From 59b54cc96f417e51e9a63f05abfb01850d782a46 Mon Sep 17 00:00:00 2001 From: Jesse Sanford <108698+jessesanford@users.noreply.github.com> Date: Sat, 14 Sep 2024 00:04:39 -0400 Subject: [PATCH 01/18] use new backstage image that removes plugin-auth-backend-module-guest-provider and remove oauth scope Signed-off-by: Jesse Sanford <108698+jessesanford@users.noreply.github.com> --- ref-implementation/backstage/manifests/install.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/ref-implementation/backstage/manifests/install.yaml b/ref-implementation/backstage/manifests/install.yaml index 969bf39..dfe4ebd 100644 --- a/ref-implementation/backstage/manifests/install.yaml +++ b/ref-implementation/backstage/manifests/install.yaml @@ -148,7 +148,6 @@ data: metadataUrl: ${KEYCLOAK_NAME_METADATA} clientId: backstage clientSecret: ${KEYCLOAK_CLIENT_SECRET} - scope: 'openid profile email groups' prompt: auto scaffolder: @@ -264,7 +263,7 @@ spec: name: gitea-credentials - secretRef: name: argocd-credentials - image: ghcr.io/cnoe-io/backstage-app:b8e4f08914af17a48ed6b8b83a3621a9f4b4181d + image: ghcr.io/cnoe-io/backstage-app:f8b92b5067803554a4891fccd399326ac16db558 name: backstage ports: - containerPort: 7007 From ec7a5f6dc377a75123a9eafd2c798ebd8219cde8 Mon Sep 17 00:00:00 2001 From: Greg Haynes Date: Thu, 19 Sep 2024 17:02:01 -0700 Subject: [PATCH 02/18] Remove coredns config from ref-implementation (#37) Signed-off-by: Greg Haynes --- ref-implementation/coredns.yaml | 21 ------------ .../coredns/manifests/cm-coredns.yaml | 33 ------------------- 2 files changed, 54 deletions(-) delete mode 100644 ref-implementation/coredns.yaml delete mode 100644 ref-implementation/coredns/manifests/cm-coredns.yaml diff --git a/ref-implementation/coredns.yaml b/ref-implementation/coredns.yaml deleted file mode 100644 index ca46cd9..0000000 --- a/ref-implementation/coredns.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: Application -metadata: - name: coredns - namespace: argocd - labels: - env: dev -spec: - project: default - source: - repoURL: cnoe://coredns/manifests - targetRevision: HEAD - path: "." - destination: - server: "https://kubernetes.default.svc" - namespace: kube-system - syncPolicy: - syncOptions: - - CreateNamespace=true - automated: - selfHeal: true diff --git a/ref-implementation/coredns/manifests/cm-coredns.yaml b/ref-implementation/coredns/manifests/cm-coredns.yaml deleted file mode 100644 index 9cf733a..0000000 --- a/ref-implementation/coredns/manifests/cm-coredns.yaml +++ /dev/null @@ -1,33 +0,0 @@ -# the only purpose of this is to resolve external DNS entries such as `redesigned-bassoon-r4jjwpvv99vhx9gp-8080.app.github.dev` to a cluster IP -# normally, `redesigned-bassoon-r4jjwpvv99vhx9gp-8080.app.github.dev` resolves to 127.0.0.1 and thus oidc endpoint configurations cannot be obtained. -# in addition, we need to ensure traffic do not go out of cluster when not necessary. -apiVersion: v1 -kind: ConfigMap -metadata: - name: coredns - namespace: kube-system -data: - Corefile: | - .:53 { - errors - health { - lameduck 5s - } - ready - - rewrite name cnoe.localtest.me ingress-nginx-controller.ingress-nginx.svc.cluster.local - - kubernetes cluster.local in-addr.arpa ip6.arpa { - pods insecure - fallthrough in-addr.arpa ip6.arpa - ttl 30 - } - prometheus :9153 - forward . /etc/resolv.conf { - max_concurrent 1000 - } - cache 30 - loop - reload - loadbalance - } From 148f518526368aaa8a5b70892d5efd62712aa890 Mon Sep 17 00:00:00 2001 From: Manabu McCloskey Date: Thu, 19 Sep 2024 17:02:47 -0700 Subject: [PATCH 03/18] add techdocs (#36) Signed-off-by: Manabu McCloskey --- .../skeleton/catalog-info.yaml | 18 ++ .../skeleton/docs/idpbuilder.md | 46 +++++ .../skeleton/docs/images/cnoe-logo.png | Bin 0 -> 58052 bytes .../app-with-bucket/skeleton/docs/index.md | 16 ++ .../app-with-bucket/skeleton/mkdocs.yml | 6 + .../argo-workflows/skeleton/catalog-info.yaml | 20 ++- .../skeleton/docs/argo-workflows.md | 160 ++++++++++++++++++ .../skeleton/docs/images/cnoe-logo.png | Bin 0 -> 58052 bytes .../argo-workflows/skeleton/docs/index.md | 9 + .../skeleton/docs/spark-operator.md | 86 ++++++++++ .../argo-workflows/skeleton/mkdocs.yml | 8 + .../entities/basic/mkdocs.yml | 6 + .../entities/basic/skeleton/catalog-info.yaml | 20 ++- .../basic/skeleton/docs/idpbuilder.md | 46 +++++ .../basic/skeleton/docs/images/cnoe-logo.png | Bin 0 -> 58052 bytes .../entities/basic/skeleton/docs/index.md | 11 ++ .../backstage/manifests/install.yaml | 5 +- 17 files changed, 452 insertions(+), 5 deletions(-) create mode 100644 ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/docs/idpbuilder.md create mode 100644 ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/docs/images/cnoe-logo.png create mode 100644 ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/docs/index.md create mode 100644 ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/mkdocs.yml create mode 100644 ref-implementation/backstage-templates/entities/argo-workflows/skeleton/docs/argo-workflows.md create mode 100644 ref-implementation/backstage-templates/entities/argo-workflows/skeleton/docs/images/cnoe-logo.png create mode 100644 ref-implementation/backstage-templates/entities/argo-workflows/skeleton/docs/index.md create mode 100644 ref-implementation/backstage-templates/entities/argo-workflows/skeleton/docs/spark-operator.md create mode 100644 ref-implementation/backstage-templates/entities/argo-workflows/skeleton/mkdocs.yml create mode 100644 ref-implementation/backstage-templates/entities/basic/mkdocs.yml create mode 100644 ref-implementation/backstage-templates/entities/basic/skeleton/docs/idpbuilder.md create mode 100644 ref-implementation/backstage-templates/entities/basic/skeleton/docs/images/cnoe-logo.png create mode 100644 ref-implementation/backstage-templates/entities/basic/skeleton/docs/index.md diff --git a/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/catalog-info.yaml b/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/catalog-info.yaml index 90c4e32..72d80a3 100644 --- a/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/catalog-info.yaml +++ b/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/catalog-info.yaml @@ -15,6 +15,7 @@ metadata: name: ${{values.name | dump}} description: This is for testing purposes annotations: + backstage.io/techdocs-ref: dir:. backstage.io/kubernetes-label-selector: 'entity-id=${{values.name}}' backstage.io/kubernetes-namespace: default argocd/app-name: ${{values.name | dump}} @@ -26,5 +27,22 @@ spec: owner: guest lifecycle: experimental type: service + system: ${{values.name | dump}} dependsOn: - resource:default/${{values.name}}-bucket +--- +apiVersion: backstage.io/v1alpha1 +kind: System +metadata: + name: ${{values.name | dump}} + description: An example system for demonstration purposes + annotations: + backstage.io/techdocs-ref: dir:. + links: + - url: https://github.com/cnoe-io/stacks/tree/main/ref-implementation + title: CNOE Repo + icon: github +spec: + owner: guest + lifecycle: experimental + type: service diff --git a/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/docs/idpbuilder.md b/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/docs/idpbuilder.md new file mode 100644 index 0000000..3ec74fb --- /dev/null +++ b/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/docs/idpbuilder.md @@ -0,0 +1,46 @@ +[![Codespell][codespell-badge]][codespell-link] +[![E2E][e2e-badge]][e2e-link] +[![Go Report Card][report-badge]][report-link] +[![Commit Activity][commit-activity-badge]][commit-activity-link] + +# IDP Builder + +Internal development platform binary launcher. + +> **WORK IN PROGRESS**: This tool is in a pre-release stage and is under active development. + +## About + +Spin up a complete internal developer platform using industry standard technologies like Kubernetes, Argo, and backstage with only Docker required as a dependency. + +This can be useful in several ways: +* Create a single binary which can demonstrate an IDP reference implementation. +* Use within CI to perform integration testing. +* Use as a local development environment for platform engineers. + +## Getting Started + +Checkout our [documentation website](https://cnoe.io/docs/reference-implementation/installations/idpbuilder) for getting started with idpbuilder. + +## Community + +- If you have questions or concerns about this tool, please feel free to reach out to us on the [CNCF Slack Channel](https://cloud-native.slack.com/archives/C05TN9WFN5S). +- You can also join our community meetings to meet the team and ask any questions. Checkout [this calendar](https://calendar.google.com/calendar/embed?src=064a2adfce866ccb02e61663a09f99147f22f06374e7a8994066bdc81e066986%40group.calendar.google.com&ctz=America%2FLos_Angeles) for more information. + +## Contribution + +Checkout the [contribution doc](./CONTRIBUTING.md) for contribution guidelines and more information on how to set up your local environment. + + + +[codespell-badge]: https://github.com/cnoe-io/idpbuilder/actions/workflows/codespell.yaml/badge.svg +[codespell-link]: https://github.com/cnoe-io/idpbuilder/actions/workflows/codespell.yaml + +[e2e-badge]: https://github.com/cnoe-io/idpbuilder/actions/workflows/e2e.yaml/badge.svg +[e2e-link]: https://github.com/cnoe-io/idpbuilder/actions/workflows/e2e.yaml + +[report-badge]: https://goreportcard.com/badge/github.com/cnoe-io/idpbuilder +[report-link]: https://goreportcard.com/report/github.com/cnoe-io/idpbuilder + +[commit-activity-badge]: https://img.shields.io/github/commit-activity/m/cnoe-io/idpbuilder +[commit-activity-link]: https://github.com/cnoe-io/idpbuilder/pulse diff --git a/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/docs/images/cnoe-logo.png b/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/docs/images/cnoe-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..63b8f228ef58a42a758e570331053afc547df964 GIT binary patch literal 58052 zcmeFZ`9G9v{68*{rH~?`;&6(H5g|JjN+C3sFl5PYWFKpjQ_5N?`&L5P_pyzovSr`* zv9E)%jeYoDw@$s!`F`G?Kj8Ctocf`=d%2d^@_en=yt=QZOh?N`OGZXUcjxvkO)@fy zbuzM}CDg~jo%lXaEpUV0>gLV+HaC@TB5je5S`Lp)&6UmV%^j^wHI;9WkzEfCh8tR* zgEPs-l;rdO+2YrglJb^*U-Vspt!DdQ1GD?)`F2BB!fXo^UN%;21s zaK~R4U(pZ8T_nH4mL)LNIi6oP{r$V7bG3IHop+l6f5>~j_m_^aPkgN$SR`=P;(9kQ zn+F#7tozDGUJgI+%eel7Yuub{pSdQ_@F|7DZaqz}$rjCbDce}i@l)Rl$#hub8J6=} zquvO=G*Z06n-;YHeefmK4EM%E3M!}N!4PTD&zYCG8WkJF(xcV5JF$MdzD0_|Hs1&R z)I;-yyqQLh7H>rGIfjq7ums`ctXC9M#F9}#!N%po$BtH&NxUv*DvC62OD*IjMOMJu)l92$0srI7G z3qrh5PFxiA_*)5<<7`0}VcLZ&H|l+L3VA-AG%9lT4ILkc3D6%tFSeZ@uPZu=3J3PD-U^o3;Efn{4@Et9x`|-~ECY`f5nlmqVNwzRJVOE`D=2_KYYx=S0)V+Zc8t9M{`-ui8w;|iM;I{QZw z=UbizEwdoAc1aa_(YkOhC$qJZ_Ab;BZp{So!1BOZH-*}L3$w`4g4P<91o4x7t$nRF zKi>D+BP6};bpp$jv=hpDoaUVWv|zIqaIPQdigRo|_-ZuMn`1O1{_w;;mCsRM{Gc{Q z6o0Kro7TG&ssCMhO-9X3Hdz2}`zSx@qn@bt4mn37nRkhM8MVbR{k_S}2D!I34V!N{ zF8NO2CS}K3oDv)po{T)LHyjmoG;%b0!r_#lY~6(-T(eoqPRga7wu;agO1SZ`Pe7X2 z?77U>Z(q&ss?RdN_>1Nd%)?bY{d6#kVcD^|9Hd#gcg9neFHQ^g8Tmb9au1ZkkMVe= zOb|qls@YHc#eGNaEZ1|pGLOF&i7Bo=cVz~$(X~!1w$hX)UPfNmWSQi?I{2L(39Qgq zSm|<{%WI?`53-6YD2$#D_|`BvVM3cN%y;I*R8=A`zI3+iTzd+AVT9!rS&pah^{>b~ z`y`e@RI<5K!m;anJW`tvizFCEGmf_HS~iM3wV1#X$TDP8+&47cdA^&BkYDfi`&O-^ z&eodFfhX#_+h4?y^?6|t2fHK>@3o^{BV@&i2S*Psx*xAG?P&x6am!ry&SO!T&m!vb|GN$?7#)dO8; zUDbP%rbs)%M`lP9b3u1I2j~SdX?IC*X=m>Ih|}H9*4|0dU54xM4M}hf-G*^-9=_si zBg3VudY|(q($Sn#Oi)Nrh)b51lao{0(d@CL<}IbaKL`Jl;j(mgc94X@+}zv*-9!YD zjux=15)u+HAz_%XumE^NzzJpV{K#Fv-iiC?Aiu`BW$t9^XyxE+g|z2{#(iXhba9s9 z;({jn{paU8ovj}K&rJ4Ce{TzH5C%PgT@@69{coR{yIcKVK7*e8{OoXFKc|z129s2G zv@!<^hL$CJRr+v(f8G0^?{xT$u-J8J*#G+IfBjVNe?FBE z75V3v|9JBEm(nnZQ2!v@Pp%x^1#FR}m4^Lhu`I3Z(#0AwGI_E)w-g?@A6XcdvpuI% z%Dbhddc;P;JzQ+K%B$)a`xQ>y7Ugt};If#A%+cFl{~Z4m6Uina9(R|U&AsHy_tz9n zFX<5l$A{u=!~FS8#VegR#B^_~{3$1ISU57L9r*6M+;BI1xO=#g+)}J8O)YLM{Zi)s zj?~QE2BoKDN60CtPjbrtckv$){*#3NwBSE2_)iP|(}MrB;6E++PYeFjg8wJAfdAtC zj4sO)FaG7)mvZOqEgZDnM2g8w2=q~@qP1E#~+;a%GL)J2O56&?8mx~lZee=Q=6y30_UFj16ly*rV*cMp0tbDU|0kmvu;*(s=FxnK7- zdrHmL;m)QE#9NnPRtSKhb*b?yub~%P7+-&IqYp~`CoSYh&!LrinsAm{H%EK?u+-Du z-nH@l@o9WVu>BNqs!yxfXsBm1+ndE6{PXRmKOJ_*Tq)Krv~<;$@aP!Dl{L~s&$r~| z57#2rsra|5ZN5Q04YkoMgPy3wJQ4fBo`|@$`952 zpg<-x{|e=LOa6*9po1EXfdsMd=0Dc}1o2B1zFI-L-O18|^>CXEtWbLh4#Q893|2 z73Nk*d`*Fvg)08!;_pE(Pmwd*u~c7g)O!?^|3F&#DH)mp3@1CfeDt5AQGYU^Fui}_ z#jP?$p_Y%@zsEcZ#$>p@_fH)4G#;U8f9d7An*eXOVTt=}X77m;d- z4FN@pD>ggjnA6qeGo3EuUG0^rnObtF+mO(60P*pr7+3!1nlj#3<$PQm<*gmMr8uZ# zm4uOM%EB|(6`oJml+PB6KTUH|mkP~~7rJfw8)7UqIH``xHl;|Yg%U1c+!a+%bGE&c z-zRx%ZD_r(u>IUHyuLQ<7KOt4sQ3}^h5EKVQmuMmdAbaM%*5hWr8|FXrzL_@y`BBt z?i_Kn(>fBfbP%pd;Ds~tZh0jk1u~|$3vVYfqI>=PEN7Is?T7&!9TT1soyhX@p&a)} z*fg_Q)!=Cga*Cci@)|)drGvGmj z)1+^fM75g&aw_VTgQQQHF`Mb?@i7apblP!+4fHNdKwf&(<>is2r4q)|e=Ee}(~;Oy z)9JHS8uQGg`f+?rywu>LgBbcDxfazFtXM_x*^@$y_v1@T%~Yg!Y1x9;clQkWhU1Z@ z3`fXqV8%Zd2P!GZesMU3>GLsvt@xFdG1M4I>dhESl!D(odzmfKWa_1*47b5=MFC%P<|!7J~T=q?~C5wdRa9|o`1zbZX13{W)*&~b+N9R^x)P84xo8h{Oomdn~R60 z`?Spi`c#a#@M=E)Kzy(BunMN6uQtq6e?}CK0tC*;2iC-;Vz*Z9Z-LddN5i<}uSUn~ z(_N@Yh>zi)^{HqVmvJjWX5qyDY;zaN-ct7PK)R*jrm76$j7{R4QsyK50C41#lVhhA zOXGhD6!ppL7lq>EV>ClhX0UNzE~l?M&O6oe z4EYpG_{>T{jEDtzDwVtZ^4Cs{-%~ics=v4Y(rT9teD(x?(_9(xatZqd=X;!QaHQN-wZbv zpj7H~O8*=mgM+uK<}M+a@c~isW#O=w?>W|+cO@btQa_33Vu4FCPr0_*ZPCz{{v-C$ zU~6+9 z#^>8q?Ia?_8wrZ-p7Cj0GU@rua}VP>V}V6S!&!jP5T$Ir{uY`eY)`9rfKQb0+Wpxt)+RndbCJ%x$5ku+>uJl0vUiTun@;Rd@2F!v14n4QsK^yc8B`4Z6A@abT4T>uv?yMfC z3$!VZiQn~D?%bU#QGCK=Lm^nct?%wS$7jYHt;xDqbMBO86JDt{aZWMoaD>`n7J`@E78L~s8dU0|lZXWUH z_|0!gexc}iPgYW+5f2#XNpK1|)wdTcs|oGvLwq&YCStKH-A-C&OK|g%^`YlOq4tP^ zIb(!Mc1LZkT2iNN{!nJ+h3__-YT}H<03fF6f85Wg6$<(-vBrYr;vDOE%GLniTki)K zwRhdue3*J>Yecn;J(hUxk45Bfig9@Y?NoQ}8Gj}A3RlcCblD-aq zaJ*UTtPx#ZeVqEK89d_F7fPZFyM2Kc`*l{ixq!jHsYAFD&s}xf~VS zc^@I<=2+o+X-!l4W;WV!jdb%cYUB*>Im9byf7+^}1lYdTi8Nm7wC$J^xBSk_i&dVi`V=rNe;VRJD%bx5`}AZA*nNGYBW5&FeBUhSvFJ=mm@bX zrFbyp-_ozp!;br}Z{d6zb=sj=BV5Ti&v#O=*}?hUPkQRwpe1^Hl#JN!^#Og|h z(kA6vOGPNTheertI2pQ-85ov9edOpNkb_7h9$S0{9ZsU2^d4OLOtIZjO1UoUqcHXS zfJ#Hg?V60Zx}9NM=54^v63yiqcJEH787~{BihyKR{On|Hw8 zX*si;F_Wzf6j?Z{+S+`iq6>0#{U+;DX{WufIBv8`_^mg%#aIy5A;kK(lZ>7^6FIm( zP#fha|7UgsW=KKy2)4n972qM9e#zzPvh?~qcvaeFzBZpq^wW;*oUb;uhdxP;9QQ52cROuzA^36o$O6=Cb z$EwBkbVS2N1N(E3*SM|tQk93q#Fk~PosIO#KNvdXNxx`jjte=fTlU~F2rfj*;81Jd%Gx$w6ESUbb2nl1BEyv(R| zw}amai?YBswBa}I@=%!`JA^5>LZ58l@ivEevgwznObRH*rFjd_4wmP3mJ zYMmZydiE3Pasjp&toF00=FO7rA7$`Tu@{F)6}%wGH!fw9P4FDT*V>uc@$~@{UDQ?b zpj=%~Mx)CW;R0J4@R5|XzB{dm$wK1JT1947uLe47uEgrP%;qMbvyuZ$z1?ubc!xLA zo16BEmt1UojL4=3`|k0C=otR~it~G2U-`#1Ja&fdk1wWlc?rRi^M%)H<2cOqeI)kV z-JpOa5&<#*9wHWhyU8vTwVgJNA!^y@DXVulPS`Pd8GPh4BAQcNJh)gGm8rwj%H6l! zO{M0eOAna-*uTAhPn32X*j5030wkH{s0uf(VoaF5TwkEdXMfa7rxAO(`lz}QjKlC0 z?KCk!&L~n;kGXCoIz~28=Ru4>pY>ayJa;bxV!Xqs{!BPly``DV$jy^{iGcO4517-f zf{7#2L#LlncG{z?KV|BZbEvmsQF634>qXpcrxYrZ z=?z=$U78uy)j#q>On7Zzfsn`IZM9ePK>=`I56Ywbj&`U25TczXT?@TiBkB{H-I`LN z9q+j7j~~=Z5SJb656pCD?Q|Yd?$6*%tldBS#SuL=?y^%PDijsZlkQO5zeVu1sc4m0H^;Nb3z&H5rS5cH1_z$~+D({j#xzdx*qUR+ z+Cklqt~dr+YhlS?z^p)~<+)leqT$bkw!tNbevf+~6Q`mm2RHX!>TDFmd*TxK`%|=g z!X!&}J}1^7n4Y;`u&H~l7+hHOxVcSguDK>u_QdM&s|rNf)?Y6+&(tLG?!3uFv<$6& zI)WAx33`0tuVdCUlMH7O3`HOc;I8lW5=z&`$jV$6Mke3}_t&>y#5dHy2J}=Cx94+G z{iWv!OLIMb*@ zgstlr(D^Ep=C<=CUkM!-d!+ER5r+j{X8u-9yVfu<=OP-4^d2)Jm0x>EWv#B*d`LcS z)M1q{0bj~h?Ds07z?^Ou*ne?P_M>iZ>go@Wi| zuDzww@fypQsa)4|RDcX8JoL@39m##fpMQ`V&}-T`c>U$D(n{dDrm}%Sdpi#gooA@+ z_y;R)Uk|H4A|TV+{C&pkF!|B;Ox{PtfWE>maVqwrlf?sVxfCAX z{@vw+4cvZ+6OuL7fZ_6pSqNNJq8 zDvGH`mU=eBTbu1#c2b7d2R4jGRW0y^Bc?jK+URzFs@9}ks&9Wx%Im=wKRuWth_jv7 z)(FbFYLkSyuuwD7;GZw%G`;=p<5gb?X(yx8>RARt$d`Hj6v1MUcrSpEzR`z@2)RcT z+RB{js-7Z!Mr}_kSdZb-n9hpOfh^Uy>TXUmTN0Zfy_~^>K;<^35XPyW?QN>Fr8{co zVGnW^q@O;sR9V}PI*WvZwVe6+pywBB@l){bxHZ@VPj$2N$jNaQ(tv=0tI7V;*+ot& z(U>N_*b1^*b5gu2!wWyEi& ziWUl{%$?bt3++v9&HAD*A(q{|39vYVF1ejV+}#nA9^AiQv@c`HbjQ?2;B|f@a1Qx& zG(v*L8!-KTYDqR6V)3Gpb+6M2_P2zxvB~rwh3-(S{g_W}Xt*Tl=-S&EQG%+JBu#t| z^{*cA+&#@fkcU|HS$^<<)j&h+8`q&VraL}a)6-au_?9WwYY{J& zj%N~W#EcQYj;89jFPJC$7xguy1H{WbMc@eRu%; zKw63CjCM0=dZ+QaCqD`JHsy@13XSS@5^0Ds4s?>w0><#q`%IO}Vq#w)KBofa`7!OK73D%R{@9N%9C8z_O(S z7|y3e4M=SZfxNhfBf)s}wDq|X+v@UCEqkpiZGAcR^Hp0vVOA!JciY=h1MF`XoG*>ZE1(y$ognbzDP4!S&6wYNjtO<-jx)i%x>DZ_*C&OH(o)4Z=!`+!qxW9IMO{}pbe_+lZUGpuru3Tso0V^4W!cwacOHgIeYrO%VCMMU z-1hDtLTP`Mv7oU@?gHm(Z9W7yePUGfNis|ZLCVdY2_h+ZxxJyA#S#->w?)_6I9QVN z)$Q~TRNC^Of?Txq#Jh%8`_i(CFfHSlmAI6O7q*oyJ}ZHkHI%JEN8tk?}?Wc+@;q|d}@oO94}k{N&!6mP=@;z z$i0g|@?CMdJrIue3}hm7tU;}0p4=uLh!$LV6y-`_Rp zn;kLQJEcXtX`_C*2`}C(Y4};^+$~q!%5&15`;6t2jU;zT-^JvW^&!XWqHa9#HewSK z6ZqW{cJj5>9(L7jfN)R5$<|HmC{{;``BGBC--r&hg!A7aC_UESj~Q5U1yyLXX;Rmg z;*08XPyb+yl$D?2N_pYswy=%rClE-P98tXbD~9e-bc+d-OX=9=skaVM#L*A|{g9qn|Mrbf4n z&j=s)iM?A;#sv0dn2S)n7F(jeWbL?lyFawuxUK#_~sfwfl47@MXn3Gs6pTUzwl- z9j{@NR*vL!ELMA;-gjs&W^+w<$!l-DNe(6{f}B2Ld6?79d-^oK_XvbNSNyAZ8!d{A zbvwDwpJBZnb6PYe)%U$0l1Fl5$j@Yq7z-B<&77@y@VQz#YmzMxH2)-vC%vxmVQSi{ zc)#>c1BEJ&H|1w(n;kel`IQBE%s(@WK{8vu&$795Z%hSLKyef z1qY$T=tQK1)1S@fUVFVWgJ-O!m$RETcA6YGc=MmZ?0jH9-*KFrg?jQwHs-=Du_qFy z8*7xkya7fX-NBh9d!*(Gl-9e!N@rWN2;cF#>58*`(Gste*ldfn+8NU&pP`v_ksYDmFMK}Q+raGfA(3a(bvh4$ zpr6K`zsAwjcou_|p!`#PQW|no&=S?OmJ>+?S4Rsk8o25A9es0xDiFd2bAMkHKie@f2&V}sNuC8E7cSD`X&_xtx_`-|n z!&a25RDVv5qK@8WjrE;EspU3fi%G_EeEqbbcS?Byv~rN4oxrHSTY!Y#$iE3`ky#>+ za&9zhM`2VzC(?1-x*>|%ehRn8L=t|^`+MOPB|gs6@~a-VMRYD-*?$x7 zgWFA7SI zM{NYNuX6f4Ub_yy?sHFvTZ91G;Iy+v?7egwTtTPXwZVb3i48Sh4(63e(t%9s;QAp_ zO7e3i_V(*1nL_&C_6V)>MQ1_D6}Kh=%1rw$O*Ya~;!$!VGG!zY*!&$JS{W~^c=?fX zN+N@ADOsG#1BT1y8jL~&WizU=66p(e6l(*lI@w!J85oZ~W2ETe%FlxeGk%M%Lk2Pl zv+v{)rgOZ^R&vi!bu$|ox8J}WmvDDn%h?_W-E;h83ZW1m`I;U-tiVLVuhmn^sqshS zrUla{ufDID0Su8Jxd;eWKh@?~y3ly(p7fWFZS8HucwiLTnRswat6&{#5g(iDLF3Llw zA*_2*Oc&bjhpImnic@q~Z_H#WbFf9#Y(F9r3PiBLE3^Jnw=sIp^+O9ahd zA0#XT&p`96Wax}F($h|EZ~KbgTayZNIm~0wiEesooF$v8E|X$y_1ze#bx!RH1d{S}uq3cJ zG>{L`;)WN8jYv)>>jUE={G{>?FXKMxQCW%IumC+o-srteVVxX-boNYFF$?J#hC96BzFv_?1!CpqgS=tna0?~G4dcsDC3akF?kA%j za$1(&t=UR9^@^xAY!5sQUdRr~g1Y&$Phh9RCU!oP7Z?UOwGTm8}Z*Txi zpJPp4GOHMm(1#l-3uO=6Y3QL)*m7~dbMm&_x?kSfm1VPKLV#}t<+V3@=B^(~lM-j8 zMw~f6SEL1+phppR_o+M!rII3SM!z%xkAwS z`c>qygzXcXsVT%vqPc|o^+qzm>znX-yM>Hye`)hV6x!bqT80DE!*Nj_>VP@KE^ur4 zO_f(_Z%E#1R_#MnATQ^;x}6m1bK3Kymml76tUXL)zgm<)$m;i(u6b;YU4O#ucAFc5 zi%+0F%YzJ5`#U`k-TGW5o!XmH(3epzCo|;1(qzMP^r|`s;z43w5)3wcXs;T;MlLxy zLbYQ^77wWe>NMvk?-jyk$Tc8D>B=GUvGC-L^>)Z z9R@{jpT@HsdL@U0Kpn22YbYvBSSOpbv**V)r1fb;GdH&^hd7B-=gC^Sc0H|AwZ;Rb z$VA*~9Gl~jiNBwy0^^bHcm$TAYXyRn_Z8STj2A1fV*H;FL`((#l!9&=;wRS6G72;(S7-nW zY!KmmCUNDUdhyUDuzw)IgdOgY8L`>WERYuYgVc~8e@ILkFv_LB99h92J({Eafs1GA zykmj+8#39A2926z=sT3Fk|=W&Yo|?R^!mGFA)fDKNBZ|I=`{GM zxa7A9=?_KZ2m$dB@~S|{`*%2fjdOWHasRuQTpBCx)rsI^Y~_isKv_+IIR0?NK(2h0 zw+z})q5wKJZX;zNR33-1GaL_dWiebg8Tz2lu<yAf_I4c1L`yoIqk$GI2H|5-v~sQwLLm1lE(;)ZjV>sc!Vwt>Gq-DKap;2kv$rm7oJ*CS zCevY5gk2bsLGZdDxPhhy*m){6DeBA{^5z6WT2)mJb}@Z%Q4-RKyeg3F;EHrBZWEkN zM6{f|MsodtsjdNSrjO8%ssj}=!dUv-*9J<3v0|Z{Jw{1=%IR8x+()07@;nPCp;iPJ zU0&FT(T5l9N`j_5v><4+br}}cf9nj|?e9}pXP+Vw}q5Ul;UG!WM)L^>@>tYg^@dj!=xJy9slqNw9&AN}#v6S%l68xFi!g1h=|5zUw!f1>IlH9v+ z{@RL!y7ftz=eA>!1ogZ3zT8dd{)=F+3V;%ugf|x;_Ff?GoqqC$Cc8bk;$EM*KUi(z zP4c9uh*N8^~&%1UK-=t4dQx9CfMKzyqfVIn7$quKm--IfCL>7 zKwH6>^?RBlCt*;6VFu0@KmwWI>ey`0jVXKF$g8g`{<--z8Rd~CWsGoJ--_M61vMa0 zps!<`v;pPPtIWZ85j6dWCTs1?a>H(UjbSJmsO;CH%SRfq)Fz8H@&m_B;xgBHy(@Af z=m~=RNHj@i{hfTcnyOCu!gK_{hMZIeEkiSz=H8#)CP7P%clB&3lq5y~a7L!vqLmr<~bV?oBu@T&B zU%F-rw~Z+?$}jp;#8F#e<}_yx7uY7hBR8ENpxIs6>yay@v7P;n&~H$|sVxN@ZP+~? z{V*oKlb%b;uCjSdwR;2VbW=dFzV|}jbHNo*rJG1)_D$7ASnaO*ojVLOSirIjKbdlX z{Zcn68%KiP#?7^AS7y+^qB#m2m5kj)<52j(vZjjO}M1~^Y#mR za9j2y+l&uh>W9tvCn2^TgV>sL8@=U^GV`i$(w~%Zu!D%1(Ka!Y{wqaN%TBcWtt+&k ze;(Utrk+eRsEkS}xB(PVl!cXQ6~VAdbobgabO{Gf%bnSxP?X6nG=?*^GzNHoRS$gM+ML6_wRMSuY-D= zp_VO+a{>?67DnWe={n3(xB$3u@O!cF*j)=~9N#Y8v(LL3kKANe~ zhl@o4xV3>9$v1#h{Fi_SX(Ha`@LSm>F9}7Purk}QoUO+@hz(rl&yKyRjmT=LV6>Sc zdFdEiYE)hVy^Lw%u=#l?@I$|cI*+3CtvG*^JMI+gvDF_?lT%@_58Y9e1b232v8;i^ zRLrKE$^6QrbM5-)Ulcr0Rb*@0pW!<1HglhFgXK3TMcWE1baf&+v%dkk)_=ipM16Lmu)^H|$ni7w`14X9)|sJo2GF&7|RabTQEwsmo+`K@W9VMny+T zcW;6#0Y0LWY?Cf~YXZtYOGAd{!vfpyEv8?7Ez+E34ND1LswEpt5c7yPX}OW!f$;Dk z%$DCgv%hz!+Ge0=6D+Yl1vfAimmy`9U2u}0oxB*p=VLLyekD)M4jOJ5bOaD&p8o@G zFEP#D`VcsacaXHoIKH`s8~aNp;o#B4M;7GF{dKO;EMA{Gz;kgklR^u)OL|sHaPjn$!CRlHmWt4}brMmW>`0sq=2PD!h29ESsB%1y=3!PQK zX$$I6=8{u*oj^kGTZ&cT2d}VIGerGTBPL^_0c8lYi`X>_LD1?YKsJlWWTpOY}?TSOiC4!{(XQ3xH{6J*Axo}9Cb5Y zs}%)tQZPME!kFuW?BN7`;y_auzt3%uPc@su`Zix7_@$Ly9si(Ca=EV?DbUw#_HjU=L35g+83`_WRV{ijZe4Q==^nLJxf&Fjb}m3!>@-(@xK29i zflcuz3)Fxm2+_K6W18kM!#+72)#X^$;qp8-BSkV-IhhhShgYA68~>FOw;uo@X_7I1T7TLr$j~8WGWX^gNuEgGcT9rl%JpcJP(O(BO<=M$42ABE+ zuW8)R*4dNDTida7Htl|q%_)^K?mba3i{9I5oBXo0X>B&SUrr%gld)f1BRD_cu4@`;a zY>TeLPB~NN9TdePCM0Q|m z)$2BA80$Sz^E3S%A>?XO-!4ZXsl*>6bE?m*K4>?ndeq-j$9{V9N}U1LHO+;wj;D7& z-Y+3n4fi(lvaV;b+Buq7#=V5UF6l@WL7e$Njyo8epf#4WJ$b9

d(w5}BKBAr{wrzd*>V2kjkOcueVOl_vEG7B`N4Za1mCi(JQ%LO+x) z%LR9-%EYJbi4B+g3doS`-R7O*pvV_RJrqJ5OdESQfTD`J#BM0KqyhJzYj9Hzi)*V+ zQsQ7*WRRPUa@%~69fxsu%hu73Axia1W%*`_K$=_%SsqVha1e;XXeY0{>-Afl9cWp` zFLGLR6_yO&!Eme#NaHT$7SWuHR530WMC?oHYTF&q#irR1=tF|?>c8`IaU=CoyQk5y z53)!V^j~dfJ|m=JM)=|lZEL9_h{rbcmxX6S^E#T+h*)vU)5%Y=rs>LXi0MdAj+;g_ zHbAWxkp=)R9Ql=@cuW#4-F&$w`aZn;mEq*qrR{<3=Ji%L@2@h$=bf*iizq`T$c+lU z-#jn$-9e5Hx;4^V$q)gj>K;sv|ER6*I0!Z{@2aW?q*5s zf2}mM{vi=ehVF*WFp)fM{{lXbzVRD8bDVgO!5_U!PvtQb0iTC-6&YjZFiREH&Ata| zpVbDt$IqDJ;k=GlFWlYtk?P^{0<9|b{>rGhY7OGRM5p0uWYuMKvsP%Tr!MuZD%G?l zNORl)8;V;h%00!|mQ`ixU2dR|)55;)x|`wxtRb%hQ=H_>?70-hGvAy_MdHnA#)H3K zNXFGZ$_VZy(2t&wX+W2kXWY>9mbl3;svhjJ3c`Z-xfx$Z3+_-n{^Fp2Ufq%M(2F?_ zEJn{t7Q4t1^5(;{5jBDvNn>-kNb!-=0w9Teg?z-oHwq*Xf{mN<8_Ep!UW2rY^!AFt zd5LJ;Sw#WOb>Fr{t8eMy!4b$g5We*^*vv&(KaYt^{%Y5bw^v%F9TA4qN&?D(Ovuh% zJVI{BTpx8A;_JC`Q>A+|LX)W`Y26>c8*!nx=g2m} zFyLMcUs`9y1+U>Ab2e)?m!4WFy1aV%c$ZbR5t`6cM&5wTEw_$q7P05>Be0*nwWHiX zokHdJpk&G`N^mSHr0Jcsc@|y|6?#QecE!+z6TN+W@9Hz>R)ln@Ehf^(bGoa6T8(*^ zu?ZX*n<<;(#0h7-64ySflSayLE70`aJi}h!SbBKipWj^4r+EukArBw^jACTAxA_VQ z1rZ$m*ALybeMdokP2ly2!F#`iX#1k)8y{CkYkiI{f^JasB}&H>go-j_-(Wx$&Q-cX z%(jB%xkyC`jzc!S*Ed|?WrRpw0PYdr#~<^cV7_J&-RN@WLOpv{7^ciI%c%q~Kl;$=XhFra8o)6=!PA9?H;(!a>+DVmkX33cXTQb%j7u^DHCqtk}cyodMDFAfuv zE#Pp4R75RwCO!6#oNLwPZhFkmP!>bC)EPO2m{^akqz&t`AbGIoy-Jw)B--9}JSt^7 zivng*P%$BOZu09<)EuVXIp{~>CVlE$ktt0q?7nTSCix7Z!ctwY`QTe{;Lc&>EeS%1 z-dy&NQc$hM_?q3PyHO~VVP?CWYv2~*0c>KV31&Lq|7K3(ywCYLHnbv?&OaT&;f+1- z>`iLT?Xpx^RC>aCwl011nD2wD?yx*MZmHEKQKmY2J0FG#>Pg_!v`s4(U|*2K3*nw! zpxft{4L}1Mz&2!d^G~R*v-bi|%pp@c8mu~a%WN=t{yH&W;++SnD==}Gui{Hwc+Cn$ zG_x*NUSs1dWuWVe_f{Y$_qgGqz1{oNuK1xC?3QmMVz2n~sC7m@n+=0ckCbjhP+hpu z$LNGxi96PBlUk%}D_vU5R-jr%Ex=$?nh^lU4sWXPtGuq5gBR&9=hWaCXTwC6#JJpN zIPzJBnRlsUFTOtN)LDtXawf-qSPzRFFX_aOVG(bM%eYV}7|Tg5Yn@D$#od(}zd;R& z>+j2s(@!csb0gF_i{`CrKbc>(LWZ*N2MsBq?joLPqzs=92YcsklL<)MMtFBO9U8RaS>|ZRt4`Q$z7o@;`Pm(8* zDdaQZSC19xiDohu8;r)_>*feBpCDrWC5Cxoz;Gk`QXiwl^#_Vq1DTGLcWPOshY;7w zmrfiUtMy1oFBQbiJqgWwXW}i5F7Lc@AsbADpJApo$*AW4eiE204FIA_@~I$SG)^vo zPgXG!6aOI{m%+kJLD-0~(Ygzrty}iTdop&Fok3?cihS^>N#K@(sed8-f9!qrTa;bb zwvM2Lq9`RuE8U1R3@V|5bT^`ufOLZ+jXk&Mf zL2EkPk=S{B-r&F#%sfsGDIrn4O%YV`b(Fh3IgV+zEzuaa!Pz+uUYX4p7H20c zV&fJscy%r0gR5}(!7g$hFR`1z^+f9YLWbxMr_d5xxZrAm^WtGv5nK4ID zWozUGy?@bwiWO8{5QLob9`BWBdD(jw9ny=}S6%$t0pNP7K0?w!@+0BBbbyMg-c?nV z9q$165#Z23t%dbXB~J9T{R}?m5~JIF`S#d$mHa1_`WOqt$_0)JG7op{0q}wjhPlTe0V#?ZxEq%mQzB4fC}R*2KNhb}cV0L+N%AwB zeNhZNTplcKmreD|Z8{!*xIvy}^s@B_H&r9i$i{fQ)8!cr%Ii~0EmJXUW;2{Zcn>2^ z^3+JqjH5PszBM+3&J_NNN_pl*_*?aj=CcIxV2=em!arT|*@y+)m!;pbY>{jy11W#5 zL#|;8Pz%SC4vc`?LIn|*TejydA9i6cw48AdG&cni{JCD3h|rYT;!@1;LjJy7=NU1? ze}_9v%(iI{qeAp&l0v+s?SkMBr^-|X_nqt&#hP_%v4(u76UaNKdvIC22#S&unU&NM zcyAPeOx7ByFN+v%A&4 zFyT8j8-e5imm&B_?eb2o7Ru0dLwMmv^b$aIl8Ccay8OH5x`sp)#8*3S41AWsrI}jK zN;q(!GpoJSQj5BaWO=W7a0MY_YueSa?Iq6}`bg1BH)f@rR(0N@VxA7><||6Osngj5 za|^a}8O*_z=^&8z8e8&v>};SQoJCAm>?OoL?s?HZ_Y48f0>e8J%{Z=D zWs*RL<N$vR*$26BRVHvcQ;Zo68X9=^N@ZHt?C|_uurWFVy#e*%NlyQ?@miqd2j~B z|3!OV7Cjmr)&ze(NIF%0tE#7E`Yqr9s#^XRbYQNSdYm$DrQ3n6)BAM6nn_(xy*rmn zeoc6rq$?D?(XS}jGr$oj&7tBMcFADUDHWEVHh!#;DZUy2*{8UF+;rB5&DISX9n$s) zaJR|en_oilI!nC`HsA&u-?97V4p=jVpMU7UN6SChl9YEU_r-VArc*>sgsx=_`zE@% zpm)b*mn}_qILF663$y3ldn@fc=8Ush$@pYd=5%5nsa#|`)O6Bo4YhlE+#Pitv>}l= z=BxLq_TiO8JqNWju`{)A8)Snq_Jf54ot55b$yyPPGmyRnNoSnhT35~8e=Z?D;gN99 zDV$g2h^l7vs2KQy^k7p?j}r`p2O+TQ$mRW}Gvj@o=Lt0MZFp$|TWUKnN zIgUYk@p)CU1vY6HTs*z(&p<6bWI8owwYjlY-PXKXNK*6Bd)~;(z=cmyoxDxA!0`JX zb(iz{*Ms~N&2gxnJwF3lY_zj4*lP?322|);sJm{IcSuf959)Ja>tg;Vf{-CC(KYi; zi8YPneRY|wLN;(<3c+lqixXxC_%BH~$ z^1~K=Q<^6(X<927MepsXcwREb;yO^L8B?Y`9awReEkl#ei;|)0yp^dN!_*zCVFk_= zZEYsy#9GCTt}Ac3Ke)`dT1^dxwsX76N9akAm$zxVqVT2*_NU^WJ(Lj33?6lDqLEoJ zEs7!3-<4b|PJt@r_jWXJOp6QHAfmA`+o_xE+t<}`DfpQ=gbsN*+$dQ_nt zC7RUHLglot3@AY8w%iwzcK+nzX-V3uZ=~CS`0hT~nlJ3r93w6vaPfBCFN8DAy#(i? z98zbru_5fBNkiGdbdcjM#0T3f8Y}Kn-&)kX#mAkIZ6_J2jGV$Z?tT7xtM}?WZocBI zJ0MvUUoyxTvr|m__HL7Bs7>@^NZlMJqW%uR!q&%Lm3bRjivaq7VhDy`_1Fwe1f3l? z5-)lNRy&B|-}$I}C!o`lSfcy71R_8bk$8SS+nT*EB&`Gt()`Xs$$X=6Tz$&1iZpN0 z`&aedNvtOa?d3>SlR1G+6_N=G#RUDBPNeE};?pAm70mHxiy^}go#+Aal+8KgM+W)9 zn)7=YhFEmy^9n{^WAz!lS^ZF>jPy|YT9ljR zB%V!dRoqdv%p*b6an-+>we`p)!ZGQo_e$2cL-f@~U8s0ODmLuYm;a^f(F9F`f2p+) zzi@JQi|nQ~BdEoe0ochKbzsnlcsyu!>77F>U`fs5*_L7(`{~IXqx9-NR>N(sC9N!>_m={-0d#9=E5cEN-wKLYfHbzHO7j_ZEwgD zsJeH(3LD**gEb!r5>AHT7?z;Kl6`e{-@^WwzJ0~zg)`q7kr!0W#>`~$7q4(ulTkt; z7Ga_#co%O%#7lEbj_p8CU}n9y!`W-kl#6{RTq*kX;Z5_q$r4nJGpNRE!dsC(W#e7Uk?UfvUQ8##S6O^{u00^H2p!%(=DEd7utI`axWG)Ff2(~o z;MA)6I?tZH^dX~>rgethv`uD!=7#Czy4otoLu5qW?}fJ$TrYFFt_0sCbjJvaT-yRE zi4dF>4pF zqPP}O8J=q0uZ)6r28woD7b^L8Uv53G))k`N36pr0R;y zEOMJ297tEw9AD2hPR)`<383mAI+K_6e||DId6KTaY`HMQrY`@dlH2GE#|B*_!n4#z z)ox(m!JfIU?UHw;%JdnMr@Nf}T3V_;m;C3T!=Mmka27$UjV{ip4`I%X?J1UVGOBNNN;l)s3vO^x3ClKM+Sgo;HDob zOwJC!J7$R7{K-6B!s40#BAU=L#Fs#N^QiyjoE|2o`$vGF-T;>&YJz6}t9;s~@W94i zj?;R(UB3INmuvY&B3WBpsrsH6AKA%=9;ebpw8+s5d#r+vPfT3Azq^CkhM(A z_VBXNq{iuP^R=i~Q)VMK!gfe2>yPON@Ad~j|< zlgT_q?N!$S8t3Kj7xVWin^8ydr{ebZe8B*=85}0S@s#lKmlQD1Rq*p&*R3-Z$`Jme z_T9nki_bNCA~chADS6)|!uA>sS~Q8YS`OM)R-0XLh2l|zo4$@Uqb{mOd7v_$*#142 z&69j%!Q_7Z_I#@N@|~1ED+zMN&tAiITPnC1le_-kghFl#na&AZJnx;Y#V09Af1>Wv z>&AKoo6PtP@Q1v=p1&-eS@}HOh^2Ljw|e(duvBQ-O$QCbyOKAvHd_v6#*CZZPq8cs zQeI$qI=CebvZkl1!+*BXC89|qT`zX3i=T=qKUE*et>s1UNy$u}Fe{=?g!i`2Y;IEC zauviywXIG`7we?fULFXG*UF?b*r!evnEt@uHag&g*8%_{3}IdhX7bUFQ*v$>OK;J%^b z&_DNb^7Fhai>u(piDRwE`nZ(ofwOn;^5C*u##r|hGqs*O!rm-^{$AI+LRD;B0>Z|+ z>tH+b#K9$rPTWhMP)omu^TV<-yB0ohfd-QV3r%)%g6mnatyFuZW1r@>srFyv%}NW- z?e)J1TrNX@{vr9@m=Tm=3KMHn9 zQX+wk*I`+Cyo<{t0GBCn6ZADpQni(wxJPE4!|?vVy;zLa;Lq?U7`f9%wF5{t^SEmM z$+2NivE5xwUI8&7-Yp7zttUO~2rw%V02ng#@m?6%3~~gG68TM42U6eto)xVN!PptM zxK_E;TbuSa?EB&X*_q}W*N%tbiN>ljOa?@=Ndm9yk*|0&Dv<{=Jwwt!Umd3Is9nys zXh|acEmjj#=7UWo^Z0^V*t=Va&)+x3OhuT91 zbR!zdbTAiT^I`T+Y4`0VWn!~BTV9Pn#%)=hA+_+xT!{>(cuE8#;Z^8~9Ftx`G9m6D z68m(CR?a+Fs=oMy{e4*(@QgeCD1p1;g%jkB!(w@U#aT$;L3h|X#ADRp(Nu&Xl?nx3v}=wVH3zjyfvh<4|WTR+>mB+5tWw-v-LecQZQ{b7A1|oN?VCt!O0B|(q3;>G zwjGJ)6?IP?*z{z7Fq8BidqMkV5HvLz{)`EQd%&`Moz-zR?dd57OviU@O6S8a3?hAB zpL$@}3>*S2(uCA*W&9!!ti*fB!DHp5J77&!PY?RsjFNCknza^@wrfD|alczVw_9JU zLAOZCRzCAN4sN;I2kM0ee|C~g;9K|I@a&^UZ(28N;u>uIn6%k z5|$Mv?|`km1r^9L--pU68*yPMmJnr)J(&AqL7L0=`R+*p9iL3vlbvC6s%uBNd@#@E z1)c=%Ysd1#)JGf#K8hclq%mTogB=vzb~tOF7+nwgNt);DYs~h~=Pb%?W9%u{UClqZ zLKr4T8QdVH>|SSS%jOK=gh&eBmVV89h984kkR8)9keS=I)ucRK1-?nvb91 z3sB$!`;yS~-jI0e^#k`Q{|)3q^sM!)c+S?Bc$)SjNHGWJ~1&Wyg*20Yve z**3`BqU&?utq9<~5dL%l9JJADM$t~Y_DtQSHq5H-t&B?$)uy=O<>Z5XZ8c}=P-C>F zGs=miEv{(ZXw~Z~dIe`|n`&puPIZJmQjS;oyA^cKKxk6us0jt zXKqCaT%|@4ybyHuh3@)S?|M6Zqnt`WG3uylB;+Jss?lmST`+bWDI6>yt(+PS}8bD?xY*c+uirz@J#79PI@64 z2%!;wI0lTRmsyOIr5CK-atW*lKTC8^glgU4Q;c9|D0}lzz-NI>01SwaAQH*HSDQ;@ zCNlL4C=a@KnLyy$8GP8TymK|a23`*)q{*XWF?#D^XmHd}Ppgx5~0M#Th&q3sp zdiRy0&PMdPQ)Axf1ulH^9tEJ_8Z4^}1gsuz;uNpvqS+(dT}&P(KerOEyK^TDP(~70 zyZL18hxjS8e{f@thiG6@mB9{?5f%W6-!VMT`o1v1Bd5R<>EnSW&Q+zsc?TNARov}O z6K$J}+>b?iIc~4ZHedE`yKB^pRpyj4Gl56EOK$9T6J>Hg2N}$#t-@Gd$xKkDpAg@P z4<-W-Ax65s;OldJ>U8)rYvAgVc#%UcU~tZ6iPf4c zs!l4poj|=@3}GT^9Tj<@R&!1nZE)L<6Rn?+f5{F?!35V?X=x1Gx=(KXR0Lx)R|6e2 z$}dB)9xoNj+w|Z!mA(3;obYt2y{WjQ8L<%O)^ho1tjr15jt%t(mr;{CGJt*z6kQJk zFp9KMr3nSA{yKHHz1t$T{W=?9{nl4_ z^7)=eP{qb}yo(zOY2qNXe&%K5<)78%%|iSnEa$CyzHbbBf9B!4?}1ln36J6~A+&Mc za0YxX^HXn6o+lE5IJN%==El>b3!hTTQgiW&TNl!VbKiQ4BSB1IHknZ#*Iu3!WVz#2 zF?w*VNcj>diTvz89QO46O-+uQBaW73MY_GmAo0**HwZEKI^} zyjUsz1V6_S%`jVBL!B=72o|2;oY*tT<`=_>CQ#IGWiqu*C#CoGiKgdSmn(0voPTyd zdg5z*)xZ;q$&H9$X##Q=1^ZF@x>_82QBmorQAEH zfE#`1`3Y`kguW3uPY*NCl&N63Cl?*@%ZJ^M_}#K69J%6lnYUPkQ*ja*g(nj3iHxuH zYw1nD;ZCwH|8lznA%s%r|Mv97sUZI(|KyU+FGa(3+S?1dkWbb z`dc#s=<`>nBkNm~9%KISDqODT6G;+W<1sZGTL0yfcspgXl zmdaG`1^n@*j=VF}9D)n8@Q(Ee^ZvvbR9|Nl)-jcw?<`v9$((X~>0{%l@J7(P)ycF{ z^~1GE7~gFdGZ9tT=JkLWFxgUcXEYaQ_r<+rG4OM+RY6O4%(AIXb>bat^Y9RtmKxUNg&Jl_zS7zg~{s6%~It~I-hJeBAaBv zuageW14Y)XxCUWYF&_t6!$goLuT=j@oZo^-;k)qVmITc5Okp_gjDWYAXXjN_9(`BS z!S44R^gI0WGnmDBdSpJ5&0_dmE_(FGL9iCdyt1DE{=2wPWkDbhh0IFU`nC;(`)ry4 zyrJLOf0kGN z0o_+Y(wHR31w_D=TikYEzEN0mTib_e*!s}D6Dj3Fof((f)LA9Aa#?4ww`LA+esRP! zBZrr-j91{kl$|1NR@V9_Y=p|o#acuZ6ipB#x=^7)A}2e-Iwx$Nw~PF-Cajp}GCs;* zIq%~oL_Y3<*IFgZ)xK8$cSFp-9(+&wlufnCHx_%k=d3n)7GWc3L9?JFZ!Oqf=1Ef8d)HMiLv;?op z`E?HxFhbk_OvI?nvie{QeQ5pm2-?3o>1cZL!|g0i?}XGBlJ&a8&ZkZHpT!s?Q!B@K zdsjXCjY>0LllF9c6k3-jW4D2fDtB$Rd!^0_^-x-q$O%TF6Fqqi2ij*mTSc)44`h;t z_aA$UW-{@*Y}ZY0x#=`Nz1#zN6|S?xte+Eyp$CS394w#VI<+VT zG^rh0lu)z0JnUicC4@g=o$zRUS$C^VKqu?cJ0NO+nd7VAmG~!+O)YG!3!BvVI_hT- zPn$()-8?8SXmX-C)f}#ok@us+MKX(guJy*nZug(S@=NfV?M1Ji(e+8)GKs?2F_FD} zss8mfOjhvYL@#a>*X*kT3-#f$1iuOG(879&osqXf(RHhqf|fwyLkZIpw9+C@90na; zz4j@bqsA7{@#B;5Q-gdI_(CDWX>?j7Pr`c1xSC1LcFfqOeU_}7VOT(kzG3o|`R47V zVz^E*LzkQ8&zcP;e6z4F=W0=bBmjaFPIw802y}n$4Q5P9*?7xQJ(!El0}6%OQGw9kCJQ&8+pD^vG3Pcyn|~p%k^NreO8D_ zS3Kn8-mrxI-f0jDGFaz$AupX52_A)pJHL9(^%yHfG(d{ncJKYQX91Y?Q5vKI<8r^H z!^Mb%NW&5fa?x>`7=~Q0CFBqwG{9>WI#ZUcL-2@O3{vNL7 z-J~l1I&c4dtir6ty}!FcrVjOfGlfl_i|sIw44U5}UQ}F)YIfJV5BIsH6%LP|;wp?z zB+HTuYYX5LXY!~{ZCA(klMR#dh-}uX>_eDa9(a<@q&TJQd$<{H(3Y6mOvl~v2FgdY zH+~>Qr}&SB^Y0?67}q7_#=LIdacx=`+U~}t%aU&Kh!owKO#ckY`*UC#*yvNBO-F`M zY+tlHuRU{JdK*^vsU`T;b+eq~NnUmNx)D5iMnDYH^3?I(YfX8YFlu$#uX=74>5~sX z?n6r%jN31UvVFPHGx*qHv8#CzY-_yVKrLy;q}xNnuR#~8ReQ4K=4sUuys#1+PV>*R zu+8q;g2+J3H?N^I>X;0;jvs>!Ez?>^X-8=lF2uGCx`e_3U7@}jDH+{u%mw`vbo-Ztnl4FFZh}4KHb+UI`csgb3H*sKCL;}s*2S* zdYiels&y}o!)31dq`@qAN{W+Mh*~{{#-Ey7hu~W&2yIRV~pCNQ~F86Tj@ z{REG{X6v|}vgm2wRW-YmpCw8)JaIHT+5hU%;IDTJeILkUCKeUZ%nL09wzN)O%(oYL zJR6?%qN=vA43%V@?>3F&gJ#O&@;HCk&iwMNhzoO}!@h(IyhJny1_rQ&Xhg~OJW=;L z`i>mFz_hd*T6yI271#(;PTtj&$Q_!!RdTqv7JcODk(F1Sd_x!|p?`mN?IbI#BDsDM zGo*^|10?J{JO*b&d@N{~-ors)bg8c95KD#6gmZrvlpI2Qpxp!$Ua_~$d%Eid=2u&1 zmVLiRw*E$XP|mmvJ`$-RC4Z&WU|AI>alupLtWB@+7A4?znDps1pU_{3ZO2CnNeDHLLEhzNkgYX4Rl3*P9tX};!(I)Tj z|3rhICvS!KuF6PSfI7V-a+W{`f1cd?y9+Q!tPgf;DX!7{VWQ}4=|mFpIxe)Na7Lh2 zLW|j;hC*7rdv9r5U1)r^HXceA26V~#S`Zau*`2`GsUk3^s2wiHD49iT+I=;p5$MxU z@BIu`k#bk?Z?(y!>fP-oeWAYI?NkSm?L*r16u18|h4e^@Xm9DgPW=EFB%!IiKq0o6 zlR}Aun>hXY8{ZE1d|iqzUXe-=Mvyub`Gko7d$%`!x|_>@K$GYAoRG+-Ydym~z} zSQyVki;&-Fno+H3HWk0&lz7w3!S+?{t2OMCaqxB@r$+np1fB6rc#jftOM!qSwF%4* z^@f-NGdwj7_PS0f*^DaGc~N)*%YOpqF90^zT(+QxmxkBi@0&Dv-N_HC;8+9VRJy8i z8Mt@uK%*VqcK^ugmOz=Hj99J8$w6j zLgq1VuQiCbv!MP8DfqzB+pgl2Ev_1i!8wNy#JsjV>-ql9O7QLQUfsxYcW5tar0R`| zpUmwRh4v?)JBh*P1FY%^;$fAIx|gtv>1*NGe;2>;2N))qOaTLUVIr~6hy;-|W+%=i z)5jtbz5C`9G}Oy5Vf=Ji>%54W3Hqq!1A6_0zj+RRFfB>TY&Raj=|mA=1xELB-b3$s z-^hS#poz3YBYPHd`8fS}4^HbHDjL5-g8-1LANsmE5$NoMbHc8T2h#sMvRoJq=}(aD z`8%DdNZ6dLwd_VgfuHw*vXiIY80{(02+Au6`;&JJM6MR^Twbb>OiU= zj8Yr#_g=Pj{CU%33hl((AHc%-fDxXpI)LLtdYLY#?T-DX8UsCYU=C~Pm0Hs(>FWrj zYX(E#S3o46I1(h`y(dagjC)I~98R6KyCG3mw)6%B1z4%l`T#!`Y{;Ea9{)B{ajWI_ zv0@asGW!`2DkiyR@YzOh5F#?mq{coA$JAJI1yKI@gihR&>c_i{7P97|nO~o*0&D0= zp~asE;RI)oK^J&}D>u(33#$CbBuZ9ylW_MhS?{g3m(zRZ6t8rWL<^(rd0g%iU}Yu) z$USG2;XHI3yHYC)DtGKggy@0Rzq@4ur#}>#du+c^+&+7<6}FyM)1izVJcl~`v2D&N z8`Lj-7vUzmoFTgJ6B5!d`eX$t3GlSG$J48*z1Yt2B+=;I?Dg;6r}LeYx3Jowu?|e) z4uMEAc#;$TZ{Fv&YF^}z4u)1Nzd$Ax`WiC4MAzSyxTsVJs4$NL3L&rd31H<|LN$ik zpA$Q$VWfRFSug*+m;-0yte94I(M!UGgQg-WLFqDdQ$*wQ1j;l{@F%$GV#nvKVaDfd z>f$!_&|qig)L&`e7&R?#?977#>v1YorNyKX6~6^FKaW4AtwU<2Fz=mQ#R-% zY-hxWQWSp;JP_y@HMWTv5fO=Otch z9#o{*4Ows}yw^%U#vJOD>;}4Slv?t!L$|DI-F)9TYw_COV~Z%sfn$aTyrK9Nw|hj+ z0RmAOSf)Pn8t};-qH@T-s0gb=qq*45n?#U{Gl;+Qun;ax}{xYD0MTP71 zRVIISvmg%HY#O-MlVFwq1zM}r0vNlsb*wYi_r-->%r%_#Y&D$G`h=#O#}MvUZ;W3& zh~8m44ZGO)F+8|*0$m5@!T~Sc)Bx{bk!9xWt2D;JwRFd)-lvHjTA`(g_r&gAE7qVj zB0Q|I%l?*c+(qAb?iitkiVYV22f~w&75>yhQ*@EBJ!kLRgedIkKLsF2wz3{JhlnJ& zh_hGw#?}0fcDWGyfKLxRIa`YE!H&$JqCjM1kSnRiY$)ni1zbUz4SQl>E$~){D`*Cw zBu*khy0AmgcIyDG*|}&}*1<{JsVM&y5$pkTczO))4rY=lBi!uJby1=kxeY(ZWuamJ z1MiCv@&{Cb2r=CL=M_bYpB_JN??Pt$nT}|%?a~dwG74ffkA+UKAafulYfwkNeKz4; zF@JtWzFJ!uxs@@A<}c14GS;uzvJ+tHLf2nY1QglOy6|5rVCt0wd*Xbr2GG;ADHv_P zo@p4qtubjxVrdci7*cwG3j%lL<%0i~P@%bKw)E_1urB7!w2hwi!MIMls+jTNifOr9 zhBNU$!SV|?f?tZMEZ)>%W0Ai*ifpALquvYemae?~4(`xJ04L|xY_m7DuKPn4FXI2~ z)&aubNu4i#MJaZO4ha7Fz?gfem0^m;6++VxrtdH&F@wFU!wD8(Wus3BEPy;cPtAyr zKr=DtRMEH?jdGN>&F{)@>t*Dtym1Hf4~P#xHa?|GVqW$H@9Wh8 zGd1KK8UQJ<=ZKm84otg?Dvk5ThQ;U5;k2f3vPrCx1yZO<`0#TlvP8v@k6T))8JFiR zP9giWXH8+`86Jl;FpI2fY*6I*1kz$(St_kq#l>wte*wT4G&}HVd&F^so3Ura2JN_P zjHcLLmW-Z)!qDoKL~hiE_xCD&VE)&|)4jmOu^Q9Ay1nIB&cxP@7dKMAxVz92^_+Dk zV4w3IPSGQpu#j@YxZ=?#OzsYbDe3Qi)dSFs%jJ+Nu+Mre5DD{iOncr1tN|xq+y$Qf z7256F=BB0w7zLq`y9>AvAQN>fTNk|6MtL55ed-OEg#;=p_Vc% z%$y;P{Kp*d1+3LF@S0>gG+hl~-7$5?st-qjt$RJ30fX?{yNGf*nfSo0dIgmti5Cx` zEe~o?l+oTBmg>pL&tLf}I7 zSQzPG)g>9qxT-cE)f7}UX%YF&Cpw4iGSgy+hc_LFAI%CZbnHm%1B_!G#6(uIlIFOG zBS5F3bu(>C%x|Uah``>F8JCG%-`BOz$#cj(4tb zXEW2zODf4{E8=0#P~0!4wgnL-aLPE%pO;}@++O0r3dq3=yvQx+5bQWDzv@H>#O?m_+u8c8zG*g@=qeWKmbBCF9Hxlmg{<#v1r~1U+$hTEF5-;}Zg@vyt zcu=WQn?dJm0*QTtaJ;jIPFpPb$EjP2J#KhGVi?*uj&eXgpCo1E;7Ht-+tD4tOC*iu z2(sT#3Ny?~N4Gy0aWU{Zo$1`n59s^V@Fd=_?eARIa&37(J&CCZ_(D@Ape|jIP5{A6 zhPYz(804!S;}l-tImhp8w6x3Q*LHt)XZ>Qu|3t9K;jZ$9fdeL%;6exWyC`4N`7f&k_M|zs?Si$QS}tq!&=|Nk+}Vy zZWg9)>gxi%O26u^Dv@HDXzAsagbDE+wNvp<^lj=Z1?hNJh5O`HYz4ffY6swvK@f&_ z8McS_cB8-_C_F7K6yUTUBApKdV1<;s#ov!{0>R`UCz!HelEamK9*T@AIgInLI!S{c zFge{5Z3F2B#F-v%4@wC-OwLNfy#6jjG*fX+6|ttdWDw(yL=o!7Ym9>HwhQB+RiHW@ zWMdOS6q5A(FafTK8^rTbp~yqox6pF8YLc}?*Y8NSDI*=-73K8L?0NEY1`u$-xpBY; zrbYO)YON-7b4y$yjc@~4g@F(OHtLE7Cb{aNJL#S5XVZD(vX~#d4~)EXa-KFjDx|W| zw3?!2?j;?RMrYovG7LzV4@fuQj3>alu$A}|C&mq5kG2i`?dK)$?~D!2j6rA9iQxu` zHQgpfB!g3GN@!&4A~l|GjM$UA-p#GPBy%@__p{4{R`w4HZ#RBCqTj9om7(f0D*5qsA_6Jp_MO@@p9oe-o<4mK zSAdZ$RSgbJFuaq8hB%`E9rLRLg*>0NgeBr?8l=dLr8H{Mh!@WKO(M-~JEDfJ}ySl92b z*BOI9;iaX&kI6{MkY&|uM?}5lR*&~Q>><~+%N|1u?034vIM$!8@4MGu4gxLHuL)iM zIFE{_dP6Jy_X&WebIY|dXm*xdu;a$BI;$1ZnQnoDPM50Pr2@!k-+<7kk9nZO_rG`O z+*c}GYZ*#!eN)tc-Gki$QE!VB-}F?$dJHJOE}8;E{Xd}Be?|+>!y&2+YYL4D9m!n1 zzt=Be=+EpE78W)J5;j|d>uGmC+2et03qf@1!pS81uUiehHQXPrQ{k2PJ2qtl=FwEjaGNb2L!=XienVT(S}#Xc=I_31T9^Vw(RmSnjPov^z!U#%WH{>!S%h zH=o;a=YeM28$Z=;QWSiQWMoO2=c-v+=+Zv=J$?`G03L(R5PkfUX%)cqJM_a`?AKPo zi-XmJK<+1ZiF{@69ea^|gwO#nFs;JI27`P465Q97$$b79PHXL0$EmnO7hcvFn&^9n z3h@>g-)hp_V%kkdbPrP|)0Ml;KQ8uWW0d?5ggH!KqyELarN16>6Y>~|YeeRl1MxoLMXpTS- zs59?GGArgcXjTz3IRs<=RcEZ5kOjyF|1cUUhj<>V+^-=>7ftZ;)-$g6)~7annwg&c zZxjXG$`Y6bK_p*(pwipGZ--7LQQW1KvsDyRbFPfS;%`LtOuJSX;HeEzKvuOWjm8CY za}~ooo>JTU+qtUbP~voW9Jy|jHuS$%4YEJ0_!M7V#F;&awLZZ~7imfc>6EMol|C~3 zcXhCTz}cZm@4G=MH4Q`L9?yPItP@Xaw3KtG#>RnIee?IitH1@g>-g;!P*c(G-F6F` zO_~3fTmobT*%(?WsC4q5=c8`N<`cMOY4Q?+1GjAOBWGB+&bR7xLx*(0ZGV8I#c28j zF^M9oO*FD4I=DChdXVe+#07JT<)>&;@aA+ zSc1tvfY~`Z-qpN&v9dq&m<70X!40dbxBE7a{om*LT|$iEw$HLN?pbPL%@!AFF-uE^ zn8f{JQ$&$X!}Zs^TK4Q}5Jgln{?8mDnZbs+l@VWm90UJJtuRyc<6?Cn`;4$O%MrO6 z0tjFP8Q_p!WO&Op9G&}HYt2cA^Y#?Fe+UhOYo%2|goS`>pH}qAzGG%AG2Df#d<3(} zWfW81bV= z!%J#6N&tNU&M_m14^!&NSP>h9>7O~kxjhG0h=FaPzU@ldkWTYx3|;=kO9U~s0SdER@%mdgDQXW}-s)De9-BOjzV-q%BKdZ!#e zFmNY)l4fq+xGG{>&xe8nQu@~FK%#N@?y&F$%L;)MfYh`hcfi-&jRSf$UeF8m6!Fl~ zCed8ihziIU;h<}Jhx@7c!4b?#gB09W$iBt)iA^HppSrUaSsueGX>3yTCa}QnBg>DO z!u=b8H4ISlijn4kFljFkuVpt(KC03`ahD1H&$h(*_8yzOMr;ts%ao>bPf*E}I#y9t zB*Hy#W-ZI4<E&{|~B*v2G7oKhZooza9@GK|@#))R%0?q`z8nT2qufzJ| z*diGqS~p=ZdSPN~^9+~cF_4}8R}7ou(rSahM1p2px2nc52W9`YD|F=GL3-{g_i&;) zw~EM{4*ieMOB24H>);yrmyU%0&Kp!S27dd3zM`7Sru)nNe{n@T$EP5sVx-Q910V_* z0MgDB?NVTq*3!im{>6QjH^)WH>hdSX-dMPMr?c7_vSizVy_(~^X|AfqDcAL{m?7#3 zBE4?tO@OrReV%0gqHPvUg+xw{Hv-)+D#w2~Tiiyt($Zh&k*5z|pui@&u@YuV|Bf-3 z1xE@LXyR`CZ10Mz>ZCER-T0OE+ZQl*Ng#4?bJ@<$OY}7xKhO_H>8yE!srFCruc@mX z2^!Q$YwQ>a475|uF}{a;Qrcqw7iGZVBH3zN_kSn>5EdQSLN}63b1KeGEMh=`8O>Yk6T~srRDHXP=a)7P}rOJLKCtYn|u7vR;(S&V|C~hE?IZzf*W~%xuEqYMwf!N>dLGQWtxJ83=^!6U=g@H z(Njd6<{ETep@(bDI%QETkfp#m<^U>l5lt?N5WxXsz85rWM=i~omI0Fi=#oV85RGpbm;+=XTPp(M-1{7npK7^ z+`&|s7kk{n`5OA61a$;oM~E)=_HEKCSQ0@_Y5AaM%BHAwXYWKyP0ZHX45$C1bt=s3 zOGE)Dtb3qx*UuU2jU$K%NvLg*nIMBF1D!MRm{hh?jrTiwZqL}rQ|sENMqeVugYd`B zg!ncOzleK1O-+I=yC~rSl=WiQ#p7;!wbAFkigmFo=X85LhKvClv0w)ioCqON&okHFK~Q`i8$A+y;+@(r=dwVclX?gPvC90Bd7e2|9R$rFaE#wk5qq{ zG~swUgqeXV7NGsV66gX${q+5yH^awxxCX4~vGTnDhP6NdaJ(UnGy3nBN3#K(LCre~ z%KjICAZ4xfDY{Awgpg`r%YFI>B_+Rx>U{Xv_`mKththNlY*hua@POO_($uk?pw?Cv z%?PKv1AKBmKOr4%zdd<|+gB0Z;Fuaa_7D@5dORxLE!{JM`X_xFGj1$%DG;=uJs1yC zONcm}kluuUx}?C+0oE}ZENZMKo|p3wq>e#-0La%G+HO|X$5DdHSr5dohQX%8fMp(Z zUioR%R0ZcIT^A!f^(vw?fR6-AbX!KCX6!Qbgc{Ubk>lnTa8>Fg;O|0K?E5&C?H9Ks z5&YcE$L=ub5IjT(@LM~o9sB{cRR;iDwSoiAMX{XBWOh4a@B79- zQ_E>urKSc~>Ihj&IqHKNY*V6i=7uLKrQaBw9&(4-#qTV zpa{4NE>qglgPq!OU;1v3>Z$n!D@X@(fs7mS-{KgoRD+vT8$YPu-SybhhUC>3j;*;1 z1L2MY0|vVlz}r%#5PbIpwQ7O?nf(NQJDaH4Inr3oQS?}f9ZVjCxjU=i0vB^S9tLcF zh(~?x0@@j@3oW9_^D!|#;w`StYbxyv*gy<6`@iH5{8sK-?Qkpx&5~SIX-x?x;|%0W zUL>ZTRiA$V>KNVyQ|2&|M_Eo_?P+6A?iw_-zrXoi%&KyhgAbMW07 z&cQPO-3#D10z~BRydOMjz>1lN$>==*K5r1s&ji+5hz;PaODby#20h2p2C@B4Q9XMG2k1P>nRC~iFy zB4}EVDX`7D`jWZV-@&%_V>GhrLNR)EN^SjI(&D*BjWEIPJo4!$ud3--8;)v;L1L|X zcx@_0(geZl5}MpujqKdLXKA_IXn~EcU&t5(;Ds8go!$-`jXka|q~3Z{PWvP7!gg%@ zT+^7JY5Bq4*!UBt^0$uLn<7CLFPp`A#L>509b z?B2eJP2z5_U~kYYi@_YVKOfWaF^@<+vAI8#WCUjQ{%-Av)tF~}j!5X`v=%9e-ZEdM6B2i&BwEI5B{V5&b zX?jCeP5X$JI>0w+rt^VN_$9;!UixQO+n1FlzN&n-+js>D-jmA>N4oLHr{{+~uDb^E zYfj^fcONU*x?eQRdokd2JT6HT6L~Ak3r0b2gSD# zgF^O;JcXXfH;yfj>(n2o3L}2y?w?><4BgB7WsGzXCvy&q8%?bky9rQKv4JVa9l;(X zi^uV#5fAk`J8#Dx@z7$=^=UG4HRj0?II>)fn0eLEeW=?QiRWzsqSg1RBSA7~_4v;oYf^=oK0~+zLlbR!!2hr3Ex3s8x znqqApCK%ch$pm7zMg;J16js(L|_;hhuWF7slZjEQS7NjWFT^diqMjX<;WLg=94aC0KH}gLApBc zz~%$6mg{%qcH%RX-E7V)ifp%S`^Nj+?e13zYwm1X|DX20JD%$Hjla&9vMM7~X33s~ zc>vN8t=lT8j`}g;HJ^j_| z_>B8=-Pe8H*Lc6Ln-0bSCv*TTck0!v#6+GV?<>y? zekEZ{@(ms21-2KIHQC=;x{Bry<7Pa78E_f%SFfNP@^e3({6>v6K!U0A>{>@(&#R;T zPFH&)lrm8KZ=V@GKU3qH@r5c?nNv9P@iP&R5j!f0N}?n#B9izduxf+pteiPM@O$kX z0dZd?QP`1_A!=B&&f~{A0LL$;@oD+7QW2efeC^MMs7$L$e-$Uh(K-i{!tT9cpsaKG z;h^nhDx4Sm?UD8&njp5KF4k2dcWBqE*jnZUX3 z`^dfs?6$=L+f?I@1z3XyoOzi~vnc@nQYgLmQ&qhw)&Y{s2_0kjhAnb_q^|;GMj%lt zg?q}C&8VJXadI)+5Mi6l(w4iCsmjVI3;J_%KJC7((<1hv{gbEXlxM4KT-0yQ#MCu`|a?aeT8N9kB|@M-jypc01JE_D=voX2y@bbAGN z&ls^hg|zUwcg0qVV*;W|ul{7Jop4yCP68a{IWDo&)B4|wwT4&QJu}w(ySUB7<7ypq ze*EQpD(hw243Rpt2=moEK0Xl+<>V8FB|hzqc%-`ANXEk@7HB$cQs&^wON5pxFRSqO zdz=VHRKcyp$qxT{ra*efDdOG)w#sbiuW__ zL*4R=u$V^VAtDYHDjbHD+4lAq!|bU++`k}E)Kumc&(OQ3Q>h~M2CzQ{9SDX#)K8QO$UC?~zyRXT z(8^)_$OiT#18CZXSv}*eynp|SRRs7dRVmVdA^4yD&6mEsfy)u2qYx<#B$M8 z4tv4&qdF-wS#GJ!Pi%NOuFNGW`7eD-##&BG&LU-j7swQMSqi((bO%fq-CQ*vP}W9b z8sInXP5VTs*=RC4fw3UpIpT6xAn=Kk?~fDnM%G=)*cNicOp|C1g9>rm*MI5+q;8nM zLcjta-o{)tXyto&@lY^BxrMc-oAATjye6Mt{7?;?tDKD0zD$K=S$DyiUWI2z)LL>y zWqNLClhCCOneEf<>6!Sg$C?wE+KFpYst*2<>|Q0bLsaFHvzHJz`Oowk7G<=%7W`lo z0;ww;R%b}l9i!WxXHaC|bQgG}I{x(8$fdd=9Nj%BTyt4p5}t_z4Gi%N*O zT^>}|L_d`AZ`~%68suWT?C0NAqEEIlV>Ue=47{FyQRP?KIRFw@I6`c1^{vz&URV^>{8cX(252yJNiLf}uvOo(TTYD=C4(n{1 z9wpyww91EtJI&joZe*uf}ep_lY{92xJ!GRT=ZoyHO5v4qRmcK~xk(XgT8gyzDJ_4KKsisAwS^ z{M9-f$I0dEtDe{5$vf`t&T#Fw~in zb>~Ob2mu*2C>4*dL&GZQ^xB*ae&;#1u-mhB)T;}7F#}`|9x;8G7+Db@`^|Jgrh4Of z6mRX_Q>hBxvIBFyB{mC9cX^O}b}On{Ypb_Tml?juQhnrhIJrMaU;2tM+uhgF2h-(P zE7z3K3zOd&AU(o#q(08ACQ=Z+V`JX2dX+o%=Lux{^7V{aohqF?cKmQy`n_(-^v8uY zQv-to=HZne6f-^zWhBfW=<*LNxEy8s8%;lQuyrJL$643s%m%|Nb);f<1m><@di

