From 6789fe9eef9e467a10600be21f27561dc7ee6dc0 Mon Sep 17 00:00:00 2001 From: Kristian-ZH Date: Tue, 5 Dec 2023 16:00:19 +0200 Subject: [PATCH] Configure Basic Auth --- assets/metal3/metal3-0.3.0.tgz | Bin 32183 -> 32975 bytes .../templates/deployment.yaml | 26 ++++++++ .../charts/baremetal-operator/values.yaml | 4 +- .../charts/ironic/templates/configmap.yaml | 4 ++ .../charts/ironic/templates/deployment.yaml | 42 ++++++++++++ .../ironic/templates/secrets-basic-auth.yaml | 62 ++++++++++++++++++ charts/metal3/0.3.0/values.yaml | 9 +++ index.yaml | 4 +- .../charts/templates/deployment.yaml | 26 ++++++++ .../baremetal-operator/charts/values.yaml | 4 +- .../ironic/charts/templates/configmap.yaml | 4 ++ .../ironic/charts/templates/deployment.yaml | 42 ++++++++++++ .../charts/templates/secrets-basic-auth.yaml | 62 ++++++++++++++++++ packages/metal3/charts/values.yaml | 9 +++ 14 files changed, 292 insertions(+), 6 deletions(-) create mode 100644 charts/metal3/0.3.0/charts/ironic/templates/secrets-basic-auth.yaml create mode 100644 packages/ironic/charts/templates/secrets-basic-auth.yaml diff --git a/assets/metal3/metal3-0.3.0.tgz b/assets/metal3/metal3-0.3.0.tgz index f0c239b1880649bc088973c9d6fdeff1d135cd29..0b5a59deaa2add51e48e3b0d4346f525c229e2f1 100644 GIT binary patch literal 32975 zcmV)CK*GNtiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0POvHciXnoD2(@SeF_|<&q~s5Qj%{;wV#~*b8WZrud(A}JL$9E zwr>KFkc65fSOB!GX6JnNcVPhVCf+1p((Y|`tw!c$FaQRFnZaB_B5|-a*q>uA-31PV zukQXD4u`|t?QQsXI2@M$9c^vyd^OtM+1lP3ZN1nXeKj0yZtd=Vg@*Tl%hHtyiTPK< zTens2++XCvF?~Mw)P(3FZWT zIxHp}OU8Q$MK~m5RQZULmM7^}l z^v|Yt(wACbhnQ3BPg3C7-%Zf7x7xrHpW+@u9*cY`;l)|NCOB|OgeL*{px^rd?|l%2 zUy*EZ?Z=Inn0HEe_(XV|#=6Bl^qK@Af-jJqV~J=aBn|?Ba1bCiMRHD1o(51vh);Yp zWgHy?hCS*jP;)6`F&+$NRL+x$>#=a)Mc#CPxx8lla=`KRAjCovK8QK{jd*|}upb3r z;IV-5ft^>6MGo9?#nr55I}OdrMNGyB$8kVCth&)F_3%qCs=v@>Cg2JO2@&_S0krV{ zoz3BkGXLM*eDTQtAL4p~F6P86EW-t;Kp4fClSo$ah2E1qXJB$pxPDFO_ppWLlQ>|D zP=Qe_Lu~Y(ph+T;&xnYgN`yU`;2>C-7ZHvYNO3vp5rL=_B$&Fro@R;T9zsvh(J5jP zx}H;S4vilHBhNm%ra^!v1d*GV3F7yV*$<9R$Ee@$0gUT80hA>}n$2ofiZp+9dkEEY z-!YovK#)2>ek4LHepfgu>|)NYsA5YrnxTjQ6GYDx+dTcBLo{JbKF?Y+-?p@1KSUmm z@q`9cF5u0Rw-<-w5-1cVLLxz=`u?fp33-ZWgc$b;2j(s3R3HZXfOIOgtBKtrFqWSF!7SuyHk@M^$ zxVM+cdG@J#L6N>CfFMJOe|72EDB8ach zk5vEEaGJqUQU$Dxi#O+|jLR|F9lhM?*;R^tpA#W0li)0ogd;2j^C*@IB$avzD-7tA z5+5DB-am!!?Z+HPGc_Y-#tz67CxJWzSQ)0vt@)8KtJ#n>EJWY7nzqA1^O`M#c zn}u${Yy1|-V_}FLp9D0dssn(WYB6h{2xwlxx9tOQg*d`9qE`TMXK3{8raRhw>240) z&EZDwua`rG%G`_36z~j(6T>@bBnh8lwMZ-%tmH8sj#Rg?=P9hzT;*RovQP?RxM#)? z3qfZQ@zu~pRqa-_SZ*Q5ZclJX47VZZSc%35-`TaNdW$8VU_s9Hos*oHmx|vS#Yk-| zNg$~cF`pnWNR%Y02oylWO+f;nXT8uw!u7M5`9f1x5FnmJmO%@J+nfohDBQeTrUZl| zztlMmD)P~Q#Zn8|h}=*iUGy$ebfR`Vi_^J9NqvySK90y>pekluL$SVCuWnC zl14L;&WqWw3*R9%B)z<5lO>kpN9N-ESl1p;-mX|%icRZav#_G zpXFLw{~zWgQ2g4J@m-mMTGs#8*3Nc${lD1Vd0hVwaeewU_@;Mw6RV{PGOLnDjUokB z9k=(*;PdC+r%#R%dQe}}jH_PlBPV;P)HCGjqa={~-S^t8sNPHkkAErcHuBK!7W|~) zc`}{S8`O9D$iO0zuYUFbxqVKQ(2Ua-rb!Si(C-NjwBm^47|?cmKM@TZ-j}Kc)dhhj z#KTHa5G*9<$5fKmot;t=_(F-N$SQXrm{NhBO%__EJ2_YHDvd|!gU{XG(G+nK5G7s# z5RXL?(?}SD8Qh~XHAsOPjRnGhyur3^T-7VZv8B^=DDA^^IL#}y&$|qFAW}GA1M1^f z-RCpIF&zXA#68m^q`$Rz7H+PHT+C@Cr>Os5!uc=JFTv7{cBiiDp9PxBO{Q8O=9EEA zBuuEG4*gbuCnTt!RCpV>t9L#0jWVsQVN33zJOR5vPdH+Y7x|r zHHLE%gszzDbEGl)^a;_(3le{+JFaeU>9JMB-x#27j!I1b_R^C^^$f?cTU2q=Bb`s5 zDn9ua`aNNil={02McZC{XR^?MEX5d|sB*kgmAz%e%AIs7G0#0X9M*=`=_{y1{t6U_AZlH+c10IxZ*nQ zedA8>W$znThUz!tbk_Uk|Ms4s_n1?b2y}FCD0;5(V(7WlCwQP==j^whdnG*Plfhqs z;h6P*cDQ$NeCUS$eYDYb{=c=gSz7<27n_@p>;ECHC+L(DPJU0QppuB*1z7c!G9<5A z(eFo}?sI}7Ce5Li(iu5RX7jxDSj)p!=TaX4OVD~%&ZuM{&heGf?#zLXbFFj=;jx&E z(MOMP>FB2TN07mB!JKYw+xCc$BawJ>C7^!ge&KY#vk2Y@5vLiPq;+K z8f@>#o{3AQzV?U^TEjGM38q&d>6=3*I9bS3kbEnIuwr7ZV_K4j82Yk1@`8YToE96x7QniQ^Sv2 zaFk?i139~dPle=klBmx&6h%dfVzT2k#j?^<^pB3?Q-LP|d1a(wMfKAF&s=myvXL_j z!c8KoW{bFTIcjusoW`Yqog5pezA9PwEyAg?CpvA=k(Qom+$=VUeCi4{r7)6hi|_}|3XVd?)38R zxOT#nGCZ0PiATLl8u?>%bZSoPPZ zgZjfkUwa0+pH<0xR9;2gZ18H}~G5Wc1{`%|Z-r?Kt?`V+UZ0`A2gi9(&NFv!f z%ucZBVE?MqXwx`1fo8}{lcqWX6uILfquod38s+>nL15KeD3}?UHOPULGj-h6nsdz6 z07`J-P6_wo`1HfU(b=o7pM{r_gfVjb=P-Ex8-4xBJp7z@4MqR`-$)^r`Q+vN>z2vA zpY`I2Wfdh}u(Y7J%IkTndO2^ktY)O9y1Ew@qu1;jEF$rYW3%3Y*C_UUmPDF`Wg^hR zx^K82H7lgn+AA4KH=4}FBmL5NQ3|)GnCp?cL#Ntwh+{P|oT^VmGST2Ps@dT@oT3>c zcvSc#opSTZKlhH`09m+dReh5=FlZkPFj-&WNLptC1$o)&K5H2ktJ}+S`pn>&2&Eii z?HLvMD4>_R-%}O@?3zY1O==#C1Pe&-YXswIhkH)&)xv?6k-I#VFS$t?K=~uJ8BC zp5I@3VE#icv;J!%uTG#&_M25Aj|LvWvvj5+U7sJQ%p9i^~AQM+%b%^Rkou2)Gc%bwQXUcepr6j)5 zI20r=z+7n~oZ?A9gpI$zLU9BdNro0I;VAVsE5&yef-RIp5M!?NoC%rH2m%h2qCp}* z4J^r`F!G@z?U5L{D2t|WjQb70Ad%RM{Hcq6!An4BP~T!WEK}|ndlfVfm#A4!i8i1GBGOqY5Ph)-dXW$Q?kKyKI zMup@Hm&GI!i6AcHvjG)XHdK1z(JD5bqN5fg*ioy)>Ek2_PFX;`#TXq;PnbOAM5xa9 z5R!N{M*X3??GF0}z0)KJ&WXo~6l3)Buf4qIml{j8gm}MK_BtD*{&MU6Ua#n`p%?wR zi2xI6m>gbmT**w|+8m%3mHuU7W%#Qa+fP6e~u}Q8UX~5D;z;F8aM*%>2Dl z7u3CT;w7BQ#XgH9xsk9IcoOZ2cY<&*&JOLJA2>^5bE_vRzQaMlu1`6=q5+waL*d~- zTYOC*s2YYe43%oj@e_oQ&sl7LJ819C8xw4Y{kKuDIActHPXnT@cQ(>77d4}WLgOnA zY(0kfLdA_a5iH>z$>!`Qf)b&1Nlr8$@nL2pOLr4%15Lk%DU%EZ1jCt(+S3GBvLfM8 zmS`U3&6%2g8`Y8s!d<-w;y^G&BQ@!2tMTSI@`$jCun90D(UszYim?cNP!muo17brD zH7XnFf#orcsNz|0G_+s|@)^3uQK2Wf&yoVyOigY&M2kl173}|(2zVZ<1|p*NBg_}z zih(!@*_E++COlZ63CA!tQ%N{_nho_+*8mNvOefik6QG^Y{2h`I*w<+DI} z>lZzoNTx^(%!W23*3W1yq|upXph7WEghG6iy8(19F`p5+fBNp7qyhZ{sP&X^k3>>& zS_JWxPt0q_(0=`!J;?&X?fUxp*Io}#r!;~?4z=3Sm71PR^bnk5>2TQo?&#(4FA&$% zD*xX>WKfIzzct(~`G0JVM%$0}zX!QSF8YB;dl+FAarEx&jnd$)yeQ{H5Nqid<0Xgh z{t5GmBK#%KOjq%9^jUFhb545l_Tcct>D#l5S6@G~hjTL`3r7HDr&oRV^JnBR^qXK& zjOF}Q|C6g2qYJ)hKM#L(BZI`}er8R~JKk2PH94(=-VPnJf%P5`}nyB)%jF zqba#oEH;rOi{mUf+8mu4WiAchbt4-t6 zY#PrG&)y&HSIi{9?SjBcEhERV{1Wv)ed>SuWK`5=H1f#}va=uLhSsIg3^c#tbM*Q1 zr%$f>pK)34f3Bd3tWRTwb!n=h+j$@A0-2<8RfmOo`u5<%$=>l{Y2;$&cU=Mj>Q|rV zziJuPY(zKeedAwMxW@Nu*PT7T2iRs*bwBsto?Pr5ogAK3aiy5~-8%cV9j;0qmFd3< zmy~0rw>8^Jr@H^13M%c4k2YVpLwD$o#xI92hei+4mXsXN?)OmY?9d5gg@rR^{2FsV zhrViK{B?0q9=+)QU9T17zqKPn+vLBU?Na>b=H_tgG5^J-WzhucIMCJ6?s*{q=uJd3cRE5#F4H z_>1)qTl9RLdnDNE4y;XT#_IW;W&|@8Jl} zX>Jwe{JsUKE{7M%ymcd-&#^$frjo} z&Wl)dW|r)`vo~ff4osuVEA&fG#232OT>mj=H;b-TptkkDJK8Dhf1}Z({`Vl)7hL~9 zLl2_ksXmcN8b=A!spTzQvP%+iaz)8?wP;ZZxI9=D>RmGVjd)TAgfzkb0`tG#`k&Cq zr_rpV8K~9%yHoc6+X9pb^UMeme>FGqy6_`t}nm- zGcn-bW%cI-n?Lp1|7ykc4@uBM9Gi4ooezOq*8k>G{+G=yr4l@@{|C7A`ubYOTV1?4 zN8?wilS8o@u?&PJIQSsuOfruJ>U~Lgg!uyXA&p;O|J%<4&AzhYgvC+$lZ}zb_CmlXAU(xB( zI8~!i1*~5l!a_~P3TPQ}>w?R>1{HFLjCytx*x%cKefaL|%^3AReacbF=g;H8K;0?h z^7->Xn@{^agbof*-@N_jhaV5mP7dFEXa|!HPzuG=_jclioU_QmGZIPnlJJNGxdzVm zjt`E`f4sXEXhbE);S_pdlHeVl9Gt#AI=N_R!P4~S&x5PcAou;z$@%Hw{>9s~u8@kP zp20giJipjGyZDf~_3s~^T^xOXw7++8_~G5@!QRE;!5H-++_G;sdtms-IIh^^D;y)z zvg&uTdw*%h_#bkuv;VJ}45nTGFU$X%TicKJ{|C8hczBj{;Dga+Kj`U)xgVo{!Qw7B zk7a2JcoIn(5?9cf$TSEX#B)5#xjpTtUzk+fn&0Rmp9BZC^s)Wxl(PwF9VS)E7>&Q( z-qz`6jalD*Fv-7F2%p-4H;g-!eO+f5_;!1H3vL8(AaNKFFUxRSxSJ-OP?t6KX=f|^ z?e@1XN83X;J33s8nOX~iXUF88nCc4aKg;R2A_Hhy|1VzbmhJzWJ1-vd|3Ao;U&1(! zMW*T>q|;rX*gK&^^|4_XP8{Hf6!?ds{lZGMS$`>WEGuyeoJ`meZ&FA(f&Ilf z@mS+7h}k*PS4eb~hpXw-2HfVt=phB$_nd{} zd~CgrN=to)OZRmt>_T*NZByr`d;9m$p3S(OcD4x8G3oPdp$7DdL_`P> zi1IL}m<9tN?nUse-s~Cu_zBjsksyf2PD8H&X|5i zIE7_d@yrxh$zzy%s-#Ai$n?|AUXf19>(J3Q;*Tb{%Lxj z6YSHw9&IQZ^QRqbU0nWHZBT{L4b>e}dS8a|;PRy?1r`kQ(H&xG=uON=erVrD!J;5e zFKrb?E93+V>g^?Ro?j47u_6P!aXb9u3c9xg3{y3W7~ z8hE(B25MEJ3~VmM38;`Ha!kgdS3{6!hU1rcPN`l`Vj(%f;j5|~Bs+t`y8)X?CZta| ze^r`R$GLiy<4I<(o_P>oc9~2FR2d{3emi`EJ$-sMz8bnO-C>FUmtN|;54^0}2jH+G z6*q!Ao2{=l(EPHXtI=CwH?w1QLW@R0mQVx*R1=94kn-YhWv4v}9S z$hU&ewzIWmMDy6xeYeWu@6yzk>Zo2N$l93B1kzyR}u0{~JB}e?8FEDgM_4sNRDa=x*X&t)W3ZIfo~Zqw`CT z?O)+qVf}L!tQh!ju9o#b8ohW?UjJL$kM`dOxmNW5x)aCml9}v_h54ojnr)G{*J~8-N*C4hq>0^|99p1TeS`RIb48m;rm;;x81uJ@cQ$=!umI@R~(t%GX7_0yPW@N zXLs|_|K~xjlK)SEI=|ex|J|JAr^mO3a#KAqwHG=|w!pY(Fx0gov=!05R6LK%@^=~YS-DQB*^}n?LZ*9LAKCb_VxE^}_ud}jC8P}?ov0k=StJa(WuexZ_O5QGC zdKTBeR$u=n+2;x>K()rK!?#^TW*9W;O zm-Q+0E7o#!fsLz zQK)t`Mn6AQuRi_N+y~bR^z+k|Mx&up4*=#wk)gEig(u|dffR=o*8dd_sE;L$W=1g5 z2JA!^$!lN)E$e@CXDR>J?(Xj6{{J9X!T;Y6sZc*n5!z}K;QN#ee$r&HpC^O+&>5E2 zd-t{*V;U^SML|{N zLNZ2u%m=P+`NOPo(#Cv@TKYmE7EKRD{_+0V;oile`9p`s!XJeLF;taPS5TiEPN!h% zMJFsG|1pzVk=nLxZYw_d6HakW65-{U{?d$m&8v0)ca>~KXA$FM-8NeF|E*H|-{{5e zWBl*KTu;y`mXdH?GhNTKu73}nxip%g7<-p^MugjYqU&FaBnHzP5_1v+Xcn-E4pgJj zYy)u;U`ekC@QvJk9QnN`C?YdmVfI$!{GM!^EH2)>Lo#4yfH?9oTZ^r4Y_s#$9Jwfj=rz{cZ=-^QF+?X>Zcl2E96Fktb zbM{-$y%HYt$>6WR6I$25$9*yI5+PY=xnpq;7q`p*HQL!84$J!g&i2-0{pSa{9LMPu zV}L2SktBlMbUFPO(1A^>dqAKddRgjUSzNCOe-{fONmxOTWuZKus=%3%$jt>66v}^H z4c*bEJ1S`V?-f zLN=g6{f>AmKPDH?IZ5IpgvqYeLB?