchbase" ) ( eq .Values.global.cnPersistenceType "hybrid" ) }} - "couchbase_pw": {{ .Values.configmap.cnCouchbasePassword | quote }}, - "couchbase_superuser_pw": {{ .Values.configmap.cnCouchbaseSuperUserPassword | quote }}, - {{- end }} - "auth_sig_keys": {{ index .Values "global" "auth-server" "authSigKeys" | quote }}, - "auth_enc_keys": {{ index .Values "global" "auth-server" "authEncKeys" | quote }}, - "optional_scopes": {{ list (include "config.optionalScopes" . | fromJsonArray | join ",") }} - } - -{{ if or ( eq .Values.global.cnPersistenceType "couchbase" ) ( eq .Values.global.cnPersistenceType "hybrid" ) }} -{{- if not .Values.global.istio.enabled }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-cb-crt - labels: -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -data: - couchbase.crt: {{ .Values.configmap.cnCouchbaseCrt }} -{{- end }} -{{- end }} -{{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-aws-config-creds - labels: -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -stringData: - aws_shared_credential_file: |- - [{{ .Values.configmap.cnAwsProfile | quote }}] - aws_access_key_id = {{ .Values.configmap.cnAwsAccessKeyId }} - aws_secret_access_key = {{ .Values.configmap.cnAwsSecretAccessKey }} - aws_config_file: |- - [{{ .Values.configmap.cnAwsProfile | quote }}] - region = {{ .Values.configmap.cnAwsDefaultRegion | quote }} - aws_secrets_replica_regions: |- - {{ .Values.configmap.cnAwsSecretsReplicaRegions | toJson }} -{{- end }} -{{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-google-sa - labels: -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -data: - google-credentials.json: {{ .Values.configmap.cnGoogleSecretManagerServiceAccount }} -{{- end}} - -{{- if or (eq .Values.global.cnPersistenceType "ldap") (eq .Values.global.cnPersistenceType "hybrid") }} ---- -# Consider removing secret after moving ldapPass to global. This is only used by the cronJob ldap backup. -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-ldap-cron-pass - labels: -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -data: - password: {{ .Values.ldapPassword | b64enc }} -{{- end}} diff --git a/charts/gluu/gluu/charts/config/templates/service.yaml b/charts/gluu/gluu/charts/config/templates/service.yaml deleted file mode 100644 index da5dedf89..000000000 --- a/charts/gluu/gluu/charts/config/templates/service.yaml +++ /dev/null @@ -1,27 +0,0 @@ -{{- if ( .Values.global.istio.enabled) }} -# License terms and conditions: -# https://www.apache.org/licenses/LICENSE-2.0 -# Used with Istio -apiVersion: v1 -kind: Service -metadata: - name: {{ include "config.fullname" . }} - labels: - APP_NAME: configurator -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - ports: - - name: http - port: 80 - targetPort: 8080 - selector: - app: {{ .Release.Name }}-{{ include "config.name" . }}-init-load - type: ClusterIP -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/config/templates/user-custom-envs.yaml b/charts/gluu/gluu/charts/config/templates/user-custom-envs.yaml deleted file mode 100644 index 35b4fa8cb..000000000 --- a/charts/gluu/gluu/charts/config/templates/user-custom-envs.yaml +++ /dev/null @@ -1,64 +0,0 @@ -{{ if .Values.global.usrEnvs.secret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-global-user-custom-envs - labels: - APP_NAME: configurator -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -data: - {{- range $key, $val := .Values.global.usrEnvs.secret }} - {{ $key }}: {{ $val | b64enc }} - {{- end}} -{{- end}} -{{ if .Values.global.usrEnvs.normal }} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ .Release.Name }}-global-user-custom-envs - labels: - APP_NAME: configurator -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -data: - {{- range $key, $val := .Values.global.usrEnvs.normal }} - {{ $key }}: {{ $val | quote }} - {{- end}} -{{- end}} -{{ if .Values.usrEnvs.secret }} ---- -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-{{ .Chart.Name }}-user-custom-envs - labels: - APP_NAME: configurator -{{ include "config.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -data: - {{- range $key, $val := .Values.usrEnvs.secret }} - {{ $key }}: {{ $val | b64enc }} - {{- end}} -{{- end}} diff --git a/charts/gluu/gluu/charts/config/values.yaml b/charts/gluu/gluu/charts/config/values.yaml deleted file mode 100644 index b3bf09276..000000000 --- a/charts/gluu/gluu/charts/config/values.yaml +++ /dev/null @@ -1,160 +0,0 @@ - -# Required environment variables for generating Gluu server initial config -# -- Add custom normal and secret envs to the service. -usrEnvs: - # -- Add custom normal envs to the service. - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service. - # variable1: value1 - secret: {} -# -- Admin password to log in to the UI. -adminPassword: Test1234# -# -- City. Used for certificate creation. -city: Austin -configmap: - # -- Jetty header size in bytes in the auth server - cnJettyRequestHeaderSize: 8192 - # -- SQL database dialect. `mysql` or `pgsql` - cnSqlDbDialect: mysql - # -- SQL database host uri. - cnSqlDbHost: my-release-mysql.default.svc.cluster.local - # -- SQL database port. - cnSqlDbPort: 3306 - # -- SQL database name. - cnSqlDbName: gluu - # -- SQL database username. - cnSqlDbUser: gluu - # -- SQL database timezone. - cnSqlDbTimezone: UTC - # -- SQL password injected in the secrets. - cnSqldbUserPassword: Test1234# - # -- Cache type. `NATIVE_PERSISTENCE`, `REDIS`. or `IN_MEMORY`. Defaults to `NATIVE_PERSISTENCE` . - cnCacheType: NATIVE_PERSISTENCE - containerMetadataName: kubernetes - # -- The name of the Kubernetes ConfigMap that will hold the configuration layer - cnConfigKubernetesConfigMap: cn - # -- The prefix of couchbase buckets. This helps with separation in between different environments and allows for the same couchbase cluster to be used by different setups of Gluu. - cnCouchbaseBucketPrefix: jans - # -- Couchbase certificate authority string. This must be encoded using base64. This can also be found in your couchbase UI Security > Root Certificate. In mTLS setups this is not required. - cnCouchbaseCrt: SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo= - # -- The number of replicas per index created. Please note that the number of index nodes must be one greater than the number of index replicas. That means if your couchbase cluster only has 2 index nodes you cannot place the number of replicas to be higher than 1. - cnCouchbaseIndexNumReplica: 0 - # -- Couchbase password for the restricted user config.configmap.cnCouchbaseUser that is often used inside the services. The password must contain one digit, one uppercase letter, one lower case letter and one symbol . - cnCouchbasePassword: P@ssw0rd - # -- The Couchbase super user (admin) user name. This user is used during initialization only. - cnCouchbaseSuperUser: admin - # -- Couchbase password for the super user config.configmap.cnCouchbaseSuperUser that is used during the initialization process. The password must contain one digit, one uppercase letter, one lower case letter and one symbol - cnCouchbaseSuperUserPassword: Test1234# - # -- Couchbase URL. Used only when global.cnPersistenceType is hybrid or couchbase. This should be in FQDN format for either remote or local Couchbase clusters. The address can be an internal address inside the kubernetes cluster - cnCouchbaseUrl: cbgluu.default.svc.cluster.local - # -- Couchbase restricted user. Used only when global.cnPersistenceType is hybrid or couchbase. - cnCouchbaseUser: gluu - # [google_envs] Envs related to using Google - # -- Service account with roles roles/secretmanager.admin base64 encoded string. This is used often inside the services to reach the configuration layer. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnGoogleSecretManagerServiceAccount: SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo= - # -- Project id of the google project the secret manager belongs to. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnGoogleProjectId: google-project-to-save-config-and-secrets-to - # [google_spanner_envs] Envs related to using Google Secret Manager to store config and secret layer - # -- Google Spanner ID. Used only when global.cnPersistenceType is spanner. - cnGoogleSpannerInstanceId: "" - # -- Google Spanner Database ID. Used only when global.cnPersistenceType is spanner. - cnGoogleSpannerDatabaseId: "" - # [google_spanner_envs] END - # [google_secret_manager_envs] Envs related to using Google Secret Manager to store config and secret layer - # -- Secret version to be used for secret configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnSecretGoogleSecretVersionId: "latest" - # -- Prefix for Gluu secret in Google Secret Manager. Defaults to gluu. If left gluu-secret secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnSecretGoogleSecretNamePrefix: gluu - # -- Passphrase for Gluu secret in Google Secret Manager. This is used for encrypting and decrypting data from the Google Secret Manager. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnGoogleSecretManagerPassPhrase: Test1234# - # -- Secret version to be used for configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnConfigGoogleSecretVersionId: "latest" - # -- Prefix for Gluu configuration secret in Google Secret Manager. Defaults to gluu. If left intact gluu-configuration secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnConfigGoogleSecretNamePrefix: gluu - # [google_secret_manager_envs] END - # [google_envs] END - # -- OpenDJ internal address. Leave as default. Used when `global.cnPersistenceType` is set to `ldap`. - cnLdapUrl: "opendj:1636" - # -- Value passed to Java option -XX:MaxRAMPercentage - cnMaxRamPercent: "75.0" - # -- Specify data that should be saved in each persistence (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType` is set to `hybrid`. - #{ - # "default": "", - # "user": "", - # "site": "", - # "cache": "", - # "token": "", - # "session": "", - #} - cnPersistenceHybridMapping: "{}" - # -- Redis Sentinel Group. Often set when `config.configmap.cnRedisType` is set to `SENTINEL`. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. - cnRedisSentinelGroup: "" - # -- Redis SSL truststore. Optional. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. - cnRedisSslTruststore: "" - # -- Redis service type. `STANDALONE` or `CLUSTER`. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. - cnRedisType: STANDALONE - # -- Redis URL and port number :. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. - cnRedisUrl: "redis.redis.svc.cluster.local:6379" - # -- Boolean to use SSL in Redis. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. - cnRedisUseSsl: false - # -- Kubernetes secret name holding configuration keys. Used when global.configSecretAdapter is set to kubernetes which is the default. - cnSecretKubernetesSecret: cn - # -- Loadbalancer address for AWS if the FQDN is not registered. - lbAddr: "" -# -- Country code. Used for certificate creation. -countryCode: US -# -- Email address of the administrator usually. Used for certificate creation. -email: support@gluu.org -image: - # -- Image to use for deploying. - repository: janssenproject/configurator - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] -# -- LDAP admin password if OpennDJ is used for persistence. -ldapPassword: P@ssw0rds -# -- Organization name. Used for certificate creation. -orgName: Gluu -# -- Redis admin password if `config.configmap.cnCacheType` is set to `REDIS`. -redisPassword: P@assw0rd -# -- Resource specs. -resources: - limits: - # -- CPU limit. - cpu: 300m - # -- Memory limit. - memory: 300Mi - requests: - # -- CPU request. - cpu: 300m - # -- Memory request. - memory: 300Mi -# -- State code. Used for certificate creation. -state: TX -# -- Configure any additional volumes that need to be attached to the pod -volumes: [] -# -- Configure any additional volumesMounts that need to be attached to the containers -volumeMounts: [] -# -- Add custom dns policy -dnsPolicy: "" -# -- Add custom dns config -dnsConfig: {} -# -- CE to CN Migration section -migration: - # -- Boolean flag to enable migration from CE - enabled: false - # -- Directory holding all migration files - migrationDir: /ce-migration - # -- migration data-format depending on persistence backend. - # Supported data formats are ldif, couchbase+json, spanner+avro, postgresql+json, and mysql+json. - migrationDataFormat: ldif - -nameOverride: "" -fullNameOverride: "" - -# -- Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} -additionalLabels: { } -# -- Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken -additionalAnnotations: { } diff --git a/charts/gluu/gluu/charts/fido2/.helmignore b/charts/gluu/gluu/charts/fido2/.helmignore deleted file mode 100644 index f0c131944..000000000 --- a/charts/gluu/gluu/charts/fido2/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/charts/gluu/gluu/charts/fido2/Chart.yaml b/charts/gluu/gluu/charts/fido2/Chart.yaml deleted file mode 100644 index 507d24467..000000000 --- a/charts/gluu/gluu/charts/fido2/Chart.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: v2 -appVersion: 5.0.0 -description: FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging - common devices to authenticate to online services in both mobile and desktop environments. -home: https://gluu.org/docs/gluu-server/ -icon: https://gluu.org/docs/gluu-server/favicon.ico -keywords: -- fido2 -- u2f -kubeVersion: '>=v1.21.0-0' -maintainers: -- email: support@gluu.org - name: Mohammad Abudayyeh - url: https://github.com/moabu -name: fido2 -sources: -- https://gluu.org/docs/gluu-server/ -- https://github.com/JanssenProject/jans/jans-fido2 -- https://github.com/JanssenProject/jans/docker-jans-fido2 -- https://github.com/GluuFederation/flex/tree/main/flex-cn-setup/pygluu/kubernetes/templates/helm/gluu/charts/fido2 -type: application -version: 5.0.10 diff --git a/charts/gluu/gluu/charts/fido2/README.md b/charts/gluu/gluu/charts/fido2/README.md deleted file mode 100644 index 2e4ca787a..000000000 --- a/charts/gluu/gluu/charts/fido2/README.md +++ /dev/null @@ -1,61 +0,0 @@ -# fido2 - -![Version: 5.0.10](https://img.shields.io/badge/Version-5.0.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0](https://img.shields.io/badge/AppVersion-5.0.0-informational?style=flat-square) - -FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments. - -**Homepage:** - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| Mohammad Abudayyeh | | | - -## Source Code - -* -* -* -* - -## Requirements - -Kubernetes: `>=v1.21.0-0` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| additionalAnnotations | object | `{}` | Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken | -| additionalLabels | object | `{}` | Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} | -| dnsConfig | object | `{}` | Add custom dns config | -| dnsPolicy | string | `""` | Add custom dns policy | -| hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| hpa.behavior | object | `{}` | Scaling Policies | -| hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| image.pullSecrets | list | `[]` | Image Pull Secrets | -| image.repository | string | `"janssenproject/fido2"` | Image to use for deploying. | -| image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| livenessProbe | object | `{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the liveness healthcheck for the fido2 if needed. | -| livenessProbe.httpGet | object | `{"path":"/jans-fido2/sys/health-check","port":"http-fido2"}` | http liveness probe endpoint | -| readinessProbe | object | `{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the readiness healthcheck for the fido2 if needed. | -| replicas | int | `1` | Service replica number. | -| resources | object | `{"limits":{"cpu":"500m","memory":"500Mi"},"requests":{"cpu":"500m","memory":"500Mi"}}` | Resource specs. | -| resources.limits.cpu | string | `"500m"` | CPU limit. | -| resources.limits.memory | string | `"500Mi"` | Memory limit. | -| resources.requests.cpu | string | `"500m"` | CPU request. | -| resources.requests.memory | string | `"500Mi"` | Memory request. | -| service.name | string | `"http-fido2"` | The name of the fido2 port within the fido2 service. Please keep it as default. | -| service.port | int | `8080` | Port of the fido2 service. Please keep it as default. | -| service.sessionAffinity | string | `"None"` | Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP | -| service.sessionAffinityConfig | object | `{"clientIP":{"timeoutSeconds":10800}}` | the maximum session sticky time if sessionAffinity is ClientIP | -| usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/gluu/gluu/charts/fido2/templates/_helpers.tpl b/charts/gluu/gluu/charts/fido2/templates/_helpers.tpl deleted file mode 100644 index 10484b1e9..000000000 --- a/charts/gluu/gluu/charts/fido2/templates/_helpers.tpl +++ /dev/null @@ -1,98 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "fido2.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "fido2.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "fido2.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* - Common labels -*/}} -{{- define "fido2.labels" -}} -app: {{ .Release.Name }}-{{ include "fido2.name" . }} -helm.sh/chart: {{ include "fido2.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Create user custom defined envs -*/}} -{{- define "fido2.usr-envs"}} -{{- range $key, $val := .Values.usrEnvs.normal }} -- name: {{ $key }} - value: {{ $val | quote }} -{{- end }} -{{- end }} - -{{/* -Create user custom defined secret envs -*/}} -{{- define "fido2.usr-secret-envs"}} -{{- range $key, $val := .Values.usrEnvs.secret }} -- name: {{ $key }} - valueFrom: - secretKeyRef: - name: {{ $.Release.Name }}-{{ $.Chart.Name }}-user-custom-envs - key: {{ $key | quote }} -{{- end }} -{{- end }} - -{{/* -Create topologySpreadConstraints lists -*/}} -{{- define "fido2.topology-spread-constraints"}} -{{- range $key, $val := .Values.topologySpreadConstraints }} -- maxSkew: {{ $val.maxSkew }} - {{- if $val.minDomains }} - minDomains: {{ $val.minDomains }} # optional; beta since v1.25 - {{- end}} - {{- if $val.topologyKey }} - topologyKey: {{ $val.topologyKey }} - {{- end}} - {{- if $val.whenUnsatisfiable }} - whenUnsatisfiable: {{ $val.whenUnsatisfiable }} - {{- end}} - labelSelector: - matchLabels: - app: {{ $.Release.Name }}-{{ include "fido2.name" $ }} - {{- if $val.matchLabelKeys }} - matchLabelKeys: {{ $val.matchLabelKeys }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeAffinityPolicy }} - nodeAffinityPolicy: {{ $val.nodeAffinityPolicy }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeTaintsPolicy }} - nodeTaintsPolicy: {{ $val.nodeTaintsPolicy }} # optional; alpha since v1.25 - {{- end}} -{{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/fido2/templates/deployment.yml b/charts/gluu/gluu/charts/fido2/templates/deployment.yml deleted file mode 100644 index 2c862cc3b..000000000 --- a/charts/gluu/gluu/charts/fido2/templates/deployment.yml +++ /dev/null @@ -1,174 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "fido2.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: fido2 -{{ include "fido2.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - replicas: {{ .Values.replicas }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "fido2.name" . }} - template: - metadata: - labels: - APP_NAME: fido2 - app: {{ .Release.Name }}-{{ include "fido2.name" . }} - {{- if .Values.global.istio.ingress }} - annotations: - sidecar.istio.io/rewriteAppHTTPProbers: "true" - {{- end }} - spec: - {{- with .Values.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - dnsPolicy: {{ .Values.dnsPolicy | quote }} - {{- with .Values.dnsConfig }} - dnsConfig: -{{ toYaml . | indent 8 }} - {{- end }} - {{- if .Values.topologySpreadConstraints }} - topologySpreadConstraints: - {{- include "fido2.topology-spread-constraints" . | indent 8 }} - {{- end }} - containers: - - name: {{ include "fido2.name" . }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} - securityContext: - runAsUser: 1000 - runAsNonRoot: true - env: - {{- include "fido2.usr-envs" . | indent 12 }} - {{- include "fido2.usr-secret-envs" . | indent 12 }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - command: - - /bin/sh - - -c - - | - /usr/bin/python3 /scripts/updatelbip.py & - /app/scripts/entrypoint.sh - {{- end}} - ports: - - name: {{ .Values.service.name }} - containerPort: {{ .Values.service.port }} - {{ if .Values.global.cnPrometheusPort }} - - name: prometheus-port - containerPort: {{ .Values.global.cnPrometheusPort }} - {{- end }} - envFrom: - - configMapRef: - name: {{ .Release.Name }}-config-cm - {{ if .Values.global.usrEnvs.secret }} - - secretRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - {{ if .Values.global.usrEnvs.normal }} - - configMapRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - volumeMounts: - {{- with .Values.volumeMounts }} -{{- toYaml . | nindent 10 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }} - name: aws-shared-credential-file - subPath: aws_shared_credential_file - - mountPath: {{ .Values.global.cnAwsConfigFile }} - name: aws-config-file - subPath: aws_config_file - - mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }} - name: aws-secrets-replica-regions - subPath: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - mountPath: {{ .Values.global.cnGoogleApplicationCredentials }} - name: google-sa - subPath: google-credentials.json - {{- end }} - - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "fido2.fullname" .}}-updatelbip - mountPath: "/scripts" - {{- end }} - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - mountPath: "/etc/certs/couchbase.crt" - subPath: couchbase.crt - {{- end }} - {{- end }} - livenessProbe: -{{- toYaml .Values.livenessProbe | nindent 10 }} - readinessProbe: -{{- toYaml .Values.readinessProbe | nindent 10 }} - {{- if and ( .Values.global.opendj.enabled ) (or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath")) }} - resources: {} - {{- else if .Values.global.cloud.testEnviroment }} - resources: {} - {{- else }} - resources: -{{- toYaml .Values.resources | nindent 10 }} - {{- end }} - {{- if not .Values.global.isFqdnRegistered }} - hostAliases: - - ip: {{ .Values.global.lbIp }} - hostnames: - - {{ .Values.global.fqdn }} - {{- end }} - volumes: - {{- with .Values.volumes }} -{{- toYaml . | nindent 8 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - name: aws-shared-credential-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_shared_credential_file - path: aws_shared_credential_file - - name: aws-config-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_config_file - path: aws_config_file - - name: aws-secrets-replica-regions - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_secrets_replica_regions - path: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - name: google-sa - secret: - secretName: {{ .Release.Name }}-google-sa - {{- end }} - - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - secret: - secretName: {{ .Release.Name }}-cb-crt - {{- end }} - {{- end }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "fido2.fullname" . }}-updatelbip - configMap: - name: {{ .Release.Name }}-updatelbip - {{- end }} - \ No newline at end of file diff --git a/charts/gluu/gluu/charts/fido2/templates/fido2-destination-rules.yaml b/charts/gluu/gluu/charts/fido2/templates/fido2-destination-rules.yaml deleted file mode 100644 index 2457647e8..000000000 --- a/charts/gluu/gluu/charts/fido2/templates/fido2-destination-rules.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- if .Values.global.istio.enabled }} -apiVersion: networking.istio.io/v1alpha3 -kind: DestinationRule -metadata: - name: {{ .Release.Name }}-fido2-mtls - namespace: {{.Release.Namespace}} - labels: - APP_NAME: fido2 -{{ include "fido2.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - host: {{ .Values.global.fido2.fido2ServiceName }}.{{ .Release.Namespace }}.svc.cluster.local - trafficPolicy: - tls: - mode: ISTIO_MUTUAL -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/fido2/templates/fido2-pdb.yaml b/charts/gluu/gluu/charts/fido2/templates/fido2-pdb.yaml deleted file mode 100644 index ebc9ce8dc..000000000 --- a/charts/gluu/gluu/charts/fido2/templates/fido2-pdb.yaml +++ /dev/null @@ -1,11 +0,0 @@ -{{ if .Values.pdb.enabled -}} -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ include "fido2.fullname" . }} -spec: - maxUnavailable: {{ .Values.pdb.maxUnavailable }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "fido2.name" . }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/fido2/templates/fido2-virtual-services.yaml b/charts/gluu/gluu/charts/fido2/templates/fido2-virtual-services.yaml deleted file mode 100644 index 88a91a994..000000000 --- a/charts/gluu/gluu/charts/fido2/templates/fido2-virtual-services.yaml +++ /dev/null @@ -1,40 +0,0 @@ -{{- if and (.Values.global.istio.ingress) (.Values.global.fido2.ingress.fido2ConfigEnabled) }} -apiVersion: networking.istio.io/v1alpha3 -kind: VirtualService -metadata: - name: {{ .Release.Name }}-istio-fido2-configuration - namespace: {{.Release.Namespace}} - labels: - APP_NAME: fido2 -{{ include "fido2.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - hosts: - - {{ .Values.global.fqdn }} -{{- if .Values.global.istio.gateways }} - gateways: -{{ toYaml .Values.global.istio.gateways | indent 2 }} -{{- else }} - gateways: - - {{ .Release.Name }}-global-gtw -{{- end }} - http: - - name: {{ .Release.Name }}-istio-fido2-configuration - match: - - uri: - prefix: /.well-known/fido2-configuration - rewrite: - uri: /jans-fido2/restv1/fido2/configuration - route: - - destination: - host: {{ .Values.global.fido2.fido2ServiceName }}.{{.Release.Namespace}}.svc.cluster.local - port: - number: 8080 - weight: 100 -{{- end }} diff --git a/charts/gluu/gluu/charts/fido2/templates/hpa.yaml b/charts/gluu/gluu/charts/fido2/templates/hpa.yaml deleted file mode 100644 index a4f1362a7..000000000 --- a/charts/gluu/gluu/charts/fido2/templates/hpa.yaml +++ /dev/null @@ -1,37 +0,0 @@ -{{ if .Values.hpa.enabled -}} -apiVersion: autoscaling/v1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "fido2.fullname" . }} - labels: - APP_NAME: fido2 -{{ include "fido2.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "fido2.fullname" . }} - minReplicas: {{ .Values.hpa.minReplicas }} - maxReplicas: {{ .Values.hpa.maxReplicas }} - {{- if .Values.hpa.targetCPUUtilizationPercentage }} - targetCPUUtilizationPercentage: {{ .Values.hpa.targetCPUUtilizationPercentage }} - {{- else if .Values.hpa.metrics }} - metrics: - {{- with .Values.hpa.metrics }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} - {{- if .Values.hpa.behavior }} - behavior: - {{- with .Values.hpa.behavior }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/fido2/templates/service.yml b/charts/gluu/gluu/charts/fido2/templates/service.yml deleted file mode 100644 index de91e893b..000000000 --- a/charts/gluu/gluu/charts/fido2/templates/service.yml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ .Values.global.fido2.fido2ServiceName }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: fido2 -{{ include "fido2.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - {{- if .Values.global.alb.ingress }} - type: NodePort - {{- end }} - ports: - - port: {{ .Values.service.port }} - name: {{ .Values.service.name }} - selector: - app: {{ .Release.Name }}-{{ include "fido2.name" . }} #fido2 - sessionAffinity: {{ .Values.service.sessionAffinity }} - {{- with .Values.service.sessionAffinityConfig }} - sessionAffinityConfig: -{{ toYaml . | indent 4 }} - {{- end }} diff --git a/charts/gluu/gluu/charts/fido2/templates/user-custom-secret-envs.yaml b/charts/gluu/gluu/charts/fido2/templates/user-custom-secret-envs.yaml deleted file mode 100644 index e2139ba45..000000000 --- a/charts/gluu/gluu/charts/fido2/templates/user-custom-secret-envs.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{ if .Values.usrEnvs.secret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-{{ .Chart.Name }}-user-custom-envs - labels: - APP_NAME: fido2 -{{ include "fido2.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -data: - {{- range $key, $val := .Values.usrEnvs.secret }} - {{ $key }}: {{ $val | b64enc }} - {{- end}} -{{- end}} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/fido2/values.yaml b/charts/gluu/gluu/charts/fido2/values.yaml deleted file mode 100644 index f29b2392d..000000000 --- a/charts/gluu/gluu/charts/fido2/values.yaml +++ /dev/null @@ -1,85 +0,0 @@ - -# -- FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments. - -# -- Configure the HorizontalPodAutoscaler -hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} -# -- Add custom normal and secret envs to the service -usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} -# -- Add custom dns policy -dnsPolicy: "" -# -- Add custom dns config -dnsConfig: {} -image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: janssenproject/fido2 - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] -# -- Service replica number. -replicas: 1 -# -- Resource specs. -resources: - limits: - # -- CPU limit. - cpu: 500m - # -- Memory limit. - memory: 500Mi - requests: - # -- CPU request. - cpu: 500m - # -- Memory request. - memory: 500Mi -service: - # -- The name of the fido2 port within the fido2 service. Please keep it as default. - name: http-fido2 - # -- Port of the fido2 service. Please keep it as default. - port: 8080 - # -- Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP - sessionAffinity: None - # -- the maximum session sticky time if sessionAffinity is ClientIP - sessionAffinityConfig: - clientIP: - timeoutSeconds: 10800 -# -- Configure the liveness healthcheck for the fido2 if needed. -livenessProbe: - # -- http liveness probe endpoint - httpGet: - path: /jans-fido2/sys/health-check - port: http-fido2 - initialDelaySeconds: 25 - periodSeconds: 25 - timeoutSeconds: 5 -# -- Configure the readiness healthcheck for the fido2 if needed. -readinessProbe: - httpGet: - path: /jans-fido2/sys/health-check - port: http-fido2 - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 -# -- Configure any additional volumes that need to be attached to the pod -volumes: [] -# -- Configure any additional volumesMounts that need to be attached to the containers -volumeMounts: [] - -# -- Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} -additionalLabels: { } -# -- Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken -additionalAnnotations: { } diff --git a/charts/gluu/gluu/charts/nginx-ingress/.helmignore b/charts/gluu/gluu/charts/nginx-ingress/.helmignore deleted file mode 100644 index f0c131944..000000000 --- a/charts/gluu/gluu/charts/nginx-ingress/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/charts/gluu/gluu/charts/nginx-ingress/Chart.yaml b/charts/gluu/gluu/charts/nginx-ingress/Chart.yaml deleted file mode 100644 index 97a849258..000000000 --- a/charts/gluu/gluu/charts/nginx-ingress/Chart.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: v2 -appVersion: 5.0.0 -description: Nginx ingress definitions chart -home: https://gluu.org/docs/gluu-server -icon: https://gluu.org/docs/gluu-server/favicon.ico -keywords: -- nginx -- ingress -kubeVersion: '>=v1.21.0-0' -maintainers: -- email: support@gluu.org - name: Mohammad Abudayyeh - url: https://github.com/moabu -name: nginx-ingress -sources: -- https://github.com/kubernetes/ingress-nginx -- https://kubernetes.io/docs/concepts/services-networking/ingress/ -- https://github.com/GluuFederation/flex/tree/main/flex-cn-setup/pygluu/kubernetes/templates/helm/gluu/charts/nginx-ingress -type: application -version: 5.0.10 diff --git a/charts/gluu/gluu/charts/nginx-ingress/README.md b/charts/gluu/gluu/charts/nginx-ingress/README.md deleted file mode 100644 index f187d3b74..000000000 --- a/charts/gluu/gluu/charts/nginx-ingress/README.md +++ /dev/null @@ -1,62 +0,0 @@ -# nginx-ingress - -![Version: 5.0.10](https://img.shields.io/badge/Version-5.0.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0](https://img.shields.io/badge/AppVersion-5.0.0-informational?style=flat-square) - -Nginx ingress definitions chart - -**Homepage:** - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| Mohammad Abudayyeh | | | - -## Source Code - -* -* -* - -## Requirements - -Kubernetes: `>=v1.21.0-0` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| fullnameOverride | string | `""` | | -| ingress | object | `{"additionalAnnotations":{"kubernetes.io/ingress.class":"nginx"},"additionalLabels":{},"authServerAdditionalAnnotations":{},"authServerLabels":{},"deviceCodeAdditionalAnnotations":{},"deviceCodeLabels":{},"enabled":true,"fido2ConfigAdditionalAnnotations":{},"fido2ConfigLabels":{},"fido2Enabled":false,"fido2Labels":{},"firebaseMessagingAdditionalAnnotations":{},"firebaseMessagingLabels":{},"hosts":["demoexample.gluu.org"],"legacy":false,"openidAdditionalAnnotations":{},"openidConfigLabels":{},"path":"/","scimAdditionalAnnotations":{},"scimConfigAdditionalAnnotations":{},"scimConfigLabels":{},"scimLabels":{},"tls":[{"hosts":["demoexample.gluu.org"],"secretName":"tls-certificate"}],"u2fAdditionalAnnotations":{},"u2fConfigLabels":{},"uma2AdditionalAnnotations":{},"uma2ConfigLabels":{},"webdiscoveryAdditionalAnnotations":{},"webdiscoveryLabels":{},"webfingerAdditionalAnnotations":{},"webfingerLabels":{}}` | Nginx ingress definitions chart | -| ingress.additionalAnnotations | object | `{"kubernetes.io/ingress.class":"nginx"}` | Additional annotations that will be added across all ingress definitions in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken Enable client certificate authentication nginx.ingress.kubernetes.io/auth-tls-verify-client: "optional" Create the secret containing the trusted ca certificates nginx.ingress.kubernetes.io/auth-tls-secret: "gluu/tls-certificate" Specify the verification depth in the client certificates chain nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1" Specify if certificates are passed to upstream server nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true" | -| ingress.additionalAnnotations."kubernetes.io/ingress.class" | string | `"nginx"` | Required annotation below. Use kubernetes.io/ingress.class: "public" for microk8s. | -| ingress.additionalLabels | object | `{}` | Additional labels that will be added across all ingress definitions in the format of {mylabel: "myapp"} | -| ingress.authServerAdditionalAnnotations | object | `{}` | Auth server ingress resource additional annotations. | -| ingress.authServerLabels | object | `{}` | Auth server config ingress resource labels. key app is taken | -| ingress.deviceCodeAdditionalAnnotations | object | `{}` | device-code ingress resource additional annotations. | -| ingress.deviceCodeLabels | object | `{}` | device-code ingress resource labels. key app is taken | -| ingress.fido2ConfigAdditionalAnnotations | object | `{}` | fido2 config ingress resource additional annotations. | -| ingress.fido2ConfigLabels | object | `{}` | fido2 config ingress resource labels. key app is taken | -| ingress.fido2Enabled | bool | `false` | Enable all fido2 endpoints | -| ingress.fido2Labels | object | `{}` | fido2 ingress resource labels. key app is taken | -| ingress.firebaseMessagingAdditionalAnnotations | object | `{}` | Firebase Messaging ingress resource additional annotations. | -| ingress.firebaseMessagingLabels | object | `{}` | Firebase Messaging ingress resource labels. key app is taken | -| ingress.legacy | bool | `false` | Enable use of legacy API version networking.k8s.io/v1beta1 to support kubernetes 1.18. This flag should be removed next version release along with nginx-ingress/templates/ingress-legacy.yaml. | -| ingress.openidAdditionalAnnotations | object | `{}` | openid-configuration ingress resource additional annotations. | -| ingress.openidConfigLabels | object | `{}` | openid-configuration ingress resource labels. key app is taken | -| ingress.scimAdditionalAnnotations | object | `{}` | SCIM ingress resource additional annotations. | -| ingress.scimConfigAdditionalAnnotations | object | `{}` | SCIM config ingress resource additional annotations. | -| ingress.scimConfigLabels | object | `{}` | webdiscovery ingress resource labels. key app is taken | -| ingress.scimLabels | object | `{}` | scim config ingress resource labels. key app is taken | -| ingress.u2fAdditionalAnnotations | object | `{}` | u2f config ingress resource additional annotations. | -| ingress.u2fConfigLabels | object | `{}` | u2f config ingress resource labels. key app is taken | -| ingress.uma2AdditionalAnnotations | object | `{}` | uma2 config ingress resource additional annotations. | -| ingress.uma2ConfigLabels | object | `{}` | uma 2 config ingress resource labels. key app is taken | -| ingress.webdiscoveryAdditionalAnnotations | object | `{}` | webdiscovery ingress resource additional annotations. | -| ingress.webdiscoveryLabels | object | `{}` | webdiscovery ingress resource labels. key app is taken | -| ingress.webfingerAdditionalAnnotations | object | `{}` | webfinger ingress resource additional annotations. | -| ingress.webfingerLabels | object | `{}` | webfinger ingress resource labels. key app is taken | -| nameOverride | string | `""` | | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/gluu/gluu/charts/nginx-ingress/templates/_helpers.tpl b/charts/gluu/gluu/charts/nginx-ingress/templates/_helpers.tpl deleted file mode 100644 index 7b3845569..000000000 --- a/charts/gluu/gluu/charts/nginx-ingress/templates/_helpers.tpl +++ /dev/null @@ -1,32 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "nginx-ingress.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "nginx-ingress.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "nginx-ingress.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} diff --git a/charts/gluu/gluu/charts/nginx-ingress/templates/admin-ui-ingress.yaml b/charts/gluu/gluu/charts/nginx-ingress/templates/admin-ui-ingress.yaml deleted file mode 100644 index b8b0a827c..000000000 --- a/charts/gluu/gluu/charts/nginx-ingress/templates/admin-ui-ingress.yaml +++ /dev/null @@ -1,53 +0,0 @@ -{{ if index .Values "global" "admin-ui" "ingress" "adminUiEnabled" -}} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-admin-ui - labels: - app: {{ $fullName }}-admin-ui -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.adminUiLabels }} -{{ toYaml .Values.ingress.adminUiLabels | indent 4 }} -{{- end }} - annotations: - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/ssl-redirect: "false" - nginx.ingress.kubernetes.io/proxy-read-timeout: "300" -{{- if .Values.ingress.adminUiAdditionalAnnotations }} -{{ toYaml .Values.ingress.adminUiAdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /admin - pathType: Prefix - backend: - service: - name: {{ index .Values "global" "admin-ui" "adminUiServiceName" }} - port: - number: 8080 - {{- end }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/nginx-ingress/templates/auth-server-protected-ingress.yaml b/charts/gluu/gluu/charts/nginx-ingress/templates/auth-server-protected-ingress.yaml deleted file mode 100644 index 9b84fe4f8..000000000 --- a/charts/gluu/gluu/charts/nginx-ingress/templates/auth-server-protected-ingress.yaml +++ /dev/null @@ -1,115 +0,0 @@ -{{ if index .Values "global" "auth-server" "ingress" "authServerProtectedToken" -}} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-auth-server-protected-token - labels: - app: {{ $fullName }}-auth-server-protected-token -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.authServerProtectedTokenLabels }} -{{ toYaml .Values.ingress.authServerProtectedTokenLabels | indent 4 }} -{{- end }} - annotations: - kubernetes.io/ingress.class: "nginx" - nginx.org/ssl-services: "auth-server" - nginx.ingress.kubernetes.io/proxy-next-upstream: "error timeout invalid_header http_500 http_502 http_503 http_504" -{{- if .Values.ingress.authServerProtectedTokenAdditionalAnnotations }} -{{ toYaml .Values.ingress.authServerProtectedTokenAdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} - nginx.ingress.kubernetes.io/configuration-snippet: | - if ($ssl_client_verify != SUCCESS) {return 403;} - proxy_set_header X-ClientCert $ssl_client_escaped_cert; -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /jans-auth/restv1/token - pathType: Exact - backend: - service: - name: {{ index .Values "global" "auth-server" "authServerServiceName" }} - port: - number: 8080 - {{- end }} - {{- end }} -{{- end }} - ---- - -{{ if index .Values "global" "auth-server" "ingress" "authServerProtectedRegister" -}} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-auth-server-protected-register - labels: - app: {{ $fullName }}-auth-server-protected-register -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.authServerProtectedRegisterLabels }} -{{ toYaml .Values.ingress.authServerProtectedRegisterLabels | indent 4 }} -{{- end }} - annotations: - kubernetes.io/ingress.class: "nginx" - nginx.org/ssl-services: "auth-server" - nginx.ingress.kubernetes.io/proxy-next-upstream: "error timeout invalid_header http_500 http_502 http_503 http_504" -{{- if .Values.ingress.authServerProtectedRegisterAdditionalAnnotations }} -{{ toYaml .Values.ingress.authServerProtectedRegisterAdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} - nginx.ingress.kubernetes.io/configuration-snippet: | - if ($ssl_client_verify != SUCCESS) {return 403;} - proxy_set_header X-ClientCert $ssl_client_escaped_cert; -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /jans-auth/restv1/register - pathType: Exact - backend: - service: - name: {{ index .Values "global" "auth-server" "authServerServiceName" }} - port: - number: 8080 - {{- end }} - {{- end }} -{{- end }} diff --git a/charts/gluu/gluu/charts/nginx-ingress/templates/casa-ingress.yaml b/charts/gluu/gluu/charts/nginx-ingress/templates/casa-ingress.yaml deleted file mode 100644 index 396932209..000000000 --- a/charts/gluu/gluu/charts/nginx-ingress/templates/casa-ingress.yaml +++ /dev/null @@ -1,54 +0,0 @@ -{{ if .Values.global.casa.ingress.casaEnabled -}} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-casa - labels: - app: {{ $fullName }}-casa -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.casaLabels }} -{{ toYaml .Values.ingress.casaLabels | indent 4 }} -{{- end }} - annotations: - nginx.ingress.kubernetes.io/affinity: cookie - nginx.ingress.kubernetes.io/session-cookie-hash: sha1 - nginx.ingress.kubernetes.io/session-cookie-name: route - nginx.ingress.kubernetes.io/proxy-next-upstream: "error timeout invalid_header http_500 http_502 http_503 http_504" -{{- if .Values.ingress.casaAdditionalAnnotations }} -{{ toYaml .Values.ingress.casaAdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /casa - pathType: Prefix - backend: - service: - name: {{ .Values.global.casa.casaServiceName }} - port: - number: 8080 - {{- end }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/nginx-ingress/templates/certificate.yaml b/charts/gluu/gluu/charts/nginx-ingress/templates/certificate.yaml deleted file mode 100644 index 6cfb84f43..000000000 --- a/charts/gluu/gluu/charts/nginx-ingress/templates/certificate.yaml +++ /dev/null @@ -1,18 +0,0 @@ -{{- if .Values.certManager.certificate.enabled }} - {{- $domain := (required "Domain is required in chartValues when certManager is enabled" .Values.global.fqdn) }} -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: {{ .Release.Name }} - namespace: {{ .Release.Namespace }} -spec: - {{- range .Values.ingress.tls }} - secretName: {{ .secretName }} - {{- end }} - dnsNames: - - {{ quote $domain }} - issuerRef: - name: {{ required "nginx-ingress.certManager.certificate.issuerName is required in chart values" .Values.certManager.certificate.issuerName }} - kind: {{ required "nginx-ingress.certManager.certificate.issuerKind is required in chart values" .Values.certManager.certificate.issuerKind }} - group: {{ required "nginx-ingress.certManager.certificate.issuerGroup is required in chart values" .Values.certManager.certificate.issuerGroup }} -{{- end }} diff --git a/charts/gluu/gluu/charts/nginx-ingress/templates/ingress.yaml b/charts/gluu/gluu/charts/nginx-ingress/templates/ingress.yaml deleted file mode 100644 index 848ca121e..000000000 --- a/charts/gluu/gluu/charts/nginx-ingress/templates/ingress.yaml +++ /dev/null @@ -1,681 +0,0 @@ -{{ if index .Values "global" "auth-server" "ingress" "openidConfigEnabled" -}} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-openid-config - labels: - app: {{ $fullName }}-openid-config -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.openidConfigLabels }} -{{ toYaml .Values.ingress.openidConfigLabels | indent 4 }} -{{- end }} - annotations: - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/ssl-redirect: "false" - nginx.ingress.kubernetes.io/proxy-read-timeout: "300" - nginx.ingress.kubernetes.io/configuration-snippet: "rewrite /.well-known/openid-configuration /jans-auth/.well-known/openid-configuration$1 break;" - nginx.ingress.kubernetes.io/rewrite-target: /jans-auth/.well-known/openid-configuration -{{- if .Values.ingress.openidAdditionalAnnotations }} -{{ toYaml .Values.ingress.openidAdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /.well-known/openid-configuration - pathType: Exact - backend: - service: - name: {{ index .Values "global" "auth-server" "authServerServiceName" }} - port: - number: 8080 - {{- end }} - {{- end }} -{{- end }} - ---- -{{ if index .Values "global" "auth-server" "ingress" "deviceCodeEnabled" -}} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-device-code - labels: - app: {{ $fullName }}-device-code -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.deviceCodeLabels }} -{{ toYaml .Values.ingress.deviceCodeLabels | indent 4 }} -{{- end }} - annotations: - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/ssl-redirect: "false" - nginx.ingress.kubernetes.io/proxy-read-timeout: "300" - nginx.ingress.kubernetes.io/configuration-snippet: "rewrite /device-code /jans-auth/device_authorization.htm$1 break;" - nginx.ingress.kubernetes.io/rewrite-target: /jans-auth/device_authorization.htm -{{- if .Values.ingress.deviceCodeAdditionalAnnotations }} -{{ toYaml .Values.ingress.deviceCodeAdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /device-code - pathType: Exact - backend: - service: - name: {{ index .Values "global" "auth-server" "authServerServiceName" }} - port: - number: 8080 - {{- end }} - {{- end }} -{{- end }} - ---- -{{ if index .Values "global" "auth-server" "ingress" "firebaseMessagingEnabled" -}} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-firebase-messaging - labels: - app: {{ $fullName }}-firebase-messaging -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.firebaseMessagingLabels }} -{{ toYaml .Values.ingress.firebaseMessagingLabels | indent 4 }} -{{- end }} - annotations: - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/ssl-redirect: "false" - nginx.ingress.kubernetes.io/proxy-read-timeout: "300" - nginx.ingress.kubernetes.io/configuration-snippet: "rewrite /firebase-messaging-sw.js /jans-auth/firebase-messaging-sw.js$1 break;" - nginx.ingress.kubernetes.io/rewrite-target: /jans-auth/firebase-messaging-sw.js -{{- if .Values.ingress.firebaseMessagingAdditionalAnnotations }} -{{ toYaml .Values.ingress.firebaseMessagingAdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /firebase-messaging-sw.js - pathType: Exact - backend: - service: - name: {{ index .Values "global" "auth-server" "authServerServiceName" }} - port: - number: 8080 - {{- end }} - {{- end }} -{{- end }} - ---- -{{ if index .Values "global" "auth-server" "ingress" "uma2ConfigEnabled" -}} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-uma2-config - labels: - app: {{ $fullName }}-uma2-config -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.uma2ConfigLabels }} -{{ toYaml .Values.ingress.uma2ConfigLabels | indent 4 }} -{{- end }} - annotations: - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/ssl-redirect: "false" - nginx.ingress.kubernetes.io/proxy-read-timeout: "300" - nginx.ingress.kubernetes.io/configuration-snippet: "rewrite /.well-known/uma2-configuration /jans-auth/restv1/uma2-configuration$1 break;" - nginx.ingress.kubernetes.io/rewrite-target: /jans-auth/restv1/uma2-configuration -{{- if .Values.ingress.uma2AdditionalAnnotations }} -{{ toYaml .Values.ingress.uma2AdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /.well-known/uma2-configuration - pathType: Exact - backend: - service: - name: {{ index .Values "global" "auth-server" "authServerServiceName" }} - port: - number: 8080 - {{- end }} - {{- end }} -{{- end }} - ---- -{{ if index .Values "global" "auth-server" "ingress" "webfingerEnabled" -}} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-webfinger - labels: - app: {{ $fullName }}-webfinger -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.webfingerLabels }} -{{ toYaml .Values.ingress.webfingerLabels | indent 4 }} -{{- end }} - annotations: - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/ssl-redirect: "false" - nginx.ingress.kubernetes.io/proxy-read-timeout: "300" - nginx.ingress.kubernetes.io/configuration-snippet: "rewrite /.well-known/webfinger /jans-auth/.well-known/webfinger$1 break;" - nginx.ingress.kubernetes.io/rewrite-target: /jans-auth/.well-known/webfinger -{{- if .Values.ingress.webfingerAdditionalAnnotations }} -{{ toYaml .Values.ingress.webfingerAdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /.well-known/webfinger - pathType: Exact - backend: - service: - name: {{ index .Values "global" "auth-server" "authServerServiceName" }} - port: - number: 8080 - {{- end }} - {{- end }} -{{- end }} - ---- -{{ if index .Values "global" "auth-server" "ingress" "webdiscoveryEnabled" -}} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-webdiscovery - labels: - app: {{ $fullName }}-webdiscovery -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.webdiscoveryLabels }} -{{ toYaml .Values.ingress.webdiscoveryLabels | indent 4 }} -{{- end }} - annotations: - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/ssl-redirect: "false" - nginx.ingress.kubernetes.io/proxy-read-timeout: "300" - nginx.ingress.kubernetes.io/configuration-snippet: "rewrite /.well-known/simple-web-discovery /jans-auth/.well-known/simple-web-discovery$1 break;" - nginx.ingress.kubernetes.io/rewrite-target: /jans-auth/.well-known/simple-web-discovery -{{- if .Values.ingress.webdiscoveryAdditionalAnnotations }} -{{ toYaml .Values.ingress.webdiscoveryAdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /.well-known/simple-web-discovery - pathType: Exact - backend: - service: - name: {{ index .Values "global" "auth-server" "authServerServiceName" }} - port: - number: 8080 - {{- end }} - {{- end }} -{{- end }} - ---- -{{- if .Values.global.scim.ingress.scimConfigEnabled }} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-scim-config - labels: - app: {{ $fullName }}-scim-config -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.scimConfigLabels }} -{{ toYaml .Values.ingress.scimConfigLabels | indent 4 }} -{{- end }} - annotations: - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/ssl-redirect: "false" - nginx.ingress.kubernetes.io/proxy-read-timeout: "300" - nginx.ingress.kubernetes.io/configuration-snippet: "rewrite /.well-known/scim-configuration /jans-scim/restv1/scim-configuration$1 break;" - nginx.ingress.kubernetes.io/rewrite-target: /jans-scim/restv1/scim-configuration -{{- if .Values.ingress.scimConfigAdditionalAnnotations }} -{{ toYaml .Values.ingress.scimConfigAdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /.well-known/scim-configuration - pathType: Exact - backend: - service: - name: {{ .Values.global.scim.scimServiceName }} - port: - number: 8080 - {{- end }} - {{- end }} -{{- end }} - ---- - -{{- if .Values.global.scim.ingress.scimEnabled }} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-scim - labels: - app: {{ $fullName }}-scim -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.scimLabels }} -{{ toYaml .Values.ingress.scimLabels | indent 4 }} -{{- end }} - annotations: - kubernetes.io/ingress.class: "nginx" - nginx.org/ssl-services: "scim" - nginx.ingress.kubernetes.io/proxy-next-upstream: "error timeout invalid_header http_500 http_502 http_503 http_504" -{{- if .Values.ingress.scimAdditionalAnnotations }} -{{ toYaml .Values.ingress.scimAdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /jans-scim - pathType: Prefix - backend: - service: - name: {{ .Values.global.scim.scimServiceName }} - port: - number: 8080 - {{- end }} - {{- end }} -{{- end }} - ---- - -{{ if index .Values "global" "config-api" "ingress" "configApiEnabled" -}} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-config-api - labels: - app: {{ $fullName }}-config-api -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.configApiLabels }} -{{ toYaml .Values.ingress.configApiLabels | indent 4 }} -{{- end }} - annotations: - kubernetes.io/ingress.class: "nginx" - nginx.org/ssl-services: "configapi" - nginx.ingress.kubernetes.io/proxy-next-upstream: "error timeout invalid_header http_500 http_502 http_503 http_504" -{{- if .Values.ingress.configApiAdditionalAnnotations }} -{{ toYaml .Values.ingress.configApiAdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /jans-config-api - pathType: Prefix - backend: - service: - name: {{ index .Values "global" "config-api" "configApiServerServiceName" }} - port: - number: 8074 - {{- end }} - {{- end }} -{{- end }} - ---- -{{ if index .Values "global" "auth-server" "ingress" "u2fConfigEnabled" -}} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-u2f-config - labels: - app: {{ $fullName }}-u2f-config -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.u2fConfigLabels }} -{{ toYaml .Values.ingress.u2fConfigLabels | indent 4 }} -{{- end }} - annotations: - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/ssl-redirect: "false" - nginx.ingress.kubernetes.io/proxy-read-timeout: "300" - nginx.ingress.kubernetes.io/configuration-snippet: "rewrite /.well-known/fido-configuration /jans-auth/restv1/fido-configuration$1 break;" - nginx.ingress.kubernetes.io/rewrite-target: /jans-auth/restv1/fido-configuration -{{- if .Values.ingress.u2fAdditionalAnnotations }} -{{ toYaml .Values.ingress.u2fAdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /.well-known/fido-configuration - pathType: Exact - backend: - service: - name: {{ index .Values "global" "auth-server" "authServerServiceName" }} - port: - number: 8080 - {{- end }} - {{- end }} -{{- end }} - ---- - -{{ if .Values.global.fido2.ingress.fido2ConfigEnabled -}} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-fido2-configuration - labels: - app: {{ $fullName }}-fido2 -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.fido2ConfigLabels }} -{{ toYaml .Values.ingress.fido2ConfigLabels | indent 4 }} -{{- end }} - annotations: - kubernetes.io/ingress.class: nginx - nginx.ingress.kubernetes.io/ssl-redirect: "false" - nginx.ingress.kubernetes.io/proxy-read-timeout: "300" - nginx.ingress.kubernetes.io/configuration-snippet: "rewrite /.well-known/fido2-configuration /jans-fido2/restv1/configuration$1 break;" - nginx.ingress.kubernetes.io/rewrite-target: /jans-fido2/restv1/configuration -{{- if .Values.ingress.fido2ConfigAdditionalAnnotations }} -{{ toYaml .Values.ingress.fido2ConfigAdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /.well-known/fido2-configuration - pathType: Exact - backend: - service: - name: {{ .Values.global.fido2.fido2ServiceName }} - port: - number: 8080 - {{- end }} - {{- end }} -{{- end }} - ---- - -{{ if index .Values "global" "auth-server" "ingress" "authServerEnabled" -}} -{{ $fullName := include "nginx-ingress.fullname" . -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: {{ $fullName }}-auth-server - labels: - app: {{ $fullName }}-auth-server -{{- if .Values.ingress.additionalLabels }} -{{ toYaml .Values.ingress.