From a48a9c5f13f04bbfdc5d626f60fd4ed4cc397c31 Mon Sep 17 00:00:00 2001 From: Vishwanath S Date: Tue, 8 Aug 2023 22:11:18 +0530 Subject: [PATCH] Move few community packs to private repo (#31) --- .../charts/minio.orig/.helmignore | 23 - .../minio-8.0.10/charts/minio.orig/Chart.yaml | 16 - .../minio-8.0.10/charts/minio.orig/README.md | 414 ------------------ .../minio.orig/ci/distributed-values.yaml | 1 - .../charts/minio.orig/minio/.helmignore | 23 - .../charts/minio.orig/minio/Chart.yaml | 16 - .../charts/minio.orig/minio/README.md | 414 ------------------ .../minio/ci/distributed-values.yaml | 1 - .../minio.orig/minio/templates/NOTES.txt | 47 -- .../minio/templates/_helper_create_bucket.txt | 111 ----- .../minio.orig/minio/templates/_helpers.tpl | 182 -------- .../minio/templates/clusterroles.yaml | 20 - .../minio.orig/minio/templates/configmap.yaml | 12 - .../minio/templates/deployment.yaml | 203 --------- .../minio.orig/minio/templates/ingress.yaml | 45 -- .../minio/templates/networkpolicy.yaml | 25 -- .../minio/templates/poddisruptionbudget.yaml | 13 - .../post-install-create-bucket-job.yaml | 87 ---- .../post-install-prometheus-metrics-job.yaml | 135 ------ .../post-install-prometheus-metrics-role.yaml | 38 -- ...nstall-prometheus-metrics-rolebinding.yaml | 20 - ...all-prometheus-metrics-serviceaccount.yaml | 12 - .../minio.orig/minio/templates/pvc.yaml | 35 -- .../minio/templates/rolebindings.yaml | 20 - .../minio.orig/minio/templates/secrets.yaml | 32 -- .../templates/securitycontextconstraints.yaml | 46 -- .../minio.orig/minio/templates/service.yaml | 47 -- .../minio/templates/serviceaccount.yaml | 11 - .../minio/templates/servicemonitor.yaml | 44 -- .../minio/templates/statefulset.yaml | 174 -------- .../charts/minio.orig/minio/values.yaml | 347 --------------- .../charts/minio.orig/templates/NOTES.txt | 47 -- .../templates/_helper_create_bucket.txt | 111 ----- .../charts/minio.orig/templates/_helpers.tpl | 182 -------- .../minio.orig/templates/clusterroles.yaml | 20 - .../minio.orig/templates/configmap.yaml | 12 - .../minio.orig/templates/deployment.yaml | 203 --------- .../charts/minio.orig/templates/ingress.yaml | 45 -- .../minio.orig/templates/networkpolicy.yaml | 25 -- .../templates/poddisruptionbudget.yaml | 13 - .../post-install-create-bucket-job.yaml | 87 ---- .../post-install-prometheus-metrics-job.yaml | 135 ------ .../post-install-prometheus-metrics-role.yaml | 38 -- ...nstall-prometheus-metrics-rolebinding.yaml | 20 - ...all-prometheus-metrics-serviceaccount.yaml | 12 - .../charts/minio.orig/templates/pvc.yaml | 35 -- .../minio.orig/templates/rolebindings.yaml | 20 - .../charts/minio.orig/templates/secrets.yaml | 32 -- .../templates/securitycontextconstraints.yaml | 46 -- .../charts/minio.orig/templates/service.yaml | 47 -- .../minio.orig/templates/serviceaccount.yaml | 11 - .../minio.orig/templates/servicemonitor.yaml | 44 -- .../minio.orig/templates/statefulset.yaml | 174 -------- .../charts/minio.orig/values.yaml | 347 --------------- packs/minio-8.0.10/charts/minio.tgz | Bin 40066 -> 0 bytes packs/minio-8.0.10/charts/minio/.helmignore | 23 - packs/minio-8.0.10/charts/minio/Chart.yaml | 16 - packs/minio-8.0.10/charts/minio/README.md | 414 ------------------ .../charts/minio/ci/distributed-values.yaml | 1 - .../charts/minio/minio/.helmignore | 23 - .../charts/minio/minio/Chart.yaml | 16 - .../minio-8.0.10/charts/minio/minio/README.md | 414 ------------------ .../minio/minio/ci/distributed-values.yaml | 1 - .../charts/minio/minio/templates/NOTES.txt | 47 -- .../minio/templates/_helper_create_bucket.txt | 111 ----- .../charts/minio/minio/templates/_helpers.tpl | 182 -------- .../minio/minio/templates/clusterroles.yaml | 20 - .../minio/minio/templates/configmap.yaml | 12 - .../minio/minio/templates/deployment.yaml | 203 --------- .../charts/minio/minio/templates/ingress.yaml | 45 -- .../minio/minio/templates/networkpolicy.yaml | 25 -- .../minio/templates/poddisruptionbudget.yaml | 13 - .../post-install-create-bucket-job.yaml | 87 ---- .../post-install-prometheus-metrics-job.yaml | 135 ------ .../post-install-prometheus-metrics-role.yaml | 38 -- ...nstall-prometheus-metrics-rolebinding.yaml | 20 - ...all-prometheus-metrics-serviceaccount.yaml | 12 - .../charts/minio/minio/templates/pvc.yaml | 35 -- .../minio/minio/templates/rolebindings.yaml | 20 - .../charts/minio/minio/templates/secrets.yaml | 32 -- .../templates/securitycontextconstraints.yaml | 46 -- .../charts/minio/minio/templates/service.yaml | 47 -- .../minio/minio/templates/serviceaccount.yaml | 11 - .../minio/minio/templates/servicemonitor.yaml | 44 -- .../minio/minio/templates/statefulset.yaml | 174 -------- .../charts/minio/minio/values.yaml | 347 --------------- .../charts/minio/templates/NOTES.txt | 47 -- .../minio/templates/_helper_create_bucket.txt | 111 ----- .../charts/minio/templates/_helpers.tpl | 182 -------- .../charts/minio/templates/clusterroles.yaml | 20 - .../charts/minio/templates/configmap.yaml | 12 - .../charts/minio/templates/deployment.yaml | 203 --------- .../charts/minio/templates/ingress.yaml | 45 -- .../charts/minio/templates/networkpolicy.yaml | 25 -- .../minio/templates/poddisruptionbudget.yaml | 13 - .../post-install-create-bucket-job.yaml | 87 ---- .../post-install-prometheus-metrics-job.yaml | 135 ------ .../post-install-prometheus-metrics-role.yaml | 38 -- ...nstall-prometheus-metrics-rolebinding.yaml | 20 - ...all-prometheus-metrics-serviceaccount.yaml | 12 - .../charts/minio/templates/pvc.yaml | 35 -- .../charts/minio/templates/rolebindings.yaml | 20 - .../charts/minio/templates/secrets.yaml | 32 -- .../templates/securitycontextconstraints.yaml | 46 -- .../charts/minio/templates/service.yaml | 47 -- .../minio/templates/serviceaccount.yaml | 11 - .../minio/templates/servicemonitor.yaml | 44 -- .../charts/minio/templates/statefulset.yaml | 174 -------- packs/minio-8.0.10/charts/minio/values.yaml | 347 --------------- packs/minio-8.0.10/logo.png | Bin 4313 -> 0 bytes packs/minio-8.0.10/pack.json | 18 - packs/minio-8.0.10/presets.yaml | 59 --- packs/minio-8.0.10/schema.yaml | 5 - packs/minio-8.0.10/values.yaml | 358 --------------- .../charts/opsportal-0.9.5.tgz | Bin 10937 -> 0 bytes .../charts/opsportal-0.9.5.tgz.orig | Bin 10945 -> 0 bytes .../charts/opsportal/Chart.yaml | 12 - .../opsportal/charts/kommander-ui/Chart.yaml | 8 - .../kommander-ui/templates/_helpers.tpl | 46 -- .../kommander-ui/templates/deployment.yaml | 137 ------ .../kommander-ui/templates/hooks-roles.yaml | 14 - .../kommander-ui/templates/ingress.yaml | 26 -- .../charts/kommander-ui/templates/roles.yaml | 120 ----- .../kommander-ui/templates/service.yaml | 21 - .../templates/serviceaccount.yaml | 11 - .../opsportal/charts/kommander-ui/values.yaml | 77 ---- .../charts/opsportal/requirements.lock | 6 - .../charts/opsportal/requirements.yaml | 5 - .../charts/opsportal/templates/_helperts.tpl | 32 -- .../opsportal/templates/hooks-roles.yaml | 57 --- .../opsportal/templates/hooks-secrets.yaml | 64 --- .../ingress-opsportal-rolebinding.yaml | 18 - .../templates/ingress-opsportal-roles.yaml | 67 --- .../opsportal/templates/kibana-roles.yaml | 67 --- .../charts/opsportal/templates/landing.yaml | 116 ----- .../charts/opsportal/values.yaml | 57 --- packs/opsportal-0.9.5/logo.png | Bin 30207 -> 0 bytes packs/opsportal-0.9.5/pack.json | 17 - packs/opsportal-0.9.5/values.yaml | 59 --- packs/triliovault-2.9.1/NOTES.txt | 2 - .../charts/k8s-triliovault-operator-2.9.1.tgz | Bin 95926 -> 0 bytes packs/triliovault-2.9.1/logo.png | Bin 2133 -> 0 bytes packs/triliovault-2.9.1/pack.json | 31 -- packs/triliovault-2.9.1/schema.yaml | 8 - packs/triliovault-2.9.1/values.yaml | 134 ------ 145 files changed, 10292 deletions(-) delete mode 100644 packs/minio-8.0.10/charts/minio.orig/.helmignore delete mode 100644 packs/minio-8.0.10/charts/minio.orig/Chart.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/README.md delete mode 100644 packs/minio-8.0.10/charts/minio.orig/ci/distributed-values.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/.helmignore delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/Chart.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/README.md delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/ci/distributed-values.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/NOTES.txt delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/_helper_create_bucket.txt delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/_helpers.tpl delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/clusterroles.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/configmap.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/deployment.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/ingress.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/networkpolicy.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/poddisruptionbudget.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-create-bucket-job.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-job.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-role.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-rolebinding.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-serviceaccount.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/pvc.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/rolebindings.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/secrets.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/securitycontextconstraints.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/service.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/serviceaccount.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/servicemonitor.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/templates/statefulset.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/minio/values.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/NOTES.txt delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/_helper_create_bucket.txt delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/_helpers.tpl delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/clusterroles.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/configmap.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/deployment.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/ingress.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/networkpolicy.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/poddisruptionbudget.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/post-install-create-bucket-job.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-job.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-role.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-rolebinding.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-serviceaccount.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/pvc.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/rolebindings.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/secrets.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/securitycontextconstraints.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/service.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/serviceaccount.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/servicemonitor.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/templates/statefulset.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.orig/values.yaml delete mode 100644 packs/minio-8.0.10/charts/minio.tgz delete mode 100644 packs/minio-8.0.10/charts/minio/.helmignore delete mode 100644 packs/minio-8.0.10/charts/minio/Chart.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/README.md delete mode 100644 packs/minio-8.0.10/charts/minio/ci/distributed-values.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/.helmignore delete mode 100644 packs/minio-8.0.10/charts/minio/minio/Chart.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/README.md delete mode 100644 packs/minio-8.0.10/charts/minio/minio/ci/distributed-values.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/NOTES.txt delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/_helper_create_bucket.txt delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/_helpers.tpl delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/clusterroles.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/configmap.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/deployment.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/ingress.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/networkpolicy.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/poddisruptionbudget.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/post-install-create-bucket-job.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-job.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-role.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-rolebinding.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-serviceaccount.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/pvc.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/rolebindings.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/secrets.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/securitycontextconstraints.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/service.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/serviceaccount.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/servicemonitor.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/templates/statefulset.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/minio/values.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/NOTES.txt delete mode 100644 packs/minio-8.0.10/charts/minio/templates/_helper_create_bucket.txt delete mode 100644 packs/minio-8.0.10/charts/minio/templates/_helpers.tpl delete mode 100644 packs/minio-8.0.10/charts/minio/templates/clusterroles.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/configmap.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/deployment.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/ingress.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/networkpolicy.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/poddisruptionbudget.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/post-install-create-bucket-job.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-job.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-role.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-rolebinding.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-serviceaccount.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/pvc.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/rolebindings.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/secrets.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/securitycontextconstraints.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/service.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/serviceaccount.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/servicemonitor.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/templates/statefulset.yaml delete mode 100644 packs/minio-8.0.10/charts/minio/values.yaml delete mode 100644 packs/minio-8.0.10/logo.png delete mode 100644 packs/minio-8.0.10/pack.json delete mode 100644 packs/minio-8.0.10/presets.yaml delete mode 100644 packs/minio-8.0.10/schema.yaml delete mode 100644 packs/minio-8.0.10/values.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal-0.9.5.tgz delete mode 100644 packs/opsportal-0.9.5/charts/opsportal-0.9.5.tgz.orig delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/Chart.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/charts/kommander-ui/Chart.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/charts/kommander-ui/templates/_helpers.tpl delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/charts/kommander-ui/templates/deployment.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/charts/kommander-ui/templates/hooks-roles.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/charts/kommander-ui/templates/ingress.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/charts/kommander-ui/templates/roles.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/charts/kommander-ui/templates/service.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/charts/kommander-ui/templates/serviceaccount.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/charts/kommander-ui/values.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/requirements.lock delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/requirements.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/templates/_helperts.tpl delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/templates/hooks-roles.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/templates/hooks-secrets.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/templates/ingress-opsportal-rolebinding.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/templates/ingress-opsportal-roles.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/templates/kibana-roles.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/templates/landing.yaml delete mode 100644 packs/opsportal-0.9.5/charts/opsportal/values.yaml delete mode 100644 packs/opsportal-0.9.5/logo.png delete mode 100644 packs/opsportal-0.9.5/pack.json delete mode 100644 packs/opsportal-0.9.5/values.yaml delete mode 100644 packs/triliovault-2.9.1/NOTES.txt delete mode 100644 packs/triliovault-2.9.1/charts/k8s-triliovault-operator-2.9.1.tgz delete mode 100644 packs/triliovault-2.9.1/logo.png delete mode 100644 packs/triliovault-2.9.1/pack.json delete mode 100644 packs/triliovault-2.9.1/schema.yaml delete mode 100644 packs/triliovault-2.9.1/values.yaml diff --git a/packs/minio-8.0.10/charts/minio.orig/.helmignore b/packs/minio-8.0.10/charts/minio.orig/.helmignore deleted file mode 100644 index a9fe7278..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -# OWNERS file for Kubernetes -OWNERS \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio.orig/Chart.yaml b/packs/minio-8.0.10/charts/minio.orig/Chart.yaml deleted file mode 100644 index 80ad23fa..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/Chart.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1 -appVersion: master -description: High Performance, Kubernetes Native Object Storage -home: https://min.io -icon: https://min.io/resources/img/logo/MINIO_wordmark.png -keywords: -- storage -- object-storage -- S3 -maintainers: -- email: dev@minio.io - name: MinIO, Inc -name: minio -sources: -- https://github.com/minio/minio -version: 8.0.9 diff --git a/packs/minio-8.0.10/charts/minio.orig/README.md b/packs/minio-8.0.10/charts/minio.orig/README.md deleted file mode 100644 index 30a7c6b8..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/README.md +++ /dev/null @@ -1,414 +0,0 @@ -> NOTE: This helm chart is in code freeze i.e we will only update MinIO releases occastionally by bumping up the version. For latest features you are advised to start using our [MinIO operator](https://github.com/minio/operator). - -MinIO -===== - -[MinIO](https://min.io) is a High Performance Object Storage released under Apache License v2.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads. - -MinIO supports [distributed mode](https://docs.minio.io/docs/distributed-minio-quickstart-guide). In distributed mode, you can pool multiple drives (even on different machines) into a single object storage server. - -For more detailed documentation please visit [here](https://docs.minio.io/) - -Introduction ------------- - -This chart bootstraps MinIO deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. - -Prerequisites -------------- - -- Kubernetes 1.4+ with Beta APIs enabled for default standalone mode. -- Kubernetes 1.5+ with Beta APIs enabled to run MinIO in [distributed mode](#distributed-minio). -- PV provisioner support in the underlying infrastructure. - -Configure MinIO Helm repo --------------------- -```bash -$ helm repo add minio https://helm.min.io/ -``` - -Installing the Chart --------------------- - -Install this chart using: - -```bash -$ helm install --namespace minio --generate-name minio/minio -``` - -The command deploys MinIO on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. - -### Release name - -An instance of a chart running in a Kubernetes cluster is called a release. Each release is identified by a unique name within the cluster. Helm automatically assigns a unique release name after installing the chart. You can also set your preferred name by: - -```bash -$ helm install my-release minio/minio -``` - -### Access and Secret keys - -By default a pre-generated access and secret key will be used. To override the default keys, pass the access and secret keys as arguments to helm install. - -```bash -$ helm install --set accessKey=myaccesskey,secretKey=mysecretkey --generate-name minio/minio -``` - -### Updating MinIO configuration via Helm - -[ConfigMap](https://kubernetes.io/docs/user-guide/configmap/) allows injecting containers with configuration data even while a Helm release is deployed. - -To update your MinIO server configuration while it is deployed in a release, you need to - -1. Check all the configurable values in the MinIO chart using `helm inspect values minio/minio`. -2. Override the `minio_server_config` settings in a YAML formatted file, and then pass that file like this `helm upgrade -f config.yaml minio/minio`. -3. Restart the MinIO server(s) for the changes to take effect. - -You can also check the history of upgrades to a release using `helm history my-release`. Replace `my-release` with the actual release name. - -### Installing certificates from third party CAs - -MinIO can connect to other servers, including MinIO nodes or other server types such as NATs and Redis. If these servers use certificates that were not registered with a known CA, add trust for these certificates to MinIO Server by bundling these certificates into a Kubernetes secret and providing it to Helm via the `trustedCertsSecret` value. If `.Values.tls.enabled` is `true` and you're installing certificates for third party CAs, remember to include Minio's own certificate with key `public.crt`, if it also needs to be trusted. - -For instance, given that TLS is enabled and you need to add trust for Minio's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`: - -``` -kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt -``` - -If TLS is not enabled, you would need only the third party CA: - -``` -kubectl -n minio create secret generic minio-trusted-certs --from-file=keycloak.crt -``` - -The name of the generated secret can then be passed to Helm using a values file or the `--set` parameter: - -``` -trustedCertsSecret: "minio-trusted-certs" - -or - ---set trustedCertsSecret=minio-trusted-certs -``` - -Uninstalling the Chart ----------------------- - -Assuming your release is named as `my-release`, delete it using the command: - -```bash -$ helm delete my-release -``` - -or - -```bash -$ helm uninstall my-release -``` - -The command removes all the Kubernetes components associated with the chart and deletes the release. - -Upgrading the Chart -------------------- - -You can use Helm to update MinIO version in a live release. Assuming your release is named as `my-release`, get the values using the command: - -```bash -$ helm get values my-release > old_values.yaml -``` - -Then change the field `image.tag` in `old_values.yaml` file with MinIO image tag you want to use. Now update the chart using - -```bash -$ helm upgrade -f old_values.yaml my-release minio/minio -``` - -Default upgrade strategies are specified in the `values.yaml` file. Update these fields if you'd like to use a different strategy. - -Configuration -------------- - -The following table lists the configurable parameters of the MinIO chart and their default values. - -| Parameter | Description | Default | -|:-------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------| -| `nameOverride` | Provide a name in place of `minio` | `""` | -| `fullnameOverride` | Provide a name to substitute for the full names of resources | `""` | -| `image.repository` | Image repository | `minio/minio` | -| `image.tag` | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/). | `RELEASE.2020-11-06T23-17-07Z` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `imagePullSecrets` | List of container registry secrets | `[]` | -| `mcImage.repository` | Client image repository | `minio/mc` | -| `mcImage.tag` | mc image tag. Possible values listed [here](https://hub.docker.com/r/minio/mc/tags/). | `RELEASE.2020-10-03T02-54-56Z` | -| `mcImage.pullPolicy` | mc Image pull policy | `IfNotPresent` | -| `ingress.enabled` | Enables Ingress | `false` | -| `ingress.labels ` | Ingress labels | `{}` | -| `ingress.annotations` | Ingress annotations | `{}` | -| `ingress.hosts` | Ingress accepted hostnames | `[]` | -| `ingress.tls` | Ingress TLS configuration | `[]` | -| `trustedCertsSecret` | Kubernetes secret with trusted certificates to be mounted on `{{ .Values.certsPath }}/CAs` | `""` | -| `mode` | MinIO server mode (`standalone` or `distributed`) | `standalone` | -| `extraArgs` | Additional command line arguments to pass to the MinIO server | `[]` | -| `replicas` | Number of nodes (applicable only for MinIO distributed mode). | `4` | -| `zones` | Number of zones (applicable only for MinIO distributed mode). | `1` | -| `drivesPerNode` | Number of drives per node (applicable only for MinIO distributed mode). | `1` | -| `existingSecret` | Name of existing secret with access and secret key. | `""` | -| `accessKey` | Default access key (5 to 20 characters) | random 20 chars | -| `secretKey` | Default secret key (8 to 40 characters) | random 40 chars | -| `certsPath` | Default certs path location | `/etc/minio/certs` | -| `configPathmc` | Default config file location for MinIO client - mc | `/etc/minio/mc` | -| `mountPath` | Default mount location for persistent drive | `/export` | -| `bucketRoot` | Directory from where minio should serve buckets. | Value of `.mountPath` | -| `clusterDomain` | domain name of kubernetes cluster where pod is running. | `cluster.local` | -| `service.type` | Kubernetes service type | `ClusterIP` | -| `service.port` | Kubernetes port where service is exposed | `9000` | -| `service.externalIPs` | service external IP addresses | `nil` | -| `service.annotations` | Service annotations | `{}` | -| `serviceAccount.create` | Toggle creation of new service account | `true` | -| `serviceAccount.name` | Name of service account to create and/or use | `""` | -| `persistence.enabled` | Use persistent volume to store data | `true` | -| `persistence.size` | Size of persistent volume claim | `500Gi` | -| `persistence.existingClaim` | Use an existing PVC to persist data | `nil` | -| `persistence.storageClass` | Storage class name of PVC | `nil` | -| `persistence.accessMode` | ReadWriteOnce or ReadOnly | `ReadWriteOnce` | -| `persistence.subPath` | Mount a sub directory of the persistent volume if set | `""` | -| `resources.requests.memory` | Memory resource requests | Memory: `4Gi` | -| `priorityClassName` | Pod priority settings | `""` | -| `securityContext.enabled` | Enable to run containers as non-root. NOTE: if `persistence.enabled=false` then securityContext will be automatically disabled | `true` | -| `securityContext.runAsUser` | User id of the user for the container | `1000` | -| `securityContext.runAsGroup` | Group id of the user for the container | `1000` | -| `securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | -| `nodeSelector` | Node labels for pod assignment | `{}` | -| `affinity` | Affinity settings for pod assignment | `{}` | -| `tolerations` | Toleration labels for pod assignment | `[]` | -| `podAnnotations` | Pod annotations | `{}` | -| `podLabels` | Pod Labels | `{}` | -| `tls.enabled` | Enable TLS for MinIO server | `false` | -| `tls.certSecret` | Kubernetes Secret with `public.crt` and `private.key` files. | `""` | -| `defaultBucket.enabled` | If set to true, a bucket will be created after MinIO install | `false` | -| `defaultBucket.name` | Bucket name | `bucket` | -| `defaultBucket.policy` | Bucket policy | `none` | -| `defaultBucket.purge` | Purge the bucket if already exists | `false` | -| `defaultBucket.versioning` | Enable / Suspend versioning for bucket | `nil` | -| `buckets` | List of buckets to create after MinIO install | `[]` | -| `makeBucketJob.annotations` | Additional annotations for the Kubernetes Batch (make-bucket-job) | `""` | -| `makeBucketJob.podAnnotations` | Additional annotations for the pods of the Kubernetes Batch (make-bucket-job) | `""` | -| `makeBucketJob.securityContext.enabled` | Enable to run Kubernetes Batch (make-bucket-job) containers as non-root. | `false` | -| `makeBucketJob.securityContext.runAsUser` | User id of the user for the container | `1000` | -| `makeBucketJob.securityContext.runAsGroup` | Group id of the user for the container | `1000` | -| `makeBucketJob.securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | -| `makeBucketJob.resources.requests.memory` | Memory resource requests for 'make bucket' job | `128Mi` | -| `updatePrometheusJob.podAnnotations` | Additional annotations for the pods of the Kubernetes Batch (update-prometheus-secret) | `""` | -| `updatePrometheusJob.securityContext.enabled` | Enable to run Kubernetes Batch (update-prometheus-secret) containers as non-root. | `false` | -| `updatePrometheusJob.securityContext.runAsUser` | User id of the user for the container | `1000` | -| `updatePrometheusJob.securityContext.runAsGroup` | Group id of the user for the container | `1000` | -| `updatePrometheusJob.securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | -| `s3gateway.enabled` | Use MinIO as a [s3 gateway](https://github.com/minio/minio/blob/master/docs/gateway/s3.md) | `false` | -| `s3gateway.replicas` | Number of s3 gateway instances to run in parallel | `4` | -| `s3gateway.serviceEndpoint` | Endpoint to the S3 compatible service | `""` | -| `s3gateway.accessKey` | Access key of S3 compatible service | `""` | -| `s3gateway.secretKey` | Secret key of S3 compatible service | `""` | -| `azuregateway.enabled` | Use MinIO as an [azure gateway](https://docs.minio.io/docs/minio-gateway-for-azure) | `false` | -| `azuregateway.replicas` | Number of azure gateway instances to run in parallel | `4` | -| `gcsgateway.enabled` | Use MinIO as a [Google Cloud Storage gateway](https://docs.minio.io/docs/minio-gateway-for-gcs) | `false` | -| `gcsgateway.gcsKeyJson` | credential json file of service account key | `""` | -| `gcsgateway.projectId` | Google cloud project id | `""` | -| `nasgateway.enabled` | Use MinIO as a [NAS gateway](https://docs.MinIO.io/docs/minio-gateway-for-nas) | `false` | -| `nasgateway.replicas` | Number of NAS gateway instances to be run in parallel on a PV | `4` | -| `environment` | Set MinIO server relevant environment variables in `values.yaml` file. MinIO containers will be passed these variables when they start. | `MINIO_STORAGE_CLASS_STANDARD: EC:4"` | -| `metrics.serviceMonitor.enabled` | Set this to `true` to create ServiceMonitor for Prometheus operator | `false` | -| `metrics.serviceMonitor.additionalLabels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` | -| `metrics.serviceMonitor.namespace` | Optional namespace in which to create ServiceMonitor | `nil` | -| `metrics.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `nil` | -| `metrics.serviceMonitor.scrapeTimeout` | Scrape timeout. If not set, the Prometheus default scrape timeout is used | `nil` | -| `metrics.serviceMonitor.relabelConfigs` | Relabel configs that can be used on Endpoints | `{}` | -| `etcd.endpoints` | Endpoints of etcd | `[]` | -| `etcd.pathPrefix` | Prefix for all etcd keys | `""` | -| `etcd.corednsPathPrefix` | Prefix for all CoreDNS etcd keys | `""` | -| `etcd.clientCert` | Certificate used for SSL/TLS connections to etcd [(etcd Security)](https://etcd.io/docs/latest/op-guide/security/) | `""` | -| `etcd.clientCertKey` | Key for the certificate [(etcd Security)](https://etcd.io/docs/latest/op-guide/security/) | `""` | - -Some of the parameters above map to the env variables defined in the [MinIO DockerHub image](https://hub.docker.com/r/minio/minio/). - -You can specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, - -```bash -$ helm install --name my-release --set persistence.size=1Ti minio/minio -``` - -The above command deploys MinIO server with a 1Ti backing persistent volume. - -Alternately, you can provide a YAML file that specifies parameter values while installing the chart. For example, - -```bash -$ helm install --name my-release -f values.yaml minio/minio -``` - -> **Tip**: You can use the default [values.yaml](minio/values.yaml) - -Distributed MinIO ------------ - -This chart provisions a MinIO server in standalone mode, by default. To provision MinIO server in [distributed mode](https://docs.minio.io/docs/distributed-minio-quickstart-guide), set the `mode` field to `distributed`, - -```bash -$ helm install --set mode=distributed minio/minio -``` - -This provisions MinIO server in distributed mode with 4 nodes. To change the number of nodes in your distributed MinIO server, set the `replicas` field, - -```bash -$ helm install --set mode=distributed,replicas=8 minio/minio -``` - -This provisions MinIO server in distributed mode with 8 nodes. Note that the `replicas` value should be a minimum value of 4, there is no limit on number of servers you can run. - -You can also expand an existing deployment by adding new zones, following command will create a total of 16 nodes with each zone running 8 nodes. - -```bash -$ helm install --set mode=distributed,replicas=8,zones=2 minio/minio -``` - -### StatefulSet [limitations](http://kubernetes.io/docs/concepts/abstractions/controllers/statefulsets/#limitations) applicable to distributed MinIO - -1. StatefulSets need persistent storage, so the `persistence.enabled` flag is ignored when `mode` is set to `distributed`. -2. When uninstalling a distributed MinIO release, you'll need to manually delete volumes associated with the StatefulSet. - -NAS Gateway ------------ - -### Prerequisites - -MinIO in [NAS gateway mode](https://docs.minio.io/docs/minio-gateway-for-nas) can be used to create multiple MinIO instances backed by single PV in `ReadWriteMany` mode. Currently few [Kubernetes volume plugins](https://kubernetes.io/docs/user-guide/persistent-volumes/#access-modes) support `ReadWriteMany` mode. To deploy MinIO NAS gateway with Helm chart you'll need to have a Persistent Volume running with one of the supported volume plugins. [This document](https://kubernetes.io/docs/user-guide/volumes/#nfs) -outlines steps to create a NFS PV in Kubernetes cluster. - -### Provision NAS Gateway MinIO instances - -To provision MinIO servers in [NAS gateway mode](https://docs.minio.io/docs/minio-gateway-for-nas), set the `nasgateway.enabled` field to `true`, - -```bash -$ helm install --set nasgateway.enabled=true minio/minio -``` - -This provisions 4 MinIO NAS gateway instances backed by single storage. To change the number of instances in your MinIO deployment, set the `replicas` field, - -```bash -$ helm install --set nasgateway.enabled=true,nasgateway.replicas=8 minio/minio -``` - -This provisions MinIO NAS gateway with 8 instances. - -Persistence ------------ - -This chart provisions a PersistentVolumeClaim and mounts corresponding persistent volume to default location `/export`. You'll need physical storage available in the Kubernetes cluster for this to work. If you'd rather use `emptyDir`, disable PersistentVolumeClaim by: - -```bash -$ helm install --set persistence.enabled=false minio/minio -``` - -> *"An emptyDir volume is first created when a Pod is assigned to a Node, and exists as long as that Pod is running on that node. When a Pod is removed from a node for any reason, the data in the emptyDir is deleted forever."* - -Existing PersistentVolumeClaim ------------------------------- - -If a Persistent Volume Claim already exists, specify it during installation. - -1. Create the PersistentVolume -2. Create the PersistentVolumeClaim -3. Install the chart - -```bash -$ helm install --set persistence.existingClaim=PVC_NAME minio/minio -``` - -NetworkPolicy -------------- - -To enable network policy for MinIO, -install [a networking plugin that implements the Kubernetes -NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), -and set `networkPolicy.enabled` to `true`. - -For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting -the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace: - - kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" - -With NetworkPolicy enabled, traffic will be limited to just port 9000. - -For more precise policy, set `networkPolicy.allowExternal=true`. This will -only allow pods with the generated client label to connect to MinIO. -This label will be displayed in the output of a successful install. - -Existing secret ---------------- - -Instead of having this chart create the secret for you, you can supply a preexisting secret, much -like an existing PersistentVolumeClaim. - -First, create the secret: -```bash -$ kubectl create secret generic my-minio-secret --from-literal=accesskey=foobarbaz --from-literal=secretkey=foobarbazqux -``` - -Then install the chart, specifying that you want to use an existing secret: -```bash -$ helm install --set existingSecret=my-minio-secret minio/minio -``` - -The following fields are expected in the secret: - -| .data. in Secret | Corresponding variable | Description | -|:---------------------------|:------------------------|:----------------------------------------------------------------------------------| -| `accesskey` | `accessKey` | Access key ID. Mandatory. | -| `secretkey` | `secretKey` | Secret key. Mandatory. | -| `gcs_key.json` | `gcsgateway.gcsKeyJson` | GCS key if you are using the GCS gateway feature. Optional | -| `awsAccessKeyId` | `s3gateway.accessKey` | S3 access key if you are using the S3 gateway feature. Optional | -| `awsSecretAccessKey` | `s3gateway.secretKey` | S3 secret key if you are using the S3 gateway feature. Optional | -| `etcd_client_cert.pem` | `etcd.clientCert` | Certificate for SSL/TLS connections to etcd. Optional | -| `etcd_client_cert_key.pem` | `etcd.clientCertKey` | Corresponding key for certificate above. Mandatory when etcd certificate defined. | - -All corresponding variables will be ignored in values file. - -Configure TLS -------------- - -To enable TLS for MinIO containers, acquire TLS certificates from a CA or create self-signed certificates. While creating / acquiring certificates ensure the corresponding domain names are set as per the standard [DNS naming conventions](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-identity) in a Kubernetes StatefulSet (for a distributed MinIO setup). Then create a secret using - -```bash -$ kubectl create secret generic tls-ssl-minio --from-file=path/to/private.key --from-file=path/to/public.crt -``` - -Then install the chart, specifying that you want to use the TLS secret: - -```bash -$ helm install --set tls.enabled=true,tls.certSecret=tls-ssl-minio minio/minio -``` - -Pass environment variables to MinIO containers ----------------------------------------------- - -To pass environment variables to MinIO containers when deploying via Helm chart, use the below command line format - -```bash -$ helm install --set environment.MINIO_BROWSER=on,environment.MINIO_DOMAIN=domain-name minio/minio -``` - -You can add as many environment variables as required, using the above format. Just add `environment.=` under `set` flag. - -Create buckets after install ---------------------------- - -Install the chart, specifying the buckets you want to create after install: - -```bash -$ helm install --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false minio/minio -``` - -Description of the configuration parameters used above - - -- `buckets[].name` - name of the bucket to create, must be a string with length > 0 -- `buckets[].policy` - can be one of none|download|upload|public -- `buckets[].purge` - purge if bucket exists already diff --git a/packs/minio-8.0.10/charts/minio.orig/ci/distributed-values.yaml b/packs/minio-8.0.10/charts/minio.orig/ci/distributed-values.yaml deleted file mode 100644 index e6c46738..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/ci/distributed-values.yaml +++ /dev/null @@ -1 +0,0 @@ -mode: distributed diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/.helmignore b/packs/minio-8.0.10/charts/minio.orig/minio/.helmignore deleted file mode 100644 index a9fe7278..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -# OWNERS file for Kubernetes -OWNERS \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/Chart.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/Chart.yaml deleted file mode 100644 index 80ad23fa..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/Chart.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1 -appVersion: master -description: High Performance, Kubernetes Native Object Storage -home: https://min.io -icon: https://min.io/resources/img/logo/MINIO_wordmark.png -keywords: -- storage -- object-storage -- S3 -maintainers: -- email: dev@minio.io - name: MinIO, Inc -name: minio -sources: -- https://github.com/minio/minio -version: 8.0.9 diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/README.md b/packs/minio-8.0.10/charts/minio.orig/minio/README.md deleted file mode 100644 index 30a7c6b8..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/README.md +++ /dev/null @@ -1,414 +0,0 @@ -> NOTE: This helm chart is in code freeze i.e we will only update MinIO releases occastionally by bumping up the version. For latest features you are advised to start using our [MinIO operator](https://github.com/minio/operator). - -MinIO -===== - -[MinIO](https://min.io) is a High Performance Object Storage released under Apache License v2.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads. - -MinIO supports [distributed mode](https://docs.minio.io/docs/distributed-minio-quickstart-guide). In distributed mode, you can pool multiple drives (even on different machines) into a single object storage server. - -For more detailed documentation please visit [here](https://docs.minio.io/) - -Introduction ------------- - -This chart bootstraps MinIO deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. - -Prerequisites -------------- - -- Kubernetes 1.4+ with Beta APIs enabled for default standalone mode. -- Kubernetes 1.5+ with Beta APIs enabled to run MinIO in [distributed mode](#distributed-minio). -- PV provisioner support in the underlying infrastructure. - -Configure MinIO Helm repo --------------------- -```bash -$ helm repo add minio https://helm.min.io/ -``` - -Installing the Chart --------------------- - -Install this chart using: - -```bash -$ helm install --namespace minio --generate-name minio/minio -``` - -The command deploys MinIO on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. - -### Release name - -An instance of a chart running in a Kubernetes cluster is called a release. Each release is identified by a unique name within the cluster. Helm automatically assigns a unique release name after installing the chart. You can also set your preferred name by: - -```bash -$ helm install my-release minio/minio -``` - -### Access and Secret keys - -By default a pre-generated access and secret key will be used. To override the default keys, pass the access and secret keys as arguments to helm install. - -```bash -$ helm install --set accessKey=myaccesskey,secretKey=mysecretkey --generate-name minio/minio -``` - -### Updating MinIO configuration via Helm - -[ConfigMap](https://kubernetes.io/docs/user-guide/configmap/) allows injecting containers with configuration data even while a Helm release is deployed. - -To update your MinIO server configuration while it is deployed in a release, you need to - -1. Check all the configurable values in the MinIO chart using `helm inspect values minio/minio`. -2. Override the `minio_server_config` settings in a YAML formatted file, and then pass that file like this `helm upgrade -f config.yaml minio/minio`. -3. Restart the MinIO server(s) for the changes to take effect. - -You can also check the history of upgrades to a release using `helm history my-release`. Replace `my-release` with the actual release name. - -### Installing certificates from third party CAs - -MinIO can connect to other servers, including MinIO nodes or other server types such as NATs and Redis. If these servers use certificates that were not registered with a known CA, add trust for these certificates to MinIO Server by bundling these certificates into a Kubernetes secret and providing it to Helm via the `trustedCertsSecret` value. If `.Values.tls.enabled` is `true` and you're installing certificates for third party CAs, remember to include Minio's own certificate with key `public.crt`, if it also needs to be trusted. - -For instance, given that TLS is enabled and you need to add trust for Minio's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`: - -``` -kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt -``` - -If TLS is not enabled, you would need only the third party CA: - -``` -kubectl -n minio create secret generic minio-trusted-certs --from-file=keycloak.crt -``` - -The name of the generated secret can then be passed to Helm using a values file or the `--set` parameter: - -``` -trustedCertsSecret: "minio-trusted-certs" - -or - ---set trustedCertsSecret=minio-trusted-certs -``` - -Uninstalling the Chart ----------------------- - -Assuming your release is named as `my-release`, delete it using the command: - -```bash -$ helm delete my-release -``` - -or - -```bash -$ helm uninstall my-release -``` - -The command removes all the Kubernetes components associated with the chart and deletes the release. - -Upgrading the Chart -------------------- - -You can use Helm to update MinIO version in a live release. Assuming your release is named as `my-release`, get the values using the command: - -```bash -$ helm get values my-release > old_values.yaml -``` - -Then change the field `image.tag` in `old_values.yaml` file with MinIO image tag you want to use. Now update the chart using - -```bash -$ helm upgrade -f old_values.yaml my-release minio/minio -``` - -Default upgrade strategies are specified in the `values.yaml` file. Update these fields if you'd like to use a different strategy. - -Configuration -------------- - -The following table lists the configurable parameters of the MinIO chart and their default values. - -| Parameter | Description | Default | -|:-------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------| -| `nameOverride` | Provide a name in place of `minio` | `""` | -| `fullnameOverride` | Provide a name to substitute for the full names of resources | `""` | -| `image.repository` | Image repository | `minio/minio` | -| `image.tag` | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/). | `RELEASE.2020-11-06T23-17-07Z` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `imagePullSecrets` | List of container registry secrets | `[]` | -| `mcImage.repository` | Client image repository | `minio/mc` | -| `mcImage.tag` | mc image tag. Possible values listed [here](https://hub.docker.com/r/minio/mc/tags/). | `RELEASE.2020-10-03T02-54-56Z` | -| `mcImage.pullPolicy` | mc Image pull policy | `IfNotPresent` | -| `ingress.enabled` | Enables Ingress | `false` | -| `ingress.labels ` | Ingress labels | `{}` | -| `ingress.annotations` | Ingress annotations | `{}` | -| `ingress.hosts` | Ingress accepted hostnames | `[]` | -| `ingress.tls` | Ingress TLS configuration | `[]` | -| `trustedCertsSecret` | Kubernetes secret with trusted certificates to be mounted on `{{ .Values.certsPath }}/CAs` | `""` | -| `mode` | MinIO server mode (`standalone` or `distributed`) | `standalone` | -| `extraArgs` | Additional command line arguments to pass to the MinIO server | `[]` | -| `replicas` | Number of nodes (applicable only for MinIO distributed mode). | `4` | -| `zones` | Number of zones (applicable only for MinIO distributed mode). | `1` | -| `drivesPerNode` | Number of drives per node (applicable only for MinIO distributed mode). | `1` | -| `existingSecret` | Name of existing secret with access and secret key. | `""` | -| `accessKey` | Default access key (5 to 20 characters) | random 20 chars | -| `secretKey` | Default secret key (8 to 40 characters) | random 40 chars | -| `certsPath` | Default certs path location | `/etc/minio/certs` | -| `configPathmc` | Default config file location for MinIO client - mc | `/etc/minio/mc` | -| `mountPath` | Default mount location for persistent drive | `/export` | -| `bucketRoot` | Directory from where minio should serve buckets. | Value of `.mountPath` | -| `clusterDomain` | domain name of kubernetes cluster where pod is running. | `cluster.local` | -| `service.type` | Kubernetes service type | `ClusterIP` | -| `service.port` | Kubernetes port where service is exposed | `9000` | -| `service.externalIPs` | service external IP addresses | `nil` | -| `service.annotations` | Service annotations | `{}` | -| `serviceAccount.create` | Toggle creation of new service account | `true` | -| `serviceAccount.name` | Name of service account to create and/or use | `""` | -| `persistence.enabled` | Use persistent volume to store data | `true` | -| `persistence.size` | Size of persistent volume claim | `500Gi` | -| `persistence.existingClaim` | Use an existing PVC to persist data | `nil` | -| `persistence.storageClass` | Storage class name of PVC | `nil` | -| `persistence.accessMode` | ReadWriteOnce or ReadOnly | `ReadWriteOnce` | -| `persistence.subPath` | Mount a sub directory of the persistent volume if set | `""` | -| `resources.requests.memory` | Memory resource requests | Memory: `4Gi` | -| `priorityClassName` | Pod priority settings | `""` | -| `securityContext.enabled` | Enable to run containers as non-root. NOTE: if `persistence.enabled=false` then securityContext will be automatically disabled | `true` | -| `securityContext.runAsUser` | User id of the user for the container | `1000` | -| `securityContext.runAsGroup` | Group id of the user for the container | `1000` | -| `securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | -| `nodeSelector` | Node labels for pod assignment | `{}` | -| `affinity` | Affinity settings for pod assignment | `{}` | -| `tolerations` | Toleration labels for pod assignment | `[]` | -| `podAnnotations` | Pod annotations | `{}` | -| `podLabels` | Pod Labels | `{}` | -| `tls.enabled` | Enable TLS for MinIO server | `false` | -| `tls.certSecret` | Kubernetes Secret with `public.crt` and `private.key` files. | `""` | -| `defaultBucket.enabled` | If set to true, a bucket will be created after MinIO install | `false` | -| `defaultBucket.name` | Bucket name | `bucket` | -| `defaultBucket.policy` | Bucket policy | `none` | -| `defaultBucket.purge` | Purge the bucket if already exists | `false` | -| `defaultBucket.versioning` | Enable / Suspend versioning for bucket | `nil` | -| `buckets` | List of buckets to create after MinIO install | `[]` | -| `makeBucketJob.annotations` | Additional annotations for the Kubernetes Batch (make-bucket-job) | `""` | -| `makeBucketJob.podAnnotations` | Additional annotations for the pods of the Kubernetes Batch (make-bucket-job) | `""` | -| `makeBucketJob.securityContext.enabled` | Enable to run Kubernetes Batch (make-bucket-job) containers as non-root. | `false` | -| `makeBucketJob.securityContext.runAsUser` | User id of the user for the container | `1000` | -| `makeBucketJob.securityContext.runAsGroup` | Group id of the user for the container | `1000` | -| `makeBucketJob.securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | -| `makeBucketJob.resources.requests.memory` | Memory resource requests for 'make bucket' job | `128Mi` | -| `updatePrometheusJob.podAnnotations` | Additional annotations for the pods of the Kubernetes Batch (update-prometheus-secret) | `""` | -| `updatePrometheusJob.securityContext.enabled` | Enable to run Kubernetes Batch (update-prometheus-secret) containers as non-root. | `false` | -| `updatePrometheusJob.securityContext.runAsUser` | User id of the user for the container | `1000` | -| `updatePrometheusJob.securityContext.runAsGroup` | Group id of the user for the container | `1000` | -| `updatePrometheusJob.securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | -| `s3gateway.enabled` | Use MinIO as a [s3 gateway](https://github.com/minio/minio/blob/master/docs/gateway/s3.md) | `false` | -| `s3gateway.replicas` | Number of s3 gateway instances to run in parallel | `4` | -| `s3gateway.serviceEndpoint` | Endpoint to the S3 compatible service | `""` | -| `s3gateway.accessKey` | Access key of S3 compatible service | `""` | -| `s3gateway.secretKey` | Secret key of S3 compatible service | `""` | -| `azuregateway.enabled` | Use MinIO as an [azure gateway](https://docs.minio.io/docs/minio-gateway-for-azure) | `false` | -| `azuregateway.replicas` | Number of azure gateway instances to run in parallel | `4` | -| `gcsgateway.enabled` | Use MinIO as a [Google Cloud Storage gateway](https://docs.minio.io/docs/minio-gateway-for-gcs) | `false` | -| `gcsgateway.gcsKeyJson` | credential json file of service account key | `""` | -| `gcsgateway.projectId` | Google cloud project id | `""` | -| `nasgateway.enabled` | Use MinIO as a [NAS gateway](https://docs.MinIO.io/docs/minio-gateway-for-nas) | `false` | -| `nasgateway.replicas` | Number of NAS gateway instances to be run in parallel on a PV | `4` | -| `environment` | Set MinIO server relevant environment variables in `values.yaml` file. MinIO containers will be passed these variables when they start. | `MINIO_STORAGE_CLASS_STANDARD: EC:4"` | -| `metrics.serviceMonitor.enabled` | Set this to `true` to create ServiceMonitor for Prometheus operator | `false` | -| `metrics.serviceMonitor.additionalLabels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` | -| `metrics.serviceMonitor.namespace` | Optional namespace in which to create ServiceMonitor | `nil` | -| `metrics.