From 631aa6f626e1c6f58b708e815476132bf494a30a Mon Sep 17 00:00:00 2001 From: rblundon Date: Mon, 19 May 2025 11:18:25 -0500 Subject: [PATCH] initial acm config --- README.md | 4 +- acm-hub-bootstrap/values-secret.yaml.template | 38 - .../.github/workflows/validate-manifests.yaml | 31 - cluster-config/.gitignore | 8 - cluster-config/.yamllint | 9 - cluster-config/README.md | 136 -- cluster-config/bootstrap.sh | 10 - .../bootstrap/base/kustomization.yaml | 9 - cluster-config/bootstrap/base/values.yaml | 108 -- .../components/acm-hub/kustomization.yaml | 9 - .../bootstrap/components/acm-hub/values.yaml | 54 - .../components/kyverno/kustomization.yaml | 9 - .../bootstrap/components/kyverno/values.yaml | 43 - .../components/sno/kustomization.yaml | 9 - .../bootstrap/components/sno/values.yaml | 41 - .../overlays/local.aws/kustomization.yaml | 25 - .../bootstrap/overlays/local.aws/values.yaml | 14 - .../overlays/local.home/kustomization.yaml | 24 - .../bootstrap/overlays/local.home/values.yaml | 122 -- .../overlays/local.hub/kustomization.yaml | 32 - .../bootstrap/overlays/local.hub/values.yaml | 160 -- .../bootstrap/overlays/local/README.md | 3 - .../overlays/local/kustomization.yaml | 12 - .../bootstrap/overlays/local/values.yaml | 83 - .../overlays/rhdp/kustomization.yaml | 21 - .../bootstrap/overlays/rhdp/values.yaml | 92 - cluster-config/clusters/README.md | 1 - .../clusters/overlays/local.aws/README.md | 3 - .../kustomization.yaml | 13 - .../patch-source-and-name.yaml | 6 - .../cluster-monitoring-config-cm.yaml | 18 - .../openshift-monitoring/kustomization.yaml | 5 - .../clusters/overlays/local.home/README.md | 3 - .../clusterversion/base/clusterversion.yaml | 11 - .../clusterversion/base/kustomization.yaml | 5 - .../consolelinks/acs-consolelink.yaml | 11 - .../consolelinks/kustomization.yaml | 9 - .../consolelinks/nexus-consolelink.yaml | 11 - .../consolelinks/sonarqube-consolelink.yaml | 11 - .../consolelinks/tekton-hub-link.yaml | 211 -- .../kustomization.yaml | 15 - .../patch-source-and-name.yaml | 6 - .../local.home/components/lokistack/README.md | 54 - .../components/lokistack/kustomization.yaml | 8 - .../lokistack/loki-storage-qnap-secret.yaml | 16 - .../lvm-operator/kustomization.yaml | 15 - .../components/node-config/kustomization.yaml | 18 - .../components/node-config/set-max-pods.yaml | 12 - .../local.home/components/tenants/appset.yaml | 29 - .../components/tenants/kustomization.yaml | 5 - .../clusters/overlays/local.hub/README.md | 3 - .../components/acs-operator/certificate.yaml | 13 - .../acs-operator/kustomization.yaml | 6 - .../consolelinks/acs-consolelink.yaml | 11 - .../consolelinks/kustomization.yaml | 6 - .../kustomization.yaml | 15 - .../patch-source-and-name.yaml | 6 - .../eso/doppler-push-secret-store.yaml | 13 - .../components/eso/kustomization.yaml | 3 - .../local.hub/components/lokistack/README.md | 54 - .../components/lokistack/kustomization.yaml | 8 - .../lokistack/loki-storage-qnap-secret.yaml | 16 - .../lvm-operator/kustomization.yaml | 12 - .../components/nmstate/kustomization.yaml | 19 - .../node-network-configuration-policy.yaml | 68 - .../components/node-config/kustomization.yaml | 15 - .../components/node-config/set-max-pods.yaml | 12 - .../quay-registry-operator/README.md | 1 - .../generate/config-bundle-secret-qnap.yaml | 10 - .../generate/config-qnap-example.yaml | 31 - .../generate/create-qnap-sealed-secret.sh | 2 - .../generate/generate-certs.sh | 7 - .../quay-registry-operator/init-quay-job.yaml | 83 - .../init-user-password-secret.yaml | 15 - .../quay-registry-operator/kustomization.yaml | 15 - .../registry-app-route.yaml | 59 - .../registry-config-bundle-secret.yaml | 14 - .../quay-registry-operator/registry.yaml | 27 - .../rhtas-operator/kustomization.yaml | 14 - .../base/cluster-monitoring-config-cm.yaml | 8 - .../base/kustomization.yaml | 5 - .../3scale-operator/base/apimanager.yaml | 38 - .../acs-config/base/declarative-config.yaml | 125 -- .../acs-config/base/kustomization.yaml | 2 - .../admission-control-tls-push-secret.yaml | 26 - .../aggregate/collector-tls-push-secret.yaml | 26 - .../overlays/aggregate/kustomization.yaml | 31 - .../aggregate/sensor-tls-push-secret.yaml | 26 - .../acs-admission-control-tls-secret.yaml | 25 - .../acs-collector-tls-secret.yaml | 25 - .../acs-sensor-tls-secret.yaml | 25 - .../secured-cluster/kustomization.yaml | 19 - .../overlays/secured-cluster/namespace.yaml | 6 - .../secured-cluster/secured-cluster.yaml | 18 - .../sso/create-sso-auth-provider-job.yaml | 79 - .../overlays/sso/kustomization.yaml | 18 - .../overlays/sso/patch-resources.yaml | 22 - .../overlays/sso/sso-sealed-secret.yaml | 15 - .../components/acs-tokens/base/README.md | 7 - .../acs-tokens/base/kustomization.yaml | 6 - .../base/postsync-create-roxsecrets-job.yaml | 85 - .../postsync-create-roxsecrets-sa-rbac.yaml | 40 - .../base/postsync-roxsecret-namespaces.yaml | 8 - .../components/alertmanager/base/README.md | 1 - .../base/alertmanager-main-secret.yaml | 18 - .../alertmanager/base/kustomization.yaml | 5 - .../components/amq-streams-v1/base/README.md | 1 - .../amq-streams-v1/base/clusterextension.yaml | 15 - .../amq-streams-v1/base/clusterrole.yaml | 398 ---- .../base/clusterrolebinding.yaml | 12 - .../amq-streams-v1/base/kustomization.yaml | 6 - .../amq-streams-v1/base/namespace.yaml | 4 - .../amq-streams-v1/base/serviceaccount.yaml | 5 - .../amq-streams/base/kustomization.yaml | 2 - .../amq-streams/base/subscription.yaml | 11 - .../amq-streams-2.7.x/kustomization.yaml | 11 - .../argo-rollouts/base/kustomization.yaml | 6 - .../argo-rollouts/base/namespace.yaml | 7 - .../base/rollouts-analysis-monitoring.yaml | 11 - .../components/banner/base/README.md | 3 - .../components/banner/base/banner.yaml | 12 - .../components/banner/base/kustomization.yaml | 2 - .../camel-k-operator/base/kustomization.yaml | 5 - .../camel-k-operator/base/subscription.yaml | 11 - .../overlays/letsencrypt/kustomization.yaml | 4 - .../instance/base/certmanager.yaml | 15 - .../instance/base/kustomization.yaml | 2 - .../base/cert-manager-ns.yaml | 4 - .../base/kustomization.yaml | 11 - .../base/letsencrypt-aws-external.yaml | 15 - .../base/letsencrypt-prod-cluster-issuer.yaml | 23 - .../letsencrypt-staging-cluster-issuer.yaml | 23 - .../operator/base/kustomization.yaml | 12 - .../operator/base/operator-group.yaml | 8 - .../operator/base/operator-namespace.yaml | 8 - .../operator/base/subscription.yaml | 10 - .../certificates/base/apiserver.yaml | 14 - .../certificates/base/ingresscontroller.yaml | 11 - .../certificates/base/kustomization.yaml | 8 - .../base/openshift-api-certificate.yaml | 14 - .../base/openshift-wildcard-certificate.yaml | 15 - .../clean-completed-pods/base/README.md | 3 - .../base/clean-completed-pods-cronjob.yaml | 40 - .../base/kustomization.yaml | 6 - .../clean-completed-pods/base/namespace.yaml | 4 - .../clean-completed-pods/base/sa-rbac.yaml | 31 - .../base/codeready-workspaces-cr.yaml | 15 - .../kustomization.yaml | 5 - .../patch-scansetting.yaml | 8 - .../cis-compliance-scan-setting-binding.yaml | 19 - .../cis-compliance-scansetting.yaml | 37 - .../cis-compliance/kustomization.yaml | 27 - .../ocp-cis-node-tailored-profile.yaml | 18 - .../ocp-cis-tailored-profile.yaml | 38 - .../consolelinks/base/kustomization.yaml | 6 - .../consolelinks/base/quay-link.yaml | 11 - .../consolelinks/base/sso-link.yaml | 8 - .../base/kustomization.yaml | 2 - .../base/subscription.yaml | 11 - .../overlays/stable-3.10/kustomization.yaml | 11 - .../overlays/stable-3.13/kustomization.yaml | 11 - .../overlays/stable-3.9/kustomization.yaml | 11 - .../components/defrag-etcd/base/cronjob.yaml | 25 - .../defrag-etcd/base/kustomization.yaml | 5 - .../components/defrag-etcd/base/sa-rbac.yaml | 36 - .../base/kustomization.yaml | 16 - .../dev-console-plugin/base/namespace.yaml | 4 - .../dev-console-plugin/base/values.yaml | 4 - .../default/configure-sonarqube-job.yaml | 33 - .../overlays/default/kustomization.yaml | 48 - .../dev-tools/overlays/default/namespace.yaml | 7 - .../default/sonarqube-admin-secret.yaml | 15 - .../dev-tools/scripts/sonarqube-config | 27 - .../eso/instance/base/kustomization.yaml | 7 - .../eso/instance/base/namespace.yaml | 4 - .../eso/instance/base/operatorconfig.yaml | 22 - .../eso/instance/base/podmonitor.yaml | 27 - .../eso/instance/base/prometheus-rule.yaml | 20 - .../eso/operator/base/kustomization.yaml | 7 - .../eso/operator/base/namespace.yaml | 4 - .../eso/operator/base/operatorgroup.yaml | 6 - .../eso/operator/base/subscription.yaml | 11 - .../eso/overlays/aggregate/kustomization.yaml | 9 - .../base/kustomization.yaml | 5 - .../base/argocd-dex-server-rolebinding.yaml | 11 - .../base/argocd-external-secret.yaml | 19 - .../base/create-pipeline-local-user-job.yaml | 67 - .../base/gitops-operator-cr.yaml | 254 --- .../gitops-operator/base/kustomization.yaml | 9 - .../base/setenv-cmp-plugin-cm.yaml | 19 - .../gitops-operator/overlays/shared/README.md | 2 - .../overlays/shared/argocd-cluster-role.yaml | 184 -- .../shared/argocd-notifications-cm.yaml | 557 ------ .../overlays/shared/console-link.yaml | 12 - .../gitops-monitoring-cluster-role.yaml | 14 - .../overlays/shared/global-appproject.yaml | 28 - .../overlays/shared/kustomization.yaml | 73 - .../overlays/shared/namespace.yaml | 7 - .../overlays/shared/prometheus-rules.yaml | 35 - .../helm-repos/base/gnunn-gitops-repo.yaml | 8 - .../helm-repos/base/kustomization.yaml | 4 - .../base/generate/.skip_validation | 0 .../best-practices-policyGenerator.yaml | 90 - .../kyverno-acm/base/generate/generate.sh | 3 - .../base/generate/kustomization.yaml | 17 - .../generate/security-policyGenerator.yaml | 42 - .../kyverno-acm/base/kustomization.yaml | 8 - .../base/kyverno-acm-policies.yaml | 475 ----- .../kyverno-acm/base/placementrule.yaml | 14 - .../kyverno/base/kustomization.yaml | 23 - .../components/kyverno/base/namespace.yaml | 7 - .../components/kyverno/base/values.yaml | 269 --- .../annotate-route-argo-external-link.yaml | 64 - .../application-field-validation.yaml | 57 - .../application-prevent-default-project.yaml | 35 - .../policies/check-deprecated-apis.yaml | 119 -- .../check-openshift-deprecated-apis.yaml | 36 - .../policies/disallow-anyuid-scc-policy.yaml | 56 - .../disallow-jenkins-pipeline-strategy.yaml | 34 - .../policies/disallow-latest-tag.yaml | 41 - .../overlays/policies/kustomization.yaml | 19 - .../require-requests-limits-policy.yaml | 37 - .../overlays/policies/require-tls-routes.yaml | 39 - .../policies/validate-probes-policy.yaml | 37 - .../policies/verify-signed-images.yaml | 43 - .../login-template/base/kustomization.yaml | 16 - .../login-template/base/login/login.html | 1699 ----------------- .../login-template/base/login/providers.html | 772 -------- .../instance/base/clusterlogforwarder.yaml | 39 - .../loki/instance/base/clusterlogging.yaml | 14 - .../loki/instance/base/kustomization.yaml | 11 - .../instance/base/lokigateway-secret.yaml | 7 - .../loki/instance/base/lokistack.yaml | 18 - .../components/loki/instance/base/role.yaml | 29 - .../overlays/sno/ingestion-rate-patch.yaml | 11 - .../instance/overlays/sno/kustomization.yaml | 20 - .../cluster-logging/base/kustomization.yaml | 9 - .../cluster-logging/base/namespace.yaml | 6 - .../cluster-logging/base/operatorgroup.yaml | 7 - .../cluster-logging/base/subscription.yaml | 10 - .../operator/loki/base/kustomization.yaml | 9 - .../loki/operator/loki/base/namespace.yaml | 6 - .../operator/loki/base/operatorgroup.yaml | 5 - .../loki/operator/loki/base/subscription.yaml | 10 - .../lvm-operator/base/kustomization.yaml | 8 - .../lvm-operator/base/lvmcluster.yaml | 16 - .../lvm-operator/base/subscription.yaml | 11 - .../overlays/standalone/kustomization.yaml | 4 - .../overlays/standalone/namespace.yaml | 6 - .../overlays/standalone/operatorgroup.yaml | 9 - .../components/oauth/base/oauth.yaml | 6 - .../oauth/overlays/glauth/kustomization.yaml | 32 - .../overlays/glauth/ldap-external-secret.yaml | 15 - .../overlays/google/google-client-secret.yaml | 15 - .../oauth/overlays/google/kustomization.yaml | 24 - .../overlays/google/patch-google-idp.yaml | 11 - .../oauth/overlays/homelab/kustomization.yaml | 5 - .../htpass/htpass-secret-external.yaml | 15 - .../oauth/overlays/htpass/kustomization.yaml | 19 - .../oauth/overlays/matrix-template/README.md | 3 - .../matrix-template/kustomization.yaml | 20 - .../oauth/overlays/sso/console.yaml | 12 - .../oauth/overlays/sso/kustomization.yaml | 43 - .../overlays/sso/oidc-client-secret.yaml | 15 - .../instance/base/kustomization.yaml | 4 - .../base/noobaa-default-backing-store.yaml | 15 - .../instance/base/storage-cluster.yaml | 9 - .../instance/base/storage-system.yaml | 9 - .../overlays/no-registry/kustomization.yaml | 55 - .../components/openshift-monitoring/README.md | 4 - .../base/cluster-monitoring-config-cm.yaml | 48 - .../base/kustomization.yaml | 8 - .../base/monitoring-role-binding.yaml | 12 - .../base/service-account.yaml | 5 - .../base/token-secret.yaml | 8 - .../base/kustomization.yaml | 5 - .../pipelines-operator/base/subscription.yaml | 13 - .../base/tekton-config-metrics-partial.yaml | 13 - .../base/tekton-config.yaml | 129 -- .../overlays/chains/kustomization.yaml | 68 - .../overlays/chains/oidc-info-secret.yaml | 18 - .../chains/oidc-token-refresh-sa.yaml | 36 - .../chains/oidc-token-refresher-deploy.yaml | 55 - .../chains/openshift-pipelines-namespace.yaml | 10 - .../chains/signing-cert-external.yaml | 16 - .../overlays/results/kustomization.yaml | 7 - .../overlays/results/pvc.yaml | 10 - .../results/tekton-results-db-secret.yaml | 18 - .../results/tekton-results-tls-secret.yaml | 20 - .../overlays/results/tektonresults.yaml | 19 - .../rbac/base/cluster-admins-rolebinding.yaml | 12 - .../components/rbac/base/kustomization.yaml | 2 - .../registry-sno/base/kustomization.yaml | 3 - .../components/registry-sno/base/pvc.yaml | 12 - .../registry-sno/base/registry-config.yaml | 20 - .../instance/base/kustomization.yaml | 5 - .../instance/base/namespace.yaml | 6 - .../instance/base/securesign.yaml | 57 - .../operator/base/kustomization.yaml | 6 - .../operator/base/namespace.yaml | 6 - .../operator/base/operator-group.yaml | 6 - .../operator/base/subscription.yaml | 18 - .../rollout-manager/base/kustomization.yaml | 2 - .../rollout-manager/base/rolloutmanager.yaml | 6 - .../default/keycloak-migration-job.yaml | 45 - .../sso/overlays/default/kustomization.yaml | 18 - .../default/patch-sso-statefulset.yaml | 8 - .../components/tekton-hub/base/hub.yaml | 17 - .../base/copy-secrets-cronjob.yaml | 25 - .../base/copy-secrets-rbac.yaml | 37 - .../tenant-secrets/base/kustomization.yaml | 6 - .../tenant-secrets/base/namespace.yaml | 6 - .../prereqs/base/bombastic-default-obc.yaml | 8 - .../prereqs/base/bombastic-topics.yaml | 41 - .../prereqs/base/kafka.yaml | 35 - .../prereqs/base/kustomization.yaml | 15 - .../prereqs/base/namespace.yaml | 4 - .../prereqs/base/postgresql-deploy.yaml | 80 - .../prereqs/base/postgresql-es.yaml | 18 - .../prereqs/base/postgresql-pvc.yaml | 11 - .../prereqs/base/postgresql-svc.yaml | 11 - .../prereqs/base/v11y-default-obc.yaml | 8 - .../prereqs/base/v11y-topics.yaml | 41 - .../prereqs/base/vexination-default-obc.yaml | 8 - .../prereqs/base/vexination-topics.yaml | 41 - .../wake-on-lan/base/kustomization.yaml | 2 - .../wake-on-lan/base/wake-on-lan-mc.yaml | 21 - .../components/wake-on-lan/base/wol.service | 11 - .../base/kustomization.yaml | 2 - .../base/subscription.yaml | 11 - .../base/kubeletconfig.yaml | 11 - cluster-config/docs/img/argocd-logo.png | Bin 26745 -> 0 bytes cluster-config/docs/img/argocd.png | Bin 222670 -> 0 bytes cluster-config/docs/index.html | 8 - .../themes/aws.cluster/custom-cluster.css | 14 - .../docs/themes/local.home/custom-cluster.css | 14 - .../docs/themes/local.hub/custom-cluster.css | 14 - .../docs/themes/rhdp/custom-cluster.css | 14 - cluster-config/scripts/validate_manifests.sh | 88 - cluster-config/tenants/README.md | 1 - .../base/github-pipeline-scc-rolebinding.yaml | 12 - .../product-catalog/base/kustomization.yaml | 14 - .../base/monitor/kustomization.yaml | 38 - .../tenants/product-catalog/base/values.yaml | 71 - .../base/analysis-auth-monitoring.yaml | 13 - .../rollouts-demo/base/kustomization.yaml | 13 - .../tenants/rollouts-demo/base/values.yaml | 54 - cluster/acm/acm.yaml | 33 + .../base => cluster/acm}/kustomization.yaml | 3 +- cluster/acm/multiclusterhub.yaml | 9 + cluster/acm/namespace.yaml | 12 + cluster/acm/operatorconfig.yaml | 25 + cluster/acm/subscription.yaml | 13 + step-by-step.md | 11 +- .../acm-hub-bootstrap-old}/.gitignore | 0 .../acm-hub-bootstrap-old}/README.md | 0 .../acm-hub-bootstrap-old}/bootstrap.sh | 0 .../bootstrap/install-gitops/README.md | 0 .../bootstrap/install-gitops/setup.sh | 0 .../overlays/default/kustomization.yaml | 0 .../bootstrap/secrets/base/README.md | 0 .../secrets/base/hub-secrets-namespace.yaml | 0 .../bootstrap/secrets/base/kustomization.yaml | 0 .../bootstrap/secrets/base/namespace.yaml | 0 .../apps/acm/overlays/hub/kustomization.yaml | 0 .../custom-metrics-allowlist.yaml | 0 .../observability/gitops-dashboard.json | 0 .../overlays/observability/kustomization.yaml | 0 .../clusters/base/kustomization.yaml | 0 .../components/clusters/base/local-home.yaml | 0 .../components/clusters/base/local-hub.yaml | 0 .../cert-expiration/base/kustomization.yaml | 0 .../base/policy-cert-expiration.yaml | 0 .../compliance/base/kustomization.yaml | 0 .../base/scan-nist-800-53-policy.yaml | 0 .../gatekeeper/config-policy-namespace.yaml | 0 .../gatekeeper-exclude-namespaces.yaml | 0 .../gatekeeper/gatekeeper-install-policy.yaml | 0 .../policies/gitops/base/kustomization.yaml | 0 .../gitops/base/managedclustersetbinding.yaml | 0 .../base/manifests/eso/base/secret-store.yaml | 0 .../gitops-alerting/base/kustomization.yaml | 0 .../base/prometheus-rules.yaml | 0 .../gitops-bootstrap/base/bootstrap-app.yaml | 0 .../base/bootstrap-appproject.yaml | 0 .../gitops-bootstrap/base/kustomization.yaml | 0 .../gitops-instance/base/argocd.yaml | 0 .../gitops-instance/base/kustomization.yaml | 0 .../base/setenv-cmp-plugin-cm.yaml | 0 .../base/kustomization.yaml | 0 .../base/notifications-cm.yaml | 0 .../base/notifications-config.yaml | 0 .../base/argocd-external-secret.yaml | 0 .../gitops-secrets/base/kustomization.yaml | 0 .../base/notifications-secret.yaml | 0 .../base/cluster-admin-rolebinding.yaml | 0 .../base/gitops-controller-rbac.yaml | 0 .../base/gitops-server-rbac.yaml | 0 .../base/kustomization.yaml | 0 .../gitops-subscription/base/namespace.yaml | 0 .../base/sub-namespace.yaml | 0 .../base/sub-operatorgroup.yaml | 0 .../base/subscription.yaml | 0 .../policies/gitops/base/placement.yaml | 0 .../gitops/base/policy-generator-config.yaml | 0 .../opa/gatekeeper-probes-livenessnotset.yaml | 0 .../gatekeeper-probes-readinessnotset.yaml | 0 .../acm-hub-bootstrap}/.ansible-lint | 0 .../acm-hub-bootstrap}/.github/dependabot.yml | 0 .../.github/linters/.gitleaks.toml | 0 .../.github/linters/.markdown-lint.yml | 0 .../.github/workflows/ansible-lint.yml | 0 .../.github/workflows/jsonschema.yaml | 0 .../.github/workflows/superlinter.yml | 0 .../.github/workflows/update-metadata.yml | 0 .../acm-hub-bootstrap}/.gitignore | 0 .../acm-hub-bootstrap}/.gitleaks.toml | 0 .../acm-hub-bootstrap}/LICENSE | 0 .../acm-hub-bootstrap}/Makefile | 0 .../acm-hub-bootstrap}/README.md | 0 .../acm-hub-bootstrap}/ansible.cfg | 0 .../acm-hub-bootstrap}/ansible/site.yaml | 0 .../charts/all/config-demo/Chart.yaml | 0 .../config-demo/templates/config-demo-cm.yaml | 0 .../templates/config-demo-deployment.yaml | 0 .../config-demo-external-secret.yaml | 0 .../config-demo/templates/config-demo-is.yaml | 0 .../templates/config-demo-route.yaml | 0 .../templates/config-demo-svc.yaml | 0 .../charts/all/config-demo/values.yaml | 0 .../charts/all/hello-world/Chart.yaml | 0 .../hello-world/templates/hello-world-cm.yaml | 0 .../templates/hello-world-deployment.yaml | 0 .../templates/hello-world-route.yaml | 0 .../templates/hello-world-svc.yaml | 0 .../charts/all/hello-world/values.yaml | 0 .../acm-hub-bootstrap}/charts/region/.keep | 0 .../acm-hub-bootstrap}/common/.ansible-lint | 0 .../common/.github/dependabot.yml | 0 .../common/.github/linters/.gitleaks.toml | 0 .../common/.github/linters/.markdown-lint.yml | 0 .../.github/workflows/pattern-sh-ci.yml | 0 .../common/.github/workflows/superlinter.yml | 0 .../acm-hub-bootstrap}/common/.gitignore | 0 .../acm-hub-bootstrap}/common/.gitleaks.toml | 0 .../acm-hub-bootstrap}/common/Changes.md | 0 .../acm-hub-bootstrap}/common/LICENSE | 0 .../acm-hub-bootstrap}/common/Makefile | 0 .../acm-hub-bootstrap}/common/README.md | 0 .../common/requirements.yml | 0 .../common/scripts/deploy-pattern.sh | 0 .../scripts/determine-main-clustergroup.sh | 0 .../common/scripts/determine-pattern-name.sh | 0 .../scripts/determine-secretstore-backend.sh | 0 .../common/scripts/display-secrets-info.sh | 0 .../common/scripts/load-k8s-secrets.sh | 0 .../common/scripts/make-common-subtree.sh | 0 .../common/scripts/manage-secret-app.sh | 0 .../common/scripts/manage-secret-namespace.sh | 0 .../common/scripts/pattern-util.sh | 0 .../common/scripts/preview-all.sh | 0 .../common/scripts/preview.sh | 0 .../common/scripts/process-secrets.sh | 0 .../common/scripts/set-secret-backend.sh | 0 .../common/scripts/vault-utils.sh | 0 .../common/scripts/write-token-kubeconfig.sh | 0 .../overrides/values-AWS.yaml | 0 .../overrides/values-IBMCloud.yaml | 0 .../acm-hub-bootstrap}/pattern-metadata.yaml | 0 .../acm-hub-bootstrap}/pattern.sh | 0 .../tests/interop/README.md | 0 .../tests/interop/__init__.py | 0 .../tests/interop/conftest.py | 0 .../tests/interop/create_ci_badge.py | 0 .../tests/interop/requirements.txt | 0 .../tests/interop/run_tests.sh | 0 .../tests/interop/test_modify_web_content.py | 0 .../interop/test_subscription_status_edge.py | 0 .../interop/test_subscription_status_hub.py | 0 .../test_validate_edge_site_components.py | 0 .../test_validate_hub_site_components.py | 0 .../acm-hub-bootstrap}/values-4.18-hub.yaml | 0 .../acm-hub-bootstrap}/values-global.yaml | 0 .../acm-hub-bootstrap}/values-group-one.yaml | 0 .../acm-hub-bootstrap}/values-hub.yaml | 0 .../acm-hub-bootstrap}/values-standalone.yaml | 0 486 files changed, 106 insertions(+), 11791 deletions(-) delete mode 100644 acm-hub-bootstrap/values-secret.yaml.template delete mode 100644 cluster-config/.github/workflows/validate-manifests.yaml delete mode 100644 cluster-config/.gitignore delete mode 100644 cluster-config/.yamllint delete mode 100644 cluster-config/README.md delete mode 100755 cluster-config/bootstrap.sh delete mode 100644 cluster-config/bootstrap/base/kustomization.yaml delete mode 100644 cluster-config/bootstrap/base/values.yaml delete mode 100644 cluster-config/bootstrap/components/acm-hub/kustomization.yaml delete mode 100644 cluster-config/bootstrap/components/acm-hub/values.yaml delete mode 100644 cluster-config/bootstrap/components/kyverno/kustomization.yaml delete mode 100644 cluster-config/bootstrap/components/kyverno/values.yaml delete mode 100644 cluster-config/bootstrap/components/sno/kustomization.yaml delete mode 100644 cluster-config/bootstrap/components/sno/values.yaml delete mode 100644 cluster-config/bootstrap/overlays/local.aws/kustomization.yaml delete mode 100644 cluster-config/bootstrap/overlays/local.aws/values.yaml delete mode 100644 cluster-config/bootstrap/overlays/local.home/kustomization.yaml delete mode 100644 cluster-config/bootstrap/overlays/local.home/values.yaml delete mode 100644 cluster-config/bootstrap/overlays/local.hub/kustomization.yaml delete mode 100644 cluster-config/bootstrap/overlays/local.hub/values.yaml delete mode 100644 cluster-config/bootstrap/overlays/local/README.md delete mode 100644 cluster-config/bootstrap/overlays/local/kustomization.yaml delete mode 100644 cluster-config/bootstrap/overlays/local/values.yaml delete mode 100644 cluster-config/bootstrap/overlays/rhdp/kustomization.yaml delete mode 100644 cluster-config/bootstrap/overlays/rhdp/values.yaml delete mode 100644 cluster-config/clusters/README.md delete mode 100644 cluster-config/clusters/overlays/local.aws/README.md delete mode 100644 cluster-config/clusters/overlays/local.aws/components/cost-management-operator/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.aws/components/cost-management-operator/patch-source-and-name.yaml delete mode 100644 cluster-config/clusters/overlays/local.aws/components/openshift-monitoring/cluster-monitoring-config-cm.yaml delete mode 100644 cluster-config/clusters/overlays/local.aws/components/openshift-monitoring/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/README.md delete mode 100644 cluster-config/clusters/overlays/local.home/components/clusterversion/base/clusterversion.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/components/clusterversion/base/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/components/consolelinks/acs-consolelink.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/components/consolelinks/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/components/consolelinks/nexus-consolelink.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/components/consolelinks/sonarqube-consolelink.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/components/consolelinks/tekton-hub-link.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/components/cost-management-operator/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/components/cost-management-operator/patch-source-and-name.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/components/lokistack/README.md delete mode 100644 cluster-config/clusters/overlays/local.home/components/lokistack/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/components/lokistack/loki-storage-qnap-secret.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/components/lvm-operator/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/components/node-config/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/components/node-config/set-max-pods.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/components/tenants/appset.yaml delete mode 100644 cluster-config/clusters/overlays/local.home/components/tenants/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/README.md delete mode 100644 cluster-config/clusters/overlays/local.hub/components/acs-operator/certificate.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/acs-operator/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/consolelinks/acs-consolelink.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/consolelinks/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/cost-management-operator/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/cost-management-operator/patch-source-and-name.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/eso/doppler-push-secret-store.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/eso/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/lokistack/README.md delete mode 100644 cluster-config/clusters/overlays/local.hub/components/lokistack/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/lokistack/loki-storage-qnap-secret.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/lvm-operator/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/nmstate/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/nmstate/node-network-configuration-policy.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/node-config/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/node-config/set-max-pods.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/README.md delete mode 100644 cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/config-bundle-secret-qnap.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/config-qnap-example.yaml delete mode 100755 cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/create-qnap-sealed-secret.sh delete mode 100755 cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/generate-certs.sh delete mode 100644 cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/init-quay-job.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/init-user-password-secret.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/registry-app-route.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/registry-config-bundle-secret.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/registry.yaml delete mode 100644 cluster-config/clusters/overlays/local.hub/components/rhtas-operator/kustomization.yaml delete mode 100644 cluster-config/clusters/overlays/rhdp/components/openshift-monitoring/base/cluster-monitoring-config-cm.yaml delete mode 100644 cluster-config/clusters/overlays/rhdp/components/openshift-monitoring/base/kustomization.yaml delete mode 100644 cluster-config/components/3scale-operator/base/apimanager.yaml delete mode 100644 cluster-config/components/acs-config/base/declarative-config.yaml delete mode 100644 cluster-config/components/acs-config/base/kustomization.yaml delete mode 100644 cluster-config/components/acs-operator/overlays/aggregate/admission-control-tls-push-secret.yaml delete mode 100644 cluster-config/components/acs-operator/overlays/aggregate/collector-tls-push-secret.yaml delete mode 100644 cluster-config/components/acs-operator/overlays/aggregate/kustomization.yaml delete mode 100644 cluster-config/components/acs-operator/overlays/aggregate/sensor-tls-push-secret.yaml delete mode 100644 cluster-config/components/acs-operator/overlays/secured-cluster/acs-admission-control-tls-secret.yaml delete mode 100644 cluster-config/components/acs-operator/overlays/secured-cluster/acs-collector-tls-secret.yaml delete mode 100644 cluster-config/components/acs-operator/overlays/secured-cluster/acs-sensor-tls-secret.yaml delete mode 100644 cluster-config/components/acs-operator/overlays/secured-cluster/kustomization.yaml delete mode 100644 cluster-config/components/acs-operator/overlays/secured-cluster/namespace.yaml delete mode 100644 cluster-config/components/acs-operator/overlays/secured-cluster/secured-cluster.yaml delete mode 100644 cluster-config/components/acs-operator/overlays/sso/create-sso-auth-provider-job.yaml delete mode 100644 cluster-config/components/acs-operator/overlays/sso/kustomization.yaml delete mode 100644 cluster-config/components/acs-operator/overlays/sso/patch-resources.yaml delete mode 100644 cluster-config/components/acs-operator/overlays/sso/sso-sealed-secret.yaml delete mode 100644 cluster-config/components/acs-tokens/base/README.md delete mode 100644 cluster-config/components/acs-tokens/base/kustomization.yaml delete mode 100644 cluster-config/components/acs-tokens/base/postsync-create-roxsecrets-job.yaml delete mode 100644 cluster-config/components/acs-tokens/base/postsync-create-roxsecrets-sa-rbac.yaml delete mode 100644 cluster-config/components/acs-tokens/base/postsync-roxsecret-namespaces.yaml delete mode 100644 cluster-config/components/alertmanager/base/README.md delete mode 100644 cluster-config/components/alertmanager/base/alertmanager-main-secret.yaml delete mode 100644 cluster-config/components/alertmanager/base/kustomization.yaml delete mode 100644 cluster-config/components/amq-streams-v1/base/README.md delete mode 100644 cluster-config/components/amq-streams-v1/base/clusterextension.yaml delete mode 100644 cluster-config/components/amq-streams-v1/base/clusterrole.yaml delete mode 100644 cluster-config/components/amq-streams-v1/base/clusterrolebinding.yaml delete mode 100644 cluster-config/components/amq-streams-v1/base/kustomization.yaml delete mode 100644 cluster-config/components/amq-streams-v1/base/namespace.yaml delete mode 100644 cluster-config/components/amq-streams-v1/base/serviceaccount.yaml delete mode 100644 cluster-config/components/amq-streams/base/kustomization.yaml delete mode 100644 cluster-config/components/amq-streams/base/subscription.yaml delete mode 100644 cluster-config/components/amq-streams/overlays/amq-streams-2.7.x/kustomization.yaml delete mode 100644 cluster-config/components/argo-rollouts/base/kustomization.yaml delete mode 100644 cluster-config/components/argo-rollouts/base/namespace.yaml delete mode 100644 cluster-config/components/argo-rollouts/base/rollouts-analysis-monitoring.yaml delete mode 100644 cluster-config/components/banner/base/README.md delete mode 100644 cluster-config/components/banner/base/banner.yaml delete mode 100644 cluster-config/components/banner/base/kustomization.yaml delete mode 100644 cluster-config/components/camel-k-operator/base/kustomization.yaml delete mode 100644 cluster-config/components/camel-k-operator/base/subscription.yaml delete mode 100644 cluster-config/components/cert-manager-operator/aggregate/overlays/letsencrypt/kustomization.yaml delete mode 100644 cluster-config/components/cert-manager-operator/instance/base/certmanager.yaml delete mode 100644 cluster-config/components/cert-manager-operator/instance/base/kustomization.yaml delete mode 100644 cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/cert-manager-ns.yaml delete mode 100644 cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/kustomization.yaml delete mode 100644 cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/letsencrypt-aws-external.yaml delete mode 100644 cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/letsencrypt-prod-cluster-issuer.yaml delete mode 100644 cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/letsencrypt-staging-cluster-issuer.yaml delete mode 100644 cluster-config/components/cert-manager-operator/operator/base/kustomization.yaml delete mode 100644 cluster-config/components/cert-manager-operator/operator/base/operator-group.yaml delete mode 100644 cluster-config/components/cert-manager-operator/operator/base/operator-namespace.yaml delete mode 100644 cluster-config/components/cert-manager-operator/operator/base/subscription.yaml delete mode 100644 cluster-config/components/certificates/base/apiserver.yaml delete mode 100644 cluster-config/components/certificates/base/ingresscontroller.yaml delete mode 100644 cluster-config/components/certificates/base/kustomization.yaml delete mode 100644 cluster-config/components/certificates/base/openshift-api-certificate.yaml delete mode 100644 cluster-config/components/certificates/base/openshift-wildcard-certificate.yaml delete mode 100644 cluster-config/components/clean-completed-pods/base/README.md delete mode 100644 cluster-config/components/clean-completed-pods/base/clean-completed-pods-cronjob.yaml delete mode 100644 cluster-config/components/clean-completed-pods/base/kustomization.yaml delete mode 100644 cluster-config/components/clean-completed-pods/base/namespace.yaml delete mode 100644 cluster-config/components/clean-completed-pods/base/sa-rbac.yaml delete mode 100644 cluster-config/components/codeready-workspaces/base/codeready-workspaces-cr.yaml delete mode 100644 cluster-config/components/compliance-operator/overlays/cis-compliance-master-only/kustomization.yaml delete mode 100644 cluster-config/components/compliance-operator/overlays/cis-compliance-master-only/patch-scansetting.yaml delete mode 100644 cluster-config/components/compliance-operator/overlays/cis-compliance/cis-compliance-scan-setting-binding.yaml delete mode 100644 cluster-config/components/compliance-operator/overlays/cis-compliance/cis-compliance-scansetting.yaml delete mode 100644 cluster-config/components/compliance-operator/overlays/cis-compliance/kustomization.yaml delete mode 100644 cluster-config/components/compliance-operator/overlays/cis-compliance/ocp-cis-node-tailored-profile.yaml delete mode 100644 cluster-config/components/compliance-operator/overlays/cis-compliance/ocp-cis-tailored-profile.yaml delete mode 100644 cluster-config/components/consolelinks/base/kustomization.yaml delete mode 100644 cluster-config/components/consolelinks/base/quay-link.yaml delete mode 100644 cluster-config/components/consolelinks/base/sso-link.yaml delete mode 100644 cluster-config/components/container-security-operator/base/kustomization.yaml delete mode 100644 cluster-config/components/container-security-operator/base/subscription.yaml delete mode 100644 cluster-config/components/container-security-operator/overlays/stable-3.10/kustomization.yaml delete mode 100644 cluster-config/components/container-security-operator/overlays/stable-3.13/kustomization.yaml delete mode 100644 cluster-config/components/container-security-operator/overlays/stable-3.9/kustomization.yaml delete mode 100644 cluster-config/components/defrag-etcd/base/cronjob.yaml delete mode 100644 cluster-config/components/defrag-etcd/base/kustomization.yaml delete mode 100644 cluster-config/components/defrag-etcd/base/sa-rbac.yaml delete mode 100644 cluster-config/components/dev-console-plugin/base/kustomization.yaml delete mode 100644 cluster-config/components/dev-console-plugin/base/namespace.yaml delete mode 100644 cluster-config/components/dev-console-plugin/base/values.yaml delete mode 100644 cluster-config/components/dev-tools/overlays/default/configure-sonarqube-job.yaml delete mode 100644 cluster-config/components/dev-tools/overlays/default/kustomization.yaml delete mode 100644 cluster-config/components/dev-tools/overlays/default/namespace.yaml delete mode 100644 cluster-config/components/dev-tools/overlays/default/sonarqube-admin-secret.yaml delete mode 100644 cluster-config/components/dev-tools/scripts/sonarqube-config delete mode 100644 cluster-config/components/eso/instance/base/kustomization.yaml delete mode 100644 cluster-config/components/eso/instance/base/namespace.yaml delete mode 100644 cluster-config/components/eso/instance/base/operatorconfig.yaml delete mode 100644 cluster-config/components/eso/instance/base/podmonitor.yaml delete mode 100644 cluster-config/components/eso/instance/base/prometheus-rule.yaml delete mode 100644 cluster-config/components/eso/operator/base/kustomization.yaml delete mode 100644 cluster-config/components/eso/operator/base/namespace.yaml delete mode 100644 cluster-config/components/eso/operator/base/operatorgroup.yaml delete mode 100644 cluster-config/components/eso/operator/base/subscription.yaml delete mode 100644 cluster-config/components/eso/overlays/aggregate/kustomization.yaml delete mode 100644 cluster-config/components/gitops-admin-plugin/base/kustomization.yaml delete mode 100644 cluster-config/components/gitops-operator/base/argocd-dex-server-rolebinding.yaml delete mode 100644 cluster-config/components/gitops-operator/base/argocd-external-secret.yaml delete mode 100644 cluster-config/components/gitops-operator/base/create-pipeline-local-user-job.yaml delete mode 100644 cluster-config/components/gitops-operator/base/gitops-operator-cr.yaml delete mode 100644 cluster-config/components/gitops-operator/base/kustomization.yaml delete mode 100644 cluster-config/components/gitops-operator/base/setenv-cmp-plugin-cm.yaml delete mode 100644 cluster-config/components/gitops-operator/overlays/shared/README.md delete mode 100644 cluster-config/components/gitops-operator/overlays/shared/argocd-cluster-role.yaml delete mode 100644 cluster-config/components/gitops-operator/overlays/shared/argocd-notifications-cm.yaml delete mode 100644 cluster-config/components/gitops-operator/overlays/shared/console-link.yaml delete mode 100644 cluster-config/components/gitops-operator/overlays/shared/gitops-monitoring-cluster-role.yaml delete mode 100644 cluster-config/components/gitops-operator/overlays/shared/global-appproject.yaml delete mode 100644 cluster-config/components/gitops-operator/overlays/shared/kustomization.yaml delete mode 100644 cluster-config/components/gitops-operator/overlays/shared/namespace.yaml delete mode 100644 cluster-config/components/gitops-operator/overlays/shared/prometheus-rules.yaml delete mode 100644 cluster-config/components/helm-repos/base/gnunn-gitops-repo.yaml delete mode 100644 cluster-config/components/helm-repos/base/kustomization.yaml delete mode 100644 cluster-config/components/kyverno-acm/base/generate/.skip_validation delete mode 100644 cluster-config/components/kyverno-acm/base/generate/best-practices-policyGenerator.yaml delete mode 100755 cluster-config/components/kyverno-acm/base/generate/generate.sh delete mode 100644 cluster-config/components/kyverno-acm/base/generate/kustomization.yaml delete mode 100644 cluster-config/components/kyverno-acm/base/generate/security-policyGenerator.yaml delete mode 100644 cluster-config/components/kyverno-acm/base/kustomization.yaml delete mode 100644 cluster-config/components/kyverno-acm/base/kyverno-acm-policies.yaml delete mode 100644 cluster-config/components/kyverno-acm/base/placementrule.yaml delete mode 100644 cluster-config/components/kyverno/base/kustomization.yaml delete mode 100644 cluster-config/components/kyverno/base/namespace.yaml delete mode 100644 cluster-config/components/kyverno/base/values.yaml delete mode 100644 cluster-config/components/kyverno/overlays/policies/annotate-route-argo-external-link.yaml delete mode 100644 cluster-config/components/kyverno/overlays/policies/application-field-validation.yaml delete mode 100644 cluster-config/components/kyverno/overlays/policies/application-prevent-default-project.yaml delete mode 100644 cluster-config/components/kyverno/overlays/policies/check-deprecated-apis.yaml delete mode 100644 cluster-config/components/kyverno/overlays/policies/check-openshift-deprecated-apis.yaml delete mode 100644 cluster-config/components/kyverno/overlays/policies/disallow-anyuid-scc-policy.yaml delete mode 100644 cluster-config/components/kyverno/overlays/policies/disallow-jenkins-pipeline-strategy.yaml delete mode 100644 cluster-config/components/kyverno/overlays/policies/disallow-latest-tag.yaml delete mode 100644 cluster-config/components/kyverno/overlays/policies/kustomization.yaml delete mode 100644 cluster-config/components/kyverno/overlays/policies/require-requests-limits-policy.yaml delete mode 100644 cluster-config/components/kyverno/overlays/policies/require-tls-routes.yaml delete mode 100644 cluster-config/components/kyverno/overlays/policies/validate-probes-policy.yaml delete mode 100644 cluster-config/components/kyverno/overlays/policies/verify-signed-images.yaml delete mode 100644 cluster-config/components/login-template/base/kustomization.yaml delete mode 100644 cluster-config/components/login-template/base/login/login.html delete mode 100644 cluster-config/components/login-template/base/login/providers.html delete mode 100644 cluster-config/components/loki/instance/base/clusterlogforwarder.yaml delete mode 100644 cluster-config/components/loki/instance/base/clusterlogging.yaml delete mode 100644 cluster-config/components/loki/instance/base/kustomization.yaml delete mode 100644 cluster-config/components/loki/instance/base/lokigateway-secret.yaml delete mode 100644 cluster-config/components/loki/instance/base/lokistack.yaml delete mode 100644 cluster-config/components/loki/instance/base/role.yaml delete mode 100644 cluster-config/components/loki/instance/overlays/sno/ingestion-rate-patch.yaml delete mode 100644 cluster-config/components/loki/instance/overlays/sno/kustomization.yaml delete mode 100644 cluster-config/components/loki/operator/cluster-logging/base/kustomization.yaml delete mode 100644 cluster-config/components/loki/operator/cluster-logging/base/namespace.yaml delete mode 100644 cluster-config/components/loki/operator/cluster-logging/base/operatorgroup.yaml delete mode 100644 cluster-config/components/loki/operator/cluster-logging/base/subscription.yaml delete mode 100644 cluster-config/components/loki/operator/loki/base/kustomization.yaml delete mode 100644 cluster-config/components/loki/operator/loki/base/namespace.yaml delete mode 100644 cluster-config/components/loki/operator/loki/base/operatorgroup.yaml delete mode 100644 cluster-config/components/loki/operator/loki/base/subscription.yaml delete mode 100644 cluster-config/components/lvm-operator/base/kustomization.yaml delete mode 100644 cluster-config/components/lvm-operator/base/lvmcluster.yaml delete mode 100644 cluster-config/components/lvm-operator/base/subscription.yaml delete mode 100644 cluster-config/components/lvm-operator/overlays/standalone/kustomization.yaml delete mode 100644 cluster-config/components/lvm-operator/overlays/standalone/namespace.yaml delete mode 100644 cluster-config/components/lvm-operator/overlays/standalone/operatorgroup.yaml delete mode 100644 cluster-config/components/oauth/base/oauth.yaml delete mode 100644 cluster-config/components/oauth/overlays/glauth/kustomization.yaml delete mode 100644 cluster-config/components/oauth/overlays/glauth/ldap-external-secret.yaml delete mode 100644 cluster-config/components/oauth/overlays/google/google-client-secret.yaml delete mode 100644 cluster-config/components/oauth/overlays/google/kustomization.yaml delete mode 100644 cluster-config/components/oauth/overlays/google/patch-google-idp.yaml delete mode 100644 cluster-config/components/oauth/overlays/homelab/kustomization.yaml delete mode 100644 cluster-config/components/oauth/overlays/htpass/htpass-secret-external.yaml delete mode 100644 cluster-config/components/oauth/overlays/htpass/kustomization.yaml delete mode 100644 cluster-config/components/oauth/overlays/matrix-template/README.md delete mode 100644 cluster-config/components/oauth/overlays/matrix-template/kustomization.yaml delete mode 100644 cluster-config/components/oauth/overlays/sso/console.yaml delete mode 100644 cluster-config/components/oauth/overlays/sso/kustomization.yaml delete mode 100644 cluster-config/components/oauth/overlays/sso/oidc-client-secret.yaml delete mode 100644 cluster-config/components/odf-operator/instance/base/kustomization.yaml delete mode 100644 cluster-config/components/odf-operator/instance/base/noobaa-default-backing-store.yaml delete mode 100644 cluster-config/components/odf-operator/instance/base/storage-cluster.yaml delete mode 100644 cluster-config/components/odf-operator/instance/base/storage-system.yaml delete mode 100644 cluster-config/components/odf-operator/operator/overlays/no-registry/kustomization.yaml delete mode 100644 cluster-config/components/openshift-monitoring/README.md delete mode 100644 cluster-config/components/openshift-monitoring/base/cluster-monitoring-config-cm.yaml delete mode 100644 cluster-config/components/openshift-monitoring/base/kustomization.yaml delete mode 100644 cluster-config/components/openshift-monitoring/base/monitoring-role-binding.yaml delete mode 100644 cluster-config/components/openshift-monitoring/base/service-account.yaml delete mode 100644 cluster-config/components/openshift-monitoring/base/token-secret.yaml delete mode 100644 cluster-config/components/pipelines-operator/base/kustomization.yaml delete mode 100644 cluster-config/components/pipelines-operator/base/subscription.yaml delete mode 100644 cluster-config/components/pipelines-operator/base/tekton-config-metrics-partial.yaml delete mode 100644 cluster-config/components/pipelines-operator/base/tekton-config.yaml delete mode 100644 cluster-config/components/pipelines-operator/overlays/chains/kustomization.yaml delete mode 100644 cluster-config/components/pipelines-operator/overlays/chains/oidc-info-secret.yaml delete mode 100644 cluster-config/components/pipelines-operator/overlays/chains/oidc-token-refresh-sa.yaml delete mode 100644 cluster-config/components/pipelines-operator/overlays/chains/oidc-token-refresher-deploy.yaml delete mode 100644 cluster-config/components/pipelines-operator/overlays/chains/openshift-pipelines-namespace.yaml delete mode 100644 cluster-config/components/pipelines-operator/overlays/chains/signing-cert-external.yaml delete mode 100644 cluster-config/components/pipelines-operator/overlays/results/kustomization.yaml delete mode 100644 cluster-config/components/pipelines-operator/overlays/results/pvc.yaml delete mode 100644 cluster-config/components/pipelines-operator/overlays/results/tekton-results-db-secret.yaml delete mode 100644 cluster-config/components/pipelines-operator/overlays/results/tekton-results-tls-secret.yaml delete mode 100644 cluster-config/components/pipelines-operator/overlays/results/tektonresults.yaml delete mode 100644 cluster-config/components/rbac/base/cluster-admins-rolebinding.yaml delete mode 100644 cluster-config/components/rbac/base/kustomization.yaml delete mode 100644 cluster-config/components/registry-sno/base/kustomization.yaml delete mode 100644 cluster-config/components/registry-sno/base/pvc.yaml delete mode 100644 cluster-config/components/registry-sno/base/registry-config.yaml delete mode 100644 cluster-config/components/rhtas-operator/instance/base/kustomization.yaml delete mode 100644 cluster-config/components/rhtas-operator/instance/base/namespace.yaml delete mode 100644 cluster-config/components/rhtas-operator/instance/base/securesign.yaml delete mode 100644 cluster-config/components/rhtas-operator/operator/base/kustomization.yaml delete mode 100644 cluster-config/components/rhtas-operator/operator/base/namespace.yaml delete mode 100644 cluster-config/components/rhtas-operator/operator/base/operator-group.yaml delete mode 100644 cluster-config/components/rhtas-operator/operator/base/subscription.yaml delete mode 100644 cluster-config/components/rollout-manager/base/kustomization.yaml delete mode 100644 cluster-config/components/rollout-manager/base/rolloutmanager.yaml delete mode 100644 cluster-config/components/sso/overlays/default/keycloak-migration-job.yaml delete mode 100644 cluster-config/components/sso/overlays/default/kustomization.yaml delete mode 100644 cluster-config/components/sso/overlays/default/patch-sso-statefulset.yaml delete mode 100644 cluster-config/components/tekton-hub/base/hub.yaml delete mode 100644 cluster-config/components/tenant-secrets/base/copy-secrets-cronjob.yaml delete mode 100644 cluster-config/components/tenant-secrets/base/copy-secrets-rbac.yaml delete mode 100644 cluster-config/components/tenant-secrets/base/kustomization.yaml delete mode 100644 cluster-config/components/tenant-secrets/base/namespace.yaml delete mode 100644 cluster-config/components/trusted-profile-analyzer/prereqs/base/bombastic-default-obc.yaml delete mode 100644 cluster-config/components/trusted-profile-analyzer/prereqs/base/bombastic-topics.yaml delete mode 100644 cluster-config/components/trusted-profile-analyzer/prereqs/base/kafka.yaml delete mode 100644 cluster-config/components/trusted-profile-analyzer/prereqs/base/kustomization.yaml delete mode 100644 cluster-config/components/trusted-profile-analyzer/prereqs/base/namespace.yaml delete mode 100644 cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-deploy.yaml delete mode 100644 cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-es.yaml delete mode 100644 cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-pvc.yaml delete mode 100644 cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-svc.yaml delete mode 100644 cluster-config/components/trusted-profile-analyzer/prereqs/base/v11y-default-obc.yaml delete mode 100644 cluster-config/components/trusted-profile-analyzer/prereqs/base/v11y-topics.yaml delete mode 100644 cluster-config/components/trusted-profile-analyzer/prereqs/base/vexination-default-obc.yaml delete mode 100644 cluster-config/components/trusted-profile-analyzer/prereqs/base/vexination-topics.yaml delete mode 100644 cluster-config/components/wake-on-lan/base/kustomization.yaml delete mode 100644 cluster-config/components/wake-on-lan/base/wake-on-lan-mc.yaml delete mode 100644 cluster-config/components/wake-on-lan/base/wol.service delete mode 100644 cluster-config/components/web-terminal-operator/base/kustomization.yaml delete mode 100644 cluster-config/components/web-terminal-operator/base/subscription.yaml delete mode 100644 cluster-config/components/worker-node-config/base/kubeletconfig.yaml delete mode 100644 cluster-config/docs/img/argocd-logo.png delete mode 100644 cluster-config/docs/img/argocd.png delete mode 100644 cluster-config/docs/index.html delete mode 100644 cluster-config/docs/themes/aws.cluster/custom-cluster.css delete mode 100644 cluster-config/docs/themes/local.home/custom-cluster.css delete mode 100644 cluster-config/docs/themes/local.hub/custom-cluster.css delete mode 100644 cluster-config/docs/themes/rhdp/custom-cluster.css delete mode 100755 cluster-config/scripts/validate_manifests.sh delete mode 100644 cluster-config/tenants/README.md delete mode 100644 cluster-config/tenants/product-catalog/base/github-pipeline-scc-rolebinding.yaml delete mode 100644 cluster-config/tenants/product-catalog/base/kustomization.yaml delete mode 100644 cluster-config/tenants/product-catalog/base/monitor/kustomization.yaml delete mode 100644 cluster-config/tenants/product-catalog/base/values.yaml delete mode 100644 cluster-config/tenants/rollouts-demo/base/analysis-auth-monitoring.yaml delete mode 100644 cluster-config/tenants/rollouts-demo/base/kustomization.yaml delete mode 100644 cluster-config/tenants/rollouts-demo/base/values.yaml create mode 100644 cluster/acm/acm.yaml rename {cluster-config/components/oauth/base => cluster/acm}/kustomization.yaml (78%) create mode 100644 cluster/acm/multiclusterhub.yaml create mode 100644 cluster/acm/namespace.yaml create mode 100644 cluster/acm/operatorconfig.yaml create mode 100644 cluster/acm/subscription.yaml rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/.gitignore (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/README.md (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/bootstrap.sh (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/bootstrap/install-gitops/README.md (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/bootstrap/install-gitops/setup.sh (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/bootstrap/policies/overlays/default/kustomization.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/bootstrap/secrets/base/README.md (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/bootstrap/secrets/base/hub-secrets-namespace.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/bootstrap/secrets/base/kustomization.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/bootstrap/secrets/base/namespace.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/apps/acm/overlays/hub/kustomization.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/apps/acm/overlays/observability/custom-metrics-allowlist.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/apps/acm/overlays/observability/gitops-dashboard.json (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/apps/acm/overlays/observability/kustomization.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/clusters/base/kustomization.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/clusters/base/local-home.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/clusters/base/local-hub.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/cert-expiration/base/kustomization.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/cert-expiration/base/policy-cert-expiration.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/compliance/base/kustomization.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/compliance/base/scan-nist-800-53-policy.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gatekeeper/config-policy-namespace.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gatekeeper/gatekeeper-exclude-namespaces.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gatekeeper/gatekeeper-install-policy.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/kustomization.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/managedclustersetbinding.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/eso/base/secret-store.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-alerting/base/kustomization.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-alerting/base/prometheus-rules.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-bootstrap/base/bootstrap-app.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-bootstrap/base/bootstrap-appproject.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-bootstrap/base/kustomization.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-instance/base/argocd.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-instance/base/kustomization.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-instance/base/setenv-cmp-plugin-cm.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-notifications/base/kustomization.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-notifications/base/notifications-cm.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-notifications/base/notifications-config.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-secrets/base/argocd-external-secret.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-secrets/base/kustomization.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-secrets/base/notifications-secret.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-subscription/base/cluster-admin-rolebinding.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-subscription/base/gitops-controller-rbac.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-subscription/base/gitops-server-rbac.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-subscription/base/kustomization.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-subscription/base/namespace.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-subscription/base/sub-namespace.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-subscription/base/sub-operatorgroup.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/manifests/gitops-subscription/base/subscription.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/placement.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/gitops/base/policy-generator-config.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/opa/gatekeeper-probes-livenessnotset.yaml (100%) rename {acm-hub-bootstrap-old => tmp/acm-hub-bootstrap-old}/components/policies/opa/gatekeeper-probes-readinessnotset.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/.ansible-lint (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/.github/dependabot.yml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/.github/linters/.gitleaks.toml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/.github/linters/.markdown-lint.yml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/.github/workflows/ansible-lint.yml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/.github/workflows/jsonschema.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/.github/workflows/superlinter.yml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/.github/workflows/update-metadata.yml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/.gitignore (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/.gitleaks.toml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/LICENSE (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/Makefile (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/README.md (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/ansible.cfg (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/ansible/site.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/charts/all/config-demo/Chart.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/charts/all/config-demo/templates/config-demo-cm.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/charts/all/config-demo/templates/config-demo-deployment.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/charts/all/config-demo/templates/config-demo-external-secret.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/charts/all/config-demo/templates/config-demo-is.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/charts/all/config-demo/templates/config-demo-route.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/charts/all/config-demo/templates/config-demo-svc.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/charts/all/config-demo/values.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/charts/all/hello-world/Chart.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/charts/all/hello-world/templates/hello-world-cm.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/charts/all/hello-world/templates/hello-world-deployment.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/charts/all/hello-world/templates/hello-world-route.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/charts/all/hello-world/templates/hello-world-svc.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/charts/all/hello-world/values.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/charts/region/.keep (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/.ansible-lint (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/.github/dependabot.yml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/.github/linters/.gitleaks.toml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/.github/linters/.markdown-lint.yml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/.github/workflows/pattern-sh-ci.yml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/.github/workflows/superlinter.yml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/.gitignore (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/.gitleaks.toml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/Changes.md (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/LICENSE (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/Makefile (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/README.md (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/requirements.yml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/deploy-pattern.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/determine-main-clustergroup.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/determine-pattern-name.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/determine-secretstore-backend.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/display-secrets-info.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/load-k8s-secrets.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/make-common-subtree.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/manage-secret-app.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/manage-secret-namespace.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/pattern-util.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/preview-all.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/preview.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/process-secrets.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/set-secret-backend.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/vault-utils.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/common/scripts/write-token-kubeconfig.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/overrides/values-AWS.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/overrides/values-IBMCloud.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/pattern-metadata.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/pattern.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/tests/interop/README.md (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/tests/interop/__init__.py (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/tests/interop/conftest.py (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/tests/interop/create_ci_badge.py (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/tests/interop/requirements.txt (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/tests/interop/run_tests.sh (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/tests/interop/test_modify_web_content.py (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/tests/interop/test_subscription_status_edge.py (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/tests/interop/test_subscription_status_hub.py (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/tests/interop/test_validate_edge_site_components.py (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/tests/interop/test_validate_hub_site_components.py (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/values-4.18-hub.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/values-global.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/values-group-one.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/values-hub.yaml (100%) rename {acm-hub-bootstrap => tmp/acm-hub-bootstrap}/values-standalone.yaml (100%) diff --git a/README.md b/README.md index eb09cca..ab65486 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ This repo is a mono-repo that is broken up into three sections: - infra-config - apps -- cluster-config +- cluster ## Hardware @@ -58,7 +58,7 @@ A Single Node OpenShift (SNO) instance, installed on bare metal, will act as a H - Advanced Cluster Management - Ansible Automation Platform - Vault -- OpenShift GitOps +- ~~OpenShift GitOps~~ #### Network Prerequisites diff --git a/acm-hub-bootstrap/values-secret.yaml.template b/acm-hub-bootstrap/values-secret.yaml.template deleted file mode 100644 index e16735d..0000000 --- a/acm-hub-bootstrap/values-secret.yaml.template +++ /dev/null @@ -1,38 +0,0 @@ -# A more formal description of this format can be found here: -# https://github.com/validatedpatterns/rhvp.cluster_utils/tree/main/roles/vault_utils#values-secret-file-format - -version: "2.0" -# Ideally you NEVER COMMIT THESE VALUES TO GIT (although if all passwords are -# automatically generated inside the vault this should not really matter) - -secrets: - - name: config-demo - vaultPrefixes: - - global - fields: - - name: secret - onMissingValue: generate - vaultPolicy: validatedPatternDefaultPolicy - - # If you use clusterPools you will need to uncomment the following lines - #- name: aws - # fields: - # - name: aws_access_key_id - # ini_file: ~/.aws/credentials - # ini_section: default - # ini_key: aws_access_key_id - # - name: aws_secret_access_key - # ini_file: ~/.aws/credentials - # ini_key: aws_secret_access_key - #- name: publickey - # fields: - # - name: content - # path: ~/.ssh/id_rsa.pub - #- name: privatekey - # fields: - # - name: content - # path: ~/.ssh/id_rsa - #- name: openshiftPullSecret - # fields: - # - name: content - # path: ~/.pullsecret.json diff --git a/cluster-config/.github/workflows/validate-manifests.yaml b/cluster-config/.github/workflows/validate-manifests.yaml deleted file mode 100644 index e1423aa..0000000 --- a/cluster-config/.github/workflows/validate-manifests.yaml +++ /dev/null @@ -1,31 +0,0 @@ -name: Validate Manifests -on: - push: - branches: - - "*" - pull_request: - branches: - - "*" - -jobs: - lint-yaml: - runs-on: ubuntu-latest - steps: - - name: Code Checkout - uses: actions/checkout@v3 - - name: Validate YAML - uses: ibiqlik/action-yamllint@v3 - with: - format: github - lint-kustomize: - runs-on: ubuntu-latest - steps: - - name: Code Checkout - uses: actions/checkout@v3 - - name: Verify Kustomize CLI Installation - run: | - which kustomize - kustomize version - - name: Validate Manifests - run: | - ./scripts/validate_manifests.sh diff --git a/cluster-config/.gitignore b/cluster-config/.gitignore deleted file mode 100644 index fad2efc..0000000 --- a/cluster-config/.gitignore +++ /dev/null @@ -1,8 +0,0 @@ -sealed-secrets-secret.yaml -cloud-dns-credentials.yaml -alertmanager.yaml -google-secret.yaml -*-private.yaml -*-private.yml -charts -qnap-tls diff --git a/cluster-config/.yamllint b/cluster-config/.yamllint deleted file mode 100644 index 361c2d3..0000000 --- a/cluster-config/.yamllint +++ /dev/null @@ -1,9 +0,0 @@ -extends: default - -rules: - document-start: disable - indentation: - indent-sequences: whatever - line-length: disable - truthy: - ignore: .github/workflows/ diff --git a/cluster-config/README.md b/cluster-config/README.md deleted file mode 100644 index 705a22e..0000000 --- a/cluster-config/README.md +++ /dev/null @@ -1,136 +0,0 @@ -# GitOps Cluster Configuration - -This repo contains the cluster configuration I use for my personal OpenShift clusters. Like my other GitOps repos it leverages ArgoCD heavily. This repo originally followed the folder structure defined in the [Standards](https://github.com/gnunn-gitops/standards) repository but there has been some tweaks that need to be reflected back in that document. - -# Structure - -Similar to my standards document, the repo consists of four high level folders: - -* _bootstrap_ - the minimal yaml needed to bootstrap the cluster-config into argocd. It deploys a known sealed-secret private key along with an "app of app" `cluster-config-manager` that deploys the entirety of the cluster configuration. -* _components_ - a base set of kustomize manifests and yaml for applications, operators, configuration and ArgoCD app/project definitions. Everything is inherited from here -* _clusters_ - Cluster specific configuration, this inherits and kustomizes from the components folder and uses an identical structure. -* _tenants_ - Tenant specific artifacts required by different teams using the cluster. For example, a team will likely need a set of namespaces with quotas, there own gitops-operator installation, etc in order to deploy their work. - -While this structure follows the basic principles in my standards document I am in the process of re-factoring the naming as well as attempting to simplify the level of nesting. - -![alt text](https://raw.githubusercontent.com/gnunn-gitops/cluster-config/main/docs/img/argocd.png) - -Finally note that I deliberately have everything in the same repository for demo purposes. Folks dealing with a lot of clusters and tenants will likely want to split things out into multiple repositories. - -## App-Of-App Helm Chart and Layers - -This repository is based on kustomize, and as a result the _bootstrap_ folder consists of a _base_ and _overlays_. The _base_ is the configuration that is required on all clusters whereas the _overlays_ consist of groupings of -clusters as well as specific clusters. - -A helm chart managed by kustomize is used to generate the list of Argo CD Applications using the [App of App](https://argo-cd.readthedocs.io/en/stable/operator-manual/cluster-bootstrapping/#app-of-apps-pattern) pattern as well as a cluster-config AppProject. I had originally used kustomize to manage the Argo CD Applications directly but this generated a lot of yaml and made overriding applications for specific clusters much more verbose then necessary. This is an example of where templating is a more optimum solution then patching. - -In the bootstrap _base_ and cluster _overlays_ (`bootstrap/overlays/`) there is a `kustomization.yaml` file along with a `values.yaml` file where we use kustomize to generate the Application manifests from a `helm template`. - -This helm chart is run independently at each layer and is aggregated by higher levels. So for example my `local.home` cluster, which is one of my bare-metal servers in my homelab, has an application tree that aggregatesm Applications as follows: - -`base` > `local` > `local.home` - -At each layer the helm chart is run for that layer and generates the Application manifests for that specific layer. The nice thing with this approach is group or cluster specific changes is easy, kustomize can be used to override a lower level layer's Application(s) and point it to a cluster specific version simply by patching it's path and/or repo. - -The `clusters/overlays//components` consists of components that are specific to this cluster or is cluster-specific overriden version of manifests from the _components_ folder. So at the bootstrap level, if the _base_ has an application pointing to manfiests in _components_, this can be overriden in the cluster specific bootstrap by patching it to point to a version in `clusters/overlays//components//`. - -I've opted to use a dot notation to separate groups, i.e `local`, from specific clusters, `local.home` however in the future it may be worth considering seperating this into distinct `groups` and `clusters` folders. - -## Why not ApplicationSet instead of App-of-App Helm Chart? - -Some folks may be wondering why I do not use an ApplicationSet instead of this App-of-App Helm chart. The primary reason is that the Helm chart allows for easily post-processing the generated Applications to enable cluster overrides. While having an ApplicationSet with a list generator delivered by kustomize could also accomplish this, the list generator is simply a list which is challenging to patch correctly with JSON semantics (i.e. you can only reference items by ordinal rather then name. As a result trying to manage patching this would be error-prone if ordering ever changes in the list. - -Other generator types don't allow any post-processing meaning overriding for specific clusters needs to be packaged into the ApplicationSet which I felt was overly cumbersome. - -Having said, the new ApplicationSet feature supporting creating custom generator plugins may make it more amenable for this use case but I have not explored this as of yet. - -## Argo CD Plugin - -From a GitOps purist point of view there is a desire to have everything in git regardless of how many manifests need to be maintained. Thus with -kustomize this can make for a significant number of overlays to account for cluster differences in endpoints (each cluster has its own DNS domain) and other -internal cluster details like cluster name, cluster id, infrastructure id, etc. - -I'm more a pragmatist then a purist, as a result I use a Argo CD Configuration Management Plugin (CMP) to template some per cluster static items as environment -variables to minimize the amount of individual cluster overlays. - -I am using ACM's ability to template in policies to automatically populate the required environment variables, you can see that [here](https://github.com/gnunn-gitops/acm-hub-bootstrap/blob/main/components/policies/gitops/base/manifests/gitops-instance/base/argocd.yaml#L54). - -Note this works because I am using the distributed topology so the Argo CD sitting on each cluster can have unique environment variables. In a centralized topology you could look at adding labels/annotations to cluster secrets and then use the ApplicationSet cluster generator to pass these into Applications as possibly one way to accomplish the same. - -# Usage - -As detailed in the layers section, cluster specific configuration is stored in the bootstrap/overlays folder. To deploy a specific cluster configuration, simply create an application in Argo CD that points to the appropriate cluster folder, i.e. `bootstrap/overlays/{clustername}`. - -Note that in order for kustomize to be able to generate manifests from a helm chart you do need to have Argo CD pass the `--enable-helm` flag to kustomize. You can do this via setting the `kustomizeBuildOptions` in the ArgoCD CR: - -``` -apiVersion: argoproj.io/v1alpha1 -kind: ArgoCD -metadata: - name: openshift-gitops - namespace: openshift-gitops -spec: - kustomizeBuildOptions: "--enable-helm" - ... -``` - -How this bootstrap application gets generated and managed can happen in a variety of different ways: - -* [Red Hat Advanced Cluster Manager](https://www.redhat.com/en/technologies/management/advanced-cluster-management) can use a policy to deploy OpenShift GitOps plus a cluster specific bootstrap application across a fleet of clusters. This is my preferred approach and the [acm-bootstrap-hub](https://github.com/gnunn-gitops/acm-hub-bootstrap) is the repo where I have this policy along with other things I use to bootstrap the ACM Hub cluster. -* Ansible. If you use Ansible for cluster provisioning you can have it deploy the OpenShift GitOps operator plus the bootstrap application -* Other. If you use other automation tools to provision clusters they could do the same as Ansible. - -# Secret Management - -I am currently using the [External Secrets Operator](https://external-secrets.io/latest/) to manage secrets, I am using ACM to automatically bootstrap the token secret needed by ESO to interact with my secrets provider [Doppler](doppler.com) from the Hub cluster. I wrote a blog on this setup [here](https://cloud.redhat.com/blog/external-secrets-operator-and-doppler-with-openshift-gitops). - -I have used Sealed Secrets in the past but as I have expanded my homelab into multiple clusters, plus the occasional ephemeral cloud cluster, I found external secrets easier to manage. - -# Managing Promotion - -A common requirement is for a cluster configuration to be promoted across one or more clusters, i.e a change starts in the lab cluster, gets promoted to non-production and then finally production. - -I am currently trying this and so far commit pinning works well in this scenario, i.e. the lab cluster is pinned to HEAD and always gets the latest and greatest. The other clusters are pinned to specific commits, when you want to promote you simply move the pin forward to the desired commit. - -In cases where a configuration spans multiple repositories you may need to have different commit pins based on the repo. This could be accomplished by labelling the Application objects with the repo and then using a kustomize patch targetted by label. Some improvements to the helm chart would be needed so that labels can be merged between default and specific applications to make this easier to manage. - -Commit pinning for specific applications is also straightforward, either by overriding the default `targetRevision` in the App-of-App Helm chart for a specific application or patching it via kustomize. - -See the repo [cluster-config-pins](https://github.com/gnunn-gitops/cluster-config-pins) for more information on how commit pinning is being used here. - -# Sequence - -This repo uses Argo CD sync waves to configure the configuration in an ordered manner. The following waves are used: - -1. External Secrets Operator -2. Storage (if needed) -3. cert-manager -11. Cluster Configuration (Authentication, AlertManager, etc) -21. Operators (Pipelines, CSO, Compliance, Namespace Operator, etc) -31. Common Apps (Developer Tools) -41. OpenShift Console plugins -51. Tenants - -# Topology - -A note on Argo CD topology preferences. I am a fan of distributed Argo CD for cluster configuration, my preference is to use the default `openshift-gitops` instance for cluster configuration and have an ACM Policy deploy OpenShift GitOps on each cluster. My preference for distributed Argo CD versus centralized Argo CD is to remove the Single-Point-Of-Failure (SPOF) as well mitigate any scalability issues when dealing with hundreds of clusters. - -I am also a big fan of separating the cluster configuration use case from application deployment (i.e the stuff Application teams push out) into separate Argo CD instances for the following reasons: - -* Argo CD uses a single serviceaccount for the application-controller which must have enough k8s permissions to pusn out the manifests. By it's nature the cluster configuration use case requires near cluster-admin level permissions at the SA level and while you can remove access to this for App teams using Argo RBAC I prefer a more isolated approach. -* As mentioned I prefer a distributed Argo CD topology for cluster configuration, however a more centralized model with respect to Argo CD instance(s)for application teams provides them with a single pane of glass. This can be very useful to them when a team's applications are distributed across multiple clusters. For cluster-configuration we can achieve the single pane of glass with ACM which is ideal for Ops teams. - -# Tenant Configuration - -Tenants are managed via a helm chart and an ApplicationSet with the git generator, it basically follows the high level approach laid out in this [blog](https://cloud.redhat.com/blog/project-onboarding-using-gitops-and-helm) from Thomas Jungbauer. - -I am using my own Helm chart and this chart is wrapped in kustomize and leverages the helm inflator feature in kustomize. The benefit of this approach is that using kustomize makes it easy to add additional, tenant specific resources and avoids -the helm chart having to be an all singing all dancing sort of thing. - -As an example, you can set the quota size (small, medium, large) you want in the chart but if you want a custom quota you just create your own quota object versus the helm chart having to support a custom quota. - -Finally note that tenant configuration is exempted from commit pinning, it doesn't make much sense to have promotions for individual tenants and structural promotion is handled already by versioning the helm chart. - -# Other Notes - -I am using annotation tracking with Argo CD and as result am not using IgnoreExtraneous (though I may still have some historical examples in the repo). Annotation tracking provides more capabilities then the default label tracking and should always be used to mitigate false positives from operator created resources. diff --git a/cluster-config/bootstrap.sh b/cluster-config/bootstrap.sh deleted file mode 100755 index 412c9fd..0000000 --- a/cluster-config/bootstrap.sh +++ /dev/null @@ -1,10 +0,0 @@ -if [ $# -lt 1 ]; then - echo "No overlay specified, please specify an overlay from bootstrap/overlays" - exit 1 -else - OVERLAY=$1 - echo "Configuring cluster ${OVERLAY}" -fi - -oc project openshift-gitops -kustomize build bootstrap/overlays/${OVERLAY} --enable-helm | oc apply -f - diff --git a/cluster-config/bootstrap/base/kustomization.yaml b/cluster-config/bootstrap/base/kustomization.yaml deleted file mode 100644 index cb839aa..0000000 --- a/cluster-config/bootstrap/base/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -helmCharts: -- name: argocd-app-of-app - version: 0.4.1 - repo: https://gnunn-gitops.github.io/helm-charts - valuesFile: values.yaml - namespace: openshift-gitops diff --git a/cluster-config/bootstrap/base/values.yaml b/cluster-config/bootstrap/base/values.yaml deleted file mode 100644 index 120eafe..0000000 --- a/cluster-config/bootstrap/base/values.yaml +++ /dev/null @@ -1,108 +0,0 @@ -default: - app: - enabled: true - enableAutoSync: true - autoSyncPrune: false - project: cluster-config - labels: - app-source: base - repo: cluster-config - destination: - namespace: openshift-gitops - server: https://kubernetes.default.svc - source: - repoURL: https://github.com/gnunn-gitops/cluster-config.git - targetRevision: HEAD - -projects: - - cluster-config: - annotations: - notifications.argoproj.io/subscribe.on-sync-failed.slack: cluster-gitops - notifications.argoproj.io/subscribe.on-health-degraded.slack: cluster-gitops - description: Project for overall cluster configuration - namespace: openshift-gitops - sourceRepos: - - https://github.com/gnunn-gitops/cluster-config - - https://github.com/redhat-cop/gitops-catalog - - https://github.com/gnunn-gitops/acm-hub-bootstrap - destinations: | - - namespace: '*' - server: https://kubernetes.default.svc - extraFields: | - clusterResourceWhitelist: - - group: '*' - kind: '*' - -applications: - - banner: - annotations: - argocd.argoproj.io/sync-wave: '11' - source: - path: components/banner/base - extraSourceFields: | - plugin: - name: setenv-cmp-plugin - - compliance-operator: - annotations: - argocd.argoproj.io/compare-options: IgnoreExtraneous - argocd.argoproj.io/sync-wave: '21' - destination: - namespace: openshift-compliance - source: - path: components/compliance-operator/overlays/cis-compliance - - container-security: - annotations: - argocd.argoproj.io/compare-options: IgnoreExtraneous - argocd.argoproj.io/sync-wave: '21' - destination: - namespace: openshift-operators - source: - path: components/container-security-operator/overlays/stable-3.13 - - external-secrets: - annotations: - argocd.argoproj.io/sync-wave: '1' - destination: - namespace: openshift-operators - source: - path: components/eso/overlays/aggregate - - helm-repos: - annotations: - argocd.argoproj.io/compare-options: IgnoreExtraneous - argocd.argoproj.io/sync-wave: '11' - source: - path: components/helm-repos/base - - pipeline-operator: - annotations: - argocd.argoproj.io/sync-wave: "21" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - destination: - namespace: openshift-operators - source: - path: components/pipelines-operator/overlays/chains - syncPolicyRetry: - limit: 5 - backoff: - duration: 5s - factor: 2 - maxDuration: 3m - - dev-console-plugin: - destination: - namespace: dev-console-plugin - argocd.argoproj.io/sync-wave: '41' - source: - path: components/dev-console-plugin/base - - gitops-admin-plugin: - destination: - namespace: gitops-admin-plugin - argocd.argoproj.io/sync-wave: '41' - source: - path: components/gitops-admin-plugin/base diff --git a/cluster-config/bootstrap/components/acm-hub/kustomization.yaml b/cluster-config/bootstrap/components/acm-hub/kustomization.yaml deleted file mode 100644 index 5ea1ba8..0000000 --- a/cluster-config/bootstrap/components/acm-hub/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1alpha1 -kind: Component - -helmCharts: -- name: argocd-app-of-app - version: 0.4.1 - repo: https://gnunn-gitops.github.io/helm-charts - valuesFile: values.yaml - namespace: openshift-gitops diff --git a/cluster-config/bootstrap/components/acm-hub/values.yaml b/cluster-config/bootstrap/components/acm-hub/values.yaml deleted file mode 100644 index f42c48e..0000000 --- a/cluster-config/bootstrap/components/acm-hub/values.yaml +++ /dev/null @@ -1,54 +0,0 @@ -default: - app: - enabled: true - enableAutoSync: true - autoSyncPrune: false - project: cluster-config - labels: - app-source: local.hub - repo: cluster-config - destination: - namespace: openshift-gitops - server: https://kubernetes.default.svc - source: - repoURL: https://github.com/gnunn-gitops/cluster-config.git - targetRevision: HEAD - -applications: - - acm-hub: - annotations: - argocd.argoproj.io/sync-wave: '21' - labels: - repo: acm-hub-bootstrap - destinations: - namespace: open-cluster-management - source: - repoURL: https://github.com/gnunn-gitops/acm-hub-bootstrap.git - path: components/apps/acm/overlays/hub - - acm-observability: - annotations: - argocd.argoproj.io/sync-wave: '31' - labels: - repo: acm-hub-bootstrap - destinations: - namespace: open-cluster-management-observability - source: - repoURL: https://github.com/gnunn-gitops/acm-hub-bootstrap.git - path: components/apps/acm/overlays/observability - - acm-policies: - enableAutoSync: false - annotations: - argocd.argoproj.io/sync-wave: '31' - labels: - repo: acm-hub-bootstrap - destinations: - namespace: acm-policies - source: - repoURL: https://github.com/gnunn-gitops/acm-hub-bootstrap.git - path: bootstrap/policies/overlays/default - extraSourceFields: | - plugin: - name: setenv-cmp-plugin diff --git a/cluster-config/bootstrap/components/kyverno/kustomization.yaml b/cluster-config/bootstrap/components/kyverno/kustomization.yaml deleted file mode 100644 index 5ea1ba8..0000000 --- a/cluster-config/bootstrap/components/kyverno/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1alpha1 -kind: Component - -helmCharts: -- name: argocd-app-of-app - version: 0.4.1 - repo: https://gnunn-gitops.github.io/helm-charts - valuesFile: values.yaml - namespace: openshift-gitops diff --git a/cluster-config/bootstrap/components/kyverno/values.yaml b/cluster-config/bootstrap/components/kyverno/values.yaml deleted file mode 100644 index 21d0fa2..0000000 --- a/cluster-config/bootstrap/components/kyverno/values.yaml +++ /dev/null @@ -1,43 +0,0 @@ -default: - app: - enabled: true - enableAutoSync: true - autoSyncPrune: false - project: cluster-config - labels: - app-source: local.hub - repo: cluster-config - destination: - namespace: openshift-gitops - server: https://kubernetes.default.svc - source: - repoURL: https://github.com/gnunn-gitops/cluster-config.git - targetRevision: HEAD - -applications: - - kyverno: - enabled: false - annotations: - argocd.argoproj.io/compare-options: IgnoreExtraneous - argocd.argoproj.io/sync-wave: '21' - destination: - namespace: kyverno - source: - path: components/kyverno/overlays/policies - syncPolicyRetry: - limit: 5 - backoff: - duration: 5s - factor: 2 - maxDuration: 3m - extraFields: | - ignoreDifferences: - - group: kyverno.io - kind: ClusterPolicy - jsonPointers: - - /spec/rules - - group: kyverno.io - kind: Policy - jsonPointers: - - /spec/rules diff --git a/cluster-config/bootstrap/components/sno/kustomization.yaml b/cluster-config/bootstrap/components/sno/kustomization.yaml deleted file mode 100644 index 5ea1ba8..0000000 --- a/cluster-config/bootstrap/components/sno/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1alpha1 -kind: Component - -helmCharts: -- name: argocd-app-of-app - version: 0.4.1 - repo: https://gnunn-gitops.github.io/helm-charts - valuesFile: values.yaml - namespace: openshift-gitops diff --git a/cluster-config/bootstrap/components/sno/values.yaml b/cluster-config/bootstrap/components/sno/values.yaml deleted file mode 100644 index 4ac70ee..0000000 --- a/cluster-config/bootstrap/components/sno/values.yaml +++ /dev/null @@ -1,41 +0,0 @@ -default: - app: - enabled: true - enableAutoSync: true - autoSyncPrune: false - project: cluster-config - labels: - app-source: local.hub - repo: cluster-config - destination: - namespace: openshift-gitops - server: https://kubernetes.default.svc - source: - repoURL: https://github.com/gnunn-gitops/cluster-config.git - targetRevision: HEAD - -applications: - - registry: - annotations: - argocd.argoproj.io/sync-wave: '5' - destination: - namespace: openshift-image-registry - source: - path: components/registry-sno/base - - defrag-etcd: - annotations: - argocd.argoproj.io/sync-wave: '99' - destination: - namespace: openshift-etcd - source: - path: components/defrag-etcd/base - - cleanup-completed-pods: - annotations: - argocd.argoproj.io/sync-wave: '99' - destination: - namespace: clean-completed-pods - source: - path: components/clean-completed-pods/base diff --git a/cluster-config/bootstrap/overlays/local.aws/kustomization.yaml b/cluster-config/bootstrap/overlays/local.aws/kustomization.yaml deleted file mode 100644 index 99d0c82..0000000 --- a/cluster-config/bootstrap/overlays/local.aws/kustomization.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -helmCharts: -- name: argocd-app-of-app - version: 0.2.4 - repo: https://gnunn-gitops.github.io/helm-charts - valuesFile: values.yaml - namespace: openshift-gitops - releaseName: argocd-app-of-app-0.2.4 - -resources: -- ../local - -patches: - - target: - kind: Application - name: compliance-operator - patch: |- - - op: replace - path: /spec/source/path - value: 'components/apps/compliance-operator/overlays/cis-compliance' - - op: replace - path: /spec/source/repoURL - value: 'https://github.com/gnunn-gitops/cluster-config' diff --git a/cluster-config/bootstrap/overlays/local.aws/values.yaml b/cluster-config/bootstrap/overlays/local.aws/values.yaml deleted file mode 100644 index 11bd112..0000000 --- a/cluster-config/bootstrap/overlays/local.aws/values.yaml +++ /dev/null @@ -1,14 +0,0 @@ -default: - app: - enabled: true - enableAutoSync: true - autoSyncPrune: false - project: cluster-config - destination: - namespace: openshift-gitops - server: https://kubernetes.default.svc - source: - repoURL: https://github.com/gnunn-gitops/cluster-config.git - targetRevision: HEAD - -applications: diff --git a/cluster-config/bootstrap/overlays/local.home/kustomization.yaml b/cluster-config/bootstrap/overlays/local.home/kustomization.yaml deleted file mode 100644 index 15bb466..0000000 --- a/cluster-config/bootstrap/overlays/local.home/kustomization.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -helmCharts: -- name: argocd-app-of-app - version: 0.4.1 - repo: https://gnunn-gitops.github.io/helm-charts - valuesFile: values.yaml - namespace: openshift-gitops - -components: -- ../../components/sno - -resources: -- ../local - -patches: - - target: - kind: Application - name: compliance-operator - patch: |- - - op: replace - path: /spec/source/path - value: 'components/compliance-operator/overlays/cis-compliance-master-only' diff --git a/cluster-config/bootstrap/overlays/local.home/values.yaml b/cluster-config/bootstrap/overlays/local.home/values.yaml deleted file mode 100644 index 60aede4..0000000 --- a/cluster-config/bootstrap/overlays/local.home/values.yaml +++ /dev/null @@ -1,122 +0,0 @@ -default: - app: - enabled: true - enableAutoSync: true - autoSyncPrune: false - project: cluster-config - labels: - app-source: local.home - repo: cluster-config - destination: - namespace: openshift-gitops - server: https://kubernetes.default.svc - source: - repoURL: https://github.com/gnunn-gitops/cluster-config.git - targetRevision: HEAD - -projects: - - demo: - description: Project for ad-hoc demos and testing - sourceRepos: - - "*" - destinations: | - - namespace: '*' - server: https://kubernetes.default.svc - extraFields: | - clusterResourceWhitelist: - - group: '*' - kind: '*' - -applications: - - lvm-operator: - annotations: - argocd.argoproj.io/sync-wave: '2' - destination: - namespace: openshift-storage - source: - path: clusters/overlays/local.home/components/lvm-operator - - acs-secured-cluster: - annotations: - argocd.argoproj.io/sync-wave: '21' - destination: - namespace: rhacs-operator - source: - path: components/acs-operator/overlays/secured-cluster - extraSourceFields: | - plugin: - name: setenv-cmp-plugin - - console-links: - annotations: - argocd.argoproj.io/sync-wave: '11' - source: - path: clusters/overlays/local.home/components/consolelinks - - cost-management: - annotations: - argocd.argoproj.io/sync-wave: '21' - destination: - namespace: costmanagement-metrics-operator - source: - path: clusters/overlays/local.home/components/cost-management-operator - - lokistack: - enabled: false - annotations: - argocd.argoproj.io/sync-wave: '21' - source: - path: clusters/overlays/local.home/components/lokistack - syncPolicyRetry: - limit: 5 - backoff: - duration: 5s - factor: 2 - maxDuration: 3m - - node-config: - annotations: - argocd.argoproj.io/sync-wave: '99' - source: - path: clusters/overlays/local.home/components/node-config - - rollout-manager: - annotations: - argocd.argoproj.io/sync-wave: '31' - source: - path: components/rollout-manager/base - -# Tenants - gitops: - project: cluster-config - annotations: - argocd.argoproj.io/sync-wave: '50' - destination: - namespace: gitops - source: - path: components/gitops-operator/overlays/shared - extraSourceFields: | - plugin: - name: setenv-cmp-plugin - - tenant-secrets: - project: cluster-config - labels: - repo: use-head - annotations: - argocd.argoproj.io/sync-wave: '50' - destination: - namespace: tenant-secrets - source: - path: components/tenant-secrets/base - - tenants: - project: cluster-config - labels: - repo: use-head - annotations: - argocd.argoproj.io/sync-wave: '51' - source: - path: clusters/overlays/local.home/components/tenants diff --git a/cluster-config/bootstrap/overlays/local.hub/kustomization.yaml b/cluster-config/bootstrap/overlays/local.hub/kustomization.yaml deleted file mode 100644 index ecd0354..0000000 --- a/cluster-config/bootstrap/overlays/local.hub/kustomization.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -helmCharts: -- name: argocd-app-of-app - version: 0.4.1 - repo: https://gnunn-gitops.github.io/helm-charts - valuesFile: values.yaml - namespace: openshift-gitops - -components: -- ../../components/acm-hub -- ../../components/sno - -resources: -- ../local - -patches: - - target: - kind: Application - name: compliance-operator - patch: |- - - op: replace - path: /spec/source/path - value: 'components/compliance-operator/overlays/cis-compliance-master-only' - - target: - kind: Application - name: external-secrets - patch: |- - - op: replace - path: /spec/source/path - value: 'clusters/overlays/local.hub/components/eso' diff --git a/cluster-config/bootstrap/overlays/local.hub/values.yaml b/cluster-config/bootstrap/overlays/local.hub/values.yaml deleted file mode 100644 index e74ca0c..0000000 --- a/cluster-config/bootstrap/overlays/local.hub/values.yaml +++ /dev/null @@ -1,160 +0,0 @@ -default: - app: - enabled: true - enableAutoSync: true - autoSyncPrune: false - project: cluster-config - labels: - app-source: local.hub - repo: cluster-config - destination: - namespace: openshift-gitops - server: https://kubernetes.default.svc - source: - repoURL: https://github.com/gnunn-gitops/cluster-config.git - targetRevision: HEAD - -applications: - - node-config: - annotations: - argocd.argoproj.io/sync-wave: '0' - source: - path: clusters/overlays/local.hub/components/node-config - - odf-operator: - annotations: - argocd.argoproj.io/sync-wave: '1' - source: - path: components/odf-operator/operator/overlays/no-registry - - lvm-operator: - annotations: - argocd.argoproj.io/sync-wave: '2' - destination: - namespace: openshift-storage - source: - path: clusters/overlays/local.hub/components/lvm-operator - - odf-instance: - annotations: - argocd.argoproj.io/sync-wave: '2' - destination: - namespace: openshift-storage - source: - path: components/odf-operator/instance/base - - acs: - annotations: - argocd.argoproj.io/sync-wave: '21' - destination: - namespace: stackrox - source: - path: clusters/overlays/local.hub/components/acs-operator - - acs-config: - annotations: - argocd.argoproj.io/sync-wave: '31' - destination: - namespace: stackrox - source: - path: components/acs-config/base - extraSourceFields: | - plugin: - name: setenv-cmp-plugin - - amq-streams: - enabled: false - annotations: - argocd.argoproj.io/sync-wave: '21' - destination: - namespace: openshift-gitops - source: - path: components/amq-streams/overlays/amq-streams-2.7.x/ - - trusted-profile-analyzer-prereqs: - enabled: false - annotations: - argocd.argoproj.io/sync-wave: '31' - destination: - namespace: openshift-gitops - source: - path: components/trusted-profile-analyzer/prereqs/base - - # acm-clusters: - # annotations: - # argocd.argoproj.io/sync-wave: '31' - # labels: - # repo: acm-hub-bootstrap - # destinations: - # namespace: openshift-gitops - # source: - # repoURL: https://github.com/gnunn-gitops/acm-hub-bootstrap.git - # path: components/clusters/base - - # Disable while we work this out - nmstate: - enabled: true - source: - path: clusters/overlays/local.hub/components/nmstate - - console-links: - annotations: - argocd.argoproj.io/sync-wave: '11' - source: - path: clusters/overlays/local.hub/components/consolelinks - - dev-tools: - annotations: - argocd.argoproj.io/sync-wave: '31' - destination: - namespace: dev-tools - source: - path: components/dev-tools/overlays/default - - quay-registry: - # leave disabled unless needed for demo - enabled: false - annotations: - argocd.argoproj.io/sync-wave: '21' - source: - path: clusters/overlays/local.hub/components/quay-registry-operator - - cost-management: - annotations: - argocd.argoproj.io/sync-wave: '21' - destination: - namespace: costmanagement-metrics-operator - source: - path: clusters/overlays/local.hub/components/cost-management-operator - - lokistack: - enabled: false - annotations: - argocd.argoproj.io/sync-wave: '21' - source: - path: clusters/overlays/local.hub/components/lokistack - syncPolicyRetry: - limit: 5 - backoff: - duration: 5s - factor: 2 - maxDuration: 3m - - kyverno-acm: - enabled: false - annotations: - argocd.argoproj.io/compare-options: IgnoreExtraneous - argocd.argoproj.io/sync-wave: '21' - destination: - namespace: acm-policies - source: - path: components/kyverno-acm/base - - rhtas-operator: - annotations: - argocd.argoproj.io/sync-wave: '21' - destination: - namespace: trusted-artifact-signer - source: - path: clusters/overlays/local.hub/components/rhtas-operator diff --git a/cluster-config/bootstrap/overlays/local/README.md b/cluster-config/bootstrap/overlays/local/README.md deleted file mode 100644 index 8e819e5..0000000 --- a/cluster-config/bootstrap/overlays/local/README.md +++ /dev/null @@ -1,3 +0,0 @@ -Applications to support my local home lab environment. This isn't limited to my -on-prem environment but can also include cloud clusters. This overlay -includes items for consistency in my homelab setup such as RBAC, authentication (Keycloak), etc. diff --git a/cluster-config/bootstrap/overlays/local/kustomization.yaml b/cluster-config/bootstrap/overlays/local/kustomization.yaml deleted file mode 100644 index 1ec866c..0000000 --- a/cluster-config/bootstrap/overlays/local/kustomization.