From e8ab6968504f1bcdce0c303dd6fd566946d6dcbf Mon Sep 17 00:00:00 2001 From: Steven Hardy Date: Fri, 27 Sep 2024 17:16:18 +0100 Subject: [PATCH 1/2] rancher-turtles: disable core provider pre-delete hook This can fail when install fails prior to installing the Namespace leaving the chart in an uninstallable state + helm_v3 uninstall rancher-turtles --namespace rancher-turtles-system --wait Error: warning: Hook pre-delete rancher-turtles/templates/core-provider.yaml failed: 1 error occurred: * namespaces "capi-system" not found --- .../rancher-turtles-airgap-resources/package.yaml | 2 +- .../patch/templates/core-provider.yaml.patch | 11 +++++++++++ packages/rancher-turtles/package.yaml | 2 +- 3 files changed, 13 insertions(+), 2 deletions(-) create mode 100644 packages/rancher-turtles/generated-changes/patch/templates/core-provider.yaml.patch diff --git a/packages/rancher-turtles-airgap-resources/package.yaml b/packages/rancher-turtles-airgap-resources/package.yaml index be2ca60e..df55ede5 100644 --- a/packages/rancher-turtles-airgap-resources/package.yaml +++ b/packages/rancher-turtles-airgap-resources/package.yaml @@ -1,2 +1,2 @@ url: local -version: 0.3.0 +version: 0.3.1 diff --git a/packages/rancher-turtles/generated-changes/patch/templates/core-provider.yaml.patch b/packages/rancher-turtles/generated-changes/patch/templates/core-provider.yaml.patch new file mode 100644 index 00000000..76e13ae1 --- /dev/null +++ b/packages/rancher-turtles/generated-changes/patch/templates/core-provider.yaml.patch @@ -0,0 +1,11 @@ +--- charts-original/templates/core-provider.yaml ++++ charts/templates/core-provider.yaml +@@ -54,7 +54,7 @@ + name: capi-additional-rbac-roles + namespace: {{ index .Values "cluster-api-operator" "cluster-api" "core" "namespace" }} + annotations: +- "helm.sh/hook": "post-install, post-upgrade, pre-delete" ++ "helm.sh/hook": "post-install, post-upgrade" + "helm.sh/hook-weight": "2" + data: + manifests: |- diff --git a/packages/rancher-turtles/package.yaml b/packages/rancher-turtles/package.yaml index 78f46b08..74f2c4c0 100644 --- a/packages/rancher-turtles/package.yaml +++ b/packages/rancher-turtles/package.yaml @@ -1,3 +1,3 @@ url: https://github.com/rancher/turtles/releases/download/v0.11.0/rancher-turtles-0.11.0.tgz -version: 0.3.0 +version: 0.3.1 doNotRelease: false From 1ff243e951577644cb004a98700c69049dfb5a73 Mon Sep 17 00:00:00 2001 From: Steven Hardy Date: Fri, 27 Sep 2024 17:18:32 +0100 Subject: [PATCH 2/2] make charts/html --- ...rancher-turtles-airgap-resources-0.3.1.tgz | Bin 0 -> 128301 bytes .../rancher-turtles-0.3.1+up0.11.0.tgz | Bin 0 -> 210715 bytes .../0.3.1/Chart.yaml | 8 + .../0.3.1/README.md | 26 + .../0.3.1/templates/airgap-cm-core.yaml | 54 + .../0.3.1/templates/airgap-cm-metal3.yaml | 4390 +++ .../templates/airgap-cm-rke2-bootstrap.yaml | 2751 ++ .../airgap-cm-rke2-control-plane.yaml | 4508 +++ .../rancher-turtles/0.3.1+up0.11.0/Chart.lock | 6 + .../rancher-turtles/0.3.1+up0.11.0/Chart.yaml | 30 + .../rancher-turtles/0.3.1+up0.11.0/README.md | 5 + .../0.3.1+up0.11.0/RELEASE_NOTES.md | 6 + .../0.3.1+up0.11.0/app-readme.md | 5 + .../charts/cluster-api-operator/.helmignore | 23 + .../charts/cluster-api-operator/Chart.yaml | 6 + .../templates/_helpers.tpl | 24 + .../cluster-api-operator/templates/addon.yaml | 56 + .../templates/bootstrap.yaml | 55 + .../templates/control-plane.yaml | 55 + .../templates/core-conditions.yaml | 31 + .../cluster-api-operator/templates/core.yaml | 63 + .../templates/deployment.yaml | 146 + .../templates/infra-conditions.yaml | 64 + .../cluster-api-operator/templates/infra.yaml | 84 + .../templates/operator-components.yaml | 27887 ++++++++++++++++ .../charts/cluster-api-operator/values.yaml | 69 + .../0.3.1+up0.11.0/questions.yml | 78 + .../templates/addon-provider-fleet.yaml | 44 + .../0.3.1+up0.11.0/templates/azure-rbac.yaml | 19 + .../templates/clusterctl-config.yaml | 34 + .../templates/core-provider.yaml | 82 + .../0.3.1+up0.11.0/templates/deployment.yaml | 80 + .../templates/metal3-infrastructure.yaml | 55 + .../templates/post-delete-job.yaml | 166 + .../templates/post-upgrade-job.yaml | 78 + .../templates/pre-delete-job.yaml | 67 + .../templates/pre-install-job.yaml | 99 + .../templates/rancher-turtles-components.yaml | 3338 ++ ...er-turtles-exp-etcdrestore-components.yaml | 123 + .../templates/rke2-bootstrap.yaml | 49 + .../templates/rke2-controlplane.yaml | 49 + .../0.3.1+up0.11.0/values.yaml | 86 + index.html | 8 +- index.yaml | 46 + 44 files changed, 44849 insertions(+), 4 deletions(-) create mode 100644 assets/rancher-turtles-airgap-resources/rancher-turtles-airgap-resources-0.3.1.tgz create mode 100644 assets/rancher-turtles/rancher-turtles-0.3.1+up0.11.0.tgz create mode 100644 charts/rancher-turtles-airgap-resources/0.3.1/Chart.yaml create mode 100644 charts/rancher-turtles-airgap-resources/0.3.1/README.md create mode 100644 charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-core.yaml create mode 100644 charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-metal3.yaml create mode 100644 charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-rke2-bootstrap.yaml create mode 100644 charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-rke2-control-plane.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/Chart.lock create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/Chart.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/README.md create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/RELEASE_NOTES.md create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/app-readme.md create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/.helmignore create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/Chart.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/_helpers.tpl create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/addon.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/bootstrap.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/control-plane.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/core-conditions.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/core.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/deployment.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/infra-conditions.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/infra.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/operator-components.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/values.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/questions.yml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/templates/addon-provider-fleet.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/templates/azure-rbac.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/templates/clusterctl-config.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/templates/core-provider.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/templates/deployment.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/templates/metal3-infrastructure.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/templates/post-delete-job.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/templates/post-upgrade-job.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/templates/pre-delete-job.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/templates/pre-install-job.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/templates/rancher-turtles-components.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/templates/rancher-turtles-exp-etcdrestore-components.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/templates/rke2-bootstrap.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/templates/rke2-controlplane.yaml create mode 100644 charts/rancher-turtles/0.3.1+up0.11.0/values.yaml diff --git a/assets/rancher-turtles-airgap-resources/rancher-turtles-airgap-resources-0.3.1.tgz b/assets/rancher-turtles-airgap-resources/rancher-turtles-airgap-resources-0.3.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..2e03c34e1b543ef51b7d875e7c5f57260c8fdad4 GIT binary patch literal 128301 zcmV(nK=QvIiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMQQ4#milrq}CwirN!(>D}GYdvoZ?9liISPcKy8?h&RTXfPv4 zf&j%PGBV>JGLZjw00Ob4Q{I%@U&px}L%IKzwp*Ppe{JPHpIct;AlIbZ@sBqhhkyHD zH3)(r0>l2@LlE>|J%nM=bo2Sy0!EEM>CJ*KmTlwW7+=+f^~Z|XZDYL9>M>R9{3;91OI6A zzf1gQ=9b?7_*eG1ms>thM>!q;hd&(Cb^?dFo_8=$m-Zj~RsS)ie^>n9slqjeLEHZ{L@Uwa$nNC{9`PSv`CNipMU)M=a6RQu>ZaK z^Ur)Z_oLkY@%+_O`#;(lT(Wyh*{Wxz!aBrl(ELEK?>_9JT!$S14zx!o5r?{304alT4|wyW z&NtfbwdEFx$i`F4y?!VLx0M04ezv^|z~i89b0!`GnFMm8ifLGEVU9={`*LFC70k3a z(?*Rxbq4Yy`6@;V?wdRZ42r3dn`{Qb>D=U|6|;^?@r;I*EtO2>$=BN#wyTfSpUy3q zO(lU3Y*4i9%M|J*qMv@B3|dfo-BbPCHE5ot*o(bDfrDz)eeXD(d6LlF(C38V_Vqvz z{AfDQUl7#U)X8PyM+1X|@M{(u%A*$jS0wVZ;*{Ld+l1yHo2Yvq0auuU6mnr=$0-J0 zsh2=SMpt2?m6MbP%mN?ZdbS=6d?!m3@UqnYN@nGYKFLuXtxc3_uTJ zQ;NA>6key1cs<49uWtpD%tCR=)47cT4Lo3{%i)uf1DIvhN*-bT)(?~b*g?Q1Kv$}p zH@_oR{YINg9VZ~FDfV2xm!TWZDcuQA!P@r{6Q0Ef7_%F}L$*=n=|fUz1JOBtHpx=w zUK`Sf7=E7Fv0 zqZFxs&<>X+Qci|xxg21`UaWUorq<}_Vx@G@6sj=upK>~w1$ zUABA;Dm7(iv#!n-D_s+dNu^QQj~#P~r4{&TSBqd0M0%yVkZ6eBQB(tJV`T_P8ySnfOr6GCA>bPf+WWuI2bK4ThltbkF6hXc05r zk!8dS^6b%}nn@@3Z%u{eM%vRumAawkP=&91PzOJnK00M1o5g57lRrx~DA+=M#TJ(; zZz&pnf`T;S3|PrWp|J~@pvMZ@L_Lv$^Nb3P{JH#EJ+;uk|z*!M2tvuJaRF71()F9a7_*rg%dx$D4#Ef7uHi;3v#px zY!y+My8s)vFI(qTTdxE0t{6N%^ccotf79KQYxiyvfI^j$prCEJw;fBj=$2nQT}?jt zUz^q1(YC|Ie#7kYVfg+5114J6Vx9G4`Y^-T)9<@bKy2QowM9Ig3N1eB_z_eOEy z`8ZDDs+9qM1Gg4Hm(6#<0STdJM_@3;<>AG%Zh2G4!edT9bOQ;y%g)9bAsDxlk>QTgX@RuoT_1bmElJu=lO2XDn}wTbZ@K#bs38I_p7RIvMKlrVfR;jVOgGasLK!r zMT~)k2=VYyFp~ zOLMg;d+wBlWuyg##RH0PKjEzC80FT;7jnL_$WC%a=pe}~?52W=k)$(J9kLi>twm$v z(t4zk+!0|!k>%KFn)$ZMrTfV;+$9U!R^3SiA3!BvcJgG=3^h-p=iOQ=A~R3m*Q>R7 z@@V8fj8GCjAVWkIMIZv&nD=p;?0mhrO9;>Bon36sI{-Go?bT=OelA%HNKC1~6=ufhox7l48xyTqU;JZY|0$R>GKcEDI z9sBb65ox4it%AL46}i}I;Ik=_IUvUVG2&1!@b$$QP|VI+f#E^ws_e{wpEQfiA`3#N zXuR)|c0idde*wJa4RMQm&LIh!O6V@|w3m`1+(Fo>Mn{5;YC1-~?QJT$5IngX8Hnn% zx;)8NVv15DW#gzlpyh|`@^x=|&VF)JC^yO+M4x|5)|`%uVR3hK%i$p0lM>Y^=z!WH zJI@%{@TkPwu$#VP<*rX}&Xx+_5qlrZf~)a%Eam;#UVT+$i5}eNgP#;I1>ldK zJ3hh=hI_RE<28iZ;~acLTKi^FPz+~tIwv6s%_h#HatipE3|$zGA)uRxaRLh6pId09 zbC=lP(yOm1d`hQx{I}sNqVgjZDGD4j{5$d!ZP9rDda4n!2wGOWoqxw?+knoVp(R<` z25ufpzJ2Kk{z?{j5%e*YK%5EC{wge}K*sa$tPSQ6Zc*qJ>%I-hV{S+ActQKsh?1JA z*_e#dOD;)ke3G!L3w6iv1dR+y7_s_k`7K6x>N0W0(;py(BEM zQoW57b~bBNAT^zpZX%Aa^Qfg8vO{Z#n_bl5=G10H_L5?*ZK2|?pSPxLt9Zm!%RiLA z(Hbh43QDEgCX1m)WW-WKKR!oc_1b(Gv#s?@K}hd-3i*pg>M8WLznyQjiCU%5IFDKPoSUPawgm#~bF zoLyC8wRjJpat1J;H7y#CA5Z3lo*-C}v-a+h!tMO4&DQw%5~5*YtqVvp_zaL7ItG9) zpzjda66OV6U4|(?7Nk-@lz>X_jb#AR4PaT{!KD#1F+u)!PO;CoPobr@ z%|Re{f%sris`2H;=*2BUfd$*f4xs(8AiN2tE~R2pIl+3(11G3g5f`n9!?ui@=(80M z71>JaG`$bo+jUb$kKkM&V=9)z_F^;sO%{G9Y?aT!S@Mk!bprm9qeJnTc#&LhX?eB| zx^rdr-!z>GI6lsT&#R{tkLrcv8T7f+77L>XIc%QXR)@VD@-wZ0KL^eWxHpYwhKP%2 zzY_ehzr*Q$x+W~niTCP8+E-UcsbodC$V8(@H1?bmT{XzA1GL|i5d_ZL>C`g;sd2Bs9gdJ4;An4fxc@cTyPrzC69@8g=I<&Jt!4Ke=`PsP^0FlcP7At+l1|F)e!k;`8Iq${Tx)Ai zfGetwmvDY=VYV*xVk7e_k;`~~T+s^~OLQd>)q(c%ud{1Mzo+yfR<@@H#B(>lM+%n# z!S#M5YA`nKCF@IuheW|^_=&(5gEJ*IrJ0ZX@r8;IFm^r#$m=^T*oydCA@AgDM)UxX z`5R@-zusCWeruQ_NF(Q3AQ|8=s6x%_tyK22c_qZ}qizJ9I+Jp17E=jB?*UTjZ%(Ej zM>?wlNE)VT5GbRC&Rv;sdJZ#VmD)T@9!_k8q&_$}l~>7@ig&Rq`Kl#u}u zoW*rSOZZ6nb@@#yjrqUFI076$)k1+;E9sKsq5T}A=g{ubd&aHOD+n&-rZoB1hm0Q5 zki7G6m|~tM@HXgl+9Hvq_FH`GQ{j?DMZYedNQr*YD{Zxg+eKD8_nG@VWhJ-wlU!Xw z;l(U~$X=Kd;eO9MGI}=HYfN80u=JEu-mgaD$DAF7F;XC3LKly4U|fVnnlAkpD1pI? z?%oodC3Ns3yn_P_8u?Tc@KZuLCugNiXwZ3oHYiOI$wx0u0~D3MX+6PobzKU0A59FY zBH&#YS%pW#7Nc#&@6Sk3;pJmB!R?RaRiC6a&#eeYX7<=agLVf-52PAUa4p#8-3Oud zT3Z*4lPxVN@iby$iqHV>rGBX+CS3GYXS<(7CV$|~l6!xL)L=f`4tpri_dPa5&aY5| zIR-FkTiz@S@`W7(nXksSm50HKZ$6P`s*-(j(p{jsm@*AL8h zb8w+QmLb{R6eyx_QK*qsvsg5138{UIvUT{Q0-w>+it4yupEZGw%Rq*aEZ57vw$dSL zj~}C;?^aYSa8uESQ=d<5d!KcSZ#~*g_eRPY%7+WJncniiiJOQ+_)lICriCG5&dCr7 zJKdcu+~BBN)Xu(D$M3O6Dv#bE$*J(JgjznofDNKMkdTJ_IYGlG%vAlz!sv{VdLPFx z`rP7f?u7NUHk=yEh<&mrm%*jpty_u5v-Ip!+1k_ zD5LpGks_t~GILR=9PlSNyOYQf6N<+a<6S|`)b&{x2Lvg+(q^ks0<-xCwq&&erD%e z?-ruw;C{Lg;-bKVWqX13M2Bw{aOn=^__ZTLLUp%KFl1D9^rbXWsGc({rI<>gv&EUB zrFj3XfJ86aJ1y$Z$F2<}S!~CxVzM5eX>-ylCiV64A=fpp$012EY}Ffrdtd(k?E3aa z;>@cnOkVmxV)}XyIxR_4@V$hVL1an)Q+V{ew?ytvx0EYcw=}R%{XLv+k85eQN^Qc)5Ebo{H1kQqxz4}Cp z2xg;hmk(+^&7IAF@iJvRAY0-Z<(Rc+6}Bw2s>Nh0ezn2f*OHX2dojA5Mr;a0bDJl> z-yoU{TEIxGe;fboogF{Usma!4;^YDk8w!wZgVG6&lj*zINuXP^1t_)N^KMHYtK-Eg z-GMoYN|1Wp^(qK87PRwC*BkY8QU2^zP6+m4@3?`Km~4er)8ewYsrma}pMqtqAL*Nb16aTHGf zQaY5C_DV*%q)$_8JYZq64n|Z;yBRJ}4D`YX(+4?Y%h&+P@vJCbEASY^)#*2xSDKh8??T?6Qg1Qi*W~jO!<7EeIXj zYzr+=*jZ2HV0RGZWd8=-7iQPTUVC)>$MpKvO7p@^bQooZ0&EL;5QyJN#AC-n#&m$T zAS7lBH))!2Pe0MBJ0#csuJ(jMdi;BQ?VYPk)xLe#p5Ku2)Ndb`>;M{J zC$wCd8>CtT@UluLPrhqsTZm%4UP}SR8}N#zsS-QLPHMZ@7_F>f*5p$o7km<0vLi`P zHgW{2E`gjN+@O>8Cub$iJo3Wf@-0e-YehZiJ&=0>do%mi_7$RaxVJYC(4|=M)jC(6 zvT6k=ynDD^3pEVgMLwou@>R<|+038XEyJ5|{S0X3zEHY)S9HAJk#I$DgEW@y*0sBP z8#(65+c zUXg_?TRQCePNe%+XMXQyp&qXkgG$3y`i?AMX&|+VVc}KT=~_?k07Why@{gY5JWN=Mo{|oHJ|3A5hu*k%CjDPq-zPpYJ#Q17E*n8vCX-qi#Yqo zRN)nI4rw&b3rkxtj8|R&$_V4g`R*8U=5)26Wx>bST##AnuMml3MDS{3a?~7b4cSqA zB|d&Xz263=m|BxV3M|=>D!CBm-}FzE4VAY@Oes%~+vI*_m}VXoj(q496Rq}NC=A4#&3<7>mwK5I zckON-!uCoPKW|PabB}aYCFB;w22v7C*F*rw%jn34-+(@RejQz6rLTE`vZcwRs3LPS zC9`+-!jS};$;~q;Vp4f>tQkixe{c=~sPyj%Ek)a75qCvN0Dps=43P6tO7eD#y2yHq zY@1lKl4ni~0w7RZlQ`9f^~e(ew|Q-q)_xZ!W;#hhKYL{Ige3A2IxU~P<{^d7z}(y8 zAn0aQk8eOVDW7&JCza#YEQz5K>n7{S1bd!Tmm5wn4#|0EnC{vo1LrtP zZts1lXFd`j)!2?u;i<+}0>!nwfk*t{VvxUmlQz}o0g=(e=!$3#03(s8}aOgHGdN!{J3 z=PxEpX(A*H)!Ncax69q#Kn-#6jlBt{9Z6pl9PSJl!e3;O&XI|jyp1z}NG99RWLiyJ ztkg->l$2$~q_e$QrBb~+f_R2n^C`|nDA`9Ix@F>dQgLv$;13Tyk!9bMm2FYjnYG|6 z+_X{_*D1Oz97PUc6w3LTjI;`zSHZ@pHuPOY(I6kehyZ;hH>#xY0)svI5;z(87`KW; zk8TgA?k`UgH>W4pd>=%UVWpVHIP@M?wWYveLx8XwQGlpwDx}f`F7>XRnKxGlxA0%a>}+K z&hyeeqlcrzZZQ2Agj4>eq>7wsw6>t>O4{mw8#?dG-8_S(JN%S|xQexU)Ku{tUA3A0 z787IkWVQfklkcmWClIoLt> zMcBx~#XWoG@RgExOq{hCXEH-!cF_$~@<-%dUTV+K$LNb%rwvJy(#z2eTBpg6TPMTK zFb59Qe}kr=KM$3sts|ZsG&m*HEo<}>>;^hjuh06`GU+vo;C6UIXMezq1v-D z=qNrMd@H|UyfDU^_N%tvczc`F5(Kf`Z_zvWF-6+`P>ZZPqL`ocG%f}%E=H=;3+y>6 zQQ$TMuH<=^@-sPcMzFuk%!#OHDIAF(5#k0;e--JdEIAJ72;9*na=*o*r4u@2!X%Zn z)}>t{g%cs(OHo)QMnMWa7lV_wyn!4?Kv6WbTq&fPnT~qW(Tw8C>d!Vw(F@7jtTmbD zs_Ukg!@9YIP*?{~-(Pk$j@W#`AXmm&TkGl82|J6S8FjOK$W z!Yt?WX=S~u$?{!ent0VyOztj z1}#{6`c1{?Ty+wD8Ba6bUwTU-+Pd_ zhVJ*4p?WFDCyCk4AbD@f^u+yn*a;f4#7?YKzf#xWYpo$zhVwK;@KsXV0c8V1D%n+< zw48UPo|>iDPhdqoBO-LU9;G3C{z&bJbi^pz@1|oPm&@Rt%xGzF2cAm67DY=;;^0g&-qj zyH@*Gy<0gkoz0EJudUf}y&f(F1cADYz61roe_=E6FkoGAh2DwxCMeC}RA**-6LuxP zC8p4!dDAW8uFJ{=7dgE~;>nZzN626{1r?EB;XSYL&G~5@d5@L+7}@tL;r<sX@P3Bx}`h1aExW%Oe0IsU=iF zCU38;Lc`g^KO1{BQ*MLJ{(g3!_Q^e!qXKK!AVau;VgVh~5b8qrYuXYA(ByKRQ=-L; zH_h$~rMevEeX=J&AZ?rz@P1+2l`ev3 zIu+fjdg<@R^rlC*N<##GT0pv`xUHyk-59;wTPYDjAM>IR5t(}|S;lNh^le{!`o<*< zx4XuTznuCTxKG5^h&`*M4e-Ss1N`MQ@j!p>8N~>Iu)KW(KL0+c%>A00`B}o|3ZX6i zT7YrvIu|G?Bq*YNoK?auliq&$;)Lw(BwUnRK5l3*$ z4fAh9vqfQbD>yYp+N=cXNY;p1>ciaxYp>^IM>&o>!^&M3qS0lYAJ>w^B;PD7+k~(w zO}sjcwY?M4BqgWn(LPAga~h!BYqK8S>BW(LQT?G2X-HVyph))#rMY)lp2R0j!{>pP z^3o?i=o9WN@RuEXbmU$R%yPE7M1e;K_&e0g-_ZOH?w1dRjA)F2zW3xoY9eYH!{BcI z8>QOG`{e=~?A$K_5G+?Ii55@^=~oVr&TQ`yf37iH-ZgJfnsrq^K`FT%_k<;+W=T_= zgCfX#`%b)7(?S|3O>so@ARpUGGoUMMK=X5OZq3f+PZk+Iwr?bWZr?CQfPGR&wPv-dLS6zFlt+zBeigE&daWS;F_i`@_pd>*@_ljvgSB31}W%L z->}Q}c~;5#kXVWeIfyyv=MLM{FKpG56!Xr7DP9mGi-Y$8g*zOk;%Wjr zh!a#4TVOXJWi1OjJ;GuszQPar&`A9QZ&W@d_9zX=T4A55W-!NSA#un&G&AbkA&HV1S4RLqFtkg!92d9iL z@Jk(OV2%1A)d$KJo!g2Ww-_fQUQzKGL~CBAzIn@Aj(uNK2ve!nAgQ%agVidNRNqTG>Cz>p2uYW*c_Pi;TW zjeAMN!p)aF_6VkDnJ4@1`pqmR7-Q9-G7Spr2paMmWl5^)oikz*9Oers(Tbdh1)W#EeVP_sbk01=coxxMuZ;XQ=QI~=p2MS{2_Aj6#1~T_d8zw3fpVc^Hw3DnrDi7<9l6d7_3X zg)oKreT?9uz#dOds9?BWzmg7Ggk4{IxsqEWFN{zdkgK;oGf$K=u z57$slfs`~MEsk73ng~qjU{{-o`*Wl<@IF`Q6AvS!&axZdHV2Ma5rWy%E+Hgm7xILv zysN9W_U>iCE@BD3p*Ub;_mPm@GF_;`UxF3`*Vcc?Q(&R>Ue;PI>nn!66MenWG;9^~ zhxDR0_lU-jBFzkMg0`hz{VE6#C0P;6&`RBGlYE9yf|UDByB+jaD5|$H#a)fjdqs%v z)UqJa^P%^qt@C%-CF?sgm^u+Zj+a&y7_;y;zM(|?Lo^gz9RF(p#I+;*rO(MqjBYL+H4`GZr*Qz;o@|Q-qR2ErFF^fMQ1>j7)EeyA!jTJ?9Y!Mei?5+b{5F&WcrpWvG0@vpLW2-j7Kc zUF^)+!zR-CI5#P`qa#~5kWfSRxIFq4JIK$0OO1qwh(N+5S`_~T3N=r=(mnLEDmY!k z8V3*iK;K52`t7vY;9CAbU~00=3YZ@MTTOZ*kLJVW75&T|qigK07O%TBL9~mR)P|PC zGYOg(YISFXpDZ?XP|8k^Zvqo@YbO5uzE&4w?b1iiQM)Y_=#)Ugg&yv2HJEVZiIr-8 z!xw|;EtE^-c$S%9XIiL{kjy8+8U+yyXTFcdDKM?NrEd7$x~JqLqa{KcOm13imX-$; zuP8JRVjeGpsq9cpOLj^lOGXRw^J{Dv8s~%W&<)jeAp4uopCk7~ZyOrz?0bibmtY$@ z?HEu;a?UHC0x+Ms!!AaQybaL^$npZ2Lo>Cltx6etoRzuuCU}`hm9azD9V&&Py|bdW zrS>6Y8B08gL*E@L$)jzsEh<4?tst+4Rj`1yCM6a!#wk|x@yaUyYYrB(8nBUD8xp)& zt+vR#N!&bioUXWQ1T4IZiC2z%vOF$p?SRP7xiC2w1^MbJrBAYlBi zH=q5FnOM{^(n|!ZpyCPGGb94Ft1<3*dL1e9x{--kGKJ z=zcO7T&ELbW!Gw<**Pw7SRjN&Mq-HjKJ?>nLzbK%b)4zR!2oH=Y#8+21|>sFUzbmB z(3Z?sqUdb#UQ%j$UgFh<$AD{<#Q{1)Wew%k6#KW&+C%BOxWR3RWdd7dHmhMtZ_M%;9dcO`RNI~4yS-1w|4 zfXP~k2#&*>Pj}S^dg}QRk?GQFb2)umrD?}&1!&<0iJ=jj50L3lLfy%clWSl*Nwunae zVbUd+&RAT@10ehLaX)w@SwJ(ol5z%Ti}aNXdlhn(B6k@}vU?OzGRY{2ks2E!KyMFE z33YG-{GNer)!A>`ha(o6ZIicW^QSfhK=56nVFgW^rzj`eHUHU{p;y)q|#`rXeY~wa`k9!jio|W35wGC zDM5%y2#(-;)ALyzT$P@kp{V}y8=(II<8dKKPs01&vIe&J?A0pe7L9hHT5W`IXAjMe zmKx(wjMXrb^A;3+xAuGndErtbx&V)#PI(KUO+gg_T5qm#>t({5l#vS+PMrc3CajpO zQU^~^ZtV#|d21(?mG;}z==S0qTAXDq;iHS6n(B;e4;0G6g(M zt`xJ-iHR_a$r8n8bIN0zPhH{8i>7?Kly!eY8Ww2D=DNJ2S%ab}AiVY&_gBib8Tyu{ z?#;i)q#gXKy+xb0C3&FLLvE;tXAWg*3@iKB^|aL0TF(zpBP57D;R4RsU;*2+2Jq;_l$9~$$R4NTQ~I^ZOn!uD!GC7SNTc9p1)A*Yl* zXPDoPQm;U7ySy;n6Ox3rvMcm`>$Q85^EB2N;CSk|7pVT5&251)0UX^i`YF_O$it&) zxp>em2u@;0&!}5bs$smDR@Ko##K=~0h~>&DyV2$H3+f(AK3qc7HeU`)B~E{o!Un>6 z{rLHa_e6=oF&N(JO)hK}4~Nf_O=N?JR{R7jVyL6Y`Ql)z+VDMw-oHg$jEM!l(OzSO zYh3>Md&X;y_jMD@9p;W7&Qjp^$+d!5c1!8LpHlI*VqsvN3{hKm-=Tu+BXSJirEo)v z?{7z8Hj2zu%Djj8 z`#CG#c8VDv0d}K|z(@Qc8sU@KZVG}8{o-zVQ|AS89uF3tlutxR;*ob24jzMjOSzD- zQ^KK*h(`5V#zt3aHJY#yTe1%;l@}I4pi#ZN3ns&6{{mE!bO5TZ@^wB=vA81*oj|mQ z81xuIo{q}Fko>gA{-9jpPvJ50(d+ftDrRF~Kumr(38yq?n9aotV?=LDlebYbAGVnZ z`A{VZhg*uxyiTXSAZO}wE)9xHOy>N}Js#NbWHI8zT+1%AVllXDA$_h+Fe;4jh-06u zAO#eON0^i7%o-@-5t=z2S65iBILUe24X1aI9_DK9q}eED3eRu##h)NiWlGIVpC5N^ zKTspZ*Ak;gn!yy);aQgtSm^7Joy1~ktPCn+OMd41m=3!`1E@@Pd zAa4JRd4*447EipxVW@`E)Q`4et4EXe7H*H`F|sGPD*R9z^Y^CxUgJM!KIHrm)>o=GYY(p*ciEx0#LkUSVp+)FTfz`L8qBiRR3leuAH3@9y?0_%Bi(~L7}KcMhQ={1nBrXGj^N*=TvndM~=ugUPAOVM(mt;LU! z9hlYpGUg(i!OJ*ZFxOEt` zf|OLk+_+O(>~vZDkxLWF_4UCBk)H4QAy(i%3@=`0*-#S00g)b`f*aoRQm#%z;j`j} zlBN>ZeINKE(1*{IIaMLW%R%_>F!0WAD%v6M)DXXj$*)5Jb+PYss*p!-)Q1;x9H|{L zcHnsKvZYs)+Xr7lN*PTchYtZXGJRpVSpm?}I`_N|*HN583OX;M7Uwi8V^t_AykN0L zJ6Js`Fb#qI=brBiG%re^7PKVT_n_fw*a4fl=Q>4p?C@5RR205YqBzg-2rGkG6IHRa zQJWT>EKAKk6KaA=W=Os&tiUQ>r(4rp!fr@cEDW#wS0q-C@PfA@sqs!%Ps7 zo7$*!Q0Ct;i`35E2HVW~#_GjWHSl7XvI-I=JE_ffn^T*s=P@ao0u^Zm!{HB`TR>xj zsWp^fA;1OW+t9=C&=R+*qmxS5Bcd%cqtmnKnR}X42mwX02|ndBD|O~Lj3G2B-|QrP zO(fkU2{lW_O3E=S1oxi~>MLkw==Ma^1Pni-uxK$^ZP?ga@IiP!k`stGbxKM+nCU`a^X1VNNl{4t;;DT>BK&{ zzf3rcWW5H!Ro~V@Pj3hFrg#e?zW3$`G__!V z!SgF=OvHzETAxr8xY}*GAv*`htD?r;N{TYOVmb|47!9)9oX`(= z&en+CZjDau$fT_dJa{Y@3L&-+oN);kw}J|41gZoT?%=e=B_wha5!VHcw`<5y9Htsd z;(Yg}fkf%T0l6n+#5CGZtX~FRE!h;MSvja;E?hV#kGF$;O-tA9gYE&5DmZieKFMEz z@_KVICB|t5yK}&xI&Dmujl$9Bjk9jJYWq=Lal`9Ro<~;@tnk@jW?G+Aqip?b>Tjfo zqPOL=t8}R)Dc2FeN&QROA$7h&omg8UNUUd9r7ZmZqu0WH7?S9^}jKAiQe9v#?K z<0#jW48C>*8_m`(R5&C@v!&;=59Tax73z{gG@Ss z)u^Ng5@XL~eUCFPEjpcSw(=0JTn92x8~}d2AF_>S3b0D$M+yDtIu&6Q8@LsDC-y!w ziKg-eIUzw4G`_J2^E&tN{n)h1@y=JC&Nxq?B8wb4WX=Tza|3+HoOSQ_kVG*zZd}KG z@$XtI9&Qd$Ivr(?h_fg~q2trt-q;rY04tsA=ylLR<&%5{3I-f2u|gqk*?5r7XmmKR zroamaidF}Pw0GWl@SR%=fHBJ9iN{SadT?1QyVI?{cRBKZbiGVzf=kh6Zu~n_Z%&|z z3y#4IHpP@~MVazasUD#KuofLu-+b!De9jm_?lpRX6@#F|(1W~%}N<809ab4s!0hehbYL1WFv|C&r0qTnJsG(3@@W!?9T|I1CD-T!Z?s9|; zXTf#9H%HgVc7zMK5sZ@II}102z6H}s0cDABA5=z(Uj#qlARTi-zSoxS!)D|We5ldH zqeb{0D#|mB(F{9Lx)OWzr{Gh?74{-3O8p3xm^wM>W$cAM=xzPlvAb~BR~alz)J_7j zu>w2O$@1eN_4%L6?%ja|JX}vf;Q{rGw4^Bz(pq#B67iKp?#0G%l9u{=Ot^6K+4QE36a#$4>7${g7f0yhzYGq35TFzl}w*(Jw}#Xfyy_X#JW! z_yHoG;@)PD%5##erD`*}v;p^d}^VA!d34InF7k!n-L%8GE@dsC=KWBVzw3q9H{Wn$ZG z6Danm6s}FD(tb5GU{m`M5&N{Y=@fIO){hznrEUPP-x4L>+wJ+V{d;{p0%2^^|73C@ zqOjbGv-uXRicM*i?4lsp59o&^eae7x*O-PQk4=Jmw;z>+`Lb)ODSOYkJcxluX4TvpRHXZ^dO3IV-a%Aj=dG)VY z3wgf8eb_@f0FW(rBj$yD#6AS^UEo3Af377EHKV+0`s_-Wy_OV{0%GE%Gta2={`@WG z1AGH8AvW1O&J-M7#ffrwH3r)X{)+vG07XE$zoVg2d|s>`^+H}lddPI!e%*^IgSng0 zw&?RNGq@8EnCpKmg0kK1(b#%GWIT?(#N}SA2a5GuLIQk|Jwh0(>Nv+B#3&w4)AR!? z6cMdgP7#GZ zA2}nrfKg(w&0eyVL8m@;6^rp?^l!N#o3!anmyW+xa4$MuLBnZp$Ya4z49{CN-a;;d zL=l%Rd}?oLRY`Ns9u83LhKFq35$06b&MOw&==7&>7RUJ9+#LzHe-Gt`M*k%|F{G74 zDc6bHjb|111>CA)b@FFSCrWE7IxLGP9jub{N@h&iKU$5&4Hglh`98rj=^QMvOaJU- z#{!{}ujhLCLE8{4JH=3g^cfAh9K&)$+Asae{a)vF3r-nPDNJIEZ|_A`MfH)VtC;Mw z(HmLtvYL(dH)MWVZOwq8F|>Wl_$3KqV6|y2#fle}dRl>mPTUOheVu&Y-JZgFXx5*F z*I*g^dTmLx^?2lY3~%aK)c5fx%M4sP)@w8fiKY`uY}RzP+g0Uu$oUEpVUC0)!(7 zK>R}~!V6R=g!017;3p^oN;JUBTHxw6y;@Oa8!ZKmD_Fgc%}DJGX>u!cCo+Le1qDD)o>l0Y$6w^LeZsz%QYsY zoNzs?(#RT&;eT(!HlnI`OaC4f`0cEen4mm5DXzLzwJXLHm51SVO70fqI`mhkch);5m$NvO)#$G#N>n%**%ER3mM7+9 zn6nTu<6oV>#+}uk+2t(Gdo@~*$-h43(pAzsTl%|j)so)jBF29+`a2zgQW1`3)lVSj8Q87Sg-6U zj>?IPVgS=WXht~M`kFd8TYgAuXM1~RFGKVO9KOv1xWMRB;tQ3J8ovirT_6aAl|eH5 zg^}8U5b5e zc?P(wh-k5t`iQ(js~I&sFmKzBA7#Li?(%wqD9jLbu0oCY;lb$yVsRjnjx8IDhbB24 zKPE1&U&dRV4NV8XI{o`0;)cr48+5zo_q0x=<*GPS9|E100f-F7Q9mV@IX?#*S>)F2 zPS-5Ja|!3UTV{Rrfk4gobyLHETD-Gj zd;UQg0?EF3e>{GAPcL484pS^IUjhA_o6c()tK@htgro!+QB|o4dd!!fJcc2q6{iDz zvtC!r^+lo?l68(#FCzVNREUvTLQjif8jWphcd*+*LvbwH5sAEz%9Qg!2=m`u&Wx=Re52e z@NdT0L7`Mf)=q&$04$nzmcE-z2^qu%sg=@XUP}f>kl|QW8XN|k3@KDAVl~7OJ~Az^ zrS8wad8GAQTb*!BynlV_WGjiB9(tMuEMQYeBj28u7VcDrWh}n1pGrH8Hm`~2!-3f6 z+VNLDI>XY;#mBxke}B)~o_tkXm z00-HM_=wm`AaorzYiiF8ZE9_|ysKn>)_ZR$D8tv23;6I`?UuWVBhdyqMhcrwd@v@p z>mlF~_IAL;nrXilGlNRDerD$9%!>=KP#Ax+9o|mX2f4K%z`0W%lUfzVbH^v=VX{~R z#1G6$#*Ky^X%^eTfM55{W)iY{V-QU-b=AV}JA?I#;un4DZS<^eHDF0ayOeJ4+r4s>12!DT(Twn4??`=-@VTz{VLAxkvEpTSVnC>nB2 z9e6~9N?<_kf+(pM#N$+#{p%{f4cws(A4I*h5gDPG@s@KqUvkk(mx)0jXHFx{5t-nH zo;CK0gHOM>fgxvBBh3|CI=LZdL#MQJXimo-r~X-xg2K0CYI+j2-L4*Xq5`Q8b<(sX zQRZWUvAc+*c!>NUL0#cG6%KAlD869Y`i)AE7BOnN|SCg zYFmI0G`@4_;=YT|0ECAGAV?yiFV6a*vbeGC8eGs%L(}14Y~3y78xv8sDYX3h-oj9? z?9kla1|^G0LK+irZD9q@Py?%p>h%j#eH_A@DXj<5R?XYZ?d;~AK_S61#(KgC%Xpcoiihs6X409}{f*S3WZf{bDRLNP;-*L|mR1-4eD z{5)NvI8&!+yjOg|`u%FK>**Ap%xh8w)EJxuCQ-H?Y)uQJRZ3PU6A_)N0`V0pbhC#O zkhDeaBv3tbe3}rK`$QOCz`nU|ghE$k&6zx=Ww98t{SMxFL4H&$)@}6^|DKC=#+uF( z&JP^jj>#&DmCU{=%FYlYVFVJsDI|aGzkPQ4_{VtS6!E^pdNWQv zgnc<_qgx`_@k0yRGN)RVnJ^1FV2wxL*!3n76Q@;Yo;jF z!qqlnFJN5LLLz#z)w()Un2*q(lZe=!-8xb3q2v4PXeIv~n@hs$)k_Gfi8cVVX7F)7 zvnBVK^9<=#`_i-BZE0<%im#_I+*A-QQ>zTkdLy(f%o#sy3*#sZ-wB$KMLxq!Irg{i zK^N!t(ji32I64Y^E+(&?$9>ozCx}!vchF{j{k=)_%^}|0C|^e}m%8Xx@k2adXPZ1A zhajw0H_P^TFA(EyCbeK5VUzsny28XZfI-i9bMWlBxDc~19UV+bLy+m(zeZx742i&2 z)@JN@3%`i%Sxw)qh4^%t2q;H|KDLXu->!@*_5&C2J<&RN>`dah6nZWq@Bw@J_0h?E zC&S438U`ugxj!|Rjl_2_wJ6Mm8&RC2el8RR7-NOl>WMa~#h%eS2QIbDMqryGS9yFrGLLR!uX({L8j`LzvbXYW|vNwqCVhOcD z26v#NHi=mxk@WK^ikFaJf4s3!lch(GLgKkWY_R)%lj$nElYX=Zuiwk4SE|7%QyB6< zr(Zfa=>U7z1AP^Mm0Z@{Xq<|KTsm{dfV=fF?IAS8T1Ci@8|cwH7v`L1cBusAGO5de z)a$ajWKb-`62@#JxdGK>aGDy>*YHnVtz4v|gPr|+`F`SNz^BvV`GR< zvG!}r+zxI{2mpCQIoRu#Y}8VlQZb?!z%+=4L4&ULq(>1Kr;nS?vF2pOAd_3aifTf- zt{+$2uUtPso@8Eo$$#0wet`C|v<%~S7c$Ao;h@;i1Pw{r{1-i(2hpQeh zAF53NrzEIoW?`^tn5fLGA5k}+GB3QGM?Hhy z%I{r_d7?bQclnt~MGVPyE<@Z5;U-#s7d-0pJ^mmQ%a&ij`*_SaU57y3Nz;WhoH1o7r_GD4cXW?Q9MiA98-<(idhz<74mavo-w4%N zTul=`fUBEW#be~@dY|!vImK7%={h1@;YP+;|M@!VSXUELJWl6Y1^G-lXQ&Fl)#}7y z`1Q1SXH2g@i~oqu{JcNf#lHG2me_!QxE?z+nh>J+lP{AMG1uTxhZoO}N@DyQ1l3xE zROc~xvAfs4b?9K&5MmQ?IPW2Rs8z0`)62&!EkjHx-_{U%dEF49+(=j+ItrP$Rax1eZIvb?imA(h7C zvNdf{kM*)D0YA$t*Omx|%x1tRM4(sGaW28WUQKw_zZxn|+r_5-{H2(p)xypUH-kd= zNHSVyw34snOo%aBeg0BhtF6=KPnO^``K*aglliOG_g2(qbAMlM)A#nzjE#O-vb_kG z8GT?E4~Ok}C-nRPA#ra)zH+#oa9!;%?4FghN>m7n{k6zgF50(u2^IO)bVC>cK#WIy z33fJvV#ASY*Q^AN*AyX_^k=QsAt%;{Sa2}va<VdF~&Yitn{q}Rv z1&-f+N?EPFsfV&eNzb!FJ-y#i0Nsv$ECCYE(@apjdIVEJJ_0B{5=C8DiJ<9;i_i<@ z=9{&A85rz0%2<;a81iuQh`S*x;##*6lu$0 zn<}oyKpmUyRcb7SKRT68W&(L#M8vYpwDE8oT{nNatH{fROr#66eViI}M@w^vwtg~b z3pwA!fLB&n8^Lfh>u=5KSe%PZ5-T#WLoB!zCe^W=P`rI0+gY>RygL0Pdy4fLQl#OB zW&RkJcXe^>ofBN+f4jn+B~6$eVzbe1Ch9zUpBG*JJw)|q8~xv$gWe1gt(&O_zkYej zC*@}FlF1G!`0IO4w^{(+wx@xAKWFq2S^w_f$6JZ|04I46Zej)e3n@!c%05Tu5mrI5dxY=YbUW>9h~ zd(PjW@`lA()ZEgE)g4;3^6XFb8!!WC8<)yy6dgghX7`FeHL5pX&TKvSJw=69Ne6dE z?%)`-{KerbqA3Ap(^5isOlh400 z$WSW_8(f2XsAXW`RWtAj#IKvbi3`GpBs9OOFSw?|K>+!Pd!cOz^nZ;$k2P{p~d^YA)#Z^$q{NsO#^Gt90yd zogml}K82ookl6gqv^bxB_vNH_DY@X-3;l{AfnL-?$HVv-m~?58?4rwKJ9BnA_ytWm z@Ro}K-M)1B$%)cTrR`NaLyBhx@fqxa%1e)tYRS8i_rc=;(`Vubxq{#sv61|Iz7C!V z#&uZsBcN*CalO{_Cn*?gD^sLvGlV4TyErI`gPRGDrlua3U@26H%A8kD(dYvB@6W4{ zP#<}ahVZ?S`-UyyPo$z#IblSx`VT9~FS_Asr1f`yJfa{0=pP-+?96We`w7q6b$JFyB z%QOULZhDmVdB_zOH1oQR%+D?p2F9xQY zD@3(t@ek8q17c+d!PD~*&SJNg;8oPDl_4Vik=C(XWwNcpT{*05Q!f>Jx0{K^q6qK{ zB~;LCcb&sguCc;4-?9wsN#HWp;o(O`j#x_Y`<8z#OhEy0E%G;+4W4wv*L~J-#j$DI z2!`~u{U?s7@kp01M6k68fZ!O7&PmdK9R|f_aywa!-P>BVDwz!TO5s3?-&|qbeji)l z#M8BKotwhi!#^6mdPN*@&3PF^ch2?dTV?d@sM^keeZm#Dtwq=(a{sd5V$6fRoPas) zgV88r--0t`xiT^o2H)zq+%th+7c=@^Ypu+xD9qvJD_pSkWO8NA0&SbFT0A?THMF1; zZ$)d@Cv2*1MRDsu>@c$F*f^Qz)rJ@xH0%dX#-&fi2*g!f-A>yq_tOr1Wv9Cwn2@MC zk0T7Js=x(R8h1jjM=~E^52a9%Y?U>}B_e$our&b@8N|uN){4CMs+nM%t{f-=?_E@g z&|^}AaIU=t#RJ$Ipl@>BGb?g>*id_z!dw^xhYhXn6S)1|vVs%R%1-T7M`SS8>lYqb zY}FyPkcs+c0502H-8bQHATwDcvI$NQu(mJPX-mS5Cnq3+vNK+t)IK(@W|jREWs`^M z(ntx8vYMv$yPFyG6zpJ6Kha0yC4+6RRLUHIiv}!YFSj>$rLrk1gy1@sRafP1&;652 zo*Q@?O7Vk*?MHWsGk>FFvL>Wm)mqk=AbWuAF{S%-^yJgX*KZ&cge8wLf)!`P(qbJX zojW9kq7<85q8a z1$9$j5Ypo|#nkwuTqt(pDUF0gnTV!qFG<%|s=%$ZgU$)?q`CAROE5}Kb9Rm@0nUV! z-v#C&?;qB|{?=&#(ZlzlSWptw%V8w^T@?n?Ap_p7lAhejSP6l(VfiX#+kyGO<~MXw z`cBAxTe=+wguPoguUE;njdb4Xv{^MXWS$1-i6=JD;EKA3X#zbwMb1h6+a{6@luQp) zfLm47U4f&Hj~4oY5Y=1O2Wi!{0m`p2la4m4rK1Z@%>a%nH6 zTm~->#(~qC$$V70G(2$jR}T@=)#CwnVW);6#j~+WODQqU?Fc%2u}?q>qkBR`J2Nnh z)G^`W9d++npOsQEN7_u9qo#!y&|o*bd2>I-aDPeii^XOfLtNJpREpVG;CRc&?IUh@ zMu8w-hyCYdO`c*xf)kh)HLJ16>i)(lR0HHiw{u{D;7ZZ8p^R0eAA)xYK~mHS0CTEx zie2cuoAE!SoJl4-C8qhT)p154ZOf z?o~UncS%S;r)h8DRz-@%tfm}5UjG1e=_rQM@{p9wD*vdUe<|2*h_Q+r5yd#=g37Vd zjnPu2TfRY#O{j+Y&>Ja<14$78?{@D@iIEr)TmrMvtTzIAywpl?)%`cuNhU;r)VH>AzYue;=OMO6 zGJXWOruJ_L)g^UNB5+^50uv`5^1#p8JPbvFLPk&(-OlQnIFDF8I~^Au&Dvr(A6~&H*i)Lfluu(-XrD@hN#8RBmJUP?c4XXAR^**K}#`R(Eq@zzV|6P}Hg8u8Xoh}4u} zE4)ZXni=*Ej@L~S4HF^;Q|IDhDNo+pIg5xQ#yl{zAk7GP0>R?|>&_MBs_ctQhNx;5 z%@m61Q6o_#ca1ovmqF=H_2kp~L5CnU;(`g%#b~=yU@~fcv;GjL+ML!q(-Az zz$7y6hPl%R-6pbF1XeRjO@8dhh;SQ5W$W9S3*;Jg|Po=R_RnvQc|U zK$kWYD%fIZYuUCGh?OC6@pz{#qVv$zeFWci9TF6;4ZJBiYVGf`{`{FSKo%_74UjZ+`fqc%y& zosNQ}6aqY8Gb=9#5{Ow7s@>K@(`a1uxc9zDXJ6&$-r=K<)$*MEoN<17vxQxpH`v?d zmR^X9=AL*s&IiG)K1<`gtiECCme8_U!8X?f=veIdf#~}CQT3it>GC^LL9gm4PnlwA zKjz!nk#bLqn?S>hS8+ZD5GT5b#N;j)-TJ`jq9KCTj7MDespA=yQ^#p1v)93K`^@T? zncURgn|RP;xfb~_m+v9>kv|6=B_~OKL4|E@r5~v3t+kV;Ed|=;D9k;;OS}s;ZvLiL znt!#yZ@q8Zfaw%iw;Kov)>?1#z+rXEqI02*v?@u5@D;J$J;jO4BADVxp=uVofbD=y z7&Enxq0@KN_`~>|&yih8=71HCUr{_{X&c}h^db5K8i<`tF{QrJ0erXwDPVv`**@jU zVXMlj&}ar`Q(yF>2i`!9ckSXxo=pCSh_gn*9nqEWf*hDB{LRdqnVH$Ee|65xyOXv0 zOI0cPG1i9=BA%V-(q zGPx5@whwwM&7?VJO;3iJioq=`P%)XPJ?RgdVzEu-)k#>$jLeZ|&}CfuF;-1>A3@-+L!!A*5%%))jkD zp&mISbJRE>rasD|!uiR)LW8c0v(xHPLMS?L5nb`YD8yl#?Sxe*;3|RWsECB?T7#1p zdN0ySbL24K9tTTtb4=Yw!*9-E-D+z&Ql%h znw`;|QGR7*$55U$YE&)N+HI(hKw5awKP34rq zm0tc0#;OS_8b;+nBfXoacK7wn(ZU0}K3DE>(sxt+hn-PRZqn&65JTP;E<=&{tVXR= zY7Md)Ynl6en7BMUi=#3x+RdDt!1C-guVZd1!>EoR{U`;gbYn<=O%Y!L>-kc|OIa+h z_YcGEL^EuLwu;||ptdO5d$GObY{nV-=|(G!BW{!lL!j5^%EmKbQR407wvRa9_D7rb zij{CH2y~;(#lAFc*Ht4t>mrWs&|}p#sa$^k;lNYf1YCHlvTxUP3RlfC+Z_B8N2N$1 ztcNXjk<;8ul=GdSUPTexgp;B#*VefRG6mR*@7H9x=j6sNr)V)7N_N(P`R{tVW7Zd0P(-NXol(sT1XLd3{X{~Pu3A(nIA-_BaxMJXaPKSu1WLEbcp0=55RsBt z=ceLjZ7De^FNG?w`)iD_l3Xi~*EyIO zBc=!)D9)f{o2cI9GE((lLZ*yZhwr#U9pj+e!oh9%W2-V;+B&s^Jh5eF$!Fe#0o0xR z-yU->q!gPVIwQ~hE~M7aK>RJc4Tgl}RLV{DHFH|i?~<#reYO{?kvr%uvM~r-eP5ut ze?_kz^&~4z#yFwxRXpq%trMtprZiTJB^bvDh1 zPK0LJV( zYJEN4yCOaIYxGMs)bwWtK1RB`>pujmO?%C}zZ<=ew|fv4<7iuP*Q zn`;?CpB^#<$xAr+nyy~MHuhro?7&jY5~f->($3RK&58>-j*1M4CAi16^BX^e<5L%V zXA)s)W-Rlhev#v?u#w@gGRs!0>WAv^NsT&3#Ne+HR#meSC(E+>Vj(IPj^R(Zp-4n- zu(f{SR=3}*DlosTV<^8%i-^uzJH5j<8)7M?hLs4rX?g~MUaTEIjeLfmeM4f}%E^-* z^G;-%YR9KD^;O;Jbq6?Q%hDAGZ4cA5=q+1Cg&e?T{qv^=jQuRjJ|}_NgK!~dTq{c_ zXNGA%`R*B2svu~mh*Ds7L(vB$V*br2*abB@#qzp?7Lr-_<5lkbYiSh_9}eqOdoa=OC(8d#MW^JI+I2x3cC_!K7#DyG344T z8pQl+ABg~9zHU*K>eW(GNjLM5&Gso5p*Gt&`EUtt=@IPm$QN38uFQt_*LHl%l$gU7 zD<8z(*Shxx1b)baXyOUj!v^_GRXEmlRb>^&*hyv1UjNjV+^^&pRu1d5!>hQ(vbd3M zZLwvi+kx}ZD1{D##iRnUVaR5utPu1>yH3{(t-9f`J1fdBZPWwqckRroKp=&2*9IJh zB^EbGG7M{AJrdkg=qvd)U0ute!}XjglMkYhYM`H}6U>?YE|xv07#$2lkdmBQeuJF$ z{E_%=RS@ri;F0mVHNL7Ew~-z+iI;+$9;hC~_a#>!s1E<}FQ^Q1ks9lq_eTgu0-b~( z<0Z&mrm6$nhI?n5r(mSXwDm^hVed)Nsta>VOkg2-U*?KT#^oEfj z*?~mn*QX2NY1w9j1Abp5<9O?ogm@^e?K?x7w&#NOmf6X#=}xQ#YsHkfRdM` zJ@0^~DFn!~PH__u-c>E6=z@|^a*Wop`tfI%L=4{G*D|^qEC5XVOLL1^9tic*U9WyJ z_XY;O8FZASAf%Pd8^Sg@4R||1*}09-JHeU+G=|n0Z^mi#F{RAArN1YKgnNL;f{(~A z)q~j{i`ehQB10vTzQ(})t_YzSD|vbtC3ug5UaC#8+J)Wo-D&=f*=uZD_XV7*V!NA9 z1eu_83M-1!DR`wHfohexI*==$2c(Qs#D4HezYs4~f*psZ7vT~$D&Y6rcSB!JsfZ-O zLYNI{>o>?qknG(_r4(+JHl+z+?)ydgqA$PRA(1OXUioQPJE%owfeh|;87QpmKs<0&7FYwfF$uaJk*065L!qcDARjsFI36@%H8GU)&Mq`j?W$v_>7eB6I zv{&$LpigJRXgXbcy(BFSzJN)swI0qVy3Z_HIghOw1zQo6wX<8LFI!fFTQMxy^Sdk2 z=se5lYfKb3s;&%f5hQ!mK!V%Uc&=o7F`~Q6o$$FE5#k-JFRnJgz~Wlh#Wz5Ey}u6+ zhmLP{loe$JlpsmK)pkQ@x7MwOm}i{AsugH&MDN|>rEYAf_EDy}@gKnY)EfRddfpf^ zatvX{ilj*GgL2HD13gP_rRyd-MBQP{l7);-z8!A*G5U%7fkL1dFBZDT)h=ww%EOcP z&x=Gbh77wkj->;# zo9O0brLp}U0B0E2CuAJf4apRi)3aQR>ESe(=r-flE5(cX@2gFck0I`D+1TBQs!FeT za>`%oimh=RG9zU_suXRZp=L*;o^=&MyFJ4X2J$F5oIw2!m`zO!=0(x>4v~Qxl%RLS99y6U{NDR!#nl>9PFGm&Cx{>SzALT3)oS zpJ<>hKzm^RNER}v%+Ob4J%Gavau4lY@pRrhWvPMz2olM}b!pk59;n34k5*S{`orC2 z0>~BG*pdftgRlu%zOWvGr+dahDiccJPBFjr(V$4FZPqguTPJ%6`nhmMEhmY*MiHN5 zkqt4zRDF@7xBQ3)EPItO_Ix(}qIelK5(=9Bum%lcJrvKN*z?L#mt8FqEA`zC74scR zjf-XXsXk$>SX-}Xxx;ZM1yW%b2xdZX& zr}7qIbCetRjaya>*ABcOddSiRD2}sSb@{vrm3RH(!PCc?8?!JPd{#o1*$4i8tS&$L zbrsJ<%ZchE1LXjugOqJj(fgL_k}%^uvf#vz(@coZ4%UhU`t%7q>TN$Wp3~IhMek*V zA(uwdQ&qbz6bxy1H5}vOt2C`FwoRO>>1k89tnVW+y9-&F-b*Hc6bpbU^tx!YyNXp? zav4hq$MWo~$c}XQfmzxhS%(YQubGQPK8*2A9o|_SY(Xp-at^8mhBdXeyFa@52iHCN zOh!HQhn=-~ZUFvpLiMhQ*s)%bs?X7bM;SFjqZXG4QXYq< zF&#Ba)OfDDBSr_HO{ubS+ZLJA&0XNtLqLE(oDmfM!?~xozxq^T&%&$=v{hnhx!{L> zcV)s85{2$}5!DZnM5s%suHTCiq1}q)Tdl~NI{`%ulo%e8Z6)w;=*bJ|x-TlTKO;8v z;zrq`1`6-evOMg9)T1J(S~JxI%iuW}{k?FxZz@i7OVuu+kbRJN@mu{=X+J2HIYi#3 zP=;@N(}~)};Jhu3z!<5wy}AEVZ?}egJkW8Jw4G1g+C}D+}7u14UJYCC{Pbe+!3&;j; zk{0~ot@yvJQHtb0A7IH`mtyziG2JiQUw7BlNvp0TJ4tLiP5babb8% z9X?2zA%_59MbCn?cI`l~MV~jsK+5HF%(|3lNYB2@6>Rh&%uW~$G&HD;PXrh%!1ur0 zz9^<~5le>L|7au!c>G-<|JfX5SF_j}YM&Me?|};W!@O0ZhBM44sOuBRPB-HQIe@)t z!ZdZB`v~UEpSqwJ+BX|*yY7L~pfn%pz4TdGPg`SN z79iO{yjzRcfg^rcp2CQm?DC_wW4UGCP(^$eL=bKgshC6;u65oh-o-QUl`H6lBPODT zque90L^2<2IolkZ zpGJ%jgdfN{!GQ;2Tik;^tnU*~JJkY8PyKFknXJ7RFQQ`BcW|PCJ=)su{ax`>>T+?C zCw7_0QjIziOfte3ur1oU+o&FU&KU9J{Im2f{%c|isR3ZMJ1I^%m^o=?*7uAj=X1h@ zu)9Skq8&(5J2SUWv7z4wtXJ|5mplPCTG(j zq$Ey_ZW)A664rA_!3g}!ITe5?5j7KN4fF0IaC}8#WbJX6gG%F&fP@}~g09SQ?%diQ zrm8^xIw$7a%Gr8vVZ?3G+ph_m7nP&wg_qTV<;yY4kGbCTNG$yyP6XRN`srPe^HjMe zHqeP|`?(wwfO+qu3>Z@mYo$ob9uoR+w;pIt>npW?0CQ)7mrUsq@>F>y4OJyy} ziCa($(|d$fk$MDVaDGj(V6J>zTOzlhx{&t^)r=8T$BxiRULPE!wlPQr^D$Y6fFZTn z8g*|vgN8FTZnD&`t-!?AUN~Mh&_)YT9_abOcurVl)BN_S}Js)|L%HkLYt?Xar|DJK6TIp+}Xr++=ev zenDJVYyDi4y)^qQLM9sCx(8wo@O}1GcYU1>C&R11bad0=_3F%nBLnjMwP8rA0kyRI zxirH1cxA5jFsw)H^8*=k2TaJjTD5-9judwV`FcK&%PzJrlH(OeFTnW%AX=&(tnj6K z3wI^A(`qL)vy0=WwNe@?NyvpW5s zG?5#(Gzvo6pV3a)$^Fji#EiR`w2KP>>D*PwNo0Z?QE)wG8B3}WUEH^_xx)+q9KwA( zA}4QPm-j@?Nu5$MC-OO&RD$~T|1fVT&--7-sQH#XX8_?oS{r6y08&EaYq1^Q@*ZK= z5cURAy2SlFRAisu^+i0Jxf1(x56l*=qQMeMRr`?GQf^;Ug%E2EM8o8BXA#!*pJ!6q zYpEC~?O)Wm5>;^Qr_DRwV>#3-lQ!|Ae*)oTDn}ahv!c0PuP-GXkNr;)ChrN|D&1@t zP+@rW=kR8i0~y_tg;C0bSkGVj-ksPYx{q*R1(KCv6t9kK1S#QC14ipx2E_N^)_}}n za?jH}fqm`lAQK=F`y32WgEH*T(|;`76>%my6DvMT@_-tzcL^!y28~8tZ(Qvw-VvpQ zhw?FBJcMKYWnb#di%96~4jS~pI*78HaNr$U2W6$lG0orU8nwu21S%6+} zVs28L6%>jTFt^i$}V*t1yo)*HU#5#Ia;TSevA!GO-d1d#>eZaQ9X+;5NLhm(4g z<_nd?Y0NJ(Z#VXngFOip0a`eJ;A10r(>)1^*=w=aCUpZ!PJs*?31>--K`_f0klkTP0SH z&?Qh%#+KnBG?u|bQ!0OvO?+f*Zb&lso`U)2v2IggiMDh6h4QkY+&Vl#kpO;0ATE;N z-wZ}8IRgUYB9#$i_B7t4EiU3mG(S3N&IlX=o3DxIZrjzF8#rAMlh@)*0bON6AYySf zWT~pc>zL~>aw@VAs>tgv5cm4>gzHLF^!0QAV9pu$H$A_g+W@YWXk2B8k`XVO=vg_% zz#Gg7M#HG#koB{!(FBM?f(5_Rz!ao9A(Hh4`rl-eHes`%-oSO2q_%easQe3s*o3^0 zKx$0;O5)tna5UFaQ(iEZS9ZJoy)45cKSXW2pUZZAGr^#v)<#hUy-Cko@I2Aw!y5 zqr*IJ?oKEgP!bcLl3}k6L7sv)+5DQ2;cl8E2T2`$(JWsVw_ka8%9tnOs%zpqs5S%` zf7vhboWpDQOZk#GAd+V#>}^2Sd+p_S>0AHWdReOuq^})~ai6{(XF^d8cEc`?!Z+A4 z8y>VKG@ZpOshC3JL(}^zqwH-*DcIl&AM$ex{ZRnIAV-&wwtfcfw+|HiyOCR2_4TSL zR$i@T>e&=}*svf(!pWV$y<^BeJOIrg6I;BT4w9u*nnr)(8t0z6Q~fx3Iyr;1P&!et z^`28(jk}n)7YK?u?@1K{+AJ>N^9(!+oli@QI4binMDbH>-+uOHA&`oeyvRj@CQY)6 ztJQ^H)+>^FIL%UHh*e?2K4G+etc0}Nv;GQUS*oO)(7%um(}7j$XYJG-8VjDd2EBjg zFn=3jNAIC$-Y17()qKpfpIh9^7D66WZPGZgos(>=2c_aHf;!BgIKVr}6oVZZLOw0q zs&l?-JIc=X2IB&dr9K@K)lv6amLxr%G^^RZ0V03EGbAQk>;T3R-F08@Zc0}_QaGIb z!`Ze}pfbT85>-Jh=TWFP4Fmrm?Y6k2qtql_aFh@Ss*&;+oQs)>bYa8gx`x4JAkgQA ztW1a!o)Zfh%Z>bN-X!A<`}6I)f`4msW2|g_9f*KelvJHF<1kdw6kEHrhJo z^D*VT7jB}(8ValoA53z0&CJ66UJca0D@2f76$8}1;|4bUP?7(^8RMTxwnf_t!S zhH9P-8k?vvi6MF~)IM34q3ElTuV?PBG?h|{$f1Ynp(3SD=5>?1?M zKAE&KPlN7Qs^wVGxbZZVt@Jz3Ux<)_$exij9!FY}ZP$^*%1Mdi-yleJm84P{)KYGuAIO_B0#mzWqC?2wq5=fJhA>==bTltAfK(1F7U zpqPk%O=TPaMaSMsJPHa`bTpa0GlQUI7k(4-)K-ou=Q?lAV^&#i`cLYWZz@dPvlh*9 zL^u??g{yi+(lg5b&g#<_;2idpDscg*8knX(xy6qY5@o{zADOB?B#oz4II=GVz)152 z>n3G4+!?yzzNSUru$r>H>^Yd6y$wkzR1(+X2d{g#8jq=R=KKoP$GRx)Ye)fa*qPlO zgl)d4yP78qHbCdcMNb5Me>q}cIGq4R#zqYI{h*)~()VTiP$9-SJC1jB98D>sM?3l% z@lR~84?o(X3Cfmm^Bm9AhbI~oNb|!h5c2$j+BzJsz8oMExbEhcQ7(fZkbMncW@ulheH_^OaP1wafFu~EBov8JhE6qeZSJ#sYXsj z0Bon-LlWC02r8ooIG>n&o?>eiT1z&^S9qnkK&{4|QC00FwO-|3YVO($^*>zBMX04# z%KvsjQ3DohNtQHMfB;Zk)&aXiKnej$YmrZ%yA+#=3Bl*Zwynyc{PML7M0EIi%;ft8 zUXkeO9bY91v4MM&sfv8k+wndo}n_2a=-!w4_o(1lVxd1LdPp&>MDJjZF*pK7(;p(Btx#d22aiz zD6J;aQa5&JzK^U+d9%R%xU$K}7PAiggK*h#xyk>41h})xvaRsR_Fa# zTNrMnx~>uGPCyBBIKtVz=<5ypvCYghx0Z8jZvoNfuujbkcJ)Y**#_9)D)!#^P1ogk zf_uw%h3v5oeYl=$Fg~|1>F@qKWG5R8b-iOL0!1?rw!CNH&=5Mvw=z}^<9B-6w@R2? zmh%|n1dAqkNDFdlgiV%w~Ir3EvXh__BQfnMj zx)ok*TjlfI4CCBCxS!-4>%3(8x^$kG?OvL?!RVN zgE#TJimTTs-D- zumvRk)az;%Puud4*{)JJ&eZXy#GQ4!y~JbTrIiVsow#3ID3SvYr8 zl1hk4;#t2Q;4?}FnStv-$(mGby^Z*RQ&AoXDdCWH9VM|n1<|PYB}sET!y+&GN@lYj zSHt?P?X+@(2>jkCx^oI4+-z<2Z3_qN`f#uOLu<2dtrS2$}&1CzsDjduRjDQfsX2>W3 z#gC2{zfC)Ovr--H$T#7b+BByI;k0atr6_Q8AykHlz`ztum@9QnN`93g5OCVhGtkLP z$GT8&+CtK)4=hP;tr!EeLXowdQe-a_J{W}R%F(@5Zsj~JnWv&*ZSG`e*aGdgu%Ea1 zp*R>NecRx(kuu|?52&Arz*<*7BnDg6#gS|G-19|71`gGWAs%j5nX8t8)q$;HnYYLh zmFyS@U2#F8>_=QNoqS9XidHsb$oCpKGWFg0W6>w@r+Ro4xO1@=cBv2Sz`+25xFtMV zinpR}OQq7mCfA8@j5oQw=7YPvuwoqstR=_q(Q69;RnpGUndwAR4T;3tYb9k`NdjMFESBy}e+* zrFduZez{3qM25YnbeO#|rMAY;Hj&AcmwIdfo^VDz_f|Kx%fR_|r>7@y3cj49+p%|c z5Onkr{`=+pVa3TO%ChJ{nSj6fXR>^qJ$W{C?Nsay5at@rSiF+M%&nvG7US0gCy&-2 z*5oZne=<5-|Hf(AhpGDH8{;%v(vmkrroqT757eia&sMhh)eRxh zwr<3!vryTNpqRv79@YztDCh4W(;;#&d9zUpc_JG@4WFdgVcRJ>EGLo|zqa3VUapP{ zTBqlzG@-1>Ap*!DaQo0I^PA*f=uSv?gG|nQpt*fEz>SC;qAkAyU%{FPT>iEmsuIo) z9a?gMXGpf=eKk!v=;eH)@rUbFOPnyH7W4Vdn*p}_$j;J8D%;Ti9*9d>5}4uxd3701 zMs;ft3kjrD!S2!Wfk?9(74WT@APPA6$p9cCwXLl7Z&qhm|23n3uUNSg$q+r{GN1*D zW)OP)x@V@FcUX+u=n>{8#u%+cvHRu&A?){D95?T6nmZL8X1LP)iH)ptnwMtKga9De zEd&)wCgEAL7!h5tTQ9wao&_D|BN5q`0C~Wo$j-FTOWh$hKFQ^156zj$b}cf|+&oQn zX`q8?9>OVbI9$H9axXywN*F`=C0h3Mc~LXA=q-p%a$;um6fx9x!M_pOnnPgG21k3+ zOzD&E6KneH>9Ue_`nJ!E>%0V-t*-S}VKqm*w4XN>1H@5c;15ZS#96Y(yG^(T@%7HNcDmnMqie zJ84-fT6(1cWU=W=)&UQkmB{GdX8(q4xvqda_v+dyYP#x=>ZJhdRZe0EgL4A z;Js_e-^L-dSKm;oaZXe1Gt{G?(|jJfqQ_gs*VtkOYmrrh3%?Ov@wP$^5pJz zAb3GwC7m4EBjKLL%uHdzXF-hE+?tYN3)C7b?)4-qAH!>&UXBVVNdg@}JPP*6N;~Cx zlHB&&WvN|_G>6P*=H@8cjz4;LE0dISvNC2H58zS^9 zYbN^g6;V%5>z5s4?^{9B4|uVd3KIyobJwBH{Sf)P)#P25>zm@2epd<&VgyRZ0?wqB z3f8_R%4$vl3-DhH?_2$Oha(Um`RR6Xv(joyi(uoJOcIGTE4bAl3cThUX-zR2CE9Ut z(eL-GQI@}Y)h?G8-)y2WE8=XPLPS3)!bT=EgtuOGrHw-v0*;m`E5xY-UP6yUD#m-- zQKV5{#7?dFL6t0dylAJfQtF~~m_-hrczD$hLWZgmdGn`|8t%w01u6^`K{vu7sK-*F ztz|adv-{ECf~{&>3c)9PPdfcae(G_2Up43WJ$EM+qB_w4se#2|X*{NqqFT*Q3zigd z@@gT~qj~puGnQbnF3R*);V@ZYb2?MF0a5x`BaoGUh5)^?k$!a)WSPW+AMCm!#t4T5 zMbKQ6H#4{!P7l!Y1!5L`6~{SMQ0Ks+cxX*7Ct$=50+6|-5bGI7^oW?2cNkCas#KOW zhgBA^zYZ@%8CMFX%)3OGmX1)VRo(c8Wm}zTE3m~Cr}sm~@_cbi-sjLY{`#M(K};wF z_1RExiiyvy+h5{f7WFhQS2cdMm0Q4COhygk!A{zUJ6cr;Uo_wK9wRFFdTlOR~Q~NCC~?b9$y2CaE(*|y&lCE6x5z0U)=ZiLM)J)yChqO^wolB(2qHam=d8b@@{`w4OzqTPU*g z5MAu0!4WHF`tcKohDn0UDGEOz94osM(nopKUt2Yh>*h|5*X z9Wk45gt&eW^f;rjvI`(<=(lTgzcmasHPY%m>h((=7c6~{d-*Jg8wl6K)XX+!JK8E<^8mOtz3?WmmL%`L4jH}H& z5tIBcjG+194_Zqcnkg&?d}RT)@6!ii*YmHh1=}Ry2?#@DAWb9liv|RTrsTbE;1znr zxAbj`KmOWZ-dG4RynYF`Z%0Q>eP7X>jht!i*N*50u_aXl@S|tZ`+RPn!{{`NHqoOy zjRE&p%Ywv@Ue*tu*kxm`-b$|_k|rn=UM*ZVP3=|8mhSa+da6>C>UVrA9?Iq;c>d^) z#5kIX$^506jZn&3T^R0dZ}%_^kcE-64UrDw#bk?Ce>}BptCgI~|;0dM=)17N& zeBv@&Ocz^NAvee1ng_(>s;WEZ+i!hD_Z^l3FxCWShOuN(2!4A!9Ewz& zWhl*3l(!8{KMJC<501zpgEfE)w?m&>u*m%8!JS$15UZDEunXG9ZMTo`b>l)z6ffe! zT)?E6G*=)D6DTelnCk;epOPP``=;hB`HKuir(1bP9A{uvpdIy6|g=io4^4Y5! zzcU^KB&KGa`n0(ozPe+b)nXZbn9n#&b?3w-er=R6MYxOJGJp&|P=388kd3y?>&p)) zURE-yMLhGw>bYg@Qa1ut%(N{~?yT}n4kOUkspX%7GDkB&dl1(*=%X5mcB zRL!>*Bf}6iS=;425RgT4UDW)v0>0hGW^%Pqg`aS5kOpxGYe$5+Dz0iUFmEpqLO+%A z3y2rDI90#0pcFCSGQ)%>E!U>3PM+@B-mCLs8}ZE`_jHXC-#h zc>uCTSX+M~*aTw#dUB(zY$}GlI4deIA97*4n;-sV_F4~W|DSGzgn3qdbS-tZH}8FFnqKhDJxY*MLJTp*UV!#RyZ41nllz|G*)!H*R+-%^ zFcU2euV<&7AQJFs8z%fLLP%#FRDc8dq5ZB98Fc9r;RRh4%lW!UWb(9kuGp+R_imZ!v;X|PfDlDH7Zz8I%_cQ~?9be!}&Y#2iM9JO+{CtA z9LyTVKY~iuQa@DJf)p?JF@`PzH_H=|NB6yZYovsFGfM%)IFU`i~!%}qiUidn`l+dhnuI;2i2IIc~%5044H!YD{&?iO|Hm5`n`iATXD})(Fjjn1*4>&!4faZ=Z z-580MY6uVa$9%lK`UxNLXM4!0WgrKGAYE`XL||ng!1NP~YiYE5lE8oe+x^#a(d! z5suiPxJP<}y(DA825c}Uz2Ylj&_`i1WKBs{8&gW6?L~Sy1g%c$y;3Ydd(bkWqe^>b za8J+-9)INzKmxoo8e`B$9YRP4Ga)4xQ1L()KuXzuSJ4+WGSmyl)L_h4fONP+#D+FW zyP~=Ka9WlC57r+|EK7BYH9X<_1WH?GJ+(=Bg@@-$Q9b;t#YgjIAYfAb6OV!b_`e2IM4y$Nu+`>7#uRxP~u@e zuAd0Li@GscWNaDEtUm-SDclC+kX6%BNx=5lt)FYM;x(tX8zKf@&bOhb;2JscaaHG4 zR5#DrQ$bCukQx0nd}&HO^{N$whjPBF!p^w=AK~t;gFBK0={^t*YGqPut?5x~t$y<9 zFHUz)&*1I?>qUK;k(CZnpb>yqZIhJSL|D8&TtWA6GK6tPYQhE@2H2g@(Og^WadE@^ z8ApZS<6j*B<;p)Q%DopmD5dR_^K(c8+t=x)P_sA;k^MQesmKnd0fDyolxfKZVl1S>?$2hp2HO0q^f`Xp+A2I=D@0E=#W zwy}h>DiBLW5aZJ!9(}pxWmJm^9tB0U%^yP^HMJ&u)0FtJOHshQs z-Qv{xpMMp8!5TMewckn`71ji6`IC{mwUfM_;T68HH2^G{^HW8wM+Eb>yu$VYKxY&8u zWaGtAec&h^YH8&-pAA1*7ettpiVt)|$Q9y)lo*clJssdx!CJtI=pZS8jk zO!0KhCsaQ(2*L4Hi;()r-z7qC#jO=Gj6H__k#hxaFIc1wPpLw^_WeOZLMm{XjI(g^ zPOwVy+Yd>Zcpt&`&E%LZxvHFSy1Z~m%)1t{u_U=KLSBMjGMQH;wCR*YB2ZoxUV*`- z8(%ooqTfA>e!L|2jL-TUdI8`1tb>=(hGQ}*kr;(t0wZbL-zgrouX!O_iLuh0r79m{ zg|9?dgiT4Cw|SR#;#Dq(W0EBrDP7*?Z7ROvMYaa19KIPRQ2f8W;-yaYPwwzD>3#;x zq1-2YfnMl_Z#w5!=z?DC%Hfz#L2A?=_AB&%>(B9*hxx`X?5Tgxe`Z9Oi(M(HOoSA1 zs6^AyP@)zbtro3zjYhcT$d3)yEVERpKHE+V9`0@l+o8vLyS(5SMc12RGsRm9Tx#G4U5X@r(q zTdAj;q9G9{n+NhMEnv-A+9Z5pYk6DB)_-Wflv?T@OO|p`It&7dG&}j z8wHR=CrV#D_aLeHLya)H^XmmNXl}pC9|#2xq&)cfSDWeaGLa#V8@8i;gjT#7x(9`x zQXeU7b<65*hAuKma~+%W9K=$;IYgaq+|^PP|FA^%f$E+dWw$zKW6pT3tWIrIf?DRw z>Wt3`1F_ZX6WA!#yr`^_3&moxZFR%8IvTh`;)wL|FXEgc?3^s*oF+U$H%Wzq3B%LC zL(Fwwp3y|>*VcMn4k((-XJC;jIlJYZ^=2O-vQ4NGWKjX5_%Wl-k5&=U?n*bBG$3Bm zn1PwNH~xT8QfD%58Q7!MOU_sHEC=xPjl(=&-*SRJ);Ea4U!-zYQ%b%}k@5vu~x)fK#Jvm!0iWn=X7)@SP;+*gFrb|%? zN}W_fY58Z0;l>AFV{R>1iJE=YZWoh75?T&CNqKzeZREkt5h#V<@JyiU&c1{01!PWH zzCsCPHl1%+rHmj%)v6$W21qON=d{!#gI-GweEiuoHR+$-A80yXb(+JJ^;Rc^%b(S+ z;_}hpVg6K}>Vw)GfX}50zDj4h`lvtOCQH2(nFA+@i-+}~d0EQjC{V~wvV8*gpH?ph zu1MhP)W!&7kttK%52*m@3Nmd!lN61A`8RxnE`|BDK&nsH-iHjoZ~h74p(ozLO{1-d*A8JMw=-H< z;L-Lg$tNwdJ=OeaTka6$fLoo+z?HR1xMdE=41t4_3YiK0)J$0MDS61gIGj0kM2N`I zXs4;G%FY4(66uh)Nm&4KP)g`Uo(A95er+4UzB%C0J5`DOw4#5ae@zPt7cTy$At4O5 zQwe94p2fKZQ2~ywx|N3NRlEm-)s0m%1ds?HbXQT)48P|J*}aSb$lRsSK|9^|w&t!%L zxYq)M4KW);M@x^Q#Z*b=F$DcUEnL7-KKpp@@wfkeWnC};KahG|f>=|>K?1&yiqtU# z#TK?BH7r82p{;{=4P?97Yc_n?x{jkyaGe*>%M=Ti*~50|(6mM)=DRsYA9aOT8DZl3 zTfid(D0LQ@Lx(`E3IRRYx>e2R*I{fmM5iwKZe~9ik(HccMk2Mey-1TDxczlz^6~s3 zj8{B$rhN$h+O;*F=1L!hm>3bZ7Qu(MYcx{@gv)qXmYat+Lb)r!6g+)8Zw(pY8&TY#)ME6rg_v<}ROeM6G=CJS)#={Q-fUO%*4M?oRhw0L)P}7LKq!Al z{r9J5@S*t~IoH)F92-D2ZcatQV%`LUZZV~_{3K-ZK zjgD_y44^zR8{-9o)Fwa>DDRrSbP!}}5H1Z696%5h!061(6oB<+J%&q|xasvUFVXTF zjy%jt*5TqO2`SY=H3SnHpW$&(FXnuf|C^mKO*H4}`zB2!?RfS0Xwr@E3vqBwZ;C`O z5Rx95W)unRVH*x}Gj&nrRa~Z~xQeOEIMetKE6;an{mnMUV@@eJ=^^6Qn->KUK-jgWdCW9s42g==04th7c5vjy3xNDj-aBYOwW3a)BtA zs*yT@LzYUnNrPlAot9*Tr)=%Yw%T7z*t8{c5^wp3P4XE*!*66=-tz^BOoQNoT94;q zF%T6agTlWw#HOlIyOjD)(l9BDmZUC$Yw=%q`mPu>zugTL0|t<1WqX2!Q;!!A_dh#5 zzm#0j3FE&^S6S0FT45AEInb!_j}Vr0Qq|BGgrLxX z`hn4|JD<@tM4+X!?e87nkPJb2eNwC@W9Y$H1mAr4N|GQ!yD3Q+h!D~~q=3DSbN~o! z-B=WbU$u=Uat+-|dh zWgVgwN~GCxT&hOsSQfJ6Y+3@CyimqJHy_k1dz#?)NJ4jHL=7^q`OZb&wb}D}cPHSE zc&LlK{m8tid}6K7E^Mw17*D9Qt{mkhnu0990#mlLkLJSXkP!i)R*3@#?~+V;3q1OYw@S)O&RO!|;c}_zHta)MYBMti6vC_mhF+B_o45PrKtmU` zsNWTII`wTyYmVSp-A-Gm9Jilvjm2jpi?*SYs%!p!Q#>5~Z(%*uOPx^1wh2Ng@QZG- z%3x~OP30`TfWD~(S%KWT7;Kg_6+W{=DTMEr; z4QX$>K9%s_#5U-jWS{*+4Ol{9$?TL^?I6k;TeUcJseQ_Ly~xMRWrgSbCGSbkuW)hz z*d>A^^%?@PDX`NxO0je8>7l8XPe5a?X6%>49*tivEB5F1rLpp@SlBh~-;0qGXmyuI zg?zYeuiMmt1%ikL&5azLwcz-Z8;Jxn>-bp8W-z#$Mn)rk4_nr`%AM!$OS45#dI0D0 z2A%LoQdSpqt|*G1-bI0GJWenEwJ4$7C}rJ?HGF%>517uep=v1F;=<<9GGsta`whP| z?+2pFcyJrXiQR0%0~%cw1B>e88>QD5j8B#cf#TM6#Y3ELVsFTfsWT(;-5bbwT7s6yni9F?B60do0(K%Mg7+4+jQnO-Xm7N04N}u zDkgys)1z$?vt4h(JT_JBfNY*~zrfgde3&!ZW6B!wRd1i%FMpU}xW82%%|KeH3Xq=e zPLA3`onL)gzuZbMz^Hpvp&3cHQh=FYI`JK~WoE~*S5Zv~bq=&Q8RQ~Pdv+XgeiDRw zNy!@UOIwD9cvIm)VXm_4Sl!fi<6Ge@zkJh;@SDA)8RlPm(yLAjSu_kkvRuag;{-rx zMp<&X--{55YtmAi(-oX$h_Cm&uvtHrHPIik+pFSXhvwx) z97g@F01Ow~q?Y`U(^+79^DiRB)6Otc~w_I0>Z z#VluP4k1QeXpG!tlahr6BYI#=%ick^uH%rc*H(_dXTJ@uVNNVedYB0-3Zuj5d_7ro z;Akv5;KY7C3)_7-0I!EVoI2D0=0v217g#6#|K&uCIr%}gfNu2b@6ZffHOg-oHAj-T zJT_aW_z!-X^bsksrPJIMA>ccj|Kp`UI_U*Sell<-Pph3WXTXC zF+t^P)O9(k6WI$-LUPQE?d_K0ZOj>*mN z%K`EFq0lCPWNR_5kncq}w}R_@S7mKYnQO2jP;4l;UPw)8pfz>{uQbC*#r}|s>@F>; z-hCgj1M=Y@z0hD$@w=gMgq8NDACn!uw;sS(t#;hH2)xfeH4h2EH}*gI5E=L@AJVXf zQyKODkq?pB^H8Z3(=#XiA!M7t;C&~Hh1kILZ#JZx6RT#nYny#TbuCuMQ_k#UBUnoK zP;N&?V=rkJbI=_`R#bv+1n06|J{WCbavCK9dJ)}oXUP*bgxsQxi`Dcfig5v<0{Z|i zH_z0&H0~w3n=@a(Kc$0C>wK^C{JtgokPmrX0cy>S1{z_U?J=1-NZA4ZeG_TIFHx5=k@*=d=QmM8|Y3C))wOm5jTBfAAAS6O1P{&c zUJULAHb-PJP5~v+)e~9=1uYTEje>@yxhq{1uYlc_X2leQ9OC z!0tf$brL3=h_rf+4ylQ5nAfk#-x+X3&Ls>K=Dse5=!qMpihFNvqAKhCQAy08(;l`UnhfDI0N}db z5dm3NJ$8Ne8xu+G50Ez2zYm~~omi}uB?7%Vuke!0 z7oiPD4FKc!6;)j*iJiohokzM1Edp0G{1@Go%|FOt=Ko|r9CZ6n_JgbG1aTm7tw;1e z(kLT~qkEs+$nImr8_TzqYd;-t&h&%OUXVF+Eh5!jJec2LXPmOZ$@%__k1*iR^xAVtR-f_VDf>?`zZ4MO+tHNg^Q_ z8GKu&EXjGZF&ZVcJLOhZH?k^pK~!EAmJjHe3wi_l%ibcSz?-8tNYb0t#88!2G0emHNZ+QMYX!b{>$hpD77 zCnu?hW@*Z+0ry4JnMbyB-$J#UM7QgfX=!R|`*|cE9dkWlDmntg7E)pfDpbq|u1HQ^2Q~P5T&n*uDn*q%> zQ~QFNyTF%l+?SW>{GKOF&3tTV83DYgCDf-luB;UBt8&|IrFM#D3#YDLxQu+h>hoM6 z^^9HMPNvRt4#na_S27cp^?aVG%3q#W3$`r#(@(GEC!WvJL z*_+~VY$P8#jQc2XVYi~Zl9)`_Ye?RuD!c)roT=a}s$zNz>2vZ-zVeBCb3q#ON8iq~ z-)cN-Ri08h7A1nX3>kh27y2WTa2=N%eTsz(moibFmUoNtnq%SY540!BEkA0-VjkKW zP}xn^#J?njPQTd8V$F8|a4!eB8|CgKd=EPjE5}nzz3^QbRG4mePCk#W|m zn45qbZ(Am#di{dS-{dg^)ls;>JcJV&1le-#c4>In@+h0IJSvW+lc}~m)h+Y?ohev* zm9uF;#B6Kn#4EX$!`QUyWRfN6pdxjdZ0QI(UHg#v`kUkrtv#qyu3;kDGtLv+SDBRPa_cHr;|p@XH`4L znO8KA!}g57;(RtuA94Jh6Cowj2%dS&L*FwqhKmD)>K4Un)qCLzO2tD zN4>U3LtDzsMI+V{e^OR^k^HHBR z$i%(q@Ly5yro|S=85Ee6-Z_|);bV7NfXtUlw9f=Q1f|Zf-T6H$y_>vzp1f?g&8-Wi zcS{Gk=xhAdRVX#TC5i^B!o8sZzBlIB_}W1Y&knZyAdvd zBG1bgL0XD60Z#biWbI}4%Txl*vxic|wUpPi#?{Wlt!AXhP4}B2>$dxSJtp1Uc>!^FCP`{tzU%WZUfdigQmZyKOGBp(Uyfq);m@ zP}04-*iz^U6YT32v7k?o`6yHIm*8f4A;sk9a_5UO*tL?N-HW_Mc#EmEwvw{8F=$k& z@vWip%vmy$Zt1K09_q4TMVtJ1&T=FRaR!N55oGf%TWw|58C5dC`xRevpMJkt3SntN z-%jg0{!0B{>6hHk+QHCDc;goQ=5T&C+YtHodv-~bg3e1jBpI!&Eh$Be0GJS{$N+F- z1eqLl@+~ri!)R8$Njm>vMw1Av)A#9&jv=c?7+^+1zpaa!U&fKmMgO1&W0yAdd*$la z2`#;_^bjiel0giTV-$06Q1@HHj-!|*0kgV%w<|j7drNjHz?`}2^4dQ!Nckx)je!Jx zaKA3G5tN_KP3pcSiCx?Wc7}tscn?QF8g-2-O%YQxUtq-2-nwg8)AUZ{ri2To+laLV zTI+U4RY(#SdupZRe`xFbY()R&hpNQ8MB9-`m@SY>F?`sXcTK_CuuSv9T>VYcK5Y(} zox>6IIjx7cR!kmDz-bn(=4KiU#{HU~B}+xKY?h2c$K?rzl&N6*bOKvUuJ!eAdAX|7 zI?U|7%-EGkJR+Mz$mJU4Nu}-hv8uxhGKu7aKC?hC zyYa-y$$dYoBy{4A1G#fVHmSNzxztaGR#?@>bF9#J9>z`2Bdxuv`)kPDlag`e_MniP z9ls7-ds7$-(q7NkT0B>}uwA(iMKTRW-~y&shCsQ z?QbP{P5NGKXm!Td+kx&{<2#K5GzFoMzg?$=KM;9H)0}4cin42rnkQDMnv5EOsmr{l z(v;1+>;n~b-Z@Yn@vcj4zV3c6mU0ewU+^Tii$YbLx!~$1Hy?@jM)x%oA@X*7n2yg; z1=V0Y^R2bTHeXA|j1F;@e2}|EotbT`?Q|miEHtie-v@(fFZwl&@mkC8?vG zKaN=i8!{l2cq!o1eF3nYR^?}WM_+USp&YU>TaC56{8(ic(QI(M3c&cl$6KLWhg^fs(4A?& z!o>wNl2!_@k-d5GYatXkgb4vQ$F;M<`+%{);OzsVDwh>h$L-GOqrv(zO)Mt5F3!Y2 z_wBbN#Dx zMG?vNL%H&OICy3E2w~>g^3?$@H|-i2(* z5+G5Z{tPZLcCV(Xdku{-rd1{4Vs#}rz|%{e1hJ}{a|qjItQrpfWOXiHe{XiQZ>%x% zAQ%}h(eZ#JcJG$R;LZ;k*hd)%s@D97i!L=5{rjOy26STsSij zSr_+YbrH?VJU@}5V7dvhy7Nn*Q_`hGbfx&LN6e`(uIgVyQy8%$S@ec;u*P& z15|n)GP7SW^D1p9)G~i{*8S20Ed#sAS)1D=J0MTTYO#B*1zK+FF)X&ZXyc#y4ub}4 zZI}0WK%fOvvC;2S2&Z=LrCnK?11=#_YRG{Wx>l`8rUVe{K-LEIWdm88v)?}m%~bpG z$65(&<{yU3kN@;wYqPe)$^chMb;hB8*C+)Hy!mep-R=D2|Edc%p+27RXZ%S!_g`Ml z1_Z58K&5{C)6@U*3eF6+GElTJ%>i5`)R2y;z($KVp~{!h{<|0Tx9{nx|1vuGGe1=B z|KYH3|E*0+s4*2wDF!Nc2{61o5|1^v_ zxdh6tXM)_s#9Y{c8?==}KH`hT7=DQfZ`vV|ShuqmXPweZGYWxaPd+m)yuc5Jh5zHJ zgt9Q}R*w49>G$?8&m|oa_P3|^^g|*SWqb0cz_h>E_=o*dZ~pc;^3aJp@bCH0j0kgK z4964m;n_Jha&wrdAVZ^;S!>)cTtw+$SpcOm9J$G?yoM>*h$ZUgS~>@xS#ho#I@ryK zTXbB}jc~epj3hSYEc(^d0N-U@56SGQ(SKH6PfF-MAyd4LT^M@iYPpG2{Up%?Ele=i z+cUd})vfrcZmqr}vWRk6r8E(OFre&*M!VLofXtU{$?4V%>U}}zxw~y`(GCPhIGjd z*ILh7Q&IC6`w)@7L&az-ZEUM5ij+w(^--j9BwFR*(-({u-A}-U(e3t(L2{5)16Ivk zKiY?Zf9TAndgK>>g~xm$9t!eYhFkgFv~a{(3*3~+ zYhcMi$4KmQbTuoG)e<@AZ^%!0puJ)C_&IvhcYPCe=?}QkxDWLJ`jSBt2@=eqovU2! zY~kR9_$-P~0_bnTpF?y8I3J*w9E5#V%NazttliZ8?iW8Ivlr}(b!%5|JuGNDMOFvK zbNC0wQNlnG^zc5dIzik;eyQsiamC*VX8RJ-x(DRT)Ax8&rA}tTHDG0!t;5qXD$d#+ zG7Z^J{FL=?GD0YPOV?r-^b13*NtG4CBo;0uQ0+Jz3@C#m71sZydrx>QO%I&OdfQ9&!sghDHF`6Um5!=6kz8IWv5a zLz;2#j2La6U#LKAY5TkZ2PPMr5Q|=WyJ#?xTh6nJF=+cw@Ls#C!!wBmI>Z8l(LjvR zYA{h5-8L__%Y*@(3y$Q#4sG$ju!rT95ALu=zDvN!?F~tmZudiB+z@<(isMlj(^(&M zwa}Sa-yx)l9JZ(>w};El8|%|tj~40+D_@eoMLjDoJ~@penQPJwaNg}r_1Ca?Y*Nc8 zHni^?>V>;5xes{28O+Qv|0(13RO~uecs-5OGuKLSF3)yH^b!uXC-bkx5JZdEeP)LH zGJ5h?3s(UCu5|9?)f%1~Jk%*Ep6dtNxQrVGc(Hy3$);}9@8MPu`2!@=A`;X>CfcXz zD{umEbHA#yhNwYj@G^fa_W_Y;;w@J4c&~x+0ltC@1h$149{{%SK=tg1KtTQoUnE*j zhQN-0nRvtdCMBEk9iJ{BP5E9rI$ADZ|2+C*b4N?^5JxrnU?w?=aH<5v$QQR%3Dy2{ zz*Nl@GW?KcCO^oJ&b2RMsc@$Lz~$Okn5>?M4wJ;01Z4$-pLWdvQ3D|@-fRlX|yUDBHh zUr}Iu;;HhdkVSiE!TMLkE|eBcPm(Wz@&%qp4^wsX9qY%pe!Xq8nx>w7EuV4i3A`gS z1(AYZ(F_{7U_|{+7j?Bf0YsK`RQ(l`TYU2NrJxo0WqJnYBW7{Y9k37UurVVuB4d_5 z%lxDD8swRV*&Dt=yMiHaQ#|L0W`W=Q?6w%Ya(Rt3NRh;{N!)iQUznqtNFb*btq>h#FuzM()L1(!cw&`@dP)G-SCxVf4b^{FB1vT`~0$S^OIi1{IjZWi!e-ocvI zQ!x(eXjBpz1POiqsMY}_8^j!o0?PGpK^RQXg*U&;yXZag>DaLOviRt~#T^G+kLFOW zYrbh}dYXtFBkz5jlg?|mH@xPJ_Tw!^CHIs$U(_WQchiWSA%1ALr4Mtw*vJVW@S;jZ zGT{$DOu1;&%7*i46FhW zN%TCz<;`Z{3J;ST`ONTYSi!cn=!-h7_4io92=%y4S4BzO+r&-NWmbk&fJMU%3d&Mj z%pejV=*-WB^cwMEGoJ7~S`hQu)6bwpBb7@{-;E;L`yX@DC+#k{3B?nRd#I_reQm_!prP+Oae&y%HRM^@$lhWR5CruJ3IEa0f1W! z=g7td498nOs;f`BaTUzsh$iFJy17j|wnLzvAv`~ClZ(kN8#n>+w_V;PRO=#7GiCAl zWcif%wgPxYt_O7sB#DHU1q7$(sa($PESGu&%4XaSY^db`ps4G=p#UyX(pi5=L{;KV zy_>A_R~v6NP<=iGeW~Q`r|X4SE`M|NMWQg0;4gS!#K>stPIQ4v%m}tu5}R0($gk8f}n|-%Q&Ip zYDNHtKzYBvKou2M3t>5e9I=DdDAp-193yhKt~ZJjh=R!)&JS`%#$b!kQI2CchNpX9 z@AWxdS9R6+i%nnh2YYWy0mvqh2-Y}_kozzUqqABUA|AN4Q zgrCT|yyFXh?z#o{A8pux@iI%hsGY`jQpEUT!0{Z*sfJ=G!Y^bUUI>LQX*|ITmUf`n zU(F~=3q}?TSU_GCB93->z#v*&#)ADY8gjrNNc@=IapXnJF}O#6w_tIU%>a;2f#d}? zBL!#Iqhx5*Me{C937_5;NU^qtYkh(oGs zmObRY%9IEN_BCEL_?-bt2bH(KWXimlwlkI|s{YW#gu|eSm6@=hV`aP`v>fYnr3Z@> znig7LF8BjtE{61)gq@}LFT30D>+Vh zY|&dNSn_fWj!(6YI$V8k7HNRawJC^x>@46~m@UJ+A1 z1LPb6H;zH(_6HmTHq>dlJs{GFPp5U|Ksm1we(0L319Ct*wki&DQYugzR$$pPwH>*o zB%A2-1ly&M!tb$adkP^~1IAId7V{>M<}00qpw2!8(SJp#WsQ}ZZ-5F=96MqLw3As@Sa>oVqG3xK{G3&$p)5)H3nAcb zmC4{VL}C)}MCgE!;!bIE+HYgZ;e&i>_ewGy(cV@8w^)ZMFhB>@ErLZMtm9yFLi}Z| zb>U&XE+J~CPK6_<(QVZf9#d((uxLeT4Yf1#NDQvt^PT|m;EB*Vt_1?A$rXonLV(}N z<=N@)cf*q6Kr14K&DJW|jM;?FN?lSbibIOdStiUvqc++sn{gov=+yb$93B}}CRfx7 zqLHBodtXi?7v19X)@76`DAy!E&G3jAH%qfx?3ZSy?-MoCH=@2|uW9sDIU!4F&xCcb z@*GqPVspe`nd7v@R)Afd6nn;<$o z4D@@`EQU=&~;J4&Sf0gPB@j29Gj~7>8hv&JiAo zfhhEWs^_M-yFiAXs;ss(2!{w(12@};BA`q)5hwzFL{d4PDFuaX z3U+{&hl59H$QqP4!3vMW6beD66S#RLN1M1nWNLGu*p=Q|-f6QtXe%wa-%YHftd$T*W-=A0gdxXq^rB8U7F zig5igMi=X7CvY35YGr80hD(H5ciYg*P%>YTi`|}&D-_L>T1eaF&>ZPfS&A$@RUpwN z=BzQ@w~={3cec5S_-Mp?9e4osHPQp949H*mgV2BoP7b{{bl_?M? z901pAj4lx&K1d7U)H^1=U$Vfk+3a@=Q#t{tsvN@$3z1w_lGcogSuB`*kcTGR#c_3nN5#tDpz#)B(D-FG64jL4)W4xBF|_E zL-9*j1-9mDnPhYn9m2LHW;Rvr=Id@w4O4{MPlXme<{eLYJj`yl>wVB5)DnUBS~B-I z7jjns561m=HU~EG+T&Fgj$KTywhoRQ_g=7(WgP8PFM@Lo0KqDZB36KHu*zBaNNo0q zJa>Fc1=MJSXX@G&Tfhyb;F7Co&kfg9%aaxyU=Zib)-FA4g@xNwO~4sg6To`qcHGnu zTLp&`%La~a=-@|gH_n9~!HWgumH4ruS2J;e(!D*?Wn@|>YF>oWLUwY}i*sCCoy2fV z{hF}SNCg9bBZWbgB^EH}j|XIdFtjC43or!8ojkHl0qDj&9>VS*ugoc!SV&kS2w@;7 z-c?&$#^=mFO2rkl4-}FM{3*QmsJ-onl_AcSY_uKcMg`8WD9(s@s*=aH12!qw)hs-3 zssZdO$c~l7GF4~4J<=MBSlhbAde-GtdPI-T_5fD{%5BP1HTRW@L{|}S9yM0yG!Sl( zQQzvE&Mljf9^(OEcE*ASW@DZN2XV7!2n&K5%viM|Lcn`MRACb+6e@zG&>(hkjA}I2 zola>q?-roxDJzhWW&ti*wIfqLmKp?Q-m#5$-F`I#QF(+YwPb@VA3GJrGek8# zwM6x4u~w&RLX5VDEXik}Cvx#oiwM2-(xY_{7jqZ_)ut*5ZYMa|obXW$iPI{u$7D;H z>P+BQtF2fHb!2PvsneYLf$z`;C2M`!(}i2R>taAmh(2)JtTFP47A+Y&A}uX6c(EeG z=CqCcgHjXzbWjq-T1Lcxp~RfS!DwVcB{|lBA84vi;>q5}>W)(EYCU%7x?hx?G8}hJ zxv{0FVWuYrmhh-2+l^PDkUmc(wNCJDvp{7y0y`MvKuFQnG`*S*`?=GKX=1H5>+rPe zl?5Ljl^%tbrn9d#RIu@5=<4_q*N?UqXj$y4InK=u%qNt}*Z|eO^~!Q!0W0;k%0W-K z1;C*0hMhy0wOxC`YGYB>-m5Zvi4#l5qxVs`S|klkH2ZWnQ$k!~p&hqB$o(poP+Hv3 za}^UiJzRwIBi%_STwsJHN!_1WnvNPJqcc65(elPu%f*Q_XK``lHfb>fg%e^{qd*)e zAM3N()Ci!%ZpEjIzLf`=F4x6sC^z#;)f=vA!x8{X)=+0iZ?5g%jamHE+?arFUW0@}00sMq|cL&G}NH3dwMkP)NEoI8t=ple})95M!|^JbGB_ z210`Hr~-It_8VPY^l-itq8xIWov?ygVAu0OA}s+^BqUnu8x6$);psv&D%+uPyFhd?PV%VE8G;fINY*j2JPXt+U;Bu6)kYzMm z!O&6h6QeYCvakafd@iXrlP*PE3wbeRx6U%!bfS#SEX7)D2Y#(D+yj9QivzfH5pooX zxq%zN-sx=0_8feTp2u-zmpl3)PNEiGR!6b%Y&L;4B@QBURqJ*RW7Z(HD+BI*Swjs) zIWDndZ0u<0u-NaFYjbWR(B>qz!K{T(>H=ljWq@kx2FD!U@lGtStcc4w zB-!@17}zr)xWlDZrEpYq7Fw~fn`ohJq9Cvi+{kifn{IZL0}@ix3Q$qN6tpPNMomSu zwNLw{O-W`V=(Gw=m;F}LqZ;LBMCq?|&glykVfGj`s-N07!F9i}wAgg8pKN>zduTxe!R zv#Y4x-rTe}m&se6c1&32mr)5YYD7-KwSXj!1Q*QypoGWNT(}-Yd9{mDJA4~s(qM-f zJi`#l&9I$Y6nH4&QazT9Ly`M<3%AV1khLyW>%N?V4qmk~ys`wR^x55XtYR2dD|eTO zL*?mPg=~Rxv~0Cbd1(PHI*~C=%2^uPC<$9&4FG@$=zgv;Sravkok;a^gjm#`W)Vw) zi@s%VXlH_u}D20YL9TS8*0_?OALyz2R$AdhK zJAR2z*{zlD5-4OOB^Bmb)}krYDu*oGDbnO4-}ylHfp1?dq-7$I3` z(K1@o@(`ZHg`jb*(=(*SbX6mHaWNS4!?s7%8nP6|Eu)OW4{jo_mP1tg0Rf*z-xRBw z*Idkjv;4$r8))8l-na7&jS&mTc$XF6Q+@J$n>+1cUcgC^AWWVxQq zfthUr$cdxlsm*k`=Od#r@IE=DowW!C6*++{zFQMjIB#7DEEK~hS}*Pp#NQ09K^ihx zD6_5w>jAWzxf_Zo5t~eOR5>UVNuGB`bUTXc%Lh#oni}$fbnCtaGlM#Az(Qiz8Mq$? zo8tU%Q4%pP=Ub!>Jdxh8_yCGNS&dG&C@I^eGuFo zcfQITvz{+$#~E;mPv?HiQr%@eDy z_5#ii#y~ofwhHwho>h|M^%u@6Wi`fm)N08@5jUr?xN)|!DXNQfAvW`*9|0x+xg~bs zVRN;D=W9sHS9r6OoEfX@;#yt{q_oVTH6+ny<XoWdLc1eY z9}8;+~`2Mlt*q{Q*3%l%3ZD58Pw5upmK!b%UTRD zg{ogrFDrx;1ULt~8yE zC1rN<>&iIJN4F`>Y#Gr`)8@DvFj=`>>AOL!GPo$Z$~qQF=`Uz>WzUh#2?FvG(x*0= zB}2)0F+$>z>dOY&*ZaP1Z zBIi-dc@$Vn-5HB9+{r}M#G_-dPT`0mAo)9nqsf(!Vzs{YF`PM|MaLn2)UD zs8b%UJaev&bA5#3EHe^E9iR|8ta-=_QO=es>1=pD>Cs{$T9^fZzjN84nlL`1o8F>gan6L z)PN+#3s4tz7O^OCm3ee-Gr)QpFo#wk(yEJ3kU!`eKb0~o_fASOmFSqM!6P9pgPPFE zIc+QN#q;h*lLjX9IXi z;jFjw}BjEncI4@d+CwEm zq+UABMIzj`tR>85po0c6FRX?0|2uTmEEY@jIJ5@lv%2hANXO4~RM*ltjv4tWpR`y| zh-#xdjl-9rywFv&DwnC4Ci!V7<`6BMW~OGShPu&snUR^z%%lL46~$_?EXDG$kMg?W zXETroLv@>2(E(l7(?!QR{Q(s_(V?B;fZ8<)vu>PM#=xIY_L`O$Q67n%7_g2>Yo1Bc zkcD=acU8&MoAU7ZKU*hxBs5~Tc88h952w(@na$}Gc{GITkgY=+N@*^u2#Js%#&u=R zP+3&`*g>p3M)n~tV+;47paN)tr0j(#HU-k&5&hh%1g@|Eu@O$)@><4siox- zmoj|{b<>lfxYHfsbB9ikkR6#>ILn0xdFOk|oPIiqa)xTE-Ea|Hvi0C?CD_*T-R{$H1jfUyEp3g-Jnl0Jb#3^oRdmDEH zlA4f=kd@-^j$+Z%SSjvpkxCg4o9^y*-kP zK~^M!K_EltRb8NG0Tvx+bXzQ7bF7l8aOGA;!U*et?YaintinhTjY#A!G9o(m#bdKx zaX}T$5xyA@xH^?7qEjl^cQSHAFiVy2XD&c)Te{w~0Fw^5>h)*?Vv!4H~))=4lnJFoW-sTOgRqu4oY{$n3QV0gNMZMwgc-3+w|h9&Eq>2=s)my=bHtXgdW=F_hBxqhZZ9?_k;aEp5G_^Q zSk__jCDz)*vaI(}-pTlEubr$$WE~!Dqde-8wZl4V)Km?Z+6o-+-|HwH?XZD^zCLK@bEBTdfJ%yVGVGRk3sToC9RsYiJGAs*T?nD(qPrH zfwW1RnVc>2JqqmSE_4Jpfwk5k977XTfK#9yxIFDhhUy7$nRcgPjUs^``7_t^;r=9G zAdYo0Y{a8y?Uy2E>1qoVqZI-i8lBiprr_qLQL{ry(Eu~w^5c3VBMi&Sei(L2VOv>^ zYqqg=4c&y9DK^dfzAJ(4)CLNr1w=rGBrHgo0A`4Knn5!L)JOt!JaB8OLMEFB);Wwm z9tH=`Tx3|+RC6ZSj>PD>*ep02+hpBt#EpH*Bzss-k(!kPq?Jyji?1lS7}EkpdG=U} zRf>1V+Uvu3O%;>^DILhSCrrsVNur|VYwVQ`aWtD^S(Pc=Xhv=R}_jbHpl7c=x zn1T}$n`Y0OAkR}6r>@+EmRPi<5V&bZQ4}Y0PJ~TPauQ*2V0LjLrrYJ9YJ_Vp)t#zp zbj-vIGh=7MY&O$(i%8Yfn2s4nfUjxl;*xI_9}lyIYU&g_WB5aVJeQfz79>NfvB0vd zuyB@5xY$MNrCo+)*_F3=XhRd}g=!kL3NBRDG#86#r{o$llNaTyK4^5HFRW|*5AADi z%yLN)Mae?R)%{dLMvd2Mf4A3oB9o8vT{3eS&)UcP#GKhW>=(1dAYq%W+9?!u^RjGJ ziCwJ;YrY!O+SR-bwNd>YVv_w;^(fRR`rs>rdo|YS3)8kFdFL{x-W@f&jV|1e* zjp?8svLtydcK}VX1TWYXQY076P!IKxoYAR~|S6FDy8vRzou#~G6gBsu- zIp+4tJXzAh!9{uouU3ZFqy$>Il-b)QB=AAF3`E`R*_P(^LUlmbxG|R%GS6|)wAYz+ z)QhPM9+*(jc9=KU!FH9|M!p7jZoip|%4$Qmq^D60EoGR^rF>0iElO;Sb%F7FSHY%* zxbBB3bZWrW0E+>{CR5F46`=!D5*_Td4fsCEhDW+%Ll%%IMC0@&e+>9;pY=Vo*Ys}3 z3@2eqX^k0)dH+2{eFSNyHIX83>j&v(^C&8oj{(o7@Zf>9Xf4Wpk7H+ z2(B7$Wptg=drH4?+moxdvadUoUTp+nVL3U{g?UmV#3|eQ$a>KmQwS&GB?N_jD3FYj zgNSAm`Em#qTcP80RN$p2**N3W`U!R`o~anyBaMSYAxJi3_sUcs6vakrLjpu1mMmAC zw}91-z|mMIl+G@;rRZto8kg-A>{%vDNTpKCzN_`?TyCXgf7)RLUf^kBu!h+0m}Xh9YV31{)O zZz@*lsD05ML}IHSS5B?~Sw6+et<$dkEe2S2c%*t~H4>m_K|UlO3Ib9WyK z*!Z!t(j=qEH8Dp{_0$M~Oqg3^4HIh*z?1+9PQ`eTHVUZI9^QDS4Fq~hY@M-5BpTT) zgDs#_YfSQO3Zl|gQAfU<_JN~zIl*uDgcKYJZ`yAetqI#@3Ik&=E7H#I+m$ayu*MBE z-y1-B@K`vAZIz`9KVPccrYKc8}B*c;?@&FwJ&Nl8+fXQ!aA z@f4?k`sg0|vEA5n84?at5fY&lgz#Xf)H%9VmI4us5HckrCe@w9s?8n@reYz8Osd9O za;jpd=AGGW?+_;x&ksZc&-W*9K85|BYt6b(0UH1cA83RyMTroYk0dZ9$|)W8;)t7m z#L0}z8$iXUEQgkR(BA-S8wgL#CY+}L&>^)#F6CoQAuYqDB@ltzaK$k&2^1Aht;5Vt zy_!fzZ|)-KG~CM8l;Z8aNs4J;w(YVDm7)jG5OJv!KyF;W$54F@PzpCEieQfda~ll% z&D@$R*kSIjQjS4WaAfg5i~JI6cTQc^LvuV>1Vsiw$Q2DnDnNhAQ7O!Kv|?#%k%c8g ztLqLfMdRcEJ^|Nsh{OPkuTTtd8Gw{*avU@VIr>;?qdRm8lDJ@6a?_5E9r*}Q>n9gb zruae8(7+9S>Ck|T3aiH+9rt!qM-a+T7PpFlHL*HUp;dzcB_NPlPixjOs{MR@I^b&w zi(QpPawI$C$=*-}q~O5KbX(?JY$yDDdT0)G+fXBlnIUEaYOR!giO506gM$PU@4O zY5aT&1L3BqE3}s&S=s ze!IyNr>||shw3oPlo`IV{d^~dsp;-$2kpZX?tliTNjoDyb)JC&V<=~s7NP!5Gl@r)1l@WF<<7)2wL_w+-?cq>e~G_S>!y@926OJ)&}WjewZQ==^%rk z_rj5Zg*8T3FmH^J6DJDkNxi+0^(C%uA{?EIl?IeDfNOnh71@d1?CYl7k+h!B!c;GT zSmxy#M|PwU_R2isrs49SK177#x*C zXTzm73U`NePeL)emXEXjdhOubWk=vpUw* z0HJh2*#a~8n4eS~;*P-%Dg$N)HNcK3&@Nsn8Gf8PnH~G-X)U#>TZYqJ)9z^@r`USA zZQJAkEvJ;U(Ji|icA6A6Dn|AxD%v0ypXNKdJ>}q*YnRr)XqhXl@CieU#+!5awJa$ zILWRS{k{NC`F_}L;7W9mkoPfSYZYJ`+NPiIq;i^XqeXqpPKV6(F$g>nTU^3=tWH76 z+`ul}XetCKyQ5JLgq_LD91e_3nd?Dmerkxg0cSp<v1se>$VnqbldbrLj_GMwa2TGrq4 zq$ul2TTZ;JYucc`bE;(Gl|@@SUOVZ7x=G67zM?h`-n^RR&N%U6r-*`y8?-|Z6q9S6 zWqobpA!qZ`#O>P2|1Qe*f8SU5P@r;JFMiDT?fUjUPgnU)8%)|bX(nNk1(UMK#>o%| z#l)Eu!EoQmxwT8P5B*9W$LwEfa;ju=ef9letX`XayZ`sw@orBx-;xsOAt$S12e}m5 zCx!ogBHd5vCF#CW{W6c=FG-Wh-L)6rC(wPu6XG%9VdlP1ddLl02l`=I{5O=v zenVOGHf6`Msg%=0)UE9@d z7BqKGQb$g8R|iem)n3p5ZID-)(*_N2|H{kn&UBq2-$p0TzS0H=f*_8fm%ktgzWj@W z5QY+efKZ&kFbsn+><=J};2`>k3HZ++{vZC(HLX+s0sPHvy&l}}O_ge%=}MMI+tay&02JCBd-`imN5`Xp=k}DBCq{nQQml%mramB<+Kd_IliJ6wGDt zLEYZvPT@pBeXc$!(!gu)Jm)T~%lu_WfuwTsyC$gnq=@d$C0{DbGRuPcE((gvWVl_D z`PWMO$5jHqLC81oAH5JC8E){IF0TLmFfa0$7y1A0|3QCP2z@MseU|rPKD@R;u7r?O zj_+S|dGqZ&z2EMIZ&F^eHC5m}OpsR=4-@&=Sku-{8${#xi50kUS?(X-4AGe`5hKX(t@|Mc_uL`QYmRoA}0n%(=}J)^+$WR}mZ`HQXi zlG?7Uw@~Qo!ab&ENz;li->s77X)smR)lT+e$)DCSF6&l)*_pd@&X>PlwRktlk(YTc zzu(XGrpn@P&syf&L=Wn7RcG?=GXI|0+esaGWmF`m z$NHN|TV5Kzn5ykN^ z|F1_Q``_O5_ewoy%bny%{`CNN{u$GS;u2+Hg zg2()zN$N8Pv`!nG`Q|a}w>MRO%Q!$Zq|JG9ous&SWT8x6D}xtpJMEeE zzEA%A=l}Q5fBy4d!8_`2fB!3VNB!;kFLe3yAMnqAhyM!Rq4%jU_E+!@``cgs@3+7F z2lDeTE%lfG=P!Rhw{}i-?n3&G|J#2+KcPQ=|I2?6KM_B_PX7CQ8KIwupTB?b2LJi{ z7wf=&{_~rx=XCg^0_Xe8Zp)iuV0Jd|_(NPnZOme=$wI){lQ%gx7{ITA(c_&ZJ5LFLow~uFZGU3a55*(ep%7ULJN%)*j z?ia)hF1FKoY94Ey3`rX&@0ll$vvGFr@26n6483*s!KAz&dKXNxWFLH={OK&>pLO>? z&PL$RfBK~6KM!$G2a`XYGydt?$wvx5r#;ZqQ)k=QX(w%+L{U&b8qn`O7u9@Lc7K_a z^?5dm@>w;P%FioW1zr*+f&ZrSe}(_{Y0qEI-y|vg;5dONNpYR0s`UTzZDL%gW-MCg zcy7&$%O?12rY~DKZ8?dZKA1FR9!!QH%kHk4(4P#>c%G4m#XQrZGpU@q{UJ3!*qFwe zTYtay@JwvcWjp9>gM`W1UOXF$_Zv!QN`2QvdU%@dUIdj7+gz8i2a~Wn+Z*5BS`?2< z^JCtB-|%~Q-Z21Q3!eW{)9Dus^x`LdaiH=uj`(z-FT-zs={4tJdO_7TK-mX%p9BLi zl=VI-qPsKs-d*XV0WKi`;D25I{N{08BOSkBaF+uA86!Nm(*VC|fDfL;FVmI(re6h) z_qzO@voxZDaL;~$)6{YXy1SNe+A>ePcS`t0bMKFS!EWSa{lR&? zkC3KDX9)nL#@yu=d$bh+dPB+i#E$jS{ zx173m#&_OFP8$r)_ysNzt~noABzpK+-5mWJx&C7u{i-apFHoXVme~UtE|kl!tIy>$ zlPD;H`s&)(Wq$MRZ@&G_x4-%JH{br|+uwZqn{R*f?f)D2_EjB($?+?8;w9sQrI}p`E%|ZClE}&Z@A{pG0D69`#Hxaqr9)|O^!M^bZ4vPZKv-( z^q%gn`(E#)pUvd2?OouL+|CU7foHkgx>4l@8x;f z*b{!xdoS&E1<%vp2O2&v@-F~0WM4`6-xJ923a0o7Vt8GH8@}*{FTCLke~0+O3v+)3 zU3kg(OR6{s-d}#E=F$3nNVwPpuMFU_{>Y7*Je;1m8OS#S`DP&B4CI@E zd^3=52J+27z8T2Bdjokg3F^A6rJ!k?=mXArF;TN;*H^=TL<6iw}?pm(_k+!ViE5)yrSc+qq&4s@K2Y z$?~G5CuBkOUfQeT&ywHAAUrGZPlO<_*U5inN<7@$IB|olETSJ>aCDV24|j?F-z#7K z--`ipzqV&Wcvi`kyzkq7mj15(_?4guseJOUp-;-l=*=quZMH4(zPugcPU@)Vt&9z_sZzvTfUnm zPl{DgL}yzc`ZZ&_SlC|#9=^KI@If0rDTkn$y!7#&KVMf$XRn5HTIWeQy=eDrLY*hF z4hsLGv?odRVF>a;ZA}*Kc|8`&-NRO_6BT9CCf#C{t}JrhRF9u(I=7TGlcboqWmkM!@r_|_4D&u8{D56PHG$t@hF@n0--z@^ zq`!ekKRbB-4vqfe<^EoU!NZyP=7wokB+H7JWcD=?U%=?pL0J9Gfe8Hea46H z>ZTiW-k9?r&74i=7Qrtd+DrCFBd9GOOrYRh1L#xMd}bUqmpHiRG*^%J${N?O{ynxX zO8TJqX_B;`1M1G*t&{%#eA}h6=Dy3-Bq_Z5f))+@i91f9$)EonqTp{3PJRQwLI3_~ zwP%OuS#A)3(SQGJ^8ZU15_l>B-@ilt3f{qgyRqtjHLE@@4ftX)p@;v^>q-9Yw{!Fl z(NdrLS5+O*Sypfu3V+--5^gN?FR+pD+Q589<1gceRUJ6jcUK4g?f19d zw)-Ko{WrUD=_zXci*|v(c8KV*5B#+=M89S$_;R%1BQbRoXg7iOdlqOPO0(Rl&Lnt` z$G)I~ekju}r+&uE>6u?6^D?Jt%`3L$3xaR;lzWo+LD42*5;WJZ%-^3DyNHCrX|B=R z2YK*5BZXz1JM9&bcGo8P4U|3kr+~8WfBY^`*`ENRuZ8c+G~ZrU{pL&Xm!kjT0O{+( z{9X{!UzqRT44J;7Utc3@pODip-oFc=en}-yEB!8xI!9h!*XF%y_*vRpp!D0z+Flob z!b89J{=fWYwzmN0e-g_0RqyiWt)Fc%EpYtt{cc?4?YH_>j%&lO%Y6lZEtSm$vl|rc z^+eF8?S@X0b#}~e@$$R_a-OfBf)Sru_--b|^Uen(@K=qemh||s_`sO+VU(?{GiIpG4L<6 z^}(Dt#pLYzUUY?b?#AT775p|?gp($?RCac>f10qgA|aC@$+9zDPm0q2=;Z&^*g2Ox zSMX5df}51r+c%!hlV56Sp0^b`Srh#95#c;lby@EVIb5okxZ|X3|cgFM{$ zb2T#E;2|0qOuE7k>TEpQOHVCc@6GuUZZo{X6Yk~Dz9@&{r*oafq-!4Rugh>A8#^z@ zSmeYhr*FNY}a=j1B@j{LKWEUwSXVDTjGa;KP_9pH0kA1at6 zg@0D{=h^Us)=9Ev;<#n^zRq~;;(6X4*Zh9zt`{Gj%~3a)1bNktpUudZMp<9{m&;$SkQrwZbx!RRZ4meuAMy2!Ud{1O>;1>fcoXzNowQ%amg@Hf9yC;QRo+#W zcu70)GN)S04E3B9_Z=Vq7ezOV@syn8igf{^mYjGJTm<$Li9P zCyD-?<1Y8kote1&c7H41H?PcrCyxAlJ)B~ke0!|<+qq-+@q~#}2b0HJm(I&xmre7i zfIsKlEZGMWx_6T7EJ1&oxZRm4J?Ct8I<=d$wNsDJ43!5UXV(N__x1|T=g*&;AeekR zn~V<;!>4Nga#2|m$4#;`J+|e<54^Gnv&8!$EH25<_P_Jlb&_AavgwJJW$ z`l(%Tcj?XtFMlJ<={^ek^-G}m7X==4WzamL9_!#5;t8GB$<89s&ED*(JUsPz)x0Eo zFgz}X+%*Vx@m}sF$mNR3$6oZW?wk5mXUktipT9ordvW}qH|nM8%(O8KF?d=f17Cc66)-6zulgA{#@)U{YrCZMR+dp6smvl%bs?$Cr)@t zxZl6}hx*z#c)@>Dc)@vU9zOnd0~kC#|GfYPoYOiVeJAc!j!!@aPqgy1-XFjW{FgX` z$CB@-zQr2&Z@~s{>v#<}c%9?F9B}Y<+W+YnoBgAAjUR{b>AvxK6t_*|+otht)A;wg zY5d6NU)?r-EbvP=NFFY${DS#!Jltz}FMFO^eth%x({Ud=VzS;BJic!NuMR%2GJkC8{sP(iU@vq< za_EA4lj;9w?@hbo$c+Wj`}zI~4DXyH>0DM(yKTPdIfqSAZB9#S4oTT>j_v1*%0yLR zmf>8AkKX%YPX?Xxyp!nBj&YY z-hj6Sl~)A&cwZoRgI5S$S;rWRXbeVF_xN*Xe)RmSlyA@TZ{wzG@&I&|dH|U~X1_cEJ<=2# z-{ujhs(+Rmw|;1F5mcK$HTBfwD_E;^hdzVNsdxOn{s=SggnKzQ@JU~xw_{xa+3NMU ziHfF-zL29YCoRT8b>TPZC)r9 zknv_kdP>;`!WNotzt~2w*~YwG5v?@diPYRNjF8wwZFTmZw$)hj92Yjp#+v=cpO{H| z^xg}en*7m$N||?`u1ZaHL$_6$m(pA1rwD05Iy74*POZ1NVyWk4lLNKph3?5V61IL* za7KRuHng+WrWp(xxmDwg8fMmE>G=i98q;yt79SEeUY8rvnQ&lZfVSqN29UPNjJ+ZBYJ}9lNs~>5FBLj8tF`PG_YX(yV~--)U!33X@#Fi+c1aT~Tk$ zdt`0sCrv7mdZ|W%ueRzYf$iz!beR!@6h1qUx!6j*Z%+vuZ=&klTkoY#gmRdSAZmG~ zFEDjmtsMw*MUZpyg-X?yD9kO%#7r;l1jyZDF}I7T22*`M-C=aUSS2k8sy*eUkDYsM zN(c=YuLtBshC%E5#rl7kRVkZFrQ{<4hYWNRy$ie5+=&vDtcWMbY*77b!#(o8A5TsZ zj$=WjBtAXS5>kEo;dWq(8?S=OVz#~s%qq%fOdphe&}zT(K_sA9Q3FFpi;rE7&_($X z3j%^Lq+PYPyFX$P-(o?~JDV5IAwaQL{nvmeM8$Oqw%Gy^Mj>KfB+Bp04isvS*ka5U(1*ta)Rwd3#aGO5YJ6Wn0$OJf`hpTg{xi zgC_(#NIE;~C4w6xmM}m=5ymNAxFQTofRTHNhJCBt zQ!kVXA`89`-FVQltRG#=`W*x?G~xNM=y#rl8Joy;(2br^-wILaMwk*zI?L6&?&_lG z*?#14FTF)g;L{DgMNI#j&kZu@JH~}l3R>ZeAkIvCoM0A_i4cbfM~bem$m(y3c+n3Um5K$Xh!PqS#sCs3cg9iA*!$$Cs z7}UE;W`pYE!201JAB6cD_5R8VTj3Aa6o|1yn ziPTnSOnWbAH1Lu}8;?-K+H}51EvLQrVNe3QMb+nwRi$eg%zD;=eGUZ(8uU=JT()_% zIiPzKu3jlM8OEZR5~gi0mqD8ML2E8ORoX%eUoN3E+Lci4e67s@O?|cH5UqW=Y_Y{5 zLUVO;LGLW9O$Kdtkbqq-8!suhCS4sb5eH#d%PYUyE53841ecj%J%am=?OVTqhkJtn zJ^*V>)vci1q^c`Z^95aX1}(1^Tm*%>o3#$Y#Z={CEQE7yeDnPIV3y*6WH>RIc%inpBJGnwCM6CoNRJq>n_=QPQA>!XJVZBi=Grvr zhup{e&=L8u%6cN^*VKy`dWv_TEE;8uQO4LTqm0o|Mj2z2F-94~HyLG&QN|c$3|qco z8N=2dx~M1D`eJCfBuJU*4q6Go%XLP?>Jagj z4CBib&JNK^)8kwcafnuQeu%PVN2Z&i46uB`T!X5{tB~_Ou`3R%3P1^}$^%DNILspF zAsbekcBMHh>SfD*6Ye0I5H3XTQ#PK!6z^AnUM09I)+O3-BGUDn1ZVx>K7?i%r{Y+# zawGTRz$hz^vhpY^SIQ_WkFqk9QC9Y4l$A$Wd6bpAtB1n_ev$Llz5s{)ya+B@Ggr$7x3Nap{TmSzhm>76T2& z1XcUcFZb+KVhrfazFY_nvtX;E$N27mW~Pg5+3#Bb3nUF z$}nKntgM&f=3uwz0R-l`ead@D=7UMd`=YJE6)#Ic)UUutnWpFlW+Most|&=PcOgfH zzWsHj^9`_h|LgMfxom5}9Kwv~BjsTiPtp0jG6v%c5{c0{C2^RDj@;ut*UY?}O>+sE z*DS9WaY6J*W(8r2UR~aUANU$^wKQ43L_Eo`P-}D64=b~GL_4(m!K_}$BVt!t9}_#d z&*#d6T?vLrv3qy5%8)0?uJk@lex$1$BIxzLATBBf%0&Z(x}mA#t7RKSrDr}}u!Qq> z=&4@Z-W85MQe8-hh_>loZ1k}yt|A^{Q9zZq^opZg67y_RnVWQgG&u+k$u^vInX9gF z(v`i#S(ebC*E54=EO@TMF2QP|cWBniDw$pbIvwylu#HuMsWfs+q3R;tK_IJS%5bHt zjrbj|plb?6?(Gg5#8s920EL>JN^py9G|Yxi3?~Fd*W$z)2Cs>$(@cKV=TLO4`6=E^`dlPMWiiU@X${=cVBpZ?|f&w49pS-rezI^kS=aV;od-m7qvwyw%ZD^}!|NZW_X0U$NOUYZF zXiL8;C)!i`L7L7-z9n01M_9z=qIASwPO-dkN~%zqxhPmVwHkVw;xFjc%MixN6tBg5 z74kaOlwq1YQzQ{9+8GnGUTQCaO>-lUSJfT%(;Z(Fai9A_=ltJ&x@wrZ{&n#5(J*$T zWkQ~dUA@*5bKU@Gg%cVNw}~R30RQ}A^)@t{SiL-I3Sr8YH|nr35JidEKvAXCw1$7J zOv+FQz&!x{RPA6|YSAAZRueG{sqg1T9A@>`Nc6`?^1EIE>by5!b)>?y_U89)|!eZ;7bXe^^XBCw45h*}x-5u-k$ zyFBVG8TApPKB9X%qduaijQWWFhNC{BqvKH@(O>=h&_}%8k1pcvef#FU-IVU$j=p)W zjJ|oJZ=Rj@=$qG6M&G<@8GZA%_P67}KHmKHbfc>N z{bgH&*DVcRwKaIv(x7!pFIyVC`R&(@`cIpyzWwdluWjFc_uH?>--~tN?Ov<{BbGjX zEd7=YCNEz8ehZ7qic3I__f2Ez zsQw$(e|^&#)qg!@RR4W%WYd&U{Wq%rI%c59k*4oDW!{LTj~h!zW!|XF>zmG~%~glRo+0QtBF$m z>>X&Ypc#tEoH8P95^6xV7`g-qY&P4Z*WFhZWik2EcAMcirh0xjx#+$3`bFyMMP$aU zhMGumR;c&(K#g&-7X13YDuNtP;`qW z^z65#`Kp|Akz#d>bcYi~TSA<4B4z9H8b6rH93v(2Vl1h+zzb6UHJ`Z%EYLTV8G?9o1HAykU3nFy)l<9>|B0SOL`WQtxOJ7aoS}Kwr**`Sf#1<3XwCIO3 zC3un$FcxyG{Nfndf7qH3IjEY2T~4cAPwRa_Q<;&-%`@W6t*5m20xPmuAEQ5$ z*^={u^S?EJm$yDjC}HZ9vpKDqSt9&n&fwN@*`YI%%~%o@ulp;+}LSy6Ipv9yBI6SR6!`?Cyv2(4A$%4T@m>6TDKgO`g6 zarD>41ZUL$YEDLlzWHyO`~P|K`v+Resh=gez)2lTik)6^p*~e7H$myEwE9lh z{G%CT^Ost4N!cP#usCk~E+ejK)F-#Wj)1RfTQsR$Hjp9wlqY%0Dod%dFEk}6&V>HpP7G@@F2j2-^Q7!~w3S~9gtzN@! zTkY4z8JMb73Z&1HGIGjOK}D6H^EzhT#OQaFUZlU^BH4B8VOd<*d{vRFPBkkqe@)2!4!~N@eo+=x9Ne z<9;HZra7Z(eFO{#o#l!Pc@&csNsc64Ot6TSR1vsZj&MdNFntDG&oqty!}DTKT3EnF z{;)Z&Vs%$s2u0_xU{+KBU;m_`b$NDmT|^z!8`QKTuooq7p<-J!04bZBXp<%^DD+EM z404?bX9+AuL&q|orBsB&wXVm`E+Y)+Iz+eW-AVbH!5)^V5W2M%m&ck3$p-f7Y^+ zBuXE`m`XfLNPJlIh9cXYp5T&8r7PXEDN$}|lIZQ1H#EygtZ#hX6mCvUQ}iGD@W!P4 zQ?oEeSe`b|f8sZ+<+EGIaPbXkKEVs<0pR;+XX5oQO;LL{MgJD~+2dN$i{nCT!smY7 zy4#ti2`nZ;AG42L072-6tetuyc9Ck+`pgx+At)0hA~8&zuZXC$Z0Ve`VqSAfk{02* zUmf3db2S40ZNJ7@*>VRR9AKHjgLgb2BhtJ8XGINkl3aBBD$xg5z$3 zA7)4sG~rw{51k$Zx-PC#jUNabYXJIRSHFBZ`l(rkR$39lQADIsijb5rb%02b>Tf1hxOV0^P=nXkW2f&~g)BTrb+I~Ce==tgGk_dthbj5?3F14()EGDa# zSRp0oVxf;*N7rzP>TBs4=u78_@lrR;#ttsRNY^L-mzRI*oOu;~R^Rs09BV2y#GXyj zHDJw}DGZK3(UMEj1!>NbwO;=cuLzPnCFqtU$;8o&Tf8DYgV(>j z`{mfoP$S!dxiH*wsyRD-D;PcmFtw4HaYg0^wG>Cu60?O5zCF)D6R>&r`>p9e``w|h z8(6hE;dxLdXTUF(RyMP#1qV7{clO7(!cKn(Y))OO%;lt&)?n8LCEP&=eyTNIW*R~ z=KZfoLL$XQ0AKvaQgwgVNn=>lw?`zXB7z!)hfyJ+RxiLGu^_-h>t3b3+?-Q{;wYgh zHS($!Wca+=pvO@JkOZh!m|2 zC*tx>D3M!+sP~SqK&7=_ucJz+N9zsgeE}5gd7wwct(aGo3jBVtjVh0&^t6tE$#|lP zU1AJbOPclc3>IzRIiJdBQ*=d$Mce76u|sQy8rT@DSF|M2 zjcijrZA|6VRyTT|G=3xV^bpAw^hInbdfAFU1-oaxExxLw6EF#fkTE`U|Bc_I*#EaB@N4ovr*H1X%4 z<#R5YBdzvOKFwynYqUUYfZ(I83UKhsMX9)OmZ6IF*>J^?AZ=v3q-=J+gP_Va?`&sl z_%)YAY)erGC>oq{ENAo|IkEadgbSJ8P)4`BHgz`wKNr1bFYN9_LWimpis_c^J?0m? zrXu7)=jOQ4J-crpv%_lkE*P>RI6(mRmO>eXBXG-V?H1P%*uA11k$7_jBNDeDapBt& zfWw8ik2iQ0Uf0Mw^RRM7bHlf+_^Ht{93LJ1k6F5$ZJj{OL$EgVt{Tr> z-Rgrj-vz=_(giabR^##Cp#()nDeJ6vDB>9UmBVqW`pAbUr++_{SFT4SCHM{!A%!0w1e`L*qll8Q|m} zxm5aKAEL7_#uM-SqC08wIrH^=n|GhC5EuT_yH8g;F0oI2IO&O`GJ!$bZk#Y(R+}y` z;>_syLXP68uk49~b8WRg_yv8~c;B__!SRFpv4JVq0~Zpu_Z2?5IPXu#Z7zPe;LXH$ zIZ6qZ>RMnXsdM@cM(Ph(Dx_#ioGXW2sPf%85~UH{5cE#8RvcjlDY~79g>lH45%=au zUwSbS$r_AYenjJ^(37zHd~Vn->lksv_$@oseKM3wC*Htv{9t-JfaZ2~Y)1z|A4Mcn zc$Rc3?7|*GS(t>-qLfJ4s@pZCdO4wGo??as!LgpK>i|&}(+GnTthJROJmY!Kvv&@vtV5Pj3c-%K83p4bO##k4zDNGoo(*F~E82v9_? zGFoyj0d*k7JQsjuEq=pADc$JaPKwbY#{x4&NDQv&b%+`-;Ld*c193@KL{QafXspE| zFby0B0@RLt$r2h-g`z|=J#*@Hi=9ijGeR>y^cX@;Ck2n2-K4)i78ejSsVHw z74FHj4%px>0jhE{Bg|riBc+cq7cpgvWNo(FudAOLeEfWM4Nkg58MiN>CWblv;XO`d zCus=VmKNT)D78R;z!(=UcjgRu{^MHY}yYp+DuM9DB-E_&Mqm(pLr-6uDpHw2xmFikWCJw&ry zAIb>lk{~Q*R0%BBB}T~+t=iT|jo=QT{RI}0UflblPGq|!4p3y|(Bk1HK&gKb? zRJUIrLNv{|P`Jx|cTb$*CRfo~wUaNnOCEBLX_5=_vFq-vVClj8N{hlBpD5=d3681O zmlZr zYYU=p3=%0L8_x)u(=Ym3G>;}|gp*`#+~$-=i^apW@&J1Cc?U$-YH@h{rjol#~ScJve_QJN8y7Ps3VoRR3z z(Nn*HIg@#&i4BRJ=CZsl3l%|Rrm62N=?4a)N|I!bX2kioSwu*wbkNm+_$xyvY;94o z-8ra?pFE0k;U3eNdD(;Lx2yJEFv4xeZw4~H##U*FfoxQ+IKTet&QGoOX%bc);8~flx~xzwM}{(O4olG zZb|9NnAnCK+fcePO>3j3!ztYcO>4*Jtts8t9_{8)I<7dcaN`OD-zx5lqiJw74K}oR z)P5`@PLDXfja$nS%Mir@1VSl4lPGH+p%b`y9m^Y8b!6L8&!&qhx*#m3Y;lM#bH?Bw z*M=EV@Q3EvNsNe!ntSO17DT}bSlJT@jN_b`D^@ha1(=tq=or1@QJxwxq3xiqu%N)R zAER_B=!)T+V{`y6ERKU)aBdE&>+RME9aN%}U?$tx%O$_n&Ab4Bs5&&NV$(xJMUBY3){n_n`S1nE~*O^Mo`Ci!Qi8AVIt=Rc{P};QA{?LuliuHliR@h$*mf zj_&}zyhOU~k!`V_k1+_w7zASsf-wfc7=vJpK`_Q3*kOTV41zHR!TpOfqkH@4-ag9v ztp{X`J^r1>9(N%E#~9?5@=eAd--saD5{ul`>yJt9v8TX*w%FvV`e(I$*SCgXzS>hG#j0omzfZcCeLxbH72)^F9 zvY|oPJ9|bZMEhQYvAfb8hzRuuXD_OC25EOCFyvf+&~{(*?t-_wvTYFeo^HK=(>B4} z`=(qE^&T43-Ieex=OG4GS9UkFx-uYiVSwSaaejjgu)SS7rgX3&HlSx~s=aH2tSj3Y zW&=9*D#^Pt(7Ljnp*EmnZ^|8Nunp+D$)ww7xDDvG!?fFDzzx~a4ij&uAvd7!Zc}fg zK{sRvLrlKDayS+0HUYcxwU~mp06@2;q8R{>#zeg3dVA~|?TdairsFLZ9&Ac(Uj80U z%C3A>rsXXl-f3!XhVmmZIS*cJP*i8Mg(=#V{;>Fs038w@zXuvVc>b_3`F#>WOA!6t z!{xgYE;59N&v#|JF!~`(c@Zr;FebJufic#Hz{Qk+F#E0ypb@5ohTV7NF2nEpMciE& zepiNuXs`aKdaAko|=Ao%%WQw&WGT6YR@* zrVl{lr_P?cvTbbm`1kg>*EdY#i=~Hpu_TCzgblzQUn`Z$xAj`-ve;+;z5Y_ERHx&W zQW;~4U2l1zB&vTkOrrjnXtT~8J|y}hzeOo#YlxO9QEBY5Bf53$!%9<0WiECbKfX#5 zm!$3uTzY8)?qBY7Oa)P5{eh;mT-%`VrT%1$!=-PH*WXslSz?KlpvDI6SF#aiiSfAQ z&6Eu>4of)YIcr-&RQndP1poZXxi>)I#PUk)Hgrx+H*(lqadb1&gFGaS--D)TW6v8A zyqK8V+mP+A1t~Yvy4vg@WIh)z9$0Ncoe+W`VjDBKsQubF{9QeBE0LehCvIf|G(Kn> zAGD1R+P=~UZKVSr`k1ZMWavXS&zLq!PPP0ermFQucJpc?_S-(QD(?T#$5upX)ciuz zJVh)|XG9p+>|##FrrhBjV>V3_jYX?&NV5(+A2chM28%;N6Lm`n+h$&!qJ4LEn8y2A zbm2@h@+7X%ml@|u_N}Xpri>wQ zzGH>b7zXG2QY`g`!fB`*rf3Qei6c~-#;GwZPUjdd4vyFijnma{hem7b5IOfCa|eZ& z>4cXlqeMPRNoT<(?$lIhZm2bmb2Ptg^ zPbtVHLe6UlI=aa$}G4P)Ax+f%*$j$iz6RAH1JY+gar*m10zd`57bTBBu_ zVAggEJ;0d>UxpPz%vm?}NWMaYdGIuYTkSW+t`-u5(gk$%SGHYC0e=!98vn}7wE zb~jagfZg8HdV+~+>s;?*cADLS0Bqk3yo(h*UWk8Fz<$JVt{eQn33&TOJx;jSZt<@k zXi$?4C> z=)eDK*9&K!eT+x1^iwf%HxgPNG7(`q8<-e;cVO^RLkStJxpW8d9 z5CWTzKbs!E*7tA6RSa84;7T^1c@}Aa%fC(#7K_?iCTQYMt3GHy{Goi%Tn)nTEFnLB z{NpE_k{_`o@r58bacN3^`0xMfsd4-RTwA|w^c+*XU|cF1$%$1>{NS#=cjqTRefs6< z`uz0j?Am0$`EuZWYKiCB_+}z3IwYMoM>QvG zwb}gyMUF*i9ALoRZi-3Ch5nJ_wZ?yg<`c?~O5r>v?o`-QaJ+gk{oVA%WN(c1(`?jg4LxYXn$YIQ zn6cp5=C2cU^5Me@WV1badyeM+Gq)FBc5g# zg3oEPfhp!)-(}7eP02fx=%F%jSxWoVDmX(|M5OkO(@z3NDj6U(JXi4HcsV?S*tdGH|7sShHH9>NUHF4ZqcNJFR-|LuBn|I5e z8p~Q8=r*CoM;?=7^!jC;)|f`0+Qq0M%Gh_nM1uq}^3ZnDBM;reLpO7}=NBg*_rd5w zKi?6b+sc8`%t6;7!^n6xYDs**BilK$otxiBwsR=k*?o zzlcyK-r2nw9vb5DhO&w=laeAhJWG?gmy_ANzyXrn z{0iE4Mh$utEAHIUJueu?DV6%4f-ES+Tx@ek_?RoKC|lS_+{V703;Ym4((l3_#V*gE zkZ5Cp_DkW*?O@j&y1Nv%yB@N;IaGN=Eb_28wooQU=wQ%ANyHR66h`$tY!I3YDB4a-eTD?JB=im&+5H@Z8b;0I>qBT#8x z54LU6;nr)NUY?y?pOt?2eDSXQLqo{2mbdwm#^emxKB@UWM!ql1D#hd7Ct87q;`_m= z@_YCZp-kw4JHjgH`#VFe%8P&zzi=%+@4ivY2N(aou&n<6{yRrB8B>l-_si)?j}VZF{7WU_jJlWd7!O#Hj|y&hEG>$LgxbI3VtYS?k? z%zEzP+--(6cyKa*Z^*HKMUL(B+dz!RrI)!ktjIV|_KXy|%WnfG%F!q8;zs@xPH6ls zTLD*ofsgTC-W!K)m-&#EKnH2gMq^;-f&G5aYj5Vj4cr)-~WjRwLIz4mV+Y(ul}kfeR{R>CdOZr^so4U`*Ag(Irn zt+B8R<-S8ochC012hmR6pT+QT>n8VQ04PrMy;u!PCw4R(elr+yC;FbzdiX7%#@_6Q z70md4Oo;vlMZa!b)%K2yRIP2g-didfp%LFM5C}-C+B~sxu zJ4P%|^r^9D!Uc6{Ke1)L$Oj{gc$#rWn8q{9{`}ixEdsM>NyJ3uLM22_Fck}&P5f~> zD$+~ZPfgB(^c>VTw zZ{ECl^YYD`e|!G&&CB1t{5SOcJ^+wQg~h);-+8S1;=Ynni{@;O%O@WXseD|@xZc74 zd%OTN`F9i;Ov@a(DrUKJrUj|mMEw~qowZF8UJ@Dh zucy!Vw;`LiHe3qFp6U2|mCq}7#)zVFS`fKLbwoKtLByF`Nx>p&0iP_^$LP$T2!y{P08NQv(y)iev38DXOxi?YLPK%cGiAmqYIqaA@YUQI*$5 z4gB`P1di$fzMXQ>uT5w2^Vv%SME@b7QvF=}_@T&3giw~`0w7Ow}9Fk>B8@j)O5ML6>CC`)C;+jH&M0~;MKYjlaDGmbz>!J{4iU@`i z6E*MyP6Ff{RQKSfR1&+ZMTc=Nm zMkQ>!HOnq`NdKfkdU{0CjZEZRC-&Rx;}*q4b6zn-W4}hI%ntK&64y*Yz+vnkqXxsd^V z?PERAs3|Sv<0>Oj<*>#?QlXEM!iwl4S=8NxTRS1q1ut5zw8lA|6t!UqbWVvx6}7OZ zZqPGCkZVM?zKOx);uu&YoP3rfk%;AVr61BN|Z}|92B=} zU6&?=qJ-!1MDuWn3q%)&nXADD~vxOVE)->8-vY>mze(W|#^fU6M+rDb+1i%bp<|rUIxnq^E-5SS^Xh zSB5q_#X_HB2`5iM=F%8piHHzf zwA>%n)y_Ci2yTZ<5KO*Iia4i}LgU_n(i4;tDIpH^FDzNxP108akiE!(CF5D1m{lpn z*@kdeE+W^Gm$$YB2dWL@e6%{|3ah^SCyE&=&31=B;;4@traACU6%spu# zZMjdyEo-8&K~p3z6lNNK3&g-wOcv11VaHfAENO(3WQ}B=Wn3Db7GRd>LHuQatbJZH zAehBKpAltJ;Uuv)rNJi6cM5`|C7vaXY^5n7SQJs&5-PX_tf%K!wgJMCqAN`s^pBtw zODJZMXWxLLcTw$#2)%NB%j*tXYZ8_>L|k`eq8HKqb@F2RvL1+gv&x&^8gF}G-FXA} zeYWA3&#deb3iy`h=pB_B4-iRbB-T8cAE-&*bVVarE(yX3NU4gh2s*tyM>Ne6k~-nI z54k!Qtk3v6DgxK{&eTTlc@k?mjiV(`tU$2SG)xXJ55D;744AHckdd?It}BvF21Zag z3osLX{IAYFKt28AX~=HTxus21LdfsKQZvJ`iJZZGk0gOP*yLvM54t*{Os%_73CO|{&AmA!^!KPv9yGp)Yiqmqbsyr^vopRKj7rT8Ok~j(% zbBc5)`;^G%W|E*KR9wTF62ohF?JY1%1jqJA4QoN{H!H^m$Y^L2v4C$z|Lf|PPe(s- zt5v~KM5HwLlfEwxk<6o|=J2g9>k4kJ6f-&}Qca7*JAZlkw?0Any}m8JV0{-KIxf^J zJl#p7(g31hAT=h!gfs30_gh$s!Z!qQyOf-ugx+*8e5M>|I$N6dzZg!*ZwKhLM&3!JIOj0B2{k+<>Qg5hfEj zTyaax7R0LU&^!mX=Y1UdW(z>M3_I^&85l&J9#osY1;oHUw?~M5DxJL@AXZI_0&2@h zOZS^dC9h2c;XXrc7}*F|DxTDUDiM=@u7)e_02LIX}DlCt@M3 z^AgzFwG<0ny6#bP_+QqV|JMB7t_(W)q69wK$gS8p&nIWDk&&$uDuF?;=?xKR4Y62& z&8d5X5PE7QY*^$E!2Lb*#spv=fA)Y!r_Qs@jWuo4#+pJEN%vgAq+ zX{JtX?#F2osWf{Vwod!hK6(k4wQD;t6Iv#H%lw-cg9qCFDr z)-n?9k!aV;NVErm%#zt|)ov5v)-62HJhcV|`5JWQI~n*Aj^iJ3f>~tqF7LtW@uAiy zg7lJ*G8y(k=9w0tBp1$YRL^2EvrWJYMDJCpp1uWeMoq?GghiLX1ml`&=rO^+f|cF$ zU=A-(LiAm*#9n79l(E#|M8Z+aW!b6958O0e^wi?nF?##@_3LMS+d-Kk^+ev~$;afR z>9t3_3?)%PcpSdRpQ`gj;9F68rcyZ0Mb>?XGvobnNWJKAr#lP2;&uq?x${AK9 zStF{P#x~pqu=PJ*I=`Jwjard}%h`N=mx=n}kT2#{TUwxq%W9LyYj>CyaK z|2gyKryV@K?9u@0+QlYmSbXYK32#6`SHBQsPQM`gKWm23AB{d3Q26xZ;=E%4KsB77 z?oO0gui+ZgPTpi=6{bODJIg!h_DMmtN3c&S)U5vL`l95kp#KW3=O`PY+KG>CurjETElKB~_oaw_gBTKxZ-0~>kOawluh|bZCuW5uIefh<7ZdA~Q z+i+*oatxgp3!OW6qH4z|!c1dY(KWotsdwE2>Tc{4MDk>H%Go>+z?Z&3gG&o8IkZ@g zzTYI1tiY+&`Q$q5 zf=@D>$t72cgubA8a#b`bmgp=9#ca!6cdgIsgb#FQ30}|T!LttIV#uN(tcw*;jmAfW zy6;>ywM7>K-k`a+b8Bm7%4H|J2`|%<#LmZ{L5Cz8u(FLfJe_NCq_p~!Mcj~=uA?0$ z({t?L?RG$9g!j5$X@+2VG_5U=Gb|;E?eP(R?|7q~XPo)icg;)dRM>1xtn$Q)GW!C^ zX)!f>U3#dFXuFE4c#Yf!@eq03O88wj!Ny}g!jy}mgCmvW#On#{1)%5NMf`(kuanrElm)KnocvLRS_q1EUykh^EXK}!nLeIO)BB)Ysu8Wwd0O*HOYnI#mFV-U6- z8hO!~(gO1oezYSj1z>Is>%S3>Bt9?Rs?mlp?iZVS zp))MW+t-~{7XPGOC&yIy&)$xLaEITrF0QZcjiPJUU&ZR*zbd?ReO#%Yoor z9qa#e26G8oMb@JTt}FsvM5=3;=SgB-RC0!5DsPa{KPrx-;+_5zXnz-IMud&w-AT2p ziz(XF)>P^ZRJc;oMNi}tUfVx(@cixT=eurC9|4#E8pwmU0zi#w%xUH**B+fT?NSU(7D zmpkn7P?vr6E^ah=t9Gw!Oj(#RDAe4fMDRF32g&9vY}=W7Q% zx9%qrLZoVRiGkc(f&Hxc+ce9;VSH+uDFM1zBeV z{a2L)s6_skCh5@n_TP|=0Y}Rq8SL8mQyTYz_wWAqC(S3GUlb_P z*Ga&VtaHH~c?W!i-V3h)RfN(P#ANZQNu`~8X(qc5UjWjZ1*Ks%0Vmm|M=|?O{9oYt zU)-ouNP1!u5I`UdctcQ14cUL}I3sAbhX3VE(F9>+k23tG8DE~WcnXN*Gfsk^z>Ii7 zFc*Efw5&JAlFK3oMo&;NWYHHgl#)Z!R`cWFR=1f3^Yi5gp8zhG{k;c8S=d6%-BWO6 zecJ~5*qPY2ZF}O0ZQHhO+n(6zXky!TGO^8_=Xt-c>itf3?Ze&GSgTgA>VrP$uHXM! z*KM|jA@^&0eP?Hzc0sYKu*AzxQN~QHz7)(O5S&<#S*XWscHsv=t^C%VR3ddp zBC70HEsg_G_ylKERB|mohEg_{#SDdabA|d_-Obb`h6ta{ZFNI`TS1WLR6OOBsYH}71mRH4BK4C1`=e|=k@N@bz??9E~dBnlUhG7dply#!;&^IwJ%k zDS|p>s4ZU2+@3z6msttxUuE4BaE<|n@ea-BWBNfmmjw-|8c^q=p6S_xqNMuQls{R2 z=dTP+_47-t!SA<{-%vO9PWAK^msRncx5UyxpQkGDts?cLBU)T`@C4+_$%PnJjflpr zNUM6%!>4IF$Yr?&rg}tTA%hJgst-TLQASx9PdG3sq?04>W{hvDSljemVvT5kVo0(q zj?zE^3n9{Wh+PmdwuNR1KdBpQI&waU_Ki|it8dfgPys6Oq$z5xNaqB@Q?sS_NX#67 zDK%B>0^x8`gzm{YM(TTHkdW<62extRLF}{iyafc)jK#oIa*n2m^#3$`0JK#FnMTuS z3y@SOrRtK0>@6z(maG%yM8Stw{M^QTB(dmQ5aa_y1N}nXQ38@XRneS$tmOQ*270wy@A)xGGpu zSp|S$48^UOmM-0AOwY0f-+S8a+4`6Y^10=bD6cIC=$KssTXcGm_ktD0G3RNbpotd3 z@ir1LX%$smdBB7k>@aqL^q7bbCG04oYqP3X&y2#%izdy9u#P|6L@^eR(k3c;;g>iO zv-fGxkMhdRC`m$P3U4qpt`DLfHi~4)Cy--b5WZERPoiM=qDjn0!-jOQ$$NR+G>#fK zsj^j?e^iyt-#QGpiZH3Jw1G82j&F?6XtLT%;kLXaFLZvWXg9$qr%WUc1^uB3@R`n? z_-7%4-_-$Z(d{Y)Lbsba8JcN|Jdm=UeN>-E_jmB*S;Ky!ZDwl8l^YukMbf*m-ZP}^ zMOw^H+b`K)P6Q18ECPb#TkF{`VukNVDx9GS%!{{hO$>nzriYsJCu?2=xV3nBX5buO zVA#yVUcO-MtV}qXs%4{wxh*GN?RdeO2+sSEpa(|wzo>ncwFUcbe*aCLFw5mmBQj)= zxv$+mk2^BCXVUCSM+(tH#S@iIRK5MUi>^zGx)bPXUwdAlCgRCvlI2aJvK^5wliS)k zUo&Z^pU(c&Ql8$_j2=Vocvzez?#LjGXJ7HeImnMU>^OhpfBx;Js)1AxPl%+)I07(u zee%V8#I^Vy!#WdE`B+C*`TNKM9C+MsO3Ekm4Pe3VW<6lJobMuEWJ(eESq(bu?^pv= z^nA;60Jc8fSa~M=0N!!z zpb{pQ$0)eWHhbCXbESE_B_K`wJ^BFPkehScKl-!wNIqkID)?Lu*_Wo;xuQ+ytUX(_ z0O}3&Hgs}OCnzMsQB))OfGMI{wcW^)KGakD^mF8CbC5a|81+Sbz$>P9TprAEdBbvf zBRWPK#JXm(<`-F{2N+efM0BcXas$Nor5byqF|Bsf|Kj8poh^vRN!&z?1DGbLkC{RX zXQXz`B|k@;+#l^cyrLvhruB;w{WutY6Ol+P-T0Loo09cT{axNhDU4{?J#Xxb(4rtk zsEYsMNDZ_15PeuhmP4wvH|hQPC`urGuNH0Q-@^1Q2CsG_uOr&lSf#?L;FmzH5@9m- zzJ!!%M>>m%=E-yAV(B7;SHw=qx14g}+4L%FX2L4C2@H{SmLKZzaN8BuG86iz3h(big0LZ@;7b=MQPPB-iN=zDp z9AS7ylXb;NzY^IJJyIP`8dV)2xK3d>jx-tJWQBX_@Ifg0#;U}Ut(H*5$8D{opwKu-;j&ywDomo*+ZtLn*yko2X)yZ2G zyA+Ntw$}z?m!P#AL7c|Ns%0@t5>F!~r~6o`q7dnCn}oALqAUY_d_4|=-~~p~n?(c8 zqslae?o?RCYh``#5f|y-=w@l2^~xR4962-}O=?>oz-NU|dKwC1=;j8Ebs-=0s53& zBc$oH-F4<=fN-Fa(JXM zinX+%KFL_;C#GvYBh)3FGo?3Q1SH`UY3)zi#V2?DfS=SRw=c%>MKI0ywt(*49gncF zR;ddVv4*9fAYugbq6R_WTzzVTbGetvx<&~6-@J|{d3*Rj&w=B9d1N}24ifXIifadN{*tKcJ?_h(a5upbplNe3@X4`v30KFlUKTWoFf39iD@=f z&uNYwk>H@ko#}SXsP;Lu9q#FZj9{`(NQhI9&na(``XB zZ7FVPnVorB>7|q#HPnv&xe_lRJ%T5hhIHk@i|To_bM3Kg<$H#4Z;0tTn1arCx!-5w zMHth5U+*q?(xMbXvpw(rX2mp14s0sPcZ@~PB4tW%qAIMi)JA~Ve)ddv)yQc%0rzTw<3_w*tCt- zMzgG|`dG`Y%{(AC`Kihup&lheG8YAO^pd^N?)40E%L9ZXZ>}(VnlbHC+E^)`Ht~bk}o#D&78RZcsQdBBU9R&b&-@{`UC1U)b6Kko*Pm*Z>aWlHI+Dm70XYAg; zA>b4EhNpie3X@M@=6~hsUz57&a`%P011lA`(L219mW4sncTT(SUZ^YD7&lAJ$lD2E2)dR45QYOXWm*_zPp>0UoTGDKS5H7AneJM#D@n zBh#jbwVbc!e=#X@`%*mdA54;zrsY#Jxsh9Qag+)9I=`TVa(kvbGi*BjLD=s4LG=4m zmfk`YVu^@&KDM>E9T#e9vHnxe>^dV~#h9;sd5pN{J6Ia(kxP1nL}Er+dJBP-lD9`5 zY}zVQR}0HZLR=D`LCEWUDK=Z$QmSZ|&z6!%@7dRLz4loU^w&;LVB5v(m898nq}6+a zsoU}&N=ocOqx(OUg#S%RAR%o;3<;#v)6R?NbF-sy5Vt$kK#0c2ua$J3X?7s4yju@J z+0G|Hf55`hI?Qb~kRYY{Ou}Pu42zY)IWS^}o;5ryrb^}3*j01j4*&uf#hHUM6Ah>V z6P*sV!CB+gJ*rZno02{dhoe6Z?Hp=S4Ki}VOuM;87aL~vEm?RmmK5a`BNiZc=beaU zfJH+oOJ%z+JoUNG0X&@3C{+)?R2MUJ&%BNp=t2X_KXi-9yj)S=Xb2Sf zYWvUsFOX=usUl-{J09r&GZKl`Vhj|s{{C+yaxeZDiA+fUgGAQQ#VrrCpHj9^^|#)E7E!74(uPWvNqB^$S_V?{X7 zL%GP*68w^UFT0GU*t;t*k*S2->C9WYMbSKxQyt?8 z)!C1ZY9nco4ijZLS1?9$(ag8YDRTAVwYYj>6h1=+jS~Q?cJ3&j%@(xg5tV7Y4}sz8 z%BRkhFML%xr3^~M^+d@ybql-x6Wl>nKvZ$Y=|M`6KOt1=X5k|urgpzcDN2Vci7z(hbCczkfOXMXb|X{nUP?%uhd%PMry-MkQ01GHPpDxSO+97%*}SFHT^S zd9-d5Bmyl7R+nLwm6RdkHuwwYA1-0CFkak7RX#RZ-g77_mFGgwTAOfxEEkPatCO}G z7ME9BlVgFga3$D3QS#F7mF-NTurk%8y&_g|cm+T|ew z_+i5%R^CDn(lrMFS$uPp0frLIKjv*ItBm;0bUooaU>#H1{g(y#+-@by^?lUeB%cL7{vo(l;_nKsQhm*TjB6ik+AA$9e_F!FY_VA4PW zCB`*AQZ4HH($*cAVvC`WzD?}%uFmIGV`k0DOqC|zrFn~&w*B=2Od4x#khOg!+u~bV zY)-Nt>)uk9Tc6bQn&7{sn8o*dw^Qu@n8_WblLH6|IyeJQJD#LK8T7Emf-%idgp$>> z-YfAKRQirwRvjccWXI>8IxL8 z|MUZ;pOqfm7Jk8VJ?|EjGzrbZ(ZnQTaQI24@zh z?}8(>dyU--Qy}G-2slP|lDdxr!|Jvd31ASk1=OeJdX6g#{{`4qz`hs!ow zlVLf?l64-g&TgyNyr6V&{6LFhDkPJ1z>@l}#A35$?*{VbhkmAKfTEhURxuS$gHDHP z**HgSUfdE*Bl~{C)Kp*806JkP0C>-?KO5DviXMT0;AW+x(t=m)pC}^XY|P2Fm*Hxb zvYvV1?f~O@7+pnlvoa0T^XEa;LfP(2){)b&>A5SOC#1mK`Ok$vE<4!Dzh(@Sw|&F1 zEzfSxPut~v`{_NecrhAFt*%&;sj^UTdQIjhK(nJIy9nf&y)|90RC}T70ZP=8rNSn5BQbz zi~0T)aO-7JWpiez;cO&vv*JZ|p5hI`wM4^-XNI0LE0TX=yRk^H-9XXB&Ln{Uq=Lw& z%$GV#eoF5#8T{qkibDVO+lh-ptWr@s^0f42fg!5jEPiLR& zN?Rv>d1iEoGIR^N{%*PZ-r-s>b^7Z%TMy+Y52p@5qpHNZguVv{s$BjB==@LPMHNZAKAh>Aq{H zF};EtMmy`ym1CF2dnmj_^wk`$!Iqo4CoF1YI$dx+`VyP(7!La4cSi!I!Kb2;RKpv8 zU_=&%^Ai0Z5#;|L5pS z^J%q#mEF)atGQ6qDZm_A!vr`j@3b=}twg`=l{miBghSlPQxbwdm&TF}1&!-w$n*Ub zoyB^}(n>Wz>?nB*f7wAJ%6e_hP66e>pZS?-7CiArMEIL|^G0;&^tWW@N@g7O;_2l8 z-+5vjTvmCMN18J4L&q!)9qOtrADovU%Wl`D?0TIq+dN!sm$Ph?-mk48!^qkxFp<9swD=|F+E~Mqn#e|Kc z>gxj?R&(z;hCx8nGLZWo3rk+pCuoR_uVlc(-5|{yB91O=Kxo`gLS+rPs#8eGYYi7d z2gF6_+xIxLLFL*P^z#=c)NFO(ckkKqTV(om%78Rxn?i3ra?5%)-X1Bhd2+Cj{D!U% zKO=vjtq0L_nty!oVy9fq=C=u+t-{!<+<|3@SG1ea3Hd+^HOSac5?yJD28yD2hH4QW zB(W^7Nc2LdjPVi$G+|H{(9-S@3#-%iK+w)A{jI9*y$8KsobG&q$Gpq?P=#>y9h;A4 zp*vd3a51K&P3v*HFNI^53hl1o0DnA*uEy_hd6<}**B6Z>TKpFXLDO>4&{3xouiIo? z&uoOl=Po(U&vY>9fNu#rrj*T-hr__TGc3VBX>t#!gs8ls!``Bgo0GkvrRw5%&ztps z6~W@CgXm*k>%`9G^41(G`dBI2>fPLeRRFF#U`v$9h*r%)A0m`{0fXd9htc=X;VIJa z?f8uZ_gf23O327EuKQck;isJs$c00&Hk~v7KAoC$&iwNLp+*4A^hMLkrePoSJ8SLO zF*Dj!_pUXor3D1GNuczMqZXZH*?a-bUW{ zDCU{2R8Al3-&fJO74N#0Tm{&>FfnmicxJDuwvg2YO^w=bJS*!!f-p4ARj&7uaX0)( zx^CemM^21L%|>l7v5SUM;&0@_pf*D^15+Tdq5LPkW~c~f{GDE#FcPchi6&a(xE^#0 zkc^a6-Ovlt=ASN^kQ8G9Oqd~J7Rhs@d`Y_ac--&3T;=`w;Q|3mY>jYyYpz6n(it8f^vgGRN=wMr(;f2(&oF!U&gFR0eYiE>FY5>l+F{!q86%QXA+YJ&e zFQOB{|LunF?e}{9-Y1ZeZ9{Ihu$Qy$5JM$^_IQmt5c>rv<7?A_Nh2U>j8hyt5=Ce5 zExNQ*E#N2B_NJfMbdxX_9D|^08IYxLp1g?<{#qm`+6fXLRkdXU9*A4uNglJT@owU5 z|1cuN&VLxO5zI`{Jt*K9ck?-u&>r**X&%7jfVDNFKt8?=uCwoaxgl8z+GejXhz}U!}pjUjqmmE{<7xJxUL~)&vTWroo{HG^Lo1dAr-sHBX}Kx_XK)5Dq*>v-jtMr_G3osrlq&AZFfvQNH7(KEW9}N zaKtjfYSgbtr7_+U^1AM4$73Ko2nDG<0Jn?; zKx!@iqI&Eho*Bn@2sM=$EF%Lb=VuH+D^SaN?((q8 z5t4|;?a)!W1p(~+iA`W%wQ4%=NulYIGJ{`mm+pxCcUtIufaNYwmrBoIq>n7^xhn6Q zP|-T!a2X6GXF^W3;a35n0BFc+W?0r-WpwCY?u%?wcce_SEWDNZS`m2-G>#2$)L`fVTSeDhOx4+$ zv%1n)ik^7T_<-2~hY6A7=@7-gX=`^ua;7*)$#7Ra-v8 zj_|zsGQNaMK7lP=?$gVtGd~DeEUwESc zbUU4t>P296pEC<*cw8IXze(UP1Pm0 zY7hKGC9&?ITp!61`B0HrtzC|!(i)8cR-2; zUm?vv@yYJMWG{&k@xRYoB>a2&Y;^pr(kj+_5g^AKJ@@rj1BXDX(Tv5vaGz$=^~Gq{ zf1O;EL2EiXjiuzQMBOF9mQIX{x4>v6K!=k6i^Go?hKBm3Jxo(lJJT-;l9-F3<+sj* z$J3E1(z8m#43fL?euYr+uWvDWHqWAxGC6w`7a5h;2?oPcu3x#^g6r~Yc@TTGch1GX z13O)btx=BU76l~+6Uo0N6DQV58si&FzVVzA$V`=8;J*-MdNxJaKUS8JLYhR_rTDt?1IS$NR`x2l;Sf-jjN($YmU+9H(`lK`ikdZ3ZQa{x~5J`$yT8=qEq zOvE6xDw3;c_=S)9^T32MW`y3UF6cJ=+<-h+HA3`r7FE(XtpcxH{`;J%95m_gx1^0c zI&TY)iar*aW51sW)gtI&QFfDfMmTx&@_Mssz$JRvbq#ZKgMK{k{^?fde?4v2wyckV z$82zV^&n=*nZ9nG;~7pKoks2VZl){{r3*pq4heFH%fm&_2}2ogp@@=Oh&T%m`NJ4y z*~T~=?>b+S4(iVouB)Z|Thvbx=4UC*a~Wc&SunC&Q;(f$etd|;a2=!1-El38i4Y-! zvUQ7P7)5J*`$Q%tbcFQAA~A*a$33z z=m_P=6K$CAM!^($^>yh?FRCpBOznn@SW~{-^Q{4;tr9>@DBLcW%`nJl+x~T!MQTd5 z=#x74T3l{dv!y?3bC_95{cy4F^1;!rv#FEv|UOPhK?b7(hP3lO8%2^OZ|7(tA3 zd?-Gx(BbqT>-q5Ma#KO+jM+i0-R15(VkDbZ-38oD6*84O zkPrcixDfVOG)Ownl&OaT!sV4uDU>pG1mG|8W5ss{4wMN_kc38vg*P--i+PN`g0Eg^ zSv_1TOTNOPlD|QH%@@OY!)DTQ?6U$?#R#ntFYcUCWDDQZi3>o7V3R(m&vrcv&~Y-W zm>7%(U@pkILee7)3@!~ikH$Qz1?4Q2mNEd@VXYMLHe0*ROREKH&ybDNYtH26DM+p{ zWl5WwOTlku&&Gl-;|KFe>nDDf(M`zbp4f+1<*>(A%WB3$w1*)0p|a_bHh1HOFr;FE zK-nD6*3Z*BY@)sDlkO6aMkcTJ7h8jeR>e>wvwSu_Hv-c{TK!h6C{a0$u|K0*k{#M9 zR(P{sp`n9!!qZPtqUn{t&Cq0z_R;qsSBoF&=V0Quv@X_zv(`n5X#@`1JBtGGtqz@0 z+Y#YjLB3XWXk4B;8;GcPo(jgot#H;|`Yq~a6N(FrKF~?P3ru+Mgr=+v!zo}@%FlXv zH#I9ZO8FN@uh$8m&N@6P&*YZI8ocQ@af#}p3?x}3n@|Mzc)4UbHu(B2<$j?%r;zDiu)a9jj={lq(i^HrBO4Sw-}WwElD`_E<04)z zI_lg+wS9>&+`}xDzN(02!qYvcF}Fl{uodZUnAd;rzCZQoI32e_m~?#MGmX(hdE`o; z>CX$Z4fS-I2Bl{}Z*W`JnG%Nr+u=`z=3Bsz%av0w4?wmfxETR9+XP}B*dI&-KakWo zLsm9e)3jopOqpkJOxv5J5}Byzlbb$TqX)~M$dCHz63|{d*lkl|qbzWMTsSq96)I`s zhoT276zbQKTIf6^zq4Ri6r5>88%Zve%o2aLnnR`+sg%vR@^D7_3h2dfL40rtriCnf zFL~aX(jn7ytOT-o?18I1(Ux0k=ZfoK8QvFOOF5}>BE=?0<;B9t=$r(#ua^8*oXLjO z74{dpm-TIl7Zl&Cb^a!fu|)!l++m;sYX|YSp&LtAmIGr(k{s5H%_d=8OnKfE*l0(# zOc55Q&kCjA9>R^*V$KPF6~jbz6pbH^O0MQKaa;IKd)0o}@9P);;v=W4l}ZB784^^1 z(})Rp#ehxSIKebd!87gkD;6Sz0H+}H6x#0mn(9t`c4HdjZVmQNdk+dn7}xOF2uT(H zG6)&_!p(vV+F?P&mP_K{ZbeC01$7rY<~zhP28-`IQ5EtI*8mDvi)S$bAYNa?z>ZAY zflc6Ix$cr_>(N+1vf9Hi)R5N@7eoLD1KIe2{Wi;nafYw2WHG!hkC96UiJQR1xva(r zJ7H-EiuSU)_k2IHxv#t`+K!gpMddL0B(+B@PMdWdfJf{oH64MhF#vBoOfIoVZZwUc z2NqW>z$(Bpe}VgBrmuc5&I>BO_EBr#73IAnGAk{hPj_21p;+3ZresRR{eIc(mHtj1 z&y%Aa7<`Q>eq?f2W_h};ZOW@rKoH=wnai3qE_a>#abpN&OOpo(S^-zWRr_7kRsge` zBp{^slOAK{>Ct7xndh2?9$0$a%{V|xnmgqw;Q|5hq8+(q;PgZinPO$G72;r?`>4Ts zuaOZlMgPVGE$Mh30@=ysDE}eN`FdZ~gniSFQTYT2>B06YP#+84B?Q^JORk9jeZ=%Q zr!vifvuAPMlsc{Bo(35OO-Do;!RM6SC`M{AE7yCoFP&*O#I#Y5#zie~pw<^j-$=3% z{N?lcq6E)VJNVk5%f9{?gz2$yS~RyNGwac(KnkSgHK_|q^Qzwhj0L_9M@Jo0v2 z#*mr}VdsKAhw*sF@p$F5-`hBYOP#8>2Ihw8aot;hOe;qP^SAnKb(l4%_(1D%)j-d1 z4P!uJs>oJrI9PgnOPChzh+0}Vvs5qEGK7*YkTApOp7K_UJR77)2l+PVCQST^*G}ah z_)um234zdxXzO=jdMB!?^fOQN1hMeWa?(lLT>8Ne>DDB@cHg~7bw$Ahv%Opzsvf)3 zTH9I$j1NEXTA1J9?_M#F%<|vOG(^ezDW>JT&n;sB0_N;>f$FDbO>rVysCy%a>|3eh698=inGkS476+Hgtv*o9zf4 z*oPGBC+tEFMC{AbylGs?rnPxTc`+E3-Yt!%b7`B0!Cu%G;L$fdIJV6!jqeIaxqFO+ zpqm+6v@Z~*#ODRtCk0qofiKl`wZj=FmI};7M+R3|RfOseD7*&BS#8@x^EtldxuzWx zw-R@!jzI#g>c*7Tz_<$w6Sv*+g}Y30fjv+O7tK*aTTJu5*<6#MsxY`6k6R@&dFj!c z*I`p)oJz6KSyd?YK4WsvEL=#ru3l|*d12&8rNQbHv4WkopKmOKf-rXD_p5v7*8f}jd?stodqtkCPf)?|2k+WWUc(9XuUd1S}ybB z^uaiTLwBjuDD*2-LI+LInm)v&Mo!xa?KLrcs$*9UcrxO($caK=oWx>Xmm4xKb&k>^ z3dL$}dP6o@Sk2F_cCB8C7C?N8V_8@WGas$jA~m$e_`9s;p7~Oj)wM;u0jP{5AZMm*IJb;+~b;_ofuh2|i^W><6<7yZvl^&l3i{Z*9_!%)?7mGv=om2RU7CWka#sTDOJfRA50~?SSN_JG# zmCJl3^o%KUAsxQ ztp8Gw^Vc=nJ#9;u@(+A3$hfYc;jLbytDX8*h5zhtIbN@5F?=8B{@&nmKTkRQ=NM{e z!_Ul>Q$^(xOA83t(0XB`fz~%+uo&SLrBRQPVM1YYavpN%d^ubc(?oL;QB**4K0sH( zXk{jRMJ=hpQWC@tJbH@o&r(F>;Nb{+=Io*jfe+4Z8>8_Ijm^p&6{dIhV?ci%Yx8c> zS(^Wh0(S9l1sHp*d>idwvz$dpByk%W{wFLzWoP1VzG86@v7jrFjirB;d5T+vSstvU z;4iRL5~TB(Y8gIxq{>=mcQun)FzDNsDi^Cs6@WQU)x@G;7G$@h;T2psO~&-S?_kS< z9n9@nnZPFlEr&LVT&DEXox3RGY0F_hys%FwI5)7_0OZyYDIxKNPJtMn+RtFE3Xfv4{jxS0M;*fTU(Q z@74NmC4eqx5|4g;jIdeS{?Q zz!)_$B%DD6dr79x6aDGp_aNILkN}2HFX#TCrN(z^!}L9uVID0jyw3j5QViZ&-A)G! z^Hq0#a&ajsC(|zm7H(su5-|$N0cv?QJA^w_)A6HT9SK+4RKh z3bHU|=zgU^?KGF=A#Dq`C1n{l%G8`Sf~A10{rRh{oJ%iHBZOw83GHcV(0Q!;i~^?$ zc#yb2*gM34eb4IC(DQ_6$gajh7@^|{nB3FYE~3l~;#Pr2TptDIVL?Duntr5>bgkzk zz2j>A6WqAa^atn+tnp12kUuA;|7$xSB=Z=v`gmoadg^Qp1YtHjw^=u6X8!khW;27b zRT{^6M54V%vn03|=4_m0@o7&~Ee4pw{mV_Obew?lZ9#|zob*DsO=00(A1$^HyLR7W zBnJcrru4zWV@sS2X7Sh(*Nh#;gddEe9WZ8+L2%$N$n&xEF3K`ZzZ7aQh3E)iz15$W z8}$9JM#gH}Qnnk^m9O*`BzX*3uj39Fy|;`93^Y%C6X~UY$&3wof^+ zGpT&ilFXmrP8cS3!N%t+5g_M$o~(}g=l^Qb>-0eTT>-C7HB9^vIF*C z7-Vi%A46xq3n&Sp_mhQKb)4Oi(V=vKP2TXPt9!=HXylCL($uhTsr4^=Byhx5o$fyz zjxYN?7N6@F)M%Wr0S4HZ4f{wgZx)Il))=lDR4X5#9X2uucgw1P`i6{9EK?zJpaXe&cN^ zg4>Bmf`;)~Hf3PZM|;bQ8Yp506)aKLjHm)BqJ}WQiVl~kZg^n$xzuZKByj`9>y?m! zsBY+7_&GBq4`tj4zUiJtio^kdY{K_BYXLB14Phr68uj0Aag4B*d!kF0F=mJ??ajl# zf4xo#*y8~S;!MMkaS%@$B+PhP@~SFgnTaF#Jc~Lks;wC>L0@0-C*mo~qqv=WfzzYu za+1kVlVOrMjY5`MP=rcQ;0zzW9yOSyqOZ61YIw#?Z;MrbhMi9eg>{0%qSJX~@3{=@ zsS_)ax~C}7H*OE~gE4UbN$DUC`)&#jqY>^52RqLZ_sOk<4t6U%SbFa&Zv$H~9vqxt z-Z)@`kVCtYh-ZYOdI?NnAUIMn=l||~M^&87;QX!zAw+$VpA`pA+airCJZ$*Z1Z#b% zy1(k$wY}4351>hvo{UkZ5zv)b*{pm0YSIs!NS8$4$%0^N$SsM~d#TeG)Hz&&<<45| zcaxNDu)j=CvE6jCl*=M6imVIMX1ZP&Y7N`S+6Z>3P|uwWE-B$7N|0j8kxodpDD7X< zo!gMU@$K13oOEVAyD@$u&%LF`aAz}ynzrCUA5q7LypV3JvL@pWW?O6R{5!an*8Z_4 zZok0Be`*crT0~;9&RFko+*h!QnyhBKudW9dtdpMZK~(xQFAmiHc+iWoSczSXvk;Lj zm>$vl`XLbe(_K+{;r`&0?H!Dp1ZZI&nnw;vdhvo-MZC6%9G$1TyQ?^){3S)8A;>vHR z+?1j0N~ahC-dkF2`BmQcyP@7Y!0OIoxnaHR5PR!vPn)C=VK$n?(&Um`P26W_IaLJU zj4iHo(-)`F^>d4_2?`?SIwfDhf=9ACNPw;Hx*ET#0zpftph2Hl%EA*c1pB(?i z;IAR&JEP9ux)aL7aqC?b9KPiU7NV&O%+<7M%vPWEC4EN-HViG7DdCL`hjkEWM!5>T zp$sANE=EJ+6ghYJ^B0>d{sf%%AJgOTGBi2iCNRcBw(3B!4@%2Su1`nUkgUmO4&pML zw_2-17`?|Tmm?H;$EPY9IXie}wjXP8UFCWs18kBwavT(TtIkA+n-XgLxLlYt4KG^< ziWy^6CSSZH-+x5mbJ&z8GXi+&i(e-N1>kw4f7=W%i)v>6ZSQ^;sN+qlB=aJbjD0>c z026=7_+l~oZ2+)FY`wb>x+_r6y$L>LxouDB&Szem$YS!IxG8#k4V0o-G6gEFqw|Ue zjm4?ODw`2eGG_~YBg{k5N#N8YN2k)$^*;N1qumYM1nc{e} zX4kMdJsm%|-TRw0Zkc7a9W;Hhy*vUk`*^m`xta|VxHiYa{5=UdQAZ(xHl5qyj;WA~ z;H3g{ary0g-r)1o{`}-pO%!cMDwdq8*@5MwSf&+N*6*&28!z(orDdsK9H^_XMz;d& zfOU{mC@u}g%#1<1thiknE6+%;&Iq99{kbG+S_EFQFTch8#x?!@8!S!Lxe-xQvxCRI z_9xJ?7y@(r6aUn&nWYCZmPm@T)0@Xsv?8i)&mrrJ#dzqToSsP-pmlt9>{1Q#Ke{x& z(=6;}Y1{=^Vr(quVa=^5ne$ZB?v1-7Dh))FW8v9;uT4UDPrXeqJiihDt})4Mclmui z%Ff^AHS;a96BtqVmO6)%Ofa~|6tj-MA6z1MD(iVs^st4$P#ReFZ-lYf=2f|c&)!oc zR4<{n@EwF1cqi=rlxkE!IVE?@(4*nnUmcPXGHD3na5+wGMo{zUX84%EZyH^gqq_Jk zH}9*-*kjJA6OCNh>R9YDF&~q1=c=W>uN22 zY}(LrYWBL&TTUC%{G&zQip7BFXG401{l*1D$6oLBSdbSk+gloa<<5QiT`1dXvZz?l z%TrTBV_r7fR=--`E$3=Wc+3J+HOK~Ov92t}e}@|OZg==aLt$O4tY8zidIFFX`&I{PEl~jRv7OkwvP!CE=wlN2RcUc3NpW1h4KS^~g z?Kl|_I$p?ea$w+`bS<6CkMz}|WWn-e6$QtdO3`aUxXt}J#244t4aHsBH~q!(RIL2y z<+$ zCDUSgEc&)ee!^)}Krwd_s-4y<`l=M|!aPAmt^*#=D!HYrJ<*Cy$8DU1_`CL0{9y0s z_WiNpwtsq=;I{y4dTiFhOJ>FJH*=U4CSNNBerBf0?UVEklCDU$Za;O$)+lVhU>aS9M z^7+2_ZD?%Y7PW7tVeNKq zHF(=0oZ4ScoGha%nG>Zz5mAm1@Tr!3O<^ z(*US4D|DK*&$VB-athfR#>Oxv%%$SVl>n3EcLg`(U(F~_lp2MA;?gmk+GA#`x1p2o zo7>e^@1L@=vSvTMyxh;v4vwp@!-tM5->=V)wE+TUxLxams_%YpSCX_hakLRn>DmX>3unB226McZ9$x& zElX78PDhF}V9&0XgG6BwMiDz+%kzsh0{%MqQ$C#4$n3!I^W&*m99~iE@19i}y+ly( zY`gvV9w|Jo&tj(1T#<%8u}eV&tNoo*lhja~42)(Y6IULu|5Mo5GFzqcQ1i>m^H|v& zMPfWJ4eBIz>QAm-Z9&S#BOYBv3F9eh$fV&yz&0WQ-uiy3`Adj#Zz|gp`hPDukiInc zzW8fbVJgnr!NvWv&QO%J79`toUGXY%dd``>Aumg?Q{J!0;T??wG1^B4ED~SC&zcFH zp5X!>I7+Wrs80Mh@C$tn!CbiK2UcH*fz%9~$Z{++nk=TUDu@!?wFQiV1qwA=s2d-1 zvXIxizBsQjOOx!^0x&PUf2Tns{RG2A{P0W%AbTS?y8x3VMvddI}c z_{Xw&0G0$mqJh|?B5L^JICC6mY)~S}81EpEN)?!8_aE~I9yLx?NRn6ajE-fdj|@ZUNnwga~ zZ*%25KgaP6PAHJZT`4eeE`*DtQ+YM$-|u>E7FZ49t*iJG`J`s8;Oura|Ip8%qGJC= zt>QHBe9Gx7PU~-&%tap$!+ z!hcz|sKnkAB`r1#i9q&zu>WD*Wdt{UFP>yif5=nYSG7ux9$SjE^px#ZHhW|i0l^MS zmw{ah7B@|e7`TecmqN4~-C*Ip14NC+TOmfz3x?Ys^jQ`5n=sy(-aI?1h#Rfax}~N%6tGgl|O=iKR45}b03_>u+4PTUm>xJ;F0E)U;H+b z`~Am4E(p}nV-x$L?aZ)VTW++P(K1pB-JBfnDDc3C|* zxS5{zq}lgZRf$m~Bw3FKU_!I}91JKMBHfuOmJa)tdb)hIa(84)Zo5miQtzPCjz`;` zP`NLgYA%mup4{U^U_~uo|(B=<_w; zKIV%H$)6W!>3s#5q0hJ8S4L3t&orTj98i(ZGSEAZ;1PdqrngbK-^i|lwmlBu#-AcY zXQb52$dZDQ#v4LYg2=URAYkG@hLKC=)qh;ifPE53l?l&Y4jezM)?P5;74kcSd4aBm zqWZ!+K3D`O$K+2tvYU}nwO2V+?TbnZwBoJ_zC6w>>GE1o)pqDmW45|(QS2RcTAgCy~I3sZQU$?8<{;{L0)uuWPgZ`*1WkeaasWNoJ zX3{R$M~SPvU$)WyflTqncsMS=-JB5G+7RBW|QEBk$}Lu6tHL%QXgT(f2jBN5nE=G6K}N6!z(3n= z2q5x^S0x<_Qnn+GGME{_fY97<4ouQ;S8&Cy10y z2z);)%cwrv*>U@lNMy{aa6~|Kl39vK{W_H? z;U1WT9xH*IdJw@KFebIsmm8-!KE2u~lcxeU(p;@Vf0-eB4 zqbBqSxjUs)^qi}RpsHkp9RhDVWEA7z;%Q9$9dTU0)uWOEoBmJmehEsS<Vi$J_iuw7W zAgPQ@8p0aeKyBIy{c!mEzZL+uA?fWJzVaMqk|NF@`5O@}L*F`7_EOADEh-=JH`b_< z+-r_RWqW+)kG4rmk8EVgSPt^hbIqm{12C4WC4b95_}rH$mf*JY8lxK)mYM(VI`c96 z_lpXPd8s8 z?vX0cCI|#8?giUiJlROB=nL7wOLXqX+_(Iw^ZOj4*A5|6uir zfsU)&ja44(vOu_GZoU+v;|meFQr+_J?42zbgj$$|sY~;WFm@E9Y8({G4>9xfBlbDI z7SBT*SylzxWKZdYNu$sBRiPW$(t|IkLo1Iu=aP6m|lN<0&~4&dW>i?Qw6;BaynL zIsM!&`i=bU9hwPF72Ci40YlCeObQE`l`IjJ*UBElkb$L-)K%Wgy)AUSo(!>XQP!O| z4bY~ih=hZyk>n&!DS_+VCH#XkHs>|00Zsnry&iPi zA{4OA&QK^aW%@xo2{ANlP>=~t$mgU|FBc4&Y)Uq6LqjKQ;iMG3ZFYlBw9Qy_#Gq!5 z_l-KEDFex%_o*-Af&!#Z@~E!OzFO-p0T}HZ79*K1yv5fJEgrFa+Hq;w$CpBU2{BBO z^!5+fwQQfEkaiMh64IM!xXiKdmzKK0z)bbCE*&4Ed~V$2PDLJ4S+Gy+gU3r zDqrMC`5`Lfsgqk6Z)w0(o<&h)SEQj((bjq7&LDNS;m-}F##cEZv_ooe1WHm=1d3?6 zB(dK&n{fI*&9{Shdwxa49+~`&rA8zA?ARlr#!yw?2`UNqN4v7Pvt%+M6q@;P?FHq^ zbF2o-o%)yo5LyQaZixq|hAi(`-i4I#^||R^+N$m`P3=3B&xQW3bM*gN=OEYv*Evf3 zgHbum zy$$>Vu`f;yJL*CUH|jzIKiWWzFxs66wV(C{+BAcdLOnppolCD-gDf_sSe9sGmP@@% z$UXN4Fb;V;2?teAFI9knXe!x$nd?Y2Q{f8y1$X!Z@U?(`g@RzBPpSx*`l&>58nRKO zg~lf1K)xF1K!lPb5OT;hDJ9hRveK1Z3(TQ!5T0%n-(^+g62ub`+|L3iX1jJqkUt-W zZo@TJ4$w|)$c(>Dx9!Arf(wYA6>0pSc0r&`20eXES6$~$SzYse0;}D=zeX$wUmX*0 z;G5=!_Xj0Y_AH1d{@OV)iSVHVQr%dpdh(w5B~n)7T7ej028P_8cEBO|Ch0E*jrD0b zrerb$HtVS_zmm^J(ibu$1U;JS5ZgbW0*4Ui*k{^)c-K(94HZ1ecVK9z{oJRb6?8YDZz zg7`&)N)}j{xXD+*8o|Gq48)+wlWOiqKn#lZZwv~W3f_(HQsaoe9B1q)fqs;Gj6_hB zI$Z>kimr+i+|*jwmICz-0($V{WSjPB?h=cS-)Y+V8_##7b%7&yDguY9eI1WhG%tO} zBeqhUnT5saS%&Ev&Wx#mX|>gpneY8kTQb)T1E>&1J>}*lLW2&AdLZa$wbb7; zb4gaJAweI;y)MtC>b8mMP|7L}6}ewixze}%Qr%Cfu+eFI-#J}dS*rFiHz(G4n*4!1 z`gfRO%eE)YIb)mek)GOoKd1>yGnMO~FQqt_0y+yE_g<%m2?VX$>ol_M)PI1wPi{ zMMiXX3nj8L%Y>;Bg*$Pr=dbs%n!4n+7CT4gPi_UP74p_Xk2C!4-v8EXe%4iSz4y02S1*~$ia<6HTn2J|v9r0T7#lRSprDRY~| zIp1RE?b=JJgNA2H-qkCQk%!z*6!V5VfG+jq))L>U;7D?b_!VD9gM8mZge$GROH~UaKi^H1Y5Y;K*ZFl6<^5pB6uN`d@(JId zXZ(E+aI%ckJb5|N-Vhuq_WmJfD2ijfVB_y*$UGn&3V(V>E_f-hQYGm`wUFIgfFl7K zT38$ZVlDZ?<{;ibqnr2Z+Ho6xE8nSQzkI>xV=n8|4<{JV2D`J8wpGoei4><(4(v?5i3WS^ze9ft zIN}8pSs*z$)CMBEhc>yzi|exoMaP;S2gJfOe;Dx>f9S{JrB}?n5X;RF%PFXM!bXFI zvhn}V?-;Ri(e&&T2L{2yleILSnB-!Mad95S{^z_(G`=v}F(uny!n@DKk{Ff~C)gh? z1&Lr%A`D>JLl!j0d_43s;wA?~X`^^kjs$5u43bPY6Uf?>W_N>4Jrz4($FN7`v^4%E zg*6PmKclWjQcDp z{o@ChI{0^T+2p*n1;<6LS4ztEMk!nJ$et%JK`u>&u{1xzy{ijr(Zw#yc2l8RDTma6M5IJx$s^%{5lRIJr6SK*%C7R|={IgzdF zg0w5k@D`1sn>1~>ONX?_h3Nrk!6!l5=ed}?r9%e|xRTU1OH|KK$$8^JHF->)oPRL}SD( zE=@$o6M~;R5fIxWfktu6CR+8w+hGg=zl|x$*{*km_qN8v0s_BJlZRlBh}Qt6k>A>E zf3$v&%pVF)7fcGk_GgI#zs_wha$!lW^H7Rv z)p<*FmTRvgbuYPIgtEZZL<(&pezctdD5QAAV$+V-h6kT}P*0oM+1rf~UzU;n(sNdhmm<{I())h4V2r z87*P+H!H|)oC;Q=BfgWNRLQNQUbqxRq17tJ5YxUC4YGcSr~)r^T-W7$+v*pIy0p)= zB+6AAMP88v@8Pkq=DvWg6JJ)>;>W3`Y=No+NRJ71nJ2F*Yv1Q;!HciU1y#B|jw?K3 zY!h@Qw#X`c%=xd_<#cIEz;)|= zubxuQ2^)!TlabKgelIb-F z=+Z{Jzj^USuo{=9vw~}NpJd{PqMxkB*BmAOf`*W3GY*fV0Xw$0YiRTOp)7fYBUNJL z(}jvY5NPT2nB~o2wcEo|JD~)FOt>zfE<>`@Sy*LjL1{DE3meQYG>@d`>}Lia;13H* zKQgKUP(z(xEFYQ{#%s(mhGJ(05C1qF)*v$w`7XES0t3UE_(%%>6DET7w!7cH=PDlk z3_OaJunV87cT8tj43dwlw~};p|6;V>X3_EWxI_~qDm;!EMq>cvvsm02D|D!pqnR)_ zAD@I{u0XdeIe?3_P6!z>%jcjE&sIF+KOxX>X-|xScM0Abdt|6B z8me~_GwhJXr{dJoaNHCfiEk;uE4c9!>*z@gS}j2-ghSv#QYf!7mKAdwYL<*9jUiq3 zSP~Zh$kwxQnIA=erXsf3i4Z@+w+->-;Nym|1%zWA4BW*#tl+4>&j%LpYV8Tz{ATUx z&NgW=Jm4cQHpy>nEI>$es17}YVmhfeow+s3Y!Hbo++-_!L5!W&q3F$-Ie8>GzM0+{ zG|S>qbR8X*HWQuJhLO}VIJFtFtPq;@y!%d2ZuV>J>yO;FiQtRi{O5D7bR9)^qU1w+ z%XEm~xinSSjAJ^1l%e*QC3fcLMiYi#Ba`OLR5?Slk(j}grpfM*JZdsg-vvd)X(dh2 zWAeG{AR_sVR@hydi!TV8h2=ZbDHCAJ7kh4SA00?3^Yfjl@57YrBx(p{R`P%AQzfsv zB$(fvNHp`;Q+zeBiIiTICAZdi<{qyg)FVKBjDK%P1{(}-iY0+=`b=n%hvgIlXSJH` zU9_wAuq~PyMSU;#A9DEc8d2}Ly@zRs?kT`6xot(?DyD<>m38ewen|}yILwXVJ~l!6 zUr$LUgb5q;fo~`RA1UQAH$RTvUAW=gAHy^_i*~+wq?QJFJLJQ&Z{Arbm&tSzV&n(^ zUWml*hRCK?%0gkxqfE9Tw-softk#ZuG$n>F8mrLgA?@MyRPeL-d^}ZC19!rmJHL|G z@9Aq-vW_6m7PBAR>XYlPjH^~ok?lfi>D< zlr>xps{B7(`^0EDc;-881Q|pWnBifzS>)!1BQ0X&5hp)4u~<-X+&#odzr-DpIzwnH ziBa-p&k3OX8f79u7GhY>6=L&Jf`BbwZ?=Re2y<`Y2?hAV*M;g@18_uX064UMu!sif zWNuL&UTLo$xxA=66ap^Vaux)#n#NaPsH6jJD8zpg@XQcl75sTb*ec0H-UcQQgV7sjY_G)G47ZvMgtE@s zw}=hJT2raZqiA}m4}RKtiMz8^A+n1P?3|`W3F>z{_0#M(WD6Cge`v`Y%@rN5*eEPL zNN3z%m^%Yg8EIYXisD{w_z8KhJ_X8I6Kmh5$;xICT{9sEo`S8WB9>}K7D+8lU!Qm@&Q z4Rcc(Uct_r$&A`gMD6b4MWqqJQ{wezR>&9HLwRvoJdaG3=*oy9 z=DrYl>%Ip6N~B!WG%fV?XN0`*;*k# z1vZR#PWscmij0m_C2ScN;oD8uATM?kdcJ!(-_R7i+I~RFmM6Ew>T~HmOvK zHKnQ2uvC?dux0GN2Ekl{)B;3Zr!LcWi&@Q`Vb&It*_2O@krLcBdj^9II8SuT%f08cdQgix20MD zkB7##IUEkTyM8_ztBOGmu|(z?h;4cLkW6=D%x_Jz`eQ$?JaW`e+8Wu?S44o4;n2tQ zL8{&8kLl=jxjAw~WS5ILc=Dmxf46N66cvq)f|}JLf?%K-*a~ZffMRhSQg-7&{N1=P{(Q z){Gq4vbP2kpROzA$Fn*<;=3a-U5}xW* zfVN+xrIH3KG>Nqljx4CeL*JMS)WdG85>@HX{d9Zmc^FQL?c46&>%4{_IWx`QTACqs z&lc34n=L{#=@HgUUKpv$2UyIt*{%L8;7hH%WcqjRKTA?%s-iGQAX2a(mrg-+bG7Ox|iB=Y^EZ zA8s&n1*kG6+ri}dx`1E&W}0Z5#io8Je(~c{1j8)7Rp1j9iOL(xce5r6OSVx~6OH}q zLEFY9XU#PDrR*o3&=o?rZ^HosQtqH3Nuv(Pdib>_DZQBDZ-ms398Q~um>xM_6=ia3 zR87p{QAvsDO0ji}HQg0Lw*!w&aD11I3|AP$Gxls-boSX94J)gso0FAs6n24Ll@EkX zg9$=Z?Ay_=ZckcWMDPfGlJvJ9qe1!dn&?kksut5@)KB*MV;vmVFhd4|ha9h_IrN zEkiwro0L4LuHKQ`WHk#j4$p+&k*$3PDcE6f3!_A5yOUB%M-QbtiJ*c4eGMsX46m10 z@h9LeW~*#WhTI-qV;^~cRKOp+(V!1G9>X^urG<51pllKDAJ9SoF5j0Vw4d7=R1b}z zEHQNpaKG$O^U<&#hVJHiP!-GAvyE!W21PZOoxsy%>W|=O$T8|YP?cq)hUS`Zq)aN( zV%SYvrr1$hj44jYPsgt(yQR{3vz<+*G3g0=xp~V!yZ<1cvuVS7^Mt1Nz%hBL0xgQW zv6xy6l?dbnG^jATbkEV)Gno$D047~CgOC3qU~^cB**#Kv1^NJbim5o*Vry+C5()yXsgsPu?tiLZqo5R+a7UvYd_mk-o@9I#X%<%N_& z=Gso5-c-MqQAHOZ{pds*ma=UeITZRPpX4qfO&>F+Q4Rs2zcFR>CCDV=R9;QPx6wNc zTSwFxM2L0W$d$79&Rd76CEFxX|lb8{wvmjRzeDgz+Uyq$yW&=M3eGTl`a!nIfbQ z8|5D@);MyfC?edclgg9DgCQJj6Pso~E5_=>Bj!x!?24kb!~@FzNljK4>gy=3aIW{p z1qI86>(6pt^)%Fwedv9gs++tJ`a}MiyBFlFPQaKqH0Q5r4-gzV>_hP`;$m#wkDjIv zU|l4DNqGZUkl11WKnw%prQnvY13M?j4^LAY+y6L>E%`zK?{zWCPsTMf zhlp%9ti0hS8!Yv3`#C zZR^fUyPT|1wKx?yJd{`J=Ld7Ng6_Nzy3}Jdu!7mbe2qxW83Nx0lNrfKjc90iz_ zw>Ok2M$qKvwA|DjP`~Fg;uMcyEkA9`gTLe=kMA$JNO}|5iTg_~g7|>sq8DEfdGH2E zE`)IYl8e}(888(*Ah~cH{D)i&FydKr0m%h%$X{}CykijnzpX)c>aN(^JlqtIjL!`D z)e!Pp00KZ-NXDkT@)JIaL#frkwL(;4<)z(h1CoA zROz?W_GB7>@=0R9KvfegH6JTP9H?n3NeftF^7!lTb^XZV>IiUD!=*Kx zmJfI<1;lS($CX9Imqt)uuG39Z*W#hFidZbm3eu86BS@coeq z08NB*pYiFC*y0&z%VSiGrs%z+Cz-Ash)#XWgU}tfRIU-4Fe=%!qGpaH%}Jj*bey+_ zR4Fq!P^E)lXxngI>!}i)L!PNSTea5@{t~|i*As%?l@aLj#H{kRF1PkTJuAK1^ba#7 zS>p4yFXI)TV;8S4`wu6C^1mP2#9Rrel2dbz6V31!^fP7{^T3EXk&K}lkHPpLzdRj2 z-4#jRUGaTowY+Q#h>FGBDzoFDGBW5ghhk2Fb+T9`h_o zSdIRZeEavLz%QD499c^^_jjf{O;}6{6w8$#2Y~k73d7HcJF%!Q%CkKtAS;2}G*(3l z1QHNlxOhl<6R5y~_GyPs*Pk%T#P((LGTC&sF_$=C(_Ku|lu#}TQUhpra|DHHkN@b$b0TLI9eCzPlj2|Coe-Uhd@#-H95(OrqT1W=JO~ z4|N9^TxugtZ{UkjaYx-_i=_;jj*taVO`G(~&R0lW3=4Z$14lw!{>3@i<)XzCutx zU4K&=i{{EZ++O3cSr1L*dcxMCLG!Ym7cl3s{#Livj9Of;;Hs-~utwv4A?pZ3eu|jq zwkZ?a;k{msh)|e$8Hb3IMek9Gp4I9UMz}U!Q_B0AlMi)zjd0w^yaK$4%HQP}zw47PGaKziYbxtRCng?Fei%?b$u3ge5^SAm zix4(wejNbD4iStK|A`%{KI4SX4sNmZbu-KYV}~p48=i)~OlDb4%xc=;Rb|UQ+u-1& zD~B<7S$>a~t}7=elD*A|4xX)~_74&t88G&ZYMNdDkp>gt6JVTER`G9x_scxM8)i2ryHABom`|+Tz(8B)165v6Rihd_@?h(D0)RT7o1T&Mix% ze#pp8?wueql98l}oun!)zqW-Yh8J|$Ny6t$rm!XA`qU#STMWgVMB|cweP8D*9@>S} zp(P31vMLIrycRkeOwgflUs^zFk>J8>(P^G!wKkqFZA5!==_*5G8BtcG*OR9n&2Nr1 z5S=dPkn@J6Ys+oxO2e8w3xeFC1N&grAFv;a>%^%{6}wrDBaz?}9yJNaHRW_7jmF#G zDRgt3=i#!#&um1J*RJjanKJ_!0zQMLtO`n4hR5`VlI`u2I>X6qTwkbrViBt6R4r63 zs?Mo#wS31hbN?Np7ZRMRsC8TKETKAJ&RwX_Acm5o>=+^>kLjo#)hNhA2ax6=v(`1f z68M>eLt9b@osu^GE$zfG0U}zOxqz#q#(W%+Hh7a^bzF4)(dYCNW0D*`BzB%iEa-Pc z`=j%{aeZqKt*y?UqH?)>QEWM}J#2G8tH!j%_-sXN) zNQO8TFt|{NksU-zU@+q2tGtc~Vus9+|Cx^F?_;q;`*N*eG}^`1XR@4=2)Z&U%*!~{ z_IRAx5)5Z*ix)hDYxvV_N>uR-~E@vIZZjNjl5me=nuRV8p~ z=|R0l5#7zsz#RjWlLa1n66zD&8mItFp9?|Bc@}eFs%dv?u@~V z>ke%RQ-I6}40qN&8T*&LOXdqDbkJom($C$^UpK!@*;t-V4VqVi-FZnPIhs5-j#awc z#Y1<-zRrYQ7E{~VHAij7PffWIs@#wIB3mSbAkTTl2TH-TZ|B-2g6r=lA9nIfejs)#vamSUbS5_D9Xscp-| z93CHe`N0mg({&=(cWK}Yq--?&MehGRg;oe3hxfiu3`@Y@qk4N|*-M!C6+=b~s0`Az z4&rtP?PH_(dE-?zF2QB8ONb4tHFOL#AHXR*;@sqyHs7WYt}LU-IQXt92LTP+)u%qEx|LHy4xrIsAd==xhK-T!AH&V^5Zk?QB&Z-%gL+|vs!*)n|HVBlYON}5 zu#?}p!i;dfu;HH2E&q#qtU4h~+;znKn|q8UAxyAxB^r5Jx3JLh@}wAfYGbkf ztp9M2*6e?C55IFiAop;R1#*u|tH0c%Uk&ju_ZYWBoM_;x`GGFEnDB&%KVCzNElNuC4QYr{JWHZ8F+!xn;{SX=OZZ`TF}bUEMM^cdp0B}jhmXTlSV@$RrT z>U%+Qb$bpUiPa&@D^>#!Ja7rm+6rX^LAPS? z5&K%qM_}(QAQ!