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `nil` | -| `metrics.serviceMonitor.scrapeTimeout` | Scrape timeout. If not set, the Prometheus default scrape timeout is used | `nil` | -| `metrics.serviceMonitor.relabelConfigs` | Relabel configs that can be used on Endpoints | `{}` | -| `etcd.endpoints` | Endpoints of etcd | `[]` | -| `etcd.pathPrefix` | Prefix for all etcd keys | `""` | -| `etcd.corednsPathPrefix` | Prefix for all CoreDNS etcd keys | `""` | -| `etcd.clientCert` | Certificate used for SSL/TLS connections to etcd [(etcd Security)](https://etcd.io/docs/latest/op-guide/security/) | `""` | -| `etcd.clientCertKey` | Key for the certificate [(etcd Security)](https://etcd.io/docs/latest/op-guide/security/) | `""` | - -Some of the parameters above map to the env variables defined in the [MinIO DockerHub image](https://hub.docker.com/r/minio/minio/). - -You can specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, - -```bash -$ helm install --name my-release --set persistence.size=1Ti minio/minio -``` - -The above command deploys MinIO server with a 1Ti backing persistent volume. - -Alternately, you can provide a YAML file that specifies parameter values while installing the chart. For example, - -```bash -$ helm install --name my-release -f values.yaml minio/minio -``` - -> **Tip**: You can use the default [values.yaml](minio/values.yaml) - -Distributed MinIO ------------ - -This chart provisions a MinIO server in standalone mode, by default. To provision MinIO server in [distributed mode](https://docs.minio.io/docs/distributed-minio-quickstart-guide), set the `mode` field to `distributed`, - -```bash -$ helm install --set mode=distributed minio/minio -``` - -This provisions MinIO server in distributed mode with 4 nodes. To change the number of nodes in your distributed MinIO server, set the `replicas` field, - -```bash -$ helm install --set mode=distributed,replicas=8 minio/minio -``` - -This provisions MinIO server in distributed mode with 8 nodes. Note that the `replicas` value should be a minimum value of 4, there is no limit on number of servers you can run. - -You can also expand an existing deployment by adding new zones, following command will create a total of 16 nodes with each zone running 8 nodes. - -```bash -$ helm install --set mode=distributed,replicas=8,zones=2 minio/minio -``` - -### StatefulSet [limitations](http://kubernetes.io/docs/concepts/abstractions/controllers/statefulsets/#limitations) applicable to distributed MinIO - -1. StatefulSets need persistent storage, so the `persistence.enabled` flag is ignored when `mode` is set to `distributed`. -2. When uninstalling a distributed MinIO release, you'll need to manually delete volumes associated with the StatefulSet. - -NAS Gateway ------------ - -### Prerequisites - -MinIO in [NAS gateway mode](https://docs.minio.io/docs/minio-gateway-for-nas) can be used to create multiple MinIO instances backed by single PV in `ReadWriteMany` mode. Currently few [Kubernetes volume plugins](https://kubernetes.io/docs/user-guide/persistent-volumes/#access-modes) support `ReadWriteMany` mode. To deploy MinIO NAS gateway with Helm chart you'll need to have a Persistent Volume running with one of the supported volume plugins. [This document](https://kubernetes.io/docs/user-guide/volumes/#nfs) -outlines steps to create a NFS PV in Kubernetes cluster. - -### Provision NAS Gateway MinIO instances - -To provision MinIO servers in [NAS gateway mode](https://docs.minio.io/docs/minio-gateway-for-nas), set the `nasgateway.enabled` field to `true`, - -```bash -$ helm install --set nasgateway.enabled=true minio/minio -``` - -This provisions 4 MinIO NAS gateway instances backed by single storage. To change the number of instances in your MinIO deployment, set the `replicas` field, - -```bash -$ helm install --set nasgateway.enabled=true,nasgateway.replicas=8 minio/minio -``` - -This provisions MinIO NAS gateway with 8 instances. - -Persistence ------------ - -This chart provisions a PersistentVolumeClaim and mounts corresponding persistent volume to default location `/export`. You'll need physical storage available in the Kubernetes cluster for this to work. If you'd rather use `emptyDir`, disable PersistentVolumeClaim by: - -```bash -$ helm install --set persistence.enabled=false minio/minio -``` - -> *"An emptyDir volume is first created when a Pod is assigned to a Node, and exists as long as that Pod is running on that node. When a Pod is removed from a node for any reason, the data in the emptyDir is deleted forever."* - -Existing PersistentVolumeClaim ------------------------------- - -If a Persistent Volume Claim already exists, specify it during installation. - -1. Create the PersistentVolume -2. Create the PersistentVolumeClaim -3. Install the chart - -```bash -$ helm install --set persistence.existingClaim=PVC_NAME minio/minio -``` - -NetworkPolicy -------------- - -To enable network policy for MinIO, -install [a networking plugin that implements the Kubernetes -NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), -and set `networkPolicy.enabled` to `true`. - -For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting -the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace: - - kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" - -With NetworkPolicy enabled, traffic will be limited to just port 9000. - -For more precise policy, set `networkPolicy.allowExternal=true`. This will -only allow pods with the generated client label to connect to MinIO. -This label will be displayed in the output of a successful install. - -Existing secret ---------------- - -Instead of having this chart create the secret for you, you can supply a preexisting secret, much -like an existing PersistentVolumeClaim. - -First, create the secret: -```bash -$ kubectl create secret generic my-minio-secret --from-literal=accesskey=foobarbaz --from-literal=secretkey=foobarbazqux -``` - -Then install the chart, specifying that you want to use an existing secret: -```bash -$ helm install --set existingSecret=my-minio-secret minio/minio -``` - -The following fields are expected in the secret: - -| .data. in Secret | Corresponding variable | Description | -|:---------------------------|:------------------------|:----------------------------------------------------------------------------------| -| `accesskey` | `accessKey` | Access key ID. Mandatory. | -| `secretkey` | `secretKey` | Secret key. Mandatory. | -| `gcs_key.json` | `gcsgateway.gcsKeyJson` | GCS key if you are using the GCS gateway feature. Optional | -| `awsAccessKeyId` | `s3gateway.accessKey` | S3 access key if you are using the S3 gateway feature. Optional | -| `awsSecretAccessKey` | `s3gateway.secretKey` | S3 secret key if you are using the S3 gateway feature. Optional | -| `etcd_client_cert.pem` | `etcd.clientCert` | Certificate for SSL/TLS connections to etcd. Optional | -| `etcd_client_cert_key.pem` | `etcd.clientCertKey` | Corresponding key for certificate above. Mandatory when etcd certificate defined. | - -All corresponding variables will be ignored in values file. - -Configure TLS -------------- - -To enable TLS for MinIO containers, acquire TLS certificates from a CA or create self-signed certificates. While creating / acquiring certificates ensure the corresponding domain names are set as per the standard [DNS naming conventions](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-identity) in a Kubernetes StatefulSet (for a distributed MinIO setup). Then create a secret using - -```bash -$ kubectl create secret generic tls-ssl-minio --from-file=path/to/private.key --from-file=path/to/public.crt -``` - -Then install the chart, specifying that you want to use the TLS secret: - -```bash -$ helm install --set tls.enabled=true,tls.certSecret=tls-ssl-minio minio/minio -``` - -Pass environment variables to MinIO containers ----------------------------------------------- - -To pass environment variables to MinIO containers when deploying via Helm chart, use the below command line format - -```bash -$ helm install --set environment.MINIO_BROWSER=on,environment.MINIO_DOMAIN=domain-name minio/minio -``` - -You can add as many environment variables as required, using the above format. Just add `environment.=` under `set` flag. - -Create buckets after install ---------------------------- - -Install the chart, specifying the buckets you want to create after install: - -```bash -$ helm install --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false minio/minio -``` - -Description of the configuration parameters used above - - -- `buckets[].name` - name of the bucket to create, must be a string with length > 0 -- `buckets[].policy` - can be one of none|download|upload|public -- `buckets[].purge` - purge if bucket exists already diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/ci/distributed-values.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/ci/distributed-values.yaml deleted file mode 100644 index e6c46738..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/ci/distributed-values.yaml +++ /dev/null @@ -1 +0,0 @@ -mode: distributed diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/NOTES.txt b/packs/minio-8.0.10/charts/minio.orig/minio/templates/NOTES.txt deleted file mode 100644 index 679f1ea8..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/NOTES.txt +++ /dev/null @@ -1,47 +0,0 @@ -{{- if eq .Values.service.type "ClusterIP" "NodePort" }} -Minio can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster: -{{ template "minio.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local - -To access Minio from localhost, run the below commands: - - 1. export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") - - 2. kubectl port-forward $POD_NAME 9000 --namespace {{ .Release.Namespace }} - -Read more about port forwarding here: http://kubernetes.io/docs/user-guide/kubectl/kubectl_port-forward/ - -You can now access Minio server on http://localhost:9000. Follow the below steps to connect to Minio server with mc client: - - 1. Download the Minio mc client - https://docs.minio.io/docs/minio-client-quickstart-guide - - 2. Get the ACCESS_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.accesskey}" | base64 --decode) and the SECRET_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.secretkey}" | base64 --decode) - - 3. mc alias set {{ template "minio.fullname" . }}-local http://localhost:{{ .Values.service.port }} "$ACCESS_KEY" "$SECRET_KEY" --api s3v4 - - 4. mc ls {{ template "minio.fullname" . }}-local - -Alternately, you can use your browser or the Minio SDK to access the server - https://docs.minio.io/categories/17 -{{- end }} -{{- if eq .Values.service.type "LoadBalancer" }} -Minio can be accessed via port {{ .Values.service.port }} on an external IP address. Get the service external IP address by: -kubectl get svc --namespace {{ .Release.Namespace }} -l app={{ template "minio.fullname" . }} - -Note that the public IP may take a couple of minutes to be available. - -You can now access Minio server on http://:9000. Follow the below steps to connect to Minio server with mc client: - - 1. Download the Minio mc client - https://docs.minio.io/docs/minio-client-quickstart-guide - - 2. Get the ACCESS_KEY=$(kubectl get secret {{ template "minio.secretName" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.data.accesskey}" | base64 --decode) and the SECRET_KEY=$(kubectl get secret {{ template "minio.secretName" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.data.secretkey}" | base64 --decode) - 3. mc alias set {{ template "minio.fullname" . }} http://:{{ .Values.service.port }} "$ACCESS_KEY" "$SECRET_KEY" --api s3v4 - - 4. mc ls {{ template "minio.fullname" . }} - -Alternately, you can use your browser or the Minio SDK to access the server - https://docs.minio.io/categories/17 -{{- end }} - -{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} -Note: Since NetworkPolicy is enabled, only pods with label -{{ template "minio.fullname" . }}-client=true" -will be able to connect to this minio cluster. -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/_helper_create_bucket.txt b/packs/minio-8.0.10/charts/minio.orig/minio/templates/_helper_create_bucket.txt deleted file mode 100644 index ad2f546b..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/_helper_create_bucket.txt +++ /dev/null @@ -1,111 +0,0 @@ -#!/bin/sh -set -e ; # Have script exit in the event of a failed command. - -{{- if .Values.configPathmc }} -MC_CONFIG_DIR="{{ .Values.configPathmc }}" -MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" -{{- else }} -MC="/usr/bin/mc --insecure" -{{- end }} - -# connectToMinio -# Use a check-sleep-check loop to wait for Minio service to be available -connectToMinio() { - SCHEME=$1 - ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts - set -e ; # fail if we can't read the keys. - ACCESS=$(cat /config/accesskey) ; SECRET=$(cat /config/secretkey) ; - set +e ; # The connections to minio are allowed to fail. - echo "Connecting to Minio server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; - MC_COMMAND="${MC} config host add myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; - $MC_COMMAND ; - STATUS=$? ; - until [ $STATUS = 0 ] - do - ATTEMPTS=`expr $ATTEMPTS + 1` ; - echo \"Failed attempts: $ATTEMPTS\" ; - if [ $ATTEMPTS -gt $LIMIT ]; then - exit 1 ; - fi ; - sleep 2 ; # 1 second intervals between attempts - $MC_COMMAND ; - STATUS=$? ; - done ; - set -e ; # reset `e` as active - return 0 -} - -# checkBucketExists ($bucket) -# Check if the bucket exists, by using the exit code of `mc ls` -checkBucketExists() { - BUCKET=$1 - CMD=$(${MC} ls myminio/$BUCKET > /dev/null 2>&1) - return $? -} - -# createBucket ($bucket, $policy, $purge) -# Ensure bucket exists, purging if asked to -createBucket() { - BUCKET=$1 - POLICY=$2 - PURGE=$3 - VERSIONING=$4 - - # Purge the bucket, if set & exists - # Since PURGE is user input, check explicitly for `true` - if [ $PURGE = true ]; then - if checkBucketExists $BUCKET ; then - echo "Purging bucket '$BUCKET'." - set +e ; # don't exit if this fails - ${MC} rm -r --force myminio/$BUCKET - set -e ; # reset `e` as active - else - echo "Bucket '$BUCKET' does not exist, skipping purge." - fi - fi - - # Create the bucket if it does not exist - if ! checkBucketExists $BUCKET ; then - echo "Creating bucket '$BUCKET'" - ${MC} mb myminio/$BUCKET - else - echo "Bucket '$BUCKET' already exists." - fi - - - # set versioning for bucket - if [ ! -z $VERSIONING ] ; then - if [ $VERSIONING = true ] ; then - echo "Enabling versioning for '$BUCKET'" - ${MC} version enable myminio/$BUCKET - elif [ $VERSIONING = false ] ; then - echo "Suspending versioning for '$BUCKET'" - ${MC} version suspend myminio/$BUCKET - fi - else - echo "Bucket '$BUCKET' versioning unchanged." - fi - - # At this point, the bucket should exist, skip checking for existence - # Set policy on the bucket - echo "Setting policy of bucket '$BUCKET' to '$POLICY'." - ${MC} policy set $POLICY myminio/$BUCKET -} - -# Try connecting to Minio instance -{{- if .Values.tls.enabled }} -scheme=https -{{- else }} -scheme=http -{{- end }} -connectToMinio $scheme - -{{- if or .Values.defaultBucket.enabled }} -# Create the bucket -createBucket {{ .Values.defaultBucket.name }} {{ .Values.defaultBucket.policy }} {{ .Values.defaultBucket.purge }} {{ .Values.defaultBucket.versioning }} -{{ else if .Values.buckets }} -# Create the buckets -{{- range .Values.buckets }} -createBucket {{ .name }} {{ .policy }} {{ .purge }} {{ .versioning }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/_helpers.tpl b/packs/minio-8.0.10/charts/minio.orig/minio/templates/_helpers.tpl deleted file mode 100644 index 0b14618a..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/_helpers.tpl +++ /dev/null @@ -1,182 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "minio.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "minio.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "minio.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for networkpolicy. -*/}} -{{- define "minio.networkPolicy.apiVersion" -}} -{{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.Version -}} -{{- print "extensions/v1beta1" -}} -{{- else if semverCompare "^1.7-0" .Capabilities.KubeVersion.Version -}} -{{- print "networking.k8s.io/v1beta1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for deployment. -*/}} -{{- define "minio.deployment.apiVersion" -}} -{{- if semverCompare "<1.9-0" .Capabilities.KubeVersion.Version -}} -{{- print "apps/v1beta2" -}} -{{- else -}} -{{- print "apps/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for statefulset. -*/}} -{{- define "minio.statefulset.apiVersion" -}} -{{- if semverCompare "<1.16-0" .Capabilities.KubeVersion.Version -}} -{{- print "apps/v1beta2" -}} -{{- else -}} -{{- print "apps/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for ingress. -*/}} -{{- define "minio.ingress.apiVersion" -}} -{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} -{{- print "extensions/v1beta1" -}} -{{- else -}} -{{- print "networking.k8s.io/v1beta1" -}} -{{- end -}} -{{- end -}} - -{{/* -Determine secret name. -*/}} -{{- define "minio.secretName" -}} -{{- if .Values.existingSecret -}} -{{- .Values.existingSecret }} -{{- else -}} -{{- include "minio.fullname" . -}} -{{- end -}} -{{- end -}} - -{{/* -Determine service account name for deployment or statefulset. -*/}} -{{- define "minio.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} -{{- default (include "minio.fullname" .) .Values.serviceAccount.name | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- default "default" .Values.serviceAccount.name -}} -{{- end -}} -{{- end -}} - -{{/* -Determine name for scc role and rolebinding -*/}} -{{- define "minio.sccRoleName" -}} -{{- printf "%s-%s" "scc" (include "minio.fullname" .) | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Properly format optional additional arguments to Minio binary -*/}} -{{- define "minio.extraArgs" -}} -{{- range .Values.extraArgs -}} -{{ " " }}{{ . }} -{{- end -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names -*/}} -{{- define "minio.imagePullSecrets" -}} -{{/* -Helm 2.11 supports the assignment of a value to a variable defined in a different scope, -but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. -Also, we can not use a single if because lazy evaluation is not an option -*/}} -{{- if .Values.global }} -{{- if .Values.global.imagePullSecrets }} -imagePullSecrets: -{{- range .Values.global.imagePullSecrets }} - - name: {{ . }} -{{- end }} -{{- else if .Values.imagePullSecrets }} -imagePullSecrets: - {{ toYaml .Values.imagePullSecrets }} -{{- end -}} -{{- else if .Values.imagePullSecrets }} -imagePullSecrets: - {{ toYaml .Values.imagePullSecrets }} -{{- end -}} -{{- end -}} - -{{/* -Formats volumeMount for Minio tls keys and trusted certs -*/}} -{{- define "minio.tlsKeysVolumeMount" -}} -{{- if .Values.tls.enabled }} -- name: cert-secret-volume - mountPath: {{ .Values.certsPath }} -{{- end }} -{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} -{{- $casPath := printf "%s/CAs" .Values.certsPath | clean }} -- name: trusted-cert-secret-volume - mountPath: {{ $casPath }} -{{- end }} -{{- end -}} - -{{/* -Formats volume for Minio tls keys and trusted certs -*/}} -{{- define "minio.tlsKeysVolume" -}} -{{- if .Values.tls.enabled }} -- name: cert-secret-volume - secret: - secretName: {{ .Values.tls.certSecret }} - items: - - key: {{ .Values.tls.publicCrt }} - path: public.crt - - key: {{ .Values.tls.privateKey }} - path: private.key -{{- end }} -{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} -{{- $certSecret := eq .Values.trustedCertsSecret "" | ternary .Values.tls.certSecret .Values.trustedCertsSecret }} -{{- $publicCrt := eq .Values.trustedCertsSecret "" | ternary .Values.tls.publicCrt "" }} -- name: trusted-cert-secret-volume - secret: - secretName: {{ $certSecret }} - {{- if ne $publicCrt "" }} - items: - - key: {{ $publicCrt }} - path: public.crt - {{- end }} -{{- end }} -{{- end -}} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/clusterroles.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/clusterroles.yaml deleted file mode 100644 index c4d9a937..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/clusterroles.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "minio.serviceAccountName" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: -- apiGroups: - - security.openshift.io - resources: - - securitycontextconstraints - resourceNames: - - {{ template "minio.fullname" . }} - verbs: - - use -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/configmap.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/configmap.yaml deleted file mode 100644 index cb11fcd7..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/configmap.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -data: - initialize: |- -{{ include (print $.Template.BasePath "/_helper_create_bucket.txt") . | indent 4 }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/deployment.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/deployment.yaml deleted file mode 100644 index 2fa9edf1..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/deployment.yaml +++ /dev/null @@ -1,203 +0,0 @@ -{{- if eq .Values.mode "standalone" }} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} -apiVersion: {{ template "minio.deployment.apiVersion" . }} -kind: Deployment -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - strategy: - type: {{ .Values.DeploymentUpdate.type }} - {{- if eq .Values.DeploymentUpdate.type "RollingUpdate" }} - rollingUpdate: - maxSurge: {{ .Values.DeploymentUpdate.maxSurge }} - maxUnavailable: {{ .Values.DeploymentUpdate.maxUnavailable }} - {{- end}} - {{- if .Values.nasgateway.enabled }} - replicas: {{ .Values.nasgateway.replicas }} - {{- end }} - {{- if .Values.s3gateway.enabled }} - replicas: {{ .Values.s3gateway.replicas }} - {{- end }} - {{- if .Values.azuregateway.enabled }} - replicas: {{ .Values.azuregateway.replicas }} - {{- end }} - {{- if .Values.gcsgateway.enabled }} - replicas: {{ .Values.gcsgateway.replicas }} - {{- end }} - selector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - template: - metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} - annotations: - checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} -{{- if .Values.podAnnotations }} -{{ toYaml .Values.podAnnotations | trimSuffix "\n" | indent 8 }} -{{- end }} - spec: - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} - serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} -{{- if and .Values.securityContext.enabled .Values.persistence.enabled }} - securityContext: - runAsUser: {{ .Values.securityContext.runAsUser }} - runAsGroup: {{ .Values.securityContext.runAsGroup }} - fsGroup: {{ .Values.securityContext.fsGroup }} -{{- end }} - containers: - - name: {{ .Chart.Name }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - {{- if .Values.s3gateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway s3 {{ .Values.s3gateway.serviceEndpoint }} {{- template "minio.extraArgs" . }}" - {{- else }} - {{- if .Values.azuregateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway azure {{- template "minio.extraArgs" . }}" - {{- else }} - {{- if .Values.gcsgateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway gcs {{ .Values.gcsgateway.projectId }} {{- template "minio.extraArgs" . }}" - {{- else }} - {{- if .Values.nasgateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway nas {{ $bucketRoot }} {{- template "minio.extraArgs" . }}" - {{- else }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{ $bucketRoot }} {{- template "minio.extraArgs" . }}" - {{- end }} - {{- end }} - {{- end }} - {{- end }} - volumeMounts: - {{- if and .Values.persistence.enabled (not .Values.gcsgateway.enabled) (not .Values.azuregateway.enabled) (not .Values.s3gateway.enabled) }} - - name: export - mountPath: {{ .Values.mountPath }} - {{- if .Values.persistence.subPath }} - subPath: "{{ .Values.persistence.subPath }}" - {{- end }} - {{- end }} - {{- if or .Values.gcsgateway.enabled .Values.etcd.clientCert .Values.etcd.clientCertKey }} - - name: minio-user - mountPath: "/etc/credentials" - readOnly: true - {{- end }} - {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} - ports: - - name: {{ $scheme }} - containerPort: 9000 - env: - - name: MINIO_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: accesskey - - name: MINIO_SECRET_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: secretkey - {{- if and .Values.gcsgateway.enabled .Values.gcsgateway.gcsKeyJson }} - - name: GOOGLE_APPLICATION_CREDENTIALS - value: "/etc/credentials/gcs_key.json" - {{- end }} - {{- if .Values.etcd.endpoints }} - - name: MINIO_ETCD_ENDPOINTS - value: {{ join "," .Values.etcd.endpoints | quote }} - {{- if .Values.etcd.clientCert }} - - name: MINIO_ETCD_CLIENT_CERT - value: "/etc/credentials/etcd_client_cert.pem" - {{- end }} - {{- if .Values.etcd.clientCertKey }} - - name: MINIO_ETCD_CLIENT_CERT_KEY - value: "/etc/credentials/etcd_client_cert_key.pem" - {{- end }} - {{- if .Values.etcd.pathPrefix }} - - name: MINIO_ETCD_PATH_PREFIX - value: {{ .Values.etcd.pathPrefix }} - {{- end }} - {{- if .Values.etcd.corednsPathPrefix }} - - name: MINIO_ETCD_COREDNS_PATH - value: {{ .Values.etcd.corednsPathPrefix }} - {{- end }} - {{- end }} - {{- if .Values.s3gateway.enabled -}} - {{- if or .Values.s3gateway.accessKey .Values.existingSecret }} - - name: AWS_ACCESS_KEY_ID - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: awsAccessKeyId - {{- end }} - {{- if or .Values.s3gateway.secretKey .Values.existingSecret }} - - name: AWS_SECRET_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: awsSecretAccessKey - {{- end }} - {{- end }} - {{- range $key, $val := .Values.environment }} - - name: {{ $key }} - value: {{ $val | quote }} - {{- end}} - resources: -{{ toYaml .Values.resources | indent 12 }} -{{- with .Values.nodeSelector }} - nodeSelector: -{{ toYaml . | indent 8 }} -{{- end }} -{{- include "minio.imagePullSecrets" . | indent 6 }} -{{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} -{{- end }} - volumes: - {{- if and (not .Values.gcsgateway.enabled) (not .Values.azuregateway.enabled) (not .Values.s3gateway.enabled) }} - - name: export - {{- if .Values.persistence.enabled }} - persistentVolumeClaim: - claimName: {{ .Values.persistence.existingClaim | default (include "minio.fullname" .) }} - {{- else }} - emptyDir: {} - {{- end }} - {{- end }} - - name: minio-user - secret: - secretName: {{ template "minio.secretName" . }} - {{- include "minio.tlsKeysVolume" . | indent 8 }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/ingress.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/ingress.yaml deleted file mode 100644 index 2d9bbda0..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/ingress.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{- if .Values.ingress.enabled -}} -{{- $fullName := include "minio.fullname" . -}} -{{- $servicePort := .Values.service.port -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: {{ template "minio.ingress.apiVersion" . }} -kind: Ingress -metadata: - name: {{ $fullName }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- with .Values.ingress.labels }} -{{ toYaml . | indent 4 }} -{{- end }} - -{{- with .Values.ingress.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - - http: - paths: - - path: {{ $ingressPath }} - backend: - serviceName: {{ $fullName }} - servicePort: {{ $servicePort }} - {{- if . }} - host: {{ . | quote }} - {{- end }} - {{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/networkpolicy.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/networkpolicy.yaml deleted file mode 100644 index de57f485..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/networkpolicy.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if .Values.networkPolicy.enabled }} -kind: NetworkPolicy -apiVersion: {{ template "minio.networkPolicy.apiVersion" . }} -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - podSelector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - ingress: - - ports: - - port: {{ .Values.service.port }} - {{- if not .Values.networkPolicy.allowExternal }} - from: - - podSelector: - matchLabels: - {{ template "minio.name" . }}-client: "true" - {{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/poddisruptionbudget.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/poddisruptionbudget.yaml deleted file mode 100644 index 1de813b8..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/poddisruptionbudget.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if .Values.podDisruptionBudget.enabled }} -apiVersion: policy/v1beta1 -kind: PodDisruptionBudget -metadata: - name: minio - labels: - app: {{ template "minio.name" . }} -spec: - maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} - selector: - matchLabels: - app: {{ template "minio.name" . }} -{{- end }} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-create-bucket-job.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-create-bucket-job.yaml deleted file mode 100644 index 27e30d4a..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-create-bucket-job.yaml +++ /dev/null @@ -1,87 +0,0 @@ -{{- if or .Values.defaultBucket.enabled .Values.buckets }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ template "minio.fullname" . }}-make-bucket-job - labels: - app: {{ template "minio.name" . }}-make-bucket-job - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation -{{- with .Values.makeBucketJob.annotations }} -{{ toYaml . | indent 4 }} -{{- end }} -spec: - template: - metadata: - labels: - app: {{ template "minio.name" . }}-job - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} -{{- if .Values.makeBucketJob.podAnnotations }} - annotations: -{{ toYaml .Values.makeBucketJob.podAnnotations | indent 8 }} -{{- end }} - spec: - restartPolicy: OnFailure -{{- include "minio.imagePullSecrets" . | indent 6 }} -{{- if .Values.nodeSelector }} - nodeSelector: -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} -{{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} -{{- end }} -{{- if .Values.makeBucketJob.securityContext.enabled }} - securityContext: - runAsUser: {{ .Values.makeBucketJob.securityContext.runAsUser }} - runAsGroup: {{ .Values.makeBucketJob.securityContext.runAsGroup }} - fsGroup: {{ .Values.makeBucketJob.securityContext.fsGroup }} -{{- end }} - volumes: - - name: minio-configuration - projected: - sources: - - configMap: - name: {{ template "minio.fullname" . }} - - secret: - name: {{ template "minio.secretName" . }} - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - secret: - secretName: {{ .Values.tls.certSecret }} - items: - - key: {{ .Values.tls.publicCrt }} - path: CAs/public.crt - {{ end }} - serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} - containers: - - name: minio-mc - image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" - imagePullPolicy: {{ .Values.mcImage.pullPolicy }} - command: ["/bin/sh", "/config/initialize"] - env: - - name: MINIO_ENDPOINT - value: {{ template "minio.fullname" . }} - - name: MINIO_PORT - value: {{ .Values.service.port | quote }} - volumeMounts: - - name: minio-configuration - mountPath: /config - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - mountPath: {{ .Values.configPathmc }}certs - {{ end }} - resources: -{{ toYaml .Values.makeBucketJob.resources | indent 10 }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-job.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-job.yaml deleted file mode 100644 index d7590db7..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-job.yaml +++ /dev/null @@ -1,135 +0,0 @@ -{{- if .Values.metrics.serviceMonitor.enabled }} -{{- $fullName := include "minio.fullname" . -}} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-weight": "-5" - "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation - {{ toYaml .Values.updatePrometheusJob.annotations | indent 4 }} -spec: - template: - metadata: - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} -{{- if .Values.updatePrometheusJob.podAnnotations }} - annotations: -{{ toYaml .Values.updatePrometheusJob.podAnnotations | indent 8 }} -{{- end }} - spec: -{{- if .Values.serviceAccount.create }} - serviceAccountName: {{ $fullName }}-update-prometheus-secret -{{- end }} - restartPolicy: OnFailure -{{- include "minio.imagePullSecrets" . | indent 6 }} -{{- if .Values.nodeSelector }} - nodeSelector: -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} -{{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} -{{- end }} -{{- if .Values.updatePrometheusJob.securityContext.enabled }} - securityContext: - runAsUser: {{ .Values.updatePrometheusJob.securityContext.runAsUser }} - runAsGroup: {{ .Values.updatePrometheusJob.securityContext.runAsGroup }} - fsGroup: {{ .Values.updatePrometheusJob.securityContext.fsGroup }} -{{- end }} - volumes: - - name: workdir - emptyDir: {} - initContainers: - - name: minio-mc - image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" - imagePullPolicy: {{ .Values.mcImage.pullPolicy }} - command: - - /bin/sh - - "-c" - - mc --config-dir {{ .Values.configPathmc }} admin prometheus generate target --json --no-color -q > /workdir/mc.json - env: - - name: MINIO_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: accesskey - - name: MINIO_SECRET_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: secretkey - # mc admin prometheus generate don't really connect to remote server, TLS cert isn't required - - name: MC_HOST_target - value: {{ $scheme }}://$(MINIO_ACCESS_KEY):$(MINIO_SECRET_KEY)@{{ $fullName }}:{{ .Values.service.port }} - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} - # extract bearerToken from mc admin output - - name: jq - image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" - imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} - command: - - /bin/sh - - "-c" - - jq -e -c -j -r .bearerToken < /workdir/mc.json > /workdir/token - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} - - name: kubectl-create - image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" - imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} - command: - - /bin/sh - - "-c" - # The following script does: - # - get the servicemonitor that need this secret and copy some metadata and create the ownerreference for the secret file - # - create the secret - # - merge both json - - > - kubectl -n {{ .Release.Namespace }} get servicemonitor {{ $fullName }} -o json | - jq -c '{metadata: {name: "{{ $fullName }}-prometheus", namespace: .metadata.namespace, labels: {app: .metadata.labels.app, release: .metadata.labels.release}, ownerReferences: [{apiVersion: .apiVersion, kind: .kind, blockOwnerDeletion: true, controller: true, uid: .metadata.uid, name: .metadata.name}]}}' > /workdir/metadata.json && - kubectl create secret generic {{ $fullName }}-prometheus --from-file=token=/workdir/token --dry-run -o json > /workdir/secret.json && - cat /workdir/secret.json /workdir/metadata.json | jq -s add > /workdir/object.json - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} - containers: - - name: kubectl-apply - image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" - imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} - command: - - kubectl - - apply - - "-f" - - /workdir/object.json - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-role.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-role.yaml deleted file mode 100644 index 26c0ce7e..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-role.yaml +++ /dev/null @@ -1,38 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -{{- $fullName := include "minio.fullname" . -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: - - apiGroups: - - "" - resources: - - secrets - verbs: - - get - - create - - update - - patch - resourceNames: - - {{ $fullName }}-prometheus - - apiGroups: - - "" - resources: - - secrets - verbs: - - create - - apiGroups: - - monitoring.coreos.com - resources: - - servicemonitors - verbs: - - get - resourceNames: - - {{ $fullName }} -{{- end -}} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-rolebinding.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-rolebinding.yaml deleted file mode 100644 index 7d0ea75b..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-rolebinding.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -{{- $fullName := include "minio.fullname" . -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ $fullName }}-update-prometheus-secret -subjects: - - kind: ServiceAccount - name: {{ $fullName }}-update-prometheus-secret - namespace: {{ .Release.Namespace | quote }} -{{- end -}} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-serviceaccount.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-serviceaccount.yaml deleted file mode 100644 index 050d368a..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/post-install-prometheus-metrics-serviceaccount.yaml +++ /dev/null @@ -1,12 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -{{- $fullName := include "minio.fullname" . -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- end -}} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/pvc.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/pvc.yaml deleted file mode 100644 index 014f90f3..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/pvc.yaml +++ /dev/null @@ -1,35 +0,0 @@ -{{- if eq .Values.mode "standalone" }} -{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if and .Values.nasgateway.enabled .Values.nasgateway.pv }} - selector: - matchLabels: - pv: {{ .Values.nasgateway.pv | quote }} -{{- end }} - accessModes: - - {{ .Values.persistence.accessMode | quote }} - resources: - requests: - storage: {{ .Values.persistence.size | quote }} - -{{- if .Values.persistence.storageClass }} -{{- if (eq "-" .Values.persistence.storageClass) }} - storageClassName: "" -{{- else }} - storageClassName: "{{ .Values.persistence.storageClass }}" -{{- end }} -{{- end }} -{{- if .Values.persistence.VolumeName }} - volumeName: "{{ .Values.persistence.VolumeName }}" -{{- end }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/rolebindings.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/rolebindings.yaml deleted file mode 100644 index ea8b98c5..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/rolebindings.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ template "minio.serviceAccountName" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - namespace: {{ .Release.Namespace | quote }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "minio.serviceAccountName" . }} -subjects: -- kind: ServiceAccount - name: {{ template "minio.serviceAccountName" . }} - namespace: {{ .Release.Namespace | quote }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/secrets.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/secrets.yaml deleted file mode 100644 index c254142f..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/secrets.yaml +++ /dev/null @@ -1,32 +0,0 @@ -{{- if not .Values.existingSecret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "minio.secretName" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -type: Opaque -data: - accesskey: {{ if .Values.accessKey }}{{ .Values.accessKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 20 | b64enc | quote }}{{ end }} - secretkey: {{ if .Values.secretKey }}{{ .Values.secretKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 40 | b64enc | quote }}{{ end }} -{{- if and .Values.gcsgateway.enabled .Values.gcsgateway.gcsKeyJson }} - gcs_key.json: {{ .Values.gcsgateway.gcsKeyJson | toString | b64enc }} -{{- end }} -{{- if .Values.s3gateway.enabled -}} -{{- if .Values.s3gateway.accessKey }} - awsAccessKeyId: {{ .Values.s3gateway.accessKey | toString | b64enc | quote }} -{{- end }} -{{- if .Values.s3gateway.secretKey }} - awsSecretAccessKey: {{ .Values.s3gateway.secretKey | toString | b64enc | quote }} -{{- end }} -{{- end }} -{{- if .Values.etcd.clientCert }} - etcd_client_cert.pem: {{ .Values.etcd.clientCert | toString | b64enc | quote }} -{{- end }} -{{- if .Values.etcd.clientCertKey }} - etcd_client_cert_key.pem: {{ .Values.etcd.clientCertKey | toString | b64enc | quote }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/securitycontextconstraints.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/securitycontextconstraints.yaml deleted file mode 100644 index dfde6fb9..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/securitycontextconstraints.yaml +++ /dev/null @@ -1,46 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: security.openshift.io/v1 -kind: SecurityContextConstraints -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -priority: 10 -allowHostDirVolumePlugin: false -allowHostIPC: false -allowHostNetwork: false -allowHostPID: false -allowHostPorts: false -allowPrivilegeEscalation: true -allowPrivilegedContainer: false -allowedCapabilities: [] -readOnlyRootFilesystem: false -defaultAddCapabilities: [] -requiredDropCapabilities: -- KILL -- MKNOD -- SETUID -- SETGID -fsGroup: - type: MustRunAs - ranges: - - max: {{ .Values.securityContext.fsGroup }} - min: {{ .Values.securityContext.fsGroup }} -runAsUser: - type: MustRunAs - uid: {{ .Values.securityContext.runAsUser }} -seLinuxContext: - type: MustRunAs -supplementalGroups: - type: RunAsAny -volumes: -- configMap -- downwardAPI -- emptyDir -- persistentVolumeClaim -- projected -- secret -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/service.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/service.yaml deleted file mode 100644 index ea681e22..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/service.yaml +++ /dev/null @@ -1,47 +0,0 @@ -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- if .Values.service.annotations }} - annotations: -{{ toYaml .Values.service.annotations | indent 4 }} -{{- end }} -spec: -{{- if (or (eq .Values.service.type "ClusterIP" "") (empty .Values.service.type)) }} - type: ClusterIP - {{- if not (empty .Values.service.clusterIP) }} - clusterIP: {{ .Values.service.clusterIP }} - {{end}} -{{- else if eq .Values.service.type "LoadBalancer" }} - type: {{ .Values.service.type }} - loadBalancerIP: {{ default "" .Values.service.loadBalancerIP }} -{{- else }} - type: {{ .Values.service.type }} -{{- end }} - ports: - - name: {{ $scheme }} - port: {{ .Values.service.port }} - protocol: TCP -{{- if (and (eq .Values.service.type "NodePort") ( .Values.service.nodePort)) }} - nodePort: {{ .Values.service.nodePort }} -{{- else }} - targetPort: 9000 -{{- end}} -{{- if .Values.service.externalIPs }} - externalIPs: -{{- range $i , $ip := .Values.service.externalIPs }} - - {{ $ip }} -{{- end }} -{{- end }} - selector: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/serviceaccount.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/serviceaccount.yaml deleted file mode 100644 index 243dfef5..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/serviceaccount.yaml +++ /dev/null @@ -1,11 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "minio.serviceAccountName" . | quote }} - namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: "{{ .Release.Name }}" -{{- end -}} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/servicemonitor.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/servicemonitor.yaml deleted file mode 100644 index 2f474cba..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/servicemonitor.yaml +++ /dev/null @@ -1,44 +0,0 @@ -{{- if .Values.metrics.serviceMonitor.enabled }} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ template "minio.fullname" . }} - {{- if .Values.metrics.serviceMonitor.namespace }} - namespace: {{ .Values.metrics.serviceMonitor.namespace }} - {{- end }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.metrics.serviceMonitor.additionalLabels }} -{{ toYaml .Values.metrics.serviceMonitor.additionalLabels | indent 4 }} - {{- end }} -spec: - endpoints: - - port: {{ $scheme }} - path: /minio/prometheus/metrics - {{- if .Values.metrics.serviceMonitor.interval }} - interval: {{ .Values.metrics.serviceMonitor.interval }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.relabelConfigs }} -{{ toYaml .Values.metrics.serviceMonitor.relabelConfigs | indent 6 }} - {{- end }} - bearerTokenSecret: - name: {{ template "minio.fullname" . }}-prometheus - key: token - namespaceSelector: - matchNames: - - {{ .Release.Namespace | quote }} - selector: - matchLabels: - app: {{ include "minio.name" . }} - release: {{ .Release.Name }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/templates/statefulset.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/templates/statefulset.yaml deleted file mode 100644 index b1d2d449..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/templates/statefulset.yaml +++ /dev/null @@ -1,174 +0,0 @@ -{{- if eq .Values.mode "distributed" }} -{{ $zoneCount := .Values.zones | int }} -{{ $nodeCount := .Values.replicas | int }} -{{ $drivesPerNode := .Values.drivesPerNode | int }} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -{{ $mountPath := .Values.mountPath }} -{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} -{{ $subPath := .Values.persistence.subPath }} -{{ $penabled := .Values.persistence.enabled }} -{{ $accessMode := .Values.persistence.accessMode }} -{{ $storageClass := .Values.persistence.storageClass }} -{{ $psize := .Values.persistence.size }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "minio.fullname" . }}-svc - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" -spec: - publishNotReadyAddresses: true - clusterIP: None - ports: - - name: {{ $scheme }} - port: {{ .Values.service.port }} - protocol: TCP - selector: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} ---- -apiVersion: {{ template "minio.statefulset.apiVersion" . }} -kind: StatefulSet -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - updateStrategy: - type: {{ .Values.StatefulSetUpdate.updateStrategy }} - podManagementPolicy: "Parallel" - serviceName: {{ template "minio.fullname" . }}-svc - replicas: {{ mul $zoneCount $nodeCount }} - selector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - template: - metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} - annotations: - checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} -{{- if .Values.podAnnotations }} -{{ toYaml .Values.podAnnotations | trimSuffix "\n" | indent 8 }} -{{- end }} - spec: - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} - serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} -{{- if and .Values.securityContext.enabled .Values.persistence.enabled }} - securityContext: - runAsUser: {{ .Values.securityContext.runAsUser }} - runAsGroup: {{ .Values.securityContext.runAsGroup }} - fsGroup: {{ .Values.securityContext.fsGroup }} -{{- end }} - containers: - - name: {{ .Chart.Name }} - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - - command: [ "/bin/sh", - "-ce", - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{- range $i := until $zoneCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}{{if (gt $drivesPerNode 1)}}{{ $bucketRoot }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{else}}{{ $bucketRoot }}{{end}}{{- end}}{{- template `minio.extraArgs` . }}" ] - volumeMounts: - {{- if $penabled }} - {{- if (gt $drivesPerNode 1) }} - {{- range $i := until $drivesPerNode }} - - name: export-{{ $i }} - mountPath: {{ $mountPath }}-{{ $i }} - {{- if and $penabled $subPath }} - subPath: {{ $subPath }} - {{- end }} - {{- end }} - {{- else }} - - name: export - mountPath: {{ $mountPath }} - {{- if and $penabled $subPath }} - subPath: {{ $subPath }} - {{- end }} - {{- end }} - {{- end }} - {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} - ports: - - name: {{ $scheme }} - containerPort: 9000 - env: - - name: MINIO_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: accesskey - - name: MINIO_SECRET_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: secretkey - {{- range $key, $val := .Values.environment }} - - name: {{ $key }} - value: {{ $val | quote }} - {{- end}} - resources: -{{ toYaml .Values.resources | indent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: -{{ toYaml . | indent 8 }} - {{- end }} -{{- include "minio.imagePullSecrets" . | indent 6 }} - {{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} - {{- end }} - volumes: - - name: minio-user - secret: - secretName: {{ template "minio.secretName" . }} - {{- include "minio.tlsKeysVolume" . | indent 8 }} -{{- if .Values.persistence.enabled }} - volumeClaimTemplates: - {{- if gt $drivesPerNode 1 }} - {{- range $diskId := until $drivesPerNode}} - - metadata: - name: export-{{ $diskId }} - spec: - accessModes: [ {{ $accessMode | quote }} ] - {{- if $storageClass }} - storageClassName: {{ $storageClass }} - {{- end }} - resources: - requests: - storage: {{ $psize }} - {{- end }} - {{- else }} - - metadata: - name: export - spec: - accessModes: [ {{ $accessMode | quote }} ] - {{- if $storageClass }} - storageClassName: {{ $storageClass }} - {{- end }} - resources: - requests: - storage: {{ $psize }} - {{- end }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/minio/values.yaml b/packs/minio-8.0.10/charts/minio.orig/minio/values.yaml deleted file mode 100644 index b08ba65a..