^Xyj|gG-}X5@23}p+p#u#bk_9fzQ{z zT{-C#`##Jr4o*3ZB;orkNWx5t@<}QajnP{xWZ?j%?riG%O|VGEx7g~(EPM4l|E3=5 z!mXH7#-ZlE4PBE9g|(1eyNN8}ahglY-iAm%fjitIOPG+3&F-^EBq8A_5xQVH6)2sA zV%w%3FuZ<7rumRv-L8ezv1ya&0rwV&oh&WWyUt|kUifmo!Z3&c2zSlvwN zcM3SY&EIMr5;GjC-B7j5iKpg=aL%fxMh^)*Ri73bKFod7+Aa+V@{O56u>p^yReBUY z-&uC>x{^xM0Pm&BJ_U^SX2o&v?TXQl3u>6I{$Vv)7L#c2^yvN8dEquH_M*TR)s(4W z)L*1^>Wj<~?VTQFfni+n8cB)B2k7MXyWHJU%TE<@CKO!PG1QG47D;^5A3e8JAWmXV z1c~(4R{)IEOE^Ld+`wEoHX~fg&nyXiwN$SN2g+cxi2jkn7P|T@L12KDC78gH6}yEn zeh{#sq(3LB6_i9dcvsr=jE$`5PqP{FL*usE;@?PJ`PE+j|I8+2~Z;~95t}rrl6b}B>%D=wR~V(E}uumd==K} zc}%>*y77siTv4{#R4oHKE-@f|Rj*nEXD?az%g;*K?4Q0Xyl#20ViFsOxHA{^Z(i=1AvVBX>k7YwfbggCRd;I zJ>mM-((Yc_)q_R=7QRrsetNfVs-{TCSfgB_T%m1gS}AyaadCRC=x>=6t9y^My^ZQk z2G}Qnv$dCtZK?MJ38sz?j@+mLIY~f}qLI!BkQT(J65$|V*J{5Fapcg*k#pjN)b|4d z#z7@-cqA@wgy~$((?wRv2ebK{Fs4}0(i^syRh*-!s^p)P2)u@WEbV467L3W`z5Ttq zg!;1n&&I{SpMTo<{B$L@s)nUzC&~?o zjzZU(4Uu!^t2JO!*3dsJpUCvUq-GVX=3I23H#v}b-yME`)O}M?Z`a(0?XzZ?Ve2y@gsW^c{l=zP!L~rPDm>Q@=&uGJYk6hx{&kgA(C?pt5!1-3{s4% zH+l*Wl+;PWSS~gS8m>Z^`h-_*?tQ8_6R8k+TK2&j{i$*w_D+wi&Sdu!PNsyDNUp{5 zvm|8gZ9hGl>c&8bkqluJQ{s_=I;J?GBv=t|4P(O*Qv5~9knqKZ))kCWk|}X&cSIP$ zK`HwGpT9jB{J?5JLNAOkphe=4L~;X(#G4~5th5XkC^y6rof0A4%$4cq&0p)bjPDso z0#?wUigMI`YJtid@Gq*iK(f`#hy9A6Q= zGhCA(aJ1&+qieiSqhKdaFa8*F*+{L{&T#Se;O$srrU+^lSxy1vQ9%OJS}#!JlGw%`CGLtu0b?3W;0ax8tu`nJ2;DdtT26>#N573F3v&rb^`(!KOijC4kAC2e`cSDbW3K}<{C9j0Nw(4G<2)xep}s>3(iV*N_#Pv`IY#t58FJJe#NYAp1jG zujh%g%*>gsd#TijqQZ^tnK=NY6s62BCoSVbwP%Bsdb8 zUV=ya(M;8l;tY(3A!N@ez$SilUHlh4Smnxz#2NTMxZuw7)xgdyWczz@Yn2 zRCnMc3oRw5)mJk+5Hw5zi6g=iahwE_%DK*7J3G`_$-6M@J!=C}nr1*yJYNXv;XrdK zAs9!VV&6)Ah+~55ESFdyL9PhL0Sefx2tl|dN3tnXtpc^gImeOZOY($lAgEGPBX(9B z2@tIMLUPLDBLKOE$qFICDZ5%>fX~mIqqpyE-;qu=2y9{zt9?$5u#&WO=-n0NGQmNe zFcArfBagu0KSrnfM-I7(!8YZSE9#LA6f>!fV}V*A3M!ZoV#2}x5P225j=tKa=+8JA zX1GjVk5y*H_7l!{3sBV9#sQXUyi&IF?=xr(dtS*gqt!l&(BgM%64RL(o$g%ELPDD-zWkeK7mon82MXSBKU$_o9RnkO1?{lmJ} z+6MR2plSykr%NNds(Ik!vVQMG2uaaYXv~mLP;E7*F1q4sCjnf)4C_2 ze_8X$j{I5*JP$e$-@CInT8Rmmm+ppYhAsQ@??XLH__D;)uumzO`C!S5WvMU6=CvGC z&Me|aw>>YPbysu@R2l2ZfS!RbiTd*cIL!SfSoGXjgs6ZF^O|@S_*{vz;&s63)yn#R zM>C_w?=7rrAA>?G!`DoU<^Sw-8Alw6JW zza=GW=jb*!0WHesoK_~pe7P+AH|Z)dFL<5h7Du&XQz>EkNB<-Bep%;}ff5rf>^ z=KQ1D7h46`=H*vfY^AZ#`*D@z2PU`W1!`;9u`9wk^?mJUqNSjP0+<`1l~f~+s}2SV zQ*pL;bZ`&mFRN!N@b8OdH5!n)P%}vda6fCPQevh6oKoFY0fjRg&X_y^+sbPi$vQEU z3S-3fH_()FAx)tV@a1C6{^_EBvIP7?v`$O(X?hJ%>uIiSl#-#3KmYm>Y()XV9N{1+ z>f6iXEUK9Wl_ab+xfR_hm&Ul#$+wu}pc*dp$Bs%=#Jc8_=K0rG=2BVzPK&>z9XA6< zjc`(9TG3a_R-vzeT#*`yy8@@DfCPM#>cM&PbOGzszSIELv@AgNF_tOfkJ0e&qrY$d zedq7He;@sA`1hT^4gbFTw_%M*N?-L#kG>q#AJ%zJnCGLG=bJ6hcUqqBHa{QzZP@sH zr{(!>@3G)e@izv3As=FI@3Bm$M9l{gI zoEeD-hZu$i*de}oL!z0SkJ0Y-t;Z$_CxpM9o|-d<1I33s57tp6$&By~0|v~t_V7Y; zbiI&k+%k)!Ra|R%-^7qcG)%%=D*(I^V!_1|wr|WO^^yQ{lr8kean`LCOZY7z4ueef zIMluuuQj@Fty8PrEDK|+#UO1@Y8(kT__U+&y0BB3QdpX^<$z+|3=;g3V@_mdX?k7W z0u3wQNKYWO@vIrH$TlT=Fy1spjk~D6I;{fx8s;3=oth)WO^h|}zNZ*}UA-2-e+|s* z86?Cw5-gy;lMjZizJz4F`fRn>i~6$~1Bd=WexMUNS;(esz1$W02SLxwihpidWPZ^a z+onE7tFtlci$>@N`kiaSd{RT88Vmx8)=)duhWG|nzK3J%QCUAXNDDWBhGnTK;TJed zmlfZ>ht^y;knO+)ttXNcs>N2DarP&4~6S#}Au7FC34G@h}{cr<~HdL2K ze;c}JPvo%44Np4Ynfp>$t%T=CfJ9TqjnAz{8gb$$o>6wVTHb7m2$ZZqNen!-?%V-I zEP?|Mun#aFlpZ*}fTMfh6((Pn+i9MlOE|d33!!?Z3+mL!YTXsQ^QFajR|=l!(5Eg6 z-k(vA8hvrisadn>BzLSQ7w)B8*etcVVy~JjWE>3$uvwl+)tVV_KXCSs)XFBmCpb{t zWAm2MSJ4Pn+z)c*b?AWJMN)HEBV4U97=b7|D6`}S`vzo}f}}R~ehbLPLvMX`SuM8b zs-yMcpT&0zv-^fd$&H;`P!a=rNl<^_ldHj%kNb7U&H0OQgwbT-KuWNHMj)M0nFpm7 zY>%vT=-WMSY8B7NDWMWe$Aaa8} z8PptJ=C6)&ySnC{Y~)V*Dh=}a{`nD_BqEJ0gn=23;Xhze9lHEQx*O8y93=P|Zk6CG zx~`_lD%467u#&u?H;~K?NzC~kwrR=+Ec2T;oQi(!p(_&kj5}6wOnan#eJSB9 zQL&MBFcQhc#GRRu%Fpnf&TKaYv!d@8JRvsl%=FqY_e3a7nnpE8l;tZVKE=jY4lyNl zUQ^MzlWmHpz69YE2Pd#mt=P{4(>H)%_BywU@pS0wgRE6el54Ecym4FuQ5-$QQ8L94 zc+$3nkUhPy6ybIt?G7;SjrgyxYhr@(SJ6>M8)K~$kXz?PlITMB568Z*ucP-cp@%l< z-+J9PR8iCWKkMdoeI5No<@}a?U+%Ovu4SvGL;usHi{Mos`NXeeCAo3w0Q9~_uGJ=_ zuaHJZAeEzPr?)(?W@G20k+A0as~8DGeA7q@w=^O)v|qCOwR(xLE9w(8OQ?^*g$PnJ z%-OY$er8ONykJwW%V`J62`QvcTHU|9O>bkasTNCF}hJKf0gPByg#tcq88r)!fwv0Y}?&>mN2C_aAJ7MQ)w32{q zpi^+d&+gQ=fFmEBu)`bTC9;-lw<@NWq$1}=>#*p7xFidEG#$qQ)zgiE9@fT3(va-= ze!V)il&Txv&SfapLrp`1u*?Mq0Lrz4d5uAyg>)P;J@{A4OcH$_l@7I8&viXC!HJO1 z+fit&I}*U)x{X3QBbq4|`G{Hk>6EQGHBD-+W2m|E(Iu&5c};q6y~3IZ!aGF&yfd%e zHuMK#F9qQU;?+#ZaUq%jBHAWo3VC@XBxI~0jmHq4f4dN#>h<8DLe+!D7IjLN&S}AQ z0+;+4vI#_c+%hvb6inD>NmQ{vrs=bnHQZtnoD>G6;^)2q!%wL8bj1TjwpNrlKq8MN zvL+EBjxu(j^inQIMcpegCoygTQ<$mRmmpJ8t`bc3iw)B`W6a;r zk}7wlvRoc!bWPATI0;U4?r2*)5@CT%7Pl3*7q1DSC8YGWc$RJ>Il&6sJu`i(q@@~W zt=BnAX7fVAUf7}}r{pTlj!w1gpY9Wt0NXuwn!`hGv6I%qLWPk$Y#*bA6E|yFh)Mbsiw%pcXUM&O_Av7NbP6Iq^IA(2iwd{0|+zI_K2JE5#$OqW(Kq!3IKX<0;SzwhQMs&?oVTxc&qA%(ip z11Px&05Yr;j*ZYdIvjNITUtWQSZZNExCe|Hcy|Lzg*5nggG}od)$)R(*?OU)O@pRh z4MBB}I5;`lFYN?2djbUZO(B_d+xqH8;WS<;Cj96$Jsq}5wk$@*o_$S&WQJUb< z>D4x3T>ZP7f}~UEEEULzrY;nkny}hqd3^ye9Qg%kI!w|+0$~*S2@V_~v3H3`bVWIf zpvFKm$z3y;)YKz|B{ELr2A~S3AOw4JbadL}l+uZALtIh1DZ7>?!<@6`%C9theY?si ztM;VLKe&!JsY#4E^Ak^^ql1*lPLB3JM*T4qxt~;mv60MPu0f-G`-@Ph^)C ztSzucqQ9b*zViB+A0Rh20B!zAwRgLVPBj1mB={W7Q& zQ0836yR{mhGwChkV+%D)#TD=eBj1td-!cr zQh+=2Ueg_4ZB|rw1;SUD1}(I)YG@G*Wa%gemJ4w010C?EUTOr{J-VkZ6MrLuM+aI* z8ErZfD$&c~raSsS8ujepyA^C#iqKbAx-f6wPdG;#r^`dUJ73s#ZKtCkR|kUQ@R&4u z$hHlV@q4(fJa=x~CyFwiNbdssd!{pao}VAo%Oga3?(@46{o2B^me>P02#;Bd-yqOR6M<)B1I3_3EAf5W!oPF@ zxThD3m^`(hb^WqJ0Rt<(`wDrl)ww+@Yui5Ntuj)_h^l2VDesnew<}K2Kgf40#SQ>M zd3Rbx3N%6hrJIP(ZrepN_;6U?Pbn^cA@Rm{PuMe8U zLr1mK_*|iI+qrDF26gfty-V_Hi56SJ=ck`e?i_&?!ni8&d0+BuymJIQM_N^)mwI5f zxn6ce>6X%#J|lnM)rHya;pe%}bRAHU)&uui7dsLw%ff2_Efd7M=|tn+L2Nq`rX zUnl|Fn^!z)7;*5DCH~vCVy?zfnQ>SP*Ty=?xQ>gm?%+`R9RQ+Qcka5H7TMBkLFFj# zfT|W{g$s98TB+uxd34Y<$Xv(WJr(HPyQ2d%6DFH7^BZhP~=@ zqLyK5u0oBL92TqVQ0F7zZtK_9RHM2DpS9~$BXmEts?lxhRiiH3KyxaV+S=9VPCXvM z$B;6exY*Y36E&vlb}Cr2H1QHzcUGPl-CK!bb+s3HMXmPshGMU%rQj>-cv#b3x)|NA zd~w4NnHsz6moRRCoiA>D7ZrKYpJB3AC~b`Ht-LY1n-a(9%MWOqou|6OFIut6FIZf4 zDyS^-uQGcA$_s;cv-LLD243pQZR!J~j!_k@b%JZL>Q*bbfowJQE7c1|9muq;%g&QEYRUJkh=&`Q) zFlwnlj2f#DqvlG)sJ$97>PF4ARf*A^RwnL*O`9NIRizkpF!)tgNL=cllEBX}_3uam z?_3?R5|OSI5}Ww%QVo{Q)m9pyR@P7KP${uVcweiABI@EOe1EkR(K_`M(F$(H-RdeX zb@JA=711irxUIE8mhijF`XJ~IYb~M<{#d9(3Nm7or_ z7*U6MjA#|o>EafCFSQvFy3hKIXoVV$Xr=L5wN@iqw_aoG=vA-V#+r?-Ff{_VuiJ>a z)^0>Ag)wxl)q~coKgO3(y4gUTIgIK65XaoUN^LGxWB3&9v3=M3oLS=~r4`z8hbfE{f^B6y`+tS)3Ey z+4j(Zi8U*iw#UA-iqz<&cCBCRv!Ne%zE;}QsP&6~ww}DSsY`cDdW{OtEsB9QZR+>I+*VOwZc`le z%dqb53dubc3q^NaFtk&@Tcj=U3+W(Z?L|7umgYjFu`I_VBPx&&WjfW^)F9m)?b6tx zdV$!fN@(n$YPXk$F_D~-JE(~S$=OY0PobF81bdgH!j9}taC7&o(e}>P_SR_Y#qQ{<;pU6s_KUC3@F4~u5fbyShPQ63 z+_}HVPe%q$VE~AjrVZ~ZR1HEa;(sV z3G)jtvzL!=7FT_zjvy_}vncMc&5)-4Rp~BnfBf?RD)sZu_6LoEV%(2zXznN#4i1S7 zI4K1uo{aq-A+f5kS`|S%B)BOuJjb$Pmj#=u417XHB~-;5h)Bjxg17pEZo~)uF1Wn8 zKm)Z4@WmuIPHO40jsFG4np`?8W_PaD==wpaD?v7J+UxtLb?D0HbJlukmxFkhYR}|Zr*pR|z&VT3h)tZwdsY(j<7N=| zoU7xKrB{He6Q=MMX~^O+@@f|Rz*-?ZsXvQ!%wF=toEK7A8@S*GO)-_Og~E-hVyqmj z5$h7pD$`IxJ>Ki58~8b@l+K^g!1C?t`+H}^T)1#g6&q@ds@#qZQkkD9&dT^hu${DD zcrHD-ovSnq=_SSS5MeA)+N25^^I*>159apjR3DQ!xo|kL9L5I3xBk1q946v-cL?aOdwp&)_7&B?kn2U{tZ8!CiD@d81(@y zl|q!d?Qzr4Ff66xKRhG=nCir{2PLol0qdYl0;xdiO0& zELNQp<5^|X^9`kLknGY&Vc4-eNkr;mQ(G4j^5Rf!L~?QBQLJ!EVISejkz_}qT$aCE zQh=*XbZg)f6&JogMWFV)X)NdU6;mU2993Z*ET=;XG+dVc|T?J_UJqUu?nw^ zrGdNap7n2KK%t>0heBYgm9xO~E+$|lLr40QNlE&QiA@ZHTs_19arOQ0& zeeA|rAt#_LS}=}tqfTem<2kSDsH zLv$lJh7>*79J8q>{l$dka-lJt_OTUE82qUptz~V(N+m zQSFHh!+UJ<;9gtv@av*Aa2-GTPo~-XtfS54{MQ5WYH##ssc_;Yj=wE$4LJQ|N$y7> z#h_x3)ihXY7vG8BIKCR-q^6r&ho3gZ3t;hBG)AUv(mWA+P&j@uZ~A1}06?Xz{1CO{ z(o(-A^li?p)L=m|l(?l)TN&A0|~wx6>Q(zsYs$GILy)K>lDAqzVQtko!z3{2D+)$X&_4+#a|3INA__^VTE67$7ev7W+hRWCS9VJHui-q5T zw2Mm|>iYP6PsfGOa6IWWJWV4=bl5 zFKUEeVHfj4IeCvL8HK|Fry%2GJM{u=h|a1GFN!7NwiiKH)#Yr&Z_k7;sSD*TL@B&@ zwp=8El7%_NHkOc^$)u0V$&6E*+icA>3B}E_422jf)2?!Ct2N)hy`u|ZM|{G>k&xeZ z!KSk%_B6BEnMFiD(-n%`13v{8e^SiO;#tcgpSRE6$UNFiu67L(5?5>Vc>NmbBGNGO z(063=y7l$r;mZ84Tp*Uhv45EIv8~jlc7ac=ri&A;uhjPyRX3WB9G(bc(!i4cyL85F zQdEyjL@9p}?*!YkMk+4<^yJIH)C_Zf&j7D+5V>JJKqCX1pA3)s2Zc_=%_8PkGBob= z+~VJ#aydG4@o^CEcyARk8a^)=_k=0QBtq+u@yalW8E8&!N%6dtA_ka=_dW3Lod*z~ z!9J@gk-u^BeHM8Bk9MG?P_r4ce6-&ja<7`WBata%|Ib+tzQKlNx)Ja~Oax^Xb`ti6po=sLKig_&Kvy-~`xx*2ZjfSUL zka~h}nZR7tn0maikWvGxa+=w>1lJjsdny>r5E9-*Etpd$PE@5ot6eRafN=({bg7g1 z@CNGOs_^RyYx>-PukXCYW^3li@cq`06pF|M5_qxd^<^kG#%?6#EzAiC%K7deZ4mWG zmjYP3jWw7p39Jok`||zht*~^K7hg_aFxC1OcVFhcO@EPouS@~k%qp08qOzc+#6D{3PkIG`?pKAa8ZwLX+~4-39` zk&maI*d%J6=#~)}3#&FrsiQ76Ua}OeiyS{nDozidJh zI=A*QCww~(j07q|wPwvrQjT^&((3s~gpyQQH`1e@X@aXwA}xAb6VGRZry~l0@QRW< z3S7lEW80AkCDc_W-)?Q-f)FuVjPC((K~w&dVPqkb2u+YoC}Eh+ zlDONKktfBp#RH?_G&#D=J$cHbK770qdGtKm1iutSwF2er)DYvn7q|VqTc(c4AB`Rt zxG)Ro=@hgXQ8aDXt} zWnfnQwE!$T@nxPz$M$oc~29G2j z>vOT6LG20GXsbPSGB1~mO5GfbOOL!5*wGJtH;qSt7S+OO zc-5olPJi{|4Lm}Q-LuqK`>X28EdJ-|)Pg(i+3f90)O}5Tc~G&NXwr~%7P@nTW z>DS^iZaz&aBBo_idmyDbZHnjPELU&Gq`qy?