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.ingress.authServerLabels }} -{{ toYaml .Values.ingress.authServerLabels | indent 4 }} -{{- end }} - annotations: - kubernetes.io/ingress.class: "nginx" - nginx.org/ssl-services: "auth-server" - nginx.ingress.kubernetes.io/proxy-next-upstream: "error timeout invalid_header http_500 http_502 http_503 http_504" -{{- if .Values.ingress.authServerAdditionalAnnotations }} -{{ toYaml .Values.ingress.authServerAdditionalAnnotations | indent 4 }} -{{- end }} -{{- if .Values.ingress.additionalAnnotations }} -{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - {{- $host := . -}} - {{- with $ }} - - host: {{ $host | quote }} - http: - paths: - - path: /jans-auth - pathType: Prefix - backend: - service: - name: {{ index .Values "global" "auth-server" "authServerServiceName" }} - port: - number: 8080 - {{- end }} - {{- end }} -{{- end }} - diff --git a/charts/gluu/gluu/charts/nginx-ingress/values.yaml b/charts/gluu/gluu/charts/nginx-ingress/values.yaml deleted file mode 100644 index 0d2487e88..000000000 --- a/charts/gluu/gluu/charts/nginx-ingress/values.yaml +++ /dev/null @@ -1,77 +0,0 @@ - -# -- Nginx ingress definitions chart -ingress: - enabled: true - # -- Enable use of legacy API version networking.k8s.io/v1beta1 to support kubernetes 1.18. This flag should be removed next version release along with nginx-ingress/templates/ingress-legacy.yaml. - legacy: false - path: / - # -- openid-configuration ingress resource labels. key app is taken - openidConfigLabels: { } - # -- openid-configuration ingress resource additional annotations. - openidAdditionalAnnotations: { } - # -- device-code ingress resource labels. key app is taken - deviceCodeLabels: { } - # -- device-code ingress resource additional annotations. - deviceCodeAdditionalAnnotations: { } - # -- Firebase Messaging ingress resource labels. key app is taken - firebaseMessagingLabels: { } - # -- Firebase Messaging ingress resource additional annotations. - firebaseMessagingAdditionalAnnotations: { } - # -- uma 2 config ingress resource labels. key app is taken - uma2ConfigLabels: { } - # -- uma2 config ingress resource additional annotations. - uma2AdditionalAnnotations: { } - # -- webfinger ingress resource labels. key app is taken - webfingerLabels: { } - # -- webfinger ingress resource additional annotations. - webfingerAdditionalAnnotations: { } - # -- webdiscovery ingress resource labels. key app is taken - webdiscoveryLabels: { } - # -- webdiscovery ingress resource additional annotations. - webdiscoveryAdditionalAnnotations: { } - # -- webdiscovery ingress resource labels. key app is taken - scimConfigLabels: { } - # -- SCIM config ingress resource additional annotations. - scimConfigAdditionalAnnotations: { } - # -- scim config ingress resource labels. key app is taken - scimLabels: { } - # -- SCIM ingress resource additional annotations. - scimAdditionalAnnotations: { } - # -- u2f config ingress resource labels. key app is taken - u2fConfigLabels: { } - # -- u2f config ingress resource additional annotations. - u2fAdditionalAnnotations: { } - # -- fido2 config ingress resource labels. key app is taken - fido2ConfigLabels: { } - # -- fido2 config ingress resource additional annotations. - fido2ConfigAdditionalAnnotations: { } - # -- Enable all fido2 endpoints - fido2Enabled: false - # -- fido2 ingress resource labels. key app is taken - fido2Labels: { } - # -- Auth server config ingress resource labels. key app is taken - authServerLabels: { } - # -- Auth server ingress resource additional annotations. - authServerAdditionalAnnotations: { } - # -- Additional labels that will be added across all ingress definitions in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across all ingress definitions in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken - # Enable client certificate authentication - # nginx.ingress.kubernetes.io/auth-tls-verify-client: "optional" - # Create the secret containing the trusted ca certificates - # nginx.ingress.kubernetes.io/auth-tls-secret: "gluu/tls-certificate" - # Specify the verification depth in the client certificates chain - # nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1" - # Specify if certificates are passed to upstream server - # nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true" - additionalAnnotations: - # -- Required annotation below. Use kubernetes.io/ingress.class: "public" for microk8s. - kubernetes.io/ingress.class: "nginx" - hosts: - - demoexample.gluu.org - tls: - - secretName: tls-certificate # DON'T change - hosts: - - demoexample.gluu.org -nameOverride: "" -fullnameOverride: "" diff --git a/charts/gluu/gluu/charts/opendj/.helmignore b/charts/gluu/gluu/charts/opendj/.helmignore deleted file mode 100644 index f0c131944..000000000 --- a/charts/gluu/gluu/charts/opendj/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/charts/gluu/gluu/charts/opendj/Chart.yaml b/charts/gluu/gluu/charts/opendj/Chart.yaml deleted file mode 100644 index c206b2300..000000000 --- a/charts/gluu/gluu/charts/opendj/Chart.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: v2 -appVersion: 5.0.0 -description: OpenDJ is a directory server which implements a wide range of Lightweight - Directory Access Protocol and related standards, including full compliance with - LDAPv3 but also support for Directory Service Markup Language (DSMLv2).Written in - Java, OpenDJ offers multi-master replication, access control, and many extensions. -home: https://gluu.org/docs/gluu-server -icon: https://gluu.org/docs/gluu-server/favicon.ico -keywords: -- LDAP -- OpenDJ -kubeVersion: '>=v1.21.0-0' -maintainers: -- email: support@gluu.org - name: Mohammad Abudayyeh - url: https://github.com/moabu -name: opendj -sources: -- https://github.com/GluuFederation/docker-opendj -- https://github.com/GluuFederation/flex/tree/main/flex-cn-setup/pygluu/kubernetes/templates/helm/gluu/charts/opendj -type: application -version: 5.0.10 diff --git a/charts/gluu/gluu/charts/opendj/README.md b/charts/gluu/gluu/charts/opendj/README.md deleted file mode 100644 index 2286c8bef..000000000 --- a/charts/gluu/gluu/charts/opendj/README.md +++ /dev/null @@ -1,71 +0,0 @@ -# opendj - -![Version: 5.0.10](https://img.shields.io/badge/Version-5.0.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0](https://img.shields.io/badge/AppVersion-5.0.0-informational?style=flat-square) - -OpenDJ is a directory server which implements a wide range of Lightweight Directory Access Protocol and related standards, including full compliance with LDAPv3 but also support for Directory Service Markup Language (DSMLv2).Written in Java, OpenDJ offers multi-master replication, access control, and many extensions. - -**Homepage:** - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| Mohammad Abudayyeh | | | - -## Source Code - -* -* - -## Requirements - -Kubernetes: `>=v1.21.0-0` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| additionalAnnotations | object | `{}` | Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken | -| additionalLabels | object | `{}` | Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} | -| dnsConfig | object | `{}` | Add custom dns config | -| dnsPolicy | string | `""` | Add custom dns policy | -| fullnameOverride | string | `""` | | -| hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| hpa.behavior | object | `{}` | Scaling Policies | -| hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| image.pullSecrets | list | `[]` | Image Pull Secrets | -| image.repository | string | `"gluufederation/opendj"` | Image to use for deploying. | -| image.tag | string | `"5.0.0_dev"` | Image tag to use for deploying. | -| livenessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"failureThreshold":20,"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for OpenDJ if needed. https://github.com/GluuFederation/docker-opendj/blob/4.3/scripts/healthcheck.py | -| livenessProbe.exec | object | `{"command":["python3","/app/scripts/healthcheck.py"]}` | Executes the python3 healthcheck. | -| nameOverride | string | `""` | | -| openDjVolumeMounts.config.mountPath | string | `"/opt/opendj/config"` | | -| openDjVolumeMounts.config.name | string | `"opendj-volume"` | | -| openDjVolumeMounts.db.mountPath | string | `"/opt/opendj/db"` | | -| openDjVolumeMounts.db.name | string | `"opendj-volume"` | | -| openDjVolumeMounts.flag.mountPath | string | `"/flag"` | | -| openDjVolumeMounts.flag.name | string | `"opendj-volume"` | | -| openDjVolumeMounts.ldif.mountPath | string | `"/opt/opendj/ldif"` | | -| openDjVolumeMounts.ldif.name | string | `"opendj-volume"` | | -| openDjVolumeMounts.logs.mountPath | string | `"/opt/opendj/logs"` | | -| openDjVolumeMounts.logs.name | string | `"opendj-volume"` | | -| persistence.accessModes | string | `"ReadWriteOnce"` | | -| persistence.size | string | `"5Gi"` | OpenDJ volume size | -| persistence.type | string | `"DirectoryOrCreate"` | | -| ports | object | `{"tcp-admin":{"nodePort":"","port":4444,"protocol":"TCP","targetPort":4444},"tcp-ldap":{"nodePort":"","port":1389,"protocol":"TCP","targetPort":1389},"tcp-ldaps":{"nodePort":"","port":1636,"protocol":"TCP","targetPort":1636},"tcp-repl":{"nodePort":"","port":8989,"protocol":"TCP","targetPort":8989},"tcp-serf":{"nodePort":"","port":7946,"protocol":"TCP","targetPort":7946},"udp-serf":{"nodePort":"","port":7946,"protocol":"UDP","targetPort":7946}}` | servicePorts values used in StatefulSet container | -| readinessProbe | object | `{"failureThreshold":20,"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":1636},"timeoutSeconds":5}` | Configure the readiness healthcheck for OpenDJ if needed. https://github.com/GluuFederation/docker-opendj/blob/4.3/scripts/healthcheck.py | -| replicas | int | `1` | Service replica number. | -| resources | object | `{"limits":{"cpu":"1500m","memory":"2000Mi"},"requests":{"cpu":"1500m","memory":"2000Mi"}}` | Resource specs. | -| resources.limits.cpu | string | `"1500m"` | CPU limit. | -| resources.limits.memory | string | `"2000Mi"` | Memory limit. | -| resources.requests.cpu | string | `"1500m"` | CPU request. | -| resources.requests.memory | string | `"2000Mi"` | Memory request. | -| usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/gluu/gluu/charts/opendj/templates/_helpers.tpl b/charts/gluu/gluu/charts/opendj/templates/_helpers.tpl deleted file mode 100644 index ecab10b75..000000000 --- a/charts/gluu/gluu/charts/opendj/templates/_helpers.tpl +++ /dev/null @@ -1,98 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "opendj.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "opendj.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "opendj.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* - Common labels -*/}} -{{- define "opendj.labels" -}} -app: {{ .Release.Name }}-{{ include "opendj.name" . }} -helm.sh/chart: {{ include "opendj.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Create user custom defined envs -*/}} -{{- define "opendj.usr-envs"}} -{{- range $key, $val := .Values.usrEnvs.normal }} -- name: {{ $key }} - value: {{ $val | quote }} -{{- end }} -{{- end }} - -{{/* -Create user custom defined secret envs -*/}} -{{- define "opendj.usr-secret-envs"}} -{{- range $key, $val := .Values.usrEnvs.secret }} -- name: {{ $key }} - valueFrom: - secretKeyRef: - name: {{ $.Release.Name }}-{{ $.Chart.Name }}-user-custom-envs - key: {{ $key | quote }} -{{- end }} -{{- end }} - -{{/* -Create topologySpreadConstraints lists -*/}} -{{- define "opendj.topology-spread-constraints"}} -{{- range $key, $val := .Values.topologySpreadConstraints }} -- maxSkew: {{ $val.maxSkew }} - {{- if $val.minDomains }} - minDomains: {{ $val.minDomains }} # optional; beta since v1.25 - {{- end}} - {{- if $val.topologyKey }} - topologyKey: {{ $val.topologyKey }} - {{- end}} - {{- if $val.whenUnsatisfiable }} - whenUnsatisfiable: {{ $val.whenUnsatisfiable }} - {{- end}} - labelSelector: - matchLabels: - app: {{ $.Release.Name }}-{{ include "opendj.name" $ }} - {{- if $val.matchLabelKeys }} - matchLabelKeys: {{ $val.matchLabelKeys }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeAffinityPolicy }} - nodeAffinityPolicy: {{ $val.nodeAffinityPolicy }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeTaintsPolicy }} - nodeTaintsPolicy: {{ $val.nodeTaintsPolicy }} # optional; alpha since v1.25 - {{- end}} -{{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/opendj/templates/cronjobs.yaml b/charts/gluu/gluu/charts/opendj/templates/cronjobs.yaml deleted file mode 100644 index 930d6f067..000000000 --- a/charts/gluu/gluu/charts/opendj/templates/cronjobs.yaml +++ /dev/null @@ -1,95 +0,0 @@ -{{- if .Values.backup.enabled }} -kind: CronJob -apiVersion: batch/v1 -metadata: - name: {{ include "opendj.fullname" . }}-backup -spec: - schedule: {{ .Values.backup.cronJobSchedule | quote }} - concurrencyPolicy: Forbid - jobTemplate: - spec: - template: - spec: - dnsPolicy: {{ .Values.dnsPolicy | quote }} - {{- with .Values.dnsConfig }} - dnsConfig: - {{ toYaml . | indent 12 }} - {{- end }} - containers: - - name: {{ include "opendj.fullname" . }}-backup - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - envFrom: - - configMapRef: - name: {{ .Release.Name }}-config-cm - ports: - {{- range $key, $value := .Values.ports }} - - containerPort: {{ $value.targetPort }} - name: {{ $key }} - {{- end }} - env: - - name: LDAP_HOST - valueFrom: - configMapKeyRef: - # ConfigMap generated by the Configuration chart when Gluu was installed. This is normally cn. - # Found in Gluu chart under config.configmap.cnConfigKubernetesConfigMap - name: cn - key: ldap_init_host - - name: LDAP_PORT - valueFrom: - configMapKeyRef: - # ConfigMap generated by the Configuration chart when Gluu was installed. This is normally cn. - # Found in Gluu chart under config.configmap.cnConfigKubernetesConfigMap - name: cn - key: ldap_init_port - - name: LDAP_BIND_DN - valueFrom: - configMapKeyRef: - # ConfigMap generated by the Configuration chart when Gluu was installed. This is normally cn. - # Found in Gluu chart under config.configmap.cnConfigKubernetesConfigMap - name: cn - key: ldap_site_binddn - - name: LDAP_PASSWORD - valueFrom: - secretKeyRef: - name: {{ .Release.Name }}-ldap-cron-pass - key: password - # while true; do sleep 60; ldaplog=$(cat /opt/opendj/logs/server.out); startedstr="The Directory Server has started successfully"; if [ -z "${ldaplog##*$startedstr*}" ]; then break; fi; echo "Waiting for opendj server to start"; done - command: - - /bin/sh - - -c - - | - # ========= - # FUNCTIONS - # ========= - - set_java_args() { - # not sure if we can omit `-server` safely - local java_args="-server" - java_args="${java_args} -XX:+UseContainerSupport -XX:MaxRAMPercentage=${GLUU_MAX_RAM_PERCENTAGE} ${GLUU_JAVA_OPTIONS}" - # set the env var so it is loaded by `start-ds` script - export OPENDJ_JAVA_ARGS=${java_args} - } - - # ========== - # ENTRYPOINT - # ========== - - mkdir -p /opt/opendj/locks - - export JAVA_VERSION=$(java -version 2>&1 | awk -F '[\"_]' 'NR==1{print $2}') - - python3 /app/scripts/wait.py - - if [ ! -f /deploy/touched ]; then - python3 /app/scripts/entrypoint.py - touch /deploy/touched - fi - # run OpenDJ server - set_java_args - exec /opt/opendj/bin/start-ds -N & - sleep 300 - RANDOM_NUM=$(cat /dev/urandom | tr -cd '0-5' | head -c 1) - LDAP_BACKUP_FILE=backup-$RANDOM_NUM.ldif - /opt/opendj/bin/export-ldif --hostname "$LDAP_HOST" --port 4444 --bindDN "$LDAP_BIND_DN" --bindPassword "$LDAP_PASSWORD" --backendID userRoot --ldifFile /opt/opendj/ldif/$LDAP_BACKUP_FILE --trustAll - restartPolicy: Never -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/opendj/templates/hpa.yaml b/charts/gluu/gluu/charts/opendj/templates/hpa.yaml deleted file mode 100644 index 157ea310b..000000000 --- a/charts/gluu/gluu/charts/opendj/templates/hpa.yaml +++ /dev/null @@ -1,36 +0,0 @@ -{{ if .Values.hpa.enabled -}} -apiVersion: autoscaling/v1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "opendj.fullname" . }} - labels: -{{ include "opendj.labels" $ | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: StatefulSet - name: {{ include "opendj.fullname" . }} - minReplicas: {{ .Values.hpa.minReplicas }} - maxReplicas: {{ .Values.hpa.maxReplicas }} - {{- if .Values.hpa.targetCPUUtilizationPercentage }} - targetCPUUtilizationPercentage: {{ .Values.hpa.targetCPUUtilizationPercentage }} - {{- else if .Values.hpa.metrics }} - metrics: - {{- with .Values.hpa.metrics }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} - {{- if .Values.hpa.behavior }} - behavior: - {{- with .Values.hpa.behavior }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/opendj/templates/opendj-destination-rules.yaml b/charts/gluu/gluu/charts/opendj/templates/opendj-destination-rules.yaml deleted file mode 100644 index a6a8f5684..000000000 --- a/charts/gluu/gluu/charts/opendj/templates/opendj-destination-rules.yaml +++ /dev/null @@ -1,23 +0,0 @@ -{{- if or (eq .Values.global.cnPersistenceType "ldap") (eq .Values.global.cnPersistenceType "hybrid") }} -{{- if .Values.global.istio.enabled }} -apiVersion: networking.istio.io/v1alpha3 -kind: DestinationRule -metadata: - name: {{ .Release.Name }}-ldap-mtls - namespace: {{.Release.Namespace}} - labels: -{{ include "opendj.labels" $ | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - host: {{ .Values.global.opendj.ldapServiceName }}.{{ .Release.Namespace }}.svc.cluster.local - trafficPolicy: - tls: - mode: ISTIO_MUTUAL -{{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/opendj/templates/opendj-pdb.yaml b/charts/gluu/gluu/charts/opendj/templates/opendj-pdb.yaml deleted file mode 100644 index 1615c4ac2..000000000 --- a/charts/gluu/gluu/charts/opendj/templates/opendj-pdb.yaml +++ /dev/null @@ -1,11 +0,0 @@ -{{ if .Values.pdb.enabled -}} -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ include "opendj.fullname" . }} -spec: - maxUnavailable: {{ .Values.pdb.maxUnavailable }} - selector: - matchLabels: - app: {{ include "opendj.name" $ }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/opendj/templates/service.yaml b/charts/gluu/gluu/charts/opendj/templates/service.yaml deleted file mode 100644 index ec7d0a825..000000000 --- a/charts/gluu/gluu/charts/opendj/templates/service.yaml +++ /dev/null @@ -1,30 +0,0 @@ -{{- if or (eq .Values.global.cnPersistenceType "ldap") (eq .Values.global.cnPersistenceType "hybrid") }} -apiVersion: v1 -kind: Service -metadata: - name: {{ $.Values.global.opendj.ldapServiceName }} - namespace: {{ $.Release.Namespace }} - labels: -{{ include "opendj.labels" $ | indent 4}} -{{- if $.Values.additionalLabels }} -{{ toYaml $.Values.additionalLabels | indent 4 }} -{{- end }} -{{- if $.Values.additionalAnnotations }} - annotations: -{{ toYaml $.Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - ports: - {{- range $key, $value := $.Values.ports }} - - port: {{ $value.port }} - name: {{ $key }} - targetPort: {{ $value.targetPort }} - protocol: {{ $value.protocol}} - {{- if $value.nodePort }} - nodePort: {{ $value.nodePort }} - {{- end }} - {{- end }} - clusterIP: None - selector: - app: {{ include "opendj.name" $ }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/opendj/templates/statefulset.yaml b/charts/gluu/gluu/charts/opendj/templates/statefulset.yaml deleted file mode 100644 index e9f26e72c..000000000 --- a/charts/gluu/gluu/charts/opendj/templates/statefulset.yaml +++ /dev/null @@ -1,133 +0,0 @@ -{{- if or (eq .Values.global.cnPersistenceType "ldap") (eq .Values.global.cnPersistenceType "hybrid") }} -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: {{ include "opendj.fullname" $ }} - namespace: {{ $.Release.Namespace }} - labels: -{{ include "opendj.labels" $ | indent 4}} -{{- if $.Values.additionalLabels }} -{{ toYaml $.Values.additionalLabels | indent 4 }} -{{- end }} -{{- if $.Values.additionalAnnotations }} - annotations: -{{ toYaml $.Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - selector: - matchLabels: - app: {{ include "opendj.name" $ }} - serviceName: {{ include "opendj.name" $ }} - replicas: {{ $.Values.replicas }} - template: - metadata: - labels: - app: {{ include "opendj.name" $ }} - {{- if $.Values.global.istio.ingress }} - annotations: - sidecar.istio.io/rewriteAppHTTPProbers: "true" - {{- end }} - spec: - securityContext: - runAsUser: 1000 - runAsNonRoot: true - initContainers: - - command: - - /bin/sh - - -c - - ls -l /opt/opendj; /bin/chown -R 1000:1000 /opt/opendj || echo "did not work"; ls -l /opt/opendj; sleep 5 - image: busybox:latest - imagePullPolicy: Always - name: change-folders-ownership - resources: {} - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - {{- range $key, $values := $.Values.openDjVolumeMounts }} - - mountPath: {{$values.mountPath}} - name: {{$values.name}} - subPath: {{$key}} - {{- end }} - {{- with $.Values.volumeMounts }} -{{- toYaml . | nindent 10 }} - {{- end }} - {{- with $.Values.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - dnsPolicy: {{ $.Values.dnsPolicy | quote }} - {{- with $.Values.dnsConfig }} - dnsConfig: -{{ toYaml . | indent 8 }} - {{- end }} - volumes: - {{- with $.Values.volumes }} -{{- toYaml . | nindent 8 }} - {{- end }} - {{- if .Values.topologySpreadConstraints }} - topologySpreadConstraints: - {{- include "opendj.topology-spread-constraints" . | indent 8 }} - {{- end }} - containers: - - name: {{ include "opendj.name" $ }} - imagePullPolicy: {{ $.Values.image.pullPolicy }} - image: "{{ $.Values.image.repository }}:{{ $.Values.image.tag }}" - env: - {{- include "opendj.usr-envs" $ | indent 12 }} - {{- include "opendj.usr-secret-envs" $ | indent 12 }} - lifecycle: - preStop: - exec: - command: ["/bin/sh", "-c", "python3 /app/scripts/deregister_peer.py 1>&/proc/1/fd/1"] - envFrom: - - configMapRef: - name: {{ $.Release.Name }}-config-cm - {{ if $.Values.global.usrEnvs.secret }} - - secretRef: - name: {{ $.Release.Name }}-global-user-custom-envs - {{- end }} - {{ if $.Values.global.usrEnvs.normal }} - - configMapRef: - name: {{ $.Release.Name }}-global-user-custom-envs - {{- end }} - ports: - {{- range $key, $value := $.Values.ports }} - - containerPort: {{ $value.targetPort }} - name: {{ $key }} - {{- end }} - volumeMounts: - {{- range $key, $values := $.Values.openDjVolumeMounts }} - - mountPath: {{$values.mountPath}} - name: {{$values.name}} - subPath: {{$key}} - {{- end }} - {{- with $.Values.volumeMounts }} -{{- toYaml . | nindent 10 }} - {{- end }} - livenessProbe: -{{- toYaml $.Values.livenessProbe | nindent 10 }} - readinessProbe: -{{- toYaml $.Values.readinessProbe | nindent 10 }} - {{- if or (eq $.Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq $.Values.global.storageClass.provisioner "k8s.io/minikube-hostpath") }} - resources: {} - {{- else if $.Values.global.cloud.testEnviroment }} - resources: {} - {{- else }} - resources: -{{- toYaml $.Values.resources | nindent 10 }} - {{- end }} - volumeClaimTemplates: - - metadata: - name: opendj-volume - spec: - accessModes: - - {{ $.Values.persistence.accessModes }} - resources: - requests: - storage: {{ $.Values.persistence.size }} - {{- if eq $.Values.global.storageClass.provisioner "k8s.io/minikube-hostpath" }} - storageClassName: standard - {{- else }} - storageClassName: {{ include "opendj.fullname" $ | quote }} - {{- end }} -{{- end }} diff --git a/charts/gluu/gluu/charts/opendj/templates/storageclass.yaml b/charts/gluu/gluu/charts/opendj/templates/storageclass.yaml deleted file mode 100644 index d33175d10..000000000 --- a/charts/gluu/gluu/charts/opendj/templates/storageclass.yaml +++ /dev/null @@ -1,57 +0,0 @@ -{{- if or (eq .Values.global.cnPersistenceType "ldap") (eq .Values.global.cnPersistenceType "hybrid") }} -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: {{ include "opendj.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - storage: opendj -{{ include "opendj.labels" $ | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} - annotations: - "helm.sh/hook": pre-install - "helm.sh/hook-weight": "3" - "helm.sh/hook-delete-policy": before-hook-creation -{{- if .Values.additionalAnnotations }} -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} - # Annotation below is to keep the storage class during upgrade. Otherwise, due to the flag at line 1 which is needed, this resource will be deleted. - helm.sh/resource-policy: keep - storageclass.beta.kubernetes.io/is-default-class: "false" - {{- if eq .Values.global.storageClass.provisioner "openebs.io/local" }} - openebs.io/cas-type: local - cas.openebs.io/config: | - - name: StorageType - value: hostpath - - name: BasePath - value: /var/local-hostpath - {{- end }} -provisioner: {{ .Values.global.storageClass.provisioner }} -{{- if and ( ne .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) ( ne .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath") ( ne .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") ( ne .Values.global.storageClass.provisioner "kubernetes.io/gce-pd") ( ne .Values.global.storageClass.provisioner "dobs.csi.digitalocean.com") ( ne .Values.global.storageClass.provisioner "openebs.io/local") ( ne .Values.global.storageClass.provisioner "kubernetes.io/azure-disk") }} -parameters: -{{ toYaml .Values.global.storageClass.parameters | indent 4 }} -{{- else }} -parameters: - {{- if eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs" }} - type: {{ .Values.global.awsStorageType }} - fsType: ext4 - {{- else if eq .Values.global.storageClass.provisioner "kubernetes.io/gce-pd" }} - type: {{ .Values.global.gcePdStorageType }} - {{- else if eq .Values.global.storageClass.provisioner "kubernetes.io/azure-disk" }} - storageAccountType: {{ .Values.global.azureStorageAccountType }} - kind: {{ .Values.global.azureStorageKind }} - {{- else if eq .Values.global.storageClass.provisioner "dobs.csi.digitalocean.com" }} - {{- else if eq .Values.global.storageClass.provisioner "openebs.io/local" }} - {{- else }} - pool: default - fsType: ext4 - {{- end }} -{{- end }} -allowVolumeExpansion: {{ .Values.global.storageClass.allowVolumeExpansion }} -volumeBindingMode: {{ .Values.global.storageClass.volumeBindingMode }} -reclaimPolicy: {{ .Values.global.storageClass.reclaimPolicy }} -mountOptions: {{ .Values.global.storageClass.mountOptions | toJson }} -allowedTopologies: {{ .Values.global.storageClass.allowedTopologies | toJson }} -{{- end }} diff --git a/charts/gluu/gluu/charts/opendj/templates/user-custom-secret-envs.yaml b/charts/gluu/gluu/charts/opendj/templates/user-custom-secret-envs.yaml deleted file mode 100644 index 8fcf989cd..000000000 --- a/charts/gluu/gluu/charts/opendj/templates/user-custom-secret-envs.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{ if .Values.usrEnvs.secret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-{{ .Chart.Name }}-user-custom-envs - labels: -{{ include "opendj.labels" $ | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -data: - {{- range $key, $val := .Values.usrEnvs.secret }} - {{ $key }}: {{ $val | b64enc }} - {{- end}} -{{- end}} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/opendj/values.yaml b/charts/gluu/gluu/charts/opendj/values.yaml deleted file mode 100644 index ea38349ce..000000000 --- a/charts/gluu/gluu/charts/opendj/values.yaml +++ /dev/null @@ -1,134 +0,0 @@ - -# -- OpenDJ is a directory server which implements a wide range of Lightweight Directory Access Protocol and related standards, including full compliance with LDAPv3 but also support for Directory Service Markup Language (DSMLv2).Written in Java, OpenDJ offers multi-master replication, access control, and many extensions. -# -- Configure the HorizontalPodAutoscaler -hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} -# -- Add custom normal and secret envs to the service -usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} -# -- Add custom dns policy -dnsPolicy: "" -# -- Add custom dns config -dnsConfig: {} -image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: gluufederation/opendj - # -- Image tag to use for deploying. - tag: 5.0.0_dev - # -- Image Pull Secrets - pullSecrets: [ ] -persistence: - # -- OpenDJ volume size - size: 5Gi - accessModes: ReadWriteOnce - type: DirectoryOrCreate -# -- servicePorts values used in StatefulSet container -ports: - tcp-admin: - nodePort: "" - port: 4444 - protocol: TCP - targetPort: 4444 - tcp-ldap: - nodePort: "" - port: 1389 - protocol: TCP - targetPort: 1389 - tcp-ldaps: - nodePort: "" - port: 1636 - protocol: TCP - targetPort: 1636 - tcp-repl: - nodePort: "" - port: 8989 - protocol: TCP - targetPort: 8989 - tcp-serf: - nodePort: "" - port: 7946 - protocol: TCP - targetPort: 7946 - udp-serf: - nodePort: "" - port: 7946 - protocol: UDP - targetPort: 7946 -# -- Service replica number. -replicas: 1 -# -- Resource specs. -resources: - limits: - # -- CPU limit. - cpu: 1500m - # -- Memory limit. - memory: 2000Mi - requests: - # -- CPU request. - cpu: 1500m - # -- Memory request. - memory: 2000Mi -# -- Configure the liveness healthcheck for OpenDJ if needed. -# https://github.com/GluuFederation/docker-opendj/blob/4.3/scripts/healthcheck.py -livenessProbe: - # -- Executes the python3 healthcheck. - exec: - command: - - python3 - - /app/scripts/healthcheck.py - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - failureThreshold: 20 -# -- Configure the readiness healthcheck for OpenDJ if needed. -# https://github.com/GluuFederation/docker-opendj/blob/4.3/scripts/healthcheck.py -readinessProbe: - tcpSocket: - port: 1636 - initialDelaySeconds: 60 - timeoutSeconds: 5 - periodSeconds: 25 - failureThreshold: 20 -# -- Configure any additional volumes that need to be attached to the pod -volumes: [] -# -- Configure any additional volumesMounts that need to be attached to the containers -volumeMounts: [] -nameOverride: "" -fullnameOverride: "" -# VolumeMounts for StatefulSet -# opendj-init vm -openDjVolumeMounts: - config: - mountPath: /opt/opendj/config - name: opendj-volume - ldif: - mountPath: /opt/opendj/ldif - name: opendj-volume - logs: - mountPath: /opt/opendj/logs - name: opendj-volume - db: - mountPath: /opt/opendj/db - name: opendj-volume - flag: - mountPath: /flag - name: opendj-volume - -# -- Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} -additionalLabels: { } -# -- Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken -additionalAnnotations: { } \ No newline at end of file diff --git a/charts/gluu/gluu/charts/oxpassport/.helmignore b/charts/gluu/gluu/charts/oxpassport/.helmignore deleted file mode 100644 index f0c131944..000000000 --- a/charts/gluu/gluu/charts/oxpassport/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/charts/gluu/gluu/charts/oxpassport/Chart.yaml b/charts/gluu/gluu/charts/oxpassport/Chart.yaml deleted file mode 100644 index 86080bf73..000000000 --- a/charts/gluu/gluu/charts/oxpassport/Chart.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: v2 -appVersion: 5.0.0 -description: Gluu interface to Passport.js to support social login and inbound identity. -home: https://gluu.org/docs/gluu-server -icon: https://gluu.org/docs/gluu-server/favicon.ico -keywords: -- Passport.js -- Inbound Identity -- Social login -kubeVersion: '>=v1.21.0-0' -maintainers: -- email: support@gluu.org - name: Mohammad Abudayyeh - url: https://github.com/moabu -name: oxpassport -sources: -- https://github.com/GluuFederation/gluu-passport -- https://github.com/GluuFederation/docker-oxpassport -- https://github.com/GluuFederation/flex/tree/main/flex-cn-setup/pygluu/kubernetes/templates/helm/gluu/charts/oxpassport -type: application -version: 5.0.10 diff --git a/charts/gluu/gluu/charts/oxpassport/README.md b/charts/gluu/gluu/charts/oxpassport/README.md deleted file mode 100644 index 89a9dbcc9..000000000 --- a/charts/gluu/gluu/charts/oxpassport/README.md +++ /dev/null @@ -1,66 +0,0 @@ -# oxpassport - -![Version: 5.0.10](https://img.shields.io/badge/Version-5.0.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0](https://img.shields.io/badge/AppVersion-5.0.0-informational?style=flat-square) - -Gluu interface to Passport.js to support social login and inbound identity. - -**Homepage:** - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| Mohammad Abudayyeh | | | - -## Source Code - -* -* -* - -## Requirements - -Kubernetes: `>=v1.21.0-0` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| additionalAnnotations | object | `{}` | Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken | -| additionalLabels | object | `{}` | Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} | -| affinity | object | `{}` | | -| dnsConfig | object | `{}` | Add custom dns config | -| dnsPolicy | string | `""` | Add custom dns policy | -| fullnameOverride | string | `""` | | -| hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| hpa.behavior | object | `{}` | Scaling Policies | -| hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| image.pullSecrets | list | `[]` | Image Pull Secrets | -| image.repository | string | `"gluufederation/oxpassport"` | Image to use for deploying. | -| image.tag | string | `"5.0.0_dev"` | Image tag to use for deploying. | -| livenessProbe | object | `{"failureThreshold":20,"httpGet":{"path":"/passport/health-check","port":"http-passport"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for oxPassport if needed. | -| livenessProbe.httpGet.path | string | `"/passport/health-check"` | http liveness probe endpoint | -| nameOverride | string | `""` | | -| nodeSelector | object | `{}` | | -| readinessProbe | object | `{"failureThreshold":20,"httpGet":{"path":"/passport/health-check","port":"http-passport"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the oxPassport if needed. | -| readinessProbe.httpGet.path | string | `"/passport/health-check"` | http readiness probe endpoint | -| replicas | int | `1` | Service replica number | -| resources | object | `{"limits":{"cpu":"700m","memory":"900Mi"},"requests":{"cpu":"700m","memory":"900Mi"}}` | Resource specs. | -| resources.limits.cpu | string | `"700m"` | CPU limit. | -| resources.limits.memory | string | `"900Mi"` | Memory limit. | -| resources.requests.cpu | string | `"700m"` | CPU request. | -| resources.requests.memory | string | `"900Mi"` | Memory request. | -| service.name | string | `"http-passport"` | The name of the oxPassport port within the oxPassport service. Please keep it as default. | -| service.port | int | `8090` | Port of the oxPassport service. Please keep it as default. | -| service.sessionAffinity | string | `"None"` | Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP | -| service.sessionAffinityConfig | object | `{"clientIP":{"timeoutSeconds":10800}}` | the maximum session sticky time if sessionAffinity is ClientIP | -| tolerations | list | `[]` | | -| usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/gluu/gluu/charts/oxpassport/templates/_helpers.tpl b/charts/gluu/gluu/charts/oxpassport/templates/_helpers.tpl deleted file mode 100644 index 1f9d4b746..000000000 --- a/charts/gluu/gluu/charts/oxpassport/templates/_helpers.tpl +++ /dev/null @@ -1,98 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "oxpassport.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "oxpassport.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "oxpassport.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* - Common labels -*/}} -{{- define "oxpassport.labels" -}} -app: {{ .Release.Name }}-{{ include "oxpassport.name" . }} -helm.sh/chart: {{ include "oxpassport.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Create user custom defined envs -*/}} -{{- define "oxpassport.usr-envs"}} -{{- range $key, $val := .Values.usrEnvs.normal }} -- name: {{ $key }} - value: {{ $val | quote }} -{{- end }} -{{- end }} - -{{/* -Create user custom defined secret envs -*/}} -{{- define "oxpassport.usr-secret-envs"}} -{{- range $key, $val := .Values.usrEnvs.secret }} -- name: {{ $key }} - valueFrom: - secretKeyRef: - name: {{ $.Release.Name }}-{{ $.Chart.Name }}-user-custom-envs - key: {{ $key | quote }} -{{- end }} -{{- end }} - -{{/* -Create topologySpreadConstraints lists -*/}} -{{- define "oxpassport.topology-spread-constraints"}} -{{- range $key, $val := .Values.topologySpreadConstraints }} -- maxSkew: {{ $val.maxSkew }} - {{- if $val.minDomains }} - minDomains: {{ $val.minDomains }} # optional; beta since v1.25 - {{- end}} - {{- if $val.topologyKey }} - topologyKey: {{ $val.topologyKey }} - {{- end}} - {{- if $val.whenUnsatisfiable }} - whenUnsatisfiable: {{ $val.whenUnsatisfiable }} - {{- end}} - labelSelector: - matchLabels: - app: {{ $.Release.Name }}-{{ include "oxpassport.name" $ }} - {{- if $val.matchLabelKeys }} - matchLabelKeys: {{ $val.matchLabelKeys }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeAffinityPolicy }} - nodeAffinityPolicy: {{ $val.nodeAffinityPolicy }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeTaintsPolicy }} - nodeTaintsPolicy: {{ $val.nodeTaintsPolicy }} # optional; alpha since v1.25 - {{- end}} -{{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/oxpassport/templates/deployment.yaml b/charts/gluu/gluu/charts/oxpassport/templates/deployment.yaml deleted file mode 100644 index 31297d4d2..000000000 --- a/charts/gluu/gluu/charts/oxpassport/templates/deployment.yaml +++ /dev/null @@ -1,181 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "oxpassport.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "oxpassport.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - replicas: {{ .Values.replicas }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "oxpassport.name" . }} - release: {{ .Release.Name }} - template: - metadata: - labels: - app: {{ .Release.Name }}-{{ include "oxpassport.name" . }} - release: {{ .Release.Name }} - {{- if .Values.global.istio.ingress }} - annotations: - sidecar.istio.io/rewriteAppHTTPProbers: "true" - {{- end }} - spec: - {{- with .Values.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - dnsPolicy: {{ .Values.dnsPolicy | quote }} - {{- with .Values.dnsConfig }} - dnsConfig: -{{ toYaml . | indent 8 }} - {{- end }} - {{- if .Values.topologySpreadConstraints }} - topologySpreadConstraints: - {{- include "oxpassport.topology-spread-constraints" . | indent 8 }} - {{- end }} - containers: - - name: {{ include "oxpassport.name" . }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - env: - - name: PASSPORT_LOG_LEVEL - value: "info" - {{- include "oxpassport.usr-envs" . | indent 12 }} - {{- include "oxpassport.usr-secret-envs" . | indent 12 }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - command: - - /bin/sh - - -c - - | - /usr/bin/python3 /scripts/updatelbip.py & - /app/scripts/entrypoint.sh - {{- end }} - ports: - - name: {{ .Values.service.name }} - containerPort: {{ .Values.service.port }} - protocol: TCP - envFrom: - - configMapRef: - name: {{ .Release.Name }}-config-cm - {{ if .Values.global.usrEnvs.secret }} - - secretRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - {{ if .Values.global.usrEnvs.normal }} - - configMapRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - volumeMounts: - {{- with .Values.volumeMounts }} -{{- toYaml . | nindent 10 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }} - name: aws-shared-credential-file - subPath: aws_shared_credential_file - - mountPath: {{ .Values.global.cnAwsConfigFile }} - name: aws-config-file - subPath: aws_config_file - - mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }} - name: aws-secrets-replica-regions - subPath: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - mountPath: {{ .Values.global.cnGoogleApplicationCredentials }} - name: google-sa - subPath: google-credentials.json - {{- end }} - - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "oxpassport.name" . }}-updatelbip - mountPath: /scripts - {{- end }} - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - mountPath: "/etc/certs/couchbase.crt" - subPath: couchbase.crt - {{- end }} - {{- end }} - livenessProbe: -{{- toYaml .Values.livenessProbe | nindent 10 }} - readinessProbe: -{{- toYaml .Values.readinessProbe | nindent 10 }} - {{- if and ( .Values.global.opendj.enabled ) (or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath")) }} - resources: {} - {{- else if .Values.global.cloud.testEnviroment }} - resources: {} - {{- else }} - resources: -{{- toYaml .Values.resources | nindent 10 }} - {{- end }} - {{- if not .Values.global.isFqdnRegistered }} - hostAliases: - - ip: {{ .Values.global.lbIp }} - hostnames: - - {{ .Values.global.fqdn }} - {{- end }} - volumes: - {{- with .Values.volumes }} -{{- toYaml . | nindent 8 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - name: aws-shared-credential-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_shared_credential_file - path: aws_shared_credential_file - - name: aws-config-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_config_file - path: aws_config_file - - name: aws-secrets-replica-regions - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_secrets_replica_regions - path: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - name: google-sa - secret: - secretName: {{ .Release.Name }}-google-sa - {{- end }} - - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "oxpassport.name" . }}-updatelbip - configMap: - name: {{ .Release.Name }}-updatelbip - {{- end }} - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - secret: - secretName: {{ .Release.Name }}-cb-crt - {{- end }} - {{- end }} - {{- with .Values.nodeSelector }} - nodeSelector: -{{ toYaml . | indent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} - {{- end }} diff --git a/charts/gluu/gluu/charts/oxpassport/templates/hpa.yaml b/charts/gluu/gluu/charts/oxpassport/templates/hpa.yaml deleted file mode 100644 index 0764e19e3..000000000 --- a/charts/gluu/gluu/charts/oxpassport/templates/hpa.yaml +++ /dev/null @@ -1,36 +0,0 @@ -{{ if .Values.hpa.enabled -}} -apiVersion: autoscaling/v1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "oxpassport.fullname" . }} - labels: -{{ include "oxpassport.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "oxpassport.fullname" . }} - minReplicas: {{ .Values.hpa.minReplicas }} - maxReplicas: {{ .Values.hpa.maxReplicas }} - {{- if .Values.hpa.targetCPUUtilizationPercentage }} - targetCPUUtilizationPercentage: {{ .Values.hpa.targetCPUUtilizationPercentage }} - {{- else if .Values.hpa.metrics }} - metrics: - {{- with .Values.hpa.metrics }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} - {{- if .Values.hpa.behavior }} - behavior: - {{- with .Values.hpa.behavior }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/oxpassport/templates/oxpassport-destination-rules.yaml b/charts/gluu/gluu/charts/oxpassport/templates/oxpassport-destination-rules.yaml deleted file mode 100644 index 238c976d1..000000000 --- a/charts/gluu/gluu/charts/oxpassport/templates/oxpassport-destination-rules.