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -helmCharts: -- name: argocd-app-of-app - version: 0.4.1 - repo: https://gnunn-gitops.github.io/helm-charts - valuesFile: values.yaml - namespace: openshift-gitops - -resources: -- ../../base diff --git a/cluster-config/bootstrap/overlays/local/values.yaml b/cluster-config/bootstrap/overlays/local/values.yaml deleted file mode 100644 index 65da0ed..0000000 --- a/cluster-config/bootstrap/overlays/local/values.yaml +++ /dev/null @@ -1,83 +0,0 @@ -default: - app: - enabled: true - enableAutoSync: true - autoSyncPrune: false - project: cluster-config - labels: - app-source: local.hub - repo: cluster-config - destination: - namespace: openshift-gitops - server: https://kubernetes.default.svc - source: - repoURL: https://github.com/gnunn-gitops/cluster-config.git - targetRevision: HEAD - -applications: - - authentication: - annotations: - argocd.argoproj.io/sync-wave: '4' - destination: - namespace: openshift-config - source: - path: components/oauth/overlays/homelab - extraSourceFields: | - plugin: - name: setenv-cmp-plugin - - cert-manager-operator: - annotations: - argocd.argoproj.io/sync-wave: "2" - destination: - namespace: cert-manager-operator - source: - path: components/cert-manager-operator/aggregate/overlays/letsencrypt - - certificates: - annotations: - argocd.argoproj.io/sync-wave: "3" - destination: - namespace: cert-manager-operator - source: - path: components/certificates/base - extraSourceFields: | - plugin: - name: setenv-cmp-plugin - - alertmanager: - annotations: - argocd.argoproj.io/sync-wave: '11' - destination: - namespace: openshift-monitoring - source: - path: components/alertmanager/base - - openshift-monitoring: - annotations: - argocd.argoproj.io/sync-wave: '11' - destination: - namespace: openshift-monitoring - source: - path: components/openshift-monitoring/base - extraSourceFields: | - plugin: - name: setenv-cmp-plugin - # syncOptions: - # - RespectIgnoreDifferences=true - # extraFields: | - # ignoreDifferences: - # - group: "" - # kind: ConfigMap - # jsonPointers: - # - /data/config.yaml/prometheusK8s/externalLabels/managed-cluster - # name: cluster-monitoring-config - # namespace: openshift-monitoring - - rbac: - annotations: - argocd.argoproj.io/compare-options: IgnoreExtraneous - argocd.argoproj.io/sync-wave: '11' - source: - path: components/rbac/base diff --git a/cluster-config/bootstrap/overlays/rhdp/kustomization.yaml b/cluster-config/bootstrap/overlays/rhdp/kustomization.yaml deleted file mode 100644 index 50867e7..0000000 --- a/cluster-config/bootstrap/overlays/rhdp/kustomization.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -helmCharts: -- name: argocd-app-of-app - version: 0.4.1 - repo: https://gnunn-gitops.github.io/helm-charts - valuesFile: values.yaml - namespace: openshift-gitops - -resources: -- ../../base - -patches: - - target: - kind: Application - name: compliance-operator - patch: |- - - op: replace - path: /spec/source/path - value: 'components/compliance-operator/overlays/cis-compliance-master-only' diff --git a/cluster-config/bootstrap/overlays/rhdp/values.yaml b/cluster-config/bootstrap/overlays/rhdp/values.yaml deleted file mode 100644 index 135c249..0000000 --- a/cluster-config/bootstrap/overlays/rhdp/values.yaml +++ /dev/null @@ -1,92 +0,0 @@ -default: - app: - enabled: true - enableAutoSync: true - autoSyncPrune: false - project: cluster-config - destination: - namespace: openshift-gitops - server: https://kubernetes.default.svc - source: - repoURL: https://github.com/gnunn-gitops/cluster-config.git - targetRevision: HEAD - labels: - app-source: rhdp - -applications: - - # acs: - # annotations: - # argocd.argoproj.io/compare-options: IgnoreExtraneous - # argocd.argoproj.io/sync-wave: '21' - # source: - # path: components/acs-operator/overlays/oauth - - # acs-tokens: - # annotations: - # argocd.argoproj.io/compare-options: IgnoreExtraneous - # argocd.argoproj.io/sync-wave: '61' - # source: - # path: tenants/acs-tokens/base - - authentication: - annotations: - argocd.argoproj.io/sync-wave: '4' - destination: - namespace: openshift-config - source: - path: components/oauth/overlays/homelab - extraSourceFields: | - plugin: - name: setenv-cmp-plugin - - rbac: - annotations: - argocd.argoproj.io/compare-options: IgnoreExtraneous - argocd.argoproj.io/sync-wave: '11' - source: - path: components/rbac/base - - openshift-monitoring: - annotations: - argocd.argoproj.io/sync-wave: '11' - destination: - namespace: openshift-monitoring - source: - path: components/openshift-monitoring/base - extraSourceFields: | - plugin: - name: setenv-cmp-plugin - - # product-catalog-root: - # project: cluster-config - # annotations: - # argocd.argoproj.io/compare-options: IgnoreExtraneous - # argocd.argoproj.io/sync-wave: '51' - # source: - # path: tenants/product-catalog/argocd/root/base - - # kyverno: - # annotations: - # argocd.argoproj.io/compare-options: IgnoreExtraneous - # argocd.argoproj.io/sync-wave: '21' - # destination: - # namespace: kyverno - # source: - # path: components/kyverno/overlays/policies - # syncPolicyRetry: - # limit: 5 - # backoff: - # duration: 5s - # factor: 2 - # maxDuration: 3m - # extraFields: | - # ignoreDifferences: - # - group: kyverno.io - # kind: ClusterPolicy - # jsonPointers: - # - /spec/rules - # - group: kyverno.io - # kind: Policy - # jsonPointers: - # - /spec/rules diff --git a/cluster-config/clusters/README.md b/cluster-config/clusters/README.md deleted file mode 100644 index faff253..0000000 --- a/cluster-config/clusters/README.md +++ /dev/null @@ -1 +0,0 @@ -Cluster specific overlays go here, typically each cluster will have a list of ArgoCD apps required for the configuration managed by the "app of app" pattern expressed in a corresponding overlay in the `/bootstrap/overlays` directory. diff --git a/cluster-config/clusters/overlays/local.aws/README.md b/cluster-config/clusters/overlays/local.aws/README.md deleted file mode 100644 index ba1e461..0000000 --- a/cluster-config/clusters/overlays/local.aws/README.md +++ /dev/null @@ -1,3 +0,0 @@ -#### Home (local) Cluster - -This is a cluster deployed in AWS using cluster.ocplab-aws.com for base DNS. diff --git a/cluster-config/clusters/overlays/local.aws/components/cost-management-operator/kustomization.yaml b/cluster-config/clusters/overlays/local.aws/components/cost-management-operator/kustomization.yaml deleted file mode 100644 index af4c493..0000000 --- a/cluster-config/clusters/overlays/local.aws/components/cost-management-operator/kustomization.yaml +++ /dev/null @@ -1,13 +0,0 @@ -kind: Kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 - -resources: - - https://github.com/redhat-cop/gitops-catalog/cost-management-operator/overlays/aggregate - -patchesJson6902: - - path: patch-source-and-name.yaml - target: - group: koku-metrics-cfg.openshift.io - kind: KokuMetricsConfig - name: instance - version: v1beta1 diff --git a/cluster-config/clusters/overlays/local.aws/components/cost-management-operator/patch-source-and-name.yaml b/cluster-config/clusters/overlays/local.aws/components/cost-management-operator/patch-source-and-name.yaml deleted file mode 100644 index 9e27f24..0000000 --- a/cluster-config/clusters/overlays/local.aws/components/cost-management-operator/patch-source-and-name.yaml +++ /dev/null @@ -1,6 +0,0 @@ -- op: replace - path: /spec/source/name - value: aws.cluster -- op: replace - path: /metadata/name - value: aws-cluster diff --git a/cluster-config/clusters/overlays/local.aws/components/openshift-monitoring/cluster-monitoring-config-cm.yaml b/cluster-config/clusters/overlays/local.aws/components/openshift-monitoring/cluster-monitoring-config-cm.yaml deleted file mode 100644 index 917af09..0000000 --- a/cluster-config/clusters/overlays/local.aws/components/openshift-monitoring/cluster-monitoring-config-cm.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: cluster-monitoring-config - namespace: openshift-monitoring -data: - config.yaml: | - enableUserWorkload: true - prometheusK8s: - volumeClaimTemplate: - spec: - accessModes: - - ReadWriteOnce - storageClassName: gp3-csi - volumeMode: Filesystem - resources: - requests: - storage: 40Gi diff --git a/cluster-config/clusters/overlays/local.aws/components/openshift-monitoring/kustomization.yaml b/cluster-config/clusters/overlays/local.aws/components/openshift-monitoring/kustomization.yaml deleted file mode 100644 index 8db0fd3..0000000 --- a/cluster-config/clusters/overlays/local.aws/components/openshift-monitoring/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: -- cluster-monitoring-config-cm.yaml diff --git a/cluster-config/clusters/overlays/local.home/README.md b/cluster-config/clusters/overlays/local.home/README.md deleted file mode 100644 index 0a1a4f4..0000000 --- a/cluster-config/clusters/overlays/local.home/README.md +++ /dev/null @@ -1,3 +0,0 @@ -#### Home (local) Cluster - -This is my home cluster which runs on a server under my desk and uses the highly original cluster name of 'home'. It runs in libvirt on a Ryzen 3900x server with 128 GB of memory. It is typically configured as three combined master/worker nodes with 7 vCPU and 35 GB per node. diff --git a/cluster-config/clusters/overlays/local.home/components/clusterversion/base/clusterversion.yaml b/cluster-config/clusters/overlays/local.home/components/clusterversion/base/clusterversion.yaml deleted file mode 100644 index 802e718..0000000 --- a/cluster-config/clusters/overlays/local.home/components/clusterversion/base/clusterversion.yaml +++ /dev/null @@ -1,11 +0,0 @@ -# apiVersion: config.openshift.io/v1 -# kind: ClusterVersion -# metadata: -# name: version -# spec: -# channel: fast-4.8 -# clusterID: 4d11acb7-286f-42e1-868c-55f1e15687c7 -# desiredUpdate: -# image: quay.io/openshift-release-dev/ocp-release@sha256:bf48faa639523b73131ec7c91637d5c94d33a4afe09ac8bdad672862f5e86ccb -# version: 4.8.14 -# upstream: https://api.openshift.com/api/upgrades_info/v1/graph diff --git a/cluster-config/clusters/overlays/local.home/components/clusterversion/base/kustomization.yaml b/cluster-config/clusters/overlays/local.home/components/clusterversion/base/kustomization.yaml deleted file mode 100644 index 7e5b852..0000000 --- a/cluster-config/clusters/overlays/local.home/components/clusterversion/base/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -kind: Kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 - -resources: - - clusterversion.yaml diff --git a/cluster-config/clusters/overlays/local.home/components/consolelinks/acs-consolelink.yaml b/cluster-config/clusters/overlays/local.home/components/consolelinks/acs-consolelink.yaml deleted file mode 100644 index 5f4344b..0000000 --- a/cluster-config/clusters/overlays/local.home/components/consolelinks/acs-consolelink.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: console.openshift.io/v1 -kind: ConsoleLink -metadata: - name: acs -spec: - href: 'https://central-stackrox.apps.hub.ocplab.com' - location: ApplicationMenu - text: Advanced Cluster Security - applicationMenu: - section: Red Hat Applications - imageURL: https://central-stackrox.apps.hub.ocplab.com/static/media/rh-favicon.0110fdfc5cab55416acf.ico diff --git a/cluster-config/clusters/overlays/local.home/components/consolelinks/kustomization.yaml b/cluster-config/clusters/overlays/local.home/components/consolelinks/kustomization.yaml deleted file mode 100644 index e96de1a..0000000 --- a/cluster-config/clusters/overlays/local.home/components/consolelinks/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - ../../../../../components/consolelinks/base - - acs-consolelink.yaml - - nexus-consolelink.yaml - - sonarqube-consolelink.yaml - - tekton-hub-link.yaml diff --git a/cluster-config/clusters/overlays/local.home/components/consolelinks/nexus-consolelink.yaml b/cluster-config/clusters/overlays/local.home/components/consolelinks/nexus-consolelink.yaml deleted file mode 100644 index 0b4598b..0000000 --- a/cluster-config/clusters/overlays/local.home/components/consolelinks/nexus-consolelink.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: console.openshift.io/v1 -kind: ConsoleLink -metadata: - name: nexus -spec: - href: 'https://nexus-dev-tools.apps.hub.ocplab.com' - location: ApplicationMenu - text: Nexus - applicationMenu: - section: Tools - imageURL: https://nexus-dev-tools.apps.hub.ocplab.com/favicon.png diff --git a/cluster-config/clusters/overlays/local.home/components/consolelinks/sonarqube-consolelink.yaml b/cluster-config/clusters/overlays/local.home/components/consolelinks/sonarqube-consolelink.yaml deleted file mode 100644 index fc9dfd2..0000000 --- a/cluster-config/clusters/overlays/local.home/components/consolelinks/sonarqube-consolelink.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: console.openshift.io/v1 -kind: ConsoleLink -metadata: - name: sonarqube -spec: - href: 'https://sonarqube-dev-tools.apps.hub.ocplab.com' - location: ApplicationMenu - text: SonarQube - applicationMenu: - section: Tools - imageURL: https://sonarqube-dev-tools.apps.hub.ocplab.com/favicon.ico diff --git a/cluster-config/clusters/overlays/local.home/components/consolelinks/tekton-hub-link.yaml b/cluster-config/clusters/overlays/local.home/components/consolelinks/tekton-hub-link.yaml deleted file mode 100644 index 568a278..0000000 --- a/cluster-config/clusters/overlays/local.home/components/consolelinks/tekton-hub-link.yaml +++ /dev/null @@ -1,211 +0,0 @@ -apiVersion: console.openshift.io/v1 -kind: ConsoleLink -metadata: - name: tekton-hub -spec: - href: 'https://tekton-hub-ui-openshift-pipelines.apps.hub.ocplab.com' - location: ApplicationMenu - text: Tekton Hub - applicationMenu: - section: Red Hat Applications - imageURL: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAXwAAAF8CAYAAADM5wDKAAAACXBIWXMAAG66AABuugHW3rEXAAAg - AElEQVR4nO3dbVYcx9nG8WpZlt+SSFkBaAXgFQArAK8AWIHRCoS+5ZvQCkArCHx8PglWYLQCwQoi - 4rc4UtzPuVpd8ggD03VXVU919/93zhznOJ6Znp7hmpq77qqu6rp2AIDxu8d7DADTQOADwEQQ+AAw - EQQ+AEwEgQ8AE0HgA8BEEPgAMBEEPgBMBIEPABNxnzc6j6qqlp1zuq065x7N/FPWxvZ6AYOz9i5v - nXPnM/+8qOv6ghOaHlsrJFBV1Xob6P62MvgXBSzea/8F4Jw7rev6lPckDoEfqKoqjdLXZ26EO9Af - fQmc+ltd1285990R+B1UVaVR+1Z7I+CBcugL4Fi3uq7PeV/uRuDfog35nTbkl4o8SACzLtvwPyL8 - b0bgz2gnWnfaGyEPDJfC/6gNfyaAWwT+h6D3IU/3DDA+Z23wH039vZ1s4LeTr3uM5oHJ8KP+g6lO - 9k4u8NuyjQ/6hwUcEoB+Xc0E/6TKPZMJ/Dbo951z2wUcDoAyvFQuTCX4Rx/4M6WbpwUcDoAyPZtC - qWfUgV9V1V47qqd0A2Ceq3a0fzDWMzXKwG+3OjgqdTL24cOHbnV19cb/b319vffjAXI5Pb15N4Tz - 83N3dXVV6nnX5O7OGLdyGFXgt+UbBf3moo9lZWXFLS8vN8Gu26NHjz7+E8AHb9++bcLf/1O3i4sL - 9/r16xLO0Ekb/KMp84wm8BdZvllaWmpG5j7cGaUD8fTrwH8J6H9fXl4u4qyOqswz+MBvR/XHfS+a - 2tzcbIJ9a2urGckDyEsj/+Pj4yb8T05O+j7bWry1NfTR/qADv6qqrbaEk31Ur7q7wt3fACyWwt/f - epoPuGpLPMdDfesHGfjtqF7lm+9zP5dG8gr4nZ2d3E8FwOjo6KgJ/p5G/i/aMs/gRvuDC/x2AdVx - zm2KNZrf29trQp5yDTAcKvso/A8ODnKP+l+3JZ5BLdgaVODnLuFo8nV/f5/RPDACCn79PWec7B1c - iWcwgd924TzP8dhra2vNiJ7aPDA+KvVoxH92dpbrtT0ZShfPIAK/qqqjHHvgaESvUQBtlMD4qbtH - v94zjfhf1nVdfGngXgHHcCtNzlZVdZo67FWjPzw8bOp9hD0wDfpb19+8/vaVAYltK6vahpJiFTvC - b0/caerJ2adPnzblG1a8AtOllb0q8zx79iz1OdBk7nqpHTxFBn6OThzV6fUG37aHDYDp0SpeDQAT - 1/eL7eAprqTTXjz8PFXY66fb8+fPm/odYQ9gljJB2aCMSFjmUXadt1lWlKJG+O0JOk3VdqkNzDRD - Ty89gHlU31enXsKN267a8s55KSe/mBF+W8ZJFvaq1evnGmEPoAtlhTJD2ZGIsuy0zbYiFDHCTzlB - q59lGtXTfQPASmUejfYTrdYtZiJ34YGfMuxVwtEbRQcOgFjq5NHAMVGJp4jQL6Gkk6QbZ3t7u/k5 - RtgDSEFZokxRtiSw0mbdQi008NsVtNH72KvmphWzAJCasiVRXX+tzbyFWVhJJ9XeOFo1x2ZnAHJT - 8O/u7qZ4loXtvbOQEX6762VU2PvtEQh7AH1Q1iTaluF5m4G9632E37Yonce0X+qEs5AKwCKorq/J - 3MgOHt15te/VuL2O8GeuP0vYAxgkvzo3cqSvOx/3vdla3yWd/ZiOHMIeQAkShf5Km4m96S3w25pV - 1DVo2fwMQCmURcqkSN/3Wc/vpYbf/my5iCnlMEELoEQJundUz1/uY1FWXyP8qLq9emAJewAlUjZF - 9uk/7GtRVvYRfmy/vVa5sagKQOkU/C9fvow5yuz9+VkDP7aUo71x1AIFAEOgun7E3jvZSzu5SzpH - 1rD3HTkAMBSRnTsP28zMJlvgV1Wl/Yk3rffXFsdshAZgSJRZyq4Im212ZpFzhG/+ptIECPvZAxgi - ZVfkJG62UX6WGn7MRC11ewBjEFnPzzKBmzzwYyZqVfvisoQAxkDXyFXoG/fcyTKBm6Oks2edqN3f - 3yfsAYyCskyZZvSwzdKkko7w250w31juu7a2RlcOgNFRTf/s7Mz6sh6n3FEz9Qjf/HWWYE8KAChO - ZLYl3VwtWeC3o3vTxR81o82maADGSNkW0bWz3WZrEslKOlVVHVh2w9RErSY36LkHMFZv375tavrG - CdwXdV0nqecnGeG3nTmm3c30c4ewBzBmyriI0s5OqgulJBnhV1WlOlPwb5alpaVmdA8AU6BR/uXl - peWVPqvrOrqen6qGbxrdswsmgCmJyLwk+8NHB35VVTqQpdD7qQ2T7RMATIkyT9lnsNRmbZQUI3zT - QeztJV9TAADFi8i+6MCPquFbF1pRuwcwZRG1/KiFWLEjfNM3TsRyYwAYvIgMjBrlx47wL0Lr9+q7 - V08qAEyZWjUNffmXdV2bF2KZR/hVVa1aJmup3QOAOQuX2uw1iSnpmH5a6EK/ADB1EVlovmNM4G+F - 3mFzc5PtjwGgnbhVJhoEZ69333Inazlna8t8nEAUXVjntrkj1VLZvA+LoEw8OTkJfeamrFPXdfCl - AU2TtpatFJisRV/0OdO1Ffyt62XmdHlNLYzxN/Z4Qh+Mk7emrRasga9vlpWQ+2xvb7OVArJSuOsz - 9vLlyyRPo8+s6qysCEdO+owZPrOv67oO/lkaXMNvd20LCntHOQcZKegVyhsbG8nCXvRYekw9Nldj - Qy7GbFyx7KAZPMKvqkpH98/QJ0p9sXRAq7U1Ooq4fFwQ7YGiXxA0HiC1qqosj/hdXdfHIXewdOkE - /741zkQDt1LwaqK1r7AXPZeek9IkUjNmZHAW9xL41ECRkkb1u7u71qsHRdFz6rlZT4KUjBkZfCdL - SSe4NvPmzRt+BiOaum/0h9G16yY3dfWotk83D2KpPPn48ePgR6nrOqgWFDTCr6oq+BtFO2MS9ohV - WtiLjkXHRLsxYikjlZWhQjM5tKRDOQcLUVrYez70gVjGz1FQa2Zo4AcP1VnBiFiql5cY9p6OjZo+ - YhmzMmvgBx8RgY8YKRdS5aRjpHsHMfoI/KBJW8uELf33sNJElv4IFtGNY6HtQ7RnD3NWsLL044dM - 3HbePK29nGEQdTEAViqTpAp7TYipRno9jPWlok4b4+XmPqFj1TGzKhdWyszQ8qWyuetlD0N2ywwO - fEY6sFJoplhUpf1wdKGJeT+XNTI/ODiILh/pmP1WD0AoZaZhvkpB2ynwQ2r41O/Rm9jrHmvlotZ/ - +BW58/gVtLpP7MpwrtkMq9x1/JDAD15dQuDDInZ0//z5c3d8fGz6han76L56DCs/ygdCGTOzczZn - HeGzAhEWMd0uh4eHSa6brMfQY1nRsQMLY2Z2zubOXTpVVWnIshZyFP/6178IfQTRqtW///3vppOm - UXnqi+Srrv/kyZPg+6ljRxPCfP4Rwvj5P6vrutOkUcw1befiw45Q1lKI6u6pw961I31LTV8dO5R1 - ECp3ZoYEftDoXiMcIJQ1JDUSz8X62AQ+LAzZ2Tmbs43wmbCFhSUk1XqZswVYj63nCEXgwyJndmYt - 6QChLHvm5CjlpHiOkvf/wTQR+CiGFj+F0graPn5N6jks29daXhOQC4GPYlj2le9zRavludgrHyUh - 8DFofW7fwVYhGLpsgU9LJvrA5wzoji4dDBolE4wNXToAMBE5f7US+Bg0bV/Qlz6fC8iBwEcS9du3 - 7v3pqfvt4MC9Oz52/zO0I1pGNn0ubrI8V9fXpPP3y96eu1pedv+qquam/61/9ztfNEiEwEeU2aD6 - cWPD/fLkifvpu+/cv7/91v24vt58CXRlqV3qSlV99LrrOSxXxerymvTlqPP324sX7veZ59D/1r+7 - evzY/bq/35xrIAaBDxOFj0LIB1V9w6UI35+dNV8C/w3YKthyWcyc++jEPEeX16Kw1xfjTedv1n+e - PWvONcGPGAQ+ginA/7262oTQvKCSkLKEZXGTLkuYs76ux7Zc+rDLa9G56XIORf+dzrnOfciXKOAR - +OjMj0Z/3t39pPQwj4Lq146X/bOunM25n471see9Fn0Jvjdc2UvnXu+B3gvLXAmmi8DHXL58o7q8 - JaBEE7ldWAP/5OQkS2lHj6nHtugS+DH0Xug9aX4lUOZBBwQ+7qRJV1++idG1bKGuFstWxKIrU6W8 - tKAey3K1K9du2dzXKmDNoeg9CpkgxzQR+LiVRo6adA0p36Sws7NjfpTd3d0kI309hh7LKuY1WOg9 - arqkGO3jDgQ+/kR1YY0YNXJMpQq4io9KIWtrQRdY+4RG5VtbW6aJXN1H97WO7EXH3qU09VmGJfR+ - tE9tHzch8PEJdX80k4GJL97x+dZW0H+/33GS9zaquz9+/LgZaXfp09d/o/9W97HW7EOPvXr0yH3x - /fdRz3UTjfZV2/+th3ZVDMt93i+4mQVU/zW0H86j0f1XgQHuR/lnxkliT+2UuuniJXpMbXGs2rrf - dE0jeq2gtSyquknX0b2n86Lae+ovWNEiuHenp+6bo6PmywUg8NF0i/y0tZUldOTrgwN3z7CXvCZN - tVL1quOE710U6JZe+hC6+HTopLGC+K+np835t3ZA3eXdyUlT4vnL8XGWEhKGhZLOxPkunBxhf39t - zf3thx/cA+MEpkbjfayiTUXHarlIig/9v7561Zyz1JoJ3fV1FmuBwJ+ypl6/sdG5ZbKre0tL7i// - /GcTYrGjStXVrW2afdIxxnbm3F9fb86Zzt09w/Vz76L3WIu1ui6AwzgR+BOlev3PEW2HN1Gt/uvn - z93Di4vgSdq7qExi2WOnLzq2lP3/Onc6hzqXId1NXWg9xc89t4yiHAT+BOkPPmXLpTzY3m5C6otM - WxxoYrXE0Ncx5dqiWedS5/RB4l84mphXGY9+/ekh8CdEf+CaHEzZiaPSg2rPuTtB1FlTWuj7sM+5 - olbnVOdW5/izhK9dczbNLp2E/qQQ+BOhP2z9gb+L7DGfpR7yv52fN7XnPihY1S9fQk1fx6Bj6Wv7 - BJ1jnesvnz5N9piE/vQQ+BPgwz5VJ44f1avdchH93aqXHx4eNm2QfdNz6rlT1uxDqG9fnU+pJnUJ - /Wkh8Ecuddh/vrnZ66j+Nn4FbcwWDKH0XH5F7iKp80nvQaraPqE/HQT+iKUOe3WNaAFPKas21fOu - GvqrV6+yBr8eW8+h57L02efga/vfHB4m6eQh9KeBwB8xdeOkCHsFisoIuTpwYmkrAx/8qer7Kt3o - sXzQW/fpz02L2pr1DgkmdAn98WNrhZFS2KeYoFWQKFCGsBeLQlk3rXhVSPvb645feuq68Y+hW18T - srFU4km1PYMP/aG85whD4I9Qqk3QVCNe1MRsDAW1tjjemln8pdr721tGrvrvVwe+z4zfnkFf9LHv - vUJfn6Fv2IphdAj8kdF2CSkWVSnsx/QHP/RA70rv2eftdYdj6EtDXyJfs8XyqFDDHxFthJZiuwRN - BDK6Gy7V9fUextLAgQ3XxoXAHwm/xXEsBYV1d0uUw4d+bAePBhBcPWs8CPwR8FsmxO56SdiPi+/g - iQ19OnfGg8AfAU2wxbZfEvbj5Dt4YkJfA4kUvx6xeAT+wKnGGtuVQdiPm0I/dk5G7Z7spT98BP6A - qbb6S+RiKMJ+GrTHfuxErvbSf59pK2j0g8AfMPVcx9Tt1XpJ2E9Hiu6dZq6Iev5gEfgDFVu3H1uf - PbpR6Gtba6vmUokMEgaLwB8g/ayOWVyl7RJYUDNdeu+166mVtux4d3w89dM4SAT+AMWMsNStwT4p - 0K+7mA3XmnIipZ3BIfAHRp0Sv19emg+asIdr995ptro2tmuqtBPbMID+EfgDoq4cdUpYaT/7zyay - pwzmu7e8HDWPo3ZgunaGhcAfkJgRlWq2pe5nj8VRu2bMJC4TuMNC4A+EFlhZ9zrX9U/pyMFtNIlr - reervMiCrOEg8AdAk2Mxf1QKe+r2uEvzGTHW8387OGACdyAI/AH4z8GBeaJWP9cXfcFxlE9zO18Z - BxWawGWUPwwEfuE0cvrN2DOvUo71jxjTozme+8aLwWtdiLboRtkI/MJpdG/dPoFSDkLFLMhjlF8+ - Ar9gGjFZ2zC1dQKlHIRSaefLp09N501tmozyy0bgF+w/xtGWJt/YOgFWX+7tNeVAC0b5ZSPwC2bd - r0R1e0o5sNJnxzr3wyi/bAR+wSydORqZscAKsbSrpnUCl1F+uQj8kaGUg1RiRvn05ZeJwC9YaB1V - I7LPufYoEtGkv3WUb51/Ql4EfsFCw5uee6RmHuWzlUeRCPyCNZOvHZe7ayRGGyZSs47yNf9E6JeH - wC+YuiWa/evnhL42vvoLVyBCJuZRPp/J4hD4hdNCGIX+bZek0145XNQEOVlH+boUIi2aZbk/9RMw - BAp9P4LXRVB8B4T+PUGPPnyxs2PanltrSWgTLgcj/IFRyDcjrvV1wh69UV++ZfUt3TplIfABdPLA - cHUrTd7qVynKQOAD6OQL4+UMf6NbpxgEPoBOdNHz25oH7mLdEwrpEfgAOntgWMmtsg7dOmUg8AF0 - ptXflmvfMsovA22ZC3Z+fu7e3rLR1KNHj9zq6uqEzgZKp84whb42SAvxX9ozi0Dg90jBfnp6+vH2 - +vXrTk++srLi1tfXP94e0Y6JBXpgCHz18Gv9CK3Ei0Xg90DhfnR05F4G/pF4+mLQ7cWLF82/2d7e - djs7O034A32z7tn0XivG2c11oajhZ6SgVyhvbGyYw/4meiw9ph5bzwH0qSnrWLp1+KwuHIGfwcXF - xcegPzMsR+9Kj+2D/4IuCPToc8MonwVYi0fgJ6bSjSZacwb9dXouPecRC1zQE0tZx7IXD9Ii8BNS - XX13d9ddXV31/tx6Tj33jnE1JBCi2bjP0J75nrLOQhH4Caj7RiPslHV6Kx2DjuW2Vk8gFcson7LO - YhH4kRSsqqF3bbHsg45Fx0ToIydLHf89gb9QBH6k0sLe86EP5PKZYVEgI/zFog8/gurlJYa9p2PT - MTKZi3mu19a7lGtMJR3j34vl+PBnjPCNYhZS9UnHSODjNrrQ+NXysvtxY+OTm/5dl4uQ63rKoUJG - +bHHh08R+Abqed8b0L4gOlb69HHdzzs77ufd3WY3y+v07/T//Tyn68tS1qk7zi2lOD58ipKOgcok - qVovl5aWmlr78vLyJ/9eAa1VtJc3fNhD6Vh1zKzKhafRcZf9cPx/880to+l71z63XWjF7bySjIK8 - 6/Fp8thyNa4pIvADKTRTLKrSfjgaec/bDVO7aR4cHESXj3TMfqsH4Nf9/c7n4K7QV9j+59mzoPM5 - b4TfNew9vRYCvxtKOoH2A/5QbrK5uenevHnzcUXuPH4Fre6zadi/ZFbssWMcVEO/qUxyFwXwTeUT - y+6Xd9XwQ8Pecd3cIAR+gNjR/fPnz93x8fGfyjdd6D66rx7Dyo/yMW1da+jX3RT6lhr+bSxh71lf - 09QQ+AFiul0ODw+TTPTqMfRYVnTsIMZtI/0QN+2pExP26I7A70irVq11dI3KU+5xo8eyjvT1K4EV - uNMWexGS66F/f20t6vFShD0XVumGwO/IWgpR3T1HC6ce01LTV8cOZZ1pUxnm3tJS1DmIHen7EkyK - sNdrSVlaGjMCvyNrSKrDJhfrYxP4+CrBBL4PfUtrpiZZU5VxUryWqSDwO7KEpFovLRO0Xemx9Rx9 - vBaMi9oYHxg+O9cpsC0dMr/+4x9Jwl6vgZbM7gj8jix75vSxGtfyHCXv/4P+qK8+Rehb9sd5/3// - F/28OvbbFoThZgR+B+eGEYxW0Hbps4+l51gy1GMtrwnjkyr0+0bY2xD4HVi6Wvpc0Wp5Ljp14A0t - 9Al7OwI/k5y1++v6fC6M01BCn7CPQ+Bn8oi+YAxM6aFP2Mcj8DOhZIIhKjX0Cfs0CHwAnygt9An7 - dAj8TPq84AgXN0FqpYQ+YZ8Wgd+BpR7f5+Imy3Mxx4B5Fh36hH16BH4Hln56Xamqj153PYflqlh9 - rBHA8C0q9An7PAj8jlYMF2vOuY9OzHNYXgumq+/QJ+zzIfA7sixu0nbKOevremzLls1c5hCh+gp9 - wj4vAr8ja0jm3E/H+tgEPixyhz5hnx+B35E1JE9OTrKUdvSYemwLAh9WuUKfsO8Hgd+RulosWxHL - kydPkl5aUI+lx7TQa6BDBzFShz5h3x8CP0DMZQp3d3eTjPT1GHosq5SXWsR0pQp9wr5fBH4AlULW - Iq7fqVH51taWaSJX99F9rSN70bFTzkEqsaFP2PePwA+0H3k5NdXdHz9+3Iy0u/Tp67/Rf6v7WGv2 - XuyxA9dZQ5+wX4z7U3zRMfwo/+zsLOpx1E6pmy5eosfUFseqrftN1zSi1wpay6KqmzC6Ry4+uLte - spCwXxwC30CTplqpenV1Ff1YCnRLL32Ihw8fJp00Bq7rGvqE/WJR0jHQaLyPVbSp6Fi5SApyU5B/ - c3jo7t1wyU39O/1/hP1iMcI3Ul1dJZfco/NYasOkMwd9ebCz09zeX9vQ7z7lxCIQ+BFUJtGk6mvD - Vfv7oD1zKOVgEQj4MlHSiaRRfombkemY+tyiGUD5CPxI6qwpLfR92LOiFsAsAj8BBatKO9atF1LS - MehYCHsA1xH4Calefnh42LRB9k3PqeemZg/gNgR+Yn4FbcwWDKH0XH5FLgDchsDPQD3vqqG/evUq - a/DrsfUcei767AHMQ+BnpK0MfPCnqu+rdKPH8kHPdgkAuqIPvwcKZd204lUh7W9d+/fVdeMfQzcm - ZAFYEPg9UlBri2PdPNXe/YZp1+m/1549AJACgb9gBDqAvlDDB4CJIPABYCIIfACYCAIfACaCwAeA - iaBLZ0B+v7hobt5nq6uuoicfParfvnX/m7n4/r3l5eaGYSDwB0B/YL/s7bn3N1w4/Yvvv3df7e8T - /MhKQa/P4E3XrL2/tua+PjhoBiAoGyWdwinsf1xfvzHs5bcXL5r/v75l8RYQS58tfcZuu0C5Ppv6 - /2dH/igTgV8w/4dWX13deZD/e/3a/TSzehdISZ+t/83ZBkSfUQYe5SPwC/br/v7csPc0yrp+4Wgg - lj5Tt/26vE6fVX1mUS4Cv2Dvjo+DDo4/NqQW+pkK/cyiXwR+wX6/vAw6OI3E+INDKvosdR3de6Gf - WfSLwB8ZdVIAKfBZGh8Cv2D3lpaCD04jrN8ODiZ0lpCDPkOW0brlM4v+EPgF+9zYedNM9tItASN9 - dqzzQdbPLPpB4BfsS+NPanVL8HMcVvrsdO0Ou876mUU/CPyCacn6l0+fmg5Qi2Ro00QofWZuW2A1 - jz6rbLNQNgK/cBoxVQ8fmg7y550dSjvoTJ8VfWYs9BlldF8+Ar9w2iPnC+Mfkibd6M1HV/qsWNsq - 9RllP6fyEfgDoJGTtftBe+1Q2sE8+ozos2Khzyaj+2Eg8AdAI6evIkbqlHZwl5hSjrBb63AQ+APx - YGen2YbWQj/TY/6gMW76bFhLOfpMPuCzNRgE/oB8HbGg6t3JCQuy8Cf6TOizYRXzmUT/CPwB0QUm - rG2a8suTJ+xZjo+aC+s8eWI+IfosctGTYSHwB0b10pjl6+xZDjdzrQUrfQZj5pWwGAT+AH1zdGQ+ - aH+hCkxX1wvr3CXmM4jFIfAH6P76enMtWytdvYhJ3OnS1gnzrmB1F3327jNoGCQCf6Cai0avrJgP - Xsvn2W9nevRFb906QfSZY6J2uAj8AdPPauu2C65dlPVffppPht7rmLDXZ41SzrAR+AOmDonY0dbP - u7uE/gToPdZ7HaP5VUlXzqAR+AOnRS8PtrejXgShP24pwl6fMRZYDR+BPwKx9XxH6I9WirCnbj8e - BP4IaB+TvxwfR9XzHaE/OinCXp+p5rPFXjmjQOCPhC48oT/MWIT+OKQIe9FniouajAeBPyLqjf7m - 8DD6BSkoaNkcLrVepgh7fZbotx+X+1M/AWOjibX35+fmvc093V8rMlW7HcPP+fPzc/f2li0lHj16 - 5FZH0H2i90tf1DGtl54WVzFJOz4E/ggppPXHH/uHr/trg62/np4OKvQV7Kenpx9vrzuuKl1ZWXHr - 6+sfb48G9Jr9dgkxK2g9deQwSTtOBP5IaYGMQiBm61vXbsNwtbzchH7pPdgK96OjI/fS+EWnLwbd - XrS/jra3t93Ozk4T/iXTl3Ls3jje55ubLK4aMWr4I6Y/3Nh2TdduuPbvb78tdj99Bb1CeWNjwxz2 - N9Fj6TH12KeFXiZS74nemxRhr88KYT9uBP6IqQzTjMwThL5r99P/aWurmO2VLy4uPgb92dlZtufR - Y/vg13OWQO+B3ouY/exn6TMytNIdwhH4I5c69FUi+vfq6sIvjK7SjSZacwb9dXouPefRgkfBOvd6 - D2LLdR5hPx0E/gSkDn1d//THjY2mI2QRo33V1Xd3d91VgjJGKD2nnntnAR0svgtH5956DdrrCPtp - IfAnwoe+JuVSUetmn6N9dd9ohJ2yTm+lY9Cx3NbqmZof1ce2287SZ4GwnxYCf0L8Fgyxm63N8qN9 - LfbJOdpXsKqG3rXFsg86Fh1TztDXOdW5TTmqd23rJVsmTA+BP0HqxIi5YtZN1LOv9s1cnTylhb3n - Qz8HnUud0xQLqWbpvacbZ5oI/InSwpoU2zDMUmugukYUUu8S7OvjqV5eYth7OraUNX2dO51DncsU - 7Zaz9J6zqGq6CPwJ09L5v756Fb3L5nUqPfz03XfNYqDY+n7MQqo+6Rhju3f8Aiqdu5TlG9fueqn3 - mu0Spo3AnzhtjvW38/NkHTyz3p+dNbXnZhWooc6tnve9AW3ipmO19ulrd0stoHqfoc1U763eYzZC - A1sroNn+Vt0aqTbeuq4J/vX14I4QlUlStV4uLS01tfbla1v9KqC1ivYywYhax6pjDl2V+/vFRbbd - Sf2+OEzOwhH48BQImsj7fH39Q3994tqx9uT5dX+/c/1YoZliUZX2w9HIe95umNpN8+DgILp8pGP2 - Wz10pfOS+nyrhKNzTQkHsyjp4BNNXT/hIq1ZfsvlLvb396Oea3Nz07158+bjijFpppAAAAw3SURB - VNx5/Apa3Wczcq1C6LGnnOB2M4upCHtcR+DjT7Qrpmq+qVs3XTsxOU/s6P758+fu+Pj4T+WbLnQf - 3VePYeVH+V2lHN3rPWvmZEawvz/SI/BxK5UE1Nlxb2mp15MU0+1yeHiYZKJXj3EY0bba9347eo/0 - XtFyibsQ+LiTOjseXly4L58+7eVEadWqtY6uUXnKfng9lnWkr18JXVfgxrbF6r3Re0QXDuYh8NHJ - V/v77m8//ODur61FnbB5F8S27juvunuOFk49pqWmr46drq/l860tw5G55r3Qe/JV5HwHpoPAR2eq - C2syUKs1LWUeBVSuwD/IWMqwPnbX16LADhnl69zrPRjCVchQFgIfwdT9oYlBlRK6BpVvE5zHEvhq - vbRM0Halx942bDjX9bXoS7DLudE51DnXuacDBxYEPkzUt6+RaZf6frOsv+No1LJnTh+rcS3PEfJa - mi/RW0pmGtH7On3za4BFVDBi4RWi+OD/Ymen6Sd/d3ra7J+jVkMFlerTXUPqvEPL5nVaQdulzz6W - nkPPFboiV6+p6/H5kplW3v7ebtGg0f+8MhjQFYGPJBRKX+ztNTcry77yubYmvu25QjuILK+JkEcu - lHQwaDlr99f1+VxADgQ+Bu0R9Wygs2yBb6nHAqH6uqYs0Bdra3IX2QKfP0QAKAslHQya9YIjFn0+ - F5ADgY9iWOrxOX/+pngu5hhQEgIfxbD006svvo/5Ij2H5apYfawRALoi8FGUFcOFV3LuoxPzHJbX - AuRElw6KYllIpcVQOevremzLls19LgrDeOTMzpDAD7oEUaqLT2NarCGZcz8d62MT+LAwZGfnbM5a - 0qE1E6GsIXlycpKltKPH1GNbEPgIlTszQwI/+Ego6yCUulosWxHLkydPkl5aUI+lx7TQa6BDB6GM - mdk5m0MCP/hIGOHDIuYyhbu7u0lG+noMPZZVykstYjqMmdk5mxnhozgqhaxFXEpRo/KtrS3TRK7u - o/taR/aiY6ecA4tBj/AJfFjtR16nVXX3x48fNyPtLp9D/Tf6b3Ufa83eiz12TJcxMzvfqarrutt/ - WFXaG/ZNyFGoD5nQh5VGyWdnQc1ht9LFS/R42uJYtXX/01kjeq2gtSyquolG932u/sW4aKGe4apv - j+u67vRztnPguw+h3/0/boU8PjBLYaw/gKG0+D58+LAZ4LBvPqyqqgq+Z13Xne8U2pYZ/NXDaAdW - Cs4+VtGmomMl7GFlzMqgTA4NfOr46JXq6tY2zT7pGOnMQYzc9XtH4GMI1A9f8r40OraU/f+YplEE - PiUdpKDPUYmhr2PiM44UjJ+joEwOmrR1xonbN2/eUNtENHXWqNPG0MWQhQ97VtQilhoU1BIcKmTC - 1hn30gn+azs+PjY8DfApBat+9pZQ09cx6FgIe6RgzMjgLLYEfvDvDn7yIiXVyw8PD5s2yL7pOfXc - 1OyRkjEjg+9kKelsOef+GfpE9OMjNf0MVmdMqsVZ82hRlYKe8iRSs/TfO+e+q+s66KdBLyN8R1kH - GSh4NTJ69epV1N478+ix9Rx6LsIeqUVkY3AWBwd+XddvqeOjJJrI9cGfqr6v0o0eywc9m6EhF2v9 - vs3iIMElHffh54d2h3oach/9AbFdMvqgz5lC2t+6dvWo60bB7m9MyKIP+pwZtg95Vtd18C591sDX - pfh/CL2fJrtYjYhFUEfNbQMO/cFpzx6gb5oTMl534du6roPXRZkC330Ife3OthRyn83NTUo7ANDS - tRcM23Ff1nVtmkyKuaZtcHLrhVkuSgEAY6MsNF57wTxqjgl8UyMy/csAEJWF5juaSzrOWNZh8hYA - zJO15nKOixzhO8s3jV4go3wAU6YMNF7YJyo8Y0f4wZc9dO3l5qjlA5gqLeAzXlaz8+UMbxI1wm+f - OHhdu14o3ToApkjZZwz7s5iwdwlKOs76E2NIl64DgFQisi+6Fh5V0vn4IIbJW9GydZasA5gKrfze - 2NiwvNqoyVovxQjfWb95WHULYEoiMi9Jp0uqwNdvlPD+ostLOnYATIKyzli7v2ozNlqSko77UNbR - AX0fej/15atjh42qAIyV1h6pM8fYivmiruu9FKcm1QjfWb+BdAKYwAUwZso4Y9i7VKN7l3KE7z6M - 8lWfMW1I/sMPP7BjIYDR0U6t3377rfVlvazrOtlkZ+rANy3Ecu1Vhbj2LYCxUSdixGU4oxZaXZey - pOMXYj2z3FcnhNIOgDFRpkWE/bOUYe9Sj/Ddh1G+Zl91kA9D76sJXP384bqhAIZOzSgqUxtr97rT - suUyhndJOsJ3f1zzNvjSW66dwNUFAQBg6JRlERO1+6nD3uUIfPch9FWbMTWc6vqj+/um7wsAKIIy - rOu1lG9w2WZocslLOl5VVdoz4ZX1/my7AGCIIrZP8Dbqus7SwZIt8N2H0NeWmJuW+7IgC8DQRC6w - kpO6rrPVtbOUdGbsWLZccG09nxE+gCFRZkWE/VWbmdlkDfyYCVzX1vPZYA3AECirIur2LtdE7azc - I3w/gWtuRH358iWTuACKpoxSVkU4yzVROytrDd+L6c33Dg8PGe0DKI52wdzd3Y05rCw99zfJPsJ3 - f5R2otJaJ5StlAGUJEHYy04fYe/6GuF/fDLjFsqeOnfU8sQmawAWTbsCRE7SupRbH3fRd+CrtKP+ - 0hXrYxD6ABYtUdhrhne9r9G96zvw3R87ap7H1PMJfQCLkijsdefV1JujzdNLDX9W+wKj6vm+R5+a - PoA+KXMShL1r6/a9hr1bxAj/4xNXlepWz2Mfh+4dAH1INEErT/powbxJ7yN8r33BUY2rru3eoU8f - QE7KmERh/3JRYe8WOcL/eABVpUnctdjH2d7epsQDIDlVECIXVXlaXLXQ/WJKCPzozh1vZWWlmcxl - wzUAsbQRmur1kdsleL135NxkYSUdrz0B6+0JiaI3RjvVcW1cADGUIcqSMYW9KyHw3R+hv2XdWXOW - Zs+1FzV1fQAWyg5lSIJOHNdmWhFh70oo6cyqqmq1Le+Ye/RnqcRzfHzMNXIBzKXrb+iyhIlG9W4m - 7M9LOftFjPC99sSspxjpu7bEo8VZunI8ANxGGaGsGHPYu9JG+F67Gvc4xUSut7a29vFNBQDXrprd - 29tzZ2fmHdxvom+NrUUsrJqnyMB3ibt3Zj19+rR5g+nkAaZLHTgaAD579iz1OShmgvYmxQa++yP0 - j1P06c/SXjx6s1mhC0yP1uto0JdoUnbWWTuyLzLsXemB71VVpRVV26kfd2lp6ePeGADGTa2WGuRd - Xl7meJ1aQVv8CLKoSdvbtCfySerH1Ruv9isFvrp5AIyP/rb1N66/9Uxh/2QIYe+GMsL3qqpSr/5R - qrbN6zTiVw8upR5g+PTrXX/PmULetZ042vVyMKPFQQW+y9TBc51q/KrxKfjp4QeGQ730CnrN0WWo - 0c8qthPnLoMLfPfHZO5+zOUSu9rc3GwWYzDqB8qlkFfp5uTkpI9jfKH8KXly9jaDDHwvd4lnlkb9 - Cn5/A7BYCnh/yzya9wZXwrlu0IHvMrZuzqORvyaCFP6UfYD8VK5RuKvbpqeR/KziWy67GHzge+0V - tPb7GO1fp8lehb9W8epGmycQT8GulbC66X9nnHy9y1VbvhnF/iyjCXz3x2hfJZ7NRR+LNm7TyN9/ - CWhlr/8ngA+04lWB7v+pm0byCfe0iXHSlnAGPaqfNarA96qqWm+Df6mMI/oz7e1zE34dYExuuzaF - gr2nurvFZRv0o7uwxigD31tkmQfA4IyqfHOTUQe++6PMo+B/WsDhACiTdlE7GFP55iajD3yvXbC1 - n2NPHgCD9bId1Q9qAZXVZALfa4NfI/4dSj3AJF21c3wHUwl6b3KB782UenZKntwFkMzlTNCPunRz - m8kG/qyqqnba4O918RaAXmjR1FFd10dTP90E/oy23LPDqB8YPD+aP5pa2eYuBP4tqqpabYN/i/AH - BuGy3WblqLSLh5eCwO+gDf+t9pZtW2YAwV63IX9MyM9H4AdqJ3vXZ258AQD9UcCf+ttUJ1+tCPwE - 2q0cVmdufAkA8RTu5/42xq0O+kbgZ9JOAC+3XwKPZv7p6AYCGmftP9+2oe7/ecFEax4EPgBMxD3e - aACYBgIfACaCwAeAiSDwAWAiCHwAmAgCHwAmgsAHgIkg8AFgIgh8AJgC59z/AwXeQIk3mH5TAAAA - AElFTkSuQmCC diff --git a/cluster-config/clusters/overlays/local.home/components/cost-management-operator/kustomization.yaml b/cluster-config/clusters/overlays/local.home/components/cost-management-operator/kustomization.yaml deleted file mode 100644 index f4ca438..0000000 --- a/cluster-config/clusters/overlays/local.home/components/cost-management-operator/kustomization.yaml +++ /dev/null @@ -1,15 +0,0 @@ -kind: Kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 - -namespace: costmanagement-metrics-operator - -resources: - - https://github.com/redhat-cop/gitops-catalog/cost-management-operator/overlays/aggregate - -patchesJson6902: - - path: patch-source-and-name.yaml - target: - group: costmanagement-metrics-cfg.openshift.io - kind: CostManagementMetricsConfig - name: config - version: v1beta1 diff --git a/cluster-config/clusters/overlays/local.home/components/cost-management-operator/patch-source-and-name.yaml b/cluster-config/clusters/overlays/local.home/components/cost-management-operator/patch-source-and-name.yaml deleted file mode 100644 index 424ce63..0000000 --- a/cluster-config/clusters/overlays/local.home/components/cost-management-operator/patch-source-and-name.yaml +++ /dev/null @@ -1,6 +0,0 @@ -- op: replace - path: /spec/source/name - value: Home -- op: replace - path: /metadata/name - value: home-cluster diff --git a/cluster-config/clusters/overlays/local.home/components/lokistack/README.md b/cluster-config/clusters/overlays/local.home/components/lokistack/README.md deleted file mode 100644 index 4f269bb..0000000 --- a/cluster-config/clusters/overlays/local.home/components/lokistack/README.md +++ /dev/null @@ -1,54 +0,0 @@ - - -### Introduction - -Installs the Tech Preview LokiStack for cluster logging using local QNAP NAS for object storage. - -Installation is based on docs here: - -https://github.com/grafana/loki/blob/main/operator/docs/forwarding_logs_to_gateway.md#openshift-logging - -# Accessing logs - -You can access the logs using the logcli tool from grafana: - -https://github.com/grafana/loki/releases/tag/v2.5.0 - -Example queries: - -View raw application logs: -``` -export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/application -logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="product-catalog-dev"}' -``` - -View applicatons logs textually without JSON: -``` -export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/application -logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="product-catalog-dev", kubernetes_container_name="server"}' --output=raw | jq '."@timestamp",.kubernetes.pod_name,.level,.message' | paste - - - - -``` - -View infrastructure logs: -``` -export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/infrastructure -logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="openshift-logging"}' -``` - -### Storage Secret - -You will need a storage secret for your S3 bucket for Loki to use, format of secret is as follows: - -``` -apiVersion: v1 -data: - access_key_id: XXXXXX - access_key_secret: XXXXXX - bucketnames: XXXXXX - endpoint: XXXXXXXXXXXX -kind: Secret -metadata: - name: loki-storage - namespace: openshift-logging -``` - -The sealed secret here is referencing Minio running on my QNAP NAS so non AWS S3 buckets do work fine. diff --git a/cluster-config/clusters/overlays/local.home/components/lokistack/kustomization.yaml b/cluster-config/clusters/overlays/local.home/components/lokistack/kustomization.yaml deleted file mode 100644 index 2d53747..0000000 --- a/cluster-config/clusters/overlays/local.home/components/lokistack/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - ../../../../../components/loki/operator/cluster-logging/base - - ../../../../../components/loki/operator/loki/base - - ../../../../../components/loki/instance/overlays/sno - - loki-storage-qnap-secret.yaml diff --git a/cluster-config/clusters/overlays/local.home/components/lokistack/loki-storage-qnap-secret.yaml b/cluster-config/clusters/overlays/local.home/components/lokistack/loki-storage-qnap-secret.yaml deleted file mode 100644 index 82f08f0..0000000 --- a/cluster-config/clusters/overlays/local.home/components/lokistack/loki-storage-qnap-secret.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: bitnami.com/v1alpha1 -kind: SealedSecret -metadata: - name: loki-storage - namespace: openshift-logging -spec: - encryptedData: - access_key_id: AgADsXMtym0OLY598xcLZ4e6zPgh9x3KtCRX59K3J/LriPJPwNuMugAMZcHjLaA9nm+Rwqg095uhGD0pUxK5N336fMiMJ+7WpzMsR8nqMS3eoOtxhXBwML5wXqLmpf2FSxujUXws847JsohHtZiCg6ZBlWuJ2pEaCz6yPecMU8dixz+7OMs079origgakI0FjHlEPMn6BOhAOR4TMCt877mNmeLWrmxNEQt3ql4qMvNH3Ru8G4YijmO+jS9OQYqXYwTbO237zx+D3DDw0PAuUzqMIKXSZZdGNmATXIROu9+4TJGT6YnraMxON81F4t78D+y6reM6AIXN49SDcIxpmSZrtLJ5QQesOPbZ+x4mdR2Rj4RaqyktuNaBknn+CUCtx9aUv5LpWcIu/e+ZXTsVLVXLsmDpVv/k9fe1tyhlQPgdCAg/Iwn+xF3YVvLEpfhrXrkcKFK0snn242NbJk4aTcY28O+XHyJn7lmsbu/BSao7cqtbwJsFNCVo+e23KUkBoenw3LMQ2lyle9AfLyD10JIR5beozyt6pxxPDjnBXx8zlxhA0dPryQkm5O/+fiJd3gidzJmZZuVr8i20DaBoM3RnDhF0uccgDsbbM0N9KkEO1JXco22NGeBveKtkMOQaNy7i1QIHIFafkcyP9CStz8swsaWk5WaSEyr7ysiKpZlYE6tyaHPW2h4/uG/NfrOi6PXzPE4d90oyOeVIC28Obxse3aVRTw== - access_key_secret: AgCE8EHoWhZm4q25TcXlMy65uPopUNULeyw1Z+reSAr3pDaT+9B2k8TkPyo8vwCLYykqQqPS3VV7X6J80upVGWbYBVUM/7kI3W6F1kRl5eQjDmkAUmFa0t2EAxQP7TN1VPHVLZGUhwTGXjARdDGgDHi/We7jhl781ZFIZ8G0nkWCSZrB4T4XI+Mb154nR+GMejrstjzhFdueWgFZX/wX3PmcbmI+eAu0yeiW9IWikmDTrQyv1P46dDyPAKquZc7Dbgy4AxJ/ebeQ4558sOW9hvhTxoQ0hrEezeOMAbzQKqPd2Y5470LxMtoGL+FNqbLHTBQnqSucyDzOO2hiFhnUaCPvpCE/TRT7T3NbQ8uaugYaRR3eNa3w9ILWduMQ2yDsG+cNrYHXcyoUtdAQQ1eRv11jFYFVARRRGuGiFzWsLmMDvokCxQgkYpJXj5HqeZ+oT2xBVgd7P+c6ZQXRzfuwUXTUh+w3QxZ4XrqBq1jv7RRnu+uCj3E+vaavqIS8ipYXfLzjneHFhlAm9GS3rAIbCPlrZCaIIe/r4KRjtP7Gj4f6jhaN5Xo5jvBPqLYfX/RY8fll9XJAZGH6a9k+NDcxrwiV/UBDEQcPgnx83bCuFQ/qvIdd3tnOZ2dIvEHXnLMfBYOd0OyvkC3CoGKgmf4d6x4xvrzyqRHSIBxOGvDMG54IutZwHngFEuQbtGgtD0eN/SsLRO4wcuDugYVgiSPCHQ+IONUqvj7c7IJgRQKad2oxmlP7ZzSExVV8 - bucketnames: AgDA2DCtrPQmcdJ/QTBNZgmf2C7VSE96LVwje8J1N9XbmTte/d0oO9V0vUanXRKdraISTlHWBRBrYOxKx42nZMVzxKOHUCBMrdSN2z9ytgxNMhX2XNusTd4oDucsW+KM4IZyg95CXNvOSt01Y/uwdnJNK71VaiCSM1Sp+lIgVBzkwiase/YitOmCXVBofVLubWtsVwIGy5cWMmNhWmD0fjG5aIQ0Nx3OjYq/tIsrM4iB7FOn9Us1PQ9bkUNqJKu3LZtNIklzgDEUY6+uwtULt/jh8bTGHdptG18D1tuBf1SmD/xIWeCHf5Btp7XgRjivBR45DDIZHyc5mNdM7ydNvmae8SgOrugBWACQ37ZYiRIivDHJDs6Aa0fWDDd4ntdYclix7SurmqLx+/wzp7nyNmF3rCJY0u3FyX7twmLO2xZyabfqIqPY+kiGlKBY8uLGkLSDXbaLF78Vkww8Q5m5qdOZklADB+VZyii2PyFxLodeOKWujdG7vFnCiI41hCj3ry1FFM8o6397GO2zL1j4bflsmYh+9c5YKgc3ykzbLnAl+G30A505uXpBLJuXmHHXayGTNzU0D3EtWKnEwXF5NRYRQTdBPrwmUo7ml/UU04bdvJGob9dxGjypjB9CQG9pL3ouGTZZ60kNnSodhnKbRFv+Z1P8oNi4Vz6789eOrLVdn5kRppZy0f231HVRKfCXKjTAw96v - endpoint: AgClXa9d4ePlMAN9w+JajdcDv+Kde3Zp90vgZ2RE3pGebMq4WNpIZ3hHZzUWQWS90ffhJmGsPrry14aGSkKyj+2i5pVLFjrMhRajOcWvQrWcdNa/2XrkijpSoGTM0wXm1yLgmfRZGnhgt5LFWjuiOFze8j984FseGWp7ZKGA86CSfiWFidcaUhzVUaPC4P/tdfQMHRnYq1GdFw/6TxZRvpoEW/RRm3P2B+H6nAyrjILpdOCEzvM88WiVF93IB/oQWw4HnRt92lQ0A2Ni81s/pTngIYhIyXS6KrWt9+0w131fJSdvC5TRidcYXVAllxRyKUm/2hEqEtCA+w3yMyQ7ZW6rEhqWAJrN0qlDzSQ3rmYzRMKWaXQVDxrMhqg6PkaYjuQYQRLmOWzJ+4KCgUXI1jPOce5W3KOGPwVJNUe7RDRrjep3fDn7XjFJoWJG76zzGkAYWsY2QkZ4LwnxzuAFFQ3iyLYw/KDnOGG3BZvIKCHDLhk31PCkrOZV4rlmm1RIPpSeZOmbBGYoM3vSvdXNmUxGzju2LL3mBF0O9OkgKozQO+ihCGVjHJMRvpB5mcoKvcP9g2+HidAwlEAt8igm5uFFx06OMnvv7RmI+kLpcgE+crA3W0L1gZKdxFZKNKxn+AFBxY5TrAoQpaSuGv8czGxuy/ZxLWF0fSKeyv4uCMWY1wq4eXT8QiyJbWYtBh9sqKF6pqNABeDNwg79y4sP8Z76PPJreN8Sy8kq06lQvDbk - template: - metadata: - name: loki-storage - namespace: openshift-logging - type: Opaque diff --git a/cluster-config/clusters/overlays/local.home/components/lvm-operator/kustomization.yaml b/cluster-config/clusters/overlays/local.home/components/lvm-operator/kustomization.yaml deleted file mode 100644 index 142b99d..0000000 --- a/cluster-config/clusters/overlays/local.home/components/lvm-operator/kustomization.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - ../../../../../components/lvm-operator/overlays/standalone - -patches: - - patch: |- - - op: add - path: /spec/storage/deviceClasses/0/deviceSelector - value: - paths: - - /dev/nvme1n1 - target: - kind: LVMCluster diff --git a/cluster-config/clusters/overlays/local.home/components/node-config/kustomization.yaml b/cluster-config/clusters/overlays/local.home/components/node-config/kustomization.yaml deleted file mode 100644 index ed4750c..0000000 --- a/cluster-config/clusters/overlays/local.home/components/node-config/kustomization.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - set-max-pods.yaml - - ../../../../../components/wake-on-lan/base - -patches: - - patch: | - - op: replace - path: /spec/config/systemd/units/0/name - value: wol@enp8s0.service - - op: add - path: /metadata/labels/machineconfiguration.openshift.io~1role - value: master - target: - kind: MachineConfig - name: 99-wol-service diff --git a/cluster-config/clusters/overlays/local.home/components/node-config/set-max-pods.yaml b/cluster-config/clusters/overlays/local.home/components/node-config/set-max-pods.yaml deleted file mode 100644 index 9c5ccf7..0000000 --- a/cluster-config/clusters/overlays/local.home/components/node-config/set-max-pods.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -metadata: - name: set-max-pods -spec: - autoSizingReserved: true - machineConfigPoolSelector: - matchLabels: - pools.operator.machineconfiguration.openshift.io/master: "" - kubeletConfig: - podsPerCore: 11 - maxPods: 352 diff --git a/cluster-config/clusters/overlays/local.home/components/tenants/appset.yaml b/cluster-config/clusters/overlays/local.home/components/tenants/appset.yaml deleted file mode 100644 index b5e4f1a..0000000 --- a/cluster-config/clusters/overlays/local.home/components/tenants/appset.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: ApplicationSet -metadata: - name: tenants - namespace: openshift-gitops -spec: - generators: - - git: - directories: - - path: tenants/**/base - repoURL: https://github.com/gnunn-gitops/cluster-config - revision: main - goTemplate: true - syncPolicy: - preserveResourcesOnDeletion: true - template: - metadata: - name: tenant-{{ index .path.segments 1 | normalize }} - spec: - destination: - name: in-cluster - namespace: default - project: cluster-config - source: - path: '{{ .path.path }}' - repoURL: https://github.com/gnunn-gitops/cluster-config - syncPolicy: - automated: - selfHeal: true diff --git a/cluster-config/clusters/overlays/local.home/components/tenants/kustomization.yaml b/cluster-config/clusters/overlays/local.home/components/tenants/kustomization.yaml deleted file mode 100644 index bfaf768..0000000 --- a/cluster-config/clusters/overlays/local.home/components/tenants/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - appset.yaml diff --git a/cluster-config/clusters/overlays/local.hub/README.md b/cluster-config/clusters/overlays/local.hub/README.md deleted file mode 100644 index 0a1a4f4..0000000 --- a/cluster-config/clusters/overlays/local.hub/README.md +++ /dev/null @@ -1,3 +0,0 @@ -#### Home (local) Cluster - -This is my home cluster which runs on a server under my desk and uses the highly original cluster name of 'home'. It runs in libvirt on a Ryzen 3900x server with 128 GB of memory. It is typically configured as three combined master/worker nodes with 7 vCPU and 35 GB per node. diff --git a/cluster-config/clusters/overlays/local.hub/components/acs-operator/certificate.yaml b/cluster-config/clusters/overlays/local.hub/components/acs-operator/certificate.yaml deleted file mode 100644 index cccabdd..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/acs-operator/certificate.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: central-tls-letsencrypt-cert - namespace: stackrox -spec: - # Replace default secret since ACS doesn't support referencing a different secret - secretName: central-default-tls-cert - issuerRef: - name: letsencrypt-prod - kind: ClusterIssuer - dnsNames: - - central-stackrox.apps.hub.ocplab.com diff --git a/cluster-config/clusters/overlays/local.hub/components/acs-operator/kustomization.yaml b/cluster-config/clusters/overlays/local.hub/components/acs-operator/kustomization.yaml deleted file mode 100644 index ea24419..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/acs-operator/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ -commonAnnotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - -resources: -- ../../../../../components/acs-operator/overlays/aggregate -- certificate.yaml diff --git a/cluster-config/clusters/overlays/local.hub/components/consolelinks/acs-consolelink.yaml b/cluster-config/clusters/overlays/local.hub/components/consolelinks/acs-consolelink.yaml deleted file mode 100644 index 5f4344b..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/consolelinks/acs-consolelink.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: console.openshift.io/v1 -kind: ConsoleLink -metadata: - name: acs -spec: - href: 'https://central-stackrox.apps.hub.ocplab.com' - location: ApplicationMenu - text: Advanced Cluster Security - applicationMenu: - section: Red Hat Applications - imageURL: https://central-stackrox.apps.hub.ocplab.com/static/media/rh-favicon.0110fdfc5cab55416acf.ico diff --git a/cluster-config/clusters/overlays/local.hub/components/consolelinks/kustomization.yaml b/cluster-config/clusters/overlays/local.hub/components/consolelinks/kustomization.yaml deleted file mode 100644 index 8f1ceb8..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/consolelinks/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: -- ../../../../../components/consolelinks/base -- acs-consolelink.yaml diff --git a/cluster-config/clusters/overlays/local.hub/components/cost-management-operator/kustomization.yaml b/cluster-config/clusters/overlays/local.hub/components/cost-management-operator/kustomization.yaml deleted file mode 100644 index 72071cb..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/cost-management-operator/kustomization.yaml +++ /dev/null @@ -1,15 +0,0 @@ -kind: Kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 - -namespace: costmanagement-metrics-operator - -bases: -- https://github.com/redhat-cop/gitops-catalog/cost-management-operator/overlays/aggregate - -patchesJson6902: - - path: patch-source-and-name.yaml - target: - group: costmanagement-metrics-cfg.openshift.io - kind: CostManagementMetricsConfig - name: config - version: v1beta1 diff --git a/cluster-config/clusters/overlays/local.hub/components/cost-management-operator/patch-source-and-name.yaml b/cluster-config/clusters/overlays/local.hub/components/cost-management-operator/patch-source-and-name.yaml deleted file mode 100644 index 6d55abb..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/cost-management-operator/patch-source-and-name.yaml +++ /dev/null @@ -1,6 +0,0 @@ -- op: replace - path: /spec/source/name - value: Hub -- op: replace - path: /metadata/name - value: hub-cluster diff --git a/cluster-config/clusters/overlays/local.hub/components/eso/doppler-push-secret-store.yaml b/cluster-config/clusters/overlays/local.hub/components/eso/doppler-push-secret-store.yaml deleted file mode 100644 index 251c676..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/eso/doppler-push-secret-store.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ClusterSecretStore -metadata: - name: doppler-push-secret -spec: - provider: - doppler: - auth: - secretRef: - dopplerToken: - name: eso-token-cluster-push-secret - key: dopplerToken - namespace: hub-secrets diff --git a/cluster-config/clusters/overlays/local.hub/components/eso/kustomization.yaml b/cluster-config/clusters/overlays/local.hub/components/eso/kustomization.yaml deleted file mode 100644 index cbb120a..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/eso/kustomization.yaml +++ /dev/null @@ -1,3 +0,0 @@ -resources: -- ../../../../../components/eso/overlays/aggregate -- doppler-push-secret-store.yaml diff --git a/cluster-config/clusters/overlays/local.hub/components/lokistack/README.md b/cluster-config/clusters/overlays/local.hub/components/lokistack/README.md deleted file mode 100644 index 4f269bb..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/lokistack/README.md +++ /dev/null @@ -1,54 +0,0 @@ - - -### Introduction - -Installs the Tech Preview LokiStack for cluster logging using local QNAP NAS for object storage. - -Installation is based on docs here: - -https://github.com/grafana/loki/blob/main/operator/docs/forwarding_logs_to_gateway.md#openshift-logging - -# Accessing logs - -You can access the logs using the logcli tool from grafana: - -https://github.com/grafana/loki/releases/tag/v2.5.0 - -Example queries: - -View raw application logs: -``` -export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/application -logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="product-catalog-dev"}' -``` - -View applicatons logs textually without JSON: -``` -export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/application -logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="product-catalog-dev", kubernetes_container_name="server"}' --output=raw | jq '."@timestamp",.kubernetes.pod_name,.level,.message' | paste - - - - -``` - -View infrastructure logs: -``` -export LOKI_ADDR=http://lokistack-openshift-logging.apps.home.ocplab.com/api/logs/v1/infrastructure -logcli --bearer-token="$(oc whoami -t)" query '{kubernetes_namespace_name="openshift-logging"}' -``` - -### Storage Secret - -You will need a storage secret for your S3 bucket for Loki to use, format of secret is as follows: - -``` -apiVersion: v1 -data: - access_key_id: XXXXXX - access_key_secret: XXXXXX - bucketnames: XXXXXX - endpoint: XXXXXXXXXXXX -kind: Secret -metadata: - name: loki-storage - namespace: openshift-logging -``` - -The sealed secret here is referencing Minio running on my QNAP NAS so non AWS S3 buckets do work fine. diff --git a/cluster-config/clusters/overlays/local.hub/components/lokistack/kustomization.yaml b/cluster-config/clusters/overlays/local.hub/components/lokistack/kustomization.yaml deleted file mode 100644 index c64c63b..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/lokistack/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: -- ../../../../../components/loki/operator/cluster-logging/base -- ../../../../../components/loki/operator/loki/base -- ../../../../../components/loki/instance/overlays/sno -- loki-storage-qnap-secret.yaml diff --git a/cluster-config/clusters/overlays/local.hub/components/lokistack/loki-storage-qnap-secret.yaml b/cluster-config/clusters/overlays/local.hub/components/lokistack/loki-storage-qnap-secret.yaml deleted file mode 100644 index 82f08f0..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/lokistack/loki-storage-qnap-secret.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: bitnami.com/v1alpha1 -kind: SealedSecret -metadata: - name: loki-storage - namespace: openshift-logging -spec: - encryptedData: - access_key_id: AgADsXMtym0OLY598xcLZ4e6zPgh9x3KtCRX59K3J/LriPJPwNuMugAMZcHjLaA9nm+Rwqg095uhGD0pUxK5N336fMiMJ+7WpzMsR8nqMS3eoOtxhXBwML5wXqLmpf2FSxujUXws847JsohHtZiCg6ZBlWuJ2pEaCz6yPecMU8dixz+7OMs079origgakI0FjHlEPMn6BOhAOR4TMCt877mNmeLWrmxNEQt3ql4qMvNH3Ru8G4YijmO+jS9OQYqXYwTbO237zx+D3DDw0PAuUzqMIKXSZZdGNmATXIROu9+4TJGT6YnraMxON81F4t78D+y6reM6AIXN49SDcIxpmSZrtLJ5QQesOPbZ+x4mdR2Rj4RaqyktuNaBknn+CUCtx9aUv5LpWcIu/e+ZXTsVLVXLsmDpVv/k9fe1tyhlQPgdCAg/Iwn+xF3YVvLEpfhrXrkcKFK0snn242NbJk4aTcY28O+XHyJn7lmsbu/BSao7cqtbwJsFNCVo+e23KUkBoenw3LMQ2lyle9AfLyD10JIR5beozyt6pxxPDjnBXx8zlxhA0dPryQkm5O/+fiJd3gidzJmZZuVr8i20DaBoM3RnDhF0uccgDsbbM0N9KkEO1JXco22NGeBveKtkMOQaNy7i1QIHIFafkcyP9CStz8swsaWk5WaSEyr7ysiKpZlYE6tyaHPW2h4/uG/NfrOi6PXzPE4d90oyOeVIC28Obxse3aVRTw== - access_key_secret: AgCE8EHoWhZm4q25TcXlMy65uPopUNULeyw1Z+reSAr3pDaT+9B2k8TkPyo8vwCLYykqQqPS3VV7X6J80upVGWbYBVUM/7kI3W6F1kRl5eQjDmkAUmFa0t2EAxQP7TN1VPHVLZGUhwTGXjARdDGgDHi/We7jhl781ZFIZ8G0nkWCSZrB4T4XI+Mb154nR+GMejrstjzhFdueWgFZX/wX3PmcbmI+eAu0yeiW9IWikmDTrQyv1P46dDyPAKquZc7Dbgy4AxJ/ebeQ4558sOW9hvhTxoQ0hrEezeOMAbzQKqPd2Y5470LxMtoGL+FNqbLHTBQnqSucyDzOO2hiFhnUaCPvpCE/TRT7T3NbQ8uaugYaRR3eNa3w9ILWduMQ2yDsG+cNrYHXcyoUtdAQQ1eRv11jFYFVARRRGuGiFzWsLmMDvokCxQgkYpJXj5HqeZ+oT2xBVgd7P+c6ZQXRzfuwUXTUh+w3QxZ4XrqBq1jv7RRnu+uCj3E+vaavqIS8ipYXfLzjneHFhlAm9GS3rAIbCPlrZCaIIe/r4KRjtP7Gj4f6jhaN5Xo5jvBPqLYfX/RY8fll9XJAZGH6a9k+NDcxrwiV/UBDEQcPgnx83bCuFQ/qvIdd3tnOZ2dIvEHXnLMfBYOd0OyvkC3CoGKgmf4d6x4xvrzyqRHSIBxOGvDMG54IutZwHngFEuQbtGgtD0eN/SsLRO4wcuDugYVgiSPCHQ+IONUqvj7c7IJgRQKad2oxmlP7ZzSExVV8 - bucketnames: AgDA2DCtrPQmcdJ/QTBNZgmf2C7VSE96LVwje8J1N9XbmTte/d0oO9V0vUanXRKdraISTlHWBRBrYOxKx42nZMVzxKOHUCBMrdSN2z9ytgxNMhX2XNusTd4oDucsW+KM4IZyg95CXNvOSt01Y/uwdnJNK71VaiCSM1Sp+lIgVBzkwiase/YitOmCXVBofVLubWtsVwIGy5cWMmNhWmD0fjG5aIQ0Nx3OjYq/tIsrM4iB7FOn9Us1PQ9bkUNqJKu3LZtNIklzgDEUY6+uwtULt/jh8bTGHdptG18D1tuBf1SmD/xIWeCHf5Btp7XgRjivBR45DDIZHyc5mNdM7ydNvmae8SgOrugBWACQ37ZYiRIivDHJDs6Aa0fWDDd4ntdYclix7SurmqLx+/wzp7nyNmF3rCJY0u3FyX7twmLO2xZyabfqIqPY+kiGlKBY8uLGkLSDXbaLF78Vkww8Q5m5qdOZklADB+VZyii2PyFxLodeOKWujdG7vFnCiI41hCj3ry1FFM8o6397GO2zL1j4bflsmYh+9c5YKgc3ykzbLnAl+G30A505uXpBLJuXmHHXayGTNzU0D3EtWKnEwXF5NRYRQTdBPrwmUo7ml/UU04bdvJGob9dxGjypjB9CQG9pL3ouGTZZ60kNnSodhnKbRFv+Z1P8oNi4Vz6789eOrLVdn5kRppZy0f231HVRKfCXKjTAw96v - endpoint: AgClXa9d4ePlMAN9w+JajdcDv+Kde3Zp90vgZ2RE3pGebMq4WNpIZ3hHZzUWQWS90ffhJmGsPrry14aGSkKyj+2i5pVLFjrMhRajOcWvQrWcdNa/2XrkijpSoGTM0wXm1yLgmfRZGnhgt5LFWjuiOFze8j984FseGWp7ZKGA86CSfiWFidcaUhzVUaPC4P/tdfQMHRnYq1GdFw/6TxZRvpoEW/RRm3P2B+H6nAyrjILpdOCEzvM88WiVF93IB/oQWw4HnRt92lQ0A2Ni81s/pTngIYhIyXS6KrWt9+0w131fJSdvC5TRidcYXVAllxRyKUm/2hEqEtCA+w3yMyQ7ZW6rEhqWAJrN0qlDzSQ3rmYzRMKWaXQVDxrMhqg6PkaYjuQYQRLmOWzJ+4KCgUXI1jPOce5W3KOGPwVJNUe7RDRrjep3fDn7XjFJoWJG76zzGkAYWsY2QkZ4LwnxzuAFFQ3iyLYw/KDnOGG3BZvIKCHDLhk31PCkrOZV4rlmm1RIPpSeZOmbBGYoM3vSvdXNmUxGzju2LL3mBF0O9OkgKozQO+ihCGVjHJMRvpB5mcoKvcP9g2+HidAwlEAt8igm5uFFx06OMnvv7RmI+kLpcgE+crA3W0L1gZKdxFZKNKxn+AFBxY5TrAoQpaSuGv8czGxuy/ZxLWF0fSKeyv4uCMWY1wq4eXT8QiyJbWYtBh9sqKF6pqNABeDNwg79y4sP8Z76PPJreN8Sy8kq06lQvDbk - template: - metadata: - name: loki-storage - namespace: openshift-logging - type: Opaque diff --git a/cluster-config/clusters/overlays/local.hub/components/lvm-operator/kustomization.yaml b/cluster-config/clusters/overlays/local.hub/components/lvm-operator/kustomization.yaml deleted file mode 100644 index 5d70ddd..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/lvm-operator/kustomization.yaml +++ /dev/null @@ -1,12 +0,0 @@ -resources: -- ../../../../../components/lvm-operator/base - -patches: - - patch: |- - - op: add - path: /spec/storage/deviceClasses/0/deviceSelector - value: - paths: - - /dev/nvme0n1p5 - target: - kind: LVMCluster diff --git a/cluster-config/clusters/overlays/local.hub/components/nmstate/kustomization.yaml b/cluster-config/clusters/overlays/local.hub/components/nmstate/kustomization.yaml deleted file mode 100644 index 5773560..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/nmstate/kustomization.yaml +++ /dev/null @@ -1,19 +0,0 @@ -resources: -- github.com/redhat-cop/gitops-catalog/nmstate/aggregate/overlays/default -- node-network-configuration-policy.yaml - -patches: - - patch: |- - - op: replace - path: /spec/channel - value: "stable" - target: - kind: Subscription - name: kubernetes-nmstate-operator - - patch: |- - - op: add - path: /metadata/annotations/argocd.argoproj.io~1sync-options - value: SkipDryRunOnMissingResource=true - target: - kind: NMState - name: nmstate diff --git a/cluster-config/clusters/overlays/local.hub/components/nmstate/node-network-configuration-policy.yaml b/cluster-config/clusters/overlays/local.hub/components/nmstate/node-network-configuration-policy.yaml deleted file mode 100644 index 30dfbdd..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/nmstate/node-network-configuration-policy.yaml +++ /dev/null @@ -1,68 +0,0 @@ -apiVersion: nmstate.io/v1 -kind: NodeNetworkConfigurationPolicy -metadata: - name: hub-server - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - desiredState: - interfaces: - - name: enp0s31f6 - state: absent - type: ethernet - ipv4: - dhcp: true - enabled: true - auto-dns: true - - # interfaces: - # - name: bond0 - # description: Bond with ports enp4s0 and enp0s31f6 - # type: bond - # state: up - # copy-mac-from: enp4s0 - # ipv4: - # dhcp: false - # enabled: true - # link-aggregation: - # mode: active-backup - # options: - # miimon: '140' - # port: - # - enp4s0 - # - enp0s31f6 - # mtu: 1450 - # - name: br1 - # description: Linux bridge with bond0 as a port - # type: linux-bridge - # state: up - # mtu: 9000 - # ipv4: - # enabled: false - # bridge: - # options: - # stp: - # enabled: false - # port: - # - name: bond0 - - # interfaces: - # - name: enp4s0 - # state: up - # type: ethernet - # ipv4: - # dhcp: false - # enabled: true - # - name: enp0s31f6 - # state: up - # type: ethernet - # ipv4: - # dhcp: true - # enabled: true - # auto-dns: true - # routes: - # config: - # - destination: 0.0.0.0/0 - # next-hop-address: 192.168.1.1 - # next-hop-interface: enp4s0 - # table-id: 254 diff --git a/cluster-config/clusters/overlays/local.hub/components/node-config/kustomization.yaml b/cluster-config/clusters/overlays/local.hub/components/node-config/kustomization.yaml deleted file mode 100644 index 6888903..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/node-config/kustomization.yaml +++ /dev/null @@ -1,15 +0,0 @@ -resources: -- set-max-pods.yaml -- ../../../../../components/wake-on-lan/base - -patches: - - patch: | - - op: replace - path: /spec/config/systemd/units/0/name - value: wol@enp0s31f6.service - - op: add - path: /metadata/labels/machineconfiguration.openshift.io~1role - value: master - target: - kind: MachineConfig - name: 99-wol-service diff --git a/cluster-config/clusters/overlays/local.hub/components/node-config/set-max-pods.yaml b/cluster-config/clusters/overlays/local.hub/components/node-config/set-max-pods.yaml deleted file mode 100644 index d3f0b24..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/node-config/set-max-pods.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -metadata: - name: set-max-pods -spec: - autoSizingReserved: true - machineConfigPoolSelector: - matchLabels: - pools.operator.machineconfiguration.openshift.io/master: "" - kubeletConfig: - podsPerCore: 10 - maxPods: 450 diff --git a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/README.md b/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/README.md deleted file mode 100644 index d260b29..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/README.md +++ /dev/null @@ -1 +0,0 @@ -Note you need to manually generate the config bundle secret in the generate folder, at some point I'll fully gitops this process. diff --git a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/config-bundle-secret-qnap.yaml b/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/config-bundle-secret-qnap.yaml deleted file mode 100644 index 61e3b93..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/config-bundle-secret-qnap.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: v1 -data: - config.yaml: RVhURVJOQUxfVExTX1RFUk1JTkFUSU9OOiBmYWxzZQpTRVJWRVJfSE9TVE5BTUU6IHJlZ2lzdHJ5LmFwcHMuaG9tZS5vY3BsYWIuY29tClBSRUZFUlJFRF9VUkxfU0NIRU1FOiBodHRwcwpESVNUUklCVVRFRF9TVE9SQUdFX0NPTkZJRzoKICAgIHJhZG9zR1dTdG9yYWdlOgogICAgICAgIC0gUmFkb3NHV1N0b3JhZ2UKICAgICAgICAtIGFjY2Vzc19rZXk6IDc0RzI1S1FBSVhaWDlISEtDUTc2CiAgICAgICAgICBzZWNyZXRfa2V5OiB4ZzVKd0gzUzY3TytzSytOTk1wOHFxdHFFekhJZ3dSRGhmVjdESmVsCiAgICAgICAgICBidWNrZXRfbmFtZTogcXVheQogICAgICAgICAgaG9zdG5hbWU6IGxhYi1uYXMub2NwbGFiLmNvbQogICAgICAgICAgaXNfc2VjdXJlOiB0cnVlCiAgICAgICAgICBwb3J0OiA5MDAwCiAgICAgICAgICBzdG9yYWdlX3BhdGg6IC9kYXRhc3RvcmFnZS9yZWdpc3RyeQpESVNUUklCVVRFRF9TVE9SQUdFX0RFRkFVTFRfTE9DQVRJT05TOiBbXQpESVNUUklCVVRFRF9TVE9SQUdFX1BSRUZFUkVOQ0U6CiAgICAtIHJhZG9zR1dTdG9yYWdlClNTT19MT0dJTl9DT05GSUc6CiAgQ0xJRU5UX0lEOiBxdWF5CiAgQ0xJRU5UX1NFQ1JFVDogNzIzNzgyYmEtOTVkNC00ZDk1LThiMDQtZWZlYmNlMGFkZjg2CiAgT0lEQ19TRVJWRVI6IGh0dHBzOi8vc3NvLXNzby5hcHBzLmhvbWUub2NwbGFiLmNvbS9hdXRoL3JlYWxtcy9vcGVuc2hpZnQvCiAgTE9HSU5fU0NPUEVTOgogICAgLSBvcGVuaWQKICBTRVJWSUNFX05BTUU6IE9wZW5TaGlmdApTVVBFUl9VU0VSUzoKICAgIC0gYWRtaW4KICAgIC0gcXVheWFkbWluCkZFQVRVUkVfRElSRUNUX0xPR0lOOiB0cnVlCkZFQVRVUkVfVVNFUl9JTklUSUFMSVpFOiB0cnVl - ssl.cert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUdpakNDQkhLZ0F3SUJBZ0lSQU5DY3FxS0dWdXVORjBDcDJDVUI0eGN3RFFZSktvWklodmNOQVFFTUJRQXcKU3pFTE1Ba0dBMVVFQmhNQ1FWUXhFREFPQmdOVkJBb1RCMXBsY205VFUwd3hLakFvQmdOVkJBTVRJVnBsY205VApVMHdnVWxOQklFUnZiV0ZwYmlCVFpXTjFjbVVnVTJsMFpTQkRRVEFlRncweU1qRXdNRFF3TURBd01EQmFGdzB5Ck16QXhNREl5TXpVNU5UbGFNQ2d4SmpBa0JnTlZCQU1USFhKbFoybHpkSEo1TG1Gd2NITXVhRzl0WlM1dlkzQnMKWVdJdVkyOXRNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQTdTQW1QeUpnWjVyaApLbmkwRUFzME1qaXI4b0habFlaTm1WaFBHVWhXVXJwQlM0ejRTa2RuWmdZUHVEdE81UVFQZVZ2ZXAyU094cFd0CjFkRm91Z1NES0ljcm9laTUxTmh4TjV6RlZhL1hmR25kaUFpYnFMYVMxS2ZJc0dJZ05zV1dpcWI1NmdxMjVOTE0KUk8yeXdZRzVxUFNXeTM3R1dMSFEvRkpqKy8vWGZCcUtuMzhSU29tZVRjbkg2ZVJxM0dwUjNlSmNsbUluV1V2Twozbmw0NE9WTVZWcHcweVFOU3plVFVNcEVNNzJMU1lFUkhZUS9EUkdlbVdCaDVQQ2gzT00xdlhtbFBDUVZZd2E3CnQ1bUNjdHh3UUgyS0o0UC80UVJxREdIZlcwc1E5ZW4xTWtEb3c2WU83WVFTT1h5UC9IcjVvTXpEcXFGT0R5OXcKbEFPdlRiUXBRUUlEQVFBQm80SUNpakNDQW9Zd0h3WURWUjBqQkJnd0ZvQVV5Tmw0YUtMWkdXalZQWExlWHdvKwozTFdHaHFZd0hRWURWUjBPQkJZRUZFcUd3c2h5R3pVL1JWZVVRa1JiNHhJeC9HYzhNQTRHQTFVZER3RUIvd1FFCkF3SUZvREFNQmdOVkhSTUJBZjhFQWpBQU1CMEdBMVVkSlFRV01CUUdDQ3NHQVFVRkJ3TUJCZ2dyQmdFRkJRY0QKQWpCSkJnTlZIU0FFUWpCQU1EUUdDeXNHQVFRQnNqRUJBZ0pPTUNVd0l3WUlLd1lCQlFVSEFnRVdGMmgwZEhCegpPaTh2YzJWamRHbG5ieTVqYjIwdlExQlRNQWdHQm1lQkRBRUNBVENCaUFZSUt3WUJCUVVIQVFFRWZEQjZNRXNHCkNDc0dBUVVGQnpBQ2hqOW9kSFJ3T2k4dmVtVnliM056YkM1amNuUXVjMlZqZEdsbmJ5NWpiMjB2V21WeWIxTlQKVEZKVFFVUnZiV0ZwYmxObFkzVnlaVk5wZEdWRFFTNWpjblF3S3dZSUt3WUJCUVVITUFHR0gyaDBkSEE2THk5NgpaWEp2YzNOc0xtOWpjM0F1YzJWamRHbG5ieTVqYjIwd2dnRUZCZ29yQmdFRUFkWjVBZ1FDQklIMkJJSHpBUEVBCmR3Q3Q5Nzc2ZlA4UXlJdWRQWndlUGhocXRHY3BYYyt4RENUS2hZWTA2OXlDaWdBQUFZT2ozTnpjQUFBRUF3QkkKTUVZQ0lRQ1IzME80MHd6ZlZIdEZtVkFHY2hJK1ZyMzl1aVpuQlhUTE8vQ0d2c1NpMlFJaEFLMExKSnR4UzkrVgpRS0pnZjlVTkZKRFdxWkJ6MHNySmI4TS91d2l2WUl6VEFIWUFlaktNVk5pM0xiWWc2ampnVWg3cGhCWndNaE9GClRUdlNLOEU2VjZOUzYxSUFBQUdEbzl6YzlRQUFCQU1BUnpCRkFpQUtob2tFNmFady9haHZtb0pTdEJJUVBOWFIKdEZwMGpJNlczTVB5V1JpenNBSWhBUDRsTWdQaHprL1lXOE9QMXRGMEFhS0VHaHJiYmtkQkhQVGYreGIwRWpiYwpNQ2dHQTFVZEVRUWhNQitDSFhKbFoybHpkSEo1TG1Gd2NITXVhRzl0WlM1dlkzQnNZV0l1WTI5dE1BMEdDU3FHClNJYjNEUUVCREFVQUE0SUNBUUFZOU5aa0RGWXMvUlB5WmtuSm9RVjZJU1hwMkFZWnk0U2F4dkNZS2dKVzFPSTUKc1JWdUp4OS80MmVEWE1Dbm5RQkNHQ3FPYmw3OHNCazZndC9Wa0ZISG8yRkdac3hXQVAzOUFqM1ZrOFNJTlc1bQo0QTBxT1RJK1JpMFArZUY5U1E1aGpodjJkaWVEcEVjTEUxMERCcDdvQ0Q4Vm1XVFNuZGllZVloMG9xaURKSVhDClc5NEpoRWptZy9xVkNoZThSUVNiQ1RXYm9HeUthZXlVT3JMM0hSZW16QUhab1VtN01qc1ZjUXYyT1RzTGM3RzYKdkYxSy9NUFpISEFHL1NLMUhPM3FlNVZaZFZIS2RybE1GR0ZSRjZ0U0pSUUwxTzZLbVc4Zk1MYlpCWkhqWS92ZQpTS3k1WUdTR0VHY2ptQjA3UDdabndMTGl5MWtFeDR5NnN2NTVZL3ZUYWlJaVV1SkNDQ2NVb25qQ0hwUU1ZTnl0Cms0UGV3MUdZQjdMV2J0VGhZTzJLRkFxbjFtRHUzZXd5TkdWMXdaeXM4c2ROYVRxOFJPdHVyR1VkS3pxSU11VzUKdXllYlcrWFNIblduajZOaGRqYkt0RlpPM2JuM0pCcmVqaFhwcnd4ZzQ4dmk0cmRFVDlsYm1hVmZoY3g2LzUyagpSbkN2cEdyeTE2bVhqNmM1OEdieFdTWTdNek1TYytHK0UzL3VwZXpacTg3aU1KVjRIcFVlT2NsRHF4ZExrcTg0Clpxb2QxT0tSdDNvWkNjR0o0aHVoV3FhaGx5L3Nmck1PRjhIdmhIRXlNdE1HZVNuQm13WU1Qc1poeEpQMXNMWHEKUGUyV052UUErSmsvOXlMQTR1UnRDOVVjck9iaDJVcU9WNjNJMCtLUUZYWnpFbUpNb0k2aU1FZDFCekxpSmc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCi0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlHMVRDQ0JMMmdBd0lCQWdJUWJGV3IyOUFIa3NlZEJ3ellFWjdXdnpBTkJna3Foa2lHOXcwQkFRd0ZBRENCCmlERUxNQWtHQTFVRUJoTUNWVk14RXpBUkJnTlZCQWdUQ2s1bGR5QktaWEp6WlhreEZEQVNCZ05WQkFjVEMwcGwKY25ObGVTQkRhWFI1TVI0d0hBWURWUVFLRXhWVWFHVWdWVk5GVWxSU1ZWTlVJRTVsZEhkdmNtc3hMakFzQmdOVgpCQU1USlZWVFJWSlVjblZ6ZENCU1UwRWdRMlZ5ZEdsbWFXTmhkR2x2YmlCQmRYUm9iM0pwZEhrd0hoY05NakF3Ck1UTXdNREF3TURBd1doY05NekF3TVRJNU1qTTFPVFU1V2pCTE1Rc3dDUVlEVlFRR0V3SkJWREVRTUE0R0ExVUUKQ2hNSFdtVnliMU5UVERFcU1DZ0dBMVVFQXhNaFdtVnliMU5UVENCU1UwRWdSRzl0WVdsdUlGTmxZM1Z5WlNCVAphWFJsSUVOQk1JSUNJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBZzhBTUlJQ0NnS0NBZ0VBaG1semZxTzFNZGdqCjRXM2RwQlBUVkJYMUF1dmNBeUcxZmwwZFVudy9NZXVlQ1d6UldUaGVaMzVMVm85MWtMSTNERFZhWktXK1RCQXMKSkJqRWJZbU13Y1dTVFdZQ2c1MzM0U0YwK2N0REFzRnhzWCtyVERoOWtTckcvNG1wNk9TaHViTGFFSVVKaVpvNAp0ODczVHVTZDBXajVEV3QzRHRwQUc4VDM1bC92K3hyTjh1YjhQU1NvWDVWa2d3K2pXZjRLUXROdlVGTERxOG1GCldoVW5QTDZqSEFBRFhwdnM0bFROWXdPdHg5eVF0YnB4d1N0N1FKWTErSUNybVJKQjZCdUtSdC9qZkRKRjlKc2MKUlFWbEhJeFFkS0FKbDdvYVZuWGdEa3F0azJxZGRkM2tDRFhkNzRndjgxM0c5MXo3Q2pzR3lKOTNvSklsTlMzVQpnRmJENlY1NEpNZ1ozclNtb3RZYno5OG9aeFg3TUtidENtMWFKL3EraFR2MllLMXlNeHJuZmNpZUttT1lCYkZECmhuVzVPNlJNQTcwM2RCSzkyajZYUk4yRXR0TGtRdXVqWmd5K2pYUkt0YVdNSWxrTmtXSm1PaUhtRXJRbmdIdnQKaU5rSWNqSnVtcTFkZEZYNGlhVEk0MGE2emd2SUJ0eEZlRHMyUmZjYUg3M2VyN2N0TlVVcWdRVDVyRmdKaE1tRgp4NzZyUWdCNU9aVWtvZGI1azJleDdQK0d1NEo4NmJTMTUwOTRVdVljVjA5aFZla25tVGg1RXg5Q0JLaXBMUzJXCjJ3S0Jha2YrYVZZbk5DVTZTMG5BU3F0MnhyWnBHQzF2N3Y2RGh1ZXB5eUp0bjNxU1YyUG9CaVU1U3FsK2FBUnAKd1VpYlFNR200NGdqeU5EcURsVnArU2hMUWxVSDl4OENBd0VBQWFPQ0FYVXdnZ0Z4TUI4R0ExVWRJd1FZTUJhQQpGRk41djFxcUswclBWSURoMkp2QW5mS3lBMmJMTUIwR0ExVWREZ1FXQkJUSTJYaG9vdGtaYU5VOWN0NWZDajdjCnRZYUdwakFPQmdOVkhROEJBZjhFQkFNQ0FZWXdFZ1lEVlIwVEFRSC9CQWd3QmdFQi93SUJBREFkQmdOVkhTVUUKRmpBVUJnZ3JCZ0VGQlFjREFRWUlLd1lCQlFVSEF3SXdJZ1lEVlIwZ0JCc3dHVEFOQmdzckJnRUVBYkl4QVFJQwpUakFJQmdabmdRd0JBZ0V3VUFZRFZSMGZCRWt3UnpCRm9FT2dRWVkvYUhSMGNEb3ZMMk55YkM1MWMyVnlkSEoxCmMzUXVZMjl0TDFWVFJWSlVjblZ6ZEZKVFFVTmxjblJwWm1sallYUnBiMjVCZFhSb2IzSnBkSGt1WTNKc01IWUcKQ0NzR0FRVUZCd0VCQkdvd2FEQS9CZ2dyQmdFRkJRY3dBb1l6YUhSMGNEb3ZMMk55ZEM1MWMyVnlkSEoxYzNRdQpZMjl0TDFWVFJWSlVjblZ6ZEZKVFFVRmtaRlJ5ZFhOMFEwRXVZM0owTUNVR0NDc0dBUVVGQnpBQmhobG9kSFJ3Ck9pOHZiMk56Y0M1MWMyVnlkSEoxYzNRdVkyOXRNQTBHQ1NxR1NJYjNEUUVCREFVQUE0SUNBUUFWRHdvSXpRRFYKZXJjVDBlWXFaakJOSjhWTld3VkZsUU90WkVScW41aVduRVZhTFpaZHp4bGJ2ejJGeDBFeFVOdVVFZ1lrSVZNNApZb2NLa0NRN2hPNW5vaWNvcS9EckVZSDVJdU5jdVcxSThKSlo5REx1QjFmWXZJSGxaMkpHNDZpTmJWS0EzeWdBCkV6ODZSdkRRbHQyQzQ5NHFxUFZJdFJqcno5WWxKRUdUMERydHR5QXBxMFlMRkR6ZitaMXBrTWhoN2MrN2ZYZUoKcW1JaGZKcGR1S2M4SEVRa1lRUVNoZW40MjZTM0gwSnJJQWJLY0JDaXlZRnVPaGZ5dnV3VkNGRGZGdnJqQURqZAo0algxdVFYZDE2MUl5RlJibTg5czJPajVvVTF3RFl6NXN4K2hvQ3VoNmxTcysvdVB1V29tSXEzeTFHREZOYWZXCitMc0hCVTE2bFFvNVEyeWgyNWxhUXNLUmd5UG1NcEhKOThlZG02eTJzSFVhYkFTbVJIeHZHaXV3d0UyNWFEVTAKMlNBZWVweUltSjJDekI4MFlHN1d4bHluSHFOaHBFN3hmQzdQelFsTGdtZkVIZFUrdEhGZVFhelJRbnJGa1cyVwprcVJHSXE3Y0tSbnl5cHZqUE1ramVpVjlsUmRBTTlmU0p2c0Izc3ZVdXUxY29JRzF4eEkxeWVnb0dNNHI1UVA0ClJHSVZ2WWFpSTc2QzBkam9TYlEvZGtJVVVYUXVCOEFMNWp5SDM0ZzNCWmFhWHl2cG1uVjRpbHBwTVhWQW5BWUcKT041MVdoSjZXMHhOZE5Kd3pZQVNaWUgrdG1DV0krTjYwR3YyTk5NR0h3TVo3ZTliWGd6VUNaSDVGYUJGREdSNQpTOVZXcUhCNzNRK095SVZ2SWJLWWNTYzJ3L2FTdUZLR1NBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQotLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KTUlJRmdUQ0NCR21nQXdJQkFnSVFPWEpFT3ZraXQxSFgwMndRM1RFMWxUQU5CZ2txaGtpRzl3MEJBUXdGQURCNwpNUXN3Q1FZRFZRUUdFd0pIUWpFYk1Ca0dBMVVFQ0F3U1IzSmxZWFJsY2lCTllXNWphR1Z6ZEdWeU1SQXdEZ1lEClZRUUhEQWRUWVd4bWIzSmtNUm93R0FZRFZRUUtEQkZEYjIxdlpHOGdRMEVnVEdsdGFYUmxaREVoTUI4R0ExVUUKQXd3WVFVRkJJRU5sY25ScFptbGpZWFJsSUZObGNuWnBZMlZ6TUI0WERURTVNRE14TWpBd01EQXdNRm9YRFRJNApNVEl6TVRJek5UazFPVm93Z1lneEN6QUpCZ05WQkFZVEFsVlRNUk13RVFZRFZRUUlFd3BPWlhjZ1NtVnljMlY1Ck1SUXdFZ1lEVlFRSEV3dEtaWEp6WlhrZ1EybDBlVEVlTUJ3R0ExVUVDaE1WVkdobElGVlRSVkpVVWxWVFZDQk8KWlhSM2IzSnJNUzR3TEFZRFZRUURFeVZWVTBWU1ZISjFjM1FnVWxOQklFTmxjblJwWm1sallYUnBiMjRnUVhWMAphRzl5YVhSNU1JSUNJakFOQmdrcWhraUc5dzBCQVFFRkFBT0NBZzhBTUlJQ0NnS0NBZ0VBZ0JKbEZ6WU93OXNJCnM5Q3NWdzEyN2MwbjAweXRVSU5oNHFvZ1RRa3RaQW5jem9tZnpEMnA3UGJQd2R6eDA3SFdlemNvRVN0SDJqbkcKdkRvWnRGK212WDJkbzJOQ3RuYnlxVHNya2ZqaWI5RHNGaUNRQ1Q3aTZIVEpHTFNSMUdKazIzK2pCdkdJR0dxUQpJank4L2hQd2h4Ujc5dVFmanRUa1VjWVJaMFlJVWN1R0ZGUS92RFArZm15Yy94YWRHTDFSampXbXAyYkljbWZiCklXYXgxSnQ0QThCUU91ak04Tnk4bmt6K3J3V1dOUjlYV3JmL3p2azl0eXkyOWxUZHlPY1NPazJ1VElxM1hKcTAKdHlBOXluOGlOSzUrTzJobUFVVG5BVTVHVTVzellQZVV2bE0za0hORDh6TERVKy9icXY1MFRtbkhhNHhnazk3RQp4d3pmNFRLdXpKTTdVWGlWWjR2dVBWYitETkJwRHhzUDh5VW1hek50OTI1SCtuTkQ1WDRPcFdheEtYd3loR05WCmljUU53Wk5VTUJrVHJOTjlONmZyWFRwc05WemJRZGNTMnFsSkM5L1lnSW9KazJLT3RXYlBKWWpOaExpeFA2UTUKRDlrQ251c1NUSlY4ODJzRnFWNFdnOHk0WitMb0U1M01XNExUVExQdFcvL2U1WE9zSXpzdEFMODFWWFFKU2RoSgpXQnAva2pibVVaSU84eVo5SEUwWHZNbnNReWJRdjBGZlFLbEVSUFNaNTFlSG5sQWZWMVNvUHYxMFl5K3hVR1VKCjVsaENMa01hVExUd0pVZForZ1FlazlRbVJrcFFnYkxldm5pMy9HY1Y0Y2xYaEI0UFk5YnBZcnJXWDFVdTZsekcKS0FnRUpUbTREaXVwOGt5WEhBYy9EVkwxN2U4dmdnOENBd0VBQWFPQjhqQ0I3ekFmQmdOVkhTTUVHREFXZ0JTZwpFUW9qUHBieEIremlyeW52Z3FWLzBEQ2t0REFkQmdOVkhRNEVGZ1FVVTNtL1dxb3JTczlVZ09IWW04Q2Q4cklEClpzc3dEZ1lEVlIwUEFRSC9CQVFEQWdHR01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0VRWURWUjBnQkFvd0NEQUcKQmdSVkhTQUFNRU1HQTFVZEh3UThNRG93T0tBMm9EU0dNbWgwZEhBNkx5OWpjbXd1WTI5dGIyUnZZMkV1WTI5dApMMEZCUVVObGNuUnBabWxqWVhSbFUyVnlkbWxqWlhNdVkzSnNNRFFHQ0NzR0FRVUZCd0VCQkNnd0pqQWtCZ2dyCkJnRUZCUWN3QVlZWWFIUjBjRG92TDI5amMzQXVZMjl0YjJSdlkyRXVZMjl0TUEwR0NTcUdTSWIzRFFFQkRBVUEKQTRJQkFRQVloMUhjZENFOW5JcmdKN2N6MEM3TTdQRG15MTRSM2lKdm0zV09ubkwrNU5iK3FoK2NsaTN2QTBwKwpydlNOYjNJOFF6dkFQK3U0MzF5cXFjYXU4dnpZN3FON1EvYUdObndVNE0zMDl6LyszcmkwaXZDUmx2NzlRMlIrCi9jelNBYUY5ZmZnWkdjbENLeE8vV0l1NnBLSm1CSGFJa1U0TWlSVE9vazNKTXJPNjZCUWF2SEh4Vy9CQkM1Z0EKQ2lJREVPVU1zZm5Oa2pjWjdUdng1RHEyK1VVVEpuV3Z1NnJ2UDN0M085TEVBcEU5R1FEVEYxdzUyejk3R0ExRgp6Wk9GbGk5ZDMxa1dUejlSdmRWRkdEL3RTbzdvQm1GMEl4YTFEVkJ6SjBSSGZ4QmRpU3ByaFRFVXhPaXBha3lBCnZHcDR6N2gvam5aeW1ReWQvdGVSQ0JhaG8xK1YKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo= - ssl.key: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcEFJQkFBS0NBUUVBN1NBbVB5SmdaNXJoS25pMEVBczBNamlyOG9IWmxZWk5tVmhQR1VoV1VycEJTNHo0ClNrZG5aZ1lQdUR0TzVRUVBlVnZlcDJTT3hwV3QxZEZvdWdTREtJY3JvZWk1MU5oeE41ekZWYS9YZkduZGlBaWIKcUxhUzFLZklzR0lnTnNXV2lxYjU2Z3EyNU5MTVJPMnl3WUc1cVBTV3kzN0dXTEhRL0ZKaisvL1hmQnFLbjM4UgpTb21lVGNuSDZlUnEzR3BSM2VKY2xtSW5XVXZPM25sNDRPVk1WVnB3MHlRTlN6ZVRVTXBFTTcyTFNZRVJIWVEvCkRSR2VtV0JoNVBDaDNPTTF2WG1sUENRVll3YTd0NW1DY3R4d1FIMktKNFAvNFFScURHSGZXMHNROWVuMU1rRG8KdzZZTzdZUVNPWHlQL0hyNW9NekRxcUZPRHk5d2xBT3ZUYlFwUVFJREFRQUJBb0lCQVFEV1FGa3ViRklzNm8wTwpRZmQ0RTVkNjFTZlB1ekdzMzZlWHFXbjJ6eHhvTFRBNElreHBXUEQ5QnZjSElGZGRwL2lQVDhueTkzSGx6bkkrCklyTDhlSDFGampTSFcyOGsrTmY3UnFRcWt2SWgwTW5BVXY3S1J3U09MbmV2bjBtNkUzZTlHYmZ2bHZTLzloTnAKS0ZoK2JVY2llTFVUY3gybUlDeFMvK0tsVy9vSWYzbHZoS0NUdGl6SGtPcWhSZ3Jkc2trNUZSeWp2bG9oT0NFTgpLd2ZpekM0TCtlZlRGQnUxTUZtVllFaG5KWUtJV1d5aUhIdjZOZHpJajJKbTMySjFSOFBGRFhPNW92ekxCYXMyCnhMc1RGRE13Mlo5TDE2WlBRYVAyd3ZuS1FOaXhQSnBWeFBjRWlrYmdRaGVwaWFmV09jZmlHeDl1UGx6R0R6enMKa0dVWDZDQkJBb0dCQVB2UVliSk9ZOExIeWRKWWkweXhnTURmWEp5Z1RQaDZXZnRROTl1UlJselluLy9LWXMraApZVnhPRStDbVd0TFMzQ1Fyc1N6Rk1jc2xXeFJiY01FQlE4Mm5HOE1xTDhLTmlVekMyNkhPSVJFaXg2b1JPbE9HCmRDZUVwWGQzSkE1Wk1TaklRQWNORXhnVzZZVTJCblVya0JhRXNpaDRrL2FLR2RjVmtZUWZPNUlKQW9HQkFQRVIKUW9aQ2tOSWFyNFpVakRJNVpoc2gvU0RjM0c2L21hQ0VDS1JFa09sZm5hbWtneTZOYmJnWEppREUvdVlLSDJ1RgpxbHJYMk9EckVaa3FvK0Y2UWg2blh3Wi9UWlZhL1VIZkdxd0d1c3k2Rzc5TlVHZGoySUFGcDVMNXZFcWg2K05RCkJ6ZFZJYTB3bFUyQzNxNmFFeDk2MXJ6a3ZJUEVLenVzRE9Lemg4dDVBb0dCQUlxSjRyWU9tcVFXOXRwYkRJaHQKUDhEZElqNnBrcTlCNFM5N0pHSVFVdjNSMEhVU0M3cmZ0b2pxQzlXVXNITTh2eERIV1BxZ292eDQyTnNpVTY1YgoyOG5SSGwwSllLMVE0VER5STVPcHJGZVpJdkJWK2hqcDZBMjExTE1kUVNFRHdTQUd5L01WSm1RaWR1ZHJDYko4Ci9SRG1nSDN6bUxRUzFwU1dzVEJYWHBiQkFvR0FRWkFRSjdPeTczR1NpMVl6U3ZXUmI0K3U2R0VwRW5YSnNuNDIKVzNiS2NxNHVreFRMR0w0ZU9STVNxNWJvUEdoRVkxblhHeDNaUGxLd1ZwZmlPbENsNnZCYVI4b1hyNmN2ZWRyVAp4aldPV0YvRmJDSDYzQ09ybmlYcmpXMmVhQzNobWRFS0pXSmg1bGh3UXNSMUM4ZWJxOVFjMHdMaXduTjN6cUxjClhrdTFnd0VDZ1lCNklsQzNFNXZ3anJBUXlUQ0pWUG1TU0Q3c2VrQWhnaTMyOE5GVUtPRyt0VmxkbzJ2QVloWFoKaU5lZU9XMVlRT1JqWU95MlJIeWJaVUk4WVZ5VHZ4bzZVdGtIbm1nak5CRWgwWGk2UDUvTEs5OTB3SWd1ZHRoYQp3SisyY0FMT3Y4OUlBQXQ2ZWRzQ3M5ODYrZVRxSE80aHJBQi96U01VWEtlYVJSY0s1UWxyL3c9PQotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQo= -kind: Secret -metadata: - creationTimestamp: null - name: config-bundle-secret - namespace: quay diff --git a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/config-qnap-example.yaml b/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/config-qnap-example.yaml deleted file mode 100644 index a843abe..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/config-qnap-example.yaml +++ /dev/null @@ -1,31 +0,0 @@ -EXTERNAL_TLS_TERMINATION: false -SERVER_HOSTNAME: registry.apps.home.ocplab.com -PREFERRED_URL_SCHEME: https -DISTRIBUTED_STORAGE_CONFIG: - # using Minio on QNAP NAS - radosGWStorage: - - RadosGWStorage - - access_key: XXXXX - secret_key: XXXX - bucket_name: quay - hostname: lab-nas.ocplab.com - is_secure: true - port: 9000 - storage_path: /datastorage/registry -DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: [] -DISTRIBUTED_STORAGE_PREFERENCE: - - radosGWStorage -SSO_LOGIN_CONFIG: - CLIENT_ID: quay - CLIENT_SECRET: 723782ba-95d4-4d95-8b04-efebce0adf86 - OIDC_SERVER: https://sso-sso.apps.home.ocplab.com/auth/realms/openshift/ - LOGIN_SCOPES: - - openid - SERVICE_NAME: OpenShift -SUPER_USERS: - - admin - - quayadmin -FEATURE_DIRECT_LOGIN: true -FEATURE_USER_INITIALIZE: true -FEATURE_QUOTA_MANAGEMENT: true -FEATURE_PROXY_CACHE: true diff --git a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/create-qnap-sealed-secret.sh b/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/create-qnap-sealed-secret.sh deleted file mode 100755 index f9b2085..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/create-qnap-sealed-secret.sh +++ /dev/null @@ -1,2 +0,0 @@ -oc create secret generic --from-file config.yaml=./config-qnap-private.yaml config-bundle-secret --from-file=ssl.cert=fullchain.pem --from-file=ssl.key=key.pem -o yaml --dry-run=client -n quay > config-bundle-secret-qnap.yaml -kubeseal --format yaml --cert ~/.bitnami/publickey.pem < config-bundle-secret-qnap.yaml diff --git a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/generate-certs.sh b/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/generate-certs.sh deleted file mode 100755 index ef30d5f..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/generate/generate-certs.sh +++ /dev/null @@ -1,7 +0,0 @@ -# Using Route53 with DNS challenge, source AWS creds (not in git repo but just sets access and secret key as env variables) -. aws-creds -mkdir -p qnap-tls -acme.sh --force --issue --dns dns_aws --cert-file "./qnap-tls/cert.pem" --key-file "./qnap-tls/key.pem" --fullchain-file "./qnap-tls/fullchain.pem" --ca-file "./qnap-tls/ca.cer" -d registry.apps.home.ocplab.com - -# Convert CA to crt -openssl x509 -inform PEM -in ./qnap-tls/ca.cer -out ./qnap-tls/letsencrypt_ca.crt diff --git a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/init-quay-job.yaml b/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/init-quay-job.yaml deleted file mode 100644 index c145950..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/init-quay-job.yaml +++ /dev/null @@ -1,83 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: quay-init ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: quay-init -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: admin -subjects: - - kind: ServiceAccount - name: quay-init ---- -apiVersion: batch/v1 -kind: Job -metadata: - name: quay-init - annotations: - argocd.argoproj.io/sync-wave: "20" -spec: - template: - spec: - containers: - - image: registry.redhat.io/ansible-automation-platform-21/ee-supported-rhel8:1.0 - envFrom: - - secretRef: - name: init-user-password - command: - - /bin/bash - - -c - - | - #!/usr/bin/env bash - - echo "Setup temporary OCP user to make ansible happy" - - echo "tempuser:x:$(id -u):$(id -g):,,,:${HOME}:/bin/bash" >> /etc/passwd - echo "tempuser:x:$(id -G | cut -d' ' -f 2)" >> /etc/group - id - - echo "Waiting for two minutes for quay to be ready" - - sleep 120 - - git clone https://github.com/gnunn-gitops/quay-init - - cd quay-init - - ansible-galaxy collection install -r collections/requirements.yaml - - ansible-playbook quay-init.yaml -e quay_init_password=$quay_init_password -e ansible_remote_tmp=/tmp - - echo "Waiting for deploy/registry-clair-app to be available" - until oc get deployment registry-clair-app - do - sleep 5; - done - oc scale deploy/registry-clair-app --replicas=1 - - echo "Waiting for deploy/registry-quay-app to be available" - until oc get deployment registry-quay-app - do - sleep 5; - done - oc set resources deploy/registry-quay-app -c=quay-app --requests=cpu=1,memory=1Gi --limits=cpu=2,memory=4Gi - oc scale deploy/registry-quay-app --replicas=1 - - echo "Waiting for deploy/registry-clair-postgres to be available" - until oc get deployment registry-clair-postgres - do - sleep 5; - done - oc set resources deploy/registry-clair-postgres -c=postgres --limits=memory=3Gi - - name: init-quay - dnsPolicy: ClusterFirst - restartPolicy: Never - terminationGracePeriodSeconds: 30 - serviceAccount: quay-init - serviceAccountName: quay-init diff --git a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/init-user-password-secret.yaml b/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/init-user-password-secret.yaml deleted file mode 100644 index 3a31fef..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/init-user-password-secret.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: bitnami.com/v1alpha1 -kind: SealedSecret -metadata: - name: init-user-password - namespace: quay - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - encryptedData: - quay_init_password: AgCFXt2+UWeWWgNO2EwPk10Vv07D8kXOYlVSPTi1AizSTJ35725eautJzhDSd1McS7A+VymUk6fdFDagx5oXJU7+Cr2V7n8sb+sQWQwiyaWuM4017PYHllCpMoU0Q5CF5yyZ11OyPPBi5Ucz391/TxgIZww9PGGXy2KolrL97fuvrVVgPdUdNw8SAG+6TlGTGiMuzg5VngLz8wKfNpQDdPum98DVRVvbzJHEp9Nu+rtglaCdLgsMcgTpWw59MKYsl7Slw7oZIxTZvRlu8m3DqGu+AqiFRGoLJpNhJ9aDMyH5QiQ+sf59VQILdTwTdPvC/wMAETKYqJ/PqEkTkYTsAdhS1AJDcMO2OoYGx7EheKNMRotjHSYor4DHedFqvVaA+X6ZjTU1so1Z5ToFW3tofnLXfrunuzUgU4Ld7pTl297Jyqy3J0kNF2vmsb0RExN8kbW+Rsk5rqHmYKm68lw28s+FI0Cejy29lk23j3V8m+WVY4ANtez1QTS0vU79+iauSVZx9Ab2hrD0IWLdU+18R+k1Mjd/ARBgxT/H6x4cGwhh32GF+46XPQpcNKrXeN0JsyDksllFHp6uXy6BYvDNxwm3eMVefOBdMkYr/z7pUqIYBtpQm9oyIEtr/j0f19CPmVX+glFsArVeCGizRrajtkLOb66x/OfoToZpwQzRalSwtHEHClLLXe8Y/HNm7vqx4golRYn3E3TiVOT0 - template: - metadata: - name: init-user-password - namespace: quay - type: Opaque diff --git a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/kustomization.yaml b/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/kustomization.yaml deleted file mode 100644 index 4b9af42..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/kustomization.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -commonAnnotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - -namespace: quay - -resources: -- github.com/redhat-cop/gitops-catalog/quay-operator/operator/overlays/stable-3.8 -- init-user-password-secret.yaml -- init-quay-job.yaml -- registry-config-bundle-secret.yaml -- registry.yaml -- registry-app-route.yaml diff --git a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/registry-app-route.yaml b/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/registry-app-route.yaml deleted file mode 100644 index 8f8fa4d..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/registry-app-route.yaml +++ /dev/null @@ -1,59 +0,0 @@ -kind: Route -apiVersion: route.openshift.io/v1 -metadata: - name: registry-quay-app - labels: - app: quay - quay-component: quay-app - quay-operator/quayregistry: registry - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - host: registry.apps.home.ocplab.com - to: - kind: Service - name: registry-quay-app - weight: 100 - port: - targetPort: https - tls: - termination: passthrough - wildcardPolicy: None ---- -apiVersion: route.openshift.io/v1 -kind: Route -metadata: - name: registry-quay-builder - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - host: registry-builder.apps.home.ocplab.com - port: - targetPort: grpc - tls: - insecureEdgeTerminationPolicy: Redirect - termination: reencrypt - to: - kind: Service - name: registry-quay-app - weight: 100 - wildcardPolicy: None ---- -apiVersion: route.openshift.io/v1 -kind: Route -metadata: - name: registry-quay-config-editor - annotations: - argocd.argoproj.io/sync-wave: "0" -spec: - host: registry-config-editor.apps.home.ocplab.com - port: - targetPort: http - tls: - insecureEdgeTerminationPolicy: Redirect - termination: edge - to: - kind: Service - name: registry-quay-config-editor - weight: 100 - wildcardPolicy: None diff --git a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/registry-config-bundle-secret.yaml b/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/registry-config-bundle-secret.yaml deleted file mode 100644 index c7b07a5..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/registry-config-bundle-secret.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: bitnami.com/v1alpha1 -kind: SealedSecret -metadata: - name: config-bundle-secret - namespace: quay -spec: - encryptedData: - config.yaml: AgCIl9LCyxEuz9IxO53ydUGhQIbf3c/wSGtS4dAMPeAKxCYvc8hPYa96kz/ogsSAAPtNqSzR4PzMFhODTfuNt7fkBUcsmMRLAPCghVySBYQZOaYmpkzr42i1B0S8KSHFkl3KDltu7QZWfiBz2cT3t5ghLU4AXNkpDAqUt2yCuYyeTxF14ND53kwWbu50n6GALUsWPKq6KHvlC1iRNk2cFMKMYVBjVYPNFrvnCLnJcCxHULAMy+IqIzHW76MWxeHGpQuWuaPK4g7YBOtjB3gs2KnqE2IsMOqTIgnp575CdyW443WNx8PbdgcaENfC+LTyjkhBgO1F9MXSJaR8Sd/Ou3Bj/u73ki/9Gi2SEJSIra+L+RMnXT/PG7orcFL0pIWONDomlfD2cG2Ky6aIhPDoJOWxUiUpGP7RHQ6sw0X/BlopOCu4c/7cb8RPaLzESG4E7w4k11OjuqsiAm92ZIvPegjIbSD4je2sVqMF9eEthwzydutgQznV3zGNkVd/L4cdI9lBo6yVKHF/imgiA7nwtaMMZN848RRMlsoiGhE8VCDYswBvMvOyoiBG1E7naijrGoeaP3GX9LIpzU6mHSLQ0aM/Pyi162wyNYo4ZLLXQ+EA+V3d4ku1AZ/ZffLXLo0nZTcyUIt0odDp3JhsBPXKzEoF843tfK7sONxxiV/xfBnTfJgfnEhxZTXq1L14VFS6NkQZR/Y8xTdUia6fFQ6nS0dkzZ5sxX6dzBeeCVgfD4WupiJ53PTAl8TqBVgi4PIFdCdCDuvt5PP1Uanr03KQG8+1fjtIJJOkOME9XgFL9ohMrhYkNqF/I8tR+LF69H7ynH+NfrmvrzMKQiDpFjY1E+Dv0hEQDe/2mjAen/Vj9dOaxYa21PU7i+Gt6/0zhveLu4nkfevUj2zFeuDXqZ1KothrPzh+xgRhSB8naf9041YYA8NPUaRFo2+DUH/YZXMfXnE36N5A1IEp3AESPrg99A+qMaQtO+oY4PYdBeWqbKYgihAcdHmlv3ZWIMHksGG352uOLSwF70VV/6p0QecM5bbP2WF6b5OWIIGZ9jarCKDJPaHh3Q/QevNwgdZIxvmVr9/FY/zhYQVOD6GXgI28E4M91nd2Kt7fZb3twscs+XgwZo2whO6I7AS3LZ0dKQIYFNSTd18s0j2z2NrLZzvnp4W36vaxvUVpGnyRsuMplwsGILlz+F3yN0qoxyZZJXl4Nhh2BbEkVacxVUrO6uMHL9BVZtW34D1P/KQJ/1dHm8hM5VZiyQHy9paVEgb7aPJ8Fwcq71mgjsSfqfNMDxBCrCq6i+mj26JKiS2bOno8eka42pNBPjEksRAAMJYI+UyO/k0XiN7Z+xXhkikgc+f++rV3HACnorisC759PVmUxM1Fu5/tdPKAp7WndHJ3/EHHen9ot7vG6VQERdnRWFYxGDxwH4qwIOJaM1Uwv/jBvJn3PJWIpF2d30VarxKoNat1g0RGKxq8nyKkpzQWRNICEC5v5Szd0n6s4FdRsQ5oDU9V4FwmrPFXUYiPjGgvvVTfDG7qLpfskajcjnbnYMsQIeBIz3dGo8z+DX/H4S676G50+alXhfEWgVJZrJSpUaMx2IFJno+xrvNYBER0m2orfwE3OBtmAXT3ac+EaAlvpi/fZAasp58gFVjCb4gNSaGbhZFKY62Oduyitfn4G6fTUUOhC9VyYUC6RJm5eJ9uPETqWTbebbG9Pe0PKMBJiAbcZ4PXEtNL8hey/iLo7SM3EhPPW9B0DtiqrX7rCEh1KwQZjbjIY4KuanNj5g5jkd20vvfVbPm9ZqITGpQM3BNH5ilh0tJ0YoigdBxJkt1vZmhWeR3ISLMokPK4A/g= - ssl.cert: AgCpxrw721DwvqSCXcjgtpkAbLSGaQcYdwTZMgBoA0kZzy0vpHkIiYlN8eLDHfdhii72cbOBKtKsil7OePm6tkSKGM8jgzZRuHxRVy2OWyuLTBQGxrRL3HyXDc+a8PlEe8msqRgZQ9n/DoaTWJco31Shh80DmERzpns+979z9RZkkhttnDhcPzXb30GCqxwFGEZm4NAP9jTwXcA+Brky4Mi6MCS3xRlBSO2ZNpn2WmCnk0kpvMJAVAMGHC3jKGFJTEQ5Jp8bjswLYIvXCnLWFo8CDW5eFGXJLiXd0nzZTQnkztAe7vy84jiGLZySn7n8MIBoOpipznJlAPUEjpWJ93/6/GFrCrKO86REE6pMN71/OoHhtcqIKSGMQfc18fjd7tmOE7/NtFKsoE4d5Eb5eI8xkxwMrdaRBz0X+m8TIZS3EVlOumtLQ4J94q79wLcVF5T7wxfdKuqQVvKOY/Hr2hTjlxiNfrKAyhRGpnaZKndWeGKSGVznWBpIMghU9YpThIvF3E7JF/fN/7YhUvGyRCn7ryRnBqQJw8F50Et/nshDg/m67vAQ4grDseOl6XGPxc43LB7G8ulzcBMY28OOsxC2lvFYwBFxvUYtS8CJHAifwq7aONVcBf8wvothZVSAKE+Qox/ZOn6BWkVwn4LGFBP5nOvXOz2YPXacXx2OSoHrVa6VMiDGk/pdu69xxPdG5aL9coIpoNGVYPbNAWHJ+iPxTeJI7BnkA0B/Ubnh1zpaB9HN7YGniBnRM9JUPKt2k35q/qrDa1IbRes/PbWO8M0vb+NrKnyI8tcD9Rq1JcDdKTGg4aNYpNYUFgnmIwf8X/ViBsHvekOtbTQwveZ+okEybRjdUAbEuKHLXyC8Wr3VGLQvsg3K3kncZkhNltVDkrWJerx8RNlFNfh7+cS/vPUHqBzHTFHTCnQp/5t7VgV4IVmrKPPgzuABsCdUW6piCzfJZDQ0hyY/vvD9BKPKLp2SwjYw39cXoCqqkNGrS7HEX7f6GVP1i42lnTLQ/0WCG7FuAqBO/0m6vgxwgkSkpqmtsuCgq8hwx94Q8d9ugmPOpJth69WSJMez9pAm60GOHYC288EO/amqzOruD474vhB64ZwxvPJfscqdf3GmmD5dTb5zYn4t3mCUzc87vNJ+kUZ5Swbu3E+ZC/6DY4wBKzVuGuOhr0VyZkH1VtpmfkhJsiGV+UM1+opr7s6vUoapEJacdVoI1Q+sPQ2EEvf7+7uRuBGcXOM4Uwxh9T3zyDkLcusbjbIo+HAFSR2M034059NcS1eXZWgGlYQmIYMkl22vEcK1K5GAHPcGxgmBVAdmBw/H9auafhKnRriNWqLIlcXNFKZFZmzxh3vKNHIT8mOcUs98dQ8Z5Nx8B5wxgXke22KrfhR5EUo7qfaGWZ43OWd+A48SmVZlZzGbT+3c0EJibspjo9wuKdS+e6llEf1BjVdUTYFx0JVUpNQMMtqBHPB8kqwX/8k/EkLoMPbJw419aSrF13qouNQklohYfRp9Cp1AuWRX43eAafLaxf7SIihH4QXfGKcdU9rYhttchJ2mAH5V4GCgOOdE3lVp41eO6nFrzdOsJ0/PtGMESa3yPwLdOW145nRFAJpMnW3NqXUrCanrCoVEIFx9tsnu+VIAbd9d9iye6+nPtNktwtV2AHPYl1ek5hq5fuwHxfwCOkUX8x6LwVcHttXx6nZbMhatLh2h0rjEcl/WrjlNqtZ4mKwyb4/z2GZhhVGrZRXzUYcHkdvAXUMocIH3dirPBlB4opWp2JMrvzm3E44P1Np9/6p5Sw/zb5JSpDseTSlqMe6FNTzE3yhAPmcfP1IIlOV8UB3+3SpUIjov/B/MJfzLlDS+jeEAJ+DaozTzNYbS9cDddRXbA5ypKCTvVybmzPjOG1KJFAZiWWXif40l853NDbDA0x/u+bv2lq/GEPEgWlaIQJb+FxxPjHx1TTc+k+KEQEPtpfUkYZ1QMEfpQQMT4GraaIe9zIOVlqkD1x88jRsa17wpA+Vl2bIyCoJyL62evNI1iktrjMjQYvOd/ddwD5QH+26FknJltD3g46J7goLAvJIzQWsbpD1A1eqZhywWNfJTHsvWAqThtykEakDwDCXR5xFuo9lALPyLHSv3gUcW1mX5DbZFmyGp/M+TLTUPP3f+o9KblpUxujZSD/922iD4D2p2muaLgU+BC/7rPZWNwXL+via/Ag1khjQDIKnr3mWIUJQ/fFwCDaRXZqNIP48/6wVLVaWLBY7Cb3qT6kLOxdJ6sXfruPJzOGnvaAHnBP9TwE5u2PFbJ5ASQdmqEbA3mQ32xdqEMWmgjebZqQegf7EeV3BHcbjZIHgw71xgxCCkr/iZzM/o9ga4wYTq3fXS6Tuw85Mu755NpZv3ErXklZaV6lBsC+MQtb1FunB6mzGe13VKnkJHp5coTzjoDtjFfHIg0OgOmZJkCoDIF5wUy8HYZtOA0EmwHHaU7pvmKAWRRhqmb55Spa4ihcMnOYxed9HjeDO+lZ7uHfOzGjhvX7eC8a44Tf0QZ9wZVriSLa64+vQPBPJJx7Nfsn11zzsE34YzWAI31S+gMiAXfjrPGcPpSM6eFeP/3VgmPH33OIu+MyONDgKRJxopU8kfSdRIUfK0I6N+fW8b4/PpZH6h5fsvQ7K6QTVGnGrkHUfKc4D5frICgHBK+bfSz+SiZbcqEQg6C/shV/7UIuYaam/GEZssa2eEX7BO9ynce+/0o5vFg7IfAae9hhV+zd0oa2+SC2bpK9WGhZCIgiDKSBu9VGA+dcR3gHepL2N0Cg5k9s1lpIF6R7iaQ1q7eSurYDya33DKCOdPSMy+G+CrSKYwdAaoqDxtzzs9m3ZRdQnUNlrnjZ8S7cb1mBefSEAYAC7uCs3oIXg8UWZ3oRhrb/ldqyPfwO7uVEgXFvTuDoAZ6MFBkJbfDmNbnpOfrM3Fpdux8U3xtMwpHbF8373AlJ+5lMRTELHXvf1APRjuY60uwbcgcFRl3lYSqB6zyBcChXjU/8LVgITYnPtd2da/58FCUJoyfp1B17deZWNIZjxsuapJe5i9iaOlWbgZG7eg3YN9l148mlaTTzaiN6XB4xGc9lg0OrrYywyCZzEfPERHprISVnhokSB+QyjnxytdnvqIUeEvW+iRZA/l2lxtBkQgzwuzP2SngSTEZluFzwgYsY3wEn6qkn5rukQVzfNod6PaDEHL0hKAQHwLgS44xvz4Cr18lnzCiYhGYf8ykQqq/t+ADkHkrW8RS6FJ63ZjHBmEsK77NRTv6sBj2vy3IcAp/pT18mN6EBxWASFYIHWqOG9Sn5ScfFFeqbYvrEOq73XpnMH8mPnsJUh6lDlc+S3EYbgnG7wp5yWCq9I+nwUa4zUMWZpyb7UWu9ANawRp8odFBeyFP9HJ5J4pj1aXfNze2B5QlAmsEGLR5jRPoNkEMznjzXWYlND+J/mvaQHFzdCfB9Wk1PaZZuhjLhC00j1BLJjZxbwtw2LeGPT6YYzNH8Q2oQr+50JCdsEIY4V+MI4gnMIG9+CBh9wTBxuaxJJG7A1O7YCV1SNPB9B2zEkPxqKpbP8YrKhYgNpd4ftOWlaZLoBWQNtuiRAxFq1mtzJAraovC//FcSoh5ZJqEs4VYzo6qJ6SiR7nF0ahDCwABmv2gTymfNbLs5YqtFJeUBEhRawE0mMnMy5TOcfDNZLGkQx+9un2t2HeahZwwaJgZYg64gCwQCk/t7Nl3isrNc/WrYfetbN82V4eFtJ+6R9oPqJ7v7PI8QV3mVh5aOK1mspTu2TQeHp+7rEXggVkyGt2Xaem0iuP3wSeG0hH9k8UopRBlpXjvUxQ4912dehQzI9uboytOH9GbC0NqBieDCYWquCpkbq53oT5BS5ashHk7zVRUIgX54Go+8iyLZcwo2Qj1J9R+ZDmTfIGinhutyiFXpQITPUJ9+OkZMWjY/4j982dpdpz743vv2xNYGVoHPmWO11T5opZHhnPj4KHPSsHE8XTqB7UQv3sozlWSRLML9LdLzVm9FUnZMDVV9iZVy+LxQOwGElOdMz+BSQ94K6N/iQ2FusfM+2X0/BNq0Qej78W7VHUaAWIOO2I00dV+OWusKh9rYQrRIabfUu0DO4MVZNxmKjnMMDnKgwRFBT0b7IInWzEtNg1+N3qzmCSv1hv+o7Dmkc7ZEna3wnpokSigOi3rJtbKOV/QFL74TfpqTpWZeII1bhgn27NIuthe/5dhGUjzDlZGIpM0kjiLNv0PbpKp+ekmOItR8t1NHyZ8HLdwROgfLFZAuS0xAVEqYvhlyyqUdwOcjqYoGXgKC324/dSl/HsPCyTyttrSfsRxwR+e8zGm66c0R4xKdBNc3+lxcGtAT2J+VoJkaTcHOTxT+BYRUpglj+kYqtdc5PHGGS+7CAlPGMAdZpUnVqT3lAkhHehQJNqLq9NBXyDOfPE/h3Z+O3/7qHv7rmlL1TyiXPPk2BzyD7zJbfenmQiNuFyH4x1ERfXW8mqMg9R2Mi414YJ6peczxGsjDXInOf3XEzYAkwg6z3YzHCcIcDAiiHEjmKyeqRQBho1qULQKOeOnzhFXc/Ye+f+JDUvV4jYicDDKMdV8C/pW/Xj760C+gsReFVs/3QIEStJkojHlmDbxW0JHL7bRydOzSa0v0/vDJWiiiv4/EEb4duIlNSwXctPCLsle88YrHN+vQzU98QvQddY1a1RDxUjQfXpsBRzpytEaw2dttd6YVc1ijo5UdUOHljV6urUTZEu+BboUiU4r+KDCZPVUoMjEbilGl+qCrb/3WRkRxgPVf3tiqTRb7WTvF1l3TGFD0d1lSIdn6PZXMsgNguCFQyX6aSnXTtdCYeumcwvGHJkCtqLDR5hTqfn2MtR83LnhyRmxcn9SZW5fm+ryn9AV+3LRDYyd9Iu/7HTU1XfYJx4bne3LG9AK35euoLjKfkqfMZmN8uR7ZlahhKQKKKlAwEsUoIq8RCwsZ8DkWLp0wTwn5u4ziljIxmn9ekB/R5U6C+aN/LcpSSkybnnZzu5Y3owUAWYUgbPKXZ7KEyqMvEe83BEgtNKelZI9L5YT90gYVoDcusr9XgcAS1lxHvhiNYH8oD8SsmlSqLd2GjowfVOEQKsH7XXyfa+fySb4+37jTo3b6hiV2hOooIlLb/U54pEYP6GvQbzdl0UaHDiXVUG5yaR0cIJta4TknRHmbTO3ME+mm7NuqLbFXe2RKZ9SUHA/pLiou/W3+pazrfJMEYGNzcYwR2BPNlbRtbPhNcRcEsIecSjQKcBmGJ0Mhi07rKLJRFinU5EkEk3bhvsNdCEgEiSSlfgW6G2wC8R72c+4OY12w+DoRhOPoS5wdd681rOrFa0/74/WgHabkYZOkDYnknDWE+LS2mRGKkuPy9XnRSS7cyUMvB/+WfOVstpTdIqjPkLdioO/Y53oGS0LEAimF7EVzRWjdwcBqcPDTS+sb0g6LqD3lLtCNoKsV0E0Rl3SBM9kFBym2eHxEatnO9PQ4g1W1ZHHRWfKr5HKTh/ps0vsoiAOYOxdcgMixZnlwgcNVLc6PuiPn76cWUWAgr+BKO6Gjj/cwaJTqs8u06nHyUk3LL6cG403ZwNp3xrQPee/ZGfBi+2mhYCRWxvCf4TqIIF3TpvBUWL059/BOFI5COAyNBhKRcPqxTvt3XCqjQfhqYYGkHmOByuIeokuY21G6/8Ih+ZhyBYrYdzJPqFinKpd5v58J0hKmUKM/Di14ehL0tFOQPF1bE7ELUa4OqPtpoKf4+T1aUbhx+sFDvqlGsKpUszobd8NpFWw+K1cKTYHuhEwoS8Jukq3fj4tOKbRxNvO2e5m/bQ+cGzJhTSqJgwAVH7UgKxhI/YDU43UC+EY82obZ16bBAYkg2L35isSFdyXJhRT5bQ1e8YaPN9SxTSpDomPklbbwF4mfMoEvQw5guUks8wA2eYAe/Fl//hJPEQeyEWIWOrgDT2R5WVZFtTY9JG8kIexcReiaCvb02tNzRXbflwYpZpnMOaCXw25qFOo8Qqmoh2Ig+eSxJw24A91lnW+j2kruuUGTupEGfgwo72QvvXPxilbMvxGX9yTne+zbdEeU1PSdA74ho2NZbtsK7Kf+pfWZZsi3yycsNR1eDeOLfLxDCYzJgu67RpYYgAF4gR06hpghH2swTNyVjkSjwRxxYRaV3S6WzoNOW5EdAnJDM8262eyVVkgpkqlxLWNvA+B1NHzXOx2Q7dPDqeqak9oEl/wnCmoPdaRIZoqN6VvXwVyusw1G1iU/9R5G7vhEWUtCLyCBhvxY+9lxMc5MGEpLKZXKXFFrzozzbYd41qX797gO6wN7op94boRbSaZPYpM+wL7KUu5EmxXY7j03aLxlhGqKiqURQFY0CY0SiOJEiwHtnKFJIF8UFZL9lHujCVsz286U1W71wfKAGejm0OCmku9rvPE+jxzoIlA5Ir5TOeYXjsVuDXqQ0ZUp1xobqe0BJbXr9qlj7Rct7RG5IPOsCc1CIR6r6M77MwXvfOfDfMHjP1OE1JoAhdcc/c5hwiRrbHGXljTXq4/Iv1Zg3srD9C0WMPdHOcSFw4OLM+ziRg08YusauUpSiIbU3vIjni8Jt6ayl0H/vrzu8MazlJWdXnjRmb+S5eHVzcmW1ObT6rzyJ1nejuTOFT+8Jo3mAMGHDSi+jsmUg9SYtE8BoUE7LyF4Nc4a0kG/YjzwhozFOOAaGJM277pVh3olyxcsxCrzBZcIv2dctCnCi9xxBsevhpWZvqjfltM57AijRn7SpUn5Nv/Gl5cZ13cl6Tt42AJCl6WGjAb/eX7LgNWQfRGGRfdIe4TCGATCWFNo9TKw8vPZbzvmqOp7AU4tjGonI9sddUgqHOHtkUjJg6t9jhj4YBfJ7E6L8UOVIAfgeASrtLzebn/t/xqfB2KOIHTN45T4aCPSYaKu8jd0v6pvr+6r7ajbrnKbxCElI/3I27fu2Gw9ycN5LfBWoh5QO04E/oe9e0Vs9BKsaxnpMMpewA5RVbP7FXKTv6GgZF1tNrhnm9WovMNht6dgXODLnDpHgUZ/lXsmrOSD/Ypz7u0XMcZ3T/3HBMdG7nFVwuqHSoYpRrtKxOjohg1L8ngQeD46uqWAGsRHMGDx4Qe/De6Regrs2BmvxhQHvIAN8pFEFQgux9yWxHLdvZhUALpWmS+WDYG6KCsHKIJ/nkfb5+ICBFEH/jHjtAeVCwkUZY0uqo5AfFEsnaEFgjB64UaDP7W0zbVjcRD+GRcZXSnOz3mFc6VAm8TpnEUFvZdUA4r1DRBCRoRGboglSjJJw6iSe8gUhejwI6AS9fVJ14CV1SGouHO39ftVQEZEpYqefzSsnEeSkyTw5K4hxWVv4bv3+8Cb1OW60kGUFDTlc3ESxtYrub6EMPXkLYzHtILuX29i2lA2E8YsHzQlZxUheMItbMJRV/mevQGYJJCPHtjLGBuOj+3SCLR1WpS5VrVztCVT0Up+Fm2Zoei41X9iMg56jv1ziArTBePTtUpx217avd5MrH3U6Ida0ol4CiWwmwOBm+kLCCcFinyz41JfeUAPjSSlbfRkZMiJ/O5xIfGAoi9fdCkXAi/MYfnzGqUsh3YYb6BtznxoMlLdyvqG0GB5YDC9JQaAHxnhYp0ddOOX4+rDzWe8SwB8FenHs55EsoqCvftuLfH6ZnfsQPfa23tScHir0WhCtDXTCo66tpDQ69WYFJvkK9cCC9rnFJ7x/CQ2CGjRPTSly8H/yemdzw4BUp5xpVqnQgNk2N/Rec8IAI/m8hbBPQSoH4Emi6CH80bPP2BOkxEoys5xZxJJ12zEUdV48fqrDj89MKfelre97Ja2P5tVb/p313NyGrdzEsm1S7wZyyzUMqE4i4MOMvt7eVVHDCiYXw2uqXGzoNi2tzZY7xX1gQrrVg2TZt73F+vP28jzBKU2LMF36oQYVQGRSkX/YbtYg14Z21NtInsVNy2mu+Z12RCNyPSz4ouYk6BASSCCA91VCxrNxkKhEuyBCo0TCpShj8BhLaAL36R6LyMG3U0XDQhMRTdiFtH/eqiJgAet9nBDBDgMxxxgcV9yLo6LQCIcDxXdEzQDNH0MLYdo85dKDcMJP5cHmvSwytXIkdoeBZBhch8YfPYjUgeRcUVG7b3jeqRXgc8EhgSr6HE3JhXsY2Nbs1oYYgndchYPrZTF4VOJ58Akdnz4zkXw5F6wQIeTZ1rCAsyi1/O4P1wG0nTLHH9H++beyQiQ0bZ2Lx8AqMRnho/nyDSV9c7yhhDZ9qlJegMFmFe4Msz7ZkwXGnVqynq70xt7S9iVHw9XHuyjn5j0zK684HCgpNoxxFzA2XQlzH87DhOw7szygUue51AyPQnP+QALr2oOtoqicI7kZR6wlAjhVb5pLwf74uhO79WJ7vzZ4WzlVY3MWh0W//6si5VZM2mLv+Gket7/eFNfXrRRPzPN2SmeM+BpndMpawXpDuXezz/iTS0WR7aj5YRcgUTqnWMQhbVzOGp9lNEHIDGZpE359v17QCsjCI/2oNzInfiA94nuCPKjRlTc1MBhlAPHbaVM3NDtHsA8hL88BpMsJHmErG815DMqr2gpysM5tAEZt0YieRWyI451qa2FvpTEqmbadOpIYvXJ93oJwHGpPv5jVSt2pZj449qszmPHuq1XLJ7kFWKkrbvQ4iIzn9jrEFlHvTVLPfxZ0BZuJA/QX4GOuJsrrRTdDpF/2ph8F+2Xg48ImJRxwP2IYJVhGJN/dqzk7CzWHGBz/Dz3J68IQSe3/H+/KcYloJwAuLJaqmDIgZ5N9kjJCzhhEDqMJdgfOEaM7Hl1EsvGaRUrsuoOMJnNTK2nVvJEzhyI8MB3XV4znx6wyo3VtCZePYltbPe8D5gvWox3763L2evKi6lK/YdHy/nAhquiinplEbd4WVxQyu9/EF/GTttastGzwl2Zvz06C/ObIuw7UM2FULUa7+D8L1fmPlTvRGnRs7xb1i71Tu23A1N0Ebzp1QmNfZmH2Y4n7gw7D2Eytp+ldI0dfKS6k1afwTCf6cOvlTKA2wC0b1Xy2j8arjUkzxHnXzfx7OLJFEw0mtlpTWemhE0bXOptqTULwx9LReKsOcjkAmemAlITXMAEzU9i6AWrV5FAIxJUHZeamH3+UNPgjYIcCTO6F5sZlwCNRGM+8UQzVsu/eJ5WTrR+hJsFBMOvG6p+6PJTNfZNNGFQBpuMDg3GSqdODSN4wqUrw02CwG5EAZPzgT6iIC1O3uqFc9ywPA3A8xUxDLQ0TvFZJsxtRI8CRoSK3ukBbJO1sX0fQfuO26ecFG7uyfK8XEpS469llYvD/B7r6Ecpl4TsjA/8Y/q8udb2x9WHR9nDA/lz3HZZHMXDGONg2Q/qPrB0E1iyHDuW5IBNYOqk0xL7XUfiOWhIv/hk8N1G7isnUpD8FBGEE3qObw9D1VPv2FHE4zOLs/xSKZpF7anXVaItBU1KZut/lbVYKm3Dr8TlBStZAdO76JY8Va0jDUoRpJre4rKkJ17m8YP5zTZXnKdXFfljxB+K957IZeKXPcxezQvj8rVPqhmo6EJqnW4N10MiVZ88R0fJKnJ2aYbX060Nyt8M86lE5zY0pOOxmNNRQ2ZaFgFU78ROxOxkcIV7YRPesn6nZe/VVuO1ivUNx8+jjwMshnDDLZ14r8Gm05yyG96wcmSBrJskrSc7hrDQ== - ssl.key: AgC6lshf5F5Ba7S9hrIj/c3BIiDsaFE10ipEGjC2wY9aID8unUAqfT/ZFGe92PsdavubO9WrwxRWT6WUj32ZimUjNKXJYoMg4c3j85B69gS1TdNDSyJySLIpK8esnto267GHfOW61krRB1aRCPM+2KZRayR1yRNFbMF3vL3wxPptQLgL9wXBPqvq2jcahaxtrfs9YMDRf0lJIFPmVexJZoettW2RyxfIebp5jLWnU/l5gl9RlNcFOfLVxroePEGwwwELNPoQuwAzyqXEVtOI6vgm4Zhpi9RUmU78AlS7nmlZ9kZNFog+RD8f1WOkIvzlXRzsfl6rGUx1NsuMp7Bgg9YRyidEQc/6L2nm+PWd19muZrU630GIqZhdtXILiz+KHWJiJnJk95pc8DZdU+cqfi9G3fm96G2pXi3XqoESo0FHfTWdniV9UwManEJmpJn8vEM46TvO7QKcB1qjMD5oQndaDTIC8Ehg2WB8Lr1OtSpYyFTXzCJ1YMWd2GPDjtTKP5ZaAuHZ4tunswEgb2dOP/WnUyvTwLAoWZVo9sZbE+UNarNSCaSr4noJuPtdMAqpiwAB8NzmCoR0IiFTviS4QTozdyvthKb7DvA37JPVRgWGCnoyIyFlRj7gsMASBkkSvDK/5P1q57aMJ7z7YoffsakaSVhdqD1o0zTT1YebSMDwGqC58Yc2QXzVi0qqwreUXy66ijoacI1ZxbmMemQNHcfz2grSLVFZ0SKsIzUe1Pn6DZJtWfGw77RnBkyLNEdcv3WJOVMnDWxP6OkW9rPWO50oRYhRVyuGdh+rA6dw6PpHEL0Pw0C0MA2xyfhTDiyOq2iNnONj7aRa0y7I1zZcamomW+/h67LR12WDHe8svD5xPrgB2xXeIjEZAtgqmjUtSox65mJF2ml2Pjgtw7H/UzMmL8wYHl2x/0rmbDEmGq542pPRFUK3ycd6kPnP6tuYRs2YEca1f+6k1vjib+3f/X6rzgVZkmJWjLfObGy/8lvQuFZs1m1c5li9xlyiNsZpFBafgzbdbFdYnBuKRULQ1frN3tG8kcTMRgdDsFJ7LJhMpmTOjClfxos0htJ7/hrNckQLa3HAa1x2tIlJRcvXaOFv3JyZjjoA/CD9DoHo0QOSpRVAWFxqi+hk1S/UudmQ56le7NjapYCLMuPkXqaHcQp/vpmj/AGfZFsMpu6KIztl1iGzWXyao5ar0mpBZKNIlA5ylDuwewLRV2/vOBzeFrGlNA/AqXi+xKRteKwnPbBPylblyFUSfeapVCxHbHgNnss7IXYYde04YEBj2Ve4hcKotXh4fxKeg6a2LQW6DBsDaedK+1VzfUeKKKmgwLgZyH3pUAiF1+j6iUmoQbxlobta/4xwpel8kkTmvuqApkbpXRGf+WZTWuydEQaWOgndKDEl5pEZTV6KvqeLqtVr0C8788aKk57MvQpGSTz8cTWSHjDi8LrNIqTToouZCP0rylS4ZZ4zXLTv4AkmHs3ZpFsbVoLPhFNPy6eg7a4GyuQRa5eM53l/fd2CeJf13wArTBNf+VtwHw0MupUrDg8PZeDtXe9jmk/5VmdOu5zi+U/k3aBfTWOgAhy4mwocrs+IzaOg5YU6EoVvrWGCOfB8N2ocFrBPMbvwqD+Q8z2xrAFCpan7W23dn9IBU693p2rlx+KGLovQ6BHo51v6i4oEr1eaACFvAZZJOL3ka/1lXphEZW5E4W51KBwAqMBw+rbLFWelolD1gE8UQVG0CTZhTP03MewhRsvCgSWZmrEoVy0xRRkiTC7BkjOsqsidP0yaFNlNLDboBp8otdszwK9edCeFOfdAcqKZpUbwZgIXCm7v6KDm8WiuEHeTzAiR5Ef6+QLuq9p5ZyUCg0fgy5R+KSFwioZg6+KtXFBJKbvw6dviCwYaWlqrzC319rm9wUdOxEFrkFt0yXPmkxm4dSxPh0A3Sg7a4r+6DCsEJjjJLbaVeLL5tNL69gIPpFc3LddH/E/lAIl0xbLKzW/RkxGM1kyygH/DcvZKN/XOk+qB3QB4K//rIWigadA1XCy7fGdA2w6rKKJfvo6yEtIjKG7i0tL/oUsmzqbOKd+Vn+s22rIduhOQNx3sY9fL9cSQFsrrjIAvqfcADze6reVAjdhmmtOe3P4uywegn8JBDRFJa/fWmOxpqIRHpY2fEVRti1366qJequpyilxPdg7h5J9UePgtjvTGOVZOe+mxX5f3kOyhpHz1w4fH4rVF9iyEtqAcVRSDl8cq4otJkeglief3SLzWtLe8DLkFHBBCdDeYpQ6qUhRD8Fsm+W/3Llg3+c9XdnIfn+JVyAoiO2QHTIF+eV20PsFu4vOT4iWebhJcv6AYYUpbKrBOIYudW+RbFCPx6EX83CbT/BANeonHqjVfdhbN5KtLQMfQimZlw7ORVFyb6dxYOO5OetCNQPk4S0GqZKqZjP9UycPzWes1fkjCxQrxbnNalYI4POTYVc59Ie1WpcEpJY88WdZ3TV8OWHFctr0KpBmXWvMUnu/d4MCGpjPGvdPIfXyP2OdN5Vawma1oqyz8DlFhRT8HSDQTfAF7+/bj9tXnPy1e2EAt6D0ZLD2hgiKnTOx/DqriigSlJiZAI12ULCmpH97npuXRFyzTE5JC0GdC232wxpQgS0gywbkFmkya/ues+xn5PkHWYqOJbFh722FhvgJPTC85weIJVUsPO3NPsnTby1tzGnrT25PjnCVdHizis4C1LzM6VBZ28/xWu4Y6ScM+lD6b1Mcjqr1p2dYcdsUYkCVZ3nGL1Vm4wsk7+54SQrPv3ZVLIsKUg1qbfgkNfcETmKyAQLtrUaGAAE6skOiU2qxJoINa6GOgRgVLCOtKq0rLtehNchLvjePWkt+dkaGQHhQNzaS9MDPtvGiiYKEcBucQSFwOq32trQbtq/AoGZ2ujgu+Y2Wyjw1gnHU8kosgLsPIIdvXPg== - template: - metadata: - name: config-bundle-secret - namespace: quay diff --git a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/registry.yaml b/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/registry.yaml deleted file mode 100644 index d81f5a5..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/quay-registry-operator/registry.yaml +++ /dev/null @@ -1,27 +0,0 @@ -apiVersion: quay.redhat.com/v1 -kind: QuayRegistry -metadata: - name: registry - annotations: - argocd.argoproj.io/sync-wave: "10" -spec: - components: - - managed: false - kind: tls - - managed: false - kind: horizontalpodautoscaler - - kind: route - managed: false - - kind: postgres - managed: true - - kind: clair - managed: true - - kind: redis - managed: true - - kind: mirror - managed: true - - kind: monitoring - managed: false - - kind: objectstorage - managed: false - configBundleSecret: config-bundle-secret diff --git a/cluster-config/clusters/overlays/local.hub/components/rhtas-operator/kustomization.yaml b/cluster-config/clusters/overlays/local.hub/components/rhtas-operator/kustomization.yaml deleted file mode 100644 index 8860d2c..0000000 --- a/cluster-config/clusters/overlays/local.hub/components/rhtas-operator/kustomization.yaml +++ /dev/null @@ -1,14 +0,0 @@ -resources: -- ../../../../../components/rhtas-operator/operator/base -- ../../../../../components/rhtas-operator/instance/base - -patches: -- patch: | - - op: replace - path: /spec/fulcio/config/OIDCIssuers/0/Issuer - value: https://sso.ocplab.com/realms/ocplab - - op: replace - path: /spec/fulcio/config/OIDCIssuers/0/IssuerURL - value: https://sso.ocplab.com/realms/ocplab - target: - kind: Securesign diff --git a/cluster-config/clusters/overlays/rhdp/components/openshift-monitoring/base/cluster-monitoring-config-cm.yaml b/cluster-config/clusters/overlays/rhdp/components/openshift-monitoring/base/cluster-monitoring-config-cm.yaml deleted file mode 100644 index 0d76888..0000000 --- a/cluster-config/clusters/overlays/rhdp/components/openshift-monitoring/base/cluster-monitoring-config-cm.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: cluster-monitoring-config - namespace: openshift-monitoring -data: - config.yaml: | - enableUserWorkload: true diff --git a/cluster-config/clusters/overlays/rhdp/components/openshift-monitoring/base/kustomization.yaml b/cluster-config/clusters/overlays/rhdp/components/openshift-monitoring/base/kustomization.yaml deleted file mode 100644 index 8db0fd3..0000000 --- a/cluster-config/clusters/overlays/rhdp/components/openshift-monitoring/base/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: -- cluster-monitoring-config-cm.yaml diff --git a/cluster-config/components/3scale-operator/base/apimanager.yaml b/cluster-config/components/3scale-operator/base/apimanager.yaml deleted file mode 100644 index 9f91862..0000000 --- a/cluster-config/components/3scale-operator/base/apimanager.yaml +++ /dev/null @@ -1,38 +0,0 @@ -apiVersion: apps.3scale.net/v1alpha1 -kind: APIManager -metadata: - name: apimanager - namespace: 3scale -spec: - resourceRequirementsEnabled: true - wildcardDomain: 3scale.apps.home.ocplab.com - system: - database: - postgresql: - persistentVolumeClaim: - storageClassName: iscsi - redisPersistentVolumeClaim: - storageClassName: iscsi - fileStorage: - persistentVolumeClaim: - storageClassName: managed-nfs-storage - redisResources: - requests: - cpu: 150m - memory: 256Mi - limits: - cpu: 500m - memory: 4Gi - backend: - redisPersistentVolumeClaim: - storageClassName: iscsi - redisResources: - limits: - cpu: 500m - memory: 4Gi - requests: - cpu: 150m - memory: 256Mi - fileStorage: - persistentVolumeClaim: - storageClassName: managed-nfs-storage diff --git a/cluster-config/components/acs-config/base/declarative-config.yaml b/cluster-config/components/acs-config/base/declarative-config.yaml deleted file mode 100644 index 2c67039..0000000 --- a/cluster-config/components/acs-config/base/declarative-config.yaml +++ /dev/null @@ -1,125 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: declarative-configurations - namespace: stackrox -spec: - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: declarative-configurations - creationPolicy: Owner - template: - data: - keycloak-auth.yaml: | - name: keycloak - minimumRole: None - uiEndpoint: central-stackrox.${SUB_DOMAIN}:443 - oidc: - issuer: https://keycloak.${SUB_DOMAIN}/realms/openshift - mode: auto - clientID: acs - clientSecret: {{ .keycloak_client_secret }} - disableOfflineAccessScope: true - groups: - - key: email - value: admin@ocplab.com - role: Admin - - key: email - value: clusteradmin@workshop-noreply.com - role: Admin - - key: email - value: gnunn+user1@redhat.com - role: Product Catalog Admins - openshift-auth.yaml: | - name: openshift - uiEndpoint: central-stackrox.${SUB_DOMAIN}:443 - openshift: - enable: true - minimumRole: None - groups: - - key: name - value: admin - role: Admin - - key: groups - value: product-catalog-admins - role: Product Catalog Admins - product-catalog-access-scope.yaml: | - name: product-catalog-admins - description: Access rights for users that can manage Product Catalog namespaces - rules: - includedNamespaces: - - clusterName: home - namespaceName: product-catalog-dev - - clusterName: home - namespaceName: product-catalog-test - - clusterName: home - namespaceName: product-catalog-monitor - - clusterName: home - namespaceName: product-catalog-prod - - clusterName: home - namespaceName: product-catalog-cicd - - clusterName: home - namespaceName: product-catalog-gitops - namespace-admin-permission-set.yaml: | - name: Namespace Administrator - description: A user that is an administrator of one or namespaces across various clusters - resources: - - resource: Access - access: NO_ACCESS - - resource: Administration - access: NO_ACCESS - - resource: Alert - access: READ_ACCESS - - resource: CVE - access: READ_ACCESS - - resource: Cluster - access: READ_ACCESS - - resource: Compliance - access: READ_ACCESS - - resource: Deployment - access: READ_ACCESS - - resource: DeploymentExtension - access: READ_ACCESS - - resource: Detection - access: READ_ACCESS - - resource: Image - access: READ_ACCESS - - resource: Integration - access: NO_ACCESS - - resource: K8sRole - access: READ_ACCESS - - resource: K8sRoleBinding - access: READ_ACCESS - - resource: K8sSubject - access: READ_ACCESS - - resource: Namespace - access: READ_ACCESS - - resource: NetworkGraph - access: READ_ACCESS - - resource: NetworkPolicy - access: READ_ACCESS - - resource: Node - access: READ_ACCESS - - resource: Secret - access: READ_ACCESS - - resource: ServiceAccount - access: READ_ACCESS - - resource: WatchedImage - access: READ_WRITE_ACCESS - - resource: VulnerabilityManagementApprovals - access: READ_ACCESS - - resource: VulnerabilityManagementRequests - access: READ_WRITE_ACCESS - product-catalog-roles.yaml: | - name: Product Catalog Admins - description: Administrators of product catalog namespaces - permissionSet: Namespace Administrator - accessScope: product-catalog-admins - globalAccess: NO_ACCESS - data: - - secretKey: keycloak_client_secret - remoteRef: - key: ACS_KEYCLOAK_CLIENT_SECRET diff --git a/cluster-config/components/acs-config/base/kustomization.yaml b/cluster-config/components/acs-config/base/kustomization.yaml deleted file mode 100644 index 26cd66d..0000000 --- a/cluster-config/components/acs-config/base/kustomization.yaml +++ /dev/null @@ -1,2 +0,0 @@ -resources: -- declarative-config.yaml diff --git a/cluster-config/components/acs-operator/overlays/aggregate/admission-control-tls-push-secret.yaml b/cluster-config/components/acs-operator/overlays/aggregate/admission-control-tls-push-secret.yaml deleted file mode 100644 index 76834cf..0000000 --- a/cluster-config/components/acs-operator/overlays/aggregate/admission-control-tls-push-secret.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: external-secrets.io/v1alpha1 -kind: PushSecret -metadata: - name: admission-tls - namespace: stackrox -spec: - refreshInterval: 10s - secretStoreRefs: - - name: doppler-push-secret - kind: ClusterSecretStore - selector: - secret: - name: admission-control-tls - data: - - match: - secretKey: ca.pem - remoteRef: - remoteKey: ACS_ADMISSION_CONTROL_TLS_CA - - match: - secretKey: admission-control-cert.pem - remoteRef: - remoteKey: ACS_ADMISSION_CONTROL_TLS_CERT - - match: - secretKey: admission-control-key.pem - remoteRef: - remoteKey: ACS_ADMISSION_CONTROL_TLS_KEY diff --git a/cluster-config/components/acs-operator/overlays/aggregate/collector-tls-push-secret.yaml b/cluster-config/components/acs-operator/overlays/aggregate/collector-tls-push-secret.yaml deleted file mode 100644 index 7a49e74..0000000 --- a/cluster-config/components/acs-operator/overlays/aggregate/collector-tls-push-secret.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: external-secrets.io/v1alpha1 -kind: PushSecret -metadata: - name: collector-tls - namespace: stackrox -spec: - refreshInterval: 10s - secretStoreRefs: - - name: doppler-push-secret - kind: ClusterSecretStore - selector: - secret: - name: collector-tls - data: - - match: - secretKey: ca.pem - remoteRef: - remoteKey: ACS_COLLECTOR_TLS_CA - - match: - secretKey: collector-cert.pem - remoteRef: - remoteKey: ACS_COLLECTOR_TLS_CERT - - match: - secretKey: collector-key.pem - remoteRef: - remoteKey: ACS_COLLECTOR_TLS_KEY diff --git a/cluster-config/components/acs-operator/overlays/aggregate/kustomization.yaml b/cluster-config/components/acs-operator/overlays/aggregate/kustomization.yaml deleted file mode 100644 index cf2c2d8..0000000 --- a/cluster-config/components/acs-operator/overlays/aggregate/kustomization.yaml +++ /dev/null @@ -1,31 +0,0 @@ -commonAnnotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - -resources: - - github.com/redhat-cop/gitops-catalog/advanced-cluster-security-operator/aggregate/default - - admission-control-tls-push-secret.yaml - - collector-tls-push-secret.yaml - - sensor-tls-push-secret.yaml - -patches: - - patch: |- - - op: replace - path: /spec/channel - value: 'rhacs-4.7' - target: - kind: Subscription - name: rhacs-operator - - patch: |- - - op: replace - path: /spec/perNode/collector/collection - value: EBPF - target: - kind: SecuredCluster - - patch: |- - - op: add - path: /spec/central/declarativeConfiguration - value: - secrets: - - name: declarative-configurations - target: - kind: Central diff --git a/cluster-config/components/acs-operator/overlays/aggregate/sensor-tls-push-secret.yaml b/cluster-config/components/acs-operator/overlays/aggregate/sensor-tls-push-secret.yaml deleted file mode 100644 index 119a5b2..0000000 --- a/cluster-config/components/acs-operator/overlays/aggregate/sensor-tls-push-secret.