$F&5EKW$uwHRp0pn-Tk|xI?7`kIjaL zvXc#kRqv*Tj zc)P$gw{XtAa3h<7cmFkd&}FidGz_fxJ>;T9v{B}7zhU4m#al{KPb1^}L2nT)+!vO7 zbct)c`J}}?R)x_V@*Pz+!Dmn!v2EtpGe8lgwc>RZWm(DBX;ZRf!YJXe$wfvA#*L@! zpT_QDs7!`tmA?@1%z+V&!(+*%zd@Ph7#&5!Rccq_-=-q`TLKCxU+UKgZ8Aa;Q)E-X zX@2xWSyeP5;QBtDC}Q67_a%S&EBz2VKrkuz6zK8n9RyB|;}s-!?@OKQj*KYLS$%oC zKI_%|3AnNt{Q!*YczwlM^tMIM=K2>ZO;+z4`nxqiUVQ$l|=+P2I9MjS~#}9NIh=euHUL0NpT}xUS#bG@s(9^zZ$zM(qy9ATO$lg>a zdzV&6+fl+-=VFsgJIYez_xIS)r^pg-Kt6LM=rhG(3EN2 z_){J2l6?uzMhn>5D!}DdxQ@AH1U{qfQ#nPNrV+mIVhQFahxzGoT-*F1^h@FX=j1od z!1NlRm^p~WclC^C~qWJ!LKk%}w3YT@(-DI^@EZtIBN#`suQgqMtzmgKlRKAovOoT;f2 zeoB^RKsi>F>kM8ia5VEpc3&hb`UboRoPF3aqJ+A0D3>$9VVZj(TBen^kg9R#xjeW9 zFrKCKu~!cLT=X7elmGa|r*0mI`?n^ztZV}Ll9<9??c}HZ()I;{n5U=>-o{pCiiO2n z7ObKxj*E_VnIUV@!&p(LPBxU1nS~r~5IDV4SfqY&>w_BzLB4O!%K4A4Nq#-E#_8pf z43l&M{`D;AIA5k~>}Yx+!)EVG0KGcn__A+`eWL_XPR#v42JUMzY@O?K{e<>&wJ#Hg zdWku?CEi?&}mDxpkGf(QUi2<56P%;9YXVD14@&FVNA*)4K{VxF!om-j|;we z48kNmRi+R@;-Z;OP5Y?ns^jW%91`Kygnvo_43&M_8s#W0yeb(`3tEg7QLI?5uU3}h!$@5jrzB5W@ZFYm$ z$o|Ei3*w70<^TimoIfDdY5G=LVs5=-`!%l>L0!KXEKQ z1F~)4*hLe5`V$^ZynpH0Jv-u;`p0a|*YI6oRBjfml0&1!!7-9=s<)KO!dHY$%Ul;(ZY;+hbrXBFNP#4kDWC|8D{z zu}x-AX0y|ey1wnE5)L6$9jU{VFN|eC%W@OJw||2)-r?X#&)dpukHZh{sGfN!MiC5G zWjPS9Pk|$y#K;Fv4IC4cI00Ewg4Hi5oKLLKfopsIpRD`uGkZiXXa8<|TD=nkpOOFz zsVp`1vUysW<4E=m=x6@Wmo}>>~Vy%|Ayk5};ovWVUT0CtOhbgzLGkN zg`zWhVVys20`R3toE5+hq(}DYKmy5jJ^mHHZMxk3m^IldotL8;_e%ikT%s#BD6}Ub zEKJCh-N3|m4>G!Qq`3WvCA}fYE@_c%4LZICV5#2et==hq@Fv06&wjB z1&S3KC|N{dcULHL&)F<7tVQyYG zy*0>K-^*fLJ87FrNFXWnlP?d98xG8PQcMBP!94m*>QYWgO3(=86^mn85C<`B9M1rS z-;7gVj6Cgp5ec+))UT79yN2&ys>X1i@Z!nvYJAIX&9Dk9YQ+K;g zx%MeiI~pVXLtKe8&s11r2?ScQ!6lXxrE1+1St-esn)r3X)(;!jtU<~nDRBM^=Ke$u zrBr}RLHvR+7`z`j8eP6(dONc+9aHBJGg5R3GlkBLvMB`Re;_ty@X-@LP$RfBr->HB zX=f1b&x0t&EY5HxLvxME5Kmu9oHbGF@cCXI>h57SNV z&ulr3)i6={;&+W&HQts3gerhVW1-*UXIj2*8GL zD;LOVPiR!!LryMnmkgC7V5tyrbX)`)`8FC(AdGy!mW|0bNo`$rS z?4`Q}1DEHgx5A@hn&Q&VhGcHDRKc@}%l{4DQSFSU0%s>f zePeUR9(o(rnlXG5YPVi>7O8vle5Gp>D|;4vVJn;|RkX%KK+VnTVX@Snua4FG4~ob9 z8^zOwu2zrfw)a$n%*KdY-ca)|T}bc+6x3lxI05&6gLudw$>hOAaKreR&@xCQ$FP6L zkiV)*`;<4`(6mdCM59VK$ddt^Rf?KH$pjb}vueHpo_XhnCRQ`FY(mBO-TeBVUc<>@ zS(ne!-Wl>6Z~N=-g`bh0;9B~)c6JCnF~^~0z;jjLB9$G9=&a>YV&;-O+ZaN=ESY1B zMAf-jh&~_~>lzdoG>1z~v}5`MiRv{gkm}=`e-c|Do`Re^YoUjzFHA@H>AB z5OuB6NzmbyM<2&ld7o7}n^+TDYsy^+RvKl_FZgcydpp;=yEuDj42ylgb-B0d7Ea3} zWBymEt>}ZIyE5{b#fI6F5Axa_a>AZV47k z`?FkDV#Cd~CF)u4M?y2JS` z-14U@oFiQD^-VaVZ-E~@H@p5QWuV6F7A`-`*U=4V*?f<%T)XX2V<=+`U%FPQi_0To zYpkltsugo!rW(WD=)V<*^y1XEyabH5dud+VM#}QLdrPVgJ?Sh9tHe6{vesNnvQB?n zHx7+{D2?ISUXE~V23@T!Sn(#AO=b}^Y@F)<(Y50|d07nrysE#vO*zUziGb5Q_(WUm zpG1xgXGu6m0)P}*K-5oE`fW@1i;6Gpy!I{AiYH_Jv^uG6f(5gJ-ziIqv|UNlmhDt; zA}hUi8h`u)YbslUzIFj+!2DhS*e~NT(nPglOp#A5lQI`W&8epv<{H#QId{G7y#*8F zsV4_`B`!&d5`XXV(g?2>dVwNFQfos!z>(qEONg|}#SJUEFZ>B#;&5ACf5u_f#9f00 zf*qO0zarI$z!q7~2?Y#8?RBdza!mGloAf}<%|1Ndq}H3bvE>twVW8 zBAyrrj_$0wl}6hDdtOTCD0qNYCz#+cBm^rL`hO{#%;ZJegn2Divb6C>p>NCU1yb_O z7ItR+QgdvjQ|hImrM>3$9_uMUdqx-kK>klJ5YmhXS!!I_bjLdTO^frQT4vWe$oGj$HjvZ?wMJT~a3>!(fQ0DS3=V9VAG z{AJV>&lqn& zF@d?#Q*wLig{L(*1}3vk=8?h?6;t)OfL&&X?#Z9c)$(<(oax)l^_;t(tG{>RW7i(ViqC@#Z1P?mJQNU!R>=rY0|kg~;@tnyPg@L^sOg;CMo5i)_|-XoK7 zVPEE#TmRyP6^H(9_KlM+D4!u%%vNL75-$G*^nTASdTt(pEq{u818A5YN z`+EXf?d$<&fF{oGKkv2p^8;Ah{pvQi{*pH}wPA%Koxt*KqGm=$z;%CsEw*)Lu_)Gd zU`>=t{l!B5oMo@WwjQG7=VhjGXKzi{nd^Y15C2Uxp!#1}OAEgHu9U0lf@~Kwi!wXM zbA&D4wV^xTX`$ccMFHEZD?7Fi{^!P*eg%72klOp`ex0O2NoJn7xuMF>_uN6Z-pvmD zcz&)=Szg$?jjyk6?Q-(NgegMN*Dlwu`flZXnW%i<`G5KbKtVwB_Du`ZgAJxRL}7m| zU$8p+Lw5s5sDY_U>1PQ4&4ArJmHo$xPf!A*?Gvx~>3D509HUc|(|PP_a6b1t+XF&a zH(U=`M|Gu}0ZGF|x(npwUxCj!b0h!2A9=X z9!%L2^Q^n4KnG5fWbiKUjZ?1zcT39syTi4+PuY&)i)41?3Y1(WI!hU2%BQalGd{w5 z^@HJJuQ97;wO^_0oxZrXW`0m@sR09XV1%#EZIzD%ji+nMm4p~;D`+2X4U(3 zf88=s4C+J4gPZ@F=Pr)}!e(LS&QF`Q9;w#!h)09U-40yj$6rUCw|3~&Kh%YNDs62J z+J?xhcDo;@SJ+9v=m^(E1eKOKcG5SdLYT9c6OpiZTIg&f1 z%FLTTJou{Nbp4kT5H8^96nMDU2&nh^60*;_ngw=BIbW56P}HJh-Obt9gE}*m5;^nq z9ME5GZpGwIn0RgnKSD`b()6VR}%JKuY?IovmtvB(CK-#uUb-d|&`|=T$zItvLNvB$@N~o*GR8N=E#wb-*) z!j)QEdXFo}0E(Z~8RBmtEqVDLSO}+NGqIEQs@TaqQ_UW(j{e$d^NF1qxJ^0LYmMRI+yf29C~h>~ zr!~h?VS0G}B<e-X+GRy)xf3qz4_f(G?a?bwg58}dRR{xUrogPBi2w?l; z8!xW}io8K-g(776*M+M{qwej6;8xVP4#x?HgY-9QaZj8r)_ND}U?X|^V!lb=Cp~s! zMYM?+g?6H&vTk)86dZCDo9Aml^$M9djg)glKHNXeO|SP|{C5Y~_q#r&fc94;1PtKk z)uU}Jup_a_@hV!8#t0|Zv_Q9Kjl02tjiV}{ zk(CfXyyXm_HoNEm$cY>M3D}jUEf}q={JI`n=|`uItqEU6uO25v>ZxG*cK3$&Pw*j;05-a({3gLRZNOn3^E zq)&{z_Xj5t1l%pJl;Z6NxxE7Z)y`d6DCsh0v6OiS9wn*b(Vvo=^bol&78@^`-ai}y zNru1m(sIYN6zz6+Y7h4o`hpDuZbXvi$y>x%5Uwld?nfB7(zLgS@$ofdQ3X9sljL2B zAmAhoUqNxQG(L_#YF{UCAupfCj;aW^4Rq_WL zG+pE%wvw72TXQ8g;-+vEXq1bf7u+jeLe_9PluXGZ{UzsH)yxv|cpJ*m!7Sx9s#a2H zu9Nb&SMrP}+z#l>mUh%{Y!q*=k&h)=e5$Oe(^BN3G3+VLbVCx!t>I4eVOgJ*6%hX@ zO`mXRXdvPLJm-7)kPMy?JbAylldjJ20t)OL`rnWXoPCCo9A4uR$(iu=pOzN~SrzX@ zv)WQ!l&3;{nTr<}I<`_m{wi^f)!p3LhMLKeNYW@r%UB?TUvJ(w43KCioBN~X>3RGX zuXK*W1x7<9hB7)_m|7tcRfr}Pz!Oo-_{I=8delO#!5yj`G?3_{AmnzQ#vsW!057Cy zE|B(5yX+8XrHx6#eu%`nwp~K(;A)leMncf`A@v|>!|J9j?zdxjO9y)4&L=R~!3!Ka>|STF;FLi*f?_!v+P~1YPD9X+Gx)iV1~ow0c)kD*~-g=bVBJ zp}~&U)7n+<1j5fvaS77}E6VNEGr*!B54;?MSk37K>yecCl_Crxw#Q4zj_~k{8CTp7 zIvTw1Al;vrD4-sVbTEroIrKwzooi~dcM$e1)t@C(<5uW{OvfuZWUkum`|B|}XhX&k z$~==b`mo*6$&JpPwu}Kji&qx`ahvI;*EJtEY&Ta=YX-s zjPcj8#>bwuJ{e7yy}S1Mdd<^s9(=Ax>p=Dywf7sZPut!v_XI@5K1m>)!Mj~Uc5n{z z9T;# z30;UkLl*MGu?O)0>QoCdgds6B79ryhexK)@?-t(G%xc@K#}3&B3K{A0{B>4v1QFQg z3%{l0463{MQDQ4PL2us+NYfRLNH!;e$r*Ts__x>n3p*&e7vuplk{c>yZOC082v=en zJ&Jhka>CUHozDOC5pG_hxzq=n58A8q&^JuPzg1iFHw?0pq9=?F7W6U2WBSmT*BW=E z7x?KAZ0)YK9shY~;^0qlFZ8j~2MIED>S_c9!1(uu&|BuX}AjSU*dfejpudKD<}MVVue%;xcS_KVOL{ zy(feE!%$TZg#7ua9N>wm%h^6Zrt2jaAT6d3EN%AvNX;%XZCwrFvkpSdCc?+7F{RGw z-uu^S93De2ufzuLR-Mq5leJhUm7VjdrLq!`I$!yam}otyfzH-zcLPyqbLf@gwM(-R3PA#*pZC5%SNWBYl0+!!^&Ox#GsKULn$~kgn_FARMqq9h zyV@tP%BiClxGvq%S@~hx)cZrLO>&|~m@?GrL(ljI$AsI7A6mvXC9R>Kte1%Od_NvL z_0ApBDHvk+c4vP*&q?&lhXvaG)Md8*0Qa_~0nDF)9?PNB#HWVX zCv(IhZh`WROb^^19ISP&1rr+VXqM#F)d@}vNdkF(MFIaTX51IXF}ppumAN6C7rLuM zKR&1J4AIe`t2Q5GL$YK(Js>WlS%p-tTKLLR+RM`ACU263It0f7I+E*Crnw+)$x*$6D;xk(0jMVUi?@ zr&E!A&+`-u*YWR5Ri{YZYpL`m9hzi<<#fydFHO@C%$Zhbx_7?d&6WsLvv(KY&V`SR zy?+X-M|iI``;y3IZuPVnut=f?~g$ObhJ(-{2Ubj76t-e;47Qz*Ah9kI%5o5GzhhHUNg<7cc?qH4fE**B5bt1~V zNib&~5H7*P5{)_ndrmOi77g0fh`mCskb!A8GA}Sd0#dw#9wG=iuV_Km`ftVKp9jcK zjV9r|uDu@P{(U;$=zgsY_4MOS*Veb`r#cRjF%7nO<8a+(o}CPUzscjglPP zCLPd8&F7xeBeb|upaVDv=j>OjhGI8xFZTriL|h1V)Nghuu@Mo=MVxD9PPl{%b7TnF z27t`1yyrIyKC$nXMkP@J%PGIgUXeHuzQnrgNB!5NNh4thj^ax}B%KO{A~BkIwxXn- z1F=MP!ZW<{HCgnh+(*eEuA_x3Rj!ryDxgI`-C_M#g5+tWcrIm&-1D{Qe-F0Y>_X}a zz);c79OTKFQio=uKgn%rd+Hu?%h+N&mU{H`31hk?{G3Y+xr=X87LIelkE=c{U!9kg zf4k4!DoQ2_0*QP1a@UdH?ZLm$yi#0{1D<;I zLE=81a_@l^T+cT^K56fdSji!v2k1m#!`J>=eaqFS{t)n8d>F{hw{!XZ{PLrBT4%88 z-y!5YnlK4PoLmszqBsi%lppef@#QrD(y=Em7w%Nqbzf+<}rIDw#!OWOKwm zsCzEQE-Pph)Y&8SbjV6Pa$E8g#+1v1OoNhwGZNg%3N>E!CJ(~I2e2W&D`0$H_8mirY@#SAPXE&&P=xj@=6)C6CbJ(ZbP0^!NCE&;boDy+)WPb43sfSkAqGa=pW3TrIRR!_9^N0N= zZL=A5sKH+u8j7Lp4KZdQC0b9p^iZ|RSE7dlIf+?~%|^3+g}bc0{n>2o_?YpqGcAAA zHnVF=@ML5u#zczA4>9yFz^s$>$>NlqbT^d5@UQ=e750khfrmoV0XNlDml9M=U~@gR z-JdWKLqf*SR3?6Ro>9{nyVsCl9$K0tq_otUTws8a8^v_`{r%vZH$#9k1Ht z0toHdzZijLcDm$FJ{^pFxE_Bh7EXHHPWH(6nJx$cjLT}%B!l#<| z!Pc#~{QsR%vNnXheZG%c;1d!fSy7WXbnVnZSS}zUO`K2xg;MA6A!Xnd7+n zdHyIq+QQl5K2n?S5Pm?Y3YrTkbE^h%gP@pEAk0Tl>(NgLG!Mpja=z|eQ6mP1(c#4< zbOLC<7p%S({@dZmD;$9+rBfJx(wg90PC}EWCXqMUe`B9XQCoT2z$KnlctR5OqM5D< z;r6MY{M6gq$z|!w=+2uQf+IC^fj-B97bx1gl-fovILSRW5`tC|st-Yv;D={aVm|gX zbzt7BScUeN71b^pd$E5NT(FWJJqR2Y3DR8-E^X^#T5+plR8E2pVy{9tFQqn`hEU|l zjKTc%s(iz`!kX?Wopgt~h885915qVfAIC)$hM?Nre9SebE3|ET%6rNi9(cQN&^Xb2 z<_@#44zPbK=e+J?(c!~g9r9*`IhS^&apTQ$RIdVC0>3nbft8i7Kntq(SN~4wmjQn? z@qNNiJMS}x361Vizjx5O-LW)5lOwJHL**^5dY1q3h&jERnDkg}YGL2WE0g3B-b8bp zD$ngK1&^v4cMCirzIQEpeLCQsDZT*=3%#ligw$VN9Xh2q`}`O5SgM+VDbHDQmkyME z{6bExn1p6Sof0@yGM8D^cWOJxoU|tHvVjuSlA#Mh0--&Z4GPIy+X})C~crNgERsHIE~N@ax&0CiuNd0;O&0p#zmh#L#*+ZTfgzOfs~ILj@j=*rY8Tsj)km_{ zo!fBPd}nwond2@J2jmFuLIGo_zpr>YA~rB$Hn5>GteGlNWIunLwm3#lFA3mDSN9Qa z%z*g_q;^I=-REZN^4lVf#RH#o-u3IZXoulq%5Az zNWpgO<1>>Uv(65;y1#9>+yQQ|CiF}yGyltJAcm+CK*+(y{93+U2kfNX$inWcqb+nR z=PMYkUMMz({ClUHqj|pJKCOD~nZJsT$*CTy6k&`b9ZJ+cMTX8#o)Os@h_jB9)B^p) zpl2h{@Ot|9k3R;ZtK@VD`mRsa8j|XfZ3@lMAGjh&z=)%+Ce<^Io&4>zKv|60V<;Nj z0hqv<03P^K$7_6UH3gXtexwjeW&2s@m6gF1jOwiTWiqIeOF6?Kvv6YTgHia`Lj@y^ z@737tM1juOCdCkc#WJX&O#vD5-nmJy2z#RA7S+$BV!VucX`4SHc>WB<*zu`e92;2VrQxGpqd%h+68A$8>>Iv|odFcjJUWGcFqMPt~~>EE0%F(UM#P z9-%ETKO>#quhzgXEf8RJ4FH&(jem1ThE(EmI+oCJD}>D4vJTG$5J2~urswt z7I&Ld>s^{k__<0VccL@2l>0eeHV5#Be*KN|ec!Fw0A{PdT>4X4rM}L3VruHPMQqbN zKd8oTbE?b$N;A;fyM3EpYnKxxtUq(vpTEAF)`%}5WOPTX=0<7aE~slYCSqecW-4Y| z+HlbvLrg!jHS!yLhbs?N+@LeA$%vizeQzr9`SzRqVf;TrLmk^1-^VBOi6RB2*zG># zMN^!t%mPcJzb{yZeA}D;*W~Aiy>BMdxJ<_k_YJJdGDsVXjo?GmKEU7QFphS2xrm!Y!