j?(uvAoJz5HrVlgu07L?Tt}6q z|d9E+-oU!KR;*g-`K~iJwJhD6w>TKjpe83 z-`26&`t6OO_nSm*`?_)<425ACl;N`9+V(ZYIhpd7xs~H>aAHQRQ|O7v0a2rU^nTPb z)VxwM9fZbhX~Kl+kqB>_8-#H3uIdEGj+(sy$a9?%3N=TV2awqnfXuG*MUSjcd7jYO zXguNLrk3vpr)4I`IQX~$+GFxqx8naM9uVfjy#hyiT#q4z34O` z)od#FG+-9{h#vcwORV40jR)#N$l@)uhDjm6?Nd?V#d|7Bjl-&*T%?*(*LzO==gp0W zUwu)7%z!GY&%~!~V(#6l-H*!9*POT+z;an|D+mkio;o%FzaN$)IPHOd&mn%FPp8|$ z>-XkLi&?Ht%_phYs+{|ACY-oIC; z_g`5r8b=v6#xn9h9XCt2ll--=MBD>-GxOzm<9C=2el2f#)MZao|cwMn28Q1 z&juP4)cuaS&~LXw+=Nw;P54T4ahrb0x89FBv3^F6XPlWGr7>T~jp{zxOFug)zo>M# zn;8=+a#fFMh~;TF#!~_wgEnyMB5WN@c1nb*35E%_#gcN*zV70yc|k4}s^J|cKSRsJ zYk0}R8Rc8G9b_H3VFhYoTG-3=WK;A#1Ljz4PW_XMTlBGhmEn08UBsz>KKj~pMJDN~ zY#Rod8nFV<-l`CsOm&7&zp>Gr`q=W+c}5{9#b#!L`Kz1Tmo^F=zMa^-?onTlyM3^< za!C8xg^Z5xXqLR?%KxblH|s?xqBm!Bzp&|~Dzh8_Dn_!O<&3loPn#2%|Iz+ID{6}B zew5*U<8tBfAi*J@rD845sVudu%C~tp-}IUhEA%c1NcEhkSNZ|Vz>}QKNvqfFYN)IF zkdIcRe3(nPYT!2iVs%R?O%SCr(WhN&{5`f~S=qRyV6pEhdz{Y2S6(jI_x|09uW-m` zwIQ_Ql_ix*^V2euef546z;$xHln2{6(z9-gS8&Mc$4JHsm6xzaH0+IbWw`Oqo90HZ zX!0waoK~5Ebni^X4fd>ZD zexyPs%E2n=c;YnG;jX@$J}&Rjtr0CwXGOnu-I=reo%fBgf=D#lWpgd|o|x+x5qFrA z%UHZVZ3itD+Y~UxzYxyE=CN!QG7;LG_jb&I9SvovWkvdZ5*bRoYLm@JuyrtA1TsSJ zk5eSir)vMjA3M3}yu!?+qwi-p27;AD~loH%NF`+O`!i%Xrx?0ep| zh_P=wM$)sA*d;Q@p;~v})$uG>c;u`1l70g#<>Xfrk#)8~4wS`HFQsy7thwoPw5{_> zV-iJjgbpUL^1tQKW?t8oMqB~T|z<81S%^h~Qr zHoIE47m??^4SPjcpgBS#d3?h&!g1R)VV6cS_2>vPew>wZNfmKYZKM%W9N}W|Bz4b&X6>G(=Zo?S9Ws&*T{hzT9)d#L;>s9^3b_WN+FdrnlP=G##!MEIRYB} z^$ytkNC5K$K=Wl}UWR8*>M=GRh>v4xaQs!cn5gy*#JDie9Rgq7c%u z_Ueex&oK0TD|BL6L_JN6%JXaoi3Y_DF@-RtRmlO0@_ziD+!K`7PR={{@ph^e&Narl z`G`;Prvn04=$mZ&)^iDeECZXQ8rSjytM5S~9!Lb1{LS?EV&q&nvN2|LPl3G0w@uox z>(oxBlo?Z%fXOccY-xFqhBk89txxW1ZNc%Ex+BJVKTKV)M7 z82Q?DsG>}-bNC`1b&yYMV}mc7TZ(&P#cdrjjlB~H*^V%jE(gsoi}g~VcLhmriCKV0 zPD?I8eN~!RtN`tw1EYSk=8%fJ0Ng}mX^TYwFNmu()2f^UxY~)K@2iP|Bb64s&VeGb zY-b`AOwP8)weFj?Cj9%0*0y+b3vzLV>wNXsNeF1-J^vt);A*i9rDNX%Y;0{BGWvsh za{3NkCghb>Mw|V8b|KhD30Nsa-xWUT7o)lc?)4f^-5%q*q}V!uMnAdYjKsr#zE=yr z*UGyx4OyJS7Ql_Ua$zbcc+PGR?J0Q)Og}KfUBl9s|26uPdnx6|iHKQRX+ihGH!Q({ zfh&1JR>p{%obVM&J^wu251!uQla8E;sg&l8d2wi;Uw)u@5FM!Zx4A4OqR2^CGa(gD zJ=ZwoZZKl5PgwkTmfvr?6WWdJHqM?yhPONBHTB^JHG=OhP?F*bkPq_@${rErqkHdY zbP^IeXE<;)4lPO$EW)Vm%@D|Qry*aek}9e(zy0)7^S*P@ZBDet?L_H&AlA1#faTQ7 z)gf8-PmRqShMT8KGaf<9ZRCw`U{>tJx`J#LB<6hv1<#56XN?quM1p0U}&-K zUFd^-`U7%Kf8V0S08^-)BS37%^os$wei3KoTSN+TH{`b1WB;&wh}X*?n6sz(9S9Jc z)}*4gbN_8Q3gGX=&tdoeYvTUZzzE*tM*c4uKSA$u@`)3*4R4<%a0wGTZJeP5 z3m6Lg#iXTN?dIGpVUV!e)F3qYz5CCcaJD6YQM4&WdUfo90%phOGAW}orz6~sRO8KC zCC>a)m%-<#BFFVMfR~yvRu4S*Eb~ug4+z z3it&`L=Bnv)uYOdEJw-@CHLLP08dQQB{mXdX5rXiO@6uZ$dm6zLU zW8l_fvQ8Y`?xU>{bk);IRw9yx3{NE&B=+&fXg^fOMPg2UMQGH26s{QhJ{4GQr%NKg zLCPp;RP~7lj&?2#+6&}+hyUxu?~nTMX{0C|KFtcD#l8ZYx`3@W#=A!VDO1{jpi@`E zw+lBWj?@W>vlxgQIV?a;L>mE7Ex0;8c9570luF7+EZgp2egWjB39G0=%(pi&5!d$h z-e&u>ov!(@51-2p)Cv%ljCezBF=7ZF^pcXh7TiGNd#HgU6!hiYPAzDNbK_o?>G4P; zrl*iMJc@@YwA$t;a)WroYP7AI|dwaF|0b*&zf4Q@_*Kr(B=^yQ|m*Pec*{*LYmlvum?3jIgc@SWDj zVbloO3z?`Tqg^2$`Hh{S0b-;_CO&262R*`pB?$%d1aYXVZc7kZzo%){1&8n^y&pMa z7L|dTxcaSivo_!#`B6w9%jF@~fM`!@Q^^es3WTcH7n4l4ieV2jSw9n=Ptr_8;s7Rv zDoV%2J|bdjka<`A1`qwrpgH7>*hXo_>gPBoRQH;5&n=@In&pN|ABDJiyr{z&lK zY36^6?_<^Koqw!9^xUBL*BT`@-S~f!9;}*@OfCtcHTCCvWK@kSdL8ZXlc;;yMU=!B zlC;SHR^pS-1vijEP2j-ijDxLP=2d8H?D!QZpw;!B_Wfx zG=_mOR0@;6dDeiSn=-rqkIWzw2AZ+ki~{iVHOPkClxZcoamHEU*w;hZ=l{8K8-O0u zms7)$-d1FNLeMn$)fDevY<>$zAHgmNU-f2b^1`=&%TRVvV?&S~Ie#Nvp68sx4vH4u!#N<{)9 z#WY!vd1X;iRAuL|Q)zLo!l9Z}ll7HE3jmt@nI(54fR2GBCB8B(0`YQQTdbeCv-ur= zD8}DKZoHW2t|9|U>q1GH4a!99-pqrNYKmB}$#uA9u47IVs0`KQ0`Vk5ifaOTTQLsS z?@#E}DCx6yUCyD0#-wdcMaK2S`Cdo1lZLJ<`@z^>p>dVO?osQ~z2ZrbW_5ni1Bqy` zLrJxrDG>w8^uRI#l<9DEzwPR+4U%fyBySKL${%<;H%HF1maJ5BiVTw2(F; z^i__e>o1@j4x5_>igy;xD%eXVf5^mxv-k&hNfN{ps3w$cDYTIeixo>zN_5NT3r?O( zJ2+!`x3yuBOmpgH+8YU?n~c1~`YB9&(^q4pFCHKt4TnDsmHkMMvXieWY0OelL@V~X zxok=x2UC;Aq(lu9Z`MYMgh}w*b^0|gTfxKi1>$V|bGPTh0uam{#OJEBopw`nqy4ED^OH}#d5Nv`4K24gW9`1;S*Ap^aW zpkdJ0K;pom49gol^gvN@r!(NMEj`23u*ySWf89B;5AxvLdQT&5^}kLLBZj-M@`aNv z5Kac@?iGx#ajCNYR-e0Y6WlI>hD4i(GhPmKi75@2GDeQ6rw{@p zq+9xc0BNC6)58uOxA3{Ffa%i6kKCig2-jo4@0)~KlemaJj^R;pklJ^0;f#eF9BH~)M(l=sZV%BPMoK|>1r@_qHlNRm*xJJpOVJLO3c zHJM#dPhR~#A0r=l9vIJEprhXS{rINywGsFWG6qMGxpR*O7Xyl5gq&M(uCjd|iQ2bn zPmn2C_EJIAb|Tlzoo$ubB6aEpZH}tX4T^I#;}ioyJt@_*Emg7ON&&>Z>j_dIxv(wL zH5ey)YwW{hhiMj2MTE@$Syt_a*eE4x@-t>VJleTxX|j~K{4cVmx;1=6B)%gUFD#w- z^z+>L*DMQ$mlHT~Eb>_pxd~~2>uLn%sM^ec`chI^t%u!vY_6!KxL0;rwv#>GnQYlw zJV^lqVATvxiwjr7L2FTM7AikIAx*Mq%B08vIMwPtvODWNRum~B z&uzJwCL85hdHv%w%>_Z`7iup_cmG-UR-w`|N0&~!o`uN-906~zZbl-oMH99uErj&E z#(Au%u1fUbq?uB^G$CzKQaz*dtMVdmNCQ&u<^UmVPmHf;uo@0lNFVx+Uh{Vg+Nq6$ zb%$Yx-mI?~D_$r19jZ8YFP!Nfwd2v=8vCV<=_HHQ!GfA$9<3RZUzHkENDs1GwO`>; z7h{)~ZrvEQ9X}B)-bb)Vl0^3ICZhW%B&AG;HdkGq`f>sCFDcyP1YPT)2f_rTI2)<1_N^8ood}Nx`XCq^b2Md)2g^Gy8@z(@>wV zJ*+zH?BAs57>Hvo*sLhMd1~EaiSo*xJuEXC=g(dml(ZohAsb+DM}1uL(%GCjy3O#< zsj#`0QFsw5b9tn^ISh>$(ph2$v8P-x{L!k56R|HX4XVlUC| z4zL^meG6~?b{&R8Yaa&Qv+PDXOWwrTmL~T5H3=GU7Y3ESX~JKHOoy#E#Q>14<$8Cj zQrLaq``DpDiWxmZ)^sJfW<~W_Hpk`7Y^KrnO%9}!Du}5Q5=YwOU8}e#SxUr;0s~v8 z)G`B%c_9sw0pR=05wBk&BThRpm9s;+4TyppN0>jEG^O$WI(VFWv18fN-=YHB&wEz6 z02}mT5E&r`Mo2A_F0Rcd6W9(7C;)>YWl$h)mlO&NBxj=8*7mKMxt>##ff{7(3Vwh) zrpl|PI+b#xc%I<%smeE~dvMlJ-7|i-3E)GJqWJse#lpyz`<{KKhRdUCI{A%mx++@; z=c|bvu>pfRUo6;Db(0u!a`U6)WY}JowX?>=*wL$dj^QFHyS?6&cAB>@|5lU9D*$K# z?Z>kaorPIhSkN?vV{_9JJL-oByp0R`i4mcWdPvRn7oB>B8U)4Z6g8s^kJXt@=v|9` zrOvgy!*+&aR^-D4Ze!}qF6U0Jc1!e^6$wqjfoDJ?2XR9A6Ug#(`SD>{e|h{`Gmv_# zRI^%Ft>zx!$3qQ$I351pj~x!aacd>NkvJ0!U8r8nO5YH7zd!Dk*f~F!k?;|_a#gV6 z?Vg6Pz>JottJ`8HAk75I9s+JR6AgZQ>UBAsUJF>U*=xmCRf}_{2If)|Pr$5GYVV}D<`(#AgSnOz^J3(@Rr&9QgKWXP@(UfaU1_rTy@?3^SdPr~ zCtWBX6Hg&MbAzwv>%u7}llGHE%sL%5k~IzfVaMweRkIL81{{WkxCN_dlS2-7-b6qz zNQcNm{f|zUx+)VIGwQ4FX}nnC+gMyk)ipktXSQ+BeuJ6+zVTz0;}7Sqol?Wwq71i! z>qvb7#*j&2DD(+?LDv2Ahh)^cR?Bqlr(B1Ckq@>HO85?r3}8+bF*5|(`tpDBVNYCz zpeCXg`ryi$?hml)QuV#TTL`Af|t>V9R39^=Bkvy7K(f|5&*;f6#B#;uD7b-j>{ppXJ=unOO} zv04SiWE1n-F5mQZ+p3FOqib3k6)jbp^Da@>*ZK6(cGIU%XkulvGs7a3@=>Yz&fx1W zscbD;oI7lM05y4PcEAmV{wT2%{A2bvv*CsLZFV2^?gNu_O}WxL?yFYY7MD(8m=#!f z6^6*IZ~n2l=8gqgit}66P7;~S6qK_2dw41K*?{T zJ38@mc0CRs+O6HVsuceEywhHeUU5&+ue`3F$REv^yY`|nDVSx*8(npLph-U|KPg}< zxTfs|_O_J_dRBnu@I4wc6mHazXC-T4Udz0|wFDtT zGS%UoROzgFq6hv3`szugUJj1(_9?0f5=ElZWT3HRLU3v~^eYiw^C{zQ)X??}ImU|m zL!--~(x?D!PG7{V=4eA==gjA4j9!o!p$qtuYd0ujf!r_nXh$1tAhG>Th#E}_8Ce6$ z_DBqApf|yIc5(N%-jGx6Y(+C8Zn^?f!mAnQliwOo<*L~xR>B%;P=LLMpa6@*t z;7~8l-TVhm02+6ocOf1W79vp5HcGZx?gl)GgDClft36HSn3|GvDs7( zz!D3rTG4S&c+MU25TPZdHPulL)y2?JqTNI%EQ(sS}tR?-O?n4ysJL0dPcDzw@H!-rS%(XEL4{9Z{e>lGXhJ&onKIS(vD*^HKCC1+I<|uVE=)ch^I?S33kh zEv_^Vw@P2O-Xfe^A6e({F9RCzB+!5Z*oxczkgi3DBdGx^iRb3#C2xJ#Wqu3j!v%&? zlKk10{Pw2xT(Q#)+nOYO|6ZS>J*^an>syaU7?qN;x%-eBuF|Y+^hh|PAb#aF0U;M- zu!u`}I%ZQKlRfBJOBk(CVn>Du!6nDlceQky9Qc|T6^O-!mEVfqd_2k-I)%cCZVT(c zCt4W)?MBX4g!PEpV7wF(f~7_dGWD6H2~|gBEJiwjQG*9$!;2GRW^LY1KF<HX?Vu~&taunvtHx(T< znMEg0G?0v(!r`^X6@9)&4csBc1y2t0hcg75f>o}uxP^;?+xHCNAaF1{5+JOsb~_6X zef<6QqnKz9W@;oaAx@q7mvPgNBwDb*7qIr)Jt2=w|n!@uR$Bl8P=BlKr-XdhoQe z=*^;t$tFM<^weiNAtY%EAtgxJV9vLok}LJ zLvu=a#Rgv`RB5CKFR(`vmPrA;VWlZ()7Y;~=~DH`G;WZ0)G*NhwOr|4^kG5Zu`Ts_Tx^1|J_K_4;l@fF3!ex0^00|x*a!(C^e_qHC@3P#3!MtbF z#!lReyO|`2TOhg6!{2*G!$7n@pAl&*=SZi1Kbe-j+u(_Eh47;m@~Epmm4_Bxwy}Eo zTWSeg)t{v_qmk91G>zOlr1Dg9UgG6AwfS{6K~@;X*ON#hQY3rHQ#*@4y9xDz+BPAq ztO=K3+#f#QFWv6kQdPBKC;>8>$N?Ft$>w)9>uBIUF_+HjG^Qht76PPgKFz(1cFA_n z^40`jx7QJi!EA!?vt$0QRIaa|3`c-e$l+~>3y)t6iQWNS`)=AQB z9ddls*qN}tml~(W^@ZDIf95sZZ=HR+8a;HuI{HF}fzo z@aVhVVxQoqDC)}}JcUx6Vu#Lc$I&9q1fXFU%x8&ZXI*F(WoW9LiDxvvuA2EY{7Hn~ zcVpOZ%jbJixWWor7tmoZPe;y|eKgY5y`@@*mQyHu_}S^O>32kyVl`llw?Z{@%sDNU zf+}8*of@dP5(f!iOe7U7LYpQIpW@}jK`3voEciy}K{Fxcd(=!l6koV$ThqNnvhMbG zytO4MrZCdv%Wwa3sULx(ZabVV04GmPhFG^%RBTs!F#30>F%&{F>2@66g*<*(bS%H~ zsu{+s3<5>#jEyJo)>b@yL9I}D?xkZL-6p=V1o1dfN} zKN@RPCv3b!uNchwyGq7K(TzSKnPsxQujXOv(fe}a#QKky-mvQa{#T!Z4y$vmDEDyu z?nSy+#-0rf;@vTg2qxwO+xBCY+}?5Sun;>_cN2aqEUgQj(qWHh{opxjgq$((u;aZz z7xSCLqX}QgI_#@X$Q??3+*PyZB|`YxSZdFY}6VJS+~ z=j~Dv0HYw!ptM21bMwL!4myrjuHk~CV^{0??=*`U(A16L&2p~ZDA4Sti3z~T$n!*9 z;b?gKG&PB(z*t@sNj&a`l6LIYX4_&PWb?rJUVYCOiKkw0W1hZG1nUZsBgJtjdVc76 zW_vU>ZHhVJVPAg~IU!07_R-gLmxu0Wl$^O5LwK_xcRZ%2jOR4Hu4mTtg^Q`RKtBLI@XSRpe6Qbz~O> z*gF6&#RM|rP#ipK23))vK)`bpwpy#N2`|z6P&1ekbrM-}Tfb)q-)Yy09o}c%Xd&%Q zrfN-AI!qy3i=wGL$VzunOj-3KMM~QDUOIhhb;IZ!=OxnzQ)ljPtS)l&bk} zwD*wW@7c=J46`+*r|U#6J9nr0%p|(V>%E}H$jRM|zNn6Jp}64k;nBa!yvUj-ZubBE zhv+l@Ck@y){u9D~LO=q5|1{x0A^f*H{I?4JTLu5Eg8x>*|EH?}lS;0zN1*SsxtnCn R>pk#KLq+F&zOr@5{{e@yhEo6l literal 0 HcmV?d00001 diff --git a/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/docs/index.md b/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/docs/index.md new file mode 100644 index 0000000..ace4440 --- /dev/null +++ b/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/docs/index.md @@ -0,0 +1,16 @@ +![cnoe logo](./images/cnoe-logo.png) + +# Example Basic Application + +Thanks for trying out this demo! In this example, we deployed a simple application with a S3 bucket using Crossplane. + + +### idpbuilder + +Checkout the idpbuilder website: https://cnoe.io/docs/reference-implementation/installations/idpbuilder + +Checkout the idpbuilder repository: https://github.com/cnoe-io/idpbuilder + +## Crossplane + +Checkout the Crossplane website: https://www.crossplane.io/ diff --git a/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/mkdocs.yml b/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/mkdocs.yml new file mode 100644 index 0000000..c8ae223 --- /dev/null +++ b/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/mkdocs.yml @@ -0,0 +1,6 @@ +site_name: 'Argo Spark Example' +nav: + - Home: index.md + - idpBuilder: idpbuilder.md +plugins: + - techdocs-core diff --git a/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/catalog-info.yaml b/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/catalog-info.yaml index d517d42..6324717 100644 --- a/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/catalog-info.yaml +++ b/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/catalog-info.yaml @@ -3,8 +3,9 @@ apiVersion: backstage.io/v1alpha1 kind: Component metadata: name: ${{values.name | dump}} - description: This is for testing purposes + description: This is an example Backstage component representing the use of Argo Workflows and Spark Operator. annotations: + backstage.io/techdocs-ref: dir:. backstage.io/kubernetes-label-selector: 'entity-id=${{values.name}}' backstage.io/kubernetes-namespace: argo argocd/app-name: ${{values.name | dump}} @@ -16,6 +17,23 @@ metadata: - url: https://cnoe.localtest.me:8443/gitea title: Repo URL icon: github +spec: + owner: guest + lifecycle: experimental + type: service + system: ${{values.name | dump}} +--- +apiVersion: backstage.io/v1alpha1 +kind: System +metadata: + name: ${{values.name | dump}} + description: An example system for demonstration purposes + annotations: + backstage.io/techdocs-ref: dir:. + links: + - url: https://github.com/cnoe-io/stacks/tree/main/ref-implementation + title: CNOE Repo + icon: github spec: owner: guest lifecycle: experimental diff --git a/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/docs/argo-workflows.md b/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/docs/argo-workflows.md new file mode 100644 index 0000000..1e01c2b --- /dev/null +++ b/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/docs/argo-workflows.md @@ -0,0 +1,160 @@ + +[![Security Status](https://github.com/argoproj/argo-workflows/actions/workflows/snyk.yml/badge.svg?branch=main)](https://github.com/argoproj/argo-workflows/actions/workflows/snyk.yml?query=branch%3Amain) +[![OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/projects/3830/badge)](https://bestpractices.coreinfrastructure.org/projects/3830) +[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/argoproj/argo-workflows/badge)](https://api.securityscorecards.dev/projects/github.com/argoproj/argo-workflows) +[![FOSSA License Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fargoproj%2Fargo-workflows.svg?type=shield)](https://app.fossa.com/projects/git%2Bgithub.com%2Fargoproj%2Fargo-workflows?ref=badge_shield) +[![Slack](https://img.shields.io/badge/slack-argoproj-brightgreen.svg?logo=slack)](https://argoproj.github.io/community/join-slack) +[![Twitter Follow](https://img.shields.io/twitter/follow/argoproj?style=social)](https://twitter.com/argoproj) +[![LinkedIn](https://img.shields.io/badge/LinkedIn-argoproj-blue.svg?logo=linkedin)](https://www.linkedin.com/company/argoproj/) +[![Release Version](https://img.shields.io/github/v/release/argoproj/argo-workflows?label=argo-workflows)](https://github.com/argoproj/argo-workflows/releases/latest) +[![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/argo-workflows)](https://artifacthub.io/packages/helm/argo/argo-workflows) + +## What is Argo Workflows? + +Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. +Argo Workflows is implemented as a Kubernetes CRD (Custom Resource Definition). + +* Define workflows where each step is a container. +* Model multi-step workflows as a sequence of tasks or capture the dependencies between tasks using a directed acyclic graph (DAG). +* Easily run compute intensive jobs for machine learning or data processing in a fraction of the time using Argo Workflows on Kubernetes. + +Argo is a [Cloud Native Computing Foundation (CNCF)](https://cncf.io/) graduated project. + +## Use Cases + +* [Machine Learning pipelines](use-cases/machine-learning.md) +* [Data and batch processing](use-cases/data-processing.md) +* [Infrastructure automation](use-cases/infrastructure-automation.md) +* [CI/CD](use-cases/ci-cd.md) +* [Other use cases](use-cases/other.md) + +## Why Argo Workflows? + +* Argo Workflows is the most popular workflow execution engine for Kubernetes. +* Light-weight, scalable, and easier to use. +* Designed from the ground up for containers without the overhead and limitations of legacy VM and server-based environments. +* Cloud agnostic and can run on any Kubernetes cluster. + +[Read what people said in our latest survey](https://blog.argoproj.io/argo-workflows-events-2023-user-survey-results-82c53bc30543) + +## Try Argo Workflows + +You can try Argo Workflows via one of the following: + +1. [Interactive Training Material](https://killercoda.com/argoproj/course/argo-workflows/) +1. [Access the demo environment](https://workflows.apps.argoproj.io/workflows/argo) + +![Screenshot](assets/screenshot.png) + +## Who uses Argo Workflows? + +[About 200+ organizations are officially using Argo Workflows](https://github.com/argoproj/argo-workflows/blob/main/USERS.md) + +## Ecosystem + +Just some of the projects that use or rely on Argo Workflows (complete list [here](https://github.com/akuity/awesome-argo#ecosystem-projects)): + +* [Argo Events](https://github.com/argoproj/argo-events) +* [Couler](https://github.com/couler-proj/couler) +* [Hera](https://github.com/argoproj-labs/hera-workflows) +* [Katib](https://github.com/kubeflow/katib) +* [Kedro](https://kedro.readthedocs.io/en/stable/) +* [Kubeflow Pipelines](https://github.com/kubeflow/pipelines) +* [Netflix Metaflow](https://metaflow.org) +* [Onepanel](https://github.com/onepanelio/onepanel) +* [Orchest](https://github.com/orchest/orchest/) +* [Piper](https://github.com/quickube/piper) +* [Ploomber](https://github.com/ploomber/ploomber) +* [Seldon](https://github.com/SeldonIO/seldon-core) +* [SQLFlow](https://github.com/sql-machine-learning/sqlflow) + +## Client Libraries + +Check out our [Java, Golang and Python clients](client-libraries.md). + +## Quickstart + +* [Get started here](quick-start.md) +* [Walk-through examples](walk-through/index.md) + +## Documentation + +You're here! + +## Features + +An incomplete list of features Argo Workflows provide: + +* UI to visualize and manage Workflows +* Artifact support (S3, Artifactory, Alibaba Cloud OSS, Azure Blob Storage, HTTP, Git, GCS, raw) +* Workflow templating to store commonly used Workflows in the cluster +* Archiving Workflows after executing for later access +* Scheduled workflows using cron +* Server interface with REST API (HTTP and GRPC) +* DAG or Steps based declaration of workflows +* Step level input & outputs (artifacts/parameters) +* Loops +* Parameterization +* Conditionals +* Timeouts (step & workflow level) +* Retry (step & workflow level) +* Resubmit (memoized) +* Suspend & Resume +* Cancellation +* K8s resource orchestration +* Exit Hooks (notifications, cleanup) +* Garbage collection of completed workflow +* Scheduling (affinity/tolerations/node selectors) +* Volumes (ephemeral/existing) +* Parallelism limits +* Daemoned steps +* DinD (docker-in-docker) +* Script steps +* Event emission +* Prometheus metrics +* Multiple executors +* Multiple pod and workflow garbage collection strategies +* Automatically calculated resource usage per step +* Java/Golang/Python SDKs +* Pod Disruption Budget support +* Single-sign on (OAuth2/OIDC) +* Webhook triggering +* CLI +* Out-of-the box and custom Prometheus metrics +* Windows container support +* Embedded widgets +* Multiplex log viewer + +## Community Meetings + +We host monthly community meetings where we and the community showcase demos and discuss the current and future state of the project. Feel free to join us! +For Community Meeting information, minutes and recordings, please [see here](https://bit.ly/argo-wf-cmty-mtng). + +Participation in Argo Workflows is governed by the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md) + +## Community Blogs and Presentations + +* [Awesome-Argo: A Curated List of Awesome Projects and Resources Related to Argo](https://github.com/terrytangyuan/awesome-argo) +* [Automation of Everything - How To Combine Argo Events, Workflows & Pipelines, CD, and Rollouts](https://youtu.be/XNXJtxkUKeY) +* [Argo Workflows and Pipelines - CI/CD, Machine Learning, and Other Kubernetes Workflows](https://youtu.be/UMaivwrAyTA) +* [Argo Ansible role: Provisioning Argo Workflows on OpenShift](https://medium.com/@marekermk/provisioning-argo-on-openshift-with-ansible-and-kustomize-340a1fda8b50) +* [Argo Workflows vs Apache Airflow](http://bit.ly/30YNIvT) +* [CI/CD with Argo on Kubernetes](https://medium.com/@bouwe.ceunen/ci-cd-with-argo-on-kubernetes-28c1a99616a9) +* [Define Your CI/CD Pipeline with Argo Workflows](https://haque-zubair.medium.com/define-your-ci-cd-pipeline-with-argo-workflows-25aefb02fa63) +* [Distributed Machine Learning Patterns from Manning Publication](https://github.com/terrytangyuan/distributed-ml-patterns) +* [Running Argo Workflows Across Multiple Kubernetes Clusters](https://admiralty.io/blog/running-argo-workflows-across-multiple-kubernetes-clusters/) +* [Open Source Model Management Roundup: Polyaxon, Argo, and Seldon](https://www.anaconda.com/blog/developer-blog/open-source-model-management-roundup-polyaxon-argo-and-seldon/) +* [Producing 200 OpenStreetMap extracts in 35 minutes using a scalable data workflow](https://www.interline.io/blog/scaling-openstreetmap-data-workflows/) +* [Argo integration review](http://dev.matt.hillsdon.net/2018/03/24/argo-integration-review.html) +* TGI Kubernetes with Joe Beda: [Argo workflow system](https://www.youtube.com/watch?v=M_rxPPLG8pU&start=859) + +## Project Resources + +* [Argo Project GitHub organization](https://github.com/argoproj) +* [Argo Website](https://argoproj.github.io/) +* [Argo Slack](https://argoproj.github.io/community/join-slack) + +## Security + +See [Security](security.md). + diff --git a/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/docs/images/cnoe-logo.png b/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/docs/images/cnoe-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..63b8f228ef58a42a758e570331053afc547df964 GIT binary patch literal 58052 zcmeFZ`9G9v{68*{rH~?`;&6(H5g|JjN+C3sFl5PYWFKpjQ_5N?`&L5P_pyzovSr`* zv9E)%jeYoDw@$s!`F`G?Kj8Ctocf`=d%2d^@_en=yt=QZOh?N`OGZXUcjxvkO)@fy zbuzM}CDg~jo%lXaEpUV0>gLV+HaC@TB5je5S`Lp)&6UmV%^j^wHI;9WkzEfCh8tR* zgEPs-l;rdO+2YrglJb^*U-Vspt!DdQ1GD?)`F2BB!fXo^UN%;21s zaK~R4U(pZ8T_nH4mL)LNIi6oP{r$V7bG3IHop+l6f5>~j_m_^aPkgN$SR`=P;(9kQ zn+F#7tozDGUJgI+%eel7Yuub{pSdQ_@F|7DZaqz}$rjCbDce}i@l)Rl$#hub8J6=} zquvO=G*Z06n-;YHeefmK4EM%E3M!}N!4PTD&zYCG8WkJF(xcV5JF$MdzD0_|Hs1&R z)I;-yyqQLh7H>rGIfjq7ums`ctXC9M#F9}#!N%po$BtH&NxUv*DvC62OD*IjMOMJu)l92$0srI7G z3qrh5PFxiA_*)5<<7`0}VcLZ&H|l+L3VA-AG%9lT4ILkc3D6%tFSeZ@uPZu=3J3PD-U^o3;Efn{4@Et9x`|-~ECY`f5nlmqVNwzRJVOE`D=2_KYYx=S0)V+Zc8t9M{`-ui8w;|iM;I{QZw z=UbizEwdoAc1aa_(YkOhC$qJZ_Ab;BZp{So!1BOZH-*}L3$w`4g4P<91o4x7t$nRF zKi>D+BP6};bpp$jv=hpDoaUVWv|zIqaIPQdigRo|_-ZuMn`1O1{_w;;mCsRM{Gc{Q z6o0Kro7TG&ssCMhO-9X3Hdz2}`zSx@qn@bt4mn37nRkhM8MVbR{k_S}2D!I34V!N{ zF8NO2CS}K3oDv)po{T)LHyjmoG;%b0!r_#lY~6(-T(eoqPRga7wu;agO1SZ`Pe7X2 z?77U>Z(q&ss?RdN_>1Nd%)?bY{d6#kVcD^|9Hd#gcg9neFHQ^g8Tmb9au1ZkkMVe= zOb|qls@YHc#eGNaEZ1|pGLOF&i7Bo=cVz~$(X~!1w$hX)UPfNmWSQi?I{2L(39Qgq zSm|<{%WI?`53-6YD2$#D_|`BvVM3cN%y;I*R8=A`zI3+iTzd+AVT9!rS&pah^{>b~ z`y`e@RI<5K!m;anJW`tvizFCEGmf_HS~iM3wV1#X$TDP8+&47cdA^&BkYDfi`&O-^ z&eodFfhX#_+h4?y^?6|t2fHK>@3o^{BV@&i2S*Psx*xAG?P&x6am!ry&SO!T&m!vb|GN$?7#)dO8; zUDbP%rbs)%M`lP9b3u1I2j~SdX?IC*X=m>Ih|}H9*4|0dU54xM4M}hf-G*^-9=_si zBg3VudY|(q($Sn#Oi)Nrh)b51lao{0(d@CL<}IbaKL`Jl;j(mgc94X@+}zv*-9!YD zjux=15)u+HAz_%XumE^NzzJpV{K#Fv-iiC?Aiu`BW$t9^XyxE+g|z2{#(iXhba9s9 z;({jn{paU8ovj}K&rJ4Ce{TzH5C%PgT@@69{coR{yIcKVK7*e8{OoXFKc|z129s2G zv@!<^hL$CJRr+v(f8G0^?{xT$u-J8J*#G+IfBjVNe?FBE z75V3v|9JBEm(nnZQ2!v@Pp%x^1#FR}m4^Lhu`I3Z(#0AwGI_E)w-g?@A6XcdvpuI% z%Dbhddc;P;JzQ+K%B$)a`xQ>y7Ugt};If#A%+cFl{~Z4m6Uina9(R|U&AsHy_tz9n zFX<5l$A{u=!~FS8#VegR#B^_~{3$1ISU57L9r*6M+;BI1xO=#g+)}J8O)YLM{Zi)s zj?~QE2BoKDN60CtPjbrtckv$){*#3NwBSE2_)iP|(}MrB;6E++PYeFjg8wJAfdAtC zj4sO)FaG7)mvZOqEgZDnM2g8w2=q~@qP1E#~+;a%GL)J2O56&?8mx~lZee=Q=6y30_UFj16ly*rV*cMp0tbDU|0kmvu;*(s=FxnK7- zdrHmL;m)QE#9NnPRtSKhb*b?yub~%P7+-&IqYp~`CoSYh&!LrinsAm{H%EK?u+-Du z-nH@l@o9WVu>BNqs!yxfXsBm1+ndE6{PXRmKOJ_*Tq)Krv~<;$@aP!Dl{L~s&$r~| z57#2rsra|5ZN5Q04YkoMgPy3wJQ4fBo`|@$`952 zpg<-x{|e=LOa6*9po1EXfdsMd=0Dc}1o2B1zFI-L-O18|^>CXEtWbLh4#Q893|2 z73Nk*d`*Fvg)08!;_pE(Pmwd*u~c7g)O!?^|3F&#DH)mp3@1CfeDt5AQGYU^Fui}_ z#jP?$p_Y%@zsEcZ#$>p@_fH)4G#;U8f9d7An*eXOVTt=}X77m;d- z4FN@pD>ggjnA6qeGo3EuUG0^rnObtF+mO(60P*pr7+3!1nlj#3<$PQm<*gmMr8uZ# zm4uOM%EB|(6`oJml+PB6KTUH|mkP~~7rJfw8)7UqIH``xHl;|Yg%U1c+!a+%bGE&c z-zRx%ZD_r(u>IUHyuLQ<7KOt4sQ3}^h5EKVQmuMmdAbaM%*5hWr8|FXrzL_@y`BBt z?i_Kn(>fBfbP%pd;Ds~tZh0jk1u~|$3vVYfqI>=PEN7Is?T7&!9TT1soyhX@p&a)} z*fg_Q)!=Cga*Cci@)|)drGvGmj z)1+^fM75g&aw_VTgQQQHF`Mb?@i7apblP!+4fHNdKwf&(<>is2r4q)|e=Ee}(~;Oy z)9JHS8uQGg`f+?rywu>LgBbcDxfazFtXM_x*^@$y_v1@T%~Yg!Y1x9;clQkWhU1Z@ z3`fXqV8%Zd2P!GZesMU3>GLsvt@xFdG1M4I>dhESl!D(odzmfKWa_1*47b5=MFC%P<|!7J~T=q?~C5wdRa9|o`1zbZX13{W)*&~b+N9R^x)P84xo8h{Oomdn~R60 z`?Spi`c#a#@M=E)Kzy(BunMN6uQtq6e?}CK0tC*;2iC-;Vz*Z9Z-LddN5i<}uSUn~ z(_N@Yh>zi)^{HqVmvJjWX5qyDY;zaN-ct7PK)R*jrm76$j7{R4QsyK50C41#lVhhA zOXGhD6!ppL7lq>EV>ClhX0UNzE~l?M&O6oe z4EYpG_{>T{jEDtzDwVtZ^4Cs{-%~ics=v4Y(rT9teD(x?(_9(xatZqd=X;!QaHQN-wZbv zpj7H~O8*=mgM+uK<}M+a@c~isW#O=w?>W|+cO@btQa_33Vu4FCPr0_*ZPCz{{v-C$ zU~6+9 z#^>8q?Ia?_8wrZ-p7Cj0GU@rua}VP>V}V6S!&!jP5T$Ir{uY`eY)`9rfKQb0+Wpxt)+RndbCJ%x$5ku+>uJl0vUiTun@;Rd@2F!v14n4QsK^yc8B`4Z6A@abT4T>uv?yMfC z3$!VZiQn~D?%bU#QGCK=Lm^nct?%wS$7jYHt;xDqbMBO86JDt{aZWMoaD>`n7J`@E78L~s8dU0|lZXWUH z_|0!gexc}iPgYW+5f2#XNpK1|)wdTcs|oGvLwq&YCStKH-A-C&OK|g%^`YlOq4tP^ zIb(!Mc1LZkT2iNN{!nJ+h3__-YT}H<03fF6f85Wg6$<(-vBrYr;vDOE%GLniTki)K zwRhdue3*J>Yecn;J(hUxk45Bfig9@Y?NoQ}8Gj}A3RlcCblD-aq zaJ*UTtPx#ZeVqEK89d_F7fPZFyM2Kc`*l{ixq!jHsYAFD&s}xf~VS zc^@I<=2+o+X-!l4W;WV!jdb%cYUB*>Im9byf7+^}1lYdTi8Nm7wC$J^xBSk_i&dVi`V=rNe;VRJD%bx5`}AZA*nNGYBW5&FeBUhSvFJ=mm@bX zrFbyp-_ozp!;br}Z{d6zb=sj=BV5Ti&v#O=*}?hUPkQRwpe1^Hl#JN!^#Og|h z(kA6vOGPNTheertI2pQ-85ov9edOpNkb_7h9$S0{9ZsU2^d4OLOtIZjO1UoUqcHXS zfJ#Hg?V60Zx}9NM=54^v63yiqcJEH787~{BihyKR{On|Hw8 zX*si;F_Wzf6j?Z{+S+`iq6>0#{U+;DX{WufIBv8`_^mg%#aIy5A;kK(lZ>7^6FIm( zP#fha|7UgsW=KKy2)4n972qM9e#zzPvh?~qcvaeFzBZpq^wW;*oUb;uhdxP;9QQ52cROuzA^36o$O6=Cb z$EwBkbVS2N1N(E3*SM|tQk93q#Fk~PosIO#KNvdXNxx`jjte=fTlU~F2rfj*;81Jd%Gx$w6ESUbb2nl1BEyv(R| zw}amai?YBswBa}I@=%!`JA^5>LZ58l@ivEevgwznObRH*rFjd_4wmP3mJ zYMmZydiE3Pasjp&toF00=FO7rA7$`Tu@{F)6}%wGH!fw9P4FDT*V>uc@$~@{UDQ?b zpj=%~Mx)CW;R0J4@R5|XzB{dm$wK1JT1947uLe47uEgrP%;qMbvyuZ$z1?ubc!xLA zo16BEmt1UojL4=3`|k0C=otR~it~G2U-`#1Ja&fdk1wWlc?rRi^M%)H<2cOqeI)kV z-JpOa5&<#*9wHWhyU8vTwVgJNA!^y@DXVulPS`Pd8GPh4BAQcNJh)gGm8rwj%H6l! zO{M0eOAna-*uTAhPn32X*j5030wkH{s0uf(VoaF5TwkEdXMfa7rxAO(`lz}QjKlC0 z?KCk!&L~n;kGXCoIz~28=Ru4>pY>ayJa;bxV!Xqs{!BPly``DV$jy^{iGcO4517-f zf{7#2L#LlncG{z?KV|BZbEvmsQF634>qXpcrxYrZ z=?z=$U78uy)j#q>On7Zzfsn`IZM9ePK>=`I56Ywbj&`U25TczXT?@TiBkB{H-I`LN z9q+j7j~~=Z5SJb656pCD?Q|Yd?$6*%tldBS#SuL=?y^%PDijsZlkQO5zeVu1sc4m0H^;Nb3z&H5rS5cH1_z$~+D({j#xzdx*qUR+ z+Cklqt~dr+YhlS?z^p)~<+)leqT$bkw!tNbevf+~6Q`mm2RHX!>TDFmd*TxK`%|=g z!X!&}J}1^7n4Y;`u&H~l7+hHOxVcSguDK>u_QdM&s|rNf)?Y6+&(tLG?!3uFv<$6& zI)WAx33`0tuVdCUlMH7O3`HOc;I8lW5=z&`$jV$6Mke3}_t&>y#5dHy2J}=Cx94+G z{iWv!OLIMb*@ zgstlr(D^Ep=C<=CUkM!-d!+ER5r+j{X8u-9yVfu<=OP-4^d2)Jm0x>EWv#B*d`LcS z)M1q{0bj~h?Ds07z?^Ou*ne?P_M>iZ>go@Wi| zuDzww@fypQsa)4|RDcX8JoL@39m##fpMQ`V&}-T`c>U$D(n{dDrm}%Sdpi#gooA@+ z_y;R)Uk|H4A|TV+{C&pkF!|B;Ox{PtfWE>maVqwrlf?sVxfCAX z{@vw+4cvZ+6OuL7fZ_6pSqNNJq8 zDvGH`mU=eBTbu1#c2b7d2R4jGRW0y^Bc?jK+URzFs@9}ks&9Wx%Im=wKRuWth_jv7 z)(FbFYLkSyuuwD7;GZw%G`;=p<5gb?X(yx8>RARt$d`Hj6v1MUcrSpEzR`z@2)RcT z+RB{js-7Z!Mr}_kSdZb-n9hpOfh^Uy>TXUmTN0Zfy_~^>K;<^35XPyW?QN>Fr8{co zVGnW^q@O;sR9V}PI*WvZwVe6+pywBB@l){bxHZ@VPj$2N$jNaQ(tv=0tI7V;*+ot& z(U>N_*b1^*b5gu2!wWyEi& ziWUl{%$?bt3++v9&HAD*A(q{|39vYVF1ejV+}#nA9^AiQv@c`HbjQ?2;B|f@a1Qx& zG(v*L8!-KTYDqR6V)3Gpb+6M2_P2zxvB~rwh3-(S{g_W}Xt*Tl=-S&EQG%+JBu#t| z^{*cA+&#@fkcU|HS$^<<)j&h+8`q&VraL}a)6-au_?9WwYY{J& zj%N~W#EcQYj;89jFPJC$7xguy1H{WbMc@eRu%; zKw63CjCM0=dZ+QaCqD`JHsy@13XSS@5^0Ds4s?>w0><#q`%IO}Vq#w)KBofa`7!OK73D%R{@9N%9C8z_O(S z7|y3e4M=SZfxNhfBf)s}wDq|X+v@UCEqkpiZGAcR^Hp0vVOA!JciY=h1MF`XoG*>ZE1(y$ognbzDP4!S&6wYNjtO<-jx)i%x>DZ_*C&OH(o)4Z=!`+!qxW9IMO{}pbe_+lZUGpuru3Tso0V^4W!cwacOHgIeYrO%VCMMU z-1hDtLTP`Mv7oU@?gHm(Z9W7yePUGfNis|ZLCVdY2_h+ZxxJyA#S#->w?)_6I9QVN z)$Q~TRNC^Of?Txq#Jh%8`_i(CFfHSlmAI6O7q*oyJ}ZHkHI%JEN8tk?}?Wc+@;q|d}@oO94}k{N&!6mP=@;z z$i0g|@?CMdJrIue3}hm7tU;}0p4=uLh!$LV6y-`_Rp zn;kLQJEcXtX`_C*2`}C(Y4};^+$~q!%5&15`;6t2jU;zT-^JvW^&!XWqHa9#HewSK z6ZqW{cJj5>9(L7jfN)R5$<|HmC{{;``BGBC--r&hg!A7aC_UESj~Q5U1yyLXX;Rmg z;*08XPyb+yl$D?2N_pYswy=%rClE-P98tXbD~9e-bc+d-OX=9=skaVM#L*A|{g9qn|Mrbf4n z&j=s)iM?A;#sv0dn2S)n7F(jeWbL?lyFawuxUK#_~sfwfl47@MXn3Gs6pTUzwl- z9j{@NR*vL!ELMA;-gjs&W^+w<$!l-DNe(6{f}B2Ld6?79d-^oK_XvbNSNyAZ8!d{A zbvwDwpJBZnb6PYe)%U$0l1Fl5$j@Yq7z-B<&77@y@VQz#YmzMxH2)-vC%vxmVQSi{ zc)#>c1BEJ&H|1w(n;kel`IQBE%s(@WK{8vu&$795Z%hSLKyef z1qY$T=tQK1)1S@fUVFVWgJ-O!m$RETcA6YGc=MmZ?0jH9-*KFrg?jQwHs-=Du_qFy z8*7xkya7fX-NBh9d!*(Gl-9e!N@rWN2;cF#>58*`(Gste*ldfn+8NU&pP`v_ksYDmFMK}Q+raGfA(3a(bvh4$ zpr6K`zsAwjcou_|p!`#PQW|no&=S?OmJ>+?S4Rsk8o25A9es0xDiFd2bAMkHKie@f2&V}sNuC8E7cSD`X&_xtx_`-|n z!&a25RDVv5qK@8WjrE;EspU3fi%G_EeEqbbcS?Byv~rN4oxrHSTY!Y#$iE3`ky#>+ za&9zhM`2VzC(?1-x*>|%ehRn8L=t|^`+MOPB|gs6@~a-VMRYD-*?$x7 zgWFA7SI zM{NYNuX6f4Ub_yy?sHFvTZ91G;Iy+v?7egwTtTPXwZVb3i48Sh4(63e(t%9s;QAp_ zO7e3i_V(*1nL_&C_6V)>MQ1_D6}Kh=%1rw$O*Ya~;!$!VGG!zY*!&$JS{W~^c=?fX zN+N@ADOsG#1BT1y8jL~&WizU=66p(e6l(*lI@w!J85oZ~W2ETe%FlxeGk%M%Lk2Pl zv+v{)rgOZ^R&vi!bu$|ox8J}WmvDDn%h?_W-E;h83ZW1m`I;U-tiVLVuhmn^sqshS zrUla{ufDID0Su8Jxd;eWKh@?~y3ly(p7fWFZS8HucwiLTnRswat6&{#5g(iDLF3Llw zA*_2*Oc&bjhpImnic@q~Z_H#WbFf9#Y(F9r3PiBLE3^Jnw=sIp^+O9ahd zA0#XT&p`96Wax}F($h|EZ~KbgTayZNIm~0wiEesooF$v8E|X$y_1ze#bx!RH1d{S}uq3cJ zG>{L`;)WN8jYv)>>jUE={G{>?FXKMxQCW%IumC+o-srteVVxX-boNYFF$?J#hC96BzFv_?1!CpqgS=tna0?~G4dcsDC3akF?kA%j za$1(&t=UR9^@^xAY!5sQUdRr~g1Y&$Phh9RCU!oP7Z?UOwGTm8}Z*Txi zpJPp4GOHMm(1#l-3uO=6Y3QL)*m7~dbMm&_x?kSfm1VPKLV#}t<+V3@=B^(~lM-j8 zMw~f6SEL1+phppR_o+M!rII3SM!z%xkAwS z`c>qygzXcXsVT%vqPc|o^+qzm>znX-yM>Hye`)hV6x!bqT80DE!*Nj_>VP@KE^ur4 zO_f(_Z%E#1R_#MnATQ^;x}6m1bK3Kymml76tUXL)zgm<)$m;i(u6b;YU4O#ucAFc5 zi%+0F%YzJ5`#U`k-TGW5o!XmH(3epzCo|;1(qzMP^r|`s;z43w5)3wcXs;T;MlLxy zLbYQ^77wWe>NMvk?-jyk$Tc8D>B=GUvGC-L^>)Z z9R@{jpT@HsdL@U0Kpn22YbYvBSSOpbv**V)r1fb;GdH&^hd7B-=gC^Sc0H|AwZ;Rb z$VA*~9Gl~jiNBwy0^^bHcm$TAYXyRn_Z8STj2A1fV*H;FL`((#l!9&=;wRS6G72;(S7-nW zY!KmmCUNDUdhyUDuzw)IgdOgY8L`>WERYuYgVc~8e@ILkFv_LB99h92J({Eafs1GA zykmj+8#39A2926z=sT3Fk|=W&Yo|?R^!mGFA)fDKNBZ|I=`{GM zxa7A9=?_KZ2m$dB@~S|{`*%2fjdOWHasRuQTpBCx)rsI^Y~_isKv_+IIR0?NK(2h0 zw+z})q5wKJZX;zNR33-1GaL_dWiebg8Tz2lu<yAf_I4c1L`yoIqk$GI2H|5-v~sQwLLm1lE(;)ZjV>sc!Vwt>Gq-DKap;2kv$rm7oJ*CS zCevY5gk2bsLGZdDxPhhy*m){6DeBA{^5z6WT2)mJb}@Z%Q4-RKyeg3F;EHrBZWEkN zM6{f|MsodtsjdNSrjO8%ssj}=!dUv-*9J<3v0|Z{Jw{1=%IR8x+()07@;nPCp;iPJ zU0&FT(T5l9N`j_5v><4+br}}cf9nj|?e9}pXP+Vw}q5Ul;UG!WM)L^>@>tYg^@dj!=xJy9slqNw9&AN}#v6S%l68xFi!g1h=|5zUw!f1>IlH9v+ z{@RL!y7ftz=eA>!1ogZ3zT8dd{)=F+3V;%ugf|x;_Ff?GoqqC$Cc8bk;$EM*KUi(z zP4c9uh*N8^~&%1UK-=t4dQx9CfMKzyqfVIn7$quKm--IfCL>7 zKwH6>^?RBlCt*;6VFu0@KmwWI>ey`0jVXKF$g8g`{<--z8Rd~CWsGoJ--_M61vMa0 zps!<`v;pPPtIWZ85j6dWCTs1?a>H(UjbSJmsO;CH%SRfq)Fz8H@&m_B;xgBHy(@Af z=m~=RNHj@i{hfTcnyOCu!gK_{hMZIeEkiSz=H8#)CP7P%clB&3lq5y~a7L!vqLmr<~bV?oBu@T&B zU%F-rw~Z+?$}jp;#8F#e<}_yx7uY7hBR8ENpxIs6>yay@v7P;n&~H$|sVxN@ZP+~? z{V*oKlb%b;uCjSdwR;2VbW=dFzV|}jbHNo*rJG1)_D$7ASnaO*ojVLOSirIjKbdlX z{Zcn68%KiP#?7^AS7y+^qB#m2m5kj)<52j(vZjjO}M1~^Y#mR za9j2y+l&uh>W9tvCn2^TgV>sL8@=U^GV`i$(w~%Zu!D%1(Ka!Y{wqaN%TBcWtt+&k ze;(Utrk+eRsEkS}xB(PVl!cXQ6~VAdbobgabO{Gf%bnSxP?X6nG=?*^GzNHoRS$gM+ML6_wRMSuY-D= zp_VO+a{>?67DnWe={n3(xB$3u@O!cF*j)=~9N#Y8v(LL3kKANe~ zhl@o4xV3>9$v1#h{Fi_SX(Ha`@LSm>F9}7Purk}QoUO+@hz(rl&yKyRjmT=LV6>Sc zdFdEiYE)hVy^Lw%u=#l?@I$|cI*+3CtvG*^JMI+gvDF_?lT%@_58Y9e1b232v8;i^ zRLrKE$^6QrbM5-)Ulcr0Rb*@0pW!<1HglhFgXK3TMcWE1baf&+v%dkk)_=ipM16Lmu)^H|$ni7w`14X9)|sJo2GF&7|RabTQEwsmo+`K@W9VMny+T zcW;6#0Y0LWY?Cf~YXZtYOGAd{!vfpyEv8?7Ez+E34ND1LswEpt5c7yPX}OW!f$;Dk z%$DCgv%hz!+Ge0=6D+Yl1vfAimmy`9U2u}0oxB*p=VLLyekD)M4jOJ5bOaD&p8o@G zFEP#D`VcsacaXHoIKH`s8~aNp;o#B4M;7GF{dKO;EMA{Gz;kgklR^u)OL|sHaPjn$!CRlHmWt4}brMmW>`0sq=2PD!h29ESsB%1y=3!PQK zX$$I6=8{u*oj^kGTZ&cT2d}VIGerGTBPL^_0c8lYi`X>_LD1?YKsJlWWTpOY}?TSOiC4!{(XQ3xH{6J*Axo}9Cb5Y zs}%)tQZPME!kFuW?BN7`;y_auzt3%uPc@su`Zix7_@$Ly9si(Ca=EV?DbUw#_HjU=L35g+83`_WRV{ijZe4Q==^nLJxf&Fjb}m3!>@-(@xK29i zflcuz3)Fxm2+_K6W18kM!#+72)#X^$;qp8-BSkV-IhhhShgYA68~>FOw;uo@X_7I1T7TLr$j~8WGWX^gNuEgGcT9rl%JpcJP(O(BO<=M$42ABE+ zuW8)R*4dNDTida7Htl|q%_)^K?mba3i{9I5oBXo0X>B&SUrr%gld)f1BRD_cu4@`;a zY>TeLPB~NN9TdePCM0Q|m z)$2BA80$Sz^E3S%A>?XO-!4ZXsl*>6bE?m*K4>?ndeq-j$9{V9N}U1LHO+;wj;D7& z-Y+3n4fi(lvaV;b+Buq7#=V5UF6l@WL7e$Njyo8epf#4WJ$b9

d(w5}BKBAr{wrzd*>V2kjkOcueVOl_vEG7B`N4Za1mCi(JQ%LO+x) z%LR9-%EYJbi4B+g3doS`-R7O*pvV_RJrqJ5OdESQfTD`J#BM0KqyhJzYj9Hzi)*V+ zQsQ7*WRRPUa@%~69fxsu%hu73Axia1W%*`_K$=_%SsqVha1e;XXeY0{>-Afl9cWp` zFLGLR6_yO&!Eme#NaHT$7SWuHR530WMC?oHYTF&q#irR1=tF|?>c8`IaU=CoyQk5y z53)!V^j~dfJ|m=JM)=|lZEL9_h{rbcmxX6S^E#T+h*)vU)5%Y=rs>LXi0MdAj+;g_ zHbAWxkp=)R9Ql=@cuW#4-F&$w`aZn;mEq*qrR{<3=Ji%L@2@h$=bf*iizq`T$c+lU z-#jn$-9e5Hx;4^V$q)gj>K;sv|ER6*I0!Z{@2aW?q*5s zf2}mM{vi=ehVF*WFp)fM{{lXbzVRD8bDVgO!5_U!PvtQb0iTC-6&YjZFiREH&Ata| zpVbDt$IqDJ;k=GlFWlYtk?P^{0<9|b{>rGhY7OGRM5p0uWYuMKvsP%Tr!MuZD%G?l zNORl)8;V;h%00!|mQ`ixU2dR|)55;)x|`wxtRb%hQ=H_>?70-hGvAy_MdHnA#)H3K zNXFGZ$_VZy(2t&wX+W2kXWY>9mbl3;svhjJ3c`Z-xfx$Z3+_-n{^Fp2Ufq%M(2F?_ zEJn{t7Q4t1^5(;{5jBDvNn>-kNb!-=0w9Teg?z-oHwq*Xf{mN<8_Ep!UW2rY^!AFt zd5LJ;Sw#WOb>Fr{t8eMy!4b$g5We*^*vv&(KaYt^{%Y5bw^v%F9TA4qN&?D(Ovuh% zJVI{BTpx8A;_JC`Q>A+|LX)W`Y26>c8*!nx=g2m} zFyLMcUs`9y1+U>Ab2e)?m!4WFy1aV%c$ZbR5t`6cM&5wTEw_$q7P05>Be0*nwWHiX zokHdJpk&G`N^mSHr0Jcsc@|y|6?#QecE!+z6TN+W@9Hz>R)ln@Ehf^(bGoa6T8(*^ zu?ZX*n<<;(#0h7-64ySflSayLE70`aJi}h!SbBKipWj^4r+EukArBw^jACTAxA_VQ z1rZ$m*ALybeMdokP2ly2!F#`iX#1k)8y{CkYkiI{f^JasB}&H>go-j_-(Wx$&Q-cX z%(jB%xkyC`jzc!S*Ed|?WrRpw0PYdr#~<^cV7_J&-RN@WLOpv{7^ciI%c%q~Kl;$=XhFra8o)6=!PA9?H;(!a>+DVmkX33cXTQb%j7u^DHCqtk}cyodMDFAfuv zE#Pp4R75RwCO!6#oNLwPZhFkmP!>bC)EPO2m{^akqz&t`AbGIoy-Jw)B--9}JSt^7 zivng*P%$BOZu09<)EuVXIp{~>CVlE$ktt0q?7nTSCix7Z!ctwY`QTe{;Lc&>EeS%1 z-dy&NQc$hM_?q3PyHO~VVP?CWYv2~*0c>KV31&Lq|7K3(ywCYLHnbv?&OaT&;f+1- z>`iLT?Xpx^RC>aCwl011nD2wD?yx*MZmHEKQKmY2J0FG#>Pg_!v`s4(U|*2K3*nw! zpxft{4L}1Mz&2!d^G~R*v-bi|%pp@c8mu~a%WN=t{yH&W;++SnD==}Gui{Hwc+Cn$ zG_x*NUSs1dWuWVe_f{Y$_qgGqz1{oNuK1xC?3QmMVz2n~sC7m@n+=0ckCbjhP+hpu z$LNGxi96PBlUk%}D_vU5R-jr%Ex=$?nh^lU4sWXPtGuq5gBR&9=hWaCXTwC6#JJpN zIPzJBnRlsUFTOtN)LDtXawf-qSPzRFFX_aOVG(bM%eYV}7|Tg5Yn@D$#od(}zd;R& z>+j2s(@!csb0gF_i{`CrKbc>(LWZ*N2MsBq?joLPqzs=92YcsklL<)MMtFBO9U8RaS>|ZRt4`Q$z7o@;`Pm(8* zDdaQZSC19xiDohu8;r)_>*feBpCDrWC5Cxoz;Gk`QXiwl^#_Vq1DTGLcWPOshY;7w zmrfiUtMy1oFBQbiJqgWwXW}i5F7Lc@AsbADpJApo$*AW4eiE204FIA_@~I$SG)^vo zPgXG!6aOI{m%+kJLD-0~(Ygzrty}iTdop&Fok3?cihS^>N#K@(sed8-f9!qrTa;bb zwvM2Lq9`RuE8U1R3@V|5bT^`ufOLZ+jXk&Mf zL2EkPk=S{B-r&F#%sfsGDIrn4O%YV`b(Fh3IgV+zEzuaa!Pz+uUYX4p7H20c zV&fJscy%r0gR5}(!7g$hFR`1z^+f9YLWbxMr_d5xxZrAm^WtGv5nK4ID zWozUGy?@bwiWO8{5QLob9`BWBdD(jw9ny=}S6%$t0pNP7K0?w!@+0BBbbyMg-c?nV z9q$165#Z23t%dbXB~J9T{R}?m5~JIF`S#d$mHa1_`WOqt$_0)JG7op{0q}wjhPlTe0V#?ZxEq%mQzB4fC}R*2KNhb}cV0L+N%AwB zeNhZNTplcKmreD|Z8{!*xIvy}^s@B_H&r9i$i{fQ)8!cr%Ii~0EmJXUW;2{Zcn>2^ z^3+JqjH5PszBM+3&J_NNN_pl*_*?aj=CcIxV2=em!arT|*@y+)m!;pbY>{jy11W#5 zL#|;8Pz%SC4vc`?LIn|*TejydA9i6cw48AdG&cni{JCD3h|rYT;!@1;LjJy7=NU1? ze}_9v%(iI{qeAp&l0v+s?SkMBr^-|X_nqt&#hP_%v4(u76UaNKdvIC22#S&unU&NM zcyAPeOx7ByFN+v%A&4 zFyT8j8-e5imm&B_?eb2o7Ru0dLwMmv^b$aIl8Ccay8OH5x`sp)#8*3S41AWsrI}jK zN;q(!GpoJSQj5BaWO=W7a0MY_YueSa?Iq6}`bg1BH)f@rR(0N@VxA7><||6Osngj5 za|^a}8O*_z=^&8z8e8&v>};SQoJCAm>?OoL?s?HZ_Y48f0>e8J%{Z=D zWs*RL<N$vR*$26BRVHvcQ;Zo68X9=^N@ZHt?C|_uurWFVy#e*%NlyQ?@miqd2j~B z|3!OV7Cjmr)&ze(NIF%0tE#7E`Yqr9s#^XRbYQNSdYm$DrQ3n6)BAM6nn_(xy*rmn zeoc6rq$?D?(XS}jGr$oj&7tBMcFADUDHWEVHh!#;DZUy2*{8UF+;rB5&DISX9n$s) zaJR|en_oilI!nC`HsA&u-?97V4p=jVpMU7UN6SChl9YEU_r-VArc*>sgsx=_`zE@% zpm)b*mn}_qILF663$y3ldn@fc=8Ush$@pYd=5%5nsa#|`)O6Bo4YhlE+#Pitv>}l= z=BxLq_TiO8JqNWju`{)A8)Snq_Jf54ot55b$yyPPGmyRnNoSnhT35~8e=Z?D;gN99 zDV$g2h^l7vs2KQy^k7p?j}r`p2O+TQ$mRW}Gvj@o=Lt0MZFp$|TWUKnN zIgUYk@p)CU1vY6HTs*z(&p<6bWI8owwYjlY-PXKXNK*6Bd)~;(z=cmyoxDxA!0`JX zb(iz{*Ms~N&2gxnJwF3lY_zj4*lP?322|);sJm{IcSuf959)Ja>tg;Vf{-CC(KYi; zi8YPneRY|wLN;(<3c+lqixXxC_%BH~$ z^1~K=Q<^6(X<927MepsXcwREb;yO^L8B?Y`9awReEkl#ei;|)0yp^dN!_*zCVFk_= zZEYsy#9GCTt}Ac3Ke)`dT1^dxwsX76N9akAm$zxVqVT2*_NU^WJ(Lj33?6lDqLEoJ zEs7!3-<4b|PJt@r_jWXJOp6QHAfmA`+o_xE+t<}`DfpQ=gbsN*+$dQ_nt zC7RUHLglot3@AY8w%iwzcK+nzX-V3uZ=~CS`0hT~nlJ3r93w6vaPfBCFN8DAy#(i? z98zbru_5fBNkiGdbdcjM#0T3f8Y}Kn-&)kX#mAkIZ6_J2jGV$Z?tT7xtM}?WZocBI zJ0MvUUoyxTvr|m__HL7Bs7>@^NZlMJqW%uR!q&%Lm3bRjivaq7VhDy`_1Fwe1f3l? z5-)lNRy&B|-}$I}C!o`lSfcy71R_8bk$8SS+nT*EB&`Gt()`Xs$$X=6Tz$&1iZpN0 z`&aedNvtOa?d3>SlR1G+6_N=G#RUDBPNeE};?pAm70mHxiy^}go#+Aal+8KgM+W)9 zn)7=YhFEmy^9n{^WAz!lS^ZF>jPy|YT9ljR zB%V!dRoqdv%p*b6an-+>we`p)!ZGQo_e$2cL-f@~U8s0ODmLuYm;a^f(F9F`f2p+) zzi@JQi|nQ~BdEoe0ochKbzsnlcsyu!>77F>U`fs5*_L7(`{~IXqx9-NR>N(sC9N!>_m={-0d#9=E5cEN-wKLYfHbzHO7j_ZEwgD zsJeH(3LD**gEb!r5>AHT7?z;Kl6`e{-@^WwzJ0~zg)`q7kr!0W#>`~$7q4(ulTkt; z7Ga_#co%O%#7lEbj_p8CU}n9y!`W-kl#6{RTq*kX;Z5_q$r4nJGpNRE!dsC(W#e7Uk?UfvUQ8##S6O^{u00^H2p!%(=DEd7utI`axWG)Ff2(~o z;MA)6I?tZH^dX~>rgethv`uD!=7#Czy4otoLu5qW?}fJ$TrYFFt_0sCbjJvaT-yRE zi4dF>4pF zqPP}O8J=q0uZ)6r28woD7b^L8Uv53G))k`N36pr0R;y zEOMJ297tEw9AD2hPR)`<383mAI+K_6e||DId6KTaY`HMQrY`@dlH2GE#|B*_!n4#z z)ox(m!JfIU?UHw;%JdnMr@Nf}T3V_;m;C3T!=Mmka27$UjV{ip4`I%X?J1UVGOBNNN;l)s3vO^x3ClKM+Sgo;HDob zOwJC!J7$R7{K-6B!s40#BAU=L#Fs#N^QiyjoE|2o`$vGF-T;>&YJz6}t9;s~@W94i zj?;R(UB3INmuvY&B3WBpsrsH6AKA%=9;ebpw8+s5d#r+vPfT3Azq^CkhM(A z_VBXNq{iuP^R=i~Q)VMK!gfe2>yPON@Ad~j|< zlgT_q?N!$S8t3Kj7xVWin^8ydr{ebZe8B*=85}0S@s#lKmlQD1Rq*p&*R3-Z$`Jme z_T9nki_bNCA~chADS6)|!uA>sS~Q8YS`OM)R-0XLh2l|zo4$@Uqb{mOd7v_$*#142 z&69j%!Q_7Z_I#@N@|~1ED+zMN&tAiITPnC1le_-kghFl#na&AZJnx;Y#V09Af1>Wv z>&AKoo6PtP@Q1v=p1&-eS@}HOh^2Ljw|e(duvBQ-O$QCbyOKAvHd_v6#*CZZPq8cs zQeI$qI=CebvZkl1!+*BXC89|qT`zX3i=T=qKUE*et>s1UNy$u}Fe{=?g!i`2Y;IEC zauviywXIG`7we?fULFXG*UF?b*r!evnEt@uHag&g*8%_{3}IdhX7bUFQ*v$>OK;J%^b z&_DNb^7Fhai>u(piDRwE`nZ(ofwOn;^5C*u##r|hGqs*O!rm-^{$AI+LRD;B0>Z|+ z>tH+b#K9$rPTWhMP)omu^TV<-yB0ohfd-QV3r%)%g6mnatyFuZW1r@>srFyv%}NW- z?e)J1TrNX@{vr9@m=Tm=3KMHn9 zQX+wk*I`+Cyo<{t0GBCn6ZADpQni(wxJPE4!|?vVy;zLa;Lq?U7`f9%wF5{t^SEmM z$+2NivE5xwUI8&7-Yp7zttUO~2rw%V02ng#@m?6%3~~gG68TM42U6eto)xVN!PptM zxK_E;TbuSa?EB&X*_q}W*N%tbiN>ljOa?@=Ndm9yk*|0&Dv<{=Jwwt!Umd3Is9nys zXh|acEmjj#=7UWo^Z0^V*t=Va&)+x3OhuT91 zbR!zdbTAiT^I`T+Y4`0VWn!~BTV9Pn#%)=hA+_+xT!{>(cuE8#;Z^8~9Ftx`G9m6D z68m(CR?a+Fs=oMy{e4*(@QgeCD1p1;g%jkB!(w@U#aT$;L3h|X#ADRp(Nu&Xl?nx3v}=wVH3zjyfvh<4|WTR+>mB+5tWw-v-LecQZQ{b7A1|oN?VCt!O0B|(q3;>G zwjGJ)6?IP?*z{z7Fq8BidqMkV5HvLz{)`EQd%&`Moz-zR?dd57OviU@O6S8a3?hAB zpL$@}3>*S2(uCA*W&9!!ti*fB!DHp5J77&!PY?RsjFNCknza^@wrfD|alczVw_9JU zLAOZCRzCAN4sN;I2kM0ee|C~g;9K|I@a&^UZ(28N;u>uIn6%k z5|$Mv?|`km1r^9L--pU68*yPMmJnr)J(&AqL7L0=`R+*p9iL3vlbvC6s%uBNd@#@E z1)c=%Ysd1#)JGf#K8hclq%mTogB=vzb~tOF7+nwgNt);DYs~h~=Pb%?W9%u{UClqZ zLKr4T8QdVH>|SSS%jOK=gh&eBmVV89h984kkR8)9keS=I)ucRK1-?nvb91 z3sB$!`;yS~-jI0e^#k`Q{|)3q^sM!)c+S?Bc$)SjNHGWJ~1&Wyg*20Yve z**3`BqU&?utq9<~5dL%l9JJADM$t~Y_DtQSHq5H-t&B?$)uy=O<>Z5XZ8c}=P-C>F zGs=miEv{(ZXw~Z~dIe`|n`&puPIZJmQjS;oyA^cKKxk6us0jt zXKqCaT%|@4ybyHuh3@)S?|M6Zqnt`WG3uylB;+Jss?lmST`+bWDI6>yt(+PS}8bD?xY*c+uirz@J#79PI@64 z2%!;wI0lTRmsyOIr5CK-atW*lKTC8^glgU4Q;c9|D0}lzz-NI>01SwaAQH*HSDQ;@ zCNlL4C=a@KnLyy$8GP8TymK|a23`*)q{*XWF?#D^XmHd}Ppgx5~0M#Th&q3sp zdiRy0&PMdPQ)Axf1ulH^9tEJ_8Z4^}1gsuz;uNpvqS+(dT}&P(KerOEyK^TDP(~70 zyZL18hxjS8e{f@thiG6@mB9{?5f%W6-!VMT`o1v1Bd5R<>EnSW&Q+zsc?TNARov}O z6K$J}+>b?iIc~4ZHedE`yKB^pRpyj4Gl56EOK$9T6J>Hg2N}$#t-@Gd$xKkDpAg@P z4<-W-Ax65s;OldJ>U8)rYvAgVc#%UcU~tZ6iPf4c zs!l4poj|=@3}GT^9Tj<@R&!1nZE)L<6Rn?+f5{F?!35V?X=x1Gx=(KXR0Lx)R|6e2 z$}dB)9xoNj+w|Z!mA(3;obYt2y{WjQ8L<%O)^ho1tjr15jt%t(mr;{CGJt*z6kQJk zFp9KMr3nSA{yKHHz1t$T{W=?9{nl4_ z^7)=eP{qb}yo(zOY2qNXe&%K5<)78%%|iSnEa$CyzHbbBf9B!4?}1ln36J6~A+&Mc za0YxX^HXn6o+lE5IJN%==El>b3!hTTQgiW&TNl!VbKiQ4BSB1IHknZ#*Iu3!WVz#2 zF?w*VNcj>diTvz89QO46O-+uQBaW73MY_GmAo0**HwZEKI^} zyjUsz1V6_S%`jVBL!B=72o|2;oY*tT<`=_>CQ#IGWiqu*C#CoGiKgdSmn(0voPTyd zdg5z*)xZ;q$&H9$X##Q=1^ZF@x>_82QBmorQAEH zfE#`1`3Y`kguW3uPY*NCl&N63Cl?*@%ZJ^M_}#K69J%6lnYUPkQ*ja*g(nj3iHxuH zYw1nD;ZCwH|8lznA%s%r|Mv97sUZI(|KyU+FGa(3+S?1dkWbb z`dc#s=<`>nBkNm~9%KISDqODT6G;+W<1sZGTL0yfcspgXl zmdaG`1^n@*j=VF}9D)n8@Q(Ee^ZvvbR9|Nl)-jcw?<`v9$((X~>0{%l@J7(P)ycF{ z^~1GE7~gFdGZ9tT=JkLWFxgUcXEYaQ_r<+rG4OM+RY6O4%(AIXb>bat^Y9RtmKxUNg&Jl_zS7zg~{s6%~It~I-hJeBAaBv zuageW14Y)XxCUWYF&_t6!$goLuT=j@oZo^-;k)qVmITc5Okp_gjDWYAXXjN_9(`BS z!S44R^gI0WGnmDBdSpJ5&0_dmE_(FGL9iCdyt1DE{=2wPWkDbhh0IFU`nC;(`)ry4 zyrJLOf0kGN z0o_+Y(wHR31w_D=TikYEzEN0mTib_e*!s}D6Dj3Fof((f)LA9Aa#?4ww`LA+esRP! zBZrr-j91{kl$|1NR@V9_Y=p|o#acuZ6ipB#x=^7)A}2e-Iwx$Nw~PF-Cajp}GCs;* zIq%~oL_Y3<*IFgZ)xK8$cSFp-9(+&wlufnCHx_%k=d3n)7GWc3L9?JFZ!Oqf=1Ef8d)HMiLv;?op z`E?HxFhbk_OvI?nvie{QeQ5pm2-?3o>1cZL!|g0i?}XGBlJ&a8&ZkZHpT!s?Q!B@K zdsjXCjY>0LllF9c6k3-jW4D2fDtB$Rd!^0_^-x-q$O%TF6Fqqi2ij*mTSc)44`h;t z_aA$UW-{@*Y}ZY0x#=`Nz1#zN6|S?xte+Eyp$CS394w#VI<+VT zG^rh0lu)z0JnUicC4@g=o$zRUS$C^VKqu?cJ0NO+nd7VAmG~!+O)YG!3!BvVI_hT- zPn$()-8?8SXmX-C)f}#ok@us+MKX(guJy*nZug(S@=NfV?M1Ji(e+8)GKs?2F_FD} zss8mfOjhvYL@#a>*X*kT3-#f$1iuOG(879&osqXf(RHhqf|fwyLkZIpw9+C@90na; zz4j@bqsA7{@#B;5Q-gdI_(CDWX>?j7Pr`c1xSC1LcFfqOeU_}7VOT(kzG3o|`R47V zVz^E*LzkQ8&zcP;e6z4F=W0=bBmjaFPIw802y}n$4Q5P9*?7xQJ(!El0}6%OQGw9kCJQ&8+pD^vG3Pcyn|~p%k^NreO8D_ zS3Kn8-mrxI-f0jDGFaz$AupX52_A)pJHL9(^%yHfG(d{ncJKYQX91Y?Q5vKI<8r^H z!^Mb%NW&5fa?x>`7=~Q0CFBqwG{9>WI#ZUcL-2@O3{vNL7 z-J~l1I&c4dtir6ty}!FcrVjOfGlfl_i|sIw44U5}UQ}F)YIfJV5BIsH6%LP|;wp?z zB+HTuYYX5LXY!~{ZCA(klMR#dh-}uX>_eDa9(a<@q&TJQd$<{H(3Y6mOvl~v2FgdY zH+~>Qr}&SB^Y0?67}q7_#=LIdacx=`+U~}t%aU&Kh!owKO#ckY`*UC#*yvNBO-F`M zY+tlHuRU{JdK*^vsU`T;b+eq~NnUmNx)D5iMnDYH^3?I(YfX8YFlu$#uX=74>5~sX z?n6r%jN31UvVFPHGx*qHv8#CzY-_yVKrLy;q}xNnuR#~8ReQ4K=4sUuys#1+PV>*R zu+8q;g2+J3H?N^I>X;0;jvs>!Ez?>^X-8=lF2uGCx`e_3U7@}jDH+{u%mw`vbo-Ztnl4FFZh}4KHb+UI`csgb3H*sKCL;}s*2S* zdYiels&y}o!)31dq`@qAN{W+Mh*~{{#-Ey7hu~W&2yIRV~pCNQ~F86Tj@ z{REG{X6v|}vgm2wRW-YmpCw8)JaIHT+5hU%;IDTJeILkUCKeUZ%nL09wzN)O%(oYL zJR6?%qN=vA43%V@?>3F&gJ#O&@;HCk&iwMNhzoO}!@h(IyhJny1_rQ&Xhg~OJW=;L z`i>mFz_hd*T6yI271#(;PTtj&$Q_!!RdTqv7JcODk(F1Sd_x!|p?`mN?IbI#BDsDM zGo*^|10?J{JO*b&d@N{~-ors)bg8c95KD#6gmZrvlpI2Qpxp!$Ua_~$d%Eid=2u&1 zmVLiRw*E$XP|mmvJ`$-RC4Z&WU|AI>alupLtWB@+7A4?znDps1pU_{3ZO2CnNeDHLLEhzNkgYX4Rl3*P9tX};!(I)Tj z|3rhICvS!KuF6PSfI7V-a+W{`f1cd?y9+Q!tPgf;DX!7{VWQ}4=|mFpIxe)Na7Lh2 zLW|j;hC*7rdv9r5U1)r^HXceA26V~#S`Zau*`2`GsUk3^s2wiHD49iT+I=;p5$MxU z@BIu`k#bk?Z?(y!>fP-oeWAYI?NkSm?L*r16u18|h4e^@Xm9DgPW=EFB%!IiKq0o6 zlR}Aun>hXY8{ZE1d|iqzUXe-=Mvyub`Gko7d$%`!x|_>@K$GYAoRG+-Ydym~z} zSQyVki;&-Fno+H3HWk0&lz7w3!S+?{t2OMCaqxB@r$+np1fB6rc#jftOM!qSwF%4* z^@f-NGdwj7_PS0f*^DaGc~N)*%YOpqF90^zT(+QxmxkBi@0&Dv-N_HC;8+9VRJy8i z8Mt@uK%*VqcK^ugmOz=Hj99J8$w6j zLgq1VuQiCbv!MP8DfqzB+pgl2Ev_1i!8wNy#JsjV>-ql9O7QLQUfsxYcW5tar0R`| zpUmwRh4v?)JBh*P1FY%^;$fAIx|gtv>1*NGe;2>;2N))qOaTLUVIr~6hy;-|W+%=i z)5jtbz5C`9G}Oy5Vf=Ji>%54W3Hqq!1A6_0zj+RRFfB>TY&Raj=|mA=1xELB-b3$s z-^hS#poz3YBYPHd`8fS}4^HbHDjL5-g8-1LANsmE5$NoMbHc8T2h#sMvRoJq=}(aD z`8%DdNZ6dLwd_VgfuHw*vXiIY80{(02+Au6`;&JJM6MR^Twbb>OiU= zj8Yr#_g=Pj{CU%33hl((AHc%-fDxXpI)LLtdYLY#?T-DX8UsCYU=C~Pm0Hs(>FWrj zYX(E#S3o46I1(h`y(dagjC)I~98R6KyCG3mw)6%B1z4%l`T#!`Y{;Ea9{)B{ajWI_ zv0@asGW!`2DkiyR@YzOh5F#?mq{coA$JAJI1yKI@gihR&>c_i{7P97|nO~o*0&D0= zp~asE;RI)oK^J&}D>u(33#$CbBuZ9ylW_MhS?{g3m(zRZ6t8rWL<^(rd0g%iU}Yu) z$USG2;XHI3yHYC)DtGKggy@0Rzq@4ur#}>#du+c^+&+7<6}FyM)1izVJcl~`v2D&N z8`Lj-7vUzmoFTgJ6B5!d`eX$t3GlSG$J48*z1Yt2B+=;I?Dg;6r}LeYx3Jowu?|e) z4uMEAc#;$TZ{Fv&YF^}z4u)1Nzd$Ax`WiC4MAzSyxTsVJs4$NL3L&rd31H<|LN$ik zpA$Q$VWfRFSug*+m;-0yte94I(M!UGgQg-WLFqDdQ$*wQ1j;l{@F%$GV#nvKVaDfd z>f$!_&|qig)L&`e7&R?#?977#>v1YorNyKX6~6^FKaW4AtwU<2Fz=mQ#R-% zY-hxWQWSp;JP_y@HMWTv5fO=Otch z9#o{*4Ows}yw^%U#vJOD>;}4Slv?t!L$|DI-F)9TYw_COV~Z%sfn$aTyrK9Nw|hj+ z0RmAOSf)Pn8t};-qH@T-s0gb=qq*45n?#U{Gl;+Qun;ax}{xYD0MTP71 zRVIISvmg%HY#O-MlVFwq1zM}r0vNlsb*wYi_r-->%r%_#Y&D$G`h=#O#}MvUZ;W3& zh~8m44ZGO)F+8|*0$m5@!T~Sc)Bx{bk!9xWt2D;JwRFd)-lvHjTA`(g_r&gAE7qVj zB0Q|I%l?*c+(qAb?iitkiVYV22f~w&75>yhQ*@EBJ!kLRgedIkKLsF2wz3{JhlnJ& zh_hGw#?}0fcDWGyfKLxRIa`YE!H&$JqCjM1kSnRiY$)ni1zbUz4SQl>E$~){D`*Cw zBu*khy0AmgcIyDG*|}&}*1<{JsVM&y5$pkTczO))4rY=lBi!uJby1=kxeY(ZWuamJ z1MiCv@&{Cb2r=CL=M_bYpB_JN??Pt$nT}|%?a~dwG74ffkA+UKAafulYfwkNeKz4; zF@JtWzFJ!uxs@@A<}c14GS;uzvJ+tHLf2nY1QglOy6|5rVCt0wd*Xbr2GG;ADHv_P zo@p4qtubjxVrdci7*cwG3j%lL<%0i~P@%bKw)E_1urB7!w2hwi!MIMls+jTNifOr9 zhBNU$!SV|?f?tZMEZ)>%W0Ai*ifpALquvYemae?~4(`xJ04L|xY_m7DuKPn4FXI2~ z)&aubNu4i#MJaZO4ha7Fz?gfem0^m;6++VxrtdH&F@wFU!wD8(Wus3BEPy;cPtAyr zKr=DtRMEH?jdGN>&F{)@>t*Dtym1Hf4~P#xHa?|GVqW$H@9Wh8 zGd1KK8UQJ<=ZKm84otg?Dvk5ThQ;U5;k2f3vPrCx1yZO<`0#TlvP8v@k6T))8JFiR zP9giWXH8+`86Jl;FpI2fY*6I*1kz$(St_kq#l>wte*wT4G&}HVd&F^so3Ura2JN_P zjHcLLmW-Z)!qDoKL~hiE_xCD&VE)&|)4jmOu^Q9Ay1nIB&cxP@7dKMAxVz92^_+Dk zV4w3IPSGQpu#j@YxZ=?#OzsYbDe3Qi)dSFs%jJ+Nu+Mre5DD{iOncr1tN|xq+y$Qf z7256F=BB0w7zLq`y9>AvAQN>fTNk|6MtL55ed-OEg#;=p_Vc% z%$y;P{Kp*d1+3LF@S0>gG+hl~-7$5?st-qjt$RJ30fX?{yNGf*nfSo0dIgmti5Cx` zEe~o?l+oTBmg>pL&tLf}I7 zSQzPG)g>9qxT-cE)f7}UX%YF&Cpw4iGSgy+hc_LFAI%CZbnHm%1B_!G#6(uIlIFOG zBS5F3bu(>C%x|Uah``>F8JCG%-`BOz$#cj(4tb zXEW2zODf4{E8=0#P~0!4wgnL-aLPE%pO;}@++O0r3dq3=yvQx+5bQWDzv@H>#O?m_+u8c8zG*g@=qeWKmbBCF9Hxlmg{<#v1r~1U+$hTEF5-;}Zg@vyt zcu=WQn?dJm0*QTtaJ;jIPFpPb$EjP2J#KhGVi?*uj&eXgpCo1E;7Ht-+tD4tOC*iu z2(sT#3Ny?~N4Gy0aWU{Zo$1`n59s^V@Fd=_?eARIa&37(J&CCZ_(D@Ape|jIP5{A6 zhPYz(804!S;}l-tImhp8w6x3Q*LHt)XZ>Qu|3t9K;jZ$9fdeL%;6exWyC`4N`7f&k_M|zs?Si$QS}tq!&=|Nk+}Vy zZWg9)>gxi%O26u^Dv@HDXzAsagbDE+wNvp<^lj=Z1?hNJh5O`HYz4ffY6swvK@f&_ z8McS_cB8-_C_F7K6yUTUBApKdV1<;s#ov!{0>R`UCz!HelEamK9*T@AIgInLI!S{c zFge{5Z3F2B#F-v%4@wC-OwLNfy#6jjG*fX+6|ttdWDw(yL=o!7Ym9>HwhQB+RiHW@ zWMdOS6q5A(FafTK8^rTbp~yqox6pF8YLc}?*Y8NSDI*=-73K8L?0NEY1`u$-xpBY; zrbYO)YON-7b4y$yjc@~4g@F(OHtLE7Cb{aNJL#S5XVZD(vX~#d4~)EXa-KFjDx|W| zw3?!2?j;?RMrYovG7LzV4@fuQj3>alu$A}|C&mq5kG2i`?dK)$?~D!2j6rA9iQxu` zHQgpfB!g3GN@!&4A~l|GjM$UA-p#GPBy%@__p{4{R`w4HZ#RBCqTj9om7(f0D*5qsA_6Jp_MO@@p9oe-o<4mK zSAdZ$RSgbJFuaq8hB%`E9rLRLg*>0NgeBr?8l=dLr8H{Mh!@WKO(M-~JEDfJ}ySl92b z*BOI9;iaX&kI6{MkY&|uM?}5lR*&~Q>><~+%N|1u?034vIM$!8@4MGu4gxLHuL)iM zIFE{_dP6Jy_X&WebIY|dXm*xdu;a$BI;$1ZnQnoDPM50Pr2@!k-+<7kk9nZO_rG`O z+*c}GYZ*#!eN)tc-Gki$QE!VB-}F?$dJHJOE}8;E{Xd}Be?|+>!y&2+YYL4D9m!n1 zzt=Be=+EpE78W)J5;j|d>uGmC+2et03qf@1!pS81uUiehHQXPrQ{k2PJ2qtl=FwEjaGNb2L!=XienVT(S}#Xc=I_31T9^Vw(RmSnjPov^z!U#%WH{>!S%h zH=o;a=YeM28$Z=;QWSiQWMoO2=c-v+=+Zv=J$?`G03L(R5PkfUX%)cqJM_a`?AKPo zi-XmJK<+1ZiF{@69ea^|gwO#nFs;JI27`P465Q97$$b79PHXL0$EmnO7hcvFn&^9n z3h@>g-)hp_V%kkdbPrP|)0Ml;KQ8uWW0d?5ggH!KqyELarN16>6Y>~|YeeRl1MxoLMXpTS- zs59?GGArgcXjTz3IRs<=RcEZ5kOjyF|1cUUhj<>V+^-=>7ftZ;)-$g6)~7annwg&c zZxjXG$`Y6bK_p*(pwipGZ--7LQQW1KvsDyRbFPfS;%`LtOuJSX;HeEzKvuOWjm8CY za}~ooo>JTU+qtUbP~voW9Jy|jHuS$%4YEJ0_!M7V#F;&awLZZ~7imfc>6EMol|C~3 zcXhCTz}cZm@4G=MH4Q`L9?yPItP@Xaw3KtG#>RnIee?IitH1@g>-g;!P*c(G-F6F` zO_~3fTmobT*%(?WsC4q5=c8`N<`cMOY4Q?+1GjAOBWGB+&bR7xLx*(0ZGV8I#c28j zF^M9oO*FD4I=DChdXVe+#07JT<)>&;@aA+ zSc1tvfY~`Z-qpN&v9dq&m<70X!40dbxBE7a{om*LT|$iEw$HLN?pbPL%@!AFF-uE^ zn8f{JQ$&$X!}Zs^TK4Q}5Jgln{?8mDnZbs+l@VWm90UJJtuRyc<6?Cn`;4$O%MrO6 z0tjFP8Q_p!WO&Op9G&}HYt2cA^Y#?Fe+UhOYo%2|goS`>pH}qAzGG%AG2Df#d<3(} zWfW81bV= z!%J#6N&tNU&M_m14^!&NSP>h9>7O~kxjhG0h=FaPzU@ldkWTYx3|;=kO9U~s0SdER@%mdgDQXW}-s)De9-BOjzV-q%BKdZ!#e zFmNY)l4fq+xGG{>&xe8nQu@~FK%#N@?y&F$%L;)MfYh`hcfi-&jRSf$UeF8m6!Fl~ zCed8ihziIU;h<}Jhx@7c!4b?#gB09W$iBt)iA^HppSrUaSsueGX>3yTCa}QnBg>DO z!u=b8H4ISlijn4kFljFkuVpt(KC03`ahD1H&$h(*_8yzOMr;ts%ao>bPf*E}I#y9t zB*Hy#W-ZI4<E&{|~B*v2G7oKhZooza9@GK|@#))R%0?q`z8nT2qufzJ| z*diGqS~p=ZdSPN~^9+~cF_4}8R}7ou(rSahM1p2px2nc52W9`YD|F=GL3-{g_i&;) zw~EM{4*ieMOB24H>);yrmyU%0&Kp!S27dd3zM`7Sru)nNe{n@T$EP5sVx-Q910V_* z0MgDB?NVTq*3!im{>6QjH^)WH>hdSX-dMPMr?c7_vSizVy_(~^X|AfqDcAL{m?7#3 zBE4?tO@OrReV%0gqHPvUg+xw{Hv-)+D#w2~Tiiyt($Zh&k*5z|pui@&u@YuV|Bf-3 z1xE@LXyR`CZ10Mz>ZCER-T0OE+ZQl*Ng#4?bJ@<$OY}7xKhO_H>8yE!srFCruc@mX z2^!Q$YwQ>a475|uF}{a;Qrcqw7iGZVBH3zN_kSn>5EdQSLN}63b1KeGEMh=`8O>Yk6T~srRDHXP=a)7P}rOJLKCtYn|u7vR;(S&V|C~hE?IZzf*W~%xuEqYMwf!N>dLGQWtxJ83=^!6U=g@H z(Njd6<{ETep@(bDI%QETkfp#m<^U>l5lt?N5WxXsz85rWM=i~omI0Fi=#oV85RGpbm;+=XTPp(M-1{7npK7^ z+`&|s7kk{n`5OA61a$;oM~E)=_HEKCSQ0@_Y5AaM%BHAwXYWKyP0ZHX45$C1bt=s3 zOGE)Dtb3qx*UuU2jU$K%NvLg*nIMBF1D!MRm{hh?jrTiwZqL}rQ|sENMqeVugYd`B zg!ncOzleK1O-+I=yC~rSl=WiQ#p7;!wbAFkigmFo=X85LhKvClv0w)ioCqON&okHFK~Q`i8$A+y;+@(r=dwVclX?gPvC90Bd7e2|9R$rFaE#wk5qq{ zG~swUgqeXV7NGsV66gX${q+5yH^awxxCX4~vGTnDhP6NdaJ(UnGy3nBN3#K(LCre~ z%KjICAZ4xfDY{Awgpg`r%YFI>B_+Rx>U{Xv_`mKththNlY*hua@POO_($uk?pw?Cv z%?PKv1AKBmKOr4%zdd<|+gB0Z;Fuaa_7D@5dORxLE!{JM`X_xFGj1$%DG;=uJs1yC zONcm}kluuUx}?C+0oE}ZENZMKo|p3wq>e#-0La%G+HO|X$5DdHSr5dohQX%8fMp(Z zUioR%R0ZcIT^A!f^(vw?fR6-AbX!KCX6!Qbgc{Ubk>lnTa8>Fg;O|0K?E5&C?H9Ks z5&YcE$L=ub5IjT(@LM~o9sB{cRR;iDwSoiAMX{XBWOh4a@B79- zQ_E>urKSc~>Ihj&IqHKNY*V6i=7uLKrQaBw9&(4-#qTV zpa{4NE>qglgPq!OU;1v3>Z$n!D@X@(fs7mS-{KgoRD+vT8$YPu-SybhhUC>3j;*;1 z1L2MY0|vVlz}r%#5PbIpwQ7O?nf(NQJDaH4Inr3oQS?}f9ZVjCxjU=i0vB^S9tLcF zh(~?x0@@j@3oW9_^D!|#;w`StYbxyv*gy<6`@iH5{8sK-?Qkpx&5~SIX-x?x;|%0W zUL>ZTRiA$V>KNVyQ|2&|M_Eo_?P+6A?iw_-zrXoi%&KyhgAbMW07 z&cQPO-3#D10z~BRydOMjz>1lN$>==*K5r1s&ji+5hz;PaODby#20h2p2C@B4Q9XMG2k1P>nRC~iFy zB4}EVDX`7D`jWZV-@&%_V>GhrLNR)EN^SjI(&D*BjWEIPJo4!$ud3--8;)v;L1L|X zcx@_0(geZl5}MpujqKdLXKA_IXn~EcU&t5(;Ds8go!$-`jXka|q~3Z{PWvP7!gg%@ zT+^7JY5Bq4*!UBt^0$uLn<7CLFPp`A#L>509b z?B2eJP2z5_U~kYYi@_YVKOfWaF^@<+vAI8#WCUjQ{%-Av)tF~}j!5X`v=%9e-ZEdM6B2i&BwEI5B{V5&b zX?jCeP5X$JI>0w+rt^VN_$9;!UixQO+n1FlzN&n-+js>D-jmA>N4oLHr{{+~uDb^E zYfj^fcONU*x?eQRdokd2JT6HT6L~Ak3r0b2gSD# zgF^O;JcXXfH;yfj>(n2o3L}2y?w?><4BgB7WsGzXCvy&q8%?bky9rQKv4JVa9l;(X zi^uV#5fAk`J8#Dx@z7$=^=UG4HRj0?II>)fn0eLEeW=?QiRWzsqSg1RBSA7~_4v;oYf^=oK0~+zLlbR!!2hr3Ex3s8x znqqApCK%ch$pm7zMg;J16js(L|_;hhuWF7slZjEQS7NjWFT^diqMjX<;WLg=94aC0KH}gLApBc zz~%$6mg{%qcH%RX-E7V)ifp%S`^Nj+?e13zYwm1X|DX20JD%$Hjla&9vMM7~X33s~ zc>vN8t=lT8j`}g;HJ^j_| z_>B8=-Pe8H*Lc6Ln-0bSCv*TTck0!v#6+GV?<>y? zekEZ{@(ms21-2KIHQC=;x{Bry<7Pa78E_f%SFfNP@^e3({6>v6K!U0A>{>@(&#R;T zPFH&)lrm8KZ=V@GKU3qH@r5c?nNv9P@iP&R5j!f0N}?n#B9izduxf+pteiPM@O$kX z0dZd?QP`1_A!=B&&f~{A0LL$;@oD+7QW2efeC^MMs7$L$e-$Uh(K-i{!tT9cpsaKG z;h^nhDx4Sm?UD8&njp5KF4k2dcWBqE*jnZUX3 z`^dfs?6$=L+f?I@1z3XyoOzi~vnc@nQYgLmQ&qhw)&Y{s2_0kjhAnb_q^|;GMj%lt zg?q}C&8VJXadI)+5Mi6l(w4iCsmjVI3;J_%KJC7((<1hv{gbEXlxM4KT-0yQ#MCu`|a?aeT8N9kB|@M-jypc01JE_D=voX2y@bbAGN z&ls^hg|zUwcg0qVV*;W|ul{7Jop4yCP68a{IWDo&)B4|wwT4&QJu}w(ySUB7<7ypq ze*EQpD(hw243Rpt2=moEK0Xl+<>V8FB|hzqc%-`ANXEk@7HB$cQs&^wON5pxFRSqO zdz=VHRKcyp$qxT{ra*efDdOG)w#sbiuW__ zL*4R=u$V^VAtDYHDjbHD+4lAq!|bU++`k}E)Kumc&(OQ3Q>h~M2CzQ{9SDX#)K8QO$UC?~zyRXT z(8^)_$OiT#18CZXSv}*eynp|SRRs7dRVmVdA^4yD&6mEsfy)u2qYx<#B$M8 z4tv4&qdF-wS#GJ!Pi%NOuFNGW`7eD-##&BG&LU-j7swQMSqi((bO%fq-CQ*vP}W9b z8sInXP5VTs*=RC4fw3UpIpT6xAn=Kk?~fDnM%G=)*cNicOp|C1g9>rm*MI5+q;8nM zLcjta-o{)tXyto&@lY^BxrMc-oAATjye6Mt{7?;?tDKD0zD$K=S$DyiUWI2z)LL>y zWqNLClhCCOneEf<>6!Sg$C?wE+KFpYst*2<>|Q0bLsaFHvzHJz`Oowk7G<=%7W`lo z0;ww;R%b}l9i!WxXHaC|bQgG}I{x(8$fdd=9Nj%BTyt4p5}t_z4Gi%N*O zT^>}|L_d`AZ`~%68suWT?C0NAqEEIlV>Ue=47{FyQRP?KIRFw@I6`c1^{vz&URV^>{8cX(252yJNiLf}uvOo(TTYD=C4(n{1 z9wpyww91EtJI&joZe*uf}ep_lY{92xJ!GRT=ZoyHO5v4qRmcK~xk(XgT8gyzDJ_4KKsisAwS^ z{M9-f$I0dEtDe{5$vf`t&T#Fw~in zb>~Ob2mu*2C>4*dL&GZQ^xB*ae&;#1u-mhB)T;}7F#}`|9x;8G7+Db@`^|Jgrh4Of z6mRX_Q>hBxvIBFyB{mC9cX^O}b}On{Ypb_Tml?juQhnrhIJrMaU;2tM+uhgF2h-(P zE7z3K3zOd&AU(o#q(08ACQ=Z+V`JX2dX+o%=Lux{^7V{aohqF?cKmQy`n_(-^v8uY zQv-to=HZne6f-^zWhBfW=<*LNxEy8s8%;lQuyrJL$643s%m%|Nb);f<1m><@di