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: external-secrets.io/v1alpha1 -kind: PushSecret -metadata: - name: sensor-tls - namespace: stackrox -spec: - refreshInterval: 10s - secretStoreRefs: - - name: doppler-push-secret - kind: ClusterSecretStore - selector: - secret: - name: sensor-tls - data: - - match: - secretKey: ca.pem - remoteRef: - remoteKey: ACS_SENSOR_TLS_CA - - match: - secretKey: sensor-cert.pem - remoteRef: - remoteKey: ACS_SENSOR_TLS_CERT - - match: - secretKey: sensor-key.pem - remoteRef: - remoteKey: ACS_SENSOR_TLS_KEY diff --git a/cluster-config/components/acs-operator/overlays/secured-cluster/acs-admission-control-tls-secret.yaml b/cluster-config/components/acs-operator/overlays/secured-cluster/acs-admission-control-tls-secret.yaml deleted file mode 100644 index e351a8e..0000000 --- a/cluster-config/components/acs-operator/overlays/secured-cluster/acs-admission-control-tls-secret.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - annotations: - argocd.argoproj.io/sync-wave: "0" - name: admission-control-tls - namespace: stackrox-secured-cluster-service -spec: - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: admission-control-tls - creationPolicy: Owner - data: - - secretKey: ca.pem - remoteRef: - key: ACS_ADMISSION_CONTROL_TLS_CA - - secretKey: admission-control-cert.pem - remoteRef: - key: ACS_ADMISSION_CONTROL_TLS_CERT - - secretKey: admission-control-key.pem - remoteRef: - key: ACS_ADMISSION_CONTROL_TLS_KEY diff --git a/cluster-config/components/acs-operator/overlays/secured-cluster/acs-collector-tls-secret.yaml b/cluster-config/components/acs-operator/overlays/secured-cluster/acs-collector-tls-secret.yaml deleted file mode 100644 index 8796b56..0000000 --- a/cluster-config/components/acs-operator/overlays/secured-cluster/acs-collector-tls-secret.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - annotations: - argocd.argoproj.io/sync-wave: "0" - name: collector-tls - namespace: stackrox-secured-cluster-service -spec: - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: collector-tls - creationPolicy: Owner - data: - - secretKey: ca.pem - remoteRef: - key: ACS_COLLECTOR_TLS_CA - - secretKey: collector-cert.pem - remoteRef: - key: ACS_COLLECTOR_TLS_CERT - - secretKey: collector-key.pem - remoteRef: - key: ACS_COLLECTOR_TLS_KEY diff --git a/cluster-config/components/acs-operator/overlays/secured-cluster/acs-sensor-tls-secret.yaml b/cluster-config/components/acs-operator/overlays/secured-cluster/acs-sensor-tls-secret.yaml deleted file mode 100644 index cff9e1f..0000000 --- a/cluster-config/components/acs-operator/overlays/secured-cluster/acs-sensor-tls-secret.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - annotations: - argocd.argoproj.io/sync-wave: "0" - name: sensor-tls - namespace: stackrox-secured-cluster-service -spec: - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: sensor-tls - creationPolicy: Owner - data: - - secretKey: ca.pem - remoteRef: - key: ACS_SENSOR_TLS_CA - - secretKey: sensor-cert.pem - remoteRef: - key: ACS_SENSOR_TLS_CERT - - secretKey: sensor-key.pem - remoteRef: - key: ACS_SENSOR_TLS_KEY diff --git a/cluster-config/components/acs-operator/overlays/secured-cluster/kustomization.yaml b/cluster-config/components/acs-operator/overlays/secured-cluster/kustomization.yaml deleted file mode 100644 index df58d33..0000000 --- a/cluster-config/components/acs-operator/overlays/secured-cluster/kustomization.yaml +++ /dev/null @@ -1,19 +0,0 @@ -# commonAnnotations: -# argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - -resources: -- github.com/redhat-cop/gitops-catalog/advanced-cluster-security-operator/operator/overlays/latest -- namespace.yaml -- acs-admission-control-tls-secret.yaml -- acs-sensor-tls-secret.yaml -- acs-collector-tls-secret.yaml -- secured-cluster.yaml - -patches: - - patch: |- - - op: replace - path: /spec/channel - value: 'rhacs-4.7' - target: - kind: Subscription - name: rhacs-operator diff --git a/cluster-config/components/acs-operator/overlays/secured-cluster/namespace.yaml b/cluster-config/components/acs-operator/overlays/secured-cluster/namespace.yaml deleted file mode 100644 index 7037f09..0000000 --- a/cluster-config/components/acs-operator/overlays/secured-cluster/namespace.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - annotations: - argocd.argoproj.io/sync-wave: "0" - name: stackrox-secured-cluster-service diff --git a/cluster-config/components/acs-operator/overlays/secured-cluster/secured-cluster.yaml b/cluster-config/components/acs-operator/overlays/secured-cluster/secured-cluster.yaml deleted file mode 100644 index 7fa2321..0000000 --- a/cluster-config/components/acs-operator/overlays/secured-cluster/secured-cluster.yaml +++ /dev/null @@ -1,18 +0,0 @@ -kind: SecuredCluster -apiVersion: platform.stackrox.io/v1alpha1 -metadata: - annotations: - argocd.argoproj.io/sync-wave: "5" - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - name: stackrox-secured-cluster-services - namespace: stackrox-secured-cluster-service -spec: - clusterName: ${CLUSTER_NAME} - centralEndpoint: central-stackrox.apps.hub.ocplab.com:443 - admissionControl: - contactImageScanners: ScanIfMissing - listenOnCreates: true - listenOnUpdates: true - timeoutSeconds: 6 - scannerV4: - scannerComponent: Default diff --git a/cluster-config/components/acs-operator/overlays/sso/create-sso-auth-provider-job.yaml b/cluster-config/components/acs-operator/overlays/sso/create-sso-auth-provider-job.yaml deleted file mode 100644 index 6ebfb2f..0000000 --- a/cluster-config/components/acs-operator/overlays/sso/create-sso-auth-provider-job.yaml +++ /dev/null @@ -1,79 +0,0 @@ -apiVersion: batch/v1 -kind: Job -metadata: - annotations: - argocd.argoproj.io/sync-wave: "10" - name: create-sso-auth-provider - namespace: stackrox -spec: - template: - spec: - containers: - - image: image-registry.openshift-image-registry.svc:5000/openshift/cli:latest - env: - - name: CLIENT_SECRET - valueFrom: - secretKeyRef: - name: sso-secret - key: client-secret - - name: PASSWORD - valueFrom: - secretKeyRef: - name: central-htpasswd - key: password - - name: ISSUER - value: https://sso-sso.apps.home.ocplab.com/auth/realms/openshift - - name: DEFAULT_ROLE - value: Admin - command: - - /bin/bash - - -c - - | - #!/usr/bin/env bash - - # Wait for central to be ready - attempt_counter=0 - max_attempts=20 - echo "Waiting for central to be available..." - until $(curl -k --output /dev/null --silent --head --fail https://central); do - if [ ${attempt_counter} -eq ${max_attempts} ];then - echo "Max attempts reached" - exit 1 - fi - printf '.' - attempt_counter=$(($attempt_counter+1)) - echo "Made attempt $attempt_counter, waiting..." - sleep 5 - done - - echo "Configuring SSO Provider" - - echo "Test if SSO Provider already exists" - - response=$(curl -k -u "admin:$PASSWORD" https://central/v1/authProviders?name=OpenShift | python3 -c "import sys, json; print(json.load(sys.stdin)['authProviders'], end = '')") - - if [[ "$response" != "[]" ]] ; then - echo "OpenShift Provider already exists, exiting" - exit 0 - fi - - export DATA='{"name":"OpenShift","type":"oidc","uiEndpoint":"central-stackrox.apps.home.ocplab.com","enabled":true,"config":{"client_id":"stackrox","client_secret":"'${CLIENT_SECRET}'","issuer":"'$ISSUER'","mode":"post"},"validated":true,"extraUiEndpoints":[],"active":true}' - - echo "Posting data: ${DATA}" - - authid=$(curl -k -X POST -u "admin:$PASSWORD" -H "Content-Type: application/json" --data $DATA https://central/v1/authProviders | python3 -c "import sys, json; print(json.load(sys.stdin)['id'], end = '')") - - echo "Authentication Provider created with id ${authid}" - echo "Updating minimum role to Admin" - - export DATA='{"previous_groups":[],"required_groups":[{"props":{"authProviderId":"'${authid}'"},"roleName":"'${DEFAULT_ROLE}'"}]}' - - curl -k -X POST -u "admin:$PASSWORD" -H "Content-Type: application/json" --data $DATA https://central/v1/groupsbatch - - imagePullPolicy: Always - name: create-sso-auth-provider - dnsPolicy: ClusterFirst - restartPolicy: Never - serviceAccount: create-cluster-init - serviceAccountName: create-cluster-init - terminationGracePeriodSeconds: 30 diff --git a/cluster-config/components/acs-operator/overlays/sso/kustomization.yaml b/cluster-config/components/acs-operator/overlays/sso/kustomization.yaml deleted file mode 100644 index 624e72b..0000000 --- a/cluster-config/components/acs-operator/overlays/sso/kustomization.yaml +++ /dev/null @@ -1,18 +0,0 @@ -commonAnnotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - -resources: - - github.com/redhat-cop/gitops-catalog/advanced-cluster-security-operator/operator/overlays/latest - - github.com/redhat-cop/gitops-catalog/advanced-cluster-security-operator/instance/overlays/internal-registry-integration - - sso-sealed-secret.yaml - - create-sso-auth-provider-job.yaml - # Use Andrew's Pipeline to create Stackrox API Tokens in tenant namespaces - - github.com/pittar-gitops/gitops-mono-repo-admins/03-cluster-services/08-advanced-cluster-security/pipelines-and-secrets - -patchesJson6902: - - path: patch-resources.yaml - target: - group: platform.stackrox.io - kind: Central - name: central - version: v1alpha1 diff --git a/cluster-config/components/acs-operator/overlays/sso/patch-resources.yaml b/cluster-config/components/acs-operator/overlays/sso/patch-resources.yaml deleted file mode 100644 index 3044057..0000000 --- a/cluster-config/components/acs-operator/overlays/sso/patch-resources.yaml +++ /dev/null @@ -1,22 +0,0 @@ -- op: add - path: /spec/central/resources - value: - limits: - memory: 2Gi - requests: - cpu: 500m - memory: 512Mi -- op: add - path: /spec/scanner/analyzer/resources - value: - limits: - memory: 1Gi - requests: - cpu: 250m - memory: 500Mi -- op: replace - path: /spec/scanner/analyzer/scaling/autoScaling - value: Disabled -- op: replace - path: /spec/scanner/analyzer/scaling/replicas - value: 2 diff --git a/cluster-config/components/acs-operator/overlays/sso/sso-sealed-secret.yaml b/cluster-config/components/acs-operator/overlays/sso/sso-sealed-secret.yaml deleted file mode 100644 index 9e3e563..0000000 --- a/cluster-config/components/acs-operator/overlays/sso/sso-sealed-secret.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: bitnami.com/v1alpha1 -kind: SealedSecret -metadata: - annotations: - argocd.argoproj.io/sync-wave: "0" - name: sso-secret - namespace: stackrox -spec: - encryptedData: - client-secret: AgCk7m6UEoCoLvvLbUW+lXnYxaZ9Hm520Xg9/h9KMifm9mqFnzfxdlPksgZ0SIyw446ThrpAd/x39K1Azm5tMgQwIn+DaTOaDS3NVrwQWnaTBFph5AJ8DbcAMKFfSZAddCCizPlfkB3kv7zL8EIbj9d59Qbn3/0mu4hgqN0I2kOptQwFXt+kYYChrJ13LwDVJ5/wxPCa1VKUQ/osSX9wrddRBn/UQLPpXtH8loePfjn+9/oMMq49S4oiN9AjNUzuLLQHmg0OmeRtH34lGAkFgWHjNboOUDsmDCb78olGKTDIzNJ/Xz6iFmszZm1bhj7IG/VtcGoxroC/eddp1chGq4M8pMYEQkON6vp1bzP6LY3x6PxLjFg0Yl1EPSMZXyONNWJ9pl4drPsJqnw0QqLQG172ucbpGy2CwiaZ4ZwPtp/JcPJCDVW2nwwJNyNodfS8DgUbTF+cHm3/W0Z5BWi5CQvXBMRF3a9LyIuRoFW9w5XNnqKQP0lP/8NKW1K5LmgpVuJSGNg6JEQyRSDnK7WAnfDReDTTTEoivjFFQ7uUJFP/RDYWiXvSE3hNYse331QO5DCATmyDPm36txFaKtfVy/TdVhU7gV07FHPQju7IqfoI9pkc0pQtFUUYB9nFamuHsvkO4brnAjIYuCl7SJeM8xK37xLO4KgbKm/ldqxb80eUScBH963Lk9+H4zgyJ5Wq04dDdnxWrBedXjY00UBbmJ4CVDoGL/24HHbi118ZFTa3N9AJDss= - template: - metadata: - name: sso-secret - namespace: stackrox - type: Opaque diff --git a/cluster-config/components/acs-tokens/base/README.md b/cluster-config/components/acs-tokens/base/README.md deleted file mode 100644 index 710a592..0000000 --- a/cluster-config/components/acs-tokens/base/README.md +++ /dev/null @@ -1,7 +0,0 @@ -## Not being used at the moment, use at your own risk :) - -Uses a post-sync hook to generate ACS tokens for various namespaces to consume. Useful when there is a need to integrate with ACS for image scanning, etc. - -Namespaces can be passed in a comma-separated list via environment variables. - -based on Andrew Pitt's tekton task here: https://github.com/pittar-gitops/gitops-mono-repo-admins/tree/main/03-cluster-services/08-advanced-cluster-security/pipelines-and-secrets diff --git a/cluster-config/components/acs-tokens/base/kustomization.yaml b/cluster-config/components/acs-tokens/base/kustomization.yaml deleted file mode 100644 index b2459b9..0000000 --- a/cluster-config/components/acs-tokens/base/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ -namespace: stackrox - -resources: - - postsync-create-roxsecrets-sa-rbac.yaml - - postsync-create-roxsecrets-job.yaml - - postsync-roxsecret-namespaces.yaml diff --git a/cluster-config/components/acs-tokens/base/postsync-create-roxsecrets-job.yaml b/cluster-config/components/acs-tokens/base/postsync-create-roxsecrets-job.yaml deleted file mode 100644 index 099a9e6..0000000 --- a/cluster-config/components/acs-tokens/base/postsync-create-roxsecrets-job.yaml +++ /dev/null @@ -1,85 +0,0 @@ -apiVersion: batch/v1 -kind: Job -metadata: - name: postsync-create-roxsecrets-job - namespace: stackrox - annotations: - argocd.argoproj.io/hook: PostSync - argocd.argoproj.io/hook-delete-policy: BeforeHookCreation -spec: - template: - spec: - containers: - - image: quay.io/gnunn/tools:4.10-1 - env: - - name: PASSWORD - valueFrom: - secretKeyRef: - key: password - name: central-htpasswd - envFrom: - - configMapRef: - name: roxsecret-namespaces - command: - - /bin/bash - - -c - - | - # Wait for central to be ready - attempt_counter=0 - max_attempts=20 - echo "Waiting for central to be available..." - until $(curl -k --output /dev/null --silent --head --fail https://$CENTRAL_URL); do - if [ ${attempt_counter} -eq ${max_attempts} ];then - echo "Max attempts reached" - exit 1 - fi - printf '.' - attempt_counter=$(($attempt_counter+1)) - echo "Made attempt $attempt_counter, waiting..." - sleep 10 - done - - API_ENDPOINT="/v1/apitokens/generate" - CENTRAL_URL_API="https://$CENTRAL_URL$API_ENDPOINT" - echo "Central API endpoint: $CENTRAL_URL_API" - echo "Creating secrets in namespaces $NAMESPACES" - - for NAMESPACE in ${NAMESPACES//,/ } - do - echo "Creating secret for $NAMESPACE" - if [[ `oc get namespace $NAMESPACE 2>/dev/null` ]] ; - then - echo "Namespace '$NAMESPACE' exists, checking secret..." - else - echo "Namespace '$NAMESPACE' doesn't exist, skipping" - continue - fi - - # If secret already exists, don't regenerate. - if [[ -n `oc get secret roxsecrets -n $NAMESPACE 2>/dev/null` ]] ; - then - echo "Stackrox token secret already exists in $NAMESPACE" - continue - fi - PAYLOAD="{\"name\": \"$NAMESPACE\", \"role\": \"Continuous Integration\"}" - echo "$PAYLOAD" - echo "Generate new token." - RESPONSE=$(curl -k \ - -X POST -u "admin:$PASSWORD" \ - -H "Content-Type: application/json" \ - --data "$PAYLOAD" \ - $CENTRAL_URL_API) - TOKEN=$(jq -r '.token' <<< "$RESPONSE") - - # Create secret in target namespace - oc create secret generic roxsecrets \ - --from-literal=rox_central_endpoint=$CENTRAL_URL:443 \ - --from-literal=rox_api_token=$TOKEN \ - -n $NAMESPACE - done - name: create-secrets - dnsPolicy: ClusterFirst - restartPolicy: Never - terminationGracePeriodSeconds: 30 - serviceAccount: postsync-create-roxsecrets - serviceAccountName: postsync-create-roxsecrets diff --git a/cluster-config/components/acs-tokens/base/postsync-create-roxsecrets-sa-rbac.yaml b/cluster-config/components/acs-tokens/base/postsync-create-roxsecrets-sa-rbac.yaml deleted file mode 100644 index 007f889..0000000 --- a/cluster-config/components/acs-tokens/base/postsync-create-roxsecrets-sa-rbac.yaml +++ /dev/null @@ -1,40 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: postsync-create-roxsecrets - namespace: stackrox ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - annotations: - argocd.argoproj.io/sync-wave: "1" - name: postsync-create-roxsecrets - namespace: stackrox -rules: - - apiGroups: - - "" - resources: - - secrets - verbs: - - get - - create - - apiGroups: - - "" - resources: - - namespaces - verbs: - - get ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: postsync-create-roxsecrets -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: postsync-create-roxsecrets -subjects: - - kind: ServiceAccount - name: postsync-create-roxsecrets - namespace: stackrox diff --git a/cluster-config/components/acs-tokens/base/postsync-roxsecret-namespaces.yaml b/cluster-config/components/acs-tokens/base/postsync-roxsecret-namespaces.yaml deleted file mode 100644 index f8cb74e..0000000 --- a/cluster-config/components/acs-tokens/base/postsync-roxsecret-namespaces.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: roxsecret-namespaces - namespace: stackrox -data: - NAMESPACES: product-catalog-cicd,demo-cicd - CENTRAL_URL: central-stackrox.apps.hub.ocplab.com diff --git a/cluster-config/components/alertmanager/base/README.md b/cluster-config/components/alertmanager/base/README.md deleted file mode 100644 index 34b4a1b..0000000 --- a/cluster-config/components/alertmanager/base/README.md +++ /dev/null @@ -1 +0,0 @@ -See Jonas Janz's repo for examples of alertmanager configuration and slack template [here](https://github.com/PixelJonas/cluster-gitops/tree/master/manifests/argocd/apps/alertmanager/base/apps/examples). diff --git a/cluster-config/components/alertmanager/base/alertmanager-main-secret.yaml b/cluster-config/components/alertmanager/base/alertmanager-main-secret.yaml deleted file mode 100644 index 9fbfe38..0000000 --- a/cluster-config/components/alertmanager/base/alertmanager-main-secret.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: alertmanager-main - namespace: openshift-monitoring -spec: - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: alertmanager-main - data: - - secretKey: alertmanager.yaml - remoteRef: - key: ALERTMANAGER - - secretKey: slacktemplate.tmpl - remoteRef: - key: ALERTMANAGER_SLACK_TEMPLATE diff --git a/cluster-config/components/alertmanager/base/kustomization.yaml b/cluster-config/components/alertmanager/base/kustomization.yaml deleted file mode 100644 index 1ea71ad..0000000 --- a/cluster-config/components/alertmanager/base/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: -- alertmanager-main-secret.yaml diff --git a/cluster-config/components/amq-streams-v1/base/README.md b/cluster-config/components/amq-streams-v1/base/README.md deleted file mode 100644 index a3ac2d6..0000000 --- a/cluster-config/components/amq-streams-v1/base/README.md +++ /dev/null @@ -1 +0,0 @@ -Experimenting with OLM v1 diff --git a/cluster-config/components/amq-streams-v1/base/clusterextension.yaml b/cluster-config/components/amq-streams-v1/base/clusterextension.yaml deleted file mode 100644 index 6c41fd0..0000000 --- a/cluster-config/components/amq-streams-v1/base/clusterextension.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: olm.operatorframework.io/v1 -kind: ClusterExtension -metadata: - name: amq-streams -spec: - namespace: amq-streams-operator - serviceAccount: - name: amq-streams-installer - source: - sourceType: Catalog - catalog: - packageName: amq-streams - channels: - - amq-streams-2.9.x - upgradeConstraintPolicy: CatalogProvided diff --git a/cluster-config/components/amq-streams-v1/base/clusterrole.yaml b/cluster-config/components/amq-streams-v1/base/clusterrole.yaml deleted file mode 100644 index 51b17ff..0000000 --- a/cluster-config/components/amq-streams-v1/base/clusterrole.yaml +++ /dev/null @@ -1,398 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: amq-streams-installer-clusterrole -rules: - # ClusterRoles and ClusterRoleBindings for the controllers of the extension - - apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterroles - verbs: - - "*" - - apiGroups: - - rbac.authorization.k8s.io - resources: - - clusterrolebindings - verbs: - - "*" - - apiGroups: - - olm.operatorframework.io - resources: - - clusterextensions/finalizers - verbs: - - update - # Scoped to the name of the ClusterExtension - resourceNames: - - amq-streams # the value from from the extension's custom resource (CR) - # Deployments specified in install.spec.deployments - - apiGroups: - - apps - resources: - - deployments - verbs: - - create - - list - - watch - - apiGroups: - - apps - resources: - - deployments - verbs: - - get - - update - - patch - - delete - # scoped to the extension controller deployment name - resourceNames: - - amq-streams-cluster-operator - - amq-streams-cluster-operator-v2.9.0-0 - # Service accounts in the CSV - - apiGroups: - - "" - resources: - - serviceaccounts - verbs: - - create - - list - - watch - - apiGroups: - - "" - resources: - - serviceaccounts - verbs: - - get - - update - - patch - - delete - # scoped to the extension controller's deployment service account - resourceNames: - - strimzi-cluster-operator - # configmaps - - apiGroups: - - "" - resources: - - configmaps - verbs: - - create - - apiGroups: - - "" - resources: - - configmaps - verbs: - - get - - list - - watch - - update - - patch - - delete - # scoped to the configmap name - resourceNames: - - strimzi-cluster-operator - - apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - create - - list - - watch - - apiGroups: - - apiextensions.k8s.io - resources: - - customresourcedefinitions - verbs: - - get - - update - - patch - - delete - resourceNames: - - kafkas.kafka.strimzi.io - - kafkanodepools.kafka.strimzi.io - - kafkaconnects.kafka.strimzi.io - - kafkamirrormakers.kafka.strimzi.io - - kafkabridges.kafka.strimzi.io - - kafkatopics.kafka.strimzi.io - - kafkausers.kafka.strimzi.io - - kafkaconnectors.kafka.strimzi.io - - kafkamirrormaker2s.kafka.strimzi.io - - kafkarebalances.kafka.strimzi.io - - strimzipodsets.core.strimzi.io - # install permissions from CSV - - apiGroups: - - "rbac.authorization.k8s.io" - resources: - # The cluster operator needs to access and manage rolebindings to grant Strimzi components cluster permissions - - rolebindings - verbs: - - get - - list - - watch - - create - - delete - - patch - - update - - apiGroups: - - "rbac.authorization.k8s.io" - resources: - # The cluster operator needs to access and manage roles to grant the entity operator permissions - - roles - verbs: - - get - - list - - watch - - create - - delete - - patch - - update - - apiGroups: - - "" - resources: - # The cluster operator needs to access and delete pods, this is to allow it to monitor pod health and coordinate rolling updates - - pods - # The cluster operator needs to access and manage service accounts to grant Strimzi components cluster permissions - - serviceaccounts - # The cluster operator needs to access and manage config maps for Strimzi components configuration - - configmaps - # The cluster operator needs to access and manage services and endpoints to expose Strimzi components to network traffic - - services - - endpoints - # The cluster operator needs to access and manage secrets to handle credentials - # The entity operator user-operator needs to access and manage secrets to store generated credentials - - secrets - # The cluster operator needs to access and manage persistent volume claims to bind them to Strimzi components for persistent data - - persistentvolumeclaims - verbs: - - get - - list - - watch - - create - - delete - - patch - - update - - apiGroups: - - "kafka.strimzi.io" - resources: - # The Cluster Operator operates the Strimzi custom resources - - kafkas - - kafkanodepools - - kafkaconnects - - kafkaconnectors - - kafkamirrormakers - - kafkabridges - - kafkamirrormaker2s - - kafkarebalances - - kafkatopics - - kafkausers - verbs: - - get - - list - - watch - - create - - delete - - patch - - update - - apiGroups: - - "kafka.strimzi.io" - resources: - # The Cluster Operator needs to manage the status of the Strimzi custom resources - - kafkas/status - - kafkanodepools/status - - kafkaconnects/status - - kafkaconnectors/status - - kafkamirrormakers/status - - kafkabridges/status - - kafkamirrormaker2s/status - - kafkarebalances/status - - kafkatopics/status - - kafkausers/status - verbs: - - get - - patch - - update - - apiGroups: - - "core.strimzi.io" - resources: - # The cluster operator uses StrimziPodSets to manage the Kafka and ZooKeeper pods - - strimzipodsets - verbs: - - get - - list - - watch - - create - - delete - - patch - - update - - apiGroups: - - "core.strimzi.io" - resources: - # The Cluster Operator needs to manage the status of the StrimziPodSet custom resource - - strimzipodsets/status - verbs: - - get - - patch - - update - - apiGroups: - - "kafka.strimzi.io" - resources: - # The Cluster Operator needs deletion for KafkaRebalance only (during auto-rebalancing) - - kafkarebalances - verbs: - - delete - - apiGroups: - - "apps" - resources: - # The cluster operator needs to access and manage deployments to run deployment based Strimzi components - - deployments - # The cluster operator needs to access and manage stateful sets to run stateful sets based Strimzi components - - statefulsets - # The cluster operator needs to access replica-sets to manage Strimzi components and to determine error states - - replicasets - verbs: - - get - - list - - watch - - create - - delete - - patch - - update - - apiGroups: - - "apps" - resources: - # The Cluster Operator needs to scale Deployments while migrating Connect and Mirror Maker 2 clusters from Deployments to StrimziPodSets - - deployments/scale - verbs: - - get - - patch - - update - - apiGroups: - - "" # legacy core events api, used by topic operator - - "events.k8s.io" # new events api, used by cluster operator - resources: - - events - verbs: - - create - - apiGroups: - # Kafka Connect Build on OpenShift requirement - - build.openshift.io - resources: - - buildconfigs - - buildconfigs/instantiate - - builds - verbs: - - get - - list - - watch - - create - - delete - - patch - - update - - apiGroups: - - networking.k8s.io - resources: - # The cluster operator needs to access and manage network policies to lock down communication between Strimzi components - - networkpolicies - # The cluster operator needs to access and manage ingresses which allow external access to the services in a cluster - - ingresses - verbs: - - get - - list - - watch - - create - - delete - - patch - - update - - apiGroups: - - route.openshift.io - resources: - # The cluster operator needs to access and manage routes to expose Strimzi components for external access - - routes - - routes/custom-host - verbs: - - get - - list - - watch - - create - - delete - - patch - - update - - apiGroups: - - image.openshift.io - resources: - # The cluster operator needs to verify the image stream when used for Kafka Connect image build - - imagestreams - verbs: - - get - - apiGroups: - - policy - resources: - # The cluster operator needs to access and manage pod disruption budgets this limits the number of concurrent disruptions - # that a Streams component experiences, allowing for higher availability - - poddisruptionbudgets - verbs: - - get - - list - - watch - - create - - delete - - patch - - update - - apiGroups: - - coordination.k8s.io - resources: - # The cluster operator needs to access and manage leases for leader election - # The "create" verb cannot be used with "resourceNames" - - leases - verbs: - - create - - apiGroups: - - coordination.k8s.io - resources: - # The cluster operator needs to access and manage leases for leader election - - leases - resourceNames: - # The default RBAC files give the operator only access to the Lease resource names strimzi-cluster-operator - # If you want to use another resource name or resource namespace, you have to configure the RBAC resources accordingly - - strimzi-cluster-operator - verbs: - - get - - list - - watch - - delete - - patch - - update - # Cluster permissions from CSV - - apiGroups: - - "rbac.authorization.k8s.io" - resources: - # The cluster operator needs to create and manage cluster role bindings in the case of an install where a user - # has specified they want their cluster role bindings generated - - clusterrolebindings - verbs: - - get - - list - - watch - - create - - delete - - patch - - update - - apiGroups: - - storage.k8s.io - resources: - # The cluster operator requires "get" permissions to view storage class details - # This is because only a persistent volume of a supported storage class type can be resized - - storageclasses - verbs: - - get - - apiGroups: - - "" - resources: - # The cluster operator requires "list" permissions to view all nodes in a cluster - # The listing is used to determine the node addresses when NodePort access is configured - # These addresses are then exposed in the custom resource states - # The Kafka Brokers require "get" permissions to view the node they are on - # This information is used to generate a Rack ID that is used for High Availability configurations - - nodes - verbs: - - get - - list diff --git a/cluster-config/components/amq-streams-v1/base/clusterrolebinding.yaml b/cluster-config/components/amq-streams-v1/base/clusterrolebinding.yaml deleted file mode 100644 index d7295fd..0000000 --- a/cluster-config/components/amq-streams-v1/base/clusterrolebinding.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: amq-streams-installer-binding -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: amq-streams-installer-clusterrole -subjects: -- kind: ServiceAccount - name: amq-streams-installer - namespace: amq-streams-operator diff --git a/cluster-config/components/amq-streams-v1/base/kustomization.yaml b/cluster-config/components/amq-streams-v1/base/kustomization.yaml deleted file mode 100644 index 43f4e95..0000000 --- a/cluster-config/components/amq-streams-v1/base/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ -resources: -- namespace.yaml -- clusterrole.yaml -- clusterrolebinding.yaml -- serviceaccount.yaml -- clusterextension.yaml diff --git a/cluster-config/components/amq-streams-v1/base/namespace.yaml b/cluster-config/components/amq-streams-v1/base/namespace.yaml deleted file mode 100644 index aa2cdf4..0000000 --- a/cluster-config/components/amq-streams-v1/base/namespace.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: amq-streams-operator diff --git a/cluster-config/components/amq-streams-v1/base/serviceaccount.yaml b/cluster-config/components/amq-streams-v1/base/serviceaccount.yaml deleted file mode 100644 index 6280615..0000000 --- a/cluster-config/components/amq-streams-v1/base/serviceaccount.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: amq-streams-installer - namespace: amq-streams-operator diff --git a/cluster-config/components/amq-streams/base/kustomization.yaml b/cluster-config/components/amq-streams/base/kustomization.yaml deleted file mode 100644 index 9ad12ad..0000000 --- a/cluster-config/components/amq-streams/base/kustomization.yaml +++ /dev/null @@ -1,2 +0,0 @@ -resources: -- subscription.yaml diff --git a/cluster-config/components/amq-streams/base/subscription.yaml b/cluster-config/components/amq-streams/base/subscription.yaml deleted file mode 100644 index 0da3527..0000000 --- a/cluster-config/components/amq-streams/base/subscription.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: amq-streams - namespace: openshift-operators -spec: - channel: stable - installPlanApproval: Automatic - name: amq-streams - source: redhat-operators - sourceNamespace: openshift-marketplace diff --git a/cluster-config/components/amq-streams/overlays/amq-streams-2.7.x/kustomization.yaml b/cluster-config/components/amq-streams/overlays/amq-streams-2.7.x/kustomization.yaml deleted file mode 100644 index 2b6f50d..0000000 --- a/cluster-config/components/amq-streams/overlays/amq-streams-2.7.x/kustomization.yaml +++ /dev/null @@ -1,11 +0,0 @@ -resources: -- ../../base - -patches: - - patch: | - - op: replace - path: /spec/channel - value: 'amq-streams-2.7.x' - target: - kind: Subscription - name: amq-streams diff --git a/cluster-config/components/argo-rollouts/base/kustomization.yaml b/cluster-config/components/argo-rollouts/base/kustomization.yaml deleted file mode 100644 index 54c4424..0000000 --- a/cluster-config/components/argo-rollouts/base/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ -namespace: argo-rollouts - -resources: -- namespace.yaml -- rollouts-analysis-monitoring.yaml -- https://github.com/argoproj/argo-rollouts/releases/latest/download/install.yaml diff --git a/cluster-config/components/argo-rollouts/base/namespace.yaml b/cluster-config/components/argo-rollouts/base/namespace.yaml deleted file mode 100644 index 1dfa470..0000000 --- a/cluster-config/components/argo-rollouts/base/namespace.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: argo-rollouts - annotations: - openshift.io/description: Argo Rollouts Progressive Delivery - openshift.io/display-name: Argo Rollouts diff --git a/cluster-config/components/argo-rollouts/base/rollouts-analysis-monitoring.yaml b/cluster-config/components/argo-rollouts/base/rollouts-analysis-monitoring.yaml deleted file mode 100644 index 2f6bee0..0000000 --- a/cluster-config/components/argo-rollouts/base/rollouts-analysis-monitoring.yaml +++ /dev/null @@ -1,11 +0,0 @@ -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: rollouts-analysis-monitoring -subjects: - - kind: ServiceAccount - name: argo-rollouts -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-monitoring-view diff --git a/cluster-config/components/banner/base/README.md b/cluster-config/components/banner/base/README.md deleted file mode 100644 index 23b8c03..0000000 --- a/cluster-config/components/banner/base/README.md +++ /dev/null @@ -1,3 +0,0 @@ -Displays a banner in the OpenShift Console with the cluster ID and name. - -Note that is leveraging ACM to populate the GitOps subscription with environment variables coupled with a plugin in Argo CD to post-process kustomize. diff --git a/cluster-config/components/banner/base/banner.yaml b/cluster-config/components/banner/base/banner.yaml deleted file mode 100644 index b5440b2..0000000 --- a/cluster-config/components/banner/base/banner.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: console.openshift.io/v1 -kind: ConsoleNotification -metadata: - name: banner -spec: - text: "Cluster: ${CLUSTER_NAME}" - location: BannerTop - color: '#fff' - backgroundColor: "#${COLOR}" - link: - href: https://console.redhat.com/openshift/details/${CLUSTER_ID} - text: "(${CLUSTER_ID})" diff --git a/cluster-config/components/banner/base/kustomization.yaml b/cluster-config/components/banner/base/kustomization.yaml deleted file mode 100644 index 102523a..0000000 --- a/cluster-config/components/banner/base/kustomization.yaml +++ /dev/null @@ -1,2 +0,0 @@ -resources: -- banner.yaml diff --git a/cluster-config/components/camel-k-operator/base/kustomization.yaml b/cluster-config/components/camel-k-operator/base/kustomization.yaml deleted file mode 100644 index 3023ff6..0000000 --- a/cluster-config/components/camel-k-operator/base/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: -- subscription.yaml diff --git a/cluster-config/components/camel-k-operator/base/subscription.yaml b/cluster-config/components/camel-k-operator/base/subscription.yaml deleted file mode 100644 index 973e667..0000000 --- a/cluster-config/components/camel-k-operator/base/subscription.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: red-hat-camel-k - namespace: openshift-operators -spec: - channel: latest - installPlanApproval: Automatic - name: red-hat-camel-k - source: redhat-operators - sourceNamespace: openshift-marketplace diff --git a/cluster-config/components/cert-manager-operator/aggregate/overlays/letsencrypt/kustomization.yaml b/cluster-config/components/cert-manager-operator/aggregate/overlays/letsencrypt/kustomization.yaml deleted file mode 100644 index 5eecc47..0000000 --- a/cluster-config/components/cert-manager-operator/aggregate/overlays/letsencrypt/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -resources: -- ../../../operator/base -- ../../../instance/base -- ../../../issuers/letsencrypt-route53/base diff --git a/cluster-config/components/cert-manager-operator/instance/base/certmanager.yaml b/cluster-config/components/cert-manager-operator/instance/base/certmanager.yaml deleted file mode 100644 index 7b95760..0000000 --- a/cluster-config/components/cert-manager-operator/instance/base/certmanager.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: operator.openshift.io/v1alpha1 -kind: CertManager -metadata: - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - name: cluster -spec: - logLevel: Normal - managementState: Managed - observedConfig: null - operatorLogLevel: Normal - controllerConfig: - overrideArgs: - - '--dns01-recursive-nameservers=8.8.8.8:53,8.8.4.4:53' - - '--dns01-recursive-nameservers-only' diff --git a/cluster-config/components/cert-manager-operator/instance/base/kustomization.yaml b/cluster-config/components/cert-manager-operator/instance/base/kustomization.yaml deleted file mode 100644 index 3a258ae..0000000 --- a/cluster-config/components/cert-manager-operator/instance/base/kustomization.yaml +++ /dev/null @@ -1,2 +0,0 @@ -resources: -- certmanager.yaml diff --git a/cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/cert-manager-ns.yaml b/cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/cert-manager-ns.yaml deleted file mode 100644 index c90416f..0000000 --- a/cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/cert-manager-ns.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: cert-manager diff --git a/cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/kustomization.yaml b/cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/kustomization.yaml deleted file mode 100644 index 6c88db3..0000000 --- a/cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/kustomization.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -commonAnnotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - -resources: -- cert-manager-ns.yaml -- letsencrypt-aws-external.yaml -- letsencrypt-staging-cluster-issuer.yaml -- letsencrypt-prod-cluster-issuer.yaml diff --git a/cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/letsencrypt-aws-external.yaml b/cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/letsencrypt-aws-external.yaml deleted file mode 100644 index 21ff64d..0000000 --- a/cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/letsencrypt-aws-external.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: letsencrypt-aws - namespace: cert-manager -spec: - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: letsencrypt-aws - data: - - secretKey: secret-access-key - remoteRef: - key: AWS_LETSENCRYPT diff --git a/cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/letsencrypt-prod-cluster-issuer.yaml b/cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/letsencrypt-prod-cluster-issuer.yaml deleted file mode 100644 index 80098e4..0000000 --- a/cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/letsencrypt-prod-cluster-issuer.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-prod -spec: - acme: - server: https://acme-v02.api.letsencrypt.org/directory - email: gnunn@redhat.com - # This key doesn't exist, cert-manager creates it - privateKeySecretRef: - name: gnunn-redhat-issuer-account-key - solvers: - - selector: - dnsZones: - - "ocplab.com" - dns01: - route53: - region: ca-central-1 - accessKeyID: AKIAVW7HGAZVWLIKXRCA - hostedZoneID: Z1LKUX3GLO9GW9 - secretAccessKeySecretRef: - name: letsencrypt-aws - key: secret-access-key diff --git a/cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/letsencrypt-staging-cluster-issuer.yaml b/cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/letsencrypt-staging-cluster-issuer.yaml deleted file mode 100644 index 92cf9bf..0000000 --- a/cluster-config/components/cert-manager-operator/issuers/letsencrypt-route53/base/letsencrypt-staging-cluster-issuer.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: ClusterIssuer -metadata: - name: letsencrypt-staging -spec: - acme: - server: https://acme-staging-v02.api.letsencrypt.org/directory - email: gnunn@redhat.com - # This key doesn't exist, cert-manager creates it - privateKeySecretRef: - name: gnunn-redhat-issuer-account-key - solvers: - - selector: - dnsZones: - - "ocplab.com" - dns01: - route53: - region: ca-central-1 - accessKeyID: AKIAVW7HGAZVWLIKXRCA - hostedZoneID: Z1LKUX3GLO9GW9 - secretAccessKeySecretRef: - name: letsencrypt-aws - key: secret-access-key diff --git a/cluster-config/components/cert-manager-operator/operator/base/kustomization.yaml b/cluster-config/components/cert-manager-operator/operator/base/kustomization.yaml deleted file mode 100644 index f6a596b..0000000 --- a/cluster-config/components/cert-manager-operator/operator/base/kustomization.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -commonAnnotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - -namespace: cert-manager-operator - -resources: -- operator-namespace.yaml -- operator-group.yaml -- subscription.yaml diff --git a/cluster-config/components/cert-manager-operator/operator/base/operator-group.yaml b/cluster-config/components/cert-manager-operator/operator/base/operator-group.yaml deleted file mode 100644 index 453441a..0000000 --- a/cluster-config/components/cert-manager-operator/operator/base/operator-group.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: operators.coreos.com/v1 -kind: OperatorGroup -metadata: - name: openshift-cert-manager-operator -spec: - targetNamespaces: - - cert-manager-operator - upgradeStrategy: Default diff --git a/cluster-config/components/cert-manager-operator/operator/base/operator-namespace.yaml b/cluster-config/components/cert-manager-operator/operator/base/operator-namespace.yaml deleted file mode 100644 index 96f3eff..0000000 --- a/cluster-config/components/cert-manager-operator/operator/base/operator-namespace.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - annotations: - openshift.io/display-name: Red Hat Certificate Manager Operator - labels: - openshift.io/cluster-monitoring: 'true' - name: cert-manager-operator diff --git a/cluster-config/components/cert-manager-operator/operator/base/subscription.yaml b/cluster-config/components/cert-manager-operator/operator/base/subscription.yaml deleted file mode 100644 index d8894c6..0000000 --- a/cluster-config/components/cert-manager-operator/operator/base/subscription.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: openshift-cert-manager-operator -spec: - channel: stable-v1 - installPlanApproval: Automatic - name: openshift-cert-manager-operator - source: redhat-operators - sourceNamespace: openshift-marketplace diff --git a/cluster-config/components/certificates/base/apiserver.yaml b/cluster-config/components/certificates/base/apiserver.yaml deleted file mode 100644 index e688b2e..0000000 --- a/cluster-config/components/certificates/base/apiserver.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: config.openshift.io/v1 -kind: APIServer -metadata: - name: cluster - annotations: - argocd.argoproj.io/sync-wave: "1" - argocd.argoproj.io/sync-options: Validate=false,ServerSideApply=true -spec: - servingCerts: - namedCertificates: - - names: - - api.${BASE_DOMAIN} - servingCertificate: - name: openshift-api-certificate diff --git a/cluster-config/components/certificates/base/ingresscontroller.yaml b/cluster-config/components/certificates/base/ingresscontroller.yaml deleted file mode 100644 index 26c75fc..0000000 --- a/cluster-config/components/certificates/base/ingresscontroller.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: operator.openshift.io/v1 -kind: IngressController -metadata: - name: default - namespace: openshift-ingress-operator - annotations: - argocd.argoproj.io/sync-wave: "1" - argocd.argoproj.io/sync-options: Validate=false,ServerSideApply=true -spec: - defaultCertificate: - name: openshift-wildcard-certificate diff --git a/cluster-config/components/certificates/base/kustomization.yaml b/cluster-config/components/certificates/base/kustomization.yaml deleted file mode 100644 index af999a9..0000000 --- a/cluster-config/components/certificates/base/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - openshift-api-certificate.yaml - - openshift-wildcard-certificate.yaml - - apiserver.yaml - - ingresscontroller.yaml diff --git a/cluster-config/components/certificates/base/openshift-api-certificate.yaml b/cluster-config/components/certificates/base/openshift-api-certificate.yaml deleted file mode 100644 index 2083286..0000000 --- a/cluster-config/components/certificates/base/openshift-api-certificate.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: openshift-api - namespace: openshift-config - annotations: - argocd.argoproj.io/sync-wave: '0' -spec: - secretName: openshift-api-certificate - issuerRef: - name: letsencrypt-prod - kind: ClusterIssuer - dnsNames: - - api.${BASE_DOMAIN} diff --git a/cluster-config/components/certificates/base/openshift-wildcard-certificate.yaml b/cluster-config/components/certificates/base/openshift-wildcard-certificate.yaml deleted file mode 100644 index d3de941..0000000 --- a/cluster-config/components/certificates/base/openshift-wildcard-certificate.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: cert-manager.io/v1 -kind: Certificate -metadata: - name: openshift-wildcard - namespace: openshift-ingress - annotations: - argocd.argoproj.io/sync-wave: '0' -spec: - secretName: openshift-wildcard-certificate - issuerRef: - name: letsencrypt-prod - kind: ClusterIssuer - commonName: '*.${SUB_DOMAIN}' - dnsNames: - - '*.${SUB_DOMAIN}' diff --git a/cluster-config/components/clean-completed-pods/base/README.md b/cluster-config/components/clean-completed-pods/base/README.md deleted file mode 100644 index c76b8bc..0000000 --- a/cluster-config/components/clean-completed-pods/base/README.md +++ /dev/null @@ -1,3 +0,0 @@ -Cronjob that periodically removes completed jobs, based on KCS here: - -https://access.redhat.com/solutions/6934861 diff --git a/cluster-config/components/clean-completed-pods/base/clean-completed-pods-cronjob.yaml b/cluster-config/components/clean-completed-pods/base/clean-completed-pods-cronjob.yaml deleted file mode 100644 index e020efe..0000000 --- a/cluster-config/components/clean-completed-pods/base/clean-completed-pods-cronjob.yaml +++ /dev/null @@ -1,40 +0,0 @@ -apiVersion: batch/v1 -kind: CronJob -metadata: - name: completed-pod-cleanup -spec: - jobTemplate: - metadata: - name: completed-pod-cleanup - spec: - template: - spec: - containers: - - command: - - /bin/bash - - -c - - | - set -euo pipefail - echo "// Listed Completed Pod." - oc get pods -o wide --all-namespaces --sort-by='{.metadata.creationTimestamp}','{.metadata.namespace}','{.metadata.name}' --field-selector=status.phase==Succeeded - COMPLETED_POD=`oc get pods -o jsonpath="{range .items[*]}{.metadata.namespace}{'\t'}{.metadata.name}{'\n'}{end}" --all-namespaces --field-selector=metadata.namespace!=ocp-completed-pod-cleanup,status.phase==Succeeded` - if [ -n "$COMPLETED_POD" ]; then - echo "// Deleted Completed Pod." - while read NS_NAME POD_NAME - do - oc -n $NS_NAME delete pod $POD_NAME; - done <<< "$COMPLETED_POD" - fi - image: registry.redhat.io/openshift4/ose-cli:latest # change the image in disconnected environment - imagePullPolicy: IfNotPresent - name: completed-pod-cleanup - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - dnsPolicy: ClusterFirst - restartPolicy: OnFailure - serviceAccount: completed-pod-cleanup - serviceAccountName: completed-pod-cleanup - terminationGracePeriodSeconds: 30 - schedule: "0 11 * * *" - suspend: false -status: {} diff --git a/cluster-config/components/clean-completed-pods/base/kustomization.yaml b/cluster-config/components/clean-completed-pods/base/kustomization.yaml deleted file mode 100644 index 3962a74..0000000 --- a/cluster-config/components/clean-completed-pods/base/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ -namespace: clean-completed-pods - -resources: - - namespace.yaml - - clean-completed-pods-cronjob.yaml - - sa-rbac.yaml diff --git a/cluster-config/components/clean-completed-pods/base/namespace.yaml b/cluster-config/components/clean-completed-pods/base/namespace.yaml deleted file mode 100644 index 969d872..0000000 --- a/cluster-config/components/clean-completed-pods/base/namespace.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: clean-completed-pods diff --git a/cluster-config/components/clean-completed-pods/base/sa-rbac.yaml b/cluster-config/components/clean-completed-pods/base/sa-rbac.yaml deleted file mode 100644 index ce391bc..0000000 --- a/cluster-config/components/clean-completed-pods/base/sa-rbac.yaml +++ /dev/null @@ -1,31 +0,0 @@ -kind: ServiceAccount -apiVersion: v1 -metadata: - name: completed-pod-cleanup - labels: - app: completed-pod-cleanup ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: cluster-completed-pod-cleanup -rules: - - apiGroups: [""] - resources: - - "pods" - verbs: ["get", "list", "create", "delete", "watch"] ---- -kind: ClusterRoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: completed-pod-cleanup - labels: - app: completed-pod-cleanup -subjects: - - kind: ServiceAccount - name: completed-pod-cleanup - namespace: clean-completed-pods -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-completed-pod-cleanup diff --git a/cluster-config/components/codeready-workspaces/base/codeready-workspaces-cr.yaml b/cluster-config/components/codeready-workspaces/base/codeready-workspaces-cr.yaml deleted file mode 100644 index b922ec5..0000000 --- a/cluster-config/components/codeready-workspaces/base/codeready-workspaces-cr.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: org.eclipse.che/v1 -kind: CheCluster -metadata: - name: codeready-workspaces - namespace: openshift-workspaces -spec: - auth: - identityProviderURL: 'https://sso-sso.apps.home.ocplab.com' - identityProviderRealm: openshift - identityProviderClientId: codeready-public - externalIdentityProvider: true - server: - selfSignedCert: false - gitSelfSignedCert: false - tlsSupport: true diff --git a/cluster-config/components/compliance-operator/overlays/cis-compliance-master-only/kustomization.yaml b/cluster-config/components/compliance-operator/overlays/cis-compliance-master-only/kustomization.yaml deleted file mode 100644 index d1f360d..0000000 --- a/cluster-config/components/compliance-operator/overlays/cis-compliance-master-only/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -resources: -- ../cis-compliance - -patchesStrategicMerge: -- patch-scansetting.yaml diff --git a/cluster-config/components/compliance-operator/overlays/cis-compliance-master-only/patch-scansetting.yaml b/cluster-config/components/compliance-operator/overlays/cis-compliance-master-only/patch-scansetting.yaml deleted file mode 100644 index 5c2abff..0000000 --- a/cluster-config/components/compliance-operator/overlays/cis-compliance-master-only/patch-scansetting.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: compliance.openshift.io/v1alpha1 -debug: true -kind: ScanSetting -metadata: - name: cis-compliance - namespace: openshift-compliance -roles: -- master diff --git a/cluster-config/components/compliance-operator/overlays/cis-compliance/cis-compliance-scan-setting-binding.yaml b/cluster-config/components/compliance-operator/overlays/cis-compliance/cis-compliance-scan-setting-binding.yaml deleted file mode 100644 index 73e8197..0000000 --- a/cluster-config/components/compliance-operator/overlays/cis-compliance/cis-compliance-scan-setting-binding.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: compliance.openshift.io/v1alpha1 -kind: ScanSettingBinding -metadata: - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - argocd.argoproj.io/sync-wave: "1" - name: cis-compliance - namespace: openshift-compliance -profiles: -- apiGroup: compliance.openshift.io/v1alpha1 - kind: TailoredProfile - name: ocp4-cis-node-lab -- apiGroup: compliance.openshift.io/v1alpha1 - kind: TailoredProfile - name: ocp4-cis-lab -settingsRef: - apiGroup: compliance.openshift.io/v1alpha1 - kind: ScanSetting - name: default diff --git a/cluster-config/components/compliance-operator/overlays/cis-compliance/cis-compliance-scansetting.yaml b/cluster-config/components/compliance-operator/overlays/cis-compliance/cis-compliance-scansetting.yaml deleted file mode 100644 index e7811e2..0000000 --- a/cluster-config/components/compliance-operator/overlays/cis-compliance/cis-compliance-scansetting.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: compliance.openshift.io/v1alpha1 -kind: ScanSetting -metadata: - name: cis-compliance - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - argocd.argoproj.io/sync-wave: "1" -rawResultStorage: - nodeSelector: - node-role.kubernetes.io/master: "" - pvAccessModes: - - ReadWriteOnce - rotation: 3 - size: 1Gi - tolerations: - - effect: NoSchedule - key: node-role.kubernetes.io/master - operator: Exists - - effect: NoExecute - key: node.kubernetes.io/not-ready - operator: Exists - tolerationSeconds: 300 - - effect: NoExecute - key: node.kubernetes.io/unreachable - operator: Exists - tolerationSeconds: 300 - - effect: NoSchedule - key: node.kubernetes.io/memory-pressure - operator: Exists -roles: -- master -- worker -scanTolerations: -- operator: Exists -schedule: 0 */3 * * * -showNotApplicable: false -strictNodeScan: true diff --git a/cluster-config/components/compliance-operator/overlays/cis-compliance/kustomization.yaml b/cluster-config/components/compliance-operator/overlays/cis-compliance/kustomization.yaml deleted file mode 100644 index 8675404..0000000 --- a/cluster-config/components/compliance-operator/overlays/cis-compliance/kustomization.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# Assumes the cluster admin had pre-created the sealed-secrets project and secret. -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -namespace: openshift-compliance - -resources: -- github.com/redhat-cop/gitops-catalog/compliance-operator/operator/overlays/release-0.1 -- ocp-cis-tailored-profile.yaml -- ocp-cis-node-tailored-profile.yaml -- cis-compliance-scan-setting-binding.yaml -- cis-compliance-scansetting.yaml - -patches: -- patch: |- - - op: add - path: /metadata/labels - value: {"openshift.io/cluster-monitoring": "true"} - target: - kind: Namespace -- patch: |- - - op: replace - path: /spec/channel - value: stable - target: - kind: Subscription - name: compliance-operator diff --git a/cluster-config/components/compliance-operator/overlays/cis-compliance/ocp-cis-node-tailored-profile.yaml b/cluster-config/components/compliance-operator/overlays/cis-compliance/ocp-cis-node-tailored-profile.yaml deleted file mode 100644 index 042ea27..0000000 --- a/cluster-config/components/compliance-operator/overlays/cis-compliance/ocp-cis-node-tailored-profile.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: compliance.openshift.io/v1alpha1 -kind: TailoredProfile -metadata: - name: ocp4-cis-node-lab - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - argocd.argoproj.io/sync-wave: "1" -spec: - extends: ocp4-cis-node - description: Lab CIS node profile - title: Lab CIS node profile - disableRules: - - name: ocp4-file-permissions-etcd-data-dir - rationale: Default value of `drwxr-xr-x.` is fine - - name: ocp4-kubelet-enable-protect-kernel-defaults - rationale: Not applicable - - name: ocp4-kubelet-enable-protect-kernel-sysctl - rationale: Not applicable diff --git a/cluster-config/components/compliance-operator/overlays/cis-compliance/ocp-cis-tailored-profile.yaml b/cluster-config/components/compliance-operator/overlays/cis-compliance/ocp-cis-tailored-profile.yaml deleted file mode 100644 index 62aa321..0000000 --- a/cluster-config/components/compliance-operator/overlays/cis-compliance/ocp-cis-tailored-profile.yaml +++ /dev/null @@ -1,38 +0,0 @@ -apiVersion: compliance.openshift.io/v1alpha1 -kind: TailoredProfile -metadata: - name: ocp4-cis-lab - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - argocd.argoproj.io/sync-wave: "1" -spec: - extends: ocp4-cis - description: Lab CIS profile - title: Lab CIS profile - disableRules: - - name: ocp4-api-server-encryption-provider-cipher - rationale: Using letsencrypt certificates, not applicable - - name: ocp4-audit-log-forwarding-enabled - rationale: Homelab so no log forwarding available - - name: ocp4-scc-limit-container-allowed-capabilities - rationale: Some containers require extra privileges - - name: ocp4-configure-network-policies-namespaces - rationale: Home lab supports ad-hoc demos - - name: ocp4-api-server-audit-log-maxsize - rationale: Home lab, no need for auditing - - name: ocp4-ocp-api-server-audit-log-maxsize - rationale: Home lab, no need for auditing - - name: ocp4-audit-profile-set - rationale: Home lab, default auditing is sufficient - - name: ocp4-ocp-allowed-registries - rationale: Home lab, open registries is fine - - name: ocp4-ocp-allowed-registries-for-import - rationale: Home lab, open registries is fine - - name: ocp4-api-server-api-priority-gate-enabled - rationale: Need to understand mis-behaving clients in Home lab - - name: ocp4-kubelet-configure-tls-cipher-suites-ingresscontroller - rationale: Home lab - - name: ocp4-api-server-tls-cipher-suites - rationale: Home lab - - name: ocp4-kubelet-configure-tls-cipher-suites - rationale: Home lab diff --git a/cluster-config/components/consolelinks/base/kustomization.yaml b/cluster-config/components/consolelinks/base/kustomization.yaml deleted file mode 100644 index 87f79bc..0000000 --- a/cluster-config/components/consolelinks/base/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: -- quay-link.yaml -- sso-link.yaml diff --git a/cluster-config/components/consolelinks/base/quay-link.yaml b/cluster-config/components/consolelinks/base/quay-link.yaml deleted file mode 100644 index f9b6888..0000000 --- a/cluster-config/components/consolelinks/base/quay-link.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: console.openshift.io/v1 -kind: ConsoleLink -metadata: - name: quay -spec: - href: 'https://quay.io/repository' - location: ApplicationMenu - text: Quay - applicationMenu: - section: Tools - imageURL: https://quay.io/static/img/quay_favicon.png diff --git a/cluster-config/components/consolelinks/base/sso-link.yaml b/cluster-config/components/consolelinks/base/sso-link.yaml deleted file mode 100644 index 0184db2..0000000 --- a/cluster-config/components/consolelinks/base/sso-link.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: console.openshift.io/v1 -kind: ConsoleLink -metadata: - name: sso-account -spec: - href: 'https://sso.ocplab.com/realms/ocplab/account' - location: UserMenu - text: Account Settings diff --git a/cluster-config/components/container-security-operator/base/kustomization.yaml b/cluster-config/components/container-security-operator/base/kustomization.yaml deleted file mode 100644 index 9ad12ad..0000000 --- a/cluster-config/components/container-security-operator/base/kustomization.yaml +++ /dev/null @@ -1,2 +0,0 @@ -resources: -- subscription.yaml diff --git a/cluster-config/components/container-security-operator/base/subscription.yaml b/cluster-config/components/container-security-operator/base/subscription.yaml deleted file mode 100644 index 0a758c6..0000000 --- a/cluster-config/components/container-security-operator/base/subscription.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: container-security-operator - namespace: openshift-operators -spec: - channel: stable-3.7 - installPlanApproval: Automatic - name: container-security-operator - source: redhat-operators - sourceNamespace: openshift-marketplace diff --git a/cluster-config/components/container-security-operator/overlays/stable-3.10/kustomization.yaml b/cluster-config/components/container-security-operator/overlays/stable-3.10/kustomization.yaml deleted file mode 100644 index db900ff..0000000 --- a/cluster-config/components/container-security-operator/overlays/stable-3.10/kustomization.yaml +++ /dev/null @@ -1,11 +0,0 @@ -resources: -- ../../base - -patches: - - patch: |- - - op: replace - path: /spec/channel - value: 'stable-3.10' - target: - kind: Subscription - name: container-security-operator diff --git a/cluster-config/components/container-security-operator/overlays/stable-3.13/kustomization.yaml b/cluster-config/components/container-security-operator/overlays/stable-3.13/kustomization.yaml deleted file mode 100644 index 2a6368f..0000000 --- a/cluster-config/components/container-security-operator/overlays/stable-3.13/kustomization.yaml +++ /dev/null @@ -1,11 +0,0 @@ -resources: -- ../../base - -patches: - - patch: |- - - op: replace - path: /spec/channel - value: 'stable-3.13' - target: - kind: Subscription - name: container-security-operator diff --git a/cluster-config/components/container-security-operator/overlays/stable-3.9/kustomization.yaml b/cluster-config/components/container-security-operator/overlays/stable-3.9/kustomization.yaml deleted file mode 100644 index 3719dd2..0000000 --- a/cluster-config/components/container-security-operator/overlays/stable-3.9/kustomization.yaml +++ /dev/null @@ -1,11 +0,0 @@ -resources: -- ../../base - -patches: - - patch: |- - - op: replace - path: /spec/channel - value: 'stable-3.9' - target: - kind: Subscription - name: container-security-operator diff --git a/cluster-config/components/defrag-etcd/base/cronjob.yaml b/cluster-config/components/defrag-etcd/base/cronjob.yaml deleted file mode 100644 index 9d30471..0000000 --- a/cluster-config/components/defrag-etcd/base/cronjob.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: batch/v1 -kind: CronJob -metadata: - name: defrag-etcd -spec: - schedule: "0 11 * * *" - jobTemplate: - spec: - template: - spec: - containers: - - name: defrag-etcd - image: registry.redhat.io/openshift4/ose-cli:latest - imagePullPolicy: IfNotPresent - command: - - /bin/bash - - -c - - | - #!/usr/bin/env bash - - oc get pods -l app=etcd -n openshift-etcd --no-headers -o custom-columns=":metadata.name" | while read -r pod ; do - oc exec -n openshift-etcd $pod --container etcdctl -- sh -c "unset ETCDCTL_ENDPOINTS && etcdctl --command-timeout=30s --endpoints=https://localhost:2379 defrag" - done - serviceAccountName: defrag-etcd - restartPolicy: OnFailure diff --git a/cluster-config/components/defrag-etcd/base/kustomization.yaml b/cluster-config/components/defrag-etcd/base/kustomization.yaml deleted file mode 100644 index 498cbad..0000000 --- a/cluster-config/components/defrag-etcd/base/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -namespace: openshift-etcd - -resources: -- sa-rbac.yaml -- cronjob.yaml diff --git a/cluster-config/components/defrag-etcd/base/sa-rbac.yaml b/cluster-config/components/defrag-etcd/base/sa-rbac.yaml deleted file mode 100644 index 2ae7299..0000000 --- a/cluster-config/components/defrag-etcd/base/sa-rbac.yaml +++ /dev/null @@ -1,36 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: defrag-etcd ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: defrag-etcd -rules: - - apiGroups: - - "" - resources: - - pods - verbs: - - get - - list - - exec - - apiGroups: - - "" - resources: - - pods/exec - verbs: - - create ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: defrag-etcd -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: defrag-etcd -subjects: - - kind: ServiceAccount - name: defrag-etcd diff --git a/cluster-config/components/dev-console-plugin/base/kustomization.yaml b/cluster-config/components/dev-console-plugin/base/kustomization.yaml deleted file mode 100644 index 0abe540..0000000 --- a/cluster-config/components/dev-console-plugin/base/kustomization.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: -- namespace.yaml - -helmGlobals: - chartHome: charts/openshift-console-plugin - -helmCharts: -- name: openshift-console-plugin - version: 0.3.0 - repo: https://gnunn-gitops.github.io/helm-charts - valuesFile: values.yaml - namespace: dev-console-plugin - releaseName: dev-console-plugin diff --git a/cluster-config/components/dev-console-plugin/base/namespace.yaml b/cluster-config/components/dev-console-plugin/base/namespace.yaml deleted file mode 100644 index 2aa549c..0000000 --- a/cluster-config/components/dev-console-plugin/base/namespace.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: dev-console-plugin diff --git a/cluster-config/components/dev-console-plugin/base/values.yaml b/cluster-config/components/dev-console-plugin/base/values.yaml deleted file mode 100644 index 5d4a5b2..0000000 --- a/cluster-config/components/dev-console-plugin/base/values.yaml +++ /dev/null @@ -1,4 +0,0 @@ -plugin: - name: dev-console-plugin - namespace: dev-console-plugin - image: quay.io/gnunn/dev-console-plugin:latest diff --git a/cluster-config/components/dev-tools/overlays/default/configure-sonarqube-job.yaml b/cluster-config/components/dev-tools/overlays/default/configure-sonarqube-job.yaml deleted file mode 100644 index 8591e3d..0000000 --- a/cluster-config/components/dev-tools/overlays/default/configure-sonarqube-job.yaml +++ /dev/null @@ -1,33 +0,0 @@ -apiVersion: batch/v1 -kind: Job -metadata: - name: configure-sonarqube -spec: - template: - spec: - containers: - - image: registry.access.redhat.com/ubi8/ubi:8.3 - command: - - /bin/bash - - -c - - | - curl -H 'Cache-Control: no-cache' -o /tmp/sonarqube-plugins -s ${SCRIPT_URL}; - chmod +x /tmp/sonarqube-plugins; - /tmp/sonarqube-plugins - imagePullPolicy: Always - name: configure-sonarqube - env: - - name: SONARQUBE_PLUGINS - value: "java,javascript,dependencycheck,jacoco,pmd,scmgit" - - name: SONARQUBE_PASSWORD - valueFrom: - secretKeyRef: - name: sonarqube-admin - key: password - - name: SCRIPT_URL - value: "https://raw.githubusercontent.com/gnunn-gitops/cluster-config/main/components/dev-tools/scripts/sonarqube-config" - dnsPolicy: ClusterFirst - restartPolicy: OnFailure - serviceAccount: default - serviceAccountName: default - terminationGracePeriodSeconds: 30 diff --git a/cluster-config/components/dev-tools/overlays/default/kustomization.yaml b/cluster-config/components/dev-tools/overlays/default/kustomization.yaml deleted file mode 100644 index 3934927..0000000 --- a/cluster-config/components/dev-tools/overlays/default/kustomization.yaml +++ /dev/null @@ -1,48 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -namespace: dev-tools - -bases: -# Nexus -- https://github.com/redhat-cop/gitops-catalog/nexus2/base -# Sonarqube -- sonarqube-admin-secret.yaml -- https://github.com/redhat-cop/gitops-catalog/sonarqube8/base -- configure-sonarqube-job.yaml - -resources: -- namespace.yaml - -patches: -- patch: |- - - op: replace - path: /spec/template/spec/containers/0/image - value: sonarqube:lts-community - target: - kind: Deployment - name: sonarqube -- patch: |- - - op: add - path: /spec/template/spec/containers/0/env - value: - - name: SONAR_JDBC_PASSWORD - value: kHPdpIYtdtGXeStv - - name: SONAR_JDBC_URL - value: 'jdbc:postgresql://postgresql-sonarqube/sonar' - - name: SONAR_JDBC_USERNAME - value: sonar - - name: SONAR_TELEMETRY_ENABLE - value: 'false' - - name: SONAR_PLUGINS_RISK_CONSENT - value: ACCEPTED - target: - kind: Deployment - name: sonarqube -- patch: |- - - op: add - path: /spec/tls - value: - termination: edge - target: - kind: Route diff --git a/cluster-config/components/dev-tools/overlays/default/namespace.yaml b/cluster-config/components/dev-tools/overlays/default/namespace.yaml deleted file mode 100644 index 591ff7f..0000000 --- a/cluster-config/components/dev-tools/overlays/default/namespace.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - annotations: - openshift.io/description: Project for development tools like nexus and sonarqube - openshift.io/display-name: Development Tools - name: dev-tools diff --git a/cluster-config/components/dev-tools/overlays/default/sonarqube-admin-secret.yaml b/cluster-config/components/dev-tools/overlays/default/sonarqube-admin-secret.yaml deleted file mode 100644 index 8a32b78..0000000 --- a/cluster-config/components/dev-tools/overlays/default/sonarqube-admin-secret.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: sonarqube-admin - namespace: dev-tools -spec: - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: sonarqube-admin - data: - - secretKey: password - remoteRef: - key: SONARQUBE_ADMIN_PASSWORD diff --git a/cluster-config/components/dev-tools/scripts/sonarqube-config b/cluster-config/components/dev-tools/scripts/sonarqube-config deleted file mode 100644 index 744f02a..0000000 --- a/cluster-config/components/dev-tools/scripts/sonarqube-config +++ /dev/null @@ -1,27 +0,0 @@ -SONARQUBE_HOST=sonarqube:9000 - -echo "Waiting for sonarqube to be ready..." - -until [ "$(curl --silent --show-error --connect-timeout 1 http://${SONARQUBE_HOST}/api/system/status | grep 'UP')" ]; -do - sleep 5 -done -echo "SonarQube reporting UP. Wait 5 seconds to be sure." -sleep 5 - -echo "Updating admin password on host ${SONARQUBE_HOST}" -curl -u admin:admin -X POST "http://${SONARQUBE_HOST}/api/users/change_password?login=admin&previousPassword=admin&password=${SONARQUBE_PASSWORD}" - -echo "Disabling force authentication for demo purposes" -curl -u admin:${SONARQUBE_PASSWORD} --request POST "http://sonarqube:9000/api/settings/set?key=sonar.forceAuthentication&value=false" - -echo "Installing plugins ${SONARQUBE_PLUGINS} on server ${SONARQUBE_HOST}" - -for i in ${SONARQUBE_PLUGINS//,/ } -do - echo "Installing $i" - curl -u admin:${SONARQUBE_PASSWORD} --data "key=$i" http://${SONARQUBE_HOST}/api/plugins/install -done - -echo "Restarting server ${SONARQUBE_HOST} ..." -curl -u admin:${SONARQUBE_PASSWORD} -X POST http://${SONARQUBE_HOST}/api/system/restart diff --git a/cluster-config/components/eso/instance/base/kustomization.yaml b/cluster-config/components/eso/instance/base/kustomization.yaml deleted file mode 100644 index 22bf756..0000000 --- a/cluster-config/components/eso/instance/base/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ -namespace: external-secrets - -resources: -- namespace.yaml -- operatorconfig.yaml -- podmonitor.yaml -- prometheus-rule.yaml diff --git a/cluster-config/components/eso/instance/base/namespace.yaml b/cluster-config/components/eso/instance/base/namespace.yaml deleted file mode 100644 index 4ef398e..0000000 --- a/cluster-config/components/eso/instance/base/namespace.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: external-secrets diff --git a/cluster-config/components/eso/instance/base/operatorconfig.yaml b/cluster-config/components/eso/instance/base/operatorconfig.yaml deleted file mode 100644 index da142dd..0000000 --- a/cluster-config/components/eso/instance/base/operatorconfig.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: operator.external-secrets.io/v1alpha1 -kind: OperatorConfig -metadata: - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - argocd.argoproj.io/sync-wave: "1" - name: cluster -spec: - crds: - conversion: - enabled: false - prometheus: - enabled: true - service: - port: 8080 - resources: - requests: - cpu: 10m - memory: 96Mi - limits: - cpu: 100m - memory: 256Mi diff --git a/cluster-config/components/eso/instance/base/podmonitor.yaml b/cluster-config/components/eso/instance/base/podmonitor.yaml deleted file mode 100644 index 1664083..0000000 --- a/cluster-config/components/eso/instance/base/podmonitor.yaml +++ /dev/null @@ -1,27 +0,0 @@ -apiVersion: monitoring.coreos.com/v1 -kind: PodMonitor -metadata: - name: external-secrets-controller - namespace: external-secrets - labels: - app.kubernetes.io/name: external-secrets-cert-controller -spec: - selector: - matchLabels: - app.kubernetes.io/name: external-secrets-cert-controller - podMetricsEndpoints: - - port: metrics ---- -apiVersion: monitoring.coreos.com/v1 -kind: PodMonitor -metadata: - name: external-secrets - namespace: external-secrets - labels: - app.kubernetes.io/name: external-secrets -spec: - selector: - matchLabels: - app.kubernetes.io/name: external-secrets - podMetricsEndpoints: - - port: metrics diff --git a/cluster-config/components/eso/instance/base/prometheus-rule.yaml b/cluster-config/components/eso/instance/base/prometheus-rule.yaml deleted file mode 100644 index 8c461dd..0000000 --- a/cluster-config/components/eso/instance/base/prometheus-rule.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule -metadata: - name: external-secrets - namespace: external-secrets -spec: - groups: - - name: ExternalSecrets - rules: - - alert: ExternalSecretSyncError - annotations: - description: |- - The external secret {{ $labels.exported_namespace }}/{{ $labels.name }} failed to synced. - Use this command to check the status: - oc get externalsecret {{ $labels.name }} -n {{ $labels.exported_namespace }} - summary: External secret failed to sync - labels: - severity: warning - expr: externalsecret_status_condition{status="False"} == 1 - for: 5m diff --git a/cluster-config/components/eso/operator/base/kustomization.yaml b/cluster-config/components/eso/operator/base/kustomization.yaml deleted file mode 100644 index cb95cab..0000000 --- a/cluster-config/components/eso/operator/base/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ -namespace: external-secrets-operator - -resources: -- namespace.yaml -- operatorgroup.yaml -- subscription.yaml -- github.com/redhat-cop/gitops-catalog/installplan-approver/base diff --git a/cluster-config/components/eso/operator/base/namespace.yaml b/cluster-config/components/eso/operator/base/namespace.yaml deleted file mode 100644 index 05a6acc..0000000 --- a/cluster-config/components/eso/operator/base/namespace.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: external-secrets-operator diff --git a/cluster-config/components/eso/operator/base/operatorgroup.yaml b/cluster-config/components/eso/operator/base/operatorgroup.yaml deleted file mode 100644 index 8a0cefd..0000000 --- a/cluster-config/components/eso/operator/base/operatorgroup.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: operators.coreos.com/v1 -kind: OperatorGroup -metadata: - name: external-secrets-operator -spec: - upgradeStrategy: Default diff --git a/cluster-config/components/eso/operator/base/subscription.yaml b/cluster-config/components/eso/operator/base/subscription.yaml deleted file mode 100644 index 3e4d375..0000000 --- a/cluster-config/components/eso/operator/base/subscription.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: external-secrets-operator - namespace: openshift-operators -spec: - channel: stable - installPlanApproval: Manual - name: external-secrets-operator - source: community-operators - sourceNamespace: openshift-marketplace diff --git a/cluster-config/components/eso/overlays/aggregate/kustomization.yaml b/cluster-config/components/eso/overlays/aggregate/kustomization.yaml deleted file mode 100644 index 0716a03..0000000 --- a/cluster-config/components/eso/overlays/aggregate/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ -kind: Kustomization -apiVersion: kustomize.config.k8s.io/v1beta1 - -commonAnnotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - -resources: -- ../../operator/base -- ../../instance/base diff --git a/cluster-config/components/gitops-admin-plugin/base/kustomization.yaml b/cluster-config/components/gitops-admin-plugin/base/kustomization.yaml deleted file mode 100644 index 6b43d9a..0000000 --- a/cluster-config/components/gitops-admin-plugin/base/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - github.com/gnunn-gitops/gitops-admin-plugin/manifests/overlays/install?ref=4.16 diff --git a/cluster-config/components/gitops-operator/base/argocd-dex-server-rolebinding.yaml b/cluster-config/components/gitops-operator/base/argocd-dex-server-rolebinding.yaml deleted file mode 100644 index 203610b..0000000 --- a/cluster-config/components/gitops-operator/base/argocd-dex-server-rolebinding.yaml +++ /dev/null @@ -1,11 +0,0 @@ -kind: RoleBinding -apiVersion: rbac.authorization.k8s.io/v1 -metadata: - name: argocd-dex-server -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: argocd-argocd-server -subjects: - - kind: ServiceAccount - name: argocd-argocd-dex-server diff --git a/cluster-config/components/gitops-operator/base/argocd-external-secret.yaml b/cluster-config/components/gitops-operator/base/argocd-external-secret.yaml deleted file mode 100644 index 1aea3fb..0000000 --- a/cluster-config/components/gitops-operator/base/argocd-external-secret.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: argocd-secret -spec: - data: - - remoteRef: - conversionStrategy: Default - decodingStrategy: None - key: OIDC_ARGOCD - secretKey: oidc.keycloak.clientSecret - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - creationPolicy: Merge - deletionPolicy: Retain - name: argocd-secret diff --git a/cluster-config/components/gitops-operator/base/create-pipeline-local-user-job.yaml b/cluster-config/components/gitops-operator/base/create-pipeline-local-user-job.yaml deleted file mode 100644 index 4e90cd8..0000000 --- a/cluster-config/components/gitops-operator/base/create-pipeline-local-user-job.yaml +++ /dev/null @@ -1,67 +0,0 @@ -apiVersion: batch/v1 -kind: Job -metadata: - name: create-pipeline-local-user - annotations: - argocd.argoproj.io/hook: PostSync - argocd.argoproj.io/hook-delete-policy: BeforeHookCreation -spec: - template: - spec: - containers: - - image: registry.redhat.io/openshift-gitops-1/argocd-rhel8:1.7 - command: - - /bin/bash - - -c - - | - export HOME=/home/argocd - - echo "Getting argocd admin credential..." - if kubectl get secret argocd-cluster >/dev/null; - then - # Retrieve password - PASSWORD=$(oc get secret argocd-cluster -o jsonpath="{.data.admin\.password}" | base64 -d) - else - echo "Could not retrieve admin password" - exit 1 - fi - - IFS=' ' - read -ra LIST <<< "$ACCOUNTS_NAMESPACES" - for i in "${LIST[@]}"; do # access each element of array - echo "Generating token for $i" - account=${i%%=*} - namespace=${i#*=} - HAS_SECRET=$(kubectl get secret argocd-env-secret -n $namespace --ignore-not-found) - if [ -z "$HAS_SECRET" ]; - then - echo "No argo-env-secret present, creating" - argocd login --plaintext --username admin --password ${PASSWORD} argocd-server - echo "Generating token for ${account}" - TOKEN=$(argocd account generate-token --account ${account}) - if [ "$TOKEN" ]; - then - echo "Creating secret argocd-env-secret in namespace ${namespace}" - kubectl create secret generic argocd-env-secret --from-literal=ARGOCD_AUTH_TOKEN=${TOKEN} --from-literal=ARGOCD_USERNAME=${account} --from-literal=ARGOCD_SERVER=${ARGO_SERVER_HOST} -n ${namespace} - else - echo "Token $TOKEN could not be generated, no secret created" - exit 1 - fi - else - echo "The secret argocd-env-secret already exists, skipping" - fi - done - env: - # The account namespace where the token needs to be deployed to - # Example value: product-catalog-pipeline=product-catalog-cicd demo-pipeline=demo-cicd - - name: ACCOUNTS_NAMESPACES - value: "" - - name: ARGO_SERVER_HOST - value: "" - imagePullPolicy: Always - name: create-pipeline-local-user - serviceAccount: argocd-argocd-application-controller - serviceAccountName: argocd-argocd-application-controller - dnsPolicy: ClusterFirst - restartPolicy: OnFailure - terminationGracePeriodSeconds: 30 diff --git a/cluster-config/components/gitops-operator/base/gitops-operator-cr.yaml b/cluster-config/components/gitops-operator/base/gitops-operator-cr.yaml deleted file mode 100644 index f6ebf55..0000000 --- a/cluster-config/components/gitops-operator/base/gitops-operator-cr.yaml +++ /dev/null @@ -1,254 +0,0 @@ -apiVersion: argoproj.io/v1beta1 -kind: ArgoCD -metadata: - name: argocd -spec: - # using this in conjunction with respectRBAC - # defaultClusterScopedRoleDisabled: true - resourceTrackingMethod: annotation - applicationSet: {} - kustomizeBuildOptions: "--enable-helm" - notifications: - enabled: true - controller: - logLevel: debug - repo: - sidecarContainers: - - name: setenv-plugin - command: [/var/run/argocd/argocd-cmp-server] - env: - - name: KUSTOMIZE_PLUGIN_HOME - value: /etc/kustomize/plugin - - name: SUB_DOMAIN - value: ${SUB_DOMAIN} - image: quay.io/gnunn/tools:latest - imagePullPolicy: Always - securityContext: - runAsNonRoot: true - volumeMounts: - - mountPath: /var/run/argocd - name: var-files - - mountPath: /home/argocd/cmp-server/plugins - name: plugins - - mountPath: /tmp - name: tmp - - mountPath: /home/argocd/cmp-server/config/plugin.yaml - subPath: plugin.yaml - name: setenv-cmp-plugin - volumes: - - configMap: - name: setenv-cmp-plugin - name: setenv-cmp-plugin - server: - enableRolloutsUI: true - insecure: true - route: - enabled: true - tls: - termination: edge - insecureEdgeTerminationPolicy: Redirect - volumeMounts: - - mountPath: /tmp/extensions/ - name: extensions - volumes: - - emptyDir: {} - name: extensions - resourceHealthChecks: - - group: argoproj.io - kind: Application - check: | - hs = {} - hs.status = "Progressing" - hs.message = "" - if obj.status ~= nil then - if obj.status.health ~= nil then - hs.status = obj.status.health.status - hs.message = obj.status.health.message - end - end - return hs - - group: argoproj.io - kind: RolloutManager - check: | - hs = {} - if obj.status ~= nil then - if obj.status.conditions ~= nil then - for _, condition in ipairs(obj.status.conditions) do - hs.message = condition.message - break - end - end - if obj.status.phase ~= nil then - if obj.status.phase == "Failure" then - hs.status = "Degraded" - return hs - elseif obj.status.phase == "Available" then - hs.status = "Healthy" - return hs - elseif obj.status.phase == "Pending" then - hs.status = "Progressing" - return hs - end - end - hs.status = "Progressing" - hs.message = "Waiting for operator to update status" - return hs - end - - group: operators.coreos.com - kind: Subscription - check: | - health_status = {} - if obj.status ~= nil then - if obj.status.conditions ~= nil then - numDegraded = 0 - numPending = 0 - numSuspended = 0 - msg = "" - for i, condition in pairs(obj.status.conditions) do - msg = msg .. i .. ": " .. condition.type .. " | " .. condition.status .. " | " .. condition.reason .. "\n" - if condition.type == "InstallPlanPending" and condition.status == "True" then - if condition.reason == "RequiresApproval" then - numSuspended = numSuspended + 1 - else - numPending = numPending + 1 - end - elseif (condition.type == "InstallPlanMissing" and condition.reason ~= "ReferencedInstallPlanNotFound") then - numDegraded = numDegraded + 1 - elseif (condition.type == "CatalogSourcesUnhealthy" or condition.type == "InstallPlanFailed") and condition.status == "True" then - numDegraded = numDegraded + 1 - elseif (condition.type == "ResolutionFailed" and condition.reason ~= "ConstraintsNotSatisfiable") then - numDegraded = numDegraded + 1 - end - end - if numDegraded > 0 then - health_status.status = "Degraded" - health_status.message = msg - return health_status - elseif numSuspended > 0 then - health_status.status = "Suspended" - health_status.message = "Requires Approval" - return health_status - elseif numPending > 0 then - health_status.status = "Progressing" - health_status.message = "An install plan for a subscription is pending installation" - return health_status - else - health_status.status = "Healthy" - health_status.message = msg - return health_status - end - end - end - health_status.status = "Progressing" - health_status.message = "An install plan for a subscription is pending installation" - return health_status - - group: operators.coreos.com - kind: InstallPlan - check: | - hs = {} - if obj.status ~= nil then - if obj.status.phase ~= nil then - if obj.status.phase == "Complete" then - hs.status = "Healthy" - hs.message = obj.status.phase - return hs - elseif obj.status.phase == "RequiresApproval" then - hs.status = "Suspended" - hs.message = obj.status.phase - return hs - else - hs.status = "Progressing" - hs.message = obj.status.phase - return hs - end - end - end - hs.status = "Progressing" - hs.message = "Waiting for InstallPlan to complete" - return hs - - group: image.openshift.io - kind: ImageStream - check: | - hs = {} - hs.status = "Progressing" - hs.message = "" - if obj.status ~= nil then - if obj.status.tags ~= nil then - numTags = 0 - for _ , item in pairs(obj.status.tags) do - numTags = numTags + 1 - numItems = 0 - if item.tags ~= nil then - for _ , item in pairs(item.tags) do - numItems = numItems + 1 - end - if numItems == 0 then - return hs - end - end - end - if numTags > 0 then - hs.status = "Healthy" - hs.message = "ImageStream has tags resolved" - return hs - end - end - end - return hs - - group: build.openshift.io - kind: Build - check: | - hs = {} - if obj.status ~= nil then - if obj.status.phase ~= nil then - if obj.status.phase == "Complete" then - hs.status = "Healthy" - hs.message = obj.status.phase - return hs - end - end - end - hs.status = "Progressing" - hs.message = "Waiting for Build to complete" - return hs - - kind: PersistentVolumeClaim - check: | - hs = {} - if obj.status ~= nil then - if obj.status.phase ~= nil then - if obj.status.phase == "Pending" then - hs.status = "Healthy" - hs.message = obj.status.phase - return hs - end - if obj.status.phase == "Bound" then - hs.status = "Healthy" - hs.message = obj.status.phase - return hs - end - end - end - hs.status = "Progressing" - hs.message = "Waiting for PVC" - return hs - resourceExclusions: | - - apiGroups: - - project.openshift.io - clusters: - - '*' - kinds: - - Project - resourceIgnoreDifferences: - resourceIdentifiers: - - group: route.openshift.io - kind: Route - customization: - jsonPointers: - - /status/ingress - - group: quay.redhat.com - kind: QuayRegistry - customization: - jsonPointers: - - /status/ingress - ha: - enabled: false diff --git a/cluster-config/components/gitops-operator/base/kustomization.yaml b/cluster-config/components/gitops-operator/base/kustomization.yaml deleted file mode 100644 index 9dfe193..0000000 --- a/cluster-config/components/gitops-operator/base/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: -- setenv-cmp-plugin-cm.yaml -- argocd-external-secret.yaml -- create-pipeline-local-user-job.yaml -- gitops-operator-cr.yaml -- argocd-dex-server-rolebinding.yaml diff --git a/cluster-config/components/gitops-operator/base/setenv-cmp-plugin-cm.yaml b/cluster-config/components/gitops-operator/base/setenv-cmp-plugin-cm.yaml deleted file mode 100644 index 44e93f9..0000000 --- a/cluster-config/components/gitops-operator/base/setenv-cmp-plugin-cm.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: setenv-cmp-plugin -data: - plugin.yaml: | - apiVersion: argoproj.io/v1alpha1 - kind: ConfigManagementPlugin - metadata: - name: setenv-cmp-plugin - spec: - version: v1.0 - init: - command: [sh, -c, 'echo "Initializing setenv-plugin-cmp..."'] - generate: - command: [sh, -c, "set -o pipefail && kustomize build --enable-helm --enable-alpha-plugins . | perl -pe 's{\\$(\\{)?(\\w+)(?(1)\\})}{$ENV{$2} // $&}ge'"] - discover: - find: - command: [sh, -c, 'find . -maxdepth 1 -name kustomization.yaml'] diff --git a/cluster-config/components/gitops-operator/overlays/shared/README.md b/cluster-config/components/gitops-operator/overlays/shared/README.md deleted file mode 100644 index d4c08a4..0000000 --- a/cluster-config/components/gitops-operator/overlays/shared/README.md +++ /dev/null @@ -1,2 +0,0 @@ -This is a shared GitOps instance intended for tenants leveraging the new -Applications in Any Namespace feature GA in OpenShift GitOps 1.13 diff --git a/cluster-config/components/gitops-operator/overlays/shared/argocd-cluster-role.yaml b/cluster-config/components/gitops-operator/overlays/shared/argocd-cluster-role.yaml deleted file mode 100644 index a3268d2..0000000 --- a/cluster-config/components/gitops-operator/overlays/shared/argocd-cluster-role.yaml +++ /dev/null @@ -1,184 +0,0 @@ -# ClusterRole to aggregate permissions needed to use respectRBAC -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: gitops-shared-cluster-access -aggregationRule: - clusterRoleSelectors: - - matchLabels: - gitops/aggregate-to-gitops-shared: "true" -rules: [] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: gitops-shared-cluster-access-view - labels: - gitops/aggregate-to-gitops-shared: "true" -# Use the aggrated view permission to determine what resources can be deployed. -# -# Note that write permissions for these resources in specific namespaces -# are determined by the cluster role granted via the "managed-by" label. -# You still need to grant the controller cluster level list permissions -# to pass the SubjectAccessReview. The view role gives get and watch as well -# so if you want to restrict permissions to just list you need to maintain -# your own hand-crafted list which turns out to be burdensome. -aggregationRule: - clusterRoleSelectors: - - matchLabels: - rbac.authorization.k8s.io/aggregate-to-view: "true" ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: gitops-shared-cluster-access-base - labels: - gitops/aggregate-to-gitops-shared: "true" -rules: -# Base permissions the applicaton-controller needs for respectRBAC separate from resources -# grant read/write permissions so Argo CD UI and controllers can update status of resources. -- apiGroups: - - argoproj.io - resources: - - applications - - applicationsets - - appprojects - - rolloutmanagers - - rollouts - verbs: - - "*" -# SubjectAccessReview needed for respectRBAC=strict setting in Argo CD -- apiGroups: - - authorization.k8s.io - resources: - - selfsubjectaccessreviews - verbs: - - create -# Needs ability to list projects for some reason -- apiGroups: - - config.openshift.io - resources: - - "*" - verbs: - - get - - list - - watch -# Hand-crafted list of what we want to have Argo CD be able to use, turns -# out list becomes huge and hard to maintain so I have opted to just leverage -# the built-in view role. However if you want total control over permissions -# you can use these instead -# # Limited resource permissions here for tenants to deploy things -# - apiGroups: -# - "" -# resources: -# - configmaps -# - endpoints -# - persistentvolumeclaims -# - persistentvolumeclaims/status -# - pods -# - replicationcontrollers -# - replicationcontrollers/scale -# - serviceaccounts -# - services -# - services/status -# verbs: -# - get -# - list -# - watch -# - apiGroups: -# - "" -# resources: -# - bindings -# - events -# - limitranges -# - namespaces/status -# - pods/log -# - pods/status -# - replicationcontrollers/status -# - resourcequotas -# - resourcequotas/status -# verbs: -# - get -# - list -# - watch -# - apiGroups: -# - apps -# resources: -# - controllerrevisions -# - daemonsets -# - daemonsets/status -# - deployments -# - deployments/scale -# - deployments/status -# - replicasets -# - replicasets/scale -# - replicasets/status -# - statefulsets -# - statefulsets/scale -# - statefulsets/status -# verbs: -# - get -# - list -# - watch -# - apiGroups: -# - "" -# - route.openshift.io -# resources: -# - routes -# verbs: -# - get -# - list -# - watch -# - apiGroups: -# - "" -# - route.openshift.io -# resources: -# - routes/status -# verbs: -# - get -# - list -# - watch -# - apiGroups: -# - networking.k8s.io -# resources: -# - networkpolicies -# verbs: -# - get -# - list -# - watch -# - apiGroups: -# - rbac.authorization.k8s.io -# resources: -# - roles -# - rolebindings -# verbs: -# - get -# - list -# - watch -# - apiGroups: -# - monitoring.coreos.com -# resources: -# - servicemonitors -# verbs: -# - get -# - list -# - watch ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: gitops-shared-cluster-access -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: gitops-shared-cluster-access -subjects: - - kind: ServiceAccount - name: argocd-argocd-application-controller - namespace: gitops - - kind: ServiceAccount - name: argocd-argocd-server - namespace: gitops - - kind: ServiceAccount - name: argocd-applicationset-controller - namespace: gitops diff --git a/cluster-config/components/gitops-operator/overlays/shared/argocd-notifications-cm.yaml b/cluster-config/components/gitops-operator/overlays/shared/argocd-notifications-cm.yaml deleted file mode 100644 index 4a04070..0000000 --- a/cluster-config/components/gitops-operator/overlays/shared/argocd-notifications-cm.yaml +++ /dev/null @@ -1,557 +0,0 @@ -apiVersion: v1 -data: - template.app-created: |- - email: - subject: Application {{.app.metadata.name}} has been created. - message: Application {{.app.metadata.name}} has been created. - teams: - title: Application {{.app.metadata.name}} has been created. - template.app-deleted: |- - email: - subject: Application {{.app.metadata.name}} has been deleted. - message: Application {{.app.metadata.name}} has been deleted. - teams: - title: Application {{.app.metadata.name}} has been deleted. - template.app-deployed: |- - email: - subject: New version of an application {{.app.metadata.name}} is up and running. - message: | - {{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} is now running new version of deployments manifests. - slack: - attachments: | - [{ - "title": "{{ .app.metadata.name}}", - "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}", - "color": "#18be52", - "fields": [ - { - "title": "Sync Status", - "value": "{{.app.status.sync.status}}", - "short": true - }, - { - "title": "Repository", - "value": "{{.app.spec.source.repoURL}}", - "short": true - }, - { - "title": "Revision", - "value": "{{.app.status.sync.revision}}", - "short": true - } - {{range $index, $c := .app.status.conditions}} - {{if not $index}},{{end}} - {{if $index}},{{end}} - { - "title": "{{$c.type}}", - "value": "{{$c.message}}", - "short": true - } - {{end}} - ] - }] - deliveryPolicy: Post - groupingKey: "" - notifyBroadcast: false - teams: - facts: | - [{ - "name": "Sync Status", - "value": "{{.app.status.sync.status}}" - }, - { - "name": "Repository", - "value": "{{.app.spec.source.repoURL}}" - }, - { - "name": "Revision", - "value": "{{.app.status.sync.revision}}" - } - {{range $index, $c := .app.status.conditions}} - {{if not $index}},{{end}} - {{if $index}},{{end}} - { - "name": "{{$c.type}}", - "value": "{{$c.message}}" - } - {{end}} - ] - potentialAction: |- - [{ - "@type":"OpenUri", - "name":"Operation Application", - "targets":[{ - "os":"default", - "uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}" - }] - }, - { - "@type":"OpenUri", - "name":"Open Repository", - "targets":[{ - "os":"default", - "uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}" - }] - }] - themeColor: '#000080' - title: New version of an application {{.app.metadata.name}} is up and running. - template.app-health-degraded: |- - email: - subject: Application {{.app.metadata.name}} has degraded. - message: | - {{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} has degraded. - Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}. - slack: - attachments: | - [{ - "title": "{{ .app.metadata.name}}", - "title_link": "{{.context.argocdUrl}}/applications/{{.app.metadata.name}}", - "color": "#f4c030", - "fields": [ - { - "title": "Health Status", - "value": "{{.app.status.health.status}}", - "short": true - }, - { - "title": "Repository", - "value": "{{.app.spec.source.repoURL}}", - "short": true - } - {{range $index, $c := .app.status.conditions}} - {{if not $index}},{{end}} - {{if $index}},{{end}} - { - "title": "{{$c.type}}", - "value": "{{$c.message}}", - "short": true - } - {{end}} - ] - }] - deliveryPolicy: Post - groupingKey: "" - notifyBroadcast: false - teams: - facts: | - [{ - "name": "Health Status", - "value": "{{.app.status.health.status}}" - }, - { - "name": "Repository", - "value": "{{.app.spec.source.repoURL}}" - } - {{range $index, $c := .app.status.conditions}} - {{if not $index}},{{end}} - {{if $index}},{{end}} - { - "name": "{{$c.type}}", - "value": "{{$c.message}}" - } - {{end}} - ] - potentialAction: | - [{ - "@type":"OpenUri", - "name":"Open Application", - "targets":[{ - "os":"default", - "uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}" - }] - }, - { - "@type":"OpenUri", - "name":"Open Repository", - "targets":[{ - "os":"default", - "uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}" - }] - }] - themeColor: '#FF0000' - title: Application {{.app.metadata.name}} has degraded. - template.app-sync-failed: |- - email: - subject: Failed to sync application {{.app.metadata.name}}. - message: | - {{if eq .serviceType "slack"}}:exclamation:{{end}} The sync operation of application {{.app.metadata.name}} has failed at {{.app.status.operationState.finishedAt}} with the following error: {{.app.status.operationState.message}} - Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true . - slack: - attachments: | - [{ - "title": "{{ .app.metadata.name}}", - "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}", - "color": "#E96D76", - "fields": [ - { - "title": "Sync Status", - "value": "{{.app.status.sync.status}}", - "short": true - }, - { - "title": "Repository", - "value": "{{.app.spec.source.repoURL}}", - "short": true - } - {{range $index, $c := .app.status.conditions}} - {{if not $index}},{{end}} - {{if $index}},{{end}} - { - "title": "{{$c.type}}", - "value": "{{$c.message}}", - "short": true - } - {{end}} - ] - }] - deliveryPolicy: Post - groupingKey: "" - notifyBroadcast: false - teams: - facts: | - [{ - "name": "Sync Status", - "value": "{{.app.status.sync.status}}" - }, - { - "name": "Failed at", - "value": "{{.app.status.operationState.finishedAt}}" - }, - { - "name": "Repository", - "value": "{{.app.spec.source.repoURL}}" - } - {{range $index, $c := .app.status.conditions}} - {{if not $index}},{{end}} - {{if $index}},{{end}} - { - "name": "{{$c.type}}", - "value": "{{$c.message}}" - } - {{end}} - ] - potentialAction: |- - [{ - "@type":"OpenUri", - "name":"Open Operation", - "targets":[{ - "os":"default", - "uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true" - }] - }, - { - "@type":"OpenUri", - "name":"Open Repository", - "targets":[{ - "os":"default", - "uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}" - }] - }] - themeColor: '#FF0000' - title: Failed to sync application {{.app.metadata.name}}. - template.app-sync-running: |- - email: - subject: Start syncing application {{.app.metadata.name}}. - message: | - The sync operation of application {{.app.metadata.name}} has started at {{.app.status.operationState.startedAt}}. - Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true . - slack: - attachments: | - [{ - "title": "{{ .app.metadata.name}}", - "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}", - "color": "#0DADEA", - "fields": [ - { - "title": "Sync Status", - "value": "{{.app.status.sync.status}}", - "short": true - }, - { - "title": "Repository", - "value": "{{.app.spec.source.repoURL}}", - "short": true - } - {{range $index, $c := .app.status.conditions}} - {{if not $index}},{{end}} - {{if $index}},{{end}} - { - "title": "{{$c.type}}", - "value": "{{$c.message}}", - "short": true - } - {{end}} - ] - }] - deliveryPolicy: Post - groupingKey: "" - notifyBroadcast: false - teams: - facts: | - [{ - "name": "Sync Status", - "value": "{{.app.status.sync.status}}" - }, - { - "name": "Started at", - "value": "{{.app.status.operationState.startedAt}}" - }, - { - "name": "Repository", - "value": "{{.app.spec.source.repoURL}}" - } - {{range $index, $c := .app.status.conditions}} - {{if not $index}},{{end}} - {{if $index}},{{end}} - { - "name": "{{$c.type}}", - "value": "{{$c.message}}" - } - {{end}} - ] - potentialAction: |- - [{ - "@type":"OpenUri", - "name":"Open Operation", - "targets":[{ - "os":"default", - "uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true" - }] - }, - { - "@type":"OpenUri", - "name":"Open Repository", - "targets":[{ - "os":"default", - "uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}" - }] - }] - title: Start syncing application {{.app.metadata.name}}. - template.app-sync-status-unknown: |- - email: - subject: Application {{.app.metadata.name}} sync status is 'Unknown' - message: | - {{if eq .serviceType "slack"}}:exclamation:{{end}} Application {{.app.metadata.name}} sync is 'Unknown'. - Application details: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}. - {{if ne .serviceType "slack"}} - {{range $c := .app.status.conditions}} - * {{$c.message}} - {{end}} - {{end}} - slack: - attachments: | - [{ - "title": "{{ .app.metadata.name}}", - "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}", - "color": "#E96D76", - "fields": [ - { - "title": "Sync Status", - "value": "{{.app.status.sync.status}}", - "short": true - }, - { - "title": "Repository", - "value": "{{.app.spec.source.repoURL}}", - "short": true - } - {{range $index, $c := .app.status.conditions}} - {{if not $index}},{{end}} - {{if $index}},{{end}} - { - "title": "{{$c.type}}", - "value": "{{$c.message}}", - "short": true - } - {{end}} - ] - }] - deliveryPolicy: Post - groupingKey: "" - notifyBroadcast: false - teams: - facts: | - [{ - "name": "Sync Status", - "value": "{{.app.status.sync.status}}" - }, - { - "name": "Repository", - "value": "{{.app.spec.source.repoURL}}" - } - {{range $index, $c := .app.status.conditions}} - {{if not $index}},{{end}} - {{if $index}},{{end}} - { - "name": "{{$c.type}}", - "value": "{{$c.message}}" - } - {{end}} - ] - potentialAction: |- - [{ - "@type":"OpenUri", - "name":"Open Application", - "targets":[{ - "os":"default", - "uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}" - }] - }, - { - "@type":"OpenUri", - "name":"Open Repository", - "targets":[{ - "os":"default", - "uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}" - }] - }] - title: Application {{.app.metadata.name}} sync status is 'Unknown' - template.app-sync-succeeded: |- - email: - subject: Application {{.app.metadata.name}} has been successfully synced. - message: | - {{if eq .serviceType "slack"}}:white_check_mark:{{end}} Application {{.app.metadata.name}} has been successfully synced at {{.app.status.operationState.finishedAt}}. - Sync operation details are available at: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true . - slack: - attachments: | - [{ - "title": "{{ .app.metadata.name}}", - "title_link":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}", - "color": "#18be52", - "fields": [ - { - "title": "Sync Status", - "value": "{{.app.status.sync.status}}", - "short": true - }, - { - "title": "Repository", - "value": "{{.app.spec.source.repoURL}}", - "short": true - } - {{range $index, $c := .app.status.conditions}} - {{if not $index}},{{end}} - {{if $index}},{{end}} - { - "title": "{{$c.type}}", - "value": "{{$c.message}}", - "short": true - } - {{end}} - ] - }] - deliveryPolicy: Post - groupingKey: "" - notifyBroadcast: false - teams: - facts: | - [{ - "name": "Sync Status", - "value": "{{.app.status.sync.status}}" - }, - { - "name": "Synced at", - "value": "{{.app.status.operationState.finishedAt}}" - }, - { - "name": "Repository", - "value": "{{.app.spec.source.repoURL}}" - } - {{range $index, $c := .app.status.conditions}} - {{if not $index}},{{end}} - {{if $index}},{{end}} - { - "name": "{{$c.type}}", - "value": "{{$c.message}}" - } - {{end}} - ] - potentialAction: |- - [{ - "@type":"OpenUri", - "name":"Operation Details", - "targets":[{ - "os":"default", - "uri":"{{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true" - }] - }, - { - "@type":"OpenUri", - "name":"Open Repository", - "targets":[{ - "os":"default", - "uri":"{{.app.spec.source.repoURL | call .repo.RepoURLToHTTPS}}" - }] - }] - themeColor: '#000080' - title: Application {{.app.metadata.name}} has been successfully synced - trigger.on-created: |- - - description: Application is created. - oncePer: app.metadata.name - send: - - app-created - when: "true" - trigger.on-deleted: |- - - description: Application is deleted. - oncePer: app.metadata.name - send: - - app-deleted - when: app.metadata.deletionTimestamp != nil - trigger.on-deployed: |- - - description: Application is synced and healthy. Triggered once per commit. - oncePer: app.status.operationState.syncResult.revision - send: - - app-deployed - when: app.status.operationState.phase in ['Succeeded'] and app.status.health.status - == 'Healthy' - trigger.on-health-degraded: |- - - description: Application has degraded - send: - - app-health-degraded - when: app.status.health.status == 'Degraded' - trigger.on-sync-failed: |- - - description: Application syncing has failed - send: - - app-sync-failed - when: app.status.operationState.phase in ['Error', 'Failed'] - trigger.on-sync-running: |- - - description: Application is being synced - send: - - app-sync-running - when: app.status.operationState.phase in ['Running'] - trigger.on-sync-status-unknown: |- - - description: Application status is 'Unknown' - end: - - app-sync-status-unknown - when: app.status.sync.status == 'Unknown' - trigger.on-sync-succeeded: |- - - description: Application syncing has succeeded - send: - - app-sync-succeeded - - server-post-prod-app-sync - when: app.status.operationState.phase in ['Succeeded'] - # Tekton Webhook Definitions - service.webhook.server-post-prod: |- - url: http://el-server-post-prod.product-catalog-cicd.svc:8080 - template.server-post-prod-app-sync: |- - webhook: - server-post-prod: - method: POST - path: / - body: | - { - {{if eq .app.status.operationState.phase "Running"}} "state": "pending"{{end}} - {{if eq .app.status.operationState.phase "Succeeded"}} "state": "success"{{end}} - {{if eq .app.status.operationState.phase "Error"}} "state": "error"{{end}} - {{if eq .app.status.operationState.phase "Failed"}} "state": "error"{{end}}, - "description": "ArgoCD", - "application": "{{.app.metadata.name}}" - } -kind: ConfigMap -metadata: - labels: - app.kubernetes.io/managed-by: argocd - app.kubernetes.io/name: argocd-notifications-cm - app.kubernetes.io/part-of: argocd - name: argocd-notifications-cm - namespace: product-catalog-gitops diff --git a/cluster-config/components/gitops-operator/overlays/shared/console-link.yaml b/cluster-config/components/gitops-operator/overlays/shared/console-link.yaml deleted file mode 100644 index 42d088d..0000000 --- a/cluster-config/components/gitops-operator/overlays/shared/console-link.