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/minio/values.yaml +++ /dev/null @@ -1,347 +0,0 @@ -## Provide a name in place of minio for `app:` labels -## -nameOverride: "" - -## Provide a name to substitute for the full names of resources -## -fullnameOverride: "" - -## set kubernetes cluster domain where minio is running -## -clusterDomain: cluster.local - -## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the -## -image: - repository: minio/minio - tag: RELEASE.2020-12-03T05-49-24Z - pullPolicy: IfNotPresent - -## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio -## client used to create a default bucket). -## -mcImage: - repository: minio/mc - tag: RELEASE.2020-11-25T23-04-07Z - pullPolicy: IfNotPresent - -## Set default image, imageTag, and imagePullPolicy for the `jq` (the JSON -## process used to create secret for prometheus ServiceMonitor). -## -helmKubectlJqImage: - repository: bskim45/helm-kubectl-jq - tag: 3.1.0 - pullPolicy: IfNotPresent - -## minio server mode, i.e. standalone or distributed. -## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide -## -mode: standalone - -## Additional arguments to pass to minio binary -extraArgs: [] - -## Update strategy for Deployments -DeploymentUpdate: - type: RollingUpdate - maxUnavailable: 0 - maxSurge: 100% - -## Update strategy for StatefulSets -StatefulSetUpdate: - updateStrategy: RollingUpdate - -## Pod priority settings -## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ -## -priorityClassName: "" - -## Set default accesskey, secretkey, Minio config file path, volume mount path and -## number of nodes (only used for Minio distributed mode) -## AccessKey and secretKey is generated when not set -## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide -## -accessKey: "" -secretKey: "" -certsPath: "/etc/minio/certs/" -configPathmc: "/etc/minio/mc/" -mountPath: "/export" - -## Use existing Secret that store following variables: -## -## | Chart var | .data. in Secret | -## |:----------------------|:-------------------------| -## | accessKey | accesskey | -## | secretKey | secretkey | -## | gcsgateway.gcsKeyJson | gcs_key.json | -## | s3gateway.accessKey | awsAccessKeyId | -## | s3gateway.secretKey | awsSecretAccessKey | -## | etcd.clientCert | etcd_client_cert.pem | -## | etcd.clientCertKey | etcd_client_cert_key.pem | -## -## All mentioned variables will be ignored in values file. -## .data.accesskey and .data.secretkey are mandatory, -## others depend on enabled status of corresponding sections. -existingSecret: "" - -## Override the root directory which the minio server should serve from. -## If left empty, it defaults to the value of {{ .Values.mountPath }} -## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }} -bucketRoot: "" - -# Number of drives attached to a node -drivesPerNode: 1 -# Number of MinIO containers running -replicas: 4 -# Number of expanded MinIO clusters -zones: 1 - -## TLS Settings for Minio -tls: - enabled: false - ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret - certSecret: "" - publicCrt: public.crt - privateKey: private.key - -## Trusted Certificates Settings for Minio. Ref: https://docs.minio.io/docs/how-to-secure-access-to-minio-server-with-tls#install-certificates-from-third-party-cas -## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret -## When using self-signed certificates, remember to include Minio's own certificate in the bundle with key public.crt. -## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret. -trustedCertsSecret: "" - -## Enable persistence using Persistent Volume Claims -## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ -## -persistence: - enabled: true - - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound - existingClaim: "" - - ## minio data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - ## Storage class of PV to bind. By default it looks for standard storage class. - ## If the PV uses a different storage class, specify that here. - storageClass: "" - VolumeName: "" - accessMode: ReadWriteOnce - size: 500Gi - - ## If subPath is set mount a sub folder of a volume instead of the root of the volume. - ## This is especially handy for volume plugins that don't natively support sub mounting (like glusterfs). - ## - subPath: "" - -## Expose the Minio service to be accessed from outside the cluster (LoadBalancer service). -## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it. -## ref: http://kubernetes.io/docs/user-guide/services/ -## - -service: - type: ClusterIP - clusterIP: ~ - port: 9000 - nodePort: 32000 - - ## List of IP addresses at which the Prometheus server service is available - ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips - ## - externalIPs: [] - # - externalIp1 - - annotations: {} - # prometheus.io/scrape: 'true' - # prometheus.io/path: '/minio/prometheus/metrics' - # prometheus.io/port: '9000' - -## Configure Ingress based on the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/ -## - -imagePullSecrets: [] -# - name: "image-pull-secret" - -ingress: - enabled: false - labels: {} - # node-role.kubernetes.io/ingress: platform - - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # kubernetes.io/ingress.allow-http: "false" - # kubernetes.io/ingress.global-static-ip-name: "" - # nginx.ingress.kubernetes.io/secure-backends: "true" - # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" - # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 - path: / - hosts: - - chart-example.local - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - -## Node labels for pod assignment -## Ref: https://kubernetes.io/docs/user-guide/node-selection/ -## -nodeSelector: {} -tolerations: [] -affinity: {} - -## Add stateful containers to have security context, if enabled MinIO will run as this -## user and group NOTE: securityContext is only enabled if persistence.enabled=true -securityContext: - enabled: true - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - -# Additational pod annotations -podAnnotations: {} - -# Additional pod labels -podLabels: {} - -## Configure resource requests and limits -## ref: http://kubernetes.io/docs/user-guide/compute-resources/ -## -resources: - requests: - memory: 4Gi - -## Create a bucket after minio install -## -defaultBucket: - enabled: false - ## If enabled, must be a string with length > 0 - name: bucket - ## Can be one of none|download|upload|public - policy: none - ## Purge if bucket exists already - purge: false - ## set versioning for bucket true|false - # versioning: false - -## Create multiple buckets after minio install -## Enabling `defaultBucket` will take priority over this list -## -buckets: [] - # - name: bucket1 - # policy: none - # purge: false - # - name: bucket2 - # policy: none - # purge: false - -## Additional Annotations for the Kubernetes Batch (make-bucket-job) -makeBucketJob: - podAnnotations: - annotations: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - resources: - requests: - memory: 128Mi - -## Additional Annotations for the Kubernetes Batch (update-prometheus-secret) -updatePrometheusJob: - podAnnotations: - annotations: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - -s3gateway: - enabled: false - replicas: 4 - serviceEndpoint: "" - accessKey: "" - secretKey: "" - -## Use minio as an azure blob gateway, you should disable data persistence so no volume claim are created. -## https://docs.minio.io/docs/minio-gateway-for-azure -azuregateway: - enabled: false - # Number of parallel instances - replicas: 4 - -## Use minio as GCS (Google Cloud Storage) gateway, you should disable data persistence so no volume claim are created. -## https://docs.minio.io/docs/minio-gateway-for-gcs - -gcsgateway: - enabled: false - # Number of parallel instances - replicas: 4 - # credential json file of service account key - gcsKeyJson: "" - # Google cloud project-id - projectId: "" - -## Use minio on NAS backend -## https://docs.minio.io/docs/minio-gateway-for-nas - -nasgateway: - enabled: false - # Number of parallel instances - replicas: 4 - # For NAS Gateway, you may want to bind the PVC to a specific PV. To ensure that happens, PV to bind to should have - # a label like "pv: ", use value here. - pv: ~ - -## Use this field to add environment variables relevant to Minio server. These fields will be passed on to Minio container(s) -## when Chart is deployed -environment: {} - ## Please refer for comprehensive list https://docs.minio.io/docs/minio-server-configuration-guide.html - ## MINIO_DOMAIN: "chart-example.local" - ## MINIO_BROWSER: "off" - -networkPolicy: - enabled: false - allowExternal: true - -## PodDisruptionBudget settings -## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ -## -podDisruptionBudget: - enabled: false - maxUnavailable: 1 - -## Specify the service account to use for the Minio pods. If 'create' is set to 'false' -## and 'name' is left unspecified, the account 'default' will be used. -serviceAccount: - create: true - ## The name of the service account to use. If 'create' is 'true', a service account with that name - ## will be created. Otherwise, a name will be auto-generated. - name: - -metrics: - # Metrics can not be disabled yet: https://github.com/minio/minio/issues/7493 - serviceMonitor: - enabled: false - additionalLabels: {} - relabelConfigs: {} - # namespace: monitoring - # interval: 30s - # scrapeTimeout: 10s - -## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md -## Define endpoints to enable this section. -etcd: - endpoints: [] - pathPrefix: "" - corednsPathPrefix: "" - clientCert: "" - clientCertKey: "" diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/NOTES.txt b/packs/minio-8.0.10/charts/minio.orig/templates/NOTES.txt deleted file mode 100644 index 679f1ea8..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/NOTES.txt +++ /dev/null @@ -1,47 +0,0 @@ -{{- if eq .Values.service.type "ClusterIP" "NodePort" }} -Minio can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster: -{{ template "minio.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local - -To access Minio from localhost, run the below commands: - - 1. export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") - - 2. kubectl port-forward $POD_NAME 9000 --namespace {{ .Release.Namespace }} - -Read more about port forwarding here: http://kubernetes.io/docs/user-guide/kubectl/kubectl_port-forward/ - -You can now access Minio server on http://localhost:9000. Follow the below steps to connect to Minio server with mc client: - - 1. Download the Minio mc client - https://docs.minio.io/docs/minio-client-quickstart-guide - - 2. Get the ACCESS_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.accesskey}" | base64 --decode) and the SECRET_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.secretkey}" | base64 --decode) - - 3. mc alias set {{ template "minio.fullname" . }}-local http://localhost:{{ .Values.service.port }} "$ACCESS_KEY" "$SECRET_KEY" --api s3v4 - - 4. mc ls {{ template "minio.fullname" . }}-local - -Alternately, you can use your browser or the Minio SDK to access the server - https://docs.minio.io/categories/17 -{{- end }} -{{- if eq .Values.service.type "LoadBalancer" }} -Minio can be accessed via port {{ .Values.service.port }} on an external IP address. Get the service external IP address by: -kubectl get svc --namespace {{ .Release.Namespace }} -l app={{ template "minio.fullname" . }} - -Note that the public IP may take a couple of minutes to be available. - -You can now access Minio server on http://:9000. Follow the below steps to connect to Minio server with mc client: - - 1. Download the Minio mc client - https://docs.minio.io/docs/minio-client-quickstart-guide - - 2. Get the ACCESS_KEY=$(kubectl get secret {{ template "minio.secretName" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.data.accesskey}" | base64 --decode) and the SECRET_KEY=$(kubectl get secret {{ template "minio.secretName" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.data.secretkey}" | base64 --decode) - 3. mc alias set {{ template "minio.fullname" . }} http://:{{ .Values.service.port }} "$ACCESS_KEY" "$SECRET_KEY" --api s3v4 - - 4. mc ls {{ template "minio.fullname" . }} - -Alternately, you can use your browser or the Minio SDK to access the server - https://docs.minio.io/categories/17 -{{- end }} - -{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} -Note: Since NetworkPolicy is enabled, only pods with label -{{ template "minio.fullname" . }}-client=true" -will be able to connect to this minio cluster. -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/_helper_create_bucket.txt b/packs/minio-8.0.10/charts/minio.orig/templates/_helper_create_bucket.txt deleted file mode 100644 index ad2f546b..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/_helper_create_bucket.txt +++ /dev/null @@ -1,111 +0,0 @@ -#!/bin/sh -set -e ; # Have script exit in the event of a failed command. - -{{- if .Values.configPathmc }} -MC_CONFIG_DIR="{{ .Values.configPathmc }}" -MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" -{{- else }} -MC="/usr/bin/mc --insecure" -{{- end }} - -# connectToMinio -# Use a check-sleep-check loop to wait for Minio service to be available -connectToMinio() { - SCHEME=$1 - ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts - set -e ; # fail if we can't read the keys. - ACCESS=$(cat /config/accesskey) ; SECRET=$(cat /config/secretkey) ; - set +e ; # The connections to minio are allowed to fail. - echo "Connecting to Minio server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; - MC_COMMAND="${MC} config host add myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; - $MC_COMMAND ; - STATUS=$? ; - until [ $STATUS = 0 ] - do - ATTEMPTS=`expr $ATTEMPTS + 1` ; - echo \"Failed attempts: $ATTEMPTS\" ; - if [ $ATTEMPTS -gt $LIMIT ]; then - exit 1 ; - fi ; - sleep 2 ; # 1 second intervals between attempts - $MC_COMMAND ; - STATUS=$? ; - done ; - set -e ; # reset `e` as active - return 0 -} - -# checkBucketExists ($bucket) -# Check if the bucket exists, by using the exit code of `mc ls` -checkBucketExists() { - BUCKET=$1 - CMD=$(${MC} ls myminio/$BUCKET > /dev/null 2>&1) - return $? -} - -# createBucket ($bucket, $policy, $purge) -# Ensure bucket exists, purging if asked to -createBucket() { - BUCKET=$1 - POLICY=$2 - PURGE=$3 - VERSIONING=$4 - - # Purge the bucket, if set & exists - # Since PURGE is user input, check explicitly for `true` - if [ $PURGE = true ]; then - if checkBucketExists $BUCKET ; then - echo "Purging bucket '$BUCKET'." - set +e ; # don't exit if this fails - ${MC} rm -r --force myminio/$BUCKET - set -e ; # reset `e` as active - else - echo "Bucket '$BUCKET' does not exist, skipping purge." - fi - fi - - # Create the bucket if it does not exist - if ! checkBucketExists $BUCKET ; then - echo "Creating bucket '$BUCKET'" - ${MC} mb myminio/$BUCKET - else - echo "Bucket '$BUCKET' already exists." - fi - - - # set versioning for bucket - if [ ! -z $VERSIONING ] ; then - if [ $VERSIONING = true ] ; then - echo "Enabling versioning for '$BUCKET'" - ${MC} version enable myminio/$BUCKET - elif [ $VERSIONING = false ] ; then - echo "Suspending versioning for '$BUCKET'" - ${MC} version suspend myminio/$BUCKET - fi - else - echo "Bucket '$BUCKET' versioning unchanged." - fi - - # At this point, the bucket should exist, skip checking for existence - # Set policy on the bucket - echo "Setting policy of bucket '$BUCKET' to '$POLICY'." - ${MC} policy set $POLICY myminio/$BUCKET -} - -# Try connecting to Minio instance -{{- if .Values.tls.enabled }} -scheme=https -{{- else }} -scheme=http -{{- end }} -connectToMinio $scheme - -{{- if or .Values.defaultBucket.enabled }} -# Create the bucket -createBucket {{ .Values.defaultBucket.name }} {{ .Values.defaultBucket.policy }} {{ .Values.defaultBucket.purge }} {{ .Values.defaultBucket.versioning }} -{{ else if .Values.buckets }} -# Create the buckets -{{- range .Values.buckets }} -createBucket {{ .name }} {{ .policy }} {{ .purge }} {{ .versioning }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/_helpers.tpl b/packs/minio-8.0.10/charts/minio.orig/templates/_helpers.tpl deleted file mode 100644 index 0b14618a..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/_helpers.tpl +++ /dev/null @@ -1,182 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "minio.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "minio.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "minio.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for networkpolicy. -*/}} -{{- define "minio.networkPolicy.apiVersion" -}} -{{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.Version -}} -{{- print "extensions/v1beta1" -}} -{{- else if semverCompare "^1.7-0" .Capabilities.KubeVersion.Version -}} -{{- print "networking.k8s.io/v1beta1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for deployment. -*/}} -{{- define "minio.deployment.apiVersion" -}} -{{- if semverCompare "<1.9-0" .Capabilities.KubeVersion.Version -}} -{{- print "apps/v1beta2" -}} -{{- else -}} -{{- print "apps/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for statefulset. -*/}} -{{- define "minio.statefulset.apiVersion" -}} -{{- if semverCompare "<1.16-0" .Capabilities.KubeVersion.Version -}} -{{- print "apps/v1beta2" -}} -{{- else -}} -{{- print "apps/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for ingress. -*/}} -{{- define "minio.ingress.apiVersion" -}} -{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} -{{- print "extensions/v1beta1" -}} -{{- else -}} -{{- print "networking.k8s.io/v1beta1" -}} -{{- end -}} -{{- end -}} - -{{/* -Determine secret name. -*/}} -{{- define "minio.secretName" -}} -{{- if .Values.existingSecret -}} -{{- .Values.existingSecret }} -{{- else -}} -{{- include "minio.fullname" . -}} -{{- end -}} -{{- end -}} - -{{/* -Determine service account name for deployment or statefulset. -*/}} -{{- define "minio.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} -{{- default (include "minio.fullname" .) .Values.serviceAccount.name | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- default "default" .Values.serviceAccount.name -}} -{{- end -}} -{{- end -}} - -{{/* -Determine name for scc role and rolebinding -*/}} -{{- define "minio.sccRoleName" -}} -{{- printf "%s-%s" "scc" (include "minio.fullname" .) | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Properly format optional additional arguments to Minio binary -*/}} -{{- define "minio.extraArgs" -}} -{{- range .Values.extraArgs -}} -{{ " " }}{{ . }} -{{- end -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names -*/}} -{{- define "minio.imagePullSecrets" -}} -{{/* -Helm 2.11 supports the assignment of a value to a variable defined in a different scope, -but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. -Also, we can not use a single if because lazy evaluation is not an option -*/}} -{{- if .Values.global }} -{{- if .Values.global.imagePullSecrets }} -imagePullSecrets: -{{- range .Values.global.imagePullSecrets }} - - name: {{ . }} -{{- end }} -{{- else if .Values.imagePullSecrets }} -imagePullSecrets: - {{ toYaml .Values.imagePullSecrets }} -{{- end -}} -{{- else if .Values.imagePullSecrets }} -imagePullSecrets: - {{ toYaml .Values.imagePullSecrets }} -{{- end -}} -{{- end -}} - -{{/* -Formats volumeMount for Minio tls keys and trusted certs -*/}} -{{- define "minio.tlsKeysVolumeMount" -}} -{{- if .Values.tls.enabled }} -- name: cert-secret-volume - mountPath: {{ .Values.certsPath }} -{{- end }} -{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} -{{- $casPath := printf "%s/CAs" .Values.certsPath | clean }} -- name: trusted-cert-secret-volume - mountPath: {{ $casPath }} -{{- end }} -{{- end -}} - -{{/* -Formats volume for Minio tls keys and trusted certs -*/}} -{{- define "minio.tlsKeysVolume" -}} -{{- if .Values.tls.enabled }} -- name: cert-secret-volume - secret: - secretName: {{ .Values.tls.certSecret }} - items: - - key: {{ .Values.tls.publicCrt }} - path: public.crt - - key: {{ .Values.tls.privateKey }} - path: private.key -{{- end }} -{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} -{{- $certSecret := eq .Values.trustedCertsSecret "" | ternary .Values.tls.certSecret .Values.trustedCertsSecret }} -{{- $publicCrt := eq .Values.trustedCertsSecret "" | ternary .Values.tls.publicCrt "" }} -- name: trusted-cert-secret-volume - secret: - secretName: {{ $certSecret }} - {{- if ne $publicCrt "" }} - items: - - key: {{ $publicCrt }} - path: public.crt - {{- end }} -{{- end }} -{{- end -}} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/clusterroles.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/clusterroles.yaml deleted file mode 100644 index c4d9a937..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/clusterroles.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "minio.serviceAccountName" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: -- apiGroups: - - security.openshift.io - resources: - - securitycontextconstraints - resourceNames: - - {{ template "minio.fullname" . }} - verbs: - - use -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/configmap.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/configmap.yaml deleted file mode 100644 index cb11fcd7..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/configmap.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -data: - initialize: |- -{{ include (print $.Template.BasePath "/_helper_create_bucket.txt") . | indent 4 }} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/deployment.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/deployment.yaml deleted file mode 100644 index 2fa9edf1..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/deployment.yaml +++ /dev/null @@ -1,203 +0,0 @@ -{{- if eq .Values.mode "standalone" }} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} -apiVersion: {{ template "minio.deployment.apiVersion" . }} -kind: Deployment -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - strategy: - type: {{ .Values.DeploymentUpdate.type }} - {{- if eq .Values.DeploymentUpdate.type "RollingUpdate" }} - rollingUpdate: - maxSurge: {{ .Values.DeploymentUpdate.maxSurge }} - maxUnavailable: {{ .Values.DeploymentUpdate.maxUnavailable }} - {{- end}} - {{- if .Values.nasgateway.enabled }} - replicas: {{ .Values.nasgateway.replicas }} - {{- end }} - {{- if .Values.s3gateway.enabled }} - replicas: {{ .Values.s3gateway.replicas }} - {{- end }} - {{- if .Values.azuregateway.enabled }} - replicas: {{ .Values.azuregateway.replicas }} - {{- end }} - {{- if .Values.gcsgateway.enabled }} - replicas: {{ .Values.gcsgateway.replicas }} - {{- end }} - selector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - template: - metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} - annotations: - checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} -{{- if .Values.podAnnotations }} -{{ toYaml .Values.podAnnotations | trimSuffix "\n" | indent 8 }} -{{- end }} - spec: - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} - serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} -{{- if and .Values.securityContext.enabled .Values.persistence.enabled }} - securityContext: - runAsUser: {{ .Values.securityContext.runAsUser }} - runAsGroup: {{ .Values.securityContext.runAsGroup }} - fsGroup: {{ .Values.securityContext.fsGroup }} -{{- end }} - containers: - - name: {{ .Chart.Name }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - {{- if .Values.s3gateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway s3 {{ .Values.s3gateway.serviceEndpoint }} {{- template "minio.extraArgs" . }}" - {{- else }} - {{- if .Values.azuregateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway azure {{- template "minio.extraArgs" . }}" - {{- else }} - {{- if .Values.gcsgateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway gcs {{ .Values.gcsgateway.projectId }} {{- template "minio.extraArgs" . }}" - {{- else }} - {{- if .Values.nasgateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway nas {{ $bucketRoot }} {{- template "minio.extraArgs" . }}" - {{- else }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{ $bucketRoot }} {{- template "minio.extraArgs" . }}" - {{- end }} - {{- end }} - {{- end }} - {{- end }} - volumeMounts: - {{- if and .Values.persistence.enabled (not .Values.gcsgateway.enabled) (not .Values.azuregateway.enabled) (not .Values.s3gateway.enabled) }} - - name: export - mountPath: {{ .Values.mountPath }} - {{- if .Values.persistence.subPath }} - subPath: "{{ .Values.persistence.subPath }}" - {{- end }} - {{- end }} - {{- if or .Values.gcsgateway.enabled .Values.etcd.clientCert .Values.etcd.clientCertKey }} - - name: minio-user - mountPath: "/etc/credentials" - readOnly: true - {{- end }} - {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} - ports: - - name: {{ $scheme }} - containerPort: 9000 - env: - - name: MINIO_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: accesskey - - name: MINIO_SECRET_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: secretkey - {{- if and .Values.gcsgateway.enabled .Values.gcsgateway.gcsKeyJson }} - - name: GOOGLE_APPLICATION_CREDENTIALS - value: "/etc/credentials/gcs_key.json" - {{- end }} - {{- if .Values.etcd.endpoints }} - - name: MINIO_ETCD_ENDPOINTS - value: {{ join "," .Values.etcd.endpoints | quote }} - {{- if .Values.etcd.clientCert }} - - name: MINIO_ETCD_CLIENT_CERT - value: "/etc/credentials/etcd_client_cert.pem" - {{- end }} - {{- if .Values.etcd.clientCertKey }} - - name: MINIO_ETCD_CLIENT_CERT_KEY - value: "/etc/credentials/etcd_client_cert_key.pem" - {{- end }} - {{- if .Values.etcd.pathPrefix }} - - name: MINIO_ETCD_PATH_PREFIX - value: {{ .Values.etcd.pathPrefix }} - {{- end }} - {{- if .Values.etcd.corednsPathPrefix }} - - name: MINIO_ETCD_COREDNS_PATH - value: {{ .Values.etcd.corednsPathPrefix }} - {{- end }} - {{- end }} - {{- if .Values.s3gateway.enabled -}} - {{- if or .Values.s3gateway.accessKey .Values.existingSecret }} - - name: AWS_ACCESS_KEY_ID - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: awsAccessKeyId - {{- end }} - {{- if or .Values.s3gateway.secretKey .Values.existingSecret }} - - name: AWS_SECRET_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: awsSecretAccessKey - {{- end }} - {{- end }} - {{- range $key, $val := .Values.environment }} - - name: {{ $key }} - value: {{ $val | quote }} - {{- end}} - resources: -{{ toYaml .Values.resources | indent 12 }} -{{- with .Values.nodeSelector }} - nodeSelector: -{{ toYaml . | indent 8 }} -{{- end }} -{{- include "minio.imagePullSecrets" . | indent 6 }} -{{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} -{{- end }} - volumes: - {{- if and (not .Values.gcsgateway.enabled) (not .Values.azuregateway.enabled) (not .Values.s3gateway.enabled) }} - - name: export - {{- if .Values.persistence.enabled }} - persistentVolumeClaim: - claimName: {{ .Values.persistence.existingClaim | default (include "minio.fullname" .) }} - {{- else }} - emptyDir: {} - {{- end }} - {{- end }} - - name: minio-user - secret: - secretName: {{ template "minio.secretName" . }} - {{- include "minio.tlsKeysVolume" . | indent 8 }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/ingress.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/ingress.yaml deleted file mode 100644 index 2d9bbda0..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/ingress.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{- if .Values.ingress.enabled -}} -{{- $fullName := include "minio.fullname" . -}} -{{- $servicePort := .Values.service.port -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: {{ template "minio.ingress.apiVersion" . }} -kind: Ingress -metadata: - name: {{ $fullName }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- with .Values.ingress.labels }} -{{ toYaml . | indent 4 }} -{{- end }} - -{{- with .Values.ingress.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - - http: - paths: - - path: {{ $ingressPath }} - backend: - serviceName: {{ $fullName }} - servicePort: {{ $servicePort }} - {{- if . }} - host: {{ . | quote }} - {{- end }} - {{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/networkpolicy.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/networkpolicy.yaml deleted file mode 100644 index de57f485..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/networkpolicy.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if .Values.networkPolicy.enabled }} -kind: NetworkPolicy -apiVersion: {{ template "minio.networkPolicy.apiVersion" . }} -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - podSelector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - ingress: - - ports: - - port: {{ .Values.service.port }} - {{- if not .Values.networkPolicy.allowExternal }} - from: - - podSelector: - matchLabels: - {{ template "minio.name" . }}-client: "true" - {{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/poddisruptionbudget.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/poddisruptionbudget.yaml deleted file mode 100644 index 1de813b8..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/poddisruptionbudget.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if .Values.podDisruptionBudget.enabled }} -apiVersion: policy/v1beta1 -kind: PodDisruptionBudget -metadata: - name: minio - labels: - app: {{ template "minio.name" . }} -spec: - maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} - selector: - matchLabels: - app: {{ template "minio.name" . }} -{{- end }} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/post-install-create-bucket-job.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/post-install-create-bucket-job.yaml deleted file mode 100644 index 27e30d4a..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/post-install-create-bucket-job.yaml +++ /dev/null @@ -1,87 +0,0 @@ -{{- if or .Values.defaultBucket.enabled .Values.buckets }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ template "minio.fullname" . }}-make-bucket-job - labels: - app: {{ template "minio.name" . }}-make-bucket-job - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation -{{- with .Values.makeBucketJob.annotations }} -{{ toYaml . | indent 4 }} -{{- end }} -spec: - template: - metadata: - labels: - app: {{ template "minio.name" . }}-job - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} -{{- if .Values.makeBucketJob.podAnnotations }} - annotations: -{{ toYaml .Values.makeBucketJob.podAnnotations | indent 8 }} -{{- end }} - spec: - restartPolicy: OnFailure -{{- include "minio.imagePullSecrets" . | indent 6 }} -{{- if .Values.nodeSelector }} - nodeSelector: -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} -{{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} -{{- end }} -{{- if .Values.makeBucketJob.securityContext.enabled }} - securityContext: - runAsUser: {{ .Values.makeBucketJob.securityContext.runAsUser }} - runAsGroup: {{ .Values.makeBucketJob.securityContext.runAsGroup }} - fsGroup: {{ .Values.makeBucketJob.securityContext.fsGroup }} -{{- end }} - volumes: - - name: minio-configuration - projected: - sources: - - configMap: - name: {{ template "minio.fullname" . }} - - secret: - name: {{ template "minio.secretName" . }} - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - secret: - secretName: {{ .Values.tls.certSecret }} - items: - - key: {{ .Values.tls.publicCrt }} - path: CAs/public.crt - {{ end }} - serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} - containers: - - name: minio-mc - image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" - imagePullPolicy: {{ .Values.mcImage.pullPolicy }} - command: ["/bin/sh", "/config/initialize"] - env: - - name: MINIO_ENDPOINT - value: {{ template "minio.fullname" . }} - - name: MINIO_PORT - value: {{ .Values.service.port | quote }} - volumeMounts: - - name: minio-configuration - mountPath: /config - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - mountPath: {{ .Values.configPathmc }}certs - {{ end }} - resources: -{{ toYaml .Values.makeBucketJob.resources | indent 10 }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-job.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-job.yaml deleted file mode 100644 index d7590db7..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-job.yaml +++ /dev/null @@ -1,135 +0,0 @@ -{{- if .Values.metrics.serviceMonitor.enabled }} -{{- $fullName := include "minio.fullname" . -}} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-weight": "-5" - "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation - {{ toYaml .Values.updatePrometheusJob.annotations | indent 4 }} -spec: - template: - metadata: - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} -{{- if .Values.updatePrometheusJob.podAnnotations }} - annotations: -{{ toYaml .Values.updatePrometheusJob.podAnnotations | indent 8 }} -{{- end }} - spec: -{{- if .Values.serviceAccount.create }} - serviceAccountName: {{ $fullName }}-update-prometheus-secret -{{- end }} - restartPolicy: OnFailure -{{- include "minio.imagePullSecrets" . | indent 6 }} -{{- if .Values.nodeSelector }} - nodeSelector: -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} -{{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} -{{- end }} -{{- if .Values.updatePrometheusJob.securityContext.enabled }} - securityContext: - runAsUser: {{ .Values.updatePrometheusJob.securityContext.runAsUser }} - runAsGroup: {{ .Values.updatePrometheusJob.securityContext.runAsGroup }} - fsGroup: {{ .Values.updatePrometheusJob.securityContext.fsGroup }} -{{- end }} - volumes: - - name: workdir - emptyDir: {} - initContainers: - - name: minio-mc - image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" - imagePullPolicy: {{ .Values.mcImage.pullPolicy }} - command: - - /bin/sh - - "-c" - - mc --config-dir {{ .Values.configPathmc }} admin prometheus generate target --json --no-color -q > /workdir/mc.json - env: - - name: MINIO_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: accesskey - - name: MINIO_SECRET_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: secretkey - # mc admin prometheus generate don't really connect to remote server, TLS cert isn't required - - name: MC_HOST_target - value: {{ $scheme }}://$(MINIO_ACCESS_KEY):$(MINIO_SECRET_KEY)@{{ $fullName }}:{{ .Values.service.port }} - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} - # extract bearerToken from mc admin output - - name: jq - image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" - imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} - command: - - /bin/sh - - "-c" - - jq -e -c -j -r .bearerToken < /workdir/mc.json > /workdir/token - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} - - name: kubectl-create - image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" - imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} - command: - - /bin/sh - - "-c" - # The following script does: - # - get the servicemonitor that need this secret and copy some metadata and create the ownerreference for the secret file - # - create the secret - # - merge both json - - > - kubectl -n {{ .Release.Namespace }} get servicemonitor {{ $fullName }} -o json | - jq -c '{metadata: {name: "{{ $fullName }}-prometheus", namespace: .metadata.namespace, labels: {app: .metadata.labels.app, release: .metadata.labels.release}, ownerReferences: [{apiVersion: .apiVersion, kind: .kind, blockOwnerDeletion: true, controller: true, uid: .metadata.uid, name: .metadata.name}]}}' > /workdir/metadata.json && - kubectl create secret generic {{ $fullName }}-prometheus --from-file=token=/workdir/token --dry-run -o json > /workdir/secret.json && - cat /workdir/secret.json /workdir/metadata.json | jq -s add > /workdir/object.json - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} - containers: - - name: kubectl-apply - image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" - imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} - command: - - kubectl - - apply - - "-f" - - /workdir/object.json - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-role.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-role.yaml deleted file mode 100644 index 26c0ce7e..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-role.yaml +++ /dev/null @@ -1,38 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -{{- $fullName := include "minio.fullname" . -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: - - apiGroups: - - "" - resources: - - secrets - verbs: - - get - - create - - update - - patch - resourceNames: - - {{ $fullName }}-prometheus - - apiGroups: - - "" - resources: - - secrets - verbs: - - create - - apiGroups: - - monitoring.coreos.com - resources: - - servicemonitors - verbs: - - get - resourceNames: - - {{ $fullName }} -{{- end -}} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-rolebinding.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-rolebinding.yaml deleted file mode 100644 index 7d0ea75b..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-rolebinding.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -{{- $fullName := include "minio.fullname" . -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ $fullName }}-update-prometheus-secret -subjects: - - kind: ServiceAccount - name: {{ $fullName }}-update-prometheus-secret - namespace: {{ .Release.Namespace | quote }} -{{- end -}} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-serviceaccount.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-serviceaccount.yaml deleted file mode 100644 index 050d368a..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/post-install-prometheus-metrics-serviceaccount.yaml +++ /dev/null @@ -1,12 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -{{- $fullName := include "minio.fullname" . -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- end -}} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/pvc.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/pvc.yaml deleted file mode 100644 index 014f90f3..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/pvc.yaml +++ /dev/null @@ -1,35 +0,0 @@ -{{- if eq .Values.mode "standalone" }} -{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if and .Values.nasgateway.enabled .Values.nasgateway.pv }} - selector: - matchLabels: - pv: {{ .Values.nasgateway.pv | quote }} -{{- end }} - accessModes: - - {{ .Values.persistence.accessMode | quote }} - resources: - requests: - storage: {{ .Values.persistence.size | quote }} - -{{- if .Values.persistence.storageClass }} -{{- if (eq "-" .Values.persistence.storageClass) }} - storageClassName: "" -{{- else }} - storageClassName: "{{ .Values.persistence.storageClass }}" -{{- end }} -{{- end }} -{{- if .Values.persistence.VolumeName }} - volumeName: "{{ .Values.persistence.VolumeName }}" -{{- end }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/rolebindings.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/rolebindings.yaml deleted file mode 100644 index ea8b98c5..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/rolebindings.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ template "minio.serviceAccountName" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - namespace: {{ .Release.Namespace | quote }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "minio.serviceAccountName" . }} -subjects: -- kind: ServiceAccount - name: {{ template "minio.serviceAccountName" . }} - namespace: {{ .Release.Namespace | quote }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/secrets.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/secrets.yaml deleted file mode 100644 index c254142f..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/secrets.yaml +++ /dev/null @@ -1,32 +0,0 @@ -{{- if not .Values.existingSecret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "minio.secretName" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -type: Opaque -data: - accesskey: {{ if .Values.accessKey }}{{ .Values.accessKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 20 | b64enc | quote }}{{ end }} - secretkey: {{ if .Values.secretKey }}{{ .Values.secretKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 40 | b64enc | quote }}{{ end }} -{{- if and .Values.gcsgateway.enabled .Values.gcsgateway.gcsKeyJson }} - gcs_key.json: {{ .Values.gcsgateway.gcsKeyJson | toString | b64enc }} -{{- end }} -{{- if .Values.s3gateway.enabled -}} -{{- if .Values.s3gateway.accessKey }} - awsAccessKeyId: {{ .Values.s3gateway.accessKey | toString | b64enc | quote }} -{{- end }} -{{- if .Values.s3gateway.secretKey }} - awsSecretAccessKey: {{ .Values.s3gateway.secretKey | toString | b64enc | quote }} -{{- end }} -{{- end }} -{{- if .Values.etcd.clientCert }} - etcd_client_cert.pem: {{ .Values.etcd.clientCert | toString | b64enc | quote }} -{{- end }} -{{- if .Values.etcd.clientCertKey }} - etcd_client_cert_key.pem: {{ .Values.etcd.clientCertKey | toString | b64enc | quote }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/securitycontextconstraints.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/securitycontextconstraints.yaml deleted file mode 100644 index dfde6fb9..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/securitycontextconstraints.yaml +++ /dev/null @@ -1,46 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: security.openshift.io/v1 -kind: SecurityContextConstraints -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -priority: 10 -allowHostDirVolumePlugin: false -allowHostIPC: false -allowHostNetwork: false -allowHostPID: false -allowHostPorts: false -allowPrivilegeEscalation: true -allowPrivilegedContainer: false -allowedCapabilities: [] -readOnlyRootFilesystem: false -defaultAddCapabilities: [] -requiredDropCapabilities: -- KILL -- MKNOD -- SETUID -- SETGID -fsGroup: - type: MustRunAs - ranges: - - max: {{ .Values.securityContext.fsGroup }} - min: {{ .Values.securityContext.fsGroup }} -runAsUser: - type: MustRunAs - uid: {{ .Values.securityContext.runAsUser }} -seLinuxContext: - type: MustRunAs -supplementalGroups: - type: RunAsAny -volumes: -- configMap -- downwardAPI -- emptyDir -- persistentVolumeClaim -- projected -- secret -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/service.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/service.yaml deleted file mode 100644 index ea681e22..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/service.yaml +++ /dev/null @@ -1,47 +0,0 @@ -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- if .Values.service.annotations }} - annotations: -{{ toYaml .Values.service.annotations | indent 4 }} -{{- end }} -spec: -{{- if (or (eq .Values.service.type "ClusterIP" "") (empty .Values.service.type)) }} - type: ClusterIP - {{- if not (empty .Values.service.clusterIP) }} - clusterIP: {{ .Values.service.clusterIP }} - {{end}} -{{- else if eq .Values.service.type "LoadBalancer" }} - type: {{ .Values.service.type }} - loadBalancerIP: {{ default "" .Values.service.loadBalancerIP }} -{{- else }} - type: {{ .Values.service.type }} -{{- end }} - ports: - - name: {{ $scheme }} - port: {{ .Values.service.port }} - protocol: TCP -{{- if (and (eq .Values.service.type "NodePort") ( .Values.service.nodePort)) }} - nodePort: {{ .Values.service.nodePort }} -{{- else }} - targetPort: 9000 -{{- end}} -{{- if .Values.service.externalIPs }} - externalIPs: -{{- range $i , $ip := .Values.service.externalIPs }} - - {{ $ip }} -{{- end }} -{{- end }} - selector: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/serviceaccount.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/serviceaccount.yaml deleted file mode 100644 index 243dfef5..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/serviceaccount.yaml +++ /dev/null @@ -1,11 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "minio.serviceAccountName" . | quote }} - namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: "{{ .Release.Name }}" -{{- end -}} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/servicemonitor.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/servicemonitor.yaml deleted file mode 100644 index 2f474cba..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/servicemonitor.yaml +++ /dev/null @@ -1,44 +0,0 @@ -{{- if .Values.metrics.serviceMonitor.enabled }} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ template "minio.fullname" . }} - {{- if .Values.metrics.serviceMonitor.namespace }} - namespace: {{ .Values.metrics.serviceMonitor.namespace }} - {{- end }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.metrics.serviceMonitor.additionalLabels }} -{{ toYaml .Values.metrics.serviceMonitor.additionalLabels | indent 4 }} - {{- end }} -spec: - endpoints: - - port: {{ $scheme }} - path: /minio/prometheus/metrics - {{- if .Values.metrics.serviceMonitor.interval }} - interval: {{ .Values.metrics.serviceMonitor.interval }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.relabelConfigs }} -{{ toYaml .Values.metrics.serviceMonitor.relabelConfigs | indent 6 }} - {{- end }} - bearerTokenSecret: - name: {{ template "minio.fullname" . }}-prometheus - key: token - namespaceSelector: - matchNames: - - {{ .Release.Namespace | quote }} - selector: - matchLabels: - app: {{ include "minio.name" . }} - release: {{ .Release.Name }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/templates/statefulset.yaml b/packs/minio-8.0.10/charts/minio.orig/templates/statefulset.yaml deleted file mode 100644 index b1d2d449..