j?(uvAoJz5HrVlgu07L?Tt}6q z|d9E+-oU!KR;*g-`K~iJwJhD6w>TKjpe83 z-`26&`t6OO_nSm*`?_)<425ACl;N`9+V(ZYIhpd7xs~H>aAHQRQ|O7v0a2rU^nTPb z)VxwM9fZbhX~Kl+kqB>_8-#H3uIdEGj+(sy$a9?%3N=TV2awqnfXuG*MUSjcd7jYO zXguNLrk3vpr)4I`IQX~$+GFxqx8naM9uVfjy#hyiT#q4z34O` z)od#FG+-9{h#vcwORV40jR)#N$l@)uhDjm6?Nd?V#d|7Bjl-&*T%?*(*LzO==gp0W zUwu)7%z!GY&%~!~V(#6l-H*!9*POT+z;an|D+mkio;o%FzaN$)IPHOd&mn%FPp8|$ z>-XkLi&?Ht%_phYs+{|ACY-oIC; z_g`5r8b=v6#xn9h9XCt2ll--=MBD>-GxOzm<9C=2el2f#)MZao|cwMn28Q1 z&juP4)cuaS&~LXw+=Nw;P54T4ahrb0x89FBv3^F6XPlWGr7>T~jp{zxOFug)zo>M# zn;8=+a#fFMh~;TF#!~_wgEnyMB5WN@c1nb*35E%_#gcN*zV70yc|k4}s^J|cKSRsJ zYk0}R8Rc8G9b_H3VFhYoTG-3=WK;A#1Ljz4PW_XMTlBGhmEn08UBsz>KKj~pMJDN~ zY#Rod8nFV<-l`CsOm&7&zp>Gr`q=W+c}5{9#b#!L`Kz1Tmo^F=zMa^-?onTlyM3^< za!C8xg^Z5xXqLR?%KxblH|s?xqBm!Bzp&|~Dzh8_Dn_!O<&3loPn#2%|Iz+ID{6}B zew5*U<8tBfAi*J@rD845sVudu%C~tp-}IUhEA%c1NcEhkSNZ|Vz>}QKNvqfFYN)IF zkdIcRe3(nPYT!2iVs%R?O%SCr(WhN&{5`f~S=qRyV6pEhdz{Y2S6(jI_x|09uW-m` zwIQ_Ql_ix*^V2euef546z;$xHln2{6(z9-gS8&Mc$4JHsm6xzaH0+IbWw`Oqo90HZ zX!0waoK~5Ebni^X4fd>ZD zexyPs%E2n=c;YnG;jX@$J}&Rjtr0CwXGOnu-I=reo%fBgf=D#lWpgd|o|x+x5qFrA z%UHZVZ3itD+Y~UxzYxyE=CN!QG7;LG_jb&I9SvovWkvdZ5*bRoYLm@JuyrtA1TsSJ zk5eSir)vMjA3M3}yu!?+qwi-p27;AD~loH%NF`+O`!i%Xrx?0ep| zh_P=wM$)sA*d;Q@p;~v})$uG>c;u`1l70g#<>Xfrk#)8~4wS`HFQsy7thwoPw5{_> zV-iJjgbpUL^1tQKW?t8oMqB~T|z<81S%^h~Qr zHoIE47m??^4SPjcpgBS#d3?h&!g1R)VV6cS_2>vPew>wZNfmKYZKM%W9N}W|Bz4b&X6>G(=Zo?S9Ws&*T{hzT9)d#L;>s9^3b_WN+FdrnlP=G##!MEIRYB} z^$ytkNC5K$K=Wl}UWR8*>M=GRh>v4xaQs!cn5gy*#JDie9Rgq7c%u z_Ueex&oK0TD|BL6L_JN6%JXaoi3Y_DF@-RtRmlO0@_ziD+!K`7PR={{@ph^e&Narl z`G`;Prvn04=$mZ&)^iDeECZXQ8rSjytM5S~9!Lb1{LS?EV&q&nvN2|LPl3G0w@uox z>(oxBlo?Z%fXOccY-xFqhBk89txxW1ZNc%Ex+BJVKTKV)M7 z82Q?DsG>}-bNC`1b&yYMV}mc7TZ(&P#cdrjjlB~H*^V%jE(gsoi}g~VcLhmriCKV0 zPD?I8eN~!RtN`tw1EYSk=8%fJ0Ng}mX^TYwFNmu()2f^UxY~)K@2iP|Bb64s&VeGb zY-b`AOwP8)weFj?Cj9%0*0y+b3vzLV>wNXsNeF1-J^vt);A*i9rDNX%Y;0{BGWvsh za{3NkCghb>Mw|V8b|KhD30Nsa-xWUT7o)lc?)4f^-5%q*q}V!uMnAdYjKsr#zE=yr z*UGyx4OyJS7Ql_Ua$zbcc+PGR?J0Q)Og}KfUBl9s|26uPdnx6|iHKQRX+ihGH!Q({ zfh&1JR>p{%obVM&J^wu251!uQla8E;sg&l8d2wi;Uw)u@5FM!Zx4A4OqR2^CGa(gD zJ=ZwoZZKl5PgwkTmfvr?6WWdJHqM?yhPONBHTB^JHG=OhP?F*bkPq_@${rErqkHdY zbP^IeXE<;)4lPO$EW)Vm%@D|Qry*aek}9e(zy0)7^S*P@ZBDet?L_H&AlA1#faTQ7 z)gf8-PmRqShMT8KGaf<9ZRCw`U{>tJx`J#LB<6hv1<#56XN?quM1p0U}&-K zUFd^-`U7%Kf8V0S08^-)BS37%^os$wei3KoTSN+TH{`b1WB;&wh}X*?n6sz(9S9Jc z)}*4gbN_8Q3gGX=&tdoeYvTUZzzE*tM*c4uKSA$u@`)3*4R4<%a0wGTZJeP5 z3m6Lg#iXTN?dIGpVUV!e)F3qYz5CCcaJD6YQM4&WdUfo90%phOGAW}orz6~sRO8KC zCC>a)m%-<#BFFVMfR~yvRu4S*Eb~ug4+z z3it&`L=Bnv)uYOdEJw-@CHLLP08dQQB{mXdX5rXiO@6uZ$dm6zLU zW8l_fvQ8Y`?xU>{bk);IRw9yx3{NE&B=+&fXg^fOMPg2UMQGH26s{QhJ{4GQr%NKg zLCPp;RP~7lj&?2#+6&}+hyUxu?~nTMX{0C|KFtcD#l8ZYx`3@W#=A!VDO1{jpi@`E zw+lBWj?@W>vlxgQIV?a;L>mE7Ex0;8c9570luF7+EZgp2egWjB39G0=%(pi&5!d$h z-e&u>ov!(@51-2p)Cv%ljCezBF=7ZF^pcXh7TiGNd#HgU6!hiYPAzDNbK_o?>G4P; zrl*iMJc@@YwA$t;a)WroYP7AI|dwaF|0b*&zf4Q@_*Kr(B=^yQ|m*Pec*{*LYmlvum?3jIgc@SWDj zVbloO3z?`Tqg^2$`Hh{S0b-;_CO&262R*`pB?$%d1aYXVZc7kZzo%){1&8n^y&pMa z7L|dTxcaSivo_!#`B6w9%jF@~fM`!@Q^^es3WTcH7n4l4ieV2jSw9n=Ptr_8;s7Rv zDoV%2J|bdjka<`A1`qwrpgH7>*hXo_>gPBoRQH;5&n=@In&pN|ABDJiyr{z&lK zY36^6?_<^Koqw!9^xUBL*BT`@-S~f!9;}*@OfCtcHTCCvWK@kSdL8ZXlc;;yMU=!B zlC;SHR^pS-1vijEP2j-ijDxLP=2d8H?D!QZpw;!B_Wfx zG=_mOR0@;6dDeiSn=-rqkIWzw2AZ+ki~{iVHOPkClxZcoamHEU*w;hZ=l{8K8-O0u zms7)$-d1FNLeMn$)fDevY<>$zAHgmNU-f2b^1`=&%TRVvV?&S~Ie#Nvp68sx4vH4u!#N<{)9 z#WY!vd1X;iRAuL|Q)zLo!l9Z}ll7HE3jmt@nI(54fR2GBCB8B(0`YQQTdbeCv-ur= zD8}DKZoHW2t|9|U>q1GH4a!99-pqrNYKmB}$#uA9u47IVs0`KQ0`Vk5ifaOTTQLsS z?@#E}DCx6yUCyD0#-wdcMaK2S`Cdo1lZLJ<`@z^>p>dVO?osQ~z2ZrbW_5ni1Bqy` zLrJxrDG>w8^uRI#l<9DEzwPR+4U%fyBySKL${%<;H%HF1maJ5BiVTw2(F; z^i__e>o1@j4x5_>igy;xD%eXVf5^mxv-k&hNfN{ps3w$cDYTIeixo>zN_5NT3r?O( zJ2+!`x3yuBOmpgH+8YU?n~c1~`YB9&(^q4pFCHKt4TnDsmHkMMvXieWY0OelL@V~X zxok=x2UC;Aq(lu9Z`MYMgh}w*b^0|gTfxKi1>$V|bGPTh0uam{#OJEBopw`nqy4ED^OH}#d5Nv`4K24gW9`1;S*Ap^aW zpkdJ0K;pom49gol^gvN@r!(NMEj`23u*ySWf89B;5AxvLdQT&5^}kLLBZj-M@`aNv z5Kac@?iGx#ajCNYR-e0Y6WlI>hD4i(GhPmKi75@2GDeQ6rw{@p zq+9xc0BNC6)58uOxA3{Ffa%i6kKCig2-jo4@0)~KlemaJj^R;pklJ^0;f#eF9BH~)M(l=sZV%BPMoK|>1r@_qHlNRm*xJJpOVJLO3c zHJM#dPhR~#A0r=l9vIJEprhXS{rINywGsFWG6qMGxpR*O7Xyl5gq&M(uCjd|iQ2bn zPmn2C_EJIAb|Tlzoo$ubB6aEpZH}tX4T^I#;}ioyJt@_*Emg7ON&&>Z>j_dIxv(wL zH5ey)YwW{hhiMj2MTE@$Syt_a*eE4x@-t>VJleTxX|j~K{4cVmx;1=6B)%gUFD#w- z^z+>L*DMQ$mlHT~Eb>_pxd~~2>uLn%sM^ec`chI^t%u!vY_6!KxL0;rwv#>GnQYlw zJV^lqVATvxiwjr7L2FTM7AikIAx*Mq%B08vIMwPtvODWNRum~B z&uzJwCL85hdHv%w%>_Z`7iup_cmG-UR-w`|N0&~!o`uN-906~zZbl-oMH99uErj&E z#(Au%u1fUbq?uB^G$CzKQaz*dtMVdmNCQ&u<^UmVPmHf;uo@0lNFVx+Uh{Vg+Nq6$ zb%$Yx-mI?~D_$r19jZ8YFP!Nfwd2v=8vCV<=_HHQ!GfA$9<3RZUzHkENDs1GwO`>; z7h{)~ZrvEQ9X}B)-bb)Vl0^3ICZhW%B&AG;HdkGq`f>sCFDcyP1YPT)2f_rTI2)<1_N^8ood}Nx`XCq^b2Md)2g^Gy8@z(@>wV zJ*+zH?BAs57>Hvo*sLhMd1~EaiSo*xJuEXC=g(dml(ZohAsb+DM}1uL(%GCjy3O#< zsj#`0QFsw5b9tn^ISh>$(ph2$v8P-x{L!k56R|HX4XVlUC| z4zL^meG6~?b{&R8Yaa&Qv+PDXOWwrTmL~T5H3=GU7Y3ESX~JKHOoy#E#Q>14<$8Cj zQrLaq``DpDiWxmZ)^sJfW<~W_Hpk`7Y^KrnO%9}!Du}5Q5=YwOU8}e#SxUr;0s~v8 z)G`B%c_9sw0pR=05wBk&BThRpm9s;+4TyppN0>jEG^O$WI(VFWv18fN-=YHB&wEz6 z02}mT5E&r`Mo2A_F0Rcd6W9(7C;)>YWl$h)mlO&NBxj=8*7mKMxt>##ff{7(3Vwh) zrpl|PI+b#xc%I<%smeE~dvMlJ-7|i-3E)GJqWJse#lpyz`<{KKhRdUCI{A%mx++@; z=c|bvu>pfRUo6;Db(0u!a`U6)WY}JowX?>=*wL$dj^QFHyS?6&cAB>@|5lU9D*$K# z?Z>kaorPIhSkN?vV{_9JJL-oByp0R`i4mcWdPvRn7oB>B8U)4Z6g8s^kJXt@=v|9` zrOvgy!*+&aR^-D4Ze!}qF6U0Jc1!e^6$wqjfoDJ?2XR9A6Ug#(`SD>{e|h{`Gmv_# zRI^%Ft>zx!$3qQ$I351pj~x!aacd>NkvJ0!U8r8nO5YH7zd!Dk*f~F!k?;|_a#gV6 z?Vg6Pz>JottJ`8HAk75I9s+JR6AgZQ>UBAsUJF>U*=xmCRf}_{2If)|Pr$5GYVV}D<`(#AgSnOz^J3(@Rr&9QgKWXP@(UfaU1_rTy@?3^SdPr~ zCtWBX6Hg&MbAzwv>%u7}llGHE%sL%5k~IzfVaMweRkIL81{{WkxCN_dlS2-7-b6qz zNQcNm{f|zUx+)VIGwQ4FX}nnC+gMyk)ipktXSQ+BeuJ6+zVTz0;}7Sqol?Wwq71i! z>qvb7#*j&2DD(+?LDv2Ahh)^cR?Bqlr(B1Ckq@>HO85?r3}8+bF*5|(`tpDBVNYCz zpeCXg`ryi$?hml)QuV#TTL`Af|t>V9R39^=Bkvy7K(f|5&*;f6#B#;uD7b-j>{ppXJ=unOO} zv04SiWE1n-F5mQZ+p3FOqib3k6)jbp^Da@>*ZK6(cGIU%XkulvGs7a3@=>Yz&fx1W zscbD;oI7lM05y4PcEAmV{wT2%{A2bvv*CsLZFV2^?gNu_O}WxL?yFYY7MD(8m=#!f z6^6*IZ~n2l=8gqgit}66P7;~S6qK_2dw41K*?{T zJ38@mc0CRs+O6HVsuceEywhHeUU5&+ue`3F$REv^yY`|nDVSx*8(npLph-U|KPg}< zxTfs|_O_J_dRBnu@I4wc6mHazXC-T4Udz0|wFDtT zGS%UoROzgFq6hv3`szugUJj1(_9?0f5=ElZWT3HRLU3v~^eYiw^C{zQ)X??}ImU|m zL!--~(x?D!PG7{V=4eA==gjA4j9!o!p$qtuYd0ujf!r_nXh$1tAhG>Th#E}_8Ce6$ z_DBqApf|yIc5(N%-jGx6Y(+C8Zn^?f!mAnQliwOo<*L~xR>B%;P=LLMpa6@*t z;7~8l-TVhm02+6ocOf1W79vp5HcGZx?gl)GgDClft36HSn3|GvDs7( zz!D3rTG4S&c+MU25TPZdHPulL)y2?JqTNI%EQ(sS}tR?-O?n4ysJL0dPcDzw@H!-rS%(XEL4{9Z{e>lGXhJ&onKIS(vD*^HKCC1+I<|uVE=)ch^I?S33kh zEv_^Vw@P2O-Xfe^A6e({F9RCzB+!5Z*oxczkgi3DBdGx^iRb3#C2xJ#Wqu3j!v%&? zlKk10{Pw2xT(Q#)+nOYO|6ZS>J*^an>syaU7?qN;x%-eBuF|Y+^hh|PAb#aF0U;M- zu!u`}I%ZQKlRfBJOBk(CVn>Du!6nDlceQky9Qc|T6^O-!mEVfqd_2k-I)%cCZVT(c zCt4W)?MBX4g!PEpV7wF(f~7_dGWD6H2~|gBEJiwjQG*9$!;2GRW^LY1KF<HX?Vu~&taunvtHx(T< znMEg0G?0v(!r`^X6@9)&4csBc1y2t0hcg75f>o}uxP^;?+xHCNAaF1{5+JOsb~_6X zef<6QqnKz9W@;oaAx@q7mvPgNBwDb*7qIr)Jt2=w|n!@uR$Bl8P=BlKr-XdhoQe z=*^;t$tFM<^weiNAtY%EAtgxJV9vLok}LJ zLvu=a#Rgv`RB5CKFR(`vmPrA;VWlZ()7Y;~=~DH`G;WZ0)G*NhwOr|4^kG5Zu`Ts_Tx^1|J_K_4;l@fF3!ex0^00|x*a!(C^e_qHC@3P#3!MtbF z#!lReyO|`2TOhg6!{2*G!$7n@pAl&*=SZi1Kbe-j+u(_Eh47;m@~Epmm4_Bxwy}Eo zTWSeg)t{v_qmk91G>zOlr1Dg9UgG6AwfS{6K~@;X*ON#hQY3rHQ#*@4y9xDz+BPAq ztO=K3+#f#QFWv6kQdPBKC;>8>$N?Ft$>w)9>uBIUF_+HjG^Qht76PPgKFz(1cFA_n z^40`jx7QJi!EA!?vt$0QRIaa|3`c-e$l+~>3y)t6iQWNS`)=AQB z9ddls*qN}tml~(W^@ZDIf95sZZ=HR+8a;HuI{HF}fzo z@aVhVVxQoqDC)}}JcUx6Vu#Lc$I&9q1fXFU%x8&ZXI*F(WoW9LiDxvvuA2EY{7Hn~ zcVpOZ%jbJixWWor7tmoZPe;y|eKgY5y`@@*mQyHu_}S^O>32kyVl`llw?Z{@%sDNU zf+}8*of@dP5(f!iOe7U7LYpQIpW@}jK`3voEciy}K{Fxcd(=!l6koV$ThqNnvhMbG zytO4MrZCdv%Wwa3sULx(ZabVV04GmPhFG^%RBTs!F#30>F%&{F>2@66g*<*(bS%H~ zsu{+s3<5>#jEyJo)>b@yL9I}D?xkZL-6p=V1o1dfN} zKN@RPCv3b!uNchwyGq7K(TzSKnPsxQujXOv(fe}a#QKky-mvQa{#T!Z4y$vmDEDyu z?nSy+#-0rf;@vTg2qxwO+xBCY+}?5Sun;>_cN2aqEUgQj(qWHh{opxjgq$((u;aZz z7xSCLqX}QgI_#@X$Q??3+*PyZB|`YxSZdFY}6VJS+~ z=j~Dv0HYw!ptM21bMwL!4myrjuHk~CV^{0??=*`U(A16L&2p~ZDA4Sti3z~T$n!*9 z;b?gKG&PB(z*t@sNj&a`l6LIYX4_&PWb?rJUVYCOiKkw0W1hZG1nUZsBgJtjdVc76 zW_vU>ZHhVJVPAg~IU!07_R-gLmxu0Wl$^O5LwK_xcRZ%2jOR4Hu4mTtg^Q`RKtBLI@XSRpe6Qbz~O> z*gF6&#RM|rP#ipK23))vK)`bpwpy#N2`|z6P&1ekbrM-}Tfb)q-)Yy09o}c%Xd&%Q zrfN-AI!qy3i=wGL$VzunOj-3KMM~QDUOIhhb;IZ!=OxnzQ)ljPtS)l&bk} zwD*wW@7c=J46`+*r|U#6J9nr0%p|(V>%E}H$jRM|zNn6Jp}64k;nBa!yvUj-ZubBE zhv+l@Ck@y){u9D~LO=q5|1{x0A^f*H{I?4JTLu5Eg8x>*|EH?}lS;0zN1*SsxtnCn R>pk#KLq+F&zOr@5{{e@yhEo6l literal 0 HcmV?d00001 diff --git a/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/docs/index.md b/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/docs/index.md new file mode 100644 index 0000000..6e3003a --- /dev/null +++ b/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/docs/index.md @@ -0,0 +1,9 @@ +![cnoe logo](./images/cnoe-logo.png) + +# Example Spark Application + +Thanks for trying out this demo! In this example, we deployed a simple Apache Spark job through Argo Workflows. + +To learn more about Spark Operators, check out [this link](https://github.com/kubeflow/spark-operator) + +To learn more about Argo Workflows, see [this link](https://argoproj.github.io/workflows/) diff --git a/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/docs/spark-operator.md b/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/docs/spark-operator.md new file mode 100644 index 0000000..c7ead4e --- /dev/null +++ b/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/docs/spark-operator.md @@ -0,0 +1,86 @@ +# Kubeflow Spark Operator + +[![Go Report Card](https://goreportcard.com/badge/github.com/kubeflow/spark-operator)](https://goreportcard.com/report/github.com/kubeflow/spark-operator) + +## What is Spark Operator? + +The Kubernetes Operator for Apache Spark aims to make specifying and running [Spark](https://github.com/apache/spark) applications as easy and idiomatic as running other workloads on Kubernetes. It uses +[Kubernetes custom resources](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) for specifying, running, and surfacing status of Spark applications. + +## Overview + +For a complete reference of the custom resource definitions, please refer to the [API Definition](docs/api-docs.md). For details on its design, please refer to the [Architecture](https://www.kubeflow.org/docs/components/spark-operator/overview/#architecture). It requires Spark 2.3 and above that supports Kubernetes as a native scheduler backend. + +The Kubernetes Operator for Apache Spark currently supports the following list of features: + +* Supports Spark 2.3 and up. +* Enables declarative application specification and management of applications through custom resources. +* Automatically runs `spark-submit` on behalf of users for each `SparkApplication` eligible for submission. +* Provides native [cron](https://en.wikipedia.org/wiki/Cron) support for running scheduled applications. +* Supports customization of Spark pods beyond what Spark natively is able to do through the mutating admission webhook, e.g., mounting ConfigMaps and volumes, and setting pod affinity/anti-affinity. +* Supports automatic application re-submission for updated `SparkApplication` objects with updated specification. +* Supports automatic application restart with a configurable restart policy. +* Supports automatic retries of failed submissions with optional linear back-off. +* Supports mounting local Hadoop configuration as a Kubernetes ConfigMap automatically via `sparkctl`. +* Supports automatically staging local application dependencies to Google Cloud Storage (GCS) via `sparkctl`. +* Supports collecting and exporting application-level metrics and driver/executor metrics to Prometheus. + +## Project Status + +**Project status:** *beta* + +**Current API version:** *`v1beta2`* + +**If you are currently using the `v1beta1` version of the APIs in your manifests, please update them to use the `v1beta2` version by changing `apiVersion: "sparkoperator.k8s.io/"` to `apiVersion: "sparkoperator.k8s.io/v1beta2"`. You will also need to delete the `previous` version of the CustomResourceDefinitions named `sparkapplications.sparkoperator.k8s.io` and `scheduledsparkapplications.sparkoperator.k8s.io`, and replace them with the `v1beta2` version either by installing the latest version of the operator or by running `kubectl create -f config/crd/bases`.** + +## Prerequisites + +* Version >= 1.13 of Kubernetes to use the [`subresource` support for CustomResourceDefinitions](https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/#subresources), which became beta in 1.13 and is enabled by default in 1.13 and higher. + +* Version >= 1.16 of Kubernetes to use the `MutatingWebhook` and `ValidatingWebhook` of `apiVersion: admissionregistration.k8s.io/v1`. + +## Getting Started + +For getting started with Spark operator, please refer to [Getting Started](https://www.kubeflow.org/docs/components/spark-operator/getting-started/). + +## User Guide + +For detailed user guide and API documentation, please refer to [User Guide](https://www.kubeflow.org/docs/components/spark-operator/user-guide/) and [API Specification](docs/api-docs.md). + +If you are running Spark operator on Google Kubernetes Engine (GKE) and want to use Google Cloud Storage (GCS) and/or BigQuery for reading/writing data, also refer to the [GCP guide](https://www.kubeflow.org/docs/components/spark-operator/user-guide/gcp/). + +## Version Matrix + +The following table lists the most recent few versions of the operator. + +| Operator Version | API Version | Kubernetes Version | Base Spark Version | +| ------------- | ------------- | ------------- | ------------- | +| `v1beta2-1.6.x-3.5.0` | `v1beta2` | 1.16+ | `3.5.0` | +| `v1beta2-1.5.x-3.5.0` | `v1beta2` | 1.16+ | `3.5.0` | +| `v1beta2-1.4.x-3.5.0` | `v1beta2` | 1.16+ | `3.5.0` | +| `v1beta2-1.3.x-3.1.1` | `v1beta2` | 1.16+ | `3.1.1` | +| `v1beta2-1.2.3-3.1.1` | `v1beta2` | 1.13+ | `3.1.1` | +| `v1beta2-1.2.2-3.0.0` | `v1beta2` | 1.13+ | `3.0.0` | +| `v1beta2-1.2.1-3.0.0` | `v1beta2` | 1.13+ | `3.0.0` | +| `v1beta2-1.2.0-3.0.0` | `v1beta2` | 1.13+ | `3.0.0` | +| `v1beta2-1.1.x-2.4.5` | `v1beta2` | 1.13+ | `2.4.5` | +| `v1beta2-1.0.x-2.4.4` | `v1beta2` | 1.13+ | `2.4.4` | + +## Developer Guide + +For developing with Spark Operator, please refer to [Developer Guide](https://www.kubeflow.org/docs/components/spark-operator/developer-guide/). + +## Contributor Guide + +For contributing to Spark Operator, please refer to [Contributor Guide](CONTRIBUTING.md). + +## Community + +* Join the [CNCF Slack Channel](https://www.kubeflow.org/docs/about/community/#kubeflow-slack-channels) and then join `#kubeflow-spark-operator` Channel. +* Check out our blog post [Announcing the Kubeflow Spark Operator: Building a Stronger Spark on Kubernetes Community](https://blog.kubeflow.org/operators/2024/04/15/kubeflow-spark-operator.html). +* Join our monthly community meeting [Kubeflow Spark Operator Meeting Notes](https://bit.ly/3VGzP4n). + +## Adopters + +Check out [adopters of Spark Operator](ADOPTERS.md). + diff --git a/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/mkdocs.yml b/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/mkdocs.yml new file mode 100644 index 0000000..ba91633 --- /dev/null +++ b/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/mkdocs.yml @@ -0,0 +1,8 @@ +site_name: 'Argo Spark Example' +nav: + - Home: index.md + - Argo-Workflows: argo-workflows.md + - Apache Spark Operator: spark-operator.md +plugins: + - techdocs-core + diff --git a/ref-implementation/backstage-templates/entities/basic/mkdocs.yml b/ref-implementation/backstage-templates/entities/basic/mkdocs.yml new file mode 100644 index 0000000..c8ae223 --- /dev/null +++ b/ref-implementation/backstage-templates/entities/basic/mkdocs.yml @@ -0,0 +1,6 @@ +site_name: 'Argo Spark Example' +nav: + - Home: index.md + - idpBuilder: idpbuilder.md +plugins: + - techdocs-core diff --git a/ref-implementation/backstage-templates/entities/basic/skeleton/catalog-info.yaml b/ref-implementation/backstage-templates/entities/basic/skeleton/catalog-info.yaml index cf9b024..8893792 100644 --- a/ref-implementation/backstage-templates/entities/basic/skeleton/catalog-info.yaml +++ b/ref-implementation/backstage-templates/entities/basic/skeleton/catalog-info.yaml @@ -3,8 +3,9 @@ apiVersion: backstage.io/v1alpha1 kind: Component metadata: name: ${{values.name | dump}} - description: This is for testing purposes + description: This is a basic example application annotations: + backstage.io/techdocs-ref: dir:. backstage.io/kubernetes-label-selector: 'entity-id=${{values.name}}' backstage.io/kubernetes-namespace: default argocd/app-name: ${{values.name | dump}} @@ -12,6 +13,23 @@ metadata: - url: https://cnoe.localtest.me:8443/gitea title: Repo URL icon: github +spec: + owner: guest + lifecycle: experimental + type: service + system: ${{values.name | dump}} +--- +apiVersion: backstage.io/v1alpha1 +kind: System +metadata: + name: ${{values.name | dump}} + description: An example system for demonstration purposes + annotations: + backstage.io/techdocs-ref: dir:. + links: + - url: https://github.com/cnoe-io/stacks/tree/main/ref-implementation + title: CNOE Repo + icon: github spec: owner: guest lifecycle: experimental diff --git a/ref-implementation/backstage-templates/entities/basic/skeleton/docs/idpbuilder.md b/ref-implementation/backstage-templates/entities/basic/skeleton/docs/idpbuilder.md new file mode 100644 index 0000000..3ec74fb --- /dev/null +++ b/ref-implementation/backstage-templates/entities/basic/skeleton/docs/idpbuilder.md @@ -0,0 +1,46 @@ +[![Codespell][codespell-badge]][codespell-link] +[![E2E][e2e-badge]][e2e-link] +[![Go Report Card][report-badge]][report-link] +[![Commit Activity][commit-activity-badge]][commit-activity-link] + +# IDP Builder + +Internal development platform binary launcher. + +> **WORK IN PROGRESS**: This tool is in a pre-release stage and is under active development. + +## About + +Spin up a complete internal developer platform using industry standard technologies like Kubernetes, Argo, and backstage with only Docker required as a dependency. + +This can be useful in several ways: +* Create a single binary which can demonstrate an IDP reference implementation. +* Use within CI to perform integration testing. +* Use as a local development environment for platform engineers. + +## Getting Started + +Checkout our [documentation website](https://cnoe.io/docs/reference-implementation/installations/idpbuilder) for getting started with idpbuilder. + +## Community + +- If you have questions or concerns about this tool, please feel free to reach out to us on the [CNCF Slack Channel](https://cloud-native.slack.com/archives/C05TN9WFN5S). +- You can also join our community meetings to meet the team and ask any questions. Checkout [this calendar](https://calendar.google.com/calendar/embed?src=064a2adfce866ccb02e61663a09f99147f22f06374e7a8994066bdc81e066986%40group.calendar.google.com&ctz=America%2FLos_Angeles) for more information. + +## Contribution + +Checkout the [contribution doc](./CONTRIBUTING.md) for contribution guidelines and more information on how to set up your local environment. + + + +[codespell-badge]: https://github.com/cnoe-io/idpbuilder/actions/workflows/codespell.yaml/badge.svg +[codespell-link]: https://github.com/cnoe-io/idpbuilder/actions/workflows/codespell.yaml + +[e2e-badge]: https://github.com/cnoe-io/idpbuilder/actions/workflows/e2e.yaml/badge.svg +[e2e-link]: https://github.com/cnoe-io/idpbuilder/actions/workflows/e2e.yaml + +[report-badge]: https://goreportcard.com/badge/github.com/cnoe-io/idpbuilder +[report-link]: https://goreportcard.com/report/github.com/cnoe-io/idpbuilder + +[commit-activity-badge]: https://img.shields.io/github/commit-activity/m/cnoe-io/idpbuilder +[commit-activity-link]: https://github.com/cnoe-io/idpbuilder/pulse diff --git a/ref-implementation/backstage-templates/entities/basic/skeleton/docs/images/cnoe-logo.png b/ref-implementation/backstage-templates/entities/basic/skeleton/docs/images/cnoe-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..63b8f228ef58a42a758e570331053afc547df964 GIT binary patch literal 58052 zcmeFZ`9G9v{68*{rH~?`;&6(H5g|JjN+C3sFl5PYWFKpjQ_5N?`&L5P_pyzovSr`* zv9E)%jeYoDw@$s!`F`G?Kj8Ctocf`=d%2d^@_en=yt=QZOh?N`OGZXUcjxvkO)@fy zbuzM}CDg~jo%lXaEpUV0>gLV+HaC@TB5je5S`Lp)&6UmV%^j^wHI;9WkzEfCh8tR* zgEPs-l;rdO+2YrglJb^*U-Vspt!DdQ1GD?)`F2BB!fXo^UN%;21s zaK~R4U(pZ8T_nH4mL)LNIi6oP{r$V7bG3IHop+l6f5>~j_m_^aPkgN$SR`=P;(9kQ zn+F#7tozDGUJgI+%eel7Yuub{pSdQ_@F|7DZaqz}$rjCbDce}i@l)Rl$#hub8J6=} zquvO=G*Z06n-;YHeefmK4EM%E3M!}N!4PTD&zYCG8WkJF(xcV5JF$MdzD0_|Hs1&R z)I;-yyqQLh7H>rGIfjq7ums`ctXC9M#F9}#!N%po$BtH&NxUv*DvC62OD*IjMOMJu)l92$0srI7G z3qrh5PFxiA_*)5<<7`0}VcLZ&H|l+L3VA-AG%9lT4ILkc3D6%tFSeZ@uPZu=3J3PD-U^o3;Efn{4@Et9x`|-~ECY`f5nlmqVNwzRJVOE`D=2_KYYx=S0)V+Zc8t9M{`-ui8w;|iM;I{QZw z=UbizEwdoAc1aa_(YkOhC$qJZ_Ab;BZp{So!1BOZH-*}L3$w`4g4P<91o4x7t$nRF zKi>D+BP6};bpp$jv=hpDoaUVWv|zIqaIPQdigRo|_-ZuMn`1O1{_w;;mCsRM{Gc{Q z6o0Kro7TG&ssCMhO-9X3Hdz2}`zSx@qn@bt4mn37nRkhM8MVbR{k_S}2D!I34V!N{ zF8NO2CS}K3oDv)po{T)LHyjmoG;%b0!r_#lY~6(-T(eoqPRga7wu;agO1SZ`Pe7X2 z?77U>Z(q&ss?RdN_>1Nd%)?bY{d6#kVcD^|9Hd#gcg9neFHQ^g8Tmb9au1ZkkMVe= zOb|qls@YHc#eGNaEZ1|pGLOF&i7Bo=cVz~$(X~!1w$hX)UPfNmWSQi?I{2L(39Qgq zSm|<{%WI?`53-6YD2$#D_|`BvVM3cN%y;I*R8=A`zI3+iTzd+AVT9!rS&pah^{>b~ z`y`e@RI<5K!m;anJW`tvizFCEGmf_HS~iM3wV1#X$TDP8+&47cdA^&BkYDfi`&O-^ z&eodFfhX#_+h4?y^?6|t2fHK>@3o^{BV@&i2S*Psx*xAG?P&x6am!ry&SO!T&m!vb|GN$?7#)dO8; zUDbP%rbs)%M`lP9b3u1I2j~SdX?IC*X=m>Ih|}H9*4|0dU54xM4M}hf-G*^-9=_si zBg3VudY|(q($Sn#Oi)Nrh)b51lao{0(d@CL<}IbaKL`Jl;j(mgc94X@+}zv*-9!YD zjux=15)u+HAz_%XumE^NzzJpV{K#Fv-iiC?Aiu`BW$t9^XyxE+g|z2{#(iXhba9s9 z;({jn{paU8ovj}K&rJ4Ce{TzH5C%PgT@@69{coR{yIcKVK7*e8{OoXFKc|z129s2G zv@!<^hL$CJRr+v(f8G0^?{xT$u-J8J*#G+IfBjVNe?FBE z75V3v|9JBEm(nnZQ2!v@Pp%x^1#FR}m4^Lhu`I3Z(#0AwGI_E)w-g?@A6XcdvpuI% z%Dbhddc;P;JzQ+K%B$)a`xQ>y7Ugt};If#A%+cFl{~Z4m6Uina9(R|U&AsHy_tz9n zFX<5l$A{u=!~FS8#VegR#B^_~{3$1ISU57L9r*6M+;BI1xO=#g+)}J8O)YLM{Zi)s zj?~QE2BoKDN60CtPjbrtckv$){*#3NwBSE2_)iP|(}MrB;6E++PYeFjg8wJAfdAtC zj4sO)FaG7)mvZOqEgZDnM2g8w2=q~@qP1E#~+;a%GL)J2O56&?8mx~lZee=Q=6y30_UFj16ly*rV*cMp0tbDU|0kmvu;*(s=FxnK7- zdrHmL;m)QE#9NnPRtSKhb*b?yub~%P7+-&IqYp~`CoSYh&!LrinsAm{H%EK?u+-Du z-nH@l@o9WVu>BNqs!yxfXsBm1+ndE6{PXRmKOJ_*Tq)Krv~<;$@aP!Dl{L~s&$r~| z57#2rsra|5ZN5Q04YkoMgPy3wJQ4fBo`|@$`952 zpg<-x{|e=LOa6*9po1EXfdsMd=0Dc}1o2B1zFI-L-O18|^>CXEtWbLh4#Q893|2 z73Nk*d`*Fvg)08!;_pE(Pmwd*u~c7g)O!?^|3F&#DH)mp3@1CfeDt5AQGYU^Fui}_ z#jP?$p_Y%@zsEcZ#$>p@_fH)4G#;U8f9d7An*eXOVTt=}X77m;d- z4FN@pD>ggjnA6qeGo3EuUG0^rnObtF+mO(60P*pr7+3!1nlj#3<$PQm<*gmMr8uZ# zm4uOM%EB|(6`oJml+PB6KTUH|mkP~~7rJfw8)7UqIH``xHl;|Yg%U1c+!a+%bGE&c z-zRx%ZD_r(u>IUHyuLQ<7KOt4sQ3}^h5EKVQmuMmdAbaM%*5hWr8|FXrzL_@y`BBt z?i_Kn(>fBfbP%pd;Ds~tZh0jk1u~|$3vVYfqI>=PEN7Is?T7&!9TT1soyhX@p&a)} z*fg_Q)!=Cga*Cci@)|)drGvGmj z)1+^fM75g&aw_VTgQQQHF`Mb?@i7apblP!+4fHNdKwf&(<>is2r4q)|e=Ee}(~;Oy z)9JHS8uQGg`f+?rywu>LgBbcDxfazFtXM_x*^@$y_v1@T%~Yg!Y1x9;clQkWhU1Z@ z3`fXqV8%Zd2P!GZesMU3>GLsvt@xFdG1M4I>dhESl!D(odzmfKWa_1*47b5=MFC%P<|!7J~T=q?~C5wdRa9|o`1zbZX13{W)*&~b+N9R^x)P84xo8h{Oomdn~R60 z`?Spi`c#a#@M=E)Kzy(BunMN6uQtq6e?}CK0tC*;2iC-;Vz*Z9Z-LddN5i<}uSUn~ z(_N@Yh>zi)^{HqVmvJjWX5qyDY;zaN-ct7PK)R*jrm76$j7{R4QsyK50C41#lVhhA zOXGhD6!ppL7lq>EV>ClhX0UNzE~l?M&O6oe z4EYpG_{>T{jEDtzDwVtZ^4Cs{-%~ics=v4Y(rT9teD(x?(_9(xatZqd=X;!QaHQN-wZbv zpj7H~O8*=mgM+uK<}M+a@c~isW#O=w?>W|+cO@btQa_33Vu4FCPr0_*ZPCz{{v-C$ zU~6+9 z#^>8q?Ia?_8wrZ-p7Cj0GU@rua}VP>V}V6S!&!jP5T$Ir{uY`eY)`9rfKQb0+Wpxt)+RndbCJ%x$5ku+>uJl0vUiTun@;Rd@2F!v14n4QsK^yc8B`4Z6A@abT4T>uv?yMfC z3$!VZiQn~D?%bU#QGCK=Lm^nct?%wS$7jYHt;xDqbMBO86JDt{aZWMoaD>`n7J`@E78L~s8dU0|lZXWUH z_|0!gexc}iPgYW+5f2#XNpK1|)wdTcs|oGvLwq&YCStKH-A-C&OK|g%^`YlOq4tP^ zIb(!Mc1LZkT2iNN{!nJ+h3__-YT}H<03fF6f85Wg6$<(-vBrYr;vDOE%GLniTki)K zwRhdue3*J>Yecn;J(hUxk45Bfig9@Y?NoQ}8Gj}A3RlcCblD-aq zaJ*UTtPx#ZeVqEK89d_F7fPZFyM2Kc`*l{ixq!jHsYAFD&s}xf~VS zc^@I<=2+o+X-!l4W;WV!jdb%cYUB*>Im9byf7+^}1lYdTi8Nm7wC$J^xBSk_i&dVi`V=rNe;VRJD%bx5`}AZA*nNGYBW5&FeBUhSvFJ=mm@bX zrFbyp-_ozp!;br}Z{d6zb=sj=BV5Ti&v#O=*}?hUPkQRwpe1^Hl#JN!^#Og|h z(kA6vOGPNTheertI2pQ-85ov9edOpNkb_7h9$S0{9ZsU2^d4OLOtIZjO1UoUqcHXS zfJ#Hg?V60Zx}9NM=54^v63yiqcJEH787~{BihyKR{On|Hw8 zX*si;F_Wzf6j?Z{+S+`iq6>0#{U+;DX{WufIBv8`_^mg%#aIy5A;kK(lZ>7^6FIm( zP#fha|7UgsW=KKy2)4n972qM9e#zzPvh?~qcvaeFzBZpq^wW;*oUb;uhdxP;9QQ52cROuzA^36o$O6=Cb z$EwBkbVS2N1N(E3*SM|tQk93q#Fk~PosIO#KNvdXNxx`jjte=fTlU~F2rfj*;81Jd%Gx$w6ESUbb2nl1BEyv(R| zw}amai?YBswBa}I@=%!`JA^5>LZ58l@ivEevgwznObRH*rFjd_4wmP3mJ zYMmZydiE3Pasjp&toF00=FO7rA7$`Tu@{F)6}%wGH!fw9P4FDT*V>uc@$~@{UDQ?b zpj=%~Mx)CW;R0J4@R5|XzB{dm$wK1JT1947uLe47uEgrP%;qMbvyuZ$z1?ubc!xLA zo16BEmt1UojL4=3`|k0C=otR~it~G2U-`#1Ja&fdk1wWlc?rRi^M%)H<2cOqeI)kV z-JpOa5&<#*9wHWhyU8vTwVgJNA!^y@DXVulPS`Pd8GPh4BAQcNJh)gGm8rwj%H6l! zO{M0eOAna-*uTAhPn32X*j5030wkH{s0uf(VoaF5TwkEdXMfa7rxAO(`lz}QjKlC0 z?KCk!&L~n;kGXCoIz~28=Ru4>pY>ayJa;bxV!Xqs{!BPly``DV$jy^{iGcO4517-f zf{7#2L#LlncG{z?KV|BZbEvmsQF634>qXpcrxYrZ z=?z=$U78uy)j#q>On7Zzfsn`IZM9ePK>=`I56Ywbj&`U25TczXT?@TiBkB{H-I`LN z9q+j7j~~=Z5SJb656pCD?Q|Yd?$6*%tldBS#SuL=?y^%PDijsZlkQO5zeVu1sc4m0H^;Nb3z&H5rS5cH1_z$~+D({j#xzdx*qUR+ z+Cklqt~dr+YhlS?z^p)~<+)leqT$bkw!tNbevf+~6Q`mm2RHX!>TDFmd*TxK`%|=g z!X!&}J}1^7n4Y;`u&H~l7+hHOxVcSguDK>u_QdM&s|rNf)?Y6+&(tLG?!3uFv<$6& zI)WAx33`0tuVdCUlMH7O3`HOc;I8lW5=z&`$jV$6Mke3}_t&>y#5dHy2J}=Cx94+G z{iWv!OLIMb*@ zgstlr(D^Ep=C<=CUkM!-d!+ER5r+j{X8u-9yVfu<=OP-4^d2)Jm0x>EWv#B*d`LcS z)M1q{0bj~h?Ds07z?^Ou*ne?P_M>iZ>go@Wi| zuDzww@fypQsa)4|RDcX8JoL@39m##fpMQ`V&}-T`c>U$D(n{dDrm}%Sdpi#gooA@+ z_y;R)Uk|H4A|TV+{C&pkF!|B;Ox{PtfWE>maVqwrlf?sVxfCAX z{@vw+4cvZ+6OuL7fZ_6pSqNNJq8 zDvGH`mU=eBTbu1#c2b7d2R4jGRW0y^Bc?jK+URzFs@9}ks&9Wx%Im=wKRuWth_jv7 z)(FbFYLkSyuuwD7;GZw%G`;=p<5gb?X(yx8>RARt$d`Hj6v1MUcrSpEzR`z@2)RcT z+RB{js-7Z!Mr}_kSdZb-n9hpOfh^Uy>TXUmTN0Zfy_~^>K;<^35XPyW?QN>Fr8{co zVGnW^q@O;sR9V}PI*WvZwVe6+pywBB@l){bxHZ@VPj$2N$jNaQ(tv=0tI7V;*+ot& z(U>N_*b1^*b5gu2!wWyEi& ziWUl{%$?bt3++v9&HAD*A(q{|39vYVF1ejV+}#nA9^AiQv@c`HbjQ?2;B|f@a1Qx& zG(v*L8!-KTYDqR6V)3Gpb+6M2_P2zxvB~rwh3-(S{g_W}Xt*Tl=-S&EQG%+JBu#t| z^{*cA+&#@fkcU|HS$^<<)j&h+8`q&VraL}a)6-au_?9WwYY{J& zj%N~W#EcQYj;89jFPJC$7xguy1H{WbMc@eRu%; zKw63CjCM0=dZ+QaCqD`JHsy@13XSS@5^0Ds4s?>w0><#q`%IO}Vq#w)KBofa`7!OK73D%R{@9N%9C8z_O(S z7|y3e4M=SZfxNhfBf)s}wDq|X+v@UCEqkpiZGAcR^Hp0vVOA!JciY=h1MF`XoG*>ZE1(y$ognbzDP4!S&6wYNjtO<-jx)i%x>DZ_*C&OH(o)4Z=!`+!qxW9IMO{}pbe_+lZUGpuru3Tso0V^4W!cwacOHgIeYrO%VCMMU z-1hDtLTP`Mv7oU@?gHm(Z9W7yePUGfNis|ZLCVdY2_h+ZxxJyA#S#->w?)_6I9QVN z)$Q~TRNC^Of?Txq#Jh%8`_i(CFfHSlmAI6O7q*oyJ}ZHkHI%JEN8tk?}?Wc+@;q|d}@oO94}k{N&!6mP=@;z z$i0g|@?CMdJrIue3}hm7tU;}0p4=uLh!$LV6y-`_Rp zn;kLQJEcXtX`_C*2`}C(Y4};^+$~q!%5&15`;6t2jU;zT-^JvW^&!XWqHa9#HewSK z6ZqW{cJj5>9(L7jfN)R5$<|HmC{{;``BGBC--r&hg!A7aC_UESj~Q5U1yyLXX;Rmg z;*08XPyb+yl$D?2N_pYswy=%rClE-P98tXbD~9e-bc+d-OX=9=skaVM#L*A|{g9qn|Mrbf4n z&j=s)iM?A;#sv0dn2S)n7F(jeWbL?lyFawuxUK#_~sfwfl47@MXn3Gs6pTUzwl- z9j{@NR*vL!ELMA;-gjs&W^+w<$!l-DNe(6{f}B2Ld6?79d-^oK_XvbNSNyAZ8!d{A zbvwDwpJBZnb6PYe)%U$0l1Fl5$j@Yq7z-B<&77@y@VQz#YmzMxH2)-vC%vxmVQSi{ zc)#>c1BEJ&H|1w(n;kel`IQBE%s(@WK{8vu&$795Z%hSLKyef z1qY$T=tQK1)1S@fUVFVWgJ-O!m$RETcA6YGc=MmZ?0jH9-*KFrg?jQwHs-=Du_qFy z8*7xkya7fX-NBh9d!*(Gl-9e!N@rWN2;cF#>58*`(Gste*ldfn+8NU&pP`v_ksYDmFMK}Q+raGfA(3a(bvh4$ zpr6K`zsAwjcou_|p!`#PQW|no&=S?OmJ>+?S4Rsk8o25A9es0xDiFd2bAMkHKie@f2&V}sNuC8E7cSD`X&_xtx_`-|n z!&a25RDVv5qK@8WjrE;EspU3fi%G_EeEqbbcS?Byv~rN4oxrHSTY!Y#$iE3`ky#>+ za&9zhM`2VzC(?1-x*>|%ehRn8L=t|^`+MOPB|gs6@~a-VMRYD-*?$x7 zgWFA7SI zM{NYNuX6f4Ub_yy?sHFvTZ91G;Iy+v?7egwTtTPXwZVb3i48Sh4(63e(t%9s;QAp_ zO7e3i_V(*1nL_&C_6V)>MQ1_D6}Kh=%1rw$O*Ya~;!$!VGG!zY*!&$JS{W~^c=?fX zN+N@ADOsG#1BT1y8jL~&WizU=66p(e6l(*lI@w!J85oZ~W2ETe%FlxeGk%M%Lk2Pl zv+v{)rgOZ^R&vi!bu$|ox8J}WmvDDn%h?_W-E;h83ZW1m`I;U-tiVLVuhmn^sqshS zrUla{ufDID0Su8Jxd;eWKh@?~y3ly(p7fWFZS8HucwiLTnRswat6&{#5g(iDLF3Llw zA*_2*Oc&bjhpImnic@q~Z_H#WbFf9#Y(F9r3PiBLE3^Jnw=sIp^+O9ahd zA0#XT&p`96Wax}F($h|EZ~KbgTayZNIm~0wiEesooF$v8E|X$y_1ze#bx!RH1d{S}uq3cJ zG>{L`;)WN8jYv)>>jUE={G{>?FXKMxQCW%IumC+o-srteVVxX-boNYFF$?J#hC96BzFv_?1!CpqgS=tna0?~G4dcsDC3akF?kA%j za$1(&t=UR9^@^xAY!5sQUdRr~g1Y&$Phh9RCU!oP7Z?UOwGTm8}Z*Txi zpJPp4GOHMm(1#l-3uO=6Y3QL)*m7~dbMm&_x?kSfm1VPKLV#}t<+V3@=B^(~lM-j8 zMw~f6SEL1+phppR_o+M!rII3SM!z%xkAwS z`c>qygzXcXsVT%vqPc|o^+qzm>znX-yM>Hye`)hV6x!bqT80DE!*Nj_>VP@KE^ur4 zO_f(_Z%E#1R_#MnATQ^;x}6m1bK3Kymml76tUXL)zgm<)$m;i(u6b;YU4O#ucAFc5 zi%+0F%YzJ5`#U`k-TGW5o!XmH(3epzCo|;1(qzMP^r|`s;z43w5)3wcXs;T;MlLxy zLbYQ^77wWe>NMvk?-jyk$Tc8D>B=GUvGC-L^>)Z z9R@{jpT@HsdL@U0Kpn22YbYvBSSOpbv**V)r1fb;GdH&^hd7B-=gC^Sc0H|AwZ;Rb z$VA*~9Gl~jiNBwy0^^bHcm$TAYXyRn_Z8STj2A1fV*H;FL`((#l!9&=;wRS6G72;(S7-nW zY!KmmCUNDUdhyUDuzw)IgdOgY8L`>WERYuYgVc~8e@ILkFv_LB99h92J({Eafs1GA zykmj+8#39A2926z=sT3Fk|=W&Yo|?R^!mGFA)fDKNBZ|I=`{GM zxa7A9=?_KZ2m$dB@~S|{`*%2fjdOWHasRuQTpBCx)rsI^Y~_isKv_+IIR0?NK(2h0 zw+z})q5wKJZX;zNR33-1GaL_dWiebg8Tz2lu<yAf_I4c1L`yoIqk$GI2H|5-v~sQwLLm1lE(;)ZjV>sc!Vwt>Gq-DKap;2kv$rm7oJ*CS zCevY5gk2bsLGZdDxPhhy*m){6DeBA{^5z6WT2)mJb}@Z%Q4-RKyeg3F;EHrBZWEkN zM6{f|MsodtsjdNSrjO8%ssj}=!dUv-*9J<3v0|Z{Jw{1=%IR8x+()07@;nPCp;iPJ zU0&FT(T5l9N`j_5v><4+br}}cf9nj|?e9}pXP+Vw}q5Ul;UG!WM)L^>@>tYg^@dj!=xJy9slqNw9&AN}#v6S%l68xFi!g1h=|5zUw!f1>IlH9v+ z{@RL!y7ftz=eA>!1ogZ3zT8dd{)=F+3V;%ugf|x;_Ff?GoqqC$Cc8bk;$EM*KUi(z zP4c9uh*N8^~&%1UK-=t4dQx9CfMKzyqfVIn7$quKm--IfCL>7 zKwH6>^?RBlCt*;6VFu0@KmwWI>ey`0jVXKF$g8g`{<--z8Rd~CWsGoJ--_M61vMa0 zps!<`v;pPPtIWZ85j6dWCTs1?a>H(UjbSJmsO;CH%SRfq)Fz8H@&m_B;xgBHy(@Af z=m~=RNHj@i{hfTcnyOCu!gK_{hMZIeEkiSz=H8#)CP7P%clB&3lq5y~a7L!vqLmr<~bV?oBu@T&B zU%F-rw~Z+?$}jp;#8F#e<}_yx7uY7hBR8ENpxIs6>yay@v7P;n&~H$|sVxN@ZP+~? z{V*oKlb%b;uCjSdwR;2VbW=dFzV|}jbHNo*rJG1)_D$7ASnaO*ojVLOSirIjKbdlX z{Zcn68%KiP#?7^AS7y+^qB#m2m5kj)<52j(vZjjO}M1~^Y#mR za9j2y+l&uh>W9tvCn2^TgV>sL8@=U^GV`i$(w~%Zu!D%1(Ka!Y{wqaN%TBcWtt+&k ze;(Utrk+eRsEkS}xB(PVl!cXQ6~VAdbobgabO{Gf%bnSxP?X6nG=?*^GzNHoRS$gM+ML6_wRMSuY-D= zp_VO+a{>?67DnWe={n3(xB$3u@O!cF*j)=~9N#Y8v(LL3kKANe~ zhl@o4xV3>9$v1#h{Fi_SX(Ha`@LSm>F9}7Purk}QoUO+@hz(rl&yKyRjmT=LV6>Sc zdFdEiYE)hVy^Lw%u=#l?@I$|cI*+3CtvG*^JMI+gvDF_?lT%@_58Y9e1b232v8;i^ zRLrKE$^6QrbM5-)Ulcr0Rb*@0pW!<1HglhFgXK3TMcWE1baf&+v%dkk)_=ipM16Lmu)^H|$ni7w`14X9)|sJo2GF&7|RabTQEwsmo+`K@W9VMny+T zcW;6#0Y0LWY?Cf~YXZtYOGAd{!vfpyEv8?7Ez+E34ND1LswEpt5c7yPX}OW!f$;Dk z%$DCgv%hz!+Ge0=6D+Yl1vfAimmy`9U2u}0oxB*p=VLLyekD)M4jOJ5bOaD&p8o@G zFEP#D`VcsacaXHoIKH`s8~aNp;o#B4M;7GF{dKO;EMA{Gz;kgklR^u)OL|sHaPjn$!CRlHmWt4}brMmW>`0sq=2PD!h29ESsB%1y=3!PQK zX$$I6=8{u*oj^kGTZ&cT2d}VIGerGTBPL^_0c8lYi`X>_LD1?YKsJlWWTpOY}?TSOiC4!{(XQ3xH{6J*Axo}9Cb5Y zs}%)tQZPME!kFuW?BN7`;y_auzt3%uPc@su`Zix7_@$Ly9si(Ca=EV?DbUw#_HjU=L35g+83`_WRV{ijZe4Q==^nLJxf&Fjb}m3!>@-(@xK29i zflcuz3)Fxm2+_K6W18kM!#+72)#X^$;qp8-BSkV-IhhhShgYA68~>FOw;uo@X_7I1T7TLr$j~8WGWX^gNuEgGcT9rl%JpcJP(O(BO<=M$42ABE+ zuW8)R*4dNDTida7Htl|q%_)^K?mba3i{9I5oBXo0X>B&SUrr%gld)f1BRD_cu4@`;a zY>TeLPB~NN9TdePCM0Q|m z)$2BA80$Sz^E3S%A>?XO-!4ZXsl*>6bE?m*K4>?ndeq-j$9{V9N}U1LHO+;wj;D7& z-Y+3n4fi(lvaV;b+Buq7#=V5UF6l@WL7e$Njyo8epf#4WJ$b9

d(w5}BKBAr{wrzd*>V2kjkOcueVOl_vEG7B`N4Za1mCi(JQ%LO+x) z%LR9-%EYJbi4B+g3doS`-R7O*pvV_RJrqJ5OdESQfTD`J#BM0KqyhJzYj9Hzi)*V+ zQsQ7*WRRPUa@%~69fxsu%hu73Axia1W%*`_K$=_%SsqVha1e;XXeY0{>-Afl9cWp` zFLGLR6_yO&!Eme#NaHT$7SWuHR530WMC?oHYTF&q#irR1=tF|?>c8`IaU=CoyQk5y z53)!V^j~dfJ|m=JM)=|lZEL9_h{rbcmxX6S^E#T+h*)vU)5%Y=rs>LXi0MdAj+;g_ zHbAWxkp=)R9Ql=@cuW#4-F&$w`aZn;mEq*qrR{<3=Ji%L@2@h$=bf*iizq`T$c+lU z-#jn$-9e5Hx;4^V$q)gj>K;sv|ER6*I0!Z{@2aW?q*5s zf2}mM{vi=ehVF*WFp)fM{{lXbzVRD8bDVgO!5_U!PvtQb0iTC-6&YjZFiREH&Ata| zpVbDt$IqDJ;k=GlFWlYtk?P^{0<9|b{>rGhY7OGRM5p0uWYuMKvsP%Tr!MuZD%G?l zNORl)8;V;h%00!|mQ`ixU2dR|)55;)x|`wxtRb%hQ=H_>?70-hGvAy_MdHnA#)H3K zNXFGZ$_VZy(2t&wX+W2kXWY>9mbl3;svhjJ3c`Z-xfx$Z3+_-n{^Fp2Ufq%M(2F?_ zEJn{t7Q4t1^5(;{5jBDvNn>-kNb!-=0w9Teg?z-oHwq*Xf{mN<8_Ep!UW2rY^!AFt zd5LJ;Sw#WOb>Fr{t8eMy!4b$g5We*^*vv&(KaYt^{%Y5bw^v%F9TA4qN&?D(Ovuh% zJVI{BTpx8A;_JC`Q>A+|LX)W`Y26>c8*!nx=g2m} zFyLMcUs`9y1+U>Ab2e)?m!4WFy1aV%c$ZbR5t`6cM&5wTEw_$q7P05>Be0*nwWHiX zokHdJpk&G`N^mSHr0Jcsc@|y|6?#QecE!+z6TN+W@9Hz>R)ln@Ehf^(bGoa6T8(*^ zu?ZX*n<<;(#0h7-64ySflSayLE70`aJi}h!SbBKipWj^4r+EukArBw^jACTAxA_VQ z1rZ$m*ALybeMdokP2ly2!F#`iX#1k)8y{CkYkiI{f^JasB}&H>go-j_-(Wx$&Q-cX z%(jB%xkyC`jzc!S*Ed|?WrRpw0PYdr#~<^cV7_J&-RN@WLOpv{7^ciI%c%q~Kl;$=XhFra8o)6=!PA9?H;(!a>+DVmkX33cXTQb%j7u^DHCqtk}cyodMDFAfuv zE#Pp4R75RwCO!6#oNLwPZhFkmP!>bC)EPO2m{^akqz&t`AbGIoy-Jw)B--9}JSt^7 zivng*P%$BOZu09<)EuVXIp{~>CVlE$ktt0q?7nTSCix7Z!ctwY`QTe{;Lc&>EeS%1 z-dy&NQc$hM_?q3PyHO~VVP?CWYv2~*0c>KV31&Lq|7K3(ywCYLHnbv?&OaT&;f+1- z>`iLT?Xpx^RC>aCwl011nD2wD?yx*MZmHEKQKmY2J0FG#>Pg_!v`s4(U|*2K3*nw! zpxft{4L}1Mz&2!d^G~R*v-bi|%pp@c8mu~a%WN=t{yH&W;++SnD==}Gui{Hwc+Cn$ zG_x*NUSs1dWuWVe_f{Y$_qgGqz1{oNuK1xC?3QmMVz2n~sC7m@n+=0ckCbjhP+hpu z$LNGxi96PBlUk%}D_vU5R-jr%Ex=$?nh^lU4sWXPtGuq5gBR&9=hWaCXTwC6#JJpN zIPzJBnRlsUFTOtN)LDtXawf-qSPzRFFX_aOVG(bM%eYV}7|Tg5Yn@D$#od(}zd;R& z>+j2s(@!csb0gF_i{`CrKbc>(LWZ*N2MsBq?joLPqzs=92YcsklL<)MMtFBO9U8RaS>|ZRt4`Q$z7o@;`Pm(8* zDdaQZSC19xiDohu8;r)_>*feBpCDrWC5Cxoz;Gk`QXiwl^#_Vq1DTGLcWPOshY;7w zmrfiUtMy1oFBQbiJqgWwXW}i5F7Lc@AsbADpJApo$*AW4eiE204FIA_@~I$SG)^vo zPgXG!6aOI{m%+kJLD-0~(Ygzrty}iTdop&Fok3?cihS^>N#K@(sed8-f9!qrTa;bb zwvM2Lq9`RuE8U1R3@V|5bT^`ufOLZ+jXk&Mf zL2EkPk=S{B-r&F#%sfsGDIrn4O%YV`b(Fh3IgV+zEzuaa!Pz+uUYX4p7H20c zV&fJscy%r0gR5}(!7g$hFR`1z^+f9YLWbxMr_d5xxZrAm^WtGv5nK4ID zWozUGy?@bwiWO8{5QLob9`BWBdD(jw9ny=}S6%$t0pNP7K0?w!@+0BBbbyMg-c?nV z9q$165#Z23t%dbXB~J9T{R}?m5~JIF`S#d$mHa1_`WOqt$_0)JG7op{0q}wjhPlTe0V#?ZxEq%mQzB4fC}R*2KNhb}cV0L+N%AwB zeNhZNTplcKmreD|Z8{!*xIvy}^s@B_H&r9i$i{fQ)8!cr%Ii~0EmJXUW;2{Zcn>2^ z^3+JqjH5PszBM+3&J_NNN_pl*_*?aj=CcIxV2=em!arT|*@y+)m!;pbY>{jy11W#5 zL#|;8Pz%SC4vc`?LIn|*TejydA9i6cw48AdG&cni{JCD3h|rYT;!@1;LjJy7=NU1? ze}_9v%(iI{qeAp&l0v+s?SkMBr^-|X_nqt&#hP_%v4(u76UaNKdvIC22#S&unU&NM zcyAPeOx7ByFN+v%A&4 zFyT8j8-e5imm&B_?eb2o7Ru0dLwMmv^b$aIl8Ccay8OH5x`sp)#8*3S41AWsrI}jK zN;q(!GpoJSQj5BaWO=W7a0MY_YueSa?Iq6}`bg1BH)f@rR(0N@VxA7><||6Osngj5 za|^a}8O*_z=^&8z8e8&v>};SQoJCAm>?OoL?s?HZ_Y48f0>e8J%{Z=D zWs*RL<N$vR*$26BRVHvcQ;Zo68X9=^N@ZHt?C|_uurWFVy#e*%NlyQ?@miqd2j~B z|3!OV7Cjmr)&ze(NIF%0tE#7E`Yqr9s#^XRbYQNSdYm$DrQ3n6)BAM6nn_(xy*rmn zeoc6rq$?D?(XS}jGr$oj&7tBMcFADUDHWEVHh!#;DZUy2*{8UF+;rB5&DISX9n$s) zaJR|en_oilI!nC`HsA&u-?97V4p=jVpMU7UN6SChl9YEU_r-VArc*>sgsx=_`zE@% zpm)b*mn}_qILF663$y3ldn@fc=8Ush$@pYd=5%5nsa#|`)O6Bo4YhlE+#Pitv>}l= z=BxLq_TiO8JqNWju`{)A8)Snq_Jf54ot55b$yyPPGmyRnNoSnhT35~8e=Z?D;gN99 zDV$g2h^l7vs2KQy^k7p?j}r`p2O+TQ$mRW}Gvj@o=Lt0MZFp$|TWUKnN zIgUYk@p)CU1vY6HTs*z(&p<6bWI8owwYjlY-PXKXNK*6Bd)~;(z=cmyoxDxA!0`JX zb(iz{*Ms~N&2gxnJwF3lY_zj4*lP?322|);sJm{IcSuf959)Ja>tg;Vf{-CC(KYi; zi8YPneRY|wLN;(<3c+lqixXxC_%BH~$ z^1~K=Q<^6(X<927MepsXcwREb;yO^L8B?Y`9awReEkl#ei;|)0yp^dN!_*zCVFk_= zZEYsy#9GCTt}Ac3Ke)`dT1^dxwsX76N9akAm$zxVqVT2*_NU^WJ(Lj33?6lDqLEoJ zEs7!3-<4b|PJt@r_jWXJOp6QHAfmA`+o_xE+t<}`DfpQ=gbsN*+$dQ_nt zC7RUHLglot3@AY8w%iwzcK+nzX-V3uZ=~CS`0hT~nlJ3r93w6vaPfBCFN8DAy#(i? z98zbru_5fBNkiGdbdcjM#0T3f8Y}Kn-&)kX#mAkIZ6_J2jGV$Z?tT7xtM}?WZocBI zJ0MvUUoyxTvr|m__HL7Bs7>@^NZlMJqW%uR!q&%Lm3bRjivaq7VhDy`_1Fwe1f3l? z5-)lNRy&B|-}$I}C!o`lSfcy71R_8bk$8SS+nT*EB&`Gt()`Xs$$X=6Tz$&1iZpN0 z`&aedNvtOa?d3>SlR1G+6_N=G#RUDBPNeE};?pAm70mHxiy^}go#+Aal+8KgM+W)9 zn)7=YhFEmy^9n{^WAz!lS^ZF>jPy|YT9ljR zB%V!dRoqdv%p*b6an-+>we`p)!ZGQo_e$2cL-f@~U8s0ODmLuYm;a^f(F9F`f2p+) zzi@JQi|nQ~BdEoe0ochKbzsnlcsyu!>77F>U`fs5*_L7(`{~IXqx9-NR>N(sC9N!>_m={-0d#9=E5cEN-wKLYfHbzHO7j_ZEwgD zsJeH(3LD**gEb!r5>AHT7?z;Kl6`e{-@^WwzJ0~zg)`q7kr!0W#>`~$7q4(ulTkt; z7Ga_#co%O%#7lEbj_p8CU}n9y!`W-kl#6{RTq*kX;Z5_q$r4nJGpNRE!dsC(W#e7Uk?UfvUQ8##S6O^{u00^H2p!%(=DEd7utI`axWG)Ff2(~o z;MA)6I?tZH^dX~>rgethv`uD!=7#Czy4otoLu5qW?}fJ$TrYFFt_0sCbjJvaT-yRE zi4dF>4pF zqPP}O8J=q0uZ)6r28woD7b^L8Uv53G))k`N36pr0R;y zEOMJ297tEw9AD2hPR)`<383mAI+K_6e||DId6KTaY`HMQrY`@dlH2GE#|B*_!n4#z z)ox(m!JfIU?UHw;%JdnMr@Nf}T3V_;m;C3T!=Mmka27$UjV{ip4`I%X?J1UVGOBNNN;l)s3vO^x3ClKM+Sgo;HDob zOwJC!J7$R7{K-6B!s40#BAU=L#Fs#N^QiyjoE|2o`$vGF-T;>&YJz6}t9;s~@W94i zj?;R(UB3INmuvY&B3WBpsrsH6AKA%=9;ebpw8+s5d#r+vPfT3Azq^CkhM(A z_VBXNq{iuP^R=i~Q)VMK!gfe2>yPON@Ad~j|< zlgT_q?N!$S8t3Kj7xVWin^8ydr{ebZe8B*=85}0S@s#lKmlQD1Rq*p&*R3-Z$`Jme z_T9nki_bNCA~chADS6)|!uA>sS~Q8YS`OM)R-0XLh2l|zo4$@Uqb{mOd7v_$*#142 z&69j%!Q_7Z_I#@N@|~1ED+zMN&tAiITPnC1le_-kghFl#na&AZJnx;Y#V09Af1>Wv z>&AKoo6PtP@Q1v=p1&-eS@}HOh^2Ljw|e(duvBQ-O$QCbyOKAvHd_v6#*CZZPq8cs zQeI$qI=CebvZkl1!+*BXC89|qT`zX3i=T=qKUE*et>s1UNy$u}Fe{=?g!i`2Y;IEC zauviywXIG`7we?fULFXG*UF?b*r!evnEt@uHag&g*8%_{3}IdhX7bUFQ*v$>OK;J%^b z&_DNb^7Fhai>u(piDRwE`nZ(ofwOn;^5C*u##r|hGqs*O!rm-^{$AI+LRD;B0>Z|+ z>tH+b#K9$rPTWhMP)omu^TV<-yB0ohfd-QV3r%)%g6mnatyFuZW1r@>srFyv%}NW- z?e)J1TrNX@{vr9@m=Tm=3KMHn9 zQX+wk*I`+Cyo<{t0GBCn6ZADpQni(wxJPE4!|?vVy;zLa;Lq?U7`f9%wF5{t^SEmM z$+2NivE5xwUI8&7-Yp7zttUO~2rw%V02ng#@m?6%3~~gG68TM42U6eto)xVN!PptM zxK_E;TbuSa?EB&X*_q}W*N%tbiN>ljOa?@=Ndm9yk*|0&Dv<{=Jwwt!Umd3Is9nys zXh|acEmjj#=7UWo^Z0^V*t=Va&)+x3OhuT91 zbR!zdbTAiT^I`T+Y4`0VWn!~BTV9Pn#%)=hA+_+xT!{>(cuE8#;Z^8~9Ftx`G9m6D z68m(CR?a+Fs=oMy{e4*(@QgeCD1p1;g%jkB!(w@U#aT$;L3h|X#ADRp(Nu&Xl?nx3v}=wVH3zjyfvh<4|WTR+>mB+5tWw-v-LecQZQ{b7A1|oN?VCt!O0B|(q3;>G zwjGJ)6?IP?*z{z7Fq8BidqMkV5HvLz{)`EQd%&`Moz-zR?dd57OviU@O6S8a3?hAB zpL$@}3>*S2(uCA*W&9!!ti*fB!DHp5J77&!PY?RsjFNCknza^@wrfD|alczVw_9JU zLAOZCRzCAN4sN;I2kM0ee|C~g;9K|I@a&^UZ(28N;u>uIn6%k z5|$Mv?|`km1r^9L--pU68*yPMmJnr)J(&AqL7L0=`R+*p9iL3vlbvC6s%uBNd@#@E z1)c=%Ysd1#)JGf#K8hclq%mTogB=vzb~tOF7+nwgNt);DYs~h~=Pb%?W9%u{UClqZ zLKr4T8QdVH>|SSS%jOK=gh&eBmVV89h984kkR8)9keS=I)ucRK1-?nvb91 z3sB$!`;yS~-jI0e^#k`Q{|)3q^sM!)c+S?Bc$)SjNHGWJ~1&Wyg*20Yve z**3`BqU&?utq9<~5dL%l9JJADM$t~Y_DtQSHq5H-t&B?$)uy=O<>Z5XZ8c}=P-C>F zGs=miEv{(ZXw~Z~dIe`|n`&puPIZJmQjS;oyA^cKKxk6us0jt zXKqCaT%|@4ybyHuh3@)S?|M6Zqnt`WG3uylB;+Jss?lmST`+bWDI6>yt(+PS}8bD?xY*c+uirz@J#79PI@64 z2%!;wI0lTRmsyOIr5CK-atW*lKTC8^glgU4Q;c9|D0}lzz-NI>01SwaAQH*HSDQ;@ zCNlL4C=a@KnLyy$8GP8TymK|a23`*)q{*XWF?#D^XmHd}Ppgx5~0M#Th&q3sp zdiRy0&PMdPQ)Axf1ulH^9tEJ_8Z4^}1gsuz;uNpvqS+(dT}&P(KerOEyK^TDP(~70 zyZL18hxjS8e{f@thiG6@mB9{?5f%W6-!VMT`o1v1Bd5R<>EnSW&Q+zsc?TNARov}O z6K$J}+>b?iIc~4ZHedE`yKB^pRpyj4Gl56EOK$9T6J>Hg2N}$#t-@Gd$xKkDpAg@P z4<-W-Ax65s;OldJ>U8)rYvAgVc#%UcU~tZ6iPf4c zs!l4poj|=@3}GT^9Tj<@R&!1nZE)L<6Rn?+f5{F?!35V?X=x1Gx=(KXR0Lx)R|6e2 z$}dB)9xoNj+w|Z!mA(3;obYt2y{WjQ8L<%O)^ho1tjr15jt%t(mr;{CGJt*z6kQJk zFp9KMr3nSA{yKHHz1t$T{W=?9{nl4_ z^7)=eP{qb}yo(zOY2qNXe&%K5<)78%%|iSnEa$CyzHbbBf9B!4?}1ln36J6~A+&Mc za0YxX^HXn6o+lE5IJN%==El>b3!hTTQgiW&TNl!VbKiQ4BSB1IHknZ#*Iu3!WVz#2 zF?w*VNcj>diTvz89QO46O-+uQBaW73MY_GmAo0**HwZEKI^} zyjUsz1V6_S%`jVBL!B=72o|2;oY*tT<`=_>CQ#IGWiqu*C#CoGiKgdSmn(0voPTyd zdg5z*)xZ;q$&H9$X##Q=1^ZF@x>_82QBmorQAEH zfE#`1`3Y`kguW3uPY*NCl&N63Cl?*@%ZJ^M_}#K69J%6lnYUPkQ*ja*g(nj3iHxuH zYw1nD;ZCwH|8lznA%s%r|Mv97sUZI(|KyU+FGa(3+S?1dkWbb z`dc#s=<`>nBkNm~9%KISDqODT6G;+W<1sZGTL0yfcspgXl zmdaG`1^n@*j=VF}9D)n8@Q(Ee^ZvvbR9|Nl)-jcw?<`v9$((X~>0{%l@J7(P)ycF{ z^~1GE7~gFdGZ9tT=JkLWFxgUcXEYaQ_r<+rG4OM+RY6O4%(AIXb>bat^Y9RtmKxUNg&Jl_zS7zg~{s6%~It~I-hJeBAaBv zuageW14Y)XxCUWYF&_t6!$goLuT=j@oZo^-;k)qVmITc5Okp_gjDWYAXXjN_9(`BS z!S44R^gI0WGnmDBdSpJ5&0_dmE_(FGL9iCdyt1DE{=2wPWkDbhh0IFU`nC;(`)ry4 zyrJLOf0kGN z0o_+Y(wHR31w_D=TikYEzEN0mTib_e*!s}D6Dj3Fof((f)LA9Aa#?4ww`LA+esRP! zBZrr-j91{kl$|1NR@V9_Y=p|o#acuZ6ipB#x=^7)A}2e-Iwx$Nw~PF-Cajp}GCs;* zIq%~oL_Y3<*IFgZ)xK8$cSFp-9(+&wlufnCHx_%k=d3n)7GWc3L9?JFZ!Oqf=1Ef8d)HMiLv;?op z`E?HxFhbk_OvI?nvie{QeQ5pm2-?3o>1cZL!|g0i?}XGBlJ&a8&ZkZHpT!s?Q!B@K zdsjXCjY>0LllF9c6k3-jW4D2fDtB$Rd!^0_^-x-q$O%TF6Fqqi2ij*mTSc)44`h;t z_aA$UW-{@*Y}ZY0x#=`Nz1#zN6|S?xte+Eyp$CS394w#VI<+VT zG^rh0lu)z0JnUicC4@g=o$zRUS$C^VKqu?cJ0NO+nd7VAmG~!+O)YG!3!BvVI_hT- zPn$()-8?8SXmX-C)f}#ok@us+MKX(guJy*nZug(S@=NfV?M1Ji(e+8)GKs?2F_FD} zss8mfOjhvYL@#a>*X*kT3-#f$1iuOG(879&osqXf(RHhqf|fwyLkZIpw9+C@90na; zz4j@bqsA7{@#B;5Q-gdI_(CDWX>?j7Pr`c1xSC1LcFfqOeU_}7VOT(kzG3o|`R47V zVz^E*LzkQ8&zcP;e6z4F=W0=bBmjaFPIw802y}n$4Q5P9*?7xQJ(!El0}6%OQGw9kCJQ&8+pD^vG3Pcyn|~p%k^NreO8D_ zS3Kn8-mrxI-f0jDGFaz$AupX52_A)pJHL9(^%yHfG(d{ncJKYQX91Y?Q5vKI<8r^H z!^Mb%NW&5fa?x>`7=~Q0CFBqwG{9>WI#ZUcL-2@O3{vNL7 z-J~l1I&c4dtir6ty}!FcrVjOfGlfl_i|sIw44U5}UQ}F)YIfJV5BIsH6%LP|;wp?z zB+HTuYYX5LXY!~{ZCA(klMR#dh-}uX>_eDa9(a<@q&TJQd$<{H(3Y6mOvl~v2FgdY zH+~>Qr}&SB^Y0?67}q7_#=LIdacx=`+U~}t%aU&Kh!owKO#ckY`*UC#*yvNBO-F`M zY+tlHuRU{JdK*^vsU`T;b+eq~NnUmNx)D5iMnDYH^3?I(YfX8YFlu$#uX=74>5~sX z?n6r%jN31UvVFPHGx*qHv8#CzY-_yVKrLy;q}xNnuR#~8ReQ4K=4sUuys#1+PV>*R zu+8q;g2+J3H?N^I>X;0;jvs>!Ez?>^X-8=lF2uGCx`e_3U7@}jDH+{u%mw`vbo-Ztnl4FFZh}4KHb+UI`csgb3H*sKCL;}s*2S* zdYiels&y}o!)31dq`@qAN{W+Mh*~{{#-Ey7hu~W&2yIRV~pCNQ~F86Tj@ z{REG{X6v|}vgm2wRW-YmpCw8)JaIHT+5hU%;IDTJeILkUCKeUZ%nL09wzN)O%(oYL zJR6?%qN=vA43%V@?>3F&gJ#O&@;HCk&iwMNhzoO}!@h(IyhJny1_rQ&Xhg~OJW=;L z`i>mFz_hd*T6yI271#(;PTtj&$Q_!!RdTqv7JcODk(F1Sd_x!|p?`mN?IbI#BDsDM zGo*^|10?J{JO*b&d@N{~-ors)bg8c95KD#6gmZrvlpI2Qpxp!$Ua_~$d%Eid=2u&1 zmVLiRw*E$XP|mmvJ`$-RC4Z&WU|AI>alupLtWB@+7A4?znDps1pU_{3ZO2CnNeDHLLEhzNkgYX4Rl3*P9tX};!(I)Tj z|3rhICvS!KuF6PSfI7V-a+W{`f1cd?y9+Q!tPgf;DX!7{VWQ}4=|mFpIxe)Na7Lh2 zLW|j;hC*7rdv9r5U1)r^HXceA26V~#S`Zau*`2`GsUk3^s2wiHD49iT+I=;p5$MxU z@BIu`k#bk?Z?(y!>fP-oeWAYI?NkSm?L*r16u18|h4e^@Xm9DgPW=EFB%!IiKq0o6 zlR}Aun>hXY8{ZE1d|iqzUXe-=Mvyub`Gko7d$%`!x|_>@K$GYAoRG+-Ydym~z} zSQyVki;&-Fno+H3HWk0&lz7w3!S+?{t2OMCaqxB@r$+np1fB6rc#jftOM!qSwF%4* z^@f-NGdwj7_PS0f*^DaGc~N)*%YOpqF90^zT(+QxmxkBi@0&Dv-N_HC;8+9VRJy8i z8Mt@uK%*VqcK^ugmOz=Hj99J8$w6j zLgq1VuQiCbv!MP8DfqzB+pgl2Ev_1i!8wNy#JsjV>-ql9O7QLQUfsxYcW5tar0R`| zpUmwRh4v?)JBh*P1FY%^;$fAIx|gtv>1*NGe;2>;2N))qOaTLUVIr~6hy;-|W+%=i z)5jtbz5C`9G}Oy5Vf=Ji>%54W3Hqq!1A6_0zj+RRFfB>TY&Raj=|mA=1xELB-b3$s z-^hS#poz3YBYPHd`8fS}4^HbHDjL5-g8-1LANsmE5$NoMbHc8T2h#sMvRoJq=}(aD z`8%DdNZ6dLwd_VgfuHw*vXiIY80{(02+Au6`;&JJM6MR^Twbb>OiU= zj8Yr#_g=Pj{CU%33hl((AHc%-fDxXpI)LLtdYLY#?T-DX8UsCYU=C~Pm0Hs(>FWrj zYX(E#S3o46I1(h`y(dagjC)I~98R6KyCG3mw)6%B1z4%l`T#!`Y{;Ea9{)B{ajWI_ zv0@asGW!`2DkiyR@YzOh5F#?mq{coA$JAJI1yKI@gihR&>c_i{7P97|nO~o*0&D0= zp~asE;RI)oK^J&}D>u(33#$CbBuZ9ylW_MhS?{g3m(zRZ6t8rWL<^(rd0g%iU}Yu) z$USG2;XHI3yHYC)DtGKggy@0Rzq@4ur#}>#du+c^+&+7<6}FyM)1izVJcl~`v2D&N z8`Lj-7vUzmoFTgJ6B5!d`eX$t3GlSG$J48*z1Yt2B+=;I?Dg;6r}LeYx3Jowu?|e) z4uMEAc#;$TZ{Fv&YF^}z4u)1Nzd$Ax`WiC4MAzSyxTsVJs4$NL3L&rd31H<|LN$ik zpA$Q$VWfRFSug*+m;-0yte94I(M!UGgQg-WLFqDdQ$*wQ1j;l{@F%$GV#nvKVaDfd z>f$!