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: console.openshift.io/v1 -kind: ConsoleLink -metadata: - name: shared-gitops -spec: - applicationMenu: - imageURL: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQwAAAEMCAYAAAAxjIiTAABtCklEQVR4nOy9B5gkx30f+qvqMHHj5RwA3OGAQwaIQ86JYBJFUgyiRJHm06Msy7QtPkkkre9ZFml9T5ItW6YtySZNijkiA0Q85EM6AAfgIu4Ol/Pepokd6v++qu7Zm9udmZ3QPTML9I/fcHE7O9011VW/+uc/R4QIESLUiYgwIkSIUDciwogQIULdiAgjQoQIdSMijAgRItSNiDAiRIhQNyLCiBAhQt2ICCNChAh1IyKMCBEi1I2IMCJEiFA3IsKIECFC3YgII0KECHUjIowIESLUjYgwIkSIUDciwogQIULdiAgjQoQIdSMijAgRItSNiDAiRIhQNyLCiBAhQt2ICCNChAh1IyKMCBEi1I2IMCJEiFA3IsKIECFC3YgII0KECHUjIowIESLUjYgwIkSIUDciwogQIULdiAgjQoQIdSMijAgRItSNiDAiRIhQNyLCiBAhQt2ICCNChAh1IyKMCBEi1I2IMCJEiFA39E4PIEK4uPduQnzVCDRiIOIQjMDAAJA6LggAo1M/S2AT/1cGOvU7kv8jBsbkdcn7tfw3995jROqCrutgDWZj6XmTLxZhJiJ6iu8y/HDDBswaOBu6yyH3rEtFMIfDYRx6UWeWUdQ1xnXOSbc1YRK0mO5S3AXFGbEYgBgHmRzQAGYAjHk8IWmBbDDmcIIlOCxBKALIOy4VdWIFMGZpGhwXwo05wnE0jbjG4QoHBo/B4QyCGI4sjuPz/UanpypCE4gIYwbiVy8dgx5jSHAd4Jp39MsnKQg3n9uHe986Eou5RpoIAwAGGKPZAJtHDHMBzGHALACDYOgjIA1CEkCcATFf6tT8taFNrBBP+nDlXbyf5BCYJAz5yjJgnAijjGEYwBBAxwCoFyMcJ2LDNuMjNljmxl0566U1aUlC4IqK5OUZNMHw/No0vs6iZdmtiJ7MDMJTb2dgFQVcYSNl6Bgby2lIxOIQop8YLdQJywWjlYyxFYywRJKEJAwAvQBS8AihXXYrt0QmAMYAnARwlED7wPg7JGi3YLSHEzukA2OOqxeEbglT0lA8DodiuOPcmBRw2jTcCPUgehpdigf3ONCzOXW0M9/kQKKgua4+QKDFYOIMRmwNY2wNAWcxYCGAPikpzADblA2gANAIAztAwE4CthBhK4F2c7BDI+gdXkCjwjYNtUiZYMi6PfjQhZGdvpOICKOL8K1rCCv+5zg0JsCtIrJunMMspHXwxZpgaxnDxWA4D4QzAMwH0FOvxEAT/zcJPhlVOsjLf0cVPktlRtAp12YNLy5BwCgDDoNhFwibiOg1AbxlAIfZsMiwOZwcMlEQWXzkgoWNXT1CIIgIo8NY/04WTtZWOjyLWRgb1vV4zJnHGFvNCJcBeB8DzgOwAFC2hmkJopwc5KbncvMyBo0zcM6gaVD/Xfr3xEv9redDUWThf04yA/meFPWTSO1uVxCEfBHBdcn/t/d7+SLh/V052TSgYbieOkMHQXgTjL8gBNsoSOw4kjlwfNnslS6Ts+YCKZ7EunMjI2o7EBFGh3DXGwWktDzcvAOXyNC4NodrdCEB14DhcgCrAWWkrKpeTGxE/zSXm13TGHSNwdA5TIPB1Dl0Xf6OeyShMfV3vJwQGtvI/s1PCRUlEpE/FXkowgAcR8BxBWybYDkCtnrRBNFMJrZpINWYIwC2AdgggGeInDdN2zhRSFpukhKw+lO4Y3FEHGEiIow24tEdeTDHUv/99F6NXbEwNw9g5zGwGwi4lgFrAPTXkiKITkkNmiZJgSMmX6b3U/5b88mBsSobkSprJ0Gg0v3IlzIkSSgCcQSKNqFouSjaApYticUnkSrq0SS4BJxkwGYQnmSMnmYCb26+cPbQeZtHldGHx5K48cyIPIJGRBhtwN07c0gWbMSdHPIsnnTJWa0x3CjAbmHA+QDmVSKJiRPYJwgpNUhSSMQ0xGOa+m/5u5I6MRFUFRYbBICJgDCftCRJeAQiUCy6yBddFCyPVMrVmRokIlWXwwBeg8CjxOkJAtut28U8j/cgbzn44MWDbft+73ZEhBESHt6TBc/YKtrxNV2wtTlawDitA9idDLgOwBIAZqXPlk5ZqVoogojrSMY1xM1TBMHKjI1dzA91ofy7SJVGqi1S+sgVXOSKLoqWUOqNmF76KALYA+AJIjwAwV65/aLBo49uHlVLXaTjuH15rC3f6d2KiDBCwBM7crDzOeRhGRqMFTqx2xjwQTBcDC9o6jSUJIkSSUgJIp3QkfBJQqoYvu3xPYPS93UFKZUll3eQlQRScOA4njEVtSWPYwBeIsHuFZweExb2mZrraskUbj473b4v8i5DRBgB4bHNNohyakZtx4mD03ncxYfA6AMAO9uPjzgNJa/kBEkkdaQTGkxDUzaIctH9vYwSKQifPLJ5F5m8g3zBVcbUaeweOYA2E9jdBHrAFWJr3IxbBEImlsRHz6wo5EWogogwAsBj2/JwrTG4jpEApws46BNgeD+g4iVO83KUpAlJCPEYR48kiaShJImSqvFekiQaRYkYlORhCUUc41lH2T7c2kZTm4BtINxPhF/mdXpzrk2WlUzipkjiqBsRYTSJB3cRYoVxCBAKtpvQiS5mjD5JDB9gwNLJRszSQjZ1jlRSQ2/KUHYJ/T2obgSFUgSsI0hJG2NZWxGIJBJRfXG7AHYR4W4CfkEkNsWMmEXE4FAP7jg/2hK1EM1OE3jknTzY6CgsGAYHzuMcnyGiDwFYWYkoOAdipoa+lI6e1ClpIiKJ4CDJQwjAsl2M5xyMZmwUVN4NVZM4JHHsIKJfMmI/Fba2VY/ZLtPjuOXc3raPf6YgIowG8MiOLLjtYtR0eCpLq8DokwB+C8BZfobnBCQZaBpDMqahP20gndKVhyOSJsLFhNThEjI5GyMZB9mCo/5dZbE7ALaA8EMi9suhkeHd8+bMI8OI4frVkX1jMiLCqBNPbilini2wV+TmgdNHAfwugIsmu0ZLRJGKaxjoMZBK6jA0T+iIeKK9YL6tI5t3MJKxleRRgzgKAF4Ese+Qyx/gsfyQafbjhlXJdg+7qxERRi3QX+DxLV/2KkflKeXq7o0M9EUAN/rp4qf+1CeKdEKfIApdqh2dG30EH566QsotOzxmTUcco0TsEcbwj8TwvK7reUPTcf3qVLuH3ZWICKMGntmcw2ExwvqFeY4g9gUw+gSAReV/o4iCA8mEjsEeQ3k8dC0iim6EJI6SxDE85kkcrlvVxrEHYD9yGL5jFrHb6EnSDWcn2j7mbkNEGBWwfnsWju2gAGvQcNlHGMMfEOHCcjsF+QswGdMw2Gsqr0dEFDMDijiUjcPByTFLeVYEVdwMtlJTQP+DhPaAHuNjOo/hvUwcEWFMwtPb8jhycjtPJRZeqHH+hwA+4letOg2mwRVR9KcN9d8RUcw8yMVvuwJjGRtDYzYKRbe8znE5jgP4KZH4h0R2zhZ7MEe3rHlvqigRYfh4ansejmPBtZx+wfFxEP2hKlZTNkdyMemcoS9tYFafqRLAWGTMnPGQz7BoCyVtjIxbsJyK9g1BDK9AiP/quuy+WMIcJ8Zx65qeTgy5Y4gIA8AT2zLoORbDyf7Rc4jwr3xX6YRUUTp1UnENs/pjKjpTiwya7yr4NZSVfWNotKjsG5XVFDpGjP0AwLdu75+1+6mxPK5f+97xpLynCWPDdgsZkYddKCY457cB+AqAdeXBV0RQ4VmDPQYG+0wVqRkRxbsXjEElt0lJY2jMUpmyFWBL7dUV9Demw59gSd2Sf3fnRVM013cd3rOEcf9OQj5zBGnNmAPBvshAXwKwuPR+SapIJ3TMGYipn+/d2XpvIl9wcWKkqELO3cpG0V1E+G+c0fc1XR9maQM3LXt356W8J0swP7k1i/s0oBfG+RD4zwz0tclkYWgMcwdjWDIvoVSQiCzee0gmNCyam8D82XFVl6SCZHkGY/iPBPZXdtE96++W3oXHt+c7MdS24T23DZ7cnsdQLq8nubgJwNcZcMXksO5kXMNcKVUkDVXJKmwVRHUM4gx+SyK4ROpEi9A9yOUdHBspqszYCpAqynqN2DfGdPZsWmPitjXvTvXkPUMYv9i4FX2xhXBdN80gPkOeveKM0vvkb9r+Hh1z+mOIGVpbbBUGZ0jpDDGNqS5gEg4R8i4h51eZaiem5rlMdTS+F3sLMVXnhDA0UlS2jSqRolsE6BuWW7wrFU/nIdK4ZW23t4hpDO+JR//jLW9gCT8PY7mTc7km/iXA/gDA7NL7ckuYOlNEMdBrqkzSdkCSRb/J1c9KkIQxZgdDGl6LgFK7gFL5f1Jp4Or3pWK901XsUXV9/ALD8KqO89JPvwp56ffvxsUl52gsY+HocFHVHq3Qr/oQIP6rzdg/9SXNkevO7OvQSMPBu/GZnoaHdo1jtZXGlvzRlZqmf40Bn/T7e0xAqiDzBj0VpF2Qm6vf1BDXqj8CuW/HLYGMU9FSXxXC7xvi/SSl4oiJl0cQCDh+pPQtSsThtTJg0Bib+O/S798NyBddHDtZwFhlFWUMDN9hTPtbztiBmBHDtavfHdGh746nVwWP7y7ixsdM/PryoQsY2P8L0J3yYJ/4Awb0pQxFFnGzPSpICTHOMBDTMJ0wU3QJw5ZbVcooSQ6SFBzVD0Qo+4dQ0gR1hQuY+VKJRyBS9eMqAE6SyUyVROR3smyB48NFlZci53/S9yiA6BfE6D/kkNuZzC3BHVdonRpuYJiJz6ouPLZtDBaBk128QiP2DQDXln9fqXbM6jOVGqLr7S9mk9I5+szpnVRyIZ4sCthljCHKCMIRXpEY0SXkUC9KjZcUcZQRyEySQJj/LIZGLUUczlRLtQvCr4m0P7/9wnWvPrzjddw+wyWNmfN0GsCj28cwUjjJepC+GcBfAqrloPquKhBLZ8oLMthnqgXaiY3WCGEMFV0labg+QdjilIrxbkFJbTG4JBGPQGYKeXh2DRtHTxZQsKfYNaQ++bQQ2p/tjw2/uNSZTXecP3Mres2MJ9IAntyWw2hhVDdIu4Nz/k0Aa8vfjxkc82fF0ZvubFesmMYwYE6vkuRdgcNZGwXXPdVe8F2OkpvZ4Fy9tBlCHtm8gyNDBVV3o4Ix9GUC/mxkvLh+4ax+cf0MTV7r/qfQAJ7cmkMxm9dIFx8Gk5IFW1N6T260ZExTZJFOdt7VJYlCEkZsGqPn0ZyN43mrrWPrJqg2DJI4NA7TJ49uBfONoYeHCip1vgJeg8CfuIX842Zvn5iJtUO7d/YbxFPbcsjncgZxfIQxSMnizNJ7pEK8NSyYlVAekW45pSVZSLVEr3J6jsrFlyueZr94L0NKGaZPHgZnE42kuwle5quLI0NFVYi4At4gwp8ULfuRVH9a3LJqZmW7dt+MN4GHNmdg5jLcNrTfAGP/yS/KOwEpUSycHW+bJ6QkUnM/A9KpYWvQGZDQGRI6h+Y/DkkQY7aDE3kHtmjMpfpeQEnqiGkeeXSjumI7QqknI+MVSWMTCXxlXIw+tii5lK5aM3OaRnffTDeIJ3YUMDw6qqdM/f0A/TWAVeXv96Z0LFC5AO2O3OQTVvS8S8jY4rT7u0SwXIGi6yoRSP697ovbRVeo92r01ogwQcwecZhdRhxecR7C0aEChsetSl64112Irww4vY8X0kQ3zhDvSffMcBN4/u1R7M/FWS/GbmVgfzPZwNmb1pUaUiVxKFDIvZ7UOZI6m6JilAdgiTKicMpUjfLxzeiH0iHoXUocjksqwOvkqDVlDRLwEhG+nEmmNgwIC7ec3f1Rod0zsw3ivjfzGGAnWEYkrgaxvwPo4vL3lWQxJ4FYyPUrmG+LSOm8pgHTEqS8HTnHOY0oIgQLSRxxnzi6wcbBfNKQksbJsamkAeAZIvZvDE3bWDQ03Hl2d9s0Zmx6+4p5Qxh3kxeB8JcAXVT6vXwgvUmphoRPFpIfegyuQrxrkUUJUqqIDJjhwhECWdtBxnaUJNfp2VZJjRrD3Flx9PdWbIx0FWP0F7ZwzlrT/uE1jM5TcIO4fwfBdEZRKNpnmlxKFqrpsReUBaAnoWPRnLhqTRjmYpEEIcnCrNPNl7UF9o0XahpAIwQLKWDENE299A67Y0s2jcMn8pUMoS4BPyMSfxoz4vs2bn8e/89Hb+/MQKfBjJMw4sUhFB1nvs7xNQC3lpNFKq55Bs4QyUKuu7QvVdRLFlKoGLWciCzaDDndBcdFxrLVT+rg/KsC0hrzggZTU7wiUj79DQ3831lFZ+Cy867szCDrwIwijPXbx2A51KMR/i0H+2R5IlnC5IosErHwyMLgDH2mpiSLOjQQhaJLOJKzMFys6F6L0Aa4RJ6aIkm7w25qU+dYMCum4oImrdM4Mfwe4+L/zhdyyce2jXVqiDUxYwjjV5sc2IWsyTn9Dge+ICcY/ikiH4Jk7mRcD40s4ppXuyKh1ZddqZLGCg72ZQoYKthtL4QTYSosITBuOcg7TsekDXlXKQHPnx1HMsYnu1t7wPBH3NV/czw7zp/a3X3l/mYEYTz9dg5HR10moL8f4F8BMFh6T9cZ5s2KoWeqmBcIVCFgXwWpVuhmMrKOwIGMhUO5IvIN1rKIEC4EEXK2q4yinZI2vDQF3+U/NQFxPoCvxrl5neMW2XO7u0vSmBGEcfL4OFb2jl0AsD8DsKz0e8a8Kll96XDa8ku1o9fkSgWphyscQTiet3FgvKhsFlS50nSELoDlCqWiFN3OkUYqqataLNrkFpsMqxljXyvm7NUjue6KAu16wli/PYdESltCjH3NT1OfwGCv14EsDHe77tsrUjqva9PnHIGDWQtHcxaKYmrptpkJVvZ690HZNiwbOdvpWKkAedjJQ2/SgST13usZ8BVOuVlP7Mh2ZGyV0NWE8cTWHEat8QQBvw/gzvKV25P0+oWEkb1o+rU2a5XPK0EVUCk42J/xpYqZsr0ky3IO4pp6Qb04qMS+RGDkggnHe5HwzkVV+YZ7f6/ppz7L+IysDiyfV95xlVHU7YChSS5feegN9FTynLCPw6XPZfPZ2DO7c20fWyV07RN+9BULNh/XOKdPgOHvAMyF/4ATpobFcxOqb0TQB0NMY+g1qhfmLYflqyAjRadSibbugqqTJ0VfpjY/s4vghSx4bhxabhQ8NwYtPw5eyIAV8kCxAOY4YK6jVjVxHWSYICMGiifhJnogUr3eK9kLN9kDMpMg3fDvQX4J8plj7ZVSZVLXVUJbOyHXjWULHDiWVy0aJ/HuXgH8YSqtP0DjBl1/YWfraHS+MEQVaEszEAfpAmL4tyWygO/LnjsY89LUA16LUqLorZFuXo6sI3AsZyFju+rf3UcWzDu+5E/hKnLQxk7AGDoI4/h+GEOHoY0PgWdHwYs5RSBMJcIJ+BWEQVK/91V8mnxdKY1IcjDjoEQabk8/nIG5cGYvhj13CZxZC+Gm+xXBqM8oAuluA7AjSBlDk6Qhprev/qaqWm9wZc+wHKEaQ5etp2Uc+OPMeHE7UrG32zaoKui+dQ5g/bY88vn8bM7dvwPYp0vjlPt47kAMcwbigUu/CUUW2rTxFaTqVDg4mreVwazrJlBJEhxwbejjJ2Ec24fYwR0wDu/ySCI/Dji22rxe53lWmt2pKoXa45I4PAI5/T0q+0meRCElGE1TJOL2DcKZtxTFxWfBXngm7DmLIeJpb2ySOLo4iE3OQkLXEde1tmpZ8lYnxywcPlGYrB5JXfcfXcG/lk6lR69bHY6Rv94xdhWefyGH8WTRcMn9EvfqcapsHDl9/WkDC+cklJQRJBK6VEOmJ4uSvUKqIU5XqSDeiS83olQtzMO7EH/nDcQObId+8ognQRB59gnWhBGTCMIh1N2OzVdHpAJEmg7R0wd7/jIUl5+D4srzYc9aBDITXS11yBmShJFQpNG+Jy2El6h2YnRKlbUhAP8uyXq+f+35sY5NWveseR8/y55A7w52LTj9r/LaFjGTY+m8JBIBqyL1ShZSXD2Wt3Gy6AVhdcfE+UTh2jCGDiG++3Ukdm6EeXQfWCHnbdgAjZHk+GpKo/OvvEakpA/RO4DisjUonH0ZikvXwO0Z9HsldCdxxDWOhKG3LWVe2TMcgf1Hc8jkJ9cGZa8R4fPxROr1G1bH2zKeSuPrGjy2Iw9nPDuHdPwPBvxmaXycM1Uxa6Bytl/TiGue63Q6srBcUu7Skhek8/CIgjk2jON7kNyyAfGdr8EYPgK4TqgeC6mekNMEaUxcQChpRySSsBedgfy565A/6xK4fXO897uwwlhM40i2mTTGczb2H82rhLWyu7pE+A4Y+xPu9A3fdkn7TZBdQxgP7RiFm3cNjdw/YEz1EZkwBw/2mipPJMgWhjEV6j09WRRdgUPZU8bNjkMShevCOLoHqc1PI7H9ZWhjJ70TmvP2PFIhVZRTBtGmoNy2Qnle7IXLkDv/WuTPfh/c3tkTKk03od2kIXFsuICjJ4uTyXmYiP3b/HD8n5ckkuKyde3dwl3jJel3NIwy6yKA/YsSWSgXaoxjdr8XbxHUEjK55zqdjiwKqsR/l5AF81x9+vARpN58CsnNz0EfPubHRkiJoo1dtTgD17ln12g2doExkByz68DYuxN9h/ciseVFZC+5GfmzLgbF07600R3E4UWEOm0jDXmHwR4TubyrXK1lGGCMvpTsL7ywb3B4W+gDqTCujmP9tjwK1ngfU5Wz2O+WxiVJYuGcOPp7glNFvIzT6etY5B2fLJypPSbaDs7BCzkktr+I9MZHYB7d420m3uG4Oylp2AFJAyWJI55E/uyLkHnf+2EtPMsLCusi+0Y7JQ15i0zOUfYMyzlNNZGz/vfksD/n6b7s7avbd+53hYRRyKlONXeAsQ+U17foTeuVagc0jVKFrGnJQkoWOQvZTpOF79Ewj7yD9MsPIrnjZWXMLEVldhzysRnwSaPFa5UkjmIByU3PwzywC9nLbkH2ghtVcFi32DaUK525SLbBeyJ5OJXQlUquVJNTkJviE0Lnj99h/4cHQx3EJHT88Hx6SxY5O7cSxL4Nhuvhk0Xc4Fg6PxlYfQv5RXtVbkjtr1wos1l0liw4mJ1HcusL6HnxfhgnDlSOlegCtGwIrQThAoaJwqoLkbn6Iygu8h1mXWLbSCiXq96Wx2FX9ZrgPpf4F1OJ2NHrV7cnArTjx5Rj2TojfAIMV5R+JwWAwT4T8QCL4aT8it61YLmEI1kL2U6TBecqCrPvqZ+i/7F/hnH8QFfnajCNgekBLyUpRTkOEltexsA9/xPJN59SXqGSLafTKDiual/ZDpg6x6y+WKUyg9drTHyk4Ii2TUpHV+AT28Zh5YsXg+EHYFA1UEtFfJfMS6q03yCQ8N2ntTQRW1X19lynHQXnMA+9jb5nfo747jc9/b1LNsl0IFt4UaEBgwkXIplG9n23YHzdByFSfV2hokj+Thm6qhkaNogIh44XMDRmTd60LzKw3zNjia03nJ0MfRwdW4m/fJtg5wopMPZZsFMBWpJFZ/WZgUVzGpypAji1yMIlLyiro2ThSw/xna9i8KH/jfjOTac8IDMESsoIIXuYuAaWzyL93P3of+R7KnpVSSAdhtSO8rYLuw01NThjSuo2p/bYuUiAPmHbblsKZ3RsNV6YewmuhnVg9FEAE0+/L22o1oZBnFMlI2etzFP50E8UnM7W3GRegljqracx+PC3YRx5p30xFUGCyX3Mwhm2JE7HRfL1Z9D/4P+CcWR3V5CpPGxyjpetHCa8EANNuVonTa/JgE8JUTz/8e2FUMeAThHGl39F2MrOTDOw3wawBKWMPZ1joNcILEArqU9f02LEcjCU72DNTcZUCnl60xPoW/8jaCMnuuL0bBoaAwurpL+fnh/fsQkDD34b5sEdXTFXjiBVhCdse6yc1f4ew3MEnH6vM0D4tGNZoeskHSGM//IbDIz0axlwB07lSqKvx1C1DoOY+LjfjawWMrbAsVwHE8lKZPHqI+h76ifQMqPd4S5tEUo1CXFCiXGY72xF/0PfQWz/tq6QNCxXqOLCYUIVEDa4crNOWiY6GH5DuNYlT20Lt3Bw22f6nh153P/a2ACH86mJojjkTcRAjxGII0Bn09stSvkhHSunJ8lCqiGbnkDvc78Cz2ffFWShILWSkIvQENdg7t+Jvoe/q4zE3SBpFF1XEUeYUE6BlFGpQv4yBvoE2SLUrLS2r9DdAtA0+yoGuqW8zkV/rxlIAyJ5wZTBagZneUbOTgZmMfXkk289g75nfgGezzR+SpbnW5RqYKB74hSYFn7MiJI09u1QhlDj2J6OSxpSrc23wZ5h6EzVs51UnpKD4YMFN3/pE9vDK+fX9hk+3y2mOfAJAPPgr++4qaEvHUwQTExjSExzug0XHWW76JhJkTHEd21E77O/AM+ONbXQmWmCz5oFfelS6CvPgL5yJfSly8BnzwYMo/PEwXzSCBnENJh7tqPviR9BHz3WcUnDEYR8yPYM8mvapqaUemCLieFjjm2HZstoa2j4kzuyyOez6xj4zaXfKemix0DMaL3Ohea3MaylimRtFyfyHaxpIUXpg9vR/+RPoI8cb3yBMwbePwBt/nzwZFKKa6e9rQkBkc3CPXoUYni4o3kYkjDIZaGTlzKEbnsVvck+jNzyWa+yVwcJU6olOndVAZ6woGtc7Zts3ik32MstcKdw7R8/sbXw4o1rgtdO2iphOHYuxcA+Wi5dxEyO3lQw0kVSr50nYvtFey3RKSMnhzZ6TAVlGcf2NUUW2ty50JcvB+/p8ats0ekvSSg9PTCWLYc2b15no0NZ+5JoJS8m3ngW6Y0Pe4WLO/i9yY8EDbNRkrxHOmkgMdWWsQKED7mOFUpcRtsI48mtGbgOPw9gt5buK59pX8rwbBctHgimxhRhVIO8/MmCg/FOhX3LjWzl0fvCPYi/82bjBk4i8P5+aAsXgU2ncsj3DB3aggXgAwOdTRHnIcVlTIZcTJaF9IaHkNjxUsfD6F0irwF0iPfQNaYcBZMyZzUwfMh17TMf2xG8x6RthGHbri6I7gSwHGWVkvvSrXtGVIiuzmrWt8jaQpXX69zWYUhueQ6pN5/192+DX9owlMQwLVmUQKT+Vp83H8yIdUxEZ6yNCXOMg4+PoufZu2Ec29txr5NUTSwnvHwTpqQMXdWMmfR4zwTo9iEKXr5ry4w+9vY4HNdezqAIY+JL9CR1xKYGoTSMOGeI11gcjiCcyFtKJemM3YLDPPy2yjplxVzjG0hKFz094KkGdXNJGqkUWE9Pw0MODMqB075ZJ8ZhHNyDnufvbc77FORYVPazG1qDJFIek4qHbhwMH+wtZhY+viVYj0lbZtN2MgycbgJjq0u/U60I00bLA5BrMWnwmntwpOh0Ll1dnnq5cfS89AD0k4ebs+IzBpZMNXdicg6eSnVURGdtjnKXnJrY8hKSW5/veHS9PKyKIWa1ysfak9K9HJPTeekiDXTFz3YEK2SEThgPbBaArc9mjEnpQrl7lMEmoQdS6yKh1TZ0FlypijgtlZ9sFXLhJnZsbH7XMAYuVZFmN73ZwmeDAG9zHQ9JsIUc0i895KkmHY7PKLoiNAOoF/SoVXIc9AvBPvhbZ+YDLZQR+kwuOsoBMi8EnWqkzBlT1bRa7YuqSelCZ1W3oZQETxaczjUcYhz60EGkX39cdRbr2Kbtgliudu9Zqb5rRw4i/epjYE4H597vZ1NwRGiPQX613pQxNcOb4eqi45zzzNbxwO4V+mPcO3DcAJzbTw/U4qr0WKu7WEoXtTJRc46rupR1BCpPxFZJZU25UMtBBGHbzRsuLavzgVzt8paUQxASbz2P2N7NHZcyLBFeGrxSwWJapfahiwDc4tp2YHpJqLP4g82vI8axhIGuLw8D70nqyljTyhqWZJqoUUGrJF3YndoojKsOZMmtG1rfrESgbAZoRhd2XRXI1WnCaGf3sLKbgo+NIv3a46rJdEdjM8iLzQjrMWgaU1LGpPPTAMNNlmDzz3j404HcJ1TCOG7tBQO/sryDmfxiPQEEasWnkS7GbbdzMRdgSgVJvfEktNETrZ9ujEGMj0NkGlz08nOZDEQmOJG0abDOkAaBIbbrTcR3vd7x2AxHCFgh2jKk1G6apxfYYcD5DtkX7bz8h4HcJ1TCWK1fkRYkbpzoM0JAMqap3JEwpQuXCMMFO/QkoKpQbtSdwS5Sx4F79AhIqhf1XJMxkGWrEHHU+5mw0YkhSNUwl0PyzadV39lOu1mLUuILaV2aBlfOhEmYxRi/4b59I4FEfoY2e49uHQe5fCUYu3yi5aGvjrRq7IxNJ11YAlmng2nrdhHJzc9CywwHt0CltDA6Cmf/flBxGiNeiSwOHoAYHekOsgBCKd9XD5SUsWerb8vosJThChUPFAbkV0sn9cnFghlj7FounIXffeNoy/cIjTC0jJAXv4wBKzARrdy6sVNOSlyr7hmRUsWIFX6KcVUwDuPEftU9PQyIoRNw9rwDMTICKCOa77IsvYRQJOG8sxvuieMdt12chk7t1ZKUsfUFMKvQ8TwTy3VVUd8wLi4l+Jg52T5IZ3JiF//ueXNbvkVo2arFJJKw6TqAJUq/S8YrfZnGYPLatS6ytuhsmwASSLz9CvSRAGwXVSDJgjIZsFQaLJ1Wqe4KtgWRyUJkM4Btd/w0nQxJ88Q64+ZV1ar2bIF5ZBeKS88FqHPtL20pZWik8p+ChPyOujyU4zqy+dO+Xy9n7Lr73hp+UG7NVu4RGmFoYEsEY5eW/q3yPRK6qtfZLGEwv/ReNb6Qkt6oL110LBt1/IRnu1DtAUJK1ZQqhzylpLoxNuoTg999zM9Y7TayUGA+aXSCMRgHGxtB/O1XvaZI6tl0RvoqSRmGxgNfp15+iYahMQZxSvXhYHRZgusLAOxp5fqhHIFP73bhOsVLSwV+4VcJSia0lp6RxpkqkFMNeUd0tnEyY6rGpHHiYHuMayVSoLJWhd1IFOXoZLa9KxDf/Qb0saGO2VNKsAXBDcFjoroGmpoqeTlpq61ybPuc9Ttaq44fyqq28rkYgzJ2eqHgfmCJqU/5Eg0hxr16ndUwZjmdSzDzjZ3xPW+CWZ2NLOxasM4SBjEO/fgh5cHqdJKJIAqt/qdSSxJTpNtBxvA+x7FaEntDIIx/A5ec+QAuLq97IfWqVrwjnHmxF9VguaTiLjoGvzhO7MCOzo0hQm2oHJOC11HO7WAfGh+WEKG4WOV+S8r9dvqhxRlhHSPqa+XagRPGq4f/QurXZ6heCSVDjMaQiGstkbrOWU1XqlRFrE7ljPgwj7wDbfR4x8XdrkaHp0Z56w7shD5+suPh4kJQaC7WhMlhGKfbC4nhbMspLH9px2tNXzfwGRs6Ns4IJKWL2eoXfguBVr0jMV7d2OkSMGa7Hc1Iheso+wWzrc7viq5Gh+eGMegjx2AcfafjaiP5HpOgKUORosGVLWMS5migC9YfvrDpawdOGLrWm2BgF5V7YOIxTRUtbRaSKGq5UouqiUwHXamMQcuPw5SLMEJ3Q6kleZiHdqv2lJ0mMEeIUArscMZUGMMkTkwQ2MXr+kdjTV83iMGVw4E7D4S1EzdgXjBJK2Sus9rqyLjlqkIlnYIypp085FUBj4yd3Q9XqP61vJjt+PNyicKplcE8R8Mku6H8x1qL89nNXjZQwrh/I8FxrDPBsLD0O01jSsJoBWaN2As54dmQi61OBzk04/h+8EKu4ydW16MLpoekWjJ0GFqmO8LmbSECD8iV1zMNPiUrnIDltmstfviVI01dt6HArce2ZCpHyHmNvDB0jFjfADsXQC/KWiC2ksrOfPtFNRQcrzhJJ9URuLYiDGV574KWfRGmA4M2PgJ9+AjsOUs7PRglHcuDr1bIQDPQ1WHNkS+e2rNM1aWh1UgmXnxs8yjK3xCq+76Om1dVL9JVN2E8usPGtrffxhmL585nhAu9gjjEAeaC0WGH2Ka+3uFxBpyr8vD9QUjpQmshBFbnbHIyzWmQ0kXH8kYUGHgxB334KDoU9Tyj0BVzxJiKlVE1VrsAwldL9IAPG8YYEqaGEXaaCznOGHsf2fYeF1hCRKafnzdsc/5W3iq+88z2vLhmdaLiNesijB/nx5DfUeRnLpp7E4A/BlPl9uKn5EuW0xmeB6cfM2A1lWWnxk3e0iIxeHUvpSSKnK+OdE7CgKpOrY0NoUMhYxGagSuUWgLhdIWeJAmDVEuR4CAFlpjJlR2jzLAqb/FJAn5TaQKnipTYOtGOHvC/LxbyP39wt5V//0pzyjXrIoxF6wWyi+zzwfCfAFxS4U8kHX0QDBcSoGrak6pbwWAaWtPHirIN8OqZqZZLSiXpLBh4bhQ8P9YV+nCEekHQR08oNzgZ8Y7LPVItkZKGFvAaMg2uVBPHpfLlOavCXRKMcCmAv3Qhxk4Qv7vS9eoyep48gwxAfAzAdA7cJQD61X+Rlz8iB9wspGRRyzuSd7xqzJ3cpiowLTMCrtKmOziQCA2BiIGPjyh1shuIXpJF0O5VqanrmmdDbABLBPDZ+Xa2t9KbdV0pZfMUA84pb0JUD+RAJbs1a2KQbFvLEJR3RWeDtXzw7AiY23mf/oxAt0yRVCULWd+12unBeAdPGO5VTWOqbF8jYMAqLjCr0nt1XcmFK/WKxkp8MU8c4i2ESes1ojsdv3R7p8GkGJkdVYVrIswsMKuo7E/dYnuSazpoxUjZMaZp9DUZUjlwBatorqiLMKiJCgbKHdrgQCejljZjuaSSdzr+qEmoRcc6b/uP0BAY4NhKyugWCEHlNSwCQzP7UK+iFoSWfcN9CaNZMNROZS+6osPuVB8kwKzgu2RHCB9SjZTPruOHjg9lxwg8gsszDbRaR7eE8AiDM8/Y0rT9AjW7sRfc4KPjmgETAlwlnDUAKnuJslf579/N6JodKsm+wWcXIsgPFQj6mprGlfEziEuHUqLPS2nnyuDS7Bg1Zb+ovLLkpBb9LL/Orj3mSRiuVf17kletTxKC/KkCZQU7VQR2UhMJlJr+cPKyrzUvC7vdDY27AqUpIubPI5vy3gQm5o7UMegtHao9Z0RgTufrYpTDDSEeQ+OexzLfUjVPD+HU9CQvLLVZg2cphqOaRuIKz4bRNZhM3eQRAzn+T9cnDSr7g1qXK3+/VJ5T88pQcsMvR/luJQ/yCUJ4BDFBEnU+bgI7nTw076dHuJOfE4GJDrXSrAJ5GMrDJMimT560H8z1QisCLAfYrNrk2S+q7wmbSFmUu2fPeCNREoQkCauMJFoF+Xwkr20DoggwHeC657cKq85w2yHJwWXeHIoWn2y5ZCJ8ElFSGoFp5BHJBA91zyqCX8iaQhCdDb01B0QJoRCGHJiuBtjcCJkvYVSD7YpQrMkNQ6kOmlqYciMLX6II1QZBHnG4NsAsjzS4OZOI4/TnSiWicFm48yZO3csjDqFOJdLMrgjcKkFKFyriM2DGkBK//Jqt2jFCkzCmtJ5vAGof1vi4JTpSqP50cA5WyCG+5RWwvYfg5tvfnXxC3bF90jA7XnWufghAuDx8opgMpS5K4uBgLgMfHlLNjcgwuyKWpmT4DKSvoQ91gGveAd5qA6XQJAytBUZjqK3O2D5hdKo6uIR+eC9SzzyI+JsvqQpOje9UqrxRmjjtJGm4cggOoMUaDrFrK1RHBIdD2F6Ryc6BgRxC4vknwLJ5ZK+6De7cRf4AO3schVEYWPO7Bba6b0IiDNZySb5qHhLhE0ZHwJiyqsfeeAHpJ++Ffnh//U2DSgux1GhI08B0Tf30WhySKhlHjuOddOUNieokESlpyI/zGKDFu88wSg7gFuQ4GxzYhEdp8maetPwn5gv1fXnGwLNjSD7/CIy9O5C94UMonnsZSNM7ShphxBcpr6PcWO40nqNpEDhhkL/hW+kCx2tI9yKskmbTgWtg2TGknnsIyeceUQtt2mI5pY2v66qtoTZ7LrR5C6HNmQ/ePwieSoOZMU86IaGaLIvsOMTwENzjR+AeOQT35HFQLgu4rq+rTUPEkncKHrPyRPeoKMLyxlV3h8Iy0mSmCZZMg/f0gvX2gyVT4GbcWyhCQBQLoMw4xPioelE+57WKlJ/nfJrG1d4EGQd2o/eu/4Pc8UPIXXkbRLLXr/nZfpSfK0GBK8Jo/TrBSxjkSRit5JDwGi5VdRC3RpJNDIhDGz2B9CM/Q2Ljs/4xXoMsfEKTpKAvPxPG6rUwVq6GNneBWuxM12ufgEQgxwblMnCPHoK9cxvsHW/B3rsLNDY6MaZakBuUBKAlPK9Kx0CeZ0dKFnXZKuTcyQOjtw/6omXQV5wJfclK6PMXgfcNgMUTgKZPGNSp9BnHARVycCXZHjkAe89OOHt2wj18wCNcTDNnXAPPjCH92F3QTh5H5taPw+2f3RG7hvCTMaoXdmgctaT2RhDKUuJ1HIQ1P19jO7kihPDZmoPRoJ08ip4Hf4T4Gy+eOrUqwV/s2tz5MC98H8yL1sFYvFydjg1BEqZhgvUNgvcNwli1FnTtrbD37ULx1RdgbXoZ4uQJf3zVJ1qpADlAS3aINMgjCkkY05KFlKB0HdrCpTDPvwTm2osVYfDe/pofU+tEcrecr0QSfGC2Iuf4uhsgRk8qkrXeeAXW5tcgho7Xfn7y966LxCtPK7vU+J2fgTtrftslDQrYtVqSVlo5xEsIzejZSuBJre/lBbY0fenGwDi0kRPoeeAHHlmgij3Bf8J8YBZil12F+JU3qcUeiAxYGkq6F+Y5F8FcfT7sq25C4bnHYW3cADE2XFPaUQbRTpBGiSwK0/2d8OZ56QrEL78WsUuuhDZ7futzx7kij5h8nXcJnIN7UXz5GRRefhbi+LHqtiHfUh9/80WVazL24d+BOzivrZIGTQTvBSdhKKm/W+MwJJO1Iv3U+qhSSZq/dP2QCy47hvSjP0f8zZerk4VcSJoOY835SN72YZirzlMnZWjQNBgrVkFfvBzW2ouRf+Qe2G9vmdh4lVDyoijSaFO8hopLmS4UWbhgPX2Ir7se8Wtvhb5wSTiWWk2HvvQMNWfmhZcjv/4hWK++ACoWKhOT/5xjWzeix4xh/IOfhds70D7SULEYwV5yRkgYTVcKn0bCCN1xrxorW0g+/QASG5+pboESAizdg8QN71cvqWO3C1JliV14OYylK5F79B4UnnnMM/ZVOZmleiJ80ggv5dDDtDYLf2HoZ6xG8v0fR2ztxYDeBl8w12CcsQb6ouUorjoXuUfuhnv4YJU58yWNTRsgUmmM3/EpkBlvm/ckhMoY3hJukTPCkTDk4Fr4vtPkC7XlmcXeeAHJDY+pFogVT27XBZ8zD6kPfRKxy68Da8eCrwA+OAepj/w2+Jz5yD/wc4iRk1VVFBX7UAzX5arC16cjC84Ru/gKJD/0SegL21/mn8UTSqLR5i9G9u4fwN6xxX9j0qT46kni5afgzFmA3Lrb/L8JdwFShfSkltGimaCEcM6aFpms1hcLPQRDnkIHdyO9/h7w3HhlshAC2sLF6PnM7yN+1c0dI4sSWCyO5A13Iv1bXwCfPbem6KxUhZASNKVWpOIsqt3edzEnbrgd6c/8fkfI4hQYjFXnoud3/xVil1zhr9cKi0tKm8UCUk/eD3P35kDtUrUQAl8E4qYN5du3ar+oKWGEye6q72YOyWcehH7kQOWT2nWhzVuA9Ce+APP8y8IbS6NgDLHLrkb6Y59Txteqln1qMB6iAVDRU30qv+mTxfV3IPWhT4P39AU/gCagzVuI1G99XhlbFSod7ZxDGz6O1FP3gY8Ptym4Jfh1Xo0TG0FI37w1D3JtwggX8bdeQvytV6raLPjAIFK/+Tswz7805JE0AcYRu+waJD/yabBUT9WjXpKFCLhujEqIq3pNzwYUv/ompcKpsXURtMG5SH/897xnWk0XYBzmzs1IvPKUz7bhRgKFoXZ3r0oyE8E9F2rixcfBivmphEGkRP/ErR9B7KJ1nRplXYivux6JG+8ENKPqylOBXUGVgiCfLKqpIoJgnncJknd+ovGYlDaBz5qrbEH6spWVVTo/LUAShn5kf9tUk25DSN+647mkTSH25osw9+2svBiIVIxF4rrbur5/KtMNJG7+oAqAqmpQEHUGVNUBYXsSRuU3XWiLliH14U9DG2i6aXhboC9ZgeSHP6UidCuSBtegHzuIxManPWP4DEOrmaoIizCoSiJm10IFaA0hsWmDvxAmSRdCQFu0FIlbPgwWT3ZqlA2Bp3uRvO0jyntSzQiqNnqrtgzyCgZVfOBSKosnkLz1g9CXndHijdqD2NpLEb/65uoSBEGprPqRfTNOylCPqEWtpCu/cS2yCUVzZIC5YxP0Q/umGrTkojdjylinL14e6G1HRkawb98+7NmzB8ePH4fjBHtqGSvPRvyam71AskqnC7VuyxCO3560EohUiHzs0qtbu0kFjI6Oqrl7J+i50zQlRRpnrK4iZXgG0PhbL/mG5S5LCa6Fri0C3EJs1XQfDTIhx7sgA8tnEdvyKphdnKpuCAH9jFWIXXplILdzXRevvvYaHnzwQbyycSOOHj2qftff349zzzkHt912G6675lqkewLQ9TlH/PLrYb36Ipw9b1cM8yzVHW0qArSWdKEMxLPU5gtKKpPz9PqmTXjggQfw8iuv4OixY3AdR83dOWvW4NZbbsH111+Pnp7WjKp8cI6K03D27/GiQSfbs4SL2LbXkb/0eriz5rXB1986vPil1scZCmEIOpVt18wQqUbmTUDtFU6BcWXEMva9XcEz4kkX8StuBO9tPYrz2LFj+Id//Ed857vfxf79+yHc0/WBJ9avxw9++CN88AN34it//MdYu3Zty/fUZs9DbN21cPa/U1HKKBUrboYwSjVMq8G84DIVWRkEhoaG1Nx9+zvfwb79+xVRlEPN3Y9+hDvvuEPN3QUXXNDS/WLnX4bCS8/AfmOjV7OkHGrNHFA1NFRy2oyAH27eYopKeDaMkEpiNVBPpk4QzD3boY2PTlVHhIC2ZDnMc6brQT09pNj89X//7/HNv/orJUpzzqEbxukvXcfo2Ci+/8Mf4kv/8l/i1Vdfbfm+ErHzLoM2f2FVW4ba9E0wu5JOKl1SqnG9fYhfdrXK42gVkiy+/ud/jr/85jexZ+9er0BThbkbGxvDD3/8YzV3r7zySkv3ZOleb/ymWeFNpqTR2M63VPe0MBBk1XAEKGGEQhiixeSZWp/lQQTET4ApF6r5zraqVnHz/Es9q3kLKBaL+G9///f43ve/D9u2oU0+scpvKXVkTcOzzz6rNsmhQ4daureENmc+zHMvqvp+1Y0/DapKF0LAOGtNIIZOx3Hw37/1LXznO9+BZVl1zd2GDRvwta9/XRFzKzDXXOAlxFUkWgZj305oYydDCeQKwzISRO5caBJGK3UJa31SYwEOmjPlHdGPHaygpwrw3j6Yq9e2LNK8/PLL+O4//7MiC16nZV3TdSVm/+SnPwW1+qQ1DcbZ54OlUpXVElV5trFLTjRlqnQx01RSGUukmh+zj5dfeQXf/d73YNU5d/JklnO3/qmn1Ny1AnlQyHmrciNooyf9mIzgt3eQV/QqQFIgtUJDocZWm8rW+mitBkcNQ4q2xw+qSkuVArW0+YtVQZdWIMXAu+65BwcOHKh5Ok4dGkOxUMBdd9+tjHutwli6EtqceZVFCWri9KnWd4XIK/oTgO1CShf33nuvslk0One2ZeFXd92Fw4cPNz8Arql8E5ZMTf2yfo6Jfmhv4EZPFoZKIhBIa47ACYOVJIwWDsVaH5WEUatnSUOQpHD8sGr7PzVTEdCXrlDxDK1geHhYSRjNxPpyTcP27duxa/fulsagrtU3AG3R8uriW4P9VE7v5Fb+BkFb4NUtbRWjo6N46eWXlXG40Q0k52737t3Ytm1bS2PQFy6FNji78vNzXXXgKO9awBs8aJnFFcHU2AjNhuG2JGFQVdKQUikPopWFH+qrDx2rnKilGyryr1WcOHFCuU5ZE0E+UgQfz2SUdNIyuOZ9n2r1MqoRQBVUDfiSUtviFV7tzRYxNj6Ow0eONDV3kmCyuVzLNiBVrHnewqpzow2fUAmLQRIGU1J0sJThlqT+rgzcIsBxRdO7WtSoecHlggwkws4rkqOyDyffy88bCeKUtG27paAiIYQy9gUBfe4CVYG74uSKBoQgqiEGapoq2BsEpGTR6tzJ+W8FzIypjNZq5fykOsvyuWDL6YWwMUsSRqujDMfoqfTP5hPRyW9IWwlywHoQRiZ5CasInh2vNADwZDqQ2Iu+vj4VSNSMS0t+xjRNzBpszUtTAu8fUIVyKzJ5g8F2Fb+OHxXLZ81paZwlxOPxlueuf6D1Z6jNnuu1QJ8MBvB8Vr2CROChAyS1p+p7qhGE5iVREkaTENPYMcyArNJSJWHFYgXaJa8dQDze8j1mz56NM888sykbhjwh58+bhxUrWleNJFgi5UVdVuOLejukqz+uXAxZzhlPB5O+3t/fj9VnndXU3MnNMXvWLJx5RuuuXXlwsIrxJEz1P/Gym1u+zan7Vasf2wLkfgwiZT60XBLbad5TIr+YW+OjkjBaHzjz+otUSjaT95Y6eACVtOQpecdttyGeSDTM8PLvr7nmGixfFlAOi2GCxWJV80oaQ+UPMDOuXkEglUrh1ltvRSqdVuTZ0OiIcOWVV3pk3SKUl6RKNzQmXM9oHiBUEe0Ar0f+fgzClxMaYThu835f8nWuajA4D6Qpi9/Su+I7rNTCMADcfvvtuPqqK6eEM9eC1N2XLFmCz37mM0gkWzcgQkU082AqmtcMlNECTf+//bbbcM1VV00Jo68Fx3WxcMEC/M5v/7Yi7FahGk9Vc+uSAFNt+1u+zQSCWdunIPeh7TRvUyxHaCX6pAgk9aZmv7pTI0Xe4EzZMVr//kFGjVbHokWL8NU/+ypWr14Npw4jnOu6Snf/8h/9Ea699trgBjKd3tGFOVTz58/Hn/3pn+Lss89WJDqdlCbnrjedxr/58pdx3XXXtW2cQSJwwhCehBEEQpMwXOEZPpvdj7UaFmk8IDsG95shV9gp5NiBBuRcf911+Ju//mtcdNFFE9Z/KWaXDLzyJRe7JJQF8+fj61/9Kn7/i19sKGBpOpC8n11FymmEO2s2jqkutTULqZb957/9W1x6ySVqzirNnePP3by5cxXB/MGXvqSMnoFANciuIuEwDtKMwKRR1T8kQL5gikSFkviDGGJoHXeEIBRtgWaTtD2vbOUMNsnApmQNu5XqLwQYBsgwp/IFY6BCHrCDK3zJGMMH7rwTK1euVBmXDz/yiMpYzeXz6tQ3DEMt9nXr1uHzn/scbrjhBpVQFSisQuV07YkxNnKxyuX2ySqqV5CQc3fH7bdj+bJl+D/f/S5+/fDD2Lt3L/KFgiILOXdz5szBussvV3N34403qt8FBbUWSs2wJ7+naSAzFph4xsGClTCYJ120EhdVjtAIQ0oHlt28ZdZVXdorq45yOuMab02ZkCqPYYJUvkOFhZ/NQOSzXgXuAHHOmjX4q29+A1/8whdUFOLBw4cgXIHBwUGsXrVKqS2t1nOoBpHLAPlsxYXfSE6f97eVS/JTMa/mLgysWbMG3/zGN/CFz38eW7dtU0FZruNgcNYsrDrrLDV3vb2tReZWghgfAVWyP0npxoiBAqzCJsmixZU9BXIfBhEWjjAJQ6Jou2qgzbRoU7EcRIhVmbyYzqFx1gJzeg9bqHL3UxvYUC7rNQUKoXeGYZhKJ5evdkKcPAFRqFDgGI2bcxivQLOKMIpwh08grE4tUuqSxCBf7YI7dNyTMKYEDBIokYRIVHZVNwOtxTajkyEP7KJ/cHdtX5ISSqJQs+O0a6jCMc6UHaPp5yRPB92A0z97qtKoFn4B7tHWU8u7Ce6RgypuoCJ4AwuqViii48A98i6aN8f21kG1Eoc9faB4ZSm1GQSWJ+XDMw0E14QmPMJQupPwrLNNzoFTI2FG5wzxVg2CmgZ3zgKQXiFc2nXh7Nvd1q7docKxYVepugVfYmhUwqgIqUoe2BO4HaNTcMdGqhMgg+rsTvFEII1E5LkVSBSzD89bSbBrnbwNIjTCYH4sRdFqnt1cKjVfroyE3rodw5mzUImVlU4IZ/87EKMnW7lD18AdOgb34L7qBs8GuVf9faVLMQb38H6Ik8ebG2iXwT18AK78LhXKN4LrsOcurHzgNIHADZ4ALHlou40f2tW+TV2Ewb1A4IZnREoHRat5w6cKOKlho0jqvLV4DBKqJqMzOHfqA+cM7rHDsPe1nlreDbDfeVvZMCoaPHkThMGrSBmMQQwPwd69o/nBdgvk+nt7MygzPtV+IdWReALuwuWBuVQ1HjBhqP3n2REbvapV5QN1EYbhcilf1nPUyl2Xm0gFIaDgD7gZqJBWUT2k1VBqSQtCEhFEMg17aYV8A8ZBuQzsLZs8g9cMhlQP7M2vKQ9GxcXdBGGoz1RMr/DsP/bWTTNeLRHjI7C3vVWl6JCAOzgb9rxFgfU1DCYL+xTkqApF0YxWPUIaq+jqqpMwjBwx8bi80DR/egxEvwQwqv7FgIItlC2jWd60aqRdS+kiaWitqSWaBuuMcz3X2OQbEWBtfhXOsRaqNnUBnIN7YW17s6qRQm38JiaxImF478Da/hacQ63V1Ow07Le3enasKgYbe9lqiHR/IIFqQdsvAC9DtdC4ScAG8JhOOFHpzboIg5mcOMQDAP4ZQIV8cAVJEt8WjH1LEYe/Bh1HeHaMFiI+p1NLWrIsE8FZuALOvMVTDZycwz16GNamF5u/fqdBAsWNzys1oWLxHAbwJn2gkjAqSiacK/VH3jeUrsJtgJTGCi8/4wVtVSjfKA+Y4llrg8nNUd6RoPKjPDA//kK+Jl1WHvoVyUB+BMADxPE9GGZFd1pd3/bqtUk8+MaRk4LjLwzB3yASt4FjjhoXKfvGEU3Dr/NW/m5dS0hK2w5AOcrlHswVBXqbDPmUXGEJQkyrPJkJjSOmcWQdtzlOEgS3bxDF1RfA2L9r6vuui8ILT8G88HLo8xc3c4eOQp6QVmnjVliQvNqmrwPKjmFULwYs7+tcdjX0Sipfl8Paugn21jcqx2kLAXvhMthLmitbUAl60PYLBuQtV3lJyiBH+6Cu4Veuy24HaCUYvKdPGAPYc4LhJ2u3D+1d+rHKfXDrVppm9Q0grsWHfvXU738bXPuiS/g0EX1KEH2aC/q/bv4vqe+lEulRjXgewGvlhtZ80VXiUbOwpnGvplpSS0idiMVzLobbP6uylHFoH4rPPz7jGvCSVUThmUfhHj9aVbpgZouNbYwqn5fzdvwICs8+BgowxL4dEJkxFJ5+xDN2VmidKaWK4jmXQPQOBOJ2Z2HYLwSQLziT+czSdbxwy9pZv9TA/zUj+jTz9vCnBOFzFud/Y2r63l3nV6+YVvcoL18Ww83npHHHVf8RmqaN6oZxWL4M3TjMNGP8l/8auHHNADbtzbnEaOOEvYN5npIKolHdcASpVzX0GLw1/U+eGAuWobjm4qnvqRrtAoXnnoC1/c3m79EBWG+8rLp3VYOULJpVR+q6BhEKLz0N661gGjK1BUQoblgPa8umygZiqcLOXYjCuZcG6h0JOv7CdgXyxSlkNuw6eP3B14R8aDndMI+qfayrvXwyGU+4N5/bhxtWVW8P0bAC9pFLaoczX3jmIBwnK1WSPQAGmF/tR4pHyXhzsq/rqyVmFbUkrnOlmoyJJtUSCc1A/uKrENu6EdrJE6efyIxDDJ9E7td3KbWEDwZTgi5MuEcPIvfI3d4pWSXAjbcoXSgw7zrCruC8Zxw0Nobcw3epRtZB1EgNG/aurcivf9BLPKxU14Nz5C+4Au7sBYEF9emB1Xc5hYLlVjqkd2q6/vbt5zYf8Bh44NYt5yblxj4EwqbSElJ2jLzTUiOVYg21RGMMabNFbwkJ2IvPQOGiq32ymByXwZVOm33wF6BCrpU7hQ4pUmfv+ymc3W9XJQtm+IQRAJhe41oah7NzG3IP/Ey5qbsZ7omjyN7zY2XorkgWwoW9aAUKF14VaDq7EbQ6QkA+707Os5K/ftkGDbVy7VAiPdOHZ2XB2IuS6NQvGJArui0V8bCnUUvShqZS3lvJLYGmI3fZ9bAXr/Dy68shn6wUV59/wjuBWqhmHSbIKiL/yN0ovvJc9T9igBYLtOMkeKya99G7SeHFp5F77F6vzkgXQpJs7v6f+obOCl+ECBSLI7/uJr9jezDShcaCVUfgR1hnC+5k+0WGAS+OpvtbegDhVNxKqeTxlwAcRZmLJ190myZmyRWFGobTmMYVabQEIZSomb32/aBUeqoF3M/GzD30K+SeerDrFj9ZBaWG5B9/wGsSXGWyJVmwgNNJlS0jVu1NBlgW8o/ei/zj93WdEVRKPrn7foLChidr/BGhcO5lSh0JEsGVm/TAmBfdmbem7LXdBGxKtpgkFwphvO9KBo3FdvpqiYIk5EzOaYmYpVpSLbdEzk2fqbXO1lKKWHMpcpdeNyFVnAbuRYDm7v0p8k880DXRjFJNyv36V8j/+i6/SE7lR6tiJ6pt7BYhCaOqaiLnLZ9D7v6fIy8ljS6ZNzE+guw9P0T+qYerFsmRqoizYAly197pZaYG5EqVS9VsJVK5EgjI5it5JelVXdMOfHhZa/cLLfmMZ90MGJ72I8cUcgXHi/pswVtSrCFlJHSOtK61xqG+6Jm77gMqNqPi4mBcGRNz9/4Y2Xt+BDE23ModW4YYOobML76nJB+5KWslmGmJUJqN+zcAeLxGXIcKt88id//PkL3rBx1P7HOPHEDmR/+E/PpfeypmRbIQEOk+ZG76qLJfVC3V1wR0zlXAVpCQeySbn+JOzRKxZ5b05ls2IoVWQIcl4gKU2wAmDgJYrqRSmxRpxJqstahi411CokpBb6kPSilj3HZb61QtVZO+2cjc+jFo4yPQD+yeagSTJ2ahoMRs9/gRpN7/MejLz2r+ns2ACPbOrcg98FNYmzd55FbNgMb9zRxqyaRTpOTkqjSXkfNWLCL/+P1q3pJ3fhzGilXhDmoyhIvi5teQe/DncN72e69WcaGSYSB39e0orn1f4EWSpXQRaKwWAwpFV6n+p9unaL8Ae/Gk1WzBzFMIrsLsJHzvH/4Sn/vDr+YEicsAqFbewu+50JPUm+4dKfy+JNVUD4Mz5Byh1JfWvCYE0T8Lzqx5MA7sBs+MTj2afZXFPbQf9va3QCRUlywWC6YtQC2I4RPIrX9AndTOnp1+FFaVb8y8TVzVxhAwmE/oVM0uXJq3wwe8eROu6izfjnlzjx1WRuHcPT9Wz00RbBWygKYhd9WtyF7/4UDrdsKXLhK6FngP1eFxC+M557S1T8B9RZg/vPWcvpYt9aERhsS/+PzXiw535oDhRjlHzDdeppM6jCZ1N/LrHsarxGSUDEiZFupwnLoZqfR3t38WzIPvgGfHKpMGY6DMGOwdb8HZu0v1NNH6BlTbwKAhxkZQfPlZpXcXNzzlp17X6KEiySLuk0X4HRVO3VavgzT8eXO2b4a9d5dywfL+WeHM2/AJFF5Yj+zdP0Rx4wYvR6Ra/xRfUstdfgOyt3zMq/sacE5MXNcCt184rsDx4aKS5MuWQ4aB/Xe3SK/95H//fy3fI1QBVTMNQaLwNIB9AJTcadlCGT8TZvNcVXAFkoIpaaISegxNhYtL1aTlPUKkwoBHDRO99/8A+qE9VQN6YNuw33oNzq7t0FechdglV8BYvRbanAVgRvNBD6pc4LHDsLa+AevVDXD27lRivdfKvsai4z5ZBBGg1QRKEo1bqNH7UqooTmnetkFfuRqxi7150+fMV93amoUkBffIARW1WZTzdmCP8taoPhXV5o2EKoiTX3cjMjf9JkSqL1C7BXzV2Qw49kISRC7vqujOSWfHVsbEC0YsHgjjhb6MHn0rkxSi8C0ifA4+efekdCydn1Qhsc0ibXD0GtUnfbjo4FC2GFxrEc5h7tmG9K9/CnPXVu931U51+SVJALqpRG19+Zkwzjgb+tIV0GbN9Xqc6vpUyUB+TriqQjVlM3BPHFFl9ZydW5Xk4p445hnnqonRZVBuznhwwVmtQFiAyNeRBa6+v1AkoeZthZy3NdCXLIc2a55qJM10Y+r3l5tcdeuxIbLjat6cvbth79qm1DUpXXgekGnmTc59IoXsVbcje90HfI9I8CUapSqSNII9q4kIh47lMTRul29qF6C/c3Xja3ee2x+IWyp0wti2+wT2jNPHAfZPAPrhx84vmZdAb9poWtLTGcNgrHoOiUuE/ZkixqwApIwSOIc2dBSpJ+5C4vUNYMVC7RO+RBykyl2rjvCsvx/awGzwvkHVtJjFExP5KlTMQ2TG4Y6c9Cp8jw57Xg9lwcf0C94HMzzJImwDZyOQqombr6GinPbH5fNmgKdS4H0D4INl8xaLn5o3KUlkxiBGhvx5G/HmreQmne409+/nzFmA7I2/gcKFV/pl94InC6ky95hG4Lkj+YKLvYdzqkJ42RI5CuCzMXH00RsuOjeYewVylRp4ekcBmczoMq5p3wdwDXw7xKxeEwvnJFqyEvcYXL2qQZLFgUyxZl3QhsE5WD6LxGvPIvnsQ9CPHT61maeDWph0Sh9mZVIK+f9XGmqp538jE+RHXFaPuuws5P4TBU/iaMh+WGnelJG3/H3/vxudN6lu6AaKq85Txk1rxdmnrhkC4rpUl4Nn8uPDRRwZKpz2OwIeZOCfddMDJ+88I5itHvoZdO2qOB5+deQgwfk1gMsBKCF5POeoiLREXGv62eRdQlyjqraMtKGh19SUehIY5IkWTyF3xa2wl56F5IZHEHtrI3hufPpFWmsht/I8mZ/PEWs9+zRMSBJTcSA6IIp1ShuYZt7Q5Nz5a86ZuxD5992A/KXXq3iLMKvEa4whFmDryxIcR2AsY08ueZJnhPvStjZ8dUBkgbD7kpSgxXWHET0MYD/852vLL5m1WyJyRxDyNfJTJI8Mxg1FKIGeF+TVDbQXr8TYh38Pmds/BqSCdbvVC7n55CbUUt1NFhPws1vleBV5hOqnqwGNoXDRFRj59B8he+0HfONmuC0lTK3FMgwVIK+WyTtTQsEJ2EagpygdjLGzhLYQxs3npJFnsc0EPDohfBMwlnVaqpMBX8qwpinhJ0kjFN1LCIhYAs6KVeADCegpUpshdHWA+XaKpE8UscCSJ9sG5geSTRBHk3VFG76vynkhaP0GCu+7BvayVd6NQ7BXlENJF3oI0oVLGBm3J3OdlN0eEpq265o1wbqo26bpfvj8noJLdO9EvU/m5eyP5+yWDmaXCDmnemVxiYGYrtysYZz/jAjEuYoI5GWbWG0CI0DyKKkdcUBPea9utVU0gpI3R81ZEuEQLj+dYOWzQUxXwVisTRXhJVkE3dVMXi5bcJArTE40o4Mc9P+z9yVQclTnud+ttbfZRyONdoSYRUIImc2WhYUWsEViHib4OAbs45N4g2MH85I8h9gJNjbmxA7BwHNYEoixXjACO/HDBssGIctgErMaSSCBJCQQQpq1Z6ant+qq+nPurapRa6ZnNEtVd8+ov3OaQV3dXcu997v//v9cVzXfs/yKZkd/4JXX0SzNeZ5Av2XAlfx+uWDA2bEmqkJRJj9LMpaNkDV6MBdXSRpDKrKWPWaK/ORAjkVdUd2oMjdoiS9uz9hvun8tNx6BhtnUhjWpH2qMzNyoybxXKeIpigHhANIcCxd/Tvkv/szIHqfG55k7pDGeHSd5WXXGrQhQJafurN+wbEe6ME+MaiYi9mtbrX71w23+31/RCOPP37cct790sLddrvopGC4GUMvcep+JlIn6am3SEgDngKRpQ5PkgjVbOao0GbWmgu60/ynpxyff8HT4vMmKPKKwh/37+MePN0VmE29fOFMw4pnZJ/6FfdyphHyClfLIgo0hP/PfUlTxCvxemOMZ8builgjUSlnCfjHslztsSf3PS7u1tK8ndFFUT32jHiPLYk/LoP8CsAlu2ns8kRP5JVORMgyLkLZsREf5Df5QG3QV6ZyNwclWGC8Ecnqb2OOJSGQjJ/IpyAcTAztOHj7W+xESISf6oME3scmmQYwFLl3EE4awYZwY+seelmD990+bKZDZVVQN+FNnzuKyejeBHvH6mzhBJyYGUlNzffLHkzTH7mGiyQyzwuqobthJn5tLGGqoFE6SCiYFR410JIzgBk1mTEgXfi9bLwx8cOSa6QHhkRfS/xa/siWYrajoJjNNVYmBPQngOe89i4D4gCH8yVO5Ta7LDZr2mOHgMU1Gg69eEwJJMkgtUipoBb7A5iqkrAbGF8wN0vLbjQq3o1nvgCGaLJ9o68R2yWK/ba3a6Ps5PRSdMC5uj6BKo6ME/HhIyoBT87M/mZvy+GVMGrOUHz9Xva6gWvNRGxNeEr2iX0wXEECqJog+KKiiwZb/v+/FXQxPYQfQZYMeshQ5/ollK30/r4eSOOWYotlkS79kwFDTDLKB3oEcjClmmDqqiT2masJZf1ZEFZZrf1L4ZNiqXtFIphFIC4FkJRCVhKsiYUUJJDbGdKWLYSX4bID9GjLboanB2mVKQhirz6iBoutdNrDZ6wrvVQuKD0xdyuBkMZgbvS0B3BaLUy4aDHe3kpiYgBURY5qAwZEIfU4xR8CqCP/FgWQOydSIAr8dJNPmTX/fEN+4LOL7efNRsrAfRVHIluwnAfzKczQSHI/JyECUiSNj2UgNbxUw/Bok5sMSJ6fRkRaafuGWpyiEZ1YNJupNV+RAIjpFNfCcjZ5+Y3gypc3A/r+VTj7zr1uCry1bMsJY36Lj0lWzemyZHgRwDF47AtN2RK4pBlgJ1SQ3etFgcnu2+lT/2fGSCMKoKCblDybGi7iE4eNwKZIUiFcEbipFPGE4rTpOPHSACJujsfrU57T6AM58IkoaWPzi8zaytvlbEH7qFPtwxa7BHBLJEUadCYMzcSJnwyyQ4ZbK2Rg0pn4OAS7iaq6IW+GL8ofEYIt6GgU63E0SMmOIBBD+Dc8pkDbRN1JdN8DYQ7KivLSuvcr38xZCSQnjvPfJqNGr0mBCytjjvW/ahJ7+rJA2pgouRfQbtvCccGGDk0jatEXKu19h4kLE1ULTP7HjlAANSRi+tTt0q2gFEaAFN0iLqyLGyLCDVxiZD8mKVrQmLyWf4etbY0jJyk4C+zdOpHAHIJm2hGriB7haEjcs9GT4y0afYYMxyVdd0xFxS5WrXcG4QQAxyVcjtSjoG4DdwkP/YA79yRFBWn0g3KdC27e+Lfhq6x5KThgc1aqSY8zeAhKNjwSEAXTAEE1Z/NgIuFbCVRP+IteIFPaxcjOpuqMTV1D2YJLkmxtcl4OzW3htD7v7jeF9dvgk3moy/FwOKUVVgstihm9srcLL/z54hGT8AMARDBlASZQey00xAnQ0SFzvVBVhrJoqbE0XzZwrRozyh4jM1aa+K6uSM3/8TizzYFmE7r6sCDcYdoa3iPCDJWc1dK1tLY7twkNZEAbHBZ9pgpKj7cREBKhIKeUPKZE2haQR1DIUxip16sYqUriEUQZVdwOqRTmT4NQvmVrqtyzIQg2MLLyYi77BEapIhoh+OCjj+WMHit/UumwIY0N7FMbsZNKycB/Afu+9z+d/T78hEm2CinJQJUkUZp3s4DMuIXIRVy4tYRBjhdPsK8gDifYOthqa9C/wzSUqJNPgyCKdtdAVHxHRyf/xNDE82KA3GOuXFj9/qWwIg2POW4uQaIjsJ6K7hipzuapJZzxbyErsG1RZEpLGpEjDbSPgFNEp0WJ1i8Jg1YcgzV7ge/MdX+D1fi2xrYcT+2STBT01Vg3wHiyb0MVVEWNEAONhEO5sjpnvrn+jLrDzj4WyIoxzLmSoZhoZdu4JG/SjfNUkmTaFPjelJssngS7LLmlM9JsEW9acDMgSgmwb0qJ2hC/7LOQ5iwIvajsh2DZYrBryuetBsdrAa2iOCU6sqoaJloaWhGThf4vD4egdMNA/UhVJA/QvhiJvz7II4bK+QK9hNJQVYXD80QIFkUjVIBjuAfC7/GPxgRz6T+zs5DsEaSjKxElD7FqlIwzGGGwzh8G+OOQzzkb4ii9AXniGK2mUWEWxLbCaeoQ/cg1wzkbkiJXukrgkpihuo6Lxf01ybV1aABmoHkQmasos5BXh+JUF9mCVGjLev6QmsGs4GcqOMDgubovByDUeIOB7AA5575s2oSOeFYVPAyUNt5XduNUTkYA2eTHXL9iWhe6Oo8jlTChLViDy8S9BXX6+E1BWClXJbX0oz1+KyJ9cB+2CDyOZSsPIpEuadsMlQVsef/EcjyyCSFf3wB9HNmejozfjVNI/8fAek+F7lx5qOLyutXgxF4VQloTBUVWVhUzSNiLikkYS3kM1bHT2BmvPwAnqyXjOQqLBr62GSpqvKoHQ+c4hpJLicUFuPg3hK66FvvpSMD1cXLuG6CimQF35QYe4lp0v3u7p7EAunS5pop6QBMdpoC4GWcC1W3TGs07i5YmH4jZwZ5ZZzz/TWrSAzlFRtoSxoSUEPRTO5oD7AfzHUK4Jc7qm8Yc71QS1k4FPkqiqjMvl6kQPllbCUGQZx94+iK7OjqH3pJpGhC79NMIf+xzkuacNNWEKDK5UITXORXjTp4RkIc87XRzK2TYOH3wLOSMjVKhSwYnKVU4qYHjekKDJgj+y7v4s+hIj3KQ5Am2WGB6OhKLmh9om79nxC2VLGBxr28KI6OFugN0G4Pn8Y/EBQxiHgha0NVkaH2kIwiiduEguYaR6OrFr56snXpqqQztnAyKfvAHa+y8Bi8ScRsV+EgcnIssCC0WgnXsRolfdAP3Cy8AixwOLEolB7N/zGmRh8CwNYTDk18IYu8hSVFMCN3DCjbfo6TMKDcdvJJvdqYYifZvOiAV+HeNBWRMGx8b2GCLM2knALfn2DC5cdMWzGEj43zZgOFRZQkxTx3alMSYkjFKaF0VncJjY8fQ2ZLIjg3qEivK/Po/In14P9az3i8UtVIepeCxs2zFqhmNQV64WpBS+4jrIC9tGJOO9/fYhHNyzG6EAmhFPBLY2dt6PJkmIqScZbx/gef86ejLIjWz5+RqzpVu+c/bLBza0BFsUZyIog9DEk4P0KCnZ5JMmSd9nwDe8niamRcJIpCgMsbAS6GL1dpx0zhQNkUaAsZIX0SEQ5sRCePm/n8Ou3btx3jnvG/EZpmhQ28+Hsqgd5oFdMHb+DuZbr4ESfYBl5jU+LtAAeXgXdVWFVDcLyukroK54P5TFywRxjIYdO3Yg3dOJUHstqIQRqU791cLjpIt4nODCvT3wX88YFjp6ssiMbBfaScB3SbJ/d8vrF2JNoFcyMUwLwljbGsWONwcNK515EIQFYPgSH1t+jD/sYz0ZzJ8VRkgPph2iB0+nlZiFjGnhxOZlDLYeKSlhcKmruSqMROfreHjLFqxaeRYUpfAQc1VBXbEaats5sI69jdyB3bAO7YXVdQQ02AfKpl3pw/2CxABFE1KJVNMAefYCyIvboJy2HHJDsxO0NgaOHTuGx372M6zRJLFzBxlPMxZI1PMMu56j48TvpaiLRLIijKFh8nmbxeBIj1+SiP1gkOUebQxVm2tK7BUZjmlBGBxrW2LY/maqbzCTuF0leSGAP3GnsbAsH+3JYN6sMDTVp8K+o4BPprBr00iZ1gkTn7yyb6VaDESoD2mYG9PxyKOP4sqPXY4PfOADY39J1SEvaBEvyqZg9/eC+rpgD/SCkgOAlXPuSQ9DilWDVTcIQyqrqhXSynjx2M9/jl1/eAVXrVkKmWHMequBgjnFc4gLUO41iKK9RfCEeBAekd6ssF0MI4scQA8Rwz21oVh6XWv5qCIepg1hcKxriWDnS5kjR+TkzYxRA3/Ls54lUqaQNJobw0JFCRLMjdWQJCZUFK9CubC+MwmMzJIY9cjdJZfNqsHW3+3F7XfcgdbWVtTXj690G9MjkJsiQNN8X69rz949+Od77wUzDSyujZY4jIy5xmlnfLi0E1FlXzKWxwNbkEVGGO2HHyLglxZwa5KqOj/RWp59bsre6Dkc++vSqIprrwHsGwB25h/rG8wJm4ZlU1GWK59sMU1FSHbEWFFYVpJLGljJd+/ljVXQdRWPP/EE7rvvPuRywRuGR0MikcDt3/8+Xv3Dq5hbHcG8WKh00gWcHjK2FnIkRUVGTPOnvMF4wCXA7r4sevsLePcI/wXg5lmmfnBBrPTxFqNh2hHGFUvqwOo1MiPaszbR3wPYl3+cM3dnTyaALu2FIQJ7NAUxVYHERd0iibWjgd91W30Mc6rCSKXS+Kc77sC/P/QQLKv4yWiZTAZ33nUXfvzww+LfS+tiaAxrJTR4kpAAZT0kxqsYxs2hMwuyMNDVZxQgTNppgb7WFDNeOlCfweql1UW5pslg2hEGxwdX6ogylWSb/ZKIbvaK7sBdMD2cNHozQvwrBphrXQ9HIq7xr3RbKL/l+VUhtDXExG7a3d2Nm775TWzZsqWopJHNZnH3PffgtttvF8QlyTJWNlUhpARrYxoT/MSSDD0cDaQVwKindUs0dMWzhebkARBuSqeSzwzaNbjqtKaiXddkMC0Jg2Pd0hD0cCRnZ9gjRPRtAEPhjd4AeepJsSCpOpgSXL/O8YDvZDW6igua64QrmC/Uw4cP46+++lWxgJNu2HiQ4CR1y3e+g299+9vo6+sTRtO6kIpVTTWlb/WkyGCinmdxBomPR09/Fh29BSOT3ybQ15MmfhGLVdtrz4gW5ZqmgmlLGBwXtUcQqQkZKsk/ssn+B9G92oVHGp1FtGmILu6lTnF37RgfmFuPhrAuJqwsy8Kt+Xc33YS/ufFG7Nu/P5hzE+Hll1/GX3zlevzjbbehf2BAnNsmwhn1MfEqbUEwEqntIpekCNdxfA4WlCze4xudRew/6mNR8yNnBd9TxA9Ma8LgWNce45JGyrJy94Lou4VIQ0TSjdGg2R+Qo46UQcUriwjLZ1VhZVP1kL7MF+7AwADuvvdeXH3NNfjX++8XJOIHOFHs378f//Dd7+KTV1+Nh7c8AiOXgyRJLoExfHB+PZoiWsniL5wLdWthKMF7IPh9dsczo0kWRwn4Zlqy/l8oFDHWtZWf+3Q0TCu36mi4sC2Ep/b0p8xs5m7R6JSx/wNAUDafn70DhohgntMQgqpMtGzK+MFkRRRmKTX4PdfqCi5e0oTt73SLycuEg8DZH1548UXs2bMHWx55BFd87HJsWL8BixYtgq6PfyFxkkgkEti7dy+2bt2Kx37xC+zevVsQhZxn+OWfa4zouGhhoyiaWyxj9KjXrWqgkwSZTQXMq5gVzzp1LUbe7zGb0a2KxTZXRWKZjWUYazEWZgRhQOSc1GD7nv5ENpv+vyCZwNhfA2hEXps5vnA4aehBBHd5u5eql00h3vULG9BaH8NrXQOiaK0HRVGQSqfx1LZteObZZ7F40SKcd955uOD889HW1obmOXNQXVODcCgEVVWFsTSbzSKVSqG3txfvHD6MXbt24fkXXsCrO3eio6NDfIYThTzMS8Sf+bnNtVjVVD28J2gJQI4EGKBhOifKSWacxMiRpzgC4FvMZD/SI+H02tbyt1kMx4whDI6d+/fjzCWnJ7NG7p8ZkGMMfwNgyOzcP5gT7N/cEEI4gDBykuWSp7h74Dvb4poILj19Nvb2JNx+X8fBpQ3+Mk0Tb+7bhzfeeENIHDU1NWior0ddXR2i0aiQOvhnOMEkBgbQG4+jLx5HMpWCbdtDv1MoBJ0vmIiq4LKlc1CjKyWXLsRDUDUwWfV97EXt2ZyNY70ZURWuwO8fBti3sqa1OVoVzaxtmX5kgZlGGNd/9Bzx9+m9ycHBdPZuldlpBnwNwFDoYiJlwrLSQtKIRfy8facaNXzsqDXFqxEqwBUtzXhs/zHs7U4UrHLNGHOkAlkWBMAliO7u7sJSEmPi8/zlEcVY4BLF+XPrsH5hY5kIXeSojLL/wXWprOnkhqRG1OLk2E+Em3Ky/JNwWDc2TlOywEwwehbC+rYoYmE9Y1nshwT6WwIOeMe8Eu5HOtNOc1s/J44kl7xMXz64NNVWH8XH2+ZBkU+uhnlEwKUFRVVHvhRFkMvJiAKuKlKtK7hq2XzMjuploI44IC3kezsIvgm925kWfwtgNxF9VYL5aLUeMi5ZVh51LSaLGUkYcEkjFI5ksoweItD/BvBK/vFszsZ73Wl0xTOi98OUZQK3ZydKnOI+HBJj+ETbXFwwt66oMSn8VBef1oRNS5pK7jUaAh8XPj6iFsbUrom5Bt3efkNsPunsiJKRNoDnQOwv+tOJn4XC0dxFLaWvmDVVzFjCgDCEhlEdiloZK/W4CXwFwA53IMXc8eooHu3OCAKZYu8zEVnppE77dQdTB9/ZF1SFcO2qxZhVpJ2eP9cldVF84ezFwltTatPFCRiqtjV58LmTs2zhMj3akylUX5aLGr8khq+8p9T/prG20S52S8OgMKMJg2N9SxThcLX1R8sHfkvAlwh4lAsY3nHPg3K4IzWaSDl+8Jmkh9xKU+WzSvhO+JHTmvCZFQtFwlyQV8ZVkSpdwZfPWYLz5tQUVaoZD4RKwqZmw0ilHZW2q88JyBpezwIMPwLh+tnp9AvNGmhje/nmhkwUM54wODa112HrgTmYk1V3G8T+CsDdAPrzP5NMW0IP7Sk8CcYJJiakUxPDr6ufOkiUnWP4/MqF+OgZcwSBBHF5nHxlJuHTKxYKNYiVsP1IQTB3fITxd2JXxtz7608YeLczhf6kWegnugH8k2GzrymKcqCnoRGbWspI3PQBM8pLMhY2tUZwV2cvVnSZ76Zz9A0myQdB7AYAi+EKB1y0PNqTFUbRWXU6QtoEXa8M7oSUyq5VIVdFZkd0/N3qFiQME08e7BT2Db+ms01Og+I/bZ+HG85dgpgql42h0wENFQJy9snx1zFlboUsvpn0DuSEe7jAc9sLYt8zrNzD1ZHq1EXt0ysga7w4JSQMD19uqse+dBNULdSvEt0DYl8B8Pshu4YrvscTORzuSIv6GnzOj39ReUa18nysfAGfXhvBty5sEwZJclUIP35XlRiuXjYfX1/dIlLYy4ssXIFCVHYPjXtAvY8Npky825EWqekF8pIsgG2XbPaltK5sDumh1BE75fvllwvKc2YHiM+dy7BxWS30cMTY06k+RoTPAXiIz4v8z6Uyjp56tCc9IYMoO0lF6lKD747t9THctm45rlm+QNSwnOziJvf3miI6/vKCpfjGmlY0R/XS5ouMBckljHGMJhNRm7ZIXjzcmUYiXdC+xdXafyGwaw+dZWyLauHcJWfW4urljUFcfVnglFFJhmNNSwxP7UkT2bTLytl/DWa/DtjXAmwB8rwoPX0G0hkLjbU6qqOKKMs36nogcuIwZM9tV576KyeIRdVh3LymVVTnuv/Vt7EvPujYIKSTqymcEPhLV2SsnlePL65ajEsWzxI9PMpOssiHdHK3N3PVq0G3+bcgikJSJsN+EO6CLW1WdSXevjeMC5eXPo8oaJyyhAHX7crx9K7+Y6k0u00OYScj/CVAawAMZSglMxYynWnUxlQ01GiiOvmoULlKUv6PlS/supCKL5y9EGvm12PLnvfw60OdONiXQtZ07C/568rjAYkBtSENZ86qwmVnNOOjp89Gc0wfIpGyBpf8+PiMcp1ef9PeAUNUbssVjs/JANgGYv8oE3tWCYXNde3lVdk7SJT/zC4CspEqhKRB49iRmscbmrreZJCuA8PVAGbB23VsEhMpmTEFadTGNFFs+MS550oYAWZD+glvga9orELrB1tw1fL5eP5oHC8d7cP+eBLxjIGMZYuQ8piqiHqcyxqrRDLZyqZqYUSFG3dR/iBHVdRGBk8JadIipwNZvyHUURSWD98j4AFidP/83tSh3rmNuKjl1CELlK3MXCL8+rWsKDWfysZjErFNNsP1DDg/X9ogd5eNhhQ01mqigZJQU+AY1aS+Y9A3fxus87AbUTg9wCeC7N6HYdkYNCwkc5Zo2sQJI6LIiKqyKMevuG0Cylr9GA6yQdX1MK66Eda8Fqdbm6t+pDKmIAonz4gKaSxZAM8wRncyQ3vSCOUy7y5pwBcjp97yqUgYebhkuY5HX9iJusjiwVd27f3Jme2n7SawzzLgkwCakeeP55MrbVjCrtFQrSGsK068luzUW5huU8kzYHIojKE2pAiVhQ0dJ7fpGSE3jXjiBLjlB7wojIxhCTdp/2BuKFqzAFm8Q8BmInqgoaHxrYF4ArVSCH98CpIFKoQxEh8/7yzx9xev9FAItKeXWV8Py+oOybKvBeFDAISD3RNje/tzGExZqIkpqKvWEVbKo4jOVEDuf4IJ7yoRyKmIRqqGrGGifyAr3OfZnD2aeToBYBsBP5AZns3AyBhZAxevmDlRm5PBKedWHS/+eFUD+vUQoqFIetPyHz5myezzRLiZgD35UT8ir8C0RQn5d46l0NFnIidNb8KYqbCYgu6ELcbpWG9WkAVGkoVFwB9AuJEB183pyT7FFDUzT5+LC08vn0zkUqEiYYyBy9ucVOQdb6QQSSQODyjybRroSTD250S4nAFz8z/PRdyujIUaU4VuuzPx1JRcyw6MgIytoGOAkNOs0YblEICfMOBBi+zXNcj24+vm4utllH1calQIYxxY2xrBjURY99qAyRheNixjnwTpcYD+DMAGALXw7BtMgiXrQgYhrwF6RY4rHcjtuWxBjAtJciGy6Aaw1WL0QzD2nCapab4wdM2okMUwVAhjnLiVMdzq/v+2N5OJeL/xRFi1f8+YfYkE9mkAqwFUC8LwXHfkuvzdNIaKtFFEUB5ZuLAU3Y3CHbLNxAn4jQ1sBqOnGyy1PxlTsWEa9AcpFSp73ySwoSWKpjodqqb0bNra+GML9FkQbgDYdgJL2uqwfAU+cS3nNZPsiOUKThLeKx+CMARzi5DuJ4jhy8xmX5zb9M5/arLW310lV8jiJKhIGJPEh5Y62Yj3HXkPp/WGjuy05QeWU+5XpKgflrOD1xGTzhnxJZc4OJlUJI4AYB+X6EbBAEnybxhhC9n2UwsPNnYebR3A0c5VuHRlZTDGg8pT8gEPPLUP85pnw4aEubduUuc1Nd0hkXntSb8ouTaOyihMDZ7qcRLpzdCqXzzSdsk1zzVf+cayBQYkTcG6ikQxIVSmqo/o/LOPgGy5RY7KWySNnT2uL7E80qiMxsQwTqIY+niWOqxk5jNq63lb6/72lqCvbkaiYsPwEUcHeyTI8kYi1jLuxU+j69wVjALvmU3QJkRgs0gNfczc/+r0Lt1dQlQIwye896kNmB2b3QyGy0GYeLklcnVwa0LFoE4t5BPFRJ+RQ+ASA7vEIuns+OcvC+QSZzoqhOET1m7eBkWS1zKw84dijSejYuQtiomI2zMa+V6myZCpZ2R2sJBJ7Mp4OlkJ25wE/icAAP//iFU60gIwwN4AAAAASUVORK5CYII= - section: OpenShift GitOps - href: 'https://argocd-server-gitops.${SUB_DOMAIN}' - location: ApplicationMenu - # This text will appear in a box called "Launcher" under "namespace" or "project" in the web console - text: Shared Argo CD diff --git a/cluster-config/components/gitops-operator/overlays/shared/gitops-monitoring-cluster-role.yaml b/cluster-config/components/gitops-operator/overlays/shared/gitops-monitoring-cluster-role.yaml deleted file mode 100644 index d1fe635..0000000 --- a/cluster-config/components/gitops-operator/overlays/shared/gitops-monitoring-cluster-role.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: gitops-monitoring-cluster-role - labels: - gitops/aggregate-to-controller: "true" -rules: -- apiGroups: - - monitoring.coreos.com - resources: - - servicemonitors - - podmonitors - verbs: - - '*' diff --git a/cluster-config/components/gitops-operator/overlays/shared/global-appproject.yaml b/cluster-config/components/gitops-operator/overlays/shared/global-appproject.yaml deleted file mode 100644 index d75ae8f..0000000 --- a/cluster-config/components/gitops-operator/overlays/shared/global-appproject.yaml +++ /dev/null @@ -1,28 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: AppProject -metadata: - name: global -spec: - description: Global Configuration - clusterResourceBlacklist: - - group: '*' - kind: '*' - namespaceResourceBlacklist: - - group: '' - kind: Namespace - - group: '' - kind: ResourceQuota - - group: '' - kind: LimitRange - - group: operators.coreos.com - kind: '*' - - group: operator.openshift.io - kind: '*' - - group: storage.k8s.io - kind: '*' - - group: machine.openshift.io - kind: '*' - - group: machineconfiguration.openshift.io - kind: '*' - - group: compliance.openshift.io - kind: '*' diff --git a/cluster-config/components/gitops-operator/overlays/shared/kustomization.yaml b/cluster-config/components/gitops-operator/overlays/shared/kustomization.yaml deleted file mode 100644 index ba3812e..0000000 --- a/cluster-config/components/gitops-operator/overlays/shared/kustomization.yaml +++ /dev/null @@ -1,73 +0,0 @@ -namespace: gitops - -resources: - - ../../base - - argocd-cluster-role.yaml - - gitops-monitoring-cluster-role.yaml - - namespace.yaml - - argocd-notifications-cm.yaml - - console-link.yaml - - global-appproject.yaml - - prometheus-rules.yaml - -patches: - # Update permissions for tenants and local accounts, note ACCOUNT_NAMESPACES is space separated - - patch: |- - - op: replace - path: /spec/template/spec/containers/0/env - value: - - name: ACCOUNTS_NAMESPACES - value: "product-catalog-pipeline=product-catalog-cicd rollouts-demo-pipeline=rollouts-demo-cicd" - - name: ARGO_SERVER_HOST - value: "argocd-server-gitops.${SUB_DOMAIN}" - target: - kind: Job - name: create-pipeline-local-user - - target: - kind: ArgoCD - name: argocd - patch: |- - - op: add - path: /spec/defaultClusterScopedRoleDisabled - value: true - - op: add - path: /spec/extraConfig - value: - resource.respectRBAC: "strict" - exec.enabled: "true" - globalProjects: |- - - labelSelector: - matchExpressions: - - key: argocd.argoproj.io/project-inherit - operator: In - values: - - global - projectName: global - accounts.product-catalog-pipeline: apiKey - accounts.rollouts-demo-pipeline: apiKey - oidc.config: | - name: Keycloak - issuer: https://sso.ocplab.com/realms/ocplab - clientID: argocd - clientSecret: $oidc.keycloak.clientSecret - requestedScopes: ["openid", "profile", "email", "groups"] - - op: add - path: /spec/sourceNamespaces - value: - - product-catalog-gitops - - rollouts-demo-gitops - - op: add - path: /spec/rbac - value: - defaultPolicy: 'role:none' - policy: | - p, role:none, *, *, */*, deny - g, system:cluster-admins, role:admin - g, cluster-admins, role:admin - p, role:developers, clusters, get, *, allow - p, role:developers, repositories, get, *, allow - g, developers, role:developers - scopes: "[accounts,groups]" - - op: add - path: /spec/server/host - value: "argocd-server-gitops.${SUB_DOMAIN}" diff --git a/cluster-config/components/gitops-operator/overlays/shared/namespace.yaml b/cluster-config/components/gitops-operator/overlays/shared/namespace.yaml deleted file mode 100644 index 9ee04b4..0000000 --- a/cluster-config/components/gitops-operator/overlays/shared/namespace.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - annotations: - openshift.io/description: Project for tenants GitOps Operator instance - openshift.io/display-name: GitOps - name: gitops diff --git a/cluster-config/components/gitops-operator/overlays/shared/prometheus-rules.yaml b/cluster-config/components/gitops-operator/overlays/shared/prometheus-rules.yaml deleted file mode 100644 index 243c694..0000000 --- a/cluster-config/components/gitops-operator/overlays/shared/prometheus-rules.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule -metadata: - name: argocd-unhealthy-alert - annotations: - policy.open-cluster-management.io/disable-templates: "true" -spec: - groups: - - name: ArgoCD - rules: - - alert: ArgoCDHealthAlert - annotations: - message: ArgoCD application {{ $labels.name }} is not healthy - expr: argocd_app_info{namespace="openshift-gitops", health_status!~"Healthy|Suspended|Progressing|Degraded"} > 0 - for: 5m - labels: - severity: warning ---- -apiVersion: monitoring.coreos.com/v1 -kind: PrometheusRule -metadata: - name: argocd-degraded-alert - annotations: - policy.open-cluster-management.io/disable-templates: "true" -spec: - groups: - - name: ArgoCD - rules: - - alert: ArgoCDDegradedAlert - annotations: - message: ArgoCD application {{ $labels.name }} is degraded - expr: argocd_app_info{namespace="openshift-gitops", health_status="Degraded"} > 0 - for: 5m - labels: - severity: critical diff --git a/cluster-config/components/helm-repos/base/gnunn-gitops-repo.yaml b/cluster-config/components/helm-repos/base/gnunn-gitops-repo.yaml deleted file mode 100644 index 7e476db..0000000 --- a/cluster-config/components/helm-repos/base/gnunn-gitops-repo.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: helm.openshift.io/v1beta1 -kind: HelmChartRepository -metadata: - name: demo-helm-charts -spec: - connectionConfig: - url: 'https://gnunn-gitops.github.io/helm-charts' - name: Demo Helm Charts diff --git a/cluster-config/components/helm-repos/base/kustomization.yaml b/cluster-config/components/helm-repos/base/kustomization.yaml deleted file mode 100644 index bd4b5c6..0000000 --- a/cluster-config/components/helm-repos/base/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization -resources: -- gnunn-gitops-repo.yaml diff --git a/cluster-config/components/kyverno-acm/base/generate/.skip_validation b/cluster-config/components/kyverno-acm/base/generate/.skip_validation deleted file mode 100644 index e69de29..0000000 diff --git a/cluster-config/components/kyverno-acm/base/generate/best-practices-policyGenerator.yaml b/cluster-config/components/kyverno-acm/base/generate/best-practices-policyGenerator.yaml deleted file mode 100644 index 0d218d5..0000000 --- a/cluster-config/components/kyverno-acm/base/generate/best-practices-policyGenerator.yaml +++ /dev/null @@ -1,90 +0,0 @@ -apiVersion: policy.open-cluster-management.io/v1 -kind: PolicyGenerator -metadata: - name: kyverno-bestpractices -placementBindingDefaults: - name: kyverno-bestpractices -policyDefaults: - policyAnnotations: {"policy.open-cluster-management.io/disable-templates": "true"} - categories: - - CM Configuration Management - controls: - - CM-2 Baseline Configuration - namespace: kyverno-policies - remediationAction: enforce - severity: medium - policySets: - - kyverno-best-practices - standards: - - generic - generatePlacementWhenInSet: false -policies: -- name: policy-require-pod-probes - categories: - - setup - controls: - - setup - disabled: false - manifests: - - path: policies/validate-probes-policy.yaml -- name: require-requests-limits - categories: - - setup - controls: - - setup - disabled: false - manifests: - - path: policies/require-requests-limits-policy.yaml -- name: application-field-validation - categories: - - setup - controls: - - setup - disabled: false - manifests: - - path: policies/application-field-validation.yaml -- name: application-prevent-default-project - categories: - - setup - controls: - - setup - disabled: false - manifests: - - path: policies/application-prevent-default-project.yaml -- name: check-deprecated-apis - categories: - - setup - controls: - - setup - disabled: false - manifests: - - path: policies/check-deprecated-apis.yaml -- name: check-openshift-deprecated-apis - categories: - - setup - controls: - - setup - disabled: false - manifests: - - path: policies/check-openshift-deprecated-apis.yaml -- name: disallow-jenkins-pipeline-strategy - categories: - - setup - controls: - - setup - disabled: false - manifests: - - path: policies/disallow-jenkins-pipeline-strategy.yaml -- name: disallow-latest-tag - categories: - - setup - controls: - - setup - disabled: false - manifests: - - path: policies/disallow-latest-tag.yaml -policySets: - - description: Kyverno Best Practices - name: kyverno-best-practices - placement: - placementRuleName: kyverno diff --git a/cluster-config/components/kyverno-acm/base/generate/generate.sh b/cluster-config/components/kyverno-acm/base/generate/generate.sh deleted file mode 100755 index f36c8c4..0000000 --- a/cluster-config/components/kyverno-acm/base/generate/generate.sh +++ /dev/null @@ -1,3 +0,0 @@ -cp -R ../../../kyverno/overlays/policies policies -kustomize --enable-helm --enable-alpha-plugins build . > ../kyverno-acm-policies.yaml -rm -rf policies diff --git a/cluster-config/components/kyverno-acm/base/generate/kustomization.yaml b/cluster-config/components/kyverno-acm/base/generate/kustomization.yaml deleted file mode 100644 index e48514e..0000000 --- a/cluster-config/components/kyverno-acm/base/generate/kustomization.yaml +++ /dev/null @@ -1,17 +0,0 @@ -generators: -- best-practices-policyGenerator.yaml -- security-policyGenerator.yaml - -patches: - - target: - kind: ClusterPolicy - patch: |- - - op: replace - path: /spec/validationFailureAction - value: enforce - # Using Argo to deliver policies so just keep reporting on PolicyReports - - target: - kind: Policy - patch: |- - - op: remove - path: /spec/policy-templates/0 diff --git a/cluster-config/components/kyverno-acm/base/generate/security-policyGenerator.yaml b/cluster-config/components/kyverno-acm/base/generate/security-policyGenerator.yaml deleted file mode 100644 index bc357b2..0000000 --- a/cluster-config/components/kyverno-acm/base/generate/security-policyGenerator.yaml +++ /dev/null @@ -1,42 +0,0 @@ -apiVersion: policy.open-cluster-management.io/v1 -kind: PolicyGenerator -metadata: - name: kyverno-security -placementBindingDefaults: - name: kyverno-security -policyDefaults: - policyAnnotations: {"policy.open-cluster-management.io/disable-templates": "true"} - categories: - - CM Configuration Management - controls: - - CM-2 Baseline Configuration - namespace: kyverno-policies - remediationAction: enforce - severity: medium - policySets: - - kyverno-security - standards: - - generic - generatePlacementWhenInSet: false -policies: -- name: disallow-scc-anyuid - categories: - - setup - controls: - - setup - disabled: false - manifests: - - path: policies/disallow-anyuid-scc-policy.yaml -- name: require-tls-routes - categories: - - setup - controls: - - setup - disabled: false - manifests: - - path: policies/require-tls-routes.yaml -policySets: - - description: Kyverno Security - name: kyverno-security - placement: - placementRuleName: kyverno diff --git a/cluster-config/components/kyverno-acm/base/kustomization.yaml b/cluster-config/components/kyverno-acm/base/kustomization.yaml deleted file mode 100644 index 83025c2..0000000 --- a/cluster-config/components/kyverno-acm/base/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ -namespace: acm-policies - -commonAnnotations: - argocd.argoproj.io/compare-options: IgnoreExtraneous - -resources: -- placementrule.yaml -- kyverno-acm-policies.yaml diff --git a/cluster-config/components/kyverno-acm/base/kyverno-acm-policies.yaml b/cluster-config/components/kyverno-acm/base/kyverno-acm-policies.yaml deleted file mode 100644 index f1ad517..0000000 --- a/cluster-config/components/kyverno-acm/base/kyverno-acm-policies.yaml +++ /dev/null @@ -1,475 +0,0 @@ -apiVersion: policy.open-cluster-management.io/v1 -kind: PlacementBinding -metadata: - name: kyverno-bestpractices - namespace: kyverno-policies -placementRef: - apiGroup: apps.open-cluster-management.io - kind: PlacementRule - name: kyverno -subjects: -- apiGroup: policy.open-cluster-management.io - kind: PolicySet - name: kyverno-best-practices ---- -apiVersion: policy.open-cluster-management.io/v1 -kind: PlacementBinding -metadata: - name: kyverno-security - namespace: kyverno-policies -placementRef: - apiGroup: apps.open-cluster-management.io - kind: PlacementRule - name: kyverno -subjects: -- apiGroup: policy.open-cluster-management.io - kind: PolicySet - name: kyverno-security ---- -apiVersion: policy.open-cluster-management.io/v1 -kind: Policy -metadata: - annotations: - policy.open-cluster-management.io/categories: setup - policy.open-cluster-management.io/controls: setup - policy.open-cluster-management.io/disable-templates: "true" - policy.open-cluster-management.io/standards: generic - name: application-field-validation - namespace: kyverno-policies -spec: - disabled: false - policy-templates: - - objectDefinition: - apiVersion: policy.open-cluster-management.io/v1 - kind: ConfigurationPolicy - metadata: - name: inform-kyverno-application-field-validation - spec: - namespaceSelector: - exclude: - - kube-* - include: - - '*' - object-templates: - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: ClusterPolicyReport - results: - - policy: application-field-validation - result: fail - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: PolicyReport - results: - - policy: application-field-validation - result: fail - remediationAction: inform - severity: medium ---- -apiVersion: policy.open-cluster-management.io/v1 -kind: Policy -metadata: - annotations: - policy.open-cluster-management.io/categories: setup - policy.open-cluster-management.io/controls: setup - policy.open-cluster-management.io/disable-templates: "true" - policy.open-cluster-management.io/standards: generic - name: application-prevent-default-project - namespace: kyverno-policies -spec: - disabled: false - policy-templates: - - objectDefinition: - apiVersion: policy.open-cluster-management.io/v1 - kind: ConfigurationPolicy - metadata: - name: inform-kyverno-application-prevent-default-project - spec: - namespaceSelector: - exclude: - - kube-* - include: - - '*' - object-templates: - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: ClusterPolicyReport - results: - - policy: application-prevent-default-project - result: fail - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: PolicyReport - results: - - policy: application-prevent-default-project - result: fail - remediationAction: inform - severity: medium ---- -apiVersion: policy.open-cluster-management.io/v1 -kind: Policy -metadata: - annotations: - policy.open-cluster-management.io/categories: setup - policy.open-cluster-management.io/controls: setup - policy.open-cluster-management.io/disable-templates: "true" - policy.open-cluster-management.io/standards: generic - name: check-deprecated-apis - namespace: kyverno-policies -spec: - disabled: false - policy-templates: - - objectDefinition: - apiVersion: policy.open-cluster-management.io/v1 - kind: ConfigurationPolicy - metadata: - name: inform-kyverno-check-deprecated-apis - spec: - namespaceSelector: - exclude: - - kube-* - include: - - '*' - object-templates: - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: ClusterPolicyReport - results: - - policy: check-deprecated-apis - result: fail - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: PolicyReport - results: - - policy: check-deprecated-apis - result: fail - remediationAction: inform - severity: medium ---- -apiVersion: policy.open-cluster-management.io/v1 -kind: Policy -metadata: - annotations: - policy.open-cluster-management.io/categories: setup - policy.open-cluster-management.io/controls: setup - policy.open-cluster-management.io/disable-templates: "true" - policy.open-cluster-management.io/standards: generic - name: check-openshift-deprecated-apis - namespace: kyverno-policies -spec: - disabled: false - policy-templates: - - objectDefinition: - apiVersion: policy.open-cluster-management.io/v1 - kind: ConfigurationPolicy - metadata: - name: inform-kyverno-check-openshift-deprecated-apis - spec: - namespaceSelector: - exclude: - - kube-* - include: - - '*' - object-templates: - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: ClusterPolicyReport - results: - - policy: check-openshift-deprecated-apis - result: fail - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: PolicyReport - results: - - policy: check-openshift-deprecated-apis - result: fail - remediationAction: inform - severity: medium ---- -apiVersion: policy.open-cluster-management.io/v1 -kind: Policy -metadata: - annotations: - policy.open-cluster-management.io/categories: setup - policy.open-cluster-management.io/controls: setup - policy.open-cluster-management.io/disable-templates: "true" - policy.open-cluster-management.io/standards: generic - name: disallow-jenkins-pipeline-strategy - namespace: kyverno-policies -spec: - disabled: false - policy-templates: - - objectDefinition: - apiVersion: policy.open-cluster-management.io/v1 - kind: ConfigurationPolicy - metadata: - name: inform-kyverno-disallow-jenkins-pipeline-strategy - spec: - namespaceSelector: - exclude: - - kube-* - include: - - '*' - object-templates: - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: ClusterPolicyReport - results: - - policy: disallow-jenkins-pipeline-strategy - result: fail - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: PolicyReport - results: - - policy: disallow-jenkins-pipeline-strategy - result: fail - remediationAction: inform - severity: medium ---- -apiVersion: policy.open-cluster-management.io/v1 -kind: Policy -metadata: - annotations: - policy.open-cluster-management.io/categories: setup - policy.open-cluster-management.io/controls: setup - policy.open-cluster-management.io/disable-templates: "true" - policy.open-cluster-management.io/standards: generic - name: disallow-latest-tag - namespace: kyverno-policies -spec: - disabled: false - policy-templates: - - objectDefinition: - apiVersion: policy.open-cluster-management.io/v1 - kind: ConfigurationPolicy - metadata: - name: inform-kyverno-disallow-latest-tag - spec: - namespaceSelector: - exclude: - - kube-* - include: - - '*' - object-templates: - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: ClusterPolicyReport - results: - - policy: disallow-latest-tag - result: fail - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: PolicyReport - results: - - policy: disallow-latest-tag - result: fail - remediationAction: inform - severity: medium ---- -apiVersion: policy.open-cluster-management.io/v1 -kind: Policy -metadata: - annotations: - policy.open-cluster-management.io/categories: setup - policy.open-cluster-management.io/controls: setup - policy.open-cluster-management.io/disable-templates: "true" - policy.open-cluster-management.io/standards: generic - name: disallow-scc-anyuid - namespace: kyverno-policies -spec: - disabled: false - policy-templates: - - objectDefinition: - apiVersion: policy.open-cluster-management.io/v1 - kind: ConfigurationPolicy - metadata: - name: inform-kyverno-disallow-security-context-constraint-anyuid - spec: - namespaceSelector: - exclude: - - kube-* - include: - - '*' - object-templates: - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: ClusterPolicyReport - results: - - policy: disallow-security-context-constraint-anyuid - result: fail - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: PolicyReport - results: - - policy: disallow-security-context-constraint-anyuid - result: fail - remediationAction: inform - severity: medium ---- -apiVersion: policy.open-cluster-management.io/v1 -kind: Policy -metadata: - annotations: - policy.open-cluster-management.io/categories: setup - policy.open-cluster-management.io/controls: setup - policy.open-cluster-management.io/disable-templates: "true" - policy.open-cluster-management.io/standards: generic - name: policy-require-pod-probes - namespace: kyverno-policies -spec: - disabled: false - policy-templates: - - objectDefinition: - apiVersion: policy.open-cluster-management.io/v1 - kind: ConfigurationPolicy - metadata: - name: inform-kyverno-require-pod-probes - spec: - namespaceSelector: - exclude: - - kube-* - include: - - '*' - object-templates: - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: ClusterPolicyReport - results: - - policy: require-pod-probes - result: fail - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: PolicyReport - results: - - policy: require-pod-probes - result: fail - remediationAction: inform - severity: medium ---- -apiVersion: policy.open-cluster-management.io/v1 -kind: Policy -metadata: - annotations: - policy.open-cluster-management.io/categories: setup - policy.open-cluster-management.io/controls: setup - policy.open-cluster-management.io/disable-templates: "true" - policy.open-cluster-management.io/standards: generic - name: require-requests-limits - namespace: kyverno-policies -spec: - disabled: false - policy-templates: - - objectDefinition: - apiVersion: policy.open-cluster-management.io/v1 - kind: ConfigurationPolicy - metadata: - name: inform-kyverno-require-requests-limits - spec: - namespaceSelector: - exclude: - - kube-* - include: - - '*' - object-templates: - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: ClusterPolicyReport - results: - - policy: require-requests-limits - result: fail - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: PolicyReport - results: - - policy: require-requests-limits - result: fail - remediationAction: inform - severity: medium ---- -apiVersion: policy.open-cluster-management.io/v1 -kind: Policy -metadata: - annotations: - policy.open-cluster-management.io/categories: setup - policy.open-cluster-management.io/controls: setup - policy.open-cluster-management.io/disable-templates: "true" - policy.open-cluster-management.io/standards: generic - name: require-tls-routes - namespace: kyverno-policies -spec: - disabled: false - policy-templates: - - objectDefinition: - apiVersion: policy.open-cluster-management.io/v1 - kind: ConfigurationPolicy - metadata: - name: inform-kyverno-check-routes - spec: - namespaceSelector: - exclude: - - kube-* - include: - - '*' - object-templates: - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: ClusterPolicyReport - results: - - policy: check-routes - result: fail - - complianceType: mustnothave - objectDefinition: - apiVersion: wgpolicyk8s.io/v1alpha2 - kind: PolicyReport - results: - - policy: check-routes - result: fail - remediationAction: inform - severity: medium ---- -apiVersion: policy.open-cluster-management.io/v1beta1 -kind: PolicySet -metadata: - name: kyverno-best-practices - namespace: kyverno-policies -spec: - description: Kyverno Best Practices - policies: - - application-field-validation - - application-prevent-default-project - - check-deprecated-apis - - check-openshift-deprecated-apis - - disallow-jenkins-pipeline-strategy - - disallow-latest-tag - - policy-require-pod-probes - - require-requests-limits ---- -apiVersion: policy.open-cluster-management.io/v1beta1 -kind: PolicySet -metadata: - name: kyverno-security - namespace: kyverno-policies -spec: - description: Kyverno Security - policies: - - disallow-scc-anyuid - - require-tls-routes diff --git a/cluster-config/components/kyverno-acm/base/placementrule.yaml b/cluster-config/components/kyverno-acm/base/placementrule.yaml deleted file mode 100644 index 8d13fa3..0000000 --- a/cluster-config/components/kyverno-acm/base/placementrule.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: apps.open-cluster-management.io/v1 -kind: PlacementRule -metadata: - name: kyverno -spec: - clusterConditions: - - status: "True" - type: ManagedClusterConditionAvailable - clusterSelector: - matchExpressions: - - key: policies - operator: In - values: - - kyverno diff --git a/cluster-config/components/kyverno/base/kustomization.yaml b/cluster-config/components/kyverno/base/kustomization.yaml deleted file mode 100644 index b3b445f..0000000 --- a/cluster-config/components/kyverno/base/kustomization.yaml +++ /dev/null @@ -1,23 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: -- namespace.yaml - -helmCharts: -- name: kyverno - version: 3.0.5 - repo: https://kyverno.github.io/kyverno/ - valuesFile: values.yaml - namespace: kyverno - releaseName: kyverno - -# Delete kyverno PDB, not useful on SNO -patches: - - patch: |- - $patch: delete - apiVersion: policy/v1 - kind: PodDisruptionBudget - metadata: - name: kyverno-admission-controller - namespace: kyverno diff --git a/cluster-config/components/kyverno/base/namespace.yaml b/cluster-config/components/kyverno/base/namespace.yaml deleted file mode 100644 index 3d79b42..0000000 --- a/cluster-config/components/kyverno/base/namespace.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - annotations: - openshift.io/description: Kyverno Policy Engine - openshift.io/display-name: Kyverno - name: kyverno diff --git a/cluster-config/components/kyverno/base/values.yaml b/cluster-config/components/kyverno/base/values.yaml deleted file mode 100644 index 5772ba7..0000000 --- a/cluster-config/components/kyverno/base/values.yaml +++ /dev/null @@ -1,269 +0,0 @@ -admissionController: - replicas: 3 - antiAffinity: - # anti-affinity won't work on SNO - enabled: false - resources: - limits: - memory: 512Mi - requests: - cpu: 100m - memory: 256Mi - -backgroundController: - replicas: 1 - antiAffinity: - # anti-affinity won't work on SNO - enabled: false - -cleanupController: - replicas: 1 - antiAffinity: - # anti-affinity won't work on SNO - enabled: false - resources: - limits: - memory: 256Mi - requests: - cpu: 100m - memory: 128Mi - -reportsController: - replicas: 1 - antiAffinity: - # anti-affinity won't work on SNO - enabled: false - resources: - limits: - memory: 256Mi - cpu: 4000m - requests: - cpu: 100m - memory: 128Mi - -crds: - install: true - annotations: - argocd.argoproj.io/sync-options: Validate=false,ServerSideApply=true - -apiVersionOverride: - podDisruptionBudget: policy/v1 - -config: - resourceFilters: - - '[Event,*,*]' - - '[*/*,default,*]' - - '[*/*,kube-system,*]' - - '[*/*,kube-public,*]' - - '[*/*,kube-node-lease,*]' - - '[*/*,openshift,*]' - - '[*/*, openshift-*, *]' - - '[*/*,open-cluster-*,*]' - - '[*/*,hive,*]' - - '[*/*, multicluster-engine,*]' - - '[*/*,stackrox,*]' - - '[*/*,rhacs-operator,*]' - - '[*/*,costmanagement-metrics-operator,*]' - - '[Node,*,*]' - - '[Node/*,*,*]' - - '[APIService,*,*]' - - '[APIService/*,*,*]' - - '[TokenReview,*,*]' - - '[SubjectAccessReview,*,*]' - - '[SelfSubjectAccessReview,*,*]' - - '[Binding,*,*]' - - '[Pod/binding,*,*]' - - '[ReplicaSet,*,*]' - - '[ReplicaSet/*,*,*]' - - '[AdmissionReport,*,*]' - - '[AdmissionReport/*,*,*]' - - '[ClusterAdmissionReport,*,*]' - - '[ClusterAdmissionReport/*,*,*]' - - '[BackgroundScanReport,*,*]' - - '[BackgroundScanReport/*,*,*]' - - '[ClusterBackgroundScanReport,*,*]' - - '[ClusterBackgroundScanReport/*,*,*]' - # exclude resources from the chart - - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}]' - - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:core]' - - '[ClusterRole,*,{{ template "kyverno.admission-controller.roleName" . }}:additional]' - - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}]' - - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:core]' - - '[ClusterRole,*,{{ template "kyverno.background-controller.roleName" . }}:additional]' - - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}]' - - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:core]' - - '[ClusterRole,*,{{ template "kyverno.cleanup-controller.roleName" . }}:additional]' - - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}]' - - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:core]' - - '[ClusterRole,*,{{ template "kyverno.reports-controller.roleName" . }}:additional]' - - '[ClusterRoleBinding,*,{{ template "kyverno.admission-controller.roleName" . }}]' - - '[ClusterRoleBinding,*,{{ template "kyverno.background-controller.roleName" . }}]' - - '[ClusterRoleBinding,*,{{ template "kyverno.cleanup-controller.roleName" . }}]' - - '[ClusterRoleBinding,*,{{ template "kyverno.reports-controller.roleName" . }}]' - - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]' - - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceAccountName" . }}]' - - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]' - - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.serviceAccountName" . }}]' - - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]' - - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.serviceAccountName" . }}]' - - '[ServiceAccount,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]' - - '[ServiceAccount/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.serviceAccountName" . }}]' - - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]' - - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]' - - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]' - - '[Role,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]' - - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.roleName" . }}]' - - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.roleName" . }}]' - - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.roleName" . }}]' - - '[RoleBinding,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.roleName" . }}]' - - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.configMapName" . }}]' - - '[ConfigMap,{{ include "kyverno.namespace" . }},{{ template "kyverno.config.metricsConfigMapName" . }}]' - - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - - '[Deployment,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - - '[Deployment/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]' - - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}-*]' - - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]' - - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-*]' - - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]' - - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-*]' - - '[Pod,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]' - - '[Pod/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-*]' - - '[Job,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]' - - '[Job/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.fullname" . }}-hook-pre-delete]' - - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - - '[NetworkPolicy,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - - '[NetworkPolicy/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.name" . }}]' - - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}]' - - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - - '[PodDisruptionBudget,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - - '[PodDisruptionBudget/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}]' - - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]' - - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}]' - - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]' - - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}-metrics]' - - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]' - - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.background-controller.name" . }}-metrics]' - - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}]' - - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]' - - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}-metrics]' - - '[Service,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]' - - '[Service/*,{{ include "kyverno.namespace" . }},{{ template "kyverno.reports-controller.name" . }}-metrics]' - - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.admission-controller.name" . }}]' - - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.background-controller.name" . }}]' - - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.cleanup-controller.name" . }}]' - - '[ServiceMonitor,{{ if .Values.admissionController.serviceMonitor.namespace }}{{ .Values.admissionController.serviceMonitor.namespace }}{{ else }}{{ template "kyverno.namespace" . }}{{ end }},{{ template "kyverno.reports-controller.name" . }}]' - - '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.admission-controller.serviceName" . }}.{{ template "kyverno.namespace" . }}.svc.*]' - - '[Secret,{{ include "kyverno.namespace" . }},{{ template "kyverno.cleanup-controller.name" . }}.{{ template "kyverno.namespace" . }}.svc.*]' - - webhooks: - # Exclude namespaces - - namespaceSelector: - matchExpressions: - - key: kubernetes.io/metadata.name - operator: NotIn - values: - # System namespaces - - default - - kyverno - - kube-system - - kube-node-lease - # OpenShift layered products - - assisted-installer - - cert-manager - - cert-manager-operator - - stackrox - - stackrox-secured-cluster-service - - rhacs-operator - - multicluster-engine - - open-cluster-management - - open-cluster-management-hub - - open-cluster-management-observability - - open-cluster-management-addon-observability - - open-cluster-management-agent - - open-cluster-management-agent-addon - - open-cluster-management-global-set - # Third Party - - external-secrets - # OpenShift namespaces - - openshift - - openshift-apiserver - - openshift-apiserver-operator - - openshift-authentication - - openshift-authentication-operator - - openshift-cloud-controller-manager - - openshift-cloud-controller-manager-operator - - openshift-cloud-credential-operator - - openshift-cloud-network-config-controller - - openshift-cluster-csi-drivers - - openshift-cluster-machine-approver - - openshift-cluster-node-tuning-operator - - openshift-cluster-samples-operator - - openshift-cluster-storage-operator - - openshift-cluster-version - - openshift-config - - openshift-config-managed - - openshift-config-operator - - openshift-console - - openshift-console-operator - - openshift-console-user-settings - - openshift-controller-manager - - openshift-controller-manager-operator - - openshift-dns - - openshift-dns-operator - - openshift-etcd - - openshift-etcd-operator - - openshift-gitops - - openshift-host-network - - openshift-image-registry - - openshift-infra - - openshift-ingress - - openshift-ingress-canary - - openshift-ingress-operator - - openshift-insights - - openshift-kni-infra - - openshift-kube-apiserver - - openshift-kube-apiserver-operator - - openshift-kube-controller-manager - - openshift-kube-controller-manager-operator - - openshift-kube-scheduler - - openshift-kube-scheduler-operator - - openshift-kube-storage-version-migrator - - openshift-kube-storage-version-migrator-operator - - openshift-machine-api - - openshift-machine-config-operator - - openshift-marketplace - - openshift-monitoring - - openshift-multus - - openshift-network-diagnostics - - openshift-network-operator - - openshift-node - - openshift-nutanix-infra - - openshift-oauth-apiserver - - openshift-openstack-infra - - openshift-operator-lifecycle-manager - - openshift-operators - - openshift-ovirt-infra - - openshift-ovn-kubernetes - - openshift-pipelines - - openshift-route-controller-manager - - openshift-service-ca - - openshift-service-ca-operator - - openshift-storage - - openshift-user-workload-monitoring - - openshift-vsphere-infra diff --git a/cluster-config/components/kyverno/overlays/policies/annotate-route-argo-external-link.yaml b/cluster-config/components/kyverno/overlays/policies/annotate-route-argo-external-link.yaml deleted file mode 100644 index bc98222..0000000 --- a/cluster-config/components/kyverno/overlays/policies/annotate-route-argo-external-link.yaml +++ /dev/null @@ -1,64 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: annotate-argo-cd-external-link - annotations: - policies.kyverno.io/title: Annotate Route with Argo CD External Link - policies.kyverno.io/category: Argo - policies.kyverno.io/minversion: 1.0.0 - policies.kyverno.io/severity: medium - policies.kyverno.io/subject: Route - policies.kyverno.io/description: >- - This policy adds an annotation to a route that will cause the Argo CD UI - to display an icon representing a clickable link for the route. -spec: - validationFailureAction: audit - rules: - - name: add-annotations-for-https - match: - any: - - resources: - kinds: - - route.openshift.io/v1/Route - operations: - - UPDATE - preconditions: - all: - - key: "{{ request.object.spec.host || '' }}" - operator: NotEquals - value: "" - - key: "{{ request.object.metadata.annotations.\"argocd.argoproj.io/tracking-id\" || '' }}" - operator: NotEquals - value: "" - - key: "{{ request.object.spec.tls.termination || '' }}" - operator: NotEquals - value: "" - mutate: - patchStrategicMerge: - metadata: - annotations: - +(link.argocd.argoproj.io/external-link): https://{{ request.object.spec.host }}/{{ request.object.spec.path || '' }} - - name: add-annotations-for-http - match: - any: - - resources: - kinds: - - route.openshift.io/v1/Route - operations: - - UPDATE - preconditions: - all: - - key: "{{ request.object.spec.host || '' }}" - operator: NotEquals - value: "" - - key: "{{ request.object.metadata.annotations.\"argocd.argoproj.io/tracking-id\" || '' }}" - operator: NotEquals - value: "" - - key: "{{ request.object.spec.tls.termination || '' }}" - operator: Equals - value: "" - mutate: - patchStrategicMerge: - metadata: - annotations: - +(link.argocd.argoproj.io/external-link): http://{{ request.object.spec.host }}/{{ request.object.spec.path || '' }} diff --git a/cluster-config/components/kyverno/overlays/policies/application-field-validation.yaml b/cluster-config/components/kyverno/overlays/policies/application-field-validation.yaml deleted file mode 100644 index 10f817b..0000000 --- a/cluster-config/components/kyverno/overlays/policies/application-field-validation.yaml +++ /dev/null @@ -1,57 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: application-field-validation - annotations: - policies.kyverno.io/title: Application Field Validation - policies.kyverno.io/category: Argo - policies.kyverno.io/severity: medium - policies.kyverno.io/subject: Application - kyverno.io/kyverno-version: 1.6.0 - policies.kyverno.io/minversion: 1.6.0 - kyverno.io/kubernetes-version: "1.23" - policies.kyverno.io/description: >- - This policy performs some best practices validation on Application fields. - Path or chart must be specified but never both. And destination.name or - destination.server must be specified but never both. -spec: - validationFailureAction: audit - failurePolicy: Ignore - background: false - rules: - - name: source-path-chart - match: - any: - - resources: - kinds: - - Application - validate: - message: >- - `spec.source.path` OR `spec.source.chart` should be specified but never both. - anyPattern: - - spec: - source: - path: '?*' - X(chart): - - spec: - source: - X(path): - chart: '?*' - - name: destination-server-name - match: - any: - - resources: - kinds: - - Application - validate: - message: >- - `spec.destination.server` OR `spec.destination.name` should be specified but never both. - anyPattern: - - spec: - destination: - server: '?*' - X(name): - - spec: - destination: - X(server): - name: '?*' diff --git a/cluster-config/components/kyverno/overlays/policies/application-prevent-default-project.yaml b/cluster-config/components/kyverno/overlays/policies/application-prevent-default-project.yaml deleted file mode 100644 index 51149c5..0000000 --- a/cluster-config/components/kyverno/overlays/policies/application-prevent-default-project.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: application-prevent-default-project - annotations: - policies.kyverno.io/title: Prevent Use of Default Project - policies.kyverno.io/category: Argo - policies.kyverno.io/severity: medium - kyverno.io/kyverno-version: 1.6.2 - policies.kyverno.io/minversion: 1.6.0 - kyverno.io/kubernetes-version: "1.23" - policies.kyverno.io/subject: Application - policies.kyverno.io/description: >- - This policy prevents the use of the default project in an Application. -spec: - validationFailureAction: audit - failurePolicy: Ignore - background: false - rules: - - name: default-project - match: - any: - - resources: - kinds: - - Application - preconditions: - all: - - key: "{{ request.operation }}" - operator: NotEquals - value: DELETE - validate: - message: "The default project may not be used in an Application." - pattern: - spec: - project: "!default" diff --git a/cluster-config/components/kyverno/overlays/policies/check-deprecated-apis.yaml b/cluster-config/components/kyverno/overlays/policies/check-deprecated-apis.yaml deleted file mode 100644 index 10e6625..0000000 --- a/cluster-config/components/kyverno/overlays/policies/check-deprecated-apis.yaml +++ /dev/null @@ -1,119 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: check-deprecated-apis - annotations: - policies.kyverno.io/title: Check deprecated APIs - policies.kyverno.io/category: Best Practices - policies.kyverno.io/subject: Kubernetes APIs - kyverno.io/kyverno-version: 1.7.4 - policies.kyverno.io/minversion: 1.7.4 - kyverno.io/kubernetes-version: "1.23" - policies.kyverno.io/description: >- - Kubernetes APIs are sometimes deprecated and removed after a few releases. - As a best practice, older API versions should be replaced with newer versions. - This policy validates for APIs that are deprecated or scheduled for removal. - Note that checking for some of these resources may require modifying the Kyverno - ConfigMap to remove filters. In the validate-v1-22-removals rule, the Lease kind - has been commented out due to a check for this kind having a performance penalty - on Kubernetes clusters with many leases. Its enabling should be attended carefully - and is not recommended on large clusters. PodSecurityPolicy is removed in v1.25 - so therefore the validate-v1-25-removals rule may not completely work on 1.25+. - This policy requires Kyverno v1.7.4+ to function properly. -spec: - validationFailureAction: audit - background: true - rules: - - name: validate-v1-25-removals - match: - any: - - resources: - # NOTE: PodSecurityPolicy is completely removed in 1.25. - kinds: - - batch/*/CronJob - - discovery.k8s.io/*/EndpointSlice - - events.k8s.io/*/Event - - policy/*/PodDisruptionBudget - - node.k8s.io/*/RuntimeClass - preconditions: - all: - - key: "{{ request.operation || 'BACKGROUND' }}" - operator: NotEquals - value: DELETE - - key: "{{request.object.apiVersion}}" - operator: AnyIn - value: - - batch/v1beta1 - - discovery.k8s.io/v1beta1 - - events.k8s.io/v1beta1 - - policy/v1beta1 - - node.k8s.io/v1beta1 - validate: - message: >- - {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.25. - See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/ - deny: {} - - name: validate-v1-26-removals - match: - any: - - resources: - kinds: - - flowcontrol.apiserver.k8s.io/*/FlowSchema - - flowcontrol.apiserver.k8s.io/*/PriorityLevelConfiguration - - autoscaling/*/HorizontalPodAutoscaler - preconditions: - all: - - key: "{{ request.operation || 'BACKGROUND' }}" - operator: NotEquals - value: DELETE - - key: "{{request.object.apiVersion}}" - operator: AnyIn - value: - - flowcontrol.apiserver.k8s.io/v1beta1 - - autoscaling/v2beta2 - validate: - message: >- - {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.26. - See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/ - deny: {} - - name: validate-v1-27-removals - match: - any: - - resources: - kinds: - - storage.k8s.io/*/CSIStorageCapacity - preconditions: - all: - - key: "{{ request.operation || 'BACKGROUND' }}" - operator: NotEquals - value: DELETE - - key: "{{request.object.apiVersion}}" - operator: AnyIn - value: - - storage.k8s.io/v1beta1 - validate: - message: >- - {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.27. - See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/ - deny: {} - - name: validate-v1-29-removals - match: - any: - - resources: - kinds: - - flowcontrol.apiserver.k8s.io/*/FlowSchema - - flowcontrol.apiserver.k8s.io/*/PriorityLevelConfiguration - preconditions: - all: - - key: "{{ request.operation || 'BACKGROUND' }}" - operator: NotEquals - value: DELETE - - key: "{{request.object.apiVersion}}" - operator: AnyIn - value: - - flowcontrol.apiserver.k8s.io/v1beta2 - validate: - message: >- - {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated and will be removed in v1.29. - See: https://kubernetes.io/docs/reference/using-api/deprecation-guide/ - deny: {} diff --git a/cluster-config/components/kyverno/overlays/policies/check-openshift-deprecated-apis.yaml b/cluster-config/components/kyverno/overlays/policies/check-openshift-deprecated-apis.yaml deleted file mode 100644 index 32beb14..0000000 --- a/cluster-config/components/kyverno/overlays/policies/check-openshift-deprecated-apis.yaml +++ /dev/null @@ -1,36 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: check-openshift-deprecated-apis - annotations: - policies.kyverno.io/title: Disallow deprecated APIs - policies.kyverno.io/category: OpenShift - policies.kyverno.io/severity: medium - kyverno.io/kyverno-version: 1.6.0 - policies.kyverno.io/minversion: 1.6.0 - kyverno.io/kubernetes-version: "1.20" - policies.kyverno.io/subject: ClusterRole,ClusterRoleBinding,Role,RoleBinding,RBAC - policies.kyverno.io/description: >- - OpenShift APIs are sometimes deprecated and removed after a few releases. - As a best practice, older API versions should be replaced with newer versions. - This policy validates for APIs that are deprecated or scheduled for removal. - Note that checking for some of these resources may require modifying the Kyverno - ConfigMap to remove filters. -spec: - validationFailureAction: enforce - failurePolicy: Ignore - background: false - rules: - - name: check-deprecated-apis - match: - any: - - resources: - kinds: - - authorization.openshift.io/v1/ClusterRole - - authorization.openshift.io/v1/ClusterRoleBinding - - authorization.openshift.io/v1/Role - - authorization.openshift.io/v1/RoleBinding - validate: - message: >- - {{ request.object.apiVersion }}/{{ request.object.kind }} is deprecated. - deny: {} diff --git a/cluster-config/components/kyverno/overlays/policies/disallow-anyuid-scc-policy.yaml b/cluster-config/components/kyverno/overlays/policies/disallow-anyuid-scc-policy.yaml deleted file mode 100644 index 6485d06..0000000 --- a/cluster-config/components/kyverno/overlays/policies/disallow-anyuid-scc-policy.yaml +++ /dev/null @@ -1,56 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: disallow-security-context-constraint-anyuid - annotations: - policies.kyverno.io/title: Disallow use of the SecurityContextConstraint (SCC) anyuid - policies.kyverno.io/category: Security - policies.kyverno.io/severity: high - kyverno.io/kyverno-version: 1.6.0 - policies.kyverno.io/minversion: 1.6.0 - kyverno.io/kubernetes-version: "1.20" - policies.kyverno.io/subject: Role,ClusterRole - policies.kyverno.io/description: >- - Disallow the use of the SecurityContextConstraint (SCC) anyuid which allows a pod to run with the UID as declared in the image instead of a random UID -spec: - validationFailureAction: audit - failurePolicy: Ignore - background: false - rules: - - name: check-security-context-constraint - match: - any: - - resources: - kinds: - - ClusterRole - - Role - validate: - message: >- - Use of the SecurityContextConstraint (SCC) anyuid is not allowed - foreach: - - list: request.object.rules[] - deny: - conditions: - all: - - key: anyuid - operator: AnyIn - value: "{{element.resourceNames[]}}" - - key: "{{ element.verbs[] | contains(@, 'use') || contains(@, '*') }}" - operator: Equals - value: true - - name: check-security-context-roleref - match: - any: - - resources: - kinds: - - ClusterRoleBinding - - RoleBinding - validate: - message: >- - Use of the SecurityContextConstraint (SCC) anyuid is not allowed - deny: - conditions: - all: - - key: system:openshift:scc:anyuid - operator: Equals - value: "{{request.object.roleRef.name}}" diff --git a/cluster-config/components/kyverno/overlays/policies/disallow-jenkins-pipeline-strategy.yaml b/cluster-config/components/kyverno/overlays/policies/disallow-jenkins-pipeline-strategy.yaml deleted file mode 100644 index c7e5379..0000000 --- a/cluster-config/components/kyverno/overlays/policies/disallow-jenkins-pipeline-strategy.yaml +++ /dev/null @@ -1,34 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: disallow-jenkins-pipeline-strategy - annotations: - policies.kyverno.io/title: Disallow OpenShift Jenkins Pipeline Build Strategy - policies.kyverno.io/category: OpenShift - policies.kyverno.io/severity: medium - kyverno.io/kyverno-version: 1.6.0 - policies.kyverno.io/minversion: 1.6.0 - kyverno.io/kubernetes-version: "1.20" - policies.kyverno.io/subject: BuildConfig - policies.kyverno.io/description: >- - The Jenkins Pipeline Build Strategy has been deprecated. This policy prevents its use. Use OpenShift Pipelines instead. -spec: - validationFailureAction: enforce - failurePolicy: Ignore - background: false - rules: - - name: check-build-strategy - match: - any: - - resources: - kinds: - - build.openshift.io/v1/BuildConfig - validate: - message: >- - Jenkins Pipeline Build Strategy has been deprecated and is not allowed - deny: - conditions: - all: - - key: "{{ keys(request.object.spec.strategy) | contains(@, 'jenkinsPipelineStrategy') }}" - operator: Equals - value: true diff --git a/cluster-config/components/kyverno/overlays/policies/disallow-latest-tag.yaml b/cluster-config/components/kyverno/overlays/policies/disallow-latest-tag.yaml deleted file mode 100644 index 5a58103..0000000 --- a/cluster-config/components/kyverno/overlays/policies/disallow-latest-tag.yaml +++ /dev/null @@ -1,41 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: disallow-latest-tag - annotations: - policies.kyverno.io/title: Disallow Latest Tag - policies.kyverno.io/category: Best Practices - policies.kyverno.io/severity: medium - policies.kyverno.io/subject: Pod - policies.kyverno.io/description: >- - The ':latest' tag is mutable and can lead to unexpected errors if the - image changes. A best practice is to use an immutable tag that maps to - a specific version of an application Pod. This policy validates that the image - specifies a tag and that it is not called `latest`. -spec: - validationFailureAction: audit - failurePolicy: Ignore - background: false - rules: - - name: require-image-tag - match: - resources: - kinds: - - Pod - validate: - message: "An image tag is required." - pattern: - spec: - containers: - - image: "*:*" - - name: validate-image-tag - match: - resources: - kinds: - - Pod - validate: - message: "Using a mutable image tag e.g. 'latest' is not allowed." - pattern: - spec: - containers: - - image: "!*:latest" diff --git a/cluster-config/components/kyverno/overlays/policies/kustomization.yaml b/cluster-config/components/kyverno/overlays/policies/kustomization.yaml deleted file mode 100644 index 10ac092..0000000 --- a/cluster-config/components/kyverno/overlays/policies/kustomization.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -commonAnnotations: - argocd.argoproj.io/compare-options: IgnoreExtraneous - -resources: -- ../../base -- validate-probes-policy.yaml -- require-requests-limits-policy.yaml -- disallow-anyuid-scc-policy.yaml -- require-tls-routes.yaml -- check-deprecated-apis.yaml -- check-openshift-deprecated-apis.yaml -- disallow-latest-tag.yaml -- disallow-jenkins-pipeline-strategy.yaml -- application-prevent-default-project.yaml -- application-field-validation.yaml -# - annotate-route-argo-external-link.yaml diff --git a/cluster-config/components/kyverno/overlays/policies/require-requests-limits-policy.yaml b/cluster-config/components/kyverno/overlays/policies/require-requests-limits-policy.yaml deleted file mode 100644 index 45b305a..0000000 --- a/cluster-config/components/kyverno/overlays/policies/require-requests-limits-policy.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: require-requests-limits - annotations: - policies.kyverno.io/title: Require Limits and Requests - policies.kyverno.io/category: Multi-Tenancy - policies.kyverno.io/severity: medium - policies.kyverno.io/subject: Pod - policies.kyverno.io/description: >- - As application workloads share cluster resources, it is important to limit resources - requested and consumed by each Pod. It is recommended to require resource requests and - limits per Pod, especially for memory and CPU. If a Namespace level request or limit is specified, - defaults will automatically be applied to each Pod based on the LimitRange configuration. - This policy validates that all containers have something specified for memory and CPU - requests and memory limits. -spec: - validationFailureAction: audit - failurePolicy: Ignore - background: false - rules: - - name: validate-resources - match: - resources: - kinds: - - Pod - validate: - message: "CPU and memory resource requests and limits are required." - pattern: - spec: - containers: - - resources: - requests: - memory: "?*" - cpu: "?*" - limits: - memory: "?*" diff --git a/cluster-config/components/kyverno/overlays/policies/require-tls-routes.yaml b/cluster-config/components/kyverno/overlays/policies/require-tls-routes.yaml deleted file mode 100644 index 489cfa6..0000000 --- a/cluster-config/components/kyverno/overlays/policies/require-tls-routes.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: check-routes - annotations: - policies.kyverno.io/title: Require TLS routes in OpenShift - policies.kyverno.io/category: OpenShift - policies.kyverno.io/severity: high - kyverno.io/kyverno-version: 1.6.0 - policies.kyverno.io/minversion: 1.6.0 - kyverno.io/kubernetes-version: "1.20" - policies.kyverno.io/subject: Route - policies.kyverno.io/description: |- - HTTP traffic is not encrypted and hence insecure. This policy prevents configuration of OpenShift HTTP routes. -spec: - validationFailureAction: audit - failurePolicy: Ignore - background: false - rules: - - name: require-tls-routes - match: - any: - - resources: - kinds: - - route.openshift.io/v1/Route - preconditions: - all: - - key: "{{ request.operation }}" - operator: NotEquals - value: ["DELETE"] - validate: - message: >- - HTTP routes are not allowed. Configure TLS for secure routes. - deny: - conditions: - all: - - key: "{{ keys(request.object.spec) | contains(@, 'tls') }}" - operator: Equals - value: false diff --git a/cluster-config/components/kyverno/overlays/policies/validate-probes-policy.yaml b/cluster-config/components/kyverno/overlays/policies/validate-probes-policy.yaml deleted file mode 100644 index 72c06dd..0000000 --- a/cluster-config/components/kyverno/overlays/policies/validate-probes-policy.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: require-pod-probes - annotations: - pod-policies.kyverno.io/autogen-controllers: DaemonSet,Deployment,StatefulSet - policies.kyverno.io/title: Require Pod Probes - policies.kyverno.io/category: Best Practices - policies.kyverno.io/severity: medium - policies.kyverno.io/subject: Pod - policies.kyverno.io/description: >- - Liveness and readiness probes need to be configured to correctly manage a Pod's - lifecycle during deployments, restarts, and upgrades. For each Pod, a periodic - `livenessProbe` is performed by the kubelet to determine if the Pod's containers - are running or need to be restarted. A `readinessProbe` is used by Services - and Deployments to determine if the Pod is ready to receive network traffic. - This policy validates that all containers have liveness and readiness probes by - ensuring the `periodSeconds` field is greater than zero. -spec: - validationFailureAction: audit - failurePolicy: Ignore - background: false - rules: - - name: validate-livenessProbe-readinessProbe - match: - resources: - kinds: - - Pod - validate: - message: "Liveness and readiness probes are required." - pattern: - spec: - containers: - - livenessProbe: - periodSeconds: ">0" - readinessProbe: - periodSeconds: ">0" diff --git a/cluster-config/components/kyverno/overlays/policies/verify-signed-images.yaml b/cluster-config/components/kyverno/overlays/policies/verify-signed-images.yaml deleted file mode 100644 index 4c57b6b..0000000 --- a/cluster-config/components/kyverno/overlays/policies/verify-signed-images.yaml +++ /dev/null @@ -1,43 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: verify-signed-image - annotations: - policies.kyverno.io/title: Verify Signed Images - policies.kyverno.io/category: Security - policies.kyverno.io/severity: high - policies.kyverno.io/subject: Pod - policies.kyverno.io/description: >- - Validates signed images against specified certificates -spec: - validationFailureAction: audit - failurePolicy: Ignore - background: false - webhookTimeoutSeconds: 30 - rules: - - name: verify-image-quay-io-gnunn-client - match: - any: - - resources: - kinds: - - Pod - verifyImages: - - image: "quay.io/gnunn/client:*" - key: |- - -----BEGIN PUBLIC KEY----- - MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjWno6IupPFSRi9btNhFtMeS1iQbM - gN6OWsfUdhfT5TCf23ESE3vfuMWtX9syvjmemuGpZ+/fRDOyqAbVnAGNpQ== - -----END PUBLIC KEY----- - - name: verify-image-quay-io-gnunn-server - match: - any: - - resources: - kinds: - - Pod - verifyImages: - - image: "quay.io/gnunn/server:*" - key: |- - -----BEGIN PUBLIC KEY----- - MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEjWno6IupPFSRi9btNhFtMeS1iQbM - gN6OWsfUdhfT5TCf23ESE3vfuMWtX9syvjmemuGpZ+/fRDOyqAbVnAGNpQ== - -----END PUBLIC KEY----- diff --git a/cluster-config/components/login-template/base/kustomization.yaml b/cluster-config/components/login-template/base/kustomization.yaml deleted file mode 100644 index 1a45cc7..0000000 --- a/cluster-config/components/login-template/base/kustomization.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -namespace: openshift-config - -secretGenerator: -- name: matrix-login-template - options: - disableNameSuffixHash: true - files: - - login/login.html -- name: matrix-providers-template - options: - disableNameSuffixHash: true - files: - - login/providers.html diff --git a/cluster-config/components/login-template/base/login/login.html b/cluster-config/components/login-template/base/login/login.html deleted file mode 100644 index 0481517..0000000 --- a/cluster-config/components/login-template/base/login/login.html +++ /dev/null @@ -1,1699 +0,0 @@ - - - - - - Login - - - - - - - - - - - -
- -
- Red Hat OpenShift Container Platform logo -

Log in to your account

- - - - {{ if .Error }} -
{{ .Error }}
- - {{ end }} - -
- - -
- -
- - -
-
- -
- -
-
- - - - diff --git a/cluster-config/components/login-template/base/login/providers.html b/cluster-config/components/login-template/base/login/providers.html deleted file mode 100644 index 4d1c001..0000000 --- a/cluster-config/components/login-template/base/login/providers.html +++ /dev/null @@ -1,772 +0,0 @@ - - - - Login - - - - - - - - - - -
-
- Red Hat OpenShift Container Platform logo - {{ if eq (len .Providers) 1}} -
- Log In -
- {{ else }} -

Log in with...