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/templates/statefulset.yaml +++ /dev/null @@ -1,174 +0,0 @@ -{{- if eq .Values.mode "distributed" }} -{{ $zoneCount := .Values.zones | int }} -{{ $nodeCount := .Values.replicas | int }} -{{ $drivesPerNode := .Values.drivesPerNode | int }} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -{{ $mountPath := .Values.mountPath }} -{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} -{{ $subPath := .Values.persistence.subPath }} -{{ $penabled := .Values.persistence.enabled }} -{{ $accessMode := .Values.persistence.accessMode }} -{{ $storageClass := .Values.persistence.storageClass }} -{{ $psize := .Values.persistence.size }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "minio.fullname" . }}-svc - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" -spec: - publishNotReadyAddresses: true - clusterIP: None - ports: - - name: {{ $scheme }} - port: {{ .Values.service.port }} - protocol: TCP - selector: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} ---- -apiVersion: {{ template "minio.statefulset.apiVersion" . }} -kind: StatefulSet -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - updateStrategy: - type: {{ .Values.StatefulSetUpdate.updateStrategy }} - podManagementPolicy: "Parallel" - serviceName: {{ template "minio.fullname" . }}-svc - replicas: {{ mul $zoneCount $nodeCount }} - selector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - template: - metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} - annotations: - checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} -{{- if .Values.podAnnotations }} -{{ toYaml .Values.podAnnotations | trimSuffix "\n" | indent 8 }} -{{- end }} - spec: - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} - serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} -{{- if and .Values.securityContext.enabled .Values.persistence.enabled }} - securityContext: - runAsUser: {{ .Values.securityContext.runAsUser }} - runAsGroup: {{ .Values.securityContext.runAsGroup }} - fsGroup: {{ .Values.securityContext.fsGroup }} -{{- end }} - containers: - - name: {{ .Chart.Name }} - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - - command: [ "/bin/sh", - "-ce", - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{- range $i := until $zoneCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}{{if (gt $drivesPerNode 1)}}{{ $bucketRoot }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{else}}{{ $bucketRoot }}{{end}}{{- end}}{{- template `minio.extraArgs` . }}" ] - volumeMounts: - {{- if $penabled }} - {{- if (gt $drivesPerNode 1) }} - {{- range $i := until $drivesPerNode }} - - name: export-{{ $i }} - mountPath: {{ $mountPath }}-{{ $i }} - {{- if and $penabled $subPath }} - subPath: {{ $subPath }} - {{- end }} - {{- end }} - {{- else }} - - name: export - mountPath: {{ $mountPath }} - {{- if and $penabled $subPath }} - subPath: {{ $subPath }} - {{- end }} - {{- end }} - {{- end }} - {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} - ports: - - name: {{ $scheme }} - containerPort: 9000 - env: - - name: MINIO_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: accesskey - - name: MINIO_SECRET_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: secretkey - {{- range $key, $val := .Values.environment }} - - name: {{ $key }} - value: {{ $val | quote }} - {{- end}} - resources: -{{ toYaml .Values.resources | indent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: -{{ toYaml . | indent 8 }} - {{- end }} -{{- include "minio.imagePullSecrets" . | indent 6 }} - {{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} - {{- end }} - volumes: - - name: minio-user - secret: - secretName: {{ template "minio.secretName" . }} - {{- include "minio.tlsKeysVolume" . | indent 8 }} -{{- if .Values.persistence.enabled }} - volumeClaimTemplates: - {{- if gt $drivesPerNode 1 }} - {{- range $diskId := until $drivesPerNode}} - - metadata: - name: export-{{ $diskId }} - spec: - accessModes: [ {{ $accessMode | quote }} ] - {{- if $storageClass }} - storageClassName: {{ $storageClass }} - {{- end }} - resources: - requests: - storage: {{ $psize }} - {{- end }} - {{- else }} - - metadata: - name: export - spec: - accessModes: [ {{ $accessMode | quote }} ] - {{- if $storageClass }} - storageClassName: {{ $storageClass }} - {{- end }} - resources: - requests: - storage: {{ $psize }} - {{- end }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio.orig/values.yaml b/packs/minio-8.0.10/charts/minio.orig/values.yaml deleted file mode 100644 index b08ba65a..00000000 --- a/packs/minio-8.0.10/charts/minio.orig/values.yaml +++ /dev/null @@ -1,347 +0,0 @@ -## Provide a name in place of minio for `app:` labels -## -nameOverride: "" - -## Provide a name to substitute for the full names of resources -## -fullnameOverride: "" - -## set kubernetes cluster domain where minio is running -## -clusterDomain: cluster.local - -## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the -## -image: - repository: minio/minio - tag: RELEASE.2020-12-03T05-49-24Z - pullPolicy: IfNotPresent - -## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio -## client used to create a default bucket). -## -mcImage: - repository: minio/mc - tag: RELEASE.2020-11-25T23-04-07Z - pullPolicy: IfNotPresent - -## Set default image, imageTag, and imagePullPolicy for the `jq` (the JSON -## process used to create secret for prometheus ServiceMonitor). -## -helmKubectlJqImage: - repository: bskim45/helm-kubectl-jq - tag: 3.1.0 - pullPolicy: IfNotPresent - -## minio server mode, i.e. standalone or distributed. -## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide -## -mode: standalone - -## Additional arguments to pass to minio binary -extraArgs: [] - -## Update strategy for Deployments -DeploymentUpdate: - type: RollingUpdate - maxUnavailable: 0 - maxSurge: 100% - -## Update strategy for StatefulSets -StatefulSetUpdate: - updateStrategy: RollingUpdate - -## Pod priority settings -## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ -## -priorityClassName: "" - -## Set default accesskey, secretkey, Minio config file path, volume mount path and -## number of nodes (only used for Minio distributed mode) -## AccessKey and secretKey is generated when not set -## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide -## -accessKey: "" -secretKey: "" -certsPath: "/etc/minio/certs/" -configPathmc: "/etc/minio/mc/" -mountPath: "/export" - -## Use existing Secret that store following variables: -## -## | Chart var | .data. in Secret | -## |:----------------------|:-------------------------| -## | accessKey | accesskey | -## | secretKey | secretkey | -## | gcsgateway.gcsKeyJson | gcs_key.json | -## | s3gateway.accessKey | awsAccessKeyId | -## | s3gateway.secretKey | awsSecretAccessKey | -## | etcd.clientCert | etcd_client_cert.pem | -## | etcd.clientCertKey | etcd_client_cert_key.pem | -## -## All mentioned variables will be ignored in values file. -## .data.accesskey and .data.secretkey are mandatory, -## others depend on enabled status of corresponding sections. -existingSecret: "" - -## Override the root directory which the minio server should serve from. -## If left empty, it defaults to the value of {{ .Values.mountPath }} -## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }} -bucketRoot: "" - -# Number of drives attached to a node -drivesPerNode: 1 -# Number of MinIO containers running -replicas: 4 -# Number of expanded MinIO clusters -zones: 1 - -## TLS Settings for Minio -tls: - enabled: false - ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret - certSecret: "" - publicCrt: public.crt - privateKey: private.key - -## Trusted Certificates Settings for Minio. Ref: https://docs.minio.io/docs/how-to-secure-access-to-minio-server-with-tls#install-certificates-from-third-party-cas -## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret -## When using self-signed certificates, remember to include Minio's own certificate in the bundle with key public.crt. -## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret. -trustedCertsSecret: "" - -## Enable persistence using Persistent Volume Claims -## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ -## -persistence: - enabled: true - - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound - existingClaim: "" - - ## minio data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - ## Storage class of PV to bind. By default it looks for standard storage class. - ## If the PV uses a different storage class, specify that here. - storageClass: "" - VolumeName: "" - accessMode: ReadWriteOnce - size: 500Gi - - ## If subPath is set mount a sub folder of a volume instead of the root of the volume. - ## This is especially handy for volume plugins that don't natively support sub mounting (like glusterfs). - ## - subPath: "" - -## Expose the Minio service to be accessed from outside the cluster (LoadBalancer service). -## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it. -## ref: http://kubernetes.io/docs/user-guide/services/ -## - -service: - type: ClusterIP - clusterIP: ~ - port: 9000 - nodePort: 32000 - - ## List of IP addresses at which the Prometheus server service is available - ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips - ## - externalIPs: [] - # - externalIp1 - - annotations: {} - # prometheus.io/scrape: 'true' - # prometheus.io/path: '/minio/prometheus/metrics' - # prometheus.io/port: '9000' - -## Configure Ingress based on the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/ -## - -imagePullSecrets: [] -# - name: "image-pull-secret" - -ingress: - enabled: false - labels: {} - # node-role.kubernetes.io/ingress: platform - - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # kubernetes.io/ingress.allow-http: "false" - # kubernetes.io/ingress.global-static-ip-name: "" - # nginx.ingress.kubernetes.io/secure-backends: "true" - # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" - # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 - path: / - hosts: - - chart-example.local - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - -## Node labels for pod assignment -## Ref: https://kubernetes.io/docs/user-guide/node-selection/ -## -nodeSelector: {} -tolerations: [] -affinity: {} - -## Add stateful containers to have security context, if enabled MinIO will run as this -## user and group NOTE: securityContext is only enabled if persistence.enabled=true -securityContext: - enabled: true - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - -# Additational pod annotations -podAnnotations: {} - -# Additional pod labels -podLabels: {} - -## Configure resource requests and limits -## ref: http://kubernetes.io/docs/user-guide/compute-resources/ -## -resources: - requests: - memory: 4Gi - -## Create a bucket after minio install -## -defaultBucket: - enabled: false - ## If enabled, must be a string with length > 0 - name: bucket - ## Can be one of none|download|upload|public - policy: none - ## Purge if bucket exists already - purge: false - ## set versioning for bucket true|false - # versioning: false - -## Create multiple buckets after minio install -## Enabling `defaultBucket` will take priority over this list -## -buckets: [] - # - name: bucket1 - # policy: none - # purge: false - # - name: bucket2 - # policy: none - # purge: false - -## Additional Annotations for the Kubernetes Batch (make-bucket-job) -makeBucketJob: - podAnnotations: - annotations: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - resources: - requests: - memory: 128Mi - -## Additional Annotations for the Kubernetes Batch (update-prometheus-secret) -updatePrometheusJob: - podAnnotations: - annotations: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - -s3gateway: - enabled: false - replicas: 4 - serviceEndpoint: "" - accessKey: "" - secretKey: "" - -## Use minio as an azure blob gateway, you should disable data persistence so no volume claim are created. -## https://docs.minio.io/docs/minio-gateway-for-azure -azuregateway: - enabled: false - # Number of parallel instances - replicas: 4 - -## Use minio as GCS (Google Cloud Storage) gateway, you should disable data persistence so no volume claim are created. -## https://docs.minio.io/docs/minio-gateway-for-gcs - -gcsgateway: - enabled: false - # Number of parallel instances - replicas: 4 - # credential json file of service account key - gcsKeyJson: "" - # Google cloud project-id - projectId: "" - -## Use minio on NAS backend -## https://docs.minio.io/docs/minio-gateway-for-nas - -nasgateway: - enabled: false - # Number of parallel instances - replicas: 4 - # For NAS Gateway, you may want to bind the PVC to a specific PV. To ensure that happens, PV to bind to should have - # a label like "pv: ", use value here. - pv: ~ - -## Use this field to add environment variables relevant to Minio server. These fields will be passed on to Minio container(s) -## when Chart is deployed -environment: {} - ## Please refer for comprehensive list https://docs.minio.io/docs/minio-server-configuration-guide.html - ## MINIO_DOMAIN: "chart-example.local" - ## MINIO_BROWSER: "off" - -networkPolicy: - enabled: false - allowExternal: true - -## PodDisruptionBudget settings -## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ -## -podDisruptionBudget: - enabled: false - maxUnavailable: 1 - -## Specify the service account to use for the Minio pods. If 'create' is set to 'false' -## and 'name' is left unspecified, the account 'default' will be used. -serviceAccount: - create: true - ## The name of the service account to use. If 'create' is 'true', a service account with that name - ## will be created. Otherwise, a name will be auto-generated. - name: - -metrics: - # Metrics can not be disabled yet: https://github.com/minio/minio/issues/7493 - serviceMonitor: - enabled: false - additionalLabels: {} - relabelConfigs: {} - # namespace: monitoring - # interval: 30s - # scrapeTimeout: 10s - -## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md -## Define endpoints to enable this section. -etcd: - endpoints: [] - pathPrefix: "" - corednsPathPrefix: "" - clientCert: "" - clientCertKey: "" diff --git a/packs/minio-8.0.10/charts/minio.tgz b/packs/minio-8.0.10/charts/minio.tgz deleted file mode 100644 index cc8bac40ceed3a2db20501b87f61fef8716c596f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 40066 zcmV)TK(W6ciwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0POvHcic9TFb>b({1mk<$zVa| z@t^MD8I4Ax=iA%(?`Slt|2ulN_2N&P+oP@Rt?kj~==q;Un_Evun}34QeE?H`av@3f zr_m?(RY&d%c}U8BrkP+o*@4SVkEChwb54Y$nHNzJW-OKX?guuV!3oVKJe!jwq#N*K zKBiehB^7W?B)g>Wdi*O5C7ep0kty|Nd`@>@CS@vihQm2a0>(WSs@AG6hZz+-&q6AO zY(5>ve9DKfj*gFBzq{gDG$+|bkS0^_f-cl=vE%t5OdmdQ?9?w`oIdsDge8)&gl1Tn z&IyZmAflK552;?k0gw;{-Yb?Iz21PMB=qzPEa4e=RBa3El*w5>4njU3>b0XwUfNOn zb1(}2;(hLE?fqyRE=inIabFBz`TF15e)fE`zW$$WKmEG?AL3bCgOiM3vWNn~wE!%E zG$tVhKGCZHCOm_4lBPT75R);Dg}1hb%jESX%`z6z9T*Heui2F3Ao8)0Oy-heGjc{@ zlE*QA7pjY5(W^$)r`CoAm2gpVnlR24Z-R)cH4axZno$ER6OiRe!jh?K&=fqtayzzO z5c814*zhTp5YY+AV+m|drgTI9b4I2cK$1xRI?3bsgvTsg1Tg0jRlVebMhZigL@Xqd zD%@0;SYgKl$Y{z1lRR4(c4AlsfF#o$cysvjaPRam*cxq({LL+Y^z>}>%-{ZtzqS3} z9za@jxdTU&V=hlJDrh2a1$8m@=kxF!o~XYxENg2J#*8MiKqt(oLWUIWkMrCNdw&`y@JKK8dkGB2Mi+e=v*WV0ke?NVFteQ$Q9#SFds0kWoRARj}<8vx! zG#7A6vr87zS3FTjX>?~ao~!*Wl=0txYsGvlF4%ng*-(}AFLY7=*Wc_wJPkI3(JG8J z-3ppr(hR9<16V)<5RxPjiFrbSXAm(VGd9j8jTCHfQ2tiC7vqr8Nx7v)JQRW5=J40h zX~D-Y{%<)8FBJci{xoM1lCJ__$LSkE+>0Wn1OO5P$)@?7CQ_&oO^LvNH40;vkZj@6 z_c9}U*;MSn+h4HyPice$FEb+PR8QFfO=G^mmb~(BT~dv*T%>dd-tahP$yC4g0OsWV zPYJmsEGFZa?!ZXDJI%8x-GR-~=>K$fcq)mclRQ49Qh3gfvdbL*IyIH*og;ta5u_R8 z8IudelO#)~ig8uPzGPIz*oQm`X)5uL37h5_QNuY*dF0#n{4}FY3L=8qW9pT&TCG=5Tt~fWD5gZxE3yctq3ZYVf+za@y9>Gq zepNr)`g>}txe#9ixe^7r9YxFPxe#MLJ%)R=0WkHb45L8rgZng-1%B%NJN^EhqLUz{ z^Ck66yUluttg3r$rhYGuL9si=6B?D20aq-JVN8Kd6Q0pXO}-Y*aSNkfW(t4(S{)#7qSGXW7zX%YcXfF`QPNHKbuqaYUYETbajNu;P%&`?1q0?!h+ z9>IbMSrHBQ-i&hz5zA<(dW5SP3ujPB8Fp_IGoHth{soha&k>=c3B+_FLGixD2C#y+ z;m)EO!68r}e)s^v&-$oRtVj6x(Xk}yr*@Wp~ z?rK^~KW{jx(}vBLYECse4`)c~BmJXIS5?noui_GB#7)@G)A2PPyIY9n1+ zgMBOM8G-1E$(h>SE{UXpC9O0c$1DuOOd<&i{Svo*#pIOW9l#rxdAA>shccsds8tG@ zqsv%0JLTGzuf;RJeCKPxJOH(b9Qp$T)_x{;90=8W4L*^6fU%9mV0muJ-1OHsYh`;sPhUyY_OW3k2(AxRwjq0_CesNa_}mPLL_GP&?W zf^x)nc@o7G=6Nhx8dH!4X16l1L~>AKp_#bPFePhi@DH`8=Rz}!c;X8-O=^&CKt|^j z$rukxVVp-)kMd&y{3>xvt5vAh=2#B_Qlp~6a(*qlD5*h7871?;fsnCKZw3Oh}r9)QroCeIwy#EqU$7 zgw3lGW4pkZ3z})UW>~ZWJ?#!R=6Mn+u+8p*5aA6zr*X4Ca02w7wh;@m#_mFDnQg$bMmu-bIg(`fbSON zL0m%2`Gw|^ML)u=9TelBz&-g{9UcS_h}dL8Gc|dY;u~iBT{uk3gUY}dR zR$t-H`i7F|9~qPMbrLGV6zq4p1J6dI@0nLlb3VrHoC%x=efmMkK#Av(-eifTP{k!E ziL9uAqK)}mmoS)~DaN8W4I+Z1J|jt_51Xc~G|s0iF^oCl$zur#D#_yoh&)xN2m}K` zQd9jTW)~EudWWBg^}tS+!J*_i?^7*YHzoJr7^%~n;%PjW!is8Eb@t>X zC((B#CP}D7GhG|i9*SUfeKqgcfMUjmJs0)&^&dwkWo0~>szL=Yi&QfhoHpc-(2zx@VlSpactz6f#;b9T7_h-?KVTYhNRJqFzGXE{6+g|mVSbZLr|tF2wHq5)SG%sp7jqn9O*sIoqLu>~3ZEvG{2qjSvW zOy2MS5b}ANOX`>R<7(cEU;0i$_n`@WPUm<#v8|*a_oT1289*j#2RHX+`cR}=G}7L8 zSg1>Da5O2;R*sfMW=ed)Lt9Lfshq*LsGQflME7gd4kS@^@LFR62~X&C#IKT=lju56 z@gIFQ!<}2-nW$2__DP;isiGQ#3Z5SXkT|0xTA*eCuL2y1mCR?Z=M{`<4Vub|h^~v0 zP9a<08NA|1uIq}9LDYvq)z5ilIM4Nxk>rAwHwavb5qLmV>`YC8X}n-Zeq{hR4Zo=m z3pCNL)!b^U*{D~$>T#Aqam(hIdwfS^ID;p1azTCFi~lPhuY2l+M*8o3yo0k?Sy8pk zQ3K-Oh%2^^S2QhoU0#Lngv6mxyg%HL5fc&mF<2dGHFr9C}g6CEstE|FS`Fm9QzvNF38xuk|FP zqBcqme81m6g(u&0K8-2t$2^bhaeMvqB0mj<=apA8pN_dI9%eM6iDV=Oyw$-=M?NVI zNhA#M*nL42lP+(A4C$@&l*-!~ z8L0l1ASH$=kMQo?G-@=*&3;A{;Z$}%eTXLi|yG`mjS1<%hZhWj+)?=%P zlN=snUyoJ0N;-b5WR}N;RzFXQJGu>Q(Dw7#$X1UFTFZrEg$ABIT}&aRyL1)TXEUm; z(~MHD9fth|Rn6*7ELfIF!)rOC*%cFX!y3ogA|#jGFH9u@D>HkZ z(YfeD<}3XJLZS^R#?)>Y5iF=&dDp{)$f+2<*#67Yaz8i5PMx9!DWss6t|mmWJY+Wd zu;c1C(5x>dA>DzwZd_}~)i;(%nq4Z2e>xK8oz_a7u{q_rRFa9%+Rd~5gM#!|;-=(@ z$~~5lVu*M1bKDXRP%RJCNH2KM)!1szXYRTKPu0;Y!IU&|cuM5#B%>4d-fUMP&uEmO zHA(e-VGGcBVa1})ZSYxp%uOJjr!kRK4ArUqG?4G*9rm%p{{Pvttx?VXcYE~J{{LZ~ z4Y;mpzeN9sMQBBI5w*D0et-Enf+WJ=8NlwOGdPw-?68#4dVNcAFUR+ zw2V49KGiJIy=z$TJhO`Y9q+>jurvw-y{}ta;Q<8j@nfJmd_z%02#zfmQXj-+7}V^3 z&$zwd&{$x<_-)38+(5+^UPaTGUnwzTPLfFMcpkuJ0NVNsPF^3pJKlSBxclgdG5iFz zVXNH^e7|6X&;=OyF$^;OVYglgK7Jg4&rz0E+-G<2Az+fu#oN&@!JJBh7C)+!kArmu z*H!=)3I&~#Zm&od!6OSM-hcE0%=6w*62Y8j6v&w8QqQPqQB7E>vR|pYGCXeu}7M|E{is{)=hy?IABp+v*grq65_K+tD4I4tL-lylG;mLM34~*`~ z5m<^c;I9@ab;+hRqMnoQ&4t+B{{G?V>AN2f|EoqW#)PAVzDqTyP-N=LyQc>~ z;xS5-vlTIE)=5nvk#x#4M#XURg{L?&O(L}rS21Vz3is2QGD(ViMdu#0q+u)fwiJT# zV#lk{)n(Y536eD3T{$0~cg&?Z5j*BPM<;l)Mztz|kmqS^9anNmg}n{8XPDq79Otk0 zh~^)ieEYwb>-3t%&&--`3*!p@bqn^@PCO6HygoDAQqmfm;0!;pXjil%_L^@Uo~W~I zdzp%sWL>qZIKU2^vLvK%?3S$<{NeQ?N@4moN*z>J%a3M7?dt36;%ts*#LD8v6Qfo> zTB*{-{d3FnH+|~ozjrelr!;$~6&LUHz0N0|2Unc`o^Nf{{Xbu9kDh-$|2@RB_HV;6 zONL_RDfZ@5_)l1aAJ7T_y}p6IXVRMH(o3~Hp|RYAu$V^nY!rA_R*K#2egE#@=*{lHVTiSo1Mk)T?qHaU3;~-fIf5nH&IEj;xb-8J!J`kAMn4YpI*bL? z9d@-csPL*aySUG|wwTu{aRT9th8MnwDNTL+8)D8=#R9Gfla5P-j=nj~aY6 z*jH5X^~Vx2YD9?(xVZb@)%y<$vfd&t}vP z6yAguPJcw55*4`G0YZVM0HEQF!(iXkNTzkUXa^qYq1YJ?A8AGU;qk%A>!ahd9rOF- z^_#N+!h!Sr>eb%y!R|oK`bX>9rcMTUUol^3XnHjYX3GV$+3HRnmA&Ba)3d#^pH6ol z{a^f*Cz8eR79Q!>unQyj#RG^qYBGzdJg4u|3?A9v@E@>wjt!V0`RCwodga)e-6;$I zb6`rciR!6n!=Flcg!BQw{HL1c#N1os+T1jiCd~YSBnw+OZJSDr;z?8}Uj>Y*yrML5 zNvnx`9sP(Wv>*vXg&9>p&gnT`?uL?G>WgEUX9gB9|BgY&28&<6kE+`3$g(<0LG@FB;f$vXv7Sj6U zI&Cf`Simi#0_b-&03qU3;I#{m>IR4lmZl07oO}cSgn9Ts9CKqe9nD;RPt}&{|=8z5`|x&N-1wE zUoACN$;5(I*ihBFtl?VXYs%SMoi<9KaSIT5)zt;XX)aQ#y&-Q3htO490YNfZO>$0` zc@oY@GNn;5Cu&Oeq+S+yQ?=nznlTMxn)za8%{b_LxT4Uc zL3((T`$)4by_)rKm>PGkk)FbL4 zafZ-ZF}CBPhY{_n+iEm0b&;yVUjelaRYlSHg&v^4@TcSaF9Mm~StzLG=l{*E&C%2P z{qOVV&%U1jAL9A&VfYPPviS~j=?ROeT%>e&u7)L?(H;0^i0gCsjdzG{=*T5p`x&&3 z3OrNJH*T0#%ceDKe)$dk2?HH)5N|pQ?Vl6(39glVkc9C3DgMdkr}<>U-owBz8&eF! z*XqXMH{O0dZqX!<;|2VdlUO_XlQc!R1MeSHw~pnd>OyIM3@NRI6we&_GfzjeFO*5Wm4A)8#D-y*>qpsKceK!NBD)oydDs(I8{E}w-e4eWH zHTZUSGuZY=8}Qf7;DtX@_>z>2S*^5(r=Lex*7cCR``-MwWGSVZ0!{#?`|Bd z*P5W+1L2nGJrbMGzqFySzL8zSPtL zw$@v1L+;R87zXB#!O{+IGTO!HiZFzX$9lI`e~cL_d^*QA4BzmWRtL4VHxEP@4wetx z&3ELJjHfiy`q?>=z*8HJu_H3$D>ouz2R22Z#a-q0x%GF#Z_c4({7$;@hw{TATiH{K64p2JqKxoHDxXxoL-!`cM*K=&7P zwz2*!Hed{}q#CCrL3_+OAdwt~%3slT=1JDA)6!QqNRLQO!}c^Xsf8BYgn z;v-qde9FSW+lvL?FgJJDP>#2af+f>fJGPorNKAfT09A17I0;PmOA<5rIqelP$48oKcRBJ+4@-3A#xbbl4H{~In)Vf^)8 zAvZ7Yie)VDj#isLIl;X;Nngg|N4gL{m(8`Z^O{Q3PKj#Tc%qu%Q67L3%hJ7vxA8Gs zrm(6Nb^Cgfltj`Dkp+Xnx^3f8NObc%yAI17?(c~~3k=r~#*`#3E~a_E2Tny_?P|uZ z*}A)l`s6v%zcpF90V$jbt41i(OA!FA#BIEb3%Y1jDMIJj8a7%+C6Hcc?IOTlqq-Ar z?_S8KM0ID^wTW%5r#4oasok$@yp~kAU6w<2`yR_S27}(zykzztHK*JRaY9{)b#I*% z@u)8uv}@_zmGrq)m|veyc5;og&sutHF5lNE~RsXF_~wch@v+t)93QK&x+C3mTgh@r93T1h$)6bBUVe}3J)rZ#ctOq(NiMl`t|De%YGXC9}O$#B)!9AKr8cqJ+0^edbTy%`pW+w;;H5T zG7J`p;1x;xvDXHR_=7W5ix5kgWF*FrvDZF&tr(@<6RoL!6r34gg71i+c%mG1yGRVy zA%JUONkkI~+g}7rtgnCP8tKj$zzX}17u(xg_4U8K^>zI}$kTK&#r#%-G6B%QSdbYr zIdv2s%%n^QEn3E!hQq04DhbXNioqe1_Tqy|&ZI&Gk-2Y+sCz}; zre#prQl*-r9+qfDZKte@4NW5aRiofC7??}QZjdjhJEySy4n?De!W%u5NorPiP?qiA zz8lr9M;Ddi{d;jz`>gK6DZHcyVT0J}7^XyqvzN}w>b z2yX!63MgyCT?CpnOtW@PQGPDOk3ZKmb_Tp^j7j~Vak$9m#{EmrT`y6{R6tR|NIzmm zww^r~`P@ad=s_PZ`gc%0jWf2bg6nFG%0Mnvc3i`6IhQVJeX7dG0jniYDO4kqRvh4~eHEoDYr_d(x~eV~ zb1P4J)SQ&n8sl7s#4d4h?>HUfJEvFBnJKGti?4z*VwTXlGFzZiN+4#&Nz^~>x@okb zP(eIx-}q{wXSFMV-{7x~EkjTnOxGi%bD+9+%|GB+=`gzYF$`VX`X6u*rlIJNF^Yh( z_eCsSLgF8AloEoY`tSg%4{?s7WBUFB1k*+?Z@VzokDLUM4lDVZ8|$~;G|gw$Gd(9&IF7M8xQ z+9kB`zQPc$mLRm_eZ?xGI-)vkQ!Z%MJ*qnCY#B*g)G^E`iC!o1q6lZ(56h~2*k(}V zs4X|Qs%@Z2U44xgvXE8pH0H68p-$Z7OZK73WqXr4NJAMBsn#l5@%=61^PSoUC;0pu zI%$4gdO28)Ce>0GjV6ld8A|{!gE#$w055`itYSh-7C?I@-ws;;{`KqcUmm{OJ2`oI zw7++D^!oVS{+q*t!{f7~y_ctLBhy0rLpMqA;07zYvNp?@za6leC?RM22Suom4hTPd zfL}RFV6ZXh>ccr?tpdzpCaWRae|dCxeD-et@XcA@(Q8XxeCtu{#o^lF?OF?cV76(K zZw+@Dx48$y0VvB?Va6+ zOn>EO+m_TDG6jt>4nEVr7d{C46OXG<$7Yms^vX8JTz@bsEjl^t%0}HpcKzBl)1|W{ zmo)3hIuCrP>Nrp>IT^Jo6v`CPT5Q+Zk}K4QiGdn6;+2-&RLgMP&&SIFqg@MtnYRyE zRwRMwSfeekmY$7V6X@!@;~VpxRi~iAGMf6_H}v=W)a^g4+vwd{f339t+S+_pxBu9F zG1~rW|M3t{jT71FcLh0gg-}f4*hGBj;q&^)sO{D1-`#~P(T|J5rdR77R0l>0+E{pn zsYjd3vt#FBauK&1d6Wo#2__wl{nMfzw_Os~Y|=hdA~kn3M5>plwVUH!jq8ij4g!<0 zX;v+BgYT<*3wk3qM75Sn)v9w<`MY7FP^oJyvzI|$0ZK>FF84D< z)D^v&Z~Si*F}e$)CS{sbcXff>EUe=WdTuGI6?3S=bJl8QpwzsTZ!ir*pJ8nuvd_)w zzCLYFegCfpb-5cUV3q&R)6Kg5_w&u|ul_#|^3-oO+rsphTWBTf{;KV`JMs@Qm49hl z%ali_4`t3~HVfij?DQJF4ujJZKSc^6pe|1)}4&;RiB>F6u}e~71PK3Pu<>+S+B$JZi) z4c%lmh?W$#EsP$C?&i$gGS?*r;BD}?*?`}Lt#QeAKKCSk!qZ&;Li!kYIgWkp;p8Ou zza1-BvHqVutNZ_KZEk+`|9+UKdGFL7^SUJpw95>}Y6X=Z+JEQc+sJqRoLso%c4HRN z(!j&Ye=QdFgBgwIftU?voL>wS-z-!F6L|`!L z(1G=7q?b>D9tTY5XDz>9Cx0U>&NF)ZyF2%Mce9Jcwp#r!_5QHegi9yC%NOFd{tnAq zzlrxlkCuA*LM(4*nP)`fX0>{Sr@eJ@JsIxxr8dZ>HLax+s-k>+liTSPNt;FoH}lQ1 z4Ypk+E^Tf3MPjGBYkg3fp`HABc(W_c<*~l(<3xBWVdxqAtC%BHKJV{|VJ!fZ#`|78 zk#u8Ccbh6zIb+u1VKWbpmiyS)0(CE&Wj;2xPP>A zUTa2O#_+H*Bc;trZ(6Umdh+^BSBtHRpcbo^E)({CtG;5}Y(~fV+;1)QUrn8H4XgPD zbqqfjjJjFEQk$JB?`*T+8GTVIsio(?G~;tBXEYc7oXU)a;#P;i74aXop4at1TU%Q% zzTW>o$Ws@E^fX(}@QNpjrB-7)+|(N2ej-QQ=Je@aiuyT52ykg!GnbnmI+wKcMV~&e zD4WjYUhU`%hOd51t)5Ho?J&A@8dpxxeV@SH+&^RjH?P2Ltj!T`M!Z!1G_3gk9>u$oBzT3(C-7Vb%iRLVUl7+yOCW`VYNRmyd z1mFKv@C1B6Q74y}XW;(^-@?$$!f+m<$C*1DU!4^n4)Ato#Wheg&^@<0TX05692c2H zL2}6GTpek(oA?Hty*$NZBru`N|CY0iM(ty?|L%v^r)Tdp*|d#N%>j02IDGV^P7>=o z_FXyJ>;JE|@$Ia%&48u;lbfNQ9+JldNT_*D7R|(BBiaBjUo!LV7fNe}zOdC)*wQDCITVhVL zDTOhYGpKEnY7D-u5t<l$|ipJQim-PkkKS_ZW@CPBvAxl2Lf9)C|+*Zvm<=KLt|M)zYj>7Zj@)i#%J^8+>@)^Bnaxj^JB+AwRdirdFu zK7M>$5p?WV9Nd5Z_m0UkL}BO#cU%@Wj&9DT?E8xU`-;MLk!9^xIT-kUlr8)$Pl}m! zpwj(xz!VbMUa|wJYorhXB#PWV`1n^E%DR~M$783<;*ePeOVTu6{7dmygIVou9Z$`3 zC-vR+3!39U#udR$_5T@<=}j*HR@wh=KYLNv|8GBk{#F0~5Kk{H-fg@9Z~&%1kZrOBn^(+_7i+12M>u6O?2hX0!+slB&>Rs4TzROkQO zqs_1J{~zS}Bk}+5O!D3To!bD9sZpw04!C6CJOF3kyzwxJ9K~a^?dX|Z%j zK+Cwc1eb65lwS69WKA!-QWm9`ZNiu~BSiCoS3IIcSb>h9a%IV?0eS6Up3&cO>V)nQ zl4oSv9ji{T-)Yk#y`z<3~5QYVrCSBtMlIOQvuQ`S|PO>6~N{)xBUv*2J z<)hsTN_R#z0JZc99YFM*@_y&j*7P-P>1JBekd(DE?G>c z^iYH(CZ$b!?Q>K(DORe}$fb`Rc>9ZIlNr9@T>g#4R4jy4>{{0{QRw!fwu;(q>mcK4 z<)i1rk4G^oOIEA2lw>-WFUx4!0o zd6=iS{pYRiId2{m^d=X74&4Sief>ZEn*Z@( zo?FC!y#E73tH0l{&UFlMw>(YsLp*U}RWv!%jp|lJjz9QW2Ac7CJCGz%#MB{$#LL1R z_N`n!=s-2ilMVbxlPKjZk(G>B9kR4`+1E_2H2ohMcuc8&n6gCD?9$DAW#9B6hGy+X zfVh5Oh%h55J!5mqbLTivdEEz~j&^PdRYsAb_fdU#Ga{%}t%hdo0LlrPbXp6d-Z#}q z#gSP*c!_SKEETJ_C68OvUwD;}(mUT!OrdQgqYks-V8zgC^J)m*HnV z_Elx5LAww&D3gKa+2T!Rym zkvOLDz-y)k@3p)vyT%&xJa)Oi!{Bcw+V@ z?QYU0-I2}KZNs#GN=WwGhhM)*sP$!m6IGM@im?aPd4@80qSGr|9xjnN5fba|bOcCb zEinYPNW}5ie zP`P5;*@Zljtit%w%KOoTV2*>GUA-@`>VBX~&?GuaBKlsHAyHIRX%rmODNBl?ZOuU= z$hOO)&#Mgn93H71?865*|8U;y;^W642tIrOk&hi1H+8}DkLMph2CEwvm!T^4s5P8z zP<*w+tR=exJ|`@}j@SgAOlAG#v$<}dEl(FNA|nUzTEzl-{Da1VwzOn!){84x^+z2~ zjO4wSO~pCxb_4jup|S43nT8pa$CO%ZcY8D4hI3ol76PnRtJSgVn!Z;uuaCFA^)mI; zV2|8WT~`%{%a+JJat>$J;^u>q)4NJFSk>y+m0R^Tocp8t2gR`cb!}IavG|cL#Lp!m zRuZ{X!;n`FQ1wx3J4o55*f|`-h4SmyOb`zUczY%Yhece_#RfdOB(bZ3pvfi6c%lwN zU8_dT{{>w%yLPfVs8(ANB0@>BmAAK#^4v(@bHnUIHIWypYwA|%kXpgIU7jLnF7Z3f zSJcw}$|SY9pl7n9(?fY0Sr3 z>&ucUW=0{BT~ai@aNd(7^41`sQ{2|!Nt)3Kdru=R4gA}B0I!pH0X)H)3M5Er1~E%$ z-~|V#?@lGpsJ90Dd_Lz1{Jeh(5zB-ZOqm?w|26ntF#bIo;{WZ7*>tG>XMc*zWLP#d zCgDY%VoDt0eG`bQ)cYnFlMC;gK+aR|oB#3F;AfICo(niSI22xB9G$#?MU)J6xs3nn zt-2@lp6~jj*Z-Tty@OYW!92Q`K9;Wk&C#~KdfY_$vM`!HYvSOTGvLM9odzf)iVg)0hIERKPzm8x%};1x@b zUfVkn0Xz(e&_-SH0>%p%=krvtkvzrBQkVMPFMz-C3{Z}hFrh@|85OYLIgpG3i7uI- zkzz@h=oNCIn&5c`Z*_k>Rp$eq{qh8_^LK{BDU-8&jFy6$sBMw;!1J(@x2qn{(@m5$ z=PU^rUspI2_<>Dla6+>Q&*mfvDZIwuMsTV{9gAoLc@ohK_EHkgD7<7LO$3F@tzZSfz#$sa~9F{0FDxiMPPHaokdgBvJB)_AQC|VU@Pn?RNtXEVS2Nq{7sJHU0vlYo9%M&vWENLUFwFdF5s}4?nhBV`9 zUU)(?OPHz+H5$0?;)NQV>Ou%SPa6@cMWMS@0|yyRd37x8ker{NkBOLhk2L2~1@XQ@ zUzk+JTl0vas-lPiyD9@&B&NG15HFEmwZkn3vpW` zLa=Ef%F3AoJ&=hW;0lo-0s;J&VR|GM90Zk$3ucgFqDD19*uZ$vO&;@wZ#!$yff`30 z3<#ON3E*`>7sB(tTNHCmRDT6cMMepMRYXxmZ}ejdxu8)1XB_w?%`z6z3f-v2Hy|ZK zQ$TA|0*C;TO_BHFIm5*$Sh5n-02LvWcIS&inY~e{pLgerLQ}kYrKk}?V;VIrdWlr1 z8ZH^Z3HQ9W`!*Ir$$BfSTJL|kpqbw1N}Gq_I$+cbB}1vbNp)7g+%)>nf;LuWK3wo_EHr?1jW*wr_ohTWwZ1#-!VTUOc8{y$kCUquld01K6L@@B%c; zDwnQe=~_Q7EaxzzSF$uXx3ib3{n(Utrrq3p0(4hX; z-m8~@!jDwcs?Jt;np6!Wmh_0uX$mpBpqklgX!3NLk%)pnF}R>TN)4)~0lcAF&@3_2 zFg+3LMefvah7m#(0ZVd0flekgl!50}7B!m8VEGvnXfwbk77VOg41Q(UY~gZ!pDU=+ zSnUJn&Rb1Bda=oz#1-CSn5nZtg)~#lE>x1X&de-lEQ=JcmJ8V56IT9H2so*;xtyuJ z7Y9LX7`1k}Y7(xn;aQ~|+OP=_c{o!`{&??9vw}A?Vj_T}i2_?#5ltx8QiTua@rq^? zeatgDWr_t`9RY!hgkL4Fzqf(gw9ImKc+j)cXo?$1Pc>+G5=kP_K1)G!D$dAD~QDx(H)VE{aU;Z8Kq|3G_*g zEG<{&Q7dumx-ywW&-G^NIq8VCT-Bc1Rv%)_Aoyq}Q^{#t4q@f>g+W1mFjC^gj*}v0 zGgg}6UhzDR^l;%(TA@*$;k$*o37it}aEs))D4~=FoY6)GJEq8E^~@sW>)|Dq!z14{ z6MBw&_IW7@8a$e7WXIf)RiPeu9?v{a@BGb5yDe2TK0hU_uTZYU@;xE)xhje~sI$$g zF^LrOa#`*ML^P%nchd4$R^+d(%P*#I*?&XZPH}9c0m-ZSAEVaMJ9f-2%UjP&B7xVX!sY8u^=>{^D7; zg+F@n-{(~fOT+ZObEs-Ss%_an&vOmuN0VbNPckZKBHI8jF?3AdR%7^*38@xWp}a9? z(rjUqS>F>%4M@)4{?cO|&cmY{t;B2C$6(loOh4mtEZ1S!1#$($zANz>=HcBf!thor zu)wgo4oCjz>Dg$@f41#EdtRSCw^%zQ=+H~U~%ai!?BTa*|Ylc$ts zIGqoSYhMhjX~9;bcn!zqe!k&y{u^4AEp)&zMD)33P=NG`eey znvk6TWi%Qs1G<8tlQv+57Q^CVYrxS75F60#?h#o6$$7%sXwxa;V%T3#W5bnwDSDdL zkoC(Hba2L})7Tgisck|Xqv%yJwI=t$-DA{*#Mpo>Dbj+W4o0)IT`PIlQIdrL5lNyU z&+vZ#9-qFFcZ=Wq3JiY|)ZN;(f4ue=LYEIB$z3DU0ZG3(tVhONefMhGWssad8;!nat90I#IW#9e3|P>$#o!#0q&yy;{Jf8v8GPJRbf!VOCg2V_9ox2T z+qTiMZKq?~M#nb3*y=B~ZQGN7X0JW7Pv)rBs)P6Rt*Yy}?~Umopdo|)DjIzAU4MlG zHq6Y$W+XfGRG6<_kReuBK46orvw-wfVwlu7rUo0UTTo&%%(rHz6I42Fei7Ni{by;P zridWpv%0F}&ai5EJLd}c2KVL90sYP80e&8Rbk$OMqJMj ziFlk_m)jg(@MlaI8s)Xy!4hJGBeQ_*oxE=6Wh7wzo1&$iWc6Imo{ca#Denyn(Db*D z@5*1-kqtJDEQ<%7p!{oyidP{qSqm5kjDcKcISIruQ-Bx*Z37L1h5*b|bU**zXP!0Z z*13DjF|_N7;|d6O{=t#NO$(-cYQa*ZVUn*E9MG3!14D%4T)hW{5yF5u?YYcvH{k|d zlw$jr_iJvh4QlPDyMi}6vSy!z079-WlZ$Y~L+1fMjg`-4#<{n@CS26|k(u~KSl*it z0!R7)v8$;4u26~5{=2j;Rwb34Z?L6 zSL6W6YnsrjrpIvgvB+kGY3%WV(68vKR=jhXvzCmy*Rw>~hs4EF;HG3I zH4sCA}=l&b*tyfteLzBXNr%X2TK`B zwPFobN^cGkcUiB&3~QW}_B%v&R8`s$5LStTE~iD{0)#+L2zSmOma8`!c$4 zou-Y*cpF=20>9U{-^Wh#3~_0Zr7FZHXj=F4i@H2Wd=WoD?T1tt~Sk3^25SR z+`5b23|N`xk^{A`k05WgjM%N*qs~bD3^wOq?AoBJXDBWIy&SaCmR%CK8pM*-oo$94 ziDQfLZ)4XRSjrUQ8;x%JFT#$aXzm)q58L->y3YZdn*YwdFKxx!KqOrWwpZHdS?zi- z7{Pj#x+26YPhrdT__xLGCqcDlm>JL|*j_~_ewTm68=c=b0M=HA=>(HhBos3C*=-ag-%r@x1^>BB7Jcan=V0-Pgk zm250MwyQUBkq+m?g{qgnR=2O_!qrqiP zZZ{9#8V~=nw{sm>*c;DUkaN*^KC`i5!qGdLLi)ZI$BGpz6MohHB5V1)Z=QN)pNP1p z2bB}-y4P(*{Jknwi?JlMuh<1~XW=;GA++7~g|1xSwyWv|t(a`^JF;!!s68ys;RS32}eFX5T>*P%|dKuE`;?s$GKjC=4?ewGF#mizq3< z^vvW%XPHh=?@KwxcP`<~b;Bf#GeVbzl*N5t1^M#=D*VC}w~kM|W5T~H3V`yAYxB~$ zwL%z!)d7R`;>gC!0@rgI9wM+JxigePJx6Nc?2PM2SbUuPz8Spr)XrZx<-(lV-T1otyJFOD{9{?nJrhIF^&Z9`nam1!sfb{LVqlCj&}+u`*wl}< zt4bV(p&(L0@>MO>SN!F&K53(CxC5INQDn|6*L29+eo-cykBrdHkG$2-v6WqapJngX z3#V{lM&WtJdOd-%5qM{{aR;9rK+P?cj*{1sxK=JH^;f<#rQS@6Pi{68xdaX|ou{~L zz0C7yrG>poiimtk@Q4m?TU)6TXVG#+whTgbV*}boPTHg&FNNF8b&yrg?krx6lUg42 z@-O;KI2pIDhiYCPv6$c=Q_n&PS^LQ4(CVJIBS8Pn6#9rU{lD3Ap-52+5{~EvWtAM@ zUHeNvMO}=OV+l#IbNEWOA#%ObUmI*VfL$YRIR#0R)< zZho-*^>&@!9&1Mda8DAk+HWc;U6x4!&5S0dX?U>8l)S3X!Ia6^D969dsXgo0pC(!Y zj+?1HPI@P|NvTBZJo=ojUK1sIIht)kERW6a1gTFgnu*$BIeB?z0+6P$uidIS#imxo z{usYTnolr6db-|HG$&^jvN?Ca1fKT=t64i_@0cc$7U-JGvpm%pP0p;}8?4{%`F7sr zf_%Br>(2WTrZ;($2GeshM)- z*aoPKq8o+laSi`MI!UGP6q>u3FA#pdM3BKH-yuz!}{qF_3m!|M-=ucPs z9#cKQ&m|VEO~11XL8l@yzAb+iJKA7@G*0kbcjbmoDCh7c<&t{s#4@I1e?#%om?D z;bHaJ=t{%#m)@z;!)v;A8*aGpDC(rz)_F3QbHcPj9|U!Q+Z=^xbOu081k>VbJE)Kx zmkb5pRI-c}O@}F)d$4T&6cwCY@H0!cqDVnhhR4>1XU3U; zV37qtY(86 zrbf==WNrshSGz)CrDTmr)&6_T9PWDV$2e>8;k+A4q(hMJ`S$_y>(b+D!7zz6wp?|; z!Z?!ydDtO|2nJbil6xMt+ZHGH=MG(chy%#(=3lCSa+VUP8*MG#1)!s9nw@@PI1CeM z0;mBU_ZDrpq3A%m$vnr8XYBE2CN=O~29L|QlVq|poZMI&svTZO06j;zku_t)qArv% ziwDG4&8KIL!oi(xx~MJl6eFDzTAt%h%o$au9A_t3CT%uN(kxJoK-P^FL+B)z93?ko z9`D|rG=6(S@D0kL#&FP~sm`eX*}Z zZRFSf@NS=64%6R(vb~W%M;{_LFQ!>r9 z;v(dH3?%BLr{_gt zqVqC5h)DCQj#emD4!Lavc;W+jWeL=vF6M?k=E2M442xDyVh8+aGhF|6>tKq7d)m)# z4$00&4+6x7mp7n}j1yzVt{#ZRUY8q2?O(hpv@k1KMgr;1>PZ@M!KwniQHsz*wPR`k zIwKWoaGJUEaO0K)51+-&BkC%EP`Rwi6wHPip)vs2tyV3aWJ;V!|bhPU-<5g%G z)g1zx5^gjU_g7+3yInl=4nr2V$AkeIq!Ho!D-^*@ZiV-5KjsWCk5@T1p}rd)=6Dtk zYvBMjc4xKL&wgL1VPX`?BK@=vXQxFe%M{7KFCTAX{jnJLrO#K!%Crq#ak}&ez7Jo5 z&NPyx3ijX$KgHu-^mF(-E>w^(DN=89KtxP2yXJ5v0r6(clI2jHi@rhXU6eYG5-nb# z9e;#Cg#$Vm0H?Ue{p$|xtvVi8JBqFRV%srkI+MD%KOHVSy&ZLV>bOcI&7ztk*;Cu7 zF*p*kbG zQmckpQ^on@_#4nK;#j`x#ayEB7B`=Mnda8e%tVnFAC6X)i>LlO=nskxVGyl)TD3|w zAT}2n3zN5qc)Sv$jZ{FvR8y1WqQJ9e#NlWh}~L-ynGa0?h#jaW*_#^+{ukKA$k0o7E!<8H72wReC0k6wX2 zliyStb6o6yqyO;?csx=6f6#0bLA}4fMaNiF%W>v?9qCzUH~ZHWB1XE z7-dLnPr3uS9~oT>)Vty~pdfD7!?+YPNiBDTHDesh2d2m>i#;IR{)##}Rd2@~@1|1p zX5x%@$e)#=oGpLP`8mL!(z7qXM9o;+VE^MJHExW(mzrY&i1uQ;=9)KS!RpoB74sD< zUi8{iG_$yv$KEQTv!?Ss4mNWq5W}8lYajOsUIaMySxADBY7mIwZ?ENcG8kn!LfUY2 zU(r#ST{@ES(IqJtthb?q-LfR8T>NT0Dq4N@fAzV0`3AiIa?BD0FR$BXPIjPHm3^C} zhfs+s_-5v!d*+!Th>`dnW(gC)K=!D^aN-Gs2`l-xVdhAe`Y0rh>I4PLKjglXim|9# zt6$rnf&5;!Xcj8LCgshgq++-Z44QKHDA80OMptf9v}6ZuWF3{ z#ADh&zVk7IBFc}Av92v(X<7JEbGxPRyxU^ME?r;(btka$7NJL}-)(@GHy@g{Z%f85 z9<0EM&FHBUc+HQ#Y%-8Nd>A$Bg|q=;=6~`3N(a&vUK9yNYdp~ZNx32Y9h(Q_!#wDm zdvtfPKlyAgmm73*`kt2WWpNo+^t;Gwc7h>wz56eA4}c{&}odDqAK#`%}+z@3ye#*%8rDVkU5A z5k9-^z~*L#6cY_^#z3|c-Tz&VC#u-C4lNFXyYqaJgWJwTt~j}pm9*sLVto=D5IiyncI7{WbN!lWlQ1|z2j ztyhhgty}?cj=KL5o0&Qr3jjHCv~03WEZ{FlLxsa5X3v<8CZFAL|3L17}h%6e7{ zOQsEjp7w^65N@Y62(RT^lKLCYrikD5f8kL1WwYV1q$nk-BF|=om*hTnS0* z?!qa@z?QEWRL6FCadB}w=H^ui(`!>-8Pm~927}LKaktjbQI(L4khH##-w4a~M;K}L zia}fL&c|G^B|sC@v)^yRbwqN)%%p0ip1ja%6UDZc@;@-?t45)J7gFJ24oTe{QOylA zCkuzjUN=cR=NNDG5V=fqN1cWa@(qzRxQR_Wu?DMT%_T`7u)FtepY7{G;rpq?pcJc8g(HU5UjhoAKqV zadMXC&`nw6)@jken*koUcb<(k&kQYap#}MH52eu5Hd^+@zVx!uc>DzN+W&_bA#I>>BAHA{Jog zJk^(VEByzr{2GeI^{c;tIjzN}L{O&kyU-jy5QDJOjDzXnN5nQy#M)B2n{4jB5V2SGT4cZOGoPO z8$kPAAV%RJ#KP6c4N=7hBf(-{%*jG$t%F7oF!3Y!Ew);wz!F6AyE0-gdCS4+gkWjdh;BXy=sEg?T6`}6<1808pzfDn3 z+1T9o@fNl51zTxqTago2jbbFk${zt{4XwGS)cuLzggBb3oidwe&8%MJzWO8-soQkznollUW>X^#&!_L!Ky+TA5-kc*WbmK`IDh|!R@av9S9M3 zh`sVh2xcB^YA@pmizZFHcq5e>J1-A;QG-&$=p`4C3!7^P{?w+?N_M(%z_cA_kt$K@ zNYjk;vZTxmIt|VO5zVMMF{IV3sE%gVngCtN=D#7)%6Wbs(8!NIsOr2dtO>_^MX{c$ z4zJZdKouLqO6aNfWjxRAH4?jGx&pKAQdK$(n2gtm1JPisYEz0F*#eC#a*w48GA=l1 z>$a5Wa*ifPl4RzS$eY$y!@H10sN$NbxFsBGvKvS1W$I}NQjr%PV6LXmo%hnEKE{a) zFYJi7x{%LkzGQL4h99rL=Lxi@18_jSfoij?VH+6SmEGY_cUL=Q02{+(SNTcLW zJsONuJ;B9>V{jsqAvvm7CNWgJ>9ppgDpb7pxg1FUaGPp&oz+q{X;1Nab0$E)ZT0pN zG%{iVmh++9Pt#I+{o40{HEjz_n{?CYG;}k zA5Iw|C(iBfY~y{y#k4xim`R2q2dKdDT;Ts}X5LtAlPR;m)x}A~azlv?BC`4N9TV@^o+eBZ4asJTR^xaT*sE+NU3B`pL&nsr=|AW=yC&pXLxVTchN&*x z30F+F5=&>MbHMi={^kZTtbH>m3~c3@!+uO!k~w@TK8cyB_Dr@;1;$1B85Gv=@<#46fN37y%EIZ$hj!>w${!PSg^t!C)j`3SH3 zKQ!oNs_nuEE0RfFQ&?dIav_x04G0-he4MP*HL~yl&&di6^L;g1F3Hr}v{Sh#OQGs0 z2#xf#xkWiS?*7Kc0JWz=yVKxNET4DI^{unK%EsP0gIKZ6t9jKHop$>EbXNu7gwCh) zwia8)h1WG16+ITUK)yCrH=|=;~Z`>Z7`0^;C#gA-EyT?AoEV`WO^R}%(7baG6 z1*(58K80aJ%?zOnkZ8VzAp}`(A=;#{&KXN)R1T$-G!wQXYgyx&Od4QTJ*bjs5Da zL-Qh;+mGm6z&+JXKwHm#_8B$5!mXqx70d4d5}STLa%4ZrEEX}EV8JP|1U+qPU}9++ zKxI+(Q+8`&oV^+Tg&dn=7rgPD=2yy;Zhlw?d7XY*MaaQKt9Xbiam^Fwt_J@Cc#Fzx zgNaGnmJ7o&ERe4`B|LV1m)g;}G_a_>0GTx5#$LLIuaE!I927_GD0|g3o&63c2Y3zB zHpm8O2Vsl%r!e`PV%6{1R~!mm~(RaKTMGM zRYyJqwJ#e8s12;$LGz=hmF!&v{31;avL{^mb9VvnS9HW^%xmoQC+f;$!7lufl^0Z} z@}Az~xzydwIVsLMk0P-jy%~#Z{-}mI-Z)?N6;D3sPhb z2mZIW$;>D-m--M9$=R4!Ubxi5mcs_K4UM1%u)dMnAA@Q{xD24R=>62MsL0txa1cpcynkJsPXZ~)w1wWwy@D|$c> zKciQAhQtn2=irFmh-r#FsqUvbxuMV>h^JOsIAUIAi7Z>e*+Qm47fz!gi~T%%BO|DG z(dwO4Cz4HFHL!y0Df`Kq$m>@`7DKBHRuIkrsM}D1CM1`;b&$DV}Aa zi^hQqWuw0+Fa#na|0*j3A64uBSjlT~!Y)6swpCKmY^YQO9zX)~;F?v%XJ-@f3=r!B z1ZI?AE<#KnOcU87QyA%!%sKB$ErQ&4B3`aHXJ>3z7@Jzw8wqvg2k1f&XW^xWPaA~+ z*ufK~*rrtCFoc=lczMrFL#$CmRpYGPeBWD;bR}PFNk+7xb<}gukAE@QgC`CKU`YFM z|NiRa^Gx6sv_Cmc?V}cI`-n@EaaHJFdu1(VNtBZUrW(#G3>FviFwA_6vFgzfF0`~Y z!S{<{x^mImLhQOFSn24lLI|T2`FXcBu>~U^_M1GO(zTytGQ9 z{22Z-i#UCg{~#Wj!W`qL>o$#*c9oR`xuRhSG86PtQvMzJYo8&UsqD~MEJ>P5ju^mp zs}b6m&)FSHyt5My`X5rYgEUYXXJU2*l2vy&L(r{ zbC@qoI(irjYr9;#8gY9RfbiquY^Lk#L95&0z#PzOsCDAvfoCwVu z#Sp>O;n*m1m~|^2W}?((5JozSu81xDtm3P^sjmY>V>ZQx(!@>?dsRenhL}sC zNR@|9$rUtctcbf&SW+6Lh@y#;VkTeoVTvX%n7Mh`7kmOfU0+7_oIZTKTi>$C!-JVW z@X;6hCLYNwnHtKk61*mZ9fl>B)mr@nWw-Ct=PmTy+ky>DR=ltC7#EC&A(t;Pm3YVt zvOZNK8FeR>QY4cmy|0yMhp5O@G3Nf3zbhECvZx*ET^g}P*_A`EtSDEbb2D;sK+NPG zF%ai%?r`WGRzc@M7A)8>JK?@zxab%f?gNzqms$ywcx0GWB-#XTn=?9Prr_m*n=*NY zu7@z#Nb+bWdV0NI1iN3>2LKh&FkapJG=^9L4orvi8>Owk&Uhx>ptY7KieV#p(PAsH zMIbiWCASi_rDcxXnX4ZKe1zn-Sc(2%>RY)-ZTLqQaswR^=zz9Oi7Y4#`^Mw9ifm7u z!!0L;7_@cAEJ%ZRIhTx!i*SWMn4pQN_nF{~w$#VX_z^(^C*L*bwm zX*VmSSjMoyP+dwy9y}rKTHK4IsH-&=r{i4sEJKnGN#KVi6D|p`4$|n~R6jjpXD#>Z zl)&aOC9|Mn<_q;^c((dJSS}gT39Zz%(eM-6M~dE{+uM<$Zw&^M;{%ofDH8+O;T^g7 za!&wnuIY@|lH((>gYiE}Rt{w5lj9=d2T=3r9cC5BkPIeU=GfdxR;8>vlLaj-5*mCb zPx9Qtt8N~Iq^oWmLKfcUjGXE!C40D-AZntCj3oTkDQi-tq`SDaY)gi^ z@=5bMgH5>L`|>j>G;H>KYw8l|sKQQg4x7jzH7|B-1Kf1lP@6w$0oF0q9VjAZKxwQ7 z=HEsNm*MeZj5Ok?mu;vsl+j{s*ZH0N++qQt4co^cvss{vN)PT|jyjB=B7GjRES@gX zBq4HT#2kX`o|`AMd1DMN(QX0s@?w8oA`2bRg^}xxN>s7oTe2VcfLKtHDtEy|69FVrC+Jj6`tLYXsn!riz0X_ugXL)eUGO-p6Y(^hrk<6+KT zy7}Vg8HTbj14)28J%J}k((kW>R=e-dtdCNO_4xSpv_pZg+xCsg;z&|jabxOOW19B= zEZk7A3^SOuH!|Y+M=()QpzvXvXmZ4PvI)ZAl+K=bW3Rz)RfSr11tn$owcs4~M&f6!ogbTB=MGTI-{v@~S1s}X} zQrTk8tmIe!I(?-XaztN9RROl1PGv?o9!^%?*1}vzH}ESZKxYksTxV*98t{p10nK!R zsQsMc;+$O>KL>@VnCHqLLOH5sQ*kwaXZ9r}6$6{2^g)DGJyF;CYd~U0Y~~6)(Ljw{uwwnk}7 zI({S<^XFkdb@U7K56@c5Dr>f#$R`$RHz5dl*mhqY(;N>7--`kY&NxedM%qfOqK$}V zBZnLQ@FV{n(I2lcms}S-EJUXU=N|M|z?GC54;`BM$LT=Es~;H#N=~jTOD~WH)`S+4q4=1nq(1vm+Ofl5hOZ?>>n=EgI?1+m;~AR3{$|m300zlI z`(vcJ1#SuL96X&vxuL@xbjE#U(pXV%n6imS(&o?fg7DinS?C4%YD7iiF*0Dldi+wp zoz^}uVWqGxycRMs&LdVi5Gy9+87WY1lxry{tjhD99UKa@oz!ya1Lz3v+8f#NV)N~X zHl0O|bj+!5led+}7G`Xd*iPn;01JbBh4{i$@xhb8pLs(81a3+RC8|!g94km>b#WVW z22TbAS6#eSb}`0@Hy6}KnHtE$iWx*OLxt&1Wi#EjcoJ|sXzC%`Kl(RF-2_KHWwCY_ zxOv@<7%O2IYGE5;76(8G_yt^Yd40M9o{{7uD1L26DAmM3ZV_%~A8v-r_Iot$g^#9U zd7)(KVPFJzW1AGRCG{V>6BP8^`QyXX_@uIAl+jJ7NJiNVu*`0@!H4OD4)74(tSe@q zy43_SVL{S@&htf#us%d^ozyy_cAB>JUG3rx^ONibg{*TXL6+3po#MI+$%~)IM584n_-2 z2SVW;X%i(ZM}J9rv!OUmhLnrp#F%L=l^fCNN&5@hDO*CEeL;k0-3p5!B6|=#XzT#h z0NOC78|DL4XEZ&}hh@@Ie>9BKbM((aqk81Us!-#49(O$dIP`@|n8!2dwM>D^h0E`J zg64nN%3J@62}QfpEUyZ`Bc8EtuHSsfR7{c`d!2Vc%!-+Nk>mmgl9J+GB_eY8{#L&bZW)m{uB%9yIRTB zhFycMTseM#h9k%X$+Qk*_3CNGka6Tj7E}qS%eT_7Vw~>PhaAfYP1tJ z*={z2%dDob3Uu8X$2 zgUYh_`=E5r3}ej$N<_ym`23p>!<}hKWgSFKk^R^_tpde^la|!w5fU)`#$2$#PM~!L z%*`o!;1H(VEZ58ZcsV`W-Ca6q;A2!}QcD%BwLnLI^9srBQ6 zi&9st1B-IAo+)d$tUd;5$TMA2Z@IHNL#TUPL+g3N+v_sHKD9&i95e^xBq_~GzApycQumQ1ff8uCp9n4V zSy&uuY;JCT@G$@Nxv{!R{RL=l?)qr`1TH=TAA#!rXE$3duWl#>X_WKz#0kD%gZU;FoUp`TBDSD}s$aS!1czM|b@PL)DbM;qEr%wXD)lKT0 zFNu#&;Kxf()X|It^p!T?qT-_4sk8wEg zDsggNmKgAkZuC=Z6)!SRcw&{T;1$(!{Nj1vZJ+n>`AgB7X<$XwD*b8U*%|%Swd^vx zOI$PV>ubjZ{YOp8G#I2R6(XXdV9&L!wALa>Yc6!xnBeKg6>-6sNGZiH!PJWydrER+ zP{&?S@|cxD#7v0LPRRCIY~xm4NIe6tp~-@B{{*8 zn?@tIkIQCy$rYDKYfUH=@s&E5b2dvL7!k$@Nv2FfyG;Vaa`Io3fXr$e*o7Y4bbO=uv@Wg-7=)+G0T`*$9ns5m~KU*fxK1JKl%`fv01my|E(X}+j z_YFYUtjh5NM}td<47)y2!i-Ijf4vjZivSrY;d6H&NBE@#@Th`-g^3F#%L6dVTLEx? znrrDl79|lW#x7?c9B|iCm9M3JAX#`Nu)4Q#GZgMbIZ>wiIT@6jtSTcf<#wTkW zo`8M}L(E}*DylCL_2VxgB!jYTq3^*}zhnyNzvVSWjd+qe273-c6}qEp&4z^_Z)qh* z_OJ7I{oq9(J;ojP{*`)FVKl3CU_EL%FVJfN^P-H0gi@bP}7Dludn^*u%e?{ zgjk@P9*a_k-mI(s+YnbYCK4Wd^R9NA zl^ousGqlIF7K&$iya3r}$Oy48GQy`gQt@`hBYs$h^7B{}z7yAKQ>bw(pgw}18xrox zpLd_vcuUCQ>izxt;N-=@9p(e3i_^=~r5o^}pc%lI&x~(Jlzk(T!SsvB*!Ow=Zp=@C zQ{O+nAX!p*H*iubjRVeo{PHz4j%6MtX>pF@mi#rX(_Mz_-nT8{lML|AFmuq3Sdpb| z_y?Tn2>Hb!Bm#{9o8ZSyDQf#$gE%kMoETUWeTmWZSv5@a#CNy$$=J-zi{K|e9~Y0i zA#NRz!Qc{);Jm|Up;nDr2Z$B0YQm0DWVt|@s6n5YR()*Jb^Oy0Vd@F!k9Aq|#qmDA zM;kp&(?qXdq}LSk>3|4Lncja=>?6WYN~NvQGviyZRoJ@6^${|+;I$0@u5Z{Em26C?8S%SNjSZesDs1T_W>k1U`7X>1b(IZLM! z+6U`BU|7^1svSlJRNZMG4*bte<8>k@WHGobYAdc|%X1%6y#zu?zmc)tI(Zfldo|1$ zO}hf!^qD&oXPo&*@|;P$J9=3@hkUWE=V0zf!xzie%6s@l5AU+x7NR$~kyY0Hq8Qda z>I10LO4J>t@S4Kc<`(S_%`bZ>5Zyn_qX2B5U)3}+eXfd=4i@ksk6qxuzF^G&#=$E; zagj%C8qKClDHviOzs%izv%WqiR_+Ei9>U;-d+>AN;^brFV)L$Qz=Yb=BPKVMPDVcI z-@=pwjRI3m5JONy923p)>iNTcBnzhzSTd~i(~G&S2qGf^@rAvs0XuDGz68K+T$imc`OZfBQ^g2*a$gIiI}aRpKxPt{6{im3en|ij^3Io&~7 zBBhym8f(SUaZPRo-xjhUr=-JX34Qd212Zb6qX|C!S%^G*3BpyFj%*B_A|=5`YlN-h zfKXYk^k*J?9KVNc{&pJA6+iVt;Q7e=^9w#V zj=+1XV8Vg@2Q42wN#Z}02A;jSU4^k9zDq%OD{nw9)Ozq_ig@>tcZAyYYFl1ai)%Otj8X%fI3!O38BckWbj{?i zU1RjtuWPHm!wtK{QK$yWn%eCOqEv{o9P|vyjyQjqj8Ys%<;TGFbCxDp$&AX_<9r?If;!R?t1z-hX6v6TZMltE}uG~HBt zO7!cdl^t!?pv4h;{^?PruF(TJH*BRM?1CL(5@bx0doMux=S{!PtSZ{ldQ!`h=|L*3 zZw(k#^amw^RZ1jB&=9;Iy(IkEeo@Pt0c$gbwiWmW{bI`DyQ#2k5mxuVl9K&}j#)Mn z`RYfaH2*djp3X6wvlY|sIA!dJwahOjXrb*n&em>!aS|g1s}no7j4MDC#pNN#t)(pP3Ek8X$KM8uLnFluWgBiJL zP0*sW0-Tu{SOrLKlB9Uk6Wy2Uz-saDT5dJ@J4)n`hXC&_u5F5@jf*F>d16DrZaZ=Dq9X^@yu`J^(q&Qy`=W!Qy{+01t6&7-a5IdclD0p^K zzX}l7g*YF7>qxjDzv`JY7&VcwxlbduMO9w&?r1s_A$>Z>LK3t(7(t2kaHd8XOr|(i zP$1#$K(hIk$&xZ?`Eiu3K*3ayoG`Np9{4I1wyNq}38ymhZ{#&! z_y>Sh6b5(Ak5vx-nItARItQi5IiyVj=Emp69txlN|h_R@ICQuScJJd_k2!BC12ic;JN>Dvqqn zURQ913r0@o7)WsyvfV*=W698{z{qXLGk-(Phj)|9T3+>fHzK3z`N%x97IIxMWm2nr z(rnu4sCK^#TrjAmZ_nOMPbWd|V!I4~Xj#kGm$uLS%RtxP>CeAYp7td(Auf-!6$o~W z{MO^w)1#93C9vY<#PHRVB(V$cH-WaUW~;6B(M66;xLS7r;aw`BtlrxpU=*smV3tNs zYBuMP4b@_>{Uj{TBzOY(rk8E5k{RkBX<@1@xvd-Q$S62V5#wwWdmFO*ET>YS7IZ@` zvySGWU^0ocj6@-2`>#X*f&RW!kG6C;Z4 z7a04Y=egZX9O8x}tlYK9mlkxwKM?&x;)I7b$QW$ngjHY^tX~w&N#w z-Qefm7*L+=b7bJ{&YwbIVF-0rvrSAGMMFDYiiHaZ4Va^qS;wX_mg+a0PfSU-lDkWg z%v8-&g0^9on;Gt~bsiS5#kOy*Di!8k%#VZUqRdD6a{=!X(L>&040ZFe&3TfRFs2L3 znnlsVS)LwhKp53?&D0_WJIr3raG9$l$w#zli6m;(jVI|i0PBx=cw#a}sah^9%QQgX z7tx&cZ+2B&3k4hb*L7u6P$ki+7#UjH=4lPN9p7xsIG+AVK{#xCXOI>B=fTC&0i40K zm@V??<1h#&h zXvZ;1nYo;4!O0NOOfojH8?7XQFG{KN{c9Ik2jj`#xWL;CmoH@NrAX97v;fKYd4#Op z3yC-_eioqxKFHxh-(Tz`%1dIdg^$pfIOY?y#+ASQ<2Htp%BC&b_gMcDvPCc&llzI6 z-C737{u=Gbw0m)YlycCDHk8{JHXK3oN}HQp*UqE9WePP_qkmM(9PvKK5Ld=2O?jOy zu4?Qv2<$cX)T1<0$8Rm;qOVXpY=@N9>NPs$gxljO(jY}fUbTj)<(w^|4GwQ!S_&FJ zf>qd0)S=5cR3e=`q?HuS5%q5xnZ9h8IZ|%Bf{)g~Rn>R}2OK=*Do|fFB~?pyA183i z9Bn7hnyQ?Tp2B6Z#&FLvd29OLj9pYQPeE&d)&?5D>4e%@GRwuq4@X#av-R}12ln}; zT3U20_Vi1oKUe)3mQ;RCeO^(zZfBQ4Nq9yBDn}cp%95Y8kRQ+lD2r3JNr8 zo@M-D_=vlp+uO{I#=vZ}v-sYOp1?s6{F!EN%jaH*m}X<`?tntn2ql5AWw?xJnKA_Tq6iL0jqTU zb3?Zj(%*vca8)a`s%JmR6C1_X{7F(j@;esh8b7@<+@>O_h54UFP*H}at1TK zu8MJ{k`{d+Wpej3O-p%s*}VRa&t6ye_d_$En=dnCH)kJ>|7q&JE9$}+=*TEvdE;Zb z3HJ^{vCWYq9ur?=RmURR_xTbGgSN!n8HqclgEQWDTQA{9C1NZFnh`3pZS^exfmjhFXS58_{qGhTP;gsz4EIm`yY7JGCaFZx(FZ_)Nv75u8~ zMic)SX&&g?bHohGU{X2#2N!DCoIVr&H)K+s)vD8GrAC)N!LDPu5u)08L{<$XES4d-TMf=W*$lfGVaP2DAKH5Fi zQRuRe@1dCOKJTf#^-B?0)N1(AJpXA8_$o8{s$cMTvj1|#P=G=y58;5~atPU$+|d;G zvDmrmpdWh7e&et=qw&OfZMwk6GeQM!m4P+6nN*aRO+On6Raju-X%bmf?Xurw%pOYdzbIHCg;Ng^EsT4DSP1HJG$5ql3VJ$Y}OOlr^K+d0~Y0>inY!`nbbqviUF!%zAC zerxO1N6*z^`DxCnvHp_iANGX4@Vxwfkv9r%?U3#}v*-SG3l4E4Hn?@V4-I3(D|so_ zvj$6h>64I&8#Bii?rRbSaw>Sq<|d5zaFaolvPC>Xk1?k$3Q|HLbJ1Z|GW^aE73|qI z>e(G1(cV?o+3`}rNifoT zmDDYY8wAei+vKVm0Lu#?iwgP7s#)XIx7n&cBx-9ProN(QV0Y1e_hY)SSiKuDYE5e& zOKGNRm6~^_Iw@+1aUrdrFe~|Qs(4xC?v06EX&PraHs1OqhYXu$skH9$s*#vc5y0A0 zxuPJaGsB++?Pyoi;FO7&7tPoL>rJK>2{P~LNwXI9hjj0U7H@*6v6?%Mw+5E8`ko=n zT^#z`av7*8LzWmnd&U0>R~xA0PQ90nGJHp`w5@wb`>OSdr~>XEx=P95wPe&K4G*mq zDQr$!?{&M?)04BN7Hb7THC8Q6ChYA_y=B`hXUF*5?ku%GO^tC4?filwhMzf%vRT4H zn;jc>)>-gueN!T-7W`k5(izF7Bxl}?WNGNL8!~}Q;y-LZuE>8L?rh!b|L^1}lR{#F z6=rxzV~$eom<~6!2KYRYBUa%)O{J)pLxccxcMIflbEb1aOW!p2`JRN6Y32@)>pgOB zi94+evMc8AR8L=-O||*b&&G@{T*jpf^tn0Ix=C7*Pi@gu3vRV+1YR3Yei_Bs?nGAj zkb55au6g9TJ#*Wfa+^MG!Y{XOuNBwarnQxL=l3+d2*Px+O)cLN`wQX{R9L0kWtKjL zU260cR+-1`x31@x-Gm{1w~_g~nYu?fn1wMaPzaiknD2aoGMr9GhCJ^rqcQTlm~$=> zO_BEwJw-ja3cZ;R9%tri+&e4Y-N5Ue71t2o1I=qIvIVCEN0H7XiZY5)GUF_*a1-yK z^A|&4BT>ji`FDAklAwN$_Fw;aGCY4RwoTm(l^kFPz25ppc}r{#)VpG~H~+uV#Wz@L zn}HVklQ$z0RAR!bC027#Db@v?>irCj2u?|QPA^Cd79quY(L77?tb(xKzFUl{IHmb> zJ|cb={q$}L)~YFcGXz%Cz~{ncZ{H!0AkRnMTjZsvYfjwv6*OdGri_>Q$~T1S`9e&l z)E)mjuJjr@pAs~tQAFQEMo2#m6OsRWP%7vlelcZJod#+q*lv_faVFEsOhcv;Ug0=E zK27E#Po-jf#OorFFMS`AG$oMJ#uu3_L=Vu$IE+YT6h`e5=c7u@NID^CM6)R>U6Onb zo|ZP6+yuyrD;yI`FtDruc?s$gc0?Y9&d^om&fsUsM-M(~<_~?0b$Bg{wJ0tPw*y-g z1~5QfRkf>Mb`l-NG`hk zpAH&D)W104wGTLp4W+X*CmoQLr!o>HBU&0-OAmv-@#G_ux31^;OM$5Ws(AHV zc~-;!5>3c#<;$*srT$+}%Jx5x9zVLr|9A4-3I5kuzJz1`EfM|Kh4mWF|D}IRv48&7 zBL2_TRyqF9qyF~2{okEDAKT`Cx_QXz#@J((v`rd6oYuuT`zuEZsF~NA;PN$}lFOEk ztjT3l%A(}5ju;bWgkV1Kk_JSF6=(=5SCq63$V-fQO5Wwf2;IXnn&L@wtU4C{Nvam< z6(c*dhG-Fzs2DqTgS;@L6lns&9+F#^K)c3r&}c!Nf?{7? z>fg=1T6Grn`Q?Sr_shFI;zH#mZCirLp$yJ&pH2kn6r+0el*>EX85G z8cDG1{;$M;-`?)`@9n?tWjuLf7t#{j+h!%@i$&nV4)2qVJgEaT`})RIx?_JX>K!fopyrHS>?@zBplFJ3qvdinG5 z$${gc;ovRwj1m4S>WoLQ3#~dVrxJ#3W8UD~VeKg43!?2+vYB|M+X( z)b*A$?GvdisMjvV$_7nA-C1slV|(OEA@9+ti(GdTZ2&&6ExRdoq2iX%^&Bfid_#R- zm6mPj-?eea^j9SFhKTfeTHk6LCfM-2pg4GjBOLoAbR zmqzB$+I46t)s4XXi!vy;4A-BeG^0L^2IzeMRBr)Dao0F!$25Q}FMRzgMPm7JbJGrb za@sT=^|3lH{1JZhM)v0-Jz~R2Au_eV(WyKs#tX5@Wq!vHb~kd!*WOt zYhi2~ik7HlA;S35SiSwT@cwUU-?{8rYX8}<=zkyH=YP4Ir?vg(%J!T$4+?q{#ot|# z1#ZnTcTHQ)Z|KaM&%*OBeW*V3`QLu>aI1X&ckc5)-p#W@{KwDFFx2|{^~zXB4sJzm zq8;F|5v!t#nQm0qB00WtUIta;^ELp9gCOKg3XT?qJ8WCoW^|C9=1B#9Byo_?FwU%u zR}HkZaM>5=tuX!X$??ci?H~=~jHH)l<}3B4&1R_9t^|l{Hw@;dI3efZjL_U*2dvj^ z2Gr2bila&i?C5u zh?Lg(hDy}Z&2qu5AZ=~9|1+GCaUQWx%KN3B#rJ=Ir~kN||MBsY?R)*-ojgtcA3?~n zG#up_3DiZs{wIyeKBwAE&YQm!r#4gNVj5J-r6h?$AD4;-X?RK4DM^ocuSRkEgH`8q zP#?U64)S7-qj)JxiR40Olmc`#MH}m?Z1HK+c&l63)I-Tf$P81*w#Y=D+ z4jBypjd+gHx!fc;SL%H=tlv^YN%|}tlrpGip zBRH7v1wl#}BTOn#Eh*_Sjmc-06@CtZm*;uQ(!rW{N<)VBp)4|NYghQK=?K)05YDK> zEX5g_%*Ajk!enDMeu45`yPA?J2QP7qC!pk20lC~$oZ=`Vk?T}bgSR?f3SC2uSst0# z-$3v;BW^x5)9vDr?>9>hbn^i5y6D};ftSN82lf|Rm-rVfpDBB7i-O!pQhsT!ch4n6 z-Dj8)xLI7wz}wvf0UVp+?MIJUJ~KhpJqW{q_8o}wGn_PbQJtv0#?*B6Wv)<`hO=Ql z9)};0`+MxRPqJ3-Tw2*^r#=&RmOhm{?`mq+q$rk5+U=xGx+R;fRl~G@N=WwA!>`{Y z)cT^piM+{uj@Y~QI-??ZqS0%(I9y_AL`W>R(-0srtci(eR4sB#p(44I@f{)8^GW$t zFJ~!~4yb=YQjf%0ItL+1mrX@%c;pSuVL%!rNoLCU*vL|`4R%o;XQ74o!ODAmj3LLt zU{~A=p?x3l5+n|e;(&bMWpEJaDwTpGG6`c{w5~Z+39@bC=r=Zke}mTf4fgRPdh_v3 zwTtWPZnyjKBVzf;7-L@)d~^Ng`ntQkadzqRQtP$hY`glanr1=S9ncvLW9TRxqm4;c z=6w2_a!Cfz-{NEKa4%r95_=V zqk>H-#dcSk={lI}%GPW^yIQG^I@ja_r+Gcl_Lj?(Q-iIWTwPNY1Ire`tsBglU0i;U zbb3>%3aVQE+S01m!Q39yuN1=i*QHxAi`dU(&VDU6qLs+S4nuA+P~};xW2DrhZw|w7 zq4;{A3E~b1UY`lVKoJ*Y-a+e^I5H&=B)$w&8gpi->D2J`zaaB!*G5(c-fB%kL{w~9 z>+R}Mo-65lZkTJ_O3U8%?|OY6{_)YCk+c2pXxFVRJ!#F&+K%a`-AiTih& zs{5cb-^yd^|1Jd*y1l?}@>#6^+unKfYvpg$O&~S!YsMmQH z8r$$j6|Y@sn2`(;L!>du2vZ6Z6bQch{gk9c4mM;c&Eq(XC%i$6{~oA%-H7@)f`*4A z(-z=B8g;}!=XlZq&Zs2I=_1gNh79G51RTOJ4nkk%&EZ`NA(9ZGOR140J;X6{5X$gm zfX)tI9PSMdyW3maTV8+L+j@Au^~l@#r?woO$22=l2_tc~(x~;^znS@O z&<6iYjAd;N33q4>jx_nix_u!?*z9uHWTL+Y==^%n`rh`V^X-S;){eLJxXsT4>wHFL??Mr8urYBG~D zh{e8@GC01wIwP_-6fbGi%FfjUtA?|5IErioa&bcebXEfo|L`EeDqcFzl+|hz0@Ydwj zh58CHrMTi#e?XFm&Y>lz_*;}Td=zOEh4JJUm9=1oKl~EoOB_a=I3A!a@ot!>oC@i0 zZT)9shlV# zyd))LmcVbOvk^%-KIWVz zLmM=X=HlS+xfAUf8wmF4CTtBI;esE|BGg1!q-P8`f{wv$h>`4bZeCnO!f;(j4+ef| ziT41xJ(Bs7=z-Tg*D(``+9hUw&vgu`n%ffuy;zK27(psxj*N*T^0sl>*h~O-iPMm8 zS~lP#U0Xv}2=oyAgGp1PE7XM)R^MNc`BQ!!%U1a(s5kIxpQiWxljyIAMq>A;HxVj5 zvR<*Oc0Il08tOI0X)y!4)b>{sKLy5VgVF`t}dVFa?`qFjma8McvDH09t-jvb| z1z`&EsX2N-4gD$7REE0S*p%i`AbvrTPypy?j3P45goAkpg&McP&B7ajDd0mity)d7 zwrC|F<1i)xG%?Fr#wQYU0@N!;M#s=1pgzuthvQI8b5qlW8bv~mjy0+j;uD0k4Es|- zVqn0ZjwM(bpuSb@Wf&iw7&=N#uNF2JJ5~kqA;EDVP$jP^h*;);=^byKPr&($A-@>l zMk;W&lL;FKx!fwc0zzwRXkSr!k{|-9T#|;DI3r!PwZL}C@A|388Og*;xb``c_2HzTCxHQrZO394CHU>sXNJe3nA23AU$7X4M3i;U_i79~H$ai6}z6xCw zyMa>~1@eH2$Rfty$_?KUnNz`%3(1vW0tG;`)&L-Hv1vkDbkud^O7P9YN~rJ<`a*{A zR?bTi&KwB=Faim#O)=IJj5#BzplfTs$O(C^JxPjwAOAWOLGxpkFXwY$ibI)l3ig%TFT%Xg4Jr4+W2(OS_nNxKMb zOp`0z1<=4Av=lRcv9sUvh9i1d39%k6T*o2Rwgqlbn#KLrpPJiX&9EEYv zMbG91Bc7p%(hGqlbwA9k-PQBJhkN=fXC4^BC2;_oo$!_ z6jW^xd+-e_>hpDn1~@X7=vmj-fgy^@z?m9(tbvIaSeav74s9l>K@v z+9JYR4xtB)4s#9lU^)?cz^C{DY|niu<{;=Op77~JBh0rW6`LraJ_wOu%y9VINl(;l zd9es)7RHlaC^`_^qO9G9SzFT@U>Cl7NghR#l5rhJHc(3@>r~)sQu+1~>2K|Eszy)} z;cQIPS@XKoR_yu$<;9aQ{!m*miTZ#4p?b?i)zX$Ug4kM{&;?VI&4$-{WQ!-6tc_{`U4M? z+yk`Lh5vdWb`|cQ4nkAP3V#Zq20iit&yt8pT>#>QV{yhj%Lc%zz=?W!5Q}Elgvg-2 zZGIp?DKB=DkUY}>Va91@eh!?QAr07s!s=d03oQc?zSm3(3J#Vw*We$eOcyDi43itp zD4OC+qOF3F3wU%z)13&GKOa%AbIF?(xa_;h=0`%uyx?7*%uO zxQ^W11!}X#I=M`a8g|Nkf#pr}WBF=q{dS~K8%wb^tVeNN9oy7gPMRqP=M|(jOdIj* zxh>G2Qg3MmI?PQJ&cf`5Y=BQ^NuCi;E6iZsEoHr}q@R%)=qPqLEoAchLZ*T6nBU`4 zYbIDD-lC-Wo7c;IIr?i-@BOtXo9lNj61KK}0XGiRf1fA8^d;fO2DuVj7dH zfWD6-ii4{>fqw*t2KTqnoW#O6YHbaj=II2&LrGA8i(m*xDZ#-UM?uZDqA@z&8zMhYpa>BOP7)Hcjv=D~Zd&XbPO?F- zSWqPh1PN|(IY8fo{^Y6K;k21lrYLy}|Ng&vF5wayha?iZj37X!Id!3?N=Za6B@izS z4Nn)HPYENUi9(x|V5WFKTBxQ4y}7|aiwp{4p$-i}O%>5O2^^z)$w2YTAN+1O;Ip%n--d^0 z1LV^2*mWGqq)Nk&x;+JK+M#6TmFQO3861Qx&A}SrSsqMCwwk#C@1GM>te4OLwCJ)? zDMPOIQ#;PG*@aL!4YdT1RL*xsVYjJ^Qmi^3LzmNz4+PSBphR*RMGv5_2fSTQAwS@B z%L6Un&tt8v>p+95p9hk@dZ2e(&Nwo(ohUg_qDxbReLf|^PECsU>S3r1SV&Mhpg6ND z0O1RVl{YIoQNvPb8l7ZQlD-ca=_oTfRRrf5^|aAMSJBOmBc(5b(R?X>ARh~piV;y) zMu6rdTdMU58OsUlJ=yu^!{SDlW>1a8MLANF7H8PedrUz|5h|+)=Ow=tfs-C?G5M|( zz^K2)gq-ty|3Gj3rLb{|!qRB5jP*cEKZ8r*00i_!1S!760$PFlq}IFZ@H%#^DM5=T zIGdiPWE_5w7nV;`62xFvV!zi`0hJeuF#6J_pZCxGbN~FCKmRWP0RR8?B+!olfCB*5 CnseR& diff --git a/packs/minio-8.0.10/charts/minio/.helmignore b/packs/minio-8.0.10/charts/minio/.helmignore deleted file mode 100644 index a9fe7278..00000000 --- a/packs/minio-8.0.10/charts/minio/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -# OWNERS file for Kubernetes -OWNERS \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio/Chart.yaml b/packs/minio-8.0.10/charts/minio/Chart.yaml deleted file mode 100644 index 80ad23fa..00000000 --- a/packs/minio-8.0.10/charts/minio/Chart.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1 -appVersion: master -description: High Performance, Kubernetes Native Object Storage -home: https://min.io -icon: https://min.io/resources/img/logo/MINIO_wordmark.png -keywords: -- storage -- object-storage -- S3 -maintainers: -- email: dev@minio.io - name: MinIO, Inc -name: minio -sources: -- https://github.com/minio/minio -version: 8.0.9 diff --git a/packs/minio-8.0.10/charts/minio/README.md b/packs/minio-8.0.10/charts/minio/README.md deleted file mode 100644 index 30a7c6b8..00000000 --- a/packs/minio-8.0.10/charts/minio/README.md +++ /dev/null @@ -1,414 +0,0 @@ -> NOTE: This helm chart is in code freeze i.e we will only update MinIO releases occastionally by bumping up the version. For latest features you are advised to start using our [MinIO operator](https://github.com/minio/operator). - -MinIO -===== - -[MinIO](https://min.io) is a High Performance Object Storage released under Apache License v2.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads. - -MinIO supports [distributed mode](https://docs.minio.io/docs/distributed-minio-quickstart-guide). In distributed mode, you can pool multiple drives (even on different machines) into a single object storage server. - -For more detailed documentation please visit [here](https://docs.minio.io/) - -Introduction ------------- - -This chart bootstraps MinIO deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. - -Prerequisites -------------- - -- Kubernetes 1.4+ with Beta APIs enabled for default standalone mode. -- Kubernetes 1.5+ with Beta APIs enabled to run MinIO in [distributed mode](#distributed-minio). -- PV provisioner support in the underlying infrastructure. - -Configure MinIO Helm repo --------------------- -```bash -$ helm repo add minio https://helm.min.io/ -``` - -Installing the Chart --------------------- - -Install this chart using: - -```bash -$ helm install --namespace minio --generate-name minio/minio -``` - -The command deploys MinIO on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. - -### Release name - -An instance of a chart running in a Kubernetes cluster is called a release. Each release is identified by a unique name within the cluster. Helm automatically assigns a unique release name after installing the chart. You can also set your preferred name by: - -```bash -$ helm install my-release minio/minio -``` - -### Access and Secret keys - -By default a pre-generated access and secret key will be used. To override the default keys, pass the access and secret keys as arguments to helm install. - -```bash -$ helm install --set accessKey=myaccesskey,secretKey=mysecretkey --generate-name minio/minio -``` - -### Updating MinIO configuration via Helm - -[ConfigMap](https://kubernetes.io/docs/user-guide/configmap/) allows injecting containers with configuration data even while a Helm release is deployed. - -To update your MinIO server configuration while it is deployed in a release, you need to - -1. Check all the configurable values in the MinIO chart using `helm inspect values minio/minio`. -2. Override the `minio_server_config` settings in a YAML formatted file, and then pass that file like this `helm upgrade -f config.yaml minio/minio`. -3. Restart the MinIO server(s) for the changes to take effect. - -You can also check the history of upgrades to a release using `helm history my-release`. Replace `my-release` with the actual release name. - -### Installing certificates from third party CAs - -MinIO can connect to other servers, including MinIO nodes or other server types such as NATs and Redis. If these servers use certificates that were not registered with a known CA, add trust for these certificates to MinIO Server by bundling these certificates into a Kubernetes secret and providing it to Helm via the `trustedCertsSecret` value. If `.Values.tls.enabled` is `true` and you're installing certificates for third party CAs, remember to include Minio's own certificate with key `public.crt`, if it also needs to be trusted. - -For instance, given that TLS is enabled and you need to add trust for Minio's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`: - -``` -kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt -``` - -If TLS is not enabled, you would need only the third party CA: - -``` -kubectl -n minio create secret generic minio-trusted-certs --from-file=keycloak.crt -``` - -The name of the generated secret can then be passed to Helm using a values file or the `--set` parameter: - -``` -trustedCertsSecret: "minio-trusted-certs" - -or - ---set trustedCertsSecret=minio-trusted-certs -``` - -Uninstalling the Chart ----------------------- - -Assuming your release is named as `my-release`, delete it using the command: - -```bash -$ helm delete my-release -``` - -or - -```bash -$ helm uninstall my-release -``` - -The command removes all the Kubernetes components associated with the chart and deletes the release. - -Upgrading the Chart -------------------- - -You can use Helm to update MinIO version in a live release. Assuming your release is named as `my-release`, get the values using the command: - -```bash -$ helm get values my-release > old_values.yaml -``` - -Then change the field `image.tag` in `old_values.yaml` file with MinIO image tag you want to use. Now update the chart using - -```bash -$ helm upgrade -f old_values.yaml my-release minio/minio -``` - -Default upgrade strategies are specified in the `values.yaml` file. Update these fields if you'd like to use a different strategy. - -Configuration -------------- - -The following table lists the configurable parameters of the MinIO chart and their default values. - -| Parameter | Description | Default | -|:-------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------| -| `nameOverride` | Provide a name in place of `minio` | `""` | -| `fullnameOverride` | Provide a name to substitute for the full names of resources | `""` | -| `image.repository` | Image repository | `minio/minio` | -| `image.tag` | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/). | `RELEASE.2020-11-06T23-17-07Z` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `imagePullSecrets` | List of container registry secrets | `[]` | -| `mcImage.repository` | Client image repository | `minio/mc` | -| `mcImage.tag` | mc image tag. Possible values listed [here](https://hub.docker.com/r/minio/mc/tags/). | `RELEASE.2020-10-03T02-54-56Z` | -| `mcImage.pullPolicy` | mc Image pull policy | `IfNotPresent` | -| `ingress.enabled` | Enables Ingress | `false` | -| `ingress.labels ` | Ingress labels | `{}` | -| `ingress.annotations` | Ingress annotations | `{}` | -| `ingress.hosts` | Ingress accepted hostnames | `[]` | -| `ingress.tls` | Ingress TLS configuration | `[]` | -| `trustedCertsSecret` | Kubernetes secret with trusted certificates to be mounted on `{{ .Values.certsPath }}/CAs` | `""` | -| `mode` | MinIO server mode (`standalone` or `distributed`) | `standalone` | -| `extraArgs` | Additional command line arguments to pass to the MinIO server | `[]` | -| `replicas` | Number of nodes (applicable only for MinIO distributed mode). | `4` | -| `zones` | Number of zones (applicable only for MinIO distributed mode). | `1` | -| `drivesPerNode` | Number of drives per node (applicable only for MinIO distributed mode). | `1` | -| `existingSecret` | Name of existing secret with access and secret key. | `""` | -| `accessKey` | Default access key (5 to 20 characters) | random 20 chars | -| `secretKey` | Default secret key (8 to 40 characters) | random 40 chars | -| `certsPath` | Default certs path location | `/etc/minio/certs` | -| `configPathmc` | Default config file location for MinIO client - mc | `/etc/minio/mc` | -| `mountPath` | Default mount location for persistent drive | `/export` | -| `bucketRoot` | Directory from where minio should serve buckets. | Value of `.mountPath` | -| `clusterDomain` | domain name of kubernetes cluster where pod is running. | `cluster.local` | -| `service.type` | Kubernetes service type | `ClusterIP` | -| `service.port` | Kubernetes port where service is exposed | `9000` | -| `service.externalIPs` | service external IP addresses | `nil` | -| `service.annotations` | Service annotations | `{}` | -| `serviceAccount.create` | Toggle creation of new service account | `true` | -| `serviceAccount.name` | Name of service account to create and/or use | `""` | -| `persistence.enabled` | Use persistent volume to store data | `true` | -| `persistence.size` | Size of persistent volume claim | `500Gi` | -| `persistence.existingClaim` | Use an existing PVC to persist data | `nil` | -| `persistence.storageClass` | Storage class name of PVC | `nil` | -| `persistence.accessMode` | ReadWriteOnce or ReadOnly | `ReadWriteOnce` | -| `persistence.subPath` | Mount a sub directory of the persistent volume if set | `""` | -| `resources.requests.memory` | Memory resource requests | Memory: `4Gi` | -| `priorityClassName` | Pod priority settings | `""` | -| `securityContext.enabled` | Enable to run containers as non-root. NOTE: if `persistence.enabled=false` then securityContext will be automatically disabled | `true` | -| `securityContext.runAsUser` | User id of the user for the container | `1000` | -| `securityContext.runAsGroup` | Group id of the user for the container | `1000` | -| `securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | -| `nodeSelector` | Node labels for pod assignment | `{}` | -| `affinity` | Affinity settings for pod assignment | `{}` | -| `tolerations` | Toleration labels for pod assignment | `[]` | -| `podAnnotations` | Pod annotations | `{}` | -| `podLabels` | Pod Labels | `{}` | -| `tls.enabled` | Enable TLS for MinIO server | `false` | -| `tls.certSecret` | Kubernetes Secret with `public.crt` and `private.key` files. | `""` | -| `defaultBucket.enabled` | If set to true, a bucket will be created after MinIO install | `false` | -| `defaultBucket.name` | Bucket name | `bucket` | -| `defaultBucket.policy` | Bucket policy | `none` | -| `defaultBucket.purge` | Purge the bucket if already exists | `false` | -| `defaultBucket.versioning` | Enable / Suspend versioning for bucket | `nil` | -| `buckets` | List of buckets to create after MinIO install | `[]` | -| `makeBucketJob.annotations` | Additional annotations for the Kubernetes Batch (make-bucket-job) | `""` | -| `makeBucketJob.podAnnotations` | Additional annotations for the pods of the Kubernetes Batch (make-bucket-job) | `""` | -| `makeBucketJob.securityContext.enabled` | Enable to run Kubernetes Batch (make-bucket-job) containers as non-root. | `false` | -| `makeBucketJob.securityContext.runAsUser` | User id of the user for the container | `1000` | -| `makeBucketJob.securityContext.runAsGroup` | Group id of the user for the container | `1000` | -| `makeBucketJob.securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | -| `makeBucketJob.resources.requests.memory` | Memory resource requests for 'make bucket' job | `128Mi` | -| `updatePrometheusJob.podAnnotations` | Additional annotations for the pods of the Kubernetes Batch (update-prometheus-secret) | `""` | -| `updatePrometheusJob.securityContext.enabled` | Enable to run Kubernetes Batch (update-prometheus-secret) containers as non-root. | `false` | -| `updatePrometheusJob.securityContext.runAsUser` | User id of the user for the container | `1000` | -| `updatePrometheusJob.securityContext.runAsGroup` | Group id of the user for the container | `1000` | -| `updatePrometheusJob.securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | -| `s3gateway.enabled` | Use MinIO as a [s3 gateway](https://github.com/minio/minio/blob/master/docs/gateway/s3.md) | `false` | -| `s3gateway.replicas` | Number of s3 gateway instances to run in parallel | `4` | -| `s3gateway.serviceEndpoint` | Endpoint to the S3 compatible service | `""` | -| `s3gateway.accessKey` | Access key of S3 compatible service | `""` | -| `s3gateway.secretKey` | Secret key of S3 compatible service | `""` | -| `azuregateway.enabled` | Use MinIO as an [azure gateway](https://docs.minio.io/docs/minio-gateway-for-azure) | `false` | -| `azuregateway.replicas` | Number of azure gateway instances to run in parallel | `4` | -| `gcsgateway.enabled` | Use MinIO as a [Google Cloud Storage gateway](https://docs.minio.io/docs/minio-gateway-for-gcs) | `false` | -| `gcsgateway.gcsKeyJson` | credential json file of service account key | `""` | -| `gcsgateway.projectId` | Google cloud project id | `""` | -| `nasgateway.enabled` | Use MinIO as a [NAS gateway](https://docs.MinIO.io/docs/minio-gateway-for-nas) | `false` | -| `nasgateway.replicas` | Number of NAS gateway instances to be run in parallel on a PV | `4` | -| `environment` | Set MinIO server relevant environment variables in `values.yaml` file. MinIO containers will be passed these variables when they start. | `MINIO_STORAGE_CLASS_STANDARD: EC:4"` | -| `metrics.serviceMonitor.enabled` | Set this to `true` to create ServiceMonitor for Prometheus operator | `false` | -| `metrics.serviceMonitor.additionalLabels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` | -| `metrics.serviceMonitor.namespace` | Optional namespace in which to create ServiceMonitor | `nil` | -| `metrics.