_&|qig)L&`e7&R?#?977#>v1YorNyKX6~6^FKaW4AtwU<2Fz=mQ#R-% zY-hxWQWSp;JP_y@HMWTv5fO=Otch z9#o{*4Ows}yw^%U#vJOD>;}4Slv?t!L$|DI-F)9TYw_COV~Z%sfn$aTyrK9Nw|hj+ z0RmAOSf)Pn8t};-qH@T-s0gb=qq*45n?#U{Gl;+Qun;ax}{xYD0MTP71 zRVIISvmg%HY#O-MlVFwq1zM}r0vNlsb*wYi_r-->%r%_#Y&D$G`h=#O#}MvUZ;W3& zh~8m44ZGO)F+8|*0$m5@!T~Sc)Bx{bk!9xWt2D;JwRFd)-lvHjTA`(g_r&gAE7qVj zB0Q|I%l?*c+(qAb?iitkiVYV22f~w&75>yhQ*@EBJ!kLRgedIkKLsF2wz3{JhlnJ& zh_hGw#?}0fcDWGyfKLxRIa`YE!H&$JqCjM1kSnRiY$)ni1zbUz4SQl>E$~){D`*Cw zBu*khy0AmgcIyDG*|}&}*1<{JsVM&y5$pkTczO))4rY=lBi!uJby1=kxeY(ZWuamJ z1MiCv@&{Cb2r=CL=M_bYpB_JN??Pt$nT}|%?a~dwG74ffkA+UKAafulYfwkNeKz4; zF@JtWzFJ!uxs@@A<}c14GS;uzvJ+tHLf2nY1QglOy6|5rVCt0wd*Xbr2GG;ADHv_P zo@p4qtubjxVrdci7*cwG3j%lL<%0i~P@%bKw)E_1urB7!w2hwi!MIMls+jTNifOr9 zhBNU$!SV|?f?tZMEZ)>%W0Ai*ifpALquvYemae?~4(`xJ04L|xY_m7DuKPn4FXI2~ z)&aubNu4i#MJaZO4ha7Fz?gfem0^m;6++VxrtdH&F@wFU!wD8(Wus3BEPy;cPtAyr zKr=DtRMEH?jdGN>&F{)@>t*Dtym1Hf4~P#xHa?|GVqW$H@9Wh8 zGd1KK8UQJ<=ZKm84otg?Dvk5ThQ;U5;k2f3vPrCx1yZO<`0#TlvP8v@k6T))8JFiR zP9giWXH8+`86Jl;FpI2fY*6I*1kz$(St_kq#l>wte*wT4G&}HVd&F^so3Ura2JN_P zjHcLLmW-Z)!qDoKL~hiE_xCD&VE)&|)4jmOu^Q9Ay1nIB&cxP@7dKMAxVz92^_+Dk zV4w3IPSGQpu#j@YxZ=?#OzsYbDe3Qi)dSFs%jJ+Nu+Mre5DD{iOncr1tN|xq+y$Qf z7256F=BB0w7zLq`y9>AvAQN>fTNk|6MtL55ed-OEg#;=p_Vc% z%$y;P{Kp*d1+3LF@S0>gG+hl~-7$5?st-qjt$RJ30fX?{yNGf*nfSo0dIgmti5Cx` zEe~o?l+oTBmg>pL&tLf}I7 zSQzPG)g>9qxT-cE)f7}UX%YF&Cpw4iGSgy+hc_LFAI%CZbnHm%1B_!G#6(uIlIFOG zBS5F3bu(>C%x|Uah``>F8JCG%-`BOz$#cj(4tb zXEW2zODf4{E8=0#P~0!4wgnL-aLPE%pO;}@++O0r3dq3=yvQx+5bQWDzv@H>#O?m_+u8c8zG*g@=qeWKmbBCF9Hxlmg{<#v1r~1U+$hTEF5-;}Zg@vyt zcu=WQn?dJm0*QTtaJ;jIPFpPb$EjP2J#KhGVi?*uj&eXgpCo1E;7Ht-+tD4tOC*iu z2(sT#3Ny?~N4Gy0aWU{Zo$1`n59s^V@Fd=_?eARIa&37(J&CCZ_(D@Ape|jIP5{A6 zhPYz(804!S;}l-tImhp8w6x3Q*LHt)XZ>Qu|3t9K;jZ$9fdeL%;6exWyC`4N`7f&k_M|zs?Si$QS}tq!&=|Nk+}Vy zZWg9)>gxi%O26u^Dv@HDXzAsagbDE+wNvp<^lj=Z1?hNJh5O`HYz4ffY6swvK@f&_ z8McS_cB8-_C_F7K6yUTUBApKdV1<;s#ov!{0>R`UCz!HelEamK9*T@AIgInLI!S{c zFge{5Z3F2B#F-v%4@wC-OwLNfy#6jjG*fX+6|ttdWDw(yL=o!7Ym9>HwhQB+RiHW@ zWMdOS6q5A(FafTK8^rTbp~yqox6pF8YLc}?*Y8NSDI*=-73K8L?0NEY1`u$-xpBY; zrbYO)YON-7b4y$yjc@~4g@F(OHtLE7Cb{aNJL#S5XVZD(vX~#d4~)EXa-KFjDx|W| zw3?!2?j;?RMrYovG7LzV4@fuQj3>alu$A}|C&mq5kG2i`?dK)$?~D!2j6rA9iQxu` zHQgpfB!g3GN@!&4A~l|GjM$UA-p#GPBy%@__p{4{R`w4HZ#RBCqTj9om7(f0D*5qsA_6Jp_MO@@p9oe-o<4mK zSAdZ$RSgbJFuaq8hB%`E9rLRLg*>0NgeBr?8l=dLr8H{Mh!@WKO(M-~JEDfJ}ySl92b z*BOI9;iaX&kI6{MkY&|uM?}5lR*&~Q>><~+%N|1u?034vIM$!8@4MGu4gxLHuL)iM zIFE{_dP6Jy_X&WebIY|dXm*xdu;a$BI;$1ZnQnoDPM50Pr2@!k-+<7kk9nZO_rG`O z+*c}GYZ*#!eN)tc-Gki$QE!VB-}F?$dJHJOE}8;E{Xd}Be?|+>!y&2+YYL4D9m!n1 zzt=Be=+EpE78W)J5;j|d>uGmC+2et03qf@1!pS81uUiehHQXPrQ{k2PJ2qtl=FwEjaGNb2L!=XienVT(S}#Xc=I_31T9^Vw(RmSnjPov^z!U#%WH{>!S%h zH=o;a=YeM28$Z=;QWSiQWMoO2=c-v+=+Zv=J$?`G03L(R5PkfUX%)cqJM_a`?AKPo zi-XmJK<+1ZiF{@69ea^|gwO#nFs;JI27`P465Q97$$b79PHXL0$EmnO7hcvFn&^9n z3h@>g-)hp_V%kkdbPrP|)0Ml;KQ8uWW0d?5ggH!KqyELarN16>6Y>~|YeeRl1MxoLMXpTS- zs59?GGArgcXjTz3IRs<=RcEZ5kOjyF|1cUUhj<>V+^-=>7ftZ;)-$g6)~7annwg&c zZxjXG$`Y6bK_p*(pwipGZ--7LQQW1KvsDyRbFPfS;%`LtOuJSX;HeEzKvuOWjm8CY za}~ooo>JTU+qtUbP~voW9Jy|jHuS$%4YEJ0_!M7V#F;&awLZZ~7imfc>6EMol|C~3 zcXhCTz}cZm@4G=MH4Q`L9?yPItP@Xaw3KtG#>RnIee?IitH1@g>-g;!P*c(G-F6F` zO_~3fTmobT*%(?WsC4q5=c8`N<`cMOY4Q?+1GjAOBWGB+&bR7xLx*(0ZGV8I#c28j zF^M9oO*FD4I=DChdXVe+#07JT<)>&;@aA+ zSc1tvfY~`Z-qpN&v9dq&m<70X!40dbxBE7a{om*LT|$iEw$HLN?pbPL%@!AFF-uE^ zn8f{JQ$&$X!}Zs^TK4Q}5Jgln{?8mDnZbs+l@VWm90UJJtuRyc<6?Cn`;4$O%MrO6 z0tjFP8Q_p!WO&Op9G&}HYt2cA^Y#?Fe+UhOYo%2|goS`>pH}qAzGG%AG2Df#d<3(} zWfW81bV= z!%J#6N&tNU&M_m14^!&NSP>h9>7O~kxjhG0h=FaPzU@ldkWTYx3|;=kO9U~s0SdER@%mdgDQXW}-s)De9-BOjzV-q%BKdZ!#e zFmNY)l4fq+xGG{>&xe8nQu@~FK%#N@?y&F$%L;)MfYh`hcfi-&jRSf$UeF8m6!Fl~ zCed8ihziIU;h<}Jhx@7c!4b?#gB09W$iBt)iA^HppSrUaSsueGX>3yTCa}QnBg>DO z!u=b8H4ISlijn4kFljFkuVpt(KC03`ahD1H&$h(*_8yzOMr;ts%ao>bPf*E}I#y9t zB*Hy#W-ZI4<E&{|~B*v2G7oKhZooza9@GK|@#))R%0?q`z8nT2qufzJ| z*diGqS~p=ZdSPN~^9+~cF_4}8R}7ou(rSahM1p2px2nc52W9`YD|F=GL3-{g_i&;) zw~EM{4*ieMOB24H>);yrmyU%0&Kp!S27dd3zM`7Sru)nNe{n@T$EP5sVx-Q910V_* z0MgDB?NVTq*3!im{>6QjH^)WH>hdSX-dMPMr?c7_vSizVy_(~^X|AfqDcAL{m?7#3 zBE4?tO@OrReV%0gqHPvUg+xw{Hv-)+D#w2~Tiiyt($Zh&k*5z|pui@&u@YuV|Bf-3 z1xE@LXyR`CZ10Mz>ZCER-T0OE+ZQl*Ng#4?bJ@<$OY}7xKhO_H>8yE!srFCruc@mX z2^!Q$YwQ>a475|uF}{a;Qrcqw7iGZVBH3zN_kSn>5EdQSLN}63b1KeGEMh=`8O>Yk6T~srRDHXP=a)7P}rOJLKCtYn|u7vR;(S&V|C~hE?IZzf*W~%xuEqYMwf!N>dLGQWtxJ83=^!6U=g@H z(Njd6<{ETep@(bDI%QETkfp#m<^U>l5lt?N5WxXsz85rWM=i~omI0Fi=#oV85RGpbm;+=XTPp(M-1{7npK7^ z+`&|s7kk{n`5OA61a$;oM~E)=_HEKCSQ0@_Y5AaM%BHAwXYWKyP0ZHX45$C1bt=s3 zOGE)Dtb3qx*UuU2jU$K%NvLg*nIMBF1D!MRm{hh?jrTiwZqL}rQ|sENMqeVugYd`B zg!ncOzleK1O-+I=yC~rSl=WiQ#p7;!wbAFkigmFo=X85LhKvClv0w)ioCqON&okHFK~Q`i8$A+y;+@(r=dwVclX?gPvC90Bd7e2|9R$rFaE#wk5qq{ zG~swUgqeXV7NGsV66gX${q+5yH^awxxCX4~vGTnDhP6NdaJ(UnGy3nBN3#K(LCre~ z%KjICAZ4xfDY{Awgpg`r%YFI>B_+Rx>U{Xv_`mKththNlY*hua@POO_($uk?pw?Cv z%?PKv1AKBmKOr4%zdd<|+gB0Z;Fuaa_7D@5dORxLE!{JM`X_xFGj1$%DG;=uJs1yC zONcm}kluuUx}?C+0oE}ZENZMKo|p3wq>e#-0La%G+HO|X$5DdHSr5dohQX%8fMp(Z zUioR%R0ZcIT^A!f^(vw?fR6-AbX!KCX6!Qbgc{Ubk>lnTa8>Fg;O|0K?E5&C?H9Ks z5&YcE$L=ub5IjT(@LM~o9sB{cRR;iDwSoiAMX{XBWOh4a@B79- zQ_E>urKSc~>Ihj&IqHKNY*V6i=7uLKrQaBw9&(4-#qTV zpa{4NE>qglgPq!OU;1v3>Z$n!D@X@(fs7mS-{KgoRD+vT8$YPu-SybhhUC>3j;*;1 z1L2MY0|vVlz}r%#5PbIpwQ7O?nf(NQJDaH4Inr3oQS?}f9ZVjCxjU=i0vB^S9tLcF zh(~?x0@@j@3oW9_^D!|#;w`StYbxyv*gy<6`@iH5{8sK-?Qkpx&5~SIX-x?x;|%0W zUL>ZTRiA$V>KNVyQ|2&|M_Eo_?P+6A?iw_-zrXoi%&KyhgAbMW07 z&cQPO-3#D10z~BRydOMjz>1lN$>==*K5r1s&ji+5hz;PaODby#20h2p2C@B4Q9XMG2k1P>nRC~iFy zB4}EVDX`7D`jWZV-@&%_V>GhrLNR)EN^SjI(&D*BjWEIPJo4!$ud3--8;)v;L1L|X zcx@_0(geZl5}MpujqKdLXKA_IXn~EcU&t5(;Ds8go!$-`jXka|q~3Z{PWvP7!gg%@ zT+^7JY5Bq4*!UBt^0$uLn<7CLFPp`A#L>509b z?B2eJP2z5_U~kYYi@_YVKOfWaF^@<+vAI8#WCUjQ{%-Av)tF~}j!5X`v=%9e-ZEdM6B2i&BwEI5B{V5&b zX?jCeP5X$JI>0w+rt^VN_$9;!UixQO+n1FlzN&n-+js>D-jmA>N4oLHr{{+~uDb^E zYfj^fcONU*x?eQRdokd2JT6HT6L~Ak3r0b2gSD# zgF^O;JcXXfH;yfj>(n2o3L}2y?w?><4BgB7WsGzXCvy&q8%?bky9rQKv4JVa9l;(X zi^uV#5fAk`J8#Dx@z7$=^=UG4HRj0?II>)fn0eLEeW=?QiRWzsqSg1RBSA7~_4v;oYf^=oK0~+zLlbR!!2hr3Ex3s8x znqqApCK%ch$pm7zMg;J16js(L|_;hhuWF7slZjEQS7NjWFT^diqMjX<;WLg=94aC0KH}gLApBc zz~%$6mg{%qcH%RX-E7V)ifp%S`^Nj+?e13zYwm1X|DX20JD%$Hjla&9vMM7~X33s~ zc>vN8t=lT8j`}g;HJ^j_| z_>B8=-Pe8H*Lc6Ln-0bSCv*TTck0!v#6+GV?<>y? zekEZ{@(ms21-2KIHQC=;x{Bry<7Pa78E_f%SFfNP@^e3({6>v6K!U0A>{>@(&#R;T zPFH&)lrm8KZ=V@GKU3qH@r5c?nNv9P@iP&R5j!f0N}?n#B9izduxf+pteiPM@O$kX z0dZd?QP`1_A!=B&&f~{A0LL$;@oD+7QW2efeC^MMs7$L$e-$Uh(K-i{!tT9cpsaKG z;h^nhDx4Sm?UD8&njp5KF4k2dcWBqE*jnZUX3 z`^dfs?6$=L+f?I@1z3XyoOzi~vnc@nQYgLmQ&qhw)&Y{s2_0kjhAnb_q^|;GMj%lt zg?q}C&8VJXadI)+5Mi6l(w4iCsmjVI3;J_%KJC7((<1hv{gbEXlxM4KT-0yQ#MCu`|a?aeT8N9kB|@M-jypc01JE_D=voX2y@bbAGN z&ls^hg|zUwcg0qVV*;W|ul{7Jop4yCP68a{IWDo&)B4|wwT4&QJu}w(ySUB7<7ypq ze*EQpD(hw243Rpt2=moEK0Xl+<>V8FB|hzqc%-`ANXEk@7HB$cQs&^wON5pxFRSqO zdz=VHRKcyp$qxT{ra*efDdOG)w#sbiuW__ zL*4R=u$V^VAtDYHDjbHD+4lAq!|bU++`k}E)Kumc&(OQ3Q>h~M2CzQ{9SDX#)K8QO$UC?~zyRXT z(8^)_$OiT#18CZXSv}*eynp|SRRs7dRVmVdA^4yD&6mEsfy)u2qYx<#B$M8 z4tv4&qdF-wS#GJ!Pi%NOuFNGW`7eD-##&BG&LU-j7swQMSqi((bO%fq-CQ*vP}W9b z8sInXP5VTs*=RC4fw3UpIpT6xAn=Kk?~fDnM%G=)*cNicOp|C1g9>rm*MI5+q;8nM zLcjta-o{)tXyto&@lY^BxrMc-oAATjye6Mt{7?;?tDKD0zD$K=S$DyiUWI2z)LL>y zWqNLClhCCOneEf<>6!Sg$C?wE+KFpYst*2<>|Q0bLsaFHvzHJz`Oowk7G<=%7W`lo z0;ww;R%b}l9i!WxXHaC|bQgG}I{x(8$fdd=9Nj%BTyt4p5}t_z4Gi%N*O zT^>}|L_d`AZ`~%68suWT?C0NAqEEIlV>Ue=47{FyQRP?KIRFw@I6`c1^{vz&URV^>{8cX(252yJNiLf}uvOo(TTYD=C4(n{1 z9wpyww91EtJI&joZe*uf}ep_lY{92xJ!GRT=ZoyHO5v4qRmcK~xk(XgT8gyzDJ_4KKsisAwS^ z{M9-f$I0dEtDe{5$vf`t&T#Fw~in zb>~Ob2mu*2C>4*dL&GZQ^xB*ae&;#1u-mhB)T;}7F#}`|9x;8G7+Db@`^|Jgrh4Of z6mRX_Q>hBxvIBFyB{mC9cX^O}b}On{Ypb_Tml?juQhnrhIJrMaU;2tM+uhgF2h-(P zE7z3K3zOd&AU(o#q(08ACQ=Z+V`JX2dX+o%=Lux{^7V{aohqF?cKmQy`n_(-^v8uY zQv-to=HZne6f-^zWhBfW=<*LNxEy8s8%;lQuyrJL$643s%m%|Nb);f<1m><@di

j?(uvAoJz5HrVlgu07L?Tt}6q z|d9E+-oU!KR;*g-`K~iJwJhD6w>TKjpe83 z-`26&`t6OO_nSm*`?_)<425ACl;N`9+V(ZYIhpd7xs~H>aAHQRQ|O7v0a2rU^nTPb z)VxwM9fZbhX~Kl+kqB>_8-#H3uIdEGj+(sy$a9?%3N=TV2awqnfXuG*MUSjcd7jYO zXguNLrk3vpr)4I`IQX~$+GFxqx8naM9uVfjy#hyiT#q4z34O` z)od#FG+-9{h#vcwORV40jR)#N$l@)uhDjm6?Nd?V#d|7Bjl-&*T%?*(*LzO==gp0W zUwu)7%z!GY&%~!~V(#6l-H*!9*POT+z;an|D+mkio;o%FzaN$)IPHOd&mn%FPp8|$ z>-XkLi&?Ht%_phYs+{|ACY-oIC; z_g`5r8b=v6#xn9h9XCt2ll--=MBD>-GxOzm<9C=2el2f#)MZao|cwMn28Q1 z&juP4)cuaS&~LXw+=Nw;P54T4ahrb0x89FBv3^F6XPlWGr7>T~jp{zxOFug)zo>M# zn;8=+a#fFMh~;TF#!~_wgEnyMB5WN@c1nb*35E%_#gcN*zV70yc|k4}s^J|cKSRsJ zYk0}R8Rc8G9b_H3VFhYoTG-3=WK;A#1Ljz4PW_XMTlBGhmEn08UBsz>KKj~pMJDN~ zY#Rod8nFV<-l`CsOm&7&zp>Gr`q=W+c}5{9#b#!L`Kz1Tmo^F=zMa^-?onTlyM3^< za!C8xg^Z5xXqLR?%KxblH|s?xqBm!Bzp&|~Dzh8_Dn_!O<&3loPn#2%|Iz+ID{6}B zew5*U<8tBfAi*J@rD845sVudu%C~tp-}IUhEA%c1NcEhkSNZ|Vz>}QKNvqfFYN)IF zkdIcRe3(nPYT!2iVs%R?O%SCr(WhN&{5`f~S=qRyV6pEhdz{Y2S6(jI_x|09uW-m` zwIQ_Ql_ix*^V2euef546z;$xHln2{6(z9-gS8&Mc$4JHsm6xzaH0+IbWw`Oqo90HZ zX!0waoK~5Ebni^X4fd>ZD zexyPs%E2n=c;YnG;jX@$J}&Rjtr0CwXGOnu-I=reo%fBgf=D#lWpgd|o|x+x5qFrA z%UHZVZ3itD+Y~UxzYxyE=CN!QG7;LG_jb&I9SvovWkvdZ5*bRoYLm@JuyrtA1TsSJ zk5eSir)vMjA3M3}yu!?+qwi-p27;AD~loH%NF`+O`!i%Xrx?0ep| zh_P=wM$)sA*d;Q@p;~v})$uG>c;u`1l70g#<>Xfrk#)8~4wS`HFQsy7thwoPw5{_> zV-iJjgbpUL^1tQKW?t8oMqB~T|z<81S%^h~Qr zHoIE47m??^4SPjcpgBS#d3?h&!g1R)VV6cS_2>vPew>wZNfmKYZKM%W9N}W|Bz4b&X6>G(=Zo?S9Ws&*T{hzT9)d#L;>s9^3b_WN+FdrnlP=G##!MEIRYB} z^$ytkNC5K$K=Wl}UWR8*>M=GRh>v4xaQs!cn5gy*#JDie9Rgq7c%u z_Ueex&oK0TD|BL6L_JN6%JXaoi3Y_DF@-RtRmlO0@_ziD+!K`7PR={{@ph^e&Narl z`G`;Prvn04=$mZ&)^iDeECZXQ8rSjytM5S~9!Lb1{LS?EV&q&nvN2|LPl3G0w@uox z>(oxBlo?Z%fXOccY-xFqhBk89txxW1ZNc%Ex+BJVKTKV)M7 z82Q?DsG>}-bNC`1b&yYMV}mc7TZ(&P#cdrjjlB~H*^V%jE(gsoi}g~VcLhmriCKV0 zPD?I8eN~!RtN`tw1EYSk=8%fJ0Ng}mX^TYwFNmu()2f^UxY~)K@2iP|Bb64s&VeGb zY-b`AOwP8)weFj?Cj9%0*0y+b3vzLV>wNXsNeF1-J^vt);A*i9rDNX%Y;0{BGWvsh za{3NkCghb>Mw|V8b|KhD30Nsa-xWUT7o)lc?)4f^-5%q*q}V!uMnAdYjKsr#zE=yr z*UGyx4OyJS7Ql_Ua$zbcc+PGR?J0Q)Og}KfUBl9s|26uPdnx6|iHKQRX+ihGH!Q({ zfh&1JR>p{%obVM&J^wu251!uQla8E;sg&l8d2wi;Uw)u@5FM!Zx4A4OqR2^CGa(gD zJ=ZwoZZKl5PgwkTmfvr?6WWdJHqM?yhPONBHTB^JHG=OhP?F*bkPq_@${rErqkHdY zbP^IeXE<;)4lPO$EW)Vm%@D|Qry*aek}9e(zy0)7^S*P@ZBDet?L_H&AlA1#faTQ7 z)gf8-PmRqShMT8KGaf<9ZRCw`U{>tJx`J#LB<6hv1<#56XN?quM1p0U}&-K zUFd^-`U7%Kf8V0S08^-)BS37%^os$wei3KoTSN+TH{`b1WB;&wh}X*?n6sz(9S9Jc z)}*4gbN_8Q3gGX=&tdoeYvTUZzzE*tM*c4uKSA$u@`)3*4R4<%a0wGTZJeP5 z3m6Lg#iXTN?dIGpVUV!e)F3qYz5CCcaJD6YQM4&WdUfo90%phOGAW}orz6~sRO8KC zCC>a)m%-<#BFFVMfR~yvRu4S*Eb~ug4+z z3it&`L=Bnv)uYOdEJw-@CHLLP08dQQB{mXdX5rXiO@6uZ$dm6zLU zW8l_fvQ8Y`?xU>{bk);IRw9yx3{NE&B=+&fXg^fOMPg2UMQGH26s{QhJ{4GQr%NKg zLCPp;RP~7lj&?2#+6&}+hyUxu?~nTMX{0C|KFtcD#l8ZYx`3@W#=A!VDO1{jpi@`E zw+lBWj?@W>vlxgQIV?a;L>mE7Ex0;8c9570luF7+EZgp2egWjB39G0=%(pi&5!d$h z-e&u>ov!(@51-2p)Cv%ljCezBF=7ZF^pcXh7TiGNd#HgU6!hiYPAzDNbK_o?>G4P; zrl*iMJc@@YwA$t;a)WroYP7AI|dwaF|0b*&zf4Q@_*Kr(B=^yQ|m*Pec*{*LYmlvum?3jIgc@SWDj zVbloO3z?`Tqg^2$`Hh{S0b-;_CO&262R*`pB?$%d1aYXVZc7kZzo%){1&8n^y&pMa z7L|dTxcaSivo_!#`B6w9%jF@~fM`!@Q^^es3WTcH7n4l4ieV2jSw9n=Ptr_8;s7Rv zDoV%2J|bdjka<`A1`qwrpgH7>*hXo_>gPBoRQH;5&n=@In&pN|ABDJiyr{z&lK zY36^6?_<^Koqw!9^xUBL*BT`@-S~f!9;}*@OfCtcHTCCvWK@kSdL8ZXlc;;yMU=!B zlC;SHR^pS-1vijEP2j-ijDxLP=2d8H?D!QZpw;!B_Wfx zG=_mOR0@;6dDeiSn=-rqkIWzw2AZ+ki~{iVHOPkClxZcoamHEU*w;hZ=l{8K8-O0u zms7)$-d1FNLeMn$)fDevY<>$zAHgmNU-f2b^1`=&%TRVvV?&S~Ie#Nvp68sx4vH4u!#N<{)9 z#WY!vd1X;iRAuL|Q)zLo!l9Z}ll7HE3jmt@nI(54fR2GBCB8B(0`YQQTdbeCv-ur= zD8}DKZoHW2t|9|U>q1GH4a!99-pqrNYKmB}$#uA9u47IVs0`KQ0`Vk5ifaOTTQLsS z?@#E}DCx6yUCyD0#-wdcMaK2S`Cdo1lZLJ<`@z^>p>dVO?osQ~z2ZrbW_5ni1Bqy` zLrJxrDG>w8^uRI#l<9DEzwPR+4U%fyBySKL${%<;H%HF1maJ5BiVTw2(F; z^i__e>o1@j4x5_>igy;xD%eXVf5^mxv-k&hNfN{ps3w$cDYTIeixo>zN_5NT3r?O( zJ2+!`x3yuBOmpgH+8YU?n~c1~`YB9&(^q4pFCHKt4TnDsmHkMMvXieWY0OelL@V~X zxok=x2UC;Aq(lu9Z`MYMgh}w*b^0|gTfxKi1>$V|bGPTh0uam{#OJEBopw`nqy4ED^OH}#d5Nv`4K24gW9`1;S*Ap^aW zpkdJ0K;pom49gol^gvN@r!(NMEj`23u*ySWf89B;5AxvLdQT&5^}kLLBZj-M@`aNv z5Kac@?iGx#ajCNYR-e0Y6WlI>hD4i(GhPmKi75@2GDeQ6rw{@p zq+9xc0BNC6)58uOxA3{Ffa%i6kKCig2-jo4@0)~KlemaJj^R;pklJ^0;f#eF9BH~)M(l=sZV%BPMoK|>1r@_qHlNRm*xJJpOVJLO3c zHJM#dPhR~#A0r=l9vIJEprhXS{rINywGsFWG6qMGxpR*O7Xyl5gq&M(uCjd|iQ2bn zPmn2C_EJIAb|Tlzoo$ubB6aEpZH}tX4T^I#;}ioyJt@_*Emg7ON&&>Z>j_dIxv(wL zH5ey)YwW{hhiMj2MTE@$Syt_a*eE4x@-t>VJleTxX|j~K{4cVmx;1=6B)%gUFD#w- z^z+>L*DMQ$mlHT~Eb>_pxd~~2>uLn%sM^ec`chI^t%u!vY_6!KxL0;rwv#>GnQYlw zJV^lqVATvxiwjr7L2FTM7AikIAx*Mq%B08vIMwPtvODWNRum~B z&uzJwCL85hdHv%w%>_Z`7iup_cmG-UR-w`|N0&~!o`uN-906~zZbl-oMH99uErj&E z#(Au%u1fUbq?uB^G$CzKQaz*dtMVdmNCQ&u<^UmVPmHf;uo@0lNFVx+Uh{Vg+Nq6$ zb%$Yx-mI?~D_$r19jZ8YFP!Nfwd2v=8vCV<=_HHQ!GfA$9<3RZUzHkENDs1GwO`>; z7h{)~ZrvEQ9X}B)-bb)Vl0^3ICZhW%B&AG;HdkGq`f>sCFDcyP1YPT)2f_rTI2)<1_N^8ood}Nx`XCq^b2Md)2g^Gy8@z(@>wV zJ*+zH?BAs57>Hvo*sLhMd1~EaiSo*xJuEXC=g(dml(ZohAsb+DM}1uL(%GCjy3O#< zsj#`0QFsw5b9tn^ISh>$(ph2$v8P-x{L!k56R|HX4XVlUC| z4zL^meG6~?b{&R8Yaa&Qv+PDXOWwrTmL~T5H3=GU7Y3ESX~JKHOoy#E#Q>14<$8Cj zQrLaq``DpDiWxmZ)^sJfW<~W_Hpk`7Y^KrnO%9}!Du}5Q5=YwOU8}e#SxUr;0s~v8 z)G`B%c_9sw0pR=05wBk&BThRpm9s;+4TyppN0>jEG^O$WI(VFWv18fN-=YHB&wEz6 z02}mT5E&r`Mo2A_F0Rcd6W9(7C;)>YWl$h)mlO&NBxj=8*7mKMxt>##ff{7(3Vwh) zrpl|PI+b#xc%I<%smeE~dvMlJ-7|i-3E)GJqWJse#lpyz`<{KKhRdUCI{A%mx++@; z=c|bvu>pfRUo6;Db(0u!a`U6)WY}JowX?>=*wL$dj^QFHyS?6&cAB>@|5lU9D*$K# z?Z>kaorPIhSkN?vV{_9JJL-oByp0R`i4mcWdPvRn7oB>B8U)4Z6g8s^kJXt@=v|9` zrOvgy!*+&aR^-D4Ze!}qF6U0Jc1!e^6$wqjfoDJ?2XR9A6Ug#(`SD>{e|h{`Gmv_# zRI^%Ft>zx!$3qQ$I351pj~x!aacd>NkvJ0!U8r8nO5YH7zd!Dk*f~F!k?;|_a#gV6 z?Vg6Pz>JottJ`8HAk75I9s+JR6AgZQ>UBAsUJF>U*=xmCRf}_{2If)|Pr$5GYVV}D<`(#AgSnOz^J3(@Rr&9QgKWXP@(UfaU1_rTy@?3^SdPr~ zCtWBX6Hg&MbAzwv>%u7}llGHE%sL%5k~IzfVaMweRkIL81{{WkxCN_dlS2-7-b6qz zNQcNm{f|zUx+)VIGwQ4FX}nnC+gMyk)ipktXSQ+BeuJ6+zVTz0;}7Sqol?Wwq71i! z>qvb7#*j&2DD(+?LDv2Ahh)^cR?Bqlr(B1Ckq@>HO85?r3}8+bF*5|(`tpDBVNYCz zpeCXg`ryi$?hml)QuV#TTL`Af|t>V9R39^=Bkvy7K(f|5&*;f6#B#;uD7b-j>{ppXJ=unOO} zv04SiWE1n-F5mQZ+p3FOqib3k6)jbp^Da@>*ZK6(cGIU%XkulvGs7a3@=>Yz&fx1W zscbD;oI7lM05y4PcEAmV{wT2%{A2bvv*CsLZFV2^?gNu_O}WxL?yFYY7MD(8m=#!f z6^6*IZ~n2l=8gqgit}66P7;~S6qK_2dw41K*?{T zJ38@mc0CRs+O6HVsuceEywhHeUU5&+ue`3F$REv^yY`|nDVSx*8(npLph-U|KPg}< zxTfs|_O_J_dRBnu@I4wc6mHazXC-T4Udz0|wFDtT zGS%UoROzgFq6hv3`szugUJj1(_9?0f5=ElZWT3HRLU3v~^eYiw^C{zQ)X??}ImU|m zL!--~(x?D!PG7{V=4eA==gjA4j9!o!p$qtuYd0ujf!r_nXh$1tAhG>Th#E}_8Ce6$ z_DBqApf|yIc5(N%-jGx6Y(+C8Zn^?f!mAnQliwOo<*L~xR>B%;P=LLMpa6@*t z;7~8l-TVhm02+6ocOf1W79vp5HcGZx?gl)GgDClft36HSn3|GvDs7( zz!D3rTG4S&c+MU25TPZdHPulL)y2?JqTNI%EQ(sS}tR?-O?n4ysJL0dPcDzw@H!-rS%(XEL4{9Z{e>lGXhJ&onKIS(vD*^HKCC1+I<|uVE=)ch^I?S33kh zEv_^Vw@P2O-Xfe^A6e({F9RCzB+!5Z*oxczkgi3DBdGx^iRb3#C2xJ#Wqu3j!v%&? zlKk10{Pw2xT(Q#)+nOYO|6ZS>J*^an>syaU7?qN;x%-eBuF|Y+^hh|PAb#aF0U;M- zu!u`}I%ZQKlRfBJOBk(CVn>Du!6nDlceQky9Qc|T6^O-!mEVfqd_2k-I)%cCZVT(c zCt4W)?MBX4g!PEpV7wF(f~7_dGWD6H2~|gBEJiwjQG*9$!;2GRW^LY1KF<HX?Vu~&taunvtHx(T< znMEg0G?0v(!r`^X6@9)&4csBc1y2t0hcg75f>o}uxP^;?+xHCNAaF1{5+JOsb~_6X zef<6QqnKz9W@;oaAx@q7mvPgNBwDb*7qIr)Jt2=w|n!@uR$Bl8P=BlKr-XdhoQe z=*^;t$tFM<^weiNAtY%EAtgxJV9vLok}LJ zLvu=a#Rgv`RB5CKFR(`vmPrA;VWlZ()7Y;~=~DH`G;WZ0)G*NhwOr|4^kG5Zu`Ts_Tx^1|J_K_4;l@fF3!ex0^00|x*a!(C^e_qHC@3P#3!MtbF z#!lReyO|`2TOhg6!{2*G!$7n@pAl&*=SZi1Kbe-j+u(_Eh47;m@~Epmm4_Bxwy}Eo zTWSeg)t{v_qmk91G>zOlr1Dg9UgG6AwfS{6K~@;X*ON#hQY3rHQ#*@4y9xDz+BPAq ztO=K3+#f#QFWv6kQdPBKC;>8>$N?Ft$>w)9>uBIUF_+HjG^Qht76PPgKFz(1cFA_n z^40`jx7QJi!EA!?vt$0QRIaa|3`c-e$l+~>3y)t6iQWNS`)=AQB z9ddls*qN}tml~(W^@ZDIf95sZZ=HR+8a;HuI{HF}fzo z@aVhVVxQoqDC)}}JcUx6Vu#Lc$I&9q1fXFU%x8&ZXI*F(WoW9LiDxvvuA2EY{7Hn~ zcVpOZ%jbJixWWor7tmoZPe;y|eKgY5y`@@*mQyHu_}S^O>32kyVl`llw?Z{@%sDNU zf+}8*of@dP5(f!iOe7U7LYpQIpW@}jK`3voEciy}K{Fxcd(=!l6koV$ThqNnvhMbG zytO4MrZCdv%Wwa3sULx(ZabVV04GmPhFG^%RBTs!F#30>F%&{F>2@66g*<*(bS%H~ zsu{+s3<5>#jEyJo)>b@yL9I}D?xkZL-6p=V1o1dfN} zKN@RPCv3b!uNchwyGq7K(TzSKnPsxQujXOv(fe}a#QKky-mvQa{#T!Z4y$vmDEDyu z?nSy+#-0rf;@vTg2qxwO+xBCY+}?5Sun;>_cN2aqEUgQj(qWHh{opxjgq$((u;aZz z7xSCLqX}QgI_#@X$Q??3+*PyZB|`YxSZdFY}6VJS+~ z=j~Dv0HYw!ptM21bMwL!4myrjuHk~CV^{0??=*`U(A16L&2p~ZDA4Sti3z~T$n!*9 z;b?gKG&PB(z*t@sNj&a`l6LIYX4_&PWb?rJUVYCOiKkw0W1hZG1nUZsBgJtjdVc76 zW_vU>ZHhVJVPAg~IU!07_R-gLmxu0Wl$^O5LwK_xcRZ%2jOR4Hu4mTtg^Q`RKtBLI@XSRpe6Qbz~O> z*gF6&#RM|rP#ipK23))vK)`bpwpy#N2`|z6P&1ekbrM-}Tfb)q-)Yy09o}c%Xd&%Q zrfN-AI!qy3i=wGL$VzunOj-3KMM~QDUOIhhb;IZ!=OxnzQ)ljPtS)l&bk} zwD*wW@7c=J46`+*r|U#6J9nr0%p|(V>%E}H$jRM|zNn6Jp}64k;nBa!yvUj-ZubBE zhv+l@Ck@y){u9D~LO=q5|1{x0A^f*H{I?4JTLu5Eg8x>*|EH?}lS;0zN1*SsxtnCn R>pk#KLq+F&zOr@5{{e@yhEo6l literal 0 HcmV?d00001 diff --git a/ref-implementation/backstage-templates/entities/basic/skeleton/docs/index.md b/ref-implementation/backstage-templates/entities/basic/skeleton/docs/index.md new file mode 100644 index 0000000..6f9f96b --- /dev/null +++ b/ref-implementation/backstage-templates/entities/basic/skeleton/docs/index.md @@ -0,0 +1,11 @@ +![cnoe logo](./images/cnoe-logo.png) + +# Example Basic Application + +Thanks for trying out this demo! In this example, we deployed a simple application. + +### idpbuilder + +Checkout idpbuilder website: https://cnoe.io/docs/reference-implementation/installations/idpbuilder + +Checkout idpbuilder repository: https://github.com/cnoe-io/idpbuilder diff --git a/ref-implementation/backstage/manifests/install.yaml b/ref-implementation/backstage/manifests/install.yaml index 969bf39..56aacdb 100644 --- a/ref-implementation/backstage/manifests/install.yaml +++ b/ref-implementation/backstage/manifests/install.yaml @@ -134,7 +134,7 @@ data: techdocs: builder: 'local' # Alternatives - 'external' generator: - runIn: 'docker' # Alternatives - 'local' + runIn: 'local' publisher: type: 'local' # Alternatives - 'googleGcs' or 'awsS3'. Read documentation for using alternatives. @@ -148,7 +148,6 @@ data: metadataUrl: ${KEYCLOAK_NAME_METADATA} clientId: backstage clientSecret: ${KEYCLOAK_CLIENT_SECRET} - scope: 'openid profile email groups' prompt: auto scaffolder: @@ -264,7 +263,7 @@ spec: name: gitea-credentials - secretRef: name: argocd-credentials - image: ghcr.io/cnoe-io/backstage-app:b8e4f08914af17a48ed6b8b83a3621a9f4b4181d + image: ghcr.io/cnoe-io/backstage-app:9232d633b2698fffa6d0a73b715e06640d170162 name: backstage ports: - containerPort: 7007 From 2b12c4d7104042140e0a41516211c12dad725804 Mon Sep 17 00:00:00 2001 From: Boris 'B' Kurktchiev Date: Wed, 2 Oct 2024 09:40:04 -0400 Subject: [PATCH 04/18] Stack: Kyverno (#38) Signed-off-by: Boris 'B' Kurktchiev --- kyverno-integration/README.md | 46 +++++++++++++ kyverno-integration/kyverno.yaml | 31 +++++++++ .../audit/kyverno-pss-policies-audit.yaml | 33 ++++++++++ .../modules/enforce/exceptions/argocd.yaml | 35 ++++++++++ .../modules/enforce/exceptions/backstage.yaml | 35 ++++++++++ .../enforce/exceptions/crossplane.yaml | 36 ++++++++++ .../enforce/exceptions/ingress-nginx.yaml | 22 +++++++ .../modules/enforce/exceptions/kind.yaml | 66 +++++++++++++++++++ .../enforce/kyverno-pss-exceptions.yaml | 26 ++++++++ .../enforce/kyverno-pss-policies-enforce.yaml | 33 ++++++++++ 10 files changed, 363 insertions(+) create mode 100644 kyverno-integration/README.md create mode 100644 kyverno-integration/kyverno.yaml create mode 100644 kyverno-integration/modules/audit/kyverno-pss-policies-audit.yaml create mode 100644 kyverno-integration/modules/enforce/exceptions/argocd.yaml create mode 100644 kyverno-integration/modules/enforce/exceptions/backstage.yaml create mode 100644 kyverno-integration/modules/enforce/exceptions/crossplane.yaml create mode 100644 kyverno-integration/modules/enforce/exceptions/ingress-nginx.yaml create mode 100644 kyverno-integration/modules/enforce/exceptions/kind.yaml create mode 100644 kyverno-integration/modules/enforce/kyverno-pss-exceptions.yaml create mode 100644 kyverno-integration/modules/enforce/kyverno-pss-policies-enforce.yaml diff --git a/kyverno-integration/README.md b/kyverno-integration/README.md new file mode 100644 index 0000000..346484e --- /dev/null +++ b/kyverno-integration/README.md @@ -0,0 +1,46 @@ +# Kyverno Stack + +Implementation of Kyverno for CNOE + +## Components + +The Stack installs `Kyverno` and optionally `Kyverno Pod Security Policies - Restricted` implementation. By default users should use: + - `module/audit` - for testing and understanding of the impact + - `module/enforce` - once the proper state of platform is understood and all necessary workload exceptions or violations have been accounted for. + - If you chose to enable `Enforce` mode. Exceptions for the following `ref-implementation` components are included, to ensure proper operability: + - [ArgoCD](modules/enforce/exceptions/argocd.yaml) + - [Crossplane](modules/enforce/exceptions/crossplane.yaml) + - [Backstage](modules/enforce/exceptions/backstage.yaml) + - [Ingress-Nginx](modules/enforce/exceptions/ingress-nginx.yaml) + - [Kind cluster](modules/enforce/exceptions/kind.yaml), this should mainly be needed when testing `ref-implementation` on a `kind` installation + +*NOTE* - enabling `Enforce` mode without prior testing will most likely cause issues for NEW workloads, already existing workloads will not be affected immediately, always start with `Audit` unless you are completely sure of the impact enabling blocking policies will have on your platform. + +## Installation + +You can use and test out this stack without using any policies, using the `ref-implementation` as follows: + +```bash +idpbuilder create --use-path-routing \ + -p https://github.com/cnoe-io/stacks//ref-implementation \ + -p https://github.com/cnoe-io/stacks//kyverno-integration +``` + +Depending on your use case, install the Kubernetes PSS Policies in `Audit`, implemented in Kyverno as follows: + +```bash +idpbuilder create --use-path-routing \ + -p https://github.com/cnoe-io/stacks//ref-implementation \ + -p https://github.com/cnoe-io/stacks//kyverno-integration \ + -p https://github.com/cnoe-io/stacks//kyverno-integration/modules/audit +``` + +If you would like to change to `Enforce` mode: + +```bash +idpbuilder create --use-path-routing \ + -p https://github.com/cnoe-io/stacks//ref-implementation \ + -p https://github.com/cnoe-io/stacks//kyverno-integration \ + -p https://github.com/cnoe-io/stacks//kyverno-integration/modules/enforce +``` + diff --git a/kyverno-integration/kyverno.yaml b/kyverno-integration/kyverno.yaml new file mode 100644 index 0000000..8816923 --- /dev/null +++ b/kyverno-integration/kyverno.yaml @@ -0,0 +1,31 @@ +kind: Application +apiVersion: argoproj.io/v1alpha1 +metadata: + name: kyverno + namespace: argocd +spec: + project: default + source: + chart: kyverno + repoURL: https://kyverno.github.io/kyverno/ + targetRevision: 3.2.7 + helm: + releaseName: kyverno + valuesObject: + kyverno.fullname: kyverno + destination: + server: "https://kubernetes.default.svc" + namespace: kyverno + syncPolicy: + syncOptions: + - Replace=true + - CreateNamespace=true + automated: + selfHeal: true + prune: true + retry: + limit: 30 + backoff: + duration: 5s + factor: 2 + maxDuration: 3m0s diff --git a/kyverno-integration/modules/audit/kyverno-pss-policies-audit.yaml b/kyverno-integration/modules/audit/kyverno-pss-policies-audit.yaml new file mode 100644 index 0000000..4d38eb6 --- /dev/null +++ b/kyverno-integration/modules/audit/kyverno-pss-policies-audit.yaml @@ -0,0 +1,33 @@ +kind: Application +apiVersion: argoproj.io/v1alpha1 +metadata: + name: kyverno-pss-policies-audit + namespace: argocd +spec: + project: default + source: + repoURL: https://github.com/kyverno/kyverno + targetRevision: 3.2.7 + path: charts/kyverno-policies + helm: + releaseName: "kyverno-policies" + parameters: + - name: "podSecurityStandard" + value: restricted + - name: "validationFailureAction" + value: Audit + - name: "podSecuritySeverity" + value: High + destination: + server: "https://kubernetes.default.svc" + syncPolicy: + syncOptions: + - Replace=true + automated: + selfHeal: true + retry: + limit: 30 + backoff: + duration: 5s + factor: 2 + maxDuration: 3m0s diff --git a/kyverno-integration/modules/enforce/exceptions/argocd.yaml b/kyverno-integration/modules/enforce/exceptions/argocd.yaml new file mode 100644 index 0000000..b10e933 --- /dev/null +++ b/kyverno-integration/modules/enforce/exceptions/argocd.yaml @@ -0,0 +1,35 @@ +apiVersion: kyverno.io/v2beta1 +kind: PolicyException +metadata: + name: argocd-cnoe-operation + namespace: kyverno +spec: + exceptions: + - policyName: disallow-privilege-escalation + ruleNames: + - privilege-escalation + - autogen-privilege-escalation + - policyName: disallow-capabilities-strict + ruleNames: + - require-drop-all + - autogen-require-drop-all + - policyName: require-run-as-nonroot + ruleNames: + - run-as-non-root + - autogen-run-as-non-root + - policyName: restrict-seccomp-strict + ruleNames: + - check-seccomp-strict + - autogen-check-seccomp-strict + match: + any: + - resources: + kinds: + - Pod + - Deployment + - ReplicaSet + namespaces: + - argocd + names: + # TODO: this should be more targeted than blanket * + - argocd-* diff --git a/kyverno-integration/modules/enforce/exceptions/backstage.yaml b/kyverno-integration/modules/enforce/exceptions/backstage.yaml new file mode 100644 index 0000000..5620a0e --- /dev/null +++ b/kyverno-integration/modules/enforce/exceptions/backstage.yaml @@ -0,0 +1,35 @@ +apiVersion: kyverno.io/v2beta1 +kind: PolicyException +metadata: + name: backstage-cnoe-operation + namespace: kyverno +spec: + exceptions: + - policyName: disallow-privilege-escalation + ruleNames: + - privilege-escalation + - autogen-privilege-escalation + - policyName: disallow-capabilities-strict + ruleNames: + - require-drop-all + - autogen-require-drop-all + - policyName: require-run-as-nonroot + ruleNames: + - run-as-non-root + - autogen-run-as-non-root + - policyName: restrict-seccomp-strict + ruleNames: + - check-seccomp-strict + - autogen-check-seccomp-strict + match: + any: + - resources: + kinds: + - Pod + - Deployment + - ReplicaSet + namespaces: + - backstage + names: + # TODO: this should be more targeted than blanket * + - backstage* diff --git a/kyverno-integration/modules/enforce/exceptions/crossplane.yaml b/kyverno-integration/modules/enforce/exceptions/crossplane.yaml new file mode 100644 index 0000000..eaacbf3 --- /dev/null +++ b/kyverno-integration/modules/enforce/exceptions/crossplane.yaml @@ -0,0 +1,36 @@ +apiVersion: kyverno.io/v2beta1 +kind: PolicyException +metadata: + name: crossplane-system-cnoe-operation + namespace: kyverno +spec: + exceptions: + - policyName: disallow-capabilities-strict + ruleNames: + - require-drop-all + - autogen-require-drop-all + - policyName: disallow-privilege-escalation + ruleNames: + - privilege-escalation + - autogen-privilege-escalation + - policyName: require-run-as-nonroot + ruleNames: + - run-as-non-root + - autogen-run-as-non-root + - policyName: restrict-seccomp-strict + ruleNames: + - check-seccomp-strict + - autogen-check-seccomp-strict + match: + any: + - resources: + kinds: + - Pod + - Deployment + - ReplicaSet + namespaces: + - crossplane-system + names: + # TODO: this should be more targeted than blanket * + - crossplane* + - upbound-provider-* diff --git a/kyverno-integration/modules/enforce/exceptions/ingress-nginx.yaml b/kyverno-integration/modules/enforce/exceptions/ingress-nginx.yaml new file mode 100644 index 0000000..24ccaa7 --- /dev/null +++ b/kyverno-integration/modules/enforce/exceptions/ingress-nginx.yaml @@ -0,0 +1,22 @@ +apiVersion: kyverno.io/v2beta1 +kind: PolicyException +metadata: + name: ingress-nginx-cnoe-operation + namespace: kyverno +spec: + exceptions: + - policyName: disallow-host-ports + ruleNames: + - host-ports-none + - autogen-host-ports-none + match: + any: + - resources: + kinds: + - Pod + - Deployment + - ReplicaSet + namespaces: + - ingress-nginx + names: + - ingress-nginx* diff --git a/kyverno-integration/modules/enforce/exceptions/kind.yaml b/kyverno-integration/modules/enforce/exceptions/kind.yaml new file mode 100644 index 0000000..6bb33ce --- /dev/null +++ b/kyverno-integration/modules/enforce/exceptions/kind.yaml @@ -0,0 +1,66 @@ +apiVersion: kyverno.io/v2beta1 +kind: PolicyException +metadata: + name: system-cnoe-operation + namespace: kyverno +spec: + exceptions: + - policyName: disallow-host-path + ruleNames: + - host-path + - autogen-host-path + - policyName: disallow-privilege-escalation + ruleNames: + - privilege-escalation + - autogen-privilege-escalation + - policyName: disallow-privileged-containers + ruleNames: + - privileged-containers + - autogen-privileged-containers + - policyName: disallow-capabilities-strict + ruleNames: + - require-drop-all + - autogen-require-drop-all + - adding-capabilities-strict + - autogen-adding-capabilities-strict + - adding-capabilities + - autogen-adding-capabilities + - policyName: disallow-capabilities + ruleNames: + - adding-capabilities + - autogen-adding-capabilities + - policyName: require-run-as-nonroot + ruleNames: + - run-as-non-root + - autogen-run-as-non-root + - policyName: restrict-seccomp-strict + ruleNames: + - check-seccomp-strict + - autogen-check-seccomp-strict + - policyName: restrict-volume-types + ruleNames: + - restricted-volumes + - autogen-restricted-volumes + - policyName: disallow-host-namespaces + ruleNames: + - host-namespaces + - autogen-host-namespaces + match: + any: + - resources: + kinds: + - Pod + - Deployment + - ReplicaSet + - StatefulSet + - DaemonSet + namespaces: + - kube-system + - local-path-storage + names: + # TODO: this should be more targeted than blanket * + - kube-* + - kindnet* + - local-path* + - coredns* + - etcd-* diff --git a/kyverno-integration/modules/enforce/kyverno-pss-exceptions.yaml b/kyverno-integration/modules/enforce/kyverno-pss-exceptions.yaml new file mode 100644 index 0000000..dce95b4 --- /dev/null +++ b/kyverno-integration/modules/enforce/kyverno-pss-exceptions.yaml @@ -0,0 +1,26 @@ +kind: Application +apiVersion: argoproj.io/v1alpha1 +metadata: + name: kyverno-pss-policies-enforce-exceptions + namespace: argocd +spec: + project: default + source: + repoURL: cnoe://exceptions + targetRevision: HEAD + path: "." + directory: + recurse: true + destination: + server: "https://kubernetes.default.svc" + syncPolicy: + syncOptions: + - Replace=true + automated: + selfHeal: true + retry: + limit: 30 + backoff: + duration: 5s + factor: 2 + maxDuration: 3m0s diff --git a/kyverno-integration/modules/enforce/kyverno-pss-policies-enforce.yaml b/kyverno-integration/modules/enforce/kyverno-pss-policies-enforce.yaml new file mode 100644 index 0000000..8545a51 --- /dev/null +++ b/kyverno-integration/modules/enforce/kyverno-pss-policies-enforce.yaml @@ -0,0 +1,33 @@ +kind: Application +apiVersion: argoproj.io/v1alpha1 +metadata: + name: kyverno-pss-policies-enforce + namespace: argocd +spec: + project: default + source: + repoURL: https://github.com/kyverno/kyverno + targetRevision: HEAD + path: charts/kyverno-policies + helm: + releaseName: "kyverno-policies" + parameters: + - name: "podSecurityStandard" + value: restricted + - name: "validationFailureAction" + value: Enforce + - name: "podSecuritySeverity" + value: High + destination: + server: "https://kubernetes.default.svc" + syncPolicy: + syncOptions: + - Replace=true + automated: + selfHeal: true + retry: + limit: 30 + backoff: + duration: 5s + factor: 2 + maxDuration: 3m0s From 2ed8e1d37fefaee129443bb16cd7f1dcd5775f47 Mon Sep 17 00:00:00 2001 From: Manabu McCloskey Date: Thu, 10 Oct 2024 12:47:26 -0700 Subject: [PATCH 05/18] add guest user (#42) Signed-off-by: Manabu McCloskey --- .../app-with-bucket/skeleton/catalog-info.yaml | 6 +++--- .../entities/app-with-bucket/template.yaml | 2 +- .../argo-workflows/skeleton/catalog-info.yaml | 4 ++-- .../entities/argo-workflows/template.yaml | 2 +- .../entities/basic/skeleton/catalog-info.yaml | 4 ++-- .../entities/basic/template.yaml | 2 +- .../entities/catalog-info.yaml | 9 +++++++++ .../entities/organization/guests.yaml | 15 +++++++++++++++ .../backstage/manifests/install.yaml | 7 ++----- 9 files changed, 36 insertions(+), 15 deletions(-) create mode 100644 ref-implementation/backstage-templates/entities/organization/guests.yaml diff --git a/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/catalog-info.yaml b/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/catalog-info.yaml index 72d80a3..7eb1d36 100644 --- a/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/catalog-info.yaml +++ b/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/catalog-info.yaml @@ -7,7 +7,7 @@ metadata: argocd/app-name: ${{values.name | dump}} spec: type: s3-bucket - owner: guest + owner: guests --- apiVersion: backstage.io/v1alpha1 kind: Component @@ -24,7 +24,7 @@ metadata: title: Repo URL icon: github spec: - owner: guest + owner: guests lifecycle: experimental type: service system: ${{values.name | dump}} @@ -43,6 +43,6 @@ metadata: title: CNOE Repo icon: github spec: - owner: guest + owner: guests lifecycle: experimental type: service diff --git a/ref-implementation/backstage-templates/entities/app-with-bucket/template.yaml b/ref-implementation/backstage-templates/entities/app-with-bucket/template.yaml index f2fc060..7627951 100644 --- a/ref-implementation/backstage-templates/entities/app-with-bucket/template.yaml +++ b/ref-implementation/backstage-templates/entities/app-with-bucket/template.yaml @@ -5,7 +5,7 @@ metadata: name: app-with-aws-resources title: Add a Go App with AWS resources spec: - owner: guest + owner: guests type: service parameters: - properties: diff --git a/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/catalog-info.yaml b/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/catalog-info.yaml index 6324717..0cf6405 100644 --- a/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/catalog-info.yaml +++ b/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/catalog-info.yaml @@ -18,7 +18,7 @@ metadata: title: Repo URL icon: github spec: - owner: guest + owner: guests lifecycle: experimental type: service system: ${{values.name | dump}} @@ -35,6 +35,6 @@ metadata: title: CNOE Repo icon: github spec: - owner: guest + owner: guests lifecycle: experimental type: service diff --git a/ref-implementation/backstage-templates/entities/argo-workflows/template.yaml b/ref-implementation/backstage-templates/entities/argo-workflows/template.yaml index fb41bec..985c97b 100644 --- a/ref-implementation/backstage-templates/entities/argo-workflows/template.yaml +++ b/ref-implementation/backstage-templates/entities/argo-workflows/template.yaml @@ -5,7 +5,7 @@ metadata: name: argo-workflows-basic title: Basic Argo Workflow with a Spark Job spec: - owner: guest + owner: guests type: service parameters: - title: Configuration Options diff --git a/ref-implementation/backstage-templates/entities/basic/skeleton/catalog-info.yaml b/ref-implementation/backstage-templates/entities/basic/skeleton/catalog-info.yaml index 8893792..c4dec95 100644 --- a/ref-implementation/backstage-templates/entities/basic/skeleton/catalog-info.yaml +++ b/ref-implementation/backstage-templates/entities/basic/skeleton/catalog-info.yaml @@ -14,7 +14,7 @@ metadata: title: Repo URL icon: github spec: - owner: guest + owner: guests lifecycle: experimental type: service system: ${{values.name | dump}} @@ -31,6 +31,6 @@ metadata: title: CNOE Repo icon: github spec: - owner: guest + owner: guests lifecycle: experimental type: service diff --git a/ref-implementation/backstage-templates/entities/basic/template.yaml b/ref-implementation/backstage-templates/entities/basic/template.yaml index dd0d173..f75743b 100644 --- a/ref-implementation/backstage-templates/entities/basic/template.yaml +++ b/ref-implementation/backstage-templates/entities/basic/template.yaml @@ -5,7 +5,7 @@ metadata: name: basic title: Create a Basic Deployment spec: - owner: guest + owner: guests type: service parameters: - title: Configuration Options diff --git a/ref-implementation/backstage-templates/entities/catalog-info.yaml b/ref-implementation/backstage-templates/entities/catalog-info.yaml index 5dd49eb..f49a7bb 100644 --- a/ref-implementation/backstage-templates/entities/catalog-info.yaml +++ b/ref-implementation/backstage-templates/entities/catalog-info.yaml @@ -8,3 +8,12 @@ spec: - ./basic/template.yaml - ./argo-workflows/template.yaml - ./app-with-bucket/template.yaml +--- +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-organization + description: Basic organization data +spec: + targets: + - ./organization/guests.yaml diff --git a/ref-implementation/backstage-templates/entities/organization/guests.yaml b/ref-implementation/backstage-templates/entities/organization/guests.yaml new file mode 100644 index 0000000..b1dddfc --- /dev/null +++ b/ref-implementation/backstage-templates/entities/organization/guests.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: backstage.io/v1alpha1 +kind: User +metadata: + name: guest +spec: + memberOf: [guests] +--- +apiVersion: backstage.io/v1alpha1 +kind: Group +metadata: + name: guests +spec: + type: team + children: [] diff --git a/ref-implementation/backstage/manifests/install.yaml b/ref-implementation/backstage/manifests/install.yaml index 56aacdb..5cc31a9 100644 --- a/ref-implementation/backstage/manifests/install.yaml +++ b/ref-implementation/backstage/manifests/install.yaml @@ -166,11 +166,8 @@ data: # Examples from a public GitHub repository. - type: url target: https://cnoe.localtest.me/gitea/giteaAdmin/idpbuilder-localdev-backstage-templates-entities/raw/branch/main/catalog-info.yaml - ## Uncomment these lines to add an example org - # - type: url - # target: https://github.com/backstage/backstage/blob/master/packages/catalog-model/examples/acme-corp.yaml - # rules: - # - allow: [User, Group] + rules: + - allow: [Component, System, API, Resource, Location, Template, User, Group] kubernetes: serviceLocatorMethod: type: 'multiTenant' From 80d62e30a409524a59bfbdf23a50a34edabf9665 Mon Sep 17 00:00:00 2001 From: Greg Haynes Date: Fri, 1 Nov 2024 12:16:55 -0700 Subject: [PATCH 06/18] Add vcluster-multi-env stack (#44) Signed-off-by: Greg Haynes --- vcluster-multi-env/README.md | 41 ++++++++++ vcluster-multi-env/add-vclusters.sh | 48 ++++++++++++ .../vcluster/application-vcluster.yaml | 39 ++++++++++ vcluster-multi-env/vcluster/ingress.yaml | 27 +++++++ .../vcluster/kustomization.yaml | 3 + vcluster-multi-env/vclusters.yaml | 78 +++++++++++++++++++ 6 files changed, 236 insertions(+) create mode 100644 vcluster-multi-env/README.md create mode 100755 vcluster-multi-env/add-vclusters.sh create mode 100644 vcluster-multi-env/vcluster/application-vcluster.yaml create mode 100644 vcluster-multi-env/vcluster/ingress.yaml create mode 100644 vcluster-multi-env/vcluster/kustomization.yaml create mode 100644 vcluster-multi-env/vclusters.yaml diff --git a/vcluster-multi-env/README.md b/vcluster-multi-env/README.md new file mode 100644 index 0000000..42dceba --- /dev/null +++ b/vcluster-multi-env/README.md @@ -0,0 +1,41 @@ +# IDP Builder Multi-Environment + +Multi-environment emulation on top of CNOE. + +# Configuring Clusters + +By default, this stack creates two vclusters (staging and production). If you +desire a different configuration you can edit the following list in +`vclusters.yaml`: + +```yaml + generators: + - list: + elements: + - name: staging + - name: production +``` + +# Running + +```bash +# Create CNOE deployment with vcluster-multi-env stack +idpbuilder create -p vcluster-multi-env + +# Enroll vclusters in ArgoCD +./vcluster-multi-env/add-vclusters.sh +``` + +# Using + +Your CNOE ArgoCD should now have a cluster enrolled for each configured +vcluster (staging and production by default). These clusters will have the +following labels for your use: + +```yaml + cnoe.io/vclusterMultiEnv/clusterClass: "app-runtime" + cnoe.io/vclusterMultiEnv/clusterName: "${cluster_name}" +``` + +You may now target them using, for example, an ArgoCD ApplicationSet cluster +generator which matches these labels. diff --git a/vcluster-multi-env/add-vclusters.sh b/vcluster-multi-env/add-vclusters.sh new file mode 100755 index 0000000..78d6d96 --- /dev/null +++ b/vcluster-multi-env/add-vclusters.sh @@ -0,0 +1,48 @@ +#! /bin/bash + +set -eu + +vcluster_app_names=$(kubectl get application -A -l cnoe.io/applicationName=vcluster-package,cnoe.io/stackName=vcluster-multi-env --no-headers -o custom-columns=":metadata.name") +environments=$(echo "$vcluster_app_names" | cut -f 1 -d '-') + +for env in $environments; do + cluster_name=$env + + echo "Checking readiness for ${cluster_name} vcluster..." + + until kubectl get secret -n ${cluster_name}-vcluster vc-${cluster_name}-vcluster-helm &> /dev/null; do + echo "Waiting for ${cluster_name} vcluster secret to be ready..." + sleep 10 + done + + echo "${cluster_name} vcluster is ready. Retrieving credentials..." + client_key=$(kubectl get secret -n ${cluster_name}-vcluster vc-${cluster_name}-vcluster-helm --template='{{index .data "client-key" }}') + client_certificate=$(kubectl get secret -n ${cluster_name}-vcluster vc-${cluster_name}-vcluster-helm --template='{{index .data "client-certificate" }}') + certificate_authority=$(kubectl get secret -n ${cluster_name}-vcluster vc-${cluster_name}-vcluster-helm --template='{{index .data "certificate-authority" }}') + + kubectl apply -f - < Date: Mon, 11 Nov 2024 14:39:55 +0100 Subject: [PATCH 07/18] openbao --- .../open-bao_20241111142831.yaml | 21 + .../open-bao_20241111142912.yaml | 21 + .../open-bao_20241111142943.yaml | 22 ++ .../open-bao_20241111142944.yaml | 22 ++ .../open-bao_20241111142947.yaml | 21 + .../open-bao_20241111142957.yaml | 21 + .../open-bao_20241111143101.yaml | 21 + .../openbao_20241111143100.yaml | 21 + .../openbao_20241111143152.yaml | 21 + .../openbao_20241111143207.yaml | 21 + ref-implementation/openbao.yaml | 21 + .../openbao/manifests/ingress.yaml | 30 ++ .../openbao/manifests/install.yaml | 164 ++++++++ .../openbao/manifests/keycloak-config.yaml | 366 ++++++++++++++++++ .../openbao/manifests/secret-gen.yaml | 179 +++++++++ 15 files changed, 972 insertions(+) create mode 100644 .history/ref-implementation/open-bao_20241111142831.yaml create mode 100644 .history/ref-implementation/open-bao_20241111142912.yaml create mode 100644 .history/ref-implementation/open-bao_20241111142943.yaml create mode 100644 .history/ref-implementation/open-bao_20241111142944.yaml create mode 100644 .history/ref-implementation/open-bao_20241111142947.yaml create mode 100644 .history/ref-implementation/open-bao_20241111142957.yaml create mode 100644 .history/ref-implementation/open-bao_20241111143101.yaml create mode 100644 .history/ref-implementation/openbao_20241111143100.yaml create mode 100644 .history/ref-implementation/openbao_20241111143152.yaml create mode 100644 .history/ref-implementation/openbao_20241111143207.yaml create mode 100644 ref-implementation/openbao.yaml create mode 100644 ref-implementation/openbao/manifests/ingress.yaml create mode 100644 ref-implementation/openbao/manifests/install.yaml create mode 100644 ref-implementation/openbao/manifests/keycloak-config.yaml create mode 100644 ref-implementation/openbao/manifests/secret-gen.yaml diff --git a/.history/ref-implementation/open-bao_20241111142831.yaml b/.history/ref-implementation/open-bao_20241111142831.yaml new file mode 100644 index 0000000..d279bc5 --- /dev/null +++ b/.history/ref-implementation/open-bao_20241111142831.