- {{ range $provider := .Providers }} -
- {{$provider.Name}} -
- {{ end }} {{ end }} -
-
- - - diff --git a/cluster-config/components/loki/instance/base/clusterlogforwarder.yaml b/cluster-config/components/loki/instance/base/clusterlogforwarder.yaml deleted file mode 100644 index 99350b3..0000000 --- a/cluster-config/components/loki/instance/base/clusterlogforwarder.yaml +++ /dev/null @@ -1,39 +0,0 @@ -apiVersion: logging.openshift.io/v1 -kind: ClusterLogForwarder -metadata: - name: instance - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - outputs: - - name: loki-app - type: loki - url: http://lokistack-gateway-http.openshift-logging.svc:8080/api/logs/v1/application - secret: - name: lokistack-gateway-bearer-token - - name: loki-infra - type: loki - url: http://lokistack-gateway-http.openshift-logging.svc:8080/api/logs/v1/infrastructure - secret: - name: lokistack-gateway-bearer-token - - name: loki-audit - type: loki - url: http://lokistack-gateway-http.openshift-logging.svc:8080/api/logs/v1/audit - secret: - name: lokistack-gateway-bearer-token - pipelines: - - name: send-app-logs - inputRefs: - - application - outputRefs: - - loki-app - - name: send-infra-logs - inputRefs: - - infrastructure - outputRefs: - - loki-infra - - name: send-audit-logs - inputRefs: - - audit - outputRefs: - - loki-audit diff --git a/cluster-config/components/loki/instance/base/clusterlogging.yaml b/cluster-config/components/loki/instance/base/clusterlogging.yaml deleted file mode 100644 index bdeaa5e..0000000 --- a/cluster-config/components/loki/instance/base/clusterlogging.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: logging.openshift.io/v1 -kind: ClusterLogging -metadata: - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - name: instance -spec: - managementState: Managed - logStore: - type: lokistack - lokistack: - name: logging-loki - collection: - type: vector diff --git a/cluster-config/components/loki/instance/base/kustomization.yaml b/cluster-config/components/loki/instance/base/kustomization.yaml deleted file mode 100644 index 8a389df..0000000 --- a/cluster-config/components/loki/instance/base/kustomization.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -namespace: openshift-logging - -resources: -- lokigateway-secret.yaml -# - role.yaml -- lokistack.yaml -# - clusterlogforwarder.yaml -- clusterlogging.yaml diff --git a/cluster-config/components/loki/instance/base/lokigateway-secret.yaml b/cluster-config/components/loki/instance/base/lokigateway-secret.yaml deleted file mode 100644 index 06204d9..0000000 --- a/cluster-config/components/loki/instance/base/lokigateway-secret.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: v1 -data: - token: L3Zhci9ydW4vc2VjcmV0cy9rdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3Rva2Vu -kind: Secret -metadata: - name: lokistack-gateway-bearer-token -type: Opaque diff --git a/cluster-config/components/loki/instance/base/lokistack.yaml b/cluster-config/components/loki/instance/base/lokistack.yaml deleted file mode 100644 index 5b33448..0000000 --- a/cluster-config/components/loki/instance/base/lokistack.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: loki.grafana.com/v1 -kind: LokiStack -metadata: - name: logging-loki - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - size: 1x.extra-small - storage: - schemas: - - effectiveDate: '2022-06-01' - version: v12 - secret: - name: loki-storage - type: s3 - storageClassName: lvms-vg1 - tenants: - mode: openshift-logging diff --git a/cluster-config/components/loki/instance/base/role.yaml b/cluster-config/components/loki/instance/base/role.yaml deleted file mode 100644 index 79f8c42..0000000 --- a/cluster-config/components/loki/instance/base/role.yaml +++ /dev/null @@ -1,29 +0,0 @@ ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: lokistack-tenant-logs -rules: -- apiGroups: - - 'loki.grafana.com' - resources: - - application - - infrastructure - - audit - resourceNames: - - logs - verbs: - - 'create' ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: lokistack-tenant-logs -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: lokistack-tenant-logs -subjects: -- kind: ServiceAccount - name: logcollector - namespace: openshift-logging diff --git a/cluster-config/components/loki/instance/overlays/sno/ingestion-rate-patch.yaml b/cluster-config/components/loki/instance/overlays/sno/ingestion-rate-patch.yaml deleted file mode 100644 index 7a29077..0000000 --- a/cluster-config/components/loki/instance/overlays/sno/ingestion-rate-patch.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: loki.grafana.com/v1beta1 -kind: LokiStack -metadata: - name: lokistack -spec: - limits: - global: - ingestion: - ingestionRate: 12 - ingestionBurstSize: 15 - size: 1x.extra-small diff --git a/cluster-config/components/loki/instance/overlays/sno/kustomization.yaml b/cluster-config/components/loki/instance/overlays/sno/kustomization.yaml deleted file mode 100644 index 5fa069c..0000000 --- a/cluster-config/components/loki/instance/overlays/sno/kustomization.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -namespace: openshift-logging - -resources: -- ../../base - -patches: -- patch: |- - - op: replace - path: /spec/size - value: 1x.extra-small - target: - kind: LokiStack - name: logging-loki -- path: ingestion-rate-patch.yaml - target: - kind: LokiStack - name: logging-loki diff --git a/cluster-config/components/loki/operator/cluster-logging/base/kustomization.yaml b/cluster-config/components/loki/operator/cluster-logging/base/kustomization.yaml deleted file mode 100644 index 678b783..0000000 --- a/cluster-config/components/loki/operator/cluster-logging/base/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -namespace: openshift-logging - -resources: -- namespace.yaml -- operatorgroup.yaml -- subscription.yaml diff --git a/cluster-config/components/loki/operator/cluster-logging/base/namespace.yaml b/cluster-config/components/loki/operator/cluster-logging/base/namespace.yaml deleted file mode 100644 index 2d1cfd0..0000000 --- a/cluster-config/components/loki/operator/cluster-logging/base/namespace.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - labels: - openshift.io/cluster-monitoring: "true" - name: openshift-logging diff --git a/cluster-config/components/loki/operator/cluster-logging/base/operatorgroup.yaml b/cluster-config/components/loki/operator/cluster-logging/base/operatorgroup.yaml deleted file mode 100644 index 06b23d8..0000000 --- a/cluster-config/components/loki/operator/cluster-logging/base/operatorgroup.yaml +++ /dev/null @@ -1,7 +0,0 @@ -apiVersion: operators.coreos.com/v1 -kind: OperatorGroup -metadata: - name: openshift-logging -spec: - targetNamespaces: - - openshift-logging diff --git a/cluster-config/components/loki/operator/cluster-logging/base/subscription.yaml b/cluster-config/components/loki/operator/cluster-logging/base/subscription.yaml deleted file mode 100644 index ad10122..0000000 --- a/cluster-config/components/loki/operator/cluster-logging/base/subscription.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: cluster-logging -spec: - channel: stable-5.5 - installPlanApproval: Automatic - name: cluster-logging - source: redhat-operators - sourceNamespace: openshift-marketplace diff --git a/cluster-config/components/loki/operator/loki/base/kustomization.yaml b/cluster-config/components/loki/operator/loki/base/kustomization.yaml deleted file mode 100644 index a6f982b..0000000 --- a/cluster-config/components/loki/operator/loki/base/kustomization.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -namespace: openshift-operators-redhat - -resources: -- namespace.yaml -- operatorgroup.yaml -- subscription.yaml diff --git a/cluster-config/components/loki/operator/loki/base/namespace.yaml b/cluster-config/components/loki/operator/loki/base/namespace.yaml deleted file mode 100644 index 41501f2..0000000 --- a/cluster-config/components/loki/operator/loki/base/namespace.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - labels: - openshift.io/cluster-monitoring: "true" - name: openshift-operators-redhat diff --git a/cluster-config/components/loki/operator/loki/base/operatorgroup.yaml b/cluster-config/components/loki/operator/loki/base/operatorgroup.yaml deleted file mode 100644 index b1b447a..0000000 --- a/cluster-config/components/loki/operator/loki/base/operatorgroup.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: operators.coreos.com/v1 -kind: OperatorGroup -metadata: - name: openshift-operators-redhat -spec: {} diff --git a/cluster-config/components/loki/operator/loki/base/subscription.yaml b/cluster-config/components/loki/operator/loki/base/subscription.yaml deleted file mode 100644 index a15b07a..0000000 --- a/cluster-config/components/loki/operator/loki/base/subscription.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: loki-operator -spec: - channel: stable - installPlanApproval: Automatic - name: loki-operator - source: redhat-operators - sourceNamespace: openshift-marketplace diff --git a/cluster-config/components/lvm-operator/base/kustomization.yaml b/cluster-config/components/lvm-operator/base/kustomization.yaml deleted file mode 100644 index c75dae2..0000000 --- a/cluster-config/components/lvm-operator/base/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -namespace: openshift-storage - -resources: - - subscription.yaml - - lvmcluster.yaml diff --git a/cluster-config/components/lvm-operator/base/lvmcluster.yaml b/cluster-config/components/lvm-operator/base/lvmcluster.yaml deleted file mode 100644 index 2c167ba..0000000 --- a/cluster-config/components/lvm-operator/base/lvmcluster.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: lvm.topolvm.io/v1alpha1 -kind: LVMCluster -metadata: - name: lvmcluster - namespace: openshift-storage - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true -spec: - storage: - deviceClasses: - - name: vg1 - default: true - thinPoolConfig: - name: thin-pool-1 - overprovisionRatio: 10 - sizePercent: 90 diff --git a/cluster-config/components/lvm-operator/base/subscription.yaml b/cluster-config/components/lvm-operator/base/subscription.yaml deleted file mode 100644 index 3f9f810..0000000 --- a/cluster-config/components/lvm-operator/base/subscription.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: lvms-operator - namespace: openshift-storage -spec: - channel: stable-4.17 - installPlanApproval: Automatic - name: lvms-operator - source: redhat-operators - sourceNamespace: openshift-marketplace diff --git a/cluster-config/components/lvm-operator/overlays/standalone/kustomization.yaml b/cluster-config/components/lvm-operator/overlays/standalone/kustomization.yaml deleted file mode 100644 index b7be712..0000000 --- a/cluster-config/components/lvm-operator/overlays/standalone/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -resources: -- ../../base -- namespace.yaml -- operatorgroup.yaml diff --git a/cluster-config/components/lvm-operator/overlays/standalone/namespace.yaml b/cluster-config/components/lvm-operator/overlays/standalone/namespace.yaml deleted file mode 100644 index 71549fb..0000000 --- a/cluster-config/components/lvm-operator/overlays/standalone/namespace.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - labels: - openshift.io/cluster-monitoring: "true" - name: openshift-storage diff --git a/cluster-config/components/lvm-operator/overlays/standalone/operatorgroup.yaml b/cluster-config/components/lvm-operator/overlays/standalone/operatorgroup.yaml deleted file mode 100644 index 4f4024d..0000000 --- a/cluster-config/components/lvm-operator/overlays/standalone/operatorgroup.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: operators.coreos.com/v1 -kind: OperatorGroup -metadata: - name: openshift-storage - namespace: openshift-storage -spec: - targetNamespaces: - - openshift-storage - upgradeStrategy: Default diff --git a/cluster-config/components/oauth/base/oauth.yaml b/cluster-config/components/oauth/base/oauth.yaml deleted file mode 100644 index bf7f937..0000000 --- a/cluster-config/components/oauth/base/oauth.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: config.openshift.io/v1 -kind: OAuth -metadata: - name: cluster -spec: - identityProviders: [] diff --git a/cluster-config/components/oauth/overlays/glauth/kustomization.yaml b/cluster-config/components/oauth/overlays/glauth/kustomization.yaml deleted file mode 100644 index 8d16ac3..0000000 --- a/cluster-config/components/oauth/overlays/glauth/kustomization.yaml +++ /dev/null @@ -1,32 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1alpha1 -kind: Component - -resources: -- ldap-external-secret.yaml - -patches: - - patch: |- - - op: add - path: /spec/identityProviders/- - value: - name: Internal - mappingMethod: claim - type: LDAP - ldap: - attributes: - id: - - dn - name: - - cn - preferredUsername: - - uid - bindDN: "openshift,dc=ocplab,dc=com" - bindPassword: - name: ldap-secret - insecure: true - url: "ldap://infra-server/ou=users,dc=ocplab,dc=com?uid" - target: - group: config.openshift.io - kind: OAuth - name: cluster - version: v1 diff --git a/cluster-config/components/oauth/overlays/glauth/ldap-external-secret.yaml b/cluster-config/components/oauth/overlays/glauth/ldap-external-secret.yaml deleted file mode 100644 index a156ffa..0000000 --- a/cluster-config/components/oauth/overlays/glauth/ldap-external-secret.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: ldap-secret - namespace: openshift-config -spec: - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: ldap-secret - data: - - secretKey: bindPassword - remoteRef: - key: LDAP diff --git a/cluster-config/components/oauth/overlays/google/google-client-secret.yaml b/cluster-config/components/oauth/overlays/google/google-client-secret.yaml deleted file mode 100644 index 15463eb..0000000 --- a/cluster-config/components/oauth/overlays/google/google-client-secret.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: google-secret - namespace: openshift-config -spec: - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: google-secret - data: - - secretKey: clientSecret - remoteRef: - key: GOOGLE_SSO diff --git a/cluster-config/components/oauth/overlays/google/kustomization.yaml b/cluster-config/components/oauth/overlays/google/kustomization.yaml deleted file mode 100644 index 471c59e..0000000 --- a/cluster-config/components/oauth/overlays/google/kustomization.yaml +++ /dev/null @@ -1,24 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1alpha1 -kind: Component - -resources: -- google-client-secret.yaml - -patches: - - patch: |- - - op: add - path: /spec/identityProviders/- - value: - google: - clientID: 853224504221-d1vvbaokui9cnq5ge7pcih1sfl26sq69.apps.googleusercontent.com - clientSecret: - name: google-secret - hostedDomain: redhat.com - mappingMethod: claim - name: RedHatSSO - type: Google - target: - group: config.openshift.io - kind: OAuth - name: cluster - version: v1 diff --git a/cluster-config/components/oauth/overlays/google/patch-google-idp.yaml b/cluster-config/components/oauth/overlays/google/patch-google-idp.yaml deleted file mode 100644 index 83ee5f5..0000000 --- a/cluster-config/components/oauth/overlays/google/patch-google-idp.yaml +++ /dev/null @@ -1,11 +0,0 @@ -- op: add - path: /spec/identityProviders/1 - value: - google: - clientID: 853224504221-d1vvbaokui9cnq5ge7pcih1sfl26sq69.apps.googleusercontent.com - clientSecret: - name: google-secret - hostedDomain: redhat.com - mappingMethod: claim - name: RedHatSSO - type: Google diff --git a/cluster-config/components/oauth/overlays/homelab/kustomization.yaml b/cluster-config/components/oauth/overlays/homelab/kustomization.yaml deleted file mode 100644 index e208aae..0000000 --- a/cluster-config/components/oauth/overlays/homelab/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -resources: -- ../../base - -components: -- ../sso diff --git a/cluster-config/components/oauth/overlays/htpass/htpass-secret-external.yaml b/cluster-config/components/oauth/overlays/htpass/htpass-secret-external.yaml deleted file mode 100644 index 536accb..0000000 --- a/cluster-config/components/oauth/overlays/htpass/htpass-secret-external.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: htpass-secret - namespace: openshift-config -spec: - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: htpass-secret - data: - - secretKey: htpasswd - remoteRef: - key: HTPASSWD diff --git a/cluster-config/components/oauth/overlays/htpass/kustomization.yaml b/cluster-config/components/oauth/overlays/htpass/kustomization.yaml deleted file mode 100644 index ace7c6c..0000000 --- a/cluster-config/components/oauth/overlays/htpass/kustomization.yaml +++ /dev/null @@ -1,19 +0,0 @@ -resources: - - htpass-secret-external.yaml - -patches: - - patch: |- - - op: add - path: /spec/identityProviders/1 - value: - htpasswd: - fileData: - name: htpass-secret - mappingMethod: claim - name: htpasswd - type: HTPasswd - target: - group: config.openshift.io - kind: OAuth - name: cluster - version: v1 diff --git a/cluster-config/components/oauth/overlays/matrix-template/README.md b/cluster-config/components/oauth/overlays/matrix-template/README.md deleted file mode 100644 index 9b5372b..0000000 --- a/cluster-config/components/oauth/overlays/matrix-template/README.md +++ /dev/null @@ -1,3 +0,0 @@ -From the OpenShift Developer Console contest, see original repo here: - -https://github.com/kenmoini/openshift-web-console-customizations/tree/master/competition/kenmoini diff --git a/cluster-config/components/oauth/overlays/matrix-template/kustomization.yaml b/cluster-config/components/oauth/overlays/matrix-template/kustomization.yaml deleted file mode 100644 index 25cfdc6..0000000 --- a/cluster-config/components/oauth/overlays/matrix-template/kustomization.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1alpha1 -kind: Component - -resources: - - ../../../login-template/base - -patches: - - patch: |- - - op: add - path: /spec/templates - value: - login: - name: matrix-login-template - providerSelection: - name: matrix-providers-template - target: - group: config.openshift.io - kind: OAuth - name: cluster - version: v1 diff --git a/cluster-config/components/oauth/overlays/sso/console.yaml b/cluster-config/components/oauth/overlays/sso/console.yaml deleted file mode 100644 index cdd94f5..0000000 --- a/cluster-config/components/oauth/overlays/sso/console.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: config.openshift.io/v1 -kind: Console -metadata: - annotations: - include.release.openshift.io/ibm-cloud-managed: "true" - include.release.openshift.io/self-managed-high-availability: "true" - include.release.openshift.io/single-node-developer: "true" - release.openshift.io/create-only: "true" - name: cluster -spec: - authentication: - logoutRedirect: https://sso.ocplab.com/realms/ocplab/protocol/openid-connect/logout?client_id=openshift&post_logout_redirect_uri=https://console-openshift-console.${SUB_DOMAIN} diff --git a/cluster-config/components/oauth/overlays/sso/kustomization.yaml b/cluster-config/components/oauth/overlays/sso/kustomization.yaml deleted file mode 100644 index 2bf4f55..0000000 --- a/cluster-config/components/oauth/overlays/sso/kustomization.yaml +++ /dev/null @@ -1,43 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1alpha1 -kind: Component - -resources: -- oidc-client-secret.yaml -- console.yaml - -patches: - - patch: |- - - op: add - path: /spec/identityProviders/- - value: - name: LabSSO - mappingMethod: claim - type: OpenID - openID: - clientID: openshift - clientSecret: - name: oidc-client-secret - extraScopes: - - email - - profile - extraAuthorizeParameters: - include_granted_scopes: "true" - claims: - preferredUsername: - - preferred_username - - email - name: - - nickname - - given_name - - name - email: - - custom_email_claim - - email - groups: - - groups - issuer: https://sso.ocplab.com/realms/ocplab - target: - group: config.openshift.io - kind: OAuth - name: cluster - version: v1 diff --git a/cluster-config/components/oauth/overlays/sso/oidc-client-secret.yaml b/cluster-config/components/oauth/overlays/sso/oidc-client-secret.yaml deleted file mode 100644 index 12baba3..0000000 --- a/cluster-config/components/oauth/overlays/sso/oidc-client-secret.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: oidc-client-secret - namespace: openshift-config -spec: - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: oidc-client-secret - data: - - secretKey: clientSecret - remoteRef: - key: OIDC_OCPLAB diff --git a/cluster-config/components/odf-operator/instance/base/kustomization.yaml b/cluster-config/components/odf-operator/instance/base/kustomization.yaml deleted file mode 100644 index 6f694d7..0000000 --- a/cluster-config/components/odf-operator/instance/base/kustomization.yaml +++ /dev/null @@ -1,4 +0,0 @@ -resources: -- storage-cluster.yaml -- storage-system.yaml -- noobaa-default-backing-store.yaml diff --git a/cluster-config/components/odf-operator/instance/base/noobaa-default-backing-store.yaml b/cluster-config/components/odf-operator/instance/base/noobaa-default-backing-store.yaml deleted file mode 100644 index a0fc582..0000000 --- a/cluster-config/components/odf-operator/instance/base/noobaa-default-backing-store.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: noobaa.io/v1alpha1 -kind: BackingStore -metadata: - labels: - app: noobaa - name: noobaa-default-backing-store - namespace: openshift-storage -spec: - pvPool: - numVolumes: 1 - resources: - requests: - storage: 200Gi - storageClass: lvms-vg1 - type: pv-pool diff --git a/cluster-config/components/odf-operator/instance/base/storage-cluster.yaml b/cluster-config/components/odf-operator/instance/base/storage-cluster.yaml deleted file mode 100644 index a0681e3..0000000 --- a/cluster-config/components/odf-operator/instance/base/storage-cluster.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: ocs.openshift.io/v1 -kind: StorageCluster -metadata: - name: ocs-storagecluster - namespace: openshift-storage -spec: - multiCloudGateway: - dbStorageClassName: lvms-vg1 - reconcileStrategy: standalone diff --git a/cluster-config/components/odf-operator/instance/base/storage-system.yaml b/cluster-config/components/odf-operator/instance/base/storage-system.yaml deleted file mode 100644 index 06e37e3..0000000 --- a/cluster-config/components/odf-operator/instance/base/storage-system.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: odf.openshift.io/v1alpha1 -kind: StorageSystem -metadata: - name: ocs-storagecluster-storagesystem - namespace: openshift-storage -spec: - kind: storagecluster.ocs.openshift.io/v1 - name: ocs-storagecluster - namespace: openshift-storage diff --git a/cluster-config/components/odf-operator/operator/overlays/no-registry/kustomization.yaml b/cluster-config/components/odf-operator/operator/overlays/no-registry/kustomization.yaml deleted file mode 100644 index 9eaad69..0000000 --- a/cluster-config/components/odf-operator/operator/overlays/no-registry/kustomization.yaml +++ /dev/null @@ -1,55 +0,0 @@ -resources: -- github.com/redhat-cop/gitops-catalog/openshift-data-foundation-operator/operator/overlays/stable-4.16 - -patches: - - patch: |- - - op: replace - path: /spec/template/spec/containers/0/image - value: registry.redhat.io/openshift4/ose-cli:latest - target: - kind: Job - name: enable-odf-console-plugin - - patch: |- - - op: replace - path: /spec/channel - value: stable-4.17 - target: - kind: Subscription - name: odf-operator - - patch: |- - - op: replace - path: /apiVersion - value: console.openshift.io/v1 - - op: replace - path: /spec - value: - backend: - service: - basePath: / - name: odf-console-service - namespace: openshift-storage - port: 9001 - type: Service - displayName: ODF Plugin - i18n: - loadType: "" - proxy: - - alias: provider-proxy - authorization: UserToken - endpoint: - service: - name: ux-backend-proxy - namespace: openshift-storage - port: 8888 - type: Service - - alias: rosa-prometheus - authorization: None - endpoint: - service: - name: prometheus - namespace: openshift-storage - port: 9339 - type: Service - target: - kind: ConsolePlugin - name: odf-console diff --git a/cluster-config/components/openshift-monitoring/README.md b/cluster-config/components/openshift-monitoring/README.md deleted file mode 100644 index 6c2c551..0000000 --- a/cluster-config/components/openshift-monitoring/README.md +++ /dev/null @@ -1,4 +0,0 @@ -This is used to configure a couple of things with openshift-monitoring: - -1. Sets the cluster label so that it can be referenced in templates. This lets us include the cluster name in the received alerts -2. Sets up a service account that external monitoring tools can use to query thanos, the bearer token can be retrieved from the secret. diff --git a/cluster-config/components/openshift-monitoring/base/cluster-monitoring-config-cm.yaml b/cluster-config/components/openshift-monitoring/base/cluster-monitoring-config-cm.yaml deleted file mode 100644 index 81bf45c..0000000 --- a/cluster-config/components/openshift-monitoring/base/cluster-monitoring-config-cm.yaml +++ /dev/null @@ -1,48 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: cluster-monitoring-config - namespace: openshift-monitoring -data: - config.yaml: | - alertmanagerMain: - enableUserAlertmanagerConfig: true - enableUserWorkload: true - nodeExporter: - collectors: - buddyinfo: {} - cpufreq: {} - ksmd: {} - mountstats: {} - netclass: {} - netdev: {} - processes: {} - systemd: {} - tcpstat: {} - prometheusK8s: - additionalAlertmanagerConfigs: - - apiVersion: v2 - bearerToken: - key: token - name: observability-alertmanager-accessor - scheme: https - staticConfigs: - - alertmanager-open-cluster-management-observability.apps.hub.ocplab.com - tlsConfig: - ca: - key: service-ca.crt - name: hub-alertmanager-router-ca - insecureSkipVerify: false - externalLabels: - cluster: ${CLUSTER_GITOPS_NAME} - managed_cluster: ${CLUSTER_ID} - volumeClaimTemplate: - metadata: {} - spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 40Gi - volumeMode: Filesystem - status: {} diff --git a/cluster-config/components/openshift-monitoring/base/kustomization.yaml b/cluster-config/components/openshift-monitoring/base/kustomization.yaml deleted file mode 100644 index 454202e..0000000 --- a/cluster-config/components/openshift-monitoring/base/kustomization.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: - - cluster-monitoring-config-cm.yaml - - monitoring-role-binding.yaml - - service-account.yaml - - token-secret.yaml diff --git a/cluster-config/components/openshift-monitoring/base/monitoring-role-binding.yaml b/cluster-config/components/openshift-monitoring/base/monitoring-role-binding.yaml deleted file mode 100644 index b7a0f7d..0000000 --- a/cluster-config/components/openshift-monitoring/base/monitoring-role-binding.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: external-monitor-reader -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-monitoring-view -subjects: -- kind: ServiceAccount - name: external-monitor-reader - namespace: openshift-monitoring diff --git a/cluster-config/components/openshift-monitoring/base/service-account.yaml b/cluster-config/components/openshift-monitoring/base/service-account.yaml deleted file mode 100644 index 0323f72..0000000 --- a/cluster-config/components/openshift-monitoring/base/service-account.yaml +++ /dev/null @@ -1,5 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: external-monitor-reader - namespace: openshift-monitoring diff --git a/cluster-config/components/openshift-monitoring/base/token-secret.yaml b/cluster-config/components/openshift-monitoring/base/token-secret.yaml deleted file mode 100644 index 222d52a..0000000 --- a/cluster-config/components/openshift-monitoring/base/token-secret.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - annotations: - kubernetes.io/service-account.name: external-monitor-reader - name: external-monitor-reader - namespace: openshift-monitoring -type: kubernetes.io/service-account-token diff --git a/cluster-config/components/pipelines-operator/base/kustomization.yaml b/cluster-config/components/pipelines-operator/base/kustomization.yaml deleted file mode 100644 index 51735d2..0000000 --- a/cluster-config/components/pipelines-operator/base/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -resources: -- subscription.yaml -- tekton-config.yaml -# Partial needs more work, even with sync wave it fails. Suspect TektonInstaller needs health check so this doesn't get applied until it's ready -# - tekton-config-metrics-partial.yaml diff --git a/cluster-config/components/pipelines-operator/base/subscription.yaml b/cluster-config/components/pipelines-operator/base/subscription.yaml deleted file mode 100644 index baa994a..0000000 --- a/cluster-config/components/pipelines-operator/base/subscription.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - labels: - operators.coreos.com/openshift-pipelines-operator-rh.openshift-operators: "" - name: openshift-pipelines-operator-rh - namespace: openshift-operators -spec: - channel: pipelines-1.18 - installPlanApproval: Automatic - name: openshift-pipelines-operator-rh - source: redhat-operators - sourceNamespace: openshift-marketplace diff --git a/cluster-config/components/pipelines-operator/base/tekton-config-metrics-partial.yaml b/cluster-config/components/pipelines-operator/base/tekton-config-metrics-partial.yaml deleted file mode 100644 index 624c2f4..0000000 --- a/cluster-config/components/pipelines-operator/base/tekton-config-metrics-partial.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: operator.tekton.dev/v1alpha1 -kind: TektonConfig -metadata: - name: config - annotations: - argocd.argoproj.io/sync-options: Validate=false,ServerSideApply=true, SkipDryRunOnMissingResource=true - argocd.argoproj.io/sync-wave: "99" -spec: - pipeline: - metrics.taskrun.level: taskrun - metrics.pipelinerun.level: pipelinerun - metrics.taskrun.duration-type: lastvalue - metrics.pipelinerun.duration-type: lastvalue diff --git a/cluster-config/components/pipelines-operator/base/tekton-config.yaml b/cluster-config/components/pipelines-operator/base/tekton-config.yaml deleted file mode 100644 index 27f5e2b..0000000 --- a/cluster-config/components/pipelines-operator/base/tekton-config.yaml +++ /dev/null @@ -1,129 +0,0 @@ -apiVersion: operator.tekton.dev/v1alpha1 -kind: TektonConfig -metadata: - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - ## Do last to overwrite default rather then other way arround - argocd.argoproj.io/sync-wave: "99" - name: config -spec: - addon: - params: - - name: clusterTasks - value: "true" - - name: pipelineTemplates - value: "true" - - name: communityClusterTasks - value: "true" - - name: resolverTasks - value: 'true' - - name: resolverStepActions - value: 'true' - - name: communityResolverTasks - value: 'true' - chain: - artifacts.taskrun.format: in-toto - artifacts.taskrun.storage: tekton - artifacts.taskrun.signer: x509 - artifacts.oci.storage: oci - artifacts.oci.format: simplesigning - artifacts.oci.signer: x509 - transparency.enabled: "true" - dashboard: - options: - disabled: false - readonly: false - hub: - options: - disabled: false - params: - - name: createRbacResource - value: "true" - pipeline: - await-sidecar-readiness: true - coschedule: workspaces - default-service-account: pipeline - disable-affinity-assistant: true - disable-creds-init: false - enable-api-fields: beta - enable-bundles-resolver: true - enable-cel-in-whenexpression: false - enable-cluster-resolver: true - enable-custom-tasks: true - enable-git-resolver: true - enable-hub-resolver: true - enable-param-enum: false - enable-provenance-in-status: false - enable-step-actions: true - enforce-nonfalsifiability: none - git-resolver-config: - default-revision: main - fetch-timeout: 1m - default-url: https://github.com/gnunn-gitops/tekton-catalog - keep-pod-on-cancel: false - max-result-size: 4096 - metrics.count.enable-reason: false - metrics.pipelinerun.duration-type: lastvalue - metrics.pipelinerun.level: pipelinerun - metrics.taskrun.duration-type: lastvalue - metrics.taskrun.level: taskrun - options: - disabled: false - params: - - name: enableMetrics - value: "true" - performance: - disable-ha: false - require-git-ssh-secret-known-hosts: false - results-from: termination-message - running-in-environment-with-injected-sidecars: true - send-cloudevents-for-runs: false - set-security-context: false - trusted-resources-verification-no-match-policy: ignore - platforms: - openshift: - pipelinesAsCode: - enable: true - options: - disabled: false - settings: - application-name: Pipelines as Code CI - auto-configure-new-github-repo: "false" - bitbucket-cloud-check-source-ip: "true" - auto-configure-repo-namespace-template: "" - bitbucket-cloud-additional-source-ip: "" - custom-console-name: "" - custom-console-url: "" - custom-console-url-namespace: "" - custom-console-url-pr-details: "" - custom-console-url-pr-tasklog: "" - default-max-keep-runs: "0" - error-detection-from-container-logs: "true" - error-detection-max-number-of-lines: "50" - error-detection-simple-regexp: ^(?P[^:]*):(?P[0-9]+):(?P[0-9]+):([ - ]*)?(?P.*) - error-log-snippet: "true" - hub-catalog-name: tekton - hub-url: https://api.hub.tekton.dev/v1 - max-keep-run-upper-limit: "0" - remember-ok-to-test: "true" - remote-tasks: "true" - secret-auto-create: "true" - secret-github-app-scope-extra-repos: "" - secret-github-app-token-scoped: "true" - tekton-dashboard-url: "" - scc: - default: pipelines-scc - profile: all - pruner: - disabled: false - keep: 100 - resources: - - pipelinerun - schedule: 0 8 * * * - targetNamespace: openshift-pipelines - trigger: - default-service-account: pipeline - enable-api-fields: stable - options: - disabled: false diff --git a/cluster-config/components/pipelines-operator/overlays/chains/kustomization.yaml b/cluster-config/components/pipelines-operator/overlays/chains/kustomization.yaml deleted file mode 100644 index 3556d65..0000000 --- a/cluster-config/components/pipelines-operator/overlays/chains/kustomization.yaml +++ /dev/null @@ -1,68 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -resources: -- ../../base -- openshift-pipelines-namespace.yaml -- oidc-token-refresh-sa.yaml -# - signing-cert-external.yaml -- oidc-info-secret.yaml -- oidc-token-refresher-deploy.yaml - -patches: - - target: - kind: TektonConfig - name: config - patch: | - - op: replace - path: /spec/chain - value: - signers.x509.fulcio.enabled: true - artifacts.taskrun.storage: oci - artifacts.pipelinerun.storage: oci - artifacts.pipelinerun.format: in-toto - transparency.enabled: 'true' - artifacts.taskrun.format: in-toto - signers.x509.tuf.mirror.url: 'https://tuf-trusted-artifact-signer.apps.hub.ocplab.com' - artifacts.oci.signer: x509 - signers.x509.fulcio.address: 'https://fulcio-server-trusted-artifact-signer.apps.hub.ocplab.com' - artifacts.oci.storage: oci - signers.x509.fulcio.issuer: 'https://sso.ocplab.com/realms/ocplab' - transparency.url: 'https://rekor-server-trusted-artifact-signer.apps.hub.ocplab.com' - disabled: false - artifacts.oci.format: simplesigning - options: - deployments: - tekton-chains-controller: - metadata: - creationTimestamp: null - spec: - selector: null - strategy: {} - template: - metadata: - creationTimestamp: null - spec: - containers: - - env: - - name: TUF_ROOT - value: /tuf - name: tekton-chains-controller - resources: {} - volumeMounts: - - mountPath: /tuf - name: tuf - - mountPath: /var/run/sigstore/cosign - name: oidc-info - volumes: - - name: tuf - - name: oidc-info - secret: - items: - - key: id-token - path: oidc-token - secretName: oidc-token - status: {} - disabled: false - signers.x509.identity.token.file: /var/run/sigstore/cosign/oidc-token - artifacts.taskrun.signer: x509 diff --git a/cluster-config/components/pipelines-operator/overlays/chains/oidc-info-secret.yaml b/cluster-config/components/pipelines-operator/overlays/chains/oidc-info-secret.yaml deleted file mode 100644 index c7a49b3..0000000 --- a/cluster-config/components/pipelines-operator/overlays/chains/oidc-info-secret.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - annotations: - argocd.argoproj.io/sync-wave: "0" - name: oidc-info - namespace: openshift-pipelines -spec: - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: oidc-info - creationPolicy: Owner - dataFrom: - - extract: - key: OIDC_INFO diff --git a/cluster-config/components/pipelines-operator/overlays/chains/oidc-token-refresh-sa.yaml b/cluster-config/components/pipelines-operator/overlays/chains/oidc-token-refresh-sa.yaml deleted file mode 100644 index 33bd55b..0000000 --- a/cluster-config/components/pipelines-operator/overlays/chains/oidc-token-refresh-sa.yaml +++ /dev/null @@ -1,36 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: oidc-token-refresher - namespace: openshift-pipelines -rules: -- apiGroups: - - "" - resources: - - secrets - verbs: - - get - - create - - patch - - update - - list ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: oidc-token-refresher - namespace: openshift-pipelines -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: oidc-token-refresher -subjects: -- kind: ServiceAccount - name: oidc-token-refresher - namespace: openshift-pipelines ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: oidc-token-refresher - namespace: openshift-pipelines diff --git a/cluster-config/components/pipelines-operator/overlays/chains/oidc-token-refresher-deploy.yaml b/cluster-config/components/pipelines-operator/overlays/chains/oidc-token-refresher-deploy.yaml deleted file mode 100644 index bbf4ea0..0000000 --- a/cluster-config/components/pipelines-operator/overlays/chains/oidc-token-refresher-deploy.yaml +++ /dev/null @@ -1,55 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: oidc-token-refresher - namespace: openshift-pipelines -spec: - progressDeadlineSeconds: 600 - replicas: 1 - revisionHistoryLimit: 10 - selector: - matchLabels: - app: oidc-token-refresher - strategy: - rollingUpdate: - maxSurge: 25% - maxUnavailable: 25% - type: RollingUpdate - template: - metadata: - creationTimestamp: null - labels: - app: oidc-token-refresher - deployment: oidc-token-refresher - spec: - containers: - - command: - - sh - - -c - - | - #!/bin/bash - set -o pipefail - while true; do - JWT_TOKEN=$(curl -sL --location "${OIDC_TOKEN_ENDPOINT}" \ - --header "Content-Type: application/x-www-form-urlencoded" \ - --data-urlencode "grant_type=client_credentials" \ - --data-urlencode "client_id=${OIDC_CLIENT_ID}" \ - --data-urlencode "client_secret=${OIDC_CLIENT_SECRET}" \ - --data-urlencode "scope=openid" | jq -r '.id_token') - kubectl create secret generic oidc-token --from-literal=id-token=${JWT_TOKEN} --dry-run=client -o yaml | kubectl apply -f- - sleep 120 - done - envFrom: - - secretRef: - name: oidc-info - image: quay.io/openshiftdemos/rollouts-terminal-tooling:latest - imagePullPolicy: Always - name: oidc-token-refresher - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - dnsPolicy: ClusterFirst - restartPolicy: Always - schedulerName: default-scheduler - serviceAccount: oidc-token-refresher - serviceAccountName: oidc-token-refresher - terminationGracePeriodSeconds: 30 diff --git a/cluster-config/components/pipelines-operator/overlays/chains/openshift-pipelines-namespace.yaml b/cluster-config/components/pipelines-operator/overlays/chains/openshift-pipelines-namespace.yaml deleted file mode 100644 index 50e7418..0000000 --- a/cluster-config/components/pipelines-operator/overlays/chains/openshift-pipelines-namespace.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - labels: - app.kubernetes.io/instance: default - app.kubernetes.io/part-of: tekton-pipelines - kubernetes.io/metadata.name: openshift-pipelines - openshift.io/cluster-monitoring: "true" - operator.tekton.dev/disable-proxy: "true" - name: openshift-pipelines diff --git a/cluster-config/components/pipelines-operator/overlays/chains/signing-cert-external.yaml b/cluster-config/components/pipelines-operator/overlays/chains/signing-cert-external.yaml deleted file mode 100644 index a969bc6..0000000 --- a/cluster-config/components/pipelines-operator/overlays/chains/signing-cert-external.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - name: signing-secrets - namespace: openshift-pipelines -spec: - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: signing-secrets - # prevent fighting with tekton over ownership - creationPolicy: Orphan - dataFrom: - - extract: - key: COSIGN diff --git a/cluster-config/components/pipelines-operator/overlays/results/kustomization.yaml b/cluster-config/components/pipelines-operator/overlays/results/kustomization.yaml deleted file mode 100644 index acaadc8..0000000 --- a/cluster-config/components/pipelines-operator/overlays/results/kustomization.yaml +++ /dev/null @@ -1,7 +0,0 @@ -namespace: openshift-pipelines - -resources: -- pvc.yaml -- tekton-results-db-secret.yaml -- tekton-results-tls-secret.yaml -- tektonresults.yaml diff --git a/cluster-config/components/pipelines-operator/overlays/results/pvc.yaml b/cluster-config/components/pipelines-operator/overlays/results/pvc.yaml deleted file mode 100644 index 12301a2..0000000 --- a/cluster-config/components/pipelines-operator/overlays/results/pvc.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: tekton-logs -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 5Gi diff --git a/cluster-config/components/pipelines-operator/overlays/results/tekton-results-db-secret.yaml b/cluster-config/components/pipelines-operator/overlays/results/tekton-results-db-secret.yaml deleted file mode 100644 index 71e1409..0000000 --- a/cluster-config/components/pipelines-operator/overlays/results/tekton-results-db-secret.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - annotations: - argocd.argoproj.io/sync-wave: "0" - name: tekton-results-postgres - namespace: openshift-pipelines -spec: - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: tekton-results-postgres - creationPolicy: Owner - dataFrom: - - extract: - key: TEKTON_RESULTS_DB diff --git a/cluster-config/components/pipelines-operator/overlays/results/tekton-results-tls-secret.yaml b/cluster-config/components/pipelines-operator/overlays/results/tekton-results-tls-secret.yaml deleted file mode 100644 index baaf674..0000000 --- a/cluster-config/components/pipelines-operator/overlays/results/tekton-results-tls-secret.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - annotations: - argocd.argoproj.io/sync-wave: "0" - name: tekton-results-tls - namespace: openshift-pipelines -spec: - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: tekton-results-tls - creationPolicy: Owner - template: - type: kubernetes.io/tls - dataFrom: - - extract: - key: TEKTON_RESULTS_TLS diff --git a/cluster-config/components/pipelines-operator/overlays/results/tektonresults.yaml b/cluster-config/components/pipelines-operator/overlays/results/tektonresults.yaml deleted file mode 100644 index 3411401..0000000 --- a/cluster-config/components/pipelines-operator/overlays/results/tektonresults.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: operator.tekton.dev/v1alpha1 -kind: TektonResult -metadata: - name: result -spec: - targetNamespace: openshift-pipelines - logs_api: true - log_level: info - db_port: 5432 - db_host: tekton-results-postgres-service.openshift-pipelines.svc.cluster.local - logs_path: /logs - logs_type: File - logs_buffer_size: 32768 - auth_disable: true - tls_hostname_override: tekton-results-api-service.openshift-pipelines.svc.cluster.local - db_enable_auto_migration: true - server_port: 8080 - prometheus_port: 9090 - logging_pvc_name: tekton-logs diff --git a/cluster-config/components/rbac/base/cluster-admins-rolebinding.yaml b/cluster-config/components/rbac/base/cluster-admins-rolebinding.yaml deleted file mode 100644 index 5c97f73..0000000 --- a/cluster-config/components/rbac/base/cluster-admins-rolebinding.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: cluster-admin-users -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-admin -subjects: - - apiGroup: rbac.authorization.k8s.io - kind: Group - name: cluster-admins diff --git a/cluster-config/components/rbac/base/kustomization.yaml b/cluster-config/components/rbac/base/kustomization.yaml deleted file mode 100644 index 20c61ad..0000000 --- a/cluster-config/components/rbac/base/kustomization.yaml +++ /dev/null @@ -1,2 +0,0 @@ -resources: -- cluster-admins-rolebinding.yaml diff --git a/cluster-config/components/registry-sno/base/kustomization.yaml b/cluster-config/components/registry-sno/base/kustomization.yaml deleted file mode 100644 index 9f7c240..0000000 --- a/cluster-config/components/registry-sno/base/kustomization.yaml +++ /dev/null @@ -1,3 +0,0 @@ -resources: -- pvc.yaml -- registry-config.yaml diff --git a/cluster-config/components/registry-sno/base/pvc.yaml b/cluster-config/components/registry-sno/base/pvc.yaml deleted file mode 100644 index 7874e45..0000000 --- a/cluster-config/components/registry-sno/base/pvc.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: image-registry - namespace: openshift-image-registry -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 150Gi - storageClassName: lvms-vg1 diff --git a/cluster-config/components/registry-sno/base/registry-config.yaml b/cluster-config/components/registry-sno/base/registry-config.yaml deleted file mode 100644 index 7b3f908..0000000 --- a/cluster-config/components/registry-sno/base/registry-config.yaml +++ /dev/null @@ -1,20 +0,0 @@ -apiVersion: imageregistry.operator.openshift.io/v1 -kind: Config -metadata: - name: cluster -spec: - logLevel: Normal - managementState: Managed - observedConfig: null - operatorLogLevel: Normal - replicas: 1 - requests: - read: - maxWaitInQueue: 0s - write: - maxWaitInQueue: 0s - rolloutStrategy: Recreate - storage: - pvc: - claim: image-registry - unsupportedConfigOverrides: null diff --git a/cluster-config/components/rhtas-operator/instance/base/kustomization.yaml b/cluster-config/components/rhtas-operator/instance/base/kustomization.yaml deleted file mode 100644 index b347a5a..0000000 --- a/cluster-config/components/rhtas-operator/instance/base/kustomization.yaml +++ /dev/null @@ -1,5 +0,0 @@ -namespace: trusted-artifact-signer - -resources: -- namespace.yaml -- securesign.yaml diff --git a/cluster-config/components/rhtas-operator/instance/base/namespace.yaml b/cluster-config/components/rhtas-operator/instance/base/namespace.yaml deleted file mode 100644 index 4905493..0000000 --- a/cluster-config/components/rhtas-operator/instance/base/namespace.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - annotations: - openshift.io/display-name: Red Hat Trusted Artifact Signer - name: trusted-artifact-signer diff --git a/cluster-config/components/rhtas-operator/instance/base/securesign.yaml b/cluster-config/components/rhtas-operator/instance/base/securesign.yaml deleted file mode 100644 index ceee732..0000000 --- a/cluster-config/components/rhtas-operator/instance/base/securesign.yaml +++ /dev/null @@ -1,57 +0,0 @@ -apiVersion: rhtas.redhat.com/v1alpha1 -kind: Securesign -metadata: - annotations: - argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true - argocd.argoproj.io/sync-wave: "10" - labels: - app.kubernetes.io/instance: securesign - app.kubernetes.io/name: securesign - app.kubernetes.io/part-of: trusted-artifact-signer - name: securesign - namespace: trusted-artifact-signer -spec: - fulcio: - certificate: - commonName: fulcio.hostname - organizationEmail: jdoe@redhat.com - organizationName: Red Hat - config: - OIDCIssuers: - - ClientID: trusted-artifact-signer - Issuer: - IssuerURL: - Type: email - externalAccess: - enabled: true - monitoring: - enabled: false - rekor: - backFillRedis: - enabled: true - schedule: 0 0 * * * - externalAccess: - enabled: true - monitoring: - enabled: false - pvc: - retain: true - size: 5Gi - rekorSearchUI: - enabled: true - signer: - kms: secret - trillian: - database: - create: true - pvc: - retain: true - size: 5Gi - tuf: - externalAccess: - enabled: true - keys: - - name: rekor.pub - - name: ctfe.pub - - name: fulcio_v1.crt.pem - port: 80 diff --git a/cluster-config/components/rhtas-operator/operator/base/kustomization.yaml b/cluster-config/components/rhtas-operator/operator/base/kustomization.yaml deleted file mode 100644 index a7ad173..0000000 --- a/cluster-config/components/rhtas-operator/operator/base/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ -namespace: rhtas-operator - -resources: -- namespace.yaml -- operator-group.yaml -- subscription.yaml diff --git a/cluster-config/components/rhtas-operator/operator/base/namespace.yaml b/cluster-config/components/rhtas-operator/operator/base/namespace.yaml deleted file mode 100644 index 4efbe69..0000000 --- a/cluster-config/components/rhtas-operator/operator/base/namespace.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - annotations: - openshift.io/display-name: Red Hat Trusted Artifact Signer - name: rhtas-operator diff --git a/cluster-config/components/rhtas-operator/operator/base/operator-group.yaml b/cluster-config/components/rhtas-operator/operator/base/operator-group.yaml deleted file mode 100644 index 556f643..0000000 --- a/cluster-config/components/rhtas-operator/operator/base/operator-group.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: operators.coreos.com/v1 -kind: OperatorGroup -metadata: - name: rhtas-operator -spec: - upgradeStrategy: Default diff --git a/cluster-config/components/rhtas-operator/operator/base/subscription.yaml b/cluster-config/components/rhtas-operator/operator/base/subscription.yaml deleted file mode 100644 index 29f1082..0000000 --- a/cluster-config/components/rhtas-operator/operator/base/subscription.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: rhtas-operator -spec: - config: - resources: - limits: - cpu: 500m - memory: 512Mi - requests: - cpu: 5m - memory: 128Mi - channel: stable-v1.1 - installPlanApproval: Automatic - name: rhtas-operator - source: redhat-operators - sourceNamespace: openshift-marketplace diff --git a/cluster-config/components/rollout-manager/base/kustomization.yaml b/cluster-config/components/rollout-manager/base/kustomization.yaml deleted file mode 100644 index 53e4621..0000000 --- a/cluster-config/components/rollout-manager/base/kustomization.yaml +++ /dev/null @@ -1,2 +0,0 @@ -resources: -- rolloutmanager.yaml diff --git a/cluster-config/components/rollout-manager/base/rolloutmanager.yaml b/cluster-config/components/rollout-manager/base/rolloutmanager.yaml deleted file mode 100644 index 67fcdf7..0000000 --- a/cluster-config/components/rollout-manager/base/rolloutmanager.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: argoproj.io/v1alpha1 -kind: RolloutManager -metadata: - name: cluster - namespace: openshift-gitops -spec: {} diff --git a/cluster-config/components/sso/overlays/default/keycloak-migration-job.yaml b/cluster-config/components/sso/overlays/default/keycloak-migration-job.yaml deleted file mode 100644 index 393636f..0000000 --- a/cluster-config/components/sso/overlays/default/keycloak-migration-job.yaml +++ /dev/null @@ -1,45 +0,0 @@ -apiVersion: batch/v1 -kind: Job -metadata: - name: keycloak-migration - namespace: sso - annotations: - argocd.argoproj.io/hook: PostSync - argocd.argoproj.io/hook-delete-policy: BeforeHookCreation -spec: - template: - spec: - containers: - - image: klg71/keycloakmigration - env: - - name: BASEURL - value: "https://sso-sso.apps.home.ocplab.com/auth" - - name: CORRECT_HASHES - value: "true" - - name: ADMIN_USERNAME - valueFrom: - secretKeyRef: - name: sso-admin-credential - key: ADMIN_USERNAME - - name: ADMIN_PASSWORD - valueFrom: - secretKeyRef: - name: sso-admin-credential - key: ADMIN_PASSWORD - imagePullPolicy: Always - name: keycloak-migration - volumeMounts: - - name: keycloak-migration - mountPath: "/migration" - readOnly: true - - name: logs - mountPath: "/logs" - dnsPolicy: ClusterFirst - restartPolicy: OnFailure - terminationGracePeriodSeconds: 30 - volumes: - - name: keycloak-migration - secret: - secretName: keycloak-migration - - name: logs - emptyDir: {} diff --git a/cluster-config/components/sso/overlays/default/kustomization.yaml b/cluster-config/components/sso/overlays/default/kustomization.yaml deleted file mode 100644 index f9158d4..0000000 --- a/cluster-config/components/sso/overlays/default/kustomization.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -namespace: sso - -bases: -- https://github.com/redhat-cop/gitops-catalog/rhsso/rhsso-standalone/overlays/default - -resources: -- keycloak-migration-job.yaml - -patchesJson6902: - - path: patch-sso-statefulset.yaml - target: - group: "" - kind: StatefulSet - name: sso - version: v1 diff --git a/cluster-config/components/sso/overlays/default/patch-sso-statefulset.yaml b/cluster-config/components/sso/overlays/default/patch-sso-statefulset.yaml deleted file mode 100644 index a749328..0000000 --- a/cluster-config/components/sso/overlays/default/patch-sso-statefulset.yaml +++ /dev/null @@ -1,8 +0,0 @@ -- op: add - path: /spec/template/spec/containers/0/env/- - value: - name: JAVA_OPTS_APPEND - value: "-Dkeycloak.profile.feature.admin_fine_grained_authz=enabled -Dkeycloak.profile.feature.token_exchange=enabled" -- op: replace - path: /spec/template/spec/containers/0/image - value: registry.redhat.io/rh-sso-7/sso75-openshift-rhel8:latest diff --git a/cluster-config/components/tekton-hub/base/hub.yaml b/cluster-config/components/tekton-hub/base/hub.yaml deleted file mode 100644 index af6eba0..0000000 --- a/cluster-config/components/tekton-hub/base/hub.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: operator.tekton.dev/v1alpha1 -kind: TektonHub -metadata: - name: hub -spec: - targetNamespace: openshift-pipelines - - catalogs: - - name: local - org: gnunn-gitops - type: community - provider: github - url: https://github.com/gnunn-gitops/tekton-catalog - revision: main - - api: - catalogRefreshInterval: 5m diff --git a/cluster-config/components/tenant-secrets/base/copy-secrets-cronjob.yaml b/cluster-config/components/tenant-secrets/base/copy-secrets-cronjob.yaml deleted file mode 100644 index 377b87f..0000000 --- a/cluster-config/components/tenant-secrets/base/copy-secrets-cronjob.yaml +++ /dev/null @@ -1,25 +0,0 @@ -apiVersion: batch/v1 -kind: CronJob -metadata: - name: copy-secrets -spec: - schedule: "*/2 * * * *" - concurrencyPolicy: "Forbid" - jobTemplate: - spec: - template: - spec: - serviceAccountName: copy-secrets - containers: - - name: copy-secrets - image: quay.io/gnunn/tools:latest - imagePullPolicy: Always - command: - - /bin/bash - - -c - - | - secrets=$(oc get secrets -l replicate=true --no-headers -o custom-columns=":metadata.name") - while IFS= read -r secret; do - oc get secret $secret -o yaml | oc neat | sed "s/namespace: tenant-secrets/namespace: ${secret}/g" | oc apply -f - - done <<< "$secrets" - restartPolicy: OnFailure diff --git a/cluster-config/components/tenant-secrets/base/copy-secrets-rbac.yaml b/cluster-config/components/tenant-secrets/base/copy-secrets-rbac.yaml deleted file mode 100644 index 121e299..0000000 --- a/cluster-config/components/tenant-secrets/base/copy-secrets-rbac.yaml +++ /dev/null @@ -1,37 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: copy-secrets ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: copy-secrets -rules: - - apiGroups: - - "" - resources: - - secrets - verbs: - - get - - list - - create - - apiGroups: - - "" - resources: - - namespaces - verbs: - - get ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: copy-secrets -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: copy-secrets -subjects: - - kind: ServiceAccount - name: copy-secrets - namespace: tenant-secrets diff --git a/cluster-config/components/tenant-secrets/base/kustomization.yaml b/cluster-config/components/tenant-secrets/base/kustomization.yaml deleted file mode 100644 index 7fec527..0000000 --- a/cluster-config/components/tenant-secrets/base/kustomization.yaml +++ /dev/null @@ -1,6 +0,0 @@ -namespace: tenant-secrets - -resources: -- copy-secrets-rbac.yaml -- copy-secrets-cronjob.yaml -- namespace.yaml diff --git a/cluster-config/components/tenant-secrets/base/namespace.yaml b/cluster-config/components/tenant-secrets/base/namespace.yaml deleted file mode 100644 index 8b3d14f..0000000 --- a/cluster-config/components/tenant-secrets/base/namespace.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - annotations: - openshift.io/description: "manage Tenant Secrets" - name: tenant-secrets diff --git a/cluster-config/components/trusted-profile-analyzer/prereqs/base/bombastic-default-obc.yaml b/cluster-config/components/trusted-profile-analyzer/prereqs/base/bombastic-default-obc.yaml deleted file mode 100644 index d411fb0..0000000 --- a/cluster-config/components/trusted-profile-analyzer/prereqs/base/bombastic-default-obc.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: objectbucket.io/v1alpha1 -kind: ObjectBucketClaim -metadata: - name: bombastic-default - namespace: trusted-profile-analyzer -spec: - generateBucketName: bombastic-default - storageClassName: openshift-storage.noobaa.io diff --git a/cluster-config/components/trusted-profile-analyzer/prereqs/base/bombastic-topics.yaml b/cluster-config/components/trusted-profile-analyzer/prereqs/base/bombastic-topics.yaml deleted file mode 100644 index f21dfe1..0000000 --- a/cluster-config/components/trusted-profile-analyzer/prereqs/base/bombastic-topics.yaml +++ /dev/null @@ -1,41 +0,0 @@ -kind: KafkaTopic -apiVersion: kafka.strimzi.io/v1beta2 -metadata: - name: bombastic-failed-default - labels: - strimzi.io/cluster: kafka - namespace: trusted-profile-analyzer -spec: - partitions: 10 - replicas: 1 - config: - retention.ms: 604800000 - segment.bytes: 1073741824 ---- -kind: KafkaTopic -apiVersion: kafka.strimzi.io/v1beta2 -metadata: - name: bombastic-indexed-default - labels: - strimzi.io/cluster: kafka - namespace: trusted-profile-analyzer -spec: - partitions: 10 - replicas: 1 - config: - retention.ms: 604800000 - segment.bytes: 1073741824 ---- -kind: KafkaTopic -apiVersion: kafka.strimzi.io/v1beta2 -metadata: - name: bombastic-stored-default - labels: - strimzi.io/cluster: kafka - namespace: trusted-profile-analyzer -spec: - partitions: 10 - replicas: 1 - config: - retention.ms: 604800000 - segment.bytes: 1073741824 diff --git a/cluster-config/components/trusted-profile-analyzer/prereqs/base/kafka.yaml b/cluster-config/components/trusted-profile-analyzer/prereqs/base/kafka.yaml deleted file mode 100644 index 77fc1b4..0000000 --- a/cluster-config/components/trusted-profile-analyzer/prereqs/base/kafka.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: kafka.strimzi.io/v1beta2 -kind: Kafka -metadata: - name: kafka - namespace: trusted-profile-analyzer -spec: - entityOperator: - topicOperator: {} - kafka: - config: - default.replication.factor: 1 - inter.broker.protocol.version: "3.7" - min.insync.replicas: 1 - offsets.topic.replication.factor: 1 - transaction.state.log.min.isr: 1 - transaction.state.log.replication.factor: 1 - listeners: - - name: plain - port: 9092 - tls: false - type: internal - - name: tls - port: 9093 - tls: true - type: internal - replicas: 1 - storage: - type: persistent-claim - size: 1Gi - version: 3.7.0 - zookeeper: - replicas: 1 - storage: - type: persistent-claim - size: 1Gi diff --git a/cluster-config/components/trusted-profile-analyzer/prereqs/base/kustomization.yaml b/cluster-config/components/trusted-profile-analyzer/prereqs/base/kustomization.yaml deleted file mode 100644 index f29ea30..0000000 --- a/cluster-config/components/trusted-profile-analyzer/prereqs/base/kustomization.yaml +++ /dev/null @@ -1,15 +0,0 @@ -namespace: trusted-profile-analyzer - -resources: -- namespace.yaml -- vexination-default-obc.yaml -- v11y-default-obc.yaml -- bombastic-default-obc.yaml -- kafka.yaml -- v11y-topics.yaml -- bombastic-topics.yaml -- vexination-topics.yaml -- postgresql-pvc.yaml -- postgresql-es.yaml -- postgresql-deploy.yaml -- postgresql-svc.yaml diff --git a/cluster-config/components/trusted-profile-analyzer/prereqs/base/namespace.yaml b/cluster-config/components/trusted-profile-analyzer/prereqs/base/namespace.yaml deleted file mode 100644 index ca4a48d..0000000 --- a/cluster-config/components/trusted-profile-analyzer/prereqs/base/namespace.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: trusted-profile-analyzer diff --git a/cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-deploy.yaml b/cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-deploy.yaml deleted file mode 100644 index a2f6847..0000000 --- a/cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-deploy.yaml +++ /dev/null @@ -1,80 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - annotations: - argocd.argoproj.io/sync-wave: "1" - name: postgresql - namespace: trusted-profile-analyzer -spec: - replicas: 1 - revisionHistoryLimit: 10 - selector: - matchLabels: - name: postgresql - strategy: - type: Recreate - template: - metadata: - labels: - name: postgresql - spec: - containers: - - env: - - name: POSTGRESQL_USER - valueFrom: - secretKeyRef: - key: database-user - name: postgresql - - name: POSTGRESQL_PASSWORD - valueFrom: - secretKeyRef: - key: database-password - name: postgresql - - name: POSTGRESQL_DATABASE - valueFrom: - secretKeyRef: - key: database-name - name: postgresql - image: image-registry.openshift-image-registry.svc:5000/openshift/postgresql:15-el8 - imagePullPolicy: IfNotPresent - livenessProbe: - exec: - command: - - /usr/libexec/check-container - - --live - failureThreshold: 3 - initialDelaySeconds: 120 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 10 - name: postgresql - ports: - - containerPort: 5432 - protocol: TCP - readinessProbe: - exec: - command: - - /usr/libexec/check-container - failureThreshold: 3 - initialDelaySeconds: 5 - periodSeconds: 10 - successThreshold: 1 - timeoutSeconds: 1 - resources: - limits: - memory: 512Mi - securityContext: - privileged: false - terminationMessagePath: /dev/termination-log - terminationMessagePolicy: File - volumeMounts: - - mountPath: /var/lib/pgsql/data - name: postgresql-data - dnsPolicy: ClusterFirst - restartPolicy: Always - schedulerName: default-scheduler - terminationGracePeriodSeconds: 30 - volumes: - - name: postgresql-data - persistentVolumeClaim: - claimName: postgresql diff --git a/cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-es.yaml b/cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-es.yaml deleted file mode 100644 index 34a0d82..0000000 --- a/cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-es.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: external-secrets.io/v1beta1 -kind: ExternalSecret -metadata: - annotations: - argocd.argoproj.io/sync-wave: "0" - name: postgresql - namespace: trusted-profile-analyzer -spec: - refreshInterval: 1h - secretStoreRef: - kind: ClusterSecretStore - name: doppler-cluster - target: - name: postgresql - creationPolicy: Owner - dataFrom: - - extract: - key: RHTPA_POSTGRESQL diff --git a/cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-pvc.yaml b/cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-pvc.yaml deleted file mode 100644 index ba08b12..0000000 --- a/cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-pvc.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: postgresql - namespace: trusted-profile-analyzer -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 5Gi diff --git a/cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-svc.yaml b/cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-svc.yaml deleted file mode 100644 index 6450228..0000000 --- a/cluster-config/components/trusted-profile-analyzer/prereqs/base/postgresql-svc.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: postgresql - namespace: trusted-profile-analyzer -spec: - ports: - - name: postgresql - port: 5432 - selector: - name: postgresql diff --git a/cluster-config/components/trusted-profile-analyzer/prereqs/base/v11y-default-obc.yaml b/cluster-config/components/trusted-profile-analyzer/prereqs/base/v11y-default-obc.yaml deleted file mode 100644 index 999e32c..0000000 --- a/cluster-config/components/trusted-profile-analyzer/prereqs/base/v11y-default-obc.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: objectbucket.io/v1alpha1 -kind: ObjectBucketClaim -metadata: - name: v11y-default - namespace: trusted-profile-analyzer -spec: - generateBucketName: v11y-default - storageClassName: openshift-storage.noobaa.io diff --git a/cluster-config/components/trusted-profile-analyzer/prereqs/base/v11y-topics.yaml b/cluster-config/components/trusted-profile-analyzer/prereqs/base/v11y-topics.yaml deleted file mode 100644 index a167978..0000000 --- a/cluster-config/components/trusted-profile-analyzer/prereqs/base/v11y-topics.yaml +++ /dev/null @@ -1,41 +0,0 @@ -kind: KafkaTopic -apiVersion: kafka.strimzi.io/v1beta2 -metadata: - name: v11y-failed-default - labels: - strimzi.io/cluster: kafka - namespace: trusted-profile-analyzer -spec: - partitions: 10 - replicas: 1 - config: - retention.ms: 604800000 - segment.bytes: 1073741824 ---- -kind: KafkaTopic -apiVersion: kafka.strimzi.io/v1beta2 -metadata: - name: v11y-indexed-default - labels: - strimzi.io/cluster: kafka - namespace: trusted-profile-analyzer -spec: - partitions: 10 - replicas: 1 - config: - retention.ms: 604800000 - segment.bytes: 1073741824 ---- -kind: KafkaTopic -apiVersion: kafka.strimzi.io/v1beta2 -metadata: - name: v11y-stored-default - labels: - strimzi.io/cluster: kafka - namespace: trusted-profile-analyzer -spec: - partitions: 10 - replicas: 1 - config: - retention.ms: 604800000 - segment.bytes: 1073741824 diff --git a/cluster-config/components/trusted-profile-analyzer/prereqs/base/vexination-default-obc.yaml b/cluster-config/components/trusted-profile-analyzer/prereqs/base/vexination-default-obc.yaml deleted file mode 100644 index 158655b..0000000 --- a/cluster-config/components/trusted-profile-analyzer/prereqs/base/vexination-default-obc.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: objectbucket.io/v1alpha1 -kind: ObjectBucketClaim -metadata: - name: vexination-default - namespace: trusted-profile-analyzer -spec: - generateBucketName: vexination-default - storageClassName: openshift-storage.noobaa.io diff --git a/cluster-config/components/trusted-profile-analyzer/prereqs/base/vexination-topics.yaml b/cluster-config/components/trusted-profile-analyzer/prereqs/base/vexination-topics.yaml deleted file mode 100644 index 8be41e4..0000000 --- a/cluster-config/components/trusted-profile-analyzer/prereqs/base/vexination-topics.yaml +++ /dev/null @@ -1,41 +0,0 @@ -kind: KafkaTopic -apiVersion: kafka.strimzi.io/v1beta2 -metadata: - name: vexination-failed-default - labels: - strimzi.io/cluster: kafka - namespace: trusted-profile-analyzer -spec: - partitions: 10 - replicas: 1 - config: - retention.ms: 604800000 - segment.bytes: 1073741824 ---- -kind: KafkaTopic -apiVersion: kafka.strimzi.io/v1beta2 -metadata: - name: vexination-indexed-default - labels: - strimzi.io/cluster: kafka - namespace: trusted-profile-analyzer -spec: - partitions: 10 - replicas: 1 - config: - retention.ms: 604800000 - segment.bytes: 1073741824 ---- -kind: KafkaTopic -apiVersion: kafka.strimzi.io/v1beta2 -metadata: - name: vexination-stored-default - labels: - strimzi.io/cluster: kafka - namespace: trusted-profile-analyzer -spec: - partitions: 10 - replicas: 1 - config: - retention.ms: 604800000 - segment.bytes: 1073741824 diff --git a/cluster-config/components/wake-on-lan/base/kustomization.yaml b/cluster-config/components/wake-on-lan/base/kustomization.yaml deleted file mode 100644 index e24f5b7..0000000 --- a/cluster-config/components/wake-on-lan/base/kustomization.yaml +++ /dev/null @@ -1,2 +0,0 @@ -resources: -- wake-on-lan-mc.yaml diff --git a/cluster-config/components/wake-on-lan/base/wake-on-lan-mc.yaml b/cluster-config/components/wake-on-lan/base/wake-on-lan-mc.yaml deleted file mode 100644 index 6d7f76d..0000000 --- a/cluster-config/components/wake-on-lan/base/wake-on-lan-mc.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: machineconfiguration.openshift.io/v1 -kind: MachineConfig -metadata: - name: 99-wol-service - labels: - kubernetes.io/os: linux -spec: - config: - ignition: - version: 3.2.0 - systemd: - units: - - enabled: true - name: wol@.service - storage: - files: - - contents: - source: data:text/plain;charset=utf-8;base64,W1VuaXRdCkRlc2NyaXB0aW9uPVdha2Utb24tTEFOIGZvciAlaQpSZXF1aXJlcz1uZXR3b3JrLnRhcmdldApBZnRlcj1uZXR3b3JrLnRhcmdldAoKW1NlcnZpY2VdCkV4ZWNTdGFydD0vdXNyL3NiaW4vZXRodG9vbCAtcyAlaSB3b2wgZwpUeXBlPW9uZXNob3QKCltJbnN0YWxsXQpXYW50ZWRCeT1tdWx0aS11c2VyLnRhcmdldA== - mode: 0644 - overwrite: true - path: /etc/systemd/system/wol@.service diff --git a/cluster-config/components/wake-on-lan/base/wol.service b/cluster-config/components/wake-on-lan/base/wol.service deleted file mode 100644 index c5c820a..0000000 --- a/cluster-config/components/wake-on-lan/base/wol.service +++ /dev/null @@ -1,11 +0,0 @@ -[Unit] -Description=Wake-on-LAN for %i -Requires=network.target -After=network.target - -[Service] -ExecStart=/usr/sbin/ethtool -s %i wol g -Type=oneshot - -[Install] -WantedBy=multi-user.target diff --git a/cluster-config/components/web-terminal-operator/base/kustomization.yaml b/cluster-config/components/web-terminal-operator/base/kustomization.yaml deleted file mode 100644 index 9ad12ad..0000000 --- a/cluster-config/components/web-terminal-operator/base/kustomization.yaml +++ /dev/null @@ -1,2 +0,0 @@ -resources: -- subscription.yaml diff --git a/cluster-config/components/web-terminal-operator/base/subscription.yaml b/cluster-config/components/web-terminal-operator/base/subscription.yaml deleted file mode 100644 index be7e58b..0000000 --- a/cluster-config/components/web-terminal-operator/base/subscription.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: operators.coreos.com/v1alpha1 -kind: Subscription -metadata: - name: web-terminal - namespace: openshift-operators -spec: - channel: fast - installPlanApproval: Automatic - name: web-terminal - source: redhat-operators - sourceNamespace: openshift-marketplace diff --git a/cluster-config/components/worker-node-config/base/kubeletconfig.yaml b/cluster-config/components/worker-node-config/base/kubeletconfig.yaml deleted file mode 100644 index 6c8b963..0000000 --- a/cluster-config/components/worker-node-config/base/kubeletconfig.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: machineconfiguration.openshift.io/v1 -kind: KubeletConfig -metadata: - name: custom-worker-config -spec: - autoSizingReserved: true - machineConfigPoolSelector: - matchLabels: - custom-kubelet: custom-worker-config - kubeletConfig: - maxPods: 350 diff --git a/cluster-config/docs/img/argocd-logo.png b/cluster-config/docs/img/argocd-logo.png deleted file mode 100644 index e204697e1b8cc9aee3b77e7b3e1ec0fb24edef48..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 26745 zcmXt8V{|25)6E1kH=5YCZQI6;ZCevgd}G_TC)UK8m=jNu8{5v8=UwaTAC0xT_vxzM zRb6MFicnURLWIMGgMffQl#v!!g@E{i@Ogd+`1-lWWn69gJV3jO%BTZAH(!7m2m*o_ zLPlIf-7EXF+cOz|+3(=xX#1F9<>iqeK=iPk-9hG)rFm+^zv@EH70;vQlF)Xq?F>DY7%GY2V`BQb^!^3;| zd7n{fr)6oUcZbN-Lw280M@N;zR>xg;?`tqdwGj-RRv(;3eNZvU8R2iZRHRDUwbtEp znlsP0z-Zg%Lp+(1bz<4@f~@-(1rkd0h927?l))xaNF#ONtZ+=2qykNUYJDj-HdUR9 zmONIsXl1KbAsyCzbT*Fu4~hbiRcG%FT;dR%aTk1p`NMg#r=7m%9_H8T^e-c`i%XgA z*!u8|Ul)Nv2&A_(Zow8RGEr8tKs^+9brfhzi%{x(aZ(c%()t3END!t-X`qby2uf_k zIN%T^o(!1)#WW0Ywqdk*gz_+};{}zb+1XoT23iBKOFrEFP&x1U{?ARO+aI`b7?E2M zn;SE(EeU3qSo#7*x(YuRY6FMT#9uTICGx{_MVy&fui&kox*jt-? z9}2tn3uj<$O_{+Teh_$L9kk6IbOOk=y%gy4M69K2i;a-!M~NQXV-^F@gGFlfUfYya zNKk+#*Y&byBnS+~X0VVY=sH0&s3E*!?5+_t?_hRe9)zyQOLWq>G=L#}PsjP;hUWy_ z4|=puv-Oozz8UZ~PBl-xD8J?RD^O#>-7Y7Qs>jJ8#+qIVh>f!qzdp8J;AFG%fEK)v zn>#!bp)2*3CRD?kanYo$XuirepsOIzm;6SRG)Ju{Ae`heEgmiZEl2$keT<~0ax|n{ zyUyKM*zyaLE~Md4Tfkai^@(>D!Zitf8X?!# zVj*IDquRpp5M3Ia$7-!zWe(YZ9)dFYf_wbL^@%0m$`j# z#=npa|CVl6oL_1OwJXdhL3}<{*?v(ajf#;tT8!Vp#+bn>!yQ{-=i@t_f9*$Bl?*Az zNW`lDi7ndC%vq|jsfh?D_0zICk}LRXgoGI{1QzTT&5uV{4*3K8PV{#7)qImMD=)JXy3eeuM1WJ;l&E z6{WY6XqaL9OQM_xsRG_0oH04bCvQFN=zQFOw$c;+ngv6^vNo-VRDoMkx(q?!6Si7v zRjAgcD~&v&q)-$g0Vqo`p)P3V!b@%#ZKCObcuno2Z2$y+v3(lRv$>0+BRQ5E`9%Hs zKh$wIed9rYozOTu@NK)~pK;N9eKF0Yg4PMLEDxux;A2VE_(o_<9STEGdiwYD@$h6> zOu3q&8kEs2jdrA}4`y)PW`ihx)F&W&p#9nc-hJ2>Rr+-KwT#Ggtt9%e@VMvUiObOu zFQYc7ouzdKXI1eOK*WEVbcOVu6WY488bMb{#Ume~1+_1#^f zSdiRA2+3DE-}e6M6UlNNr_d?p)534W8k)&RqJs?)s(w4dBPutb$hYwYxA(CWh#5c+|M^H3+$)Bd5w zH{7=Fr6dHY>k;dK*=&gXC_}9KL;uS(%GVcPjk{+rI@KW`R1C-QhA~vB5m|I7U2xzm zEbuAJ^ek_~duVlejrouHkWV6WivzHgnfduMAXTfMBmUxBCFxDfddzI z4K7EjM`&PI7R675O-Ia zM9s~rM@PjgB#X;?@cZ)Ql@5CE9Ac3Dls2Bj4Y_|UMZVZVe!!WzgWX|#HMQpRO!AjU z(!m*+(}1_0zAEQ#J*x~rB1ue}gm8(zaLH@030>X5pN0;38scPl1T;+ou9Ph>?Ow|A zR!o!}24$%%0s);W^`xc>JwAHjhfe+b#|v5-QgpLD&h$kvY89M;+)l1;lQy(b6UO35Zehqv7Ieh^>_Ur`V%JNiT!e5U3Czd zgE=ubDceU~*Smvo54N+}uixSr7%*<4p+4$hp@7r5#S8kEZ5@#3$c8QiQa86-h2;51 z#0nn_&lDV_pFZKqSGD3du!;z+G>$PbxIUg)Ejrn>q`Wj)B>|rlC|V`Hgqku|NXqjI zPc>E61oF!WwjNs2*cfdDNSLM`fr!qF@PnDae3x|X&ub0YW~X#)`BH0M*_JZ zCTeiyJ4yJED5wN+c@!4fg;j>wxjyYPJWL+75}a~NbjZ{RRh{3rW97c(+Kyl+4Uf5c zrUHN|;fDB6pvrfa@kNYAWteGwp2 zwjf=~_@q#NlTOLsGgg89ddpRn5_{pC+nyI~E{pS2K7`|A&QhtM8r{W7B>Zl%5GHt+ zu~So;>3V-)=H@xLNmE^H9Odh4C@|62jE9{-8C1A?2D1e&Z_5xcy_8=cIx{1V`^>rj z5+LV8%Vni`rfHu$l^hMa@60?pJ>K=TNdK!kb8n;sVeaE3{)DD1r*LEVy;ZVr{LMU* zO+%D4`t2#rV04Q=4uf#8#g;H~L;TYgA=mVBVsEwr*~Ij)AOTXX-DX%hmujaquful{ zNl|0&aQ(02|0=fA=*`f>Gzsq3>kh~boN&Y{RjKR;*fn)4o& zdiDpg)8?t^hIU#^)%?UhYz1f`j2nuz+SJwwhP5`{8By`c16m^kAR4Rz0k&d;l&4=XzH=@QeV8yT?_0+XkH`?R{}_c4q4!>$Ym2;J67U2Ohm7Lj)}r}tCS zZhb~Pjj}c5c5933!zbwsxKr5WICUC{R1@?-(eVgGKZv1G)yU(!C9N;&ARfx^y#pXJ z#;GEN7<6t7dn%7yV}5});05iN`wmY za*#Q6V=c+aI6sD|2SjR)1o}UEpy~ai;&ayA*ERxKeB)w#90q1ygUr^i4A0Ra`&|EV zM9m&Y59%;G!ye*4Q2ZX1g(oJE0n3Y)W7Q@0!6gs-;@l`K=R8 zpAkeGa2(-}^U)u`?;iMyI{lCL_XVynH&XdT>9FIF-mDl|61HQc;K728ja+T!R7ev) z&c;O_<7#4UYUN0JH4$OPLxhMa*O0rax!Z?75g#ZlpiNBNoA3umJb`Y3B3*t(*?uph zENponZ$&wgnZ7lTIuGG^?cSVx{WP4J8cRy43q9>nUDM zn6{AmUWuy?^gio|gWZQGW!3tz;U4NVm7LB@2yzQ!}p!O4_?Z{bH)T zn?L+zcQ8P+R10Gk&|v&pgh?GGKRkHhxxSl+;i{_fO@o+7QvMr>3Lb)jq!BQ0`nR4Z z-41A6NvdRy$?gU<1x5z?HptS6<#mmWF4fR@|yi|lqu zhAS`TXvT$H(}WiEQ!$yAe6t6+9;K8yhRqq>aSvki(!VP~j5~=e{m5CKB^+9UJW`ke z4A*aER#3fjvVMb$mK2;P$+jUb@D>7P3#*wYTYt~q55$Y;cu`@(2$19u^!!HlYg`>U z5g49)LjM{VlK=ApX9=;CI@CjPfShMQ#Q!AlAlwjYb(6Z{X6XmcgJYJ~S$pUQUjG9O}ns-Kn1hwj$%1=I?NKZ4O3aHMj@7*{_ z;{K@p5DTe%(`hd-#5X`VnC8e~VCVtq7# z$={X~RWG{2_`JDOiPcSCLfDN4)rZ2y3)dP_7Ewf0MuzThQL2T4cQUY4_LMH)^sp-bs%Pr`zKDVKmkF-$V;@`&{ZmrpRM|nT~p$Hif0ES5c8ix?}aZXHFvGrLJRUeOp)elzGRFL=A88^)xQwL0ycA8|{ z)VkrY3m)omH{<&bG_u3LCU9tryWG{1ZPH_Yzu`yO++%XJm9GS8D z)OiCB)Hxo4^P2u4uRk>NkIox^&El{U(AO1{47!VK@g!QhD8jf%sB7^h z1`aQxJZ`qk_Ke27NA)uS)lo(Oc+15{7cz<%SL0?4$~NAD^hpxjy(5E-1K9E;Qv1zi zN1N|}_nFN{V^;gv&ZbC2cAU6y+CoeP%P~VI9<_@P?2?#+ArWH&vn?%+Ipp;5&{Lvu z6}Y%6%E+&90q0ha-&*xsj61+k8KJStGU`AByxa~saep=Oj{H-MqbpRP#LjwrXq73L zY@$Ff;>aUOLfiKte6#T3s<-UnFGHKD6fae!YVj$B!cS(}^KIrqqE)5ivovHxSWSCz zwWC<)0ZFhky=E5F7MoU;{6U;tdk{Bu8O*TX)y4bBM{{)p4nh6#whtdt9)b2l6`)mE z9@Bc->G|2t-y)(D^*zz=?v|R zW*|Ep$V`57-Gt!#5)kiq#X^p-YFbwjB#Ny9N*!qdcZLD|Dl$0HF+eU+L_D4hmS@o| z)BeUzUQPW>q{aDjC4bC`MLH#hQ98PxwaWry=u8z_)_z+fy!S2Ryq;?w{=H`|O}Fi> zF+o9=+7We)$W>QnX$yat|JeR0eF%RraoHtcA^KbbzWR z*Ygjl=NN)tlTdTSgBgMFl~C)PmA56yy5o zI5bAfZpLx2@!-Z<%Tc2nmg9*{^k6sUsZ!9N^|u~}xN|$!l6zWvh~su8;6E!8JI6_d z2(-ZtkGJ@~@ZLzz$C_)#)eKr`1pu~`4x1edvZR@zSN1!@2mHllZY=SZh3exDXKTG`cHajyY~+6ZL2$c;a!tYbdFjg)ptcFMI$iT68rQ{ zNsBV5&E^qy`li^K33Ve2UTba={(_15iAiU@)}ye@Vix3t@{vouQmDeAGjdn@pcl>WLf z=Q)-UsezB=UD>ty1-a~wg^c!Vz?Q>*9OxqRS!1-;iV>iyX|eRGWnMYS(aKdF1YJhF zJ~mY8{5Uhu`&ZK$)RIvSyWhqbbYC$(Nz?Chk7{gI4Y)N+RdkZKeGl)v z$8Udb#l_(DeTkZEFwT$4c60r{pZ~So&Gr9kac6Vcb&nPv-<8!2r;h*HT{ru1xa>R< z_e*~cP?PA`ARrcDyXrAXcSl?%dds9^J)w1v>IYM`4ELNczD3$VLIvh9Jm^QkRF^0X z1{FPVF8yNu{vNn|_;KL49gE217Z_#q{LN{pZp5r7C#nTaV;d#uMn7vnt?A*#Rr*wT6Tw7r<)(Vr0zMyF{f6W z+bnYup7q3TkOo zNrc?cj{Bph8+NE&`8=jEWKK_K4Dz}_<7g#qKw$jTXAJB*tz5(|2}pED=n8*Zk(f2= z8*h=OtLAPJ1!UdoGBIxau82Ik82Rf3*BC!u0GAupWDI3t^s}WDl!ZBD{wEZWEbAt8 zr_b7%XYGUSSB%T`)8QY7o)q@s)xOzOWKoz>?D%MVP1}AW%J63f4XgAd^`^wHOI}~z z=&}@t?$E2yMX=a)G+TIKn2f>}@S+gb= z32ZSg2X-XQR40kD98CJfG4Zuc+@e+ZlWBm}l1S{}fJ1lhTz?3f{nU4e3KMT{W_`JZ zNnk=PV{w_K^|BnQ=m}(drSQ-;!HV2;(gWANpR5bLFiE7&60yve>73r9$oQ5prQ37d zjr3cNG;>ZMa3LMZ)QnPQm_yXCb@>(|T6l@gJ+H69WTnT=oh5ypTwt0X#OGbkLe~RG zJhQPIVgEY6xTt}mpUN|?kHN|$BzB)dwMM8Z;;?r0m1JpTVEZ{N5;w&^5=i{El&Qr3+Fu|ZRm?ackIUtgv9cSJ z90TayaG3W~AqcFd;~)~NYA9&3M+_g_j>XS^2_+&HY4Ag`|2F8t@W58JvyCq({NTDJ z)z3L4;4G9SYNhLeC%$ty{R3ySkV|r@n|jQ)`IXb(Jj+{SU=1S&qul&(yiFl03a8AU z(uOe_o2iAyTpv0Dvcr>qH67laQ@ufCrtM#&x=jG_vda%SivijUeWgV2my#Aa9E!CL zcCSV5BzK1wU)tIz%5;L{m zBoN*UxW;;})o+lhXn6%-Vh;ONLUM8)_>Ac-AL_NShUBB?-(HcJLo4owEv)dfW-HgW zxkVk*JVj>;i3u6z za~_W4?Cp#&qM~Y0lheB;U8$fsT`+T9R)U-(oKp^2$YM(LzX@#_u?SgGwJBgIqTAh> zwjLol+%H_2Na|3OgEc*=EjX7hL<$^E`Hj&?6YiE2r~@y9l|VZJCo+-r)21K$Rm_om zuz*?S|9b&Cr3d1z4w-dm8P2mwt!RjGaU+3=isj!{V@W{7?f8GO0zhLNsjW%q$=pSY zEmr!^xdnW#CN1H#RpQ`aLmBGprjn+#*3G}9dTjI8_0_TLwx{w8vAo}x!Y?Jn?26pw3F+|dkkkbJ#3 z^q+G)vl}})8&&D=b~GLtCT>)=7Epd_z~mE@d|VVS7`pX^1+cWUgB&LG^TDaQCj7jLDA23XR9y& zt)<%@av|}DAKtkZWJ?roy{YNp0{YxyjGHH!e|x{Ta=)U2X;~RDV6`V}DwMc<29v7} zvZ9-5m&iY9=LjpfrHP%~dE6n@JAKenK*bA9sy$p@k8s1|37{=8Hf%JTaJm z6-i@R?SZQe(ZC#%e`bWhGCGKTw44`}MH(U238_x28g{VY=r;@4c|{FRfbG*zCqgM& zsiMGLgE+O{e`QdUVW-xIanS)gPGdCUlvVibVOOl}GZU@eb1GtzG=BiQioT_ev}urp z{>@q7OQ5zW%K3YrK+$bUbv`J)c1nW*tr4NK&7!gsq+Zc}1_-&~AYvyNTucOZo41yV zw@c1&qj%wJ?Q~AM8!2V98CWvNC->h|q^HE>9Cb61mfTBXdeDcopoT^E5eR|;4rA`W zhj2eP0q=zLmuFHk$Tnz$cSc{bCXMW2jaRl;ytgC&x-)gmP5zLI9&EsBR*wADtv@k7 zac~ap-e<7T_Ef|9fjQ7fTVy!VXM1if)Qx9I>f^gx(EWVZl(>tWb$~*0S4d; zUB$up)OaTNBuO5br0&bo`kKe;$eMNz2R;9Y{NXKq+s<|zq>3ihir_Z+9Jdu?TLkph zb?h^uICk;)9b>y^oB}0F*s^#Wci2iRQTs4xJ9zy`97txWJ;}{&@c76=BZzHmC23Wp zZ9b}`l?%_5BtF4h$%6PipdAluTB>4XPg!I#S=IY)5Uc}g?@4UMZ|5wga=49sE%|Un z7_rQTp^_AN+7xapm__w9ZCD!j)|OZyko(4zc96OkYf-9=8jwZce!K?z{FeNc^;^_d zSJh|)6tBQXdvJ`Pl!G;yjonDN?>RHmm%c>m-SX(-& zx0A;cz}Ea?$l~E4NE+q&$RO|BarQu`YOhd(5J7-A)m5(4KA1OE<8b?HtcskI7i&Ns zyK)zBr0#kJ@XuL^`c&XBv2^tTkX{2XETQ;kn+?2#1k3`oL3}O%%SyKXeJEQrq)}ju ztK7atsP65bpgkq~+pY-Iu*yjHHtZ6vcfJ-w_M~yf!TTs3>JVq=M2|``@h_W~?)3#ZES6y5*~D z)glmf#Ie6eAbPyMsl8D7G-X6#bhSN7*!4PP0s`G*vg761u;z^ydb&^`pw<5TBg89I zP?@H};5CUAk5^@>ZCL$MZ{9qp&}N$jioYTl-fM%`2F`!Keh>G=|64^`hN5jK!m^)^ z>$p6hcH4ayPRik4EP*zhratLD9p|e>_Qp`JSw&_I>dn`gtngC0cjF15qRpZ{2*Zh} zvgK%!=2u&j!>LH5t0Fr~V*b5X=0quJr8c?(hbv;{EcHDQ@d#Rg<`?FWj2k(ra}o2% zXtXg+AQW&t<`)p~c2{;#mE$@a;(P~hnzeXI1l{g( z-in%la0v@+{}XvX_yoBP+V)W#Sc`%s z8)5yW+Ggh*xY+isO0$e?TMsm9t?~4^ARTwF!PisHmU9v99&sokr_g)5p1y(0!NN`I z?kaViVDDJ3fn(u~5V3kOFGMp#qegB7H*dad)A%fngpCS zxp4^1F13Xr#P0ZF#6&b`BR4Z+i4Mf7l3IR0Wwcev-<7SvE zZ17zAHt_+`!_8!SN;B*x;E=o8xhXZk*FBuylkor_w`D55hK|v{IKoyU}OT&cQ#+p1K#vYp>xP769g~dwioghU< z%(A;+^T>jzF8RRCgec`|yrimR3SF5b9rX~tBT}l)v6Le>G%0wK(<7^Fm(~tSBQ94?sF` z6dButNy1(Yd3;Pg5rSSa$W~fq1}R_4KiIWsa;KB4EIO3Ne{2PMp+O6EE}D(@H0lAQ z(IRj>pYp%hrl53k9T{pffbCdOnG&)040wQv1kcG@LlxPsJPvIhFU>q68L#@~?ll%v zQh_aqc4Vs+CT*vNo?*^si_DP3oK1vo7X1fA@$v$0QhxevQaq zq4OqUZPYpsDCCz0DAK0#@?uox7xaBa_T;d^f<{dFlN3if|D)8gEyn7M2K=SPlg~!N z*r;rsq5khdsYD2gLfT#xn51E*vA+Ud6dD#vl`la4L1-(^$4V&50aslclp-k>8{GDt zTk*9OSdW4mcBRPGNis_+BMt=+W2SMMbIUeX7X!iN_o05{+*QeZVV>50XS;!kdcG!2 zKZ0#k5)68{cPJHll!?SLjNx_Al_|owl8B|@BPoR8mx3q$r0~wSo(x8((pWdc3WEAm z=I^WmBFk|-a`#ekMx|6n1E=$C9t=^f~1cQ4*)O zbaVxw z9nJk5H;zS$sRI=I{i!$%re#$0{?KM3%n4YEn?nVMfo=6fT`%Xjd5yt{))>mB47-ott>n6=&bIAC9o|v>3}SQ-ol9E(?`;VFCwRp z)O~A?s;liWb8^$BQeh`sLZ-x#qjoPOs-tW_4lF?$HHIECrjj?ZAST*5S+*=M7zQ?P zPBbso3!kAt2E;sXYvf=ykL28MAC#0)8Pt_L)LX`E^^psUT=6~c1D_+$;@eIU$a*rp zOQh{OuF5+NgwwnpeoJl<3eDlx&|IA@S148?iRu@;3vquqGk~Q)H5Uj~AjYy&R_d7CMQ5UvXV`=&eHQ zjst&8Ds@(Dl+QCyTUl;Iz+aBNR{yj)S0Tx$(Bnb%p6LqBmigVX^w&WqNK07r8tVPVDy@~g}8riQB2 z%bg-xqp=g9I-20;3xEF4v+`m=C8Ws#YQr<&d%(?N4c>$*iRke$-qAZ&Z#0e;aILXU zE;?Kb@)vfM;387$*iI_n;q%_KvG;Q#kua3gl6~=srJ&sB$h%mT_GiP}_;{r!4Hrg~ zaSUosa@Qwam{g1~4A1+MKjKf&ByAHm?