$$W%IAp)Yxg&J2@iQ*{IT+>OX(e?a{)=i3}QAV!lHZ)4>FWjC=J! zq}PQk7Jrf0^+9*7Hi7!6k(Y*oB&myCs6ilb)u4>%8LTdg`cM`t zRzGP|FS`N>FZ}uz(2pvAvPK`}UbxtY?xG7N{&ViZ4E$v#6#JfM`Z~@!Fb8Q4Y%vX* zBDjsD++6K~5bPMF$i3HCa&1cuL~+CF9pvGn-!4ul-Q=7`wMiNX@Z9fqW24ZxoLz=R zS9L1G|IVf-!$FVnd~mw1ZZFvC1#oMk%}LW5#S~~5yQ)?mV}+A>t4N0~E>wpXXCjM% z_rMX=%>IRBOQ6h4_5y=uO)K0m7fHL-IZDGQ6;~y}=O7>_K`h^W#n0(Nuh3NrQawxR zPterqFdotRGlj#NU)i_3E)u_&>?)dpt)jc^S#m;A-I6+Yx!$N+={|UP;z=+%D`)4 zdr4x(d=30Pu6kiw94`c}&FU&`1J?7)_DD6|S?F1k(SZNvA~+I?!@)fXbd)rhH2RfX zMSnuJLardwz+_pcVNjfJ{Tp_e4*wf=6zwB8@a@@iTAcX;VTa~l*ukQY{vX&e^!wki zV?XZ-2s=2A`XdW*{}^+Fn_M&OQg_xvTWwyda2YziMvp;S#>xIv#yYpx+iz1TJU}iG|$T1 zmEbhUs#zk{SRwyvi42kMg2y8S<;uKOe-7a|J!!9jZ~J|8Pj!A^4M;l{`u;^b4kHT0 z$ETVmzt^9-7?$b`uAJq;=t-RdD>NYTT@}H-gqIQ%y zd4q)V{}>QJD?{3;W&G{v3lh2olpRn=yay!sRDa$S)nU6kr*WM}wuOMU1GZlZ8diSf zx(C1L%Qtf$)L3!>72%^foDN1@TIeycLrau9D|%z&ec1hGA@NeXti&nwm5=H`_#N!b zit4AQsJQO-`=nVxzPC z_xbsMNIAv5{tI{fBL0gzf<2inTT;wYtnWKhwCYSv!xd0`;)|_nVh@t!FtjNGlGPm# z#+uIU$>LK1`AU3d8Zzr8LNyj6Rm%g+yi^9U6gDVX!mDQqce(VWq9s3|2m&SHmc>$P zhqL!7f-82`i;&<_b6ypP^x2v>v8_}Ds)#Iii| zky5{k_!mczBFX-OJzTG^k4(D{39^6+|=-ecva`Z$w$6;ooylj6ntD&x$ zOBXT?AE~8rzq3^-XoM6n-T5M_1J+ufHj%YIs{oAaZ-w9V;Hz7FM@%@+rN^7drDnN? z(%A(nSHPEA?H4aW7ww>7`=Gbtx|Lx~)d=_gysYKfMX4+#dgx5Xa{hd;%k$b|QS6=@ zpiq^hd4Fp6{6&TD|E}n9m&oC|DQN(lrvIueF;ezA<{_8Z*|cDp*k3`hDVPZaui?40 zTaq6G4vuI^mfH2oM~>$_&W&)A{=XoP{rdGjqXe?t7s@BX~JzlX*CmhS`|Bg3_!L8>91&Ct2f!J)y$4&CZT#5UBS7Sj7^sXeuh> zN#EUNQ|>vbk2Uy#C0Qz6wV_VBnP-+%<95VG3Er&zg0@N-7 zU)3!45*#7;M&Y?mFmhC9QD z<HPBEOQNwyd%@-a6ZKN>9FB;`4{`=es-c8$*)hIh_x z+$VU8#MEP5jOM3EUGJw=oD^ZtOH=Jvih^vJE#kaIyT|g5o_| zWS+xZXq;2Gn=*S{B&EFay(Fd0AG#eq&t#XiWXbig&ct>&Y1({4O<_(o@pT9uv*njA#3lSX z3D6eezJJWgFYBC@$v&JloQGFZq^55wsN96y$lxCg|1$7wx2a}c z3cH+=S&TjTOb7S%jC4c)&ecHXQd~b>tZjsZW-J+=-oSZ2{Fph(8S$6@d^x-VToY7v^*)KvQBysYve&G$kQ#e@#il<~Kokpeb3# zlw0sBJ`^Ec44&arFb`pYFK(Y7bGKg^6>GEGV2cBb$;0l~4Ne(o%yUS+DRJO-5zzS% zmuwH44q*4^_QA%>y3hdsz#vD8$2dpXzN>zCs-O7T4vy`$59vYDfBmhax?RiQUKLr9ig<;c40(n~zUqy{ z%d5o1nSFr#B6IL6_>G3>teGeTpd>hJwqeK_)F@PeO3-r&U%L?>d{B%`JtJd7&5p47 z-MwoeS@w(|+I4h4D?z-jFpx?@<%g8>1v-OrwxUUR5{sy3F>Ka2m~Ym2SyU>2VdgJc z(}_)2o)`&KVdnA<{_UT$JD5H+cE18*kZewqerBoQ)R`GG9LJksHU8p!K(x8Cw84ra z7pad`9_SBJQKQk!e>jG8)RRj)K>I(L5}}d*ni6@pf0+`b=$)efWlFXe|A#55RIwa| zss67i8Tq#<+1&oWnv&=l?B7TKH6>#qFkk;~Oo`Y4(3Cj!7ZE7dJM`iFk-R5)(&{~F zb0Pdw=j!-&rq?Nzr>5>Zy-tb!|Id8C;)>&-NjBmZBhBz)`g zMQ3Clh)UpoSf}PzgS1U*o-maFc(+?MmvtI0zIygk>{lYvBoOt=$YOFdx09+T~M=~H8-C47uh%JPM`jmuroZyooULB8@}h+vD#*dO~}F@Kyn&Ck?*uE5^87&osnYj^ZCL9#2keB5>-4 zO6UF!&;!9gV^y(MygqTa!I?m?ZuV0apgF*kd)pZ4((;nA?hT4WzKO1=X2YtOH@XVg z=w>?_LGwr-TLO=xn=GO4z1B#Lh|{+kNT!riNNqnd7O0O(Hh|H1wVWP&s!px9>I20Y zLmEK_e7L^7Y^_3HnYoVFTXSv=3Pj@J_#D=-DqjU&sCifYtI3?z`7_=8Ik5X<>3z3c zXjU+CtqCp)w|O$44oAZuzorGr?l_aYdjmzWvpJ}-fh99eu-q8b3ITV>{Yx=@Xfub^We2H7O&+eqX$xaW6Ad@}FIMNkf*Skc zcmmGz?1mcqyp`smu+1L**9IP87hpNrq~{1;})^YOsSUA&uZG}Aj1BhK?eN)vY&SU+h@J47&5aDaA zrFYyLN&AqeEG0i`ty=P`>A1->;41Uw;KFoIDduECW%zf+su0)ht5uMhsKJ_j*>Pan zX;0rd)mPc7Xm>idLE!*=GBA&cq~Sk6m$A4{vOTJZa2;yAsi{foz}FipSpU%zhK<^p z!xyUg_z82<9v_h{eyeKx|7hwgW9s<6aE)tmio3hJySux)bAaOR?(XjH2Z!QPIB3xp zcZxe)e*c@B+z)%Nwe}=4lSwAo^5%KDmtWsqwg?(>M?BoRoQ$44AXj64`57##d-Vuh z$^?S4JpL9l)M#d|T?Fjq#w|p25X6cieFt5yZHrg#HKu$NbS$=Ic6iwFwPpwc=BbpMOcFe7BuQ zAy|;K?liMK_>atP$hB;T3loti!9Z!;G2-2WP5}-Zk?p2_OD+Z}ycVmf`z@fCEjWra zBL!N$4&r=lv~T7TqGp4kl&aVca~Meq7khLB9)MI;-0Fw;AEyQXFONAm%D|huuea1( z>$gm47kYSk>Z(~)?`$7=vlAcP1p$~d=Kn-S(vUw8!wCE}H=B&D1gh@#DfS4 z@KC?H+95W%RkE_f(1eB5>FOn`8N>?BaLEoB*P@=lJV>KAy!XNd6FSExKUeM%9FJL8 zV#qQ~`C-fU7uzH%npbzKZ6b?^d8S2>)4%VF#qwBy{xHbdIuC!V$LKX|z9ypXX!#c+K1IVbl=6jV2c$YU%lu^fq7LhcDRj4y68Q0{D>TpiPj7S(R||?^|4(mJ=#ux%;QwLTKW29L zXG1<^LM`B_%;fGu`n^B%{VA`n#DsoXI>Cc8Kf|ICXSCjQAu=X@jL2Dk@^Ya>tkHwQ z=P5niov6vgxwHQGf(2K{nl#7jf;m`~kLS@&hlADm>WBmc@EhdSSPq6ietx+n&Bkx6 z6+HI{Lr=NY@}00+_H1os-#c|oHRq?%J4)MkAFZrh^uT}Ftc+m}fs1(3XZt-e5`g(d zql3$}EMu6}RG24w5eC8XH15Dx;{YnC_PfKdSIO1U{;GhaT`+)MM7Dv9F{vzxe_XSA z$*5r187iWId^HjJXWjdGu&-E-k*=YgA*n-W>POl;d;`x;wenWHLxveLeAL==&!K0m zobj`39Dkx_#($F9b+MJf>7aM*XAEO7UpAoSSF-MpuYC|{RZdWPOsKW(d;7?C&uUQM z<}~x@5hE_ydO@jK9PKAaX_JtihgceMdbT6zqDWQn%pRW#_ErWk*zvn}eQVX$SlxyB zg+3bu9o!6+L$KhPgb;vko=NWw3AR%c;DCul)G9sx;IAaKr?lVsL)fOdW!@`@kv!Fw zs(zvxnm^OLWcRN?)BG3-;JD|R&$$ZVdRS1dMQGG%cF!eD8fD1b)E_x^A-Qwn>;jB+ zJ^_~hion#NVp|euJbXgF&2W%GmbT4PtX^K{`F0Xu<-Y}XYDz1(0I6FPT0-7~f#pR+ ze4P02vtXxpbro9^QQ#487U#ZYvm;-Er2<|nQ*{y2&-c%}8LgQyjo*5PY_p?BinCGu z#o^M829MVv=(Os?CxSrlHC5QY5MV9nwq0jElYMXS+|rRof98E-;mwBe_@=Y!#x|;RYH--OcWlTP6TJ{3i8&LI+VTL2Aem=0hl%q~a)xBB(La z!=JWJQ_1tHbMHIG$`HYOXILFW08hHE05(d@{}ji^{7Ly7U6tlTfz-xsvP+@8DfdOz z?WxY3t|;q1H$?l+0S|J!p#_Ccjw(f$?mIu!i1(HKe(ej{WWooiWKswd?Rt%enfLH> zFF#{q7;`=<16S77nWqItp5?MNsXTH#u)rrb8}ZMoc}Q9=s^Vc1}{H>8@}UhV_*!fz(8i_5yrqv zTh^+jB4Q{+fiY&80oFuO!rSXG6;`x|(}kh5=%tD~PCoiz?!M3;tX)1@M+>9tYViZG z-G@a+{(W|z0Ur|Gtk{X}lUnmCwlsBbfN;Ro1IEqFA?EnXo`tkl&XRcZ@H-li-Db&z zSbh*TCiJnC-!?uL#UO{%L6#r4kRPd~#4z&PL1)E!QY!p=+>G#;N-dF{e8P(a!Ql^A zq286vnTRcidkR&z-tncAu}%(o!{!#j^GR(z=S=9Zi2fi#Qh&o}r>jWH0jB#*V~w!N zs9OIczD=TbYZDE;+EJMZ+@R8kJ!ofza~^>P_XbsDs<{GBwB6f@OAvuA&mud=uRMSr zIS>6N)W>^rouE>D8oR96b1Gkf*_mipto&h9b?GLd=4YHm2F;2Yx$gZedY&w44$K0) z&&1BsWbx86c?pK&F33}SI(z1Q?gXb2<4j5KVsIA{+fXFRyAN@k(skoC4-QM%sL5it z8`aZ$6ed%`fQN!_enckBj`Plign;_-dz-d{h}<@t{h8pyY5C*YS17t8^6eWZO4~MX z{9mn=@s%}y4W@&9&);8t&Rq$oPHoI;JlTVtBlu#tOV^*S zw5g-9b@?)AvvlVRFpL*m=d={^A!PTeH_(OTkm+e^`U1)-b*5f}6h{&+$Wou=&Mf6H zV5^rM535GbHN8oY8QN$xJKurRmyW#yt+JVz&vs zWfQIPzW2-nVA#b&dkPzjj;hnz04u2^-8N=xR|&KW8QBd+5be8jS2dGfy2^Qk4Sr*U zU4iLFr6jTwWH~(G_$%igKr|naTA4*zi+$M06ZLC-pl2k1(wTnAdvCv`z zPufQjeGlxfX0uSl)^s`MN_)ze3_0{0=jxAP4TN`B za~Teb)5Y9&&us*cGo;##3AG=*wwFWM36E3*t7oFx+bM#!kiX=F9zR);zTKpJ8C(l5 zDY~zf!$ozF!<1}ado1htj%!!8Fqe>>5*quCuWn!8KTFCj@%KL@G}_BwJ+15bjIYX_ z5E_5_6B=t*devtl;}J%u!re~H?3GXWZa^Bw6Hax6vk{}B+*$5ZGeG*#4DpKUro?ul zb=lg&g9GGcDgrp3+vTcrn#0bg&9y5DMaxnuC#_Qj_1UmuhlNG9BzTkaQl!B@S@sdkH zRyQWBa{)@t7H#LNe_OXrmSN)6JiC~n=bLhaHoVWC?w5F%2Cq${k z3C$16q+Y)nDj*q|?F<%$7*DE0Liyx3JAhn-E0qO3*6;7g*6W@*6e&kcYvq5l9OfT( zlFBvMHR7oFXbUcyQZ|kE{D!O|HcQEVMmKqXhRr3`L>SN1Jm%Tq8ej3Yx17iF^*-jE z3RY^>D_`+0`zqZRsP`Rdbl?3KmI~+Grj!pK^|RlT?+X>@cADd^x)Rl>%Fy4K+$$i6 z4T4SUPtkvh*bukD7+*7pdXd3PzXkV7g-kGL3U{C`!0Qd(hT6r(%JH7aHQLR3?5nvs zXRl-_V8*^c978AJ!-RyQmzrId=$j*c4}-H7NJS`OhAOVqR6uPfN}_-PyJJ+5$sJ7q z%ss7WkozR@OXM|*CY3zY1dK#rKHxa^bQj zaW9zEC1?EePTdw|etv;b5%X^VU>RsUBU&2-wuW;n}E+D=|e0SD=hScO933TXoL zGZUb*Me>Aa{(JURGyP-B*y98W4Qldy;@9~?w&s?>Dh;kzJGPi5%^rm;N6X;IW z8cE*3lne49uQV_$SmxBuRJyy|uc)1-(g>u>G&Jl7bF@+AV=QgOXk^M|*n&as0}9mY zH!>00oS)Q1a=G7e<^x||J&ZxGkK~MP6_1W3@x0Kp z4CB!i7^)#8xDCNhX_7$_Ni2I7cOr`e7)sPz*C>sdIc!c}uC8Z!;WF40s*pmh zC>)v)jo12&iwET*#W`0{a7QqbT5$&St?3g#dr0Vk)}CzbW~Irui-Sc-x=Zh`s@)q> z<#FKl8hH-M==HM9I!SS(ji+!3);1B)Q)-$gnC_HzmDSNmVhs`(I^T#UhP%pYc6z01 zgjobvo269Mi7hk-GEga9%?By864A*6-PJKXUM*CtC6U*Y*RW z2gvK<&?xKjlql=ik|^u2mMA_y!co>cK(K%IHi!oHZjz|$+Loy67L0!B zVm65O&D{XFi|7zIM>!v7NwjtJ_s${~vDab_vD~^Lm?`qM@N_RdO7s^HrmRhB`Mm~B zF(bp#SPW$w@f77!{v~0Wf(?BP)m1~E(c=!Tp5N+oVEi7#2Y@1Z614~@buC;OS+*oi zwR4ll267Hy`LggDwI3+jQLzidDuV5~N)z8otJwBPvmcm~Uc=)#i5@bB_(UyF5sxMn z(LU%bS7h=<;O_O^?tNIrO*J6-<#oPEZlh$aFd+tacZ-YuH*RLK*hzd+FbNUtO@5j~ zg!pp%h&3$R&Iq^QZn3J7?N{?ec_e1+- z25Nf!bdy5oAZ5!7cE&3kZq=rH%tyiha$>X^u(4(z^&@TD?lRAaxR+_(<YGl;(b)tiPoxoXcq{0RpsEVt37U2Y%ldTmfP_=2KP2n*@%m_Uk_ z0_8RprUVROiNQ?>VNGyFM{l^K3mhP-nYv(DOj|D-a@|ez9!V@JV+x z&rtPSjFr$%38Pdd+{F#!y+2^;f;J9fnLz{ug)ueyGOO>CO?gdLbmH@Yz3;`{aFt6q zf0Ob3gG7U}iJ-k4G&J<%2dqiKlV7}NMa&kwEEh3`5rhgFRXKhUdR270L!>FcMe{?U zkouX&%ev{donfVYGbT^0dB$Y&`liLY8Ct`Pv0=$&P5Xs4Nw#3hc}|CdAuP47fQ^3~ z<$fwqz=<(JWHyaz5yf^X#;1>CmETYsQt`-4Du%Zp798*NJkkWxg(vK|OsUg%ly;!C z?-N{oC1m_R>HxOgwcqENcFT@_7drEHJc9L*-ILNzg)ObxmclEv2t~j z#{aEXK$RL*nO~#&C+c)}wBKXCY8^WB90@|pg{#;a?{AUK0HLJS`IgjS<4l7=iE+rM zos9BP7Asx%k9oI}=H$G8kmcKpHz^L>vOF{yO*=U6LSmefPOLW|D2nLw z-LM7nDdl>5ThcxJR29OP=#&QS#8?##?#r^2*(ovM@7mk#70d+Qk;@XCF@GsGvzW;T zQ(de*LFZO7kVdzWyRB(XtU8Y9M_(MZfSVxu2) zOru|n*K#=Myf~4=E$j>C44?DV7|#&xmf3;Gei-!bRFX9 z?j_`9sFYRX6)6=6r&F8{vD_3w5W{o*`B!Rx57q-9;N`~0LzL%WoLO)E>oDtu%63u~ zHvMcV_O8*cywCjsmdgly{x3?0;7-`3#I1|3A-h49aRe&7?$kd|xEF#7io`I264Y@H zi_;yb@kp97*4e|)Mae?TI>>7={*GU*I#yz`3F|v?h`Bc6Y!c`)7l_4_FMYhpJS?U; z(0@%aciIBeFN(?F-kO&Q2#ppcTzpuEE*A2FN%u0iXOUDc5oEecku)xc8FFk4blclA zv`|Q{2((aatJSYa2rso~vw5{4KH^WX%Jb$}jjM!E;`5~MRzmC*Nf|aAvO8Dx5Ck;L zVcdB#Br2fU?X<_PU{bJEi)GT!`26D&Gw)wag3#mj>@wL6(cpI*X3)QEyWb z>)^j(28~u6hk)mZsSjV6zK z;&|vV*(>T0v?>dUcJe7d>Jm{6qnN@+=J^|ujGe7mNtc$==dMuF_;@xXqky`l9I0MS z(Uy%*qzb2+RwVA(tA#zd^8^>L&4iQIMHFE?d7%D8-zM}|`5hV6DPa%PPZLj^kyzwO zMAN$}QsyY|qLIl|a6F%Ddni#<7Q^L{Q_MGXwnVzfSRCiV{*#MXpgT&dDV{la;S<$< z#LnChdLHBPn^4PSDIBBif9ux}E!R#b(^(nh}Zk*aX$<*H9>E)jT((6Z3FVtJ!1o zGtEu&Z-4=3NAzQHy-5SzAP!gL=`s5l;boi+Ip90o*V=a5$iby5C*b^Zf`e(fL`xS% z46~Zc_STj^71Imb4;(47Q8MhfY0g}+gr16%R}Vh~If`V8ase9OGUTPhc#MzhB8CRq znsn^mc=eRW%$b*sx(T8d!3*|wbV7uqMJEoGP8$Kglkl*QhVe}T)CY%ad#_T+zq9CK z$lIn6;HYppI1^$Yy+lu>*QZzy2eqZoZ^_5*A%?ypDb5MNk`k3!1gPLs(TLAY z)55&*UBxgCzysed{~d6H&2NI42e{G99*t%1P%D=Jep5Gob@*-1f!rL$p?!+mFIg=Td8aUMPdDrXvUuq@aXsoaORW=%* z-P@;w&Q`y2x08GO`A`f1(+N%= zAD?&qx=3U1lDy#?Jd)(*u(M-za@P_JUNHT4QF8`B@r<-Q!${Tsp&pNJ4Q#MK>RTg2 zaUo>8m)NfN%YdK{4H^)1=tO(b{n~!3YfXI{t9BnF-t20JAt9HeVEDWAUiin}`3E1f zvVnA)xP$b5K~UG@;=n3tN7DJYvh$;6H)8B6l;6`!Npxs$6!{NN<~@g7z~fW^RPB`wA`R!2UtL0uW3F7H1z_)&=u^_@4Z2)2Ch=vF(g2i(GV~ z38dq3^q_Le@!PGe;OfZtg_xTVx|aylIt3M`zw7?icxi1hdT9mywLEGC&?@!--W@#ixovza~S6i^|e266;@Co6pdfeQ3l9>+gI~i!g#jL4tY}EOo zlk4kiSC^NU4bL4X{0F@;voQbbzN?)?DIU=yRSmO1o3XH^ZStU`gz(gQe~ZnLU*@u2 zA(Z|U>#VC@(K`dgq9n$z+pa=`{C=Vru$_CE568RnC)R;20oj)JsnK7OP~1f~e8MZl zBmZdPC=ps}(&)hv^=6?#fh8xp(zLM9TUyz&4__1MoAw8ka8z(jLV5Id5|v7wntNe! zW8r`}A!H$`fq@V4_uJLPzyp+h&QBcw+s4mFVr2UHmbwciPw+2&sX3`POhTEbMLWAj z(Epv4@9U(ToHBxdf-5KtV2|x%()RjBTXsPd*_Esr)0q#Pj0n+|EB}%;UC;iM6Fd+L zIF%DaQK_Bx=x6 zB#VTL5H(RF{Dzjc+qc9Yco#A*zkLd`tkhxbWU19yFE- zU*Pr@DAIOdTr7mR_8sRNp~ZGCFw%`HGPeBVnB#?9{nbv8ewoyY_hG9NcY)eALn3S( zmB#q4O1z~699VG7=vdNCg#JLwt8tH>29J;RO zT`-(HdK=Fx-}M_WTFHUlS*zEPO~$Ni2+t5&kz39Knj#sVS#{KRv}jufRH9Y|{#7jb zvnHP$01R31jCwa$&hYi05wrKckw}@*U_hA)Riv2r(-_*UAeVI|D7N7EGs1~NdO+hJFEd5Z^aqzBnUcqg6ICQpre;OB zK!Li^Kd)aVXd)#YFt|e^jspibj%3(+V~F35YUXPO(=r_ zy#q9)PY9Dwa`^;M6)aTY`#j;vBwMPtQ*CvVP>Vc!`&L`=MF`dE)hZ;7kk(@G@(@ZC z#>YzvdF=hWz$>nX9?nSj#inn8JIhrzVw9t-?~cnb4RI$xuMMMc8EE`5s-Rrcdewwz zgA?f-&pxVgpIpysEJ~R>a@jbIKP<6@nRLG|YAq~D7uvi`_;pw#uS*!t8aR%AzcMNA z_i)=&$zjM=#M4TC?TU{Qma=v7-y1nP_IK`NyjaDaVRBT@LeN`PcKL7_r%Mz$Iu^b2 zmpCzfefK{4fkO5)0Y(Z!R&qKS4VBv8-{ z#B5MaaR^SR##7uEAF+$4evQIAwyv$Sd7?e;)Iz)Z(b{q9q@<=4Cc7^^pGW0hFpKYg zWvSb(5_lN0HdWe`C)7S7+JEz~`XoYZYmI84_Ex2inI3=yp_qYwjO!y1TnJ_fi@UMz zjngvY7wbmW3>?xe8TV4y1+BEJzY*a4gw4fzno(l_i-CR%UekpAhm(6+`!;9bo1S5` z_>W5QDkeP1q90)77dHYvw;$)~OUepaH}jN`?Z=?Z_bcm9)ITsli>k-1xwjV1k?bu) zN6fs)?3?sl3kR`F5Hj-2*K6uuD+E@!<*mQJ$~<-5`Q<<&Llrsv`g{trIyQ>5f6jmcUkA@s?C>!1$)5}bi&tY7oNyTq`D!cDPeb;_Ul z2N*Hu?lH=Wfx^cFAHM2XH<;|3b2sg7+kD;~KaK1PMNKr|oeCvS&h%gXwFiE$!y5X% z#kZ=~DxljgHPydKx4@>j+{jE;KJeC^H}%(RJzD>J;s6{-y&u|TmtV93J=+cMQZ4~Q zdRi0yU5ARzcO$BjxY%p_22(nlZ+kHa)53K=u7w>>dfN-YC-3FJ0eC`i1giJ?HMaKd z^oaJ2V2vLOIrg)1HJr$er+9m;gPDy+LbH$kzwh6Db0oCFd>-`Qx;StOrv+js3A5LN z*EJ2qVQ;MzV@}B2vPLL{&$VMhd?~xqoeY0x=qKAOUx#xyz<~BEvO6* z*{q*PLcu7%v%=VjmYVq6J$;hKh4YH-8WrjLCLOkp^bK+J)x|qA1CdaT5Zn<}RCs$b zh@>!;F{mhzB!fz$Fi87f6L*;BB0Yr-`#uhCUf#wx3Z)-cu}h8Tn3=B{q)J<_<~|+{ zXHSUb85jQB#4g*ksIETSSXds7?5PEO*-(N%%n@_8h%~AD6G=}`2cuR?$3Y*y;(Yi$ zPhULGF57qoxN3Ss+DgY0^W-wu4iDk!@cCsFh&o024Itep+h36U*!Y}k5H>KrY&eS3 zil;#R1bk_3lWG%#_9*hu0xbFyz$!VKh^15x#e8msiBS3p37ENgW_G>cc+{+qeE`$@ zDjS4!&SQ7U6cSOS)_asFk=bb{iHhDfYFWP);{NE&1?UHSgH>KsSNv14rNg`E4j<#J zNo@I9>Nl2-?;x;ulfj$HU~!EL9Kh-L;j+0VdaEF)_pwn^j6ctCl)*cMcF}8QBJ=nq zPW(HQku_(lzGR+dWqo{cea*H#o;QPQoL9W+yt6gGuCDZvjn>@Km&!TY=c{gy#6z1N zi>>C6r&xmF?gF{$ z_IG(;FccXMAB}z7l8=+(qATfgkdexhc|_8;LQR_O{Zj7{N}3D{yZN@ohM#EM$CEsY z3*{A*rqLrj+q`?LZ{NVSgMII)hW{7??KHQ;jL<0ri$*=6?}+|=NxTPVn(aq&+|>zX z`^{rhG!7~ygqo(tcjq%(E}h?RA_5Wm_B5-bqYOV+nnMth(TuvskC(e5V4oB1;jopV z@~J2gY`W!E9aHVmW58L3Mxz%@(pH2;JYPUzV~89tEWp!_3pot`UBXp`E~O16POgx# zx%sQWI;`bV-tVWvipVp|2#vW4VtG@6ryf9^VY=$Y8dbkKi~=e<%TQEU43BCf!6EWa zW%te(F7Xh*MkdIPEb8zB5aZPl9D+o3&8tBLYf$|^Ew)BwX2 zSVm?ArG*FX1Cs`wNNrAbEvwQ=m30`G+LA63Fv!uM;%(H(?S+#W2N90e^#xbAd#Aa2 zma}Ak3282yKJp1-x@?%cYLpZ9!!gPTwCN&hp4d+|KxUt@$ZO<~hA~Zky z+_)s*AIczXL-YLPPq4kSKDtWeMf;#2*jDfw7x-vCx_&ph-oKIetvI@2mSezqN8Elv z%-Pc*Q5q!GbVQLO*>z9&9C|WQ!WbiswksB2xf?8QLq4o1-W=_{n}AY-ELg~zP!6Mz z>4YyH{509@r*+3XtPPvgt`OA+?`67qY@>fMp5b5j_$g&MUWVBnt12dxt)$^RUr&fV zdqlt(`@^T9I4)BVlUUg$Z|w1E& z;p07whcb87t5qn_`71bu0(Tm!?Kva|X`EeNO8n%(g-J0;5#fK%sicg?EZ|U?J5nVO zH2XbID6;a-<=fP}?bcS(kC|ak#7$>KfvF3P+9tUbmiE-%PUqGR37l?^e=UBld$^td z?CkCBy$n$A^b5V8?$7o(?|d0rKHP6~8WR@!`Q9APY9D*$Vi;<&k+OcCdhPX}roM_z z8OP;HHbD2R;)5?ho%AK8z(prfWT{gb^>$gy%zNW4PC`g_M@kVn<-?;V*~qClnine@ zaE>l73?9_11XrJNyKlg(N4qLXObzN+KRLy+-^^PKqwo@nYc$n7><*l|0WC=X3=PA6 z>=fHOFKL_H3@=5QiZzwKDdU%q9`c74=2yZqS%9;I7rm@vN0>Qw* PK0lvYP)@)m5WxNq_Y-Sv literal 0 HcmV?d00001 diff --git a/assets/rancher-turtles/rancher-turtles-0.3.1+up0.11.0.tgz b/assets/rancher-turtles/rancher-turtles-0.3.1+up0.11.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..782169a0cd1761aad3bc38a76b1e91b24e6026ae GIT binary patch literal 210715 zcmX6^1C%H|&tBWMZQHhO+qP}nwr$(IYx}Nwm;b)s-*bAV$;>1E}h7w8)#uBn@GM=2QM$BpqCd#aqTFRVk@@i^qvg$TghIS^NDvI{J5~en`0DpV0 z+>YB)8M5}iP~K4LNiB)eO8PbyN$wR_Y{kcY7cbRvn2+u|2$57nBSA3Xo>&wsaZ`Fua08_nkPc>LZk-Ni@c@_D#laJaViP}j8RNRNBCwmfRS zj`Fp$LAw{^ zi=|^!C`Yfmd5t$|4<>(LaM>#7H;&vW8%o;^JU_Kig(7& zRx5~x2`R}e5xEeg2_=`_(2&U~$}GPd@7H7QLZlE~_)WvBWnS)&_%d;R3+H9p($D)df5mHh^zvdY3;)FD`SeNsp;WSjZCQRbgSeISybci-;R?IkB9A6`)oGM#zRRwO1}=&#s=lzX}bk<3T_lS^z? z7&`-lFv~sNN*=vGo?JYJ4~j;R0uy8w}Oq;V;C(`7%ln)~xSb$*g8 z9M;}DWKWa3l-a;L{uVW2*H3!Z;emt^@h2Qs{0yM*;)0+s%v#H{9*69RW|)~q5`Y;2 zHy#O7EKtIc>{JFU2V#=r!UInnQ5twZkZ35_QYOO2v&VM)3R*Qt)<8kpy_M-EXw=h) zv9bdjGTqDsFv9#SP(h@OBmTr1EfM+Y>0a?Z*zYdZZ!b4PG)e%WuYeFTYS&ubk>W_e zzF8Fi?GDTQ-hB0>#N7Q!( zi7HBdU~!8@PfbqEHDXGut890vxOuvDmO5-jx2OJZBA&VVnWE`%PAuUCk%obss`-$M zvQe3E?fylONF~_Q`7IBhAUEi}38thd-9*U!1|e#+@bf`}2(!@!agHJ=Or)h$2SC@BTp?_-PK_bYUKi6hhkR{+Qa@IhaqG0IDPPfjZdl;d~i zFK1B;W#X*`|I9GIdN$Im>t{|GYYY|jH(qU}>0 zibNc~FkNj1{7}F7OD55bB}ELEQM>bY7KH!!f4)7AtA797-zOg_{&He_j_CL{M>wPb&uRRj+K+!8zi{J~|R# zXNi?t*ti(|7kcrM$km9L_Ew_6IwYVPY501Uf1N|VN+};zzEIzP!zWZxb|z+FE_Y}` zbQ&Htyum5Rjfu=uP?^9H2an)0)r>igxS{Dw*g@#RmVVhg&K)lzCbU|uI6w)&3zUbd zQpw>LtIS0@^q@EA1q3S_zNKmI>FPlbm7qn|2%GnOk5AxmU6TwHah@&!4LX-(h-+j- zadvF%@D*CIpW!74d_vuNr~Le>3F(H;*XwQaik%8{su>eXK_3D$?eHB3k>(64eYU33 z9_izqjPxBR14(WvA#xI!<E2f)hj;4MPoP$XN{hnwW z{=`VgkGC)#@c^SL=l%h7!~X1-{U5uN&srb<^cBZyWWnCwe#+x$Tw)Rh5di5i%LZa&js8+UAHUE?bF2ypu z)M?pXcXUKO&E>QL<dJ?Sldok++t#<=UWcHjP-mk*pk>kVhnmYYusacA!TE>(Kbr0Q z+x>QoioKxgUrkTB{CAI9Jk*KXg509~B5Q6@iew8qvsAg z0%){SkLsbK?L08(zpz;l-=B|eg+>y~wHDgC_#;sHZL^}=iCS%zqGQ@=j)z?(wVfP~ zeY(o+yX-9L>7HOLGz0|EUEl8A1$9}&>>RIl;$}F^BV!S}+xPSQ#7NLi*v1@i0MEvz z1S1@qTL$Pj*hg@ilb$`z{iEMCZtmv#z~-Yxor`SkGy^xl4EEUv7T#xbV%uX}Py-u) zQpmS#>Mcw%u>DmPZG#PK12$k$5@^k)LP|$(N?M81;rPBWF>$qnO1+pkRLGYdHJ>Wr zx+IUwJ=q3<73(#tl}VzZlGCcwMQYY**g^#%Ljug;faj8kRhQ<9^>J-=d8+mpsI{Yw zN{Z2a%1E}8aesYo-`q4|Y2WS6_HyuB+}8dn5zg-jQ4AjBl)VB_azB6}JSORFo%AP# zZ8v?LZ5)-0yMD|sn-_nb$!U#-<(U?-Joiw%^a~|Yv*D337Fj2OGA z(t`{OwglANP}+AUg5i6W^T#b?V(ywwYFF^m^wUow3Q_BGZYiB9Gvsp?Kq?@NfQW~H zH;kv^$D}J2oY%cM7svn0SN9B|GcOCCa$A6-u^tzU*W0cd_f~PNj#7>FC`F)@binHLaMmz)mF(is9NdU* zr}y)4et$pth+b|^k86e+5%nF_RC+eZR6-KJooIQl{ioO6r9GsGRJSJB&aZc*;Lq>h zxRdCFrP>xOx0uH{1$3P;(3dNxWJFi!>uxSfqBO1xAYY*G|K;z6$JmSQ&I)di(>m0E zD8Giw7<+ltxv1z%oIbDS6?YL-A`$^TR~ON3>`d8Qzk`5Uf;)9ee(oUWKy${g>JMaI z&CloSb?hUnOhp-|pMXKXSDlPoY5kJL6QAcU?nS3;!jLm{2 zMiUR~AeC!a6_lZ*hmi8VT;C}N2|6uw8Vy;`)Cfp~OgTvk`8ljN{+wjWI4No;*)(!W zQ$)a%uCX&xOF}k=*MyYQSnjN&rdUX@y~oNi?i+# zi*g5m=(V}^+DOqY6;wRfm@I&6Hk&wad~Jn`Z@No4+Juqs=9@;YRx{#& zbLT#dO1rR~)vC>T3sFNn*eEwEMO*RHnoUff@OIgT;{;Q?VWf_E&ow4FxUi4)%T%lQ zZWm;;FB$xJ)dlbPl9cA<{OprOSTfkCdm>j!Th}RS6>D1ch7TvEoEo~JHfqK!w*MZ? z-#=_t*AMs%TwLFzZ{*#Z0}y{`e{g?492Iy!zE5wDj6ch{EeH2|wIEE50`@Xlci&tGBL8{leA;lyt8Gl0$!%_bqz3Qq@O?fZmZX>I%N}8 zg{i<_-es_Mr{I{_*Y6i9NZ+Wkl^MzBAiSJhT8^X+u&=URUuC_vN1*FL+M%>|hmq?A zKX#{GSlE`ajpy7SDMw8qR$$*!E4Kes$!#;A7Mhx{??_sFQ_nW8ZJ#|^EpbTY(yCp( zE5LMN&r8!xt$f?N7GHVZ zbrU{7;Qiqr8SmcGdu!zZ)^3ZvP{5y+iGhaqb`1V{lY)@`yw*zrVgYW8;m}wz^oFdG zBncKf{cVF3B*(1iep{6g5CzBxNVnR{0zxTK&2OXy1AEJjEYsB>CFvja#cY|{lxuZS zm@e;t{CgF6+pqiPUEg92&xM==w+-GA;`eA?;3m7rmCEF{X*6Q1SOb=J(B7eZm6tT@ zHa$z%GZtn$3$R@L!yX5hjS1lO*`LSb|4>r*^s+wY2OFSYwUd{xahIwquk~(3ausUk#oDAN z#ZH?$J4v~9<$d^FtHl8_K*FsDgkG6mWkUTe2d|?My@ow zcrA#K8CWB(6?>WLB1I-+%CUxwU40zTX}bf4Y;|a(=2;cy|Q3+m0=XKh{YSaOv_g zvd^h^tcPt?;FKmeFI*6_Nggq>%`s`96?*yy2&kD46@7Tfax0fy3{K4P{`>HpjOLbCOV1eRa+l z;=zI^Aq=i;T)v!(7L)gh#tZiZjA9oVN%b)ZeTr@}8fbg3omtkAwQ4Z%YbE)1LM50W z90y^)=D&+nwJ740QO@yu$zUkC1(&q(40V6+kOT-#u^bmc#muHs1bG{}KxjE-$v4dC z#}Oemfgco_)l3X>t3u??85+)YhAx`^1xoXfV<{~Qznw{RODEB+$v#T|^9wPf%;?C@ z0Z9{v>ZJ?M$9O$lb7vYWWtTq93n6}`N&uQ6PRS^oJ{sbS-{nWU{H}VR7zGj0F-vkl z_DvWuRYDGOiN1jH*g>&Z2|&6)Ir>?0QGHBvjDut~CupwonU6O121y8gc291EfRA2^c8g|ms`EQewr3&ukxp|l=!-V(VO@nGTHKwtJks|(gkwK;+RF1 zp>T#Wl2nOfb;#5r3I0fuYIkoi6l`5YEeuumw=A48#7-*+)?@~8W5G&*!x9YsY zEnkh`^?!q?B3Nx}ypOlcNNRD~A|NN10unTlTq-xqsu+p!9Fs;)O29f3k|k(SSE!Au z%rWblGY{uA9(N!oL3af{%`bUmZf{~MefBe~YQ7~sq4@H7GI3P>Y|8YjTueJG{BDbz zt59$1a%pzuvchU@WjS<7&NPY<%As3hfRK$U`0+uMmN;V^e!@y4OXfWUFPe_%GS>N_ zeyX^SP8+E0k74(lgf@W9S?CqOE~F-40A;1dCV*=Ipyq*~069sBw7f60YOFkeEHKfaq!|<5t{4X;gw)moP}Sv*vD9r8Gq4c+EPQ7tn7Gq987c zH7mK4=T+YCBBXRps6o9qMNiEpQXJ%q(K?9hucIwaMPx zI zs&$B{4#42fVj{V4ZS6E}S!e78F&ktfN7i`ufKCc&ECJsWOFYUU;yst1VSV=gC0?-u7L=vtO9_2*D1iFgMt&gy zp1S;w$nl(kw^bfT!C)#$Bf&WZtn>Ur<&;E{Wa)5R+!Caa@=y+dyOvkUdStRq8DT0| z$714n#y6GB0TtV*4rah<*YXRLQjbBOF0#a?qck$&R#ri&zMiti5Up+Y6_trBItNT! z+NR2KtnZrm78+}SLqZJ+RFMPS>MBK=sQ%AlZ-4-`pdcpGpB&{T6W!DVk(CLT9qNKd zO3i}3#G*PX`rSh+ANS#4SZ@1TX~(`#Q)=Qc=FehNvz&@bQ+#nw$c3nomW zY(!3XECtSTPotFyS6MWL%VwZL`r7cFF5P6kpL)vGHY23xa&;0gR|?VE#p1JlD0kzU zXu#I}M0?(@t2FW-tlhQP!=|txs@J-OjEiq=)GT!rPz>dnT{fsiLxy_rhAtmy<1AEa z)cX%S^6(4TWUKk<_>~GiE6`#i*klJsAilJ$@BLT;pHpp%edn#a>vcJ05YBPwP?vRd zGBPPGU^bP3B}F7>l}2H#Br% zib$S)9Vv7Ils}{<72wk(fg$ZpmU^}(N?2PHC6{eYma=}^u`-(zC8)nd*Jdu0r8Vpe zBZV|47~~ufbCU@qEU))s*AS~}=FbAwo|1bdYtn!{+;F8TX_-;;Zg%%4l1d57^V;xL zSv4L$__(g2s(_9|?dG2%bEbMR}A;hkkOqVuv zd8Y*wu-d51no$6V9hoT-sR)sL*h;I~LI}#5qwh4vJifJJEP`~btrTH5epFp+Qi6dX z%DTJgiq+@e3M9z1ij8HJO>b%1&_A<6-X=`h1r*_Rj#fHZFV9uhmDJr@MIJmkL0#V&HRpv&I@8zZ|Dq< z*WCPDgjjRLHS>S59&wMxayqOotQht$QdJQ$Wy5!HH#@xEPeb`-5*&RxOfaK2Y%c6L z6gU`cvi=#6JWvxeP_psnb8Cvhm6Wd%PcPea1}UfH5X+sqg`&T&}X$@_B~ ztAI%inZ1P}$svZsS0ORPiH23qn!b#uagM+)TFk%EAryKH21qz587bg(-N$IN=^rA3 zuG)bC3rYhcju@#R=22j<@4d*xQfj#ZfC?>HAGZbpS3_qan_O+pS+{M5K*bTjU&Vd8 ztzJP;flcGy6sTp>z~EuUg3EszLXW78pa*p%YK3*ADFO=BxX`|=aIo)F1+2Nu69@02 z@0!!50?0;WdifeSTvN}nIpY&^xutLmm*Qv*!KyZ1`C6ek*%_D8b|~ABW*=Z@E$ySN zXyhVb1`K-s&eeZSDYzIGrO?vHgtF=`UOUpD18~dwAri{hs>t5uR)2M&vUtiBKI>9# zAss%D8=hQ$<(67Ip?&}*UQp!RTi>gtzZcckp)3Y0DOl;Aj-~O$(9)2*%%FUyre4Pz z47-|R!K_NY3C3k#^dN#=!Mm7MCEpVHj%-^5B#J!<<efzA5&niSxqA zpkSj4#5~I8tEPjTW3s;pMwu=}z>Eg_#$Jr|+@*Pqgo(97XbUtBHM~5xDi%t3wtUVV zzaX0vISX|;3YKbNj#cvp2PP(^VU{$S`|Kj_6jvQWYtW*JMXw0=&9;0n)*X1vTR3_E zi{4InIG*ay6Rf7)AqW#jy1u$t8xl}~+*r}lIsBCRY(7?M>YCo72gR+oXu`-k$X|Du zrtigw43PH#IEE~tV4VaBSnU6H&(LyhxK;y)msm_9W5pNv#-Wa8H6dKEG`@IY;9d(C z1ARPBsEGLpXcoW|0F+w5>2Lfota_*dDp6Z$z%K<+&<)8bFCA`zwg(Pu?S#-Nx;M=l z!<8jpp}!VE0QCYQkQ!aoFFCc|O}Q~H=av2nTJEiifyV+NW*+jSk#W`&ISzoq;+!mP z>czCMnSMrzAxaXejL;oLO?rM|1pEYdp9zQa#e#BIyken6`m92BXC}9BK@sCB!*YfAfTKlim{SDnSSe=I*5V{McFpZ_gnEzJ! zlmBa_h=b_2Z3Ti(=|~iqIW4SEbzi{(MNLezsOnI8flD&k)+)O&Y2&QJ*OHiGrc=3k z2~1wf3K2rl7RdUUj7_Ep zg#M{V7S$L6Y1x^DfsJ!+LF$d!#$_uI4eE)ClQzx+QjJTbX0mxK>DWpk-{KEUj>JO| zAREiZro!-hQXC=oC6$4`Lk=@`VfysexCsY4CI|ArUu#(D>tdAZ;JCfnH=i|Mh*H8L zRL((u+LG$k`*%LpGd)^ujE|Ss=6bF@AloQ4eh$Gbwe5L9sD=JBkO&ZREtdT8q_a~f zh(fm-HK^Rm$k;lha#ms-Io`19+?@<$CAkO=!xtTz3^(T~Rcc4Yz=;>YmD6uSDJX7V zf*_m9J(4{vdB~_%dWKd!;EV5nKpQ`QV(28a9{9bD{P&`8UFqhWLu5U8_oyu>;?<72 zc*HIDXTOgdVEr%7=6JxD!Z*WAxwG}1O#RLb8nVo14Q6GN!1nwSPHVv}cD?oX#E|J1 zmIG(J<2})J;n1kt3Jtr;L0sS`az3^u1=QL1>MDE0ugkXlM@3xR?VNhKov+AqB5rnP zs^JG(y!y>n8P~JjKdw)`wgz;%V3jX6Ga4{2I^7@7d$Yyx!!%uJRr=eXLaxRJYT~Qi zu^T+#1?l0*74Gqfb#IubPF{$0ZYUY<;ewHFIrB^zh}+gmyWyN0Q{PfygW%Z-dfahc z-mnXMt--P5j$Z*2_O8LucWn(0Bto<|)gtb|07JA}y|?xD_kBTNca;YAeL^DWDr`6IOSwXg}}NR^Us#0rm{l~X2)|@U}`QNG`L?mJetUNv|eh|jN{ zo&VSK{hO^|ZHq?hTVm0<>iCb71FSIqr?Q4iT)DUy5 zA?nx~;|?-n+t_0_55{d6sBdP#wi$l@GFoFd490C5tX&w)g0H>JXTYvFPZ+WPX28B6 zPk?c+A%2orX~u@ufW>?@KxxLhf{Y`nJ+u9?Lo9AJ#P5{J`hVpnLa?|0Pgg_x?-Sme z7MxVSRm<`>vbFz<>)lxl;HY2qNo|HFMaptsYwvX}1u);%${pCT)au$OpqUmPBzP_ z{82e)Z~Crp3B9|nfpiZTcMwj%VAg8@w)XiQowxeADZaGh@kYcMtBkAlm=9(YaoY8%D#)vcgINH9B_*!sG4~* z?Q&0BcNw)j*6H1dREF$(k@Iifw}V#bzP``K*L2W+MYE+;AA9X$exjF6OD1N{kHi1| zVfN&o`WgM+zdrs9SP(L=T2lA~<33ge0R~;<7O~?BU$A^891`k0Ze^K^h z>4pKST=JIGEQ8d=NJEQQ+~ew?(w957^ zledBsx@r~9jss!cDh?9zMF_iDaj+i^XbN>0(U5qDuHA8ht`&@~vfk%zNEASqwn7Tv zd6!AwR@nKR+nCXE2@}mRj+6?&*ocM^WY;OUDttkA-vB-oeXH@~TeqL5+3BCR>6=&l z?Y;e_r8xRI;9xSEl$yMzh@QaC0r6quyfDIPWlO&VjZ-5gbD=za6ntj1Reo5fHqF;8 zO3F#G@{K1&5(daKl0j=y?k}n97tl24QO0ctDpHP->=s@duI)h*C(p*w`~4+E>*dKx z-6^pGPz{WZ%VGtci(tVsB!)g3z9bttB+@TXA*ML<;{pt+el?#Z zdNs1<_ck@=5KeU;y`C2IA%^;BS4lI#3HEHJuI^AE8Rps10}P*rRG4-H$2#nyX6e|-xD%%7Qb~8toK)7V z@pw$+f*T4Zqm5`AhxE%s?p@3`t*}xO9$vwp-dBD9H_|^pPWHFm#ryGlKZdvcWOwuZ z*Z!S9(O-ArUthhww|$;p&nKhPw-?{^d!?REwftXAuehH7dd<;cpWaxJ_yfXp^`#ezpxu4tNU&oqPD&p!n8ub6B^E$ggcuGYr@}6r_&0*#lUiG%IXqnq+H+SEC8!1qm`CA zG}T^}((aeEMf&8BIBU(P=E3pIjNMG6Tp{Cs-}JYp(Ja~sEsYt;r2H6nu{(L+-!+Sk)n;dom?7Xq?8f-E!c zG;A1CBXEEN2JMlRukF}aLc*l%3A+Ss7yg5h8&77ifTG*Z4Xg#?7hq=%x^}0)eGXvC zRf_J?h~%{1nf3uW?ma4m(+>*JN6ph2odQ5&`p*XLd>onfNixicXff$TB7DXxA}N#t zHM6(rv$X|KC^XeTThYb3LcgbCw@d2sLq&Qoj%f3P>X{7s>XOqp&V7ogJ|$w96GNT@ zMzEEA&cvE?&1E21HL?1t_s(e^gF`{Kl4f|dTk+9XxLzw~-ToFT`>};htQMxQPy1th z>zr;_Xh9Rpga&FwLiaTteax}w4dAc*`QGs)>cQomxJW<|vXy(P7rX9R!X008q#mseklx!l1YQ$|PucFIPsV1(8>f5j$? zE|JTdw0D`T8YJFg0VYg1QJNo>5&t#kR8{(hUQ!?ohwvDGgm zFEN%_3k{RRm4>BYDv2Q^ad+oiY6mMny5 zSB0X=UV2xve*bo|wBx8UFD@^K?jMG}9b(*n*PMxf-23^|&TnizxC!9R5)h}rr)56r za!J$a{HGjwDn=mB>U`tM?#)R|*I{Fd5uIqytfoRin9Z07;|tRZ_Le4*IzrwYrWw*$ zr;Mi(i=miDcz$faY+WPouOudxEGtWwtw-t4g4?y>-Y`m>0p~)!quI-YN_$S^(37B(MQ&;_EjKl0IcH!wEKfBQ6ML zL19n6LB7flns~ruCS}l3*+2>@ECwJ+VupZl3wd=_v&bMLDbh&vZmgB*7+otr7^f-; ze?BY8zyDS8^A?|l6YsRMeYb*iz(v*?swZwuQH$$Zi>(DGsc~kG(bUpA+~z|?G9H?M znQP@Q(&nAlQs#PbGi_LJw$(KmlGRITi;?DLW0wOoqUev}#;MlG2q;Jw8;=esN!dx& zuYg(OlQF39Tw_xzLYTxqacaN3zQ#A?G$0{*8r7FQ;jTM46S45H0uyOa{C5I0G=uftK_j5K80Z z`=^kO|Ag>?oEuPqvFo_KZc((q!U?7z<8YPH%t1w9NqtZ=RDIRpg}aPIrafHnz<{#3 zs5w*T5JP1Jb)-QFwT{}%%KLtYsoHH2_421j9Sps@;DB0vkgQj~?0{4jV%qzpy3l=4 zv(~>Bo0h2xa2l}9-Qg-wShUqUUZboKiPA6(52wvL1+O@ytka16e5DD*mlvkf?2BHr zBKQebwwO8Xa=*4gy-#aigX{PZzbjgwy{1Se59SP&__=#$y+t81^aZx{`4Tv`Qs0-H z8d-h^3h902jUzQMB6epQ>Y>6NmqNVQF?Cr(SFf{#Q5Ab(KIl}4kd4GIc?Q8~_M)=3 zaxVuB!&EQ79%C!s~d>riDFnNp<=&UL+cMo!MjH1?%x5qiJNkG ze62n34#%fXSGQgjIWL>#QsNx{85b#~T8S_#1EH)H%}b9}Fim(+$B2YM3%e&pv>d&f6dLbt8&mB~l9Y%ug+%Q!-yJ24?)sdiI(mN@#kG-+y7 zE9A}2Frg_$Sq_aI6xSNvMS)*8yX@h@jZFbr`CN{zB~f30Rp;~OIN&B(;`ipA{{`*1 zkZE85ebwjs5xXU8nGH!~B%U;yxfD(x-t)-XW@!*=hSfzRz3Ix~9Vnb~gf%#1I!`#m z&$|gfCKX0Nop05lK{D3{2VpFQ$mnHgUgKWBK4(OS?FMXCs!H{47P;$G;r*S0N67Ty zt&GLSd4=Jz$5Ksvvd%I+Jw^49DhWbFQ{bQ$B}BtYU>t<{7*wk$z(;!769IsDXo?lMvr29*IO}NM8XRmThst}O{|+?Mdo}|ZcP^Ifx4t55yJnSg z(nfaeN@#&}zoZahs|#LF)w}7e@S%q9IxH;&0gFP_ic+ASslJQC2I!KzZyV^xaks&? z=+MO$#arR2QM_R&6U%8DW@+Vz=Dc~!Y;UIm#Pz*|P{U$CyA~~kSpi0riQr_GdyQN^HShkW84U-uv({x zCv;cRL{WM~CasTt6HNr2M9(WUO|$)-$_1*Y^)=dLpa27Br3_!2xE9|z9in{ms5Zcr z(|AEV2$c&2q-;4=Soq^ss90)mvlL9gPtXBn+2zmZeqes;9Iao__!7`~D0$K#w&Arp z2MCT-!<~aIRam7_nGl*e`f4B4TW%S1GwGU0eaWLA=^q?nTY(4TIAdyV%f1z(lySM& z+dAiG8~^fFq%TzH`u6@s(>+%IbSC#Sw-Ht@YVjc2>9z3nFE(M_a)*;H%`nG)CU=G! zFlT9C1JJl$RgDdgG1LrSq5VtN;==1;8SP3w$pOi}m1mYV_@<&Ou(<#Xu-U4|7S9r~ zL|>t_{Va5qZVkcxb~DHsT{}o8bjK$XM7urjFn)P7& zE@I7~RpzZnmq6LNA%9B}acY)O>;fpGM&s6XTUJaMoNSxqTp}K!SRY zxey*tzo$=&er&EW4tw7wq@d-d&&Z23DCn=ekD}!Q!*1vqCAKx;=%SRhHn+mxvo}OU zkn&Ny4fl=85p{CIq)I-B35*VGRd0Xx@hW>87{rlXqKw>xJ6vBt)Tm8ztWOe-X|#(( zAPxCXS$g8q!3nmmuxNZ~OvjWAS<0a7U3k%PHKaKJ<@Z6#r&m#B7Bc47wXluiL1Z5^4pRhD3t}0)1m94RRou9W zFh(6;LpeaM`df>wqNrA3-j%pRUx+y z*6cqM9R3BpfT6*>+%N5*9YUWV@O04hibkncRi`*OyeTL}WFh1RrJO5H+g^IOV?$(q zw-k%j^i4MB1^O_hefvlz{RKVg$J6sC1Y*`G_~2prD^T!`(uL>sVetheU%adI;22^; zL)M1=>_2e=xS&xjvXdnN&HmbUog#z6=DEs$E(v8;-)0`QclY?om(G@%Oo?jIoz)Xw zN9KRk$X-ksFp06pWk82P4^aGW4+`~(2;m(P_bMa`dkLQES1t%&)_RsWm;Z6#spSEf zdVwHv5mZ5Uu=LF1ghxqW%WHwf#oiRo_A0BB&Z53m&YKjiG}vbMH5BP;ao(LnN8+pP zSp-aX5~X*PBA4BK4FjmV7|WLarv@&{GB{gIut};Jw}5PP8r3#8Zryr`O@eKCLw|bd zdd;w^+XPOgCWb=0a$QJqDm`k(j~nE00o+w~exy^Jt$BVRg{1$(AKw@@SLxXifa z>f?f>(Hdu&`P@g^6UH+K4#6Lgh@X1lfu3T=8q6Egf*QL{8fq(J_Zqj_0aXq-O9?my znfl0=LRij7iC=gwHtE%?r-pMAl4@_?%iump@O6S?iF}sgQH?@)8nGQ*Xa%W>eZ+wC za)ey04V8kF7DbvD_aGuC0C_idH=vj*%BCOeMK~=b@Eljuof?^LpCM2GV0)%4;mc-8 z1Q2VFW|}D?Hs<=O45!rw-E1d3RiXK}g2c#X^9GeKg}fZRCkJ(YONf9(UiiKikGZ3X zs<~YH?4KNHa_AUQ@Fz9>(3_9VZEUR`m2DGaT=W`U8FfEK)${DOm?M@PWIwcK9x8P= zpaUd9&frvbdLmJk0^jlYmc^5l5Rf5iJggM9GwGTsV$cXodAJ`YSD!sp%GU#~>n zr4-A+w(S zLd4lxG1@`bS8W773?C0oU|ggCXoB5=q^Zh$4{Y}r%mStP%yJ+Ax2-YZ?U?U`U!ZIW z3Xw=XB8NDQi{w|!naeLYX(^%ynZbabI@o$sR2Tm4YjM!&Up;fn{6dMyP?bcaq%eKJ zcxnba^| z?Un(Fm~x)LfHrNKG1UB9MHKS)Jm{SzEFrZKvL%PJqC!YDuq8frY~5HC+-rb~uw=G| zS&pMx&K=%-!3y2F=iE}i86rfc*3P8fC!ZG!WtG8TIm^+J)tss!Yf zZ9iQXmIYBIJ(L1K8zzr|0z?-_jt7<H~gNiX42r><L$;HxN_BsF8-#ki|$N&#!D>|M=@fO8M8 z1dtnABnp@ffXZCNbUK{1h*R+f`@zP%P(Q)eZ?!9T!LhYvxy%jODvXcGDzKkUvrsoa zn+H2>o0Gh6-;;+87Z4jR3_uoYDRs9!y#jU_D!>1<$kAgU+Gm8sBR{pSP<&b$JomE_ z)~mavJMhc8YEgiy^XfwHmTjw_AzTy?vN;qC*^$l!gra7Z0_rTs5@*Ty#Hh2GSqHbn zf3~Uw_a(^{)fbwg=N1x(f{O)}HFp@i*o<*h3y0mM#~>Grk5#rN!HK#q9A7Tx5|CbX z#I1@MOPaBWKprp$F-fp+StJC$CfHf4N8o4yL)5B@IBGzS8oZUZiOr4{QiIEZPaW`6 zkc}U^<7eh*VQ1zP#mdZ09JjP3PHq_7B~D`ga(v%q<^}-Ssx@j|m4a7IeipQbv-E0c zwDz?h+Nubgp~rQC4rl*-bBwUy{Df?# zir>|W32e7_V*=r7=u&~fsud&buv{)vR5BYsWLt-pMOMOJ4)~HRt!M&4@qbR zjf9nR+a=2tnsY)zs`M^kF<{ED6_}qz_lH~iPlIY*a+NxMR$+#(2L{9SHFv&Me$O5Mcw@!G1tIlF;_ul>{Za>E&~4>iYf^9CF8PfX*9loMqPU2x1+6z4Dic8& zp74%X*!!VxGtpCUx=bcEoD1*x+p<_W}%7w;|4IU?w*&(C@?T19J|8buKz6vR9W z6B7$5StwAetIuv$1Z$7m1$Wt(O<>p)I@Nk7e3jrw9*tO_WZS9?a1rA#efrXb%mRNn zS(o18IS-^q&_dD=O%hQb3M!N!Ld#Y*9?hfX%el^}XOG?lUX_No4neL;sARrwcn7$o zVt)SuRKT5kiE9C(C?8CZUXGQSp<}6#h=EAp3UbcmyG#7U400zRYSl!(XRN4r) zhOMd97rLt0RKWR@t7{e7Vs8^`tZqWLb|ZObGqztbo_Sd@wxn6Xz^cU; zKC75m@UmiRA!7|}^Z@-%eg-t^<=!t%z;8duN=7xUNqsNoqlyERU#X`UPJ|#)#FVeU z%~WLM*nz|63+SffId%8{q6{>c4aafCbK%9D_z>AyG4m>dTcxw`gtuX~> zU{^mv`Rf13dI#W0zPSB2w(VqNCmU@xwvCOkv2EM7ZQI&p<78snwmJXo?|uKb>fSq5 z-DkQ7r)N%m>vVO0p698OFZ#mOPly!r`&P6<3Ocwnne*&9hGSgjP=u5Xr7z5#`M#K( z7i!wMsV=39Gmf}y%{>-E0KLkHg-oz^V2zUfa8WbgwuFvnx#iftgnsv`FlilKSkKRB zof8N0#$2d$2Bo~sLT5os^yb#G>=3NDaC(?o1s#uJ}`RrG5qG(P-cl}czUVhDtOf>80Ps@0&pCK@@~@VfitY?4LXwS^@rux@4(@L{gUbQs zQ;Ed4eSF_?1D&ewrW+Jvoh(vyQX$V@=pD5#RK^XjhP37ie2R-PM)A~2E-wQMQhdcO z(?Mn!`Ct?V)DBW^#x?VcBcbZdIi(6MImMJheV#-aa+xfL%Hkw}4}wk>?YuFGKSS=K zl@k?1i^bflduBe|LwW2gPS z?saJqyO~9gwc$GjJWq3CQ->IJ@+&Z*@>@Nt&$Lj+k*AIWiYTz_sUDvgz;%xTJl-~g zq)(}U!tI%OOS5af;A(eNM_ixM{CacTL3|0K8cPnI(mo}~h0xUGP|)Jlsa!W4fdw|- zNltYg2wE~%;qF!hV%nA_O2Tq_?H$7adq{IIyfBTcr5WO7qfsp}lJ<0zP4d*)(}Wol zm;Kt0qebW)(09v$a`aAGCiUNKW9Rrjx_B+qJ2_aLtLsb85<)!LY&Qzc&w3^`!Q&t0 zl*JLB0`#DtE@|tI20pF6fqSGOYs%5?$oLs?`1~Zz_fDpcQr7vGotH7V>%f zTV75z^nFxHa0rJc7T2no1`Y#!q4A&6=#=1U1U^ly>Hqdji;ef2X_U4624y+h-tdMP zS~pghXaP64WWYK6P5l!Js<$dI9+~X;;2T8Ox?|nAi9h2Sj03LU$mbvAPk#ojXtQhj zKZ#Nu8n{GH5LNTLC+fkE%ftUe-ONMZlnu|#l$Ou4F7Dwf#FjSr8Y<=-J_J zrw_N(vrMU{m#z+t@faEtl}5j8X|ARLs~3mfZ67wjRz%hlz(wxcG~iczc=OdxdjH$= z?{&k^)~^rS=DGY;=j^ZKE$T-#G|s6v`m3IPl$clZ^=(`6#AyD6bazoki~rkAeRQ(B z=2xA5m8;EHSw8$%r3iTc3e;p|ywG^a+q!9@sd>iq{Ur(xLSQn3J*3u+xCyJI9hh#jazZN-s)|2Me z?}?jn*uyd&hLpUf0fv;_U)!3ovFsjWkE3dNIOFn7Eul(2230e2YeZslL-k_v!f*RD z`|5?ImAn|FKNpW*mPnHgqjUc2uyppnK{K-~GzR?|SG%vp%(l?@_ekW|s)?Qxo#5X{ z|E?Y$#^bHD{_mj7ZIQ{|555KUM6r8(CR^O!^XOml_iKd-9F%plICXlB{?Q5?VfxY) z7k9AXznvBR=s9|whyn7E<^M#{lwwMTfMH^ezEMTU*|rkoEJdXmt804Hsgh-YsYJqN zBP9?W?1&q|T!eSZ*~SIk_4-HGu>UVzldVkpkFIet8&D_qhCXbR+vUv?f8fCvre+2i zR)mO)P2l!p$H6Etk1`DbEH7gxgwW460aO_4)gDd;-JcYFU%p40OEgPGe)%;JP;d^i z_Uq8s&(G^$g~GE|k6M0I_1D=bW8pX+y8VV5EZdZnAWaBSIHY3##crC1jQO5T{p@wD zJD~<=$-he;ISTr^En|J_lOBQ{q>SZFJt3t}R8$@ZARZgf(Rl{;n+eCP1Ngw_UGJGVAg0m;X9BA7KbxoT4O&TrBCE)@N zF8Acgx%Y;+drG~xj2fdZ?Z`*l|ddLa9MOMLD z$J!!eHIeG$&^v6VE$tj%=g(UmepWU=Ot299?b$B3JKISvRE#VoC*{1U#~xnqr-975 zC8j6;>$q54IkH+0+4eerLtHBOF$Yv8_|vthm5^s{C*}uS$?rY?p*26`&NRQ!n(xt$ zr0QKH@v;5rq=5`(QcHpKslOVvP(InR_MF5DU_JgguFSsx6Wo>7t#dOv1R#)Mr+_+*~@saN5i zFfvF(2q%pd6d1CsKM%TV6ylD74*DnUha*@qadXK?WI>r2oVUwZR~0-{QzvxX0%0r# zB5%2#{h{KIY6s0NVP>tJFVXUBCtn9Yj&A?}&T0u^w8_aDbQ3VuZJf5kWOR}Q(A_)7 zZ}1W?@rj70MG@d(Kcq!*TcF72en3|Y#ixbFrBS1Wv zcCdSm*gE&zz63Cfx5%Gi|39jR@gG&=>HZ&8(>nbBp=uJQkw5|9Im(z)IWig|n|<`# zg*zj1191oCZ2S`Rj^EQ+zfCbk#NtMt=JISHha^7VcGbFnPORCKZ$k|9>Xqws^fmDF z^jfLp;mZ|6P-!L-1jr&+p;sJAVGV<$Nz@9)m$>X&28eW9?BpvpJ5iNDwzj?JlbdsyrCwz*uc*N2ZP55P6l&5_leeK;Pcfje<)u;1KZB;zuJok70g2#t~$JpCf1KMsia7URIF)AR7x zsVG_moW-uX=f^a7nZI}8kW9Zr`oSzY%H1fTGKaEBE-Xq-; zr{`7g=e2Yl@L+S(Rs0WeFK}SfS9UwscMa$O#D3dBetYxu-15GAJsXcq-J1K*>yf_O z*YtfgzT&>U^_-G>eCmCl@QlEmmG}>*spkB`X?hrGu+-0Tn6&2Ji;6r3on0e`4UTz@ zsh*f?X#|Dj_BoQlJH&~r-Bv7O@Q{C1Dv&z_P+%={_-V@gl%|BiSk~n2265Gy+hfO7 zxHX$si+YW?T&%2htDUhy;b)O6S*9n;X1F8lx->R{BSl;6zJB7H^O3BH!eiM{IUOlBd-=(jRn6a&)Vbd3}#Aqb;e7 zXl8nde58utvHZ29i}{gxcbP)~xyc%_(V(xOt^}N3SU5E(>yTl)I#h^l7fd1*IZWzC zURuVGR2Zw^Twe&yYZlh5+|KmTPn6&;5STYbY|{W?H%#F8>K>TzfQ`8?^4S84gLAf? z=l}g{UO%=A;UU?>NMIvrlqx=6Ij_qLsXHd0s!;lG*fkIj1_(HJAv`c& zjl6wSIvIZX;%AWl<7cWJT(7#pMT|v-Es@BwPw7(NM4~#Ky672xf4tL{!P%6_-Nq`5 zB+7_C{>g`<=e8mUh)Bod=e+$+PR^3}vOm>2Z0J29bYy&ndonYGh)USr`j6>pyS?rXQUlPvU>U8E6G(IG$h_6kKX8Bqhzz zMQ6^PFlitkPK?mIv1cVggm(yt;nJT55Z7?2yZh~VonB*N!Mcd<@W(pa5~5r1!X^w- zzU5B!G|B!wDaN(XYVT)cc%-9mqYr@yibJcM1F;W!#isZuk}kUZQ7#`EK4g7C9B}j# z1OHVyzJJH>pQVMby%1Rh7`JFf5dRABvtjh0M0|De;StS4_#ZU0A3Hle4Njx}M~RY> zSv_VIn+~KhI(~BFC?CO+zAz;`*(>G&QAesyRDS1J`Jw{C)9cX3JjBb#jqPU zM8sB-WEC5y6&l@#YIu-bf3TdLZlW65N(QNG*6?qY4 z%O@NWk`rq z{)d<$W*jM=hZzrVWgmlJ16C~UCu2ggh6Msl9 zAuT+q+#p-6f6IV}BsM~Ar2h_J6q}xDM z{+9Y!zg!uU4wL)SS8+)~aq}mC9_4g8Chd>3A;Gd4dsJq8+0<1r6312Z@(&Lz185jS z`qk%yXsqo^Q{cW{s{E7ey3_hla3v8(n%hx*;*R#P(?eF5*y@w&3s*!KIgfu6y`zhA zv38v<&bV78Ij*#`E$AZxO}WJvHRD%l%iMM_a36OQm6sQV2mKaA7V?vJNM2R%%4r3<<4nGI76(%fa5Fo02xL^}N&ZVm3 z<7%AGJ$p)G=c%|IY%FZy!#W52=mnCkDi-5XOO(RRev1HuEnlWmE4LJ25oEIGWFlsN zM9D6eQo~WecEdM6@6*#ZY1LSMu4c0__TFNal%uV|PNtSV@@Tym-gs{@)RlB9avM(h zZHMvA%E4#wUUR@;EU62AsBZVK#2$MoX zVD*Xo%SP%^{nCn=fb-ZAU-?X-9 zMmXEOEAQ0T>5}c`F1y6D=M7>i^Kg~G#vZUnit>)KeRZYV%(7TxwlJ<8xJ&&zA+J`j zPa!D`mX>?I4O6gGkmn_RqbLaI@$9&=P#a7=JA33?r;RS*Oz2bB2z_O_$AA5YBwo{E z6#jeC%r)MD^=8?kP-oepI&8KxTS@|63%y z29hv$@EmTKJvj;q3qy1{4AfJ)HEW_QppM4O%yA5_%0kz+cOP89_e&8Woq>|#s{ZGr z_Nq}ccXhmSgdO3K>bjs6&mUjL`8w*0`YO0%u9S=aBlR`BThF~P() zgkARj{6Ey!U+mwZAnio*3#OkpTgkQfCRz?^hy5zOYu-}urg_sn`7KJ`dEYN8was}^ zOKQ*r4BcFpG27VmQ;!2tW`f^iVn%jU?cbmQ}mKJwJ2~ zGj>mOzhLfpCXN~r2XkJs>1pl2k1WrhkoFwu_=? zts~m@7x7hfs>?oAyyN^h6TLv=L#>xx_Qch|?D@hKY9;s#DQA8x3A^>PmQ#-3DT3u8 z+3r5K96jPZ>{-I_4XJ^TtxbOP;N(hD3Sh0-|Yj)P@;%m*6l=Kyxu?YJ& zH~W=kMHf+U{FN4D0HV!{Iy;p!l!at(=W^5{Z-zZVf;mxd?$Iq|r@3U!A@oXZb`Pmb z;ws(JF$LMUrCDRFkwRNP77j{+@o|IFgdMdbfiNv?x+9A4&I*T{P5>+Qy~R>U zQ2Ml>pof_dCDVl0W6a~)+nA^@zkt^KSds4U874*@j&qCuMZItcT9JO*;>n{<{zJWx z(Ep)cFj#rR@`_=>P+Br|{e}h%FPb2QV1re%{3`=t0N9u{mI>ACUE6E@QPahmD)$@5 zQJ0!g>Mu<`XD6v|vH6$iAqz&2Rf5X!wsk0n0ZK1NhdKdL53|GBG(4rtVyO7Y0AhH< z$z&&?{ClU9@KJD_MV$4K8T9uU7ndk-w(YJ9)yavA_Sgy6({Tf5{csefIT){+&c>_- zA^l%^)fAnxbMNK62g$<-KmVZWI7VD$Y*tSyKJ=~|MerJ_6R)Kn&f5qD>8W}&q-lL& zUP5Zkkj6t7E9Z9Vv^0$j*NRj>EpyDF!PYoOX%`tP5v}v4IW2r_oSYx`taTmmBraNzc_a3Wg;nt#9KTlox&PS4tpH z9AbbB%}c!$MLvdEw>11;yvyec?-KpOyS`JcE+sKabe${Kto5DK(!(J%C26y?%_GX0 zFDY3To%a8s=r50fpwrg`pgAe)k0OF%o;X3?XzAdisPKSN9E+(z`Q1SNQIt{E6Iu^9 zPex)W5qzHl8y0nn{R94+SKl6nGhRO*Jopu=Y&UJy%hYz>2KFD|1#V+$qoVXX70fv1 zPneX?guT@P=wzk_!p(AT4X-22r^};!rLbQ8wFmc_+M`;eIE~}f$33*TX_vj9Zv^`?5vROOra9GR@iw zg|9tcU6a#L`RpO8yYA8~FQhn6ZQzs_C6PfAa>B$UU5oM^a50$?q_ywfhKR!pE(>_B z#p5HK(qUPN+UjObnxq+QcrlFN%p)KRQFWj*$3F>hO_lM`H({Om!}L@-E1n5Kc;MSu z6JfP0Ll-b2-2Li3z|4Q_{zSjsf0?-}{AhW=M=y%j{L&>85@T+B!^CQ+ZfaFtvEqiC zxL=y3j3`(?6w|#DWwOZ&$|N*{YcH6!3&*ep34$OXpiS{vrzOLBY&Hv!Q=G7YX%&p@ zGYg7xtk#UnGL}xFM%@|C3R$|j1tFKz`CgOlJ*G|@WrLu-pMRMpM=in$YFqJ-?b49{ zV!K)f1UKeOeqpm`3%#bCC2i#4I|CM|s71#FBFc-nIfWck9P4ln%tH?}r%*}!7qq^} zF47ZVk&=)z=cKQ|*tSC@hB#>5nIjXmfk~x&CYY1HiagmxyNz$znz0DY#wtF#_L#-Ly)Sx(Z~6 z_;r*c(yva(`d|nFHkHXNH1!1}7j;ARkBu@C;BH(K#NVar2)-X4=*tev1=(KQ=x{b4 zPRzl~%xiAw@E_Lotz)k8|BZFY^YUUS2_NWOIpT^4ENUiAa-yE zX#&tra-dahW37iohlcl4mcK%Tck26Fyyah>_1J|unk(0?qV<*}j(Q#&-M0Q(%RHK8 z9cpd3haZY8uH@57Mf8Q}&;EwkefDeMp}KRtye!f9%muz!nRGwc#Z-d|>(03uzU{lS z9RhtyA{!WTUcX~sOu6lywnWNw?kZ`3+EzwhNqm$o@?N}LUvH2ep>6s?&4S{mo$TC* z$L*p6n)HOJ2woduQxQp?@_qgU&13#ljVb zSuQs0p*)y$pkae9*!A~xAIl0JLAJlz3u15w7KQFOEl}4OkWKm}$G*%47aK6;5OuPX*5sTm}JHRIsTL*i~Nc zFNqp<^G|N4MQw@za(KeVIQ?)IxsrRsz;e_qDpyzR&d#sNASda|R5~`1>Oo0^N3Hkb zGxsN!XTaY%$sL@Rai)?wpl8NaEe9$=CDc*CbA~6GD(-%gLNVYmg7kbv4yd5MkxJav~r`B zRpYCECInPOlS@j*+>BmF0Qp2?c=}o5xFP*M#c+8Glg_NmUAZfgA-z#Ld(|>Bd8DF5 z5gClS6avQywbXU08Me5E7fst`**Ay5lVNEXNE)%Z(~glKmOWC6WoI~>5~Xf!D6l>! z)zFKE>8!pOvy_c{BsLlZNy^MQrV|rG2~v8=JTZ&8m51>3loYEr!BVpvDo)5$9)-P3 zpNoeIKQz>Eb9$5>Fec5BcJtO+)6gh|z*OV7rw;hV&&IV8i3(3zQc!pv|A}rmy~u@f z&u0WGa=w8AVR0u7EEOcs@AClzKMeygAXjjplPV9}0tH|gG7Q+pzYmv_cThI|(4S;z z!L@_bK-sL2et^F6oQtK16 zYm?O4w!Iv0cuyDG0>_7O8g+E=)8~RdzM@fRZ$4U}Z{V1yIGe`(*-|ue*{-C8_*=lr z;4gMq+9RiHt$l|`V!;yZ$haJs78L*{Gz(U-JkDEoy1cr+s9Hdc{BJu6%pD!=&qL|Z zK(p+i?-3aUSDpbV5bUp1CDT4DgFP`rEIs*LWU0GEh9fXED6%X=6gE@lTa6kzF<62F z2b<4nInI0XbYSt^m2%yBi6Kx;@NJ{MZN$}piO$6?Xf7W|yf!j~)$dZ1<~PcP>_~cw z5-Bc_gMixbnD1Hy!shLz;6_r^!xZ)eiN{(@<&RyDZK|LP2KUko3Xc6`!J;jtf^*FX zPfO$!)=0z2u)R9&`4eX3;c;faKJ~e6)9P;CorHPLVx2-aTuzD`e_}YT!LFG{@c$+_Xy!I7{P0UD{`S)zMns=f z6U<+0a~Ap7zNXr`^gyEyT^)9-daUl%ETkP_xyk&pBX#x3rQp!@!Y$Ip_Y+sPXW^uC z0zUQiMY4SJ%a(j2Sx3n)ds`cTTgq=v?37tDeYwSrl?dHzx!TNH_gMsLYQH9iu+(k;Wc7d@<#ENwm(oreT@#J$&SlWPJ<(gf^#5OY*6`E zJ$j)~O|pL|AOi)ag*Vn|YW?p4L(nbjnsjJ5UKW4H(9Q@{=F3jm>8PM*t&#PnSl2*E zKZ440kTUkNsV`)y-VRDp( z#dxDNlC&MZ*6R&E0Uaykp}(WS#XoE{)b$;=1Dc8?uw_kKf8Iq?n!{>_v9A7<%u=NL z3}3JfxqKMIP@^|aYGqdMy_TCP!B)>dB_+RRlg{pC%~ zB^;C3LdW{Fu|n=x7$lZVKuB5)b><-r-i4?zhcNDm9Yv$EAI1^?dQ9c=1^0fn z&Ar3o@-ckCjhnfn+^@Wk^Odj62Orn_=ar*jdEd~OOE8f3xHRCU*q{c}S?N7nT!cpMVW~cSAwP9qz)hiqUg{Qiv zv}%GC)k*QClWlWV5xW65UJ4iQB48}$U+M{#WF2hXz6F)x`OzJuDSx)_nw}ls4uXs} zOoJP!MseiaUtt4GNo`6>%0q9W-Yg=GS;|rygcA=?uhqWW+a!V8{&rG8bkz4aZg#rn z0!P%Kj{Ui0B8VKRl)KK7AG<82M~ttON`4swa)+V8-hfdMko3EYNhJHp#?p!(546 zvmfE#_sheWiRdMwqJM=IlmG1QdfpjSJvoY)EHJ?wIxX&Ll%tSEQLNtIQoKq&$Wv~_ z-pH_5VHDIt&~fELL_j-LrIUtrrsc)rGY#i(RYA0;mHNx214*xuAXDs|O?98!Vw)+T zxCZ*|Ogex}*}#!E7JJe8d9!vViVg~3!gb11#OeHN8U71B=Ebf$J)6mf`= zWPz~U5qcIRJS|Ka36i}ORb3ne(kdGge`A1Zw7uEnHPrH!p(lxC4Xxwe{0+6spSHYi z?%oc@EREl#PLELqUQ%7MHmKagsm<)t z=^5anJTxfsR!&UvOecSYi_|=2cM>>Cn12@>w?&A(DM8G?NgTxHUCr33+wimL)<0z~ zi*tdCxDG9t20!i6Que8xV#>7|M4jGlc+|EATeH&fs#Sm?_LxFr#hJCNJ)6rjHV%K$ zTZ!Mh*MB|ce({*XDr{Vq(Dyw|;_s+;RQ^kQ>!1Rb0iF>3S{QYQ#CcHZRlx>NBnNrh zq<7}Ft7v3Aerj#ZIMmuzGjpSwJC=1K0voc5(8HTfE@Tbv#Jim@oeq9OK&f%k#w>C3Uhd=B}Rv z{aSe2A{wxGNi0Bnti6c^34T@I!ifJY=)Sfq*sFLYEmStKI|>VHefL&92K$xKvGHXMuOfCJlnX>I!x?gB_)d3rXWI5}$bER{8-hIc8zFR18@7G7)}Nu8bBxuy#tm7U1ji_VMttkTN2$^uqsn>wfUw z`+hop^Ug2vcFwAk6igN?- zj68Y1I`wsL^7+(@IRXlS%- zbXl4v_I1~(1qgryrA%?l1{`yST^^By!yk9ekVxkTdhi{%FUlf9rP!1L6|L!-_5gNv zqoB7DUrX{QMS7RGMB5sOL!j2{n!^=i){b@H&x56jK1M)`;Wn3vH3(qsJp_WZBkX1! zLJR|1?#Zc4k4u9{UXMUl?|c>e%wIN%R+dx>;7sbSUee{^tk|lVzKIpcLN@=5qNaZ- zw@%#0x6R@-k#xTbbA!-Ka)apqH`9X^MXsC%?~rn9N@5~qGtAV3|3^1Cgwundt`Of{ zMK#Z}{;^u{k>T$gf0rLI>9^6=ZHM4feAE7rfl}G>zwu?rh*oip{Sz&5pCou}~BLYE~jxKjh6md0I= zrXqP((HOGdoFhKFSjZ~W*~XlEcbZZ(0xzR#ML%4g_0==#F@%w1L`hzERInwLy(`+d zNW>vw8^OUhX5Uu)f2AJcFQiM^dGJ#q)4s?~xX7BIek&lhy65vI>lG<&=p-e6q?ZRX z=F2w-Hd9)daO&HM*yapid5PJC#9**sbN8VLdJQhuN3`Q7K94`ysOn!`RL6h_Wge9OI+k1j9m`w2wl4^8Y>RG zf}kg(GIMnu4pHjUtC_-hSCF$pocX7{|n2tsaUQx<$So9NNB`q&0ref zBlKzI&<{?W9G_%QtKPyT$aU~AW@1WBn4@_MgFu*5S;RW^?F2!{oJcg4zTnR(gwDh! zi+wrTuk$#g6FHEN=Q%*YwgkQ005i8>Csi-^>&DHcoQ#MV_@`+`(CeR@yV?@*xx$lr zuRSwYsv@@>W=6BV1N@-7FHKr!DwE#G#UA+x>urVGpj{(~|2R(s#__^X^6s5{kXBF=4vH;`eY+vtd1g?tHu?+F-FGZ1G$8GeS3tQt83dD2f0t1sH$RI8+$g zX9{}qQoxodUZ9%0SmKLn9m#K^86%(X@@XG0@8GZwt@nxN!x$=Ulp5MKc7dXGoWM9K zg+)y69*VfI#YwVA))9^ijzBD`;{r`v<@n79ZAA2-y}A;#d59hQnh##tKqkFka3xD} zajNiKh#9&fiSGk3`tdcs#VkVd;;!bCeG0!|CjmjIqD@%x2HtXw_^przJq|OCTx7`4MEeQo>ES z1h2aPS3uMA!3}ou8}Q(+cIdel+MJl5=o4Ra_8Foolobzkw8589x(?zC0QtN?(au2z zS|7a&TU3Ngbv3g85Tsq7xssKcIo_DfPpg25lDt8pZZ453N-7;GNldZz=_S_?6Ati+ zcgun}9>>0x$J0A##QpGdp%OJEhuzt-NHLAmC-}`hL?2s#`6?bm##Kn3)DJV^+i~}! zz$5f2m_WEDcx^T{YY^goBON z9)X0b@tPT#L1uzGn#m26VOLZhWjjQ!=Wz?$H0PD_up{+^8?0Dye%Pg^SkF_QdD4v3 z#O$f}X4H4DGkJ5q&6~OSWGmJihd3Xx5ZE{42_Has|25TNtG-+fsxgTHd!fy9%^8~F zpDN~|T~@^o`t`Jx;Bv%N@;0`vTDo5r5qCE>bbQsHIwgD6J(6~e{XeIcP-|iD^)T!t_4*%W1W^uh7FeR6}jj3Pew~A-tvjfPodtvA?86Y_OJ`6fWvJ% z3j_uDE|tq7RxHtTxy`LHLQDn;j9mKIVid%|Wwqe7th+KgZI4R-U84LQn2TL2K!6=B zFxBMzN(pJVl00pFhe8ASTdj@MBp%)wb9&j;kw>(^FU|fQ>4EZST4?Vj8Iw+Ck4xCX zqfR*x+ZPBgn=rj^h-2;*eYVlCkfkc0E(}VZ7dIZ)#shA~<|;0#z#O$uq$WCk4rl9L zGbDnK$-mN{i>u6^wR)N(jGtfs>%uD&Q}4S&($~48cgUyJV?#W2Q>Qg9&6_kh)AFq- zy1cqa{)q;@t$GyAi?C^kW%vAbI0L%w9`^W$irY~0ly*-&6pWr4A5Ei{ab8ugr}k6L zK#rd$$OXOSca-r=Ce)wWPOP7nWoG|e`<)`4~99@iOFi!)$uhkD6wqd~o<82#SXdg4Iy z#~Fgj1|0*>?~Ch&bN&(8!nud?$-LS30`S}B?whx=M0i5n*#g8ppj1nf98p~)@XcWo zcovyDtQYmZCEPSMoxUm!;khyb-r+-(BJSX8wGF}DYq<+udDX;Yvj-==Cp}chbJTHZ zu{;1!t@<8rN%-seZ%3@ouX-X8y;@)O!_39JUvGo<1K3E7&7X?Acj~P%M?`1S+G-mX zF5@d8mT64AsvLicos%E5jW=jB{ho0utqj;U?yHf9Ectj%8ht!Dc79A{5pk;nnyst$ zxbRKga-&Q)@^OYd7ay7cJ{(=_4tcT5A-BE?AY8EJ0L+;&P?r}V53u1Bc=uHj|MNQn z2$C+^z6fj07{I&w<7=|p2d)PsQk%ps9Bo8!X3#i6e?K+s2K~e!&X=0hCyNdu%h`z| z3ehI2>Y~IBN&Cgc4!SpW97O2v>9MBZwHA#Hq5VZcVP^cqa7lV^F-O+t+pxdWDDdo| zSJ&%ifg1RAnvDRX9J!p^4rcp{jG(ngGd{dAfgXW>9`5S8NP{(Q!4d+Gi!P|GN^l-f zLF)30PRJw%CuJdGRzst0f=lG6O3;XL%5ae}o_fts1s7cJK2REA_j@i$$4g$CdtN{xoS+G|tgSbuC(nAlKk+%wC6{R~`^p#xJ@Sxwl5g>FtYFN1ap7Z*hPSJr=eV-m)Udh8hdg^;BjuO&3ldYWCG zw$#Bsp{mHPq(UbMN#~aNfZhOCbDTql>U)JmV%TPtIcni4~KeMmlE zE7TiJ+}ih@47S}<)DCARs0j(iR!-=H7Ge3>{>+b5OD7?!q0W#qzM7Jzs|>pGqwaUv zm^^5tVOEgMuY`e9Srz%ZF)73al@|Oatt!cb7QsY4UsdG=U*PN6&M;|!CNB$(ecU@} z&sJuLlU&>T21M0((Fv!P3IU&Ei&+-1Ob_CbH6_GOKG{cGO zGT$zhkHO)xZEGntQ(A*kYDJG;w8to&QxJG_djS77@1!JmxWgmIN~zvgfbQh&va)_M z9BVf9AYn;j^EQ_oJHr%4*{>6-6YkOOc+bvLuiigHV43nf4qkopOlme=~lXe0as2!xB(n3A~F|iq(MA>4c z$D^Z_b1d1q+R2&jxxLo+G9k`*@{^~5&*`eMsjPe6jt>yQVu;X}!mTXUQ|y>=XqE3;nVl~BG4=EaYj-qO)@=Yj-q|Sj8x)Rba7={whUn`iX2bkCJx(jDuCs@>X+U3h^}C~RSK(5t zY)l@^!{iHl~$|({u4&^JcgTxcM+)6|lN$u&6_9DX?^c5NQ)~PR7_FB^O0S zTTO+;>!ox93qppMySbm5mH3na1fz{gW$M1{>?TfmPc!Zy?+)C%wY0k4)P zoq?oJES|8?QQt+a(&^V`i9qYyEw!oGUQUnCt_mRG9gtUn?hUAPD;NhMl_qncYJJbA z5cZMH@z_JEk5Nc(ZmJ+9I`)U~>WUmC5k%euH&TlyVEn+5(&i!3wBo3L&qfaIdb4xX z9HYYioVSH1gQ#~t*?9udhJGY@j(W;Y zWrMHz8+=MRPiu*$v|l|f6~LTjiY!aDXH75+nw|m)pBSqvnUPCboAnir%TSRBJGdPP z&?unomuc@Kh301*jY&`lv>DzQk9-Za6m2-;VnlG~|1`hqmCpwoS(@5JC8)`{02Xc0 zMng?ygecUi6A^=8(o0xv1Zzko%#BA9e^ste4Tdy>HAVqJ5#s}-%2={*N-KQCA(jtU z`d?hZ@!)WRfTMR!+}Bje6Wjzs{6{tO@p-HJuYQ>n7DVz1jLB6+JFS}avPfLW%(t3m zA28h@R`70Lr}Ls9ta7G(S9{tkScOou|A38knZU-V+)&hws(QrSd|`Dl;kSQJcsI2wjbP8TAtMwxky<{-JIfS zPyBabU5w>{Fo`L}JAqsVS60Q^P&5^F%GQ9kt=c>UqSD0^N{yo98@0SJy@a~=4ymB& zmvv5hQ4?~fnuFT2h)uwfjcOt2dMc({HgwGox5>p6q>q0W+TGz{OVfE!!QiO{R6M#7 zieLAbv=DKpJki)htEg`x9R*2eIk|&% z@;0n#Qjt9}(kglvQ76eGbwXmXv!d|n6(8W-tiu!r3OhPY7){E{>h7Ki?Qmh2DXm~p zb*Qeur{#_aCSk?lhoMRZuPvkyF0-kWB(ekAF$!4#R#T_{2Zu^`PrrGIxtGGY&y^$v zMZtC)Uqa2#v4j~C1|xUICMb@oiP%#HUaM%w-Xv18fU(7^`YxPLNO3NZ z=3kzGz+l$yG?YK6F{F(c*x9P-3Zmst2y@%)2|bU?JAMfk^^T#;wVFj2d?Xd5@>&!>3K0Vf2f{jf zGM;2KQ5HSAs8`RIn5DFaJ>DKYlD+@{wh7R_#ERLt>qZcqR^nVxZo2O-cG^5ZA}b;} z5P+ogC7Hm|_H*qcwr`ffD@8>tn;wad;Tc{}GzC$-i5f`Hu5Q4qDMT zj@h5*q*kNFVG&@(}jwbp7eN#A-9kB=H1ieKSV~Hzv^SBAALKw;)z}6CSPK~C!nIqCAhQ>xw{@&>9Lim!xn8*rWcu#}@6^tcM=g-BE!p@sUw&+D)SkMN(#URW&BKv&LFuC;DY( zBYR*RnNQ1vKqM$(rqmCdG!u{kPz!J2;(~r@%~eE3oiJx))S?- zz`BV^cJOcK8i&gPn;_@-wUp3?D&`X3St-!f%aj9@S7XS419q3bS#;)vF@VdEBDgWKTl7M$Sj z?(XjH?hxGFAvi&UyF+jb?(V!p_CBZ1_v8D~)zjTY&#GC~Lr<@JJy#yYqms$2a=>+h z#ElJUlIoHuxeQQ(sUYRtdS_P#~G;_PHRC#OWPX}0e6nj z)HN%Ua_g>FOE&La%H+2K;CeyB;(|6Q3iSgs_5GNfat(jJf%%=TW7B1n&Q4LI)ouyz zZfQa$0{qG97RFqY)8+FQ39Sg9uto-z*z9*eUx0zq6f|khrg?xw!S*U#XmoQkP=Km% z09sEoz{Lu8fwRj-c{kcJ>mImwWyRb|$)>UCpTCvz`N;z%sLyTzcEuS`fm&JV4y~@< zG=8yOGuAOXvl+UA>L(|R`JyH6pZQO;MXjybZ@SROG0FM+lR~fJk<`gm)Ic9-K>l~h0G?Qzs zoiE}T;~!5}BtX>Uy7`s;FTYUV7_)X`C>Unw@AzO!vOgkyJr4yY=Aub;P}ER~y7&k% zh_npGc_Rx=ct31eU@%U5303f&2xyd%=Mfg#Iecwc3@(+exZe|!tV5O)jYAl1ojS~? zNJbU>+uF0A;h?ctForYs6rA&(D|Q<5;p$Lelcu~7S+pG*)1SVowB)bgQ|>~+u!#

MwXL&#?QiD_bEoXzrtKxQQ(w4i)5DZ&yZ8gH=0;bQp-F8i4w1{*YSbisUIOnYN!eupVWsb`@&{F~OWc z8=-2Bm2Uk?^|dTmW;0=dT$ZTQ;Yr5An3NdgxQLcE`aREE<+WT@ zgX#<;=J~pd0|M4ts>gST=!6i#g-tyKkugIgC@V=G5tqp|vlJ>@nr}Ae_bfoaK0-{M zZwPhwP9v@CTg9>4SG;rKYH*K_6&2B6VrhjBM4$k3B)&Dj%_Vn}fO7PI_7earpJJra z-Zn^kYFp;hews?2FhrsVJlA@gLH}nzHSDF!JF(u5IZrR;4x9@bY^sPthk%u^wy$7F z?D!)bbB#9DcbZ$+3^w56gaQKOQGQ0_l4C9yfxIJ~=RDv)v+kVctyt-^Y>%S3wh&2p zAd9p?Fj91qf$1Z$f#Vl{IX$dmbNEXgSGIO?T}6*7c4AEJoyUclLk>0v#pD;naFstU z6`?Pd9My}Sc`XK5Spd3E>ru88($Phq?$gpg_et~9eQE}}PpgWAa{Yrvx80+DtI{!8 z6$ar!c<0PkI|86Xc|WGrOKwE4Y(Z9?nHotPRffWIc5xKq$%2EQJbCn-P5@(BG{f(8<)XDv8EEE}o5)i>YBFR!x0#DLkYwD3GE*ek9 zZCZ9y##z#C7Sx5!+eh*(nLlt#3mQq4gKLWZTNg;d;}7*;%aoF{$Da+U=@jyCziF zftu0&LP1Qr+6Dhj#V*-aiT+&>ZjnXj19}zAn~k8qfU!vW{f+o^qc}?MLhN_RdX~BR zUXvYwS#VIul6^|j7bBq+SVWGj$V|xHSjlorRz7OvbiRc4=vrq9gC)Y?Lf(-~5t=hD zg@S#ul0hfr;y4}D-yc&)i2%rtpFKC4 zQLjfpm?I_2^Ag%$+mwZBuXu9JyCz`EwEe(9o8fI8x!WGE&b23L7h|dA1D!kG%}^QA zw%a&s$vm+EcRFI1E)HTcV41x++@BHSh~Y!{c}S$}*LWK&Y@{E$d;A-UmQQGUYz|i0 zyI=grP_$#)2h0yKIBD;myneA*v!jV{gm&jJMl7uey+1^c_TYUl(}H2$C@Vai%l3e7 zIsaE%j@C;9@GoK{Ytzj_!5lC|YZdFe?_kh`q~@17U{HiK>cADG*qDM7E}hsv_^GLB z#&Lc{bW8zQ8VLyhB-jBDu-W_rq5P=EX5vBGx80xJ1DucuS>5VG^4s!q$(Pd6L@^bQG zJ6mLh#F9?=H1TW;@TaGZWmKGt@N1qEJ+rcLA>jNYeE~9FKsL$R_J7GIAfp77p3MJA zPZnahP6?h(K=KKwJPp(SM}lI)vgih4Q274{D4Q2&;CcagCTe9P*osYQ*osf3$=ebr zJT3YPJ9_~^C@qq8;Mo)W;}*bIfjrYEGPMo_+NS>Nw%u6%yKp@kXAC(sPo@7uK>hqj zK&gH1Q$@n7gy!=U06dE%1Dh!T8A^dh8<8W~1Hb`VQb1zrIKUQ&L8Y#eFMvxa_~rV- z_P&o{pTK1N$5D#?hbo=e0P!cF>tt=jz6?a2G=ccjVl=;L5M9eZ;>lG28hD__ZqT|e zM~UDc48y2*|0^F zs{asGbN%8LgQlDce{<>ioRZJwQjaiP4G^;|se4Y>=_%jp>%2QY zen?Fgz-K9mq*!K*tZRs~oe4w21-xm%Mu?yTUt$W>`Ke8rx=wE)&WyftN0Kvk(?9b) z`T(LPV$OPU0>PZ;k^kew&&|OHfbs`!Cv!zEpt}p!%qfn>gwkx|1meCM1tdE5I>Z|} z{U;<2G&pP2rS=>*8iiP*e@Nu<@v}wf0%zy1OJb%2!r5>r<#Hn6uoZCnknClaF}*GJ zagAK>ixh9$5$;`0zZ78*Wf~}!dwJBK5hif~p+pGz0>&9kO|#Yqvb9`E_09*4We(H} z{w>a!VNlNtX(!Jn$v~+@1 zI=z+6fvEWc~a~dgZIJ zSbM{Pr`T@8{?O`M?}xg;`YL};q+j$502=qf$!#v;4Mo^e{`2$>qGV)CpX}2N#ay3T zR35d=!#9n0|FQO+BG+@>s^D`G9d5ICrwhBN_}5AXEj`UkEe}kYqooX&XBJ1hMohHA zpScXW+1;I8kNZ2X*%uF;e+2Xkpy}Ge@NR-a!2%646JwojpEi(6FMNHyp7*^8!wH|_ zcL2Ba$dU4sG6Gf^31lW*ajN&SW&9K>w?BesyuMKZ>=WrM*oassSk-#)f?90;u$aHkD$254(sD0tQOD^Hp5pf06 zEhG;ntX_KBw=cS4q$iSG??diUEc*HUEMO0@lyy4({i>=y7 z&>(D5!sg6FoeouyXB$3|bXgapW1J7>>+$YV?bNW4YjiEFwXmxDUNAMF#d8M=rTj3t z2w~{|_J|Nvg~H+*h$&R`x_4P8pDIVi1FzA81fB{3z<8CvZk3WeN4!vXl>*j>h>aW& zxmtexRG)HtKRl=Qo?p~9bMxjHMc~cVCP!%F8izT)a~AW*M=Pb`3 zX;c^=$FM)a1+S?@aIb;e&kMdFDJiZlPKMhI#vcuyeL~lm`(S>S1UIZO>NzlP0{RIzM}ZCw4i+EM8tQMA zKYmV3Tb1MiaI;Ob0De96LVxvD!z;_%vVY{z4K~IoWFh!e9xs(Nyq_sXnrR9Jco(8q|x8IgR1aloVo{n&KgPVB8bkUl`QHy?Gk(} zmr8+OL((Fa-;1&WYnJTqTeg-%!*kaXmEdUdA0D2)=cS<63(GW(3K?fwEDL()_ObV> zs>N@<;@HqGVH4pd^bH$2qfr;`EeB>)n1RM4u+O<(A9oks()S;YEf2dhd;Gr751k(w zef;k>A963_S? zb0X5}>t z3f?S*EdvH!DxZT{rPwuyX?++!*{69R`$ViQaJSkqr#0L0U-s$lY=c!t?RUJFvJ+d2 zjW#lG*g1F%to#={e#j}V#}}&UuTvv>EI{_D)#WSfcaMO#yLGGoVV}%%7_$DCeexQg zbKHLGG@R8&2F{7+G%Bp};T_Sg>nEYyv_c*RJoRfUbUxRhl$X9bh97)_J}3)P)#oS|clbpq|8I26hQp^ywI zbdnWk>b5tyGlKGb+WS$ro8948!-nnSEiF)2!S(DE-W-MghEfr(>OJ3e8dOq6lHt&hZm-6LE)FgBAp?^0nE>Q* z($jGjh&~xSd4nGQ7?3~$jDoMiAqO<)$*S9mu>-LUtwCX*ya`y%kl&)%>5TBF7J zKwi+ETRgmlnLQqb`vhlTn>ye+Gb^0L8|b49$`t?ZCo@bVptuDCQfUM~0N6?qG-;Id z@#Qfc=0iaAX|-8^^{b1m=k`%r*R+RyRdQzb*9Sn7V?!BT^L=&E&je0A{q z*F9T@h*H4A=~>Aac3ahUXm|&WScF;We7NlwNKHs{N0YlR)|66(q-S!~M2&U}L-YF} zv>i#LLF%}=Jj1?RvlwAR%$$cvLt4;V5Z#v^`kB*@8TAB@t0)-AAX^ItMGN#%j?bX1 zD5(@%;3dTy3KlGMG5p?9LL46G_~Xn+jGFWyQ8O z2QXx*OPTo{^?^tTh!j?CQFz*-z4lv4nYw!eFz}JNF18gSyRJ@fohivql4JWPN>axu zaD!9cx>+;r2?%;3eb~nH;xQCe0Xk$d0?Y{9^)K~VI^Dl*cIeRdL`pYl6KcJ~$7qTLNXDEYs>6rv^6Nu)3=?z9)Rco}>}I zZu_&;U(pYC6SC&{1RYZbG@nS(rqav)bh`KN}3bb)osf|Nx_|-2;A2u0h&)} z(rAVQMmU)JVm8oJ^b#q$wkOr zLBlOv{u*H=+KR>;zX{uZ%-;6WKJ8WQyTA9?f%IGIf%QdRkb^YewD_b!&2mVMBC0q6 zZehe4Uzmi9fkL|xs~GzPyVjt4^f~7 zOS3B*%LAo5A44tiOedq{bL04pRHzTei83oC55x&_I9xyCO`j%tIxgH>h$~Xviwc)P z)kn~NK1Zw|SkNzE=?lRx$94MC-9WNUu$QX#&hcf0Cl;B$ImU6A3**J-20g!W`~m%s zyFbN%#LJ|GG9D=o9F&0^51ku*d#QaW%W}N7)%>kKYE;&ObAmIH)ckdwr!X$I5<4!b z7QgPXAz=hG2@(NLemSAKj^{nvGS2fVH+%WX@&fYrsTvTc3obK=Fy}&v?#h#VW-G2y zORc2)c4YJj&Lwn1t)<=*#oB#5WnUFBots2tA@C4M1js|>eGHBe2@oAJcda}^MDJ!9 z)~uQ)LnKQARdZKl1smCPqm08LZ@~_q{ks@Rfg!!GfhH8u#Y)aK4Ej`dAbT<+5NCSC z-$*#YF-vJdl|legU%2(sS`nyHT{4Vbjrg|DnK=%4t-sGa;mj5I7$-(-WP(r-BLvJq z>|Y_y*$4L4!14h@k>J; ziv`LDpq>vdpwF$v!`k>lKVNZMtz!wYrv?#*BJ->RPw=R5ytYN*PD|%t%$vZvVQIKooBo-k@2z4xhiC-M4%nMD4{$YAcN4R3%U7m?`klJo zs{|v=8vH-;?X;{{l%1olpsmhOE~=UgwV2m3pU)?-8NKzZiObzP*MGs&3uKs#UoSf6 zE`mO{qS@+@H>ZV1L%sWZ7H+tysJW4m*8wpV7pD5>*SrBY9*OZNxvt@Vul_Easc zbZk`i55l?h%%VeKs{Q@L)LN7@(c@Gux3i7bP3syKY^Pjg!-3mYq}$Q^A; zK%jB`Iyf33Ptf5pK%IC53ltmNtS~VS;XHn&I)p2$KncB`ClT9BPQM8()kKmDz?@nm zPa9I_x5wHVqY5;iDsgCaXiY{@YuHLq?UZ@3Fw~`(!E$<-WK~aS(h6AaYSf*@=i60F zj3o}?h2ZVbT*J-*_z8Z3PfSqEg(pys-oco(Q$5rf6xn=4mR%sYwB0fin8PRg7s@bY zEd{Og;-;$B`FnXF8NT$qi^6TMG4!WkHPjMi74sR$Ui}tXVqg>y6%aPjGg67`jI!S= zNh4M9TJ*ww>fWJQDhgT^>CK#UrAr!IaO3?8q;kLb-GrC&IR4bHQc-6BJ+?c3BiF*< zz_)!HL=q?0otf+j+~Cu#(4y&@h7W{R3uy`0DgGrX0fk7Y2$z6Xz!HzjYuPq|cVUY_ zyq@bgAHK)nvBDHDH#i%&1d!F6IbHg_x_K2rU|sP1ZT_@JJp@!HCs$wwYV{kX2l6rg+i;K_$rnwdg}dfJ(- zGq9$_@2HNWkk4O2quHfLyI~wm^nMct{gF^?nbi3g8nvT5f0;86f+u4&er+S)dFVm; z9T@d2@ns*Rf^J{PiO1nDLt>k6=9b(`4Pnd=GCKdzr*DZi<@!o3zDNDs^S3(ESczTL zoikuR48Pmi3z^;haeelmbS)ewBd-iHUfC*1h^L*ihAyjrYb~l)y7F{cf$H6-ez8($ zU+0v@aP0(JA)0|r1&Rb{X8n-+EAcNI@9HN(Zk_i0N!Ix}xrPMk+UMD>@MP)Qq@&?? zTKTY8oRQ-0X~6$VVe!1Ss;+em-}MMttvx0FXlS-o?gclQwX3CoX?8?b#;J0uek*Vc zXpCSwHLVuT%SJPw^r_FWoyR~(a(tgD=~duJmsw$(vYL|@sG2N>Sdk&0uadVOW}0)< zT==G(m_|HwJN~p0Pf$$|1`d%4a`mACb7+SiyYRacBzcAo%jCPvY3xjmhIYtqJj5Qz z_uEuT!WAM?VhM-=g=%A;6le?z8r{Vc8p7yk{W|;x`0}KZ1x~B^{O#});a(cpKUO4{ zYpewg6QW5)CtPZjoyNWNEK3iEtI8?Pkn`A~}LR1J^ z$GYJ_OPT8u66GHh4od$NZyM~>iV*oInKXk_(3{ei0EfPd0f!lVML(lqLZaxTsfZa+ zj18vCTs%r!0hiv3@l(Tl@n{H5Dqztzu`>lt@v_mW6|Gg^8#Iou*r7M^V}Km51*K{T zFiKOLh71}ZyxtxN#e~78=s1yMhL2M%@~y71D$=rP)!9EBrX)LnjogbgbYZg!dA?(D z!ymgSJcus*w#Yz+9TY?rD$Mrgt_JM5#^Ep_i0Z8&Fbjb+Op9HK`$(RPB0}Fmx9a49 zK-Ror3>cxYzWR*Ngw?~6P#TE7hxk?F0=uI{keM*yH^B^&K#!+`nQ!e9OS;-;CaGyG?naN1Q;v28ipRO+A!zGisXV0xN(>@`mSA6=iwHU|p^jhS|$2sE|dN@0zF zdX5FZ=1L@8N20u^!ah1hc45GU=si@GupwVtnjpbG%!w3hB-pFWv29h4kvW0p{Dw2+ zg>LZFuYqn<#ZQ&q%BaCtFl#o{urO+7cfaY`gyTB2+6GJ>X$_8J!wGFL?XaecrT$^T zPK%a>S{s>*Ht&R&jb6xSs0cC@i8<$d!xfXK<-qyETnZW~!A?OL((ls=b>x9m&fdDC zxtW1uF0atwOEyCO#?S=HHvU|L$B9qL@K%(Dm(Ac|>_}~6>}dT@>#?vVP5RlpMViFI z%+(CUkYuNT7!pXOvts9hv7eIW??~M$aji#&U`BpEQepYtqo! zfRkPL%U_wBf#Hb4kW+7!Goc^616T~N)72wi?LS;8WXh^%@{Q-s84-JBav1{*Ns!OM zQYu4AnCcgY`Uct+i~EcjPH2^w?C(Jzu`CV(CsCKxi6#vTEJeRYGL*`VyB>l>Gjc4H zB=7ciX_iaUteGq)z6wEoB!K`2G=%t40W(|)$}5K8T*H@QkPrR}agyIsz&APG?s$|a zs}yR`8h{!Sak`H?Hsjfg8{fjvuZt<-(`@$YI%!;w#U&LZZH4^_R7p=vC5$fx(psf< zdQYmlNk%$9lfPScIkqT#k6i^b2Wm(h8CO4G?wT7uHKgkQuZE=aKN?cm|Br@bVFlEX z(9^S^|7l1a%04P%NBN!IEs4tn>!q}Kc#264bz}uljf-?qaLfIev85F(HlT`EHnaff z!(3WoYED5^v`NjMrR8|FR9_w*eWT)@{y|95_1sA4l|Os54JzoT|9oxVMJAEp;7=IN zwi-SHH8)`vw%7}Id8RSprPwy{@X5wXN-R^64PpckOG>aS04=2G2S}I*Oc7yoywPsIr=F@{v!t);P48D@N8%K)OnToRFLu_Z46kI zIGIN}Wh&X#tHxd~8*}89Dp3DSr74knR*7Lw+tg>=jK%yqlW z-M$EW_-P@54-!oo3H0x@94%$leYQ9AL=jZ27raC=V3@ew#($?M9n_5OM2h>ByDMKeuQ6v0 zz%KMUNUpttxjd2Z>;mt%fGO?w66i17#T!OkSw19omb|>WA(ps}zo6OE8?^<#DSbLf zFzt4Cm`V^YNaOCqiDp6*lhgQfKnH14=vQ4G6=dUzWp+!4xKu?N{Kb21OqUK2%Sv6J zW>hwDIh(gjQ&(2Nqa8ipct-NXad4GCW9W%+SfmglL!@Si-n3j`5-?n~%sz;4C?{odOF!#Q=9d8G-_H#wUZ6U8l8* zbkjc)egM@YZJA*< zTK&habQ_FG6X&e8NT0yPue4#O=?6d}M2d@R2|&Exae~#*B-@g2v=>}wVCI)PuTqX_ zTDaK+SBJOB$(55jpC?_s7Dwi*d)e#|M~(`ztCNU$iK4YLxKS7syfUIVEB;cLH#8z{ zq3U?uwglt~@stU(T9*j~d`-+stYTHOw3HR5RZpdmhsq%1{$!9MWltJ-Avs3{OdgFq}0-6A4Iz*9OU#msI|sN>`K zB#ZOa+F`P-3=YiYHg0AlSBs^ToBD~IU2C0vqzoUoxpWeXwn*+D-@6QYDz)X!HZ$!d z*7v#@+?2L8xnF9xE#J4ahx|_Wt+>PF#b#3_Xq#KM%-R{-!-NXl?C0y|BOb8PUE)9$ z;u3f3{>+M%ui8d-8xJ(oBQA?HibJ=+?Rs#NapMe+Ci( z&_J@Fw=# zwx4_vbKD$|HbMXzN2(S;;K&lF9C5_4@B5wLd5nJm*Ef&uKnTef_{z!>c%12D704ZN z$nzM|;%zVFC~k*;dP>ZORpU1j@=L(8T?_-i5n@w3M47Gr`!=gU(Fg&^97U&Mw*W6y z%YQr>6z~=B+CA8vVczuxUc4FqL6U%o(!&1$NS{p8{Qqtw)s8Dgc093;-Q4Q+{d13g zE)L@GBK*f1!nV3aw;3r+a_|~0=Bzw9_p8;db8~4zl0(&u(j1=$9MC?pu#yWAj|IX-P2zw5S6OQM*LA?A zYWM?vt1RG>v1+byc(eVFwVH$w`*f|o-aZ5WpcCjb0h>2*W)a-|EoAx!5K-z@jLC_` zx_uLCfFhCSwyb4ar{{CLR3*KpNffmvW0+WZ*F1{3Xyaqq)hh-}Lkme9g(QM(la-)! zMf9L$(MhDv#4j_`#`vr@jX)aw*-i`v2lK#?l*pqY%iF`^m-O7IU`s@ml+_ zK2DV&VoU=xkorCiq{;p2{to`QV-NOcd3})BLKq@Kk$n(VBYA&QlpHH=BSSrL)H?YY zZk@J%?S;}GSZ88yufjMp{?sX|g9YKnl!LH2N#g^k!ZK|4UET9@8C?n&lJHg>CIL)l z0YBR1qffIT000RP6JJyt6(=Z9y}r%z;Hj7U0dLa!d+^w~aJ;;S$@vnsNE*Cgx- z^Go06?<)`fbo1SDW5n)egsty<;Fv?47G$er=zK~Sm0H1AdwqfX*lw}bC)WYGEp$CW zf3LrV@L@qnq;AMF-ev=&GU_41*HO)s6%}mO*_-9~gIAE@i$}64#t7{-3e)B%8+V@< za%rx8_gUun+Ra8fU4GUThjgZx4WKhtYD}Sbj&vrbt|PY<{GX(W4hPG85D-DCKlntD z2yZ_Tq(tYW!l?&ePM?RH)j5uX7XkO-Fm#H1wa${P%$|ByQmIi#f@<2k>LF{HSA6cY z$7leyo@@gd!ZC;Jk!JndDpQPE@K19IA;J&}5h&bg^crXj`e@T7)OUdTma%LfmFIvX z*UmvM_#-pwegM{OvXCxS03SaiUROb656=}yDOArn{gn#IWf)qnqI<)c@45FcD>yV} zE*UbU@|5rLdh|ja=c{~gxnmxQ(*sl(a8juNaD@87GVtUCuF1Y|dzisrTF8`dWvt(I z(Z91B-u;2SX`uh5cupXo>c*Qo|4`(c#1z+VQ9S1f*=xPXTY^}e`*irO|4POEbGhbg zqQ>?L*sttdFDd??dOeBQ+1|v4gQ2sw6NmT zkNJD|smW{j8}+BD^onMfu-PnAIMGc5gC<^-pn!3DziQfz~lgT#hjz>m=v^_dnfH3W)a!ypx zb#7kgH-U?@xY4t#Av3?n^H=_l$J5e>bCy;>vatV6;DK^mG6nD{M+@VZMXtatQ$B+0z-GN>Jk>=7(gz+_rXI|+S<#MHh8H9(nB}@?- z%?*Bu&Vq(irP8hX*f~kyJmJsd@5OwyGDdG!WYzxG_yNS;ckDne~foiFqT(o=u zN;^9V|Xp@ zWJdAw;`hAf6-hQLj>cs0N5p0T7FFZ?B+<~H?bbUzW1j+Y;pfsiFF{n-Lvs4s+^-T& zSZ0#uay)t7XY+w5Rfl=^22IG!Vc1mj`fBK=G!xn!5_x@^yIa&X7nit}BC(M|1wE!? zniZ|mt{usI9R^=xWmWk9Fi37-rGI`~u5cB^EhG=R%f4qck?0NhTes@{#kgK_tK})3 zcED>dQ!7NNXY6k0b{~%aLoMV!F?#LoV|`*lA5I#rG1JrkUj~V&@4pOEcH>-of@%W@ zw=6+k6m#7C(7Gnw$txIU63*eNv+E3v_F|ZcN0X$zbdZ}TRVm6NiDIfUm?dwisZYBF z-ht4c76u47`vMVHd=A=>uD*$?6Xv^HL%Opk9ydE}9%8BR>$^)O5}gL*HBHGkk3*Cf zCg=C6aYlBiL+CY!txF3gZIae6$Ri!HR`#oU;mN#u4e~F|k*KobjnK~FSJhWsO|!8s zhc|fPLb@QqZ)H&|y?nnSKTOUX0`h%Z8oR^pJYm{?P1^BZo4NxXPa)p(I(Vu(jV1I@ z$QAcvQ=pIQd2EI|B&x@Jqe-Q|V8)?|gt3dnI%yPaluEJE)H+J*&g1%!T##HT zP;(uMN4+#1f$yrQ%@?LSG@Ud<<}LE*hY;*n>edl?&3Yu_;Z*Lt`#MndHO#T!kUChg zt>a+>w4k6Ue<3Vkavnp9i)2NITN5L-&ej)08PZLe>}d$Lz@dWVWlLTLo~H^w@DzBd z;5{KDqaKfVUmvXQHqo2r-!PzK^DK(bN#=du~F&2)xHAU2dh86sdhF=mt6s1Fpp0C_+DmNQA&S! zmf8G;>tJ7IsNY&agoPo7NG%23fmuMKdIQh^E;#aK!(s<*PJs#%3nlw4bS6+i`m77& z=PX2O9e|%nzKsN&9lW;Zs6=XW;>i=Xfh;40v;3+6hhs?uOQSxj3=LIj?=It0PS66K{Un(JX;JFt0`W2O=r-A?o?+4i;yWT{<<%A`aL#nVid4yBC404w8rzurLY3 zVqfa`X^GZpxJj*sWB+2=$HFRqP0$N zx{UWD(F@Sin-9aDCTIzb;0^R0DM_=(ufV~;QC7XTdEY8!XsZZ~b8~bkPNki~0=#e* zn`Dp%4CgdPgmvop5E_OEbhAJxk6;#n+;x^o^*;rP@gWj|7WR!!5&y+q=WKahzLklH z74xedPSP>c3eA;DHEDf1v2m&+UaOGHAN_)cfpeagAl^Bp+k=#Z%hdr_YH1KeiarSU zbnsHQS|SXVRKcEk-C^bF$wVkazsUEneLl@F$zkmj!?~~}@{0)=z|S5${Cr*&v$#Pf zSSn0_<{8azteKSOmCOEe|EIrWvfjsv9xkGs_ksn4(p5^J(irc`y_lJLg`{ILMu<&8 zfvKErGVl{kt+#Fwv0qJ$5liK>s}ZKQM5!ZElu6H$=i+EcBK<+EsWL4mjHI-)G$V+LVnCvcmEPc{BI2g4QI^{|x7|sG9l>Uo zYlYXuf*1cEk4}UA9|0{4{RDuqbMS)&pH}I1UdIE^c9%Ow`3D-TO?KxWo7HMLS`2fB z4_TcJOZRuwmw^=@Gal2ljYt`8_uDKJwi&mz-A6Qbjv@EL{@q<(>%;0D1u7Iy2&mTM z5Q3Y5{=`%$yULA+Ns@uGG49t1>tukJyGx^)g<4f~i^Cg!jT)GuUx=HTe}Zt!*p0iE z!~s7vFNNTXSzEt*Bxz+aVbG2BZg{f8fo&>Y{dg_$ZK^hFhNN;f{Do+sMd4s2*;=+N zl+{z6u!U=~P|31vPIxD&+GWetk$v>VzRq6+M89AY0+>DGB|c7zmKO!MgB##2>z_}x z;@~%y<^5bFzc$4(1SQLzcg6CE*O9SpW0WfNYf4-ono*uX`ddR)2*UojK}269^1+ct zDIO++TAVuX(W6MQhIW>4ga<$NqU6$b+9NAnwqgpK61pK+4bpGlTQDs&p3I~bHVKj? zHo3yl7Y?RFho38U3MGb-5*?|zv*@Q2)S15;JzgGMS5sx0sAXAIp=Z|uG>5u1$$Hsh zV8^t^9p0B7G>YZ^+8QS11QOt_dBlirAu9bHm{OAT3wvGifZSDR^<>nV+s1sNqj)7Fo&P;RJKG4V1g zF}*C>?w9r9QhMim&An(o1~l3ZH5p~P%trx7pSK;AlzpW=s+3jjqs-@Mh#I|KY`g@3 z^JP6ty-jMA?OA1&YEF30Q_#*Wbj=9Yv9otxcIL`oYsm1ce$1KlqyjqnVG+JjZSx$U z4ZZkJ%2WI8#J(#%Y)n+QeD`;)GTaA@uczv1tUA9Q#$^tw{S0=I$aaZNOIrJr2D+eO zai~)O&tOL0{38bYFEDFFnt9*b){8($a{!nUAbYXL&75f!`@dNu1dW_mqL=D9wc&GA zr@xk+#^&w_Cif`t%!irM2ikS$>+#rQ;bZwEc;R?r@n~Xu*x~t?wrIa5*Xn1ow3*Yv;9ChcArZL-?^Ht4X213r3tL{M(j#}nM!;^LgiLqREB?>&G z=9D)L@TS7!k$drOA7SAb)%2raQr+R7bz!Z@{1swJ7K?IE^+m8C#AM2AB;BvD-0Qbk zXw(+__~@4>1ELF#kC}})_NG{2<$g1gt}VgOj;6g9H=70ZE}8vEH13sCZ8@i%iB}tF zb=HpF5=e@TBUa0YIYNe*Fg9 z`}C7{U2y=*?`=+U5ua_skNsfdD$PLDUL0EXN@u+#g=_R(EmOKa2)@$Dt48jOT;$QE zoFb?#MQ?%FSw&0!VmWI9b1EW`Ia3l`C6VP)ng@A#P|&q~P7(y<(E<^xh$!&Gi_b7fNpqswguZpv}SXezHLervIO<%r#=W|DdK{GmvIUM z=ryQ)%oWtMD8wat&$F+&(yVLXS;4FjpXLyiRZD~o3$aNTuJEThLfD|={rD#qfNjA>@9IR4=yf^GHWws4p%49d?8<(1Es)3T^*h^ zS(~wSo=ujDki)3R@^>#rUj&>)JtLhdY&%um9+ZEib93lpObr5zB!fSyb0H0Q&tv2k zV?hK1vF$*kVi?pM5wbx9DXwYWl|Qc9H#`v8{gumU_+DzdEc4xmS9Z!D-j3)0f-c;~*qm0w2J!MXK z@FKq0QufOC2d<_vH7dBp4A%yh$pkEcogBH!1Xx(W!@s4 zv+{;VPJgrXD%#t^`b(+Z0cVqHSaXQRE>oz8;-s|viZ|+uaB%cjzq)7Ft4Ygvjs*6N zc{dBj1$)7!}9Hf=4eXg@43hMn@$v#C3gJvD55k7tFYfNZabaQc%EGv?W><_tHw4 zC@GA{c_*?VX>s{rzxHhDYz;uQ%}B%sR7(V6B>ng_aK=u$@Mjn>n-20(lPe741_rlod#1hW zLGtQgeVg-{GMJ#Y?JJ`(*zwZ83g~qAdA&uI)l%0>usNq{sX-w|>-n@2$DcpOB&M;4 z>8i;9X0k+up#kR-*h!>MQaP^hGdTxWyKE72YOKI}fO|LZg0S?m4a7Sa?u5=G%GiB} zm3i&KHrye_)5ynpZ-x(i;~fz5Y=sOPfO;=oD*`Uk?jkwW3q-_fgFwn#{DX@cXMYGI z7m-Z0!urT99C!MA@yz{x+ikLmmc}#L*y*fEZp>KdheNQIFb?+;UD%1HTc(l%&Di2O zrleVLl+@ozW&q}mOdAj#QURhv?4%Mf1OkgrJ<;X1H(6gW=ls~oY&AbDBacOAyLf58 zsE}V`d~^9_ve=O-_Vh+4BeXlBB@s()&rTuq`z((bGh=f4g`{ofB~gpKpwA)T7ga#9 z_*8xt$q9wHju?6tQHH;)TgWcVy2z=hS<6q^DPl}@W6oBxKgp;}nGM#yUmLdUiFXbe zGa>alALAI7L@nX_F74TCzG$kmr}S3Pxv8k?{du#knwsYfGw{Om6bn-N6@Cd3EwE7FusNWQnK6$H#A z?*Jr8(}wNN%#Ll_o*mn^ZQIt4ZSUB&ZCg9`j&1AozF(X_{&PB_s=Dv2dO9Psv!g5f z%IA*sfp_DNuPcmKXjf?nw&+qcBr_1ODw$0Qf^L!F6rq>YZvxrT;Lf1i^;SGEOXi79 z=0?83lEIyo_+4{R_v)m9xQZk?=yJVFj15Yv`r3-a$0pZIglq=3TKv?L>qUIYorkJOH=J&r6Xm*C4dqf2 zTuhw@2=QXr&r&5N7t-gbF4q=v=9U&KqB zDbjDEYwLmmnk*gin8Lxm;{lOK%{N)m*lH+Xh=MVc`H@F`VMmm1e89ire%&2x)PlP| z{jbVkF3#;8{zQ{*aVt2Rv-Rog{}wfb4(WjyVSeM990v|O#m(y_7dQl;h0$Amn5$MQ zcs$>GYY#kYzT;>pho=fcWQucs2B)B5Y3`Qm=QuAycgC%CjAxvYZicak;$mI9PSLsu z1?4yf-Ma{lgf*uDc+zAAFC(8{WO`>If-WhSc7R&V5BE69ugow}i%Rw-YJ#?VaTL^} zdOJ9`%*Re!HS)+>(Lb-R{Hd}g7~jLuTvih-i!}w)g{g5aI}@v9{;ZyN4_pw=4V~Jv zn8pmDv?N%nptyw#xnN{h2)#?CEPX#@ME&$w3t|ivf&vjog2JKslgdn~rpF%WKxQ#7 z*Gu#xc!+pWx%L!0_FX$Mo*bcSA-GrnJx}765E8>ekLPFhii}3*KpP{&lKT37d@Ba%G;AqUQpIC=%;eSblc-6;=WwnQ>{ zJ+BP|2Hfm{PRi*lWmMQ}2>fEA7=K{vCE{WklZ0{(Och_;Pg5>V){Upkxf{+0o**?v zf>Wb7NsV`bI2~&8`YYuRCDN2*FP5`}qLQ&2D|Z-ehl!$N!oi9;TY8k;9P37UO%?{D zp@bal`W2kA^fXY5hF5>5SVleqeUp1n8V#5&$@Ked{?v>LyjoMZrwdwBwOB|TGV>MH zdYYo+N&hclv6U%!Oq6R631CGf%bDguR^DO#y?mbD9RwsAm*BMjpL^v`N}tchHAoVl z!Nzc>Tiwt5mE=m#62+XoGCP{3BU%mc?J2J|DCnD*JKK~34g9^TqYb=ZLI*XpW2L=% zZnbYZ##sqPxw*Q^W2Z=1O!N;%mnGFU%*~R%k(cXfNe$bep}su??z#P!_ssSorH2_<69qS2 zB>x;*f$G*2lxGr<@vN55T|w6FniEY~+HapjzDxsefK0&Nsh{Z=W+GVxJZHAN13GOP zVSMM60y2k&1jq?b%;4-rwTAO`jU$!-U~vS3$Z7?yrW|sf5k_>!(bnryvvRlkRkB+* zjS~awWn3`1tXZGDB861Wi2=-Lgsc;=!p&hj4b_g(o)*qh;&q`y3?^g8{y=Vth5?oV5ZlzOk`?^FZR0@})@E)@iZPA($ zY~|{2M}SqKNH*>8k(4ed@BmqCFJ#Z}bq!+&dt_R`)D(bJ4Jn{!2kma9uEc0ehoQ$&}gLpmt4ldZ$p;9@(5--^VaQUYWC51wjjQP#9r zKmchQkQpnir801uKv`;LyUx&#>Anxj=>d+cQ>Yy)-wvK~skcE(x>gubrq1EonL!H3 zFJA3j0bEmFOvc|r<8+*Ih!l`lJA$8}snFOl!_aL4Ey6~!M{^U{+mO_zP~NdLOI`17 zowvHq#odS)h_9c9KW8F74Xy(zBO90;um}buy^l8-wTn!#VrkgJwqz-| zRh68m!f_NFi=<+U$y!QgN)18ju#|oW^5=L5OGlS{*u1)5yy$|xyXgAk(LeHqs& z!Fil{*lCPg=oqFS0WsUH=tv#E6BGi*T#AthL<)U<{T1G*Lv#B{OSVXKk#;kn*i==e za;xNrh{#Xd>G=SccoX{Y1MPbaJ4&=Xh#(rSASbOlu!Ni@B!zZf4c?m`%N!1APt;qSa{(|1Gafu%6XK z2_PO0z=NT;uy}%zzdX%D5<|LiU^S1Jg`?0fzgvM)m{COD`4HTBbT#x}n*KA>hvP|3aMYu1QB+#0v z+Y1cXt(XqoU#3ajds^E3eVq!dffD{RwVOXGxC}r#em-LEo|(azqA&3XRA*KTo=x)B zS7%NWoOY}QR!l5UV}Nz8jWl8hO4WoxjM%X;{JxMxA;IZZHVixIPSdE^keGNkv}E7- z<-*_1?Q&_>XfIz;(xSiht42o_AkbJc*}+H_V0oCzH6=QBFlysJ0i zI_k&o{HiNBQhX59ZJU7Ocq)_6@|%m#4-4unc#!`%CqYUR;*!R)zaV zMk>w@Xj>Jh7A+Mgnd^Lw~~NqpuY)!_m^mUa~ep=H&Fya=rS1fH)yrVytB z%m(Q@mEg%?Lb99xJhI(idcoZg0L!^B7>X$mTl%OP>`oN6Pt;Q=Oj zJqqht*t*8aRgyJ=IjV}f!km!k1%cjkWBTel+c)@O^XNKNfA=(xyXD68d`&`Cp7soP zo9y}FJY5vVUOC0O7i-YetSDx$+?zSnwX6i|`6TK(BFHpf|HL?D;+`j>(Hcj^bVgJE zO{jt1e;5o`U(vcvgMDWWn%gwV-#!?wxAC`3bdeCxIE2-DUc`q z*P^#pisKRgTDc%`ait*f9y2A&`!V80ZrYxxq*F}};kF5>e4QCP%DSjZhQBHwzO~o)Luz2*Nh+>52=xj(Q z`*)?Yd^?x)6j~`YT|T$#D3XYh9bdv!wzU5ZSPRq7^9)WkY<@k@SxK+?kDmS@$*nTg z8K;ayRJ5WjYBLiHIaYX``*U#aB~%;_ddkm|SIvHSrj^PS4*8ZO$1WAPNvP+P=pQS_ z&f9TJW1u>2a*wtjqmjutL(4@~wMpo;Mn+Mg!nRuN&mRC^hjyvAiAvhcGQF0U(!D+w%rrXQ#K8>>3CLY1dBD-<|?JoDt$nvq(6^VV+gqOJ~B zErWe5ufQ8>2^UUVTSP~|*)Hm=&u!bB#$Ey)Y^G4b zzh>E_1lVH_x?DLyP6T*U#pMwah=t2_RhAu3|GjStw&-Tf+;#*B^5< zVq%+O3-=!}vdoBtj--#zNm%)t-ERw)JXq5w@3t-4A9P%kXl2=}R*XOkQ=R4(i2-+B zVW=2rIeF&KrCL4PuMZu#pm6vA7qj?PonV`HgmTVIvue$lXwPQlZIJC_|Cz`uB-o0d zR>aUzad!q=p7;D!Dc5g`IT=w-)W33UPB3 zHew+L10EW`qE)%-sM-K=woj83-Vi%Sd+*+fLV5!SJPX|@@ZR#9RdIi8xH{^tA+zGA zj8Pp>H$;)=fEqcy<}kC=_L2^->Pg7ibA^8nPl!uK-x46jq)*6CarM00qZ3R$p7uL; zUX2B+d;Cg+YZOnV^V3_~iYLWMZ-bzsL*&2d4Vnb|I&&!2t-pyh{1ir%Q~6P>+{CVa z!+(5!rT%RWlf}wgQab_2DzERx3pGf~!Kuk&FoN`4WDT|CZsy zr|E@Un&K269HVuBEWuo7UR4CO)*qSCaxHjIN#p2f@^5I5k{YA3$SltA)|oshTHDT& zZgG|s(o|tzT>3NOxEaE^(rBURhnhtZw4qc=yXBU$J0P*=2QRp9I8xM3j zHp>6$v>@;e$U&5oev%%MlkShs%Un(8WyYoTF!j>dYTvo(jdf^+Bt47b0WZ@nb?+W>8Drta|Cc>#w zDKl3fXL)30%4F*H`y95jakDD{IAnc64V;G5RhI z?{$alB%-8%n)pmlijV^8q7NmYsB%R?El&1^JErst1B&lCbJO`|DCb@NjMGC%{sBOG zo@ky}&Nm|R!pt}BE*6;Y5eA9Rf<)$ooM-|*umEw+#t@3h_~nWS+4zc?>Szv%5g`@! zo+BDJV4T62W=7X4t4L%-bt7mt0hNBW-LKMemq>H!EHT0?$-698mqZJwLR zKhP6jc`sZeogy_lJjF97*d->#(?|T53<#UrQH0TQ6QD%x$kG<@7UEI=#;BwA!<5Z` z0}~6CmwBEU<<9A0s;w3Q1N|DbHui%7inivzM$&G zGB*dk8U6InR7LXt$#5?OEtZ0B}Jk_-pK;YAn;4_Q!Rq}|~~ z>}R(cg{5}#Js_gA{PS!0(ytK!BD0PcUS_ggU{2Q|M!w2uu z36_UIu3ymwB1la2liuXz8(Ek=D@iYr=m^{0oXuse`u5A!`HI=cESTg&s6y+*x`h7? z_9CplIU>}|auKbilnqwuOwVQOIKn`~AgioogwnfixO(C_Czt*n81SBt7JVD1wGG7g z`_A`bHC2L6GR~OG$zKfuZwPvf?g4Hc@yAUZB4o_)eN2!s3`MTsCEVmZ&rl4lnctfj zi4?S|4RY%AjN*@{!=B%2{O?L8Ecp{fstvRxWLkT;3=*eK5eX$3-nH}(O=bjt8WRWK zbTxOUH2*f!qmp=2KuJpG2&CugcrRrI)L?&bCq1;EegAGvwC>$iO-O+1a4KPY?;1~n zQBq3P(`-do1QpsnNtwgK=TazLU+7f!U(TrWsApLHR`bOlqDfBTJ$och@nV zuuma4!b1<%?|*8~kZX1}>+s)sg4-qILut|4>r%I2*LZ36(#t09LdQsDnQdz{_2wry zaNU9MDAUR5oICa>d|l6k7VAm!k(Evjs?*+2l%lHW-WYj49aZp7%x7$G^!dcI(?Y#p zPKU?seRCz-)_)MEsj(&{k}1T0#|tuuI~$WKqIL|ruRn~+|v~F&B}YjPl>55`Dw(kZmL*>aUrq4GLnfC4zRSh$^ehTV-5jOzIulu`Iz;Q(jJ!lz zhjg=GVWy+YM1fOrQ>wc}$_6Cs*_re-_q`bCXP|nogImdb?nm2kp0g5Gw{vp|v&KC} zTiVa5(I<%g**WXUODUrCm3+Fqjn|OY;Py}C)Y;R&Kj?diGUZLK%vUXtfon?Fb-^(7 zJSEEHK5NSMVkZbG4&{mkT#Z+rt^C}FAYqzz_LjNk3Dr}*iO=A059;6h2obzy^zw@l z!TcUSJZ1gaNdVX&!)n`$|CGkUePu=?k`+*!e zyk2J7>*p`BEESv3$Q`Mc)G{&$!@S{9ahkq@Zq4yz=S7z2?;QTE7uo_9r{6ViE3w7C zo41Qbba#QWd`Ps6X_Oq9ncJ_@`cfj z1e4k$)I|-g1|6#=vWp7Clk{%1@PSm7hT>xCS3ZE>>-Y3-KlAm8F#D^`=^H#O7#h+6 z|0at%?Rh+__<&>zvziFsSe5Pw1~IQae}6qMkKro_idAfQtuWJ^18zC_YHRbhnT z3Re!s$693n7TB9ojAM)HGT*RV0_wyg!AhU&z;OYhu5NW;Q!!Q@1AB+sWd0Qpmb~bi zve+LBstvvf_r{NBv{V%lS7t55G-`GiaYY)5DP5&9?FM9e@ez0;-DZAD3~VL!?=2m7 zGUIX1?@HMQ5AIvkn}zPPo!yp1KO#pGJxY0nY<-EC%?&BQ)Nk7%x!Q!97y1G!t4 z{$RSw_{fxD_tUL8S+U7Ult2O2&)t2HdFYQZR_sufB8pIOghxSm%IvykxsGi*+8;?H z{kL~xor54Sf)gKTZ?pT~FVnM&Nwslty?%_Jz5E|XFZ^aVx!=xrkK?mPVLMq_xCDOR z(_!vu80P$QNx8kVl}j;ir^ox(<7)^x*;!dWpDE9%I0XquMiUd|T9N7!$tm^{kwnX@ zpQctBy%ohdyjNEa+QB)>W=?VUzyFd_MQ{{33Ot?|qt$Mx<&6|JQ)>`XyogNN0xuZp zH7vmf0Bfh0t{~P_dUp{4lf@Nu6R*>}ZRBt>xl!w>6*lBYE&w%?vL#NDJE^NaN)2zzJ*#j+$9Pl~b8chCsR%6mD|HMeRmeuA zkRQR=Wwp9bp8&rUCg=l56sjPUE=(HS9g3Jipb>rhsa0ewhe4y_N0Dd{1?k2Q?y8#@ zD4iB{GaR%tPDC&VsNl~c04$0avZB9#KNqO*yW*Ijq&G^K&~*R@;RdZ%)4d?@zEJH*at&u}bjQGlG~FkYJsPE}&( z=^r85N=WaLhxi8Wjhj2ji#M~V_6#lp7l@mE#n7aQi;F}mexlG!bQ%TMM6{8SwjQ&* z;ZUVd(3=;ak2Z=qyiK|ZS)m=EdCdz4*?l^&OU(x19y^QI{*<|i-XMjo@;XmfIF>`C zT|`XeJ6~W0z@lyycn6T3ESn7Ny9@A8umD)J6F5a%!4~<8*y4WLj#dX6pl5%2+e0g z#ypKi28_VB#Atu^J$0AlMn z)yy(b+SOMj@rPqcHZoyLA~1hjf;MZT1DcicuF_o5ghRxEoL*f6yU&pItJTb>403Ae z7k+twYuD!0s;&YDBVjK#s(lCX#>PoozWQVA(2-cY<~XAx!;)+m0Nv$tl!NFjH9v{N zaUQ(xZBaICXyZU4m!7lX==N$Z``w7#a22au!qmIWf<(dm@ZIz@&#fYdUXhc#-GvU^ zLFykK$mtajt6DGCp_PzqB-k(=;pBs)dsQDNpT$(s`+h9=3!BLku4Fv)=e#?)VGVi7 zME=HKbeIJupp-vQL+s_I5kKOMO==E{d!^il%1B{WL#*sC+aaErBp&@i^460Tbku%G+6JuP`?n)Sz` zqxSpX+eQI}ypApo%7@SPn&MT?86FEOHcV~0A z-Km$amaG)oLvb!5p#r!2!3HA?uZh+73l^PtUn91TiarisV24$-zVWONYN`zQ&mn+@TQ;%Vbf@( z>4s(Kx^&N?cRde$-t}-58!J=xqoQ^9Z6-+zm3G=<^jA!-Pt?dJ7M_s?g6KfA;zr(j7>T z(n5X+He>mh3W}ezmSY~mB^LUX=4zGS^?GpKOCS5TPkjpS&!O;e%A@S4{8yXCoEDjl zF!&0m5xh{FP(AHiF`1G2YgGnGQ80i7 zL=#aFY)#3tAzCXPE)}FV-AYtL!BSrkRx@@HlQVl8m2}lZy}f`ihW=_QL-)@5=4?T^eh581&?;#gl1bJjII;$AiPOL3fcVJxiETvTmgLz14 ztot+$Eb1cZupE-Myc@;eAJm-F?rK7JnQPtbTvSlj(LuS!`bsjrxX3~W_3Rq-Kuzvv zb-Ctnb9fFz)v&9++;ZhpfK)5xh{b_P6!=pgvjf#>if?1Cy}QWDjN8jGSR*1f)`gV( zrt4I7X6n*YV(NK)lBwMg>e$>9x{Utfa_K z32o-14*p^y6~}8V3@?x(PD+c&Kcpj^!DN9Sp>iRnpTh$T6Ywx|=6914((g9Qoe-X}*oGRsx);cpUVRVJfKFM6dK zWP-@sfmBHxb4TxBt^4Qwg1{7f=3?@Xwuh8s&UlCZt0!meV!;82jI_+rXbGNy&;~U; z2z4_A?VM8olSLqD^x!YIHHmuE;ErX_+yUE_m?zBza~>@thvIk~+RT)%z^PfNFwb(W z{WNZX-|t7|qq%3=cFw80rB7S1k(KZYYH!&M?kpUPEQP@QXfk$QV~f(O*!Ue%&0Jsx ze{5i_5DZpAgc?aWl(r_}6mjWz{MKQ?@&X=Ed4HCI&9XO*FrvuInnNElt&sW>yr25^ zl7nA2ARM%us_CfyErsxEzVz6Js}wol2e+52 zD1j18Po$ubwCle<-(3tvPVE5$Z}=N1>TEp@C-@l%!S?t#o7Veh^h$@c#) zUF&^Z4NI;(TVoVS=4v2iaWhg^2v5M7a+})M)~~s+EG-h4${w_M9Ox-tw_va<4unvp z|FDqFv5Ef!ClD{-FFd#y$9)~X+?zTxM>VlZM|AQ{F0aJ7FQILG zjjki*UFQolgcWPk2-|aoVJ=aX%p0U*&2FHeY=(J)2bOuUg2WL3bT1k&tPBd&^2M4qh9-DvW zb0#|9B&Q3k0jxIcNh+9NwanH06XK|i1Q%6a&?~dSdz5in}q9eVTBhTp1Zw zOhK)nLL=FryK1x=58hT-$0|bBMXXCXGoOrRJ!B-?IwiC)t7*L<<=!$xnF+Y}wVLtx zgj>+)ZAtL74$>7!8iC%$c;OL;O947CXcd>Kilq-ngYCf_D`J^i+a0O-!2B8F`^n}y zL!R5lf@sR>hlTrv=`Wj3RpB<^*+q1gC9Y^wnlywUi-s#|%@wVT8cVXKLic5*bKExJ zj4~nL>2VhFJMj@v3^IBdwC~v)vHh7+9u3lvZGRPRdsg%H>Pu2ubtGjvuQ@kgpwGMr zN2lUgL52pDGxNO}pOPn{%h7!uzs^|3(1{jmHXNz#NAxSjHHZp)jHyQ3N`%u8tfRjT zL+uUrdJA^<-R!>!jtW9&>&^p$@j{BI15*w~?&Bu@0{iJcJC+5GHj9wMsdBr7JQx)s@mVWZqZl{GB9$KS+}L_>aU3D zkCRo>5J-}g3D~@ZgAjpjCP((R^FE_T&bJb}Fz<6?tL19H#KG3`mci$lmL{{GwtFov z&4w*r)jO<5rge;`TMEd}9VNMq?9XrDYfmvRTIKI6IL}7yzo1yvzBnbA!*Hxp6Pg+; zTu|zq&K;du*Cvpf7q5Xf<8@5DpfhUbJ9ZMXT)?_m$v-YVFAd!LhUd_**A~C8-G|r7nfa<{w`p^|^?jD1>-L|} z_3NLyOB?T^5n0XK`d4r&*PNbUs?I^v;&}djZ=tEydh2G|ri+d0$-#%#N)@DCqH^D6 z?=7eFUMoP?W71h-W}BirNnHApeNW1Va(yl3>7fb;oUa$}jP_ZPqPP-}81+soAY0=5`i2p|l7^EYu3b5U#~~ zV9ti`E>EuuQu&%0jH?-p3KRedykqaVY#m|nF$Gj35AVaPcJJ~vP zY7PPmCM3C#+O`R)cLDj(&x5hZJDXa#uC5tU|KtBK zZnDKX17?e8Y{69@t{^GbZAYCD2&r=%R~wbpvZesPU}$K5y_F;|bHi*UWMP}T>gz2+ zRvJfEO_6)*w+y;j(@vBd^9m zske474=EcPu#B7ilzV)zZf zrVAT-u*EPIR`&TihsLT4E{xM8XMa|7+Mdj!zO;3QWtVon>8lXKkd#f&p!J+Gc z__R`K?@1^h=_e1jw&+qv6_wB82sG=GlxW9&Aj=d{qtfRsA~O{MR{!>R?DaNg)m8bu z+3vo<85*;bV>CgO#BQzKgEcq&>S_OZ1!H(aZ@%#9#qlU;jHdy|t{L_NxhXvhs)-oH zle(y;HLxc9F?L1rT-$UX4#Z7<>*a@!BnYN4*GlY*FEo01Bbs8!_H;WLf5`9QgqH)i+9U+tz z9Dd8L&QBQhPVf_waNl4vA5TfS*N7qKkozgRmp#VCZWLEu9a^{^bf&=?1Q~zaP^25~ zsCb$-4%*VH46w9qHo??SoLy8g#aYC zP*tl-4Ne*Pv8EIv(t|JQ%#cT92Ei^>QORTlc5^GpFupw{~G_CoT*nT3dx!M(6phmP*7 z<33A}NpV)0cYUL-2Z5s`JUVVUP6Hi6aF8^{a!q z$^KUzvW6qoR9O}M4IbMf5Lyuc68Iww%bsI>);GE(&9IaE=SWQ3A55H5twJ@D0_?0QRK)J7t??k+R^Ug~wQml`DL_9GD6m(mFb!>V=Zop8a zFsyDWY(!~4Vd%ocC2KVgC?I`Ml=Jq>eSx9wtX#t|~g7k4&Mi%Xk zFzhWK*B6d~V7Mm^XZIFr^8^I~b##ajlQ0bjtWj!UdHHZ$p_KGTzIj|qv(^H=;$81Q zHt-v-vF^JikyEiylC6w}sS&^iUYIyY{s=4n#|9Dz4&zG4u6P?(+^8&FtHOzT;#=X2 zEqSkCI{sq=9e#|>Gj@46p`CR#45@@_sRcX`Dn-pD9c;K<73%EXfM?E;O)wuea*VX+ zQ7r#r5$?lq5S7&Yk}2cFel_KSj4`jbR(N+$Srn}IulZf3XjdG5PIEf9L?3f4y0d&# z)m36C<)q55>NmoQGI?nWbc=A65eDy@;mEdj#abWUrf_E?d3Qt@?j*UJbCvZaLZP8TCKweU6x?Z>e8>KVNKo0u0_rB#j!9QfR&5b7x+_RNa1JsHJNe~eyx#p+((UP8_Y(Q{FI2tyU z!K1LtctXaSb4u+VS-~MpL)40giNsOU4&8uz2J5(%o60|SNPM{kiSDG5dqr!>VXp zwtf_T=SjUaK*hP&`=SvX@&~OmbMC7^zTP~<$o&lDHlJ7quXIWoj&u6dy^!QvbQ9SL)Un!ESmzuAycgp?k zbQi;a6exF2VMEA`c_1zzOI&?pDr;RUciliG!U`jqFFP?3T}~AQ`C4h3a;$`8(msO) zofX4{lANGx&uuE^Zy&;K)oml^1%+OrRym?+-0r42wo~>Cgu=+3bS`zB0cI=Oybfwh zQW^d{vN3uq6raAZMWT(3)0N`lb2)s_nqh1yuiAYhZk8)6AJwUNf%{|ytYe)t>{uJg zv)K;G^YJP{J)063BXB9s4rtNq7!lx9YAPupkSx;v^p6w_4d1mIW-?t(Ki}LfaY$qy z7+R4Tr5&l@P@+C*0ka4JRLx_FLVzX>zE1UQv8 zm&3LN_Obw|+$)uM&f{p3Xi z+9Gi}{_;XRY1wKeiFq#DaD9J<6mh?%UwL`*0H&UAl&H0r+G zqvs8-bYY>mpzy-q$bp=aBfCz#k9uhTMLa7^r zbfri-h)0Zc>`=GZQDRVq<#Ce{5R(!c@*~$|udjwRdg(`}b`?HmCB(>CK)sj25Wu7qDT>7? z0lq0*^lXV3-ExQ+k2xw_6uVx61l>|2N~7q%;`Jw&dI^C4D1~MSb!y(*QgUA8(huX? zat+?P+Rw-XH-JH@HS!i9AnGn)=NAPieC*pp=XDF9^SS`nepvNvKB?kHlHjO#_~gU|)p8 z6JuY@aU;PkJ5M0Nu@&_50kf=Xh~G&5X^0G|0vY+G6H;Y_*RL^P)j7-+C@=8@h$yf5 z0oW@-wzg`B{{%Rc+SJGH3Pk0QY!n<@l#0$O0(eJ2FP~xadc_tTQ{FtDa9a5>dc}tR z*Vl?wB&$pRB8ofwiwLNwb(AY;W*k8sz?IbaEtuT2w#?FI=lSiTOyBiI-#(nZXlzvs z|BAQUOQP*(`|bMFiL)Sb_fj%m5!*On*9gnt3YLje9V?Y|2C_D|odM|k^qp}1g`2Fh zQo)~J41ZHL<#DrXZvy)m9si+(z_$OPgv>>c|DlBTXFFhDPvkoEfOWg|8J=_Su>45= z(XqE7K1julpcxP-EVDO4lUzv@;&;KtQfB~HQZaxlDaSJsqq%-$G`UJTp>(QgkqAxJ zJ{XnmHq(Ocbzmh7Z~Gd=W7UB)K^SElaGFQ;f3BoLN{JKzSJD-HfGcSw`1LGlb&U_- zMfJfugNLe#NnlNu5a9BcKot{9_3>_kUXc{IY&b<+}8si=`dU zaTJI3hzFaA+e5flqYrv&`bHAFb0sXEDi^+ErPG8jaEpC{LA)L&QJ6zsKv z&J8kb{n>6t0rE(PJwh>$=3gJd1uU;YYR)TlePBW9L^Vku-jsc@bil0T@63e6sXT%^ zP>j%ntFv2K`kOTMFVQel?zf54zhlXvW=<1la^*ctL1*1qTu!-91cx#+=|%K_w4Qzq zDNIqM-Heum zgY?WTTA1}uI@bb$7bcLXLANic)oxAAVeQ@R>9lU$1KM9z#X2Pi!2MXM#%}tiY0^=g zL1#`L&AT+(?~l*M9Y5!%Yd?>t!IXD)jwY4esC$9A;P$S{V_Gr-L;9P-Wk&g=VAb|H zKST``pB59HEd5mim{hxOR8$-0r{Cpd<9eN%&xXJsRBe6`cD5-XCu^ja7pgf#vPYb01gy*lcPKBu$# zQx&h-#qP$?T{~E(s?rQlsPQYSfBMkbJAbVCN_HpLP$3}L4Zj|3 zTX(t%+9i4}wTJ>_>?>B2C#jDtGaNFBSM%fC43)-I1qiBI>e$W{rqp9uehBL z9^TitmzQ^p#qak)``B+|@b6cC3jN#B_5+JG;Ae&^Bo5(a^g+L1JMRbl7KONH1s>ym?4zDQGmPa*BdBddpZ{b> zMFV>}mcQnuIBeefAhjsoH=c2?6R5oc$sh zdb%~B+8c_*65a|Iyz~Fi_Ey1d^NoXb7#mI+riL19n3=I*#x~5%%*=6^nVA_HW@c!Z znQ`4d@B829V(0rVcJ{&}k1T5}YoxKI^E;>a%2BYbo80U@U+13XV3~;hlB#j)oRFIf z4ou~eP4B-j;LdlZkc2{-O)x!})WUJA93TuxbPtgMpRlEsV#B;2(7wM&T<$f(FDDJ$ z8s3(Z1GgRZ?@9qlO;d#&t$LIYEi7(#jULhRzCwUTPjuE8Wg7*dtybXgxo|Z*2}X39 zjD}N0?`*qygAYua`K#yL9wECOkQX2m7@FPGq=+kt$BYLVfD<5Okj%7fQ$eHjcFF57 zjnzTIykmgbDqKp*wt*!FsyiDPS9^V3L6ujrnSU?g^{MtLvhFUj_KL@Cc2PiDX9r@{ zeUC=&o345I0i1VEnOWdvm~zYak|h-nuvtAY>td?YA_WumNoD?*IYi!y=)nU}O|HW) z{4Q&Zwxjh8vZ-8+YzX7fY>^z79?s)W?F5l_zf_c9;{1XR(`V3xMfzwf*;q2D8+`19 z9a6;`OFH^HTRE}ptV*Z?0_=rV14s6Q#yMCp!SMeyN%bxM!2*v|ztXl7-YYtBC-`O4 zw0Su~mBU~vCsKl|xRl~M_`pFPL294ouibf#_T}$%7{g9;t7!6mLj4#r6sxkwWrjFlo|iLzy;n^U7HL43F4`G)Plp~RJ5^D>sO+I`{~%Fk z-chIHEdqCJwt}H?1i7@%(WSj(f^m#Pdw15aK#@aX^J%Z&mMqo{f~ain3VCh!vm2ZoqJke zl`)+hO#eCDnQ~`v{tj4IUT5ZSgUS}yiPgvUHeulI->aqdKfP4hF3zQQJ|DVY?mW$$ zat!MyIiYr23F@^#6Ps(liEN16AjBCr$+;`!Nq&j|(_5G;fbY?8LIw@zjo3*RJ=e-=@gmPDYUgw0}~jlqN?6_xr$W6phA&@EIV z7o1aHkPW5x<&b2yz;YNu+ecLX18TQhtT1fNEx!VC&8kC?tk?8a2En`}1TvKKb9J$i z9&}@I(h{4&j)*D3PSFn*VoY;|x)P3W7`2;SIGCfysrzP}W;S*2^quM?fTuH#SRahb z!I4k8LDt|l^t43DNGYqAboeo&b%fOE<2W3C$Ev)mijH;QDNa&#%smCI$JE0C?6X!( z$Wft5d7DE+sV&W6HdHp0CJKhl!U}XWYDXx>Xw_3Ji{9k0qqB0dWs70DR!G})Jn8x% zdmyTqe-ObdAR_1%F}N>kqVdFRJ5C})ktI07XFEYjO>6{21odmK82aRXpwe-mkb^E+ z=yvorJf_s4#+gJb7RE6z{s$3E++)xKB7()$pJ5ua1tdV|;p}h0@XJbP92&k*_WK#6 zq3w;3wbI?ui*c~*dOu8Nz8)CA-;QM>8Mj_Yznjb008oLq0zR*fz~@z>#X2gCQbC)J z4Y`fFdjq5+L{Mh7$a{Us!zEIa%jYmIt5+;i@-L$&9N=f>_Z znKp_F!bX+gq~D_E8}(|jh!Qve+~Wdy0X!|N^pXIGe7P0?i=-w?=PJ*%8q@7@#}FB~ z0KMYi82yEhm_SbP%_(lraXUae;L}Fc0Ed(i;`@}c$Ko{xiwonaYQ*m5cTc7})A3VOGB{vc@ z;_5EwKOx2g!5uVIw#3H8I>uYD@S@P_O} zc+^qYggmi#f5R7UaqMnqzsex(^G@Ph9bG^%8lDa-p+N|#Do}}K{@zZb{hFHg6GS8S+o<_iEpT0+RK08 zI<3N2BMZJcfA6Af8;@knu}&_TuKDaxF|rL%&csbtqf_&(3~j$^OXcnjEw+I&{hdn% zdO(nQR4YX&2wW4eyh%a(CYzhBc0+?1kAp}4A{V`t@7uhYYC z=yct}eC=q|*Eh*BPcqg^C|oeB9d9x;hPf9H&Uo)@j}{6eiJBeXBOKWs)0YoHjuAC) zV3AbW6Ucu>lT2@A^Y!dBAa**g(E<4{z$?gc-SK^{!QyT-v#jiFJ*kJBI=ph%`y6N3 z@AuI~Oa<}Ys&bL_CkK5L`QwyD1|-BLj~~SDvZw zX^oHWFPtA;l7BE#Lcsjtzr0il$NVa~Gu9EwWu!4!uDTG&lHDg;NZAYAWu6r^ku>WP z^DGcqOsl{JLPMBni4h&~+O2QR?t2!j=T#P4N%N=pa}-EGp(0)HBz}NoH$iTI?gk5G z3Be;2nOiRTrv_^>at#+d718{|fFTZ!ouC1HBD2amwZ zp)Kj9Qaz4ls(dvKAP2Td|4*>_6+DKKi6xcFrg~96z4qXUvNRgXtySHQ<)4udJ0d`ds>%@h- zh#mr1okIw$xKpgdS7Tn`-|ae?Hs{-1mTx0+tC2(ztzGt5;Qa zPy&q~=O`-%!KQYF2A_>F_FC;8xyCWwBqG9fHYS22^`t&Efd0k6)+LS#g7Uak+*}+p z@(wPkDXe8o8`U}3mRf-sIHpr3B}X{ts5F^41YCQ6Q;c$2 z$SF85_q2M(rwA@)cfnm8hrFD=S!vgjOw!-NE%JBFh_Z~Uj^Rf9^?pWUt|L6PWU-zK ziCf7BN`Yzu+f53vx9V09c3C#JN+{=Y?9chZ(%Svbhb zdqnF&S{Bq_BvT*Jj{V&>ShUw!Biipak<8j!JGuPl-!w|X;wnPa;=*t>TwNwtER>@F za4vFaI??t-#QP0TVR7T8qLR^fum$iur7GZaJByofY3G-B)v3XbT*Rm5amea}r<_ zDo=5eUza!xR1b!sBsySzVL{-s{It02u2^?Vo(1Yuu-nKAVDBN6sec%jL?^g~tb zlAR8Qk+UrufjPS?`x}ZE(5Ou`^ebIQmLBAynoCF!p}GX#jGtqUO_|@7t0ArxJ61@S z#7%MJV{Po7eqNX4_~Pw%t^es9sHGYj#WWc%MQzVj=EVZf-G{I5xn2h%Vcb^ll7T*M z)RHG)^mT5q1yGQ4x9~?bC?n&}4nHtql!t*G@rC>)lJBa@`4}c9d?R za!vYdKYX!z?>1B90lxqbc8yzi291eUNGNj7NA_D6Syv8Hl}QnIIt#b~&*5&JqpJNf z!O(nHXbNF$4)ird>;qDc=2hS719p34@M(W`DG(Io2lybl!UMCU_RVB&b9QN5)9a~% zt$Y~8vBR56{oVY$Aq9NeamrUgiCx@XPnf*({xZs0lMS5o08cw*qz?D`AO1zG*26Eh zVZsB(g_utt`RHgdH3K1T)zq}l4wcge7YKGS4B%m@F$Qw=_cv$CMY~8 zi3BVCjqHN&_Z8_k=PkD*K}`ZH3NvlSNn5bp!}wYZ^WsX;m;ZE0&vrTMZ?$DH`8S<1 z4|Am6LvV@QZKK+s4RzFZSw!}dbVYaqC-JezaR0g5A_P*1>?NN5oM5W_c-j6hZ|t z1E#;!zf!>8MLrejSp&~@tb=ev{%*3kWui8=|CV@=Vfyup)ntLdiYNJ;rQB(E^3igI z837!r(HN`eS-Z7xG;4Gpl%I&t>xU)Wp)-1P!)yn6LJjRAuuFO#Ra2?16L=OwVc^H; zCZzPqQXwv3*KfQ0&giX0veB>HWwx^FC%vR!kModZzEdje&Z&5C6!4!EDZS z58;Dns}cF{oTP~!?m$e=m#9s%4rE0sA=#_pFqo_aZNg2?1vkEOb1HTdd39_*#=U|# zxBF8S-)M12Mc4_QLe#5;>OOZsf*g}K&6l6I7KoIDX7fMzIp=Wtyg1xfe0Pg!K9?Jk z8gD(N?`JrH^L<4M)B_3Sp*hG6@Hkm`53+9HkQz3y$@e=1ppGmJfEwd zv#st{E+ln)P*vh?5te+~a|1|B~ zQIq2(l*IG}K@rlrF8B(2V1qOF1b~{xsqF#u#KP70;wI2w?+B?H2MXu!*B8=&%QBI+ zCyXSht70(vQybQKS<*)tlYOgqiajk!kJl*D?oR23+{PHX{0A=Kz01#01M+1P2`T|F zAc&49a5w`>Gve#!Q9LJ8CM4UxMrtip%(V+)zkEqSAYZ_`75${^-60@%p&}uf$EFSfQjUk%cYZ=5GDm_oMFOpOZz#f%CW=^OQDQMu0{0zt_`3YP()$iZFkYMB zCf+SH$)SdsIzk3jz@ObOd?)}VGvHO2#Ej`FXc*<%{O?Rm2A zj;lT31|3d9aF)XWk%1gbTkGImXm(Q%y`U4YwE93j73Bq%ZR$71vQumba{YK;o9kTC z6*_5Ob|G?=hGL4ASG%mUO3bTCvP&EHI7y6wdqrZE-;&CRmqMTUDN z<7E1f8c*^Oz`p8@}XDSf{YqgMIe7Sgu8noT?L zI2_Ak{G&^iv960AuLB9&967+xH!kua8yq>A({b=8h}np*nv|Ln#Y+-lR|1*e1(SbRj>2+PgyYJ~0C4W(G9tc<&u6xm@oxs@Ju&B;AW>Bsn9cgfUzKXQoW8qjJqgEUE zjO&c8yx&ag1BE$$tU>)Am&0pS;eH!>`&Uc_cJX-}@_YEcUn6ijt%W=eS<2&SFK`{mbfOBZZ_Jvsa;%@lQxPyKuU=f&7sqr4Htu! zIZld^S(w2OD$WBHRVA;iiE;l@RO#F@2VQAZ-zI0>{z@MFqo+c%cRZ(5H4bgrR?^O{ zWBQk&s{0nCk#R`wkD=;a^52Fkj6#8b8LAv5?fx$eRfd*7|Mp1#PlhT;h3@}@p=!jl zL2ds3Ls12V1pR#vxsZiTT&@N@(@ajUpTRfz=`s%e|iRQzT1p z&fAiGy85R`#>gDK8!Q~-FG9e=m1}Bd9Zj(~NkMaHGtlzi=-ErP zb8rx171Oq{TOY?z`$M7R!%CU_3R7+dfxLiucbY?`W0zdVv;07CGvq6yGqV|CGhmuf zC+JQi#L2^^#ljNQF|YVJh~Y+&V5&%tVu+ukzJK9FA-;tRmWfe#OkR{<>69PNH`-re zURM2AQ3ZGIjwF5)P$8{V8)lr)Ue@APO2jaKf$`q-|4dP3zIKk2s6>gq@urL8-qsm7 zrtT^;s{{ZFGrNp_wv2CY$vZ7Bcu&nn)D1g%!%oOl^P<49S5NcgYQ@dw)pxx(&QWEn z*ZhidRD>7Qt`n^^wdXx((SNE2WMb+}&6h%!Dv}`1+8E{#t1yl9!?Z{~@q{m&f#x~j zCscBv$#=Uo43g?OV|jXGx6K-&*U1WvX(-J?-_m_G&kg&`GHXk;K>W=#B6fOL7j)93 z+v<$3+zuLL6nqu=bmpm#W8XYuayO$~WAbdE<;EOnxrqWAsosH-s$Ap3 zHj&8)OP~dZhpFr5q_ihb%L!M7yYF1jcs2w)jfsM>;0oB6%dX&-t=6QOx5}n-W!J$l zWS6$H_R*Eq^9dN}mVI8{yr`)qip|GOssX#Rg5ls|YUpKyP;`7;sl!mMjP%fbLVJOt zJ2XdH)CULb$mI;(kg>T>FB;edb+1fHIv=Z1x;zn`j<0y_`0?aFI2FA|B7RO!@Q5H!W?F1&4AI7ygF@ z@YY6xl?sfZ`Ug0C3<5~LpoeqnnnRtw4MHKoY5!lXeA4MJ+5^p-?qJg$q)0q!!tOq1 zXfBU|`1|gn)zOluIKaI7H;%($sUZ{z0eSI_wis?D)G1Fg5E1#7tYSRCp*@k*lQ!w& znzh|z51RWqU&+B1EDumTHIr+c1Edjv5+mVBKUtvG$o~@o5ByiR&$-5+8h>UA)&-Ic zMf`3H7LRC|%ug1g_{FWpIJQG?2SMHy@q1`6_VyYJRfm9m*|1AENrCvAKY3Q8`*zpzf!ne|fzOF~BYX)ly;Vvws~^MGe5^ z@&6u-1Hc2ZZXI}>x*5scjtNgn4~cz`r1-0gn*1Kl;>M{_K8^O*ALSS>?uH^!RVG5pV}c?vX$pMaCPLZ~gGus7 zS!GX-6?^+7Zlib*=$vZhd4dDpfe=VpZ__pV1`{ zI+iM*zIjl}Gu{IAe2=Xaf?;l4ai?uMNy6)#k9ZA2$6g&0s%z-daouUF(oMVK!z7)? z6muB+F5FlmOjIYh7tT9yMd}-Vy=YttVTx2FAlRR@K){&?@IP?g_gb27X zZQ0r{ufcx>j&PT4DipSpw<4O&3D@^L#c$TSg}bo9pSQOT5Z5D$(uX0^6+S{%v6lmu zI(1Aq^zC%TGpm(`|CC4Z=7Ij2H_f+Gso3cNs(6**+K2>`K>K#0f>AQjRI~Gr)~VT4 zPq|4+#1m&jUnb+w#lPiIQc^NkFhei9GhlhN)$H;@dgh??Lw`fE^36|GM3nq+BxU9F zhFq3TTteN=a9whXAfE#hqKG%H#mH5QZff3Pgw2(a)}hLw5>L!d=2q-hc7Zc5QMxjD z%{G#a`nKBbABS_2+V7h%_r$mddV#CMyF<7@Au-dt7F)uhL+k4_s&G( z*_%hqq9@^2j-BhdU>3OFuDLZ8*3QAEtBF3S9|$dv-zIC6DlxPv+x&PB-lq6NbeY21dXbRW$@kP zlzP>iDz+x$$tEyKGjiC<<4C;jFk-4mO#v?Qve>%-l*6*n=}UkT#Cj-2Gd+ZpYN)lH zZ&&*@Wgx}swCcpDSRp-e{H)Rg@tq;|T+--N>`T4uhp}BIsiUi8L2n!jWshJvhnb&b zZMR`63gU2blN4A1A)sJLDtAb20@vPS3#avr0*E73?XhDV+mj$aII!`MU{wXbwU*4t`XrUY<$egK&;$cr89zzf&7c zhs4?#1lOj?@~5Q=Std9=*`d8&S@f}cyimM zcI~z=)!Lx2PmGHOwnyd74T>asOSKO9U}&g#H5ut9zMV!xN;P?3f8v9|yt?xuZ27od zwJO=d2>R#*lsWkJ+qikHe-&#Y!vOO$VPS_zla)p;osnGl1`d)hCZ6At@+clRq>8|U zUbgW2*Ibt*$OanBFnB0%nhe3$wr(Xo^~aK3sx zlBQHJ=Uy9$(%RX1VDsBx_};eN?_n%eAtBWS8@Qcd_uHw4^I?~v^Qv^K#^=Yl{~u0Md0_-M?rm9CSPql%C*`y?YdNv}Jkcn-l2*kR+7mF?u^eSh!2{dm7j+xbZD@qV8iUZmhlBlNPjv-5a; zV5CJ+P^#yfzJ*5H1SuZw zI;_G30cByBsUy@}d43fHk-!~xA7)Z@XzhO=HW_y2cN=R`jzwwF5q$HqL3wI~RCTl! z!mFd$+6#YuP@DABh&Lqqq71w<_I~SS0|&nPL)^`g6UF?Y%-kP3U~GdrV6nV>0&`pQ z8+fo58ORS^MaM@_Ppp9Q|DDJMSl}DkvdF*+bT9!XiI9qD*5s!w3-CZ($(XK}C)xddkT|((Y=k!)KO2+}e2A^Pud925y z!(Jl`nbS6=Z9nr41;$6Kl?EHbpk&1xp`FxzlL}P%AD@)Xk%gjrZ_u4GJ;s^>{!#{?ZZ)X7L|jD;51tS?Q74=5Idf zux#AC5hYhs10vBR!}?r7t4+^MY7;Y{F$FR4o|m|9SbKR)CA7aVG1kmKrCr0+*JMHZ z>xFS(INJTd)c3SHlGXk)?>^bw!?SwqSwN-#sfIZoxZD*Oy^7@l0#MGsKL@)nz`?$s{?8!-vnkKLq#f z<3jk@OHdlSqXH!!JDxTP?>W}y#Dh6ECbHT7@*;ea@V6x@i-g=2^1G}TL8UhlE4>y%)hO)J6R8}l zvY>JLz<2Dn6Q_Y{m~|5(WI@Kh$EVJZh33)wyw78`s4gU-A!%;xx z5BP1%s2aHA;ZwYOejfVu6yg;$)a3 zZ=kWQmWdc^Xunk*j=};MfVRn5zwJCLIWqN&&QL+wl6rFB`q^3xs3rARm#X zoK{JRFG(T_*7wW&_BiX<8z>R(D*E}s>p!{jigApS)4rYb#+hL`hmig#pu8(~wvrk& z0FLBN$ZrHckkmIWG{YN7tCK8JWsO4;-bzuL)SNxSjRB*|bI|!oH$nwkM92P7c}d%4 zcSPF%h({rq6WQcoer^a)l{kM#^Mm>zjCIeUCyPS8ACj^NI6zluma=niQYsE*Y?X-U zMOk*k{osDJ{vNgLykN^aX*X~ZD#C_m_T%m1`%y;yBdMTw!bTKV)j&qG9W(lLi zPZXoi@|MZUHXLxrT9R>5D9?|Wi}bkW@#1mD8OE1ljj!>XYOM-C%%`_m=*am%lr2C<(#QZ`=UwQld!J{r9^UJjP|8l3n%w66xq z5JkQ;(kzqc2G;}!gB(ER5%|ez5WrEo;IUR)-v)>wmlJMVgZDWvVIM?lADn65^j{&| zDXvqhT&!o`xXq3s`LZSaeDJFUo)}smg7a~GGET4;Ft)N0f$34UTe-Cg%!!JBd{T!E z|KpPi6Lha?u6u}PZu@qq3-n1H!v)^!`|x?YZI-CDsg?=s;aF8ulf$?{V}7Cx#VX1j z%$#dJtk;tD`q{)m>FxTixIX{wo@!?LpsP+2R@@a&CuLa(tJujv$CNxSOXEcF69#jO zfU>Gux-CXU+AuIZ8U}Vz{HW--{@&2x-WW{DOux}>sOjJA2uerQfP7$Mw)?2zdbfhd z$|>pz53qjBT(7z%V^;@525CNg__4ScnThPEC0a}x*B(j_YC->CtQCoeV;#h^G~k;F;jLcp=vi77UBYPR?I zMSqcfm2tSZoXl!xk!6{ym3G)q67FQg3~EimUisw#anr-+FpJIAPC_+6ndhASW9Q{g zC5vk9mtUqIK3=bDq{!B1MU4JQHrFqE!1n0F$QI*=^>o-ipdE9jrAEcM>%`UZXG)V zJTA{x-bQ=#su{Mq$T0)W!Q3KD^{$NRNe2n9Ty@H@cOk#Mn?r`1>^H>$2F0__U$zMU zrRdyKP4i+D1phIt1w7fkxVg6T=y8}3b3nB$z%qM+Q)~>>nbnHFL6y@jiKZ`Y=+}KU zLmu}It(n0hCp$&+wEkZDF2Rx@;khCc=c0-HcEDKK=}j%F^^zs@NIaq8CWmLiDJz>; zWusJ~=%SnzVGoGFCQ*ic51fO{emQAnP?*gZs&r8DsA9?Hpx!#|+tz?$=EHdp+-)~O zG-|iQu(6H9C%i89qw}(D+BYAISY7ft%oQ)&GcHzLE&+pkt45aXTf>8x(Z;L%srDR^ zoJsnq17YznJw&HhJhEi!T0;maUMTmf{DxLwe3Ws)FbhvkI0?d7TTT_B^AU|(?IcB0 zY+>fTMTJX@Dy+0DJWe~FZ-$#kW;V`7mrcCt=XKFSCIYl>XJ^b8crQcClL-o(t5WnN zUw@P@FgJlYQpAI&bqE=&Ql&M_E*UXDK>N2Ts>w$?av8>ykD&%`Re&fT9c;2D0Tc^0x01j}iE+f?s+4tQ+Kxy?cLqVLs{(kxGptE8e_JAX=?^I50)s@4$KW<#v$k~)!6T>9Gf zC*_uG>|VhbWnu?4xbNL`JVU_z=&vV3QjtXfzcS)m+*~!>WOA|prZVtqXuJiJo)#N+ zu8f8nB6FM;J^LJsYzY?IPX6&u4?=H?q(lvKg)wX+<>fAUcbG$G-(yD3-~1?wLlp`5 z&|}aRb6!go(fMAzXmHRh5z3E9rZl7MC!aJq?sO2@a(Y#4cp-3RS82M=I##;|_ScMk zcp0l5tAwUrUholAe>A|W+V8P7=maYx_FwvM&kJKHkHPAEhKQb%acO-ty6c-NdL9Tt zCAEw79epjfJ+Ne0BWiZDOhHb^=P*w)ad+64V8tle$}aNY*ITJ`^uAJDO0M+~N4A=H z2~;COmk{D4Bau{=4p_NM=Nc2Lxyo4PE1)-biOi=+-+cPw6af;TCS1pQ^9Q*oL7v;D zm)ShkF2~XK$*m*04`>Y=Ggs0(zm7Z#KbwO`dz?zfW}crHP8`sDi)b+@zr-}R#>^^* zbj?~F2)?I7D8ivFp7+q@+t@Sl$MUYA0w_b5HjKl0EDOb3E%t|n#F6s~KW1k-AmBA2 z2s&;7l`=;O~Ue+T0Z6X`oHpJ4HwN#R~$ zJ$f5+yb{M2nqOARxsVumb@6Y1G<}|F=;MzITD8mlstuDud$USAhTQX~h|T%0;$lQf zwuG~Uj*bDN*=Z$N?*x|E)mCqJk&acJHDOrHLIcEX7S~z<1vU@?Fi=DUS-$gj5{(ZH zPNAZ&`c3)F%Zk}1q~$aKQ-Or?rEEa^mshpvUGi1wE%FjcRmU<}$kCR@NP!S;^lpVA z@_bTcnTFmcBj*LCTMeF7w7&sT|I`Ukv2AkWrbCr;`zN$HVFR0R(_QT@ekm2e7DMSZ z!DK@!i5%Ey6PyCMLjDH;4%DzT;r;5P?xAu#c6Dj}(cK#^VY@Uo^UP}8K=DPEyzN9R zC0uncrN&J3q=GvNO@Oo&mzq@oP0!rTQgzRK_hc{r6&@PXZ@nGlbYUF6JtbBcjL62u zrm_osso+jUA{1=F>T7#9`2|bX0-(CPB(sRhZe0(J_&;Eh&C1smt@!IyTPjYxgB7AB z$LUA;b7!MZ{Wtlahd#FxtWcwPZDlWH-03Fo%p6(|-^JA+7F5^3c+1N=xk5A_9TTw` z2})k2-V3Kd|B5KCEN_;Pg2~*pAVV(hezud5#Qpe2A#jl0bekBH&J`NrhTtGOl9K+H zNp%=HW_}f}opTrf-m7E!0ATq|@=Z@TOUT^&X&`-DUDl4){ zo=#q@Kql#2#uV$-ieqic`2iB+F3jTXM~=hy=4QFyH2QW7n`~`9xQb+h-GhmwvczCR zqKL^1^OiccJu0`>+TAj3*5h)k;+&1afD%El&2HTcla%$!J^9Yo99Oe1u1($YkaU>B zhmL6uyMnVEt))GYl{i0ALf|MMu3KwpSh$1X!Ys0g9Kq#nqD&B3*Aa9K4>|Q0an>iG zc#72Y)v91hN*082L z>tXoNR>!M&kk2`!h4Eqby^tZ+TVL8ne!Eu*>I1@>IRRx)gP8Ibs<0uWDV6E0GYBoQ zOfEBL_I`xd#Lt?aYKj#UyiA{Bj!*s-3k8{Zk|zjiaufbm=-FxcUw7< zFxeOvfCNkPkBW-1U3eR;Ps?maotg0bqd{s<)%rA1ABj;yDUR2 z7OKSnMO0EL*sb2G0ru@n?*0=~wZPWGPmJ!)oEMgMK{`oEh(c_!N1Wbp5R74q&2B_f zt7taI`&FQZ%2y<~J3@hH868%N!l#1#Xx=NM{Y2+C#<0$h4H9nM1+oiNqW@~BhCeBf zxxfcPd=Z|{h@8&tC7XbhSH5Y-R7oOTvbN<=kFQl6zSZ53Z6)j@P}X(@uS*1KsK~m^ z5g+6&MS2y$qlFx%7~<_h+M7Zp>ul&{IK_hdCIg4D>R!{r;51diz6(cUPE)+;3dW+n z@tAdNemu<*;|RBt462r`pN*@GNa$!JiGag*LCtU$xB~_X2my@w6uLkSXWQJ~Imf98 zKPm||-bs+UV3O9jW2AFYeEg+yUZlDDJv(bp>G9S(S-Z#Y(+#S`W@y?y`+lonWkJKo z0I$U*o}R}XS)n8GMxzLgf_iT=7R7CIxUYItau$7C@$(%6<1gYB%iV zBpn#{T=vT6BP`MUVO=nqp<9~5k-gVyRs50$v{1=K8~w3RbtZo=(q+d8MWOrpL?e!v zGR5RybG;2;^3f?=#ShPRC!-^^Oo+IPNzU@8ZfdInPM(jhh_)lXOgX*>Ese$v=)IA; zJuS+bI?Wrg$e15a?0U6J-SYb`Gjlq}Qd7bid^aMCNt(5;v?yEz!!bqwZTk7?w4ZN0 z!PZHlc0S^p?0Bv;eB!jh4eC0wf`>0Ne??}qf*xw@+4jUx-7_i+`D0*^1M4gmV>+79 zt%ni8>JiWh>NSjlmdNJt69ITG4bpu)OKedKq_)sEAbZ>_i`*5zNA zlA7y?aq}uAl&LlQMz^bjg@N~;E>G8aJ1}jdft09!85?d>B{Qb3%qk) zlj|KOow;qZIneRNeEFt2_<>29$oKktS)nk;me1)ngvx z+1N@Os}O$-Qoc6!kMpK1oUZdW*HzXfdXM?=GTAe$It9};?$*VLIe`Muqj6zrfI{>a<)NO6{mv zi>hO9TT#n*izwCOPZMVQ(UXSb;J}8QisBA>f_M4n>Xe_6?kg=?BApG8w&+1u!JnGo z1V(*fN}YSKYT|<66r31+u(t8Fph_Rrbeq~$ zV|vToHv}Yo_!odR3|>ImR)c0`MD5#UC5xKwFuvyMfIKe-sVN>8xTc;=m8JDls{e_3 zH@kwU>yHViHhGlm!muDP%=FoQI84p+WjDA=>j4Ce`KWMKo^aX(O4zs%+!g+eY=*k0 zA!INzwGvqfiir@Ze*H?=Rv`E)^QjXEzP9KP(RVtZhyVsKQ1iG(Uz z`dJd0Gb2B=P5I))Hb#DPCb9UvDg~^ZMp>lPdcb;c04t}WP6$}0tkmeF1#QnmRvhw4 zr8h>N)0I8b)gxKZMD=smd-qy6Qf-p~t+dGa^Db@{&?U5fOg7>tW*ne;oV1&T`bj6Y z4^Y!R_EYDaLe3tNoL_}K&L(44K8=gCF_^LAkr`8RoMb4DZl}6wUK_rMoVSlqk;Gsv zER!%2&RLG!_-E7j3@4I$BE(*2osv#qq&Gb`fPI|Hkgq;X2;>V^U!7b-q@EQo^C$b3 zXv)#UjQRA>I1JWgd+;hLp?>l=vJLeQ)@W;%fz+fIq4p=kh${P`2cgU-I&LbH(hCc@ z+^Q7o_x#G`UpAWWRlz18)d;kaZII>>4hfuQG=Q|*(UBDa@U9c5`V}r=bL&7Ky)fpb zY-$|}>%R!|s|#uBZW2pl!k#xTdTOxI4$07bTP1H;uuT0UBl{KwJrkM$AX0FvP_Yv# z0l~%AnkGwF^P?TQ&5w+ePr^?G`$a^*6RR;tk|#FQQ@oJ9JEETKU`Vg*n^iI*VGj26 zcET@8JfpRjoHeJ}o*!PY{KFy!4JTo`Yg$Jfki(v5++r8Yv3nE~Mzl9V2QL>7HT5?~ z+O2T1f|7UGs4p=d5@w7yv7UfI!Q>EhJyILl3A;NMRmBw-zg>QAt_McE7Xwe-jL6s4 zaB3WuZbqZ8P)QDBKYJX;!Ri3s%HuiV*$|SM){CMNt5ma7l3k2OHutyrP z6}h70RRHK9*8bBYO=j`?>iefhI`OAR>T-u=b7BNf2JDggRHaqa%q6*R>$0Ws;W*Vn zDrZ)teN%9%i=<$InAbr<%3Qb5kz0u;k79k+2qe#S*0CtDB2nEyvTj?x*LpkTRM0#h=l%SMQNZG`Jby6MIFsBly1(D@ejk>sC$^ZB@!mz-EkwKP(2 zLM2=<%2IwPRPeiTxZnhVzZfwE97iLMCozSM&n4BJmEyl4&w~PlG&N;&Ams`6^oQ~! zt|lYh?n>@-d0z|e&A1%de9wCbL+Yt4+n0(}9E9U|EM5sD_73}|9e}~m>fIG@G`Dax zWn<>R9=ugJnZi%~Ws1L_eXd$?7Ncfk5NCO-)ycCUWDklwqrjgaO}EQJvlvzdejigt^5|L;Q^4`nRpp&GKiz?uEkL(Y5y89M}s3b>0@ zfPV}zRr4Uu)9CRk^u`Y3ieG{0ft+|9rciv~V2J z@V#@Tmk}^z@ zkO!#^GqbY)=*M;;hNan0An@X4FfJ(7+{R?xevau^ejl3;ZQ*=KD69LWC0`nc+N$V` zCrbLXk2bv40+FmsL=E0w8LD5vun%}h&&M3Uz->=X5UsFF{EvSOg+$1{lwmtnmu;y; zr^ffdZ^k+`3*(f?zQZl@#efTYP-?C^!A5tOJ)0oy#VbL8oPU{PcI7b|gOV+zLPEVP z{&U06pYY*AZyK)muYvy#k{&K(>Zu*44|lmE(GP?$EHnf+V!E}F7=ny^8i}^nx9@Zqz83dJQrLlWx!PPIfJtT6^u~bHn;D6B15<;@f zJIU}NSX-@T`FT2BNYA{07j#cDX=}v5Ji;90H?D7z9{MSgDLyB*3^Z<>3%X&Zs-@a* z$Eqv#r4z~Awo^G2hx*fAp?4fAWO}QvoUiF{fnW~p{P|{m=dg>5BaYkDeAw1qzV5Cl1}Zv0E47(P<}CH6&R<@ zR43ppw*U!Ybup8~r?z!i)W;wn<3M#}FU`x;V%y#Qg+TXZ8D*?53?V)n;4|DmsL_(j zx3S62%t|w@8Q-Ko!c`S7xeQN?310#eba zfjKqH9v8=QhoP`!nKZCb*$~4)U1gdYr-d;y_m}vT`9pj@0Ey4Kzr<%~e@Z~9s#F|X zn^?l=-f2np(!Jvx+<%BqCP8gZ_4EG_pZxZIBFd=sSjB<|jr_J|zYKBcXqcDGfX=ZV zRmv{og;pND-Aey87UM6BYE}2iSf_|N7nAzVtq~UYrq$~37SBE#kcKi!)44{R-wo}D zq;T{Nn4eVnnH&p*ltIP?+8v>kElgKg&UkX=1vvfrv);2nIW!v@SY(^( znvXMy51mA8CZ=Oyom~b_fEgFWMgg#T62gz$Q3>$3DgySu#HX7P7%)Uy-*}jEWCCQ# zHvht9Kssw|2}qSqGu=?%kIfwqYoF9tf|dBEDW8%3!+hfWVLpMEmJ1yC?iQ2*&gC$^ zE0#rc<_&*(q`Cha`83DSFS(!D6`F(GwyYHni;5(>{e`|~^~!+hpus1g|k?Z*`kzR1}iQju9iV{#8C!!2$H&tJIN1y)G^5Cfg3$bgU#&RI2}eG7Z^ebyJMZ}_(~n2FI&RJ@^265+9C|pTxRNjss2Y2&d*=U%6gyCO ze#@PS)XFQ`JLyW0zWO7f^*sWdFK}DJe-5&MNI1VWL}}5aN8B;WdLghJSAz_szD;O| zGvK|J)FwhI7q3*A+(f>J*}j1(g^_E_F-SY!b*N>_pqO)PA=H1GNFcROJC|{~+n{Re zFoH*r?0Ooyg!xtjGsm9i6c2yYop;rw%fY{l6(XSL98h5`6T#h{Z63F%@QZNPcF;@Gw`FSY`k?6jBHzgEzQ8~ePSFrZIGuIh6k=`MX?{n%swyDmXhFC;C;YW z!1=VH6XAI+1vtem$a#$z0*!;JRZYn1PJL1ID$~e%LspsjugoYz1f;_aH~z&1p|%FF z(0iSnyxzR6!Kn>Tvd`=0OE3E3U)^HV9)d&dyGF4d++~SclXi2U!%dKoEy2EZRgZd1 z!raSC2<9#AypcikxFT|Vq5R4?>~0(vED6?H1(7{O^`H;PL-j;7pzI2V$a;}E=WzKs z`9^Vv$DKpr_E`f6cHY(>s)ziER$cM|#qD(*J^k z9MA@ePv9@8rR=K8alXfh`ehMaY$sIq9aU1KcbH4ozombetDTsa3=)UxT!_U|19*h$ z{2TBk3IWkm3ZO@Uw6h*~Lkf+=6n7ku>nzH?nj9u&>{eRkmH+yGFdX9hx3 zKn^+v{@Q-xypW-a4dl9h?~^k3tfKQDgvurv7x1CT41w5lDuXK+h&}I?4E5uHd~+SM z6!_>5FFKiHN(6+Sz$*#7Vh}F{FR&UH7=xMnau~o)Uy9xccP`+&vVO%^e972{K(Kgk{6 z2bwk(l)oclLjJXXM#O^hYi;kX&jPBB?EZ|1Vg5+WbB`KR{lxFfo|y<|bAr9x_55`G z>?A2cg1HUJfYP2sl3m5)1a9^qIjv1x`@QLZg!oRseF_kY355E?LG6+wNg{kz{{4J&Xn3-OYILL zS28GZaa?{3yiHdn>|ol=d#+^jf1=Nl$B2KU&*}deeWo>${mGH&NvP6P;U!Dca>5#3%lE9)xzIhIdgu1vB}(0C3zmfDO!Jh?x%b0 z?FQ>b3msPpj5YjnjjJ>ta?o?J)KVA{u5(?!;dz9%7&kVPI+1RFLS&^0b32rRs?dFG zHaM;HG{H9TNSa!%f?mF*6sx)9Uaiu|Ghss1 z>htISQhlnYa$IB;eXc&z=+7jVOrsOy5Uf-u6@569RBMmRQ~pusK1^5{!KW(|@wu|` z{h$n2SD?C{>z5lc%$sw`OodN1cwYOho<^{!4D8bRNX2v`S?yXuQ7eUBcRs|s;tF31 zlqjjy<58%4Q*+1w>`SWvYcnRot%XGHPF_8%l`YJwcd6EKXIuMIc{jIjIlh~x!k)O7 zCPQ?ydF1pROx&W?Cn+3p-t+3mt{cXSVTBeHu^neKxIq{1O&Wchj?deU&7Y#fZ3lOV zQ|_@?Qo}(Gid|Iwx~b@3W{We!uuqEM9TZNKV3n|2=KiTZzx=H}Ba4t;s!#6M>NE7E z`rO_(e*sBdQfoeEl2OZw5#1CgTmfgPGS+I&f_B39Y0yWCe3!@wzUQJW2NxoH-JCo?3G5YFb$Ozz^} z`qc~Rb~~dxfc>xqx*v4ki?>fFV6UW(;T$2h7^AA)GCNbjD4)Z5LLek{-|L`5P(g@N zy|)X4$QW|`X#NB}H}Y~;L`gq-o%jBc)%NKz`j1EYnn=!+Yw^RB4($vMbV)(1u{OqO$0jw(U!uSsW=w3ZiQZkJ?YDFBQ?U*x5QKKe?U?UCXWqBVACu`PexS?-?e(lOJSZ4B zVniIS>*F=o!ljF9<)nUH4$Jv>IqU#f4%?mfx!q(Pc>Wmh{E!)6DdWuo=%ia)z$3P6 zK3;CWcc9$Q&ad6-n&o*PJs-H;&I3%z$;oxS_PP5YE%Ta^YaB}Ie~_XWZ{x%nU|1gA zGBA(o&S{P7xVnC#7C5C~Y#MNrwvS5?!kuEva=)k!o42Nt`#GtBP91~lnUh}+V)K!1 z(ITkRxBUCGCG`9(_gai^oam$u@-h0O^@PrE@mTE`E|f@g;*|1hJMVSQ!0Dq+W<1=< z0ZR$hPm?1Y^{oRU7s^CL1b3zfBg0+`^A+UsoR%aFbD|)Evd&ATX+Ph3obgnVQoJkl zPYn1XZCFBZY#D;u)$m|TsxC(>k=e;-AoP!@m?PkUJ)Tl8`|YvOWtF8eW2eGVVEW?(qB);MO8go;kTWg6P5N6{<7e0NSS z5^N6fboPr){oM@|w8UFxD+(=?#uh>a(A2t#`VLZoE6*+kJVF|5CZZwyLH$5msf`-t z6l#|2>p^m8(NlAmZ1{SshoxjI!_O;#ZstFZ0pC~=M^ z(E5!n-LP*25Ip=K+eEF1m#0}UhE3KesM_6+HEhTIoYiP55VwP@ayo{c7y$C z8%$1){?2@G?AR>2B>Q`g9iHWxlNo(C^dsp8CFQVA_MB3I{NV2FRBU@S(Zt1+13if| zb|RA5c(=3N<)76=`q|etmr|GqC{TP}ZGbhaJ|*A~w4t0|Ms;`!wvE_k2n>z|Lfn`I zSXg7wzt*FE2~_!6(0>QVj5jYSxl|y;E-7(f6q3uJEw9$ef0K)q6KpVU&K(9Rg9aPeuyL|Extt)>Xp13Y~d^| z;l`%e-L(LbFKlriL75~Z(S%amEmij6Gz__!>_<|}%G&gvZJrTjOIm0u-Z*yGKHU&tRs7K9xjg&4iiyyaeNKRR^WrAh)PmT!QzLO|YyYvVLV<0+b7w;uVf56tv zA2P6hSbI2)zSpv`$P?7Iwf$Rq|a*_L7ep0{JNa^`CsSI6BOcaO|7nn*|ky4JcO6QZkGR0c%(-*i|_-Rt4_%u1~*Z6U8+po zgPyDnnI63B(qZHK`a!2q{L50x1PdYl4g)vXfhUKBb#aYWF{0!f7i1u>&ks$xL%8M{H9W!J}FU|5fq@5AQ z@zS6Kx0%MGnve!ePCT8@Gd}eT8wh*Qu7<{4DT!!=M2)Xv(b!yusU2Os(D;bs`?&mJ zxuw;pP3cdX9Z?GJ#hTv4#FDmH(-KYmn~!pH*SUSHn=|-Dsu9GMnVV)3pY-JHtiT+> zDHK;VH3K(G-jHut(@bVAp|I?iJGGEfERdq$sFDmnEOM3s%@zN{jfzYV?2AA?>A2)~ zVRh1t8Hn9=^!9Dl6Ap0}o`F!g-`F&(*lkw)eKpM)q*mKSW{NVH4^01Xq^Zp5KQz5H z{&J*r?q@pb%cp>5sIvc3kB-1)BJiEN7d+puKlikV=X=S=ylIz*amBSKx^1-7o|0q` zw6&`#BbW_R4{XZ&bw*0Q|1LY)+dgu(hGkLAZO#qKN6)|2>c$s`JpeItld>62EoQ&b zs`F}4vdr*ZS^=~rcxl91QC%`4#isz}wG6gep3FklXZWyo{6nNe%vzt+$NIW^edj)c z6%Mqqr8pxbA3Vq^d;uEV2zO}zJGT#w`}QEy?UShZu`}LPlL&-+`le~DAUO@LqnPj< zGqTQwzT>W7zmM8pIZ`SYI=Rtn_%Tl(yYHYN-!t^JK@lxFVz4r^GO{8gzA=70Q3 zYa@&i%!O@LnSI_{p-TAO=8w6~tM$8mFm|(|vgAl?=NB>1k9y8isI`>LX4xTNzi_1O zkgpu6MnzE0bWX-YuZ^R^lf&IhJgS1ezjwZ_p8qbd6|wUB5fQu+CqpF@@{nw~F;Ng~ z>Pl7#74=wS*qn4P2scjM8(qcUg$K=#mLB6)Nb+V*eW1pg#Go$OE|k?kJZkx$@#vDh z+V~0P9ZDKCsPr4Hi~E?vQW4n@4q9R*l&1eZ9&OgQXtAWX2IA4OlW8Cxbz$9!63g}Yz75k_8>(X)_<;GCqF$hk!&*#|ToiqiMVVSmPLT7Ht%9X<# zD9^k(=%ZA{|Fs>(>v?HM4VwJz#oW;b?HOic@Rod3+ig;;X|(s@fOhogZ#%m3rya!; z`O}UH|7}NUr=du5qHpj_FP(*Jm7YW&nCHq#i??28r~|I`m^LCUPgr`UMq%bAX;v%SX%;PecjfyXgYiPXZ`e}->#FfX zBQ1*iijeh8%@|BGGfQ9T-E4|yC6wX<)gFUB0PAg}k!7U)$~_N5_2Sztis|?f^{9Bw zLtTEIkBsEmx5BT@qok$2?(}dI9S%`0+|6QSmrlGx_!);ai-QWUO)?JnPsq|^FrOM*0-g}H*HRhQZ~@jT?42T~Yj)pPce>zt3?92UUt5k`NXHSZRUb*7vV%Ya>lJLz zMJ`bB4@as|AE75cpm&;RS&l|OEZ^UJ6c6UV7q?LcM_0~|>EjP&$?kYKtg*y9Z?G%I zFYoLuUt@V@%OpEK^^Ig@9$|_q`JuSZRIuwyB`wK_zpnan^Lc1c8)cXAhQVj(ZcqKW z{20Tl#h|hBxRTK0y<21hQVx!(*kr!*0#$a#hFv0-bxXRDEkDwSq^+_9m6@vux3T(APSnE7c=N0~(R+6lOO)8N+>i1_Wh zb1)}n8)C$Gq5B_?v!cu{~Dzr3T zZTA?iEaH&!5wWleD!&rkJJMnz^o)=4P#vXNtj%PLCY_Bo3_@Qm^(iLo9J)3X=9%&h zRwCj{q9IwKcPUBxD$KbhtEBzNSwR)@&hffW;jQ`PI=~{bJhZW@A}V2CJW_@qIud|K z`r%)X6!Fy~o%q)y?cdtr^dNQ(fAvU5tXCox{?j9k;K?##6ePmGpKmZl?BV_XMB%u{ znY4mya)0nt|K_KqkaA*M!7*M`KLl%n-Uq`W>G5|<#VtKstm1Q~op5TAAjRF5FCJ+V zHkqBdsWLurm0KeXV)JV}nk15dqfBr}A8ycM*`ynappbb@7-TRMGQUE^IY z(2kk{?I=Mxgd2hNPcM%zK?;#*GZyWY1g8$)_#-+n5{FB`uvbkW+V|A|ZAZg@>2NQa zZ>Y`stS@)ld#Tm-do42jU7`CryLTz{O`Qo>6H+cl=LIB{GTgBH3zC+eH2f_`t1?_x zQ~CiRL!TXj6Uk0xobZ_!xKvZ;>E!k_Bh$&N!-YTfA{4!=2{ku|BX6b5iv0ALndNI# zf%{!eUZ2iAH)-N09QNc!anbPDdvhaZ^UJ zep#_qHA)2#@-+qlDhk3k)j31b^(nq&#Rr+r;s2JSO7e>TwH%drEk~(nM#BH!ax?=d zN73etvig|LDl&6POC^52Q+A8q)fh!q`BRR@<-e4pbz=z+pdgL^E%Mx+`5%$z-P-^E z$WuFc#mPAahmk1%le9<9cQ6AHB~_J`0#fjC+jNhgP=Mt9O2>Q#d+FkE)bXAeOzttA#Xj7+~02yU2{O6855{e;+KK0V7%i^W6vMp)G5Ql>V z@Brk5#3D)zQZ>3md&^+K<+oo_4N=pPPiIWbhQeI3?RPcuHb0P;*IR9SYHTJ*b=rDc zerMMp7nADX_<+Zfji|TZ6=);X>@5f-!Eg8Wt6)$fputmV#KVYX&@&#Qd{+{%-Yn&qV4U zd$hEY*i>1@C6}zHt|4!Fv}R(kU3g=va$}T)>uS=>QWa9TH+l}+-=iDW;KJWD;pPl0 zDwyCv%hm%S=*liLR{>X_!sQ5&6{D-aqJDEt&&j=;xSptzK*$MRj#K<+w6Jm4R;wSW zq~RIEvCS8QM3bh%Y^N0An=SmNX6og3i2CpKG^QT0pNKF?N#9II5PKrTYJ-Rw*W2m^ z&%l=dDv;sAz3-wdIDBiTT~esALGSdY$|X+ccz)>XZ*-m5BlI0^_Yq_58V1nr7=kol zCayQBRlaYq0Ys0GjWy8MJOTrq)}A(`#C^Z5su{c2JA7m)H6i`3?fJ}m>hawbwASeR z6;iAntzwzf9xo-$*s2*qRAjuQzLb>+%gt1ZzLazKR98W^MBvtND0^&(-mx-O5PW-5IOL z!uan?O=LQ5IOOg^ART$^u|Q1HMmb$;@uOR~;Vw#X>d2xK6C5 zEx4v7M4XEtOyT&CNrApGPH82BsbJ%8Y%R#?-R_Si`12jNyAi8ZgC zRs;`;`C%mkX-nA0A zY_Rkv1x-%tI?0n26xTwR;We$h)hM;P7x64t@;!_!wW`qNTTS$Vjho}Q9A$`eQAxG& zSF_=^nMo{fmFIj!e2XY9Tu_*`kNxq%GA_P?u(AJh$EsVl$l}}2aNmla^*C%(s-i?3 zrlaZ!_GKXs>l43CZI98-e#dS7q^*lG(FiC$pch}PlDovxIar67mJ zym>Qa>vb*0E&5$+6J-fcfP$zpYG98T-rFt>!x3g{>-g%Ld-X(8{oB+8N_pGZ=?*|d zmWbdH=95$?p5BXWf%Z~>q=s1tE?L>H#GA;6uyf<@lM0|GwfY+*Lj5m6qOZZr1&@G8 zT4W7~q+R&&N%4(6t}h~~6;d8I<;Hucl>9Y_+)gjg^Zlvf5h_;+oCyoQw7*57o!UVj zEh--9sSt*EJ%})7S)uj(J07+2<5tnG#-D9*Er3Xh+Uhcr#nO6FgNRN7Q-|;xBgWI% zjMCmG`&&F|%`=@7NmVm>93I)zgP=Qouk?dPSt3MhQ zI#<{^&sL(t+S;m!4qSUAErA_I_ruTccri2ndc>mt?eEusmZYG_Jm7!UWZJfoUklpn zM_FbsC1o#8ulyk}33dQ&n>mW|SJqBLffVSipLVuVHkSsneL+^*)}>_|7Mio>N7@4# zrkpHX*t2O+2y|R+t+j6($<3rr)o7mndsbC8r515#(7<%$1uz|1#Bb8(g2>)dB|X4D zdtUdJzFOmkMZVr<9UM9KySw7)p~zFPDlLe3i|>bD*eMTuaV@%u>h1{T_MN;UlB zsq3N^)zJ}Ll)*Eq&}I3;>?#rsVapQA65^=Ahq_QG{s&~7JUisfpf5iGUlDx0*o9oZ ziSZ-f!^PINIHy+KQ4LPR%R$N0THJoqJl)9lE5#{4GS{MwQy|)9xta^?wE{f)w*t&; zH{bd`Cg4g^*ss3&WuB>)hTTOc4YVnxZ~+Yu z;D$Dp6Jr7#yIX35HP3~Fqr+%lPAIp_qd2D<{-L={nnqK+(li|h_Lbe&8k~%^DRY_}KRMG=DqJLCU;eS=qyuT_b?7u4M{;?*+ z4uXn{Y~bySN@`}rK^6UvN=mvp+V-N7j!w~I04ga34mwd@z-Q%rB|s%j2$lE>mo=jJ zqLT7dl?+(Sp$McFZLF1Il&o6S;-4Nm!+9vlKb1*3UYY)*k`6yy<-Vw-BhWts|Eo$0 z5$qDTcbEFo1cv6Uk`1&OL5wUI{IqH8F3v6OX3P2bW42BunFPywAtz?fGQ7RstUuHw ztr@^bZNp7)*D*%f0H1Una7rtMb-!9n&SM0A`;f;B{L{JvH&5V}6En9C+~%KnJgxQP z5f&TwD@K==qkp!&y{GoOmV=PImb#=;YZfiYJToV;O8wZW4?!1pq|oE|A%u_b{uXB> zRKf@Q2;Fg8O5WKEHVGJB?SfBC7GGF1Ak+U&;;EGKS@Ju&G!;c5XZ3`>O`It2Vr#b~ zA3Ee4roq!x-;dteJpelq;9w1#&}igA0KYD9c5 zG?%etfrGbt$o7?TX?>?E(;6Lb?``9`-A3if+(MWqLWLbTHp_hQQt9t26{pVhDGV`K zk+%D9ojC*gfye1V8U77T4j1rOOpZB^Qt5kdw_2lzP>=Pmgovdx%?Qo`m=rwhN`oq9 zdyRiV=SJbye-xpvt;pDCZoAA6rBvmeMes98J~`V^N7kF^ILSaM50;e<^XaVV(IRm) zIsVImunPME$@!lv$@E*E_1h;f&DsnVLLb8iy3N=}dNNspMA1XUIz5tMfj2 zVHChBD?jQeYbIQ0*ZXO;IYuI@LOVJ^VDm*qZT7{N%Izj|o))vQaKhyJivks&X&(wFi{+@6bGmiY{HS{RZqzKyC=7TNlJe)=GSSO9npwq1vzu%b0)f8>U)#_ZS-#6Db!&?$-%3)%DL72KSS9`9nEV zvx1f4=>~~8hKAcbABA^te7-}Z&&e+ExzGcGN>7=h2D~4F0#7TWkh{RG< zghW159ibf0CmeK0XGCMeaVGyj+`{8B909Tp%VE)G{fd$r{8yAzmZXfPP8Y-d-FhdH z6S*||5!D!j3yynJ1jqZ$sjZpxs%uSR+R8RU)qtoqYhIp1yC8)SiG10KN;s#wCfp2L z;jP(b;MO9l>9J1NdWWh<&bDGlX^WA@39B%x=Bf0a!HdKhOZPCY+lC8TbU=Y+h=s!;r)v~P zAaa**7{7%~)a3seHrX)hTkw$(nY>^{$OqH=h&Ij*b_2#cZ&1sYn^?>D6JM z`*M%AJGAP)nZ!c$C0C=zMVEGNbPo+j*bD)DhMg7S_fHya>!16e#N6GuLc@@f_s?R~ zXghpK>_WPCP9o-^{>lu>Q#VPU5v&abe11%yW_v95GMdKFr0zguC0I3XY zcri+e*MZ|Sz@ePoz0+YwCNe)8u5=!)A1jaKqpQ;0D`4a!+$x4sMO%%(ogR|oe&EXr ztmKLXaSFX(*^JxpAL3;irC|DfJXVwBKMcO(kDsHI2b??!CAFFZy zn(u7}Akx83;O+_I6+P_%-l%T?aulH+c&A#tzEkmmLpcLufFcYCrQ@$cscHl8!7E}4 zB^x3n+q(yRa*6RLrlGjKY7(iOf47YALN-8cPIjJdK9;urFYE-_0a0l%=P;dM=8 zhPvkRsLds;up0f4k61^L`f8S$rNu)P?%P6C&$#TJ+PmT2%=fATBa)EcUPmOyV`fBO zMkG6mpV4lXzuGnZYE)2llhbhnURNYZVI7aN zor78|CZ41!W)sJQ+Y+6gu`0tNq$Uy>M;8mFGqhsjYA%MGNxP1v9BH9t9#6yXCN>=W zDhd?ahvLn%?+YBaKP7nN^A4K+n9FZ6a^T&*wU&A=Kilw%gxFNIgRd-5Jf8bXyV20o z177v(bGZuJb)yva=Vytwd>c-kTH+R?@x~rVt|W+)7nKx)Hel@AGdiG>Zb+nP25(tv z)ZnTeV}DU{aKQ80tmU~gTDs)kP+%^&C)4!_{#yT|)%ipx=ktk>Hb>>dF8)b)%vour z+WO4~(iwH?R3**&KHXs3yoywW&g1;;Au9px_NmAAT!7hGYD7FY5?c!rJ!6T!2Y&Q0cuzc#egiB?R`4&g zU1k!_&Ot`h;e9rJy3$G>fp4oJ7Y&H`XFDCVvD~75X!;82 zS`YPCB^7^BN&AB3!yQJ|MC`<7j^71a6frvI@m|n_gz>rG)6aA&YM<+F|C|nP(c72o zEzQx(-!Kyfm#OY#bQ>lcCFpYD=2yM?LP>vnZ`$#^GurX|dl5&t|m7Linb4*i>S6d|u(}&+(J+!+c;% z@{=7Euq6qZ4xFS&>Dr5Fv5gMvutYW~cA2b}Kuesk`?8r+R?p>4`wq%6Sh$w~Q{C>% z*$)qUv>Oe-Ktkgul*irQJ`X#)`$MV&1M9q*Pa{Yj>`&2H54+E4p3Y~rKx#-%4m{#> z{&YAJ&dNIxpV={9IvaVnzx(ra=qrG9va{bFjC6*wyki;dOGs3#%cqO|P)d*7OMUIV zdzag^WdZnqzv_!6pE3|n8a)<0*A$zQ*u^E@BidpsJif^zb`=!1s4}( zK@qrpg0&zc%LoUdFY!^oEQ8c3M#UX^L>7OmHQ@tBR3+*X1dBYdDOpp=J`UOCr&?`% z-2Ut61GHM#y6>&~>!##EH0KDRLTZgCoG+1CDoaZsuqo-gfa*jm=kI9TJ(-NEFj^_7 z_W0Q^EBOJ^+0*HI{Ib6`tq7XVwm{m^sY?Oc!Sdq3`WBz~O)#wWJ+xJ4=|(|Nr?ZF1 z7IO6n>6dK1{jzPR8?eMuvilCb;;4B{1nf8{s6kU84FqqSm9hR{KVgUV*5WPVrv8{w zPkxQu@1FZ9VZ*JciHLaZJrs(9l~0Cz5T4SQ62rqI4J8rv-tkN1w;u<0SjXmAhx@Ph zq;;V_xqu(>a3XHtlWP0mUP1Q{Z)vcXw2< z+}i}>dAc!Q^v#!X$xc|=x&TDEY{Isz@brY1HCwl2r&d?$uEmBbUjl2AhCpya_EHQ< z!VZW01fDKA5%8rd*y03rB;~0Rh2k|TVqLg+LZdeD;Nct`eed5t+zlgVkj#_XaRk3z zD<6zv^e?e{MY)bC(24ch!Sp-g35XpBFfP(WFem=fliE6SZ;(HM2mmPoCMKKRdCk2o z_LYmz4~|V&^fGKBtCfS~R?B;S9y@>0AKQPQi9ww{9D8>{M;AsFngCYCoBJ&HGBJtd z158YEWV@(ZyDB;(inDKhltNds5xzyyMzxm|v&l!fU{zp%(CQNM^80SJCd^C2aFJsR z_f78#g_}UDjcCZ76=cSPXnZ$nYr8Q_dJRRz3sJ^?<2y`}d4&Em_epB%wCegD{)2lv zlc~(qLVh}U%-6SS8T^A9sy?yJX6^iECm07(7D}Oh@*q+LpWi2SG`tl?9SGLh8|| zienz1W*gO1fSJi@`GBvF!M{iGi@)2Bhk_sZ@~W8Juz2G52AG3(c_uX>oKAr@d7c{v z)~XYW$~_M6ek!qXA)K}`Pagp5@f4&19z{3cX@8rWALSMzv=U ze3q3|#|PUn$_|6I4AO(cP5=kVr57EatS+IH{yLM!J`0ZB1IQSiz2c}v{Kdq;Ns z=+-Xher&5_4z5DMprL5QK+{cs#`%4XjD^lNVI-E0t@&wXT*ybtp*LgSIC7!5CZQNP z5M1&mEt~5rs`ar|^Wo&h^&NlWs!$KitIO)4mx4mq>p4YWt62^KV@pf+9Ah+!2-`AaAcz#-t*@60rWm(e+`c=KL@cVFC1!?0%*Gty? z#JA83MK&lIxFB~e0$d9_w+tR+(i>=W@m7gP0PDLBx3^W zJBWA+enQ0%dpN@hX(t7Js8&N=M`cdAc~qggu7Alo8^Vc1+)V^kt%rzX0N zmMD_naU2e}k(hG5FViDrxLm2kiWGmMDnU}RxX@8`%Aaz|MG60G&Pi!)rQ~O%WYtpx zFK;BV0`W$bVl*J#A1YsLXCF0~Y2>k0cjNjxDkJC5h}1VICfLc8XFBVHVJk)w@K}Kw)#Vq^f8}f`KORW6vxe|sZv2*7 zNKL?GD-?fw`ncD+mt3)ji+-l61=k%w1$HAdFH_EbzeSDvBsHjujO1SlGPZyzm{g~BS;sdpX7+h$pVhdb37PC$PzpAdCI5U0wT}9BlV9kzKl)y(Smb)* z7P5>`Afp%@rZNoM^)IVu3mt|81w^l}mBL!GmIf(A+Odn4+@(Kv$pyJpTJu>qT+XNh z?=+She-P1ZgqAEdR4d-Wa?r9 z&p?O&WJ%@!vZPtBEGc}u^Xdyr8v6k9<1b6PZkCaeZ!Uh5RfR$6{aEabCiwW$fyIB; zRS$1I-|v5))5}{rX39)=af$&m}axj{)$=(F{Qt`(0l(k_Zs%PE3o_l49tTw})~aSv_i zFyYoo+#hoDT`eM&JGfSlDtOK`k^-;@Xq3#jdK1a2>u8W5?q4_Ye0|ss9nA_hoyrkB z%Y2aqpvwPLpW{h(otoa--TXQQPL;c zyml|^Mk<$jltdEp1~x%uTC@VIY8eO zoTm#42A>L8OYkn_Lxw-30#kx+3w;~>nUP}%UIM*S*rqHf;?oGMPgH3j2<7zG(AG6Q zOcaVJ;kDroy6i7gf^DSz!gO`#`os$;g4TRzhJlQ^oD@wnatQ-6NT(H!m$=@AiO7$5 zk~WAPlg{g!ziF9Wl3;shS*Sz<%17qNS$lW{l?&~5n-@tIt3I-RD)-ON_pS5qT-(t| z@$64$_7E6h-V+fF)@9tzcaMW3AC4?3w7(&()ou`j6oNDBPb*v@*2G;TH-@QjlTi*q zC-J6=p)&j+vpp!HuT`B&9w$s+cDo*Fikx1%b$-Y#?YWs?+w*2yS#g)eX`d|ceSTyt$PMFpC7a8OAlKZ)mAGLOa5*Ns#77Is(&pXu2uj=I0&5oi5n8? zhS#2BYs?Mw)777JilB4yBU7S{$bQL)WV$kJne6mYlt>~M~!y#OJge5Rya%uI0=GOe5l zlZIM^@{LuvQrvBn4ZY3p!;;;K4^fcZqpOKhpMAd07)EQx_qn;_t~Up?UbGL7j2SjB z`+qvdZPju<^5d?zC5`*PHdwu1_WuycFu(^s72A~G2}p|JugpxozoOb!mXLtHiO~p2 zdz&7Rv?o7eeIn#~h(7gL%oi#3R6q#{dB#uuxF1&*HvjEm`(h{aRtbqk*(<}sUXSvA zs|4Tu+N=js)_N`O?mu19jTe`cJ`uy_MDU&htAWRDk#|A7tg4~TRAKE`_yZ3n#mAJj5H}1X3BLrn-FQd z=BFVh8q&$#=klL&uGtFDUB0EqDehfG@75B1{0G(nYB{ua$VZ-CRKTa9dhb_|*-7uN zMi!?LNkomR^=ODGz{Yo(PQT&Y@Vk8g2NOHeXU8Pn(rmb5Et}n;CN*tyv{2Uy5GB{G z*WDT`En`wWiVvQJat@#OrgQ@pP!pe;-{^lZBDb$V$(^lK#=g|kQeg89@jIZ91~p{I znIMB76YAm<4ftnZDuMP5=zA0Uq1_ykv>t1@T~%x$%Rxw0NKwiOSX;RoqX?wpG1yQs zU};JnGQ&jd6Gb9LZ3U$fq-wXxSSs z%f!@Qn6%D;B@)+WQDHGp5j~A0Zu{$9%hN0|w6u%cci96P9YFd%qGu5YM;P8)H>2D5 zEf?RdUXezD=*E!;T+354@@6K_(Q-3)Pr^{5*!h^*uf&DA7)$SuOS7>F*}iVV@hqCk{c zh5Jt2&+l7pr*A%l+%s-F=$)67+POuUcD&VF^Um{g72h^FAJc&}o|U6yX4R#h$imb~_VlS!lhkx8Zg zl}Y{n$fTpt&z&zasV=zsz5bI7eGgiFmrr@#b92U)>n65HU;TiOe=%w}eu zD9SO?Cmkx-{IV2+ZIZ2v7>Ahf#al@rs$Vkd|9iITk+PHWt5Q|U5#6vwqcLVFf2WtE z7z=`t4N;IJeXIGY8O+CSx&pck-s@~TsDa~#=e@R9niTCXO{)DulTHN^H2tMXvHqn= z8~>q6lZNa5j8<{^3&l^D}Hpig6YNF-|+83Sx_S!QxTetpvTpf$xJ?;fO%(b zTq0fE8Gw4353BO&b*>8KDHiViFhZVZnRvy=STw6@b#}g+Tz`);c|OvNaxel|pT|iw z*#Ev)l`DJs@$}v?;!~kERoRS8#_FkseZ_}slK>L#@ZvC1`HJ#dq)IQU%KwRn zWs+kmwWPU`^uMdBJDnt-n$Kw>OoeOJWWr>lNrhW_-LK+j!YsPF0FY90l$WWhPj!Fi zs^kavE#(K@A_T_T?u0xGceG2qmxuTD+d69F7VuXwsqxYk6sx|G=R%gvaT6p~71Q9# zDw{5W<()07Ns#T?QUlB>KLY?UPfnxtTXszudQYJm;yXGUysT9<6>6oE?u02g`;Cpw z-~}U#x8DjexYB}7gAEQ73Yz~=GrytQ<|f}4KEH>gBg>bkk_uoVrJxjJSMD90NIOW_ z+L=diDN(iBXv(_yx?>8#IjB{s^OI*$rvEnzGd1aoDg$ECz)m}XaSV){%h)%TCqv<3 z1OrQjxr01m^{)#hx^j)e8QebEH=Y%7?PruDWF=o{n(N5b{LtucT~9&#-+kyb`ATM2lrZJIqZZUp7gQkngc zjOAO~6XI1&T|LBgh|95KE{%;D0gY?fHo~!V(#Zl3#OXCtACayj?px!Y_pX^OAN#R` z5o<7)RD`>rop`Ur3^nTa0T_J3{J2y zVqrI76E3y}(C5bV{iR9&Y*oF|qzNB3X8zEm=&;tsF3$zhQZlT5J(zO48-Gd^^Ual_ zNe8lJhaK=$TCDjj*DNi?s3@Dkogz4yik2q$!#ytER3?2G1kLI2Z;j<(dL`lm6hgt*q0WCq+p}{+LuXoVYrvH^pl8qOKM3WEQ;cz&Zf_ZrdS~i z(4r`BQGI4_eiOf$u(x-e4&)-1h?-&&&)!4(R!)uRbSA~F*g?D>X zs4IiL=X2TlN{<3}6Tsk29WZz!8lHjm{JKpw4M>Rnz;IP)Mv88=X@QFDiAJF_x)|OH zyg*f_KbbRG9u47}XODLf^U4y}iniLXGHKDO%R!CG@+#IQp~cBh#sla`ud~Pwm5)gl zbkaOR+U$d5l6iXzY67xbCtFfX&&hBc<(Wm6)zt}_gS5}i%&D^0{|{aF7**K=@O?kK zrpY!Y+nVf}Y#Wnp+jf&}+qP}n)^le5*LC0bo99KVb55;lt-bbH)&8E}2X~$Vi&g0l z8Qh4B_(}>D3ri6pdU?6s56}s_Ou}uRZv#b+YTGS&F+ETGPUamvGBF%Mcaipy#eH_a z+mpKFK3rsbvM5!>&ASG_es=i!@5?AICHJWfT79T_64V5X87Mfr;Y~qm;S=v1aete< zpqJ3{9`wx?xXI@~^^->=lGhR{wW!z4=Nw`?6Ig_=KmuCbAT-1k@K!5ry)4x9OoUdS zr8u_%13 z`Hf3-=r(JLb(L;oyA&Q+uiD+{Oaqzt8{Ki*eglf_xU5VBP$vyI{9{LS0`vH%U_m-f ziBa_zTFK$lq~rULUW>5}lq1RS)P6U23s>WiTu?Zqo)NjdKgd^%6sHKtxp-iE)oTmJ z8z#O;H-FNl8F{>qj6){&@bm)k0yQp5cA*+tW(J#4zU>OQ3)l!e9W%Clb6$z}MRo&v zTF!$&Yo%&Z?Z2>Hog2EqJh)t)T42$a9jXn2bg<_6V{w+Vq3$c>UNtSZBX@0Jdew;( ze#vtF!9aq-BUb*_*Wa>b6!F$Uj<_LtJMAxA4;jMho2;{J)M*0tR!ov3cYgC3=MNY% z!ihyeN!{;Y8WAJ~-cSMgWtjL@Gb$I#3t5}6CG0o#LH2~hU32sq?}m^yjm!fJXiCuB z{u4;=shSwq!t9HZ4eq(9|NDvZNHVBDXyj~jtlRQGla zBg_LwoGzMh=fF2!>rv8yLnuxXi13Y^@0q+2hdHmO4osHz*vrUe9l2T|yy%EZv7c9) zDJ?e_sg*ZGlqV~T*Rdc=HJbbno~*%_zFgMhqgdFj!-Z1$xWRt|P|Or;;P zAzzIPM4xL;*5AJ-@&IF0J+Z`}8vWjPE&!mkr3&ysC4eji5T@nhcT~l=-(f{v8io|v z0VZiE>0h3dyhqEx2yZJEAK5=L(UmBjcfSD%%N4gF;BiH^Jq!9l`sRG(@ zc$h9NW|-yx=qKRg`bKyQ|BI0V00FH3qm+v3q!z_G-!YHf1$Ybm^Fq(-0n=1@16Vx& zR-qLBE>Z!efYpU&{n29YGXQU`8bY(Mt_(yc0Ibx+@85=1cz;91nvb5|XsBp%JwW(ss_^hn3n?h%%)4N3B;K#tgMe<;5+-}iVI-!x`(P(bq%L7ckdr92i>Q)Q%3jZR z+rNstUNjAvb4K%(YN?4y0YmO|Vkh#UJB4X(RkZi@##ak;x*q<%k|#gn7w=TmpoT9Mj(o6Ugr zQ^23pjOV6BKQ`w)Nas#PYgOS?i6U+xepagB8-LVjKsme>M=1GN@3BHC$^5nN_z;BObNLOVk z;JT!%)SRb8bkh}e1c@p*L7 zU0iR^I{1^DT^zuJg1qSLvK^-^O6w$1sHAEN$~TqDR0zyjAB$o{?L(& z^r~onHzd#6?xn77lk|v(eSayCrQlwP>U7ZNWekK)%_y7=o=-OVr9&$ydO64Y(G`0~ zQX;89iJDX{4vnTSEr$$P|EHacun`+<*FyU7QA{nYjU&vef3d=GcT3x@yo1-R9L>#3 zai8BwlPbDVKWO#=He$)jT^O04{j&V2`;O^mRH6krQ@ZphVjokZWH(|gOI)jl-9 zW_TAn{sD(QAq@1O*jDy)CowtTbY4~%-dPcXgTk2-oHA1DY~k}V?@N7C+v7Mu(6jAyMg