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: keycloak + namespace: argocd + labels: + example: ref-implementation +spec: + destination: + namespace: keycloak + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://keycloak/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/open-bao_20241111142912.yaml b/.history/ref-implementation/open-bao_20241111142912.yaml new file mode 100644 index 0000000..0d8f748 --- /dev/null +++ b/.history/ref-implementation/open-bao_20241111142912.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: open-bao + namespace: argocd + labels: + example: ref-implementation +spec: + destination: + namespace: keycloak + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://keycloak/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/open-bao_20241111142943.yaml b/.history/ref-implementation/open-bao_20241111142943.yaml new file mode 100644 index 0000000..38a34a4 --- /dev/null +++ b/.history/ref-implementation/open-bao_20241111142943.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: open-bao + namespace: argocd + labels: + env: dev + example: ref-implementation +spec: + destination: + namespace: keycloak + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://keycloak/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/open-bao_20241111142944.yaml b/.history/ref-implementation/open-bao_20241111142944.yaml new file mode 100644 index 0000000..7249de0 --- /dev/null +++ b/.history/ref-implementation/open-bao_20241111142944.yaml @@ -0,0 +1,22 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: open-bao + namespace: argocd + labels: + env: dev + example: ref-implementation +spec: + destination: + namespace: keycloak + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://keycloak/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/open-bao_20241111142947.yaml b/.history/ref-implementation/open-bao_20241111142947.yaml new file mode 100644 index 0000000..3aa23e8 --- /dev/null +++ b/.history/ref-implementation/open-bao_20241111142947.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: open-bao + namespace: argocd + labels: + env: dev +spec: + destination: + namespace: keycloak + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://keycloak/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/open-bao_20241111142957.yaml b/.history/ref-implementation/open-bao_20241111142957.yaml new file mode 100644 index 0000000..a557757 --- /dev/null +++ b/.history/ref-implementation/open-bao_20241111142957.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: open-bao + namespace: argocd + labels: + env: dev +spec: + destination: + namespace: open-bao + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://keycloak/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/open-bao_20241111143101.yaml b/.history/ref-implementation/open-bao_20241111143101.yaml new file mode 100644 index 0000000..a132e8d --- /dev/null +++ b/.history/ref-implementation/open-bao_20241111143101.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: open-bao + namespace: argocd + labels: + env: dev +spec: + destination: + namespace: open-bao + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://openbao/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241111143100.yaml b/.history/ref-implementation/openbao_20241111143100.yaml new file mode 100644 index 0000000..a132e8d --- /dev/null +++ b/.history/ref-implementation/openbao_20241111143100.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: open-bao + namespace: argocd + labels: + env: dev +spec: + destination: + namespace: open-bao + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://openbao/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241111143152.yaml b/.history/ref-implementation/openbao_20241111143152.yaml new file mode 100644 index 0000000..aa23be6 --- /dev/null +++ b/.history/ref-implementation/openbao_20241111143152.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd + labels: + env: dev +spec: + destination: + namespace: open-bao + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://openbao/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241111143207.yaml b/.history/ref-implementation/openbao_20241111143207.yaml new file mode 100644 index 0000000..8a632d4 --- /dev/null +++ b/.history/ref-implementation/openbao_20241111143207.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd + labels: + env: dev +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://openbao/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/ref-implementation/openbao.yaml b/ref-implementation/openbao.yaml new file mode 100644 index 0000000..8a632d4 --- /dev/null +++ b/ref-implementation/openbao.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd + labels: + env: dev +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://openbao/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/ref-implementation/openbao/manifests/ingress.yaml b/ref-implementation/openbao/manifests/ingress.yaml new file mode 100644 index 0000000..abaf181 --- /dev/null +++ b/ref-implementation/openbao/manifests/ingress.yaml @@ -0,0 +1,30 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: keycloak-ingress-localhost + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "100" +spec: + ingressClassName: "nginx" + rules: + - host: localhost + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http + - host: cnoe.localtest.me + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http diff --git a/ref-implementation/openbao/manifests/install.yaml b/ref-implementation/openbao/manifests/install.yaml new file mode 100644 index 0000000..ed3b799 --- /dev/null +++ b/ref-implementation/openbao/manifests/install.yaml @@ -0,0 +1,164 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + name: keycloak + labels: + app: keycloak +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + selector: + app: keycloak + type: ClusterIP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: keycloak + name: keycloak + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "10" +spec: + replicas: 1 + selector: + matchLabels: + app: keycloak + template: + metadata: + labels: + app: keycloak + spec: + containers: + - args: + - start-dev + env: + - name: KEYCLOAK_ADMIN + value: cnoe-admin + - name: KEYCLOAK_LOGLEVEL + value: ALL + - name: QUARKUS_TRANSACTION_MANAGER_ENABLE_RECOVERY + value: 'true' + envFrom: + - secretRef: + name: keycloak-config + image: quay.io/keycloak/keycloak:22.0.3 + name: keycloak + ports: + - containerPort: 8080 + name: http + readinessProbe: + httpGet: + path: /keycloak/realms/master + port: 8080 + volumeMounts: + - mountPath: /opt/keycloak/conf + name: keycloak-config + readOnly: true + volumes: + - configMap: + name: keycloak-config + name: keycloak-config +--- +apiVersion: v1 +data: + keycloak.conf: | + # Database + # The database vendor. + db=postgres + + # The username of the database user. + db-url=jdbc:postgresql://postgresql.keycloak.svc.cluster.local:5432/postgres + + # The proxy address forwarding mode if the server is behind a reverse proxy. + proxy=edge + + # hostname configuration + hostname=cnoe.localtest.me + hostname-port=8443 + http-relative-path=keycloak + + # the admin url requires its own configuration to reflect correct url + hostname-admin=cnoe.localtest.me:8443 + + hostname-debug=true + + # this should only be allowed in development. NEVER in production. + hostname-strict=false + hostname-strict-backchannel=false + + +kind: ConfigMap +metadata: + name: keycloak-config + namespace: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + clusterIP: None + ports: + - name: postgres + port: 5432 + selector: + app: postgresql +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + replicas: 1 + selector: + matchLabels: + app: postgresql + serviceName: service-postgresql + template: + metadata: + labels: + app: postgresql + spec: + containers: + - envFrom: + - secretRef: + name: keycloak-config + image: docker.io/library/postgres:15.3-alpine3.18 + name: postgres + ports: + - containerPort: 5432 + name: postgresdb + resources: + limits: + memory: 500Mi + requests: + cpu: 100m + memory: 300Mi + volumeMounts: + - name: data + mountPath: /var/lib/postgresql/data + volumeClaimTemplates: + - metadata: + name: data + spec: + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: "500Mi" + diff --git a/ref-implementation/openbao/manifests/keycloak-config.yaml b/ref-implementation/openbao/manifests/keycloak-config.yaml new file mode 100644 index 0000000..4bb098e --- /dev/null +++ b/ref-implementation/openbao/manifests/keycloak-config.yaml @@ -0,0 +1,366 @@ +# resources here are used to configure keycloak instance for SSO +apiVersion: v1 +kind: ServiceAccount +metadata: + name: keycloak-config + namespace: keycloak +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: keycloak-config + namespace: keycloak +rules: + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get", "create", "update", "patch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: keycloak-config + namespace: keycloak +subjects: + - kind: ServiceAccount + name: keycloak-config + namespace: keycloak +roleRef: + kind: Role + name: keycloak-config + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: keycloak-config + namespace: argocd +rules: + - apiGroups: [""] + resources: ["secrets"] + verbs: ["get"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: keycloak-config + namespace: argocd +subjects: + - kind: ServiceAccount + name: keycloak-config + namespace: keycloak +roleRef: + kind: Role + name: keycloak-config + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-job + namespace: keycloak +data: + client-scope-groups-payload.json: | + { + "name": "groups", + "description": "groups a user belongs to", + "attributes": { + "consent.screen.text": "Access to groups a user belongs to.", + "display.on.consent.screen": "true", + "include.in.token.scope": "true", + "gui.order": "" + }, + "type": "default", + "protocol": "openid-connect" + } + group-admin-payload.json: | + {"name":"admin"} + group-base-user-payload.json: | + {"name":"base-user"} + group-mapper-payload.json: | + { + "protocol": "openid-connect", + "protocolMapper": "oidc-group-membership-mapper", + "name": "groups", + "config": { + "claim.name": "groups", + "full.path": "false", + "id.token.claim": "true", + "access.token.claim": "true", + "userinfo.token.claim": "true" + } + } + realm-payload.json: | + {"realm":"cnoe","enabled":true} + user-password.json: | + { + "temporary": false, + "type": "password", + "value": "${USER1_PASSWORD}" + } + user-user1.json: | + { + "username": "user1", + "email": "", + "firstName": "user", + "lastName": "one", + "requiredActions": [], + "emailVerified": false, + "groups": [ + "/admin" + ], + "enabled": true + } + user-user2.json: | + { + "username": "user2", + "email": "", + "firstName": "user", + "lastName": "two", + "requiredActions": [], + "emailVerified": false, + "groups": [ + "/base-user" + ], + "enabled": true + } + argo-client-payload.json: | + { + "protocol": "openid-connect", + "clientId": "argo-workflows", + "name": "Argo Workflows Client", + "description": "Used for Argo Workflows SSO", + "publicClient": false, + "authorizationServicesEnabled": false, + "serviceAccountsEnabled": false, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": true, + "standardFlowEnabled": true, + "frontchannelLogout": true, + "attributes": { + "saml_idp_initiated_sso_url_name": "", + "oauth2.device.authorization.grant.enabled": false, + "oidc.ciba.grant.enabled": false + }, + "alwaysDisplayInConsole": false, + "rootUrl": "", + "baseUrl": "", + "redirectUris": [ + "https://cnoe.localtest.me:8443/argo-workflows/oauth2/callback" + ], + "webOrigins": [ + "/*" + ] + } + + backstage-client-payload.json: | + { + "protocol": "openid-connect", + "clientId": "backstage", + "name": "Backstage Client", + "description": "Used for Backstage SSO", + "publicClient": false, + "authorizationServicesEnabled": false, + "serviceAccountsEnabled": false, + "implicitFlowEnabled": false, + "directAccessGrantsEnabled": true, + "standardFlowEnabled": true, + "frontchannelLogout": true, + "attributes": { + "saml_idp_initiated_sso_url_name": "", + "oauth2.device.authorization.grant.enabled": false, + "oidc.ciba.grant.enabled": false + }, + "alwaysDisplayInConsole": false, + "rootUrl": "", + "baseUrl": "", + "redirectUris": [ + "https://cnoe.localtest.me:8443/api/auth/keycloak-oidc/handler/frame" + ], + "webOrigins": [ + "/*" + ] + } + +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: config + namespace: keycloak + annotations: + argocd.argoproj.io/hook: PostSync +spec: + template: + metadata: + generateName: config + spec: + serviceAccountName: keycloak-config + restartPolicy: Never + volumes: + - name: keycloak-config + secret: + secretName: keycloak-config + - name: config-payloads + configMap: + name: config-job + containers: + - name: kubectl + image: docker.io/library/ubuntu:22.04 + volumeMounts: + - name: keycloak-config + readOnly: true + mountPath: "/var/secrets/" + - name: config-payloads + readOnly: true + mountPath: "/var/config/" + command: ["/bin/bash", "-c"] + args: + - | + #! /bin/bash + + set -ex -o pipefail + + apt -qq update && apt -qq install curl jq -y + + ADMIN_PASSWORD=$(cat /var/secrets/KEYCLOAK_ADMIN_PASSWORD) + USER1_PASSWORD=$(cat /var/secrets/USER_PASSWORD) + + KEYCLOAK_URL=http://keycloak.keycloak.svc.cluster.local:8080/keycloak + + KEYCLOAK_TOKEN=$(curl -sS --fail-with-body -X POST -H "Content-Type: application/x-www-form-urlencoded" \ + --data-urlencode "username=cnoe-admin" \ + --data-urlencode "password=${ADMIN_PASSWORD}" \ + --data-urlencode "grant_type=password" \ + --data-urlencode "client_id=admin-cli" \ + ${KEYCLOAK_URL}/realms/master/protocol/openid-connect/token | jq -e -r '.access_token') + + set +e + + curl --fail-with-body -H "Authorization: bearer ${KEYCLOAK_TOKEN}" "${KEYCLOAK_URL}/admin/realms/cnoe" &> /dev/null + if [ $? -eq 0 ]; then + exit 0 + fi + set -e + + curl -sS -LO "https://dl.k8s.io/release/v1.28.3//bin/linux/amd64/kubectl" + chmod +x kubectl + + echo "creating cnoe realm and groups" + + curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X POST --data @/var/config/realm-payload.json \ + ${KEYCLOAK_URL}/admin/realms + + curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X POST --data @/var/config/client-scope-groups-payload.json \ + ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes + + curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X POST --data @/var/config/group-admin-payload.json \ + ${KEYCLOAK_URL}/admin/realms/cnoe/groups + + curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X POST --data @/var/config/group-base-user-payload.json \ + ${KEYCLOAK_URL}/admin/realms/cnoe/groups + + # Create scope mapper + echo 'adding group claim to tokens' + CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r '.[] | select(.name == "groups") | .id') + + curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X POST --data @/var/config/group-mapper-payload.json \ + ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes/${CLIENT_SCOPE_GROUPS_ID}/protocol-mappers/models + + echo "creating test users" + curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X POST --data @/var/config/user-user1.json \ + ${KEYCLOAK_URL}/admin/realms/cnoe/users + + curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X POST --data @/var/config/user-user2.json \ + ${KEYCLOAK_URL}/admin/realms/cnoe/users + + USER1ID=$(curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" "${KEYCLOAK_URL}/admin/realms/cnoe/users?lastName=one" | jq -r '.[0].id') + USER2ID=$(curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" "${KEYCLOAK_URL}/admin/realms/cnoe/users?lastName=two" | jq -r '.[0].id') + + echo "setting user passwords" + jq -r --arg pass ${USER1_PASSWORD} '.value = $pass' /var/config/user-password.json > /tmp/user-password-to-be-applied.json + + curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X PUT --data @/tmp/user-password-to-be-applied.json \ + ${KEYCLOAK_URL}/admin/realms/cnoe/users/${USER1ID}/reset-password + + curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X PUT --data @/tmp/user-password-to-be-applied.json \ + ${KEYCLOAK_URL}/admin/realms/cnoe/users/${USER2ID}/reset-password + + echo "creating Argo Workflows client" + curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X POST --data @/var/config/argo-client-payload.json \ + ${KEYCLOAK_URL}/admin/realms/cnoe/clients + + CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r '.[] | select(.clientId == "argo-workflows") | .id') + CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r '.[] | select(.name == "groups") | .id') + + curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X PUT ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID} + + ARGO_WORKFLOWS_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret') + + echo "creating Backstage client" + curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X POST --data @/var/config/backstage-client-payload.json \ + ${KEYCLOAK_URL}/admin/realms/cnoe/clients + + CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r '.[] | select(.clientId == "backstage") | .id') + + CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r '.[] | select(.name == "groups") | .id') + curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X PUT ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID} + + BACKSTAGE_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \ + -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ + -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret') + + ARGOCD_PASSWORD=$(./kubectl -n argocd get secret argocd-initial-admin-secret -o go-template='{{.data.password | base64decode }}') + + ARGOCD_SESSION_TOKEN=$(curl -k -sS http://argocd-server.argocd.svc.cluster.local:443/api/v1/session -H 'Content-Type: application/json' -d "{\"username\":\"admin\",\"password\":\"${ARGOCD_PASSWORD}\"}" | jq -r .token) + + echo \ + "apiVersion: v1 + kind: Secret + metadata: + name: keycloak-clients + namespace: keycloak + type: Opaque + stringData: + ARGO_WORKFLOWS_CLIENT_SECRET: ${ARGO_WORKFLOWS_CLIENT_SECRET} + ARGO_WORKFLOWS_CLIENT_ID: argo-workflows + ARGOCD_SESSION_TOKEN: ${ARGOCD_SESSION_TOKEN} + BACKSTAGE_CLIENT_SECRET: ${BACKSTAGE_CLIENT_SECRET} + BACKSTAGE_CLIENT_ID: backstage + " > /tmp/secret.yaml + + ./kubectl apply -f /tmp/secret.yaml + diff --git a/ref-implementation/openbao/manifests/secret-gen.yaml b/ref-implementation/openbao/manifests/secret-gen.yaml new file mode 100644 index 0000000..f7bf8c9 --- /dev/null +++ b/ref-implementation/openbao/manifests/secret-gen.yaml @@ -0,0 +1,179 @@ +apiVersion: generators.external-secrets.io/v1alpha1 +kind: Password +metadata: + name: keycloak + namespace: keycloak +spec: + length: 36 + digits: 5 + symbols: 5 + symbolCharacters: "/-+" + noUpper: false + allowRepeat: true +--- +apiVersion: external-secrets.io/v1beta1 +kind: ExternalSecret +metadata: + name: keycloak-config + namespace: keycloak +spec: + refreshInterval: "0" + target: + name: keycloak-config + template: + metadata: + labels: + cnoe.io/cli-secret: "true" + cnoe.io/package-name: keycloak + engineVersion: v2 + data: + KEYCLOAK_ADMIN_PASSWORD: "{{.KEYCLOAK_ADMIN_PASSWORD}}" + KC_DB_USERNAME: keycloak + KC_DB_PASSWORD: "{{.KC_DB_PASSWORD}}" + POSTGRES_DB: keycloak + POSTGRES_USER: keycloak + POSTGRES_PASSWORD: "{{.KC_DB_PASSWORD}}" + USER_PASSWORD: "{{.USER_PASSWORD}}" + dataFrom: + - sourceRef: + generatorRef: + apiVersion: generators.external-secrets.io/v1alpha1 + kind: Password + name: keycloak + rewrite: + - transform: + template: "KEYCLOAK_ADMIN_PASSWORD" + - sourceRef: + generatorRef: + apiVersion: generators.external-secrets.io/v1alpha1 + kind: Password + name: keycloak + rewrite: + - transform: + template: "KC_DB_PASSWORD" + - sourceRef: + generatorRef: + apiVersion: generators.external-secrets.io/v1alpha1 + kind: Password + name: keycloak + rewrite: + - transform: + template: "USER_PASSWORD" +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: eso-store + namespace: keycloak +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + namespace: keycloak + name: eso-store +rules: + - apiGroups: [""] + resources: + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - authorization.k8s.io + resources: + - selfsubjectrulesreviews + verbs: + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: eso-store + namespace: keycloak +subjects: + - kind: ServiceAccount + name: eso-store + namespace: keycloak +roleRef: + kind: Role + name: eso-store + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: keycloak +spec: + provider: + kubernetes: + remoteNamespace: keycloak + server: + caProvider: + type: ConfigMap + name: kube-root-ca.crt + namespace: keycloak + key: ca.crt + auth: + serviceAccount: + name: eso-store + namespace: keycloak +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: eso-store + namespace: gitea +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: eso-store + namespace: gitea +rules: + - apiGroups: [""] + resources: + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - authorization.k8s.io + resources: + - selfsubjectrulesreviews + verbs: + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: eso-store + namespace: gitea +subjects: + - kind: ServiceAccount + name: eso-store + namespace: gitea +roleRef: + kind: Role + name: eso-store + apiGroup: rbac.authorization.k8s.io +--- +apiVersion: external-secrets.io/v1beta1 +kind: ClusterSecretStore +metadata: + name: gitea +spec: + provider: + kubernetes: + remoteNamespace: gitea + server: + caProvider: + type: ConfigMap + name: kube-root-ca.crt + namespace: gitea + key: ca.crt + auth: + serviceAccount: + name: eso-store + namespace: gitea From 6157854f504926991192fffd7bc524537c27961d Mon Sep 17 00:00:00 2001 From: miwr Date: Mon, 11 Nov 2024 14:54:14 +0100 Subject: [PATCH 08/18] test --- .../entities/catalog-info_20241111142553.yaml | 19 ++++++++++++++++++ .../entities/catalog-info_20241111145410.yaml | 20 +++++++++++++++++++ .../entities/catalog-info.yaml | 1 + 3 files changed, 40 insertions(+) create mode 100644 .history/ref-implementation/backstage-templates/entities/catalog-info_20241111142553.yaml create mode 100644 .history/ref-implementation/backstage-templates/entities/catalog-info_20241111145410.yaml diff --git a/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111142553.yaml b/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111142553.yaml new file mode 100644 index 0000000..f49a7bb --- /dev/null +++ b/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111142553.yaml @@ -0,0 +1,19 @@ +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-example-templates + description: A collection of example templates +spec: + targets: + - ./basic/template.yaml + - ./argo-workflows/template.yaml + - ./app-with-bucket/template.yaml +--- +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-organization + description: Basic organization data +spec: + targets: + - ./organization/guests.yaml diff --git a/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145410.yaml b/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145410.yaml new file mode 100644 index 0000000..ff05253 --- /dev/null +++ b/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145410.yaml @@ -0,0 +1,20 @@ +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-example-templates + description: A collection of example templates +spec: + targets: + - ./basic/template.yaml + - ./argo-workflows/template.yaml + - ./app-with-bucket/template.yaml + - ./app-with-bucket/template.yaml +--- +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-organization + description: Basic organization data +spec: + targets: + - ./organization/guests.yaml diff --git a/ref-implementation/backstage-templates/entities/catalog-info.yaml b/ref-implementation/backstage-templates/entities/catalog-info.yaml index f49a7bb..ff05253 100644 --- a/ref-implementation/backstage-templates/entities/catalog-info.yaml +++ b/ref-implementation/backstage-templates/entities/catalog-info.yaml @@ -8,6 +8,7 @@ spec: - ./basic/template.yaml - ./argo-workflows/template.yaml - ./app-with-bucket/template.yaml + - ./app-with-bucket/template.yaml --- apiVersion: backstage.io/v1alpha1 kind: Location From 2d083b9f40609ae8e1ce1b414066bf19c7ec3c32 Mon Sep 17 00:00:00 2001 From: miwr Date: Mon, 11 Nov 2024 14:55:28 +0100 Subject: [PATCH 09/18] template --- .../entities/catalog-info_20241111145445.yaml | 19 ++++++ .../entities/catalog-info_20241111145519.yaml | 21 +++++++ .../entities/catalog-info_20241111145520.yaml | 21 +++++++ .../entities/catalog-info_20241111145522.yaml | 20 +++++++ .../entities/basic/template2.yaml | 58 +++++++++++++++++++ .../entities/catalog-info.yaml | 2 +- 6 files changed, 140 insertions(+), 1 deletion(-) create mode 100644 .history/ref-implementation/backstage-templates/entities/catalog-info_20241111145445.yaml create mode 100644 .history/ref-implementation/backstage-templates/entities/catalog-info_20241111145519.yaml create mode 100644 .history/ref-implementation/backstage-templates/entities/catalog-info_20241111145520.yaml create mode 100644 .history/ref-implementation/backstage-templates/entities/catalog-info_20241111145522.yaml create mode 100644 ref-implementation/backstage-templates/entities/basic/template2.yaml diff --git a/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145445.yaml b/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145445.yaml new file mode 100644 index 0000000..f49a7bb --- /dev/null +++ b/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145445.yaml @@ -0,0 +1,19 @@ +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-example-templates + description: A collection of example templates +spec: + targets: + - ./basic/template.yaml + - ./argo-workflows/template.yaml + - ./app-with-bucket/template.yaml +--- +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-organization + description: Basic organization data +spec: + targets: + - ./organization/guests.yaml diff --git a/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145519.yaml b/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145519.yaml new file mode 100644 index 0000000..740bc62 --- /dev/null +++ b/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145519.yaml @@ -0,0 +1,21 @@ +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-example-templates + description: A collection of example templates +spec: + targets: + - ./basic/template.yaml + + - ./basic/template.yaml + - ./argo-workflows/template.yaml + - ./app-with-bucket/template.yaml +--- +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-organization + description: Basic organization data +spec: + targets: + - ./organization/guests.yaml diff --git a/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145520.yaml b/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145520.yaml new file mode 100644 index 0000000..8e7eff6 --- /dev/null +++ b/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145520.yaml @@ -0,0 +1,21 @@ +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-example-templates + description: A collection of example templates +spec: + targets: + - ./basic/template.yaml + + - ./basic/template2.yaml + - ./argo-workflows/template.yaml + - ./app-with-bucket/template.yaml +--- +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-organization + description: Basic organization data +spec: + targets: + - ./organization/guests.yaml diff --git a/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145522.yaml b/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145522.yaml new file mode 100644 index 0000000..3bf5a42 --- /dev/null +++ b/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145522.yaml @@ -0,0 +1,20 @@ +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-example-templates + description: A collection of example templates +spec: + targets: + - ./basic/template.yaml + - ./basic/template2.yaml + - ./argo-workflows/template.yaml + - ./app-with-bucket/template.yaml +--- +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-organization + description: Basic organization data +spec: + targets: + - ./organization/guests.yaml diff --git a/ref-implementation/backstage-templates/entities/basic/template2.yaml b/ref-implementation/backstage-templates/entities/basic/template2.yaml new file mode 100644 index 0000000..f75743b --- /dev/null +++ b/ref-implementation/backstage-templates/entities/basic/template2.yaml @@ -0,0 +1,58 @@ +apiVersion: scaffolder.backstage.io/v1beta3 +kind: Template +metadata: + description: Creates a Basic Kubernetes Deployment + name: basic + title: Create a Basic Deployment +spec: + owner: guests + type: service + parameters: + - title: Configuration Options + required: + - name + properties: + name: + type: string + description: name of this application + + steps: + - id: template + name: Generating component + action: fetch:template + input: + url: ./skeleton + values: + name: ${{parameters.name}} + + - id: publish + name: Publishing to a gitea git repository + action: publish:gitea + input: + description: This is an example app + # Hard coded value for this demo purposes only. + repoUrl: cnoe.localtest.me:8443/gitea?repo=${{parameters.name}} + defaultBranch: main + - id: create-argocd-app + name: Create ArgoCD App + action: cnoe:create-argocd-app + input: + appName: ${{parameters.name}} + appNamespace: ${{parameters.name}} + argoInstance: in-cluster + projectName: default + # necessary until we generate our own cert + repoUrl: https://cnoe.localtest.me:8443/gitea/giteaAdmin/${{parameters.name}} + path: "manifests" + - id: register + name: Register + action: catalog:register + input: + repoContentsUrl: ${{ steps['publish'].output.repoContentsUrl }} + catalogInfoPath: 'catalog-info.yaml' + + output: + links: + - title: Open in catalog + icon: catalog + entityRef: ${{ steps['register'].output.entityRef }} diff --git a/ref-implementation/backstage-templates/entities/catalog-info.yaml b/ref-implementation/backstage-templates/entities/catalog-info.yaml index ff05253..3bf5a42 100644 --- a/ref-implementation/backstage-templates/entities/catalog-info.yaml +++ b/ref-implementation/backstage-templates/entities/catalog-info.yaml @@ -6,9 +6,9 @@ metadata: spec: targets: - ./basic/template.yaml + - ./basic/template2.yaml - ./argo-workflows/template.yaml - ./app-with-bucket/template.yaml - - ./app-with-bucket/template.yaml --- apiVersion: backstage.io/v1alpha1 kind: Location From 2a6b10f007e85ea3b2cbb330072f491aa8e78cb8 Mon Sep 17 00:00:00 2001 From: miwr Date: Tue, 12 Nov 2024 10:40:11 +0100 Subject: [PATCH 10/18] let's go --- .../entities/catalog-info_20241111145551.yaml | 19 ++++++ .../openbao_20241111150421.yaml | 21 +++++++ .../openbao_20241111150423.yaml | 21 +++++++ .../openbao_20241112103833.yaml | 19 ++++++ .../openbao_20241112103904.yaml | 19 ++++++ .../openbao_20241112103909.yaml | 19 ++++++ .../openbao_20241112103930.yaml | 19 ++++++ .../openbao_20241112103938.yaml | 19 ++++++ .../openbao_20241112103940.yaml | 19 ++++++ .../entities/basic/template2.yaml | 58 ------------------- .../entities/catalog-info.yaml | 1 - ref-implementation/openbao.yaml | 8 +-- 12 files changed, 178 insertions(+), 64 deletions(-) create mode 100644 .history/ref-implementation/backstage-templates/entities/catalog-info_20241111145551.yaml create mode 100644 .history/ref-implementation/openbao_20241111150421.yaml create mode 100644 .history/ref-implementation/openbao_20241111150423.yaml create mode 100644 .history/ref-implementation/openbao_20241112103833.yaml create mode 100644 .history/ref-implementation/openbao_20241112103904.yaml create mode 100644 .history/ref-implementation/openbao_20241112103909.yaml create mode 100644 .history/ref-implementation/openbao_20241112103930.yaml create mode 100644 .history/ref-implementation/openbao_20241112103938.yaml create mode 100644 .history/ref-implementation/openbao_20241112103940.yaml delete mode 100644 ref-implementation/backstage-templates/entities/basic/template2.yaml diff --git a/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145551.yaml b/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145551.yaml new file mode 100644 index 0000000..f49a7bb --- /dev/null +++ b/.history/ref-implementation/backstage-templates/entities/catalog-info_20241111145551.yaml @@ -0,0 +1,19 @@ +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-example-templates + description: A collection of example templates +spec: + targets: + - ./basic/template.yaml + - ./argo-workflows/template.yaml + - ./app-with-bucket/template.yaml +--- +apiVersion: backstage.io/v1alpha1 +kind: Location +metadata: + name: basic-organization + description: Basic organization data +spec: + targets: + - ./organization/guests.yaml diff --git a/.history/ref-implementation/openbao_20241111150421.yaml b/.history/ref-implementation/openbao_20241111150421.yaml new file mode 100644 index 0000000..ecce75a --- /dev/null +++ b/.history/ref-implementation/openbao_20241111150421.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd + labels: + example: dev +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://openbao/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241111150423.yaml b/.history/ref-implementation/openbao_20241111150423.yaml new file mode 100644 index 0000000..8a632d4 --- /dev/null +++ b/.history/ref-implementation/openbao_20241111150423.yaml @@ -0,0 +1,21 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd + labels: + env: dev +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://openbao/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241112103833.yaml b/.history/ref-implementation/openbao_20241112103833.yaml new file mode 100644 index 0000000..d06ab5e --- /dev/null +++ b/.history/ref-implementation/openbao_20241112103833.yaml @@ -0,0 +1,19 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://openbao/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241112103904.yaml b/.history/ref-implementation/openbao_20241112103904.yaml new file mode 100644 index 0000000..8bcfa6f --- /dev/null +++ b/.history/ref-implementation/openbao_20241112103904.yaml @@ -0,0 +1,19 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + repoURL: 'https://github.com/openbao/openbao.git' + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241112103909.yaml b/.history/ref-implementation/openbao_20241112103909.yaml new file mode 100644 index 0000000..997633d --- /dev/null +++ b/.history/ref-implementation/openbao_20241112103909.yaml @@ -0,0 +1,19 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + repoURL: 'https://github.com/openbao/openbao.git' + targetRevision: main + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241112103930.yaml b/.history/ref-implementation/openbao_20241112103930.yaml new file mode 100644 index 0000000..8d19f61 --- /dev/null +++ b/.history/ref-implementation/openbao_20241112103930.yaml @@ -0,0 +1,19 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + repoURL: 'https://github.com/openbao/openbao.git' + targetRevision: main + path: "openbao" + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241112103938.yaml b/.history/ref-implementation/openbao_20241112103938.yaml new file mode 100644 index 0000000..76b59a3 --- /dev/null +++ b/.history/ref-implementation/openbao_20241112103938.yaml @@ -0,0 +1,19 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + repoURL: 'https://github.com/openbao/openbao.git' + targetRevision: main + path: "openbao" + + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241112103940.yaml b/.history/ref-implementation/openbao_20241112103940.yaml new file mode 100644 index 0000000..8d19f61 --- /dev/null +++ b/.history/ref-implementation/openbao_20241112103940.yaml @@ -0,0 +1,19 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + repoURL: 'https://github.com/openbao/openbao.git' + targetRevision: main + path: "openbao" + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/ref-implementation/backstage-templates/entities/basic/template2.yaml b/ref-implementation/backstage-templates/entities/basic/template2.yaml deleted file mode 100644 index f75743b..0000000 --- a/ref-implementation/backstage-templates/entities/basic/template2.yaml +++ /dev/null @@ -1,58 +0,0 @@ -apiVersion: scaffolder.backstage.io/v1beta3 -kind: Template -metadata: - description: Creates a Basic Kubernetes Deployment - name: basic - title: Create a Basic Deployment -spec: - owner: guests - type: service - parameters: - - title: Configuration Options - required: - - name - properties: - name: - type: string - description: name of this application - - steps: - - id: template - name: Generating component - action: fetch:template - input: - url: ./skeleton - values: - name: ${{parameters.name}} - - - id: publish - name: Publishing to a gitea git repository - action: publish:gitea - input: - description: This is an example app - # Hard coded value for this demo purposes only. - repoUrl: cnoe.localtest.me:8443/gitea?repo=${{parameters.name}} - defaultBranch: main - - id: create-argocd-app - name: Create ArgoCD App - action: cnoe:create-argocd-app - input: - appName: ${{parameters.name}} - appNamespace: ${{parameters.name}} - argoInstance: in-cluster - projectName: default - # necessary until we generate our own cert - repoUrl: https://cnoe.localtest.me:8443/gitea/giteaAdmin/${{parameters.name}} - path: "manifests" - - id: register - name: Register - action: catalog:register - input: - repoContentsUrl: ${{ steps['publish'].output.repoContentsUrl }} - catalogInfoPath: 'catalog-info.yaml' - - output: - links: - - title: Open in catalog - icon: catalog - entityRef: ${{ steps['register'].output.entityRef }} diff --git a/ref-implementation/backstage-templates/entities/catalog-info.yaml b/ref-implementation/backstage-templates/entities/catalog-info.yaml index 3bf5a42..f49a7bb 100644 --- a/ref-implementation/backstage-templates/entities/catalog-info.yaml +++ b/ref-implementation/backstage-templates/entities/catalog-info.yaml @@ -6,7 +6,6 @@ metadata: spec: targets: - ./basic/template.yaml - - ./basic/template2.yaml - ./argo-workflows/template.yaml - ./app-with-bucket/template.yaml --- diff --git a/ref-implementation/openbao.yaml b/ref-implementation/openbao.yaml index 8a632d4..8d19f61 100644 --- a/ref-implementation/openbao.yaml +++ b/ref-implementation/openbao.yaml @@ -3,16 +3,14 @@ kind: Application metadata: name: openbao namespace: argocd - labels: - env: dev spec: destination: namespace: openbao server: "https://kubernetes.default.svc" source: - repoURL: cnoe://openbao/manifests - targetRevision: HEAD - path: "." + repoURL: 'https://github.com/openbao/openbao.git' + targetRevision: main + path: "openbao" project: default syncPolicy: automated: From 67a67174a598e506912a1f5476093d11d67bf2f2 Mon Sep 17 00:00:00 2001 From: miwr Date: Tue, 12 Nov 2024 11:15:26 +0100 Subject: [PATCH 11/18] hopefully it will work now --- .../maniek_20241112110416.yml | 0 .../maniek_20241112110417.yml | 35 ++ .../manifests/manifest_20241112110416.yml | 35 ++ .../manifests/manifest_20241112110859.yml | 35 ++ .../manifests/manifest_20241112110906.yml | 35 ++ .../manifests/manifest_20241112110950.yml | 41 ++ .../manifests/manifest_20241112110952.yml | 35 ++ .../manifests/manifest_20241112110953.yml | 35 ++ .../openbao_20241112110613.yaml | 19 + .../openbao_20241112110615.yaml | 19 + .../openbao_20241112110641.yaml | 19 + .../openbao_20241112110645.yaml | 19 + .../openbao_20241112110651.yaml | 19 + .../openbao_20241112110747.yaml | 19 + .../openbao_20241112110753.yaml | 19 + ref-implementation/openbao.yaml | 6 +- .../openbao/manifests/ingress.yaml | 30 -- .../openbao/manifests/install.yaml | 164 -------- .../openbao/manifests/keycloak-config.yaml | 366 ------------------ .../openbao/manifests/manifest.yml | 35 ++ .../openbao/manifests/secret-gen.yaml | 179 --------- 21 files changed, 422 insertions(+), 742 deletions(-) create mode 100644 .history/ref-implementation/maniek_20241112110416.yml create mode 100644 .history/ref-implementation/maniek_20241112110417.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112110416.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112110859.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112110906.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112110950.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112110952.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112110953.yml create mode 100644 .history/ref-implementation/openbao_20241112110613.yaml create mode 100644 .history/ref-implementation/openbao_20241112110615.yaml create mode 100644 .history/ref-implementation/openbao_20241112110641.yaml create mode 100644 .history/ref-implementation/openbao_20241112110645.yaml create mode 100644 .history/ref-implementation/openbao_20241112110651.yaml create mode 100644 .history/ref-implementation/openbao_20241112110747.yaml create mode 100644 .history/ref-implementation/openbao_20241112110753.yaml delete mode 100644 ref-implementation/openbao/manifests/ingress.yaml delete mode 100644 ref-implementation/openbao/manifests/install.yaml delete mode 100644 ref-implementation/openbao/manifests/keycloak-config.yaml create mode 100644 ref-implementation/openbao/manifests/manifest.yml delete mode 100644 ref-implementation/openbao/manifests/secret-gen.yaml diff --git a/.history/ref-implementation/maniek_20241112110416.yml b/.history/ref-implementation/maniek_20241112110416.yml new file mode 100644 index 0000000..e69de29 diff --git a/.history/ref-implementation/maniek_20241112110417.yml b/.history/ref-implementation/maniek_20241112110417.yml new file mode 100644 index 0000000..81ab8ad --- /dev/null +++ b/.history/ref-implementation/maniek_20241112110417.yml @@ -0,0 +1,35 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8080 + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 80 + targetPort: 8080 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112110416.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112110416.yml new file mode 100644 index 0000000..81ab8ad --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112110416.yml @@ -0,0 +1,35 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8080 + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 80 + targetPort: 8080 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112110859.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112110859.yml new file mode 100644 index 0000000..d68ae99 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112110859.yml @@ -0,0 +1,35 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8200 + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 80 + targetPort: 8080 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112110906.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112110906.yml new file mode 100644 index 0000000..3f9ba3f --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112110906.yml @@ -0,0 +1,35 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8200 + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 80 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112110950.