+}jk*KAhl|NJJ_7rKjj%&N1wlE(dst*ROD z^Hg6b-0f~*{g@+impw7$EAk@0r5%*))}wKU;M0+p9RakZ6T^nk8`G|jjvN+p@W-&6 zS&M*%#oCf2WV7hmxn9biSxAI_c}7{lPxPA`STPKllCgDftcr;``)O>fh}-7Y_@|ki zZ7&YZT!zJjuc>ehNfHdeLE871T5_L*4Y@cOZOU|@?NP_cf%7zXXNRn&BK)YG55mLc zySbVIFCxS9lKnJ=J)i%MFKB>(Kg+6Xh^d?5pFQkoIrJQBVD zqkbZqz!p9C0S=Pc4xbmM{~@riv-@gq=XzlNReGZ@4XEd}#{Tv&`h|5Z02^;WiIqL8 z0*-+cp(X+Jx8XDIaEe-tsDVS7r8?>{50dA{d~emHdDl`&7%@sa(@yO@jhCwHtf8Al zAX^Y%7*yWEsz{Fz{^|+^`V8|Z7+C#?@7SZA`77_SGLkgIv#b@ zi?h=yy19uhe4Rn^qb z8wD3q@3bG}Sx%%f*sb;C6cmsYQWy62=0!1efYuy3W3q&t&^82M51)tQd-gG9rv((+ z9_}iQb5lBs5G8&tB{5bHAykvP-q=UTn5&>)^~VzMKW+!}ciQ8LNyQ?ElDxgW>AC$2 zU4Nd9bD3ahotdA{R#`--CGnfD33+)Kp3QeX)8-_-JBHt@>j<@4>@dH)h5|k=p04xWX& z_71yF3oPHde^I^Y#I<}I&TK(Iw3a4as1H*BVjP{3`Q62Av-eWPL`Po^2|Yr+KTa50 zT&y{cz+_hb*%%yz4tVhl7^!<-t!uDfYbmXz+33D{^y?iL5eXu#;PMcOT16+<=D<%( zV%8DGZW-Il@Xq6qfgYR|jyECvsL{058G4)49MZUbgD7K+<;Y1h#A$K);t(JPFy+Gj*vbit#sxP=*ye%xRM z^a(tyi&d!WEUXLMEvUVICcn{7GG}(Q1pF&;7S#h5Vs!aAZp%lvkjGbHq$ZHN9DEk* z>}qNCn^XicPBW5D!;(&M_~nIVI`WQ0@1=5?nAW*|_u4)8ngJ5X(CHF7O9ac{*&5xa zVXoc?PMfdMBdXyG7vi=sltf@@Z_%p9|tPp)Db}S@yKL7e#lt z_zXCtZ3Ew!)zE-Y&DnQlJM0-3`IWvWYg_v{o|_e&d{ac3%Jk@uOMVY5ZhO*drVy8k zLU@*w9mj_|>?UyvE63?@q3#ty=YQOjW~*hSt69)lLnv>VCGcMym~Wrt`p zBDZt>F-tpJE9CI`Jfbc0{8|dM40pM^?pJNQ+AWnn-{rGF;4aJ7*7emj5lTVhYo8R% z=f>OVD48_z_06`-^~1!Ikn{f;y<2ZNO=#eEw^%y7?Z8i9>EwR*f+g{3w#kJ~Ka$rR ztDIRwn`OepJW(~-80oDmUYGT#XV*Jsuv0Q2p7^PI$= z^9b$MhW&N!kyz4Dy}}R@(umKwvc&Pl=x>Hl=0-%JMYgk@%HN=EN>pPktTC3Pk^Q)) zY_7yXMjU7nH4%v=9a&g+Y|mu}Vc*{8y;TZ;h^#%!jI+~n-rP3e0D&elGq;o2YATAv zAI@@PI1~K(X8}5KI>CxZATfZM4pp+L$S!6U4KOf_Hru=&--3&dWugvjchkhf}im|^BX^ixq{c{(bsbMCiJ`u<-B@apt}>I^HB3^s?uVEsa?=_9Om z2?avDNdw%O&H8uZ9EWGzD$Tn6b=PV8(JDN|c{w9XsU{I=&5~B*O_^ zi%}$UyfH_Llz!cx>0RLAd4MAofFy+mTWb+tlVE~`qIEon%ow6^&fUQ=FFr5m?kRxRNgsYfi+Z|0FXuFKD^K_aAbN9lg}lWtj~2Gqg4E2 zmWOEF^5^5)bb9M@+V=(w#Lp}8#TY*Ru^cta;v$A@xMGfo+;@jE&laEmaO^$f6m%Lu zyy-tYA&DmCbXfV#^!_@Xq$n(lzMMluXb`9~7#2}#N!8R6H&BTh60?SGS!7P}+&_vc zvC6C#=B~OYK-N~;z@LJaV76dopY1YE^SXKQPMF1MPpTJ!!Wc>F?d|u}v~%%B*n9mn%|v5lO;X-$r7SkC4d=OJkFTa{V~bAo`1{*q@5fERekEPq zppLHldH?l#jc#Y^)?3cjKf|})6J78G{YW=bnRsc=<q)cZ>1`|g^zyQpah{#_8fGRn%$Jz9D*Z8=}6ps?&( z4wID?^y;=4+MAr+^Vkh^s0Qf#DVkSPh-t!P?79@~d8G>IKM;J;Hu!M|{7%R(jUI+j zt26X;kTX)Mkac)w&&b+}d%B0MGx=T|=}p7lM{6e;LaBMrpA4BLt;PK-o*5!iB&2y& zIf@fT6sXEU$pps5CsSay^lh?NBD%>%M`7n8;DWIcxj>k{Y5!!@f2=|k@)TH^Em{#x zfgGtfbB#@>Wv2_mj1nJ-ovT!2s6A=4o~PurUtK7q`y<89iZ6$K1NjwW(ySrlxb|3b zoBgka8>4!G)@B=D3zG~ChD!OY^H+EEf5|AX76_kBekUmRb-8uyk@-WAv&uIW;GB@d z%P-~TZX9x2%6FnD1M!EKomQLu#0KA*W%2KC3yzLeZOEkQl`5lG*yHukGM7-ogppTQ zc-OY^L)=j<^vH^{H~_rgXEPDYbt&|CBLNR*+Do+?3=-JL3*{X!;Kc88$;_3aDVI6j z5o;`~p;ji&${HqCjep~Q<}(<;lB)XvNz!4 z(YDDomVOSrS=@hf|K3~ccZ(+V3QUn>@JV><>stC;Bi8A@FTzTO9M1Tk9$qGntVDpm zcZ;#}>NWe44O3`!Hav&TL!febL6*#*io=p8BsWm^gQ{)FU<)-0v~1Qdt%0z|E7Xm( z){KN=46~JYA;Go>TTW!+Qr}TdZ3UaV(2%?Cct3R%_uw+?pUm=zG-A*`b|FU7=fhuD zWt1tr-YDE`TzcL_`%2lw@uubflpLprz={=UMV^7=1Z)|eoK!+cjC(-GLAo`=DjYn& zPC=T~$=}ui=m5L3c#Ubmk&TQC`G`zi>dF{Pkf!G%HLqF3S535PJ_?j0NNH;L7jATF^s~ff z8x#W9p^D>Uodtknx0~Phk$2(Q1{g+nXxk4I?6{8*Q6pHNg3T( zv7_uL)8&zsTf)ky$`BNyg4w zWy6RwEe-_EKAf!jjkgHsN(%elpWI^2_2NlC3%`s%Ebn#1el8(!!-|PZL?XexV#ucW zIw`y9&D4dNyhH8*25p%U?CnOZNOxRGnu}>B8fpIxHvyJ&c(*<~<7Q__WchL(USH3` zbRyUC1_|*h4EUvfvmZiXw1%0PAb8wT51lDdw!AQM{Yo#pJl%Dk(MY+D$(&NNUSyY4+0wHsza`(#LgWRdFSs{p{BLy__P^TUpx3M|lXkIAQzB2a%E(LnDh?)qIBr%PxH>3VCpD!8wvkyxQ7+#dxQYG<*$ zr$pBJB`HL63#6+6K5Q3 z(KeUnDb%e5{<_`%NLG?=pVI2VMv;hA+bu8zlr;J@uXek}%z%0J`X$d0 z;D(jE4&hkW2nTQo1f8k=FPSH1*fxgf;692^{s8w=pGl<8#&SVRMGB99k7#(PrgR}b zOZLSPf01TWL>8rLJqAGTE(wHI6a=>SWyTYjrz2fV8a;{FT8^6 zj~+hpm!ctOyHoSUd1Q7hjO+^lpS8V-hw%4$h1q+LVCG0nx=IUe~dZXg<5J%85_gFQA% z?xAm;H1P$|&;fFf+!ybXHAG$0q;vuC=WCuv3_3AE?%{6{4IgguLd%2T%~!~8-4Z7r zR`nSZ+FA#kr?POnX=DaN-jI65%QQc8?v&MFeeArYY zm13Q!Pe+7qze#V2T7py0p>X+)WifPaT!tZdWhc{H{sAp4nV6Rqc4~s@?|hSR&+9b{ zzlc|U&=Y{Tb zv^t`Y&qpWZS!ry*c($j|HPXzvTS6GOT)cK#F;9y~0RVwqF>0!aM^IKvYN6Y6@SBk` zRKan{U409|sb|Ic^|MhHKZ{R38t*_&RI_d+v{WSj$bA&I{iybv1e_Gf)eaIcsaoF0 z_#%a;e@O28_s4ZcIuLehg4_e&EE_tjd=XVNl_r1fhszz?laVeQNmdhP@|Rwh=(Uq8HyJ}Dj_%BtqB-tV_F(LeX3yWU zToTQgH&B@wptUfS3!5V5qSczYB?9#MPV;Q7O7X(0$X#`Fb)%MvBS3Taf0O*94|Ys6 zqZV@H9{MNp4}Gg#B&YhV{r}rL^Dw#UGT(pRv((c2nuY8vAwWVBi9ry(29+g)sHn_{ zI``hWbM@-ub-8zDoZWGmnL9d++jT(iI9H8=fTIo|iwq!)fC~bKV1fh)gphQnyQ{mZ zyVi4l@BDF2b$U;y>r_`Y^!Is+Jk+VKbLw}_`JQ+EzT$vPcVkxwD?Wp3Vp(V|OZL{A z$o<>Rb+c|JGswulew*BVcTOvkgYof}uOj=}-wHZYBTA)OLLdYcB@{+-K~{3YhDYL- zsdyq*boy@-aOxNTuC%fzzZ}sEWi->TG&j09&fIQl)gX=PPD2W|B@{d*@6Wxm6ad%7 zU$zRT_Yls}!;>!}5hxV!p4o@yb2zKkBJpU1dglVu-^<9&*OR;FHYnt$oo*&J*bQ^9 zyErZ+_-^%>I=~%T8s0NcqPc9aZV^mKn=AYyFEH}muakf9$1{+H!8Em!*?ASk(>6sa zKj_*P3EPQO|H3y)-(Z14@mRo9VMJ7}edFdOKduA5rV(X!Bdp4?qGllj)Qcn2y9KF;!j8Eb5he?0q zOB8Vsxx$3XYBdLq5=pso)hrBv_k8G2 zv#5C`$Qcj}C$cP|xxtz9>_|f(06d-R;aWo0GZZQi?g4_vw6;#X&ZW37JcBhnG}+7# zT^9evgOr}!gQ~&qS~4%zhDr62z4wQVeE(Z`2lm5E!*3+GiKmS*L<|WhH0X5ChVr@{ zej!*l<70O(otJgTQ(GSS}>-G3A9t;R}8nVE)$-ep`Mqc;kNOe0QNTntnJMtN- zsZ5bf)*H_kaLaJ6>)SVd?GqJ8>Z3i{2~bt*&d2&cpu%TGNC3oKi#5v|NXG0rFMp$B z(HfiHI7$^f4hL|MkPP-1;r-qc2WBbHf;j#c)qMljH?&Aa>>!q{7MXQ|=}` zNOAYW+3pBaO=F`V^hlDOdY#LjvJR%7&< zrY6-#;jy2Qf8d^=p=?UYy$~8y|7OqK!SKbujcI6(yeFo?bx1nVKCeCB@Z8}nBe`P% zPgRCh_5GJ_>H4E@Her8)MOjD;$NGtXhjjnQ)Jw{TuOFg0md7L-bq_B@LB^piO2P9uKKdAO%<#O_{R zQE9Xm^7y@nDem1(@sWq{p4*QW3gIaG8OXv4$s&pZtvR4<(fE0$pM7ars8?RMeK;qd zPW%4(R9ZR#Gc+8Y?>+pQ(i4wS`pvI{bz65T?kQ*BtXhlRxfDq@AdWlPjZlLc z1EmsXB!k~~1n;?LC_TLo@4$XcsxJ&`9%tQ*k0u)#dG#fX{HM!;j7Y>}0YU6yuGju_ zFhvyyL;b(%2x$xgCLu+YH5;|CU?%3o+Cm>+?qC) z;j40RxInrXft68)WnuUC(0I@HNj~-vGDAiJ2nayK5p|A()zE~rwPCk+VYPN(H8lrW zg0Npj3pvbi27hoMQ1~87p}A~85<=J>di-A_ZeUqdJHUA&P%m&#rj2Wi`|#LxbFms5 zv0B@)I>xM9JaKH@@;UtBG-j|rT(`ks-O8Dd<2}v8{dwKX8M*MSe<0irV{>0+Yv$PB%IMQ~RtPIDr?0xK9mD~<5llX8RGaCPj9WK@$)qvqA$b1T zaC`Wl@~PJf*3J0fxD?iJVdQmhrnqjy=zgn#m_7YNZmuX>?M2T_yq|uF<@_?rea#DD zG^Upy%6IhNA*$yh5`*9e7K%Q}#N0YqA#h6)_VlhvlWWrwvq=>qEaNr?O*E1{?;=X8 zPov?X9}(a4ORVhlOR)tzCG{ zc}q?rw|xh>ZLh;LwN_On-WDMq;podUJkO9GE=`m?$${Q-@mZ~@DEBol&!HVV#Ir>2 z1UU%7`7L>d^hl|q;In6x+zkCGmOw|s#f@Ze^B8EL8(3O-GU+$}SB5WnJ2Xa{cAG84 z32s8WvA)S-6k&I(-58QbRTKL&z!vgb&tvea4>9uE%fjGhbw^56!@3Y)IOk1O3ckMyUiuP{WX-ekFm1|mP5K(vBfcQfBeR04l z2m8J7U!R~JK_}D!DdV25ql1yd*x%S!E$S)e17Z=#1;&DP8vDY82Ec4iT{+xg&9HW= zsO<*lZ64rSf$nV7@J(P{cw?%X0}I~z(O^es#hs~BVO|O24cl7=?)=rjzo?iu0&PN| z_nFChbhO0gYylXB5zi2_>?w6W0h(hrZJtA4F8Y@AV;A4VcK9(DD;y&VGvWV_eSDNC z5Kee};Y$UR*369m7jrDB1Y-!+8bcQ0zf(d%9T#<~AM_D{gkwjps3ii~tj}<6d>ObP zJ-)c#zjC$YBHdw#c{ON7M2&IpL3ybBo-vThlqh+X`H)3l$xRf!8M|+wGw#ypMC_U< zVB474R3wHZP_{tIs#oQg#6ma5;U#TNoDj;S8>)I)aj=qMptm7(W0J>;)Wi+fZsuxv za9q@`K4HWx8@EcxrkG7iL*bYv^{`i^^l@W>n6EmZ0;#fj=gG;>9(FA3PjdA0P z9?1fN#uBLQPz@8q79r_GtE5$i7g`tNB=}T~DnC-&y)XJbjz`V1_!n(%I%+VxG@J@w zRtrj{E4MOAMj0+mKb8Q35sMXz21D?)vILDKSTr#f2!y~QjJU--{OYQ?A_AmGN{nPD zh-r)TV9Ty*TNhA6!VnS7$BK6eawi&;*(pKBWMU!8T#)w-*%`7X5LgC2FtNnK zE4O@^LILAer|K>4*j1_M6oEp?&_7fh-%P1$1pc*D$WK4wE<)6_PVkB|SN5yze?vu% zK)|3y&jcn{g#}g$jFgnZH1P~2n5Gty{&SEe5n(Y^vJfDsn?Nlq($nQwR#mbh5Y+3W zGR0t2$JqBpo>pIWg`*Fvj+z%1XEKHRG5RlIOVUt#R`kLAh05aiiW(e_!^K%&NHM6USwtB3ZY9<^W|K` zaS_zvAF~K6hX6^ZIt5w~6lwJj6$8DCG4HGJsH6UMJJ-v+4SA`HEBrvQYd32Bf5K_f zLNJVFARSHbOu<)DMW6n>Pk-JpSTu-Ok@}i}iCe2)?M2KQ3My8lLF$BK6RSepqKu*8 z5OVRQGq&bO!w!g${{DS4_lsL|1)6D26-8p(N)JP1?+l`c<%xP?gY zRETQwl)CZ2CtgI|Lo6$@GQSz$h>%&fa#bXcWg1RD% zi?=Kv@qF`DK}N^AsY3ryk>Sauu#v&FEE+3#QV1HjBzA2HLq(=;vtPs*C|EYeP0aZl zY!Mn=rz*u+5RgT#;Bz!JzM@lARp1_R>~B;<9A`GDE5ZP{Y-{&^HS#5eK$(lcHR(+i zCPj&(glk(gxO3Dk2*(HnB04p?Swm46w!Ri?>8h&C)2JBXM6qgASf0>f*v_1r1*SpPNzB$%48OeF{4Hm`)f1*a* zwnNf5(Z5uT9Sb@jYX~(4Yt0!XFaLe)WoxP~YI{O325D-+-gY6{)K+y3%^6|4;Kn#n zX=qD?MmM@Z`E(da7a1C!B=?X*^#5g?j(g`j&^Z=$M;HKCZd^JnmR>8!17qJ$rArKD zN>%OHh}$*|j&tIqVLKK3#g#xrFkXq_!4&psTS#8RZtsNvUc{iN% z21+WmJ0w-qal%1Gv;Q+IjCIAT(1BWp0K-{tQdR^&l{>|%ohwpCT@nVs&P_|7Hex;t zdZ7HCXOx~)fsuUm;u#S11DsIwTS2Y4o4HZJ_&$9-hbfgjoRc@v@Qx4Sp0zzFD6565 zqzcAhuRN88w|#)vxfe5%%~8zfYT9;VoEXNQy?9QUEUMA2UWO3#iu4TR110@2+f;S0 zZ_8&d+0+@?$ium!ZV3Z`MEBjsaIL}!go|1<^bS-vo&jUsliBP=!L~4NqNe?-7E15) z2gr_$0AMd)NAimI6F+|^5>L)=T*LU_IJlc%9T3-<+X3kB?V*&*)wEGh-B_3cKR)Jz zEFg$m^ri|yY6Ziu9t%67r!R(z0qD138tp?rV14|s2vY+ z+osWVW|eXcst0RpVK}zUk>{S}Xm8Kxdsb@~iJiYo@~!_J`=oWFLzt?D(5kSyP9k~f zduVvu2e4P10zkwLp_~n=Hd&}b-%x?U%y@4@(UK8%HK_BQ z9Xlk#@qKegT@wbt<=a;DVOdwBjAPhTy2wBk>odxT+1BhxL##-Of#wP&AdGB(FOTmY zuP`reoY*<9r{SF+CHAU|kcOsUP;r#Rp$2>(Ni-1K_BtA``Y7?&T#hs}kA5VR8D{_9 zC$QB}EA0?rtQN-1B1?@ir|JPt2wyIl}2+erhchBAA3zK7G_VRTk-~3)0 ze&@ruXTJ(bGz6|gB^e82f}m!y33v1PG`#bpB(L}Y_Ua9jn(>}{?f}p3-9y5yZM}+# z&D{4Bvn-n2`~8Gw_~%oZ{{W@Sb@B%?yI?acuChO#UsZ$6f%gi`CwZbIK;%O|QaPdnS@> zn)dkayYD`7{kM*fqp5G?@mC>y5FrkbFBy*X=ULgEBoVL9IK(o_KCLA_dCwoWFGVo% zhME$FQCQxbB-8tAzH`G3Y~6e|jx+TsmWF2BP3PloI0yg8bCjOmgMVNj{?S9|@E}^q zh1N&-2bO>nLlO;Gt)19QS7EQ+fV1u_?9Syu(b^0+a^wg%|KJB)5VLSCtE%-hGeIG6 z9mN`FS(RJV6OKJE@s*-yIMQEWctXZcVMLWLk7Tnq{nn1Ix`SOR48K8O4BtmsY>b0ZS=odzO8GK^_tJ%4-`VOjRARyTtx9f=qxHO0B{ zrki;CTi?QY=bbn6AGvYtRqL@=tw#%4%+LTjcodT!Ku6NxmxA9EPhvH-AT6C(tzAfS z8*&1LYB%3<3y(kcC|6x@Dz-4A-fC4Lfq0Gzl*^xN5t8$e2`R%jO7B2{^hjv}S!fC6 zIvelWE6-nDmC0q5VnGoG1YNCnKGy$9Bif1T4hbIznXJc={yfXOk~mKF&B?f9V_8D3 z${i2v<8xp50;ivTIvpJyv-*39H()PmfF&ywAc~IV*}xd3cOXw{qSlM5QRMa#rN4dimgT+k zaxinif(Uv}#6_Dso&f8wKz5IPe{i@&&p;mE=)Bynt`!7B6Lw(68aED>UDLu!Ti~p& zX5w*|AKrEwU;XM=DV3@p7@iK9Ooq>W{`36mv0rggO9LyK61B4~0IWc;Swu)WHchc; z@oZ8+*S29+^fTyBjVaF3Rxz4-7wH|yW9Er8gdn<}Y-k9Bf3#fo0Lx z*T=^{@d<9Y;f8r7jY6ToHP>Ft)t~zu*=!EWw%NR-nS@i_7}JbUz_N)a8>=!3VA|b= z5)DUFg~`{X@-)iFf3~%IUd9AeiUms;0Nb`nY1r+$QI$`tGFskPK0#&oWWHdzam1Vo%Sc!@UQP7%_3_t#^EZ6z)1PK=a1g|z zJ>jx-No(y#JvlZKOE6z2Ni`6(?irY>GFhK9m_LsXcHR03kveKEo*oODFd#^`mb~IO zRn6b2YJd6tGHLYAV@yMBHx#g`9h4xBao$NCbSC4dDzg-#UM;>{E4}Ijr{QcEeGn7ta+crj((>j_st)r>Nf?x`^8}yRQ!*LwD1}9q<3NI@9 z>0zh)d-YQGJsT`|!T`8@+ls8`m%f7XnW;#lr$0|=h5^mdKm&KA4iv9^RnF>eX7iGk zQGeOCZPMv9*L>wGyzAZX=AXXyHI5uP63PBlmHqqo^LL;54DWo`yZFuxH&QH>uq-Pi zFyYlJJ6O^Xt6BX;aG(TQ7*6$jevB%8sr)pS1&3Ai6GvJ`zE$gX^%KQ{ORG+Y%eSq_ z{$TIXYZ7@x(LWNA4hTqNAYH^5Sk{@qbxu?^W%dx;ff{OJl%Wc3afdgayo7t7@55+d zVOe1|;1>@+%-+3wx#7kex#F#F;q@23o;7RM5RcFPMp9KWnGE~(?c@k5~Ri&#T&g)ip;aW0p!RYCrZVWw6ky#}WLdC39A<(s$9J4rLEdOuYh6}rP zp1m$#wF9XVUNVFM@Rl>WGj~3A`2VUpis&DLbOEDd=8P)KIupdJQQTF2db#ns5#qgY zbtk8HH1WjIH1-%pAjfgY=5qYo-FNfvKlur3*R0`{uY4uvZr{#^4I5a#Y#A-Btt1l( zT-U|-eF}vF*=&}9fdQUBc#y{*f1IEH;urjC_ilQ6dhmT8+qTD%1q4spZOhx(x};_N zOwgJ@0}HT@tdcf z;>jnUq_wq`&W;Y++uLbuY$P6!<9Qz0T#igS%|I%}U@FB(Hj6Q4^n0c%L05$a z*WvP0m(dz`YHnSi1k!xA8~M2xpja{-8OSq~DNU}kP(3JOeJU}S-gW7Yg=blm@scA9 zfE^o`4&Qt4v)AO?n{vRPAu?LJn8|whevW0G37Q(B{P}?zH4#qKs_t~xQgG;kU1=!@&J z1uy6g$xe=6s^Q1TzB%zajADWl{{=ic zc3Yujc(E_X(Nq;&(!2lw2ny~io$xEnp)@T$W!TGUlDm^A42HZM{?+qz*l8ebAtD8 zT}$^oJ?VX;oZQ~X`?jp5E$-B|cVr?))wbpi5h(eFo`C{~`}32hs-qqvx2w%ZF5c4h z( zUpB4AwW?d1ZB%KFJN(acPUe-%TIbcOnGH0SK&7%6Mm86?v_}Vnf~<*p7Qi=+<$rkR zrtV+Va)wAX@UkF`GA`cIxhISKfuh$aIy83MNY3Yl-W>f?Tm-X+ps|oJ>gY02AZ7{g z-MpGNowf`OC)h{69|c=1es|MqetW}7NDar2ObH3kk0qSwkp(UY3}uSE(3@pw#GB$P zv`^4~@NM&FJ2%yrv|dzrSrG=n+ctN-;CS|5A^MkNH9|!K6{N%c1ztRw3&zx)=$8xO z1zCT~>Z`J}An2}3BPmZ3O>5+WSU&NPBJ59=%^6TiC*@>xK2Y) ze~v>(^W=(?-B(riq4Kd}srY{`+qg8E652XM{axAffH!XI7|K}P*Q(D)6#dy~T!X-T zPi0CR?8z}W9Ar^uPaNf-T7537ugWQH4Seb~8+hZoB`8Evs_m=dTEe@|T*;rGzn-pS ztZuR*qfkO+_r$DEX!&EqS&tWbavU8jPSKa7z9RS9zJBmIuXESs+g4;FJ?=WgOR^4Q zHn?)56jk-++jgg(vBmt6DsK^CRKYfz5B$`T7LTsh_^hi#B~+xYqqyfdct$y+qlv3` zoW*B<{xsj+cZi(l&uaF{L?}Ukb7^Co|F(Gz@7=tHj)Yr(WKo6{62>gfjsPXkFpw@X zkSeTyJ>U5(WgC8o=YX?&N%cD4F@p@OOAWg zMirw<+_5=-MF;<5>sl^a+fB^2>X$4au>6jb_7(#7YB(JJoyi5UipgZbepJ5XSl}cEvva;Wd}FxeUTp>=;hhLECnwR+8HN(AM$`D(3Xg?vAdbePg~BL zPFc$GruZm{)HN(SI6u=IXL-KqK)OgOU8FQceU2)55$?w5-zNsUezK5S)1yHBU)l47 zunO;oKYFD1H@+nwKzJ9>4dGMACP!5}I6x6-^1w>}qD)@-{XvX<=zYP}N#*sne;U z!SJG3V$v27@O=#?kPQ{d=0n1q^bNeI=s#n;uU)!z`GM*mbN!({ZRQ%|-aS1{rIK^0 zZ-doZjhTo@1ncSM1rZx}B6jFfx| zAz?H)HjS=L(zS8IF#&b$eoTZKw55aMReyrNVtp{Jjo^1=^B(;}#jwvvCwnYP0rcMm zz8Fh&-L+$fEZF9;O0j5ROo1I6mkz7ycYnC2e~)GK_XXYwEQe$H_)OL#SM+IVbm(k} zk&HV*y_Oy5Ei5!9Rv7Ijbwp@OIJ75@{SHOLp=U~I0rA8*gz^LBDvW&5XCPf-X!uxA zbMmk^eID55TmC;^cJ{Jo=KrAU3yXv?4Z?uv-Wwl${?D6Rn(o8+?-!NV0u90Tz>FOj zDlwe(X>D?7Z;6w1>O(}Q5@`6J>XdiY2pTA&sT-qE^cYGPNM%YCN@nWtw31P{8%w^N zXwLj($GU~vk{%@%3F9~jCs5sd$K(Bv8sA(c!haSx9SJ54iv;PnzQH1ytWR6aW4RTh zetK3HQHC!LeHp_*CQB}VELJ&1UB%<5{u91_@6v5c4$t>-)-&p}!l({$$)?VO$-%Cx z5q&q7Tx;OPiJ!?AeU7GmvYrcuI;)F*c|#QP#-S&zqe0Ed&;yEm&Qf{LPq%bkvq%<` zv1nnO0Kyd7BR|-C^r=|M`k|`%J>d0%v_Tl(5DVXqgCUsTDJ;@*EurDeWgmPyK21@b z_JQ1C;OoO9*$3-&u4z4Bkuc_fx173m$rd0T`XJl8xx9+)QTgT8;U$uy1SR{-JaK*W;{lN9N zJlc1^D_pE1?^f7u+(hHVo@ey|StO46fR^3C2`-`U#8I(=l5Uj;jKy`f@$P!l*7_ZO zTyIz;j0o_itzCzJf4=3>zB_H(z1S{fKA>WqGwFki#8F+CV;0?1P)Ms~|5#LR5DNdc z^Xx^UI8iKKvJvCq_nzafZCv{W3-A5M{je3rI2O-BWzaEJ#SAFMnje1tw2R-p{rBJV zvS<{m1{T9{5o2|3$vTR~^Jev76JF?x8I`#qwAj>VR_o`c)2r6}`>u6WKdzTB{sUYC VKGMoF;Bx=~002ovPDHLkV1h}vJpBLw diff --git a/cluster-config/docs/img/argocd.png b/cluster-config/docs/img/argocd.png deleted file mode 100644 index e309bbba365f3ecc8febc76a28ea760b2c1e4607..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 222670 zcmZU)1yqz>_dX0FAV{c4r+}bzN`umkbeELG&?y6ml(c|!i~`afLwDz(G(!(CbPqKH z{O9@Bdf&(Q_uXsOV$BTqK6Ccj``XuzJMz7{0wF#XJ_ZH`p^~Dk76t}R2?hq1$0Ho{ zC%>tbTF`$UdPpnjJVIZhDWZ&udX6-N80coa}E>2cP4;`jkIET~@NiV-( zQu91fmgXtweZugQ`HA!=20v+O=}#Rp4=&XnykM@Q_+a#*nGi>n7u?m~Hkbl1Y*Q(n z2B*XOlpV{xr#CHDZ%$9_yluy`L~5CkVO)1`3ORr8IXHJ4#iRf)K}h^FD7cy<`u!`} zSI-$K2%Zt(yng-q`bPu{_)gY94cx`0(# zZ}T%sZXpW60BBkPC0?ndGUR{cXs$kFOqM^eRQE^xjtGF#X&I&<5+1M1{&h+2s|t%Q znfni7$%aYN_XjW>3Ix$YqW@ZE5SKM^!?R5G=GB1@uszQB>0j5ih1{1C;!hdvR`p?X z%DjJl^YnVPue|8y6(BfmLiw-tWF>uhNp+uyshPFn|00I@{e6o_pfFSlHOrR07?~DX zOmS#UFo}s{fJuMV`cOhG&3ijdPbc#4A9m6;?^f6nm4D|v_MIS0q{lTs--?;VN|@v` zxITBGmZ{}{3fg^&tTL7erE+|vllpE#=p*d!1ruNq{L5YAq>2H{1D)yF8q&+JMyFJr zpxu0&(gp_M9}b_i!5AP3!+Q zYNdV99vJ_>lIYQr?y3lrdfoWlY>B$~I35&`L-RdYrv1a;4U#f`#O4Jgg^rqN*>d#j z*Q8qXb#+mJ|I*G^;9H!RMSRb+6{)1CnRxL!dg5)uExwhc5lnXW7fc_ocSrhfFpq9{ z0+9_wGn{{KVgu_5i4JA>Q$tuW3|x9<>p-TIwDlo<)#s{PSLc>1Z#Tn|>fzWEy}|xu z(*`A!;*=37X@S^7}S}c zdo-l`pFERS?+^0TuPorCQO!vqb8v8=6m;+Xajvhw(rJEog8>pg6WAKh={l5<%P%a{ z`UVnub&EBSuko+dB@hogwnR7W{M0SG`eT>&2KaHRDVZ8v+fc(&16p<2bfpO9vDemFM_y#7j5)n!kzmmuH^r&7i+3Iyuq}V^LLN$iRF&mhE*#yK<71|hTu1#5J zU|nS!2MzbD88_bNh^2|ztbay2I$s=bOhR~_M?d~^GMp<&Jncf&4SgwOUjR9k4>CEFUd4&yqt~&-jY0SLZBvdD=O`s*DkqRF*_%Z4%dg1diaMW zF7N2jr$8%MG3!l!*1sHrktOIwlR66O4{>p_)%O!z5l3z)zV||Eb9-E}Q@ducqz^@+ zO8vxq$_*iHvmBdc#W0LH1CwD|?smBnvEW&kwm8f5odn+7>tw>t-#>QSXWyLMvg%n` z@QAa=qW5!mv%pdz6+kCt>TOHEVq%~wr#o=#JGo7X7s*UO8B9zMro59*OiCPtjQy;u zi7Hvx{x%#oCKy@Iq4u$xN3DwBhXfCwE3?M3oD zYKze4P}4#Wi|1||^P6PlYbj^LUp-M1V+7qd-QA+q4VhM98aVO?kTgiPXPBD+$!4=f z8=y$3S{ossj+$U>t8kBdaxO+8!F07gg{ysYz0+h|{geL74n_6d->pC9;qaN{(rY9+ zR}>U9OTSupZ>D0a#mEgro;}~P{j-gz-XB+Jv^$XJ$`*>HWI98lB+}oG3ivG@u*PIY zhQ)4HVYrHBt5OI?h1(L73JU(thQ4Wdne1UH%{2ZL<`$C`YIWtiEzkyHdLjCaDi+i- zhGqR^{~C|rkuZvah}G7?d-0@!dNis8ZVtqb=-J5q1={GFc0561C3plip3wzfXG)z+ zn%@PhaNRSm+}=ToN{E7lAd(&7)EzgbbU^EuBbBYedoImkoW?%AZ3CdYOG!G@YftNa zVsR9AMdJ-iin$+F(DfeH!;rNjxS~B}!`*SJ32@%a#Q#>v&ka$E0fcQqg?)=cg_b`> z90lIn@di9V?Va2oH|@0#pR&8GUizTYQ^>fVNu|h}gbg`=v#Zvw+Ha4ZEw%P53t`nc^6&L{{dwctUfEUe5lx>91xI zU*|ou9RDDV#XG9ja$l@>;RS{7(=zeieoD-QatUWsr;f(!_#=|>WOdcO8U(fZ-SVx` z@s`n0JJ6YkC_+g|&gs3I+6TfjlkzmbFbXcAaQhF;jl5_0c?*=`!E1bC`!Xp{*P*tr zi9QALK&$ZP-#r`1!3d}1Ka9Jirl;EaYe-%bfqbK%T{Al0(`VM7QB9J{uxPc z&~<;id6X5nJH#P!@ciy%!fNsIGU&lE!sY(kEiTdNCUr%@4~th)H#;sO?}1;>#zl;5 zeJ%_O`_7xzs|&A|Xnpv7E(lTrZ)o%+kk1-!uVyg>{KcK-n?uY|TN+v3yF=D?cBgQE zdJFhr8_g@p-iCH0Q-AF1jZ*XWI0^qtkCAdI%DN-Hf1x0sHTeBkR-prnh2x*-qXPa( zS}gOmbBv!gOi>GIApM;G&@T00S9}@#rXn!b#n|}QY*x3W<^XqwSh7qPQEA8 zPD(~$ViwX1DGBqrs^U|DvNR2E%2b~s| zAeaiql#sybu@rqFxI)tXkX-7TPGsJYfPD~VywaA9pkB6F4|OwLKHIr(?HqaxKkIX> z#OT~~Uq8D>rzxPjZLy6F>oxZ#9)gf*?vC;009;`>NukHe3cY3Tv1L}1wVNs^UgFMW z3zFS8+i@y~VPqVD+N>m&*Hs8u%V2NZ|MP29*b@K9$u~X(S7mT)h~;_Bt5<_oYhOfS zXtfpPl{tRdAXA{;X#GFoqe1-Q0mNy(CmMRe%gCM$;m#OKRR?K&sfBN5tw;WI z)Y1dD-r<%O)I=st*bnjKONwjw|KNp7Pk9=p;;%+W)(b;#s!QT6HsYOCx;V-*{-j-m zTZSSJp0i}zO`QoC&Uu;>+EA|zvnlA&{k$1&1fWlPcNs~K^W$fAf-a<8mf^|jfzKOF zL*2277fm{|Q}XrnLM$fl^d{GQzp&HH#L`kr>g$?9ZQk2J-;gHjW;JbmZ2q(~4T=RW zw>5l~S~(?FjZjikyD|-x{^<xU|-x z*k$oeq_)uG0L~4gCzk9F2nq`I^RRQft=ISVm-_4Yx~Aw3IkF`vKR<@6+V+VV`+45# z1-f?aXabG`ZDclTp*yR&P1@IfSqxiy@#56i;w(bZE1Xgh*j5VXjzDL-MkDqoHO&C> zM`6C`$SiMT$K!K;d|W%4(+$$=7%Odw7O@(hlU#w?X9%m21o3!Bz6>%B{I(rc&Vt&ZadwqTKD+bv#u3<#2cuqf zRlMK-z$j!Mx>^&4VYLO6w4WidTCer4aBr47>aq0**Xj`S@L5-c?#R&a=vOLff7j%c z6sk#c|ElkFa1*f}9yH^OEE!yAIl>6+0HIJnQM(O3r%mi!nUDm_8d6?x+A!Kv6lnb^rcH}X;ba@t==>lsClKL_q zZ>|3qCUTc#h__Y&=rKSyJu(=fWv&;l@C*d-2&J9JmOzJE?^ETX_%dRdn3O@&aAT*w z#&dUi{g{V9QN=SUJxllp@0MM7(2=>`imau&?S`+L7cI9lbO4X(RM-#o%4`uFPZghv zevt&a>Tg^#(DWl%i}(map3d*k6g%ek(K9sloQL6-bT{=5mYp}w-g;k)WS#6Go34M8 zKQh$Y@Go;Xcg=54STo#F9ffSpoN2(eJjmVpB-s4`KD^vVa}be9)^oqIHf7R&^^Eap zAz-xj)>!2Cm%n}$th$T7t}KbOm+D!2Ikf%UY@Y1OsF|R+`2$AbJYkyyHJ=Penn?7X z^R-B=hS8rwyyJ z^ByZCf`kPAK-w;)RDa)nIJ}0+2xqHrjit{Y1ZbE7pE;WQC&gxht4@|Ufr!k8n$sa& zUvbVku$s0uKW-H9NsH7XAx-u;?~50~HK+Jd7vuxyep{5$ew))mhRB7?{l)rJTzbQy z?e2sadZA`$b(xL~d0PNbSxZrn=8p@g&l zsm+CM=wqb?_MWZhMA70SaP=JQ&NJgn`GP0=rDp{i3{Pr&x63&btiXV?iOjWIkAnDk z|E17Yn)XjK(&(gaVpXD9Z<@V@$aVaPe)SU4@l+&b)sx3xM-oGKjPsVt4xJ>xOIUh% z3{H0-JZ|0A?o_)5wVQ-aP!@hpLiC;>NAXR8DYb&9od*LrAD&Bgdpw|W8z48d8VTJ= zV&UZrqUceG-C7bdj}wbsdt3JD;-!|hw(w4`pXLBW@=V~canB6wM0nr%l9lxYO%66( zhn~8-*EAmZuf#ZXc);oCZf7SONuFI@%y#rn{A{A(ip+jiy)^55^I&?qe(^l^2(xN? z1A7q_ORc1&wAEZHHL^l)(nX>nHKN2ij{RdpkrIR4%$2L70|r@io%AudU9{2+SoZ7@ zoSK?Cxeq+{aDv*R8hKIs7e^OYv;j9scC`Q`*WC(npgOvq$Ic&O+;N6zoYwy(CWTNB{k|M1WxyGLqyF21s5I>ZZzxj3%{5rtVO%xh#UZv z0$^iGEAx}thmo_q+-<>l;~B$t?W5~XqTsbEHw+QtDUJyv$(DprX_b`O(c@#YWT!_XCEP zA|ktzsT^V;jT{e_uJ=3zkc|!IKt%1)iX5j&;(r!7)6Y1 zscz0fDy+~U5=p9KQ^oL3Wt@Rc? z*|=XU&3^kMBiDT;v;W9%IzsqhrkQ*j(clsf>0TVIXx>ZFth0*<7&>Kl1#|9B)5&`+ zn)!@C(s;aB>SGZo=RS!!@E9IRzxM2$ti6qm4$>Z+N*|`|M#U2Mv&VH~>nVpssIETY zT;re4wJ1VCCuskyMKHF!G^4FLot_7iw+GgXk##Nwy2=cDw}DwVe^{74FPjSm=a|}J z;G~T~iX6ie1`2}pOC%mn$a8Y?%e|4^@=72~Z;pz3q6I>Y`LBBy|r6?or-HyIJ;`b|mh9}Oy7uC1ijMO->QDrJAyAt|l^eUpO z5mki&9q8(y7{;Uk-opo)2kLbh*I-?xe!meV5rjC6y#l-Em+4IbNd!jwn9I8iQc^v` zl-Q20ei0`E%G3b7+3m=L9k?{2-gg-oSt-@>MMtccKW?-UwpXH6(r|z?nX9edyB7ev(3Y?OezPjxPuaW`eqIBho)mD~+Dh^oYbb7k>tA_0^^S^vivK*& zKRWmVInuB;IM@#cl!4o6)93TEeO_M$nB4v$apF%B{@B=3RZ_W@^dv6Rnq5pk`45>Rg8}W#x(eWggUpl~W?S-f=b@Dn^rU z>PtFjfemHLlD5DlsHtefR*-*#5kXAP;xqV!tLa?J$jFF?AnE+El!ElK>v%oY`f^9h z`|`6!xxd#6A;&9eHbxfbUBK3qUo*J}(wRLg9Pj#=39V{sN;gNXlh=X4r;)Xge)t*Y z>L@*?vydLcA_x$i@I9v1LUw~r>gIR+$B!RZiwkqscM3sqG#V8Ak<}^OhgZ#yr$wbe z|LXngSKzVg_NV3!-!=6C`};*ayo6g>X!m{`wMTVa+vKE|wx2cdIAOSuLK{F~*R zo_~aea5hEUAV;VPq6uP&E{&z9b4Vhl@aOSI))VcI_%iJJL&D= zo}ziuY@aPQpYG3)jfR5TX)OFD9y+q;Ef5Zk#o`xN0UqF9x_7$zNT_#K#mChb!k_%* zLJ7oic(QB>H#LBd&Wv4~%)bxNR%GUr@0MSY6CQNe1f_l>iLkipj{_eMKJ2m7_87RV z77aDY7VJ26`SL5mw`+9Y-6WipR@Q4;{jc*yw{6-=iawp3;0o*1WnO}hI;*+|G9@^# zLf)Nvcyv$hV)}@keVjjL^SZnz2CtBNF^wGMZQTb(1r5kQS>;r5BL6CO+i%c=e{GqR4$7&uQV5?j`QUX(jURN7UcAkN`{jFQ|!To8pKZ zIEuYgH-8xEjBX%M;PiwOy>;7@Mz{Ws>)uu zi$BMI`sm>!oREhPFdqbC^!4?HoNoTzgi^d0`3YCfyEqGu>SV+=yN_C{Olfgj$_vY3Ac-YmN)BS|VC@%q%gBoiO&!g#NtLN(dPx-1%-f)_6Bh=J* z4@v>7>J5>TOATEV;lVvNtFChNF2^D~1pKz*2?5lLde6FUls^Iv-BEuVqdV&BXxA+7 z)Q-E2s&g@QcJrO2dV3hUz2KWL7x0ichHULnNGbv z4Wf=vkFK8xTd8WvV!%ZoAhNzZs;>CJM=Ld?dhBXea3QW@z=oRH0Po@6aCHEuMBM-B z^=Ojn(iV>FInc9*R&EE3J`v`yTfE>*GjL-|%K&1U=%X+^2ET5TM80OuK^Q*3hQWwx zmc9GwiE%2vJ%%3jG`Oh5!^r>k1DL`Tl`d^h_90l$O0a9e-9)6PD)vdrd=u>zuj0OE ztik|(oh=_XnM8mg|fIaqQ^`f8n`h&6deL2Jn)m`80DawL2Ad5lww`u7zN+zyE z6`D!Ho{gc!lLfqtFYgxg5CBIVxtoDbO4oG(lRCONoaHUESmVDvE{>jM0{(3n3{dTC z2%^^0rp5ayOOrzBCHWSGUl7f*aoo38X@?5M<7nAt+#1gu2#q8WvHPlIo6BC%27pc( z+v+H8J`#0X&qW+_p$iOV@&8AB!$fyr(vF)WnEP_H(m@9cdhHgbtSi+d<>kFc|A>=h}nETPAu~w=dxj$0IJHr zF`7myYoa5nB+pX!>&z0hYix$9wAl;qiQMV6STO{BXyJVeyxY&Dy(1A+u{0E>9ey$$ zM#3|8bxB-b)KBw{Q+9*4-rOvk>q}{F=Y3d|B0v{ga zRY>tcCy`O; z7cz=aEcOUW`xQyCAD9*m*g7w$*(n}~0U7576kjhW0y=YV-(b=Hk6wYtSp&I~_V#$p zqN=K?SR*ynA!K?Cp`=v|7KjpJrmo&KPYZ0zcj1}v(zbyQMSpwxDJCy&n*wwzI`0qD zG%!Yw~z+ikK~{@6kO zy&*~E4{Rj_JztF`(dvn0iBa}+*V1FmOEd|UUj69kF-O8E^gD9xQG;N%{Dw(O+@5l> zAkLsV0r6PBt!GViX?S6EdwX)C-eZlysHPwvWH#u3df)%wi~y}nPWyg?(JCLIRyGSn z=aX;y9};_yL6Wb)i-$0c+u3bmxto$>943%?rTu1PjV)g`i}Pgu%jZr5ed>0mXsLFc}=>^CK~%Yn^qGo2Gs{UQteOhQN^m z!G~NVK(YkVV)1vS=9fo@s2~*&mB&yY^6CJMr_)}9zDBLSt!58`SAzfq^ekMdN#FCC zwGxvC$A&Ey@=vmO>}g&rDGi*rf6};@pq~;W`!DPyz>-M1_udl9qZu$jn}_C+Az01E z(O)iEt)Bb24+G|7qYyHCE)ti)?ixU6CrKS6Z12+dYk8Sy$^{wy2ShVse?cEOdW6t? z_UK_Tv4G~vTyMguGI)RSap#6xo`~Z~q$-7k!~3Jc%k!1XmB4|2EhuD7(S~!{E0($0 zG@topVs?(Qdm=J~Zbm`6F}H+sidW6!y);`7&&T5ktk>p)EEd!Wkg?z^M;&ay$NGht z7W{>|(8`mCxOU>%?B#J`>xo)-wKswnr1X-umsi3Ix;mp3xgYxD>4pj+qRGFR!U>C{ z+6rM1iw>**>^&jACdJ|_YrGDOQ0~56V&1aGNtR2A2$$L+)3>8NJ+9-a&}Yi@;!%it z4>kUYwUQub_Kl)@8V7ZbN)5j^9%vcgkPQ9%4fM{BU}}>LLhQ5=_UMA&y1o5@#|kY{ zSPz};KzCWK4fB76+J&6nbR+31iQ{J#YyepHua#m3M_vqNyN>psx;?2VqUwE86ab}o zbdPbvNgc$43R$M9!}Gdos^g%ZB*4|eeB27qH7KWLD>3@w-7#QksF&)fM+oK=yF89h zE`1cXt{*ehdB83?njK``l{_NZw{M?xGaa!!c>>^BuKo{@4k|1qDU>uhy4Wvz6j)XP zH=a1pn}kB5I2T`{qm8B$+nSyB)TDHm?LUVp|{ zId$hl1_1P1%LCc=sEQmvI*+`vn92X0W*YiIjgGs8=sQn|#Ul|)w;Az7Gv2jrPhYnN z@B48fu&z2b$D?o;nItLMsvh$gTEe?QyAGS*3n?G2MISaEkm`nrw0B)Bh#k4#TWPSP zuDBoJ$e^q?I}DK*{gURTm*;Cd-+Va!V?C#C6HSRFXHDPK7Qf+l56E~!0tjT`$|Z5q zdW}cHp*l;5mC8G(Or~VPeew6wY605J`46^t)WL+fDy2nb0E#KzfUGpvb6m#5neCP9 z9Yg2Ne(Jho?4GW-9usl+C1&iG@{+jac~YqIcbO?*wlX*S@ptqq7DmVmdAcBP!U0$L zcRRh{wIR6qT5N2le?aW=WQ0o4zncE4XdcE99S|{GR77bop`)cKBa>wJO&)Rb%rMX4 z2b38%M$wyBgekZ-{3SojbfnP7Gvy}oLZ;RWU5`%2-rpq!gwvAZ@1maK+9buHbhJ3XA4j84E@Ci*R@7A4uKKg*1D4N~dme3r8*?OVo?s&#*cXYhWD&;lB1 zBEl7$DKz6cwwKJ@BB~CvgLzX3;BxGP?QcKPm>0sSIdlcR7VqaK2lACwKCwQp@m)R9 z1)e?DPfX3EZTLrl#xDOVaBx6POX!_qVo$GS=xlD3(5-ncrR0h>J(gvLDS52$!i+y3 zLEcJ7!$HM;`>WCl>bh_E3>5g9n%a=6pEstq=Catjyrc@*J}n~Vli;eU30Z@z)ZRJ{ zA(=&%9XukMxiaC2UKp-%qb<<)UG=3yfJJ9TI0kw*l*zm65PvFrym=F0wy+lRtv?i1 z#TQ|7^Q-W&VLc*0js>#p-LtFp9Qx0s_kO{8pbmJryQ-gYfcOcD%DMIQPa_O- z>0h9u7a9qNKd5$8dMT!wLImmJAqW(6q&b=uQkeFj=*%k9A?UH#Ii}%&7W~qtS0dv7 z6BM**`wI(w13IRv+fs#F@;F;d<^+by7TC+)(0|nfflhaCFfS(!)nrJpWomE&!W-iG z?BG}uztSYKD^I&%5k|hKAGnh|JTb@82K==oSG(T{$OzS#t)b$6uf+9XnaSlQqAba; z)A4{VpU6r_T7f%bY$&}(li~jU!*9Zbp1_ck9!(Ri;r8_&tV0Eyfy3MnM9C@q4hDf! zCtbc8LrRfo#Qr_E-vyVV@>QeYkDB^!y$l6AzP(jB@dpPD zD7=zSZ1sBwev_XyUlVO@vhcC820t&11VpeG=e)MJ)R)2doV&#!K+8%7s=6w6P0x~|jn%~4PY@pQ-UP9uC=fsOa!^zG4 zqq$AM9J{_jD@mB6nIf@$kKu_@%(xgM;MZ)DqopnYYsg(lR=|SN^EirvAG;m-rGJA_ zT`@S)7`z{Etchqbgr#LC4+||X4csggq&aGgs>9+$V1AVq>6t?0{|qr6j8=~xux#uq zB@L+jUUTOV1Lry{4g&uqCe8U5#jwOTKmsxW(+2ifkD8pI1r^mzE3=pR({TE_9}WS2 zg0bxwpjR9e-|ylSO!agKJsqi8`f{G&8XFn-O-uri60z?BPXhx|;g%M#9TX7j_wHG> z)lo1ef;VVJKwZq9jxcttji|)EmVZc5Wpg6I{Xv(-#?_$ZwLwZBI&Pysr_}rwQP>x4 zLwh^$tDpk2K`c05R;VumJ(mJk1xcT*X*ulm47tgFVrw!?r{OB^q<_>)JFrNp{kpWQ zpstl~7cI<>xzXgUFuGLLsxvdyA4A`*5>bDH($SfIf*fsRf4L<6wTydFNpW8FJc&I&vsg6x&I@|cXLu%r zJr?JKme%>dv}Pv;eSt`%fx-IBiK;a zAFA^t2fwQ6SMpSTZ(x|tle;Aw50$;oUrJK+%qs&2pypk|D~>@Dt$P^$yBU%?@21cC ze(CrbH#rQ?nbjZF2pzQ0|n^EDn))Yz=~1+TF|I@1N78e*hmiG#vC zY>#_Z?#vf?V`x$aP9KkV!7n|aE_Xt^i@!jUtZcm)uPRH{)&}%7HBG5~oN~yx20lu4`@w?P`@0jH`3YE%j~UYzV8zt?PY)M$N1OZl-(7OHMngS5%V zH(UA1ym>YU1%0} zbQCZDr4a3aRj%U%&bQMbG!wA4$@dsL{k1_n78_a<5%>M9fmGwqdaP7K>Ezm~ihkJa zr<-f~qhCLFw(kWeCdFvbzoV2(Qfe2-^L)L&;mrwZL8v+4P!Ow3I&|)D$DLksX##Zf zKlk!)Tk@c%w<&MG3Zq)0lw{6q-H)MzQsOYP2DTR78V59Hnbs5D5|`kV=I;6~cn7uz z`vyIcP7W6KS~Ec-U-aqlE*BJa6LeHK?Nc}0cSOu%Ir<7i{`p3=-Tk|M(zu5|Tzjh& zTb^S3eb>|R(pD2B#PE@R5XOX$1|l-A_STw=4)MBYJv{@zfD+@p!Sj8`u1? z%EKFK$qvx|s3(`my_2N>njdO?9QpC0?))V4YrV%xu;SO>pi6;VhIl{zLQS-7OAwdG zl-Op7T5`-AQaUZxgw$$?;YIZPwvkHTu?L=x_U$kDe-4r)CBjV2_F;i%1@g6A(5_zB zySOiHjtJWy5|{<}lc0T5Jwq&MNv@AZ*pvBLC}|u;eo)iJ?#%KI&1TbV9yE6K?`GMed#{4 z9+p-85i>$%L`2JM{=kENM<;BSo_6KGH1(@uP-t1ZzWB?REHohr1Ua{aW8(g+j}Vel zF#gF#i~UE5roW#~>?yDr>KjEu*H*Qy!nOZwbO{io#Ec$!Nf952cW&%^Zf(+Xe)6pl zHaV{5kxFH~pk0?js$ev_Kqb{F--HfHJOtVfWM8=Ae#Q5fEJM;ZWP>U@*h(F5fU%Qn z44i^5PYVM+3HI>h#<4d0=lmJn18lBq}h0gyTb*7vAKgwf7cygrA~FX~*EDWm@x8)#B6bAFSjKm>~=%oOp=Cl~?G>jS^W8iSLP<`L#M z|5%isW?u@ef7&dWxc5}1&-NMeq|Udvq!<=f@A6>Hp*APSpNBwx?&W`(x#jHAQ3PSP zuEdg=%lYDff}uIS5h^%OBl1?l zq;6N2O;ok=3VwNc95(GzTMG`BQKPHyJK=0^_GY?wew_RX3ZXqZum&i}P2JKjX^-al zN1cR8@9!TkitSMqUtasu1nFd5ywjJY-HR&mCDjX<7U|qZPcxvz=iRzP&@{yv*^fvF z7y&oIeRk(~_-CDadx-F!E+X`e2GP0{VJ)^zRb%jin^^3>^s zo;8LbMIy-#`VOhUu$kj8KQThI)UYR})|SrU5&&QjE;5R^+TYx5v?+_ zpr6>Bt;BIYs48?)BSS$?UNm!gr7Pza*AH=^mhcABRuh+5(H_&sI=;4XUF#b(kdx-s zq1SQu2F_{Ni){xQ@6iw^@pAqMeI8(wtgATy^7U3rg{0X(#XVpgSB7!0*i+t)54$Dswdl1<+HGcM+<8u-qfStg(4}wKGYwz z_Ap)WDT=`h>rqs7MbkS)KQ9T+@^-pPeuBXvRccq3-$~7S^bKuI=_9PMTgb-+SQD#f zwfj<)r_qGaE7;Ci@v(1{q(Z}RGG|s24GbD~TQyLnl+KE?7>mnHYC4jHM z!$^|2f`|c`B7rpHuSA77dAY;TX!_1^t)wLX>2U!9t;A+?3}^WAtx0NS2j|(l*Xgk z$f>)>T>TLSI*48FB6pMqTuY>miqVtG%{MsDo|z8Xh>@Uh+sGeW(Gl3Q4pKgjI!f>t1kD>Ly@HpHlw3vUx-F~B|Dn+O^ zCf;#Dn37W)8f%;@Q*%+$TG9UmlC`7Fqn5-eb}=zG71J<1fJ)cS`%<#p+5<8Fgy~OA z!}$Ba*1(L*i!jz{uC+}cBJutfkKtc7@33WCcygMUz65Tv8ozReK*p7A)QAJl^^KID z)w0CzfX6~Lu?IGm+Y&YoZv_H_ExxwlsxVnjqd(o3(3!C^NZ#m<$RjdNUXiYG&dIxPJ3Ud zVSLGBn-z#}@2^*L_?Gy9%H83n(o#AVcGxiH5fk+h)3=OXF{&(=8 zW+CVI+Q7!|Xu!3&s2f68*uLxQR99Z{6oSO#(dcg~!-OW&ytBUw3wZoc6koa+qRB?% zXr!!ue<}Kb-`$l4=t0vN?*sO@;+f)N!osm%o5`(LyT(q`y@DMkw0DVU1h~CQ$z%*R zZ7CPKJY9vA=EkYfNrgLdw|qk!wL@U0Iy~54-p#bO=cLZI^)z-T0C&s!fOmg1&X67A zZ@mB#7>+Y-V^fh<^ECi+-Fh!Kq@M?jY)ci?U2`_R+WC_y0fq*#&uR9Uggu>~)9$q~ zSCj0xaN;VolfQ4w@ypdHrt{}iD%M(41*i-#kFW(={H;Dg-y1Nz!!@yoZ3 zalfTP|AX#~^emiRPc-O?s{FUMZiJzkVm*dxZ>RMINi!t#8P(z=tJLUm+V!kZ10;MN!1emV8C2uUrDs~0}U)Pi>9Md$etiLcL|`j5*a z9y3967mz>0dim_XVcqR)Bf;TtfjY>WW0J=}(*03`6IZug-yQLR^W@erNk`3BNZm)X_=jFv0PSpmn=R$lsiO~2I@x+SZXlTvV0{VtM=Mx?1 zep}iFO}Zt|c04Eq#X%u2ZT1&iqz(}g$|HsuNqsdMIYT3RGbA+}>KWu*Kg)|s4$pj* z*-H%2d?c&c)p^4}Mw|Z#0PTycE!5W4)=)CU*6xqDoH~A>*FlDq+#1UYw}GP8H7@_m zJtrDe?ODZLY0N>>JMo9PW!Rz3ldgxB*s7*3VNc9s!uFwj)qe~I|*r!Ubd7T?DIh>E+ItAsa~6+JLG zu8(MXxuXHx8sLWE#x$9)-+|)SL8(jKCDT5qdD9qnRr$ADrspt8z-yIfGskDR7YPzJ zZ1dB|S0$$dfR)A4z$NQVvTxZ`0gJU;>Vb7EHw(VA#J$I;pJ-PRUk$`5Y5TKPIven2 zYtc?JKz-`&vEz#MSTo{nV~N8;ubU?1y=PVEJgaI!V?O%nI8Aii&&V88sg$eysbglS z=BG<|W~**9=Jrg75JFFdXhKKtvKp$?$*z487JfIU7slTE1>lO{{W4WswM7&k+YmKSKGztxlfv@r*R zl(9U=ce^u;b`z$#y2Ui}_a`ZZE_;a;PIiqJlf0HhCuL~z|EcrR=Wq>O&l(z5wfhm* z=ixJRLi=w+{XEr@B8H1%_%KA_<~b1YT(615wek1o0u%?vn9nSWW?r!EtQmMN31z#M&Crf?BU8&u3kmY zQ1-Gf)?T(C(i`S;%vdrPp^UOFz)7DSCIx@vBnxc~T>{zA!Fi^OC}67)v!1@jIyF&t=4 z%oBL7I4)+zE7up{d$H+-wW|_$^Cvl##|G#d+>TDgR#2;%=#)6LL+V1nj?-)~(xV`0 zRrH2@u!iG}%gR`g*(Xws=m!0OW)hP|6E5+b6t0l+V0U2}biwq`;(A{V&P9+YL5dY( z@vnq;aA4Z}GSzM6?z9nJL9gGb8|KFm=;x6-+Y#8$K__m|B_UVc_ZVX~b`1X5>hX<4 zdrgVxaLL|!4m(AnT%bD3(Lq#4owCdG4O>DZimB}rEzic7b~4|ltT;sj(i)B^qGZ_P zhiL}F1U|%Fs^&nz0gjn4#l3`t`{C=+v5}vL_q9Io6HVRA`vG(Q^nG?b=5L{IKR=wu zmVJj!?poZq_CSlXk%7%K_`wqoPi_iAuu~z_fqxTF~02VZ6uQ4d_fMkRR?+wQ_V9bQ<5XbO&z? z!aQ0cu8Iv>zUnA*pLS`Nl9JVe9HyyC8kB?ionfm9Rw&0Vq+PkjdR7YeYu>Ka`5rY0(5gF`bn;4jLN{{bqBGc7&)VZcGa)w3lP-Wh!E*ElH76dkd zYM1VI@E;Q~Hz{zW&tn^?!_KUur{&RMz*Nkqd*CB;v4YUPH?E}A@v`9gX+4us+2rfa z_@-G?^{_r=`||Yd9~i*coLj|5gtpfQvs&+ULptIU9tBBNnAAk6-vt&=d#FwkmJ3T{Yvf4X*B1(-jb#`wmwz|4mc4 z^hnl4v0`Tv@lSc(6-=JvgapI655_7I@#87u2|8E5J|V!t^68bc^bsy{n2`Sw|9ko_ zeRpxFX-cu@H6lhHOY`YZ3Id!@K1a$nx?}bY00AnK0}y9dFs4Z&g~sy92lemY8w^%9 ztn!Uh6-5<7o6Yzs2(GTO+AtQ0H_uDBnpo9CwDe84UX(X+eGQ750-m99WD@q zgC&oplU9ye|D)2#2UaomsdW2MV%ePi;*1@<(cTx}qgS;XBqYdn$)^VDd8&H!6w6}e z4Iew&V3v~orYd(^a;B($PyjEN;tzoFm95sQV2U^&-gmckI30ACG2N0mQ#HAUn#i_SRUz zLqqF9!+DI&Y-Cc}0TGUDI0@;T??O9x_30`9gs-|{1ngC*HfGJ0=(KTD-pPq%syiA2 zI=`2qvXBbPTihOhcJ4EM3~M|o?=xtIw?rzdN}kj7zo=+l9*=LhP=c3J`kY2U#+D%~ zviIW!Eza#ZgI{Yi&0ZB&YWq?&thlNrZGKXxHCKTc{5$kwM7H7h!McGfCNkPt=p7qI z&rhtKIOHKHDn6bVC!{O+=XprO-JP(5qlEb-VS#bJl-xjc)!dT#WuHZLR`yvl0Pu#I zC;}_G?@Ql@E~htE)dqv3qvGsBM+VN4+-(RtFph`s@bwzZ%KD-XcYC?~`v0-@)?sZo zLE9*l0>w*<6ff@X#ai6m-6;eQ?i48Q?!_tYuEo8$28ZAlT)*@?*ZV&0Ip?qBO7h#x z&hF06-gD3FrK&(tRB8R+GJK*Uw^t7ksj%t!nAqdrtt_SQ699eZAP=>Y4Hh~#3l%F* zdDRx}dX|~3z8no|u&Dn(O}ytR8eqqd1XF4{2{yX4f=pg?n+|GZU~l(20oBVBV;ljS zLti;q&gTg5IIZnVqbGp}n&aDe|2Zj=118^8@YKZffI}tUyECKOe3{rw4)mNC3!I`N z47=lYW@geR7TsTe3wY&zwz@1Sf8?+7KhAj4d1#rzaD<6cv1^6iHc*q}5FM9R=@3EF_iuD6Jk)*4v&-#}L@jUvx z17V}ag>o6vuWQF+7X}IZAKQ@c(PJ~%yq>L4V2rOG3#=bu@nvb zd;aBnLk5dWFjSihCxI{sjZdG53RY}uOO5ke#+m?XI69!rUAMX7> zg?8!~HGY(AIJy6SK2~|cxWbb_2!IWSE=I$y``}~+wa2Xqy-L>vo1VjehV{CKJg-D> zP^I&9T*qBv<)3a}cbi1g*`-R3CA#){|05|$#5&%LWlE@OWqHy01F6o<^FLa7FbpgV zP&`@swBW=wSE4NbzXw97UL+qTY4V1>*YrG78ctcmwRjOHaBG&cU*3*QJE z5bR&g#73F!RC`^NS}kv{6qwVmVJCYqmewq3X6g*K21iv>-SEt+FT0;r4I2XH{<=d$fp8pUA=EAZhaqfAD_l$geFAuJ|}h?eszf~ z`o2@X22GPl`8n!i{0^>^`>eb3MgDs^q6w8iPj326)%I+%n}rB*61#2Z{?qrTzekhz zJ#@47a(cqP#h)-}+b9q~TvXN^-K&UoLP0&#w%F)4`QSfa(US0)grua5i+K5h2nEBO z)$?;UWNv}*~w&2ecC4L z2h{|+SGM)cFYZoTy#ya|7crQi7+60>wMzhLN~?q=Db5A%*^DnW`zeANT8RGAKQCo% zZkPb|NK*sAVs0BtSy4}B;`c|}kjU#dFpGrfbKvZcd3CQy^87I~`8bCu=xQ~!5>-AM zMW(LibVuwFcHg(XU->{HS3IJpSS0t?{(Jn<8_Jy{Mq0ZW>hzxOx^3c$dB+kf&1BaM>F~r3%$$hO z&|jL#y0x8k-=55{S616g=bvTw@J1%?Z>YKk1}jx=+{)uUa#PZ`THft#!F`Sy3I?>e z?2fGbqN=PFu!k=>V2?atk83j{o9$dZD7Skx&(9H$=ZcnZ{N!aWaE9bLg380cRBAd= zaBaXbcJOU4OX+EC zbaZp2BM_I{1-oKUjDjOhTK}^|gJOWSA-3J)k?nYL-b+-Z{sF`FPTo7OMAr;36G6x% z3?~;~r#wjHiyRtxtEjTN%?`K3HCw#`#>pWz;%A5QAgyH=B|xKtmMXR2#5j1?J9TF1 zSa-GHeGb)o^VWbhuh!s|5`1xS3CF6Y1Pl!DS@Omc-U4lz(i&Zvx=)8Qu6l4lj?#vg zhI%(*D(~ZIOouKWQRvvl`WT#qTbUi1w{QS$@lP`erO-n+#2EEP1Crt;UB%HgmtzY_ zQywK)pSHNHAr1F|yXoIPFl9rGrq1%PjlBbg7w-o4-s7(vJ#j1(C8U)*pNSsNcT9@;oEU(QVUFd-s^G&XmaBm3Lw?XcdHPmkm2!!t!hX8+Otdr2m} zo<{?P&G^i#$zG}`=EWZB34vb+iLR``Ih9coZhteow%&9=w1+I>LJNd@)y|DbuGIW= z0Fu&KztDV0Ahr2p^)l>Dud-u8duz0^X?0wuGv>=WX;zvW(w8F7`Tsplh>8aO^nTY= zp@R$4fQ17oI_fef(H1K)mxe9*$4ZF9LQ5WV9)$bmXveBJVuH~&p$4Hgd0}lQ3HN|Rwvw-WFy_|;{~1;B#Kw#756|s(hW$cGXLHQoV;fCz;tPcasQE^8 zyuHls*`A;GM9mq;O%|9}jrYUZ@sjtJ54O^m{wTQGv~0V*`i5nr z;av7{2=)24HTc7Ouvdzhj?iW;stj=Kue2A*_e`gbbZ0;_CyLnTj{GcpbMnZ2{Jz$C zUGbas&sNqhPz54EAO*u#dHv>y>*>FYEB4;)Bh$b>Ho3Y+1ItE)#yLTspc!{CCMJ19 zG^IaEn7X!@R_1a2BH_g}4>wU>To+-U-Nm+ksEh1V?z92VKB&aM+auY~75=(>94htv{1a1vp%goh=Ry&2lNWg?fJsr$)(lx>eIu+`Qr{; zdM5F?_4!~i8-C=NxvKj_TM3`wM}LCCG4oxbA*}MOi87%%ISBZx<7@1vaOy>T>)fIMLCvdeZcp7*H88s*yt6-@-ItQNN~IlzsYv#er(QRY?MkEPGK*VNg*yywo#A>$ zp{^RRMb*8~Rw^%m3$oT3o>8gr;P(;PvN#N4? zt7w(z3f`e$W8=cHAA8=cEE(bd7kc5I6Em-bwi zV&l#~@y(sCkkMd&%vhUCnl=sGc}H3_P^pO^d}O6a@unVWX3t4Kym~6YzC=bUEU1M# zD26A+GO+mNX3iDObHycV9_iPW`aO;V*f*>N11?#qkFO`1;eW0y11g@T=_?Hoi+(JPre$nZaAuaFgYnfGDVuvH842fv1hlOvBX4CtJzWt@Isknt7Fom{{IJKZJDV3qn)zMm**-B2D1ZRfb z)I@DYH!}k&<|E!WpF2YoeFO$QpT>g3V7yXY zGngS!o(b*lvx+T%3FGD2mQr~U4fH)dxvl$D zxUoNX0-`Bng+vSBK|vfZGz8nz$;k6_khWkG8s4A7J3q@6W`sC76g?p?Ho1Ee(i3`k z-pAE1nuMIXqp1*Qcjv=mm)+g)@A}qc8bi0as|jnNKv>ra!|NG>H+MdGklk^M9wlJ- zz_K+LAvz*XIDGA5#G-Y-adnlsiF7=7Z`?ViZ%VQ>-Z}wynC0}Tsh?+6$&qJLM|B7q zulmOXR`x7o<2XC^#=l@5(Uo%kq>0XJvy1a9jdcKrvN6~Dol`KUq>53!aRYD2rQLn) zt#)fBTWt`HuaMvb)4IU}o0bP?hj{vo*KbpsohqPOEmZ{SjlJhI|0XLKSqR}%fzBE; za{?vUj>tlyIzGY*T1?+JwV>`HZIsMM?{hvG6_hL)V%G-f>FN6p^f(EbL>u+(c-7hY zl=)yjwvl!Y(ByGtl4-#8Ecb1Bi0z?b0q%0xN+K6byp zB#1U=%lkAP8!isAZ{qojnL*@U)d_@Vrzd$>S_gE&V(&G*-=R#>sQz!Pn2gNv{xJd} z7w$2g0fRLaUzA;b5o(MQ7vcFGq{#GMJ<^tNLiQ*55kv#IkeTrOXnZ@>Z$?a6esfms z`(%bfk20^|yxWp8BR^vEoLa~l9#+2|hOPk0=m763HM-TpZ;F@dIyQ9<@JpB<@7Qv#p;< zq;i!o-I~(wc3qcy-OVC!Syy5xr@ld9|FTG`-YyWWF%LGh>`?k|Yr*6lc_;jhrh*f= zc5mmlerT6kLy88)T;t*5msf4Y#KDxy`7{fa#FbT%0?Z@^LO%Hnb3__P?|W6U-m z@lGgUD?#h8p_uwcR-2j;hL7NaEI^+sIzU%CR9Zs%Yb|-ZDyH_g2(N*zyIm1qWEK=~ zfc?OdQDUHBJ1(!2l+lCk+-@xfbDsHjIa>9?GoV#@WFOQPO$BC z7r6m}Oy-Rq9S(V^*S;uPw?aKUXG`pD&GVB@M9fb%C6B?7f`==NbI7vC)?<;un7{K+ zLctM>zXl((S+V(*8l%}qcV=$jSuHsAI=<+Z&FY=6k07t%}6ELpzvkNpXQQ3mm3Fo`<3`==C6`Z!Cp!zio3xg6uMx_9)ff?7snB6QLt=rH|E%t35T; z1O6#%Fxb3REw0wXnYZFj@9NYZ57y5XAMC#y&AOoVlqURu!(_5Uq;NK}2*GnbWLr&p zzyYuU^agh9Jd-VyHQ3Ht08$sJ6Saq~F*=8f6?VVA5@+(p^D)y}9DiGsy?4S$M1Tty z)Em-Mc#JE0P83}*QGjUaZ*i8a{6U$?^A3&_Ua0?@Lu6zY!*AqX=d_jG%@pfTeT=hS z*5YVnk~Cvkw@--gcyuSeJ4a30#W0?0!$^Tl6G*C6x($4b&4N+brO5ZU7@bUecXi9^gDWTM%w8nYd{4hn?I|AiDAEO?wgg3h~UB+kyy zyA4^~UOSIYj5?@Ydb+4X@MN9^@C2@q%vU*MF0LS{khBLUKj-Cj!Ie)>$@~|26 zQ~k}y*LoX_%>PC{L+UW7ek@u(w^?eQbl8nAb)|Q%4yUoIq_RTn7~0IpQ4D;73i#w( z4w5a(j3!3_?ZhO!Uth8NoWC)7byIU0^pjyFMZ$(13^?uxk(4M{GlHV+SsACyzLtbo zn6cNQTR%cVbVtW$d7xqI*`@e;)iuK^d#5e0tfhuHR*X^Oegj;G!z8g$cN?VTXl@5D z=oTj+7?2%-Zgd(v!FmNk+fLQ-?3iA*lj&=gSZ+ZfbNo(b;+b&+oa>}r)Xy654eOvD z(3KAw8*Qjo$hd(*(Sv<`=8Yx|n!H;2QqJXlSKL>3x({l95{Iy_l6r{h}% z7|Jvavl?Nh3+?QwoX#9Rtw|SPOBAUg*6eB9&=9BBS9a3MBaUvY765`9aZynwE(!1j8ALTU6`1E&M>yJ)qA3}W!AG}C}Mu#&BwfbG)C-ki4 z&uT}j3YFWdcGkzGx?-d~p>l;-C7XW}9-xf$of@ z8i*qkCT48m?ZcgM{n8mHo_$8%9{~!3>jXAc0 zRz;hkAU$;dE3VO5Y9WB?D;5G>t5)?JCYRkt99i=idmQLtA(A?PX@}p14vNr-M$)8V zmwEjs_V9_x%f|kDk^=&}CYy>CZ>C>S>P%!)m^4k$HFq4;V>@tCl|5fA^?zpwt_>@C z?*DxpskP@s7WtEeNjxS$d-_2DpPU(8b29geOTzyXAK?|a=hKFcusJ@WnCP~#OU1w! zlP9UPVbKzBdD})qUc&zc{0H}^gPow#vQGa|0d6gj7u~~Dl@s-v<46=Zec+t`FZl0C zjHiZHGy$Anx%4Bl`8NoWMV~jk+>ldv;9OV!ACd~4)dCt&Sj$F4F0s+c%ai_Zcs;h^ zCV;IZ&7-|N`JeE^GJDHuU4p$+&OaXy-kCVAS*F-;zknAxG*%TQnEz=DGO%zKR9HB6 zSp08nO^_2=l^1_BdVcceFIZ7D-`nvIz8uR`2aWE$|I6Emz3%=Kb`x#+-GEm4PhesR z(d?fcSTg+#3P628CB~D&{nhbs^%tfFoeUeXN;||W&5GBc|5qy*&`1+BcAPi4V0u>c zXCzwZ-($v_t719)`0?toM=Bz^tFioHdR#S=M_OE-R?UYMbstwGrWqmJ!0#kJB!oj< z?eqP{E9r7l3XDB5EKXI-&oMuDL?$|=FEBEHpuSfEZG~L$WrG`(&A2d~$;1%O>a$; z%3bbh3C!6!BB%v%>4~e41+U5FbfLcOyA44`Z)*%gHDNA%ytMruT<45IP(@;Pmz$XX ze$;u|!rtQO?vn#%>6+%?u&%GTeAf7O2Y9n*1mb{>iRs{atBGFOdBZx(Sr7BLxiQps z{!9&}iTJQXjD87!TW$)rSo59p8B0#@*!VuFVSl*5Y6Hr2F&Y1M!<&>okr#iO>#JPZ za1s?#2PF3W={X|W5(D)l90k>C&f8rz^f+R`g@BmoDw=C0I{1wd;lx5>wwN^vWW&&2%UB z&d%dU@2@krZR!l>^f0sP^k}PT4a-1iAP*vF(3pCVru}ZS#qq8H4qCgr%c|C>%MY}Q zj_?bIkjE>bZ=~}h1x<*7+>2Cc6l;3sDKcQp!*y@my1}rKuSzr1>|P$Zvaf z1vt{gb&?rU#|`aNV=!tlFi{D5`mjAxXK;DnVQ~n-FU3YdTdq~q)0fi1OPF&LcoSY9 zB)D+6#L1;H(2mh>exO~hDO-qBcmSCysv!$If|=BP%A3?BdG$L$=!&KrAM48kUS?4< zlV-Pxbj0pye4lmSd}R>gVzJyrP5(s27k8QY>99}b2Sp)+cT-b53sWh|MdzmtWXNF| zLRXy!>b8X2kM7sZ?`he@-_D-#5frhHbDCB>fIQO%v`gq{=}QCYDg$b3qwu`a)95NW zy{{c#@UywUpGQv^nkHf>8AW!EPCYgml^^C=+${=7OwU6%ipj+z7i%s8pN`d+Z;jgJ z&}rc1<&|brG-utvHUaG7(f4}icPJidxX>j7bGvmk&Y%b*~uL z8*|{FvwFP1gVGv~(Gk^4XSW1X7}djMhIPBKUD1OBv}@s^6qab_zO}2oYF)kqwp_Ab z=||y}L)%y3m#g=`W5&$kzMi|oK-m%J5Qxo1i%tu3y*ay2M~Bd!%*)jalh55AoT}RV zTTC2eo+1ebCfdB*lKY5doLH1(wi2jarZPjkb-MH5BBJYi^;(?T;i;S(Xd=9YVRzB# z6U?h4lXJt9)!r!7k#IKqEvSqsu$Q0^vTz2&5Y(#qm@RiST;bG!o7y#4&Fuj8Qx^1a zrzHr_v?02CG~oBPC+zI>rTN0iTc%$fR(XxBWP`XCqFK>l#P5n80uxnp+qZMX5zKDt z#)GHBUX1@Kwi7g$HzZT?sVxyhP{GW?h|!RY&XVS4#f9;y2c~ShsNC#){((o?96nFz z{7Kw?;8uwO5mxK)Zu+6MI81W)zL$)va97!!6LZd!B3h1E>@kPg&Ewn_oZyR9^B9z@ z#eJ!sbsRsQtAeM zf*AwB!5@7F-~2)^`V@^3W`0S;9iPyg6s-)Tt!=#;daW70aDRtewwNgsi+6@n2#x`y zUgSNC;sF+JR|(4a5r)XcyF1E{_?1v#l_J_~-o+#G6fM#4)g?x&&#rNUJA(-9+EWh? zpBd|RJ;Gcn&CZishiHCwHs+;x4ZPWW`eD8N?zyD`=G_B(4M(PPv(gGg=!U(eUCy17 z3^y64zq{l}Rq)=L-tumom6BoZuGPV*42h@fSEu)vPf8JlL}LBBAX5#0JJWZrFSqjI zLC2d{xEitgxa5m>=Og@2SB5_KhCJCFHL=#YAB47i#Dih~3|B+k?1N18ho?}IDU|7F zS>z+6m4^{NywzLNHLkCIYieQw|B-I6X zM^DCB!Rsrc;lUE`vT=KTjR_^!vjsGPLCtH&Er_5%*f;pob2V0qm#+vI7_9#FA$1d- z>(iOd30mFU6lojtE29GB#u*0RX?VMe=(%GZi%;xAV!k360NLXudSh0XfD1AU&F0u6 z(={0;UqACa1sjZP6T~3};8arX9X-lmL3uIMG9#K7i&oHN@o%7$j}-upn;u(XV*JtU z=R2xI=Px0yg4*3_k+h>Jj?6FIH#RU?Ue?H&zj_Ag`NvyFo@HG0N&R7;QTMY)Pfju3 z&2y%us!(xxq9H~TZpAZqP*A_{i0An~OSPxE9ijyWe_H!${a}k>P_`!PAcY6@TT%Cu zdj%RJ$a!dDM#~6yeXAmh%L)rDDpl~jtvy+587=1H}pt5h^>$VV}V>kWun#FpZ5^CIeR(0DVdIlVu zJbD#fe6zpUb~`}HNGV%_ zq!J*HcTIju{=NS3&xXuZc(M+0PM4CGT{pGlm8b#ULE_m{I&W2?aI?3wbowuza>%Wh zs|Oa71=fHcAv8iA5Q(;zeemt=hdaZjTo z3V@dUXCBlm)WtgD^}0XZDdST`#+(u9?{EN0BuIJbJ$cbS%Y$At-u^h`pLs+ALBhYv}t3*Hnj zJ>UV=k9H;TMEeHby;qdEUX>fwYfAKjkwH^~N&`MM-x=5bl^by0C%u>>=ar(3)U8C} z;=*U(MHrg-)UAEkf;*n>oDjXLr-N%6mTO@_Z^_3_Tl%x0C1@XZ%=y^VdRg>4Yeve) zA0;u7;kY%15|l=IJ$l~SZRM~1;If%F0_t?bUK!&F=Hs%eI#M`OqHulc?6>>r($Eat z@~C+_SSq6>Gwb_=4wG=aUVf8t!&qo1^qu;(ie5_h#ZBi&&{E4`wW(KkMzm{;(x#8y zJY;xaUlkSy7zrUhUhZyLX?e)E%L|v(v9cs&SnNK0(O1y+Vf4>5*Cki|40YH@sWSfgpl4u%SWIejH&C`> z5Z3oWR@R!wjPKeZe^_f^Wt39&_&K6E`;@$uDkY!vNixhYH$oMMVfhO-V>HMpbIbmP z$`G>M>ae?`5wt(FXv$vq40h5Adh~&x zTSw?%4tu+{7oNOK1XI(qyXyfA<$y>othLANSfN7%m+oZl=bm1!cQHK*XEIxv-KG zgQkbqdV#^;4LP!qBQB*w$XU9gcS`4L&(n!sBfMs@S}=stkPV9Rt8HcI)<-{$(Y!IvbaG$=NeS z3Po~w4Sx?gu5em4c!q~rJ6ahDrk__-QWHBR9-l3lFUmi^YZ>EN$!aaPJrFM)b0?uM z&HN%2-X{$0=O42t>B0nqfC^0*Q`Az6?6V>-tOXB`x4+wzl$Y(Ys#jLmAMzi~gE?AC z{sMhqC=>}KXo7MEM*3Y!nEp)m+ zj0jAhS~#U7!qKl9+G=AGs6?|pb2VP~^s@q_$&^S*W3tB&o(hVFh2J%KxDmoHyTm|U zyw&-O^lVhhVk_LrwyLm*74Q7S%YaC{@%jRBx$PV7zAuaD`X26#5*I33u3xd@LGs)e zU<`KNF6pH>-)j5p#Ei#RA2`1a_*m~$GTY_)X`bAjgCfvhxp1{L@=4Oe$yTqhKKWEc z`}HsjO=N7UIEP)^QH~wMRdn5UN1Pl#`|rx}KinD)YLBp^xF{k73b15Szc&O2Ggli{ zCVqPq{s^4`2W%4`{$Zm36T`Y)8aJKode(ircw!Iv?O8p~P1 z=JmI5x=cG|5t`*%AA0iF(&5VJlfwH1;Q79QR6EZE3Fr+6L9URqk3Yy}Ysu9f7OEyv zt2s@7_3-o4z_u$9+&8(kOsvX6X%Wh(NsxIr?#>`0)dxL_eXP)6DUN4yuxC zpW$r5(H}I7L3$>qR24yhoYKN-?ARzv192*-@j*gI-u_8V+&gc&*~h&`Nza{q8PT(i zoAqPPI>*9`p_cfL6@8t=j)8)&GKSHTuX(4XRL=(FJ)+sKD;N>EcC?=NQb9@G`PNrR zs1U^Mzt(w6S73(C&vEX;bi9^a6DB?3L&*Qft?KBYG8ejsQNrAK+(~St;deL~Q-S(C zQ|xSd4@RWjx<31#xr%&(`>YBKl*yvkd@-=q)E=KnDjg{Jl5^vfJ67t@{0=KyGL{GQ zM5MHMeedRV2*-w?c|r`)6NtVK(-Ln`&%nn8BX>+sFuZp`y1+hr;%2*7b{#KBIiz1? zTkT%KfLivBZecaQoId=9xZR zVkJF7Ps2pJ^?TCVOOEQ#sZTU8=wf4-(^~o|3Tlq|=j_5F-fW#Co{&=T6c0UYj`{@% z3bX(Z7bbPNnuOL0PF>Ap%0YE#!EoXRf(f3scoJG-l)i4~YA(kkKiX>Iu5>!#4Ii)a z@H}UC{upp>TxOGpEbkS^r`e3CeW8xY+?)dD>xS7atX#3PdR? zzc;oSTVkYd#HkN`}jQq@@jw)j*}H4&4V0I|4JN_ZER# zjn+tfurih)GH_p?s)LpMY1QHPmYP%s-d3$S2Afu#q>s0h^SK>HUa8Jw zDZz{bXBu`r9Cl@OREAcGx~65~n>1H%qnc8|i;Q`5RE^#!DrS877*P~dne zXXV=#3`MVtb9wM(crdj|?K11#?b(ti3EXdHTFiiMKiIwOned}F;Tj0Cz|sNUsTVmm z@vhgFMMIqjR{nYuP&V`w{}@_R)*xFn`txjc+bi`l(E8FTF+tBxGCD=k3I6@%9{OiV z#kanm_ZHAh1!%q*FZ{UAwSuEOfB+LmTDS2ly2VaRriSFrg34*(4>xr{A1IHtkWT$xIW5uPqutt1B9z%xULNoUKr~~^I!lPYe07h z$Tsh+SLy;;0j8OKgNY?S@$uu7K>}49QTStHZFlGswn)4gl!dXihSysiq2Kaacaul$E%_LYPMbVc~1pTWEq4j1!;r)4^3Eh(6J6}VMwkQMJH2j;e zDM9n`FoqI1XxYeI5|Lb&S}(hwH{u6wQJ^s-s@20o_0c&MAsvQsX2;j!;?wN!eu;Qx ztX0755v?r6y9;2fqe{=Rr=67>RF0(eNT94*n6QdcqM4bl8M;&~i@HFvF+FN#HC!IJ z*Pl^WvLP5PIM7&L(KC?khS?=umTG?OV0HM=S1>)hdbZJwBkLZ1<*am9N}v_;yLVad z;cAh0^4tf_TS-c zTsfDH?cO)f9X*zQWMT2^4diJNb-pMjP{NfAC_EkcGle{t;H>Xls6E-yV_VoWXEOIA zTJMo<3Aho`lOdG7&hTBP7qI-NrBJHJ+5|7myuuB*qOkt~R}`99d2)5NdwB?o|Iq~l z-A**0uGFDsx=j@64H+)!d@Ib2fjD~b*0%+&Hl~|$XaJFl?$bM(Z{Kv$ml5Nw%Z$Kb zlwN8upvsnPPy88-%TfX|sN;>`MN2W(F8s_S2vQ2+WC(pIj3h6ni|@1Zl9iUiv3vl0 z;QUoy0aBk2rtzZfH4fWpX*~hoOZwrXlh9FixT1ELZmNl5%p0GaY_{Hts58PhH*1D; z&3hy$;8uXE1j1t9OJKf7$|&CH${~{s`BoxgiuEcbB=q{Za6?wqxuUf(DD|imzx(VX z4d1pFH3L`bMq~$;%cty$*%4!Khjdr(83|}8vwh=p#m#3mm9T3fd!H&?p)iU5=#Qfv ziE_67B}tXkaTV2{nF7&>#!Or<$=+0D3{ou5g!jIov9f>q6R<0Au(y|GF;!Ex=LxSl z%zcv=2p24U7!~;|c^6K&90yMf)jp8$nz)9If9N&5R+e*Hl&AXCbY^F1p7_dWLN#j@ z`!u=Y?B>F8MS=52Jz1w{^k9*K-|nw(1l<_Vsk(GOdl>ONZNUw`)YRK>0#}(>d#lpP z=XB9=g1t*o>yZ5sgPnGbW%4c8oT2%^RAJj&ol=SQw_@nV$$D#MG{nimpx!1Ps`ZIeQocr`~YRgYUfrBO_Jo zuJ2~nY`(SvzBclq*g?4+0~Z-X8~&c)x7ftuT4K(f$R!@{u~?8{>b3h6l0XBJ1|-lQ ziBXz~iUnSMGO&BtY4!Dv?p}~|G=5cjV$kK^qxEP4b~Pmy8j5pgM?xbWTfCrq_nxZS zYUowh;##tHfpK6XIux`jnK*=&$E0F#QV9!eACFaO^e*Se}ZM{kUrT zP(1Q*?U?K0;6Tbm6&6vpbv)pFA!>Q85VBF+{$qH<{)Z~vayHAJ<{pq99fh>lJ})ZD zBCR5%=esUf+uG+Q0GyZ^nr7m2Z>0K{WPn`fXWyB<>ZBsb+}g;SuLsH@`Ib2p^y$hv zq~HVUccqp;df%)|8T#@4_*Hskv^^!F<5p=)SBfiV=3*$=T1qeF{sO(g>DIsF+tjBJ zPkVtwW5fnIC6z6tK|xu$XQt;{2f>!_$YD$z0d^lS4jx0~P$`eo*{slQccT+wi^r3d ztYE#iQr{zu^Qp|s6A6UAw!zfuXX9#rp_O<_8!BzR@X{D~ABn)SFt}KcCe97ydAV44 z#`1Rms*|2pGHSY|;laV#%tNsL71q}FF?(ezJqs78SO0Zm)T6~LNFGaHT+}-QiNty{Pd~poFu|K#&rnPa(_S6d+(_>l- z-=)?k=c1&xU4d&O(Ch~kmBb?{LlP&-Noz&@BV4 zfuSM#^~!APjogiQv-P-dKI{aK%g9{Ry%v;N9IEg&S5(&$8G{$tHAnH!drWzYDeeGx z@8*3z^~tw44L{w@bqjZe&-0Uh7XHBjTK>_hf}|nLB6TLbhQKV>K{OJkQ3Mk5x~>`8 z%T;4E63P3BXJdg`@YUl{PQl9LlBuEZ>?{G#tv46Eg>)(#?e|~rz|jv4RB+(2rf>|Q zHF5Dd2f7lg^BFh$!m^B5axb^Lp93il7W_KOHy2}Ba9B9m1>3st$q|t&0+i@M!e3%u zXol%Z@2r>Qp~>t+L#OjWGTi#w7DavTVttP`(;EEuUEWQt&9U~L9C%s-IwseY6lcTp zRKg)T3Z4SXSyp7A;hq3!J)U)Yo+>`Vg<}`(rDyGJh3D(Z7pusD$n)Ry+ufUoxx>I`KBNn(cI{A4st0?xiormqJk6l;jZLYn{~CSU-I&Vca|$LNKPP(;qY_cDQbL zfKLnTE0Z~su;Erph?mJ>i<2aQA=s(EdRiiuJ2KYSJz2T=e!zAyJ~Ne%W_G<2+Ri~l z8TdBfNZQ@rluV%_OFSQAZzOz(o;&9{((w5pv7FPd64&)zvQXENqCypiqN-}>r2SK=H((^hY`3h( zeg1dfR;uu=XzA$k`cLF!ry_^}{5RXfhtAYScRdV|S3Nz7GWtr42#MSdK$6W#9@n$f z;XE0#bCt#4xI4h6;q<1r7PZ~?OZa6^x)Li>oMjP^fu7u=;vW(C;RK}TC~huFy?$vT zP;@w_U#)!iXLcC{gDD4?4nRXk+hZ5Vtx%>Nl^x9uOa63wcYyd|hx;45#Rx5JX_s$4 z^C5}5Uu-*vk!!sJe}@&G4|!X&qK1Nl7OzovolL@53_39p>8144$nrpa-`K%3#jN`wXuq(PbucvQJCG0e2A0=L~hd{wYVU3oe45H47A zL2m&2YHJIn)&E{u89nheM_od9Q}L9aqLA96Bf|u}DiGdy^iic#qRAv0 ze%6Fvg$Biwl5l*KZ`B$dBz6V8IU$0Kb%zpi4==!Ay zc)CFq9Vs4w$szdl6VosA{@)AVq_-CDo=QzQ=ceB zipCJ~&x@$|+|nwmJMAmxA-Y`z04k7Qy1}@O@L}k#6$)sS3e}}?j{36oL)W!tBvsnp z10kj`s`tQ!!q&lVnD%j4c=!m~L~uYVVtHiw8epFM%T;mKg)}Fu;P3nk(Ztr&H7^x} zib?*vVPoS8md4qyxkL5Q8FSeyps%@7`*Sj@M^YHR@c)Jw$e!oZuN{_ zKDOs!;o{n~ubUMjw>@^Q zy;^Ua5SlE{W+Lq!+gSKH-PF>uQKFvL2J5Z}zk(Gc&AmBm+jz6&I&1iqo*!CE!a=3< z&BZx%owigU$-i;%UVz>tr&FdnGdF33=()Su%DWbtZLY? z6gWS0E<=v22&O($J=t@5Lfagk(asiZkO~raB|jCO1)haZEGQojE!g|EG1hMQY~y&74;EpmI#vQ8+6y9)_R6hGyDOGASFZtfEML~65hGp)2EW_1%`NU) z49qro?4`$1{vy=j`Vik*=}0hpl2u%p`|i?jZh4+lSg3-e!ktL?jYIf!Q>zHc+75S# zU&$D?f%i!BuoaZv!NSe0V&A{03etNj`MDWM41N5&HcJ#P4|Am4ml{d{r8EsGk<4?kjpn;pBFe7%$#mzNy=W9!fzvE zo3wl@e(kAg`>kqePr&t~2!}xR9!ZkQFVPZjCixP>QM55|bA=^T)Sa`IJm82=PMUts z(&%9g7HK%`ij2;Lik^%VKzpd)sEylOrv=f(^G0)pAdHna2td07L<)(rSV~2$kq#?{ zwZEcbBTb#XL2YX$Aq{+MT%0OM8Fl=Cy1kA4YW;9)tbNFp-Qm~mmnhlCh4F+$U_}iA zi5)YsKAUe<4|E~r>U4;!%^wpmKnZHWAb;%w)0sE!P6{D8!a0g>KY3u?f0yA%9izcU z*2T6W9L_N)mDV-zc@I8c>2)8ciuC}<+r4R?ZIFOEO;iV6Zt6mq6IS7P0q_>=9sxuN zZ-w8SlQ)x_zjE!B?V6c+jea)cWcPpAdh4h-qGwweLU0Wb+%*A$JA(v*1r6>V++pwm zf`;G_+(U48cXxN!!QJ)i+_&y~zkApB4-1CwInt-ksoHy2RjUFTrp)e$iOZ&n#C^EA zU55k`8>nV3AJC!t_t@5L33PfY8e@r~rHW=z%&$d0O*&39a53QH|Nd%GseENEGQxlX zTeoxjqIE5d9XZOO~j6I5RLmOd0Hw zv%N)T!`-hYN*=~5=4Sll@+f!SLIvE41kBoh{SZsTZk*$6oC!wshXZVqeAP+k7%Z{q z;1ou@qW38!@J(GmaFvn&`)c5p?wZ(MVINr~II*9UB|WxzJtt9PmH+XDqB`_Sir2;t z6kMzU1e+u-h~ru*Uxmj1UyH!A9BF*7f)1c1U0H-8l-=XoA`JhtiR`#{Ya8cm3O5%auRobn!%1?Q^ zyF0u*x!2k(1+}#a&&1U>sVQVh&aq2-^g?2^Uqde|F3rZ zi+~h2OICBHmk9hvJ3Bpvszo0d82;4O#_tRzI6d7tG&eURVPfWGX8KM}PRd_qfZSvL z{-ps43KkR>n>^hCMUxPfwX_Bos?3m4P((}Alr=ToRnKdpiB$hrOFWS`M5;Drb6VL4 zCrzij(*?>;ml?0!8}^ENdh*uROdc)i{)m`HbxTRWEb^yC00U+PAE=zPKH3fr4g&Qz zDfs!5fu`lt_AVl9`pfG5{U`&NX5t) zIzO+0LBcEI?9A!90>)pewb^>Qzg*c>P*8vZ4TCQFsogw1oi@9XVf_63q!bkL>gyBR z+eMmNTJD$DUS>K$DA6qbkR{A5jzN0Ok*ZPqdH%S{Wb1I*;~cA^7{fe@<@*Q1F*y*w>z|Z%Ln|q z3#)D_cccixuv2$CzdoSFAO>R1W!4w_;d!FMFn^_`ZU%>)&Faon5{;NzjvfNOo|m8) z?z4SqWpWxKJ775P_>&HzyKc_|g?EGo&0oI(z8E0Slp)0DMu-a?G6<#%s2?r8P}f`o zhQkKrQoFxrgFHAZDJeC+R|4abkjU!ll1gO1OOx*l!J%J7Ee6(iz5T`;z#d#*Hy9im zvis66io}LC9d)ySzisZ1WRFcNdaBA|a>vG{=z&30Wm4JVnFH8QMZnZS_9gG?z>zv&5PCuw2|xinUz+M(vj=5MR3*hY zy`O7NO?$*-qh*edrnUvLTrzVL+&vxYf@&R+fm0nYeCD4k~UMH+Ku77?qw2qU!W=1d617Yg~HPrP&Qp6Y~7>yXN^puvLcbj1|V zCyq6Lox`S=oedDtu^o9>7)YD7tz}qAP5`s5$t1N*8=Rbn zd4d`67yWr?c;1|}OvZ%)qpXbM^RPsJB=?&BXsSRy?r0lHG}oG11Rj{~Z@oIr$+V0* z5>D-@uQ0Y<^efbYkP>0Kp8O24^f{gJ(H8#s4w=&S?+sPx&F-b*`nqF=0%@NBNd#FR zBQ6S^e5#a)2u!v__@DfIq^1>l0|N>H*OMd8w!Gfhd(_>n<70FY2t?5H=4bJQJ%N+>Y;r?cct3F3`? zSUXlU^fvfSEqJWoQ!yIpu)`Av%=i)Xf&p!*5H+}X$e|t0k zMI7@I_=vR#NlK&JN#@UZfu+>rE^DoponA|wQ;j2}*JX9djB3Av02`s6C6M4|xhoNG ze_&&fs5oEh(SUI$TeN_=Uo!2ELr>l@Z+l$6*5tRMu|o%sHTFji1Ef2gK?1A%q~}(JO|(| zRv`(g-QvxanMra!gER)mM7v=Dy_IM}FOA?<2b>VfgvNYuap>vc24D;B8DL!+95vv+ z+{v*a7;I&%LYFVDnNXR3gXTNzNBv>pm)wtsyo%ced>Bj@{jQ56KE;DR1k{&;1VQzJ zmLxl>GcZp(*<;8A`!e$0@0{}12ChCjc-3%(r#^`SN2W4;Px*GbX1$kQS9!`&&;gE>y6~ z$LCORmZ=F7_bih1@opzJGOIc8WJ|Z?*MU~6?24H9h`Y0vLi}*bOu;xpW@+n>Hm@tb zHg^|Y&yxCAk5}XPQ3cbddA9BM@2kLlLTCxHZzC>@cmBB7Hx#;`PL*&brMN$4k1!?i z#JY2w99$C+h0(1(t>YMF_d3u#z8!nDexLRE$8!YNt246xDW5NZGy;f?Myox>yR1=9 zPoMieC&0Vv7jpO&ijF|lC8pVA#FjVu`(gvS1OvUV@Y)~&-tWFcpBG{U;RlKrAa_ba zT$TGH*#R-yF;wd);Cz`7-;)|M6l)W~0@!7FwNQQRt1(@txtFKz1Wub{0n<)NMdb@n z(-x@c97fC&F*x|OSj{SLA3B^Srm0D&si_Im-Pgxqw+aFdwZ(*l*x0V&Bo02uZ6x3f zt1=tYi`Zh=JhX7@zf2pn)01kwp=Zg)zp#9a&E&>-d6ui?99y5c4so{4xqAaccFyPq zwpdd*ckgCCVhs;JI67{QtxWj0D}HyG`%|+DWfZQCtGoGI`HA6I4Gy*@UdE7T(jy-) z1YO#uLlZ@sPbHM!5%xB4Eh?TVu)b#D@M9tC2HPSr7dKHj`u6W4jV9Yq#?KH|6WiT1 zF$OizIVePEWc#nzpl3$Ic}gBOa&;mb!Ab?}JmY+=13h$;YiXWlXK zM#V}y4m%rZ`ocWO+8kT;5-Y)AKgaOa0(~d){^Fphe#IiYo2N1}C8p3Q@r134S?<{^ z{YN*@Eo%rraX3CvKZD)wfRm_;GLMZpZs(qVj|}p>d}*R7NQk*tard z)*MHd>qdG#y)4Qqp!-fyBNc}7B^pc=%F-gdrnJdl48374vka~C2J6oIe0p9_@7_oN zEcT5crw;ptu)a>@$ZTg5xzE5&%d5$P--1T5+5vjPV#4K|LaqHAY2D>?Hl}0cI_K-N zI7(S-eR^Xky4O>roxAC=e;6Pb8tdrtI=feY+FbwxZ_?HXrqE6tl&r6(C$Kk{Zg(V+ zE>Oj{$8x7dp^p8sbfEdHY9^Imc`%4Y35js!UOFD=V55gv-eWpGIszae4L9W=w_WYU zDT?PXT-ItT4*ZXe<=Pv6Eu`6_Pt9(TIb?utkbajna(!OQ33fEZ^~b=II}A(3Z` z83s5IhLht(?h*}#NASFP9e(M9DiBbod zCcswbn>zhcpooP-*l_`0wZ!=LD!6N-eZwA41b|r+GdRNqwrnM{6sw^Gz?|df#Q1Fj zrO-F#vCOzO<8DWc1L`8G-mCsrpMk;RwWJ9*btA45tcL`f9)G{+i%y2oWYDdEwh^!MN#m}j1k$7LH zAqYKW?NwN>6V;$=emoA$<}N%!^bT*@mO6+Yl(_fVz4 zb7%61wD)5~f}0-R<#T*yg z>9_CZTxJY7zA5Lqu4Y!bIStg@YB-_MIk$S}3ovoCD+I2N!|>WI207=G6)OP=G44Ap zSq*34HUO!AeYkdsSaw53^n} zRm(FlYd-)eu=;$qcOssiBp-}yYsXEvUA0VgTYi{^#=YJNzpm^zv|tZ;8Xw* z{)QLr4_!nNXbE9=5oaeVP1X;;1yZ-da)qEa77la(2#=ZWe)ZYqNchX($@7<>U`IQa z$JR3Ad5IF+W69Qm;rm7pC_g8WY9WI zq$93tkhxR0C6uQ2T!U+J8Sm07sNEVcs4IE zg^yLzA7{RdOEn#dUYQ>Km8Q8Vx^%U3*80Gi2m@7apC@J|SQ&Q*7@}y2E#%}7(Bn{` zGX$f#e7R&Ou$mB3LKqn>lwgPU%a)T!fi;;`spTWr~G}5+Nt?%CaG$TlDAB6x57h*+Htb-db9i92q-j=f9Q_N39w@P3lyv%5%l;S6N3%FO^JL?bRi)j{{T3k zHfLz4Oy2&~ zY&zhz`*_2yB=qd(%Kv23pWkqPSfiq(p)|W+_P6yimQ!v)`~G=}`0jb>^kV4snyw6@ z>UTOVUM$n-h@My42Ae`e%&NiPyg}4asri|6C--7B8sQCgtn{=?x@3vN>4mW>k^|UF z>gRPH=N3hvDL`ObByH~*X{CHQpkNQ;^%N=yzS4lT_F#88rXNGvVEdMjQpvaHwT>co zBL7lPnWhAzqgbSsIs&t)BMH_-4}zU-Z>ANOcxOCn>}q@1j(a1ct-#qd0 z`gb~5Xn)p?Zt9-9ec}1(rDS9ja(W=PJr4t78Yxk*bOn|ZNtaa!mzNQ4qhHrwwc4J# zjA}>W+-_atlDRXa&7=FHQRj4x*#p@N-zY2XLM&0|GwSWnIj9C*RPN;h|GhVL{PW^$ zbaFd^!Z7O;Lxo=-T(9s2 z)ERGXCO0=XMJ?QEVF2ON@z!X(`uV9{i-Il$?!>k<43$`{s>iSEqbzE=TPvE1I1v%gf6)?l^R^nT3TY zKve|*6S?0EW${QYZR09z14dQJF<(~8=mD;_?{<~4UM#GAgpObZmx1+ znCU_bo6de-qU00GOZHafVU_#kaf`JS>gEi5$FbdE?kM#~V`{{aXeOB$Q{{mA=r^(P zm9xOsP`4_cT{*EwHaMs{5a60N&h<+bbFO@&DEx`J3!RDk$p~5@4|m`&0OAu2ME7~- zXwuCJF*wm)x}kAmMXpG1uDTwZmIV^V<;_J^vZeWg$I6-Z`qoxcetDu5sZU>Q@SI*A z3fdZcdsnq?hzAcVPMWLSTW)U4Y-jg?%14Ah%`g0B@u89+VR*4Xd*SLNW8t{8)6$9F za$<5eH?;BSaiN7=tkgNSv`j;KcL08A;clRb#6{Jx#tpmf33m5U&oJqEUYIc<;oN0# z?GBtwZ2ksm!X=-989)m=(8v6#v!#$ggHRujgkSH+%GsF|E)0kV{MB{xwm(yLhu`#9 zdM?z11rnsSfo0jwZgUV986c5k6Sg1% zg2C8;bplWt>E2hLRhXH>E-q;~KSccl2*|V>-U5&CpYyQR=25E5;n)?O7mO$jIrA2J z^}q)_cahkJr1!U@--q{L0DO2UPr0Gq{#B6U-e5}Iob%+)Sh8e;i-F@|{gy&J`QY#9V zj9(ebw<`Vy-8kt@-nl(rs3rAEiI2#W@UN2(_1l1~BC-AcIEuT==Y7+y{2^}ehT9_R zRw(Cz1LU+T%dFe@MOqp;6z`MKTMln{qxh4M!5lOK|w)4U|<%&{wOH46}pj> zD0l(Y1CmoxDm0jYEJlFe?t#ag`9sCb_gF>l^Ox;}iR7gu@L2F-kCf7_9`NE-2_5Weg|datj3e zPuB#)9?~-|FPt-8#t?l&PKDeOa6RYTw6-|qwr0#?N;P2Uy00t0pSB^L5qBWju`KKA zmKAzDh*U#@pZ}f}*=|J)AM2662301pX{hXRlG^%g+itDh+@D>94y2{8))2{QtO!mx zw$5)I}}D?b3uJ|+IQ&H-n;L!yc>NA!nhFx_j!&ik{GRiBF{eDBqlbihuZ zpZ^I+YDy277fN#id+9i|6y)+mKm1FlZ{8_$7^0NbeqxXIC|Vc+$mArHsR7hhh4f^} z<$Hxzg+_@v*UFM_&7yT;O3L}g)e-mT^n8F;iKVa}U>I11)b!Z)0UxMsO_WHi&H!b4 zfF&+l0-ZU0eO;@6P1o%1ldoqU!WVURIhwZ6(Ot1uE&8_V3v$!7Q~^V{Qbx>cw3zjp z`vFfgNx&83@#gp+!2=nE9v%**@;UJWP!KvgdVNEKuBu#N1Xm%yZ3e;Hmk_4p#E~HX z$9`#z&&$5aze@5(VZt2ywh#j81NP|S1R61TtcX}}W0f^f8(ABLu!?6rZoJ?m7B11L z>~E?lc%UBHqEkcOhagR;@wAN&3+BhG>Qhg_Aa#sCw;FNJ%Msp1X19|1ie!A@0Tixi z?)xOQl2!8Fu>gA>K%9(Nc6+;3B5`3b_7Au41`*wk@;F&C@9}B61-)BMBX>~yfGda> z$_I~SJKcuDnHD^z0>I-dOm~XP%e^G6YmL~5yLw*~ zsL`-u<*CSKW#WF~HK&aBx&X(*6A2;C<2p?tzbsi<=|KVEyJ@ z>xX?hdRhpE4Y+zJDy^b}z|-#7uB^_5qxF{ciGFzR;Dkfy=_vfs;(hlD@$%G{(eK2T ziwQP1mYG-P{D|nb-JgD*ykd$2QTeVWVo#tLziq@eES|4&wg|xhXVzf<=W5{-LI~z1 zxmJ4z^}PuxSJp*R|HHL%h$HDyeE?S1kL}NFcmL)OK|x-RGPjp5enf%nNU@vsW-3mG z*ZGQoP?PU2{A?qKes=wYE=2KXRw2OdO3qCl>C4KZH8eD+sHxRP3PT<^@tJiD27iBC z_I^B074{(m;$K9wM2cpx2?(U*@e^RTi6{PmJfv$Bnx4h&HwT>|ObfN0Kn z2PDcM(gFX?TnfOSXOr3;lO;LA3TT&v_Wa?Cfe)-#t-k%Xv$^T0yNHw~1mWMMWv&KdbmWZo=JaMx#JV`?rgF5qqJjU27X47D5MY+kJi8hr82~9k*Q)(V z_E!K^zx(!(-1m_sGJ*>kr7!}$0L)#oCENy*^-ei$@G+zKODAt z9RPwE@RFqD<#z$4K)wn?Zv^SkXqrHoYvQIF0H^&Ag10-$eg(AF#^j3&M;M6+5@~yTR)FvAGOB=4)YOy)7+|%cI8p(Z@#$&j zmM+}?@x_4bvRM0boM_hGbl%hq8gaP9%XOJg4Q3s1#Qa+mc6O&XehdI-?3&sGayjpJU^SAv^+B<;2YXzl{AMaxMr(ug8kZ9_yM+;fg%IMws))H!oci6Qn zDc=8XKD#Beuq5}JcKBc7Yb_0ppG{2yuFDRHFaSZ1i-)%wbq!uAjVSwHcNy6itUGS} zR?0e3nTK;`e){Y%vUThtz{kf&BH&Ui`17#g=_L&Rf8FG-fJ}E}x z=OVP$Q2+-?vr@Uv<7?02_5Q$E(8xMZiNt0S7)izl{PLgTlRXjmE3JNxX?>tcL7O#2 zI-bSTO@|BnLDn&d1+?|VSTJo|zT6*&nSHseA$zdfcDbnSLtmpb`k4(E za0%xMuM>CIsQRXL#Pl>FV_RtNw^cFi1&-+khpsr;o1FrLoQUmC1O(;{pOCCo%#OE@ zUDu#BC4CmvGsK(!YzPB$QTy~fXQq2tuEfj51Qeh}5Sv>+t)1++d2jeaad^sD zly9T7?LEr7>X`v9{_Cjf6>sUPeaNrmMc7YeIXQuw?9hu*RW)PQ?-$?je{9d09B>@y!g-MN3Jm15RGs$|^ddwxt;NDEgl5OZ**BDQFzU+$UN zmSO|++=_J`v9T48$dZB2%$#s9Z1dM}DyTem`e_zb-` z3|cFvPMfZFu7$KDt+kyq6SH6QnD5L%L3Q!pt3Fk2=C(G(*4YVI3l-BQSuduoZC#6jPrQNTMZ}7FmAj`K$Nuk~o8%j`#I7E4 z3tHnR7Y)mggRF(*KXuv7Dy8dU0YPE}+DcU)$&c#4WC-0oF@7CnMC6Pt$qAgwftpuf zf->UN=ahUb663Yj{*0>57}SeLSU70H16JwyRz2W7AC2`BjbF&)rvG!aVUDDQI|n*B z=5X}^>_`9fn6EWO6L67cpk*b8$yw#c_{3;lFW1bwW6dc!m$3!Kd}9eqw`lja!3fHL zC~{PN543!JJxc&YE{LMpoY0hd2X)teHYN<_xVrn4_+{N72#gbw)D%=RG5SiZV7paQ zf;b?pA(856zjYut)v)zaCuo7^z#IF}W4}w0; z!#r5Ff7yci_v-!VFrv2VLuj4)w7JvJF$zho3KuqkKRast;tb}R23yc6=3G-N7QJzT zZ&G$~IFp5wV^E;N*{$%fecLFnJQwxgjUwkXS5Vfcsf_nn` z0$paj`m0J;HVYG-{LB(`u)$|YGEhl3Dw6-)tT}ah$7xEvIGzY2_r%2YGpU>#yUQk; z+8VKc1~!W8wF~Iq_~8n6MD8D-m|cm+gx)DgAM({RuaX{Jo8;t{f2zYM>dpA*;Qf2M zsp=xhr1Mc|B(UB>2TWGIKOnU-T1S6quH=prTkoqX-BH3<2{+&mH+#s&W_r2$7`R7e zv%QljrBRpu{RhMcvj+P60S_b*#PQe~IE)N-EzOTS9l6ob!E8MH@W#W2e^Nra7Z48M zew#uf`!T_!T^kh;Z6Mf?HWwih))-Ul^tsscI~!ZCQ7xn*;p!_6*-Nx6vGHd4r}Vjm zFB6^-J1FkWc_bUFkCp#NYyf)vVpP`|b>N?IA^$wh*f-@}?#QQu)AI+Jp?%pqt&(}Q zCGyG7X#r8`{!WSzAr!TB`->+xL>dj&Fv>` zsXsnYR0FFM7d-*8;UTNdH1~Su*gD}t%KgBe?t*s3@{DkS2xUuaK^A-#)30)0F_%_7 zQw7uYb^n|Q&N8N1nISjGi0etb<8o2x?Hw~-5qy`gU<<8bxvY3|`c#l;fjV2Y$e6Zf z7d$gYgA);cLA|u#mKnegA|xgcEY0+bQngB)%2~4c*MY~+;(oa?UGV7h)i1;Ku4EfI zkJ1CoVv#)2A*gPSYKfPI=?|i{5TLFvRCZov^~)+(-PFClpe>agy>?kf*QVy9JryNG z>e`HeOC{6<2#X?yjaJrd@hWsmg~L5U&xM+J<^>ii_c=CE5Z~~Itld#a8m-_)A z`PIu+UF7|O*e%DR&vayMi`ZwozHS4~^IgOYEMl$*>IHhY7qcQHj4LR)z)iF}2$Mwt zU3trBKv1=NNI?ie?+=XyCr`$$IO; z6zm5+^$zITQSONmT=Yg3C-?O#(~)rGQ@iWy;NOaZkf;gR;zl1>KvX~?tlAAk4Cc=; z007wqd7JkSK$27)8Vbeu6^EC`c;eHe7KUgIBhSTrL6#Cid-W5^^seG2hw zlI>E^)1#JsNvR>;Uo)1p3{+vNGI;iX&d^enT;7}kkYHc(_ggmaqeP)w2OwC>3*vkX zZI5xUT15TEP-u0}4#s@X1)Z=E6bJ{hQ|uI_Sxj>g5ODDOO2#vH+XY|(vNs)eaO;_a zlPbrc>suglOyT_4b$^;T>@9qR(M$|{*v;t^?Q2(vvdPZw`Q;2IjD1#Vx+}Nst`F#z zmm%&~^B<$yllkC{n2`2w-o-kck%fz>g0`M^4mZx;;2HH|NSc+M_ZjlQRBrj{_$?67 zl`EItz1blB?=b{t*jYt7+;{Ssa}fbwvhhHfcv^j=U zEH4+dt8SJE$;-I4+ljCWMsy0)A9ZX;!A6XxL(qK!I;Nc({SxTF0Q%pZl<^d8U%X`I zBy-lfOc{-iB8Bd3>ffp?#ZIgJ{jwWrVxNXJZh=-F9Plhq+)t~}%r4nnh`EA{Ftl>d zH(4^EGw`J&;WMnxXjDh*3RC}q5xuSm6iXq&KkT~$s+D7|O zmJ%Uz+vJe%o04pLk?=R7a;}4qBg0>KJkfpbX0%K_qO6ID$~nC6DkC#a%1tEV=Mnz)()F1;=g4F$LEGI^hODs3G-|z+ z%A=TkXW{-guPZwr{V&DH5DF|DzDK2n`kYJsueNXobjFAHUS^Td9{rYX^4SrQwAjwv zqf+5XYfeHU^CQLind$j<+N#T{$t5!i+W`-~v}4529Bwtoy{csyjKtx+2#%GiOd2)u zVC5!n+lOB>vZFjH(hUSXv2AW4JbD@;>kBHY3p>`5Ew@`6eNSLvvsU4-7Bj)JQW=`^ zE%RI)hdtJYeM@QD?^)0Qy?xNx83ez#ao0^A##pKeYww!eE>zX-_HA*bF8Oh zW4de9%Z|}>ivDpzL8Ifa4U(>Yf=+Q-gxgw_eR>#vpu=sm?_p#ATgi9ux%pC+a6@Jm zSPKf5d%S|$!ZN3`M`<(Go%RJ{Le(j31hS)vBYg|?e3)(G|1|}sx+ZWRwI|uGs*fQ( z3&&3fedRok~u|y(gJ{`CZt`gb0xTg<^GjsPz?QF36^3fwdW@ z7Rs~Z&;Bhmmf7-tuGnH!k7N%^(HWyo#Tc0pQp~f5vbiduS&7BmaBD^Rtsec>?!zIm z0+}TREkOW#t^FGXZSqz3dB*m+v)~LzRKBl8gWmgO{V0YT8PDnZgzM=oh+fz1Uc%j_r|uqSkLRru z+9-)qhM&gp=Psue)GDDF!2`m_&3{%Kjmhbhsb610^V}R(sE_1?I}12+R%R;>MG&qL zsLNi36)rDgt$+Z+G0cYh`i2+%n^7U=K?a*A{UFaELj(kqal?1wA`}#~UzFI@ynKqP zC%LMYXSHlbY@9NV3ewFyy_Zg^YP1!WYJqB+jZL+2@$o8&WrkTlC@KGBMs1=}<#!G7 zatsr9oknhaCkTR_uARPo_PRskfVPf7R-mbmI#8jxhEi%Xty#BDQLz`@I#2QSBKcH# zdUQDiq7-z{Mf=JZwAl-HLpDT)LO1LC$on0IQ$vLbZ_Cm88;wGNJgD6vH=F0=TkqFy zmU;_ohO(BHAGHM?bAU+5z@wV$Wpwp~T85Bt4FA}nrngrp{Dj|p=qyc$G)cE#e; zyK-q-QDi_qg0Ew!jM^&HKDwe`anTz1bZX3qtWuDJ!G&0+$VJ zT!E^XObF`(akn_cq%&rO3F@TO{0uQ`LXCdJ%F6Tg?vhYQ>&uNqsRGHsDY;LgfSKHe zKKZU=Yek6DgT%|rs^l`CC(4-63u_lOwcDY;PW$&|_e1|>TR_9?IshrGji?ivAMRW- zJsaK9ZOC>Wr1yo&T0&wQw+R1T~O!PT2Lm%z7ko&5 z8kgX-UQ=~XeogJZpb>%k!&*Ynb?EoEA8@DB1Qo2T#;^+2QqsECNa(4#0)d(M$u_6o zcW7tVy{6w==5tSRyUG?klChI*XL(XpR$3z5w>t(zGM%S^S~uxa3rq6yudrb3eCm@r z4E^s`d|p!Hg!TGsSx`JyvX7ho^ew&<7H+exz%2_pee*+vVh>K7eTZBEfr)_VYQC%5 z+?sxz7?yAvu7Ja6g26YRDL3zEYo&{x@>^f)A7k^WcUC4wv4TU!Y2eyn` z+Y?Q9liE#nVhY=Q5cWIaI7u>YDtLFjibyM(?#aq$8t|7XMendXhivow{7l>Ai1;n~ z37XXqynLQFCLHedM2Z|jhDdz0BLpyF4)3_cI5dT($*bW1u*Zxam;7B${Vc0V`%sUT zE~P?^Xhdf!;{A;$TMD8|sk^JhH9+`v+ZRL|vc0T}J10v^_a_E!hVrk%6l_$3LBTDn zcs%y6qG^*7DKSRaje+5`DcOptH*m<)b4wf)a1Gm-?8wq@Snu6RvD;xxWN9JwMa+Y@ zYE5*7iZ~fY2fAuY(ifQ0%TFS7-%v!}jXZsn1~pa$Txg1QNJ7j_9JjG4?x{~Jh6lbl z^l1KJht}31l4^1obOnz*vk?DSZ`w7wHb@P8Qj*e54(PS$D3vwvdSYG`^hy>#C$ohU z#l#2`I_SpeUQ3qnLul`|C4W`~OCw)9@Ko^+>`>xIv&9b3mQ^-YhYW`utUiul=z=WF zo0v!G(isYy2Z(uM*FYGK!N||3#-3l+>&@9$V z+PRJ|lo^@;s!X!K$sCyCcAFm=$%c zVR4e<3(V7v&7O>UONDVuXQgj5GIL8iCM8nzc5^dCJuYhwZsVB!EA|g1g@nIEV-;Fz z2-^+4mb=N0zgD)1WdyN0Q|}bFMMNz*kN9LPO+ASfWU2Ht_Zw~VlLu}~j4IKFd+Dys zCm7`Rt}zHOFi@kCR#sVPV)>a8mgxjpf9Fff+)vRUH|2!zX9vhLew!ah`*RCVA(FN3 z8d=hfInKk4BlH2cXr>oFw!um7c(y>8MkI^EV-HhGPJX?8gJJVe_J^m&Fv*j)6t%qA zb`jc-$POf+3-r03@I9CC+FEWv!zvL=c$}$7rd#{Afo1~=m6Wg?Y7bUp zAIn$?7G*a3$sI<%!kz{+olS39zCb#h=!WycPAE;STY=qd)4{>+LC~iAjD;b|2qj8J z!bHtExErwTlO1#poT^&1R`GHIdaf^<$?hxi9mc=LpV#Sz1O~nbF%h)UD?gSdU@EtJ zZl=GfVnf>TnORrplNAX{Lu&W@yD<4*P+;&e61@iX21c8A&PGA##~fuZn~af$(eKi} zd%XfjtYBN0;uPi7H8SYe5!1@P$YZXzo2`{7612T+z@TB2?Z|@34eD-v3XHV1iEV6{xBgVs#O-TtHLzWK zl-<6l?sw?z9A#!h(s&_3$sDB%zCSxQNO*N-ii)2tteo=9aPrY8DCv?7Y6@2v+0cL; zQTio~y-`_9Pughtr@TU*G|%_5^9Yva!MV?Ums~E+>`Rxo7hMjm zT?EH)!8ukci)2~zM!BC%25xk>Tkp+gzlur851Fifsqkp#IYPj3k)tuR-6@6L%@{npQg_i*?``L9ar;k%#NpRcl!^ zfy~n*tqP%nqLYfu!7t7$Nk=~W7lfl3j2OF#nhZFa#*) zibyV~d*O6%#JZO0{B+>@5qOZN@JmmYvwsD>N%#Di&|IG*i>YAXwW-GaJI&PAiB>gB zdYJT$K~|*!4|3%6InFEOX%2Dd)%Z25B3R zwQ0PLc!%T*AydncM=P4Ya_A`JL?=(&Odx30&+1KU!o!&y4g$4#*Yb(@dl)3Kxb?4_ zRM(juU%2Q7Uu%Mt#3c&@K&u=&iR1ooed=kxsZvS;Yo?G}F$8~Pxy0I()o}~js~}U> zo7KLhP(g4-v#ah=KE01Iv%A^T#J;FvS|PmjTpU^YbdKi;9a=!tk&B!=mg3g>Em znB-NodfOg#q*P{OfYEpCqTs8TK$hni-dM@pBZDbPALA6wfuG%+yRt)Pw)|(By_Qk? zNJqSCF*>oN@~p(N^I~Az4fHsgFek#yuaGbv)`Y5p{MoK8Yosl+@Z1gq(ZiEx%KiS- z&6u94qQX8K=U;5ew71FgzZ1HqmOh#PiB009T{`?jsJ}&(sr~4fm|S3If35xFGahcs zpogDmh7CGre#pMpD9tuIqKlp0xAcn}f})1fwRLeJB-jPTx<*uyKKmHl6TVu}M=-i- z)7{eSS1nF{s_Bv6#D)PWvfpeSm}m)gFSz5XZdz7IBtvZ#VYnnoSO<%Iwz)zwGRWQa z@y@@W!%~6$Ex?Ux&jL$}XLdZl`b~6EJGw;0fIY_x`t}JhrM_hC6*|~Gz6>XG{upuh zblX2YjH2;j?+d#jqEcM{BMhcWaFshG3X`bzZ%l`-XO>cQhmRlx1-SYYOa%r{%v+mh zRNEeM+JBx4xL}HbSy=mD! zaHPJhytvM20vl2gszfJ3Acd3DZX)Xq0t``d>*m?S7U=O{O<+ot^K*5z2A_Ll#Nfe6 z5UY(jk|s~?gjdJB%`$BQjj5@^Ue4Q=Yz#D$o)*+Q=Q%RR+G8pqQ{F0%f$Xe-@uJl6 z7D$pdQ>vAH%Y2b4Lq_FIUJ3X&t?#h@Y?swAF+z5Q_M=OmvJi~)fo3F%yL!d}6dGJL zvR|bSqb@ASX(UzG%s+`iF3^FPaYDny89-6@p1G;QT?mE>W0ud5r4E_z1#EiD$( zTR**gMw1n?#G9e-CWSCEux*~Te*`CTQdfc<5VDaQ*pU>m2{5SHy@v}O(%~eOJ>9tQ zO+#b;TDZmtp`z6w&X?O#`^0(=79tzPj1oJ>0g+W`<9roHFdnuZo6<Jh2P_Z4p(mek9f#yj@HwTFI9@ zMWg)lNT(|3$B@DQCdi@m_3;($&ZG3;H)Fv4^v8qHq-XhC0O1I1KVPKh}S(8(n8sz9*%m0hNdG3DWI15myG1kx&R7cH^u) zM@i)L8ki&S)0Hw2B$JwV`gz@+3p!V<+b6hBUFKavzb8ZX;kgl8caa^WYD6z|6}n<19?Ksaw`FR?lS;ut zAFM8fww~0J?de8$&%8x}bjat9oatE9he0?ZcU}DfEYwHL`ElZHfgqadR~ib9_r4wT z5T-xER+OyGkC#jd6BY)r?P@<-sU?Hq5zNX>Ea>KwKfHp1xnAc*`;7%}6EA4YeGeMeYs}aRq~&8ef?Hox{RK@$ddB8CqIw z46L;+KU37*%XYz2ABfO0=Le{htBk-4)Ac;d2r{APFI;iFk-gXiu!tM z{JJ;UoBNjyuo&PfzpOO1*i<8^<20=ep(FsFS%zt(DRC(OBwY4o; z4X8AZTQcm}>ld?mymr2`61AjrM1f##;(xOV*{GC35#N4j_E_;9GH2U;prH$E`9aqO zKMQG&1C!hAz_P4rLgLO1jw#CK09U~64Z15;OlNw zy|mD5!Bkc58@ z(ErQB%tu(a06`C^Lb#ngOurgeK*`+AfYjSL6VA0@$fF5REu|GFomxqKz5%r5XfgLGa+IDEXuZ0Y+IMlq|^)j&GG(WkE=&eJ3c z>q&YA2QWTC*Ely(43M_|4jU|=$P(f)lxbaxG^5Gl0cLz8S*~25-|DXcgY{|adOD}t$FlS zh3ioqQmNMw2+N9K0_g(7XM;+i`}&fpNBDkpA#7w98p16rc%2$iU2pt2$Wv(91`+?p zP57}V^`*IeMhF~#hFz=sR7G_v>b$oaQItEUMg{3=1zLqo}6aUr@!ekwYv@+YpG}=X_ zz5PSQksH-4*PG?rkm(s5UGPjsx&7I4m0!6!;7Qmn*th|aLr;U2mB&@^lpEG5l<@kD zobr!t#9V`LG0`J>w=P4t z-7f3q+jJ_;9#yDLb+bP9pXQ>|tK(NFP&H@mx)&A{kUQ-UOpZC2B=jo)7)6HfH1nVG z)j#q1SX#WQr$u(OUwxqnjrz#Nk61K4nABTY;8cH8IpIT?$#Vm~$q1njpAE^I6|uIa z1ODtTw6xU2Jr}@A@}p_r=y>G{Ypj8D1RKc}e4UX=Vp6HNb=7UGy|mol@GJ`Z6Pk_m z5H7>>SV$G2^P!JYW_dY}>oHCPuHV|Kn$OEi`*Enpxc=KWHF@nJSN*E>&mhEbPqPy* z8#lh3RKr}-5Ep$(D=u!$@`kbT*TibR3zi<1M$H8SKWK-9MPmIYsz)Hwwp`3Vbb*&t zT{P$rkbVNPw6-Q=rXKLILa? zW3t@I9jJ=!M0^z2?_~?0ot+~OS?S|v0pzmLuW8eZz#AW2{M>FzDD{K`KTq|~vG`CE z%vM|Fn^i1pmi;0Mr%;5EHoB&jnJ`ObX?1#8%$hoyk;659fX{bl_vC&z+MOo@*s4mF z-}6F})lX<)Z1>Z-a@Ylx;EJTz0rSDEzxSFh>0j63kzskXV^NytU1NO{yyLg3F7N|l)e@4`#MALPweFN^^a@`|2{ z&#KWbr#%x*8F^k-ymT5f@Z@KLQ02`HZ2fl(1FuLTU`%|Z?~yR=UTNqzr<;i5q^pp(h5B+H>@v=I8AjmD=@^M^2LR;H+4)H_heY;|;MO%x6U#ZVUlt zahkUiX+Jl@?iCR?n3uvs)v*qf{$4d*OrA@RDzA(@ZvGIjsCiW-q*8uf)LTgI zIi))zq!96@R{E3L^pOK7=_AulfQ;H@!PO5ZdstQEdBP= z?2c#(zd!2Dk<DJ?q9S|&s6RNhoCX)O%3v6S!ixN7VvdnR4q3qA!W zV8p<37n^^v#U$C4)Y(n*q4fiZN$bneZS(&6a`)NmU!>;g0G|bq#PI`*jC&HRErPu{ z+nofVcrt1976;qVyfoqSw(ZM9k+AY*u=3j)cIIo39b|R)A9n0W<*7XXk6sRj$ai{F znfJ$`Ar`eheN^Qy^JSQ{m1Fq4k1i znj`8I375-=&ZG@IUAJ<;PidjebrFY6?1^;zY{$gkw49Swl7_Fwlk&cCGs}vlcuS@Z zPmVbIuw}EliKUF>@{M0MM)UP?p%1cQvr?gV_IvceT{hVyDh?QpS~FG4e_%j1yN%V6 zO7skV4aXl}X}a^c>rGn7{{ugRa&W2id)QpM@9UcH4MhVD#W5-cg7aRBsJ7Rd_jB*y zVp92aqc1Y%c=giXFO~_>0C~)BYDKKQkyLQLPf+>3@G_1wk^z69>>0B zQpX9i1n=N*Jetqzf4|*gXw{4vQ5l}%ZhsNr{C>K@rII?R1;SsQ!Xk=+sq}e$9D`f! zzK@h481xlN9ggJ6KVKGlLy^9;P~DO;Wfj6pO~uW1b@h>lCF^+X(D?qnIyNR%)GC%P zesOErqSkGj>iO_N<2zszl)0L8l50`1M^gHPIDJM`-tImF*7uWG_h5@7G7tpPSoexH zcsBh8_7j4{VF6q~*R8P~1TLqVhD?K(^|AqqFu>zGOZSP!<&0mpP}pL6TN3^u8nt@5 zaq3yiE8uY2?91uz|3;SSwaElnc2;GTWNtfT)|3cuyR6aWG(j`xHM<#FHLmCsw8kA4 zpMA7sf$xx9(QN_0OHKG6LX$3%2AjU{1VDv$Tv*+IcuyO&UW~y#-#J%pFvYRZE6;z2 zNOMtv1sv7P*J*reOsDt{A67aXh*%px2E(Ch)cCr8F|YkuT{4()G8y-}15^3e%ir_J z_q4;B2!UntWo-K>2#dV8KNq=)TY~$c5ZP*M=1PdE_3IDO0NqP)Cf^dSd^CLro@$Y%&y#@3}eZpYvxJ_tR{S z6yvDiW|_f0!wgB2C3185y=#6DL_d?xxT7H93ZS@sgjt@Le>?2c(KF2jJC zTD)iEIPLYsw|0GU=(3?e=mq!n^%Woya405KSq>Y9E+~3o! zt1tAK!;;oz7~!LRH`Rin6M%Q+JrY7_kUNcPtR%%O^Rv5*?_@W>q9Sr`PW`mx`LE>C z8jaACdgb@V$h;3v& z%Iv7RJi5Vk&}L4iU>C7Nc=4%(r7c@E&h52cHK0d5RzRSy^o~oa1WyXY@LxD!8@Fs8 z8u|BfQA1)5>>>ipZXGv24K-4U>U8AlK2BItKl0_q zoT7Pt`gp(AnAE!7k>;8C75%J=Oy2r+vlS>f^E@n7E7eT!BcA|Ox z#zuQtr>T0t8-g#uo`m+#8~2=_Q^|dreFQT9WDQztO_|2Kv#_(L}g*GT@N3 zPwjklU&O+iF8nRhYr>`)m|UN-&)2E}a*CxT5~W2p-Mr@BdS2mKS@;Ij2ukN@CCjmf z2D>LPe9L~B!ir;E13(q~XP80;m1wV)DcoZ#ry%11*lAHZBZ-s>S7BTLUjX-STf3s7 zB3YXrx=d|#sjblqWXPI>hw0Cb8LIyx5Iqo_+uOUyX(&~PPuW=Hn8-di@-J(jF_h^n{D)b+d>IP&I!ssXFF zEr&>w)^vN=NFr7V<26^aQGkFec3Hh-lYsr5U$xUMMOkA@n<_wF0X$qqg@QIcuntZe zJe(Y2B@w89gq>q*0<=u3`3N$;2(2DizMYN-fZ3|w&bg>DKTz*DnXU&C9q)a+(eoD8 zJ5?;2UhGkkdw1H}$TUiQ@hLG6*EH;8WY}LkF5=4`n?kZPC>vh31+2FEoGBUA(F zqGTt7UVJNqi3o6B80P(M#M)gD+aE3LzXt1Hp4SY5xJnzV%z`Mw1_yb${eP?=asc(l z?SW5QH%*`UFIlsMzJA};nh?Kh?>7O6lw)UfKF2MsU-?cR)y~$AJ?iwm43@2EvqVq(=RPd@?Q(jM&+jpG6^j8w#2)@i8;&EgTJ?vGjWhr7(mT@(Y}2)pi) z8$8mdVN5~72C${5t@6-FWNK&EYE*>pS)nXnt$%3!1=CAQLwkDO$?=Q6Z%qCv$dS>4 zGs|l#8<&0OZkdf1PRp9$*6}qguTe^~J1)X#N0AnaQ>X z!{9`dQCk1*{L=00Gac1^VtrKurxNm445l{|!Z^DjVT^opaAp;b>*~O;aem_=*b+RC4##WWvrd}YoR?GLALPw;8^z;O?l13-8rks_Q*n@alsr;H2dRF zLd1;7Fi6ugsh4-Q&rme9;Dyu2m@M|Vt3&TPN~V}P$SU~>gqEaqs*1t3ZC4mQb?ci8 zTuzs=vd)j%e2H*m5tQZoBXtQ(i7)TI9T1+sl85I+I^nM2QxQb(v9Fvdfdt%vfSxsxr1IvlK@Og}l#$!R-jg41&-a0bw6_eLp>Ox)d_Q5* zl#=306mb;(m0tKwTM^rJ7P&M)80gCsA)RzoTVG%ATg!|O@EC{p29BCzvJewEBho?m72#4-WqCL;w3%;Mr&8ej(es2lm^#O+KHs zJAs$do=I_62@W-IC-@{A^Fi`llYe_i@is=0PLy3wcVe9A+m!T-^|_eSh0Ii9>FZWx1u|Wl8X5I9IUo23eqboDE;B8W8@c`mNVoND1Wx| zM+0d|iqI%|V7)di(&#&Vn?3DdslNuzfA6{XmNiWsm=|B>4exKy!n^z|a)0(SGa-G; zBaEl}dNDDSLQbvMv1EPac`>S2{@}x{D33dIOjC{N*AzV(%Bq=~d(7+ZjqsRFo@jBf za_QpWW5M_!9X@#JQg+#T+lMw_jWhNP2acURtuV8v-n`**`+K`B zvq;{P!oGjmnH|LQ3r*5+%2b|Dhi(Qp7sicIL@#9)tZO8WuGzqev!}u7N)je z;M@4>@kF`8t;_ZL_r}F><1MP_NNXWka!kt2Nn|H{Naj&?k6=Q9g~yR|Gv#N|IH3Jd z_JDInz_6Eh1uk)Ic%xQfp?&7{Lr)rmRzm|j{O1`N;01oIZf5sd^-nGVh+@eCRgxrG zsaPRI>3!k%*OJP@ckH9>9?Tma^KZj}5;aPM@v5kPRQk1fJ05>57e$GMk2J>6v(ug7 zv{5v&Ii*AW^Tk86m9{n^MDg?Pv%@)jV(;3(gm4z!DGX#6Rxq^Q=A|j?qPv~$V}l@H z)1^RZ_b(jCUNy6L{9NhN<7kSh&-`*;U`K6Ad3=diou>hsQA1BFx-46|u8)~rm&mSn z^jMQ48R*@qckUN<(vZW`{8P&;1Ofq>Qj`=l-uV({W4k$@Q0tNo7=imWhORoKmST+7 z4a^`%hEwK($r$bh4SD+Bu(*N@iNb3W?KQ zH&O=`pJ`(UY~YFSchLpYX`!i~Y(>L$YdV4V!~KM;TzRWCPtpaKe*pWb0~;~M2j|La zT(cjLk=j2gssD6B{JiT;?(?EegZveS=o;=}B;sE~hTE9T9QF{C;?1;aUp z3oxtgjqIHG-1^S2{{Fa*li!M=px#HaKDRx`g`p#Ak#;JdzbrB;c<`vkGslUmVAM6E zqr*2hetrs!eqdC`<9y5SBu&a+{-jP^WOW3Os*F*J&~EvF*e)mxqyWqnQzytyfNULR zlG zFA}?aI~Ax_NEhshTJ>)B-)ue8#snOcpU7SzpPKN5{xeuaQ~Y!|FB%Z_{SVaiUzxL> zX$8zJ#>sXa7e}IkF2|8d1Y^e=QX!^_R*zkk<>FZ5V5DE;?N>#sC!Z2-zG4i_Shlv! zKp#l`BL1!Jp@IOtZbC3~tTkSxKla7lAEw~R{bCEr{%=Ehi9lP}RK`O*=QUGfYOJ1* zy4mAgep`d%-y*Bf<(>3!q(Vf$W_#zxK|mIc>S3J>OZR-BzzXbLzNm9{Q5Lfmy|(?r zdPE_;Fy)fCZNYcAo_E46H#0M1a-N&^IQr9Ao$%T?->IlRrV(xLvO%M5R=n$x%fsu0 z@p71s=Gli#v7;&Txi*Ppdbc|td`}~A+a3*Aq9m*wxGI85W&un7zJ?08{bbfU{2KzH zX&>nqpS-StgIbijdL9G>WfoE=_)nWbIM^&WWpW2cd+Z7`)4%p_eo9MIe=dQ&pJUXKIWb%%;O z(Q~zL_3WqiDW+>kGV!lzw*z;5G>U!IX4vP~K~V1v5tEna8u}3aQ_^b5B`KofZ`=s`P~LW%bF-X-u=)#fxOR%~kLHH9MfT-Bs%mm6Xkr>a zoT%9Xu{QX}j}qX#nER6_@xE-Q*4b}P|9wf%0+A)J#!GwR(q^nE-dT`l zS$wtqmMz4Qy?uA6xcMBFE2YPrve^7oHk=BUUH4hUJsijHffU0bL>G}Q3rZ?Q^vWkL z<(KK@ntexb(!WgV5@~sH%|{Y+0nQs!Svs&>UViDCJ^Hrm(qi6J`Rw4Yue2|f<$`n& z*Qu*9cslN0eX{L7!ROySgv^z+_9bNmU#@g8pj!0MNhd!I6`9Y`&VvF|5n_er;#QpD<`mhz;;$fkmCSRp#G+6yES+;(lN_&cY)(v76?-J% zq~yUi=jmU6AVM<(6&wG)OlTpGLAYGt(zgf%QQvW(Ss>kScknMM;Qa_nZOb~>b;P<+ z;2@hStZ`X#pcT~Zu}I}9&t%1fa6X{Sq?x;zn39|K`wh`R+rW7%c!2#e`5)WCqTB|_ z5?so*_kWzPRw$; zGLM7xJG`;KcntbZRVX2QOp*osiBdKzb+66%G}AQ3zKhWXhym~mz<&@UU*Fxg$>rt> zl`lZ4qwbN4PW&5g*bLd#L7W2zquLQz#_)Qdg_+1< zsPQv~*OoC{Igt7^l*ooX`R}sML)V4~5Jht^aHF{bgj>E)v1>*y8u!i^7XTvKns|o$ zj3x+G9gcy;j_A8Er!BnL;}CcuWI7(cpr2`Hnf(iFS?AaDB65fVBKnQq*7hAJyEgY8 zTu%yV!nj|Z=H#%=_W$4mjwXIT4#=43KqlKzBAPQ|}ygTysm@MN*g-H81G$Kr#DJ2wEKgDwMQUQS9Q05OdjK(xIA&FOo!rso6k zQM2nIT8h^dcWJ5O<>nm!7#BM_I>EnI+&C!!y>jRO09StlrsjJ_DLNXv=+wKq-%hh< zvltpB|JNj%Yq!uEq$JP$j zM^*K#jo~e2AVy=<+a?6L;bVePRp}cI;37vVyL|!rp~LZ`5j6|ko}m+S1foMcr$#OcG=#+^#Br-EYBNFjrybRu#1AP-&alJ}84E2MG;QbmHe-MjPb|_Fi9|aw_PjaFYoU>%l`^_SVUm0OY-w|+-$AYQ_O&_Lv3Pk<)BL|BiS&A}(AFYK=|fQpu!ZF>lP^qre+@RDiaSh0n3TYV zqFB@=t?P_s<+mOtFB@=h*r7s%#OmrZ#U{UYj(fgN@=4pS^x}I~3X5=L*_*DWY|{Ih zVvWB!F|yo%G(kn6M5A9x4Nwa_vYQXkiIvYhimSM?J(+qt8A(!jIR%CJfmRR%@kHgK zg7gi;QZNpiKHj|0WueY-%k7;RUuh2r?2}H+h#?{g?i{TCP(_)w)&z3c`*b(dOz#s4 zYtn1sPFj*0hsCIUb12rEoK;uyQI{1>5AG=kdwlzpDjn{*S4|-@8Pb84Fo)BMbY#{ba}j# z;{2!-1^$GDY_8m#EAP1;AIzvqc+SXWdK_Dn%l+(L5iLE?LDRN%vvGsF2kb?vJ{93^ ztdLQvp|(zj=E-dU)0hkI1b*p)`cX+4h}gVxt!o(HIxK}FZiKnhyw{=b*A~$oEVn|f zku77wCpM46K{b9?4amonBhSWeND;BH*isr>G(Jr|b)cepD{EvVTwZ-xaShm$6gp4@cSHM*&PD}3E0zd5N7 z7CIWs1P@eiuf8JpRZjFuz@fgU%K>rAk@tcMAkEw0`whNxnb_{VRL1WvOUPn3`g6@m zcp%Z2BRe^Hqgkl%5AR@`e_uhI1UyCd zg`wf4d~QgZpy&PF6{ln-HvLVoDPyjIGri7nWo4B@5Qy*qlNX@i=Zh!c4IH(j0s`D= zQ!34jcF^y6ctDa`VR4g|y-NfL3?+{+_*CCno0}rmoF+0BKdTXU^8GE}UU;76802tjpulYFh-5fwp*65J?$0V?aDF9 zf0z>m>y@RydqUhTk6#pZf1+V7O4;ViAg^B}%tW1uWur-_LCBN2@Bs zi32c!ETREXuubk5NzSwkJ3ISb>o1Gt4~GFexCoXB=&4N}TWX{GH`y}Mq>IYZjwl<& zJHoE;2PG}15A^}ol^Xp$-<|Kb7jRb!U2seE_nDOweEtFDaBSTbngTu0w0TlvKWjePIckMC^qBGrF^BwS&m8jS*rv&t(Gf zpL&HT3;hUmQyFy1v7NDRUlwfJhbF}@a%#mRhbaZ*L@Q@vIG{RZc@Uuk?Q#F(n9vJQ zCz0<+QRky3WqApYKC=_jN=vKC&}%!hxkk0$WXtV^j-HZ875tlA@)Wi#nrUnTzK^s>Y^hkd5++=!BN2c4`bdQgZ&nDF$iTbBRK>Q3`7ift67UsB*pN2q;2}DG; z0|$?%{0aM?p6)zX|Ep{vMdS+}P__`fbFT>jVEsQ5QDWP8T!!DL{ZhZF(j|=-DOVV| zOjW;-cSRFeu-VtHu6`Q|To&6RWPVfK)%v_1 zp;i68n9k6&fei0H$ymL#Mg?4;t(+k-{s;mja<-`Ph$0Lld04o3B)z=IwLMFn* z^qQI6-@kB;KPqB!5UAeH+HHDMqQK}cdang>H6(E#OJA|bK!lzrMZdo0ZdvLum_#NX zPH%GJ^m*jOPhVUi_#8DfCw>zn%Bc~+NEcQt+xFEGPqr}rYGiKdw4>}Ro4+!`_}R#& z>#XWtKB`1eOzPCCP3ezMwS938CG+nq4697;RE<_@Vr1I^^uuyvjd|qHP@)uR(P#(S z|6UX@=^by0mhKXQ7@5-Whho`1=4mfWiw@-r4?~oF1S3C{7D?xNCQGE2#fEV!Sb&xm`;TUjn zfhCD0pAUBzx;6w-z$qhWpw)nmkwz?4T#|ls_iO~^$wQZ0&sM6oLn{cj__IY6;lQEM z`o;dXl(f|9(B7@~XYtQOkbpG`NDkHcMsvZ#Ux^-ls`Z#o* z2x_J^)(s!{(4VGSjqhqbSX}k`^W;A>3qghrV25Euj0BJzrXT|eUPFE!=YS40{l zo$a9ISzIJtH{U-! z4#m`2IQK*y->rYcVGq8>6*7M1zNlgN=##~walBQrEvCs%hl@gj7HNK2fg3NVBmAHx z_3N5Dr}B@hx8V{~QcMXXJBX&Ecii}qqgDNQVhG zqbh8=7(ToBZv#g!BU)ncYwp8;q=*O=W$kdA_pG|Vnz^Dq!Dat8i#?=^N)}ny>=Y|F zmpMfFw*iEcijA8F^N?wU)}A3&#k~ZxS5B;m;Yz$nH4z% zXOFxAEesPqpe-UQQ0>ENx9Ja<7cHcK&Gw<{Fj}m1*5n_z?BQ5AzX31dj`Vs1YXGYZ zE{J60DcH!siM3@N439KOS_mZ zf-3uVmk4U(sn8qFpZgSl8L&jFCY*Vzz?5`tu*$d||10K7CgC2a*Km@99PIPCylo(* z7!xT&AmJ$fwdI4cI?XO?RXFR{D|2;x1Zh z)zA(vO-B8zcH{c;(vpY8bkU0Q)3L%C*Z5!mcARp;8SABm$w8ZiR;awik>sPQqZmPU zC9!ngh`d5r#OorDHI zbt!i|GYSyf1zmEg*WfSJM}&2|R$V?9QT>HV9oUSR5DxFHCmq*y59Ixn+3XIv?dc`Q z8Mi~!A-9Tv8%EC?IkgOF;cp|6gQ49A8};KKZ6&cNW>I60XHk;N z2T-0qta-L(I|)CTIn|DKe~FAlN1mnbSkZ6f#Om?i)qf_#LbMA91>i&*)YHQCdV;9A zm)E{#P|BdqizYYt7PwPyOQPghDSo;M8_d5oIZ*g7*l?a6&QQbo3f{cT)7mgg{Eo-T zo5k74c4_%#|J$BjXPXTqBmR7%%mKt*^`wP7eajoy*0GjKlRtv%*%g za@mGc&KybYP}@`)f!2(V*lY9CKW(Ie1)a6xGcTET0jYM<-@$WVYXy8rjD8V|(6BWX zx#JpCj^+$+cz>%VSMF>Oiwsdt8|Tuh7e|R`@TZe`ME~rUIby?5?HKR_EsVwPc-25$ zv!gF%6j;M7@^aw$cb#5TC4I3d&D$$C*E97}Oe-`PMm~b!J|l--=f?DkfDFw~+9j z^5rCfsLoK@q5LI=^||bu@y}2*zb2QOgetk?5X@%@q%2yxx`}y|UeiC-L>bm=v*5|^ z;}19e-9hH4KN&BM#2EMGg2lGdK3W7ScYuLf)OXMh z>=c!?v${)HJ?SV2i5wASYM_ql74#{5R;F*vceN!;_}n^AzA*wIpAY{Ewz3CawJI%E zWo6~{^?HugKY~pBxNZT2vis`{|BFbu-}b7|0YKyd`d)OVlUfs$ z`k66mr{F18iZDt1wiK&1IZw3kJg<>y=0i5=P1Hqvr2@FOmvyDW{9JLX9aAVf#MhvT zlIzr+pXzIZdjxGr2Ws`X+^s%p@`n;3#Wg3mS^@vZfBV^!?yLrJW4{~ML@NJIkRX|F zWdwcTinW&|y9=*xO{Rj9IGPRq^j}y2i0Vz+nflwCRP8AlcXUuw33*_S%)p%FpB0g6 zZ`i_%#uizCpPJP5M@z#G4%@L960AMn&K?F# zSs}gQNY31jnFE9!WC;=$as1K8JA_UQ(7p5Gb;W% z{0s>+Bi`@gF2V{luHYIK*>E!*w|u=NTn)d`s9xLA-FZ6zbS6BDlS|Jc81h!R`mgCz zPck>{Pou_v7fJ3(q;b+=XX|KT|9&3gJ$b1GZNr`)w8*RKt6rVAYOQ2)2AY*k^SJEb zIHg2%W{$S0)fUMaKBPvrUPhz+)vkbsxsT(ufrlvLwA)T>dW~At2yD3i=5@99htGqY zFGIEvmfsX{t=WwBh2PIBdIPw1apmlJlDnWt&L6TkndY-G8mR(hbH$9#&j)E*ZQt<& zUj3jSpOp2cIfFeFg$y2H;Vz0AUq@eR3tc@GOT+_N@_-58(cbkMt3T`l5BlHU+BtMu!WDrKYRS?EsDAjE9>&C{4H#L zgWn_8<~5;kr;Fc=XG+_uedKVXum4t@sKq4L*2;lhVb0FWc6xH)8TzoGnPe*Z2E)ZD ziKvj{phl8J_eZ8c=;;Tu5gbfKbNh)Q*lhiArSjM?sOy({QU9`7*qULkx=yq>X_q0Z z5p(i?Ac^-|+a;o306-b=ka*;k3SN&_CR1}JP8cnWP0dZ%ZWC73%x4yVgHXJnu)|@{ z)Rs2^jd<7{CtSqlHje3o8z~BOT`XIaoG#0(FS#zYjWOzFSQV8Y&=Sz4`5y8r=IaqE z%uJV>G1s>Y^><#FV17gaK8&5%|(Q{|EYJ*rbe*l?KR$I{8U z?Sq^{bx%fv+L&L0ZMYmhQbl0fD&Ag@1Y8Mg9kMUZ{$W?#H<}2vew0WPvkU#K#kmX_1Y)P>S^2U0$$gh{r#ZCmCalS>x3xe0?B>>^onV0U82fN zs0aTbxL5wL;gxeME+1vE*`b{K(7dXO!nbdzxE7DB-?cS1&rE~wWOiTlX;f8{Vv44X zI60>twx&(bhP%?a!I$Z(5a_u2guBwfFp$tghllQRsoiFHMf#%Fk=JyyP5#K&5sUc6q&>)hPF>HKjhVd%~;4yR?q? z`Sa&i0Z>%GcZqsW*p~8dnW1C>PoE^PBK&dx!VmbU`Al#`CG6+ys;N-!Gl+b~Reb&x z?XzoGD2W1##rC_8&S%LB73}FT(glQvo)!pEn>4+^RslQbhyReq95iz2sK?kys^FN8))PV zfuH~E`lAy*9pj7qJ)4ac9i8;$Nk@`0nM^L@L;v<4eBM}-E+2JF)5m>q(9kMMSU3_R zBV*)dh@YR0<(uo@7OFf#S^q)! z1zLw{JlpbP_*WF{kN$fC>sfz!$K##T?Z}*DhbotEk^{J|K>VyPP;ktq8$YaR#j-n? zqSuAMsY5{Xm$s707E`8+K>dKq_-IAr+HY}E$8wh0XKU;F)wXTmQ6g~JLX3Js-b^2Y zYu_uL{u|g2*cd)`Z5AKSjpQpt73Jsu`SSbu0hy(ZlJ|0UaH^Qd7{P2*}6( zzfN8Tv<|gkU?1zvV5pwI96SIzIkiR}fs4<|#gIhW_{? z189Knn|RQgL+=4H$c%)|9zSSGo_+{$y8dUkE|EB{IgD`E)GwWGG|3d?`oF!NRMMC^ zYde?b=LZ8SIE>Td!^3$sH8rC*75>{>TMo|7N6PJ}(d(T))kbXV#5}ig!1M+_`yLti zs$y0D`_ufV=aQmFJbPHS2MT80;QCEWObDNNk)GTycLwc>`~f|0Kqs6}UXd{g0}D$+ zUthoI(v|uRMQ$xj1%m&zlOVVIQU4nrz{cI$=#xOk@c()jfz|=5-)3jU$?#FZ(QKQW zo5ElPfC}|<>Fn&PLPtwW%kXu%I$cam%xF|8>W+2Ht9)MqZ%KMpTdtN?9}=eNu47#* zc95v_`UkNlS7Aj=4f;_g2^c!RH`cOlVv6msf7T2mRmglP~I)@|!qBHvk{^^gEi z;(u?9gPx(gsw>B2anLp}fgGHO79GA@$kPD!SK^>izR2tms2kB6nm^eNJau%Vs(QU~ zt~q=O3p)%G^$&ZOJB$6TYrF=rxL0;+1|C88va%{5#y056Zu7IKk|PJ z#b+zW;8$xVxy(^>>#HN5R$mKcK$gqvI=is2aP;P+V14Rg*6|TNEPvHSTS)Q9pesRn zxFuSUN)|BDcf=%L&DO2y^~V9Su)Vi-yv|T(v8sw+KqPt?ru2~HVA9>wHU3#!mh68F zp1>n`>1m-c1tRdtTt`K;PQ@Ife_n2GONL*E-%Cq|o%_zwe$$2%kC-FP^)KR62jvgc zq(x3(W{RZW3Q8r6hSPl&1k~>BW8xRD^5svJIArxZc8mWSa<%JvQ_3Hoodq@9Gv)iO zm)8{ZMjBAc9t;n_^sC9z)rGT;vJ5cmw#Elj<613VR9Xpz>Qu?a{55e{!$RPo@kXZ& zn;x}6m@X_O60y>?C+BUslO%H{p!;hVfhDno`(btt%s`bo^P@6d>&$sZS^-5 z$NKKeUPf^CO2LG!QGowo<$>3q|u=MTIM`ZQv-qUj1fik@uwwjd}QPY0)yF_I%{kp%p4I-NsBxttQ{O zBKLg7aF_TYG1IK>szSxj;9C(qLx$^;Mwz+ z_Yy3$#mR$eX_VgZ1V2e{p_n2}U1T~>JA zzcf7G!Faj1lxsf!8TZ*C&z)a`$VmPxDj1^p%iVI@j$8H4zM5EC|8FLz;#gNdZLv{L z8PF#E$+P~vKPYebB~kIplzhA;?IFmwcw~7r>1nvq4z!xvx~V&6=Z3u+k?|GSFe&NI zyZr^(wgCYfVE?4g1&k@z2h&}zIln6g9XDd&r4zopVhb(cPL4Q>r*<&{CVJTH28H2y zzFS>3tx7JS&bmlu+_<`7eK9k^J3X#QmTotn|nhDj$wLC-g> zcVKx!3wM5YUPayUfk8>b)0v^9tO^{La1N*~rd{3qabI*QniSIxQZg8Q27j^8%n?HOJIF?tKi2N$}i3@Y8zHFS#1 z`rE}?U)Pic?~lvqT9Qz>)x5Ct4)*pfTw5OjKZhJ$IviJOZ1Z|)IplUe-^tOj%e+2d zI#n5vnu3UrkFQJ9S5?KNp`jtvU)O)s8=TKbYJ@05=ax`xwb zOjlh+Iw_a)CD0}Amt7iW&UUh8c_{-o51h1B_ek6?xc}dsp;~s}Gk$?LV z*Y|I04xB>aBiT58UrTt~_h7#+bfpDZTfu===iU&9H5aI`clo5qkWbwEdMF*s!jNe7KH=hsrMB zlDt$%-_R!uMe;m{ufza85KtuWJ@4GAV`8c0TML9 zVQ>fz!QI{68Jq-{f#42-!QEYgySux)JG{>B*?qh3{o%}+GxT(S-Sbt|t$S~6*R<6# zj|}jR{H}k~SNaQjU~y*IcRACSt)Sy(5oOrqtbNaEUrLA*7Eo4qy58Qv5`ugh)^4^{ zQ^%hR_^aoiwOXyzkZS4m{e45k;dy16a4h<#n?U)v1b=$ow%1ak#)(qBM8$|1-`w0B z7@s7sr6nZ|@zRI@bf`e)aCILOcGJX{_u7RtCG?S#2-8BC&pM%Cu=Mji(Jk5^a!22`;yo{S}5Qb znjb5%1meQ_;#(2gg0DH}QkjgPYqqnE1V?Ut?Efi~Y?E6q+yl62l~7Ibho%a`QKP>1+vu#K-0~!gf}vQszlbg#QFcg-9~T=d{X8F>aYP94 zTcggqqQ#uAU~y1#Cz;b>^;BY7&fAQ3lnoUgq8atMZoBUF1{S+4#XK&Tn%lu|luXZ8 zE@%}pQY}c|{rs85YdIgM8Hj+b-$_-WCk5rJ6-=x1!*05unN_nx4>q_6Uld3B{U&WM zkuu1~$AO^jE%gvRbfJ*kqU&=m82fCy4nB2K66q+TmP$y+-6V|p7yWQ2&?nv%iR$lX%FntgUK6Yd6Rb9pWHN9 zV~=;PrR_$)sDdBX`SUjtTyb6x zS@eBSExPVHALL6@_8rBbCS23FN$JtN_@3_hC=mHj+dDmz zVW}_qde+>>Xl9`|7uz#Lp{#4zABJPq>!SAHayNmy`k`xpu8)s!=vP86h6kII^kM~l z>SAN~E&2>Be)H2PEG0u@*jehRTN`D+j!fFV+97k@%Ad2LdemKb~kno2F^PSnt7C#+!oa~2#9qMpi$SFE>W6t z!9XD@;b)MAr!*To9{|WWU73^sn@PRZo-Adi4eX#8#mEsa#z(QWxSOgWGm10JnJVc(A*j3ITh#{~4dTER*E}OiiMNID7HZQpMG~BYE6c zmtnM;l{%xbi`?7++YE1wh$~*sD`T1taW7o+2VZmeZB21>r z<+9G~-~j1hzqgoX6X|$4Own|t(&n;`=W*;=oZwL|GMz&NoT0~~l!MvWtg4 zlsuDYD{|C7Bubwk?_T?>t@Z4)XiUhprfZbr(OZXxa3&gw@D?^C-{`9C;-z}X!H*i@ zfLoE-G3Ft2>$LbU8Kt>fR`B0>pX*(Bj9{Oi8Iy*s<{HCNH>oN#O1ebEm`xXi0q?tU zn-+&2i>eCaTW{dGFjw{#&t#^^+6Pwz2pNU@&}z_aQyKif+f^ zq#u4v561$&DKPo!klp8SEG65Y0~qymz9e*OSfg=&$xV9M=T&t-dQhf06^FPxvRB>m z;NF`qb2uE~6*T93hA2geIsP$oD2=^eo&l&U2Er_WzF`!^?W9od!+0GC7^@MCe0pdW z6M>B*gd0Jt?Uz2CQfr@8k5!;F5S&@Z=r$CLv#T^a^{@75zMBJd?T?zT{Cp3w`{d;KZ)mPZYH}LeP#_I75RcG0|-P==+)|`*) z#uNvpn~0+rI$A1p`B9wvWXfmo@)QeYvBuO!g_8m9Cx5dlQUYgm6-D&azf?W>9s`IRUvh%d4j zb5@1*&7LGO^~C+hiTCC4Rr=jHBZ1PpaS7?`IY_k3Z3}|6B<0Bk6R9R;Oi6heUcXdN zLIql=(%3{y1Y}Qol(Th1cQRM`J2$APJ~~nQ-PSGS*(Mxm{BXDCk>!6x2_q#5VP;5U zYjFQ7D5T9>RdV zD{U#-xMcbZ`RkFF9NX)1K}F#K2$Mhg!?nqe|ee#MCQj zN!w`Nt3S0xmVYXYzhZklT9<)^CdLwoT+VUuCIt=9Phf)YrYuyCp2iY^IJRitc?w)ya zsVnGQX)9N?Z zhT#aT#_+Mi;k)}HhQW;%jWZSW!m^2@lM=MS$z61^Dq+FHdJ+*s2Q-*H)&{O z{5_W2^_LMiAjH-ZTP*`2cFwa*H;kCa=l5;vP^Z_DAkOP4CQrPX{-WtV(bSwV?tetw z5Fn5!td0rT>B$1S7O8h_AkfHrdFY6dB1{f(8 z^v9Y7cOa|+TMl@q-3_Ms>Q0ax@QelDQLmmnruUL2cE0kya*#-VA@ylME5AijnKi3d zDq7!1^bt}J{2Guq${`5dPNVJ^oP=XQ$7Xu&z)v1qC~@DEb9*6Y;H&k$ugb0TvZYkU zExPYKJuwz&W9)$t^}to-F?n2ofiNdxCeEPa?nwq10=a9$Ayzux4___b4^~BHDKwtX zH`>CC?Oy}v&QJB2-pjg#baG1CRBTJon-5cyk>?bEe=n`C5T_f8?U5%aX_$ytUU=iv zidi#KEJx8BRe5foT8!($LPOw(mm zZ7F9&akoWgqo|)_S!wC_QPK>ZuFl&LgGbjStW?@eHd8vy^%>s+dQk-i6{XgX8pkS zTf`eDp3Z`aDxf&rOhP<`*E`;^y%|dw|1T~;LD}qi-YWml}{*4zYMA76E-%?d4E+DsdmbZUdbi}1Ym!STGFJp(YDNZQPc3lxNRw>Ri4 zB`&>V%fQ!tH)ZtFSY zrla#cGXC0q~iHLmp zi_KX;Zwe{QIJ|Y(hG&8vgcfiLskpo`O*@DdQzLgw_l|GSr*x=0w!C^H675pNpTLYB zr5W4*lB^SsKTdS}eI1GSNrURdUoZlecp*?m<_%VVs-i_jx@Lz2LBQHv#r<;xtazG*PFwe=fa z4?dYsT^KeALE2Q6RUu)NL@tcBOwlNWbDC&B;Xo})_>l12cFk{>=zn0}>ACxmZZU&8db6YQfhnU|I|iy3>pK*G0uJY-7$-X#F%6QsgRxewd>vlybD!fX~$FQVQDIm~%b2ekwt7ffM0 zRQJV2Z4zYk^2e+5K?G|=DTOFw$P@aHY$LikjSdVFnfm!0bn#O=j)Xy#=(q;3kI6Kf z(eLC3em{0Gy9zTN#E3xBnGWSGQ4)>3!_%sQcYChk z7Y?=>j=qjulMKzRC^)&llL#d%&-(2tcIRbl0tx=qwHjCWEB9%LtnDFhUt`x<8-W@B z!exebU$Qs3fU0SYhYZ5pw+t(h_Ev6jN6N#^Pl{6L<%fS-Bf?Uw%b3rH5HbsgOAB9j zhxa3xIJjZB0MKg9J=a)*>vA@0iul99AwQI;pO=YNKvZtRI{cc!P}lGdO&>9UxOwIN zF3h>P&4BIovS+dRF(Yn?*O?qh@i~<>L`!lb04mBDA&PL|b-Pebc7Aq)bqFL>fHH5D{;zSS&Y14SKSf>YExch)F^LLd}B$M4O-R)kuLxpT5<5vl^$k+!|NRq==(bI%DDxsK zInn#(BTmD8z}5T1uz_V_-wl>s#^m88K9jf1NdVD2RORyR0^KHM;Fm7IoJ}J5I8sz| z_4wKa2zLQRg5S+fbv}2AI$jCOr#O1|(S2(5`TQ*S_$fvbpWlH4D3Y0yq?RWtDk!4u zl&OiT+!1!mHQ19aP3vDd+F;W^+|9ol1lcr=w-(}jF`3z(W zCnq*Qo#k+}MdQJjJS0WnMF*Ty)T%UJ5M`b=IAf*0fff&M8Qpoag$g1G*f+2E0b#GU z6wODMlwL{KB4(FBr#UfNvM~X5;@ILT0G`Eefiv1txTi{gwkqB zQc#snPPFoC7rB6%2M~jecP@sJtmydPBAqCZ_)_$~$4^TQ_CY5FKDFe$s3ykOK#SG< z^0e7?8!7Bnfb&Yihle71aNxX^M(xn&RnZu@^dvZ;5V&z_DQo)BRqf)O?X10D*m6*~ zlK2gWetL#1p&zVwL%ejtT2$b?Y!`90^EYR{Z2TizGFNXE37-or&?K&i>6XIh#t6`o z@y#gnno03kJPjEspSPNtK4ioT|A$rhWO$Z$Ta_Qa!Dj_%kK#uv^}M?>9*Y2BDM@N( zuex%5qCHtbqa=P{fcEMEVQG082^m?iK*^wLe$1jqtKRNSnoLko5F#+Y9t;Lo$H)v` z)o55JT-2=KJiVp8t+*Rb>*9GJD~oU-iQE@LC;c7c`|PGemYn&0Xj53(qL`-BJC$V=$RLKPzT^f9~W` zi5F(19DkuHE|NE7RxLkjLC%ZvqwN@WPv+Z56~jV!aG$i3f1j+us=^PO)@k|n;iDN3 zL<7A5bBEFA(T17NEdjd{#sD#o(a=fNl5jd}M&M7|q#H8-ujYe-*0*5aR6UGTJ~bf> zgLg~1;-#$&)9}|_5e*-Oh-$jtW3NY;#*!r@GC8}hJ3;Z2Es57;|1c<7psuk8-``GG z>8o;;S9pT*dG&d`acU{0{{t)W=_Eod zc3xMC3*58g&HcDBqa$;Bb*V6aU4cEF?Ed7LI@1{gAI(hvfkVi|lq>hGtCByPuJ~_6 za1Dw7&hMJ^qaz0lg;R&UG!4zjrpU4wl7($Ejj-p+fmun%yfE0k(<{KTfjn0x5m(bWfTVk!bKphY0CIkMT7YISn(t@C9 z;^zC6_MJ46mBeI(w!2=Ah40#s|MvIqPc#K3 zbZa}+ezbu-h%xEfzFhr~rBJ=Vkrt*j#StwZmvU=Oh9kWysWu$${PC&H?Ze$GEn3)T zqkOg+-;{DcYa?uzGk3$I5{WKRv2y;ycL86FKeGjT7nY9eF(%&~BEFj2w~ib2=vnO( z$JN)boi6%ul|(FXeN!olgL&OS#$G!OThYt@UbcI~L~&;_>%DS6DhcquXoL_r1=E~+ zax|pFShcZ{0c^0Kbb4)Hzl_R(3f;uO69us{GMeXe`h+9@#bVQG{nJnbT9jl8p+|_) zubPzS6aYv9d$5Bhd6Fpfn+|h$vR-nQ_z9 zq?q2js7~Tuwgq?3mX_a=8tyJNjWVKt>cD&jldm_djf+8aQLNnm2-NrIPu=XhQ#0n8 zQ(g^HJ=T!Xg`^0YIG4ktBeS!ci%+cC35JU+t5&wfD58KEF5P025eeDM`@59``}5;v z4K>#Ax7ojYeKHs0FM{j2a=$+i9?vnvNtUy(JStcd56*f*-qYXRobAl@E20ojx!`1? z5=Bt{o4IP8hU1g>1hBm*##U{}{yEY#4zF$;ZbE`2B_O#Y^6VHPKf;`kvlR-2K-@86 z(CLj?=)Jd&4A%h=`AXr`iTd~!I0h#T5++TcqEL}#4h~Azt~p9#*~k-4twxJ7t|E~A zI56>;KeUXw7CJr?^8vGatAc`fx3-kfA*mRmIMB+YuzQ%0BxNGT=~fsEi4fEbbFgqQ z(rC1ESN}TPi#wDg^H96od~+lA_U7u}Q*n2@caXA`AcCOE2Q6%FP8}N?QyBpa>lCc5 zzp1OM$0j7`sx*?3k)e?C5xKhFx}+-K9A8{q*o@vexM(1i{(gh04*o%D`+6%KuVKo} z#D|CeEFwd^(iciGwmY&OaR&5o`uF%!)SNZMwwl)y>Zpq}nH@#Tc5@)4RkRzfQXxum z&PJHFWjy{Hr3K)%;V%46_3P2=r&VO1^kk-B0ZVwq8Sf#)?*8WI2c=&K5Piur9hGmd z!T!A_(QAfTdYipB<$ead*}8a~LX&}O=R1@*wn*CrQ>}ePRrhO?op^qE%oWy&>g@~y zdTP|;Q37|%v2B;|mS~ihOYcZyC9$bD-HzrLgKfN`dS1xZo(c=brzl)6VbI^7Oetu? zv9{!C6^eY5U*AUHDj{UTJRv`K8B-!M9v-Oq8uuJwD(bW&deJiohs<^@u-V&Kg9Dkt zW*9}IKaVsu6QG>;xEwR3~75I@L02FD@_ba2a)-`snoR1DGgp9*5B9ZvBrb43`o?__ z4xdk~O<%b4$hxe!m>*ekrqq}E`lN4^z=6}uYb~SWbOgvd5anUq_ot`85PJe zqVX{&IUWtM2UT(?Vk9JfkSr9Wrjrcd=obJK<{IZ~aN&Y22(cGcZ#g~<0MsdIi)Dj$ zpEcxYmd(dNi|v$DArs4}(0*Y(S>1H79z7tsu)QVS03iPR%c{s)yI3F(ZRK|uVp^2+ zDnPi-Apr1i&80l!W!r_-mU$B1XZPwRUGk{4qcY~C1$^-}CoRQ1k?9c>O!ORX=aQ|* z^CuD5CwHyd2dMVeeLTHefgK9}pfB9;BWYE8b3QEQC2uPPgsd@!n&7>cHnL%>Ez~LKIl%Sk>K8D}< z`ot^iod`LN&AXdK@p$(=QoqgkytCg<4+)*YJuwNrtp}0n!C^H^0zw*;Ipp)=DiynP zzVqtw(}UCll7p*2%#7r%&V%7Ic=#Ss?tc1ksp(9Ahv$~5A-#a-_DRZSss9#)6ulxv zg8O}X#kPMM4v-+J0cxeP+DLJ>BF=he(7gr>sM)v04Z^@Ut#0+rch1|Z{abQo)b-JF zjO{67#Z38S6KrtUmw0z(ReJsN9hO9xvb9!!x9@%{6A?TLf5W}X)6qlh-^7wE{m3Nw zJJg`9zUAH>Jy!=syddM`^UZozSGtb0CNVB8$l5Xh8SE{Y^%?20f?Shp`}hSgP?XBc z?B$XuPe1XS`Gr7Y+mn`?UuI};W?+y>vpQhyK?Fw>s>5utsYSrpT6>ZPlJn0Xuj9HE zgm;mj+BN>xetirkRW!!A7g*ezJ?@)Bav-%`vZSS+hE3#jEyqdic|m{$%%qMSX12pdTzlr+pA{n7kNBX8ky z%s^qK7p}O+rH{CNFxP&w08sCapOTOCz@Dr+R4o1Z<@^byU{KS@JrirY4qpdaZM^ba z`yqCLa7S!Kfz{*5C$5(Cmyb6;_oOZR0n&f#N(CaMmL#DkiB1{!_;MOhYykwTA5Oy5 zw63lQ!hu!Jqu+r^ivS13+5?RltmpF?18K1BVWDD2`oENDpz0{GnYsNE&>Xfy-(S2N zBa_K7@JVe;5};H2JY+5!#vr=?CRyXnVm7`EVJPrJrNb7jWb}x)3iEF zt9?X3%q%E!9SVGOdA$XcH@5AwrWBc6=uwZ6phCR_D0@d@U*8GH zo8$B8q@$TmWK#5sOXAIuTj?6DegJr}0Gj;faY1CvTi5E4`2bN9KWfO zr0av2f2G^3H&AS|r$Aa(ckLRBn>#&YouIOswu}a>$wY2ZaVe407Pl%+al3v9!WE~F zM7><1gsz@q54F5Ndple-X0x#)nq_Kg#@Vt~)AZv16~#pyq99NJmg~@Q|7i>3*`Htk zJmb4qPtGsyq*A6HN~#_!n_io^ny{aisRfK1b@UF#{Qd(IbW*Jfdh+tx+n@D=n-_b- z0We>k)HwmDx`BvCNs|2G#$_uA;0%4GI1 zoZ&Eh;Wt{(=h$Nzg+f&~p{dWgHNjLL`YA{ma<=D)I5BnA284IDC-f-!p2R5W$LtGc z{FfF9(M1L=AF_G>ZdALOO|vC#@m-x+TsL6G4k_AFR+aDkdajp51H|I|>*w&Qp{adH zVRv>Nw%qg#?QBB$89iOkgW{{oG9AZ&`KMxc!Zz<3d;pwKM!m7OJ=v) zlvG;ZlITt>2JZ@v?zO@HqKU*<<-lpjazg!P1|yc4g{!W0C^<#clyaGl468PS%1-X` zZY0`ozuAYWVObsuV%Cwb@IPK?C-f=XNY69B=7-A`2xf{|G-&!*r)Dzz zb+hFv(oH{sjv5Z>+|0AxOqvj%8)&)gM-|;)l(^3Q`MpkpH)fDsLd0*thTnX1E9xbc z*!2X)|3l?*$>jq78mQU>PaY|?nfY=5>*E=5EzO^wD^lsJ90o7QPQ_jW{X@=Q+`bpB zl$^2RgsTl!%B~paNrhI*!gyCdQ`?4xPT5Nsm1(qxanc$g^SeKGOlt#NuQ~h}>gTV1 zsxOW3NnI&_KdB?8`L;-eE1thBxaJcu1?~0-vsjiU%g&ap1w1n|3a+i~f0a^tqjC0z z-xwzh*S6h=UGGBLpq=BX(Z zN*Dj%5=js7NHhczQPl8XHAQag8{#^R4Ewn{;x9Xue#{6Wa8zVWt!}~<<$kJzXf9*_ zntk>wOVuunkRVEHgKpCweM)_d_{yJ$nt>h%oSQ!}mdhD}fgMn^6Zie=Gf8D6_5hlx zi~B&^IXA{IgqELOcX++wXs#etKFx%mDzgGDGQCGMo5W<5-YlCgD#goPbgyc^rY$I% zWf@rrXVa5-jbR68t+wKPJbkAvzEJ(o=$n`vO=xZZ{)^9^Swf0;IA! z9*-1Q$ecE%rC(E7I+-m0@NOVpQJe~YL}D7A zX&DOLz$;&YfKUN!fI2$O{;ysa-?J5ve)2xw9YzCG3>+;x{q-e$7=RUGe03)L^0Mwj z%u;M3o8&7+30+e{qMNbVcun_79qJq&!3Bm1shrr8_~_ZZ=UiIWN&-1D>srkXftqeI z6==_IF8&78qQ%b`FX03D=omk9`0UC9o~kNm`x|S-j#;zn=BLOntgLwAlED;YJuB$t z-h=cHHz(a&OccQp?~DyBn8WxVut2Kt0MC-gVb#h=;a_s#p(UrAC8{XaR$dxpIGVzl z1hf;+FE+ja>Gm%;kLVACkfs#6+mY0vU735lv39GfnI$HDR#Kmeh@)m$Ep2R|Z|6LO zWtp}c!PZ3p&});z5-h;mq@JMStuGg7@pIN;kY%#_IcV30`lZOV}+9zN68>(IK7qd#rxA_h^Olwqr2Zv8bdLR zy;YYLTh%3QN9Nc2152IzT|_(xWi-YH9z;g*~Ry>Js)C9 zk>UR>L2@{;)zUdJP?}_auMiFl)T^1lJF8;jVSGg6;f?)z@5JWgzO!yQ;nIkOyR(SH zd+}DG;Hr|2TtHm>9aI!z@zLdUZyZX*@BLKxF7fwo0WB@9uq)S-rTGr|>5qU!5%6*E zH|o%1{4;yVL;x}Jd|XzJI(8^mE8c^MB8XOV*Oo5wTpy&sG(R6W&WdmyXRQntjWYD! zrTAPt)Zd6vBfSNYTe=W^8Y@HOZRWLCq~=Q9@vJFli#VyTv-3(Z4C<*t?X_cLGCyQ$ zD3Iea`C@#&!~b5w+nb~y+MN{xTjv;DApPJ@z{QnY)SGQ5S*1O+S8cLIVl$j(4v0pf zC}krI)ru_%v;2j|Gw&4_1FakJD-Oo@jKFTJ+tQ9NQC0D#w}@wec=N7?ew1>^oz;E! zFl~~rGjLl(c$8H32rxic*~}`u?2T+QqSx96aLixtkaNw%1tr&)6=r`VCmWZ>#TD#( zJGM=qJS;D}6rD1(ExODvEI4R`en=~-($pxRFi>N_0xk%B(sJMNlJpbt16N7mf|rE5 z-rsrik?;hv?4|<#2cx?~_o(2?COZ2ms_uXdG@YX!6w==Ps^f0~vR!Tv9r{K6p@D zQZP2L+}_%1`m5cnOOJ6w&*zy*8T|`oOnlOCRSkOlVWOqQ!W2tRRROb_d(0FnjjFab zq*fsk>c^}5Y>G>p1E2+BikU@S?JK1c1VH9`rK~I+*vK+FrN^Ff|A?ESe$|CCMT>ne z;_z0P<-fQ9xOe;F>w|yl7wDO49hIh*-gm`0HY31m)M3ANv z*)dS)y;t1>9C&KVZuqyy@OE86BZ0Q{6TxUxlwmPvkdI8eQK1bpkGADOpiz}2tCqet ziA!BwQ>J71yj8BCY6w(lQvdy8^o}wDoM;RZVw2_MUp-cUoL64gQt?JZGYs9gwh|*w zLER_9e9zrYr&mc^S~>1boTS7=h~g1%>|aZUZ&ohzJ#BG~$EV>{sj(G;Tu6*pk%O1;L^s;R2=VWOfATN5Ap8&kXAptsHanI*RC1XQ0W6SD0Se zwC^Rgq9qFY&hH1>Q(C$DMn|at#V;vo#si5gfItEg2{|PtCq@0+ljW3`=SL7&EG{WE zHI-di!Pz;9v*GPSO<9JgNkq<}uH|NKtt{DUb44;FZ-D8o%+BnohPQ1 z;i^HAV4U>eVZo6GQdK%eQxAGrEIWrzUG;=wtaE%9oJ3-W$tq!-5{wG)t|O*5+jBT- zt2GmU9AwrO&xJJi+tK8OQw#G=@v^YD-dp_^tFdh2Pb)-29l5ukr8nkqN{AI<@-_KL z%Jio@{KU;RnP!m7#N%0K`|`;HWM{HBi8*6GiSgpwBbmWMk*qI03~j!a*eKoH9?lh` zn>YniX-Se%E~f{>5A&z`?f7(-q|<3g06(sV0NKs^8S+Jq7dDi-n$4VU!<;0i+QyLT zwzysmLy%oK{-o>q%y&Xjk(=&erN1j)0e2!1*7w?37Af@0zn>kR zS^ZHIp^;;8qwga0P)N({cyY&f^3KtlskQ&9R80b&)lIELjyhQhMNM73Mos;X0&PkO zNAZoK>6lXhY*h;q5 ze>_hA$HP}A6r@EC2!*kzsHhrUPb227L^I_W9k#@yqoex<1}sz)pC4~c`+k#MPnuLE zU0gT-DqSw}fwcG>!b^NUt)>d0jsrE`cNvVtvq-J}Kx15FyuJNB*$Gh%AsL+4d9(8< zvW)@~4PtcPZLrCBe$%eVZ`bI7;e;`P$J&;`=Ufh!mvf{pVhO7AM4X(EL@Q*J38 z(eb^B%=%izCXtL(&v17V_UK4wj|Q@!{o&GV8)@!=g-q&5msP3$LA}{Yo9$oeAP;UI zP*wq@(Caj6nQEH=VIDCN5gxBQYi(`qEXt%RpipseU^X^3wniQu9)QX?0N7xt^Xg4XZN}+cu?j;B zL@|2k8n-UY!4Xtj`XTg+MCShivi#pK=>GGa;f71~Ym;f$6pC`|d9Tv>Kg4fKQ+x!2R2ga}>r~JY0b$@%hb7Pj`2YcVb)PD4lBQ z*`zGLyt?|l5#j>j>d3%IPoU|pQwgpBGVtYs@BZu0#)^`zys|2s$}B|zZ-#2Ami}t1 zmw!;u=Kj8$w6S6&$q8VApba8gOTHe-;2#}_iUHgJ5K&tX@SrOG_fh`ycuVS%W**z< zcFXs1adBPU-Rq~Pqh7bmL6SKZ6GDaGGJv(iq>`~aS!y6$@U~n9Jz@Rd^Z1WfuJIUV z6L1AByoChbCZ?v2Crg|UH^*URWeg)DBi4o4v~+Y7+}tV6%|I-glj92)Qf%q21aykV?HV=fY~&`*9uRg?hD}C{($|NQSmqWMHcn1tfGxYCs!FIpP7uUM z08vs=QP9zm0n|y)9{F4bkIt86NV5O$)nS+J%RAHY)6oG;py8J7Me`+S=t5&bU?+@= z32?_tnr@=pX=5b4l$$!;^!mJ{GB}XA2~*I*)BeYD1E(jvIDMOcFp%NgC>U7?JSJiX z1uP)qk?~C`UxFQJkEHyg31&N-9m{T~N>N7kj?QMlf9?M~!; zeV@ga5Ukx4A97}ojTr$Q|kXZ zw_AHO zd80cY#(ELAr2{GaKWxlcIDk}cBl1dFzuA;EcP)S3Lu7RO6Ea7-*-r~M>-&yU1aWO_ zLUKBQXyKYgWW+C#CkwsX8Wp<0{CPdIDuHpX9+QYf#K||tSm!(W>XX%HC#|<{YS0@| zX%5|t>ll30@B@BWe-P<)b?p55qu6%rN?UmH=V=S> zh!0UtM8+FQ50X(w2&2=P$K*O@4Hi(fkLN|C!{gCs)R8v9sX85${>**VF^M3B@a;y0mrC;&U!e zeMsSK(Hjjrvgz{Fc7?mHl7^0KS6h#lW48aK$2_`5O`Mviqt_vZ&R229Z>;sIu{Pt{ zxN^A*zOxT{^4!2Ob$k!Q5fg(bz|T(#BZ@-kph;UevV$Y%bdG@@7{H#Ss-ZFxWC@y> ztplm3sF=}Kn>oh~rQE!O^MhTe;Z<~IBXm7lZ)jlI+h6yt8b6KJ7{ml_Wm@tQgpGux ztVlXclYzkoGlSHXyocoI8TM>yr*ikP<%kBHHoD8^YHuIK>!UvGk>`HCK}rR+vBZ1$ zI`e!^%#PE9>FvXR^nSz5cG1RV#4P}ncm2JDZ#4ayyZ->YeSmS0wzqZp$Bg})B38E* z!(i>L?Oa#jN>~yTf`Sdl$%eZY?C0eZ9J0-w>Do{1A8*TCLoU;YLz&X+Kp5B!U8MBw zCG(-QVZWI!69G%X)kM-k&5UD8O7O=?4UJ4T6|bbnqSj-`F>fX_Lx9&lS$IMyEtxRx zEGJN*gs1SQh_m^IWYt5OYn(~_bkn5dJZfEKXh-7$O&zH62^Uw6k=RW4T~sCHgYj45wzJn+;t`HT(q`E@*Zu_@4SA$W?vpb75Ztz3GP2$Z#+>?z;h3m{ku@PGe*prkpB3n$Z`?&Wmk{+25B*%4{~Q*Xz)3T!S0nonKWsjQBG zVQmi!V`{^sYqa06y7mS8isaQ+PC(Q* z_NB8eyPZTi=l!D3H48rOHyE>F=l8I#x}P_s;pnQ0x6e z#+$5#$9-*g@_kHySFywOb^4Xi#DUO3{&hfztP1E%lTCL?LD=V9x$n_C~Yr696$r~vgsVCq|3gfY{ z(V&oN{NOL&eEz}@J}*!Q*Eg(8TpgMjC(||8?ff9Yb09^;h%jVN!RL11kXa@Uo+s>$ zLnelML_C|i5|gKmi;a!DbRN1j+Qs>!K;vcx#@mFF!wi;(>h^ld4ivBeCb=Zg2dow=CP)2>o3M;UUkej{CFY*pu6h~hh zOa)x_?p;vc9U&PTYqgqur=U4p*&4MMH7VBWKZ2P?^^fXK7fO%|f)tiz!=AZ0!J;o{ z8TdSL{=r=rO07?g79f>K zA>Dz4)z&_#x~k$Z2|+}?e8HF$8JE?Huez+E0#`&Ut!Z$f-@p18(-fIpeK{7VPe#Us zNzTUOlaOP6na?Tq-ewYH=)Kr)H6ZFFF`TXvvhPaZ9K_M7i$)emNR!DOK|M|PZSb`| zbcxyp#VMDStzFySbosP|3Aa#@@li(P7)_Nb4^?a_G(UUFCrO*JYS0eXQ7_wksY*8( zR^O27RIBu)DU-g@G&_NBX` zm|G22;HLGP6$5G4g{n&VLqODAj*Y2fW%?LRm>SyvsyoDJy0YJ&R&#`(F|&x8ic_NB zpYu{3k3LRGFqnR;^edwDRtC?H5I?FHGy!wi49~QXU5e52hij3ceeFKg6b$Oj!+1Xe z2#%1~(znMfCbgGYZCWaOA8hCj!