%sDbs^dEy z-?|{;>^~i_KD(j6-mPGP%{{Tew#24Ue}D0hmr}wl-;L7m;y4FFfq(#k6+2;NATHn_ F{|odkB3%Fg literal 32183 zcma%iQ*b3r)NO3rwmq?J4T=QRi!CT!^Y zmgQ3b4=DzO;`RHrpWycP#^Dah>*dwhpBvBdt`{%x7Yu6f%rZ7&^qWqYK!?`#uJP$G zdVor25ff4InLsNz1x=NOKf5?4FjZ~f?#WOppv3rnXt#vZ*)wlQ{Ufb4sar00s?g(xij{j1 zg{^Xvkaloo;Hs$7i93XrWQ;i60LNEzI98)DzWFW*EivFhY~U4q|AP#!FxB1pW}-bS z%L~EVTe34xx_b=rDd!(}C~H!lX|xR;)k{D~(;X#`n5(pE28^m~l#C#kDN#N|1Tm07 zm6M*59r#+QIe*-I(o%F6aa)$y)oc3My>PE2GANF*pUC?W-x*BNL<(JW$5D9SpRbeo zOQ`cC>aERO0C{doN>Un5CRxR>u6v38>8}E7&A_51jY+~+Rut?u7{Nc#ZLH<@z(DK3 z5h&3`NKA**3@76VLX#|xVpfiB=AZbvTm~l_AEm(n&6D4z_@nG;t5ne-T?YAYew9Vu zj7f9Ja24v|hPdWC*4bFNNW`*EB9CZMO@w2WJY|{IQ8n0N+KW@7X0*N8DuJ+ZmEhz` z(mmA!8S~J|pQBLs{FB$PwC9woH=bbQb8%qPDdclj+>BB=1N_9{HC=abN=>Y?*kr6& z;5Y+}MA)9_)^0VM7|4}$RD)1UoMSu-pmV%<{M3b&_1O+&=1tV(SW3YP;dDgr$LpK5 z`zkO5=;kC@wCesK1|P)&3Id98q2Ump8GP)hA>kq;wG*CfG@WI>DI^JZ1>q_hLN-R_ zu`Dk(t?rK7xRRX zYGC0d2tE67GZPn#(U5qi-lv$&egq9Zsoh#%Y5Pc0k_l^zW}bz0uBG{qI}q`-g=|nL z@gG-F4PqclFMjb4X#hm9sJt?_usJdFD8tS8#5u|mS@tq z2;MOx*?Q4jY2hkO6nrxp@;Y^~5^F!NyAc?R#TRX51-ac#^?EFs zar7tI8aav3T0PoSH|?nI_Bo-7?T~Fif>e@fdiBKT=-A&(Kfbn^R`6 zLLh89>7!H(rjU|jv#zYsAHyq{4rByTn0qi0I`A>o)jEATWZ~f=jf&j}G%t#UW6N;# z(7VdT`7aEsE+lVAaViyJQ{KrE1euD7gNt*t%}R3U$At)#zo3)kUL@KR$(~O6Niaz; zmPLotud3W8Kw`zC+ln9$C;H@p+78}ZR*Zlkm3 zHXbav@fHXD&L+T@B#Pey6aF});e!%xdFPs+uzd?as$O64{K|5&vg7w@MDMy_gin*< z5u;b9?)<+B!Hd<_%s_+@eRoZX5}D3Yv&k4=zcl?K1DU@FD)*^zOMy-2lx`zlWR_J-dhJQOB_sNpF{6)4{A z68qgx>w87;TgARfkzS3lPC^Jmm5V z_wOmQnNo4j(tlXAoBDLZ7Mjq9%Pfer?ls!q#rqa0^D24q5#QEb8S9`({Cn(37Ylde zir|Rnf!5XzeFG4y5faZ8h`m9j@cqC&!HKe6Q*2rtBMtpatk#SF;7KIt*8hE#bB7CP zm*cWpYq+XF%J2(<@0|{uO6$Cjhq3xcYW;(;JUfD6+W@49tuwv~%@dA?pP_|G@}h=_ zK=3X(t^DkW9AfI`EAGWB-Unc9NDazHAippw0{Kp1Efg54E^SyRsXqh}8mMR?vbP0K z-A|h)`m2r~q67>3V#~WYJ*idUxgljK9p-WOGEWhWR#*)J9LzX+22rZmqG%qXkodcP zto7|#%%oIagllLwh}suK-3_hVz4WrG_01{cmOZ6;HKLonCOI5V09^H%%>%Kge* z#%F$^5}17N;ENCgiRT4F1a}8rmE1<&0uiI2!4bJbOEAQ~bj^7w0}rFJg=O%HRSMCN z4Mkoux=$`(GD-B;?&HCM7FDB9cVv9F>I=?Td_Lt&?3Y3Bnh#S0i+Aj)Ws3)vblZT# z=W#^jN%gqoV}%JuH4Z}Qy3HvgdKf@66Fz0%XufN&Sg1NgAj;LXI78_M1!RYM?sC)# z+On02I|v}wH6Z{DCY$D8*yi_)yzwy;Y_d*0^8~%Q|}eWX5;hXH$+q0?|~*A`Q?*F+e3+5Z$x! zJ`Jw&5z3IhS$0%yv=d8qHtKGqm>Z$V-I^=Uk-iH~fuELc*fpaoQKIn?>X$_gve5#C zGR@Qab~0$g4Ym*Y3)+m_zgkrs{b;h1+=YLB=})9WQ;?vTm55)EceLQN)I_%WRwT&& zNnrjT>V70>hp^Sw_-o;t{>)Sanrr;lgUGg4|C~@}S2EuzkG=oa|7241%PLP<;NbIM z9`lLBZQ3kEIUzx6g1vH+IMNsD_4z9AYu)8+*plQDgpHS=2g03zm8qOiJ`|E9M7|1g zvbOGN`i^A%{rZ0$f%YN~Q#mlPx+o=T9(%JmorB6rcmGbJ@YXd{oMw(aZW*61wz9RZ zPh)08`&^wAOkvSiYrM*WZ2qr-t=Ab`iC3vR!cj|9+@egT^VW*eeIi-dNgntn!2G5d zONPSJT3!?cH~H@*G0Nph4PK{@FJ72Ge?FD=BFQ;gnR|0SS_m^;G2jM+ye+~upt?tuY43n@-nYHiJdL$ zV?zH=toVPY87gkTsdMX(Ca3mu&)ZSnJttgv z{U&}ALKfnZ#8j4j5zPX+3A@Q(x_c72n_XO$UcODZwloykqa!X;?x#`l(s&VZE~Md` z8CO`Z6k^5P9AV(+eh4+Ar9fea*TI`^h@I!8UyQW5VX>c;?($*_NI9l+g|jrGG$^Bp z9ObpC@}Ae@&h&=w#5fmwmyIV@u=5V3k?>mJTF$-w}3VFV?g^N>Lo6s z^TT%}dFl`r7rN0#3xI1ecKVbp3{%#iRZwyiRfjs zt)Uc6_Cw*=4v=+J9alkx((d~enw_i{Mx@J!IiXa~Cu4wI1ckdF?%b%nAVQRH(EI+b z=gcgJR$TB(1alWu+9;A8S=ibTaxnlRq#so;tcwd;uA>%GnE+qRMe~SQq$9Fjl~NtlHY72?fxNggh^``n3x1qn4PGPUWYj zGA3ZeG0d!s=@(`z)}wG0L}!`{*Vn$n39axRLdZJLyb7BUA2Hb6p>Fx+*Zy}rHU zZ_x3WiFNBY>4|TsB31Aj`82MF>kH&@$TFud<~Sr1^?lrUF5!!zdU| z4CSIKN1F+|Omv4Hc|R>KNfA{joLl*M+*De`Aw?q=GKQ}log~4JBxFyU1mek2=v8Pm zL5D#w__5otUq}}GW|VR?Q4_v+wnHG1_D)^GR~(=;*Yz+j1RtHy9Pd9-JRs(kv(edW z;Sy`Rg5N_qJn`XZQA=oMkOFGZ>ftddlkW>Frj|=qn+mj9^XhqFGI^H;)Pub1GG)^p z#HDf-A}>SU16{!T?xi!t$1ZuS1fTebawLp50?FjRt#1 zaf^9oM)M^UaXa2n0)RxBc&tBY-XF*!ePQ7`e#%EH?$IBXG`fNgM9DL>UgW;WpXd*g zGf*zWD=rMWu@D+q)vci(?a43M*n;!O)W7rO_whpRyI@tCO_2?)`I~YgZ}+}_2G(Bn z#ENNE4n`bKp88@Tr=P_feKzEQHhkH`CII}X)!ye!FjOF4S@OVtM8Xc9!xN|cqi~gO?4k^}aQZSWkAZS&OFEHW!EzEq19YSW zA`WF@F(J{JZ^|3f{QcbMMa4*rO_kBmzEgAXd59eum7UD6KlnUeRBG^C{2u4oH$*&N zM02+6@Y0HVRUto&ji@EZlp|JHy9iqlEEO0G&u*ZPyb^9uVzkYN6zoI_JqF}RaeUd6 zIsnneyI8ME^%}Dn?7+$q%v52vQj(-#z>l_C1q5a%M7v8}tl5hrrg(_?xJ} zQRv(=9QfV7GL#CBe3T_o-(gWtV~t4+MXSdj-r6JL&!RbGt91N^Xz9)kc+i;X0+kIQ^00qYTwm7{FuZ^Y>cFlEKd>_m+%4bY3F0G`~8q6B5_UQd2D6ClV_VK^}K5ep~0e2*X z(ze5Y_RTOZxvf;$Qz?v#d5?=A>5}q%`I=qi=gJE``{A7+9Q6G(r3T_;nb}*Q=1P9C zEo)*?-j6#PF&6H`O!{mZCGmSNi0VL7JH+i^}z2Dt?5$rFP)d+B-f5krvnq6>(QV(i_Ki!MZZ|+dTeeUm*SwW&czh?@5k|| z46+>#qqgo`h2~P~#&5rg^7y{%ZLA7KgVFXl(Z$Z z;Pwip0Ttr1dd55yzFSj*goe|fK~vBZ!4kdqzeE(R`$tg&sS)K+wUv2qs>k^!|4I`> zgV_(jq!eC5fW*ny8rFL3Li7fFS+R=NHoTH6RY3fMjOT6q!~_BPSoUWH9~&$#yP zvtz$d#5JR`{vvWL3Gv($Ib%B3{V4gC{6KoD`bBj(t4#|=1j`i3b>#ck^jk*{)Xkdr zMujWBCTkx5eh^#o-O1Dpi1KL(pjwSb#Y=uBhiN z1xZ1LQi6_Peqfv`g9ilCtM{;y44EICHYU;$1rV|<-GstM2wjEyStyIsyPrKZcU4NE z{^R?#+bVRbQ5+!pjVMDFsNB~tAJ7hV3`ulfvXoG6h{5gicYJCD&wsDQL@J>Wz+s0blC^0 z6_^Z?bOj`Wb*b{wgDkI>!5Gv#wrkU$B*}eQUhb>FGysen1srANpV{uYQ@To z4)>`Bxyh-#lw8-P5-ewzCi&GK?@vOPaum4gFc9=vP~WpiMX}6?tpcZN>6cgI1*q%Q ztaA$VO1JTT1rkt#^umSY7$=d?c^ya1Qi-cyW7*9y@~ji$nK`{33bxD;VWZg_w7h+) z`blUhW0ml-Ia8Kb%^{=1mf2Ge@-!1Yc|X`=Z2;}Xf4#aiunv4{upb^+K3hZOiac+F z?8cr^!VPYf=ulRBm8{fkhr zq>_1ZXB@_TtnjGp#zib;_gBE69=)PVFCJ4}If1Ftpz;LVy>b;)iuWA&>V8<*YNW|q zo1pVQ`wz6V#ZiN`74IW`L;EIgBX@YI-0{f98UAijd-%5Z$!{^r8ROMNzc@_xj?vC) z;4(xNlJ#*7*17321uQn3a|e%xj;>Dr3&7Gt>cT-J&mTZ#^vs3Ak8S_$8!~ry z|L?OK5s^=Ce;3csGYQTti(m}8iheg%z$8ARpSQgDrNMuglgP^8*wE$D)StxH4G84w zQ{F65Rz-~7lh)G54q9s+WM(l{OMqXM%J;pOn~um^5A$H22e-FC_tx<`ClNgB zgXv!?H$#Nu#MAu^kBI&~Jw1>={CSgjU!rrZI_LJ3Qk1J^2tL|cvA;cEcQQxzLQ+YH z8^#ptp@-VdA4C;BemxhSJ?STdbJc;qjt-?2U_`XeTL^{-et{YGLW~4v47D(Cyfz)#VCv{ogkiIc$7rhIyglJ70)NIAF zKZ<7vrA$8Ese*DU$?&UlXW)R8YBhBay+k&P!+=!$2hS5L+?z>`35)mO)IW#q`O#X| zkmLeM@YQ93Uo%~HDSzEH6{S+!8cbwgREYk0IIFAsWe?9HH{Z0POe%3EnG4Uw$)i4} zP}*Jld}>Vzn;opQ?yu-eCT8VR`uqxiWHL~yQQlt!iB>_2D1voyc*&;%TF8gw?s z{x~nmWz6js6yfy`esLJTDQopf5=s>YVaX_nZs@f{7ZkJROCzpQC}2C!$gSAXGuvJ^ zkFLa(7c=El+BF zSk1m7&9rPNPG7)MJaVF49v=Wk-zh2 z8r0k^x-^B3UJvf-7BXlu#$;_=1;Ug|mLaExN3Gt3`M%)|C=00{c_xYbuQn1(St2(k zSFRV8c45=;jzzawX7?OX@BamL@}{D~_**mu2`4k*7KxAl>PJ2oU)$QMCUHO+l7&HV z{!qI;!;Za}4*9y5O9wGYmr$ugWH7gauP~OyUA81kBTSPTk~C{8RFzR8B{|>FP;JX9 zir?36k8rL$O_>aDP`ZSoP~O0_V!LUG2JWzD!wGxH@z3y)I}%cJ9a8zYGsyFDPCBOA zVTJn4jhU7|&^(70w5$by-9JT;Q5k=OBb*%{AtzY)8p(o`hO_(n!ok`%0z3n9<_^<* zEW$lI-0Z8RMCWQw^~HK;ye$cTR7~vtP)MtB6dmt^!0EcqncC?xNH1U3E>(RlU(1?n zKWh*DZVa1QpM=`80PSqij|UKI_cbL$;nVA+$g=lM>{!zl{N{wcp zmP9R27NYrUGj?V_5|OdpWe<0?{K^vM0DM-S?JhYBKwZtG0fGM6OMN>TJl*nvCQL3r zy+C6T|HXiI7|;Og#6ru@!-XRVU)Y0%<-VJtKGBUr5cc|jZQtqSb;3QVU(eX5h~I|* zAt+I%3*noT5BTYN-v8>Bl1p@eKdtmMI@+|Q&jFD3nW<>NDw@lGDgT83>E_k{gtcL0 zUl(Nl?!XGk)c`903bKA3tN7k1HAw9H-q73n6{l}GqszL}qGdl1reoMKsF)WA%+b~1^|VNIxw(bXliP)`-;vzUnbAra99?-glsf$<5 z8)c|9#4+nH0s5at4cXXECI0hTKU_|vZ21mev)*T1*j2TDWX7qGK8C0m zy|C40wXqVGru8PpN-awy2l#ut_&a+zd@mL!|CPBFMN0ppiM>iWkqV#XyM&K86*OCx zQO5H#XD3DFJ6yvcS<=&|Vt|X%_|a|`L`yLF;g<**7|1ovLx7-C7NA3j|zzK?k!KaAPxPQVq?+$g4={CH3;(7mcm-)c^ zlm8#4%NQpd%bUHZe{B2w86@PjxU*;A`yxynow zlMDrX@mmjgaAo!bXwG!ddMp)#(7-O%fj~2Rl{o#dhemyu;`8vsq(_(%l zF@m^Ac}IR)>n_SGDs$?*%T*`r6x=?`erTo3mQYYu>N1XKe&AR@r=roK!}&h-kL2am z;2Q0~$rU2JojkPuSQSkC%rYO??8QN{j+<$1gQu>YT{f0OqCu`~PV@nfz%VtyNk*54 z5?1-}v@FxO_F?PU6gmHo*CXW+K~bllri@nP5_hUk`W2AY*;;+|V@RAh%DncVF+yqwuJ|Ac5AVoA|NdI)@P`}T7_I9}2W-rfz@F{6S!nO)0g|(#4Z*9!5Dp4lQWoR>^ zUv+jBPXc^-`&LfeDAD*RYmPi#CH5 zQW%&K3h$T%yba~c<$~|jEi;LvVOKtRy*EcN7XPV4;KM|yyV|@QM~0l#GblPY|-y( z|I9(*=(y)CsoFrN|Fb3oJRb)ysef9BIkYvi?PJUu+5u(Z;Ez#6UPCJsPH`%HjD*;#mtB+j^#>wWGoAJo2Cz>(-z&bw`Rya7IP!Zm z1sY+zSfwdNob0Ks%p5HJe&e3~w$k)lv z)LT~sXqcA^As~apscM&A+OdKcgB% z5Fe^U&CoA83YJEO%4I^b?VUkhzFEHvmqM&#gw&Oxx@izYx|>z~v_-o`rT5?vT}C=L z0{XQNkmf9a8vV2eAi(yXLXWQ|;@~i@-G<7ow$d8ZrHOMIeHud>vl1h8V`IZSEA|(2 zs+rGS^6w6{zA3N|DCgfVj{VHf1!Ui4m0^?}45A6PgJiX4XSr8fTi%3J6tv^QU z&tIUyvh<-5BB*>$rMWX>KyN>@E1xSTb8)#4w%^hDgYO~$bX9q?ups?5P#CoR@##+e zyC$OCjCL9+Y97Ccn~=hKR>OX*PxI*e~$?UG`N`vft2& zJXJjD6~~PE6ZOp^W^arEGF5FScQo-y>GYV5{*x6SV|hAQaM1xKQI9Ev<+RQ}>J(|D zW-SgX4C~|~zF-)V+9QQ5CAK~@l@Ww0}#5 zHyce^ybEVWB~_KX6IGFrhEm~|YUVj|Ux9fuq#dyh*kF^sDZ&|#C8 zs~N4{LpOzjEx!N-y}i_dAZx+k``CtqaiSqHrkSbCyds*KmN|5b^1ve9#lzjzbt(!w zg6g+9`mKqQ^@${fx5PCQy-UD`278*c2A!$Uj<6!MZ+_xQ&2sMbhuq5hE2X)I#;c#L z*mH;*+V67M1gh(QojayGICE0w6*XkQf^|ur%uSQhr!*l^Rj$}V%TczXhU9%4z`rEb zvO+?D)o#T`DbS{QE69R+zwD{U-|oe^o+g>MrMXtkG1>3B%u%Lribp$|V5}9BF0Z zO4od@4ly1JY_fNk4$)kTs=su|;h1$lu@v z837JOswR`{7_kIjH>y%A24U&;DQbdzGbRomkqd*_1pCKpwhwa_Rdu6&Cdhc=K0>0@v^IIZFm6Kf79 zw0m>IKpt*9xpuQdowOwCkYR=zM>dJ?Xj4Ww_lz8_@=%t?v_`8agYJa4#b1sjl^IG) zo?&#}l@dHut8k_yI|zzwgH4Z|ir4ZH8|L3biPytR-;Ka>G;6Gi(%HM(}nZmaB_e z+nDdTRMUu=(`Q{vZ3mH~xF4`m@jp+^tH&8l1wg`K+O6lcTT8S52Es}Rk z1hwh&H|~SFU(SQ;seIrMQKPH4o|;cI^w~hewA-%QnBd#E&W(~7lLzr4pSAhqFD{p| z#q8M)eshkZhE@9;cJPBN3ZBhE4&^^}*hX;Z)-e!HPKeR?`};eQL9Y=zjE!}JJGI^= z;5s68cJ)(9@Mi~})|wj!BQxu9I&|Z^DhYW&ItiVh>LvDP-~LRe4~mr;E_RN*rgRv8Lr?Os zXC(E$7~UJ$iPw{j<%4bm(D!