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112110950.yml new file mode 100644 index 0000000..9fdb23b --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112110950.yml @@ -0,0 +1,41 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8200 + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 80 + targetPort: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112110952.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112110952.yml new file mode 100644 index 0000000..3f9ba3f --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112110952.yml @@ -0,0 +1,35 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8200 + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 80 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112110953.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112110953.yml new file mode 100644 index 0000000..8ec577d --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112110953.yml @@ -0,0 +1,35 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8200 + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao_20241112110613.yaml b/.history/ref-implementation/openbao_20241112110613.yaml new file mode 100644 index 0000000..0ff12a4 --- /dev/null +++ b/.history/ref-implementation/openbao_20241112110613.yaml @@ -0,0 +1,19 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + //repoURL: 'https://github.com/openbao/openbao.git' + targetRevision: main + path: "openbao" + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241112110615.yaml b/.history/ref-implementation/openbao_20241112110615.yaml new file mode 100644 index 0000000..dd920ca --- /dev/null +++ b/.history/ref-implementation/openbao_20241112110615.yaml @@ -0,0 +1,19 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + # repoURL: 'https://github.com/openbao/openbao.git' + targetRevision: main + path: "openbao" + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241112110641.yaml b/.history/ref-implementation/openbao_20241112110641.yaml new file mode 100644 index 0000000..8d19f61 --- /dev/null +++ b/.history/ref-implementation/openbao_20241112110641.yaml @@ -0,0 +1,19 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + repoURL: 'https://github.com/openbao/openbao.git' + targetRevision: main + path: "openbao" + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241112110645.yaml b/.history/ref-implementation/openbao_20241112110645.yaml new file mode 100644 index 0000000..acc1c64 --- /dev/null +++ b/.history/ref-implementation/openbao_20241112110645.yaml @@ -0,0 +1,19 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://keycloak/manifests + targetRevision: main + path: "openbao" + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241112110651.yaml b/.history/ref-implementation/openbao_20241112110651.yaml new file mode 100644 index 0000000..627b1fd --- /dev/null +++ b/.history/ref-implementation/openbao_20241112110651.yaml @@ -0,0 +1,19 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://keycloak/manifests + targetRevision: main + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241112110747.yaml b/.history/ref-implementation/openbao_20241112110747.yaml new file mode 100644 index 0000000..e398adc --- /dev/null +++ b/.history/ref-implementation/openbao_20241112110747.yaml @@ -0,0 +1,19 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://keycloak/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/.history/ref-implementation/openbao_20241112110753.yaml b/.history/ref-implementation/openbao_20241112110753.yaml new file mode 100644 index 0000000..d06ab5e --- /dev/null +++ b/.history/ref-implementation/openbao_20241112110753.yaml @@ -0,0 +1,19 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: openbao + namespace: argocd +spec: + destination: + namespace: openbao + server: "https://kubernetes.default.svc" + source: + repoURL: cnoe://openbao/manifests + targetRevision: HEAD + path: "." + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true diff --git a/ref-implementation/openbao.yaml b/ref-implementation/openbao.yaml index 8d19f61..d06ab5e 100644 --- a/ref-implementation/openbao.yaml +++ b/ref-implementation/openbao.yaml @@ -8,9 +8,9 @@ spec: namespace: openbao server: "https://kubernetes.default.svc" source: - repoURL: 'https://github.com/openbao/openbao.git' - targetRevision: main - path: "openbao" + repoURL: cnoe://openbao/manifests + targetRevision: HEAD + path: "." project: default syncPolicy: automated: diff --git a/ref-implementation/openbao/manifests/ingress.yaml b/ref-implementation/openbao/manifests/ingress.yaml deleted file mode 100644 index abaf181..0000000 --- a/ref-implementation/openbao/manifests/ingress.yaml +++ /dev/null @@ -1,30 +0,0 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - name: keycloak-ingress-localhost - namespace: keycloak - annotations: - argocd.argoproj.io/sync-wave: "100" -spec: - ingressClassName: "nginx" - rules: - - host: localhost - http: - paths: - - path: /keycloak - pathType: ImplementationSpecific - backend: - service: - name: keycloak - port: - name: http - - host: cnoe.localtest.me - http: - paths: - - path: /keycloak - pathType: ImplementationSpecific - backend: - service: - name: keycloak - port: - name: http diff --git a/ref-implementation/openbao/manifests/install.yaml b/ref-implementation/openbao/manifests/install.yaml deleted file mode 100644 index ed3b799..0000000 --- a/ref-implementation/openbao/manifests/install.yaml +++ /dev/null @@ -1,164 +0,0 @@ ---- -apiVersion: v1 -kind: Namespace -metadata: - name: keycloak ---- -apiVersion: v1 -kind: Service -metadata: - name: keycloak - labels: - app: keycloak -spec: - ports: - - name: http - port: 8080 - targetPort: 8080 - selector: - app: keycloak - type: ClusterIP ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - labels: - app: keycloak - name: keycloak - namespace: keycloak - annotations: - argocd.argoproj.io/sync-wave: "10" -spec: - replicas: 1 - selector: - matchLabels: - app: keycloak - template: - metadata: - labels: - app: keycloak - spec: - containers: - - args: - - start-dev - env: - - name: KEYCLOAK_ADMIN - value: cnoe-admin - - name: KEYCLOAK_LOGLEVEL - value: ALL - - name: QUARKUS_TRANSACTION_MANAGER_ENABLE_RECOVERY - value: 'true' - envFrom: - - secretRef: - name: keycloak-config - image: quay.io/keycloak/keycloak:22.0.3 - name: keycloak - ports: - - containerPort: 8080 - name: http - readinessProbe: - httpGet: - path: /keycloak/realms/master - port: 8080 - volumeMounts: - - mountPath: /opt/keycloak/conf - name: keycloak-config - readOnly: true - volumes: - - configMap: - name: keycloak-config - name: keycloak-config ---- -apiVersion: v1 -data: - keycloak.conf: | - # Database - # The database vendor. - db=postgres - - # The username of the database user. - db-url=jdbc:postgresql://postgresql.keycloak.svc.cluster.local:5432/postgres - - # The proxy address forwarding mode if the server is behind a reverse proxy. - proxy=edge - - # hostname configuration - hostname=cnoe.localtest.me - hostname-port=8443 - http-relative-path=keycloak - - # the admin url requires its own configuration to reflect correct url - hostname-admin=cnoe.localtest.me:8443 - - hostname-debug=true - - # this should only be allowed in development. NEVER in production. - hostname-strict=false - hostname-strict-backchannel=false - - -kind: ConfigMap -metadata: - name: keycloak-config - namespace: keycloak ---- -apiVersion: v1 -kind: Service -metadata: - labels: - app: postgresql - name: postgresql - namespace: keycloak -spec: - clusterIP: None - ports: - - name: postgres - port: 5432 - selector: - app: postgresql ---- -apiVersion: apps/v1 -kind: StatefulSet -metadata: - labels: - app: postgresql - name: postgresql - namespace: keycloak -spec: - replicas: 1 - selector: - matchLabels: - app: postgresql - serviceName: service-postgresql - template: - metadata: - labels: - app: postgresql - spec: - containers: - - envFrom: - - secretRef: - name: keycloak-config - image: docker.io/library/postgres:15.3-alpine3.18 - name: postgres - ports: - - containerPort: 5432 - name: postgresdb - resources: - limits: - memory: 500Mi - requests: - cpu: 100m - memory: 300Mi - volumeMounts: - - name: data - mountPath: /var/lib/postgresql/data - volumeClaimTemplates: - - metadata: - name: data - spec: - accessModes: ["ReadWriteOnce"] - resources: - requests: - storage: "500Mi" - diff --git a/ref-implementation/openbao/manifests/keycloak-config.yaml b/ref-implementation/openbao/manifests/keycloak-config.yaml deleted file mode 100644 index 4bb098e..0000000 --- a/ref-implementation/openbao/manifests/keycloak-config.yaml +++ /dev/null @@ -1,366 +0,0 @@ -# resources here are used to configure keycloak instance for SSO -apiVersion: v1 -kind: ServiceAccount -metadata: - name: keycloak-config - namespace: keycloak ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: keycloak-config - namespace: keycloak -rules: - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get", "create", "update", "patch"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: keycloak-config - namespace: keycloak -subjects: - - kind: ServiceAccount - name: keycloak-config - namespace: keycloak -roleRef: - kind: Role - name: keycloak-config - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: keycloak-config - namespace: argocd -rules: - - apiGroups: [""] - resources: ["secrets"] - verbs: ["get"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: keycloak-config - namespace: argocd -subjects: - - kind: ServiceAccount - name: keycloak-config - namespace: keycloak -roleRef: - kind: Role - name: keycloak-config - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: config-job - namespace: keycloak -data: - client-scope-groups-payload.json: | - { - "name": "groups", - "description": "groups a user belongs to", - "attributes": { - "consent.screen.text": "Access to groups a user belongs to.", - "display.on.consent.screen": "true", - "include.in.token.scope": "true", - "gui.order": "" - }, - "type": "default", - "protocol": "openid-connect" - } - group-admin-payload.json: | - {"name":"admin"} - group-base-user-payload.json: | - {"name":"base-user"} - group-mapper-payload.json: | - { - "protocol": "openid-connect", - "protocolMapper": "oidc-group-membership-mapper", - "name": "groups", - "config": { - "claim.name": "groups", - "full.path": "false", - "id.token.claim": "true", - "access.token.claim": "true", - "userinfo.token.claim": "true" - } - } - realm-payload.json: | - {"realm":"cnoe","enabled":true} - user-password.json: | - { - "temporary": false, - "type": "password", - "value": "${USER1_PASSWORD}" - } - user-user1.json: | - { - "username": "user1", - "email": "", - "firstName": "user", - "lastName": "one", - "requiredActions": [], - "emailVerified": false, - "groups": [ - "/admin" - ], - "enabled": true - } - user-user2.json: | - { - "username": "user2", - "email": "", - "firstName": "user", - "lastName": "two", - "requiredActions": [], - "emailVerified": false, - "groups": [ - "/base-user" - ], - "enabled": true - } - argo-client-payload.json: | - { - "protocol": "openid-connect", - "clientId": "argo-workflows", - "name": "Argo Workflows Client", - "description": "Used for Argo Workflows SSO", - "publicClient": false, - "authorizationServicesEnabled": false, - "serviceAccountsEnabled": false, - "implicitFlowEnabled": false, - "directAccessGrantsEnabled": true, - "standardFlowEnabled": true, - "frontchannelLogout": true, - "attributes": { - "saml_idp_initiated_sso_url_name": "", - "oauth2.device.authorization.grant.enabled": false, - "oidc.ciba.grant.enabled": false - }, - "alwaysDisplayInConsole": false, - "rootUrl": "", - "baseUrl": "", - "redirectUris": [ - "https://cnoe.localtest.me:8443/argo-workflows/oauth2/callback" - ], - "webOrigins": [ - "/*" - ] - } - - backstage-client-payload.json: | - { - "protocol": "openid-connect", - "clientId": "backstage", - "name": "Backstage Client", - "description": "Used for Backstage SSO", - "publicClient": false, - "authorizationServicesEnabled": false, - "serviceAccountsEnabled": false, - "implicitFlowEnabled": false, - "directAccessGrantsEnabled": true, - "standardFlowEnabled": true, - "frontchannelLogout": true, - "attributes": { - "saml_idp_initiated_sso_url_name": "", - "oauth2.device.authorization.grant.enabled": false, - "oidc.ciba.grant.enabled": false - }, - "alwaysDisplayInConsole": false, - "rootUrl": "", - "baseUrl": "", - "redirectUris": [ - "https://cnoe.localtest.me:8443/api/auth/keycloak-oidc/handler/frame" - ], - "webOrigins": [ - "/*" - ] - } - ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: config - namespace: keycloak - annotations: - argocd.argoproj.io/hook: PostSync -spec: - template: - metadata: - generateName: config - spec: - serviceAccountName: keycloak-config - restartPolicy: Never - volumes: - - name: keycloak-config - secret: - secretName: keycloak-config - - name: config-payloads - configMap: - name: config-job - containers: - - name: kubectl - image: docker.io/library/ubuntu:22.04 - volumeMounts: - - name: keycloak-config - readOnly: true - mountPath: "/var/secrets/" - - name: config-payloads - readOnly: true - mountPath: "/var/config/" - command: ["/bin/bash", "-c"] - args: - - | - #! /bin/bash - - set -ex -o pipefail - - apt -qq update && apt -qq install curl jq -y - - ADMIN_PASSWORD=$(cat /var/secrets/KEYCLOAK_ADMIN_PASSWORD) - USER1_PASSWORD=$(cat /var/secrets/USER_PASSWORD) - - KEYCLOAK_URL=http://keycloak.keycloak.svc.cluster.local:8080/keycloak - - KEYCLOAK_TOKEN=$(curl -sS --fail-with-body -X POST -H "Content-Type: application/x-www-form-urlencoded" \ - --data-urlencode "username=cnoe-admin" \ - --data-urlencode "password=${ADMIN_PASSWORD}" \ - --data-urlencode "grant_type=password" \ - --data-urlencode "client_id=admin-cli" \ - ${KEYCLOAK_URL}/realms/master/protocol/openid-connect/token | jq -e -r '.access_token') - - set +e - - curl --fail-with-body -H "Authorization: bearer ${KEYCLOAK_TOKEN}" "${KEYCLOAK_URL}/admin/realms/cnoe" &> /dev/null - if [ $? -eq 0 ]; then - exit 0 - fi - set -e - - curl -sS -LO "https://dl.k8s.io/release/v1.28.3//bin/linux/amd64/kubectl" - chmod +x kubectl - - echo "creating cnoe realm and groups" - - curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @/var/config/realm-payload.json \ - ${KEYCLOAK_URL}/admin/realms - - curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @/var/config/client-scope-groups-payload.json \ - ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes - - curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @/var/config/group-admin-payload.json \ - ${KEYCLOAK_URL}/admin/realms/cnoe/groups - - curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @/var/config/group-base-user-payload.json \ - ${KEYCLOAK_URL}/admin/realms/cnoe/groups - - # Create scope mapper - echo 'adding group claim to tokens' - CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r '.[] | select(.name == "groups") | .id') - - curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @/var/config/group-mapper-payload.json \ - ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes/${CLIENT_SCOPE_GROUPS_ID}/protocol-mappers/models - - echo "creating test users" - curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @/var/config/user-user1.json \ - ${KEYCLOAK_URL}/admin/realms/cnoe/users - - curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @/var/config/user-user2.json \ - ${KEYCLOAK_URL}/admin/realms/cnoe/users - - USER1ID=$(curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" "${KEYCLOAK_URL}/admin/realms/cnoe/users?lastName=one" | jq -r '.[0].id') - USER2ID=$(curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" "${KEYCLOAK_URL}/admin/realms/cnoe/users?lastName=two" | jq -r '.[0].id') - - echo "setting user passwords" - jq -r --arg pass ${USER1_PASSWORD} '.value = $pass' /var/config/user-password.json > /tmp/user-password-to-be-applied.json - - curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X PUT --data @/tmp/user-password-to-be-applied.json \ - ${KEYCLOAK_URL}/admin/realms/cnoe/users/${USER1ID}/reset-password - - curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X PUT --data @/tmp/user-password-to-be-applied.json \ - ${KEYCLOAK_URL}/admin/realms/cnoe/users/${USER2ID}/reset-password - - echo "creating Argo Workflows client" - curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @/var/config/argo-client-payload.json \ - ${KEYCLOAK_URL}/admin/realms/cnoe/clients - - CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r '.[] | select(.clientId == "argo-workflows") | .id') - CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r '.[] | select(.name == "groups") | .id') - - curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X PUT ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID} - - ARGO_WORKFLOWS_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret') - - echo "creating Backstage client" - curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X POST --data @/var/config/backstage-client-payload.json \ - ${KEYCLOAK_URL}/admin/realms/cnoe/clients - - CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r '.[] | select(.clientId == "backstage") | .id') - - CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r '.[] | select(.name == "groups") | .id') - curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X PUT ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID} - - BACKSTAGE_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \ - -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \ - -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret') - - ARGOCD_PASSWORD=$(./kubectl -n argocd get secret argocd-initial-admin-secret -o go-template='{{.data.password | base64decode }}') - - ARGOCD_SESSION_TOKEN=$(curl -k -sS http://argocd-server.argocd.svc.cluster.local:443/api/v1/session -H 'Content-Type: application/json' -d "{\"username\":\"admin\",\"password\":\"${ARGOCD_PASSWORD}\"}" | jq -r .token) - - echo \ - "apiVersion: v1 - kind: Secret - metadata: - name: keycloak-clients - namespace: keycloak - type: Opaque - stringData: - ARGO_WORKFLOWS_CLIENT_SECRET: ${ARGO_WORKFLOWS_CLIENT_SECRET} - ARGO_WORKFLOWS_CLIENT_ID: argo-workflows - ARGOCD_SESSION_TOKEN: ${ARGOCD_SESSION_TOKEN} - BACKSTAGE_CLIENT_SECRET: ${BACKSTAGE_CLIENT_SECRET} - BACKSTAGE_CLIENT_ID: backstage - " > /tmp/secret.yaml - - ./kubectl apply -f /tmp/secret.yaml - diff --git a/ref-implementation/openbao/manifests/manifest.yml b/ref-implementation/openbao/manifests/manifest.yml new file mode 100644 index 0000000..8ec577d --- /dev/null +++ b/ref-implementation/openbao/manifests/manifest.yml @@ -0,0 +1,35 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8200 + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/ref-implementation/openbao/manifests/secret-gen.yaml b/ref-implementation/openbao/manifests/secret-gen.yaml deleted file mode 100644 index f7bf8c9..0000000 --- a/ref-implementation/openbao/manifests/secret-gen.yaml +++ /dev/null @@ -1,179 +0,0 @@ -apiVersion: generators.external-secrets.io/v1alpha1 -kind: Password -metadata: - name: keycloak - namespace: keycloak -spec: - length: 36 - digits: 5 - symbols: 5 - symbolCharacters: "/-+" - noUpper: false - allowRepeat: true ---- -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: keycloak-config - namespace: keycloak -spec: - refreshInterval: "0" - target: - name: keycloak-config - template: - metadata: - labels: - cnoe.io/cli-secret: "true" - cnoe.io/package-name: keycloak - engineVersion: v2 - data: - KEYCLOAK_ADMIN_PASSWORD: "{{.KEYCLOAK_ADMIN_PASSWORD}}" - KC_DB_USERNAME: keycloak - KC_DB_PASSWORD: "{{.KC_DB_PASSWORD}}" - POSTGRES_DB: keycloak - POSTGRES_USER: keycloak - POSTGRES_PASSWORD: "{{.KC_DB_PASSWORD}}" - USER_PASSWORD: "{{.USER_PASSWORD}}" - dataFrom: - - sourceRef: - generatorRef: - apiVersion: generators.external-secrets.io/v1alpha1 - kind: Password - name: keycloak - rewrite: - - transform: - template: "KEYCLOAK_ADMIN_PASSWORD" - - sourceRef: - generatorRef: - apiVersion: generators.external-secrets.io/v1alpha1 - kind: Password - name: keycloak - rewrite: - - transform: - template: "KC_DB_PASSWORD" - - sourceRef: - generatorRef: - apiVersion: generators.external-secrets.io/v1alpha1 - kind: Password - name: keycloak - rewrite: - - transform: - template: "USER_PASSWORD" ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: eso-store - namespace: keycloak ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - namespace: keycloak - name: eso-store -rules: - - apiGroups: [""] - resources: - - secrets - verbs: - - get - - list - - watch - - apiGroups: - - authorization.k8s.io - resources: - - selfsubjectrulesreviews - verbs: - - create ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: eso-store - namespace: keycloak -subjects: - - kind: ServiceAccount - name: eso-store - namespace: keycloak -roleRef: - kind: Role - name: eso-store - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: external-secrets.io/v1beta1 -kind: ClusterSecretStore -metadata: - name: keycloak -spec: - provider: - kubernetes: - remoteNamespace: keycloak - server: - caProvider: - type: ConfigMap - name: kube-root-ca.crt - namespace: keycloak - key: ca.crt - auth: - serviceAccount: - name: eso-store - namespace: keycloak ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: eso-store - namespace: gitea ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: eso-store - namespace: gitea -rules: - - apiGroups: [""] - resources: - - secrets - verbs: - - get - - list - - watch - - apiGroups: - - authorization.k8s.io - resources: - - selfsubjectrulesreviews - verbs: - - create ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: eso-store - namespace: gitea -subjects: - - kind: ServiceAccount - name: eso-store - namespace: gitea -roleRef: - kind: Role - name: eso-store - apiGroup: rbac.authorization.k8s.io ---- -apiVersion: external-secrets.io/v1beta1 -kind: ClusterSecretStore -metadata: - name: gitea -spec: - provider: - kubernetes: - remoteNamespace: gitea - server: - caProvider: - type: ConfigMap - name: kube-root-ca.crt - namespace: gitea - key: ca.crt - auth: - serviceAccount: - name: eso-store - namespace: gitea From 8720cfd633526d75a929ff12fc1362000b953f6d Mon Sep 17 00:00:00 2001 From: miwr Date: Tue, 12 Nov 2024 11:53:48 +0100 Subject: [PATCH 12/18] let's go --- .../manifests/manifest_20241112112033.yml | 42 +++++++++++++++++ .../manifests/manifest_20241112114625.yml | 43 ++++++++++++++++++ .../manifests/manifest_20241112114627.yml | 43 ++++++++++++++++++ .../manifests/manifest_20241112114630.yml | 45 +++++++++++++++++++ .../openbao/manifests/manifest.yml | 10 +++++ 5 files changed, 183 insertions(+) create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112112033.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112114625.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112114627.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112114630.yml diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112112033.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112112033.yml new file mode 100644 index 0000000..1b22ab8 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112112033.yml @@ -0,0 +1,42 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8200 + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112114625.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112114625.yml new file mode 100644 index 0000000..ad22ff4 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112114625.yml @@ -0,0 +1,43 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8200 + + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112114627.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112114627.yml new file mode 100644 index 0000000..cddcbef --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112114627.yml @@ -0,0 +1,43 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8200 + + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112114630.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112114630.yml new file mode 100644 index 0000000..aa8e5ea --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112114630.yml @@ -0,0 +1,45 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8200 + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/ref-implementation/openbao/manifests/manifest.yml b/ref-implementation/openbao/manifests/manifest.yml index 8ec577d..aa8e5ea 100644 --- a/ref-implementation/openbao/manifests/manifest.yml +++ b/ref-implementation/openbao/manifests/manifest.yml @@ -1,3 +1,10 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + apiVersion: apps/v1 kind: Deployment metadata: @@ -18,6 +25,9 @@ spec: image: openbao/openbao:latest # Replace with the actual image ports: - containerPort: 8200 + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" --- apiVersion: v1 From 575cbbbfa887fddffe2494dc27c2d6d1c0c33526 Mon Sep 17 00:00:00 2001 From: miwr Date: Tue, 12 Nov 2024 13:54:10 +0100 Subject: [PATCH 13/18] loadBalancer --- .../manifests/install_20241111142553.yaml | 164 +++++++++++++++++ .../manifests/install_20241112125306.yaml | 165 ++++++++++++++++++ .../manifests/install_20241112125311.yaml | 165 ++++++++++++++++++ .../manifests/install_20241112125315.yaml | 165 ++++++++++++++++++ .../manifests/install_20241112125321.yaml | 164 +++++++++++++++++ .../manifests/install_20241112125401.yaml | 164 +++++++++++++++++ .../manifests/install_20241112125405.yaml | 164 +++++++++++++++++ .../manifests/ingress_20241112130717.yaml | 0 .../manifests/ingress_20241112130720.yaml | 30 ++++ .../manifests/ingress_20241112130742.yaml | 27 +++ .../manifests/ingress_20241112130743.yaml | 30 ++++ .../manifests/ingress_20241112130751.yaml | 28 +++ .../manifests/ingress_20241112130756.yaml | 28 +++ .../manifests/ingress_20241112130759.yaml | 28 +++ .../manifests/ingress_20241112130902.yaml | 28 +++ .../manifests/ingress_20241112130904.yaml | 28 +++ .../manifests/ingress_20241112130913.yaml | 28 +++ .../manifests/ingress_20241112132252.yaml | 19 ++ .../manifests/ingress_20241112132258.yaml | 18 ++ .../manifests/ingress_20241112132302.yaml | 18 ++ .../manifests/ingress_20241112132304.yaml | 18 ++ .../manifests/ingress_20241112132310.yaml | 18 ++ .../manifests/ingress_20241112132312.yaml | 18 ++ .../manifests/ingress_20241112132315.yaml | 18 ++ .../manifests/ingress_20241112132318.yaml | 18 ++ .../manifests/ingress_20241112132320.yaml | 18 ++ .../manifests/ingress_20241112132340.yaml | 18 ++ .../manifests/ingress_20241112132445.yaml | 18 ++ .../manifests/ingress_20241112132617.yaml | 18 ++ .../manifests/ingress_20241112132620.yaml | 18 ++ .../manifests/ingress_20241112132622.yaml | 18 ++ .../manifests/ingress_20241112132648.yaml | 18 ++ .../manifests/ingress_20241112133726.yaml | 0 .../manifests/ingress_20241112133806.yaml | 18 ++ .../manifests/ingress_20241112135400.yaml | 18 ++ .../manifests/manifest_20241112121944.yml | 46 +++++ .../manifests/manifest_20241112121955.yml | 46 +++++ .../manifests/manifest_20241112125415.yml | 47 +++++ .../manifests/manifest_20241112125417.yml | 47 +++++ .../manifests/manifest_20241112125534.yml | 48 +++++ .../manifests/manifest_20241112125538.yml | 48 +++++ .../manifests/manifest_20241112125540.yml | 48 +++++ .../manifests/manifest_20241112125545.yml | 48 +++++ .../manifests/manifest_20241112125549.yml | 48 +++++ .../manifests/manifest_20241112125552.yml | 48 +++++ .../manifests/manifest_20241112125553.yml | 48 +++++ .../manifests/manifest_20241112125604.yml | 47 +++++ .../manifests/manifest_20241112125613.yml | 48 +++++ .../manifests/manifest_20241112125615.yml | 48 +++++ .../manifests/manifest_20241112125617.yml | 48 +++++ .../manifests/manifest_20241112125618.yml | 48 +++++ .../manifests/manifest_20241112125627.yml | 48 +++++ .../manifests/manifest_20241112125629.yml | 48 +++++ .../manifests/manifest_20241112125633.yml | 48 +++++ .../manifests/manifest_20241112133731.yml | 50 ++++++ .../manifests/manifest_20241112133734.yml | 50 ++++++ .../manifests/manifest_20241112133738.yml | 52 ++++++ .../manifests/manifest_20241112133739.yml | 70 ++++++++ .../manifests/manifest_20241112133740.yml | 70 ++++++++ .../manifests/manifest_20241112133804.yml | 48 +++++ .../manifests/manifest_20241112133833.yml | 48 +++++ .../manifests/manifest_20241112133859.yml | 48 +++++ .../manifests/manifest_20241112134239.yml | 49 ++++++ .../manifests/manifest_20241112134258.yml | 49 ++++++ .../manifests/manifest_20241112134322.yml | 49 ++++++ .../manifests/manifest_20241112134324.yml | 49 ++++++ .../manifests/manifest_20241112134335.yml | 49 ++++++ .../manifests/manifest_20241112134407.yml | 49 ++++++ .../manifests/manifest_20241112134409.yml | 49 ++++++ .../manifests/manifest_20241112134417.yml | 49 ++++++ .../manifests/manifest_20241112134421.yml | 49 ++++++ .../manifests/manifest_20241112134425.yml | 49 ++++++ .../manifests/manifest_20241112134434.yml | 49 ++++++ .../manifests/manifest_20241112134440.yml | 49 ++++++ .../manifests/manifest_20241112134443.yml | 49 ++++++ .../manifests/manifest_20241112134912.yml | 49 ++++++ .../manifests/manifest_20241112134953.yml | 49 ++++++ .../manifests/manifest_20241112135014.yml | 50 ++++++ .../manifests/manifest_20241112135016.yml | 50 ++++++ .../manifests/manifest_20241112135019.yml | 50 ++++++ .../manifests/manifest_20241112135021.yml | 50 ++++++ .../manifests/manifest_20241112135022.yml | 50 ++++++ .../manifests/manifest_20241112135048.yml | 50 ++++++ .../manifests/manifest_20241112135059.yml | 50 ++++++ .../manifests/manifest_20241112135112.yml | 50 ++++++ .../manifests/manifest_20241112135129.yml | 50 ++++++ .../manifests/manifest_20241112135138.yml | 50 ++++++ .../openbao/manifests/ingress.yaml | 18 ++ .../openbao/manifests/manifest.yml | 15 +- 89 files changed, 4317 insertions(+), 5 deletions(-) create mode 100644 .history/ref-implementation/keycloak/manifests/install_20241111142553.yaml create mode 100644 .history/ref-implementation/keycloak/manifests/install_20241112125306.yaml create mode 100644 .history/ref-implementation/keycloak/manifests/install_20241112125311.yaml create mode 100644 .history/ref-implementation/keycloak/manifests/install_20241112125315.yaml create mode 100644 .history/ref-implementation/keycloak/manifests/install_20241112125321.yaml create mode 100644 .history/ref-implementation/keycloak/manifests/install_20241112125401.yaml create mode 100644 .history/ref-implementation/keycloak/manifests/install_20241112125405.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112130717.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112130720.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112130742.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112130743.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112130751.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112130756.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112130759.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112130902.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112130904.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112130913.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112132252.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112132258.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112132302.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112132304.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112132310.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112132312.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112132315.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112132318.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112132320.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112132340.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112132445.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112132617.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112132620.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112132622.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112132648.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112133726.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112133806.yaml create mode 100644 .history/ref-implementation/openbao/manifests/ingress_20241112135400.yaml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112121944.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112121955.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125415.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125417.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125534.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125538.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125540.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125545.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125549.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125552.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125553.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125604.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125613.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125615.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125617.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125618.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125627.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125629.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112125633.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112133731.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112133734.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112133738.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112133739.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112133740.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112133804.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112133833.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112133859.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112134239.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112134258.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112134322.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112134324.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112134335.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112134407.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112134409.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112134417.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112134421.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112134425.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112134434.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112134440.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112134443.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112134912.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112134953.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112135014.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112135016.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112135019.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112135021.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112135022.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112135048.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112135059.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112135112.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112135129.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112135138.yml create mode 100644 ref-implementation/openbao/manifests/ingress.yaml diff --git a/.history/ref-implementation/keycloak/manifests/install_20241111142553.yaml b/.history/ref-implementation/keycloak/manifests/install_20241111142553.yaml new file mode 100644 index 0000000..ed3b799 --- /dev/null +++ b/.history/ref-implementation/keycloak/manifests/install_20241111142553.yaml @@ -0,0 +1,164 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + name: keycloak + labels: + app: keycloak +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + selector: + app: keycloak + type: ClusterIP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: keycloak + name: keycloak + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "10" +spec: + replicas: 1 + selector: + matchLabels: + app: keycloak + template: + metadata: + labels: + app: keycloak + spec: + containers: + - args: + - start-dev + env: + - name: KEYCLOAK_ADMIN + value: cnoe-admin + - name: KEYCLOAK_LOGLEVEL + value: ALL + - name: QUARKUS_TRANSACTION_MANAGER_ENABLE_RECOVERY + value: 'true' + envFrom: + - secretRef: + name: keycloak-config + image: quay.io/keycloak/keycloak:22.0.3 + name: keycloak + ports: + - containerPort: 8080 + name: http + readinessProbe: + httpGet: + path: /keycloak/realms/master + port: 8080 + volumeMounts: + - mountPath: /opt/keycloak/conf + name: keycloak-config + readOnly: true + volumes: + - configMap: + name: keycloak-config + name: keycloak-config +--- +apiVersion: v1 +data: + keycloak.conf: | + # Database + # The database vendor. + db=postgres + + # The username of the database user. + db-url=jdbc:postgresql://postgresql.keycloak.svc.cluster.local:5432/postgres + + # The proxy address forwarding mode if the server is behind a reverse proxy. + proxy=edge + + # hostname configuration + hostname=cnoe.localtest.me + hostname-port=8443 + http-relative-path=keycloak + + # the admin url requires its own configuration to reflect correct url + hostname-admin=cnoe.localtest.me:8443 + + hostname-debug=true + + # this should only be allowed in development. NEVER in production. + hostname-strict=false + hostname-strict-backchannel=false + + +kind: ConfigMap +metadata: + name: keycloak-config + namespace: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + clusterIP: None + ports: + - name: postgres + port: 5432 + selector: + app: postgresql +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + replicas: 1 + selector: + matchLabels: + app: postgresql + serviceName: service-postgresql + template: + metadata: + labels: + app: postgresql + spec: + containers: + - envFrom: + - secretRef: + name: keycloak-config + image: docker.io/library/postgres:15.3-alpine3.18 + name: postgres + ports: + - containerPort: 5432 + name: postgresdb + resources: + limits: + memory: 500Mi + requests: + cpu: 100m + memory: 300Mi + volumeMounts: + - name: data + mountPath: /var/lib/postgresql/data + volumeClaimTemplates: + - metadata: + name: data + spec: + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: "500Mi" + diff --git a/.history/ref-implementation/keycloak/manifests/install_20241112125306.yaml b/.history/ref-implementation/keycloak/manifests/install_20241112125306.yaml new file mode 100644 index 0000000..7418140 --- /dev/null +++ b/.history/ref-implementation/keycloak/manifests/install_20241112125306.yaml @@ -0,0 +1,165 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + name: keycloak + labels: + app: keycloak +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + type: LoadBalancer + selector: + app: keycloak + type: ClusterIP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: keycloak + name: keycloak + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "10" +spec: + replicas: 1 + selector: + matchLabels: + app: keycloak + template: + metadata: + labels: + app: keycloak + spec: + containers: + - args: + - start-dev + env: + - name: KEYCLOAK_ADMIN + value: cnoe-admin + - name: KEYCLOAK_LOGLEVEL + value: ALL + - name: QUARKUS_TRANSACTION_MANAGER_ENABLE_RECOVERY + value: 'true' + envFrom: + - secretRef: + name: keycloak-config + image: quay.io/keycloak/keycloak:22.0.3 + name: keycloak + ports: + - containerPort: 8080 + name: http + readinessProbe: + httpGet: + path: /keycloak/realms/master + port: 8080 + volumeMounts: + - mountPath: /opt/keycloak/conf + name: keycloak-config + readOnly: true + volumes: + - configMap: + name: keycloak-config + name: keycloak-config +--- +apiVersion: v1 +data: + keycloak.conf: | + # Database + # The database vendor. + db=postgres + + # The username of the database user. + db-url=jdbc:postgresql://postgresql.keycloak.svc.cluster.local:5432/postgres + + # The proxy address forwarding mode if the server is behind a reverse proxy. + proxy=edge + + # hostname configuration + hostname=cnoe.localtest.me + hostname-port=8443 + http-relative-path=keycloak + + # the admin url requires its own configuration to reflect correct url + hostname-admin=cnoe.localtest.me:8443 + + hostname-debug=true + + # this should only be allowed in development. NEVER in production. + hostname-strict=false + hostname-strict-backchannel=false + + +kind: ConfigMap +metadata: + name: keycloak-config + namespace: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + clusterIP: None + ports: + - name: postgres + port: 5432 + selector: + app: postgresql +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + replicas: 1 + selector: + matchLabels: + app: postgresql + serviceName: service-postgresql + template: + metadata: + labels: + app: postgresql + spec: + containers: + - envFrom: + - secretRef: + name: keycloak-config + image: docker.io/library/postgres:15.3-alpine3.18 + name: postgres + ports: + - containerPort: 5432 + name: postgresdb + resources: + limits: + memory: 500Mi + requests: + cpu: 100m + memory: 300Mi + volumeMounts: + - name: data + mountPath: /var/lib/postgresql/data + volumeClaimTemplates: + - metadata: + name: data + spec: + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: "500Mi" + diff --git a/.history/ref-implementation/keycloak/manifests/install_20241112125311.yaml b/.history/ref-implementation/keycloak/manifests/install_20241112125311.yaml new file mode 100644 index 0000000..4e41c0a --- /dev/null +++ b/.history/ref-implementation/keycloak/manifests/install_20241112125311.yaml @@ -0,0 +1,165 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + name: keycloak + labels: + app: keycloak +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + type: LoadBalancer + selector: + app: keycloak + type: ClusterIP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: keycloak + name: keycloak + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "10" +spec: + replicas: 1 + selector: + matchLabels: + app: keycloak + template: + metadata: + labels: + app: keycloak + spec: + containers: + - args: + - start-dev + env: + - name: KEYCLOAK_ADMIN + value: cnoe-admin + - name: KEYCLOAK_LOGLEVEL + value: ALL + - name: QUARKUS_TRANSACTION_MANAGER_ENABLE_RECOVERY + value: 'true' + envFrom: + - secretRef: + name: keycloak-config + image: quay.io/keycloak/keycloak:22.0.3 + name: keycloak + ports: + - containerPort: 8080 + name: http + readinessProbe: + httpGet: + path: /keycloak/realms/master + port: 8080 + volumeMounts: + - mountPath: /opt/keycloak/conf + name: keycloak-config + readOnly: true + volumes: + - configMap: + name: keycloak-config + name: keycloak-config +--- +apiVersion: v1 +data: + keycloak.conf: | + # Database + # The database vendor. + db=postgres + + # The username of the database user. + db-url=jdbc:postgresql://postgresql.keycloak.svc.cluster.local:5432/postgres + + # The proxy address forwarding mode if the server is behind a reverse proxy. + proxy=edge + + # hostname configuration + hostname=cnoe.localtest.me + hostname-port=8443 + http-relative-path=keycloak + + # the admin url requires its own