%j)}I5>^}Z>=z|ob)#Kx9tZDJG_C*!JdsEOsI}p z*MPkj(v2epKTX=v0%MGP%uH=x~ z-w*ZCYP{PjYa(^tO-0hkZ%7-_3nJn}ZsHAE%A)ZZ0-fSG!== zPA5~krm7#VF`{KL_I8C(-E_7s|LlX}d`RR`OoQbc z+~0pr7vJ5Tx&nR>IZtr)TBShAW|W@B0twFaJ5gJBN7k785L(#7`@3-=uYUPKo7+DY zw!E3(p|E+m`S$qB-w@vw7Z6^LNa&Bhc?qXAMbw_>M{h(#5@6o7`Y@se?0>fWbZRwt&dh>H9=U>qnl83l< z20Ov6;HE_=v(fKp^Wi?GDDWb+d_xf9BtA95n8VlguQoyyNYzZ4EZiSI9{lLvM+t?A zQwTx+a-d=(i2*9zU1mGH-%L3@TWA~E;5Da>;qfh2LNoKk=Uqa&a*urxLaO2Z;XrwZ zj@nMo;>XHjN9Kp6{pn+S-MThKof^`I2Rl-tY00Gr#7$(za`t6yM9c%YZsTnjaHK|` z$EfJKIXzSy+BGRHVP0TNV!}u;Kr@~6mlIH-@b@mgudSr?Mv z^NPk#e4i9hm1kgV+৙}YBv!X+?S5z2W@54Cn764$X{^)4yUHe}Pi;8F(!6C>c z5x-qpXAf*x+=V%2ES#S`8UxXYd|OJs@h)kd0ohN^V7y0bx9qUNg1@|0!I**~+)Zt* z*4J-vUm zcXt`w-Cf_#dGA)8@1A$7?te2w?L9rs?q0ptPu7$tKjbr8Dmm>gf$v^eLNIan#r!cIJD$GP@Lf(B6?ngzV>{V{;cvh|E2zj1*XJ zWBd&8{Ph}i3)V#ojEV-6Hai^J9Ti21H7+5ZFsR7NoS4}bsmF3llsAKaZ9+JR788#5 zjOU;(Rsd#yvLGG>$&QcCYOMlEE3P=Hk(Tj(cSHRt~_ zwY18*n}vcbM+~E&64U6!eaS0;wQJR6L`^xve}~w5y}4N$&ds4WJ7YA`MK)SsLDq)j z=r6DCS55m|ia?a}Zp~JR&QQnWFS)N<;O=P25{Q&jQ_PmC)^V$G6;3xf)03X|!XF1K z^y*0;UAjG>d_cvRYGLcrqvf-+mRBCX zb_Y!`rQ_lqY_DFYxUsS(c=0&h0mQC*;)-!;jzzFsL6iKuAw$8&a%)WLqwD)6ua#y4LDvVQ)Rf`f0S~Qm)8-`c zE1@q4Cnm|taAcm}JzK3%s7@i!*DE2Pki0s$*Ly1pi3Za3=xfj^k_8nzH<`YO9cg=Aiz7W4YQz|6-;L*I+~FJMZ>%OGp86;gk03 zzQgc(^NVtnZU6W<{t49OG&M@9TXriva&|>)Y=STN5jF@k&8m%i9yC)2;?Xc9vb(po zf63IH`!q7dVKvg?DbKA^*g)vIVh{j=OzB2tvsvukAKq7G%&{{9THUEgUP+xsBJr=Z zodMP>Fde?UpNa`hH$|`bB1j7uLd@Da=f|;s4P5n~{5GC;!L3`<5|R5i z;N{73oH(80&h~o9T>jFYu|61I?F^8stty4wrT`c%@dqD4*_?R-4=A;P_levsQ0U?2 zs(XAsi16d{^@v)BsdJm2zW_&ubIPxrucJvE1zO;=n811lg%AM-i@tFDb11S`#0)pP_CS>^s=iXlNX> z%adfAiOx>c3lb=-gj7HiM$x4pv=*T=RmZ%M$NLdt!+8nKOmluViGid5>k8S3%r+UB z)?=4Cvul60MS?xNCS4 z>VZaf4Ur{B3A$petIX0_B1nuC~GXM6p$ zU`&0peiCvR_t(&N)T_jh`6sPX&cZt{><<4FA;&EjALKMy($PxD4^J_$IIfMMVhHF8 zQoPIOVx*ZZ|HzNZA2KebW7Mf=mDAjuLgnvQ`BsxUvYTR@SXW(7mKBZ2htCt%Q~;H( zEi={k&D}$-xex(wF%u|PD<05%-b_y8K_J0}{sF|cN^=RqFF*(i!E`48cdY9WoDD_L z*k679Kry4K_k3S{8#x^ekFY5^4Fm9eY44sW+ZDqKy07TU9X{^^tW?Yh;c>Jy8-=tp zW#bww|1Qf7nhhz7*eDYL25GN ztgTVrJ8ubjZ<`TT%ah~)2iIk@j@Wwp9+uqViLFPwr}LP;Dg>N^0?)?nWyL0wVjf;u z6RZk@nL2z}CZd;yQs{ZV%avzM>k14O6{}ENH>-1+qIKsn7JEL-L6d+fWjUKSmxj5e ztZ7c#;cEN^y>y6Da9~t`iVY)iFgzjXnx^u-15r*@jgf>TBu>Eu@ZKJyEc*20>2CA{M|nmOAQVVRu_Orc-1;SYv5Q=-6~1qqbRLYtQNO?gy03WsaqDc zd&$tW@pv$}Nup+YKf(hz+lPGqu4Y>9$Lq?(*>eGtTv>`FRySN7>-Q)r?)wdZ&<-5^ z^6So-Gg!@VE!fX>=ia>lq_=;hC%p*z3_4{GV37f|~z z`%dt$=LeRwlTX(c=H^8e75%ylvH*eaz2Q1Iq5rbcsibu503Pb>7<{9AFWma_>;mC> zeouXF$^kVdBwjk(*vyr!tm*TpF(N7?h9!(+qIm*l6HP!mt$qv^aBXhd*qX(|slyJ; z(b^uXRa@me8Hy;E+QY-T-lAP9sOJCbd{jC7`FQFe zj)RLOX-fYMhVV>jU}hq#UO893SdId^+yC1D0_}|y ziOq{Is6AX2YpFduED-5FgIf+ErL;8J1!ts-TAkLpzMi5?on9BfZnbXwTHNYHPlh1ppZ z;kp|i6CkNzOp#m!v%O1K!ImRfSg@7|!}H<&ctQVPT!563*n}&YFLvi#-bZleb*$#` zu%#NZ2=n(vIT{PcYDN`aW;r)SN3P}r_%2hbXH>W=J0Jyq$4^Q)Ht2slbOwyQ7;*)8 zHsxU%5AOtNOmCt%^Wmcq#>&fk$2a%z*@|&bz*<9db#)o_R4wS!VPs2SXF+S+(Mz;UAl1vu5ndltv- z)WRjuBzcW70mG~-Ib03q&o*@-Me_wn3hno^k>;vcbJOqXY7%DJ0H2{^={$8L_BarL zUhvA_@RaVSO;mm-$9l{hFE6XQC^`lp-DAGnF(>WF^$l%{k?7bPul#zHY-vKs{fFoj z67K5mD1t_ochk%8KyQD|#CIyw@ znrEtk55}d+4+OJ!V)Wh6ZUetvvfb+jq^|A0q4ROtsN>>6kY9l}AST&4eaIGdEaB5PWEYS8I%$YDiR#UJybUrV2!9_y(i zM$C&lP6$#>pkTz^^l!=@o41#q#fWU6f zOxdAY71ELrzL`u*L~t~IM&i|H;AJ|>`|p#ra((2XxcW77YYz?YC2sxY^@|YO*(cYf zY})0aeT&sl?=vH1;rr(7s;jMrzm_%@1KM=d~>-9Y?M$Tk{j;QOuP=vQbW-PMq|U==PA zs62pH9tAA)2CLL^PA|4#UtV4cv@mYGcnz}3sxRaNXB=FENJ>t?scoP%7zd~;k8qx` zm7dGZ$!_C|YU!yv`lgk?yyX&KT1)&RS`P` z3VNof*%ekg)CTLq_1t`2;?WuyHSWf=eUBKjSk{-$RPt)~MjueL4_9xp)9M4#cu4#A z<}FB02hvYwg081uba`xY7VM0cKHJloSrjfO%J8q?%OivpgvlE`mQbWAMSsrD*&YXY z=hcQB0nA)gr$%R|6g3sAe4rs6myNog7P|@}#T+9U{%CL+44Cwts&f3}ZhcN8peB6N zWKF~s4PI~+nh3PV$*Cn{>KLjPO?G7^yUavd1VA5hTCHjNjH=bz>#vs$p-Dk0ly9kH zfM|FB|0ZzZ|1d^~^)qf?X`Q~W*T!2Xvu&%JWF(or)h!@^hEnI2zRHK!Keu$5psaWr z1{$oI^lNOXUHj9is5RD)=izF77SU3$b)x+6)`|S<`4PqKeS@syay&10%Uh^)w+3G0 zF>`kUcq9<2eieYCnxAS-5s8EAPst`Y!&Hu_enX&22hcx|#;(#;J81AESX_paoGcGz zDC{njWjfiCujBGSr_kJ;EDo_l`*p8+)))Y~{eGNf;l5&y_D5rKH_Xu0x>y_M-dGiQ zA(II?KYB#o#qFa4G-*MZaH1da67I%UJl>-@Ih$wkc{L6L*5AS)tk6B2Pe_}3Mc1ZQ z%QOIhpZ$a^yXexWeVoZ>Rh?J6B|aUn0Vq8e;>u(u$ve1kw~fpH1Ka7%5F5-bXZK<< zeQvsPrbTG5SG~35R_1zVrc9gpbE8jn{)E2$%st+X@PxvO#+)q`>FUJc?vv^5Tw#n7$J$NJ}P%a+=z}+W@kL-*VQP` zZ(D4!z_Q-~+;nYbmF1mwni%P6{T^1rj_FnR>*LfS?<)-|;kgPto1?-sw-8O_ZHbQu zZ+}qlxNm5)xSa^lXfXsQV(@m^B!YmOOS}NpNT-DnS{@nwl9fIe)+ywkBkE#^FuDW= z4vydW)^zN*zj--9{xwZjd>W~eWKo$sQV$z`r)$Oh z<#g!xxNF?ys`xlNe@wnC>mm^Gp-00Nr*j0shM@L1=U?-ViDAxQl}sFPkj;|Y-@g|7 zyJ^HD$dDz3vz6rL-g}d44iTBt!B5CYF9p|cd<7qWH;`sbbV&ciyW@(rI9CeWV!OOt zxNGHchm6a=7<)=rJXwM-!TjFjnLaCw6Y@y`VI?xIy=^FGs69ntsk)LH)B^^+E21HaX!esoi}Tzz$O z1R}wz--+tl3&I{&PbR>N~)diO=fdZuud&L##Qat(4u~Z%egXyOvWay@Cst`aVA+C z)(6nmbfV1f;?uDdMY0>%n0+hAWOt{M-+_+r0K_cm;mM>|M{CaN1fKHE6+wzMmL?g+ zVsfq|>_?4w&!4r3ro7f$d) zW6px2&6fy~C?VRqT-I|MH6rP^G|{l9jAyF|xRuklta7}zqt}}-u?QK0zT(?;DMoI+ zu_V!^?Olk{*XLc8-c1r3Ejyh{tKU{|=9V_<>wypAX_@rog|SnyP()BR?gQpokx8Od zmg|m4zuU0jwt@T+YNYF>@wTi9b=+d+nCeF_{0zzEkco-i*T9HgP4Th2PfGL~RcerDmY|CVjY-pH2qeE(qa2Us=Q~9 zrr`_8YI))$%CJ!Qr)a9wCg{*6a!zpIZlvRxOhFvKT~WHtU@*dTD)Mhd`5dk+k}6hcw%MML{H)SaxDa5XuSW|>7JJ^Ub`Pi<7dbs^mSz+aGX!} zZ1rIwd>)R;UyO&CA%IHfMy`(y5qBk0CBF5)0wvGt>ci!R99@E@F#y=FRC^tt46~@X z+KeUsJ9h(xtN}|lX6GH-v}SIk8uln^G%lz+#Es%Z;MfE-zMHi* z&@Uncagj-IXTXv|(XKd6QhA3jo&|J{0&!D5IH~Z+f~&VX(|eO z8A(Vyt1Bqur#wdmBB&$^`>unr1kmH9X5<^ za-;@YM%o7zk$uEJGBfIB6d-CGP*Go=9S)`GNET%#Cb%WguD^!tg`oq_)o2<^0+9bg zBH{Q%v;}|r=Y@ogG*~8PPzlbx)wZJsbA?v)+J@@Wy4Fwr>741ot4*Y^mPjOOV8~E= z`bI4R(MDEde<(4EU)G#$)hNg_K5T??!Qc0gPhV|+Xvja;`J3F$D~UfEGDrVIa) z|AhV_^n%fvn5BPZ^VXXxfl+-m$9H-E`ITa=E~A`%wzV>R28R*C{MbUK(Hw_0E0-U9 zqQ2$Klo+E1G*DfFK~ul8UXxBa{-oU2{Hp=|Q*Lyf0K}U`Bw^&>-PPS(XCQvD~kM>I^uO=L~%=#botiw4sga zKYsa8PkQtLC8gW`8%kQzZMXcIJ0W(%3Bkj$3D&0x)n1Jb?_YBD$)0ueJ>RmYKk+_t zp-hNm=-nQNC(X3{u4E&XmB%Se3kWC}h!Y{9PLLv<6&G7v5h@G0`s4+B%vP|;c8I0? zekX(ul~Ch#?f3Kw1-j(JK(hBa70_4skh;+Kdy~};wKh z(5}Z?HecFL0(>qz0e1<~xiN-g%K0?Xah3?uk;JQIN1ZUAm0s@Ww4@eS%F;x^Z6~^f zBtuYnx6L$O$`k)9s68)SEdQ9;JOy)RVFJ9Fgumv(I@3`*^9As>Ptb49pU7y{hmTbDk@dLx zQ&vqX_f&GPLX|72msR#SfHD4E5)84gT%aPpSlOkb&!u3WY(sFm~|QXDHu%-kM2jK0b|zpt@) zC)9TH=6!$Nf*jx5yS@e*W0kEx(SkI!T(3J4|Lz}$7#-QzKj^5Vh&fv90@$V&sM*A~zx$*#k_bucIkW>JwE?X*UXkRA{=Whq+Bj8Hf z?aQIdV5D;JwkjnmNIi%;sW4DEM7<1*PBFeM~|Y_UiAAd5j}mH z1pgHbK+Mr+N`Cl9+64AiFhH>hjFvGvKJ!W&95i>*0j;i@M{9is$eXcph(QhRqYDuE zM%X2#wD%K0fP8d5|B#V+k6B6gM(P&WM?#X>YK^T$w_tmr$}};aEG+2%S~?@&te86X z@)|z&>Gre-;2{|dCsDjLnQ<=?{q|2>-9hblg{L#|2@ykEUBLKQ(e~Zt$#NVxRPQ03;5#-`pFUFZ$+fJ`4`> z4m3O?{0rg#C{H)GPI^H71~O~r_|bEl&6t-f;oa-i=-08RVz4CXR_-9Opl~Gj+yua|=-ICPT&}M@IYdVu{AeF|@cksT zs=PnI$^JYvlK4(}S&Z4*oy4 zxZZlZCwjhG1Y@u)_!;6ZLc8kM0>L3Xno-Pi1mDRRgcC)-j(qEUfD3B^zLY125j zm+|}WA1(Ic;y>p20=f#|qR=4Ih#zbJR8695n_HobXJ;=HAA*sp#Gz#$42s&=7(%T1m*TSIl&KMGS5Wz zgfE1l<+v9Eg4{UjAiSZ)D;IjY{3Rm|8f8z5-`*T6imQkMRP48|H=Den3i8_ zL?D}m4jUP6I^!&>yUNe*-xpSZvKvC;BEl4@!OxXKLiYRZd1O9PE3UgmakX8 zGb335RIRYQ0ji?6Znh6Q`emM09|X50O@+nD_|1k@cOf|0;MWuhY0SJ(CA4~5LEN#Q z$Mgbs$A0Pi$=1l}di7JR6F}OJz~jWVs7qn@X$$!I`jMhZGYZgFC@Db!a5n{N*b`4V z4noCC*zRUShl~xNuvo#Ejs7!|uw9X8g7|cM*<|p%7$1R;995^Twf@oQp!35bcp2c6 zedasY)+~{_{_lh?gF{-E>REgG1$AxKJVgo`qeS^o`D{Q_`t99;Di7FDT!X6l`D&ib`0RNE-t{Q7GKMP0I_@X|uMTMwQATj4mE&WnvogXW@dwmLqzs zaI|2#{O0D~@OJEgfrW*DurnPHBVq>x^^A-HU1Vg0gAg|-t9O*|>i`{+%66V&R@Gng z+aw!Fm12|85NKOF``*4GWFT9K)1>RL#x|=kb>kp{^T}KT5Pk%F?(r^zfn#b+4e>-~ z&ZanviVMIl4iGs)zIfVJH4rm%CmIwV!W|L(==fJ{h6OSf>4y!Zi2iy|93C1coXow2 z&iBO?8_&fJq^QDlsPDImWFP&X^vjj!&U=76Pbr!{KK4=;M0sH1SXkhmoF)Om6yZJX zS5rX&@5}Gbc8YlMeh_M?dimDPQkwF8_4ugBz%+Q~W1aZi7ULSn*%OsO>eeg=UKC0C z_pP_m_)vg44e@Yu1I)>#=*^e$-Aq7joUcPb@K$?83gn5l)wOUgDkgLZ+7%NsDcB=+ zRuvV-o{FF7dCiI+K(;p=$O6!MR^pZ{aq$7MNk|y|M zNa`&ir(lZnO3(J$^;B#qXMHDFbLUuFS1AgMdcT0&wZR&KtHB49v^;R_K+DgB;f{VZ z`8lU+8ym-fz|?4ZzjlCG+0qq5b8`=Xc2M%MSR?x_%tekjy(8^uwXhc!#r$&cH#Qd< zb$?MQug;>PvZ<-NOsNdVf&(?ZD(gURWD>^|A}5!X^nLL~Ws;aeJ+J#dhau#{n@S-PS$G3w23nMU~uR>_BF>KYp0 zyW-cAv&z%!;t6kaK8^LUHjC2L<$0^}dTuGop%z#v_&B5(!Ou3x$fKLaNmzSP$$(t{ zBOG&2WKz!g{`RH;kHfg;eshIGx&z+0Q^hg%y0-$*nIbeK>d;pGC^TG7kAV#`1DY7- z63@H5vxbkS@Tv$QHnz0FH)N+`rilB4fIn80*YH>R-G<69(Y<>4E=JUmPr1?CLB;F*U7nxkj=8XMTDuts5M3$YVzmg6R9IOL^r|)#BOtqiQgwEz3&;K}R!D;#( z|D@gpJGeG9#{9Hn6y%bTli>J3Fd+_dT?@=MiE|MX^5hVFm^Uk5D9&1_YR9KGARb^) zxSJOjZ#|zbmL&)KQtYjO2nGr~wcmQkLZtMkZxxbJPU*8Yz)$mPNs^eMB+UY<`9L}JHPGEN+_bM8Rax=I|p@D;P)lRcBlH&yzj>8{5avj`4-RZzuE-WCd9_FG} zthiw>;dfwzr_&i7@r9gmGfet;rQFT?;sAzs z9$V@e?X_fHxQ05$SM+~z0d`%+$W5-5Gaj!kdf`L$`kj_~5$^a1bgQgfPG3__V9Y2` zGoVp2g1)d<<5gH#MXGXlEK68A#<^(tHZEc!DB>PFsSEJ)yKC;Dg&_qEG`vrhDpJ`s zt*-9L847abins^ux^See_4oWNk973A%CG1O89Uo}?0BnD;5k7ckCZBqUhu3F?^`ij zc$Ufq!&|F(xNmtd?kg+1V`rW%1~xS%Px}WabDwgpY)F0l0k~L=?CP5aLuF=HPpMit zr<5y~)sG9$%tK<+w9n^2%TCxnLC`J6by_xUwSMONbp3R1o z(~N|@4nK2SX%4rt#MncxntjDK{hkicoq?9EFnA|~#=XQmp9&<>!l^Nl5d+Dos+r41 za3#rQG6El9eg;35tRlj3XFl87+Q0Lf*Q)#h72HNMpCU0C(-9I6k9K45?)QKs9xBC< zyjKO8)?EF|KhK$lA!H4?Cs{1($Py!9B43Qrvtq;R*6BheM^j<8A%J9U>L;r&tH-y@ zB6tdeq^3-A$s~2{OFCG|2gfLhjW>H}a7rP~)!Ovq3xl)yu+j9GW;We&XAXZRj>~xS zCZev#3x|CF^P_>863dK3nP9^~g;Vd)WwRlDSR_C?dTQ}Y?YLDSnn7-C$boHVC>5+e zq$b83GSX5{gHexT_HV9mlk+1kR8cjX;kX%Cfxm#mDAOVi1vsH+n4Rt0&+s1>#(^>&p`bO@4kHxzXQQ4V}Z# z$u6;6EYr3ub*oyu9$mY0D^IWWAYQjG5hxx=Wk?v=zPGwkAI{GLmiRn;hqyXZCTubh znJ8;!{r9!tVnCji#iT<64xX4r;}mRq^o_^Bb5i z5MP^L#!xK56;9~Qw%rUfhLGx+0-Taia229kEyWW@Pbtdj84RPCk*+$%wyM5G^Fef_ zks%RHJWO_U2-`4M_V%uBRumJo$-cP~ud}OOLO%1Ho1fltyJgmbf>DHto#20f8Ov>Y zvnElpKR4c-LH}A)*y2X_a2eJ>UqiMU(~KEO*a0re!Dwmf7G5Pa7x z>{(eEjeS4Q_uUK#GH(UZ_Xh4dw>;iA!vp@0#?ya5`-b2upUHcJ{26yTmgrR%#7hA# zzD1WN&47S_i&vqBE&G@bi=_lq2AC3L80f7IOXU>l0??v8K?t z4llAWC82d=3H$w9+Khpn9p&2=CzRD;r437ta`Bh1@K$(ur8UC2Fj`6Ik-~TkkydTV z%Z@7j+^`G5pCe=WJVu7GxQ$WumhWz>r{r+CrnQG~G;m0r^wisFsIuFuL&*u65QRj) zw1i14O>(6btZsg{7G>dk?OFx)6<#o)Qc`J~sNwTT(z6q2JWGKqFg77-zRJ+EqWx{% zkc!05MXMuzETluqWF=2?vfAsuew@1LFpt3*GLa#A{0tdz++}#Ws5Ji*#`QdP!i(UI zgW~Z5&HFV`3inbA4J{Dgwl)%{D6==MbPjj%$z?vVxaq7Jrp?rLIwl44E4hqqV}8#9 zywJ<`J$+64$T+=;L8JXA++vO&&)ld8QTUwj#1(>Xc};_jmMq{dv-{RIeV)Jmrv(T$ zRV9kLF4HTqRcY|JrRKjIh9`vVv9T&X?wql>UQL;O_nA>1mIOUm@l&aV>DxP-HIe07 zOpy8fnN|qlQ2b$CxBs9KWl35|RWQ(TUL1GBLPQ0tx^Nd%U!Arh^~_`A2c0iiZr(NJ z%*a_Czy5Xzs%M8tq4*=xhiu&7=I(|^nNPx#E{3;mE+b7G{?T%6?&&VEI6?*%N35MH z|JE%n!GbIz&vFET>d%b&ekNz|gR={-*-TQJ<#!ts(%cGht4ROkUoJX&eL*N3z9D+V zSZE){=Fumb^*>^*ak4?=h)P6ly6W)`ocNANE}2X!FWpg{{oKY8a{Q#IG*^#6tu&7C zg&{6_!tR^?_iFCy#xxf2hcaAnyT7{RY1?Oa1w?EMPUreW0i)3NvflONQ-9nolg!-9c= zt@k+kcv5HSZ9!_2km4?zc^hL4XGV-exp;_mhj2`3f1Gtn+qIl-b3KcrQEc~%OP|B+ za+AZ74cGg)(E5yeJbzq{;sg0z#w_#Om2zq~tHG${y7C?t!qi;nz7DSMrI~9=7G2x3 zpZ2PPGs=2nk!VCA73k2J^|y*&17jU?69Hz3B^$SO15V4T-^eb}`3Qg3t6PeE@yRqd z(eHjT6cae7ecFl~=ERY})w2uy%qs(OQ`4Jua31?jGedurw4uP7w7MqUiZwgf1;e5C z3KgL+cKrpQi6!9i7t6W^Wn17m!}IL+%|E^Cf|YSANvQOZ1oT^DZICJ!7~OYlZLn&W zPG4TvEhyJ~LgMlSS30A*+k6YlPH9#o<^wXuLgyK^SK}WY#&XX-jU-m*qS!TQT2fP7 zSwBw|f*F905}1jSLw>Mu{M= zV*xB|J~0ykvxXh;zE4#Q{gGn&GxeUD*6g&jw3cfLGC;dgfQA`B!GkAaJ~3a{fBQXB zicDUZ97-y;@@&|3pwR_`+{YO$(K%Uw#$J|#E^!1WbE1QW#M_j{pP0C6`Gi9wt+uvS zw+8ICpDVS-xgf2WzUT9PgY5(#X)3@PA%^QWW<79fAH(TQ1BMM_P~({xMI_)mq#faR zR}9t0tl5BGk+1sY^Rk|4OVbp8EF7rEr!?GR(=H>{tLW_|0-DY%@S;P9^)4KImLkG~({4+`u6V#D3 zp58S$Q=#%5!J)P1xwy&Noa@C5Q6y<_x@;}-C;MIjj@arIo6oZb)szGovI%H(k9}>g zhj{zp_TtRP=Ml3To_XNnEY;%icsyn$5l!fI?Osjk;JeeI;8qLb56@Io$`zi8S>@X=J&Soq891fyCGnn!BloPKN34PJDUlvoLeTlhU-Dqiiw$Ke>S9z!NZ11(| z$~0TT3a&Ti`cImFIeN9xiu-->sAY-6*hrQ;u zE5v4@#F3^hzc)rMu$yNn!wHj&=!pMIB(^)J1-|uhlPY7e7?Qi!XneoD?2escc6&yy z5+vRmfN+ij9cm-HnkJK_&kt++@@)+A5p1p;#&E56*Z296499~o>aLwgfZ(Hhvbb7MXlt<}v=CQt7?>uNU z@w~nWD~5?~ZGrbO#FMz9-B_E-RON&N`a^|S(;gd4a!RRhH26MuRB{A!k+TJsJyg2h zBUaiTMFl4lFn~UsL90g>Z@xyp+_`ATwWJk^NN#nxox<}auDt%J@)*|cXZPMhCBqxs zP2LZOQ796{L@!zydhPtdV%}?8(dN$6@i@XKTO5}c-S#bzD4-c?VggSUBumW#Xv$5@O-X42tMZB zynf+NDQEjTtuS@mEsB*sm{uICdbykmY$X3qTa(k=a+L9!K4WtywAA|@+OAmf@?z5= zdLM$%Z+1PRg3Vbx$-Qt1tY6Z~ZaQV0&(v&DO6SY=57#?>jqH+{^)jH3r*CQz0C`I} zq64E^3Zn+i3a1Tvj6aW7$jAJth5=OLqbV0O$Na)_c^+F5WvNg#(-XSe{e$f|(n-i8cY;FIUe0XZ`7sLm&TMV> zTbGIysf@LKXq_U3y|1^9OG8b~U9XP*m%4_d=KNLm-(g9hj_;T79!XF#L zS$==lPMxo+0AXmO!j5s`Uh|JQ{wo${W=&;U(ia9zg!y?;~mY-u$*frrg#NS`Lk);c;1n zmBtflbWf`{UW5=0s}8H$xO2WJ@(SHF;qql;R^9t0^BC*8#^)m30^Ghb@Kxe{G)5zH z*Jk}XVpnguApwn=T~2jd%;2FYbmcylfXO6)C+eUqrdx^rdY@LL$OU3pRNjPsv%~wh z(8StdqifmQjl`Bd6f=iCl6qvnO~d)yjz z8l$?RV893x;yPLIP=r9K$i0)@|8? zsmEh$`rC~@+5^^;6^=6F6qs8S=ie5&t6@`fjJ&+yyS(wgNoLB2p%)7H&#!NthrQX5 z!9xlrapkYX=cd;Ck5Shb%VU^YRy{jTI((noDi0jeXZ)Xv$lWYhXUZ-z8$Q7AJb!SP zGj8Tg#3f@!NMGZgu=<|3{Ms2<1g%9&OY@j;{4;zmOg{U&;>_)ishL^ViX|yg>vO+d zA~=#?8~a^(2@e5Ry3pmI_07=iZuB(w>x}c$+OECcUlx>#ugB9GeZ~zlTlQ|j1J|qb zOVi!!YwBYk?^mMwCy?wQj3t<<;{QsxIkv1O(V%zp3&`Ets|wWQW7Vneu9{Rat>gGz z{afu-wCUN{Qi(kF^|iWY_1`KMoH!R!Mvc2`)z4eSK)@=_EVtOW_wk8+f9{ikyc0Gz zs8*K?2*^5RXw}|qfAwrOVDE5$2xdthGZheMxfz8`5Z37$ZtOUY?cjJEUavtctO+b$ zcp`|RU%WJ9N}UP}%)W_bM<_%o9qa$@wQ!ujx_OAlCR&Ljn{IK3&l4ex5++NK|xCXbJ`BrZrh{@IMbdubB~RUEuK1?6&*#}s?*FaaLS4Z zf5YG5vbK4Esv!#NLjFLfSov4 zr>hl9;R#iEAc%_bBKSks zW*HAxwI=jWQgInaurSp{o?H;nrfZB7@OunsRK$#qNz@VRy>+P)#TN%e9F3wRW9{i~ zEq7OQYx-%+n8xqAbg}s{M=vqY9{|M#M)idA*2ug?VJhJ2e9;dV~l*uIH;Ypjy9RL*fGd7nvgO2L7_v>vJ{QpC` zl14c$l7$@^w70kC4O0pf11DvrIs*PTV>LoL{E};A(*eReetv#Tc57UJDEO_(YylQF zHpt&eNrNHC#LaN4CJo>vz+kWN0zmB_Lkj+LN&*^vTR|m|@Tm(6yY>AgCnuKj3JP+i zbEBDj1m((KeS0=L^{aK6lAAr9;VNm<-l70e?|*1j8moZom)%*NG|!4uM)2M&YL*sT z-I&Q@Lz9v)gAnkLcwFt?%vZSh94c7pW6>S+_K^0IZ6JH5nXWI7Rghf zuJva}Me??3opESpf&o7&vY^^p7T(7l6rimEgo>u!=b@n?E$k%V9WXwv?qds2u7Zh% zOTc65KV054Invz~(;Z|=5F!Qea1sF#^kS9XM|gPnwNnHJ?E$l zYv6G?{u0%Qb>16cR$QtN2Cm|)p_N2+*meI_hVt;-@`O6v?}~Y^V#F)bq)+*+(U>5} zJ90;8&?(NTvXZj}e6GhO)FCa%ua1S(mjthri8GxkD?jL2Zr)2X<++w6FMQeS?Pe z7m4g^`Ag<4lX4$;E;+sS%3L0C1VHfp1-t{-8!_9hZPo%lBG)&(^8X$TPJPASpzXa@5NEr7fpP-iK52h%o zDQzDP-*`|T*+|zo-6kl1)aH;QClE-kuS$1QqQ;4laRTdZdiUFIo!mYzE69l5=UF@{=FY)kF!d4!hddlC79 z5PHwOmH@kl5=Sz&G+hX#@z(wLilN(rjmcs*_udFW9B|L~d=ex+NOfR>>+#gn^vwY1 zn07|G!p-|V7oO!#$Op)#h@i!~Ix1kK9NqRM7T#F7_xyZy2G}UevFmFb$6?4sSWrM? z#|$uBWMQ}V)oYi0A9sx0^!CfHP8Chr@GY&Zj+!>M9SmAmLC1Cew$3X5TpiwT$NdP2 zbWU%CU|k_ur}MF*)j8RK#niwgg$u+|YfGc_*}0NkNOg-1ue&-<= z2*)>nAH5)1F?_(z9SeeU9(CHg9%*%RSVQZ2L}H&k-?}8g_XMMd4l-!>M=vcr{IxT= z&gaRPW~KE-in5m?6N8R@J@zz{=b9~)`>C!KE`lRFeDX+7OaeF3axz$_$w;8ln3zd}2H1RgiMwY+ zz&nn!QoPaU(j+=l&sh1vhq#v%4N7{HCx=e@FHRIIB5YkQ>3MK+5~0;#Il)*_CUzZl z^DU{82zRA(%hfy$YY4jWk!&k7lO}qJk)CgLR)h(aDTP@>%4XnMBKuslWT~e=DV7-4 zbYwbxr}bAv+V?6Yt`ycD+q+YqEuRsiu~t3Jm07UFB5*VMyF{Hwe|#}`jJtH7K;pcT z(}QcCQV1&@nO<{r4RA@e*BTvvj1gj#f8B=S6m&pHY=*z$v@scfW5w0YAEYpE^f2T= zq@^B5&1yXbt;pA%73*A0!C+N-98J*Y-UiNMsdeOFdG9`q&e+J~pPE*A6(@z5y0eh2 z0O;_srn-u3wz8y)6GxPNwoF0`j;MA-RM1?o68c>=F+CH#vBLiS>jJbAx)eY4pwL%} zXR9CgBmnFB(JsS{A4(g!XXly;xqg+XC{B8R%CqrL+5FOpo51h&e_isw4nC752bhq& z8`}FCb+lqn&F_(>%)aRWSx0^VKXXTucvCEzMS~0FTels!%K5FgmPW01!UrAB`vExP zR_9yKQgb)}K@QHW$@F76uKBLUwCOPZV`?YW2$;GriCd?h7+Gt^_m^=XQzFvmCKfVm z9G%(C1lQEu3Ua_)1OVS?bG<_?OB&02=JVMhC$W2o&J}#{#f04oz01~5u4{B)0;&Yb z&GcUktfg0ww-#c>N~y0LbfX<;x=3{pILFHXG+Em#TLda0$4?oJrpHz3HUW z!O+x|Tw@uixrR1hKM9hDiC&w-EUurjgGWt{ayBq`bceCwFFR!dIU7omzCIO$%~> zjvYU1gNxBZePEjP?h*LS%T3Vj*<#W+sl#pc4oD;Br^9?l_%Z+Dk@r4`!puSC*VTC~ zim#?he^@oIBUhFVD{1v?htT2E!K|%Mi*YNJK&jr|Baz9R{a$mI7F6tBHEAhJ_K4pb z7o8s;oUSEWrF50a+7pz#d|aTRvd7c3_HTv2S*u}-E0<M3g{8lTB>udH&?_2>D>{vR!Xm?knk%#aO5AU3);+q!4y<-HHA4ZSGT-c*y*K~ZCvoQI!i}5& z)rq$ouT)XflWm^s5s_=cwS3v<^@BdZm85cmj?8Ssx9Z_MTq9>qV(N$}r=76lZ(MQ^ zf2qW?+z)WfE#tUtmWr)^oVxVQMDDpK*M1$FlKJ7Ey)modr8&b0hFwLg;Ysi^mERbs zR$Z~qjQe8*?7)(t|283ix+*u7T$bA~?T;!e&ndqvG zjQ$-nh@UU!VU|}z{qM4T-dCddJu1)DCgBpp*u4-VMR;z_WCTD=G)S4)x)w+ zf>mpSRcWcaSF0zo&=+LC7pSO&&t_Nre7>omf%eabGZb;;PZ~6$)nwnf&D@} z;raj~Ss!ns6K8QAYkt|9(uTHRORrzybH+|*nDnW)M(336%rS>t8v;xdhu!PP0DyaX zAh$Jg_~I|weZCUS<7IbLnx8I*U0zL}g!D0?>Ur&E|MC<3 z8@L|9QXe^LRiW3iQVT;$cq|WtTGq@xBt2kd-r< z&$tbMyezBgj14Y?(S*;A_5@@3g_k_rfbEc^@0{ z%-*EGjn4BdHIDhU!{)8ojGrv8e?@^pz{*|MzBN>eMnBz%+7znR*@ANSO-cFF61 zOoWC2z)Bnb9GR2ncRhx;;x9n=*n~VABHS2bHsPb{k(4$uN^YI4p%X7Nh8wx9&~APP zgTr-FjSg2Zqw#bRr@^O&jD%&C{1KB@g;tQ48Cu48Sc2b579|lFmiqk*37}F=Qf3BVu zGH&b0pf!N($qYe2{(Ufgq1h}%?p`vIr&b=3%M~iQB6X+AwJkxz8%>tZ!t$|7O+_-@ zdW`yILSYB`_j_hO~|JNHE#YTXq!N-9nzr4=ZyW%s&-kZ2bpi@dVG zD20^r_k`xQgsgTMLvtRcV9xzeT%jW3E)U)4+dNZ$n!U(Fon2)(3H}38pv{1lFB99f zRavR`W=i}zi-D@gq$P*(mZ*k$^{j#O5#WK2|pwDNnVBPxqSxs|Cd z0YDB$_qw!aT4GWYwp`uo2`@D%*?F%l{(zV57t{&uTgDow_4=aW90QA`Y~*m9P!KIy zYH036#>G%;EG}p3;!+AfMph>^IS}BICdx1XDU1qX<;|Pj^kgGYaAC%1#S|}(O&r&n z0yhUBqb2ZJCcL{~lPyDq11s2TfmuF)GSDs6M|S6e4wqOE6F`8A&Sm~plQP)SKw)ET zugPsZ68#0x$^fOxvhu1oGn{m)Qa*5O(<_eQSIlPiM4_OLOjKp)a0%u4_!Pd3ga#3)6JCw&QzA8uhTOx%#z;cUSh-5m?U-3Szo9?GBhnEF4YW%qiUaWyA> z2y&&0h~#+IL=b@&^Kd;pF2Qn7)rAT_8k9N1>f+x7cP&XB9rBLE`Mje(-i=|g=o;J| zBVHdI9FeS7YIr*GLIhF54Q=z}G3D)Br-Ex_1{i+HjSQ_&t?j|-S+=EYp%KS@AUsz%eSxZ@#<(b(R(cxYm?Un7tlO%P=%~SnDHq!5!8v&STFFO10Dv zgJ>PQuX}vxj`;`xxE~-rF?z`Ux9rJ-;;_9P`ZcYvu#JuHV<1{Aktl^DQoxK~%Kj zqo1Ey7}Q!%Hh41RY%ko=H2+_fa+{b6T^ z3dq;TJCz8Nm{{3gjE{)2y|ASDmq<~{5khetGA6M5U32hvJyh9&^}4L5aiY7~a#nJ< zcrCdhr}qNxEK`x9^f!lLeYyE_Q9N$}u%nlZbje6Mb|A#n9jD8?75TCX?g1l?D)bXJ|OBUzuBF2UFD<^E))!**9|4=8N#vmgV!>FU{4|C3Ox@EXm+5YaO zOibUt6!G*p%(hwTNX(klmXyOkBzl@&tm)QIQpKFPLCKc- zuBd>1o_p%Lw&|Sn>zAy3GwrzX-f0sgE*urz;QCb;SC!4BL4r!bFMzoeg80>K{(x@S zN1IvQ4fv1ry32T$KxNOVT>FZKfKFlzEN5uYBM!lO&M+WcJy*yP&O+`*RejCx^IiqmPvB>Ku~W%R{>f*xDU)IWEG$}QVw#b`c(=NYZR4#xOaK&`hk%)iWUaCg!D z`lnps7kVLEWBQk*tYMWLKbr>g7f8YVL!2#tgu4fqA)C@7RMUFg0;iF}LF6Bp5Rsc- zxy-yl5-*#=_d>^An5Qyxc;8BqZ@aws$umvIse-!$8*I6&e2mHBd%HrL?8!#7)(;QVpY_lZ(O$0wGf%jbMsL$UALuq&9~!UR059hXu9Yvwte%?vlQ(u(19<`WhybAKmrVTy zd)zVLyzed-R^&Y#Mu~u=lcx~kp{1Zj#OD+ZSXl))+Sz=~N1iR1E<;>A_SiQ^cU>;& zTbkSJJSh7uhw4QHM>pF8#Qqv$!4#4WPwiA!vBY-qJ^k8QMfJ@O%r8QRS5)Rvr5KKH zCzeoM%^ZuJHLacm5_Q*JK*PE5YVqmO`;Ns(qpP(vORx00>tKEi;47C*j4Wha^48x^ zlf8jBwL5zO@l!;Yf{#^YM|tsl=X0%-|1N83^-7urrOa$Z6I4*o zmRl<`AVE+V^hx{iGC^qp<5>S^f>m>xhN^&!iBPV-TsNO^@ky@v)K1| zb_n*@p5?JI+Z^IqN5yztc~v7Q2SDWp?U8Ff1P$**rw#tIlq(-t&+a#BY0`%Fvvc;( z%I+_rx0324S7N75grMZZ8qbu39I@}B(8m>8Bn0^5qw7uRBAk1hPIvEAs~x5BIWy{h z2y-lY^fP1PK+%GNEA@)UBa89syu+lO*peDM<_>+e`8+n8p6*J2g6 zQ#Qx1$zqY46t$oQV~GqeNzfu)Uz#K)U&-1x8qLNB`pZR*$Ib=AuECWdRQ`~%oRT=7 ztHdoLPV!PX`o?n6wr&Tktgd!5eyijkk?HEtKmT9(7*5QZ+`?G;(I^UZUr`hCL`(=mZUcN-q1%RfmbA$Fop{w%$#Hn46y1I1x|#SoEziyEBpm ze|+or`~M$(o9kHakKN?&q9{gy+>mqOUqsJ#Ox}F#7DI{JJzL!e$dM6qUU%3W_@e(5 z>fMFS?^~E+K~W%#Su$rx$l;GJO-BN7*13-ipeh8=_l0uDqEaBJt6J}>Y4@1Ml8nDy zkpXIYc)l1TZta#Gx6a@c$Vwx;{aTF_-oV?BLX|~7*k9_;V_lAiwjIFEb?Yp3V_{=c z(ohPkY+h86ziNrG*F41CG&ocOkT`xndTW8l=o2*lcFJgJvyn3+LOJ>Mr^{0PpN;KQ z_F9M-I;o4u06)mXj&f^?w?dFQ#m=`WR?#yo{+{$5SCzue1~Mj%N||eXG=Ao!@x6J% zA1#8xO$XlbXzr?~*{Cvh2DZvD7Vw>n(D>Y{nd8eVp9c3eAaMT zm%Qhhdo#VC&9^uzi@02_#6v7@zIz`QtI(XkbNOZH>`LGe@_C1b;bTwF$*4I!f1KX7 z{9UG7Km$fH@J#S{dfrmt#;q8aHW+-(_bD5}SHZyqfvGlhPkwFYb)YLM%|6F`sN^RW z1nc~58%u8elKFZ%h%zj(Qh%E!D$y(|r782w!0O!xmKf7zYY%WT&T^INwu6;qI_D;9 z^q>5em-Hy(|B=i!p@DXbie?)~R;KBn^eCCS;s=h3_UJQ!E(O8KbN|t(ACvZD*kjiu z;CxsYL+9ClFlc%DK~SmfxkgK^Mt4a0G2g)bBdZ_wxT_Eo$qXFhY=C?YgH+CNFzaID zRdugIk>ZTaVgiS+0LDRZl0Tg&fdIMv5xe#ECHD-il8x7Q;SyDeY2rNU*k6vns6rznG2TSUjlnwV8T)4%V-h* zJpiCypjW}+27rNH$g>D05?pY_e!^PiaQh0p| z-UBr~uU&qzIKru0KnVt5wQt9vsQ|J~9)r7JdC=dsWZ~3eQwX#|^Hu<~-`Lgd27tMw z_O;I;plf8ymX+U9@}jlKh2^O+s(oWOKhrG!ArpXVmUdI$h3=ok4@hxcPj~qJP5Erv zwrgLVX#tw(+c;z;#xt7G4~|p5H-}C<#$X{S@@4zB6~Nb{iPN`YqBz*t3_4!gZSPP4 zc`=ESidVoN1yo~kDlY=3&hgb)o*Z#!`?eZopWtHT&))qWJuekSvkDo`J-m^Px2Sxt z&%J=_Ujz{5(9gP>)kj3%`wPb=rM8p29qyK?RM>6u9F#{#qiAVqJv<%P0xUnZH*=58 zXXD}MZ>6(}8X8Nl!vcT;S+4X`_(0&K*??8EQRDK1g|lAn?yNck17npNuX>E!fuAwy zps3|-ss2YC*0jF(;6GMu(48swIPS-phW9D8rww+C6FII}=d7hzg;-zuJEw5A>e3u7 zZVr6(T^;^!h1b1b1YGzi3QzZ@WDV?Dt!?+bOrx-TNXcR+(L=}I_D@lxkvuxcL)H(E zQ~57P@#TYQ6I@MxSAQ&rEKnULbf`4$#o%bh&EiY08rP7~5&@Vaj`0`GrxRRWn4#`g zn3TgizH2l<)?rk?r0`6WxSlM|)QMFnEgG@_3FDVfrSjtu1Q&2-efC`4eYj!M?J)!d zXj#{N7_dVdu;J4oRtlBu)X8JlZ^CJF!Rsf$_nQmel;hV(1W7-7r7&cDcnFPwDk46S z0#e-v-3YHg^E3Sk$O`ByL})<34!-GNJY-8}@C#pPTs{TLzk{ZA*@Z>b#N}v4`l{JF zXWNMsvpK8eR+h=sAuCagk3k&2*Ccv$?Ct~XimY}s!GN+mEwlQ2$T6VEjww^6waev& zO)O4#=&q5@Ad;g}%Z&N{M2{D5T7`7C&UIW_Gx*Ts?ngilW@we&IeDMn(%be#ClBx}DcCq2 zbv0lS`(Pz_bJlC?`_p)B-QJttKx_4SLV6qA+4A6`Ox(@3l864)JE!KCz@^G}Xz|Q}UcBJzSfHN33n=f(H{r6~=9{*&z!14P1@!e=S^dNqW zvd=UAAX6shEC=rX(4+F9%@OHf)@ijjBH}$TG?Lr(2-A2ZmVya1n@GdPmb7Zu8G|nP z@-z0?e%8@*p-K}tb?*Elj!o^KrfaRtSS%sFD%H>eKq7Tgiim+Jm5$s5$;>BNVr_ue zuze=d!3^x7j`u&w3h*s~@sT>N^Qz?Ja# z!qMV0Gso);2P9-&fgun%@$KB=`WnGccwNpe0AX=nx1AMr-(5+nkz>k=1WVYk_W0VK#Hm!zS+c1 z9SW5bMp-%kW8Ugk>`rIby_}hFS-hP+Hu}<0cUZ?gi+fC+ij>Bf?UMGFmh|YGQ$=+A z_vb0%$_Nu5vjR|211jd;Ngj(gBWsvzwgStao|xq4C5Y^*5*ZdnG8;PHWQd_{;!`;; zi$KgfE1G3}>7_KpqVJDkcKaHm7)M6KKa>9mCQ|&j+3?QJ-oFc3&gHKJq{MEWM2Vx{ zZER2g5fUaAR(wXr7$A|ew6Hi>e0_XAN$Zgwx?IonxX-jncwtjvSGNJLGtgoew{WQ7 zjgLOILBYlket)*9!j+A-7f~HTQ^O(&un%KBe4Ak0Mp$XxR$$RaThdC!XPJXeo}VL* zvUz1ppoz33Z{xd+)IO-quShv<&!m=yZ#}b)jt1tSj#Yw5DwEudu!WWax z`uC2A$8!pMtCzo9sb+-qnSxlc0ca3+lKqgzq*z=@TSsO-G&bo!KLG&sG%L?NTE9iC;`6wI(^a;?jpu=33yKKO2PJlyy;TIa`ua+D6ulUr|HDcL3xrq1*<|Q8! z^(XGg8a4PzAcgw%Xll~{cXMCs6`mZ6Mp%q&C-Yd0jTfc!%fREE#?^4w9wO@51Ug!9Qs?livU%rJ(p zT}=OV`-OF~x@6&O`Qui+sCAKYdk&8txVJ>jua~YY2cLax*B+U2R%TqUn?j{Mn8_R* z_EwQun3HG>OUo+md{UX;5k9-uy)IyyS-?VCm|jM})RlgnVGVEV|A&T>QE7u4(EAbV zGUgV*E-GH#!Df+yZ~d?Pt#kb8?qP9%)3E3-Js^@kMJ8vAeNsvH>E%>*{fh~Y=cVj2 zE;T)3-}n@8D=ZGob$Svy`sP^kFFc{xh||d%vbp*V?>cpsbLmA+GGgT)Y#_92Q}eq# z{1ZnyB3^N*xGusTDm`PK5N%M}Q595x$!bw2GZD!E%4^EA2s@bnsw zR`zhQOD>eC1Ik~zAU7taF<}`>NIX-%re77NDXO$QkyRt0`xSM6Rb*d@M*!C6dw}?y&}i#)bila9XmIyMpm1OX>CX(5d}ps@s*jV*OUYe`W9a6kvx<*x?)5waHR$nC{J`+wt=Oe71etE=FG2QMnmV`Lg$ zV=^0yugE>_$ePnRdH-KY3k;w~(q^5~Pzli8%b6|r z+k8}kl8fE5H*xiYYsP-_zdPe&96Q!~c?dT&3ozWo`2JnUQFLg1t4B zbKit|&lkrRxtw#reCAWBo>LRfDG04U`{?!f;vS%mFQsOC_Yz;hZ3XPR*q8&sQD7Dp z2}}NscwHNw4DtHD(5-KuJdd`Am0SPc83BqR)Z16vAPr|@dPu#==Za2@0PVa<{t2AO zLzC3`{2L_G{?ukefz&wDQlUV2+lORKvMda=d1K_T^+{!mggkmC0;WZFt9NuWGZ#W(YHIo140;-{FF~E#t%m~&pwe6G3o!mM0-Bir4req`kIf6Y| zEdR4Pp3mWg{5c_k1@KIai!po*(ge!dJ7Vs>+ZiWfZ;LbCA3|VLu&$Bxj-Opp^6u$j z-%k519uG5;ZF6kz+pcmLTJ+AtA&TE!;mCVr#GP^byM!z^G5TT2`LCXCL}OR|HWun+qwlV3jwuV+Z4`8c+2yu9mzfo2_L`a$$ky_fVPXxA7vV*TD9($K`MwF z+N)a;>zmo)SOdC$I8DSTvm@NgR^@%zfB_T*rOim_XU9 z$I0EJsZ~O&g=8_^>3@EU4^&8*Kp<$0^t{2#iE`TS=ge)i68ZX?OB4lpwD-K{;(I#* zMckK}Y?|lRQL;oYrnD(5t4K*rI~=p1;AnK3QCZ)GU9Gko{(NR2Ia#dVTF#CCVDQCt z9Dm`2Z*q$yT3Fd7z`a$+Xiyn+#f0Ht2=P+$eIwfL%?evQ%=YJJJ!R91bk^+D zPBDr23@4OSoXu{c3_7v*o8+*C6!+a76=4ltEJog6>T{oXxy?P$#jpWR4Tb&gB%mL= zn-xz#ClB^>6;t8-mQ1F?RZzu2(DhS82f@6SQIg~ zZ8n{MHtV1LO$G5u?(`L^SX4gl_I3-&R_FA->?%LqA(~A@kp9(Y+}SCnd$}KHD&WL@ zSQS5(;PXflZ7it+U$8Lh(`_f`Lf!?m3O)q|k0_;OGY9q;SXaGXS?lT4XTAA~EIU8o zLNr=KA@_|Wi3xtOfLi;S3B(sUJeiCxusU%jGNQr78rU}-|NZ9Fxplxn`Kbe#>~~24 zZ0_865qPIBxAc&;u3&Zbo{%A<{3>B-&*BvQw+BR+S08Q<`p~8c8^7B%bO&eW?Phnu zhV{6Um0KmX+SM_1z!-5U&muNk4*Uw@xPGPlH{{-Q68L$nq@B3l%GepDPf+aG20PSG9khyY(FW1*3TWm=KR+g0GaJLh z8`9Sn!2>g5C-&+TC*C`kh@tzApi#CRz<}|^zhvGdSsgRezNTLuG*)F=wgawo9}I}%r$|S3MdM2|VI4s!kp32a9unT~L5cgC+B@xH;(q5|zj&-*-RYEM zqnqoIaRo`s0jDjo&t}uq@L>;miboQo^!ew5=`uHs!(R*;g(#prOXZabZ=vGQ-4K#O zqO(V$1EhUYwV@&fJYP-#k|$C*n-h3nj6aA#)b>6@xqV<=wY z$j;fm*w0=P;xqg?D=gB$HwztIJRa&FGfu}XR7$K7?~g?^Bt8JkhBBJ?o1P)YJUcsZ zG6tB_q)=Vix40UWnycIQGYuLlO~#BkgCEX4hTu(LW5UOP&{A_5Y9jk++8W@={)u>|XqMU}sI{U1;F{zP7@f^Y0ybgr;^Ht4=o8Q%gl~kZ%~aS0>>rmJW=lDXVP_-(rfJd= zzQM+ir`AsXuf?1}C%Nq%v>KIO9x$}~!@bm$s)&CSyDZ!dy48x>GD4Tp$w&cgTEGkv z(O=*3<8wk=sf&x@G6eX^-Bi|I(_{6@W!+sV$hSfbW^ej81K^yLcw@oSV_`*&7;;G3 z5AH5cs^?msPlP8iC3WwU`k<05T_2u3IO%klKbgbBs!PxWjf);XDmy7Rqz>n|k#^fik;n8MY2G~(l%V84!nLE2hMl}TLj#XzWDk^%^ z)f82W(XmNz^SwYrvA4IUg0}X^%VFZ97X)MD&4Ng(nDvu*oWXEW$-G||e79~c1QT| zDTmeBnWK}Fk-yScNgB%#cm$)CH0Zjy#oaXrU*+Nk_7IE8%F`65o0~sNZ~A)W6x4Z| zA_(sg9u)P;Z4Z7{QRQi_v%5(U2_^>Sw&F}7g|7F^v(EtYQ3>S{@9&~3#O}u${%P~6 z^#;I~4l7nIwx!Dr;&3NxZfFn+rUoE7QJc*Y{1tFQ6-@%Ryo*+M_J+U~A1Fuoj)8n8iynXOvUu~=2rS||3JYVR5NJ&d@Zd4 z;~-S8dRpn&NE2ur(lAW#VsHJ>hPoknhJ7>jK__I{$gu`aJHIo795>3$K|K|AJ!zTo z5_Iks2MSlCS$M=f@%-|-oRQv*RntafTeJSazasTX&yP6o@)s(R>b%f^{U>8rnqq8w zVYV}c>P9`n<`NAiD~{KFVB)!+^hzHwP^6^Wv2P zeZ`Dx4@DeILt zul95`{0NNiY3tPFJ!zVkh1IKY;h8XtVh3Tnu6WRshB&anHSvoa>Ur6avjQhB3%K1W z1^8lm)EU_s42{bR7oaGEUAr1M?s?JFwNn?{Rbj)?`{hg+h@2Byj^opJj8bhHUQLNPsPGOoC?0r^P-t4x6l zT0Or>VHI-(C%3~?vziV&J$xtK|L)4aDEME+5w|e3swBE6$&N%3aL`kpheZ;P7!(W} z6)ZsIQJr77V=AMjv~b)RN<<4jj*0`e_t-?>I~Wari|=S85sQz;C-hbt9klmQ&rHv( zlv5;Z@q@PvdrR9e)>)`SCvPsO*0YtQPEd|1GH#soF{WK^3C_Q}xq-o8NR|lI1VAP^ z&HJ$9*X+}0gH)r_%-^a(56rCB7M~97f}y3Yv;z+HmgNU?d6T9BI}ZxT`%AzB1b{xD zu1mTW$}@z|^jshG?d5NtcvgEl(a06`_2Z^ZcD61twM)}`rULp5Y?GzwXeH(N!-tF* zRwI^hl~@~XrO|T)ymNYeyJDZh8VLDPj4~0E67_$(kD5ar%Ty)IG-&(z>sHrH3Hkc+ z!v|wT4fVf~A2%J`8L`+HU~W?6is_sGvZ=3g-Za!+`JZnmkUFkjZ3_vFg8Peu&0=Li z52QQz8|214eRJlEZLl_%?;W4w>yuHvhJ=(PTwd7&4-`^+4{gW+ObedsWU~%sZL1(~ zh;JG#4x=h9dz8dYD|PrA%TENHEaUl>-peaDim?C*qnEs@f}4fwGtL;W*_pv)sXv+M zsZ4cWGU+VIF!F`G#;+i2UeDbaXOD8(IqCrqk3(vjdDJy125gxUa)kHxuun zgoi;UUUwXCH!GGZNbW}P2>CqvlIe(F3QI26{@PY~LTueC^HZ3Kb?SeT0<#U3)GS&r zM>FjUl`_j!!@ioAyRzwSOxt#O8^ic}IeiCp#QXF{@)5V@G}}XxYm=uQhEP7I(Iut8 z23B*P^SVN#>#t69Lfp}cl`M4=3LQV__FD3Bx+CQJJQ0t~NkzlE@1)QJ1a$y9YYIc2 z$2y0er%2?OK|kG@VNT`=>_eT6BnFAibA#G)t_Ipwt%zx=*BV+uh%nq;UGXLjcJ&LCS@< z#hr@4%Zs$q46CD~BCCZ^h;7LqApK8Bru`zQT-Z4(7zU~UoE)v#ndS8K#1Tcc^1a^8 zHw3F@q~bdess=g{TpbL8`SnV>fH zuRfF5zWmsH+dBug(C{#->CwY9H6~I|@853%t52x<=MXgan6SJs-;fXe(^*bTS(T7O zrZ-gJxpa!pclZC#iCbn|l)3r&{Kez)%1UGHot{oT?8fDw4FiKEC_I0v@Al1ytK>ni zzL&RmgR0fT%k9>nbYM58O`7%i8%kF;?Xv10%orQb6tdG?I;n2>tY+4ym6ex^6g!H~ zH;ke1G-11U=@95sn;mE7DsVVc$fGY5vQuBqG%*I(Ya!U~EjsYo#vpQ{FD~G$$#^w+ zU0gZX8js|RmMt2pv=u6D+DLyAi~4xO6K&KojwL>|7we%reNWSoI>7}Z&Aw=iR*vR z@T0||DHClq+jtFIG|Cp{xAGkamY4mOe_83GGBR4JjFq&U#o7D+F3?oQJM9eE)CRRJ5ng2`F zcQ)(;@H*XW=wzwU!)W?D3W{qICVpFKPHp-FE33;tZOxvj8tTeXN{4Gl8o-=d-Rd6I zZeaQ)lX-)aLZvRi{!n-15xM+g`iH{a6Bg6y#afYKO0f~2nv}S;ZX~^6kLOu|#U*zy zyH9y#DhEIbmZmV3IMQ1CW_estOuCyT^ zV!v#*0K*S&J~M`(|LBue`_yJy(Rb~!kTl`0S;}qhNab|)X#($TbA9L|KqE;P5q0VQ zD+mX>4Lxj7dVn*~yB|(*IjHf0dpZ1QL!aVBoWmb8Jz&(?39vEKmeo8JSy@>&_a0Vn zO9ViHgbWlF3_cOLy=|Sy)6&39Yk_#vfzD1s01>szZ3=Fc|5tXj;Q+Nmb!XHc>lnhX z5kULu>dpc{uq{nTWmYFQmX)6l^d!ztt!}(pPFCc-)LKqUB3g~tej5UqPxq{H#Q!nN zk#N!t+?B%mb0srBeGgHUi)ZMMppfTvJQbC`jw6|9~y10`U>8|TbFKxa5hWJ0Me}kS(87&N!%kd_E z)pP93R++r-p4Ze|oFX>6uZO8vm0-mzsecy258Yp7RI@f$tN&Z?4^DhRYiVx?1(SG( zEy{CUv=tnyVE)WV=nt$KJ7bLePnsfv_?Mqpa(~B11MTtsb!pJh>FCNWi#^tq=|#wU zKCPm|8MliCEf2$+_x;@+74MSC?PdQOJ-86Zpr2F(N7Upo8H^mEYx+LW!mHc&n?ph@ z>o?YQ0Uq{0K4V=5u}KiNJXH|bRa!lQ)0yjAe`~&@MH4X+sdkUKx^=w)eZ|MVANr6W z3NlzlclY@J{BPl#_dqhepDk?Dj@FUp9qwaIr4|uUc|qAnY0ec@_N9n{6`!H0g1Q$_ zl*!=S!adl6d{w>#^IO%!@F=&l7?)A%%Kin@%aCOQY2&6>_|TpTU3%V<4rRz)vD)j16KUtPx#Ec5T0 z?t5U>d8;!rA_{JwgGRJ@qov3m9;FE$t_&y=v6n$zSGesV$z{AfLT~UnkFH-j6Rp!YcyqXo*~y7`<&Ic`BVi@vw~GVxv-2S6o%R z2AXf-k0jh5!5fO zntSV-dXXmJe6EfK>)r;4CLUMsf1U~d=Mr!8mlRKKV<&a?+)X~m*x1>-%C5b7ZH@t1 zQ8TjkH-FFZr>|GVCQfD#fUha4d%9*g5pc!|u7r12Mcot2;K|~VL=8dU@E0}h?TdI< z@<_PyZRqR+jo5a7CU+nnzac+Pt|CWX zt3#)E-A)jYZ|+P71v-d|Ykz04Rf6J0BcXEr@q-M@SA&iF20QMHT^y%h;1K{8_o+{FU<*$=O}Qg5)pd!31_t0-*rAH&dbaU_HC6O2+pDub&_^72mkoVkPfa)v_?_dG zbqXNi|L>NW{^W1y1lSnb7A2P zvo*T<$NRx|KK734+n=X^znXFY&awadb`g|rtQ8&J@JWRv4A|rRyoI#9kdG{{&+B(R zP3Yje?*x(XDg%N-K)}wuBg%CwTrn7(E97jGT`AjaeE7- z66|5!pMclioR0_UzA2&*V8#qrAD8xSGP$m)lDqNCyAOYVFW#vy0Cr+L&F*;ip{uv9 z?lk^#hAL%oQUnuPaNFQ1n=N<;@;2tVdBam3FfNn?jcsSgE%K7rdh35S1~c~A+X?RM zkX^W*on5`3ZZrk!@2sB3CMG9tu8X$Q0WAa8FfDD9s!qF_u$37HRK4PBdNT7{3&J~> zzkZdwHDBtFJv+!Kg}Jok{75(b+_NUKy3QEKbf=%3y`k&;?98cTK6m)H4a9l&&O55d zFWvI3V|*edJoS6d8gFlMKdQN|9<1@5fkzTo5Z-O@Bx1^4d?u;3Z)*jWc^O^$2y8x~ zazBR79Ua^8<~ovvH<)aoAf!~4Dq;LzRJ~O|lwsF4ilQjpAt{ZNAl*uLcb9Z`qk=Sp zba!`miF7wZ3>`xa-MJsW_ly0{0S7R{J!?Jps%w=X^D7<_q{(U^(zkiO!T{d1tQSX0 z&cKxkq|tKjgKI73aPF>A+c)|1LC0vJdgIf$teF2Mk(dp>-#5M+Oc>{xxM+^tBO3#p z^w8ZUDCj(nw}bD6ry4x~Ph-cM1$Yv#%T;^&tIE#Z619fsN+DxRRvHCXw|p~Bg_ zM`zq|y~bUpUyN7?ib_j!8yXT?T6i0d7QMm4#+*76L?|dk6W0|$1iDU;+95|Vzlsll z54y8JXwiC=rUifx3pP9V_ziW^e1hk1gGp#P&R+v7=-_J?4y*W&sR7_|)u85wlE}Md zH&W&PWf99zwR^{~oFHB_$+}_NO)sL)%{PN+5RpJ3!v} z+#Jt)M2gj#(T~ZBxm@_);mZ`78^a4>Al_B!Lt=@=zbnVG>S$K=$iNDBG5op!q^#K* zk8-l(NEbk`uF%rCdnJe(1`{jL08ss@d5-~&n9oz^UWUY-4B)AA;R{dEGPy@nP<6JQ zS6;;qj`S0CZmd#^rc~!dXxC{FV*euj%Qqqn?ru+cP6#&X1c7R~i0ePqSi%Vcp>v7cAApt}?BNHt_OZuFGAn^oXeXh(YIPxnCgs z<%IbEoX{!oB5!t=fV>@eO(BFeu#Xh&dkjssXD|bSR_uS}-i%URHdYa87yi+vx-0tR zmUYAOK;EP;7jfa`pMZylv}*lIea7qq7HrltQyWy2wO7{NfP6NA$c|QRAuhKXU;Bea%6!v9Zg+Q;4+t#m8!U*Exjk89?SdHX~lHyyK|h z`~#O0fy|Da#OD6~-zh|LuK?F2>`Cy4mR5px_3{qTXLs24@8i$*?nK3#8B#AQhz5}6 z#g@t~XFpm1`0%+M)z5f-s&Q+K<~>S&kq`419t}bt#s*#l`0!TU*!^0Ph)!FX{i)EC z7QIfNxw5fvmElEnX~#?9tfmjB3qT}E4v4k)1ZWF@?20y!abVz>|5)KGBndav5 zo=u+Ua+D2?>KR{`IMjzapEs+zl#kXimztm--Ib1tr}tzACI4MwM-rNa<6Pz05;Pb zL(3G`4q(44qX5*schtRU93VHvIz?%g1-{s^V5Qo%2z5LjHNiVO(|SEnne|9u!@%5p)1tH6#2{j!u}N9BZrX7}GfC3= zPo5B&aPL`g_mPOi?Wu{3cD@wJwT(NITZ*7;3U6p=z&&P}rOzbrNq!Kqz)1Fad=jyH zoql=l%boJ>;M=KcOZ&m>x=R0h=u4%>P)4=DLriuJ+15xA`fV`^GWYleQ`Q08I6|Lj2 zVAQ`4;|+U}XIPdAq};g}$b{8NnGg_h;e1v=hXc$-F?7uNWLL^APVHpA`@BihAsJFn zMB)bVo*f-)1VyBGR&v!A%DyCQXRHpsM)C&ytc5x+_@2;x$BjqhQ@5wF&9WGqQ&I!e zqi}ZBsHoM-p7Uq^;JM+qS7wb%QnNm*I;rt$QajP?VFBVSOnpm&QW{^C&!{26G#L2v z&5)R6eJmDd)uhBVUjoz_0rl0z#r5z^$YHZHlXI{O|X~ zfWrfhwv)3=QN8VTn~j6 zO}W3J!V}6B@LJV>*KMw-bp?4KNMKEZkt+#F7R@|&?YE*$P>eM-G4v~V>p0{r3&KiG z>PK6Q8MTpWWQtxZHenEckV=ZeiUk(M zw_%mYjt<#=qAblSE2fm#lXFr17>66<{5WQY)2$bxx5kp;<-*zRt4%|9dPvmWw!Mxb z)Do`deV+0d$z``8=K}d?Jga?XKcke-v?*QfTR10Y0`8BmDfPs$)Y*c~1{xvfV#)C0 zS?HyA8D%=ZfTGNLez*a-XPEn<_ zv7Hpi$U0;R)!*?l>$gMskwj9?6OU` zxNr6P(U(uHe?7aa;RC-}_-`NyIK+@5AMwgh@B)S%QBi;wp1)_Rt*swAX-dIJ^&TIe zgM&lPe7}$XE;x8mpDkr1EA@c(DvpeDke~-wf9W+N+$%)TDf?-wUshrAANYMWu#lrY1k zMZQ(uFK+PfL{DZYksU1^QSj?iCcEFU0mWL@T*qtwdVi_kw^&06Sh<7tQ?%>Uc!wD1 zC)E!Q8}^C>&Mqd_V0+*6Yk6&Fltz|y^(LCMKF|CP{%y#qL)W7I`fGhf5YcyBuE+ye z45uP{O{&uDGFuk$qeZpmp_w8_rX{uAEGnAM1M9oKr(c$=l!vhuWagLmp(r<6P`;8L z->o}Vzvp{&seCfW$M#Q4jRCU;AhT^Ued82=cl@I#C+2(ORs&=ENWNS=P8Vght?Gl+ zN8%ydwm(M^2D1F&P!KJr7ystsV3+fRONJhM%$gZVg4(Ubjj0HdUAI{k1)981LyDZ| z+*u21`k1qf@dT-Xgt#Ync%lN$h(l<3DQE1A15Ee>M+WYBx76wx*IdTi8Q-KD7fj^b z8+&dy1{W(_1y1&-=n`vp?Vjb+^=tpM#6HHkaCv$0h zvHU}v1wwr^T2jsJMm`P-ycr^aejBS2`d8t!3CcP{C(9?ZRi;W^{=`pC8 z(4TF8^(V>v@#j?X{CC@D25V&<8;n^u-9e!qK8>InW2f-gvzws)6vnv+>fgJZPX%8k zrWVy~Y#)gZ66$bY;)$~EvB|27u4EJv9I?U3FPt!lh@a7PZ`~_QU(YSz*JO~VRcBRE z?p1%&S3p8`1P^%(=`EC5cWZi-FNEmJpTN^xpp(T_x5Wwf$2X-%&z)21LqU(YGij!A zf%-J<_6)9-=fIMnaQw-~ZcpREfU+lJWWY^PqEGic%=U~R_%d|3oQp5|-Qx)*2sNyrYM1b!;b_B4YkIVSPo;ktf3!aG#6HeIvxgS&|H@0( ze>&zSv74EeKDzmNhtxg($1Y3IWO z*_)^H=asId=>T(517S%;I3N*VZf;(Ym{5HeULL2WTH`aR%ZP_;?{`ydYXBs{UkG}X z8uY0>ZoOhCk8Szl1|*CM$@FXv@@i(lxfWMMZKt>CZ}rk!z*tkG*#werm<`wFXbd!#kk zZ03@lVmpcLi@O%G6y&&zX-@rifG!@h^x)E1>Q21Gu)J1W&0FHk%+>^O(n&p(qAV@xJepPMgcfWcsA zL9R^HC3ltbS`gY{kpLk!SD=)M_*pC0iZ#c#?A#;?i7OLD)o0FCmHmZt8#&0Tk?wI| z-Orq807x$;G*`V0lrN~zMmW(=R-zU?Hl(s#Hm8dHTk8Kr?pX1IITGxDiRW*S*jJY* z4q<<{&TR?OK4LQ_Mhf}r`Jn9~4rbOiY zUVD1H`bW2z%6LOKBZD`&7u(t6V9n7fXv}bCE1GI2U-37Y3QgZy!MNGMdTAC~qgn1z zKZK`Sa`n$QH6n@748hFblYi>XNr+-Ajgg4^Y9!3roF{RdRu@F%C2HGwKe5q{AN_0T z-si5#1~Gimyx$|ONf}k&(Fb;CJC-guRD}0XcmGdWduX71A zsj+JgC^>4}yeTU5S9j`74qXD7z?T@qe1=ICT2^}BcZHW%o=I@bhwD+TNT(==<1@)B zNzFdw^4(1-OI#X~o#E zBg#n#C9;_kkc7Y59|tbK*}q*(#tg1>DU*$P_pLXZ;%Fv2@S8UlkDPF3f-E2)*B2aB zn5C*MRBBgI!O!kZpJ{vBGHNp7WeCjDL^0jGTF%Q$?*{j$0&@8eTZVM&@>=lU#*bC8 zWFCANGd*_+s2kYw$LB-_z}p0p6oubF$UR-xU5yBk;Me0X#9$9A=EH5+ijKXOlGUW4tZD%ZYXu4g~ogy!?Jn-h}R z&%4piy2-TAyT$fLQZ=n_Xo;(%0X55i6*4rXvw)i7YvQe;dMse11}o4u|CX)rPeyV; zmxWFIc=3g7!!eKKkIc{Lqse^=8M;FTLJu=`oL?oX4!F=bKT*A=nfU6E2YzJAD|sWQ~Y zA%($AnJFy6pDJ!q%-6Txhw-HbH^+=n21~Vgzz0~v1@zOfFqIft{$u#$<2fV=IYboY zK;h@g^X(fBeY~lRN4()Qb%e=MNaatCB!3XQg~jQ)d<@>IBNQ%>Yjjh7)f8p8?qQEc zEGR}pNdPI|ZtaYN(78$qR#O_Eyg>pTHy-4@HorqB8y|VaHQYtQ#i6Jq{;l}~qZty2 zrdq@icbw=4XM9hbhdv=$|HuiBn?)bnr#BVEvNie>_DQIAGY3j&vWBM?^kW}SJ=l#-^)HYEiQhpg&!xLnZ^Y3`H;t-2j42Lw$y?=1#=ws7 z;mL&MAbJ;55;<~bAF9n?zfN+iRSH1b>7bJR26wL6-6E@IAKgtGA7>IZZIZ0qLrFZ9 zph#No0d&HS)zp0#)V-_iYh{KmWvNNE1ID%z$mSu$ghIM}+iu0U-P#zxXSXYoa>->Y zb1bJwwSRHk@aQXvca%YIUKwSsDOFeY4{NGi1RiJJ`pbd#MQswbMd^~dVxMeR+Kc8> z*>sG-Y*=KvKS_TDrEMQBn;OCav`F3l^~G+fE2_*FPLm?*n^dQ^|I!@VAkB8Y++dx~ z_QU%l(b9ZPU{fB-}2O0$G@#DKD&e))W$#7xB}7X?6WgF%HX-b13o0q~B_ zuKE5R1O_m{ujySDtzR|DOUdnaKgt)RZ~EAE=sn5*ZBpt6pb#pa*+n)zZT+sNJX5T` zs6IetOr0Se&1~ak>PXC<78%X)t~l>nlv2;~>hv3uG((zjCILhR*wLhrnFZHsYh`7< z)LxZaT5ekpF!e2O?BGkxK~jIHApN4l0^huyXP%hdKhTCD&mou6)FxX~a~1XTw)mcp z+1n1YEi>tn@Kx#eloge21SoK^($U9kv3&q)K`L~a$ZHG;UdofuLOyQ#9CT4|)O%S! z&dr?dCGy=|$|#)womT=%%c~YRVK2<=#Ray|ElmAXm!W($^C80a=-@q*$$vru@5L@4 z<6b=jt~EK%R=0F6lsmd`TKI4Ir8I^Dn7G;3H-@(T^50FB)XGgp@5*Pm7^B^D%YN;} z_Gddfe>YV1hj7^0&c#+V-~oY9L>Vzq(n9KMK^l-tX-g99K1EuO>zq3%*j|llm#5nD z3f6xqFGWO`6$ungWj3aT&ZK5?`Qzx7o}3`4XP%lB@-=1_F^gt379JPS zoJ44=zO1wi4_01Bdn33R$gE9b98{xMEd6b%!q?)(p0aB`%n=D9!qNEV@aHk*&-%Al zifZ4gKOi&;y;tYf945nTETw{B5S<^;4cIhu)+Lv9uU4IwO+9^A`E=DdHcH9U9;al| ze?B$sM^$L49?Iphx1E8Ur(EZrm zR9%T%K|OtuCPB6rzY`!^j7YrR){%JClZk1xpO#p;UfX>Df`L&b*xF#7^VXKZhL5~o zX`MhY$mt8LY}wj&8F|w}n!Xl`=41n%bo*w{hAh;If3w+308k1w@n_|ODw1!+-&CODwV?=71` z5@J`qn!#gpjxxUYZ`Ogx6fnE3VA=>$qgG9oQgE!-(J!WQ15L7$l2q}Cx<=KRiJx<; zh+vu2j?xH1JZtykxWl&B(!&fqZuF7B2Gxg+eg!8+YGBfvR@zvVeXmFWJWPDh+snf4 z?#WI~qh}29J(7hsSbXa6n(IzYd zG#owtJ3O|7C>`>C0m?4;ms1mhN=$N1)HyZ5WHBdwVvW zLsW)su74?W^I+nvxlg-M@f~9sw!5pENX(|!Ni;6`3Ew-ms{k3FCUl^Vy`ys{YJ+(~ z1M7b1zAQrd6$i1$qk-q+3G0{42rJfrf|xw_)wS~4l`@ZQd`6T5AJXPjjp`1%6nuUE zZMaC|AnoMBGOSwoj(Wt<%orf=DBl#FiHKASwgsq}b1_aS9HyK1RaH zz0EM4EG}a>e%-@P(PF*Xuc))Ue@pq0-29zpYN!@BglnW9c)snIX(7V+pS@ z1INV?x~tNVTy5HpY*AG}mx*GN_&5_j)tV%IX^$z}ykBS%8u!X>rwP{^Jbn0L#LvbW zT}vBUrj9=~JRk27WTX&jdU}DfV&zwEkS~gu#Opb^?pFWs<)DaH{FPx&`9@>eCfeJc z^Wn^X<%4Yy(cegvj`?)4bDMzvezy8*I|k)JtGNYC;?4;3O`=9d<9?z8OX6uLUSpC5 z#ifUrR;Q`PcbJKF4cgL$3RtoLbZo*WpK$f&L$6}|Evmhr`aeh@x42wJSJ9vf-5Bp! zL8XGC;XUfsSkvjLoIh8}+_g!IiXIl<_u5qd*L3ZO$fv@|<+XFo!DN_zM_2cBywf@c z=8rmxtrKlDykUC5cfD-0oPTQGsN6BRsMd$b+3vUoyQ=c+Z-ipNif0e(JCtbS65>_# zl`P$(2Q1i)zNCJl?~qrjwvCk6)tj-^&sqY&Uclu|<|WTKW=iSqb}p#C9&kjXN`I3z zW@z{vjm?DUobM>RbC3WF($tyPhkJ@!KN)=MkSC2&&Xi9YW4&s9h>V>G?u$nO_u*Z z(q+M!yYJ_PqbG|#5!IhV*jZ;061fNe33t96D=4~7L4UivTRfqoCPpGxwegPxb8D;4^L( zv&Wx=FJ59-eVC)dSPo8YROsaE#ZafuuTh}{@o`4rejcZ3*dFG&znN`OZB2v(F>iro zj6a(2buKMB<=K$D{dBJt@AQ7Wihzb%)_7;@H^2TPVrfjdfm0Z$;E$l6U^lAPp^V*q zcvSHkhK_>7nahLCP67K;K?9n=8g%6jxm;N)mE>!qNWN-=mmk!%EVu37n{2;zd zEh6t^^9s!k!-&S|(CN4{dMsP1SHtE{$Gp($+2AS-pHs}PzkJEIZMdM&-4ONq&`lFX zl_U*1RLIX;FmK^>W$0YWkkBbPQ=X4Y{HLDjARbB5-*y`7xtOzE|CvbKY*})B^cvl$ zmAZDE+wXLG5Df-CikVNQ|5RF#T|4HbP=byIc%&DUEea$&zqQI9Q8K)o1iQ;Sfwpyv zdISTaHpf}G?{n1GWhS$HKxA9f@SM(3%(Yq}$7Hhk^}qZko*iP;=lV11*6>rfz2t?m z<+kpl`uSbSm*A^kA;0?epuPOelK2}jfRU61BJy)n{w&!iRGu1p^(QW7DB@io&>H1X zvRZd*M;VdzUFWhdKUZ`jeOkwwFns>#Z^IX~Rjjh|GlKciRE zxkoix(d&|r^BKUJfI$M>Mw-4TL$iNxiYgnIgY$}RT9)Ou1OyOSJGcZ}%^1wMm0`{7@UP!w$EUO+(S{mjb?TXV1 zdT`#&V4IfpsUs`LjOu!PlDL`zSt ztvJuVpXU58> zJ4-x-)vMNq=^A+wwf?;YPXfp9^EVz3b{(Ggc6l}K{#XWWwV~MBAxZq9yE->d8ajGX zT4I|*>C3WZi!&-zN2}wRLj3ZqE3)Z?*6H=L*%o+0t-t(raIDi$)s-aAG9J@9UfDhV zLu}o90!?#NGf-_BPfPOW3nNMk(J<-s)hYmBNK%jqJ6cLDPPFUO4rMeDB*^ zJtzC3j2s3tl=qWqxletBpU09%&BoFM#ut#Abvw-bH$?z|(~MeE;|td0MG(z`%~5K0SbhUfwnBl zH-O8&55Dax)c|7+>Rf8yDyKJ#W@f7Ou1PkPeFt;~n65D(DtkI^kNU(^X$W924ckY2 zxzdHXB`tdf=X5^q8!jR%WI!2s5}WIW+`02>zpD#u#uNeEDt(7V=UoDg%6OJ6t;6G> ziZH!%yE zF*O^3n`bln#)sM=XwpC|)cevUcIWJvI%8;2+S&Ks^@r_TBLl`t^QFl

wJ(9ih$g zPHMmx)3qrDt+J!z9?>_M*=c1FMtCW(p<_C{w|D&xLtq$9^FuR04*j4 zc_O`(%Icqm51+5DqYQ+j34XhU@bA)t}4 zl{z16lHwYtOZ_Q7q?&Eh!>1bLyZ4;{-Z+^E3aZ|HPaDQJaE#|sfAeL#h?g^6ZhfLh z((Ed=CyI2c`s#pDI^`OxIDp{(d7<_ChHjYe`MGk$H0aM8r;p@_1R)6Qn35PF%5;QT zudT|ma4qV6EQ|Hx)gX8+%w?T5q(yp%f_duIQ!d2`cvY`k`{=Wc<6=<7F|as_F?bN) zyyp4(1%)j+d6g_SaPTJ;Rje$Hrw|!BY2)=?OXYn>+I{R68`#yC@+Y#lP(hP`fR$BL z?c+1Zae8EOr0x6XU^g(>kwq$3+8=^-e3Icv4&# zx<`Mar1Pid=URoLpuZMQa#@9^(h>y^jbnC<4Iv(Y>e8E_0d+AZ|x}k5dSx6#wjY#n8{o^jA!v@hMpXUEjFh8xf?M% z;me8?PCM_)NkxvwfIHUfqhu6d+UI1Yf|AQgsW>#9M?+qyHd#xB)}*pLf8Pf%cKYaF zEf<pQWuepKVIg5C=4XM`KCTzmV+rnluRVAF zx$k9n6Z0tzp@t$t*qrI@k8i3b8&~1sBV{vK5~8mC=PK;q@TJSU`NZ`T|249)?{|`8=&j`wr3R<@Pz&D`RTMUFOsA;;zCMQugJ{6NGbQx2wqsK z`PA#F!<-CuYt^w~Xu{NP-#+Vh>|2%k`~0X2hhQM*cr3fmDLRDZdj8|{L%?m|n``@B zfs2)Qt(BT%MMUC;>;#e_WJ7s%)rU+szf5SE$1&aVJzQ=d`e2KT9cDBZb&6MZRL9AT~%&A7V1E=8yY?mjDrrOuA9Q0UobfYV6G= zWF5xu{$?=rkBX*bFN8c1TkiXBV!D8>XxC030u@Q3x7LleeX6lNxtp?o9j5xls;SN4 zXC-oys<`ivz<Qcb3>uO z(%YI_O@s*a=^lQ-ayOD;lX|-&&$gSW=OiN?+v**Bgjoq^l-{?_bNwzKN#=60s{>NY zy|+K`DO5j}M-kjTT2kdhx?%!V!_Y~gq8x96(RYHP!C2TRR|Lr8c28x4#D+|*Ra}V= zbw;u+-?4J9=g@~S2SS$Y`_IQY3ZIWrGWFEhxNk1H+aW3J$@a2x+uhIQOT>aH_s66# zM~Kl1BSieE!S*84m7!6tIe_&iT)i%LLuO~2^ABVcJAEJgy_$y7`QZb5iJF^?Nl^p@ ztPe-0x$0}%RI|M%t)9O3>kPEP!pr01cEuZ}r*`^Fx2(a0kEmsr4F{PneAl$~_GAXf z1x;I=r2Tx)v*L;!}EP{ zv-`M>3*;(IcPy>7B~#+5fg#EAU9FRP%KCbqeBH2hPze*Y{2;#AQQgX_h z6`BwWMBVDT|I*};9rT!qUn@Y1pW1$!h@)fOiuj4^3;A}R8;sB6hTwp+ZT86f!banV z##2=&Wj~(~UByP03rFv_=g@$7=;srt?eXd3u_?=QhL$WbSI|Zb<-CnsMQFH@?3AQz z!B-n#gMuKFjYe`aFu+9U z_QTJgKQ(3_r^&d}<*lr(s~2p5UC_Y3$wX#7E2om{O6WTD{JmV}a7=4IHkt9J$2U%E|IXOyT+)r%@7SSmP6oO?&a__!bOj2t zgH`vIp1X2TjmqY4-o*ZZB;uVys)zfD{SSmZ9^{bOGQ1Kb#FH1*f^46?{B9ofjgNgp z^4+PiwY7Q*Gz^Snwnf#;^(C#ABhF`!JO8%1im~{S>msRZU(Dz< z+s(dl^~h!Zhj-=pQ+yaQ!LS8vnYELTh&27XXSbe>Z)0*?jy`g(BRP&_% z&aK&HaE|fSG)YSfET|97?5fNXrIV&&(k*p#EZ8&i9*`ZeL`-VD)PFQ0Hf^VV-# z*$1y~vxFTR2YVDGN{&bJ1Yi4&ZGAZs4FA;L}P#Gl0ORuSxPEPfkV>kleW$E%|=TV zqHW(r7*VZ0(J?$QO3e~Q$cE6eOw11=3XePP)&|U%4mE4~hDEKc^hoege2C@_B!|CO zvM%1}nd~Mmw}En4eOA(+?DaQv;%%A$Ic8R>KWF(xv^AXad#-r)k&cm>-S2d_k&#L$ zKYXMRxmWUjLIKnjG$J21?On%gm3XxaYH0Ov`RxC+>{qi96wOW*^R%PQobefIG3Yqv z;^&g3UzpE{dD?JLNwO0^ew(3y{Hd~NBj*we@S6U>c$#&&9ti&-1R6J6Y!85GE4kCO zRM3J0&SCrwxw_06tq0B=ckeDY@2rWUg4W8-b;q41hcX-6hnM&Ssr)1v;e~(k80dAc zo6r)XvTaATlmI%EZ}CWU?}NU6XEdOBQ6fnq7EE)_9^Rsn@vX=9=qiAfQ$svbH?rJa z`&%z&_P)$@bR_Q%yf-$is@=vVe!PoYrM>sXeOC!6KDQ;3n++MHa5O9-cF^uO z%pc)3&hf-Tjzjjb;d)}Miu)Wgs?8}rnqEsSF7k&x?=(41U)ey1={ikmzI;Kctv+Rq z%^289FMuvTIaV5~dm zm`x39bUYDTD#>C-%kV4`rEQnf6ZfjHSUib}CPDU2!#LJ4G75^Rs4#zTFvuk*PQ|B= zsq~b_nkQKBGgQ%>9vUo8)q`ze^YHp&jLoj1;S48JE#u58*;nhjK0N@r5G~e!-(e~E z%8{u)G^FuEq_{W@O75;AR4`U97^P+bhT~o%>(5R>-l28uWG}E;P-4wkjuu6!QOLJ+ zG_v4yJQlquQ$GV(>;mpxz2#eGCWcCjYhvN47KV2F)*KjM)+9Ow7mhqJ?&*8K7K2ax zzxj^mu5{oWv!F-NaJG2H3~|W@qJ`PP#62aGM1)&^?vJj8NOeuuw1oq z%*=2cFK9UM)V2nE{8n@Emderzh9;p#6>UhNIi$82=9MwGDB81h!E=q)F7v3ObF5RZ zcddegqk!-Oju|}>>eNh#nhE^$ntfW?Sc^7E7i{!b6tY*75Pj$YCQ<`F#@2z=O*>#Z zvACMH*BLG&ygBQE5_xUlj_5$v==%1YS1hrW#WA_KOL~31`UFxJE1;I;a-wZ=na;-( ztusRPmmO+Lu0p+EPjTL_{hKXq~1Wqr>Tu-d5%p#N{LV2$-&5dfii0HKT107u=9Nv3&n#yx{yY<)({Znx5-k>~D2^uWkzl_BrN%a*rwzm&#~}QG04%UG=rUB8iX!G7T$=Tu~&wXW{`^sonr1uloB@jJy_WzsA_TrU@Aj;{i0~$TVaf_1$DF=neDcT2&n_JQ#cD;AxP&He)yqGmiYxlO>0@R~ zk9rP@7(yvR{oq*)Od)(Bs)YNaq_Lecl8%ZngXUww8_*_@+h0#8` zDA&uUOq}N5?_22owmbMbdO2XeiTfX}>8yaJ2&?}*;$s5f5l_!{*w4D@DX=PPW4&i5 zq^Vq(n!UdY4|xxSUU)w`A1>{=)1NX2j-?Sq;GEgaP9hyYX}D%&R3E?G6;K0k)#Wn& zApJFXY7xmi=X80{D=|N`1`d&MRP;jf9RosM<>#5?>+;14YdQpJYeFy8+0Wj>3Uv0& zh!#Hn6ckPiTZks1VJOh+)Teg`)Tx!F)0Ds8T$`^yx;sDCck{V)0B02eXN~>$S<)`1 z+{vj8d(M7u$-5qJyB=4~w(7fi|KIlkw~P}YE|zPh(TeX_86~cPAd$bpWBcl`6KL*X zA%JY!H!O+_MkT<>7h)GqO96Y9042G&sJ$c9v}Tp5QV5JGwjx18kU%-SvJMY%_c@() z6b`tb7Ahk9DNczX0=}MdY1Xyj(SX?8i-7YzVT8a;wimZAd`>2fPGGa%=~3_NS2%2Y z!tR%+Zs*`qI5fp}qz^ErKh>6^L&d9s*dz-xcQT~Qa5rHRsf7{^E$ls%XjA!u$3ExD z`F_G3iowTSqVj$3gZpRTu56BSVy-F?AL?8%Un;Elt(L%e6&8@lLR4v<(@=>Cb;q0mJI2qn$ zIu|46_iTxHUOqL-d`@c>YTWB_?IOdzh-gg!q;YSEGx})zf8C0uJ-z+RmOJ0lhE}hz zpY6j>8zM=gk1VOO1T7!YIHgr*uZ#AX_Pv#7X-oE>Z=G|7jO%MI+tKM51qZ|q^3f8V z0hC}QnInEJD@%S>BJcAaa%hPc2ma@?1tIC12eM#p9VM~IZ3^Hw#*JXNJ=fOMK^#fR z=O-YprlqHdPy*9_p|PaudTf1Kp4Z55)KCJb>afAyBlRU$QhTwQ=Fi+c=FfENHe%l^ zAJe#=AVF;VL88hr;!{FJ28jl(mHe9(Ie-fC0azh$C!ABFZ*ZG-01)N#2xvGC=m9|P zH7_Osljr;f?7hcd_wQan5lGp%XW}H=m4Ovs^ol~}c}1c5Vdsn+g#RkWtGRPei*m9CJ#z)|nuPQ1BuJ&>v~@cqeA*(U6>G2YzRc*Tj7GB7l9 zYRGxpLgUvbf7FM%#r9jRQ(MvsLs8}LerCB5tnc*{e&J2aum5AqhDfBB>Iak{ae=6m ztE#hW*YSK0sR<0Tk<7k?w(_l`@{N_&wZGo2-02R;gV3u#dN#D%9Xxrz;X(9aZpReY zrM2_FawO$bg}sb5H_yh%sLi3IVPgx3QUv|WCZk)>3@X1xoEVX{n-$m=IKogFB30v_ zh>>yycMWo)jk2Ld8dy;qa4ZcSIOuZ*Z;1*=CWbe}<3>MD3W74>opmYpRA^!djvQ?d zq|ThLP6k8i--lAVp5f5+f-gxoshXFrjanUP_CjfjK9PGvm5gcR$ZJe#$$T8cQnI*d z@)RhU<|vc5i*o49X`3ZVKJrIjEXC4|FN?@c$xdP42~Qnh+`h##o-S;ORfQw}WD3C& zAFJ@ii59L=IH3JMCUwjdNyJxrfA#dOf$Yd1 zqn;VKZ`5s17gn6@m^@fsBB$^M$qG+V4xNT4xW+W}@&MZ_7NLP#4AkV22eAWCLxsU6Ohp9M^Jl zCYYBVSgDHNKL%5S>5=Da$iw#!VTNHeo|+%~g;vGpyu}#3PZ6iOUkwd-Jz38A8BsXu zVzK5gX>~Zm&q5FLm{aDsu+$oA(>mZ-1BlQQ352+jm{pw?Uk&y#q%r&-uiEuL>dGs> zs4_&Uf(p%FUaFp%=`kdpIGEz%%IppucFqLD22a$M@XMvtMEWMvgP8m^UY|a=@`P{N zS8kl5R#rJ4e%AT}_l~oYwvi^8x>I{7;u{;$oiemN*&(vwQ7NaV z%DFAD;I%(EACbIK6q_5$ta2M>?(la;V2ZS`ct=kUJ?ZD7!FuIj$`+mhk$3C(eX$f! z4O@{l%MQKxK3-$f)@rWadmrxMkgh@6=3li~{R)_3PP;ww&FrtRD=NzbJ}&nE=mpH^ zjE@+*m{NHahf1?kX=+p70FE}_<#~hXC75Q-LCP*u@(*Paw|>gYtZqLdf~aug{-k^3 zo!>O0O40wg;WPiTSFUlxa!iMewH6DHH?mncM_ml}OR61TQ)4y{OKC)*CGDna8yXEv zCyBOi1#a<AzO;7*R5bf}D51!!fh|?}qsHkij;z5IRS-g`s zZee@mDz;1JgQH zy|D)C$IPulRnb}J!o@J{0uHg*SPm&X*gaIhiwz&=fUr-cpL{MG@CR8)%#flSgPi zg5H*reOI0idjtL+BaGF2T{!MkSs#(}_J~6X8}PWxC@4C1mbeL|Lq!}FMMZs}##}w$ z0-$fb?v;JM1DLo&Th$+NA?c{87qYrei5Ts5L&pmBB` zMas<$dE#@gD7MhRn>4EXdhh^558>M+Fdn@x=etZ2TaU1v-77e;w((YLBZ0ig=X z1MSF(H8$D=xXqr#yK8#1G@{@3l)}nMiI}`!Ey`Y8l7>cv1jhu3%@a2KH?F?MOEx!> z3Bk?SJ)jQ>ktEabx=I`OD^MrK!NfE;waP&Je8<2hI>PE^5YWy|oIwYCq_izR&49@haFbU3wb4m)(Mj8@YP8nw!<`xqV{1@!w|E&X($TkTKadit9%K3vqGO~*7Z^6f)UUu!UB zghK{}_b|fTPMo5WN#R|OzEgNPAFW1y~e) zwC=!L+@QO)7QLBP*#LZ^sSvcE!#&R;5ns5{!Mr@q??&F~fiw4Di5lL})F>8_))$70 z{)cc&A3gm6J|VH=-#(MI$Bo=aQ-Tk%*hY={kyF7e_P5G6Ft0Bff_oW-Lpb95Wxp8- ztY6EHc(@?qcIu520YjW=ey}Fp)VCi+kWf4G3z7wnpYbLDk`D1c+88 z$Gm1EwD#d)c9hZAn2n%YvfY;WRN~6DPP7w;&zg03ylo^!Ba>nY4fs>XqmueanBBRq zV`t}U6ofw15EI!>I%4^E^1%TQzdrluabRNZ!2_IQA&7iK2#<)uj%B#}BpSbw6%ukI ztq>9r^aIY05Tk!L>l@(xr=ii_z7<(|8It{*X|yCVwd5`xY&dXNFWN+O9Hq#|*P3oy!OfNF z&QT6Ed%2a2s~Mvs(NgrxoRM=PZ?|bvUA!H?tWvlo*-SeYNPStZpSD6%RyvX8tN7rrFaUJRhPYx zKlST2%gz}BePWDI6ney(H+V{r8OeH2@ecvRl+%PAfca}XxQeFtde$A*9A=bt4*qVt zloS?)gt&y?i7FWa(Hbj8?&SOlpNPhDw)}sog7U&1V2jl^+j4jbTPFF$7uLC;U*prD z5Wp`R%(D=*Fry)O)w4%)Cch_{aZ(^$f~IOUQ-+BNrHOBRT!ZM(b!fb%gnnrj0L)hw zi?NRMSI;B+^6)s;q>$Y;H~oJPhKv7G3s8m%y{@^-7oNfs{CYQGQ57HE?ug$nXObk; z$Cr4*uwzIu6Ivqj@;C`2kMg@hrnld)mlXrwr~J-V}$g!t?dv6zIKS44} zSvU0c1^Pa8l-@Ok#}6emzVhTIiVK_2?w?!NYu3gpn^Rc|AH8M}0r#)LYOS){h3>Ks z7(vYiVOHlXUovi9?U8p>q}>GEU2A>SYh3*C15OtK9^p|K@Q9WN*w8%xKfb;KtjeZ& zA4Ca3TBMQgl5Xiv5s>cgZcva8r8}g%yBnmtK^mmH;lI4!_kO;=`k#yIz;$?@J^Sp= z&dz<$?2P4Z*e=yyd&zke`}RxNx2+rPGyNihs3_m@ivh*3ZY8vxGj3nt=+zE|&3nv9jQb?GOT4Vy zbsE+W=)@6zXe%vjB)q@k-L0_E0d8%4sS*^nm` z+po_K5)yy+p|<7g?Wqw)L3Gif$9tV)e&9xPs7*@j2{Rlj%zF;=!llgdpDpgcfgNLkBHx?Z-(^r+e;CnZH{^wJu5sTl~FbS**0F5 zP;}~V6g7hKa@mH!|V}qf;#_&!D*GW8Vk!`V09b7jyTX zV2+l^EWRc0>-1O^7M>Zm$x~$(^1k7D(NPYrbRSgl#3X@6kz}y*{rk0Znn3!;vyixy zYCm$ET*Ins~i9Q+KC3E43QhT%2|$X5dn&UKa+1K+HlIa+3T> z-x8~*Jm*a$Z|`*UAJY{@%QPnUMC#=1tAj}iRdr+aXZLY*O=lOvKEi{d>WCs5jk@@) zC8^cP>kbb!;hoQW>y``ec|WL}7ktfxh6G6DVHSJJlIE?4O;8CnFggBy@!EIce|%^@ zYfR0)B*(LfiXcY*?kOo4@v=23uC0mfP=CKoR{~2$UmX9FR-9Oa8~5=!OfoeQ^(Fdo zWcGK}X`gN-C7}z^TXs*x0h_=~*?2Ks=f!4X7kv->flNvrbgx?fA54w{exW+u7L=W= z*m@%}Cj9sW2YezNZ6sl--68Ti4!8O2M@w`vbkB5)?HsXsN8BA%1$lf6lZ7 z@7?F*G75ip-3^GbYT2Zy<8Wh_GbJZs4b0nF3%qnjWY4FVtBPDeg-4Je;Tc>i>si>v zC2DCEFuzfBig@{!L$ zLLDg%U$SgTbYB)LRs!~fCGkyYrteHWXj-X?RP#MJI45ERJ2Hy1h?X12ITg8>oPKa{ zZAn9#!!Z_KMt!G}@hGpVeYpDEGkgbH{JvwRiZve7G&mjT?~2-8pEEJ-qH1FxHZ})E z&(o4*XCWT~GbnyvfB2D2GmZzBUGhLpt?%8TZe)j$y8>>to{N4{O>hLcS6@UK8H7Z2 zk?v0S2O+XhLX%d?cd1KKJ1>5zhO6B-gvdztH;wRqz-SjsdWd}=)XmNXpJaaTUn5qYIX^UgHtE}$UOf6t(Zuj|Agf7|%&xKJgvj{qk^u?HefIra<^ zHkm#64AK!1m*Ux5FJ=76GPL+Z8>!WaKoZU%b~*K$wwH06wNDTcg`~%4U*Pqmcab%L za2R{`P_Co`WT%Y7<(K?IHNKkgBp(KyDJdYy+P{Rdv*U6pXnvrxm$o3QT{*ww{*7wW z&m7LR(~)F>@OgVL#WdhQFR|f?9KePj#>&8A3*30Xi?>)2PKsWf3{?-ByPvNp) zpU;@*B@jz~d>%~om?+)i9wFTZ^c1%2O<}w~$>boOfgL%UE>7}mVJVs!s)ACT75h3o ziJH@+yZynRNJZtf!H}3ZOU^kcr49Xj9>u63Hl1wE$S4q54%7xll#mjdu5k^Trnc!v zR8*x6yYH9}PLk9e&R^sjpNpSCl0|aC%`g*gOSY%Wu3AX5O z)eZPbjWQF?2;q(FoR;&=VL^Tx1b^$WzzP_gX%<-s0X=*%xO7n9{^f3;y3g zZc~PgMK5FSrEeUAUb{I&d(KgN5SA}1#~Av~!K^+$1d30wyJWf{8arKm|0~n-iU*Mp zz-OpG&c$tavYm;laW&j(=0kcUq6? z`3Y!5x6pw_17vjRlTH&F)oNc3L7MeVj9MhddN<+?H_e}_?aEomi3|t~-{X*9Oi9Ry zA`Pt9&zJ*fP8;ck0WuC>;Q^-8aNt%#z#>*-3byDU$@Yy@%2VYUvsM_6k9%TO&1vYIjO;^?^ zFQW}wjH3~HQJXoXX3m+eI4?nK4%b9--^Y-3Z~;X7@0XYs8Z0vb;;?W9zNEDO;_mUS zTAI!yCvgH6-!wxyjIu1Q5~seUonXCZfJ$wT^;I@*$>BgD59LE<}l z0lk!YT!e90;dJS%HM=fr@#KBa8KBWpFCh942@Y(U*vY!qk57A8<#e31jJh+zZLK^E z^+uRu_zaBp3qH|!=@z)DT`|0Cenj4Zns<}!_;gg^pL;b4tyD4t6&HZV7m5Wp-)G6* zEp&1jTi$*IqxtEQdA3B(Nged0c$fY)Pv~peq>Vadwu-aBL2U%$^8?CE{MpHep84Re zA=QBsCi;ra$(-J5sBVS`E3c^66?1Gk@qZ6NK){(MB&n9?%FWJjj2<&KBPK#q_VoAu zjrJXT0KsYj9#bl)T3J>*)UVO-j^)6WDP+aTC~3(4utD>w4%?fBI`+B}SIq!xBMg}c z<^`KQuc^ED*B~mc>|O=|wIsWjrAqRuCdAC#33A~aKk}Ulbv4Oo`qYOIA{&yv^)d`7 zQ}j4C2iZ34{B$t!|NZmbUiOnCUYWP|FQ5i3gf?m~Lk;1d9Q0E{3hD>kzOk@t#mysm zd;8tR_1%V5T_-}&TOxA^enTdajJD~IsQ=ME$7Y{_@hdjCX`8>>wk~^{WftF&p+-V}7)u2UAMO-kSPWS_nabKAqZh_z~^T>KV(a zZGd9l5t=Mij&30-4{rD?;if zmel`wOt96x1~g&*Vf+M6jPzjv8!Y0>RngO}zo@A{oll+uO#9Z6OOwri!2+&fenKB5 zdA@@Pia!DYL;@FjTchK?s``&Pi~_(;2gF$biGtJMr+@l?hmZN zFE>FdSo*;$em)Gp#rRG~#s4R}^E&2VU=NNSWk>bACCXjZBj}MsZ2-=VWwI)EhUp%K zU|LE@$dxN+yoTCf|cW|b13I*_KlPB!*$7Z37QLUaVYp|7T`<2zm4Bn z9v)?cIK9P~HX{B;0C3BvQ|FK!IktaCm{@Vv^ z;ld6X2ZPs>-4tYtmwGV^$zr(xG4Oo&|M(pHt$va zFIMnhn6!{q@09j8FW^7irS+@r%ooqxyW|BGE_ z)`0I^MxFC;7uY&t1k=OjKdPrbQ!+p(FV<|=`}{Tb&;R|9qPU7bBshmKMNSI4XiDy! z@Rv`>W^3pTx?69O9VOsTuB;y!f5MU3+%X%5yfm|~-|y5cw+-U3U_s$?q}o{_)h9sE z`(3C{l)L)BIo-CxBPz_0gtIVU1NGXYOfp}wxI~%f*gw*hU#9-(Mi>5FM66oaye|Yf z+whXZk_E+O(fJ@DNi27C%{w7ueQ!n(fXMG~YjHZJWtb+DgeUMco!PPuoN9;&G2|jQoBv-Dm+)_iLxD*o%~!={ z9bTRW*wa~g^(>IYa$Z8F`774A4|{S#pT-MBWY#f>lg=xZ*{@L&MRtE<{)HYdYn6TW%zA%=Q+d6qdo1>% zEp$x`uI8xiu%?34iO?)1Nr2}4hNe=9^H*FoToX#0Bu_6qE3c0)Ivox>&Yk}4;mW|V z2qVCK@rH_H-&=p}_0a1YP4=D?z$239^alb)&6vS{S@`u6|Ka}^!_r(>u%=xh6kQ;W zytlu*`eM|k6LY1Y{GB%YKj8-q)VH$hWtY1_w!W0=C@d)1a)Wyr3IE}hNuzfGY|pAQ zXta))VG=y$d-1zZV!gywHDrsRcAac#T*(Sj64hdV#Yt?U$yRLab7O=ie7XK#K?;5B zr^ucJZHXH3zS6kDFPbaGihQ3fL>_;PdG%aaX?=)T) z;Nc+8mDo5j+kL|-mD7MiFy9dZx_igu%&ziDv;14S9dOOXye2Q1e^W~ylc5=+sh3YZ z`_@7o{(B~HpaftD5}9PN9~l8qUGHakc{$+n#&hbP@W#pj&P1jP*Lx8F^4~hF&|j~e z9*{)uyT8sdX!G@hivAb{Ro(7^&aoQDnE`xI$XwBi-V&Gjw0z<2W<*%a&F&#C6X;|} z<#uUDnATCUh$;->sj9J=&tSMwdSeyO z+c)$P)j3Qy!uzu?KeW(kUbrv{KWCz3#4goig;@FEtkZ=ckcev;H84cT=?C?eaYTr&TVP}ul!y7a-X>(X)z7S`$D0hcSd3jPT zNTDj*vPg7vHHPr`sc)IjxUR36Nxl>LA(2OApnL4NEPb+t^sArNMO%gK5-<_A&$#L8 z`OBMxK+cFyg^2&7y&`US-#d?YnRGv*H^7;KL&dj9Co#E1LWchiw)j+M@Q-cMd5Q48 zfF}}m+v7G1O#(^YzSQ@}>NDHr<)6P_xBNPf>`*znQjge06#u^re3w@46pjz=><>e( z@A!BngblDrIZEpMS8zt=x-tU8U(7$4SG#*gjE!Zio2y78dS_VDWk%&KuyhJs+)VdU zQf90!h}%w=*pZ9><}wQ%{I%puRX*J$qGW@`TJUx33yl)*LrLMR6-;{^qZw{GOoht5 z5@Zi`0R`<+-_PU`S0d?z;LYltz;7+lRSmKV7FE{VR!}8d^WrI<@MRWn-u@AoCY27{ zkLUd{etoAs_sX0y0Ie4Ivd9)a%K#B96sRAJ%1?~2GKJl6-x*`~rgl}$F$ zx?^H3dj*_*h9FaTL$~rBzU14rmTbif1|%%en>cOTuu8{$Z9^K@fFD{GfF#Q4eNNOp zpuf~vVLs;;QG$zXhCB2nl}D(ngtgSQ3%^xp@5*FAY(~aWkV7!8#+~xcktd!y)tCA`Ab zcnp5u-ET7r<6bXr*8O?Zu?Cg_`HwBkmbvNa!HL*7I80Qo ze=dZPOx=NxE-eJxs*X`U3}#h_ zsdsocKkLvU9x9dZ3ols@==bgE>k6jTJ2RvTd_ zl`rE;b*4Egip?1!k_jZ|{zKda)3zkW0dKC;v~z!s0m7dCVxv>xNBDA6*$V7GuJ(|0 zconU*(UK8C&*bG+qH%fB^&jFLRB-;otQEU7jRNOt)^ck~ZZjCgi9xhkr`43ziNvR7 zU74i5pRqY|u1Cl{!-Cr*fHs1@E#&<(H$-Fi2o`uFO13@Am$!+BgUvpm0nSC7-T!@Yn|ezI~){@!)mz-pHMAFUEKPZo-P)cW)XI0LX?1;l5=whq*R z3Uz(^;`#HlIR~(>aZa*eNQ8NWE^10joQORO6)|_@;=jMSt~d1%sOoCZV={tc#;#-a z%mu-l*+KcINkzGtUUJCOornk3yD0^^nT@}>3GZ*2NXY8D^!BQ%AmX0QCry12%H$ts zS9vt3J8+H#r&UV27vNb~qGFOe&@si@Sp*?UHS2w6_1m=>Ds8I4w)&d3E4bjJk|zJg zH9P_=92qO;&wiFC$WXY#mUTlS<58aPxtJO&lT#rtn}4(aFz|l{1iq!8k`a22NWj-- z#nw1^6sCGSL-bI4UV_W_>8IdwQ!I|C=GGeag{KxC7yo9r1p@4=&DpGA4~=A2j~f@p z$H;p^V$@X^^OZZx2Fss`x_eFcn{zgG0_R_H$o`5~=u$=;!*dVOj?WVJMy8DW1g z7=_ZzEd$RDExjfzx_5K+fp=iOUpgaFIL+B$HE+?i3Wj zXU&;B!HN6)*F&9vP$o}8ciRI$|KbhZ&hI$0lA^91d!35ehD>*_vV&nYP@g`eAzNBU z;3sg7gaH#TZqRb;4gDj&cNhF7%4@8HHSEBEtJwF(+%%e2yYiD~4|h$XAOA1^&uS{J z3^}4dR7Ky!>H`SB{g?l;D8{bOFe7z#!C38+%L|APE#JFqN5vuT*3)6i)GJYWt>3Th zvg1NLueM3P&}^U-)woW%99?oV3m&wzI=|-7D5gGWiMUAGvaic6DzZ4nbhEJVPci5? z$3sMbgbekwHQnc^$+-s+^}rSWK76H^Zq__bI-9zC9b`yTb9m;oP{ZaT5^K)-EVNr` zeo<2`cvRcC_VMU5)K$2b3+A)8nO={EJ=0TDx<~AqLU*E0J#ExYlALHT=^K|D(Ykb% zcQVa$Hz7^O&`J;ed?=_3cTKPsd<_?!hcPpIj?bW=7%NY1)s;KLsk=7w;U}Y%Q??=o zrwWs%bRC*vJVn67(plV_FDP*v4-Zc%f6!DrJfyZka#E9&YXK=N)Z8u`)alF}-3rRm zyOt@{Y6)WdgUaKg&vxN%$(PP4wjXP#Zy_~mecBN-e31e`->>f@Hi%OE5jhUW~&*^Iap zoB{nCt6=fePHLfFcpW2EH#S6qQ56#Qvyc~|FN61D43E`U{(C!cL;a{F}J$x;UIMJrH#vq{l|D{JJ|b#KY2B0{VdB_zgrmF73V=?L@rl#b~f z87OP%1?^_LoCb|%PRB3H77IVq0vL*09N7sDW`h?s`$LIK)?n;fLTB|?!2!vVmguf@ z;+}0IR;H7=i>`nhH*A-EhADr;Z-2)E;3C4L-e>r}&-jj2=LdIMfL3 z>D)3}&hXJDm)BbFain*!?^XIhiyK+ls1G}c+K$y)mNK^XQiv!aCqG0pHNy*O)_J~s zvpINo?N#%^b(5y;-Y3rKQmT8&*+bAHpHA^qYxiO1$h^hl)&B zFU^~x=a)!C_c&;Aj0QwN-!(ocVRVs-#(lFTzU6y_;pe|sX}}n`^naJ{JgYl4dO7hOJLk%78=4E7G=YU#ETTQbI{2No#tFHdXSFPndthwp=036}&C@=&X)?OJ-;zBd6h&^o=oj9E$vFb23_f{sR)F{0d3!SHMZR9EiK|@3cI$4O z(gUHwjAx|`4cYnNUA??gG+Xh=wA4Q<4OSO`^Lc&5*H2w1sr3TK8${Pc&C0IpVm*7} z?GAj`!FddKnyjN)4S4 zf@wJ6+pzLlK7FikT3(U=cn!9XNJ??CCja-GO<(DRT~Scv&|i0jnHfwjPHM#7?-$Rj zYdGEiR-!2^4k8*83OajB8wHW>i>e?dMx1Fx78ySlu@7%E;9kR2|-j&;3|DF$3r=cUIXhm8k8_O%1lj~sH zt@&pAo2IJD(7mxT1dlP!WKCoiU)?JGprokCU~p6Df`I4qsB!!7bRrjdh|a{f&+o_2 z9X@QxQ~aV2e%$I^PJFzhugD2AI*CImswY4ZfQ7X5)??=`n0y)JddRh6JIb1aR#U-d zgJf_ygaJa z-Q9F!9aVhD>6ZB2rbo){Y>ODp!FI@^tLdQO!|63!l0-kr$TDE<+txAE^^f0B=T7WU zP*QI#r_z#h)p*mT6Z(FA{vDL(VjBZ_booQ1nsFiXm-WSuelpe#P^Ckxbz!J!Cz~Vimj_VwPOiIG5*wnFJ_b{-}10 zw-No(7y3n-LLPg9D@JlNc19oTbNP=N_-v1*!;E|Kk_Hu=(Sz#KI5kt|)gDR~{gHk8 z0y!m{>$CP}&`==bJm`yiogvhlmvo?B?A1~KM}7URh>;v}JwH+t`jb)R0>%WXINEA={VfdZU)yl?eqWz`ONeP}?&yI~ zsW*f&iLVyP2ZK{|z-UH4J{oC6(Woc@>PlqKsZLqVcfBcK1vSjW8@e4srY&dTW;QKu zwsN#0zW?y*6v2_<~b_1`J}2DJTNTDI?m|cH;n7 z$%9yp9-O8#P}S2#a6yo57ArSl%91l|P`1|~{l5R)Rqs|lr$j`{0>WIjZ5Q;0&-TlY z2nB&J&lnR2&1a*9EYoRaX(v~tITBoB=%>vyD;vLDZCg5<@UXkDG852f1a_HPOg`OwcMmnXc;rLb4Y=@IX6T>^P5~B&GejGtXA*nlkn*zU^7e(Q#IT&+`kFyOor-!;ODYon!2y_( z>Uyj(a-8>F8-2^L9sKf*YE&&B!advp3;nWXGM z`#$j#-+_l7BU7|#vAcJ8ch|66;^gHQ5m(9O=Tdtb)lohn8-p!8{9j10NK_bqM_KC}h@BA_XNl5S{!6E@ zb(!}r1pfNXY+_P-NMH@uSiM!Zes?Hldoh%#N|_FI-HSIi)5gxOOSqn=2VNB50Bj$O zAyckZ3H0^IP63!04Daj90d29zB@zPJjf&`9yxsNJ7~d0OR-6xa_qzi4@5MQ7af7=g zgj8TlcyBQ!*w{2Z*OEp0akdZp?ZOAT<|X^5G;R}V=keA=wMLuOE3F~fvuw6is3Ln1 zaxx2Xy|E%K$!XXFfId;&0Tpm#$olo)O}_JJH)b|vS+m3u04K^yny&FVJy=}63csq} z1+^B)`&%}Qe}A%tr&G}U)U{*x34$ih35iE9{9bOpd<(&HzNvJ*0WYh| zns~k65S%x$(>Fw&rmQZN(X*^nO@2IO`l-$ahi{K>pe-sgq{YHGau+N;O|bNWsFEdl z=g?r1Suld@zxuO&dg!YO*S?54#^rK|A=UEg4`kW`HMVG{c9mCS>A6jIUtb*PQsvvP zW1yp;VvgwIHQ)Y{M_`E+bpsuK)Asqne7=dmTU^iFg}xwnUG`C>{d&QD$iSec7E~cp zU8-hsyUWdEWW`A&h_`$5Lbz*v{q;%fKwbzIYe1yYxW(4z20!Ig4|D>0dL@sR>H&3*~zGOG*Ue@nH{V$Y6uH zzA0v`VuI)SCYayhR5x6D*JhWXw$C`=}E_Lg*$%I@1|pWeEkvA$3Q5xgxl8{2DXbQwXs> z*~CXc9lKm&+_CKXJ?jf-mK8>*IM#F|NQdKwvol9W{TEC&H}9W$C#_54GM^b5wy2`k zkbc*M{(MYaXZB@x#JhVze~L6EdnAp_c0`EmDyM>DFg$Sl7TKEiA{t`I<|r=Z2oB96 zR1rcGD&8fLAg}?^F6i^w&dA-O>Ru>5I7k_G+@j_An-FL*P+6c$Qu*0PjwsE`ug_kL z)QIAOZO)eP@rR@;w?IRaDV?o-`*X2%rSjr~3Nn*TKHPz9cH* z%cv{o^)lF8j@%=?NQR`^$SVDP~pGQDVip{8cZ;P0`4IHngW~ZnV@%`P4 zrJGA~A%}f|<%6;i`~>gRaJJj<6yr)Mki7it0KXsUHuAcKR5GuaRl98FnbLhu5y*oF zc~p?-)M=dWF!1$rRS`L<2wKx>1|)6=IJ{KlU^085 zY{`#8KvTuTqmnfaWqqs=C@C22Ax3#C_x1wrtA__2-;Q>^)4@!*+3<|G^i3p|-NmCNSb1NZV^u#GATIWImEA76|qsH+Y=-tM;SprDDjq#TD}P7pW{ zpH@&rOSpS90&@s&hpkJ^?AE4C_EN=j#%qT0c@*+$_axS8T1B_6yxkt-4`p`*2#jE` zMV(;mo>RvoXr{}h$x$2~PbtV}b?CpV%12zTHfqt+MDjiw(f;!64wt9=<{|*f+z!TZ zA63H8(b7k6Z05n(?5=gbV6tp>$g>FLHA+}`EbY+wE>_P_rhd=SXUCyw3Q*m-snXtJ zL4iAt)e@aWgcz)Z@*RJV^$8XXmXGw+Q7KKaHj2~MJ-A_>yh~Ban)u;c#=o%;ad~!} z`E1UtT{}e>bFE}Sagd%92ep~_C@HXJ5G1!n^^A{fs~lzLfXLB3VY zA;gK1WOQF`-q^#zpVaB(*~8T{L4puUJ`gpqWmTlNc&2=P zi{>!`!Lhr%o;7?5hr{5_`|#TQ!5yu?dT^!0D^9!-RU(3|Oka}w_`)w=qyLlbMEJSp zuh(d@ade4;YSk4SPAHO_^C{|uoYhgW%S$riVg!C&1!9k9mo${)dS{rD1SYxljv=uW zg}$Y7(*#;Xf5iFyTuxhQ(YP+nk@mrXY`|yy z&VAi#-s4u3<1fjZaFfEcCB8ndz$!?+dHg|Jw&UXATJ+G!%J!wGYzpD7058a{zqjBO zm&$kP9BDvBQQvth+1#n9)<1*d0|)m~d&AG-Rdv=VGjCm~Uh2d>yGl#a$k{{XEvyOu-=<5BC8GcjJSBxflRMp z+hTMi;BGG)-(q)R^@%iMVvnwDbs98u_+o-jx1hX4nSU=+eWY{WjxoDkKAR! zATFG8oZKBs$d^?6;J@rOtr*+goEu{ss<37UPZ;`Fu}A# za)~^cbXSv|x!Nq}(#LJMX7vh`q8yktD;xn8Yh?ehEY`Xw&CVuPN13Fn)8y*07eIJs z_xn3GHacu8ut?BQFn*@%!DqD3Df9y^n7XKF?>s@i2V40SL#&4XfeT_8BNph*sfYy<%n9wdjC;Ls!j5R}n>JzZL04#ZD zFaTTc3mq8~FRg0G>J)e7GeQ?#fEyjP1)MguEJUFG1E$4K~>eXp>51@DuD&NVLc` zrEK!)G3Uv$J%P_-#0C~KMTvFtA~zM$ovqb0C(ySzXqP`AQsTJK&|fyIRHc9lo!{K= z(Cv(*OsWs2m2u=K%$w5TgXmE3QKiPduaV$!$Q)i_X0tKUxJzz;7V&mff9ncL-Y$63 zllvn7c>U@lEz7gT?f$NhhVSIZ-H67Csw+HC8B-1!kr~RIBvG>%nd+#QIt}%hmM>2_ z)ZjQM#WRtxB^&95c#lMb*+-!R*MrnD8k1|+RIf80j$2*J6dhgnevVABi z{^`Xb?WZ9B1}>BMSs-uqzF(11(OZ|+(Z}9ZT;Gyw0nFGp&?i`=#OP|={;}UbJoe4K zo5R-Cj@_MAms6*xsO{=NT}%t?0;@9wNIFUirXI+mK|zhn?GgWAjC8sjG77eUqb8(Q z@pZ~}@k(ZrgxR~M7SAh=18kO0Z%*VWv}anIon2hZZ-1c-7&3KbZ2+*Cm+L0MK*L_T zbH8GNgHHi;tyaXnj$AN6iCismgTS?8z9cz9YIE}%8v#8j35E9rvswrypDiqaqND$U#52219{%C-dE*tABO7J*d!ZLY01D&#=i9q3 zsht>9H2Ei+OqdR38huw*>Fion0E;L>jjhqj*jl^b_k(Y96T9mP0>Izm(?@bLIYtU< zW`+v^ZPJ!CStrkLu2+lYKj<+ZU+14M@VYao$_|@3@)7wWCx@<0m)r>Q+s7!|L}N+E z1!zxII_F1JN9ICNMW{H92(?d$`|7n%sIU1vl4#x^lRT55-^embS^F-0c>Iu{Z;QK+ zg)(s4hbARQemXRqverh>(wEA+*x42lQ_t(rlQkTMns&g|wGov@O4C_IT}_7kwxo*m zjYYcB{3d>Zm&}aY02^;ae60w;l*2slVz(_ddi$tJXqghzAox;J*!Pxf&I` zL`6k^e{&5F$N*Gq++HT6WjEo|50%}GvrZ$#tU;!NugHf}?66#m>u$KpB{5G8mp|wD zbAioWQBjHGWJ3DN#+)U-W(Df@onxmqs81&DAD*E|1^2R)N7yP= zHj6ZTAfCU5E?rUaH+!T_3S&p{5>o#8i>vFC)ios4#UgmHECA6V1K1!+JyFz&Ax*WW zH9dv|Q;tX*{3?mAfj+&!@ap}B*>N%khdr?gDpIh^M1D_}R99r{X0>DD0EXbER4Qz1 zH=f%J$Vk6J$j{AVg?JE(ux~>OAOX7#8D4N#JJ>p~yb|wVDLX@pfjBp01BJzv+;t zwHjI?c_{v8z-gQWQGwM8m_O%(?{)U!ftg1NaO6XoYXBKGjgxbvY`zf)2%8wIvXMOg zbzp+F4QwRgtT3>YF~?eJhz(gBm&X)b0no%x<$?#s(8BGN7ykCKJu)K0Of#+Ua|w!IYtIkRB8zh3lR1cDWy^3}x|#zdc9~|5#LT z0r`o?$wT<_6eHB+gdVyir_VfvUM&7veoEiEmRvp@HkRsqtHA#reG zVnQ3#z%DNC)@C>wbXwNByo(#eKoB9mUrTr>D`x>*2_D3f*ILzXip=UV#*xf{6h;e| zznCE4XSa#-H(UA(vM*Ii-^FQpToGlkY<)UeTdtsb5H0jFAdwr&7v?h%Z$&HgvMBsu zN+wYuV{^2v!&d^lnDQ^h?+P!y@csNWG4zP|LAY;bK2bte7&3wn#d ztwGsTLdcohrDqROT#=-Q18qx$jlUX}%e3qr$-$ug zH5tNt=P+Bq>_JI1M;^#GcpES#y1Y^1r16m6v2kUueNa3RROAK+|MG3?Fbq;CbXNI> zOT=6U7!bz9crQl>AA?(RzUAV|b7&~C546oonxRv-7vef4`j$b|I%O)ov@}HE#%P5; zK=9FMRG@Y`=A}U3#s_q9t=GIZfZOS&Q7{puPQAML# zSFcf(DfeqECKO zRi@z6l}*ci5DXpl4UetOD4P~ z_993xJU!bF=q%nP&D^M0{wpSV2W$ya+Xb(#oJ}mtv%iurQtz(c2lEF*K~6#N6A=MZO7k}Shyv<6%Fw8B)g$msH^0a1wlI(GG-SVwMI zvuMuI&fo(D`qi~_O`M42F3UNTwq5Z$OhdN%;R-P*>tRRILF`|w`{MvW7yp;=r4_+f4I zOr?|O)VYoOc|`4Y>gwt=Y`81T@|rF34yJP_EnIs`>P`S}@a#^Ve63mOk{ImB@$3or z$v7^Y<8C(l2&tSgM@b!fv;ebIPMwRNT#VY$*l;{vbH^vWMEhv4HS5lRGlA0S59Mhp z5#dy}K0b*%FsU~YZAW#C$zdEAZoc-7Iw5@kYgcsWM)s5KFYYV@;Y@PRUN4As&J}EU zox62s_S%HUy}pc}Y2@T4l&N^kqedqdzBNhS+nLa32mI#x%3wdYSzpHj^#Q=KH=~Ov zn?cXv@o}Gd|5rb{jn_xY6oDoUIGFnS2ER#*?(QqHzyk9eHVpU;O9*UMCfgl(gDO=U zJGGRKJ#Li<(IGS>; zHZ{hrskdp#2_=w@mI-eV@mTD>!1tP$>qfvKLE>L%uXli3qYu_R*fs}x{d0A9TXp9T zzUG@}?=w2`mi9a`*BZpXAXy^&I`BFRuglS)^9XQbJc^2 z!M=2BbC@VuJ8cr$Ya@GfX>*!KMVIlCzTHRNUum>cc2)UMs$E51NIcZ9^*tZ6jNpr& zVXwsVQ~DNy`=6*&)BR>wh0EohF?K&j2kvI)2PUFFXv?ADXObRU!Hb<8XIS732=87q z-jxZvGs?=E)WKDy5-hzl%FP`gLl%;@`9M*8%ituDbrRG~`zAR&QGhTKAD*x{pE}gX zB2YNFZYg4h=IK!gg|@6E&vMI=U??m}OdEX!5-do@uKd)i(pSc&8+*1kxty<4czxaY zCwDdqIT2PW{6^-6w0|Tst3Jy_i~iTl|26#ru;i~?6(L`_5^;b8UNrqUYAsCS{Xers zr4$oe;Av$M7vhBwx1kQ3hlvX&o?pdL&@!R$oq zaJ=)&kdple8$K;h)5{vApCA3&ak1m%#Q87X^+n#_oSN}JcYEtlefi)1^J9%=PLA~N z2A`G*xS+F&?A6ErexV?s@4D9(BJLa z(})5<0Q7YzPqIzje;o_oZ57L36S+R^S>y^n(=z4%<6dqyYizP`Lu?n$QQLp@@9$<| zM~~Ir6j_+eHH}>9|MTI$uHj5E3(v3DIp(}|`yV&q^5k1)DgSRDLzK2m?7B?M#=sMH z7Euv%#a0%YkCm7A^)|mZaS=`&AHzY=-(1)1S_qu_*+=~=qeRKcp0zl*5Z>kPKC;@2|Ii>obVNjjAw_&S zidA=(+y0-w@>esJU0yqAr1_Psp z(=(4%e7fkEDz0R;zR7yZMy!kbHwA3SjtC-Fy7qxV1- z&ROh!vfo^Wz`R%17;GT$Xq#GuiDR@Gc%3!gV$?{Sd?6+!LB>lK@eAV7F^9BxAhh{# z(2xnRH-L-|Ppbz^>-_oRzILX;W3``3u}%J+cE(X|;t(CDWEf)NBL*;T$CM1}+^l zLf~?^Bs`THR+1MMa)v!MT>LBm3Ea8jRq1|So;NHN*&%BeE1;r5#<0uD=UIEWS39|j zwjI5+wY^UP6KX2HB{grrMNV~MFi#N&1gUguPwqUCBIsXM1fD}+L`QhYA|@&klq?rS zfa!nq?d|3g%L}K_`nKj&+gl51{0?BE0Vn#Kvt6v=2V(N8QGFMX2{~-A{s{{*kt;jj;n&<^CQ~K_*!^U5>$B zTgy-yFI*z8k<149Md4g+C~&divc(%|{v|(_l$Pgw#{$ny`^8Uq8H z)KD6~ANW;;l{KVgG$B(<=30F!4u1`oJjQ_;b#F9h0YM8is>dkxDOFVksJ0mQ zCciqS?4yexu{-0$F~ds5#5C-=ZOv8(n5w_4zc>Og#0_dpgA}sevrC>t$5b zM-aLI;yCUucdf8S3b?#n_k~4XN&f=QV-O%QebEZG`RK3^A3)4(kjoCkXpgqP=oEH} zWZzy_3ikorl~G%x8!-Egz~^U&lNvy^tmd0hBGPHqe3i^HxVwlpQaM}wkZG_{YPpNl zS{3L6z_L`GM<%lZp^Y54x+VphCqIe0dguyFlcmFQ;e7k?feAG5D zZteu5=enFOv4t$#z9esVCL=K{90J6zB`)&g8#OO-@{(54LAy`0QOb(%T#cUrx^-2L z2zaL=0C8+6gAe7}HO|9{>P=a*?Dq_WX?AI3@E0khD^SYU&!!|}(#i5cT9d7D1K0ve ze*emrdvg8R9mECfyzCCIQ7uv_s>YECo*k$xBgXnZLhx1Kvuc*@?4{AW@&s-_#zi8C zI4-@Hke8@(L!{v2=T7F6ow_oRMuSCzu)PT7EiVXNet5(f5uU0GbOwMIQus_? zAo#Q(bcu-pp$qfANMW*R?!>rS1=m25&kIt|g4Rg}*Jo^S@c20%>cv-N+FJS5v{`eJ zjodA|!aCPT6%Zy3R=$f&iLuEwG)g}9E$;N zs%J$E;4*46U8+{oYLxl`&@Y*9uKm8)YjXt1YoOR5VUgfOtQf?e8cAFW>s>k(OPABG zQswG0ySIe{K3|QiE@6ib>2&R@R?kjh2jM)$XTP>~_qV?wRm0DX{CeNx<`fDI6r99Q zYV|Q1%7V0R|7G82TJ*? z4L;TzwwSTbW7{`!^SG>x-p@c*%O)?rb0?b-(m6#)b35Cx@? zZg>bmTDrTtbAZ8zZs`W4yStI@?ijjZ=#FoV``!C{pLg%WKhR+gXYO^cb*=0Ao#(Y~ zLIKW-8HZ^thH)7=9Z2|Kr&yqGU1oRv1g|d=@E1@NaQe>8VcMZ#*i*|=Mk%Qr{t)>R z6#^dRCHyc;J*u&`9S({?^VcYrV9QHD1ovTuf?!Wzpi-j7is7JUVtXkN9A@I#LMGww zsR#=uKsgOjrUCC&DH{>ct;~HEK`>48Tw8x zF4eB<3XafK0Tg?KQrLFz_(!#cuJh)JZr(133NERf2r2*{1 zZR3mC&*Hbgk4F@qO1p~uBRXzR$>ENlrwIZV5bfzXw3>WLOehjO>{ns& zlzYPsHb-wJrGaw3)85Uv74nN@z##Dx)u+&w+Zon$VOKd;00+cRVo?6?h z@33X(UTb%}vo1#V_w0{gBloJF026PEkhnK9>AF~{AhzFt1wPlgc-KG>{J}wy3Y<0g zabROzvx$G9nG~Hx3dF6XP_a--R@N#Z-{CSkOOx0JeCwKa9b-F?UHVNVu(_~-Cr94g z-C_(IjX71A?d4{T42EKL{_EJH9C^OND&D zz8&18ou}pQNHE*|MSNFfLx@N=es}%4xjtU2zgZO!6!LNu470@1NKWRmzBfa-tY&C9 zb6Cc#fIQ{D`?@18h`Q4SI2xv9I}Z;P^M*~hpPn3pxc9`2^#u?fdq7Hu0W?Uk%U#3c zw{cJxoMBSLytUoBO7~mURNYj~iCb?j2eGNFCbQ||Oq?&0IiDGCyom%np)ZBe6FAZI zT0`cYj4LiKUDE#2X?VH3T{B_*nUwqoP($6%7f`r(9I@!;)BbPkmr>1Uo2j;4v$$*Ta8Z>P{us$J1Z|YhryxGMf9Mc^+s&0Kl}i z_IMiu4sF}bS;3tvnv@sOe7dx~xn*m_v=1zzbCEr!cQ3(%H&F@{s1O{gzQIbCoD_Wm zjH@vi*Xl-#HMVS49Pr|S72c85^5QAUfB&Y?o6&*9V}qB2m^Vg{T$Lo8z*zlf736H$+I1BzRhPbx;(jB@}xr zf;@qphL_l~6XNe#2o{e7B1Lc+cBvk?{$PD@6~;EjY0%#hD*Q!b$)LoM|AP{(W_CK zrv<7Fr;=+jsfQnm-OY~oda{Z5?2Y-%_z9MRJDX~$qr#jiBg)0(W9PV@hHkesD?tl) z+0jS@g+)cU10^;07{aPwPR_ouH7wZ}l0GBLdWpF>D3zQX3U-=5wbWyL<`HZ^1#nmdpH2THdppGoX&RF;v8!MsnQvTB(u-gUS7o^W?11>fVc;S8_25G>+#1 zAL{Qo?8UJ|4`73p;U*_(s*1c^5^K9NVO{YT&$zCKtZJDjn?a$cEsoEcn^yMj(Oo0Y z9J8^Ru%W{dIXlw&kWo8~j9%_=i|DnpBeosz)e8l` z^jOOvfBmqP{@v?QsL;f7y&3S--0p>Hxu_P!d-d)rQ;hI~KJvc_cD!xQ#UyveW#@G) z>~>Y^qU8FKG}PFVlI@l0*Y=hhLf>4%2guzS*>|6d0;%@jN_D@4IQ%I*XR{)S({Hsk zF|+p3MDhiSLL*^ZTyOT5OWY}CB0^<{$ydN9{!&i*bAAA!I z(vcx{JlQCtXw04cClYB3?n6`AH?}LIYtmQel9c(*`3$H-c3K!*WuXyr6Y+G>VR3n$ z&F>x*nfN?-hT$DhzLH*B9-D*XaxYeYI%bu%p!#oL6ySr+UA6UWlb-&@8-=Ji*F+sy zBNraVXOBmFHsFzkaT8ij4S}w87le%kHdkG&A$1$U@9P&_>Ku1dXY@Cl-uX!Gs#-Q= zUND-UJsNP2?m~eMW(qeUlb*nPhc4dD-YEU^!>Ti~ckiW#tYWz~l0~0mDwQnA^{V%@ z(oDqacWX^r6Y_bYyhQzr>BF^iSfov2U$?e>3VTlOd1GZj_z|Apw;ES9SDu72l}UMs zczP6?{9hMVSdFj093^}1a=QDyr4Y$KK-XVw+v+34^Qo=a`X?M&&fGBaF4nO(?#tm# zOt$^-%}{A!I!l)Vmw?4&;taS8Ndk+!-e9*YnWJ z$sT*V+bz$a5srfMHrK4vnXhj;hWr_EIbNMSHk@u?4C{xviIl8~V4cEU>1Wokxj+zMgXYx$;h^J?duILqlmDK1O&9~W8u1#!Yi#q#?4`lkQt z+~%nA0%wzhiG0>q%I_8t&^A+DH3<3J-5WaSf_#mNdgw5YD_YzB$K{j&l44_#U;D~Mu;P4Nr^F5%OCsN%uHIEJ zS)BHpmFYzY!G~U&ziT{iTl!B;mjqCT%njd*2-^kW>05f|{`&kWMx3}=M(m3_UV@{Z zz~)yUd)vFp5Y!FZ?vuP2>|ow`{)TvU;XQnzs%-7Kw<$dV!D7nVam{;&Ek?omddVU> z0(f4*djhQgSal#>{l>Rpk#3S}I4&_5+Y%7Uxb3z%FqO5Q#$oeHC+l;0Nlm)zH3I`> z*jr(ASuPW56O->Y;f;6Uq)2j3S69R4&6pYqY}FdAVIixQjifd1@k>?52^&J=Xk=3t z9NH@>I>T-6I(V3f_d*0&%vAm8Jv z0EGGQoZty0s4itpR%dm4YXrG%Gk46uLR^50s-j*3CVi}`QN+BH{WlKBDUXljV_A9J zw^$giZrt&4bYf4fnf3KHUSkpX#Y~iq!*WKpE>{yO5K=5iR20h_-r`q|FtP-EcXQD& zR%l1tPB>NFoac^4Zm4y%Q<&-3sjy*L;o@FNwa#;N`=%i651I!GwSN^z4w|vp@>F?L zXBV1Zxf_;%!VPGkarD;W!iH<{v(S@AoDt~5WK3Qth7v2Fe&W_i<={|F#eI$P1!A9x z*p11lDL=B5ntJN*1$(kP1L65YD^^$d`ZQ8DKZyL4^pH%z<-Z*EYgoFVs%KEt} zQ#X3aV~r6b+FQsUQWy-74kCjrw@#~p%sc`T#)ZK=R?T{S3#b?N#^aW?gdAv1tC)xk zXYf&~b{7V_%eMA1g*NmwF4oR(4}zh?6pu4hhjI>MejGeg(WDnVjNorpyC>{G$o%m7iXM#D z9OiQ#jY=QnhUFUb1CJerg#gx z;iEt8m_R{6lO=41d1WFHae1qKuU!e}_G_$-w^08b%X*Ct{4MMb9Kpb3o;^-kYIEeY za~cEG`sKiJ{I1#`!h%Lm>BC+DZ;s8qx-9Zk3H+V^bvXUl7=jm~7)Z7bb|wHa2wY4( z#oup%x#20u%|+6D8G#Q1>F#g~e8q<%>`@)7^dDlGT%00|xAM?HXTbeM_h={+PPq2< zf+rw{6|uy1K$4|h)l9dXhXoy0Tcgu-^ToX9h0BcwdV`l^$^?}yT{w*M=Pb0bo z0cBh7ul0OmI11Xt;K&#A5MuCvLtNl)FmoV=i}48kY${qI063$5C6&Eu@jWab#&4nh z3Lq`o-T^(mlB;V%M4QeuS&%P0S@N3)uMeJX8h3oH_pDD7o6QjuekD9JKQ+Mb;3eW? zKwlE=4iS%a{OU^1&E_u%ayG4+I?MF+H00izYdZ~@3d9KcPWJ!#7E0te}hFovPZJiCUP!TDHwTCI&bH+ToA-#a@s z0_vjt)Y65`55TuZ@*UZuttBMDvwwWNzrAIBc_a8Yn$ZwhL0J=$+r4x7U*nG zh1K8o#>6o=klw4-gn;U)lLJ&`O>S$r$q+qSRrjyUV>RMP=tP{|pmpb>`|rz}{j5Q0 zHI z4|+y1-VnWR0}k?#B+-?PL7o9A=*d$EI?)>c-4`U_=Tt5=Lu33Hvb3k!*te|S5W#i5c(^Z)>97#CC16Lx?}tzK9h*&+ zBy12jq*Q4@{eLtgDOgNBnX(Wa)L$E-qV-APx_yeI39Z6?d~lt@GYD#Ek>y5#NX2cW z+1QC$2V$+IHyB4*DRgbBd22uoLe?r#0z5GbsL{bGT)l732X$IQxI>OhK;zi|hu%Lg z%kwL5jo{z+@@KTH)FN49eCEHWeZt}Ri2=&FC$Pz_yh{*Q_7gw*@ZRh`1~>^wLD(KZ zPI!GzxIAu1v=&;_;5V$NGheA5^mVfn6iFD(soto5f%_B7JdzT~(r#L>Hz*i}vepuf*mYH}o2n8j=AY1}21~?xTu1R$T_mhP&6m@!{HN!i@y% z3E-!jCloN*#QFz7wEB)>2y02vyr&07tqah@M15LVV-h6P>HI{iGM0iOuQ|Y6{DMrg zNP9nsqP}5M|LVjK(TfFQj1C~vz>0~OB4D+2nw1oTuELX`!1aPjO`VC=64%ljRlD)= z;AG8#_+C@74HaPG+^{{qTnm&soSKV6bm1*!yuLc$9{Ah&d=WUTz=duCj-RRW29P%- zy^XiUI;{%p;EWAe{mqMgJhaEyblNPe1PtINET7a+`+PcC0mIb=pzEd9mT06XtNZ!r zhSSMH-Bhs~cDw!>61956cW~nuZrVeYFD^XI?zD;H*lR*`E48mJl9QmsMNJ2!?9Sd` zCOvD8Ru@qtukI?+ym|#DzB1UXr{cyMmnb+R&e~c)#QHV5bvZAUvJ#a=WB_7oqU4}S zF&bE$LSO-hdj3&0dW3pM7l0a<(fUpH;a7tC5w4aWzzC3uJfN%$&V{m*9u*Ge{ z9UB55vOn0!t&7uE7Q-U4@Y|XtIL$Ak*{0~Ni!*9#YuKjLZtA70fjqwR0-l7Ql`aev zZ>B-@w59$OIzeQx6TBf_8o|4Kz9uG*(_B5x;Y!6n>D&Q${jtA62f3} zfHXJH97}@*#_9v`xPzA2S~FmXlF?<7$rybD%J95FE+3VQ2S26Gr*_m=@ik0Cy613Z zpB@}Pen)mn{YD7w1KSXb_zcj!*l6cK&jv!X0iF%yW)MxML7?pJl%lukLXu1r*}xv; z{Vr7Sk%{~VV!Jad`Qd)|KuDIxF^D)A;CAaoJjh)d#Eul|y7vXx#WABIUlD9dsVG$T za=a0q_K^Zs33hv0PerW0&e2vv;JpIPnq5swkD41-b;a=*e;=k#G&o8wpH|&T0+ooz zo;xKoqya5hMWU!0=gHaD5*slUrF{@F`xrfmg{|@9i|fj5C8ii5J;7>SV!Bw?tYL7J zQ{SHRHmr;jB_ug}Hbwz-8-oar*kJsx4RsmDK^5bZyAN-@a~z3x<9h##80ncCq(r-u z2#_a3h5_9YrC26|M;6Z?yFuFMH$wbl#Xo`;FA2~e2Kab82&P~ong;!K@-E!g(&~r? zI~J8p0Wd&66}jej+?5deAURS*_gJo*30>W|NnKodY`-`@XE^JG_ly7b0st{jnj90@ z{{RsJPOppve4vMb=19Ghp+^9FwRH+E?`4qD9NS#(ZA^k@Ioeh12QP_U_mzwqORQHg zZy;_JSWJ?j*9bIz+e`g=!f|BC%QGM&GdM!U({ZRb3m$TM2_&Q7^}&I=b7nIwO+=ao zx^sU@=WWe?K$pV65Eboxc67etEesc4S{KrfLeF~(C@uvh#RryBDzGyEXlgZvS`zjO zGiJtps!n%~d>@B5-o*1eaQH9&1q~3zyZ^PMFgC%4Lp&c0x{IClTUx;+mDjT=e?*uThGE+FDGBQB*<7E-=Y}&Z2Pkkm6H(Use)g$?Oe>S$_k1Wc|LSqS{BW zyJ-n`wmkdb%gp{L73^yMp5NUYB_>dTK-AyyXKzbgO2z~lLN6G<-6_bAhHlW-jA|_& zXgD*K3L z=z)g#VDx7sW-7MgW81yj^{Kf5@3LxKUF$1C?qi}AU*he~G;mR~{TMk4s13x-Tk&~9 ztNCt^*X3`ZjdaRtI}BiZIsj=jBahVzR2B$_ckK^f(HuK!3`e{NKSecz+jZ>YAYC9U zv{hygUY}G?YXPR*@T2FQ?Wtu$Kaq~;ux3XNPaR%p56h?&fHnZy;4VL_fuupcyi-yx z((GY4#E6M>3@s1or(CUe$&8CNXv-SRr&zf#xWxh;m!v0KEkPnxtnrd!*GgMQ&{_I2 zl>*=teucB>n=tCh2@>B2Kht-SvPR3Cc3>%N(U+Glvg+!dl9pC4m>12?#twnn`D)c} z08GV9DV$NG#)Rdyt!~uNg~5(CZr3{YFrpIaxoJT>u&a;ZNFZF1YCNp*Ceq|;gLG~c z-&0@Dev{BpF)wpA@2@d{#UNRTRy~n=#*&$uo7-JevAu!uSB8lbL6Yx#8FI`J+jYAR zX9e>)kc$#8XsGm1QW9bq)znaIs<4tqannHD#d@hO?b=l^$$_}F0@Ae?_)}HwrE`?P z1-8e_{?w}bt=e$e zo80XD-@T&`J%GI)p$_jJwDeoFg1+uTkt*B4@@K27*hjFUrY{*XmB!&Cs(g7N{%`0C zKE0Jx-?qQ%)%Cr0f=H{t`RmK;!;?#pot$Uz-cse-JsL-=0tR_)7F9E2g)O{!1vj9t zkkb_DfvvWh0uywxCkETM;xb({W}!Uy-s@(7s8oKUy4^m?v+pjNHp@haWs0o{uRTfw zdN*|4?o%4B(LWr-NyJqfs&u z5^=#dE5hewB><6C8>+$_Dmz^^|fw>euBb-M<%ez;{)olvUqMz+cVeo z-M++{F@5y`hRWTk_Ts1KQS>+`+JmJJ;F8kAy;Q4tf-_q;AzEG%`N^7xep+mMu_YfYY4Be*QMX@34Jhjl5uL^8?d zoac|k&wI9stn7Qff9Tw%Hq{*qwMv!vDB3zVNvd{PxeEWtyy@#%>%>LGb7ezuK9I-{ zC&EQSZe=E|48+*{dZ}9cd-k% zx;Q@A(zCr?47H``Me1%*36Aq@c^`G$)h&xW8txhH86#j*d>KX%N$|pbjDxFFZld8`q7$DOLZW&_7X1xzex*#N8MUl!<)GvX6<4Gp_Za^a8^ zoxd!kbW$bs>~?ll8|Rl6_d?gpbO+rT>g@TXF9RpCBC!WK$6qx*>14XcljC?#|sX)(Ait(%4a@Z*|AR$@e3tu z5EF(m9Gzn#Tm8yUe9&}-lTXr{Yron?k?6j1z^aD}?yg(AFYb?7#@*{l!~S(H4LA53 zaMaY^vd-4XuLihVIWuQ0OI_>v)R6sd(OG8aCFK0!g8kVB>z#mzvUimQCgEz=Gx&fT zP{~mh@>^C8e~i&4Tetf9+{ot0o$O3|{_WNtIkxKxpDIg!hBN68zCZW>ap*Ziv1w!bc}9=)(}!TNk$@YLlpzaeIxM3QHmu{uA4l~#(zU#n(^ zpV+6W*`0Fs_zSL%%4$}%x|Ze^F(zg*5uz33I?WlmmF1+rd-*%3rT(UUP5r?U@309o zc!j?JoE5IYcTEb91BauGb6qc+Dit{RoD60_>EIbVE5a`_%2UI!?+(#j8qf=bTHUH7 z(41k)vY(FjH#84tu{DLIF*(Ym4914Odz=g9POhzAbYNorSg5dVm~DeqzY<_~*rpzA zyujlqhz{9{aN|^+uX8Y1m(X>-^&F(%v?I&B8!GrQ3hLTI*7?{;6x`vR}CB3ir zY8LhG?@TJ<5x;1qivfomx}-{EdN8K1)2T{S4G@B=_R$9v&CbSU0j}c>#i8tRwMou| zByW`8`%m?fSz`6b)9lJw2Q0fC}n!UPzhfUE+WDe#63ARA1UrY zBmV6_YUsS5!TNdgbh8|9zu@vNos?{(Ko%wWel}qa+F359(OHoiEJPH`oK%AvQ)bn! zlF!0f1>;ICB$P$22GM8X<^VNF`U&FIAYysAKhHF-u{a)cP*eRWkMt96%BX-&c*5Jy zCy$&ur3bskHyoi5d`~{%tTT#6XYN|Zm5v>hL$D}3yK%f*xAZ2){2LFuP)_&Sp^Zvy z7q0|rwmO!$xF8>i-D|uoS^uncXvmy22ta@K3}at>UjBpbDVz-(F6u z*?hAvHY(a+y}#w%wBwMYl2o+rlQcX2bLL3Yr|hNX3uI))DN8=bckVLk5@_D)XZ6c z0MC&WO<0F|X|TfLe!Pm|dORQS_p}aKhu(|275z#ju=GgaYYuhvs^%oKEOQQd3<>nO z!6X7z-jU;L{At7A^ebPQGaMcMt&elUVIYyT2?=gRJoxPO8#n9f?|>2}L$=WF4o)JB z#_;4Q;keGH&#LlG0=@6Aj`O(gk2{U9u~jX(UsMGRVikc?R@9mZ2YYqPW~I4^U2X&{-;A~1Os^=C}e~%liI6|Qb z*vT%-0lr~Kmd;7EF_ziUJ~EizCV^4apLMS%C!qImz5~biO$SIW4ag0WzA9-o+aIvY z%L&Sr8U%J@w{cuD|7&{GyRgSLIr3^2+(a8fZ(2EcrQCXd5P(;4_RBOa{xx5;Xu4b0 zg>An5`SW=yqa5|_{hFa|7axsBKrO}@NCaT6Fgw)PqOlkFvYeX0qkj9hW5C~EW{}5r z?9i^3*whZhveGS1%_CIm&WRTjf@g8uZr_2;Pi(^MDLbQPnu70M>}2lFHfFHUn=|-t z^D3WxI~tV=^n`i7CJk;j$gjx18@}{8FBW=CjwxpSw*Rs7x;{T3*W~DYS2%0@YFp3k z^s}1t4X2D^Y9Txt;8GrzkBc?E^Cj|ma`qO`U=_k69<*NtX%>$HtajSKl1vekez-IECFqhOlPW zsk&RP++*{|*qw|?QHmtdlN-MMPEPeCZR@;Djvz48_}9Sk*}No0!RP;11`|n8e`LeI z)6?QpiQ4ksZD9R}rwS4V5$siQX5;HzdSbVfPkLVBAb&}<--?Lv?%gvuzth2NZ!LJ! z`MG#-EjYrBMjV$lT*8@iI=(3(oBW|IQFUPXz-j2ig2^qMxgy6T6c)Vg)i~ST8K?(* z-bJ=+T902Xr#jYXKaSnI;Ib}Me9Y&n3C|DV6T|7mcI)-Ug^N|KT(5 z_r!aO^O0_Kc=T%hzj`(P=huFj8+EC<1H$q<3IAzkkJq?Wl&knH{6Fvgum5!TWbEz@ zi6X&csmjXB|M;NP?neaK&uf;+ok}bE|I@E8Aw+oNMR~C)iT}SosxbJ+L;2*z!=srg z*Z=r9Yx4_qxpDNsNd+QAOUh8jkPyWN-9x0T_3PaB=ZK1?>%TvAExIZOA==A8JWhJY$HQd@fBauMZw4ms(xfA zXD1g_UFQ6@25k?!=gW(}!MUlqAx7jZl%UVG%YPJ{*TgVd`_i0=#Xd|B2Yc6ms8_Yw z+SD6flQ^Z9yv6Pl6EGqB&AQ|K##b2CNq4Bg?)i)euiO3ukZ!EDIUo-b^V<7N#Tw1D zw`(|DvY5j}l)t={?Fe}qr)XYz03XCUI@pcFNuzCQEw2F&u9!Y$#;RgmbPk;DE@f9*4uUQFBn(OJoFV8oB44Hy%cF9xbI9)bpdPqKNzRN|O zYuYHFk@GdL06EIFSA-xfz?x%#pz}ZjGbnoy=Mo;Ks+!C=-qtX zd?YjR9uT?5n*L)mnYVv#E4^wy^@R%!#)30d=z=Y0=$spVS*GOTig$1E^d3_FbfU2G z7ky9A=TPJ)(5bhvZ89xqa}%!7l(EVt`X)KZn!-Md)^NDB`#c`oW3Tnm5T{d!Qb{HT;mG&}KKa9Xk8S$;-X!2E>Dx_m5 zz;`t=3-_c6M5Grl&4aOMiN>V!#wB>vG8WzWK=5F^5rH5Xc&_+hTBF1kG>elVx^V3l1yhqjd-ZgR5S>T0{%?@J4w*2$*h}d> z5z+mYCs)sSE_Su9XLIY(C{bae65PxER=0m0egQHI0`yOAkTb1`v1gn19N@TIP#*S& za9>Mfde7~O@5i$|YmnTyo@LyiJ6QMCd^DESa_jQ2c&Y9Ii&-y7+I`S=J84#g4?&XA z*4h49A83_F4tx5eXX<@5_p~sEUP6V+$i(cj`mM}I8u)C4pvQac^j_Px+q#EPVP=aC zT~)`CZP>U1q=7KoH$rMs!%JzPAWe2$AK1X=tp^a`+)~5k`XSK6I)1HuvgS}v1l!Qk zO4jC&@U{lVtRL}-kD5ccy{Rt^xIy7zxBcVyu5rZH6c78diyhVT;~2MAupV%NrS&q# zxtY9yIT75y+xYh=tnjJ!PSj}RgB#ewYBH`Yl2zTjYo*iUS%-ZxmYKHlXRJ2raI-(t zFFt5hYiDwbT}eix#V}CO>S9X7j)Nwxh`23Xy7j?bCE5C7NBx7N^ZgC~>-|TI{L1V_ z4d)cRZkt3CW_OZcxA~a*B>v{7jO<()FvrZqJ6M;z*d2{v<+(|;tg^@|oe7f6(?1#d zZU>)fxrPVA^|4}1E(|58)38+siwxpEo%rW)a=;IM@<3ulv}+4H1S+K?oTSqlG&?F;xkl@)}G+=)$x0#!-K!r`Nk zE++JTLwI+pj2M6%8y!v`jBTl`F-#-}EUbrCHz&%HN!(HjF06f6R4|Ka@LX1*gKJGL zzVhy_QfB;yB2Igs^9`D%!Yy!im*%}+a@#*Hh`YH@QqS6cS1K+gT+C2=Pm z@g+|KL=S0*Di6}tum1QZz0+z$98HyuFjdEi(ok;7`5GK#1Ts@_$K@2R*Nb5BgT=^h z0LxXs^(MKsMGOm4gfOf*l=z0oqFv&P{M&B-Jy*`-ir?c&DvTdP+i~>Y)j{w;AOntY z&{uE2VHs>W{3Pp5&g%0hI9C zt%V9kP|UiOmXT8&hoIfh7rKD~A*Jevyjghmp~&!S(*j%4fZq;1RO%HgI=-L{KPM=f zEt-tg1X%K3E>r$M>^7q4x#K3~Dl|wO1y~iZP%nY&jnv7lO&F(dj|n4smMkLg_xni3 zK4rt?OW?ZPsN5IJ6`gCsNQ5DXADl>sR`07U*4NVJa0u8Jf6KyqB!{;|THhpaNx_WZ zP%&yyl%rq{j=bliLS%$;ly3#D))>+?X~7Y+)G8GrfFbpk@w!Y^*>2s>jN@08&|7{= zl99Edvha8k3MshQBVXWhcqFD^xk!AU90A#h)zrN&` z%l<0vXLx@1uu=OKk3X%(X-Kp{I?ag-%&x0dz3?VO-na7O>7*Yod_=RyyKzuFW>=Oj z8}cq}n-ZMeh6;@2D8=K4B>nGU7mS;y2)rPY=3{-bYRscv{&y%g^~!hUQQWaAR*=ZF zm{pYK9Uy`F9sRFJ4XOKuY2*~XoGo&BIr)gyN&gAsia90&!G@iZ(%SfRuRtg^HvZ_M zJ=jLoz@ics8{`XyVN_K(Z-x;(LJX`Z;#IKJehUc4RoT7u-&^+gXOY%W9$!R7j)$V3 z>F6#`j*Q!N8UW*o7s!9Yb>`&d6JDfobXI{1+5r^Sy$XwT)Ud2{oE)ht7m!( zrIr9LhZ1e6`v;#9ZAO5Mbn9YYdabBJ3Kb;fkuQmRed-@PKYM$b+zTrsPErulsdvnh zOdHm!g7|us%o2ji0HhuPsl_fUEQ>k`+xIFSU|oSm$LG~fHTAXYeL0T2s$DU?iVug_ znZ3O(l)$45kg^7nV+bpra^UGY>o?nlpJsY&tk_G}b7|pi4cj{+;Q=y@4)!H!^TUuZ zx5X~&3CmuTdO}g()@Of-I6t0!ewIqU#K>IDBRImC#|dsI$cS4V#F2;w>le=NCCEB2 zmG5-i!<*RBWnbUSsC?AL6jLbL=(|Kk0R&I5nKU23~0J%=5+5bt?EjX1NCoR=!abQbuQZ1Y(+mi0?xcxl> z&!rEuem<#H({Q>>F{;1=+2Ah)@SL6V5GkH_Ri8i}+7^dO#^o?bILBr1=>EzMS@p;< zZPY|WLgc97JU{1+^Z9Yn#a>`h8u@d=nNN%+n|~qkTyC2d_VynpnSbK9XKp|4Y2M;W zuJT~Wioz*KhN?NDD$|Rc-dl5nPZu@*LPmG9LU`grs1odRZIST2`NW^~=uG&yYqkQz zlTS)g2v7g*l5f&M5od*A!T6Ung*W)-zjZ1ezxcjrDJRMiYVcyMUqBW4x5HN?qJEs7 zuGNzt8@?FZp{-l1QTMKYi)Q>bDI3iYfWQnN;!I6Ku;za@qTzQ?aDE5|aq2LpYT;AQ zPvH!i!wa`EkQ%?5TtQG}_bY;bQRVUhLhIT@G#4pwlRz?16AwYp{3nKWf&JI^kogX5 z56oZCO_=Zu<{835v8dNZzi39pCkmR_ya$yMNv}~3`&5-7R^9VJussSl=sy89Od-p7 zOKL;%{nZ|P$fP2Bd|ScxTj$E*Px9xqF{pL(A>$_Pe<)+@wf@QrbvueVi^mDAd?`V+ zlQ#|CFN0T(qwqx}L_zq~Yl9jBsa=L(;7T}_sedsjWp3UO1azN)zc zpicC|nLnHj0^cS{25MwIY}P5ew8+Ho+doKtr56zJpnm0tqH2DdV8R27RFymgf{fHS zbo$+>;6+(TxpeBOdck+jcj7NqaF0Rz9l%OeS^z7H>AuxTtmym>b>63|-WNph`>^2( zMvx8T9NJS25G}4POC(mHpxcL;_$_sETWIl{C^W$3%`1P7oA@!{JVz(KL#W%Fn zN~Hpt871cRXc#_nz^3n3DEq-lQ{x)8_*X?@D;sMTq4Xf zY{ni+LxE!Mz}YSwQl>MHWgwL@_EY}?gxKZnr|jR}T1?eP^UxsJ)B4iEp)3eK%Y02F zLfdK5Ia`y34{vAejmmBEXNsdjawx=!xbugjDZrb@0QUmCQgwpBrZ}~yZ>HZFoK6&( z7<3|}ocVIO=P^OH%&+G)6dKKZDGHwf+4OoTVW^doY`^gNT*c*PL0Llm5qQn~2N-ow z%;vMNYJur)yWf;2()-Tq=~|tTOoq%-%Szn?iaA}=*#E_`P?*&SXz5nNIFc<}j{kKo z%YTC_!Q-D#wt1!myZ}10Yy78a-OGrGzcAYb6=ci*fKsVj-fGh0SU{Qj$1em&kJY8e zqyJ#4e|!I*m)8ba_nyUDko~WZA4RQB&5gEHdCN2}`oGy+mc{mie||Q&ei3vz(4714 zpY8YY7n(bNhRox+(Hv%R6lh~KH62}1PT)JiKxU(%pP97$5uA3rq!#UH9+G)v%tJW)Pt@nwY~LMZoXhZ%wCVUHygyP)0zUGRTV>$l1f+@tMU7H;~cQLTfvXsQiV=?=ZH*B?1JW;_51(_enLw*Z5_8X0@?ep4s^_3%d zmXNxIfZERO&%u~{(mDw1)oD-TNBHE32zn(!e?dVEfmyZBiGF-t=05RP=s{}b81ajm z)SmlyQmV07U|3g^YK|{;x+$Xzrn^9?eFT(2!^@dq35DdhJ5|M5o9~c7j!LaoQ`y}! zGFLrkflk1_zw`A8Vqo!)pSzAKLT+j99o~4OU`(>B$9$cw?lD`R%3+LAi@utWkiDMF zLd|ASjjzQ~TpgP}cC9q>wrnzO&Y84`N4RJV92t}!P$aBvG1*K2-7x%3H#5$4Fd3e3YateVyjF} zLH?mtVS40ohJH*%qG_CVOpi{5^~FWEka}kC-g-n)XV1v>c zvQmP#AUcFx&0HHB_%1|V`6NR~(>TE|pJxYJnL31D}tuV5z?W~2C~*Hsnf4h3M! zptr#G7S+te!#&X)X|5R*BTi5fLcyFlAH?nLvMN4`!$E7krYVt zQmEAifM?Pe8@tz>H8{=CfCC6scV~kbxN~$dr?U==hfX-Gu1^6~dDy&f^%**C0@Bo9 zGC4RSMXaMA7yJ~`Ks9|Zz5I5Un#)5WP21>REmI25Qzc^=mO}fE^%LqB=?kY82Bbgw zETisobl(x`&QZQw&0In*YGBfL=de@_+B{j^qtdm-^mubB^VJCWyMZ6rCk(Zs%FiJw^&zULt zuE16p*fIy|Gx9FhKx=a$dyTH)5^}BMo}hR+#qP;3-A@;K!_RxDD7WI`(EqZK!~!+3 z&|C+SMO6Yq_nRGPXcJ0^Wmys`+)3&`oA+Mbo9V@9a>Pf%7VULDZIHU4Yf8#`yHi;V zW&%;DFForEgQHFS--WG&kmt%r{Vu@Xvo%KI4NgJ0_Q}uA3yD%xI6Q~CwGHiD6*n5( zN&)0~SVB*IXFw=Fj%8!ZP-D4{Sw0i^fx>d3F+%&{)s=aZD+mXEC>X3Sb~^`tKLp8c z0TA6002Cax{}}`&w5diUFwz2rZ7AZ<`9*b5X@bg)Y2aDlw@UB%PYMT z4)wOP<|=f@-SzLBnaoDl;{kG-fIWZ$S^G2-4j#v*XP6H9So9pQ317_a?}89|*{dL{ zA}ul*k~8PFBSA`5u4|}G59*m;qsHtuH<-|y(@^}3!tqMOrS0FpqfC`6-1Dk}KEYNE zF<`xpoaZt!3IiZh|1eQ>V&+d(~tunJ**Az|f=0FRhUEw6uX=5r~_MFj3~Gr*_>lGrue4AsZcB7hHpwi3iT zB;av)og~@2xr0KVv(9;cRA<{g@Kv{SpC8x&w}u<=VNJJKV6>CghIi~hp?2BZsBL;@ z5!69mI#T;2GV9`i9#I^5k1#Cj>c-ML=NAoJ1&(D>1^kBJAF_nPSOcNZ+Ry0{p<@~} zYBgAS;{)Ag8wfa`Bs*&hH<$e?B98PlA*%uwXax%f`27%kr9>`BG7ud#Z=YN^^g1+7 zSEB`vi^hcH0K*9G7wO*?Wj=*5UsKTVlH<%p1Z=GgwXNG&k%YX3AqqV>y7alr zgFjCPT*K?-1F)z=rcE+rO`cnPSqjGB`2;E*-n*+#aeUqYa6L$6;{mDUh*M@9*)CF2 zxDlARMDO&;8R3D()%{lLTd?PC)THqIW|X?~SO)&E@*`Cw(9SRDtk2wZ-@d|ix_RC` z+Yq`}cZU2;+PuS{im@C@%L}<6LQ0N1eu-Ng((EAV1I**ay zI1Rv^5BfchMt$L#AZu8><$F{w(2k(``6m`9J=+7|bcdoX7jtpL0rf>z@bPe%H7eDF z`TDN6jDbX4bNRD0k)4q+u-UYMPAL9~l=&qs%|mSjf4xsmZXLR-x!E`_`mCA{kigw# zcg!5U{sXAX`lpla;iU6MrAL4HMv{IEBETw6tJd$NEj-`xyO82cl)O9begLXo@LiKv zefVy>VX9vJ7AWs6bq_+!lmCP9S{hdUw#31%TFxx5e|sU0bi>y(9siK}5EtTR0z)y^^$PLPoD}gI$Q<+M6R}xZ|8@g{0^DJLEk_u>0d+qk zSEx&(iz#}t*m@}jV#XpAdir5~4vMV_t?OnLhXMT#u^$pOY&f{zws{ip+D8NY^gcT4 z>=t~``c^0L;#TLr;pE*zIeEyeUBdi;D)FH1a<=x(7AvpzZ}4*?@JqE?;SU>OlTmJP zDjk_c6{lGOQBDJcYCcE?7WY*x*S$4)_{u2)FxF|1w+BXRE1Liw>BngLDJ6*oy*dr8 zxm`a5yByOX`m=W4o9m1|GKftZ8A8chcM-KTda2`Qglt)L4R2ez=Y z@VlQUD0DIKzvQc_a#fDY!67#CmQbcpMc8$u<}D27d3URKf)h zoq!z-h@ZLrSg)5?z;uLVIfe##FyxGzz?8otXuoKCW_?l+K7C|l+oN(kw5oZo5D?3) z=PY0BaAu1Cv^9a8a1a6#`w?5JyMPiPh_a5Dg^BTnG<(4`>+6a*l}JaGD%pZdCe&tN25o68+ejie*~ z5wxLf{Xe$80xHU=>lzF&2oVu!73q=&NkI{5X+c2gZWv$)m68@Ik&@0e4yG*Q2X@gtI(<{cdlCP>U- zItU8qYi%|eJV1p4d`-H~4mE3jpHN~yUSWa-sf^Jd%zQT{0IdbwR1IY>0ZaR2%KQlf%cn!mq$(B7d8iFgEJ}xJNo@Ge zvYdE^!B>1yJnVn*X>;tgkyM49mnEdB7P6%f{aiU^lU>fT`^~s0pnn5)_Ps8_b3LXJ zY8}~2e=0*EtEhy1+2PfG{JJ>M$a9ppP}5hYFl%j>8-ym{LG;%t%#!a=mm#VS4@0mIfQr_yG_iWoS;`+j{QCk~dG@+Mr~bF;6W1=mLEu%-L^F=ty^ zk;m3aGdjN#05i7^@&|$1BrGI8Ibq4;An!oXL0jIdMv+cxXm9GK04Q2qRpg(48<_0C zN2xHSx@ILybKtY}oeD21aU$G2JyMq`>?XQq3N>T_d95<-J)cY@7%jSefnSFlTsPbg zYZL5Z9S1uUD}W5VlQWetnYN)gjbv#C$yiAMS<(V zCnZ@Lk*FZo%_^&89yq)Gv)lS63u?Jy{RpO&J)qb0{tp)aGy8s8C$$3(7&Udx1Y|FW z2bVzV1<8d2eL$LK{`xGvFR1uhaDLV$hwQ$sEcV*dnqXDFhu*eK7TIRtm9nMEQwFR3 zMoloDB}b&MH}ClLq?RTzM6wXU)U9<8Zh7EfDS;U}x>?KGFr+&L*p9lcG_8pl2qZ z5oOp;;@uHSm(F-;7vNLJ9R}m-mRhgn<#7PHPt*ay9$Pfo^tpH(i)C$Tc^_{&f|>wR zpfm#h_SZ1TD(@~X0(}aJJxn^?=5+RMEliy)FYmQn zoltm%QvPz*j{(Zu@OaCBuZIY`FA*V+3W3YL9DxiSsM<`m4|eWmi)_ zkd1s`Ry~dZ^}*Y#x8I~b=6;ksiza?rWpI+u^cyzY<&9+G7w!@iRh>^w@71jd1|kuN z`@r3>Z$kysA+wjD3zJ#QPl)U$ow?s}x|}JOX?WCbW8FLb*2yIVWo_QJ_&)~&R3hPm zzPm59HDJ|nQNmMOphtecL$_;m_@#Lq7tY2bp4jLINSMJAFCLH=<{fnWl0`17ice=6 zn_5AHh0P%&vwsglT!L?8!$6Wqc^q|y1Ar9fJj1m^^z~E}vo*Vo#ph8jx{#;G0nNZb3%=dS z>;N6{X~KSY-qQgMQk&4nj8k9amI>iREbu>^`8hALM-BNN0NZT*GutP;jA8SDY&u6q zT{nmQ@UX+7pfb8OG3Zb`tF9g&6c$c|J{wtj@hrQ-tS?Ixlru{84_R3eJk#rRB8wRX zZzq(fq^frJbnt2!I01k)_Qzh(h|B$;k3<0-i`Ya8G3nAgj5EkcAHy$_gh^9;L&$0- zrz$nETF=z~F3~jrojPIXZ4y%{ju*mB;U&@rQ%b3oL}&QP7a2uHN5`nCYAU(P{Me~B zj|v*XOC%u=mnm%bxek(L!%af?PH6K_VyJ*dhC4WW6y74|0<|fZ2y9?{ly+%6k`*bW23Kn8zZA%gPR!}n)8qx?Q`svT)S z6uk&&d8%toqCZ;$8>6QFIvwQ>a!F8?;*kNVUpN~b(hH*|K#a)~Nu9Wm_TF3O0KMC4 zrcrviu-divG|0h(H<6`w&9`l6NRz!r-P%p8!N8;CQjA8F-EyBCaLn;i2Y=EHRa?im#zFdFl$2cET`?Iiw?0;YL^ z1hEX!sUQ8`TSR@JA`FPi#8!P)jrx`GK=U2C=zo7p;C}_z-K|7mB5*3oIF!@UDof9$ zXvoyuJyRP^)YBAcKLS25b#SDUBHIUn6#!#rhpkBgXvS1WYm*3{_9cM%j)1nt367vn z*Lzn`d~ipU@atsZZ6HE(4~T3|=a#`!ul!!Nv8SMa{m()ly9?d2)7r1&BjQ@X{uTb? zZ0(|#p}}Li*o+vkhUfs5i4rpju0|1Z;yA62jZy|5LFqHpO(Cl)K*U0WiBHG6ApEEz z^DiK5Q47z{k`!&J=OIs?Z#n|}YMkYA1TPp}Y&I-&Sn+(_G&zs?TR5~8J1a&={L5Rn zq1Y4TJiMJdn@1*A0t)~l)x0a1{kDpZ1R?#GNk`Gg1Rm+7tyL~nueX4e1t<3!@Js>j ztH#-UXL_aC#SvS&6-;zC_Wx^~EdB&3jpr4e<`;+40HximPfYaeKXhuTSgjr(Xr*Z( z2fkuEvxkYv?onj|#YAP?jyt&Xdz$TmD)3XQ%7v8u|ExQTaw+PN?a4PO6T#Lqxs(*X z=L&W#nGGMwIsye%N4k)csqSJ;?;dcgrZL|l3LLI13?`z>1m&~O-S6azrrPXzAP|#V zM4-HYD3J8!8|``rsymqO&pkH7NUP!+mkmjim`TV{ZyurU`X6zyN223UuAQK@OhV|PV4xV9*m2?TEe=R9mpk{=2s-P9 zj5Gcs9AO|(?JMF-cx<>e#P_2ln8`%3`q}u$8EQ?tnf72iK__Ge_kUN=d@OqexqrXJ z@WPb+K9w&Tl?7_07?vReRq=quXtgu&Bz(E|r{0RmbS$)50x*;Ci*q(_^a2tz5eKngB!wT*1{4Q4j zKik^TZohcsdvZW^xtH`t5PTZIWMYkE^<4L{?9VTE=v=truJaajhS%v9omVwBwr8D4H9^^_pVOXV=PgRMoz5<|+_!L(h!iXXdn*7nl0LUoZ?)vrLk> z0VZgLTzZy#0k7gX9MJ+fH49pY!dMxDrgmRhNqMr0`60U z%3~K8{;GU803wgs#C9>bkrgS8vPUK}yN?ouykb}NJ+AudM=0gb!>6;Zq`H&>6$0D| zEeUkqpSZg}0?TjgUOHttu{+0x&M#S)-a_U&48}~94~hp2y$=KpnLCt{mM6&#q_and zO1w&o)9+b>qDy#6cG_ z*eJNG#_DZe1~AL~;A8>Q8SuPO8AX4>R>es-9zF1^aMt^;s;nzS9@osi zH-aWaz>}DWXgGOB3Hw2`6$SD$J`kwNY~wp$-HzQ~Pb;r~TvxS$z zT(yP@A)q}Za_&4YJSE==9=8fOKN8@yIxqOMesf<6A48 z0TfVfGXBAVrUSbTW;E_PX;fHo zaX9{m+OK9>9T)>|{neR5552Yr>l2pV)33bO17z$BU84K2w*KXu6M+W}SoT`8nN5+O zELdcx&-o8Ghxaz>Z{1kTj%xKB+c&AeSu6NKGxUDo^j5oR*@v=8&@XkuT0lIxaqUOp zoDQgI>YM+mEE8viflGa9-#hIN%V1;xu1)!9eS=kdy0A9j2&tN#QR9;^hR5!uws7;U zpfz>bfkp3-zhwm!-0#iE+wBHsr@TlX`>E9&t5-r}WlFPH6X;@qg zvT{Fxi8iC#nz8%+jkl+%WsC zW401b%>!O&Uh^LCyX5z^gTN)gC3^J2mvc`GTja%W9Z%)k^M4hyJvcu4YivPIV_-J^ zgYS1|{qE19F5R$9NmN2o(Cqe&T7BPXU&U$2f@8IGfbwn(|L@}i^4tbss=gP|A$X`> zXzwyq$PB91TEB({$SLT1vrCGiv(sw5s8waN^z(CNYM7zGF@B8Nfi@e#alEEx_ zOCw9(vI@>?xBGv+2L;2~JugF9>}dcH2lo3x86)4Gp`ZKOg=^*WJ!%MnVwX%CkE-Jh zP}~6a_KfRr)ic!d&j;lVTgCrVawoyA8Q=FkwEZh|T5?UmYRw}TS@yhzx2)*0a+!Lj z!b!Q_hEMm5bNSA?6ZO{d4^qzQsp{Xn<$sC_PcB}b`3}+5y(2Hqx#i}!J5ZT; zntVg+Juo`tB*?DtU_D_2WFl5scI^E4wMH?6x`*ci0U@ZHxf%w#Z?rBx|2dumj@rku{6l{?f?qz{odzY#kq!C0 zY)p}<-fc|-nuANuO}NiTI{{mx!y{i%6TtqqtXZ(%ONj9F(Jz=~kg$2#G>f=nA`m>E zLeDb3o__PyO7?Yu9X%9&U@<$waDt;zIA=4Za%5s^A8;KQWj{>U_vi^8#WMZ=RD4z; z%%_wCEcVE#PPv<4j;H-TFJo9B-kDo zS(vm_v;hTv&I*bj_SZfr>P4GA5>BP@D&;Nif{NL9@CkUv4P@0_`F3||uPkuqQTHEL zpQR!)a?(CA-t1reK7zoG0;qz}265-_QCU1DGqM89TgD(GOiLpGHHw@=&kQCXOyU6I z2lNaUC|oLF260M*P{nJ|kEd2^2#d*wBWgEnfKewN$9+HXuuK{5rj895~x4>j`a zw_mC66;6&?4iDEl*DUdN=mxJe7>v#6^#~j}$`S?C#9~p{?hj}!{Y7(ZG3*Fm13%>0 zBl#kQ{GT4W(a7u-9*wvj|5@9A47LNMdVdS`O3P#ZQK)A>)&2Dqcq%W1KmipfzbMU5 z@@+79>q}1UIb0hn{@3XQ{{Ej{9zL#ys~XKM%kH1sd#u*~%PMqm*YTx>l@|df@n3!h z`_pL_z?Ye+n(L{>2&=HT9Kc$x{`XZu^_zYZnFb6WqO(|j`Cqkxipqqa@LhC}MjX{? z|K30KPMW*QRYmVR>pG%i-`Mj0^F;%{0&X1%xb=U1D?f96tYxb3zbsSkgI6AD(ZT{c z#ynqYbTud4i$RN}ju{3AWkXT@trqlkN^~zhRiPfvmVulzpE=A}CY(Y^V+2ASa*a{l zS@H^AncPlp@( zwMi&xb=v8!2V>C$XD-1FRdq9P=b$_mOttjAdnp+scp-D4#yjN4S14SS^pw zEwB2+fLef};J<&mlE=L*wIV6zoOl%^p3J#Lpxq-__TEDDB73%<81KnT=DzC!TzX3S z5!2wyq?>v$B-nh7en59PWgg&CB&M>wpa6di*LkO4qHs4UilC~y!Dug-|1jB8Btkz$ zt_wp`Fkx1FI(U_NM?N=n{;PV!vkol4N{ z_NrE|pmv5_0Y*lfyJa0&uM>`sSKwKK@^(&f2Gi477Q^Lzs)}hrlws(*D6%)t)$ggl zlYBRUXZoGO^z?%J>F=k!?6&L(6mr?h(=FM3>>zPR*eThG_RA)<%<7-7wbf7@U_kje z`vE%#gM^0S6Q>GP4Jqm(kdkpCq%OByIPns!iH*8dgzx?QnA`p@ajxBw{HZBD&Kb#U z$K#D1Yj6Yi?<^zG8&tFSl}6$5Q@u)uy!xY@D-W&ja5eITf1k3j;znz7F89Rbe+j>M zMEbj)%ZybHOwO@hEh8&A^!9lA2D}1cs>z=W=v;^23{5-J{JPyqxFczE&RI$XOzG>O6rY8e4KjmDhJKv9Gl<2QsZuP|YUBf5I82?bAUF}it z_m2*po%d}9Oe@O{rxiufYc0-Ocinkw;kHTjDw2aRWGM9yk4nf(Fk~fvj22(MyW9OT zD)Y(l7cfibeGZ=?pGL|1{;L^Jm|*76yZBUpXJou74-i`88i)~cgZ!NgazC$~oW$lc z<7YG@vFUWztZ_0Q&xdG~{)@Bkd@BUvzb`jM0NeIdnoNKPLbDL;{jhjUKoyty^V(&T zdVAto;%u$b)5S;(Jn*(P300sgb*hl{Qwb+QRorXeMBT4l@Q!_R$oNQ+OsFb;k6bS` zm@^}5Z2fW84a2qXpFAPk53&bZ{)mIL(ciqxRN=uQ<}!uc=cN?NR`jXu2+eHZt@NP6 zTH-V7oGWhjLl*=&xnGtHSeH;f2ERXw*MA9HAKKi?jh2I-?>TY65#e)E^CscTORw8r z+!)-3#R#4JUUV9?7;(*~`t@yL z`KaC*rmHMte(vZrEfQ{$oUUb+GcuXbpoYPp_jv(yz<15ijbpyMPy_J(cfpoXLPs=4 z+OtxSCLi|WlNXfNuKfv-+3Idv9wAQM5t{hzQ?nZMO>u*}H4u93;??dWLqnq)70^d? zXq2jpt4cvzmWei5;8Vlvo9Ej*@^0^En9mp)aDG{gd$Y2JiSoIK?wrrl>w6l~>OKB_ zVVe(Q;Z@)DxjadnM-jY-oV}qY!jFsZ36>*e@%rYrkh-3u&YEW<0Guje z^c~9c_Cm6+l@=o7)qs4VU7*>ZQyX89C<=P(wy3FL2iNqBSsNP2+@GsqysR*P#2V9$ zJQ~g!J>QGs3JND+I>2^xBsBZoSzhZI3u?c|EW#X~G6)BaCO}jy@*Y1C`l4ob@V5E` z6~i*#LXFJ9#HPgyXQC*f9Mw1Adumw;I&Dkgf(MD-q3Mq1rpE#O{2#p_o!J(uGHik9 zAH4Iy_T#!IILpP+6>c;A za%0akC0hQ4HuLwed(-BcWu~KhUIm0KIjG97ethkR1lM#K@YwwPu0c<;g1^uPoj}<% zuhui|wf@OJcS4$-?`uD9QAKk*zvmH?&Y;o!lJ(4MTNGKbwE{DvWnvW#%|zH5p4JrB zowSOwYqGhYlE?G9h!QI%;WQ1|36kK{T||*{t5cp1pf3BH8tQRn2cGp8`Mz?qnZI&a zBPsr_G*M9m#p`v>Y?$`=WEK&-+n(mHNNELD@@1%ohI2^xZ(ul#Ycp`#5xeR(ALLFg z5!2Dpqq(<|KQPG485?TEG(#43*t^)9D1^tPqH5Y?TZzcxg`k1pE!RyjVeJaeR@u_B z!BTNb@k7=$-eQT%s|t*~J||1J!OnYno{Vb^ho#8B)H+>e8@RF?2)g5TUzbsSjexODq|pE}6~M=VbFiJYtk!|H16KeaYP@qQUE zKLa~`cQc*Xsj$lL@&YNbo^7W?o*4- zwQs)l8^qlMLLQ;oI@x~lbdXX)-y!W$9J&u}7StXv?;)%qDXU7UEWy{wzm(jk#1ArK zx(Ve%Ra^neafb@8D!KhxJS0|& zoKuoK=OuX#19<3h#rjv@qngu0ABf%oBJ}M1Lk@obEi|v2{lWu?$&0OQ)&0R$Hd&?6 zRjFnZppze%DKap!egh|kMNs{zqd6<+2AJU|^x5}tDY;g1>L;e|a$R-PRb*UFE|>4e z8sfJ@uWrK4^dV5avh6U5pMA(6n@taXr9uUZ;$p8pJ;I>BKXZMeVagjLLmD~%;T;>x z^>-zI3}LDkd?bUyq2noNT+5hSnW{l@nJ)@etBZpgk!CqhK}TE_k9K|=b4{R1vFWH$ zpAVb$fcHoghbBL)4__tsB=(nTZtk^SFsi*vH4GZJ{QmOD_r%ujSqx)T>+`uxrWKN( zDk^U*TG#y^CWV711zNnufXP00!m6Acet9P&!&;lquqXW4Er@Z>mb>~ieXf|N2dx%5 z?Xf7&?@^UZl{6(;Qz=!RT<+wZtXn3%^}a!P!6=&#y07oh(>{20In}T5N#{_qWRif- zvpA;98dqu%U%+n1*|)L7s*JRLfM6sIk6=s}{X$-L==};Kp=l8;bT~dxyVgd64%5=v z6Ot9lo|Nym+p}$t-GrQEdYM*nvin?QX?X`35QQZ20nHzIfUbVw+As*^Em!-6_OCmQ zyVcdG-dS`=zkS;5p%;ZR`Q6EP#>7<0bioV+cCfbB?Zs}Im1rKoQzVKi>tItd)(Ygm zrJgweSjVZ~@LTKx{Zo~-M1;Cegrrbq_JoY`u7W43=x9YasmO?(qj)Z=Sc_B=XFf@~ zOFX9I*YgWpxA*7FV>Z(*bmEx1V3eJgG~Ow7Rx{%0HsMXil0bDiFwIlhD%e+TyOFq1 zrf(Fcp6W60ah`mzMsVn^!7Jea*2y*{toX&@a&cE_FtBugbi) zIT&PiN9u&h;nxwEPU5%5tUj0N5KPswI(ktHts(4%j2Mr&T*8a|h)uUg99sEm-tnXl z-CrahIm~(ddCgwP0rt`I@$ROUhCPh>_uU}8JhmR@ioBp3#FoDj z^WN^1hdz9E&9T_v6Q1vROk|0-U^e}*8y`o_O=RgC=M{E_8tpSkzJ>X)Uu2>{(9(O} zVlJ`vZM9)pC5wK{&B49RzD~dDo0(_m>RM`LAn^ zN4+h2^rH6VD{e<^R-+-jN^^s6cNf-@{`j`i&i;+WAOb(|L4cY!NpPmHA-dk%ZsI3~ zTFfE%b6UQrsEuJr#cXWhR9zBW4EhwhFNAZy_#HCY4Ct!dANZWWB*=wjwsWI(RxouK zaGF-Xk`wB^L8Q75%MzLpd4%m_mPRN3+fMxCdx-zbR+o_H#kZG|qs2w}?PAAwT$Y3Y zHF$cSa3qTP<9vp46=R2NFNA&Q1cN^x`T5+%pBBKj%s-aI6{Ljz%o@BEu`VFqxNR1g z6>QdiLi@EgL1WdL-zU^myHTZ6?03=Kh-Jc86Y*B`k2C3JKe6G*?j=YR%zuUT^Q<@q zE8e*~^Gh(+ZZPBccG@%412n6csh(K-)Kw;yQg^6NjG%xcq+p??c({5=n2qlNjS6VH zd76ADjT5wC0&OX6D~(EYP7RM_w$j4Y+30U6;&Muc{n>kSWz1dedm4+=-5{EM7clPl%exb#nmc9qM?4L*%JC zC9YQ6Qd6WgYbaxivb$cj{(?Tnv)QCzbW}S(U)aFDIyXCS6nNOQ3rBJ8#l=J=yI%=x zIr`epWKf8$Q^)xd7M|v0&eUsq8%Hj)6n?Y|xd8cgy(PdLAnelP5x*Z@q1is7mGBBU zm-qjOWI*N%*g+(|jz=#3Y?*JeEObp7$L3s`-ixmtv3JcpA}QE6*}X^tjHFWnXCh6^ z{wODJJvBpxxsEvf6@AMl?Dr{AVEPATHj9GC#%n?{JEx&GRKxN6zr9}I%yuZ5fN=l? zXU4)6x%3Z4_`l|{nN3!>i=3W$i%N`*mgPbljUT&ambovJJZ5Af{ZKE}-oCZO`uIEd zFYle~yoD?MdP4#;-p1@CpZ++VKM9~UXxkqUX!5nl@WVG`6>h2E4`e2y>O4hhFS&i`|j?I5$|{zOoEfSRi9+^oboVVF#qT<%g(pc&2` zG7_Z-TW%~qJ)NJ4-;SF-;}Oavo<7bhb6@o~Ri^0RJ)kq}5=5TZ8axA4Nz(YoP7-b8 zQ(dD?G~@j3X5NjK!>%%1Ug;s$3HfGcXfpRu5_1t1iMj=FGad@$(lfHtvrHGizk zx{oo9p8iWXL3T#(5uE5>7hf}duhsx;0GYoV;D(UXncqQQrFWQ4A>+e`O%NjuD)hBq z(_0f;u3!$mhK9z2Fd6WNl;V@)@D%gf*-w*}CX$Az1bwY`^2-*p@u8D(t#jgwRV(4) zJv%pazSE)S+RJ3+LibbkWp{zX*=`6^NbVKMm(D34dgHkRFpmTqbfc?3aS5b6X&lnf zeiP_yba<8b`*5+V^}>PY9-QYmp?+uh&nxeC; zEaAcViUnrxn3Z!D{lHGi=EOL3Ug{abT8;_%ZLq%R>vnxSW{z(=1Ps%4u=1=o;Tj}K zTBn{0k_^MkEPZRFFOV?2-uj`kZ0@id?|?