{k-lgeygRW(etiP02C|SYOO^g6lqR00_qz#z(RG>PVCO&EHLK z9M@%vA>8nS$#AyW5v5I$ukYqGEqeI?s@Hn&XNJ-1TmV%8?E7Ias_^{LUM=Y_iatv%&2U~| zHSyBI?9XwL8lUF$;Ckc0Ut`*Mh<&7)a)BnU`bI^+Bk*%E=c~_cMKGD6nXv|E!RpHh zTns$fl5%5W!%|CO*@Eq#@ceqy)3#n!l*Pex;5bl9qS?N>o-Dg8?dTKTFe)0zTh15=|H% z;LqSb0*wxgNUYW7nX0J7%BPs`l)Jdb%a!}zh+zLX7mIjm4hybh7p^W0^s8r11HA}7 ziEldbdF{ea5LROP34S94yjdtSP~BqW6+mG8RVsnCo>~E~!~9T3)?H}E1|9b5kxB~_J>liwC{pR`i@qGY;O+z1`#VGU+EWRz8b{iHXp$@Q z_SY$F``izC;nlvdgCfjMPR7{hja4E&!#wMTYYTKGyvk$woGecd`v)(4PFvK+yDK+(7-u3%ksvcq6g(o?UBl;M`}Q2ikKX{K<(IPU4MjWOoMric1dD0RXG;8BdbMhonThlXZPEU5JdSe6ANbrd)buAaDK4|H{>)D;K->IqQDhR;U2y_YucIEfM;t_Uk*#;X zz#Kcv0x;iMov_j3kq%fw`w|^+Q_NB^gVPKX6I~*(soVxT7@qcW2{&Y@J%_P9f>~^0 z;wJwjvbJqK&h5y1$2R_Hv!bKoRv1&+-c12far5DQovQYHq$wnX$dmla+@YU^O4CuO zC~t9OS9O`4evDBa&j)2~I`^=QJch>H&DB>0hB&KK_!u)v$ENAt^OKm2m)&Kazj@ly zQghkz7>T^~IiQMn0%sPXE+ zre6{IH8Udv$VBdB9GeyqwD^Bl1L)~=hFd8`hv84g&$TJzdGF0O=mZRyop{8c)1qTd0yj9_T#NY}{%~5m-+}M8#ln$kIt*(>tu+yU(5^J7n7BVhGS!kDcj zm$lZk6008D{L%PCnfdacX5NGgF98P9dJ(gssBg%|j|&f3UZO2_BRyNTk5wFpBMa$z zdb2`N^c1IOxskVb)`j^!y{g{4GxeE4hP4Z$*d0?8|o3+h)}qE@Z|8x>y}i z!I=0)A~ShlZ*hqSZ7!Bd0Q@lh%YsQMpt(?{!U=5X+Cv%t#CB;-Mz1!9YD2eJ@1zr^ zgx5EC#5F%%_pj{4l)#UWx9156l$C?3FOx(>KcB7 zFzVX!9R>;n3+1o0+?LfN2HZsKp-7|kCk1r=raTAckM^TRQ&`7oRM+zAUiHIR4+koY z0OK;NXLxBT%-%Jxv3fWOwgn-VbHWbj+%wg89||jTD^k zB+tU?Fo1#oojL2CDrn4g^oa8^9raNPewUazG@-$6Ko7%AB=~`s$XtqADA0|R6;ih_ zI=@*?P`^p5e?gS@cSRtb`EXIf`ubl+XLH@@c6`hwH~m!C5-*c4S;N#YiPC=)5zp@C zMUn0I$y{Wx1v>T0%;ms{4o>`-XVsNpGA7O;@L<C5DsR3Q#Rh9( z+c+Nb8SAz~9uS$=crEObe!J|PyjY677B0FiA~ct+ncTbn7&Aoj3zz0V0_r>b;nFGZ*+kJ>CsF0AjOue#;F!b ztCe63bn03iSQ2EbB@Qc8Lo|KH$@S|?=x34wP?r`t-;ymWETZm%mMQI*srP2(-DqnT z_HnKz>H1sTIrX_H!(63Uw&JQ$EN6<&fF2eiHqYubGE!@d=(OmLV5zy))0t!%>J=D@ zZ?W7fe3r8Uim418UNR_+pu$h`0g9=A67f*7VDiZ~tE9k?AR#nfd_zrB+kDDj67 zc7!;6YRbwHtm-%ZM;vP~Y_wTIRcTRRAyWx>QF)1051u0tcs?Tc+LU87r3l}-si@jR zR~u;nY{&l=uvem0#0A_n)cdY@H#EyPF->c@`~*&Uyap0BEtb8UKe%cfF?blnhMnSI zeRJ9FOyk>@bSfcaJ$jvuXTcdhu}`sT?|5@UOkyEaR}A22Ucb-w2~%qbQW|_OrKF** z$z-CFS2!SpiHRS;EnQxTFdR`K;KojH16#%o^c`#2SaCxi(156rw891JM6EpCfZzPG zj>4}$oqM~lfc47jkujJbeLmb0E#nIY2mP=y#2VV16$-Vu>TopCZA=vD2OVzMS^`f9 zENwbPN#c7K!f6IjVD#Du695}#VwCNF%*^CgOzlmif?(3zy*)7H1_YlUVihj2cHUx3 z4(*FeWnvl~p+(y=M0xo{IGzx>Lf{Y|G)aoxwgK&>&II*Xn1QYZc_=$n`Z$#43;o4` zeWdeQbV`3u{rh9_bU?SXWS3C<3eX%S)sVj`#_Jw*jf}yNB8^aTP*U5HMDe7I;=T%! zHv6Qh@-*hftJqalTz??ZaNozhimA94bfMupR$~Trzv7Ogt zKQM9|AJlV9*9h4@pf(&U*OQ2Of?5S*R%?YmEE=VE{jqW=wf9EcLuM&JyI;v~45bb)OMFM|gG%K=F@rG7OW z_Zt-6u4Nu+N1jfK)V_S1o)I9K(gG6yAE7@L(BJJ8aL;Zc;m>W3-Swhg&k=X(ZrZR; zYeb!i@=^e(TNPp)fv8^T=PdCbl13GnQ-&r%3+^-vGc%=jKH;((K7qz1#u~co7=B=| zLk`O`X+9zigGr|?!3!h-g~l&*?dIT|Rj)pOQL#xJ;pV~|n!6)b;(*&d6@Z4|FMQKX zPI5F_Y}zD7PtSNF{Awt%UoUg>Y!8YRND>RrUwzYBSc|sShB#1%girumroU+p#c*jh z)cq<1|1w#?UZ3pHlPhuB8jLd-O-#nTRLJjm_&X{sf96i~s!7}7tF<%HSngrmd5yup z!@fC|Z-R@`T`AYfhD5*>wP7X$P9^NNn=LGbZ!ppd30{?-leITDEy9gRiEV{r=l2Uq z4%p?tp4IZbH#Kfng>~q5Jy>$<#p-)y?oxXRO2#t&zFk(f`pKC5Vrx+M-^Udsydxf3 zPu4EKpeD&uYRF_(>n?38Uzj}T@G$-D_s{Z-(-2mZ$^+cJEE;$`7pDcJw3TK6Yj0@h zyW$I|bi*(os8V5Ggi!7=JaMD}`PI6soznkqg6@1}+2~ut>{Z9nB1L>-c~~9a3!ce+ zn$vW_{H@G|{o8688RtD~|9yw)WaauvC(Pw|?jeU^*s&($<@ew2dl&tNnB2ktt|?VB zjSRPyO#<1qqs^sa+w)8U<*6zi0jcCuaE<5_rty)9{RQQLwz6DtP^T0;Kn@>FCQF+%yNepNa8 z?T{v|&;1D1Z#VezGjhi6-rwnc7z0~egM+fMzuooqE|(ZKwr(HPj8Xf(noq5OF4_-G z(~WDC!bWL<#ZV4j+7DG$qeBWA-cGqOT?8_g`qVb7mo$Afmb-fg9ke%hV{5A0OURYpib=4}|ewZ_tQe99gZA_Nv#3-*$j}uGVF+ z*D3XT_J$&rn07xl(;raL%&N()Hkn%>h_t`3u5V1}UCroKjT#4#*5X=+Zy2pHtUn}ZS=(&XWW{SI zTdCJR`xq*aE8o*I*i`%o$ysykzZYV6yTqEF;2RKYAlevO6o>xwd9+^PAv?* zy-GV2uxcjB3}i3SlC6x_{};AuC3!)9#aV)F$5oO(ZodYIx7qWJk1y5fceJ)3WC;@jMc-Nl#y4 z`NIdOhME{z^O3B#6DnE1J+eu6znw9(&tC3pR`@--A7i_hdz905=cRI!pbZ~lH^Y~+ z+*>-Xc~|vwc16DO*u%cqBS6+YlOQ>Rt>PmV&*r2(@0wB-=bJnMmF6mXpqz8%d@56VEno!!k93j=l^7++>QK`hEMyUjQ z^+2T6YD+T!L#Uf&tL~sZBV#?&{jQdSx;qk>R@F!J=B&kl4(L<2R7hg3(JDzd+g^&% zVqAjMYLGN8^QG>7MaZz>Muu*0u!z>KuYb_F{062oFHN`W0TRX#xY?HMqA?d^rZ81M ze6ub>?956ct74&Lu_6Hf7S^DIq!cz!eN0D;^;mVh3<02Jxw9F>5*0`84v z$ONmIU5P3WX63d}7hm(yFI2W;p0yjvSL=(P4>`6qC(-i6HYts5{r)2TTtBf^VCiS0 zNm_VmyE|@*p)qT9SngEoS}WX8H}hYnkH2v4ByavH5Y8_bt=AjRwpvNw*7Ub$W%Jl= zzmEyozpn#`?Xjzuuhq%k)&DEma z!rSG)CDtHZ8kve+P}6(*R^y^i({?44sAT6IDg0c=^2Rs&Xs8<$b8}?>cQdoqj@Hx+ zn*!LHu0!aXbi6euF?77U(;`a$3d-@R^%|#h7q_V>{P5uEhyrpK0wrN}Uvh|bhNeh;7dol(g_l3)dGT#+$ z6jD<;HK&(&nxBF~)!AxVk0@UCeeim|n|p8WP8l^3yKV-F$@^M^JgCn94>C8u;^_p@ z2R5&5f}lB3N=1&RpN&KBiQkmYyA*-4Iq9RT32}J%%xZ+Q6*UaCL=HLhrck(0BJk&B zUYOGt`Qr(hBEaakEIWAibn0>OZ}++_{ybT zd0gZJ94tXqW-PgP%F+fW9;Z?*RF{hqxXL)LFsCpA^3545PYtx0*kjQPN!Cg-_F!Hz zVU?l`adJK`LC+rNv=04$0&0Pk(Ynh-lvf&PrIQr~8nnHAp6RTmdX!U@^O>1Sqj64t zCR^jMu_2UUmR`w&Qk2$0X`w}kWs7qmL5#_zeSexl+vqdVsuR}~Mc*XBbhQXZMiS^x zABBSQ7R_B(T>Y`a&=%n$27d5)h;yBw(*V}vhllxljQ$zcgzWbaY?whhDQ_7Mu(oI%r3O%2p1 zaLB=3X$JWGWN`7{BGcBd?>(t}b;;|x$hM9u-O0ymsO*{_Xi(r=HegN0v4<*}E!HiW zF)?E=p)J&b+Rawm>~Pgdx{g&?5}&xlwb;LB~*#x}utrh@^DXXgqgK-QtxV zRczd;tMXI`|6QP?&oswp=A(2?wu#wiEHngCE*FZM2XVhQQ?H*|d!c+P3~x_M7t651 z4RTneM&~ZC8e~re2;#}{tG|a4y*-s6dfc7yoM*WqJeoEKpm~0_EPAXJhBsV+y3U4J zJ8cI8WVUd09g03=!?_57Nu&BPAFClYdtr>bvyRlQAi4-urg~Ws`#^%zY3v0Hf+tGoD78M9ilPM7sv zP;V;9eHaZx6g*<(xjSWqh5mmTtYTKaPC;+om0)`(IS9XOrJ= zb8nYNAlob~u zwj5f?H-x_I85J5oQHt21Ty3pX%cdg(au+^|Fqk!~(vBq@BU$eU?%kK(L?I3cxU`#wEJtcw>yJWT5$rSl_11JGP_#vRptV*9A$q}kXbbx zm?8h0{pWG9Q~&B43!d9TVu?nPL|~#$uX3BVzDvlrgA`u83-c-SPaNo1Kt}Z(cxl2s zq+GGB>t0jlincE6;WDH;mR5k&eIGM1qdjI%qMv*95p{7A*cOkf06e3`xqxLAf#JMP z1T>DAYGmwy{W6j%pA;eEc`gfpsQWV-S+|Xb+OZrK>^!cG9jCN(?3(l+1&}`LH^CWl zf>-)uN*=h0!^2%OkvJP+2Yyk_hC{jDd)k+G={&iNk|G0-omV1=Q0==2dejV}V>E)3c6lc1&5s%#tc}ty`B@b+hksqHn^Nt(D-a ztF%gCt{hDsL%{kTk)A=zH0LUzmc!DH?qB};Q<%1F2aZHj>(uu;l?cLpp1N||azW%n zKWxcMG;YHHs!~*tiH1~aZC=t1@*O*|S{mT&#>lR;?NtHA#h%jMX_CjuXGTy%eb~)I zy$CJBp@M!feWHwYup9LD(xTe0kIms@{j9-L|~e*j}8_~n;pV44}kPbwJn|F*1KTI*BD z+GOZR&=scJq*+vJum7SMRS($V;-YARJx+%j%a-3%&hB877QAE0lDYzW_b!fKY;Msk>^pi zz^zo;%!1pI`~T4b(_u4Pkz?yZo0Lv2l2Db6?bH!;=R9|Ko#8@>w=HPNX0;<{BH(Z!G#r0p5bkTS z=JBKFZ=7^*+>?JLJXqy35Vso}(GBj)@SQ0nC>pqIss|MKGBjsvD<;B5V}Y&snY-gS zOjLQ0Y~E9gn#6{r|Adr*z7I(!;MZ8%S5K(nX{`RJYKYfU8EvTH_`vC>9lM*VULUOc zVyW&Z`2F44a=Wb|k_jCcT2BaOj;LWzL-Uf)cV=XOK`@WK&Gu`{cM>P@uHFq$D&t^v z7zz`}Ya&G2Wg&~$oAT}YO)BRZ4(jkY6J0N@L((A4I@v49U2bezMN4j`dNNE9Hfo+% zoLo#kp^4wId@`)X8d;zynwTHb%51L0hZF7SX-#YzSQA!U#)mVyJI~+vcU?`q?1&dM zM=+4N6<=o{2+!F-otaBJwigO%N-++j1ApQCv2j;jim*dz(V!}F@Ze0@py+-?ge31t zVCFqudZ|jjTxnUHe-kQPWtuNFcYQQgZJ={HmePRJU=4+10*>1TPs); zjy;tywBc+xUNJ8&e8`KDxXoa5Es^)Xi70PH-bT}WfU?rNSJ~&x1{x|6X}unoM~hF{ z=P)_$r?6*PP4>qY7+H5WnU|ywDa@MOfP<%^1FeM9J@wq|RF3>Db(Z}_QqmeQd(TL z&=;Wa8+pQYzy6Jv#`)=&E%mB@wIaN725ce<+Ql%RgZFmv8iUIx*UqEx5eH?j(Kg>uMX(6Syzj9fJDwVdr%c({@ReADvq1QD!)~h zCpfUJI^NM&441M7tBhafsIrk2BC>}Z@uH|<6HKYMW|+JCgo&F`rgbzcxczlT?_P&^ z*P;vgQ6^+vzAEOu7dV@V)>VajSZSv#{#unx{%NN};98;|ZHHfF(jzX5J6luC0;TcK zb=(ozNP6=(MFJ)~%($P8zebkg@LL(P9$Q1y_DysQYpCUV5K)S~NjEi)D*k!Il@#m|;d!=4r^BU) z!>7&z! zO^x959OT8v+vGjKESulZnR|H=^)fkZxu^z`Vo~LSwW}>j0ChrL<$~;w>sSz`WzONq zD))NqTrV-x1-o|AO>NMk?R+yBCTT4-Q*KZsW;+Y&UMTQ~eMM_aEb!_sK@y0-JKzLe-s76H`z*Qai|jJ_I>rjxl>aP|Z2PkP5FG#I z#19>J&sUk)3)fNxF11Q0i%49=^(&?Q02Ec6ZDw8J3|!^u^OFjGTmoGLjl(w=qagL1 z-<;kH=&(q|XwbrU&t5?ENt%|o? z_GDW3zXRq+#{WB4ezHF7YW@Gaj3xGKu3Gg#!|9{IYf*3nKQ#@}NzVB6Gm}E!(pkMG zSBjq^;bv~{1twxxm*fO@=hvapKP{7hQjuIR@7REqlL)q|BWV?u2-na>!<|zyM)Ho1jQ=pofqD+*U>3JaR5Z zgDis0=oJ=@59@*lQ)6l!QA-P(rUyJGOOVZkvvy76Z@Xo^so~%H2zU%9=k0gw4j*fo zCk!#fgbYlv0So=obk{&pZuqiwK{Y@V^~K_ybtzC_h4A9=6AbEOgK!ujT3iVUe2|${pGgckEUCkdBTrV@^e~U{W#R(V5HhSV z&!Y&6(QU`%*mu%WelWliZt@<;4fU#bn)$YlbhM6=Ze$pzAP%4YtFKx{pLFJb20&f6 zoo|bo=12jU9@~J@L_Y=LC`T^5zk0Oz+Ne7VjbA?9E|}EVjB1mypn83_;&)u8bu#h> z)d=W9hXWT>788f8G9nEkg#aeDh|flbqxQp}fcs!?R13cR9e+@S^6#&QUt!qKFp50|OBjsJNFomHJ(+`^~Q6gU4Q!%r@V$(6wvP(OT2M+mKtr>|+S?x<)j zYtrH@#oX9)4|ymvhZ2&K!>E>qW%yhk-fr-_TZo+T11oLc?3RWhd%@i2BbGXqtVp7D z-!#?ES2YsdxKL2w#hb$$WG{=71D9VI;wAz?p859X{mT(Iz}(8m&_Vatb8%~7K;j{| z*b;8h#4>4c{W>ncwQ)S_;FjLC$*<>!Lc1)^1@Mr3;(L{qBGDSkGMa_661C^Fm3#=I zR0G8#^T=Ak{9qxjd%}-!!bv8K(q{=4nSaQLO3a;jsF#nz#c4Rnpe-b7kzH`D#q%2f zDd4;fVNNkv6}d;%5vO`V2F@d#o#{7VQ5PRaGa!=mQ-}FVdz0M5$k-Atg?qwpmJ0mZ zXh%WlkU#>MXjL!zHKu_Lo5~!MFEpJeI1s#$#xjw%s7dYSy5}kMR87aDlco+*Rh!{= zgCTQ0L>(I>^vGk`JLvys3v^AmpjxeIQn)3*OcK==EUOG|uioKuu?&9h&%=oufIxA+ zgTPD<3ki3_DsxS|W`(-TQQ{m6%^46mWg$=yO5zJ zY>UFtRN-(h?oYx-|H>^FAM$mu$;Uw7RV2UnIW$3T?)BZM1l~tXe4w-kBFN6d=Ae3J`!YZm zQTfJ)HZCL189*hJ4UTz0&21UgASfKM!^29lMNTU4{$8-j^3gCArxZj%ho{Dg!(<2P zkEdTPkcY7GB7{Jvz`29X&X`0J&6C4~OJ!kR6BNFRqS7i_|MYO z4k?X!+mdsw{1M`nO|8c0nzN~B0tc3OG``f9=>Cs@))Bdpvk5=k2PCfZ4^viUmev1P zI>R0=@bgf8)`1!3-!>?$zbayjVYbS=_+|9gRb-4=_igHoY<>_Ga$DofIcvCAgRuQ~ zsH|ZngL?CbIA8N3J(z4Ei+M@@$C29mF61^Orv&WpxwQMc;oxIpTQUhjDCanKiB&R-B@Ok-#NAkjK zYwe#@t+UL!DveRHaeQ){CPz*_KJ#9M$`p63&6Y4O zAh9641s!R}bc>t=kmHj<3=o>oHW4t$eV@@o-{|RvNal0GV@u!