wP9YPsQppkJjPWw5G6tpq*jHQ%4x<;ajcM-8KVgMB z8wZCq0%m^1Y}d%eX6X>#^^nBB(q9@d8xmgWn+JltfZK8u;noox58{y0`n@`>9&( z@J2p$?Qesoll>HXB-?e71f#9@e5KJMiLMG)bhH#{=b#}^ND!jzFIfH350*n&V)#J> z^wSMYG%Y6 zhWin6wd?pw(6Q&1JvB<&#g!yl$k#9m&(7QtOk|u^cq7oSv(yyAkdSG7B|V9@sVmi# zE1-|oPsBJvK@gjrwqPTG%)f6HJH=Q3jY)v? zd6yX+=ZqdPArDq}vzck5&_y?K(Nv-259wyS@xF$vy|S`A90C03-AUK`|Ak3a{$H5% zs;jfzjqieWN(ri}y3D{iUZaK0dyx^FB-8pJi54N{vHF;|3|T_7+~8A)MvW zBQ@=i&Z5$!s*Q^qE$1mAb$zeBko|8&VutgJ=T&v!tP!>N#&CZ5@EZskx?h&mYW>( z?hgZH7Wx+#Z3KfYZ2A#;9&XD6s$(U8r&an{8kC>p!=RROhq9*!dSyxQUck}fW2YVr z|G}igxBnB7$a0MR|G=bFiCRbSk_A-=OxUebJb9|v?w>Oo*h{j*cDedI?-63?)PdDW zBHnmT{q(+*ItiHMgFs(CTnHe%G=Y*J&gep;m33&Vk19k)Q|QzSH5Ix1$Z_YsILgn1 z{Tb@Nham1<5rlxzf%Nz;cctislyADqd1&cToFv~wRj&$T#?IacLD~8&7PT->%Ydh1 z7_;G}^)z!Mi++>MlOdaiyY?SO@=RdmSRQ6Fc9$+yHsG2E^35qV2)GQCY6hcO!@_R* zZuqJvz@QeRSPhrJz-O-N6+Il-pE|=ZO%N!EBg-xgjpJTz=aa)n8uC}3F!>q0ouXcP)5?h?2vR{%J&eXC1~*S znF_$h!ylY?G2P1@O5C@_>ATSQ5T!Ob0UDMcp5T3s^a{A`Nu5XA4Trg836gdNUtON^ zMvYBdh+oBZDyUgv3eQX7$KXQnbg-wzE zHGl517((SW(;1@<<{FyyRL{{-2mip^R9FcnN*qirl zmgRd<@}m;hFshSTv5tIC0WK1h02H+>=>GT8F0l*pEdtjrXh%*5Rx6XQ7;YVbnw%{S zs9@;SDRH9D<9v~25H2*bou@-@@AV@)1!CM&H+Rqu!n7jhnrAt4mieD{7268NoD8Z3 zeHNGTMv=jgLQ+3g_hW(f{8aCFsp(aVKPuCCz^7X1L7*R_nV1Dj zmhe=}0JSa5MCxvg14b|0(O{{uK_!*jmY>cawF%u9*RHNzy1Q!dWI6C6f*w=wj-K!4 z)wXgzxB9V;5rYNm$ENl1b>49nx858}_vx7hGIIvyn0-MhZV~+DUf-F~n2$*%GW#R{ zk^RxdQ`rH%ZcD$pw$Odqvh;#n~Y<#j_%8cBAgs*PNN zL+DJ2uR+iKWj-%sIuW;XDI*rleYP;jp4Rr6=KA`t3gH?!or6%L(sV(qt~8R|mdI50 zxO5-Fb;P8k8hy0=9gf?0+`}Xc*SBFMhW;a@Z(|IdP&!Lh@d*^lR>1iB#8&AfU|s<= z5o;bAA?t={MYIJuoeip{K2d}^6=IWhcTu0xdg3^P_(bADW|BNI3&JUf4${OH^C_fa|EH(H>WLXx2u^t$+h_l)H`ga5*m* zIwq^OC;NSA#iR3L)AvqDeI0duYCP6Su*pH`C+SuukjR^HTxul4i6`xoO0z!X4bq3( za6ma$l8R433BF5Oq(ow;1Gv);lWUEf<+}g4(-F*2Uta=0%ON9BTVZ^Cp1x^j(s`e6 zM(%e(?2p$N z+v}$DeIyAcI*4^VVCn$UoK^X|Xi zsRO_}MQP%o@^*VS*jSLgq@0~Q>I#Pe&*w$pTm9>u+8TN>OXc%5ECzy6xY$XTc2={W zQMQ_qxu>rXfOqbkJ}oFcEg@X402k7CyAUV;2HjnRYz{FeoYdS6j}jdO?e{@&GSb^wOkw&-ozIu|Fe%w z>m2ESu3?uRsOGj;c2f!QQ^Ao>^R+S}Z5h#BFn^Zqm9JN5$7$I)kD1LeHKbSaiKNJ~ z1!CxS1?edndwC3cz-UqNa@>1q{enxW66TFy+{&a8h(gYOWL|IQHQCz!KwdPX za|d>=B1mcQuQTTdu>Fg~p@&O;5*6F3d7ZnOY|?TN+pgq94j6KQ@7IEPqWK5m~9eL>+QNCj?w|sI(u0b`k}C#^0Z37e3kk z_WS|ruur9or+ZnmI~r7oOy=!@p_7N?i)h`O@uWzbVJWT)Rly5 zez?=|TE?bq=#=AxXIcOsPoBwb$y94LprZ7=uTY+@|M$011q`FEn^%c}-&WC@2FX$t zmA+Q^qyX)dC{vOY#%@44*RV54!ZepM4WONt{?kr9|3^FZ!j3f-IFh-)rqSr6zvJ+< zTijA1<$48P$?cNbL2vakyWncnahF-XO*gXWADG)DWYgL+%W<6u@6FJQt4x_i$w4}Q z<`6Fysx^u*|ErxAvS@cVlcXNk$wvLi#TKdKEiQx5dB?*me;8kkZLsBAGCz_M{@&)M z5=QmNl~sgprp}0Y3W2F8<+Zg^cd$KnbX7m>$H%eO`V^|%p1aFvM=t=T*V*Vmai1dC zn4@wTXP$DgKLY)ol!JpIHl_QnQH6)8>xhAY&y;TLKFCPEa~!Z(g%hM-Ym{Lua*b<*}Y-SE5MKJ#jHl=+kfkwR_K%1oqG^Csd~!E)m-GU`Aw z-DEtYZ^ux(?~F-tWfHNJ!Cq?SYQn|>3q4mD_k-4|jo1v8Yj87UG&qpz;+0@Hr$I&Z zgA<%3K`u6;rco3WQH2lGJ*?na>tL#}RgV~5Z1uiBPr&K@@Ei<*Fm>qDjJdy|_WNfn z9#7k0kr1s4Rn{V~A682SIxwchG}m*!|m9vGh;yHY`CTrL*el zF}slMhGRz6crpECJ?P%3k1 z5~^sr=bmG?b;~XpSRE#|ev{8fe`_mw;uwOpr^VEG9a&jha5n+Gs;2R#uuXETL>cy! zd21>9iDQ*uaI09tXu;q7q820@VLE@yvBs!$UmWWD=5~Ci?_Q(caG5vXa<8qUX5F9` zV6jTxGIh0DLfstBji{9xD~kq{eHd{e!p3JBV+BW;LYdp(fMB8T$7kh=67eO_@yRhQ z90@~O@B_*^ceh$c!26daalYH*7sl0= z@oQaq=Z+;E$h0BbH~kAdO=XqH6=@h`vACKzQh z_580uDsZFHUtd7yvu-8zBEa?7uyi&f?h{4Qq|`R0M-(EJ8kR&vFO8!p6PPG6=>zF( z^6RGp3Rkne_>l-4@zY{;@-5I=4{IlqGeCI}uyPH^x5!1L> zd}8ZS zGo(w2Ek6GhjAV{rV|38kg0%hPhp0V~9o!Y>n(x$xKPv$wGq?eH^)D``AmX0IjW;>#EIY*Ehw$Q zTX#b|5YeLu(g@4I%<4@*wxN9(yIdrL;48w*oz-Vp<6kewoO3{Zy3JY;MsqLbiJnoz}Od@ zGePJDY>8K>L&e7|CtvtuiX=w`(GE;Z-04L`c{l^eLB*th;zJjXl@lTg<#B(O3@00C zGwo32$?^5wU8afJUFN_?z*8-`N79Gk9+DiJki_1Ixw_jHHWe&aywUlkc#=8QCkf zNs8OfPR4x{Lb?uRy71vXn+mGqC3spfmZ1Kzhz)e0?D!Kw$JYB!UjYlc-y^Ucq-=wZ zw{)Es8K#bJ)Lnh>=OIc(xH7?8)>`q&SgrmMSfRblXN-SBIuD)8_Ox^pRZ2}q(c2pg z<=W}Rk0i1UxY;p~#|`YXtKr#)RD3 z0VVOV%p(4KnO@Zxc*dg=!-$_o3k4L>0F*Q+=Zq`{Vn-4wwu-U)CN{wOAu;5UI5vuU zF-FCF#mFNUHsct*(8E?TDQQZkcVPo7HAR<1hMe8~XF5wQ2aG(w&|ioK*(bcx-DG;SJc(wc zLK<3`hrW83R6d41Vc1H0y`Pi~=-(u&6r@c1)yak(#Nc++H&e-W%{uRz>~pM-|DK3P zSAPnIe@T>HS|E05$h7SaNHo{m!)tLFxBmbR51_5TeUIRNy%DYTh+e52;{?7d%ElwF z--b;WYrCGXQhlo~eAl12J#cg!kXns_M8Atz=T_tW7(jw=#7_F1Y%qK=_D2@mhEx~LRs%9 zqWgL&=>$U%ebq$``a>(R2-968tIGSs;>pAw_P!}F)!e_gGc%rz)`B*`P`BmXEdg99 z-DID^EA?Rem20aGd(sMiiKA09CcS9$%Wr$u+XpV!BtJXG*lRgjPf4zoitU|aPu{cb zY0iSy)(L=-GFw#ORt}0JATC(G>cj+)VeFMwX(@?}9a`vo2WhEO&4y(%?6M<6JT{sU z+w}d}eneE(*n+)BC%^xTG<~_QnI@s@cBzKOuj`gHh@82Nv+~;u-^b(qmk-hHnGT=Z zlxeHG!{d?B-mig~?WRsbdF2E+B1ayEfGbxE2`L8qw#QuEmw`5wt*>{%y(vM+(yl0F zuf4U+hhYur_S9zzJG%Cg-U+Y-dTcnQ+KOg=uH59=WWaGf_fK+6Cx3H4hH!X% zUm+djt7?AM-51desi=mnV`nc_FH2HS!*%ArlD%D{b@X0UX`Sq3gdn6llVOZT=&*HL zQe{u-A5%;D^m+yXe+u-VZQtO~>)2LdSLqbZ-+Nak5h~9svjRVcC)uez&A4JS091cj zgQj;)$U%Q&m;M>gb<2scz=H|`HW+Z=JFgBlbUW>Rs#M*W@1O2qAd#BVhUHLV z?a9pI+6iJ5>V9%FZm8xmWAPdi+>1Av-gae!SpoHI-mQF{x+GB*rgV9M8S zeau2`IW_x=v@h5bH|SI+1~zGT%7<${P%+T{5ISyGta^J`Rpbco>bJ3 z<#%O#lgAtRE%(fgWYHAZ&tp3XN#{tNTFab4h>1cj4VNI5Z5P656qOi%1E0&@gO2Uf zqEisE98JLcvO=83gj6$&S~1Mq-$fJkEUs|SZWU<6)aU34_=DNc7+dEOa;�xlpCt z{yd=C3woW=je@?Vbslc+vl@fHYr5Sf}!42{|=h~Fk(vv|9J zq18LnuFJQ>zzff#AIAhKhtdVW#7;J>hzz=th$tZX)IO>~S0qZBm4l~(emql1$*$9d z4Na?PdEl^&tC%gf++f7Sx)c~0bMWX;FVL+Hq5R&)U+(^Udh%VYDHa85%3?}%aUGDy z{OhR=5XZJ9ECm&Kw@Eh-A|v*_$;4vs7=Ol0Yi|ncjimSk1ym@v45aYqFC3=N)Y$Tx zGr80jjT90$VYvs$R=^SiH-KEoIpVc4eAdk!kY8RbQdyvTMY_ z#;M3y!buaLTY1dIW+k9F>JTHR$gecpgq=Ot(bVb?a4l5#m#=3bQx=G^&!bPz!yYF% z*bv2W=4)TqGfpb}EK09&6$jBd1bc*SJQGQ+tfn04IWEt{N7PJC^Re%GqWbo; zFpC~oA=nK;#<5P?2+a~0V{u}U;Nigc*Wv^kg5`!~eAw_J4a$A%%3&RrZ*RrWP>)q3 zf#Ufc842qPL>}D889|L=Q)RCiP{=F%XY2w<&x&>lx}90v zbT*WqdvdTfmI*u>P{UZv-NPCQ;|V9e+wwNjGDZ)&>(>;`+Y_ueIK8a)DpC}!I!%b& zH^$h4=+=BZFTY@E)i=FJ-^cjpUa%zEc}YlzP%6ag-DB%-(v)2TsMBQu4!a#SLQ(tyC5*eGfZKt3HzDUMXGXtO4qPmmNW3G&jQf^f zhGQt06rUnk%BG!0lW(g2D4GkERS6;ML|Neu^9D>7fUfhKu19ZDq;xhV(Lj>0ESfN?eZf$uz^ToZ-3>h65&Wf^rWbx zeCD!{)e>8tY}DGVTv9GXs@(aLQ9lE)!LoQF8d_c%v0H_C`rBe7Pu8#)V2?7RgEg7b zUIT(ohlalfDF7nvemqEr&6Opg-u_Q!$ zQ=SAm^Xx8~d>i(;gpHk)DWMSJjFAIXKJ$&1=qEz<$%1LL-$=ay5^oj0d*^s58^$Cf zH`OB&rjtprQVlLbJSpME4q=FH;bc%DKRjKRtDFpy*jJoKdR1`d=FdMkM2~B+hYsoJ zRz_3WpdVW79>{yjD7Z@7VsoS4iNvx8D5M4Xx(6VsaxtiE(^eBz*cbD^EcaW)PuM1= z(#{F)01D|{er5!6zB#*0bD1GdGv3;rR}#N*uhCKO`k;5QY76mhP~wB*Y>r|^8`jRR zFy*Tbn}X*BnE1bG=VVPX+EyzrT>fO>Cy$E{he$+ACC@CGLmM$OkP%uvd3|W2TA<9_ zN~f%o{1LKe?XvN@K0>?Iw_n>pb?W#@YrnXH%p%8Gt719GSZ52nDDta3EY|k%MmjyM z8V4eA?8Y)JT!|s;3iui!!|z(8Y)R&EAf;BShc^z)$7=>-^U4Ejlx*oiHX=Qv)|(=& zY(R{!b^8`0YE065hc)dnI3jqCQU`{q=P*(&@rduF3=OkVBgXR~Oj)aVsz<61`yeK{ zK8!2h2y+MCloeSTQ7A>fidkTm9rj*0f1# zrn|^64idtV+SfsNB`Uv$xPUP`?+8 zm{s1#S7?&J7V#5q6!)W1CMQR6*Z7;aw&dC$t8;*{l2_+@nVMtOnc)}smaUT)H?6D) zspPb8n2k6V`TUY;%gaB|E{8;)1GA#=SWEi27C$2M$ zsj_9U$p*9Ev?Bka#cIY>*?OHv3~F8}C8k<5O2XZmkfZsa9;cR?X~;r^B#U6Bo$F9; z1CMS(W!@|cIwj2VpT`)mbG$r!T7#$72>r(~#5#oKd%O-7Uf)4!(k z6Yx;wznJVD*WLK^Y~-kO?iF1Oc|D>bsd!gB6Z*tFr2A`Q3Vf+60ne%9p=#7!IUuxY zZL_Vs?cy@hCc)yekLmP>zvu1m=L&t=CGAy@kk-mJ$t1Cnl7@h+74_9feER|P2V}e^BJ3bD|2LnyE*&;#Z)-HF8> zSWFLm!=lBpJ@8b8K-6=%+^FHm8}%>nH|Q+CHKm{8mz`uDf*k>o`?B-%(Yb15R(--B zLdMy-ku>io;M{yC&neJ+=*_lPLvp7!A&Tg+r&zxkAotmqjro~QK+P6d(~Ea<6oA&B^cnL(RC z8|V6t;O!ij^MD|~Ja;H!x#@*Xzu-BE%RF#oUqtA%5-MTC^qM}Ip0(*I<7?kxCoQS> zmvD2{!MJF^VqLr;(wJ$!%Pv@{tB;v};i^wmweLN%?YT_=b_q#;zveczH}EnI&LG1f z#mDCXR*k$S^NXia5FP0-fYDWCUh9`dhbTGv1COY`gBja=FCuTAM;1p-U(F z`>a>>ymZ0d%1Lt6c5g1@{5xHsIfyBKz>ILA#|;4-(lW3=KPbN;C)Oc(Mj29k;Xv~` zr?1=J_h+@qo^rSe$lg;s0IE)m{~AF+5jdM`vh%}VbP6Q&uR!X9#sfQ3H*GnGWO#VJ z;Yl*MZX`cmgRFl^gL$Zj!9hmWHNG<(9D9F@h@^eVv2su?lx#rKBBi^3y&rttpOk0J z43@M#g34D87u^N=Xnq6d0WNYrhuxzfuQ)mn30*wIG+k6Ok9>9`RXjAO+NGLM)W#E& z%k61_N_Dr4Ms)`eJ}3Trrwvd>c>tYf0{|qocmkB1Ab=a#xPZ13Pxc30@I+TYu{jC& z766GA5Lsh(0Zv9h9SJyLWB#3>6m+6f5nq54_P*iYebrRR|C-akUz1Tb?|)I!yKSmF z=3A@I@muaWKElOgfbaRJ4zNS#{yCulmb3&AbOOLpPXIv54|uN)c>4g{mj0i{)B3;0 zbK<|o6a7Dk^!K;_AktMlh<_024B+5mTHM1m1QU@ML}qzY%K`2IB27T%31CzKEiT}P z{CCK-0SGDJsRdR+JK`TMONR0HFw&phsOFh;{a2lOyJMWteItAzT|9mfEuCSy_2KwZ zT_Fa;(zs}dU3-wk+rkp@>IsuNzt34&+4|ECy|FZP@r)0XlmhSDbiXS0^BDdBvtyJ1 zNprorcAvuDNY(AlX{(Sgr>!CsF>Vh z>L}@Bai`0Zxl38syP_fYj_E9=a8ga2rJ2l9`F%^jghF2j{#L3P&DM5ZT3^uL$a7^H zTj7Vu(%U4U>x;zoUeP@BDTjm#RgKkFyD> z8Pb&&HP0->uu?56$>P?wCZ>&B4W&?}Q(!1o8~N^gU%caFapW{rp|hsJs7@aKA$DoX zJJj0Ip1xiNQ#i}Jqp1(UO=`$R(xJb8TTk!QjVrgXAq_2#8J@WH7=jn?@LA3`s9!B0 z&U(YZJ-6w)l&UY2x7gZYH~|~*G%ZQFgKfV(v-RK{2{5tZ-BY(bWYYnar+p#uP?an0 zz}sC+s!R=!#l>&UKtScG(V=1qTo-kv7RRQ9Xu5(rr*ofOrQPn~{&ISzLbnx7C5Ws@ z_zQ#FOFhQwv*Seu1iYwzJz?LZXiKO4YpMy|T06^kTQ3_Xt%(02jnWKxC@gNnMsCFN zDBqgR1bgRdq=(y(q~cjZdGk8oeP?=6Vxx;^$z>#e*h&>k|2kk?SMr}ln$U30*^^C< zomQpRNNsrSw<4#W*Q?(JUum85fm-|-GMxHx)*6#hqPr3_2Zs8A0^9* zobOJXw~R&b4AzIZH5e4i1(3AYgOo?75)jxJgq)}Ml5N$3&RWW1OH~8 zq^_6ExTtYTxT_$oTB z%q2#Y<0?wWH4Tyi(B9pZC1`K$?I!N-GZeW$E{-(0<+i154ne$pELJNC@izujcB5zs zBej_-92ZmjTz7|bpko=Z&~Df!N>DGS)6P>lQ4V32O|og{Y1;x;iPxr5R7KgFf{c7W?d50f8th-Pm(zB`a}!X6!4CYOA7jXIPrk~`jA zi)Hswr8oEQt+wJ;l9ec6GgvlIHJnZS#l?y1+?hZGJc2|O=lv#eLS5!3zUAt{$amM2 z!1+c#T`o^y>jVvadq=XU;$`Ax9!Gv70)!r(MIfV5<}KYD+gUk$OTf%A5!NlCpo~hj zg5T~GJRDO|7Fte>TZ}a1F4y_gYVGZhoOHmY)aY8ITg+jaEh!`#;jo24eZ8tD=%{U{z9M?gpUSrc1 zfsM|1JZTXWAv+*R|J+{nw$=yx75q9FnJ%PQTATok2-_1?l1@=aN1|DY`zgM+?c#>C zuE(FKZ}b`Q-Zl62eAGoV>E-VBT0|cH^>O6Q`w>n0KJ~@?k9WvGswU6qD76Rlh@p>Kr2#-md(=^J{-UINjnK3DN?{jq zKET)$b8Lu}7H;jv$P#$M?!xsda7}XV1CWMo;;&-NfIp%ed-?)BuRxsaeU=;?`Vp%r zwq_sx9GkjESDc0u5?TkFU;!AP{-sXx8Fq{MdR7e|fxjqe)?SJW%w{zyRlvSPLS8Tc zCB53P5Mm_N_-u-+Xi+p0+a{nWrS7xtMLEv%OwBzL&vp=B%IsHh_)s&&@4qzQo<9q% z^nC6lhSXJtyvpH^cSaAU0HCA=Db9J$Pm<~LfMI;Z)~C3L+dYG9-e7I`+p=(BD}Hge zSOMMXdcK{py+S#3esHTMgi{Ze)q(tsGsKRk0oo#stai3+yIB68ROqf$R9rUZvaF@tJIzCCb?YLH<(>z_sCD1X-@LAKA-_ENGmRN08v{JPc zO}BsIbdy5C$J1_t75!-6!P4&bMo7Wkey3+R|#iN zni4GAHR5IfmhC*3*8>mocVG7!Qhe;r7X!v;huQ_}*qukh!9@<^0B(w@VQ`bs_N1!NmazJXzo25#d!q9_KHQR<=ISRjhZxeW7aBrcys^hXyVoPe8 zuEZmS9yLq+%kGnNw}HWE@3tOx3hjImLifXiR-%!qczPTYSkO&9Tk0Z1K zeL^x&RUCuN@eMqWkH68yK5r76_1vj#=JJw^oFRU`{;`i~CZdh{$T;9s?gMJlRfE+kq=5CfYKWbE@ywy|gq>7PQR{f*^uFgdeN`Ch5EIme(!r%u#yphMs(@`x_)!5E7;G$LNkvM%_Xf z=_#AGS7h1jel@F?(bpAQFpd@bY)w>C@-+62>nJj$K+t@*FEbz!%{Jd4|Tj#PE|1Po#qu?Et8SiYfx#;cN@vN*%+RD$zKkaEw0-_6p+Eo!d9fN}g z4gaOcloPzlAU0{yh@DfwAIbQaB(>A7OXIOc6g%B2k9Bt+u+M-(uvkJ9X)N;z&B{}N z%C&`RUqun{W&`G&$XS6yu7xF<=o5B-5frW~93SF?x28JR{kCzGWMU>D+0L80Pauy` z1Qt?Z*#FJyKzV{1Ff9Y4PMM{MNfWv`Vj+hR6b(kBGtq*tN_5M-PRvppm3$HP0Un49 zdRxYSbEvVnDN+RAVQxcGQ|mV_9%cXaS0p9azfN`LZ06}8=~`RC{=9C;q)HzkO|4b) zbLvZ7C=(u#NC1eWX)xpOtvjKd8gXA1_0c^!c8!B>UdDHvV8?O5L@RE$ksfVE z6h&c1ZA=ax3<{UFA+qg^rCsj>Klmb3+ePLKi|A*bSoJE&$PT9)ng@LABYu)TfZSv* z)%Jr9*Dx;K%<3?6$pd~*ITu*hfV}MSmqG%it4fhzP06Y6!r2SIcKqNJPt`v_`zgY@ z+bAxuEs8PLJkb<5EbZoYdaHk`5k8Q7jB&dVw$IIVb-blWKA`tb7$=m_s9n6$f{R;s zfhwtx)QZqf6`78SHagE{(r@?^djz}iSibBiGX)M_6Glo>J5jN;R-(HEcCst_UfJvZ zB!A#Jj0|Rvg|oHcsg^}0{nR`)q{3NPL##6?I=(zEED=`yIrNf8>E`&o_vcxc5nq`Dav;GqJlVQ9QDV|wr{hSBp}6*} zp#q;dTwO>@fXj<|+pWc}vY-kklQb3pI?#;vYzwl@W`f1w%CKq{*u5eowf_ z1ShQ^0Pm+XSQU##m4j+sJ=%tAa&l*8`%z^x!)EaDdU$e+K9=q5#OI|24cU|hV{)Nt z_p>t!R5dyWElPw(%I~#>uKC0jXf9_488~)c?;l8NYobXHq+jh!g97JPntfUa!t0F} za-^FU*uyScu$=jmWs8CRZli}m7DyKX?ksKl4+3l|H1sJZ>?Q(;B*K4zCy49+2|NWb zwp zi`@EQIiT!_c2wbODHD^;{-UKsiFsvzH#PaD_h&HnWrjZXb6y=CDSvx}rR24Dx4i7Q zFcd@A*dOINsBB9`WkZLn*#t7B_YYN+W+Ob3F1|T=X&`g30&$Vb@xqziatg)+TK(QL zkGtxLq-iZMGqlYNesARzHqZCVmI$#CW>;h*&}H4rXp$%dWyNYWY;;#|s2aakz2FY7ek* z#!MvFb*yyhYA}-36bg!*>8X6^*F&fsQR*75A4{10k3yd=AZ>*vDrKUom~4gXlEfht zw(`Su*bJ{u(Bh3$%|`Fk0u=j{HnzCD?tpW>mk&lrw;1K%oA-L7uZ}8s8P@v=kNj|P zdR;4ox0CE5c9YwN&|I@U&1#L7D(T;OejlM03d0HBJK8!R?n(Q^v6Ax_^pLp7H#qv zQ{1%WbhI&@4nZTHICB@8qB-~w)`Re6#D5^^?z+rC3>2 zmh~bN9Z01Y?L#iXaOtKp6wMXJ?-yXOi<6aUtm*?d@lAvBamexNB4I-5*y%Yk^Sl|y z$>E9y3a@e-`P)t zM|n#8$`>u*Atr66P2?<&%u>k+pEc2q(8~Q!Z|{${$R!m@D|`2StTsb)M|g*~AHYT! z)S8`&xdbYfq!Nb~#Q|icxtKsyC8YrtKe*RKt0Y4t{IxHdzMGLbTnc^Lsy%>Z%AO-P z`S4V#&BKqOc^yOX$~jA3>@;|5I0~TYQfm~^O?!adt`fQpiq7?M~B@z6ptSs%qz*s`YDwPyy$AU-NIBG%fcKM6ZqG5j(51s%B`cjsv%$Mx{M^H4 zkq9(J{6xL*6PjthJD_HQH>M!mH3djaXoC=@w<+2l*1zw~#h){eECj92tmd0~2|-7L z{E!nre$9+;LjGc_!$GR{60|ske%~v{PZQJ$-+yHvQ+Zl~iKzOn#Na-$%+-#Kp7Bc} zMv7z!)BvOCGAm|_bR`DZ8ia++6qSG8hr5}K#d3QVPYI8jA7UL%v;f8psuO6o*e>{? zCQ1-xNo(k3Gy-N%ic7cCO1y998ibvibVv&3=UR{dLPoeU2101jjQ`{Ct{MBJ-VT-b zhwQwYDvc4j zC>n*V<#9<^{#hZk;Xx*2KnRRNEW|hj%p$C!a$%@bsvKeu^ng8Ur-cwMAUDodSbvMi zLp>gFHULFRNBG6J233;vaXUhno$=t=Wy`;MA4-$gf}ZDxYiCBWM&%9}InkIGnEFX= zk?Sx({4LDQx#Kw$iC1a_=BLH2p=iAokRKQb4px@es=KJeXM=+{tr(e=nps`Z&lxcx zwOlj)#N6fBicX^UUpM=lYngr0NN3p(WwL?81vQcUA>4{`f`-V-j3I@qvmQ-+XQZxC zQwU(i=@MhFe-5d-W1A-jXj&HDG{0bBEMS`dQKT`E#eXT%7oQ`nBdCNwuN8iYp=c-G zI}-dAO!Is|Kuy||6>>lqgT1htx7v4R3Nr8+r>zE*VX{o;_em* z?k>Rz4#C~s3GObzEx5aTaCdiicXxM!PQ(4~H*couy&tcpYN%?u&uIaA_wK6Gti4tl zqmVts+=J28K0I}W|8DVstreWF2c#6{fv5EVUviuJ(xndvefV2~ zmZkq;6B_I9OOapI7oBnSCAn!y(A0CVJV-xz2#vs6?2cLK30*uF#0fe(pRNPr>E3i? zd@DBB8C8QE_DC7Oeoe}lOinxMQ0yB->S2%M)vmU@@=fIBZhup0V(6i%Y#7*Q*E(F6 z#1MIB7c`>7UX^NiT8Ooy3ONA%E+ z%ol8x#{iwiC}l~f;pHPA*?4$b2jOi)+LPmXO{Z8ZJmGN%q)3UOaV1SLU#+-T7o8Eo z(cz0NKzWIl6&k9H(p2$RR}vIG8Iyq>M0DEcs`|lHwI1dmLYF0?Lb*1Z6alUm4x>1q z>%=&kpH17$CyMnvif5zZOU!;*3WbJfVOcpON>y}SZfcPloH)&ajm#*i$zd)Ptb!uS zwTR&@j8x$y94ECub8k!~6r2z|Z#2xuzd8H%-kbYQ>meTlB>-z4_UE0jNoJveK?b86 zs$zMwRazuXRHKwB)SnZZ9ZldNyx}gcvt-^cP8Kkfz-F!0BnDJjmIT^>W)xDJ6x(AC zDD&V;13I@lL(SvU4pP+F*li67>KC2d(_pZ7EaWpF(Dcc)oA1DQR+^*|q~N1mk=Z0%1Ky7&In@x`5+dV3a|UO~ zR)^Ohf)G6NTt591!eXwUKkNN~4B1ks>t2f?I%l61b7OLl0{sQTAOwn0eII6keSgStehzDhh9ciZc2@;mg%f19f zm`rWvx7V+MM33Z|Dj>>CdJ>YrtO9qU4uLv9>&_n57_(Mc{Q!Y4y^dIbPmRZ4%mLRz zk}JQxH~262d5^?|yp}_vkz&EeNCw1m0%YJO5;RsZ*Huf|(Nz5BW@hrooGy-_N{Iyf z+t|P0XI+bLJk%~ihEB&@iqWeiV><{gxe?;)n5&w~JKsHb!`4CK&%SYJ$%C{PLP$zB zckRp0>{KfihMiu~hX?f8-6QbR7B=RM==>8$XgnLlj6;fK~42UUC=v*i4-!lqBm_FYJBos;;&$r?1fh2#RYk*joRKIo^Cj&iyMA7lgwf}{G~VNp15a7 z`*l7_x_$MTczjgQpDo@aGddn4>#^|ItO713dSQ1UvwhmVXJXL%u=oQ}yx*=O@QNl1 zdRpoo4q)|5@~k4VPQ`6MR_iQ}F!#AB+{k#tM+)h9yUTqDD`*ih_R?l$WsiX9xP$kJ zOya(z7e)MIVns;^lc3Y;e)l@T%lyV=vsIJkOYah*Iz;0)Qh+e)VSiLI%R|F=t2tJF zU6E!~c*IFA4O@@%&6kcxRnSUCGogxTL7tZuX=swn=lke z4biC^Y1;J#z#v}EelUnDaJbKwGR>MdTaHQ6mg$O-#Rhx>@P|w5kXSBeMH&mlhm+ZYGkXHJOQGe2h5RJ7(yiwwZBjeK3Ng(- z_YA0EJ1Z*YmrB2%ofPhx51CaWu>y}5{K`RCev%;-sC2P{on-kw_(TBR83b*r&&-7! zfIe)s$(;9biZq%SM8*_@MXma1`%y=P#A$(z+F2LSYr1}23wW0ID)>2vuc^$2xaI}7 zXexfz0uluwp3v?sJA-JYUV()8WNM?W&{kQ&cACmK0v>8X(_&e4QSH0 zQfAq=cv>>tWLs$vDz*75Pt6GOYjb2J`ud3<$D-qiH-uHNiD#g;q%=EGcd-tI&zSobGJXtY-w>!rQ}S!NMnenfmGN(F&g2Q%Nm%AumOJ{leHKB zV+$$~n~Yd#W~z0d5ZcwLzD6#3idy1zOgM%NQtNQo`zOMnRVk#1K_^R$ic1Kn(MH3*eU8_3-zdG#`(+7%x;okHGsM;Rm|skH~d=Cr*ffBDsK^kI?qnc z#HWUwU;~EF%z_vxe5NA@M5fQo_z#;8q)fD~!v*fWxcMLF&axb#{dUgG22|riCm`on z=G>4Sc@e!Y@+fZ+-@~T`JCwDRf{O}aSgrYhc5*Og=P1hSZ-2wvfW#WhF`|Nq*qirc zHn8|!g%oZgJJ+cd64d+MPsd$voMC9!wl4KEM7C@syADcI_^;n>D>i!<+_RwN{rV%G zLYasaU)zZhUt5k5&uk$lc48$b7Amf;IIS5fzAW3KKx#R!I}`frf~^*PocZS)GHrX^ z847JoJ;()E@fr5F*N~k=U826q2I%yJD9~4jtJ|U2%k;ef-Pac#vhoegCr1Oj*!#}z z8cxV|Z))uQ)YN_t1`5kXCOR_H^7Rf|DFhv(-n;QGAJC5pZ zB@C^7jd*|Hy!`3KfP_X3XR0b?vO`3xeyR?yWoSGpBx%ur@=1q#goLfHodg5yknW{tULHenqTzPBR$XT?6K@OlTZlOV0KPU+CNr4)X%v z!N*_DJ(4b>Bo~nPsayIz$i;W0S05Z4*)PAtfCm${{&7;ku7{_jt=+h7Ow2(_R=s!u z7x~4}PFqTxf}*CC3>$0I(?E+5++Gi8j~bGEZe)qJ(W&Y*2%Iw)KU!g@X1CqWa;c zTdYGk4a)dBSs49Whzy7qy_KR_0<_s@($jnEMkSg_((CJ4ytqSwE_a4NUg5O`vmmJv zic>?97$y@mz9QKc00cChwR=K^<=!gzdHW?*#Rb}=v(p=+YK;NO)7=CCyFaq>Rx6gS zUjP_i_#X~XV20o}3*E2}o>AT08cQ6)k(v0TJIbV0-VW%FrtlYUg1!F1O|sYd=#Ew{ z4*?rh4JCHL8XP@l>+ePU##WwBv<*77J2y)d4AyLmE!0NPE@Oyhsi;21c{aPLjfbg3 zYMShj!7*yzI%IhGW=b#E!UkV##Y%-Hb&1^eepY(r@KpO?NpWb4HK@m;WLGq`GcyR% z`OY=GjAV8bMk7nlzOAAz#oC%wM3d6MXIFQ&MFN(_6;pY!%QT4+ES1`LVv~=FoMUuW zETU^XD2WU3SIIEW+=?N5^NJCa%-SVT_n~|E+I?RTONC}(Rf^k78x%?x3GqkSl5+Ot zP0n1VGS-U-d@q0Y3**kxr595He?_WVEJfD!5h8j=b}}W0jJyxsmwderR8;%HN?T>auAh6X_{1-OEoRFzf-S@0l;MGwe&G-WEB$)lFBRieYhE!K^Qxn4!ZzmQ5qag= z0Mz{!(d=RhOaNfuoc|Hep=4IYfD;L7LQZml2VI6mmf3MgswBS z2L0`Ix$x_F@=G$>!I?H{kRPnj7%Po6fB`(tG|Y<)m6wcE;E;l!^krMunrj za)sT*@ek#&;$lNXZh14CjxqT+Bm8aq_{6}@@kYfOQr5%=irN)FktS|2s{;X{saI#> z<_FfEs=Np70Xgr6l|<@Jt?(|$Z3BU4`hM$`B3IH|LPR^y!O}5Ma6CV4`IF>wy9)0R zHfES6C*9s&+cPEEU0DUuW59oTuL6BD3O!K_!{;$>xGWE%=U@G1Oh!!ThJxY8T}e*J zrO9BSLOo9Ud0(#zYarGwxqsa*3PrB*0pg-vAC*yS;Yh99#eh0Mvk##a9wfjpQ%A`oBs-*nfb~@f-G!K@3)a+>w*i`^d0cBN7$)}Fs6`dl269HeE@G>CK1`xKz6OOLUz5oA+B(f1K|NP z$6Ny{xT_JYM7bV-2L+a6bU0H<-WGyKCbaEiWIipGw6alPKf;~u6xuaV)P;abVrk7x;?pmlN7464LOn7frS6cUJl!u6um7{HN*Y9$!__h}@BSQ-z2C7Nt(B9|3P4@4eNQcYkE6M%t z(-+OJB49Z!_K7EJO&T4#1kLXD6+A!-$FI#w#Pb?9&(D2soSj;3a4JU@((IDAt1a%g z>sq;pfbeMO+y#7wjTOS^FYUG!|2}s>c$7Ujn#zlecFt0|oVhf$}QjMvaVG zzXoBAW4KT5S_MIrhl}rW-En$rBlt8u-2$`k0u-rZK#Hz)rMH{H-+fum{}LG5U*yjH zS9@>Qv*_0sNoc=^c$&v#6mUR*5Q&4pSH5maNRA;r8S|u%IHrNeLGFvZqVPG;jzKELDzLc?Dd=KA6BHveWDYcFc_Vr?Vh;2@bevZCU{nvKKI6a{<9oU-ggqsr503536cE3#4?FpR;xju6EU> zKdn)B+MF(@F#IXqRKNvc=0z;rAIytY&O~1=HsgrDTKw>P1^H}`(&r>7(HOGmodzil zQUM-^v~(Ge2z~K2v@RunBn{mF^h{y4&i{#r<^rz4F`csCRlmhKt2^X4Hvf!_dgO|H zjJMP;ZnubL9YA^Z>T`_IPN44V0CxujM;kuRPAvdA(wi&dd1N@Z(X`1@95j~jv*+bB z+`AII_f+^RU-aa~qaKf}1t4fPDJ!l9rYG6TUJI65zgaRY0c(nhLnVl09Kad@Qki6G zP&P*2XQS6_MQ8UO1?8Ao5Bli%b(xsfMum*+%K$cByhIP!1W}3CpWl+ z%D6q~IEvBmpn2?b1HXsF6lHuto>TL&hs?wJ!9|Y0hf?-`^%BW1RELC~rkVit(NX&% zOsSrUP`8;$J1HJI47)_~(C*tYl|z?V^PfBvhTG%$O~`KCcW;3DsQK-thah?^z8KOzH6u6wC>BnBSwZ(HHJupVPqaT1jr!B!N6k>ICWy|y~87N z|8;6`Ty-JBh_wr)9a0@z?XG%E>R~9-Q&RfTq5F@I`Y2<^-wamEKG%a)KSk&nXuR(e zJqJ8%U$XBOWb4|mx~%WCYx8wD+nF?@-3>~U;<(-?ROq$a+kV~Ml_XvWZe*51_@Z#1 z#FDQXw6iG^$XY0j*ot{NJ-zllzyET-+TX*1;=M1*a{a1F5EmuB>_4Al$fl{txYERw z?Vee?qyyW(d38(5Uws`&z9tct;B@?U2JRXs8FCt!zZGcJDN)&5>}MV#u6EMS8Fy_c zc*7!*xEt{2wvqQ43#r!7G+r``{JYhp=0lCWJCnc=+*7usiJsVbMaJr0h^HHdwu5Rz zY^JML+T!%2fDG0}++#eJ;>Flt@Vmn!1^r!`+VKr8*-H(!vTsGF%^C;gQc8kpKS^G~ zh81SqzHsU~m|8xzy>^7A)@p8&pbduerle9-5=p1iNxOdVPuO~4Oi#};abhv!Lulq+^ zOBx-!D|YnYUunO&^a5fc>muBHmd8M(`%8Tqgu^+%7NQqknoF-KYEU z6gF5)@uP@jiBU+Q_)z|$`evWE%gIBUr`)m{Vi3*>+SFzA_xPb-33uH zrE=E!4zRS5b`<>0)L}G~1X-zk6fvY&oQ_SPSmk1s7dE>7orQAI==__4M2w$P%~20< z5(##Feodz|0498mC=Q>;{3Ho`u@~{GQt)(Ro|+fOW`^>KjYfvzU*r5lVQU#2`pPyV zZin&~?XNXk-G!`d&dz_++<@g1?hard~6J>DkC~lI&<$ZC~6T zGZYn2(iARsF;W)W&n(%E)aR@=c~$H8)IZ%fM2W{ajE%3!KBhc>X z0VE-0!}PC*wLC3>$#@PdT)X!(wJT@bVH!5N?{Y;s@(|~C%~a+zk(n@rU8`G2Rj2%{ zO%fiL+}z2J>i=hP!lm9|Rxs9yIe|D>&1vHw@pH`Ry)n;~9pXfY{hv4&Ibvt4? z+l*o*RD>l|Y8@OKCX9}r7$Tc;lS?{qcf6C>Z_&(X_y9|XDZ$1Gxukupk5XQ<;dJ+u zRfF2Hb}qWggbwr z2vc&;7`Zpst>VlcD2Uz_@a_hiUu~0gmBGuImwU4I8L+;f75b28?J%b%D3t<@z&HQl z0P&rp`SX~+xWantO*3mb!ERVlgIAI7#uGu0P5B!zkl(U&An3s>K#=wAvNi6sb$GV3 zY45@jxB3RKP7DE9z$lH}1>KPc9CVlBX{X=a5Y;f!W>A{W?mw)NMd+jg1@cBB){qet zBcvYQrSr(Nby!?Pt#NcSY1`_NZ_k~M1%k=p2Y|B!Cn*_6Q%@brEQ+6ye;vkfxDCvP z#d;i~loe<~8t_RyrtrkYSw>l-hu7=Hekb{B8#88|QD&VGe$kcM9-)7oLcXY-TLYxi z&WJHV``X(umoQoO$1YZWO8FOAL6>A}w*I0_fQee2%Xu1ogHWm_h}*Tp~j!v z2}foZ@Xobt@Dn0z;oO%3&SND?++P!aSTxDgfWuF5=1%~Sz=p=9*zyKtWIod+S zJyg)qkzse$j>iAT2NGyx-?Oi|22SmHt^QP@Th*-K)|rCV7au{v2_()}OwFn1 z7)}*=T}dqvqV%Z9X%d(cX&Sb9QKAX^CE;0Yz?~K)#RC%T*9B1%E(y?xP~AGvbG%0D zEhRr=!JxDvn1T^#dCWOgd`eyQQ(ZN*z_^4>DNQrhej-5;+k&V^rqR)a!EXc}algK9 zO-|#%`*ESKV8QHKe$aV6Xv*#*6asGXkUGg zwC0V$xT$3kE`cM=DBIb=bx4q-{QF%8jY#V-I&i##Ac8u19@L~U%S*$uLbZs^YnbFe zCDNYnL8Ul1m<3Sr8n#V@pJX6sng0hF=tJ#aj2M+a(t^1!#Gipc>mxUs5lx;ui#=2N z0LteF{nu>IR6C<&ai3Q1)ZQV4*j+k!R2MF&!ggb}wLS3A{dVW?^f||vL828(rhy!3!V|mqVVJ+0Wa})wKaW)*SmE5+ zDgMa7{a06Ux6OJ4W697K&hkFW)QvP435qW9!5hvrr;hzO`ckCjrEW2KRL;2od znYS4P7oCq0mSNx0*VmA8O26!(qAuGr;G+&%)6p3ui zjWlxjdN!D~a7(LY&;?g6j-P{~Z$E=WkuXzYK~O0^3j{`siR%tuYCWWNDeh5=AP0h4 zHq%}=pQYR8;jfj+=0>_Yb1gP>n?gSPp1L|+&L+kHw|(e$zWO;frt=g7_V5WIrsxjTassX50bNY z2?hA~>ZSH3Pjzs?%qAwmH^Nc_;_6wsY31&v!i7mA_~il?sfd35J0qL}kgR-|N)?=hO zzCEA~PXD{kf^E!oVrSQ!ia3TIAo!IH@pplGu8P|4T`J0?m?wI}->^LgKPsf3ycd}@ zY3@Ub>-aP!qv7ZQRHNbKiEZL7|>!YOd<^M($!-MS9L5164Hv&{uNx z44GTR5CRWzgL3?fYDe?zMR?AH)TIj<;Na-OWIR@^`l0P1$GCZ$TKGa-o7NtYc!!1uJtOjq;Ef<*QONY}+(gyBh_-JoB5=-Uey7?wMx0si>)hl zNNe1N5Be(xpWmb3Y9oF-gk%8zvf|wZ9qD`uc{~0cxrK`;;>LQ(${n3D;Lh63y~Y?H)h#sqYeE;%JN; zn2D9jU4;M0TWD;?KntKkHNhE@A0ng~U`Y%q<%`A(UeMH)k}_oX# zxO7rUtLWT3IPuwhEh%Op40#oqYn;hvC1^#!OK%^K-9#p?RKA8ERtVX7yabd#TlKZf zE~;VvHn&h-hp(s8$kdE{hO3g^TDPr{sJ1mYH&mCJPavCw0dY^Qt^OP4&iw2<$Z{-9 zJWz<`R@5%qT?Bx@m?LBu7aW6(I>UU8##|5aOvQGi;z-%|Ne7UqMPG#DJJa@*2@s(N z_|UhQUE_p z>Z!OgH+KL?kd^@wq6T#-(tonUv-? z<(~;siVI~?OlDyRp2MR?4t}UXl$h4)@TlV@`plQ>p(O^#F#Gj>Lrbi&lWXz<4LaI8 zk?~OepujULJ)S*X&RU23+K4(BM_alW#=hY)4bW8l7T?ojt|jEMFFu%ly1Bw(@VHHN zoQU?#Bwt8S8%k@tGP2A_b7-d6^Tg#&2bFcYJ^#4arJs#&Sw*s__A3qx>`tpnvTW#b ze~~QxN$MxMNjv8JtW!xcaivy=)g+gyo~%x~MJ@WR^%DrQ`|%Dt90}dX^rS~1lle)6 zg(&|ufrA?VVj_6g0#1$UvHAjV{oN_co`5jaxIx!JfX~9g9@!!fk2y=~eSuOMQYe)- zS2zvcU7=E7HkKtl)QxD@+l!CVgont%?76!1VGlUzXvod!oqMpWO1LvrmvHum`qKi( zafvwL()?2en-GHj1YY13IrHL1No-|nO6J8s{umrziY5tXCt$7l1eTuA)kZ}mw6S7V zgp!(YQ*cAz*8dU4Dj2wKRax7iAv@{_5tN1THL(~Iivq0bc0i(@R{Qe0aA4t`>Wfh& z`2F9-KcKK{g}rWvuessaT;Z+~8<7e*j7_y|hwn1tjtGqNU*#g5@&jU@7d^!Z(`B?D z5S>s8PwVC-Pq6i(H!9-5?HThyELBDjC+Dsoh~JDD0~i3pKj|dr90&iY*9R1E02T%> zii@8gg2x<2wZrcREPgUb?8h59bJHyZJZA${jle$}WP|IL;TFj*z5uj$p3*6+d~8iZYHv%;l^6oRXz*3~n)4{L2Fg-^@54_|ZZd?dF*yNx zCTxza6^R*Y0lrjO+h3+44S$IBq4GfcZ9?m0eDtKU@SpYZt!6vE?n}K)0R&BrNn=5@ z6Yev7MD+*L1ZRY($7~e$x}$KX%4v|ky`xJ76KxM=hu`*X7x^loqTV+Oyj>w(OH=0=g|Xv?SM3?gXJXaVY1j9c^!KMW!* zLLG;Yb-|7;-(ZN|Kw6SrP^?VmsMwxf8$@MkNugS3WVWxD}{2@u;pBwMgb5@xtpKlAZaW8M)E z5k_%gEqK_S#U`tsEg1~3Gc!TL7N;0`Vo8+)G89r(@6XJT7%}KV{&XEvSMdQJ3;LpZQTpk)Ji5mdp{xCG@pc(W^yiHR^?0J;?;< z(ddJh8vP5{q!WV2VuDpvDHg4imRJfvIL8ajz_^XBG?fHSJsLB!B0Qf)vabj_(Rw_qVD- zRdy$XAghLUfcog;yskK*7Nk_xqBIK|YB`?RqBE>q8toAH5H&e#AXyYFTlVinsRPFRt2$XD{H5w7 zmp`R-|A~*n1~8}lPkKQ~dbnq|RakT#vy2h`zO{{r;y9q_w1X7=rUwEM!ehTBH-8vP z>~AnUQSzIm32$DTg+_Ie?00PbQeH$b;v@6XSTcG<_f-6glPYw{!;Y>58cm}{^ z9n{NP?Da{*RZRg-R}tBTWiQ|qVIEY@v7i~9g80`?#kHAM^mDW|n_w>;W$4CnKaM-J z)6kL;Nm@H@bn&N&RU3kW8ZHend-IoDYf%0oZIj}~6mr9nVHRR=pa-e1hT9zemQHl|gs&Fh?&|B#r^p#+Kii|efcB^hZ3=AjzwJ@o=j+e*=*M#j z_9+4bJil^7SO8;{>u>S#^rs&Jg&3N}?Us9RmFr&hF^j-!Ux?BH?a|*31Rw2DQ2hAc z0n|7XRZKg;-7l=s)%MpPV2bo)_m2?%TjpLD+8=II6A=2N1|Q+k;HK}+aV0g`C>(QW zho@3&S76ZzsXC(j6g@Z^pk4v%_6hCgo*Rc<{%mHw%%TbjF~0GzhQj>H zt9c}B9agmpf>qH6WceG+yyn$@qYuX{|5nAwwrDi6VGZ8$ zr1T8SIl^%IGj2xp4HHbmBv~V)UC9_3CnSZ9Hax@vW#PYB=z3s!6e&8sss0ouH=!G`GFze7S zPSePA>=J8fmhb7e!+OeE)0=VDOI8^*zd)?pO~Z`pbakOT${a(|f80t_%mk7l*G62@ zz&f`ueb6WqA)U=blqDs&$=efdwkOL}+s#xov5UUXU7*)o$Qsy*VOL=(&hRSqNGPc9 z5sw>BXpE*H_&U!jyOI9l*T~H4X=&Y|#`ry2h!GAZ>!|3b9tARHOx#Na$4GU)koBVK zJcM}JV^4AWA(TZ&O$gZm1q;@XM!fzC$&C{r{t;n)`pKsSx#XuVeNxu`J)vFT;RO zS>Jl79+0a37dKThSSqjm6vR5gr17IM-?*}+<=Bi9hRPZf*qRjhJIZCm-Bvfb|H4c zqwtPCimVYUPFDy3ph$|U@PWNuc+xe#<=E?q`?D_J2;r+716(?s`qM{cJpis9v0C9|@5*^&+McteSI%&LdfW1t%}_E6@ZB6^V;$<@Hnr{GZ@A#9Du8CVz3>8o$3 zo^&=ls}Z@g@Wwd)S`_UjQO#nMP{>7eL~|_5hI!v7*iHoJ!{wlX&UlCoaS6Rvb+w!| z%G>|1s;RU9?NL{A52LVLa!e93a*;7V>6bJyxy)~b$Jz`C&svt_9;|Z2c#buu*grB-&L4bbKOtyv@{;h=2Hf1ondfUxM4gIF4mOvr_ux4c>Voz+=CrE zGT9#{uy#BTpno{Wa5-2bpP?$I1_y1__PlgL-K&WS)b#GGkwSW0q1Xw_%c8|N(~(5R zgE^=`^T{dVkx?0wKH&_>zj2`aI%jP+VV zZaIj^3~-bWn-LJ8X9-AIE)|dtj&8L)i-t9gdbon3cRXX5D9GQO3M^C_9bo!i+grD0A+7W^POadH{|yG%q-we0B>O*Frhvg^1msA~5QRhm z;n8>19KaSpf(6iD2?JzQfT1-1XUJLsS}MRh3r0cfr;}<^is54z_2ze~geN>hKkx8% z&oHfnCvYrLI&~ANm}|TXZ2wkOEds?{zidw2aFWOcKz?36xe~#enht(f)aHuJl`CE} zns3-3)<<>G-jmqFOm6Y~B#n)FKZg|dhbwRI&)TKDkmhjLFXQ4#95;jv^P99|R5Y56 z2-4_>>uQa|Pc}c6wm-9wCY0DgCL?&@VC!FG?YYUi$SlZ#KJ=qO!}VUl0RylS?(VM$ z;)7JV=ETMp=ddHF(K)3|@e-$U9#`jcm&#s$iw0e~r}C6SXbeb~rqjyRj_iZu3j*DF z+nHw6+q;Zeg5X=KJCkd&*$QOC&eKV0e!7DE^t9Vix`B9F+}zlEpIBd^Ylzlx-Pt&x zl3gyUzV**LC5eA8zhR8jABixth!mG6tD7)n^=;-yk#o*1^eGq}m7H7eUtiZA>aaoZ z7LI-OB{N-;{;FdUZ2{zA1NhSR6qz}wfBva$TJ9k;!=;C6cOqr!)Ha?Yp=^V^@sIF| z3_aHtAiPq|z<{;mOdoc{kg}hl&dl8rtq67vJ|FsSJS%^QKEqkgx~Fm&VD6Yvq%@w_#aQ4e1YC(%0Da#K0ygLfi z_h-qc@2VP|{s%<2l@M%s{+}x=jSXW=!85VI<=yd`xrSORxzVr2%l0oR19Gh$P{~I~ zD>d`$PfCl+p=~qneHaYpE}2-a8W27SYu{dly;@vc-_G~9=lcFCbucpXp@Rh2ZkB)_ z?Qf(!kjUDIk4TBNbG_Z49$R0GuV-X>Z|Ysxr}P1ASKu80BB2)XH3D+U&J;@(&FMU+I(3hC=!XA!G*O>hp>O5U=IcM#@oN)N1pVeEXQL z<>TCX={vx#(P`*%368V*@xu9Zq)Y#iU13eFe#)-K(LCO{K4e!SI&O&gOWpngGN>1V zk4Dh5i4ud+?#&i+J=mP}$y zo^^L?1U9`AMUVa6rXA}rI-zDoWU`nI23kf0yItEe=uXaL=Bvmd2<~$xkx97?_K{rGW|)HZfpBBR5U}FC{(q4 zw`l%eIgLAw=l6Doap)1K$_S-d()DN46yhB&sb`FhzQa{|e0wo2h8A$t9o*DE3N`k( zp)^X<5Y=v?#zjCJ&+Crxi_ESI>Z&bp#a2pv`H)D%x4_0+Skc@CN%M5aeH*;TYi9wH zut1>~czd$|&RU3nqNevtQkCEro#G%l?|l}%n!OXjG&h=P;xTcQUloLm-E<_6y?pQN z1gzGAFz+ANVmCZI-ZH&hu3yXEadA*Ekv3lmY>MSK$eEC9oEcyrXG{!@G z_fL|sK%z1uEincK%5#nqwdcIT70bb|yX8|Z>kf8xi3h6I^X6@7C7{l`hy3-LO=QYr z5|6LNphn@Z5=oVH`X>Q)75<##$sU&vRLo^q3MZ;42G=bKeMv zMyFbFL!m%E*q3gx7v49rspGP1nYli*pW0dxL;XT*UimQaDI*A$T%_K)h1x|XjS_tB z$H3+j&o^EA@*naAlG17Iz6;|P`4TJ`+32jwRI$mGsKJ8`UO2_MJ=61JaXXheA`hDkF2j|@p;{7i# zxla0v;rnCX(9qSDvrdPHhrR0?H}Bu0mQu-!tBTBs4ugXYNGChH>$$`(h0@JQtXaELCKZ@x=xb#Q+P2{qY@+yB;pm(& zE1O&0>&`GO9G&LNocg~P;tCzQ-ZUK;Hv&PI%sMauP16##Hig3_1dr*GxnR{M9S>|S z0z)TlLSLgjhjzmDyH>@~mawK0pRoa0JItUAZ#jX#TYA(wd=(J2GXc?7SwL?5c)Fq0 zI$J%j%CuizK=5KAj(<(9^kq3LA;s_Qeb1$gEFUdNBSi`w6snJw#b#&uGBY+)t9ZE4 zE=!VwrM)DzUfF)Dq-W$2WU7m1ZaG%*Qg`+0Ph^03f^77o8SR^Y-Ru)=B{71+VYgE9 z+AL-izD+-WXW@>`*d`Bu?fG}}&9h61yz{^Ey=3)Db1nik+?9gj7nY+%EoY71?VUdC zn;=ME$+TLb5vG*75l_59!{9jcdx%RL6bA2XJ@LI$k(p2G;qGb&nEdx^+9^*HOi)cy zvCLwzOhW(qk72u~umpxAvzd7J4V;JJQsrN`su%bd6;wR!gH1(WX@z+V*WW~)S}Jz-dmeon z*4V$N04>$TQ(VA!4=ck=t`x2}_Sw&55)&{iK+-fa2FFKYb1M>%G!_2A{1*bsW^bEN z3xs^+N0Tau9~z~$Y#af!f+4NAFSKI%7d&V1-|+Ee5JeVzEj5ehu{GZg)i;QZ1F`XV zBZ{sj`}@3!DRns!8mt|yt0a552_yui@7JB-4C0*E^H`B|7#bJ8vI4wR`n>kQU1;{@ z#k<|C{moXNUaD18Q`-qvw+#w0KV!KCQTKEpMe+8*f~MbvZed168$B%GGleAZ$Qc*I zw-M-W_WhE+Rj|bZiuYKh_B}9C!I)d;;&dzBoaaeyx-|9&%zq)N!N?$Bm4bKFXv-hf zm)**{n^EIL;huB`n`=M3RLN$L9Nktl zA6_ckf4x*(0x!ZFp4BY>c&VywHJ*cZ|AK_TzmD^>OD_HzC%S{AXX!>?v}J(qsCj?x z;R(WyaQL%xhT}%e73#WsnH%+$J*oh`b$FBn!r*&rG>@44vu$Juv`{M7Jj25{44rSZ zb9Wqq0jeGJf#n_aX`eGl=x@gYKCrbyx3mVqKaY;!`T@I@1j>(ceg1fx0^}SQOU*$E z5SIg;#{7BjdHO8w+XN7k)@9M0Z97=fU_o`}u*54$oj7gllwecrU|8l**&SHkZhPLM z&CpB!R(t&F>F=`Bd2}~dx#yMvxBzn|*Ck1WiO+&a91Z|Gi36%aziVVDTP;o!(vSNg z4cnK?m<>L~=}H(PJ>fNZt(4|IMikw*g;$i}*t&GOs3Xh%jerFM%{rrc%+f(~rsTT_ ziv34+H0d$%xVZ;xN?)dRrt9no>+jC;`ejSSndTB0&QP4xWi|GAsWvIqevY?)(T=L_ z^mvHKv7zu=<`mEOpy5RjiK^tWlTLS72we=tn8IDmlT&~!`&(fM=?UtGm8z&BRHhXs zspGFBJ?~v|s~Zze5W`dh>p~F`Spl!5O=!=;A%Bx;pKPjPb#D*rr&kp|N5Qp@+TGvKom1t-7tSi9-@iR5*Ktd zubKpc7t|gV>yH%^d@raZLD)e=7Rss2#~T~BJWR@WrioBH{eD@_Y-OanBfF9IEgjF2 z#5y^LsVsx7U}k{;oFUgiTec{K5u}ig{oU%wul4RjN|h!IGu4m%A*BLW8M(H?2%c@p zks{R@oS~r1*YAtl|7B+SJs84!S3hsS1Tb|WHyVuibE2;5q^ z2!rh}hrKTk*nUK~Q}B>2T?cd>uqA64z}B+9SE0P5$vEC=Rqv7ZJ+#P+VOa5J_1Be0JV=QepucfMDRwtJ7xs z5gk>k_=t`wQV47JfD1|x5jGuHlF!k7hhK=r?-T3~$&~RbZGKwP5>kJ9k&(;so*mdK zOXv3Y`6{wsrbqNz98X6gI-ct;Umwt?rZQEWacT*WQn`%HWe&IOH=M23;7aOwU%An( zK=hWu+aS*gq;wTUPjTKJvv62QhCM-0>AZ8dXdH!_)PfNJ*-TyZl+&C2Bc#mMwiN(CgP^eLsH`mdA<le@+qYvv7=v$#i>~W z!5JZE`jk?UqkTxJ@;{|injs`kXf;1a>x*hYCr~fe9=3mnXr<%mkZebgVUuBvs>jfI zu0^%wulUk77E~6M8gUlVP`PPIel8GzF>RkHwJ@pgLAU`->8Rn zg6?7V(J!dw?QxA3-wbauz0->g*T`?c{#{isS;>U20S!|1$p%|n;0o3G4aanu8v(m( z^<63R!%C&iHd;SjKI&7{(Qp#i^v8dYCp%I8y$f|+<)b-z@X;J?<@|4R^zgGes&Y*- zpGlEnBeh+AB1y@j0fJY8A`F$o$&c!Fb6QoQ?E}<~(syOS%1MYU_5Ic4{u*5WB>2aT zxpcm=O{tuY;kXM#A9jiJD7h1r(^~TyPU^rM6C zo4Noi6>*h*AL*D28U=Jk>;K^FFQejU+eTeCSb*T}P9Rut3r=u%C%C(NaCdiig1fuB zyNBTJ&MNXe@4LUb*WPo?wSLf4Q*?Ewi+f~H}1f`$d0RON#b@k#2<>V>Wa2@-HWItl7+?3dcVxFR)nE> zCmTfe-@u(+=ADqvrmZiI_4W(T8iaT?Sl8gdUv zOD{iB8hqy=RKHH8aR0tQTjoA+YeDWe_G5xYD2>|;&vuCk7)o`=IWYzdrAqsEC{=V2 zFqEqMe-5PzVtLY!ByQGcGVyILx#-K>42;icveBnmTZmt7%FPMV)I{Hoc!@T;P{qZN z2x#W}h8D}id~42rzuT9Ou6iB~45h00JCus+eJGV7jCi6(ex%pP@?-997_`tbkCfLHc0DT1b>Fg{RT(XgN zLuKm~x@~3@!n1a?6dCxk)j!yr#mT5O^7%~cjmZerx3ZA(t0K==0dA7LU6Gkb2AMgf z7J9zL5){84Mq*Qi!u@6+-rPtn=KvHrtsAG()7gH_X2sc+Kr5Wd@ta8MwI&V|JfG3Wr>JDUfj5-j!RBIu{1@w*XC~$X@mAIK_^iuJ~ z0=!>YJ1MEn@EC7B97gKPXA$C@rwIBmc_;C~irl;rFIF#Xu-XtpQ(kD!{OhDQuX|IDAjsYz}gmswTf6oGOAa-FXS(Fj54}oWa&1@ z6YoBGr?j3~<=16T*#jDyj^cE-vX0_jwF&9hEx@G8#Hs$#I*OuYLZhl}gUYNaTC_sx#0*5rXp?v22*62(F zZ&lRXBwz437f#(_=~L$_P57(#8jZhk6Y6}>ImWX=sxa?zIlQf|P^k>9i*Ve7R}#|k zaPdm3*XF~G&^tMbL8a7q@5u$t9q1-*1U=N0IB0CF?aFUto5MqKl|j^OgYVg@WAYk< z!IQcE){>T@Q?R&F%q~^f%o^J_#VwVXJo3?LMnS6unZ0J>=uOx^#p_)hZTl;ZcK=Ut zH2h|A&q3>3um69%8*$l2Dy*PpE{7s zA2OkjeC^PB8L+AsGL`Ixf?}~0Q&Xvn?=q!!Qe@R?y0I*qnEh6a&N8sAbu(n1rHnC( z4$%=nuy9JWuc$+B53a=g=Kc7*jIbf1kJ&lXFz}<1U^xnB5+dw#r_VuSlYO9kL%I1? z)M=ZE;g1!+R{n4aShRp`)%4H2beQ;5Po12p&MnfCqD2a<5Mz_8jy)@7LtTru3MHS$ zy2>DBEm6_+c=HF7wy-5ALGEN*?AI3yHiu@v$ElrvHVX=K$Zfi8!$4!mowvR&Bk>LD z8VwEgJ2-@2i46Gci^d0S=oWeOWj#UGv`FB&jl0}8cSx5f^4hMO%&zi?=yhi$} z1x&tB5S6A$Kg;|k1%i`vIHUd6`DBo^iI)BxsS=U=K4>0xS-J72PuoWnkzI@x53_a$ z4Kf8rPOTiEoI*&dUiu8f$3GNM+GBv|?PEkF@QdtzGSG(p4R?$b1k)Fr5+f)IlR^Xrj*5KLRUiFc0l9u-rSQSso zOeRJ#uV}_>^y>Ro<0B>15Y=bB{el~)pHmT&#{Hhz!6+K8S~nq|ESnw1!yLHQ*Og^j zl&pm58KDiLc+o4*)~C%S4a*m>8V$L$>1mHsg#4qbm72~oq8URyB893r(5K`W_(M6$ zKdF^+!R0t0_Y0XPV6*)N*zRf*xact5Es)Fu@pFdU*`vapWQOqjPOViP@#t z!E-T6Ytc`G%SX8l3o=Y4yMU!SI#fR603%7rz9fEcZ)YfyCuRw4w`RNqbtKc1JKT7@ zkVVn)5NE!!Sx4~Uz{jBG=`td@mkwNrp{Nho#7?S{Qr@*D!^r+T}!36j0%S@ zt$VW$SwEe>qI$>nn0n184}b()qNL!s$I zTH1E1>W}jEtB^7_H@fFNHhVFpiPkqCs2Kv@`boQKDG^4VW60#&oOsE8ZpLYXl^DaOhkTvRA(wGQVHL{ZYA%q?_gw=hQN-me99 ze)v%1ZbUH*W2?rViNwCcOT8KEsk+ZFo^7oDw;1hV7ro~41MzC-Ysv#}7z&9SZ?8jW zxfhQ^Lw7aH^kKPOP8Q#LscA6<&Rl(9GOy+{l0f$ogayW{Yeqt?JRLNj8jqkXe;80b zRS`JVnW~z#Zrm5!)3zP-ynIw($6->eR4AQX-_L(FIBp|e*)$vzim2zmSZfX_2xs^5 zIEvGuL|<{epd&d2QBxvI8^vWw-NRnaN{8z?wm3ij%J7P?&>%j+FhE&pA%qf2+H65I zm)PyYx38M)^1|#3!|dfr+nBTT0$S}1ud|z!&TxI^4jB2Pc2=G(LCTS7@&?xesQ9P1{)1Ln4&D8w2q%&Ah zx1h<2C++EJRgeV+n40YkNvRQc*~!I4eX|cZ%$qMPQCVu87AIpbyz0((-Pa+^G3na# z2;Sntv=C&5%8k*ERROyBwHQQ8<&=k44ob9)%PedM4IuhpUTTyMc6MKxr%xHP9b*N= zWi#OQ_>WDuuFa=QjK@Dnqz5=L5{=F^y6GKEvTNL_kvQ{HauCwB+gR_9z)dLBIF#^E zenz3^I7*WTv$0sBd8u?G@%$l}OgD&Nb`rgaVcKxwPb9lbs1JkQ;pg>W#u^MGaMK@& z1lGz}Xnw@y1_INyZ&iYdS>;>fZ49Q~PKbe+3DV2pPF}oiyRNK`Ozof0IO;1{#<^A> zMYC8i0HCK5tEP0u=$@rx^%o#{Oj??QxrLiw|DC8q7 zs%19GWPZiQ^U!;I65IyGN%Ptx3bbF8wV8ZLn!SeAE5U=4Yuk(!<^tu+Mn4IHQNw7cv_S(Kxhe+$DZ7>s%XEPLmz-lVg5WqS2LDXG2o(Cj*HQDOLL7 zehM$y>U{wT7X?L0yDJ%89;NLm>cZ=WWz-AoQn3${q2MBFU^`j7bWUO#xB| zk+LnF&sl*VlonR{f2kK8euH*TMp>j)=`;J>-c3mjNz%g7&TB1c2C4&AX4M2)a^nS^ zggxJ)t+B8oW7vi6<*8}KEVpqC?W<|Em9==oQuM)Mjvu7v$ihj9MCSVD9CP^w-LHtN zxW^=R0W(`<9XvR{Gwa^ghi;h>Z*30IaCcXColvTq)W)roS)R2@{Jj z%j}3@wD#KSJA4UXDef|??#P<6?)j>eUw8vRqjLZ>n*NLfK%+^EpqCe!l9^l{*Z?%z z`lsS2mc#}3wS##!F8fVsR2xs9;{IP~v{Fqd@?U7wR4N?(9U4uRAvFlOMvWk0recy# zzT#H;0O=HeL`6niV|+k-db4=U^aQmHNyklO;4xDeA`*RwbtR!1Tv0f2Y>Rmw)2LtI zh19>Dbnjjoxw5x7{m8$CY%ReqSFfAg<=g+*l3ult%>rB-s!nsI^L~Zz`b=pct_sWSc z1_)&A*|EX;^t;N7He5pCIb1gN_5(<-nLD*X_`?<~J(t zw7YSbcc};HLq*3!C>U}H?JRkJA6hM}6lbeUoPEsSnAI|?d`~&&#sO|NjZm@2rd#jx z@6MaWj5`i2{f`=s~th9_H)2xMD1xR>#pbX~^{@xu2M(car63bVaOEgJ|CcBg+v)YWIf(&*d1aTs`qIiEf zo@S$?T$aY7TOjAm4Lyc(D5CNHjrx_h>6_141a>!slN_s4{TsZiKF_bO#WuqW=547p z?jNk$%fkOZHD~W3w~QEpB(X8xmMHS6qmjUr+s6#FEtv<+HM4-<`+a4HcOg#<4HCMt zAij`0s-$xNZ8@cp1`v4$)ZG5IoDEjbRF^c_F{?iPsnL4Q=Q}K`H=81XyIiu}>qd`x zEHkmG3MV;A=bdQ$#)3iQ#x>jp$=l@Pmh>c*uUTOO#BMp(j!LJC@ZB%35!>;BaB!22 zvjq_uT`{vc#lNb%9b2ky9qnL}L$@Oa=tn9u3X&hwWkw{?AtS3h>bHC|KFdk4JcZ)U zlcIL0RhO=FZOO&f{R$ zJrlXF$!kU|6uNxi3^7hbYl1X4p@~r->LkA%Ral5c_)pY%L@V2u zONlZ)hv@z0kp@%lNwIe3dZZQKPznWR)llZ7>a?u~# z`&|L;w`R3~LS{TtnC%_Q7S16qOAL>!JWmK&urn0K4Op^A5DUvqA;$R=-@rh`xt%x8UN%8~Imd6p zWBvo%)g1_Vf7O!S2twfH-RMk2o3uh@++9 zTFqpNW}o=20C7~E{ucu6eTYFkx(&6oR4HhCF~rSnTV%p4?Q5VZD~_7D)f=4J*cl*> zBD}atp8ZE0jpv>jm;!@E_KnST1hUR3QCR{yqQhKm-1?T~v?uc{q17Y98GhQ;CidRl ziy%7wOh5G#yFMgS+uW0FInE%M6Gk5tSAoPOy~Yu49JcJpP5h@kZ-4GMb@Seni{-t@ zm73TVGalsyc(dkT#`i&|Ws&>KkBgRN-V#qmld?Uzn@(G817g&!vz2$!MA`efz0IC! zYB!G^d_ht+L=%_RQ#J;MrajsEzZg_@25O}(x^DpnK zvJGzL8hHa=CC~|4TvG!Zt~d#VH82|e^AO3 zkY?da3uhL{O{hc~@p5G>KZXmsq^yw3#T8nV0qtddc)Sbn>4rsV7mMo3*#ZbVO-No> zgm5l4Sloac&}AUzSBs+j{aOd5;Q zDMp~mG`m)?5SYe^zFuAq%7X+puYk`B>q4Y$LZQ5B6a`{T|kZpz8xqxfqnBr6Wzdh zHOn;u0nX+*@L>%6gLDRcftzb;XB1p67+|X~Gm_c0e&z2=oLT1%zfP1Ux-kGk&kBXy z!ac~{XFb7C#3GA2Rv}Ae1Q&NR%!kh-C{^=;hI*dqmt^)@9hJYe_NW=&L(h01^hEmu z-6jqgq@^md=SfWr)MXwmPBXLu4uMqoH9ozkZ9&w`3*xrX(-2@=?n=~oTxJ@OZ%-R< zGvyRj5@=?F_Qt;#5#1nZ(9^r!8Y8e9Sp!702_uZ4w9gc`kmjvr1a_e{G1>L(v{cZ8 zF%8m-HFP5nf#0Z4%YMFcOFQ=hoo5iK4uq(Q5Ju_wKLlw*qM=$%!@c^L&RRLO^)B_n zFlxwDTTM_Ob!gV8v|+31I&TB>Yr4tfs$<6})mYt`Nea0+zhztTSowmg{m`ec+vD!SkmVx{6}m zOZ57Q6MNG%#u*6rWoF)}`!Io&=~8*~1(kbhubP%jP2pP=)eN zO-x(fN^>*`2&xU$`fdL~-o-NGt~ylab&I1XSiK^yA(_-wm-@$qd72Q_-x6*ST32i# zcNj#Bc)D)$%jzAU)ZMC_Tq_nq4dKohNvuW)C#yLMHukMBXeTz-G+LY4Iu4ZsJ{Iw3 z(ZRdd5w1O}UuA%Qk}_$c7)l)2$k2Q_SzB7ULP6v__K>P!EBYZ%VX>|9qY@1xUt(VB zk;Sea=`{m)lwW8%q(Z+hM0gA)uwLo#^;Y9IL@cpt6$m5t^zewETg8k!N&M;eLe zoLgQGsR^8clwG|tr}x-2Wfz14G#IYk>y6D!5WB{Q-9M}oL#nu`a@G0zR}AzENm$wJ zZwY8Iq2~OjF6h!CL%%DyceaCZt$aAXZZd1k%rigiv-Bf6*@Ku|rXqzEoP~}J+x0X&2XTgm5Stk;kGlni$V_vf{l z15fw2(BB>7n>=rOJHKKxj|n>1*x9*XPmdZZtiDck?2+?$B*q_bz23}RI2}JfbxKJ| zwLdaAhcHhKGBTs}p(bv#%L-y)$LI#v9sM;&mEX-#0&8{HcXO0`Oi!%3Nc%9VALN+6 zm-0tlIB&T0e95L)+9n!a16&mP6@MNh=tpxV=?X%Pg=^=Dk8zyXCuq5CIW0HKROQhp z9}h@!t8|5Ra5yyvr(UTcQV#qkvN&7d`UjsRhN5Z9lWNgNT+t64KBiRy*_~X% zn|m>pq8amAjMaWh#9a`B!0(ptczxh|S;qcw;2DSQ2gAB6d~7BcCmT%UtmwoL7gkrN zj#|-lK3T|YH(IeTJe;=&F#B_a9nC5`a9>1e<)C0wZmHZGH<%8Ii#ku{dDCfKTQKA7 z@N(|jHH?`4OvSsz*MNhnH4U;t61piS}!;;RN)1 zHfwKE15102sy-}OKsR-CB5}ZCk(wt+|GrLxkF|$0t0v|S*_h!i z2xl=m{sASn-PKUUDzON2SeqpHL446fKJBw-aosMv05y?Q9)0@_q$tikTG9?l`UZ1M zt|QRwQ-QQ7HZkW$`~e=-^=?=)xE@9vdhs!%3Ux4A3NpPeS%OA=AJiH>FmZNw+~g8L z32O8!MhWsjjhgjijUhia+77$RGM}&Gi#3NBtrsqaopeQ|#JNB-DQrlagG7-7`Il%+ zsG%qalhmLEamG1#Tfa4x(*+Id-vQtOG9ia+ABKwV!`ol<&2lDK{abqS>>F+opkN^s zN*~jEK$0sT(gY6?{!5M;z1;-Uk!Rk5iwg6N>Vw;Cl7rUmVhAf zh{?PCjgN*x>FH9cbDEB}3q^9~SIjd&wu3yra)`1RdIqkPb99aJo^}#{2#~or`UDL( zq!T@Po*M$qH5(yiyI$jfKm%tQ*QM=iA1&HvdfUrKSiGS|;^aEO_&>$bwtvM@M1D`k z5AWirJxVq7yEw}6mYpZ6x%*pqZRHckBLAJsrYP;PR3&R>cPrj{QuV+)4R+nLxhAA7# zibGt{(K1527`<(+k|TH&KV0q$DaeLGqn$`Ix1O{1dOL%fMpAhe@kvXz8rS%uq)^c6 z(+EB9WGyQE;#jN)PobxMTuMEd(mf-Vitk=uF$r^IL^ERasOJY~;`-7k6H28gFZv{! z2EKA%3>UrbF0?(*8eJYr#^QAgY%KdVg(M|?Z|I_d&&!9TEJh2mk{d!sARHLh7!dbd zI2IA@La&6eu{vpjykiix=j1e^RMQQZzO}uk?f!LWgUr|$g32qDu$?XSFE~1*p-;xe z<>*2`SJt;J&IId1PmU!`2KSPBn8y~zBY+y*JrBdo(U7f|uwKPxSasCdGToT0lP%$4 zCnWK)HoDayWW3gOJ!nX#C%?0H$AvGSau_PDdGomi$TjB+W6^)xVN--H81K)okDzPN zjI;pPf6hW!;@yd)bMxXt(BxCDit`WRxCdu^K8FpH;Z9l3$vdt$^{|w+^lrDIKA)wu zo-co3vNC+^czfZgPFG9`=108$h;m9AEjD7a(X21RK(fcAro_V>pxUd!-|9{yswT9* zt)-?@S8C28mr$G0b>^o#VaC0wHl9UpL@Jc%167TO!Mup?5mX2J{dba#uXg;oTV9`r zaUV|UrR9L?V=E9taA;hQsdQ*@rM|e{{^~z{s-W81od3R6iYM+kxbXAC5%+BOdQl*s z3=aW}r7Nq~!Q_6hm&hUA;yyN_eFx)L%n$U7E$E*=vSfqVK$8JeIULHF_gYA#i&Z@EM5hH}B$SJGd1hgpNJ74w$G_Wym^8S$4J z{a?$@Ni;X0?1Zj_t3&y}m7TSE|1CS;xzYcFvh$rAMSJH)%arf_DLb>`|Mz95QPTfX zcK*YS{?D?r?)?8x*(u=>`%l@aE|H+)PcdPHB=^4!JHLI4ggVe0EgUO-InZ7w$1x3@pu2#nCq@!=iEfz4^(i~xs^}ZfADh0 z%K0YoGwsVjQfUl#KIs{h)AwZTHZckEM;;Z03oQWGhvy5N)w#aSOgLzNf`rf%((MZo zPr3LagZ#rK(s>HfUCQ<)`uaGt;O?hI8&!DY9?dTP;br#raB~3)nWsCoaV|0ok#8z4 zJp$2cGl)$^?RB}T(EL`}nvR~Z3o*{@V7{lGzi3Z~6tsl%YbjI)~Y`V}XuQBs~=0h3@6ILA*RV#;W9=-iaZuJvCg;TUvZMTwV> zW4S{1W2W-pXv_LBJbeh1TzC7U>+H3ZP4^-~h#ehNgE(%5Gy05dH0ZDnKOQJZyv{Dx z{Mk&!NL17B5+1KVZOcKcC~CaM4MXHhqM_EblO_w>ol(-L@Y0C*5SEroB6&2ztEkQ}1g`T- ziWFlasK~!JhBkr4TSbfbTh0W(jMgSoW#OdvpoT-E!(?jby}9W={uK2t{g)qE5(h1g z3w0Ld*Xd{D!%T-Xh!iUQ_{RLh5*L0l`6?+?C<*)|mEw2RkoMpb)&`8ufU zONmjkOE#TgU4K(0l)8l-v3#$Uf*J5uilG7tY~G>>v#F6P`HHWBlAR9Y+`(bjs0BC$&aH)DaQ$6>R;3DeNSrPZ5ZVwS(zmXFg4ddo}ohwK{Gb zA zYa!94*KFYBwI0mg1oInep9>tfYhMeH&A50>1dUTI&kE)@*ncekiHV-R1GLfdGzgc> zmHw68uQY{fG(}VHS}(0*|7xSd=zq1*QeU!@^3b?qA7LT^=gA-Y$mq;j`gcZDt9zPiVHpEB2i*Oby;=8%%V9* zO3J~RzGPgv^Ue?1vvLd`+3rA!WH4h%^s?Z2INm5;ukT|s(&}eH;~nS|gIJ=yU{vO} zs9&(7zkFh%DdOKTi#ep~M)(|g8hZn78Kd%6s_8K-NEU7Z%fFKyf=!%S>BGmQC{}ZG zTWYie@mf#9yQZKv56PSf7SZcLhCk@LzV}G`rIcb5U4EqHr&vM`b*G+!Azp@A8i|b0 zVWF*(fLh*LIu%6SxXjy!538odwL&1Zz_d5(A-5Z?R9n+cg$dm-jfO=5fy-J6)G@ML$vbcHIZ3N5cdefAb`pusU!v`SUBw%=|@?{QCQ z(j7$heh}wodmlij4+X#Gjk*Qw_qzc6O#XxTk7sw+w=-MQfMi{(!d*o;MNb#yQRnF^GMQK#{BHNwi|1Yvo$n@+2U#k_h4h` zvHp~wx|%J8G{w*Q3}E{a?e4$yZlEhmPJh9n*Ci5SxO6fW8>3f2zgwdiXw-(u+e{`3 z_2naDqhhM8@7AdHyERH^(Eg>Wr^!PqTcsag;ptq*t zv>|N%xHaQ)%sWAd=whep_E!VM=42O;5<1N_ohPg|{Yv5_R9)9Vku@Ow9DYm)v@owh zpONR1ThXkRei2QM!^@`!xY01`kvKy{O3>ZUGZpbfDPQR2Whh(Rxv2b5 z#SWUqxL1Mpv-}7#N^?;@-(H0q#F%5O;`HSD;NGWz+J(e~K^%+G2cG5NqYef_Cy3M+#odL7_*vqWKgv zZ44bl4@##7Nip;7oB7W&x_*a;F-6gI@<5>ypQHU|_cbpc?RCh5m)nU2)_DdPN75(` z=kk|VG|A=UJWmMh@mci8RJ+;|1fOG$Dv(1~!67p60!AXwao*t*PTKpf_EgJs#^1X^ z4R>e?Ie<1gDq%>Ve+g)#4NU5>$wv+!xor`)#zH*{Wr^}i=ZM;jc1F>Oc#n4QLX9b~ zvitCqA!z0SZS)&-ZW0dStRA3^iVZT#k2fA}gV%sdj3N{F85=Ny43c`tPBus{!#}>q zpYWakGyWutZ+PQgjyr`Vqg_T_n4eIh9j%!^hOH;B!TGeS^?USeHN3r9m8FfOt;ei$ zZMnm`JcI8fUJGG*aceh)l-jb4r7fF&!PByW8mB4O@{xuYHzm|u+PA8Mt~5%roWfx=E_%-&tPdZ1f(pzvYC zO$|Gfh@<~05m`QWP{n`QF&R~&W{-EL&ljxS3F(?nn@*G75@gtHRK_)u@S#r zy`shkxY5_34?_6-;&q>Hk)0fVdi_ zvsqyYxl^)e*>BW$->jSdMO^5Ly{B((YCq7 zW-`kmuwc{QxYJ1TJG`&vA{$9694HGjb*Sj^$K`Gvx^a6gq;6rNgjLD8qns)5btAD7 ze1v9Bg*YtUB&GOO#8U51>oDIy6?j%4sZz)HIFB0ntlDg;0>1If;J_p(KzulJyvEk( zQ|LXW)=p4o^f(Y(-~YOr`p8H#eCt(L;(`YD*qIYBJ2L{(mZg0m4yD!RIMd7NA(g6(-037XUbuDE~%`tuN|M-6)9%d6N;~~m+ z9elnqfsrbK?8gxQOzt<~YSySblQv*ndtH#oP>_Y6e6{IveEgja&k1{-HB}az?3AT_ zC@y@2l}JLcW}NA{WC>Xwb>F6eOruK@Mj;dQaJO@sbQhwuL~Ra!PM5Co^$rR7Y49-5 zRm9Hk0}b9b{f~C~0IL4$m~UhYR&FuAB?TPZ3FK&C)DOBQ3z^Fb``8xyni^(0kv486{OE&n(|{&=x63tvSEbbucki|cZ(e`3mP^2r+$yw(BYsO*pY zknDfN(fb_qFY|ynnidR~0?KIogAPSWn9=NJ!@>+)j}W1Y&C--3-DmN3S^T?Lh*kYL z|NhNhykz9G+!*vlq0eQ-;bPeJvZ7{|xiKu1 zCb==Y%SCw(b;63%j@ahTTjwVM_1$=q$)0?nRt7Bsp?PJ89A2g?LJ}Pz4{%8$^fH#b zg%CT6JgMAnk4)}HE_~`8kAFIEj=s;9OIl9iC%HQAbwXMj^tjvgG+IIVHn7LyFZ7te zWAAmAG!3cYMrDoZ^GC-~AQweFu7Ap4*u$%kTVo9wQ(rxfFuj6wj)jUEk_fU0?XC z%X>k_-Iyx9{8#a3@$bWE7OY&S|Mq}gNHq~a4=5lH^ni9c)8_Y~PP>|%UZNA>$sg3zc+MjF4nB{#b6%Qz~Z?PMqV0!d)C z;d>HTA(>Gx2ZBzF^7!Q4b8N}BJmDe1lBiPysG}#=#Z@d)8o5FwdtV!B%Zz=}b-^l6 z+<$WfA?5lqxMA`-H9X*rLy6ro`Ngb-XY1QJT&J>uH*zE#FTS&*LM!{@ZKsCvpPyE6 zZ)?h8z$`#L@$tdu1DWe%WPGX2y;H_+^vdQ=Z^m{C#n87TqNb77ZbS+_+kUf>GgQFz3W;u4#jbS;MqWUvZ=&ilhZ`XrZs#`K zDy;FdLX3JNi2e>HK4%l&VXJMg!1uB*e6Dn5f=QyolHZ(UEjQ26uB`>*$oFg5{#TY8FRt^i38oY99KjiRvr*H6kUp;kNw2!YI=7sNj{y7bph_Eh@}yK zc+OL%kiC^fz<1HJvIt?2_9bpDkkdo-pTyi`wQsu5_30_f2?UpfP6)|$E?J#=lj7!F zGX}fy8W#aVL=9M&^wt_~XsB2UL@~`gB%ZC=S$o+P;HtUteVn1JS0cY&yG-I3QbcX_ zeeE&^4>5#&A^iH<9exwM-Cv2qoz-Liyj~2)Z;4=WJ^r?`Uv=bW`}ck&a33H@%Ya>) z890D%IAD3b_+sXETynIgw+#1u)Fi6WdFZ8ZQ8fHk-_iZ%AwlBf`G?03x{FoJT-DmK zny_{mCQVSsEDbCLnHw@UmBCn93!yFeWZ;OEC3IK;u}x1gL=mV2bN9W$@Q3ik>&D7=r zBj0u;olIz9#c9Tx&_Q{O-9?^{2P#2K*T&;o!2q*ZdC%@H=@V<`6Nsj7#z$QCziV!d zzQFyZM<*bf)yRc6bux63dCFP8ZZ1n%`*G=+eZ?<)8ABTKV0 z;0`IQyREkD7@pT{Bcc~Xg7e-%1NNv3;y%k-0|)k*Xv@*97E;jZlxBJ4p5;rJ_da)u z+YO3!*-wpz!=M}V)mN9Q^;_#i{BFf&M)G5FSMFxF>)aM09=L{msnXY}O=zbv@1=BQ z0#=<164EyJZ^0o1^fQ0-44d5VVG|?clJ0{W8tToa>e7oz99AGS`-Qc*VxlN-U5e#=p5k2>j}HU+ zGr=EhW!@Ul9M%DRRPUy<%5@V!Lf;8efEo=FT%Hl4p3Y(cEK-%cmQmeaV!SF5Vd`le zi+{J|7Pz&jr-26PvR;vMU@a@a z(Sc{%5Q<#u1Xipou!3Ps|E^Vt+9^F&*JJa)YxiphIo1i&A_Qt0x77QiB(d*U#XA9pfs(ll4^*n<~QAr6g?g zNUN55cwKgfpd$(+^0bM-~FUcvIR=``QA&CvJuUzHn)mK_5ACx_*8% zt^^)3k&`f|GHBYln5jhc>-~7$rZwRX;5;Nt9Dqog)^`Rx0c!V{#os46wg4WH!QvXB z0i0uX;2hW0{XOf;LIhmGz}epX4M4OHUBC(7_!kD%)7{&|t_2Oaq46Am0mY%3OEy)Sreom;09^jrkL-a@5n7`_7R{ShiL&Hjk_7*JCg9QO3e%Qw^iI zCi0R6s#N7{(%Ttqx(ZpJm1@NuS}JoILIkfpA*&v~kPZooVZcTN*XR&ofqn4P-||#JkTP8RtQOMv5rf4P5C6`>L{al@Nbwh_U)3WoT@D+lpB$fK8wa zt}%~FepD*5ix|Cz+6UP``C`(wXKmiuv%tgw=Tf(VX``diB%>0#>860a<%iMKXR5{^ zt8{hb)p5?)kSVt3)*==-8uT5i{o-o`P&oDmIFN@DeDvl(KS8C%+#G%UWw!#r@DvuQT=wQ%_(1r z-vKy6I>weA!D;B^qgj!fmfMz-EA8@h1>6}{`CuEfl7!fg=acO}4=t&o${2gf*%Js# zV0^*r2l0@AM9TahiS&ON@OZBGKH#wnf*+b9U($FCrhYpoZfH3jdhAI*_N7i67GGKm zne^|3N8Q?5`MU;;9a%bx7_`tHxHYdt?O;WSg`NEBc@L*A22(MHFu=8EaoIzgj%Q>j zwaUh@kCP~Ptj6U}wz^hAUy}KF;*iE@hF<1kk0hqZPvy1>*sE_n>rRSet=) z)GxCzKaL+v1Znkq*2y~S(Wo8?k>fsc;}b8C?Ct3nD}2q&%uwpT#KI`73feIttq%Gl zmSGC~UDs02f$x`7m--}b>$!67D8@pIV)rK% zDdoyam8fZuY$wC$!Y_{V^{@(EWyiU2-R%Ej?XH62=-UVH6WrY;xO;GScXxLQ?(P;K zxVyW%TX1&`5Zv8uhuqKo)PLW15B6ZGnv);ULv`0sGu>BzKe5%@aqU$S0ERRqR2lWZ z3~3FD!g-K5CLXeLJ3t&PVR9DpJv0D9^}oAEDgkkICiR^eGGle6`*R?iruev@-WNaM;b~#Lu6!8G`xG}9{#G6_9_J2I z{?C<1IOwL8yOdIr5#9Ec+if7}JW{D6S^eVbTT4B~#(C_1q29y*KR1vy;{ARQX+u2> zEgl?gPD3*ej^^q*3=4nskg686^;q5%R4v)8`Z1WgzD7@yx>GU=JW4(cdkcSSU2o=E z3p0K9p^b!WBiO*eRl?7i!tS~9{sQcx8eAiYzm>=O|5c4xG7tdNeEDR zoRV6+=f^~Mt}P#S3i4{M&U+ca>XEl_NjJJ2Ty$;u&s5>mWm$IRr$OpYQ;KnemfRnx zWzqC*I!#A-IEoty-}-hdd*urEk3m}2p$srcTRsia3&;N&q%EHYDHrym`v1e$BM7-B z$}+c-l7h6oL^g^_LccPi)cM=}T_Vpe6=lW1mPxL9hv)NaBh*L^N2)fhUzH~910EI2wH4$U?ILF)LTpHy|S zk>bhh*w`$DiwF|>RWOQD{Kpo1a1Te&5ane8-E#I1Al2WHCpB!Sk-#s25sMxPuhpK# z5WIp%S7WS#u`0Zv@#0!eIttirsaWT1VEE&~0jol?>Hj+u*jf)tR0x;}1i}QDnKNm= zWTr(M$cljxAxg`I8q$|NwDLjg!!Ck_jTou6A4>e|j~f5S9~~|XBOI<=w5r+j#6WW^ znQi*{|MN$+2kJxqEx8NW;A`Xn*+(zZN?a#M&^SftWM#oO6P%$Ip7^KIFgdsyILao-5C z>RTbSK{9aIq}q=$H&XZGrKg9Ob*2w~b<1tv2b3QNKg*91zj6pYif@DLR2+Y#%S;@U zpxa5LNT5h8CN{Gxt3e1&f(!|YGZS-9Fs9?M9?a`PO84ZXSBKY{To4Z$G8Os?S|Gjd zFqn|@Q(`8VELBeWp>5YmBQxv6$u$PTi$}-kPXAIJ)j4SQ%5dsnBgz|LM~Tw+iL#Dk+y45aDgXGRYDKOU)9HMs z$gr96?d5gt2AM*tx9+e;L8G*-+HqV(UoporR0ZFAq5T0j%BesMkMHR?-Q*EWwI%gX zm`;t%=^o!%EUtaY=?&^g@k~oTplWiLLVY>SG@Qy(B4Whs-?mz3WvQ;Fd;a?B)>Z2% zd$Sys4qB70sC*$XtT|+RtHZ2?;_X7c9uKaPXNC$CPni?8cYzB!8#Hl1qv(67xUB6j z3PF3z_0r9Ud%QKMz&9}C4bOv;^^4nqB2JtdS6K;J*WQ$X9+6~Fe1N3%ja}S7R5ACf z5SEkxSkJ&Pmx1J39aJl5RNgb_ZV#8ghz-c>BKW#Zpde|;+~W!KB62ubI468fiJ?A1 zQ%U^tgEgM81;~z>J_{j+m16Bb{Alyyueje=u*HFaYj>enXV?b&u3N(375wa~`n6GriIt_hZ}Q5n`|9IvhtO!ah5Yn%08j4B9I}Qh*L5P}AB{g&nC6 zpaV&=3g|$_?f=_>tOEugUk3gGjpM%sjg1NmlwU$3H^QizxNk9PD2pbwNd8wJb>{o4 zkKUa8tB)d>wb=snQ4xSXy0JwU`W-DuVJTvmv()&%`luB^AJvEX)JG9o@)1m(jz9I$ z23no(pZX}yUwssoB59_*fVf6d83+`If%6_)eIqV?D{<8vFAr2yv)J3LQlQtv6QRAU zY>;<11cTemxVyp2(0 ziYFQQ4F%PQ6iI6H3o3)^WvZ(tup4Bk({LjL%Om|~uu0ISZmQLt=D9<(P{Sozl&_@AXzyIo^-6WJ#l9jTT zttwE@9+(c}A^3Ij5Jy&7zvzWSMzjVq_#zrCHc&dNx_M5~&jR=}Mytw%wgA=xrCZX`rZlOs_-l#nenuAM6v-uFV5 z_pb2R^fDwjUSbkP*wBVxx3}B$DA&az2T3{_Y|rSPLW)C$8cm%|V&JgKwdm9!OfQxs;cUo2JeWLOF7K+FF#WY12 z<_p=LJ9^+I3uwJQv7K3apah;082S6pF3_7T4vfe_uWAWBmb)58E1uD3`FMCvM0w#1 z94Pyeoh_M4wRQwn-d~kAP7>m|{(^<7z_-{pW$}H${I<{?Aj1ehc|*~$b(aQfAXpIC zj9n7!c4Rf=vr?<~;vR;^(@_%rqq-eHPh^9J&34yud!D<#Bs7zvNP7iC4{rhPF8cwi zjiyOM3%Ejd!+P6Tv4n?`bpvIV%)`Ogqo|x|OG!&6N|v717;cV!gNZ65{}rF&0-?6R zvG8KeRkcmgmQtek+dV&uqG<$q5Y?|)++=A)Y=L1D0xkj9EnF#e>2pbuQCJVNS`*q- zNR?k*IrL%G>UHpvwDkse&d2OsjR!xFb8;}h3NQVvj9r{+wGw2CbaQN|GKIYtzZ4Yf z>GA4nv~c^-Fqb}p;F|XvrpJmx$%5m;1b(bvY~7O!Q`ejs5Fx_qie2;-A>PVO_=g_N z{4YHU_?VjV4?TLp7C=k+Nsj_rfB({>P9LB2==LW)YAfvI`xspH{5#CGw5FZ`acQ}t z1IJpWiMQ?I0n0G6uX4u}kMwPDy|)3of)*|Z4fKA|!sG_4+58?WwtOi{6kd+$R?#~t zNa+{$i3M(!an%XbkYdtSN;0lc1;G`L3b136mj5~_E{IAH0tK$n ztWZ(cpS6c}N$QhVlQXZ=ClgZrK%d7du6UESPBTxRvlffZaxKYCF591N4!(+Lse1|j?2Z349=_o;d;{+qr8qlR#ANxnPSy@g>L+l6NrBz4GRTKFbHykWVHyw4I zIGL?om2Rj!*K!M~3!O_;N+KL%Qz%snY~ZYYPI2qX>&;~vbU_Va1EMS$SsM-(&$-91 zA~Rxzxoi5sJp;$V$6{-sGMt;W-T=}|`jJ^DBK2cSp6_J%;$vECSB%>HTqiHudSfrB2vG~_<7WT3_J+PqID z26#}HIDbjeXbjQ}1hxzbzHNcrduA%Cfe9)zW>hV0q`d!kJ`8F#J^!Eiut|PYBldG% z#8A7pW*6mzmS#a#HjeadYx2Xlq5jx^ zN5sIP1!&&>w-GV$bi?doQM{C6UeZM&Tl~t+EsJrjXCGXY#NpI4kq%8!5#*B0qH4;4FSw9>BJnN}we|3C7m4nQ82+307n!rMP# z(ZESiCwR6}Y1;soR`KbKShdSn%42u{9_c_zR>l@PuY9Rt1ivsn;wxGZWa3l)8tk(H zfr2>-{T5xIPiGTsrZ_`laAlE74~-4tvEK1jUvI1{tAWO2Vp+q}adQ~zLN`Sh33xRq zVn@g-EiXEZFa{p8pLUTItc}Ir<@Cq*7KIPXl!Ys?HE{AbL)McfZd)0U@D`3_Y>S6f z`F4R?Fry-)=0DtsB!Fq)=RVKh5nqkIhQfjV0DAgJM`f5I_{lQYNtDn?t7and{XDv{ zibFT}EJnmy5ZPynA%vAmef--mi&?k&F1q|E0&0!s6C+sBUW!L}5dphmET+jMC-ap* zrb@$b{P!WS-1wqSHs?ig#uXxlN5x9m^-!QIJj-AVMR~*bR>FKV5{Y(;{(V~MPIp1! zuOZ8(jG^mRAV^@QZa12$BG$^<&9M%*RxjTUjKrZbo{EWxT(Twz_k;>LZ^c6;jh5-n zrr2Y+6My+Po(^L<@g8WDZxFzaf*`>X)QTA^qQ%&5EbDz#vi=*JqWzlbv)mcWSDnYK zSSy7;h+(N#-CwoKL16&)LoWd5W>w}7FiQTFk#zofloU2Rfnlx(v{sM$6u1ovx)~9M zofwEAR#&{TJ;#LuoR*3<^oo1n4K&& z9r7i!P@fb4$|)<0!NX0QIIjK8o~5j3zCqNg#9@>u+wR9CKt&`KvyBi*pClB(%tj&j~=jz4Xl6(ltCJ;na9IJ3D#?7YO@!$^D(88)1YK>1SPQ|LDj8e8}~%nG^7x9rZ6&EaG#oK2Id?{ zl4ttYE|M;?v^BD|t=`pQce7w#q34hHxB`6~LLUL2h5&pW>^aUuzNcL8P#JyCbVYbo9TwPxf?y|ah)iWdE$A>Bu;?1Ds53)MiIf5F8~G7u z-VQq%wM3Y((EBY<)HUE;hJYdoCJIbr8njZpm7oM@t1CwUc#3dAR81SEveaJ`jTDAj zf)$Q$UUZ%T#@q2PXBw~Q!2HRXHfbt5SpSfeRd(RiQg*n<xmP;)*=z4RI@f`m?x?u}&fBJoN5+d=d;q#v-M|^l!yLF!%E8B>d?V=}# z-T7KU_;=;Xz8Jn=$@H(wm19_TA3o%?C6#lz+w+HZ@Vye*O#Z6E1l+<@OVBcE10MJ% zh$od)XyBdJHPXL^SI80d3IbukrSy&b*|m^VnEJ%MIJ^y$gvj*^5=&VNfe~cq)2YJa$AWnb=Ri=R^-o;XB1=c>?DEy<_OJsa885PlSNRadLf z$I`N1H&IUAX#&F5W-iC6e3S}#uKDy#XP5qZrX2v!lpWxiuKw$pmfSz3!{o`4eD2IE z0Ad>cxr6iK=9co}ZU8APh`aDd*@<@Lx2D9oeh*(;(psK2dUa0D!XkYOxz7-mr!JL& zk`{Yb*<=HR_+E2ug7oyJ24E8bsAL&;dBuQR-U14TUJJ+vx%ZC;v@=u6Zvagtsd2R8 zW8lopQm$x%IENdik@Z$!X#{=hK-j`mqr&a#golg*jEM&v?v(i`O#|!#N(lvl(NaUv zkbUK161Gj78YP)p|4lFeXsSoOEU@o!hkY>O@+~^K%z$G%_b+HV`Jw=x>Nhr-+7l7wrQ$LjFACmX|v{rMP_!A)@I^ z)0ikYt3};`JjRvZdwKG7Ue?Wj;H(}baV=hl+?z_dT4x75c&7b{spf!BsWXW69A3aQ ziV}j*fcajYrw{6Z`GV_VjiYk`db{;Iq!P*KCu?wS?LI>TzGpPkk6eW!MpWysLOasN z<{7E5Q3c@UtQQ316hW9f0MJyH)otSeiFUG`bqmNh4jb&WEnC6gVq`B^P^)a?q9J_b zh|KO0_!#$9eTHSyiIO%W-KrsDq$!I-z*TCHT#5%7UbT&F#!5gZ<2FOZwo1XlD&WFjL zI2G>vU7d*qC9v>PUbV-~Yt&f_;H8Uo>T8xhT%Ewd^!(2V*6QY+zC`i3XGK7#+^$4r z@lbQ=su=BsKU`drRG8VQsduEKfLz6fVTk^l0G6D_yL8D4R;v-`<-?2CCunNorz%xx z-)^O@SZM6_;A?Vv_Kg0`Y!6OGNkw%@_AMlQkM&2O*ouzUhrragNwT#!Qg*i9XJLx1 z9?^#|2MO7qv+w6?3gv#LzmT~WWoRLtC$L+KCY~}5qWAh$J#^g!)XLFIWTV)n0rjg8 z^$7|L;$5me1RBj|h{#!I`L=y&;V&l(S#f?F2Dfh}r?SZk<33*v7xU71^IQcqP*fU9 zQlmj?;oT*SA|uH@pxs14T&z9}61l>bCvzlezPA^3iZL&dB%#2w`WoiLWeDWReJuH9 zRIaY36|ZS%J5M1xwG*))91aI@aqryGM+37q2>>?`JUfrHi?KSNV>*V6^1hDxs5GQm(oOXWYjcQ^NfMu_tqsZ= zUKmL=_eq7}tn^h_GBl!Wj?sB{Vqwc(QQMnV8$>@ks| zPCgj%0!NnyMx9NVB#^o5&lqROH|NshwseO(6*6;$V!-v0Z>it7#+^fSl-!0}w~R|T z#}}gmX9xt+`Ze;t0n%61TZfT6f~40oVx`Qtni#o`Jg2yLV~)IQ=G{(0Wvr+{z2}LQ zwla~t9XVEUOPT|Wd>o9>k4@;z%MZMovo((h3pPy+Nxkn{4QZQPLs$5rcWJ$Z^GOXR z$R~T1cd3NY@C@RhulAmzt?l=Y z&Qa=fwRzh}8(M(ym4|h+D#08tg_E)y>MQ1N&yoSahZIj=Xeg1N$S3dY_U8|P?$s8Q zFan@^WsY?ArA%gP8^a~#0;`voO2RzB&8uZMXG&KvS{yn;@VfV(>=o4)iipuS;k^>! zY!Hpn3*z1bgLqH)tmT_a2_6W!!|<%&B!GU&^A|1!kfvUmw=}rMmxmhsGxdl(F#kBG zX|yx~rm&klqK4x_WWR7Z3HN8>46;IEi5Z?uV8wW&3X+RsF0cRFydw3BeT&C`MbUy! zo7vI`Ajfd({>FU{zg+rj?gpL85WgBrMnM5e2Y(>{tDIbRo1$FB5X!%vsi!BAhi!ehd~{eaamOkkc!flLGZ2Ra=u(*x>KK`P-HgqS^8@s>@={p-c?wOfit)Lbzpuu1 zz$q?}?of3D}s_%PFZbpmepA6%iB3;_==p42V>rSltd_ z^F#rT;Y|HB;E((QIDqVcqY3!GLKDP|`MJC${f}olKLrS5ZJ_`Cg^e?df^P2M`DFF{ zgX~h#sUC#eC$Uj@!s%tpi-z?oe1}I>rfVxjV{2lBiN$x1y{L;WACtik^%!AWNN1_) zC{W01#)(TA@YpSDnbEkSfh2>Y)3vU2FG3nF?YV>mipGmzH`3Ou{2Me~M8rw6y@2%k zL6^(VTjw{@kViyX{iQ?cqVH;5w;X1uJNliKr#g{{{QcRZ3H`i~3x(7t1fbH)+;aCK zN4yE$`xHq}oc53%m9up+9&GQ}vLhnNlv5idlS~SPsWW!KD0S!|GqU#w$ahF%}?$H{1Q1EN~_ZDH+2&Z&8y^_ZYEI&Iz|%nR7<^y zryl;U^Cpa2iFQ`|^noA2(`q`jXji{ki2JHE@La((=*q4 z1I2zN6CS(I-Hv2O_jRg8*qMf2{0~mwxBdQw zr=?2;-aj*TvZ#`T5L zIB#=Gf@)7Sd$Y-7QLLDmE%!l-CP3cE3<*SAat)>VN-L_?)hzWVl%Uz^hF6^P9bDOuJ^0sGySDp z4{lYL_uHA2Q&Le|g7vSFj?r5d(-1p>Zer46n(Q2{v|<$HncMOgZEn?)^sQmASIDIX z86n=)D5O8pbc9j5-zx1FkNP<-_iQo8An$)X!Z=z!aWw?+D82M)e|d>SvHs0fljJx0 zk;i7(JDVJ)Ceka}I}-t!Vd!t>peLR7Nsk6porO}JUcH!gf9y~AzFw^$ESW%Q^Mei!W(@9_6PygUnqBUMz-3f`zas%j5z^&^PLDl%m{HY3X7|S^8QhQU4KyVcK z)MYzBtnmk_-KHuiMM}eydiT7E0QRVcY9(a0y0?f9*G*$b;HB9E zw!Xkp0>B>K_PVJgFDBk2fd<&4-gFGWB_iJWt1^953d({YVNd!)^D@aRX1H`q=pP04 zb{*{3=QTZoG2eW{-#4#(-;eR<;;W;7cKh{F0AnsQh;d~ zwV_v3^fab*xfu z`=nYEh?q5r?jCU4ZEZtZ$nw_|tJHa&dEIcU)Vx$pFtcKLwT1;XcV8zjyo+nnc{+*$ ziJ#qMj-cs>^+t8~*Bl6N&eTMLU-zyzwot*F`eSa7oro6C)t0~!AX7WlAgeVrGU*4J zb(I6ylNmi(7@pj8;f*#?7)BU)xUKi74^;wPRvBh#QTfS-L97+_sqZdpRK~!&{e}vH zIrU&&kP_%l^6NT&@4AV^OTAHYBk&Q=f=Llp6wYLa;xS6+-l&-jmNF9XZAAw9$&GEt z_38wOZ#XaZt-U9UuiSu1Ia`;TUj`X_>W89ru`m|jHyMFEb3^3$!T8l=JK2+A=9NF< zFMfr zCC_*xi>1F{#I_3G*q41+rb*ags8S{Lqd5@(0-yJ2B|xK0n4JFo^+-GMletzSN}7Yz#GVDLnf{5-?7 z**xAfhW7B z(B{pKt!Fe4_rOuCnnC(9a_!N*!s8@W{y-LyX713J_hgm@sW{oC3~v{*{o6Wy>((ed z6f7ZVQu~){$OX3R`*_~H?nNex zHmCr83LTy(*&*=c+A|oSDGVVT+m)=x0t0qUUd_f3kIqztaudIuk@NDjOP+Zv{iOX*|vemk@RQnY{ z0D&~2v>=m3W?%&NO|R1X7CtdPnCe#%TQ%4PEtH>zesos8k&4;RDpis~^%!f%JX}3t zwd0c=lw#oh3m>jwIU%y@Uf3Z-vggTN&V>QxBRQ>g!z&hWc^gi~d9p?t`x=?Z@y3o@ zwvlMeMB^{*@@JJi4_mrq;aQ;v!X#3O+I8)?{XZ_9-`FL?3HG2b36oB%BtAP;QtcCJ zU}Mgv_LfT6$67!9!OgL*y`mk`WHg_bf=L$`&H=;Hl1j%47wbvUBgY|t6KCHcCKCrI zr5D%}*vt}TtF1{c!U45`tmdLQHUcnZ(W8z5?F1EISslA~ogFTpvssCVD-PKpK^)to z#q}|CWt#GIjXu>$wC|%w0oi04zrZMqTXK|y<|w;%ib+Qx_rD{?yp@q(bUMC#*Ypfm zc~HFUmb&h<0ugP=I{J8j__(xDwIGL9Od+LGiy)>ez;&&ZN+V&q1t%YSE?#9Q-*P~m zZ%rVe7>i}n1_KX({DzkdH-P3I<_sG+hiU-F zn=qp#@`EEjf=zwzESl-|iMjJlt>y5f_Pxf3@#XB4t#SiFPwmw{Tqrh-R_cCu$>4OG zu&1@RB$OZ_34o9SE-Rhl@N6T2o`gQG^<3h)47wXFxqB{o*?S4SDL+Ikc=8=~{ARup z+JY-w4$L{_WvDvuCp-ezKkx`~24gP)7^DwyJgBZG!Hy?;nz&i@7#`ovmHjbP-kK)^ z^QL(z&QJS^C(dD>G0vaM+5~goFt_NFFF4Vx9xPc(wEN*)et`Ls%QcJP@MpL4vvPQZAd4YH>W#`~u zSZXtEsi&1@`4pE)5qxTFXSQqYW}Yd6AUkl{O)Ozr7+ZOYF!u1pqS3YqYSj}4`9|~2 z@=qZbD{qo|0r8|jU;KXf;JbJ)96~7!nFL7^jif`O^ng414lW$(i-4s!y2QGMBEnES z6(qF}3b@d=PV~`aUM(C~f%7Xl^Ch%bMWz8d!GSF?Y|q_&!rLy(&iV6f&RI2m5)Z;d z#!Wy&*CWzr^jtOZC}l|+iiP?AAf$CPji^i}<1VF40SB=+=brY$6IH6w^xs?p>uKX7 zM>YSj`sl=W=C8%kloZrdRhahBvZyt7Ut9tZ(s%oKay2Ir^@W}28@?{R?{}qrGBk&j z%e{mdOX{HK3@Qq*Uh(9Lll>JQ)v$CoAJ~=Vx+9*1nK)L?5A{AS`uNlg2{|tz`$yDC z<*=^>2fzT}4ZBY0rFwKNX=QOWk(Xib!8FqWCov|4d{=Rl&s;QA@(?TeaGeF10{&v^ z189@VC74&6=s9K6UUgHMS!$0wz*IS|<$_bmek93nh$;m=U^J5;yxaReMXg!@sM~b! zQy~?An)G-x-~UudvDEgLfE`P>F!OoGDz9K8*cLC;rN@=W+wR&qnm%h)O`S*1l{@?% z$vdN06P)`Ze!^3&+Ni-lDVq}o!I~pkUmyeS9}8^ZhOHTek^$!^@+G4OMS7jRhjz%e zvKF0Xr!#9Qb(ell?mF_=)#wT&Lutid10OJ7B?Ki;63gCx$;=n@8NhofKKEAFx)=k( zbNkT>lHys?QrC6#ID(Hcs8$~IJ!g_rZ2XHWs||mn8mC7xO@I3Ez)4TALj!mqpNvcS6N!|v( z7f4`}Ak(oI+DT}?f}|=W!j6b4;|p1IiR5Rls{POz>@!#8&NgrtM5cN>jh5QEc*Ei2 zGrOVoOY8Z|3el!?30uS4pH)}u-!1{er)Sny14ln536sC?NaVUp{SeGHz?}+@LG8so zedLg2P%|EbO!9)g*Ojnx{*sStQZdHMkrPG-HQAO^h3$1^_GnOPW`n08_2OLV60MA? zqJ}}*PUxHG?vYePy4__Hqx)-js*(o>zRSazPz2q}`1{EuHTG2*YO;SI5)tH0aIO^L z&}ltf=9*NQX;c1zSXkoWp}3eK@Kn0)-uQY}=zv#sCrvy~lHEI*9Ka#Px3Qo`_kEb5 zoyTLD=yo-_a2u~7VJ{>uc3ZhWUBor{NcS#cCkR<+^3Het>{aRHllQl3WtYhurZwgK zu3bsziA8BNW=#Zd5}6$4Ig|hFRUOIVeD!S|te65vK7DL{vl>d?pl*LDcs3THn7x%61*%jSZ_ww~J^ zXgb8SY&S}bc2D92^2Z^Npz=3w;+#;6cFsYA>5 z(D4j^okkjXG9eLROXOF9e~X*1fu2e!3EWhf#?gtlX42PY!^)Ggs>Y%!Pvlq&tzEs)<2{AJev&^INM4&i5Kb zLqp~WkPM=j(oJ)o{Ln|MSA%%GVvAE3Psc}30>6p?ss`o%| z*;%;57KKuL!`7&d^EeV(g?e;!Zgc#axfjfs9EtXBe0KI{Rx{?I^?Qfy#jIV~On~OZ z!`)On?svqUYL&veWB$e_4S#wM^VzdDbtHw^fl$bc1$rHjA)WphHQ(;$;GO*%)2Pro z6I4z%6x)3X<6j!ciO+kI(jCQgOaEwZd*$gy%CGNI?XG$0`y z^~g70kUy2G&=<(XqElHhA7~XW7-M<2bHCb|l*X>?pfp08ZCN;MP9+g41BD`kHG*xa zpu->|0)D8K719Nd*(c*A6H91>+a1OjMi=2M5t6S);big|Vcg#0)^*o(M182RMj)uW zOwYv~wB_iSfZSA2@+$3KI2B?bvZSh_O-2ebYtxz(v83nOK}HhigPvUAz|QuFmXO00 z8H)wZNp3VXV??gZP(REkV<@|7xXevvEL+a@BT?>-L1|&FlvlR6jxF=o43BJf>KLf& zPGX0PiI-_s@`s!x;};FHNK;RpiY-*`pr4`kC-Dj1eNk&={8}f3QzyAjVU7k21TvKh z8zZO0fNqsz@x{c=0*vZcK(|WWLQm&@_pu8`PQy8R_Wy}bu%w~ZR4L0txXp;?Ue4cD>%o|R@EC-g=3H!22BonT_li%oh1Y& z(j*tt=1;*c#te~u4qpAuDZUmb%El}(ONpk2!rnn@6pPf5*J$q#v&qPjVnyAYL)Pnu z&y8*O8dfP2R6p@@3$2C0h6;Fjn&_z#x7UcNq~ zD4g)?>KN2El6JS2Gdz~foEJA)^(sNH5SMN07a^1ckkx=DG|Uz}rXhd7lgUO~{MlKM zgEU-D3iLAbGJQje>IE$l;o!0IRX&C()^mJC<8R}?RKguiV%qaI?oDlPImShz9`u($ zptztVRE9~%!uP2YU4Y?>Y@RwBV|$kglwyjzjRVOA+(1(A1wvgQ_obt>{?A}n4KzC^Xi~!QNRcd{N;S?h zQhk56i}eUyEq)Ju^R@7~j4n7C$Y>aFQYzBkP|Bi&Xh`dj1d*d`(jgKZjn1AftgPrj zMqQ^&pYM-D9hu3&-duJEzB8XFcbUfxxDV|J!+~V=67snstw^6DNV<>{!?*b7aPFya z$!@zESxx{+Iu$%ZQh%Ku0j-4rA}bt4JmX5;67Yxo*&DTU^J8x(kr68Z9N0lD)5`Y| z+iXMnTL&<$nI**A9fu}HmHa6eW9%GY+=~pdh)KYAL|`;33*%LPQ>K|Rtf{-W{RO&g zZS-u|lyeVOah&^p!!yHndimHuO{=N zQvQUzDbJtW>i;dVSr}}uT902LW)qxZQeIqOi-y?33~Y@ys`bgyQQ^0wWy9PBe^`vR zu?KWomBPSgT!xc~ISbkA*(3-HXb^#Rj>uc^QHMz%r}E%L_{zJ4Z zW6!uVkHSOzv1zg2PxPh3;(tt1_QVJzI*KO}ad@m*rohhYKQQj}KH<8(XY2Dk?zDeR z(v$=pjsT@i4Y-sTMQNE+Vv}O#WO@dfOJ%Al`kDG{AHjO5#4FD7cn071C+1$T%rxWG zQY#OoI|QpyISi8Q4OKSbVt9@i0KW13bo$HIY}CA+WW{nYxj2MkF2IC&r9-$m2vv^& zPP?4EijE8?ZhxZ6qC zH@LZ;3>Mkd7R)bomJpB0J-~b`4?*|FCM4?vcFiyjHsAJ*c6I=Ckp=~E&H~8&`_6k1 zTlLp7@W86N)3<}BjB?&_ZI~Ecxwy3BQ@dFO2;Mr@&|OVC+iaxKKUQa7Jcj)6onz;^ z*SfxcOW@7(GjhnlTA$SMEa=cr1O@IaTR*DC8!ZO2^c46t9?`x~Hd?xz5inlJmZ(q4 zCo_^}T%18y)FPdvjL6`eDVYmQ9|s~gp?cK4EL5_Wvc@rQ00TjTK+-`qOa&2NtP5s@ z*Xnh1HA-1TttKhfw;(UBb3$Ayal=tUKQEz4&iT+AP8lCcm#|jDyQsr9te@F+lePB3 zQ=O=d#+&$Kt5NfOyZdcN=cb(ZhBIk#V+tQ8j=3ql7ow&~`eCWdWkK_J5sgN(s;Ubr ziFawZzKO7(pQQ8tU%7wpMN&OW2%7$8?n@>0+}(q8Lzvh-L6f2_Zi1B zQ@fhLqKq-_Wj0ciR9x8&H!?gBh2-@K7m#6kiYO$Wu><1yRxL8AK~3&z`?Ss{HjmtV zr}857B^M4av0+swU^_a%S-bSNFd!5ytM=99c^_zw+nvz;*mDvZvu6^Jz}mCx;1#x) zojV5=3c2TB7ZWIlMHyxjsm!G|k25Jt?82UFe`}|= zP;*@3<^Cw#LJ>9taXT)Om?UP`;GEM!BFb6Kp!GbjsfU?%##R2Ki~o#bHM?p$y1184 zKoqAzKP{ar7V<6tiHv!H(*iPO6q<|#zT#i7jdMQ;lpePac@BJ zi#DsVPQMhgQ<)Tj1!?Kso8Ye8rf$c`N0F%~jxNdctyaRx_A&|q$E^=0Z$?CA%3*KJ zZh6IkN?BImq(wKPtw_-1Wf6U94zEQw_VZ3z8Dbq53lFgWz`~Y}m$3W!_a_w)K|y zG9W1+6Iv?2#}4=*vq|ho*5~~09bBO}+LePtZQAApe9S*t_@2%PA83Wk4W~2a2D@ml zg)^jG=B`iF+&CzxeFjAG^AL%JKM{mKUaK9NQmJjjt2c3NwF@>PNBwZSHhC=#%sTlmloYr(l@v5KmK2ntCpO#z9wh}Lq!WO( zyG96=Sy4E2U38yjO08{irG34`U(HQAR6hzNpkZ=WtB~d@6@0mB^<$0PK&o zi1L-Mqs@pKp=m9%zJw-{PJ_4z=uw!b3d+({ER}QKEZO3rV1coWLlkHw)djYuAS4Rf zdb(w9bNct09q$gC+;OVOZ0C)Px8NTcfewoOzWz+zowql5d3JaP9d+d!t`+m=13GeQ zKR~Jr8|GzYE%i{O>aHn88`pMQ{xkFlrWO|Dq=G5NEZWgFgF!YDg5ShW^1PZ?O`B$) zhgEDd6FIk*hc(nJ!X(SQbK7h_cw{xRRHS*^C_+k0WibKR&%egl^MjReyiKnKw+wvIsXsy;qf* z(_NoYa$DT1%cwSqs?uAkf5ga#H7*~X8gxc$iaaRYN1iCrGN66cFze8U0)w|rW^!wm zuI2{zIMd??zN5z!vUUb7z)J(ZJkPl3PZ||M2ekH@lY6H83ZM@(Tb;c!5*dXvv{GD5w*PVZ zt#;u&x1?@;1W^3CX_YjdD5ps;>1uLc6$gM$86y`Up;)$`#jnVwWP^4<@hhrj9uucn zGhdbXAVq6cmbtfN8E8Rt^AX-~;4pXmEBN#kYj;1Ez)V(%Jo9hNh$c0$uJB-m4#JgT z-q^z0crR$i!XkqGd-X8lGKY16W*u z!UZ91&7p<5foE}U@z(b$T%JIli41c-C2~$st_!1UVb2tv8Sy#t)uGq$dq)4fPIIuf zbuI{Q)`F*i3Ao1278Bo@y=neZ6>3#IK!!q>jOpV;fSa4V-MpvdE67dXV}IKVZsy|b%FQ!00KrP-G8iFLX& zG|CU1gyLIT!0%k9)K<&K_rg(RD>+rO6E@|2HSq$(aJWhPP+F;8plFUX9J&|5rGg47 z+2w6%*WB~0F(x- zmG;d9O)yUCq~%%-tL-vCOs>&p@|fGTLe^ZirbIFT9po3K>l($L?JXg%s=Ec`X`}P9yv0D;4TC+&3Qj0W~<_wE8-SAB8=%E?X10k;PD>7dhY$sgwyFxC302h9p1-rq1k}E!)dDJJRt>X? z*W3%7Kem`Pkun^ei~}6AuAVW(dV%}&H&?HI`aVAu_`7N$;Pbf57%k1^4OKOZ{M?w1 zpE1JVaq*$`I0dZCUN?Uh@59&i+MFnlV4<@vIA#i%p1yW1#JyquAUP|@@5wVZN)PU6Z4FW z_IP8dQiNa(h-vm;|s^?wXWLLEY3^@)yVU3zGG7sTwRZSdy&Nf?tL2P}q^$iT#`AyEG0> zz5W+#cNx`2*8uDqx8hpd-QC^YU5mRr#a#*%EACEkcPsAhR@~j~OZ&XvI_s?S_xu2o z3>h}e%7kR@xi)ylbQarwO%>PJvi{Kyi*Teyn6l+I6=@R1W%D+WQr6##H+r}qp zH8bINS&HC~w>ZfMt&*`?XvQ0DXk+I0O0+!A%A)N;IKBOB8BU%j47nUhL8GVu5m7 z$5*e}`nUJ3eYYNm5ja4IT8v94>^*Ykdy^ zwugzOPZ4PhacTR`pV$n4rLO?#$hgcYR6xWJ9@il%Ea(x#71C!%q~6zQ>F{pk6<(ed zrl_s|L0>h%{UwY?Lomz^KPn8;$zx0R@7^IPoQ{%^-XR&xjuNrnBkmLX85eYZNg(mG zlz&*-EIy^|8J%5l#C>B2ylFQ7kjgvuql{0|1odd}_IQ_klK=bc`a9V;zjNI>Q2F{H z6N@`Fq)1JDaZL7`Khm^Cl&lY*0hS^4U34x}1a0er-iEqV&WPcNSO&6L=R0F5 zWhtxERr(A%M)EYqaGNz0qPxx#dJH=_k^yT??QE?h(B|T*u|WV5To;%X&_F<|*4qd` z@U>QoU*|W;53NFQdgGtojS=EFwNgXlB*s61;urABA_=C|zr{_yU0Q|z312iRxi14r zxls$?Cf8+J{593@L3{21f+tzj4d6P_w}GGhqk#+Wdv-AS-2;ISQYhWKWv|Ag+Gqma zIN(h)CKft(%i?ia7SROlN3|8er2~J*vt2+bmOu6T2sl0(7QQr7={q%43T5CR|Bcrk zxXui_oRh#GfbOa85TmEl-#kIZ13W>su|@#Wuct5v!BRVC|nPjC&(+NPpR}e`8!;HOB8fm_h=gWTzG{ArxlSrB=3E9xrF5glzl3rYBe93w;>gKYhr*rv`k?9{U9sJc-0Mi8%) zH{!Kt?((WC`SV?jf0EY~@v^F~f_j*pG#FaALGAv{63SY5|5Gmsci7=%3-aTELXUwj zHmNq2w-5# zm$C?_(2Yq&YH$sGQEBTiD{S9{T*C5pu75mfPGI!K%io65`_sr^PB}ybD=nQZ6xpZe zW0|#6h1(&R*wFUiRa;HI<=GLS=cwygkDFj$=NRiIt;NlXAx%%Q)gO26Q^)IS(^&Y4-M0VqSgrlO_{)>4 zXDSFvb`9|DHG**I;A_LOl6k8k8z)oghZtVto?syC1>c?8?2O$|@*c;OPz_FPrhuPN zZ8hSI+-RexLOtSk7mDP2H`#EkC>(T;ezxiF7>{k zS?SPm1>K4zf4r3Pc&E9yX+ujPQT=iHcAtTyd1#o^-FoLMpoIWI?mbWY7xtP{6H>BO z9d(KY!d@3=H{Al6o&GLheR1Du9J9T#V8l!RP~XCmG+ZXyJ^Tuq@!|85 z-Y(ReEA)*_F2Y~y&LWEYFQ9Zdg6e<}1@N>K0|Uy7HBoBC6fVPf*D!;6nb=q0RH4%e zh3cq6iu*0f2W^a$2j+!jtViK|y`jXd?cU!Lzq}n6`Okb?iS2T2<6FXdwJ{Nj#(sS71QmMz>cA*!1&R) zt+SJRlz0GuQ<55cOAa`fyW0A}J=D+n2l@wDINzV2IvD2Hvx&o-YW_KIKAl3_^rW+~`)>ctN+gPy`*8r?93rg3L(Ru+f*-QoA=n*OrE1*Bb$Fvha$u{Gs$Q-ANQ*p5#oemE8;DLq5QzAHVXrTjT#!@TPeatx7zXj(Nd$ln zjKy#ER5WmBz$k@}a=&rojm)ydrwh@~@m(Px^4tjnKDA__4+wij$sixr*?A6{YePdg zhGacShaJE7sdopVuthW@glzR)yNR^-P*``VAibvF+9Kn5V(3~vhFVAp_rQHXjW1>3 zRa-ij8D7u@OIeNH(1V2KTCJX8w&|#Y87oe=3c*e$!%CVc4BPnO_nnl$Lk#S3w(QR8 z3ohYKIp>pfbcAwD%m8!B;mVnc=6#kBqVK!!YC*hBI(St|$ zdDxWg)8s1ht@ncgaGn_qNlD4S9MrMx-YFUtZ%pDR95O2%l73u{WON}K-{4R#Z&F(X zdOu0%@@YPy>8k@b1Yp!nW}xX0S}GKpr>Ocj!DQeQo;v8cD(_Q+0D&TSll!!Iz*URc zpA;*bU+KI}oCp)poIkj)zI#kOcM$w={;i<~lMobklsStgCf-k9#mSyU+Zf<1=9(_m zRMt7r)yDJH`J$92B*aBbGj#MIY=WB|3k;vh^030hcI01Gd5lFx-{F5&a^^_|DXi`O zegdzB!cb193I(`Q<2?ewfSdi&wk+Lx>icU*ddO!8HPiPCL`TEVbxhQNJ%A2f;QMHD z+Z}8e3(0htx>V7)w;uVqI?aNO*`3Wd)DXb0Z6$42(s4!u6$il27v_oCN0W#L0h!K$ zJ}usosfS7J6UfM~RlT0G#32g;T!|ZfTB@)}gJKME9=Q7kOfb3Ws>&r5kM##bDFzE} z2K?_axZ`t`%uS=n<@Ii!9i5XbviUVjY$dwl^s?CoYar;64g9awhPv)lN(EnO!eOK3BWXqi5VB zCYtW3J@z6-t`Oi=z^}40}Wy<7G5}-_Js8L!Un<7N=!`~H9uO%r%ConA= zrbW6rKVNtA5bfDdeDO9MaxKJelPEC7Rc2%mXsBVUx#r@r;K(Fof798#EzACuy%0sM zWQ7rW#HOK(W!Dm5+dzKge*k4K=;Ek#@4`yRb^A^c@;<9Kc?6rX2%zkRSyO6m1l?5n zYq{BUSKJC=x8&PD*{i;cn-QaKs~Z<<>?G{Kn#bC){)4GYn>6|Pocm`0#?{a$ykVFF zxFZuiQ7Tf}+7$zS{1~U823H2VGsJ?Vz?!OCJ$Rb?e}Ux*?MMjM++W%&@>jvu@Njx- zOOzwc{{l-D20E={6brPPY4#<5GT5;>CB=%RC__7>KMenu_G%+pTf1(_)AWuRI*_o` zd1iB(AeE=g5g8S9nxv*BHa}9tHL1O3?pOMT%D|060lI8!*xA?klvaT=coWQok zhC<1D=iivJ&upZCSzcO$3DcA-EDgd0=W>UKUr|2m+DJk@5M-Kxwm(YV#&FLh$<4m! z|ER0@am(uOZ9Wywy5T|b*+|hM6S?t+A=+*~RCy^9XnUC@2eX-*cJ6m}OH&M%k^yZm z>o@{ONy70Xw&kA^)yFz*gF#k$$qZuTp%Xt`aau%iG{BKrH%dbSt!~m0#x_OmZwZ4@i%`Nl$)naye#6jVE^P0sO@j-jX zFdTC@e610?qbP%PP@kuuQT1tYANY&pg8>2Sr_Bl@pv7{t7gYsQ0d=Vf#JwsiKa%a{ zNy-C9LAyL)P6Oq|)jg56_98n}`r!G2zzpsC-(F7IEokzG4AZ>mF!QPZun2ykgJpJ? zajVRx3~(*GnMK6Ve{nB6uV|dVxR=C@PkmJ@dnEY*Z0p?(Qo3^Yi^72dp9if}ss1jS z8kDB(8G%MX!De$FUi6^6IIEYZI5IFsPuva7wZk$`X(qO>(G%?`BCjg`1QTfqD1fu|?3;Gweq zq|s^CB&{lQ?72ilIDtl#MGbscMATyBybMHzo^?_n2&j8u8{o3&j!ze{ocWQ#MORR@ zFsQn(i%rd}^im#8mL@FS7qC9B6TRpK46%N*Q8C!gq!6xqob{S!)}P^~*^|_x?F&u< z{Z4sgy}W;cD{^`N-~zpSDS*e=KL`Iah=C+eqiAiK)@{2Y*x1TG)Y{@9mN+ee6BO%Q z*lN&wPa-32TDHj&r2 z-IBfd8&0&1q<+a;V`xe-%p2e->p*nArwe!A)a0R;K`@@7h@94$W%q;Emzn9R&Q6Vb z*1<~oDDl@WH%fv;DsW0yJn~dp5pxLH3uwc=|X;ML)!D@95-Z`=FB>mF`ccDhs||bOYPDP_pl)^e2-Q zxX}?RQysBhjxGCNL>on7`S6q+?Ga$pmE*Dri8b;INT0)3*oz&wWt;uG`-l4B6QzlT zxcn1Kwmt59>6YQvSI&)Qf2%2@eZDFMwLWIb2C23!6*8`QFQ+%+nYolo`{2XKh;_`M z{!tq0ZI`GvC$#k~Z)#g4Ck};zOU8j^vK+5agaZfZq`yKW62yDK)3M~zx9KOC=UY!$ zk(OxWH4C(=>OPR=!DFpfR0HGqSVf`Z{RT+Q<9q>0c|^$Vpiax(r45mUvgp%*9P3pl z9+(9l4x?}oH5h~1VE*9Fadb~hyd_Awf;{_+ z*H#zvEC#P^q)b90Z)P417MrLROdZX90&@r&OzWK~J{*-%w@o&-bG2>2d9< zw>rAgE|ve!_o{|fU`-FlhbMSjIa6r-zjGAI4Xw&l3n-3NO$4d)U!O~EUd$Vy(% zRYA3s-2cdCctp<3;O)gr$Pq-(JP$<%eBxmBpe*`@6MLg|ytCjIo84dCz>?n$Oz3v7 z+Ae%(H;V=*RRUX9&G*-hPV4SR&TFQW7O2;`?Kz}5Y{wCb)oYs2g=k^U>}E&zSTCl} zSV@+0aS`yd%|~VLwNVw4aMcxeugL24n=PTlXe|dbOV&wsQCBFJy*G$d8tZ~Y!wLO`sNYXROn0(KyG(ZX#At;-r>No?1Y z^FH@JORjE9OgD@FfG-z+sEY7L6^#ESbPYFG*^MjZcz=N}iVgxG@HK98i$R_-7n4MA zidM&gHDQm-EG*>JE+SXJOmi5V8JqP#;0ySA%i!bU`7%4_PF0fkP+o2^YP*BMKfk?b zUCDpD+JMOWrjsX__sP=p$#P;Uiz7E`UuaMffYLV`C+1TzeW_3!2F zK;8CxrV>`yFcx=78MHIla*e)G73^@akthV65!vN940-$d35bh_a;UL*8SR=(o9MDV zT=gk&^2LM%A+jsD!;B5i)I80TW@B#0g2hIbA{mjxcw^6udR|w`{fM_OqjAhFtZm+raS5NEV4x|zGak)!R;*3$9!HvjA7H&gw{=J`LZ3OE?@xUY(-E1}%!Qo<9rG(c)_dBfM*9=`+{E zA5>ZFeQ)agYZA509Bd{EyLPaieHq|W6B#fp+tPhQs?7Zft~d*j`_KV=T;CY9tYArB zFUjEE`cWRF@Cgf}@aE%a`h|lDWKMe&y}JpD57T~tmG2;X;s;S7?eN_3x%nAW+mTr6 z@GN;C?O$ZH5?fU@DvFb>sq_}xzpswCSsu4%GX!*x)?lzFOYng%7IPn3coQ#ki zZzO$O^;^aX_Gok^Otj9+&QT#q`@X@8|5ZljIkuFH!#?yt511w$TdC8@WP$;WFKnZ& z;jU~~I`97F6;GF?zsA>z0R}_^B8DcC-IdI71P#P2n91_MYLQSk#q~HF!IfgrvQoKY)8+jUdw$1n``z zsy1el3F`G2mML^k=h!`y3XcW8l7ids^?N|f(Qjdz~?{pzKRK>(^o!X0}Hv*4<9X2oyI z`&yX-f*4siXk=z3{vv84It%b-*kD#=rj`QGTDC1GI;tF`qG+Lj2x5k3wWJUiE`*ae znP5wVmF>}ODM+0i1euhW>%5A35fT*_9o3Y;5^Pih8M9G91zcKha-Fsy$Je3y1T39) zsRy-5>B>2VZMki*YdF)V{|b{F?^z`P9Hp#<46O(RNO+qYB!UTzRpABuP_~<81B#Qe z*$PKRBf}g7%Fl5qG#hwt(y-?46{1p)$^uZ?fQVr7;k&|}EIJSn4aD$okM}=GPJY53 z{S2mlt;^4pCk5c53k4Kz7vsCIF z+yy!6s%v7mfaqc>X)JJ}S!#O}Z_1Cjr!Eln@QW2r$aFW7-1~zFuR|+j#S&XMRbgCY z(0CdZXo{{-Q~<0c)ysI8Bz8eHPA{RVpPo2i+gpowp~mQ229ZLTxiCH{))n>9$WM&e zx0&SiCPUbYv2Qix@R)iWNai35tJ}XOZ((10Lf(dY3Ome0{EfgqGV_{6YOmURtaV7K zt2fVxkNr|;Q!%79+4V&?Iq1?{BJecOzu*n82DTDRd%I}~gqpOuiT$u07#-}xv%R_q z1jZ>xygML=At}r*VL?eAFUgvy=8qJnyI~;) zobzglzNF`3P-8)0fUIM&No{i%t{z3%qItIW>O2#7`x`+cP{TFxXxx6o5`aw+?!Lb{`IEh=_Zu0 z-HjXkV(YRHveAu)EfWWSl9=n*gyLQ2_J?pKIE z(XNiYMzFSY$QHEu))HSM8A}w$osS@58dw&J)wX*hy;UJ;`Sz9*UPNF&rGg@y!Kn#t z5^UtiAa!l2pke&g9FcG!)&8ukUgcda{VG<{I_y*!Ht;nKQ+wDM>ap4~cu^y~6%ZUM z^;m7}lR4j8@vX)@jB*|04GCPv8plh&})-5qA;RjXnsnWQaHbTM+Pf5x$EQ`}@ZPo{b1(x&Dz{ zFF^e)8)$On3ZQJ2dHpKiYI640y1c9;Ym$6~l$9)*N2facU z6?;F5G+xbsV^CYO_&hcj0NY#gO?Kj4{(GxBB?-bmmFY-oYAz zdpR}7ReSDT#(@na@33CA!7ks5!r-+EI~^sT8VjOc+=Q3lC=r_D3in*|H6g8vJ+f|M zU6+DRQe$N03uLJ7-sY`l)YKu(F>Q67ZNB%)AKms~3@OmWEgvMN!3gHX#_%TC&W)ce zAZAIg*0tretp=eQb1PMf9HqBHIRI-?duAVlW*@4WaBT!XJg#KX)WvDbTO1q{W6`xc zkD72mBYlfxgG~;uos;P6y7Q3E=JclRaqPM3m7k(2-VOT@s454YGg2##3Bc)y$R^KD z9X&<}$s|WK&aU7zD}Z2qt%lwBY^IorZ4oc*!DPzGoSAKuEi7ol#4`-JAy^WoX5vb}{f&2llB`CaYMU{d8{YO?BCi>P6B}>`H*DMZZ?hOb;L!qo- zLfW>$G=`#37ndI?tSgJGlt=a>El{1oW9<7!M=7?kZQFZo8MHOAleY!ZXerYX7!{77 zaGNOKJ?2pvxMVi)>^>2^O$93$tQ|)=O<5TPetpMVj7>*(vb;pqbf>gWIV>z(wyrdp-&>w#Ove&Eq#qiVCW$gAI2(sl# z@RuLeF`fEbA_stuJgf52lhv{-M2p0X zRxv+k_6$L%EPL$F1p&^`C~Meikwtb(4UZ8A>A#)(dJhzB8vtF(zo%9@CEBdF9o94XUitvuXl z6O1mxCHIUcI<|ECm~~@0RR;&Ey3lS>Ve%NI*rHLYDjWwg@)K6WkhB$eqeAt17BHSu zq9a!Nn4TAU!`tsfyp09~l*4%aAA_wD^WR!I48|1I1UFS{+Tp0A&)1$DN;zwOu1B7{ zI0M6ztnN}I(+6Zb+Y^PU-ACb}A*mPI_g^JwXD|MQVd`v@ki-T2;3vyaMx30ga7y98jJwXwg-R;8q``|i&Nkp-)@}cz) zOk?ZJU<*3ZACcFX?GS=#vj^mhx+y4yBb0R$MI5c8u61LS<{_&bLHj8xk0rmVDij+Y z4K}`fpHmcl-MI5bIMY?=&{(**Ai{nhq-3qT+;5kP#Cb=`#v6o`lkWm1>x6uPN5To= z1oZj*LXEI|Z+(cj{G`j0(@2Y$^u$NHlN%M{(sIrA20^#fKMI4EoY}o45U2E(aJd&;g920fn!B zgDd!NjDYdmJ=$Bg8+(DN8@`=tt$6HB?0Jk3H~YtUNioY4K%!foET730}hf7xQl`OyETFPmC$(Tg1#-AWN?8Vq!BSff~mD1X?Ny{vBS-xu?iHsp;;Wp_Bs6`K* z$kk*^F0NgDU%>jF0eX%ui_3@~kKLaox~e3tRGjh0(*v~v4~TjU-k}~Xu_vvZB4kX+ zL(CBIiutZE72H(9xA2S&nar(>WQtnlrdd^b#<3^$(YGI!9|x*GXF_NaHAd=Uk}N}A zI*5wK$R*OPFFL!X=h8bhyOZ%2FGs;FCQ+;1^1iO{N=wPyK#acatyUbsyKZc6r4>%O zeU5#nZ+$>Bz`#z+wXv|SkIUd|B_cOFZgis!^oc*vL(Y7WI!NDlY86_Vqu$yZX_)Su zZFR;QVV_}~5!617(P3#db{=9cervqx?-&TWvRM{bnk#dkl*78R+5$27!}_fPW7229 zJvh{`Y^y>wWa&>|!U48NlkMecaL0uYC{ps63)TxBGMS-|YVWYee?f`+-=IXi(PQmN z;Qgz$A`2VEBZZ-Vcn0P`hg&iDP_>_4GG}G2uAm4@211;b$+3k%li*kXFavFSO}LQ`L_5%pNyZNH@$+9b-xaVf zovsm9^b%Tgz7U{LtU3c;7%FrJME(*F6;r z*3-U-Eah~JAG+WV<~!o{iA)hef7?H{vSY|nc2BPh$)TWAlp=mAn}1kLTF=_7y-7KU zKE}rwE1P9{rd~Et_=Nm`P3>Q3uI~1YoSaqrl~Bo*rkU0?IF8J4jm|?oJxzDO9v%TmF`OJB3k-ZvBp4Qy765pl;7|3 z>~X8(IZjaEb!YV*5fK&xdHb!$rCe{5(j_GUiRsIes*S0IbYHpN5hDa9Mh-nT)*;rz zR8Y~HzgHMxNc59;cig)Fi&eAQ6}8M24aqa`~*x zA|n_`p`=t{Yub}k!muO|)Tmh8`90q)1G37}1GM%E8uK6cyZlO}(xEGFg1=CJhhE(W z!%?x8?|}IP`;@)4V&;OHxr)2t#aAVq`=k<9NLolM%e!*cV`$epn|zWDBmnmK%|;<< zuY=^yh)$Sae|gt1|JW#5Naie)DSI@=U{@0R# zFcY4owjHy)#`N#6{>foOjKz}N#K+WvQ8{3o`Q-hWGJH4jzFD}wew-@#eCV%^{d9r) zd={iM%zEp8yRJw~+}#C+Jf9CIe_1L}&a-MY|P`E()l99h+zK*Ouk?S>M=gg5fV2-^)H=9*|Z+b&}c*IGGuuF=(z7 z`ax-(Lm=)W-k^EcEbKENIp8k*BE_Z= zgWj~+|J-?r?p`0h5rkI& z{pj~10)i&%m2Ir6)CQ%)=w61PSugh1?9&BniH+V=hUiR{t)$um8xoP{<|#-S z$EvC`9tSOhmlLM?y#9ICsK(lZUl*$_ej+Jo7^gcHVr@p$A&qP=w>6|;)UF@p<6P`e zd(fFq$X8a}dMqun$Yt%5I-YBvsMJ1PzbCKhfeMF89$0c80=Ifzo+|HIgTQx% z&ZfMQd|6M^Cx67S?)i$&i5oUTQ!kfN_}e#NI}-k{9WitEnCgVh&;ORUknwYJ0Y#RZ zgh!8OZ9co^n=ghOq=#DI+b-UWdLGNGk*fR;9sqdInVcIQ-g6Ri!pX?@hu5`T3(--L z%WtP?$1_EUJwG1uM_J4uV5J`eB$e|5WVd&Qq+dP%i$+=+uH!iZ6aPgcz|+0ja$)`# zjgTwd8+e{!5G|;2;1n`}o-Z1=D^5yGH~I-phTswq4$XU7?&c5u+^fa!Ki7TNrL#B& z8CDq{5qOIAi@E7do5%bU4R^sFChrBYx;zym%ruZ0#nW07T`SOZSHke~q}5`5JKOHQ zOFcm%OWc?A+zrfV@|YwClP+tNd9~;RWGP83J7HPU)2~#6voI-xl^icdUkM|>X{wY5 zcs)r9V_jd|OVe`*0mUO^?;%sdpORcPvR7{YkLO|pt>27-RAo?y*p!dubS2>hl$KZg z?)Qr$j4;@2CtSfebq9X5lXci2Go1G+3;i~VKXOE z@?Io1{caEv4l|V6MJ;ySACN|F$nK3CKa zghG3~bp646uEABse|xJEbzG=|Pp%=;_^AeKQ9FM{roC652tnKyVdQogF%L+=xsvR+ z5H9>IG-r4DLj|Af&na=SfH1KjHeX|I_sz5(jz-eK5zc_^L3j|3_^uhWR1-6zFel#b zNCUBOA%l=MlijTArPN=y4ADJ6`@%AXqD5^laOBR7eI$ z`EvMQQWtxWv_AZw24k8o7m^7zeD{x12!P!M_o0iRzDUrr+FZ{$jFnA^A%xCy4>AtU zpmCYlNS`u$9yxTKvq%@7Wqy89|J77nzt6@jxWs_|NG4bV^Zw(73h{x=Nv@Ai^{g;U+N>>%3$?%_Kt<5rPZ^W~am!0>t&Mv2w;e_8D z0A`Pqf9&z2cv39fF1o%z6$Xq_W&KKxu9N90`!d;W^L?mVpGTTmU?@__a+iK1-Df2z z%FK;bc6qclU!Gh4YL2X;g=ilg%hlSFXTamFfegF10|Bhg@P4n;!@gVIhOzd<0Pe#> z+Q8GU2WE-&9XKyD;pPO*xtK6qz1Y5t)9=uv-6}WfMANX%ZBy+}HC%HHz1Se0UkQaK zAp#!*?Bj#0WC?rPhuCj{us3x(;P!<++|FSYJwnLB#k+NZEhI>_vELliNdUd!EZ!BC z%oZxwP!$~;PGJH$#lW-_%a?zVaFNlxJL|o;@pb1kN|3>c3bod3gy5MchMy0Di}UL} za>(qBmQ?RZ>pvW1lmoj^{Fc_{EvO7qkX4dbid1kNHxL_nydWs&qXgK^i}AA zEML#U6<^`cK7B)VO{xY$aG)cpUt)Z2PzjZ6)6!d&N_0f8$5cpWoEb&nqq3Vn=gj{c zxv^jP_Iy{;R*`eAURW^oX_Sl_f5X+mQ6J8vbUxg%C`V@4xET7C#?m>uysCz4mqv#( zvGd**9dc9U`tYRq-OlIH7D?68s3UN!3CigdOi#_4cyecc`1;4qNh7zdYs?EK&DIrv zyWz2{V;uw$h~vy&* za20v8c4`r8m(Iolh-LXjxbsr7G8(S212Wc)#HVH|)jDFkebP(uB$@`-arRN_IOevN zKw8k`ekyj*@s~P#ssYwW1)*l<%Qqk6yli)WEiUJ)-<2*fOB$S&Yd37 z(6O4RyXB|4*BZ;3PWvo$@!KXq)xH1~^)^IL<{5h8NC}pI7d5M00%Tz4{h4rEcc5xI zTvm+mmUr?bBg(w&O>8=W&b?K}J zbmE6PVB(Lse?{kCG4D62ly0ZYm=g+56Xe`gf~L`%AE^wCepefrX`yPVy7XL!Sf6W~ zgl%Kx7&v{IN&8*}jkrjA#PYwmC_CY5*6VkqK(340a9oSY=X@uU&8aVTF1Q1;2Z#$2 zhUOwCzToq2-;;H64Z^(kVFdT~5f|(~;+A;x$d6Gqk_>VIk=tBrjZ$M_^ zI=Jppzpu5#Ar8GvX1rIjub##q_V!aDubYB1-ID60js1h+1^1EpBb?E5(yv5ExP>kZ zT7mY%naRHwlu#7JLRou$qo~6!DLvU?bygA4Ab7K1hP7l*|BfQ~R}~2WtD?5oa!*-7 zBHg_V*!!?1L%rA7i8Y1)sv<7m8ScG0J3eZ*zf}=y%-^brBsCacP!jea$`-pfA+C3m z)~b@h2pAQ)tx!Uv&ye?OW6i4vGk(Ae0`A8vNo}mUs}?4IM&+NJRZOU`;kzN>gzk7qJ zMa9QImXh1{nybi6Tf2=1uxwS_P;s4N2Z#VGgQlKrgt)Te%(f$lS4m$;+ z#B~pyaV>izz2MBhehMA>cg<>(!(G*eBuux>ohk4nG1W#`{W;8eUJjpnO6UBP@#5K@ zreW;X5_~v3V^ZD?s{%wW-sVD+1Z6u@eWUc#>gR-qBL5TCD4}Il{9iPL7XN}Gsl*o+ zr3JP28R6x8tdM?Y5*gy!!ssGtqLg0|*+;B|J&0TgU`qrQb4nrFApK=5P$J6p2cN8&Ih$9;v4&BH|b7ONd5@B;l) z?^O?`J?L8b$8Q$i?H~u2j8bWQoB2&FOD;sajv*!pS|`49*ipfMHSoe)(upHDx;E1O;4ik<$reiUQcfD1lPCzJ4R zY{+MI*LN@-B-Hlh06O*cbiUjOH2-)!*T+#{*HNl??)vchRe)gp)>y8lfnU1FL3<^R zB;TfwMN1-+{)D{K`BG%F-D30g=H&9R$#ETT5pb>46q9dCOOjIfCk&@EJAxxR%w!A% zaaL@B^o*DdibGPlj(b9CMb=F)%8;$y`ZqoZKmA5p7@5YwH*QE?Bu9-YqEErs&t;!A zdQN*%f36%i3{Ui&g0zr5smR?8%i9|{vXwLw>Ffe*UW?DoH&QuHDUvzc23*Tn%b}^2 zwdJ)nS}(+M5VrI)EZ4+alJ@J~#duo~eJXUg`*S~ML{3$^}CNjNUJ$YjhJGC z7&!Ogq9WUZGdp&Uwb)|wmta8T?85sR?a9XdA4-`gCUO^$O6dZGnKn=uR2aun&ljs* z{F&#aKiJ&lkuBd^C$hoBNm0FGiy@PvZACR+qOSCN3r-hlb9q2}60?VSXtPk~DQ;lbeClelzw$C?*IcLerK`hw)L z%6r?)G_#mf?2{-|!uP7!W2E%6pCidZEb66ynXgtg9U$}N7K+uf*LhMc|CjkHVV0=U zwIu;Eno{WU*yswlzcXx73}HvqgLl`zLS!JOGfln^#s;z|Zh;Mmq=-V3_j%aP*VR9O zyJ+FOBed(l%{Wp6karxO#wg+f8uan^e#dB48Qi2$-4Za9E+?xtdm;ATW>i9e!2_n2 z=sd1Jy-~j-KBg?9Cb%&EoSE*q3z^&#^H(v&7j4+(`*0l5Sdq>C^mKl|bhZvlGj^an z;L1ALl*5#~<+3wpz+IQud|3s~Jm_oi$ve6LVVcFBe(qKqquU_S4p{Ibddma^iZzc1>OQXA^N#^6*4n56{vh=)U$=b5Mgl}4gH?$h?fC8J<9jU zw<}IaZAeixN$xR|1UhW%GU}K&+jJ&x8Q!ur{p`@)E{!_)QVhRAfzUerU19Urw!|gv zx3myiMu?kokrdQy@L-Zt%Hek*^mNqhAbAf_P1shM-^s$wF2YmH>T3IJZRXE0tn4|F z-bJ?dmxC{IKN78tTlKQV_LT;Hpk7Bdz=(-Y;~~&%@!I`YdV*3JgG+jT>v;mF zZenoleyJLHday21{yG)iV1Ud|mVWkBHL!~U^W%<2`QF5`aH@uFSq^0EQwf)SpD7tr ziOQWLT}e2U;4&;M*trFK4nhQ3DB2*@@jFD&eC6LPVq5l}%VG0_YPDqqWyf%HZYNc# zNv^ezU|9)fwfWRyQ~~P!cQ)i96f)!J`;laKa6wTZUq%=Vhv2ZW6*1%WH@ED%$PXfG)zKNd+$Z)!|#5kRDa` zd=ed8`kWdwAQ?+eOEm&0e91JKd+jc;WOiT`6VejYrguPUMx)Y@Tc1nxb@mrUh}jA| zrNXjf>by>uu=nr5A&nF|xh}t{tne{YcDK@$x)4oEB~zi;@qCgeaWG#7-}&9%4-~P( z1o?qFLr+x;`Y9xuQyd!vrlZvdejIerjj0g5D%k4XnHki;1|G`|FHuXi_TB~&p0yuy zV6!gXdwLiOpX+qu4~&x~34>|(boq$RA*8h$SZt@?2Ml!7*x>AojLPiy*+?kRKk(xW zRB4HQ8G)IoZW*=ex@LUla+q=n^5Q9>h#ls4zG{z9i%(W3RN+cvrHtPi@#h-AM z+;ul?4w#7@u)gJ$w?TYd&DjCibkFv4(f}%#a(O~A=;#|5GRre64N@&C8`0zl%sKb6 z1#E_>7!xikbau%){{-N>K#EgUV~4F*=LnC)Df*NSC{YLlC(3j(@m(z!=(u(YxYWct}QjO zbf?p`{)}vKAe;=OQa&gL78JY)NUKJW1O?I+O5!?reutQ6`YO?dz8$8CYj{0KZF%P; zVmUrGsmmK!ZxC|qk!HkKNM4n5?gpTYEzC=BI6L*JzJtw0C^X)@W%51mK(qLSKLhGn z25yE36-m;s%jA=@Uc%S`_F5`_ZAQmuZ7s$W%){UzUJ8qf7E=OQdD8A92@7%zige1w zX;PjIUJ6y%V+1JRvNja4SgBIv?Ut4WB~RMwiUZ$<|u zAY&TnvJ8D$3ap`mth5dFYKw-6Cs)S5$&jS8!uu>dHjw0bxe&&| z1kUTwZH2-%#ASv;v}I~I`w%HyhDt@LpFq8ppi`sIP&^QAr5we*g>I#6#eH|$m0oX) zl||TD6C`}^&K-EWj#J!Z#&O8T`}Eb|{^`W_RAmM87O8!?MKqBMXx;zvv-a-p?JQ%< zKuusXme)Z`hW6n4n@6zhflt)sQmw0*0epv=p{T8Vkt^xslnIQ*Y;h@i%piHZGa_&XWRO)Em46J|z^e{m zHk7{#k=~Hg=t0_ec|D%|nWgQo&>a0eolGPne_BvBGRIviu`cUjL1EJu zEinhpgMQ+;36y_jEJC~MF~@r7tCI~dxEG?48+5viYk|yHe;PHz*wD0uRxKaFSe+ z2DCDZ*$0LGF0jWb9}?eW*P`MkkTPL?@QW5q@-!kPH-^HuHbesShm0T zmNI@TwIs(?XbV-6p5+6b0$n=;=V_kZxfMh97hf37ofvP_goD8N^o<(wwQg4CE#egNPeEY7wK2y6#xinLM4$V|&!spqUc$|nFiHkW z3z)ckId@Iu6=plQPLRl(7+bsPfko6Va&($Ni7KTQFz$2(H-OSbu7|A$Ip0YfZqtf? z$}7<3Nn$V~C+f=cqm+~`>)9exjCzAsM%>dCI`0auC`$BGq#O&ml{}-A@(cQSPiDZY5^TN>QvGW9U=hT`4dQjH?>1jI@zfC zjOW?5DqJ6Rv@isrP>OlFTOW5|1V8bV2l6H|F#5)HT@t^Kw=8!A1B)y-3s;Sw{_7WC zZsrb6x?~MG+U-^FJXs#Ebeexs?mvQuy0%{!fWsYL#2Bo{uG7bwax|4%6!0hGxC*t2 z)(88?2es;AGfNe2Q`@~zO7!6h%TTCiqeHpzFayV9?3Hv>>s7~~BcSw#Cso9!Og4pP zkDuJs$3|`8Vxv4?7cHgfgPYv+OA#`e5x z1cqd$^HPvyr5g%cVgJ1f1i(incKvyturnBB6M6B~k_Ahi-K5;Vicr*W!(0sbB3fA#=X0q(Z_PYhg z{&JSj6!u4IR|DQ*MZGbMfCnBfx#Mx&_G(HiM*`H8IxHzXE2_)Mv_jB2*K9mDq~jw* zXxTmkf9w(KnJgj8M$pzwhDbK))eaQ>~u&;diA1HrCfC?Dge>tZ@*oe=gcUX}hc*Xye@jJUnmU1r94=Ixw62EO@ z7B-nAt+F#B-%XQz&ie_Ss!SqZnDRGE{REnwu8@DNYe2fM6au1&6$}n^w=?Xh&fp#D z_e`ZT69x>JZj2E|V$`9MY|w0wY8)qfT)39kgu>6VLg2B0MNI4y#|Pfgj9ik$<$Cs5S7^%1{i?5M?9=4F;_4tcH!!cU0qS!@2L@$C5WP#4|11YoE(`(BvzWF zV_~VY4Y4nY7e*jtUUM+c?aKt-Hn|uuY|D#}dnq5H zsp6o@m8xhJvtN156f0x=2~oG&XRzrv*3aA6fAf~7@+6HFem`{v)>;&>^1xNFk;CzR zTVF!9DMAI*M=-QJJ*JtXi8<*gEiZ;QHyW>4E~EGXM`*HTP}f*JUfQT5ond?3rQ-U1 zL1A^*i7@OwV{C6=0ry9T?8))};DOaCP#sS1Q`PZh&Pzv(LzZZA?iYP(v3}iW1boT0 ztr66C@(s?h;3lc`4ZFl^xHhB}^M)N-kgBo~0vpA!j%Ic_q+ ziP4B;^_sHMhHl>2f9>)IC3|npT`S6FG{iATcwZ`}OYF3a|JHLAWQJoEq6D*QOjq#+Ld-+0+V2 zc<9Q|o(;nqd6^q^vb72qmaxT*AN!4cb%AUwVt5eokvDxAzPDs&(8>F1O;e)&Dx4IVt)t{cm}YTGh+9=@ZBQly!CWTbp`$Mv_-+J(KQA_c05nVXZ4A^g|Jp{jh0$T={_=IbAQ+0*VmmF9*tVmdEU_PK9|2mP_ii6m+do}iC-k@6x`ORw& zbj*_?v-=>X3ThSgvT;68;Jq*S4_Yz&S=80KD#6cf<`yoWNglt*%f&dcOvVe4kN#6> zf*Y@92jISbqg)fK4}NoBtqA>6f3{QLz(l5JoApQ|&B#Q8htQ>G>zLWw`&D*}%tQ)J zX6?1OF-O2wprI-7j-~>gAc<9~hapkpUqH(zp68R$9`^-FIp;eh8<^rz(Jgd;S%N?c zdR=5_eE9V*)6zZU{_ya&uEk&1)ZT%5JMqjHSJ1<^kv@mPD;8sa13Z=WUarLriwDKt zEIaXt(Yr7{@F-}(K>5O#Jve^n6{ZzE-^5z6q(CL(VzS*wDZ%EYPwZh85OI)>D}3<^KF8i1VbWf=dp&sAOTyEGBO>xC?bI<>gT6I) z*HJzq!YwVyeddL>8@*mI>=Nm4kLZQQiC&fE4!0*sr`AM9x0x|V#KklgN={o2LjIzn zwy;E`C!&O1gm@^oHqy4Oi*5F)a=X3tY7@E#YSc7p-*Cl%Pr2LqaIS6GGw2K%ybcT= za*cc$@P?9%fb8rPR`Ah`0LWTwb&XR1_$3YizbxQK&jO}wst7n#5%DS^V*o*B+IfFA z!}u8WB7B=65_roW7^mT)T*esxdo_%IwEBN*9gjDF;}${r$ElT#peu4^peq1Im%6uQ z6~W4quaKh`!2D7|*#tOWzx-ntLD$#SdF=taHUXV<2GCcz0DTwMvT)S)eg(Ygzs_on z%j;S=N?-S1=T&O~l>K*7TV6t>FA`CT_P-Kwe+cd+#H^O(?4CfSR6>$F}NYc1CG^ z0aX_w)z}%~_XG4UGhBe?)imdHu=Y)V0a~^EzgAsfc|GC8;T7j4B;*x;Km^P(bqV+c z0NP$%ysrGaQm(-7N;#I0t84%joqgk9j3;JC!KNOSW#!h}%SRWKgb&Z#*5RqN(nDf| zmvr3_5^cVY`ytr?Gk~OVaTY-_!x&0ODQC74>?h|?#vx~HIt}PDQ=pgGM}e|iC%{6M zyx2S<}Mc~u1sbeGiv({89F~ToYLb(Rm^UmOM>c_E$7r z{C}G~32zN^t$Mx$)HDXj54zc>R)@)>r!}TU-?!Sy`u|NTm19K@&ir=#JL@gDC12{8 zDE4>qe(LzdeZk5^m(qA|y0{(9llS4XTIS2?e#b`;J@Lu_wIu)iFVlRGQrNtOqjR(`OGIOhvr?*ZsZ28(QwhhF#oh}kEfT%m{L`{B{=?#O^4cF-vq1Y%q$VMCNS9q4ks~abh$#>e&gM2A}WN0M3RZ_5*7ZB!zVd5|SyP?p7dE%R(ugKEtfu z8<;n|1HU*)_T4aU2H-2%)k;_FYPl31BQ(}1Wg5=CLx|236D*udKB9f@m9m}Kc|^VK zy^9U}qr^R@yHzP)U%*-Js+a)WHDNEZKMoV-%$Q=i3?DxyRrDbn7b#) z7y0{Ld5Nz!!?4oc|0VK!znt-Z-5*?CeO&F#4)kGOL3WeVKIrhGGkL)}1@K45c;JW@ zNF=`iY}r4niV`lam!Fd&T_0+-`kDEoGE|a}Yf~kNkoqWetC0vG+#lMtkDMyf)l3@) z+Eh^C>~*|`Tl{^bk1q8Oja$V(ASTAzeUiH+V4E17hpTsD?zf6o9B#96a^qQRHu2+4 z((;^(-qnYS!5d!Qw}wix0}k=slzd~D;1DdsNWF(;-?Me`$yNA64xzZyL^YV0vZqw7 z$!??H5>2FA=39Hql}Sor*&Kv-jV>9y>wczhmd;Hgp|>yHB}DTgy^898zQBT=A-EXbDBD7*i)*CwR-7|Ncm0I~^Cdyw*oeg_WnSAZ2X4v+eHA_Qv{PZdm zzU1Sj{Hzg6KO7OIfJsIl@6&lyGl@RD5hf>17>{9qxSSBH#VlnhwI~G+t24-kNJ5NklyruXLuW}jg1BD`M90JOg*msoR0l^u+gll zxvBNT_nFZB;H?9MI{E$PoeIzcrj%IGU(izTIe&S~$%EG)Y}x7cHil_ag(RPJTf6_+ zo*Th;rC(ouQ;#tjE66Gz%nYs58+cm`Wx>SZuR8nDK+9PtI{6* z>Q=g3<#swgH_xisakgHq(Lo=|^kjZyX&c5t`T!%gwO`_m{$6C;7xqkIK*(vWc@a3qTv#` zZ|-U+7G>NHv*r~%N?)K$hv*$6rWSJzobA^eIv<|pw3DFyj!ISjW+C7%6);UOE~B2U zV#nSb_nl)Yw1|{bye%-}eMZTI?QW$?KG9=v78S}Ink)x|laSus1kw_tNuHXFZwU9+ z%lWa_zUVmP0FAo&T~gL>tiTQGZV0WOu(Cd%5;^cRTp|sNS!M&33Mr!;)RH;z0)E2)+Gbv}^ciZs<7^zs{Eq zJ;C>3mUGRQZpv`Pj{;uYx5-dYR2A$|VOa~6wah&j)n)57Xz3AT>w&a; zo(A!L9#`j4y9d=nrx8*skdXZb!2UABmmI^R5BkE0OmOx4KbGTqYZAm#@V28^v^9 zBtiC+4q`xk^zide|BnlXr%!W*{D8!US2^H?2AKY6~sZt=ROnfvYRLLZSHrb{MHJg>mgOv$taMphS80aK}prTz_{43woe5+A70-sdS z@PGoh*`G%_Q9Q7S6}=$nB4I*RuX9;fSR;5;f~p8@!Ylf5UQ{Fj*5e8pH9NDZ-x<0$ zT(R=}@fdf`R#DYIgWX$PV_TOs#EK7oJ7+|=SBP73_Xcv%n`t8E?FN3@)OQ%RZ@n`m z>YoI!=@f6mpW`)jO&DSQP`2$qOweX>8B{-OLb>Ig00&WnQXwE>PIa4`{vF6;r3F%$ z#!Dg3UA|nbaRuQIfqH9wX`!1_xpGAJ>!Q&q65mTMVn`n@tkwZA;@7kGpZ_&~$vI_| zY76kcq<(b+{4f08Ik!1y;rrEUdwCq?h?rkMGUQ<-DSq}y5~yssjS?SY(gsf8IQUJo zgcrS^&SgQk;@#1OZ|L_j?l^aU@+C;B?G^)i2@jKeBEQcdtu9T9L3+l~SCA0EyHcQP zsMjcqR16=L8?YFxT_rhI^4KL}-1}8WpR$N9@4&^;rsIdTU4v}u3n^DL3KMK(@~9VD z>$#)PB~XX-b9q5IPp4a=W2jV=dL8)9A51!WqLT;hz-O56O7}% z7PiLE)FG(SsG~@6Q6Z;-!vUcKUSd0jk%X15O&6|mTg73v)PH=g6J7)uG z)?VBMD);05H$xjR0QZZ$$D`=%K)C4L=qk$*#Zc_Cp&la>i5X6fZCCN939A3UM^+l` z$lUfn#1W5_7->cANAX-a@n1$wRsO(AEqw(8Vnl6$5S*ZWl+6f^fUz#X*N`|d%69!t~1`Dht4RTT%hs4nu z8dvUDxfu~uW2+#KESGbjmnT8k*<9Q|PgrH8)ifA`D(8dCf>$6I3{V$czJkhhr$O_I35Pea(|+YLX_wJACs(upeqc{yQ6JTU z3{McEPLVeu{mDR1cy=3vzvmtbBx38%U{AOz^0(XtE-npesUA)8g3^L!_hP=%rV+yC zZvr{wex4&U$N32fvKk99I&%ngRT91PFs*DDuXq0gby@*0#?$zFA z?)z87oa?$*xkovkCmM;J8fa+hAR4v@M4G-|cIyf`qWcv)5qw=R!>Bcwd0OCfMW)t3 zzDfg7h70%i^VYdpDOhARGsh(S8B?aCqy>_F!+$J=iCA(a>Shz8q{a+O)gl&NNb_FR zUwT%DDCV)PBxiOqT;S7I8M9RF>*9g8GAY`Wd6{mc-2OXH6vZ3<;TBZeq<@-4dd+Li^}_ON-E}|BF(srr`GJC?(t*%D z57y&JnewO_&fVw&HZez6|IJKE&tmPD3Lrb?OQhnmdxvyW`ftOPns zK$E@7fxi=CuTAMuF%eVhY^#qJ$y5`$9M&y*W;aVCm#62(q7ku`C#Xf~w&L!3$CibK zXPq4%vGwDywbjOHV@yD*OQB`F?^NStR#(Dw`aDYk3XEAXX#om!I%7pUp?65eEA-!O zdr6cz-EndW6}_JsP5Tnc94EEccZ!hPT(+r~=Za+f{;yG+ImdgEA0eeT7I?=puGCgO zi?zK=F^275x5Moi3D@zBWnQ(mbR=at;P`ht_R^RsmgxlT+<7~b*eGy?e7>(~;aNPs zRbO?TBahW)r%!~g&tPc=D0E?={3};93FPo%k{pY1AAySDh%6LC0ClICtIT zA2l^$)f(r&*upZLX9N66_LAd~!nhE0)jXTu^v{(x&csrK(Qqi0Ey)B*nQD2cXo2oq z`ndhyuTPxJ^LJfr;Jg&>?4?b`q1i8!zz@q`H0eFuCc8L)VXr((i`QL>gjvH!@; z;&Y6mU?f%w#gl|=X;^DWlM5x+Gn~NgS*2J9Do$9d`y_M4*!_Dc0HdS~g`9gZvMO?M zx(uB~`>};rJ%Js>i_$fV%*dE~WsS4tgMp*;+K<3WbSo{kA6)u@5DN5J6e$QF?!s#Yfon_1%z3x;@wVLk;0q1TMKS>PyUObR``;KGwYiZ zNFc__BVFbpZ_dE8GhC-jhlW~A$#;}l3U=2|J*Q_Sh6i-L{AK^n&K}`Z-K>ho9qSD( z$6zch(06z%8&y11sdog0-I=EYg4Jh_CLEcLp(j9>N@v!x)H`oVW5LX!lxm5 z@!2V$fYSvN)EdwfdA}}B&E#X(%Z;+`*vPGh%{5c_nKm6Q%C{YKo45ejuus`wFMATIpPrfv5FI(5iyQF`rNW~1u)-f#tuCg{`eaaymNq`#5=0#6`R9D}2g~@32+QRq( zHFU0U~?VsqBAFm9Q{Ny{+Ct(3RUQ#IqfBI=Oi?W%BIP~)17iUaqWA7dAvL)>l&FTxbM z{|H)-xa?;nE*epJb!bRDF=kD-NkEc!@$;Z>n}7c_REI9ayt_&b>Vf?opr%W$At3th ziPNevc$gUqUSTm@Ea~XEBa8)Q{?r`mF6NWcKmaCu#VDW{I<}XFD?4O+D(Hj{k@3SS zi$9T%tTM_&8k#4hU#0dMyCamZ`O=Y_(pS2;8!7`;+AJONJeewV!R3keklv0pDnQ|E z>^|`mZ_n_LY8G1v(y`b*;A_fNlsHaY{s_t*qVm$RDtU;m`*X!?(w`+$F0j6M0n(B2 z(LA^<^NK`{`qB^WMDHk$wdwcc*A5_J=f7|xS8*aZST>K(f|b|g`d;*KZtI!TL79hw zAecfN{)$8|JY#f45i`#gSW@ET^d#W6J&7oJSM7rpe<20F-tl0?u$*6V<=6rA+H&_B zqa(@gKD5MJH@4+(m~#!TbE>*BWOY-&WFeJC@+!eEwaeYeW`w(kvnqHgTBMI=+D%)~ z5~*HYNdWvs6`$!9V7wJBO&$H?sr#*t4dTl2l)q$Ah?!rRAjEeQ7Zq#V@gs)RjNUe+ zR1uI_x{-{hbHo7!z+X7}dSg8~EVQ1(D;ge7+W`10CsP+0WGy&yUl_MT2p?IP2%j-j zt4ar^$qHm@1+&w>@N_H?k z8E5l4;I$P=U<8j6C(Dl}(>@Z=SueuK$U$aK5-$oB2>A2)3s{d6tIPtgs6?nJRR&VD$izOtcrPWRq#5Kc(e-S&`Z;z8P#i(0O2cLze&RkZK zc|gf%&2FUajda^2vkVMbe4{KDvK=HpfJJDPwn>2b?F~^t{Gc?)8Z>D3J=WuAS&Rn!iwGc{+G|i4+#psS7Sl6?GTIgh(^XC*8>PI0p zoxhet0P-&w%wPBUz>0WXfw({EpY4fCalj!jLQ!YU^~?(P?fb~Wlu~gi@jTwEi`IJ|{sGxAcC^|pejeACBG%E8&0C3K zVMndWkyvq4ipQV%LnR4I!L~*o2gBZTDj_cw*-#q;eGkk#voXvD#@r(GsANnLR$iiK zC{&h2vX}R4aR%-zWyygoi4Wp5i@EEQISMJbky|h!I0-<%CbIgz(XT)hOc;wb*nB_2 zwAX(jk6Vtgs{=LPs(R{>2D!1*2eaXg+%bg;jHy;!vYWgsRAuZoF05mg;qN zDo7O4jk@@#gxBTEiJ&xiA%!$AHoYjSR~`K+lA#p~bopZ)Df=V;z-JOLy z!;Cur3x`;hI!F%TT-lid^~=A{t4)T?`r8_n&W={pr9|Sd2f9jWlR7}4#L2_0#8#QN5wA6Ij0ZYrTu~nn%Ut`$Gc*}ggWTnU7?3ZY! zvK{m4_N--_2_}tTpRlxqD!j2Tai}z77xtAo0@J`u$xIF({H{IXC?MVoUE+>qt4S#? z$4g^;EboBc@lKWRjXYv2JMF*z#EmWZFAD*^R4m8|O72yevcWKNmR|8i)x5`W`b|Al z-A<*v?!+Y9gc<^%{63SQYR_tbWKxq1M;c5)(cC=Tr|Tdj`Xghutf4^=;O%FURN1E* zNuR@VzRRPE9O6p6s5dU?lMq|i7vmAVJCK2zFBGE8EQMad`h84ez*u!HQ*By>PtK0> zy<>6wt8^n?91WbAAwJ7?s1D!Y@NnI(9BB`{oPv>tz)(_=4y~#F+sYtJQ+rxZFG`M5 zzw$g0p1xlLgrm*!o2KyDD%7*H`La;Hs5<&6a84U(L(C~)S?lS?QTE^UjrzXGP0hc?Ji?`>vtLDoN-?x6eAmaZ^}BnU6IOsX%}5Bc6cZ!b z$O<8Qd=?T)43WVS+#T z-2I8gqVj8a8)Q%Z#moXF*<)7>8=^Wj!ZepO>f~D2PJ6u?*Tc6BUwCZV=JyepvOYV^ zl;aIFi9uv8|3N~+$C6`b%G zO@>L_QY)E;aKsTBFh*2|`=OlKA2}Vj**cb>)B1zpwLnJ*tYLl#PZ=2VKjN8U{0NdU zDr)tJf@6-4H!%JAGY%(jwJVgdkZ%Y})y>_lp?lefaBi>L3LN1YvietF&0D;2(y^i* zWmNIn*K}H1m#rs4u3&c16--Y_1XZ!9l2`Q7f9}_TDOC~hxBHcPaKpOJV;h)gW!ux| z>7Bxtqig_Ot?mGWnYY6mdPT4t42z)14!Q2<#oLgplB&#cDBXg6M0?erX-8eC@eP0J zS!EkiAa|pVH|0x$RsZ0T9N4^!qV$~VYb2?&b(|cx6fb#h)ZJ)kiEN|)IYHX8<9qGT z6FoFOLT1EMc%(D9s1!UjG=u!5l`BLpyYpf775Sc{Ah{JZl9}+s{rcIb?Yuu8Valt( zzkB9h(x!x>wR}yidMAJ`Aw@o%!n~2MpnPw1+Lq}@-Dh6Z=yxc^RrPWOVc_F4X0JF5 z9)7lM0iv}tm`s%HN86XQl^uI)T>GC|cRV8v9rg#B{FHTC1OgL3n?Xok*`hS-C(OA8 zh;!zUzJTOQ=+ulX;Np*u)_pl(*#@$Qs!TDYj0{#!*~&XkY2Jyj%KI*;z?zXIrEDDg zv_~}zYD3mtMfkW%?X7zAO#=I*n(TR2bW5~4!GFZiEBIpDdLx(4oRO=s!joLef4%PM z^H`A!MgKYTguDEa#xXQ*dQt0RhNxSAM*O`XJoE@5THo|91A$;pH&JAqbmcw$H`_Ht z0NI#n%2s}BI_iX(5sPSO`e zj~$nhP!j%UkL^Pjb$_9E8ls++qB7 zT)VxR6TV&FBVGvGJU#<1V85T7OvGopj0l-JHq$;!NrK}T!&BSD4i%wX-dL5~^OTOMh?;NHz;LJ*%PG$#?2Ia-1n zJt<-`n6nzRKw;U2yfT8+J!f3;I~$7kC0qOPP6V%8?t;^GaL!z#!e0OkC5_7qTWDr* zPaE7c*JvNtFFpf;{apgQcA|mB3%j_)AZQA;y(w-usY5=D$3=X!m0&;+8eeF3JAoAA zjU~x|NW6QPlc@73?aV2XAdM)7Anyw$Z_Q~gCae#gqkQu*e*Mg?Uy30=p`|~>rvpon zSfx>jmfG+3S6YjefS11sn(133wxaz#6jAZg}2f z9E^ArpsEC9Ba@t1p^lhj4%}s~zV_{{L+dc$?%%ZB318dh*dJ^$@B1pkY~ zD1H^mU78^pEVzbB{zL^Ne#da?HfwY;*}&pry*tyFxPn{zF71%i^-9z@zg;(>5nYE7 zX}a`9XsvO?<+}IlgMTUmMOvjNKqibl2EN{H)_ab+>+QTOz^gD84C4C+`J><=fdM?E z=zrM~X11r0?`+9Z`Z(ER86Pjd)%Mx{WlNeI|Nq$%`uh0=`>Qu6=IT}4_v)iMS2YX{ zrxa%!nBkKxjUmGnF@+-vR$W%RyeIU}Y>U?}JHPZ9)@9$kN?HTd+pWyC3&TXQW7=a9 z->VI&9fE^$<){(jgmz<(42C~%r^>eT<{9a_FL?Okp0bnDP4Y{eg(*U{X)wivy! zA`rj%Brz`Wv7XWNI#)HIVR%%%Lf7i6I`T0+kVOX5bRE9O{n)=atZYp+%gycfT&{+D zPzVt)xOlM??08{6;)O=bns-!6kdNu%^m&SHEw$6d585#x{FwomZX^T70(G<@tGb=i zxWQq*HK#H9`sqL)=VyYdH`&B8PlX;wQ?uez>oLwuI@(yqFfoMuAGnqxDq+M1A&rR| z)OU-fqSL@(=37NH&mnm};M+r5`U0Y}d_jU}fn1rY&{#!eXA11ONt6{mvUW-Ik87SH zv>e-5{u=^cYgkkmUfC|h-ApnCJ$mBU552JaFR7WtVLo{SYFe#EJldhqLUK|w*o;x= z#JDJrMq`CnWI9nn6jAo0i`8rd|E)VOyeh?vg(&r==E2ew< zIx1#Jn`vhakt9&WOZ-To@+fHTW;J7{U?=H4IyLkhTy%`YDd7S3njB-;_2WIVe_5QU z%}M;r!B%VxJ9Z>$Si{6D#QX_AL56u6tbNCl6Bjt@*E2PYioFE}NxuWG{g(~><%CU) z(9Ida;y%Nox^WtBnpf{rDm-|uF1*)QuG&6K)ox~?hf%GMZxBrD8iAIK=v8l0Y*OSs z>kr9DyFy+(Jo4M)X0Qm!s|Ab+0;)BorE4}nXv7ZL! z>s`Bco>OJ>^u=U9;lET#0qYKuAz!^mI0N0b%pKfGXW!gok@F zP=kp-KQI3etD;A`9$&q9maFD*H~KVMw1Hzc>b#4x6xa>;OU_p(d;w6&=g3SBA|*2J zdq(~NakF2lGBN-MOe?~B|I>Iiq57WJggW`pX`t)|(R11xEMb+5(UV2jt(a)dLyoag zh;7+bd#}Btu@|>?zt^4&RT()K#PU-FftLeag5mJN&?$}kKbhrM1d`khOMh@Zr&S7t zn3Bv|5YFtp#4<>bKw;R;_5HAj%pJ#Hxukrt)DZXD!F!G+qheXGg@c(4CxQ7Bg|SLaDGJ#Ilm z*G7@^aG~3giX3XV=mE*5R2h6$#_!W3K$c{-*QZ26M5(JGv&+EelxA?U1L1EU<frir zs>J49d$_E1WyN){sh55jdUp#`>1E44$SVlso7=fUjURwo>%6S4Caj0LANv@?I@Qd+~L*k^L5CLI2YkO(Dq`d!LGsiDJGuSR*th|{J9r`w+zD|rrdJg6|D zZ`gyqlv3?h!ZCk4VAWjKAb}e)vUqrJNK6=+W8U{~+&gAE<3i^KxM`=l>b>OTj}urD614*zYvb*)vMdJiG4n2*Bim^+kd zT+2>TE1Usq!wNq070S6jH{D-9l2gsZ(E!y*XW>39Rl@r+qN&YHtJ^NQsK2qyrl?yE zh?-2V=&#I>60cbI!qrYj)~QlLDAY{r@LA-cr_+c`U_ESwP|_oImD8Z3Yy{TsB@BJ$ z0C!DVhXJk2G0RKNAqZ+v2=(wy6^hz>RZg53xQAR$%WR$o{|0;=4AJQ7#$Os*RGxTx z-yB0bI#kOIXem;N4+dkM4D!7PMfq1wv|#=fzYmMtL3nYlg_}nh&mVwsh=c3G zI2?|+67;U|Nm2+SuC91KNyQh3ut;dpOr9mir)d=W!1&gIBm^T=M}%XW7wC)OR*>J} z%_Rb0o26V?tv+SXCeVf<2X#cM&%efk33h~NIBQo+f>I!^NBjO$z>HbF_J|;6{nURv zokf;%Amc67&_!9R0XyAul_H7kBN zT-2uK!=`+*cyY4Z}t2PN~t~A z_)d)=JW04z?H{_1e*QlM><)c>OH3TSyTXN(sWos?GA6>WyoO5#iSBWQ8-F7wC%)JE z0>1ZSZ8}-DFJ5L9jG=RP@+`T)kls-ujVltI{9lzvQH)~Ga2_zWLPjX%gZwfg9X{+|JMd!1Eo9x+DNIWgA_m75xy z_&q=eL}*B5TR{ru8(bf??wuU5V2m+JU!337tZwd~K|FIrdN@{8;-{pJ5_S_7P7=Sa z7;AdGh)roUzb3N2&Z4FwZMJ z$Jf?h+?TD=M2vkW94Zmq+S8@22@Gwz-<2Aqs$1wb)GtCgB9g@D6QwNsO45I+y5lK0 zrLmG-kmCMTlv;N?h1qDjMGSjUJ#Vvm>^1}c*qFTc`+D;;X0BX74IwgxK9Z6oNlw}C zaT$v<7So+G*Z5q(GDW6`%%5&1wZO`c_OpO)tZ#`RwU~E@=tYm@t$p^VIn~X{ipRo& zBKhN*rG}(-PrSqk7i}a2|Ew@j8;{|Xk8W2t-idE^dS~GIab-WpZuH^sVf}b|(b~M} zrl&UG5b;KW%$;H#U%R<7sN?UH{R^>MLGu!p${mZ%-uzxf0LdC_&klUBbsZZsN(b{o z2X^@8-+5_=O4Zi7;4yrO1{R2&UgRe9_$B`S*%p3+E#k#SUtJ9W!kO>k-g@X|WG7%! zEO`K_r#I*6Hkm*)6Kei_ITXm$0wP+Yc%%AwpqHealz6?9@x2ixo=k zp|}@Plwv*pu%Rg;LXL}u@)g?7mNgXo;h9N?{5kImt`CKsku3Kwxdj5i<*|cLu8&9% zmU!t`@TjM1bS}h#KM8aa3#e$PJ0h1BjqR9mi~2CNKbqSr{MMIv*9Xubuxj@kYy>tk zfG~g26;Wm3P<0E{>Shm)43*jC-@0r!t|#||i%A240AYUcUAz{|qweNRgdfNxvMaLr z!ykQ$?49U~f@d~6#IuJX(NMkwPw4Csy`^ke8l;RoTXt0f&nmAXruNVjlClkLA(h`p zf7&trYQtySq@0q~5hJ;q=N&`Nr0c8q<{A7rgm`oma!6-Y!SRG_1c4eXmM|1&(i*W& zQ1J9z$%8Lj>t(_cz(zBv!QfZsf_?q>~=HDQIdwP>sO^y#$Y6S)5^ zi=%Ukjww6Y*?b0=Ja5dW-T1w-B)OpyXJ`( zajuq?%Uz>^>kbkPV^ZE*Lg@``ydi||f@1()iIU4|{-E07?~K)ywPa4lhbPx;Ma*QR zRf>DXGk*7hPN@@()RPT%5TdZwV?TepF&7s>oEj z&q!qeO3<0Ye9tbI_i<4gsc%NqmnCy5Mp7hEl|Q4~J7C3=WbQrVS2;SK)dFTY^S1zY zi{BWL9jVjm`ac0IwS~R0#sp8|+)>-JM`Pw&04rbk9r&E)sYOiPX4JF_4z*Ue-@>Zj zI2_eAsGbfh6H}r=F6%Q|NWGIY=Mpm(-AvWPK$v}cthu8f6iEN0-t>i2)&q?adfOw` zeGbxF?&nAR{Y7rcldVlR9ca@&-4TKQW&YmyS_vw-pEs6XA<9w!S0)}4;>KzRutP1& zeT{~gYJ9||fswceiPgfN5|?W^`^wQX&QspH5WbBPQ zS-O_^(!7sOMK&n9=*1ZirrHGqPqh3#huO~s`1y*o_vRL}iT+fE>1F@`mSwZ)B}$|F z%i)v*i#U)`N4>+?bCPX+Hodb5$JFcno(Y-L<9$WM5M*Xu_hIrqr*p`=vYU1eH%0P= zI-2;o5#QE=2E*@Zj&1=z>*#4}g&UZ85lo6%|r!yAG zSLbxh@p7rO4cg}$0BiATBy%iCnr!(G0BbAd{RY6iHnIN?086qrGS*SZ$*4U{Xf5{3 zV2%`AQNm8GAjBlej8{97`1=ijsdh36u2i504>FTj64wKUL1l@SQo~bD8j-#Mu#0a1 zEcF`zBWL8x#_14eiS~f|2EblxHeGEpX?%`58-7N6!iqSiG~i~$k*M$xD^sdvdC6S`Vw)0X>MN-_Sr+(kSM!>#Adr=;E4ABixlMtwk7|i#@Cb! z5(#FN)y@dm1+@^qF$d$RFF;|&=zu7@P1E(Zv$?mFe9kF_6}COMU1%L(107EYL{0Wl zn;qJMRA6t!L#gw%u{wf&AFLwG5Z3#B^2#`&_SlM!r59*m_?S`e=FU#fk)K2q5niJ; z!YH?iPuv@kzy_*|Xn8+N9askJVXtDj(pQXM!J{77)JBIOg?^9Z4OaB)1wtAZKa{ej zGvh898+|0*wa>eo3@~{)>`q-09y7rIf<#nxqSrK7AujyVeU*qN#>6(1MU}5PBxu`CyU3xeGHp?qpBtB71}E0-spia zsLUGcq=JrCk)0GR$ZyDKcr!K`po2zJ&NfI{LUw|2uOcSWu`;voatBT{N@b{0qICQI(=KIB}9xkn4?2q15UIav$MZ?D+E38lz&MX(}kQG+Z&IZiEA(AbYA zvKfIKM&wc^ezBsuVnfxjw3kKGP*NZJVW3q)%cY#^vwnJjbE#DOsVrdvY0KS~=SGLZ z%bW;WuDogXgWgx>Fx?4Fvu7-0HgI`lqd7ww0{m!SNSj5%bxOqWzSC@MMLL`!-E<1Fv@)??xtv z=~+xmPrbze8(&}8Z~I}HqG`u}^3%AG8fHN88S0C>aBOfQt|awP1Q(|mva`}c>X~@N zurPwz32D#3&Q5H73p6yXk%b|gWU%1MA(djdx#D7xALy>9X9!1Iz|bcFu>==#!g(H> z-$t_ab2AzzG}iRg#KXmph{){T$1LrM!35vJ>Dn#FxcI@*$*UVdi7#Z)N>49`6{(Vq zerrX!CkYd9$#Cx4Hm<&EAk;GQ3`g3ZSdpERH+(H4f$Gzou99TgKOk(=L#$VN?Qi6b zE~6K~L!V=$Ho7h3pQFm1C8hUt_utIW>3B@G5K5UjDTA8BKW+`L^XqqY7=#27gsEV) z>s5(^^}CSp%MLj2Y}s~CoSsbnifCZsFZRf~5NX4+?CGVWf%o}-_taJekHnamiFGSu zYcacBv|+Zzgq~Zgto$JWZ%S3G8k?&|Z9FY2Q%qHjMJ2J`)`I6`TIqX7|57fF!rpy- zWm3!e;qn0q`>Oupm%h2J5hQ94!}GmcuZEa#E76s|16J+t5FKf%iCW9VpYBwVtPPgH5BvP7{)b#SN}C z^iR|qElNBqx(p6lX7?H%5&czGCtaX7yUTKSLY3I^W_0O0dyD4>c3BuNwZGw<8_SbY zcTH!YXrWw1;={~0T$UoyyrfV|e%8S|RRWHm*`@xx1gX1tPZEZ2TW1!!{*8SU$%k|b z{bp2WdOD9g93ejYZT6;#Skti90E+~B&5LC)#sl~$CE}B&c0gQZfO;Wn#)a>5v!HL8 zrF?2rQKuxY!QW<=a1uXr2*9T4Z?h}(^^w^np^y$aHoG?ekJ+WZdu(<+gdLk*Wf(*B zf0|t#Ti<)zz6bnecE!FsHoJ`U&_n-gc3CwTF8^hA)oFv_H;>J(C7nOz=PHV7G#?X`cIU3_0tid%A{gT#{9DU-aJ#Su!pz1o#H|rR`&RAv&fp zPu@!DAMW~UWArwv_)uGTvwfk%Vi)_n`WL^nxlEhREtC|Mbsq6qbqZ(<7WLRWW(D5s zMHv2AVaIdsPJ8$8sSR?<#lF?^QtyU79u8cLk7)o?57VxKonMvr?d=GFZkKwk9<=eC zZe4g|0NDQ=y;jkjup;S!%LRS6FX2Yt>mw#sT7Q`DMK*m@w$50HFa;~Hjmr}+W0jsJ zF{EAQ^gB3{kW4_~Lmq$QPJQrB>;U&mr3|`G@%n|9mp+hob<`s?a zjL-?IoKBInk3XY2F{^XS1dqu&Q6xb9fGb($X4l`8Dc2Wx`<4DY*n={6L47(;P%H9h zYH}fWX}-Ba@ZMuCo3c$V)&_%v61OMLqKM$G5wF2ks2bLI&5zTCH6F$qkb-bdUJKpI zr%-ijBYES1AD$TgqilR3gM~>6xVLHd-qqN6S1V>4aaafJn~0|?`p2UsRmb%2?&pdh zsB4Mm%N@Y;P*(s`YdMn}08f+oMRmF6Rcoap=^3*tdej0e(9HloPDC=(o9r~BZENJ-AV&L}NPp>4$1fcPbTjT()Z?046g#|i_; z0O;P~3+VcxPs=BV+gr4Wwsv9)VSg)>Ubt>}6#{UI#T5YB7r$MLcay_-m4WctZU?w% zJLK7-lW6bh4$cRP-ApQU6p{;yYsa_||`%U>Y_x7*btb|PYP4jD(sS4RAP>kRz|h@?kbor&9NouU2EARbIBmCzS8 zNF}sw5Sda#cs&8E^rfd)Ads(VAr~zUB(*9m>(8-2pP%zAIg@M3)F>k4I?9T|n-Nu0 zlTF!XolO*>IR>TN1vhn7Oljk`4+1H%*GG3plsJDinSZ#EkJn<{ssd**mLjjVTcS8` zFWlCY%&9My(1qj8@C6{oTU#+7WSoWD<1x!JauEn5vDh4=3cDN5%;=`*qg`XM*pB!