configuration to reflect correct url + hostname-admin=cnoe.localtest.me:8443 + + hostname-debug=true + + # this should only be allowed in development. NEVER in production. + hostname-strict=false + hostname-strict-backchannel=false + + +kind: ConfigMap +metadata: + name: keycloak-config + namespace: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + clusterIP: None + ports: + - name: postgres + port: 5432 + selector: + app: postgresql +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + replicas: 1 + selector: + matchLabels: + app: postgresql + serviceName: service-postgresql + template: + metadata: + labels: + app: postgresql + spec: + containers: + - envFrom: + - secretRef: + name: keycloak-config + image: docker.io/library/postgres:15.3-alpine3.18 + name: postgres + ports: + - containerPort: 5432 + name: postgresdb + resources: + limits: + memory: 500Mi + requests: + cpu: 100m + memory: 300Mi + volumeMounts: + - name: data + mountPath: /var/lib/postgresql/data + volumeClaimTemplates: + - metadata: + name: data + spec: + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: "500Mi" + diff --git a/.history/ref-implementation/keycloak/manifests/install_20241112125315.yaml b/.history/ref-implementation/keycloak/manifests/install_20241112125315.yaml new file mode 100644 index 0000000..213df32 --- /dev/null +++ b/.history/ref-implementation/keycloak/manifests/install_20241112125315.yaml @@ -0,0 +1,165 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + name: keycloak + labels: + app: keycloak +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + type: LoadBalancer + selector: + app: keycloak + type: ClusterIP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: keycloak + name: keycloak + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "10" +spec: + replicas: 1 + selector: + matchLabels: + app: keycloak + template: + metadata: + labels: + app: keycloak + spec: + containers: + - args: + - start-dev + env: + - name: KEYCLOAK_ADMIN + value: cnoe-admin + - name: KEYCLOAK_LOGLEVEL + value: ALL + - name: QUARKUS_TRANSACTION_MANAGER_ENABLE_RECOVERY + value: 'true' + envFrom: + - secretRef: + name: keycloak-config + image: quay.io/keycloak/keycloak:22.0.3 + name: keycloak + ports: + - containerPort: 8080 + name: http + readinessProbe: + httpGet: + path: /keycloak/realms/master + port: 8080 + volumeMounts: + - mountPath: /opt/keycloak/conf + name: keycloak-config + readOnly: true + volumes: + - configMap: + name: keycloak-config + name: keycloak-config +--- +apiVersion: v1 +data: + keycloak.conf: | + # Database + # The database vendor. + db=postgres + + # The username of the database user. + db-url=jdbc:postgresql://postgresql.keycloak.svc.cluster.local:5432/postgres + + # The proxy address forwarding mode if the server is behind a reverse proxy. + proxy=edge + + # hostname configuration + hostname=cnoe.localtest.me + hostname-port=8443 + http-relative-path=keycloak + + # the admin url requires its own configuration to reflect correct url + hostname-admin=cnoe.localtest.me:8443 + + hostname-debug=true + + # this should only be allowed in development. NEVER in production. + hostname-strict=false + hostname-strict-backchannel=false + + +kind: ConfigMap +metadata: + name: keycloak-config + namespace: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + clusterIP: None + ports: + - name: postgres + port: 5432 + selector: + app: postgresql +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + replicas: 1 + selector: + matchLabels: + app: postgresql + serviceName: service-postgresql + template: + metadata: + labels: + app: postgresql + spec: + containers: + - envFrom: + - secretRef: + name: keycloak-config + image: docker.io/library/postgres:15.3-alpine3.18 + name: postgres + ports: + - containerPort: 5432 + name: postgresdb + resources: + limits: + memory: 500Mi + requests: + cpu: 100m + memory: 300Mi + volumeMounts: + - name: data + mountPath: /var/lib/postgresql/data + volumeClaimTemplates: + - metadata: + name: data + spec: + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: "500Mi" + diff --git a/.history/ref-implementation/keycloak/manifests/install_20241112125321.yaml b/.history/ref-implementation/keycloak/manifests/install_20241112125321.yaml new file mode 100644 index 0000000..b304101 --- /dev/null +++ b/.history/ref-implementation/keycloak/manifests/install_20241112125321.yaml @@ -0,0 +1,164 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + name: keycloak + labels: + app: keycloak +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + type: LoadBalancer + selector: + app: keycloak +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: keycloak + name: keycloak + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "10" +spec: + replicas: 1 + selector: + matchLabels: + app: keycloak + template: + metadata: + labels: + app: keycloak + spec: + containers: + - args: + - start-dev + env: + - name: KEYCLOAK_ADMIN + value: cnoe-admin + - name: KEYCLOAK_LOGLEVEL + value: ALL + - name: QUARKUS_TRANSACTION_MANAGER_ENABLE_RECOVERY + value: 'true' + envFrom: + - secretRef: + name: keycloak-config + image: quay.io/keycloak/keycloak:22.0.3 + name: keycloak + ports: + - containerPort: 8080 + name: http + readinessProbe: + httpGet: + path: /keycloak/realms/master + port: 8080 + volumeMounts: + - mountPath: /opt/keycloak/conf + name: keycloak-config + readOnly: true + volumes: + - configMap: + name: keycloak-config + name: keycloak-config +--- +apiVersion: v1 +data: + keycloak.conf: | + # Database + # The database vendor. + db=postgres + + # The username of the database user. + db-url=jdbc:postgresql://postgresql.keycloak.svc.cluster.local:5432/postgres + + # The proxy address forwarding mode if the server is behind a reverse proxy. + proxy=edge + + # hostname configuration + hostname=cnoe.localtest.me + hostname-port=8443 + http-relative-path=keycloak + + # the admin url requires its own configuration to reflect correct url + hostname-admin=cnoe.localtest.me:8443 + + hostname-debug=true + + # this should only be allowed in development. NEVER in production. + hostname-strict=false + hostname-strict-backchannel=false + + +kind: ConfigMap +metadata: + name: keycloak-config + namespace: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + clusterIP: None + ports: + - name: postgres + port: 5432 + selector: + app: postgresql +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + replicas: 1 + selector: + matchLabels: + app: postgresql + serviceName: service-postgresql + template: + metadata: + labels: + app: postgresql + spec: + containers: + - envFrom: + - secretRef: + name: keycloak-config + image: docker.io/library/postgres:15.3-alpine3.18 + name: postgres + ports: + - containerPort: 5432 + name: postgresdb + resources: + limits: + memory: 500Mi + requests: + cpu: 100m + memory: 300Mi + volumeMounts: + - name: data + mountPath: /var/lib/postgresql/data + volumeClaimTemplates: + - metadata: + name: data + spec: + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: "500Mi" + diff --git a/.history/ref-implementation/keycloak/manifests/install_20241112125401.yaml b/.history/ref-implementation/keycloak/manifests/install_20241112125401.yaml new file mode 100644 index 0000000..80965f6 --- /dev/null +++ b/.history/ref-implementation/keycloak/manifests/install_20241112125401.yaml @@ -0,0 +1,164 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + name: keycloak + labels: + app: keycloak +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + + selector: + app: keycloak +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: keycloak + name: keycloak + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "10" +spec: + replicas: 1 + selector: + matchLabels: + app: keycloak + template: + metadata: + labels: + app: keycloak + spec: + containers: + - args: + - start-dev + env: + - name: KEYCLOAK_ADMIN + value: cnoe-admin + - name: KEYCLOAK_LOGLEVEL + value: ALL + - name: QUARKUS_TRANSACTION_MANAGER_ENABLE_RECOVERY + value: 'true' + envFrom: + - secretRef: + name: keycloak-config + image: quay.io/keycloak/keycloak:22.0.3 + name: keycloak + ports: + - containerPort: 8080 + name: http + readinessProbe: + httpGet: + path: /keycloak/realms/master + port: 8080 + volumeMounts: + - mountPath: /opt/keycloak/conf + name: keycloak-config + readOnly: true + volumes: + - configMap: + name: keycloak-config + name: keycloak-config +--- +apiVersion: v1 +data: + keycloak.conf: | + # Database + # The database vendor. + db=postgres + + # The username of the database user. + db-url=jdbc:postgresql://postgresql.keycloak.svc.cluster.local:5432/postgres + + # The proxy address forwarding mode if the server is behind a reverse proxy. + proxy=edge + + # hostname configuration + hostname=cnoe.localtest.me + hostname-port=8443 + http-relative-path=keycloak + + # the admin url requires its own configuration to reflect correct url + hostname-admin=cnoe.localtest.me:8443 + + hostname-debug=true + + # this should only be allowed in development. NEVER in production. + hostname-strict=false + hostname-strict-backchannel=false + + +kind: ConfigMap +metadata: + name: keycloak-config + namespace: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + clusterIP: None + ports: + - name: postgres + port: 5432 + selector: + app: postgresql +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + replicas: 1 + selector: + matchLabels: + app: postgresql + serviceName: service-postgresql + template: + metadata: + labels: + app: postgresql + spec: + containers: + - envFrom: + - secretRef: + name: keycloak-config + image: docker.io/library/postgres:15.3-alpine3.18 + name: postgres + ports: + - containerPort: 5432 + name: postgresdb + resources: + limits: + memory: 500Mi + requests: + cpu: 100m + memory: 300Mi + volumeMounts: + - name: data + mountPath: /var/lib/postgresql/data + volumeClaimTemplates: + - metadata: + name: data + spec: + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: "500Mi" + diff --git a/.history/ref-implementation/keycloak/manifests/install_20241112125405.yaml b/.history/ref-implementation/keycloak/manifests/install_20241112125405.yaml new file mode 100644 index 0000000..ed3b799 --- /dev/null +++ b/.history/ref-implementation/keycloak/manifests/install_20241112125405.yaml @@ -0,0 +1,164 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + name: keycloak + labels: + app: keycloak +spec: + ports: + - name: http + port: 8080 + targetPort: 8080 + selector: + app: keycloak + type: ClusterIP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: keycloak + name: keycloak + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "10" +spec: + replicas: 1 + selector: + matchLabels: + app: keycloak + template: + metadata: + labels: + app: keycloak + spec: + containers: + - args: + - start-dev + env: + - name: KEYCLOAK_ADMIN + value: cnoe-admin + - name: KEYCLOAK_LOGLEVEL + value: ALL + - name: QUARKUS_TRANSACTION_MANAGER_ENABLE_RECOVERY + value: 'true' + envFrom: + - secretRef: + name: keycloak-config + image: quay.io/keycloak/keycloak:22.0.3 + name: keycloak + ports: + - containerPort: 8080 + name: http + readinessProbe: + httpGet: + path: /keycloak/realms/master + port: 8080 + volumeMounts: + - mountPath: /opt/keycloak/conf + name: keycloak-config + readOnly: true + volumes: + - configMap: + name: keycloak-config + name: keycloak-config +--- +apiVersion: v1 +data: + keycloak.conf: | + # Database + # The database vendor. + db=postgres + + # The username of the database user. + db-url=jdbc:postgresql://postgresql.keycloak.svc.cluster.local:5432/postgres + + # The proxy address forwarding mode if the server is behind a reverse proxy. + proxy=edge + + # hostname configuration + hostname=cnoe.localtest.me + hostname-port=8443 + http-relative-path=keycloak + + # the admin url requires its own configuration to reflect correct url + hostname-admin=cnoe.localtest.me:8443 + + hostname-debug=true + + # this should only be allowed in development. NEVER in production. + hostname-strict=false + hostname-strict-backchannel=false + + +kind: ConfigMap +metadata: + name: keycloak-config + namespace: keycloak +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + clusterIP: None + ports: + - name: postgres + port: 5432 + selector: + app: postgresql +--- +apiVersion: apps/v1 +kind: StatefulSet +metadata: + labels: + app: postgresql + name: postgresql + namespace: keycloak +spec: + replicas: 1 + selector: + matchLabels: + app: postgresql + serviceName: service-postgresql + template: + metadata: + labels: + app: postgresql + spec: + containers: + - envFrom: + - secretRef: + name: keycloak-config + image: docker.io/library/postgres:15.3-alpine3.18 + name: postgres + ports: + - containerPort: 5432 + name: postgresdb + resources: + limits: + memory: 500Mi + requests: + cpu: 100m + memory: 300Mi + volumeMounts: + - name: data + mountPath: /var/lib/postgresql/data + volumeClaimTemplates: + - metadata: + name: data + spec: + accessModes: ["ReadWriteOnce"] + resources: + requests: + storage: "500Mi" + diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112130717.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112130717.yaml new file mode 100644 index 0000000..e69de29 diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112130720.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112130720.yaml new file mode 100644 index 0000000..abaf181 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112130720.yaml @@ -0,0 +1,30 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: keycloak-ingress-localhost + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "100" +spec: + ingressClassName: "nginx" + rules: + - host: localhost + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http + - host: cnoe.localtest.me + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112130742.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112130742.yaml new file mode 100644 index 0000000..6abab23 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112130742.yaml @@ -0,0 +1,27 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao +spec: + ingressClassName: "nginx" + rules: + - host: localhost + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http + - host: cnoe.localtest.me + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112130743.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112130743.yaml new file mode 100644 index 0000000..abaf181 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112130743.yaml @@ -0,0 +1,30 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: keycloak-ingress-localhost + namespace: keycloak + annotations: + argocd.argoproj.io/sync-wave: "100" +spec: + ingressClassName: "nginx" + rules: + - host: localhost + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http + - host: cnoe.localtest.me + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112130751.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112130751.yaml new file mode 100644 index 0000000..fb5aeb3 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112130751.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: keycloak-ingress-localhost + name: openbao +spec: + ingressClassName: "nginx" + rules: + - host: localhost + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http + - host: cnoe.localtest.me + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112130756.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112130756.yaml new file mode 100644 index 0000000..35a4f35 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112130756.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-localhost + name: openbao +spec: + ingressClassName: "nginx" + rules: + - host: localhost + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http + - host: cnoe.localtest.me + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112130759.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112130759.yaml new file mode 100644 index 0000000..932955c --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112130759.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-localhost + namespace: openbao +spec: + ingressClassName: "nginx" + rules: + - host: localhost + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http + - host: cnoe.localtest.me + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112130902.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112130902.yaml new file mode 100644 index 0000000..f356af7 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112130902.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-localhost + namespace: openbao +spec: + ingressClassName: "nginx" + rules: + - host: localhost + http: + paths: + - path: /openbao + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http + - host: cnoe.localtest.me + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112130904.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112130904.yaml new file mode 100644 index 0000000..c4b8374 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112130904.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-localhost + namespace: openbao +spec: + ingressClassName: "nginx" + rules: + - host: localhost + http: + paths: + - path: cnoe://openbao/manifests + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http + - host: cnoe.localtest.me + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112130913.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112130913.yaml new file mode 100644 index 0000000..9bacafb --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112130913.yaml @@ -0,0 +1,28 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-localhost + namespace: openbao +spec: + ingressClassName: "nginx" + rules: + - host: localhost + http: + paths: + - path: cnoe://openbao/manifests + pathType: ImplementationSpecific + backend: + service: + name: openbao + port: + name: http + - host: cnoe.localtest.me + http: + paths: + - path: /keycloak + pathType: ImplementationSpecific + backend: + service: + name: keycloak + port: + name: http diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112132252.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112132252.yaml new file mode 100644 index 0000000..31fff8f --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112132252.yaml @@ -0,0 +1,19 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: my-app-ingress + namespace: default + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / +spec: + rules: + - host: my-app.local # Change this to your domain or leave it as is for local development + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: my-app-service # Name of your service + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112132258.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112132258.yaml new file mode 100644 index 0000000..9f706f3 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112132258.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: my-app-ingress + namespace: default + +spec: + rules: + - host: my-app.local # Change this to your domain or leave it as is for local development + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: my-app-service # Name of your service + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112132302.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112132302.yaml new file mode 100644 index 0000000..9e9bfcb --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112132302.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: my-app-ingress + namespace: o + +spec: + rules: + - host: my-app.local # Change this to your domain or leave it as is for local development + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: my-app-service # Name of your service + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112132304.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112132304.yaml new file mode 100644 index 0000000..0e0d97a --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112132304.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: my-app-ingress + namespace: openbao + +spec: + rules: + - host: my-app.local # Change this to your domain or leave it as is for local development + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: my-app-service # Name of your service + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112132310.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112132310.yaml new file mode 100644 index 0000000..6f33ebd --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112132310.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: open + namespace: openbao + +spec: + rules: + - host: my-app.local # Change this to your domain or leave it as is for local development + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: my-app-service # Name of your service + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112132312.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112132312.yaml new file mode 100644 index 0000000..4849eba --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112132312.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao + namespace: openbao + +spec: + rules: + - host: my-app.local # Change this to your domain or leave it as is for local development + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: my-app-service # Name of your service + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112132315.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112132315.yaml new file mode 100644 index 0000000..18f3315 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112132315.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + +spec: + rules: + - host: my-app.local # Change this to your domain or leave it as is for local development + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: my-app-service # Name of your service + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112132318.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112132318.yaml new file mode 100644 index 0000000..754343a --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112132318.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-local + namespace: openbao + +spec: + rules: + - host: my-app.local # Change this to your domain or leave it as is for local development + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: my-app-service # Name of your service + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112132320.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112132320.yaml new file mode 100644 index 0000000..7857781 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112132320.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-localhost + namespace: openbao + +spec: + rules: + - host: my-app.local # Change this to your domain or leave it as is for local development + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: my-app-service # Name of your service + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112132340.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112132340.yaml new file mode 100644 index 0000000..e7669f3 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112132340.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-localhost + namespace: openbao + +spec: + rules: + - host: localhost # Change this to your domain or leave it as is for local development + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: my-app-service # Name of your service + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112132445.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112132445.yaml new file mode 100644 index 0000000..650ab4d --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112132445.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-localhost + namespace: openbao + +spec: + rules: + - host: localhost # Change this to your domain or leave it as is for local development + http: + paths: + - path: "" + pathType: Exact + backend: + service: + name: my-app-service # Name of your service + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112132617.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112132617.yaml new file mode 100644 index 0000000..69be905 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112132617.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-localhost + namespace: openbao + +spec: + rules: + - host: localhost # Change this to your domain or leave it as is for local development + http: + paths: + - path: "" + pathType: Exact + backend: + service: + name: openbao # Name of your service + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112132620.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112132620.yaml new file mode 100644 index 0000000..cc13074 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112132620.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-localhost + namespace: openbao + +spec: + rules: + - host: localhost # Change this to your domain or leave it as is for local development + http: + paths: + - path: "" + pathType: Exact + backend: + service: + name: openbao + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112132622.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112132622.yaml new file mode 100644 index 0000000..9615367 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112132622.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-localhost + namespace: openbao + +spec: + rules: + - host: localhost # Change this to your domain or leave it as is for local development + http: + paths: + - path: "" + pathType: Exact + backend: + service: + name: openbao + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112132648.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112132648.yaml new file mode 100644 index 0000000..9615367 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112132648.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-localhost + namespace: openbao + +spec: + rules: + - host: localhost # Change this to your domain or leave it as is for local development + http: + paths: + - path: "" + pathType: Exact + backend: + service: + name: openbao + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112133726.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112133726.yaml new file mode 100644 index 0000000..e69de29 diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112133806.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112133806.yaml new file mode 100644 index 0000000..9615367 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112133806.yaml @@ -0,0 +1,18 @@ +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-localhost + namespace: openbao + +spec: + rules: + - host: localhost # Change this to your domain or leave it as is for local development + http: + paths: + - path: "" + pathType: Exact + backend: + service: + name: openbao + port: + number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/ingress_20241112135400.yaml b/.history/ref-implementation/openbao/manifests/ingress_20241112135400.yaml new file mode 100644 index 0000000..f75a03d --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/ingress_20241112135400.yaml @@ -0,0 +1,18 @@ +# apiVersion: networking.k8s.io/v1 +# kind: Ingress +# metadata: +# name: openbao-ingress-localhost +# namespace: openbao + +# spec: +# rules: +# - host: localhost # Change this to your domain or leave it as is for local development +# http: +# paths: +# - path: "" +# pathType: Exact +# backend: +# service: +# name: openbao +# port: +# number: 8200 # The port to forward to on your service diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112121944.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112121944.yml new file mode 100644 index 0000000..badda3f --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112121944.yml @@ -0,0 +1,46 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8200 + - hostPort: 8200 + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112121955.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112121955.yml new file mode 100644 index 0000000..d20b7b3 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112121955.yml @@ -0,0 +1,46 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8200 + hostPort: 8200 + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125415.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125415.yml new file mode 100644 index 0000000..a656216 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125415.yml @@ -0,0 +1,47 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8200 + hostPort: 8200 + + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125417.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125417.yml new file mode 100644 index 0000000..47b44df --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125417.yml @@ -0,0 +1,47 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125534.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125534.yml new file mode 100644 index 0000000..0f612be --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125534.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: LoadBalancer # or NodePort + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125538.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125538.yml new file mode 100644 index 0000000..4040f40 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125538.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: LoadBalancer # or NodePort + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125540.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125540.yml new file mode 100644 index 0000000..ca2a209 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125540.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: LoadBalancer # or NodePort + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125545.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125545.yml new file mode 100644 index 0000000..4e2f145 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125545.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: LoadBalancer # or NodePort + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125549.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125549.yml new file mode 100644 index 0000000..5607328 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125549.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: LoadBalancer # or NodePort + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125552.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125552.yml new file mode 100644 index 0000000..9c90d16 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125552.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: LoadBalancer # or NodePort + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125553.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125553.yml new file mode 100644 index 0000000..9ded5d1 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125553.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: LoadBalancer # or NodePort + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125604.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125604.yml new file mode 100644 index 0000000..47b44df --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125604.yml @@ -0,0 +1,47 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125613.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125613.yml new file mode 100644 index 0000000..fc8bf8c --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125613.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + + - containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125615.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125615.yml new file mode 100644 index 0000000..020d960 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125615.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - + - containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125617.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125617.yml new file mode 100644 index 0000000..c152d38 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125617.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - po + - containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125618.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125618.yml new file mode 100644 index 0000000..7f08b85 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125618.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - port: + - containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125627.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125627.yml new file mode 100644 index 0000000..256cfb6 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125627.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCO + - containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125629.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125629.yml new file mode 100644 index 0000000..0a3e930 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125629.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + - containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112125633.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112125633.yml new file mode 100644 index 0000000..575777f --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112125633.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112133731.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112133731.yml new file mode 100644 index 0000000..6d406a4 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112133731.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + + + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112133734.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112133734.yml new file mode 100644 index 0000000..b07a1b7 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112133734.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112133738.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112133738.yml new file mode 100644 index 0000000..2bb23c2 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112133738.yml @@ -0,0 +1,52 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + + + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112133739.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112133739.yml new file mode 100644 index 0000000..04470a4 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112133739.yml @@ -0,0 +1,70 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-localhost + namespace: openbao + +spec: + rules: + - host: localhost # Change this to your domain or leave it as is for local development + http: + paths: + - path: "" + pathType: Exact + backend: + service: + name: openbao + port: + number: 8200 # The port to forward to on your service + + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112133740.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112133740.yml new file mode 100644 index 0000000..04470a4 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112133740.yml @@ -0,0 +1,70 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress-localhost + namespace: openbao + +spec: + rules: + - host: localhost # Change this to your domain or leave it as is for local development + http: + paths: + - path: "" + pathType: Exact + backend: + service: + name: openbao + port: + number: 8200 # The port to forward to on your service + + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112133804.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112133804.yml new file mode 100644 index 0000000..575777f --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112133804.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + env: + - name: BAO_ADDR + value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112133833.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112133833.yml new file mode 100644 index 0000000..6ddb3db --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112133833.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + hostPort: 8200 + type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112133859.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112133859.yml new file mode 100644 index 0000000..eeff542 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112133859.yml @@ -0,0 +1,48 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112134239.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112134239.yml new file mode 100644 index 0000000..9bf147d --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112134239.yml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + hostPort: 8200 + targetPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112134258.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112134258.yml new file mode 100644 index 0000000..a4247b3 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112134258.yml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + hostPort: 8200 + # targetPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112134322.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112134322.yml new file mode 100644 index 0000000..9bf147d --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112134322.yml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + hostPort: 8200 + targetPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112134324.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112134324.yml new file mode 100644 index 0000000..b81c1cf --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112134324.yml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + targetPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112134335.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112134335.yml new file mode 100644 index 0000000..ce84f2e --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112134335.yml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + port: 8200 + # hostPort: 8200 + targetPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112134407.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112134407.yml new file mode 100644 index 0000000..bc183db --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112134407.yml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + port: 8200 + # hostPort: 8200 + containerPort:: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112134409.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112134409.yml new file mode 100644 index 0000000..0f65ec9 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112134409.yml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + port: 8200 + # hostPort: 8200 + containerPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112134417.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112134417.yml new file mode 100644 index 0000000..ce84f2e --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112134417.yml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + port: 8200 + # hostPort: 8200 + targetPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112134421.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112134421.yml new file mode 100644 index 0000000..b81c1cf --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112134421.yml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + targetPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112134425.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112134425.yml new file mode 100644 index 0000000..b81c1cf --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112134425.yml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + targetPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112134434.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112134434.yml new file mode 100644 index 0000000..f162211 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112134434.yml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + port: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112134440.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112134440.yml new file mode 100644 index 0000000..572c07a --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112134440.yml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + hos: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112134443.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112134443.yml new file mode 100644 index 0000000..8ffb033 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112134443.yml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112134912.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112134912.yml new file mode 100644 index 0000000..f3a5b6f --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112134912.yml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: ClusterIP diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112134953.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112134953.yml new file mode 100644 index 0000000..470a458 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112134953.yml @@ -0,0 +1,49 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112135014.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112135014.yml new file mode 100644 index 0000000..26f238d --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112135014.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + no + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112135016.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112135016.yml new file mode 100644 index 0000000..21d3812 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112135016.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + NodePort: + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112135019.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112135019.yml new file mode 100644 index 0000000..f9e2ddd --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112135019.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + NodePort: 8200 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112135021.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112135021.yml new file mode 100644 index 0000000..f9e2ddd --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112135021.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + NodePort: 8200 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112135022.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112135022.yml new file mode 100644 index 0000000..f2ea0bd --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112135022.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 8200 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112135048.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112135048.yml new file mode 100644 index 0000000..84881db --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112135048.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + # nodePort: 8200 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112135059.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112135059.yml new file mode 100644 index 0000000..f2ea0bd --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112135059.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 8200 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112135112.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112135112.yml new file mode 100644 index 0000000..e3e69d3 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112135112.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112135129.