~9q&Qt9@$AyB90h6 zo^o++!O=r^_DyJs%dslo?us6t-rHp^1;eYiG~srO$m|dG*Q{!Rzk60z8CL*L&+gyY zPqHlp@h!kgAm`^yf8K&eUNatD1$_SF>~?CN^KKGLy0Q?-Hbr`)AP^}}qE)WUfY3RI2&$*~C5hU**z(toO)Ag&&m ziPefLD#=S7L>LZ1BtJ-Zn8mGQJL`ql2Wi^^zYCNFb|?nAcGvhI0f3)D@5Moap2A@#rVD&Cg1b@={Ca6l?x=l)BIJ{ZgEl z?%?b8061x}*n?Ea7erU(8BE`aEPOtcy`LsFBj;Iu$8~J?icc*=X7Wh5Mhg0zA71ZE z6l30qRPy(ar@xIk4cSko5D8WlG@M7ZiT59y7iEj#p4~AC&(KTB@ojc&-)*_={o~o);6fBnW4{0(5tW>iF}`?zg6GSA49DFvTb1b zfOpYv!f*jDiEkopE@C0WgJGr@(k8>4jo^wFz4Mq9yZ=#6`)l@pZcupBYJjOf4-W0m zPhKfL`Gp4aQxZoM<@dcgDxgTuh+KjQAT{sAl(~k}Aj%1^l6#7VfXRDlhRtM1;YsG_ zjN6#bYS{rD9dC5XU?7hd1IvvQo`-yB{nKXyEoKs6^5@chKgUg_M6I6zB<;T^riLqq znd;YBTgY4!TSM#lM8pSkALA&c5{G6bZnm4*_Xl}?7Jl?nL6^IaJ z+&`;eGdxq?P|tXyzoFSBSJ`P-hNA8=lhWgeKm?Te$LtUj47uz0fjCZ>muIT;HruM} z+oN|nnDoqSI_?~sALuL`ytsO7M?e1jy=)s6E;Ob}G1MGS1a@<}TENpO{fN3MffWp<4aw9PJfL9ScpHgK-WJvosY;k{qpb=z(wK>vd`*k^>t!7`4K8+RO*`om-P_R<5VE*q*M zd93=r=fXyqX&A*5+oX!(R3fWV5NYda&9P5AmEv17l5kmD~*-~h~Wt`cz2Pz)BB-tNa>|FvZkQ#?M0^E>ul`MfYqepx<4n#&>Cq zPRvdF=h^|mh^FLqAzN1@zFa+FZgZ=4o0~8T2`+({^;djMVX+B%8N2yx5uy(Y z+>(Nb8|3yB57p+=+uR+#i`QjrNtPophkzxPK}qHwf2ay+1LZ>Iuq^Cwk;i_v_$}z( ze$)85bNSMj(A~RWYDe{5YvN!@E#K7RT;|!;_SqTl(nd#Cey(NSjp=l>7P9n_dD`7e zpc~t5cwoCD=cZMGyE*0V{W>ewr(7TlX?U~Y$x=^~#zaY<{=MYMfsGJhZNzZCXV-da zEy(Wupx|czmpj+l!|>(2YWV1j`{&76szj#7W!RW@Q$Dq|*oM9)1)-XqWU znq&~FK724`gnn@z>A#g4%_eE|wGY(E)u3<#8BD^I{w?|donJ*ZW}ilklMM%PDlN0l zKvBr9-GxuEAr+Sn6^Gl0P3#6|K1mxOsp6hl-(mH;Jtrn_NLKQTXsJIL#ybZ+@h?5d z9X?;-yyK>c8oIcoR7VTtWkKV%O*_--Bl>xvh~nASirnitg*gS4fU)pqMFP5bIF9G= z-_z`s#69!ZY6iz;NPI-a{A7}jx>Gryi8_7dG`?wz06+RTo0SQD(Y5^l!PF10RxLgU2y45&x_<8FWG(b z3r-v6Fp~Gk-=j$Zdm@Tz)tPj}Nio-kLavGN2*&6n&bIUwfgzl#NUQC}=72u8C(6uV zlJ@ZHn5}9P?pC~}kq`A4KC8a8%Ofc@?xKPaEyW4`_<6dg|@6$ zooUvVi<`|U*b30ftm>#=+^F*LLD*lr$tqasRn(dFSL16nJG0)FfSBg+gV!bFfsELSMO`NoX zpV19xpYge{`@Lb06xx%6q!3&VgPy&?2(s~TO4ljf^lt|b3_g!e@Q)q+>=1K7wshib z!;X)%gO=?_3iI8-nepQzv$goA6zm=LFNt&pgvdGgI|kWH;4sdIr}!mWWIx~R?pp(k z;~}6cf8f!w5W2V)kZsj98uaWHDwhYKGX3)qh2O3X01E8ROuoGjEDz+}oBfU&q@2Qp zwlP)jv^afBKfW3(Jco~~!4nvdIOfM*P2TBH4ezIjpiQxy{&Zl47FbRbc^`HwIwX9d z#+A@04GxsP4vg{@Iw{GmG0)(!aTw|T?MiZ8u5a&c=&!-*)R>zIDHjG`m zF3Z4@%`PX?)jRzf`f@uG#@e;lV0_b4fK?nOX|o90&;L8-G-FK|0QeyLytHS^=01XJ zE=bbK_;)Epx6G*UW<&eNpsvgoeMh(E@BhJ+K1G$_`n;cb=1fEwxxWyZ=QWWE9sJ6mtVP1X7mP4vq;}*{w}*4R+sSN7-qOTo#f#^OjhROg zY&#&Lu5uTnKM_Br#qlL_w_Vs3Pe)tbW^STbTP1_&LJGS2HNT2MON^dTsWX_nV$}6q zS!MKmt!Xo^==F)cQRB3Fuhp^8WGMB-^jkk187O__@&bCpO!v3aV*iCydWrmCR08k7 ze?IUJQfTg$6))JFYl3WWkDr#!v~5wdtYWg$g<#n_kW4h-@D0GJ{&8F|P(bjtuQ8W$ zYlz(_wwB9=(Adv_c*`Vu2QPfi6jdL;supO0vTw}{KKc76aQ?18^OLCZVk8vw-zu=l zi}uU1VRhpYSXD?mg5>HxqFY(RYh(5vRdM`dF@_7)z0dwcN(w4JuJA{`EPi1E5#j{s z?79pCYKia@*DfA^IAnm%9~fjXEo2sQu`IAx4Ek%%7_48mOWT3C_CgVE@ptDmC8T;% zGI^+AT2YDLV%olQZ{d93lgv{W&mkkye03y_hctt;n0XFpMTK zdS9nncN(gQz!KCt{I*zS(EAraQ%XOug5c@~(3}AAXgaAk7Us zK;@KSbn=B@3w=V$l_h~wm96gO&J#N*_C_VYTJSjFaTzrbdj{efUH7MIYRDdR*arzL zDw3c7gax?Qg&$HXIVNIzg2!(bS(WXDD9Tf<(+RMfd)np>HR{7V0Itgc&3~`(bX?&3 zNp1H4U{l5`>1(>Pq2-dOyzTkmd_g6PM)f!(%6nQu=KjDEYWx^-ixzT^q-ala54ul# zHcZ6&vQR-9mdc&&hDk_y3U+F-@By>)_Cw0*fuX0Dfl3u+KVLNuchFBQ;D9-qk2!H0 z)dRvWmVWTxAa_E~d?*1yomTW9M30;odjP2XBt$UX;i2 zHGX)jdJJ3A-*lfsqDcNyvC!b#0pU#%g9X# zR0H4s2{Cx4iPREO*ht)Y*LxxZ+q*Z271#Jl9=X5F8G*`0@~ftWlIwW`Z^yfkoDvp- znf!KGet-`rCN!Q%#1yI4Lt{H8)Mzhwl-W{2jRdH2hj4#)T`Tf+X!y?(;{yqZR@Et^ zGFxO0FoZHXYemNCNk5@w_G4$Nx*o2vXzb1ToJqs!`4Tim@@WtmF(jSgKP3jYaR7+$ zvdCG2Rl!XXz5#HL;8wpNGz^}mN~Al0&{)pq~yiOV(#8Nj>rA1gTg#Ib~RHdTD#!)^($<#87{W)(IpY3g*{$l
  • u*5E_*%>^xkHj;7uWZd1*;r0u|DmeEEy+WXt zg{S$uO+3=9w^=TaS;e(|6cQZy516)Z_Gehvr*Rir*7I#!_)%&Rh=}O^0@RhB3%~5G z-9ye`P^w6mzaRZ8WEQG`9DlvG1Mh-Ge?Vj5Yw0nR>EnYXDaKC*Kb}j)dle>ot@MX@ zMFM}T!Fp-(%w{IZZ>n$`n1p5*0ea8{WIL001rjZ#cYO9lCrNoD9N57poxJT3K2nI* zjYGG%hmhd1Gzm>IuQbWrc{$1Dd3N~T))iJdz7}g9KYBI&D&^cekPUj{RmN62npglM z$>gSnvzHU}Ck*g>8qgjRu7K0sN^KsP=BQgI5V%%%IFbRwLWYTvw|yRO7jA`LqPGYM z!G3Fpl%WtsXqE3~JBXx^yC%ejnsF;e6npWJZ-k=5$itfaEaC-CMV`@Z2?t#%(VAQX zCpED;Fino5%aU;&N5IUc*Yi`OmaCP%b1Tt81A~ze3pMNWBM>X~gr>(l!wns;;8tjn9l3@@!}qG)+TGc z0qz@uEqs7M89B*`)Y&1%%*Is-LB>$0Qs7LrT3YtFlLc;4A@P&0EIP^kD<+h;;O{*r zVd|P?XbLhtY{NvrSBt5DyaS5ZElo82kFkU}gR?N*M^X714fTrt!q-+L)#dbfS<=|@ zsu$LuGe0yqw4l17kF+?oybkcim9D?D^+L?O2%@gF`$$%mhBWpZv#WmQe=wHYD(UTJ z3>j<6l^AS3cOeY946-p95)HrL7f`!C6bb!@olo{i*a~*~%7tP+YL+v~zW@t-8=Ju2 z6!FvtS?3_E?(9B%+UOQM$lSUV^nt$Guya#^k7%QQUsI%TQa9ieh|^G$Jg+D8Arq$y zZBRu{u$8cO_CpLtbxz=4Iy#J)C1^g?#4Z`%Me~yUon$NI1~dd?o-G3k#HgXr4SP(Z zqBpN=E-%S5MXxI+BBrreCJ#(!TPF#b;~d^zr&e_y$eO);0WTy8f|wAUu{ETLBpEFR znb)xs?CI&KNH6Iit2HY$$Is;1;B8F|L;;Jm9xNPtl9exkyspQ*mtab^;Q}GLcoX(P z7a7B?L@rd$-*7U(pmAW3jEsKc?B0YdP+7;N|Mwn2ze1G<<*O&>7WIR%(`03W-dIw( zK8j?Tp9PiUO;DKaL`d#Kk8Ca*<0b%pHWl%WEnS`jz%xYd^b9A`^dV8)AjWOf z#QmUCSk+s5DIw19G^MSytR&M=dcq}gUAo0uU7}j^X4#eI^R0SUOotaVH!O&=3=uxW z-@f7OZjcb}T`*>HR3HgXJ#K4%n!(LbZhRidfdazu{MAx645(g0biXxhPFNZNK;qgE z_$k$6okuyU#V6o^K4k}#XM1=0H7B(IIZ;4pErFbfi}%~YP0HU>I$H``;;%%B>SL|5 zLl$T|Z>C|dxwc6G;yKl3r#IG6FWR~De_D#~blViEj$sfRDbdYCy8Ld~DDkz3W)a_Z ze|-z_be>>^5)9Q(6+Ke{xNK@#b)JJnC)P5N=47>lMtl#BkUo5$gyY=9i61&Y$PgO!WpNx4&66n) zUYlzRCHx3Db$vbs*dfI;0{qiyv%tw@~ zXiT1?iMXo@({YTF%a0^_?s;Y2EsH}F3sjZ=kiI3d#{CE#o<#&2(}h!0x+IKz?6!~- zWuL51^BcR_*&kXHd6JL^UJh!Gc<*>1US9tlo7H68z;_fQ(bRMh+4_Bau&U3+n85gc zWfqki-Esc*^=u9zQ=tQ!WEGl}YL2eOvG5@2kR46u6ExNx1LO#A(g^3A-rPlVW_9wd zs}|FN8~UAw*Sxt2+w67iKPgFZ%0Y;6q$Gk52LW!FoUV46)+$=BWqNu4t2b!x6%16R z;M&An*a#HKApD+88BJ%a@Dj?oqD9X?s5}OY)GOPYsB0-{8aO7e^ZFA8#Pb>ux|n_j z1UNJ{0Jmgl9}0VLmcPJK8<4P&rw=!PYwYWR??7cZqpPnP&bg-?USLgC;rqT<*-!L2 zJF*O~Pdfk3Ca9Ov(L_zrpzWd|478b6me;{Pn+55IcR&LO@$0+bA#l;^Y75ws;PyhK z7zVtBO9D3s4uqT9uDo}I0p0b7fLuH)r{ABo^N*fMo%zb6SHM0-;^C)!pvw(DY^!b)}W(9tpC@IucbOenli9@!ZxN zmvZc>9nrFc{-m)~6K0H>3~iBJpMo4F6N3c{1Lt4eh(zc|CrxDQmuTzO2bkcveNcG% z6uW~YegK%T3S@1W`zNmw9Da?M?;qGkmEWTxw59@ktd@}cfkMHLopD}~Y9GY;9XZ~Z z12)j&qYzlxmrR&1K4_C=?`>wh#-3=H>gfwX6-8Sr9E8Rr8Eu?qZe|N0ENtF))HnGI zN;(@!uZ9#n$Rj@y5W&7!@@cJiX6j}i{&EeY$qtv9vUV1UtU&7cgW4Z?EW-&1xv$+9 z_`#qQM>=wHwvr-ivpTRpqeSUz;*-BbQQR#ZNP!ondpa0tOr+p(5ncg)A4_gi zD#3r8Z}Z{@UhX3^mzUtX?&RuBf)MnsE@5ltUVE>g@O~GDE~j=5MHi}3+pvC0aiaXO_x(oGziZ!s(rN>HbzaMx= z?_0+ah=z304|$Mz*Zwn;NP}YSb55LT8p%kgPbcU5X+gN57Bu~KjZ8l~=d_7OYRWvH z9`^_DH5i9`9zu$VQC`F4031t)4hm9oi{5ryltaLN4wC)(_Go7ZO%_5l5zcBtT)=^^ zlM0!fa5Nhsjf#a7+r68Lw2OqcQ;#Y_uQ`c}<{Ct2&3WS^ZJ*oYORn?L?t|j*%g*>+ zVK&TAO8#G|n=`4)7ns;BP@B7B)c9?zR#2ohWD>eg&ykx)%&!PI6mOh%&K;J<(G|J6 z#!m{IGebFz(|+lrQN$E8Ec%sg_*UYm4!4`Hf5!T97gl$&*h?&T@wRO-oQWK8L-im= zyBG-|k7l62(tk zh6^JRzdso#++AeWgzavGF>*F`)!4dP$P1*X5$w8GwzQI1o-J4#pm^am8;p=|57b9aB!D2`K>kUvw2=+rH*E*NnS^{ z#K+fXgSuYe?l*_?JPlod^lo3<*hq%;&j@1NoT(X4h5z}q#oaykB1ka)+L%-@$xfbL z{Zw?mryNL$dG>5ToJ+uuT~HN<3ukZIaqvbOYn~&L|_W zX$p-oh3iygExHNETNZY4=s>{_idqIFJ?(h@l2DX0zFoy3-ctLh*!BE1XWRx z)Ry-`##@$wKz^yS2UEPu93V)u)Z;54qT`p?%3z{naz)lA1lyqdc0^3Im#D|f#ZqCh zSlP6txvjbCnYHx{+YdqXz;*bCdRQ%~#LvV04_biFhJ=kFVUi}A<$h7|c&BuujDC|~vIE%t zOP##06fXq_WVzueZBZNeHug1d}-P&sR45=3hM5Gt1>Exo;bKEg%p(9v=u?J*xGug zAA6xw+kctbeF1Y8t41$;-!=npF*zF(If1PD$R0(SPLPctl`(WFWX?S;I8QB-Sv~3s zrG!w7K;@H_z1$N^yRKc7W06DbxuiQ!QA}i5-U2dX=!qA+H6d?EQ5&c~5-c4mQKWyM zkDnZ(Cl|nZrK@@g*Qdc;x{^8~9zSw2bomsZ4sL)FRmE=r{KfN*7eQTV?i9WcLI)z} zE<$g7tpViy4=Z!iNv+2B_^q!$@DdXlg=?`0@zQ#xH&A^;a3LdKq_rY2GQeZe$;vJ! zP1#;P%!|s&nhDv_%TqyKl=qjXDu`uK+DzS(|8O+jTTar_3U_KS?ej=$DvShD4MPWz zdsub~{Uqe5C0{f#@W}`?>?hOvSGK{(GC3WBzH@XmhopK$t9%noXH0IWASpK!0Xpq? zhYL2VL)l)_2er5;7s(7pt^e+iYJKqcacSw){-_jWi6dBy;hHwP^bG;wa(3(z-3?x2P!mz+08>S~R@lNeEII|6K-& z;XjA8c0nrdsEqgdi6H#!m1d4I9|@!P9xq&8a1?2dOOm~B8X%xus!aa$rcWWK$i~f# zinlsQWk+Ds*LiY3kyk6c~q9_XjR1eF9_79{&fFKW~Y0-gb*Y&I)eS3@v)0 zY=w}dA(0LzZV?Cf*szigVe9@k4x`bF>czTz(c`;d z{|NP+{pu4x(%N5ByN?gR3ZL3EuxTLcb6F!n;44FL_TpA$i;{^BzUYBEEt`PY?&^J8 zmcd^)QW2rNif}*|cp~jT=7pDEaVb4xw&qqc^TnKA$&%g6~TnBI! zO_-cqwUO8%+tK*FQGNpd`$s!a N+4HCx!