|*Q2czhFYhTOFwrxUVIulW%Tm=@bD#dW zF@!uZ9K|cA z)6{qIz5WgoOtOVg6Z~C9ExSu5)|gu_6(8+L-Vf<&>x2B9huE^XdrbQh81G3FHU@ZU!12h;Em7Y(Xe^ijF5>NmXBgKMRMRC8j0aNU;Pl5`u1qDgv5;XJpHCfn8_6|)1 z7>V*Xzv*zQUHplr(SW5Sw=BZ~Phq0j{^WU*QoqmnRdI9v1p1LUuuAdJX8_!WEBK8j46Q=-J`e zfm}`AE$~;VZ}KTb44I8y5!6rDJ_fYmj01KUnUu5f-`{2|kJ<|@3-DE;3HSeDQ&?~D zzww_{wHqLw+w`vA_)iLSVOv%5LMAbM_dn^`ZSm`WSScg6m$Jb#Qa9te_cg)i)6Dtp z#CrRnAxG(uahS`%b8x9u`9qnu@vL00|3{-&(4h5 zxX~ioem^FNY1gg599)kp(JrjC_Oc1bB zaCm6zvBR&6DzZ})_+jxgLxw;5P>rgQmA8%tHwJ3}+m_r-Kz8q4^+s|-!cj9gBRyKh zh(Q|24h|Sqi$}$LSX{M7n{kAYvDpFc6lKDI$FZ?N}8>SgW zG`#EDchQ~v<;4Yh=yds9E~{bRZERyhrV)B9g$w27nH|;&k+0HJ^$>w*&EWcL7441w z=-a0407-GXamDWM&((nCnp`-_GNWA`nLIc3VnQEMRBQ|XS+EiCU){5TdwpEY9+>&& zqV*u`9FS(rG2ObQ4Hcd1&fnsEN?yBnCpk9E@x(9=+spLT_9S$tuv1anbe#sK z#F~t(eOk>YNB7t~d`x>FPecDr7l0t!$F}7Y0b9^2@7t7~+s0=uQu&I+g3{NwDqqC_ zfN*dE;6yqUOI^t-U1`$RXtR^h=>_u<;>EqA5j%R!b-g8tqB2B^^`x~d+h6^*XWfhj zrBKd;Fv9?%%~$F#RugpWR=S2;+nrOD4W*(Qo#r~Zx2bs6vMQz@3@k#=&}DX$HN(6S zyiYQ@SS{Y&ad897{m5ed_?ys#_)PaXm5yt1g-a!?qI@#Li)nDSNBC`9e|Zc;^2N=| zCWSoC?_KUML z^D{m>Dp{cv&2b1@W55C7*j-?xF@-CEiGTzAmA0SfN{8~_p9=Ix(a9M=1}-ZI^S)aK;yMGi3qG12}A2Zg0m zri%dH34y{kqCns1r6;uU!q>xe`oMza6jeAZdpP)7xq!{s13KfG4P1Ve@ZM)w<-BJP zsH0aADGRTZ`#W^>`ntg@d`kkZGQ)E(3xx;qcuhy&cmR%^d@D!1f-Xv`&g8 ze5B@Mtf+gs(toZ|4)mrhI!)>GimqW61BKrhc`bdJrWZA`M_X*yBuPu7K<;6|lb+VvwDU>avxbZ=STew3wE0 z+qE0xRBVbjRd@yF6csTFb0?qjW`i6ILf3+!pA;2_WI;U!Qq!#`8pxTHz&7~;h`0OV zJPDG8v4{&BZkDds)I#6-B9eb7I~xnJ30l)1ELmK+az&PEBn6nY(^Of76O*LdOGvRy z^Y-H9u$la6<;&Z`k&y6uiuh}mFlvBAiufhyZ>5e+q?^O~@u+>N0dtM4F)k@3DnF%VEi|K2{N7fMoM3{^04O!7L4jjh;{ zH$yiN^xnT+e|O;ot1g+AtH77I*$$LNvD(|GVp_=)@>{Py85)W{*In>X36t2 ze~e~RbfbmOzc+eAK3%&l3#?#7I4y5ZJ7Yg9u?8(>W)ubs0v={ z*PGyLXxzV5^e%I^o8K_KcK4)ZIOrDSqSJN5S{$rcdd7_8yK!^c1hKFi5p?vTJEPcz z1u5j;oQj%AhJd2gm$U=tBrHs^55l3DKj10B#x!mR-)8eUboIescTwb=o}?jaM3?^? z;XKo^5O1c(#qvo0F)M^IlI!1L}J^Q=Bu;Am{^oX!>(54{!(%1(1^$VlcM~yTJMI9 znTCzqaKpX%P3i`17_R*?;q4WLY%QsG=`O1}n2lphQCXwYY9Z}v;W=QRPwcxKK?^hZ zr7;UH)9gUTAWEP{c`$O`IJwtkA!mNuX+7TCs}S3M4ke-2jU2eZspq`&F`_}c`75p$ z#j{_H14jGoffr}1Asb1r3{XArP=)Yhp*DGCPXx>$)5LRkl1E>!>LWM@jTRfW_KoRz zMaS5l8Nb`M?Y|n>$M619!HF$+_e$N(40B-M-HJ`*!31g{NXbX{VJ2>;p^H|?PB&G^ z{WR5FoX%(QJy)@rhqA$A*nYp+-g8COzDKut0i%qut=mCX*gi>AioYSp4FFt}ETcRR!@m50vswvY6YB zfx$eQSZV&iZcI(bb}oBBTnV9nQ-NA6k!iK>u-3ZJ_f;8qTy%2&S3VAC6?T|Hc8`?} zmO7LrBaWjiXD+wX7T^qn2QQ z;ubOOHRxCRpO$6quSBFs=MSnlA3XyZz^gtO2Z!M925$rjDOqzVe?qmsPCIxk;ez_! zKW5HD3MNZQ?JvH+)qnGr$!3Cug?FwX9>Rm7#s>4g0dj6pet+dg%>DG-TTzp}h&b<- znf0iXVnJ_(Mz|Od_9%DKGB@Yrt92K{ z?x^&+GxP4Z9She25NYi*Dtz^6!i`aLumW%)Y( z6F|AA<8dh~_)c`j2Spd}s`am&gopKYL8y9AUdvmU{a1DM`3se0{z;Ku$sik8fks8wX{c2cUyp0(r{!4rrsBf6i_{yFn#c(@yn4 zoYw6}w&AVKWBJub&kat+PPhiN;`_EgY;T)-?Se|e8Qttporpak%Nb9@rO%h*J5Jkr zltI&7Tq?+>6J35W&vPS(nkiFyHm0~#-!uN2y2gF~#u^Ph%-CR}M{J`+;5N@TL%doFxL$%o7`@Il@nzWowVgA=);O`{V&JX|T_K{vf4y0nA~VvEt4cB)sh z2a+Mg!yfERabK013riz!ZPfiUV9`u!SqU7pZ4hF|vt6R+%^oOfC{TKF;c$s@M+mER zs9}kBXR!~E!VH3cQv0bzxzQsSdpMAeBnty@yXu)aT`rzd7mV{7OCoBWK5q5;y|FOo zr$niZ_^O@V%@`&j8;l3Awo2crKN}9lo{1hYy9Orh2j6au1;k5B;pI1H2u%D)go_}JfiruPtAt!AFL&>Uo>!h8=KhStiV6Hw-|L8Bwl zh8m!@F&*^t7%e<-{-l#e-x3tO*1McPK7+OcJ}i!6;9A&Qs(UM{V&)co^;Iba_ma$W z{)1MFvnLE+za{#~6qb;>c4wldVyxqN=bbkpz*hJ&8=ag+9VdxVsv5g05oja6m}lD7|_w1T{v_qUlBs1 zl)zj^UiaSmZLepsQAl_@z@8`w_?UzEc;BWZC_dtPd4Np3nkkbwb9ouCslZyGVw>}R z>5n>qDz9%kT*F`Q5`#3?W4!A<(%$6HDwD%~cJA<5@?$^FZGwypQz#(Y)H>j=WbN-f zYJMJCYxkhT@tuX+f9OnYdKNfo&tco}Llj(35ZWySmi8O8eV9d7 z*})I3BfqucB%l6MbfPn@@0pA{*HHPoCjQVqi^vztx z3oarbF4j^;HJpghCiL|ebfHKy#z{!-cZ2a~v&&a~Ku>`Zymu~D`ZvXH67xJnaP4>P+ck?j5oie0=diu^<`h7F|3f@M&%YjU$|dmqU2Lr-M|)AWG(ZE zZK13+_}wD)dUG(Tmo(dINQqV&|IljpVob`V5+Vs0prldWBB~& zU4sa~Oi5J}0kmG=q+y|8A^7q3bN`A}e=3jAm^eZcqB+w}<_{xh+Tg zv1PthWw7*caYv|!AZA-%ac{N|w7tg5K6Dt+Vu@*WspUSd%~xH_yAvBt@k=}3eP@7f zTsIpwwQ^RpAtP;MgVCsLW_bAUC)|a2>)s~D2RIJMVv3R-|4lADqf!P<1ME?8c(#lZ zn|BA}d$dAucPw(tXH>XsK->i?VReA-+Wi)QWraa@FOWb8`eS-pYe8O4jMv{595Q&d z#6@H~ozM>tWd|VY17rf%Q{aI-b=|=RoXdqQE_S?jz$y@xo5QE7YKnz}J6`tm5;qBN zX61DctsO^qQZdwbSO?K0lwX+vY(tYP7Cf`rrsx;EFOHmf!5J7?rk!y?B3 zD;QgPkiSTHzI7p(09xb?|r_USSt1eGt0cj3ODvE!&gSiJV({e^(1^;wx zHe#86kcN0|MdWsGauQ!(KLQh58(pBgUP)AJh|$6hkO-wL6Dxxw+lamgL{!6w2@k{` z_P7{zHZ>GX)`S4^zaXl5JNa!GO_Z5%0jCeD=MNa6oDkXe<6@FGQBwmU8uUY*xZaO5&HMVgR$xUI3q3(GeUp#zYM}FKp|=CN=Dn#oVcJLbTuy z#&R;p<>=Ntq}E3L0bJE+R9UhYx^d&iT%eN~=y-wEZ?g@2dX$sh6Srx(l5MOfuf7T& zMG6?8uO*}o$-e0O6-_2X?^^4t)cibpl%P*NA2=zpe`N3JcoaOZk-T!{T};W(A6Fom zgD+l~jUOv&m zZqZ_n*Z_DsU>+psbKo!ad=`P9hdh6fdo)CqHKP)wPyPi~^J6W?-urOL6Zj5vQD8D? z3ddp+n8K=*L`Q}j>seOxa=ioL5KbXp1uy4R@#TE_2U(i@zrrb1uZTV0G*ZnNqy8gr z=8~&8$64ZHjN@5wWQ!_Al)%Ke*6exar-UwIaHy`0Zbnp=kFaPP*lFLZomF!8k5qbI zG*5{|*5E0H%+A|ueY}{hg^>+}_i9nIS2@P?)e`OIk0%2+R0km6s4kBh29CgZ)W4hk z`nt;z<*}8|_d(r>0la81$7>}b`5!p5 z?Xg|m@>>vk5}!H2#cXn%IF3z?Rdw{6u~{8hJOC97iYYw05!F^o`W$}diGX{|E;(=D zAICQ`sv_G41@9wq}^#{5QmFPS&1S~s1<#y8z!2w|1 zHLdvPJR(g!R&G*TP>ldboy&99EDS#~%LsJgZBJI|%|E;bC5DZN5uBwNpv5QD0gSzEK=a4!PdKlos? zyJ_EO%QR7c5XO&o?7W!8@y}0GL&Kx#JDh+$?+GB^4&pcu#&#~{z}U7=I)tzH96(Z) z7#SR){vUUVn5kosJ{_?eb>`fQvomlIxq=ya{Ef7vl{|1G;_ zq7oBWEuz4dBz)KtqF60;M_AQT#g^5p1*CUw{;SFd1Y|Pon&U^4HLDM~^&YQNQ~n0x zJeK%7moK{I9iRGHBcZbLM64aNT@2!X*fJWkf4s63(Z@2)U!e?l>nQ^WY0+M227NFK zcSgZLFQti10U%xglP{O1owHyoS_IP9mG6It1Gq)DEZH0Faz)1;X}x3FRZWNAR*)ZR>rF26M~VZp5=6Y6JTk%6pKD z^U>=1J@OC@ez8AR#ae1eMaA4{bWMLB3*wZ`NAjY4Y6d}7mx;(Kpyz-|03yw)k@aVF zhq{&#Dny@LwoyOGda63*(N#MF^f)E*BjJx>B&{b7E}@c)ZVG5P`db8Ww{`eT2d8;Q z?7C$^Yn?X$6lcj@SA`3*d^(yw-tD=(_~_%aOwovZ=7hPM!eP)-?9-5=|6F-Syo@no z8EoROAQ#su3;-sEqgw_Xu({NA&k9e%#&ZNQfd9a#_Za5G1DX{A?z?~7s&aQLHt9Qu z<`CWy6H9~0oQLIV3fq{9bNzSn`@Kiin++{*50Oc-KQ-0tYO%ynM59h$LgNK5SX+x+ zme6|0ja&Yo%~l3J02e86zuo~kx|cLQpf;AXB3uB4hZWM#(U<2pGo_xtt2Bq4B|YT{ zlaDLj%|~Fa7s`N+giCvYW>vSH>+fzvG$Ys^g#&H>V7ie*CS5b?PrYs*^$x1V$cc8Y zY}v}~;L;1ApA55ig0w#bnqfsJLLf=nJ>HR!%GVe!lvl6c*|-7&d48;%8X2HS+yPTO z#q#}+QZx9R%$FB&%CpLMfL=c-7T~7Gp(p{u)px!#eUt;^@fv&$^5d~e{&M^&amiAG zi)STQ61b96ucE7=wfwJSvmXLVa-|S)Nd|hP0q6MkBN4`MN~PD;pCFgJf_#+xteM|{ z<#pagtYJt}-gr6D^kDnqyMk#z<}nk@pmd;|&)b+1TyStqV`JK2&dm|awl)3H&y-nNkQ z#oog?WWEsL(@DJAZ|zvmqLRO-TZw`sC8#wVXkkEcApy-qgmPT*2f)jMVbrB>8wEEd zW_DAP+QVISDjhb0kRn-s|z~Y6Xp=dD25#Y0gnwUhQJ5-BwteC18WA0z-EzHi0KOD)xtJ_M>cZKqRARQ_SNQg)`(jeV%2o({K66sbEK^p0n zmX^+QknTfsION@DX8!xn{P)6|wFcLT@B7~O-SIrn-aEG&ZD&v_lEISz8It%EGNpQ^ zG^@JRN{SSUCt{vQgQf}+MN~OXCJZzqz-Gyx>&PvQaY=6bouyTdKtB&l3+H}St+))kt*bF&Zh+q?tI#2NtljZ>D0$k zL{4;Lok+{X(bQtl04=OLDCAz>>N>MXn~10c5l7F%e7$*Z%J$ApXP>)wCkWQC-pYS@ z70xki(4%6S_QJy`682yz=%XdeEmnM(^ylUsC&tx>l(-yk9wa!6Ecrqor&^BV_<4H7 z@C%Nuztrrw)DJR14*J=HuaW0OjXHsUS`mF;XH>|r?y+)g7?HR6$Z<*SxQ(^*n;AAM zeJ_h_FVhh*eTzaQ=?Tz6!UTln-LBwIYH&P*W6oUU+F_JL@K^SJ%P5hn{Ii(1&AqmA zK85BMaX`h?3NS^GmCw6<{n}Haro8mh8HpCmI2Avz*QYi&6za1igsTbjp(!4nC!q(y zS*wJhT-r>RGAns$TKIX-lb@@$3CRSyw(Wz~XEvMFN#a3zHOcqW<>vbO~I*}Jm)Oc zOy-csKD>+RY*F#iWl=+#Y0pSkrbYMKF{0Rm$r7QZnmz*0^fax`k(P@1Q8$f07gNMi z9KEI&0fi!NDDIlQ_Lj)=kE$shCeGLV>H2?dR#gjOjU3xu6f6R4Il4DpIS*G$YaNGr zJwarRLq&4O;uKM#`yXY$8TXJdY#hdG8?{Vxo9>Nqcdt2zElw4NXBMpPvFr1t+sp#t z^EW~&eBV(jXWdx=h)EhcNqF)hQ5ISb$JHC9MBR?RA|2F>7E9BdN1~%Ot95A$n;zI4 zKjL2#{sD?K8qf6N0en@vRC~gBl=%RKxEO8LpV|)3I8eGA@O&3^<4gE)j}wP(?+xd2 zYN-SCb%8#<3s6KA8U=tG?N6#DZ8qp70fWlpZlK7C0GJPSotsnk*W*75VdS7Nr8GN6 z<;6AkN)U!jj)5W{BBUv2J;W_CCu88D%;PuDGl}e)0fS=)K=k-3(n6)0UbR@4PmI=e zbjrz^Nfr5*P^HGa-?BNBs%@B5(zbOU6woDQpR&GrG&l9~a_yGbNRA78=zgqHe-yxM z*>%*bv6fsSwdn#tDJWP!U}vqRABX?|!lNzjrW& zwi8ep*yXd#OG$3|f7CTxu9B+OimAK%i|+qhI5~y>K(7j_+E+MTE@T}MuE&fZJ+T>c z`Ah5K(LRI#T9v=@C_1n7ZYE#+9?+D}OiIRAb@6o$9I;C~XZtvj-HE(dm;rW_gX&ak zF)iI{fo_gPRiy=O}1QG?k2=`RrrQfWO=i0Cr%P75{}#5?IT;-+%K7!U$@QW-%aHRIb!Nk> z4ue2BORKy4bAyiOyW*y=zu9f4r?nKeea8HbXv0?sVX-a2^sc#5H?IdpEO5p{q3-Mi zr;d?|XsnZhin7nn<+}F2w#3J(4)9tOQ_2^2Wa+lA>Wg-lo9R>y0ADQsBEZ*qjp@2p zp@&$eC7gfU^jp+4mVdj&3Bpcr+*FQ!${rB_VM zrtvlfln9%;#z2-gu1NoP{THq>u5a0zM6}!8ucvVkNod<%V#QAjdJabGr|*UqOO{-c z3!_;p)Bxo{;}q2lRBr8q3GSPGAgki5`FQE-OPoT;rnwIER%gzfxioZlzraZH$@Y#QXaKm6ewXkJd%!lkGRuJ_x#*jpqt#V8kzfzN=gpB6Zd8fqm+o z7R}m%maW3#Zdc(%BATo((lAe@UqE=3K9sKexvdm4NiZ$JkKH4GT(tuP?WYfRO;N#* z!6pDL0lcET+7o(+T_?Y>b;R?8f_|ico9V*KQty-NxS}Z$68cX-@j)P6=+RD`nPm-> zSVwt~A5h2Zz}g3f2ICpbziPl0iYcpJK~_rf`V6W-F3-TF`6Ozj{vd_JWbVsB9EAL? z$Lplr;&;NJ2n~`~HJf26P#eMBzvs`8;AIJWl&10_Dx$q6m;*p!h$-%;UlZeH37Jhk zZkvizw=W8Xwd=V(slALn~{LH&UTV$R`@6Wa4l30iii0NAAq!l~O0Mfm|((HIc z#2=WpYQ*ku!U@Es5G^7%#XkQ+N06$%^_b6Ae?SKZpwOX#U$%{?(K%$UV5Bc#fo_iX z2q7m4@;1#{FOq=)egLKPZIhvJsoKQ9^24@ToqyGC$MnLfV$VW*TItY~`bj(Bks6tJ z)1k?TX8EK@?R?1~Oe!NgpQkge@r0h>(GX1s##sj^NHQ?x=jMpL@N&d()<^s>5|~SA zHw{)m5O6zb(2|y|nhXodlwSmvv~pb!iiH0Ri*693|I$@dqw^Z?gFd zwOxu=mDLqCFArQonA>>YXUvMk{ui(91>)YjtU=jhHU63G7YNjIpSjJ#Fg9Jc!^y>m zey(S45WBn))Noq$@I5f^T|g|ahBe;riD$*j3lTfxc7o7O(#Hsb{A>I@`9xBXpE}+@ zYSmEttry5+q6;kMz47?b!_sk|KDc`CGfE(i35|_YX4VTLaFt8F^SC&s4gU|;T{ zqQY}*1?S)LivWHlHhk6!k0c*2tcCY&%zgf~(e9|_n?zk$C{eL3nDrn7e2+^;=)pn@Vbmz@#Ao8vXAs~2hH_s<8HS%z zSC*j+)aAY4!m9Y@4g04>%;!Jqg)w2$`&uT(>Tn^705B)6Hx2)X`SdeN-^5cls%^4N z>otcmkw5YzFsJu{nEj^m`57CiJ2F%=&o1X(mHKR^!vO%`=?@4coh9~_Z75KL#7rLQ zWOJh;NvY|Zi$6SrXm)&A`5TU&^H}E7&Zg_?dcHeT0HQiDZ*fA4-k@=-S4y8>fsF(Y z=G)N$u7Eoymsumv?B~mx(peo8vE$cJX($LRHxq@_3{KNs!TIxkr&K%3)w5J~*suJ5 zdFBTe<@o-{E+~a{+t_f&BkEGLD1Y^Nxd}+wzGbHzV74_6kX(BEb(nJ(7W-$WX%l-X zqhy<6i|Q7fUnN4JUe)1+NLqF(A-*dRYd?EH2jHwjx2~O!EyyYwrCjf)su^YS@Y?s= z3H!hOCB*k8*&aD=(V-r{>(WJRYD&g176pt=EGGrdD}akqiI*4et4)WHAl0-#Vhv#jga0cAosd5HQxDduq0og|o{ zslpnu*U+L5Tc+Ih=QU}JN!t^n%Ws_jP6LEDK2U{V*6h5m>P5=FvL(+F_t@8Tci%sb@_Bb%eYwc=pXHg~i8WR2eim5ENHo z>OxlEzCEL?YGUEAFQB4!c|@pVexFt(w*s1h?#(O@Kt~6+`KLg%-lY=$tY$PnNa@oO z6+M~)CH*|6dzTzGyEcCHZ@gSS4!T%tAKVj8ivFbi#ysfnHA71{WY^^jU9-=RZiGqA z$-7j9N7jWo78Z0IT%0UWONpp(`C0o;mZ{*5?hRs(>-JBlK9*IEuVq-;ra-l4<^kji ze~R+F*ux4i!~`F;oyeK|(|DMz?R-r-DQ@vH2b*?9+Urz#`uT9^`pKplj|V*WF8wrM zStb6QIJY1{uKgCy(vjoi(+N5R@7$H-*(0O-!gTG&j+454jk0BS0hP}~1h}Is%$~>~CIqX~1_TB05$$gCJ26XQCbLe$LT-FxM@~uePP#aC z&yjzjMwP?WZtgvLe0+RXa{S!Ojv^APUOIHt7U(m6;6aFV!pYgbXvDnEE$qyP`% zv1QfYOPeuY#TK1kjYstQr_Xg--tK;CVfAdEq<5K(jdQEqTfb$tGqW>Sc6z0C8V|lA z2chTKox^>MUWTZrMyEO)^j-nW6w}^3JTiGLPc5AC8lb3GPw8E{8Ek$WRU z1vPZEr0gxITLU+U20872J%W_QS`HC{v%5;*kxC^?K?;=O6cqyL6qhe?~D<|?K zNs;ILm2U%{vPTgm>)4$CPa)xn&n{X-G<3NJbAq@fe2@IpwK}~YDB4EGf{4pE!&M3@ ztXsdEw1h^C)6O$vk%G13Gt4DqETO4oF!V{4H87GjJhGAb17j1h%jFw&Px8sCIr4Xo z@eKlXIoK(Ob$@Sp(2KW^@QOI@(sf|FR^o*GX)2RkB{Xr$5dowzj}nMh7bS~BZu19YRjFR|074^cp>qXfHx1%F6(ESK;)@ZepTEK=9-)?>H zF`S8?^!+J81VeiOkA{B!@a%JH_C@qW3=MQL8(UQt$5L|jFx{y;FiJmhkn}>Bts*cfPBEz6j#0Mr~z1`15y_=v3&)18-a< zB|P1f70pUqlHxP6*V5!&&C7Nx?@P1Z0ctL9_d{H=l*6;nQy+1^Z*HcrWL6zgGTlM; z$yWr(2&ihBOh>tjH=6T(fFYp6lakm`$qNO8NM}*oW|eoc?R)9^$MjhPuSblh%B7?6 z*7rUTR24W7NgQMI;K3PxO~*~)!Fx+W|HDkXW@_ztRsC>{p=NmLup?0v9G&CgYPVjq zF(1T^{L)X7p{J|iorE|((=$FA#nJA(U%wlug?5{z=($MP=4!Qv`5fOGw;{o0ZrG`E zPW0AF( zYUAeCW7z-}w(H3UUlpdzYO%hU(2ABAjvrS15w3GprJgPfg0fGLU&`;Ln)ux5QG(C# zcf*EYsQS5ss3Te&7aA>&YkiJvJDADfGIpsm8JRf!!USwmAvs)HqM_I4nLxx01}SpQ zuMVVaHsyK^XTFGq`+Rli2UT^6Q}!oD9*b$|Fs zlbS!H7E@oH_TAdNK4bE5qoG)*R`;iCihBo3ZKoIaOEx3v0>_i*DW8-nPzepIQCPPiy;pFe3|v{$qE&i8W3MKi^e^~02t z17!{hIiyisbAGJRQto`lDIG4#C+QJOOO^l?L`6kGLq(Jp);^uGsD1Y9sEyh7M{&+P z4#wvevtN^pzc5E6M&2tL7@bL-t;2Q9t<({9+)tIVK+F}Rl{R+2i_obI4L=SDvhE+z zSJJ#<$4U^>{wOUczHzUNe=V=-`-kD!*q0FqHMNm^jSf^0i;wES02R^M&k58Q#!|+n z0~dlmc))FKxUpts+<-3q$F8_wYnyIpUG-^-8Z|bX%n>BCTsXPHG$5y=36aWSc@b~*;Z0}k$_pu`&PU7)6pT!sGQd6%(U-2tzlydR!&Yo z4*69HIj#F9oh~!bjxBY|7>hV9g<%dENX^|AogL6J+5 zySla$t3tP(Cde8tYoD*C+#=U7ot;BYIM!0zLEGHqDuJa78tGsPnt!Hb!X(aB(&MT| zxANz*eGz0`9q6(Dbucu);Z`Bf5>;pLW7S1K$V~M{duJz+GsQ#3!7q;^9whk%JTKOW z7k&ON?1JZIL!P+NooTvX3yo!;zM{D@hmtRR%C%EE71BO#aC=WaRy*(8W^rsMzT(4> zv!{WFWbm9mw}vpSoh>oX_5QS2%jR46YsySJ3m(%w6H^|V)6q<4x?X&&O=rz2ZmlYs zMNo${n}%f#+N3}CJ~dnVP1xKbq0>t-T;{7F6}2!g@ouZU?NFFw=W1>8ltCXk;iCts zV)pAcp@dC!yI>3M%`V?^XQd*`0z`XoE*At zVWsX<*V}*q85vgMcL6f4{2vw9q!dpF2E5@-vDtd7cUKN2gQ{9yb^3TB+11U#vdQK>(x`sK&s8l~Z>>0NJxX&D(; zKMS(D%Gp1C$QU>Eah$X1KItMW(l9jBW2xwJI2w()B|bHPQJdZ!r=}f%5k{M|YxZyu z-v~v>*kebD+S+d69&xyf5?y2^Y-+}EdHbj6=&6qZ5LW(P?ceAp$jmL#>Gsil_(h~b z!!BwSLHy^}GG6}#uVzHTmj(p9Vd8z`tx*%|Hb4f?=~ZW}XmYW>mDzTF-4|wzd8D4k zvo^wIeuv}UD;yNOm?sI1^_oI>hf~F_H~}t<-uwhAN~ICsxFp`ds1%#2(ay2$u7y?s zdPG1`#cHy!>#H#Fi3ds+)Lsaa_3hp!l$XtDfj?*EE=V$P(FY5I)(@nh))})YF5u~-g?>d(zdooaSeDi{`T2%!{=&7N=Ppkf#_`yY zODoQ8rN-3Y-$TW1d49L2^=rCm{3Y$X=Z4PNo%T~7+tfM_UI^H2t`NvGlfnG;`By@` zc!ECI^S1`AK4z3ff<{2eB#T(nJs{wW?_cpmfRoweCBhdgF1Ss>#L{iR9~UcZLr%h- z7}8^4&QC0y_(UylqP}iA9lCP{x6yZyk#KG|%QW4Gof4>nG!13%)V#^~>_y|R`!Ka7 z5;JJ^N9^&gbV@Jp%{ZT9eV;axnvFBGHRDa#c6Gcmr&$`2UHU0*J(;#SIc%2z74tiYBk}EEp48C9$s1{g*cQd(eSciMz#ySR_#^Pp(F$3dQhV6t zc-R+K69%KoR_9jnbXd#UqLU7=4BX=F`aUP_UHTPM$hpNWN~}{maSdjC`fw)CN2WW{ zSk0?~`XyBHZncm|%m(^XZgBe?r9<@kaw2c$B+5O)8%EtUv9sag3<;kN z3m(MR@7Atd(wm#uteBd*lfB(S&*HU91Vc8b?2go~=jCd2o^~`{@2kb~epRGzu|?@U zwm`loTJt=leiD;#vL#X5l2W}+en8A%G%-01t*7+7Z13WFJ?kG2k>J{dm!1!j)Z}1f zbXBl_iu-+7QD_(7yIi{Z8Fr-4Vamj`G`CmMxRE=ZU_2oo1EGM;ghJg;!Xc8RwsYbH zD+keSkaeXa{$ES!D!)acf73x*7JB;D~Vi>2ySR))zcO_s&)M|h)#7tE!IXyu>VuT~&P7*c)IxWDuC zearoJ-E2yuOTR`IJTHA1A@tz2w-BNzjI$L#zKt0|7R)+TxVhC;H#RlDA7uhHOuEC2 zu{a*|_Mc7h-u8k{Gv%r(542=SY_1F>v#v?Rx5Pg8rS7feHjM~`a?d*^D>4A(!`5On ztEc+>IlF8eJzCkm#QbtKsVCz4(SeIwT&Zg0K%2zLz@Jkr{hHFg+{AqR+Wf@bB+50Z zg+5kMO-fiT$ghFr3GYF2>zB0cYh284(=M1HhQ<&JR3pCoyrz3kFP=S(k*AY0?N)IJ zn^RKN?JQ6>)8uhwhBtymsM-Dfz|ios5TXFDvZ3|!!B->x1nN7+*YM7#FTOF4fgmX3O95|#a zx0v(oJ8eGP%oy8Y7Qv+Tn&Q-(%vGso^#wJxWjLCDr)5qC5rgLg?>B>m&Y zmL?caiSBDn36EYn@~K6|!P#BW<)^xc3Um*WZ4-3gJtcu1SVnDsX>_wHp^-8nnfrvr zY}QqTz)&b2o5rW~u_9Yt9_KbtC+X?T%6dxYUcwOF)iCk2-}?$4Y3cT#ezTiKoO{{3 zdH$I)`l9ahI|-VimAlflfRUF!1w(&8?9n%EWHhSekkn#uJKtnp++~jbldF`XjtwOq zglWpU9EA|^?X1cdDz*TT`+E+S7^HT#nGR7XqA6@Te^&i#=A{g+S)5*+#E zp}bUTw;7E0xkMUhjLW6o`7-t<`3V!FB+SmH*kIr3*VLRU9BC9IYvFO-j}%$HOG+3d z*Y0jK%R+S9z!-LX0f|* zC~C1dad*1Hukz-qsD`>IT7i)=FA|><%8BdZ{L!)rA+<+~?FzXJl(dqX$X`TwQL3)Z z#EJo7U~4+ej;4AYz7sN&Q7R)|slmt=%di`GZMSaOmyZ{ZZQttK_X-SnDBM)H{uLZ< zZ@~jLp1TSzgvZ`X>2R_dxQpucu5o4oW8mM{S|V1C3i`4{Bl0AM4Dy2z zWLITMHYV9F3|vZsI~Mhc8N6+iPj$g5MP0p;)vg^B)_Jbp#AQX~Oh3xqwJ<-Ub0RNw zpnrG+#?q}4kJ|`nyP!|U)7QH=?Ha(VWFUQy8SAXzE+rBZ?F!-_v}dj}ULbv?L3 zII;Je4BX?XdumdOA0jSi*qBf?lOFv?3qV&ib`_62I`TUXGC+@3u@SQqzmqZM70@vk zY*AL%r63I#0n?^gVaI<EKQ`H=N^u~x6iivN!3 z@TFj>(~oYZeM$eyr{#kV{-#sm;ahuv&C8GNg!pLdctI%NmZF`qdveG&=SG`l-K5>- z_VZdSx$Af)cI46x7=FultK51f@8Qy z+dqM5c>DLJZW!rf5j{EVOED@Qc{xvGMnkd(TCV3F-c|naq*VpAXj?LW-DfX@u*ivyi2=7PaUzB z&m~7CxO@nYmv?w}sz>b>vvR8cGvBu9jo&WiZgbnxA-%gD2YUYKF|-{lcXb2aI8hAb zvnE$y(nzd)O~XUTo`3JULF2F88cbNNr=S1aM0>_cU4Q>@U|7)3#EsdgsK(|-KAKy! zKNcMzf@H>Jrb&7((yPc<=j;o_1-Q$^lJl!?WoK5;Q&E+};j`(LXr%8)1D5$F1SjN1*5z8E<< z(XFUCsyHV#_qXnh7a!W_ikobFGftD5IyF{}eq71G6bm)FXIbME6 zN1%;G#(Q@3(a)ZYO9YJO>vb+VudPp{rA=OqTM;1AbCIww8(j4}USMBr+7y~UAW)#_#JE}Oh1mTjhzET!rD!Q1cCNY5ua zZ|o%-Zs;>!Rsj!5>`cKpxEJ0)CE=jaehZ+7VL)^w!2E~*Ob5UX_vNiswP->be(qlV zqgwTbp`Xryhe4NkO<6-sE5Dm=4GW~Q6`iG-U$co_Oh`U6zcu1*alU;Y>AoW9JW6(G zto7b?h%UAK{+cD#tlU4qfYIzGp-j=_pYpYR76Vbj-|)-`Ok8B-FY=it$Mt*r%B;Rb z?#30q@uO5Pm@L+JG+y|_K`PXsH{>$!piXXs|nphGA6x=;l}(s;hDFx$D;i? zU0A2jx~SCr<9ogo#^Q_8hjk~^DBi$wNy~av?{9N8K>I;MK4-LdjwT1T%atmwGGUca zF@JJ8HCvmqwZo|3Vz+LTIvDnN1 z#b(0046{!ZqV3 zjQ{nO2De|IBtFsIDqj9+FdiUChm{^tos4nXVqFIHI&!4mNOtG4ax0(Y{kki)XILn6 zDehabdws^ARw&8dkDah7?{_2HuzyJ=JzbM~Ey%RDif&(JzQ6;aE3KpPuO~R#{>Pgt zvTwY4l^4ibK1&H2X961(^P)VZPc)4R3WgeZd! z)2^Z$ZN$0L#d%%!)!84uf1ss9eSb%?Y49VP?c$l+riJS@PKo{!^Rt~Sg8C|tH6LG} z53`-`)DTHe}3vT zrD%g(bGK%-*Oim+1^lg-Q@Vx^YMYJvo>gaI;&#sX&{z5nj16rCtvZLXQKv5O8ZuAl z^Z2QZW_}naL0um@S?!2B+^fVGoZF-3Wttyvc$u28=d>ln%zd>V|6j}1WhjW)e>0zc zvU?$04ZV2@?gu5!fez2A$PFYOxT7A(}? zT5qu2ykuQ$$V07t{7V<6D3|GSB?}!Xr51^8)eL<)pdcmPa9x<8&K_h1cOVtBv7M0n_^9erZ~5TY#o49 z#A_fVF{sO?gK|;YZ7-Kn9yDua@hML|qj37^9^bUnDhho`R2*Yv~pgj(9Fy1Gi+ zKh{d!%ZB|4s9(=`IjBQo>C$e<3r3m|US9-+-iMmX( zaDzU36yN`SST}VR1#RPT532+ButeYa_FiV<6XVd6YnXeaRS^)dHwp+@UUe-^O#79k z>^Ge0eND6sp7kZj^40w+=q{k*IyrB%{P4!GQ(~#SwZ+Ucq#r}m{c{4sUD{tu_;?6X zt5uN%DN`T$S{6>EGwS zt|H>^&rF7EOM^=X4vP!E0{5qrz-rD??ldd0tTK(5(tsURwTutJ#PbtA^{4=u9OZeg z&7OVEPhC=tnmZ$3)f5vmd5F1TrTU^_<@m48ucrRrC;H|?=+>^1Hci~z3?b9r zR+p0M3C&VhnnBI$xy;LOJhL)lhfvx%p$9H@<>QCXXK8FGCrDCY zb+QY0jVW4N7+cCAvMQG0kxp^{rc>3OEl$RLV7XBf%ksC}0)Jsz(sni72LBXm8<(q5 z_HOXxQU?E8^jZ;1Ii{E;u0yy-)&;>o|5Sc4rahoL|BNp3ZG2*CW)>H~c4n}j?C0ud zKiUfLGsh>hwLa9$5nm$#DjX!XEAGJ{YTEKoW-SAm0X!q!)Lxc{D8P&$iu%+t@o5J zQlx{3@^Id6>0LXRw2|hkmA)mMr*FHDvzpGzGZvb$13=_oNXb=bJ>(73ZGYAupg;Mf zpy)(hc+3xo2d%ueDwCZJ(x7CSF8FnRE+SaSbWQ# zQbVkW5qs^?G+|=3#-)BQ*GEaJu02X>riv-`k@l&8I-Ld*%@N&uh2M4}r^51MIc`TZ z)%{+`E-B(P@m$#Z_HniJmNMN%*lxXXaQmr+qrI$IQII(DnvAo;Bf^JH=5*rr@2o3# z9V;{5u*7i9jW?a@I^OVwcV=0Bt0pommZS&7`43mpm%+ zthIjl6Z@x2?w}75aSoO;`Z*uHv{0V;@L@$NWKb-dzPw6lz~0A6N8h#_Ho&tPXaAC4 z7TF(p1KJ_B09Yd!9}_l)bgHB^DZc&DmI9V=yiB*Tn6?yeA!Yyv5;VQe5?>}+iScWg zoEZ(#zPK<3vyRzqP+Xf|TUwd`WT-DrDE;Ayp6+46CMJ_v z8EcOa9kv>PYnci019p9TG3wQT<)_THxg#AQfVE45sD70S1fJW7j8b>&gQ1}@d8m)J zYZupadtjgy;EM0$+B|oWz_@?|7`G|K9Mw-fgYmnsM0N~a1%;q>7)>QIA+IC(n@+8& zjES%3j{IZhJJ&-UV{*r#&S{}S4juk8NRcz$%<^6L0hGO6KfTXW=EE>(i)^LTU$x%W zjOh6pODb8Q#WBv#{N z_p#4`#j}4}!O~Rs z^PO+&qRN(Cw}9 zRFccHrD3qO;U%}(5x0FnwgK=M|9&>4hz72vZ+~^)93ag*PEsM#e*{}|8ap2^8fcv* zO&<%r6MW0vD+8i{q?_DK3JSP?bg;f~dW(wJ&^#iAVZ4^RTfE{;*)WxkjR4pJvh?na z!OY@d+PKba3o>`?&J~>s2cnnHeF@id(xVHXk8!<|Yj;~LZz)h!-?FWB$4vyn1E1U8 z2l&u{tHf0Q$OS+wlRe$;7)hHVj2>vZ6Zq^I5XI!_)h_dZ0txQ7F?Le2YK@>Um?f0D z?zE$sl9FcAyD$liP#{h;^u5WEO5FG(2K~r~H~oph{>+B>8npS?=#oxxDELj|yN{VH zmu9fqE(iTfRjui1ZZV8oYSD7(c`Rn4rgfTx)3RvdLQLM~T-#k06*Yo!fgcqL`rp0Q z?k8)xNK8waB9>8L$3+;t+P)Q1R$=!W2vh71`!(0h%x2|p01lW72$%$N%+vmr8HErp6cc0F)YZKOvv)U?J z6#0iQO_vX0Ka5Mbn*LZ*f!3H3$5XEO%U6HLY*`*Rbxr5hAe) zV{x#@wVpdyacZhxU`WG-2VhuXaI)o)&E0?~EdtR_|FMW;%mdkwCBdt+!j^ZrO z>e!94n(BSG)_^bEY#YlebJ;2p$WfP4{7$&b#C<|n-HZ4TNj0%j;=Q@~qJMbRcvpUQ zM4ADb##3$->Q_%H=$E^|K%ohtS2?vBc*8z3XO{WB78PE&l@9JClww!4Zvpaik%8xZ z3%$;d&m(=B#WoSHNh!yeWx)8{Vpd%UVSDo081tvtV&COd?t)!wFHQFN(`}_3Z$*_* zs);zOAUk7)lY=WFFh(rh>#fZ>o(GH43vu!F@gZYn4oA$~qU9IiET|AxS(XWGY=By`V@29tnnpX-Qy(A8J~4*z#`!41sMbA$W= zpLVPlUn3lUF2uFj9`E7Lb5s1PwYAmr+$W{i6HE|5o$T4X%Td5Vh-n8(bis*&f?jQI zJbitFPAfOo@_gxml~6UdQ-F=-%Jb7w~QISJQM^G!3>8d<{E*kV<{z$@51O9|E`^tbec3OROt4Uoo=9fq+ z3v9uQ3kgjuv?b4sT-~_k+1azG1T3iz!V-Uji4-3bz*A-kp6l>y2hA8=hS;ak?~V+G zUlne^_5|U;cn+wNyrO+oo5B8*F;KRnPfL3O&;+qt!v`#;#6!CTBw!E;RBPbm2J-YG zmkY671V(9{6m~LrFPE0$r7U*F>B9u9*FG6_B-{ zALI28UsX6(80S3sD~$UY=nD(q%L`-0h zVWq1ievQNje1b;`pkwYtRfzv+<(PWT*v!@BZ-qD%S{9RvGh%jA3zKDH^n*6X-<3u` zkMITrhFT7|fYG|pk2;%*hQyRgI78woZ3{7-$YY?(^Quc}6p_FDOM_%%d5zd1RW&A| zzo%m*|HAEgN~rPDy}aeFz_=lsmO9^&l3B+ zMz(#E9YgGqBNl5rvHdtGB;>j{SM;(sS=O3}Q?Qq_>p23+a{aioS;4%^T=ZRfW#g=? z3$32uf;}g;`$I1v6Nh8X&+e`&faF&(X$I);2RezaLU69uP7o$vdbqPyF{q1-F!THIcsUB zed&?=qbS$%Z=XId8TIGXi%2-YRvb4&M;-!!$-!lUdBqe=BmPDLu|e%JPe1v)AOdoZ zUNgk8welj8#tBlzC+GB7{j5DoC5a1o8A0VTX zw@X#>^-gyx-2`rXBr{7}@7tC0LGReO*mi`3Tm%zw+Y?pRG*I!_4j;tQ_}udRR%1;$ z^@iy7xW*xRt)IPqg(HUp^d;zVl6yd;M(6E*H$JYWx_B0)Ux=SR;noA`)4mh0gy$q1 zXjnEzY>$u{U24fz#W5$XR{3pZ;#OE6vzKseW!trCE`7tO`)rDW>4RMWoLpYj)+fb% zIIcfe+~;#E-b&Kr)Y=T9CtqB#I~Z|haA8joulH+fPDCLDh2E37dbNwZ^4EUAzN}*D z0<(kL65lsvy|GIo9AyIj-^iqRUyMHF(y6IGc)`CXe_6z89nZsTdz*`;v4vC~vd6Qj zJ!bTw5SV6nIIRUDS#%X5^JjaY=+FkP+p{xkzs#gxoD2RW|4&Gmk9$-my2 z4wO-bge@<1+Tde3<6(Q5&}xY4&YXNoed3~WRl5(SFsAw>MacOS(_7*jcgqQ%9xy4Q z!$sG^6d_p=Up3KuL;x}oTr8P~(x^Ms6yk^%OM2vJYWLfmp24T4X@0SQ05j)y!mvW6 zkpRK82V{u4ti)&a{fpAho<4g@|H3JFbN`Yx8}V6+jA|k&B#icDdUNCEjrZeBt(CPi z^pD~H_q?R+^MPdNquD1h-+uV)2G@ZP16YABL;ljG(CO&IhOnBoEv7R+da68+%Pe!c z5e@zqXZ%=V3g&;1f}E+m$7N|Pu?-v>T%qV~SBlvyswfr@&{~+HJ1iiApfg{ORFs6l z1;#BX-;TDp#uD9w>b0R1WyWe9wL!y0^nt`~*GdB4m5RX@!vr8{5 zW#~y40T|NHR!=Spot?)de65y8zkCQo=L&4LT-FZw6V_S}P`)j({Pq{w#6Apvchpb4 zj(5Dqt$%LsjGBcz!L1?dsc9l@+-wYzuG%nLvEoD@>)Wo;J~j0226{n8`K6Df`*n|= zz7_jm$t^x;v;W~Lg2a%A=CPvOB*^#cbYj<0z-UTYo9!Ptzduq!;}HF?}6l6uv3?w)uD>2c9DP@zUSVeX^Ift z3enrd%n6sH#_8o!^maLVya018#cG(wt}-T9XTJDK7SNru$&ZcV1a1+E(yxi$`19P; z`C#TJEXF8pU*X6yCqM$iNePkkBsWcFx8)x<8{V0=8`m|1h{fpD=$HZAjZEI${6AU%CU}513(#xphIOiXx*Jenyc6L1$D^h?5m3Dvlv*n{%sEGyz{0a?xLzO7 zkAy&*_^Lz`NGaILyc^7}Mzl5_Y8JcRo1IO;JYEJ>lf=nxp*)os-Al*}G$AN_Dsu8n zEWOV!r@}>NZjQMEnQu)Ajorr+cv}zjAb}ry)MUKVwyx>AF&=j~V|x-@6iIJ=G>VUn zvB+-|Xf4-C`f4;msi5yvBCtlb<4?qV#}n!v&$# zx|coXGmEn%>qoZYnj-z-lU?qCeY2K)$==s|4=~s7Tu<(s*U}UC;M_=dnvsZ&Sn3HF z;O{Q1WdOKL47iNaW-UdjtL-<|y)Di+TC1zDt_^KpHJ$Xr6qSjcUQg#1?UcNLK5aR# zKC(A!ldD_X`thvu1T~PKfR;M({h1mAf*hyJJpPx{R#B|WsD!eU+@bC})@6mrm}EpS z?!PyCWusIYF)pif)+t>%UjcP3zbwEmU&;EbDnK|wIR_?tF%?ex&cNG0b|=Xr7F zkgNBdRLDs>5}Ll)GeHVR@LOAv3nH`C>b}FQYQluWuGF_gbK_~JJigv=oDhpBx6gW? zbU-Yi)l%!Z_60lm!qMVNREd=0=-o6|sctDU*Z@pT_}s*&W+2BR-V20Kirds{rRUapnGz zkmnTnBTyjTz!)56Ja24%sI2m=ZHyuJh11ju=pbiTRXMap{b3fvB{(k)lg6;}p2Zl0 z%1!9q8k*{k4W_=+e}IBiDj+n}5F|F^ycQg=z*W5SknZ*AdOGTB#w~(9S8Y!5D)7~# z7Q?lq_t|0Tc3jwF1K5v|i$7ke;q9+mVjkFmAh6Ped-f@Eb!5DS7rWG(r{b@@~g zEuqGn!{Mme!>t&%^!w6kFW@A880kyT|Ba$^2t!dvPro4H+|;y%tjh{jKv+1^k+>KE zGB(kti2D^&)7=Sl{?$xC3P(k&uMcKAdroio7l7c8VID7AEy$JQMA?j+5Apm%V&u=l zFmV}o_nZEqDaP<&a5z$&PerYDR-6kyS}rax!d(D7lbqww3Ae-NDYN=VlVV&tHb_4O z$N$86EW{ol+B>$pI&rW+6nn=+6rAMmpMjoj?Cg&fo*0h*w7NVs{S)NWNdqaxmI>B@ zssb0rb|s;=L1mnvhajBMb@40jlcT5l^eT`x$NMQK5pX69vvMb2xfeod4@CT3iM5TH zioWXHIiGNKH^{I*HxWqOP`XD#-D11f6uETeyBhB#iX!kUk@r*dsDr7+$%C4Lk!XYN zy40M}|5Mp_#x<3+Z@aqUu8OP;rSDQ#5R{@|XcjcmTO!g?N~8;+g<@1zRGLBrqy>={ zLX$3CWC247QX*0VLI@p6fKVj)PXKq<=l%5N1N=^zIdjk4Q_g)|*PP5RBLeIRf;0qJ z%(>)B%+=y7+tQnF#E0Tr^J*LRJGJ)J9WDO@MAIX;r8ygDrs9p9;~2uRH^vf2;!;;+ z?Y2Ium4?TMhKBB!l#*K8G+!u9ee$q@;%V$!F7IzZJv8;ZaDB07x1O94MpIAg_kO2F zJEu(%`rPOb+MJ+*_JLMqB$ixVO3SA&7qd1`B!T`2UW8w+6?=l|Jlwa)45#{&s@Jz; z&Omv-bnLl0hM-}gqX1&D7MFM>22<*7eh2Rn;4SdH?r;6PxL0$WYy5)%L5@9EXnji~A5(oeqRaTeeuA?l6wW?(_?VW zfDTzoy7CqfomwD%Zxw;m@Q*7kjT+D>Rq$zzfO^R>e-Q2k1GK{oadT;*J8?YyXQx>o zAWqE4t)_<%X8uf_eD#o+T?K$h8reM;yfHiit6=~TgEa_fI5AQ6>mgMay@ijs03e3M znv5`YE1t+z9# z;-hsOuJLvn8V<@xPTa09eX=mi1?P7G0Xd%`0kCohqt8S8x|5 zhk=$cc*WOlNMWgh&@dlZt9<-v^Mf+7mJ*XVst$VyWT4}gZt_Psc|MkR8he8v82V5a zM*alEcRn;fSAJ%GV(#@T;@*$&y=*uVpe^}C7i}rYoCENejJ&@ zN&iK=8w9VFU(W++3&6a}{FzzvKzp(){9`F3%Pb)ge~#|=aBC4mR} zm6;f96WFc%N^-;#Mbzw{fCRl)$C&4_B1rC-&t7~sqweDV!GM!Bw-0py28OTt2tY6Y zVF`R?0|40Hi7+}uGN89{#fJ+4Yt*!Iq}HL=kms=kJ11Rs^ed8H^&d>~;r5|iX&Hb{ zy=59NIet)HO?!|z;VI`u@B(W_$ve#-<6b6nyqO3BUJW5lsl(7WCshI((VCX`M(6oz2 z68NtVhO|606MKFufbeEXvz-mVn$Uj{Ua@T?Rj#y@UCcv`mlhHEEd7RCwD-64vTXp$ ze&#U1I-ABlcIAHa5^*bs&=YMHcvt&_4^$w&d_EtfXV34?MrDV$QQ5q#e^J>30#x>) z+>kCCKve>7TE~E7XdV~o=laLU`|8%6j`N zSH&)#gB+gX;iCik(h~BjbNOW%a`S8s!O=EI)W?c@Rli^e;RL()A2oY9LxWTQaS0nX z^Q{K>nohkN0RHP!l|G*X#7BiB)u8wElrt=jutuXQj7*my1&sO?7GTeWZ7C-V1~V`< zB}kzyI;YkEL42Fhn$^va7OpS+@1!yJm2gf~kjpJD455ea`O~$ddcpgHS^z@ow?&c~t_`e=&2D zk3(C8kW(-=Qvekj>{(uogsu6`YpfRm{)`7v5{UUu1IRpk3@Y#aZPEad(Q3p4l_4cx z@68&k9?K2~=(}F}44_IZ!kPfDM50T!dh7(!Y7~epNFh30VEW!~Fx#jZqk!b#~#d4e|kfS=E1_1--lf|y(57pH1Tf55Ri+1sJk0q6e=0c zA#yG4FogaXvX#r>ow6w(N|<38lb?byrUt3(9n%{^*4KwUy)G(y@*q$ci;FJZ_VSXH zi91l<+FmPyN+l+M`C<>721a;7Z~ZR#3A>Or`10l82{9r3amQig#KOrwp=1Oe=@vDkM#iH`yi96|77Cu zs&Q9u7v_4@a~a_y*+5owE$!E^J|F;iKj*W@X#kjLOG>fki)iXsrb5=5D?-+`B&Aj)Q_+;%S8xE+8KLS=*A|$xm;HhuRBB zs=`OOf%cX?hovh`%0uCs&N%9e{VRho0l1&Aus~j|ZVs!iUkOSqk@m*T@~juL7mDLw zIBC|*-DoNhj#Lq04rb=16k^7LrnFpB1GGII7BrqBIP+kGqVjOzTCIS&cd zU4jQo-^}Y2U7Cjan0bx0!IEs3o3z6%6aekFiLi`!!;al$a)#pn5El!M65)vIvq3&W zJiEJUbV^kG@ED`-b8b{Pojc_J)g%-?E&4Boc4A6m9 z78Hx~)27c?sSo@;?{r;PlV+|SnUvcfDcRf}T)i?OuJ;);iHXq&PkS+EURLD))y2x+ zX@5}L#chs$5vzB2v++g{_)<9w8|>=x`=Lf2onN(g{{lHbX8$}m`c6ZvsI+dZk7JBR zpUbtF%mmGhWTzLVbNMBTHJ>Z8ecbVIz>g{JlO&aN$Ic%zM`dbuKl;!%68hVT!Qb}g zq-y^3ll-+F*?OC1#2J_HAQz^ny=UYzbs>WPCYGwYu)vT%e}dXcSJQUWMK=7+9Y;ji z+)-$snQuKISf}XBn?HLmki}I@HRvkN6|r9PYdy^fP3JF<*!{wYgCg zKv-8<+?S$DEi#qi+Qt4^U^GZc=Mtk3)rwpt(rs1lHOYMo4i@wT*FI)prG?+-b#WtC9#qNjq{onk1@*>IBT$2CXHdye&=4$v?8IXv;yH2 z-~U>?& zGU$cs?IyKv?3qiD-Zi@82rD1<4L| zJ=Ng4mS(=uUD(k@-tOwfRF#!5_ldO=_mYBVgfywqIe98^*kMez`#?Op|9OwQn|3R6 z*o#Fwin=|t6qA;gSK*G-u4FJKJ~sH;b^q=DA$w2Ih2ghq*55uq{8ne0e|NNWbIM6g zc9S_j7@ghk06TxU<$`O;@C3i1=mu=3`jZ=(^$J-}8*E z%`49jD3Y=3qB-;As5$q|vuD&8WKX{!^La;iZEBNpm++;%ThbH~yO1yQC?qG+39&25PgU^K8sqe0bjIJLZUP8F4 zk!5Rr>6t6JEP{3)`i@evxp=s?UuVj$+@EJrjO>t}4* z=vM|j8*dy6nwmCCS~f4EJl!|Y{d$0J%lc~fZYjLn=E<50H9dIPakyr**c|E$CTLAx z-TxGNt-oId(i)vMv`_9irJ`U;BQk{_?Mhk@6)Bk0W+2XwKR6YXcCG0eMoeIhDm0Kt z>08t9^JnfId6jzZJWn%j1Tjn<`kcPIOyxdw7h^{<5Dp3vU195fz zBV6Ez{fFF>4_-L49P9+WGT7B)>ez`EOo6%rA+3q~)<(vJp3bfP8?J zcC>uo=B#ha!##aLlYxS70~TK_YZ}E7tNLld?u^V09cXM#f64*pGD@wzCI_9#i6y2U zZE&>oh2GHNk14;?7~+BsMA67BXyv_6aSx=;B{pEC>Z?x!eY)W*kTtrOwU+19#ad?j z9(%x!pmPn-CS5hn+;p{NCVJxOgoMWKI8FiGUj4|-YZpH0NT6 zsnzxMiGl7lLUXap65rZ%hd=VG{9IqZUvkivjrSch;V^jR?r9-g9XVU80B*z#(G^8; zK4Z^dR*JSth=>#j=%Kl(%q*s^nsT1SWMF08a>VSkYSM$Mg=C#0x@P4U7^mm7JFr4o z73zIUH=FkroP_koE!-^*1lwBKTQ>@pu~#qS)jbM$*sDIZjOkGV5aq8QDCT(P|o<89w+aD&U60 zH|qeJvj;@ES3GOI3+YhCXd`S$qeg{AT;dhe#@OjB8IWfX!xNM5xdSsw|7_Rq9nvu<6P?|XZ8 z&*ODZuhW{b6HIiWm^5OAGNZ2aJPkoa+?}+DT%K!Z4I<@qT^ST6#dt-K_d4q|1O09A zj?v)rIU#Fo=M{Bg?>&FfW+Jv@q~Za8K%R2Pf;wiMG}l)$eob)O*q75_|AhSRG|5LV zJR|mJN`_nC!_ufZaB0T;hm~4ZO#V|f7|*PB#~BQq%creBz_GKb%w^rs#QzZXL*!#b zUjY*NX#w>ILeZTV@}+H6!JRRl)3MU#S3zGyr*xD{w||nrw!Kyjpuayr)@OXxcvC1g zXD&oI%2hV}kseVEwx((bLy|L<9U{tE%n$_ue^piYKw-ZAX|OUi$KLb2<+It&4BX@k zXg)!bCMGAU#bgP|%$)L`YM=FAY3B(zPu?t`Q@O}kxVcbAci0N0pwjw-NtHzOgT_au zBp++0U2|;wamOuV-+3Ruhg!Nm6_2Qk2?+`5Aw^L09F*1E%X)JzfNmLESXgLL?I(Le z#^S@rj|Sil8c}&+oUbEjLx}PiCB0Ci7(1#RM+zT3bN(S62pc6wvm&K1x35bVof`7vm@;|NLIkK=jaURHr|FxK@=g2Q z>|(tnJ1pTOxx?U{=F<+5#wi7{Quv9`bun%ArTyvaSGBuo4-#Es94(S!n-WV-Y#GvK z+n7#MOlFnAkJ2|}aZ<{oP=RbFrKu!4bZ(Y9M^49G&{)IEcD`CcCCxNXQ*sosjr>!HL zjJ!WAMypqEy=_@(`#LH0rD#T1%-G`oM^kjOusvI64FtfbV0mK(xs!+c@Dk4Ro6y$L zMeq1roMepFIc4#9+3nut|V zJs)~}`!ea4|1-Qr7PXuI+0Ii{Ga0y+bI}*i{kD^@zeO<=o)@u`-7_gwyb-qT)Qff} z>75D^(-p^Somv=$NhXracIrT@(#Q}l)=a;^@!M8Hn|p7&((qo%<9eKpJJnE42*uBo z-Nk>e1R?yF<+$yqylYo<_lND2))Lqiqm|)ENH$B<7x?#=?2P+8dtaL>0;^2TwDT|$WEoD-DF-y8D)K)si3X|1N{@bPr$#8iWinTM z61cv%9ou1|)3==tCnz5Pqd-)#6Mj3DHGNjZ5Z+Q60BQeT7o=OjVQ7Wb&BoGy?^t|@ z{u)ZMj|K&2|43;s?Ispc=g#jm(z;F#t}^%2#P(HKit`E%pHcYj!cO8`DNtRDg)m9o z@NOznO|8E0{`Q@uQLShA%PrBWV+Uk9sDUab-*d3CloLbAi&e;zEW&%8Jf}zMgJWv< zzAT0)D@z3(*h;J;3mS=JRJ6T5eZ{SF17>-k34hdUVyKd

S>ho?yM+Qt1zGQWukp+{aEZf%UT?q=Bo}M;3eeBq_!w&x3Xs7bjSTZJ4 z%-acN_3NX{e;f#Hw0NtOV4Wg}`y8}uft;GwOe3xxaCEYGxn5a$`cG~t?6}yV($aocDI6pVoy7M_>$SA zAkAL@hTH>^_^qaMdss<3k$FS1eR+{af1z%jaV+}SiDTUcIQ`U{*RKRwUQ4(pFSl;h z)YK%3f2C!i2Rk0t*wZV0J;-uM1C8H{&)&}Eb){%G29hzeCc`&BQ~-`ZT#YBbU^JuCPk`{A_VTRDro%SYLdy-y~#h2nX6&PZfAgqZ|8 zRZDCY<~~=qU2)9imZK8(gcRPVJ1!<5eiWYZqD3+)v%~q19Y - - Hosted CSS themes for Argo CD - - -

Nothing to see here, move along... - - diff --git a/cluster-config/docs/themes/aws.cluster/custom-cluster.css b/cluster-config/docs/themes/aws.cluster/custom-cluster.css deleted file mode 100644 index c9bafe7..0000000 --- a/cluster-config/docs/themes/aws.cluster/custom-cluster.css +++ /dev/null @@ -1,14 +0,0 @@ -div.columns.small-9.top-bar__left-side { - background: #fefefe; -} -div.columns.top-bar__left-side, -div.top-bar__title.text-truncate.top-bar__right-side { - background: #FF9900; - color: #252F3E; -} -.top-bar__breadcrumbs { - color: #252F3E !important; -} -.top-bar__title { - color: #252F3E !important; -} diff --git a/cluster-config/docs/themes/local.home/custom-cluster.css b/cluster-config/docs/themes/local.home/custom-cluster.css deleted file mode 100644 index 8a4eff3..0000000 --- a/cluster-config/docs/themes/local.home/custom-cluster.css +++ /dev/null @@ -1,14 +0,0 @@ -div.columns.small-9.top-bar__left-side { - background: #fefefe; -} -div.columns.top-bar__left-side, -div.top-bar__title.text-truncate.top-bar__right-side { - background: #0066CC; - color: #fff; -} -.top-bar__breadcrumbs { - color: #fff !important; -} -.top-bar__title { - color: #fff !important; -} diff --git a/cluster-config/docs/themes/local.hub/custom-cluster.css b/cluster-config/docs/themes/local.hub/custom-cluster.css deleted file mode 100644 index 139a2f6..0000000 --- a/cluster-config/docs/themes/local.hub/custom-cluster.css +++ /dev/null @@ -1,14 +0,0 @@ -div.columns.small-9.top-bar__left-side { - background: #fefefe; -} -div.columns.top-bar__left-side, -div.top-bar__title.text-truncate.top-bar__right-side { - background: #3E8635; - color: #fff; -} -.top-bar__breadcrumbs { - color: #fff !important; -} -.top-bar__title { - color: #fff !important; -} diff --git a/cluster-config/docs/themes/rhdp/custom-cluster.css b/cluster-config/docs/themes/rhdp/custom-cluster.css deleted file mode 100644 index d3c23af..0000000 --- a/cluster-config/docs/themes/rhdp/custom-cluster.css +++ /dev/null @@ -1,14 +0,0 @@ -div.columns.small-9.top-bar__left-side { - background: #fefefe; -} -div.columns.top-bar__left-side, -div.top-bar__title.text-truncate.top-bar__right-side { - background: #EE0000; - color: #fff; -} -.top-bar__breadcrumbs { - color: #fff !important; -} -.top-bar__title { - color: #fff !important; -} diff --git a/cluster-config/scripts/validate_manifests.sh b/cluster-config/scripts/validate_manifests.sh deleted file mode 100755 index de7d363..0000000 --- a/cluster-config/scripts/validate_manifests.sh +++ /dev/null @@ -1,88 +0,0 @@ -#!/bin/bash -# shellcheck disable=SC2034,SC2044 - -# DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )" -DIR="$(pwd)" - -function display_help { - echo "./$(basename "$0") [ -d | --directory DIRECTORY ] [ -q | --quiet ] [ -h | --help | --vpc-keypair | --lab | --teardown | --redeploy | --clear-logs ] [ OPTIONAL ANSIBLE OPTIONS ] -Script to validate the manifests generated by Kustomize -Where: - -d | --directory DIRECTORY Base directory containing Kustomize overlays - -e | --enforce-all-schemas Enable enforcement of all schemas - -h | --help Display this help text - -sl | --schema-location Location containing schemas" -} - -which kustomize && KUSTOMIZE_CMD="kustomize build" - -KUSTOMIZE_CMD="${KUSTOMIZE_CMD:-oc kustomize}" -KUSTOMIZE_OPTIONS="--enable-helm" -IGNORE_MISSING_SCHEMAS="--ignore-missing-schemas" -SCHEMA_LOCATION="${DIR}/openshift-json-schema" -KUSTOMIZE_DIRS="${DIR}" -ERROR_COLOR='\033[0;31m' -NO_COLOR='\033[0m' - -for i in "$@" -do - case $i in - -d=* | --directory=* ) - KUSTOMIZE_DIRS="${i#*=}" - shift - ;; - -e | --enforce-all-schemas ) - shift - IGNORE_MISSING_SCHEMAS="" - shift - ;; - -sl=* | --schema-location=* ) - SCHEMA_LOCATION="${i#*=}" - shift - ;; - -h | --help ) - display_help - exit 0 - ;; - esac -done - -errors=0 - -for i in $(find "${KUSTOMIZE_DIRS}" -name "kustomization.yaml" -exec dirname {} \;) -do - echo - echo "Validating $i" - echo - - if [ -f "$i/.skip_validation" ]; then - echo "Skipping validation due to .skip_validation marker file" - continue - fi - - KUSTOMIZE_BUILD_OUTPUT=$(${KUSTOMIZE_CMD} "$i" $KUSTOMIZE_OPTIONS) - - build_response=$? - - if [ $build_response -ne 0 ]; then - >&2 echo -e "${ERROR_COLOR}Error building $i${NO_COLOR}" - errors=$((errors + 1)) - fi - -# echo "$KUSTOMIZE_BUILD_OUTPUT" | kubeval ${IGNORE_MISSING_SCHEMAS} --schema-location="file://${SCHEMA_LOCATION}" --force-color - -# validation_response=$? - -# if [ $validation_response -ne 0 ]; then -# echo "Error validating $i" -# exit 1 -# fi -done - -echo -if [ $errors -ne 0 ]; then - echo -e "${ERROR_COLOR}$errors Errors occurred, see logs${NO_COLOR}" - exit 1 -else - echo "Manifests successfully validated!" -fi diff --git a/cluster-config/tenants/README.md b/cluster-config/tenants/README.md deleted file mode 100644 index d2fa09d..0000000 --- a/cluster-config/tenants/README.md +++ /dev/null @@ -1 +0,0 @@ -WIP, changing to new system diff --git a/cluster-config/tenants/product-catalog/base/github-pipeline-scc-rolebinding.yaml b/cluster-config/tenants/product-catalog/base/github-pipeline-scc-rolebinding.yaml deleted file mode 100644 index c571a91..0000000 --- a/cluster-config/tenants/product-catalog/base/github-pipeline-scc-rolebinding.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: github-pipeline-scc-rolebinding - namespace: product-catalog-cicd -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: pipelines-scc-clusterrole -subjects: -- kind: ServiceAccount - name: github-pipeline diff --git a/cluster-config/tenants/product-catalog/base/kustomization.yaml b/cluster-config/tenants/product-catalog/base/kustomization.yaml deleted file mode 100644 index 9257a79..0000000 --- a/cluster-config/tenants/product-catalog/base/kustomization.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -helmCharts: -- name: tenant - version: 0.3.4 - repo: https://gnunn-gitops.github.io/helm-charts - valuesFile: values.yaml - namespace: gitops - releaseName: product-catalog - -resources: -- ./monitor -- github-pipeline-scc-rolebinding.yaml diff --git a/cluster-config/tenants/product-catalog/base/monitor/kustomization.yaml b/cluster-config/tenants/product-catalog/base/monitor/kustomization.yaml deleted file mode 100644 index 04f4c06..0000000 --- a/cluster-config/tenants/product-catalog/base/monitor/kustomization.yaml +++ /dev/null @@ -1,38 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -namespace: product-catalog-monitor - -resources: -- https://github.com/gnunn1/gitops-catalog/grafana-operator/overlays/user-app -#- github.com/redhat-cop/gitops-catalog/grafana-operator/overlays/user-app - -# Patch in namespace for Argo CD that is managing this namespace -patches: -- patch: |- - - op: add - path: /spec/config/users - value: - default_theme: light - target: - kind: Grafana - name: grafana -- patch: |- - - op: add - path: /subjects/0/namespace - value: product-catalog-monitor - - op: replace - path: /metadata/name - value: cluster-monitoring-view-product-catalog-monitor - target: - group: rbac.authorization.k8s.io - kind: ClusterRoleBinding - name: cluster-monitoring-view -- patch: |- - - op: add - path: /subjects/0/namespace - value: product-catalog-monitor - target: - group: rbac.authorization.k8s.io - kind: RoleBinding - name: grafana-proxy diff --git a/cluster-config/tenants/product-catalog/base/values.yaml b/cluster-config/tenants/product-catalog/base/values.yaml deleted file mode 100644 index 6a69412..0000000 --- a/cluster-config/tenants/product-catalog/base/values.yaml +++ /dev/null @@ -1,71 +0,0 @@ -tenant: product-catalog - -default: - argocd: - cluster: - name: in-cluster - annotations: - app.openshift.io/vcs-uri: https://github.com/gnunn-gitops/product-catalog - app.openshift.io/vcs-ref: main - labels: - argocd.argoproj.io/managed-by: gitops - tenant: product-catalog - networkPolicy: true - rbac: - adminGroups: - - product-catalog-admins - editGroups: - - product-catalog-users - -argocd: - namespace: gitops - sourceRepos: - - '*' - adminGroups: - - product-catalog-admins - userGroups: - - product-catalog-users - pipelineGroups: - - product-catalog-pipeline - -externalSecrets: - tenantClusterSecretStore: doppler-cluster - tenantSecretNamespace: tenant-secrets - -namespaces: - - dev: - quota: medium - annotations: - openshift.io/description: Project for development environment of product catalog application - openshift.io/display-name: Product Catalog Development - - test: - quota: medium - annotations: - openshift.io/description: Project for test environment of product catalog application - openshift.io/display-name: Product Catalog Test - - prod: - quota: medium - annotations: - openshift.io/description: Project for production environment of product catalog application - openshift.io/display-name: Product Catalog Prod - - cicd: - externalSecrets: - tenantTokenKey: TENANT_PRODUCT_CATALOG_DOPPLER_TOKEN - annotations: - openshift.io/description: Project for ci/cd tools for product catalog application - openshift.io/display-name: Product Catalog CI/CD - - gitops: - annotations: - openshift.io/description: Project for gitops tool for product catalog team - openshift.io/display-name: Product Catalog GitOps - - monitor: - annotations: - openshift.io/description: Project for monitoring tools of product catalog application - openshift.io/display-name: Product Catalog Monitor - operatorGroup: true diff --git a/cluster-config/tenants/rollouts-demo/base/analysis-auth-monitoring.yaml b/cluster-config/tenants/rollouts-demo/base/analysis-auth-monitoring.yaml deleted file mode 100644 index b727ea7..0000000 --- a/cluster-config/tenants/rollouts-demo/base/analysis-auth-monitoring.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: analysis-monitoring-view - namespace: rollouts-demo-prod -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: cluster-monitoring-view -subjects: - - kind: ServiceAccount - name: default - namespace: rollouts-demo-prod diff --git a/cluster-config/tenants/rollouts-demo/base/kustomization.yaml b/cluster-config/tenants/rollouts-demo/base/kustomization.yaml deleted file mode 100644 index d1a0cdc..0000000 --- a/cluster-config/tenants/rollouts-demo/base/kustomization.yaml +++ /dev/null @@ -1,13 +0,0 @@ -apiVersion: kustomize.config.k8s.io/v1beta1 -kind: Kustomization - -helmCharts: -- name: tenant - version: 0.3.4 - repo: https://gnunn-gitops.github.io/helm-charts - valuesFile: values.yaml - namespace: gitops - releaseName: product-catalog - -resources: -- analysis-auth-monitoring.yaml diff --git a/cluster-config/tenants/rollouts-demo/base/values.yaml b/cluster-config/tenants/rollouts-demo/base/values.yaml deleted file mode 100644 index 4e1a055..0000000 --- a/cluster-config/tenants/rollouts-demo/base/values.yaml +++ /dev/null @@ -1,54 +0,0 @@ -tenant: rollouts-demo - -default: - argocd: - cluster: - name: in-cluster - labels: - argocd.argoproj.io/managed-by: gitops - tenant: rollouts-demo - networkPolicy: true - rbac: - adminGroups: - - rollouts-demo-admins - editGroups: - - rollouts-demo-users - -argocd: - namespace: gitops - sourceRepos: - - '*' - adminGroups: - - rollouts-demo-admins - userGroups: - - rollouts-demo-users - pipelineGroups: - - rollouts-demo-pipeline - -externalSecrets: - tenantClusterSecretStore: doppler-cluster - tenantSecretNamespace: tenant-secrets - -namespaces: - - dev: - annotations: - openshift.io/description: Project for dev environment of rollouts demo application - openshift.io/display-name: Rollouts Demo Development - - prod: - annotations: - openshift.io/description: Project for prod environment of rollouts demo application - openshift.io/display-name: Rollouts Demo Production - - cicd: - externalSecrets: - tenantTokenKey: TENANT_ROLLOUTS_DEMO_DOPPLER_TOKEN - annotations: - openshift.io/description: Project for ci/cd tools for rollouts demo application - openshift.io/display-name: Rollouts Demo CI/CD - - gitops: - annotations: - openshift.io/description: Project for gitops tool for rollouts demo team - openshift.io/display-name: Rollouts Demo GitOps diff --git a/cluster/acm/acm.yaml b/cluster/acm/acm.yaml new file mode 100644 index 0000000..4b0ab87 --- /dev/null +++ b/cluster/acm/acm.yaml @@ -0,0 +1,33 @@ +--- +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: acm + finalizers: + - resources-finalizer.argocd.argoproj.io + annotations: + argocd.argoproj.io/sync-wave: "5" +spec: + destination: + name: in-cluster + namespace: open-cluster-management + project: default + source: + path: cluster/acm + repoURL: https://github.com/rblundon/homelab.git + targetRevision: HEAD + syncPolicy: + automated: + prune: false + selfHeal: true + syncOptions: + - RespectIgnoreDifferences=true + - CreateNamespace=true + managedNamespaceMetadata: + labels: + argocd.argoproj.io/managed-by: openshift-gitops + ignoreDifferences: + - group: apps + kind: Deployment + jsonPointers: + - /spec/replicas \ No newline at end of file diff --git a/cluster-config/components/oauth/base/kustomization.yaml b/cluster/acm/kustomization.yaml similarity index 78% rename from cluster-config/components/oauth/base/kustomization.yaml rename to cluster/acm/kustomization.yaml index 15fa2c6..aac50a1 100644 --- a/cluster-config/components/oauth/base/kustomization.yaml +++ b/cluster/acm/kustomization.yaml @@ -1,5 +1,6 @@ +--- apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: -- oauth.yaml +- namespace.yaml diff --git a/cluster/acm/multiclusterhub.yaml b/cluster/acm/multiclusterhub.yaml new file mode 100644 index 0000000..cb3a5aa --- /dev/null +++ b/cluster/acm/multiclusterhub.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: operator.open-cluster-management.io/v1 +kind: MultiClusterHub +metadata: + name: multiclusterhub + namespace: open-cluster-management +spec: + imagePullSecret: + name: multiclusterhub-pull-secret diff --git a/cluster/acm/namespace.yaml b/cluster/acm/namespace.yaml new file mode 100644 index 0000000..5642a0c --- /dev/null +++ b/cluster/acm/namespace.yaml @@ -0,0 +1,12 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + labels: + kubernetes.io/metadata.name: open-cluster-management + name: open-cluster-management + argocd.argoproj.io/managed-by: openshift-gitops-operator + name: open-cluster-management +spec: + finalizers: + - kubernetes diff --git a/cluster/acm/operatorconfig.yaml b/cluster/acm/operatorconfig.yaml new file mode 100644 index 0000000..477d971 --- /dev/null +++ b/cluster/acm/operatorconfig.yaml @@ -0,0 +1,25 @@ +apiVersion: operator.external-secrets.io/v1alpha1 +kind: OperatorConfig +metadata: + name: cluster +spec: + prometheus: + enabled: true + service: + port: 8080 + resources: + requests: + cpu: 10m + memory: 96Mi + limits: + cpu: 100m + memory: 256Mi + + +apiVersion: operators.coreos.com/v1 +kind: OperatorGroup +metadata: + name: open-cluster-management +spec: + targetNamespaces: + - open-cluster-management diff --git a/cluster/acm/subscription.yaml b/cluster/acm/subscription.yaml new file mode 100644 index 0000000..c2bec97 --- /dev/null +++ b/cluster/acm/subscription.yaml @@ -0,0 +1,13 @@ +--- +apiVersion: operators.coreos.com/v1alpha1 +kind: Subscription +metadata: + labels: + operators.coreos.com/external-secrets-operator.openshift-operators: '' + name: acm-operator-subscription +spec: + sourceNamespace: openshift-marketplace + source: redhat-operators + channel: release-1.0 + installPlanApproval: Automatic + name: advanced-cluster-management diff --git a/step-by-step.md b/step-by-step.md index 5cb026b..d16d739 100644 --- a/step-by-step.md +++ b/step-by-step.md @@ -5,9 +5,18 @@ This ~~is~~ *will be* the complete walkthrough of the deployment of my homelab. This repo is a mono-repo that is broken up into three sections: - infra-config -- cluster-config +- cluster - apps +May refactor folder structure to: + +- ansible +- argocd + - cluster + - apps + - bootstrap +- terraform + ## Getting Started - On a PC/laptop, clone this git repo diff --git a/acm-hub-bootstrap-old/.gitignore b/tmp/acm-hub-bootstrap-old/.gitignore similarity index 100% rename from acm-hub-bootstrap-old/.gitignore rename to tmp/acm-hub-bootstrap-old/.gitignore diff --git a/acm-hub-bootstrap-old/README.md b/tmp/acm-hub-bootstrap-old/README.md similarity index 100% rename from acm-hub-bootstrap-old/README.md rename to tmp/acm-hub-bootstrap-old/README.md diff --git a/acm-hub-bootstrap-old/bootstrap.sh b/tmp/acm-hub-bootstrap-old/bootstrap.sh similarity index 100% rename from acm-hub-bootstrap-old/bootstrap.sh rename to tmp/acm-hub-bootstrap-old/bootstrap.sh diff --git a/acm-hub-bootstrap-old/bootstrap/install-gitops/README.md b/tmp/acm-hub-bootstrap-old/bootstrap/install-gitops/README.md similarity index 100% rename from acm-hub-bootstrap-old/bootstrap/install-gitops/README.md rename to tmp/acm-hub-bootstrap-old/bootstrap/install-gitops/README.md diff --git a/acm-hub-bootstrap-old/bootstrap/install-gitops/setup.sh b/tmp/acm-hub-bootstrap-old/bootstrap/install-gitops/setup.sh similarity index 100% rename from acm-hub-bootstrap-old/bootstrap/install-gitops/setup.sh rename to tmp/acm-hub-bootstrap-old/bootstrap/install-gitops/setup.sh diff --git a/acm-hub-bootstrap-old/bootstrap/policies/overlays/default/kustomization.yaml b/tmp/acm-hub-bootstrap-old/bootstrap/policies/overlays/default/kustomization.yaml similarity index 100% rename from acm-hub-bootstrap-old/bootstrap/policies/overlays/default/kustomization.yaml rename to tmp/acm-hub-bootstrap-old/bootstrap/policies/overlays/default/kustomization.yaml diff --git a/acm-hub-bootstrap-old/bootstrap/secrets/base/README.md b/tmp/acm-hub-bootstrap-old/bootstrap/secrets/base/README.md similarity index 100% rename from acm-hub-bootstrap-old/bootstrap/secrets/base/README.md rename to tmp/acm-hub-bootstrap-old/bootstrap/secrets/base/README.md diff --git a/acm-hub-bootstrap-old/bootstrap/secrets/base/hub-secrets-namespace.yaml b/tmp/acm-hub-bootstrap-old/bootstrap/secrets/base/hub-secrets-namespace.yaml similarity index 100% rename from acm-hub-bootstrap-old/bootstrap/secrets/base/hub-secrets-namespace.yaml rename to tmp/acm-hub-bootstrap-old/bootstrap/secrets/base/hub-secrets-namespace.yaml diff --git a/acm-hub-bootstrap-old/bootstrap/secrets/base/kustomization.yaml b/tmp/acm-hub-bootstrap-old/bootstrap/secrets/base/kustomization.yaml similarity index 100% rename from acm-hub-bootstrap-old/bootstrap/secrets/base/kustomization.yaml rename to tmp/acm-hub-bootstrap-old/bootstrap/secrets/base/kustomization.yaml diff --git a/acm-hub-bootstrap-old/bootstrap/secrets/base/namespace.yaml b/tmp/acm-hub-bootstrap-old/bootstrap/secrets/base/namespace.yaml similarity index 100% rename from acm-hub-bootstrap-old/bootstrap/secrets/base/namespace.yaml rename to tmp/acm-hub-bootstrap-old/bootstrap/secrets/base/namespace.yaml diff --git a/acm-hub-bootstrap-old/components/apps/acm/overlays/hub/kustomization.yaml b/tmp/acm-hub-bootstrap-old/components/apps/acm/overlays/hub/kustomization.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/apps/acm/overlays/hub/kustomization.yaml rename to tmp/acm-hub-bootstrap-old/components/apps/acm/overlays/hub/kustomization.yaml diff --git a/acm-hub-bootstrap-old/components/apps/acm/overlays/observability/custom-metrics-allowlist.yaml b/tmp/acm-hub-bootstrap-old/components/apps/acm/overlays/observability/custom-metrics-allowlist.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/apps/acm/overlays/observability/custom-metrics-allowlist.yaml rename to tmp/acm-hub-bootstrap-old/components/apps/acm/overlays/observability/custom-metrics-allowlist.yaml diff --git a/acm-hub-bootstrap-old/components/apps/acm/overlays/observability/gitops-dashboard.json b/tmp/acm-hub-bootstrap-old/components/apps/acm/overlays/observability/gitops-dashboard.json similarity index 100% rename from acm-hub-bootstrap-old/components/apps/acm/overlays/observability/gitops-dashboard.json rename to tmp/acm-hub-bootstrap-old/components/apps/acm/overlays/observability/gitops-dashboard.json diff --git a/acm-hub-bootstrap-old/components/apps/acm/overlays/observability/kustomization.yaml b/tmp/acm-hub-bootstrap-old/components/apps/acm/overlays/observability/kustomization.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/apps/acm/overlays/observability/kustomization.yaml rename to tmp/acm-hub-bootstrap-old/components/apps/acm/overlays/observability/kustomization.yaml diff --git a/acm-hub-bootstrap-old/components/clusters/base/kustomization.yaml b/tmp/acm-hub-bootstrap-old/components/clusters/base/kustomization.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/clusters/base/kustomization.yaml rename to tmp/acm-hub-bootstrap-old/components/clusters/base/kustomization.yaml diff --git a/acm-hub-bootstrap-old/components/clusters/base/local-home.yaml b/tmp/acm-hub-bootstrap-old/components/clusters/base/local-home.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/clusters/base/local-home.yaml rename to tmp/acm-hub-bootstrap-old/components/clusters/base/local-home.yaml diff --git a/acm-hub-bootstrap-old/components/clusters/base/local-hub.yaml b/tmp/acm-hub-bootstrap-old/components/clusters/base/local-hub.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/clusters/base/local-hub.yaml rename to tmp/acm-hub-bootstrap-old/components/clusters/base/local-hub.yaml diff --git a/acm-hub-bootstrap-old/components/policies/cert-expiration/base/kustomization.yaml b/tmp/acm-hub-bootstrap-old/components/policies/cert-expiration/base/kustomization.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/cert-expiration/base/kustomization.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/cert-expiration/base/kustomization.yaml diff --git a/acm-hub-bootstrap-old/components/policies/cert-expiration/base/policy-cert-expiration.yaml b/tmp/acm-hub-bootstrap-old/components/policies/cert-expiration/base/policy-cert-expiration.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/cert-expiration/base/policy-cert-expiration.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/cert-expiration/base/policy-cert-expiration.yaml diff --git a/acm-hub-bootstrap-old/components/policies/compliance/base/kustomization.yaml b/tmp/acm-hub-bootstrap-old/components/policies/compliance/base/kustomization.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/compliance/base/kustomization.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/compliance/base/kustomization.yaml diff --git a/acm-hub-bootstrap-old/components/policies/compliance/base/scan-nist-800-53-policy.yaml b/tmp/acm-hub-bootstrap-old/components/policies/compliance/base/scan-nist-800-53-policy.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/compliance/base/scan-nist-800-53-policy.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/compliance/base/scan-nist-800-53-policy.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gatekeeper/config-policy-namespace.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gatekeeper/config-policy-namespace.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gatekeeper/config-policy-namespace.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gatekeeper/config-policy-namespace.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gatekeeper/gatekeeper-exclude-namespaces.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gatekeeper/gatekeeper-exclude-namespaces.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gatekeeper/gatekeeper-exclude-namespaces.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gatekeeper/gatekeeper-exclude-namespaces.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gatekeeper/gatekeeper-install-policy.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gatekeeper/gatekeeper-install-policy.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gatekeeper/gatekeeper-install-policy.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gatekeeper/gatekeeper-install-policy.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/kustomization.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/kustomization.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/kustomization.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/kustomization.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/managedclustersetbinding.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/managedclustersetbinding.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/managedclustersetbinding.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/managedclustersetbinding.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/eso/base/secret-store.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/eso/base/secret-store.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/eso/base/secret-store.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/eso/base/secret-store.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-alerting/base/kustomization.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-alerting/base/kustomization.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-alerting/base/kustomization.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-alerting/base/kustomization.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-alerting/base/prometheus-rules.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-alerting/base/prometheus-rules.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-alerting/base/prometheus-rules.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-alerting/base/prometheus-rules.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-bootstrap/base/bootstrap-app.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-bootstrap/base/bootstrap-app.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-bootstrap/base/bootstrap-app.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-bootstrap/base/bootstrap-app.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-bootstrap/base/bootstrap-appproject.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-bootstrap/base/bootstrap-appproject.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-bootstrap/base/bootstrap-appproject.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-bootstrap/base/bootstrap-appproject.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-bootstrap/base/kustomization.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-bootstrap/base/kustomization.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-bootstrap/base/kustomization.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-bootstrap/base/kustomization.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-instance/base/argocd.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-instance/base/argocd.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-instance/base/argocd.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-instance/base/argocd.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-instance/base/kustomization.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-instance/base/kustomization.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-instance/base/kustomization.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-instance/base/kustomization.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-instance/base/setenv-cmp-plugin-cm.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-instance/base/setenv-cmp-plugin-cm.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-instance/base/setenv-cmp-plugin-cm.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-instance/base/setenv-cmp-plugin-cm.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-notifications/base/kustomization.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-notifications/base/kustomization.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-notifications/base/kustomization.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-notifications/base/kustomization.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-notifications/base/notifications-cm.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-notifications/base/notifications-cm.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-notifications/base/notifications-cm.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-notifications/base/notifications-cm.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-notifications/base/notifications-config.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-notifications/base/notifications-config.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-notifications/base/notifications-config.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-notifications/base/notifications-config.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-secrets/base/argocd-external-secret.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-secrets/base/argocd-external-secret.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-secrets/base/argocd-external-secret.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-secrets/base/argocd-external-secret.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-secrets/base/kustomization.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-secrets/base/kustomization.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-secrets/base/kustomization.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-secrets/base/kustomization.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-secrets/base/notifications-secret.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-secrets/base/notifications-secret.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-secrets/base/notifications-secret.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-secrets/base/notifications-secret.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/cluster-admin-rolebinding.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/cluster-admin-rolebinding.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/cluster-admin-rolebinding.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/cluster-admin-rolebinding.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/gitops-controller-rbac.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/gitops-controller-rbac.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/gitops-controller-rbac.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/gitops-controller-rbac.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/gitops-server-rbac.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/gitops-server-rbac.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/gitops-server-rbac.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/gitops-server-rbac.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/kustomization.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/kustomization.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/kustomization.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/kustomization.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/namespace.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/namespace.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/namespace.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/namespace.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/sub-namespace.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/sub-namespace.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/sub-namespace.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/sub-namespace.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/sub-operatorgroup.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/sub-operatorgroup.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/sub-operatorgroup.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/sub-operatorgroup.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/subscription.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/subscription.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/subscription.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/manifests/gitops-subscription/base/subscription.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/placement.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/placement.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/placement.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/placement.yaml diff --git a/acm-hub-bootstrap-old/components/policies/gitops/base/policy-generator-config.yaml b/tmp/acm-hub-bootstrap-old/components/policies/gitops/base/policy-generator-config.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/gitops/base/policy-generator-config.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/gitops/base/policy-generator-config.yaml diff --git a/acm-hub-bootstrap-old/components/policies/opa/gatekeeper-probes-livenessnotset.yaml b/tmp/acm-hub-bootstrap-old/components/policies/opa/gatekeeper-probes-livenessnotset.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/opa/gatekeeper-probes-livenessnotset.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/opa/gatekeeper-probes-livenessnotset.yaml diff --git a/acm-hub-bootstrap-old/components/policies/opa/gatekeeper-probes-readinessnotset.yaml b/tmp/acm-hub-bootstrap-old/components/policies/opa/gatekeeper-probes-readinessnotset.yaml similarity index 100% rename from acm-hub-bootstrap-old/components/policies/opa/gatekeeper-probes-readinessnotset.yaml rename to tmp/acm-hub-bootstrap-old/components/policies/opa/gatekeeper-probes-readinessnotset.yaml diff --git a/acm-hub-bootstrap/.ansible-lint b/tmp/acm-hub-bootstrap/.ansible-lint similarity index 100% rename from acm-hub-bootstrap/.ansible-lint rename to tmp/acm-hub-bootstrap/.ansible-lint diff --git a/acm-hub-bootstrap/.github/dependabot.yml b/tmp/acm-hub-bootstrap/.github/dependabot.yml similarity index 100% rename from acm-hub-bootstrap/.github/dependabot.yml rename to tmp/acm-hub-bootstrap/.github/dependabot.yml diff --git a/acm-hub-bootstrap/.github/linters/.gitleaks.toml b/tmp/acm-hub-bootstrap/.github/linters/.gitleaks.toml similarity index 100% rename from acm-hub-bootstrap/.github/linters/.gitleaks.toml rename to tmp/acm-hub-bootstrap/.github/linters/.gitleaks.toml diff --git a/acm-hub-bootstrap/.github/linters/.markdown-lint.yml b/tmp/acm-hub-bootstrap/.github/linters/.markdown-lint.yml similarity index 100% rename from acm-hub-bootstrap/.github/linters/.markdown-lint.yml rename to tmp/acm-hub-bootstrap/.github/linters/.markdown-lint.yml diff --git a/acm-hub-bootstrap/.github/workflows/ansible-lint.yml b/tmp/acm-hub-bootstrap/.github/workflows/ansible-lint.yml similarity index 100% rename from acm-hub-bootstrap/.github/workflows/ansible-lint.yml rename to tmp/acm-hub-bootstrap/.github/workflows/ansible-lint.yml diff --git a/acm-hub-bootstrap/.github/workflows/jsonschema.yaml b/tmp/acm-hub-bootstrap/.github/workflows/jsonschema.yaml similarity index 100% rename from acm-hub-bootstrap/.github/workflows/jsonschema.yaml rename to tmp/acm-hub-bootstrap/.github/workflows/jsonschema.yaml diff --git a/acm-hub-bootstrap/.github/workflows/superlinter.yml b/tmp/acm-hub-bootstrap/.github/workflows/superlinter.yml similarity index 100% rename from acm-hub-bootstrap/.github/workflows/superlinter.yml rename to tmp/acm-hub-bootstrap/.github/workflows/superlinter.yml diff --git a/acm-hub-bootstrap/.github/workflows/update-metadata.yml b/tmp/acm-hub-bootstrap/.github/workflows/update-metadata.yml similarity index 100% rename from acm-hub-bootstrap/.github/workflows/update-metadata.yml rename to tmp/acm-hub-bootstrap/.github/workflows/update-metadata.yml diff --git a/acm-hub-bootstrap/.gitignore b/tmp/acm-hub-bootstrap/.gitignore similarity index 100% rename from acm-hub-bootstrap/.gitignore rename to tmp/acm-hub-bootstrap/.gitignore diff --git a/acm-hub-bootstrap/.gitleaks.toml b/tmp/acm-hub-bootstrap/.gitleaks.toml similarity index 100% rename from acm-hub-bootstrap/.gitleaks.toml rename to tmp/acm-hub-bootstrap/.gitleaks.toml diff --git a/acm-hub-bootstrap/LICENSE b/tmp/acm-hub-bootstrap/LICENSE similarity index 100% rename from acm-hub-bootstrap/LICENSE rename to tmp/acm-hub-bootstrap/LICENSE diff --git a/acm-hub-bootstrap/Makefile b/tmp/acm-hub-bootstrap/Makefile similarity index 100% rename from acm-hub-bootstrap/Makefile rename to tmp/acm-hub-bootstrap/Makefile diff --git a/acm-hub-bootstrap/README.md b/tmp/acm-hub-bootstrap/README.md similarity index 100% rename from acm-hub-bootstrap/README.md rename to tmp/acm-hub-bootstrap/README.md diff --git a/acm-hub-bootstrap/ansible.cfg b/tmp/acm-hub-bootstrap/ansible.cfg similarity index 100% rename from acm-hub-bootstrap/ansible.cfg rename to tmp/acm-hub-bootstrap/ansible.cfg diff --git a/acm-hub-bootstrap/ansible/site.yaml b/tmp/acm-hub-bootstrap/ansible/site.yaml similarity index 100% rename from acm-hub-bootstrap/ansible/site.yaml rename to tmp/acm-hub-bootstrap/ansible/site.yaml diff --git a/acm-hub-bootstrap/charts/all/config-demo/Chart.yaml b/tmp/acm-hub-bootstrap/charts/all/config-demo/Chart.yaml similarity index 100% rename from acm-hub-bootstrap/charts/all/config-demo/Chart.yaml rename to tmp/acm-hub-bootstrap/charts/all/config-demo/Chart.yaml diff --git a/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-cm.yaml b/tmp/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-cm.yaml similarity index 100% rename from acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-cm.yaml rename to tmp/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-cm.yaml diff --git a/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-deployment.yaml b/tmp/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-deployment.yaml similarity index 100% rename from acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-deployment.yaml rename to tmp/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-deployment.yaml diff --git a/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-external-secret.yaml b/tmp/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-external-secret.yaml similarity index 100% rename from acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-external-secret.yaml rename to tmp/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-external-secret.yaml diff --git a/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-is.yaml b/tmp/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-is.yaml similarity index 100% rename from acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-is.yaml rename to tmp/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-is.yaml diff --git a/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-route.yaml b/tmp/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-route.yaml similarity index 100% rename from acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-route.yaml rename to tmp/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-route.yaml diff --git a/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-svc.yaml b/tmp/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-svc.yaml similarity index 100% rename from acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-svc.yaml rename to tmp/acm-hub-bootstrap/charts/all/config-demo/templates/config-demo-svc.yaml diff --git a/acm-hub-bootstrap/charts/all/config-demo/values.yaml b/tmp/acm-hub-bootstrap/charts/all/config-demo/values.yaml similarity index 100% rename from acm-hub-bootstrap/charts/all/config-demo/values.yaml rename to tmp/acm-hub-bootstrap/charts/all/config-demo/values.yaml diff --git a/acm-hub-bootstrap/charts/all/hello-world/Chart.yaml b/tmp/acm-hub-bootstrap/charts/all/hello-world/Chart.yaml similarity index 100% rename from acm-hub-bootstrap/charts/all/hello-world/Chart.yaml rename to tmp/acm-hub-bootstrap/charts/all/hello-world/Chart.yaml diff --git a/acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-cm.yaml b/tmp/acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-cm.yaml similarity index 100% rename from acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-cm.yaml rename to tmp/acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-cm.yaml diff --git a/acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-deployment.yaml b/tmp/acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-deployment.yaml similarity index 100% rename from acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-deployment.yaml rename to tmp/acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-deployment.yaml diff --git a/acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-route.yaml b/tmp/acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-route.yaml similarity index 100% rename from acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-route.yaml rename to tmp/acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-route.yaml diff --git a/acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-svc.yaml b/tmp/acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-svc.yaml similarity index 100% rename from acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-svc.yaml rename to tmp/acm-hub-bootstrap/charts/all/hello-world/templates/hello-world-svc.yaml diff --git a/acm-hub-bootstrap/charts/all/hello-world/values.yaml b/tmp/acm-hub-bootstrap/charts/all/hello-world/values.yaml similarity index 100% rename from acm-hub-bootstrap/charts/all/hello-world/values.yaml rename to tmp/acm-hub-bootstrap/charts/all/hello-world/values.yaml diff --git a/acm-hub-bootstrap/charts/region/.keep b/tmp/acm-hub-bootstrap/charts/region/.keep similarity index 100% rename from acm-hub-bootstrap/charts/region/.keep rename to tmp/acm-hub-bootstrap/charts/region/.keep diff --git a/acm-hub-bootstrap/common/.ansible-lint b/tmp/acm-hub-bootstrap/common/.ansible-lint similarity index 100% rename from acm-hub-bootstrap/common/.ansible-lint rename to tmp/acm-hub-bootstrap/common/.ansible-lint diff --git a/acm-hub-bootstrap/common/.github/dependabot.yml b/tmp/acm-hub-bootstrap/common/.github/dependabot.yml similarity index 100% rename from acm-hub-bootstrap/common/.github/dependabot.yml rename to tmp/acm-hub-bootstrap/common/.github/dependabot.yml diff --git a/acm-hub-bootstrap/common/.github/linters/.gitleaks.toml b/tmp/acm-hub-bootstrap/common/.github/linters/.gitleaks.toml similarity index 100% rename from acm-hub-bootstrap/common/.github/linters/.gitleaks.toml rename to tmp/acm-hub-bootstrap/common/.github/linters/.gitleaks.toml diff --git a/acm-hub-bootstrap/common/.github/linters/.markdown-lint.yml b/tmp/acm-hub-bootstrap/common/.github/linters/.markdown-lint.yml similarity index 100% rename from acm-hub-bootstrap/common/.github/linters/.markdown-lint.yml rename to tmp/acm-hub-bootstrap/common/.github/linters/.markdown-lint.yml diff --git a/acm-hub-bootstrap/common/.github/workflows/pattern-sh-ci.yml b/tmp/acm-hub-bootstrap/common/.github/workflows/pattern-sh-ci.yml similarity index 100% rename from acm-hub-bootstrap/common/.github/workflows/pattern-sh-ci.yml rename to tmp/acm-hub-bootstrap/common/.github/workflows/pattern-sh-ci.yml diff --git a/acm-hub-bootstrap/common/.github/workflows/superlinter.yml b/tmp/acm-hub-bootstrap/common/.github/workflows/superlinter.yml similarity index 100% rename from acm-hub-bootstrap/common/.github/workflows/superlinter.yml rename to tmp/acm-hub-bootstrap/common/.github/workflows/superlinter.yml diff --git a/acm-hub-bootstrap/common/.gitignore b/tmp/acm-hub-bootstrap/common/.gitignore similarity index 100% rename from acm-hub-bootstrap/common/.gitignore rename to tmp/acm-hub-bootstrap/common/.gitignore diff --git a/acm-hub-bootstrap/common/.gitleaks.toml b/tmp/acm-hub-bootstrap/common/.gitleaks.toml similarity index 100% rename from acm-hub-bootstrap/common/.gitleaks.toml rename to tmp/acm-hub-bootstrap/common/.gitleaks.toml diff --git a/acm-hub-bootstrap/common/Changes.md b/tmp/acm-hub-bootstrap/common/Changes.md similarity index 100% rename from acm-hub-bootstrap/common/Changes.md rename to tmp/acm-hub-bootstrap/common/Changes.md diff --git a/acm-hub-bootstrap/common/LICENSE b/tmp/acm-hub-bootstrap/common/LICENSE similarity index 100% rename from acm-hub-bootstrap/common/LICENSE rename to tmp/acm-hub-bootstrap/common/LICENSE diff --git a/acm-hub-bootstrap/common/Makefile b/tmp/acm-hub-bootstrap/common/Makefile similarity index 100% rename from acm-hub-bootstrap/common/Makefile rename to tmp/acm-hub-bootstrap/common/Makefile diff --git a/acm-hub-bootstrap/common/README.md b/tmp/acm-hub-bootstrap/common/README.md similarity index 100% rename from acm-hub-bootstrap/common/README.md rename to tmp/acm-hub-bootstrap/common/README.md diff --git a/acm-hub-bootstrap/common/requirements.yml b/tmp/acm-hub-bootstrap/common/requirements.yml similarity index 100% rename from acm-hub-bootstrap/common/requirements.yml rename to tmp/acm-hub-bootstrap/common/requirements.yml diff --git a/acm-hub-bootstrap/common/scripts/deploy-pattern.sh b/tmp/acm-hub-bootstrap/common/scripts/deploy-pattern.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/deploy-pattern.sh rename to tmp/acm-hub-bootstrap/common/scripts/deploy-pattern.sh diff --git a/acm-hub-bootstrap/common/scripts/determine-main-clustergroup.sh b/tmp/acm-hub-bootstrap/common/scripts/determine-main-clustergroup.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/determine-main-clustergroup.sh rename to tmp/acm-hub-bootstrap/common/scripts/determine-main-clustergroup.sh diff --git a/acm-hub-bootstrap/common/scripts/determine-pattern-name.sh b/tmp/acm-hub-bootstrap/common/scripts/determine-pattern-name.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/determine-pattern-name.sh rename to tmp/acm-hub-bootstrap/common/scripts/determine-pattern-name.sh diff --git a/acm-hub-bootstrap/common/scripts/determine-secretstore-backend.sh b/tmp/acm-hub-bootstrap/common/scripts/determine-secretstore-backend.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/determine-secretstore-backend.sh rename to tmp/acm-hub-bootstrap/common/scripts/determine-secretstore-backend.sh diff --git a/acm-hub-bootstrap/common/scripts/display-secrets-info.sh b/tmp/acm-hub-bootstrap/common/scripts/display-secrets-info.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/display-secrets-info.sh rename to tmp/acm-hub-bootstrap/common/scripts/display-secrets-info.sh diff --git a/acm-hub-bootstrap/common/scripts/load-k8s-secrets.sh b/tmp/acm-hub-bootstrap/common/scripts/load-k8s-secrets.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/load-k8s-secrets.sh rename to tmp/acm-hub-bootstrap/common/scripts/load-k8s-secrets.sh diff --git a/acm-hub-bootstrap/common/scripts/make-common-subtree.sh b/tmp/acm-hub-bootstrap/common/scripts/make-common-subtree.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/make-common-subtree.sh rename to tmp/acm-hub-bootstrap/common/scripts/make-common-subtree.sh diff --git a/acm-hub-bootstrap/common/scripts/manage-secret-app.sh b/tmp/acm-hub-bootstrap/common/scripts/manage-secret-app.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/manage-secret-app.sh rename to tmp/acm-hub-bootstrap/common/scripts/manage-secret-app.sh diff --git a/acm-hub-bootstrap/common/scripts/manage-secret-namespace.sh b/tmp/acm-hub-bootstrap/common/scripts/manage-secret-namespace.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/manage-secret-namespace.sh rename to tmp/acm-hub-bootstrap/common/scripts/manage-secret-namespace.sh diff --git a/acm-hub-bootstrap/common/scripts/pattern-util.sh b/tmp/acm-hub-bootstrap/common/scripts/pattern-util.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/pattern-util.sh rename to tmp/acm-hub-bootstrap/common/scripts/pattern-util.sh diff --git a/acm-hub-bootstrap/common/scripts/preview-all.sh b/tmp/acm-hub-bootstrap/common/scripts/preview-all.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/preview-all.sh rename to tmp/acm-hub-bootstrap/common/scripts/preview-all.sh diff --git a/acm-hub-bootstrap/common/scripts/preview.sh b/tmp/acm-hub-bootstrap/common/scripts/preview.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/preview.sh rename to tmp/acm-hub-bootstrap/common/scripts/preview.sh diff --git a/acm-hub-bootstrap/common/scripts/process-secrets.sh b/tmp/acm-hub-bootstrap/common/scripts/process-secrets.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/process-secrets.sh rename to tmp/acm-hub-bootstrap/common/scripts/process-secrets.sh diff --git a/acm-hub-bootstrap/common/scripts/set-secret-backend.sh b/tmp/acm-hub-bootstrap/common/scripts/set-secret-backend.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/set-secret-backend.sh rename to tmp/acm-hub-bootstrap/common/scripts/set-secret-backend.sh diff --git a/acm-hub-bootstrap/common/scripts/vault-utils.sh b/tmp/acm-hub-bootstrap/common/scripts/vault-utils.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/vault-utils.sh rename to tmp/acm-hub-bootstrap/common/scripts/vault-utils.sh diff --git a/acm-hub-bootstrap/common/scripts/write-token-kubeconfig.sh b/tmp/acm-hub-bootstrap/common/scripts/write-token-kubeconfig.sh similarity index 100% rename from acm-hub-bootstrap/common/scripts/write-token-kubeconfig.sh rename to tmp/acm-hub-bootstrap/common/scripts/write-token-kubeconfig.sh diff --git a/acm-hub-bootstrap/overrides/values-AWS.yaml b/tmp/acm-hub-bootstrap/overrides/values-AWS.yaml similarity index 100% rename from acm-hub-bootstrap/overrides/values-AWS.yaml rename to tmp/acm-hub-bootstrap/overrides/values-AWS.yaml diff --git a/acm-hub-bootstrap/overrides/values-IBMCloud.yaml b/tmp/acm-hub-bootstrap/overrides/values-IBMCloud.yaml similarity index 100% rename from acm-hub-bootstrap/overrides/values-IBMCloud.yaml rename to tmp/acm-hub-bootstrap/overrides/values-IBMCloud.yaml diff --git a/acm-hub-bootstrap/pattern-metadata.yaml b/tmp/acm-hub-bootstrap/pattern-metadata.yaml similarity index 100% rename from acm-hub-bootstrap/pattern-metadata.yaml rename to tmp/acm-hub-bootstrap/pattern-metadata.yaml diff --git a/acm-hub-bootstrap/pattern.sh b/tmp/acm-hub-bootstrap/pattern.sh similarity index 100% rename from acm-hub-bootstrap/pattern.sh rename to tmp/acm-hub-bootstrap/pattern.sh diff --git a/acm-hub-bootstrap/tests/interop/README.md b/tmp/acm-hub-bootstrap/tests/interop/README.md similarity index 100% rename from acm-hub-bootstrap/tests/interop/README.md rename to tmp/acm-hub-bootstrap/tests/interop/README.md diff --git a/acm-hub-bootstrap/tests/interop/__init__.py b/tmp/acm-hub-bootstrap/tests/interop/__init__.py similarity index 100% rename from acm-hub-bootstrap/tests/interop/__init__.py rename to tmp/acm-hub-bootstrap/tests/interop/__init__.py diff --git a/acm-hub-bootstrap/tests/interop/conftest.py b/tmp/acm-hub-bootstrap/tests/interop/conftest.py similarity index 100% rename from acm-hub-bootstrap/tests/interop/conftest.py rename to tmp/acm-hub-bootstrap/tests/interop/conftest.py diff --git a/acm-hub-bootstrap/tests/interop/create_ci_badge.py b/tmp/acm-hub-bootstrap/tests/interop/create_ci_badge.py similarity index 100% rename from acm-hub-bootstrap/tests/interop/create_ci_badge.py rename to tmp/acm-hub-bootstrap/tests/interop/create_ci_badge.py diff --git a/acm-hub-bootstrap/tests/interop/requirements.txt b/tmp/acm-hub-bootstrap/tests/interop/requirements.txt similarity index 100% rename from acm-hub-bootstrap/tests/interop/requirements.txt rename to tmp/acm-hub-bootstrap/tests/interop/requirements.txt diff --git a/acm-hub-bootstrap/tests/interop/run_tests.sh b/tmp/acm-hub-bootstrap/tests/interop/run_tests.sh similarity index 100% rename from acm-hub-bootstrap/tests/interop/run_tests.sh rename to tmp/acm-hub-bootstrap/tests/interop/run_tests.sh diff --git a/acm-hub-bootstrap/tests/interop/test_modify_web_content.py b/tmp/acm-hub-bootstrap/tests/interop/test_modify_web_content.py similarity index 100% rename from acm-hub-bootstrap/tests/interop/test_modify_web_content.py rename to tmp/acm-hub-bootstrap/tests/interop/test_modify_web_content.py diff --git a/acm-hub-bootstrap/tests/interop/test_subscription_status_edge.py b/tmp/acm-hub-bootstrap/tests/interop/test_subscription_status_edge.py similarity index 100% rename from acm-hub-bootstrap/tests/interop/test_subscription_status_edge.py rename to tmp/acm-hub-bootstrap/tests/interop/test_subscription_status_edge.py diff --git a/acm-hub-bootstrap/tests/interop/test_subscription_status_hub.py b/tmp/acm-hub-bootstrap/tests/interop/test_subscription_status_hub.py similarity index 100% rename from acm-hub-bootstrap/tests/interop/test_subscription_status_hub.py rename to tmp/acm-hub-bootstrap/tests/interop/test_subscription_status_hub.py diff --git a/acm-hub-bootstrap/tests/interop/test_validate_edge_site_components.py b/tmp/acm-hub-bootstrap/tests/interop/test_validate_edge_site_components.py similarity index 100% rename from acm-hub-bootstrap/tests/interop/test_validate_edge_site_components.py rename to tmp/acm-hub-bootstrap/tests/interop/test_validate_edge_site_components.py diff --git a/acm-hub-bootstrap/tests/interop/test_validate_hub_site_components.py b/tmp/acm-hub-bootstrap/tests/interop/test_validate_hub_site_components.py similarity index 100% rename from acm-hub-bootstrap/tests/interop/test_validate_hub_site_components.py rename to tmp/acm-hub-bootstrap/tests/interop/test_validate_hub_site_components.py diff --git a/acm-hub-bootstrap/values-4.18-hub.yaml b/tmp/acm-hub-bootstrap/values-4.18-hub.yaml similarity index 100% rename from acm-hub-bootstrap/values-4.18-hub.yaml rename to tmp/acm-hub-bootstrap/values-4.18-hub.yaml diff --git a/acm-hub-bootstrap/values-global.yaml b/tmp/acm-hub-bootstrap/values-global.yaml similarity index 100% rename from acm-hub-bootstrap/values-global.yaml rename to tmp/acm-hub-bootstrap/values-global.yaml diff --git a/acm-hub-bootstrap/values-group-one.yaml b/tmp/acm-hub-bootstrap/values-group-one.yaml similarity index 100% rename from acm-hub-bootstrap/values-group-one.yaml rename to tmp/acm-hub-bootstrap/values-group-one.yaml diff --git a/acm-hub-bootstrap/values-hub.yaml b/tmp/acm-hub-bootstrap/values-hub.yaml similarity index 100% rename from acm-hub-bootstrap/values-hub.yaml rename to tmp/acm-hub-bootstrap/values-hub.yaml diff --git a/acm-hub-bootstrap/values-standalone.yaml b/tmp/acm-hub-bootstrap/values-standalone.yaml similarity index 100% rename from acm-hub-bootstrap/values-standalone.yaml rename to tmp/acm-hub-bootstrap/values-standalone.yaml