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112135129.yml new file mode 100644 index 0000000..8da5307 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112135129.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + # nodePort: 30000 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112135138.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112135138.yml new file mode 100644 index 0000000..2b5441b --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112135138.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + # nodePort: 30000 + type: LoadBalancer diff --git a/ref-implementation/openbao/manifests/ingress.yaml b/ref-implementation/openbao/manifests/ingress.yaml new file mode 100644 index 0000000..f75a03d --- /dev/null +++ b/ref-implementation/openbao/manifests/ingress.yaml @@ -0,0 +1,18 @@ +# apiVersion: networking.k8s.io/v1 +# kind: Ingress +# metadata: +# name: openbao-ingress-localhost +# namespace: openbao + +# spec: +# rules: +# - host: localhost # Change this to your domain or leave it as is for local development +# http: +# paths: +# - path: "" +# pathType: Exact +# backend: +# service: +# name: openbao +# port: +# number: 8200 # The port to forward to on your service diff --git a/ref-implementation/openbao/manifests/manifest.yml b/ref-implementation/openbao/manifests/manifest.yml index aa8e5ea..2b5441b 100644 --- a/ref-implementation/openbao/manifests/manifest.yml +++ b/ref-implementation/openbao/manifests/manifest.yml @@ -24,10 +24,14 @@ spec: - name: openbao image: openbao/openbao:latest # Replace with the actual image ports: - - containerPort: 8200 - env: - - name: BAO_ADDR - value: "http://0.0.0.0:8200" + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" --- apiVersion: v1 @@ -42,4 +46,5 @@ spec: - protocol: TCP port: 8200 targetPort: 8200 - type: ClusterIP + # nodePort: 30000 + type: LoadBalancer From 111648d78a68611ff4203aec3f1f88a97244dfbe Mon Sep 17 00:00:00 2001 From: miwr Date: Tue, 12 Nov 2024 13:58:55 +0100 Subject: [PATCH 14/18] node port --- .../manifests/manifest_20241112135826.yml | 50 +++++++++++++++++++ .../manifests/manifest_20241112135828.yml | 50 +++++++++++++++++++ .../manifests/manifest_20241112135835.yml | 50 +++++++++++++++++++ .../manifests/manifest_20241112135837.yml | 50 +++++++++++++++++++ .../manifests/manifest_20241112135849.yml | 50 +++++++++++++++++++ .../openbao/manifests/manifest.yml | 4 +- 6 files changed, 252 insertions(+), 2 deletions(-) create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112135826.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112135828.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112135835.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112135837.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241112135849.yml diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112135826.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112135826.yml new file mode 100644 index 0000000..056eceb --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112135826.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + # nodePort: 30000 + type: No diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112135828.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112135828.yml new file mode 100644 index 0000000..09680c7 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112135828.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + # nodePort: 30000 + type: diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112135835.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112135835.yml new file mode 100644 index 0000000..8da5307 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112135835.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + # nodePort: 30000 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112135837.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112135837.yml new file mode 100644 index 0000000..e3e69d3 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112135837.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241112135849.yml b/.history/ref-implementation/openbao/manifests/manifest_20241112135849.yml new file mode 100644 index 0000000..e3e69d3 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241112135849.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort diff --git a/ref-implementation/openbao/manifests/manifest.yml b/ref-implementation/openbao/manifests/manifest.yml index 2b5441b..e3e69d3 100644 --- a/ref-implementation/openbao/manifests/manifest.yml +++ b/ref-implementation/openbao/manifests/manifest.yml @@ -46,5 +46,5 @@ spec: - protocol: TCP port: 8200 targetPort: 8200 - # nodePort: 30000 - type: LoadBalancer + nodePort: 30000 + type: NodePort From 9fbea8df451213276ab668db885ced07764c8155 Mon Sep 17 00:00:00 2001 From: miwr Date: Wed, 13 Nov 2024 10:33:41 +0100 Subject: [PATCH 15/18] values.yaml --- .../manifests/manifest_20241113093100.yml | 50 ++++++++++++ .../manifests/manifest_20241113093101.yml | 50 ++++++++++++ .../manifests/manifest_20241113093110.yml | 50 ++++++++++++ .../manifests/manifest_20241113093126.yml | 50 ++++++++++++ .../manifests/manifest_20241113093129.yml | 0 .../manifests/manifest_20241113093614.yml | 50 ++++++++++++ .../manifests/manifest_20241113093615.yml | 50 ++++++++++++ .../manifests/manifest_20241113093618.yml | 50 ++++++++++++ .../manifests/manifest_20241113093621.yml | 50 ++++++++++++ .../manifests/manifest_20241113093625.yml | 50 ++++++++++++ .../manifests/manifest_20241113093821.yml | 52 ++++++++++++ .../manifests/manifest_20241113093826.yml | 52 ++++++++++++ .../manifests/manifest_20241113093827.yml | 72 +++++++++++++++++ .../manifests/manifest_20241113093842.yml | 73 +++++++++++++++++ .../manifests/manifest_20241113093847.yml | 73 +++++++++++++++++ .../manifests/manifest_20241113093851.yml | 73 +++++++++++++++++ .../manifests/manifest_20241113093853.yml | 73 +++++++++++++++++ .../manifests/manifest_20241113093944.yml | 73 +++++++++++++++++ .../manifests/manifest_20241113094042.yml | 73 +++++++++++++++++ .../manifests/manifest_20241113094100.yml | 73 +++++++++++++++++ .../manifests/manifest_20241113094104.yml | 73 +++++++++++++++++ .../manifests/manifest_20241113094154.yml | 73 +++++++++++++++++ .../manifests/manifest_20241113094340.yml | 73 +++++++++++++++++ .../manifests/manifest_20241113094401.yml | 73 +++++++++++++++++ .../manifests/manifest_20241113094647.yml | 81 +++++++++++++++++++ .../manifests/manifest_20241113095157.yml | 72 +++++++++++++++++ .../manifests/manifest_20241113095238.yml | 72 +++++++++++++++++ .../manifests/manifest_20241113095247.yml | 72 +++++++++++++++++ .../manifests/manifest_20241113100517.yml | 72 +++++++++++++++++ .../manifests/manifest_20241113100529.yml | 72 +++++++++++++++++ .../manifests/manifest_20241113100645.yml | 72 +++++++++++++++++ .../manifests/manifest_20241113100725.yml | 72 +++++++++++++++++ .../manifests/manifest_20241113100745.yml | 72 +++++++++++++++++ .../manifests/manifest_20241113100822.yml | 66 +++++++++++++++ .../manifests/manifest_20241113100829.yml | 67 +++++++++++++++ .../manifests/manifest_20241113100833.yml | 67 +++++++++++++++ .../manifests/manifest_20241113100902.yml | 67 +++++++++++++++ .../manifests/manifest_20241113101113.yml | 65 +++++++++++++++ .../openbao/values_20241113103308.yaml | 0 .../openbao/values_20241113103317.yaml | 1 + .../openbao/values_20241113103322.yaml | 1 + .../openbao/values_20241113103326.yaml | 1 + .../openbao_20241113102912.yaml | 27 +++++++ .../openbao_20241113103006.yaml | 27 +++++++ .../openbao_20241113103024.yaml | 27 +++++++ .../openbao_20241113103029.yaml | 27 +++++++ ref-implementation/openbao.yaml | 24 ++++-- .../openbao/manifests/ingress.yaml | 18 ----- ref-implementation/openbao/values.yaml | 1 + 49 files changed, 2546 insertions(+), 26 deletions(-) create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093100.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093101.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093110.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093126.yml rename ref-implementation/openbao/manifests/manifest.yml => .history/ref-implementation/openbao/manifests/manifest_20241113093129.yml (100%) create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093614.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093615.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093618.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093621.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093625.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093821.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093826.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093827.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093842.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093847.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093851.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093853.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113093944.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113094042.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113094100.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113094104.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113094154.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113094340.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113094401.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113094647.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113095157.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113095238.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113095247.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113100517.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113100529.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113100645.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113100725.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113100745.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113100822.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113100829.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113100833.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113100902.yml create mode 100644 .history/ref-implementation/openbao/manifests/manifest_20241113101113.yml create mode 100644 .history/ref-implementation/openbao/values_20241113103308.yaml create mode 100644 .history/ref-implementation/openbao/values_20241113103317.yaml create mode 100644 .history/ref-implementation/openbao/values_20241113103322.yaml create mode 100644 .history/ref-implementation/openbao/values_20241113103326.yaml create mode 100644 .history/ref-implementation/openbao_20241113102912.yaml create mode 100644 .history/ref-implementation/openbao_20241113103006.yaml create mode 100644 .history/ref-implementation/openbao_20241113103024.yaml create mode 100644 .history/ref-implementation/openbao_20241113103029.yaml delete mode 100644 ref-implementation/openbao/manifests/ingress.yaml create mode 100644 ref-implementation/openbao/values.yaml diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093100.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093100.yml new file mode 100644 index 0000000..a9c388f --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093100.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: HTTO + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093101.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093101.yml new file mode 100644 index 0000000..ff5a849 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093101.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: HTTP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093110.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093110.yml new file mode 100644 index 0000000..6c4856f --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093110.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: HTTP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: HTTP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093126.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093126.yml new file mode 100644 index 0000000..ff5a849 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093126.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: HTTP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort diff --git a/ref-implementation/openbao/manifests/manifest.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093129.yml similarity index 100% rename from ref-implementation/openbao/manifests/manifest.yml rename to .history/ref-implementation/openbao/manifests/manifest_20241113093129.yml diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093614.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093614.yml new file mode 100644 index 0000000..e3e69d3 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093614.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093615.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093615.yml new file mode 100644 index 0000000..8da5307 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093615.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + # nodePort: 30000 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093618.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093618.yml new file mode 100644 index 0000000..9b7d979 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093618.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + # nodePort: 30000 + type: Load diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093621.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093621.yml new file mode 100644 index 0000000..f11cbce --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093621.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + # nodePort: 30000 + type: Loa diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093625.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093625.yml new file mode 100644 index 0000000..8da5307 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093625.yml @@ -0,0 +1,50 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + # nodePort: 30000 + type: NodePort diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093821.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093821.yml new file mode 100644 index 0000000..2e0b80a --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093821.yml @@ -0,0 +1,52 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + # nodePort: 30000 + type: NodePort + + diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093826.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093826.yml new file mode 100644 index 0000000..c5989b8 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093826.yml @@ -0,0 +1,52 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + + diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093827.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093827.yml new file mode 100644 index 0000000..89d123c --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093827.yml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + + +# 4. Ingress (optional for HTTP-based access) +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / # Ensures requests are rewritten to the root path +spec: + rules: + - host: openbao.local # Replace with your domain or host if you're using DNS + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: openbao # References the Service defined above + port: + number: 8200 # The port exposed by the Service \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093842.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093842.yml new file mode 100644 index 0000000..f59a0ac --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093842.yml @@ -0,0 +1,73 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + + + +# 4. Ingress (optional for HTTP-based access) +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / # Ensures requests are rewritten to the root path +spec: + rules: + - host: openbao.local # Replace with your domain or host if you're using DNS + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: openbao # References the Service defined above + port: +--- number: 8200 # The port exposed by the Service \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093847.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093847.yml new file mode 100644 index 0000000..f2e7b01 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093847.yml @@ -0,0 +1,73 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + + --- + +# 4. Ingress (optional for HTTP-based access) +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / # Ensures requests are rewritten to the root path +spec: + rules: + - host: openbao.local # Replace with your domain or host if you're using DNS + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: openbao # References the Service defined above + port: +--- number: 8200 # The port exposed by the Service \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093851.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093851.yml new file mode 100644 index 0000000..376b905 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093851.yml @@ -0,0 +1,73 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + + --- + +# 4. Ingress (optional for HTTP-based access) +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / # Ensures requests are rewritten to the root path +spec: + rules: + - host: openbao.local # Replace with your domain or host if you're using DNS + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: openbao # References the Service defined above + port: + number: 8200 # The port exposed by the Service \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093853.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093853.yml new file mode 100644 index 0000000..c8002fb --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093853.yml @@ -0,0 +1,73 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +# 4. Ingress (optional for HTTP-based access) +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / # Ensures requests are rewritten to the root path +spec: + rules: + - host: openbao.local # Replace with your domain or host if you're using DNS + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: openbao # References the Service defined above + port: + number: 8200 # The port exposed by the Service \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113093944.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113093944.yml new file mode 100644 index 0000000..49eefae --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113093944.yml @@ -0,0 +1,73 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +# 4. Ingress (optional for HTTP-based access) +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / # Ensures requests are rewritten to the root path +spec: + rules: + - host: localhost # Replace with your domain or host if you're using DNS + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: openbao # References the Service defined above + port: + number: 8200 # The port exposed by the Service \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113094042.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113094042.yml new file mode 100644 index 0000000..0cb99bc --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113094042.yml @@ -0,0 +1,73 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +# 4. Ingress (optional for HTTP-based access) +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / # Ensures requests are rewritten to the root path +spec: + rules: + - host: localhost # Replace with your domain or host if you're using DNS + http: + paths: + - path: "" + pathType: Prefix + backend: + service: + name: openbao # References the Service defined above + port: + number: 8200 # The port exposed by the Service \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113094100.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113094100.yml new file mode 100644 index 0000000..c8002fb --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113094100.yml @@ -0,0 +1,73 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +# 4. Ingress (optional for HTTP-based access) +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / # Ensures requests are rewritten to the root path +spec: + rules: + - host: openbao.local # Replace with your domain or host if you're using DNS + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: openbao # References the Service defined above + port: + number: 8200 # The port exposed by the Service \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113094104.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113094104.yml new file mode 100644 index 0000000..49eefae --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113094104.yml @@ -0,0 +1,73 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +# 4. Ingress (optional for HTTP-based access) +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / # Ensures requests are rewritten to the root path +spec: + rules: + - host: localhost # Replace with your domain or host if you're using DNS + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: openbao # References the Service defined above + port: + number: 8200 # The port exposed by the Service \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113094154.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113094154.yml new file mode 100644 index 0000000..f879eda --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113094154.yml @@ -0,0 +1,73 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +# 4. Ingress (optional for HTTP-based access) +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / # Ensures requests are rewritten to the root path +spec: + rules: + - host: localhost # Replace with your domain or host if you're using DNS + http: + paths: + - path: /openbao + pathType: Prefix + backend: + service: + name: openbao # References the Service defined above + port: + number: 8200 # The port exposed by the Service \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113094340.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113094340.yml new file mode 100644 index 0000000..dbce7b6 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113094340.yml @@ -0,0 +1,73 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +# 4. Ingress (optional for HTTP-based access) +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / # Ensures requests are rewritten to the root path +spec: + rules: + - host: localhost # Replace with your domain or host if you're using DNS + http: + paths: + - path: localhost/openbao + pathType: Prefix + backend: + service: + name: openbao # References the Service defined above + port: + number: 8200 # The port exposed by the Service \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113094401.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113094401.yml new file mode 100644 index 0000000..f879eda --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113094401.yml @@ -0,0 +1,73 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +# 4. Ingress (optional for HTTP-based access) +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / # Ensures requests are rewritten to the root path +spec: + rules: + - host: localhost # Replace with your domain or host if you're using DNS + http: + paths: + - path: /openbao + pathType: Prefix + backend: + service: + name: openbao # References the Service defined above + port: + number: 8200 # The port exposed by the Service \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113094647.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113094647.yml new file mode 100644 index 0000000..2b6727e --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113094647.yml @@ -0,0 +1,81 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +# 4. Ingress (optional for HTTP-based access) +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: / # Ensures requests are rewritten to the root path +spec: + rules: + - host: localhost # Replace with your domain or host if you're using DNS + http: + paths: + - path: /ui + pathType: Prefix + backend: + service: + name: openbao + port: + number: 8200 + # Optional: Redirect root `/` path to `/ui` + - path: / + pathType: Prefix + backend: + service: + name: openbao + port: + number: 8200 \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113095157.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113095157.yml new file mode 100644 index 0000000..335bdaf --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113095157.yml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: /ui +spec: + rules: + - host: localhost # Or replace with your custom hostname if using /etc/hosts + http: + paths: + - path: /openbao + pathType: Prefix + backend: + service: + name: openbao + port: + number: 8200 \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113095238.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113095238.yml new file mode 100644 index 0000000..809d96c --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113095238.yml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: /ui +spec: + rules: + - host: localhost # Or replace with your custom hostname if using /etc/hosts + http: + paths: + - path: /openbao + pathType: Prefix + backend: + service: + name: openbao + port: + number: 30000 \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113095247.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113095247.yml new file mode 100644 index 0000000..335bdaf --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113095247.yml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: /ui +spec: + rules: + - host: localhost # Or replace with your custom hostname if using /etc/hosts + http: + paths: + - path: /openbao + pathType: Prefix + backend: + service: + name: openbao + port: + number: 8200 \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113100517.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113100517.yml new file mode 100644 index 0000000..2efa4bf --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113100517.yml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: /ui +spec: + rules: + - host: localhost + http: + paths: + - path: /openbao + pathType: Prefix + backend: + service: + name: openbao + port: + number: 8200 \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113100529.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113100529.yml new file mode 100644 index 0000000..bb50907 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113100529.yml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + annotations: + nginx.ingress.kubernetes.io/rewrite-target: /ui +spec: + rules: + - host: cnoe.localtest.me + http: + paths: + - path: /openbao + pathType: Prefix + backend: + service: + name: openbao + port: + number: 8200 \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113100645.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113100645.yml new file mode 100644 index 0000000..ea5af0d --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113100645.yml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + # annotations: + # nginx.ingress.kubernetes.io/rewrite-target: /ui +spec: + rules: + - host: cnoe.localtest.me + http: + paths: + - path: /openbao + pathType: Prefix + backend: + service: + name: openbao + port: + number: 8200 \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113100725.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113100725.yml new file mode 100644 index 0000000..6ae7008 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113100725.yml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + # annotations: + # nginx.ingress.kubernetes.io/rewrite-target: /ui +spec: + rules: + - host: cnoe.localtest.me + http: + paths: + - path: /openbao + pathType: ImplementationSpecific + backend: + service: + name: openbao + port: + number: 8200 \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113100745.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113100745.yml new file mode 100644 index 0000000..ea5af0d --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113100745.yml @@ -0,0 +1,72 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + # hostPort: 8200 + # hostPort: 8200 + # type: LoadBalancer + # env: + # - name: BAO_ADDR + # value: "http://0.0.0.0:8200" + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + # annotations: + # nginx.ingress.kubernetes.io/rewrite-target: /ui +spec: + rules: + - host: cnoe.localtest.me + http: + paths: + - path: /openbao + pathType: Prefix + backend: + service: + name: openbao + port: + number: 8200 \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113100822.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113100822.yml new file mode 100644 index 0000000..6d528b0 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113100822.yml @@ -0,0 +1,66 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + +--- +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + # annotations: + # nginx.ingress.kubernetes.io/rewrite-target: /ui +spec: + rules: + - host: cnoe.localtest.me + http: + paths: + - path: /openbao + pathType: Prefix + backend: + service: + name: openbao + port: + number: 8200 \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113100829.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113100829.yml new file mode 100644 index 0000000..a61d0b3 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113100829.yml @@ -0,0 +1,67 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest # Replace with the actual image + ports: + - protocol: TCP + containerPort: 8200 + +--- + +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + # annotations: + # nginx.ingress.kubernetes.io/rewrite-target: /ui +spec: + rules: + - host: cnoe.localtest.me + http: + paths: + - path: /openbao + pathType: Prefix + backend: + service: + name: openbao + port: + number: 8200 \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113100833.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113100833.yml new file mode 100644 index 0000000..6ed5ca2 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113100833.yml @@ -0,0 +1,67 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest + ports: + - protocol: TCP + containerPort: 8200 + +--- + +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + nodePort: 30000 + type: NodePort + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + # annotations: + # nginx.ingress.kubernetes.io/rewrite-target: /ui +spec: + rules: + - host: cnoe.localtest.me + http: + paths: + - path: /openbao + pathType: Prefix + backend: + service: + name: openbao + port: + number: 8200 \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113100902.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113100902.yml new file mode 100644 index 0000000..fa08302 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113100902.yml @@ -0,0 +1,67 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest + ports: + - protocol: TCP + containerPort: 8200 + +--- + +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + # nodePort: 30000 + # type: NodePort + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + # annotations: + # nginx.ingress.kubernetes.io/rewrite-target: /ui +spec: + rules: + - host: cnoe.localtest.me + http: + paths: + - path: /openbao + pathType: Prefix + backend: + service: + name: openbao + port: + number: 8200 \ No newline at end of file diff --git a/.history/ref-implementation/openbao/manifests/manifest_20241113101113.yml b/.history/ref-implementation/openbao/manifests/manifest_20241113101113.yml new file mode 100644 index 0000000..d9f9c28 --- /dev/null +++ b/.history/ref-implementation/openbao/manifests/manifest_20241113101113.yml @@ -0,0 +1,65 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: openbao + +--- + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: openbao + namespace: openbao +spec: + replicas: 1 + selector: + matchLabels: + app: openbao + template: + metadata: + labels: + app: openbao + spec: + containers: + - name: openbao + image: openbao/openbao:latest + ports: + - protocol: TCP + containerPort: 8200 + +--- + +apiVersion: v1 +kind: Service +metadata: + name: openbao + namespace: openbao +spec: + selector: + app: openbao + ports: + - protocol: TCP + port: 8200 + targetPort: 8200 + +--- + +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: openbao-ingress + namespace: openbao + # annotations: + # nginx.ingress.kubernetes.io/rewrite-target: /ui +spec: + rules: + - host: cnoe.localtest.me + http: + paths: + - path: /openbao + pathType: Prefix + backend: + service: + name: openbao + port: + number: 8200 \ No newline at end of file diff --git a/.history/ref-implementation/openbao/values_20241113103308.yaml b/.history/ref-implementation/openbao/values_20241113103308.yaml new file mode 100644 index 0000000..e69de29 diff --git a/.history/ref-implementation/openbao/values_20241113103317.yaml b/.history/ref-implementation/openbao/values_20241113103317.yaml new file mode 100644 index 0000000..30d74d2 --- /dev/null +++ b/.history/ref-implementation/openbao/values_20241113103317.yaml @@ -0,0 +1 @@ +test \ No newline at end of file diff --git a/.history/ref-implementation/openbao/values_20241113103322.yaml b/.history/ref-implementation/openbao/values_20241113103322.yaml new file mode 100644 index 0000000..23f90b4 --- /dev/null +++ b/.history/ref-implementation/openbao/values_20241113103322.yaml @@ -0,0 +1 @@ +test:123 \ No newline at end of file diff --git a/.history/ref-implementation/openbao/values_20241113103326.yaml b/.history/ref-implementation/openbao/values_20241113103326.yaml new file mode 100644 index 0000000..07fb25f --- /dev/null +++ b/.history/ref-implementation/openbao/values_20241113103326.yaml @@ -0,0 +1 @@ +test: 123 \ No newline at end of file diff --git a/.history/ref-implementation/openbao_20241113102912.yaml b/.history/ref-implementation/openbao_20241113102912.yaml new file mode 100644 index 0000000..164c5fb --- /dev/null +++ b/.history/ref-implementation/openbao_20241113102912.yaml @@ -0,0 +1,27 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argocd + namespace: argocd + labels: + env: dev +spec: + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true + destination: + name: in-cluster + namespace: argocd + sources: + - repoURL: https://github.com/argoproj/argo-helm + path: charts/argo-cd + targetRevision: HEAD + helm: + valueFiles: + - $values/stacks/core/argocd/values.yaml + - repoURL: https://gitea.cnoe.localtest.me/giteaAdmin/edfbuilder-shoot + targetRevision: HEAD + ref: values diff --git a/.history/ref-implementation/openbao_20241113103006.yaml b/.history/ref-implementation/openbao_20241113103006.yaml new file mode 100644 index 0000000..4879383 --- /dev/null +++ b/.history/ref-implementation/openbao_20241113103006.yaml @@ -0,0 +1,27 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argocd + namespace: argocd + labels: + env: dev +spec: + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true + destination: + name: in-cluster + namespace: argocd + sources: + - repoURL: https://github.com/openbao/openbao-helm.git + path: charts/argo-cd + targetRevision: HEAD + helm: + valueFiles: + - $values/stacks/core/argocd/values.yaml + - repoURL: https://gitea.cnoe.localtest.me/giteaAdmin/edfbuilder-shoot + targetRevision: HEAD + ref: values diff --git a/.history/ref-implementation/openbao_20241113103024.yaml b/.history/ref-implementation/openbao_20241113103024.yaml new file mode 100644 index 0000000..dbd59b5 --- /dev/null +++ b/.history/ref-implementation/openbao_20241113103024.yaml @@ -0,0 +1,27 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argocd + namespace: argocd + labels: + env: dev +spec: + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true + destination: + name: in-cluster + namespace: argocd + sources: + - repoURL: https://github.com/openbao/openbao-helm.git + path: charts/openbao + targetRevision: HEAD + helm: + valueFiles: + - $values/stacks/core/argocd/values.yaml + - repoURL: https://gitea.cnoe.localtest.me/giteaAdmin/edfbuilder-shoot + targetRevision: HEAD + ref: values diff --git a/.history/ref-implementation/openbao_20241113103029.yaml b/.history/ref-implementation/openbao_20241113103029.yaml new file mode 100644 index 0000000..8d66475 --- /dev/null +++ b/.history/ref-implementation/openbao_20241113103029.yaml @@ -0,0 +1,27 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argocd + namespace: argocd + labels: + env: dev +spec: + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true + destination: + name: in-cluster + namespace: argocd + sources: + - repoURL: https://github.com/openbao/openbao-helm.git + path: charts/openbao + targetRevision: HEAD + helm: + valueFiles: + - $values/stacks/core/openbao/values.yaml + - repoURL: https://gitea.cnoe.localtest.me/giteaAdmin/edfbuilder-shoot + targetRevision: HEAD + ref: values diff --git a/ref-implementation/openbao.yaml b/ref-implementation/openbao.yaml index d06ab5e..8d66475 100644 --- a/ref-implementation/openbao.yaml +++ b/ref-implementation/openbao.yaml @@ -1,19 +1,27 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: openbao + name: argocd namespace: argocd + labels: + env: dev spec: - destination: - namespace: openbao - server: "https://kubernetes.default.svc" - source: - repoURL: cnoe://openbao/manifests - targetRevision: HEAD - path: "." project: default syncPolicy: automated: selfHeal: true syncOptions: - CreateNamespace=true + destination: + name: in-cluster + namespace: argocd + sources: + - repoURL: https://github.com/openbao/openbao-helm.git + path: charts/openbao + targetRevision: HEAD + helm: + valueFiles: + - $values/stacks/core/openbao/values.yaml + - repoURL: https://gitea.cnoe.localtest.me/giteaAdmin/edfbuilder-shoot + targetRevision: HEAD + ref: values diff --git a/ref-implementation/openbao/manifests/ingress.yaml b/ref-implementation/openbao/manifests/ingress.yaml deleted file mode 100644 index f75a03d..0000000 --- a/ref-implementation/openbao/manifests/ingress.yaml +++ /dev/null @@ -1,18 +0,0 @@ -# apiVersion: networking.k8s.io/v1 -# kind: Ingress -# metadata: -# name: openbao-ingress-localhost -# namespace: openbao - -# spec: -# rules: -# - host: localhost # Change this to your domain or leave it as is for local development -# http: -# paths: -# - path: "" -# pathType: Exact -# backend: -# service: -# name: openbao -# port: -# number: 8200 # The port to forward to on your service diff --git a/ref-implementation/openbao/values.yaml b/ref-implementation/openbao/values.yaml new file mode 100644 index 0000000..07fb25f --- /dev/null +++ b/ref-implementation/openbao/values.yaml @@ -0,0 +1 @@ +test: 123 \ No newline at end of file From 384dff1c3e52ee4ecc91bb94e13de17881fe4302 Mon Sep 17 00:00:00 2001 From: miwr Date: Wed, 13 Nov 2024 10:45:28 +0100 Subject: [PATCH 16/18] test --- .../openbao_20241113104501.yaml | 27 +++++++++++++++++++ ref-implementation/openbao.yaml | 6 ++--- 2 files changed, 30 insertions(+), 3 deletions(-) create mode 100644 .history/ref-implementation/openbao_20241113104501.yaml diff --git a/.history/ref-implementation/openbao_20241113104501.yaml b/.history/ref-implementation/openbao_20241113104501.yaml new file mode 100644 index 0000000..b2e7e7f --- /dev/null +++ b/.history/ref-implementation/openbao_20241113104501.yaml @@ -0,0 +1,27 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: argocd + namespace: argocd + labels: + env: dev +spec: + project: default + syncPolicy: + automated: + selfHeal: true + syncOptions: + - CreateNamespace=true + destination: + name: in-cluster + namespace: argocd + sources: + - repoURL: https://github.com/openbao/openbao-helm.git + path: charts/openbao + targetRevision: HEAD + helm: + valueFiles: + - $values/stacks/core/openbao/values.yaml + # - repoURL: https://gitea.cnoe.localtest.me/giteaAdmin/edfbuilder-shoot + # targetRevision: HEAD + # ref: values diff --git a/ref-implementation/openbao.yaml b/ref-implementation/openbao.yaml index 8d66475..b2e7e7f 100644 --- a/ref-implementation/openbao.yaml +++ b/ref-implementation/openbao.yaml @@ -22,6 +22,6 @@ spec: helm: valueFiles: - $values/stacks/core/openbao/values.yaml - - repoURL: https://gitea.cnoe.localtest.me/giteaAdmin/edfbuilder-shoot - targetRevision: HEAD - ref: values + # - repoURL: https://gitea.cnoe.localtest.me/giteaAdmin/edfbuilder-shoot + # targetRevision: HEAD + # ref: values From 71223f2f6726c8eb4726af82e2fa757402f59d77 Mon Sep 17 00:00:00 2001 From: miwr Date: Wed, 13 Nov 2024 10:51:48 +0100 Subject: [PATCH 17/18] global: domain: cnoe.localtest.me --- .history/ref-implementation/openbao/values_20241113105141.yaml | 2 ++ .history/ref-implementation/openbao/values_20241113105142.yaml | 2 ++ ref-implementation/openbao/values.yaml | 3 ++- 3 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 .history/ref-implementation/openbao/values_20241113105141.yaml create mode 100644 .history/ref-implementation/openbao/values_20241113105142.yaml diff --git a/.history/ref-implementation/openbao/values_20241113105141.yaml b/.history/ref-implementation/openbao/values_20241113105141.yaml new file mode 100644 index 0000000..623e208 --- /dev/null +++ b/.history/ref-implementation/openbao/values_20241113105141.yaml @@ -0,0 +1,2 @@ +global: + domain: cnoe.localtest.me \ No newline at end of file diff --git a/.history/ref-implementation/openbao/values_20241113105142.yaml b/.history/ref-implementation/openbao/values_20241113105142.yaml new file mode 100644 index 0000000..623e208 --- /dev/null +++ b/.history/ref-implementation/openbao/values_20241113105142.yaml @@ -0,0 +1,2 @@ +global: + domain: cnoe.localtest.me \ No newline at end of file diff --git a/ref-implementation/openbao/values.yaml b/ref-implementation/openbao/values.yaml index 07fb25f..623e208 100644 --- a/ref-implementation/openbao/values.yaml +++ b/ref-implementation/openbao/values.yaml @@ -1 +1,2 @@ -test: 123 \ No newline at end of file +global: + domain: cnoe.localtest.me \ No newline at end of file From d8104418cffb81a422682c9ddf54d70070782bc6 Mon Sep 17 00:00:00 2001 From: "Michal.Wrobel" Date: Wed, 13 Nov 2024 09:58:36 +0000 Subject: [PATCH 18/18] ref-implementation/openbao.yaml aktualisiert --- ref-implementation/openbao.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/ref-implementation/openbao.yaml b/ref-implementation/openbao.yaml index b2e7e7f..c30e2dd 100644 --- a/ref-implementation/openbao.yaml +++ b/ref-implementation/openbao.yaml @@ -1,7 +1,7 @@ apiVersion: argoproj.io/v1alpha1 kind: Application metadata: - name: argocd + name: openbao namespace: argocd labels: env: dev @@ -14,7 +14,7 @@ spec: - CreateNamespace=true destination: name: in-cluster - namespace: argocd + namespace: openbao sources: - repoURL: https://github.com/openbao/openbao-helm.git path: charts/openbao @@ -22,6 +22,6 @@ spec: helm: valueFiles: - $values/stacks/core/openbao/values.yaml - # - repoURL: https://gitea.cnoe.localtest.me/giteaAdmin/edfbuilder-shoot - # targetRevision: HEAD - # ref: values + - repoURL: https://gitea.cnoe.localtest.me/giteaAdmin/edfbuilder-shoot + targetRevision: HEAD + ref: values