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{- if .Values.global.istio.enabled }} -apiVersion: networking.istio.io/v1alpha3 -kind: DestinationRule -metadata: - name: {{ .Release.Name }}-oxpassport-mtls - namespace: {{.Release.Namespace}} - labels: -{{ include "oxpassport.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - host: {{ .Values.global.oxpassport.oxPassportServiceName }}.{{ .Release.Namespace }}.svc.cluster.local - trafficPolicy: - tls: - mode: ISTIO_MUTUAL -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/oxpassport/templates/oxpassport-pdb.yaml b/charts/gluu/gluu/charts/oxpassport/templates/oxpassport-pdb.yaml deleted file mode 100644 index 8ebcdc717..000000000 --- a/charts/gluu/gluu/charts/oxpassport/templates/oxpassport-pdb.yaml +++ /dev/null @@ -1,11 +0,0 @@ -{{ if .Values.pdb.enabled -}} -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ include "oxpassport.fullname" . }} -spec: - maxUnavailable: {{ .Values.pdb.maxUnavailable }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "oxpassport.name" . }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/oxpassport/templates/oxpassport-virtual-services.yaml b/charts/gluu/gluu/charts/oxpassport/templates/oxpassport-virtual-services.yaml deleted file mode 100644 index 6c2416b84..000000000 --- a/charts/gluu/gluu/charts/oxpassport/templates/oxpassport-virtual-services.yaml +++ /dev/null @@ -1,37 +0,0 @@ -{{- if .Values.global.istio.ingress }} -apiVersion: networking.istio.io/v1alpha3 -kind: VirtualService -metadata: - name: {{ .Release.Name }}-istio-passport - namespace: {{.Release.Namespace}} - labels: -{{ include "oxpassport.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - hosts: - - {{ .Values.global.fqdn }} -{{- if .Values.global.istio.gateways }} - gateways: -{{ toYaml .Values.global.istio.gateways | indent 2 }} -{{- else }} - gateways: - - {{ .Release.Name }}-global-gtw -{{- end }} - http: - - name: {{ .Release.Name }}-istio-passport - match: - - uri: - prefix: "/passport" - route: - - destination: - host: {{ .Values.global.oxpassport.oxPassportServiceName }}.{{ .Release.Namespace }}.svc.cluster.local - port: - number: 8090 - weight: 100 -{{- end }} diff --git a/charts/gluu/gluu/charts/oxpassport/templates/service.yaml b/charts/gluu/gluu/charts/oxpassport/templates/service.yaml deleted file mode 100644 index b4fda3285..000000000 --- a/charts/gluu/gluu/charts/oxpassport/templates/service.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ .Values.global.oxpassport.oxPassportServiceName }} - namespace: {{ .Release.Namespace }} - labels: -{{ include "oxpassport.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - {{- if .Values.global.alb.ingress }} - type: NodePort - {{- end }} - ports: - - port: {{ .Values.service.port }} - name: {{ .Values.service.name }} - selector: - app: {{ .Release.Name }}-{{ include "oxpassport.name" . }} - release: {{ .Release.Name }} - sessionAffinity: {{ .Values.service.sessionAffinity }} - {{- with .Values.service.sessionAffinityConfig }} - sessionAffinityConfig: -{{ toYaml . | indent 4 }} - {{- end }} diff --git a/charts/gluu/gluu/charts/oxpassport/templates/user-custom-secret-envs.yaml b/charts/gluu/gluu/charts/oxpassport/templates/user-custom-secret-envs.yaml deleted file mode 100644 index 47ed7cd16..000000000 --- a/charts/gluu/gluu/charts/oxpassport/templates/user-custom-secret-envs.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{ if .Values.usrEnvs.secret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-{{ .Chart.Name }}-user-custom-envs - labels: -{{ include "oxpassport.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -data: - {{- range $key, $val := .Values.usrEnvs.secret }} - {{ $key }}: {{ $val | b64enc }} - {{- end}} -{{- end}} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/oxpassport/values.yaml b/charts/gluu/gluu/charts/oxpassport/values.yaml deleted file mode 100644 index b9654930a..000000000 --- a/charts/gluu/gluu/charts/oxpassport/values.yaml +++ /dev/null @@ -1,97 +0,0 @@ - -# -- Gluu interface to Passport.js to support social login and inbound identity. -# -- Configure the HorizontalPodAutoscaler -hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} -# -- Add custom normal and secret envs to the service -usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} -# -- Add custom dns policy -dnsPolicy: "" -# -- Add custom dns config -dnsConfig: {} -image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: gluufederation/oxpassport - # -- Image tag to use for deploying. - tag: 5.0.0_dev - # -- Image Pull Secrets - pullSecrets: [ ] -# -- Service replica number -replicas: 1 -# -- Resource specs. -resources: - limits: - # -- CPU limit. - cpu: 700m - # -- Memory limit. - memory: 900Mi - requests: - # -- CPU request. - cpu: 700m - # -- Memory request. - memory: 900Mi -service: - # -- Port of the oxPassport service. Please keep it as default. - port: 8090 - # -- The name of the oxPassport port within the oxPassport service. Please keep it as default. - name: http-passport - # -- Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP - sessionAffinity: None - # -- the maximum session sticky time if sessionAffinity is ClientIP - sessionAffinityConfig: - clientIP: - timeoutSeconds: 10800 - -# -- Configure the liveness healthcheck for oxPassport if needed. -livenessProbe: - httpGet: - # -- http liveness probe endpoint - path: /passport/health-check - port: http-passport - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - failureThreshold: 20 -# -- Configure the readiness healthcheck for the oxPassport if needed. -readinessProbe: - httpGet: - # -- http readiness probe endpoint - path: /passport/health-check - port: http-passport - initialDelaySeconds: 25 - periodSeconds: 25 - timeoutSeconds: 5 - failureThreshold: 20 -# -- Configure any additional volumes that need to be attached to the pod -volumes: [] -# -- Configure any additional volumesMounts that need to be attached to the containers -volumeMounts: [] - -nameOverride: "" -fullnameOverride: "" - -nodeSelector: {} - -tolerations: [] - -affinity: {} - -# -- Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} -additionalLabels: { } -# -- Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken -additionalAnnotations: { } \ No newline at end of file diff --git a/charts/gluu/gluu/charts/oxshibboleth/.helmignore b/charts/gluu/gluu/charts/oxshibboleth/.helmignore deleted file mode 100644 index f0c131944..000000000 --- a/charts/gluu/gluu/charts/oxshibboleth/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/charts/gluu/gluu/charts/oxshibboleth/Chart.yaml b/charts/gluu/gluu/charts/oxshibboleth/Chart.yaml deleted file mode 100644 index bc1f675e3..000000000 --- a/charts/gluu/gluu/charts/oxshibboleth/Chart.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: v2 -appVersion: 5.0.0 -description: Shibboleth project for the Gluu Server's SAML IDP functionality. -home: https://gluu.org/docs/gluu-server -icon: https://gluu.org/docs/gluu-server/favicon.ico -keywords: -- SAML -- Shibboleth -kubeVersion: '>=v1.21.0-0' -maintainers: -- email: support@gluu.org - name: Mohammad Abudayyeh - url: https://github.com/moabu -name: oxshibboleth -sources: -- https://github.com/GluuFederation/oxShibboleth -- https://github.com/GluuFederation/docker-oxshibboleth -- https://github.com/GluuFederation/flex/tree/main/flex-cn-setup/pygluu/kubernetes/templates/helm/gluu/charts/oxshibboleth -type: application -version: 5.0.10 diff --git a/charts/gluu/gluu/charts/oxshibboleth/README.md b/charts/gluu/gluu/charts/oxshibboleth/README.md deleted file mode 100644 index 3b877d7f2..000000000 --- a/charts/gluu/gluu/charts/oxshibboleth/README.md +++ /dev/null @@ -1,67 +0,0 @@ -# oxshibboleth - -![Version: 5.0.10](https://img.shields.io/badge/Version-5.0.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0](https://img.shields.io/badge/AppVersion-5.0.0-informational?style=flat-square) - -Shibboleth project for the Gluu Server's SAML IDP functionality. - -**Homepage:** - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| Mohammad Abudayyeh | | | - -## Source Code - -* -* -* - -## Requirements - -Kubernetes: `>=v1.21.0-0` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| additionalAnnotations | object | `{}` | Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken | -| additionalLabels | object | `{}` | Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} | -| affinity | object | `{}` | | -| dnsConfig | object | `{}` | Add custom dns config | -| dnsPolicy | string | `""` | Add custom dns policy | -| fullnameOverride | string | `""` | | -| hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| hpa.behavior | object | `{}` | Scaling Policies | -| hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| image.pullSecrets | list | `[]` | Image Pull Secrets | -| image.repository | string | `"gluufederation/oxshibboleth"` | Image to use for deploying. | -| image.tag | string | `"5.0.0_dev"` | Image tag to use for deploying. | -| livenessProbe | object | `{"httpGet":{"path":"/idp","port":"http-oxshib"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the oxShibboleth if needed. | -| livenessProbe.httpGet.path | string | `"/idp"` | http liveness probe endpoint | -| nameOverride | string | `""` | | -| nodeSelector | object | `{}` | | -| readinessProbe | object | `{"httpGet":{"path":"/idp","port":"http-oxshib"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the oxshibboleth if needed. | -| readinessProbe.httpGet.path | string | `"/idp"` | http liveness probe endpoint | -| replicas | int | `1` | Service replica number. | -| resources | object | `{"limits":{"cpu":"1000m","memory":"1000Mi"},"requests":{"cpu":"1000m","memory":"1000Mi"}}` | Resource specs. | -| resources.limits.cpu | string | `"1000m"` | CPU limit. | -| resources.limits.memory | string | `"1000Mi"` | Memory limit. | -| resources.requests.cpu | string | `"1000m"` | CPU request. | -| resources.requests.memory | string | `"1000Mi"` | Memory request. | -| service.name | string | `"http-oxshib"` | Port of the oxShibboleth service. Please keep it as default. | -| service.port | int | `8080` | The name of the oxShibboleth port within the oxShibboleth service. Please keep it as default. | -| service.sessionAffinity | string | `"None"` | Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP | -| service.sessionAffinityConfig | object | `{"clientIP":{"timeoutSeconds":10800}}` | the maximum session sticky time if sessionAffinity is ClientIP | -| service.targetPort | int | `8080` | | -| tolerations | list | `[]` | | -| usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/gluu/gluu/charts/oxshibboleth/templates/_helpers.tpl b/charts/gluu/gluu/charts/oxshibboleth/templates/_helpers.tpl deleted file mode 100644 index a9a1a94b7..000000000 --- a/charts/gluu/gluu/charts/oxshibboleth/templates/_helpers.tpl +++ /dev/null @@ -1,144 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "oxshibboleth.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "oxshibboleth.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "oxshibboleth.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* - Common labels -*/}} -{{- define "oxshibboleth.labels" -}} -app: {{ .Release.Name }}-{{ include "oxshibboleth.name" . }} -helm.sh/chart: {{ include "oxshibboleth.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Create user custom defined envs -*/}} -{{- define "oxshibboleth.usr-envs"}} -{{- range $key, $val := .Values.usrEnvs.normal }} -- name: {{ $key }} - value: {{ $val | quote }} -{{- end }} -{{- end }} - -{{/* -Create user custom defined secret envs -*/}} -{{- define "oxshibboleth.usr-secret-envs"}} -{{- range $key, $val := .Values.usrEnvs.secret }} -- name: {{ $key }} - valueFrom: - secretKeyRef: - name: {{ $.Release.Name }}-{{ $.Chart.Name }}-user-custom-envs - key: {{ $key | quote }} -{{- end }} -{{- end }} - -{{/* -Create GLUU_JAVA_OPTIONS ENV for passing detailed logs -*/}} -{{- define "oxshibboleth.detailedLogs"}} -{{ $ldap := "" }} -{{ $messages := "" }} -{{ $encryption := "" }} -{{ $opensaml := "" }} -{{ $props := "" }} -{{ $httpclient := "" }} -{{ $spring := "" }} -{{ $container := "" }} -{{ $xmlsec := "" }} - -{{- if .Values.global.oxshibboleth.appLoggers.ldapLogLevel }} -{{ $ldap = printf "-Didp.loglevel.ldap=%s " .Values.global.oxshibboleth.appLoggers.ldapLogLevel }} -{{- end}} -{{- if .Values.global.oxshibboleth.appLoggers.messagesLogLevel }} -{{ $messages = printf "-Didp.loglevel.messages=%s " .Values.global.oxshibboleth.appLoggers.messagesLogLevel }} -{{- end}} -{{- if .Values.global.oxshibboleth.appLoggers.encryptionLogLevel }} -{{ $encryption = printf "-Didp.loglevel.encryption=%s " .Values.global.oxshibboleth.appLoggers.encryptionLogLevel }} -{{- end}} -{{- if .Values.global.oxshibboleth.appLoggers.opensamlLogLevel }} -{{ $opensaml = printf "-Didp.loglevel.opensaml=%s " .Values.global.oxshibboleth.appLoggers.opensamlLogLevel }} -{{- end}} -{{- if .Values.global.oxshibboleth.appLoggers.propsLogLevel }} -{{ $props = printf "-Didp.loglevel.props=%s " .Values.global.oxshibboleth.appLoggers.propsLogLevel }} -{{- end}} -{{- if .Values.global.oxshibboleth.appLoggers.httpclientLogLevel }} -{{ $httpclient = printf "-Didp.loglevel.httpclient=%s " .Values.global.oxshibboleth.appLoggers.httpclientLogLevel }} -{{- end}} -{{- if .Values.global.oxshibboleth.appLoggers.springLogLevel }} -{{ $spring = printf "-Didp.loglevel.spring=%s " .Values.global.oxshibboleth.appLoggers.springLogLevel }} -{{- end}} -{{- if .Values.global.oxshibboleth.appLoggers.containerLogLevel }} -{{ $container = printf "-Didp.loglevel.container=%s " .Values.global.oxshibboleth.appLoggers.containerLogLevel }} -{{- end}} -{{- if .Values.global.oxshibboleth.appLoggers.xmlsecLogLevel }} -{{ $xmlsec = printf "-Didp.loglevel.xmlsec=%s " .Values.global.oxshibboleth.appLoggers.xmlsecLogLevel }} -{{- end}} - -{{ $detailLogs := printf "%s%s%s%s%s%s%s%s%s" $ldap $messages $encryption $opensaml $props $httpclient $spring $container $xmlsec }} -{{ $detailLogs | trimSuffix " " | quote }} -{{- end }} - -{{/* -Create topologySpreadConstraints lists -*/}} -{{- define "oxshibboleth.topology-spread-constraints"}} -{{- range $key, $val := .Values.topologySpreadConstraints }} -- maxSkew: {{ $val.maxSkew }} - {{- if $val.minDomains }} - minDomains: {{ $val.minDomains }} # optional; beta since v1.25 - {{- end}} - {{- if $val.topologyKey }} - topologyKey: {{ $val.topologyKey }} - {{- end}} - {{- if $val.whenUnsatisfiable }} - whenUnsatisfiable: {{ $val.whenUnsatisfiable }} - {{- end}} - labelSelector: - matchLabels: - app: {{ $.Release.Name }}-{{ include "oxshibboleth.name" $ }} - {{- if $val.matchLabelKeys }} - matchLabelKeys: {{ $val.matchLabelKeys }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeAffinityPolicy }} - nodeAffinityPolicy: {{ $val.nodeAffinityPolicy }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeTaintsPolicy }} - nodeTaintsPolicy: {{ $val.nodeTaintsPolicy }} # optional; alpha since v1.25 - {{- end}} -{{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/oxshibboleth/templates/hpa.yaml b/charts/gluu/gluu/charts/oxshibboleth/templates/hpa.yaml deleted file mode 100644 index 3d4c0597f..000000000 --- a/charts/gluu/gluu/charts/oxshibboleth/templates/hpa.yaml +++ /dev/null @@ -1,37 +0,0 @@ -{{ if .Values.hpa.enabled -}} -apiVersion: autoscaling/v1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "oxshibboleth.fullname" . }} - labels: - APP_NAME: oxshibboleth -{{ include "oxshibboleth.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: StatefulSet - name: {{ include "oxshibboleth.fullname" . }} - minReplicas: {{ .Values.hpa.minReplicas }} - maxReplicas: {{ .Values.hpa.maxReplicas }} - {{- if .Values.hpa.targetCPUUtilizationPercentage }} - targetCPUUtilizationPercentage: {{ .Values.hpa.targetCPUUtilizationPercentage }} - {{- else if .Values.hpa.metrics }} - metrics: - {{- with .Values.hpa.metrics }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} - {{- if .Values.hpa.behavior }} - behavior: - {{- with .Values.hpa.behavior }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/oxshibboleth/templates/oxshibboleth-destination-rules.yaml b/charts/gluu/gluu/charts/oxshibboleth/templates/oxshibboleth-destination-rules.yaml deleted file mode 100644 index 8478504b6..000000000 --- a/charts/gluu/gluu/charts/oxshibboleth/templates/oxshibboleth-destination-rules.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- if .Values.global.istio.enabled }} -apiVersion: networking.istio.io/v1alpha3 -kind: DestinationRule -metadata: - name: {{ .Release.Name }}-oxshibboleth-mtls - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: oxshibboleth -{{ include "oxshibboleth.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - host: {{ .Values.global.oxshibboleth.oxShibbolethServiceName }}.{{ .Release.Namespace }}.svc.cluster.local - trafficPolicy: - tls: - mode: ISTIO_MUTUAL -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/oxshibboleth/templates/oxshibboleth-pdb.yaml b/charts/gluu/gluu/charts/oxshibboleth/templates/oxshibboleth-pdb.yaml deleted file mode 100644 index a8c99410c..000000000 --- a/charts/gluu/gluu/charts/oxshibboleth/templates/oxshibboleth-pdb.yaml +++ /dev/null @@ -1,11 +0,0 @@ -{{ if .Values.pdb.enabled -}} -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ include "oxshibboleth.fullname" . }} -spec: - maxUnavailable: {{ .Values.pdb.maxUnavailable }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "oxshibboleth.name" . }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/oxshibboleth/templates/oxshibboleth-virtual-services.yaml b/charts/gluu/gluu/charts/oxshibboleth/templates/oxshibboleth-virtual-services.yaml deleted file mode 100644 index 5f89fa5c2..000000000 --- a/charts/gluu/gluu/charts/oxshibboleth/templates/oxshibboleth-virtual-services.yaml +++ /dev/null @@ -1,33 +0,0 @@ -{{- if .Values.global.istio.ingress }} -apiVersion: networking.istio.io/v1alpha3 -kind: VirtualService -metadata: - name: {{ .Release.Name }}-istio-oxshibbioleth - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: oxshibboleth -{{ include "oxshibboleth.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - hosts: - - {{ .Values.global.fqdn }} - gateways: - - {{ .Release.Name }}-global-gtw - http: - - name: {{ .Release.Name }}-istio-oxshibbioleth - match: - - uri: - prefix: /idp - route: - - destination: - host: {{ .Values.global.oxshibboleth.oxShibbolethServiceName }}.{{ .Release.Namespace }}.svc.cluster.local - port: - number: 8080 - weight: 100 -{{- end }} diff --git a/charts/gluu/gluu/charts/oxshibboleth/templates/service.yaml b/charts/gluu/gluu/charts/oxshibboleth/templates/service.yaml deleted file mode 100644 index 478177475..000000000 --- a/charts/gluu/gluu/charts/oxshibboleth/templates/service.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ .Values.global.oxshibboleth.oxShibbolethServiceName }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: oxshibboleth -{{ include "oxshibboleth.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - {{- if .Values.global.alb.ingress }} - type: NodePort - {{- else }} - clusterIP: None - {{- end }} - ports: - - port: {{ .Values.service.port }} - targetPort: {{ .Values.service.targetPort }} - name: {{ .Values.service.name }} - selector: - app: {{ .Release.Name }}-{{ include "oxshibboleth.name" . }} - release: {{ .Release.Name }} - sessionAffinity: {{ .Values.service.sessionAffinity }} - {{- with .Values.service.sessionAffinityConfig }} - sessionAffinityConfig: -{{ toYaml . | indent 4 }} - {{- end }} diff --git a/charts/gluu/gluu/charts/oxshibboleth/templates/statefulset.yaml b/charts/gluu/gluu/charts/oxshibboleth/templates/statefulset.yaml deleted file mode 100644 index 6cf0886b9..000000000 --- a/charts/gluu/gluu/charts/oxshibboleth/templates/statefulset.yaml +++ /dev/null @@ -1,169 +0,0 @@ -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: {{ include "oxshibboleth.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: oxshibboleth -{{ include "oxshibboleth.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - serviceName: oxshibboleth - replicas: {{ .Values.replicas }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "oxshibboleth.name" . }} - release: {{ .Release.Name }} - template: - metadata: - labels: - APP_NAME: oxshibboleth - app: {{ .Release.Name }}-{{ include "oxshibboleth.name" . }} - release: {{ .Release.Name }} - {{- if .Values.global.istio.ingress }} - annotations: - sidecar.istio.io/rewriteAppHTTPProbers: "true" - {{- end }} - spec: - {{- with .Values.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - dnsPolicy: {{ .Values.dnsPolicy | quote }} - {{- with .Values.dnsConfig }} - dnsConfig: -{{ toYaml . | indent 8 }} - {{- end }} - {{- if .Values.topologySpreadConstraints }} - topologySpreadConstraints: - {{- include "oxshibboleth.topology-spread-constraints" . | indent 8 }} - {{- end }} - containers: - - name: {{ include "oxshibboleth.name" . }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - env: - {{- include "oxshibboleth.usr-envs" . | indent 12 }} - {{- include "oxshibboleth.usr-secret-envs" . | indent 12 }} - - name: GLUU_JAVA_OPTIONS - value: {{ include "oxshibboleth.detailedLogs" . | trim }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - command: - - /bin/sh - - -c - - | - /usr/bin/python3 /scripts/updatelbip.py & - /app/scripts/entrypoint.sh - {{- end }} - ports: - - name: {{ .Values.service.name }} - containerPort: {{ .Values.service.port }} - protocol: TCP - envFrom: - - configMapRef: - name: {{ .Release.Name }}-config-cm - {{ if .Values.global.usrEnvs.secret }} - - secretRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - {{ if .Values.global.usrEnvs.normal }} - - configMapRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - volumeMounts: - {{- with .Values.volumeMounts }} -{{- toYaml . | nindent 12 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }} - name: aws-shared-credential-file - subPath: aws_shared_credential_file - - mountPath: {{ .Values.global.cnAwsConfigFile }} - name: aws-config-file - subPath: aws_config_file - - mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }} - name: aws-secrets-replica-regions - subPath: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - mountPath: {{ .Values.global.cnGoogleApplicationCredentials }} - name: google-sa - subPath: google-credentials.json - {{- end }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "oxshibboleth.fullname" .}}-updatelbip - mountPath: /scripts - {{- end }} - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - mountPath: "/etc/certs/couchbase.crt" - subPath: couchbase.crt - {{- end }} - {{- end }} - livenessProbe: -{{- toYaml .Values.livenessProbe | nindent 10 }} - readinessProbe: -{{- toYaml .Values.readinessProbe | nindent 10 }} - {{- if and ( .Values.global.opendj.enabled ) (or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath")) }} - resources: {} - {{- else if .Values.global.cloud.testEnviroment }} - resources: {} - {{- else }} - resources: -{{- toYaml .Values.resources | nindent 10 }} - {{- end }} - {{- if not .Values.global.isFqdnRegistered }} - hostAliases: - - ip: {{ .Values.global.lbIp }} - hostnames: - - {{ .Values.global.fqdn }} - {{- end }} - volumes: - {{- with .Values.volumes }} -{{- toYaml . | nindent 8 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - name: aws-shared-credential-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_shared_credential_file - path: aws_shared_credential_file - - name: aws-config-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_config_file - path: aws_config_file - - name: aws-secrets-replica-regions - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_secrets_replica_regions - path: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - name: google-sa - secret: - secretName: {{ .Release.Name }}-google-sa - {{- end }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "oxshibboleth.fullname" .}}-updatelbip - configMap: - name: {{ .Release.Name }}-updatelbip - {{- end }} - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - secret: - secretName: {{ .Release.Name }}-cb-crt - {{- end }} - {{- end }} diff --git a/charts/gluu/gluu/charts/oxshibboleth/templates/user-custom-secret-envs.yaml b/charts/gluu/gluu/charts/oxshibboleth/templates/user-custom-secret-envs.yaml deleted file mode 100644 index fd6e4e0aa..000000000 --- a/charts/gluu/gluu/charts/oxshibboleth/templates/user-custom-secret-envs.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{ if .Values.usrEnvs.secret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-{{ .Chart.Name }}-user-custom-envs - labels: - APP_NAME: oxshibboleth -{{ include "oxshibboleth.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -data: - {{- range $key, $val := .Values.usrEnvs.secret }} - {{ $key }}: {{ $val | b64enc }} - {{- end}} -{{- end}} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/oxshibboleth/values.yaml b/charts/gluu/gluu/charts/oxshibboleth/values.yaml deleted file mode 100644 index 6baaa0bcc..000000000 --- a/charts/gluu/gluu/charts/oxshibboleth/values.yaml +++ /dev/null @@ -1,96 +0,0 @@ - -# -- Shibboleth project for the Gluu Server's SAML IDP functionality. -# -- Configure the HorizontalPodAutoscaler -hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} -# -- Add custom normal and secret envs to the service -usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} -# -- Add custom dns policy -dnsPolicy: "" -# -- Add custom dns config -dnsConfig: {} -image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: gluufederation/oxshibboleth - # -- Image tag to use for deploying. - tag: 5.0.0_dev - # -- Image Pull Secrets - pullSecrets: [ ] -# -- Service replica number. -replicas: 1 -# -- Resource specs. -resources: - limits: - # -- CPU limit. - cpu: 1000m - # -- Memory limit. - memory: 1000Mi - requests: - # -- CPU request. - cpu: 1000m - # -- Memory request. - memory: 1000Mi -service: - # -- The name of the oxShibboleth port within the oxShibboleth service. Please keep it as default. - port: 8080 - targetPort: 8080 - # -- Port of the oxShibboleth service. Please keep it as default. - name: http-oxshib - # -- Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP - sessionAffinity: None - # -- the maximum session sticky time if sessionAffinity is ClientIP - sessionAffinityConfig: - clientIP: - timeoutSeconds: 10800 - -# -- Configure the liveness healthcheck for the oxShibboleth if needed. -livenessProbe: - httpGet: - # -- http liveness probe endpoint - path: /idp - port: http-oxshib - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 -# -- Configure the readiness healthcheck for the oxshibboleth if needed. -readinessProbe: - httpGet: - # -- http liveness probe endpoint - path: /idp - port: http-oxshib - initialDelaySeconds: 25 - periodSeconds: 25 - timeoutSeconds: 5 -# -- Configure any additional volumes that need to be attached to the pod -volumes: [] -# -- Configure any additional volumesMounts that need to be attached to the containers -volumeMounts: [] - -nameOverride: "" -fullnameOverride: "" - -nodeSelector: {} - -tolerations: [] - -affinity: {} - -# -- Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} -additionalLabels: { } -# -- Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken -additionalAnnotations: { } \ No newline at end of file diff --git a/charts/gluu/gluu/charts/persistence/.helmignore b/charts/gluu/gluu/charts/persistence/.helmignore deleted file mode 100644 index 50af03172..000000000 --- a/charts/gluu/gluu/charts/persistence/.helmignore +++ /dev/null @@ -1,22 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/charts/gluu/gluu/charts/persistence/Chart.yaml b/charts/gluu/gluu/charts/persistence/Chart.yaml deleted file mode 100644 index e736208f3..000000000 --- a/charts/gluu/gluu/charts/persistence/Chart.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: v2 -appVersion: 5.0.0 -description: Job to generate data and initial config for Gluu Server persistence layer. -home: https://gluu.org/docs/gluu-server -icon: https://gluu.org/docs/gluu-server/favicon.ico -keywords: -- persistence prep -kubeVersion: '>=v1.21.0-0' -maintainers: -- email: support@gluu.org - name: Mohammad Abudayyeh - url: https://github.com/moabu -name: persistence -sources: -- https://github.com/JanssenProject/jans/docker-jans-persistence-loader -- https://github.com/GluuFederation/flex/tree/main/flex-cn-setup/pygluu/kubernetes/templates/helm/gluu/charts/persistence -type: application -version: 5.0.10 diff --git a/charts/gluu/gluu/charts/persistence/README.md b/charts/gluu/gluu/charts/persistence/README.md deleted file mode 100644 index eb579723f..000000000 --- a/charts/gluu/gluu/charts/persistence/README.md +++ /dev/null @@ -1,51 +0,0 @@ -# persistence - -![Version: 5.0.10](https://img.shields.io/badge/Version-5.0.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0](https://img.shields.io/badge/AppVersion-5.0.0-informational?style=flat-square) - -Job to generate data and initial config for Gluu Server persistence layer. - -**Homepage:** - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| Mohammad Abudayyeh | | | - -## Source Code - -* -* - -## Requirements - -Kubernetes: `>=v1.21.0-0` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| additionalAnnotations | object | `{}` | Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken | -| additionalLabels | object | `{}` | Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} | -| dnsConfig | object | `{}` | Add custom dns config | -| dnsPolicy | string | `""` | Add custom dns policy | -| fullnameOverride | string | `""` | | -| image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| image.pullSecrets | list | `[]` | Image Pull Secrets | -| image.repository | string | `"gluufederation/persistence"` | Image to use for deploying. | -| image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| imagePullSecrets | list | `[]` | | -| nameOverride | string | `""` | | -| resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. | -| resources.limits.cpu | string | `"300m"` | CPU limit | -| resources.limits.memory | string | `"300Mi"` | Memory limit. | -| resources.requests.cpu | string | `"300m"` | CPU request. | -| resources.requests.memory | string | `"300Mi"` | Memory request. | -| usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/gluu/gluu/charts/persistence/templates/_helpers.tpl b/charts/gluu/gluu/charts/persistence/templates/_helpers.tpl deleted file mode 100644 index bf0a313b2..000000000 --- a/charts/gluu/gluu/charts/persistence/templates/_helpers.tpl +++ /dev/null @@ -1,79 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "persistence.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "persistence.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "persistence.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Common labels -*/}} -{{- define "persistence.labels" -}} -app: {{ .Release.Name }}-{{ include "persistence.name" . }} -helm.sh/chart: {{ include "persistence.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Create the name of the service account to use -*/}} -{{- define "persistence.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} - {{ default (include "persistence.fullname" .) .Values.serviceAccount.name }} -{{- else -}} - {{ default "default" .Values.serviceAccount.name }} -{{- end -}} -{{- end -}} - -{{/* -Create user custom defined envs -*/}} -{{- define "persistence.usr-envs"}} -{{- range $key, $val := .Values.usrEnvs.normal }} -- name: {{ $key }} - value: {{ $val | quote }} -{{- end }} -{{- end }} - -{{/* -Create user custom defined secret envs -*/}} -{{- define "persistence.usr-secret-envs"}} -{{- range $key, $val := .Values.usrEnvs.secret }} -- name: {{ $key }} - valueFrom: - secretKeyRef: - name: {{ $.Release.Name }}-{{ $.Chart.Name }}-user-custom-envs - key: {{ $key | quote }} -{{- end }} -{{- end }} diff --git a/charts/gluu/gluu/charts/persistence/templates/jobs.yml b/charts/gluu/gluu/charts/persistence/templates/jobs.yml deleted file mode 100644 index b76cf43c2..000000000 --- a/charts/gluu/gluu/charts/persistence/templates/jobs.yml +++ /dev/null @@ -1,126 +0,0 @@ -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ include "persistence.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: persistence-loader -{{ include "persistence.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - ttlSecondsAfterFinished: {{ .Values.global.jobTtlSecondsAfterFinished }} - template: - metadata: - name: {{ include "persistence.name" . }} - labels: - APP_NAME: persistence-loader - app: {{ .Release.Name }}-{{ include "persistence.name" . }} - spec: - {{- with .Values.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - dnsPolicy: {{ .Values.dnsPolicy | quote }} - {{- with .Values.dnsConfig }} - dnsConfig: -{{ toYaml . | indent 8 }} - {{- end }} - restartPolicy: Never - containers: - - name: {{ include "persistence.name" . }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - securityContext: - runAsUser: 1000 - runAsNonRoot: true - env: - {{- include "persistence.usr-envs" . | indent 12 }} - {{- include "persistence.usr-secret-envs" . | indent 12 }} - {{- if .Values.global.istio.enabled }} - command: - - tini - - -g - - -- - - /bin/sh - - -c - - | - /app/scripts/entrypoint.sh - curl -X POST http://localhost:15020/quitquitquit - {{- end }} - envFrom: - - configMapRef: - name: {{ .Release.Name }}-config-cm - {{ if .Values.global.usrEnvs.secret }} - - secretRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - {{ if .Values.global.usrEnvs.normal }} - - configMapRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - volumeMounts: - {{- with .Values.volumeMounts }} -{{- toYaml . | nindent 10 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }} - name: aws-shared-credential-file - subPath: aws_shared_credential_file - - mountPath: {{ .Values.global.cnAwsConfigFile }} - name: aws-config-file - subPath: aws_config_file - - mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }} - name: aws-secrets-replica-regions - subPath: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - mountPath: {{ .Values.global.cnGoogleApplicationCredentials }} - name: google-sa - subPath: google-credentials.json - {{- end }} - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - - name: cb-crt - mountPath: "/etc/certs/couchbase.crt" - subPath: couchbase.crt - {{- end }} - resources: -{{- toYaml .Values.resources | nindent 10 }} - volumes: - {{- with .Values.volumes }} -{{- toYaml . | nindent 8 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - name: aws-shared-credential-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_shared_credential_file - path: aws_shared_credential_file - - name: aws-config-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_config_file - path: aws_config_file - - name: aws-secrets-replica-regions - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_secrets_replica_regions - path: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - name: google-sa - secret: - secretName: {{ .Release.Name }}-google-sa - {{- end }} - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - - name: cb-crt - secret: - secretName: {{ .Release.Name }}-cb-crt - {{- end }} diff --git a/charts/gluu/gluu/charts/persistence/templates/service.yaml b/charts/gluu/gluu/charts/persistence/templates/service.yaml deleted file mode 100644 index b266650a6..000000000 --- a/charts/gluu/gluu/charts/persistence/templates/service.yaml +++ /dev/null @@ -1,27 +0,0 @@ -{{- if .Values.global.istio.enabled }} -# License terms and conditions: -# https://www.apache.org/licenses/LICENSE-2.0 -# Used with Istio -apiVersion: v1 -kind: Service -metadata: - name: {{ include "persistence.fullname" . }} - labels: - APP_NAME: persistence-loader -{{ include "persistence.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - ports: - - name: http - port: 80 - targetPort: 8080 - selector: - app: {{ .Release.Name }}-{{ include "persistence.name" . }} - type: ClusterIP -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/persistence/templates/user-custom-secret-envs.yaml b/charts/gluu/gluu/charts/persistence/templates/user-custom-secret-envs.yaml deleted file mode 100644 index 29c8651b8..000000000 --- a/charts/gluu/gluu/charts/persistence/templates/user-custom-secret-envs.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{ if .Values.usrEnvs.secret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-{{ .Chart.Name }}-user-custom-envs - labels: -{{ include "persistence.labels" . | indent 4 }} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -data: - {{- range $key, $val := .Values.usrEnvs.secret }} - {{ $key }}: {{ $val | b64enc }} - {{- end}} -{{- end}} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/persistence/values.yaml b/charts/gluu/gluu/charts/persistence/values.yaml deleted file mode 100644 index 662b58539..000000000 --- a/charts/gluu/gluu/charts/persistence/values.yaml +++ /dev/null @@ -1,48 +0,0 @@ - -# -- Job to generate data and initial config for Gluu Server persistence layer. -# -- Add custom normal and secret envs to the service -usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} -# -- Add custom dns policy -dnsPolicy: "" -# -- Add custom dns config -dnsConfig: {} -image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: gluufederation/persistence - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] -# -- Resource specs. -resources: - limits: - # -- CPU limit - cpu: 300m - # -- Memory limit. - memory: 300Mi - requests: - # -- CPU request. - cpu: 300m - # -- Memory request. - memory: 300Mi -# -- Configure any additional volumes that need to be attached to the pod -volumes: [] -# -- Configure any additional volumesMounts that need to be attached to the containers -volumeMounts: [] - -imagePullSecrets: [] -nameOverride: "" -fullnameOverride: "" - -# -- Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} -additionalLabels: { } -# -- Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken -additionalAnnotations: { } \ No newline at end of file diff --git a/charts/gluu/gluu/charts/scim/.helmignore b/charts/gluu/gluu/charts/scim/.helmignore deleted file mode 100644 index f0c131944..000000000 --- a/charts/gluu/gluu/charts/scim/.helmignore +++ /dev/null @@ -1,21 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj diff --git a/charts/gluu/gluu/charts/scim/Chart.yaml b/charts/gluu/gluu/charts/scim/Chart.yaml deleted file mode 100644 index 930609500..000000000 --- a/charts/gluu/gluu/charts/scim/Chart.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: v2 -appVersion: 5.0.0 -description: System for Cross-domain Identity Management (SCIM) version 2.0 -home: https://gluu.org/docs/gluu-server -icon: https://gluu.org/docs/gluu-server/favicon.ico -keywords: -- SCIM -- API -kubeVersion: '>=v1.21.0-0' -maintainers: -- email: support@gluu.org - name: Mohammad Abudayyeh - url: https://github.com/moabu -name: scim -sources: -- https://github.com/JanssenProject/jans/jans-scim -- https://github.com/JanssenProject/jans/docker-jans-scim -- https://github.com/GluuFederation/flex/tree/main/flex-cn-setup/pygluu/kubernetes/templates/helm/gluu/charts/scim -type: application -version: 5.0.10 diff --git a/charts/gluu/gluu/charts/scim/README.md b/charts/gluu/gluu/charts/scim/README.md deleted file mode 100644 index 9f6887ac0..000000000 --- a/charts/gluu/gluu/charts/scim/README.md +++ /dev/null @@ -1,60 +0,0 @@ -# scim - -![Version: 5.0.10](https://img.shields.io/badge/Version-5.0.10-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0](https://img.shields.io/badge/AppVersion-5.0.0-informational?style=flat-square) - -System for Cross-domain Identity Management (SCIM) version 2.0 - -**Homepage:** - -## Maintainers - -| Name | Email | Url | -| ---- | ------ | --- | -| Mohammad Abudayyeh | | | - -## Source Code - -* -* -* - -## Requirements - -Kubernetes: `>=v1.21.0-0` - -## Values - -| Key | Type | Default | Description | -|-----|------|---------|-------------| -| additionalAnnotations | object | `{}` | Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken | -| additionalLabels | object | `{}` | Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} | -| dnsConfig | object | `{}` | Add custom dns config | -| dnsPolicy | string | `""` | Add custom dns policy | -| hpa | object | `{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50}` | Configure the HorizontalPodAutoscaler | -| hpa.behavior | object | `{}` | Scaling Policies | -| hpa.metrics | list | `[]` | metrics if targetCPUUtilizationPercentage is not set | -| image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | -| image.pullSecrets | list | `[]` | Image Pull Secrets | -| image.repository | string | `"janssenproject/scim"` | Image to use for deploying. | -| image.tag | string | `"1.0.5-1"` | Image tag to use for deploying. | -| livenessProbe | object | `{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for SCIM if needed. | -| livenessProbe.httpGet.path | string | `"/jans-scim/sys/health-check"` | http liveness probe endpoint | -| readinessProbe | object | `{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the SCIM if needed. | -| readinessProbe.httpGet.path | string | `"/jans-scim/sys/health-check"` | http readiness probe endpoint | -| replicas | int | `1` | Service replica number. | -| resources.limits.cpu | string | `"1000m"` | CPU limit. | -| resources.limits.memory | string | `"1000Mi"` | Memory limit. | -| resources.requests.cpu | string | `"1000m"` | CPU request. | -| resources.requests.memory | string | `"1000Mi"` | Memory request. | -| service.name | string | `"http-scim"` | The name of the scim port within the scim service. Please keep it as default. | -| service.port | int | `8080` | Port of the scim service. Please keep it as default. | -| service.sessionAffinity | string | `"None"` | Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP | -| service.sessionAffinityConfig | object | `{"clientIP":{"timeoutSeconds":10800}}` | the maximum session sticky time if sessionAffinity is ClientIP | -| usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service | -| usrEnvs.normal | object | `{}` | Add custom normal envs to the service variable1: value1 | -| usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | -| volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | -| volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | - ----------------------------------------------- -Autogenerated from chart metadata using [helm-docs v1.11.0](https://github.com/norwoodj/helm-docs/releases/v1.11.0) diff --git a/charts/gluu/gluu/charts/scim/templates/_helpers.tpl b/charts/gluu/gluu/charts/scim/templates/_helpers.tpl deleted file mode 100644 index 04b66d5af..000000000 --- a/charts/gluu/gluu/charts/scim/templates/_helpers.tpl +++ /dev/null @@ -1,98 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "scim.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "scim.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "scim.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* - Common labels -*/}} -{{- define "scim.labels" -}} -app: {{ .Release.Name }}-{{ include "scim.name" . }} -helm.sh/chart: {{ include "scim.chart" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end -}} - -{{/* -Create user custom defined envs -*/}} -{{- define "scim.usr-envs"}} -{{- range $key, $val := .Values.usrEnvs.normal }} -- name: {{ $key }} - value: {{ $val | quote }} -{{- end }} -{{- end }} - -{{/* -Create user custom defined secret envs -*/}} -{{- define "scim.usr-secret-envs"}} -{{- range $key, $val := .Values.usrEnvs.secret }} -- name: {{ $key }} - valueFrom: - secretKeyRef: - name: {{ $.Release.Name }}-{{ $.Chart.Name }}-user-custom-envs - key: {{ $key | quote }} -{{- end }} -{{- end }} - -{{/* -Create topologySpreadConstraints lists -*/}} -{{- define "scim.topology-spread-constraints"}} -{{- range $key, $val := .Values.topologySpreadConstraints }} -- maxSkew: {{ $val.maxSkew }} - {{- if $val.minDomains }} - minDomains: {{ $val.minDomains }} # optional; beta since v1.25 - {{- end}} - {{- if $val.topologyKey }} - topologyKey: {{ $val.topologyKey }} - {{- end}} - {{- if $val.whenUnsatisfiable }} - whenUnsatisfiable: {{ $val.whenUnsatisfiable }} - {{- end}} - labelSelector: - matchLabels: - app: {{ $.Release.Name }}-{{ include "scim.name" $ }} - {{- if $val.matchLabelKeys }} - matchLabelKeys: {{ $val.matchLabelKeys }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeAffinityPolicy }} - nodeAffinityPolicy: {{ $val.nodeAffinityPolicy }} # optional; alpha since v1.25 - {{- end}} - {{- if $val.nodeTaintsPolicy }} - nodeTaintsPolicy: {{ $val.nodeTaintsPolicy }} # optional; alpha since v1.25 - {{- end}} -{{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/scim/templates/deployment.yml b/charts/gluu/gluu/charts/scim/templates/deployment.yml deleted file mode 100644 index ac7b9f603..000000000 --- a/charts/gluu/gluu/charts/scim/templates/deployment.yml +++ /dev/null @@ -1,172 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: {{ include "scim.fullname" . }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: scim -{{ include "scim.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - replicas: {{ .Values.replicas }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "scim.name" . }} - template: - metadata: - labels: - APP_NAME: scim - app: {{ .Release.Name }}-{{ include "scim.name" . }} - {{- if .Values.global.istio.ingress }} - annotations: - sidecar.istio.io/rewriteAppHTTPProbers: "true" - {{- end }} - spec: - {{- with .Values.image.pullSecrets }} - imagePullSecrets: - {{- toYaml . | nindent 8 }} - {{- end }} - dnsPolicy: {{ .Values.dnsPolicy | quote }} - {{- with .Values.dnsConfig }} - dnsConfig: -{{ toYaml . | indent 8 }} - {{- end }} - {{- if .Values.topologySpreadConstraints }} - topologySpreadConstraints: - {{- include "scim.topology-spread-constraints" . | indent 8 }} - {{- end }} - containers: - - name: {{ include "scim.name" . }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} - securityContext: - runAsUser: 1000 - runAsNonRoot: true - env: - {{- include "scim.usr-envs" . | indent 12 }} - {{- include "scim.usr-secret-envs" . | indent 12 }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - command: - - /bin/sh - - -c - - | - /usr/bin/python3 /scripts/updatelbip.py & - /app/scripts/entrypoint.sh - {{- end}} - {{- if and ( .Values.global.opendj.enabled ) (or (eq .Values.global.storageClass.provisioner "microk8s.io/hostpath" ) (eq .Values.global.storageClass.provisioner "k8s.io/minikube-hostpath")) }} - resources: {} - {{- else if .Values.global.cloud.testEnviroment }} - resources: {} - {{- else }} - resources: -{{- toYaml .Values.resources | nindent 10 }} - {{- end }} - ports: - - name: {{ .Values.service.name }} - containerPort: {{ .Values.service.port }} - {{ if .Values.global.cnPrometheusPort }} - - name: prometheus-port - containerPort: {{ .Values.global.cnPrometheusPort }} - {{- end }} - envFrom: - - configMapRef: - name: {{ .Release.Name }}-config-cm - {{ if .Values.global.usrEnvs.secret }} - - secretRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - {{ if .Values.global.usrEnvs.normal }} - - configMapRef: - name: {{ .Release.Name }}-global-user-custom-envs - {{- end }} - volumeMounts: - {{- with .Values.volumeMounts }} -{{- toYaml . | nindent 10 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - mountPath: {{ .Values.global.cnAwsSharedCredentialsFile }} - name: aws-shared-credential-file - subPath: aws_shared_credential_file - - mountPath: {{ .Values.global.cnAwsConfigFile }} - name: aws-config-file - subPath: aws_config_file - - mountPath: {{ .Values.global.cnAwsSecretsReplicaRegionsFile }} - name: aws-secrets-replica-regions - subPath: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - mountPath: {{ .Values.global.cnGoogleApplicationCredentials }} - name: google-sa - subPath: google-credentials.json - {{- end }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "scim.fullname" .}}-updatelbip - mountPath: "/scripts" - {{- end }} - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - mountPath: "/etc/certs/couchbase.crt" - subPath: couchbase.crt - {{- end }} - {{- end }} - livenessProbe: -{{- toYaml .Values.livenessProbe | nindent 10 }} - readinessProbe: -{{- toYaml .Values.readinessProbe | nindent 10 }} - {{- if not .Values.global.isFqdnRegistered }} - hostAliases: - - ip: {{ .Values.global.lbIp }} - hostnames: - - {{ .Values.global.fqdn }} - {{- end }} - volumes: - {{- with .Values.volumes }} -{{- toYaml . | nindent 8 }} - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "aws") (eq .Values.global.configAdapterName "aws") }} - - name: aws-shared-credential-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_shared_credential_file - path: aws_shared_credential_file - - name: aws-config-file - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_config_file - path: aws_config_file - - name: aws-secrets-replica-regions - secret: - secretName: {{ .Release.Name }}-aws-config-creds - items: - - key: aws_secrets_replica_regions - path: aws_secrets_replica_regions - {{- end }} - {{ if or (eq .Values.global.configSecretAdapter "google") (eq .Values.global.cnPersistenceType "spanner") }} - - name: google-sa - secret: - secretName: {{ .Release.Name }}-google-sa - {{- end }} - - {{- if or (eq .Values.global.cnPersistenceType "couchbase") (eq .Values.global.cnPersistenceType "hybrid") }} - - {{- if not .Values.global.istio.enabled }} - - name: cb-crt - secret: - secretName: {{ .Release.Name }}-cb-crt - {{- end }} - {{- end }} - {{- if and (not .Values.global.isFqdnRegistered ) (or (eq .Values.global.storageClass.provisioner "kubernetes.io/aws-ebs") (eq .Values.global.storageClass.provisioner "openebs.io/local")) }} - - name: {{ include "scim.fullname" . }}-updatelbip - configMap: - name: {{ .Release.Name }}-updatelbip - {{- end }} - \ No newline at end of file diff --git a/charts/gluu/gluu/charts/scim/templates/hpa.yaml b/charts/gluu/gluu/charts/scim/templates/hpa.yaml deleted file mode 100644 index d3ba580d6..000000000 --- a/charts/gluu/gluu/charts/scim/templates/hpa.yaml +++ /dev/null @@ -1,37 +0,0 @@ -{{ if .Values.hpa.enabled -}} -apiVersion: autoscaling/v1 -kind: HorizontalPodAutoscaler -metadata: - name: {{ include "scim.fullname" . }} - labels: - APP_NAME: scim -{{ include "scim.