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `nil` | -| `metrics.serviceMonitor.scrapeTimeout` | Scrape timeout. If not set, the Prometheus default scrape timeout is used | `nil` | -| `metrics.serviceMonitor.relabelConfigs` | Relabel configs that can be used on Endpoints | `{}` | -| `etcd.endpoints` | Endpoints of etcd | `[]` | -| `etcd.pathPrefix` | Prefix for all etcd keys | `""` | -| `etcd.corednsPathPrefix` | Prefix for all CoreDNS etcd keys | `""` | -| `etcd.clientCert` | Certificate used for SSL/TLS connections to etcd [(etcd Security)](https://etcd.io/docs/latest/op-guide/security/) | `""` | -| `etcd.clientCertKey` | Key for the certificate [(etcd Security)](https://etcd.io/docs/latest/op-guide/security/) | `""` | - -Some of the parameters above map to the env variables defined in the [MinIO DockerHub image](https://hub.docker.com/r/minio/minio/). - -You can specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, - -```bash -$ helm install --name my-release --set persistence.size=1Ti minio/minio -``` - -The above command deploys MinIO server with a 1Ti backing persistent volume. - -Alternately, you can provide a YAML file that specifies parameter values while installing the chart. For example, - -```bash -$ helm install --name my-release -f values.yaml minio/minio -``` - -> **Tip**: You can use the default [values.yaml](minio/values.yaml) - -Distributed MinIO ------------ - -This chart provisions a MinIO server in standalone mode, by default. To provision MinIO server in [distributed mode](https://docs.minio.io/docs/distributed-minio-quickstart-guide), set the `mode` field to `distributed`, - -```bash -$ helm install --set mode=distributed minio/minio -``` - -This provisions MinIO server in distributed mode with 4 nodes. To change the number of nodes in your distributed MinIO server, set the `replicas` field, - -```bash -$ helm install --set mode=distributed,replicas=8 minio/minio -``` - -This provisions MinIO server in distributed mode with 8 nodes. Note that the `replicas` value should be a minimum value of 4, there is no limit on number of servers you can run. - -You can also expand an existing deployment by adding new zones, following command will create a total of 16 nodes with each zone running 8 nodes. - -```bash -$ helm install --set mode=distributed,replicas=8,zones=2 minio/minio -``` - -### StatefulSet [limitations](http://kubernetes.io/docs/concepts/abstractions/controllers/statefulsets/#limitations) applicable to distributed MinIO - -1. StatefulSets need persistent storage, so the `persistence.enabled` flag is ignored when `mode` is set to `distributed`. -2. When uninstalling a distributed MinIO release, you'll need to manually delete volumes associated with the StatefulSet. - -NAS Gateway ------------ - -### Prerequisites - -MinIO in [NAS gateway mode](https://docs.minio.io/docs/minio-gateway-for-nas) can be used to create multiple MinIO instances backed by single PV in `ReadWriteMany` mode. Currently few [Kubernetes volume plugins](https://kubernetes.io/docs/user-guide/persistent-volumes/#access-modes) support `ReadWriteMany` mode. To deploy MinIO NAS gateway with Helm chart you'll need to have a Persistent Volume running with one of the supported volume plugins. [This document](https://kubernetes.io/docs/user-guide/volumes/#nfs) -outlines steps to create a NFS PV in Kubernetes cluster. - -### Provision NAS Gateway MinIO instances - -To provision MinIO servers in [NAS gateway mode](https://docs.minio.io/docs/minio-gateway-for-nas), set the `nasgateway.enabled` field to `true`, - -```bash -$ helm install --set nasgateway.enabled=true minio/minio -``` - -This provisions 4 MinIO NAS gateway instances backed by single storage. To change the number of instances in your MinIO deployment, set the `replicas` field, - -```bash -$ helm install --set nasgateway.enabled=true,nasgateway.replicas=8 minio/minio -``` - -This provisions MinIO NAS gateway with 8 instances. - -Persistence ------------ - -This chart provisions a PersistentVolumeClaim and mounts corresponding persistent volume to default location `/export`. You'll need physical storage available in the Kubernetes cluster for this to work. If you'd rather use `emptyDir`, disable PersistentVolumeClaim by: - -```bash -$ helm install --set persistence.enabled=false minio/minio -``` - -> *"An emptyDir volume is first created when a Pod is assigned to a Node, and exists as long as that Pod is running on that node. When a Pod is removed from a node for any reason, the data in the emptyDir is deleted forever."* - -Existing PersistentVolumeClaim ------------------------------- - -If a Persistent Volume Claim already exists, specify it during installation. - -1. Create the PersistentVolume -2. Create the PersistentVolumeClaim -3. Install the chart - -```bash -$ helm install --set persistence.existingClaim=PVC_NAME minio/minio -``` - -NetworkPolicy -------------- - -To enable network policy for MinIO, -install [a networking plugin that implements the Kubernetes -NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), -and set `networkPolicy.enabled` to `true`. - -For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting -the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace: - - kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" - -With NetworkPolicy enabled, traffic will be limited to just port 9000. - -For more precise policy, set `networkPolicy.allowExternal=true`. This will -only allow pods with the generated client label to connect to MinIO. -This label will be displayed in the output of a successful install. - -Existing secret ---------------- - -Instead of having this chart create the secret for you, you can supply a preexisting secret, much -like an existing PersistentVolumeClaim. - -First, create the secret: -```bash -$ kubectl create secret generic my-minio-secret --from-literal=accesskey=foobarbaz --from-literal=secretkey=foobarbazqux -``` - -Then install the chart, specifying that you want to use an existing secret: -```bash -$ helm install --set existingSecret=my-minio-secret minio/minio -``` - -The following fields are expected in the secret: - -| .data. in Secret | Corresponding variable | Description | -|:---------------------------|:------------------------|:----------------------------------------------------------------------------------| -| `accesskey` | `accessKey` | Access key ID. Mandatory. | -| `secretkey` | `secretKey` | Secret key. Mandatory. | -| `gcs_key.json` | `gcsgateway.gcsKeyJson` | GCS key if you are using the GCS gateway feature. Optional | -| `awsAccessKeyId` | `s3gateway.accessKey` | S3 access key if you are using the S3 gateway feature. Optional | -| `awsSecretAccessKey` | `s3gateway.secretKey` | S3 secret key if you are using the S3 gateway feature. Optional | -| `etcd_client_cert.pem` | `etcd.clientCert` | Certificate for SSL/TLS connections to etcd. Optional | -| `etcd_client_cert_key.pem` | `etcd.clientCertKey` | Corresponding key for certificate above. Mandatory when etcd certificate defined. | - -All corresponding variables will be ignored in values file. - -Configure TLS -------------- - -To enable TLS for MinIO containers, acquire TLS certificates from a CA or create self-signed certificates. While creating / acquiring certificates ensure the corresponding domain names are set as per the standard [DNS naming conventions](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-identity) in a Kubernetes StatefulSet (for a distributed MinIO setup). Then create a secret using - -```bash -$ kubectl create secret generic tls-ssl-minio --from-file=path/to/private.key --from-file=path/to/public.crt -``` - -Then install the chart, specifying that you want to use the TLS secret: - -```bash -$ helm install --set tls.enabled=true,tls.certSecret=tls-ssl-minio minio/minio -``` - -Pass environment variables to MinIO containers ----------------------------------------------- - -To pass environment variables to MinIO containers when deploying via Helm chart, use the below command line format - -```bash -$ helm install --set environment.MINIO_BROWSER=on,environment.MINIO_DOMAIN=domain-name minio/minio -``` - -You can add as many environment variables as required, using the above format. Just add `environment.=` under `set` flag. - -Create buckets after install ---------------------------- - -Install the chart, specifying the buckets you want to create after install: - -```bash -$ helm install --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false minio/minio -``` - -Description of the configuration parameters used above - - -- `buckets[].name` - name of the bucket to create, must be a string with length > 0 -- `buckets[].policy` - can be one of none|download|upload|public -- `buckets[].purge` - purge if bucket exists already diff --git a/packs/minio-8.0.10/charts/minio/ci/distributed-values.yaml b/packs/minio-8.0.10/charts/minio/ci/distributed-values.yaml deleted file mode 100644 index e6c46738..00000000 --- a/packs/minio-8.0.10/charts/minio/ci/distributed-values.yaml +++ /dev/null @@ -1 +0,0 @@ -mode: distributed diff --git a/packs/minio-8.0.10/charts/minio/minio/.helmignore b/packs/minio-8.0.10/charts/minio/minio/.helmignore deleted file mode 100644 index a9fe7278..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*~ -# Various IDEs -.project -.idea/ -*.tmproj -# OWNERS file for Kubernetes -OWNERS \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio/minio/Chart.yaml b/packs/minio-8.0.10/charts/minio/minio/Chart.yaml deleted file mode 100644 index 80ad23fa..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/Chart.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1 -appVersion: master -description: High Performance, Kubernetes Native Object Storage -home: https://min.io -icon: https://min.io/resources/img/logo/MINIO_wordmark.png -keywords: -- storage -- object-storage -- S3 -maintainers: -- email: dev@minio.io - name: MinIO, Inc -name: minio -sources: -- https://github.com/minio/minio -version: 8.0.9 diff --git a/packs/minio-8.0.10/charts/minio/minio/README.md b/packs/minio-8.0.10/charts/minio/minio/README.md deleted file mode 100644 index 30a7c6b8..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/README.md +++ /dev/null @@ -1,414 +0,0 @@ -> NOTE: This helm chart is in code freeze i.e we will only update MinIO releases occastionally by bumping up the version. For latest features you are advised to start using our [MinIO operator](https://github.com/minio/operator). - -MinIO -===== - -[MinIO](https://min.io) is a High Performance Object Storage released under Apache License v2.0. It is API compatible with Amazon S3 cloud storage service. Use MinIO to build high performance infrastructure for machine learning, analytics and application data workloads. - -MinIO supports [distributed mode](https://docs.minio.io/docs/distributed-minio-quickstart-guide). In distributed mode, you can pool multiple drives (even on different machines) into a single object storage server. - -For more detailed documentation please visit [here](https://docs.minio.io/) - -Introduction ------------- - -This chart bootstraps MinIO deployment on a [Kubernetes](http://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. - -Prerequisites -------------- - -- Kubernetes 1.4+ with Beta APIs enabled for default standalone mode. -- Kubernetes 1.5+ with Beta APIs enabled to run MinIO in [distributed mode](#distributed-minio). -- PV provisioner support in the underlying infrastructure. - -Configure MinIO Helm repo --------------------- -```bash -$ helm repo add minio https://helm.min.io/ -``` - -Installing the Chart --------------------- - -Install this chart using: - -```bash -$ helm install --namespace minio --generate-name minio/minio -``` - -The command deploys MinIO on the Kubernetes cluster in the default configuration. The [configuration](#configuration) section lists the parameters that can be configured during installation. - -### Release name - -An instance of a chart running in a Kubernetes cluster is called a release. Each release is identified by a unique name within the cluster. Helm automatically assigns a unique release name after installing the chart. You can also set your preferred name by: - -```bash -$ helm install my-release minio/minio -``` - -### Access and Secret keys - -By default a pre-generated access and secret key will be used. To override the default keys, pass the access and secret keys as arguments to helm install. - -```bash -$ helm install --set accessKey=myaccesskey,secretKey=mysecretkey --generate-name minio/minio -``` - -### Updating MinIO configuration via Helm - -[ConfigMap](https://kubernetes.io/docs/user-guide/configmap/) allows injecting containers with configuration data even while a Helm release is deployed. - -To update your MinIO server configuration while it is deployed in a release, you need to - -1. Check all the configurable values in the MinIO chart using `helm inspect values minio/minio`. -2. Override the `minio_server_config` settings in a YAML formatted file, and then pass that file like this `helm upgrade -f config.yaml minio/minio`. -3. Restart the MinIO server(s) for the changes to take effect. - -You can also check the history of upgrades to a release using `helm history my-release`. Replace `my-release` with the actual release name. - -### Installing certificates from third party CAs - -MinIO can connect to other servers, including MinIO nodes or other server types such as NATs and Redis. If these servers use certificates that were not registered with a known CA, add trust for these certificates to MinIO Server by bundling these certificates into a Kubernetes secret and providing it to Helm via the `trustedCertsSecret` value. If `.Values.tls.enabled` is `true` and you're installing certificates for third party CAs, remember to include Minio's own certificate with key `public.crt`, if it also needs to be trusted. - -For instance, given that TLS is enabled and you need to add trust for Minio's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`: - -``` -kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt -``` - -If TLS is not enabled, you would need only the third party CA: - -``` -kubectl -n minio create secret generic minio-trusted-certs --from-file=keycloak.crt -``` - -The name of the generated secret can then be passed to Helm using a values file or the `--set` parameter: - -``` -trustedCertsSecret: "minio-trusted-certs" - -or - ---set trustedCertsSecret=minio-trusted-certs -``` - -Uninstalling the Chart ----------------------- - -Assuming your release is named as `my-release`, delete it using the command: - -```bash -$ helm delete my-release -``` - -or - -```bash -$ helm uninstall my-release -``` - -The command removes all the Kubernetes components associated with the chart and deletes the release. - -Upgrading the Chart -------------------- - -You can use Helm to update MinIO version in a live release. Assuming your release is named as `my-release`, get the values using the command: - -```bash -$ helm get values my-release > old_values.yaml -``` - -Then change the field `image.tag` in `old_values.yaml` file with MinIO image tag you want to use. Now update the chart using - -```bash -$ helm upgrade -f old_values.yaml my-release minio/minio -``` - -Default upgrade strategies are specified in the `values.yaml` file. Update these fields if you'd like to use a different strategy. - -Configuration -------------- - -The following table lists the configurable parameters of the MinIO chart and their default values. - -| Parameter | Description | Default | -|:-------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------|:---------------------------------| -| `nameOverride` | Provide a name in place of `minio` | `""` | -| `fullnameOverride` | Provide a name to substitute for the full names of resources | `""` | -| `image.repository` | Image repository | `minio/minio` | -| `image.tag` | MinIO image tag. Possible values listed [here](https://hub.docker.com/r/minio/minio/tags/). | `RELEASE.2020-11-06T23-17-07Z` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `imagePullSecrets` | List of container registry secrets | `[]` | -| `mcImage.repository` | Client image repository | `minio/mc` | -| `mcImage.tag` | mc image tag. Possible values listed [here](https://hub.docker.com/r/minio/mc/tags/). | `RELEASE.2020-10-03T02-54-56Z` | -| `mcImage.pullPolicy` | mc Image pull policy | `IfNotPresent` | -| `ingress.enabled` | Enables Ingress | `false` | -| `ingress.labels ` | Ingress labels | `{}` | -| `ingress.annotations` | Ingress annotations | `{}` | -| `ingress.hosts` | Ingress accepted hostnames | `[]` | -| `ingress.tls` | Ingress TLS configuration | `[]` | -| `trustedCertsSecret` | Kubernetes secret with trusted certificates to be mounted on `{{ .Values.certsPath }}/CAs` | `""` | -| `mode` | MinIO server mode (`standalone` or `distributed`) | `standalone` | -| `extraArgs` | Additional command line arguments to pass to the MinIO server | `[]` | -| `replicas` | Number of nodes (applicable only for MinIO distributed mode). | `4` | -| `zones` | Number of zones (applicable only for MinIO distributed mode). | `1` | -| `drivesPerNode` | Number of drives per node (applicable only for MinIO distributed mode). | `1` | -| `existingSecret` | Name of existing secret with access and secret key. | `""` | -| `accessKey` | Default access key (5 to 20 characters) | random 20 chars | -| `secretKey` | Default secret key (8 to 40 characters) | random 40 chars | -| `certsPath` | Default certs path location | `/etc/minio/certs` | -| `configPathmc` | Default config file location for MinIO client - mc | `/etc/minio/mc` | -| `mountPath` | Default mount location for persistent drive | `/export` | -| `bucketRoot` | Directory from where minio should serve buckets. | Value of `.mountPath` | -| `clusterDomain` | domain name of kubernetes cluster where pod is running. | `cluster.local` | -| `service.type` | Kubernetes service type | `ClusterIP` | -| `service.port` | Kubernetes port where service is exposed | `9000` | -| `service.externalIPs` | service external IP addresses | `nil` | -| `service.annotations` | Service annotations | `{}` | -| `serviceAccount.create` | Toggle creation of new service account | `true` | -| `serviceAccount.name` | Name of service account to create and/or use | `""` | -| `persistence.enabled` | Use persistent volume to store data | `true` | -| `persistence.size` | Size of persistent volume claim | `500Gi` | -| `persistence.existingClaim` | Use an existing PVC to persist data | `nil` | -| `persistence.storageClass` | Storage class name of PVC | `nil` | -| `persistence.accessMode` | ReadWriteOnce or ReadOnly | `ReadWriteOnce` | -| `persistence.subPath` | Mount a sub directory of the persistent volume if set | `""` | -| `resources.requests.memory` | Memory resource requests | Memory: `4Gi` | -| `priorityClassName` | Pod priority settings | `""` | -| `securityContext.enabled` | Enable to run containers as non-root. NOTE: if `persistence.enabled=false` then securityContext will be automatically disabled | `true` | -| `securityContext.runAsUser` | User id of the user for the container | `1000` | -| `securityContext.runAsGroup` | Group id of the user for the container | `1000` | -| `securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | -| `nodeSelector` | Node labels for pod assignment | `{}` | -| `affinity` | Affinity settings for pod assignment | `{}` | -| `tolerations` | Toleration labels for pod assignment | `[]` | -| `podAnnotations` | Pod annotations | `{}` | -| `podLabels` | Pod Labels | `{}` | -| `tls.enabled` | Enable TLS for MinIO server | `false` | -| `tls.certSecret` | Kubernetes Secret with `public.crt` and `private.key` files. | `""` | -| `defaultBucket.enabled` | If set to true, a bucket will be created after MinIO install | `false` | -| `defaultBucket.name` | Bucket name | `bucket` | -| `defaultBucket.policy` | Bucket policy | `none` | -| `defaultBucket.purge` | Purge the bucket if already exists | `false` | -| `defaultBucket.versioning` | Enable / Suspend versioning for bucket | `nil` | -| `buckets` | List of buckets to create after MinIO install | `[]` | -| `makeBucketJob.annotations` | Additional annotations for the Kubernetes Batch (make-bucket-job) | `""` | -| `makeBucketJob.podAnnotations` | Additional annotations for the pods of the Kubernetes Batch (make-bucket-job) | `""` | -| `makeBucketJob.securityContext.enabled` | Enable to run Kubernetes Batch (make-bucket-job) containers as non-root. | `false` | -| `makeBucketJob.securityContext.runAsUser` | User id of the user for the container | `1000` | -| `makeBucketJob.securityContext.runAsGroup` | Group id of the user for the container | `1000` | -| `makeBucketJob.securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | -| `makeBucketJob.resources.requests.memory` | Memory resource requests for 'make bucket' job | `128Mi` | -| `updatePrometheusJob.podAnnotations` | Additional annotations for the pods of the Kubernetes Batch (update-prometheus-secret) | `""` | -| `updatePrometheusJob.securityContext.enabled` | Enable to run Kubernetes Batch (update-prometheus-secret) containers as non-root. | `false` | -| `updatePrometheusJob.securityContext.runAsUser` | User id of the user for the container | `1000` | -| `updatePrometheusJob.securityContext.runAsGroup` | Group id of the user for the container | `1000` | -| `updatePrometheusJob.securityContext.fsGroup` | Group id of the persistent volume mount for the container | `1000` | -| `s3gateway.enabled` | Use MinIO as a [s3 gateway](https://github.com/minio/minio/blob/master/docs/gateway/s3.md) | `false` | -| `s3gateway.replicas` | Number of s3 gateway instances to run in parallel | `4` | -| `s3gateway.serviceEndpoint` | Endpoint to the S3 compatible service | `""` | -| `s3gateway.accessKey` | Access key of S3 compatible service | `""` | -| `s3gateway.secretKey` | Secret key of S3 compatible service | `""` | -| `azuregateway.enabled` | Use MinIO as an [azure gateway](https://docs.minio.io/docs/minio-gateway-for-azure) | `false` | -| `azuregateway.replicas` | Number of azure gateway instances to run in parallel | `4` | -| `gcsgateway.enabled` | Use MinIO as a [Google Cloud Storage gateway](https://docs.minio.io/docs/minio-gateway-for-gcs) | `false` | -| `gcsgateway.gcsKeyJson` | credential json file of service account key | `""` | -| `gcsgateway.projectId` | Google cloud project id | `""` | -| `nasgateway.enabled` | Use MinIO as a [NAS gateway](https://docs.MinIO.io/docs/minio-gateway-for-nas) | `false` | -| `nasgateway.replicas` | Number of NAS gateway instances to be run in parallel on a PV | `4` | -| `environment` | Set MinIO server relevant environment variables in `values.yaml` file. MinIO containers will be passed these variables when they start. | `MINIO_STORAGE_CLASS_STANDARD: EC:4"` | -| `metrics.serviceMonitor.enabled` | Set this to `true` to create ServiceMonitor for Prometheus operator | `false` | -| `metrics.serviceMonitor.additionalLabels` | Additional labels that can be used so ServiceMonitor will be discovered by Prometheus | `{}` | -| `metrics.serviceMonitor.namespace` | Optional namespace in which to create ServiceMonitor | `nil` | -| `metrics.serviceMonitor.interval` | Scrape interval. If not set, the Prometheus default scrape interval is used | `nil` | -| `metrics.serviceMonitor.scrapeTimeout` | Scrape timeout. If not set, the Prometheus default scrape timeout is used | `nil` | -| `metrics.serviceMonitor.relabelConfigs` | Relabel configs that can be used on Endpoints | `{}` | -| `etcd.endpoints` | Endpoints of etcd | `[]` | -| `etcd.pathPrefix` | Prefix for all etcd keys | `""` | -| `etcd.corednsPathPrefix` | Prefix for all CoreDNS etcd keys | `""` | -| `etcd.clientCert` | Certificate used for SSL/TLS connections to etcd [(etcd Security)](https://etcd.io/docs/latest/op-guide/security/) | `""` | -| `etcd.clientCertKey` | Key for the certificate [(etcd Security)](https://etcd.io/docs/latest/op-guide/security/) | `""` | - -Some of the parameters above map to the env variables defined in the [MinIO DockerHub image](https://hub.docker.com/r/minio/minio/). - -You can specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, - -```bash -$ helm install --name my-release --set persistence.size=1Ti minio/minio -``` - -The above command deploys MinIO server with a 1Ti backing persistent volume. - -Alternately, you can provide a YAML file that specifies parameter values while installing the chart. For example, - -```bash -$ helm install --name my-release -f values.yaml minio/minio -``` - -> **Tip**: You can use the default [values.yaml](minio/values.yaml) - -Distributed MinIO ------------ - -This chart provisions a MinIO server in standalone mode, by default. To provision MinIO server in [distributed mode](https://docs.minio.io/docs/distributed-minio-quickstart-guide), set the `mode` field to `distributed`, - -```bash -$ helm install --set mode=distributed minio/minio -``` - -This provisions MinIO server in distributed mode with 4 nodes. To change the number of nodes in your distributed MinIO server, set the `replicas` field, - -```bash -$ helm install --set mode=distributed,replicas=8 minio/minio -``` - -This provisions MinIO server in distributed mode with 8 nodes. Note that the `replicas` value should be a minimum value of 4, there is no limit on number of servers you can run. - -You can also expand an existing deployment by adding new zones, following command will create a total of 16 nodes with each zone running 8 nodes. - -```bash -$ helm install --set mode=distributed,replicas=8,zones=2 minio/minio -``` - -### StatefulSet [limitations](http://kubernetes.io/docs/concepts/abstractions/controllers/statefulsets/#limitations) applicable to distributed MinIO - -1. StatefulSets need persistent storage, so the `persistence.enabled` flag is ignored when `mode` is set to `distributed`. -2. When uninstalling a distributed MinIO release, you'll need to manually delete volumes associated with the StatefulSet. - -NAS Gateway ------------ - -### Prerequisites - -MinIO in [NAS gateway mode](https://docs.minio.io/docs/minio-gateway-for-nas) can be used to create multiple MinIO instances backed by single PV in `ReadWriteMany` mode. Currently few [Kubernetes volume plugins](https://kubernetes.io/docs/user-guide/persistent-volumes/#access-modes) support `ReadWriteMany` mode. To deploy MinIO NAS gateway with Helm chart you'll need to have a Persistent Volume running with one of the supported volume plugins. [This document](https://kubernetes.io/docs/user-guide/volumes/#nfs) -outlines steps to create a NFS PV in Kubernetes cluster. - -### Provision NAS Gateway MinIO instances - -To provision MinIO servers in [NAS gateway mode](https://docs.minio.io/docs/minio-gateway-for-nas), set the `nasgateway.enabled` field to `true`, - -```bash -$ helm install --set nasgateway.enabled=true minio/minio -``` - -This provisions 4 MinIO NAS gateway instances backed by single storage. To change the number of instances in your MinIO deployment, set the `replicas` field, - -```bash -$ helm install --set nasgateway.enabled=true,nasgateway.replicas=8 minio/minio -``` - -This provisions MinIO NAS gateway with 8 instances. - -Persistence ------------ - -This chart provisions a PersistentVolumeClaim and mounts corresponding persistent volume to default location `/export`. You'll need physical storage available in the Kubernetes cluster for this to work. If you'd rather use `emptyDir`, disable PersistentVolumeClaim by: - -```bash -$ helm install --set persistence.enabled=false minio/minio -``` - -> *"An emptyDir volume is first created when a Pod is assigned to a Node, and exists as long as that Pod is running on that node. When a Pod is removed from a node for any reason, the data in the emptyDir is deleted forever."* - -Existing PersistentVolumeClaim ------------------------------- - -If a Persistent Volume Claim already exists, specify it during installation. - -1. Create the PersistentVolume -2. Create the PersistentVolumeClaim -3. Install the chart - -```bash -$ helm install --set persistence.existingClaim=PVC_NAME minio/minio -``` - -NetworkPolicy -------------- - -To enable network policy for MinIO, -install [a networking plugin that implements the Kubernetes -NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), -and set `networkPolicy.enabled` to `true`. - -For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting -the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace: - - kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" - -With NetworkPolicy enabled, traffic will be limited to just port 9000. - -For more precise policy, set `networkPolicy.allowExternal=true`. This will -only allow pods with the generated client label to connect to MinIO. -This label will be displayed in the output of a successful install. - -Existing secret ---------------- - -Instead of having this chart create the secret for you, you can supply a preexisting secret, much -like an existing PersistentVolumeClaim. - -First, create the secret: -```bash -$ kubectl create secret generic my-minio-secret --from-literal=accesskey=foobarbaz --from-literal=secretkey=foobarbazqux -``` - -Then install the chart, specifying that you want to use an existing secret: -```bash -$ helm install --set existingSecret=my-minio-secret minio/minio -``` - -The following fields are expected in the secret: - -| .data. in Secret | Corresponding variable | Description | -|:---------------------------|:------------------------|:----------------------------------------------------------------------------------| -| `accesskey` | `accessKey` | Access key ID. Mandatory. | -| `secretkey` | `secretKey` | Secret key. Mandatory. | -| `gcs_key.json` | `gcsgateway.gcsKeyJson` | GCS key if you are using the GCS gateway feature. Optional | -| `awsAccessKeyId` | `s3gateway.accessKey` | S3 access key if you are using the S3 gateway feature. Optional | -| `awsSecretAccessKey` | `s3gateway.secretKey` | S3 secret key if you are using the S3 gateway feature. Optional | -| `etcd_client_cert.pem` | `etcd.clientCert` | Certificate for SSL/TLS connections to etcd. Optional | -| `etcd_client_cert_key.pem` | `etcd.clientCertKey` | Corresponding key for certificate above. Mandatory when etcd certificate defined. | - -All corresponding variables will be ignored in values file. - -Configure TLS -------------- - -To enable TLS for MinIO containers, acquire TLS certificates from a CA or create self-signed certificates. While creating / acquiring certificates ensure the corresponding domain names are set as per the standard [DNS naming conventions](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#pod-identity) in a Kubernetes StatefulSet (for a distributed MinIO setup). Then create a secret using - -```bash -$ kubectl create secret generic tls-ssl-minio --from-file=path/to/private.key --from-file=path/to/public.crt -``` - -Then install the chart, specifying that you want to use the TLS secret: - -```bash -$ helm install --set tls.enabled=true,tls.certSecret=tls-ssl-minio minio/minio -``` - -Pass environment variables to MinIO containers ----------------------------------------------- - -To pass environment variables to MinIO containers when deploying via Helm chart, use the below command line format - -```bash -$ helm install --set environment.MINIO_BROWSER=on,environment.MINIO_DOMAIN=domain-name minio/minio -``` - -You can add as many environment variables as required, using the above format. Just add `environment.=` under `set` flag. - -Create buckets after install ---------------------------- - -Install the chart, specifying the buckets you want to create after install: - -```bash -$ helm install --set buckets[0].name=bucket1,buckets[0].policy=none,buckets[0].purge=false minio/minio -``` - -Description of the configuration parameters used above - - -- `buckets[].name` - name of the bucket to create, must be a string with length > 0 -- `buckets[].policy` - can be one of none|download|upload|public -- `buckets[].purge` - purge if bucket exists already diff --git a/packs/minio-8.0.10/charts/minio/minio/ci/distributed-values.yaml b/packs/minio-8.0.10/charts/minio/minio/ci/distributed-values.yaml deleted file mode 100644 index e6c46738..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/ci/distributed-values.yaml +++ /dev/null @@ -1 +0,0 @@ -mode: distributed diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/NOTES.txt b/packs/minio-8.0.10/charts/minio/minio/templates/NOTES.txt deleted file mode 100644 index 679f1ea8..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/NOTES.txt +++ /dev/null @@ -1,47 +0,0 @@ -{{- if eq .Values.service.type "ClusterIP" "NodePort" }} -Minio can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster: -{{ template "minio.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local - -To access Minio from localhost, run the below commands: - - 1. export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") - - 2. kubectl port-forward $POD_NAME 9000 --namespace {{ .Release.Namespace }} - -Read more about port forwarding here: http://kubernetes.io/docs/user-guide/kubectl/kubectl_port-forward/ - -You can now access Minio server on http://localhost:9000. Follow the below steps to connect to Minio server with mc client: - - 1. Download the Minio mc client - https://docs.minio.io/docs/minio-client-quickstart-guide - - 2. Get the ACCESS_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.accesskey}" | base64 --decode) and the SECRET_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.secretkey}" | base64 --decode) - - 3. mc alias set {{ template "minio.fullname" . }}-local http://localhost:{{ .Values.service.port }} "$ACCESS_KEY" "$SECRET_KEY" --api s3v4 - - 4. mc ls {{ template "minio.fullname" . }}-local - -Alternately, you can use your browser or the Minio SDK to access the server - https://docs.minio.io/categories/17 -{{- end }} -{{- if eq .Values.service.type "LoadBalancer" }} -Minio can be accessed via port {{ .Values.service.port }} on an external IP address. Get the service external IP address by: -kubectl get svc --namespace {{ .Release.Namespace }} -l app={{ template "minio.fullname" . }} - -Note that the public IP may take a couple of minutes to be available. - -You can now access Minio server on http://:9000. Follow the below steps to connect to Minio server with mc client: - - 1. Download the Minio mc client - https://docs.minio.io/docs/minio-client-quickstart-guide - - 2. Get the ACCESS_KEY=$(kubectl get secret {{ template "minio.secretName" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.data.accesskey}" | base64 --decode) and the SECRET_KEY=$(kubectl get secret {{ template "minio.secretName" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.data.secretkey}" | base64 --decode) - 3. mc alias set {{ template "minio.fullname" . }} http://:{{ .Values.service.port }} "$ACCESS_KEY" "$SECRET_KEY" --api s3v4 - - 4. mc ls {{ template "minio.fullname" . }} - -Alternately, you can use your browser or the Minio SDK to access the server - https://docs.minio.io/categories/17 -{{- end }} - -{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} -Note: Since NetworkPolicy is enabled, only pods with label -{{ template "minio.fullname" . }}-client=true" -will be able to connect to this minio cluster. -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/_helper_create_bucket.txt b/packs/minio-8.0.10/charts/minio/minio/templates/_helper_create_bucket.txt deleted file mode 100644 index ad2f546b..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/_helper_create_bucket.txt +++ /dev/null @@ -1,111 +0,0 @@ -#!/bin/sh -set -e ; # Have script exit in the event of a failed command. - -{{- if .Values.configPathmc }} -MC_CONFIG_DIR="{{ .Values.configPathmc }}" -MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" -{{- else }} -MC="/usr/bin/mc --insecure" -{{- end }} - -# connectToMinio -# Use a check-sleep-check loop to wait for Minio service to be available -connectToMinio() { - SCHEME=$1 - ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts - set -e ; # fail if we can't read the keys. - ACCESS=$(cat /config/accesskey) ; SECRET=$(cat /config/secretkey) ; - set +e ; # The connections to minio are allowed to fail. - echo "Connecting to Minio server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; - MC_COMMAND="${MC} config host add myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; - $MC_COMMAND ; - STATUS=$? ; - until [ $STATUS = 0 ] - do - ATTEMPTS=`expr $ATTEMPTS + 1` ; - echo \"Failed attempts: $ATTEMPTS\" ; - if [ $ATTEMPTS -gt $LIMIT ]; then - exit 1 ; - fi ; - sleep 2 ; # 1 second intervals between attempts - $MC_COMMAND ; - STATUS=$? ; - done ; - set -e ; # reset `e` as active - return 0 -} - -# checkBucketExists ($bucket) -# Check if the bucket exists, by using the exit code of `mc ls` -checkBucketExists() { - BUCKET=$1 - CMD=$(${MC} ls myminio/$BUCKET > /dev/null 2>&1) - return $? -} - -# createBucket ($bucket, $policy, $purge) -# Ensure bucket exists, purging if asked to -createBucket() { - BUCKET=$1 - POLICY=$2 - PURGE=$3 - VERSIONING=$4 - - # Purge the bucket, if set & exists - # Since PURGE is user input, check explicitly for `true` - if [ $PURGE = true ]; then - if checkBucketExists $BUCKET ; then - echo "Purging bucket '$BUCKET'." - set +e ; # don't exit if this fails - ${MC} rm -r --force myminio/$BUCKET - set -e ; # reset `e` as active - else - echo "Bucket '$BUCKET' does not exist, skipping purge." - fi - fi - - # Create the bucket if it does not exist - if ! checkBucketExists $BUCKET ; then - echo "Creating bucket '$BUCKET'" - ${MC} mb myminio/$BUCKET - else - echo "Bucket '$BUCKET' already exists." - fi - - - # set versioning for bucket - if [ ! -z $VERSIONING ] ; then - if [ $VERSIONING = true ] ; then - echo "Enabling versioning for '$BUCKET'" - ${MC} version enable myminio/$BUCKET - elif [ $VERSIONING = false ] ; then - echo "Suspending versioning for '$BUCKET'" - ${MC} version suspend myminio/$BUCKET - fi - else - echo "Bucket '$BUCKET' versioning unchanged." - fi - - # At this point, the bucket should exist, skip checking for existence - # Set policy on the bucket - echo "Setting policy of bucket '$BUCKET' to '$POLICY'." - ${MC} policy set $POLICY myminio/$BUCKET -} - -# Try connecting to Minio instance -{{- if .Values.tls.enabled }} -scheme=https -{{- else }} -scheme=http -{{- end }} -connectToMinio $scheme - -{{- if or .Values.defaultBucket.enabled }} -# Create the bucket -createBucket {{ .Values.defaultBucket.name }} {{ .Values.defaultBucket.policy }} {{ .Values.defaultBucket.purge }} {{ .Values.defaultBucket.versioning }} -{{ else if .Values.buckets }} -# Create the buckets -{{- range .Values.buckets }} -createBucket {{ .name }} {{ .policy }} {{ .purge }} {{ .versioning }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/_helpers.tpl b/packs/minio-8.0.10/charts/minio/minio/templates/_helpers.tpl deleted file mode 100644 index 0b14618a..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/_helpers.tpl +++ /dev/null @@ -1,182 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "minio.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "minio.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "minio.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for networkpolicy. -*/}} -{{- define "minio.networkPolicy.apiVersion" -}} -{{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.Version -}} -{{- print "extensions/v1beta1" -}} -{{- else if semverCompare "^1.7-0" .Capabilities.KubeVersion.Version -}} -{{- print "networking.k8s.io/v1beta1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for deployment. -*/}} -{{- define "minio.deployment.apiVersion" -}} -{{- if semverCompare "<1.9-0" .Capabilities.KubeVersion.Version -}} -{{- print "apps/v1beta2" -}} -{{- else -}} -{{- print "apps/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for statefulset. -*/}} -{{- define "minio.statefulset.apiVersion" -}} -{{- if semverCompare "<1.16-0" .Capabilities.KubeVersion.Version -}} -{{- print "apps/v1beta2" -}} -{{- else -}} -{{- print "apps/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for ingress. -*/}} -{{- define "minio.ingress.apiVersion" -}} -{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} -{{- print "extensions/v1beta1" -}} -{{- else -}} -{{- print "networking.k8s.io/v1beta1" -}} -{{- end -}} -{{- end -}} - -{{/* -Determine secret name. -*/}} -{{- define "minio.secretName" -}} -{{- if .Values.existingSecret -}} -{{- .Values.existingSecret }} -{{- else -}} -{{- include "minio.fullname" . -}} -{{- end -}} -{{- end -}} - -{{/* -Determine service account name for deployment or statefulset. -*/}} -{{- define "minio.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} -{{- default (include "minio.fullname" .) .Values.serviceAccount.name | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- default "default" .Values.serviceAccount.name -}} -{{- end -}} -{{- end -}} - -{{/* -Determine name for scc role and rolebinding -*/}} -{{- define "minio.sccRoleName" -}} -{{- printf "%s-%s" "scc" (include "minio.fullname" .) | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Properly format optional additional arguments to Minio binary -*/}} -{{- define "minio.extraArgs" -}} -{{- range .Values.extraArgs -}} -{{ " " }}{{ . }} -{{- end -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names -*/}} -{{- define "minio.imagePullSecrets" -}} -{{/* -Helm 2.11 supports the assignment of a value to a variable defined in a different scope, -but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. -Also, we can not use a single if because lazy evaluation is not an option -*/}} -{{- if .Values.global }} -{{- if .Values.global.imagePullSecrets }} -imagePullSecrets: -{{- range .Values.global.imagePullSecrets }} - - name: {{ . }} -{{- end }} -{{- else if .Values.imagePullSecrets }} -imagePullSecrets: - {{ toYaml .Values.imagePullSecrets }} -{{- end -}} -{{- else if .Values.imagePullSecrets }} -imagePullSecrets: - {{ toYaml .Values.imagePullSecrets }} -{{- end -}} -{{- end -}} - -{{/* -Formats volumeMount for Minio tls keys and trusted certs -*/}} -{{- define "minio.tlsKeysVolumeMount" -}} -{{- if .Values.tls.enabled }} -- name: cert-secret-volume - mountPath: {{ .Values.certsPath }} -{{- end }} -{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} -{{- $casPath := printf "%s/CAs" .Values.certsPath | clean }} -- name: trusted-cert-secret-volume - mountPath: {{ $casPath }} -{{- end }} -{{- end -}} - -{{/* -Formats volume for Minio tls keys and trusted certs -*/}} -{{- define "minio.tlsKeysVolume" -}} -{{- if .Values.tls.enabled }} -- name: cert-secret-volume - secret: - secretName: {{ .Values.tls.certSecret }} - items: - - key: {{ .Values.tls.publicCrt }} - path: public.crt - - key: {{ .Values.tls.privateKey }} - path: private.key -{{- end }} -{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} -{{- $certSecret := eq .Values.trustedCertsSecret "" | ternary .Values.tls.certSecret .Values.trustedCertsSecret }} -{{- $publicCrt := eq .Values.trustedCertsSecret "" | ternary .Values.tls.publicCrt "" }} -- name: trusted-cert-secret-volume - secret: - secretName: {{ $certSecret }} - {{- if ne $publicCrt "" }} - items: - - key: {{ $publicCrt }} - path: public.crt - {{- end }} -{{- end }} -{{- end -}} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/clusterroles.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/clusterroles.yaml deleted file mode 100644 index c4d9a937..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/clusterroles.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "minio.serviceAccountName" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: -- apiGroups: - - security.openshift.io - resources: - - securitycontextconstraints - resourceNames: - - {{ template "minio.fullname" . }} - verbs: - - use -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/configmap.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/configmap.yaml deleted file mode 100644 index cb11fcd7..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/configmap.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -data: - initialize: |- -{{ include (print $.Template.BasePath "/_helper_create_bucket.txt") . | indent 4 }} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/deployment.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/deployment.yaml deleted file mode 100644 index 2fa9edf1..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/deployment.yaml +++ /dev/null @@ -1,203 +0,0 @@ -{{- if eq .Values.mode "standalone" }} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} -apiVersion: {{ template "minio.deployment.apiVersion" . }} -kind: Deployment -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - strategy: - type: {{ .Values.DeploymentUpdate.type }} - {{- if eq .Values.DeploymentUpdate.type "RollingUpdate" }} - rollingUpdate: - maxSurge: {{ .Values.DeploymentUpdate.maxSurge }} - maxUnavailable: {{ .Values.DeploymentUpdate.maxUnavailable }} - {{- end}} - {{- if .Values.nasgateway.enabled }} - replicas: {{ .Values.nasgateway.replicas }} - {{- end }} - {{- if .Values.s3gateway.enabled }} - replicas: {{ .Values.s3gateway.replicas }} - {{- end }} - {{- if .Values.azuregateway.enabled }} - replicas: {{ .Values.azuregateway.replicas }} - {{- end }} - {{- if .Values.gcsgateway.enabled }} - replicas: {{ .Values.gcsgateway.replicas }} - {{- end }} - selector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - template: - metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} - annotations: - checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} -{{- if .Values.podAnnotations }} -{{ toYaml .Values.podAnnotations | trimSuffix "\n" | indent 8 }} -{{- end }} - spec: - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} - serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} -{{- if and .Values.securityContext.enabled .Values.persistence.enabled }} - securityContext: - runAsUser: {{ .Values.securityContext.runAsUser }} - runAsGroup: {{ .Values.securityContext.runAsGroup }} - fsGroup: {{ .Values.securityContext.fsGroup }} -{{- end }} - containers: - - name: {{ .Chart.Name }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - {{- if .Values.s3gateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway s3 {{ .Values.s3gateway.serviceEndpoint }} {{- template "minio.extraArgs" . }}" - {{- else }} - {{- if .Values.azuregateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway azure {{- template "minio.extraArgs" . }}" - {{- else }} - {{- if .Values.gcsgateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway gcs {{ .Values.gcsgateway.projectId }} {{- template "minio.extraArgs" . }}" - {{- else }} - {{- if .Values.nasgateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway nas {{ $bucketRoot }} {{- template "minio.extraArgs" . }}" - {{- else }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{ $bucketRoot }} {{- template "minio.extraArgs" . }}" - {{- end }} - {{- end }} - {{- end }} - {{- end }} - volumeMounts: - {{- if and .Values.persistence.enabled (not .Values.gcsgateway.enabled) (not .Values.azuregateway.enabled) (not .Values.s3gateway.enabled) }} - - name: export - mountPath: {{ .Values.mountPath }} - {{- if .Values.persistence.subPath }} - subPath: "{{ .Values.persistence.subPath }}" - {{- end }} - {{- end }} - {{- if or .Values.gcsgateway.enabled .Values.etcd.clientCert .Values.etcd.clientCertKey }} - - name: minio-user - mountPath: "/etc/credentials" - readOnly: true - {{- end }} - {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} - ports: - - name: {{ $scheme }} - containerPort: 9000 - env: - - name: MINIO_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: accesskey - - name: MINIO_SECRET_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: secretkey - {{- if and .Values.gcsgateway.enabled .Values.gcsgateway.gcsKeyJson }} - - name: GOOGLE_APPLICATION_CREDENTIALS - value: "/etc/credentials/gcs_key.json" - {{- end }} - {{- if .Values.etcd.endpoints }} - - name: MINIO_ETCD_ENDPOINTS - value: {{ join "," .Values.etcd.endpoints | quote }} - {{- if .Values.etcd.clientCert }} - - name: MINIO_ETCD_CLIENT_CERT - value: "/etc/credentials/etcd_client_cert.pem" - {{- end }} - {{- if .Values.etcd.clientCertKey }} - - name: MINIO_ETCD_CLIENT_CERT_KEY - value: "/etc/credentials/etcd_client_cert_key.pem" - {{- end }} - {{- if .Values.etcd.pathPrefix }} - - name: MINIO_ETCD_PATH_PREFIX - value: {{ .Values.etcd.pathPrefix }} - {{- end }} - {{- if .Values.etcd.corednsPathPrefix }} - - name: MINIO_ETCD_COREDNS_PATH - value: {{ .Values.etcd.corednsPathPrefix }} - {{- end }} - {{- end }} - {{- if .Values.s3gateway.enabled -}} - {{- if or .Values.s3gateway.accessKey .Values.existingSecret }} - - name: AWS_ACCESS_KEY_ID - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: awsAccessKeyId - {{- end }} - {{- if or .Values.s3gateway.secretKey .Values.existingSecret }} - - name: AWS_SECRET_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: awsSecretAccessKey - {{- end }} - {{- end }} - {{- range $key, $val := .Values.environment }} - - name: {{ $key }} - value: {{ $val | quote }} - {{- end}} - resources: -{{ toYaml .Values.resources | indent 12 }} -{{- with .Values.nodeSelector }} - nodeSelector: -{{ toYaml . | indent 8 }} -{{- end }} -{{- include "minio.imagePullSecrets" . | indent 6 }} -{{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} -{{- end }} - volumes: - {{- if and (not .Values.gcsgateway.enabled) (not .Values.azuregateway.enabled) (not .Values.s3gateway.enabled) }} - - name: export - {{- if .Values.persistence.enabled }} - persistentVolumeClaim: - claimName: {{ .Values.persistence.existingClaim | default (include "minio.fullname" .) }} - {{- else }} - emptyDir: {} - {{- end }} - {{- end }} - - name: minio-user - secret: - secretName: {{ template "minio.secretName" . }} - {{- include "minio.tlsKeysVolume" . | indent 8 }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/ingress.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/ingress.yaml deleted file mode 100644 index 2d9bbda0..