~h)R{{fqjAa4Kw diff --git a/charts/metal3/0.3.0/charts/baremetal-operator/templates/deployment.yaml b/charts/metal3/0.3.0/charts/baremetal-operator/templates/deployment.yaml index 2f5c5f03..93503d4c 100644 --- a/charts/metal3/0.3.0/charts/baremetal-operator/templates/deployment.yaml +++ b/charts/metal3/0.3.0/charts/baremetal-operator/templates/deployment.yaml @@ -71,6 +71,24 @@ spec: - mountPath: /tmp/k8s-webhook-server/serving-certs name: cert readOnly: true + {{- if .Values.global.enable_basicAuth }} + - name: ironic-basic-auth + mountPath: "/opt/metal3/auth/ironic/username" + subPath: username + readOnly: true + - name: ironic-basic-auth + mountPath: "/opt/metal3/auth/ironic/password" + subPath: password + readOnly: true + - name: ironic-inspector-basic-auth + mountPath: "/opt/metal3/auth/ironic-inspector/username" + subPath: username + readOnly: true + - name: ironic-inspector-basic-auth + mountPath: "/opt/metal3/auth/ironic-inspector/password" + subPath: password + readOnly: true + {{- end }} {{- if .Values.global.enable_tls }} - name: cacert mountPath: "/opt/metal3/certs/ca" @@ -93,6 +111,14 @@ spec: secret: defaultMode: 420 secretName: bmo-webhook-server-cert + {{- if .Values.global.enable_basicAuth }} + - name: ironic-basic-auth + secret: + secretName: ironic-basic-auth + - name: ironic-inspector-basic-auth + secret: + secretName: ironic-inspector-basic-auth + {{- end }} {{- if .Values.global.enable_tls }} - name: cacert secret: diff --git a/charts/metal3/0.3.0/charts/baremetal-operator/values.yaml b/charts/metal3/0.3.0/charts/baremetal-operator/values.yaml index 010d7024..688459f8 100644 --- a/charts/metal3/0.3.0/charts/baremetal-operator/values.yaml +++ b/charts/metal3/0.3.0/charts/baremetal-operator/values.yaml @@ -45,8 +45,8 @@ serviceAccount: podAnnotations: {} podSecurityContext: - runAsUser: 11000 - runAsGroup: 11000 + runAsUser: 1000 + runAsGroup: 1000 securityContext: allowPrivilegeEscalation: false diff --git a/charts/metal3/0.3.0/charts/ironic/templates/configmap.yaml b/charts/metal3/0.3.0/charts/ironic/templates/configmap.yaml index a645ca83..09f174d6 100644 --- a/charts/metal3/0.3.0/charts/ironic/templates/configmap.yaml +++ b/charts/metal3/0.3.0/charts/ironic/templates/configmap.yaml @@ -71,4 +71,8 @@ data: IPA_INSECURE: "1" IRONIC_REVERSE_PROXY_SETUP: "false" {{- end }} + {{- if ( .Values.global.enable_basicAuth ) }} + AUTH_STRATEGY: "http_basic" + INSPECTOR_AUTH_STRATEGY: "http_basic" + {{- end }} DATABASE_HOST: {{ .Values.global.databaseServiceName }}.{{ .Release.Namespace }}.svc.cluster.local diff --git a/charts/metal3/0.3.0/charts/ironic/templates/deployment.yaml b/charts/metal3/0.3.0/charts/ironic/templates/deployment.yaml index 99090956..a438cc47 100644 --- a/charts/metal3/0.3.0/charts/ironic/templates/deployment.yaml +++ b/charts/metal3/0.3.0/charts/ironic/templates/deployment.yaml @@ -96,6 +96,13 @@ spec: - configMapRef: name: ironic-bmo env: + {{- if .Values.global.enable_basicAuth }} + - name: INSPECTOR_HTPASSWD + valueFrom: + secretKeyRef: + name: ironic-inspector-basic-auth + key: htpasswd + {{- end }} - name: MARIADB_PASSWORD valueFrom: secretKeyRef: @@ -129,6 +136,16 @@ spec: timeoutSeconds: 10 volumeMounts: {{- include "ironic.sharedVolumeMount" . | nindent 10 }} + {{- if .Values.global.enable_basicAuth }} + - mountPath: "/auth/ironic/auth-config" + name: ironic-basic-auth + subPath: auth-config + readOnly: true + - mountPath: "/auth/ironic-inspector/auth-config" + name: ironic-inspector-basic-auth + subPath: auth-config + readOnly: true + {{- end }} {{- if .Values.global.enable_tls }} {{- include "ironic.CAVolumeMounts" . | nindent 10 }} - name: cert-ironic-inspector @@ -151,6 +168,13 @@ spec: - configMapRef: name: ironic-bmo env: + {{- if .Values.global.enable_basicAuth }} + - name: IRONIC_HTPASSWD + valueFrom: + secretKeyRef: + name: ironic-basic-auth + key: htpasswd + {{- end }} - name: MARIADB_PASSWORD valueFrom: secretKeyRef: @@ -184,6 +208,16 @@ spec: timeoutSeconds: 10 volumeMounts: {{- include "ironic.sharedVolumeMount" . | nindent 10 }} + {{- if .Values.global.enable_basicAuth }} + - mountPath: "/auth/ironic/auth-config" + name: ironic-basic-auth + subPath: auth-config + readOnly: true + - mountPath: "/auth/ironic-inspector/auth-config" + name: ironic-inspector-basic-auth + subPath: auth-config + readOnly: true + {{- end }} {{- if .Values.global.enable_tls }} {{- include "ironic.CAVolumeMounts" . | nindent 10 }} - name: cert-ironic @@ -263,6 +297,14 @@ spec: - name: ironic-data-volume persistentVolumeClaim: claimName: ironic-shared-volume + {{- if .Values.global.enable_basicAuth }} + - name: ironic-basic-auth + secret: + secretName: ironic-basic-auth + - name: ironic-inspector-basic-auth + secret: + secretName: ironic-inspector-basic-auth + {{- end }} {{- if .Values.global.enable_tls }} - name: cert-ironic-ca secret: diff --git a/charts/metal3/0.3.0/charts/ironic/templates/secrets-basic-auth.yaml b/charts/metal3/0.3.0/charts/ironic/templates/secrets-basic-auth.yaml new file mode 100644 index 00000000..c06bf2f8 --- /dev/null +++ b/charts/metal3/0.3.0/charts/ironic/templates/secrets-basic-auth.yaml @@ -0,0 +1,62 @@ +{{- if .Values.global.enable_basicAuth }} + +{{- $ironicUsername := "" -}} +{{- $ironicPassword := "" -}} +{{- $ironicSecretName := "ironic-basic-auth" -}} + +# Check if the secret is deployed and has a password +{{- $oldIronicSecret := lookup "v1" "Secret" .Release.Namespace $ironicSecretName }} +{{- if and $oldIronicSecret (index $oldIronicSecret.data "username") (index $oldIronicSecret.data "password") }} +{{- $ironicUsername = index $oldIronicSecret.data "username" -}} +{{- $ironicPassword = index $oldIronicSecret.data "password" -}} +# If not, check if a username and password are provided in values.yaml +{{- else if and (.Values.global.auth.ironicUsername) (.Values.global.auth.ironicPassword) }} +{{- $ironicUsername = .Values.global.auth.ironicUsername -}} +{{- $ironicPassword = .Values.global.auth.ironicPassword -}} +{{- else }} +# If no username and password are provided in values.yaml, generate new ones +{{- $ironicUsername = "ironic" -}} +{{- $ironicPassword = (randAlphaNum 20) -}} +{{- end }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $ironicSecretName }} +type: Opaque +data: + username: {{ $ironicUsername | b64enc }} + password: {{ $ironicPassword | b64enc }} + htpasswd: {{ b64enc (htpasswd $ironicUsername $ironicPassword) }} + auth-config: | + {{- printf "[ironic]\nauth_type=http_basic\nusername: %s\npassword: %s" $ironicUsername $ironicPassword | b64enc | nindent 4 }} +--- +{{- $ironicInspectorUsername := "" -}} +{{- $ironicInspectorPassword := "" -}} +{{- $inspectorSecretName := "ironic-inspector-basic-auth" -}} + +# Check if the secret is deployed and has a password +{{- $oldInspectorSecret := lookup "v1" "Secret" .Release.Namespace $inspectorSecretName }} +{{- if and $oldInspectorSecret (index $oldInspectorSecret.data "username") (index $oldInspectorSecret.data "password") }} +{{- $ironicInspectorUsername = index $oldInspectorSecret.data "username" -}} +{{- $ironicInspectorPassword = index $oldInspectorSecret.data "password" -}} +# If not, check if a username and password are provided in values.yaml +{{- else if and (.Values.global.auth.ironicInspectorUsername) (.Values.global.auth.ironicInspectorPassword) }} +{{- $ironicInspectorUsername = .Values.global.auth.ironicInspectorUsername -}} +{{- $ironicInspectorPassword = .Values.global.auth.ironicInspectorPassword -}} +{{- else }} +# If no username and password are provided in values.yaml, generate new ones +{{- $ironicInspectorUsername = "ironic" -}} +{{- $ironicInspectorPassword = (randAlphaNum 20) -}} +{{- end }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $inspectorSecretName }} +type: Opaque +data: + username: {{ $ironicInspectorUsername | b64enc }} + password: {{ $ironicInspectorPassword | b64enc }} + htpasswd: {{ b64enc (htpasswd $ironicInspectorUsername $ironicInspectorPassword) }} + auth-config: | + {{- printf "[inspector]\nauth_type=http_basic\nusername: %s\npassword: %s" $ironicInspectorUsername $ironicInspectorPassword | b64enc | nindent 4 }} +{{- end }} diff --git a/charts/metal3/0.3.0/values.yaml b/charts/metal3/0.3.0/values.yaml index 5bb11c6b..61de2445 100644 --- a/charts/metal3/0.3.0/values.yaml +++ b/charts/metal3/0.3.0/values.yaml @@ -25,6 +25,15 @@ global: # whether to enable tls enable_tls: true + # whether to enable basic auth + enable_basicAuth: true + + auth: + ironicUsername: "" + ironicPassword: "" + ironicInspectorUsername: "" + ironicInspectorPassword: "" + # Will be used when tls is enabled vmediaTLSPort: 6185 diff --git a/index.yaml b/index.yaml index 8b263c06..e6af4390 100755 --- a/index.yaml +++ b/index.yaml @@ -111,7 +111,7 @@ entries: metal3: - apiVersion: v2 appVersion: 1.16.0 - created: "2023-12-01T10:22:15.23758+02:00" + created: "2023-12-07T12:01:21.064919+02:00" dependencies: - alias: metal3-baremetal-operator name: baremetal-operator @@ -131,7 +131,7 @@ entries: repository: file://./charts/media version: 0.3.0 description: A Helm chart that installs all of the dependencies needed for Metal3 - digest: 2f1d7b2d19829ab15c3b109292054f651eb0d0bfb08e8a76413e93d35c4e1841 + digest: 4618759937031459bd923b9611d91ab974699e1ee64312a91a2d13074c4eab93 icon: https://github.com/cncf/artwork/raw/master/projects/metal3/icon/color/metal3-icon-color.svg name: metal3 type: application diff --git a/packages/baremetal-operator/charts/templates/deployment.yaml b/packages/baremetal-operator/charts/templates/deployment.yaml index 2f5c5f03..93503d4c 100644 --- a/packages/baremetal-operator/charts/templates/deployment.yaml +++ b/packages/baremetal-operator/charts/templates/deployment.yaml @@ -71,6 +71,24 @@ spec: - mountPath: /tmp/k8s-webhook-server/serving-certs name: cert readOnly: true + {{- if .Values.global.enable_basicAuth }} + - name: ironic-basic-auth + mountPath: "/opt/metal3/auth/ironic/username" + subPath: username + readOnly: true + - name: ironic-basic-auth + mountPath: "/opt/metal3/auth/ironic/password" + subPath: password + readOnly: true + - name: ironic-inspector-basic-auth + mountPath: "/opt/metal3/auth/ironic-inspector/username" + subPath: username + readOnly: true + - name: ironic-inspector-basic-auth + mountPath: "/opt/metal3/auth/ironic-inspector/password" + subPath: password + readOnly: true + {{- end }} {{- if .Values.global.enable_tls }} - name: cacert mountPath: "/opt/metal3/certs/ca" @@ -93,6 +111,14 @@ spec: secret: defaultMode: 420 secretName: bmo-webhook-server-cert + {{- if .Values.global.enable_basicAuth }} + - name: ironic-basic-auth + secret: + secretName: ironic-basic-auth + - name: ironic-inspector-basic-auth + secret: + secretName: ironic-inspector-basic-auth + {{- end }} {{- if .Values.global.enable_tls }} - name: cacert secret: diff --git a/packages/baremetal-operator/charts/values.yaml b/packages/baremetal-operator/charts/values.yaml index 010d7024..688459f8 100644 --- a/packages/baremetal-operator/charts/values.yaml +++ b/packages/baremetal-operator/charts/values.yaml @@ -45,8 +45,8 @@ serviceAccount: podAnnotations: {} podSecurityContext: - runAsUser: 11000 - runAsGroup: 11000 + runAsUser: 1000 + runAsGroup: 1000 securityContext: allowPrivilegeEscalation: false diff --git a/packages/ironic/charts/templates/configmap.yaml b/packages/ironic/charts/templates/configmap.yaml index a645ca83..09f174d6 100644 --- a/packages/ironic/charts/templates/configmap.yaml +++ b/packages/ironic/charts/templates/configmap.yaml @@ -71,4 +71,8 @@ data: IPA_INSECURE: "1" IRONIC_REVERSE_PROXY_SETUP: "false" {{- end }} + {{- if ( .Values.global.enable_basicAuth ) }} + AUTH_STRATEGY: "http_basic" + INSPECTOR_AUTH_STRATEGY: "http_basic" + {{- end }} DATABASE_HOST: {{ .Values.global.databaseServiceName }}.{{ .Release.Namespace }}.svc.cluster.local diff --git a/packages/ironic/charts/templates/deployment.yaml b/packages/ironic/charts/templates/deployment.yaml index 99090956..a438cc47 100644 --- a/packages/ironic/charts/templates/deployment.yaml +++ b/packages/ironic/charts/templates/deployment.yaml @@ -96,6 +96,13 @@ spec: - configMapRef: name: ironic-bmo env: + {{- if .Values.global.enable_basicAuth }} + - name: INSPECTOR_HTPASSWD + valueFrom: + secretKeyRef: + name: ironic-inspector-basic-auth + key: htpasswd + {{- end }} - name: MARIADB_PASSWORD valueFrom: secretKeyRef: @@ -129,6 +136,16 @@ spec: timeoutSeconds: 10 volumeMounts: {{- include "ironic.sharedVolumeMount" . | nindent 10 }} + {{- if .Values.global.enable_basicAuth }} + - mountPath: "/auth/ironic/auth-config" + name: ironic-basic-auth + subPath: auth-config + readOnly: true + - mountPath: "/auth/ironic-inspector/auth-config" + name: ironic-inspector-basic-auth + subPath: auth-config + readOnly: true + {{- end }} {{- if .Values.global.enable_tls }} {{- include "ironic.CAVolumeMounts" . | nindent 10 }} - name: cert-ironic-inspector @@ -151,6 +168,13 @@ spec: - configMapRef: name: ironic-bmo env: + {{- if .Values.global.enable_basicAuth }} + - name: IRONIC_HTPASSWD + valueFrom: + secretKeyRef: + name: ironic-basic-auth + key: htpasswd + {{- end }} - name: MARIADB_PASSWORD valueFrom: secretKeyRef: @@ -184,6 +208,16 @@ spec: timeoutSeconds: 10 volumeMounts: {{- include "ironic.sharedVolumeMount" . | nindent 10 }} + {{- if .Values.global.enable_basicAuth }} + - mountPath: "/auth/ironic/auth-config" + name: ironic-basic-auth + subPath: auth-config + readOnly: true + - mountPath: "/auth/ironic-inspector/auth-config" + name: ironic-inspector-basic-auth + subPath: auth-config + readOnly: true + {{- end }} {{- if .Values.global.enable_tls }} {{- include "ironic.CAVolumeMounts" . | nindent 10 }} - name: cert-ironic @@ -263,6 +297,14 @@ spec: - name: ironic-data-volume persistentVolumeClaim: claimName: ironic-shared-volume + {{- if .Values.global.enable_basicAuth }} + - name: ironic-basic-auth + secret: + secretName: ironic-basic-auth + - name: ironic-inspector-basic-auth + secret: + secretName: ironic-inspector-basic-auth + {{- end }} {{- if .Values.global.enable_tls }} - name: cert-ironic-ca secret: diff --git a/packages/ironic/charts/templates/secrets-basic-auth.yaml b/packages/ironic/charts/templates/secrets-basic-auth.yaml new file mode 100644 index 00000000..c06bf2f8 --- /dev/null +++ b/packages/ironic/charts/templates/secrets-basic-auth.yaml @@ -0,0 +1,62 @@ +{{- if .Values.global.enable_basicAuth }} + +{{- $ironicUsername := "" -}} +{{- $ironicPassword := "" -}} +{{- $ironicSecretName := "ironic-basic-auth" -}} + +# Check if the secret is deployed and has a password +{{- $oldIronicSecret := lookup "v1" "Secret" .Release.Namespace $ironicSecretName }} +{{- if and $oldIronicSecret (index $oldIronicSecret.data "username") (index $oldIronicSecret.data "password") }} +{{- $ironicUsername = index $oldIronicSecret.data "username" -}} +{{- $ironicPassword = index $oldIronicSecret.data "password" -}} +# If not, check if a username and password are provided in values.yaml +{{- else if and (.Values.global.auth.ironicUsername) (.Values.global.auth.ironicPassword) }} +{{- $ironicUsername = .Values.global.auth.ironicUsername -}} +{{- $ironicPassword = .Values.global.auth.ironicPassword -}} +{{- else }} +# If no username and password are provided in values.yaml, generate new ones +{{- $ironicUsername = "ironic" -}} +{{- $ironicPassword = (randAlphaNum 20) -}} +{{- end }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $ironicSecretName }} +type: Opaque +data: + username: {{ $ironicUsername | b64enc }} + password: {{ $ironicPassword | b64enc }} + htpasswd: {{ b64enc (htpasswd $ironicUsername $ironicPassword) }} + auth-config: | + {{- printf "[ironic]\nauth_type=http_basic\nusername: %s\npassword: %s" $ironicUsername $ironicPassword | b64enc | nindent 4 }} +--- +{{- $ironicInspectorUsername := "" -}} +{{- $ironicInspectorPassword := "" -}} +{{- $inspectorSecretName := "ironic-inspector-basic-auth" -}} + +# Check if the secret is deployed and has a password +{{- $oldInspectorSecret := lookup "v1" "Secret" .Release.Namespace $inspectorSecretName }} +{{- if and $oldInspectorSecret (index $oldInspectorSecret.data "username") (index $oldInspectorSecret.data "password") }} +{{- $ironicInspectorUsername = index $oldInspectorSecret.data "username" -}} +{{- $ironicInspectorPassword = index $oldInspectorSecret.data "password" -}} +# If not, check if a username and password are provided in values.yaml +{{- else if and (.Values.global.auth.ironicInspectorUsername) (.Values.global.auth.ironicInspectorPassword) }} +{{- $ironicInspectorUsername = .Values.global.auth.ironicInspectorUsername -}} +{{- $ironicInspectorPassword = .Values.global.auth.ironicInspectorPassword -}} +{{- else }} +# If no username and password are provided in values.yaml, generate new ones +{{- $ironicInspectorUsername = "ironic" -}} +{{- $ironicInspectorPassword = (randAlphaNum 20) -}} +{{- end }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ $inspectorSecretName }} +type: Opaque +data: + username: {{ $ironicInspectorUsername | b64enc }} + password: {{ $ironicInspectorPassword | b64enc }} + htpasswd: {{ b64enc (htpasswd $ironicInspectorUsername $ironicInspectorPassword) }} + auth-config: | + {{- printf "[inspector]\nauth_type=http_basic\nusername: %s\npassword: %s" $ironicInspectorUsername $ironicInspectorPassword | b64enc | nindent 4 }} +{{- end }} diff --git a/packages/metal3/charts/values.yaml b/packages/metal3/charts/values.yaml index 5bb11c6b..61de2445 100644 --- a/packages/metal3/charts/values.yaml +++ b/packages/metal3/charts/values.yaml @@ -25,6 +25,15 @@ global: # whether to enable tls enable_tls: true + # whether to enable basic auth + enable_basicAuth: true + + auth: + ironicUsername: "" + ironicPassword: "" + ironicInspectorUsername: "" + ironicInspectorPassword: "" + # Will be used when tls is enabled vmediaTLSPort: 6185