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - scaleTargetRef: - apiVersion: apps/v1 - kind: Deployment - name: {{ include "scim.fullname" . }} - minReplicas: {{ .Values.hpa.minReplicas }} - maxReplicas: {{ .Values.hpa.maxReplicas }} - {{- if .Values.hpa.targetCPUUtilizationPercentage }} - targetCPUUtilizationPercentage: {{ .Values.hpa.targetCPUUtilizationPercentage }} - {{- else if .Values.hpa.metrics }} - metrics: - {{- with .Values.hpa.metrics }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} - {{- if .Values.hpa.behavior }} - behavior: - {{- with .Values.hpa.behavior }} -{{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/scim/templates/scim-destination-rules.yaml b/charts/gluu/gluu/charts/scim/templates/scim-destination-rules.yaml deleted file mode 100644 index fc26343bd..000000000 --- a/charts/gluu/gluu/charts/scim/templates/scim-destination-rules.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- if .Values.global.istio.enabled }} -apiVersion: networking.istio.io/v1alpha3 -kind: DestinationRule -metadata: - name: {{ .Release.Name }}-scim-mtls - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: scim -{{ include "scim.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - host: {{ .Values.global.scim.scimServiceName }}.{{ .Release.Namespace }}.svc.cluster.local - trafficPolicy: - tls: - mode: ISTIO_MUTUAL -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/scim/templates/scim-pdb.yaml b/charts/gluu/gluu/charts/scim/templates/scim-pdb.yaml deleted file mode 100644 index d700490a8..000000000 --- a/charts/gluu/gluu/charts/scim/templates/scim-pdb.yaml +++ /dev/null @@ -1,11 +0,0 @@ -{{ if .Values.pdb.enabled -}} -apiVersion: policy/v1 -kind: PodDisruptionBudget -metadata: - name: {{ include "scim.fullname" . }} -spec: - maxUnavailable: {{ .Values.pdb.maxUnavailable }} - selector: - matchLabels: - app: {{ .Release.Name }}-{{ include "scim.name" . }} -{{- end }} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/scim/templates/scim-virtual-services.yaml b/charts/gluu/gluu/charts/scim/templates/scim-virtual-services.yaml deleted file mode 100644 index 14fafd1d4..000000000 --- a/charts/gluu/gluu/charts/scim/templates/scim-virtual-services.yaml +++ /dev/null @@ -1,54 +0,0 @@ -{{- if .Values.global.istio.ingress }} -apiVersion: networking.istio.io/v1alpha3 -kind: VirtualService -metadata: - name: {{ .Release.Name }}-istio-scim-config - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: scim -{{ include "scim.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - hosts: - - {{ .Values.global.fqdn }} -{{- if .Values.global.istio.gateways }} - gateways: -{{ toYaml .Values.global.istio.gateways | indent 2 }} -{{- else }} - gateways: - - {{ .Release.Name }}-global-gtw -{{- end }} - http: - {{- if .Values.global.scim.ingress.scimConfigEnabled }} - - name: {{ .Release.Name }}-istio-scim-config - match: - - uri: - prefix: /.well-known/scim-configuration - rewrite: - uri: /jans-scim/restv1/scim-configuration - route: - - destination: - host: {{ .Values.global.scim.scimServiceName }}.{{.Release.Namespace}}.svc.cluster.local - port: - number: 8080 - weight: 100 - {{- end }} - {{- if .Values.global.scim.ingress.scimEnabled }} - - name: {{ .Release.Name }}-istio-scim - match: - - uri: - prefix: "/jans-scim" - route: - - destination: - host: {{ .Values.global.scim.scimServiceName }}.{{.Release.Namespace}}.svc.cluster.local - port: - number: 8080 - weight: 100 - {{- end }} -{{- end }} diff --git a/charts/gluu/gluu/charts/scim/templates/service.yml b/charts/gluu/gluu/charts/scim/templates/service.yml deleted file mode 100644 index a585ea31b..000000000 --- a/charts/gluu/gluu/charts/scim/templates/service.yml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: {{ .Values.global.scim.scimServiceName }} - namespace: {{ .Release.Namespace }} - labels: - APP_NAME: scim -{{ include "scim.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -spec: - {{- if .Values.global.alb.ingress }} - type: NodePort - {{- end }} - ports: - - port: {{ .Values.service.port }} - name: {{ .Values.service.name }} - selector: - app: {{ .Release.Name }}-{{ include "scim.name" . }} #scim - sessionAffinity: {{ .Values.service.sessionAffinity }} - {{- with .Values.service.sessionAffinityConfig }} - sessionAffinityConfig: -{{ toYaml . | indent 4 }} - {{- end }} diff --git a/charts/gluu/gluu/charts/scim/templates/user-custom-secret-envs.yaml b/charts/gluu/gluu/charts/scim/templates/user-custom-secret-envs.yaml deleted file mode 100644 index d9f83a46e..000000000 --- a/charts/gluu/gluu/charts/scim/templates/user-custom-secret-envs.yaml +++ /dev/null @@ -1,21 +0,0 @@ -{{ if .Values.usrEnvs.secret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ .Release.Name }}-{{ .Chart.Name }}-user-custom-envs - labels: - APP_NAME: scim -{{ include "scim.labels" . | indent 4}} -{{- if .Values.additionalLabels }} -{{ toYaml .Values.additionalLabels | indent 4 }} -{{- end }} -{{- if .Values.additionalAnnotations }} - annotations: -{{ toYaml .Values.additionalAnnotations | indent 4 }} -{{- end }} -type: Opaque -data: - {{- range $key, $val := .Values.usrEnvs.secret }} - {{ $key }}: {{ $val | b64enc }} - {{- end}} -{{- end}} \ No newline at end of file diff --git a/charts/gluu/gluu/charts/scim/values.yaml b/charts/gluu/gluu/charts/scim/values.yaml deleted file mode 100644 index fd0f8aefa..000000000 --- a/charts/gluu/gluu/charts/scim/values.yaml +++ /dev/null @@ -1,84 +0,0 @@ - -# -- System for Cross-domain Identity Management (SCIM) version 2.0 -# -- Configure the HorizontalPodAutoscaler -hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} -# -- Add custom normal and secret envs to the service -usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} -# -- Add custom dns policy -dnsPolicy: "" -# -- Add custom dns config -dnsConfig: {} -image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: janssenproject/scim - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] -# -- Service replica number. -replicas: 1 -resources: - limits: - # -- CPU limit. - cpu: 1000m - # -- Memory limit. - memory: 1000Mi - requests: - # -- CPU request. - cpu: 1000m - # -- Memory request. - memory: 1000Mi -service: - # -- The name of the scim port within the scim service. Please keep it as default. - name: http-scim - # -- Port of the scim service. Please keep it as default. - port: 8080 - # -- Default set to None If you want to make sure that connections from a particular client are passed to the same Pod each time, you can select the session affinity based on the client's IP addresses by setting this to ClientIP - sessionAffinity: None - # -- the maximum session sticky time if sessionAffinity is ClientIP - sessionAffinityConfig: - clientIP: - timeoutSeconds: 10800 -# -- Configure the liveness healthcheck for SCIM if needed. -livenessProbe: - httpGet: - # -- http liveness probe endpoint - path: /jans-scim/sys/health-check - port: 8080 - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 -# -- Configure the readiness healthcheck for the SCIM if needed. -readinessProbe: - httpGet: - # -- http readiness probe endpoint - path: /jans-scim/sys/health-check - port: 8080 - initialDelaySeconds: 25 - periodSeconds: 25 - timeoutSeconds: 5 -# -- Configure any additional volumes that need to be attached to the pod -volumes: [] -# -- Configure any additional volumesMounts that need to be attached to the containers -volumeMounts: [] - -# -- Additional labels that will be added across all resources definitions in the format of {mylabel: "myapp"} -additionalLabels: { } -# -- Additional annotations that will be added across all resources in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken -additionalAnnotations: { } \ No newline at end of file diff --git a/charts/gluu/gluu/openbanking-values.yaml b/charts/gluu/gluu/openbanking-values.yaml deleted file mode 100644 index aff860b5c..000000000 --- a/charts/gluu/gluu/openbanking-values.yaml +++ /dev/null @@ -1,700 +0,0 @@ -# -- OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Gluu. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing. -auth-server: - # -- Configure the HorizontalPodAutoscaler - hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} - # -- Add custom normal and secret envs to the service - usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: janssenproject/auth-server - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] - # -- Service replica number. - replicas: 1 - # -- Resource specs. - resources: - limits: - # -- CPU limit. - cpu: 2500m - # -- Memory limit. - memory: 2500Mi - requests: - # -- CPU request. - cpu: 2500m - # -- Memory request. - memory: 2500Mi - # -- Configure the liveness healthcheck for the auth server if needed. - livenessProbe: - # -- Executes the python3 healthcheck. - # https://github.com/JanssenProject/docker-jans-auth-server/blob/master/scripts/healthcheck.py - exec: - command: - - python3 - - /app/scripts/healthcheck.py - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - # -- Configure the readiness healthcheck for the auth server if needed. - # https://github.com/JanssenProject/docker-jans-auth-server/blob/master/scripts/healthcheck.py - readinessProbe: - exec: - command: - - python3 - - /app/scripts/healthcheck.py - initialDelaySeconds: 25 - periodSeconds: 25 - timeoutSeconds: 5 - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } -# -- Configuration parameters for setup and initial configuration secret and config layers used by Gluu services. -config: - # -- Add custom normal and secret envs to the service. - usrEnvs: - # -- Add custom normal envs to the service. - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service. - # variable1: value1 - secret: {} - # -- City. Used for certificate creation. - city: Austin - configmap: - # -- Jetty header size in bytes in the auth server - cnJettyRequestHeaderSize: 8192 - # -- SQL database dialect. `mysql` or `pgsql` - cnSqlDbDialect: mysql - # -- SQL database host uri. - cnSqlDbHost: my-release-mysql.default.svc.cluster.local - # -- SQL database port. - cnSqlDbPort: 3306 - # -- SQL database name. - cnSqlDbName: gluu - # -- SQL database username. - cnSqlDbUser: gluu - # -- SQL database timezone. - cnSqlDbTimezone: UTC - # -- SQL password injected the secrets . - cnSqldbUserPassword: Test1234# - # -- Cache type. `NATIVE_PERSISTENCE`, `REDIS`. or `IN_MEMORY`. Defaults to `NATIVE_PERSISTENCE` . - cnCacheType: NATIVE_PERSISTENCE - # -- The name of the Kubernetes ConfigMap that will hold the configuration layer - cnConfigKubernetesConfigMap: cn - # [google_envs] Envs related to using Google - # -- Service account with roles roles/secretmanager.admin base64 encoded string. This is used often inside the services to reach the configuration layer. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnGoogleSecretManagerServiceAccount: SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo= - # -- Project id of the Google project the secret manager belongs to. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnGoogleProjectId: google-project-to-save-config-and-secrets-to - # [google_spanner_envs] Envs related to using Google Secret Manager to store config and secret layer - # -- Google Spanner ID. Used only when global.cnPersistenceType is spanner. - cnGoogleSpannerInstanceId: "" - # -- Google Spanner Database ID. Used only when global.cnPersistenceType is spanner. - cnGoogleSpannerDatabaseId: "" - # [google_spanner_envs] END - # [google_secret_manager_envs] Envs related to using Google Secret Manager to store config and secret layer - # -- Secret version to be used for secret configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnSecretGoogleSecretVersionId: "latest" - # -- Prefix for Gluu secret in Google Secret Manager. Defaults to gluu. If left gluu-secret secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnSecretGoogleSecretNamePrefix: gluu - # -- Passphrase for Gluu secret in Google Secret Manager. This is used for encrypting and decrypting data from the Google Secret Manager. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnGoogleSecretManagerPassPhrase: Test1234# - # -- Secret version to be used for configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnConfigGoogleSecretVersionId: "latest" - # -- Prefix for Gluu configuration secret in Google Secret Manager. Defaults to gluu. If left intact gluu-configuration secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnConfigGoogleSecretNamePrefix: gluu - # [google_secret_manager_envs] END - # [google_envs] END - # -- Value passed to Java option -XX:MaxRAMPercentage - cnMaxRamPercent: "75.0" - # -- SCIM protection mode OAUTH|TEST|UMA - cnScimProtectionMode: "OAUTH" - # -- Specify data that should be saved in LDAP (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType` is set to `hybrid`. - #{ - # "default": "", - # "user": "", - # "site": "", - # "cache": "", - # "token": "", - # "session": "", - #} - cnPersistenceHybridMapping: "{}" - # -- Redis Sentinel Group. Often set when `config.configmap.cnRedisType` is set to `SENTINEL`. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. - cnRedisSentinelGroup: "" - # -- Redis SSL truststore. Optional. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. - cnRedisSslTruststore: "" - # -- Redis service type. `STANDALONE` or `CLUSTER`. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. - cnRedisType: STANDALONE - # -- Redis URL and port number :. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. - cnRedisUrl: "redis.redis.svc.cluster.local:6379" - # -- Boolean to use SSL in Redis. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. - cnRedisUseSsl: false - # -- Kubernetes secret name holding configuration keys. Used when global.configSecretAdapter is set to kubernetes which is the default. - cnSecretKubernetesSecret: cn - # -- Load balancer address for AWS if the FQDN is not registered. - lbAddr: "" - # -- Country code. Used for certificate creation. - countryCode: US - # -- Email address of the administrator usually. Used for certificate creation. - email: support@gluu.org - image: - # -- Image to use for deploying. - repository: janssenproject/configurator - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] - # -- Organization name. Used for certificate creation. - orgName: Gluu - # -- Redis admin password if `config.configmap.cnCacheType` is set to `REDIS`. - redisPassword: P@assw0rd - # -- Resource specs. - resources: - limits: - # -- CPU limit. - cpu: 300m - # -- Memory limit. - memory: 300Mi - requests: - # -- CPU request. - cpu: 300m - # -- Memory request. - memory: 300Mi - # -- State code. Used for certificate creation. - state: TX - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } -# -- Config Api endpoints can be used to configure the auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS). -config-api: - # -- Configure the HorizontalPodAutoscaler - hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} - # -- Add custom normal and secret envs to the service - usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: janssenproject/config-api - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] - # -- Service replica number. - replicas: 1 - # -- Resource specs. - resources: - limits: - # -- CPU limit. - cpu: 1000m - # -- Memory limit. - memory: 400Mi - requests: - # -- CPU request. - cpu: 1000m - # -- Memory request. - memory: 400Mi - # -- Configure the liveness healthcheck for the auth server if needed. - livenessProbe: - # -- http liveness probe endpoint - httpGet: - path: /jans-config-api/api/v1/health/live - port: 8074 - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - readinessProbe: - # -- http readiness probe endpoint - httpGet: - path: jans-config-api/api/v1/health/ready - port: 8074 - initialDelaySeconds: 25 - periodSeconds: 25 - timeoutSeconds: 5 - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } -# -- Parameters used globally across all services helm charts. -global: - # -- Add custom normal and secret envs to the service. - # Envs defined in global.userEnvs will be globally available to all services - usrEnvs: - # -- Add custom normal envs to the service. - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service. - # variable1: value1 - secret: {} - alb: - # -- Activates ALB ingress - ingress: false - - admin-ui: - # -- Boolean flag to enable/disable the admin-ui chart and admin ui config api plugin. - enabled: true - # -- Name of the admin-ui service. Please keep it as default. - adminUiServiceName: admin-ui - # -- Enable endpoints in either istio or nginx ingress depending on users choice - ingress: - # -- Enable Admin UI endpoints in either istio or nginx ingress depending on users choice - adminUiEnabled: true - - auth-server: - # -- Name of the auth-server service. Please keep it as default. - authServerServiceName: auth-server - # -- Boolean flag to enable/disable auth-server chart. You should never set this to false. - enabled: true - # -- App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. - appLoggers: - # -- jans-auth.log target - authLogTarget: "STDOUT" - # -- jans-auth.log level - authLogLevel: "INFO" - # -- http_request_response.log target - httpLogTarget: "FILE" - # -- http_request_response.log level - httpLogLevel: "INFO" - # -- jans-auth_persistence.log target - persistenceLogTarget: "FILE" - # -- jans-auth_persistence.log level - persistenceLogLevel: "INFO" - # -- jans-auth_persistence_duration.log target - persistenceDurationLogTarget: "FILE" - # -- jans-auth_persistence_duration.log level - persistenceDurationLogLevel: "INFO" - # -- jans-auth_persistence_ldap_statistics.log target - ldapStatsLogTarget: "FILE" - # -- jans-auth_persistence_ldap_statistics.log level - ldapStatsLogLevel: "INFO" - # -- jans-auth_script.log target - scriptLogTarget: "FILE" - # -- jans-auth_script.log level - scriptLogLevel: "INFO" - # -- jans-auth_script.log target - auditStatsLogTarget: "FILE" - # -- jans-auth_audit.log level - auditStatsLogLevel: "INFO" - # -- space-separated key algorithm for signing (default to `RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512`) - authSigKeys: "RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512" - # -- space-separated key algorithm for encryption (default to `RSA1_5 RSA-OAEP`) - authEncKeys: "RSA1_5 RSA-OAEP" - # -- Enable endpoints in either istio or nginx ingress depending on users choice - ingress: - # -- Enable Auth server endpoints /jans-auth - authServerEnabled: true - # -- Enable endpoint /.well-known/openid-configuration - openidConfigEnabled: true - # -- Enable endpoint /device-code - deviceCodeEnabled: true - # -- Enable endpoint /firebase-messaging-sw.js - firebaseMessagingEnabled: true - # -- Enable endpoint /.well-known/uma2-configuration - uma2ConfigEnabled: true - # -- Enable endpoint /.well-known/webfinger - webfingerEnabled: true - # -- Enable endpoint /.well-known/simple-web-discovery - webdiscoveryEnabled: true - # -- Enable endpoint /.well-known/fido-configuration - u2fConfigEnabled: true - # -- Enable mTLS on Auth server endpoint /jans-auth/restv1/token . Currently not working in Istio. - authServerProtectedToken: false - # -- Enable mTLS onn Auth server endpoint /jans-auth/restv1/register. Currently not working in Istio. - authServerProtectedRegister: false - auth-server-key-rotation: - # -- Boolean flag to enable/disable the auth-server-key rotation cronjob chart. - enabled: false - # -- Volume storage type if using AWS volumes. - awsStorageType: io1 - # -- Volume storage type if using Azure disks. - azureStorageAccountType: Standard_LRS - # -- Azure storage kind if using Azure disks - azureStorageKind: Managed - casa: - # -- Name of the casa service. Please keep it as default. - casaServiceName: casa - # -- Boolean flag to enable/disable the casa chart. - enabled: true - ingress: - # -- Enable casa endpoints /casa - casaEnabled: true - cloud: - # -- Boolean flag if enabled will strip resources requests and limits from all services. - testEnviroment: false - # -- Port used by Prometheus JMX agent (default to empty string). To enable Prometheus JMX agent, set the value to a number. - cnPrometheusPort: "" - # -- Document store type to use for shibboleth files LOCAL. - cnDocumentStoreType: LOCAL - # -- Persistence backend to run Gluu with ldap|couchbase|hybrid|sql|spanner. - cnPersistenceType: sql - # -- Open banking external signing jwks uri. Used in SSA Validation. - cnObExtSigningJwksUri: "" - # -- Open banking external signing jwks AS certificate authority string. Used in SSA Validation. This must be encoded using base64.. Used when `.global.cnObExtSigningJwksUri` is set. - cnObExtSigningJwksCrt: "" - # -- Open banking external signing jwks AS key string. Used in SSA Validation. This must be encoded using base64. Used when `.global.cnObExtSigningJwksUri` is set. - cnObExtSigningJwksKey: "" - # -- Open banking external signing jwks AS key passphrase to unlock provided key. This must be encoded using base64. Used when `.global.cnObExtSigningJwksUri` is set. - cnObExtSigningJwksKeyPassPhrase: "" - # -- Open banking external signing AS Alias. This is a kid value.Used in SSA Validation, kid used while encoding a JWT sent to token URL i.e. XkwIzWy44xWSlcWnMiEc8iq9s2G - cnObExtSigningAlias: "" - # -- Open banking signing AS kid to force the AS to use a specific signing key. i.e. Wy44xWSlcWnMiEc8iq9s2G - cnObStaticSigningKeyKid: "" - # -- Open banking AS transport crt. Used in SSA Validation. This must be encoded using base64. - cnObTransportCrt: "" - # -- Open banking AS transport key. Used in SSA Validation. This must be encoded using base64. - cnObTransportKey: "" - # -- Open banking AS transport key passphrase to unlock AS transport key. This must be encoded using base64. - cnObTransportKeyPassPhrase: "" - # -- Open banking transport Alias used inside the JVM. - cnObTransportAlias: "" - # -- Open banking AS transport truststore crt. This is normally generated from the OB issuing CA, OB Root CA and Signing CA. Used when .global.cnObExtSigningJwksUri is set. Used in SSA Validation. This must be encoded using base64. - cnObTransportTrustStore: "" - config: - # -- Boolean flag to enable/disable the configuration chart. This normally should never be false - enabled: true - # -- https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ - jobTtlSecondsAfterFinished: 300 - # -- The config backend adapter that will hold Gluu configuration layer. google|kubernetes - configAdapterName: kubernetes - # -- The config backend adapter that will hold Gluu secret layer. google|kubernetes - configSecretAdapter: kubernetes - # -- Base64 encoded service account. The sa must have roles/secretmanager.admin to use Google secrets and roles/spanner.databaseUser to use Spanner. - cnGoogleApplicationCredentials: /etc/jans/conf/google-credentials.json - config-api: - # -- Name of the config-api service. Please keep it as default. - configApiServerServiceName: config-api - # -- Boolean flag to enable/disable the config-api chart. - enabled: true - # -- App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. - appLoggers: - # -- configapi.log target - configApiLogTarget: "STDOUT" - # -- configapi.log level - configApiLogLevel: "INFO" - # -- config-api_persistence.log target - persistenceLogTarget: "FILE" - # -- jans-auth_persistence.log level - persistenceLogLevel: "INFO" - # -- config-api_persistence_duration.log target - persistenceDurationLogTarget: "FILE" - # -- config-api_persistence_duration.log level - persistenceDurationLogLevel: "INFO" - # -- config-api_persistence_ldap_statistics.log target - ldapStatsLogTarget: "FILE" - # -- config-api_persistence_ldap_statistics.log level - ldapStatsLogLevel: "INFO" - # -- config-api_script.log target - scriptLogTarget: "FILE" - # -- config-api_script.log level - scriptLogLevel: "INFO" - adminUiAppLoggers: - # -- config-api admin-ui plugin log level - adminUiLogTarget: "FILE" - # -- config-api admin-ui plugin log target - adminUiLogLevel: "INFO" - # -- config-api admin-ui plugin audit log target - adminUiAuditLogTarget: "FILE" - # -- config-api admin-ui plugin audit log level - adminUiAuditLogLevel: "INFO" - # -- Enable endpoints in either istio or nginx ingress depending on users choice - ingress: - # -- Enable config API endpoints /jans-config-api - configApiEnabled: true - # -- Fully qualified domain name to be used for Gluu installation. This address will be used to reach Gluu services. - fqdn: demoexample.gluu.org - fido2: - # -- Name of the fido2 service. Please keep it as default. - fido2ServiceName: fido2 - # -- Boolean flag to enable/disable the fido2 chart. - enabled: false - # -- App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. - appLoggers: - # -- fido2.log target - fido2LogTarget: "STDOUT" - # -- fido2.log level - fido2LogLevel: "INFO" - # -- fido2_persistence.log target - persistenceLogTarget: "FILE" - # -- fido2_persistence.log level - persistenceLogLevel: "INFO" - # -- Enable endpoints in either istio or nginx ingress depending on users choice - ingress: - # -- Enable endpoint /.well-known/fido2-configuration - fido2ConfigEnabled: false - # -- GCE storage kind if using Google disks - gcePdStorageType: pd-standard - # -- Boolean flag to enable mapping global.lbIp to global.fqdn inside pods on clouds that provide static ip for load balancers. On cloud that provide only addresses to the LB this flag will enable a script to actively scan config.configmap.lbAddr and update the hosts file inside the pods automatically. - isFqdnRegistered: false - istio: - # -- Boolean flag that enables using istio side-cars with Gluu services. - enabled: false - # -- Boolean flag that enables using istio gateway for Gluu. This assumes istio ingress is installed and hence the LB is available. - ingress: false - # -- The namespace istio is deployed in. The is normally istio-system. - namespace: istio-system - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } - # -- The Load balancer IP created by nginx or istio on clouds that provide static IPs. This is not needed if `global.fqdn` is globally resolvable. - lbIp: 22.22.22.22 - nginx-ingress: - # -- Boolean flag to enable/disable the nginx-ingress definitions chart. - enabled: true - opendj: - # -- Boolean flag to enable/disable the OpenDJ chart. - enabled: false - # -- Name of the OpenDJ service. Please keep it as default. - ldapServiceName: opendj - oxpassport: - # -- Name of the oxPassport service. Please keep it as default. - oxPassportServiceName: oxpassport - # -- Boolean flag to enable/disable passport chart - enabled: false - oxshibboleth: - # -- Name of the oxShibboleth service. Please keep it as default. - oxShibbolethServiceName: oxshibboleth - # -- Boolean flag to enable/disable the oxShibbboleth chart. Not part of the openbanking distribution. Keep as default.This also enables SAML-related features; UI menu, etc. Not part of the openbanking distribution. Please leave this disabled. - enabled: false - # -- Gluu distributions supported are: default|openbanking. - distribution: openbanking - persistence: - # -- Boolean flag to enable/disable the persistence chart. - enabled: true - scim: - # -- Name of the scim service. Please keep it as default. - scimServiceName: scim - # -- Boolean flag to enable/disable the SCIM chart. - enabled: false - # -- App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. - appLoggers: - # -- jans-scim.log target - scimLogTarget: "STDOUT" - # -- jans-scim.log level - scimLogLevel: "INFO" - # -- jans-scim_persistence.log target - persistenceLogTarget: "FILE" - # -- jans-scim_persistence.log level - persistenceLogLevel: "INFO" - # -- jans-scim_persistence_duration.log target - persistenceDurationLogTarget: "FILE" - # -- jans-scim_persistence_duration.log level - persistenceDurationLogLevel: "INFO" - # -- jans-scim_persistence_ldap_statistics.log target - ldapStatsLogTarget: "FILE" - # -- jans-scim_persistence_ldap_statistics.log level - ldapStatsLogLevel: "INFO" - # -- jans-scim_script.log target - scriptLogTarget: "FILE" - # -- jans-scim_script.log level - scriptLogLevel: "INFO" - # -- Enable endpoints in either istio or nginx ingress depending on users choice - ingress: - # -- Enable endpoint /.well-known/scim-configuration - scimConfigEnabled: false - # -- StorageClass section for OpenDJ charts. This is not currently used by the openbanking distribution. You may specify custom parameters as needed. - storageClass: - allowVolumeExpansion: true - allowedTopologies: [] - mountOptions: - - debug - # -- parameters: - #fsType: "" - #kind: "" - #pool: "" - #storageAccountType: "" - #type: "" - parameters: {} - provisioner: microk8s.io/hostpath - reclaimPolicy: Retain - volumeBindingMode: WaitForFirstConsumer -# -- Nginx ingress definitions chart -nginx-ingress: - ingress: - # -- Admin UI ingress resource labels. key app is taken. - adminUiLabels: { } - # -- openid-configuration ingress resource additional annotations. - adminUiAdditionalAnnotations: { } - # -- openid-configuration ingress resource labels. key app is taken - openidConfigLabels: { } - # -- openid-configuration ingress resource additional annotations. - openidAdditionalAnnotations: { } - # -- device-code ingress resource labels. key app is taken - deviceCodeLabels: { } - # -- device-code ingress resource additional annotations. - deviceCodeAdditionalAnnotations: { } - # -- Firebase Messaging ingress resource labels. key app is taken - firebaseMessagingLabels: { } - # -- Firebase Messaging ingress resource additional annotations. - firebaseMessagingAdditionalAnnotations: { } - # -- uma2 config ingress resource labels. key app is taken - uma2ConfigLabels: { } - # -- uma2 config ingress resource additional annotations. - uma2AdditionalAnnotations: { } - # -- webfinger ingress resource labels. key app is taken - webfingerLabels: { } - # -- webfinger ingress resource additional annotations. - webfingerAdditionalAnnotations: { } - # -- webdiscovery ingress resource labels. key app is taken - webdiscoveryLabels: { } - # -- webdiscovery ingress resource additional annotations. - webdiscoveryAdditionalAnnotations: { } - # -- SCIM config ingress resource labels. key app is taken - scimConfigLabels: { } - # -- SCIM config ingress resource additional annotations. - scimConfigAdditionalAnnotations: { } - # -- SCIM config ingress resource labels. key app is taken - scimLabels: { } - # -- SCIM ingress resource additional annotations. - scimAdditionalAnnotations: { } - # -- configAPI ingress resource labels. key app is taken - configApiLabels: { } - # -- ConfigAPI ingress resource additional annotations. - configApiAdditionalAnnotations: { } - # -- u2f config ingress resource labels. key app is taken - u2fConfigLabels: { } - # -- u2f config ingress resource additional annotations. - u2fAdditionalAnnotations: { } - # -- fido2 config ingress resource labels. key app is taken - fido2ConfigLabels: { } - # -- fido2 config ingress resource additional annotations. - fido2ConfigAdditionalAnnotations: { } - # -- Auth server ingress resource labels. key app is taken - authServerLabels: { } - # -- Auth server ingress resource additional annotations. - authServerAdditionalAnnotations: { } - # -- Casa ingress resource labels. key app is taken - casaLabels: { } - # -- Casa ingress resource additional annotations. - casaAdditionalAnnotations: { } - # -- Auth server protected token ingress resource labels. key app is taken - authServerProtectedTokenLabels: { } - # -- Auth server protected token ingress resource additional annotations. - authServerProtectedTokenAdditionalAnnotations: { } - # -- Auth server protected token ingress resource labels. key app is taken - authServerProtectedRegisterLabels: { } - # -- Auth server protected register ingress resource additional annotations. - authServerProtectedRegisterAdditionalAnnotations: { } - # -- Additional labels that will be added across all ingress definitions in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across all ingress definitions in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - # Enable client certificate authentication - # nginx.ingress.kubernetes.io/auth-tls-verify-client: "optional" - # Create the secret containing the trusted ca certificates - # nginx.ingress.kubernetes.io/auth-tls-secret: "gluu/tls-certificate" - # Specify the verification depth in the client certificates chain - # nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1" - # Specify if certificates are passed to upstream server - # nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true" - additionalAnnotations: {} - path: / - hosts: - - demoexample.gluu.org - # -- Secrets holding HTTPS CA cert and key. - tls: - - secretName: tls-certificate - hosts: - - demoexample.gluu.org -# -- Job to generate data and initial config for Gluu Server persistence layer. -persistence: - # -- Add custom normal and secret envs to the service - usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: janssenproject/persistence-loader - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] - # -- Resource specs. - resources: - limits: - # -- CPU limit - cpu: 300m - # -- Memory limit. - memory: 300Mi - requests: - # -- CPU request. - cpu: 300m - # -- Memory request. - memory: 300Mi - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } diff --git a/charts/gluu/gluu/questions.yaml b/charts/gluu/gluu/questions.yaml deleted file mode 100644 index b9768fcbf..000000000 --- a/charts/gluu/gluu/questions.yaml +++ /dev/null @@ -1,1287 +0,0 @@ -questions: -# ================== -# Distribution group -# ================== -- variable: global.distribution - default: "openbanking" - required: true - type: enum - label: Gluu Distribution - description: "Gluu Distribution. Openbanking only contains Config-API and the Auth Server customized for Openbanking industry." - group: "Global Settings" - options: - - "default" - - "openbanking" - -# ======================== -# OpenBanking Distribution -# ======================== -- variable: global.cnObExtSigningJwksUri - required: true - default: "https://keystore.openbankingtest.org.uk/keystore/openbanking.jwks" - description: "Open banking external signing jwks uri. Used in SSA Validation." - type: hostname - group: "OpenBanking Distribution" - label: Openbanking external signing JWKS URI - show_if: "global.distribution=openbanking" - subquestions: - - variable: global.cnObExtSigningJwksCrt - default: "" - required: true - group: "OpenBanking Distribution" - description: "Open banking external signing jwks AS certificate authority string. Used in SSA Validation. This must be encoded using base64.. Used when `.global.cnObExtSigningJwksUri` is set." - type: multiline - label: Open banking external signing jwks AS certificate authority string - - variable: global.cnObExtSigningJwksKey - default: "" - required: true - group: "OpenBanking Distribution" - description: "Open banking external signing jwks AS key string. Used in SSA Validation. This must be encoded using base64. Used when `.global.cnObExtSigningJwksUri` is set." - type: multiline - label: Open banking external signing jwks AS key string - - variable: global.cnObExtSigningJwksKeyPassPhrase - default: "" - required: true - group: "OpenBanking Distribution" - description: "Open banking external signing jwks AS key passphrase to unlock provided key. This must be encoded using base64. Used when `.global.cnObExtSigningJwksUri` is set." - type: password - label: Open banking external signing jwks AS key passphrase - min_length: 6 - - variable: global.cnObExtSigningAlias - default: "XkwIzWy44xWSlcWnMiEc8iq9s2G" - required: true - group: "OpenBanking Distribution" - description: "Open banking external signing AS Alias. This is a kid value.Used in SSA Validation, kid used while encoding a JWT sent to token URL i.e XkwIzWy44xWSlcWnMiEc8iq9s2G" - type: string - label: Open banking external signing AS Alias -- variable: global.cnObStaticSigningKeyKid - default: "Wy44xWSlcWnMiEc8iq9s2G" - required: true - group: "OpenBanking Distribution" - description: "Open banking signing AS kid to force the AS to use a specific signing key. i.e Wy44xWSlcWnMiEc8iq9s2G" - type: string - label: Open banking signing AS kid - show_if: "global.distribution=openbanking" -- variable: global.cnObTransportAlias - default: "" - required: false - group: "OpenBanking Distribution" - description: "Open banking transport Alias used inside the JVM." - type: string - label: Open banking transport Alias used inside the JVM. - show_if: "global.distribution=openbanking" - subquestions: - - variable: global.cnObTransportCrt - default: "" - required: true - group: "OpenBanking Distribution" - description: "Open banking AS transport crt. Used in SSA Validation. This must be encoded using base64." - type: multiline - label: Open banking AS transport crt - - variable: global.cnObTransportKey - default: "" - required: true - group: "OpenBanking Distribution" - description: "Open banking AS transport key. Used in SSA Validation. This must be encoded using base64." - type: multiline - label: Open banking AS transport key - - variable: global.cnObTransportKeyPassPhrase - default: "" - required: true - group: "OpenBanking Distribution" - description: "Open banking AS transport key passphrase to unlock AS transport key. This must be encoded using base64." - type: password - label: Open banking AS transport key passphrase - min_length: 6 - - variable: global.cnObTransportTrustStore - default: "" - required: true - group: "OpenBanking Distribution" - description: "Open banking AS transport truststore crt. This is normally generated from the OB issuing CA, OB Root CA and Signing CA. Used when .global.cnObExtSigningJwksUri is set. Used in SSA Validation. This must be encoded using base64." - type: multiline - label: Open banking external signing jwks AS certificate authority string - -# ======================= -# Optional Services group -# ======================= -- variable: global.admin-ui.enabled - default: false - type: boolean - group: "Optional Services" - required: false - label: Boolean flag to enable/disable the admin-ui chart and admin ui config api plugin. This requires a license agreement with Gluu. - show_if: "global.distribution=default" - show_subquestion_if: true - subquestions: - - variable: global.admin-ui.adminUiApiKey - default: "" - required: true - description: "Admin UI license API key. Obtain this from Gluu." - type: multiline - label: Admin UI license API key. Obtain this from Gluu - - variable: global.admin-ui.adminUiProductCode - default: "" - required: true - description: "Admin UI license product code. Obtain this from Gluu." - type: multiline - label: Admin UI license product code. Obtain this from Gluu. - - variable: global.admin-ui.adminUiSharedKey - default: "" - required: true - description: "Admin UI license shared key. Obtain this from Gluu." - type: multiline - label: Admin UI license shared key. Obtain this from Gluu. - - variable: global.admin-ui.adminUiManagementKey - default: "" - required: true - description: "Admin UI license management key. Obtain this from Gluu." - type: multiline - label: Admin UI license management key. Obtain this from Gluu. -- variable: global.auth-server-key-rotation.enabled - default: false - type: boolean - group: "Optional Services" - required: true - label: Enable Auth key rotation cronjob - show_if: "global.distribution=default" - show_subquestion_if: true - subquestions: - - variable: auth-server-key-rotation.keysLife - default: 48 - description: "Auth server key rotation keys life in hours." - type: int - label: Key life -- variable: global.fido2.enabled - default: false - type: boolean - group: "Optional Services" - required: true - show_if: "global.distribution=default" - label: Enable Fido2 - description: "FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments." -- variable: global.config-api.enabled - default: false - type: boolean - group: "Optional Services" - required: true - label: Enable ConfigAPI - description: "Config Api endpoints can be used to configure the auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS)." -- variable: global.casa.enabled - default: false - type: boolean - group: "Optional Services" - required: true - label: Enable Casa - description: "Gluu Casa ('Casa') is a self-service web portal for end-users to manage authentication and authorization preferences for their account in a Gluu Server." -- variable: global.scim.enabled - default: false - type: boolean - group: "Optional Services" - required: true - show_if: "global.distribution=default" - label: Enable SCIM - description: "System for Cross-domain Identity Management (SCIM) version 2.0" -- variable: global.client-api.enabled - default: false - type: boolean - group: "Optional Services" - required: true - label: Enable ClientAPI - show_if: "global.distribution=default" - description: "Middleware API to help application developers call an OAuth, OpenID or UMA server. You may wonder why this is necessary. It makes it easier for client developers to use OpenID signing and encryption features, without becoming crypto experts. This API provides some high level endpoints to do some of the heavy lifting." - show_subquestion_if: true - subquestions: - - variable: config.configmap.cnClientApiApplicationCertCn - default: "client-api" - description: "Client API application keystore name" - type: string - label: Client API application keystore name - - variable: config.configmap.cnClientApiAdminCertCn - default: "client-api" - description: "Client API admin keystore name" - type: string - label: Client API admin keystore name -- variable: global.jackrabbit.enabled - default: false - type: boolean - group: "Optional Services" - required: true - label: Enable Jackrabbit - show_if: "global.distribution=default" - show_subquestion_if: true - description: "Needed for SAML. Jackrabbit Oak is a complementary implementation of the JCR specification. It is an effort to implement a scalable and performant hierarchical content repository for use as the foundation of modern world-class web sites and other demanding content applications. https://jackrabbit.apache.org/jcr/index.html ." - subquestions: - - variable: jackrabbit.storage.size - default: "4Gi" - description: "Size of Jackrabbit content repository volume storage." - type: string - label: Volume storage - - variable: config.configmap.cnJackrabbitUrl - default: "http://jackrabbit:8080" - description: "Please enter jackrabbit url." - type: hostname - label: Jackrabbit URL - - variable: config.configmap.cnJackrabbitAdminId - default: "admin" - description: "Jackrabbit admin user" - type: string - label: Jackrabbit Admin User - valid_chars: "^[a-z]+$" - - variable: jackrabbit.secrets.cnJackrabbitAdminPassword - default: "Test1234#" - description: "Jackrabbit admin password" - type: password - label: Jackrabbit Admin User Password - min_length: 6 -- variable: installer-settings.jackrabbit.clusterMode - default: false - type: boolean - group: "Optional Services" - required: true - label: Enable Jackrabbit in Cluster Mode (HA) - show_if: "global.jackrabbit.enabled=true" - show_subquestion_if: true - description: "Requires postgres." - subquestions: - - variable: config.configmap.cnJackrabbitPostgresUser - default: "admin" - description: "Jackrabbit postgres user" - type: string - label: Jackrabbit postgres user - valid_chars: "^[a-z]+$" - - variable: jackrabbit.secrets.cnJackrabbitPostgresPassword - default: "admin" - description: "Jackrabbit postgres password" - type: password - label: Jackrabbit postgres password - - - variable: config.configmap.cnJackrabbitPostgresDatabaseName - default: "jackrabbit" - description: "Jackrabbit postgres database name" - type: string - label: Jackrabbit postgres database name - -# ====================== -# Test environment group -# ====================== -- variable: global.cloud.testEnviroment - default: false - type: boolean - group: "Test Environment" - required: true - label: Test environment - description: "Boolean flag if enabled will strip resources requests and limits from all services." - -# ================= -# Persistence group -# ================= -- variable: global.cnPersistenceType - default: "sql" - required: true - type: enum - group: "Persistence" - label: Gluu Persistence backend - description: "Persistence backend to run Gluu with ldap|couchbase|hybrid|sql|spanner" - options: - - "ldap" - - "couchbase" - - "hybrid" - - "spanner" - - "sql" -# LDAP -- variable: global.opendj.enabled - default: false - type: boolean - group: "Persistence" - required: true - label: Enable installation of OpenDJ - description: "Boolean flag to enable/disable the OpenDJ chart." - show_if: "global.cnPersistenceType=ldap||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnLdapUrl - default: "opendj:1636" - type: hostname - group: "Persistence" - required: true - label: OpenDJ remote URL - description: "OpenDJ remote URL. This must be resolvable by the pods" - show_if: "global.opendj.enabled=false&&global.cnPersistenceType=ldap||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnPersistenceLdapMapping - default: "default" - required: false - type: enum - group: "Persistence" - label: Gluu Persistence LDAP mapping - description: "Specify data that should be saved in LDAP (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType` is set to `hybrid`." - options: - - "default" - - "user" - - "site" - - "cache" - - "token" - - "session" - show_if: "global.cnPersistenceType=hybrid" -# Multi cluster ldap replication -- variable: opendj.multiCluster.enabled - default: false - type: boolean - group: "Persistence" - required: true - label: Enable OpenDJ multiCluster mode - description: "Enable OpenDJ multiCluster mode. This flag enables loading keys under `opendj.multiCluster`" - show_if: "global.opendj.enabled=true" - show_subquestion_if: true - subquestions: - - variable: opendj.multiCluster.serfAdvertiseAddrSuffix - default: "regional.gluu.org:30946s" - type: hostname - group: "Persistence" - required: true - description: "OpenDJ Serf advertise address suffix that will be added to each opendj replica. i.e RELEASE-NAME-opendj-regional-{{statefulset pod number}}-{{ $.Values.multiCluster.serfAdvertiseAddrSuffix }}" - label: OpenDJ Serf advertise address suffix - - variable: opendj.multiCluster.replicaCount - default: 1 - type: int - group: "Persistence" - required: true - description: "The number of opendj non scalable statefulsets to create. Each pod created must be resolvable as it follows the patterm RELEASE-NAME-opendj-regional-{{statefulset pod number}}-{{ $.Values.multiCluster.serfAdvertiseAddrSuffix }} If set to 1, with a release name of gluu, the address of the pod would be gluu-opendj-regional-0-regional.gluu.org" - label: The number of opendj non scalable statefulsets to create. - - variable: opendj.multiCluster.clusterId - default: "west" - type: string - group: "Persistence" - required: true - description: "This id needs to be unique to each kubernetes cluster in a multi cluster setup; west, east, south, north, region ...etc If left empty it will be randomly generated." - label: Unique kubernetes cluster id - - variable: opendj.multiCluster.serfPeers - default: "['gluu-opendj-regional-0-regional.gluu.org:30946', 'gluu-opendj-regional-0-regional.gluu.org:31946']" - type: string - group: "Persistence" - required: true - description: "Serf peer addresses. One per replica." - label: Serf peer addresses -# SQL -- variable: config.configmap.cnSqlDbDialect - default: "default" - required: false - type: enum - group: "Persistence" - label: Gluu SQL Database dialect - description: "SQL database dialect. `mysql` or `pgsql`. The former is still not supported yet!" - options: - - "mysql" - - "pgsql" - show_if: "global.cnPersistenceType=sql" -- variable: config.configmap.cnSqlDbHost - default: "my-release-mysql.default.svc.cluster.local" - required: false - type: hostname - group: "Persistence" - label: SQL database host uri - description: "SQL database host uri" - show_if: "global.cnPersistenceType=sql" -- variable: config.configmap.cnSqlDbPort - default: 3306 - required: false - type: int - group: "Persistence" - label: SQL database port - description: "SQL database port" - show_if: "global.cnPersistenceType=sql" -- variable: config.configmap.cnSqlDbUser - default: "gluu" - group: "Persistence" - description: "SQL database username" - type: string - label: SQL database username - valid_chars: "^[a-z]+$" - show_if: "global.cnPersistenceType=sql" -- variable: config.configmap.cnSqldbUserPassword - default: "Test1234#" - group: "Persistence" - description: "SQL password" - type: password - label: SQL password - - show_if: "global.cnPersistenceType=sql" -- variable: config.configmap.cnSqlDbName - default: "gluu" - group: "Persistence" - description: "SQL database name" - type: string - label: SQL database name - show_if: "global.cnPersistenceType=sql" -# Spanner -- variable: config.configmap.cnGoogleSpannerInstanceId - default: "" - group: "Persistence" - description: "The google spanner instance ID" - type: string - label: Google Spanner Instance ID - show_if: "global.cnPersistenceType=spanner" -- variable: config.configmap.cnGoogleSpannerDatabaseId - default: "" - group: "Persistence" - description: "The google spanner database ID" - type: string - label: Google Spanner Database ID - show_if: "global.cnPersistenceType=spanner" -- variable: config.configmap.cnGoogleSecretManagerServiceAccount - default: "" - group: "Persistence" - description: "The service account with access roles/secretmanager.admin to use Google secret manager and/or roles/spanner.databaseUser to use Spanner." - type: multiline - label: Google Spanner Service Account json - show_if: "global.cnPersistenceType=spanner" -- variable: config.configmap.cnGoogleProjectId - default: "" - group: "Persistence" - description: "The Google Project ID" - type: string - label: Google Project ID - show_if: "global.cnPersistenceType=spanner" -#Couchbase -- variable: config.configmap.cnCouchbaseCrt - default: "" - group: "Persistence" - description: "Couchbase certificate authority string. This must be encoded using base64. This can also be found in your couchbase UI Security > Root Certificate. In mTLS setups this is not required." - type: multiline - label: Couchbase certificate authority string - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnCouchbaseUrl - default: "gluu.cbns.svc.cluster.local" - required: false - type: hostname - group: "Persistence" - label: Couchbase host uri - description: "Couchbase URL. Used only when global.cnPersistenceType is hybrid or couchbase. This should be in FQDN format for either remote or local Couchbase clusters. The address can be an internal address inside the kubernetes cluster" - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnCouchbaseBucketPrefix - default: "gluu" - type: string - description: "The prefix of couchbase buckets. This helps with separation in between different environments and allows for the same couchbase cluster to be used by different setups of Gluu." - group: "Persistence" - required: true - label: The prefix of Couchbase buckets - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnCouchbaseIndexNumReplica - default: 0 - type: int - description: "The number of replicas per index created. Please note that the number of index nodes must be one greater than the number of index replicas. That means if your couchbase cluster only has 2 index nodes you cannot place the number of replicas to be higher than 1." - group: "Persistence" - required: true - label: The number of replicas per index created - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnCouchbaseSuperUser - default: "admin" - group: "Persistence" - description: "he Couchbase super user (admin) user name. This user is used during initialization only." - type: string - label: The Couchbase super user (admin) user name. - valid_chars: "^[a-z]+$" - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnCouchbaseSuperUserPassword - default: "Test1234#" - group: "Persistence" - description: "Couchbase password for the super user config.configmap.cnCouchbaseSuperUser that is used during the initialization and upgrade process. The password must contain one digit, one uppercase letter, one lower case letter and one symbol" - type: password - label: Couchbase password for the super users - - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnCouchbaseUser - default: "gluu" - group: "Persistence" - description: "Couchbase restricted user, used in Gluu operations with Couchbase. Used only when global.cnPersistenceType is hybrid or couchbase." - type: string - label: Couchbase restricted username - valid_chars: "^[a-z]+$" - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnCouchbasePassword - default: "Test1234#" - group: "Persistence" - description: "Couchbase password for the restricted user config.configmap.cnCouchbaseUser that is often used inside the services. The password must contain one digit, one uppercase letter, one lower case letter and one symbol ." - type: password - label: Couchbase password for the restricted user - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" - -# ============================== -# StorageClass and volume group -# ============================== -- variable: global.storageClass.provisioner - default: "microk8s.io/hostpath" - type: string - group: "Volumes" - required: true - label: StorageClass provisioner - show_if: "global.cnPersistenceType=ldap||global.jackrabbit.enabled=true" - subquestions: - - variable: global.storageClass.allowVolumeExpansion - default: true - type: boolean - group: "Volumes" - required: true - label: StorageClass Volume expansion - - variable: global.storageClass.reclaimPolicy - default: "Retain" - type: enum - group: "Volumes" - required: true - label: StorageClass reclaimPolicy - options: - - "Delete" - - "Retain" - - variable: global.storageClass.volumeBindingMode - default: "WaitForFirstConsumer" - type: enum - group: "Volumes" - required: true - options: - - "WaitForFirstConsumer" - - "Immediate" - label: StorageClass volumeBindingMode - -# =========== -# Cache group -# =========== -- variable: config.configmap.cnCacheType - default: "NATIVE_PERSISTENCE" - required: true - type: enum - group: "Cache" - label: Gluu Cache - description: "Cache type. `NATIVE_PERSISTENCE`, `REDIS`. or `IN_MEMORY`. Defaults to `NATIVE_PERSISTENCE` ." - options: - - "NATIVE_PERSISTENCE" - - "IN_MEMORY" - - "REDIS" - show_subquestion_if: "REDIS" - subquestions: - - variable: config.configmap.cnRedisType - default: "STANDALONE" - type: enum - group: "Cache" - required: false - label: Redix service type - description: "Redis service type. `STANDALONE` or `CLUSTER`. Can be used when `config.configmap.cnCacheType` is set to `REDIS`." - options: - - "STANDALONE" - - "CLUSTER" - - variable: config.redisPassword - default: "Test1234#" - type: password - group: "Cache" - required: false - label: Redis admin password - description: "Redis admin password if `config.configmap.cnCacheType` is set to `REDIS`." - - - variable: config.configmap.cnRedisUrl - default: "redis.redis.svc.cluster.local:6379" - required: false - type: hostname - group: "Cache" - label: Redis URL - description: "Redis URL and port number :. Can be used when `config.configmap.cnCacheType` is set to `REDIS`." - -# ================== -# Configuration group -# ================== -- variable: global.fqdn - default: "demoexample.gluu.org" - required: true - type: hostname - group: "Configuration" - label: Gluu Installation FQDN - description: "Fully qualified domain name to be used for Gluu installation. This address will be used to reach Gluu services." -- variable: global.countryCode - default: "US" - required: true - type: string - group: "Configuration" - label: Country code - description: "Country code. Used for certificate creation." -- variable: config.state - default: "TX" - required: true - type: string - group: "Configuration" - label: State code - description: "State code. Used for certificate creation." -- variable: config.city - default: "Austin" - required: true - type: string - group: "Configuration" - label: City - description: "City. Used for certificate creation." -- variable: config.email - default: "support@gluu.org" - required: true - type: string - group: "Configuration" - label: Email - description: "Email address of the administrator usually. Used for certificate creation." -- variable: config.orgName - default: "Gluu" - required: true - type: string - group: "Configuration" - label: Organization - description: "Organization name. Used for certificate creation." -- variable: config.adminPassword - default: "Test1234#" - type: password - group: "Configuration" - required: true - label: Admin UI password - description: "Admin password to log in to the UI." - -- variable: config.ldapPassword - default: "Test1234#" - type: password - group: "Configuration" - required: true - label: LDAP password - description: "LDAP admin password if OpenDJ is used for persistence" - show_if: "global.cnPersistenceType=ldap||global.cnPersistenceType=hybrid" - -- variable: global.isFqdnRegistered - default: true - required: true - type: boolean - group: "Configuration" - label: Is the FQDN globally resolvable - description: "Boolean flag to enable mapping global.lbIp to global.fqdn inside pods on clouds that provide static ip for loadbalancers. On cloud that provide only addresses to the LB this flag will enable a script to actively scan config.configmap.lbAddr and update the hosts file inside the pods automatically." -- variable: config.migration.enabled - default: false - required: true - type: boolean - group: "Configuration" - label: Migration from Gluu CE - description: "Boolean flag to enable migration from CE" - show_subquestion_if: true - subquestions: - - variable: config.migration.migrationDataFormat - default: "ldif" - type: enum - group: "Configuration" - required: false - label: Migration data-format - description: "Migration data-format depending on persistence backend." - options: - - "ldif" - - "couchbase+json" - - "spanner+avro" - - "postgresql+json" - - "mysql+json" - - variable: config.migration.migrationDir - default: "/ce-migration" - required: false - type: string - group: "Configuration" - label: Migration Directory - description: "Directory holding all migration files" - -# =========================== -# Ingress group(Istio, NGINX) -# =========================== - -# =========== -# Istio group -# =========== -- variable: global.istio.enabled - default: false - type: boolean - group: "Istio" - required: true - description: "Boolean flag that enables using istio side cars with Gluu services." - label: Use Istio side cars - show_subquestion_if: true - subquestions: - - variable: global.istio.ingress - default: false - type: boolean - group: "Istio" - required: true - description: "Boolean flag that enables using istio gateway for Gluu. This assumes istio ingress is installed and hence the LB is available." - label: Use Istio Ingress - - variable: global.istio.namespace - default: "istio-system" - type: string - group: "Istio" - required: true - description: "Boolean flag that enables using istio gateway for Gluu. This assumes istio ingress is installed and hence the LB is available." - label: Istio namespace - - variable: config.configmap.lbAddr - default: "" - group: "Istio" - description: "Istio loadbalancer address (eks) or ip (gke, aks, digital ocean, local)" - type: hostname - label: LB address or ip - -# =========== -# NGINX group -# =========== -- variable: config.configmap.lbAddr - default: "" - group: "NGINX" - show_if: "global.istio.ingress=false&&global.isFqdnRegistered=false" - description: "loadbalancer address (eks) or ip (gke, aks, digital ocean, local)" - type: hostname - label: LB address or ip -- variable: nginx-ingress.ingress.adminUiEnabled - default: false - type: boolean - group: "NGINX" - required: false - show_if: "global.istio.ingress=false" - description: "Enable Admin UI endpoints." - label: Enable Admin UI endpoints - subquestions: - - variable: nginx-ingress.ingress.openidConfigEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable endpoint /.well-known/openid-configuration" - label: Enable endpoint /.well-known/openid-configuration - - variable: nginx-ingress.ingress.deviceCodeEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable endpoint /device-code" - label: Enable endpoint /device-code - - variable: nginx-ingress.ingress.firebaseMessagingEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable endpoint /firebase-messaging-sw.js" - label: Enable endpoint /firebase-messaging-sw.js - - variable: nginx-ingress.ingress.uma2ConfigEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable endpoint /.well-known/uma2-configuration" - label: Enable endpoint /.well-known/uma2-configuration - - variable: nginx-ingress.ingress.webfingerEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable endpoint /.well-known/webfinger" - label: Enable endpoint /.well-known/webfinger - - variable: nginx-ingress.ingress.webdiscoveryEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable endpoint /.well-known/simple-web-discovery" - label: Enable endpoint /.well-known/simple-web-discovery - - variable: nginx-ingress.ingress.configApiEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable config API endpoints /jans-config-api" - label: Enable config API endpoints /jans-config-api - - variable: nginx-ingress.ingress.u2fConfigEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable endpoint /.well-known/fido-configuration" - label: Enable endpoint /.well-known/fido-configuration - - variable: nginx-ingress.ingress.authServerEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable Auth server endpoints /jans-auth" - label: Enable Auth server endpoints /jans-auth -- variable: nginx-ingress.ingress.fido2ConfigEnabled - default: false - type: boolean - group: "NGINX" - show_if: "global.distribution=default&&global.istio.ingress=false&&global.fido2.enabled=true" - required: true - description: "Enable endpoint /.well-known/fido2-configuration. Enable this!" - label: Enable endpoint /.well-known/fido2-configuration -- variable: nginx-ingress.ingress.casaEnabled - default: false - type: boolean - group: "NGINX" - show_if: "global.distribution=default&&global.istio.ingress=false&&global.casa.enabled=true" - required: true - description: "Enable endpoint /casa. Enable this!" - label: Enable endpoint /casa Enable this! -- variable: nginx-ingress.ingress.authServerProtectedToken - default: true - type: boolean - group: "NGINX" - show_if: "global.distribution=openbanking&&global.istio.ingress=false" - required: true - description: "Enable mTLS on Auth server endpoint /jans-auth/restv1/token" - label: Enable mTLS on Auth server endpoint /jans-auth/restv1/token -- variable: nginx-ingress.ingress.authServerProtectedRegister - default: true - type: boolean - group: "NGINX" - show_if: "global.distribution=openbanking&&global.istio.ingress=false" - required: true - description: "Enable mTLS on Auth server endpoint /jans-auth/restv1/register" - label: Enable mTLS onn Auth server endpoint /jans-auth/restv1/register -- variable: nginx-ingress.ingress.scimConfigEnabled - default: false - type: boolean - group: "NGINX" - show_if: "global.distribution=default&&global.istio.ingress=false&&global.scim.enabled=true" - required: true - description: "Enable endpoint /.well-known/scim-configuration. Enable this!" - label: Enable endpoint /.well-known/scim-configuration. Enable this! -- variable: nginx-ingress.ingress.scimEnabled - default: false - type: boolean - group: "NGINX" - show_if: "global.distribution=default&&global.istio.ingress=false&&global.scim.enabled=true" - required: true - description: "Enable SCIM endpoints /jans-scim. Enable this!" - label: Enable SCIM endpoints /jans-scim. Enable this! - -# ============ -# Images group -# ============ -# AuthServer -- variable: auth-server.image.repository - required: true - type: string - default: "janssenproject/auth-server" - description: "The Auth Server Image repository" - label: Auth Server image repo - group: "Images" - show_if: "global.auth-server.enabled=true" -- variable: auth-server.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The Auth Server Image pull policy" - label: Auth Server imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.auth-server.enabled=true" -- variable: auth-server.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The Auth Server Image tag" - label: Auth Server image tag - group: "Images" - show_if: "global.auth-server.enabled=true" -# AdminUI -- variable: admin-ui.image.repository - required: true - type: string - default: "gluufederation/admin-ui" - description: "The AdminUI Image repository" - label: The AdminUI Image repository - group: "Images" - show_if: "global.admin-ui.enabled=true" -- variable: admin-ui.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The AdminUI Image pull policy" - label: AdminUI imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.admin-ui.enabled=true" -- variable: admin-ui.image.tag - required: true - type: string - default: "1.0.0-0" - description: "The AdminUI Image tag" - label: AdminUI image tag - group: "Images" - show_if: "global.admin-ui.enabled=true" -# AuthServer KeyRotation -- variable: auth-server-key-rotation.image.repository - required: true - type: string - default: "janssenproject/certmanager" - description: "The Auth Server KeyRotation Image repository" - label: Auth Server KeyRotation image repo - group: "Images" - show_if: "global.auth-server-key-rotation.enabled=true" -- variable: auth-server-key-rotation.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The Auth Server KeyRotation Image pull policy" - label: Auth Server KeyRotation imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.auth-server-key-rotation.enabled=true" -- variable: auth-server-key-rotation.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The Auth Server Image tag" - label: Auth Server KeyRotation image tag - group: "Images" - show_if: "global.auth-server-key-rotation.enabled=true" -# Casa -- variable: casa.image.repository - required: true - type: string - default: "gluufederation/casa" - description: "The Casa Image repository" - label: Casa image repo - group: "Images" - show_if: "global.casa.enabled=true" -- variable: casa.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The Casa Image pull policy" - label: Casa imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.casa.enabled=true" -- variable: casa.image.tag - required: true - type: string - default: "5.0.0-0" - description: "The Casa Image tag" - label: Casa image tag - group: "Images" - show_if: "global.casa.enabled=true" -# ClientAPI -- variable: client-api.image.repository - required: true - type: string - default: "janssenproject/client-api" - description: "The ClientAPI Image repository" - label: ClientAPI image repo - group: "Images" - show_if: "global.client-api.enabled=true" -- variable: client-api.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The ClientAPI Image pull policy" - label: ClientAPI imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.client-api.enabled=true" -- variable: client-api.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The ClientAPI Image tag" - label: ClientAPI image tag - group: "Images" - show_if: "global.client-api.enabled=true" -# Configurator -- variable: config.image.repository - required: true - type: string - default: "janssenproject/configurator" - description: "The Configurator Image repository" - label: Configurator image repo - group: "Images" - show_if: "global.config.enabled=true" -- variable: config.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The Configurator Image pull policy" - label: Configurator imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.config.enabled=true" -- variable: config.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The Configurator Image tag" - label: Configurator image tag - group: "Images" - show_if: "global.config.enabled=true" -# ConfigAPI -- variable: config-api.image.repository - required: true - type: string - default: "janssenproject/config-api" - description: "The ConfigAPI Image repository" - label: ConfigAPI image repo - group: "Images" - show_if: "global.config-api.enabled=true" -- variable: config-api.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The ConfigAPI Image pull policy" - label: ConfigAPI imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.config-api.enabled=true" -- variable: config-api.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The ConfigAPI Image tag" - label: ConfigAPI image tag - group: "Images" - show_if: "global.config-api.enabled=true" -# Fido2 -- variable: fido2.image.repository - required: true - type: string - default: "janssenproject/fido2" - description: "The Fido2 Image repository" - label: Fido2 image repo - group: "Images" - show_if: "global.fido2.enabled=true" -- variable: fido2.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The Fido2 Image pull policy" - label: Fido2 imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.fido2.enabled=true" -- variable: fido2.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The Fido2 Image tag" - label: Fido2 image tag - group: "Images" - show_if: "global.fido2.enabled=true" -# Jackrabbit -- variable: jackrabbit.image.repository - required: true - type: string - default: "janssenproject/jackrabbit" - description: "The Jackrabbit Image repository" - label: Jackrabbit image repo - group: "Images" - show_if: "global.jackrabbit.enabled=true" -- variable: jackrabbit.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The Jackrabbit Image pull policy" - label: Jackrabbit imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.jackrabbit.enabled=true" -- variable: jackrabbit.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The Jackrabbit Image tag" - label: Jackrabbit image tag - group: "Images" - show_if: "global.jackrabbit.enabled=true" -# OpenDJ -- variable: opendj.image.repository - required: true - type: string - default: "gluufederation/opendj" - description: "The OpenDJ Image repository" - label: OpenDJ image repo - group: "Images" - show_if: "global.opendj.enabled=true" -- variable: opendj.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The OpenDJ Image pull policy" - label: OpenDJ imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.opendj.enabled=true" -- variable: opendj.image.tag - required: true - type: string - default: "5.0.0_dev" - description: "The OpenDJ Image tag" - label: OpenDJ image tag - group: "Images" - show_if: "global.opendj.enabled=true" -# Persistence -- variable: persistence.image.repository - required: true - type: string - default: "janssenproject/persistence-loader" - description: "The Persistence Image repository" - label: Persistence image repo - group: "Images" - show_if: "global.persistence.enabled=true" -- variable: persistence.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The Persistence Image pull policy" - label: Persistence imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.persistence.enabled=true" -- variable: persistence.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The Persistence Image tag" - label: Persistence image tag - group: "Images" - show_if: "global.persistence.enabled=true" -# SCIM -- variable: scim.image.repository - required: true - type: string - default: "janssenproject/scim" - description: "The SCIM Image repository" - label: SCIM image repo - group: "Images" - show_if: "global.scim.enabled=true" -- variable: scim.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The SCIM Image pull policy" - label: SCIM imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.scim.enabled=true" -- variable: scim.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The SCIM Image tag" - label: SCIM image tag - group: "Images" - show_if: "global.scim.enabled=true" - -# ============== -# Replicas group -# ============== -# AuthServer -- variable: auth-server.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: Auth-server Replicas - description: "Service replica number." - show_if: "global.auth-server.enabled=true" -# Casa -- variable: casa.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: Casa Replicas - description: "Service replica number." - show_if: "global.auth-server.enabled=true" -# ClientAPI -- variable: client-api.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: ClientAPI Replicas - description: "Service replica number." - show_if: "global.client-api.enabled=true" -# ConfigAPI -- variable: config-api.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: ConfigAPI Replicas - description: "Service replica number." - show_if: "global.config-api.enabled=true" -# AdminUi -- variable: admin-ui.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: Admin UI Replicas - description: "Service replica number." - show_if: "global.admin-ui.enabled=true" -# Fido2 -- variable: fido2.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: Fido2 Replicas - description: "Service replica number." - show_if: "global.fido2.enabled=true" -# Jackrabbit -- variable: jackrabbit.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: Jackrabbit Replicas - description: "Service replica number." - show_if: "global.jackrabbit.enabled=true" -# OpenDJ -- variable: opendj.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: OpenDJ Replicas - description: "Service replica number." - show_if: "global.opendj.enabled=true&&opendj.multiCluster.enabled=false" -# SCIM -- variable: scim.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: SCIM Replicas - description: "Service replica number." - show_if: "global.scim.enabled=true" - diff --git a/charts/gluu/gluu/templates/_helpers.tpl b/charts/gluu/gluu/templates/_helpers.tpl deleted file mode 100644 index c5b8d3d30..000000000 --- a/charts/gluu/gluu/templates/_helpers.tpl +++ /dev/null @@ -1,32 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "cn.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "cn.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "cn.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} diff --git a/charts/gluu/gluu/values.schema.json b/charts/gluu/gluu/values.schema.json deleted file mode 100644 index cab15431b..000000000 --- a/charts/gluu/gluu/values.schema.json +++ /dev/null @@ -1,2888 +0,0 @@ -{ - "$schema":"https://json-schema.org/draft/2020-12/schema#", - "type":"object", - "properties":{ - "admin-ui":{ - "description":"Admin GUI for configuration of the auth-server", - "type":"object", - "properties":{ - - } - }, - "auth-server":{ - "description":"OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Gluu. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing.", - "type":"object", - "properties":{ - - } - }, - "auth-server-key-rotation":{ - "description":"Responsible for regenerating auth-keys per x hours", - "type":"object", - "properties":{ - - } - }, - "casa":{ - "description":"Gluu Casa (\"Casa\") is a self-service web portal for end-users to manage authentication and authorization preferences for their account in a Gluu Server.", - "type":"object", - "properties":{ - - } - } - }, - "config":{ - "description":"Configuration parameters for setup and initial configuration secret annd config layers used by Gluu services.", - "type":"object", - "properties":{ - "adminPass":{ - "description":"Admin password to login to the UI", - "$ref":"#/definitions/password" - }, - "city":{ - "description":"City of the company or individual. Used in generating the self-signed certificate", - "type":"string", - "pattern":"^[a-zA-Z]+$" - }, - "configmap":{ - "description":"Configuration parameters mapped to envs in a ConfigMap", - "type":"object", - "properties":{ - "cnSqlDbDialect":{ - "description":"SQL dialect", - "type":"string", - "pattern":"^(mysql)$" - }, - "cnSqlDbHost":{ - "description":"SQL server address or ip", - "anyOf":[ - { - "$ref":"#/definitions/url-pattern" - }, - { - "$ref":"#/definitions/ip-pattern" - } - ] - }, - "cnSqlDbPort":{ - "description":"SQL server port", - "type":"integer" - }, - "cnSqlDbName":{ - "description":"SQL server database name for Jans", - "type":"string", - "pattern":"^[a-z-0-9]+$" - }, - "cnSqlDbUser":{ - "description":"SQL database Jans username", - "type":"string", - "pattern":"^[a-z-0-9]+$" - }, - "cnSqlDbTimezone":{ - "description":"SQL database timezone", - "type":"string", - "pattern":"^(GMT|UTC|ECT|EET|ART|EAT|MET|NET|PLT|IST|BST|VST|CTT|JST|ACT|AET|SST|NST|MIT|HST|AST|PST|PNT|MST|CST|EST|IET|PRT|CNT|AGT|BET|CAT)$" - }, - "cnSqldbUserPassword":{ - "description":"Password for user config.configmap.cnSqlDbUser.", - "$ref":"#/definitions/password" - }, - "cnCacheType":{ - "description":"Cache type. NATIVE_PERSISTENCE, REDIS. or IN_MEMORY. Defaults to NATIVE_PERSISTENCE", - "type":"string", - "pattern":"^(NATIVE_PERSISTENCE|REDIS|IN_MEMORY)$" - }, - "cnConfigKubernetesConfigMap":{ - "description":"The name of the ConfigMap that will hold the configuration layer", - "type":"string", - "pattern":"^[a-z]+$" - }, - "cnCouchbaseBucketPrefix":{ - "description":"The prefix of couchbase buckets. This helps with separation in between different environments and allows for the same couchbase cluster to be used by different setups of Gluu.", - "type":"string", - "pattern":"^[a-z]+$" - }, - "cnCouchbaseCrt":{ - "description":"Couchbase certificate authority string. This must be encoded using base64. This can also be found in your couchbase UI Security > Root Certificate. In mTLS setups this is not required.", - "type":"string", - "pattern":"^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" - }, - "cnCouchbaseIndexNumReplica":{ - "description":"The number of replicas per index created. Please note that the number of index nodes must be one greater than the number of index replicas. That means if your couchbase cluster only has 2 index nodes you cannot place the number of replicas to be higher than 1.", - "type":"integer" - }, - "cnCouchbasePass":{ - "description":"Couchbase password for the restricted user config.configmap.cnCouchbaseUser that is often used inside the services. The password must contain one digit, one uppercase letter, one lower case letter and one symbol ", - "$ref":"#/definitions/password" - }, - "cnCouchbaseSuperUser":{ - "description":"The Couchbase super user (admin) user name. This user is used during initialization only.", - "type":"string", - "pattern":"^[a-z]+$" - }, - "cnCouchbaseSuperUserPass":{ - "description":"Couchbase password for the super user config.configmap.cnCouchbaseSuperUser that is used during the initialization process. The password must contain one digit, one uppercase letter, one lower case letter and one symbol ", - "$ref":"#/definitions/password" - }, - "cnCouchbaseSuperUserPassFile":{ - "description":"The location of the Couchbase restricted user config.configmap.cnCouchbaseSuperUser password. The file path must end with couchbase_superuser_password.", - "type":"string", - "pattern":".*couchbase_superuser_password\\b.*" - }, - "cnCouchbaseUrl":{ - "description":"Couchbase URL. Used only when global.cnPersistenceType is hybrid or couchbase. This should be in FQDN format for either remote or local Couchbase clusters. The address can be an internal address inside the kubernetes cluster", - "$ref":"#/definitions/fqdn-pattern" - }, - "cnCouchbaseUser":{ - "description":"Couchbase restricted user. Used only when global.cnPersistenceType is hybrid or couchbase.", - "type":"string", - "pattern":"^[a-z]+$" - }, - "cnGoogleSecretManagerServiceAccount":{ - "description":"Service account with roles roles/secretmanager.admin base64 encoded string. This is used often inside the services to reach the configuration layer. Used only when global.configAdapterName and global.configSecretAdapter is set to google.", - "type":"string", - "pattern":"^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" - }, - "cnGoogleProjectId":{ - "description":"Project id of the google project the secret manager belongs to. Used only when global.configAdapterName and global.configSecretAdapter is set to google.", - "type":"string", - "pattern":"" - }, - "cnGoogleSpannerInstanceId":{ - "description":"Google Spanner ID. Used only when global.cnPersistenceType is spanner.", - "type":"string", - "pattern":"^([a-z0-9\\-])*$" - }, - "cnGoogleSpannerDatabaseId":{ - "description":"Google Spanner Database ID. Used only when global.cnPersistenceType is spanner.", - "type":"string", - "pattern":"^[a-z0-9\\-]*$" - }, - "cnSecretGoogleSecretVersionId":{ - "description":"Secret version to be used for secret configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google.", - "type":"string", - "pattern":"^([0-9]|latest)*$" - }, - "cnSecretGoogleSecretNamePrefix":{ - "description":"Prefix for Gluu secret in Google Secret Manager. Defaults to gluu. If left gluu-secret secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google.", - "type":"string", - "pattern":"^[a-z]+$" - }, - "cnGoogleSecretManagerPassPhrase":{ - "description":"Passphrase for Gluu secret in Google Secret Manager. This is used for encrypting and decrypting data from the Google Secret Manager. Used only when global.configAdapterName and global.configSecretAdapter is set to google.", - "$ref":"#/definitions/password" - }, - "cnConfigGoogleSecretVersionId":{ - "description":"Secret version to be used for configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google. Used only when global.configAdapterName and global.configSecretAdapter is set to google.", - "type":"string", - "pattern":"^([0-9]|latest)*$" - }, - "cnConfigGoogleSecretNamePrefix":{ - "description":"Prefix for Gluu configuration secret in Google Secret Manager. Defaults to gluu. If left intact gluu-configuration secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google.", - "type":"string" - }, - "cnLdapUrl":{ - "description":"OpenDJ internal address. Leave as default. Used when `global.cnPersistenceType` is set to `ldap`.", - "type":"string", - "pattern":"^[a-z0-9-:]+$" - }, - "cnMaxRamPercent":{ - "description":"Value passed to Java option -XX:MaxRAMPercentage", - "type":"string", - "pattern":"^(\\d{0,2}(\\.\\d{1,2})?|100(\\.0?)?)$" - }, - "cnScimProtectionMode":{ - "description":"SCIM protection mode OAUTH|TEST|UMA", - "type":"string", - "pattern":"^(OAUTH|TEST|UMA)$" - }, - "cnPersistenceHybridMapping":{ - "description":"Specify data that should be saved in LDAP (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType` is set to `hybrid`.", - "type":"string" - }, - "cnRedisSentinelGroup":{ - "description":"Redis Sentinel Group. Often set when `config.configmap.cnRedisType` is set to `SENTINEL`. Can be used when `config.configmap.cnCacheType` is set to `REDIS`.", - "type":"string" - }, - "cnRedisSslTruststore":{ - "description":"Redis SSL truststore. Optional. Can be used when `config.configmap.cnCacheType` is set to `REDIS`.", - "type":"string" - }, - "cnRedisType":{ - "description":"Redis service type. `STANDALONE` or `CLUSTER`. Can be used when `config.configmap.cnCacheType` is set to `REDIS`.", - "type":"string", - "pattern":"^(SHARDED|STANDALONE|CLUSTER|SENTINEL)$" - }, - "cnRedisUrl":{ - "description":"Redis URL and port number :. Can be used when `config.configmap.cnCacheType` is set to `REDIS`.", - "$ref":"#/definitions/url-pattern" - }, - "cnRedisUseSsl":{ - "description":"Boolean to use SSL in Redis. Can be used when `config.configmap.cnCacheType` is set to `REDIS`.", - "type":"boolean" - }, - "cnSecretKubernetesSecret":{ - "description":"Kubernetes secret name holding configuration keys. Used when global.configSecretAdapter is set to kubernetes which is the default.", - "type":"string", - "pattern":"^[a-z]+$" - }, - "lbAddr":{ - "description":"Loadbalancer address for AWS if the FQDN is not registered.", - "$ref":"#/definitions/url-pattern" - } - } - }, - "countryCode":{ - "description":"Country code. Used for certificate creation.", - "type":"string", - "pattern":"^[A-Z]+$" - }, - "email":{ - "description":"Email address of the administrator usually. Used for certificate creation.", - "$ref":"#/definitions/email-format" - }, - "image":{ - "type":"object", - "properties":{ - "repository":{ - "description":"Image to use for deploying", - "type":"string", - "pattern":"^[a-z0-9-_/]+$" - }, - "tag":{ - "description":"Image tag to use for deploying.", - "type":"string", - "pattern":"^[a-z0-9-_.]+$" - } - } - }, - "ldapPassword":{ - "description":"LDAP admin password if OpennDJ is used for persistence.", - "$ref":"#/definitions/password" - }, - "orgName":{ - "description":"Organization name. Used for certificate creation.", - "type":"string", - "pattern":"^[a-zA-Z]+$" - }, - "redisPassword":{ - "description":"Redis admin password if `config.configmap.cnCacheType` is set to `REDIS`", - "$ref":"#/definitions/password" - }, - "resources":{ - "description":"Resource specs.", - "type":"object", - "properties":{ - "limits":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU limit.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory limit.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - }, - "requests":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU request.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory request.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - } - } - }, - "state":{ - "description":"State code. Used for certificate creation.", - "type":"string", - "pattern":"^[a-zA-Z]+$" - } - } - }, - "config-api":{ - "description":"Config Api endpoints can be used to configure the auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS).", - "type":"object", - "properties":{ - - } - }, - "fido2":{ - "description":"FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments.", - "type":"object", - "properties":{ - - } - }, - "global":{ - "description":"Parameters used globally across all services helm charts.", - "type":"object", - "properties":{ - "alb":{ - "type":"object", - "properties":{ - "ingress":{ - "description":"Activates ALB ingress", - "type":"boolean" - } - } - }, - "auth-server":{ - "type":"object", - "properties":{ - "enabled":{ - "description":"Boolean flag to enable/disable auth-server chart. You should never set this to false.", - "type":"boolean" - }, - "authServerServiceName":{ - "description":"Name of the auth-server service. Please keep it as default.", - "type":"string", - "pattern":"^[a-z0-9-]+$" - }, - "appLoggers":{ - "type":"object", - "properties":{ - "authLogTarget":{ - "description":"jans-auth.log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "authLogLevel":{ - "description":"jans-auth.log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - }, - "httpLogTarget":{ - "description":"http_request_response target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "httpLogLevel":{ - "description":"http_request_response level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - }, - "persistenceLogTarget":{ - "description":"jans-auth_persistence.log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "persistenceLogLevel":{ - "description":"jans-auth_persistence.log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - }, - "persistenceDurationLogTarget":{ - "description":"jans-auth_persistence_duration.log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "persistenceDurationLogLevel":{ - "description":"jans-auth_persistence_duration.log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - }, - "ldapStatsLogTarget":{ - "description":"jans-auth_persistence_ldap_statistics.log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "ldapStatsLogLevel":{ - "description":"jans-auth_persistence_ldap_statistics.log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - }, - "scriptLogTarget":{ - "description":"jans-auth_script.log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "scriptLogLevel":{ - "description":"jans-auth_script.log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - }, - "auditStatsLogTarget":{ - "description":"jans-auth_audit.log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "auditStatsLogLevel":{ - "description":"jans-auth_audit.log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - } - } - }, - "ingress":{ - "description":"Endpoint control", - "type":"object", - "properties": { - "authServerEnabled":{ - "description":"Enable Auth server endpoints /jans-auth", - "type":"boolean" - }, - "openidConfigEnabled":{ - "description":"Enable endpoint /.well-known/openid-configuration", - "type":"boolean" - }, - "deviceCodeEnabled":{ - "description":"Enable endpoint /device-code", - "type":"boolean" - }, - "firebaseMessagingEnabled":{ - "description":"Enable endpoint /firebase-messaging-sw.js", - "type":"boolean" - }, - "uma2ConfigEnabled":{ - "description":"Enable endpoint /.well-known/uma2-configuration", - "type":"boolean" - }, - "webfingerEnabled":{ - "description":"Enable endpoint /.well-known/webfinger", - "type":"boolean" - }, - "webdiscoveryEnabled":{ - "description":"Enable endpoint /.well-known/simple-web-discovery", - "type":"boolean" - }, - "u2fConfigEnabled":{ - "description":"Enable endpoint /.well-known/fido-configuration", - "type":"boolean" - }, - "authServerProtectedToken":{ - "description":"Enable mTLS on Auth server endpoint /jans-auth/restv1/token", - "type":"boolean" - }, - "authServerProtectedRegister":{ - "description":"Enable mTLS onn Auth server endpoint /jans-auth/restv1/register", - "type":"boolean" - } - } - } - - } - }, - "admin-ui":{ - "type":"object", - "properties":{ - "enabled":{ - "description":"Boolean flag to enable/disable admin-ui chart. You should never set this to false.", - "type":"boolean" - }, - "adminUiServiceName":{ - "description":"Name of the admin service. Please keep it as default.", - "type":"string", - "pattern":"^[a-z0-9-]+$" - }, - "ingress":{ - "description":"Endpoint control", - "type":"object", - "properties": { - "adminUiEnabled":{ - "description":"Enable Admin UI endpoints.", - "type":"boolean" - } - } - } - } - }, - - "auth-server-key-rotation":{ - "type":"object", - "properties":{ - "enabled":{ - "description":"Boolean flag to enable/disable the auth-server-key rotation cronjob chart.", - "type":"boolean" - } - } - }, - "awsStorageType":{ - "description":"Volume stroage type if using AWS volumes.", - "type":"string", - "pattern":"^(io1|io2|gp2|st1|sc1)$" - }, - "azureStorageAccountType":{ - "description":"Volume storage type if using Azure disks.", - "type":"string", - "pattern":"^(Standard_LRS|Premium_LRS|StandardSSD_LRS|UltraSSD_LRS)$" - }, - "azureStorageKind":{ - "description":"Azure storage kind if using Azure disks", - "type":"string", - "pattern":"^(Managed)$" - }, - "cloud":{ - "type":"object", - "properties":{ - "testEnviroment":{ - "description":"Boolean flag if enabled will strip resources requests and limits from all services.", - "type":"boolean" - } - } - }, - "cnPersistenceType":{ - "description":"Persistence backend to run Gluu with ldap|couchbase|hybrid|sql|spanner.", - "type":"string", - "pattern":"^(ldap|couchbase|hybrid|sql|spanner)$" - }, - "cnDocumentStoreType":{ - "description":"Document store type to use for shibboleth files LOCAL.", - "type":"string", - "pattern":"^(LOCAL)$" - }, - "cnObExtSigningJwksUri":{ - "description":"Open banking external signing jwks uri. Used in SSA Validation.", - "type":"string" - }, - "cnObExtSigningJwksCrt":{ - "description":"Open banking external signing jwks AS certificate authority string. Used in SSA Validation. This must be encoded using base64.. Used when `.global.cnObExtSigningJwksUri` is set.", - "type":"string", - "pattern":"^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" - }, - "cnObExtSigningJwksKey":{ - "description":"Open banking external signing jwks AS key string. Used in SSA Validation. This must be encoded using base64. Used when `.global.cnObExtSigningJwksUri` is set.", - "type":"string", - "pattern":"^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" - }, - "cnObExtSigningJwksKeyPassPhrase":{ - "description":"Open banking external signing jwks AS key passphrase to unlock provided key. This must be encoded using base64. Used when `.global.cnObExtSigningJwksUri` is set.", - "type":"string", - "pattern":"^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" - }, - "cnObExtSigningAlias":{ - "description":"Open banking external signing AS Alias. This is a kid value.Used in SSA Validation, kid used while encoding a JWT sent to token URL i.e XkwIzWy44xWSlcWnMiEc8iq9s2G", - "type":"string" - }, - "cnObStaticSigningKeyKid":{ - "description":"Open banking signing AS kid to force the AS to use a specific signing key. i.e Wy44xWSlcWnMiEc8iq9s2G", - "type":"string" - }, - "cnObTransportCrt":{ - "description":"Open banking AS transport crt. Used in SSA Validation. This must be encoded using base64.", - "type":"string", - "pattern":"^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" - }, - "cnObTransportKey":{ - "description":"Open banking AS transport key. Used in SSA Validation. This must be encoded using base64.", - "type":"string", - "pattern":"^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" - }, - "cnObTransportKeyPassPhrase":{ - "description":"Open banking AS transport key passphrase to unlock AS transport key. This must be encoded using base64.", - "type":"string", - "pattern":"^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" - }, - "cnObTransportAlias":{ - "description":"Open banking transport Alias used inside the JVM.", - "type":"string" - }, - "cnObTransportTrustStore":{ - "description":"Open banking AS transport truststore in .p12 format. This is normally generated from the OB issuing CA, OB Root CA and Signing CA. Used when .global.cnObExtSigningJwksUri is set. Used in SSA Validation. This must be encoded using base64.", - "type":"string", - "pattern":"^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$" - }, - "config":{ - "type":"object", - "properties":{ - "enabled":{ - "description":"Boolean flag to enable/disable the configuration chart. This normally should always be true", - "type":"boolean" - } - } - }, - "configAdapterName":{ - "description":"The config backend adapter that will hold Gluu configuration layer. google|kubernetes|aws", - "type":"string", - "pattern":"^(kubernetes|google|aws)$" - }, - "configSecretAdapter":{ - "description":"The config backend adapter that will hold Gluu secret layer. google|kubernetes|aws", - "type":"string", - "pattern":"^(kubernetes|google|aws)$" - }, - "cnGoogleApplicationCredentials":{ - "description":"Base64 encoded service account. The sa must have roles/secretmanager.admin to use Google secrets and roles/spanner.databaseUser to use Spanner.", - "type":"string", - "pattern":".*google-credentials.json\\b.