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/ingress.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{- if .Values.ingress.enabled -}} -{{- $fullName := include "minio.fullname" . -}} -{{- $servicePort := .Values.service.port -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: {{ template "minio.ingress.apiVersion" . }} -kind: Ingress -metadata: - name: {{ $fullName }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- with .Values.ingress.labels }} -{{ toYaml . | indent 4 }} -{{- end }} - -{{- with .Values.ingress.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - - http: - paths: - - path: {{ $ingressPath }} - backend: - serviceName: {{ $fullName }} - servicePort: {{ $servicePort }} - {{- if . }} - host: {{ . | quote }} - {{- end }} - {{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/networkpolicy.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/networkpolicy.yaml deleted file mode 100644 index de57f485..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/networkpolicy.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if .Values.networkPolicy.enabled }} -kind: NetworkPolicy -apiVersion: {{ template "minio.networkPolicy.apiVersion" . }} -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - podSelector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - ingress: - - ports: - - port: {{ .Values.service.port }} - {{- if not .Values.networkPolicy.allowExternal }} - from: - - podSelector: - matchLabels: - {{ template "minio.name" . }}-client: "true" - {{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/poddisruptionbudget.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/poddisruptionbudget.yaml deleted file mode 100644 index 1de813b8..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/poddisruptionbudget.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if .Values.podDisruptionBudget.enabled }} -apiVersion: policy/v1beta1 -kind: PodDisruptionBudget -metadata: - name: minio - labels: - app: {{ template "minio.name" . }} -spec: - maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} - selector: - matchLabels: - app: {{ template "minio.name" . }} -{{- end }} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/post-install-create-bucket-job.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/post-install-create-bucket-job.yaml deleted file mode 100644 index 27e30d4a..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/post-install-create-bucket-job.yaml +++ /dev/null @@ -1,87 +0,0 @@ -{{- if or .Values.defaultBucket.enabled .Values.buckets }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ template "minio.fullname" . }}-make-bucket-job - labels: - app: {{ template "minio.name" . }}-make-bucket-job - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation -{{- with .Values.makeBucketJob.annotations }} -{{ toYaml . | indent 4 }} -{{- end }} -spec: - template: - metadata: - labels: - app: {{ template "minio.name" . }}-job - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} -{{- if .Values.makeBucketJob.podAnnotations }} - annotations: -{{ toYaml .Values.makeBucketJob.podAnnotations | indent 8 }} -{{- end }} - spec: - restartPolicy: OnFailure -{{- include "minio.imagePullSecrets" . | indent 6 }} -{{- if .Values.nodeSelector }} - nodeSelector: -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} -{{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} -{{- end }} -{{- if .Values.makeBucketJob.securityContext.enabled }} - securityContext: - runAsUser: {{ .Values.makeBucketJob.securityContext.runAsUser }} - runAsGroup: {{ .Values.makeBucketJob.securityContext.runAsGroup }} - fsGroup: {{ .Values.makeBucketJob.securityContext.fsGroup }} -{{- end }} - volumes: - - name: minio-configuration - projected: - sources: - - configMap: - name: {{ template "minio.fullname" . }} - - secret: - name: {{ template "minio.secretName" . }} - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - secret: - secretName: {{ .Values.tls.certSecret }} - items: - - key: {{ .Values.tls.publicCrt }} - path: CAs/public.crt - {{ end }} - serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} - containers: - - name: minio-mc - image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" - imagePullPolicy: {{ .Values.mcImage.pullPolicy }} - command: ["/bin/sh", "/config/initialize"] - env: - - name: MINIO_ENDPOINT - value: {{ template "minio.fullname" . }} - - name: MINIO_PORT - value: {{ .Values.service.port | quote }} - volumeMounts: - - name: minio-configuration - mountPath: /config - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - mountPath: {{ .Values.configPathmc }}certs - {{ end }} - resources: -{{ toYaml .Values.makeBucketJob.resources | indent 10 }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-job.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-job.yaml deleted file mode 100644 index d7590db7..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-job.yaml +++ /dev/null @@ -1,135 +0,0 @@ -{{- if .Values.metrics.serviceMonitor.enabled }} -{{- $fullName := include "minio.fullname" . -}} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-weight": "-5" - "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation - {{ toYaml .Values.updatePrometheusJob.annotations | indent 4 }} -spec: - template: - metadata: - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} -{{- if .Values.updatePrometheusJob.podAnnotations }} - annotations: -{{ toYaml .Values.updatePrometheusJob.podAnnotations | indent 8 }} -{{- end }} - spec: -{{- if .Values.serviceAccount.create }} - serviceAccountName: {{ $fullName }}-update-prometheus-secret -{{- end }} - restartPolicy: OnFailure -{{- include "minio.imagePullSecrets" . | indent 6 }} -{{- if .Values.nodeSelector }} - nodeSelector: -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} -{{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} -{{- end }} -{{- if .Values.updatePrometheusJob.securityContext.enabled }} - securityContext: - runAsUser: {{ .Values.updatePrometheusJob.securityContext.runAsUser }} - runAsGroup: {{ .Values.updatePrometheusJob.securityContext.runAsGroup }} - fsGroup: {{ .Values.updatePrometheusJob.securityContext.fsGroup }} -{{- end }} - volumes: - - name: workdir - emptyDir: {} - initContainers: - - name: minio-mc - image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" - imagePullPolicy: {{ .Values.mcImage.pullPolicy }} - command: - - /bin/sh - - "-c" - - mc --config-dir {{ .Values.configPathmc }} admin prometheus generate target --json --no-color -q > /workdir/mc.json - env: - - name: MINIO_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: accesskey - - name: MINIO_SECRET_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: secretkey - # mc admin prometheus generate don't really connect to remote server, TLS cert isn't required - - name: MC_HOST_target - value: {{ $scheme }}://$(MINIO_ACCESS_KEY):$(MINIO_SECRET_KEY)@{{ $fullName }}:{{ .Values.service.port }} - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} - # extract bearerToken from mc admin output - - name: jq - image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" - imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} - command: - - /bin/sh - - "-c" - - jq -e -c -j -r .bearerToken < /workdir/mc.json > /workdir/token - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} - - name: kubectl-create - image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" - imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} - command: - - /bin/sh - - "-c" - # The following script does: - # - get the servicemonitor that need this secret and copy some metadata and create the ownerreference for the secret file - # - create the secret - # - merge both json - - > - kubectl -n {{ .Release.Namespace }} get servicemonitor {{ $fullName }} -o json | - jq -c '{metadata: {name: "{{ $fullName }}-prometheus", namespace: .metadata.namespace, labels: {app: .metadata.labels.app, release: .metadata.labels.release}, ownerReferences: [{apiVersion: .apiVersion, kind: .kind, blockOwnerDeletion: true, controller: true, uid: .metadata.uid, name: .metadata.name}]}}' > /workdir/metadata.json && - kubectl create secret generic {{ $fullName }}-prometheus --from-file=token=/workdir/token --dry-run -o json > /workdir/secret.json && - cat /workdir/secret.json /workdir/metadata.json | jq -s add > /workdir/object.json - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} - containers: - - name: kubectl-apply - image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" - imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} - command: - - kubectl - - apply - - "-f" - - /workdir/object.json - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-role.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-role.yaml deleted file mode 100644 index 26c0ce7e..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-role.yaml +++ /dev/null @@ -1,38 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -{{- $fullName := include "minio.fullname" . -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: - - apiGroups: - - "" - resources: - - secrets - verbs: - - get - - create - - update - - patch - resourceNames: - - {{ $fullName }}-prometheus - - apiGroups: - - "" - resources: - - secrets - verbs: - - create - - apiGroups: - - monitoring.coreos.com - resources: - - servicemonitors - verbs: - - get - resourceNames: - - {{ $fullName }} -{{- end -}} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-rolebinding.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-rolebinding.yaml deleted file mode 100644 index 7d0ea75b..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-rolebinding.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -{{- $fullName := include "minio.fullname" . -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ $fullName }}-update-prometheus-secret -subjects: - - kind: ServiceAccount - name: {{ $fullName }}-update-prometheus-secret - namespace: {{ .Release.Namespace | quote }} -{{- end -}} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-serviceaccount.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-serviceaccount.yaml deleted file mode 100644 index 050d368a..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/post-install-prometheus-metrics-serviceaccount.yaml +++ /dev/null @@ -1,12 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -{{- $fullName := include "minio.fullname" . -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- end -}} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/pvc.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/pvc.yaml deleted file mode 100644 index 014f90f3..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/pvc.yaml +++ /dev/null @@ -1,35 +0,0 @@ -{{- if eq .Values.mode "standalone" }} -{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if and .Values.nasgateway.enabled .Values.nasgateway.pv }} - selector: - matchLabels: - pv: {{ .Values.nasgateway.pv | quote }} -{{- end }} - accessModes: - - {{ .Values.persistence.accessMode | quote }} - resources: - requests: - storage: {{ .Values.persistence.size | quote }} - -{{- if .Values.persistence.storageClass }} -{{- if (eq "-" .Values.persistence.storageClass) }} - storageClassName: "" -{{- else }} - storageClassName: "{{ .Values.persistence.storageClass }}" -{{- end }} -{{- end }} -{{- if .Values.persistence.VolumeName }} - volumeName: "{{ .Values.persistence.VolumeName }}" -{{- end }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/rolebindings.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/rolebindings.yaml deleted file mode 100644 index ea8b98c5..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/rolebindings.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ template "minio.serviceAccountName" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - namespace: {{ .Release.Namespace | quote }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "minio.serviceAccountName" . }} -subjects: -- kind: ServiceAccount - name: {{ template "minio.serviceAccountName" . }} - namespace: {{ .Release.Namespace | quote }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/secrets.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/secrets.yaml deleted file mode 100644 index c254142f..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/secrets.yaml +++ /dev/null @@ -1,32 +0,0 @@ -{{- if not .Values.existingSecret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "minio.secretName" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -type: Opaque -data: - accesskey: {{ if .Values.accessKey }}{{ .Values.accessKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 20 | b64enc | quote }}{{ end }} - secretkey: {{ if .Values.secretKey }}{{ .Values.secretKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 40 | b64enc | quote }}{{ end }} -{{- if and .Values.gcsgateway.enabled .Values.gcsgateway.gcsKeyJson }} - gcs_key.json: {{ .Values.gcsgateway.gcsKeyJson | toString | b64enc }} -{{- end }} -{{- if .Values.s3gateway.enabled -}} -{{- if .Values.s3gateway.accessKey }} - awsAccessKeyId: {{ .Values.s3gateway.accessKey | toString | b64enc | quote }} -{{- end }} -{{- if .Values.s3gateway.secretKey }} - awsSecretAccessKey: {{ .Values.s3gateway.secretKey | toString | b64enc | quote }} -{{- end }} -{{- end }} -{{- if .Values.etcd.clientCert }} - etcd_client_cert.pem: {{ .Values.etcd.clientCert | toString | b64enc | quote }} -{{- end }} -{{- if .Values.etcd.clientCertKey }} - etcd_client_cert_key.pem: {{ .Values.etcd.clientCertKey | toString | b64enc | quote }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/securitycontextconstraints.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/securitycontextconstraints.yaml deleted file mode 100644 index dfde6fb9..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/securitycontextconstraints.yaml +++ /dev/null @@ -1,46 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: security.openshift.io/v1 -kind: SecurityContextConstraints -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -priority: 10 -allowHostDirVolumePlugin: false -allowHostIPC: false -allowHostNetwork: false -allowHostPID: false -allowHostPorts: false -allowPrivilegeEscalation: true -allowPrivilegedContainer: false -allowedCapabilities: [] -readOnlyRootFilesystem: false -defaultAddCapabilities: [] -requiredDropCapabilities: -- KILL -- MKNOD -- SETUID -- SETGID -fsGroup: - type: MustRunAs - ranges: - - max: {{ .Values.securityContext.fsGroup }} - min: {{ .Values.securityContext.fsGroup }} -runAsUser: - type: MustRunAs - uid: {{ .Values.securityContext.runAsUser }} -seLinuxContext: - type: MustRunAs -supplementalGroups: - type: RunAsAny -volumes: -- configMap -- downwardAPI -- emptyDir -- persistentVolumeClaim -- projected -- secret -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/service.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/service.yaml deleted file mode 100644 index ea681e22..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/service.yaml +++ /dev/null @@ -1,47 +0,0 @@ -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- if .Values.service.annotations }} - annotations: -{{ toYaml .Values.service.annotations | indent 4 }} -{{- end }} -spec: -{{- if (or (eq .Values.service.type "ClusterIP" "") (empty .Values.service.type)) }} - type: ClusterIP - {{- if not (empty .Values.service.clusterIP) }} - clusterIP: {{ .Values.service.clusterIP }} - {{end}} -{{- else if eq .Values.service.type "LoadBalancer" }} - type: {{ .Values.service.type }} - loadBalancerIP: {{ default "" .Values.service.loadBalancerIP }} -{{- else }} - type: {{ .Values.service.type }} -{{- end }} - ports: - - name: {{ $scheme }} - port: {{ .Values.service.port }} - protocol: TCP -{{- if (and (eq .Values.service.type "NodePort") ( .Values.service.nodePort)) }} - nodePort: {{ .Values.service.nodePort }} -{{- else }} - targetPort: 9000 -{{- end}} -{{- if .Values.service.externalIPs }} - externalIPs: -{{- range $i , $ip := .Values.service.externalIPs }} - - {{ $ip }} -{{- end }} -{{- end }} - selector: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/serviceaccount.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/serviceaccount.yaml deleted file mode 100644 index 243dfef5..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/serviceaccount.yaml +++ /dev/null @@ -1,11 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "minio.serviceAccountName" . | quote }} - namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: "{{ .Release.Name }}" -{{- end -}} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/servicemonitor.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/servicemonitor.yaml deleted file mode 100644 index 2f474cba..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/servicemonitor.yaml +++ /dev/null @@ -1,44 +0,0 @@ -{{- if .Values.metrics.serviceMonitor.enabled }} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ template "minio.fullname" . }} - {{- if .Values.metrics.serviceMonitor.namespace }} - namespace: {{ .Values.metrics.serviceMonitor.namespace }} - {{- end }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.metrics.serviceMonitor.additionalLabels }} -{{ toYaml .Values.metrics.serviceMonitor.additionalLabels | indent 4 }} - {{- end }} -spec: - endpoints: - - port: {{ $scheme }} - path: /minio/prometheus/metrics - {{- if .Values.metrics.serviceMonitor.interval }} - interval: {{ .Values.metrics.serviceMonitor.interval }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.relabelConfigs }} -{{ toYaml .Values.metrics.serviceMonitor.relabelConfigs | indent 6 }} - {{- end }} - bearerTokenSecret: - name: {{ template "minio.fullname" . }}-prometheus - key: token - namespaceSelector: - matchNames: - - {{ .Release.Namespace | quote }} - selector: - matchLabels: - app: {{ include "minio.name" . }} - release: {{ .Release.Name }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/minio/templates/statefulset.yaml b/packs/minio-8.0.10/charts/minio/minio/templates/statefulset.yaml deleted file mode 100644 index b1d2d449..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/templates/statefulset.yaml +++ /dev/null @@ -1,174 +0,0 @@ -{{- if eq .Values.mode "distributed" }} -{{ $zoneCount := .Values.zones | int }} -{{ $nodeCount := .Values.replicas | int }} -{{ $drivesPerNode := .Values.drivesPerNode | int }} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -{{ $mountPath := .Values.mountPath }} -{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} -{{ $subPath := .Values.persistence.subPath }} -{{ $penabled := .Values.persistence.enabled }} -{{ $accessMode := .Values.persistence.accessMode }} -{{ $storageClass := .Values.persistence.storageClass }} -{{ $psize := .Values.persistence.size }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "minio.fullname" . }}-svc - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" -spec: - publishNotReadyAddresses: true - clusterIP: None - ports: - - name: {{ $scheme }} - port: {{ .Values.service.port }} - protocol: TCP - selector: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} ---- -apiVersion: {{ template "minio.statefulset.apiVersion" . }} -kind: StatefulSet -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - updateStrategy: - type: {{ .Values.StatefulSetUpdate.updateStrategy }} - podManagementPolicy: "Parallel" - serviceName: {{ template "minio.fullname" . }}-svc - replicas: {{ mul $zoneCount $nodeCount }} - selector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - template: - metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} - annotations: - checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} -{{- if .Values.podAnnotations }} -{{ toYaml .Values.podAnnotations | trimSuffix "\n" | indent 8 }} -{{- end }} - spec: - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} - serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} -{{- if and .Values.securityContext.enabled .Values.persistence.enabled }} - securityContext: - runAsUser: {{ .Values.securityContext.runAsUser }} - runAsGroup: {{ .Values.securityContext.runAsGroup }} - fsGroup: {{ .Values.securityContext.fsGroup }} -{{- end }} - containers: - - name: {{ .Chart.Name }} - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - - command: [ "/bin/sh", - "-ce", - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{- range $i := until $zoneCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}{{if (gt $drivesPerNode 1)}}{{ $bucketRoot }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{else}}{{ $bucketRoot }}{{end}}{{- end}}{{- template `minio.extraArgs` . }}" ] - volumeMounts: - {{- if $penabled }} - {{- if (gt $drivesPerNode 1) }} - {{- range $i := until $drivesPerNode }} - - name: export-{{ $i }} - mountPath: {{ $mountPath }}-{{ $i }} - {{- if and $penabled $subPath }} - subPath: {{ $subPath }} - {{- end }} - {{- end }} - {{- else }} - - name: export - mountPath: {{ $mountPath }} - {{- if and $penabled $subPath }} - subPath: {{ $subPath }} - {{- end }} - {{- end }} - {{- end }} - {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} - ports: - - name: {{ $scheme }} - containerPort: 9000 - env: - - name: MINIO_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: accesskey - - name: MINIO_SECRET_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: secretkey - {{- range $key, $val := .Values.environment }} - - name: {{ $key }} - value: {{ $val | quote }} - {{- end}} - resources: -{{ toYaml .Values.resources | indent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: -{{ toYaml . | indent 8 }} - {{- end }} -{{- include "minio.imagePullSecrets" . | indent 6 }} - {{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} - {{- end }} - volumes: - - name: minio-user - secret: - secretName: {{ template "minio.secretName" . }} - {{- include "minio.tlsKeysVolume" . | indent 8 }} -{{- if .Values.persistence.enabled }} - volumeClaimTemplates: - {{- if gt $drivesPerNode 1 }} - {{- range $diskId := until $drivesPerNode}} - - metadata: - name: export-{{ $diskId }} - spec: - accessModes: [ {{ $accessMode | quote }} ] - {{- if $storageClass }} - storageClassName: {{ $storageClass }} - {{- end }} - resources: - requests: - storage: {{ $psize }} - {{- end }} - {{- else }} - - metadata: - name: export - spec: - accessModes: [ {{ $accessMode | quote }} ] - {{- if $storageClass }} - storageClassName: {{ $storageClass }} - {{- end }} - resources: - requests: - storage: {{ $psize }} - {{- end }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/minio/values.yaml b/packs/minio-8.0.10/charts/minio/minio/values.yaml deleted file mode 100644 index b08ba65a..00000000 --- a/packs/minio-8.0.10/charts/minio/minio/values.yaml +++ /dev/null @@ -1,347 +0,0 @@ -## Provide a name in place of minio for `app:` labels -## -nameOverride: "" - -## Provide a name to substitute for the full names of resources -## -fullnameOverride: "" - -## set kubernetes cluster domain where minio is running -## -clusterDomain: cluster.local - -## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the -## -image: - repository: minio/minio - tag: RELEASE.2020-12-03T05-49-24Z - pullPolicy: IfNotPresent - -## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio -## client used to create a default bucket). -## -mcImage: - repository: minio/mc - tag: RELEASE.2020-11-25T23-04-07Z - pullPolicy: IfNotPresent - -## Set default image, imageTag, and imagePullPolicy for the `jq` (the JSON -## process used to create secret for prometheus ServiceMonitor). -## -helmKubectlJqImage: - repository: bskim45/helm-kubectl-jq - tag: 3.1.0 - pullPolicy: IfNotPresent - -## minio server mode, i.e. standalone or distributed. -## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide -## -mode: standalone - -## Additional arguments to pass to minio binary -extraArgs: [] - -## Update strategy for Deployments -DeploymentUpdate: - type: RollingUpdate - maxUnavailable: 0 - maxSurge: 100% - -## Update strategy for StatefulSets -StatefulSetUpdate: - updateStrategy: RollingUpdate - -## Pod priority settings -## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ -## -priorityClassName: "" - -## Set default accesskey, secretkey, Minio config file path, volume mount path and -## number of nodes (only used for Minio distributed mode) -## AccessKey and secretKey is generated when not set -## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide -## -accessKey: "" -secretKey: "" -certsPath: "/etc/minio/certs/" -configPathmc: "/etc/minio/mc/" -mountPath: "/export" - -## Use existing Secret that store following variables: -## -## | Chart var | .data. in Secret | -## |:----------------------|:-------------------------| -## | accessKey | accesskey | -## | secretKey | secretkey | -## | gcsgateway.gcsKeyJson | gcs_key.json | -## | s3gateway.accessKey | awsAccessKeyId | -## | s3gateway.secretKey | awsSecretAccessKey | -## | etcd.clientCert | etcd_client_cert.pem | -## | etcd.clientCertKey | etcd_client_cert_key.pem | -## -## All mentioned variables will be ignored in values file. -## .data.accesskey and .data.secretkey are mandatory, -## others depend on enabled status of corresponding sections. -existingSecret: "" - -## Override the root directory which the minio server should serve from. -## If left empty, it defaults to the value of {{ .Values.mountPath }} -## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }} -bucketRoot: "" - -# Number of drives attached to a node -drivesPerNode: 1 -# Number of MinIO containers running -replicas: 4 -# Number of expanded MinIO clusters -zones: 1 - -## TLS Settings for Minio -tls: - enabled: false - ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret - certSecret: "" - publicCrt: public.crt - privateKey: private.key - -## Trusted Certificates Settings for Minio. Ref: https://docs.minio.io/docs/how-to-secure-access-to-minio-server-with-tls#install-certificates-from-third-party-cas -## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret -## When using self-signed certificates, remember to include Minio's own certificate in the bundle with key public.crt. -## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret. -trustedCertsSecret: "" - -## Enable persistence using Persistent Volume Claims -## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ -## -persistence: - enabled: true - - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound - existingClaim: "" - - ## minio data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - ## Storage class of PV to bind. By default it looks for standard storage class. - ## If the PV uses a different storage class, specify that here. - storageClass: "" - VolumeName: "" - accessMode: ReadWriteOnce - size: 500Gi - - ## If subPath is set mount a sub folder of a volume instead of the root of the volume. - ## This is especially handy for volume plugins that don't natively support sub mounting (like glusterfs). - ## - subPath: "" - -## Expose the Minio service to be accessed from outside the cluster (LoadBalancer service). -## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it. -## ref: http://kubernetes.io/docs/user-guide/services/ -## - -service: - type: ClusterIP - clusterIP: ~ - port: 9000 - nodePort: 32000 - - ## List of IP addresses at which the Prometheus server service is available - ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips - ## - externalIPs: [] - # - externalIp1 - - annotations: {} - # prometheus.io/scrape: 'true' - # prometheus.io/path: '/minio/prometheus/metrics' - # prometheus.io/port: '9000' - -## Configure Ingress based on the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/ -## - -imagePullSecrets: [] -# - name: "image-pull-secret" - -ingress: - enabled: false - labels: {} - # node-role.kubernetes.io/ingress: platform - - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # kubernetes.io/ingress.allow-http: "false" - # kubernetes.io/ingress.global-static-ip-name: "" - # nginx.ingress.kubernetes.io/secure-backends: "true" - # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" - # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 - path: / - hosts: - - chart-example.local - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - -## Node labels for pod assignment -## Ref: https://kubernetes.io/docs/user-guide/node-selection/ -## -nodeSelector: {} -tolerations: [] -affinity: {} - -## Add stateful containers to have security context, if enabled MinIO will run as this -## user and group NOTE: securityContext is only enabled if persistence.enabled=true -securityContext: - enabled: true - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - -# Additational pod annotations -podAnnotations: {} - -# Additional pod labels -podLabels: {} - -## Configure resource requests and limits -## ref: http://kubernetes.io/docs/user-guide/compute-resources/ -## -resources: - requests: - memory: 4Gi - -## Create a bucket after minio install -## -defaultBucket: - enabled: false - ## If enabled, must be a string with length > 0 - name: bucket - ## Can be one of none|download|upload|public - policy: none - ## Purge if bucket exists already - purge: false - ## set versioning for bucket true|false - # versioning: false - -## Create multiple buckets after minio install -## Enabling `defaultBucket` will take priority over this list -## -buckets: [] - # - name: bucket1 - # policy: none - # purge: false - # - name: bucket2 - # policy: none - # purge: false - -## Additional Annotations for the Kubernetes Batch (make-bucket-job) -makeBucketJob: - podAnnotations: - annotations: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - resources: - requests: - memory: 128Mi - -## Additional Annotations for the Kubernetes Batch (update-prometheus-secret) -updatePrometheusJob: - podAnnotations: - annotations: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - -s3gateway: - enabled: false - replicas: 4 - serviceEndpoint: "" - accessKey: "" - secretKey: "" - -## Use minio as an azure blob gateway, you should disable data persistence so no volume claim are created. -## https://docs.minio.io/docs/minio-gateway-for-azure -azuregateway: - enabled: false - # Number of parallel instances - replicas: 4 - -## Use minio as GCS (Google Cloud Storage) gateway, you should disable data persistence so no volume claim are created. -## https://docs.minio.io/docs/minio-gateway-for-gcs - -gcsgateway: - enabled: false - # Number of parallel instances - replicas: 4 - # credential json file of service account key - gcsKeyJson: "" - # Google cloud project-id - projectId: "" - -## Use minio on NAS backend -## https://docs.minio.io/docs/minio-gateway-for-nas - -nasgateway: - enabled: false - # Number of parallel instances - replicas: 4 - # For NAS Gateway, you may want to bind the PVC to a specific PV. To ensure that happens, PV to bind to should have - # a label like "pv: ", use value here. - pv: ~ - -## Use this field to add environment variables relevant to Minio server. These fields will be passed on to Minio container(s) -## when Chart is deployed -environment: {} - ## Please refer for comprehensive list https://docs.minio.io/docs/minio-server-configuration-guide.html - ## MINIO_DOMAIN: "chart-example.local" - ## MINIO_BROWSER: "off" - -networkPolicy: - enabled: false - allowExternal: true - -## PodDisruptionBudget settings -## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ -## -podDisruptionBudget: - enabled: false - maxUnavailable: 1 - -## Specify the service account to use for the Minio pods. If 'create' is set to 'false' -## and 'name' is left unspecified, the account 'default' will be used. -serviceAccount: - create: true - ## The name of the service account to use. If 'create' is 'true', a service account with that name - ## will be created. Otherwise, a name will be auto-generated. - name: - -metrics: - # Metrics can not be disabled yet: https://github.com/minio/minio/issues/7493 - serviceMonitor: - enabled: false - additionalLabels: {} - relabelConfigs: {} - # namespace: monitoring - # interval: 30s - # scrapeTimeout: 10s - -## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md -## Define endpoints to enable this section. -etcd: - endpoints: [] - pathPrefix: "" - corednsPathPrefix: "" - clientCert: "" - clientCertKey: "" diff --git a/packs/minio-8.0.10/charts/minio/templates/NOTES.txt b/packs/minio-8.0.10/charts/minio/templates/NOTES.txt deleted file mode 100644 index 679f1ea8..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/NOTES.txt +++ /dev/null @@ -1,47 +0,0 @@ -{{- if eq .Values.service.type "ClusterIP" "NodePort" }} -Minio can be accessed via port {{ .Values.service.port }} on the following DNS name from within your cluster: -{{ template "minio.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local - -To access Minio from localhost, run the below commands: - - 1. export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "release={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}") - - 2. kubectl port-forward $POD_NAME 9000 --namespace {{ .Release.Namespace }} - -Read more about port forwarding here: http://kubernetes.io/docs/user-guide/kubectl/kubectl_port-forward/ - -You can now access Minio server on http://localhost:9000. Follow the below steps to connect to Minio server with mc client: - - 1. Download the Minio mc client - https://docs.minio.io/docs/minio-client-quickstart-guide - - 2. Get the ACCESS_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.accesskey}" | base64 --decode) and the SECRET_KEY=$(kubectl get secret {{ template "minio.secretName" . }} -o jsonpath="{.data.secretkey}" | base64 --decode) - - 3. mc alias set {{ template "minio.fullname" . }}-local http://localhost:{{ .Values.service.port }} "$ACCESS_KEY" "$SECRET_KEY" --api s3v4 - - 4. mc ls {{ template "minio.fullname" . }}-local - -Alternately, you can use your browser or the Minio SDK to access the server - https://docs.minio.io/categories/17 -{{- end }} -{{- if eq .Values.service.type "LoadBalancer" }} -Minio can be accessed via port {{ .Values.service.port }} on an external IP address. Get the service external IP address by: -kubectl get svc --namespace {{ .Release.Namespace }} -l app={{ template "minio.fullname" . }} - -Note that the public IP may take a couple of minutes to be available. - -You can now access Minio server on http://:9000. Follow the below steps to connect to Minio server with mc client: - - 1. Download the Minio mc client - https://docs.minio.io/docs/minio-client-quickstart-guide - - 2. Get the ACCESS_KEY=$(kubectl get secret {{ template "minio.secretName" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.data.accesskey}" | base64 --decode) and the SECRET_KEY=$(kubectl get secret {{ template "minio.secretName" . }} --namespace {{ .Release.Namespace }} -o jsonpath="{.data.secretkey}" | base64 --decode) - 3. mc alias set {{ template "minio.fullname" . }} http://:{{ .Values.service.port }} "$ACCESS_KEY" "$SECRET_KEY" --api s3v4 - - 4. mc ls {{ template "minio.fullname" . }} - -Alternately, you can use your browser or the Minio SDK to access the server - https://docs.minio.io/categories/17 -{{- end }} - -{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} -Note: Since NetworkPolicy is enabled, only pods with label -{{ template "minio.fullname" . }}-client=true" -will be able to connect to this minio cluster. -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/templates/_helper_create_bucket.txt b/packs/minio-8.0.10/charts/minio/templates/_helper_create_bucket.txt deleted file mode 100644 index ad2f546b..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/_helper_create_bucket.txt +++ /dev/null @@ -1,111 +0,0 @@ -#!/bin/sh -set -e ; # Have script exit in the event of a failed command. - -{{- if .Values.configPathmc }} -MC_CONFIG_DIR="{{ .Values.configPathmc }}" -MC="/usr/bin/mc --insecure --config-dir ${MC_CONFIG_DIR}" -{{- else }} -MC="/usr/bin/mc --insecure" -{{- end }} - -# connectToMinio -# Use a check-sleep-check loop to wait for Minio service to be available -connectToMinio() { - SCHEME=$1 - ATTEMPTS=0 ; LIMIT=29 ; # Allow 30 attempts - set -e ; # fail if we can't read the keys. - ACCESS=$(cat /config/accesskey) ; SECRET=$(cat /config/secretkey) ; - set +e ; # The connections to minio are allowed to fail. - echo "Connecting to Minio server: $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT" ; - MC_COMMAND="${MC} config host add myminio $SCHEME://$MINIO_ENDPOINT:$MINIO_PORT $ACCESS $SECRET" ; - $MC_COMMAND ; - STATUS=$? ; - until [ $STATUS = 0 ] - do - ATTEMPTS=`expr $ATTEMPTS + 1` ; - echo \"Failed attempts: $ATTEMPTS\" ; - if [ $ATTEMPTS -gt $LIMIT ]; then - exit 1 ; - fi ; - sleep 2 ; # 1 second intervals between attempts - $MC_COMMAND ; - STATUS=$? ; - done ; - set -e ; # reset `e` as active - return 0 -} - -# checkBucketExists ($bucket) -# Check if the bucket exists, by using the exit code of `mc ls` -checkBucketExists() { - BUCKET=$1 - CMD=$(${MC} ls myminio/$BUCKET > /dev/null 2>&1) - return $? -} - -# createBucket ($bucket, $policy, $purge) -# Ensure bucket exists, purging if asked to -createBucket() { - BUCKET=$1 - POLICY=$2 - PURGE=$3 - VERSIONING=$4 - - # Purge the bucket, if set & exists - # Since PURGE is user input, check explicitly for `true` - if [ $PURGE = true ]; then - if checkBucketExists $BUCKET ; then - echo "Purging bucket '$BUCKET'." - set +e ; # don't exit if this fails - ${MC} rm -r --force myminio/$BUCKET - set -e ; # reset `e` as active - else - echo "Bucket '$BUCKET' does not exist, skipping purge." - fi - fi - - # Create the bucket if it does not exist - if ! checkBucketExists $BUCKET ; then - echo "Creating bucket '$BUCKET'" - ${MC} mb myminio/$BUCKET - else - echo "Bucket '$BUCKET' already exists." - fi - - - # set versioning for bucket - if [ ! -z $VERSIONING ] ; then - if [ $VERSIONING = true ] ; then - echo "Enabling versioning for '$BUCKET'" - ${MC} version enable myminio/$BUCKET - elif [ $VERSIONING = false ] ; then - echo "Suspending versioning for '$BUCKET'" - ${MC} version suspend myminio/$BUCKET - fi - else - echo "Bucket '$BUCKET' versioning unchanged." - fi - - # At this point, the bucket should exist, skip checking for existence - # Set policy on the bucket - echo "Setting policy of bucket '$BUCKET' to '$POLICY'." - ${MC} policy set $POLICY myminio/$BUCKET -} - -# Try connecting to Minio instance -{{- if .Values.tls.enabled }} -scheme=https -{{- else }} -scheme=http -{{- end }} -connectToMinio $scheme - -{{- if or .Values.defaultBucket.enabled }} -# Create the bucket -createBucket {{ .Values.defaultBucket.name }} {{ .Values.defaultBucket.policy }} {{ .Values.defaultBucket.purge }} {{ .Values.defaultBucket.versioning }} -{{ else if .Values.buckets }} -# Create the buckets -{{- range .Values.buckets }} -createBucket {{ .name }} {{ .policy }} {{ .purge }} {{ .versioning }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/templates/_helpers.tpl b/packs/minio-8.0.10/charts/minio/templates/_helpers.tpl deleted file mode 100644 index 0b14618a..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/_helpers.tpl +++ /dev/null @@ -1,182 +0,0 @@ -{{/* vim: set filetype=mustache: */}} -{{/* -Expand the name of the chart. -*/}} -{{- define "minio.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "minio.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "minio.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for networkpolicy. -*/}} -{{- define "minio.networkPolicy.apiVersion" -}} -{{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.Version -}} -{{- print "extensions/v1beta1" -}} -{{- else if semverCompare "^1.7-0" .Capabilities.KubeVersion.Version -}} -{{- print "networking.k8s.io/v1beta1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for deployment. -*/}} -{{- define "minio.deployment.apiVersion" -}} -{{- if semverCompare "<1.9-0" .Capabilities.KubeVersion.Version -}} -{{- print "apps/v1beta2" -}} -{{- else -}} -{{- print "apps/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for statefulset. -*/}} -{{- define "minio.statefulset.apiVersion" -}} -{{- if semverCompare "<1.16-0" .Capabilities.KubeVersion.Version -}} -{{- print "apps/v1beta2" -}} -{{- else -}} -{{- print "apps/v1" -}} -{{- end -}} -{{- end -}} - -{{/* -Return the appropriate apiVersion for ingress. -*/}} -{{- define "minio.ingress.apiVersion" -}} -{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}} -{{- print "extensions/v1beta1" -}} -{{- else -}} -{{- print "networking.k8s.io/v1beta1" -}} -{{- end -}} -{{- end -}} - -{{/* -Determine secret name. -*/}} -{{- define "minio.secretName" -}} -{{- if .Values.existingSecret -}} -{{- .Values.existingSecret }} -{{- else -}} -{{- include "minio.fullname" . -}} -{{- end -}} -{{- end -}} - -{{/* -Determine service account name for deployment or statefulset. -*/}} -{{- define "minio.serviceAccountName" -}} -{{- if .Values.serviceAccount.create -}} -{{- default (include "minio.fullname" .) .Values.serviceAccount.name | replace "+" "_" | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- default "default" .Values.serviceAccount.name -}} -{{- end -}} -{{- end -}} - -{{/* -Determine name for scc role and rolebinding -*/}} -{{- define "minio.sccRoleName" -}} -{{- printf "%s-%s" "scc" (include "minio.fullname" .) | trunc 63 | trimSuffix "-" -}} -{{- end -}} - -{{/* -Properly format optional additional arguments to Minio binary -*/}} -{{- define "minio.extraArgs" -}} -{{- range .Values.extraArgs -}} -{{ " " }}{{ . }} -{{- end -}} -{{- end -}} - -{{/* -Return the proper Docker Image Registry Secret Names -*/}} -{{- define "minio.imagePullSecrets" -}} -{{/* -Helm 2.11 supports the assignment of a value to a variable defined in a different scope, -but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. -Also, we can not use a single if because lazy evaluation is not an option -*/}} -{{- if .Values.global }} -{{- if .Values.global.imagePullSecrets }} -imagePullSecrets: -{{- range .Values.global.imagePullSecrets }} - - name: {{ . }} -{{- end }} -{{- else if .Values.imagePullSecrets }} -imagePullSecrets: - {{ toYaml .Values.imagePullSecrets }} -{{- end -}} -{{- else if .Values.imagePullSecrets }} -imagePullSecrets: - {{ toYaml .Values.imagePullSecrets }} -{{- end -}} -{{- end -}} - -{{/* -Formats volumeMount for Minio tls keys and trusted certs -*/}} -{{- define "minio.tlsKeysVolumeMount" -}} -{{- if .Values.tls.enabled }} -- name: cert-secret-volume - mountPath: {{ .Values.certsPath }} -{{- end }} -{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} -{{- $casPath := printf "%s/CAs" .Values.certsPath | clean }} -- name: trusted-cert-secret-volume - mountPath: {{ $casPath }} -{{- end }} -{{- end -}} - -{{/* -Formats volume for Minio tls keys and trusted certs -*/}} -{{- define "minio.tlsKeysVolume" -}} -{{- if .Values.tls.enabled }} -- name: cert-secret-volume - secret: - secretName: {{ .Values.tls.certSecret }} - items: - - key: {{ .Values.tls.publicCrt }} - path: public.crt - - key: {{ .Values.tls.privateKey }} - path: private.key -{{- end }} -{{- if or .Values.tls.enabled (ne .Values.trustedCertsSecret "") }} -{{- $certSecret := eq .Values.trustedCertsSecret "" | ternary .Values.tls.certSecret .Values.trustedCertsSecret }} -{{- $publicCrt := eq .Values.trustedCertsSecret "" | ternary .Values.tls.publicCrt "" }} -- name: trusted-cert-secret-volume - secret: - secretName: {{ $certSecret }} - {{- if ne $publicCrt "" }} - items: - - key: {{ $publicCrt }} - path: public.crt - {{- end }} -{{- end }} -{{- end -}} diff --git a/packs/minio-8.0.10/charts/minio/templates/clusterroles.yaml b/packs/minio-8.0.10/charts/minio/templates/clusterroles.yaml deleted file mode 100644 index c4d9a937..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/clusterroles.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: {{ template "minio.serviceAccountName" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: -- apiGroups: - - security.openshift.io - resources: - - securitycontextconstraints - resourceNames: - - {{ template "minio.fullname" . }} - verbs: - - use -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/templates/configmap.yaml b/packs/minio-8.0.10/charts/minio/templates/configmap.yaml deleted file mode 100644 index cb11fcd7..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/configmap.yaml +++ /dev/null @@ -1,12 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -data: - initialize: |- -{{ include (print $.Template.BasePath "/_helper_create_bucket.txt") . | indent 4 }} diff --git a/packs/minio-8.0.10/charts/minio/templates/deployment.yaml b/packs/minio-8.0.10/charts/minio/templates/deployment.yaml deleted file mode 100644 index 2fa9edf1..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/deployment.yaml +++ /dev/null @@ -1,203 +0,0 @@ -{{- if eq .Values.mode "standalone" }} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} -apiVersion: {{ template "minio.deployment.apiVersion" . }} -kind: Deployment -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - strategy: - type: {{ .Values.DeploymentUpdate.type }} - {{- if eq .Values.DeploymentUpdate.type "RollingUpdate" }} - rollingUpdate: - maxSurge: {{ .Values.DeploymentUpdate.maxSurge }} - maxUnavailable: {{ .Values.DeploymentUpdate.maxUnavailable }} - {{- end}} - {{- if .Values.nasgateway.enabled }} - replicas: {{ .Values.nasgateway.replicas }} - {{- end }} - {{- if .Values.s3gateway.enabled }} - replicas: {{ .Values.s3gateway.replicas }} - {{- end }} - {{- if .Values.azuregateway.enabled }} - replicas: {{ .Values.azuregateway.replicas }} - {{- end }} - {{- if .Values.gcsgateway.enabled }} - replicas: {{ .Values.gcsgateway.replicas }} - {{- end }} - selector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - template: - metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} - annotations: - checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} -{{- if .Values.podAnnotations }} -{{ toYaml .Values.podAnnotations | trimSuffix "\n" | indent 8 }} -{{- end }} - spec: - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} - serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} -{{- if and .Values.securityContext.enabled .Values.persistence.enabled }} - securityContext: - runAsUser: {{ .Values.securityContext.runAsUser }} - runAsGroup: {{ .Values.securityContext.runAsGroup }} - fsGroup: {{ .Values.securityContext.fsGroup }} -{{- end }} - containers: - - name: {{ .Chart.Name }} - image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" - imagePullPolicy: {{ .Values.image.pullPolicy }} - {{- if .Values.s3gateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway s3 {{ .Values.s3gateway.serviceEndpoint }} {{- template "minio.extraArgs" . }}" - {{- else }} - {{- if .Values.azuregateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway azure {{- template "minio.extraArgs" . }}" - {{- else }} - {{- if .Values.gcsgateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway gcs {{ .Values.gcsgateway.projectId }} {{- template "minio.extraArgs" . }}" - {{- else }} - {{- if .Values.nasgateway.enabled }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} gateway nas {{ $bucketRoot }} {{- template "minio.extraArgs" . }}" - {{- else }} - command: - - "/bin/sh" - - "-ce" - - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{ $bucketRoot }} {{- template "minio.extraArgs" . }}" - {{- end }} - {{- end }} - {{- end }} - {{- end }} - volumeMounts: - {{- if and .Values.persistence.enabled (not .Values.gcsgateway.enabled) (not .Values.azuregateway.enabled) (not .Values.s3gateway.enabled) }} - - name: export - mountPath: {{ .Values.mountPath }} - {{- if .Values.persistence.subPath }} - subPath: "{{ .Values.persistence.subPath }}" - {{- end }} - {{- end }} - {{- if or .Values.gcsgateway.enabled .Values.etcd.clientCert .Values.etcd.clientCertKey }} - - name: minio-user - mountPath: "/etc/credentials" - readOnly: true - {{- end }} - {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} - ports: - - name: {{ $scheme }} - containerPort: 9000 - env: - - name: MINIO_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: accesskey - - name: MINIO_SECRET_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: secretkey - {{- if and .Values.gcsgateway.enabled .Values.gcsgateway.gcsKeyJson }} - - name: GOOGLE_APPLICATION_CREDENTIALS - value: "/etc/credentials/gcs_key.json" - {{- end }} - {{- if .Values.etcd.endpoints }} - - name: MINIO_ETCD_ENDPOINTS - value: {{ join "," .Values.etcd.endpoints | quote }} - {{- if .Values.etcd.clientCert }} - - name: MINIO_ETCD_CLIENT_CERT - value: "/etc/credentials/etcd_client_cert.pem" - {{- end }} - {{- if .Values.etcd.clientCertKey }} - - name: MINIO_ETCD_CLIENT_CERT_KEY - value: "/etc/credentials/etcd_client_cert_key.pem" - {{- end }} - {{- if .Values.etcd.pathPrefix }} - - name: MINIO_ETCD_PATH_PREFIX - value: {{ .Values.etcd.pathPrefix }} - {{- end }} - {{- if .Values.etcd.corednsPathPrefix }} - - name: MINIO_ETCD_COREDNS_PATH - value: {{ .Values.etcd.corednsPathPrefix }} - {{- end }} - {{- end }} - {{- if .Values.s3gateway.enabled -}} - {{- if or .Values.s3gateway.accessKey .Values.existingSecret }} - - name: AWS_ACCESS_KEY_ID - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: awsAccessKeyId - {{- end }} - {{- if or .Values.s3gateway.secretKey .Values.existingSecret }} - - name: AWS_SECRET_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: awsSecretAccessKey - {{- end }} - {{- end }} - {{- range $key, $val := .Values.environment }} - - name: {{ $key }} - value: {{ $val | quote }} - {{- end}} - resources: -{{ toYaml .Values.resources | indent 12 }} -{{- with .Values.nodeSelector }} - nodeSelector: -{{ toYaml . | indent 8 }} -{{- end }} -{{- include "minio.imagePullSecrets" . | indent 6 }} -{{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} -{{- end }} - volumes: - {{- if and (not .Values.gcsgateway.enabled) (not .Values.azuregateway.enabled) (not .Values.s3gateway.enabled) }} - - name: export - {{- if .Values.persistence.enabled }} - persistentVolumeClaim: - claimName: {{ .Values.persistence.existingClaim | default (include "minio.fullname" .) }} - {{- else }} - emptyDir: {} - {{- end }} - {{- end }} - - name: minio-user - secret: - secretName: {{ template "minio.secretName" . }} - {{- include "minio.tlsKeysVolume" . | indent 8 }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/templates/ingress.yaml b/packs/minio-8.0.10/charts/minio/templates/ingress.yaml deleted file mode 100644 index 2d9bbda0..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/ingress.yaml +++ /dev/null @@ -1,45 +0,0 @@ -{{- if .Values.ingress.enabled -}} -{{- $fullName := include "minio.fullname" . -}} -{{- $servicePort := .Values.service.port -}} -{{- $ingressPath := .Values.ingress.path -}} -apiVersion: {{ template "minio.ingress.apiVersion" . }} -kind: Ingress -metadata: - name: {{ $fullName }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- with .Values.ingress.labels }} -{{ toYaml . | indent 4 }} -{{- end }} - -{{- with .Values.ingress.annotations }} - annotations: -{{ toYaml . | indent 4 }} -{{- end }} -spec: -{{- if .Values.ingress.tls }} - tls: - {{- range .Values.ingress.tls }} - - hosts: - {{- range .hosts }} - - {{ . | quote }} - {{- end }} - secretName: {{ .secretName }} - {{- end }} -{{- end }} - rules: - {{- range .Values.ingress.hosts }} - - http: - paths: - - path: {{ $ingressPath }} - backend: - serviceName: {{ $fullName }} - servicePort: {{ $servicePort }} - {{- if . }} - host: {{ . | quote }} - {{- end }} - {{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/templates/networkpolicy.yaml b/packs/minio-8.0.10/charts/minio/templates/networkpolicy.yaml deleted file mode 100644 index de57f485..