$ zK!0~C9Z9pR9Yr;~kP~tR2^OAwKZf((kV0%$f8isG@)4bH)4 z83`@Ko~0fd-ki{}D~J@l(urM~!y>)?1yi45o;(i=@Dl!N9K?ucVq#)2qOw(FnR-N- F{t34P9-9CF literal 0 HcmV?d00001 diff --git a/charts/rancher-turtles-airgap-resources/0.3.1/Chart.yaml b/charts/rancher-turtles-airgap-resources/0.3.1/Chart.yaml new file mode 100644 index 00000000..2c1cbeb7 --- /dev/null +++ b/charts/rancher-turtles-airgap-resources/0.3.1/Chart.yaml @@ -0,0 +1,8 @@ +apiVersion: v2 +appVersion: 0.11.0 +description: Rancher Turtles utility chart for airgap scenarios +home: https://github.com/rancher/turtles/ +icon: https://raw.githubusercontent.com/rancher/turtles/main/logos/capi.svg +name: rancher-turtles-airgap-resources +type: application +version: 0.3.1 diff --git a/charts/rancher-turtles-airgap-resources/0.3.1/README.md b/charts/rancher-turtles-airgap-resources/0.3.1/README.md new file mode 100644 index 00000000..4f8c6555 --- /dev/null +++ b/charts/rancher-turtles-airgap-resources/0.3.1/README.md @@ -0,0 +1,26 @@ +# Deploy Rancher Turtles in airgapped scenarios + +To simplify deployment of the suse-edge rancher-turtles wrapper chart in airgapped scenarios +this chart deploys the corresponding ConfigMap resources, as described in the +[Rancher Turtles Documentation](https://turtles.docs.rancher.com/getting-started/air-gapped-environment) + +In addition to installing the chart, it will be necessary to adjust the rancher-turtles chart values: + +``` +cluster-api-operator: + cluster-api: + core: + fetchConfig: + selector: "{\"matchLabels\": {\"provider-components\": \"core\"}}" + rke2: + bootstrap: + fetchConfig: + selector: "{\"matchLabels\": {\"provider-components\": \"rke2-bootstrap\"}}" + controlPlane: + fetchConfig: + selector: "{\"matchLabels\": {\"provider-components\": \"rke2-control-plane\"}}" + metal3: + infrastructure: + fetchConfig: + selector: "{\"matchLabels\": {\"provider-components\": \"metal3\"}}" +``` diff --git a/charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-core.yaml b/charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-core.yaml new file mode 100644 index 00000000..81b26e84 --- /dev/null +++ b/charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-core.yaml @@ -0,0 +1,54 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + cluster.x-k8s.io/provider: cluster-api + control-plane: controller-manager + name: capi-system +--- +apiVersion: v1 +binaryData: + components: H4sICJ/r8mYAA2NvcmUtY29tcG9uZW50cy55YW1sAOy9aXPbSJYo+t2/AqGeCcszImWVq+pO+cbEfW4v3brtLSTZdV9U91yBJEhiDAIsLFq6Xv33d5bcsCdIipJdeSK6yyKAXE5mnjz78dfh5yDNwiR+7l2dPPoSxrPn3nt/FWRrfxo8WgW5P/Nz//kjz4v8SRBl+C/Pm0ZFlgfp+Gb05T+ycZgcr9PkKpwF6XP5aOSvQ341ifM0iUbryI+D5/LPCN5Y+bG/CFJ4K4YO4RF8Mspu4evVo9Fo9Mg3xgb/Dm7yIMa/srHoVA34JXSZrM6CLCnSafAqmIdxmMObpfH7cZzkPv4sJxGkuRwENhfG/x1M89HUH83TZFUazzH/O0ivwngxwg/NueFkFkE8/lJMgkkRRjNu70oh9un45Pvx001xKLDDv00jP8uCbFz9+lG2DqbYMIxJdkzdZHnq58Hi9rn3czBZJskX+vWa/82v4FjCIM5fJvE8XMjf4FOc7zTQP5RWSjQxEm9VXqL9U15T/cLaz5fPvWMeai7HoAZ+FlyFwbVY+0x2P8INqv85gaXFvxdpUqyf17Ap8CZxjShI0lD+PaptU7GR+NeXiGT6OQqz/G+1R2/hV3q8jorUj6qLw3hfJmn+Xg8BupzyA9hCReSn5a/gUTZN1oFx+mbw25WBhJHnz2a0r/3oYxrGOJokKlax6mEWZNM0XOe06y7CVeDNYHz4J/Y6DbxpGvCfybw+V8/77yyJP9LajOXJGctPsLks91frR+ZOeLGQC5/f4uDhE/5hFqzTANEOqMvTgn/kb65O/Gi99L9nbEyXwcqXawwIiF98PP387Lz0s1ee2f83MvaSOQ0vzDzfg70GxCYPvOtlOF3C2sfeJPCKLJh5ecIoCDw+9/jLOomSBeyM8aNHRrOvjPFfLKFdnJ93HUYRNpYGq+QKvg4Bk3GA2MyXgRcDiYJHUeDjCVWNwblewzZXm4/BoG7Gr10zRUDk8FfwIpC5IKOexTaBETE+eUQw6hSnkcHZVssO2EgmSOjGlabP4RxDM7hxi2gmjiPOZ5os4vCfqu0MsYidIo6z3KONCFvSu/KjIjiCDmaVllf+LTSDfXpFbLRHH2TVcbxL0gAanSfPvWWer7Pnx8eLMJc0f5qsVgVQ99tjIr7hpMiTNDueBVdBdJyFi5GfTpdhDn0VaXCM1IcmEhPdH69mf0rFLZGVuuXdC7QSDqfxgKjCgOVBUsGbkJviKepVwJ8QdWevzy88ORJeKV4U/WoNL3J9EJuAniDl7/CuojaDeLZOYDHoDyboXlZMVmGO2+BXwHSOS1dt9iXdi3RC1nh6Z9UXTmN4ZxVEL2FX73mtcFWyES6C1WqZt331ZUav8UDely1La5KVc3hVPJ2IAwd/hSkeiRyJiTj/5jdlTDWTAATBQnwk7qjyrG+30fIZ3/POSwPYGwFSezinvhclUzibgKtiilvDz71lEs3kLHI/jLKGZudJ6hE/gmRF7lrRl8ed4SvGrKtbo2vStFg+rH0cnMbz1OfRwSZoetEGCwjvuMELSf1N+ih3BhIn3K9Gl7R90xXRx5aWcaZinTxiY+XgK3eGCXRnzMMgInqQFes1sAN4Y8xpDEkc3eK/6ayWmpZcoLrGWjpQyzzz/AlcRtiNQIE38fGyw35ExzCCICfqA/QlCqd+jbowdC+Z6Lbtke1CIZwFc7lbfy3oJFW27ZRYekUjO5pK5vjhzJvcwmcSe83Ts5siQtvt3DljuJzlTSxJgphV7bItQws9qwJtJ+LP7MfUuQoIp3MeJF1XhHoQtaZBiVWAMwJH3J+JH5FCw8HhZ0d8DfUOHkGzFkB3YugKrsdw5v3v8w/vj/+SiOPiT+FyzpiyrqCrI9jEwMYB3yGI7jk+GQMDF87hThuL1gDvv3z3j248e94bOMrBDXCxEXAq4vypm1duwDATe1C2DHwfTBIHvE5mYsLXNJXc/wINiKnATR+FX1qImIYDvHqMYf+GbPHvB97h9RIG4B3gnwc8HMVr4W9yT+lhETkHxC8WeAJ6uiUeAW/XJx4gAeYeJ0ZT1AGuI4wthIWY1YYJ2IUxlnHS0yVc3MGN9x2yyYQzwN6TMZPG7BbaucEep8sE+B2miDDbpQ+0LEtgNNdBFI2Yis+8a+B6knlPf3IJcSvDWvnAvnZxvFW4+PDqw3MeKW61RYzDQ+YIhgB3KNLTvELWeeugWLH040XAM4W7scCrZSeHvs6CVmHYeScWdRB1ujc2rwqWGCMpc4cYe2+cvS0whtqhNA5AZkKkzZJphviaBus8O4b7O0Wdx/F1kn5BFRMerhHv2uyYFBnHf6L/7ApBrJ/ZMZao0ftHFY4iO94FpiT7MZwX6MXXORPaabUPJCasuBACvHErrfwZX1t+fHvPZxbXo0hxZLcjqeIFAon/zkJgFuD3XSxAEe6U+H06fXX/2/P4TzCrHRzkFsG2DDcjPdrRyl+P+CsfmOtw2viV5Mib8T5CxDU+6RlOs3AuwVLEk2JcWBXr1iDVsH6PfhfimRLMDSG5bb1fAAdYwP5eCX3MyuhrFaSoK8SlFBwY7PxsncQz5DTUm0oVI5SKtw9DPKwKhpuKfjUDSuNLhoraRtCy2un2h/yFHiPJl7FXxErUn3lfglvBqMNRgF6TVC6rb6rjgKtGLdukS+wEgRpFTrRKkfYzT5KI2HVqlVYxDWBaQFE9P52Eeeqnt2qvIBcMY/HhTRhwRze/FkF6608iblEIUBPcBwEaXnD4S+CeV8ksnN/ibhSkpousVUhaM0UrMrRqAaUC8q+Rug0xMo1fTXDPW+cd7AigF0JxCzslI5Szkpo3RcWUkKQLHzXZ9J40Mf2za9Mcko2HlzKIAFVP1HpB/7A9/Bwufn4E9zGORyhsSH2v7Y1d1we3Tka5nW4DXr/Nd0DPC62aJbsl3JFGaYA2yYJiWmiRttcgWZwDC82R/UHZl8bofrVF960pugct0Z41RPvUDm2hGdqfVsjiIHdrg+zP8FAt0APQAFlgp1vzY4+doRqf/Wt7LJHRo+UZhpHB2p29a3YssGKt0bHHzV1qch6wFscC2Z3aG3sED9Ta7F1j04uJXtZ4mJamXUPTrJ3p6D7sMb/3L9JpxZre4IIg2ehRJk+KctHSDgkNTRsuCnWHhIoVXzUtnOoampMOCwXwHWlEwnIXg3/R/KpHRxmVP1mIYrlsNUROcSU9rRraEztYTz1B/qMyjelmzhROdnKyUwmc7ORkJyc7lcHJTk52GoAMJztVwclOTnZyspMCnDPs1k2Epp/504pTOTcI9yP8rOSKVokAmMmcufYpmoSmMsADP6dhZ10BMC3iVmkIkhvaysH7VbCOkltkL1tY/UHe3UZrPHcM0MKBit4w7ki84IlorEbTXSsSEHwy7kKjJjaaTw0QiFWrCGN7Smtz42Amsu9myI77JamRGbfmUVbWrLVLJUoDOopMOvhfmhEMl210wsaDmnDfxaIP8dthdMwCYBwDQgaGYpUn7omoGckuivkfdbZLVwux5u8+nV/Q9ojDX4tACyKl4DK28sYc/yW9Kzo7EIMRrRjRZ76KP6utfRd1tnMLEltlV9hXARV83sxwEiGusGBQpkJyFEzIjLjDzr5q2JDm8XII1YADymDn9O95kyTJMWB23efDPcztzPP+LBuWOGOKr/rTB7ykeREUq7d5dVkY8Z0CN+9UqEp3E7YoQugMAtEwFEkIOwwM0TAwRETDEKQg2IaNaNhNAIkGS79KDZZBJS0jtlxVhH0Gmmi4/5ATDfetFivDPYWhaLiHgBQN+w5N0bBlkIqG/YaraBhMYvpDWDRsSl02CWvR8ABUdGUYjOP+oBcNm+J4k0AYDfcTEqNhI5RahMlo2AavG4XOaLiXIBoNg3E7KLBGw6YYvutgGw0PWOlYhsFL1huKo2HTZdogPEfDvQTqaBiIT6vgHQ3Dw3g0dAf0aGgP7dlg2H2OJWUYumEqTiclmbriUeEEawYnWDvB2gnWTrB2gnUvOMHaACdYO8G6G5xg7QRrJ1grcIK1E6zLsFPBujuPhoahW2XT3BqDHBgY7ibVRnefQwROq0QXxusD8xZoGLi1Nzn9+0uIoWFPqTE03EWSDA13kS5DwyB61ZdCQ8OD3pT7SLWhYS9JNzTYpt8w0LHbRBwaBuwty1dtrryRdmvqfKusqO141WJsfeMaeVMjz339aU82JcvcJn6a+nU2sfXjxge1H5mCPffmfpTx+JCM+oug9FMxUYnNn3u//f7oKysXICsDyKoOmxUG2K4WgLE2ZlUA+ZtL4+/S+Ls0/i6Nv0vjb4IQB/8a+FG+fLkMpl+ar+BBUR5Ga4o++k0PefCALxN/DQunYUDixdKaPPC0/Cv/5lO8JMzcdmTYi28/dBiYR+KQ4VWw6AgeGdnJCEOyNt568yIFpKdYWieYhXzPIT3FBfGjKLkWiwSSaALX1cE7Y8YHWivBbDyZpDs6PJDc/oGUMz3RVDvHXtIUAYpGSTpiDBgVjuqAsQnnuZ/mxRp5oqTIdxJTWmuVkcRidpALVc1NuCrgWkHWDo9K/QR1cd1kNMxo06vDBze/QBQtRkU9g6OCRYsfw2iyLJmGeBF1dbFMk2KBuoZLJM7jj+KQnb665DPankAVATN0aI41yJXNUZ1vuLrWfqqVVwti+ChirFuCEdTwcVZ1J4EGZreIGGatCbfE53qHgoSQqsG/AoqMGokn3d2YpJg6g1b9iNiqXfUhVu6up6K7UUo6JT6oljuX81Uw94uIuBvv5Km3CuMi7xahT+febVJ412G2pMC4MCMlEO8B6BtmeaROA/NwwQ0S2jBnw/PTrRIKGKTqojfoakhtlFqzjSyBSSl7biUEcYOxs04t8Yx23uk+cdXTFQE5BFwmaxY0j3jPzMMoCsinImi6trVKpaMvFs5w3nFwLflqrfetuXXxzbqE/0MVzryEHsHZySDRPOno1zeGx5xWFGIcJtBYJIaGLIxinCs04wrNNMFDcElyhWZcoRnPFZpxhWZcoRkEV2jGFZppBVdoZu+FZjytTHgphdAOXnlAzqN6szpERKeMESyOfIN4nBkMPwXJs0uQAu6JNFU+Zx4hQYj1JJhMRfZNbgxm+z4FqqwmxGUgj9fRBdqeUN/74QxO4TgYi6PYMGp2n2FJSw5Hj6G1i868NcOw3YRvw/4BaCK1kKFnuBXWeOZkhbdJzmqszo40z0hJcaTuZ+x5P6PUKflXU3eyhDcnQRBLhmkBslxbnVfRCXD9BactQdkvACGZJU6hZ5P2se7V7xbErRwyeCB9TD5s1rdBvEAr7EkfY27r2ZH3KSqHtocv7n0edr4KjOXOV/q3JmvEuzSdNiS0y4mAQe2vMxQCdkErB6je6XgVKyDyRsKtksa9pFfPTLV6xwhQxGWpl25Lkm6g/YNPpbkeAD0FEThDn65pMCNGBa9Az7QDdJ2614uxd/DLs9EPIFyOWDRcBb6k++bUr8MoQkOqnDrhAdVaXRvp0H+C40f3NvyfJBzPDIW5wtghEL8uZerhpNIWWTx+aGiqXfnk52jOf+79199/+eXp6Kd//PuI//P3f/zL5irPvhJvd1TSuxLt6Qp7u8LeG00Rwelbnb7V6VudvtXpWxGcvvUhaGmcvtXpW52+tQJO3+oKe9eCD0sumXxtKweTxmrfLf01eHheNDiU0Mk0K2cjUw18AxxVTr0uRidZHGizpUOzJ1eB3FUgdxXIXQXyGrgK5PdbgRwucUD8OZwTQGSLG31pNd+XPpAe2CQxymALblPqY9vU+pk8RewyK75tobtdMm8/De0vD2C/YdWdaapkzVIVMDFSsi6COEj1xEylR+lK7xfn+QIWHc7oIiZ9/RyQP/GnX7DXy99+88ayagn19fvvI/wthY0JF+Tvv7fWthBdmPOYyQMZ3EyDYJZ5Pz7DJU79KTSf6RHAsYT3Vis+mT/8h/ESO1PDSx29LgKqp4CHOKZe5aXAY86K+Ty8QaRFZCXzfuisu6bHz/wB7skwW8lNxCs1T3DDkk4lXRQdJVoY/s27LGH18jn1U9JgCcfY/nXExnhq0MwLOUs/WsNAYSgpyE+M9iNCBBlek2s4/Ud2ONjWloHG3VdABWUsa6s51O60vK83pw7NMrn2oqR85iPSw8GuQrqxWudc9wWdrektsqizklAzwC1dLxOMGPTnVIFEv83MbfoFdhqe0JkY3BgWQ8VUAKaf8jCQkbhVL5H+b47BCkHUKq9W3PmzAI3yrdfB+w8Xr58zU8rskbjpUOxKw9kMaCMIz5EgNawHlCFrF505QHp2Ai106oc7W2WjLSnO5MC8wFKukiJmzxPm8cXyVZc8WwfEgHuzVBVXwVG2h7QRVhDZAnfQ7dMjMm8yxRUdkcOCwCu1LagMRQ/FtzysKFyFgtXqXqumyQILyMI3SyKXeJ1P84h780YjYUm/fIib4DMGx8MhzeF87GgvNDS55Za49kOi6OSdAg+uqIc2logT3c6of5RerXeKaFZtFtHCFrvlHhbVFUV2RZFL4Ioiu6LIrihyGVxRZFcUeQAyXFHkKriiyK4osiuKrKCv7kf/IlW8PZsi3yUbPcrkSdFKR5Uap6FpI1lOPTVOxXtUNd1eSlemzimA70gjsn10MfgXza96dJTRlpeFaGWRrYbIKa5kzq+G9pKynpJQU4vr37B4s5OdnOxUAic7OdnJyU5lcLKTk50GIMPJTlVwspOTnZzspGCNvjdNDGz/6nzkT0uOGKI5se0plFB7UzID3uwrZHjuSeGCHIH8jtSoDO+THCYnB6MCKUW34uZN0hmHkOIfFO1ab6o1Pr01uyt1amQLpdmLuWtXzeYdYaDD3NglBDRNt0/oEEbyLn9F24P3SjclJgnojPA/YpnbD+HOFqXc4Osbf4pp9JKY7iFzgMCwvpZeiSvALPaXBa10oicZQQlFNA3d12YLzrDxsjPYxRuKHOnN57p1lr3+7ih39Z957aypPZVLOoO+IgLkDSi9tqRTYJ9j/c73G0JvwgqEEg4Viow9gr8xjnZZLyZZ31XR1g/r0urikEoJDa2mwsCr8gFFt0t/Nrs88i7RsRN4uEsSm+CvFdy+l3RRKHdwm7YHFQxZWxZE3QRbqFOpnobldqiifY95w+n6U6o24cLAp41UC4XR49IXbtgo2ZIb3zG2cTykd9R4xMk1L7uZiIHOCntbC6dcTi1zCQcsiGdiMdewtvgXp4+xK/zyb6R6hM3MG+S5iAEgxcBT71A0+YQ6GHmH3N8TZix4cEO7URsQfpD77zkqOqjTIBvY9qCNSIqfu9qJn0mrVCrtQL9suhdfh5Sgg5tNxD/eoItVmGkdKzkFzWbC859Qa9WHIivZmHe9uNKhT+pAbj12J8KwA+EmlKFojn5AQ+byc8CKI+EeDIIQRjDEKKRlVydjItGGwhKEOCbbuLpHVv1MgqmPTWsvqhHHRiwpbdDST1GomukyG4S4hnFY9aYqi4j6C3BzzIqpzLOb0MJRyqPDIqZcxPhv0k89sUPbWTAvCZzLYjIGYdOQo0YgXmbH1ekeT6Jkcjx7Gjx95p98/x38Yzqb/fD9Tyc//PQs+On7kyA4mf04+WH208ls4v94vP6yOJ6ms+MvQHbi/0tKoPEi+dPbk6c/jt6enPQl5UEoSU4yPmRUxNTkiOacdSZL13Ald/idHlE6Qu6YmjC0Mnt/PEEZNi1haabCxkn9JSlZvsyqPn40LYQxUKyofbHLF+VLXuuJrvw0xCgoyW8TJzsmpbt+hEs6KcIoh2fqV/vOeRcZzvsBi08BTkKa+ITl5f998e4t7jGijYMmObhAqZzJXS/xZ9GPXGLZr7m+fjZ0RVWr0u9UnRq7NcXTWlvUO8L1gIJt9sVHk64ybPwKsq09L1kPrT+LGYIUJgcIxefiE0Wwk1iqdJWWSpHtntnUJOPuBbUnirb5hWqzM0qCzWGvkSFRTQtZCdVw/94bsOvsSsiXRkrmqsYxYmM7HR3pH85UYbth43xX+ljsuNKIMRbZ4lTSPkM7by4jZrWmqH+6wy7U7kJSvXO2pralsLs6aszgbUkSbWLYq8A3GlveURHE4aVGiIMO5fejLKk9seymMfOcdzgjiZViklnrhBuUO1OnyZIJ5007Ab468LvzhzKU3XCEonqDBT1taqe+YJZ4alrW8kjvBhurapFoUtnf5f6ulaXmopB9O115fTV/H2ARHcsRMHbRjgUbbVzDgCVbOJQdF6Zm25frAc3NlPK2s35q6zDsuTQr/a4Jg7lY/VEfb1J937qYvFjkj3Au9rXBVV+Dt7b6cutNjS257VyCb2A7W79sJ4mMjDu350W8pXteKTOGFvJIzzz65zAyTXkdb0nBpvUVi/H0rau5yW3syq/0H+yWuyxWfjzCAnAkGRsvd3nusWNgl1KsdxcHMXY4O23NNWtLDF/LhnhCNtogKljIVmIt/okBtZ/s03wPiqALKbYqc6kYl3R2VZOTqiCyMF2iKvXyyCMl83WYBTIZRWtHGMzLVfK6pjwvoxcV25ksMtA8TCDqMrJ4870hXAa23hrS9UDZfWOdJKlHp7tr1wab+w4WZIp+T1JRlb2WdgjrAg2vWpvQG1fhIe4lwcqJAg5PxMdIDtJOrWl1m4mkMMHw6f6l+mXbLHkmnXMtzVIOqd+pxnKOIjt3d0rqgVmnrJmFIYzluRioOjQ6UdnaD9mrnSzeWabT8WmDWTdn9JkzWEl6yboUdMGvJvNXCvsScW1Pq8dQToanNsXLJJ6Hi/4l7GENSN2+0Tb9XP1yV9tUDqmS6q9vop0bphcXXf7cNa7byoTWm7+hnScb0XAaHnROo52vUlRtE+fLzxWOIKsYF5SFGE/QlHZl0Rz8IZyjpJpHLi2rrFgBGTNnA2+20ig758kWgmD6VCrTifagUjYZNanGVkoT7ZxW72z6L9HuDKT2dLA1Cyk5//Sbfk5r+fnIzKvIu8c5OoGFWIYLNBRH6Buu8ja2tus3Lso2LIdVIs0HcjMNSqjZlCRRpcPskWLbU2V2fmim0dTJMre+dvpyVT6Q1dlHzsrGrJUD+FALWXvX914fsehdiT6FhO0anUmvExkpmEmR8sqwtsve+gQj0gCwxVTFOap2yLnqeplEMjUz+0S2qxOS9YgpoAjlLLN8wjmLcy4HGaZEZA8iPGy9ipwjw+g0CYw4yZCKtZkddC5Rl42Dv7daoXN2NDP5A+F7ZrlhbKg6vBGjGfnZeefAaoPrOeIfys22TMJgDa5CX37kXT3rbFuu8YVui/Q5WTFBByaBHPFEsAqdDf5NOaB5L89edRIHW130cDo7XKf/oqEP48iWUS2IK0U246V3yGSXfGWv/VsZzZ1ZmDY5OdtLXwT1Cr8xpBDopYhF4KwKrMiGGqeBEXZFXoD0gsmqMSFBeCXKPuq3bHsw0pYXaLn4KLwMP7GT4RtBIYD+8G6FCyLr9xqVHqMgjhYpDU+IWEJjilf7OskoQUPfSHfkBCm0abveaCIrp2Rxy9kALWmRBr19xM6ReQnZfXRfmOrVhje9OkQr3osIwhxlOLRDnbW5J4iLXhfYoXvgNbQpN4AshstOhYKy7HkfWBrLduZdbGs2ExknBqH/NX8jJBXRgsjpMmB/7Giuity+82/C1R3spEr7dS5TPoC5q8Hs4FoKY5AbMIAsFSVJ7Q6cjceKxlkY3y3OuP0GnIkHXw/OuNDmrjH1hloVR0kzlKI3QT3Hnrj6xc/MCIWLOOmUZ4w+jJLgugyKbGyNdVwRlYCJQ0EXRcB/KWJkBH/RIU1VzqDr4DEmYKKQfrQmwTrGi666rwydkR5tnXKsx8pHLRFFcugnmpM5FpMaL9p1TRJ6d5PA/q7uueHxnRYb6BQbNc6XkB852YxF0ClCLyIGtfOHYV9X/s3pXSzpO9Gu0tH6N7IagLGsG7Eu26yvIIBIY3/83upMCGrch0RRE333WOSGW9Ao9Xk7RKMdvbgzPN7FTW7wNgKH9Cfvw9ptOwCZ6IBR5ayQbvhRFhzVlHfMugOquSgZBoFRnrH4CDsPfi2oNpT8Tsh5otmNx4IEoHcouObkSKHHtOEods/c3NFOC+O7IXuiXbXXwvgbJnthfEdkTzbcgsZvjezdjQBjiCcCh3dB9nQndmRvgZWzbAgfN7zxaIYRPnNUG47jayF9osTZrnfbR25W7rYUxnEjU1pVzyt75K3swrb3LeHYu74PRlGTyaAk6wzT4u/MHGBnBGgyGjh5qgK24b5D906DfZgPV8P+EaGPfaZiCTvaTJba4QEBFLb6X3pvx/i+EHMnzz3892Bd+2dTUw8r8lxlcqYZHam6eYJoH8mLGO4HocvbGU0r4vDXIrgTjveTbrqsIQ2ZD4411yv9sHk0++J97bWjViRgx+j7Py2UkEuUCrdkechFQm9xiVrGB+m0kkZBTum7oRrTBn7E63xOkViiW0Veo9t+mozVN9e0SsIZRN+nHidUqVue/bTs+WHh9SHBdnVt6PKIWut4wcJNqa+fUdX7o+W9nq428rkdqc8aH2Zt49nQV1dEH27iqfszfyrenAjPCm6QigBmqvxCa+EE8vMke/EUky1NZT4+qq5I9s6yw68KRCJRoAkN1SGUi6nWR9DNSdYjjbep5FCLg2YnTGUxEb1Ba/IFDq1scf5rRQKC7wmfHxMbzQe1kymw9vdtixEHspmxO5sZVCbSrjaOsrJmrV2qiiPBjO1B9NWl6d/bWpvYRoCY9oUdD7lHGB2zAOg7+X5LfsWYOFeBj3NJXMX8u8k5WcKpgsG7T+cX+ubW9RpMfAg/UdpGOqK525hU9TcX+478pWJ/Acivrf3WoT5zP4yKNHiVrPzQPkakZwnemI1KvlH05M34V9Y903S0wyNPGC+97pvunZKYATnoSy0aLHWckZsZ+VGrFLL2pZ53UwJUHRdopPngbr2CAol/DfwoX75cBtMv1sv4rvapETNRf9iJLeUsMnyatjqGlX/zKV7SeFrq3Gvw49sPreG6EkYDFEX6bStpbbArZXzrzYuUMvGlwSqYhUpuLyVSxXBg2PoJ7P+DdwY+DvRhYl9zSuXY2+2BDPw+UDyxaHCQhgAQOErSEWPGQi+ARPgcE80W686ixRqG4vN9rQcpRWBsRZCXbF9UFBg38MA9j5BTgZuMamKpQwNXg0Ajx2+XY/2oDnqYxY9hTFmWTEOkef0dLdOkWCDBu8RyEeOPorLU6atLFk3Gjx71C/LoPSkLpZP8GFdKz0yT1dpPdbQk64KJbepXZ4wkAXycVUt6oYPiLaKKJR7CeZb7q7V3SDUsZpitCm7RKyDhKIP1u5yMZDooj5IuUZfQth+F/wxmO+5JrOt+pqU7U7FcdDGW2rdY7Eot+1UYF5254SWczr3bpIBLOVuKIGrOZ0j7BMYB8z5SZ4ivxuBmHYXTMOcSS093pqoxSOGFZcrO4brEWheN5ftMqiwZ7N7GRfk3kVa3unl0cTibk1s9pRGQXgz3X7MG4Yh32jzEeNsj4cZYu991ut3eHpkZQ0zEwbVUps4xL2wpt4ORrwe3+xL+DwWLeQlhQtCQcldH2KAE3ywnT0JZFKKAA5ScQmGgRckpv/h4usvE+EOSIe6i+J6GQel0LArytYzSMlvTvor0abjfcn0a7rtwn4Z7KOGnYc/F/DTss6yfhi0K/GnYX6k/DYPIhl3q1M0oxtCSgBoeQHFADYPw2V0wUMMm+BxaRFDD/ssJahiMvp4Sgxo2xeHgsoMa9l6AUMMgPFoXJdSwCTbvslChhgdcslDDoOXpLGOoYZMlGVjaUMPeixxqGOz2YGXdHVYC0QSlrnkpBfk78AyodSGZKdMyJZg2+QZxbTOYUArSe7+4CVwhaRB9NnOQoMi6KbTcyBFw4LrRC6r+4FRNpC28zQyrIUoW4RT4mQ9nXKtJHO+GGYSkxWB5VA5Kj6SnI0svmuHHpr4aWNSErUK4HKSiM7Q6tyKPB/Pv5ADmky4GxFGL7jSPTPY5qYEbe97PKLNLrt3UWmHVn0kQxJIdXID0a5PvFuWigg3CKDMHfsZ6GjFYnsFR3w6xUWwMSInLg7ITebQftWdTvWd4tQo7hfNmbVv4XjHc7Sxt/e7I0YHWxuJF2+3e6zjCMICw27q+qf17hoLUzrNd2Jto6EAL/7V5o2WmZHnJTMNL7zgoQQxpGujOJ5kRejn4VJr9AVB5/wt0Ws1WaFqN+s/568XYO/jl2egHEOVHLIKvAl/eTCYaVMlMgQbCCaok+zfhof8E54KpQPB/kmw9M8woCoeHQIb7leiHk0qLZDH7oaHBPsWh8A/3/uvvv/zydPTTP/59xP/5+z/+ZTdKbqtzAOTiDC0N5wHeEDvzlZARAnqvZtwB3R/SXz0OrmEppW1e6nBZWdfZ/ETYR7q3mWmmeOodyvaVT4C+n5QVBY9MlqBGDRiMbupB0giMoXvP3L+t3whvePZd73bps1gDNwFjOc8xLeyi01heTQZmfCYtpqSXkl4/3LI8F93kGN2nyCjB5ivRwiAnFls+w7ag22DPZ2nmMPNHmf5V6HGPh0Uk4TXQpDQOtQlbaxQxiZh2Uz2SibIxuCia+NMvlE77t9+8sfS6o25//32Ev9Vc6sYyheV74y24P2bJCv5q9eAqDcec/kxGsqCXawBE48dnuFdSf4pFlvRo4RzBe6sVG5V/+A/jJbaQduX+lrAIciQFmHovpr4FEy7GnxXzeXiDGBeRcT/0T8coWYezWAW40cNsJe1ywm8pwVNARz5dFB2uiSb8m3dZWpNLLpBXUs0PcEWSTfJkobEXct5+tIZBw7DScKp86BE1xOvDRRzBQgzCCvbTvXUaJlPf4ipd6qGkk2QdUHl/20vM/PIPQllvHrBd3q8oDL0ChoyswP0CwhAq8r7etCImy+QaRGlBMgx7Jx0bpLCrdc5OnGjspbdIMmVjjsZ75wCWwPqgF3suUlVLHxVSzcEicG3PmRjiGPaW8hCB1X3Kg8FEo7fqJbLQUHr5IBpwu588lfzFN+F5R5sm9cM72TFGuyryJsnRhLRKiph1Rei2pLZCdftkWEUMrY4zbIqRhCPuzQtbSa8GnT89Iqaf8Sm6I/WBWBfqQZBk8rQCSYkGF4WrUGTBtVnxponPwjkrNdn14BJVfNM84j690UhIpZffyob6nERAzV8FOXRxB/uqofktt9e1H3JUjkiedkU99FS3obT8MxpFMBvb7zrRuNp4ooWtd96D3xrZUFa+Zy8wxtVtLZuXHC38RxR5BuYuzJg/0t7aPXZ88heK+1zN7h/ztsKFoea4Q+8zecRE4lS5IonhSQVTHazB8NgtCzgNsxldllt63STTaZHi1S9FmCicB9PbaaSYPC5M6cN2Eag+D/oLAg5RFGP6pfhNFC6WVupZKx9vhGF+3uYX1prfTSx37/R0tY2HmcIVEjK43+b81NiAar2W/nqNnqW1aun9voQI5sYjVR23l8lICb3ELGmR+x4q0URqOBgTxwQd8Sm16jSJZkFq7h7vsMg4vF6G5IgNiFcNEnS9T5+gKo98pnXFeIkX61lzQvDTWIjrkXeInCxu64AvPRPTT46aFJA6Y7FVj+s0TFK4IdEnWcwtm/pI1TD7n3EMSTkre2PqaTcncxtNdTJTck4DmRj61aHUPta8msJc/YVl0VSRGvQ5K3KI0IaZ7OC7p/96VN0tBqPAYkum9K/wuq0zFtMb8uejmyic+tYIEVoTKv5VUdQTWyCqXFBhX6lVngDXI/x0ZXf9WmYE/IzlKn+aY9IFjQp04KbArT4ll4StYiqG1D6E5YFGP61nd+FPzY17BbUuCqqgO52/ysac6gKPGpKcsH8v1C51qZyklAT/KXvjqezyLuK9+zGBrdAbbMTvD78AXhl9lBSMa/6JFKiwI9s0LF6IZCuc34pwTq0poMOKFAZpjUU+GIZqkgbv4Iy0TEfewfvgOsjyA/jXB6Dh8C+rBsm6HSeap8dUpVi4/qiUx7uEB0qwpqgJegvY1Tu3yTmNMPJ4Ulav8rStXmW87Nb5hVii8yLtN2YifO380IURktVgPTUjszE6f1ZgYTF/Ahen11dszRgWXSn15q1PiBZUMJXHJAOJNFfW3sPg5rn3w5PqVWt768nh6XsJ2zt5+q+W9d5JmMLR4f0HI3yKxmgy+GrTGUrWdq29qEyOq7lxXdIZq2OMKeLNiZco0367HkrKwR3wI88kP4ISqMmTyF0DjJed73ux9shigcylsGOzub18u2UYYpiJEASlpSBNilU3eh8mEcfP4MjV8s8SWkm2r3gnz4h/krvEzs9Ebm/vA3kARMbmIpd58jH6IoKG6miz6kShFtEmXCSOgCBnUphEvJB2qeFYp0Uc2waI+IaGx5BUxWKEmtOsoGrQKd+SCxNxyurAOcpdzqlhkKLaEt41Ed7o6AwlwpuTTWTYtiP0xCsMIPEl34tdEmAkNFsRYBKPocX/0XyQbaizVT9MwQV5LBFfX4b3Hu1oNooyskmZeXvBoCPlrF9cmohaCs3mBdR0Eg0PmpxLnYR2QR1eK71lX62WZXpIUu+dJcajeStLufdCLK4hR5WkVLrmP8Qs9Nh5Kcx0/aNBAq+NTDQqN9n7thz5Hq3zNs49g4wfpTjvKEFPdo7Kli75bG0op8qSo2DnOBWR38Patzn/ZNrhnDuzziLFYKvLmCRJjraE9a63/p9lwzqMAWmD6q8hQlzY/awEepXRTONZ4uadJXEZou6BMd6VlucsmMuEAiJraSWzwLTIcmAKZEiVnSadrOKcV8DII9D/4TDH/aHR8Ai7jIhHGMi/DoyMr43YclUR9h8hj/BQouQRHk6kPMK9Rssj3FvEPML9RM0j7CRyHuE+oucRBpMY2yh6hE2py+bR9AgPKqIeYTCObSPrETbF8eYR9gj3GWWPsBFKraPtEbbB6xZR9wj3GHmPMBi3G0TgI2yK4f1E4iN8FdH4CIOXzDIqH2HTZdo4Oh/hHiP0ETYJfrXNw75NtL59fCvm+O5jY6yHXU7etvOqj+XUcCWZupI2zgnWDE6wdoK1E6ydYO0E615wgrUBTrB2gnU3OMHaCdZOsFbgBGsnWJdhp4K1zHK/85K/Mnu+rPkr//bZCV1yqnUTPfNDRoGatjQH/VvuRY4ejiKWNjRS+tO/04XMZMFsslkmQr2pc67L5Ak7lM/9GNhA3yrlIb3eULHuTlKpbUIXXui5kGIg9opYqU1mVCiIpR+jMJBMIyKIPQsoKx8LLFr1iW4bE6wOi+lwqHQzRXAm3D7tJMydEALZ9vx0Euapn96qtaXQ51tZe8Wqw1+LIL1lFy5oW8isE1HTKr2SKXdWySyc31KoJ9OpjZKCNhPGAjoaLYDgwb2jUb5rShb5kyD6+jflO9hrmFiLU+XAHsx0JsnmcnNJuvDj8J+BqCGWB4skhT+tejvMponIVckJ5p6o9YeR3IqiWTL3XMYhjxTvZoYgR8Dy2CmxqB+4HKe2ERRDNxjvgt3uLctX7apkKoenzrfKKtyOV3dSVZMK6rU+7ale0juC7nSM4s78iHRwBzUcqZ3m6o1rePTV1W3E+VhWbKT57axk41dWrrG0yF95vUZc891WatwZ+isVEwWnLE9auWZjZvLAOCeD+/BzkYklT77d0o3q7Hb1bpGzepBvdHfa2weYGHStd0ZnH3/47KBW2+kPlxe0j1h+QxlBiYbuMxco4dZlAS2vp8sC2tJP26Zpz/9JG3pg5k9i8F3Oz/3k/KQF+sMl/rS6aF3KT5fyc99bySX7/CaSfe5uU3wDka6ssGsJcm1Sabko17IzrnFfZ1I7YikbITjn3AZwzrk9I3bOuc451znnOufcTnDOuc451znntoNzznXOuc4513POue3w1TnnfsNRr06wVuAE63ZwgrUTrJ1g7QRrJ1g7wboHnGDdDU6wdoK1E6w9J1g7wfqhRL3aSL4uilWBi2J1UawuitVFsboo1m85irX145YHqBcrKoe1dMrMUMNzerkUPpJMBNEjBZvk8MyPytuy/WpEJ+uw5R4sj0i9qEYiK/sOHQ1Ca9Rbc6eqT9LqYHdKK688LknZ26nFVtVzyauxpR5KHxsB88kvUh+kA+mtv22k71ssiCN4pUCviJerXmQdKPiX2Duk0oRLaNmldmflm7orVdkjqkEb0TWpe2MF1mzM8Tp+LnVfX+LkOqYiTbFyZeXS0dRga+f4Fq4IK8tE68SgTFFewLu8beQyhg3ry5D3dueZ7bjHQOTI/PZimLYL9MJbFivYeRj6RzyIaBd1nnSHYC0u4G1C4IH8CboaE4rU8vWsEGOIuS8PwzlaWd3eCcMIs3bh33a+FyQuYkvaDib3yeOMToAxO9R5vgTpLnrpZx0qT2w0k1oD3Bg44ekySTLaSLiTUWuNW66sZDVDNr1F4UPHOZY3hDasESvKnm2H3Ay42TTMW8MgbdF7LtrREWNomblBfiTM+RZDJCkKd8ZLMU1QfZKxNIa8Qob4UimHkJ0yipy19k6HH4iISFkkiTisZcE94hN/muM5TVKUyboid3BV1XwY3zJ8ntIlxLLcGt9i//nGj9o3Sf8KNNybLfgXt6Y2rfD2PSIaCr9epAVgk4Zz5H2KicptPK6uUmHWh04kMtAU2TxXZNDB45iMhcFrPE1Wxxbn7h2GPYxVq2NKmGDUGlOKLlzxNMkydYdmZP/yXsg46SNvUuAxmvoYsqrFOs1DtA5C8/rzIgJ2PQi8MUUa8Yrq4WVPuB6gPwkj3FIU2IY1weFw0JUUrtZJCru3VY/Vs1hdbOSo4XJvfI1H3fgIu2940MletrOWkrX6i4gNbqLtpQ32ofaBytGAARq5ijJOYtV4w3BFEXEtGNWxbQSa//h9y5Saw8uv/DTE/dTHcn6W75XTudR5Y/ki8S0Ns8FtLm2L8kLbCXvaPhLFr6rZslq8cdP663Xgpyp4I1Oky+8ZZj+3KqIvuxRdpSm90u+XsW40xNFcamJtB7EnsYUlJvWAJE47xMgqtrfBrB1+GZA571a9DNOhvEFmX9rphciXhotQObFclfZZD5PJQByRjKy/DOMIcHlJS6nOozok5VQ1nPBGnBvpsICGdlSqdHzSM6BK12E2RQuCFHV875X4RZMBqVJGtWOc9YfvWeq57DTrw1awVatOqOs7OhJOa1oyfzYzFH8ea8oBkctwgQx0hHYvpY3tab18Bj5bjcleyT5Ixb6pLnOQJnO4HnOQar1JqanU4RaddSnMLT43VepaXd7/5QANoq1u+oGu5j510g0aaUXrdrgmO9TpDsXomXQn1fdUWLmcyAGA3+qb8/skD4TrFdsdlYecao0S310vE2EDypcFkdY+rXeyHjFVFI6BlQsrmy6DlU9aL+AtqOI6SrEkG/U0LecmXQjF3ar960JSXJjdWCzmBIh34HdlROK2BqzlOX1Q0iBzG1V2Yle0H96LX3w8/fzs3GKoteFaHeYP5S5aJmcwhFehLz/yrp5Z9CB3xoVukTjirJiITJBGX0Qxwu48Vgx/U4Yf7+XZKwtiMMxlenOr4GY+Ji8a+quwrno5BKkl31u8Mg+ZCOMVGV37t9IXOevN6yOBEzS89IVLqdA6IR1CLUeYDXQB5eYap4SOC0Ve+FGEZm9MwxRecW5IT781rB9DR1lgStKPwpYttFFvBB0CWsd7HK6OrDuHpQappUmDaZHSUMlNW2kEkElYJ1kWWvEICCWHGWl2HxU81hETTaDgaWFzPYp8Hne5MUU+IcmAlzOIDKJ7GvR2EztN5jUhf9R7waNGzXBcvtJ/MGkjM8dImTmMly0RRHilbClDEDvQHyGIix5pW8JmO+c1tF/NbMpBDoJ+3ePuscgWqmGnW80uv6gGoabeYKFe85dC4hLtCMXd4L21Uxwowv/Ov8F8p3e6Cyt91fls+QBwoga2s4tTqG7JJEdJXYcc5X4eVoLGKGeQ3Q9GRbbaOkbFg68Zo0Ivf4d4fEM9iOOpWWrRs6DjY2lUEz8zmxcu4sRCGjR6MlTQWbFG2w8r8alJoAtoG8sCwNChoMrCMdxfh1pNOIK/6OCnKhrwOnicKutnJLJ0daf11WA4oi+LCVniNJVp6/p4EiWT45WPGrfj9ZfFsX6iebNjMbXxok97J6F334n1uIubeMBttNlWO8UOjHMqZHMO76KbaGfHc4PW/sAM/Mq/Ob3rxX8n+lA6dP9GZqQ1NsAWbNj2O6HbCNoEdnm3NcCk39Kc7xjT3EkLqqXOdOeoHkKb9oLru+ZBDJ5N4Jn+5P1c4xAGI/x0XucbkUaxm0tVOctCDSxHSLd5lFxz7DF6yaRe8GtBnv3yOyE3i2a3HFFO7jc9A8LdMcXLWY9sq7HcFYu2h50ZxndPbkUfam+G8R+Q3IbxHsit7KQF1X8Ucnv3Ip8h0Ak83x251V3ZkdsF1UGxILjc8JZjGkZwzbFtNZqvl+SKyiR3uTs/chdyd6YwshtVLKdCA7yVKoR0L+RgoGQ4NM/PhghsMjmVZMRN7D87NifZGZGajE5OGrWURm0Dshk222sN/g58VBv2G+m6bF0fJOx08w2yEwzOXDDMEtDlHV+GzVbmQuCHgm6EF/0m9pnPpo0HVvC5ypNFMz1SlXLEJXKkyp2lUj97J7SU6xDeOf//SXdT1oyHLBXEWgagu0hVSLwPSWCoVtyK3Nwhcv9PCzXmymiABy6Twb+KtGri4rdOaYEguAfhBljxdVJNatcWxPp8TqUXROeKxEe3trcDVvJa00oKFyp9++PZaHJJoSGanlLWXlIShu0A+xuiNYSjqXuLtbHreVT1mep826rz/o5H5Grd8Vg20fFK1j1ai5H2XSZG5MFLEQg0NJRBfle6uyshh0GHv5+Ik6I2ONizGgyB1qPIOGHoJt8dodS1c7tyj1ULLaqrz0wl2Hf1bRUkZcy+8TkOpOHBRiFQjR/VfuQ4JoNdRL9rDPw1fikmKq5NTkuEE3q//f5oNBo9MnKNeiUbnkw2dXXyiDLveS8pZeqZaE9vtEdmKEHNAX4KpG/EpX5TbC6McQKjqT+i+BFviumpslugoKtj/jfmmIgXI/yQW1DxWKNFEI/xSpsUYTTj9q7k4K+ejk++Hz99VPbYlpUF4Srk6ci8rc/lI7RVPhK7T/6mkBbkk5BS9GRjIOiIlWqDj/B0YV+UYstIQ5bJ+qHez8FkmSRf6Ndr/rdcjGkUBnGOJzVc6H0n0myYG1EMDxEkmhiJtyovcao5E63GC2tM0Ood81Dl1tIDPwswlZXYDmrDjDzYAvqfE1ht/HuRJsX6udeGFjEasQrCi1z+PaogXyR3lKEZco+dB/mfGf30DprE/9b93lt4hd5dR0XqR10LyosE/yoiP+148RE6xSZ49lSCPbwargwsIXUA9gpnaZ5HXrOrEyo8yc63ZS/mVo/hdnardeaEHeKtWF+CP9VfzowMVCKBRIhMLdZazKgs9SOjs1fGrIhrIp5VunynwSq5YjZGhBcTQQYKAo/IR8GQ5ZtVI22JjrvZTUSZcGgwHaDFiqCwavh5h0Z5LZ0+o01Hck6uCZmR7xcPCrKHyQJjImTbylFfBJiicEQ5oUiQOmoIfsGA/DQgObmIjfZY8qqO447z/6ld3nDt1O7Het7V7uWhHKrsNC61eahGLRU5Q9SdvT6/MJNxKWFfv1rDi1wfxCagJxDecSptWhDP1gkshtjhIQX5F5NVmHNURpDlWUP19Zd0bZFwt8b8GzX1xWlHtod7yvraslrNcX1tKXnE3dWytK3EBhNhls6eSHCtkuFU8dvWkG3GHkm0e4KnRavNsdMlMigyQYSpDvzfNCC6gRZ/CYJ1RnuCEmtHkc5H2XTwVH+xDk80Wt0kBHpaa+W9LXtdH0Abw11/s10kEsl1KvkVk2tMua3qO3Ozk6a9YTTVnw+mwvJ2TvdMJX4obRqdD0KV2hww3aXfqsceEiEuu5L7Cq6l66wW1G1RxIDmoK/5xm3GfAPXN1Br09FmZdXaOZM+Fa6d2UTsnAERYC/EXuNc+MCOT79QIl596egN2aP6ENtVTZnk590EtsFW6bG7D1O+/RXak4cV2y7vkceZJ5NRhlk18nMWTDF0r4YjmSWrp2d0XD1ApN9+iKfBQRMlo9z7UjISIYRkSRkla4x1pH0qn3uzJGArC2bmUdm6dhL+3p9MvoT1x+XE8DyhsXeunHPpfib9eQ+SzoNpKi8glvve+ets/Ljzs/7gj5FouOcl1eMucIh5Y8QZ68oIx1BC59vylx7sOmB4pIoqlmy7VW2Wa18k56pcLVIi7fzcNukagyVe+pPo19VZla2l7kupI27WLlV75fTvJOI10HcbU5p2BfJOtseFjTa2jwCP6Gx1PG7RvJnD3EIV260VbGaz7kcPSA44ZUWg8VO3JpAWwrBYkDz7EkuLx0plU9q0dGxnhUiqlIWY7d4sG9WtyfG8/86SmMoFeWOV70F+j23D2FaSSLEe5cVC4pUxMJNpTft1L9873YvTvTjdi9O9ON2L07043YvTvbSA0720gNO9ON2L0720gdO9ON2L0720DdPpXr5h3YtUs0inoM20LNsqVoyF61OxyPecTsTpRJxOxOlEnE7E6UScTsTpRExwOhGnE3E6ka6PnE6kHZxORPfqdCLNw/xKdSLqjm3m3frvhZf68w7+jY+b4LqMyghNO8UooSALH8ZweJIU5TGhmPiu/mHrbnGhdw8n9M7F3Ml/7jfmjh52BdtZRNn1h9c9euBxdZJAiVIbqiZsfapclNU5bzlFpVNUOkVls8qqV0PZq2frKGfPX55Tya0k3YQxe4v3tijaBYQOiZ0YT8a1gORfLAg0l4niz6XCxigORdobKgxKWVeMN+yUi6e5kQiuxCkyvzE204ChkAI7p6XWerduhzp4fYOHqHQdd6Cz+klZaxeV8SqY91XTCZVwsQxK71EejhfvX7XpOzr1d/bF3ttHKkiSfMIl4+BI+mGcCSoMdBtLyx1xGe0YL+DUly93SGN0CdCCYlVBXZeuDTc2mjloqUvYLWEEe5U1T2j++IPSr6opCxGkW/5sFE/UUxvpVGLNevg9uje1Cvpa4HV6nDHucb8uwzUrYEV5r+4FYOCcYbJ53qGn8REKY/if1zdstYXlfJUEGfxKv2yNHx7arrAjy3JlOsOXrpMosIB5RYl4SUzC23CjwT94qt07YmmUHDcTiMVJPApW6/y2sX2BPfjDRN6GXYluOOUVPWG2LkJuG30ISMKWclM47dbFBOki4Aq4XWtpkYXPUnHVn3GvT6Ezwu3e+kyivVMR06Gr6R4f3QxvO6qHDqla14sxu61vjInJ+orLg/6G1Jt20O+wwCHe+i9keifzmVD/Gc20drSmgjKwPPAp3iJIZGIPSCrdKdBn9eY8wjqXGV8F6io/gL8OKIVvS0fm0Tk4jQ+OpCm1fCDUhUVZ+A7o2cF48GVroTZreVjKxQfYGYnNkyer2rHrMBjamAqFSv9Yq/NRiw0TC/zGWuwKNydIdVZJGpjWxgTpiKHLRuk1V3Lw1lbqs2BuJCjTdp5NjMxdRpRNzScSm61kytJw0mUy6TGW9JtJeqnDsNxqFsp/rfdqRcxman8Lhf9WedxalPe7TeBmaCK7T/C5NC2G0owu/uZjR4ZQeUujIRP/0eEgogpA0rlVps8B8lHzNh3ptlpw0LAazeswqoqrVuI2K84HCdzskGCK3MmE9fY7kbmTmC/vPhr9Ur2oxiLqb+lhNLsrbEpZVY+qQ9La4dy1Hk9J0FjGrNOyyRcssSk84k0oMxpEL1I/zkLpZLqtxIomWw8tpKyxUnPOVS9YMg3VW6hjFe4pxIMkmPaynYGloyLUmHAEhf0X0/7OgpRPoO5NeiIwI89UEhVilO6W2JaYi6xREzRcbLC1c3wLV4SPqmidbvcpZpvtym5pazruvSuArmdoy9papUCFVT1VWFW066Fdb+qLlKLAeAAr6k+SgmVuvXw9KyStfbdazNl0wjDCrL2UrO18mZXElrStQO6Tx8IlQM8O79JWxWi5UcEdTWlj4ISnywT55FoyV5PEQ9dYhh01jL63KHzoOA/gDzJVWCJWaHa3Q24WXAVpmLfqZGzRey7a8YQVUZRJBbZ0GuZwp/ggRMxpXzGFO+OlmCaz4MjL2OYA12lKkvXKR1/ygB2O4DYMZiGcmqg9rzsdfiAiQrRQFDzMC+6RFF+YA386TVK0W0cdOb1xVdV8GN/vPp1fyOTgJKIQ3eFL7D/fYCjB5ivQcHm24P9cefGVtu+RtFNdUD2VN1zpRST13nhcXRnyrQ+dyHyvKbJ5rnCpQzyOyVgU1KWqlRbn7p0f33pj1eqY7Hc6ST4fL7g/Y1zxNMkyQ2KKwi9AxK+AsCHZO/ImRa5KSfjpJAQikN4aDETrILQ33LyIvMMsCLxxDPt5zCuqh5c94SI3/iSMcEux65xM/0wMH8o1QALuJDUyD6fxUUtW8Q2ZasnA/SWIBU/Sw3x9qH0AU5lHlPkdEbbQv4s9v0qyJjEsDaZcMVXxkDb8Wne9nvbaPN9U7JHo9NtI+OKcApxTgHMKcE4BzingW3IKqE11qnZwi/Dj3AgawbkRODcC50bg3Ag6e3FuBIPG59wInBuBBudG4NwInBuBcyNwbgTOjcC5ETg3gmZwbgTOjaDaqHMjQHBuBBuvgHMjcG4Ezo3AuRF8K24Ed5W71N5HwFit0oXqzPvOvO/M+86878z7zrzfwmk5874z71sO35n3t8COM+87874z7zvzvjPvO/O+M+87874z7yMMN++P4CgDBZmGkTP9MzjTfwmc6d+Z/ivgTP/O9O85038znp3p35n+vxnTf/1yb3zNeQjcq4eAq3YR7rrahattUa1tsdOiFvRLrZJFW/kKUbNiCYTuve4Su+AH1WIWj2wqWAxyi5EilRA2smK6xCpkHwMqhXP8EbcUtl36I5gdvwJJGNnh4zdwZ6jaRYavjKD366WfyQXmHfDR+KVGwu+y+oacaqezTOb8Ykrg/GKcX8xX6hdj7Qwz0APmfZBfJ+mXHv5MUpuY38YzCTek8D8c6v8B+OUt9BFuCgvnj1bpA2iQbsiwbyB6kN1Wyhx+S+mU8Gy0exKYyt0fv//+WfN7Bsv47Lt26aqRbRRISmY2ri8XlMaI0Z6iNkqctOtlCLfbx2Qmn7Jc5EdRMm06PaLTXhvoNJylf4Y2vnRYl3uNz1am5z7Dc7fZeWSMtAP/rYZlwa69SlZ+2KJ6Kq0Dv8j19vCaFd+3OHH0IEB+vPX6i4a8z6cf3fo3NT/ciizEmI+RHwevxVXWb2KofWL6A5VuRVGdt2HM4prC5WO7ntABYdvAbEPjQ0ntEqRkyz2Gr3IxyVjsLUk9M6aeqJRnkW+jLb+2I/YXknZvOoxtCXP7rhsRjhp+xvFuusPOgvkmzqcvy00IB6tkLcxEaQBsWYBRAeR1JmXpkdJkl63OyySaNR0i5jPYQoA0b20IUGwzE5uTxkGv+M18CEIvV9AohjTiBPeDEDW0HZ2m3KJg69mcpAImWW8LduR0zoMgfpvxHgbToCTrwLYD5Pgz8SOymGkgnon62Z1UU8tE6EwCXVyRl+D/Pv/w/vgviVBlo6kqy5gzRIebIyUJC6bxnKyIKz8O58CMj0VrgM9fvvtHG1uE1cCFDvcIS4qzPVeICnK3haIavWqR6BgNFNgdMcFrmkLufyFa4wvRBJW2bVfKAdUZ18P8DQnV7wfeIXvcHOCfBzwMJRSahXH1cNjtNA0XC7TMtHRH5BrZ/yekv557cWI0EYvqu5LfnNWGB1iEsZVx0NIVsKLBjfcdO31Ao4ClJ8KRILuF72+4XnsC9whbJWB2S/8q8LIELZlBFI1YKJh51+Rb2dKPXCL2RFz7ad4pgku4+PDqgygPjFtnEUvzKnQJZIatMabVC+Q82hIwTLadSneWeYGy1UaHs93hyO5clt2QuqjEvcmRlphodzCyw0TZ72gwJrRvHSJjlkwzxAOaxbPj5Aov5eD6GBlVVAvjph/x7sqOSQV5/Cf6z6YTZ03qlrPniur3hgLsPTveBAPywra/I1vxcF5lAqQiDw6tZLlIY2dQ9ZU/Y7Lvx61m1Ts+O4hnsvpOb0eCgxoBARopS+C0WYzoQWwRbkVcPp2+us8TBaPf4EDtzIcWZpP60ElBq7YhL3tabYQVl5vwsCbH2sTmVXnY8vgFAzuVqvXYy3xgrmTPjqN1HK3jaB1H6zhax9E6jtZxtI6j/QY52jV6CTbgr4S7j/SS4R5IMVvrlK5Yww9KmGqATUT2pXm1zNB88mGNIg8t5X6WJVN0ip2JaTVYmngekySJAr/s0r5lGMeQ2I29BmwIc1cpcGPapnB20RoaXLRGBVy0xqYTdtEazYh10RoKXLSGi9Zw0Rr3najR9DM4xRgAP0J31wHOLMZXijsKtQZK+aU0jHnpZ7AaAe4w1cYQDrbqJuHP+sK8X1bf7xwy52iBt4YNag77FMQ59gZroBK26UZsTuwbsy9yAK17e5t8qRibN+PBNW/e05x8xK6zkpwCR8Cg2cvkGmg+HOlKi4ZyfGq4mwD5zdaY34eO9ib8rp+z/NzuljYkjYuV/1lZ+676Z9vDPA3IGrCSqVv0AL3altBQMSdIw4G3ChdLcvzydNKvbtLSkQ/HPBZW94F5LpCFDNKVPhXIwZQWuX1yqAsNiaemnYfTmdxWDpXkFLpn13y0emdfmlXpcIhly6KQdWHlKUkBGhXQ00YdufJdb1nBNhrROFDR+bs2uaD/6L8ptSAlgCBTWdPSQOxTPwcxE0YJi7KiCAlMESHkp4aGSSDl5D0y0SByUGThUMO6Ah42TZHt4/7bJt94vMTkz1pkBOu5C350P1PPky9wUbHVxtzjzZRskforEB1BwqCIk3Ua5C1+8B14qlpO+6+3qpkULziV0MRQh5Rbbp5C56ZuPp27iOlUWQApXscM6hTvNoyW0l4GxmW1u/BNQAWGb22ySynuq+riK8UcapXYbKnXmwq5p4ksvh4vxjJE7cg7K+KY/nFBZJrk/iOP49K8IJ8O2GRff/5q0dMOk1Z/7QGDu63MbRU96Gpwu2BEF4zoghFdMKILRnTBiC4Y0QUj1sEFIxK4YMQKuGBEF4zYMBPnuu1ct53rtnPddq7bznXbuW47120FznW7Ai4Y0QUjCnAcreNoHUfrOFrH0TqO1nG0jqO1wM/XztF+I8GI8CxZJ1HSW6ircRvQbQ3bz19nhS5lK1usOq007Y73Hy5eP0fH5zBTGnXEURCTo58x6QvRahMPG/jEli/QIDKPfOZBp3l4hT9w4vyZHBYafjOuc/c/G9GMl7poEP65DBdLYD6CG2DgQ2Qp/Yg9FZGToPiSMBdOxFkunG2QTQiRXcT3myxs3fIARQDZWvyMe00g6iV+LhlU5EbQHStocb2kKQvMbsSi9Ls8dzk845OJ2DbKfb3bkNWPP4Rmz4rWYXWWyn0n2pIuWbJtsygk/S5DseR6GHNtj8/xvBcgRxSxCADFG8foj0rOzkwrH9wD2TohJzj9pvKpMfdA2T+sChcV7lVWfqSbbsYsd2NwhnKdBxFrHUnvvWZQN+lMcsOlTQodv2OkeRM/a7NFI9gUvm6onNH64qCQBQYrWzXCkCLMsPp6zMI6V8RK0zCjYrAsJmK4A/p/yu3gVxQbHEDa0xv6VU+QnAkXuBzuBBIcqWVa+TSAKcINZUR4KddOpDm35D8Ag+7p6tciSG+JimOrOgyZrN0Urk6BgatkFs4pFrn1+ipDhZlo5iUwPnK0AB4BGCqN4M6We6M7GKKOgsYSHtD2esdBMsK7D3ZTZpSZ541TYU+SdOGjuyO9J6uS/LNvYx1SvRBeaipe+UStJ4zhlosdq4ryRCOxDLcMczV4oZ6OuIcunxpj8gO3StRV0ZnBapdYvCQm37Et7Nf5TLQlL6i4WE0wmnpeodwYcdmJM1GNnekN6jvC6Kh2lSl9XiZYC6ZHMuxddy6H1Umw4WLIHxMXW6xw/4lQksrI9fbwZkmQlTkseXkJflNea10T/Rkpj1Zj+QsMVMqF+q7pqsNhRf70S9bSmVDwMeak03W4iJFctw+k3wcFoc9BsHe/IeZgeV7MgehvI/GdGe14QNZw+KSB598l3yNUu5KfS2j9VsCzUIwxYhl5naOWTsorMA9TXBcOVo8li4Xe+FFyu2ryOmawSyHRQ3OvrDUOyIr/TZGWqoK+Q/7pHQOKwNDaNsv2MzdRF9Tg4mW5nYLAiecQVwLFV+Ir3D1TjpbmLaQ8K46dl/aVXllL0viu9mG5GnzDnumgDIJN7ZwMvdfn2jjkmq5NQQq7FWdlvWAgfYLkR5EgbIyibAvz0nrJuXTLdxJY886tiM8zJTsDy+jXRylvgmvU0gO+58H0dhoFlQ9NxUVXqJgGO2a/U1DWMIxdwvgbIZlUTSm16fObkm3SYnbTWvRxKuVkPcwsGYE6eu/ypAOZf6lZruplYhlWrGPUjVxKnzxUlI6prcv+yxTBmnvtF8wZhi7bpkJ6bVX7V+ru5PXufm2PBYK1JCxe30BgYbBeeIahy4qwXwmZYY9yMsNdScsMdyUzM1hKzgw28jPDg96U+5KrGfYmXTMMkbEFOnYvaTMM2FvWr7YbkzUM3RPvhW8E59cLf0UBeob3K1yfqRYWWzk9GwbBkMxpUxGRoxyA9S4zgydpYN1A5MYR93Z6GGAIvOCG4SNE3REGuz8ZY5zlFKPpFaME41pQjyQwM0tBCW0CZGluwlWx8qIgXuTLNuFPg9JDcLjS0s+WdIwWQXfOQ/G1LQHoV8MwDN0O7SqZEocOhyCJF8JrKhcceP9WaNXT1Fl0ay2NdzjjgEYxmn8GafLEgs9oUuBQPjtxc+KGzG+9Q8olprIuFHmSTX0gSE/Y8ocsUhbK/DXMqKEEgXPoHYSMHSd89GHPTufC0K95YeiOQGMYMefe+UbcfSQH6B7bo+U6G+kKamoe/kgqO1qMzg0duQS4nkuAa4JLgFsBlwB30wm7BLjNiHUJcBW4BLguAa5LgPuQEuC6DLIug6zLIEvgMsiGLoOsyyDrMsi6DLICXAbZry2DbNkVQdxD4scjFkEl02YkO0UJtSjFvvillsTPZiJXdFJQzi2mepLzsjZ8XUPnw046+0BT8zZ4uhlRSML3Qa9538qVFcg8lM+l32qIkYl3JzCxE97EG+TdHZJqVzbgcuO63LguN67LjUvgcuO2tOpy4/4BcqO63Lh/7PV3uXFdblyXG9flxhXgMom5TGIaXCYxCS6TmMsk5jKJuUxiLpOYyyTmcuM6jtZxtI6jdRyt42gdR+s4WsfROo722+NoXW5cz+XGdblxH2xuXHbj/mvgR/ny5TKYNnguNA6wO0turVUZiqC27JE3CzOV4wQpWQoyYUebRki72W7Jc6IxAZLKt2CBMDukIfAsulMFDEsU8JqPshglee37TTPWMawymF/Sj9xPF0FuuOZ35fxFOJ2z6+dz733S1JX0nxYdWTWIhzoLcplB4AmI4hZN42xDom5SWCG5rdEzuwRixQ3qXkqjxCNqGoDRFYXzxhgLt8mE87QIWiaJSTB0jCbsfaNpdUmRfM7bF7vv6XCCBnrE1iXvwEuSqGEIdI6ap0rzDKVjti9D2LqzI/QFcEhY+Tef4iX11hoMygCM4YcGhZYJI+s0C/rdO8jCDFdykVIQbhpwEKnAHQnYMo0JHlA4bUmWewfvDCwc6DhUzsJDue96Oj2QCXsOZKooTzTXvUwlXgzQNkrSEWPkOW2Ljo8x5vAcaEZerNEHOCla/AkkDMPi+1rrxh1AARmU2IMzwVAEPZKx+u7t6SZPVEy0JpdeIdeCqWg58xqODBYzfpwbZKOvm2WaFAtMI3ZJ+fA+Ch3m6SuVFK+PVCAboh22g1xpdIzg7hVwSzo/HSfQocyVfTlpRpKcPM6qSliKfTQzKUh/b+9Q5HenmGRFFvoSvYzKXgrUIbQMVAxdf3fZj1jNfUxJd6Xy8ilvetV67xKbro4nT4HdjTGQsC8LDdwht0kBxD9bUoiv4ItMDvtInRhWhcoAeVb3PbWh5L1k0iB1FyKb/y7pwVm9+Ua7hElxLaoKIAiDAqcmjdtD+/pPaPU0RgGmD1B+QEe8r+ZwTQezow6WVMirPf0xK4A4iINrKYkot285ebNwAsXswv+hQDUvoUrINjLBbaM/nAm+MUzWeUfhFabCLHIkpoYDdHduCYF/y5R8fSYcE7Yz55gwIAVgj5mndXxWmQL3Yf4x4f5MQSbcp1nIhD2biEzYo7nIhH2ZjkzY0Ixkwn5MSqX1sScQ7aYmE4bThiEmKBPu2RxlwgAs2mTd3ASLQ8xXJuzXlGXCQKR1mLhM2Axzg0xfJuzVDGbCAOxZmcdMGI7DuzKbmfBATWgmDFiUVtOaCcMXYoDJzYS9mt9MsMaYdVrjISY6E5Ti5GVHFkwThi3Op3rzkhEyy3SUspSJjCAqn01PFzJ9nk/6rUrOPDU9yspu9sHZv1YTWUfB7+kGLWRT4EY+nMHpHQdjcYQbRs9VAVhalEPS4+jspjcuDGHo8aivgRla5bN6zNCt3Ipk47KeESXTz1ml19uZUVcJ25b6r7EouyR5bFNvtPQxF3KgjDkLkEu7FNCiI87SQB6HIMsGlJZR5OZE3aOMYe/eFf2KBuvc893p+UyATf2WMmE/905shIkhCe1zG8XuJu12JPkz4e7mZpNnGaEjj135Nbst3Zr7zgRrMt0Xssmg9ucZCje7pMcDTB3lTOFNFo6SDSMzTRg9o0DRnqV9urFJgoM+Dj6V5n0ANBtE/wz9QqbBjBgovII90/bSd4JfL8bewS/PRj+AQD1iUXgV+PKOMVEgTYESBSp7Z9+GO/SfiPRVFD8sidEzwyihsHcIhLVPOX04qbRHFqcfGprrVtL5OabzeO79199/+eXp6Kd//PuI//P3f/zL9upjix1/H2V4S24UMsvru47avB19hvW3LxpUtOUqV6qClFTMcm1bYSgH1qGLPqB6XMxHqmeqI7ifWsJtPbrKvK4yrwBXmddV5v36K/OisMD53DhPWicrbb/k7+vNqlxEmJIXC8FUkiEyP4J3+GqdcyZoNE7SWySxqWq54nrr6B7TLsAGm3NxHvUFX1PpF+FRNhMDHHsvtN8CbIinPBQkQLfqJbI1kJdR0JUhvWYizzCd56xji1gcOFqk1A93vkJGm5LRyBNMRuqvkiJmTQXfruVCxWq5QPpFrX7szbApNolQpu+OnslNhJGki/o8PSI2ldNEiM5IkBVUgdo3yvqgJoKGFoWrUJDVrk7Zvbhp0rrMKPECl3g0p3nEPXqjkZCaLrddwM+YRBIORQ57ccfr2ND0lst57YeU8Y20DfDginroIkns+zejMSD/Z73Komm10KKFDVfaYjFcMXIEV4x8J8XIPeg4DZG9tN1Pn+X7VYZnCgJIskKOZ4DMJt321sjXdG0xO8lFuqkP0Yl/kN/UODjxoJIatQ0itOFodN6D4liMU65QzwIJ56HqCnivgX7VmgqzWtbYPgW8p7ZKyb+5IQDgkhWAl7bIG6bn1Z2/gQvSRie6SYnRV6VejNyM7LzCYfoKCzJJrIlfvL7H1Xbg98swjoB3uFQVsazGU3Ypb1QTeJec21dh/dITcQrSq8bnXdFVvtpqMKIjscUuDZxw+xh8JUVpCkmSpYbUr9Y7g6HsKLiCNn0Ql1Qma9kamTIuNcqzl6J2C7tmX1JRm4adqlH2yz/aGSsNgzT3dq4XlV1q+lXIwdmgatDI6I66qwP0mS7ADaaAPGQePDf4D3mLisAN45rGd8w8zVW9mrnY8mxaDWGjGuHm6H8O2LMLy79gvaJ1iHs/Ru+E7OpkjC6BJc9DQc3JV5BW8UjVOtIsz4j1UrjL+6k1wtJP0ZVgptNZEwfdNBj2l5iqHMZwZmfFVPr4cqFbrt4U+rUh9ZeURWCzrartt04yrjoqveDihHuwKnrPgBlbTL+MZTGh0lSGMT4LF9lxdcDHkyiZHM+eBk+f+Sfffwf/mM5mP3z/08kPPz0Lfvr+JAhOZj9Ofpj9dDKb+D8er78sjqfp7JgKdf1f8tEaL5I/vT15+uPo7cmJjaWt5CAglX2jgmt/jWjKWW8ECYK9Ha6noim/REdsn+a13sZ6XsBlBBHjBWpTtgkTPzPa8YD7QBac3OP5d0lQhEOwDAJNSAZZAYGhmmW5MM23HYCyFDEPU5QtYhEBJ00UM1UxuCOE8BW6DFBi3Ofmdbgkw583L+IpMQc+p01fJMLleYK2klVypW/7GM6+4RfenYS0uwhmz23TI4rYLZOtfFJmf1saU0wxKexX8AlHHShTT+n66BkR3QlB1sVNNSO3U1iwvWsfinCwe6HARhiwFwKG8C4Phel/EMz+3pj8B8LcW7HOfcz8Vky81Qh6mfYhG34DJv0emfMNmPKHwIw/DCZ8h8z3w2e6t2a2+5jsTua6m6m25H/bmOgr62xTaPJoqBYlz2J77pteSoT+19DaNmzdz9xEPUmPtn+hwyh5fAiDPFUNxVe4ezZitDRvkeFnQLaWV5pBt9Sqv6t9yLG30uG6gfXv2M7i6u6cDL3Xp4UecjfUpiATHVUK1egFW/spHAoq28WJSKkI97y0XnIu3bl9JHDoHLciPs9U3iSkifVRSqPUNYbZAb7nwfR2GgWVD02muKsAogZbFXVHkiQNwy0BwqutGiNZmz6/qaQAlWKpaS36VSyMf/ZRYlcVUcCcWWGF82m/KGSjPkBYcXCMbuRS1mOgPBDU1qWdishaGVoqPb3rtSuV05VrWCmja0SSZ/VMPa2l4TW8Q1GWV8gn5zjRaKWWr+Esl5RoimW0qDVGh6S5YhiK1rtIeSUmuXXiq9qp3KX9yyYRFsMmavt7SIrFsPPUWKrZPSfIYrjnNFlq8vtNlsWwt5RZDLaJsxjs02cxWCTRYhiSSqv8hXV+iU0O9L0k12LYNMUWwxaJthiGptti2ATHe0q9xbCnBFyis+3TcDHcaTIuhj2m5FId7iUxl+xtb+m56h1uk6SLYbNUXQx3nbCLYRAxHpy8i2ET6nKHibwYdpXOi2HfSb0Y7jO1F8MuE3wxDJEKaAQDkn0x7C7lF8NAfmZQ+q+GEVseIIR9pwJjeBgJwRgeSlowhntMDsZwTynCGO4jURjDDtKFMew/aRjDYBJjl0CMYVPqsmkyMYYHlFKMYTCObX1cETbF8aapxhjuL+EYw0YotUw+xrANXjdORMZwb+nIGAbjdnBqMoZNMbyPNGUMX0GyMobBS2aVuIxh02XaMIkZw72lMmMYiE9rh16GTZObMQxOccawyTLuId0Zw56SnjHsJfUZg1UcG8Nmx2yvydAY9pYSTXS3j8RoDEMVBEOSpDEMTCfGMJi4D0qbtnkflinUGPYzc9tgDgbL1Gry5SHHxCrNGsPAy8Mu5RrDkMRrDHdsErvDJGwMe0zFxrCHhGwMu07LJlrdTXI2ho1TtDEMOO3WZ6Y/aRvDYHcZywRudX86mcVNLVab61n//tt/gjSGIfekdbI08foGOa0Y9mL732cSNYY9plJjuKuEagx3lVaNYdBVapNijeFBb8p9pV5j2FsCNoYhadgEOnafjI1hwN6yv53C+Ax9Dc45i9jOL6kwJhcZzXGJdGUkTbGqjAy8wIhINz1ppeWD39vFRHhL9C+O6bDw1DuU/ShXPC21Kb8KZACzBG1iWXeiUQbS+cFY+jgfu+RADPY+aDY6+6EL+F6YzfCCLuLwV0weNUMFIojfaYd/7IVVNADChZmViggEXVgcGlXrMjOc4BtiBR5nNOLeTg+DMXDNU+VdhKg78oJ8+mTsnQKR8LNAGyjRrZJ6JNOkcAMVLLT0AYtIsuzPmqD8WVh1tPSzJZHEBWmfduatPSjrIsPgnXG/GRgZ7jMPI8PQbIwMwxbSKjMjw0areC9ZGhnuJVejmPrdZWxkGLTIg7I3Mmyy1g8hk6PAzsPI5ygGY7tU/bkdGYauTXuex1KsHXCKQFaFx1MuYun6t3pr8se6csA69aMnwy/EaE761T3NKSHRMUvKlnjN57feIboeqUgmv8iTbOrD1nvCHBYqETjWWYaocCAgTqB3EDLJAyGjD3V3w6jBPkOZpzdaYegmuijH8MluZJQ8/Ae3LzoGBDdhRgtnxKhZeDuRJ2a82+x/hoJyD/62Og6KQiglhhLDXxSwspHukfc3sj5mU4gIobARmoxkOi1S5ENCwSDpkFYdhwnE1YclFOfzPLDTbgw1HwH3ehq/icLF0tpQYx09gzA8gsb8apAtaFMfgXcaBdpizBzsCm8SuPDn/NTYqGotl/56jX74IjcGSgt49dh6ViOYm5MU8txmJuM59RbQqlRSkbPjBo7rKkTnE/TCDi2z4SEk0SxIzR3mHRZZAVf4rSfMt3KTqgRaai8/QemFok+EHES0hScyaPaczgNErkUQQ+ORd4jsN27/gLkQE+tPjppMDWQ2iK79W1vXCjwnYZIC24JRHWKOdMF4s+Q6No8smWRkj8mA4EcEc2sJZoVCGtAddx7eQN/yVkW3A+h0CnOGa8zeR+U1e/8+l0mIQuIfRCffPf3Xo+oOMpMtk+yVKYsLvD7E7ZTpFHkzK6ZoCHJ0GOdR1WRHfBvvKWQotU1pAqypiGqQXdrZmBDwU2YW/GkeXploeZwZDIQt9reOZhuoLMZlg8Y/rWd3GZnCnXgF9SIipDkNRDb2PgqyQGQqtNsrNQ7zXNy5F+gI8p+yR57WXdxxvM8/JrBdrMJD+ZvNLpNXRl9KGUIJtvgnUm+JZBV11hv2u1B03Qp2X6tI6IAjdUI6BfiypxGfKUDB0DkdnAGfkqyOvIP3wXWQ5Qfwrw9wF8C/rBv9mQOZtUSBqdPR6ngkc6qRHFfCBxBzgxIJZZ9ljwFQSnumgydo/Tqjwfp1xtUQF5UhnAywZOdFaucqgfCt8WMXRmBtg5+GaU3C3FuzIkJ9/SS5CnqT8FWGR1dXvYtBJ6tQOin4f3+SJVGRK2H5MLh57v3wpHq9D7ll5TD1HYhtnjz91ycD4jqQLcBRihRkT9ENhtxMtJkDVS32Lb6oTJTaj6aU82nGOjNjunhb48XN94p9LyXN6o54omeSJ0JJ1uSL5I4CJtA+4qhYe+FKML3Ck4adfsq3aIaB5JkIAlNqLFK3WXel92kScaQjzkBti1lCqxvcTDHzw8kz4uXk7rHuRB0B7wP5I0XGxqNgJfKg/CLCPOsotO5IoRpRKBy3joDIZ1IoRhyROrKBBKRFHA8J2fMNlaAhdYvFCTUHXEHbYIqwA45QZLNQB9PdAr23QGGQsdry7oOYb3zMNiHmm5NeZB63vzSINxl4XZTs7rsm5EiktibkJPZDq/+jmQDYUHnrvvg2ECS2RMR9mfjhaIezUtR1nghVDWwKIUQg9a1fhpoQD1AGmJda04k1PCpIacTZJuyn0kK32QO1ZdkeqiRv67a+CfEkqZpwoZw4vRdi4Q0ZsCR1EzvxIWZhzbZ8ixbyYCUGC/G28tyo3LTVF3Im1su2W39fi3JdDBsU7eqdUoNSwbZ+F8MQ7YplLa+G2e6qohfDoLpeDHceFfVQkvmX4e7qfTEMD18aXvtLfrcZY/lwSgK04eEBVANj2HtNMIYHUjygDBuIPkMyKOyoVtjGY7WuG9Yw2EGHb4saYgwPoJIYwxb1xMyZPIyqYgwPo6xBGe6gwhjDwy95UIadVRtjGBqmalF5TL5qU3+M4c7iTi0btkHCiFOhd77Rgxyr0fRPToi1H3EXDitaQJ80lytY86M+duVeChXgsIeXKMAZ7aBGgWyms0jBR3rpD1ieACfeWpigaQVcZQIBpcoEO1+3SnUAsYDy0JdrFGRmEDAv2gMuVGApsQ/W6PRfJw8kgBuPnAvIfmixry4g2wVkP7hN6QKyy+hwAdkKtgnIJhbBRWUTfE1R2aYctZd4bOzQRWIzfCOR2LikvQNpicYmKdlFZLuI7N6pu4hsF5EtB/NwI7LbQrHXVhJ6Xyy2pJYuClvB3TBmD8FRhxbbueg0gXPRcS46zkWnG5yLjgbnotM6WOei41x0nIuOc9FRrzoXnU1G0ze5zkbaJ9I2/JGs3Vh70tpRy4OmGhGlC0IQyHMudGEmLkgmwsJHxQyNkpflg9zOVU47SsSUx6CLnsgByAw3wtyjx2C4D9QJSqvg0Nyd6o1K5mFXShvpm/U9lb22ce1VzhjgqWiYTYSuj/eGbZBfpD7QcanKbdv2ttf7W6pVwmqjUhUW1YuMGkRnG1HoBPOu8AXRTq1Nb51JoIPiKMtKREZg3RtXB5yNWffhq6uCCCMpP2K4WmWAFw0XG2w/iPAWrgizoKJ1ErqmWIypi2GRqgRkREhr2PJeL4e2CrLMb0/TYLtAL7xlAQw0GaiIZxbtos6bLKQYuRnkfgjMgj+ReiC9fD0rxBhi3wIPdf2t+vPeCcMIs/YUbbbzRZ0it6S0RmqfPM7oBBizIwkBKHf00s86eFBsNJMl2XBj4ISnywQd8mRdpySlLVetUK6Ni96i8KHjHAPoO8v5VhAr2KvtkJsFQOvDvDVBjS16z0U7WtIjvR5XzuZ7BpGkKNwZLwVylEdexv5GaAnPEF8qeBM1I0YIbGvvdPiBiIj6Eop8h3nBPeITf5rjOU1SZPG77Dm4qmo+jO93n84vZBotVbzE42vrP9/4Ufsm6V+BzjpKJfyLa7JarOtIOixepFgOioZz5H1i9m/jcXUFi1ofOhEUqimyea6oWi4ex2QsqgkTl21x7t6hYn+sWh2zOKFtqqqKIK54CnKBukMzKi7svZAWfRCRilyJSdppSXMPrYPQart5EXmHWRB4Y7J0CWWCbuIJ69n9SRjhliKr51SoJJAahKt1ksLubfVF7FmsLl511HC5N77WWg+qtZ5TJ9vZzrMKqelj5McBeZz082fl9xXjFOoCzvCCt8Y3lNNFHZc8pAlIakEtZUifd6yt25XNySg5qKLDr7T0nGvJ2uT/Kt6zzZvkVKREzEy/JlIdaNqocktW/XF9ZWzBTZ2seaYROr9jRgo6QpvwlX7OtUHbdb7D3Nks1FflOvSqfw5CmKcBGY1W5BWJjLZ+oSOLTBjPU185V8orDu4pyrBYMCUTh7D7CHcIeuaxsKK75rkwM4iGQi1dXuT2yWEOtZB4V9p5OJ3JbeVQ9WU26DpavbMvzaruSO57WRRyTeHylKS3HxY6nzamp1CKuJYVbKMRjQMVnb9r47/7j/6bUguS05aekTnp0Hmf+mh/h1HCoqxgZ2Gx1zASckpDwyT4HRGXI5WeKuGnGtYV8IppiuwV9982+cbjJSZ/1sKLW89d8H37mXqefAEujZXB5h5vpmSL1F+BiAacPBpx03UasMfAIDyVN5rN9XZa/0LeByW1Q7nl5il0burm0yn1LH+hNLjNybDL9tnaByraAxc0Fwl1mdEX7zaMVoQmdYUkGdb3H79vmVSzvX29BPZxk136ET80y8ia4gS1Suys9EyYCvmiiSy+RvfCjwEZFI68M84dduRdEJkm+fqIDgVIfUE+HbDJGklU7UdGvKH1RR99pFvGL8VEscUSWUIa8X77/dFoNHrkr0NZ2bys7JeFwK9OHn2Bwwy3EdkezkR72vb2yIxiqQVgGBp02DZjVGNPihDzQ1Pjsuurp+OT78dPH5Ud5aUi7mYkBiNPwHP5aARjfiTMbZ4aPCeXzcYiXmVcbecRivTYxSJNivVzr/U9blmORjivy79HlUF4HiPqtRzGSxoGPcE4qb81PX0bioSfayCeflSfBC/kEsSH93ooI3yNn8DmKSI/rX0IT8l7/rnhTSHQTY2MSpwZEcSX6GwVqy5Kh+lC5LjjYw+9TkUslxD3mybtef8NV8FHH+vijlWQiPwKW4TNuFqLd3kNXywk5eMNr3Lz8OOrEz+CU8qWE7ZTyY0Nc42Bmf787Lz0c4UoVMbZwJjjn9W3SlqbZp7YOEilw9xNknDA/FVJNy4WStvipCeCIlxakxy3hLmdI31IlSoVdgX8mdOFu4gpPzm3ncloMEHdaSuwAZ+LT8dV6o66qTSg0NQiNtpj+bw6joZq94swl+RlmqxWBRCSW7a1IauepNnxDL16jrNwMfJTYEzzgO7EY0DyiCYSs6ffavYnReAaSGiNttIBHbA8eGQFh8oRL8xqqFWQiuWz1+cXZtRVKANFjZumbX0Qm4CeQHjWK44WLpZ1EsbCIzMKSd9VTFZhnpEoEmTkiFxt9qUyy3I6s5pd9LRD8XnHa0UW0BEugtVqNYdHtlmiBElvWdrKiTaFcpncrcSMNdMzhg6TFC0Tf9Kn9DBeLfnUo4MYIxovHB1TqUbUxCPTXqqzGN3i+9T/cxHP2lKBlkf7gl/lw/Dx9TvYnuws8PKFN+FH7BYgePQWMVK6wEmPjfLMxDweZ+If3hQHT1rlFrFbcpCT25asbD0KBWH/s8BAqxL0XJgQCTNpQM7k00AS1b8pu72yNdYumdblY2Bfkdc3wIxGt1ITfFmkEbmAXYpmL70VhktPlL0CT35b0YTTeeMISLXGfKysNK4UR8KYdpsU8kZBPYLqvXnw/S6B3Y5SdceohsQBYgjtymQLpRKxeWu/bSc0joXeNwfEP+xwVGtknewG1OmIhSyYiCGWqj/v09lbap+dtueqMIuw6KESUdx5axRohOdNh5oJWCBslEyxPjctkqqGuZLc6fz7VJt+Ht7IQ7JMki8jZWbDT7dDGzDLO0EbtCPXF9uU6QXkQUbNxuOMYpMkI2B7phHMaKLvv3/W9SqNRNvEfaafPCiZRfhk9OMPPzz74QjWCI9seBV0JP+183vv93jvdqLpcI4Z6RPTQbdbtalA/bah2bj5F4AhodZItNmyaRERpR4p2P10Rt8i+lqaPrwktjoA1gk3xnNco2Pc0pety3EHBP5C+j8G6qsD4ugOur+5xDFfyq2GjCTdaKxtk/teXhFhKdvG/8TD3aY9XhpXhTSSs2Nj+3heKCIiidbRjojVTglV6/A5BFJEz5DxkQzguKYTP4Pv/QK6piDVA3zwfO1n2XWSzv6fA+HG0jZ8jksde29Sf7EiLdbhwZ/G4/HBE0IQJVUw0xcdHvwv8bQzNYOMdw3Cdg+dTvLbcWjVaT8X0fqbKO/eVxtBMyv5IkhfDGSeKQe0WCx2YpUiMuK9UVeJoW2yhdJlzryan8sGVuwPL64BHkQTokzaTsIc+nB4b1G3Jcd+JBhm2SQOuzW7RTcjRU28vsFTofQ7dSjht/pJOYcXKeHUBCWVXzWJsRLY/Ua/R3vtxftXdQGUoTMIx97HqX2kQm6XTzg3BcitZHViVcUR5xVisuLL8mzi5dZO0yASho2AsrDoBBhtuLGJjIGWrJOcUS4kqZLH+eMPKmZSTZmz/XRHfdQVCKWnNtEEEmu7ytGmVsHQ0tM6Pc4Y97hfl+FaXkq0Y7sXgIHrVcnmeYeexkd4/+J/XmPlUs5n8ioJMviVftkaPzy0XWFHOMEwN0/eF0ZCFoEFKd8pTMLbpzFePDzV7h1hZi/A5iUDESfxiH3RmtoX2IM/TORt2JXohvzh+AnrPrHCrKqr6Msiq+G0sxdKTsVhS11raREVaBlc0++q3ud7PsLt3vpMor2N2epzROgeH90MbzvSFQ3x6OjFmN3WN8bEZF14d/yG1Jt20O+wwGGaYdYHNIkA92c+E5yq0UxrR2sKbYPlgU9F6Tx0dIz4TqH8luWb80jkZ0QarNw/D+Cvg6OOMEDz6Bycxgd8B9UOhLqwyCfxgJ4djAdfthaOXC0PS5EngJ2R2DwYwFo9dkCKkd3dwrmqc7v0b5VzMQClT9VJ0mh3iDwEyGfrIqDILzZtB/EYyw+CCAfvn7GV8LU2kTaxqCTLqYEIF0IR2TwLYqlD6A4ca12SZsIxKimerbTlfXEbVX05O6aGZXv5LjTmGwdxlEfSFMdRGZGL53DxHC6eowFcPIeL53DxHPYr4OI5XDzHHymeA27NGQYb9HBofxWvlTyZ5MlWvJh6SzHWDQOlRAL6m005t2qn1VT/4rYk/k1MsnE9Rfp/HxgyrIeZqkTYpGJOgwVu3VQmQLAyAvYxeMIdu7u4vO2pfmM2VnI2Ed1QGQMShKTCuo46xcExpkS5AhY82g++qQjHYaD1Bu9BoMsbE7oun4FWjwGRX9R0HKjOcQuGh9yx/gq7wWpcZ/r9Frc/c4O14pbtB8Sn1JcLd95WCuk2h8aOeRnejALr5GDLGnLxgHHfqWZDvGytdV12LEZt4LQSDa4ly+1H0q/q04hufaVjG/Rr+zjzY0/WZ2sGodRaaffmMkGs9BJGsikcFztpix31OHkqhcEO2mHj19Dn1dB9Obd4NIxMIrC7q7eigEP7HGnhMPN6U76PxtHVm+AOoaF+XZGLO+iNOwjX/myG6mCQmsIVfLD2V70xB80vbRRwcPrxBff/EvunBzreoPywFm5QGTsvn4opKD99pEIKlCEembctogrMXGeUA56VrsmUawd7onfSO4l9ZIQUcIY6+OwsmI+Nnc+rQgkwjUThNVpdGQv5eu9mLLgs9bH8Tf/aN5a+aAtc1PKCP8RYi/LWawm1KG8xF2lRAhdp4SItvrZIi/Kp7wy0gBNVfts29ZcgtD0KiY/8VotnPtF42gOiNgkORlL5Bg5OC8Aif/ZQLy1Ypr/Q3d/Il9ox4EDFqI2yfCVpqToXkwDPi5pya27E03mpRWKupXMpq8DUn3xCpYOGdP3EXYxqdBpHWy9vyAfvVhT6gLOXzkaoTLmlHZYdlcYgue8N3A+bqE4jeiWxIalFaDxbcbfJONo1FL0RDTscR1diQINFMX9ulB925CDQZrsWh9mK9PSZrSvEp2S1LiUcLITabzP6I6hEPwl6oV5soUKSqyRj57WvkvM3rLYqvjOtD7V7uAiWW7KV8pisuphFqxTecLk11MXCxA/BOs+O0TviKgyuj7GsJ2zkEcYejYQv7DEJRMd/ov+09Hfx4dUHwrWsJcQafs6LOjYYxiPa90deEc7+1/DztDNHmU2cHrJitfLTMAs6XDAaBEETnLuDBufuUAHn7rDphJ27QzNinbuDAufu4NwdnLvDV+HusK0RZI67m3/qtoI4Zfm3pSyfQDtOV+505U5X7nTlCpyu3OnKna7c6coZnK68Ak5X7nTlTleuwOnKna7cBKcrbxuV05U3gNOVN+HZ6cqdrtzpytWjh6Qr/8MHDAT3GCxAvzXECbSHCASt4QGPdh4Z8KKkW6raDsqaJ6GgL/3WZzSoG1MMATO8LyPK4DHszXhSH8dDCzLos5k4c0kJnLnEmUu+WnOJtaVkoJLSTkMpe9YmkAHFnTxWSfarQ1+K11qUoWwCpt2mSeC138T0CTUpkkSnCdXwtWlCF7CI135ftbm/8FvKVBLkiB/5sVwL+bPBcTTMTFCyQbt7Z+ZGkc/W3N8NQzTMAC1jdYbGRnCGxpZx/LEMjZ7IcN93XjkNviyGwX8JWtJzBzYlWmgzbzaRopG6MCs/N9lCR2JsO1VTtLj0beTE5+TaP4pcuyN/QCfWOrHWibV3v1ZOrHVibXWsTqx1Yq0AJ9Y6sbYMTqw1wYm1rUh4qGJts/V9b/Z2IF6whjEMhSzsYYxDHk39EdK7594UebTsNsuD1TH/G+9FuA/xQ25hjxZ74cU0C9ZRcst10Fpt9izNaGlLVCm6fe79HExUJs9r/rfcKs2VoxvKE/N4CCOiiZF4q/ISl7M18Wi8QJVlvWMheMkxqIGfBciCfDbM97wLr06Mf0oBV/go7MY94R0j+pVCND3Tbgq15zV3hfpS8SoskzR/rwc08lZMlLQ7Q+3LRzt3a6gNX7rLZgWG1WQg5vsRDOjT+lj861VyHR+fccXNY8ygHMyOhTtYgw6FvZXWSz+rqHCMX3pVJ3BQI1lWNplT3a8cy2rGxI4oh77cTxdBzomgiaFpXrumAWIpr3DqlxVdZ+Uf62S2Z5zo/Xq7o+FBS2fNY4Qnmw7QGpGz6hA9ZhuX/lVQEg6xwiiqRoh1ap2OELYbJ/SJn206pSL2pffdTjBvtNc8XP28dcgzVGsgvTFvvZK3yTM++Buo5UrMcv0wN+vq6hSJlXZm5dhXxqDJN5h4RVmNNg1WCUbjhLF0D2Vp5waVOFHgZ6Zqy+kAnQ7Q6QC/Mh1gjZaQLtA8czWFYO0TW62g4LzeNwqOFWWderMpPb4MbDI3FLDYSbxoLqhXl6XgLnwbxAu8Ak5qDzsETviOruLWrPb9Ko53IKasipVxmWUiqT3SbRHnDDT2OrpVqhhByQXNamiUaDWMq0mjYCazf+odyrYkjTfDSNSdCtQvSzDmIfPCpvT+RHKhvye1Z92Z8Lty4K/Rfb5BkC/rrDmyKMg8VXd4VroHuZU26XkCQm7gV4OzYMsuUFB+BVMC3jfYYnUv6N69oRWmWLAwLq2vbw4XFmTlfwlU/7Acc6I0LSg3loorSs6JL+e6nEa7WkLlVca/w7hAhWBDw9D7lHKmUGOeyS5QyIsReYE6YfjhYwVfr2+mAbAZTRtThEvJzZYV6Zxq6Qrl2qwqkIypkiUvrkILft2kgRLBSxkgmo6JKNCr4vD85r1ROhE/Pn3aoGvZfBdLEWOTzfNekQRJdCVvWx7zSdMxJ+6N7mS6Hrko/QykVJQzw2wJqMqvg8CIqPpnkCa0xCWd6G6RcRVSwY0QtT+3b0O4pTc9VZpeJhhMxYg5DxgjKUYZxjIb0LWHu3/iTxuLqNwdory+Vdock7K4+ibYe1uuVT83ouPGXD8bT42JUa4srAQrP20K3eEGDXFLHnIK5Kfv5vPyG7MWnoHhNGfdO1U6NiUYJW9SkCUq04baJarFky0U19VPeMugRgj3YFTGqVkUuc1EwNGj9sWTOwuD24foto9UcPDyCdFcVfiZhRYQc7CYMVeJRpFKlo/Gl1s7BdlQXNFcnprqMDUKQRJsCkNBS+0PKxjBXgXjyPPHHxTHoKbsr+GEt1o0GZrYR+NpXwgkgsSa9fA7FtRsz5CieJ0eZ4x73K/LcE30kONN5z0LwPDZj8KZap536Gl8hHcy/odoBXMFr5Igg1/pl63xw0PbFXZEDGdI4cNczhyZbENQzUQwf1Aqhw4CIPzj/2/vXZfjRo510f98CgS9HSP5EE1qLr4otncETWrGPCNRCpIabx/vdcZgN0jiqLvRBrpJ0Q5HrNdYr7ee5FRe6gKgUACazZsmK7zWUN3oQl2zMrMyv4+6Gl4RVzW2dH1jCI42SqX21c+jp/7hDt6ar+LX4FlG35AXZIraFStCib4DaNxSVcssLS6BnlwJvNBcBgUSt7fPdIeJp6h005ep5d76nR72lgeCl33d7cOT4a1zqVMvfWnn7asCI9Zv6TttIrE+Sxaw7P8F0htX0L+Ji36kjgS4elBGnvsd6+NONa0vwitsmB71U7ZiIE9/SmeKemf95NxhfQJksEEv2Fb/2sb795YXuVtn+2i+TWdQY0OYAwtT6rfxu+3R4MO2Rx7yBi6HzZXcmjpwxVyiqmD4Ie0clWDc/kpvZZXOKHBgt/kMqPQGFbWh2hRo13hZBI60u4R6nFBF7JKDubzILoHwNJmphfqBzjaa2eyipY6mB4tHBoED/qjfQY31T3639qFM+tNV0Y6YAhfNt+89YTq6xJ30f9XnOkRo//PQdUhYE8remaDSRygE4PeerMAHkJzndOMTPpLRRG1WGjpDfkJHMb8QzufzMp+ulsa8e5F+fh199zIi5tu0GINP/xI8fz2aYnqFtbza+/XLUFPw7ISWsB9hDzhi3yWfnbsekD17oTr2a83HGqdA1qsjqNxOKDOoyFfzCS35UL2d1r4ubwj04rUGMSLTFlQ+9ctv9n69wzc2N459Z+dbCXB/zA0ViFayyCkWJ6mobttymRRLJeXxLtko2Uu4sgtUXrXn0bpWrTRTOMlxXlJ0LUWvVFccv0igWmvZvocQuHzqLAu8xzwH0/6TMlUh/Ks5MIGqzZDBwFysCgj12onSeandTtDz2kWleXdBV+mB6tWvIYJsyRkE2pPFgwyHujKNc6X+1Qajx76rnFFKBMV5EZOEca4qfWPpboYvWva5F8qNwb8fgTZgMfcTaOsLo0kA5IcG0i8q8UzsFJKVC4i7C7Oq+6+3MIM+Qj2/82+ePpIuUDvJQBY6FUEGiifelezcqeVG3lzk4OEkp1pJsTogj5pi3oqmkCVWEde+XeJcCi3Bu4oCKuQyaZNdEC+wbBv+DcuuDguvHZeqn3DRmFSOPzM6IMCw6S37P9Uf5WoBoEx4ecraetY2ctsVPXW7bTx4L8GQ9lBs142k1/7WDjvlTIcB0afn7PKrClhzz7geIrP/stvbnNbpOgVUt6SYcGe/Kk2tA5InNnnhr1+/pjXSCGr1PjTACQFlw2fvvm0ju+JWc1X5Csdkgr4AChoBhwLcDqkP+XrRCRgBlQfxH0OiV4lSJQshUhjjc5Z5TpzvWCtqlkWquqVmxwFnMysAtIRblNKqwYHX/GOVFrckB1WNFj0UPbCIWYynxiyfZBcIIcq5M6EDr7bM/Ck6AGkYX66yiVpKdlBba+10bkXRZToH30rqj8TQpf9c/+DUx5OdLxhPlgLId8BHwfdAKcWGq6NMzZFuipp2taP+0aqKQsEQkPfHb/8aHX2P9eD7yKN0lZSsnKg54Jjq1pQQKEccOWYcUtDAHRtqopbMqpjTTbsTaaSlmZpkSr8Kn61zW+EiKUu6q8/4doUqS6ZlTnEYs3OI1tO7gIZDnSEXavzCyllqeswVw2jgQMOLr8GpT3FxhbLuy4i/tKMX8kHDYmcIVrV75xgqqOdxiiE0OiqHWmo8tya6wbjsQpYmdTafO+ujGqjYOX82i0f7CfXamtAEoFus3HHe0BZYoMvx+zNeB2o+vt37g7JQMiXElDK3E2W8FtIMM374sa/3XkUHHLSjNP7v9vZoOgmqNPAqinqDlG+AyXXwc81CwD6MUeqwFn4B6rv23FLAg1INl0tYxwbGFJdtSHqSIAMJeRu90NtWKS/JBYVYpTqOhQJvzAtP4BfxPj51pYYkLV6GZ2wfL9sm2p1nMoM6L9V1uedDWe2f2SJfpvPxbbAfjZBZVwIpPX0+NnCx6svLHJXhvBZOm1SiaNt73eNUngZuIqA8siLwji4i+P5Nnfulcx9ctcFLkhp5cZlA5Cw+pxM4/hkSHy8wXYIOZrzbfWlOX/X+W44o0Ne+JUXtY5wOQXybeKmQXUO1Y8rLRg/1aei6pdd53p6KB6X/VOGO1DeMLHZAfNF61akoo+jIpjCS0kOQFZjKx1HHSgJNl0q0XPruHXQp85lN6KSIXwrfSfRxi7caGNPrSnQb4p0sQFsuwGz35/XZkih5oNaBmnMl3UZG+qgfA2Y/iKS52vsTSuy2mB1WKvB6xDsKBvgI+qR1PlporXRGJbtl6MJS/6ekm5JORcmZ289JrNlcsg2tbKysEtpMn/AKT5XVSodsdQeMlClD1+22Se1mPJTq3Si8aHtCZvu2rYJAo+0XHK2iRGE+hzVaS2kIrYvjnBwzLPLY42S1MPQxKfk4oXgQ24vY6mYmk4Jm/aL17hzKEq9z9eu0Sswg8qE19o5HNokOj09/frv/pzdvH213mGF4Xtsiv1Ei8ERnTAcO8v6b4y3HtOkJnaQLEoQ6bI8TaTCV/u1b8xwrghgSB1crwauTFDJ5pumSjCwbt69Xz6UyzcEtPYZzGIIGR0bF5yczOCEgbxcbljindsh+WcL5BPEJc1BwM3YrY5vx1ZxLktPnTp2kuBMCgAmnpslnjzR4HzsMswJ3NC/iGaxQNAohmQr7wlQjXH148zzoSuyM9RkSkfW+smZtyEY6BwUBNy3ExULrVYPVIolu81XEx9ctuhNuOi7PIrNI9/XTet3U8BzQJrYyMNFZLrjm58udKCj68BZQpxCTVNXcEwVbM07lOEOhJdIn7hFKWxZds1QRdj4c6Zy5vrAxuvSM5FLjMc3Hn3CGD2F/D21ix9KBAnIAWSn2jw/BcET/OrzQ+Dm2IW3iEq+zdCO21eArk0fZDQWR9HS+xlZrtyyLLJt9puyXmA5M8i6u1BKdouzorN/ismCoHm7JrlkAx0DaC7+nYt2yMI1ZmKrh2P2VHaJ4wmPU+XLQhK+UPo66d1VAI++G2gQJqQAoKo1MAhmUwq4es6ZlXx7pl3d33b03vAjxo9hylpNwNk2BAGY49JXYSycl6FswodtwETrLSndj4NSHozGhIMDLTab0n2+//jp68XHO6TPoGX6jVsPy9qWTP0tOxH6bzZ+cVC32sBi0y8wW4mxZvRLx9DOZrvpI6hwE98jaVM/acW1a+tRDcriIkH0F36NlezZLbxkcdgBQGTp2Q7DGbNk86lgQdEyX3iOlVP9ND9THo8MnMU6qaxsapq7gayixo5MEH/OiMLkPdPhtYpizTndl0D8GZUiYbr3y9kD1jpc3k6916XlxzbxwxuXlJmSfp8royvJCf87X7o90pQ1djdW5H7dyQPXRdtVBsYRYiRYAuf4jB+VPujIPLl4SKbUV6S7hSprTrtWXyaLEeKnQTiJIQ6hFOwPpkotDb/77P/+rtB1ZYCB2CjyPWenB0+s/NlDohV5AwPXGCMqBrtQ7TqYn+pJR2T2arjDIKmoLgcjkMGgV96kmh9Th+o5+bO6PvSnLbiGPMfL+7drMJbj+x1be2mUwOkyWCeqq+SokKqjJKaqMxKTaV9/pa84NMeg2Z9INOCZ5kSNIzrD29Tgw0aLDRhfso0iiRZaONdys9vfQVSt/CKKm0E5H1mN7dQSKxXrBNOGE7sSj//v0/fHuD7k2WsaYBo84FzP0BGhwLJa4p0iNq5Tk7CItlyOuTc3F377+j+6xJ4xIJincMXashkNx1j4OiKnd3sAscu07u8HuLOF2PefurFJkJeyerSjaRshz2/x/wQn87+3oxQ06Mbbhn9vUJGMauPAbtmkUPVhkl5dpOJBVFwRwgWMDA2IzwKZyqpvznYy9yq83VY20amd1bHq8Vqkg6efoa+P+UyP5kiMxyltVF0IxjsGrPafradVrDBbHG6qbdDqN6d5gEhHqa4936imlS3zAAg3CEvkKQepy5rQ6hOf6uhxdG3zHX4mBWNFygqMJiYW10+tiBef2RgVEH3ttHdmwns32hKy2QaPYx3JbZxTXs94eHjXaloGD1nE1qMt6I0fe2ycxfHhDtbvJ0dNK23r6R68xPK0riBrMTQkmUrVrfii825nQsZjMA7zKttzzfoc5woju8W3M6h+aN4YWeNxOJa3LgEnp4ZdYZyLW8k3cjxTo4Z4YMGI9rf517f4oao85N08Mmg20PczNF0yINazgXVbbHE/z1SSG4BFtH0X0og7wBlSr59l0xzVGbXzfDDRfVgc+pJT3g7pu+NYR2+7cPJ6quYX9m2OPTtNxkSK8bbhtPed1Uqly08Nva/aBypX4Lam0eLfjmyWeifuaiFCdvYawx7YIovDpckc0vmAkAOL0BWFVguh81a4GxwMQzZR4P8xhyDfhUfrerVCPBb8lmtCnLm5RLfdFzXowgsWCHyWEYEO1Vd5augkTHC/NU9ppWfQYMiX0i8TkaQQdTf2H7aheqXY0cYxSzeM0RmD3Ps6lHIPwKR5kXmu7cVfd1efW11WzGTdNT0nZ0z0zTEg+pFvm8V0yT8Ed80iumEdwwzy0C+aO7peHdb303PTdLpdh+30dV8sTcbP0HLFu98qwEVvHrfI4LpUBA9TDlTJ8lNZyoTyK+6T3pfgAt8mw8bpvd8kTd5X0nIBOF8mwQV/DNfIobpFN2X3ruULm+SQ9LNQpz6mJG0nGqNVpaMoQgiKZ5SvCkcO8QwNQUQe1LiFgF/StCVRFxzy0titVljMuWEkD7JKdaJYmcwvhAzqWqkinpWH9nJcLrTUgPVOAM6Zs7GB6xvuzN6+9nTZJxBRf+neYnvFySm+M4nhJj/79LgadtoKODjcxdR9MbXrSdJIRx6jYTaVtYJOazEnD3WZZ5Ia31xCB9a/hRQBSn6K6aOeMFfhxruRRucjJu6Kj+zsiZGpvdoj6oO1X2SUk+k5BLCIS+2qWUiqhwyg10hg2iMk3TkpcYdo+hxQ0RHsJRZhjLK1TJXTTjFl0AHGU8WoRTfNLdWCwjmkrhjRypeympYPCkePQUBgtanzB6AcL/LK0o02nkM0+vkzBSLoE6Y7EAWX0oxEt9LZR9BdPR/yIF1QwuU/1STUvzi/iZZE6043Y+aaXOzXl250nZyww+yFk2UPMrrYzEvsyENp6GWvAZ4srtj8nkkf9DQ2uagUgRGSVYPHfl+A9oGTzUDsoWXuOdiZMXwaY+SAgIFHEmTbklTGjbmcKwJkL2HLFJ85fpDjnnivdoPMTkgauKHXaMwYwJT3Ccm/uA9j74D9BY7cy9Br6JegKpBDyiwStNN/C12uiW2j0EIXXXZpbfznoIyfScXnOTuA39hc4cBAtOWvHycXX4BnNWKzAydM5IuEwz9i+reV7x5Pc8kTDm+h9bj3s1TbSy7ZWxSb/u/axBjuqfNzGpoPBjYP4dIhnz10o+TkDxtydUqfBWrYWsmwN+stDrfaCSO5QCmskrxoXTpMKJgoxzG2SHEEP6A8mPbwLuKqWS64nhIWfl0ol2ODffjuowUiU2MURC8+4CO+oBBPIGFVAsYltJHdueWHoHXcih99xJ2KCx52IGB4h+S1ilkcP1GBAolSoC7tGfyCB4v0smrsQtWySYdGZJTXDWcF4Ho7Oq+WWZ0Yeh1DkVPMnZA7MUOLSLRiGhXNEs6GnCAGEmoxe9es8gzsxtcHAv9ySkaaGjsAgOEyYq9E6i5vVyVVzSxCwK0YwaXYx+85KY9MD6LFqbLX95SAMj1/hf2Lz4yEbyMNAuYmV2Y8oM8zLoglzgjCRqPCBElouYWaMRu5HEqhJWa2Dv9rb+7Vz/IyThVINiecgvUV8EIJb8i2TOu4goiCQeMNVCGbLrVJwbfUOD463iRgIAJ3Bthl0sVYgw/U3Y40p9emIpB70r5sbh2HE4pgRSp9oZnHnI5danOtCy8QOLe5VLcmqbLANRRH6qSdHPwpdr/EJa/2w/qiXfJhVSeA9H0znzCEXXJNLZ4v3dA0NmFhoq7/qpGNmHGpSkcoMM/c1Ko5PZ222xmAs6t9Bnarfs0WlXfuXVVJdA7UrJNZCYi0k1k+MxJosHSGxDncPipBYC4m1kFgLibWQWAuJtZBY6yEXEutKeXYk1vhWn8QRfmvhtxZ+a+G3Fn7rZhF+a+G3Fn7rAa8Sfmvht25pk/BbC7+18Ftvlt+awkU/5MoeCCgh/U+pQ6e+iiNuQR+5bGDNmwA11wb824QuUxOJbwQYMZn7soObNZvY7ZRG2ydqj+WznWj7OL1RJrfadNvvpxP4K1DNX+CV89xmDACvI1AZ7bD5TwkFlT5bFyMwfTK9WOs7UmX8hfhzqdmBB6g7gQeol60P9DjXhALd1wShQBcKdKFAFwr0L0D2CQX6OqJSKNB1EQp029xfJAV6y5PDKMvbVeG4+vOWZ97PSQ8PjInwoQsfuvChCx+6KcKg+8tm0BUWD2HxEBaP58Ti4UC5Cp+H8HkIn4fweQifh29+hM9D+DyEz0P4PNwifB7C5/GL5PMQagl/EWoJX1eFWkKoJYRaol+bhFqiUp6CZ0CoJYRaIhJqCaGWEGoJKEItIdQSrUWoJYRaQqglKkWoJYRaQqglhFpCqCWEWmL4iAi1RCTUEtEXQC1hYMO6un9gHjQToskaOOTVzok367nZ6lY8Cv+LzXsTzWhhcUTNTQo4j4Pebwq+o6i91qujLu/2VE3iWZEoG02jPt8V5+ctLAvW2lMHzG1p3qJPRzjXGBcakRvwRG0XZeQmNNHrJu1pNVcicIqB6/Zt5H6bMPxJstSeO0SU3qGDdlVW4NugwnY5qp6CGSEhzbXjDcYY7DzYKG0t10saUmFQm295rlNUK1OxTNrTuvsDMV2tZmrlwW6mDU71gncWNXjIsaNAUWZawCEy09cxQ6yxY+4Dg8Os22FC87trfynWFXEBNVSxWScI4wXr1fQOtOlWYNZqpSYsFxYGdHh8lQO6iFpIqBuql8GSq2qpLv5ldLlK1IuXEO2KUMk9B1YjEd5pcEuluxXZshVEou/wnnI9WhtBqWYA68ZqeMtKSP0JTcU4B9dVSbcZGE3ssjyg2e0kOba+HTd/udSALEaQZ6C5whtRLVbGoNqneQGG4DTgKYNZNf2h8X738fRMq8V4JYFyhw70P34PNAbrz4BHj2gZf1Yg7IUPLd8djZN9VgBGNDZnR9MCrd2u9oTDAZuOkw6tRHb3FV44wXbMR3z5NlI2z26PffcOHC8jU+sI8cMd3BDjboQZL/KyNGcomyf7Wq/ZQa6R83QMKJ1OepXVI1obYXN4LlbT6EWpbNQRep0YVNRW8ZLCP5LzbApLCsFRICRfbQ48krLZIi/U6m31OnZMVkh7j6PW1BBKXvfpat1auA+LSmi9hNZLaL2E1ktovYTWS2i9hNZLaL02QevVttNNQvIA3iHPYFGbDiu4Posiy9EoVJKg0sz74H8SIi0h0noCRFrPkbvuyTH+Ne+71FCV+TjDpYu3eoNklV6p9C+ustKynyqfNUZMM6Gdq35S/sA6RGh35T7TlQpZmZCVCVmZkJUJWVkXWZlbhe7frBeHGQTXMelViM7MkJdp+it9I6M3Jiub1k69B5YzeA+2V5jNhNlMmM027R4O0JcF3Gt3p+HaCksK3y3Nb3TWmaNBOyF0M1j2Gh9O7Qf9DwtRiC6/tCUmO4baM8CNTFzAVXs+7WCMqn5Lex2OYNQ30XzgODixVTX5f5pq7/El/8sMCr+E/7XRl/Aee2H7o1/zMiogEmQn+pSmBGtL2p7RyFSd7w69047RLjdZSVHCvhRn2MCv9fpxXe7Fao7X0HBT7esPx7q0rIrfRPv+tYCSkc9MFFCmWq7Nt3l+E72f041/lb3NJYlotvAG/ypKrBbXNrb5BqA2/e85Q+IWCKamJZ/itsPASOCGvoaQSW2NEeowNMa/qXRYtvfuvdfwEDQnd8nqFbNknlzaa8xgqLd6T3DUSK1Rms+SeqmGbP6VcyT1e0vktA6MtWJYBUK4+PiEi9ChfLXcv1DtXWcET5zfU+dpDwJ3CyuBkIdPT7nwsGkBjfZqI8nFkkWPzQ9GTQESinUuMQbJuUQGkK7GngOf8t8dZ+mgrh+RTP7r/ru3Vk/RIOWmTSy5T74/+Oabb/7Ak+BdGRa/cMlQ6mbMyD8Javs7sFajP+xEX+99/c0ORMH+IUpm0cezA0+VIGW24cF4T/3vD2d7f3i9t6f+9/9st6+O9hjBgOEljJzCyNnaVGHkrI+IMHIKI6cwcgojZ+j1wsgpjJy1aRBGTi4djJwpBe235lj25OO01WiLtdRBjNQ3jODgh4BVaH6VJtPllY3oaKkZVsoV2InOj00qlTHm8/F4Vbh+0Gmm9NXb8dRctKjxTucTcDs42vG6rJ6z5PPR/PtpdnkVAFd4qsxl72zjIXEII1bA7suBWGqOCHYX9K2zOMxIXylFC7KelzaMFAwgvzNVF3d54OamWkoNA+AQV3HsQUp0dDp+W7snQP5k0yC83BSywV0L6MWqXKFLhhUsvUy0CW1X00sQLeC1SZgGC3ciZ7WEe0jOP6V3UJj8NHoB4Fmw5FiSumP5csez/lGsJdOb5DakxHLEF17Gcz/QF0REXs7GACCTSL+DJEOo/e6i0GY5caOB/+Gzw8VZ5Zpbm3Lta0255pKW2fsbyoW3vIRfI7VXSA9x7ne1qy/cZQD8JEfpjjs70EZECaH5B1Yym1J7Dqx2ZAXrl/hyaHXBdCedm59du50Fbih0P4YYvu6HoUxYmNueEhZmYWF+due5e/UuLMzVkfFTiwoLsy7CwlwpwsLc1vLnL/uEhVlYmIWFWViY12ZhjvZ5WhyNu2Kd4BGnaZJDV4cTIW4W4mYhbhbiZiFudosQN7d3WIibhbhZFyFu7hM7IsTNXY0X4mYhbhbiZiFuFuJmfxHi5tYixM1C3CzEzULcLMTNQtzcLELcrIsQNwc7K8TNQtxcLULcLMTNQtwsxM1C3AzliVj8QtwsxM1C3CzEzW4R4uZ7Im6GWC3G990kd3O1WpO0All/YCMaBcfFz0uWEOa1dNJTDBCiiSpkizvweqVmQNKugaDRNjruqyr5qWogJDUbqGS1ZPaoKRCfc2seQgXnAsCW0hA/VC3Kfk8jEt7JaBN27WfOrg09+QnIAtSmWKq1uOF59FR9x+m8SbIlM8FgeO41viEkyAglc4JtsDiZPWaZqzYTzTWsOdNCdS5U51XEOqE6F6pzoTr3PyJU59UiVOeRUJ1HQnUuVOeZUJ0L1blQnQvV+bDhFarztWdAqM6F6vw+qc6bh7v3MWFEF0Z07+gLI7owogsjevUrYUQXRnRhRB/AiG6wZQwhuv3kWfGhx3G85QTOglMfsC7mCNmtI0+uX21hSFt0gBG/J9y9Q7pHB8npAqk0AETGabGMCbG0gOqyOYxnPE5i8Ji8hp2WxeWtUnBnu/Q3eKzmlzH8kGowilCsNKcRiMPzVQZwvdg83fjrvdGrb0dAZ+6CULDbdPQ55u5oD/Nr1ye/pYmEebES/u34Kh1/Kkf1KrY0igHx5lrfu4H2jv6SnivD+RN+ekN/6wVAJwqlmNtFwW46d/tRg3BIuIqYn6o9RJFh7kA6DyxwKewyxa9ug2n4SQqXQrwAzIqNo+tXzp+aW/myyFeL140h5cHTA84YGfrfcW2cOUBSK49/xpE+gJHGL+H26ceWB95mDNW5mK6KZOqdLZqIK2WCHNs2xdHsamz/4oeADGqaFL5qtmDX5rD9TZQcROteO+MUV7BM8MLnAC7B5+adNQd6HWzOh+RMQFE89HWubMTc499suWvkXfOLLmbx4+Yxygr+VLUnVxs7L7wNIZGSfl4gq8+76iFGzXnj/7KTkf2ALQxjE7UgvTebw03/s2dsDnxfNZsyAWMHlq4r3jW3eDJVRs83tGjWIBevHJrNVR2mGnfXNnnUXGjqQ6fZqCuh88DwB6az/JrYsdipQtgNn5fIpQfMeEJdbopQlwt1+XOjLm/gIenoJBIbEcoNBhev1PJlM5Q752GzDy2QtF1QtB0QtN1m0v78VkN11mkD0AuvuSMgWpzhfLfdk33bHtUO7Z7nRdvajNjW2HP6JG0O8UAITXAJnwKe6WrRGv3Yg/5d94M4N5Slx+lGJn7XhA1S9JuHbp3tdk/tTMsNtyTOQUjXLq085y2eRTNLZ/1gK/3EnM1qvMBS7qLwBm9QcQMPQ/mUPgqLs9rFHdxTIKytDsrZocugCwbBdoIFXI3FWmSed5CTQjNR88Y38t8Y8KbzNFVqDUzgNqhCeFKPufRiX7kYVOQ1mGbXsLhWS1gsUIcTgDAUJLQrr/Ru+aQddyEd+aP9bq4eIl/08fJEHzM/9IHzQh8wH/Sh8kDXzP98mLzPjs3ZnufZb18Oyet85HzOjpFoz9/sNxJD8jUfNk+zR8cDeZn9ez8oD/NB8y87b+t75FsOw3bddH7lE82r7BjY1jzKfoM5IG/yQfMl14WNH8ix2e+GuUaKrtYZ3XxbzkzkLGVbmo0JT7fSz2kxznxEVsJI7i3CSC6M5MJILozkwbcII/mg9gkjuTCS2zJEWzIX0Qd98428E/6xWY0dB6ujVKK9OWDKsEl7qtWpB+wKruYbmKaPSJNxKqbQ6dk5OiHA1eOpG5ONk2n0/kQZEaN0xJaEp5mYw7jcsQnZQF06b3Wr98ueatk3zYGsHqmIo+FkId0y2wg5rJjphgEPvC+wLiJIXTZe9xFTumo31cR5yZV6EkPQeEteZtctqUWc/lRJqdMJSeDS1/ev4en0+72DUiuce9ADrbI7iyAM+HCnLIS7ty8cOB+KiG9dKutFy6uuHOH6b721a55hG8t69QizyhNrJ8DCfVyRjilCppLqSlksnmsSb65j4Ob1ntM9naZJvqfke0q+p6dIvqfke0q+Z/8ZkHxPyfe8z3zPB0vkrIYQdyhg9VSkRiD3GJDanEyXWSvYoRuo1/g6nM6i9GwIKX8d7bX00x/KVo/dHtjXrj5yjzxdfcA+Dk7Lfd/4gfXUY/ywJ2fX00XO4r2f1F0nMKpkSuk7hqPpakz4ppllT6CiSU9omXEONj1PVQ99K92NyqQMjWicFeMVYRTqUD26/GiO7b0sE8pI60wapqegzTfVXOg6iJobrNax12HIb8Al6ZOKrcZYj+vTpnAbltx2AScwfaKz25yPfOltNp9scFYMW4pcUz3hpWn8c05H5VddqS5gEdrIUmUwjZnqg7W5lkSkSnMMpbP+IVSqOj5bVBq2f5lWGmXI1SUZ6MtKBiLBLclAXR2EIslAkgwkyUCSDCTJQE6RZCBdnlQyEJEC5nCPovMeDOw546DT617twYJcLf2xS6qS23yl3lheocMkKwmSGYWfUiCV7NhBd5wJHDDuRoql35M8JclTao6n5ClJnpLkKTlF8pQiyVPqPRKSpyR5SpKnJHlKkqdU/0bylLxF8pQkT0nylCRPKfgWyVMa1D7JU5I8JVskT0nylCRPySmSp/Sk85QcKXQC/rl1BNCAu79qUJ7vyq9ywVe693ueN4P3mBzKaHCjg1HVu/2x0ic4AJJPKdCzpkofQh8GWNOV0CLfyn9zOYq2//ZN/N1/bKspQe0KiB9ZeLpdNdF+3FUTlu5bFC+Sl9DeIkVZaTbrN76gqRdKwPgY+16c1+rAK9XvPFU0bWNgMy/UZP6//+dvf9uL//Af/1dM//k///E/WtaNZ+1LgpskuEmCmyS4SYKbv1WS4OYpkuDmG2dJcJMEN0lwkwQ3SXCTBDdJcJMEt196gttTTN96Yhluj5lN9gTTEXUumyZ2Wy+V7S7Za87+rVhVkngmiWeSeCaJZ5J4Joln95x4dtyohTqPMlsnZ81Yj0HvM5xnrcezW5a58SEq8cY/cTQgGFz1hFIfygX4IZSkO6Zb5vlXQCJe5mNMUPNVfVXkq0u4Of87bLvRB86jOjr8O3nD2hKqXKUjXZqMiUqSVcLJdHhzTulRoP77PRe8s74q66ld4LS+dW8VtHISvcC4hQn55wwbtu++LoabGDAxow/TZJ7iS1RtyRQPw7vWzTNyX0231WspazU8U6N3mg4px7CUFENJMZQUQ7dIiqGkGNoiKYa6SIqhpBhKiqGkGEqKoaQYSoqhpBhKimHtW0kxlBRDSTE07ZUUw0hSDCXFUFIMa0VSDCXF0BZJMfR8JymGkmIoKYZR65KXFENJMTRFUgxrRVIM1+2wpBj6B1ZSDE2RFENJMZQUwxZ7p3m4DzaLJBNRMhElEzHUK8lElEzEoZmIJrTdJCLaT8J5iHEcbznhmBCamX5Wxx2683U8x/WrLQzMig6UKZnPTri+Q7A68SjYcpNAMLUlcUznsTIYY2UhqIYVUF02hw7E4yQGs+21Ov4WWVzeqlN2tkt/g908v4zhh1SD2Zux2tMjcMOfrzKgecHm6cZf741efTuC5TR17mzYazH6HHN3dDjva/1VrF66pZPZeCks8nxajuq/3dIJLJSoZcNz+Prt9nX0l/Rcqe0kM2/obz3ulB+kzPaL7NKuFPYSuEuHWoJjwVXE/FTtIQqUckfQeWCBOX67nFOm22AafpJCyAnPvFkbcXT9yvlTJ/ZdFvlq8boxljxqeqRhCPLCOAfi2gBzfJ92gXxQQ4yfwpb8sf7NW/UhfruYropkWp0YGnOQR8f29XHEaYtgh6+mSVH5zRbkJuawgUxwGEisa6f/A1NyncbihawySviE5QFsJoHqx7bceT6pftiVguq+lt0dOub3DG980OTe/ZBiPsgu5nVAF+EfJ6s5/vd7ZDMyayVdjlubvLhKympS8Qfnk67G/mhuzEwQt81KoXsVPJbqS6KZxauD3OlfXFmlXT9VPmu0rJuM8RtaPRsiY8QJCuax4lIW+kXJgpUsWMmC9Qp4iN+t7DbO6rBXCs7D1RH6olNigY1PTdxhPoNIiI5efF952NiIbAdwVdGEv245jtxiLw2S5VI9ibmOA25x1rIIcLBOIK3wFFw+k7XiSd6RzeUYjSVVhkcTRYRjjtn0lnPOJsZihHSmZA6OL+q/z5TmxEef98nNSNyLXtRr9bExmuxI0G3KHHUHNaqeyvG4US9uXqeGbdCQobkwCbGgiq4z2h8qNaA/EVae+kjJGePDPjos3VR3O8xuUiL8zqYhNl/levQhcJCCrt1f4XtgHFPML7JRNxxmXksjxoBS3SZQVL4qm028/zWvFea18rLNItdSU9v8o2p+bOuA4nGKJ1tacHIsnKMryJVVltENDKW5mvhnWuR4PYC0nzocKOhMGrgijZG5xmBg3rYazPwWg/d0VdAr8Fer/3BMqeoQ9dKzIluy2zAnde5bDuHrYjDp1Ys+4uF/l8yME6qI1QgQIcrChtS3ZKbm+gNpNXTdkrWlzbHIPzRjdMpDhFcPf9TvoMb63evdse2z5PPpqmi/c22Fc9ClC9ah/lxHgG7/aOszB8PA41imlAK6xwBdfbJCttxzZaoEIj+5Cbg3m5WGIpR/QuWWXwjR3+elstSXxh36Iv38OvoOkzrVDk4LCBVJMIKoR1NshA7U8mrv1y9DTUFJAS1hXXYPgqEw/MieX+oJT5q8Lfu15mON0/Fqiicw6tlOJ9R5UOQrktOrRajeTjGnyxu6NnutwyBI+GHafx59s/drjtJUG533yWnqzHcybU2whbJauHevNtKiqG7bEjA0Ss5gNikceJcRqNyum3xKae/QSjOFkxznJf08hlvxV6orzoEQqNYeFe8xpmzqLAvMysXIzU+c098cmEDVZshgYNhpv6NsqJJi+annbTc4BXlwAtWrX8Ol5pLhwbTdx4MMRxpHlNUGo8e+GwivYsfS3QxftOxbOZu+Mfj3I9AGLOZ+Am19YTQJhAnQQPpFJZ6JnUKyYkHcXZjBll5DmEEfoZ7f+TdPH0kXqJ1kIAudiiBLNKrMzp1abuTNRW5vBuGn1DyPmLeiKVB3VVz7doljzCE+EgHYhJrbIrsoorZl+Dcsuzryh9ojW/oJFx3VYhXzkQaDnJLNhzpruVpAWAe6fVhtz9pGbruip263jQfvJRjSHortuhnGy34IPwbBhz49r17KsoA1/gFySwy1NfwOOm9z2rPpIS4sKSbcWQeW6ZHy5PXr17RGGje13ocGpLhB2fDZu2/byImeq7lBZppgphk5uiFdrUSAWp2u4zi5QeXBCNKQ6FWiVMlCuP7GO4Ul3s4AhBvUipplkapuqdlxwrvMCgAt4VYj1AVe849VWtySHFQ1Wlci+t4xjB1PjVk+yS4wCJn9M6EDr7bM/GgDEBQZX66yiVpKdlBba+1MnYx0fE3q9yTr0n+uf3Dq48nWGFowPBfZ5x1wVhiHGI6XOsrUHOmmqGlXO+ofraooFHRhvz9++9fo6HusB99HzrMrzktB7V474EJDf3RRC8iFBu5YV7laMqtibtHw+HZESzM1yYQkET5bbQJZtEjKEgLRUZfS6WmqsmRa5uQ/5fw83gU0HOoMuVDjF1bOUutypIphNHCg4cUIP0Uuy0JZ9+hMrI5eKMMZFjsHcavdO8frTT2PU7wC0LcK1FITikgQEp9SmxAasjSps+zepPXhR21rnT8nkY+DgPXamtAEoH+s3HHegBMQeMfx+zNeB2o+vt37g7JQGBtsJ8p4LaQZx27hY1/vvYoO2P+uNP7v9vZoOinYOfAquqnTMJROBL5ZCNiHMUod1sIvQH3XSYhoNkLQ2HIJ69gEQuOyDUlPEmQgIW+jF3rbQobYBV0RcdXcpNS88AR+Ee/jU1dqSNLiZXjG9inaTLvzIi0tOtyuttzzoaz2z2yRE0hNqB+Na35XAik9fT42Aefqy8ucvfLVEICkcvPf3usep/I0kOcO5ZEVgXeU5s6X2+rcLx20kaoNXpLUyIvLBG778Tkdm/TPkPh4gRFCdDBjRttLc/qq99/yrYpOdsNrG76goCQhE6YWsmuodozm2uihPg0l8/c6z9sxx6D0nyrckRq/gsWOAQc0YWuj6Ki0Uh6VHgI3VdNrIiWUBJourwCoNiR7cjxodVw+HDMY9grohHTc4vUGxiG4Et2GpSQL0JYLMNuxgaHpU/JArQPIcZ/ejoz0UT+eJUUGImmu9j6coXClauBarVTg9Yh3FJwlHvRJ6yDL0FrpjKRwy9CFpe8r1bJmWLfnJNY68OSgDFvZhCvnBmXQJ7zCU2W10iFb3QEjZcpQipVtUrsZD6WKvAEv2p6Q2b5tq6C0E/sFRzcoUZjPEYehGoYVWhfHOTlm9IUweZysFoY+JiUfJ3Q5bHsRW93MRH/RrF+0IrNAWSJYiH6dVok5DS20xt7xyCbR4fHpz2/3//Tm7aPtDgv296y2RX6jROCJxv0LHOT9N8dbjqjREzpJFyQIde4BB/+Bzr3/9q15jhVBDMiBq5Xg1UkK0YcAsKwhZjnuSK+eS2Wag1t6DOcwpMyMjIqvYXnhhIBgdEJ7dk7tkP2CGb4E41vcGgxXbDO+muPfcvrcqVMHuboZJjz57JEG72OHYVbgjuZFPMsxkCShAFDsCycrmwSWJ7MSO5GkhuB9va+sWQuEk84RyR42LYRWZIRvqRYJIpvz8YXA3mrVh/3YkVmk+/ppvW60OOflijaxlYGJjs/DNQ9AzEHRh7eAOjqepKrOXi3YmnEqZzz+9sr6oOpB6ULetuVuGNy29MQJU+MxzcefcIYPYX8PbWLH0oECcgDzWvePDw2sNbzQ+Dm2IQ3qEq+zdCO2Cf9Y2Q0Fpfl3vsZWa7csiywbMavsl5gOTPIurtQSnaLs6Ky/AtbKW7JrFsAxkPaCIq1YtyxMYxamajh2f2WHKJ7wGHW+HDThK6WPo+5dFdCYuas2QUIqgM4HYHRzJYNS2NVj1rTsyyP98u6uu/eGF6EMa1vONHGHbgqAK8Ghr8ReOilB34IJ3YaL0FlWuhsDpz6M9QcFwSluMqX/fPv119GLj3O1hQHKHT3Db9RqWN6+dGL+yYnYb7Od57mSyuFZsYfFoF1mtlANNhhPPxOdr4+kzkEI5Vyu27N2CPGWPvWQHENgxW15ZIBxW3rL4LADgMrQsRsCRG7L5gGUA4jktvQeqVYoaVuGDtQAeGlb7mGcWnGmbek5TF3QnlBiRycJPgYLPfhAh98mhjnrdFcG/WNQhoBA1itvh0HteHkzYUSXYTDwFQIYHTpxniqjK8uLGjHMI11pQ1cR670VRaKPtqsOiiXESiw2Ydf+SVfmZRhSaisCZsGVNGdQqC+TRYnxUqGdhIpFyRxf6AxMXYSw//7P/yptRxYYkZ0CUlRWztoFQz9LgF6oTKmwEBsmwg50pd5xMj0xGQlxWWcn6BI74OS/ymHQKu5TDS+lwWAd/djcH3tpjtxCHmNEDtq1uNhw/Y+tvLXLYHQIRFwgOdvAQN0mp6gyEhZbX32nrzk3xKDbnEk34JjspFtqbV+PA/NhaJjc8niUTG55THomtzwwVZNblg9H2+SWh6JwcsuadE5ueRhqp8r89BcQfey1dWTDejbbE7LaBo1iH8ttnVFcz3p7aEoptwwctI6rQV3WG7lBFFRueVA6KrcMGL1eNFVuGT6G90Vf5ZYnSmXllgGT0sMvsc5ErOWbeGAaLLf0HrGeVv+6dn8UtcecmycGzQbaHubmCybEGlbwLqttjqf5ahJD8IiB36UXdVADoVo9z6YVplob3wcoCVodYIwhDRcdunXEtjs3j6dqbsfIOAw9Ok3HRYpYTuG29ZzXSaXKTQ+/rdkHilHit6TS4t2Ob5Z4Ju5rIkJ19hrCHtsiiCKiyx3RRIKRAIgzEiTt6sH/0Gs8Kmgjm/AoVRBJ9FhUgUhcV1w990XNejCCxQJAJMSPRrXVcFCchAmOl+Yp7bQsegxZlUE76GjqP2xH9Uq1o4ljlGoepzGiFfZxLuUYhN/J/t32837umr6ums24aXpKyp7umWFC8iHdMo/vknkK7phHcsU8ghvmoV0wd3S/PKzrpeem73a5DNvv67hanoibpeeIdbtXho3YOm6Vx3GpDBigHq6U4aO0lgvlUdwnvS/FB7hNho3XfbtLnrirpOcEdLpIhg36Gq6RR3GLbMruW88VAkhzh4U65c/CfH+DkjFqdWpDiiAokhkgMePUEHkUA1Q4UdhoVpUQsAv61gSqomMeyTcCbyYwNUJQICUNsEt2kEHOQvhogD1OS8P6OS8XWmtAeqbZLONs7GB6xvuzN6+9nTZJxBRf+neYnvFySm+M4pjJCP9+F4POoiFuYuosMqKetAYoYi0cZRAaoi69UBEDoIhNTESXQ6HnmzMny021/Sq7hETfKYhFBLtczVJKJXTA0kcawwbB+cZAcQNqLdvnkIKGaC+hCHOMpXWqhG6aMYsOII4yXi2IrlXrmLZiSCNXym5aOigcOQ4NhdGixheMfrDAL0s72nQK2ezjyxSMpEuQ7gVRpzqA4fi2UfQXT0f8iBdUMLlP9Uk1L84v4mWROtONFKqmlzs15dudJ2csMPshZNlDzK62MxL7MhDaehnXaScgwQBjgM03NLiqFYAQkVWCxX9fgveAks1D7aBk7TnamTB9WUmcKBNIFHGmDbGwzajbmQJuqwK2XPGJ8xcpzrnnStduKkbSwBU1BuIsZJinpEdY7s19AHsf/CfEqeQOvYZ+CboCKYT8IhkTK0lzveg10S00eojC6y7Nrb8c9AGq67i8JnR+f4EDB9GSs3acXHwNntGMxQqcPD1o9UJhnrF9W8v3bbSi9omGN9H73HrM3sPJTjWqUeXjtalMHbBvInNw10KF2nRdvG+DvHXSD0z3rMIqZHG7DMfFC8Qhq9BReyakBlf9ktkPqujam4THNesMX9vRyT9VHtZaSIWptblLmq0N5SWsTyFLimoPFln/EAp9rC1CH1srQh+7boeFPtY/sEIfa4rQxwp9rNDHttDHPhgvLEdSvGs7oLpXzfeVGgxoWWk8e5Skj7a+mrwZUlXNx9lUH+GoAfmygEEAuHYy3gqbBl0rMVoUIHnozW0KZ4gU56TlmOrdaxaJ63baw8IFpdHpZf5JiS5Ogl9lqLTgkaiqvyySGYIskWW/KNI2+JrAeNStxm6joB5g0mYZVGv267lrGAywaZVx22UuHPNjDeCRtOavPCaP0oWfM2cJeKUIZriuBdEicN/jfh2O0zEHDWaJ5y6Cn9o7FYxRCty3A4up7/PjFDO6SoNKhPIZBPMkK8dKDhMKDAtdAGLOLpRysJoq4chYxDCOQGO2QkGAp22qTOPJhHBQlJ7U5jp5pbT9yznGV1Gm3yiKjiDuZTxdTdCxOr/VOYDMvETgsQxPBg6bqxwrGFGUiSZi2YlOahd8IFW+16E8WM+5Ml/Ab3QbqWMEsMgpLgYiTsAlN6UOtTT9a9X0Of2A+n2VThfcfDollBbFTs9kMrGqJzyHexiEh9oB9kVI5oa0A2b48AsC0ixoViC8AoY/afdyquWt9vqYrGU4QneibfTt40IxIR94/69sCxiYP23DmtqGizoYXR5T+rAC1KXrVl+GlLK8dNF4IKTEAFdPqiukpZZvYHgd1cAiq6ph+hOvRlJEYYR4wfIdDx3hTTBW9xnw8eFvd3hlAYAqUGdFVwBfDRNEOq4aKSVbJxmmrmqQ7atksUjb9LVvKcmS161ZaWpNqNMA4CxgxOHGcgoqOH40suSEMGaJ/hwiEBcmROzjyduRJQhQAnSyAlid2Xl2qQ6HdpWbYeKr5wSjNaM2oupGzkN+m7MS4V6FgVw1bs8YBT7fBCHp7Y6FkV4pzbC1HVrnr0Xr8W7j/GDYPQWAJl23K1nfjaK/mAWmjmLAFNShQMvKAtECTf3XlUkoWCAtGTfJDoOeleb6qkXZokJYwmodqdbO4WoqB35ZYt9ULz9URuqS8HiBJQDEH72bkLnB+jHRXmCHYvvwpGEiFr5+bQsWP7JRgdofwi3e4ehXnXI9vbVXgjD2hPpJryMHCwZ7XeRj/EbNiDpkChv84B/9SjDfKXneLEoauTwnGvGF7lCYq94NibhanaMFYe/JId5h93yan+8yZFb8avTqd7umLreq3etXuyi/Rpf5r95+98030TqutO5w07sGmnZabp3BpX3Nt4cJKH3MUNLHDSJ98PDRBw0cfbiQ0bWDRR8qTLRzy4ZCQ/vu1mHhoI8eCNo5JqHgz75jMizg86FDPXsNQTC8c8g4DAzpfOBgzh7XAL0COHs7rO8taPPJhmt2DnEgRLPvsA4Ky3zggMyO/ncEYQ4Lv2z3kurYgh8MGHqH3+l94weGSxvsi2UFVp2f9bSfI4NCWDhODMBvv23pUgtp85XSrdfiaoYfWrDssnJ/g7U6IXoc1tRy+/hmpIxMzsjciU6IsHEnOgOoyDleaO6gq1XpE+lyPMiliYEXa4VxUMiGCeHwxmJE+57eGBbgymUhVWcuvTFmElBUEaBZpykShLCnzm10rXqcLOsHf/QkitZjp1cu+gGKdEyMaybcxh03+sEm2+qQRPacSz+lc41qz+WebHI3L5PiMjWkOzaKFcm9fctYM2DbkOoGq59bPSj+4A4ql+BBMJGUfgT4SmCver9RuV/t7f3aCTkaJ+qsVmcUs2vBbTMR5fjkirfXulnMm4q3bKBY36ZL5z32rtf+1ttsTOomJ9l1apmiWknp1l0k3jOg8SGt1teEakufqEMc7rzcj1bn5tJRLzOMrrRrDqwrvRLRXo9GaHDpxW8fxCu8+qN0zVh7mK+To3/9ewtRHh32GPTVHeTT1UyHRsU10cXctXSWlBneImgmjWoQHL/t/yvzOTfHMLLpX0BtqjUzHX+I+ny0f6mdYDSshpiz1hbnXVZ8jiG3oPlq/0jQ+06qHzaEfOC1HJWkHQ3OQbLLx8wuBtSD2gj/4CNnlw4ZM3nqsGltMp5wlfZ+cD7pamwzVFW1s8zHGR4DFtU5OG+44nRsJf3ruoILSu2qYoU2WjZxMCYMrSf98vpVMlX9JIWCXJp6C+SLdL7/4einb04rH4eksDtBLCXpxyashyXKAnkEMaDG9Xk2YPjRd2kRnw3UPsdUEJKgxdx3TiS/K7DNARg+WGAUPEHJPBMQiUqd1DdqVXqRoLuDuMlKx8+m/omnb34JPE26buNiYrUSxQW4QdCV5btfhnOhSNEhApHtpj6KxKi3457tIiNsPQK9odQ1/S3h6dEXKYkmwiL3npkFfRWPNx4OAaalv7Aqbtv8wGiq4dFQHCYNQYkavmy+MjyG6nCZwfUosyv58Dg62VeOAiFuj+QdapktP4lsW+h3A7S3NfBbPelNAbhL1HcQn+WOuCwafcWnInnwWII4LN0BLQxY0tGLGrqJtkw5uaYKrlK2HUdusbG9yXKpnkTeowGhEj1Ik31meS1sfh3D4F02r3HVl1QZHk0cawD3d3CzyLZaU3Wm/vsVbTT/fEZDhaM9elGv1SLZOHGnlhhcvTRH3cEfsYLHjXrxyw3aYjavEeiL1vIcVGpAY8Ob0Fj6DacheY298hnLQEJj2cxoTCqG2Fdls4n3v+Z7Gu/e4T82i7zBBV9Zja9CNm5CYVSU6zdR06jav8rKK7VUlzcwlCaC+J9pkaNjo4NudP0VKaTpQpruLUKa/iWQpgvN7i+bZleoPjKh+hCqj44XPCWqDwfvVUg/hPRDSD+E9ENIP3zzI6QfQvohpB9C+uEWIf0Q0o9fJOmH8E/4i/BP+Loq/BPCPyH8E/3aJPwTlfIUPAPCPyH8E5HwTwj/hPBPQBH+CeGfaC3CPyH8E8I/USnCPyH8E0vhnxD+CeGfEP6JwSMi/BPt9Qv/hPBPCP+EKcI/IfwTtSL8E8I/EQn/hH+chX9C+CeEf0L4J+q9Fv6JHuMh/BPCPyH8E8I/IfwTwj8h/BPCPyH8E9Ui/BPVIvwTwj8h/BPCP1Evwj8h/BNOEf4J4Z8Q/gnhnxD+CeGfEP4J4Z8Q/omN809w0BHXVOcoaEbmEb9A9VddnAn13WPu+g1Y321DQrY0yMs3cUjV8GeLIssxvEGt8EoD3ckX5ovBzBdPiankCbFwaMKNc9VDgj5Yh29jHYoNXZFwYggnhnBiCCdGpQgnhpsKJJwYXzQnhs3Y1El2GDoxxWsjTq9ynPpoLC+1ywFiPxK4AtCY0auwm0RYN4R1Q1g3hHVDWDcoMkxYN1qKsG74irBuCOtGy9AI64awbnAR1o1w44V1Q1g3hHVDWDeEdcNfhHWjtQjrhrBuCOuGsG4I64awbjSLsG7oIqwbwc4K64awblSLsG4I64awbgjrhrBuQHkiFr+wbgjrhrBuCOuGW4R1455YNwDBnXMbNkm8Ua3WhApf5TcR2Ii1HE/GlVlCmNeSgAcBWB6fguoiQ5nBFnfg9UrNWCoL5ILMVmuj476qItcjpNK+TRBRS2aPmgLxObfmIVRwVAcyQPcMLaRKbN2ejmG9k9Em1CjPnBoFevITZLOpTQFB2RueR0/Vd5zOmyTDpAxEM1JfXOMbQoKMmAQmKcWcj/rPMldtJpprWHOmhadGeGqWwlMjPDXCUyM8NYNHRHhq2usXnhrhqRGeGlOEp0Z4ampFeGqEpyYSnhr/OAtPjfDUfDE8Nc3D3fuY0NlEQmcjdDZCZyN0NkJnI3Q2QmcjdDa+InQ2QmcjdDaVInQ2QmcjdDZCZyN0NkJnI3Q2QmcjdDZCZyN0NkJnUxkZobMROptfKJ3NsljV2GzsJ49OZgPOeccZAY4JwIGdl6hIsDZy/WoLTY/oALPhtX/7kHJM1JNbLshwA1x3nBZLdRbOVd8LqC6bwxjF4ySGCKDXsI6yuLxVsnu2S3/DCa5Obvgh1WCOo1gdYyM4Ys9X2XRC9enI0Oh6b/Tq2xEw0rgArXwsjNTRTN3R9z+v3XjVLU0zYkKF67/b0rCeRKth1Ut0DaWXt6+jv6TnV3n+CT+9ob/1TBKbA2EuOrNLTixXwFArcBy4ipifqj1EKr87es4DC5z/XWYA0W0wDT9JQUXiWTdLL46uXzl/aroV9LS+bowjj5geZQaN1f+Oa4PL1mslIQpisH90PwXwdfxmMV0VydROBo3zVV4gZIp5xYwi0sEXCfcS5vkt2EY57Edj0oCyc+30dyCH0webucAjVGe5sakaW+5Efqh/3JOwqA9ZUZWf6B55iQZyAbWM0BrMP3HzcpUcUN7Xz1pfT4PAV7ijeZ1rC+p1Qo4dequ2hk1AF4U17wp4zVOUTNVwf0NLcw2iooo+4aQDLlsZi5ityPXaHzoNPDOXEfqev0hn+TVdSHDwEOGdfgZ9C13gjk4l5EdCfiTkR8+T/Kg38VHftIYAVHe3UbRpaO6NQnKH7+w6ILj7eb7uDXL7XqC2B0JsdwBrDwPU7sHh0QMK6+4wWH2Q3brhrwbAkz0Q7NXjQl49NtzVI0BdPTDM1UNCXN0B3urhoK16bOQwpFX/PTwUyurRL1n74UL0B+kMg0AMhK16eMiqnoPRAVU1bEQGQ1Q9ODxVj1HpDUvVf2zuE47qyV7B9hrsIARV/wEeCD314LBT/RKVQnBTQ6Gm7kqWh7qwCatv4jZbLWo8zVeTGHzoJteSXtCKC7AumLM/nrPqJTpVcwP7Ka8BVPvb0jEvfdCz+w/n/aNlbxIluweBpne5fml8wnfIctowqvW9oVkPSHDyOA66h2PjaNVrolSHzfEuU/xuZniHpOkwv/sJmYcwux/P5H5Mc/uBTe0HNLMfysRe07x+GNO6Y3O2m9T99uUQU/qRzeiOkWg3n/uNxBCz+WFN5h4dD5jK/Xs/yER+UPO4Mz+/h1k8jBl20+bwEzWFOwa21QTuN5gDTN8HNXvXtR+GmbrdQL3do/jwwLwPCsh7D0C8gbkNYb32CJG+X2zXh8d0fTws18fCcH1w7NaHw2x9bKzWB8VofTxs1o1gsgZEVCsGa7d8ujvm6uaxVlt72oZO6sdUDaGWhjFU7whfOgS6tDds6WSiZFfpc/R0T/K+/jG5qfS+NXVC2KayRAELIHePou7pHueLyoZv8VyFEAT6webwcHFPrB/fxcXR0Zcgj77y63Dc5bWwAeinvXLszpzjPPBKKJtDfHtXfSEDQHAc6Z/zcgkK7o46fymu8uhD6+WOGsejuX7qXtDPuI3e7zaLa/bl4OCWvUBwBQBXAHAFANdTBABXAHAFALf/DAgArgDg3icA7vNFtnW9B+xnwrvNqI75uqTkwKkGf/WOURUO1ijxGvLW3kvPwNmttv85iHHOA9IYsJ6a4TiZ5peX6LhVtdG5So6NBR2VvvAjR5qzOsMCHXqLRxSfRhp2V+eLO/5jX2uSSma5EsEpYEayp+Ai+wxHzmqZI4Atugxyv8sItaEXuFu0Gqy0AIB8fEmbRocDaCheDkDKZylcm1/6wRUulKhO4GIfX31T5NpN48zJV3RBHdlj2kno8F4TV73qO+zuSsBNOweAQ3QK8YWM670zTlJfU0HM6nXFE3Cj1c6MAUiVvDrHrFSwHtQP1NyB5lTycvXUCj3b0bLKTNNKLZYFCAHrjXb7QyPhv1pbgKxDOAJ7rZAty3R6oRqK6rA6x3iqZwAsy4lCE/+y3Ie7AVx5sNHchZeP1bmqES3p0oi3lDnV37npytXC0jJBHMikpI1sIh70bmRnuZq/Xd5VlKTp773tsVoyanEuVsNClDaMSf1I4qpcjcfZfLysoVW3SCqLJFGFrhYRZZonIkpE1FMRUc8OJh4M6Y+UiNzR0Lf2SXNXm5bWo2NwrZzR9zSzZrmHcG7afS+BGWDQhH6w971Q7wn0ntDtPe5qiTWVWFOJNa0WiTWNJNa090hIrKnEmkqsqcSaPplYU0GzdUs/NFsT1vFIaLYbiPXSqk+1h45C7gR+MQSoz8ift9gRI4OC6gaDJfgvNPXPV+fn05btvNCX7iakCE2TqrHrG3KiWSKNHFwzHHtGDhe+DAHfkJqUGG70oo//mwweRCPiOR8wE8PARi/g8os+0Wijzkc+uFGLBToYFJGDNLimOtxfMyiO8PGqv+qC/INgDPBo0F4vM+Qsg2TPqj+j2QYNpjXST0NNqrezRaU1+5dVEMSJphgXAEgBgLwTACSdJgIAGVWKAEAKAKQAQAoApABAfnEAkA5Ki0BB9mqHQEEKFKRAQVIRKMjo0e8Veo6OQEHWBkOgIOtFoCAFCvLLgIIUFENBMQx0QlAMBcVQIsskskwiyySyTCLLJLJMIssksmzYwEpkWa0IiqGgGAqKoaAYCoph/f2CYigohv17KiiGgmIoKIZtLxUUQ0ExFBRDQTEUFENvERRDQTEUFMP+MyAohoJiKCiGWATFUCDCBCJMIMIExVBQDEVEiYgSESUohk8BxfAIIh/WOB+O+becF53ibUA2KXdXEPwAK2s1z/6xAjQQHoFb41j3xvEOC8PA+0L8/7u/gl81auwIa3WiWnrEmYDZvO/8BPK5K+ICGtJuarabN+AJ9gUFNFoAXmW4hve9eK3wPRMHebKaw7rpH8F0UPuluf/ztU39UeSry7ZAy4KrAOSFJTkgX6QA32OaN1EL4dXo29HXL9eLUoQVNO3fuR/x+XCX0Lf71QojTuPiq5auUT++Gb367Wgv3hudL/LRt3Eym/z22zV7onbDhyL/fDugM/onwf6s3ZppuhzWFvWDzbeEtb5eu6jVn/NOV+JvF4ZZkzyzWmYlBqel3qyaa1D1lC4oLh0UobdpUszJOsfVpTSnF9+9bKmUWxBnE5KVaoeo5383yovLXaVVrz7DP+MFKIvw13e79gej70ZXy5kvvqBznPk2Zn55eqv6MuspNd/rX0X0s41Jzrw8mrXeFVRh004jfDSwmXfT5Xg3L2NGeQnu6MP0PFPa1A/HH3ffwmBHv8OA9/Sfty/X29glDszHj3dbwaemlg0vYbs1qku2eolvrgrUwX+iXv1nRF4ol20+Rn3GU1LESNWolFz0kapzfjXT0Da76Txelbvq65/V9z+Xq3MzFj+rpa1mFR7dfbULq3q3uCpnqH8Mn4Z2P2NcURY8X9MZ7vmi5Yj1PFk5pXzf12R/yyNWIHseMHLS811tb/ueoO3m+cYu3xbV0+tsFQBtWyTNSdKcbJE0J10kzUnSnCTNSdKcJM1J0pwEQFsAtAVAWwC0NwSg/UCQyV3N+GXjZz8VFPNHw/HWyNjnqj+ExbMOMPYQLGxdgYBXC3i1gFcLeDUWAa++gwkm4NXUWAGv7soYEPBqAa8W8GoBrxbw6uDoCHi1gFcLeLWAVzsPCHh1JUxfwKsFvFrAq7FIVJdEdUlUV7VIVFckUV29R0KiuiSqS6K6JKrryUR1IXg1pDLwvf5d8Kur1ZhLs6v8JgKroxbGRUp7slwC7hRB2QAOrBPGoxGo21N2MeclSi7IzEndy/k6wCwEX0X7NgBCTfkeNUFZjcWteQgPdNXwDHCifAvhkECzUU15tQdmZ64Og0FGgSCGPzHEcGjxTxAkpRbxUq2hO86Lp6o7Ts9NkmHoAGJJqy+u8Q1+Ox6HHd9NiWM9Z42rNBPHNQycOYFlF1h2gWUXWHaBZb8SWHaBZRdY9taffkGw7DutV24WlN0+f3h86uK1q38KYPtmAdth9aFemJZvPi+y4vZQ/bnOfj/w1qQbneInGOheVz3dJrRufqOOo19YQ+GxDRAtpsncBpRvGItKMO1tEUx7wbSvFcG0F0z7SDDt/eMsmPaCaf/FYNo3D3fvYwJ9D0Wg7wVXWnClBVfaLQJ9L9D3nuaJiBIR9VRElEDfC/S9LQJ9H2yBQN8L9L1A3wv0vdNjgb4X6HtbBPpeoO8F+l6g7yVJUpIkJUlSkiQlSVKSJCVJUpIkA+Pz3JMkBfreLc8B+n4Y4PqyWNXw1u0nYbj1OI63HJUe1Pv0s9qkJW5nlgnXr7bwcI8OEJjlhOs7pDRTMKJc3FpE402c2FyIJY7JBi2gumwOHYjHSQwuhdfRGKQIGUe79DfsKLWT4IdUg1lAsVp4I1j456tsOqH6dNJLdL03evXtaG8L7gOUjadfTy6lkdow1B19p/HaTb3Z0vjaOjwtVbZR/adbGnKXoKWthIdob7VGb19Hf0nPr/L8E356Q3/rYSdEY0KAteuWLy3dhUwNwaHgKmJ+qvYQnbXuADoPLBBtfJdRsHUbTMNPUpBaPPFmacTR9SvnTw01flnkq8XrxlDyoOmBhiHIC2M4xrXxZRXRJMek1ChIQvmx9sVb9Rl+uZiuimRamRUa8Ku8QCQt864Zf6EWzmqaFO5PtgApPYe9Y3QLkFbXTt8Hkg6cYRbsfDU7hxhQsDzmMV/CLt20tGVSXKbGwWTzKctUT0gTJV8Jpmk2TvR5QYvhpPphUy52NDDRIXG2bS8KvBbENMJlBO68JQBm4WXhKSWFv2xtpKnvxNdaE4C3bnOpaX2GcRQYR1WHt3nYxdamTeBgGOPdpRWjGns/maoD4htaaWuA71fOI7vcO8D41aKn2GH3IvzQaSYaohgmqcNP4Jromu6kOXwUjW0l2yN23TqeH4H3F3h/gfd/pvD+6bI3wv9pWttT7a7eLwDEkfK/P+RK/neFy3jNhEPn95XhXdBHmMmsJI0J2jAQAgwEg0Esk/xmDonhqn1dYCzbJ0oy5bPtURT9hO5iJ+adv9uJto/TG7VRttVf75UCrP5q1Jqqc9R3O0NVeL6gKj1f0BuGDHpNgVhn3N9Vq9CLStWczVYzR0lg5Bo8LskhkqgT7mZ6a2A0tQ1nM8pQKeiaiL3oRQOY00npMaoUoGnkSP8D9yl4mKnam5fRjo37zdeDbFytC64zjlr1MbvSDJyWD7r21gRPPChQZhN0xESp5aBfZ+WVGpTlDUCJmDSgf6ZFjq7m1dz43Dvxh4IOgYGDVaptN1YCfJ3BOuXfcl48mI8IYkFhp44mirGjtJwsxAoPJKCA+P1Kb7HCT+ktgUq4YZUOWgsoa8VEo3RYq9fqvW2CnMrRso79opcxYFSBNoS5cGAabyCwLOz4otfs/gr/G+upacr88G0j9uTNZ9A4KmZqYHrrP6kiHdDM6uboy+yZT53RhXIL7XMoj/ePD/2rO5Ao3GhqMIGzvaU6kJC/wVVkYBBoae0QQDBFGINCzeQt+HDrS5VlABozrhyAF7ZLtW1suqlZILCsNf+wMSIIaqwdjbxlTOS87XKyUPstgNoPxadKON92g6pHZtR6Nz+Irm7rc32POE9flTT2sF6vsgVdznKkaHgCqJC6YBl6YIUezXei43wJ/3mDN/04nYd5WqpP8ZM7jw81bVOjw0Ixw+RSTC3DQ94xU0pO9U7tSKqnj0BqclfDK+LKSSOE6lFYnqfovaFEW1/9PHrqH+7grfkqfg2ervQN2cBT8EnpoPVE+xO9mPS2zNLiMgU/3/gqNJdBgcTt7TPdobQ/XULJilAggqftt7EZ9pYHOuH9w+3Dk+Gt4xmuF9cF2CXXOkes39J32kRiHcDb1bL/F0hvXEH/VhOcFQC2hb5NpXa63xkceVNN64uQcg2mR/00pfggCG2Z0pmCNx7Vk3NHadWQ/Qgy2EQObKt/be+0JDpAcbfO9tF8W2e51DaEObAwXGIbv9seDT5se2SpbuD+TKtP62iWZ/xbfa6xDYyHGv36nI9co6xpALEKI4AvZESN3+riQmnfMINam8chm6RLzKfyjdr7WjgQ0edVMfepliW/HFxq3I3BAWN+n0f/8YNyCsn/STHhwfuqNLU+0iW3fr337T346upXZN6HBkgjKL1keP8Ded+2kc9kZdfpTKEJCgXyHTp0E5ghl7h+Q8xtu/VjDurC2Hspw0up1ZhPiWUQakXxARC3WXrt5vCbFQAy4xaXq2pw4DVozpHdPp84LgFUxRCSDR02s3ySXSDSDJsyAyhw/BYTIF/EymieqKVkB7W11s5TLtK372k7KQ2U/nP9g1MfT7Yhh4RA5uzzjgHuI0UcPL07MEe6KWraKWY68Br0C74/fvvX6Oh7rAffR0fLVVJyYqmaAw18Ghr6o4taTBs0cMf6H9WSWRUOkh07nLVcNSi8oR11lcxthYukLE04Ny19QoCelmyuQ46l3QUcQo4S+nOQ+O7KgXqlimE0cKDhxRg7StcjxWqKIH210Qspo7DYGalH7d453hjpeZyiX9UQEGFLLXKoGrgZRH+aszvwFu4s48rS+vAnbrbOnw3U1AqDXlsTmgAKWN5x3tAGs6nL8fszXgdqPr7d+wPiPWJg7w547HD60gyBfPixr/deRQd86ikd5ru9PZpOyu4OvIouPwxYsoVZMgsB+zB2M6gv8tVcp41SHjMQri6XsI4N2g0u25D01PROAAL+wkHatKjiWLVOfzYvPIFfxPv41JUakrR4GZ6xfbS6J6SxZReRlhbQm6DHT5d7PpTV/pktcoowC/WjcXPqSiDI/B4bVCH15WXOceLVW9Wkcpl6J67JacAkgfLIisA7skjYEPf6MC1YDkqNvLhM4AKVAHQ5KuSfIfHxAuMz6GBGJ89Lc/qq99+yR9N4ESlEANVdQoIz8UEhnxDVjnE0Gz3UpyG7q9d5vlE+Te1qYLFjIvtNwNAoOnLwoVHpQSsDptfo/0oCTQE3vTUhFQpGt1uTAY4ZooxO9HGrVgNf7boS3d70JwvQlgtAAMMGhqbPRYMYGemjfjxLigxE0lzt/QmjP1OPIG7RSIVUAzpbmIag60pHt4XWSufltFuGLiyTEF+UHJP9nMTaPfGiujex9Amv8FSZz3TIVncAwJST3802yQ/6oUvVSQIv2mYGgm1bBYGL2C/YvFeiMJ/DGq1FtoTWxbFaQUCKwCIPbRlXCwOwFZCPE3IM217EVjczATU06xetTjQoS/Tr6NdplZixBkNr7B2PbBIdHp/+/Hb/T2/ePtrusJH6z2pb5DeQ52h8L5vYHG/5cktP6CRdkCDU14YcTwU69/7bt+Y5VgTxbgyylQKvQLOM4hp0fhg7svTquVSmOeQOj+EcRteTUfF1Th2cEBAFTKQELnJMcK0CKwDm4BW3JgEL21xPdiToTYNGY/B6HMQZBjJK6RfFKjCXaJgVuKN5EWPWORqFOSIbq74wIq0Jb38yK7HT6T/kauZ9Zc1a3206BwWhAr2uGgzgBbf5ygbGwIDdzMNXC5FZpPv6ab1utDjn5Yo2sZWBiY55wjUPWZRB0YccDDoumaSqhigt2JpxKscZCi2RPhegULrSZm25WwKtLT2vdNR4TPPxJ5xhTYA1qIkdSwcKyAEEL90/PjQ5qfBC4+fYVgsohSDz+UQ3YpuSF5XdUBCWc+drbLV2y7LIcohI0tuYMdLQuwgJ51OUHZ31VzKteEt2zQI4BtJe4RQV65aFaczCFPL7f2WHKNZcX50vB00Y6MtQ964KaIRnVZsgIRVgeeWqDyCDUtjVY9a07MstG1nn291In4sQjK4tZzkJZ9MUiGSAQ1+JvXRSgr4FE7odLSDavnQ3Bk59+FoWCiKQ32RK//n266+jFx/nagtDHjZ6ht8AqcvtSyeMmpyI/TabHwyrWuxhMWiXmS1Uy/nD088EPOsjqXMQQhlZ6/asPf+3pU89JMeQnGBbHjk72JbeMjjsAKAydOyGZBHbsvnsx0A6sS29R6o1D9SWoQM1IDfUlnsYp9YkUVt6DlNXFAaU2NFJgo/BQg8+0OG3iaM2nBkqPfxjUIbc19crb49Y6Xh5MwZfl2E53Mbl5Ybnn6fK6Mryosa98khX2tBVTNRuhQrvo+0a6ptN2LWGaodCY+yph24QpbYiKwpcSXP8t/oyWZQrjFMI1IuKBUU9aJTRyMGX/O///K/SdmQBlsgsBZiMrJy1C4Z+lgC90Ivns94YQTnQlXrHqclGFJd1aIEusXOFIFUwaFWUW+YQ0XE7jn5s7o+XTcTJaiGPMdJD7NoQRrj+x1be2mUwOkyWiebz7GxyiiojEe701Xf6mnNDDLrNmXQDjslOrKTW9vU4MB8GQ8ktj4en5JbHxFZyywPjLLnlATGX3PJQ+EtuWROLyS0Pg8tUmZ/+AqKPvbaObFjPZntCVtugUexjua0ziutZbw+NB+WWgYPWcTWoy3ojNwg/yi0PiiXllgGj1wtjyi3Dx/C+sKfc8kRxqNwyYFJ6+CXWmYi1fBMPjGHllt4j1tPqX9fuj6L2mHPzxKDZQNvD3HzBhFjDCt5ltc3xNF9NYggeMRyL9KKOLC5Uq+fZdMc1Rm183ww0X1YHGHJKc4KGbh2x7c7N46maW9i/OfboNB0XKQLphNvWc14nlSo3Pfy2Zh/SQInfcoYu3O34Zoln4r4mIlRnryHssS2C0Ay63BGiIRgJgOANwfzKIGRDtavB8WBupsMchnwTHqXv3Qr1WPBbogl96qbiNLJwgrde72zydUKprFRb5a2lmzCRV1HvuyyLHkPW4LPfxLDV6WSMo4ljlGoep1ouUaDiHIPwKR5k3sYZf1efW19XzWbcND0lZU/3zDAh+ZBumcd3yTwFd8wjuWIewQ3z0C6YO7pfHtb10nPTd7tchu33dVwtT8TN0nPEut0rw0ZsHbfK47hUBgxQD1fK8FFay4XyKO6T3pfiA9wmw8brvt0lT9xV0nMCOl0kwwZ9DdfIo7hFNmX3recKAVC6w0Kd8pyauJFkjFqd2pBaIoprMgMULJwayDs06D1OFDaaVSUE7IK+NYGq6Jhv5zajcobhExhVyEqaevXeTjRLkzlBV/LLkLGK09Kwfs7LhdYCvTw2bZrNMs7GDqZnvD9789rbaZNETPGlf4fpGS+n9MYoRppJ9ejf72LQaSuojfQKSv+p+2Bq05NWpbaK7KbSNrBJTeak4W6zrEIaXEMk07+GFwF+Xorqop0zVuCrrEU6ur8jQqb2ZodAF9p+lV1Cou8UxCIzs6eUSujAVBumXQhIUAuoxBWm7XNIQQMwRy8RsS4YS+tUCd00YxYdQBxlvFoAaaw6MFjHtBVDGrlSdtPSwZzLLbTkBWp8wegH8zu1Fcxo0ylks48vUzCSLkG6FwTw8aMRLfS2UfQXT0f8iBdUMLlP9Uk1L84v4mWROtONMNOmlzs15dudJ2csMPshZNlDzK62MxL7MhDaehlr5Dc9LJBggDHA5hsaXNUKQIjIKsHivy/Be0DJ5qF2ULL2HO1MmL6sJMaECSSKONOG8MJm1O1MAUpbAVuu+MT5ixTn3HOlu6TjvEuJtgDBwCjpEZZ7cx/A3gf/CRq7laHXIDRBVyCFkF8kaKX5Fr5eE91Co4covO7S3PrLQR9GtY7Lc3YCv7G/wIGDaMlZO04uvgbPaMZiBU6ezhEJh3nG9m0t3zue5JYnGt5E73PrgTD5W9/eqtjkf1c+bkNPJo6LyqNt+Mn4aGUpaE6Tu0AoNyDyO9CjzioYrRZl1uA6eQD7PdNRh/BnNPkO8ND1UVfZe/4OUih8LKOBVcw/JWyNdbC1jubWE2Z0P0rjSiLmYwAEm1yN48zywBPGuac+PdQ7ausoWfa92z6Uo99XOuvK3VH1aU/l+uFFvsAIVQMUU67GSn6OtUZbrpRSChMPEzdrpTxHybsoUlJgAastm6beBloXLSYwKpl2nnupWxniodIA4LZH3Vz1/mo1S+Z8liwoBch386gWcpnqIFt2E3M6FhxQuB6Zql0d22lRYLwnzJ5Pu3CTN5OxRpyA0zL9vMBEUxa3F9ln0GRclAAE7/XUidr/CzzyGBACDmegAX5Jad3aR65BU/hWMZ+l4Du+9KePX6zmkwQJWeHVN0Wuz0TnFvHMAvGCSzZipodqVK3XN+qq5G6WK+keiLM1X6nVjuuCrXtXtTKara/poCvp7cITcqPxsbI5efYJ34gRwRB+ewmQETqN2LeeVA93KkAhCWbclatFlXfX1y8aGe8mBbugzBwyE3eRZEt1TFyohmNqbpHppTDLShPtPfEv3H0wDHFlgjxxF2Y+Hq8KDc9JHgeWJSaynyfYN7pshyaTCanaKK/MdYBDA8LGj5rSXd56Bq4nuDPUalLrd7HyCPaQ+F2pcUHQyHSy1hllTiaKDwclnLBQyN5rl7P8VM3Q1BCD+vP7Oa82wYVWpBdTzKBvYppgh3LvyazWjJp3kEpau+jZw4HEaBXim4ETCgqGmVaf5hDth86k0gXKp9oQX8aY95Dwi1gC+kads923UWfZ3uRE98TOr8Pkw+R5pqq56p8idL3Jj09cEG2Dm01HGz1FZz01Ga9Ir/MMhI0SKSC3W9KLlcAmZB/O+eBqtG7jpuhz1dwSRF+MlWmczPi+MAhBr0x7MJer7S8HATJ1Qs9viHwPM5vpE82+53zko98DC9vONDZTT2KVwqph8MDM6AWrH4Wb3RpnmDZ/6o96CcYcNsDBPGgcOsQ1uRxceN/csOSIRqv6q8Y01LnBQFmbaN2ozBCBQqM7VSyzZjMMSKj+AVSmOjxbVBq0f1llKgOsGm9ThPbtF0z7Rqew0L4J7ZvQvnnmR2jfhPZNaN+E9k1o37jcj+mK7fXtCWGEE0a4ehFGOGGEE0Y4LsIIJ4xwtT5dCSNcW3uFES4SRjhhhBNGOGGEE0Y4LMII93QZ4YRD6JfNISQ4poJjKjimzwnH1AGzEURTQTQVRFNBNBVEU9/8CKKpIJoKoqkgmrpFEE0F0fQXiWgq4Jr+IuCavq4KuKaAawq4Zr82CbhmpTwFz4CAawq4ZiTgmgKuKeCaUARcU8A1W4uAawq4poBrVoqAawq4poBrCrimgGsKuObwERFwzfb6BVzzgcA14S1ZS1R49RbCPGiGmqyOpUE4NKPdha3Wmh3kf6N5IbqP4G0W08Ncf4DHN+iypog5CrVrve/pcklP1aydMbQkYf3cNevyLcDjsKqd2ukwAJaIbYJHGhxGtC8ojwaPwXb5Q749E3JuUNJWcyW3phhtbt9GPrMJJ6MlS+1u+zTPb+Y7dDquSg3igc2FCtuFn3oKZoQkK9eO1w5jMM5gZ7S1XK9lgORAFbzluU75OmsDjKXSPy2WUElh+xLQEUOfMnQnDIpmYSRMMRwiM30dM8RqNiYscKreuh0uWmBuh/WXAlQRkPbCgofSOsFcblivpnegAreCpFQrNbG0sDCgw+OrHHK91EJChU69DJZcVbV08RGiy1WiXryEEFWELeo5sIzycrfBLZXCVWTL1rzivsN7yvVoFQKlmgE0GKvhLStx8IwNPM7B31TSFQSGAEe5gxEAtnI2UypipnbNtN3fg5u/XOr0OCPBM1A3M8YgTgAhdKxsOLDepgH3Fsyq6Q+N97uPp2dal8V7BJQ7dEb/8XtArVt/Bjw6Qcv4s05gb2lo+e5ozKqzAvCasDk70cc5Srm124UP3HXTAcYW2LJGIrv7Cm+JYDvmI74xGylDZbfHvnsH3pKRqXWEWF4O/IvxEcKMF3lZOtl4aFMYxDWCLT5PxwmY1jYnyioQrY2wiTcXq2n0olSG5QhdRQyoZqt4STEbyXk2hSWFkDcQR682Bx5J2QxgfZN2V2HHZIVU7jhqzeeIsV7PFz1UZ19msCCaC6J5tZwJorkgmuN6EkRzWsKCaF4tgmguiOaCaO4UQTSnIojmgmjeBXtt/AQmo74PbLhnlKgxh1QLf7Yoshw9I9GrvUr7BuByP3mc88cEDn/mEOxPB12/eTWoRG2ZjzNrWtbO7pZdodUu+hfXVWnST5XPGvtVw76fqw5SjsU6qO/Dgd51NYLMLsjsgswuyOxOEWR2QWZ/jsjsENlJmk4/kHb1x0VeWOR1654iQG2j/twDmju8B9v70JjuzwO43edgdEbcd2vzG5065uh2ThycWkJK5WSQt1nyWf/D4gzCVlP6UVsQlqo9A/BHXFyOVN3BCFNdffuPnZWlr6RZTObTSU2B+5+mvvuo/X+Z/nPt/K/N1M5ejBe2B7r+l1EB0R870ac0XUQGlNUqCaqyd6feqcUIl5uspHBeXy7ycb5EexTXiOtVKVZzlMZwO+3rCMe3tMz8b6L92nyjn44FCxoKpj6uxrcvfhO9n9P1Pu0Ftz5Pm27wr6LE+rSXbw6QX/OWF5whWC7EOdNCTnEzoe8e2JiuIZpR2wIXOcCHQSv8W0VHTHtv2MMDQnCZ3BcrbmfJPLm0NxbB8Gv1Av84kZhXJ8GS+qUGaf7VskFU0FF95DQLbIRiWAWP76UUggghiHDK2UDMaiGIqBYhiKjXJwQR7bUJQYQQRAhBhBBECEGEEESYIgQRQhAhBBG2CEGEEEQIQYQQRLhxqEIQUS9CEBFqvxBECEHEI8BAQhGCCCGIaJsfIYgQggghiBCCCLcIQYQQRAhBRKAIQUTrQ0IQQUUIIgYPmRBENIoQRAhBhBBECEGEEERAeSIWvxBECEGEEEQIQYRbhCDinggiIPmQk+M3yRFRrdYkRF7lNxHYiEbBcWkhkiUEZS2dnEiT82ZCpt+1guHootQMCLO7WHLyjrbRcV9VQdYBUi3atwADasnsUVMgPufWPIQKzgXkkaQhSMtqit+rPZ1yeCejTVg8njmLB/TkJ8B0UZtiqdbihufRU/Udp/MmyZaMVQRRAdE1viEkyCi9Z4JtAOS73rPMVZuJ5hrWnGmhVBFKlWoynlCqCKWKUKr4HxFKlWoRSpX2+oVSRShVhFJFKFWEUmVAh4VSxT+wQqliilCqCKWKUKq0UKo0D3fvY8K8IswrwrwizCvCvCLMK8K84hRhXhHmFWFeEeaVjTGvLJWZRh9o4hX7ybPiXYnjeMuJ/I6uX21h+CVi0isdaX+MwJdbLtSPC1HCTvXR55jDrPT9w2v3xmZLUzWMIa6KAE2LLTcsj74pb9UvZo1GFefJeKSUvCtADkGpq4O6THNP8mm60UZOlWxSn+N0qBfGRY5cHS0tLlZTmO0YbvV+KPLVAt8cR9sAMl5ZDjFrAlt47XTOn5FkbP5+nKOvw+1zs0Lw2Ke1Ci+RdCPGu0j84wZOZ/dd8CfxAuCfC/M93RDSJFxeFuklvv1kRSuYBwzG+9RsUfydB4OtMfC6wjRe5nodvI62YfNsD53yA9uSjc68aeNEt5Amn+Y4+tt/rLM+12pscLTuuPvcPvVbtzbQtNdSa9SpVGGIWam3ufmir37zlXd3OIvT+167hJ11fdfG8BPm03RZ7mJwfPZPAhjyP2JcMZ6BarSz2bpFBpBZc8Tqa933lECkP+SwPPZ3rTM/K7hMWbKHt/Wty/xTOi9SCIXoKcR8O6NZL2cWUC7MoPrNdbRvOmNtMikzY576n6jeRj+RFdrRqyfZ5t7bCW8T6oLkaTSo/lFwK99vo9bcyIPqt/9oEWv+AXjMuXqqzWMbeaKU7fx21qrkPYFG+T6uTv/DrfU1G+h94qkthas0mS6vxlfp+NPTbZX385bBrjzyCIKRm7EAGNGnM6C6OdUPWoaQvntqK7XSxLamP/lm+5oXatOdX5/WZfx9vaLy70cW1d1Nqn71QIvGZ7PS7c8sWfQfqAG1Bzw5m3sJRpE/yuARVMxd393ywmyRzHpYLeqxyQRQ65U2ns3W3GzFag63vz1eZ6xuWjil98O7H3zr+Tf/lGHWyr27Oc/5Pe3eznyqMVP0SAc6scUZ/eSj7XaysiMA3VJeX/S9O5MdZ919jLnrgdNjveaQum7FXk7Mex7c+vXBRsftJj2/yvNPMYdvtLdKg2RDwAFvT/jzdfTtt9/g24l3/AN+5taKXa3ey/VsaH0gksWitAvq0Ngodx8QEwMQo0frtRMSUJsvHpTW7wMjZ+5REZmqOiJ9/Pztje/X/CorR51noo6RP+j1/RpQRVq3kDD6E3XGFJdOE+IorkizyheTLLmc5+UyG5cxH2d//B//Otj/cPTz4dH+D8fvT8+ODk5/3j88PHlzevr6j69/rxbqvytVZHN1Gq+K1K1L13F0fPrm4OPJG7ey13+8gBjSaiWrUv0e+KnGKBjQhRizpharFaEEka7z46mq7s2HkzcH+2dvDtUrvj/Z//nd/sGfj47f/Hy8/+7o+AfvKy6UdgDNBNFT/pFjCD4ok0dV/OZ/fzBVfHj//u3rP8JNxr93tBDjo/g0XfLDB28/np69OflZjcr7jycHb34+fXNW+9FZvsin+eUttJufPnv/4f3b9z/8Vbdv54SO/9PDH7nek4/HZ0fvVHWHP5qHbLjDB4j0yC6vlgdo5tYarprwsxqW798e/fDns58P/vzm4MfmYAPWROKC2MTRrru2oKTza/d72rAf3h/C6L45/bB/8MZ8ywRa3xd5jZ4Y4+086GUWNstyaZgd3/rSzb/P+6qPR4ebfdMqs0BQ2Qxv4ykZsrg14B9WDLh/O7Lx9fWr0e9G31Ur+rCaTpkHOzq6OM5hbQC3m3lqmikTQG3nD0V+XomDhZiFH+qsqAts9y45Uf5Z/QrPovo3NGj1lWOONT22RjzRifYHfcy5lTSOOVNbkS/zcT59HZ0dfAhWuteotNmTnrX93tfEGTDBjMvO2iDGKBs86hiZ1GfQUdBmy9sD1WSl+ruVITPAhyK7zqbpZfoGwjoomixCAeA8qQ5VihVvJGxNirzGRRFH+2/fVnrNL5g061WmzH7J6uFvv/uuEnKE330s4dirfkXYAu9Av6usG4RDoM20u5wtdtVmiavrZBd1rfllPE6LZdmYMfjUbYAa4vfz6a0TDRMYTmzucT4/yfNl5Rf4G8h3VvN7kU0rM0wROSzRGWPEvMhVZI99WizWQDGvMG0/FEocfkiLLJ9o2vXolV7lS6UuF1UiJ2UKXlyowx0QNE4BnWE1tW0GLkw01lHRHlWjlWYJiJw7V1PRXLbcyXXa6JkasuTdcSwt/KxXucYJb2i18KEezqrFBKmJmBy0WZXfXX7dWutkXiImF3sqPN0aOT8bldfj3g8a3wGSvGxB2GO5Ap2FTygahiP8cMvZINSJ6QVg64HKpR/oN/6RvhWnlzCVkrsoY8ASiAG+So/hNFNr63Y8TfvPHjd7sxPX7HPH7MFPTvEn3si0ZDLLkLyQz3a/6f5utcTEx7/QcB64MfaVDjZ42uqjk81h4ONxEkOOa6XJu761eWevALfcrIRKfsAWf0rBOnooTjBMgoeIl/31K/7Pueot/E2xmzQS1DxeY1oeBE1s/YBn4uhLPl6x+alZhdjzOMtjbof+YstkAGm9CrJXttiq1J+9MVSWZowYRMfsQ58vj4KZ0DhzHYAtzm0X8tY8Z4fNycs23x6cvFHmEP/j44dD/Y9awGflphoio9+gvC9B4M/T5z2BGBWxqVnEyp7HVNoAkS9lQm1I/93mUoMnPe1pdC4Mv7AJtAEQm5pKW+PzmNRq7MgXNr1OyMWm5tep8nlMcC1i5Qub4TLd2M6FpORnMaMcQ/DMZpIvkn0zmkwXV2pKa3fFd57XWn0jfZUdiF8PzHXgIrxlzqlbd510z7X6M5v5rj0MUV2b2sRQ1/PYxTrw7ZlNJm2eTlPHSei489Q2q1xzC7f/6gGMIDfFxT/tazltfgKsgWfqtrk2bX+mjhvuwD26bvQQqZl/kt6bODp88/bNF+TK6T2ld3PmNOf1Cfpzek3u83PudE/xXd07zuyKh+exZ3EDPp7mfIqb50nN8SYcPc1JFl/PE5vmu1gTzekVh889T+fDuXycyW3z+oi758ls4zs5fJr7WHw+9z6jD+j1aVpGX7zj50ube5sEdQ9LgCt/5iuBe/EsFwSkH7YvB5N1uInpN5WNWnMeA5Pd9psHc5GY5j9Py7rnRGN66UZnG2t85lNukm6b0/7/A7AalfZPogoA +data: + metadata: | + # maps release series of major.minor to cluster-api contract version + # the contract version may change between minor or major versions, but *not* + # between patch versions. + # + # update this file only when a new major or minor version is released + apiVersion: clusterctl.cluster.x-k8s.io/v1alpha3 + kind: Metadata + releaseSeries: + - major: 1 + minor: 7 + contract: v1beta1 + - major: 1 + minor: 6 + contract: v1beta1 + - major: 1 + minor: 5 + contract: v1beta1 + - major: 1 + minor: 4 + contract: v1beta1 + - major: 1 + minor: 3 + contract: v1beta1 + - major: 1 + minor: 2 + contract: v1beta1 + - major: 1 + minor: 1 + contract: v1beta1 + - major: 1 + minor: 0 + contract: v1beta1 +kind: ConfigMap +metadata: + creationTimestamp: null + name: v1.7.5 + namespace: capi-system + annotations: + provider.cluster.x-k8s.io/compressed: "true" + labels: + provider-components: core diff --git a/charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-metal3.yaml b/charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-metal3.yaml new file mode 100644 index 00000000..d3eef5ca --- /dev/null +++ b/charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-metal3.yaml @@ -0,0 +1,4390 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + pod-security.kubernetes.io/enforce: restricted + name: capm3-system +--- +apiVersion: v1 +data: + components: | + apiVersion: v1 + kind: Namespace + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + pod-security.kubernetes.io/enforce: restricted + name: capm3-system + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + cert-manager.io/inject-ca-from: capm3-system/ipam-serving-cert + controller-gen.kubebuilder.io/version: v0.13.0 + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + cluster.x-k8s.io/v1alpha2: v1alpha2 + cluster.x-k8s.io/v1alpha3: v1alpha3_v1alpha4 + cluster.x-k8s.io/v1alpha4: v1alpha5 + cluster.x-k8s.io/v1beta1: v1beta1 + name: ipaddresses.ipam.metal3.io + spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: ipam-webhook-service + namespace: capm3-system + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: ipam.metal3.io + names: + categories: + - metal3 + kind: IPAddress + listKind: IPAddressList + plural: ipaddresses + shortNames: + - ipa + - ipaddress + - m3ipa + - m3ipaddress + - m3ipaddresses + - metal3ipa + - metal3ipaddress + - metal3ipaddresses + singular: ipaddress + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Time duration since creation of Metal3IPAddress + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: IPAddress is the Schema for the ipaddresses API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPAddressSpec defines the desired state of IPAddress. + properties: + address: + description: Address contains the IP address + pattern: ((^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$)|(^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$)) + type: string + claim: + description: Claim points to the object the IPClaim was created for. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: 'If referring to a piece of an object instead of + an entire object, this string should contain a valid JSON/Go + field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within + a pod, this would take on a value like: "spec.containers{name}" + (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" + (container with index 2 in this pod). This syntax is chosen + only to have some well-defined way of referencing a part of + an object. TODO: this design is not final and this field is + subject to change in the future.' + type: string + kind: + description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + namespace: + description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + type: string + resourceVersion: + description: 'Specific resourceVersion to which this reference + is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency' + type: string + uid: + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' + type: string + type: object + x-kubernetes-map-type: atomic + dnsServers: + description: DNSServers is the list of dns servers + items: + description: IPAddress is used for validation of an IP address. + pattern: ((^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$)|(^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$)) + type: string + type: array + gateway: + description: Gateway is the gateway ip address + pattern: ((^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$)|(^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$)) + type: string + pool: + description: Pool is the IPPool this was generated from. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: 'If referring to a piece of an object instead of + an entire object, this string should contain a valid JSON/Go + field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within + a pod, this would take on a value like: "spec.containers{name}" + (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" + (container with index 2 in this pod). This syntax is chosen + only to have some well-defined way of referencing a part of + an object. TODO: this design is not final and this field is + subject to change in the future.' + type: string + kind: + description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + namespace: + description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + type: string + resourceVersion: + description: 'Specific resourceVersion to which this reference + is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency' + type: string + uid: + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' + type: string + type: object + x-kubernetes-map-type: atomic + prefix: + description: Prefix is the mask of the network as integer (max 128) + maximum: 128 + type: integer + required: + - address + - claim + - pool + type: object + type: object + served: true + storage: true + subresources: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + cert-manager.io/inject-ca-from: capm3-system/ipam-serving-cert + controller-gen.kubebuilder.io/version: v0.13.0 + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + cluster.x-k8s.io/v1alpha2: v1alpha2 + cluster.x-k8s.io/v1alpha3: v1alpha3_v1alpha4 + cluster.x-k8s.io/v1alpha4: v1alpha5 + cluster.x-k8s.io/v1beta1: v1beta1 + name: ipclaims.ipam.metal3.io + spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: ipam-webhook-service + namespace: capm3-system + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: ipam.metal3.io + names: + categories: + - cluster-api + kind: IPClaim + listKind: IPClaimList + plural: ipclaims + shortNames: + - ipc + - ipclaim + - m3ipc + - m3ipclaim + - m3ipclaims + - metal3ipc + - metal3ipclaim + - metal3ipclaims + singular: ipclaim + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Time duration since creation of Metal3IPClaim + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: IPClaim is the Schema for the ipclaims API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPClaimSpec defines the desired state of IPClaim. + properties: + pool: + description: Pool is the IPPool this was generated from. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: 'If referring to a piece of an object instead of + an entire object, this string should contain a valid JSON/Go + field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within + a pod, this would take on a value like: "spec.containers{name}" + (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" + (container with index 2 in this pod). This syntax is chosen + only to have some well-defined way of referencing a part of + an object. TODO: this design is not final and this field is + subject to change in the future.' + type: string + kind: + description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + namespace: + description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + type: string + resourceVersion: + description: 'Specific resourceVersion to which this reference + is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency' + type: string + uid: + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' + type: string + type: object + x-kubernetes-map-type: atomic + required: + - pool + type: object + status: + description: IPClaimStatus defines the observed state of IPClaim. + properties: + address: + description: Address is the IPAddress that was generated for this + claim. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: 'If referring to a piece of an object instead of + an entire object, this string should contain a valid JSON/Go + field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within + a pod, this would take on a value like: "spec.containers{name}" + (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" + (container with index 2 in this pod). This syntax is chosen + only to have some well-defined way of referencing a part of + an object. TODO: this design is not final and this field is + subject to change in the future.' + type: string + kind: + description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + namespace: + description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + type: string + resourceVersion: + description: 'Specific resourceVersion to which this reference + is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency' + type: string + uid: + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' + type: string + type: object + x-kubernetes-map-type: atomic + errorMessage: + description: ErrorMessage contains the error message + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + cert-manager.io/inject-ca-from: capm3-system/ipam-serving-cert + controller-gen.kubebuilder.io/version: v0.13.0 + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + cluster.x-k8s.io/v1alpha2: v1alpha2 + cluster.x-k8s.io/v1alpha3: v1alpha3_v1alpha4 + cluster.x-k8s.io/v1alpha4: v1alpha5 + cluster.x-k8s.io/v1beta1: v1beta1 + name: ippools.ipam.metal3.io + spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: ipam-webhook-service + namespace: capm3-system + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: ipam.metal3.io + names: + categories: + - cluster-api + kind: IPPool + listKind: IPPoolList + plural: ippools + shortNames: + - ipp + - ippool + - m3ipp + - m3ippool + - m3ippools + - metal3ipp + - metal3ippool + - metal3ippools + singular: ippool + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Cluster to which this template belongs + jsonPath: .metadata.labels.cluster\.x-k8s\.io/cluster-name + name: Cluster + type: string + - description: Time duration since creation of Metal3IPPool + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: IPPool is the Schema for the ippools API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IPPoolSpec defines the desired state of IPPool. + properties: + clusterName: + description: ClusterName is the name of the Cluster this object belongs + to. + type: string + dnsServers: + description: DNSServers is the list of dns servers + items: + description: IPAddress is used for validation of an IP address. + pattern: ((^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$)|(^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$)) + type: string + type: array + gateway: + description: Gateway is the gateway ip address + pattern: ((^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$)|(^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$)) + type: string + namePrefix: + description: namePrefix is the prefix used to generate the IPAddress + object names + minLength: 1 + type: string + pools: + description: Pools contains the list of IP addresses pools + items: + description: MetaDataIPAddress contains the info to render th ip + address. It is IP-version agnostic. + properties: + dnsServers: + description: DNSServers is the list of dns servers + items: + description: IPAddress is used for validation of an IP address. + pattern: ((^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$)|(^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$)) + type: string + type: array + end: + description: End is the last IP address that can be rendered. + It is used as a validation that the rendered IP is in bound. + pattern: ((^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$)|(^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$)) + type: string + gateway: + description: Gateway is the gateway ip address + pattern: ((^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$)|(^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$)) + type: string + prefix: + description: Prefix is the mask of the network as integer (max + 128) + maximum: 128 + type: integer + start: + description: Start is the first ip address that can be rendered + pattern: ((^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$)|(^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$)) + type: string + subnet: + description: Subnet is used to validate that the rendered IP + is in bounds. In case the Start value is not given, it is + derived from the subnet ip incremented by 1 (`192.168.0.1` + for `192.168.0.0/24`) + pattern: ((^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))/([0-9]|[1-2][0-9]|3[0-2])$)|(^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))/([0-9]|[0-9][0-9]|1[0-1][0-9]|12[0-8])$)) + type: string + type: object + type: array + preAllocations: + additionalProperties: + description: IPAddress is used for validation of an IP address. + pattern: ((^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$)|(^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$)) + type: string + description: PreAllocations contains the preallocated IP addresses + type: object + prefix: + description: Prefix is the mask of the network as integer (max 128) + maximum: 128 + type: integer + required: + - namePrefix + type: object + status: + description: IPPoolStatus defines the observed state of IPPool. + properties: + indexes: + additionalProperties: + description: IPAddress is used for validation of an IP address. + pattern: ((^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$)|(^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$)) + type: string + description: Allocations contains the map of objects and IP addresses + they have + type: object + lastUpdated: + description: LastUpdated identifies when this status was last observed. + format: date-time + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + cert-manager.io/inject-ca-from: capm3-system/capm3-serving-cert + controller-gen.kubebuilder.io/version: v0.13.0 + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + cluster.x-k8s.io/v1beta1: v1beta1 + name: metal3clusters.infrastructure.cluster.x-k8s.io + spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: capm3-webhook-service + namespace: capm3-system + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: infrastructure.cluster.x-k8s.io + names: + categories: + - cluster-api + kind: Metal3Cluster + listKind: Metal3ClusterList + plural: metal3clusters + shortNames: + - m3c + - m3cluster + - m3clusters + - metal3c + - metal3cluster + singular: metal3cluster + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Time duration since creation of Metal3Cluster + jsonPath: .metadata.creationTimestamp + name: Age + type: date + - description: metal3Cluster is Ready + jsonPath: .status.ready + name: Ready + type: string + - description: Most recent error + jsonPath: .status.failureReason + name: Error + type: string + - description: Cluster to which this BMCluster belongs + jsonPath: .metadata.labels.cluster\.x-k8s\.io/cluster-name + name: Cluster + type: string + - description: Control plane endpoint + jsonPath: .spec.controlPlaneEndpoint + name: Endpoint + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: Metal3Cluster is the Schema for the metal3clusters API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Metal3ClusterSpec defines the desired state of Metal3Cluster. + properties: + controlPlaneEndpoint: + description: ControlPlaneEndpoint represents the endpoint used to + communicate with the control plane. + properties: + host: + description: Host is the hostname on which the API server is serving. + type: string + port: + description: Port is the port on which the API server is serving. + type: integer + required: + - host + - port + type: object + noCloudProvider: + description: Determines if the cluster is not to be deployed with + an external cloud provider. If set to true, CAPM3 will use node + labels to set providerID on the kubernetes nodes. If set to false, + providerID is set on nodes by other entities and CAPM3 uses the + value of the providerID on the m3m resource. + type: boolean + type: object + status: + description: Metal3ClusterStatus defines the observed state of Metal3Cluster. + properties: + conditions: + description: Conditions defines current service state of the Metal3Cluster. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. This should be when the underlying condition changed. + If that is not known, then using the time when the API field + changed is acceptable. + format: date-time + type: string + message: + description: A human readable message indicating details about + the transition. This field may be empty. + type: string + reason: + description: The reason for the condition's last transition + in CamelCase. The specific API may choose whether or not this + field is considered a guaranteed API. This field may not be + empty. + type: string + severity: + description: Severity provides an explicit classification of + Reason code, so the users or machines can immediately understand + the current situation and act accordingly. The Severity field + MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + failureMessage: + description: FailureMessage indicates that there is a fatal problem + reconciling the state, and will be set to a descriptive error message. + type: string + failureReason: + description: FailureReason indicates that there is a fatal problem + reconciling the state, and will be set to a token value suitable + for programmatic interpretation. + type: string + lastUpdated: + description: LastUpdated identifies when this status was last observed. + format: date-time + type: string + ready: + description: Ready denotes that the Metal3 cluster (infrastructure) + is ready. In Baremetal case, it does not mean anything for now as + no infrastructure steps need to be performed. Required by Cluster + API. Set to True by the metal3Cluster controller after creation. + type: boolean + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + cert-manager.io/inject-ca-from: capm3-system/capm3-serving-cert + controller-gen.kubebuilder.io/version: v0.13.0 + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + cluster.x-k8s.io/v1beta1: v1beta1 + name: metal3dataclaims.infrastructure.cluster.x-k8s.io + spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: capm3-webhook-service + namespace: capm3-system + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: infrastructure.cluster.x-k8s.io + names: + categories: + - cluster-api + kind: Metal3DataClaim + listKind: Metal3DataClaimList + plural: metal3dataclaims + shortNames: + - m3dc + - m3dataclaim + - m3dataclaims + - metal3dc + - metal3dataclaim + singular: metal3dataclaim + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Time duration since creation of Metal3DataClaim + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Metal3DataClaim is the Schema for the metal3datas API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Metal3DataClaimSpec defines the desired state of Metal3DataClaim. + properties: + template: + description: Template is the Metal3DataTemplate this was generated + for. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: 'If referring to a piece of an object instead of + an entire object, this string should contain a valid JSON/Go + field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within + a pod, this would take on a value like: "spec.containers{name}" + (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" + (container with index 2 in this pod). This syntax is chosen + only to have some well-defined way of referencing a part of + an object. TODO: this design is not final and this field is + subject to change in the future.' + type: string + kind: + description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + namespace: + description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + type: string + resourceVersion: + description: 'Specific resourceVersion to which this reference + is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency' + type: string + uid: + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' + type: string + type: object + x-kubernetes-map-type: atomic + required: + - template + type: object + status: + description: Metal3DataClaimStatus defines the observed state of Metal3DataClaim. + properties: + errorMessage: + description: ErrorMessage contains the error message + type: string + renderedData: + description: RenderedData references the Metal3Data when ready + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: 'If referring to a piece of an object instead of + an entire object, this string should contain a valid JSON/Go + field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within + a pod, this would take on a value like: "spec.containers{name}" + (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" + (container with index 2 in this pod). This syntax is chosen + only to have some well-defined way of referencing a part of + an object. TODO: this design is not final and this field is + subject to change in the future.' + type: string + kind: + description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + namespace: + description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + type: string + resourceVersion: + description: 'Specific resourceVersion to which this reference + is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency' + type: string + uid: + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' + type: string + type: object + x-kubernetes-map-type: atomic + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + cert-manager.io/inject-ca-from: capm3-system/capm3-serving-cert + clusterctl.cluster.x-k8s.io/skip-crd-name-preflight-check: "" + controller-gen.kubebuilder.io/version: v0.13.0 + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + cluster.x-k8s.io/v1beta1: v1beta1 + name: metal3datas.infrastructure.cluster.x-k8s.io + spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: capm3-webhook-service + namespace: capm3-system + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: infrastructure.cluster.x-k8s.io + names: + categories: + - cluster-api + kind: Metal3Data + listKind: Metal3DataList + plural: metal3datas + shortNames: + - m3d + - m3data + - m3datas + - metal3d + - metal3data + singular: metal3data + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Time duration since creation of Metal3Data + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Metal3Data is the Schema for the metal3datas API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Metal3DataSpec defines the desired state of Metal3Data. + properties: + claim: + description: DataClaim points to the Metal3DataClaim the Metal3Data + was created for. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: 'If referring to a piece of an object instead of + an entire object, this string should contain a valid JSON/Go + field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within + a pod, this would take on a value like: "spec.containers{name}" + (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" + (container with index 2 in this pod). This syntax is chosen + only to have some well-defined way of referencing a part of + an object. TODO: this design is not final and this field is + subject to change in the future.' + type: string + kind: + description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + namespace: + description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + type: string + resourceVersion: + description: 'Specific resourceVersion to which this reference + is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency' + type: string + uid: + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' + type: string + type: object + x-kubernetes-map-type: atomic + index: + description: Index stores the index value of this instance in the + Metal3DataTemplate. + type: integer + metaData: + description: MetaData points to the rendered MetaData secret. + properties: + name: + description: name is unique within a namespace to reference a + secret resource. + type: string + namespace: + description: namespace defines the space within which the secret + name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + networkData: + description: NetworkData points to the rendered NetworkData secret. + properties: + name: + description: name is unique within a namespace to reference a + secret resource. + type: string + namespace: + description: namespace defines the space within which the secret + name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + template: + description: DataTemplate is the Metal3DataTemplate this was generated + from. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: 'If referring to a piece of an object instead of + an entire object, this string should contain a valid JSON/Go + field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within + a pod, this would take on a value like: "spec.containers{name}" + (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" + (container with index 2 in this pod). This syntax is chosen + only to have some well-defined way of referencing a part of + an object. TODO: this design is not final and this field is + subject to change in the future.' + type: string + kind: + description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + namespace: + description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + type: string + resourceVersion: + description: 'Specific resourceVersion to which this reference + is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency' + type: string + uid: + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' + type: string + type: object + x-kubernetes-map-type: atomic + templateReference: + description: TemplateReference refers to the Template the Metal3MachineTemplate + refers to. It can be matched against the key or it may also point + to the name of the template Metal3Data refers to + type: string + required: + - claim + - template + type: object + status: + description: Metal3DataStatus defines the observed state of Metal3Data. + properties: + errorMessage: + description: ErrorMessage contains the error message + type: string + ready: + description: Ready is a flag set to True if the secrets were rendered + properly + type: boolean + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + cert-manager.io/inject-ca-from: capm3-system/capm3-serving-cert + controller-gen.kubebuilder.io/version: v0.13.0 + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + cluster.x-k8s.io/v1beta1: v1beta1 + name: metal3datatemplates.infrastructure.cluster.x-k8s.io + spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: capm3-webhook-service + namespace: capm3-system + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: infrastructure.cluster.x-k8s.io + names: + categories: + - cluster-api + kind: Metal3DataTemplate + listKind: Metal3DataTemplateList + plural: metal3datatemplates + shortNames: + - m3dt + - m3datatemplate + - m3datatemplates + - metal3dt + - metal3datatemplate + singular: metal3datatemplate + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Cluster to which this template belongs + jsonPath: .metadata.labels.cluster\.x-k8s\.io/cluster-name + name: Cluster + type: string + - description: Time duration since creation of Metal3DataTemplate + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Metal3DataTemplate is the Schema for the metal3datatemplates + API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Metal3DataTemplateSpec defines the desired state of Metal3DataTemplate. + properties: + clusterName: + description: ClusterName is the name of the Cluster this object belongs + to. + minLength: 1 + type: string + metaData: + description: MetaData contains the information needed to generate + the metadata secret + properties: + dnsServersFromIPPool: + description: DNSServersFromPool is the list of metadata items + to be rendered as dns servers. + items: + properties: + apiGroup: + description: APIGroup is the api group of the IP pool. + type: string + key: + description: Key will be used as the key to set in the metadata + map for cloud-init + type: string + kind: + description: Kind is the kind of the IP pool + type: string + name: + description: Name is the name of the IP pool used to fetch + the value to set in the metadata map for cloud-init + type: string + required: + - apiGroup + - key + - kind + - name + type: object + type: array + fromAnnotations: + description: FromAnnotations is the list of metadata items to + be fetched from object Annotations + items: + description: MetaDataFromAnnotation contains the information + to fetch an annotation content, if the label does not exist, + it is rendered as empty string. + properties: + annotation: + description: Annotation is the key of the Annotation to + fetch + type: string + key: + description: Key will be used as the key to set in the metadata + map for cloud-init + type: string + object: + description: Object is the type of the object from which + we retrieve the name + enum: + - machine + - metal3machine + - baremetalhost + type: string + required: + - annotation + - key + - object + type: object + type: array + fromHostInterfaces: + description: FromHostInterfaces is the list of metadata items + to be rendered as MAC addresses of the host interfaces. + items: + description: MetaDataHostInterface contains the information + to render the object name. + properties: + interface: + description: Interface is the name of the interface in the + BareMetalHost Status Hardware Details list of interfaces + from which to fetch the MAC address. + type: string + key: + description: Key will be used as the key to set in the metadata + map for cloud-init + type: string + required: + - interface + - key + type: object + type: array + fromLabels: + description: FromLabels is the list of metadata items to be fetched + from object labels + items: + description: MetaDataFromLabel contains the information to fetch + a label content, if the label does not exist, it is rendered + as empty string. + properties: + key: + description: Key will be used as the key to set in the metadata + map for cloud-init + type: string + label: + description: Label is the key of the label to fetch + type: string + object: + description: Object is the type of the object from which + we retrieve the name + enum: + - machine + - metal3machine + - baremetalhost + type: string + required: + - key + - label + - object + type: object + type: array + gatewaysFromIPPool: + description: GatewaysFromPool is the list of metadata items to + be rendered as gateway addresses. + items: + properties: + apiGroup: + description: APIGroup is the api group of the IP pool. + type: string + key: + description: Key will be used as the key to set in the metadata + map for cloud-init + type: string + kind: + description: Kind is the kind of the IP pool + type: string + name: + description: Name is the name of the IP pool used to fetch + the value to set in the metadata map for cloud-init + type: string + required: + - apiGroup + - key + - kind + - name + type: object + type: array + indexes: + description: Indexes is the list of metadata items to be rendered + from the index of the Metal3Data + items: + description: MetaDataIndex contains the information to render + the index. + properties: + key: + description: Key will be used as the key to set in the metadata + map for cloud-init + type: string + offset: + description: Offset is the offset to apply to the index + when rendering it + type: integer + prefix: + description: Prefix is the prefix string + type: string + step: + default: 1 + description: Step is the multiplier of the index + type: integer + suffix: + description: Suffix is the suffix string + type: string + required: + - key + type: object + type: array + ipAddressesFromIPPool: + description: IPAddressesFromPool is the list of metadata items + to be rendered as ip addresses. + items: + properties: + apiGroup: + description: APIGroup is the api group of the IP pool. + type: string + key: + description: Key will be used as the key to set in the metadata + map for cloud-init + type: string + kind: + description: Kind is the kind of the IP pool + type: string + name: + description: Name is the name of the IP pool used to fetch + the value to set in the metadata map for cloud-init + type: string + required: + - apiGroup + - key + - kind + - name + type: object + type: array + namespaces: + description: Namespaces is the list of metadata items to be rendered + from the namespace + items: + description: MetaDataNamespace contains the information to render + the namespace. + properties: + key: + description: Key will be used as the key to set in the metadata + map for cloud-init + type: string + required: + - key + type: object + type: array + objectNames: + description: ObjectNames is the list of metadata items to be rendered + from the name of objects. + items: + description: MetaDataObjectName contains the information to + render the object name. + properties: + key: + description: Key will be used as the key to set in the metadata + map for cloud-init + type: string + object: + description: Object is the type of the object from which + we retrieve the name + enum: + - machine + - metal3machine + - baremetalhost + type: string + required: + - key + - object + type: object + type: array + prefixesFromIPPool: + description: PrefixesFromPool is the list of metadata items to + be rendered as network prefixes. + items: + properties: + apiGroup: + description: APIGroup is the api group of the IP pool. + type: string + key: + description: Key will be used as the key to set in the metadata + map for cloud-init + type: string + kind: + description: Kind is the kind of the IP pool + type: string + name: + description: Name is the name of the IP pool used to fetch + the value to set in the metadata map for cloud-init + type: string + required: + - apiGroup + - key + - kind + - name + type: object + type: array + strings: + description: Strings is the list of metadata items to be rendered + from strings + items: + description: MetaDataString contains the information to render + the string. + properties: + key: + description: Key will be used as the key to set in the metadata + map for cloud-init + type: string + value: + description: Value is the string to render. + type: string + required: + - key + - value + type: object + type: array + type: object + networkData: + description: NetworkData contains the information needed to generate + the networkdata secret + properties: + links: + description: Links is a structure containing lists of different + types objects + properties: + bonds: + description: Bonds contains a list of Bond links + items: + description: NetworkDataLinkBond represents a bond link + object. + properties: + bondLinks: + description: BondLinks is the list of links that are + part of the bond. + items: + type: string + type: array + bondMode: + description: BondMode is the mode of bond used. It can + be one of balance-rr, active-backup, balance-xor, + broadcast, balance-tlb, balance-alb, 802.3ad + enum: + - balance-rr + - active-backup + - balance-xor + - broadcast + - balance-tlb + - balance-alb + - 802.3ad + type: string + bondXmitHashPolicy: + description: Selects the transmit hash policy used for + port selection in balance-xor and 802.3ad modes + enum: + - layer2 + - layer3+4 + - layer2+3 + type: string + id: + description: Id is the ID of the interface (used for + naming) + type: string + macAddress: + description: MACAddress is the MAC address of the interface, + containing the object used to render it. + properties: + fromAnnotation: + description: FromAnnotation references an object + Annotation to retrieve the MAC address from + properties: + annotation: + description: Annotation is the key of the Annotation + to fetch + type: string + object: + description: Object is the type of the object + from which we retrieve the name + enum: + - machine + - metal3machine + - baremetalhost + type: string + required: + - annotation + - object + type: object + fromHostInterface: + description: FromHostInterface contains the name + of the interface in the BareMetalHost Introspection + details from which to fetch the MAC address + type: string + string: + description: String contains the MAC address given + as a string + type: string + type: object + mtu: + default: 1500 + description: MTU is the MTU of the interface + maximum: 9000 + type: integer + required: + - bondMode + - id + - macAddress + type: object + type: array + ethernets: + description: Ethernets contains a list of Ethernet links + items: + description: NetworkDataLinkEthernet represents an ethernet + link object. + properties: + id: + description: Id is the ID of the interface (used for + naming) + type: string + macAddress: + description: MACAddress is the MAC address of the interface, + containing the object used to render it. + properties: + fromAnnotation: + description: FromAnnotation references an object + Annotation to retrieve the MAC address from + properties: + annotation: + description: Annotation is the key of the Annotation + to fetch + type: string + object: + description: Object is the type of the object + from which we retrieve the name + enum: + - machine + - metal3machine + - baremetalhost + type: string + required: + - annotation + - object + type: object + fromHostInterface: + description: FromHostInterface contains the name + of the interface in the BareMetalHost Introspection + details from which to fetch the MAC address + type: string + string: + description: String contains the MAC address given + as a string + type: string + type: object + mtu: + default: 1500 + description: MTU is the MTU of the interface + maximum: 9000 + type: integer + type: + description: 'Type is the type of the ethernet link. + It can be one of: bridge, dvs, hw_veb, hyperv, ovs, + tap, vhostuser, vif, phy' + enum: + - bridge + - dvs + - hw_veb + - hyperv + - ovs + - tap + - vhostuser + - vif + - phy + type: string + required: + - id + - macAddress + - type + type: object + type: array + vlans: + description: Vlans contains a list of Vlan links + items: + description: NetworkDataLinkVlan represents a vlan link + object. + properties: + id: + description: Id is the ID of the interface (used for + naming) + type: string + macAddress: + description: MACAddress is the MAC address of the interface, + containing the object used to render it. + properties: + fromAnnotation: + description: FromAnnotation references an object + Annotation to retrieve the MAC address from + properties: + annotation: + description: Annotation is the key of the Annotation + to fetch + type: string + object: + description: Object is the type of the object + from which we retrieve the name + enum: + - machine + - metal3machine + - baremetalhost + type: string + required: + - annotation + - object + type: object + fromHostInterface: + description: FromHostInterface contains the name + of the interface in the BareMetalHost Introspection + details from which to fetch the MAC address + type: string + string: + description: String contains the MAC address given + as a string + type: string + type: object + mtu: + default: 1500 + description: MTU is the MTU of the interface + maximum: 9000 + type: integer + vlanID: + description: VlanID is the Vlan ID + maximum: 4096 + type: integer + vlanLink: + description: VlanLink is the name of the link on which + the vlan should be added + type: string + required: + - id + - macAddress + - vlanID + - vlanLink + type: object + type: array + type: object + networks: + description: Networks is a structure containing lists of different + types objects + properties: + ipv4: + description: IPv4 contains a list of IPv4 static allocations + items: + description: NetworkDataIPv4 represents an ipv4 static network + object. + properties: + fromPoolRef: + description: FromPoolRef is a reference to a IP pool + to allocate an address from. + properties: + apiGroup: + description: APIGroup is the group for the resource + being referenced. If APIGroup is not specified, + the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + id: + description: ID is the network ID (name) + type: string + ipAddressFromIPPool: + description: IPAddressFromIPPool contains the name of + the IP pool to use to get an ip address + type: string + link: + description: Link is the link on which the network applies + type: string + routes: + description: Routes contains a list of IPv4 routes + items: + description: NetworkDataRoutev4 represents an ipv4 + route object. + properties: + gateway: + description: Gateway is the IPv4 address of the + gateway + properties: + fromIPPool: + description: FromIPPool is the name of the + IPPool to fetch the gateway from + type: string + string: + description: String is the gateway given as + a string + pattern: ^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$ + type: string + type: object + network: + description: Network is the IPv4 network address + pattern: ^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$ + type: string + prefix: + description: Prefix is the mask of the network + as integer (max 32) + maximum: 32 + type: integer + services: + description: Services is a list of IPv4 services + properties: + dns: + description: DNS is a list of IPv4 DNS services + items: + description: IPAddressv4 is used for validation + of an IPv6 address. + pattern: ^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$ + type: string + type: array + dnsFromIPPool: + description: DNSFromIPPool is the name of + the IPPool from which to get the DNS servers + type: string + type: object + required: + - gateway + - network + type: object + type: array + required: + - id + - link + type: object + type: array + ipv4DHCP: + description: IPv4 contains a list of IPv4 DHCP allocations + items: + description: NetworkDataIPv4DHCP represents an ipv4 DHCP + network object. + properties: + id: + description: ID is the network ID (name) + type: string + link: + description: Link is the link on which the network applies + type: string + routes: + description: Routes contains a list of IPv4 routes + items: + description: NetworkDataRoutev4 represents an ipv4 + route object. + properties: + gateway: + description: Gateway is the IPv4 address of the + gateway + properties: + fromIPPool: + description: FromIPPool is the name of the + IPPool to fetch the gateway from + type: string + string: + description: String is the gateway given as + a string + pattern: ^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$ + type: string + type: object + network: + description: Network is the IPv4 network address + pattern: ^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$ + type: string + prefix: + description: Prefix is the mask of the network + as integer (max 32) + maximum: 32 + type: integer + services: + description: Services is a list of IPv4 services + properties: + dns: + description: DNS is a list of IPv4 DNS services + items: + description: IPAddressv4 is used for validation + of an IPv6 address. + pattern: ^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$ + type: string + type: array + dnsFromIPPool: + description: DNSFromIPPool is the name of + the IPPool from which to get the DNS servers + type: string + type: object + required: + - gateway + - network + type: object + type: array + required: + - id + - link + type: object + type: array + ipv6: + description: IPv4 contains a list of IPv6 static allocations + items: + description: NetworkDataIPv6 represents an ipv6 static network + object. + properties: + fromPoolRef: + description: FromPoolRef is a reference to a IP pool + to allocate an address from. + properties: + apiGroup: + description: APIGroup is the group for the resource + being referenced. If APIGroup is not specified, + the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + id: + description: ID is the network ID (name) + type: string + ipAddressFromIPPool: + description: IPAddressFromIPPool contains the name of + the IPPool to use to get an ip address + type: string + link: + description: Link is the link on which the network applies + type: string + routes: + description: Routes contains a list of IPv6 routes + items: + description: NetworkDataRoutev6 represents an ipv6 + route object. + properties: + gateway: + description: Gateway is the IPv6 address of the + gateway + properties: + fromIPPool: + description: FromIPPool is the name of the + IPPool to fetch the gateway from + type: string + string: + description: String is the gateway given as + a string + pattern: ^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$ + type: string + type: object + network: + description: Network is the IPv6 network address + pattern: ^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$ + type: string + prefix: + description: Prefix is the mask of the network + as integer (max 128) + maximum: 128 + type: integer + services: + description: Services is a list of IPv6 services + properties: + dns: + description: DNS is a list of IPv6 DNS services + items: + description: IPAddressv6 is used for validation + of an IPv6 address. + pattern: ^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$ + type: string + type: array + dnsFromIPPool: + description: DNSFromIPPool is the name of + the IPPool from which to get the DNS servers + type: string + type: object + required: + - gateway + - network + type: object + type: array + required: + - id + - ipAddressFromIPPool + - link + type: object + type: array + ipv6DHCP: + description: IPv4 contains a list of IPv6 DHCP allocations + items: + description: NetworkDataIPv6DHCP represents an ipv6 DHCP + network object. + properties: + id: + description: ID is the network ID (name) + type: string + link: + description: Link is the link on which the network applies + type: string + routes: + description: Routes contains a list of IPv6 routes + items: + description: NetworkDataRoutev6 represents an ipv6 + route object. + properties: + gateway: + description: Gateway is the IPv6 address of the + gateway + properties: + fromIPPool: + description: FromIPPool is the name of the + IPPool to fetch the gateway from + type: string + string: + description: String is the gateway given as + a string + pattern: ^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$ + type: string + type: object + network: + description: Network is the IPv6 network address + pattern: ^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$ + type: string + prefix: + description: Prefix is the mask of the network + as integer (max 128) + maximum: 128 + type: integer + services: + description: Services is a list of IPv6 services + properties: + dns: + description: DNS is a list of IPv6 DNS services + items: + description: IPAddressv6 is used for validation + of an IPv6 address. + pattern: ^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$ + type: string + type: array + dnsFromIPPool: + description: DNSFromIPPool is the name of + the IPPool from which to get the DNS servers + type: string + type: object + required: + - gateway + - network + type: object + type: array + required: + - id + - link + type: object + type: array + ipv6SLAAC: + description: IPv4 contains a list of IPv6 SLAAC allocations + items: + description: NetworkDataIPv6DHCP represents an ipv6 DHCP + network object. + properties: + id: + description: ID is the network ID (name) + type: string + link: + description: Link is the link on which the network applies + type: string + routes: + description: Routes contains a list of IPv6 routes + items: + description: NetworkDataRoutev6 represents an ipv6 + route object. + properties: + gateway: + description: Gateway is the IPv6 address of the + gateway + properties: + fromIPPool: + description: FromIPPool is the name of the + IPPool to fetch the gateway from + type: string + string: + description: String is the gateway given as + a string + pattern: ^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$ + type: string + type: object + network: + description: Network is the IPv6 network address + pattern: ^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$ + type: string + prefix: + description: Prefix is the mask of the network + as integer (max 128) + maximum: 128 + type: integer + services: + description: Services is a list of IPv6 services + properties: + dns: + description: DNS is a list of IPv6 DNS services + items: + description: IPAddressv6 is used for validation + of an IPv6 address. + pattern: ^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$ + type: string + type: array + dnsFromIPPool: + description: DNSFromIPPool is the name of + the IPPool from which to get the DNS servers + type: string + type: object + required: + - gateway + - network + type: object + type: array + required: + - id + - link + type: object + type: array + type: object + services: + description: Services is a structure containing lists of different + types objects + properties: + dns: + description: DNS is a list of DNS services + items: + description: IPAddress is used for validation of an IP address. + pattern: ((^((([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5]))$)|(^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$)) + type: string + type: array + dnsFromIPPool: + description: DNSFromIPPool is the name of the IPPool from + which to get the DNS servers + type: string + type: object + type: object + templateReference: + description: TemplateReference refers to the Template the Metal3MachineTemplate + refers to. It can be matched against the key or it may also point + to the name of the template Metal3Data refers to + type: string + required: + - clusterName + type: object + status: + description: Metal3DataTemplateStatus defines the observed state of Metal3DataTemplate. + properties: + indexes: + additionalProperties: + type: integer + description: Indexes contains the map of Metal3Machine and index used + type: object + lastUpdated: + description: LastUpdated identifies when this status was last observed. + format: date-time + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + cert-manager.io/inject-ca-from: capm3-system/capm3-serving-cert + controller-gen.kubebuilder.io/version: v0.13.0 + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + cluster.x-k8s.io/v1beta1: v1beta1 + name: metal3machines.infrastructure.cluster.x-k8s.io + spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: capm3-webhook-service + namespace: capm3-system + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: infrastructure.cluster.x-k8s.io + names: + categories: + - cluster-api + kind: Metal3Machine + listKind: Metal3MachineList + plural: metal3machines + shortNames: + - m3m + - m3machine + - m3machines + - metal3m + - metal3machine + singular: metal3machine + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Time duration since creation of Metal3Machine + jsonPath: .metadata.creationTimestamp + name: Age + type: date + - description: Provider ID + jsonPath: .spec.providerID + name: ProviderID + type: string + - description: metal3machine is Ready + jsonPath: .status.ready + name: Ready + type: string + - description: Cluster to which this M3Machine belongs + jsonPath: .metadata.labels.cluster\.x-k8s\.io/cluster-name + name: Cluster + type: string + - description: metal3machine current phase + jsonPath: .status.phase + name: Phase + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: Metal3Machine is the Schema for the metal3machines API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Metal3MachineSpec defines the desired state of Metal3Machine. + properties: + automatedCleaningMode: + description: When set to disabled, automated cleaning of host disks + will be skipped during provisioning and deprovisioning. + enum: + - metadata + - disabled + type: string + dataTemplate: + description: MetadataTemplate is a reference to a Metal3DataTemplate + object containing a template of metadata to be rendered. Metadata + keys defined in the metadataTemplate take precedence over keys defined + in metadata field. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: 'If referring to a piece of an object instead of + an entire object, this string should contain a valid JSON/Go + field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within + a pod, this would take on a value like: "spec.containers{name}" + (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" + (container with index 2 in this pod). This syntax is chosen + only to have some well-defined way of referencing a part of + an object. TODO: this design is not final and this field is + subject to change in the future.' + type: string + kind: + description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + namespace: + description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + type: string + resourceVersion: + description: 'Specific resourceVersion to which this reference + is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency' + type: string + uid: + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' + type: string + type: object + x-kubernetes-map-type: atomic + hostSelector: + description: HostSelector specifies matching criteria for labels on + BareMetalHosts. This is used to limit the set of BareMetalHost objects + considered for claiming for a metal3machine. + properties: + matchExpressions: + description: Label match expressions that must be true on a chosen + BareMetalHost + items: + properties: + key: + type: string + operator: + description: Operator represents a key/field's relationship + to value(s). See labels.Requirement and fields.Requirement + for more details. + type: string + values: + items: + type: string + type: array + required: + - key + - operator + - values + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: Key/value pairs of labels that must exist on a chosen + BareMetalHost + type: object + type: object + image: + description: Image is the image to be provisioned. + properties: + checksum: + description: Checksum is a md5sum, sha256sum or sha512sum value + or a URL to retrieve one. + type: string + checksumType: + description: ChecksumType is the checksum algorithm for the image. + e.g md5, sha256, sha512 + enum: + - md5 + - sha256 + - sha512 + type: string + format: + description: DiskFormat contains the image disk format. + enum: + - raw + - qcow2 + - vdi + - vmdk + - live-iso + type: string + url: + description: URL is a location of an image to deploy. + type: string + required: + - checksum + - url + type: object + metaData: + description: MetaData is an object storing the reference to the secret + containing the Metadata given by the user. + properties: + name: + description: name is unique within a namespace to reference a + secret resource. + type: string + namespace: + description: namespace defines the space within which the secret + name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + networkData: + description: NetworkData is an object storing the reference to the + secret containing the network data given by the user. + properties: + name: + description: name is unique within a namespace to reference a + secret resource. + type: string + namespace: + description: namespace defines the space within which the secret + name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + providerID: + description: ProviderID will be the Metal3 machine in ProviderID format + (metal3://) + type: string + userData: + description: UserData references the Secret that holds user data needed + by the bare metal operator. The Namespace is optional; it will default + to the metal3machine's namespace if not specified. + properties: + name: + description: name is unique within a namespace to reference a + secret resource. + type: string + namespace: + description: namespace defines the space within which the secret + name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + required: + - image + type: object + status: + description: Metal3MachineStatus defines the observed state of Metal3Machine. + properties: + addresses: + description: Addresses is a list of addresses assigned to the machine. + This field is copied from the infrastructure provider reference. + items: + description: MachineAddress contains information for the node's + address. + properties: + address: + description: The machine address. + type: string + type: + description: Machine address type, one of Hostname, ExternalIP, + InternalIP, ExternalDNS or InternalDNS. + type: string + required: + - address + - type + type: object + type: array + conditions: + description: Conditions defines current service state of the Metal3Machine. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: Last time the condition transitioned from one status + to another. This should be when the underlying condition changed. + If that is not known, then using the time when the API field + changed is acceptable. + format: date-time + type: string + message: + description: A human readable message indicating details about + the transition. This field may be empty. + type: string + reason: + description: The reason for the condition's last transition + in CamelCase. The specific API may choose whether or not this + field is considered a guaranteed API. This field may not be + empty. + type: string + severity: + description: Severity provides an explicit classification of + Reason code, so the users or machines can immediately understand + the current situation and act accordingly. The Severity field + MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources + like Available, but because arbitrary conditions can be useful + (see .node.status.conditions), the ability to deconflict is + important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + failureMessage: + description: "FailureMessage will be set in the event that there is + a terminal problem reconciling the metal3machine and will contain + a more verbose string suitable for logging and human consumption. + \n This field should not be set for transitive errors that a controller + faces that are expected to be fixed automatically over time (like + service outages), but instead indicate that something is fundamentally + wrong with the metal3machine's spec or the configuration of the + controller, and that manual intervention is required. Examples of + terminal errors would be invalid combinations of settings in the + spec, values that are unsupported by the controller, or the responsible + controller itself being critically misconfigured. \n Any transient + errors that occur during the reconciliation of metal3machines can + be added as events to the metal3machine object and/or logged in + the controller's output." + type: string + failureReason: + description: "FailureReason will be set in the event that there is + a terminal problem reconciling the metal3machine and will contain + a succinct value suitable for machine interpretation. \n This field + should not be set for transitive errors that a controller faces + that are expected to be fixed automatically over time (like service + outages), but instead indicate that something is fundamentally wrong + with the metal3machine's spec or the configuration of the controller, + and that manual intervention is required. Examples of terminal errors + would be invalid combinations of settings in the spec, values that + are unsupported by the controller, or the responsible controller + itself being critically misconfigured. \n Any transient errors that + occur during the reconciliation of metal3machines can be added as + events to the metal3machine object and/or logged in the controller's + output." + type: string + lastUpdated: + description: LastUpdated identifies when this status was last observed. + format: date-time + type: string + metaData: + description: MetaData is an object storing the reference to the secret + containing the Metadata used to deploy the BareMetalHost. + properties: + name: + description: name is unique within a namespace to reference a + secret resource. + type: string + namespace: + description: namespace defines the space within which the secret + name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + networkData: + description: NetworkData is an object storing the reference to the + secret containing the network data used to deploy the BareMetalHost. + properties: + name: + description: name is unique within a namespace to reference a + secret resource. + type: string + namespace: + description: namespace defines the space within which the secret + name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + phase: + description: Phase represents the current phase of machine actuation. + E.g. Pending, Running, Terminating, Failed etc. + type: string + ready: + description: 'Ready is the state of the metal3. TODO : Document the + variable : mhrivnak: " it would be good to document what this means, + how to interpret it, under what circumstances the value changes, + etc."' + type: boolean + renderedData: + description: RenderedData is a reference to a rendered Metal3Data + object containing the references to metaData and networkData secrets. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: 'If referring to a piece of an object instead of + an entire object, this string should contain a valid JSON/Go + field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within + a pod, this would take on a value like: "spec.containers{name}" + (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" + (container with index 2 in this pod). This syntax is chosen + only to have some well-defined way of referencing a part of + an object. TODO: this design is not final and this field is + subject to change in the future.' + type: string + kind: + description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + namespace: + description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + type: string + resourceVersion: + description: 'Specific resourceVersion to which this reference + is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency' + type: string + uid: + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' + type: string + type: object + x-kubernetes-map-type: atomic + userData: + description: UserData references the Secret that holds user data needed + by the bare metal operator. The Namespace is optional; it will default + to the metal3machine's namespace if not specified. + properties: + name: + description: name is unique within a namespace to reference a + secret resource. + type: string + namespace: + description: namespace defines the space within which the secret + name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + cert-manager.io/inject-ca-from: capm3-system/capm3-serving-cert + controller-gen.kubebuilder.io/version: v0.13.0 + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + cluster.x-k8s.io/v1beta1: v1beta1 + name: metal3machinetemplates.infrastructure.cluster.x-k8s.io + spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: capm3-webhook-service + namespace: capm3-system + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: infrastructure.cluster.x-k8s.io + names: + categories: + - cluster-api + kind: Metal3MachineTemplate + listKind: Metal3MachineTemplateList + plural: metal3machinetemplates + shortNames: + - m3mt + - m3machinetemplate + - m3machinetemplates + - metal3mt + - metal3machinetemplate + singular: metal3machinetemplate + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Time duration since creation of Metal3MachineTemplate + jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Metal3MachineTemplate is the Schema for the metal3machinetemplates + API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Metal3MachineTemplateSpec defines the desired state of Metal3MachineTemplate. + properties: + nodeReuse: + default: false + description: When set to True, CAPM3 Machine controller will pick + the same pool of BMHs' that were released during the upgrade operation. + type: boolean + template: + description: Metal3MachineTemplateResource describes the data needed + to create a Metal3Machine from a template. + properties: + spec: + description: Spec is the specification of the desired behavior + of the machine. + properties: + automatedCleaningMode: + description: When set to disabled, automated cleaning of host + disks will be skipped during provisioning and deprovisioning. + enum: + - metadata + - disabled + type: string + dataTemplate: + description: MetadataTemplate is a reference to a Metal3DataTemplate + object containing a template of metadata to be rendered. + Metadata keys defined in the metadataTemplate take precedence + over keys defined in metadata field. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: 'If referring to a piece of an object instead + of an entire object, this string should contain a valid + JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container + within a pod, this would take on a value like: "spec.containers{name}" + (where "name" refers to the name of the container that + triggered the event) or if no container name is specified + "spec.containers[2]" (container with index 2 in this + pod). This syntax is chosen only to have some well-defined + way of referencing a part of an object. TODO: this design + is not final and this field is subject to change in + the future.' + type: string + kind: + description: 'Kind of the referent. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names' + type: string + namespace: + description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/' + type: string + resourceVersion: + description: 'Specific resourceVersion to which this reference + is made, if any. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency' + type: string + uid: + description: 'UID of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids' + type: string + type: object + x-kubernetes-map-type: atomic + hostSelector: + description: HostSelector specifies matching criteria for + labels on BareMetalHosts. This is used to limit the set + of BareMetalHost objects considered for claiming for a metal3machine. + properties: + matchExpressions: + description: Label match expressions that must be true + on a chosen BareMetalHost + items: + properties: + key: + type: string + operator: + description: Operator represents a key/field's relationship + to value(s). See labels.Requirement and fields.Requirement + for more details. + type: string + values: + items: + type: string + type: array + required: + - key + - operator + - values + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: Key/value pairs of labels that must exist + on a chosen BareMetalHost + type: object + type: object + image: + description: Image is the image to be provisioned. + properties: + checksum: + description: Checksum is a md5sum, sha256sum or sha512sum + value or a URL to retrieve one. + type: string + checksumType: + description: ChecksumType is the checksum algorithm for + the image. e.g md5, sha256, sha512 + enum: + - md5 + - sha256 + - sha512 + type: string + format: + description: DiskFormat contains the image disk format. + enum: + - raw + - qcow2 + - vdi + - vmdk + - live-iso + type: string + url: + description: URL is a location of an image to deploy. + type: string + required: + - checksum + - url + type: object + metaData: + description: MetaData is an object storing the reference to + the secret containing the Metadata given by the user. + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + networkData: + description: NetworkData is an object storing the reference + to the secret containing the network data given by the user. + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + providerID: + description: ProviderID will be the Metal3 machine in ProviderID + format (metal3://) + type: string + userData: + description: UserData references the Secret that holds user + data needed by the bare metal operator. The Namespace is + optional; it will default to the metal3machine's namespace + if not specified. + properties: + name: + description: name is unique within a namespace to reference + a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + type: object + x-kubernetes-map-type: atomic + required: + - image + type: object + required: + - spec + type: object + required: + - template + type: object + type: object + served: true + storage: true + subresources: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + cert-manager.io/inject-ca-from: capm3-system/capm3-serving-cert + controller-gen.kubebuilder.io/version: v0.13.0 + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + cluster.x-k8s.io/v1beta1: v1beta1 + name: metal3remediations.infrastructure.cluster.x-k8s.io + spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: capm3-webhook-service + namespace: capm3-system + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: infrastructure.cluster.x-k8s.io + names: + categories: + - cluster-api + kind: Metal3Remediation + listKind: Metal3RemediationList + plural: metal3remediations + shortNames: + - m3r + - m3remediation + singular: metal3remediation + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: How many times remediation controller should attempt to remediate + the host + jsonPath: .spec.strategy.retryLimit + name: Retry limit + type: string + - description: How many times remediation controller has tried to remediate the + node + jsonPath: .status.retryCount + name: Retry count + type: string + - description: Timestamp of the last remediation attempt + jsonPath: .status.lastRemediated + name: Last Remediated + type: string + - description: Type of the remediation strategy + jsonPath: .spec.strategy.type + name: Strategy + type: string + - description: Phase of the remediation + jsonPath: .status.phase + name: Phase + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: Metal3Remediation is the Schema for the metal3remediations API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Metal3RemediationSpec defines the desired state of Metal3Remediation. + properties: + strategy: + description: Strategy field defines remediation strategy. + properties: + retryLimit: + description: Sets maximum number of remediation retries. + type: integer + timeout: + description: Sets the timeout between remediation retries. + type: string + type: + description: Type of remediation. + type: string + type: object + type: object + status: + description: Metal3RemediationStatus defines the observed state of Metal3Remediation. + properties: + lastRemediated: + description: LastRemediated identifies when the host was last remediated + format: date-time + type: string + phase: + description: Phase represents the current phase of machine remediation. + E.g. Pending, Running, Done etc. + type: string + retryCount: + description: RetryCount can be used as a counter during the remediation. + Field can hold number of reboots etc. + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + cert-manager.io/inject-ca-from: capm3-system/capm3-serving-cert + controller-gen.kubebuilder.io/version: v0.13.0 + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + cluster.x-k8s.io/v1beta1: v1beta1 + name: metal3remediationtemplates.infrastructure.cluster.x-k8s.io + spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: capm3-webhook-service + namespace: capm3-system + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: infrastructure.cluster.x-k8s.io + names: + categories: + - cluster-api + kind: Metal3RemediationTemplate + listKind: Metal3RemediationTemplateList + plural: metal3remediationtemplates + shortNames: + - m3rt + - m3remediationtemplate + - m3remediationtemplates + - metal3rt + - metal3remediationtemplate + singular: metal3remediationtemplate + scope: Namespaced + versions: + - name: v1beta1 + schema: + openAPIV3Schema: + description: Metal3RemediationTemplate is the Schema for the metal3remediationtemplates + API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Metal3RemediationTemplateSpec defines the desired state of + Metal3RemediationTemplate. + properties: + template: + description: Metal3RemediationTemplateResource describes the data + needed to create a Metal3Remediation from a template. + properties: + spec: + description: Spec is the specification of the desired behavior + of the Metal3Remediation. + properties: + strategy: + description: Strategy field defines remediation strategy. + properties: + retryLimit: + description: Sets maximum number of remediation retries. + type: integer + timeout: + description: Sets the timeout between remediation retries. + type: string + type: + description: Type of remediation. + type: string + type: object + type: object + required: + - spec + type: object + required: + - template + type: object + status: + description: Metal3RemediationTemplateStatus defines the observed state + of Metal3RemediationTemplate. + properties: + status: + description: Metal3RemediationStatus defines the observed state of + Metal3Remediation + properties: + lastRemediated: + description: LastRemediated identifies when the host was last + remediated + format: date-time + type: string + phase: + description: Phase represents the current phase of machine remediation. + E.g. Pending, Running, Done etc. + type: string + retryCount: + description: RetryCount can be used as a counter during the remediation. + Field can hold number of reboots etc. + type: integer + type: object + required: + - status + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: v1 + kind: ServiceAccount + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: capm3-manager + namespace: capm3-system + --- + apiVersion: v1 + kind: ServiceAccount + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: ipam-manager + namespace: capm3-system + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: Role + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: capm3-leader-election-role + namespace: capm3-system + rules: + - apiGroups: + - "" + resources: + - events + verbs: + - create + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: Role + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: ipam-leader-election-role + namespace: capm3-system + rules: + - apiGroups: + - "" + resources: + - events + verbs: + - create + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: capm3-manager-role + rules: + - apiGroups: + - "" + resources: + - events + verbs: + - create + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + - apiGroups: + - cluster.x-k8s.io + resources: + - clusters + verbs: + - get + - list + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - clusters + - clusters/status + verbs: + - get + - list + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - clusters/status + verbs: + - get + - apiGroups: + - cluster.x-k8s.io + resources: + - kubeadmcontrolplanes + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machinedeployments + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machines + - machines/status + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - machinesets + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - metal3clusters + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - metal3clusters/status + verbs: + - get + - patch + - update + - apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - metal3dataclaims + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - metal3dataclaims/status + verbs: + - get + - patch + - update + - apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - metal3datas + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - metal3datas/status + verbs: + - get + - patch + - update + - apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - metal3datatemplates + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - metal3datatemplates/status + verbs: + - get + - patch + - update + - apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - metal3machines + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - metal3machines/status + verbs: + - get + - patch + - update + - apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - metal3machinetemplates + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - metal3remediations + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - metal3remediations/status + verbs: + - get + - patch + - update + - apiGroups: + - ipam.cluster.x-k8s.io + resources: + - ipaddressclaims + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - ipam.cluster.x-k8s.io + resources: + - ipaddressclaims/status + verbs: + - get + - watch + - apiGroups: + - ipam.cluster.x-k8s.io + resources: + - ipaddresses + verbs: + - get + - list + - watch + - apiGroups: + - ipam.cluster.x-k8s.io + resources: + - ipaddresses/status + verbs: + - get + - apiGroups: + - ipam.metal3.io + resources: + - ipaddresses + verbs: + - get + - list + - watch + - apiGroups: + - ipam.metal3.io + resources: + - ipaddresses/status + verbs: + - get + - apiGroups: + - ipam.metal3.io + resources: + - ipclaims + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - ipam.metal3.io + resources: + - ipclaims/status + verbs: + - get + - watch + - apiGroups: + - metal3.io + resources: + - baremetalhosts + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - metal3.io + resources: + - baremetalhosts/status + verbs: + - get + - patch + - update + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: ipam-manager-role + rules: + - apiGroups: + - "" + resources: + - events + verbs: + - create + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + - apiGroups: + - cluster.x-k8s.io + resources: + - clusters + verbs: + - get + - list + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - clusters/status + verbs: + - get + - apiGroups: + - ipam.metal3.io + resources: + - ipaddresses + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - ipam.metal3.io + resources: + - ipaddresses/status + verbs: + - get + - patch + - update + - apiGroups: + - ipam.metal3.io + resources: + - ipclaims + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - ipam.metal3.io + resources: + - ipclaims/status + verbs: + - get + - patch + - update + - apiGroups: + - ipam.metal3.io + resources: + - ippools + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - ipam.metal3.io + resources: + - ippools/status + verbs: + - get + - patch + - update + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: RoleBinding + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: capm3-leader-election-rolebinding + namespace: capm3-system + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: capm3-leader-election-role + subjects: + - kind: ServiceAccount + name: capm3-manager + namespace: capm3-system + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: RoleBinding + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: ipam-leader-election-rolebinding + namespace: capm3-system + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: ipam-leader-election-role + subjects: + - kind: ServiceAccount + name: ipam-manager + namespace: capm3-system + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: capm3-manager-rolebinding + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: capm3-manager-role + subjects: + - kind: ServiceAccount + name: capm3-manager + namespace: capm3-system + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: ipam-manager-rolebinding + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: ipam-manager-role + subjects: + - kind: ServiceAccount + name: ipam-manager + namespace: capm3-system + --- + apiVersion: v1 + data: + CAPM3_FAST_TRACK: ${CAPM3_FAST_TRACK:='false'} + kind: ConfigMap + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: capm3-capm3fasttrack-configmap + namespace: capm3-system + --- + apiVersion: v1 + kind: Service + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: capm3-webhook-service + namespace: capm3-system + spec: + ports: + - port: 443 + targetPort: webhook-server + selector: + cluster.x-k8s.io/provider: infrastructure-metal3 + --- + apiVersion: v1 + kind: Service + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: ipam-webhook-service + namespace: capm3-system + spec: + ports: + - port: 443 + targetPort: ipam-webhook + selector: + cluster.x-k8s.io/provider: infrastructure-metal3 + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + control-plane: controller-manager + controller-tools.k8s.io: "1.0" + name: capm3-controller-manager + namespace: capm3-system + spec: + selector: + matchLabels: + cluster.x-k8s.io/provider: infrastructure-metal3 + control-plane: controller-manager + controller-tools.k8s.io: "1.0" + template: + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + control-plane: controller-manager + controller-tools.k8s.io: "1.0" + spec: + containers: + - args: + - --webhook-port=9443 + - --enableBMHNameBasedPreallocation=${enableBMHNameBasedPreallocation:=false} + - --diagnostics-address=${CAPM3_DIAGNOSTICS_ADDRESS:=:8443} + - --insecure-diagnostics=${CAPM3_INSECURE_DIAGNOSTICS:=false} + command: + - /manager + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + envFrom: + - configMapRef: + name: capm3-capm3fasttrack-configmap + image: quay.io/metal3-io/cluster-api-provider-metal3:v1.7.1 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 9443 + name: webhook-server + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + - containerPort: 8443 + name: metrics + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsGroup: 65532 + runAsUser: 65532 + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + serviceAccountName: capm3-manager + terminationGracePeriodSeconds: 10 + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/master + - effect: NoSchedule + key: node-role.kubernetes.io/control-plane + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: capm3-webhook-service-cert + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + control-plane: controller-manager + controller-tools.k8s.io: "1.0" + name: ipam-controller-manager + namespace: capm3-system + spec: + selector: + matchLabels: + cluster.x-k8s.io/provider: infrastructure-metal3 + control-plane: controller-manager + controller-tools.k8s.io: "1.0" + template: + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + control-plane: controller-manager + controller-tools.k8s.io: "1.0" + spec: + containers: + - args: + - --webhook-port=9443 + - --diagnostics-address=${IPAM_DIAGNOSTICS_ADDRESS:=:8443} + - --insecure-diagnostics=${IPAM_INSECURE_DIAGNOSTICS:=false} + command: + - /manager + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: quay.io/metal3-io/ip-address-manager:v1.7.1 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 9443 + name: ipam-webhook + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + - containerPort: 8443 + name: metrics + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsGroup: 65532 + runAsUser: 65532 + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + serviceAccountName: ipam-manager + terminationGracePeriodSeconds: 10 + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/master + - effect: NoSchedule + key: node-role.kubernetes.io/control-plane + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: ipam-webhook-service-cert + --- + apiVersion: cert-manager.io/v1 + kind: Certificate + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: capm3-serving-cert + namespace: capm3-system + spec: + dnsNames: + - capm3-webhook-service.capm3-system.svc + - capm3-webhook-service.capm3-system.svc.cluster.local + issuerRef: + kind: Issuer + name: capm3-selfsigned-issuer + secretName: capm3-webhook-service-cert + --- + apiVersion: cert-manager.io/v1 + kind: Certificate + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: ipam-serving-cert + namespace: capm3-system + spec: + dnsNames: + - ipam-webhook-service.capm3-system.svc + - ipam-webhook-service.capm3-system.svc.cluster.local + issuerRef: + kind: Issuer + name: ipam-selfsigned-issuer + secretName: ipam-webhook-service-cert + --- + apiVersion: cert-manager.io/v1 + kind: Issuer + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: capm3-selfsigned-issuer + namespace: capm3-system + spec: + selfSigned: {} + --- + apiVersion: cert-manager.io/v1 + kind: Issuer + metadata: + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: ipam-selfsigned-issuer + namespace: capm3-system + spec: + selfSigned: {} + --- + apiVersion: admissionregistration.k8s.io/v1 + kind: MutatingWebhookConfiguration + metadata: + annotations: + cert-manager.io/inject-ca-from: capm3-system/capm3-serving-cert + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: capm3-mutating-webhook-configuration + webhooks: + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /mutate-infrastructure-cluster-x-k8s-io-v1beta1-metal3cluster + failurePolicy: Fail + matchPolicy: Equivalent + name: default.metal3cluster.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3clusters + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /mutate-infrastructure-cluster-x-k8s-io-v1beta1-metal3data + failurePolicy: Fail + matchPolicy: Equivalent + name: default.metal3data.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3datas + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /mutate-infrastructure-cluster-x-k8s-io-v1beta1-metal3dataclaim + failurePolicy: Fail + matchPolicy: Equivalent + name: default.metal3dataclaim.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3dataclaims + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /mutate-infrastructure-cluster-x-k8s-io-v1beta1-metal3datatemplate + failurePolicy: Fail + matchPolicy: Equivalent + name: default.metal3datatemplate.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3datatemplates + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /mutate-infrastructure-cluster-x-k8s-io-v1beta1-metal3machine + failurePolicy: Fail + matchPolicy: Equivalent + name: default.metal3machine.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3machines + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /mutate-infrastructure-cluster-x-k8s-io-v1beta1-metal3machinetemplate + failurePolicy: Fail + matchPolicy: Equivalent + name: default.metal3machinetemplate.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3machinetemplates + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /mutate-infrastructure-cluster-x-k8s-io-v1beta1-metal3remediation + failurePolicy: Fail + matchPolicy: Equivalent + name: default.metal3remediation.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3remediations + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /mutate-infrastructure-cluster-x-k8s-io-v1beta1-metal3remediationtemplate + failurePolicy: Fail + matchPolicy: Equivalent + name: default.metal3remediationtemplate.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3remediationtemplates + sideEffects: None + --- + apiVersion: admissionregistration.k8s.io/v1 + kind: MutatingWebhookConfiguration + metadata: + annotations: + cert-manager.io/inject-ca-from: capm3-system/ipam-serving-cert + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: ipam-mutating-webhook-configuration + webhooks: + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: ipam-webhook-service + namespace: capm3-system + path: /mutate-ipam-metal3-io-v1alpha1-ipaddress + failurePolicy: Fail + matchPolicy: Equivalent + name: default.ipaddress.ipam.metal3.io + rules: + - apiGroups: + - ipam.metal3.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - ipaddresses + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: ipam-webhook-service + namespace: capm3-system + path: /mutate-ipam-metal3-io-v1alpha1-ipclaim + failurePolicy: Fail + matchPolicy: Equivalent + name: default.ipclaim.ipam.metal3.io + rules: + - apiGroups: + - ipam.metal3.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - ipclaims + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: ipam-webhook-service + namespace: capm3-system + path: /mutate-ipam-metal3-io-v1alpha1-ippool + failurePolicy: Fail + matchPolicy: Equivalent + name: default.ippool.ipam.metal3.io + rules: + - apiGroups: + - ipam.metal3.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - ippools + sideEffects: None + --- + apiVersion: admissionregistration.k8s.io/v1 + kind: ValidatingWebhookConfiguration + metadata: + annotations: + cert-manager.io/inject-ca-from: capm3-system/capm3-serving-cert + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: capm3-validating-webhook-configuration + webhooks: + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /validate-infrastructure-cluster-x-k8s-io-v1beta1-metal3cluster + failurePolicy: Fail + matchPolicy: Equivalent + name: validation.metal3cluster.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3clusters + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /validate-infrastructure-cluster-x-k8s-io-v1beta1-metal3data + failurePolicy: Fail + matchPolicy: Equivalent + name: validation.metal3data.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3datas + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /validate-infrastructure-cluster-x-k8s-io-v1beta1-metal3dataclaim + failurePolicy: Fail + matchPolicy: Equivalent + name: validation.metal3dataclaim.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3dataclaims + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /validate-infrastructure-cluster-x-k8s-io-v1beta1-metal3datatemplate + failurePolicy: Fail + matchPolicy: Equivalent + name: validation.metal3datatemplate.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3datatemplates + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /validate-infrastructure-cluster-x-k8s-io-v1beta1-metal3machine + failurePolicy: Fail + matchPolicy: Equivalent + name: validation.metal3machine.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3machines + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /validate-infrastructure-cluster-x-k8s-io-v1beta1-metal3machinetemplate + failurePolicy: Fail + matchPolicy: Equivalent + name: validation.metal3machinetemplate.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3machinetemplates + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /validate-infrastructure-cluster-x-k8s-io-v1beta1-metal3remediation + failurePolicy: Fail + matchPolicy: Equivalent + name: validation.metal3remediation.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3remediations + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capm3-webhook-service + namespace: capm3-system + path: /validate-infrastructure-cluster-x-k8s-io-v1beta1-metal3remediationtemplate + failurePolicy: Fail + matchPolicy: Equivalent + name: validation.metal3remediationtemplate.infrastructure.cluster.x-k8s.io + rules: + - apiGroups: + - infrastructure.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - metal3remediationtemplates + sideEffects: None + --- + apiVersion: admissionregistration.k8s.io/v1 + kind: ValidatingWebhookConfiguration + metadata: + annotations: + cert-manager.io/inject-ca-from: capm3-system/ipam-serving-cert + labels: + cluster.x-k8s.io/provider: infrastructure-metal3 + name: ipam-validating-webhook-configuration + webhooks: + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: ipam-webhook-service + namespace: capm3-system + path: /validate-ipam-metal3-io-v1alpha1-ipaddress + failurePolicy: Fail + matchPolicy: Equivalent + name: validation.ipaddress.ipam.metal3.io + rules: + - apiGroups: + - ipam.metal3.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - ipaddresses + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: ipam-webhook-service + namespace: capm3-system + path: /validate-ipam-metal3-io-v1alpha1-ipclaim + failurePolicy: Fail + matchPolicy: Equivalent + name: validation.ipclaim.ipam.metal3.io + rules: + - apiGroups: + - ipam.metal3.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - ipclaims + sideEffects: None + - admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: ipam-webhook-service + namespace: capm3-system + path: /validate-ipam-metal3-io-v1alpha1-ippool + failurePolicy: Fail + matchPolicy: Equivalent + name: validation.ippool.ipam.metal3.io + rules: + - apiGroups: + - ipam.metal3.io + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - ippools + sideEffects: None + metadata: | + apiVersion: clusterctl.cluster.x-k8s.io/v1alpha3 + kind: Metadata + releaseSeries: + - major: 1 + minor: 7 + contract: v1beta1 + - major: 1 + minor: 6 + contract: v1beta1 + - major: 1 + minor: 5 + contract: v1beta1 + - major: 1 + minor: 4 + contract: v1beta1 + - major: 1 + minor: 3 + contract: v1beta1 + - major: 1 + minor: 2 + contract: v1beta1 + - major: 1 + minor: 1 + contract: v1beta1 +kind: ConfigMap +metadata: + creationTimestamp: null + name: v1.7.1 + namespace: capm3-system + labels: + provider-components: metal3 diff --git a/charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-rke2-bootstrap.yaml b/charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-rke2-bootstrap.yaml new file mode 100644 index 00000000..b1d77f24 --- /dev/null +++ b/charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-rke2-bootstrap.yaml @@ -0,0 +1,2751 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + control-plane: controller-manager + name: rke2-bootstrap-system +--- +apiVersion: v1 +data: + components: | + apiVersion: v1 + kind: Namespace + metadata: + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + control-plane: controller-manager + name: rke2-bootstrap-system + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + cert-manager.io/inject-ca-from: rke2-bootstrap-system/rke2-bootstrap-serving-cert + controller-gen.kubebuilder.io/version: v0.14.0 + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + cluster.x-k8s.io/v1beta1: v1alpha1_v1beta1 + name: rke2configs.bootstrap.cluster.x-k8s.io + spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: rke2-bootstrap-webhook-service + namespace: rke2-bootstrap-system + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: bootstrap.cluster.x-k8s.io + names: + kind: RKE2Config + listKind: RKE2ConfigList + plural: rke2configs + singular: rke2config + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: RKE2Config is the Schema for the rke2configs API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: RKE2ConfigSpec defines the desired state of RKE2Config. + properties: + agentConfig: + description: AgentConfig specifies configuration for the agent nodes. + properties: + additionalUserData: + description: |- + AdditionalUserData is a field that allows users to specify additional cloud-init or ignition configuration to be included in the + generated cloud-init/ignition script. + properties: + config: + description: |- + In case of using ignition, the data format is documented here: https://kinvolk.io/docs/flatcar-container-linux/latest/provisioning/cl-config/ + NOTE: All fields of the UserData that are managed by the RKE2Config controller will be ignored, this include "write_files", "runcmd", "ntp". + Deprecated: Data is reserved for the arbitrary cloud-init data + type: string + data: + additionalProperties: + type: string + description: |- + Data allows to pass arbitrary set of key/value pairs consistent with + https://cloudinit.readthedocs.io/en/latest/reference/modules.html + to extend existing cloud-init configuration + type: object + strict: + description: Strict controls if Config should be strictly + parsed. If so, warnings are treated as errors. + type: boolean + type: object + x-kubernetes-validations: + - message: Only config or data could be populated at once + rule: '!has(self.data) || !has(self.config)' + airGapped: + description: |- + AirGapped is a boolean value to define if the bootstrapping should be air-gapped, + basically supposing that online container registries and RKE2 install scripts are not reachable. + type: boolean + cisProfile: + description: CISProfile activates CIS compliance of RKE2 for a + certain profile + enum: + - cis + - cis-1.23 + - cis-1.5 + - cis-1.6 + type: string + containerRuntimeEndpoint: + description: ContainerRuntimeEndpoint Disable embedded containerd + and use alternative CRI implementation. + type: string + dataDir: + description: DataDir Folder to hold state. + type: string + enableContainerdSElinux: + description: |- + EnableContainerdSElinux defines the policy for enabling SELinux for Containerd + if value is true, Containerd will run with selinux-enabled=true flag + if value is false, Containerd will run without the above flag + type: boolean + format: + description: Format specifies the output format of the bootstrap + data. Defaults to cloud-config. + enum: + - cloud-config + - ignition + type: string + imageCredentialProviderConfigMap: + description: |- + ImageCredentialProviderConfigMap is a reference to the ConfigMap that contains credential provider plugin config + The config map should contain a key "credential-config.yaml" with YAML file content and + a key "credential-provider-binaries" with the a path to the binaries for the credential provider. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + kubeProxy: + description: KubeProxyArgs Customized flag for kube-proxy process. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + kubelet: + description: KubeletArgs Customized flag for kubelet process. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + kubeletPath: + description: KubeletPath Override kubelet binary path. + type: string + loadBalancerPort: + description: |- + LoadBalancerPort local port for supervisor client load-balancer. If the supervisor and apiserver are + not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer (default: 6444). + type: integer + nodeAnnotations: + additionalProperties: + type: string + description: |- + NodeAnnotations are annotations that are created on nodes post bootstrap phase. + Unfortunately it is not possible to apply annotations via kubelet + using current bootstrap configurations. + Issue: https://github.com/kubernetes/kubernetes/issues/108046 + type: object + nodeLabels: + description: NodeLabels Registering and starting kubelet with + set of labels. + items: + type: string + type: array + nodeName: + description: NodeNamePrefix Prefix to the Node Name that CAPI + will generate. + type: string + nodeTaints: + description: NodeTaints Registering kubelet with set of taints. + items: + type: string + type: array + ntp: + description: NTP specifies NTP configuration + properties: + enabled: + description: Enabled specifies whether NTP should be enabled + type: boolean + servers: + description: Servers specifies which NTP servers to use + items: + type: string + type: array + type: object + protectKernelDefaults: + description: |- + ProtectKernelDefaults defines Kernel tuning behavior. If true, error if kernel tunables are different than kubelet defaults. + if false, kernel tunable can be different from kubelet defaults + type: boolean + resolvConf: + description: ResolvConf is a reference to a ConfigMap containing + resolv.conf content for the node. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + runtimeImage: + description: RuntimeImage override image to use for runtime binaries + (containerd, kubectl, crictl, etc). + type: string + snapshotter: + description: 'Snapshotter override default containerd snapshotter + (default: "overlayfs").' + type: string + systemDefaultRegistry: + description: SystemDefaultRegistry Private registry to be used + for all system images. + type: string + version: + description: Version specifies the rke2 version. + type: string + type: object + files: + description: Files specifies extra files to be passed to user_data + upon creation. + items: + description: File defines the input for generating write_files in + cloud-init. + properties: + content: + description: Content is the actual content of the file. + type: string + contentFrom: + description: ContentFrom is a referenced source of content to + populate the file. + properties: + secret: + description: SecretFileSource represents a secret that should + populate this file. + properties: + key: + description: Key is the key in the secret's data map + for this value. + type: string + name: + description: Name of the secret in the RKE2BootstrapConfig's + namespace to use. + type: string + required: + - key + - name + type: object + required: + - secret + type: object + encoding: + description: Encoding specifies the encoding of the file contents. + enum: + - base64 + - gzip + - gzip+base64 + type: string + owner: + description: Owner specifies the ownership of the file, e.g. + "root:root". + type: string + path: + description: Path specifies the full path on disk where to store + the file. + type: string + permissions: + description: Permissions specifies the permissions to assign + to the file, e.g. "0640". + type: string + required: + - path + type: object + type: array + postRKE2Commands: + description: PostRKE2Commands specifies extra commands to run after + rke2 setup runs. + items: + type: string + type: array + preRKE2Commands: + description: PreRKE2Commands specifies extra commands to run before + rke2 setup runs. + items: + type: string + type: array + privateRegistriesConfig: + description: PrivateRegistriesConfig defines the containerd configuration + for private registries and local registry mirrors. + properties: + configs: + additionalProperties: + description: RegistryConfig contains configuration used to communicate + with the registry. + properties: + authSecret: + description: |- + Auth si a reference to a Secret containing information to authenticate to the registry. + The Secret must provite a username and a password data entry. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + tls: + description: |- + TLS is a pair of CA/Cert/Key which then are used when creating the transport + that communicates with the registry. + properties: + insecureSkipVerify: + description: InsecureSkipVerify may be set to false + to skip verifying the registry's certificate, default + is true. + type: boolean + tlsConfigSecret: + description: |- + TLSConfigSecret is a reference to a secret of type `kubernetes.io/tls` thich has up to 3 entries: tls.crt, tls.key and ca.crt + which describe the TLS configuration necessary to connect to the registry. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: object + type: object + description: |- + Configs are configs for each registry. + The key is the FDQN or IP of the registry. + type: object + mirrors: + additionalProperties: + description: Mirror contains the config related to the registry + mirror. + properties: + endpoint: + description: |- + Endpoints are endpoints for a namespace. CRI plugin will try the endpoints + one by one until a working one is found. The endpoint must be a valid url + with host specified. + The scheme, host and path from the endpoint URL will be used. + items: + type: string + type: array + rewrite: + additionalProperties: + type: string + description: |- + Rewrites are repository rewrite rules for a namespace. When fetching image resources + from an endpoint and a key matches the repository via regular expression matching + it will be replaced with the corresponding value from the map in the resource request. + type: object + type: object + description: Mirrors are namespace to mirror mapping for all namespaces. + type: object + type: object + type: object + status: + description: RKE2ConfigStatus defines the observed state of RKE2Config. + properties: + conditions: + description: Conditions defines current service state of the RKE2Config. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + dataSecretName: + description: DataSecretName is the name of the secret that stores + the bootstrap data script. + type: string + failureMessage: + description: FailureMessage will be set on non-retryable errors. + type: string + failureReason: + description: FailureReason will be set on non-retryable errors. + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + ready: + description: Ready indicates the BootstrapData field is ready to be + consumed. + type: boolean + type: object + type: object + served: true + storage: false + subresources: + status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + description: RKE2Config is the Schema for the rke2configs API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: RKE2ConfigSpec defines the desired state of RKE2Config. + properties: + agentConfig: + description: AgentConfig specifies configuration for the agent nodes. + properties: + additionalUserData: + description: |- + AdditionalUserData is a field that allows users to specify additional cloud-init or ignition configuration to be included in the + generated cloud-init/ignition script. + properties: + config: + description: |- + In case of using ignition, the data format is documented here: https://kinvolk.io/docs/flatcar-container-linux/latest/provisioning/cl-config/ + NOTE: All fields of the UserData that are managed by the RKE2Config controller will be ignored, this include "write_files", "runcmd", "ntp". + type: string + data: + additionalProperties: + type: string + description: |- + Data allows to pass arbitrary set of key/value pairs consistent with + https://cloudinit.readthedocs.io/en/latest/reference/modules.html + to extend existing cloud-init configuration + type: object + strict: + description: Strict controls if Config should be strictly + parsed. If so, warnings are treated as errors. + type: boolean + type: object + x-kubernetes-validations: + - message: Only config or data could be populated at once + rule: '!has(self.data) || !has(self.config)' + airGapped: + description: |- + AirGapped is a boolean value to define if the bootstrapping should be air-gapped, + basically supposing that online container registries and RKE2 install scripts are not reachable. + type: boolean + airGappedChecksum: + description: |- + AirGappedChecksum is a string value with a sha256sum checksum to compare with checksum + of existing sha256sum-.txt file for packages already available on the machine + before performing air-gapped installation. + type: string + cisProfile: + description: CISProfile activates CIS compliance of RKE2 for a + certain profile + enum: + - cis + - cis-1.23 + - cis-1.5 + - cis-1.6 + type: string + containerRuntimeEndpoint: + description: ContainerRuntimeEndpoint Disable embedded containerd + and use alternative CRI implementation. + type: string + dataDir: + description: DataDir Folder to hold state. + type: string + enableContainerdSElinux: + description: |- + EnableContainerdSElinux defines the policy for enabling SELinux for Containerd + if value is true, Containerd will run with selinux-enabled=true flag + if value is false, Containerd will run without the above flag + type: boolean + format: + description: Format specifies the output format of the bootstrap + data. Defaults to cloud-config. + enum: + - cloud-config + - ignition + type: string + imageCredentialProviderConfigMap: + description: |- + ImageCredentialProviderConfigMap is a reference to the ConfigMap that contains credential provider plugin config + The config map should contain a key "credential-config.yaml" with YAML file content and + a key "credential-provider-binaries" with the a path to the binaries for the credential provider. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + kubeProxy: + description: KubeProxyArgs Customized flag for kube-proxy process. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + kubelet: + description: KubeletArgs Customized flag for kubelet process. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + kubeletPath: + description: KubeletPath Override kubelet binary path. + type: string + loadBalancerPort: + description: |- + LoadBalancerPort local port for supervisor client load-balancer. If the supervisor and apiserver are + not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer (default: 6444). + type: integer + nodeAnnotations: + additionalProperties: + type: string + description: |- + NodeAnnotations are annotations that are created on nodes post bootstrap phase. + Unfortunately it is not possible to apply annotations via kubelet + using current bootstrap configurations. + Issue: https://github.com/kubernetes/kubernetes/issues/108046 + type: object + nodeLabels: + description: NodeLabels Registering and starting kubelet with + set of labels. + items: + type: string + type: array + nodeName: + description: NodeNamePrefix Prefix to the Node Name that CAPI + will generate. + type: string + nodeTaints: + description: NodeTaints Registering kubelet with set of taints. + items: + type: string + type: array + ntp: + description: NTP specifies NTP configuration + properties: + enabled: + description: Enabled specifies whether NTP should be enabled + type: boolean + servers: + description: Servers specifies which NTP servers to use + items: + type: string + type: array + type: object + protectKernelDefaults: + description: |- + ProtectKernelDefaults defines Kernel tuning behavior. If true, error if kernel tunables are different than kubelet defaults. + if false, kernel tunable can be different from kubelet defaults + type: boolean + resolvConf: + description: ResolvConf is a reference to a ConfigMap containing + resolv.conf content for the node. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + runtimeImage: + description: RuntimeImage override image to use for runtime binaries + (containerd, kubectl, crictl, etc). + type: string + snapshotter: + description: 'Snapshotter override default containerd snapshotter + (default: "overlayfs").' + type: string + systemDefaultRegistry: + description: SystemDefaultRegistry Private registry to be used + for all system images. + type: string + type: object + files: + description: Files specifies extra files to be passed to user_data + upon creation. + items: + description: File defines the input for generating write_files in + cloud-init. + properties: + content: + description: Content is the actual content of the file. + type: string + contentFrom: + description: ContentFrom is a referenced source of content to + populate the file. + properties: + secret: + description: SecretFileSource represents a secret that should + populate this file. + properties: + key: + description: Key is the key in the secret's data map + for this value. + type: string + name: + description: Name of the secret in the RKE2BootstrapConfig's + namespace to use. + type: string + required: + - key + - name + type: object + required: + - secret + type: object + encoding: + description: Encoding specifies the encoding of the file contents. + enum: + - base64 + - gzip + - gzip+base64 + type: string + owner: + description: Owner specifies the ownership of the file, e.g. + "root:root". + type: string + path: + description: Path specifies the full path on disk where to store + the file. + type: string + permissions: + description: Permissions specifies the permissions to assign + to the file, e.g. "0640". + type: string + required: + - path + type: object + type: array + postRKE2Commands: + description: PostRKE2Commands specifies extra commands to run after + rke2 setup runs. + items: + type: string + type: array + preRKE2Commands: + description: PreRKE2Commands specifies extra commands to run before + rke2 setup runs. + items: + type: string + type: array + privateRegistriesConfig: + description: PrivateRegistriesConfig defines the containerd configuration + for private registries and local registry mirrors. + properties: + configs: + additionalProperties: + description: RegistryConfig contains configuration used to communicate + with the registry. + properties: + authSecret: + description: |- + Auth is a reference to a Secret containing information to authenticate to the registry. + The Secret must provite a username and a password data entry. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + tls: + description: |- + TLS is a pair of CA/Cert/Key which then are used when creating the transport + that communicates with the registry. + properties: + insecureSkipVerify: + description: InsecureSkipVerify may be set to false + to skip verifying the registry's certificate, default + is true. + type: boolean + tlsConfigSecret: + description: |- + TLSConfigSecret is a reference to a secret of type `kubernetes.io/tls` thich has up to 3 entries: tls.crt, tls.key and ca.crt + which describe the TLS configuration necessary to connect to the registry. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: object + type: object + description: |- + Configs are configs for each registry. + The key is the FDQN or IP of the registry. + type: object + mirrors: + additionalProperties: + description: Mirror contains the config related to the registry + mirror. + properties: + endpoint: + description: |- + Endpoints are endpoints for a namespace. CRI plugin will try the endpoints + one by one until a working one is found. The endpoint must be a valid url + with host specified. + The scheme, host and path from the endpoint URL will be used. + items: + type: string + type: array + rewrite: + additionalProperties: + type: string + description: |- + Rewrites are repository rewrite rules for a namespace. When fetching image resources + from an endpoint and a key matches the repository via regular expression matching + it will be replaced with the corresponding value from the map in the resource request. + type: object + type: object + description: Mirrors are namespace to mirror mapping for all namespaces. + type: object + type: object + type: object + status: + description: RKE2ConfigStatus defines the observed state of RKE2Config. + properties: + conditions: + description: Conditions defines current service state of the RKE2Config. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + dataSecretName: + description: DataSecretName is the name of the secret that stores + the bootstrap data script. + type: string + failureMessage: + description: FailureMessage will be set on non-retryable errors. + type: string + failureReason: + description: FailureReason will be set on non-retryable errors. + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + ready: + description: Ready indicates the BootstrapData field is ready to be + consumed. + type: boolean + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + cert-manager.io/inject-ca-from: rke2-bootstrap-system/rke2-bootstrap-serving-cert + controller-gen.kubebuilder.io/version: v0.14.0 + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + cluster.x-k8s.io/v1beta1: v1alpha1_v1beta1 + name: rke2configtemplates.bootstrap.cluster.x-k8s.io + spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: rke2-bootstrap-webhook-service + namespace: rke2-bootstrap-system + path: /convert + conversionReviewVersions: + - v1 + group: bootstrap.cluster.x-k8s.io + names: + kind: RKE2ConfigTemplate + listKind: RKE2ConfigTemplateList + plural: rke2configtemplates + singular: rke2configtemplate + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: RKE2ConfigTemplate is the Schema for the RKE2configtemplates + API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec details the RKE2ConfigTemplate specification. + properties: + template: + description: "Template references a RKE2ConfigTemplate, which is used + to include an RKE2ConfigSpec struct.\n\tThis is used to include + a desired RKE2ConfigSpec configuration when an RKE2Config resource + is generated by a MachineDeployment resource." + properties: + spec: + description: Spec is the RKE2ConfigSpec that should be used for + the template. + properties: + agentConfig: + description: AgentConfig specifies configuration for the agent + nodes. + properties: + additionalUserData: + description: |- + AdditionalUserData is a field that allows users to specify additional cloud-init or ignition configuration to be included in the + generated cloud-init/ignition script. + properties: + config: + description: |- + In case of using ignition, the data format is documented here: https://kinvolk.io/docs/flatcar-container-linux/latest/provisioning/cl-config/ + NOTE: All fields of the UserData that are managed by the RKE2Config controller will be ignored, this include "write_files", "runcmd", "ntp". + Deprecated: Data is reserved for the arbitrary cloud-init data + type: string + data: + additionalProperties: + type: string + description: |- + Data allows to pass arbitrary set of key/value pairs consistent with + https://cloudinit.readthedocs.io/en/latest/reference/modules.html + to extend existing cloud-init configuration + type: object + strict: + description: Strict controls if Config should be strictly + parsed. If so, warnings are treated as errors. + type: boolean + type: object + x-kubernetes-validations: + - message: Only config or data could be populated at once + rule: '!has(self.data) || !has(self.config)' + airGapped: + description: |- + AirGapped is a boolean value to define if the bootstrapping should be air-gapped, + basically supposing that online container registries and RKE2 install scripts are not reachable. + type: boolean + cisProfile: + description: CISProfile activates CIS compliance of RKE2 + for a certain profile + enum: + - cis + - cis-1.23 + - cis-1.5 + - cis-1.6 + type: string + containerRuntimeEndpoint: + description: ContainerRuntimeEndpoint Disable embedded + containerd and use alternative CRI implementation. + type: string + dataDir: + description: DataDir Folder to hold state. + type: string + enableContainerdSElinux: + description: |- + EnableContainerdSElinux defines the policy for enabling SELinux for Containerd + if value is true, Containerd will run with selinux-enabled=true flag + if value is false, Containerd will run without the above flag + type: boolean + format: + description: Format specifies the output format of the + bootstrap data. Defaults to cloud-config. + enum: + - cloud-config + - ignition + type: string + imageCredentialProviderConfigMap: + description: |- + ImageCredentialProviderConfigMap is a reference to the ConfigMap that contains credential provider plugin config + The config map should contain a key "credential-config.yaml" with YAML file content and + a key "credential-provider-binaries" with the a path to the binaries for the credential provider. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + kubeProxy: + description: KubeProxyArgs Customized flag for kube-proxy + process. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line + arguments (format: flag=value) to pass to a Kubernetes + Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables + to pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts + to be added for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references + a container image to override the default one for + the Kubernetes Component + type: string + type: object + kubelet: + description: KubeletArgs Customized flag for kubelet process. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line + arguments (format: flag=value) to pass to a Kubernetes + Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables + to pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts + to be added for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references + a container image to override the default one for + the Kubernetes Component + type: string + type: object + kubeletPath: + description: KubeletPath Override kubelet binary path. + type: string + loadBalancerPort: + description: |- + LoadBalancerPort local port for supervisor client load-balancer. If the supervisor and apiserver are + not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer (default: 6444). + type: integer + nodeAnnotations: + additionalProperties: + type: string + description: |- + NodeAnnotations are annotations that are created on nodes post bootstrap phase. + Unfortunately it is not possible to apply annotations via kubelet + using current bootstrap configurations. + Issue: https://github.com/kubernetes/kubernetes/issues/108046 + type: object + nodeLabels: + description: NodeLabels Registering and starting kubelet + with set of labels. + items: + type: string + type: array + nodeName: + description: NodeNamePrefix Prefix to the Node Name that + CAPI will generate. + type: string + nodeTaints: + description: NodeTaints Registering kubelet with set of + taints. + items: + type: string + type: array + ntp: + description: NTP specifies NTP configuration + properties: + enabled: + description: Enabled specifies whether NTP should + be enabled + type: boolean + servers: + description: Servers specifies which NTP servers to + use + items: + type: string + type: array + type: object + protectKernelDefaults: + description: |- + ProtectKernelDefaults defines Kernel tuning behavior. If true, error if kernel tunables are different than kubelet defaults. + if false, kernel tunable can be different from kubelet defaults + type: boolean + resolvConf: + description: ResolvConf is a reference to a ConfigMap + containing resolv.conf content for the node. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + runtimeImage: + description: RuntimeImage override image to use for runtime + binaries (containerd, kubectl, crictl, etc). + type: string + snapshotter: + description: 'Snapshotter override default containerd + snapshotter (default: "overlayfs").' + type: string + systemDefaultRegistry: + description: SystemDefaultRegistry Private registry to + be used for all system images. + type: string + version: + description: Version specifies the rke2 version. + type: string + type: object + files: + description: Files specifies extra files to be passed to user_data + upon creation. + items: + description: File defines the input for generating write_files + in cloud-init. + properties: + content: + description: Content is the actual content of the file. + type: string + contentFrom: + description: ContentFrom is a referenced source of content + to populate the file. + properties: + secret: + description: SecretFileSource represents a secret + that should populate this file. + properties: + key: + description: Key is the key in the secret's + data map for this value. + type: string + name: + description: Name of the secret in the RKE2BootstrapConfig's + namespace to use. + type: string + required: + - key + - name + type: object + required: + - secret + type: object + encoding: + description: Encoding specifies the encoding of the + file contents. + enum: + - base64 + - gzip + - gzip+base64 + type: string + owner: + description: Owner specifies the ownership of the file, + e.g. "root:root". + type: string + path: + description: Path specifies the full path on disk where + to store the file. + type: string + permissions: + description: Permissions specifies the permissions to + assign to the file, e.g. "0640". + type: string + required: + - path + type: object + type: array + postRKE2Commands: + description: PostRKE2Commands specifies extra commands to + run after rke2 setup runs. + items: + type: string + type: array + preRKE2Commands: + description: PreRKE2Commands specifies extra commands to run + before rke2 setup runs. + items: + type: string + type: array + privateRegistriesConfig: + description: PrivateRegistriesConfig defines the containerd + configuration for private registries and local registry + mirrors. + properties: + configs: + additionalProperties: + description: RegistryConfig contains configuration used + to communicate with the registry. + properties: + authSecret: + description: |- + Auth si a reference to a Secret containing information to authenticate to the registry. + The Secret must provite a username and a password data entry. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + tls: + description: |- + TLS is a pair of CA/Cert/Key which then are used when creating the transport + that communicates with the registry. + properties: + insecureSkipVerify: + description: InsecureSkipVerify may be set to + false to skip verifying the registry's certificate, + default is true. + type: boolean + tlsConfigSecret: + description: |- + TLSConfigSecret is a reference to a secret of type `kubernetes.io/tls` thich has up to 3 entries: tls.crt, tls.key and ca.crt + which describe the TLS configuration necessary to connect to the registry. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: object + type: object + description: |- + Configs are configs for each registry. + The key is the FDQN or IP of the registry. + type: object + mirrors: + additionalProperties: + description: Mirror contains the config related to the + registry mirror. + properties: + endpoint: + description: |- + Endpoints are endpoints for a namespace. CRI plugin will try the endpoints + one by one until a working one is found. The endpoint must be a valid url + with host specified. + The scheme, host and path from the endpoint URL will be used. + items: + type: string + type: array + rewrite: + additionalProperties: + type: string + description: |- + Rewrites are repository rewrite rules for a namespace. When fetching image resources + from an endpoint and a key matches the repository via regular expression matching + it will be replaced with the corresponding value from the map in the resource request. + type: object + type: object + description: Mirrors are namespace to mirror mapping for + all namespaces. + type: object + type: object + type: object + required: + - spec + type: object + required: + - template + type: object + required: + - spec + type: object + served: true + storage: false + subresources: + status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + description: RKE2ConfigTemplate is the Schema for the RKE2configtemplates + API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec details the RKE2ConfigTemplate specification. + properties: + template: + description: "Template references a RKE2ConfigTemplate, which is used + to include an RKE2ConfigSpec struct.\n\tThis is used to include + a desired RKE2ConfigSpec configuration when an RKE2Config resource + is generated by a MachineDeployment resource." + properties: + spec: + description: Spec is the RKE2ConfigSpec that should be used for + the template. + properties: + agentConfig: + description: AgentConfig specifies configuration for the agent + nodes. + properties: + additionalUserData: + description: |- + AdditionalUserData is a field that allows users to specify additional cloud-init or ignition configuration to be included in the + generated cloud-init/ignition script. + properties: + config: + description: |- + In case of using ignition, the data format is documented here: https://kinvolk.io/docs/flatcar-container-linux/latest/provisioning/cl-config/ + NOTE: All fields of the UserData that are managed by the RKE2Config controller will be ignored, this include "write_files", "runcmd", "ntp". + type: string + data: + additionalProperties: + type: string + description: |- + Data allows to pass arbitrary set of key/value pairs consistent with + https://cloudinit.readthedocs.io/en/latest/reference/modules.html + to extend existing cloud-init configuration + type: object + strict: + description: Strict controls if Config should be strictly + parsed. If so, warnings are treated as errors. + type: boolean + type: object + x-kubernetes-validations: + - message: Only config or data could be populated at once + rule: '!has(self.data) || !has(self.config)' + airGapped: + description: |- + AirGapped is a boolean value to define if the bootstrapping should be air-gapped, + basically supposing that online container registries and RKE2 install scripts are not reachable. + type: boolean + airGappedChecksum: + description: |- + AirGappedChecksum is a string value with a sha256sum checksum to compare with checksum + of existing sha256sum-.txt file for packages already available on the machine + before performing air-gapped installation. + type: string + cisProfile: + description: CISProfile activates CIS compliance of RKE2 + for a certain profile + enum: + - cis + - cis-1.23 + - cis-1.5 + - cis-1.6 + type: string + containerRuntimeEndpoint: + description: ContainerRuntimeEndpoint Disable embedded + containerd and use alternative CRI implementation. + type: string + dataDir: + description: DataDir Folder to hold state. + type: string + enableContainerdSElinux: + description: |- + EnableContainerdSElinux defines the policy for enabling SELinux for Containerd + if value is true, Containerd will run with selinux-enabled=true flag + if value is false, Containerd will run without the above flag + type: boolean + format: + description: Format specifies the output format of the + bootstrap data. Defaults to cloud-config. + enum: + - cloud-config + - ignition + type: string + imageCredentialProviderConfigMap: + description: |- + ImageCredentialProviderConfigMap is a reference to the ConfigMap that contains credential provider plugin config + The config map should contain a key "credential-config.yaml" with YAML file content and + a key "credential-provider-binaries" with the a path to the binaries for the credential provider. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + kubeProxy: + description: KubeProxyArgs Customized flag for kube-proxy + process. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line + arguments (format: flag=value) to pass to a Kubernetes + Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables + to pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts + to be added for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references + a container image to override the default one for + the Kubernetes Component + type: string + type: object + kubelet: + description: KubeletArgs Customized flag for kubelet process. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line + arguments (format: flag=value) to pass to a Kubernetes + Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables + to pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts + to be added for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references + a container image to override the default one for + the Kubernetes Component + type: string + type: object + kubeletPath: + description: KubeletPath Override kubelet binary path. + type: string + loadBalancerPort: + description: |- + LoadBalancerPort local port for supervisor client load-balancer. If the supervisor and apiserver are + not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer (default: 6444). + type: integer + nodeAnnotations: + additionalProperties: + type: string + description: |- + NodeAnnotations are annotations that are created on nodes post bootstrap phase. + Unfortunately it is not possible to apply annotations via kubelet + using current bootstrap configurations. + Issue: https://github.com/kubernetes/kubernetes/issues/108046 + type: object + nodeLabels: + description: NodeLabels Registering and starting kubelet + with set of labels. + items: + type: string + type: array + nodeName: + description: NodeNamePrefix Prefix to the Node Name that + CAPI will generate. + type: string + nodeTaints: + description: NodeTaints Registering kubelet with set of + taints. + items: + type: string + type: array + ntp: + description: NTP specifies NTP configuration + properties: + enabled: + description: Enabled specifies whether NTP should + be enabled + type: boolean + servers: + description: Servers specifies which NTP servers to + use + items: + type: string + type: array + type: object + protectKernelDefaults: + description: |- + ProtectKernelDefaults defines Kernel tuning behavior. If true, error if kernel tunables are different than kubelet defaults. + if false, kernel tunable can be different from kubelet defaults + type: boolean + resolvConf: + description: ResolvConf is a reference to a ConfigMap + containing resolv.conf content for the node. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + runtimeImage: + description: RuntimeImage override image to use for runtime + binaries (containerd, kubectl, crictl, etc). + type: string + snapshotter: + description: 'Snapshotter override default containerd + snapshotter (default: "overlayfs").' + type: string + systemDefaultRegistry: + description: SystemDefaultRegistry Private registry to + be used for all system images. + type: string + type: object + files: + description: Files specifies extra files to be passed to user_data + upon creation. + items: + description: File defines the input for generating write_files + in cloud-init. + properties: + content: + description: Content is the actual content of the file. + type: string + contentFrom: + description: ContentFrom is a referenced source of content + to populate the file. + properties: + secret: + description: SecretFileSource represents a secret + that should populate this file. + properties: + key: + description: Key is the key in the secret's + data map for this value. + type: string + name: + description: Name of the secret in the RKE2BootstrapConfig's + namespace to use. + type: string + required: + - key + - name + type: object + required: + - secret + type: object + encoding: + description: Encoding specifies the encoding of the + file contents. + enum: + - base64 + - gzip + - gzip+base64 + type: string + owner: + description: Owner specifies the ownership of the file, + e.g. "root:root". + type: string + path: + description: Path specifies the full path on disk where + to store the file. + type: string + permissions: + description: Permissions specifies the permissions to + assign to the file, e.g. "0640". + type: string + required: + - path + type: object + type: array + postRKE2Commands: + description: PostRKE2Commands specifies extra commands to + run after rke2 setup runs. + items: + type: string + type: array + preRKE2Commands: + description: PreRKE2Commands specifies extra commands to run + before rke2 setup runs. + items: + type: string + type: array + privateRegistriesConfig: + description: PrivateRegistriesConfig defines the containerd + configuration for private registries and local registry + mirrors. + properties: + configs: + additionalProperties: + description: RegistryConfig contains configuration used + to communicate with the registry. + properties: + authSecret: + description: |- + Auth is a reference to a Secret containing information to authenticate to the registry. + The Secret must provite a username and a password data entry. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + tls: + description: |- + TLS is a pair of CA/Cert/Key which then are used when creating the transport + that communicates with the registry. + properties: + insecureSkipVerify: + description: InsecureSkipVerify may be set to + false to skip verifying the registry's certificate, + default is true. + type: boolean + tlsConfigSecret: + description: |- + TLSConfigSecret is a reference to a secret of type `kubernetes.io/tls` thich has up to 3 entries: tls.crt, tls.key and ca.crt + which describe the TLS configuration necessary to connect to the registry. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: object + type: object + description: |- + Configs are configs for each registry. + The key is the FDQN or IP of the registry. + type: object + mirrors: + additionalProperties: + description: Mirror contains the config related to the + registry mirror. + properties: + endpoint: + description: |- + Endpoints are endpoints for a namespace. CRI plugin will try the endpoints + one by one until a working one is found. The endpoint must be a valid url + with host specified. + The scheme, host and path from the endpoint URL will be used. + items: + type: string + type: array + rewrite: + additionalProperties: + type: string + description: |- + Rewrites are repository rewrite rules for a namespace. When fetching image resources + from an endpoint and a key matches the repository via regular expression matching + it will be replaced with the corresponding value from the map in the resource request. + type: object + type: object + description: Mirrors are namespace to mirror mapping for + all namespaces. + type: object + type: object + type: object + required: + - spec + type: object + required: + - template + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: v1 + kind: ServiceAccount + metadata: + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + name: rke2-bootstrap-manager + namespace: rke2-bootstrap-system + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: Role + metadata: + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + name: rke2-bootstrap-leader-election-role + namespace: rke2-bootstrap-system + rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + name: rke2-bootstrap-manager-role + rules: + - apiGroups: + - "" + resources: + - configmaps + - events + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + - apiGroups: + - bootstrap.cluster.x-k8s.io + resources: + - rke2configs + - rke2configs/finalizers + - rke2configs/status + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - clusters + - clusters/status + - machinepools + - machinepools/status + - machines + - machines/status + - machinesets + verbs: + - get + - list + - watch + - apiGroups: + - controlplane.cluster.x-k8s.io + resources: + - rke2controlplanes + - rke2controlplanes/status + verbs: + - get + - list + - watch + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: RoleBinding + metadata: + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + name: rke2-bootstrap-leader-election-rolebinding + namespace: rke2-bootstrap-system + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: rke2-bootstrap-leader-election-role + subjects: + - kind: ServiceAccount + name: rke2-bootstrap-manager + namespace: rke2-bootstrap-system + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + name: rke2-bootstrap-manager-rolebinding + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: rke2-bootstrap-manager-role + subjects: + - kind: ServiceAccount + name: rke2-bootstrap-manager + namespace: rke2-bootstrap-system + --- + apiVersion: v1 + kind: Service + metadata: + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + name: rke2-bootstrap-webhook-service + namespace: rke2-bootstrap-system + spec: + ports: + - port: 443 + targetPort: webhook-server + selector: + cluster.x-k8s.io/provider: bootstrap-rke2 + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + control-plane: controller-manager + name: rke2-bootstrap-controller-manager + namespace: rke2-bootstrap-system + spec: + replicas: 1 + selector: + matchLabels: + cluster.x-k8s.io/provider: bootstrap-rke2 + control-plane: controller-manager + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: manager + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + control-plane: controller-manager + spec: + containers: + - args: + - --leader-elect + - --diagnostics-address=${CAPRKE2_DIAGNOSTICS_ADDRESS:=:8443} + - --insecure-diagnostics=${CAPRKE2_INSECURE_DIAGNOSTICS:=false} + command: + - /manager + image: ghcr.io/rancher/cluster-api-provider-rke2-bootstrap:v0.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 9443 + name: webhook-server + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + - containerPort: 8443 + name: metrics + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsGroup: 65532 + runAsUser: 65532 + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + serviceAccountName: rke2-bootstrap-manager + terminationGracePeriodSeconds: 10 + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/master + - effect: NoSchedule + key: node-role.kubernetes.io/control-plane + volumes: + - name: cert + secret: + secretName: rke2-bootstrap-webhook-service-cert + --- + apiVersion: cert-manager.io/v1 + kind: Certificate + metadata: + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + name: rke2-bootstrap-serving-cert + namespace: rke2-bootstrap-system + spec: + dnsNames: + - rke2-bootstrap-webhook-service.rke2-bootstrap-system.svc + - rke2-bootstrap-webhook-service.rke2-bootstrap-system.svc.cluster.local + issuerRef: + kind: Issuer + name: rke2-bootstrap-selfsigned-issuer + secretName: rke2-bootstrap-webhook-service-cert + subject: + organizations: + - Rancher by SUSE + --- + apiVersion: cert-manager.io/v1 + kind: Issuer + metadata: + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + name: rke2-bootstrap-selfsigned-issuer + namespace: rke2-bootstrap-system + spec: + selfSigned: {} + --- + apiVersion: admissionregistration.k8s.io/v1 + kind: MutatingWebhookConfiguration + metadata: + annotations: + cert-manager.io/inject-ca-from: rke2-bootstrap-system/rke2-bootstrap-serving-cert + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + name: rke2-bootstrap-mutating-webhook-configuration + webhooks: + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: rke2-bootstrap-webhook-service + namespace: rke2-bootstrap-system + path: /mutate-bootstrap-cluster-x-k8s-io-v1beta1-rke2config + failurePolicy: Fail + name: mrke2config.kb.io + rules: + - apiGroups: + - bootstrap.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - rke2configs + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: rke2-bootstrap-webhook-service + namespace: rke2-bootstrap-system + path: /mutate-bootstrap-cluster-x-k8s-io-v1beta1-rke2configtemplate + failurePolicy: Fail + name: mrke2configtemplate.kb.io + rules: + - apiGroups: + - bootstrap.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - rke2configtemplates + sideEffects: None + --- + apiVersion: admissionregistration.k8s.io/v1 + kind: ValidatingWebhookConfiguration + metadata: + annotations: + cert-manager.io/inject-ca-from: rke2-bootstrap-system/rke2-bootstrap-serving-cert + labels: + cluster.x-k8s.io/provider: bootstrap-rke2 + name: rke2-bootstrap-validating-webhook-configuration + webhooks: + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: rke2-bootstrap-webhook-service + namespace: rke2-bootstrap-system + path: /validate-bootstrap-cluster-x-k8s-io-v1beta1-rke2config + failurePolicy: Fail + name: vrke2config.kb.io + rules: + - apiGroups: + - bootstrap.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - rke2configs + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: rke2-bootstrap-webhook-service + namespace: rke2-bootstrap-system + path: /validate-bootstrap-cluster-x-k8s-io-v1beta1-rke2configtemplate + failurePolicy: Fail + name: vrke2configtemplate.kb.io + rules: + - apiGroups: + - bootstrap.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - rke2configtemplates + sideEffects: None + metadata: | + # maps release series of major.minor to cluster-api contract version + # the contract version may change between minor or major versions, but *not* + # between patch versions. + # + # update this file only when a new major or minor version is released + apiVersion: clusterctl.cluster.x-k8s.io/v1alpha3 + kind: Metadata + releaseSeries: + - major: 0 + minor: 1 + contract: v1beta1 + - major: 0 + minor: 2 + contract: v1beta1 + - major: 0 + minor: 3 + contract: v1beta1 + - major: 0 + minor: 4 + contract: v1beta1 + - major: 0 + minor: 5 + contract: v1beta1 + - major: 0 + minor: 6 + contract: v1beta1 + - major: 0 + minor: 7 + contract: v1beta1 +kind: ConfigMap +metadata: + creationTimestamp: null + name: v0.7.0 + namespace: rke2-bootstrap-system + labels: + provider-components: rke2-bootstrap diff --git a/charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-rke2-control-plane.yaml b/charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-rke2-control-plane.yaml new file mode 100644 index 00000000..3dc9fcbc --- /dev/null +++ b/charts/rancher-turtles-airgap-resources/0.3.1/templates/airgap-cm-rke2-control-plane.yaml @@ -0,0 +1,4508 @@ +apiVersion: v1 +kind: Namespace +metadata: + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + control-plane: controller-manager + name: rke2-control-plane-system +--- +apiVersion: v1 +data: + components: | + apiVersion: v1 + kind: Namespace + metadata: + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + control-plane: controller-manager + name: rke2-control-plane-system + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + cert-manager.io/inject-ca-from: rke2-control-plane-system/rke2-control-plane-serving-cert + controller-gen.kubebuilder.io/version: v0.14.0 + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + cluster.x-k8s.io/v1beta1: v1alpha1_v1beta1 + name: rke2controlplanes.controlplane.cluster.x-k8s.io + spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: rke2-control-plane-webhook-service + namespace: rke2-control-plane-system + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: controlplane.cluster.x-k8s.io + names: + kind: RKE2ControlPlane + listKind: RKE2ControlPlaneList + plural: rke2controlplanes + singular: rke2controlplane + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: RKE2ControlPlane is the Schema for the rke2controlplanes API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: RKE2ControlPlaneSpec defines the desired state of RKE2ControlPlane. + properties: + agentConfig: + description: AgentConfig specifies configuration for the agent nodes. + properties: + additionalUserData: + description: |- + AdditionalUserData is a field that allows users to specify additional cloud-init or ignition configuration to be included in the + generated cloud-init/ignition script. + properties: + config: + description: |- + In case of using ignition, the data format is documented here: https://kinvolk.io/docs/flatcar-container-linux/latest/provisioning/cl-config/ + NOTE: All fields of the UserData that are managed by the RKE2Config controller will be ignored, this include "write_files", "runcmd", "ntp". + Deprecated: Data is reserved for the arbitrary cloud-init data + type: string + data: + additionalProperties: + type: string + description: |- + Data allows to pass arbitrary set of key/value pairs consistent with + https://cloudinit.readthedocs.io/en/latest/reference/modules.html + to extend existing cloud-init configuration + type: object + strict: + description: Strict controls if Config should be strictly + parsed. If so, warnings are treated as errors. + type: boolean + type: object + x-kubernetes-validations: + - message: Only config or data could be populated at once + rule: '!has(self.data) || !has(self.config)' + airGapped: + description: |- + AirGapped is a boolean value to define if the bootstrapping should be air-gapped, + basically supposing that online container registries and RKE2 install scripts are not reachable. + type: boolean + cisProfile: + description: CISProfile activates CIS compliance of RKE2 for a + certain profile + enum: + - cis + - cis-1.23 + - cis-1.5 + - cis-1.6 + type: string + containerRuntimeEndpoint: + description: ContainerRuntimeEndpoint Disable embedded containerd + and use alternative CRI implementation. + type: string + dataDir: + description: DataDir Folder to hold state. + type: string + enableContainerdSElinux: + description: |- + EnableContainerdSElinux defines the policy for enabling SELinux for Containerd + if value is true, Containerd will run with selinux-enabled=true flag + if value is false, Containerd will run without the above flag + type: boolean + format: + description: Format specifies the output format of the bootstrap + data. Defaults to cloud-config. + enum: + - cloud-config + - ignition + type: string + imageCredentialProviderConfigMap: + description: |- + ImageCredentialProviderConfigMap is a reference to the ConfigMap that contains credential provider plugin config + The config map should contain a key "credential-config.yaml" with YAML file content and + a key "credential-provider-binaries" with the a path to the binaries for the credential provider. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + kubeProxy: + description: KubeProxyArgs Customized flag for kube-proxy process. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + kubelet: + description: KubeletArgs Customized flag for kubelet process. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + kubeletPath: + description: KubeletPath Override kubelet binary path. + type: string + loadBalancerPort: + description: |- + LoadBalancerPort local port for supervisor client load-balancer. If the supervisor and apiserver are + not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer (default: 6444). + type: integer + nodeAnnotations: + additionalProperties: + type: string + description: |- + NodeAnnotations are annotations that are created on nodes post bootstrap phase. + Unfortunately it is not possible to apply annotations via kubelet + using current bootstrap configurations. + Issue: https://github.com/kubernetes/kubernetes/issues/108046 + type: object + nodeLabels: + description: NodeLabels Registering and starting kubelet with + set of labels. + items: + type: string + type: array + nodeName: + description: NodeNamePrefix Prefix to the Node Name that CAPI + will generate. + type: string + nodeTaints: + description: NodeTaints Registering kubelet with set of taints. + items: + type: string + type: array + ntp: + description: NTP specifies NTP configuration + properties: + enabled: + description: Enabled specifies whether NTP should be enabled + type: boolean + servers: + description: Servers specifies which NTP servers to use + items: + type: string + type: array + type: object + protectKernelDefaults: + description: |- + ProtectKernelDefaults defines Kernel tuning behavior. If true, error if kernel tunables are different than kubelet defaults. + if false, kernel tunable can be different from kubelet defaults + type: boolean + resolvConf: + description: ResolvConf is a reference to a ConfigMap containing + resolv.conf content for the node. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + runtimeImage: + description: RuntimeImage override image to use for runtime binaries + (containerd, kubectl, crictl, etc). + type: string + snapshotter: + description: 'Snapshotter override default containerd snapshotter + (default: "overlayfs").' + type: string + systemDefaultRegistry: + description: SystemDefaultRegistry Private registry to be used + for all system images. + type: string + version: + description: Version specifies the rke2 version. + type: string + type: object + files: + description: Files specifies extra files to be passed to user_data + upon creation. + items: + description: File defines the input for generating write_files in + cloud-init. + properties: + content: + description: Content is the actual content of the file. + type: string + contentFrom: + description: ContentFrom is a referenced source of content to + populate the file. + properties: + secret: + description: SecretFileSource represents a secret that should + populate this file. + properties: + key: + description: Key is the key in the secret's data map + for this value. + type: string + name: + description: Name of the secret in the RKE2BootstrapConfig's + namespace to use. + type: string + required: + - key + - name + type: object + required: + - secret + type: object + encoding: + description: Encoding specifies the encoding of the file contents. + enum: + - base64 + - gzip + - gzip+base64 + type: string + owner: + description: Owner specifies the ownership of the file, e.g. + "root:root". + type: string + path: + description: Path specifies the full path on disk where to store + the file. + type: string + permissions: + description: Permissions specifies the permissions to assign + to the file, e.g. "0640". + type: string + required: + - path + type: object + type: array + infrastructureRef: + description: |- + InfrastructureRef is a required reference to a custom resource + offered by an infrastructure provider. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + manifestsConfigMapReference: + description: |- + ManifestsConfigMapReference references a ConfigMap which contains Kubernetes manifests to be deployed automatically on the cluster + Each data entry in the ConfigMap will be will be copied to a folder on the control plane nodes that RKE2 scans and uses to deploy manifests. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + nodeDrainTimeout: + description: |- + NodeDrainTimeout is the total amount of time that the controller will spend on draining a controlplane node + The default value is 0, meaning that the node can be drained without any time limitations. + NOTE: NodeDrainTimeout is different from `kubectl drain --timeout` + type: string + postRKE2Commands: + description: PostRKE2Commands specifies extra commands to run after + rke2 setup runs. + items: + type: string + type: array + preRKE2Commands: + description: PreRKE2Commands specifies extra commands to run before + rke2 setup runs. + items: + type: string + type: array + privateRegistriesConfig: + description: PrivateRegistriesConfig defines the containerd configuration + for private registries and local registry mirrors. + properties: + configs: + additionalProperties: + description: RegistryConfig contains configuration used to communicate + with the registry. + properties: + authSecret: + description: |- + Auth si a reference to a Secret containing information to authenticate to the registry. + The Secret must provite a username and a password data entry. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + tls: + description: |- + TLS is a pair of CA/Cert/Key which then are used when creating the transport + that communicates with the registry. + properties: + insecureSkipVerify: + description: InsecureSkipVerify may be set to false + to skip verifying the registry's certificate, default + is true. + type: boolean + tlsConfigSecret: + description: |- + TLSConfigSecret is a reference to a secret of type `kubernetes.io/tls` thich has up to 3 entries: tls.crt, tls.key and ca.crt + which describe the TLS configuration necessary to connect to the registry. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: object + type: object + description: |- + Configs are configs for each registry. + The key is the FDQN or IP of the registry. + type: object + mirrors: + additionalProperties: + description: Mirror contains the config related to the registry + mirror. + properties: + endpoint: + description: |- + Endpoints are endpoints for a namespace. CRI plugin will try the endpoints + one by one until a working one is found. The endpoint must be a valid url + with host specified. + The scheme, host and path from the endpoint URL will be used. + items: + type: string + type: array + rewrite: + additionalProperties: + type: string + description: |- + Rewrites are repository rewrite rules for a namespace. When fetching image resources + from an endpoint and a key matches the repository via regular expression matching + it will be replaced with the corresponding value from the map in the resource request. + type: object + type: object + description: Mirrors are namespace to mirror mapping for all namespaces. + type: object + type: object + registrationAddress: + description: |- + RegistrationAddress is an explicit address to use when registering a node. This is required if + the registration type is "address". Its for scenarios where a load-balancer or VIP is used. + type: string + registrationMethod: + default: internal-first + description: RegistrationMethod is the method to use for registering + nodes into the RKE2 cluster. + enum: + - internal-first + - internal-only-ips + - external-only-ips + - address + type: string + replicas: + description: Replicas is the number of replicas for the Control Plane. + format: int32 + type: integer + rolloutStrategy: + default: + rollingUpdate: + maxSurge: 1 + type: RollingUpdate + description: The RolloutStrategy to use to replace control plane machines + with new ones. + properties: + rollingUpdate: + description: Rolling update config params. Present only if RolloutStrategyType + = RollingUpdate. + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of control planes that can be scheduled above or under the + desired number of control planes. + Value can be an absolute number 1 or 0. + Defaults to 1. + Example: when this is set to 1, the control plane can be scaled + up immediately when the rolling update starts. + x-kubernetes-int-or-string: true + type: object + type: + description: |- + Type of rollout. Currently the only supported strategy is "RollingUpdate". + Default is RollingUpdate. + type: string + type: object + serverConfig: + description: ServerConfig specifies configuration for the agent nodes. + properties: + advertiseAddress: + description: 'AdvertiseAddress IP address that apiserver uses + to advertise to members of the cluster (default: node-external-ip/node-ip).' + type: string + auditPolicySecret: + description: AuditPolicySecret path to the file that defines the + audit policy configuration. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + bindAddress: + description: 'BindAddress describes the rke2 bind address (default: + 0.0.0.0).' + type: string + cloudControllerManager: + description: CloudControllerManager defines optional custom configuration + of the Cloud Controller Manager. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + cloudProviderConfigMap: + description: |- + CloudProviderConfigMap is a reference to a ConfigMap containing Cloud provider configuration. + The config map must contain a key named cloud-config. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + cloudProviderName: + description: CloudProviderName cloud provider name. + type: string + clusterDNS: + description: 'ClusterDNS is the cluster IP for CoreDNS service. + Should be in your service-cidr range (default: 10.43.0.10).' + type: string + clusterDomain: + description: 'ClusterDomain is the cluster domain name (default: + "cluster.local").' + type: string + cni: + description: |- + CNI describes the CNI Plugins to deploy, one of none, calico, canal, cilium; + optionally with multus as the first value to enable the multus meta-plugin (default: canal). + enum: + - none + - calico + - canal + - cilium + type: string + cniMultusEnable: + description: |- + CNIMultusEnable enables multus as the first CNI plugin (default: false). + This option will automatically make Multus a primary CNI, and the value, if specified in the CNI field, as a secondary CNI plugin. + type: boolean + disableComponents: + description: DisableComponents lists Kubernetes components and + RKE2 plugin components that will be disabled. + properties: + kubernetesComponents: + description: KubernetesComponents is a list of Kubernetes + components to disable. + items: + description: 'DisabledKubernetesComponent is an enum field + that can take one of the following values: scheduler, + kubeProxy or cloudController.' + enum: + - scheduler + - kubeProxy + - cloudController + type: string + type: array + pluginComponents: + description: PluginComponents is a list of PluginComponents + to disable. + items: + description: DisabledPluginComponent selects a plugin Components + to be disabled. + enum: + - rke2-coredns + - rke2-ingress-nginx + - rke2-metrics-server + type: string + type: array + type: object + etcd: + description: Etcd defines optional custom configuration of ETCD. + properties: + backupConfig: + description: 'BackupConfig defines how RKE2 will snapshot + ETCD: target storage, schedule, etc.' + properties: + directory: + description: Directory to save db snapshots. + type: string + disableAutomaticSnapshots: + description: |- + DisableAutomaticSnapshots defines the policy for ETCD snapshots. + true means automatic snapshots will be scheduled, false means automatic snapshots will not be scheduled. + type: boolean + retention: + description: 'Retention Number of snapshots to retain + Default: 5 (default: 5).' + type: string + s3: + description: S3 Enable backup to an S3-compatible Object + Store. + properties: + bucket: + description: Bucket S3 bucket name. + type: string + endpoint: + description: 'Endpoint S3 endpoint url (default: "s3.amazonaws.com").' + type: string + endpointCAsecret: + description: |- + EndpointCA references the Secret that contains a custom CA that should be trusted to connect to S3 endpoint. + The secret must contain a key named "ca.pem" that contains the CA certificate. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + enforceSslVerify: + description: EnforceSSLVerify may be set to false + to skip verifying the registry's certificate, default + is true. + type: boolean + folder: + description: Folder S3 folder. + type: string + region: + description: 'Region S3 region / bucket location (optional) + (default: "us-east-1").' + type: string + s3CredentialSecret: + description: |- + S3CredentialSecret is a reference to a Secret containing the Access Key and Secret Key necessary to access the target S3 Bucket. + The Secret must contain the following keys: "aws_access_key_id" and "aws_secret_access_key". + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + required: + - endpoint + - s3CredentialSecret + type: object + scheduleCron: + description: 'ScheduleCron Snapshot interval time in cron + spec. eg. every 5 hours ''* */5 * * *'' (default: "0 + */12 * * *").' + type: string + snapshotName: + description: 'SnapshotName Set the base name of etcd snapshots. + Default: etcd-snapshot- (default: "etcd-snapshot").' + type: string + type: object + customConfig: + description: CustomConfig defines the custom settings for + ETCD. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component + command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables + to pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to + be added for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references + a container image to override the default one for the + Kubernetes Component + type: string + type: object + exposeMetrics: + description: |- + ExposeEtcdMetrics defines the policy for ETCD Metrics exposure. + if value is true, ETCD metrics will be exposed + if value is false, ETCD metrics will NOT be exposed + type: boolean + type: object + kubeAPIServer: + description: KubeAPIServer defines optional custom configuration + of the Kube API Server. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + kubeControllerManager: + description: KubeControllerManager defines optional custom configuration + of the Kube Controller Manager. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + kubeScheduler: + description: KubeScheduler defines optional custom configuration + of the Kube Scheduler. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + pauseImage: + description: PauseImage Override image to use for pause. + type: string + serviceNodePortRange: + description: 'ServiceNodePortRange is the port range to reserve + for services with NodePort visibility (default: "30000-32767").' + type: string + tlsSan: + description: TLSSan Add additional hostname or IP as a Subject + Alternative Name in the TLS cert. + items: + type: string + type: array + type: object + required: + - infrastructureRef + type: object + status: + description: RKE2ControlPlaneStatus defines the observed state of RKE2ControlPlane. + properties: + availableServerIPs: + description: AvailableServerIPs is a list of the Control Plane IP + adds that can be used to register further nodes. + items: + type: string + type: array + conditions: + description: Conditions defines current service state of the RKE2Config. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + dataSecretName: + description: DataSecretName is the name of the secret that stores + the bootstrap data script. + type: string + failureMessage: + description: FailureMessage will be set on non-retryable errors. + type: string + failureReason: + description: FailureReason will be set on non-retryable errors. + type: string + initialized: + description: Initialized indicates the target cluster has completed + initialization. + type: boolean + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + ready: + description: Ready indicates the BootstrapData field is ready to be + consumed. + type: boolean + readyReplicas: + description: ReadyReplicas is the number of replicas current attached + to this ControlPlane Resource and that have Ready Status. + format: int32 + type: integer + replicas: + description: Replicas is the number of replicas current attached to + this ControlPlane Resource. + format: int32 + type: integer + unavailableReplicas: + description: UnavailableReplicas is the number of replicas current + attached to this ControlPlane Resource and that are up-to-date with + Control Plane config. + format: int32 + type: integer + updatedReplicas: + description: UpdatedReplicas is the number of replicas current attached + to this ControlPlane Resource and that are up-to-date with Control + Plane config. + format: int32 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + description: RKE2ControlPlane is the Schema for the rke2controlplanes API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: RKE2ControlPlaneSpec defines the desired state of RKE2ControlPlane. + properties: + agentConfig: + description: AgentConfig specifies configuration for the agent nodes. + properties: + additionalUserData: + description: |- + AdditionalUserData is a field that allows users to specify additional cloud-init or ignition configuration to be included in the + generated cloud-init/ignition script. + properties: + config: + description: |- + In case of using ignition, the data format is documented here: https://kinvolk.io/docs/flatcar-container-linux/latest/provisioning/cl-config/ + NOTE: All fields of the UserData that are managed by the RKE2Config controller will be ignored, this include "write_files", "runcmd", "ntp". + type: string + data: + additionalProperties: + type: string + description: |- + Data allows to pass arbitrary set of key/value pairs consistent with + https://cloudinit.readthedocs.io/en/latest/reference/modules.html + to extend existing cloud-init configuration + type: object + strict: + description: Strict controls if Config should be strictly + parsed. If so, warnings are treated as errors. + type: boolean + type: object + x-kubernetes-validations: + - message: Only config or data could be populated at once + rule: '!has(self.data) || !has(self.config)' + airGapped: + description: |- + AirGapped is a boolean value to define if the bootstrapping should be air-gapped, + basically supposing that online container registries and RKE2 install scripts are not reachable. + type: boolean + airGappedChecksum: + description: |- + AirGappedChecksum is a string value with a sha256sum checksum to compare with checksum + of existing sha256sum-.txt file for packages already available on the machine + before performing air-gapped installation. + type: string + cisProfile: + description: CISProfile activates CIS compliance of RKE2 for a + certain profile + enum: + - cis + - cis-1.23 + - cis-1.5 + - cis-1.6 + type: string + containerRuntimeEndpoint: + description: ContainerRuntimeEndpoint Disable embedded containerd + and use alternative CRI implementation. + type: string + dataDir: + description: DataDir Folder to hold state. + type: string + enableContainerdSElinux: + description: |- + EnableContainerdSElinux defines the policy for enabling SELinux for Containerd + if value is true, Containerd will run with selinux-enabled=true flag + if value is false, Containerd will run without the above flag + type: boolean + format: + description: Format specifies the output format of the bootstrap + data. Defaults to cloud-config. + enum: + - cloud-config + - ignition + type: string + imageCredentialProviderConfigMap: + description: |- + ImageCredentialProviderConfigMap is a reference to the ConfigMap that contains credential provider plugin config + The config map should contain a key "credential-config.yaml" with YAML file content and + a key "credential-provider-binaries" with the a path to the binaries for the credential provider. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + kubeProxy: + description: KubeProxyArgs Customized flag for kube-proxy process. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + kubelet: + description: KubeletArgs Customized flag for kubelet process. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + kubeletPath: + description: KubeletPath Override kubelet binary path. + type: string + loadBalancerPort: + description: |- + LoadBalancerPort local port for supervisor client load-balancer. If the supervisor and apiserver are + not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer (default: 6444). + type: integer + nodeAnnotations: + additionalProperties: + type: string + description: |- + NodeAnnotations are annotations that are created on nodes post bootstrap phase. + Unfortunately it is not possible to apply annotations via kubelet + using current bootstrap configurations. + Issue: https://github.com/kubernetes/kubernetes/issues/108046 + type: object + nodeLabels: + description: NodeLabels Registering and starting kubelet with + set of labels. + items: + type: string + type: array + nodeName: + description: NodeNamePrefix Prefix to the Node Name that CAPI + will generate. + type: string + nodeTaints: + description: NodeTaints Registering kubelet with set of taints. + items: + type: string + type: array + ntp: + description: NTP specifies NTP configuration + properties: + enabled: + description: Enabled specifies whether NTP should be enabled + type: boolean + servers: + description: Servers specifies which NTP servers to use + items: + type: string + type: array + type: object + protectKernelDefaults: + description: |- + ProtectKernelDefaults defines Kernel tuning behavior. If true, error if kernel tunables are different than kubelet defaults. + if false, kernel tunable can be different from kubelet defaults + type: boolean + resolvConf: + description: ResolvConf is a reference to a ConfigMap containing + resolv.conf content for the node. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + runtimeImage: + description: RuntimeImage override image to use for runtime binaries + (containerd, kubectl, crictl, etc). + type: string + snapshotter: + description: 'Snapshotter override default containerd snapshotter + (default: "overlayfs").' + type: string + systemDefaultRegistry: + description: SystemDefaultRegistry Private registry to be used + for all system images. + type: string + type: object + files: + description: Files specifies extra files to be passed to user_data + upon creation. + items: + description: File defines the input for generating write_files in + cloud-init. + properties: + content: + description: Content is the actual content of the file. + type: string + contentFrom: + description: ContentFrom is a referenced source of content to + populate the file. + properties: + secret: + description: SecretFileSource represents a secret that should + populate this file. + properties: + key: + description: Key is the key in the secret's data map + for this value. + type: string + name: + description: Name of the secret in the RKE2BootstrapConfig's + namespace to use. + type: string + required: + - key + - name + type: object + required: + - secret + type: object + encoding: + description: Encoding specifies the encoding of the file contents. + enum: + - base64 + - gzip + - gzip+base64 + type: string + owner: + description: Owner specifies the ownership of the file, e.g. + "root:root". + type: string + path: + description: Path specifies the full path on disk where to store + the file. + type: string + permissions: + description: Permissions specifies the permissions to assign + to the file, e.g. "0640". + type: string + required: + - path + type: object + type: array + infrastructureRef: + description: |- + InfrastructureRef is a required reference to a custom resource + offered by an infrastructure provider. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + machineTemplate: + description: |- + MachineTemplate contains information about how machines + should be shaped when creating or updating a control plane. + properties: + infrastructureRef: + description: |- + InfrastructureRef is a required reference to a custom resource + offered by an infrastructure provider. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: http://kubernetes.io/docs/user-guide/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: http://kubernetes.io/docs/user-guide/labels + type: object + type: object + nodeDrainTimeout: + description: |- + NodeDrainTimeout is the total amount of time that the controller will spend on draining a controlplane node + The default value is 0, meaning that the node can be drained without any time limitations. + NOTE: NodeDrainTimeout is different from `kubectl drain --timeout` + type: string + required: + - infrastructureRef + type: object + manifestsConfigMapReference: + description: |- + ManifestsConfigMapReference references a ConfigMap which contains Kubernetes manifests to be deployed automatically on the cluster + Each data entry in the ConfigMap will be will be copied to a folder on the control plane nodes that RKE2 scans and uses to deploy manifests. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + nodeDrainTimeout: + description: |- + NodeDrainTimeout is the total amount of time that the controller will spend on draining a controlplane node + The default value is 0, meaning that the node can be drained without any time limitations. + NOTE: NodeDrainTimeout is different from `kubectl drain --timeout` + type: string + postRKE2Commands: + description: PostRKE2Commands specifies extra commands to run after + rke2 setup runs. + items: + type: string + type: array + preRKE2Commands: + description: PreRKE2Commands specifies extra commands to run before + rke2 setup runs. + items: + type: string + type: array + privateRegistriesConfig: + description: PrivateRegistriesConfig defines the containerd configuration + for private registries and local registry mirrors. + properties: + configs: + additionalProperties: + description: RegistryConfig contains configuration used to communicate + with the registry. + properties: + authSecret: + description: |- + Auth is a reference to a Secret containing information to authenticate to the registry. + The Secret must provite a username and a password data entry. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + tls: + description: |- + TLS is a pair of CA/Cert/Key which then are used when creating the transport + that communicates with the registry. + properties: + insecureSkipVerify: + description: InsecureSkipVerify may be set to false + to skip verifying the registry's certificate, default + is true. + type: boolean + tlsConfigSecret: + description: |- + TLSConfigSecret is a reference to a secret of type `kubernetes.io/tls` thich has up to 3 entries: tls.crt, tls.key and ca.crt + which describe the TLS configuration necessary to connect to the registry. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: object + type: object + description: |- + Configs are configs for each registry. + The key is the FDQN or IP of the registry. + type: object + mirrors: + additionalProperties: + description: Mirror contains the config related to the registry + mirror. + properties: + endpoint: + description: |- + Endpoints are endpoints for a namespace. CRI plugin will try the endpoints + one by one until a working one is found. The endpoint must be a valid url + with host specified. + The scheme, host and path from the endpoint URL will be used. + items: + type: string + type: array + rewrite: + additionalProperties: + type: string + description: |- + Rewrites are repository rewrite rules for a namespace. When fetching image resources + from an endpoint and a key matches the repository via regular expression matching + it will be replaced with the corresponding value from the map in the resource request. + type: object + type: object + description: Mirrors are namespace to mirror mapping for all namespaces. + type: object + type: object + registrationAddress: + description: |- + RegistrationAddress is an explicit address to use when registering a node. This is required if + the registration type is "address". Its for scenarios where a load-balancer or VIP is used. + type: string + registrationMethod: + description: RegistrationMethod is the method to use for registering + nodes into the RKE2 cluster. + enum: + - internal-first + - internal-only-ips + - external-only-ips + - address + - control-plane-endpoint + - "" + type: string + replicas: + description: Replicas is the number of replicas for the Control Plane. + format: int32 + type: integer + rolloutStrategy: + description: The RolloutStrategy to use to replace control plane machines + with new ones. + properties: + rollingUpdate: + description: Rolling update config params. Present only if RolloutStrategyType + = RollingUpdate. + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of control planes that can be scheduled above or under the + desired number of control planes. + Value can be an absolute number 1 or 0. + Defaults to 1. + Example: when this is set to 1, the control plane can be scaled + up immediately when the rolling update starts. + x-kubernetes-int-or-string: true + type: object + type: + description: |- + Type of rollout. Currently the only supported strategy is "RollingUpdate". + Default is RollingUpdate. + type: string + type: object + serverConfig: + description: ServerConfig specifies configuration for the agent nodes. + properties: + advertiseAddress: + description: 'AdvertiseAddress IP address that apiserver uses + to advertise to members of the cluster (default: node-external-ip/node-ip).' + type: string + auditPolicySecret: + description: AuditPolicySecret path to the file that defines the + audit policy configuration. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + bindAddress: + description: 'BindAddress describes the rke2 bind address (default: + 0.0.0.0).' + type: string + cloudControllerManager: + description: CloudControllerManager defines optional custom configuration + of the Cloud Controller Manager. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + cloudProviderConfigMap: + description: |- + CloudProviderConfigMap is a reference to a ConfigMap containing Cloud provider configuration. + The config map must contain a key named cloud-config. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + cloudProviderName: + description: CloudProviderName cloud provider name. + type: string + clusterDNS: + description: 'ClusterDNS is the cluster IP for CoreDNS service. + Should be in your service-cidr range (default: 10.43.0.10).' + type: string + clusterDomain: + description: 'ClusterDomain is the cluster domain name (default: + "cluster.local").' + type: string + cni: + description: |- + CNI describes the CNI Plugins to deploy, one of none, calico, canal, cilium; + optionally with multus as the first value to enable the multus meta-plugin (default: canal). + enum: + - none + - calico + - canal + - cilium + type: string + cniMultusEnable: + description: |- + CNIMultusEnable enables multus as the first CNI plugin (default: false). + This option will automatically make Multus a primary CNI, and the value, if specified in the CNI field, as a secondary CNI plugin. + type: boolean + disableComponents: + description: DisableComponents lists Kubernetes components and + RKE2 plugin components that will be disabled. + properties: + kubernetesComponents: + description: KubernetesComponents is a list of Kubernetes + components to disable. + items: + description: 'DisabledKubernetesComponent is an enum field + that can take one of the following values: scheduler, + kubeProxy or cloudController.' + enum: + - scheduler + - kubeProxy + - cloudController + type: string + type: array + pluginComponents: + description: PluginComponents is a list of PluginComponents + to disable. + items: + description: DisabledPluginComponent selects a plugin Components + to be disabled. + enum: + - rke2-coredns + - rke2-ingress-nginx + - rke2-metrics-server + type: string + type: array + type: object + etcd: + description: Etcd defines optional custom configuration of ETCD. + properties: + backupConfig: + description: 'BackupConfig defines how RKE2 will snapshot + ETCD: target storage, schedule, etc.' + properties: + directory: + description: Directory to save db snapshots. + type: string + disableAutomaticSnapshots: + description: |- + DisableAutomaticSnapshots defines the policy for ETCD snapshots. + true means automatic snapshots will be scheduled, false means automatic snapshots will not be scheduled. + type: boolean + retention: + description: 'Retention Number of snapshots to retain + Default: 5 (default: 5).' + type: string + s3: + description: S3 Enable backup to an S3-compatible Object + Store. + properties: + bucket: + description: Bucket S3 bucket name. + type: string + endpoint: + description: 'Endpoint S3 endpoint url (default: "s3.amazonaws.com").' + type: string + endpointCAsecret: + description: |- + EndpointCA references the Secret that contains a custom CA that should be trusted to connect to S3 endpoint. + The secret must contain a key named "ca.pem" that contains the CA certificate. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + enforceSslVerify: + description: EnforceSSLVerify may be set to false + to skip verifying the registry's certificate, default + is true. + type: boolean + folder: + description: Folder S3 folder. + type: string + region: + description: 'Region S3 region / bucket location (optional) + (default: "us-east-1").' + type: string + s3CredentialSecret: + description: |- + S3CredentialSecret is a reference to a Secret containing the Access Key and Secret Key necessary to access the target S3 Bucket. + The Secret must contain the following keys: "aws_access_key_id" and "aws_secret_access_key". + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + required: + - endpoint + - s3CredentialSecret + type: object + scheduleCron: + description: 'ScheduleCron Snapshot interval time in cron + spec. eg. every 5 hours ''* */5 * * *'' (default: "0 + */12 * * *").' + type: string + snapshotName: + description: 'SnapshotName Set the base name of etcd snapshots. + Default: etcd-snapshot- (default: "etcd-snapshot").' + type: string + type: object + customConfig: + description: CustomConfig defines the custom settings for + ETCD. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component + command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables + to pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to + be added for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references + a container image to override the default one for the + Kubernetes Component + type: string + type: object + exposeMetrics: + description: |- + ExposeEtcdMetrics defines the policy for ETCD Metrics exposure. + if value is true, ETCD metrics will be exposed + if value is false, ETCD metrics will NOT be exposed + type: boolean + type: object + kubeAPIServer: + description: KubeAPIServer defines optional custom configuration + of the Kube API Server. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + kubeControllerManager: + description: KubeControllerManager defines optional custom configuration + of the Kube Controller Manager. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + kubeScheduler: + description: KubeScheduler defines optional custom configuration + of the Kube Scheduler. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line arguments + (format: flag=value) to pass to a Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables to + pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts to be added + for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references a container + image to override the default one for the Kubernetes Component + type: string + type: object + pauseImage: + description: PauseImage Override image to use for pause. + type: string + serviceNodePortRange: + description: 'ServiceNodePortRange is the port range to reserve + for services with NodePort visibility (default: "30000-32767").' + type: string + tlsSan: + description: TLSSan Add additional hostname or IP as a Subject + Alternative Name in the TLS cert. + items: + type: string + type: array + type: object + version: + description: |- + Version defines the desired Kubernetes version. + This field takes precedence over RKE2ConfigSpec.AgentConfig.Version (which is deprecated). + pattern: (v\d\.\d{2}\.\d+\+rke2r\d)|^$ + type: string + required: + - infrastructureRef + - rolloutStrategy + type: object + status: + description: RKE2ControlPlaneStatus defines the observed state of RKE2ControlPlane. + properties: + availableServerIPs: + description: AvailableServerIPs is a list of the Control Plane IP + adds that can be used to register further nodes. + items: + type: string + type: array + conditions: + description: Conditions defines current service state of the RKE2Config. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + dataSecretName: + description: DataSecretName is the name of the secret that stores + the bootstrap data script. + type: string + failureMessage: + description: FailureMessage will be set on non-retryable errors. + type: string + failureReason: + description: FailureReason will be set on non-retryable errors. + type: string + initialized: + description: Initialized indicates the target cluster has completed + initialization. + type: boolean + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + ready: + description: Ready indicates the BootstrapData field is ready to be + consumed. + type: boolean + readyReplicas: + description: ReadyReplicas is the number of replicas current attached + to this ControlPlane Resource and that have Ready Status. + format: int32 + type: integer + replicas: + description: Replicas is the number of replicas current attached to + this ControlPlane Resource. + format: int32 + type: integer + unavailableReplicas: + description: UnavailableReplicas is the number of replicas current + attached to this ControlPlane Resource and that are up-to-date with + Control Plane config. + format: int32 + type: integer + updatedReplicas: + description: UpdatedReplicas is the number of replicas current attached + to this ControlPlane Resource and that are up-to-date with Control + Plane config. + format: int32 + type: integer + version: + description: |- + Version represents the minimum Kubernetes version for the control plane machines + in the cluster. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + cert-manager.io/inject-ca-from: rke2-control-plane-system/rke2-control-plane-serving-cert + controller-gen.kubebuilder.io/version: v0.14.0 + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + cluster.x-k8s.io/v1beta1: v1alpha1_v1beta1 + name: rke2controlplanetemplates.controlplane.cluster.x-k8s.io + spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: rke2-control-plane-webhook-service + namespace: rke2-control-plane-system + path: /convert + conversionReviewVersions: + - v1 + - v1beta1 + group: controlplane.cluster.x-k8s.io + names: + categories: + - cluster-api + kind: RKE2ControlPlaneTemplate + listKind: RKE2ControlPlaneTemplateList + plural: rke2controlplanetemplates + shortNames: + - rke2ct + singular: rke2controlplanetemplate + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: RKE2ControlPlaneTemplate is the Schema for the rke2controlplanetemplates + API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: RKE2ControlPlaneTemplateSpec defines the desired state of + RKE2ControlPlaneTemplate. + type: object + status: + description: RKE2ControlPlaneTemplateStatus defines the observed state + of RKE2ControlPlaneTemplate. + type: object + type: object + served: true + storage: false + subresources: + status: {} + - name: v1beta1 + schema: + openAPIV3Schema: + description: RKE2ControlPlaneTemplate is the Schema for the rke2controlplanetemplates + API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec is the control plane specification for the template + resource. + properties: + template: + description: RKE2ControlPlaneTemplateResource contains spec for RKE2ControlPlaneTemplate. + properties: + spec: + description: Spec is the specification of the desired behavior + of the control plane. + properties: + agentConfig: + description: AgentConfig specifies configuration for the agent + nodes. + properties: + additionalUserData: + description: |- + AdditionalUserData is a field that allows users to specify additional cloud-init or ignition configuration to be included in the + generated cloud-init/ignition script. + properties: + config: + description: |- + In case of using ignition, the data format is documented here: https://kinvolk.io/docs/flatcar-container-linux/latest/provisioning/cl-config/ + NOTE: All fields of the UserData that are managed by the RKE2Config controller will be ignored, this include "write_files", "runcmd", "ntp". + type: string + data: + additionalProperties: + type: string + description: |- + Data allows to pass arbitrary set of key/value pairs consistent with + https://cloudinit.readthedocs.io/en/latest/reference/modules.html + to extend existing cloud-init configuration + type: object + strict: + description: Strict controls if Config should be strictly + parsed. If so, warnings are treated as errors. + type: boolean + type: object + x-kubernetes-validations: + - message: Only config or data could be populated at once + rule: '!has(self.data) || !has(self.config)' + airGapped: + description: |- + AirGapped is a boolean value to define if the bootstrapping should be air-gapped, + basically supposing that online container registries and RKE2 install scripts are not reachable. + type: boolean + airGappedChecksum: + description: |- + AirGappedChecksum is a string value with a sha256sum checksum to compare with checksum + of existing sha256sum-.txt file for packages already available on the machine + before performing air-gapped installation. + type: string + cisProfile: + description: CISProfile activates CIS compliance of RKE2 + for a certain profile + enum: + - cis + - cis-1.23 + - cis-1.5 + - cis-1.6 + type: string + containerRuntimeEndpoint: + description: ContainerRuntimeEndpoint Disable embedded + containerd and use alternative CRI implementation. + type: string + dataDir: + description: DataDir Folder to hold state. + type: string + enableContainerdSElinux: + description: |- + EnableContainerdSElinux defines the policy for enabling SELinux for Containerd + if value is true, Containerd will run with selinux-enabled=true flag + if value is false, Containerd will run without the above flag + type: boolean + format: + description: Format specifies the output format of the + bootstrap data. Defaults to cloud-config. + enum: + - cloud-config + - ignition + type: string + imageCredentialProviderConfigMap: + description: |- + ImageCredentialProviderConfigMap is a reference to the ConfigMap that contains credential provider plugin config + The config map should contain a key "credential-config.yaml" with YAML file content and + a key "credential-provider-binaries" with the a path to the binaries for the credential provider. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + kubeProxy: + description: KubeProxyArgs Customized flag for kube-proxy + process. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line + arguments (format: flag=value) to pass to a Kubernetes + Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables + to pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts + to be added for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references + a container image to override the default one for + the Kubernetes Component + type: string + type: object + kubelet: + description: KubeletArgs Customized flag for kubelet process. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line + arguments (format: flag=value) to pass to a Kubernetes + Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables + to pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts + to be added for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references + a container image to override the default one for + the Kubernetes Component + type: string + type: object + kubeletPath: + description: KubeletPath Override kubelet binary path. + type: string + loadBalancerPort: + description: |- + LoadBalancerPort local port for supervisor client load-balancer. If the supervisor and apiserver are + not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer (default: 6444). + type: integer + nodeAnnotations: + additionalProperties: + type: string + description: |- + NodeAnnotations are annotations that are created on nodes post bootstrap phase. + Unfortunately it is not possible to apply annotations via kubelet + using current bootstrap configurations. + Issue: https://github.com/kubernetes/kubernetes/issues/108046 + type: object + nodeLabels: + description: NodeLabels Registering and starting kubelet + with set of labels. + items: + type: string + type: array + nodeName: + description: NodeNamePrefix Prefix to the Node Name that + CAPI will generate. + type: string + nodeTaints: + description: NodeTaints Registering kubelet with set of + taints. + items: + type: string + type: array + ntp: + description: NTP specifies NTP configuration + properties: + enabled: + description: Enabled specifies whether NTP should + be enabled + type: boolean + servers: + description: Servers specifies which NTP servers to + use + items: + type: string + type: array + type: object + protectKernelDefaults: + description: |- + ProtectKernelDefaults defines Kernel tuning behavior. If true, error if kernel tunables are different than kubelet defaults. + if false, kernel tunable can be different from kubelet defaults + type: boolean + resolvConf: + description: ResolvConf is a reference to a ConfigMap + containing resolv.conf content for the node. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + runtimeImage: + description: RuntimeImage override image to use for runtime + binaries (containerd, kubectl, crictl, etc). + type: string + snapshotter: + description: 'Snapshotter override default containerd + snapshotter (default: "overlayfs").' + type: string + systemDefaultRegistry: + description: SystemDefaultRegistry Private registry to + be used for all system images. + type: string + type: object + files: + description: Files specifies extra files to be passed to user_data + upon creation. + items: + description: File defines the input for generating write_files + in cloud-init. + properties: + content: + description: Content is the actual content of the file. + type: string + contentFrom: + description: ContentFrom is a referenced source of content + to populate the file. + properties: + secret: + description: SecretFileSource represents a secret + that should populate this file. + properties: + key: + description: Key is the key in the secret's + data map for this value. + type: string + name: + description: Name of the secret in the RKE2BootstrapConfig's + namespace to use. + type: string + required: + - key + - name + type: object + required: + - secret + type: object + encoding: + description: Encoding specifies the encoding of the + file contents. + enum: + - base64 + - gzip + - gzip+base64 + type: string + owner: + description: Owner specifies the ownership of the file, + e.g. "root:root". + type: string + path: + description: Path specifies the full path on disk where + to store the file. + type: string + permissions: + description: Permissions specifies the permissions to + assign to the file, e.g. "0640". + type: string + required: + - path + type: object + type: array + infrastructureRef: + description: |- + InfrastructureRef is a required reference to a custom resource + offered by an infrastructure provider. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + machineTemplate: + description: |- + MachineTemplate contains information about how machines + should be shaped when creating or updating a control plane. + properties: + infrastructureRef: + description: |- + InfrastructureRef is a required reference to a custom resource + offered by an infrastructure provider. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: http://kubernetes.io/docs/user-guide/annotations + type: object + labels: + additionalProperties: + type: string + description: |- + Map of string keys and values that can be used to organize and categorize + (scope and select) objects. May match selectors of replication controllers + and services. + More info: http://kubernetes.io/docs/user-guide/labels + type: object + type: object + nodeDrainTimeout: + description: |- + NodeDrainTimeout is the total amount of time that the controller will spend on draining a controlplane node + The default value is 0, meaning that the node can be drained without any time limitations. + NOTE: NodeDrainTimeout is different from `kubectl drain --timeout` + type: string + required: + - infrastructureRef + type: object + manifestsConfigMapReference: + description: |- + ManifestsConfigMapReference references a ConfigMap which contains Kubernetes manifests to be deployed automatically on the cluster + Each data entry in the ConfigMap will be will be copied to a folder on the control plane nodes that RKE2 scans and uses to deploy manifests. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + nodeDrainTimeout: + description: |- + NodeDrainTimeout is the total amount of time that the controller will spend on draining a controlplane node + The default value is 0, meaning that the node can be drained without any time limitations. + NOTE: NodeDrainTimeout is different from `kubectl drain --timeout` + type: string + postRKE2Commands: + description: PostRKE2Commands specifies extra commands to + run after rke2 setup runs. + items: + type: string + type: array + preRKE2Commands: + description: PreRKE2Commands specifies extra commands to run + before rke2 setup runs. + items: + type: string + type: array + privateRegistriesConfig: + description: PrivateRegistriesConfig defines the containerd + configuration for private registries and local registry + mirrors. + properties: + configs: + additionalProperties: + description: RegistryConfig contains configuration used + to communicate with the registry. + properties: + authSecret: + description: |- + Auth is a reference to a Secret containing information to authenticate to the registry. + The Secret must provite a username and a password data entry. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + tls: + description: |- + TLS is a pair of CA/Cert/Key which then are used when creating the transport + that communicates with the registry. + properties: + insecureSkipVerify: + description: InsecureSkipVerify may be set to + false to skip verifying the registry's certificate, + default is true. + type: boolean + tlsConfigSecret: + description: |- + TLSConfigSecret is a reference to a secret of type `kubernetes.io/tls` thich has up to 3 entries: tls.crt, tls.key and ca.crt + which describe the TLS configuration necessary to connect to the registry. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + type: object + type: object + description: |- + Configs are configs for each registry. + The key is the FDQN or IP of the registry. + type: object + mirrors: + additionalProperties: + description: Mirror contains the config related to the + registry mirror. + properties: + endpoint: + description: |- + Endpoints are endpoints for a namespace. CRI plugin will try the endpoints + one by one until a working one is found. The endpoint must be a valid url + with host specified. + The scheme, host and path from the endpoint URL will be used. + items: + type: string + type: array + rewrite: + additionalProperties: + type: string + description: |- + Rewrites are repository rewrite rules for a namespace. When fetching image resources + from an endpoint and a key matches the repository via regular expression matching + it will be replaced with the corresponding value from the map in the resource request. + type: object + type: object + description: Mirrors are namespace to mirror mapping for + all namespaces. + type: object + type: object + registrationAddress: + description: |- + RegistrationAddress is an explicit address to use when registering a node. This is required if + the registration type is "address". Its for scenarios where a load-balancer or VIP is used. + type: string + registrationMethod: + description: RegistrationMethod is the method to use for registering + nodes into the RKE2 cluster. + enum: + - internal-first + - internal-only-ips + - external-only-ips + - address + - control-plane-endpoint + - "" + type: string + replicas: + description: Replicas is the number of replicas for the Control + Plane. + format: int32 + type: integer + rolloutStrategy: + description: The RolloutStrategy to use to replace control + plane machines with new ones. + properties: + rollingUpdate: + description: Rolling update config params. Present only + if RolloutStrategyType = RollingUpdate. + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of control planes that can be scheduled above or under the + desired number of control planes. + Value can be an absolute number 1 or 0. + Defaults to 1. + Example: when this is set to 1, the control plane can be scaled + up immediately when the rolling update starts. + x-kubernetes-int-or-string: true + type: object + type: + description: |- + Type of rollout. Currently the only supported strategy is "RollingUpdate". + Default is RollingUpdate. + type: string + type: object + serverConfig: + description: ServerConfig specifies configuration for the + agent nodes. + properties: + advertiseAddress: + description: 'AdvertiseAddress IP address that apiserver + uses to advertise to members of the cluster (default: + node-external-ip/node-ip).' + type: string + auditPolicySecret: + description: AuditPolicySecret path to the file that defines + the audit policy configuration. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + bindAddress: + description: 'BindAddress describes the rke2 bind address + (default: 0.0.0.0).' + type: string + cloudControllerManager: + description: CloudControllerManager defines optional custom + configuration of the Cloud Controller Manager. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line + arguments (format: flag=value) to pass to a Kubernetes + Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables + to pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts + to be added for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references + a container image to override the default one for + the Kubernetes Component + type: string + type: object + cloudProviderConfigMap: + description: |- + CloudProviderConfigMap is a reference to a ConfigMap containing Cloud provider configuration. + The config map must contain a key named cloud-config. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + cloudProviderName: + description: CloudProviderName cloud provider name. + type: string + clusterDNS: + description: 'ClusterDNS is the cluster IP for CoreDNS + service. Should be in your service-cidr range (default: + 10.43.0.10).' + type: string + clusterDomain: + description: 'ClusterDomain is the cluster domain name + (default: "cluster.local").' + type: string + cni: + description: |- + CNI describes the CNI Plugins to deploy, one of none, calico, canal, cilium; + optionally with multus as the first value to enable the multus meta-plugin (default: canal). + enum: + - none + - calico + - canal + - cilium + type: string + cniMultusEnable: + description: |- + CNIMultusEnable enables multus as the first CNI plugin (default: false). + This option will automatically make Multus a primary CNI, and the value, if specified in the CNI field, as a secondary CNI plugin. + type: boolean + disableComponents: + description: DisableComponents lists Kubernetes components + and RKE2 plugin components that will be disabled. + properties: + kubernetesComponents: + description: KubernetesComponents is a list of Kubernetes + components to disable. + items: + description: 'DisabledKubernetesComponent is an + enum field that can take one of the following + values: scheduler, kubeProxy or cloudController.' + enum: + - scheduler + - kubeProxy + - cloudController + type: string + type: array + pluginComponents: + description: PluginComponents is a list of PluginComponents + to disable. + items: + description: DisabledPluginComponent selects a plugin + Components to be disabled. + enum: + - rke2-coredns + - rke2-ingress-nginx + - rke2-metrics-server + type: string + type: array + type: object + etcd: + description: Etcd defines optional custom configuration + of ETCD. + properties: + backupConfig: + description: 'BackupConfig defines how RKE2 will snapshot + ETCD: target storage, schedule, etc.' + properties: + directory: + description: Directory to save db snapshots. + type: string + disableAutomaticSnapshots: + description: |- + DisableAutomaticSnapshots defines the policy for ETCD snapshots. + true means automatic snapshots will be scheduled, false means automatic snapshots will not be scheduled. + type: boolean + retention: + description: 'Retention Number of snapshots to + retain Default: 5 (default: 5).' + type: string + s3: + description: S3 Enable backup to an S3-compatible + Object Store. + properties: + bucket: + description: Bucket S3 bucket name. + type: string + endpoint: + description: 'Endpoint S3 endpoint url (default: + "s3.amazonaws.com").' + type: string + endpointCAsecret: + description: |- + EndpointCA references the Secret that contains a custom CA that should be trusted to connect to S3 endpoint. + The secret must contain a key named "ca.pem" that contains the CA certificate. + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + enforceSslVerify: + description: EnforceSSLVerify may be set to + false to skip verifying the registry's certificate, + default is true. + type: boolean + folder: + description: Folder S3 folder. + type: string + region: + description: 'Region S3 region / bucket location + (optional) (default: "us-east-1").' + type: string + s3CredentialSecret: + description: |- + S3CredentialSecret is a reference to a Secret containing the Access Key and Secret Key necessary to access the target S3 Bucket. + The Secret must contain the following keys: "aws_access_key_id" and "aws_secret_access_key". + properties: + apiVersion: + description: API version of the referent. + type: string + fieldPath: + description: |- + If referring to a piece of an object instead of an entire object, this string + should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2]. + For example, if the object reference is to a container within a pod, this would take on a value like: + "spec.containers{name}" (where "name" refers to the name of the container that triggered + the event) or if no container name is specified "spec.containers[2]" (container with + index 2 in this pod). This syntax is chosen only to have some well-defined way of + referencing a part of an object. + TODO: this design is not final and this field is subject to change in the future. + type: string + kind: + description: |- + Kind of the referent. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + namespace: + description: |- + Namespace of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/ + type: string + resourceVersion: + description: |- + Specific resourceVersion to which this reference is made, if any. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency + type: string + uid: + description: |- + UID of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids + type: string + type: object + x-kubernetes-map-type: atomic + required: + - endpoint + - s3CredentialSecret + type: object + scheduleCron: + description: 'ScheduleCron Snapshot interval time + in cron spec. eg. every 5 hours ''* */5 * * + *'' (default: "0 */12 * * *").' + type: string + snapshotName: + description: 'SnapshotName Set the base name of + etcd snapshots. Default: etcd-snapshot- + (default: "etcd-snapshot").' + type: string + type: object + customConfig: + description: CustomConfig defines the custom settings + for ETCD. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line + arguments (format: flag=value) to pass to a + Kubernetes Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment + variables to pass on to a Kubernetes Component + command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts + to be added for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references + a container image to override the default one + for the Kubernetes Component + type: string + type: object + exposeMetrics: + description: |- + ExposeEtcdMetrics defines the policy for ETCD Metrics exposure. + if value is true, ETCD metrics will be exposed + if value is false, ETCD metrics will NOT be exposed + type: boolean + type: object + kubeAPIServer: + description: KubeAPIServer defines optional custom configuration + of the Kube API Server. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line + arguments (format: flag=value) to pass to a Kubernetes + Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables + to pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts + to be added for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references + a container image to override the default one for + the Kubernetes Component + type: string + type: object + kubeControllerManager: + description: KubeControllerManager defines optional custom + configuration of the Kube Controller Manager. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line + arguments (format: flag=value) to pass to a Kubernetes + Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables + to pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts + to be added for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references + a container image to override the default one for + the Kubernetes Component + type: string + type: object + kubeScheduler: + description: KubeScheduler defines optional custom configuration + of the Kube Scheduler. + properties: + extraArgs: + description: 'ExtraArgs is a list of command line + arguments (format: flag=value) to pass to a Kubernetes + Component command.' + items: + type: string + type: array + extraEnv: + additionalProperties: + type: string + description: ExtraEnv is a map of environment variables + to pass on to a Kubernetes Component command. + type: object + extraMounts: + additionalProperties: + type: string + description: ExtraMounts is a map of volume mounts + to be added for the Kubernetes component StaticPod + type: object + overrideImage: + description: OverrideImage is a string that references + a container image to override the default one for + the Kubernetes Component + type: string + type: object + pauseImage: + description: PauseImage Override image to use for pause. + type: string + serviceNodePortRange: + description: 'ServiceNodePortRange is the port range to + reserve for services with NodePort visibility (default: + "30000-32767").' + type: string + tlsSan: + description: TLSSan Add additional hostname or IP as a + Subject Alternative Name in the TLS cert. + items: + type: string + type: array + type: object + version: + description: |- + Version defines the desired Kubernetes version. + This field takes precedence over RKE2ConfigSpec.AgentConfig.Version (which is deprecated). + pattern: (v\d\.\d{2}\.\d+\+rke2r\d)|^$ + type: string + required: + - infrastructureRef + - rolloutStrategy + type: object + required: + - spec + type: object + required: + - template + type: object + status: + description: Status is the current state of the control plane. + properties: + availableServerIPs: + description: AvailableServerIPs is a list of the Control Plane IP + adds that can be used to register further nodes. + items: + type: string + type: array + conditions: + description: Conditions defines current service state of the RKE2Config. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + dataSecretName: + description: DataSecretName is the name of the secret that stores + the bootstrap data script. + type: string + failureMessage: + description: FailureMessage will be set on non-retryable errors. + type: string + failureReason: + description: FailureReason will be set on non-retryable errors. + type: string + initialized: + description: Initialized indicates the target cluster has completed + initialization. + type: boolean + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + ready: + description: Ready indicates the BootstrapData field is ready to be + consumed. + type: boolean + readyReplicas: + description: ReadyReplicas is the number of replicas current attached + to this ControlPlane Resource and that have Ready Status. + format: int32 + type: integer + replicas: + description: Replicas is the number of replicas current attached to + this ControlPlane Resource. + format: int32 + type: integer + unavailableReplicas: + description: UnavailableReplicas is the number of replicas current + attached to this ControlPlane Resource and that are up-to-date with + Control Plane config. + format: int32 + type: integer + updatedReplicas: + description: UpdatedReplicas is the number of replicas current attached + to this ControlPlane Resource and that are up-to-date with Control + Plane config. + format: int32 + type: integer + version: + description: |- + Version represents the minimum Kubernetes version for the control plane machines + in the cluster. + type: string + type: object + type: object + served: true + storage: true + --- + apiVersion: v1 + kind: ServiceAccount + metadata: + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + name: rke2-control-plane-manager + namespace: rke2-control-plane-system + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: Role + metadata: + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + name: rke2-control-plane-leader-election-role + namespace: rke2-control-plane-system + rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + --- + aggregationRule: + clusterRoleSelectors: + - matchLabels: + rke2.controlplane.cluster.x-k8s.io/aggregate-to-manager: "true" + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + name: rke2-control-plane-aggregated-manager-role + rules: [] + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + rke2.controlplane.cluster.x-k8s.io/aggregate-to-manager: "true" + name: rke2-control-plane-manager-role + rules: + - apiGroups: + - "" + resources: + - configmaps + - events + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + - apiGroups: + - bootstrap.cluster.x-k8s.io + resources: + - rke2configs + verbs: + - create + - delete + - get + - list + - patch + - watch + - apiGroups: + - cluster.x-k8s.io + resources: + - clusters + - clusters/status + - machinepools + - machinepools/status + - machines + - machines/status + - machinesets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - controlplane.cluster.x-k8s.io + resources: + - rke2controlplanes + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - controlplane.cluster.x-k8s.io + resources: + - rke2controlplanes/finalizers + verbs: + - update + - apiGroups: + - controlplane.cluster.x-k8s.io + resources: + - rke2controlplanes/status + verbs: + - get + - patch + - update + - apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - '*' + verbs: + - create + - delete + - get + - list + - patch + - watch + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: RoleBinding + metadata: + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + name: rke2-control-plane-leader-election-rolebinding + namespace: rke2-control-plane-system + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: rke2-control-plane-leader-election-role + subjects: + - kind: ServiceAccount + name: rke2-control-plane-manager + namespace: rke2-control-plane-system + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + name: rke2-control-plane-manager-rolebinding + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: rke2-control-plane-aggregated-manager-role + subjects: + - kind: ServiceAccount + name: rke2-control-plane-manager + namespace: rke2-control-plane-system + --- + apiVersion: v1 + kind: Service + metadata: + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + name: rke2-control-plane-webhook-service + namespace: rke2-control-plane-system + spec: + ports: + - port: 443 + targetPort: webhook-server + selector: + cluster.x-k8s.io/provider: control-plane-rke2 + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + control-plane: controller-manager + name: rke2-control-plane-controller-manager + namespace: rke2-control-plane-system + spec: + replicas: 1 + selector: + matchLabels: + cluster.x-k8s.io/provider: control-plane-rke2 + control-plane: controller-manager + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: manager + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + control-plane: controller-manager + spec: + containers: + - args: + - --leader-elect + - --diagnostics-address=${CAPRKE2_DIAGNOSTICS_ADDRESS:=:8443} + - --insecure-diagnostics=${CAPRKE2_INSECURE_DIAGNOSTICS:=false} + command: + - /manager + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_UID + valueFrom: + fieldRef: + fieldPath: metadata.uid + image: ghcr.io/rancher/cluster-api-provider-rke2-controlplane:v0.7.0 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 9443 + name: webhook-server + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + - containerPort: 8443 + name: metrics + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 500m + memory: 256Mi + requests: + cpu: 10m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + privileged: false + runAsGroup: 65532 + runAsUser: 65532 + volumeMounts: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + serviceAccountName: rke2-control-plane-manager + terminationGracePeriodSeconds: 10 + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/master + - effect: NoSchedule + key: node-role.kubernetes.io/control-plane + volumes: + - name: cert + secret: + secretName: rke2-control-plane-webhook-service-cert + --- + apiVersion: cert-manager.io/v1 + kind: Certificate + metadata: + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + name: rke2-control-plane-serving-cert + namespace: rke2-control-plane-system + spec: + dnsNames: + - rke2-control-plane-webhook-service.rke2-control-plane-system.svc + - rke2-control-plane-webhook-service.rke2-control-plane-system.svc.cluster.local + issuerRef: + kind: Issuer + name: rke2-control-plane-selfsigned-issuer + secretName: rke2-control-plane-webhook-service-cert + subject: + organizations: + - Rancher by SUSE + --- + apiVersion: cert-manager.io/v1 + kind: Issuer + metadata: + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + name: rke2-control-plane-selfsigned-issuer + namespace: rke2-control-plane-system + spec: + selfSigned: {} + --- + apiVersion: admissionregistration.k8s.io/v1 + kind: MutatingWebhookConfiguration + metadata: + annotations: + cert-manager.io/inject-ca-from: rke2-control-plane-system/rke2-control-plane-serving-cert + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + name: rke2-control-plane-mutating-webhook-configuration + webhooks: + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: rke2-control-plane-webhook-service + namespace: rke2-control-plane-system + path: /mutate-controlplane-cluster-x-k8s-io-v1beta1-rke2controlplane + failurePolicy: Fail + name: mrke2controlplane.kb.io + rules: + - apiGroups: + - controlplane.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - rke2controlplanes + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: rke2-control-plane-webhook-service + namespace: rke2-control-plane-system + path: /mutate-controlplane-cluster-x-k8s-io-v1beta1-rke2controlplanetemplate + failurePolicy: Fail + name: mrke2controlplanetemplate.kb.io + rules: + - apiGroups: + - controlplane.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - rke2controlplanetemplates + sideEffects: None + --- + apiVersion: admissionregistration.k8s.io/v1 + kind: ValidatingWebhookConfiguration + metadata: + annotations: + cert-manager.io/inject-ca-from: rke2-control-plane-system/rke2-control-plane-serving-cert + labels: + cluster.x-k8s.io/provider: control-plane-rke2 + name: rke2-control-plane-validating-webhook-configuration + webhooks: + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: rke2-control-plane-webhook-service + namespace: rke2-control-plane-system + path: /validate-controlplane-cluster-x-k8s-io-v1beta1-rke2controlplane + failurePolicy: Fail + name: vrke2controlplane.kb.io + rules: + - apiGroups: + - controlplane.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - rke2controlplanes + sideEffects: None + - admissionReviewVersions: + - v1 + clientConfig: + service: + name: rke2-control-plane-webhook-service + namespace: rke2-control-plane-system + path: /validate-controlplane-cluster-x-k8s-io-v1beta1-rke2controlplanetemplate + failurePolicy: Fail + name: vrke2controlplanetemplate.kb.io + rules: + - apiGroups: + - controlplane.cluster.x-k8s.io + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - rke2controlplanetemplates + sideEffects: None + metadata: | + # maps release series of major.minor to cluster-api contract version + # the contract version may change between minor or major versions, but *not* + # between patch versions. + # + # update this file only when a new major or minor version is released + apiVersion: clusterctl.cluster.x-k8s.io/v1alpha3 + kind: Metadata + releaseSeries: + - major: 0 + minor: 1 + contract: v1beta1 + - major: 0 + minor: 2 + contract: v1beta1 + - major: 0 + minor: 3 + contract: v1beta1 + - major: 0 + minor: 4 + contract: v1beta1 + - major: 0 + minor: 5 + contract: v1beta1 + - major: 0 + minor: 6 + contract: v1beta1 + - major: 0 + minor: 7 + contract: v1beta1 +kind: ConfigMap +metadata: + creationTimestamp: null + name: v0.7.0 + namespace: rke2-control-plane-system + labels: + provider-components: rke2-control-plane diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/Chart.lock b/charts/rancher-turtles/0.3.1+up0.11.0/Chart.lock new file mode 100644 index 00000000..5be7ba64 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: cluster-api-operator + repository: https://kubernetes-sigs.github.io/cluster-api-operator + version: 0.12.0 +digest: sha256:c167c074ca89ef7a520ec18a5afd380b9edaee513810aa3ac0e0bda51db9c526 +generated: "2024-08-22T14:23:18.589443298Z" diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/Chart.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/Chart.yaml new file mode 100644 index 00000000..7385bc7b --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/Chart.yaml @@ -0,0 +1,30 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: Rancher Turtles - the Cluster API Extension + catalog.cattle.io/kube-version: '>= 1.23.0-0' + catalog.cattle.io/namespace: rancher-turtles-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux + catalog.cattle.io/rancher-version: '>= 2.9.0-1' + catalog.cattle.io/release-name: rancher-turtles + catalog.cattle.io/scope: management + catalog.cattle.io/type: cluster-tool +apiVersion: v2 +appVersion: 0.11.0 +dependencies: +- condition: cluster-api-operator.enabled + name: cluster-api-operator + repository: file://./charts/cluster-api-operator + version: 0.12.0 +description: Rancher Turtles is an extension to Rancher that brings full Cluster API + integration to Rancher. +home: https://github.com/rancher/turtles/ +icon: https://raw.githubusercontent.com/rancher/turtles/main/logos/capi.svg +keywords: +- rancher +- cluster-api +- capi +- provisioning +name: rancher-turtles +type: application +version: 0.3.1+up0.11.0 diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/README.md b/charts/rancher-turtles/0.3.1+up0.11.0/README.md new file mode 100644 index 00000000..5d7463e4 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/README.md @@ -0,0 +1,5 @@ +# Rancher Turtles Chart + +This chart installs the Rancher Turtles operator and optionally the Cluster API Operator using Helm. + +Checkout the [documentation](https://turtles.docs.rancher.com) for further information. diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/RELEASE_NOTES.md b/charts/rancher-turtles/0.3.1+up0.11.0/RELEASE_NOTES.md new file mode 100644 index 00000000..9ac04fe3 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/RELEASE_NOTES.md @@ -0,0 +1,6 @@ +## Changes since test/v0.11.0 +--- +## :chart_with_upwards_trend: Overview + + +_Thanks to all our contributors!_ 😊 diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/app-readme.md b/charts/rancher-turtles/0.3.1+up0.11.0/app-readme.md new file mode 100644 index 00000000..cfb4b629 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/app-readme.md @@ -0,0 +1,5 @@ +# Rancher Turtles - The Cluster API Extension for Rancher + +Rancher Turtles brings enhanced integration of Cluster API with Rancher. + +For more information, including a getting started guide, see the [official documentation](https://turtles.docs.rancher.com). diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/.helmignore b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/Chart.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/Chart.yaml new file mode 100644 index 00000000..0ab286cb --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/Chart.yaml @@ -0,0 +1,6 @@ +apiVersion: v2 +appVersion: 0.12.0 +description: Cluster API Operator +name: cluster-api-operator +type: application +version: 0.12.0 diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/_helpers.tpl b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/_helpers.tpl new file mode 100644 index 00000000..a4c8b733 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/_helpers.tpl @@ -0,0 +1,24 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "capi-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "capi-operator.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/addon.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/addon.yaml new file mode 100644 index 00000000..9095368c --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/addon.yaml @@ -0,0 +1,56 @@ +# Addon provider +{{- if .Values.addon }} +{{- $addons := split ";" .Values.addon }} +{{- $addonNamespace := "" }} +{{- $addonName := "" }} +{{- $addonVersion := "" }} +{{- range $addon := $addons }} +{{- $addonArgs := split ":" $addon }} +{{- $addonArgsLen := len $addonArgs }} +{{- if eq $addonArgsLen 3 }} + {{- $addonNamespace = $addonArgs._0 }} + {{- $addonName = $addonArgs._1 }} + {{- $addonVersion = $addonArgs._2 }} +{{- else if eq $addonArgsLen 2 }} + {{- $addonNamespace = print $addonArgs._0 "-addon-system" }} + {{- $addonName = $addonArgs._0 }} + {{- $addonVersion = $addonArgs._1 }} +{{- else if eq $addonArgsLen 1 }} + {{- $addonNamespace = print $addonArgs._0 "-addon-system" }} + {{- $addonName = $addonArgs._0 }} +{{- else }} + {{- fail "addon provider argument should have the following format helm:v1.0.0 or mynamespace:helm:v1.0.0" }} +{{- end }} +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "1" + "argocd.argoproj.io/sync-wave": "1" + name: {{ $addonNamespace }} +--- +apiVersion: operator.cluster.x-k8s.io/v1alpha2 +kind: AddonProvider +metadata: + name: {{ $addonName }} + namespace: {{ $addonNamespace }} + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "2" + "argocd.argoproj.io/sync-wave": "2" +{{- if or $addonVersion $.Values.secretName }} +spec: +{{- end}} +{{- if $addonVersion }} + version: {{ $addonVersion }} +{{- end }} +{{- if $.Values.secretName }} + secretName: {{ $.Values.secretName }} +{{- end }} +{{- if $.Values.secretNamespace }} + secretNamespace: {{ $.Values.secretNamespace }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/bootstrap.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/bootstrap.yaml new file mode 100644 index 00000000..a1634ee8 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/bootstrap.yaml @@ -0,0 +1,55 @@ +# Bootstrap provider +{{- if .Values.bootstrap }} +{{- $bootstraps := split ";" .Values.bootstrap }} +{{- $bootstrapNamespace := "" }} +{{- $bootstrapName := "" }} +{{- $bootstrapVersion := "" }} +{{- range $bootstrap := $bootstraps }} +{{- $bootstrapArgs := split ":" $bootstrap }} +{{- $bootstrapArgsLen := len $bootstrapArgs }} +{{- if eq $bootstrapArgsLen 3 }} + {{- $bootstrapNamespace = $bootstrapArgs._0 }} + {{- $bootstrapName = $bootstrapArgs._1 }} + {{- $bootstrapVersion = $bootstrapArgs._2 }} +{{- else if eq $bootstrapArgsLen 2 }} + {{- $bootstrapNamespace = print $bootstrapArgs._0 "-bootstrap-system" }} + {{- $bootstrapName = $bootstrapArgs._0 }} + {{- $bootstrapVersion = $bootstrapArgs._1 }} +{{- else if eq $bootstrapArgsLen 1 }} + {{- $bootstrapNamespace = print $bootstrapArgs._0 "-bootstrap-system" }} + {{- $bootstrapName = $bootstrapArgs._0 }} +{{- else }} + {{- fail "bootstrap provider argument should have the following format kubeadm:v1.0.0 or mynamespace:kubeadm:v1.0.0" }} +{{- end }} +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "1" + name: {{ $bootstrapNamespace }} +--- +apiVersion: operator.cluster.x-k8s.io/v1alpha2 +kind: BootstrapProvider +metadata: + name: {{ $bootstrapName }} + namespace: {{ $bootstrapNamespace }} + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "2" +{{- if or $bootstrapVersion $.Values.configSecret.name }} +spec: +{{- end}} +{{- if $bootstrapVersion }} + version: {{ $bootstrapVersion }} +{{- end }} +{{- if $.Values.configSecret.name }} + configSecret: + name: {{ $.Values.configSecret.name }} + {{- if $.Values.configSecret.namespace }} + namespace: {{ $.Values.configSecret.namespace }} + {{- end }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/control-plane.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/control-plane.yaml new file mode 100644 index 00000000..b7cec76d --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/control-plane.yaml @@ -0,0 +1,55 @@ +# Control plane provider +{{- if .Values.controlPlane }} +{{- $controlPlanes := split ";" .Values.controlPlane }} +{{- $controlPlaneNamespace := "" }} +{{- $controlPlaneName := "" }} +{{- $controlPlaneVersion := "" }} +{{- range $controlPlane := $controlPlanes }} +{{- $controlPlaneArgs := split ":" $controlPlane }} +{{- $controlPlaneArgsLen := len $controlPlaneArgs }} +{{- if eq $controlPlaneArgsLen 3 }} + {{- $controlPlaneNamespace = $controlPlaneArgs._0 }} + {{- $controlPlaneName = $controlPlaneArgs._1 }} + {{- $controlPlaneVersion = $controlPlaneArgs._2 }} +{{- else if eq $controlPlaneArgsLen 2 }} + {{- $controlPlaneNamespace = print $controlPlaneArgs._0 "-control-plane-system" }} + {{- $controlPlaneName = $controlPlaneArgs._0 }} + {{- $controlPlaneVersion = $controlPlaneArgs._1 }} +{{- else if eq $controlPlaneArgsLen 1 }} + {{- $controlPlaneNamespace = print $controlPlaneArgs._0 "-control-plane-system" }} + {{- $controlPlaneName = $controlPlaneArgs._0 }} +{{- else }} + {{- fail "controlplane provider argument should have the following format kubeadm:v1.0.0 or mynamespace:kubeadm:v1.0.0" }} +{{- end }} +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "1" + name: {{ $controlPlaneNamespace }} +--- +apiVersion: operator.cluster.x-k8s.io/v1alpha2 +kind: ControlPlaneProvider +metadata: + name: {{ $controlPlaneName }} + namespace: {{ $controlPlaneNamespace }} + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "2" +{{- if or $controlPlaneVersion $.Values.configSecret.name }} +spec: +{{- end}} +{{- if $controlPlaneVersion }} + version: {{ $controlPlaneVersion }} +{{- end }} +{{- if $.Values.configSecret.name }} + configSecret: + name: {{ $.Values.configSecret.name }} + {{- if $.Values.configSecret.namespace }} + namespace: {{ $.Values.configSecret.namespace }} + {{- end }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/core-conditions.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/core-conditions.yaml new file mode 100644 index 00000000..7bba5953 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/core-conditions.yaml @@ -0,0 +1,31 @@ +{{- if or .Values.addon .Values.bootstrap .Values.controlPlane .Values.infrastructure }} +# Deploy core components if not specified +{{- if not .Values.core }} +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "1" + name: capi-system +--- +apiVersion: operator.cluster.x-k8s.io/v1alpha2 +kind: CoreProvider +metadata: + name: cluster-api + namespace: capi-system + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "2" +{{- with .Values.configSecret }} +spec: + configSecret: + name: {{ .name }} + {{- if .namespace }} + namespace: {{ .namespace }} + {{- end }} +{{- end }} +{{- end }} +{{- end }} + diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/core.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/core.yaml new file mode 100644 index 00000000..013a2ef0 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/core.yaml @@ -0,0 +1,63 @@ +# Core provider +{{- if .Values.core }} +{{- $coreArgs := split ":" .Values.core }} +{{- $coreArgsLen := len $coreArgs }} +{{- $coreVersion := "" }} +{{- $coreNamespace := "" }} +{{- $coreName := "" }} +{{- $coreVersion := "" }} +{{- if eq $coreArgsLen 3 }} + {{- $coreNamespace = $coreArgs._0 }} + {{- $coreName = $coreArgs._1 }} + {{- $coreVersion = $coreArgs._2 }} +{{- else if eq $coreArgsLen 2 }} + {{- $coreNamespace = "capi-system" }} + {{- $coreName = $coreArgs._0 }} + {{- $coreVersion = $coreArgs._1 }} +{{- else if eq $coreArgsLen 1 }} + {{- $coreNamespace = "capi-system" }} + {{- $coreName = $coreArgs._0 }} +{{- else }} + {{- fail "core provider argument should have the following format cluster-api:v1.0.0 or mynamespace:cluster-api:v1.0.0" }} +{{- end }} +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "1" + name: {{ $coreNamespace }} +--- +apiVersion: operator.cluster.x-k8s.io/v1alpha2 +kind: CoreProvider +metadata: + name: {{ $coreName }} + namespace: {{ $coreNamespace }} + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "2" + "argocd.argoproj.io/sync-wave": "2" +{{- if or $coreVersion $.Values.configSecret.name }} +spec: +{{- end}} +{{- if $coreVersion }} + version: {{ $coreVersion }} +{{- end }} +{{- if $.Values.manager }} + manager: +{{- if and $.Values.manager.featureGates $.Values.manager.featureGates.core }} + featureGates: + {{- range $key, $value := $.Values.manager.featureGates.core }} + {{ $key }}: {{ $value }} + {{- end }} +{{- end }} +{{- end }} +{{- if $.Values.configSecret.name }} + configSecret: + name: {{ $.Values.configSecret.name }} + {{- if $.Values.configSecret.namespace }} + namespace: {{ $.Values.configSecret.namespace }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/deployment.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/deployment.yaml new file mode 100644 index 00000000..312693ea --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/deployment.yaml @@ -0,0 +1,146 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ template "capi-operator.fullname" . }} + namespace: '{{ .Release.Namespace }}' + labels: + app: {{ template "capi-operator.name" . }} + app.kubernetes.io/name: {{ template "capi-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: "controller" + control-plane: controller-manager + clusterctl.cluster.x-k8s.io/core: capi-operator + {{- with .Values.deploymentLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.deploymentAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app.kubernetes.io/name: {{ template "capi-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: "controller" + control-plane: controller-manager + clusterctl.cluster.x-k8s.io/core: capi-operator + {{- with .Values.strategy }} + strategy: + {{- toYaml . | nindent 4 }} + {{- end }} + template: + metadata: + labels: + app: {{ template "capi-operator.name" . }} + app.kubernetes.io/name: {{ template "capi-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/component: "controller" + control-plane: controller-manager + clusterctl.cluster.x-k8s.io/core: capi-operator + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + serviceAccountName: capi-operator-manager + automountServiceAccountToken: true + {{- with .Values.securityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - args: + {{- if .Values.logLevel }} + - --v={{ .Values.logLevel }} + {{- end }} + {{- if .Values.healthAddr }} + - --health-addr={{ .Values.healthAddr }} + {{- end }} + {{- if .Values.metricsBindAddr }} + - --metrics-bind-addr={{ .Values.metricsBindAddr }} + {{- end }} + {{- if .Values.diagnosticsAddress }} + - --diagnostics-address={{ .Values.diagnosticsAddress }} + {{- end }} + {{- if .Values.insecureDiagnostics }} + - --insecure-diagnostics={{ .Values.insecureDiagnostics }} + {{- end }} + {{- with .Values.leaderElection }} + - --leader-elect={{ .enabled }} + {{- if .leaseDuration }} + - --leader-elect-lease-duration={{ .leaseDuration }} + {{- end }} + {{- if .renewDeadline }} + - --leader-elect-renew-deadline={{ .renewDeadline }} + {{- end }} + {{- if .retryPeriod }} + - --leader-elect-retry-period={{ .retryPeriod }} + {{- end }} + {{- end }} + command: + - /manager + {{- with .Values.image.manager }} + image: "{{- if .registry -}}{{ .registry }}/{{- end -}}{{ .repository }}{{- if (.digest) -}} @{{ .digest }}{{- else -}}:{{ default $.Chart.AppVersion .tag }} {{- end -}}" + {{- end }} + imagePullPolicy: {{ .Values.image.manager.pullPolicy }} + name: manager + ports: + - containerPort: 9443 + name: webhook-server + protocol: TCP + - containerPort: {{ ( split ":" $.Values.metricsBindAddr)._1 | int }} + name: metrics + protocol: TCP + {{- with .Values.resources.manager }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.env.manager }} + env: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.containerSecurityContext.manager }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.volumeMounts.manager }} + volumeMounts: + {{- toYaml . | nindent 12 }} + {{- end }} + terminationGracePeriodSeconds: 10 + {{- with .Values.volumes }} + volumes: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.topologySpreadConstraints }} + topologySpreadConstraints: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.podDnsPolicy }} + dnsPolicy: {{ . }} + {{- end }} + {{- with .Values.podDnsConfig }} + dnsConfig: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/infra-conditions.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/infra-conditions.yaml new file mode 100644 index 00000000..3c3a8a75 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/infra-conditions.yaml @@ -0,0 +1,64 @@ +{{- if .Values.infrastructure }} + +# Deploy bootstrap, and infrastructure components if not specified +{{- if not .Values.bootstrap }} +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "1" + "argocd.argoproj.io/sync-wave": "1" + name: capi-kubeadm-bootstrap-system +--- +apiVersion: operator.cluster.x-k8s.io/v1alpha2 +kind: BootstrapProvider +metadata: + name: kubeadm + namespace: capi-kubeadm-bootstrap-system + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "2" + "argocd.argoproj.io/sync-wave": "2" +{{- with .Values.configSecret }} +spec: + configSecret: + name: {{ .name }} + {{- if .namespace }} + namespace: {{ .namespace }} + {{- end }} +{{- end }} +{{- end }} + +{{- if not .Values.controlPlane }} +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "1" + "argocd.argoproj.io/sync-wave": "1" + name: capi-kubeadm-control-plane-system +--- +apiVersion: operator.cluster.x-k8s.io/v1alpha2 +kind: ControlPlaneProvider +metadata: + name: kubeadm + namespace: capi-kubeadm-control-plane-system + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "2" + "argocd.argoproj.io/sync-wave": "2" +{{- with .Values.configSecret }} +spec: + configSecret: + name: {{ .name }} + {{- if .namespace }} + namespace: {{ .namespace }} + {{- end }} +{{- end }} +{{- end }} + +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/infra.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/infra.yaml new file mode 100644 index 00000000..842123f5 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/infra.yaml @@ -0,0 +1,84 @@ +{{- define "recursivePrinter" }} +{{- range $key, $value := . }} +{{- if kindIs "map" $value }} + {{ $key }}: + {{- include "recursivePrinter" $value | indent 2 }} +{{- else }} + {{ $key }}: {{ $value }} +{{- end }} +{{- end }} +{{- end }} +# Infrastructure providers +{{- if .Values.infrastructure }} +{{- $infrastructures := split ";" .Values.infrastructure }} +{{- $infrastructureNamespace := "" }} +{{- $infrastructureName := "" }} +{{- $infrastructureVersion := "" }} +{{- range $infrastructure := $infrastructures }} +{{- $infrastructureArgs := split ":" $infrastructure }} +{{- $infrastructureArgsLen := len $infrastructureArgs }} +{{- if eq $infrastructureArgsLen 3 }} + {{- $infrastructureNamespace = $infrastructureArgs._0 }} + {{- $infrastructureName = $infrastructureArgs._1 }} + {{- $infrastructureVersion = $infrastructureArgs._2 }} +{{- else if eq $infrastructureArgsLen 2 }} + {{- $infrastructureNamespace = print $infrastructureArgs._0 "-infrastructure-system" }} + {{- $infrastructureName = $infrastructureArgs._0 }} + {{- $infrastructureVersion = $infrastructureArgs._1 }} +{{- else if eq $infrastructureArgsLen 1 }} + {{- $infrastructureNamespace = print $infrastructureArgs._0 "-infrastructure-system" }} + {{- $infrastructureName = $infrastructureArgs._0 }} +{{- else }} + {{- fail "infrastructure provider argument should have the following format aws:v1.0.0 or mynamespace:aws:v1.0.0" }} +{{- end }} +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "1" + "argocd.argoproj.io/sync-wave": "1" + name: {{ $infrastructureNamespace }} +--- +apiVersion: operator.cluster.x-k8s.io/v1alpha2 +kind: InfrastructureProvider +metadata: + name: {{ $infrastructureName }} + namespace: {{ $infrastructureNamespace }} + annotations: + "helm.sh/hook": "post-install" + "helm.sh/hook-weight": "2" + "argocd.argoproj.io/sync-wave": "2" +{{- if or $infrastructureVersion $.Values.configSecret.name $.Values.manager $.Values.additionalDeployments }} +spec: +{{- end }} +{{- if $infrastructureVersion }} + version: {{ $infrastructureVersion }} +{{- end }} +{{- if $.Values.manager }} + manager: +{{- if and (kindIs "map" $.Values.manager.featureGates) (hasKey $.Values.manager.featureGates $infrastructureName) }} +{{- range $key, $value := $.Values.manager.featureGates }} + {{- if eq $key $infrastructureName }} + featureGates: + {{- range $k, $v := $value }} + {{ $k }}: {{ $v }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- if $.Values.configSecret.name }} + configSecret: + name: {{ $.Values.configSecret.name }} + {{- if $.Values.configSecret.namespace }} + namespace: {{ $.Values.configSecret.namespace }} + {{- end }} +{{- end }} +{{- if $.Values.additionalDeployments }} + additionalDeployments: + {{- include "recursivePrinter" $.Values.additionalDeployments | indent 2 }} +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/operator-components.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/operator-components.yaml new file mode 100644 index 00000000..c5ccd2e7 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/templates/operator-components.yaml @@ -0,0 +1,27887 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/capi-operator-serving-cert' + controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: addonproviders.operator.cluster.x-k8s.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /convert + conversionReviewVersions: + - v1 + - v1alpha1 + group: operator.cluster.x-k8s.io + names: + kind: AddonProvider + listKind: AddonProviderList + plural: addonproviders + shortNames: + - caap + singular: addonprovider + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.installedVersion + name: InstalledVersion + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + name: v1alpha2 + schema: + openAPIV3Schema: + description: AddonProvider is the Schema for the addonproviders API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: AddonProviderSpec defines the desired state of AddonProvider. + properties: + additionalDeployments: + additionalProperties: + description: |- + AdditionalDeployments defines the properties that can be enabled on the controller + manager and deployment for the provider if the provider is managing additional deployments. + properties: + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the additional provider deployment. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules + for the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated + with the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching + the corresponding nodeSelectorTerm, in the + range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector + terms. The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules + (e.g. co-locate this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling + rules (e.g. avoid putting this pod in the same node, + zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set + in the container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. + Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the + FieldPath is written in terms of, + defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format + of the exposed resources, defaults + to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in + the pod's namespace + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the + Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to + distinguish between explicit zero and not specified. Defaults + to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + manager: + description: Manager defines the properties that can be enabled + on the controller manager for the additional provider deployment. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should + be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + type: object + description: |- + AdditionalDeployments is a map of additional deployments that the provider + should manage. The key is the name of the deployment and the value is the + DeploymentSpec. + type: object + additionalManifests: + description: |- + AdditionalManifests is reference to configmap that contains additional manifests that will be applied + together with the provider components. The key for storing these manifests has to be `manifests`. + The manifests are applied only once when a certain release is installed/upgraded. If namespace is not specified, the + namespace of the provider will be used. There is no validation of the yaml content inside the configmap. + properties: + name: + description: Name defines the name of the configmap. + type: string + namespace: + description: Namespace defines the namespace of the configmap. + type: string + required: + - name + type: object + configSecret: + description: |- + ConfigSecret is the object with name and namespace of the Secret providing + the configuration variables for the current provider instance, like e.g. credentials. + Such configurations will be used when creating or upgrading provider components. + The contents of the secret will be treated as immutable. If changes need + to be made, a new object can be created and the name should be updated. + The contents should be in the form of key:value. This secret must be in + the same namespace as the provider. + properties: + name: + description: Name defines the name of the secret. + type: string + namespace: + description: Namespace defines the namespace of the secret. + type: string + required: + - name + type: object + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the provider. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set in the + container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in + PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to distinguish + between explicit zero and not specified. Defaults to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + fetchConfig: + description: |- + FetchConfig determines how the operator will fetch the components and metadata for the provider. + If nil, the operator will try to fetch components according to default + embedded fetch configuration for the given kind and `ObjectMeta.Name`. + For example, the infrastructure name `aws` will fetch artifacts from + https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases. + properties: + selector: + description: |- + Selector to be used for fetching provider’s components and metadata from + ConfigMaps stored inside the cluster. Each ConfigMap is expected to contain + components and metadata for a specific version only. + Note: the name of the ConfigMap should be set to the version or to override this + add a label like the following: provider.cluster.x-k8s.io/version=v1.4.3 + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL to be used for fetching the provider’s components and metadata from a remote Github repository. + For example, https://github.com/{owner}/{repository}/releases + You must set `providerSpec.Version` field for operator to pick up + desired version of the release from GitHub. + type: string + type: object + manager: + description: Manager defines the properties that can be enabled on + the controller manager for the provider. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + manifestPatches: + description: |- + ManifestPatches are applied to rendered provider manifests to customize the + provider manifests. Patches are applied in the order they are specified. + The `kind` field must match the target object, and + if `apiVersion` is specified it will only be applied to matching objects. + This should be an inline yaml blob-string https://datatracker.ietf.org/doc/html/rfc7396 + items: + type: string + type: array + version: + description: Version indicates the provider version. + type: string + type: object + status: + description: AddonProviderStatus defines the observed state of AddonProvider. + properties: + conditions: + description: Conditions define the current service state of the provider. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + contract: + description: |- + Contract will contain the core provider contract that the provider is + abiding by, like e.g. v1alpha4. + type: string + installedVersion: + description: InstalledVersion is the version of the provider that + is installed. + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/capi-operator-serving-cert' + controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: bootstrapproviders.operator.cluster.x-k8s.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /convert + conversionReviewVersions: + - v1 + - v1alpha1 + group: operator.cluster.x-k8s.io + names: + kind: BootstrapProvider + listKind: BootstrapProviderList + plural: bootstrapproviders + shortNames: + - cabp + singular: bootstrapprovider + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.installedVersion + name: InstalledVersion + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + deprecated: true + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + BootstrapProvider is the Schema for the bootstrapproviders API. + + + Deprecated: This type will be removed in one of the next releases. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: BootstrapProviderSpec defines the desired state of BootstrapProvider. + properties: + additionalManifests: + description: |- + AdditionalManifests is reference to configmap that contains additional manifests that will be applied + together with the provider components. The key for storing these manifests has to be `manifests`. + The manifests are applied only once when a certain release is installed/upgraded. If namespace is not specified, the + namespace of the provider will be used. There is no validation of the yaml content inside the configmap. + properties: + name: + description: Name defines the name of the configmap. + type: string + namespace: + description: Namespace defines the namespace of the configmap. + type: string + required: + - name + type: object + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the provider. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set in the + container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + image: + description: Container Image Name + properties: + name: + description: Name allows to specify a name for the image. + type: string + repository: + description: Repository sets the container registry + to pull images from. + type: string + tag: + description: Tag allows to specify a tag for the image. + type: string + type: object + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in + PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to distinguish + between explicit zero and not specified. Defaults to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + fetchConfig: + description: |- + FetchConfig determines how the operator will fetch the components and metadata for the provider. + If nil, the operator will try to fetch components according to default + embedded fetch configuration for the given kind and `ObjectMeta.Name`. + For example, the infrastructure name `aws` will fetch artifacts from + https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases. + properties: + selector: + description: |- + Selector to be used for fetching provider’s components and metadata from + ConfigMaps stored inside the cluster. Each ConfigMap is expected to contain + components and metadata for a specific version only. + Note: the name of the ConfigMap should be set to the version or to override this + add a label like the following: provider.cluster.x-k8s.io/version=v1.4.3 + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL to be used for fetching the provider’s components and metadata from a remote Github repository. + For example, https://github.com/{owner}/{repository}/releases + You must set `providerSpec.Version` field for operator to pick up + desired version of the release from GitHub. + type: string + type: object + manager: + description: Manager defines the properties that can be enabled on + the controller manager for the provider. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains the controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + secretName: + description: |- + SecretName is the name of the Secret providing the configuration + variables for the current provider instance, like e.g. credentials. + Such configurations will be used when creating or upgrading provider components. + The contents of the secret will be treated as immutable. If changes need + to be made, a new object can be created and the name should be updated. + The contents should be in the form of key:value. This secret must be in + the same namespace as the provider. + type: string + secretNamespace: + description: |- + SecretNamespace is the namespace of the Secret providing the configuration variables. If not specified, + the namespace of the provider will be used. + type: string + version: + description: Version indicates the provider version. + type: string + type: object + status: + description: BootstrapProviderStatus defines the observed state of BootstrapProvider. + properties: + conditions: + description: Conditions define the current service state of the provider. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + contract: + description: |- + Contract will contain the core provider contract that the provider is + abiding by, like e.g. v1alpha4. + type: string + installedVersion: + description: InstalledVersion is the version of the provider that + is installed. + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.installedVersion + name: InstalledVersion + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + name: v1alpha2 + schema: + openAPIV3Schema: + description: BootstrapProvider is the Schema for the bootstrapproviders API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: BootstrapProviderSpec defines the desired state of BootstrapProvider. + properties: + additionalDeployments: + additionalProperties: + description: |- + AdditionalDeployments defines the properties that can be enabled on the controller + manager and deployment for the provider if the provider is managing additional deployments. + properties: + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the additional provider deployment. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules + for the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated + with the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching + the corresponding nodeSelectorTerm, in the + range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector + terms. The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules + (e.g. co-locate this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling + rules (e.g. avoid putting this pod in the same node, + zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set + in the container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. + Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the + FieldPath is written in terms of, + defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format + of the exposed resources, defaults + to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in + the pod's namespace + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the + Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to + distinguish between explicit zero and not specified. Defaults + to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + manager: + description: Manager defines the properties that can be enabled + on the controller manager for the additional provider deployment. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should + be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + type: object + description: |- + AdditionalDeployments is a map of additional deployments that the provider + should manage. The key is the name of the deployment and the value is the + DeploymentSpec. + type: object + additionalManifests: + description: |- + AdditionalManifests is reference to configmap that contains additional manifests that will be applied + together with the provider components. The key for storing these manifests has to be `manifests`. + The manifests are applied only once when a certain release is installed/upgraded. If namespace is not specified, the + namespace of the provider will be used. There is no validation of the yaml content inside the configmap. + properties: + name: + description: Name defines the name of the configmap. + type: string + namespace: + description: Namespace defines the namespace of the configmap. + type: string + required: + - name + type: object + configSecret: + description: |- + ConfigSecret is the object with name and namespace of the Secret providing + the configuration variables for the current provider instance, like e.g. credentials. + Such configurations will be used when creating or upgrading provider components. + The contents of the secret will be treated as immutable. If changes need + to be made, a new object can be created and the name should be updated. + The contents should be in the form of key:value. This secret must be in + the same namespace as the provider. + properties: + name: + description: Name defines the name of the secret. + type: string + namespace: + description: Namespace defines the namespace of the secret. + type: string + required: + - name + type: object + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the provider. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set in the + container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in + PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to distinguish + between explicit zero and not specified. Defaults to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + fetchConfig: + description: |- + FetchConfig determines how the operator will fetch the components and metadata for the provider. + If nil, the operator will try to fetch components according to default + embedded fetch configuration for the given kind and `ObjectMeta.Name`. + For example, the infrastructure name `aws` will fetch artifacts from + https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases. + properties: + selector: + description: |- + Selector to be used for fetching provider’s components and metadata from + ConfigMaps stored inside the cluster. Each ConfigMap is expected to contain + components and metadata for a specific version only. + Note: the name of the ConfigMap should be set to the version or to override this + add a label like the following: provider.cluster.x-k8s.io/version=v1.4.3 + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL to be used for fetching the provider’s components and metadata from a remote Github repository. + For example, https://github.com/{owner}/{repository}/releases + You must set `providerSpec.Version` field for operator to pick up + desired version of the release from GitHub. + type: string + type: object + manager: + description: Manager defines the properties that can be enabled on + the controller manager for the provider. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + manifestPatches: + description: |- + ManifestPatches are applied to rendered provider manifests to customize the + provider manifests. Patches are applied in the order they are specified. + The `kind` field must match the target object, and + if `apiVersion` is specified it will only be applied to matching objects. + This should be an inline yaml blob-string https://datatracker.ietf.org/doc/html/rfc7396 + items: + type: string + type: array + version: + description: Version indicates the provider version. + type: string + type: object + status: + description: BootstrapProviderStatus defines the observed state of BootstrapProvider. + properties: + conditions: + description: Conditions define the current service state of the provider. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + contract: + description: |- + Contract will contain the core provider contract that the provider is + abiding by, like e.g. v1alpha4. + type: string + installedVersion: + description: InstalledVersion is the version of the provider that + is installed. + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/capi-operator-serving-cert' + controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: controlplaneproviders.operator.cluster.x-k8s.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /convert + conversionReviewVersions: + - v1 + - v1alpha1 + group: operator.cluster.x-k8s.io + names: + kind: ControlPlaneProvider + listKind: ControlPlaneProviderList + plural: controlplaneproviders + shortNames: + - cacpp + singular: controlplaneprovider + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.installedVersion + name: InstalledVersion + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + deprecated: true + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + ControlPlaneProvider is the Schema for the controlplaneproviders API. + + + Deprecated: This type will be removed in one of the next releases. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ControlPlaneProviderSpec defines the desired state of ControlPlaneProvider. + properties: + additionalManifests: + description: |- + AdditionalManifests is reference to configmap that contains additional manifests that will be applied + together with the provider components. The key for storing these manifests has to be `manifests`. + The manifests are applied only once when a certain release is installed/upgraded. If namespace is not specified, the + namespace of the provider will be used. There is no validation of the yaml content inside the configmap. + properties: + name: + description: Name defines the name of the configmap. + type: string + namespace: + description: Namespace defines the namespace of the configmap. + type: string + required: + - name + type: object + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the provider. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set in the + container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + image: + description: Container Image Name + properties: + name: + description: Name allows to specify a name for the image. + type: string + repository: + description: Repository sets the container registry + to pull images from. + type: string + tag: + description: Tag allows to specify a tag for the image. + type: string + type: object + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in + PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to distinguish + between explicit zero and not specified. Defaults to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + fetchConfig: + description: |- + FetchConfig determines how the operator will fetch the components and metadata for the provider. + If nil, the operator will try to fetch components according to default + embedded fetch configuration for the given kind and `ObjectMeta.Name`. + For example, the infrastructure name `aws` will fetch artifacts from + https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases. + properties: + selector: + description: |- + Selector to be used for fetching provider’s components and metadata from + ConfigMaps stored inside the cluster. Each ConfigMap is expected to contain + components and metadata for a specific version only. + Note: the name of the ConfigMap should be set to the version or to override this + add a label like the following: provider.cluster.x-k8s.io/version=v1.4.3 + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL to be used for fetching the provider’s components and metadata from a remote Github repository. + For example, https://github.com/{owner}/{repository}/releases + You must set `providerSpec.Version` field for operator to pick up + desired version of the release from GitHub. + type: string + type: object + manager: + description: Manager defines the properties that can be enabled on + the controller manager for the provider. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains the controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + secretName: + description: |- + SecretName is the name of the Secret providing the configuration + variables for the current provider instance, like e.g. credentials. + Such configurations will be used when creating or upgrading provider components. + The contents of the secret will be treated as immutable. If changes need + to be made, a new object can be created and the name should be updated. + The contents should be in the form of key:value. This secret must be in + the same namespace as the provider. + type: string + secretNamespace: + description: |- + SecretNamespace is the namespace of the Secret providing the configuration variables. If not specified, + the namespace of the provider will be used. + type: string + version: + description: Version indicates the provider version. + type: string + type: object + status: + description: ControlPlaneProviderStatus defines the observed state of + ControlPlaneProvider. + properties: + conditions: + description: Conditions define the current service state of the provider. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + contract: + description: |- + Contract will contain the core provider contract that the provider is + abiding by, like e.g. v1alpha4. + type: string + installedVersion: + description: InstalledVersion is the version of the provider that + is installed. + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.installedVersion + name: InstalledVersion + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + name: v1alpha2 + schema: + openAPIV3Schema: + description: ControlPlaneProvider is the Schema for the controlplaneproviders + API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ControlPlaneProviderSpec defines the desired state of ControlPlaneProvider. + properties: + additionalDeployments: + additionalProperties: + description: |- + AdditionalDeployments defines the properties that can be enabled on the controller + manager and deployment for the provider if the provider is managing additional deployments. + properties: + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the additional provider deployment. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules + for the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated + with the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching + the corresponding nodeSelectorTerm, in the + range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector + terms. The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules + (e.g. co-locate this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling + rules (e.g. avoid putting this pod in the same node, + zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set + in the container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. + Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the + FieldPath is written in terms of, + defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format + of the exposed resources, defaults + to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in + the pod's namespace + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the + Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to + distinguish between explicit zero and not specified. Defaults + to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + manager: + description: Manager defines the properties that can be enabled + on the controller manager for the additional provider deployment. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should + be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + type: object + description: |- + AdditionalDeployments is a map of additional deployments that the provider + should manage. The key is the name of the deployment and the value is the + DeploymentSpec. + type: object + additionalManifests: + description: |- + AdditionalManifests is reference to configmap that contains additional manifests that will be applied + together with the provider components. The key for storing these manifests has to be `manifests`. + The manifests are applied only once when a certain release is installed/upgraded. If namespace is not specified, the + namespace of the provider will be used. There is no validation of the yaml content inside the configmap. + properties: + name: + description: Name defines the name of the configmap. + type: string + namespace: + description: Namespace defines the namespace of the configmap. + type: string + required: + - name + type: object + configSecret: + description: |- + ConfigSecret is the object with name and namespace of the Secret providing + the configuration variables for the current provider instance, like e.g. credentials. + Such configurations will be used when creating or upgrading provider components. + The contents of the secret will be treated as immutable. If changes need + to be made, a new object can be created and the name should be updated. + The contents should be in the form of key:value. This secret must be in + the same namespace as the provider. + properties: + name: + description: Name defines the name of the secret. + type: string + namespace: + description: Namespace defines the namespace of the secret. + type: string + required: + - name + type: object + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the provider. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set in the + container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in + PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to distinguish + between explicit zero and not specified. Defaults to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + fetchConfig: + description: |- + FetchConfig determines how the operator will fetch the components and metadata for the provider. + If nil, the operator will try to fetch components according to default + embedded fetch configuration for the given kind and `ObjectMeta.Name`. + For example, the infrastructure name `aws` will fetch artifacts from + https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases. + properties: + selector: + description: |- + Selector to be used for fetching provider’s components and metadata from + ConfigMaps stored inside the cluster. Each ConfigMap is expected to contain + components and metadata for a specific version only. + Note: the name of the ConfigMap should be set to the version or to override this + add a label like the following: provider.cluster.x-k8s.io/version=v1.4.3 + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL to be used for fetching the provider’s components and metadata from a remote Github repository. + For example, https://github.com/{owner}/{repository}/releases + You must set `providerSpec.Version` field for operator to pick up + desired version of the release from GitHub. + type: string + type: object + manager: + description: Manager defines the properties that can be enabled on + the controller manager for the provider. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + manifestPatches: + description: |- + ManifestPatches are applied to rendered provider manifests to customize the + provider manifests. Patches are applied in the order they are specified. + The `kind` field must match the target object, and + if `apiVersion` is specified it will only be applied to matching objects. + This should be an inline yaml blob-string https://datatracker.ietf.org/doc/html/rfc7396 + items: + type: string + type: array + version: + description: Version indicates the provider version. + type: string + type: object + status: + description: ControlPlaneProviderStatus defines the observed state of + ControlPlaneProvider. + properties: + conditions: + description: Conditions define the current service state of the provider. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + contract: + description: |- + Contract will contain the core provider contract that the provider is + abiding by, like e.g. v1alpha4. + type: string + installedVersion: + description: InstalledVersion is the version of the provider that + is installed. + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/capi-operator-serving-cert' + controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: coreproviders.operator.cluster.x-k8s.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /convert + conversionReviewVersions: + - v1 + - v1alpha1 + group: operator.cluster.x-k8s.io + names: + kind: CoreProvider + listKind: CoreProviderList + plural: coreproviders + shortNames: + - cacp + singular: coreprovider + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.installedVersion + name: InstalledVersion + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + deprecated: true + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + CoreProvider is the Schema for the coreproviders API. + + + Deprecated: This type will be removed in one of the next releases. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: CoreProviderSpec defines the desired state of CoreProvider. + properties: + additionalManifests: + description: |- + AdditionalManifests is reference to configmap that contains additional manifests that will be applied + together with the provider components. The key for storing these manifests has to be `manifests`. + The manifests are applied only once when a certain release is installed/upgraded. If namespace is not specified, the + namespace of the provider will be used. There is no validation of the yaml content inside the configmap. + properties: + name: + description: Name defines the name of the configmap. + type: string + namespace: + description: Namespace defines the namespace of the configmap. + type: string + required: + - name + type: object + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the provider. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set in the + container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + image: + description: Container Image Name + properties: + name: + description: Name allows to specify a name for the image. + type: string + repository: + description: Repository sets the container registry + to pull images from. + type: string + tag: + description: Tag allows to specify a tag for the image. + type: string + type: object + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in + PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to distinguish + between explicit zero and not specified. Defaults to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + fetchConfig: + description: |- + FetchConfig determines how the operator will fetch the components and metadata for the provider. + If nil, the operator will try to fetch components according to default + embedded fetch configuration for the given kind and `ObjectMeta.Name`. + For example, the infrastructure name `aws` will fetch artifacts from + https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases. + properties: + selector: + description: |- + Selector to be used for fetching provider’s components and metadata from + ConfigMaps stored inside the cluster. Each ConfigMap is expected to contain + components and metadata for a specific version only. + Note: the name of the ConfigMap should be set to the version or to override this + add a label like the following: provider.cluster.x-k8s.io/version=v1.4.3 + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL to be used for fetching the provider’s components and metadata from a remote Github repository. + For example, https://github.com/{owner}/{repository}/releases + You must set `providerSpec.Version` field for operator to pick up + desired version of the release from GitHub. + type: string + type: object + manager: + description: Manager defines the properties that can be enabled on + the controller manager for the provider. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains the controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + secretName: + description: |- + SecretName is the name of the Secret providing the configuration + variables for the current provider instance, like e.g. credentials. + Such configurations will be used when creating or upgrading provider components. + The contents of the secret will be treated as immutable. If changes need + to be made, a new object can be created and the name should be updated. + The contents should be in the form of key:value. This secret must be in + the same namespace as the provider. + type: string + secretNamespace: + description: |- + SecretNamespace is the namespace of the Secret providing the configuration variables. If not specified, + the namespace of the provider will be used. + type: string + version: + description: Version indicates the provider version. + type: string + type: object + status: + description: CoreProviderStatus defines the observed state of CoreProvider. + properties: + conditions: + description: Conditions define the current service state of the provider. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + contract: + description: |- + Contract will contain the core provider contract that the provider is + abiding by, like e.g. v1alpha4. + type: string + installedVersion: + description: InstalledVersion is the version of the provider that + is installed. + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.installedVersion + name: InstalledVersion + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + name: v1alpha2 + schema: + openAPIV3Schema: + description: CoreProvider is the Schema for the coreproviders API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: CoreProviderSpec defines the desired state of CoreProvider. + properties: + additionalDeployments: + additionalProperties: + description: |- + AdditionalDeployments defines the properties that can be enabled on the controller + manager and deployment for the provider if the provider is managing additional deployments. + properties: + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the additional provider deployment. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules + for the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated + with the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching + the corresponding nodeSelectorTerm, in the + range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector + terms. The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules + (e.g. co-locate this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling + rules (e.g. avoid putting this pod in the same node, + zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set + in the container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. + Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the + FieldPath is written in terms of, + defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format + of the exposed resources, defaults + to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in + the pod's namespace + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the + Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to + distinguish between explicit zero and not specified. Defaults + to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + manager: + description: Manager defines the properties that can be enabled + on the controller manager for the additional provider deployment. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should + be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + type: object + description: |- + AdditionalDeployments is a map of additional deployments that the provider + should manage. The key is the name of the deployment and the value is the + DeploymentSpec. + type: object + additionalManifests: + description: |- + AdditionalManifests is reference to configmap that contains additional manifests that will be applied + together with the provider components. The key for storing these manifests has to be `manifests`. + The manifests are applied only once when a certain release is installed/upgraded. If namespace is not specified, the + namespace of the provider will be used. There is no validation of the yaml content inside the configmap. + properties: + name: + description: Name defines the name of the configmap. + type: string + namespace: + description: Namespace defines the namespace of the configmap. + type: string + required: + - name + type: object + configSecret: + description: |- + ConfigSecret is the object with name and namespace of the Secret providing + the configuration variables for the current provider instance, like e.g. credentials. + Such configurations will be used when creating or upgrading provider components. + The contents of the secret will be treated as immutable. If changes need + to be made, a new object can be created and the name should be updated. + The contents should be in the form of key:value. This secret must be in + the same namespace as the provider. + properties: + name: + description: Name defines the name of the secret. + type: string + namespace: + description: Namespace defines the namespace of the secret. + type: string + required: + - name + type: object + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the provider. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set in the + container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in + PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to distinguish + between explicit zero and not specified. Defaults to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + fetchConfig: + description: |- + FetchConfig determines how the operator will fetch the components and metadata for the provider. + If nil, the operator will try to fetch components according to default + embedded fetch configuration for the given kind and `ObjectMeta.Name`. + For example, the infrastructure name `aws` will fetch artifacts from + https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases. + properties: + selector: + description: |- + Selector to be used for fetching provider’s components and metadata from + ConfigMaps stored inside the cluster. Each ConfigMap is expected to contain + components and metadata for a specific version only. + Note: the name of the ConfigMap should be set to the version or to override this + add a label like the following: provider.cluster.x-k8s.io/version=v1.4.3 + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL to be used for fetching the provider’s components and metadata from a remote Github repository. + For example, https://github.com/{owner}/{repository}/releases + You must set `providerSpec.Version` field for operator to pick up + desired version of the release from GitHub. + type: string + type: object + manager: + description: Manager defines the properties that can be enabled on + the controller manager for the provider. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + manifestPatches: + description: |- + ManifestPatches are applied to rendered provider manifests to customize the + provider manifests. Patches are applied in the order they are specified. + The `kind` field must match the target object, and + if `apiVersion` is specified it will only be applied to matching objects. + This should be an inline yaml blob-string https://datatracker.ietf.org/doc/html/rfc7396 + items: + type: string + type: array + version: + description: Version indicates the provider version. + type: string + type: object + status: + description: CoreProviderStatus defines the observed state of CoreProvider. + properties: + conditions: + description: Conditions define the current service state of the provider. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + contract: + description: |- + Contract will contain the core provider contract that the provider is + abiding by, like e.g. v1alpha4. + type: string + installedVersion: + description: InstalledVersion is the version of the provider that + is installed. + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/capi-operator-serving-cert' + controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: infrastructureproviders.operator.cluster.x-k8s.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /convert + conversionReviewVersions: + - v1 + - v1alpha1 + group: operator.cluster.x-k8s.io + names: + kind: InfrastructureProvider + listKind: InfrastructureProviderList + plural: infrastructureproviders + shortNames: + - caip + singular: infrastructureprovider + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.installedVersion + name: InstalledVersion + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + deprecated: true + name: v1alpha1 + schema: + openAPIV3Schema: + description: |- + InfrastructureProvider is the Schema for the infrastructureproviders API. + + + Deprecated: This type will be removed in one of the next releases. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: InfrastructureProviderSpec defines the desired state of InfrastructureProvider. + properties: + additionalManifests: + description: |- + AdditionalManifests is reference to configmap that contains additional manifests that will be applied + together with the provider components. The key for storing these manifests has to be `manifests`. + The manifests are applied only once when a certain release is installed/upgraded. If namespace is not specified, the + namespace of the provider will be used. There is no validation of the yaml content inside the configmap. + properties: + name: + description: Name defines the name of the configmap. + type: string + namespace: + description: Namespace defines the namespace of the configmap. + type: string + required: + - name + type: object + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the provider. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set in the + container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + image: + description: Container Image Name + properties: + name: + description: Name allows to specify a name for the image. + type: string + repository: + description: Repository sets the container registry + to pull images from. + type: string + tag: + description: Tag allows to specify a tag for the image. + type: string + type: object + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in + PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to distinguish + between explicit zero and not specified. Defaults to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + fetchConfig: + description: |- + FetchConfig determines how the operator will fetch the components and metadata for the provider. + If nil, the operator will try to fetch components according to default + embedded fetch configuration for the given kind and `ObjectMeta.Name`. + For example, the infrastructure name `aws` will fetch artifacts from + https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases. + properties: + selector: + description: |- + Selector to be used for fetching provider’s components and metadata from + ConfigMaps stored inside the cluster. Each ConfigMap is expected to contain + components and metadata for a specific version only. + Note: the name of the ConfigMap should be set to the version or to override this + add a label like the following: provider.cluster.x-k8s.io/version=v1.4.3 + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL to be used for fetching the provider’s components and metadata from a remote Github repository. + For example, https://github.com/{owner}/{repository}/releases + You must set `providerSpec.Version` field for operator to pick up + desired version of the release from GitHub. + type: string + type: object + manager: + description: Manager defines the properties that can be enabled on + the controller manager for the provider. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains the controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + secretName: + description: |- + SecretName is the name of the Secret providing the configuration + variables for the current provider instance, like e.g. credentials. + Such configurations will be used when creating or upgrading provider components. + The contents of the secret will be treated as immutable. If changes need + to be made, a new object can be created and the name should be updated. + The contents should be in the form of key:value. This secret must be in + the same namespace as the provider. + type: string + secretNamespace: + description: |- + SecretNamespace is the namespace of the Secret providing the configuration variables. If not specified, + the namespace of the provider will be used. + type: string + version: + description: Version indicates the provider version. + type: string + type: object + status: + description: InfrastructureProviderStatus defines the observed state of + InfrastructureProvider. + properties: + conditions: + description: Conditions define the current service state of the provider. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + contract: + description: |- + Contract will contain the core provider contract that the provider is + abiding by, like e.g. v1alpha4. + type: string + installedVersion: + description: InstalledVersion is the version of the provider that + is installed. + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.installedVersion + name: InstalledVersion + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + name: v1alpha2 + schema: + openAPIV3Schema: + description: InfrastructureProvider is the Schema for the infrastructureproviders + API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: InfrastructureProviderSpec defines the desired state of InfrastructureProvider. + properties: + additionalDeployments: + additionalProperties: + description: |- + AdditionalDeployments defines the properties that can be enabled on the controller + manager and deployment for the provider if the provider is managing additional deployments. + properties: + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the additional provider deployment. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules + for the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated + with the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching + the corresponding nodeSelectorTerm, in the + range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector + terms. The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules + (e.g. co-locate this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling + rules (e.g. avoid putting this pod in the same node, + zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set + in the container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. + Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the + FieldPath is written in terms of, + defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format + of the exposed resources, defaults + to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in + the pod's namespace + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the + Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to + distinguish between explicit zero and not specified. Defaults + to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + manager: + description: Manager defines the properties that can be enabled + on the controller manager for the additional provider deployment. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should + be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + type: object + description: |- + AdditionalDeployments is a map of additional deployments that the provider + should manage. The key is the name of the deployment and the value is the + DeploymentSpec. + type: object + additionalManifests: + description: |- + AdditionalManifests is reference to configmap that contains additional manifests that will be applied + together with the provider components. The key for storing these manifests has to be `manifests`. + The manifests are applied only once when a certain release is installed/upgraded. If namespace is not specified, the + namespace of the provider will be used. There is no validation of the yaml content inside the configmap. + properties: + name: + description: Name defines the name of the configmap. + type: string + namespace: + description: Namespace defines the namespace of the configmap. + type: string + required: + - name + type: object + configSecret: + description: |- + ConfigSecret is the object with name and namespace of the Secret providing + the configuration variables for the current provider instance, like e.g. credentials. + Such configurations will be used when creating or upgrading provider components. + The contents of the secret will be treated as immutable. If changes need + to be made, a new object can be created and the name should be updated. + The contents should be in the form of key:value. This secret must be in + the same namespace as the provider. + properties: + name: + description: Name defines the name of the secret. + type: string + namespace: + description: Namespace defines the namespace of the secret. + type: string + required: + - name + type: object + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the provider. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set in the + container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in + PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to distinguish + between explicit zero and not specified. Defaults to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + fetchConfig: + description: |- + FetchConfig determines how the operator will fetch the components and metadata for the provider. + If nil, the operator will try to fetch components according to default + embedded fetch configuration for the given kind and `ObjectMeta.Name`. + For example, the infrastructure name `aws` will fetch artifacts from + https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases. + properties: + selector: + description: |- + Selector to be used for fetching provider’s components and metadata from + ConfigMaps stored inside the cluster. Each ConfigMap is expected to contain + components and metadata for a specific version only. + Note: the name of the ConfigMap should be set to the version or to override this + add a label like the following: provider.cluster.x-k8s.io/version=v1.4.3 + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL to be used for fetching the provider’s components and metadata from a remote Github repository. + For example, https://github.com/{owner}/{repository}/releases + You must set `providerSpec.Version` field for operator to pick up + desired version of the release from GitHub. + type: string + type: object + manager: + description: Manager defines the properties that can be enabled on + the controller manager for the provider. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + manifestPatches: + description: |- + ManifestPatches are applied to rendered provider manifests to customize the + provider manifests. Patches are applied in the order they are specified. + The `kind` field must match the target object, and + if `apiVersion` is specified it will only be applied to matching objects. + This should be an inline yaml blob-string https://datatracker.ietf.org/doc/html/rfc7396 + items: + type: string + type: array + version: + description: Version indicates the provider version. + type: string + type: object + status: + description: InfrastructureProviderStatus defines the observed state of + InfrastructureProvider. + properties: + conditions: + description: Conditions define the current service state of the provider. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + contract: + description: |- + Contract will contain the core provider contract that the provider is + abiding by, like e.g. v1alpha4. + type: string + installedVersion: + description: InstalledVersion is the version of the provider that + is installed. + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/capi-operator-serving-cert' + controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: ipamproviders.operator.cluster.x-k8s.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /convert + conversionReviewVersions: + - v1 + - v1alpha1 + group: operator.cluster.x-k8s.io + names: + kind: IPAMProvider + listKind: IPAMProviderList + plural: ipamproviders + shortNames: + - caipamp + singular: ipamprovider + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.installedVersion + name: InstalledVersion + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + name: v1alpha2 + schema: + openAPIV3Schema: + description: IPAMProvider is the Schema for the IPAMProviders API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: IPAMProviderSpec defines the desired state of IPAMProvider. + properties: + additionalDeployments: + additionalProperties: + description: |- + AdditionalDeployments defines the properties that can be enabled on the controller + manager and deployment for the provider if the provider is managing additional deployments. + properties: + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the additional provider deployment. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules + for the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated + with the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching + the corresponding nodeSelectorTerm, in the + range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector + terms. The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules + (e.g. co-locate this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling + rules (e.g. avoid putting this pod in the same node, + zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set + in the container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. + Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the + FieldPath is written in terms of, + defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format + of the exposed resources, defaults + to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in + the pod's namespace + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the + Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to + distinguish between explicit zero and not specified. Defaults + to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + manager: + description: Manager defines the properties that can be enabled + on the controller manager for the additional provider deployment. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should + be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + type: object + description: |- + AdditionalDeployments is a map of additional deployments that the provider + should manage. The key is the name of the deployment and the value is the + DeploymentSpec. + type: object + additionalManifests: + description: |- + AdditionalManifests is reference to configmap that contains additional manifests that will be applied + together with the provider components. The key for storing these manifests has to be `manifests`. + The manifests are applied only once when a certain release is installed/upgraded. If namespace is not specified, the + namespace of the provider will be used. There is no validation of the yaml content inside the configmap. + properties: + name: + description: Name defines the name of the configmap. + type: string + namespace: + description: Namespace defines the namespace of the configmap. + type: string + required: + - name + type: object + configSecret: + description: |- + ConfigSecret is the object with name and namespace of the Secret providing + the configuration variables for the current provider instance, like e.g. credentials. + Such configurations will be used when creating or upgrading provider components. + The contents of the secret will be treated as immutable. If changes need + to be made, a new object can be created and the name should be updated. + The contents should be in the form of key:value. This secret must be in + the same namespace as the provider. + properties: + name: + description: Name defines the name of the secret. + type: string + namespace: + description: Namespace defines the namespace of the secret. + type: string + required: + - name + type: object + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the provider. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set in the + container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in + PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to distinguish + between explicit zero and not specified. Defaults to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + fetchConfig: + description: |- + FetchConfig determines how the operator will fetch the components and metadata for the provider. + If nil, the operator will try to fetch components according to default + embedded fetch configuration for the given kind and `ObjectMeta.Name`. + For example, the infrastructure name `aws` will fetch artifacts from + https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases. + properties: + selector: + description: |- + Selector to be used for fetching provider’s components and metadata from + ConfigMaps stored inside the cluster. Each ConfigMap is expected to contain + components and metadata for a specific version only. + Note: the name of the ConfigMap should be set to the version or to override this + add a label like the following: provider.cluster.x-k8s.io/version=v1.4.3 + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL to be used for fetching the provider’s components and metadata from a remote Github repository. + For example, https://github.com/{owner}/{repository}/releases + You must set `providerSpec.Version` field for operator to pick up + desired version of the release from GitHub. + type: string + type: object + manager: + description: Manager defines the properties that can be enabled on + the controller manager for the provider. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + manifestPatches: + description: |- + ManifestPatches are applied to rendered provider manifests to customize the + provider manifests. Patches are applied in the order they are specified. + The `kind` field must match the target object, and + if `apiVersion` is specified it will only be applied to matching objects. + This should be an inline yaml blob-string https://datatracker.ietf.org/doc/html/rfc7396 + items: + type: string + type: array + version: + description: Version indicates the provider version. + type: string + type: object + status: + description: IPAMProviderStatus defines the observed state of IPAMProvider. + properties: + conditions: + description: Conditions define the current service state of the provider. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + contract: + description: |- + Contract will contain the core provider contract that the provider is + abiding by, like e.g. v1alpha4. + type: string + installedVersion: + description: InstalledVersion is the version of the provider that + is installed. + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/capi-operator-serving-cert' + controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: runtimeextensionproviders.operator.cluster.x-k8s.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + caBundle: Cg== + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /convert + conversionReviewVersions: + - v1 + - v1alpha1 + group: operator.cluster.x-k8s.io + names: + kind: RuntimeExtensionProvider + listKind: RuntimeExtensionProviderList + plural: runtimeextensionproviders + shortNames: + - carep + singular: runtimeextensionprovider + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.installedVersion + name: InstalledVersion + type: string + - jsonPath: .status.conditions[?(@.type=='Ready')].status + name: Ready + type: string + name: v1alpha2 + schema: + openAPIV3Schema: + description: RuntimeExtensionProvider is the Schema for the RuntimeExtensionProviders + API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: RuntimeExtensionProviderSpec defines the desired state of + RuntimeExtensionProvider. + properties: + additionalDeployments: + additionalProperties: + description: |- + AdditionalDeployments defines the properties that can be enabled on the controller + manager and deployment for the provider if the provider is managing additional deployments. + properties: + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the additional provider deployment. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules + for the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated + with the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching + the corresponding nodeSelectorTerm, in the + range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector + terms. The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules + (e.g. co-locate this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling + rules (e.g. avoid putting this pod in the same node, + zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set + in the container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. + Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the + FieldPath is written in terms of, + defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format + of the exposed resources, defaults + to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in + the pod's namespace + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the + Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to + distinguish between explicit zero and not specified. Defaults + to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + manager: + description: Manager defines the properties that can be enabled + on the controller manager for the additional provider deployment. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should + be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + type: object + description: |- + AdditionalDeployments is a map of additional deployments that the provider + should manage. The key is the name of the deployment and the value is the + DeploymentSpec. + type: object + additionalManifests: + description: |- + AdditionalManifests is reference to configmap that contains additional manifests that will be applied + together with the provider components. The key for storing these manifests has to be `manifests`. + The manifests are applied only once when a certain release is installed/upgraded. If namespace is not specified, the + namespace of the provider will be used. There is no validation of the yaml content inside the configmap. + properties: + name: + description: Name defines the name of the configmap. + type: string + namespace: + description: Namespace defines the namespace of the configmap. + type: string + required: + - name + type: object + configSecret: + description: |- + ConfigSecret is the object with name and namespace of the Secret providing + the configuration variables for the current provider instance, like e.g. credentials. + Such configurations will be used when creating or upgrading provider components. + The contents of the secret will be treated as immutable. If changes need + to be made, a new object can be created and the name should be updated. + The contents should be in the form of key:value. This secret must be in + the same namespace as the provider. + properties: + name: + description: Name defines the name of the secret. + type: string + namespace: + description: Namespace defines the namespace of the secret. + type: string + required: + - name + type: object + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the provider. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set in the + container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in + PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to distinguish + between explicit zero and not specified. Defaults to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + fetchConfig: + description: |- + FetchConfig determines how the operator will fetch the components and metadata for the provider. + If nil, the operator will try to fetch components according to default + embedded fetch configuration for the given kind and `ObjectMeta.Name`. + For example, the infrastructure name `aws` will fetch artifacts from + https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases. + properties: + selector: + description: |- + Selector to be used for fetching provider’s components and metadata from + ConfigMaps stored inside the cluster. Each ConfigMap is expected to contain + components and metadata for a specific version only. + Note: the name of the ConfigMap should be set to the version or to override this + add a label like the following: provider.cluster.x-k8s.io/version=v1.4.3 + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL to be used for fetching the provider’s components and metadata from a remote Github repository. + For example, https://github.com/{owner}/{repository}/releases + You must set `providerSpec.Version` field for operator to pick up + desired version of the release from GitHub. + type: string + type: object + manager: + description: Manager defines the properties that can be enabled on + the controller manager for the provider. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + manifestPatches: + description: |- + ManifestPatches are applied to rendered provider manifests to customize the + provider manifests. Patches are applied in the order they are specified. + The `kind` field must match the target object, and + if `apiVersion` is specified it will only be applied to matching objects. + This should be an inline yaml blob-string https://datatracker.ietf.org/doc/html/rfc7396 + items: + type: string + type: array + version: + description: Version indicates the provider version. + type: string + type: object + status: + description: RuntimeExtensionProviderStatus defines the observed state + of RuntimeExtensionProvider. + properties: + conditions: + description: Conditions define the current service state of the provider. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + contract: + description: |- + Contract will contain the core provider contract that the provider is + abiding by, like e.g. v1alpha4. + type: string + installedVersion: + description: InstalledVersion is the version of the provider that + is installed. + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: capi-operator-manager + namespace: '{{ .Release.Namespace }}' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: capi-operator-leader-election-role + namespace: '{{ .Release.Namespace }}' +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - configmaps/status + verbs: + - get + - update + - patch +- apiGroups: + - "" + resources: + - events + verbs: + - create +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: capi-operator-manager-role +rules: +- apiGroups: + - '*' + resources: + - '*' + verbs: + - '*' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: capi-operator-leader-election-rolebinding + namespace: '{{ .Release.Namespace }}' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: capi-operator-leader-election-role +subjects: +- kind: ServiceAccount + name: capi-operator-manager + namespace: '{{ .Release.Namespace }}' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: capi-operator-manager-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: capi-operator-manager-role +subjects: +- kind: ServiceAccount + name: capi-operator-manager + namespace: '{{ .Release.Namespace }}' +--- +apiVersion: v1 +kind: Service +metadata: + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' +spec: + ports: + - port: 443 + targetPort: 9443 + selector: + clusterctl.cluster.x-k8s.io/core: capi-operator + control-plane: controller-manager +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: capi-operator-serving-cert + namespace: '{{ .Release.Namespace }}' +spec: + dnsNames: + - capi-operator-webhook-service.{{ .Release.Namespace }}.svc + - capi-operator-webhook-service.{{ .Release.Namespace }}.svc.cluster.local + issuerRef: + kind: Issuer + name: capi-operator-selfsigned-issuer + secretName: capi-operator-webhook-service-cert +--- +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: capi-operator-selfsigned-issuer + namespace: '{{ .Release.Namespace }}' +spec: + selfSigned: {} +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/capi-operator-serving-cert' + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: capi-operator-mutating-webhook-configuration +webhooks: +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /mutate-operator-cluster-x-k8s-io-v1alpha2-addonprovider + failurePolicy: Fail + matchPolicy: Equivalent + name: vaddonprovider.kb.io + rules: + - apiGroups: + - operator.cluster.x-k8s.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - addonproviders + sideEffects: None +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /mutate-operator-cluster-x-k8s-io-v1alpha2-bootstrapprovider + failurePolicy: Fail + matchPolicy: Equivalent + name: vbootstrapprovider.kb.io + rules: + - apiGroups: + - operator.cluster.x-k8s.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - bootstrapproviders + sideEffects: None +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /mutate-operator-cluster-x-k8s-io-v1alpha2-controlplaneprovider + failurePolicy: Fail + matchPolicy: Equivalent + name: vcontrolplaneprovider.kb.io + rules: + - apiGroups: + - operator.cluster.x-k8s.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - controlplaneproviders + sideEffects: None +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /mutate-operator-cluster-x-k8s-io-v1alpha2-coreprovider + failurePolicy: Fail + matchPolicy: Equivalent + name: vcoreprovider.kb.io + rules: + - apiGroups: + - operator.cluster.x-k8s.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - coreproviders + sideEffects: None +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /mutate-operator-cluster-x-k8s-io-v1alpha2-infrastructureprovider + failurePolicy: Fail + matchPolicy: Equivalent + name: vinfrastructureprovider.kb.io + rules: + - apiGroups: + - operator.cluster.x-k8s.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - infrastructureproviders + sideEffects: None +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /mutate-operator-cluster-x-k8s-io-v1alpha2-ipamprovider + failurePolicy: Fail + matchPolicy: Equivalent + name: vipamprovider.kb.io + rules: + - apiGroups: + - operator.cluster.x-k8s.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - ipamproviders + sideEffects: None +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /mutate-operator-cluster-x-k8s-io-v1alpha2-runtimeextensionprovider + failurePolicy: Fail + matchPolicy: Equivalent + name: vruntimeextensionprovider.kb.io + rules: + - apiGroups: + - operator.cluster.x-k8s.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - runtimeextensionproviders + sideEffects: None +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + annotations: + cert-manager.io/inject-ca-from: '{{ .Release.Namespace }}/capi-operator-serving-cert' + labels: + clusterctl.cluster.x-k8s.io/core: capi-operator + name: capi-operator-validating-webhook-configuration +webhooks: +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /validate-operator-cluster-x-k8s-io-v1alpha2-addonprovider + failurePolicy: Fail + matchPolicy: Equivalent + name: vaddonprovider.kb.io + rules: + - apiGroups: + - operator.cluster.x-k8s.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - addonproviders + sideEffects: None +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /validate-operator-cluster-x-k8s-io-v1alpha2-bootstrapprovider + failurePolicy: Fail + matchPolicy: Equivalent + name: vbootstrapprovider.kb.io + rules: + - apiGroups: + - operator.cluster.x-k8s.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - bootstrapproviders + sideEffects: None +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /validate-operator-cluster-x-k8s-io-v1alpha2-controlplaneprovider + failurePolicy: Fail + matchPolicy: Equivalent + name: vcontrolplaneprovider.kb.io + rules: + - apiGroups: + - operator.cluster.x-k8s.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - controlplaneproviders + sideEffects: None +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /validate-operator-cluster-x-k8s-io-v1alpha2-coreprovider + failurePolicy: Fail + matchPolicy: Equivalent + name: vcoreprovider.kb.io + rules: + - apiGroups: + - operator.cluster.x-k8s.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - coreproviders + sideEffects: None +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /validate-operator-cluster-x-k8s-io-v1alpha2-infrastructureprovider + failurePolicy: Fail + matchPolicy: Equivalent + name: vinfrastructureprovider.kb.io + rules: + - apiGroups: + - operator.cluster.x-k8s.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - infrastructureproviders + sideEffects: None +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /validate-operator-cluster-x-k8s-io-v1alpha2-ipamprovider + failurePolicy: Fail + matchPolicy: Equivalent + name: vipamprovider.kb.io + rules: + - apiGroups: + - operator.cluster.x-k8s.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - ipamproviders + sideEffects: None +- admissionReviewVersions: + - v1 + - v1beta1 + clientConfig: + service: + name: capi-operator-webhook-service + namespace: '{{ .Release.Namespace }}' + path: /validate-operator-cluster-x-k8s-io-v1alpha2-runtimeextensionprovider + failurePolicy: Fail + matchPolicy: Equivalent + name: vruntimeextensionprovider.kb.io + rules: + - apiGroups: + - operator.cluster.x-k8s.io + apiVersions: + - v1alpha2 + operations: + - CREATE + - UPDATE + resources: + - runtimeextensionproviders + sideEffects: None diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/values.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/values.yaml new file mode 100644 index 00000000..b5f58efd --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/charts/cluster-api-operator/values.yaml @@ -0,0 +1,69 @@ +--- +# --- +# Cluster API provider options +core: "" +bootstrap: "" +controlPlane: "" +infrastructure: "" +addon: "" +manager.featureGates: {} +# --- +# Common configuration secret options +configSecret: {} +# --- +# CAPI operator deployment options +logLevel: 2 +replicaCount: 1 +leaderElection: + enabled: true +image: + manager: + repository: registry.k8s.io/capi-operator/cluster-api-operator + tag: v0.12.0 + pullPolicy: IfNotPresent +env: + manager: [] +healthAddr: ":8081" +metricsBindAddr: "127.0.0.1:8080" +diagnosticsAddress: "8443" +insecureDiagnostics: false +imagePullSecrets: {} +resources: + manager: + limits: + cpu: 100m + memory: 150Mi + requests: + cpu: 100m + memory: 100Mi +containerSecurityContext: {} +affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - amd64 + - arm64 + - ppc64le + - key: kubernetes.io/os + operator: In + values: + - linux +tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/master + - effect: NoSchedule + key: node-role.kubernetes.io/control-plane +volumes: + - name: cert + secret: + defaultMode: 420 + secretName: capi-operator-webhook-service-cert +volumeMounts: + manager: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/questions.yml b/charts/rancher-turtles/0.3.1+up0.11.0/questions.yml new file mode 100644 index 00000000..eaa73f83 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/questions.yml @@ -0,0 +1,78 @@ +namespace: rancher-turtles-system +questions: +- variable: rancherTurtles.features.default + default: "false" + description: "Customize install settings" + label: Customize install settings + type: boolean + show_subquestion_if: true + group: "Rancher Turtles Extra Settings" + subquestions: + - variable: cluster-api-operator.cert-manager.enabled + default: false + type: boolean + description: "Flag to enable or disable installation of cert-manager. If set to false then you will need to install cert-manager manually" + label: "Enable Cert Manager" + - variable: rancherTurtles.features.cluster-api-operator.cleanup + default: true + description: "Specify that the CAPI Operator post-delete cleanup job will be performed" + type: boolean + label: Cleanup CAPI Operator installation + group: "CAPI Operator cleanup settings" + show_subquestion_if: true + subquestions: + - variable: rancherTurtles.features.cluster-api-operator.kubectlImage + default: "rancher/kubectl:v1.30.3" + description: "Specify the image to use when cleaning up the Cluster API Operator manifests" + type: string + label: Cleanup Image + group: "CAPI Operator cleanup settings" + - variable: rancherTurtles.features.rancher-webhook.cleanup + default: true + description: "Specify that the Rancher embedded cluster api webhooks should be removed" + type: boolean + label: Cleanup Rancher Embedded CAPI Webhooks + group: "Rancher webhook cleanup settings" + show_subquestion_if: true + subquestions: + - variable: rancherTurtles.features.rancher-webhook.kubectlImage + default: "rancher/kubectl:v1.30.3" + description: "Specify the image to use when cleaning up the webhooks" + type: string + label: Webhook Cleanup Image + group: "Rancher webhook cleanup settings" + - variable: rancherTurtles.features.rancher-kubeconfigs.label + default: false + description: "(Experimental) Specify that the kubeconfigs generated by Rancher should be automatically patched to contain the CAPI expected labels" + type: boolean + label: Label Rancher Kubeconfigs + group: "Rancher Turtles Features Settings" + - variable: rancherTurtles.features.managementv3-cluster.enabled + default: true + description: "Use v3/management cluster manifest for import, instead of v1/provisioning" + type: boolean + label: Use management v3 cluster manifest + group: "Rancher Turtles Features Settings" + - variable: rancherTurtles.features.managementv3-cluster-migration.enabled + default: false + description: "Automatically migrate between provisioning and management clusters on upgrade" + type: boolean + label: All imported clusters will use new cluster manifest, replacing old cluster manifest. + group: "Rancher Turtles Features Settings" + - variable: cluster-api-operator.cluster-api.rke2.enabled + default: "true" + description: "Flag to enable or disable installation of the RKE2 provider for Cluster API. By default this is enabled." + label: "Enable RKE2 Provider" + type: boolean + - variable: rancherTurtles.features.propagate-labels.enabled + default: false + description: "(Experimental) Specify that the labels from CAPI should be propagated to Rancher" + type: boolean + label: Propagate CAPI Labels + group: "Rancher Turtles Features Settings" + - variable: rancherTurtles.features.addon-provider-fleet.enabled + default: false + description: "Enable Fleet Addon Provider functionality in Rancher Turtles" + type: boolean + label: Seamless integration with Fleet and CAPI + group: "Rancher Turtles Features Settings" diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/templates/addon-provider-fleet.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/templates/addon-provider-fleet.yaml new file mode 100644 index 00000000..211fcd7e --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/templates/addon-provider-fleet.yaml @@ -0,0 +1,44 @@ +{{- if index .Values "rancherTurtles" "features" "addon-provider-fleet" "enabled" }} +--- +apiVersion: turtles-capi.cattle.io/v1alpha1 +kind: CAPIProvider +metadata: + name: fleet + namespace: '{{ .Values.rancherTurtles.namespace }}' + annotations: + "helm.sh/hook": "post-install, post-upgrade" + "helm.sh/hook-weight": "2" +spec: + type: addon + additionalManifests: + name: fleet-addon-config + namespace: '{{ .Values.rancherTurtles.namespace }}' +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: fleet-addon-config + namespace: '{{ .Values.rancherTurtles.namespace }}' + annotations: + "helm.sh/hook": "post-install, post-upgrade" + "helm.sh/hook-weight": "2" +data: + manifests: |- + apiVersion: addons.cluster.x-k8s.io/v1alpha1 + kind: FleetAddonConfig + metadata: + name: fleet-addon-config + spec: + clusterClass: + patchResource: true + setOwnerReferences: true + cluster: + patchResource: true + setOwnerReferences: true + selector: + matchLabels: + cluster-api.cattle.io/rancher-auto-import: "true" + namespaceSelector: + matchLabels: + cluster-api.cattle.io/rancher-auto-import: "true" +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/templates/azure-rbac.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/templates/azure-rbac.yaml new file mode 100644 index 00000000..4cd993c7 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/templates/azure-rbac.yaml @@ -0,0 +1,19 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: caprke2-azure-aggregated-role + labels: + cluster.x-k8s.io/aggregate-to-capz-manager: "true" +rules: +- apiGroups: + - bootstrap.cluster.x-k8s.io + resources: + - rke2configs + verbs: + - create + - update + - delete + - get + - list + - patch + - watch \ No newline at end of file diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/templates/clusterctl-config.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/templates/clusterctl-config.yaml new file mode 100644 index 00000000..616c4626 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/templates/clusterctl-config.yaml @@ -0,0 +1,34 @@ +{{- if index .Values "cluster-api-operator" "enabled" }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: clusterctl-config + namespace: '{{ .Values.rancherTurtles.namespace }}' +data: + clusterctl.yaml: | + providers: + # Cluster API core provider + - name: "cluster-api" + url: "https://github.com/kubernetes-sigs/cluster-api/releases/v1.7.5/core-components.yaml" + type: "CoreProvider" + + # Infrastructure providers + - name: "metal3" + url: "https://github.com/metal3-io/cluster-api-provider-metal3/releases/v1.7.1/infrastructure-components.yaml" + type: "InfrastructureProvider" + + # Bootstrap providers + - name: "rke2" + url: "https://github.com/rancher/cluster-api-provider-rke2/releases/v0.7.0/bootstrap-components.yaml" + type: "BootstrapProvider" + + # ControlPlane providers + - name: "rke2" + url: "https://github.com/rancher/cluster-api-provider-rke2/releases/v0.7.0/control-plane-components.yaml" + type: "ControlPlaneProvider" + + # Addon providers +# - name: "fleet" +# url: "https://github.com/rancher-sandbox/cluster-api-addon-provider-fleet/releases/v0.3.1/addon-components.yaml" +# type: "AddonProvider" +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/templates/core-provider.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/templates/core-provider.yaml new file mode 100644 index 00000000..07337658 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/templates/core-provider.yaml @@ -0,0 +1,82 @@ +{{- if index .Values "cluster-api-operator" "cluster-api" "enabled" }} +{{- $namespace := index .Values "cluster-api-operator" "cluster-api" "core" "namespace" }} +{{- if not (lookup "v1" "Namespace" "" $namespace) }} +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + "helm.sh/hook": "post-install, post-upgrade" + "helm.sh/hook-weight": "1" + name: {{ index .Values "cluster-api-operator" "cluster-api" "core" "namespace" }} +{{- end }} +--- +apiVersion: turtles-capi.cattle.io/v1alpha1 +kind: CAPIProvider +metadata: + name: cluster-api + namespace: {{ index .Values "cluster-api-operator" "cluster-api" "core" "namespace" }} + annotations: + "helm.sh/hook": "post-install, post-upgrade" + "helm.sh/hook-weight": "2" +spec: + name: cluster-api + type: core + version: {{ index .Values "cluster-api-operator" "cluster-api" "version" }} + additionalManifests: + name: capi-additional-rbac-roles + namespace: {{ index .Values "cluster-api-operator" "cluster-api" "core" "namespace" }} + configSecret: +{{- if index .Values "cluster-api-operator" "cluster-api" "configSecret" "name" }} + name: {{ index .Values "cluster-api-operator" "cluster-api" "configSecret" "name" }} +{{ else }} + name: {{ index .Values "cluster-api-operator" "cluster-api" "configSecret" "defaultName" }} +{{- end }} +{{- if or (index .Values "cluster-api-operator" "cluster-api" "core" "fetchConfig" "url") (index .Values "cluster-api-operator" "cluster-api" "core" "fetchConfig" "selector") }} + fetchConfig: + {{- if index .Values "cluster-api-operator" "cluster-api" "core" "fetchConfig" "url" }} + url: {{ index .Values "cluster-api-operator" "cluster-api" "core" "fetchConfig" "url" }} + {{- end }} + {{- if index .Values "cluster-api-operator" "cluster-api" "core" "fetchConfig" "selector" }} + selector: {{ index .Values "cluster-api-operator" "cluster-api" "core" "fetchConfig" "selector" }} + {{- end }} +{{- end }} +{{- if index .Values "cluster-api-operator" "cluster-api" "core" "imageUrl" }} + deployment: + containers: + - name: manager + imageUrl: {{ index .Values "cluster-api-operator" "cluster-api" "core" "imageUrl" }} +{{- end }} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: capi-additional-rbac-roles + namespace: {{ index .Values "cluster-api-operator" "cluster-api" "core" "namespace" }} + annotations: + "helm.sh/hook": "post-install, post-upgrade" + "helm.sh/hook-weight": "2" +data: + manifests: |- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + name: provisioning-rke-cattle-io + labels: + cluster.x-k8s.io/aggregate-to-manager: "true" + rules: + - apiGroups: ["rke.cattle.io"] + resources: ["*"] + verbs: ["*"] + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + name: provisioning-rke-machine-cattle-io + labels: + cluster.x-k8s.io/aggregate-to-manager: "true" + rules: + - apiGroups: ["rke-machine.cattle.io"] + resources: ["*"] + verbs: ["*"] +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/templates/deployment.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/templates/deployment.yaml new file mode 100644 index 00000000..c184f54c --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/templates/deployment.yaml @@ -0,0 +1,80 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + control-plane: controller-manager + name: rancher-turtles-controller-manager + namespace: '{{ .Values.rancherTurtles.namespace }}' +spec: + replicas: 1 + selector: + matchLabels: + control-plane: controller-manager + template: + metadata: + annotations: + kubectl.kubernetes.io/default-container: manager + labels: + control-plane: controller-manager + spec: + {{- if .Values.rancherTurtles.imagePullSecrets }} + imagePullSecrets: + {{- range .Values.rancherTurtles.imagePullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} + containers: + - args: + - --leader-elect + - --feature-gates=etcd-snapshot-restore={{ index .Values "rancherTurtles" "features" "etcd-snapshot-restore" "enabled"}},propagate-labels={{ index .Values "rancherTurtles" "features" "propagate-labels" "enabled"}},managementv3-cluster={{ index .Values "rancherTurtles" "features" "managementv3-cluster" "enabled"}},rancher-kube-secret-patch={{ index .Values "rancherTurtles" "features" "rancher-kubeconfigs" "label"}} + {{- range .Values.rancherTurtles.managerArguments }} + - {{ . }} + {{- end }} + command: + - /manager + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: POD_UID + valueFrom: + fieldRef: + fieldPath: metadata.uid + {{- if (contains "sha256:" .Values.rancherTurtles.imageVersion) }} + image: '{{ .Values.rancherTurtles.image }}@{{ .Values.rancherTurtles.imageVersion }}' + {{- else }} + image: '{{ .Values.rancherTurtles.image }}:{{ .Values.rancherTurtles.imageVersion }}' + {{- end}} + imagePullPolicy: '{{ .Values.rancherTurtles.imagePullPolicy }}' + livenessProbe: + httpGet: + path: /healthz + port: 9440 + initialDelaySeconds: 15 + periodSeconds: 20 + name: manager + readinessProbe: + httpGet: + path: /readyz + port: 9440 + initialDelaySeconds: 5 + periodSeconds: 10 + resources: + limits: + cpu: 500m + memory: 128Mi + requests: + cpu: 10m + memory: 64Mi + serviceAccountName: rancher-turtles-manager + terminationGracePeriodSeconds: 10 + tolerations: + - effect: NoSchedule + key: node-role.kubernetes.io/master + - effect: NoSchedule + key: node-role.kubernetes.io/control-plane diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/templates/metal3-infrastructure.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/templates/metal3-infrastructure.yaml new file mode 100644 index 00000000..e8366d54 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/templates/metal3-infrastructure.yaml @@ -0,0 +1,55 @@ +{{- if and (index .Values "cluster-api-operator" "cluster-api" "enabled") (index .Values "cluster-api-operator" "cluster-api" "metal3" "enabled") }} +{{- $namespace := index .Values "cluster-api-operator" "cluster-api" "metal3" "infrastructure" "namespace" }} +{{- if not (lookup "v1" "Namespace" "" $namespace) }} +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + "helm.sh/hook": "post-install, post-upgrade" + "helm.sh/hook-weight": "1" + name: {{ index .Values "cluster-api-operator" "cluster-api" "metal3" "infrastructure" "namespace" }} +{{- end }} +--- +apiVersion: turtles-capi.cattle.io/v1alpha1 +kind: CAPIProvider +metadata: + name: metal3 + namespace: {{ index .Values "cluster-api-operator" "cluster-api" "metal3" "infrastructure" "namespace" }} + annotations: + "helm.sh/hook": "post-install, post-upgrade" + "helm.sh/hook-weight": "2" +spec: + name: metal3 + type: infrastructure +{{- if index .Values "cluster-api-operator" "cluster-api" "rke2" "version" }} + version: {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "version" }} +{{- end }} + configSecret: +{{- if index .Values "cluster-api-operator" "cluster-api" "configSecret" "name" }} + name: {{ index .Values "cluster-api-operator" "cluster-api" "configSecret" "name" }} +{{ else }} + name: {{ index .Values "cluster-api-operator" "cluster-api" "configSecret" "defaultName" }} +{{- end }} +{{- if or (index .Values "cluster-api-operator" "cluster-api" "metal3" "infrastructure" "fetchConfig" "url") (index .Values "cluster-api-operator" "cluster-api" "metal3" "infrastructure" "fetchConfig" "selector") }} + fetchConfig: + {{- if index .Values "cluster-api-operator" "cluster-api" "metal3" "infrastructure" "fetchConfig" "url" }} + url: {{ index .Values "cluster-api-operator" "cluster-api" "metal3" "infrastructure" "fetchConfig" "url" }} + {{- end }} + {{- if index .Values "cluster-api-operator" "cluster-api" "metal3" "infrastructure" "fetchConfig" "selector" }} + selector: {{ index .Values "cluster-api-operator" "cluster-api" "metal3" "infrastructure" "fetchConfig" "selector" }} + {{- end }} +{{- end }} +{{- if index .Values "cluster-api-operator" "cluster-api" "metal3" "infrastructure" "imageUrl" }} + deployment: + containers: + - name: manager + imageUrl: {{ index .Values "cluster-api-operator" "cluster-api" "metal3" "infrastructure" "imageUrl" }} + additionalDeployments: + ipam-controller-manager: + deployment: + containers: + - imageUrl: {{ index .Values "cluster-api-operator" "cluster-api" "metal3" "ipam" "imageUrl" }} + name: manager +{{- end }} +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/templates/post-delete-job.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/templates/post-delete-job.yaml new file mode 100644 index 00000000..9eedb993 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/templates/post-delete-job.yaml @@ -0,0 +1,166 @@ +{{- if index .Values "rancherTurtles" "features" "cluster-api-operator" "cleanup" }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: post-delete-job + namespace: '{{ .Values.rancherTurtles.namespace }}' + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "1" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: post-delete-job-delete-webhooks + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "1" +rules: +- apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + - mutatingwebhookconfigurations + verbs: + - delete +- apiGroups: + - apps + resources: + - deployments + verbs: + - delete +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: post-delete-job-webhook-cleanup + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "1" +subjects: + - kind: ServiceAccount + name: post-delete-job + namespace: rancher-turtles-system +roleRef: + kind: ClusterRole + name: post-delete-job-delete-webhooks + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: cluster-api-operator-mutatingwebhook-cleanup + namespace: '{{ .Values.rancherTurtles.namespace }}' + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "2" +spec: + ttlSecondsAfterFinished: 300 + template: + spec: + serviceAccountName: post-delete-job + containers: + - name: cluster-api-operator-mutatingwebhook-cleanup + image: {{ index .Values "rancherTurtles" "features" "cluster-api-operator" "kubectlImage" }} + command: ["kubectl"] + args: + - delete + - mutatingwebhookconfigurations.admissionregistration.k8s.io + - capi-mutating-webhook-configuration + - capi-kubeadm-bootstrap-mutating-webhook-configuration + - capi-kubeadm-control-plane-mutating-webhook-configuration + - rke2-bootstrap-mutating-webhook-configuration + - rke2-control-plane-mutating-webhook-configuration + - --ignore-not-found=true + restartPolicy: Never +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: cluster-api-operator-validatingwebhook-cleanup + namespace: '{{ .Values.rancherTurtles.namespace }}' + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "2" +spec: + ttlSecondsAfterFinished: 300 + template: + spec: + serviceAccountName: post-delete-job + containers: + - name: cluster-api-operator-validatingwebhook-cleanup + image: {{ index .Values "rancherTurtles" "features" "cluster-api-operator" "kubectlImage" }} + command: ["kubectl"] + args: + - delete + - validatingwebhookconfigurations.admissionregistration.k8s.io + - capi-validating-webhook-configuration + - capi-kubeadm-bootstrap-validating-webhook-configuration + - capi-kubeadm-control-plane-validating-webhook-configuration + - rke2-bootstrap-validating-webhook-configuration + - rke2-control-plane-validating-webhook-configuration + - --ignore-not-found=true + restartPolicy: Never +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: cluster-api-operator-deployment-cleanup + namespace: '{{ .Values.rancherTurtles.namespace }}' + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "2" +spec: + ttlSecondsAfterFinished: 300 + template: + spec: + serviceAccountName: post-delete-job + restartPolicy: Never + containers: + - name: delete-capi-controller-manager + image: {{ index .Values "rancherTurtles" "features" "cluster-api-operator" "kubectlImage" }} + command: ["kubectl"] + args: + - delete + - deployments.apps/capi-controller-manager + - -n + - {{ index .Values "cluster-api-operator" "cluster-api" "core" "namespace" }} + - --ignore-not-found=true + - name: delete-capi-kubeadm-bootstrap-controller-manager + image: {{ index .Values "rancherTurtles" "features" "cluster-api-operator" "kubectlImage" }} + command: ["kubectl"] + args: + - delete + - deployments.apps/capi-kubeadm-bootstrap-controller-manager + - -n + - capi-kubeadm-bootstrap-system + - --ignore-not-found=true + - name: delete-capi-kubeadm-control-plane-controller-manager + image: {{ index .Values "rancherTurtles" "features" "cluster-api-operator" "kubectlImage" }} + command: ["kubectl"] + args: + - delete + - deployments.apps/capi-kubeadm-control-plane-controller-manager + - -n + - capi-kubeadm-control-plane-system + - --ignore-not-found=true + - name: delete-rke2-kubeadm-bootstrap-controller-manager + image: {{ index .Values "rancherTurtles" "features" "cluster-api-operator" "kubectlImage" }} + command: ["kubectl"] + args: + - delete + - deployments.apps/rke2-bootstrap-controller-manager + - -n + - {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "bootstrap" "namespace" }} + - --ignore-not-found=true + - name: delete-rke2-control-plane-controller-manager + image: {{ index .Values "rancherTurtles" "features" "cluster-api-operator" "kubectlImage" }} + command: ["kubectl"] + args: + - delete + - deployments.apps/rke2-control-plane-controller-manager + - -n + - {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "controlPlane" "namespace" }} + - --ignore-not-found=true +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/templates/post-upgrade-job.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/templates/post-upgrade-job.yaml new file mode 100644 index 00000000..b0915bcd --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/templates/post-upgrade-job.yaml @@ -0,0 +1,78 @@ +{{- if eq (index .Values "rancherTurtles" "features" "managementv3-cluster-migration" "enabled") true }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: post-upgrade-job + namespace: rancher-turtles-system + annotations: + "helm.sh/hook": post-upgrade + "helm.sh/hook-weight": "1" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: post-upgrade-job-delete-clusters + annotations: + "helm.sh/hook": post-upgrade + "helm.sh/hook-weight": "1" +rules: +- apiGroups: + - provisioning.cattle.io + resources: + - clusters + verbs: + - list + - delete +- apiGroups: + - management.cattle.io + resources: + - clusters + verbs: + - list + - delete +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: post-upgrade-job-delete-clusters + annotations: + "helm.sh/hook": post-upgrade + "helm.sh/hook-weight": "1" +subjects: + - kind: ServiceAccount + name: post-upgrade-job + namespace: rancher-turtles-system +roleRef: + kind: ClusterRole + name: post-upgrade-job-delete-clusters + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: post-upgrade-delete-clusters + annotations: + "helm.sh/hook": post-upgrade + "helm.sh/hook-weight": "2" +spec: + ttlSecondsAfterFinished: 300 + template: + spec: + serviceAccountName: post-upgrade-job + containers: + - name: post-upgrade-delete-clusters + image: {{ index .Values "rancherTurtles" "features" "rancher-webhook" "kubectlImage" }} + args: + - delete + {{- if eq (index .Values "rancherTurtles" "features" "managementv3-cluster" "enabled") true }} + - clusters.provisioning.cattle.io + {{- else }} + - clusters.management.cattle.io + {{- end }} + - --selector=cluster-api.cattle.io/owned + - -A + - --ignore-not-found=true + - --wait + restartPolicy: OnFailure +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/templates/pre-delete-job.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/templates/pre-delete-job.yaml new file mode 100644 index 00000000..0ba6b5a0 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/templates/pre-delete-job.yaml @@ -0,0 +1,67 @@ +{{- if index .Values "rancherTurtles" "features" "rancher-webhook" "cleanup" }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: pre-delete-job + namespace: rancher-turtles-system + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-weight": "-2" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: pre-delete-job-delete-capiproviders + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-weight": "-2" +rules: +- apiGroups: + - turtles-capi.cattle.io + resources: + - capiproviders + verbs: + - list + - delete +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: pre-delete-job-capiprovider-cleanup + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-weight": "-2" +subjects: + - kind: ServiceAccount + name: pre-delete-job + namespace: rancher-turtles-system +roleRef: + kind: ClusterRole + name: pre-delete-job-delete-capiproviders + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: rancher-capiprovider-cleanup + namespace: rancher-turtles-system + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-weight": "-1" +spec: + ttlSecondsAfterFinished: 300 + template: + spec: + serviceAccountName: pre-delete-job + containers: + - name: rancher-capiprovider-cleanup + image: {{ index .Values "rancherTurtles" "features" "rancher-webhook" "kubectlImage" }} + args: + - delete + - capiproviders + - -A + - --all + - --cascade=foreground + restartPolicy: Never +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/templates/pre-install-job.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/templates/pre-install-job.yaml new file mode 100644 index 00000000..3253f4c1 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/templates/pre-install-job.yaml @@ -0,0 +1,99 @@ +{{- if index .Values "rancherTurtles" "features" "embedded-capi" "disabled" }} +--- +apiVersion: management.cattle.io/v3 +kind: Feature +metadata: + name: embedded-cluster-api + annotations: + "helm.sh/hook": pre-install + "helm.sh/hook-weight": "1" +spec: + value: false +{{- end }} +{{- if index .Values "rancherTurtles" "features" "rancher-webhook" "cleanup" }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: pre-install-job + namespace: rancher-turtles-system + annotations: + "helm.sh/hook": pre-install + "helm.sh/hook-weight": "1" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: pre-install-job-delete-webhooks + annotations: + "helm.sh/hook": pre-install + "helm.sh/hook-weight": "1" +rules: +- apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + - mutatingwebhookconfigurations + verbs: + - delete +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: pre-install-job-webhook-cleanup + annotations: + "helm.sh/hook": pre-install + "helm.sh/hook-weight": "1" +subjects: + - kind: ServiceAccount + name: pre-install-job + namespace: rancher-turtles-system +roleRef: + kind: ClusterRole + name: pre-install-job-delete-webhooks + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: rancher-mutatingwebhook-cleanup + annotations: + "helm.sh/hook": pre-install + "helm.sh/hook-weight": "2" +spec: + ttlSecondsAfterFinished: 300 + template: + spec: + serviceAccountName: pre-install-job + containers: + - name: rancher-mutatingwebhook-cleanup + image: {{ index .Values "rancherTurtles" "features" "rancher-webhook" "kubectlImage" }} + args: + - delete + - mutatingwebhookconfigurations.admissionregistration.k8s.io + - mutating-webhook-configuration + - --ignore-not-found=true + restartPolicy: Never +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: rancher-validatingwebhook-cleanup + annotations: + "helm.sh/hook": pre-install + "helm.sh/hook-weight": "2" +spec: + ttlSecondsAfterFinished: 300 + template: + spec: + serviceAccountName: pre-install-job + containers: + - name: rancher-validatingwebhook-cleanup + image: {{ index .Values "rancherTurtles" "features" "rancher-webhook" "kubectlImage" }} + args: + - delete + - validatingwebhookconfigurations.admissionregistration.k8s.io + - validating-webhook-configuration + - --ignore-not-found=true + restartPolicy: Never +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/templates/rancher-turtles-components.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/templates/rancher-turtles-components.yaml new file mode 100644 index 00000000..77b8e4fc --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/templates/rancher-turtles-components.yaml @@ -0,0 +1,3338 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.14.0 + helm.sh/resource-policy: keep + name: capiproviders.turtles-capi.cattle.io +spec: + group: turtles-capi.cattle.io + names: + kind: CAPIProvider + listKind: CAPIProviderList + plural: capiproviders + singular: capiprovider + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.type + name: Type + type: string + - jsonPath: .spec.name + name: ProviderName + type: string + - jsonPath: .status.installedVersion + name: InstalledVersion + type: string + - jsonPath: .status.phase + name: Phase + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: CAPIProvider is the Schema for the CAPI Providers API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: CAPIProviderSpec defines the desired state of CAPIProvider. + example: + credentials: + rancherCloudCredential: user-credential + name: aws + type: infrastructure + version: v2.3.0 + properties: + additionalDeployments: + additionalProperties: + description: |- + AdditionalDeployments defines the properties that can be enabled on the controller + manager and deployment for the provider if the provider is managing additional deployments. + properties: + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the additional provider deployment. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules + for the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated + with the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching + the corresponding nodeSelectorTerm, in the + range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector + terms. The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that + the selector applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules + (e.g. co-locate this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling + rules (e.g. avoid putting this pod in the same node, + zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched + WeightedPodAffinityTerm fields are added per-node + to find the most preferred node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, + associated with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a + list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label + key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set + in the container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. + Must be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the + FieldPath is written in terms of, + defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format + of the exposed resources, defaults + to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in + the pod's namespace + properties: + key: + description: The key of the secret to + select from. Must be a valid secret + key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the + Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to + distinguish between explicit zero and not specified. Defaults + to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + manager: + description: Manager defines the properties that can be enabled + on the controller manager for the additional provider deployment. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should + be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + type: object + description: |- + AdditionalDeployments is a map of additional deployments that the provider + should manage. The key is the name of the deployment and the value is the + DeploymentSpec. + type: object + additionalManifests: + description: |- + AdditionalManifests is reference to configmap that contains additional manifests that will be applied + together with the provider components. The key for storing these manifests has to be `manifests`. + The manifests are applied only once when a certain release is installed/upgraded. If namespace is not specified, the + namespace of the provider will be used. There is no validation of the yaml content inside the configmap. + properties: + name: + description: Name defines the name of the configmap. + type: string + namespace: + description: Namespace defines the namespace of the configmap. + type: string + required: + - name + type: object + configSecret: + description: |- + ConfigSecret is the object with name and namespace of the Secret providing + the configuration variables for the current provider instance, like e.g. credentials. + Such configurations will be used when creating or upgrading provider components. + The contents of the secret will be treated as immutable. If changes need + to be made, a new object can be created and the name should be updated. + The contents should be in the form of key:value. This secret must be in + the same namespace as the provider. + properties: + name: + description: Name defines the name of the secret. + type: string + namespace: + description: Namespace defines the namespace of the secret. + type: string + required: + - name + type: object + credentials: + description: Credentials is the structure holding the credentials + to use for the provider. Only one credential type could be set at + a time. + example: + rancherCloudCredential: user-credential + maxProperties: 1 + minProperties: 1 + properties: + rancherCloudCredential: + description: RancherCloudCredential is the Rancher Cloud Credential + name + type: string + rancherCloudCredentialNamespaceName: + description: RancherCloudCredentialNamespaceName is the Rancher + Cloud Credential namespace:name reference + type: string + type: object + x-kubernetes-map-type: atomic + x-kubernetes-validations: + - message: rancherCloudCredentialNamespaceName should be in the namespace:name + format. + rule: '!has(self.rancherCloudCredentialNamespaceName) || self.rancherCloudCredentialNamespaceName.matches(''^.+:.+$'')' + deployment: + description: Deployment defines the properties that can be enabled + on the deployment for the provider. + properties: + affinity: + description: If specified, the pod's scheduling constraints + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + containers: + description: List of containers specified in the Deployment + items: + description: |- + ContainerSpec defines the properties available to override for each + container in a provider deployment such as Image and Args to the container’s + entrypoint. + properties: + args: + additionalProperties: + type: string + description: |- + Args represents extra provider specific flags that are not encoded as fields in this API. + Explicit controller manager properties defined in the `Provider.ManagerSpec` + will have higher precedence than those defined in `ContainerSpec.Args`. + For example, `ManagerSpec.SyncPeriod` will be used instead of the + container arg `--sync-period` if both are defined. + The same holds for `ManagerSpec.FeatureGates` and `--feature-gates`. + type: object + command: + description: Command allows override container's entrypoint + array. + items: + type: string + type: array + env: + description: List of environment variables to set in the + container. + items: + description: EnvVar represents an environment variable + present in a Container. + properties: + name: + description: Name of the environment variable. Must + be a C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + imageUrl: + description: Container Image URL + type: string + name: + description: Name of the container. Cannot be updated. + type: string + resources: + description: Compute resources required by this container. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in + PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + required: + - name + type: object + type: array + imagePullSecrets: + description: List of image pull secrets specified in the Deployment + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + type: array + nodeSelector: + additionalProperties: + type: string + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + replicas: + description: Number of desired pods. This is a pointer to distinguish + between explicit zero and not specified. Defaults to 1. + minimum: 0 + type: integer + serviceAccountName: + description: If specified, the pod's service account + type: string + tolerations: + description: If specified, the pod's tolerations. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + features: + description: Features is a collection of features to enable. + example: + clusterResourceSet: true + clusterTopology: true + machinePool: true + properties: + clusterResourceSet: + description: ClusterResourceSet if set to true will enable the + cluster resource set feature. + type: boolean + clusterTopology: + description: ClusterTopology if set to true will enable the clusterclass + feature. + type: boolean + machinePool: + description: MachinePool if set to true will enable the machine + pool feature. + type: boolean + type: object + fetchConfig: + description: |- + FetchConfig determines how the operator will fetch the components and metadata for the provider. + If nil, the operator will try to fetch components according to default + embedded fetch configuration for the given kind and `ObjectMeta.Name`. + For example, the infrastructure name `aws` will fetch artifacts from + https://github.com/kubernetes-sigs/cluster-api-provider-aws/releases. + properties: + selector: + description: |- + Selector to be used for fetching provider’s components and metadata from + ConfigMaps stored inside the cluster. Each ConfigMap is expected to contain + components and metadata for a specific version only. + Note: the name of the ConfigMap should be set to the version or to override this + add a label like the following: provider.cluster.x-k8s.io/version=v1.4.3 + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + url: + description: |- + URL to be used for fetching the provider’s components and metadata from a remote Github repository. + For example, https://github.com/{owner}/{repository}/releases + You must set `providerSpec.Version` field for operator to pick up + desired version of the release from GitHub. + type: string + type: object + manager: + description: Manager defines the properties that can be enabled on + the controller manager for the provider. + properties: + cacheNamespace: + description: |- + CacheNamespace if specified restricts the manager's cache to watch objects in + the desired namespace Defaults to all namespaces + + + Note: If a namespace is specified, controllers can still Watch for a + cluster-scoped resource (e.g Node). For namespaced resources the cache + will only hold objects from the desired namespace. + type: string + controller: + description: |- + Controller contains global configuration options for controllers + registered within this manager. + properties: + cacheSyncTimeout: + description: |- + CacheSyncTimeout refers to the time limit set to wait for syncing caches. + Defaults to 2 minutes if not set. + format: int64 + type: integer + groupKindConcurrency: + additionalProperties: + type: integer + description: |- + GroupKindConcurrency is a map from a Kind to the number of concurrent reconciliation + allowed for that controller. + + + When a controller is registered within this manager using the builder utilities, + users have to specify the type the controller reconciles in the For(...) call. + If the object's kind passed matches one of the keys in this map, the concurrency + for that controller is set to the number specified. + + + The key is expected to be consistent in form with GroupKind.String(), + e.g. ReplicaSet in apps group (regardless of version) would be `ReplicaSet.apps`. + type: object + recoverPanic: + description: RecoverPanic indicates if panics should be recovered. + type: boolean + type: object + featureGates: + additionalProperties: + type: boolean + description: |- + FeatureGates define provider specific feature flags that will be passed + in as container args to the provider's controller manager. + Controller Manager flag is --feature-gates. + type: object + gracefulShutDown: + description: |- + GracefulShutdownTimeout is the duration given to runnable to stop before the manager actually returns on stop. + To disable graceful shutdown, set to time.Duration(0) + To use graceful shutdown without timeout, set to a negative duration, e.G. time.Duration(-1) + The graceful shutdown is skipped for safety reasons in case the leader election lease is lost. + type: string + health: + description: Health contains the controller health configuration + properties: + healthProbeBindAddress: + description: |- + HealthProbeBindAddress is the TCP address that the controller should bind to + for serving health probes + It can be set to "0" or "" to disable serving the health probe. + type: string + livenessEndpointName: + description: LivenessEndpointName, defaults to "healthz" + type: string + readinessEndpointName: + description: ReadinessEndpointName, defaults to "readyz" + type: string + type: object + leaderElection: + description: |- + LeaderElection is the LeaderElection config to be used when configuring + the manager.Manager leader election + properties: + leaderElect: + description: |- + leaderElect enables a leader election client to gain leadership + before executing the main loop. Enable this when running replicated + components for high availability. + type: boolean + leaseDuration: + description: |- + leaseDuration is the duration that non-leader candidates will wait + after observing a leadership renewal until attempting to acquire + leadership of a led but unrenewed leader slot. This is effectively the + maximum duration that a leader can be stopped before it is replaced + by another candidate. This is only applicable if leader election is + enabled. + type: string + renewDeadline: + description: |- + renewDeadline is the interval between attempts by the acting master to + renew a leadership slot before it stops leading. This must be less + than or equal to the lease duration. This is only applicable if leader + election is enabled. + type: string + resourceLock: + description: |- + resourceLock indicates the resource object type that will be used to lock + during leader election cycles. + type: string + resourceName: + description: |- + resourceName indicates the name of resource object that will be used to lock + during leader election cycles. + type: string + resourceNamespace: + description: |- + resourceName indicates the namespace of resource object that will be used to lock + during leader election cycles. + type: string + retryPeriod: + description: |- + retryPeriod is the duration the clients should wait between attempting + acquisition and renewal of a leadership. This is only applicable if + leader election is enabled. + type: string + required: + - leaderElect + - leaseDuration + - renewDeadline + - resourceLock + - resourceName + - resourceNamespace + - retryPeriod + type: object + maxConcurrentReconciles: + description: |- + MaxConcurrentReconciles is the maximum number of concurrent Reconciles + which can be run. + minimum: 1 + type: integer + metrics: + description: Metrics contains thw controller metrics configuration + properties: + bindAddress: + description: |- + BindAddress is the TCP address that the controller should bind to + for serving prometheus metrics. + It can be set to "0" to disable the metrics serving. + type: string + type: object + profilerAddress: + description: |- + ProfilerAddress defines the bind address to expose the pprof profiler (e.g. localhost:6060). + Default empty, meaning the profiler is disabled. + Controller Manager flag is --profiler-address. + type: string + syncPeriod: + description: |- + SyncPeriod determines the minimum frequency at which watched resources are + reconciled. A lower period will correct entropy more quickly, but reduce + responsiveness to change if there are many watched resources. Change this + value only if you know what you are doing. Defaults to 10 hours if unset. + there will a 10 percent jitter between the SyncPeriod of all controllers + so that all controllers will not send list requests simultaneously. + type: string + verbosity: + default: 1 + description: |- + Verbosity set the logs verbosity. Defaults to 1. + Controller Manager flag is --verbosity. + minimum: 0 + type: integer + webhook: + description: Webhook contains the controllers webhook configuration + properties: + certDir: + description: |- + CertDir is the directory that contains the server key and certificate. + if not set, webhook server would look up the server key and certificate in + {TempDir}/k8s-webhook-server/serving-certs. The server key and certificate + must be named tls.key and tls.crt, respectively. + type: string + host: + description: |- + Host is the hostname that the webhook server binds to. + It is used to set webhook.Server.Host. + type: string + port: + description: |- + Port is the port that the webhook server serves at. + It is used to set webhook.Server.Port. + type: integer + type: object + type: object + manifestPatches: + description: |- + ManifestPatches are applied to rendered provider manifests to customize the + provider manifests. Patches are applied in the order they are specified. + The `kind` field must match the target object, and + if `apiVersion` is specified it will only be applied to matching objects. + This should be an inline yaml blob-string https://datatracker.ietf.org/doc/html/rfc7396 + items: + type: string + type: array + name: + description: Name is the name of the provider to enable + example: aws + type: string + type: + description: Type is the type of the provider to enable + enum: + - infrastructure + - core + - controlPlane + - bootstrap + - addon + - runtimeextension + - ipam + example: infrastructure + type: string + variables: + additionalProperties: + type: string + description: Variables is a map of environment variables to add to + the content of the ConfigSecret + example: + CLUSTER_TOPOLOGY: "true" + EXP_CLUSTER_RESOURCE_SET: "true" + EXP_MACHINE_POOL: "true" + type: object + version: + description: Version indicates the provider version. + type: string + required: + - type + type: object + x-kubernetes-validations: + - message: 'CAPI Provider version should be in the semver format prefixed + with ''v''. Example: v1.9.3' + rule: '!has(self.version) || self.version.matches(r"""^v([0-9]+)\.([0-9]+)\.([0-9]+)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+)?$""")' + - message: Config secret namespace is always equal to the resource namespace + and should not be set. + rule: '!has(self.configSecret) || !has(self.configSecret.__namespace__)' + - message: One of fetchConfig url or selector should be set. + rule: '!has(self.fetchConfig) || [has(self.fetchConfig.url), has(self.fetchConfig.selector)].exists_one(e, + e)' + status: + default: {} + description: CAPIProviderStatus defines the observed state of CAPIProvider. + properties: + conditions: + description: Conditions define the current service state of the provider. + items: + description: Condition defines an observation of a Cluster API resource + operational state. + properties: + lastTransitionTime: + description: |- + Last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when + the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + A human readable message indicating details about the transition. + This field may be empty. + type: string + reason: + description: |- + The reason for the condition's last transition in CamelCase. + The specific API may choose whether or not this field is considered a guaranteed API. + This field may not be empty. + type: string + severity: + description: |- + Severity provides an explicit classification of Reason code, so the users or machines can immediately + understand the current situation and act accordingly. + The Severity field MUST be set only when Status=False. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: |- + Type of condition in CamelCase or in foo.example.com/CamelCase. + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions + can be useful (see .node.status.conditions), the ability to deconflict is important. + type: string + required: + - lastTransitionTime + - status + - type + type: object + type: array + contract: + description: |- + Contract will contain the core provider contract that the provider is + abiding by, like e.g. v1alpha4. + type: string + installedVersion: + description: InstalledVersion is the version of the provider that + is installed. + type: string + observedGeneration: + description: ObservedGeneration is the latest generation observed + by the controller. + format: int64 + type: integer + phase: + default: Pending + description: Indicates the provider status + type: string + variables: + additionalProperties: + type: string + default: + CLUSTER_TOPOLOGY: "true" + EXP_CLUSTER_RESOURCE_SET: "true" + EXP_MACHINE_POOL: "true" + description: Variables is a map of environment variables added to + the content of the ConfigSecret + type: object + type: object + type: object + x-kubernetes-validations: + - message: CAPI Provider type should always be set. + rule: has(self.spec.type) + served: true + storage: true + subresources: + status: {} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: rancher-turtles + app.kubernetes.io/instance: controller-manager-sa + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: serviceaccount + app.kubernetes.io/part-of: rancher-turtles + name: rancher-turtles-manager + namespace: '{{ .Values.rancherTurtles.namespace }}' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: rancher-turtles + app.kubernetes.io/instance: leader-election-role + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: role + app.kubernetes.io/part-of: rancher-turtles + name: rancher-turtles-leader-election-role + namespace: '{{ .Values.rancherTurtles.namespace }}' +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +--- +aggregationRule: + clusterRoleSelectors: + - matchLabels: + rancher-turtles/aggregate-to-manager: "true" +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: rancher-turtles-aggregated-manager-role +rules: [] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + rancher-turtles/aggregate-to-manager: "true" + name: rancher-turtles-manager-role +rules: +- apiGroups: + - "" + resources: + - configmaps + - events + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - namespaces + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - cluster.x-k8s.io + resources: + - clusters + - clusters/status + verbs: + - create + - get + - list + - patch + - update + - watch +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - get + - update +- apiGroups: + - infrastructure.cluster.x-k8s.io + resources: + - '*' + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - management.cattle.io + resources: + - clusterregistrationtokens + - clusterregistrationtokens/status + verbs: + - get + - list + - watch + - create +- apiGroups: + - management.cattle.io + resources: + - clusters + - clusters/status + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +- apiGroups: + - provisioning.cattle.io + resources: + - clusters + - clusters/status + verbs: + - create + - delete + - get + - list + - patch + - update + - watch +- apiGroups: + - turtles-capi.cattle.io + resources: + - capiproviders + - capiproviders/status + verbs: + - get + - list + - watch + - patch + - update +- apiGroups: + - operator.cluster.x-k8s.io + resources: + - '*' + verbs: + - create + - get + - list + - watch + - patch + - update + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: rancher-turtles + app.kubernetes.io/instance: leader-election-rolebinding + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: rolebinding + app.kubernetes.io/part-of: rancher-turtles + name: rancher-turtles-leader-election-rolebinding + namespace: '{{ .Values.rancherTurtles.namespace }}' +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: rancher-turtles-leader-election-role +subjects: +- kind: ServiceAccount + name: rancher-turtles-manager + namespace: '{{ .Values.rancherTurtles.namespace }}' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/component: rbac + app.kubernetes.io/created-by: rancher-turtles + app.kubernetes.io/instance: manager-rolebinding + app.kubernetes.io/managed-by: kustomize + app.kubernetes.io/name: clusterrolebinding + app.kubernetes.io/part-of: rancher-turtles + name: rancher-turtles-manager-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: rancher-turtles-aggregated-manager-role +subjects: +- kind: ServiceAccount + name: rancher-turtles-manager + namespace: '{{ .Values.rancherTurtles.namespace }}' diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/templates/rancher-turtles-exp-etcdrestore-components.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/templates/rancher-turtles-exp-etcdrestore-components.yaml new file mode 100644 index 00000000..7d450652 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/templates/rancher-turtles-exp-etcdrestore-components.yaml @@ -0,0 +1,123 @@ +{{- if index .Values "rancherTurtles" "features" "etcd-snapshot-restore" "enabled" }} +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.14.0 + name: etcdmachinesnapshots.turtles-capi.cattle.io +spec: + group: turtles-capi.cattle.io + names: + kind: EtcdMachineSnapshot + listKind: EtcdMachineSnapshotList + plural: etcdmachinesnapshots + singular: etcdmachinesnapshot + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: EtcdMachineSnapshot is the Schema for the EtcdMachineSnapshot + API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: EtcdMachineSnapshotSpec defines the desired state of EtcdMachineSnapshot. + properties: + foo: + type: string + required: + - foo + type: object + status: + default: {} + description: EtcdMachineSnapshotStatus defines observed state of EtcdMachineSnapshot. + properties: + bar: + type: string + required: + - bar + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.14.0 + name: etcdsnapshotrestores.turtles-capi.cattle.io +spec: + group: turtles-capi.cattle.io + names: + kind: EtcdSnapshotRestore + listKind: EtcdSnapshotRestoreList + plural: etcdsnapshotrestores + singular: etcdsnapshotrestore + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: EtcdSnapshotRestore is the schema for the EtcdSnapshotRestore + API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: EtcdSnapshotRestoreSpec defines the desired state of EtcdSnapshotRestore. + properties: + foo: + type: string + required: + - foo + type: object + status: + default: {} + description: EtcdSnapshotRestoreStatus defines observed state of EtcdSnapshotRestore. + properties: + bar: + type: string + required: + - bar + type: object + type: object + served: true + storage: true + subresources: + status: {} +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/templates/rke2-bootstrap.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/templates/rke2-bootstrap.yaml new file mode 100644 index 00000000..69b5f89f --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/templates/rke2-bootstrap.yaml @@ -0,0 +1,49 @@ +{{- if and (index .Values "cluster-api-operator" "cluster-api" "enabled") (index .Values "cluster-api-operator" "cluster-api" "rke2" "enabled") }} +{{- $namespace := index .Values "cluster-api-operator" "cluster-api" "rke2" "bootstrap" "namespace" }} +{{- if not (lookup "v1" "Namespace" "" $namespace) }} +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + "helm.sh/hook": "post-install, post-upgrade" + "helm.sh/hook-weight": "1" + name: {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "bootstrap" "namespace" }} +{{- end }} +--- +apiVersion: turtles-capi.cattle.io/v1alpha1 +kind: CAPIProvider +metadata: + name: rke2-bootstrap + namespace: {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "bootstrap" "namespace" }} + annotations: + "helm.sh/hook": "post-install, post-upgrade" + "helm.sh/hook-weight": "2" +spec: + name: rke2 + type: bootstrap +{{- if index .Values "cluster-api-operator" "cluster-api" "rke2" "version" }} + version: {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "version" }} +{{- end }} + configSecret: +{{- if index .Values "cluster-api-operator" "cluster-api" "configSecret" "name" }} + name: {{ index .Values "cluster-api-operator" "cluster-api" "configSecret" "name" }} +{{ else }} + name: {{ index .Values "cluster-api-operator" "cluster-api" "configSecret" "defaultName" }} +{{- end }} +{{- if or (index .Values "cluster-api-operator" "cluster-api" "rke2" "bootstrap" "fetchConfig" "url") (index .Values "cluster-api-operator" "cluster-api" "rke2" "bootstrap" "fetchConfig" "selector") }} + fetchConfig: + {{- if index .Values "cluster-api-operator" "cluster-api" "rke2" "bootstrap" "fetchConfig" "url" }} + url: {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "bootstrap" "fetchConfig" "url" }} + {{- end }} + {{- if index .Values "cluster-api-operator" "cluster-api" "rke2" "bootstrap" "fetchConfig" "selector" }} + selector: {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "bootstrap" "fetchConfig" "selector" }} + {{- end }} +{{- end }} +{{- if index .Values "cluster-api-operator" "cluster-api" "rke2" "bootstrap" "imageUrl" }} + deployment: + containers: + - name: manager + imageUrl: {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "bootstrap" "imageUrl" }} +{{- end }} +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/templates/rke2-controlplane.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/templates/rke2-controlplane.yaml new file mode 100644 index 00000000..d9c6b0fa --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/templates/rke2-controlplane.yaml @@ -0,0 +1,49 @@ +{{- if and (index .Values "cluster-api-operator" "cluster-api" "enabled") (index .Values "cluster-api-operator" "cluster-api" "rke2" "enabled") }} +{{- $namespace := index .Values "cluster-api-operator" "cluster-api" "rke2" "controlPlane" "namespace" }} +{{- if not (lookup "v1" "Namespace" "" $namespace) }} +--- +apiVersion: v1 +kind: Namespace +metadata: + annotations: + "helm.sh/hook": "post-install, post-upgrade" + "helm.sh/hook-weight": "1" + name: {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "controlPlane" "namespace" }} +{{- end }} +--- +apiVersion: turtles-capi.cattle.io/v1alpha1 +kind: CAPIProvider +metadata: + name: rke2-control-plane + namespace: {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "controlPlane" "namespace" }} + annotations: + "helm.sh/hook": "post-install, post-upgrade" + "helm.sh/hook-weight": "2" +spec: + name: rke2 + type: controlPlane +{{- if index .Values "cluster-api-operator" "cluster-api" "rke2" "version" }} + version: {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "version" }} +{{- end }} + configSecret: +{{- if index .Values "cluster-api-operator" "cluster-api" "configSecret" "name" }} + name: {{ index .Values "cluster-api-operator" "cluster-api" "configSecret" "name" }} +{{ else }} + name: {{ index .Values "cluster-api-operator" "cluster-api" "configSecret" "defaultName" }} +{{- end }} +{{- if or (index .Values "cluster-api-operator" "cluster-api" "rke2" "controlPlane" "fetchConfig" "url") (index .Values "cluster-api-operator" "cluster-api" "rke2" "controlPlane" "fetchConfig" "selector") }} + fetchConfig: + {{- if index .Values "cluster-api-operator" "cluster-api" "rke2" "controlPlane" "fetchConfig" "url" }} + url: {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "controlPlane" "fetchConfig" "url" }} + {{- end }} + {{- if index .Values "cluster-api-operator" "cluster-api" "rke2" "controlPlane" "fetchConfig" "selector" }} + selector: {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "controlPlane" "fetchConfig" "selector" }} + {{- end }} +{{- end }} +{{- if index .Values "cluster-api-operator" "cluster-api" "rke2" "controlPlane" "imageUrl" }} + deployment: + containers: + - name: manager + imageUrl: {{ index .Values "cluster-api-operator" "cluster-api" "rke2" "controlPlane" "imageUrl" }} +{{- end }} +{{- end }} diff --git a/charts/rancher-turtles/0.3.1+up0.11.0/values.yaml b/charts/rancher-turtles/0.3.1+up0.11.0/values.yaml new file mode 100644 index 00000000..e38879f4 --- /dev/null +++ b/charts/rancher-turtles/0.3.1+up0.11.0/values.yaml @@ -0,0 +1,86 @@ +rancherTurtles: + image: registry.rancher.com/rancher/rancher/turtles + imageVersion: v0.11.0 + imagePullPolicy: IfNotPresent + namespace: rancher-turtles-system + managerArguments: [] + imagePullSecrets: [] + features: + cluster-api-operator: + cleanup: true + kubectlImage: rancher/kubectl:v1.30.3 + embedded-capi: + disabled: false + rancher-webhook: + cleanup: false + kubectlImage: rancher/kubectl:v1.30.3 + rancher-kubeconfigs: + label: false + managementv3-cluster: + enabled: true + managementv3-cluster-migration: + enabled: false + propagate-labels: + enabled: false + etcd-snapshot-restore: + enabled: false + addon-provider-fleet: + enabled: false +cluster-api-operator: + enabled: true + cert-manager: + enabled: false + volumes: + - name: cert + secret: + defaultMode: 420 + secretName: capi-operator-webhook-service-cert + - name: clusterctl-config + configMap: + name: clusterctl-config + volumeMounts: + manager: + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: cert + readOnly: true + - mountPath: /config + name: clusterctl-config + readOnly: true + cluster-api: + enabled: true + configSecret: + name: "" + defaultName: capi-env-variables + core: + namespace: capi-system + imageUrl: "registry.opensuse.org/isv/suse/edge/clusterapi/containers/images/cluster-api-controller:1.7.5" + fetchConfig: + url: "" + selector: "" + rke2: + enabled: true + version: "" + bootstrap: + namespace: rke2-bootstrap-system + imageUrl: "registry.opensuse.org/isv/suse/edge/clusterapi/containers/images/cluster-api-provider-rke2-bootstrap:0.7.0" + fetchConfig: + url: "" + selector: "" + controlPlane: + namespace: rke2-control-plane-system + imageUrl: "registry.opensuse.org/isv/suse/edge/clusterapi/containers/images/cluster-api-provider-rke2-controlplane:0.7.0" + fetchConfig: + url: "" + selector: "" + metal3: + enabled: true + version: "" + infrastructure: + namespace: capm3-system + imageUrl: "registry.opensuse.org/isv/suse/edge/clusterapi/containers/images/cluster-api-provider-metal3:1.7.1" + fetchConfig: + url: "" + selector: "" + ipam: + namespace: capm3-system + imageUrl: "registry.opensuse.org/isv/suse/edge/clusterapi/containers/images/ip-address-manager:1.7.1" diff --git a/index.html b/index.html index cd2d0248..6c1036e8 100755 --- a/index.html +++ b/index.html @@ -311,14 +311,14 @@

Charts

- +

rancher-turtles - (0.3.0+up0.11.0@0.11.0) + (0.3.1+up0.11.0@0.11.0) github link @@ -333,14 +333,14 @@

Charts

- +

rancher-turtles-airgap-resources - (0.3.0@0.11.0) + (0.3.1@0.11.0) github link diff --git a/index.yaml b/index.yaml index 670b7d76..15b3b58c 100755 --- a/index.yaml +++ b/index.yaml @@ -1220,6 +1220,40 @@ entries: - assets/metallb/metallb-0.13.10.tgz version: 0.13.10 rancher-turtles: + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: Rancher Turtles - the Cluster API Extension + catalog.cattle.io/kube-version: '>= 1.23.0-0' + catalog.cattle.io/namespace: rancher-turtles-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux + catalog.cattle.io/rancher-version: '>= 2.9.0-1' + catalog.cattle.io/release-name: rancher-turtles + catalog.cattle.io/scope: management + catalog.cattle.io/type: cluster-tool + apiVersion: v2 + appVersion: 0.11.0 + created: "2024-09-27T17:17:49.305107+01:00" + dependencies: + - condition: cluster-api-operator.enabled + name: cluster-api-operator + repository: file://./charts/cluster-api-operator + version: 0.12.0 + description: Rancher Turtles is an extension to Rancher that brings full Cluster + API integration to Rancher. + digest: 33e35461a50a77b7c4220bf78b574e822118f0bd0121225642baed76f04bc588 + home: https://github.com/rancher/turtles/ + icon: https://raw.githubusercontent.com/rancher/turtles/main/logos/capi.svg + keywords: + - rancher + - cluster-api + - capi + - provisioning + name: rancher-turtles + type: application + urls: + - assets/rancher-turtles/rancher-turtles-0.3.1+up0.11.0.tgz + version: 0.3.1+up0.11.0 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/display-name: Rancher Turtles - the Cluster API Extension @@ -1323,6 +1357,18 @@ entries: - assets/rancher-turtles/rancher-turtles-0.1.0+up0.9.1.tgz version: 0.1.0+up0.9.1 rancher-turtles-airgap-resources: + - apiVersion: v2 + appVersion: 0.11.0 + created: "2024-09-27T17:17:49.465603+01:00" + description: Rancher Turtles utility chart for airgap scenarios + digest: 0065121225ab97f637de1b5fff24dd6174002c3f9c19fe87f29ba13ffd789962 + home: https://github.com/rancher/turtles/ + icon: https://raw.githubusercontent.com/rancher/turtles/main/logos/capi.svg + name: rancher-turtles-airgap-resources + type: application + urls: + - assets/rancher-turtles-airgap-resources/rancher-turtles-airgap-resources-0.3.1.tgz + version: 0.3.1 - apiVersion: v2 appVersion: 0.11.0 created: "2024-09-24T17:43:49.324908+01:00"