*" - }, - "casa":{ - "type":"object", - "properties":{ - "casaServiceName":{ - "description":"Name of the casa service. Please keep it as default.", - "type":"string", - "pattern":"^[a-z0-9-]+$" - }, - "enabled":{ - "description":"Boolean flag to enable/disable the casa chart.", - "type":"boolean" - }, - "ingress":{ - "description":"Endpoint control", - "type":"object", - "properties": { - "casaEnabled":{ - "description":" Enable casa endpoints /casa", - "type":"boolean" - } - } - } - } - }, - "config-api":{ - "type":"object", - "properties":{ - "configApiServerServiceName":{ - "description":"Name of the config-api service. Please keep it as default.", - "type":"string", - "pattern":"^[a-z0-9-]+$" - }, - "enabled":{ - "description":"Boolean flag to enable/disable the config-api chart.", - "type":"boolean" - }, - "appLoggers":{ - "type":"object", - "properties":{ - "configApiLogTarget":{ - "description":"configapi.log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "configApiLogLevel":{ - "description":"configapi.log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - } - } - }, - "adminUiAppLoggers":{ - "type":"object", - "properties":{ - "adminUiLogTarget":{ - "description":"config-api admin-ui plugin log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "adminUiLogLevel":{ - "description":"config-api admin-ui plugin log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - }, - "adminUiAuditLogTarget":{ - "description":"config-api admin-ui plugin audit log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "adminUiAuditLogLevel":{ - "description":"config-api admin-ui plugin audit log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - } - } - }, - "ingress":{ - "description":"Endpoint control", - "type":"object", - "properties": { - "configApiEnabled":{ - "description":"Enable config API endpoints /jans-config-api", - "type":"boolean" - } - } - } - - - } - }, - "fqdn":{ - "description":"Fully qualified domain name to be used for Gluu installation. This address will be used to reach Gluu services.", - "$ref":"#/definitions/fqdn-pattern" - }, - "fido2":{ - "type":"object", - "properties":{ - "fido2ServiceName":{ - "description":"Name of the fido2 service. Please keep it as default.", - "type":"string", - "pattern":"^[a-z0-9-]+$" - }, - "enabled":{ - "description":"Boolean flag to enable/disable the fido2 chart.", - "type":"boolean" - }, - "appLoggers":{ - "type":"object", - "properties":{ - "fido2LogTarget":{ - "description":"fido2.log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "fido2LogLevel":{ - "description":"fido2.log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - }, - "persistenceLogTarget":{ - "description":"fido2_persistence.log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "persistenceLogLevel":{ - "description":"fido2_persistence.log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - } - } - }, - "ingress":{ - "description":"Endpoint control", - "type":"object", - "properties": { - "fido2ConfigEnabled":{ - "description":"Enable endpoint /.well-known/fido2-configuration", - "type":"boolean" - } - } - } - - } - }, - "gcePdStorageType":{ - "description":"GCE storage kind if using Google disks", - "type":"string", - "pattern":"^(pd-standard|pd-balanced|pd-ssd)$" - }, - "isFqdnRegistered":{ - "description":"Boolean flag to enable mapping global.lbIp to global.fqdn inside pods on clouds that provide static ip for loadbalancers. On cloud that provide only addresses to the LB this flag will enable a script to actively scan config.configmap.lbAddr and update the hosts file inside the pods automatically.", - "type":"boolean" - }, - "istio":{ - "type":"object", - "properties":{ - "enabled":{ - "description":"Boolean flag that enables using istio side cars with Gluu services.", - "type":"boolean" - }, - "ingress":{ - "description":"Boolean flag that enables using istio gateway for Gluu. This assumes istio ingress is installed and hence the LB is available.", - "type":"boolean" - }, - "namespace":{ - "description":"The namespace istio is deployed in. The is normally istio-system.", - "type":"string", - "pattern":"^[a-z0-9-_/]+$" - } - } - }, - "lbIp":{ - "description":"The Loadbalancer IP created by nginx or istio on clouds that provide static IPs. This is not needed if `global.fqdn` is globally resolvable.", - "$ref":"#/definitions/ip-pattern" - }, - "nginx-ingress":{ - "type":"object", - "properties":{ - "enabled":{ - "description":"Boolean flag to enable/disable the nginx-ingress definitions chart.", - "type":"boolean" - } - } - }, - "opendj":{ - "type":"object", - "properties":{ - "enabled":{ - "description":"Boolean flag to enable/disable the OpenDJ chart.", - "type":"boolean" - }, - "ldapServiceName":{ - "description":"Name of the OpenDJ service. Please keep it as default.", - "type":"string", - "pattern":"^[a-z0-9-]+$" - } - } - }, - "oxshibboleth":{ - "type":"object", - "properties":{ - "enabled":{ - "description":"Boolean flag to enable/disable the oxShibbboleth chart. Not part of the openbanking distribution. Keep as default.This also enables SAML-related features; UI menu, etc. Not part of the openbanking distribution. Please leave this disabled.", - "type":"boolean" - } - } - }, - "distribution":{ - "description":"Gluu distributions supported are: default|openbanking.", - "type":"string", - "pattern":"^(default|openbanking)$" - }, - "persistence":{ - "type":"object", - "properties":{ - "enabled":{ - "description":"Boolean flag to enable/disable the persistence chart.", - "type":"boolean" - } - } - }, - "oxpassport": { - "type": "object", - "properties": { - "enabled": { - "description": "Boolean flag to enable/disable the oxpassport chart.", - "type": "boolean" - }, - "oxPassportServiceName":{ - "description":"Name of the oxPassport service. Please keep it as default.", - "type":"string", - "pattern":"^[a-z0-9-]+$" - } - } - }, - "scim":{ - "type":"object", - "properties":{ - "enabled":{ - "description":"Boolean flag to enable/disable the SCIM chart.", - "type":"boolean" - }, - "scimServiceName":{ - "description":"Name of the scim service. Please keep it as default.", - "type":"string", - "pattern":"^[a-z0-9-]+$" - }, - "appLoggers":{ - "type":"object", - "properties":{ - "authLogTarget":{ - "description":"jans-scim.log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "authLogLevel":{ - "description":"jans-scim.log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - }, - "persistenceLogTarget":{ - "description":"jans-scim_persistence.log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "persistenceLogLevel":{ - "description":"jans-scim_persistence.log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - }, - "persistenceDurationLogTarget":{ - "description":"jans-scim_persistence_duration.log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "persistenceDurationLogLevel":{ - "description":"jans-scim_persistence_duration.log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - }, - "ldapStatsLogTarget":{ - "description":"jans-scim_persistence_ldap_statistics.log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "ldapStatsLogLevel":{ - "description":"jans-scim_persistence_ldap_statistics.log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - }, - "scriptLogTarget":{ - "description":"jans-scim_script.log target", - "type":"string", - "pattern":"^(STDOUT|FILE)$" - }, - "scriptLogLevel":{ - "description":"jans-scim_script.log level", - "type":"string", - "pattern":"^(FATAL|ERROR|WARN|INFO|DEBUG|TRACE)$" - } - } - }, - "ingress":{ - "description":"Endpoint control", - "type":"object", - "properties": { - "scimEnabled":{ - "description":"Enable SCIM endpoints /jans-scim", - "type":"boolean" - }, - "scimConfigEnabled":{ - "description":"Enable endpoint /.well-known/scim-configuration", - "type":"boolean" - } - } - } - - } - }, - "storageClass":{ - "description":"StorageClass section for OpenDJ charts. This is not currently used by the openbanking distribution. You may specify custom parameters as needed.", - "type":"object", - "properties":{ - "allowVolumeExpansion":{ - "type":"boolean" - }, - "allowedTopologies":{ - "type":"array", - "items":{ - "type":"string" - } - }, - "mountOptions":{ - "type":"array", - "items":{ - "type":"string" - } - }, - "parameters":{ - "type":"object", - "properties":{ - "fsType":{ - "type":"string" - }, - "kind":{ - "type":"string" - }, - "pool":{ - "type":"string" - }, - "storageAccountType":{ - "type":"string" - }, - "type":{ - "type":"string" - } - } - }, - "provisioner":{ - "type":"string" - }, - "reclaimPolicy":{ - "type":"string" - }, - "volumeBindingMode":{ - "type":"string" - } - } - } - } - }, - "nginx-ingress":{ - "description":"Nginx ingress definitions chart", - "type":"object", - "properties":{ - - } - }, - "opendj":{ - "description":"OpenDJ is a directory server which implements a wide range of Lightweight Directory Access Protocol and related standards, including full compliance with LDAPv3 but also support for Directory Service Markup Language (DSMLv2).Written in Java, OpenDJ offers multi-master replication, access control, and many extensions.", - "type":"object", - "properties":{ - - } - }, - "oxpassport":{ - "description":"Gluu interface to Passport.js to support social login and inbound identity.", - "type":"object", - "properties":{ - - } - }, - "oxshibboleth":{ - "description":"Shibboleth project for the Gluu Server's SAML IDP functionality.", - "type":"object", - "properties":{ - - } - }, - "persistence":{ - "description":"Job to generate data and intial config for Gluu Server persistence layer.", - "type":"object", - "properties":{ - - } - }, - "scim":{ - "description":"System for Cross-domain Identity Management (SCIM) version 2.0", - "type":"object", - "properties":{ - - } - } - , - "allOf":[ - { - "$ref":"#/definitions/admin-ui-enabled" - }, - { - "$ref":"#/definitions/auth-server-enabled" - }, - { - "$ref":"#/definitions/auth-server-key-rotation-enabled" - }, - { - "$ref":"#/definitions/casa-enabled" - }, - { - "$ref":"#/definitions/config-api-enabled" - }, - { - "$ref":"#/definitions/fido2-enabled" - }, - { - "$ref":"#/definitions/nginx-ingress-enabled" - }, - { - "$ref":"#/definitions/opendj-enabled" - }, - { - "$ref":"#/definitions/oxpassport-enabled" - }, - { - "$ref":"#/definitions/oxshibboleth-enabled" - }, - { - "$ref":"#/definitions/persistence-enabled" - }, - { - "$ref":"#/definitions/scim-enabled" - } - ], - "definitions":{ - "password":{ - "anyOf":[ - { - "type":"string", - "minLength":8, - "pattern":"", - "description":"Password does not meet requirements. The password must contain one digit, one uppercase letter, one lower case letter and one symbol", - "errors":{ - "minLength":"Password minimum 6 character", - "pattern":"Password does not meet requirements. The password must contain one digit, one uppercase letter, one lower case letter and one symbol" - } - }, - { - "type":"string", - "maxLength":0 - } - ] - }, - "password-pattern":{ - "type":"string", - "minLength":6, - "pattern":"", - "errors":{ - "minLength":"Password minimum 6 character", - "pattern":"Password does not meet requirements. The password must contain one digit, one uppercase letter, one lower case letter and one symbol" - } - }, - "email-format":{ - "type":"string", - "format":"email" - }, - "fqdn-pattern":{ - "anyOf":[ - { - "type":"string", - "errors":{ - "pattern":"Setting not FQDN structured. Please enter a FQDN with the format demoexample.gluu.org" - } - }, - { - "type":"string", - "maxLength":0 - } - ] - }, - "url-pattern":{ - "anyOf":[ - { - "type":"string", - "pattern":"(^|\\s)((https?:\\/\\/)?[\\w-]+(\\.[\\w-]+)+\\.?(:\\d+)?(\\/\\S*)?)", - "errors":{ - "pattern":"URL pattern is not meeting standards." - } - }, - { - "type":"string", - "maxLength":0 - } - ] - }, - "ip-pattern":{ - "anyOf":[ - { - "type":"string", - "pattern":"^(\\*|((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))$", - "errors":{ - "pattern":"Not a valid IP." - } - }, - { - "type":"string", - "maxLength":0 - } - ] - }, - "admin-ui-enabled":{ - "if":{ - "properties":{ - "global":{ - "properties":{ - "admin-ui":{ - "properties":{ - "enabled":{ - "const":"true" - } - } - } - } - } - } - }, - "then":{ - "properties":{ - "admin-ui":{ - "required":[ - "image", - "replicas", - "resources" - ], - "properties":{ - "hpa":{ - "description":"Configure the HorizontalPodAutoscaler", - "type":"object", - "properties":{ - "enabled":{ - "type":"boolean" - }, - "minReplicas":{ - "type":"integer" - }, - "maxReplicas":{ - "type":"integer" - }, - "targetCPUUtilizationPercentage":{ - "type":"integer" - }, - "metrics":{ - "description":"metrics if targetCPUUtilizationPercentage is not set", - "type":"array" - }, - "behavior":{ - "description":"Scaling Policies", - "type":"object" - } - } - }, - "usrEnvs":{ - "description":"Add custom normal and secret envs to the service", - "type":"object", - "properties":{ - "normal":{ - "description":"Add custom normal envs to the service", - "type":"object" - }, - "secret":{ - "description":"Add custom secret envs to the service", - "type":"object" - } - } - }, - "dnsPolicy":{ - "description":"Add custom dns policy", - "type":"string", - "pattern":"^(Default|ClusterFirst|ClusterFirstWithHostNet|None|)$" - }, - "dnsConfig":{ - "description":"Add custom dns config", - "type":"object" - }, - "image":{ - "type":"object", - "properties":{ - "pullPolicy":{ - "description":"Image pullPolicy to use for deploying.", - "type":"string", - "pattern":"^(Always|Never|IfNotPresent)$" - }, - "repository":{ - "description":"Image to use for deploying", - "type":"string", - "pattern":"^[a-z0-9-_/]+$" - }, - "tag":{ - "description":"Image tag to use for deploying.", - "type":"string", - "pattern":"^[a-z0-9-_.]+$" - } - } - }, - "replicas":{ - "description":"Service replica number.", - "type":"integer" - }, - "resources":{ - "description":"Resource specs.", - "type":"object", - "properties":{ - "limits":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU limit.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory limit.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - }, - "requests":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU request.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory request.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - } - } - } - } - } - } - }, - "else":true - }, - "auth-server-enabled":{ - "if":{ - "properties":{ - "global":{ - "properties":{ - "auth-server":{ - "properties":{ - "enabled":{ - "const":"true" - } - } - } - } - } - } - }, - "then":{ - "properties":{ - "auth-server":{ - "required":[ - "image", - "replicas", - "resources" - ], - "properties":{ - "hpa":{ - "description":"Configure the HorizontalPodAutoscaler", - "type":"object", - "properties":{ - "enabled":{ - "type":"boolean" - }, - "minReplicas":{ - "type":"integer" - }, - "maxReplicas":{ - "type":"integer" - }, - "targetCPUUtilizationPercentage":{ - "type":"integer" - }, - "metrics":{ - "description":"metrics if targetCPUUtilizationPercentage is not set", - "type":"array" - }, - "behavior":{ - "description":"Scaling Policies", - "type":"object" - } - } - }, - "usrEnvs":{ - "description":"Add custom normal and secret envs to the service", - "type":"object", - "properties":{ - "normal":{ - "description":"Add custom normal envs to the service", - "type":"object" - }, - "secret":{ - "description":"Add custom secret envs to the service", - "type":"object" - } - } - }, - "dnsPolicy":{ - "description":"Add custom dns policy", - "type":"string", - "pattern":"^(Default|ClusterFirst|ClusterFirstWithHostNet|None|)$" - }, - "dnsConfig":{ - "description":"Add custom dns config", - "type":"object" - }, - "image":{ - "type":"object", - "properties":{ - "pullPolicy":{ - "description":"Image pullPolicy to use for deploying.", - "type":"string", - "pattern":"^(Always|Never|IfNotPresent)$" - }, - "repository":{ - "description":"Image to use for deploying", - "type":"string", - "pattern":"^[a-z0-9-_/]+$" - }, - "tag":{ - "description":"Image tag to use for deploying.", - "type":"string", - "pattern":"^[a-z0-9-_.]+$" - } - } - }, - "replicas":{ - "description":"Service replica number.", - "type":"integer" - }, - "resources":{ - "description":"Resource specs.", - "type":"object", - "properties":{ - "limits":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU limit.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory limit.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - }, - "requests":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU request.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory request.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - } - } - } - } - } - } - }, - "else":true - }, - "auth-server-key-rotation-enabled":{ - "if":{ - "properties":{ - "global":{ - "properties":{ - "auth-server-key-rotation":{ - "properties":{ - "enabled":{ - "const":"true" - } - } - } - } - } - } - }, - "then":{ - "properties":{ - "auth-server-key-rotation":{ - "properties":{ - "usrEnvs":{ - "description":"Add custom normal and secret envs to the service", - "type":"object", - "properties":{ - "normal":{ - "description":"Add custom normal envs to the service", - "type":"object" - }, - "secret":{ - "description":"Add custom secret envs to the service", - "type":"object" - } - } - }, - "dnsPolicy":{ - "description":"Add custom dns policy", - "type":"string", - "pattern":"^(Default|ClusterFirst|ClusterFirstWithHostNet|None|)$" - }, - "dnsConfig":{ - "description":"Add custom dns config", - "type":"object" - }, - "image":{ - "type":"object", - "properties":{ - "pullPolicy":{ - "description":"Image pullPolicy to use for deploying.", - "type":"string", - "pattern":"^(Always|Never|IfNotPresent)$" - }, - "repository":{ - "description":"Image to use for deploying", - "type":"string", - "pattern":"^[a-z0-9-_/]+$" - }, - "tag":{ - "description":"Image tag to use for deploying.", - "type":"string", - "pattern":"^[a-z0-9-_.]+$" - } - } - }, - "keysLife":{ - "description":"Auth server key rotation keys life in hours", - "type":"integer" - }, - "resources":{ - "description":"Resource specs.", - "type":"object", - "properties":{ - "limits":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU limit.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory limit.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - }, - "requests":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU request.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory request.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - } - } - } - }, - "required":[ - "image", - "resources", - "keysLife" - ] - } - } - }, - "else":true - }, - "casa-enabled":{ - "if":{ - "properties":{ - "global":{ - "properties":{ - "casa":{ - "properties":{ - "enabled":{ - "const":"true" - } - } - } - } - } - } - }, - "then":{ - "properties":{ - "casa":{ - "required":[ - "image", - "replicas", - "resources" - ], - "properties":{ - "hpa":{ - "description":"Configure the HorizontalPodAutoscaler", - "type":"object", - "properties":{ - "enabled":{ - "type":"boolean" - }, - "minReplicas":{ - "type":"integer" - }, - "maxReplicas":{ - "type":"integer" - }, - "targetCPUUtilizationPercentage":{ - "type":"integer" - }, - "metrics":{ - "description":"metrics if targetCPUUtilizationPercentage is not set", - "type":"array" - }, - "behavior":{ - "description":"Scaling Policies", - "type":"object" - } - } - }, - "usrEnvs":{ - "description":"Add custom normal and secret envs to the service", - "type":"object", - "properties":{ - "normal":{ - "description":"Add custom normal envs to the service", - "type":"object" - }, - "secret":{ - "description":"Add custom secret envs to the service", - "type":"object" - } - } - }, - "dnsPolicy":{ - "description":"Add custom dns policy", - "type":"string", - "pattern":"^(Default|ClusterFirst|ClusterFirstWithHostNet|None|)$" - }, - "dnsConfig":{ - "description":"Add custom dns config", - "type":"object" - }, - "image":{ - "type":"object", - "properties":{ - "pullPolicy":{ - "description":"Image pullPolicy to use for deploying.", - "type":"string", - "pattern":"^(Always|Never|IfNotPresent)$" - }, - "repository":{ - "description":"Image to use for deploying", - "type":"string", - "pattern":"^[a-z0-9-_/]+$" - }, - "tag":{ - "description":"Image tag to use for deploying.", - "type":"string", - "pattern":"^[a-z0-9-_.]+$" - } - } - }, - "replicas":{ - "description":"Service replica number.", - "type":"integer" - }, - "resources":{ - "description":"Resource specs.", - "type":"object", - "properties":{ - "limits":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU limit.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory limit.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - }, - "requests":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU request.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory request.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - } - } - } - } - } - } - }, - "else":true - }, - "config-api-enabled":{ - "if":{ - "properties":{ - "global":{ - "properties":{ - "config-api":{ - "properties":{ - "enabled":{ - "const":"true" - } - } - } - } - } - } - }, - "then":{ - "properties":{ - "config-api":{ - "required":[ - "image", - "replicas", - "resources" - ], - "type":"object", - "properties":{ - "hpa":{ - "description":"Configure the HorizontalPodAutoscaler", - "type":"object", - "properties":{ - "enabled":{ - "type":"boolean" - }, - "minReplicas":{ - "type":"integer" - }, - "maxReplicas":{ - "type":"integer" - }, - "targetCPUUtilizationPercentage":{ - "type":"integer" - }, - "metrics":{ - "description":"metrics if targetCPUUtilizationPercentage is not set", - "type":"array" - }, - "behavior":{ - "description":"Scaling Policies", - "type":"object" - } - } - }, - "usrEnvs":{ - "description":"Add custom normal and secret envs to the service", - "type":"object", - "properties":{ - "normal":{ - "description":"Add custom normal envs to the service", - "type":"object" - }, - "secret":{ - "description":"Add custom secret envs to the service", - "type":"object" - } - } - }, - "dnsPolicy":{ - "description":"Add custom dns policy", - "type":"string", - "pattern":"^(Default|ClusterFirst|ClusterFirstWithHostNet|None|)$" - }, - "dnsConfig":{ - "description":"Add custom dns config", - "type":"object" - }, - "image":{ - "type":"object", - "properties":{ - "pullPolicy":{ - "description":"Image pullPolicy to use for deploying.", - "type":"string", - "pattern":"^(Always|Never|IfNotPresent)$" - }, - "repository":{ - "description":"Image to use for deploying", - "type":"string", - "pattern":"^[a-z0-9-_/]+$" - }, - "tag":{ - "description":"Image tag to use for deploying.", - "type":"string", - "pattern":"^[a-z0-9-_.]+$" - } - } - }, - "replicas":{ - "description":"Service replica number.", - "type":"integer" - }, - "resources":{ - "description":"Resource specs.", - "type":"object", - "properties":{ - "limits":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU limit.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory limit.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - }, - "requests":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU request.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory request.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - } - } - } - } - } - } - }, - "else":true - }, - "fido2-enabled":{ - "if":{ - "properties":{ - "global":{ - "properties":{ - "fido2":{ - "properties":{ - "enabled":{ - "const":"true" - } - } - } - } - } - } - }, - "then":{ - "properties":{ - "fido2":{ - "required":[ - "image", - "replicas", - "resources", - "service" - ], - "type":"object", - "properties":{ - "dnsPolicy":{ - "description":"Add custom dns policy", - "type":"string", - "pattern":"^(Default|ClusterFirst|ClusterFirstWithHostNet|None|)$" - }, - "dnsConfig":{ - "description":"Add custom dns config", - "type":"object" - }, - "image":{ - "type":"object", - "properties":{ - "pullPolicy":{ - "description":"Image pullPolicy to use for deploying.", - "type":"string", - "pattern":"^(Always|Never|IfNotPresent)$" - }, - "repository":{ - "description":"Image to use for deploying", - "type":"string", - "pattern":"^[a-z0-9-_/]+$" - }, - "tag":{ - "description":"Image tag to use for deploying.", - "type":"string", - "pattern":"^[a-z0-9-_.]+$" - } - } - }, - "replicas":{ - "description":"Service replica number.", - "type":"integer" - }, - "resources":{ - "description":"Resource specs.", - "type":"object", - "properties":{ - "limits":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU limit.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory limit.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - }, - "requests":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU request.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory request.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - } - } - }, - "service":{ - "type":"object", - "properties":{ - "fido2ServiceName":{ - "description":"Name of the Fido2 service. Please keep it as default.", - "type":"string", - "pattern":"^[a-z0-9-]+$" - } - } - } - } - } - } - }, - "else":true - }, - "nginx-ingress-enabled":{ - "if":{ - "properties":{ - "global":{ - "properties":{ - "nginx-ingress":{ - "properties":{ - "enabled":{ - "const":"true" - } - } - } - } - } - } - }, - "then":{ - "properties":{ - "nginx-ingress":{ - "type":"object", - "properties":{ - "ingress":{ - "type":"object", - "required":[ - "additionalAnnotations", - "path", - "hosts", - "tls" - ], - "properties":{ - "adminUiLabels":{ - "description":"Admin UI ingress resource labels. key app is taken.", - "type":"object" - }, - "openidConfigLabels":{ - "description":"openid-configuration ingress resource labels. key app is taken", - "type":"object" - }, - "uma2ConfigLabels":{ - "description":"uma2 config ingress resource labels. key app is taken", - "type":"object" - }, - "webfingerLabels":{ - "description":"webfinger ingress resource labels. key app is taken", - "type":"object" - }, - "webdiscoveryLabels":{ - "description":"webdiscovery ingress resource labels. key app is taken", - "type":"object" - }, - "scimConfigEnabled":{ - "description":"Enable endpoint /.well-known/scim-configuration", - "type":"boolean" - }, - "scimConfigLabels":{ - "description":"SCIM config ingress resource labels. key app is taken", - "type":"object" - }, - "scimLabels":{ - "description":"SCIM ingress resource labels. key app is taken", - "type":"object" - }, - "configApiLabels":{ - "description":"configAPI ingress resource labels. key app is taken", - "type":"object" - }, - "u2fConfigLabels":{ - "description":"u2f ingress resource labels. key app is taken", - "type":"object" - }, - "fido2ConfigLabels":{ - "description":"fido2 ingress resource labels. key app is taken", - "type":"object" - }, - "authServerLabels":{ - "description":"Auth server config ingress resource labels. key app is taken", - "type":"object" - }, - "authServerProtectedTokenLabels":{ - "description":"Auth server protected token ingress resource labels. key app is taken", - "type":"object" - }, - "authServerProtectedRedisterLabels":{ - "description":"Auth server protected token ingress resource labels. key app is taken", - "type":"object" - }, - "additionalAnnotations":{ - "description":"Additional annotations that will be added across all ingress definitions in the format of {cert-manager.io/issuer: \"letsencrypt-prod\"}", - "type":"object" - }, - "hosts":{ - "type":"array", - "items":{ - "$ref":"#/definitions/fqdn-pattern" - } - }, - "path":{ - "type":"string" - }, - "tls":{ - "description":"Secret holding HTTPS CA cert and key.", - "type":"array", - "items":{ - "type":"object", - "properties":{ - "hosts":{ - "type":"array", - "items":{ - "$ref":"#/definitions/fqdn-pattern" - } - }, - "secretName":{ - "type":"string", - "pattern":"^[a-z-]+$" - } - } - } - } - } - } - } - } - } - }, - "else":true - }, - "opendj-enabled":{ - "if":{ - "properties":{ - "global":{ - "properties":{ - "opendj":{ - "properties":{ - "enabled":{ - "const":"true" - } - } - } - } - } - } - }, - "then":{ - "properties":{ - "opendj":{ - "required":[ - "image", - "replicas", - "resources", - "service" - ], - "type":"object", - "properties":{ - "hpa":{ - "description":"Configure the HorizontalPodAutoscaler", - "type":"object", - "properties":{ - "enabled":{ - "type":"boolean" - }, - "minReplicas":{ - "type":"integer" - }, - "maxReplicas":{ - "type":"integer" - }, - "targetCPUUtilizationPercentage":{ - "type":"integer" - }, - "metrics":{ - "description":"metrics if targetCPUUtilizationPercentage is not set", - "type":"array" - }, - "behavior":{ - "description":"Scaling Policies", - "type":"object" - } - } - }, - "usrEnvs":{ - "description":"Add custom normal and secret envs to the service", - "type":"object", - "properties":{ - "normal":{ - "description":"Add custom normal envs to the service", - "type":"object" - }, - "secret":{ - "description":"Add custom secret envs to the service", - "type":"object" - } - } - }, - "dnsPolicy":{ - "description":"Add custom dns policy", - "type":"string", - "pattern":"^(Default|ClusterFirst|ClusterFirstWithHostNet|None|)$" - }, - "dnsConfig":{ - "description":"Add custom dns config", - "type":"object" - }, - "image":{ - "type":"object", - "properties":{ - "pullPolicy":{ - "description":"Image pullPolicy to use for deploying.", - "type":"string", - "pattern":"^(Always|Never|IfNotPresent)$" - }, - "repository":{ - "description":"Image to use for deploying", - "type":"string", - "pattern":"^[a-z0-9-_/]+$" - }, - "tag":{ - "description":"Image tag to use for deploying.", - "type":"string", - "pattern":"^[a-z0-9-_.]+$" - } - } - }, - "persistence":{ - "type":"object", - "properties":{ - "size":{ - "description":"OpenDJ volume size", - "type":"string", - "pattern":"^[0-9]Gi+$" - } - } - }, - "ports":{ - "type":"object", - "properties":{ - "tcp-admin":{ - "type":"object", - "properties":{ - "nodePort":{ - "type":"string" - }, - "port":{ - "type":"integer" - }, - "protocol":{ - "type":"string" - }, - "targetPort":{ - "type":"integer" - } - } - }, - "tcp-ldap":{ - "type":"object", - "properties":{ - "nodePort":{ - "type":"string" - }, - "port":{ - "type":"integer" - }, - "protocol":{ - "type":"string" - }, - "targetPort":{ - "type":"integer" - } - } - }, - "tcp-ldaps":{ - "type":"object", - "properties":{ - "nodePort":{ - "type":"string" - }, - "port":{ - "type":"integer" - }, - "protocol":{ - "type":"string" - }, - "targetPort":{ - "type":"integer" - } - } - }, - "tcp-repl":{ - "type":"object", - "properties":{ - "nodePort":{ - "type":"string" - }, - "port":{ - "type":"integer" - }, - "protocol":{ - "type":"string" - }, - "targetPort":{ - "type":"integer" - } - } - }, - "tcp-serf":{ - "type":"object", - "properties":{ - "nodePort":{ - "type":"string" - }, - "port":{ - "type":"integer" - }, - "protocol":{ - "type":"string" - }, - "targetPort":{ - "type":"integer" - } - } - }, - "udp-serf":{ - "type":"object", - "properties":{ - "nodePort":{ - "type":"string" - }, - "port":{ - "type":"integer" - }, - "protocol":{ - "type":"string" - }, - "targetPort":{ - "type":"integer" - } - } - } - } - }, - "replicas":{ - "description":"Service replica number.", - "type":"integer" - }, - "resources":{ - "description":"Resource specs.", - "type":"object", - "properties":{ - "limits":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU limit.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory limit.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - }, - "requests":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU request.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory request.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - } - } - } - } - } - } - }, - "else":true - }, - "oxpassport-enabled":{ - "if":{ - "properties":{ - "global":{ - "properties":{ - "oxpassport":{ - "properties":{ - "enabled":{ - "const":"true" - } - } - } - } - } - } - }, - "then":{ - "properties":{ - "oxpassport":{ - "required":[ - "image", - "replicas", - "resources", - "service" - ], - "type":"object", - "properties":{ - "hpa":{ - "description":"Configure the HorizontalPodAutoscaler", - "type":"object", - "properties":{ - "enabled":{ - "type":"boolean" - }, - "minReplicas":{ - "type":"integer" - }, - "maxReplicas":{ - "type":"integer" - }, - "targetCPUUtilizationPercentage":{ - "type":"integer" - }, - "metrics":{ - "description":"metrics if targetCPUUtilizationPercentage is not set", - "type":"array" - }, - "behavior":{ - "description":"Scaling Policies", - "type":"object" - } - } - }, - "usrEnvs":{ - "description":"Add custom normal and secret envs to the service", - "type":"object", - "properties":{ - "normal":{ - "description":"Add custom normal envs to the service", - "type":"object" - }, - "secret":{ - "description":"Add custom secret envs to the service", - "type":"object" - } - } - }, - "dnsPolicy":{ - "description":"Add custom dns policy", - "type":"string", - "pattern":"^(Default|ClusterFirst|ClusterFirstWithHostNet|None|)$" - }, - "dnsConfig":{ - "description":"Add custom dns config", - "type":"object" - }, - "image":{ - "type":"object", - "properties":{ - "pullPolicy":{ - "description":"Image pullPolicy to use for deploying.", - "type":"string", - "pattern":"^(Always|Never|IfNotPresent)$" - }, - "repository":{ - "description":"Image to use for deploying", - "type":"string", - "pattern":"^[a-z0-9-_/]+$" - }, - "tag":{ - "description":"Image tag to use for deploying.", - "type":"string", - "pattern":"^[a-z0-9-_.]+$" - } - } - }, - "replicas":{ - "description":"Service replica number.", - "type":"integer" - }, - "resources":{ - "description":"Resource specs.", - "type":"object", - "properties":{ - "limits":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU limit.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory limit.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - }, - "requests":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU request.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory request.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - } - } - }, - "service":{ - "type":"object", - "properties":{ - "oxPassportServiceName":{ - "description":"Name of the oxPassport service. Please keep it as default.", - "type":"string", - "pattern":"^[a-z0-9-]+$" - } - } - } - } - } - } - }, - "else":true - }, - "oxshibboleth-enabled":{ - "if":{ - "properties":{ - "global":{ - "properties":{ - "oxshibboleth":{ - "properties":{ - "enabled":{ - "const":"true" - } - } - } - } - } - } - }, - "then":{ - "properties":{ - "oxshibboleth":{ - "required":[ - "image", - "replicas", - "resources", - "service" - ], - "type":"object", - "properties":{ - "hpa":{ - "description":"Configure the HorizontalPodAutoscaler", - "type":"object", - "properties":{ - "enabled":{ - "type":"boolean" - }, - "minReplicas":{ - "type":"integer" - }, - "maxReplicas":{ - "type":"integer" - }, - "targetCPUUtilizationPercentage":{ - "type":"integer" - }, - "metrics":{ - "description":"metrics if targetCPUUtilizationPercentage is not set", - "type":"array" - }, - "behavior":{ - "description":"Scaling Policies", - "type":"object" - } - } - }, - "usrEnvs":{ - "description":"Add custom normal and secret envs to the service", - "type":"object", - "properties":{ - "normal":{ - "description":"Add custom normal envs to the service", - "type":"object" - }, - "secret":{ - "description":"Add custom secret envs to the service", - "type":"object" - } - } - }, - "dnsPolicy":{ - "description":"Add custom dns policy", - "type":"string", - "pattern":"^(Default|ClusterFirst|ClusterFirstWithHostNet|None|)$" - }, - "dnsConfig":{ - "description":"Add custom dns config", - "type":"object" - }, - "image":{ - "type":"object", - "properties":{ - "pullPolicy":{ - "description":"Image pullPolicy to use for deploying.", - "type":"string", - "pattern":"^(Always|Never|IfNotPresent)$" - }, - "repository":{ - "description":"Image to use for deploying", - "type":"string", - "pattern":"^[a-z0-9-_/]+$" - }, - "tag":{ - "description":"Image tag to use for deploying.", - "type":"string", - "pattern":"^[a-z0-9-_.]+$" - } - } - }, - "replicas":{ - "description":"Service replica number.", - "type":"integer" - }, - "resources":{ - "description":"Resource specs.", - "type":"object", - "properties":{ - "limits":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU limit.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory limit.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - }, - "requests":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU request.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory request.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - } - } - }, - "service":{ - "type":"object", - "properties":{ - "oxShibbolethServiceName":{ - "description":"Name of the oxShibboleth service. Please keep it as default.", - "type":"string", - "pattern":"^[a-z0-9-]+$" - } - } - } - } - } - } - }, - "else":true - }, - "persistence-enabled":{ - "if":{ - "properties":{ - "global":{ - "properties":{ - "persistence":{ - "properties":{ - "enabled":{ - "const":"true" - } - } - } - } - } - } - }, - "then":{ - "properties":{ - "persistence":{ - "required":[ - "image", - "resources" - ], - "type":"object", - "properties":{ - "usrEnvs":{ - "description":"Add custom normal and secret envs to the service", - "type":"object", - "properties":{ - "normal":{ - "description":"Add custom normal envs to the service", - "type":"object" - }, - "secret":{ - "description":"Add custom secret envs to the service", - "type":"object" - } - } - }, - "dnsPolicy":{ - "description":"Add custom dns policy", - "type":"string", - "pattern":"^(Default|ClusterFirst|ClusterFirstWithHostNet|None|)$" - }, - "dnsConfig":{ - "description":"Add custom dns config", - "type":"object" - }, - "image":{ - "type":"object", - "properties":{ - "pullPolicy":{ - "description":"Image pullPolicy to use for deploying.", - "type":"string", - "pattern":"^(Always|Never|IfNotPresent)$" - }, - "repository":{ - "description":"Image to use for deploying", - "type":"string", - "pattern":"^[a-z0-9-_/]+$" - }, - "tag":{ - "description":"Image tag to use for deploying.", - "type":"string", - "pattern":"^[a-z0-9-_.]+$" - } - } - }, - "resources":{ - "description":"Resource specs.", - "type":"object", - "properties":{ - "limits":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU limit.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory limit.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - }, - "requests":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU request.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory request.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - } - } - } - } - } - } - }, - "else":true - }, - "scim-enabled":{ - "if":{ - "properties":{ - "global":{ - "properties":{ - "scim":{ - "properties":{ - "enabled":{ - "const":"true" - } - } - } - } - } - } - }, - "then":{ - "properties":{ - "scim":{ - "required":[ - "image", - "replicas", - "resources", - "service" - ], - "type":"object", - "properties":{ - "hpa":{ - "description":"Configure the HorizontalPodAutoscaler", - "type":"object", - "properties":{ - "enabled":{ - "type":"boolean" - }, - "minReplicas":{ - "type":"integer" - }, - "maxReplicas":{ - "type":"integer" - }, - "targetCPUUtilizationPercentage":{ - "type":"integer" - }, - "metrics":{ - "description":"metrics if targetCPUUtilizationPercentage is not set", - "type":"array" - }, - "behavior":{ - "description":"Scaling Policies", - "type":"object" - } - } - }, - "usrEnvs":{ - "description":"Add custom normal and secret envs to the service", - "type":"object", - "properties":{ - "normal":{ - "description":"Add custom normal envs to the service", - "type":"object" - }, - "secret":{ - "description":"Add custom secret envs to the service", - "type":"object" - } - } - }, - "dnsPolicy":{ - "description":"Add custom dns policy", - "type":"string", - "pattern":"^(Default|ClusterFirst|ClusterFirstWithHostNet|None|)$" - }, - "dnsConfig":{ - "description":"Add custom dns config", - "type":"object" - }, - "image":{ - "type":"object", - "properties":{ - "pullPolicy":{ - "description":"Image pullPolicy to use for deploying.", - "type":"string", - "pattern":"^(Always|Never|IfNotPresent)$" - }, - "repository":{ - "description":"Image to use for deploying", - "type":"string", - "pattern":"^[a-z0-9-_/]+$" - }, - "tag":{ - "description":"Image tag to use for deploying.", - "type":"string", - "pattern":"^[a-z0-9-_.]+$" - } - } - }, - "replicas":{ - "description":"Service replica number.", - "type":"integer" - }, - "resources":{ - "description":"Resource specs.", - "type":"object", - "properties":{ - "limits":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU limit.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory limit.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - }, - "requests":{ - "type":"object", - "properties":{ - "cpu":{ - "description":"CPU request.", - "type":"string", - "pattern":"^[0-9m]+$" - }, - "memory":{ - "description":"Memory request.", - "type":"string", - "pattern":"^[0-9Mi]+$" - } - } - } - } - }, - "service":{ - "type":"object", - "properties":{ - "scimServiceName":{ - "description":"Name of the SCIM service. Please keep it as default.", - "type":"string", - "pattern":"^[a-z0-9-]+$" - } - } - } - } - } - } - }, - "else":true - } - } -} \ No newline at end of file diff --git a/charts/gluu/gluu/values.yaml b/charts/gluu/gluu/values.yaml deleted file mode 100644 index 561513c64..000000000 --- a/charts/gluu/gluu/values.yaml +++ /dev/null @@ -1,1675 +0,0 @@ -# -- Only used by the installer. These settings do not affect nor are used by the chart -installer-settings: - currentVersion: "" - acceptLicense: "" - namespace: "" - releaseName: "" - nginxIngress: - releaseName: "" - namespace: "" - nodes: - names: "" - zones: "" - ips: "" - images: - edit: "" - aws: - lbType: "" - arn: - enabled: "" - arnAcmCert: "" - vpcCidr: "0.0.0.0/0" - couchbase: - clusterName: "" - namespace: "" - lowResourceInstall: "" - install: "" - customFileOverride: "" - backup: - incrementalSchedule: "" - fullSchedule: "" - retentionTime: "" - storageSize: "" - # Couchbase cert related keys - subjectAlternativeName: "" - commonName: "" - # Couchbase cluster yaml generator keys - totalNumberOfExpectedUsers: "" - totalNumberOfExpectedTransactionsPerSec: "" - volumeType: "" - volumeProvisionStrategy: "" - ldap: - backup: - fullSchedule: "" - postgres: - install: "" - namespace: "" - sql: - install: "" - namespace: "" - google: - useSecretManager: "" - redis: - install: "" - namespace: "" - openbanking: - hasCnObTransportTrustStore: false - cnObTransportTrustStoreP12password: "" - confirmSettings: false - -# -- Admin GUI for configuration of the auth-server -admin-ui: - # -- Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API - # https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ - topologySpreadConstraints: {} - # -- Define below as many constraints as needed. The key name should follow the structure tsc1, tsc2...etc. - # Do not enter the key labelSelector in the entry/entries below as that is automatically injected by the chart - #tsc1: - # maxSkew: 1 - # minDomains: 1 # optional; beta since v1.25 - # topologyKey: kubernetes.io/hostname - # whenUnsatisfiable: DoNotSchedule - # matchLabelKeys: [] # optional; alpha since v1.25 - # nodeAffinityPolicy: [] # optional; alpha since v1.25 - # nodeTaintsPolicy: [] # optional; alpha since v1.25 - #tsc2: - #maxSkew: 1 - # -- Configure the PodDisruptionBudget - pdb: - enabled: true - maxUnavailable: "90%" - # -- Configure the HorizontalPodAutoscaler - hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} - # -- Add custom normal and secret envs to the service - usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: gluufederation/admin-ui - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] - # -- Service replica number. - replicas: 1 - # -- Resource specs. - resources: - limits: - # -- CPU limit. - cpu: 2000m - # -- Memory limit. - memory: 2000Mi - requests: - # -- CPU request. - cpu: 2000m - # -- Memory request. - memory: 2000Mi - # -- Configure the liveness healthcheck for the admin ui if needed. - livenessProbe: - tcpSocket: - port: 8080 - initialDelaySeconds: 60 - timeoutSeconds: 5 - periodSeconds: 25 - failureThreshold: 20 - # -- Configure the readiness healthcheck for the admin ui if needed. - readinessProbe: - tcpSocket: - port: 8080 - initialDelaySeconds: 60 - timeoutSeconds: 5 - periodSeconds: 25 - failureThreshold: 20 - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } -# -- OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Gluu. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing. -auth-server: - # -- Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API - # https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ - topologySpreadConstraints: {} - # -- Define below as many constraints as needed. The key name should follow the structure tsc1, tsc2...etc. - # Do not enter the key labelSelector in the entry/entries below as that is automatically injected by the chart - #tsc1: - # maxSkew: 1 - # minDomains: 1 # optional; beta since v1.25 - # topologyKey: kubernetes.io/hostname - # whenUnsatisfiable: DoNotSchedule - # matchLabelKeys: [] # optional; alpha since v1.25 - # nodeAffinityPolicy: [] # optional; alpha since v1.25 - # nodeTaintsPolicy: [] # optional; alpha since v1.25 - #tsc2: - #maxSkew: 1 - # -- Configure the PodDisruptionBudget - pdb: - enabled: true - maxUnavailable: "90%" - # -- Configure the HorizontalPodAutoscaler - hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} - # -- Add custom normal and secret envs to the service - usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: janssenproject/auth-server - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] - # -- Service replica number. - replicas: 1 - # -- Resource specs. - resources: - limits: - # -- CPU limit. - cpu: 2500m - # -- Memory limit. - memory: 2500Mi - requests: - # -- CPU request. - cpu: 2500m - # -- Memory request. - memory: 2500Mi - # -- Configure the liveness healthcheck for the auth server if needed. - livenessProbe: - # -- Executes the python3 healthcheck. - # https://github.com/JanssenProject/docker-jans-auth-server/blob/master/scripts/healthcheck.py - exec: - command: - - python3 - - /app/scripts/healthcheck.py - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - # -- Configure the readiness healthcheck for the auth server if needed. - # https://github.com/JanssenProject/docker-jans-auth-server/blob/master/scripts/healthcheck.py - readinessProbe: - exec: - command: - - python3 - - /app/scripts/healthcheck.py - initialDelaySeconds: 25 - periodSeconds: 25 - timeoutSeconds: 5 - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } -# -- Responsible for regenerating auth-keys per x hours -auth-server-key-rotation: - # -- Add custom normal and secret envs to the service - usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: janssenproject/certmanager - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] - # -- Auth server key rotation keys life in hours - keysLife: 48 - # -- Resource specs. - resources: - limits: - # -- CPU limit. - cpu: 300m - # -- Memory limit. - memory: 300Mi - requests: - # -- CPU request. - cpu: 300m - # -- Memory request. - memory: 300Mi - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } -# -- Gluu Casa ("Casa") is a self-service web portal for end-users to manage authentication and authorization preferences for their account in a Gluu Server. -casa: - # -- Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API - # https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ - topologySpreadConstraints: {} - # -- Define below as many constraints as needed. The key name should follow the structure tsc1, tsc2...etc. - # Do not enter the key labelSelector in the entry/entries below as that is automatically injected by the chart - #tsc1: - # maxSkew: 1 - # minDomains: 1 # optional; beta since v1.25 - # topologyKey: kubernetes.io/hostname - # whenUnsatisfiable: DoNotSchedule - # matchLabelKeys: [] # optional; alpha since v1.25 - # nodeAffinityPolicy: [] # optional; alpha since v1.25 - # nodeTaintsPolicy: [] # optional; alpha since v1.25 - #tsc2: - #maxSkew: 1 - # -- Configure the PodDisruptionBudget - pdb: - enabled: true - maxUnavailable: "90%" - # -- Configure the HorizontalPodAutoscaler - hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} - # -- Add custom normal and secret envs to the service - usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: gluufederation/casa - # -- Image tag to use for deploying. - tag: 5.0.0-4 - # -- Image Pull Secrets - pullSecrets: [ ] - # -- Service replica number. - replicas: 1 - # -- Resource specs. - resources: - limits: - # -- CPU limit. - cpu: 500m - # -- Memory limit. - memory: 500Mi - requests: - # -- CPU request. - cpu: 500m - # -- Memory request. - memory: 500Mi - # -- Configure the liveness healthcheck for casa if needed. - livenessProbe: - httpGet: - # -- http liveness probe endpoint - path: /casa/health-check - port: http-casa - initialDelaySeconds: 25 - periodSeconds: 25 - timeoutSeconds: 5 - # -- Configure the readiness healthcheck for the casa if needed. - readinessProbe: - httpGet: - # -- http readiness probe endpoint - path: /casa/health-check - port: http-casa - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } -# -- Configuration parameters for setup and initial configuration secret and config layers used by Gluu services. -config: - # -- Add custom normal and secret envs to the service. - usrEnvs: - # -- Add custom normal envs to the service. - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service. - # variable1: value1 - secret: {} - # -- Admin password to log in to the UI. - adminPassword: Test1234# - # -- City. Used for certificate creation. - city: Austin - configmap: - # -- Jetty header size in bytes in the auth server - cnJettyRequestHeaderSize: 8192 - # -- Schema name used by SQL database (default to empty-string; if using MySQL, the schema name will be resolved as the database name, whereas in PostgreSQL the schema name will be resolved as `"public"`). - cnSqlDbSchema: "" - # -- SQL database dialect. `mysql` or `pgsql` - cnSqlDbDialect: mysql - # -- SQL database host uri. - cnSqlDbHost: my-release-mysql.default.svc.cluster.local - # -- SQL database port. - cnSqlDbPort: 3306 - # -- SQL database name. - cnSqlDbName: gluu - # -- SQL database username. - cnSqlDbUser: gluu - # -- SQL database timezone. - cnSqlDbTimezone: UTC - # -- SQL password injected the secrets . - cnSqldbUserPassword: Test1234# - # -- Cache type. `NATIVE_PERSISTENCE`, `REDIS`. or `IN_MEMORY`. Defaults to `NATIVE_PERSISTENCE` . - cnCacheType: NATIVE_PERSISTENCE - # -- The name of the Kubernetes ConfigMap that will hold the configuration layer - cnConfigKubernetesConfigMap: cn - # -- The prefix of couchbase buckets. This helps with separation in between different environments and allows for the same couchbase cluster to be used by different setups of Gluu. - cnCouchbaseBucketPrefix: jans - # -- Couchbase certificate authority string. This must be encoded using base64. This can also be found in your couchbase UI Security > Root Certificate. In mTLS setups this is not required. - cnCouchbaseCrt: SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo= - # -- The number of replicas per index created. Please note that the number of index nodes must be one greater than the number of index replicas. That means if your couchbase cluster only has 2 index nodes you cannot place the number of replicas to be higher than 1. - cnCouchbaseIndexNumReplica: 0 - # -- Couchbase password for the restricted user config.configmap.cnCouchbaseUser that is often used inside the services. The password must contain one digit, one uppercase letter, one lower case letter and one symbol . - cnCouchbasePassword: P@ssw0rd - # -- The Couchbase super user (admin) username. This user is used during initialization only. - cnCouchbaseSuperUser: admin - # -- Couchbase password for the superuser config.configmap.cnCouchbaseSuperUser that is used during the initialization process. The password must contain one digit, one uppercase letter, one lower case letter and one symbol - cnCouchbaseSuperUserPassword: Test1234# - # -- Couchbase URL. Used only when global.cnPersistenceType is hybrid or couchbase. This should be in FQDN format for either remote or local Couchbase clusters. The address can be an internal address inside the kubernetes cluster - cnCouchbaseUrl: cbgluu.default.svc.cluster.local - # -- Couchbase restricted user. Used only when global.cnPersistenceType is hybrid or couchbase. - cnCouchbaseUser: gluu - # [google_envs] Envs related to using Google - # -- Service account with roles roles/secretmanager.admin base64 encoded string. This is used often inside the services to reach the configuration layer. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnGoogleSecretManagerServiceAccount: SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo= - # -- Project id of the Google project the secret manager belongs to. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnGoogleProjectId: google-project-to-save-config-and-secrets-to - # [google_spanner_envs] Envs related to using Google Secret Manager to store config and secret layer - # -- Google Spanner ID. Used only when global.cnPersistenceType is spanner. - cnGoogleSpannerInstanceId: "" - # -- Google Spanner Database ID. Used only when global.cnPersistenceType is spanner. - cnGoogleSpannerDatabaseId: "" - # [google_spanner_envs] END - # [google_secret_manager_envs] Envs related to using Google Secret Manager to store config and secret layer - # -- Secret version to be used for secret configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnSecretGoogleSecretVersionId: "latest" - # -- Prefix for Gluu secret in Google Secret Manager. Defaults to gluu. If left gluu-secret secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnSecretGoogleSecretNamePrefix: gluu - # -- Passphrase for Gluu secret in Google Secret Manager. This is used for encrypting and decrypting data from the Google Secret Manager. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnGoogleSecretManagerPassPhrase: Test1234# - # -- Secret version to be used for configuration. Defaults to latest and should normally always stay that way. Used only when global.configAdapterName and global.configSecretAdapter is set to google. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnConfigGoogleSecretVersionId: "latest" - # -- Prefix for Gluu configuration secret in Google Secret Manager. Defaults to gluu. If left intact gluu-configuration secret will be created. Used only when global.configAdapterName and global.configSecretAdapter is set to google. - cnConfigGoogleSecretNamePrefix: gluu - # [google_secret_manager_envs] END - # [google_envs] END - # [aws_envs] Envs related to using AWS - # [aws_secret_manager_envs] - # AWS Access key id that belong to a user/id with SecretsManagerReadWrite policy - cnAwsAccessKeyId: "" - # AWS Secret Access key that belong to a user/id with SecretsManagerReadWrite policy - cnAwsSecretAccessKey: "" - # The URL of AWS secretsmanager service (if omitted, will use the one in specified region). Used only when global.configAdapterName and global.configSecretAdapter is set to aws. - cnAwsSecretsEndpointUrl: "" - # The prefix name of the secrets. Used only when global.configAdapterName and global.configSecretAdapter is set to aws. - cnAwsSecretsNamePrefix: gluu - # The default AWS Region to use, for example, `us-west-1` or `us-west-2`. - cnAwsDefaultRegion: us-west-1 - # The default profile to use. - cnAwsProfile: "gluu" - # Example replicated region [{"Region": "us-west-1"}, {"Region": "us-west-2"}] - cnAwsSecretsReplicaRegions: [] - # [aws_secret_manager_envs] END - # [aws_envs] END - # -- OpenDJ internal address. Leave as default. Used when `global.cnPersistenceType` is set to `ldap`. - cnLdapUrl: "opendj:1636" - # -- Value passed to Java option -XX:MaxRAMPercentage - cnMaxRamPercent: "75.0" - # -- SCIM protection mode OAUTH|TEST|UMA - cnScimProtectionMode: "OAUTH" - # -- Specify data that should be saved in LDAP (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType` is set to `hybrid`. - #{ - # "default": "", - # "user": "", - # "site": "", - # "cache": "", - # "token": "", - # "session": "", - #} - cnPersistenceHybridMapping: "{}" - # -- Redis Sentinel Group. Often set when `config.configmap.cnRedisType` is set to `SENTINEL`. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. - cnRedisSentinelGroup: "" - # -- Redis SSL truststore. Optional. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. - cnRedisSslTruststore: "" - # -- Redis service type. `STANDALONE` or `CLUSTER`. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. - cnRedisType: STANDALONE - # -- Redis URL and port number :. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. - cnRedisUrl: "redis.redis.svc.cluster.local:6379" - # -- Boolean to use SSL in Redis. Can be used when `config.configmap.cnCacheType` is set to `REDIS`. - cnRedisUseSsl: false - # -- Kubernetes secret name holding configuration keys. Used when global.configSecretAdapter is set to kubernetes which is the default. - cnSecretKubernetesSecret: cn - # -- Load balancer address for AWS if the FQDN is not registered. - lbAddr: "" - # -- Country code. Used for certificate creation. - countryCode: US - # -- Email address of the administrator usually. Used for certificate creation. - email: support@gluu.org - image: - # -- Image to use for deploying. - repository: janssenproject/configurator - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] - # -- LDAP admin password if OpenDJ is used for persistence. - ldapPassword: P@ssw0rds - # -- Organization name. Used for certificate creation. - orgName: Gluu - # -- Redis admin password if `config.configmap.cnCacheType` is set to `REDIS`. - redisPassword: P@assw0rd - # -- Resource specs. - resources: - limits: - # -- CPU limit. - cpu: 300m - # -- Memory limit. - memory: 300Mi - requests: - # -- CPU request. - cpu: 300m - # -- Memory request. - memory: 300Mi - # -- State code. Used for certificate creation. - state: TX - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - # -- CE to CN Migration section - migration: - # -- Boolean flag to enable migration from CE - enabled: false - # -- Directory holding all migration files - migrationDir: /ce-migration - # -- migration data-format depending on persistence backend. - # Supported data formats are ldif, couchbase+json, spanner+avro, postgresql+json, and mysql+json. - migrationDataFormat: ldif - - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } -# -- Config Api endpoints can be used to configure the auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS). -config-api: - # -- Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API - # https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ - topologySpreadConstraints: {} - # -- Define below as many constraints as needed. The key name should follow the structure tsc1, tsc2...etc. - # Do not enter the key labelSelector in the entry/entries below as that is automatically injected by the chart - #tsc1: - # maxSkew: 1 - # minDomains: 1 # optional; beta since v1.25 - # topologyKey: kubernetes.io/hostname - # whenUnsatisfiable: DoNotSchedule - # matchLabelKeys: [] # optional; alpha since v1.25 - # nodeAffinityPolicy: [] # optional; alpha since v1.25 - # nodeTaintsPolicy: [] # optional; alpha since v1.25 - #tsc2: - #maxSkew: 1 - # -- Configure the PodDisruptionBudget - pdb: - enabled: true - maxUnavailable: "90%" - # -- Configure the HorizontalPodAutoscaler - hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} - # -- Add custom normal and secret envs to the service - usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: janssenproject/config-api - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] - # -- Service replica number. - replicas: 1 - # -- Resource specs. - resources: - limits: - # -- CPU limit. - cpu: 1000m - # -- Memory limit. - memory: 1000Mi - requests: - # -- CPU request. - cpu: 1000m - # -- Memory request. - memory: 1000Mi - # -- Configure the liveness healthcheck for the auth server if needed. - livenessProbe: - # -- http liveness probe endpoint - httpGet: - path: /jans-config-api/api/v1/health/live - port: 8074 - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - readinessProbe: - # -- http readiness probe endpoint - httpGet: - path: jans-config-api/api/v1/health/ready - port: 8074 - initialDelaySeconds: 25 - periodSeconds: 25 - timeoutSeconds: 5 - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } -# -- FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments. -fido2: - # -- Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API - # https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ - topologySpreadConstraints: {} - # -- Define below as many constraints as needed. The key name should follow the structure tsc1, tsc2...etc. - # Do not enter the key labelSelector in the entry/entries below as that is automatically injected by the chart - #tsc1: - # maxSkew: 1 - # minDomains: 1 # optional; beta since v1.25 - # topologyKey: kubernetes.io/hostname - # whenUnsatisfiable: DoNotSchedule - # matchLabelKeys: [] # optional; alpha since v1.25 - # nodeAffinityPolicy: [] # optional; alpha since v1.25 - # nodeTaintsPolicy: [] # optional; alpha since v1.25 - #tsc2: - #maxSkew: 1 - # -- Configure the PodDisruptionBudget - pdb: - enabled: true - maxUnavailable: "90%" - # -- Configure the HorizontalPodAutoscaler - hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} - # -- Add custom normal and secret envs to the service - usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: janssenproject/fido2 - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] - # -- Service replica number. - replicas: 1 - # -- Resource specs. - resources: - limits: - # -- CPU limit. - cpu: 500m - # -- Memory limit. - memory: 500Mi - requests: - # -- CPU request. - cpu: 500m - # -- Memory request. - memory: 500Mi - service: - # -- The name of the fido2 port within the fido2 service. Please keep it as default. - name: http-fido2 - # -- Port of the fido2 service. Please keep it as default. - port: 8080 - # -- Configure the liveness healthcheck for the fido2 if needed. - livenessProbe: - # -- http liveness probe endpoint - httpGet: - path: /jans-fido2/sys/health-check - port: http-fido2 - initialDelaySeconds: 25 - periodSeconds: 25 - timeoutSeconds: 5 - # -- Configure the readiness healthcheck for the fido2 if needed. - readinessProbe: - httpGet: - path: /jans-fido2/sys/health-check - port: http-fido2 - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } -# -- Parameters used globally across all services helm charts. -global: - # -- Add custom normal and secret envs to the service. - # Envs defined in global.userEnvs will be globally available to all services - usrEnvs: - # -- Add custom normal envs to the service. - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service. - # variable1: value1 - secret: {} - alb: - # -- Activates ALB ingress - ingress: false - - admin-ui: - # -- Boolean flag to enable/disable the admin-ui chart and admin ui config api plugin. - enabled: true - # -- Name of the admin-ui service. Please keep it as default. - adminUiServiceName: admin-ui - ingress: - # -- Enable Admin UI endpoints in either istio or nginx ingress depending on users choice - adminUiEnabled: false - - auth-server: - # -- Name of the auth-server service. Please keep it as default. - authServerServiceName: auth-server - # -- Boolean flag to enable/disable auth-server chart. You should never set this to false. - enabled: true - # -- App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. - appLoggers: - # -- Enable log prefixing which enables prepending the STDOUT logs with the file name. i.e auth-server-script ===> 2022-12-20 17:49:55,744 INFO - enableStdoutLogPrefix: "true" - # -- jans-auth.log target - authLogTarget: "STDOUT" - # -- jans-auth.log level - authLogLevel: "INFO" - # -- http_request_response.log target - httpLogTarget: "FILE" - # -- http_request_response.log level - httpLogLevel: "INFO" - # -- jans-auth_persistence.log target - persistenceLogTarget: "FILE" - # -- jans-auth_persistence.log level - persistenceLogLevel: "INFO" - # -- jans-auth_persistence_duration.log target - persistenceDurationLogTarget: "FILE" - # -- jans-auth_persistence_duration.log level - persistenceDurationLogLevel: "INFO" - # -- jans-auth_persistence_ldap_statistics.log target - ldapStatsLogTarget: "FILE" - # -- jans-auth_persistence_ldap_statistics.log level - ldapStatsLogLevel: "INFO" - # -- jans-auth_script.log target - scriptLogTarget: "FILE" - # -- jans-auth_script.log level - scriptLogLevel: "INFO" - # -- jans-auth_script.log target - auditStatsLogTarget: "FILE" - # -- jans-auth_audit.log level - auditStatsLogLevel: "INFO" - # -- space-separated key algorithm for signing (default to `RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512`) - authSigKeys: "RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512" - # -- space-separated key algorithm for encryption (default to `RSA1_5 RSA-OAEP`) - authEncKeys: "RSA1_5 RSA-OAEP" - # -- Enable endpoints in either istio or nginx ingress depending on users choice - ingress: - # -- Enable Auth server endpoints /jans-auth - authServerEnabled: true - # -- Enable endpoint /.well-known/openid-configuration - openidConfigEnabled: true - # -- Enable endpoint /device-code - deviceCodeEnabled: true - # -- Enable endpoint /firebase-messaging-sw.js - firebaseMessagingEnabled: true - # -- Enable endpoint /.well-known/uma2-configuration - uma2ConfigEnabled: true - # -- Enable endpoint /.well-known/webfinger - webfingerEnabled: true - # -- Enable endpoint /.well-known/simple-web-discovery - webdiscoveryEnabled: true - # -- Enable endpoint /.well-known/fido-configuration - u2fConfigEnabled: true - # -- Enable mTLS on Auth server endpoint /jans-auth/restv1/token. Currently not working in Istio. - authServerProtectedToken: false - # -- Enable mTLS onn Auth server endpoint /jans-auth/restv1/register. Currently not working in Istio. - authServerProtectedRegister: false - auth-server-key-rotation: - # -- Boolean flag to enable/disable the auth-server-key rotation cronjob chart. - enabled: false - # -- Volume storage type if using AWS volumes. - awsStorageType: io1 - # -- Volume storage type if using Azure disks. - azureStorageAccountType: Standard_LRS - # -- Azure storage kind if using Azure disks - azureStorageKind: Managed - casa: - # -- App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. - appLoggers: - # -- Enable log prefixing which enables prepending the STDOUT logs with the file name. i.e casa ===> 2022-12-20 17:49:55,744 INFO - enableStdoutLogPrefix: "true" - # -- casa.log target - casaLogTarget: "STDOUT" - # -- casa.log level - casaLogLevel: "INFO" - # -- casa timer log target - timerLogTarget: "FILE" - # -- casa timer log level - timerLogLevel: "INFO" - # -- Name of the casa service. Please keep it as default. - casaServiceName: casa - # -- Boolean flag to enable/disable the casa chart. - enabled: true - # -- Enable endpoints in either istio or nginx ingress depending on users choice - ingress: - # -- Enable casa endpoints /casa - casaEnabled: false - cloud: - # -- Boolean flag if enabled will strip resources requests and limits from all services. - testEnviroment: false - # -- Port used by Prometheus JMX agent (default to empty string). To enable Prometheus JMX agent, set the value to a number. - cnPrometheusPort: "" - # -- Document store type to use for shibboleth files LOCAL. - cnDocumentStoreType: LOCAL - # -- Persistence backend to run Gluu with ldap|couchbase|hybrid|sql|spanner. - cnPersistenceType: sql - # -- Open banking external signing jwks uri. Used in SSA Validation. - cnObExtSigningJwksUri: "" - # -- Open banking external signing jwks AS certificate authority string. Used in SSA Validation. This must be encoded using base64.. Used when `.global.cnObExtSigningJwksUri` is set. - cnObExtSigningJwksCrt: "" - # -- Open banking external signing jwks AS key string. Used in SSA Validation. This must be encoded using base64. Used when `.global.cnObExtSigningJwksUri` is set. - cnObExtSigningJwksKey: "" - # -- Open banking external signing jwks AS key passphrase to unlock provided key. This must be encoded using base64. Used when `.global.cnObExtSigningJwksUri` is set. - cnObExtSigningJwksKeyPassPhrase: "" - # -- Open banking external signing AS Alias. This is a kid value.Used in SSA Validation, kid used while encoding a JWT sent to token URL i.e. XkwIzWy44xWSlcWnMiEc8iq9s2G - cnObExtSigningAlias: "" - # -- Open banking signing AS kid to force the AS to use a specific signing key. i.e. Wy44xWSlcWnMiEc8iq9s2G - cnObStaticSigningKeyKid: "" - # -- Open banking AS transport crt. Used in SSA Validation. This must be encoded using base64. - cnObTransportCrt: "" - # -- Open banking AS transport key. Used in SSA Validation. This must be encoded using base64. - cnObTransportKey: "" - # -- Open banking AS transport key passphrase to unlock AS transport key. This must be encoded using base64. - cnObTransportKeyPassPhrase: "" - # -- Open banking transport Alias used inside the JVM. - cnObTransportAlias: "" - # -- Open banking AS transport truststore crt. This is normally generated from the OB issuing CA, OB Root CA and Signing CA. Used when .global.cnObExtSigningJwksUri is set. Used in SSA Validation. This must be encoded using base64. - cnObTransportTrustStore: "" - config: - # -- Boolean flag to enable/disable the configuration chart. This normally should never be false - enabled: true - # -- https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/ - jobTtlSecondsAfterFinished: 300 - # -- The config backend adapter that will hold Gluu configuration layer. aws|google|kubernetes - configAdapterName: kubernetes - # -- The config backend adapter that will hold Gluu secret layer. aws|google|kubernetes - configSecretAdapter: kubernetes - # -- Base64 encoded service account. The sa must have roles/secretmanager.admin to use Google secrets and roles/spanner.databaseUser to use Spanner. Leave as this is a sensible default. - cnGoogleApplicationCredentials: /etc/jans/conf/google-credentials.json - # The location of the shared credentials file used by the client (see https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html).Leave as this is a sensible default. - cnAwsSharedCredentialsFile: /etc/jans/conf/aws_shared_credential_file - # The location of the config file used by the client (see https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html). Leave as this is a sensible default. - cnAwsConfigFile: /etc/jans/conf/aws_config_file - # The location of file contains replica regions definition (if any). This file is mostly used in primary region. Example of contents of the file: `[{"Region": "us-west-1"}]`. Used only when global.configAdapterName and global.configSecretAdapter is set to aws. Leave as this is a sensible default. - cnAwsSecretsReplicaRegionsFile: /etc/jans/conf/aws_secrets_replica_regions - config-api: - # -- Name of the config-api service. Please keep it as default. - configApiServerServiceName: config-api - # -- Boolean flag to enable/disable the config-api chart. - enabled: true - # -- App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. - appLoggers: - # -- Enable log prefixing which enables prepending the STDOUT logs with the file name. i.e config-api_persistence ===> 2022-12-20 17:49:55,744 INFO - enableStdoutLogPrefix: "true" - # -- configapi.log target - configApiLogTarget: "STDOUT" - # -- configapi.log level - configApiLogLevel: "INFO" - # -- config-api_persistence.log target - persistenceLogTarget: "FILE" - # -- config-api_persistence.log level - persistenceLogLevel: "INFO" - # -- config-api_persistence_duration.log target - persistenceDurationLogTarget: "FILE" - # -- config-api_persistence_duration.log level - persistenceDurationLogLevel: "INFO" - # -- config-api_persistence_ldap_statistics.log target - ldapStatsLogTarget: "FILE" - # -- config-api_persistence_ldap_statistics.log level - ldapStatsLogLevel: "INFO" - # -- config-api_script.log target - scriptLogTarget: "FILE" - # -- config-api_script.log level - scriptLogLevel: "INFO" - adminUiAppLoggers: - # -- Enable log prefixing which enables prepending the STDOUT logs with the file name. i.e config-api_persistence ===> 2022-12-20 17:49:55,744 INFO - enableStdoutLogPrefix: "true" - # -- config-api admin-ui plugin log level - adminUiLogTarget: "FILE" - # -- config-api admin-ui plugin log target - adminUiLogLevel: "INFO" - # -- config-api admin-ui plugin audit log target - adminUiAuditLogTarget: "FILE" - # -- config-api admin-ui plugin audit log level - adminUiAuditLogLevel: "INFO" - # -- Enable endpoints in either istio or nginx ingress depending on users choice - ingress: - # Enable config API endpoints /jans-config-api - configApiEnabled: true - # -- Fully qualified domain name to be used for Gluu installation. This address will be used to reach Gluu services. - fqdn: demoexample.gluu.org - fido2: - # -- Name of the fido2 service. Please keep it as default. - fido2ServiceName: fido2 - # -- Boolean flag to enable/disable the fido2 chart. - enabled: true - # -- App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. - appLoggers: - # -- Enable log prefixing which enables prepending the STDOUT logs with the file name. i.e fido2 ===> 2022-12-20 17:49:55,744 INFO - enableStdoutLogPrefix: "true" - # -- fido2.log target - fido2LogTarget: "STDOUT" - # -- fido2.log level - fido2LogLevel: "INFO" - # -- fido2_persistence.log target - persistenceLogTarget: "FILE" - # -- fido2_persistence.log level - persistenceLogLevel: "INFO" - # -- Enable endpoints in either istio or nginx ingress depending on users choice - ingress: - # -- Enable endpoint /.well-known/fido2-configuration - fido2ConfigEnabled: false - # -- GCE storage kind if using Google disks - gcePdStorageType: pd-standard - # -- Boolean flag to enable mapping global.lbIp to global.fqdn inside pods on clouds that provide static ip for load balancers. On cloud that provide only addresses to the LB this flag will enable a script to actively scan config.configmap.lbAddr and update the hosts file inside the pods automatically. - isFqdnRegistered: false - istio: - # -- Boolean flag that enables using istio side-cars with Gluu services. - enabled: false - # -- Boolean flag that enables using istio gateway for Gluu. This assumes istio ingress is installed and hence the LB is available. - ingress: false - # -- The namespace istio is deployed in. The is normally istio-system. - namespace: istio-system - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } - # -- Override the gateway that can be created by default. This is used when istio ingress has already been setup and the gateway exists. - gateways: [ ] - # -- The Loadbalancer IP created by nginx or istio on clouds that provide static IPs. This is not needed if `global.fqdn` is globally resolvable. - lbIp: 22.22.22.22 - nginx-ingress: - # -- Boolean flag to enable/disable the nginx-ingress definitions chart. - enabled: true - opendj: - # -- Boolean flag to enable/disable the OpenDJ chart. - enabled: false - # -- Name of the OpenDJ service. Please keep it as default. - ldapServiceName: opendj - oxpassport: - # -- Name of the oxPassport service. Please keep it as default. - oxPassportServiceName: oxpassport - # -- Boolean flag to enable/disable passport chart - enabled: false - oxshibboleth: - # -- Name of the oxShibboleth service. Please keep it as default. - oxShibbolethServiceName: oxshibboleth - # -- Boolean flag to enable/disable the oxShibbboleth chart. - enabled: false - # -- App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. - # log levels are "OFF", "FATAL", "ERROR", "WARN", "INFO", "DEBUG", "TRACE" - # Targets are "STDOUT" and "FILE" - appLoggers: - # -- idp-process.log target - idpLogTarget: "STDOUT" - # -- idp-process.log level - idpLogLevel: "INFO" - # -- idp-script.log target - scriptLogTarget: "FILE" - # -- idp-script.log level - scriptLogLevel: "INFO" - # -- idp-audit.log target - auditStatsLogTarget: "FILE" - # -- idp-audit.log level - auditStatsLogLevel: "INFO" - # -- idp-consent-audit.log target - consentAuditLogTarget: "FILE" - # -- idp-consent-audit.log level - consentAuditLogLevel: "INFO" - # -- https://github.com/GluuFederation/docker-oxshibboleth#additional-logger-configuration - # The below are very noisy logs and are better left untouched - ldapLogLevel: "" - messagesLogLevel: "" - encryptionLogLevel: "" - opensamlLogLevel: "" - propsLogLevel: "" - httpclientLogLevel: "" - springLogLevel: "" - containerLogLevel: "" - xmlsecLogLevel: "" - # -- Gluu distributions supported are: default|openbanking. - distribution: default - persistence: - # -- Boolean flag to enable/disable the persistence chart. - enabled: true - scim: - # -- Name of the scim service. Please keep it as default. - scimServiceName: scim - # -- Boolean flag to enable/disable the SCIM chart. - enabled: true - # -- App loggers can be configured to define where the logs will be redirected to and the level of each in which it should be displayed. - appLoggers: - # -- Enable log prefixing which enables prepending the STDOUT logs with the file name. i.e jans-scim ===> 2022-12-20 17:49:55,744 INFO - enableStdoutLogPrefix: "true" - # -- jans-scim.log target - scimLogTarget: "STDOUT" - # -- jans-scim.log level - scimLogLevel: "INFO" - # -- jans-scim_persistence.log target - persistenceLogTarget: "FILE" - # -- jans-scim_persistence.log level - persistenceLogLevel: "INFO" - # -- jans-scim_persistence_duration.log target - persistenceDurationLogTarget: "FILE" - # -- jans-scim_persistence_duration.log level - persistenceDurationLogLevel: "INFO" - # -- jans-scim_persistence_ldap_statistics.log target - ldapStatsLogTarget: "FILE" - # -- jans-scim_persistence_ldap_statistics.log level - ldapStatsLogLevel: "INFO" - # -- jans-scim_script.log target - scriptLogTarget: "FILE" - # -- jans-scim_script.log level - scriptLogLevel: "INFO" - # -- Enable endpoints in either istio or nginx ingress depending on users choice - ingress: - # -- Enable endpoint /.well-known/scim-configuration - scimConfigEnabled: false - # -- Enable SCIM endpoints /jans-scim - scimEnabled: false - # -- StorageClass section for OpenDJ charts. This is not currently used by the openbanking distribution. You may specify custom parameters as needed. - storageClass: - allowVolumeExpansion: true - allowedTopologies: [] - mountOptions: - - debug - # -- parameters: - #fsType: "" - #kind: "" - #pool: "" - #storageAccountType: "" - #type: "" - parameters: {} - provisioner: microk8s.io/hostpath - reclaimPolicy: Retain - volumeBindingMode: WaitForFirstConsumer - -# -- Nginx ingress definitions chart -nginx-ingress: - certManager: - # Enable deploying a certificate that uses dns01 challenge instead of passing an annotation nginx-ingress.ingress.additionalAnnotations for nginx http01 challenge. - certificate: - enabled: false - issuerKind: ClusterIssuer - # Issuer name which you will create manually. Can be letsencrypt-production. - issuerName: "" - issuerGroup: cert-manager.io - ingress: - # -- Admin UI ingress resource labels. key app is taken. - adminUiLabels: { } - # -- openid-configuration ingress resource additional annotations. - adminUiAdditionalAnnotations: { } - # -- openid-configuration ingress resource labels. key app is taken - openidConfigLabels: { } - # -- openid-configuration ingress resource additional annotations. - openidAdditionalAnnotations: { } - # -- device-code ingress resource labels. key app is taken - deviceCodeLabels: { } - # -- device-code ingress resource additional annotations. - deviceCodeAdditionalAnnotations: { } - # -- Firebase Messaging ingress resource labels. key app is taken - firebaseMessagingLabels: { } - # -- Firebase Messaging ingress resource additional annotations. - firebaseMessagingAdditionalAnnotations: { } - # -- uma2 config ingress resource labels. key app is taken - uma2ConfigLabels: { } - # -- uma2 config ingress resource additional annotations. - uma2AdditionalAnnotations: { } - # -- webfinger ingress resource labels. key app is taken - webfingerLabels: { } - # -- webfinger ingress resource additional annotations. - webfingerAdditionalAnnotations: { } - # -- webdiscovery ingress resource labels. key app is taken - webdiscoveryLabels: { } - # -- webdiscovery ingress resource additional annotations. - webdiscoveryAdditionalAnnotations: { } - # -- SCIM config ingress resource labels. key app is taken - scimConfigLabels: { } - # -- SCIM config ingress resource additional annotations. - scimConfigAdditionalAnnotations: { } - # -- SCIM config ingress resource labels. key app is taken - scimLabels: { } - # -- SCIM ingress resource additional annotations. - scimAdditionalAnnotations: { } - # -- configAPI ingress resource labels. key app is taken - configApiLabels: { } - # -- ConfigAPI ingress resource additional annotations. - configApiAdditionalAnnotations: { } - # -- u2f config ingress resource labels. key app is taken - u2fConfigLabels: { } - # -- u2f config ingress resource additional annotations. - u2fAdditionalAnnotations: { } - # -- fido2 config ingress resource labels. key app is taken - fido2ConfigLabels: { } - # -- fido2 config ingress resource additional annotations. - fido2ConfigAdditionalAnnotations: { } - # -- Auth server ingress resource labels. key app is taken - authServerLabels: { } - # -- Auth server ingress resource additional annotations. - authServerAdditionalAnnotations: { } - # -- Casa ingress resource labels. key app is taken - casaLabels: { } - # -- Casa ingress resource additional annotations. - casaAdditionalAnnotations: { } - # -- Auth server protected token ingress resource labels. key app is taken - authServerProtectedTokenLabels: { } - # -- Auth server protected token ingress resource additional annotations. - authServerProtectedTokenAdditionalAnnotations: { } - # -- Auth server protected token ingress resource labels. key app is taken - authServerProtectedRegisterLabels: { } - # -- Auth server protected register ingress resource additional annotations. - authServerProtectedRegisterAdditionalAnnotations: { } - # -- Additional labels that will be added across all ingress definitions in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across all ingress definitions in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - # Enable client certificate authentication - # nginx.ingress.kubernetes.io/auth-tls-verify-client: "optional" - # Create the secret containing the trusted ca certificates - # nginx.ingress.kubernetes.io/auth-tls-secret: "gluu/tls-certificate" - # Specify the verification depth in the client certificates chain - # nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1" - # Specify if certificates are passed to upstream server - # nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true" - additionalAnnotations: {} - path: / - hosts: - - demoexample.gluu.org - # -- Secrets holding HTTPS CA cert and key. - tls: - - secretName: tls-certificate - hosts: - - demoexample.gluu.org - -# -- OpenDJ is a directory server which implements a wide range of Lightweight Directory Access Protocol and related standards, including full compliance with LDAPv3 but also support for Directory Service Markup Language (DSMLv2).Written in Java, OpenDJ offers multi-master replication, access control, and many extensions. -opendj: - # -- Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API - # https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ - topologySpreadConstraints: {} - # -- Define below as many constraints as needed. The key name should follow the structure tsc1, tsc2...etc. - # Do not enter the key labelSelector in the entry/entries below as that is automatically injected by the chart - #tsc1: - # maxSkew: 1 - # minDomains: 1 # optional; beta since v1.25 - # topologyKey: kubernetes.io/hostname - # whenUnsatisfiable: DoNotSchedule - # matchLabelKeys: [] # optional; alpha since v1.25 - # nodeAffinityPolicy: [] # optional; alpha since v1.25 - # nodeTaintsPolicy: [] # optional; alpha since v1.25 - #tsc2: - #maxSkew: 1 - # -- Configure the PodDisruptionBudget - pdb: - enabled: true - maxUnavailable: 1 - # -- Configure ldap backup cronjob - backup: - enabled: true - cronJobSchedule: "*/59 * * * *" - # -- Configure the HorizontalPodAutoscaler - hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} - # -- Add custom normal and secret envs to the service - usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: gluufederation/opendj - # -- Image tag to use for deploying. - tag: 5.0.0_dev - # -- Image Pull Secrets - pullSecrets: [ ] - - persistence: - # -- OpenDJ volume size - size: 5Gi - ports: - tcp-admin: - nodePort: "" - port: 4444 - protocol: TCP - targetPort: 4444 - tcp-ldap: - nodePort: "" - port: 1389 - protocol: TCP - targetPort: 1389 - tcp-ldaps: - nodePort: "" - port: 1636 - protocol: TCP - targetPort: 1636 - tcp-repl: - nodePort: "" - port: 8989 - protocol: TCP - targetPort: 8989 - tcp-serf: - nodePort: "" - port: 7946 - protocol: TCP - targetPort: 7946 - udp-serf: - nodePort: "" - port: 7946 - protocol: UDP - targetPort: 7946 - # -- Service replica number. - replicas: 1 - # -- Resource specs. - resources: - limits: - # -- CPU limit. - cpu: 1500m - # -- Memory limit. - memory: 2000Mi - requests: - # -- CPU request. - cpu: 1500m - # -- Memory request. - memory: 2000Mi - # -- Configure the liveness healthcheck for OpenDJ if needed. - # https://github.com/GluuFederation/docker-opendj/blob/master/scripts/healthcheck.py - livenessProbe: - # -- Executes the python3 healthcheck. - exec: - command: - - python3 - - /app/scripts/healthcheck.py - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - failureThreshold: 20 - # -- Configure the readiness healthcheck for OpenDJ if needed. - # https://github.com/GluuFederation/docker-opendj/blob/master/scripts/healthcheck.py - readinessProbe: - tcpSocket: - port: 1636 - initialDelaySeconds: 60 - timeoutSeconds: 5 - periodSeconds: 25 - failureThreshold: 20 - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } -# -- Gluu interface to Passport.js to support social login and inbound identity. -oxpassport: - # -- Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API - # https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ - topologySpreadConstraints: {} - # -- Define below as many constraints as needed. The key name should follow the structure tsc1, tsc2...etc. - # Do not enter the key labelSelector in the entry/entries below as that is automatically injected by the chart - #tsc1: - # maxSkew: 1 - # minDomains: 1 # optional; beta since v1.25 - # topologyKey: kubernetes.io/hostname - # whenUnsatisfiable: DoNotSchedule - # matchLabelKeys: [] # optional; alpha since v1.25 - # nodeAffinityPolicy: [] # optional; alpha since v1.25 - # nodeTaintsPolicy: [] # optional; alpha since v1.25 - #tsc2: - #maxSkew: 1 - # -- Configure the PodDisruptionBudget - pdb: - enabled: true - maxUnavailable: "90%" - # -- Configure the HorizontalPodAutoscaler - hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} - # -- Add custom normal and secret envs to the service - usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: gluufederation/oxpassport - # -- Image tag to use for deploying. - tag: 5.0.0_dev - # -- Image Pull Secrets - pullSecrets: [ ] - # -- Service replica number - replicas: 1 - # -- Resource specs. - resources: - limits: - # -- CPU limit. - cpu: 700m - # -- Memory limit. - memory: 900Mi - requests: - # -- CPU request. - cpu: 700m - # -- Memory request. - memory: 900Mi - # -- Configure the liveness healthcheck for oxPassport if needed. - livenessProbe: - httpGet: - # -- http liveness probe endpoint - path: /passport/health-check - port: http-passport - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - failureThreshold: 20 - # -- Configure the readiness healthcheck for the oxPassport if needed. - readinessProbe: - httpGet: - # -- http readiness probe endpoint - path: /passport/health-check - port: http-passport - initialDelaySeconds: 25 - periodSeconds: 25 - timeoutSeconds: 5 - failureThreshold: 20 - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } -# -- Shibboleth project for the Gluu Server's SAML IDP functionality. -oxshibboleth: - # -- Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API - # https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ - topologySpreadConstraints: {} - # -- Define below as many constraints as needed. The key name should follow the structure tsc1, tsc2...etc. - # Do not enter the key labelSelector in the entry/entries below as that is automatically injected by the chart - #tsc1: - # maxSkew: 1 - # minDomains: 1 # optional; beta since v1.25 - # topologyKey: kubernetes.io/hostname - # whenUnsatisfiable: DoNotSchedule - # matchLabelKeys: [] # optional; alpha since v1.25 - # nodeAffinityPolicy: [] # optional; alpha since v1.25 - # nodeTaintsPolicy: [] # optional; alpha since v1.25 - #tsc2: - #maxSkew: 1 - # -- Configure the PodDisruptionBudget - pdb: - enabled: true - maxUnavailable: 1 - # -- Configure the HorizontalPodAutoscaler - hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} - # -- Add custom normal and secret envs to the service - usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: gluufederation/oxshibboleth - # -- Image tag to use for deploying. - tag: 5.0.0_dev - # -- Image Pull Secrets - pullSecrets: [ ] - # -- Service replica number. - replicas: 1 - # -- Resource specs. - resources: - limits: - # -- CPU limit. - cpu: 1000m - # -- Memory limit. - memory: 1000Mi - requests: - # -- CPU request. - cpu: 1000m - # -- Memory request. - memory: 1000Mi - # -- Configure the liveness healthcheck for oxshibboleth if needed. - # https://github.com/GluuFederation/docker-oxshibboleth/blob/master/scripts/healthcheck.py - livenessProbe: - # -- Executes the python3 healthcheck. - exec: - command: - - python3 - - /app/scripts/healthcheck.py - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - failureThreshold: 20 - # -- Configure the readiness healthcheck for the casa if needed. - readinessProbe: - # https://github.com/GluuFederation/docker-oxshibboleth/blob/master/scripts/healthcheck.py - # -- Executes the python3 healthcheck. - exec: - command: - - python3 - - /app/scripts/healthcheck.py - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - failureThreshold: 20 - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } -# -- Job to generate data and initial config for Gluu Server persistence layer. -persistence: - # -- Add custom normal and secret envs to the service - usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: janssenproject/persistence-loader - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] - # -- Resource specs. - resources: - limits: - # -- CPU limit - cpu: 300m - # -- Memory limit. - memory: 300Mi - requests: - # -- CPU request. - cpu: 300m - # -- Memory request. - memory: 300Mi - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } -# -- System for Cross-domain Identity Management (SCIM) version 2.0 -scim: - # -- Configure the topology spread constraints. Notice this is a map NOT a list as in the upstream API - # https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/ - topologySpreadConstraints: {} - # -- Define below as many constraints as needed. The key name should follow the structure tsc1, tsc2...etc. - # Do not enter the key labelSelector in the entry/entries below as that is automatically injected by the chart - #tsc1: - # maxSkew: 1 - # minDomains: 1 # optional; beta since v1.25 - # topologyKey: kubernetes.io/hostname - # whenUnsatisfiable: DoNotSchedule - # matchLabelKeys: [] # optional; alpha since v1.25 - # nodeAffinityPolicy: [] # optional; alpha since v1.25 - # nodeTaintsPolicy: [] # optional; alpha since v1.25 - #tsc2: - #maxSkew: 1 - # -- Configure the PodDisruptionBudget - pdb: - enabled: true - maxUnavailable: "90%" - # -- Configure the HorizontalPodAutoscaler - hpa: - enabled: true - minReplicas: 1 - maxReplicas: 10 - targetCPUUtilizationPercentage: 50 - # -- metrics if targetCPUUtilizationPercentage is not set - metrics: [] - # -- Scaling Policies - behavior: {} - # -- Add custom normal and secret envs to the service - usrEnvs: - # -- Add custom normal envs to the service - # variable1: value1 - normal: {} - # -- Add custom secret envs to the service - # variable1: value1 - secret: {} - # -- Add custom dns policy - dnsPolicy: "" - # -- Add custom dns config - dnsConfig: {} - image: - # -- Image pullPolicy to use for deploying. - pullPolicy: IfNotPresent - # -- Image to use for deploying. - repository: janssenproject/scim - # -- Image tag to use for deploying. - tag: 1.0.5-1 - # -- Image Pull Secrets - pullSecrets: [ ] - # -- Service replica number. - replicas: 1 - resources: - limits: - # -- CPU limit. - cpu: 1000m - # -- Memory limit. - memory: 1000Mi - requests: - # -- CPU request. - cpu: 1000m - # -- Memory request. - memory: 1000Mi - service: - # -- The name of the scim port within the scim service. Please keep it as default. - name: http-scim - # -- Port of the scim service. Please keep it as default. - port: 8080 - # -- Configure the liveness healthcheck for SCIM if needed. - livenessProbe: - httpGet: - # -- http liveness probe endpoint - path: /jans-scim/sys/health-check - port: 8080 - initialDelaySeconds: 30 - periodSeconds: 30 - timeoutSeconds: 5 - # -- Configure the readiness healthcheck for the SCIM if needed. - readinessProbe: - httpGet: - # -- http readiness probe endpoint - path: /jans-scim/sys/health-check - port: 8080 - initialDelaySeconds: 25 - periodSeconds: 25 - timeoutSeconds: 5 - # -- Configure any additional volumes that need to be attached to the pod - volumes: [] - # -- Configure any additional volumesMounts that need to be attached to the containers - volumeMounts: [] - - # -- Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} - additionalLabels: { } - # -- Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} - additionalAnnotations: { } diff --git a/index.yaml b/index.yaml index 2a5709aee..e4d3bbfe9 100644 --- a/index.yaml +++ b/index.yaml @@ -8868,450 +8868,6 @@ entries: urls: - assets/gitlab/gitlab-6.5.1.tgz version: 6.5.1 - gluu: - - annotations: - artifacthub.io/changes: | - - Update always - artifacthub.io/containsSecurityUpdates: "true" - artifacthub.io/images: | - - name: auth-server - image: janssenproject/auth-server:1.0.0-beta.16 - - name: auth-server-key-rotation - image: janssenproject/certmanager:1.0.0-beta.16 - - name: client-api - image: janssenproject/client-api:1.0.0-beta.16 - - name: configuration-manager - image: janssenproject/configurator:1.0.0-beta.16 - - name: config-api - image: janssenproject/config-api:1.0.0-beta.16 - - name: fido2 - image: janssenproject/fido2:1.0.0-beta.16 - - name: opendj - image: gluufederation/opendj:5.0.0_dev - - name: persistence - image: janssenproject/persistence-loader:1.0.0-beta.16 - - name: scim - image: janssenproject/scim:1.0.0-beta.16 - artifacthub.io/license: Apache-2.0 - artifacthub.io/prerelease: "true" - catalog.cattle.io/certified: partner - catalog.cattle.io/display-name: Gluu Cloud Identity and Access Management - catalog.cattle.io/release-name: gluu - apiVersion: v2 - appVersion: 5.0.0 - created: "2022-03-16T12:29:00.327278263Z" - dependencies: - - condition: global.config.enabled - name: config - repository: "" - version: 5.0.3 - - condition: global.config-api.enabled - name: config-api - repository: "" - version: 5.0.3 - - condition: global.opendj.enabled - name: opendj - repository: "" - version: 5.0.3 - - condition: global.auth-server.enabled - name: auth-server - repository: "" - version: 5.0.3 - - condition: global.admin-ui.enabled - name: admin-ui - repository: "" - version: 5.0.3 - - condition: global.fido2.enabled - name: fido2 - repository: "" - version: 5.0.3 - - condition: global.scim.enabled - name: scim - repository: "" - version: 5.0.3 - - condition: global.nginx-ingress.enabled - name: nginx-ingress - repository: "" - version: 5.0.3 - - condition: global.oxshibboleth.enabled - name: oxshibboleth - repository: "" - version: 5.0.3 - - condition: global.oxpassport.enabled - name: oxpassport - repository: "" - version: 5.0.3 - - condition: global.casa.enabled - name: casa - repository: "" - version: 5.0.3 - - condition: global.auth-server-key-rotation.enabled - name: auth-server-key-rotation - repository: "" - version: 5.0.3 - - condition: global.client-api.enabled - name: client-api - repository: "" - version: 5.0.3 - - condition: global.persistence.enabled - name: persistence - repository: "" - version: 5.0.3 - - condition: global.istio.ingress - name: cn-istio-ingress - repository: "" - version: 5.0.3 - description: Gluu Access and Identity Management - digest: 5179611a022721f7667fd8212d04a07e21165c2b8409de3197468a82d76afd4b - home: https://www.gluu.org - icon: https://gluu.org/docs/gluu-server/favicon.ico - kubeVersion: '>=v1.21.0-0' - maintainers: - - email: support@gluu.org - name: moabu - name: gluu - sources: - - https://gluu.org/docs/gluu-server - - https://github.com/GluuFederation/flex/flex-cn-setup - urls: - - assets/gluu/gluu-5.0.302.tgz - version: 5.0.302 - - annotations: - artifacthub.io/changes: | - - Gluu 5.0 Openbanking Distribution. Auth-server and config-api. - - Updated new images - - https://gluu.org/docs/openbanking - artifacthub.io/containsSecurityUpdates: "true" - artifacthub.io/images: | - - name: auth-server - image: janssenproject/auth-server:1.0.0-beta.13 - - name: auth-server-key-rotation - image: janssenproject/certmanager:1.0.0-beta.13 - - name: client-api - image: janssenproject/client-api:1.0.0-beta.13 - - name: configuration-manager - image: janssenproject/configurator:1.0.0-beta.13 - - name: config-api - image: janssenproject/config-api:1.0.0-beta.13 - - name: fido2 - image: janssenproject/fido2:1.0.0-beta.13 - - name: opendj - image: gluufederation/opendj:5.0.0_dev - - name: persistence - image: janssenproject/persistence-loader:1.0.0-beta.13 - - name: scim - image: janssenproject/scim:1.0.0-beta.13 - artifacthub.io/license: Apache-2.0 - artifacthub.io/prerelease: "true" - catalog.cattle.io/certified: partner - catalog.cattle.io/display-name: Gluu Cloud Identity and Access Management - catalog.cattle.io/release-name: gluu - apiVersion: v2 - appVersion: 5.0.0 - created: "2021-12-06T09:13:44.889427-05:00" - dependencies: - - condition: global.config.enabled - name: config - repository: "" - version: 5.0.1 - - condition: global.config-api.enabled - name: config-api - repository: "" - version: 5.0.1 - - condition: global.opendj.enabled - name: opendj - repository: "" - version: 5.0.1 - - condition: global.jackrabbit.enabled - name: jackrabbit - repository: "" - version: 5.0.1 - - condition: global.auth-server.enabled - name: auth-server - repository: "" - version: 5.0.1 - - condition: global.admin-ui.enabled - name: admin-ui - repository: "" - version: 5.0.1 - - condition: global.fido2.enabled - name: fido2 - repository: "" - version: 5.0.1 - - condition: global.scim.enabled - name: scim - repository: "" - version: 5.0.1 - - condition: global.nginx-ingress.enabled - name: nginx-ingress - repository: "" - version: 5.0.1 - - condition: global.oxshibboleth.enabled - name: oxshibboleth - repository: "" - version: 5.0.1 - - condition: config.configmap.cnPassportEnabled - name: oxpassport - repository: "" - version: 5.0.1 - - condition: config.configmap.cnCasaEnabled - name: casa - repository: "" - version: 5.0.1 - - condition: global.auth-server-key-rotation.enabled - name: auth-server-key-rotation - repository: "" - version: 5.0.1 - - condition: global.cr-rotate.enabled - name: cr-rotate - repository: "" - version: 5.0.1 - - condition: global.client-api.enabled - name: client-api - repository: "" - version: 5.0.1 - - condition: global.persistence.enabled - name: persistence - repository: "" - version: 5.0.1 - - condition: global.istio.ingress - name: cn-istio-ingress - repository: "" - version: 5.0.1 - description: Gluu Access and Identity Management OpenBanking distribution - digest: e3550c2d34d6febf7ed2d5c59cb6ec9d07b5dcc5fb4258fd67185008663e151e - home: https://www.gluu.org - icon: https://gluu.org/docs/gluu-server/favicon.ico - kubeVersion: '>=v1.21.0-0' - maintainers: - - email: support@gluu.org - name: moabu - name: gluu - sources: - - https://gluu.org/docs/gluu-server - - https://github.com/GluuFederation/cloud-native-edition - urls: - - assets/gluu/gluu-5.0.101.tgz - version: 5.0.101 - - annotations: - artifacthub.io/changes: | - - Waiting for changes - artifacthub.io/containsSecurityUpdates: "true" - artifacthub.io/images: | - - name: auth-server - image: janssenproject/auth-server:1.0.7_dev - - name: auth-server-key-rotation - image: janssenproject/certmanager:1.0.7_dev - - name: configuration-manager - image: janssenproject/configurator:1.0.7_dev - - name: config-api - image: janssenproject/config-api:1.0.7_dev - - name: fido2 - image: janssenproject/fido2:1.0.7_dev - - name: opendj - image: gluufederation/opendj:5.0.0_dev - - name: persistence - image: janssenproject/persistence-loader:1.0.7_dev - - name: scim - image: janssenproject/scim:1.0.7_dev - - name: casa - image: gluufederation/casa:5.0.0_dev - - name: admin-ui - image: gluufederation/admin-ui:1.0.1_dev - artifacthub.io/license: Apache-2.0 - artifacthub.io/prerelease: "true" - catalog.cattle.io/certified: partner - catalog.cattle.io/display-name: Gluu Cloud Identity and Access Management - catalog.cattle.io/kube-version: '>=v1.21.0-0' - catalog.cattle.io/release-name: gluu - apiVersion: v2 - appVersion: 5.0.0 - created: "2023-01-30T09:29:26.001960687Z" - dependencies: - - condition: global.config.enabled - name: config - repository: file://./charts/config - version: 5.0.10 - - condition: global.config-api.enabled - name: config-api - repository: file://./charts/config-api - version: 5.0.10 - - condition: global.opendj.enabled - name: opendj - repository: file://./charts/opendj - version: 5.0.10 - - condition: global.auth-server.enabled - name: auth-server - repository: file://./charts/auth-server - version: 5.0.10 - - condition: global.admin-ui.enabled - name: admin-ui - repository: file://./charts/admin-ui - version: 5.0.10 - - condition: global.fido2.enabled - name: fido2 - repository: file://./charts/fido2 - version: 5.0.10 - - condition: global.scim.enabled - name: scim - repository: file://./charts/scim - version: 5.0.10 - - condition: global.nginx-ingress.enabled - name: nginx-ingress - repository: file://./charts/nginx-ingress - version: 5.0.10 - - condition: global.oxshibboleth.enabled - name: oxshibboleth - repository: file://./charts/oxshibboleth - version: 5.0.10 - - condition: global.oxpassport.enabled - name: oxpassport - repository: file://./charts/oxpassport - version: 5.0.10 - - condition: global.casa.enabled - name: casa - repository: file://./charts/casa - version: 5.0.10 - - condition: global.auth-server-key-rotation.enabled - name: auth-server-key-rotation - repository: file://./charts/auth-server-key-rotation - version: 5.0.10 - - condition: global.persistence.enabled - name: persistence - repository: file://./charts/persistence - version: 5.0.10 - - condition: global.istio.ingress - name: cn-istio-ingress - repository: file://./charts/cn-istio-ingress - version: 5.0.10 - description: Gluu Access and Identity Management - digest: 9c0c030db9292754a9c17d73c8e2f1cd9c4d1b41c8738eb397f73e7b4714c2a0 - home: https://www.gluu.org - icon: https://gluu.org/docs/gluu-server/favicon.ico - kubeVersion: '>=v1.21.0-0' - maintainers: - - email: support@gluu.org - name: moabu - name: gluu - sources: - - https://gluu.org/docs/gluu-server - - https://github.com/GluuFederation/flex/flex-cn-setup - urls: - - assets/gluu/gluu-5.0.10.tgz - version: 5.0.10 - - annotations: - artifacthub.io/changes: | - - Gluu 5.0 Openbanking Distribution. Auth-server and config-api. - - Updated new images - - https://gluu.org/docs/openbanking - artifacthub.io/containsSecurityUpdates: "true" - artifacthub.io/images: | - - name: auth-server - image: janssenproject/auth-server:1.0.0_b12 - - name: auth-server-key-rotation - image: janssenproject/certmanager:1.0.0_b12 - - name: client-api - image: janssenproject/client-api:1.0.0_b12 - - name: configuration-manager - image: janssenproject/configurator:1.0.0_b12 - - name: config-api - image: janssenproject/config-api:1.0.0_b12 - - name: fido2 - image: janssenproject/fido2:1.0.0_b12 - - name: opendj - image: gluufederation/opendj:5.0.0_dev - - name: persistence - image: janssenproject/persistence-loader:1.0.0_b12 - - name: scim - image: janssenproject/scim:1.0.0_b12 - artifacthub.io/license: Apache-2.0 - artifacthub.io/prerelease: "true" - catalog.cattle.io/certified: partner - catalog.cattle.io/display-name: Gluu Cloud Identity and Access Management - catalog.cattle.io/release-name: gluu - apiVersion: v2 - appVersion: 5.0.0 - created: "2021-11-17T03:31:39.761275-05:00" - dependencies: - - condition: global.config.enabled - name: config - repository: "" - version: 5.0.0 - - condition: global.config-api.enabled - name: config-api - repository: "" - version: 5.0.0 - - condition: global.opendj.enabled - name: opendj - repository: "" - version: 5.0.0 - - condition: global.jackrabbit.enabled - name: jackrabbit - repository: "" - version: 5.0.0 - - condition: global.auth-server.enabled - name: auth-server - repository: "" - version: 5.0.0 - - condition: global.fido2.enabled - name: fido2 - repository: "" - version: 5.0.0 - - condition: global.scim.enabled - name: scim - repository: "" - version: 5.0.0 - - condition: global.nginx-ingress.enabled - name: nginx-ingress - repository: "" - version: 5.0.0 - - condition: global.oxshibboleth.enabled - name: oxshibboleth - repository: "" - version: 5.0.0 - - condition: config.configmap.cnPassportEnabled - name: oxpassport - repository: "" - version: 5.0.0 - - condition: config.configmap.cnCasaEnabled - name: casa - repository: "" - version: 5.0.0 - - condition: global.auth-server-key-rotation.enabled - name: auth-server-key-rotation - repository: "" - version: 5.0.0 - - condition: global.cr-rotate.enabled - name: cr-rotate - repository: "" - version: 5.0.0 - - condition: global.client-api.enabled - name: client-api - repository: "" - version: 5.0.0 - - condition: global.persistence.enabled - name: persistence - repository: "" - version: 5.0.0 - - condition: global.istio.ingress - name: cn-istio-ingress - repository: "" - version: 5.0.0 - description: Gluu Access and Identity Management OpenBanking distribution - digest: 587670505b47416f2bea59c3ef523caf51f91bf5efc46166ff1b052551648f29 - home: https://www.gluu.org - icon: https://gluu.org/docs/gluu-server/favicon.ico - kubeVersion: '>=v1.19.0-0' - maintainers: - - email: support@gluu.org - name: moabu - name: gluu - sources: - - https://gluu.org/docs/gluu-server - - https://github.com/GluuFederation/cloud-native-edition - urls: - - assets/gluu/gluu-5.0.0.tgz - version: 5.0.0 gopaddle: - annotations: catalog.cattle.io/certified: partner diff --git a/packages/gluu/flex/overlay/app-readme.md b/packages/gluu/flex/overlay/app-readme.md deleted file mode 100644 index 84d58ba8c..000000000 --- a/packages/gluu/flex/overlay/app-readme.md +++ /dev/null @@ -1,35 +0,0 @@ -## Introduction -The Gluu Server is a container distribution of free open source software (FOSS) for identity and access management (IAM). SaaS, custom, open source and commercial web and mobile applications can leverage a Gluu Server for user authentication, identity information, and policy decisions. - -Common use cases include: - -- Single sign-on (SSO) -- Mobile authentication -- API access management -- Two-factor authentication (2FA) -- Customer identity and access management (CIAM) -- Identity federation - -### Free Open Source Software -The Gluu Server is a FOSS platform for IAM. - -### Open Web Standards -The Gluu Server can be deployed to support the following open standards for authentication, authorization, federated identity, and identity management: - -- OAuth 2.0 -- OpenID Connect -- User Managed Access 2.0 (UMA) -- SAML 2.0 -- System for Cross-domain Identity Management (SCIM) -- FIDO Universal 2nd Factor (U2F) -- FIDO 2.0 / WebAuthn -- Lightweight Directory Access Protocol (LDAP) -- Remote Authentication Dial-In User Service (RADIUS) - -### Important notes for installation: -- Make sure to enable `Customize Helm options before install` after clicking the initial `Install` on the top right. When you view your helm options, please uncheck the wait parameter as that conflicts with the post-install hook for the persistence image. - -### Quick install on Rancher UI with Docker single node -- Install the nginx-ingress-controller chart. -- Install the OpenEBS chart. -- Install Gluu chart and specify your persistence as ldap. \ No newline at end of file diff --git a/packages/gluu/flex/overlay/questions.yaml b/packages/gluu/flex/overlay/questions.yaml deleted file mode 100644 index b9768fcbf..000000000 --- a/packages/gluu/flex/overlay/questions.yaml +++ /dev/null @@ -1,1287 +0,0 @@ -questions: -# ================== -# Distribution group -# ================== -- variable: global.distribution - default: "openbanking" - required: true - type: enum - label: Gluu Distribution - description: "Gluu Distribution. Openbanking only contains Config-API and the Auth Server customized for Openbanking industry." - group: "Global Settings" - options: - - "default" - - "openbanking" - -# ======================== -# OpenBanking Distribution -# ======================== -- variable: global.cnObExtSigningJwksUri - required: true - default: "https://keystore.openbankingtest.org.uk/keystore/openbanking.jwks" - description: "Open banking external signing jwks uri. Used in SSA Validation." - type: hostname - group: "OpenBanking Distribution" - label: Openbanking external signing JWKS URI - show_if: "global.distribution=openbanking" - subquestions: - - variable: global.cnObExtSigningJwksCrt - default: "" - required: true - group: "OpenBanking Distribution" - description: "Open banking external signing jwks AS certificate authority string. Used in SSA Validation. This must be encoded using base64.. Used when `.global.cnObExtSigningJwksUri` is set." - type: multiline - label: Open banking external signing jwks AS certificate authority string - - variable: global.cnObExtSigningJwksKey - default: "" - required: true - group: "OpenBanking Distribution" - description: "Open banking external signing jwks AS key string. Used in SSA Validation. This must be encoded using base64. Used when `.global.cnObExtSigningJwksUri` is set." - type: multiline - label: Open banking external signing jwks AS key string - - variable: global.cnObExtSigningJwksKeyPassPhrase - default: "" - required: true - group: "OpenBanking Distribution" - description: "Open banking external signing jwks AS key passphrase to unlock provided key. This must be encoded using base64. Used when `.global.cnObExtSigningJwksUri` is set." - type: password - label: Open banking external signing jwks AS key passphrase - min_length: 6 - - variable: global.cnObExtSigningAlias - default: "XkwIzWy44xWSlcWnMiEc8iq9s2G" - required: true - group: "OpenBanking Distribution" - description: "Open banking external signing AS Alias. This is a kid value.Used in SSA Validation, kid used while encoding a JWT sent to token URL i.e XkwIzWy44xWSlcWnMiEc8iq9s2G" - type: string - label: Open banking external signing AS Alias -- variable: global.cnObStaticSigningKeyKid - default: "Wy44xWSlcWnMiEc8iq9s2G" - required: true - group: "OpenBanking Distribution" - description: "Open banking signing AS kid to force the AS to use a specific signing key. i.e Wy44xWSlcWnMiEc8iq9s2G" - type: string - label: Open banking signing AS kid - show_if: "global.distribution=openbanking" -- variable: global.cnObTransportAlias - default: "" - required: false - group: "OpenBanking Distribution" - description: "Open banking transport Alias used inside the JVM." - type: string - label: Open banking transport Alias used inside the JVM. - show_if: "global.distribution=openbanking" - subquestions: - - variable: global.cnObTransportCrt - default: "" - required: true - group: "OpenBanking Distribution" - description: "Open banking AS transport crt. Used in SSA Validation. This must be encoded using base64." - type: multiline - label: Open banking AS transport crt - - variable: global.cnObTransportKey - default: "" - required: true - group: "OpenBanking Distribution" - description: "Open banking AS transport key. Used in SSA Validation. This must be encoded using base64." - type: multiline - label: Open banking AS transport key - - variable: global.cnObTransportKeyPassPhrase - default: "" - required: true - group: "OpenBanking Distribution" - description: "Open banking AS transport key passphrase to unlock AS transport key. This must be encoded using base64." - type: password - label: Open banking AS transport key passphrase - min_length: 6 - - variable: global.cnObTransportTrustStore - default: "" - required: true - group: "OpenBanking Distribution" - description: "Open banking AS transport truststore crt. This is normally generated from the OB issuing CA, OB Root CA and Signing CA. Used when .global.cnObExtSigningJwksUri is set. Used in SSA Validation. This must be encoded using base64." - type: multiline - label: Open banking external signing jwks AS certificate authority string - -# ======================= -# Optional Services group -# ======================= -- variable: global.admin-ui.enabled - default: false - type: boolean - group: "Optional Services" - required: false - label: Boolean flag to enable/disable the admin-ui chart and admin ui config api plugin. This requires a license agreement with Gluu. - show_if: "global.distribution=default" - show_subquestion_if: true - subquestions: - - variable: global.admin-ui.adminUiApiKey - default: "" - required: true - description: "Admin UI license API key. Obtain this from Gluu." - type: multiline - label: Admin UI license API key. Obtain this from Gluu - - variable: global.admin-ui.adminUiProductCode - default: "" - required: true - description: "Admin UI license product code. Obtain this from Gluu." - type: multiline - label: Admin UI license product code. Obtain this from Gluu. - - variable: global.admin-ui.adminUiSharedKey - default: "" - required: true - description: "Admin UI license shared key. Obtain this from Gluu." - type: multiline - label: Admin UI license shared key. Obtain this from Gluu. - - variable: global.admin-ui.adminUiManagementKey - default: "" - required: true - description: "Admin UI license management key. Obtain this from Gluu." - type: multiline - label: Admin UI license management key. Obtain this from Gluu. -- variable: global.auth-server-key-rotation.enabled - default: false - type: boolean - group: "Optional Services" - required: true - label: Enable Auth key rotation cronjob - show_if: "global.distribution=default" - show_subquestion_if: true - subquestions: - - variable: auth-server-key-rotation.keysLife - default: 48 - description: "Auth server key rotation keys life in hours." - type: int - label: Key life -- variable: global.fido2.enabled - default: false - type: boolean - group: "Optional Services" - required: true - show_if: "global.distribution=default" - label: Enable Fido2 - description: "FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments." -- variable: global.config-api.enabled - default: false - type: boolean - group: "Optional Services" - required: true - label: Enable ConfigAPI - description: "Config Api endpoints can be used to configure the auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS)." -- variable: global.casa.enabled - default: false - type: boolean - group: "Optional Services" - required: true - label: Enable Casa - description: "Gluu Casa ('Casa') is a self-service web portal for end-users to manage authentication and authorization preferences for their account in a Gluu Server." -- variable: global.scim.enabled - default: false - type: boolean - group: "Optional Services" - required: true - show_if: "global.distribution=default" - label: Enable SCIM - description: "System for Cross-domain Identity Management (SCIM) version 2.0" -- variable: global.client-api.enabled - default: false - type: boolean - group: "Optional Services" - required: true - label: Enable ClientAPI - show_if: "global.distribution=default" - description: "Middleware API to help application developers call an OAuth, OpenID or UMA server. You may wonder why this is necessary. It makes it easier for client developers to use OpenID signing and encryption features, without becoming crypto experts. This API provides some high level endpoints to do some of the heavy lifting." - show_subquestion_if: true - subquestions: - - variable: config.configmap.cnClientApiApplicationCertCn - default: "client-api" - description: "Client API application keystore name" - type: string - label: Client API application keystore name - - variable: config.configmap.cnClientApiAdminCertCn - default: "client-api" - description: "Client API admin keystore name" - type: string - label: Client API admin keystore name -- variable: global.jackrabbit.enabled - default: false - type: boolean - group: "Optional Services" - required: true - label: Enable Jackrabbit - show_if: "global.distribution=default" - show_subquestion_if: true - description: "Needed for SAML. Jackrabbit Oak is a complementary implementation of the JCR specification. It is an effort to implement a scalable and performant hierarchical content repository for use as the foundation of modern world-class web sites and other demanding content applications. https://jackrabbit.apache.org/jcr/index.html ." - subquestions: - - variable: jackrabbit.storage.size - default: "4Gi" - description: "Size of Jackrabbit content repository volume storage." - type: string - label: Volume storage - - variable: config.configmap.cnJackrabbitUrl - default: "http://jackrabbit:8080" - description: "Please enter jackrabbit url." - type: hostname - label: Jackrabbit URL - - variable: config.configmap.cnJackrabbitAdminId - default: "admin" - description: "Jackrabbit admin user" - type: string - label: Jackrabbit Admin User - valid_chars: "^[a-z]+$" - - variable: jackrabbit.secrets.cnJackrabbitAdminPassword - default: "Test1234#" - description: "Jackrabbit admin password" - type: password - label: Jackrabbit Admin User Password - min_length: 6 -- variable: installer-settings.jackrabbit.clusterMode - default: false - type: boolean - group: "Optional Services" - required: true - label: Enable Jackrabbit in Cluster Mode (HA) - show_if: "global.jackrabbit.enabled=true" - show_subquestion_if: true - description: "Requires postgres." - subquestions: - - variable: config.configmap.cnJackrabbitPostgresUser - default: "admin" - description: "Jackrabbit postgres user" - type: string - label: Jackrabbit postgres user - valid_chars: "^[a-z]+$" - - variable: jackrabbit.secrets.cnJackrabbitPostgresPassword - default: "admin" - description: "Jackrabbit postgres password" - type: password - label: Jackrabbit postgres password - - - variable: config.configmap.cnJackrabbitPostgresDatabaseName - default: "jackrabbit" - description: "Jackrabbit postgres database name" - type: string - label: Jackrabbit postgres database name - -# ====================== -# Test environment group -# ====================== -- variable: global.cloud.testEnviroment - default: false - type: boolean - group: "Test Environment" - required: true - label: Test environment - description: "Boolean flag if enabled will strip resources requests and limits from all services." - -# ================= -# Persistence group -# ================= -- variable: global.cnPersistenceType - default: "sql" - required: true - type: enum - group: "Persistence" - label: Gluu Persistence backend - description: "Persistence backend to run Gluu with ldap|couchbase|hybrid|sql|spanner" - options: - - "ldap" - - "couchbase" - - "hybrid" - - "spanner" - - "sql" -# LDAP -- variable: global.opendj.enabled - default: false - type: boolean - group: "Persistence" - required: true - label: Enable installation of OpenDJ - description: "Boolean flag to enable/disable the OpenDJ chart." - show_if: "global.cnPersistenceType=ldap||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnLdapUrl - default: "opendj:1636" - type: hostname - group: "Persistence" - required: true - label: OpenDJ remote URL - description: "OpenDJ remote URL. This must be resolvable by the pods" - show_if: "global.opendj.enabled=false&&global.cnPersistenceType=ldap||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnPersistenceLdapMapping - default: "default" - required: false - type: enum - group: "Persistence" - label: Gluu Persistence LDAP mapping - description: "Specify data that should be saved in LDAP (one of default, user, cache, site, token, or session; default to default). Note this environment only takes effect when `global.cnPersistenceType` is set to `hybrid`." - options: - - "default" - - "user" - - "site" - - "cache" - - "token" - - "session" - show_if: "global.cnPersistenceType=hybrid" -# Multi cluster ldap replication -- variable: opendj.multiCluster.enabled - default: false - type: boolean - group: "Persistence" - required: true - label: Enable OpenDJ multiCluster mode - description: "Enable OpenDJ multiCluster mode. This flag enables loading keys under `opendj.multiCluster`" - show_if: "global.opendj.enabled=true" - show_subquestion_if: true - subquestions: - - variable: opendj.multiCluster.serfAdvertiseAddrSuffix - default: "regional.gluu.org:30946s" - type: hostname - group: "Persistence" - required: true - description: "OpenDJ Serf advertise address suffix that will be added to each opendj replica. i.e RELEASE-NAME-opendj-regional-{{statefulset pod number}}-{{ $.Values.multiCluster.serfAdvertiseAddrSuffix }}" - label: OpenDJ Serf advertise address suffix - - variable: opendj.multiCluster.replicaCount - default: 1 - type: int - group: "Persistence" - required: true - description: "The number of opendj non scalable statefulsets to create. Each pod created must be resolvable as it follows the patterm RELEASE-NAME-opendj-regional-{{statefulset pod number}}-{{ $.Values.multiCluster.serfAdvertiseAddrSuffix }} If set to 1, with a release name of gluu, the address of the pod would be gluu-opendj-regional-0-regional.gluu.org" - label: The number of opendj non scalable statefulsets to create. - - variable: opendj.multiCluster.clusterId - default: "west" - type: string - group: "Persistence" - required: true - description: "This id needs to be unique to each kubernetes cluster in a multi cluster setup; west, east, south, north, region ...etc If left empty it will be randomly generated." - label: Unique kubernetes cluster id - - variable: opendj.multiCluster.serfPeers - default: "['gluu-opendj-regional-0-regional.gluu.org:30946', 'gluu-opendj-regional-0-regional.gluu.org:31946']" - type: string - group: "Persistence" - required: true - description: "Serf peer addresses. One per replica." - label: Serf peer addresses -# SQL -- variable: config.configmap.cnSqlDbDialect - default: "default" - required: false - type: enum - group: "Persistence" - label: Gluu SQL Database dialect - description: "SQL database dialect. `mysql` or `pgsql`. The former is still not supported yet!" - options: - - "mysql" - - "pgsql" - show_if: "global.cnPersistenceType=sql" -- variable: config.configmap.cnSqlDbHost - default: "my-release-mysql.default.svc.cluster.local" - required: false - type: hostname - group: "Persistence" - label: SQL database host uri - description: "SQL database host uri" - show_if: "global.cnPersistenceType=sql" -- variable: config.configmap.cnSqlDbPort - default: 3306 - required: false - type: int - group: "Persistence" - label: SQL database port - description: "SQL database port" - show_if: "global.cnPersistenceType=sql" -- variable: config.configmap.cnSqlDbUser - default: "gluu" - group: "Persistence" - description: "SQL database username" - type: string - label: SQL database username - valid_chars: "^[a-z]+$" - show_if: "global.cnPersistenceType=sql" -- variable: config.configmap.cnSqldbUserPassword - default: "Test1234#" - group: "Persistence" - description: "SQL password" - type: password - label: SQL password - - show_if: "global.cnPersistenceType=sql" -- variable: config.configmap.cnSqlDbName - default: "gluu" - group: "Persistence" - description: "SQL database name" - type: string - label: SQL database name - show_if: "global.cnPersistenceType=sql" -# Spanner -- variable: config.configmap.cnGoogleSpannerInstanceId - default: "" - group: "Persistence" - description: "The google spanner instance ID" - type: string - label: Google Spanner Instance ID - show_if: "global.cnPersistenceType=spanner" -- variable: config.configmap.cnGoogleSpannerDatabaseId - default: "" - group: "Persistence" - description: "The google spanner database ID" - type: string - label: Google Spanner Database ID - show_if: "global.cnPersistenceType=spanner" -- variable: config.configmap.cnGoogleSecretManagerServiceAccount - default: "" - group: "Persistence" - description: "The service account with access roles/secretmanager.admin to use Google secret manager and/or roles/spanner.databaseUser to use Spanner." - type: multiline - label: Google Spanner Service Account json - show_if: "global.cnPersistenceType=spanner" -- variable: config.configmap.cnGoogleProjectId - default: "" - group: "Persistence" - description: "The Google Project ID" - type: string - label: Google Project ID - show_if: "global.cnPersistenceType=spanner" -#Couchbase -- variable: config.configmap.cnCouchbaseCrt - default: "" - group: "Persistence" - description: "Couchbase certificate authority string. This must be encoded using base64. This can also be found in your couchbase UI Security > Root Certificate. In mTLS setups this is not required." - type: multiline - label: Couchbase certificate authority string - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnCouchbaseUrl - default: "gluu.cbns.svc.cluster.local" - required: false - type: hostname - group: "Persistence" - label: Couchbase host uri - description: "Couchbase URL. Used only when global.cnPersistenceType is hybrid or couchbase. This should be in FQDN format for either remote or local Couchbase clusters. The address can be an internal address inside the kubernetes cluster" - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnCouchbaseBucketPrefix - default: "gluu" - type: string - description: "The prefix of couchbase buckets. This helps with separation in between different environments and allows for the same couchbase cluster to be used by different setups of Gluu." - group: "Persistence" - required: true - label: The prefix of Couchbase buckets - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnCouchbaseIndexNumReplica - default: 0 - type: int - description: "The number of replicas per index created. Please note that the number of index nodes must be one greater than the number of index replicas. That means if your couchbase cluster only has 2 index nodes you cannot place the number of replicas to be higher than 1." - group: "Persistence" - required: true - label: The number of replicas per index created - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnCouchbaseSuperUser - default: "admin" - group: "Persistence" - description: "he Couchbase super user (admin) user name. This user is used during initialization only." - type: string - label: The Couchbase super user (admin) user name. - valid_chars: "^[a-z]+$" - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnCouchbaseSuperUserPassword - default: "Test1234#" - group: "Persistence" - description: "Couchbase password for the super user config.configmap.cnCouchbaseSuperUser that is used during the initialization and upgrade process. The password must contain one digit, one uppercase letter, one lower case letter and one symbol" - type: password - label: Couchbase password for the super users - - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnCouchbaseUser - default: "gluu" - group: "Persistence" - description: "Couchbase restricted user, used in Gluu operations with Couchbase. Used only when global.cnPersistenceType is hybrid or couchbase." - type: string - label: Couchbase restricted username - valid_chars: "^[a-z]+$" - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" -- variable: config.configmap.cnCouchbasePassword - default: "Test1234#" - group: "Persistence" - description: "Couchbase password for the restricted user config.configmap.cnCouchbaseUser that is often used inside the services. The password must contain one digit, one uppercase letter, one lower case letter and one symbol ." - type: password - label: Couchbase password for the restricted user - show_if: "global.cnPersistenceType=couchbase||global.cnPersistenceType=hybrid" - -# ============================== -# StorageClass and volume group -# ============================== -- variable: global.storageClass.provisioner - default: "microk8s.io/hostpath" - type: string - group: "Volumes" - required: true - label: StorageClass provisioner - show_if: "global.cnPersistenceType=ldap||global.jackrabbit.enabled=true" - subquestions: - - variable: global.storageClass.allowVolumeExpansion - default: true - type: boolean - group: "Volumes" - required: true - label: StorageClass Volume expansion - - variable: global.storageClass.reclaimPolicy - default: "Retain" - type: enum - group: "Volumes" - required: true - label: StorageClass reclaimPolicy - options: - - "Delete" - - "Retain" - - variable: global.storageClass.volumeBindingMode - default: "WaitForFirstConsumer" - type: enum - group: "Volumes" - required: true - options: - - "WaitForFirstConsumer" - - "Immediate" - label: StorageClass volumeBindingMode - -# =========== -# Cache group -# =========== -- variable: config.configmap.cnCacheType - default: "NATIVE_PERSISTENCE" - required: true - type: enum - group: "Cache" - label: Gluu Cache - description: "Cache type. `NATIVE_PERSISTENCE`, `REDIS`. or `IN_MEMORY`. Defaults to `NATIVE_PERSISTENCE` ." - options: - - "NATIVE_PERSISTENCE" - - "IN_MEMORY" - - "REDIS" - show_subquestion_if: "REDIS" - subquestions: - - variable: config.configmap.cnRedisType - default: "STANDALONE" - type: enum - group: "Cache" - required: false - label: Redix service type - description: "Redis service type. `STANDALONE` or `CLUSTER`. Can be used when `config.configmap.cnCacheType` is set to `REDIS`." - options: - - "STANDALONE" - - "CLUSTER" - - variable: config.redisPassword - default: "Test1234#" - type: password - group: "Cache" - required: false - label: Redis admin password - description: "Redis admin password if `config.configmap.cnCacheType` is set to `REDIS`." - - - variable: config.configmap.cnRedisUrl - default: "redis.redis.svc.cluster.local:6379" - required: false - type: hostname - group: "Cache" - label: Redis URL - description: "Redis URL and port number :. Can be used when `config.configmap.cnCacheType` is set to `REDIS`." - -# ================== -# Configuration group -# ================== -- variable: global.fqdn - default: "demoexample.gluu.org" - required: true - type: hostname - group: "Configuration" - label: Gluu Installation FQDN - description: "Fully qualified domain name to be used for Gluu installation. This address will be used to reach Gluu services." -- variable: global.countryCode - default: "US" - required: true - type: string - group: "Configuration" - label: Country code - description: "Country code. Used for certificate creation." -- variable: config.state - default: "TX" - required: true - type: string - group: "Configuration" - label: State code - description: "State code. Used for certificate creation." -- variable: config.city - default: "Austin" - required: true - type: string - group: "Configuration" - label: City - description: "City. Used for certificate creation." -- variable: config.email - default: "support@gluu.org" - required: true - type: string - group: "Configuration" - label: Email - description: "Email address of the administrator usually. Used for certificate creation." -- variable: config.orgName - default: "Gluu" - required: true - type: string - group: "Configuration" - label: Organization - description: "Organization name. Used for certificate creation." -- variable: config.adminPassword - default: "Test1234#" - type: password - group: "Configuration" - required: true - label: Admin UI password - description: "Admin password to log in to the UI." - -- variable: config.ldapPassword - default: "Test1234#" - type: password - group: "Configuration" - required: true - label: LDAP password - description: "LDAP admin password if OpenDJ is used for persistence" - show_if: "global.cnPersistenceType=ldap||global.cnPersistenceType=hybrid" - -- variable: global.isFqdnRegistered - default: true - required: true - type: boolean - group: "Configuration" - label: Is the FQDN globally resolvable - description: "Boolean flag to enable mapping global.lbIp to global.fqdn inside pods on clouds that provide static ip for loadbalancers. On cloud that provide only addresses to the LB this flag will enable a script to actively scan config.configmap.lbAddr and update the hosts file inside the pods automatically." -- variable: config.migration.enabled - default: false - required: true - type: boolean - group: "Configuration" - label: Migration from Gluu CE - description: "Boolean flag to enable migration from CE" - show_subquestion_if: true - subquestions: - - variable: config.migration.migrationDataFormat - default: "ldif" - type: enum - group: "Configuration" - required: false - label: Migration data-format - description: "Migration data-format depending on persistence backend." - options: - - "ldif" - - "couchbase+json" - - "spanner+avro" - - "postgresql+json" - - "mysql+json" - - variable: config.migration.migrationDir - default: "/ce-migration" - required: false - type: string - group: "Configuration" - label: Migration Directory - description: "Directory holding all migration files" - -# =========================== -# Ingress group(Istio, NGINX) -# =========================== - -# =========== -# Istio group -# =========== -- variable: global.istio.enabled - default: false - type: boolean - group: "Istio" - required: true - description: "Boolean flag that enables using istio side cars with Gluu services." - label: Use Istio side cars - show_subquestion_if: true - subquestions: - - variable: global.istio.ingress - default: false - type: boolean - group: "Istio" - required: true - description: "Boolean flag that enables using istio gateway for Gluu. This assumes istio ingress is installed and hence the LB is available." - label: Use Istio Ingress - - variable: global.istio.namespace - default: "istio-system" - type: string - group: "Istio" - required: true - description: "Boolean flag that enables using istio gateway for Gluu. This assumes istio ingress is installed and hence the LB is available." - label: Istio namespace - - variable: config.configmap.lbAddr - default: "" - group: "Istio" - description: "Istio loadbalancer address (eks) or ip (gke, aks, digital ocean, local)" - type: hostname - label: LB address or ip - -# =========== -# NGINX group -# =========== -- variable: config.configmap.lbAddr - default: "" - group: "NGINX" - show_if: "global.istio.ingress=false&&global.isFqdnRegistered=false" - description: "loadbalancer address (eks) or ip (gke, aks, digital ocean, local)" - type: hostname - label: LB address or ip -- variable: nginx-ingress.ingress.adminUiEnabled - default: false - type: boolean - group: "NGINX" - required: false - show_if: "global.istio.ingress=false" - description: "Enable Admin UI endpoints." - label: Enable Admin UI endpoints - subquestions: - - variable: nginx-ingress.ingress.openidConfigEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable endpoint /.well-known/openid-configuration" - label: Enable endpoint /.well-known/openid-configuration - - variable: nginx-ingress.ingress.deviceCodeEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable endpoint /device-code" - label: Enable endpoint /device-code - - variable: nginx-ingress.ingress.firebaseMessagingEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable endpoint /firebase-messaging-sw.js" - label: Enable endpoint /firebase-messaging-sw.js - - variable: nginx-ingress.ingress.uma2ConfigEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable endpoint /.well-known/uma2-configuration" - label: Enable endpoint /.well-known/uma2-configuration - - variable: nginx-ingress.ingress.webfingerEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable endpoint /.well-known/webfinger" - label: Enable endpoint /.well-known/webfinger - - variable: nginx-ingress.ingress.webdiscoveryEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable endpoint /.well-known/simple-web-discovery" - label: Enable endpoint /.well-known/simple-web-discovery - - variable: nginx-ingress.ingress.configApiEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable config API endpoints /jans-config-api" - label: Enable config API endpoints /jans-config-api - - variable: nginx-ingress.ingress.u2fConfigEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable endpoint /.well-known/fido-configuration" - label: Enable endpoint /.well-known/fido-configuration - - variable: nginx-ingress.ingress.authServerEnabled - default: true - type: boolean - group: "NGINX" - required: true - description: "Enable Auth server endpoints /jans-auth" - label: Enable Auth server endpoints /jans-auth -- variable: nginx-ingress.ingress.fido2ConfigEnabled - default: false - type: boolean - group: "NGINX" - show_if: "global.distribution=default&&global.istio.ingress=false&&global.fido2.enabled=true" - required: true - description: "Enable endpoint /.well-known/fido2-configuration. Enable this!" - label: Enable endpoint /.well-known/fido2-configuration -- variable: nginx-ingress.ingress.casaEnabled - default: false - type: boolean - group: "NGINX" - show_if: "global.distribution=default&&global.istio.ingress=false&&global.casa.enabled=true" - required: true - description: "Enable endpoint /casa. Enable this!" - label: Enable endpoint /casa Enable this! -- variable: nginx-ingress.ingress.authServerProtectedToken - default: true - type: boolean - group: "NGINX" - show_if: "global.distribution=openbanking&&global.istio.ingress=false" - required: true - description: "Enable mTLS on Auth server endpoint /jans-auth/restv1/token" - label: Enable mTLS on Auth server endpoint /jans-auth/restv1/token -- variable: nginx-ingress.ingress.authServerProtectedRegister - default: true - type: boolean - group: "NGINX" - show_if: "global.distribution=openbanking&&global.istio.ingress=false" - required: true - description: "Enable mTLS on Auth server endpoint /jans-auth/restv1/register" - label: Enable mTLS onn Auth server endpoint /jans-auth/restv1/register -- variable: nginx-ingress.ingress.scimConfigEnabled - default: false - type: boolean - group: "NGINX" - show_if: "global.distribution=default&&global.istio.ingress=false&&global.scim.enabled=true" - required: true - description: "Enable endpoint /.well-known/scim-configuration. Enable this!" - label: Enable endpoint /.well-known/scim-configuration. Enable this! -- variable: nginx-ingress.ingress.scimEnabled - default: false - type: boolean - group: "NGINX" - show_if: "global.distribution=default&&global.istio.ingress=false&&global.scim.enabled=true" - required: true - description: "Enable SCIM endpoints /jans-scim. Enable this!" - label: Enable SCIM endpoints /jans-scim. Enable this! - -# ============ -# Images group -# ============ -# AuthServer -- variable: auth-server.image.repository - required: true - type: string - default: "janssenproject/auth-server" - description: "The Auth Server Image repository" - label: Auth Server image repo - group: "Images" - show_if: "global.auth-server.enabled=true" -- variable: auth-server.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The Auth Server Image pull policy" - label: Auth Server imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.auth-server.enabled=true" -- variable: auth-server.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The Auth Server Image tag" - label: Auth Server image tag - group: "Images" - show_if: "global.auth-server.enabled=true" -# AdminUI -- variable: admin-ui.image.repository - required: true - type: string - default: "gluufederation/admin-ui" - description: "The AdminUI Image repository" - label: The AdminUI Image repository - group: "Images" - show_if: "global.admin-ui.enabled=true" -- variable: admin-ui.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The AdminUI Image pull policy" - label: AdminUI imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.admin-ui.enabled=true" -- variable: admin-ui.image.tag - required: true - type: string - default: "1.0.0-0" - description: "The AdminUI Image tag" - label: AdminUI image tag - group: "Images" - show_if: "global.admin-ui.enabled=true" -# AuthServer KeyRotation -- variable: auth-server-key-rotation.image.repository - required: true - type: string - default: "janssenproject/certmanager" - description: "The Auth Server KeyRotation Image repository" - label: Auth Server KeyRotation image repo - group: "Images" - show_if: "global.auth-server-key-rotation.enabled=true" -- variable: auth-server-key-rotation.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The Auth Server KeyRotation Image pull policy" - label: Auth Server KeyRotation imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.auth-server-key-rotation.enabled=true" -- variable: auth-server-key-rotation.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The Auth Server Image tag" - label: Auth Server KeyRotation image tag - group: "Images" - show_if: "global.auth-server-key-rotation.enabled=true" -# Casa -- variable: casa.image.repository - required: true - type: string - default: "gluufederation/casa" - description: "The Casa Image repository" - label: Casa image repo - group: "Images" - show_if: "global.casa.enabled=true" -- variable: casa.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The Casa Image pull policy" - label: Casa imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.casa.enabled=true" -- variable: casa.image.tag - required: true - type: string - default: "5.0.0-0" - description: "The Casa Image tag" - label: Casa image tag - group: "Images" - show_if: "global.casa.enabled=true" -# ClientAPI -- variable: client-api.image.repository - required: true - type: string - default: "janssenproject/client-api" - description: "The ClientAPI Image repository" - label: ClientAPI image repo - group: "Images" - show_if: "global.client-api.enabled=true" -- variable: client-api.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The ClientAPI Image pull policy" - label: ClientAPI imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.client-api.enabled=true" -- variable: client-api.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The ClientAPI Image tag" - label: ClientAPI image tag - group: "Images" - show_if: "global.client-api.enabled=true" -# Configurator -- variable: config.image.repository - required: true - type: string - default: "janssenproject/configurator" - description: "The Configurator Image repository" - label: Configurator image repo - group: "Images" - show_if: "global.config.enabled=true" -- variable: config.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The Configurator Image pull policy" - label: Configurator imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.config.enabled=true" -- variable: config.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The Configurator Image tag" - label: Configurator image tag - group: "Images" - show_if: "global.config.enabled=true" -# ConfigAPI -- variable: config-api.image.repository - required: true - type: string - default: "janssenproject/config-api" - description: "The ConfigAPI Image repository" - label: ConfigAPI image repo - group: "Images" - show_if: "global.config-api.enabled=true" -- variable: config-api.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The ConfigAPI Image pull policy" - label: ConfigAPI imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.config-api.enabled=true" -- variable: config-api.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The ConfigAPI Image tag" - label: ConfigAPI image tag - group: "Images" - show_if: "global.config-api.enabled=true" -# Fido2 -- variable: fido2.image.repository - required: true - type: string - default: "janssenproject/fido2" - description: "The Fido2 Image repository" - label: Fido2 image repo - group: "Images" - show_if: "global.fido2.enabled=true" -- variable: fido2.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The Fido2 Image pull policy" - label: Fido2 imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.fido2.enabled=true" -- variable: fido2.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The Fido2 Image tag" - label: Fido2 image tag - group: "Images" - show_if: "global.fido2.enabled=true" -# Jackrabbit -- variable: jackrabbit.image.repository - required: true - type: string - default: "janssenproject/jackrabbit" - description: "The Jackrabbit Image repository" - label: Jackrabbit image repo - group: "Images" - show_if: "global.jackrabbit.enabled=true" -- variable: jackrabbit.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The Jackrabbit Image pull policy" - label: Jackrabbit imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.jackrabbit.enabled=true" -- variable: jackrabbit.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The Jackrabbit Image tag" - label: Jackrabbit image tag - group: "Images" - show_if: "global.jackrabbit.enabled=true" -# OpenDJ -- variable: opendj.image.repository - required: true - type: string - default: "gluufederation/opendj" - description: "The OpenDJ Image repository" - label: OpenDJ image repo - group: "Images" - show_if: "global.opendj.enabled=true" -- variable: opendj.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The OpenDJ Image pull policy" - label: OpenDJ imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.opendj.enabled=true" -- variable: opendj.image.tag - required: true - type: string - default: "5.0.0_dev" - description: "The OpenDJ Image tag" - label: OpenDJ image tag - group: "Images" - show_if: "global.opendj.enabled=true" -# Persistence -- variable: persistence.image.repository - required: true - type: string - default: "janssenproject/persistence-loader" - description: "The Persistence Image repository" - label: Persistence image repo - group: "Images" - show_if: "global.persistence.enabled=true" -- variable: persistence.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The Persistence Image pull policy" - label: Persistence imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.persistence.enabled=true" -- variable: persistence.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The Persistence Image tag" - label: Persistence image tag - group: "Images" - show_if: "global.persistence.enabled=true" -# SCIM -- variable: scim.image.repository - required: true - type: string - default: "janssenproject/scim" - description: "The SCIM Image repository" - label: SCIM image repo - group: "Images" - show_if: "global.scim.enabled=true" -- variable: scim.image.pullPolicy - required: true - type: enum - group: "Images" - default: IfNotPresent - description: "The SCIM Image pull policy" - label: SCIM imagePullPolicy - options: - - "Always" - - "IfNotPresent" - - "Never" - show_if: "global.scim.enabled=true" -- variable: scim.image.tag - required: true - type: string - default: "1.0.0-beta.16" - description: "The SCIM Image tag" - label: SCIM image tag - group: "Images" - show_if: "global.scim.enabled=true" - -# ============== -# Replicas group -# ============== -# AuthServer -- variable: auth-server.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: Auth-server Replicas - description: "Service replica number." - show_if: "global.auth-server.enabled=true" -# Casa -- variable: casa.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: Casa Replicas - description: "Service replica number." - show_if: "global.auth-server.enabled=true" -# ClientAPI -- variable: client-api.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: ClientAPI Replicas - description: "Service replica number." - show_if: "global.client-api.enabled=true" -# ConfigAPI -- variable: config-api.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: ConfigAPI Replicas - description: "Service replica number." - show_if: "global.config-api.enabled=true" -# AdminUi -- variable: admin-ui.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: Admin UI Replicas - description: "Service replica number." - show_if: "global.admin-ui.enabled=true" -# Fido2 -- variable: fido2.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: Fido2 Replicas - description: "Service replica number." - show_if: "global.fido2.enabled=true" -# Jackrabbit -- variable: jackrabbit.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: Jackrabbit Replicas - description: "Service replica number." - show_if: "global.jackrabbit.enabled=true" -# OpenDJ -- variable: opendj.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: OpenDJ Replicas - description: "Service replica number." - show_if: "global.opendj.enabled=true&&opendj.multiCluster.enabled=false" -# SCIM -- variable: scim.replicas - default: 1 - required: false - type: int - group: "Replicas" - label: SCIM Replicas - description: "Service replica number." - show_if: "global.scim.enabled=true" - diff --git a/packages/gluu/flex/upstream.yaml b/packages/gluu/flex/upstream.yaml deleted file mode 100644 index 0684f884d..000000000 --- a/packages/gluu/flex/upstream.yaml +++ /dev/null @@ -1,9 +0,0 @@ -ArtifactHubRepo: gluu-flex -ArtifactHubPackage: gluu -#HelmRepo: https://docs.gluu.org -#HelmChart: charts -Vendor: Gluu -DisplayName: Gluu Flex Cloud Identity and Access Management -ChartMetadata: - kubeVersion: '>=v1.21.0-0' - icon: https://gluu.org/docs/gluu-server/favicon.ico \ No newline at end of file