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/networkpolicy.yaml +++ /dev/null @@ -1,25 +0,0 @@ -{{- if .Values.networkPolicy.enabled }} -kind: NetworkPolicy -apiVersion: {{ template "minio.networkPolicy.apiVersion" . }} -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - podSelector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - ingress: - - ports: - - port: {{ .Values.service.port }} - {{- if not .Values.networkPolicy.allowExternal }} - from: - - podSelector: - matchLabels: - {{ template "minio.name" . }}-client: "true" - {{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/templates/poddisruptionbudget.yaml b/packs/minio-8.0.10/charts/minio/templates/poddisruptionbudget.yaml deleted file mode 100644 index 1de813b8..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/poddisruptionbudget.yaml +++ /dev/null @@ -1,13 +0,0 @@ -{{- if .Values.podDisruptionBudget.enabled }} -apiVersion: policy/v1beta1 -kind: PodDisruptionBudget -metadata: - name: minio - labels: - app: {{ template "minio.name" . }} -spec: - maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} - selector: - matchLabels: - app: {{ template "minio.name" . }} -{{- end }} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio/templates/post-install-create-bucket-job.yaml b/packs/minio-8.0.10/charts/minio/templates/post-install-create-bucket-job.yaml deleted file mode 100644 index 27e30d4a..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/post-install-create-bucket-job.yaml +++ /dev/null @@ -1,87 +0,0 @@ -{{- if or .Values.defaultBucket.enabled .Values.buckets }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ template "minio.fullname" . }}-make-bucket-job - labels: - app: {{ template "minio.name" . }}-make-bucket-job - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation -{{- with .Values.makeBucketJob.annotations }} -{{ toYaml . | indent 4 }} -{{- end }} -spec: - template: - metadata: - labels: - app: {{ template "minio.name" . }}-job - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} -{{- if .Values.makeBucketJob.podAnnotations }} - annotations: -{{ toYaml .Values.makeBucketJob.podAnnotations | indent 8 }} -{{- end }} - spec: - restartPolicy: OnFailure -{{- include "minio.imagePullSecrets" . | indent 6 }} -{{- if .Values.nodeSelector }} - nodeSelector: -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} -{{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} -{{- end }} -{{- if .Values.makeBucketJob.securityContext.enabled }} - securityContext: - runAsUser: {{ .Values.makeBucketJob.securityContext.runAsUser }} - runAsGroup: {{ .Values.makeBucketJob.securityContext.runAsGroup }} - fsGroup: {{ .Values.makeBucketJob.securityContext.fsGroup }} -{{- end }} - volumes: - - name: minio-configuration - projected: - sources: - - configMap: - name: {{ template "minio.fullname" . }} - - secret: - name: {{ template "minio.secretName" . }} - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - secret: - secretName: {{ .Values.tls.certSecret }} - items: - - key: {{ .Values.tls.publicCrt }} - path: CAs/public.crt - {{ end }} - serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} - containers: - - name: minio-mc - image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" - imagePullPolicy: {{ .Values.mcImage.pullPolicy }} - command: ["/bin/sh", "/config/initialize"] - env: - - name: MINIO_ENDPOINT - value: {{ template "minio.fullname" . }} - - name: MINIO_PORT - value: {{ .Values.service.port | quote }} - volumeMounts: - - name: minio-configuration - mountPath: /config - {{- if .Values.tls.enabled }} - - name: cert-secret-volume-mc - mountPath: {{ .Values.configPathmc }}certs - {{ end }} - resources: -{{ toYaml .Values.makeBucketJob.resources | indent 10 }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-job.yaml b/packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-job.yaml deleted file mode 100644 index d7590db7..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-job.yaml +++ /dev/null @@ -1,135 +0,0 @@ -{{- if .Values.metrics.serviceMonitor.enabled }} -{{- $fullName := include "minio.fullname" . -}} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -apiVersion: batch/v1 -kind: Job -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - annotations: - "helm.sh/hook": post-install,post-upgrade - "helm.sh/hook-weight": "-5" - "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation - {{ toYaml .Values.updatePrometheusJob.annotations | indent 4 }} -spec: - template: - metadata: - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} -{{- if .Values.updatePrometheusJob.podAnnotations }} - annotations: -{{ toYaml .Values.updatePrometheusJob.podAnnotations | indent 8 }} -{{- end }} - spec: -{{- if .Values.serviceAccount.create }} - serviceAccountName: {{ $fullName }}-update-prometheus-secret -{{- end }} - restartPolicy: OnFailure -{{- include "minio.imagePullSecrets" . | indent 6 }} -{{- if .Values.nodeSelector }} - nodeSelector: -{{ toYaml .Values.nodeSelector | indent 8 }} -{{- end }} -{{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} -{{- end }} -{{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} -{{- end }} -{{- if .Values.updatePrometheusJob.securityContext.enabled }} - securityContext: - runAsUser: {{ .Values.updatePrometheusJob.securityContext.runAsUser }} - runAsGroup: {{ .Values.updatePrometheusJob.securityContext.runAsGroup }} - fsGroup: {{ .Values.updatePrometheusJob.securityContext.fsGroup }} -{{- end }} - volumes: - - name: workdir - emptyDir: {} - initContainers: - - name: minio-mc - image: "{{ .Values.mcImage.repository }}:{{ .Values.mcImage.tag }}" - imagePullPolicy: {{ .Values.mcImage.pullPolicy }} - command: - - /bin/sh - - "-c" - - mc --config-dir {{ .Values.configPathmc }} admin prometheus generate target --json --no-color -q > /workdir/mc.json - env: - - name: MINIO_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: accesskey - - name: MINIO_SECRET_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: secretkey - # mc admin prometheus generate don't really connect to remote server, TLS cert isn't required - - name: MC_HOST_target - value: {{ $scheme }}://$(MINIO_ACCESS_KEY):$(MINIO_SECRET_KEY)@{{ $fullName }}:{{ .Values.service.port }} - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} - # extract bearerToken from mc admin output - - name: jq - image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" - imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} - command: - - /bin/sh - - "-c" - - jq -e -c -j -r .bearerToken < /workdir/mc.json > /workdir/token - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} - - name: kubectl-create - image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" - imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} - command: - - /bin/sh - - "-c" - # The following script does: - # - get the servicemonitor that need this secret and copy some metadata and create the ownerreference for the secret file - # - create the secret - # - merge both json - - > - kubectl -n {{ .Release.Namespace }} get servicemonitor {{ $fullName }} -o json | - jq -c '{metadata: {name: "{{ $fullName }}-prometheus", namespace: .metadata.namespace, labels: {app: .metadata.labels.app, release: .metadata.labels.release}, ownerReferences: [{apiVersion: .apiVersion, kind: .kind, blockOwnerDeletion: true, controller: true, uid: .metadata.uid, name: .metadata.name}]}}' > /workdir/metadata.json && - kubectl create secret generic {{ $fullName }}-prometheus --from-file=token=/workdir/token --dry-run -o json > /workdir/secret.json && - cat /workdir/secret.json /workdir/metadata.json | jq -s add > /workdir/object.json - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} - containers: - - name: kubectl-apply - image: "{{ .Values.helmKubectlJqImage.repository }}:{{ .Values.helmKubectlJqImage.tag }}" - imagePullPolicy: {{ .Values.helmKubectlJqImage.pullPolicy }} - command: - - kubectl - - apply - - "-f" - - /workdir/object.json - volumeMounts: - - name: workdir - mountPath: /workdir - resources: -{{ toYaml .Values.resources | indent 12 }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-role.yaml b/packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-role.yaml deleted file mode 100644 index 26c0ce7e..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-role.yaml +++ /dev/null @@ -1,38 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -{{- $fullName := include "minio.fullname" . -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: - - apiGroups: - - "" - resources: - - secrets - verbs: - - get - - create - - update - - patch - resourceNames: - - {{ $fullName }}-prometheus - - apiGroups: - - "" - resources: - - secrets - verbs: - - create - - apiGroups: - - monitoring.coreos.com - resources: - - servicemonitors - verbs: - - get - resourceNames: - - {{ $fullName }} -{{- end -}} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-rolebinding.yaml b/packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-rolebinding.yaml deleted file mode 100644 index 7d0ea75b..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-rolebinding.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -{{- $fullName := include "minio.fullname" . -}} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ $fullName }}-update-prometheus-secret -subjects: - - kind: ServiceAccount - name: {{ $fullName }}-update-prometheus-secret - namespace: {{ .Release.Namespace | quote }} -{{- end -}} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-serviceaccount.yaml b/packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-serviceaccount.yaml deleted file mode 100644 index 050d368a..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/post-install-prometheus-metrics-serviceaccount.yaml +++ /dev/null @@ -1,12 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -{{- $fullName := include "minio.fullname" . -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ $fullName }}-update-prometheus-secret - labels: - app: {{ template "minio.name" . }}-update-prometheus-secret - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- end -}} \ No newline at end of file diff --git a/packs/minio-8.0.10/charts/minio/templates/pvc.yaml b/packs/minio-8.0.10/charts/minio/templates/pvc.yaml deleted file mode 100644 index 014f90f3..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/pvc.yaml +++ /dev/null @@ -1,35 +0,0 @@ -{{- if eq .Values.mode "standalone" }} -{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }} -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: -{{- if and .Values.nasgateway.enabled .Values.nasgateway.pv }} - selector: - matchLabels: - pv: {{ .Values.nasgateway.pv | quote }} -{{- end }} - accessModes: - - {{ .Values.persistence.accessMode | quote }} - resources: - requests: - storage: {{ .Values.persistence.size | quote }} - -{{- if .Values.persistence.storageClass }} -{{- if (eq "-" .Values.persistence.storageClass) }} - storageClassName: "" -{{- else }} - storageClassName: "{{ .Values.persistence.storageClass }}" -{{- end }} -{{- end }} -{{- if .Values.persistence.VolumeName }} - volumeName: "{{ .Values.persistence.VolumeName }}" -{{- end }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/templates/rolebindings.yaml b/packs/minio-8.0.10/charts/minio/templates/rolebindings.yaml deleted file mode 100644 index ea8b98c5..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/rolebindings.yaml +++ /dev/null @@ -1,20 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: rbac.authorization.k8s.io/v1 -kind: RoleBinding -metadata: - name: {{ template "minio.serviceAccountName" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - namespace: {{ .Release.Namespace | quote }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: {{ template "minio.serviceAccountName" . }} -subjects: -- kind: ServiceAccount - name: {{ template "minio.serviceAccountName" . }} - namespace: {{ .Release.Namespace | quote }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/templates/secrets.yaml b/packs/minio-8.0.10/charts/minio/templates/secrets.yaml deleted file mode 100644 index c254142f..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/secrets.yaml +++ /dev/null @@ -1,32 +0,0 @@ -{{- if not .Values.existingSecret }} -apiVersion: v1 -kind: Secret -metadata: - name: {{ template "minio.secretName" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -type: Opaque -data: - accesskey: {{ if .Values.accessKey }}{{ .Values.accessKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 20 | b64enc | quote }}{{ end }} - secretkey: {{ if .Values.secretKey }}{{ .Values.secretKey | toString | b64enc | quote }}{{ else }}{{ randAlphaNum 40 | b64enc | quote }}{{ end }} -{{- if and .Values.gcsgateway.enabled .Values.gcsgateway.gcsKeyJson }} - gcs_key.json: {{ .Values.gcsgateway.gcsKeyJson | toString | b64enc }} -{{- end }} -{{- if .Values.s3gateway.enabled -}} -{{- if .Values.s3gateway.accessKey }} - awsAccessKeyId: {{ .Values.s3gateway.accessKey | toString | b64enc | quote }} -{{- end }} -{{- if .Values.s3gateway.secretKey }} - awsSecretAccessKey: {{ .Values.s3gateway.secretKey | toString | b64enc | quote }} -{{- end }} -{{- end }} -{{- if .Values.etcd.clientCert }} - etcd_client_cert.pem: {{ .Values.etcd.clientCert | toString | b64enc | quote }} -{{- end }} -{{- if .Values.etcd.clientCertKey }} - etcd_client_cert_key.pem: {{ .Values.etcd.clientCertKey | toString | b64enc | quote }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/templates/securitycontextconstraints.yaml b/packs/minio-8.0.10/charts/minio/templates/securitycontextconstraints.yaml deleted file mode 100644 index dfde6fb9..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/securitycontextconstraints.yaml +++ /dev/null @@ -1,46 +0,0 @@ -{{- if and .Values.securityContext.enabled .Values.persistence.enabled (.Capabilities.APIVersions.Has "security.openshift.io/v1") }} -apiVersion: security.openshift.io/v1 -kind: SecurityContextConstraints -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -priority: 10 -allowHostDirVolumePlugin: false -allowHostIPC: false -allowHostNetwork: false -allowHostPID: false -allowHostPorts: false -allowPrivilegeEscalation: true -allowPrivilegedContainer: false -allowedCapabilities: [] -readOnlyRootFilesystem: false -defaultAddCapabilities: [] -requiredDropCapabilities: -- KILL -- MKNOD -- SETUID -- SETGID -fsGroup: - type: MustRunAs - ranges: - - max: {{ .Values.securityContext.fsGroup }} - min: {{ .Values.securityContext.fsGroup }} -runAsUser: - type: MustRunAs - uid: {{ .Values.securityContext.runAsUser }} -seLinuxContext: - type: MustRunAs -supplementalGroups: - type: RunAsAny -volumes: -- configMap -- downwardAPI -- emptyDir -- persistentVolumeClaim -- projected -- secret -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/templates/service.yaml b/packs/minio-8.0.10/charts/minio/templates/service.yaml deleted file mode 100644 index ea681e22..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/service.yaml +++ /dev/null @@ -1,47 +0,0 @@ -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -{{- if .Values.service.annotations }} - annotations: -{{ toYaml .Values.service.annotations | indent 4 }} -{{- end }} -spec: -{{- if (or (eq .Values.service.type "ClusterIP" "") (empty .Values.service.type)) }} - type: ClusterIP - {{- if not (empty .Values.service.clusterIP) }} - clusterIP: {{ .Values.service.clusterIP }} - {{end}} -{{- else if eq .Values.service.type "LoadBalancer" }} - type: {{ .Values.service.type }} - loadBalancerIP: {{ default "" .Values.service.loadBalancerIP }} -{{- else }} - type: {{ .Values.service.type }} -{{- end }} - ports: - - name: {{ $scheme }} - port: {{ .Values.service.port }} - protocol: TCP -{{- if (and (eq .Values.service.type "NodePort") ( .Values.service.nodePort)) }} - nodePort: {{ .Values.service.nodePort }} -{{- else }} - targetPort: 9000 -{{- end}} -{{- if .Values.service.externalIPs }} - externalIPs: -{{- range $i , $ip := .Values.service.externalIPs }} - - {{ $ip }} -{{- end }} -{{- end }} - selector: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} diff --git a/packs/minio-8.0.10/charts/minio/templates/serviceaccount.yaml b/packs/minio-8.0.10/charts/minio/templates/serviceaccount.yaml deleted file mode 100644 index 243dfef5..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/serviceaccount.yaml +++ /dev/null @@ -1,11 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ include "minio.serviceAccountName" . | quote }} - namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: "{{ .Release.Name }}" -{{- end -}} diff --git a/packs/minio-8.0.10/charts/minio/templates/servicemonitor.yaml b/packs/minio-8.0.10/charts/minio/templates/servicemonitor.yaml deleted file mode 100644 index 2f474cba..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/servicemonitor.yaml +++ /dev/null @@ -1,44 +0,0 @@ -{{- if .Values.metrics.serviceMonitor.enabled }} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ template "minio.fullname" . }} - {{- if .Values.metrics.serviceMonitor.namespace }} - namespace: {{ .Values.metrics.serviceMonitor.namespace }} - {{- end }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.metrics.serviceMonitor.additionalLabels }} -{{ toYaml .Values.metrics.serviceMonitor.additionalLabels | indent 4 }} - {{- end }} -spec: - endpoints: - - port: {{ $scheme }} - path: /minio/prometheus/metrics - {{- if .Values.metrics.serviceMonitor.interval }} - interval: {{ .Values.metrics.serviceMonitor.interval }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} - scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.relabelConfigs }} -{{ toYaml .Values.metrics.serviceMonitor.relabelConfigs | indent 6 }} - {{- end }} - bearerTokenSecret: - name: {{ template "minio.fullname" . }}-prometheus - key: token - namespaceSelector: - matchNames: - - {{ .Release.Namespace | quote }} - selector: - matchLabels: - app: {{ include "minio.name" . }} - release: {{ .Release.Name }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/templates/statefulset.yaml b/packs/minio-8.0.10/charts/minio/templates/statefulset.yaml deleted file mode 100644 index b1d2d449..00000000 --- a/packs/minio-8.0.10/charts/minio/templates/statefulset.yaml +++ /dev/null @@ -1,174 +0,0 @@ -{{- if eq .Values.mode "distributed" }} -{{ $zoneCount := .Values.zones | int }} -{{ $nodeCount := .Values.replicas | int }} -{{ $drivesPerNode := .Values.drivesPerNode | int }} -{{ $scheme := "http" }} -{{- if .Values.tls.enabled }} -{{ $scheme = "https" }} -{{ end }} -{{ $mountPath := .Values.mountPath }} -{{ $bucketRoot := or ($.Values.bucketRoot) ($.Values.mountPath) }} -{{ $subPath := .Values.persistence.subPath }} -{{ $penabled := .Values.persistence.enabled }} -{{ $accessMode := .Values.persistence.accessMode }} -{{ $storageClass := .Values.persistence.storageClass }} -{{ $psize := .Values.persistence.size }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "minio.fullname" . }}-svc - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" -spec: - publishNotReadyAddresses: true - clusterIP: None - ports: - - name: {{ $scheme }} - port: {{ .Values.service.port }} - protocol: TCP - selector: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} ---- -apiVersion: {{ template "minio.statefulset.apiVersion" . }} -kind: StatefulSet -metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - chart: {{ template "minio.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -spec: - updateStrategy: - type: {{ .Values.StatefulSetUpdate.updateStrategy }} - podManagementPolicy: "Parallel" - serviceName: {{ template "minio.fullname" . }}-svc - replicas: {{ mul $zoneCount $nodeCount }} - selector: - matchLabels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} - template: - metadata: - name: {{ template "minio.fullname" . }} - labels: - app: {{ template "minio.name" . }} - release: {{ .Release.Name }} -{{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8 }} -{{- end }} - annotations: - checksum/secrets: {{ include (print $.Template.BasePath "/secrets.yaml") . | sha256sum }} - checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} -{{- if .Values.podAnnotations }} -{{ toYaml .Values.podAnnotations | trimSuffix "\n" | indent 8 }} -{{- end }} - spec: - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" - {{- end }} - serviceAccountName: {{ include "minio.serviceAccountName" . | quote }} -{{- if and .Values.securityContext.enabled .Values.persistence.enabled }} - securityContext: - runAsUser: {{ .Values.securityContext.runAsUser }} - runAsGroup: {{ .Values.securityContext.runAsGroup }} - fsGroup: {{ .Values.securityContext.fsGroup }} -{{- end }} - containers: - - name: {{ .Chart.Name }} - image: {{ .Values.image.repository }}:{{ .Values.image.tag }} - imagePullPolicy: {{ .Values.image.pullPolicy }} - - command: [ "/bin/sh", - "-ce", - "/usr/bin/docker-entrypoint.sh minio -S {{ .Values.certsPath }} server {{- range $i := until $zoneCount }}{{ $factor := mul $i $nodeCount }}{{ $endIndex := add $factor $nodeCount }}{{ $beginIndex := mul $i $nodeCount }} {{ $scheme }}://{{ template `minio.fullname` $ }}-{{ `{` }}{{ $beginIndex }}...{{ sub $endIndex 1 }}{{ `}`}}.{{ template `minio.fullname` $ }}-svc.{{ $.Release.Namespace }}.svc.{{ $.Values.clusterDomain }}{{if (gt $drivesPerNode 1)}}{{ $bucketRoot }}-{{ `{` }}0...{{ sub $drivesPerNode 1 }}{{ `}` }}{{else}}{{ $bucketRoot }}{{end}}{{- end}}{{- template `minio.extraArgs` . }}" ] - volumeMounts: - {{- if $penabled }} - {{- if (gt $drivesPerNode 1) }} - {{- range $i := until $drivesPerNode }} - - name: export-{{ $i }} - mountPath: {{ $mountPath }}-{{ $i }} - {{- if and $penabled $subPath }} - subPath: {{ $subPath }} - {{- end }} - {{- end }} - {{- else }} - - name: export - mountPath: {{ $mountPath }} - {{- if and $penabled $subPath }} - subPath: {{ $subPath }} - {{- end }} - {{- end }} - {{- end }} - {{- include "minio.tlsKeysVolumeMount" . | indent 12 }} - ports: - - name: {{ $scheme }} - containerPort: 9000 - env: - - name: MINIO_ACCESS_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: accesskey - - name: MINIO_SECRET_KEY - valueFrom: - secretKeyRef: - name: {{ template "minio.secretName" . }} - key: secretkey - {{- range $key, $val := .Values.environment }} - - name: {{ $key }} - value: {{ $val | quote }} - {{- end}} - resources: -{{ toYaml .Values.resources | indent 12 }} - {{- with .Values.nodeSelector }} - nodeSelector: -{{ toYaml . | indent 8 }} - {{- end }} -{{- include "minio.imagePullSecrets" . | indent 6 }} - {{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} - {{- end }} - volumes: - - name: minio-user - secret: - secretName: {{ template "minio.secretName" . }} - {{- include "minio.tlsKeysVolume" . | indent 8 }} -{{- if .Values.persistence.enabled }} - volumeClaimTemplates: - {{- if gt $drivesPerNode 1 }} - {{- range $diskId := until $drivesPerNode}} - - metadata: - name: export-{{ $diskId }} - spec: - accessModes: [ {{ $accessMode | quote }} ] - {{- if $storageClass }} - storageClassName: {{ $storageClass }} - {{- end }} - resources: - requests: - storage: {{ $psize }} - {{- end }} - {{- else }} - - metadata: - name: export - spec: - accessModes: [ {{ $accessMode | quote }} ] - {{- if $storageClass }} - storageClassName: {{ $storageClass }} - {{- end }} - resources: - requests: - storage: {{ $psize }} - {{- end }} -{{- end }} -{{- end }} diff --git a/packs/minio-8.0.10/charts/minio/values.yaml b/packs/minio-8.0.10/charts/minio/values.yaml deleted file mode 100644 index 8d70d4d3..00000000 --- a/packs/minio-8.0.10/charts/minio/values.yaml +++ /dev/null @@ -1,347 +0,0 @@ -## Provide a name in place of minio for `app:` labels -## -nameOverride: "" - -## Provide a name to substitute for the full names of resources -## -fullnameOverride: "" - -## set kubernetes cluster domain where minio is running -## -clusterDomain: cluster.local - -## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the -## -image: - repository: minio/minio - tag: RELEASE.2020-12-03T05-49-24Z - pullPolicy: IfNotPresent - -## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio -## client used to create a default bucket). -## -mcImage: - repository: minio/mc - tag: RELEASE.2020-11-25T23-04-07Z - pullPolicy: IfNotPresent - -## Set default image, imageTag, and imagePullPolicy for the `jq` (the JSON -## process used to create secret for prometheus ServiceMonitor). -## -helmKubectlJqImage: - repository: bskim45/helm-kubectl-jq - tag: 3.1.0 - pullPolicy: IfNotPresent - -## minio server mode, i.e. standalone or distributed. -## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide -## -mode: standalone - -## Additional arguments to pass to minio binary -extraArgs: [] - -## Update strategy for Deployments -DeploymentUpdate: - type: RollingUpdate - maxUnavailable: 0 - maxSurge: 100% - -## Update strategy for StatefulSets -StatefulSetUpdate: - updateStrategy: RollingUpdate - -## Pod priority settings -## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ -## -priorityClassName: "" - -## Set default accesskey, secretkey, Minio config file path, volume mount path and -## number of nodes (only used for Minio distributed mode) -## AccessKey and secretKey is generated when not set -## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide -## -accessKey: "" -secretKey: "" -certsPath: "/etc/minio/certs/" -configPathmc: "/etc/minio/mc/" -mountPath: "/export" - -## Use existing Secret that store following variables: -## -## | Chart var | .data. in Secret | -## |:----------------------|:-------------------------| -## | accessKey | accesskey | -## | secretKey | secretkey | -## | gcsgateway.gcsKeyJson | gcs_key.json | -## | s3gateway.accessKey | awsAccessKeyId | -## | s3gateway.secretKey | awsSecretAccessKey | -## | etcd.clientCert | etcd_client_cert.pem | -## | etcd.clientCertKey | etcd_client_cert_key.pem | -## -## All mentioned variables will be ignored in values file. -## .data.accesskey and .data.secretkey are mandatory, -## others depend on enabled status of corresponding sections. -existingSecret: "" - -## Override the root directory which the minio server should serve from. -## If left empty, it defaults to the value of {{ .Values.mountPath }} -## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }} -bucketRoot: "" - -# Number of drives attached to a node -drivesPerNode: 1 -# Number of MinIO containers running -replicas: 4 -# Number of expanded MinIO clusters -zones: 1 - -## TLS Settings for Minio -tls: - enabled: false - ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret - certSecret: "" - publicCrt: public.crt - privateKey: private.key - -## Trusted Certificates Settings for Minio. Ref: https://docs.minio.io/docs/how-to-secure-access-to-minio-server-with-tls#install-certificates-from-third-party-cas -## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret -## When using self-signed certificates, remember to include Minio's own certificate in the bundle with key public.crt. -## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret. -trustedCertsSecret: "" - -## Enable persistence using Persistent Volume Claims -## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ -## -persistence: - enabled: true - - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound - existingClaim: "" - - ## minio data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - ## Storage class of PV to bind. By default it looks for standard storage class. - ## If the PV uses a different storage class, specify that here. - storageClass: "" - VolumeName: "" - accessMode: ReadWriteOnce - size: 500Gi - - ## If subPath is set mount a sub folder of a volume instead of the root of the volume. - ## This is especially handy for volume plugins that don't natively support sub mounting (like glusterfs). - ## - subPath: "" - -## Expose the Minio service to be accessed from outside the cluster (LoadBalancer service). -## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it. -## ref: http://kubernetes.io/docs/user-guide/services/ -## - -service: - type: ClusterIP - clusterIP: ~ - port: 9000 - nodePort: 32000 - - ## List of IP addresses at which the Prometheus server service is available - ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips - ## - externalIPs: [] - # - externalIp1 - - annotations: {} - # prometheus.io/scrape: 'true' - # prometheus.io/path: '/minio/prometheus/metrics' - # prometheus.io/port: '9000' - -## Configure Ingress based on the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/ -## - -imagePullSecrets: [] -# - name: "image-pull-secret" - -ingress: - enabled: false - labels: {} - # node-role.kubernetes.io/ingress: platform - - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # kubernetes.io/ingress.allow-http: "false" - # kubernetes.io/ingress.global-static-ip-name: "" - # nginx.ingress.kubernetes.io/secure-backends: "true" - # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" - # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 - path: / - hosts: - - chart-example.local - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - -## Node labels for pod assignment -## Ref: https://kubernetes.io/docs/user-guide/node-selection/ -## -nodeSelector: {} -tolerations: [] -affinity: {} - -## Add stateful containers to have security context, if enabled MinIO will run as this -## user and group NOTE: securityContext is only enabled if persistence.enabled=true -securityContext: - enabled: true - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - -# Additational pod annotations -podAnnotations: {} - -# Additional pod labels -podLabels: {} - -## Configure resource requests and limits -## ref: http://kubernetes.io/docs/user-guide/compute-resources/ -## -resources: - requests: - memory: 4Gi - -## Create a bucket after minio install -## -defaultBucket: - enabled: false - ## If enabled, must be a string with length > 0 - name: bucket - ## Can be one of none|download|upload|public - policy: none - ## Purge if bucket exists already - purge: false - ## set versioning for bucket true|false - # versioning: false - -## Create multiple buckets after minio install -## Enabling `defaultBucket` will take priority over this list -## -buckets: [] - # - name: bucket1 - # policy: none - # purge: false - # - name: bucket2 - # policy: none -# purge: false - -## Additional Annotations for the Kubernetes Batch (make-bucket-job) -makeBucketJob: - podAnnotations: - annotations: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - resources: - requests: - memory: 128Mi - -## Additional Annotations for the Kubernetes Batch (update-prometheus-secret) -updatePrometheusJob: - podAnnotations: - annotations: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - -s3gateway: - enabled: false - replicas: 4 - serviceEndpoint: "" - accessKey: "" - secretKey: "" - -## Use minio as an azure blob gateway, you should disable data persistence so no volume claim are created. -## https://docs.minio.io/docs/minio-gateway-for-azure -azuregateway: - enabled: false - # Number of parallel instances - replicas: 4 - -## Use minio as GCS (Google Cloud Storage) gateway, you should disable data persistence so no volume claim are created. -## https://docs.minio.io/docs/minio-gateway-for-gcs - -gcsgateway: - enabled: false - # Number of parallel instances - replicas: 4 - # credential json file of service account key - gcsKeyJson: "" - # Google cloud project-id - projectId: "" - -## Use minio on NAS backend -## https://docs.minio.io/docs/minio-gateway-for-nas - -nasgateway: - enabled: false - # Number of parallel instances - replicas: 4 - # For NAS Gateway, you may want to bind the PVC to a specific PV. To ensure that happens, PV to bind to should have - # a label like "pv: ", use value here. - pv: ~ - -## Use this field to add environment variables relevant to Minio server. These fields will be passed on to Minio container(s) -## when Chart is deployed -environment: {} - ## Please refer for comprehensive list https://docs.minio.io/docs/minio-server-configuration-guide.html - ## MINIO_DOMAIN: "chart-example.local" -## MINIO_BROWSER: "off" - -networkPolicy: - enabled: false - allowExternal: true - -## PodDisruptionBudget settings -## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ -## -podDisruptionBudget: - enabled: false - maxUnavailable: 1 - -## Specify the service account to use for the Minio pods. If 'create' is set to 'false' -## and 'name' is left unspecified, the account 'default' will be used. -serviceAccount: - create: true - ## The name of the service account to use. If 'create' is 'true', a service account with that name - ## will be created. Otherwise, a name will be auto-generated. - name: - -metrics: - # Metrics can not be disabled yet: https://github.com/minio/minio/issues/7493 - serviceMonitor: - enabled: false - additionalLabels: {} - relabelConfigs: {} - # namespace: monitoring - # interval: 30s - # scrapeTimeout: 10s - -## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md -## Define endpoints to enable this section. -etcd: - endpoints: [] - pathPrefix: "" - corednsPathPrefix: "" - clientCert: "" - clientCertKey: "" diff --git a/packs/minio-8.0.10/logo.png b/packs/minio-8.0.10/logo.png deleted file mode 100644 index 18dbe0c38025cc5be7c7add44da1b16314d5f797..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 4313 zcmb_gcTkhfyA1>)y(+#4BA}EH6*fP^YaN$3bj?;WYqix3D!K&o^@M<4+y z5}HUa(xmrl2*Snt`|IAhf8L#EpWSoj>@&~o%+8tF2n}^5dYWrA5D0``MOj`G0wDwb zPAcdHQ=!4$e6dhi%BaaeAeFJSrzpw`Oy;bqBnv6)<6MP6$a^*5+6sz_%1TNqOpNrg zv2jaFOM`>ohlYNfpP%n4@~p0|zJH&bl7dc3dVh3uG%+z@Y>YfRJFBRutg8B~stW)4 z^QVf+v**tdYHI2R21Xl(k)EFM?3tRTruOf@gXrMkWN+`Ft*xu4rw@m#`}+qX5L)5k5$^7uSZwvd!NJVT z&%C_6larH$g~gDN(Ea^`zP^5QbIYBb9d~yRB9Z9m=oA$d-PqVvQ&YRMvuk2vwyVmQ znws|O*RTBig6{6_;o)IROY6eIqOq~DprBw)O|8Yn#nRHU!^6Xlj*jN$mf6`^7Zgt+-fdMBc7cVdGuC6W|4&UAV&C2Ta`uh6o*ESzN z=C!o6`uO;so}Qkc{n^u#I47NGXlNplCU|^XPY=P``gKuJ@$T-fr>B>Z5z^Gu{P_6T z*Vlh}d3kzz+Rn~?Z*OmYe!jlGAuSEFva-_K+dDTmH#j)BtHc`+5Evhy*w)roSy>ey zpU~6OgF>0s)z$C91xrdw_nzOLoSZs}a56SVB`2qhkB`ep%l?_0Jlo$P4RrolTRQYL zO-;qTd1IfI^&vDgY**=KVq#KY;M?)>iH?rWp`oFenAr02iu1Fx+}w}9(<3r7vxr40 zA|fJFQ`1RF$()=VqN1X*vU1$qT)Mh1h-I1kD47EXt+T`Z;^I%v&MtczcTc}}pWv{h zp4QVJgpAh#F~OQOJu8y8L6Y;_lM|xq%=xPbIDF~ z-d@)L@q9=BAqawX&SpoEE{B0u`gJ06kfcBVikEAZI6kK>0|%PomU_` zlG-!WJ`N6r>0Szkva%mym!T_G&$9&&-=Ewt_{g{HD?r%Jl4 ztw7Ae!HoCb1G8aEi{m$XwKu8VW=PSP>BfFP_FhbC#xzerHai716Abk~1Ns-=p<6IO zFx_`0N6>O9^^u+oVPFIdT)xx>s72v&TFDZH62A)*=84=S6Eht*uViI@Fs4XO89PqiN_L2co>y^;i|CvwYb z*~(mby8ZK5CgeXT0P20CZ&Fo`V*is-O8J*|Hf-3Q@bV*RF7(saOI87OX2a>*p)7H* zrReR0y3<*Onh#HuhMR6Zy;XY{RcD|(J~!m`lHd8F7yb2Ae1 z{au$=Za8K=b}vdx(c$~cELS^;Nl&P`?z3FlYqcfT>c;58qKkFzvEGI(29EDlD#qxV z_yF51-n6%Zh~2T`7v(ygJX7A!aWlgUB88N0SN@B3-*tW~4{kS=#^=7D*;3ZocLJn& z(Vw!4ov|!iCNq3RY-U0AC#w<9XAu5P_E)wOnCV4vr`u20F0M-FG z8eD&hA2x(I;j9#u?mV?>qNjp_w=wo^N>DrmyE{EyEfWAj%uhFZx_vJ;eV5XEx|-`7 zRuofFBhJF>q)76vhAtL;6gkUScS^U5{&JO3i_br(sY&3f-eU()by55o)&1DbW=<$Q z5VDkP3l0*R+^O`$$xqJl@BaJ>s_*=lj|q~Aq)L4;n@rV#(?$=^QijGU1n#w_XN&k; z_6XytDHPI2uH18V&E}%x8UOq%fI3H{;qn10d^7wN46VABa3g>jke&a-7Z8yx>`@~F zBwR!J0>z`4>Onz5ML89_5BgzB-;h2T7guCcs)Zdo_eXW}6DGh3ocazr7e1T5#|^NI z2+|VL195RvSJ*8p6*|0J5J(&MC=yvx1I z+JeB=lH6j9DHZIco2aOyIxU`H(MYtR!%0(<2)nP?f&-;&E#1<2fU%TLf`Rx8ru=Yk zyohBjGazUtEim$u5!SKS&oCuH4z(UiP5f4JX(4J(;4;@DM?m1o_Wk8{eFhk(mX7^3 zDOc?qp|7%aO{D-T8m*RK*Y9M8fK~2jD?h~xM%cS5@vZnp@sI1RtzXR#XvWyqaRKK> zz1D^;v@@t#F{vDbUsx_Wc({O9c0DXuf9&CS5Ey5)!5WqL$1?-XdXB&`Utu}nM{cFLe9a-(lMpV=l1fpyWwm6&N1M-k@cxr*w-YtpH#Tj8 zRXHDf~E!B~0k()65-Z zC#L-S#X@^^>?OU${`j015UqBmZ9xdIA62ME~Qfq2io;*1V`7MXfpW z{%_F-jt3(qvs^!K5b~dHow2fcoJ@$Wy`o(Wa#(xiy0tP=UjM}3&Tw?IspL1udTar0 z;BKz5fKSK%)uv}R9wcPv(Qxf+#5wh}jmG4vTNquF{H8^A^{(lCVr^985oabZVDYI_ zhf0PgAE`XHB@dx#zG_v{g#K6F^_sD;W3_Tt%y|yz8CvyQ{1Cn zKs}IP1w*=p%Q@cKM!V1iQ%@F*&vvGTQTyrKfe${KwsXr@h0c=UXd`lBWrvG zCYQV))}&5>8*`%y(g)yCiiXV~+MulaUEdW-InB4htu9u!^Y5=^)fTU&!^ZOd$w7AA zItnMs19aUkv;iuZZ=>x^#s}dk<#oxu=N3^Q;1u;__6{?ZTp4x1oYO};md|uQ47(5S zcD+V{lZAXJYtvx-7%#ldK~hxry$5H1MGN~n6Qvy6af$$IHu$mc=N*FBQS4`hg&c;) zgR1OUuqSLN7mbX1Kf2#X$9pX_UG!2Lon@ysJGzg1 zG3cU)x<(gKW=1(7LTm7lD{iTtqzgZv=XC`24R6=AX+UG*z5qM)0+&bQuMeed~7 zs~CH#Cjfz;NV4TG_iIr_C9-o&#-x5z&Ek;OeRLB7TLL{@%jLM~k~Z>MNPd`9KX{XS ziV&t?{G~B!mg`T;1WCRE01C}dpsDfD;8dmMYL*45pWHm4b&A;9CvIR%SZ54^avKoH zdXSz}l_85nDj46Ta}EzhEs3H*v4;HHQ`+`D?0C7NoAvxU)te*0+H`y( zH(mZ?5#eB&Kvcq(^fpVn+19>?S0qfUvWp=Q)H10rl8Xm_t^0%(nd@Svv4H!ja&&q=-)Hg zFBGXHD$2+}y2m6Ydf*4nk;OerP+b_$A 0 - name: spectro - ## Can be one of none|download|upload|public - policy: none - ## Purge if bucket exists already - purge: false - - - name: "minio-disable-default-bucket" - displayName: "Disable" - group: "Default Bucket" - remove: [] - add: | - charts: - minio: - defaultBucket: - enabled: false - ## If enabled, must be a string with length > 0 - # name: default - ## Can be one of none|download|upload|public - # policy: none - ## Purge if bucket exists already - # purge: false - diff --git a/packs/minio-8.0.10/schema.yaml b/packs/minio-8.0.10/schema.yaml deleted file mode 100644 index ebad80b7..00000000 --- a/packs/minio-8.0.10/schema.yaml +++ /dev/null @@ -1,5 +0,0 @@ -charts.minio.accessKey: - schema: '{{ required | format "${password}" | hints "Enter the accessKey for Minio" }}' - -charts.minio.secretKey: - schema: '{{ required | format "${password}" | hints "Enter the secretKey for Minio" }}' \ No newline at end of file diff --git a/packs/minio-8.0.10/values.yaml b/packs/minio-8.0.10/values.yaml deleted file mode 100644 index ee9ec469..00000000 --- a/packs/minio-8.0.10/values.yaml +++ /dev/null @@ -1,358 +0,0 @@ -# spectrocloud.com/enabled-presets: Ingress:minio-ingress-disabled,Default Bucket:minio-enable-default-bucket -pack: - #The namespace (on the target cluster) to install this chart - #When not found, a new namespace will be created - namespace: "minio" - -charts: - minio: - ## Provide a name in place of minio for `app:` labels - ## - nameOverride: "" - - ## Provide a name to substitute for the full names of resources - ## - fullnameOverride: "" - - ## set kubernetes cluster domain where minio is running - ## - clusterDomain: cluster.local - - ## Set default image, imageTag, and imagePullPolicy. mode is used to indicate the - ## - image: - repository: minio/minio - tag: RELEASE.2020-12-03T05-49-24Z - pullPolicy: IfNotPresent - - ## Set default image, imageTag, and imagePullPolicy for the `mc` (the minio - ## client used to create a default bucket). - ## - mcImage: - repository: minio/mc - tag: RELEASE.2020-11-25T23-04-07Z - pullPolicy: IfNotPresent - - ## Set default image, imageTag, and imagePullPolicy for the `jq` (the JSON - ## process used to create secret for prometheus ServiceMonitor). - ## - helmKubectlJqImage: - repository: bskim45/helm-kubectl-jq - tag: 3.1.0 - pullPolicy: IfNotPresent - - ## minio server mode, i.e. standalone or distributed. - ## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide - ## - mode: standalone - - ## Additional arguments to pass to minio binary - extraArgs: [] - - ## Update strategy for Deployments - DeploymentUpdate: - type: RollingUpdate - maxUnavailable: 0 - maxSurge: 100% - - ## Update strategy for StatefulSets - StatefulSetUpdate: - updateStrategy: RollingUpdate - - ## Pod priority settings - ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ - ## - priorityClassName: "" - - ## Set default accesskey, secretkey, Minio config file path, volume mount path and - ## number of nodes (only used for Minio distributed mode) - ## AccessKey and secretKey is generated when not set - ## Distributed Minio ref: https://docs.minio.io/docs/distributed-minio-quickstart-guide - ## - accessKey: "" - secretKey: "" - certsPath: "/etc/minio/certs/" - configPathmc: "/etc/minio/mc/" - mountPath: "/export" - - ## Use existing Secret that store following variables: - ## - ## | Chart var | .data. in Secret | - ## |:----------------------|:-------------------------| - ## | accessKey | accesskey | - ## | secretKey | secretkey | - ## | gcsgateway.gcsKeyJson | gcs_key.json | - ## | s3gateway.accessKey | awsAccessKeyId | - ## | s3gateway.secretKey | awsSecretAccessKey | - ## | etcd.clientCert | etcd_client_cert.pem | - ## | etcd.clientCertKey | etcd_client_cert_key.pem | - ## - ## All mentioned variables will be ignored in values file. - ## .data.accesskey and .data.secretkey are mandatory, - ## others depend on enabled status of corresponding sections. - existingSecret: "" - - ## Override the root directory which the minio server should serve from. - ## If left empty, it defaults to the value of {{ .Values.mountPath }} - ## If defined, it must be a sub-directory of the path specified in {{ .Values.mountPath }} - bucketRoot: "" - - # Number of drives attached to a node - drivesPerNode: 1 - # Number of MinIO containers running - replicas: 4 - # Number of expanded MinIO clusters - zones: 1 - - ## TLS Settings for Minio - tls: - enabled: false - ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret - certSecret: "" - publicCrt: public.crt - privateKey: private.key - - ## Trusted Certificates Settings for Minio. Ref: https://docs.minio.io/docs/how-to-secure-access-to-minio-server-with-tls#install-certificates-from-third-party-cas - ## Bundle multiple trusted certificates into one secret and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret - ## When using self-signed certificates, remember to include Minio's own certificate in the bundle with key public.crt. - ## If certSecret is left empty and tls is enabled, this chart installs the public certificate from .Values.tls.certSecret. - trustedCertsSecret: "" - - ## Enable persistence using Persistent Volume Claims - ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ - ## - persistence: - enabled: true - - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound - existingClaim: "" - - ## minio data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) - ## - ## Storage class of PV to bind. By default it looks for standard storage class. - ## If the PV uses a different storage class, specify that here. - storageClass: "" - VolumeName: "" - accessMode: ReadWriteOnce - size: 250Gi - - ## If subPath is set mount a sub folder of a volume instead of the root of the volume. - ## This is especially handy for volume plugins that don't natively support sub mounting (like glusterfs). - ## - subPath: "" - - ## Expose the Minio service to be accessed from outside the cluster (LoadBalancer service). - ## or access it from within the cluster (ClusterIP service). Set the service type and the port to serve it. - ## ref: http://kubernetes.io/docs/user-guide/services/ - ## - - service: - type: LoadBalancer - clusterIP: ~ - port: 80 - nodePort: 32000 - - ## List of IP addresses at which the Prometheus server service is available - ## Ref: https://kubernetes.io/docs/user-guide/services/#external-ips - ## - externalIPs: [] - # - externalIp1 - - annotations: {} - # prometheus.io/scrape: 'true' - # prometheus.io/path: '/minio/prometheus/metrics' - # prometheus.io/port: '9000' - - ## Configure Ingress based on the documentation here: https://kubernetes.io/docs/concepts/services-networking/ingress/ - ## - - imagePullSecrets: [] - # - name: "image-pull-secret" - - ingress: - enabled: false - labels: {} - # node-role.kubernetes.io/ingress: platform - - annotations: {} - # kubernetes.io/ingress.class: nginx - # kubernetes.io/tls-acme: "true" - # kubernetes.io/ingress.allow-http: "false" - # kubernetes.io/ingress.global-static-ip-name: "" - # nginx.ingress.kubernetes.io/secure-backends: "true" - # nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" - # nginx.ingress.kubernetes.io/whitelist-source-range: 0.0.0.0/0 - path: / - hosts: - - chart-example.local - tls: [] - # - secretName: chart-example-tls - # hosts: - # - chart-example.local - - ## Node labels for pod assignment - ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ - ## - nodeSelector: {} - tolerations: [] - affinity: {} - - ## Add stateful containers to have security context, if enabled MinIO will run as this - ## user and group NOTE: securityContext is only enabled if persistence.enabled=true - securityContext: - enabled: true - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - - # Additational pod annotations - podAnnotations: {} - - # Additional pod labels - podLabels: {} - - ## Configure resource requests and limits - ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ - ## - resources: - requests: - memory: 4Gi - - ## Create a bucket after minio install - ## - defaultBucket: - enabled: true - ## If enabled, must be a string with length > 0 - name: spectro - ## Can be one of none|download|upload|public - policy: none - ## Purge if bucket exists already - purge: false - ## set versioning for bucket true|false - # versioning: false - - ## Create multiple buckets after minio install - ## Enabling `defaultBucket` will take priority over this list - ## - buckets: [] - # - name: bucket1 - # policy: none - # purge: false - # - name: bucket2 - # policy: none - # purge: false - - ## Additional Annotations for the Kubernetes Batch (make-bucket-job) - makeBucketJob: - podAnnotations: - annotations: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - resources: - requests: - memory: 128Mi - - ## Additional Annotations for the Kubernetes Batch (update-prometheus-secret) - updatePrometheusJob: - podAnnotations: - annotations: - securityContext: - enabled: false - runAsUser: 1000 - runAsGroup: 1000 - fsGroup: 1000 - - s3gateway: - enabled: false - replicas: 4 - serviceEndpoint: "" - accessKey: "" - secretKey: "" - - ## Use minio as an azure blob gateway, you should disable data persistence so no volume claim are created. - ## https://docs.minio.io/docs/minio-gateway-for-azure - azuregateway: - enabled: false - # Number of parallel instances - replicas: 4 - - ## Use minio as GCS (Google Cloud Storage) gateway, you should disable data persistence so no volume claim are created. - ## https://docs.minio.io/docs/minio-gateway-for-gcs - - gcsgateway: - enabled: false - # Number of parallel instances - replicas: 4 - # credential json file of service account key - gcsKeyJson: "" - # Google cloud project-id - projectId: "" - - ## Use minio on NAS backend - ## https://docs.minio.io/docs/minio-gateway-for-nas - - nasgateway: - enabled: false - # Number of parallel instances - replicas: 4 - # For NAS Gateway, you may want to bind the PVC to a specific PV. To ensure that happens, PV to bind to should have - # a label like "pv: ", use value here. - pv: ~ - - ## Use this field to add environment variables relevant to Minio server. These fields will be passed on to Minio container(s) - ## when Chart is deployed - environment: {} - ## Please refer for comprehensive list https://docs.minio.io/docs/minio-server-configuration-guide.html - ## MINIO_DOMAIN: "chart-example.local" - ## MINIO_BROWSER: "off" - - networkPolicy: - enabled: false - allowExternal: true - - ## PodDisruptionBudget settings - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ - ## - podDisruptionBudget: - enabled: false - maxUnavailable: 1 - - ## Specify the service account to use for the Minio pods. If 'create' is set to 'false' - ## and 'name' is left unspecified, the account 'default' will be used. - serviceAccount: - create: true - ## The name of the service account to use. If 'create' is 'true', a service account with that name - ## will be created. Otherwise, a name will be auto-generated. - name: - - metrics: - # Metrics can not be disabled yet: https://github.com/minio/minio/issues/7493 - serviceMonitor: - enabled: false - additionalLabels: {} - relabelConfigs: {} - # namespace: monitoring - # interval: 30s - # scrapeTimeout: 10s - - ## ETCD settings: https://github.com/minio/minio/blob/master/docs/sts/etcd.md - ## Define endpoints to enable this section. - etcd: - endpoints: [] - pathPrefix: "" - corednsPathPrefix: "" - clientCert: "" - clientCertKey: "" - - - diff --git a/packs/opsportal-0.9.5/charts/opsportal-0.9.5.tgz b/packs/opsportal-0.9.5/charts/opsportal-0.9.5.tgz deleted file mode 100644 index 805de6baec112e8fcbff6922d60d74aff9aca023..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 10937 zcmV;qDn`{GiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYKlj1tkC_JC}6}t31ah@3(;|&a)?v60~4#isV#v6TwEgOSv zxh&f(J^kNrcwwiuKHYWZ%#V&?ND22=zsgkiKb~f z!}Gx>P1Bd3G?!-o#_%jnXVMJM(|@BGj%Db-0s3b*i}V6+0Rgwf7T7>}uy7oUj zVx^gf4Aq7bl5s5jbztb2x9SYg9}ri|?UQy+2ckehV1>k$fw)y6UchD#hUM*wNg0@=W_vFu8|#QxU` zn;zbN1mP!8uq|n(3S13nCWuG529}ZE5C1bC74@OZ8nJY^?F0mDhGmPoOB`ee$Ul4l z!-Ymd^agaKg+Ek)AluU<{Q(N= zh0iZ}6adGDNYPdm8=DR?<-V(<;nqTV(1XsRXCp=13>;gtg2EPb7I~1u7D+`20-zhm zhN5X=2l_;dP#r*1Q41)a4{Q@Th)^0%S+<64%?TJj{-PStbrwk{Xq%dO2Pj5eu6HB^LuBbkKE1)yA$BiycO^Ul5D8gw3syQEg}~9`xSjqg3=D;6ZSU8i1u} zpqWlE5fA}BRzO_KuMeOp0~4w}2ixL4+*=LJAzEF>uYGvCst2vTSVG8gvk_v5vr83uHS$n*b99h8S2j z@{s9(xsBioswnE1KS6_@iMlSj&cc_EQXpb+p!)euMrJTrAHiDFgBJLLE1KM@Kg{6& zk}YwNk%zhtPl5bjFh_nv=GZlTnHb^3LDd6mB%y3*X3%sh5-ggbNhBy0^udQgkmUN) zE~2d8E*k-8ZowJKV3aS(yr(JwimU4lEo3`{a;%@B z3qGU&u{6hB=znP;lYZC#-XeYbmii~~G$S7@)rzJge}Ve!FX>QPpgj0z>ihSYUn*AK zSpKB)x!+%=L$*hIu8+zkeU(Nt5r`k>lV3UxlE>$P%0q<)hd@oB#^L6}FWKGeOaJnx zgeidx7kt%>fvYIm2E>y`V7?;Ze-B$&3^YFg4>J0p{fuypK^baal zR}O+A03zXF9~_B`Fi&$1a>gZoI|+cHj0#)(1abXR=LFW213mW-4>aAEd9=Wbh^~_( zq`wCp$bWwMxSq80K#LFx)ei|3Rz9@#Ecew7v~10E6cGO(lKdYMzkn9veGR8Q_Wg_l zPlnc?GLa?1AJ$-aBVGwh>2QwpCxFZ%X#~k#m{U<|Ttp6FF5#HDTw@4pAD6;$o$L9cSLwgGXO7_Gmryi=)nBJ{PXP_*z@=8 z#ghWxzbE}7Q59lADXe$4U0w*j1x2V;HthDE86p!^AM5CcIU$$;&kph{AiiLjFI1C9>zuO|xZ!y{jR z`a8XVvU$)!UT{j_r^q%H+*jE*J^46)UoiGQg~!W5g^MW`JfV(f&fmZ1A1mZQ^*AH} z32pVHRbk7H=O|(2i^t)NzQ{}_{r-IRdHe#gd7@!lmJgQ0&yOyWKU-p)s~i8>661y2 zt9L2!?<*yqk`b4h^RJQ+=knnR*^mS$-1b_T@Ira;3$@qx^heVz{Xe=6l00&azwe1| z6a2t_;2Hg&VVH~ie=N(e@8`d7k|O;dn(|?~pWW4=qWcMtJiUEq|b*e;46&pu3S_M@|oQNIX{(Cso@9kfQL$9RPyAk4cx~2bx7tVj) z1+ZuDe{om$ztT+RUH^NF^x*?&2E*;kZy8xS-um*}#s+{Ua4q842pZ8{R)QS5APH&H5*bg zt33p-70+$FCMZ>6>vzcvC-9leJ7dRpE8a+XjpoYjwcy|M>c=mZ`6pxWLV^EWjaN(i zHyH6pb}fJPA^*YM$-lvvztO%V8vfhclfU}t|JXL<*A4!wD?v+35$GZLD-MmGKL!Tr zkT{w|5VWPmkGI6p45Vw=Oxdpa5?1~bl+;`LU*r?ur@4Z7TK{92^ws_Ubo%}Mzqd&j z`qO^spHQAIFWsL>%PVQcz%q7c5D zFX@nw{QhnCQ`ZNNyuR;?@5tLg4?2sVM)zo02Am=x-8Ojb$x%yrml3b z)3Xsl=IK?oA)z_7OpMr-m3 z*Bxcgkq!sy++@_-V#iM&)?EX&v1?w#3~3wnCb@77{Q{`rSBpGkxWrD81+-Brpmgf0 z_$53Eo5~aLkRyeVVy6wgG4_wN&j+umZD^hM>Jff9ul-C@UkN&>{pdng+ygt42>Uy7 zL(M?Mfrga_rmO3Zi-COye(3eFTN7yC5}!9Wln*@*{uNaC^nXg-;&9q413&l6C;z`s zD)n<5nei{5e6{k+C%-r0YwgJS93KrU$!t8z4X${_eRbc*84q|Dna=0h~FqcUrUh@UBZ=+ToRq} zRCl0}!&RrKPsKYz++Am<-0^~(Qo639xLiHAn;E>9+rnWNNx3w~^}14S=aEFZotMttuMWztT$rZU>%yZW3~5?D>GxvbY<^!jk~z>4UuSJ@Po_337v)4G}2-Efdl zo3zs9xx#RxVtacxlT)=}Wp$T=`lgg-)3`#W8E-wT7siH&5@Q=j1Q;=$O@*?B0M879Q z*|CXYZpl`7p^s$7V(#g-QI|R#JM6H=oo6&uYotu8i5z=x87(+WNsAO;&fT}v`)Q(M zF7#5in&=qmVW~Atx5{?cU8iA+*$s!SVXq@+Jhtg5yrt-!T&`-?7S3$guIC2bsy=#f zX5-vuE;f-|n{?H5PR-U>+oYAWUO@?UHC$|W1KR(3j_>TKMBu;j2p$~3o`=no#vq*;-*R@{uMv2@xi=?`Yt?LyBS)|s-^ zSQlu0+88^_W^UzenPFy1FU16EbvmW$dNN4k;&z@J&7hTQbj!@Vp0igbS{b8<)O}eO zi#xt-8>*6RmNr{eXk^Jav7lR{HP82__iPQ$w86S0WFe7VI1%rqMvCj+J)?TuF{%Ton*S#s)1c})^1v)OG|S z57#qT@7P|^^%~vvBJsewcXgvSC=M2@X>HS*7nvz4j7Xp7yam#x6MmQ;)ET^*c9z}s ztlaABwlc`wGb7L8doJVlwfSt*$l6P@U9q#7DQfF0wZvvQ`hJ?4-@9r^Sgeqqohn zyGBZ5Q!31+Y$iLHD%jBPTTMq{H;t*NjwP;P!^WuOiH@D<2;F6?x6Rgf-JYD=l1!<^ zOANb6nRklXDRD&uWwrEhQkA%Rr#9SqrDcEIoebBj_Fyh5Wuuy@^{~;-OxmOBgiUSD zd6(}uQeO71B(NxJlk&0a@d7}I?vXPolt2fsvbML zD|Xx5a#`3uRA$9&anMglxKtKb6Q{c_*XZ78Ds9z-I^#9XUMsUYKc8gv+(X*p6a?Eg zlH{$?YqGQ{wghI`7v08mqpX^RiYKu2qFBjo3dO!yu90G)r)CQ&w_nTbW*dI^F!Od( zW-&1ZoxS7uX1%B9=x(;nr08z#A(zwY`n0Uo%tXDt)$hfY(p~OU#{sDbstSpxUF!#1i=NU9qjt3CzKiIaV5;Hg?u@XAY(Da=?k5 z&W_C%QDr=mOI>bV?rcThvGwBt5(XX z#z556N^RVc62(-RDTy0cObfb^soSO9e6qXmY;%pfv}bgA;*!ZsYIoRyFdD2&=EBK# z6Ah$SicVtPm743jN~fcmtaR5)wePyK#$25z)@)|335kZdD@?Mx`?0&xO?SwWnvrn| zoxxIU-4FOS%g=|sJK0X%cV?q|dN7)3Hm8w|IInDGeg2`E=t6gLKfYh!nY(>ZcbKqU zDQ$X9nDY9bTy7~P(-D`rRc1>ow%TB~Y&DZAuMEDNW);CLibR@Z6@KLOTC1J1utyzw zo$YrTV%1yoYo(u?tfzPNLD%iHrpxxmaeCbpDb2GP!<3gzGE%FGCE!FMJJ%Dv-nQGD z-Eqt;vr4g0*mVU%QB$0rg|N^!%uS}okfpGy4W(7ZZ6*dZo^tJV$E7DyPT#aA+tjY= z_PUC(^9Ym|?##HaaRpT&rEMm)oOD%nmrc|OqqMWm-AdmuWL>C^nxc}%i+0PE#7?TW zwA^O3g{v|i7b@87F!DOXc^##*8+JF|knu+9eQMllZsB&w6-zSmri-#tZ;nSpWYs{on(a>!Yggi z6xD@4i&bb32}kSbNJSQWW-LXZ-3QOPmmu5DpCJJg1faBmHZ6KT_^ zsNGW68tZC#q_&Fn2f5zbj>YntY@=6-1K_w1^3Wp%4O1;vZ+nm zQ}jkv)tKdyVX9?AU;PN&%84Zxd^rm{rxHY6wbeP)-jz z&FW&?sPp2~p2?dGX)pUZwYe!*1V-YG!CY&!CYAecs_9PIGD6d852iJ#uWPCFva`tE zd8;&=P+c_hdiCwttB==AL8wd2axyk|jh5Au#+xQjMx_PZjXTVGm!gdfllJbXooZX$ z%n4s_=G0<6n^?+9xhPu+xtCdVU5IV2+4UNV%;qM`kvVehyM8&LWJP;h?{fTlp4g7s zG*WsSZ(<`(oGaXDn^<<*Ye!6!&D>b7dgF@KnilSBMF`WG@-~&VS`V1Nrz@$3n#wjA zb2Ho2MRhn5N-a07xo#;jU!z+4E>qJ5UVY%ydz~he*@zp^ovA~dxlwOC6o#zJPO_6l zA+<;}CaC4K?>j9$H@j1acc0}ZZgZ=rCh7k0-mKQ{wFE|RS8Ty0F%m9hX0y9yt+P?4 zO^yf;jw9F=frH2xsU4B^MnRRPaXlFNbX1!Z%hJ}Ktdp*O^X@wg= zC)?Fkp37!)ldNR9EXi25r%#k+Y9v;S3fadz!%?4t& zqgwQ6-580DB`UTp5mh&%OmkL#5X&2{Q1$2GG$WVW+p$=j?iNdb9=7GKHkmcmLVdd4 zcgjn@&=JhNf@xNoZL*N`_bCKNkFLY#U00;AaJ!&d1*d zNW}<@>c4&bt%h_DIhq82`}mt^Yf%5~BY`GK5@c)2$KOOB6e#+*K-s`c?YCp?>x{wH zm}C97ur);6p*+J|oA77&qF|n<>E9ROSB9ql=XV3zs%GZt-z_KyPM_)TAE0G@J1sMZ z(n__lYs$%}*A=0Xt>k`>oB`(*9c_Mxx~7^*%|QmqOUQJP{rl1-j;3sr(Y8Oz{!X2k zU_$HIw=+oozoe|$DDYRDm$2>{<}LVvEn?q~O=z0Pa~ay&e5WL6%im54IB4S}0~q_- zSKSI+gB}RMvDW7IaOm@lwE+a{nhZXa#8RouMh}uUlr@*+eJV$kWO-`?=P4v6u+63Eq3u^(@F8Z@?WPX7?WPiJEoCGCF zQod6i$W=Xj9KP^^^XDGty{fyx4oN(Y|; zmGzi3B}g>zA97S0MA^X~LuCLBIEqP9X~0u_lA(A#DNvmM2hvnJnWoYpO|kypILA|r zL?``nA^e<=!~fj1(+pq*ieLD@JdUBbTAGo9_5gtrk`ZFR{FqBqTmXiPz+?|#;vn@z zKWRXF44+;we0ogR=$((;=`8bGLk@LDBg#~gN#37 z9K`^}rya!sfnt&wz_1}6CV03=a#T)A2KWLT5p*A?m!@(HmZQ=EfrKo@>0x6tJA-5V zA>yg5zHf(=%uqtW1dLB-p2{RymSU3OAD3jQY?7lg$xJYinIuDp973_lEF}QJXD6S1 zn1CW_iUV27Zx)lL7?7cIAjtFo?OBwea>;;8vq=V|sf_OTI74NV>40XLh(A*5;UDqT zFP~Df=AF$ue-(*;`Ltm68If3zf0-a%!Uh5kj_lU|=TmCId;yh|f;h*DQ=Q{L%hdB4QG7lFrJ-H40tdS~d>6aYwG>b)cCFwvF%#sb&Vg2W=Ue5(-cH zuxlS_an-J<1$$=*SKZl*TEDMfdSPJ@9zE_mv*(Z-|3mp6oUeU(?Xl96M^wMy@F+OI zqkQQ5!=p8}SIGVv5gZY~{2t^Z+s5`+9jhQEBQHf98M{s}4AFBBnGONp4kvCAAPJjh zsJ;=v&@3O84v$OyfjQJ5$o7zZ0w8q2eu?t;!}Gv(y9u)NG0Vo-xqZ@kQVmBpk5ebO zKyYDV`&H3&M8Mx&TLY=%!P>F%_iHepPfK2aL>nuJA;8h(8pijC692|89~|$0MKA9d z{vcDn_W9FrJahk_zIy+Y;WHWb{r=Zmq{HQW4V}d0It@G%I}ePr7q!RuI8+q(OT($t zdi%g%032RJ%1{hVQ%p?OR79LSAPdN*Gx-d!Ksn20X(_`oGRz2qA|WPAGdVUZa|$OR znaO528f7yyq-jA&OLC6kxJ))j%UK1+)M&YsgQ!6)lVsQ=%?%kQ&oX(IrFf1LI3YnZ zd76&@+fBhgH9a!_e`*x4=jK1lU(bJmd7uApkXQM`_D;F&;Oqj6ZF~le_7^o z{&VcR|KB%BhwzuD3;C_-8w2|YKf@r{k?L5*uG2^1!BOw}9e^;1WdRa&6+JK(#Y602UDr&tZaT>J zpk9Igj)d{Y?vWC0Bx|mb2bm|z40OEC1BSg(WZ*zmMRo-S7y1DkTVUc`RL=v>uXqgL zD9UmW{PIK|oR1h`N|-ohQw~mX4nZSt0`N;Fp$YZv4%yV92t_<8pQCg1 z0o(-5NA-)aboR1>sD|$bp(3*h^xu7X~Sfh2ck!`LWnV0Mh-+bBICu0Z7n- zb4}Nr?Saq8#~_rMgM)~A{%5F220reB5PW`~tPwvmrX6EdjtH{%LHfu7uZ!5{h?C!? zLkPbQ#|UGZjz}!})j!Okmgd(D!?XtBMeC;K6i;5Ch#}JpBI(9HfM&4;Tqo>B^sY;6 zCF!FuD|*f9xXvC&Qb95b56hBK{Uo%s(9Cu|nlbkbSm$Dmy$0mB3vHlb=?El&1`P@t zaEDE}Ccz4CV;$weX1j}7SU!!N8uaPxEsfJS!M7s*Ud9MMMhHHQDNM8cRq-G`upLx&US1lUB-hBA6>k(b+JJt0jt<~e>WGr zlpSUCpbd>Mg7gQlgh)m9m1qhA)B4gd&+u#}8@@VgLkW@C1>Y8t?F28%SjRV12+>m# zI#XRJ3mLJ9h7vS=sS`;D8JYX&YZkPT=|r9_91L6%#wH>@dH1hR$@_TBFbqR_oG6DG zdzf)I+Byh4=RQ5tj#D=2=;Wz8g=3j3O zdV2k5Sb@Ft|I4!UyZ^U0Nk8N);YI|rTMN?d5P2`J2tXtTPK-^_JWd{S&TUU%zt~2# z_H!+YT@e-u?sM*=ZrqxW@u!_N{D_l=mv;JT#|;`EPW?nY;$tFvS>}w)CjlA$*F0)a1`gLi)5F{NKW;pdHDdX!7yri*)}sy^g8lNz zJ*F_i%egOwFz-O}J+{X-xleG;Q*J|E!$9CHTF#+Gmtk^15GUuLkN&S?=@(^>hHOCn z&i9BHS(j;`l9YlM|tkO_p}MrW!cMa+%(TU4(>+rONbX{y~kml6+DM>Wkq~* zGM=^I4^#0R+8-j~IjARScx_C56v}zQb1*+s)PiRm`JDLGc~Y1jteclT29JntKM{8x zf|ej9+0I25uck6Gy-N|21U58P1pdB4+mGPyfzi|7)E`zl)4Prac#zAwd)R+}to+RuAF)-+rLP^aT^{trV)+)Lij9rS83aPhO%z|}=ChD~dv%LC=qfiG z@uxSS)vb0%!>|2vsopOahhKZ*u=Xg`4-@0+(Dbn}*rRE7JLB&3Ye5{8UxwoR*!4N^ z?QZEN1rLWCVq1^A3hvmW7ak)RJcRPdU=fJ`C6YWgNAlM*=79$5Y$T9Z9C1xL= zSSocpgRf$#)GrSnLAQS)@B;1GodNLuJN4K;iz1#BzuAI%yI1ZHx*c&?{yG|zpC8bR z1N3KUTkB4~7Q2Jt^Mu@=!M_Y->1FUr&&s?}q3pNsYq?YEb?cqy<;Uffix*>ciN(neIb3}*I zr(S7qHL4+&eM$7HHtj)^=Nom2Mr`+5<^I>p5QS`*V`21>efg?D1e<7k5 zbIKma`APnhx|~j)!(OTn#6qk5$PA9Wkzc{R))6nbX73jF8LsK|yQNX_74v-$*Lp(5 zc}9!9oIb^J|9QMmZ5B?N@w(%Km)idq7_Z0=hJ<j~ z0rUS4zR~(uI3&2?y!$jFdmdOeN(SeVy8hAs?pmr1Wpq{YJa&5?#BT*_|0Qp(y>$NX zh2D=`1%GD#Gn~L&-Tx8Z{r|s7dVbCP89wg+3l0o_h9m#|{b|Z}bwq`}`)?>7QSnMt zy6@^}xU~*C$kj2`VNf@Y4R4$mK5{U?pFWS2nO_$K;B=!F=I@8#cC9C(0X(Lw1@|oe zU0=lilhRA&{~rkk_>BBdGlFm_|C#iA{O31GKRr@b{AI`U(f!HzEph)c5b-}*;2%Wb zF{=JS>?MykzNwR!p@YEv;d6fp4b)#kJy&!;8b}WOq1eK?6vj}(y6=CLQyDOVVM z@#KMnRt`2P8F|O7trZ!n6eORPm9UL&<;Nf8v;7cVoOLHb{GZ{YLlmvk?3-f{e-(V< z1`)$TpENe|G_)qS5C-ZvdKBlQ@Lhsza`>eN^=`pGF{r*CNf;NyfYuRHc#q@scfi9i z+}Pc0LKvMa{OJQQXcFPRp*qTJ1WAtOAUWfLNEfobVd^7V0w*`@l z)ugNu346%i{#Ex0z9JQ!1MkQ12~x%YxL$PkgbPWMKawO8VbQ8|(~bkcE6ENIRh~2A z{JH!QDHQK)@k)CAxjge{tH1yC>81O>{hs_+*#Bty+Wwb*_y6=J=~dA^&F3vOe@WpB zj%FnTo0@}d>amSe%G%%4@>Q*;f|2fvgi6#aLy$%{I&TCaeJMQ&B0i-=MbS*n+2%n9 z2LTsDt75cn)O+s|_`f^7QvOG~#@8(a&z=9K>5KT!EJt(i^8ZcJFFyYbb;1AOBj7)K b{NB@hdQb1^N7Mfc00960p_CGY0LTCU#a(oQic3htJ(SiHJ+|ZVOlsYwh`J!Q(t2;1NwJo*mg^Ic&u{)BLzH|CxOM6FbM>CB!TFL^ptl&{DHA)phC5~cimdmm( zET_-71u^Tmo2yHm85BS>MrrD`_?T zAIByrn*XcKW`h2WMr$|!ZzZjm|C=SbQYp!C3*e2<9_aF9t?56?PuWJm5jHfUpAD7S zTvJ_d8jn?5CcE_9So`;+)$;F>xus*5Jj^WET>m$kb$O@%w~^MR|MiUM7KmZVwKkp$ z3iN-qS*^$EU#-Y={lC-yPoMt!tNaUEYV$U7h>IqgPTV_-9LyBo(V|_0P?+J&_%Dc1;It~YoiGmjnK@Lo9=*?nGY=Z#*^AQ6KU3Cz)3DUK><^n|5 z1SDt<`e}T}uyJ%gq-8Z@iX4k5KbM4)39^Y!u;ZakG1(O8aK!OE%|*AGu0!hx8i#&D zBdqgYZ&x6fmWm@-n*{juUj{h!%j6bV3+cKOLi&*npnb4DT_gPraKWLJ1{_hma?saU z?#3OoY_K^dNc^uO{nrr_(0IF>a9ZB)7zaj3OGU=BUnp4_c|Bg?rF1+d`brYBa$@d) zqWI>&JrfQFV-wKd3PAf+MB=r0ADMz~04UZ=XH_qG2@VG2taK9yPf0V&+^YNQFQgfY zzECstLkU4em}TZAXT~R^yz(ACScP;;z)mhU6y92#+7SWai0TC9ZZ@pI@T8zpRsIIe zV!8oXinmNC&}}>=sx-cf_i0G%rKZH{GrVt8|F1j$tH4O+-JBTrSPrh9|K)0{T1(FV zExEdz|F@AONfM%KK;T}d3=6><%}`-!7EoQ76Bn!4#ccthK$w00$exgxfFe(I(0Yi1 zU%w(ko*EEC@$=+Z3UfjM7Fiu{vh`~DvS#plya+5zH5WuOQ6`i}QJ|AI?J`xMnt~lJ zx!!c<=6B0fJBDGpm@dv8A8XKJnAsL+ z%jOjbZCHz!F)QOt$mp0Ce$ zl7l@E+8ij|hnGX5*u;&DAUIJll^bHu7GuALp}Ac%+^F!&Qt%Q0w9jp6`Z4F;8NO9iTH_8)011TM=XoVr0HlNhIde* z4X=HB^e0%cCdzuRMtF)!KPTRSUI_F=f`R%bNc~+_<5uuCQJ2oGP8_en*_Z2Du@@0U z(L=U2s>AFUDPa@GT-XXpz=O`jm@+69M_evD%GIobF#__|u?k&toW5<2NxTbmD91_u zfx%;U)<)$S!MZz3zRMaRLKCd%3!98)Fp8O}s|mFm?LsM8HaQF`#v0a-h>n3>0k>*W zi^sra6i-65VBRp*HDJXG#-Zrik~}XOV?B5<7UR$!gv2 zOjS!0SGQ+$rb@~DoaXi!C08m_R+~~hIbxKfx@mG2V-8xuCB=3VLrjS>F_uXcA|V?a zQ&t>|hf-a7`2YkJVc9_%0U%4haCZ0%L===!{K z)*JRa-CkBhuWWOklpw@+ZU$tMe&fC4`18%JQedlOcH-GPaC&ikaXGpk^o~vjz3%9` z-x>Xpi}gS-%qd91fT)@c_9|^Jj|P4-Z!XT?U0husc80z6n&3in2xi?n;Lk3OGBFqf z$waOIQ1|q5IO+|q`xmFDC+El4C+G0=u5)_*sxurFwxH;+2BdSYu4~5h#DL#W=oNO{ zd$)TAgtE!8+U{`FIX;HxSDo(YVz6PuL$J1{#D0b8 z`l+bpKQ4x&)Nl(MoSBZB7-msJ!^?jEVlV#UNqRK(04oSgMxpcm(zQSbV4*efQeHmAozrU3^0C9Kv8ar?)``|B=HvKWzIj@)+5 zVkzVxkJf{CRH*ZS1hjwGz4N2~1+dv#1XrM+Jwvrj%_!_|(8BxP;q~Ro+VJ0#@ugM> zynA|mIXXE#8C`8K0!6>%mdLte@S6Y*d3Vz7u_?K*nYgv%?dIni0g-JESY<09zhH&n zu}*SrgV&uN)kGWh$p`HecPiOT=d6DUe@9pS4VuBQ)-9HjL=*kapi?}XB--d>8yC(Z zUPEhhir>aZOh9iJaZ7L(v%2-8lVRuZw3j2nqH8aRn1-9S5ffYk{iJ%Zh->U(H4%vHvgA z*Sr1yEu`fBf3WpGjP1NWVEcc)ZQpP5kRY+q&TH`lOe!yJWZ6Vw=aIVplKx&;QyZ%! zRZ>y`x=SR>-(eh+i3#P|JB6MpLkr?l91N~2|Gv_@k1uF}{L8hLoIL-lR^*-hZzC1Y znMn-+OPgEMzM)pY%^p7`m&c$Te8q9XL40oqh8emb>6gG!tLWHq+6XKuGSO~WLGO2I zVwZfTL0KOMsbi{usPwohDWH{$jIL(cDNu+R;0ZJ280$uiaWLs>Vc_ria6 z&p;X5n&K2Odf2JWntj+*aR?cJ^ZPCfBN=DE$^?>?=&{`1%5 zPqF_8|E2E#H5$A1-!@Xw{(rVU&flr|CY3KO<_%?T8q|rnl(%pyTfUzbHMN5Mu!x_p zf5zt*;YO4d->$N3(=`=SZ=+GS@8tm>f&~_H{f%EO*a)9s*-}h(CKKwDdDlkgra|Wj zzN_fX8z=pp2L8U&hWg)IHEuQy6rKMzlK20sa-+7>|655BR-i_xA?Slp%9UaKG#}YOW|lJ*WXnHKRz(*SU?VLWXB@ z8`WsVlrL{I9#Z%+`cnbjOm`EL&ZzvJS-V`$1VBql*ueVT7f`IBiglJsd%v<@5u(1Q zCowdJ0Ly-%vVVSER)MOTUYfacT@YTNGwQ=nLyFJ<7esS`v#15EE|^#J-<((i_4IE? z@&$n&LFo979}tI;r#$18LRPSa$ILA*;4|kX3uQtBbJz<)|8i#rcF$*msXHR%0ce^j zB;1$VyoBKU9><=K{3mEQh%ln*#1XuwK_Ek?8m&t^AP5<^MB9*SEMbQGhr)W(Jw={# zpT7(dLYG``wh7~Gg_N8S_?PVqNnU*k=5h)mNlhW`dmH7cG$7h9@|k&((#>)_FX1`< z0(iQ0ScEUSU)4sR@4g7}%fx(4v0Z1Ie1b{DUmne2iA8mcSZy@VH1814T0jQK-khBW z(w(VfX}MCZr;5|^Li%E2=9M+MA*Ak}vApC}GMO&C(iiBOLh9z;6SX6}c<};_sP<$c z!!DGwcp*_AWy<23!Lq%R4ByKFWDJy$;1v$-wNR4_UJd%rbMy%~+jH>Ec$M(ihy`ea zciic?O;4cM$wAZ$nW}6$EyTTs1J$IP3f8GMY|Hg(bFU0MT&Dd1!4g(Dy@EO-u2Oa! zuw6*ZbSYV6E_gUputBwsryW#c_|aD^Y*Q~69)txn0*(5^uuReG+np-+!*yur7Wy(2 zlt5wwiOc9KzZ$(-(n67yT;18WK^fYAR7_zyrNJKPT`}e6(b_0l|J9ncWc<%sv$?bX zwvkj~5$f)xXe1JnF(KSh+t8ndBD-Q<;784jFCM(W&&Usd6p1LQO$nVJof(E%pxvxb zu)0^Kytm0;?HBpGXSCRLtdunY`Q-~_>HER{J*Q{U~9KNBb`;@n5%*vgq%{dUfv=>@_15=>KY^mel|CdTV$8V=L+D;=cx*wTu7y`0-yu zod7dEW^s3jo0K%iF)I_+Tt^ebXLfkJejisEplIXg_SX%Q?3Jv zuo0`HSSKgIf~u>7R1^|LiGMhki~DUc#m7Tbg+V`I|j*Tkm_SGNO(s10T$SQVELuK|5k78{J*x6HnzFO)EyyIrmxL$_9gI`08vL! z23d+Im5jUJ--QviQfJm4O=o&H6IOpuAdg&rytRy={|}XRat3|r5l)@K)T@iZP*9^2DYgy~?oo~R{W$1ZF8 znUX}ua}c}H!yC?uz2cW=)8WC|_dp-2G2-UNzguIhxxCtGiLX~ntkMxl%lWA^L|i|t z&<&Bm44dnOHTA(0TCcnG(3EBWd+wo9$Tf7`Gv;gMd#ncv?0;F7tI7Mn&D!q#cPlCK z4Gdr01F{beJKZ1>VD?+EcFfz3u6JPhOAJ?2*tYLK|2)Z_OvsNo+T5C(bw#@(8`%b_ zL&=942OIA!q)_4^A-&^}vwN~K0uzVAiVBHvBQf0j%6+HXztOb5{=ffDP|^8c+W)&% zZ|%d`r9_=)RAjpIj&9c+;dfROmypA?SETA&;?Z8|2Fj!1{qaBjlt;Ei;T2zeip73Q z5(Q}Ig!B9nTjS6u7th7GVIaH6l;R7X|I!cQ8)ZTk3F41z2Zq~egCs;dnnC-V{_&5|oM9_IsvLfa*DmPlhM-yP+=;B~1B+<{-$!l) zMjY4(bC3`N_%mM(_yf3SwA-`*`8}b$`I!Y%Y@@$fh2Q>jbkU_Bo<=nH_uuHh6jjp$ zkr*O8gIW3eZ*(;LT03zM#LLkuX;1WWnTwZ5&3)RY$aoj{|3JLeRCjiu5~^?|_VCh= zb0;|p*2#ffs`yZ-_Lu0M|MEcmAYFE(t~m#Vtbyqe0jZG#qD~1^ay3^czaLe#x9AOv z`S@FzXZ@yY#tqWc195_(Wz!Jpo%sXNf%S^3EL_C%SZD%~sfw~?Ohq)a$>cy}cnWg= zXAIbG)?aGx4lf3`l{d#zvjgdTcsc7`PT|)veLS3YJ6G`cNSptm)M-xV!})MfIqBF= zU1`4Ubh`TM*Mr`xOVatn{qVke_U@JP=VZ}3JJt8cSG{BXLsP4}r+=P|-u90MchxuD z+ku16Ej&~HoL&KD-tM1V-F?1#Q_-%P{r$nO)#J+#m$ki$`~K7D-R#qQnP`))_Gi~@ zeNc}&?z<};m~7uXcDwpj=dI%`zMOxVysfv?^5gZ+OXt_d+1}M&?f6Wa3_cydee>t+4OU(o6=nJwA056L_VknP`|0i5Y2~6nuN>mH zz4Jru@K7TY*X#mHuKvHhCv8?#S@Qe+70&6I=!mhERhHBDb_62eg5V0um-`R_Q5FSR zJNmy*73f*|bi8{f;?2bSU`8NVRApvmRVB4%9#M60LJRQX+IRc?iv@HqFP#eR#L(zq zaS(UMrDjsvAs@`QG41QKA#x}#JYtWyz9E!b{U}BL!UiR;^c;PPq@lAeqxoouI_=0s za)Qamm_J$-7o4-_GqK>0qivD1o=O?>)w1nQP)8++{;F`JxSSh%WVjMfbHwzEK@aam zVzQ;Od^PH80cW>uZLRdA(KYs`5{p=zoLpV6eX>+ZWkPx%M^*kIHs~}MSqg!#6g-$`!Pq^o zovqYn@y$7q%@qQMm88IKWOuV|E8)Q(Fj89ydaHrF>d8W^rg_gquxhoES2JY~=uEB- zd3Jn-Wu9tX+>2_LP;_irS(_u5HVTGLUk8*^Bsc$F2?Y%#Kw7 z+l|=x6xyd?eL*&Y&+!#0#DVKDlR;6s^q5Js_5qdGIY}RQ-ZCH1jG63HQ|C6; z7$Ma8#o)K4jj!pk*;fERXwlnp)d{q|>Y7N}x)L?bJt;?rAV=qn7@89diTz2iQpXod zz0Qg&zYH!(W#H>LO=sE(IcF}79|zZwBjicjri!XOF%g+;dj%~`eA-PpPEeES#w;$5 zwKZpSb<_{NRc@FgCC>OX8>{)DeZkZDC>SpJ<>9m)7V?hAwswD=EJz|d*xptrSH0y3 zi%whRsOE+sFZ|e9vKwrjUCCLBr3-Io6k{enhEp+SsI5KqPwoI`2z0YWcAL~(7ear& z-9>6POeQ@)58G#Qb~!|Wlk(I^*|pd1CZsLIQ)6V!ix?v9HwU*kaFXVaF=rn56>0US zmqI1oqpQrc^AJ=JC0*!SZ6;fbC1D-u)#^M-<2kQ~TSoC&j-7cWw|3S*M{;^#pyfnJ zbK4mggTArFDQ3BKqQKwCpq}Ezc+0t(MT}!}ydGrSHEt`kdX#4+Gpf|to-Gq|?6k)p*ZgEnD@Ay; zTz$7GgzdbdtiDU|l7x$XVzQZ?mn*lO#qq>oqtv9`9Wx3lTAa3}3^(SyIwg+Bet8iM zp5d2^wiOKo?xbJUTo|IW_0}rgwrh}{7w3*KB6m9DvzOkPaBOoL+t$7eW)mC@Ihn?e z3oadR3kNh#F{5$xz>93r=NFtXO!)rHW%@|E7*dr{kgJQ4Ra@+!hqRB+334);`7Ek3 zQw%}X;e}-?R2-tutOuk3^0X2#T z)lRQAO39Ary)014Bu#X~nkx8`UIP^n9i!WKXeP9AC^DE|B`VK7! z>wdlor~Rd}@^n8t>V&+dlwG+A_2P_{fH`>^_mJ~~vPsvMv1EKTHoTTIJ6=@Ar${C^ zNzxhGu%nZ=oN#XYN)N9C(!K`#Sgg)b%KB)jT`W=Zc!?wOHf^^Igz~l=;zRKaxw06O8_$0^O#ApsA-lDX!++5Eo|5P&5T&=~iNy z_w#l?^oiLunUssMblmg#SsU9I*BFVJyuXmzPMYEjOH(}_9g!zFb~huEy9&1C9-X5k z%9h9wTWM~bBu{q-{k@6JH@sLW`1mw)G*v21hdSGwxLnM~gPt~^HEX9CqL&U9=CR4P#*zv)S}OTvSXD5_yXw#WZvL zvE+K#@rYrP5YYHCmygc1OfT$ZKjB7#D(LIDC-%)`LdMBiYa5cwy8-RUOQE+^CeooC zgA8qBV_#6o^tfQ%Ng;?dW|6^i=Z$4u+^EPT-Qt36Z>5>p^Q?vMA-$t=VCLDWhqv9- zHnQ2M)UuJ5V|{vLVMkpHtFe5ZSz0k6ll9huX2_dnj}l6RIm?%b+@K;db`fTRg@sX!ICr(C2Xfl; z(savaO1Tj+pKumJSIUqH8I1OPlih2Y$q8h@6u%ti}Llp)a7uJ zn1jn8K~r)il2|UU`%|Xa0ht|&Rlm>q*(?aDWLS*EV9U~Rd%BPI=#*^pSNbYYysUCr z275w>!i`CKI4!B!YF8muGO$>4tB$J`x9g3TIH)-yu{43Q_Fa--7*=PjbBZU_InI3D zIU;LL3`BJ1E9BTYU&jbK*W7S_0t4WD9=R)tIT=fiQQR}S&c|zRe6;!LnX{#0O-&5p z!U;tNv=eBDTWT*%K|AEP)!_)+;dHNhx-oJ4qitSfy%~|NFTohiNP1b1@dRI7otEi5 z;CV0}O@OAczy0_3T~u@uuYz{ZcTo(@kAjdNa8Uha7wyaMR^&(V^Czs2qd5E30R!8P zV+NjIK6l_o2m9un^h+NOW2dIItp5TXdHwQvX}gi#T8}<|`8>4!%!V81!7~?w5%uRU zi5bF^_Oa)HAc(5PLs~5%h>qUp*VG>amSwPu{Lc+HfO-2FBhN+iw>c>IOrq%5L-UBC z=zo0;%-Hq9XY}jY+`|cmXY|J>!2kERao~I{^i3S@JGWemw8)6;*PAbfXUDgTucq(0 zVaEfROr9+pIKfpn8IJ-ujeA} z`6!yHiD!aB&&7|fWybsOZz5dn;@YWk+*5zZR(=53Uj#wmKy*#fKV#>jl|;U`Z+#kY zgMonGUUXt}@1@Bzl=4lIICyTMKe~t71%dnht?+w5_;1RFc}?{qe^AS=*C=>qU>c{6K0y<>$`i^8s4Z|NfCV%d{-Z0c9S!(XBj4$jPmOkxfQpP$N39rQF*U z*(XSr{WV8#M2NpnedFSegTQTu{n0(gUS?Y5_xI`E$pU|o#V4AgSz7p5UqBXK`MXK1 z342eKGAWD3e*BI!n&fw+nRtUr{C?5*Y zvP*WbF6o1W1iV^3fCOCNj>Ai1$u4H09T=~{&q5mTUQK&g3#Yr}0shMftV;}gpj!a> z0fgwzjWCR_5xp)^qaki+m=`opE##l%6Nn`PA~}FdLx*S;P!!-FW_{QrZ)6V`2C@wB z4I!BfVjhyTR!4dXIe?fXj8p|^2ZZ84JWQAB&@CV;C{P9Rrxm+YIzuzerE_eWv}sEAwST=2JbJUt@bC$(s@e zTBu*PfI4&GQ31d~8Ktchnshf?jNH?wEWK--+U&*+L4^LfeD! z9&V3nR{EkeewD=szHS`cjUjx<&Rx~QyndTCkz38u<2^I?8uE+ZM!(nVYv2C2%S!)r ziR%Ag@u*(F>q6}J#Ur>w!H)mD3EWOv*w;GTj^il)6BJhq0b_UYN!v$ondH}(_r3@E(P4{0UxVT( zy8e2l^G&kow(}TyLkq$+F8{0@cD4R9jlCA~y0G?|_{T>yf4q(P6H2={gU)NxBGBX` zjvqHk{2L!Wc-{Z?ukrQxEBMR(|Gl5i|6@2tJ?ww|zramhyz}=}yRCb>PX+t!ogv2W zuwH+9=hy91>#eUgoM~LO!O-`<-9EkX?)EOti#NE}Gy0s^ zJ?Q(IwV9jbx7*v7g?sxY8!rm?W^oo8zqx-Jf4lEZX*S8e^=0zb2j;88#QN5`Er^5B zMcmk2sa;w=WoQ@gqBYC9-3sl-Jp7CQOX#EwbocKb#p*K_ccbYqj!*7yA>rTNxzBTwf z+wlHse;w#zL~-p|{cZ{MuTsGM*S8&cpdfP4-TeE>(%66Tmv@Waxgn{oVZ8C``PO%R zl3CrG8`5s=X78EA7!3LQbV2wTAhJ8KGYmI=wKg5Gp=<9u&}HVA(W?v1j{%JdiQnEG z>HC$k`BllhIsW(;p8JkYuIkGqKw-+yN%p4E)0S|b<10L{z2Rz^b4|u=>9`Jw%Jm3Kj jc)$Z5@PG$A-~kVKzyluefCoI_-vRyyk;fyt0Pp|+67SD2iQ Konvoy

Welcome to Konvoy!

Launch Console Generate Kubectl Token Credentials Plugin Instructions
D2iQ
By logging in you understand that we will process personal information in accordance with our Privacy Policy
---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: opsportal-landing-conf - namespace: {{ .Release.Namespace }} - labels: - app: opsportal-landing -data: - nginx.conf: | - worker_processes 1; - error_log /dev/stdout info; - events { - worker_connections 1024; - } - http { - server { - access_log /dev/stdout; - listen 80; - root /usr/share/nginx/html; - location / { - try_files $uri /index.html; - } - location = /index.html { - expires 30s; - } - } - } -{{- end }} diff --git a/packs/opsportal-0.9.5/charts/opsportal/values.yaml b/packs/opsportal-0.9.5/charts/opsportal/values.yaml deleted file mode 100644 index 066be296..00000000 --- a/packs/opsportal-0.9.5/charts/opsportal/values.yaml +++ /dev/null @@ -1,57 +0,0 @@ -landing: - enabled: true - replicas: 1 - resources: {} - # requests: - # memory: "128Mi" - # cpu: "100m" - # limits: - # memory: "256Mi" - # cpu: "200m" - -# these secrets are created via hooks -secrets: - create: true - name: ops-portal-credentials - image: - repository: "mesosphere/kubeaddons-addon-initializer" - tag: "v0.2.0" - -# We need to override certain values from default kommander values here -kommander-ui: - enabled: true - - # Mode must be either production|konvoy, konvoy forcing ui in "konvoy mode" - mode: konvoy - - displayName: Konvoy Cluster - - ### This must match the serviceName set in the ingress backend below - service: - name: opsportal - - ingress: - enabled: true - traefikFrontendRuleType: PathPrefixStrip - path: /ops/portal - extraAnnotations: - traefik.ingress.kubernetes.io/priority: "1" - traefik.ingress.kubernetes.io/auth-type: forward - traefik.ingress.kubernetes.io/auth-url: http://traefik-forward-auth-kubeaddons.kubeaddons.svc.cluster.local:4181/ - traefik.ingress.kubernetes.io/auth-response-headers: X-Forwarded-User,Impersonate-User,Impersonate-Group - -opsportalRBAC: - enabled: true - path: /ops/portal - graphqlPath: /ops/portal/graphql - ## traefik-forward-auth 2.0 introduces RBAC support and now requires that users, regardless of whitelist, - ## be allowed access to a resource via explicit RBAC policy. Upon upgrade, whitelisted users would no longer - ## have access to ops portal resources unless an appropriate role binding existed. To prevent breakage, - ## the allowAllAuthenticated option, when true, will result in the group `system:allauthenticated` being bound to - ## to the opsportal-admin role. This mimics the existing security policy where any authenticated and whitelisted user - ## has full access to the opsportal. This option will be removed in the 0.3 release of this chart. - allowAllAuthenticated: false - -kibanaRBAC: - enabled: true - path: /ops/portal/kibana diff --git a/packs/opsportal-0.9.5/logo.png b/packs/opsportal-0.9.5/logo.png deleted file mode 100644 index 2b81293deb734893ed5c26072d4d60cdc9de6bfd..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 30207 zcmeFZby%Fs(l0u=1$Q6Zf(Q5D8r&TQcZcBa?(V@g!7aEG9D=(BcfDloeb!#<`_^~v zz31=4JVWp?*%t#9SgT={`k5pY& z9w=<<00OczFflNZ^1}mxKwbx96K+Kjv44xdec~fEb8@odW@L1Ab!Bj6Ww3QHWn|{! z;$mcCVPs*Uf8(HcbhmLbaHF?zB>R_=|D{I+xUCFqO!-LN=#4=p2F_Mar2K!b zgZ~}4zia&i+&{zk4bZ{d)Xd58?X&-v7J& zzhe0BIQ>r!lKfYp`2Xpk{|ewYC`V^Q3y{%&iO?U`KN^_+9qfPN_K$A(JO3XM`R~ek z|6EVp!Ulh=Yc&URCy)cbupIAy*4lp=`%iBEMO?|&*}(|(N3#4?^55it6cM&{wsCTB z|10{xC=@nu0-4%6xbq9kEB;mEpY(s!De@*I{Cf$4jQLrZSeUq(K5#R0{8j$19RH|7 z*}=fZ(c0Y6@vX`!f=oaTAR8ml{{T|S+0O1?70tlv-@wd4|CHH(kH+7UieFw)PRPN? z%-jW}$E*P|aPU+E89Kg2LB!nA$-&&v`FFYf-=)^yb^mp)|F7`=>Th!=cYY-yIiQ%L zkesljlJKX$Y7+iE`j76Cw0T46Z1fwXBfk;|1XO&h@dl0{;9tf6#`KSB-hyUq?)2aC z=ilUi6p;WK7+aa!{7$+*7vO*L`OndRlvQ$iOA&ryp}&Is7ws?Xzc&o-PY&j98L#*50IwdvnA5ega`L!Bs4S62_+E&a*RdcA7x zXJqcD1Id-F`V-M{xS@-|KeJA!Q|tWyQvW~uLGbgyJi+C)*7zRQyonY2!?L*c^)1=y zb%wz+Lp(8__j{A`b`F+KZW)Lik4Td0cb1w>Lk_5(tRsqFjC|wOvf}wEa=2yg zi8AKILwtH3l-CAc(7ka_f}c`hOkSfLMEItAh@}qHF3-xcoOkP@=fl-PxE{QXWn*4i zbk>emSE_beUmPZdqGZbi*S=*Ca@XSrC~*9&406~N#`d*|X=;Kn9W!CYyD1d_Dx!bF z&+W6UpWJR9Q<*Y%vpuuvMLieqF+;DKCMDRD_;9vFz!u8f*N&bw?(~(q=faMwC5y=2 znL41fk;}5X6~JG?0IyA=ol(5-u2fIP~?DE)&bGfwp2mn>)2&V{d@WA8hi zoAOfZ@e}J8kK?@qu0jeChdGvJiZbq(^fQGL1uk-c z7p#cm^nfKosX`gXMj+sTqmVsx_k_B^3AXP8L_+3M4Ds~&n!II4zZM%!%)F>;Xi)*V zj5~nnr3m~9C|#ug=+_t5BCfx<3z6Dk*AT(=tid1Ir=;X0o4^XW&cNTj|Wb!;-Kb z9SWM_6z$i;LsIe;-}P}KEDLZd1f$ZYfjw4EOVf$9s68(x6;{4y%0{P8i?vQ}K^|k1 zl)!@rcxzpSfl86`FD>44+G=Yf8I^75%j04wc1c@ot`iz{1RS)nVMr&Qsf#p0kPWYW+z#o`mla$-SoC0pwirP=JbX!U} zP1G;<0mM-g-iOonLlm!Am+e9O&Y#GRl`D`{jjU^k5R~d`TUF8FrAG?VTlW=45g z_eNC^d4~Q6H$YET?Wxz?zr3zbmDgfIJw3dq;aRpHE@vyI2iNk@{XbQ&n@IUV7d==ki(ACa#lCM5QtMyiPICdmLZN`mX zxDkHQ($kD0Qsy|KYBXsveodOF7-(I)?{Isme`V=-3Mx1BKFl;jN<%=zW9H#Qm!^X$ zfRQ%Qu_z?MCK)jzl;Z1uSvvQ-$muo3(BvxK1&TJZLcP9&($ETKltvDCBRyS9e&J*QE>b(i!elkoiYd4X?B z_SD;k_q6Dhm7#4#!`^NOt-Grn!YulN!iW`H9e$SjOo@pVw=g}OTt-6>VR#vcS_YT2 z9O@D?#D8zXSG?|)DvwNkTEdn8BvTc$r8qUeBs-2jo8PNi> zpF*%^KooH)$xwdr%~AczqvNXtOJCF9rs*cF|I^Cep9cNGg2^;cRVr{M81CEqp2_%J z1qykG{56U(2EjG6LpV4v{iS-|_?wjzFQK+yd_Dx7H-$MdN#8MLj$vw7T_vz2tV{sl zz~EJTY=x`6Vbf;>WwuOw3Wv}%omgEg4>n3jvA`<_OS-pwWl`$e{{t7GJEbFyIX@c?RqVNyRPKsH&=$ zz6VY+L(yEO5Ik8kF!Ek1*0D(lX8jDn2HY%AdFr+8gC@eqM|~B%Y4-4TdB)lHc&>R? z6_e8a@8IQka(*C}qBHZXl&WheXo{@5*}gNT7iA#J3=II!K=u!j?Q0;1A}lTY5*RB4 zP-u2vJ(jC=83A%0sA~I==}O2`guq6krQ`qbfArmO%;$&Au;;7m2)`#h*w#@rU;K$p+gA$Ymv7+4y7`b zq*=pBN2prohPi!6>naNt>OHr|2f-OxJYAB(L6>!*JmLCZ+9S$z14csO4%O|Ak2+?H z&EsNUEJrBn<+FnnbEa{N{lDPJdeWP9LlBR2=WT!m6NrQIhTXUYNh#PA73bnAHxQ<_ z66?4%5AkHpdx3ZofvJ;)Yn3N+(E^{(Un85JD+riiT#)R2!zx4BIihed*AJ16zuS=# zQplyuL|>svic55ByIJ{>mov`>yrPPu$405;XAYjC1VMx&pTVzF2-)!`BzqLafXq?l zlPyU$7a858wC&1S4U2qy^N|IiHSuW|Vg)M8HhLSsTGHs8-!yL9lY(AM`d1cVKUNnf zhK4mv<&c6YS}6N21y{h-;<>Z`;(QqVzSL?7@S<#c-pJLC^!FN!C?BrUZcMdqY^@MQ zu>o0Qf^}JZAF-tLTljF@FlHiM z<9zQV+c=c!n+pT+lDTm}sS6!$VMZaw`WJng^H5boh8Wa`$=tHD#*rz=M-0~Vz7)ug zFpKMzASXE`x;ErusphwohDy!YZvXCqhN~$8p6z}a`g%U97kxbzVP4*60WcI|TjcN7 zh$uiQtXiAP(&y>=Wd)f>b{O{p+dwUD-??$2%1!^6l9Qg#iRQX}{v05B#58%@>!fRa zVoilPYMUO)j>ysD;cE$g<<&jxgq?)u+q!gkKK_wJB5B9hRt>S|>U9f(F*4_&83t^A zSJG~jvbUt&UH@%M{rt2i(iEFAvHFB%lNmOBvW#sC%XcOKGC)i1FfG4wS6k*uYSx1!1m&+PhQ{JE zUkZe#k~O!Bp3MMaeS`C@l>U#WSMVg^5B<=Wc%{gBk`UV^v90pt6v|THNKInF+x7^F zL#w^7M=_*h1Zf4CsulInn+(RUBWMbZWJ_kFY+W=neKOkHPK#EV!sR5^+r_?0k2Ht6 zZ_H=c)fvtJyvgc<*hwUlTcp-qBnO%=);7cwg24gs{HY0N*xA!6#|7DM19UMEapU-0t>r|Nc;LFgtiqz6 z0oqGRC5Itx?vORE)AYthZ>Y~5mbY3@&|=(Xgg13>n~lDjNIA&H8jpd2OKM^zb~7;2 z_Z=_GWcnnqZe`!Lh__vTdzHWy#rwI!UWmk&)KT?OMaMxWry)!4D07$3+jS}FFcpCu z1wtRNDAA!)OIEP*U`BEBT5ubdvG(A^9qA1f3dKJE&SCJAx>fHcCjR*Yb|;mIm}$4n zSU-klz0w%&$xgb>Sa<)|t>fwOm}?5G?YWbc%m~>I=^4pNBreF z=Jgyx>dua z!PEp=8hID5Ab2aq=E?{+se}s_+^J{o6o|&|FxiDcB*WV4Bw^+eW6!)sj_l`1>^`cs zfmP&)o%D$xUMz_boK^R}Xd=7#O36HHm*6O!pB}>r4xOC^G3sQ8NH@%}=Oaa6p^(YQ zea&DglExszzUdIoE)0#YLIgTG966dhd%I7qwal&^psXH_Fdm?RU(Movrz~Y$4a%4K z;_13Qfr<%KrK#o94mIWd^(jE~a>%v!gv6otFj+t@)NJQ_4i^4LrGNcEG)uF#Kp+ zF~qf&wr1FT`(cy@Rm6_JejYr9%{2EnSY-Yj_f=h#M2m)8i&C)lAA-2F4dqp8La{AQ z$wg&Gk`7ugCw7qcs*UDpRG#}e0(iDwmmyLHWs`dO0UtPY;$p4)-@!+_Hf>o8YTU$c zA94e-^)xL)9FE>faP3eE_UELqiTE{`Q6o;T&bEhaX$f)FF_)IwxEW5zh>Ue+P;IP+z=H6T zyL1}`%zxE1GkQObNzuAgEY5gH7q20)tM!u<+|dUa)7I9vXIy?n@hcXjHaa@Ez1aLd z_V0;Cg>dz-hVY^7?Q3Eln@Uwi_0mE%WMRr%2kaJtElor??-;b0hBnd~~XWh~w zUrIH|z$;;qt|(@b6nVZE$wvUxU`qwqF^%v>=NzOck1@JRq&q3f+SDl*>yZfS)W1`l zt-mQ(T0FUZvmZxf_U5f6W={wVbp+EObM6K^*>Ek;awoqZHLzQx<5+lLPrUi^XYd+9@UF3D+ug{G;E-P?f1rey5ch}i!O|ub6W(W5N4>kP;6-4Tw%&sjj zYQ>QHhN-p(1-EO^j}98sc1H{FzBP8$i6uVh8gl6=@`-`3cjsi}v1`%QzDB0q4ZU7; z`CBGxjU|YLmUUgTgiKvYGd8nO?UGH=l${oJh=M{~)+g2^QzZBfYGrd=QMUuR#q){&W=b8s&^3+V&L&M17p3Tqq*BJ=p)F0Ql({)VlT?p2r{( z%&?;&cbvRjpgT4enuHst|LF}O;CfgP-QM;GnIPUsM*=$)^TdQmX^n>?v{ z3f!TYD*HEh_Sds&d%jG3QSk4yY@W}uJ70|}Dr<^+y36pV#SXu$iwMp~G-$K;&K)7S zJKTIbk}HHlu z%TIEj(YfTMrJr=f^J=Bg{@Pue`g&{mMwQ0?RH6Llg~{@^s;~d5 zMfla@WG2{mP>NtD77t$5{GeR%Qm$c5SkA-#{M&Z;%9(F7s{&h{>+2^pCj~W?-wGmA zMr7_tF%Ex)V;9Vtc`bPST_}54(5O1I7WBpEv*-n3WxnYl0v{5gzJc3;9z5Da?GSg$ zibjl}YbzqW=9x&E4(KPs^xTfOw!GJTLKZ%gDPrv>LCrwQqBGX%LC*P5u)|vJE(TSC)?k_3+vm$F^l90S(~L(b zD+;_DYQ*RQm#Lq-+5OOu39+HkiBsiM`0x^E+xxNlZ0)2|m%Fv;BB!ArHRLUcxtp;E zh4R5fm1}a9e#EA?luDzWC#!jqzTAwR#w?C=y$_fBf+;D`oMtsh$wVU&KS0|WAKvMq z4#;v{ZLD1qjYU7mJl?}&o>8sLEhR!d>iBdc6?n#j0Xd`qp{tYJ7xxu91z$5!Hgc;H zi7{$v`M&@BSm3j2rmJ*|(zc*5|E;N+8ObF(@*a#YdHMFwS!*Q>#3rK$j)+-%M!ua% z&TCq-O!Za1DufTm zS*)&dGz$~8q@HF)cpnU*9%`L}k3Dd^`igX3fz8jn@D5JDj)+zK9T`|f57;)?fhyhZ z*_2`{y0rjLBLG*Kp~6Ft46SrrE;|?5fcA*;Ffxo>BrqUCnx89@`0Xq1J)_% zHhO0!6~pCu{Bm8c)wi{aM%64da1PIWs|#fx_J zwZkW>TF1fHtv)l;nNmxfNvGFOFoGa7pF-@C3juMr2m}cwUXiYqkTCL#bg)y)2Y!$= z%m(dB2=VTm-jgO#SYV!#<%1)3PWU!ed;cjdyG4qH%Y^dPJW^kbz*Wdja(w&G_4obI zQvQAU@N?UbiYWBiO~qg|`siC3x{n)fvm`MC&|C|`F;=cR(?zlHF|JDsoFcjm z;ED{p#OXNco4pl_H))d`gcW6>Z6hJ`wIwVg+G2{V;pND>X)oDj&Q4y^h;q?uZ|fq@ zy8_kkvz*jXuZ7R5m&}SC@kNn8m3cr#?AIdseBR2iTc=RB#ET}66{uLXIV_DeoIbA~ zDcxuaQW3m4wWFrF%R;c zPOa}h(te1${jxBRX?Hol-y3@g|LuW4XtHGkAjJG$C50^xOpI`sNw|!}8gXstr8(V^ z<&QG6Iu<1N0&Pf*N!C(7>2jL(}uvm_1wni^~Ucofz#?(^WIzPm9_o! z^Qm!BIy#!+drJqU7KP%r=(3*29dW;w?rS!u*GqAQfv<#l*n-fk9kY@ivaImpazsU$wMZ0{X@6m>kT$ClnPG8l49BWiTzkqp-ffrGBk%~fZF zYwp;d;XTDXp&QI&-;i&mP%u`#3QkWLCr zi^9q1E2H2aBXB6pEr+%wcL_XyABBAnF^FvH+v*ZqF9=f6 zktC-w$`PnajSAK^vF04sw3x*+;R?lR8Hd zAv4!wws)P8XQM(7cyYVkIKoO&J7sM$aR|QQ^_kz*LKRSe<`8Ql!G}_ZrtWtMb)lSL zysNAO2@j?zZ)cEOcxq}|ou0$R4o56Q@0cTSa*1+yT~d*cbzKwMJ|jQT1~Pnl{0&Ur9`axp|zsduK0lxvG2; zgX`^|?7(V;TmmqjT#O*q_#=&kIF*+~g-R(xYf$;&8;`}-spux*e^Gn<%m_;!PH{u- z-zDasm?0}MD><&a$kK|@tI8=yRl>$ewIE6`Pl-31`|l8;-Hv8e=jKqrxzY51f@KnRdI-zD@atBAQz}WK@R4P_`{XIy9FKw zK*-;g`sLgucmYe-XiF&!Og;iwOy8%^AoO&hZH7vW4g=4UD3Ko&R8?f%uSQ((C_M8C-zI@zE5H4mdXJ@}@2n357DDsd(PZR2Uq$llgD&2csl z7;b=0ht6eOZCnZIFwYxn7Im33I&FHnPQ_^Xb|&zBZx@~_syA{G02Hq^>gP+#qH^LLfgm2^nO4$JjM%t*w1+A^u%hIQ1YW; z6gB_7uBXG1MO8t~_{QRCk~9FzOaTJbZDf&Tdq9JPIepkUT7+~Y{y2%}h2TDq$T&%{ z1k#HpLbKIPHKBMJ>DY11rHGF{7QWNNJDy_nV`yMeo64kI*%HzhAb1j)sR|-bu1!(iH1LT!e?6D+q%~Pv18xMr_|8|HJFHC zvRGj|mI^=-CwsN$2!mB4zZ#C6RW;Hzf=Tdj`ca!gtb=%|EFn zTd;dQs*%6B(Ubnf0>UlSgi$(3jhn^zn?dOeEZFchW^>HT!ecey*c_Ydx<>y_q2vHc{hZkX}bBNn93w|0~HPwdmb}H zxs;^*4cKt zdEexDpftHM9bS*Jv%0Ce*ZYb8IA!zk)Mp_719ct?{G6bZ4X+ejOi4F2uexapROM4X zb~_LM?a;{9Xb}FugTZiH^XTNbOv%6_ja0VtcybM=muCY@U-b=cNS_vjEtU_2_3HG* zDmqLR@95?Z%jfY$h0qx*I=-rS=CScYWpZD3Ziea1lO+ zOIdHdej<35R#WcPhudl}Uve@A}~rAw55J zUAL>-GOkn&vhg+3t+Zbtpfb9Dw-m~97rR0-jdlHzcx}c;NeNf7>x@yd4w9vozYa1T zsT#4}Q3$-vm5uAMI(2Hy=)2Uts8CPkBUHhfS*C@^X1qPKeKf#NA@(}g-u??n&F4LQ{7teUWWY$PXU;vk5@ZI9(05wcf#Hji^RoN zCeK2M8f`^};ArZ*A7-PP+${R_itG#C$kyWT9 zsJ396I%mDB8k^WZW~rySimzjsLa$!0axge6+Sw^TU+Q?_44Y+5&E6hf zhi0rDe!R;=D$hA^6!=9z$$zYtmX90Dol&)T!{;hnPY{A8e zhe&8x!g~7W!A)?NZFx#^wF;9bqoB5-F>HQhApwzz(WlQNZqA;&B;*4pGlh_nZg=F2 z^h{Evylr*AN|QzA*sYTxN|TbO(t7&ovLC_378-pC_IBhtoB=HpgFnF}wbExdCe-JD zl{xIdcGb_&L*Rdzp*j*V{#0=>DjbAXm2aw0MYoaO&N5bE7fxQq^VyS%W^h|SVW1)p zPCp~^r*v)jB6{(GT{;q))h%dc04=&S1u?D7Y^YJD^7ujT_q$hVNxCpQMa+{Ud}+m<@3+P^XP(U4jJagPe$ zH_Du_rOqiz8EH2(zfAKm#(a5Q%`s$jwH>uPS)0le<;){VhTTh`aE$)(oq(rRVo;kx*84CO~} zt3?}jh$_|qjB;^qMM@^8-oO>FGYgK^>v_-Pf{*Q^8oi}Q2lKy!Bf@gChoqi`_{J$i6i<}=+_mkBxn~qcD z-h5}p!Lck@5dv_4?fN>-$VFUuz)bEKM4)$T z!_#euAtQ!~oMo*OH4hxy6=1gsJk{pzpC&6Ow$!y0Sp6#0AMTZkMwMt}?|~>OU+}M_ z3AQL6w->-N=8xod8kU2tC_$^n^0N1oACOWY?MmmT$}kW!N(8LG1}Gkzb9 zS-`a(BB#m%M_&8|n&W6f7U1#Fx_+^H456DMEG&U`r1Xc0-V3IGp^OWtNc{Y5;IUC- zD>Vz61Y2Xz?WJ{-QTME+>8U)TM!{4_R=?7B%b?0pc|C24V88>-wL42+tNl_{d#K*~ zs9wvy7jJ}niX;YikQyE;5oKPXzM|-gLNG}$2D;uCGr`eum^OpF?oITK<4xX@WR0TIxs^)*a`G>R=O@1$CV8HU^x&-8XE-qERMd zg+|y8Y(&Tr=;HMe9`U^rA4@hSmThQyE*imXxNz&WeO_txrRF{I3}MyeBCy{-6l!~W zLJ&RQaXhxKK{6K3$2`qXR?JgxZ+9;B4qu{!mO~7wx5dx|JaX+Y5>h+cQgCyO=ITSj zBU^02fZ=ipazB2i0?(;95Ze3Ts)B!pUjUGbb!bm!QD=wcNd0|!_nMv$O4xnk zFFQu|lcoYOw4w?eIj5Om{-d>mbD=$>xWx+Qx2eS}n!|IcReu zZPE2Lb#;RJER6_k^gJ&L^n|uOZSdkOE$jmoTA&{Hv`Y#P7~N+DQ!p=!Zq8b(A~(5M zjr1jd`Cn{kc3$)5f5m4WP)^0mD`21336<{bJ-5aQTEKDOC!NhqPs?xrI;~}qQhp6Z zCbb%djWymeb+mt>Q;xI764S4v*%?1}M^E=14)jg}B3GE4T5c+2pFs9gPJj4`U+PLD z8Vs@?{O3Lb!8qfOQLu`DV#>>LW+&2+!jFPgg6v+RT}bH0eeu~8CoeX)j$do(KvED_ zQCPdXM&~G9eyT&RU9SHJO5piY|Iw`lE z7+=Q5&#vtVH2DYl@1D)`zm$^GY-MCu%`g%VoNC!#E1}l=lQuV8Tnp)=kwj{BnsS$t zgu4Tg$Z#uNQ9%=5%EF+`h0;_`t{_+Zfil@YIrJUUaCv-YOR`w+hJM zKT*#V={!u8P-q)ZZWOP*i(4f=Lobwq@{!7?_meDL04184V_yZO#4bWHYAxt<0x3Jt0YRk#IW#AO=mjC{fH zHV&acig&B#pGG{=?01c}=G+yrM-&yS9G7)(v!Z|>POV&t^o_sETKdW8f}{z~Q(}Q* zxs)vNqg#91nhqx-S|~KiL0@?NB|H5I_(9ba{%)Kgzt-Jj~C*u~jnmoT46oUM$c zooa-#QookN#roz1F?6Y2IO;PA*E8N@3eFac=X`?O_~^b<$Em{Gb_nOqo-IW1>)Fc4 zgUT9lq*SjVY=N6zD8F+T{LqP(P8DO)kCx1i>~%Ew)?wcEa|>Y%5dU~s_&Mgqfl$PE z`xs%4uNcSqn;^qF&*lz;z+*1j;!jaK86eUcI`9Z-c$KPhDi1#m`Zy6X6v!5l{49(2 zv(X~AjFiqG6w8;yeeS&(`b||Y8j71-@DhtX?nLW&9%q(O#r;+tj#Mg!T3omlU~mKe zh7x3`LjF7wQ!AqJpm3M|*j<^Y2x z;MBWZoPj&U)PT|p&8@21vcb35sjO4W9P|;_i%wgTURX_!vJ;Ga$RX_=?C@H0hTFJ9 z5|`rn4u@Z7U~&K>pdl$nkLA6tvs4i6y-;E4rpeC^WwZ3tFfG9wSLhE_V0jO_pg!5FHe48-y+ukawP$0l>Il7GT>1u+> z#W;>Ks@M*Q&)MiVc7gK~J&^;XDRuo|pZJ}X0!<6O>*M@C-n z9|WpXp(HW5*6|X_UM|(XCX&lcvM3wb4hb@qT}&Dww1qpB8t2@rZp84-55*SCD@hy~ zt0o(vnMto|6}0&^m92w(nMPHGSfHyPjQPrH*!b0CT}23V<)j*WPxa#{veqECA{cYh*o8UGMWTcJrlpK)iHfu zLA82TE>&K55RHzhdpPn{BMb)YeZZ2H&Y0f7pl}8Ya;^)#>e>jbx2No>v1e~{&@Xnn z&=XnHC2I~>o;uT!hw{);KMvJ!UI+TwZJ{Z!BN0+TgoNVVYE2LPZ?OyyR#kgVyHobJ z*e@9tcqqDGUFfXwB8*lG4rY`)iOCkuXAN2her{kuR%*KJIpa^e%Ur_J|)f0DM?EMq1-gk2PrjDdk2oqRu3>zc+aS%arBqSZg1mu$O?4-BO{I^LFo zJZSzI6Yidor>84&F1ejt9AM)DJOn4VbFH(!wVM9qG19k2p6yG z^pT=nJW-R12N3VjjPoa5A!vpS_Lp=~qZzypZ#B<8Sv5cH5$Dj9wkUlRNc=q%>ycU^O3103myk@K`qdKfu(3#OZE{N4(l=a<-iocr;zSwcDlB7!u~ zm{D?^dYU?KUo$CFEsB)i0bm0b3lkRJ_7D4cJmb#JQ3)8dT$tIc_%*$VjAcWg_QqRTZQ_R)DMK} z0)ZNN8csjv480uT&i=QWy0uCN_ywI!;&H*qWXKxT5aw zLXZZI^qx7+qdT8Nny$)I`mB(p-QNN0EUgpSS_yDI`18@hhmYP9z{nZCm61SHjI>T@ z#9*^oDJpgx$(5%1MR3wA2PPT@x)IU{KvDpA4F4>G#lTXJiTpx+ZxZvm5LfPd8vpA_ zzU`sA1Z3#BIp(<~wK-rr^eLXXPc3kduNU-{W{db|egNP9~e8YtJm-5lQT$9T42oJ3p*q{+dR| zb$Ye{=&RIv&^AQzP81QKFdnaEkClh3ba%qvoMWS0E5PdCd%Ls{ZP0dx>4WF`BIoic zJ_JKh7G2h6lAth1NPc+D#vmr*N>KV_1|^&>lAVr3So1Dk$GEZ}CUw~vB~HGOfP}_# z*;W8J&cC;OH#WdW?{U07(^kq3u=@U?89tv2t8nri%UZ6k`D`!B(D+Yw$eMPE>6^Kt z6U}GEwuaeirrLn40$#GLV3-fX&}Z;r^pVU%3>Z|2iAeUdOYrlqU>Y6TJgrjcPnxzO zhp=sduGo4jKKZGi*PWXy6Pwulm`3B&hFE=qL)dHnVtVd@cVem)btQ(f4g zoQ`q4b6uFSh8i~YYwU?dXe&-oF={LBxd%@}z2oAfLG25x;L~hap0bMkp}FK#tJ#a1 zTh}A~nxLCSMHKF_?18X;qaLtdAI)S@-$`H**FW#OA0OOD{jG~E>o_&SmuOY^#Qx_p z(T#^*ROsEs-I~wKnshcTbSHNJ87$FdL&gr|{YV~bvKhK!Jl4>+(Q zNI8$8qdf8mJ+x@Vid9%q>w?xU`KDV=A1ZhZ)A|4#rsF2m7|MVHgqwTVQF zGHx=5>C#v%=Ho<~4s#&H&c$*ZepP$;c?UVinjP$DbfD5RI^3J>=-%s10fgGcDnOj- z;6ngM7!eVKKcDM69qK&O^KZIzW{)+Mf&`^$lEMJ2j*#_!ba)#8L$-zNGaZnFG=0u{ zKJ!sP^uoZJ77>LJ4V`EWe#kt@5xdMc%&W#M6ERU|3OY>x0Ju|KwFNqyN_CJG@Wb(l zUwBCT;DhhPDz}UD9HSsM6T{J437uQyMU0w-%67oOTdeWHvgpjlHsRd^aAYm@+`!m^ zi-;cO00GOQdCbDVKos>!fAG_B+dJJX1q4kg7Uf+RGpNrr;${Q&A-!8W4e_FWIe_di zMA_jK#6_$YBd6q?Rq1uqC!C%vXujMXiBke$ zvY1v~!sO4bZhvn4#*-hC;jFr1SZSDteQLa|i~#s+L_yoDef$dk#M(6+=yMtEv}PN$ z<3=}TP~l7w1brT(OPbgj>z2A~An<527f}Gx(MB=*=tTl1CGq5^Jw6`tfX5&hLG^^m z`jCZC4-jp@&q+9O>)OQ{ z#i6CI(VswOc3GuT0)jYk7C{{0M6fhm00|j1mpRV)+v1te`R}oC8cYlQ%7C1d!d@&R zAb!gcPyF>~#VcO&2COF{UM3AGfyh^QcVWWGcafm=0KBEe)!4UiCI{$r;~FfVoZdd4 z3GFmMwN}DmY{JnySv8@Vv_M~yPTLePfOlva z89mkx=>YnfeqkgA=*lRs%tio~J)o~)&r-fdW5gov;^f1rUz;118$a#TKu^Vxi&Jeb1Wo;crONn>^ znv#zoWp3s2kW5*!E=q~(aVTzf^Rwbd9}039&9Zs3km<~qnrQU|(?A{^`iXzJDt_mQ ze;6Nn-zTxBb!Hqs?Apa_oVIsQT=um~WA92c{_0h4i@$x-JL7)ee~)k@ zyoMmagLq)nAZ1=`- z$ycQ=7SPh_yj#ER@9LJ_{w4i7C7gxl^^~Vo^pI+i>J;a0xXL@z*~j@Dm;_p9wL0$@ zcVh&PjUJOpI@;q2MzehH=DpX%LZIvj{kM)lNQqOCI*BZFHt*#uLZZT=Ottrr4r!S- z_e?j_H|^=zTti2!u_s2{TbrExx(d63^4|dU5?PQb)ZL57({Av>C7Ie9ca^ZETDlZ& zb1i=CCw>T4NR<`l2}DUytD@#S8GAQV+W84R-a%TWRVq)K%BS3`Qn5+^MkgmV z9+!q_nicRmkA(EBvWb<8UmSB4fNvEk*23PYxc>vbC!@^l5g4&zFOXG$Ru0W9Y}E(e z^VN9t&pa`j{WGGwc@}~QPohPSDhkIqI6vBFyOjPG#4FnNxQ+5yNdEig{Fsd^w9?ncNhw~UV1{)~Iy8Bc>kQxW-I|-$; zZl!*e$2Ps~a0Ic5?MNq&%r#gCXmAIlxSSw60`dnGWd{+w_?527ZWnoS4k6D{7Vx(E zinP;J`IuK;+;aHd0-a3D{9s4&B1pn{=3kx#iPZkB%bR!EJJT;I@Nk6FQlTpI&ed;q z+ndF{)A%g6Sk-TxiF9#JibW2n6qe_o_LOIW^n0T@oaX|dsbeWm-6qtPdD{$jb(asb z(W*Je-jqFD`{OI0KM>D&+OtWkE_cbHZZ(I3RH32Bce?9s;3Kt)#9fAf`RC=7Y>wuuF)`d^qoBz*0#)tm-lN4nJ#9(Pqq-`h)MobHp zZP-qk5!6*|lh#2kJYzADiMi72Uh%g0+(!?YT&7yr*1N+(eK_aYH;cI7X6MBEa0MiG z?F1nKWz+m?vV55jk+MFfR#ni)9pH92g4kV70(}DnKuhjA%Svji4e|@$s8LUI4wy(S-;QPAviV zbMTRo83a*+;0uVMC_6h+O32vo@|V6o_RpRJg49%l!6F9_*Cs>`2NUxpwv%euBDJ0w z`dI@R#=`U&v9Z#Lx4hwcBZhi zT(;}ZD)MA$?IieV&H*fUSPb=v5@}R@@KSBUOA&05G%3UK%69<8BLE7@Or%|ncm*gX zJ65PD^rEmDjFgPNlWB@H3~^DOtKaS1~DSVdoqa-1aNgO;%Lu%Z|foPRlZb zwG~R&n2&#c-$y49M1&$OikhXf$X+CK{srftcA~gcs_j=8KvqN*aFjs$Rdq6fs@7va zgKbl1FYR2HKwMXW4$M)}j?~#9_D~rE?3O}Ze9#HRh3!dYIy$a&UDc6Qn5{RT2vK?D z$+`fbx#bss@*P_MN=x_dmA~SZAW|7QeLr`U z9x?e=X!MmYU&)$_3YAQ}(S=c9P||WRA(1M-L=ZAHE!iSv2YsY#U98FLH|n?J@=LEu zVv~D!$xVjLx|!nG(fp^Kz6XSWT|}DYn$M6UAO_k6m_nPl?vAP)<9Op#Os#IPt*_hV zsfMoYQl1-F4jR|VvMxK`hMsKf@}53?PZY=zEMxE^QaP#$jFa)|@1|crlg|;OU->jf zF7x-htj7^~905*sVwr5o(+mtF0CN{Qbv2>@k?NJXrqW?su}(cJA=*XG9y=3F%+sV@ zG+$ln#|k3g^G~0T!v|!i${fSh?|QRGK@Q6+s|6jb%G+nbvD5PGkxq05th=yIgESgi zSI=2!CyT4gVj7?07~Bj-TRPxmZ78M^LpNuoOxp0e{8%1$%5Q1$ol@HCDrfds-D^h$ z7=QD7eHo^HuBk?eC%_h(P~HoxRzC{_vP2aC=hM;oR_U7W7?O?-Q|DEuTS`-sHLS?$ zUx7i-BypwJsmPcb^5Si_5IC#*#F}t_YLPzWNICX7CQO|VP;r-a#Lv@fw-w{WH)51o)W z_AdjvU0J|(gon#6Er7HoYhnU)dg4SCCbOurzgBt1{ytca0_Dl>kw`h7%<@)$7Jza# zuxph&5RGAGM>q>aIBqHl4p63?;RLGai#3L|jY^%JbLi7hiBjsqq}_2p?RP;gWZhKS z?6XLylvZ_{h7zf&Z88~~NPM%tiD!HViM5pCe98K|g{2LfCndCQQuxw_&c%3g4#d6G zzm$!aZRd72g4moQ$r0|l8+*%l>&gBRNxT>8VHZv!Nbz@=v@7k*>};M4*Kj1y4+VMZ z-wb*TKjvmi1yD?=_!L&lLX})g7^y))CjBRBK`g@xaCLVY&hUh)0Wn8z!&zqQQKh9n z>E*=T7=%wG1+Wa(>QtE zE(JO1`nIM9^}WFGm|LsrD=H-L%a(~a%;kjjLPccP3M-cJM3Vf*PdZ~yQlQHFB)sh+ z$PVt*1oEocL0n65~06h+wRG*q1`UN@YT2o>9_~)dESxjymXMJB`!3u8)%e zcmDG(g6#Z0%o?~Jli-?@21j>Yg&a9Suh=L8i4SFxu3rHGWq9R_h~dPel6;wHeU*p= z6R}vmH=9H*?kB0+MUa!BV{1Mr>oN(kHDp(mB9TM+QOb}C;8&Ewy)+Vr61%2H6{6MY zr%bnMu%sdEO5o0%o19v17eRJ>e~S#0yiScAQjcaF z#2Wj;)LyiIM_3{8NCS`rU8&AgGp(a+G!Ddp z*TiD~vbfcq&xn8c@GIlHzyB_AVCmwRp6_6%*S#g0EtQIxs0(~f;`1eQ@v+Leyq~1M zy9jd9b*zvpAeT#ncLIDHOOAcE!E(X}lw&bghF8bk|HJL#FJApeamIxa&wTE$#&>@A z9g0ypY;R$lB$Ft*ST+)ihB=WRC#~m6?{*Pn$9J(^=*oBL$|BOWQe~p8j+JIuSJ{WF zxzf(eAP%lv61TnM`SHJ>_td}=Q3|qV&xm;GtA0Q30g`m*u#Gi?4X)K|CMNEtIq9Gu zrvS^fiy)JIzQdl!bYfDB3u5GaA?vakvvbq2l*aQgT+MddwE?DsZgqCN@vr}PoDJo` zoD~}B06X(>bqoLerB8@Ee%sCC^2IO4zSF03c4JaUuv2F2mt0Zz`Q&xG2y#;NEfAY) z6IP~18=p7h>ZL1VVRkmAW?OOf;jhK5Z+}6&{tbT~y?uOEC7H)(Byh(Yu zRkdl#l$frR{Z(knzu=|66ZiQ~_ap^R39j-raf_2hGLKS=q6w_0i;Z5E+i&zmE;^QQ zrSa;tl#n^m+1?;%33s-m?d#*z>TRT@LIRtO@7>O;I;noj(NDkPKcpiy^?8owRDwZTIrdd5U zY+Q1$M#-G_D*r^%vZ`$!dF(J!Su>HW7|&+Djp?0(iw8LWoC!siiKDSO zEcEJY4#b~5_q7?p^}iC+jZq*8NT>+d{o|e)gay~M)H=iYofM(8kx|l_tC^FtS0Ys( zWI(f*_H425H>F)5rS`mXkjSuR>g>pNlFFOT_IIH2PIh)uRRvatCFgEpDo%iNy4Q0?2VVc@YSrUFUHgUSAP0 zRXO$Zs+wBE5t?KbAJPDXpWP>dO|C}6osiU#wlI%kyNq=fZFJe*Reum=Te_;o+p=so zpilxJRY~@T&d58REt`^5g3b}B{L6QrjUoG?pJLL&D(Rme^TCmxB&w@C6{slb70^yZ z0ie?_^D&7rO~AjfBx=Yyf|gO#dzC*=TWOn{d6Zn60A3o9#)RqOBG#z!9#w;Y<SeQ98UjE`Y#1kI-0#8zaxxyR+Nwy#xB_C!R zm_wDFoW*eUhUYU_#=3Z=Ncg39xdZddhu3otyT{3;xgWx(LG7d*_D9_(1>ADGZSEz3 z>eN_PQrmXFI~+miWqI11A4s-qz~a%-KSy;(MlXTW(Y|^oP9yh}GyYZxQoz0Hqa4|4 z1WEAYLk+wYVpPcGyrc;bcxmZf3+`K2p<)FQMNyLxDP=jlL~Q*@JIibx%9WE}kU=AH zBSz$lFTO0JcrIg-3+mEEXG#i^21M{Z>zs(Q&pVS9aYk;iV4cHtw9G!;Tfp{k2ZM6w z$17g+mU!~xUJ(Iubg*DDT(bl-grV#nR7sn}b?r&MII_0{=_u;Om>SX` z_t4XP90aTfbx2dFJXyQK{#J;bv85*4pVivg2$Dm#4P7;M0+@hi_u2Sdi9jNeS2coz z81-mgy4o%*fJ~suC1+p1(4{t&pi+Ux1jR@%y#e&RGTbCs<;N1eN~Iu44LBuiB8kXR zlOhuKFYWVk-p8ju^?720BWbO~`dKF_Rf%b~oCg&D`Nw`Rt~huJ2(p3x)nSwpo1B@# zq#YyO>m1xO*FH1e@XB|@lm6?=vxyW0u*l8{Rvd)G0Yv7PW_wcQ#2k-w*#dR-xPS4Y z%P2LaAe|m_Aj{PUF*Pn>JJ*PxrA(@_HE0}}^7eb%*$4t~6eJK>9JK@&|D5D{m5Fef z4Ex;=EC%K~@0?0#NNXVTeJHInd{!3mK_DNvU@^PQO2S&l^7l4{AVq$z+~ zHtSG8-RBa{gE2iV*5&Sh`S8aRkY#y{A&WKg{6p>oC*v3RYtL_*5stI46#u9U?Lxw2H&*%P{W zzv|+M&wuV>lpryZ%^W6At+g*0god(f8WT@RmDI&PAWhF|86geODrQnqZrjw^0z2Fl zKq}y3b?78UvND(prXoqjDrE-)DnOXAN@x4s&MpvQ*aU`bm5Js_mdJM@MQ1qTa!+Ka zfG5)xx$0};yK$2enO3r5-b;EDB`V41udJ0U3&;H+uKn~UFN(tl`H-+Fdj{GtM;Y`L zl>*;nF23x8&HA+`JQnJ4HAr$8HtSH#%z6^-W-P89ij^f!yP7#Irn`IMRWEx}{OV($ zpQ`URhz97Kounr3xUSh!mE3>~k~IS0$@60$`+R));;-g;B2LiP2FzP1Z^r{YohxNn z+txyh%r+DVk|tw8knzA|zT3}DK*07Z+_98M3D1W67dY6ZiNqw=1F#{r0*P-)?x~@` zs!&BqkOnk8<9vj)MjKa}%N($lfIUJi6T(M(7$yBEoyo}j%37zDb>gcT>nB&AH#yYC zbT=JoDTjzzm^fIL^oO74-sD(<4bBU6PsS#aosm`!S*6?bS*_%AU(n|qOYzWP5|D!=k$2x%U>T)c>D{jG;K&yvOx|si5EW8PWj9aZRz0Pz+?FL zy!Y>7c82v2w1hngHP1#T{}#4`Er+2C1-H-@f=D$ILAL6^$8G6K3vbJ!9b2I!={=yr z(~UHpDbRTI@C+v;soLG>GAZxTIeCYL0SP?(rO_cQexvppd^Td@OMs zFc;aPBF--?8$XFW&LPU+^W@)qWPI0s?-ti^9;7TC;{-t(vE+mw;ehqb!G<~(4S~9z zReIjGu@i-Nu(PoXo70E1+Yvp0@6g&+uoS~MxO^G!bXe9mD-Lj4)HFx4O>t7wsPBP4rG#4mC^RNS=7`>Bd3%0-58~Rx@h>0v zWW4vUFNu5J_eRm0ml`Mrc64@dU{e&QJk4;Z`G|vb^!olEyM27e-Jct;dHLVQ>t6MS z=)>l0pw9lK%W0e09_`eO3vYds_?`dui*f(|e6NzNI7+h&;n_S|I~_%=O2n&k6!OM7 zWqHmEe=8pL<4=l@eejEvSE@J7Nm?4uHj*PuDVyPCN6Wh86vIBbsFOH5NU;>bE@w zGozGEgYO;|%H+Xgmthjg&ov$90DMp4RKp^5`RW&jaq(A?aPc=aI~6y+*;#SgS%jmG z!mA~RQ_Q;ayX8v7w%+R}{5?M1W2ArTK~IbKy!|6_=AH`}L^wu))%9MIGuuKW0Xe8l z{$)StQ`)Ic?wfw6JlA*1?G8r}&-q(rlw%#DH4h*$2Vi7hT)!;-^aZ~gKkyT`mX*$q z&xW^?>y8%Sy&T|#Zvhp8k%rTut4?;ETBQ0#od$uV2o3pX`&B?X+L`906F3d$oxDH( z4+rCcKk_gp$fpBDh(&{Aq#2Eqr>8(LV7!-vbEE~zolC7S_h~`B+OBfpphZkpkp{V~dA9@Tu|MzyC;_Hg`V$u(_OFUt-r1I^KwDGl?uB ze|hu%EpXoeL9VNdzXhc{-Ygq2%_+A{hQD==a9)G&^*jxwqCHrLoC`YgGVvBZ^1|D5 zHS^NX{^weU6-eO{L;3(D0Oyiwco%8^#S2vabM%J-AB1By>+kmlEV51=QNNdCaBk?qci!uY^9FR7Lj?Tx^fB#wW zp?6;e8%PL{Swvo51xmrjDUc(bqjrS=LZmS5yLILa&uEAc+&3VTJ*HN9tODUg4%sV_ zqfkZ5SV6UEOt^KH;zv?r(lx!mc;!>#KKJ_$<~ElhUPh2HX8%kVp6PCHx5E*n znLx3LRH(;cl%4Jz2m%$MbN#a~8t598i8&(}^AV{8LM|riPy!~^LnJS<>)mNt9JFRz zOsEAqqRYbQnx4&(k|J3dCiAc}WRnu37C_zrN}GIdcpyGDATsL<|<| zrl$6Dh6gMNY)EkcO7cR!+a=XS89E#*;AycQNYjB`Sq4$9>uGz=jmJFlSK`vI61P;9 z;|n;Bx{B-B=Kc+tH>DT(Z_*YcM7^8TanM@fj9dU1WbR_XA%T?}a*1?G?fOjAGjWhu zSs%6M9Y2d%T^`&ik`G8naBrdD_~O?;A-?VIw?rbi$bi7yP{BuCza$xTy@{~RojtL0 z9gVFT#Q<`!!8$>XybSFPPg)hivmYGe-SlGz`^QL`SMd}02O}r=D1WoC<^FAfLI88_ zVR&5~*EI>%Gn5!ft?E77hP$py9VbWl%#;9YYwQn4Ah5B{ZogU8Wh*Jq5r9*2(`y4D z?L*Oe0OF9z`T|B6hNyL{Esf&f6|3=}ANi@c^ot<7oD2lSIkBQ+b)l?N6NFgrFEc-b zk|{+4$U$*K5AURa!-!n#1 zC0~j~+}Hf|)8a07yO2Cx7okx2)#@geu*5bYK5S#Rvk`=bRUGT2&u-T_^5uauw!46t zonZ)jesbh89wR<~9Y_jtEbj9hN+WxMs)grV7@VuH2KGGu+KbYYOO=l@dFS;AXXbV1 z6I(bd#e;3>#_B3_1T=0vK(p*Wv20#CAUzMPdkq(Sg68+T0gc zerYv+f7OXE^o$%s#nmYcdZ*lXK#Erxvk($3R(ETqbc z%qzqTvNE0iQpDf??Y{;~C*x`<1~x6%a!g}gQL`)NZ7$YZm|DeOzVUbBp7*{h^CVZ( zStnAv7X)*0b2#Fxc$<{i+u7}G1Ys0kqxU+n4$}^O45K3&-VW|LxwLjbxg(c|P{Dh8 zm+`as`c=t~(xxH-+6r68*$P>n%C8`D{g<7;$z&zZ-1G&2n3-Yn>WVYvEY5;@ky_4R z@z1-Vr38G-j6gQ(>|-iNa{hUHuqXP5rsKzd=x5_a&wN(`wn~U@WZE2bsFlc|x;*HS z^D)60ASH+>X?@#FM3NHPPEZQ=XT^{SH)BMsABgzv$3G{2=ApkDPyDq%<^z$OazI@+ znD=!_sE_!tol296yZNXmZfy}&lml1ipw*PJ^Cw{+(jKl~&pH=uFP}l~s#~*mQp-wUJ!qnNZy4ZmpoE=a9-RH&q@AaGUseb|a0PrR%?!y)4 zLxUOYGR#4BSf9vq(?vymNyITAyJ8^09VJ#2fzNGjZ>4dt|)! zrSF8+oSnK`Px_VTlwwlnp6Vo|GsPK&BHiIbuxXpj_DOH)auzBd`kQ&;u4_mxcB*&`N;Rl5prXvM#Y;R~vN6Epnx&PrBbV`B{#1Q`#~o8A=X>@|>V<)M}4CQHOs z4c7Hs(Ghmc)>Oc2=;L*c>NOG+`R~@)lcH1!hC~hk-C!QFzG2ISyLJEo z%A_V;;#ztp31NgCA$IKo$gHF@U>>?^5NGVYF)Qd@>`tx6j7!nS?Vth(6I!RX?Y_) z``ItV=RW(n_{fLM!5qkUyIYv>|reJ0D~hvD-O7Fs{|$y0^nsL z?0_nQz-WErmb#7*#!8Bm-}0>x5s**Or*omqBUv~&eGk?gOvRN;hhlH*Y&J2?z{jJ{ zH6}gRk;(OW0b5#Obm zn{N!N*SC_s!zl;~e^}A*G}SJ;KZ<%+SD2v3e$EJAK|G2@^VAceZN~@#AR~8eRQnm= zijN;b=xBl4MZM~&NWSn(wR!H2nzAsCn1glMs&?FH<`%4hfYeHyTqkkzavZKq*f-G8 zTBaNf5G?c*;R6%sWssCpZhM`XWM#C>K1FZ4iD?tD@oW ztA{g82NrB?bt%r>a~AvCuOfXn=uWZXzQ%gX8O$H{#Q%BayRZyDil;o|QL*~9h)4Y7 z6XV}L@})R)-%aAcHHX;~KcCbSGDrQHE7BAjAfoFzeI#*fYeiai9993OMcLs9LWeU6 z@oaD8G;{#ZbjDP72HAf<=6a{)$XQy`xd_1M=;dtPBLV2JVNw(xj?*>Ea7gUJs^zOd zm=B0qVJ&*FSWAq=3)5IlUuDf9&4!e93d?XJZXI=y878~~sK@|efMR4wLaePbVt1wy zFU#s7p;L+kBFp!yF5}h!S<~SLh{fPBBpoO1ZI;7Z$aaOd_NA_`ZGT+~G4`)RQgE@)9SbL78k*!l^bhYO78{JoQ&{Bb2&iULZtLR->6iiNnK$<4awX z3Eyw(BLz5#Su7fU%$^8>eXo)3cPdl&wNQ!*4^k^AW^R&NeR)$AgWp$HbK*q3;vHs*(G6xtmNZe~!qU zY^#Edfr9UK*)q>+q$ix-b?~k9ZpafUQ~++hYr#NC)YPlXBKSDzN^_Lqm zs3TSgQm1KJ)G=Atq++~hWhQ}NN@P6Q$|^(S=`!p@+Z5kz_q)Rpq!Qa^XI8+F9caVb zA@bMt2vs`h|8LjamK=p)Ao~A*y*e$+HiT%C%nMYtr@*$Z&{9KE8I@bbL0-lGwJzD@ z=^e2$#R$fx4n(n5BWA;>aYD*d`rwA?r$gl6U)=NFiK9E>q@Zz+;6NkC-+CidMhvlu zSt9lv^(KgADp;(chZ6Yl{RH2#FaI=US1Z<;bxBKm=lR(L5eXm(5c9O7`FMgcRzqZC zNED`ffudw0iyVG9?TuFMqZJM+Hg#YZHZt3EC44LjfL|nm3 z#v;!o3Hh-qOJ+Q4u#Q9OnEA+6kpuhm8aBAFl<6fve`qFQbfe%r(3f8~vX582K){XA^|t#4p6E%Pc=n zFDj6q?Q?}4kW-K($tq4-p#64K3sk;}pK#@boX( zYrd-W(q$FS`(J9a$Jp0htWWL!7vmI1TN-w?@g56Jj4i2J|@Gzgd=4LDXA0TaYMU<4WjOppc~tBimN;vO&p z4FV=e1CCWjzyxs*7=Z=>6QlvhDkETmxCe|tgMbOrfMb;rFhSe{Mxa5!1Zlvr$_SVs z?g1mvAYg(t;8U+DYA{+ONo6JzNjY{|FD^D?R&^#*6*env6)tuKb#-<*4O?p? zds8n}B?mr9Gg~{b%a1poP4-64n7j$Z0Wt+7&1|P@&J3+Ud-FOdYaz$M;sj-Zn6g){o8v! zkZ}HV9AT3i0T&#gJ?yL3I_gULar#73jL>8IjW+|Gaz6h&_x=r&4=~1rqPk}`CjAY? z9|@Q;gJLm{VA#b8&tT-k9B_&Nzy!d~DDBlifQd01Wngpy1L2V8D|Y@u#Wwgg91j}a z_CYwDBISTF=kIH>y}pvWFp>}SCPTidW6<>@_QT@5LV+85elG-b1ROI3sX+ci#1ilT za)M&T>Dm$74Kkg z&#N{)RN{}(#UIHT;R2ba$P_aj7r#59!f)5ORUL}iXiA%))t4WU6iVx+kgAAX#! zOE(+*%t?v{^ZjAPjbkb+ClnvGz7NwJE${x|Ly!$V>tO1)psj&ju|&|#WzXq9kVy)q zLcj=e;9eQBn95Z9?lNDBr%FEj3e?H10cTd{Ct}!|#P##_%(mm43s8jZ8tMBiY=^s3 z$V)~4BP}hLJU$e*K%E&aa`+9o!O zMx19dGljB0bjypUc1K47-YH0YFXpja?73&)D7=T6TP%P+j7V4IhifUj%!NqI8jnpT zdwfa~#GH+m*W%bIU@m)@uZsl$( zRZkkhA+P$r3r=VL;WtjWAy#x_e=Y#b9+ECgc=){xg~hq*wO0=={7EgLF{ab1L`qX0 zy2!0*rd%UQ?&V)L?N7QxoVf$yhuV4N1=ylL-sdU|`GX=YM;9GgXrs&Sv=ox>Pws(K zBY}Rxi78UZQY8Gi@ZTxgCJ~0Y;>yrJnjYFfCpQ`ry7JE!iS?p|K% z-j0br&Yq4>i*@C7@^Q7uJ9(eJ?~~cVtUb1pj%cL*CG&jzJX2X{DDr51#E;yd+sifK zFk*qi3`VmZhmNu~GH%0iGH%L{c(8J~2?EdrDt_ReA(LxPRJ;*RQZ{SUH%?I%*I{2A zVRFnYY?B9;wtk~qcKGxnA!b(Fan3BAn`%^=BGNJ@b#xl`ly8dYc;8(I2F4=~b|ai{ z!qRW_PdsCx;aQ~~1}T}p2M#eA0hM6DdfWN22_^Ws*+Rg<;>wKC@RKZq%B$#^Ctm5n zcul{t<5!n6MZu;|*Q5QrmEvbjpbK-7JZ6qm9LD+=GH4rWf#f1Rh^n+WZ=5fRw!rhO z)JpK8?0TI7c^ad5&B+DcmxK^*$~}^JZ7f;q^wWo#+=W4OGwZtxI-Gl+Fvb&Feql(> zxyZ`oId_nmp5xd&-Z1sEmYCfl;Sg!Oy@{|FxnY-ePW?Kjvnxb8t@YPTwU3z;1qf5< zIQ#xuD%_=x08&jp*nAztvk42DmU{t-2hI>+!{^!NWHCbg&b{2GCNby+={f2i6#bEF zLlx*ryH!KZl_b)y>p6lvr?u9TVkm!26e} zc*~vqmNSWKj_pXyP69m!P z!3z#(XK-1s>r#a|F1w8{r zWeWIp&>ib*idOtiR?IU67Pk<`)G(lWGr8kEZ8DeY^i7&(iQ=0`Y<^bqPnkp&PV0`)Oud}dt%LADW zOAVf+7vs=vKMT?1)ll;$+50j1jOr47WS1bSM$MG9P$Kq9_pUbOk{Wz{CaRCH;VlMY zsIEM{aF9u(;O?!ib0o8{lHdH)E&yD9>GfMP$=S)4O~ZMn=Uy@wKyjQhvZe>>nD`kIW;OY#G<)6$SVlku(gjarJx~r?Y--g2Dy4_`l zvg1f1m}GRbMmQ48c$I9uNj&G$r}0(Z%QOiZ3x2$E#Cb&Ub4`&&7TCjc5CR8Oiae|I z5_^F4H7?ezlTc>OGf;G{EOuZl+)wKKmnfIWR;aJ zfsM}f$s1G0DGs*_Cdy(OZ4Sne*bBuJ6w-nxCQV>R996M?5W%^XP0*N{rao^i5O%(b zc$EJuQ7z_adTFDjf9#v|a6m2vy3~$jxS@oq=Yecd?q7GFpY1(9L7Zl}d_PElya;e; zwlx}*?azXBboI}I3h#ga3<0Mz*X{XznM9$z-CR#gDP}yFh64{X`F4N49yTWx*^pc6 zc(0`WgO@5lX~v4M%dWo6;Z?a^`z1hn*hx8?rpwnEmzYbxF50nqiX52d>N{67LUXop zxi6OrbzBvBSs7%1RjMZ3`LA9UZ^Rq7!dja~v(2q9isI(Hm8Ngn=mYYdW*Dxr){0AB z>P(v{Q5tfy@kG*oGM)0v97x~f+)p_^4@I~fWj?;@gJP_ z3d)hJy*TCC`4ab?s6nUm}N{FhujIu+oW}>aIfg+$6`0^dD(GM)UHnAgeYEnU`6B{N3}bvVm>_X7N#6pbk?$aj z74alWvooAk)7&d94oZQa8s*=LYMZZy$NYO|WMOR|nv5a|j?K8=%jE4s)gLe#5f|DT zlZy#iNb1A7lOXAMN6ZnNhJU2+ew4Hy=hemkt%R5_}|u&M_c}Eo?qqV0_k& zR%B#h{AJGztJlTt7~Kj-Nq7Sf=Wo>|Y|SQ9)OI+EA;1aN+hQNV29^vmAXAjMETS+1 z;uox9{)MS|EJ6KhcqyUp#SjM*HpT~2&n;lgh~n>YN~eX&FcN@|u(Qf!A@{!H1FixH zO{f${sp)(Ohm3|gL6eG6`02a>j{A*c7x{wyfscwiPjo`9X)@TP?A~&REjBmv`lZ z6!nuw-ca05y!hZMK;Nu^-L`Tn+Ej$2i-yAazPlhh#@Q0{yZK}Q$6FakN6kch0hD%|qdaa8}&D(ZQYi;}pCQ{2j}qF5Ej7KZE9-eOVHY8Y%#FRgl-7nF1x9b1QQS z`M|6Y8pi=BrqMpdq+z;feb3h|6?~+WFfVKadQ^O!`0|Ky|L_bmff76mJszgf)3jpA zQ7Eg4DjQ9%+01XwjOlUGzu@tY{8B$<_xnF9c~uwloiL&{R(}DA?LXwOS>Z{=c~!h8 zm*22jgvW3ON*8;bSQmlSf&zk0l4%dF>;#CB+Soc>sEtS&YJ9*0DpYOt72#U*%88$k zvLEP%tk!DaS{1cBso{?{&iGHB({9;SD5+ZtZ#r;pInQm@##E7hln2uFXYDm8t;nWE zMOiu#W=ke|7|d{hDNB-MnwVt6DE7ivUgjSM7?qAfKsgP?E_Diez=}c%yE0!m)Q<WxmG^1q~tD4t7QO-v8W<7pxH3zmBtsqX6S%bsPb7hU)T2B{!haF&Mrfx<4SHE~& zZ~D%2-yzFe{C)M5kc!K9`nf5YIWib~SuX>kbzG-DOC9Z*z^G<^1ZPIAw-Cz8j1B7QLx4p zpF8@yCq+A@G&e9?H4`D{hLPVOSf7~B$4zzqjI|_YXu5;sN*^U3`gJ%!8x@0O`sL!% zQJ_-;UyRU+Ze;}dMOz%E#^UEB!nmEju zwNO+%B8zNWi}BA@`9`F^C|0{1V8O!|c67+{VPjof^5;GA+we^PRe2b=TQ}-$lzmfC zdAaDlL{akIgl9m#1X(%X<=%r6MMe%w=qDsv901elwlT1`r8-eI({gkRik5{q zsJVhy#p}8N-BXGy<_09zg&S7fh>Hndr~CJZpyT^@n>);qkP(P z)#<+;E(O5Cnb#dFxeJfthGugMx=}h$#1VQiV6Y={aqTesPqWT?PPOzmiS+c}<$b!k zdO-X7439OGI@NLv#psqr0}^WDboJ2@8kKU1gYhb4gjA-{s%ZVJImz%3&Ph7-o=>#~i=%WOHKu0$65u@$vSAY2#6^cZ7X0YXE3$B+i!jJ}4$RxsHGL<1|y};OVB-#j>*-Kxjmx; zxZ4N26_14uhvUx`bTs``mMwMm?QQK=?AFd*u0N@o9FObs5vFFATu-$l$|w)kA^Tzn z&8P=t$axs-QHU1@G?y#JfrY%LSXUeEO2VEy7^$1Z>ixpyW!iyIwt>Ps;dur)V^1)Z zk8{&(zfT&bUhLYFrAyb+)0Qo@nRTlusabU#zHeHh6zB(oEo+PRJTv{VXC^8Y;Zbu1 z>;iml4@@CjVS>H(UVzhP*!w+u&v?2xsJZWL@C)_WbB+mvXgMeKLaXDYrZYq})jO(X zo}W__)9E7Qxhu<7dMLGSTk*nfH}Fbjr8z)+U7%hM5BIlwU%s((TP(AH+}8URYg%0M zKKzfzwl)U?13h4FACJ9a*s8%xt8CEErM1_eGzU?kQVA$?*+pZIoGjkCVYh3IJd^mK z{Oyx<0V)TiXE_*LrK${7r|qX4WP+qjYxs!g z^R!jLa#e;8|7!X~f3g1{th*ZWt3@egp5>#e!mozrTwS<+F7Ug&nNSsI6Bso~$Nm%$ zgR`__EWrBA-^6+WxpRZ^e^YaT^1}+^rx;ITDZ+O!*$&ZBw!&FYr32q)uRlAqiPy(m z1cO!5c_*q9E@eF^1O{P&^8Wt@z>h@LJl4#rN*`M@$5d#0fVe3(N*`Co`wU_BTrJ(n z+9R4tT&G7``0Ef*W>DlH|6asro-IZ9`X;z=@M%2|cer3&xdi6BAhTyA-7qKjd&O}A4nR{<(%!cl})xK$W_T#Cd@OSH$&&DGh} zYAO?pGOtunr=XVL`&q@7Jkbk4Ci+8Q8tD4OgKIE?c{Zh>VRsa8{NeuvlWI(XIynAp zUOj_;QVS6XW3Uh?noEGavx~b zUcChRHmE{YlQJBw!jG?fr<1q`+jLnUJGMJI2I=V4-c8CpC8qOtni7&P zbf>!#8lY-jKlV-?l0q?a$_S9yaV^715`?(5nQWJq(tCW`;(}0ccWwwCcyPNi(fU)H zUiTmhnBb8IJ)sqnxz?Zvg(U4!dsH^U87_t(8j_-@-|sc0c^DcuWs;R+3jO6Mk}-IH z`$9q^gXM&CtDhSVqJ7{>WK1hE0eB{~sPo$gkh2}45EOpTH%^%cqK8JnVld8EBWKhn z`F#r}b8fQ;_KA#tw104=zWt z+sWzt@rQhenu&u#Wt(okn~+CkAS~Gt`B(3AwPER6~=!Ragz!4D9Ck?~FY4 zF^Yas{SGg*Sy97(`2o-(thQ#{MWnvlW`nb-aa&}BgAINpQ$qcCa=R2 zKB4fBJjf>fg z5IWH`SblHQ2DL`?ffH)>e0oIP83gBEf7VG*qj-t_WUO2PJ?89g$Cc2Y^o_js>D)?W z|C`M%0-Zd6%C~_8q+iev1Uh%))p!e|-!0KzoNk;7*uaVP$SgH_H@;32#$S_9SOKZe zJ3Y#u;YQ^k0ePz=(9I@T0`v0>@u^G#NfrAa9z6sMjEO~h(Nc-+EjFnzt`e2u*~7(~ z<%4%5MilOme4pH(m8EH*$@c-z?`Toi8>2LDv--@R{_TBDJ*#(Lhk!yq?jdkK0$e^I z%fXRV1PzCh6VdSp6!T-<9wzgw7l6Sc13YcmxfFt3#0a*G7`OV?0w~uuEF1!4Oi1}% zbHW6lLrEm8LcJMe!7PU18x3#_enET(<@xN|VKRV69;O4xQAy#2fyA?S`g*#0j>3r# zkievu9MRpaJt$Zvvp9~CZbneuoJaRvpQXX)4sV9s+rIxXrH<$a;vCNFsuUsxr|8tn zj0s1>LoP?y>Wl|L{_hzNP~8J$cQ9shNZ^5n#MGU!w4VgO2QQFlP2-8`Wy=fj88+Av z_W0bkSo{#pn0vQW3rap1Dqf5(ezP=LekJUtTJsO{8Tyv{@mFaA!x3AUa9R?F2%aJY zz%Q~3`9@_7y9?JYL?p$}8nLgCiySXI+ZO2)x9jkcWV4Co-(zpq{B*Peoj321rEa2E+ zx5lrD3{l}znVYP{l&OD1PHMeXul-C+k%%xRj5gQwqYpYGl) zrNL}(PAci#ZAb5EIF$#UaNg|nX%u~XppNSx6?GF-k_AHqBwJJT0?u}XFz zO0GVS!QS6^^Q_06kr+%>XIFtfKi>X2(=8hwOUOzGYJmxTDh_ny5Hk@Q zN!o{q(#)p_b;v49&paa;OYQ+9g(xsyI)9+4VT2JWPyrGG@t7MEw8qA=IR?l=R9eZ2 zjICJ~&dK6B>vzx^tEb&q)d8#(d{pVEWWQb_=^)K;BBc(mk)mrF=M0NdrL&h5kK5f^D zTuBEq1N#>~C2~(i8>2s&b5C=Vz;e+he5$=wr72pkp%M7c?V5#gFiP6mdrcfv@i1^$ zO#PPBC;yJc!RnOj5C-xl5n&|bO4L!x3l1(t(YU4tTATLV&_9sG= zgB3`EN@+xuiar1<7L6!Nl}U@A`Hu-|m?Kkqq`~YYMm-jvO!y2F{E}w<9DddF!O^a9o`_%BCI0)~MHR<_ z>yv|3G?9;%gA)--;~Pd;5O#ChI&j^o*Txwdz2H$+HQ$dmP7p9o{N=a^p_4SU7EEab zP_Ct?qcJmMn)fWb*KkU#TD}A?8T!ca(TqU1tx(KtA-$dQXQcg<`)t=7`aNU6m8*xWOUm=cn6vkL#ps)J z7@4v1^c46ijpack_Q9_A*S}Oyr0+l5{ z3bT|^Dl!iAYWn4VMCn?RJ5){8xGA7`Bo1KKi6L^PGQ)kO`^RCc^YP=~eH~{1AYSd6 zd~}lGaCY*+ghZaC;sanvjBOxMB1|=EOfq$VZjDSBM9I-NAyjyO<_uF~xHT!+B3FAr zkmh4bFrIMTlb{4F)QaNCZ)ymPA~+b6A45upbXW(9B;?{8+1Q++oEreCVJE6UxEN-L ziO8Xd?hNV6wjWN^B5{YXK`JGxoWV*&xM^}X1e|r*v%ryv@4#sjVPd@v`MH@nnN+lc zyt3eolIY9~WiY`&I-FlbL4+5{%0HB2?ag>ZhBbL+r6K}mO4b78xG?O<-Q8f9C=oHI zuT+bdk#oCtjlMhP@q#-X-qYt4=_Oqnj&GYwm4y0)d7=mJV2m!R)v=gXk{8FdKq8)1 z5y8e4W%wRhn3W%z%jmd*H=~H|SP~!I>UP>`ky_+uMd9=DKtJ{GNCA9tO6`I7m$LW* z$B^`C+Rq^&Ne%F0j}xZa8;w2TwB*%vwiPkHGd*k1Pc1~T{ZBG!-h>Y$Zs#@=te)%S z^P~ypa{Xkoz0%fMvbL^ni!hC zMD76mgsG!E+o!tUn~CRRMQ{q~9fL=8z_y}1A|~>$zYLHsCIYd@-rVQU1c}_j=|E@T zB&=Likx|B8WxVFYlZ&|=^(%Uffp)Of-hKe0;Y?#y*wXnp)nvSC_t7wwmpeLNX=bdT zg9npmu#fv_4<~Nm_Ol_=Y#xn^%+cR3%fX`>3=xJp#JLTTtOoLsL6Je!0=xh)r~r%T z7gSiVf2m3U9CoT8+Y=eVoN@b$FVW-ub%Dhqf;_(2+2$2JhN^adU~J6k(Xe}ld;Zo&0!=WnC6??GH||Mhu$OTICH4CFEEYWw_Y zXfMf^wST%o;`#UJ69F{xSxb1?;Xk#%`JvVy&N$gWVh!>Gg@T;_j^y$9qrJU7Ej6OM z^k#Iq@pN?c2_Wl3GX4$bI{2 zBAl{MUzZ@a>$k=I$vmioms^03leuqTee+?`;u{-wp*n5#xk!&kws;uCO=w$B*MZ$l zRK9<#WQbpL)y?(wBO}UeRU(ePzkq|BO$Xx@+I0Qe->{t%>n zW(wEj9vf?o>7ft9d?3dm^$S*1RfS`#w;)d+JCSCzQY7%tE|ffmNgXZ4qe_917erT} zR-Fegs)60YQEiRspfj@O#L2PnRQDd!mZYmnI1NI+?pk^Uz5Ou!kk0+AI@c|wrs|#t z`TMjt@vSiq``_GLyZr}7k7|=p)zdNGf+KwrF2?SaW~7HwrW*vU-@1gu=EGl zUr%LkSQiZ|94^#|JdMU^B1X|FXS~s!?)V%ju1pHnYPn6`JJb3*86juCqe`+L8Eidw zB407*egr`hQ>KL$pPvO8ce0i;FEfjNDH479*a$M>c%McXB!!FnN&sWlu5-c_C9R>; z7{>7nnR1WG!WKP>th!Y^u2>94lzjBxWg5$q^BNs*y&&6#p^CEy3rpnK%FtmdZcZM* zHkU*nM8SlYCyn_;#O6%m0)CkqEw`nTiGg*eSK6|maF?7u?ltX$j*?w2+dTM?r_Wy{ z66TZGRC7O7Ey^c`<sLS?~Xz!FzaJnwm-mC|w<#Suig3dSfGVL`N^(=lX9 zogjeZ#kViUzc8w6ZGl)sMljJ5iYyUIA=KP+7b!7(9V00+KxGQa;bGi2Pc(z^ElFX*~Y%W+K0LSV$D$tGt>RDgy*DvvDZzBVE6=s8@ zCm%FYfi_RTFq2rIGYa+a#Cmo#_40)VCTHT?RpYz%nV3v?#z;F`+&IO@hnSBEjkHmMjD!4?60aoiU?)QZfQtj z-4Z0iNn5bjyLtM141MExJ7_IS5l%!m5iS9~t9A_pbjuyS${E%%=4>i6K77iQEh-1# zXNmLU}%%CAc3YZbWr&PS&u`!%YJT3ycLYxRR zDk~FZjD^WInDUKFk=2jjNvTeH#@NEm#wsyMp2nmjMil^G^ZV(Uh>peQG)9zg7|bWm&|uL=a)-E z)X?u*ELLoH6W~+{+Yo#|wbIr##6&caB7yXog%DV6@w~c_zQWYT%t{1s_u0k2%0Zby zKBIZ%i|b&{Vdbo>vx@nd$JFKC9nnEtS*x|~in98-rs==ZVlh!zDPV>p} z1(HNvCJ&z{5&DQ3RmwD-E@216pb<_IwP2?dN$0&UC2*jKyv;-^lbtRbq;%4xhz!`= z>$PghA!G>Nf`RW*FEXH2d&6z~iqI~xNlZ0ef+wjz)?nKHVXZK}^A&^SMHyl$C5B&E zTLLWvr(A})u)oBnoVTjo=>X+`FRgg=eHoTRt&|LBEHgQy?DwX5j5fqF0iEQ;T1{US znpbud?m5z%PaX}9bx}S`E_jrvZP)?ZEA18$Zc_BvsXfcOV^ooAiax}?Q!|u2+&9n{ z7kw7_5JluJ-TrTO9V&yRmu3||1@T+XSp?4E z?G(UTIE`ivt-Jw2w&W(MRm7%{p^8C@-r=kupPQ*t*Y-@ryy!yX*krLRuEf?2tr~31 z=3O*z;Mr87OGk+XTWN0YNDL(alpAuZ&_)Q>+2~klUy@#wlucaIAhwyc4rH&EMO((z z#*CZj#t3%ofN~rmZzj*-zv6fGtD&^Aaln|Bu!Rzx^s`N53hTYz zY`R5VFt(A|A_to*!jDdCXwkKNdfL)B zXxtkmtvgw}rYRTenjG3Wol`>*$bIpdD{dCLD-%K1X&A`{ z%aW9}6R9Ad*x|f1u_=+?-LLj_CM~A8gZGX^^^+7jaMA363#eTXFXPcZd*!t#g<#nQhs9P!hB$Is z9h}aRR3on&0AzHzEtLQ6qFOQYwDdARa7N3_l1?9o&LAZ#%%ZpPPynE~9nCc{M{Jd-iyLyl{4eRJu6H)6*T`QJ(JM?Ny$xk>c;s)6J88YFg0j%AzQ8 zW?GPje{M>o_kY)<@;IFsq6PX7^x^q{^Ca{n*2)v~lDcYyRK1d>lx$E~1-co{b0i)* z;eDqX9nvyOp-l=@RdlUGpnoE)os`4R2FudvtXtfq7lZtU6SnPTJyq!^91kVxFWFU* zf@_;(pxVgP(UXM}>6{QXq6B&II*S$dZu~ewI$8niyevvyY|eVG*n{vmzzjcg|I_*p zM2a7cl7`3Za71SmCS1mtYh5Wprjq6Nw^n9SFV$6U;l|lcXT)9{p+;v9Ig5uvQppl| zuf(o7-&kZq%iPC!$a!)i1W{H!S|lcW?GCL03J4C<3W~u8dp;<a9=f>ifg+N*%qtxP+Q3ra1E)f z=QLC3MI|)}@Qsqy*eC%;s29Qz8ve;Vm$LEXYZZUDlf|P8Y;+^Hu+YXZhVo-;EqfDI z+stOj=4-B!?rET49ry+3Od5=|Hf#yOUViZu%VB5-fvhMSI2v@}i#iypE117=bB(G(0r}I+vc(9;CuUjKrXD~# z6;MzPg{U;#(o~?X4b>|4(!|%+o{3gQMp(LLOmVYtZin@vY!lIQP*Fa!E6q!lx+jUr zAf&Lhy6m^75!rtc*@~CRs-v#p5Yw)(ECr``-rSZkWCL}5%&XW*t$nY3&Ov>q$L~O? zZTTjSe)gtQ5=ts2JsDQ>?%$N8rP5pzB~=4g3N2d=uGO|BE7LYDs~H+?GEqwZXmJdIrqs*@VQjVO$bHA$RS#}FPer?ag&ayrY2IDNe#4Tw`X2%;LdT-mA|#mLsHQsczP>qaa-p`=z6$d8y}rr(5(n- z(gdMM)hj2T8kNtpF1wc28(*viAj4qBrtZ1xGekGgBzc+T)x1Yqg6MumI&P?-0LR75 zi7l_s!oHB!jk^;zs-7C#qgrNjl+2<1<82pBOy1DmMojD)zQ#^o>?&6;I@j@&hJ<`- zhV`7eB5>oh^CCN81g{zm46!PmQ)<8i*&!z~Ynwu-eg)=x z&*76+zE{o3KFF#%XeH`L2P@L7)%Srmw+=dRP1-{`N1Ltam*Tw+^d6~fo+>)qondvG zL;pHz&JI?tU4g232^=qNl|!egf}3xx>o5z|Fh;2cI(L$tBT-g+i|Y3pI&jampSJYW z?YUj5JcO-2cfr<)j!gTW4<*6uBdewazXtFbV37rL9CMZJVlRW)P(j07a4w6AnHlxq zmNRi3^2USE8OEDu=oqzpEQ5Wysec3_M2v*~lGg+%4TIli5CN z|GR-{W&W!UHT;k8%3d&|y!`KEa$8?L(sS!4WgR9iO)&E&;hW}RoTZAr9`_d+!WA@7Lv6fD%{J-Ia(#z{7RWzYW z_DW5&dY5V#e9?=Y!=0<8R}!W6O4^j38}dXlGaX{UzWiJxsuxSB-i1I0SsV#W(=Z@h zwxVOj_SjBoyi$rP*@pA91eU`B^n`7S7)CNzSCz4b%!a3 z&Z&!jMHylpt@Ox`MuZ5SLh#Glr`P5mY=VB#IsPpd|B+#3GNQY^-jpb zKj1P&`|qa?Eg&Y%fl`g}PipP{HBBN_SPtp;*nSZITc7{SDL<&rV)m2Su@7`&koRGr z@OiiO0P_BvfB!f6a59_saqyIFz%U#48JX|@E|D@-w_F!L`xzMbxsE>eZ~}U=gJS8> z>PPc{bHh4jGs!P5E3Z?OO-#v?*iGeov~pKH@P`$C@>Q-J%dF9t&0nkkIh=vo>rZKN z%(oQ)HWRyf01tksR@liUK~?kt;y82TI3LJjkG@ zpzq3Gsl(!oNdcCXKlwwj@`>5($JQ9%i+&mClN++(v5RiaZ=960xD08-FNGCbTUQT| zkw>d;rj-j)yH0^+nlQAw6($HLC@bWmeRDxAfRh!T2?;1(4VfCRL9Z;I0N6Wh?}{pGgMyj8$SCNm!`f9Q#sc%Wv~pACuBM6E%T zIIS~s{fB9X6?0~1Ifwe>_FYH2!Ek!)bimYPRbBR{YPP7fq=@`5Y(^+`PZm zofyV}-DVb#W>y``#bu@VNO*cPAycdMxuBd%xg=7xB+ga8?MH0oe6YN{>Y-2!NIR#rCDWwm-j%W_6 zh2%^NcAKC_luyC{>kI*lgpV-(2uZKlZXBoJ%60`#36jm=cEOM(CR?;BZRneM_JJ;r zQWatQk)z%6ic1<`>kw(3|u3W>YDwlMh75sf390_MNDjWah{w-gR3W z@m5P_uMrs(w^H3VJ|HE))%kxwse+kKz?k#VXSe>Daxs=_%}pOp#PZUM@evni!ZMa@ z^YK3ewruwBXkWPB*#FhPOClMC6DvnT-i*zb{XB4O8fQsf;mTu>0@xQgFRe;OSS-0C znC4jlH0>a%#Ffm9CDEx-R~d0RL1(-5ys9mEWAriVYS+m*ArUKDP%;`B<}GF$eAB09WMJ8nX=q4{h`)U38+A#6vu4Yo0giE7#)$UMRe0z?6%HRrUboeL#uqGym~}ye`a?wyAMh3 zn?j_tj%GHT{So#us#g|X?W$Hz<#|57g>`agTzkdUH%f|9%cpj|Vl!;UieeozSCOC1 za?-pMGxDLgALa6AV#g*x>O<9Jb7QgU7D2goc}&SeGVN^S`zpiLKazcRxEq}`W`Wz8 zG{Tx!mP=phi8$W7sVxpw5-pBTzf1pB;{l=hORU?}Wx<$=EJe*TszXnQzVIYm@`|o} zAw=rme(1vR!`!*(+CFGQ=Pqd}vWy7|MFr}-Q>?T58qZUbBj`%MFi!V25FUh_3V9d5 zx!YusV+?sLi1ldy7&k*1K{QOAf9x0;U;GNR&QBBP-vG4p`wGGcF%7p(mF|15pHfd` z^oJ-m3u5vjMEonmE|G11`2zt$DH0VUFRYxnsYuU^gxb9i^1=;a0h>Lvc=DV%q3Ta4 zc6`x2+G64ox_}*)j_&H)loXXK>J#n2IvNwX<=s?;4gyf0)-)$ttZY*>rsfvt+{sjH zmJ!q4b`=P~Qe{oBm8s8$(f$h6)TUNf0vg}TqaF(Z+jtz)EiS`ZC10Xcj-^ds_Fp-T zf#UpC{OeP!0UmW%8|PH__ggj?9YqvMumc;tn1Hd} zgOtKliXf-4WWeI&-yhkL9Lm&%-|jK+fn~6nF{Kb-OH^7whgiZua=*uZPT{OiNRfmFg!L@Ip>_V2Io(e zn3442?lXgxG6up$(Dp2oX^VruTCGI3A+3RfAZ&)oSN7m?NLl+v+pp)AteVcY6DrY! z!hB+6n+u>y)rksS^HW#v0va0B_gFWraiF+o5W8zbI&A}lBAru_ zp+m-i7x`G+Q0*7^JgW#(DhL*bJ^?3{AY9X&Ah&+r>E~Li5<%oyc6UaL1^GyrH4wKY`Ubu(ok8)Tw% zgC82IimZMY5~s6QT6x7gxQ}1P~o2~6Epp{ zKa|b2-Smmf?!JO}Y@~K}i5B5a`F~?92h!hChzXwW+*}IX123b?rpHI7r(?_0D#E2e z6lo`DRQn%f$Z&|7{yz15mndOBmm9nI)(F~(GtvLPr|19qg6=$|(W1IJv$$8sIkyt~ z7YY4wyoYXj0(m^or$U8)#c>Vu7IO{n!Pb+-!5x8eNp?@=)NOF%UK33)W=Ir-^Rq|0 zlnqu6Kre1196#9s8sBIgZ^^`%l zm;#Ow-?SJgR*b=x>Ijr3Wx1y7yHX!1Cuix@2+LVBwQTBMX%a*ne%Nv2i!zS{D;6d8Q!N!KnLnhyh> z?EE<(yC;=*L8USH$F2_zx6+Dlmte|1*jLQ||DRix4KAWY1XBNpKQTlDw#ZH)g~KpF zDBPGvy>1AUnc_R)C@GkH)omvB9_Yt;VKS23O8v|Igroei%$$^PUV)fg_J07uKt8`7 zGw@8GcfC5j5Ou|l!D8e;_nhO2u>&a}X{JdzZ0Z^2>4BS!rGgAViM+TfN)fsZCTG3foJ z2YOe%4c618%;rZISYL6iGh{{D8RtYue>qPDdEzT7hGdF;(c_*J5mPd)>gYB0bR(yA zlw7P-qU72Nk{F7RRxXU{T6bR^vbVi_Gk=2B@wvCSt~8W;lK%q8p*}e%+XGhGe}}`o z{I@gM-R0&jAK%=d7u!_sg`d7QM*-3`gm9G+`3UreJ;w}; zZr#n^%QY|pA6?zGY>bEUiM3otmAjobau^JZdHX~eSF!`XFna){6M(db+!~jjgoeuK zFzWX|e0YWC;GzLB*Ep#e{N$ie)hwrfk0B@?UGY6aUvgjRmgG9=wA8 z4_*v+iu`|P*zx~IDGm1DZEx4x&YMHe^h}$JXr?IQ+9{RIaLm%!MWh{uL*m0wFi55@ z^wA6qYyUlGMg&_c+G>3=?@P{>x0+ITqs_PpLsT~-E9(#CNBucu98neGqnWIrSaNq` zX=-XtdAFP4uI$T2Z0s6V?+9ZG*_!tfd09cqSG@0Nf6dIaoSAI3;d-O_zt{C|<&Co2 zXkPz2gBQE|#r40p_o7?>k5Qfg*9AraWtnM0-!S3W`sqkIW;#y8H#){J07fEoih8sG zf+NfiO<D4sU_r3Mp$*sZ>;a zd3s``{~Cb_45b%8o~K@-vi-{$0oe>D+M~ZW3SQ?IO z!aAC2hL;^+jT5#UliLzJ4yR2ZIGm2a(A(LmK_pJX5X2I|!AOQy3V0KCtm?jjx4$w(jTbi?f#LQ`$4MunZYrF*5pNpr!nvSf z&epME1wAVuVyM+s8^(l#^W>gwmyRBJN!%;O-DwzDwYZM6Pnb;jrIHBR0GS%Dvm^{v zPB7(3r@lYP@};Gd{0gEui7pU#>}+a4ECLy(;`%e>UwhZd7`Y*ixE$L)O(GXEHzJWs z3E?Bqlee>ENee-QP{2&;2FQS@rU-!(FeibajgU;`*#hgWXzoU+W8)CHGs3tlLziot zGN+vQA6_eT^9S@X2~@4Y;UtV2}TYPtFtR5<3_CE|Jm6%%@N^*W=Qsx%6Jh zDkIPnf`dCpoMJ!MKl^m%jABADU&^F&PHg{@p%ykvKfwzWA;v^&W8{ST=b89r_2?YI z09*B*fd4kjLvV0}zV)1)LV_D?8lm1!Ju$ZN{QMeTC z{w$Wc4Estk@L{Y3$kgLIpd>aP#x6KGIdOE7i!+KBI7Cx)#C)hCdCX?*&@uEI1cmdT z4i2p>1~M34ZvVatViSnSzf!zv070>4O)nLb&SZ%USj^(1yg1=#d&zImJTY;Dl5pQEaPMVTXo9u?)TfUOOi?652?HxW+{kUIl`U0? z>@BWlqvF=l5mdMtVXL@dX+TvwRv7{;a85m1MYMWcA3wKSVpP9?S ztWUC#Q|%R zNh6qb(4l;&qwTFQ_0=%TH{P@btwu&4|LHAQUm+%zp4^OOUQkZ-cpXPzE_P-gGNi&J zSsEfKD0M95s%VM=&v^oVWeB`Sx17Rv3ikWH{qv20&)%zCBv~F~KVh8A4LaV+y-B~+ zO{hswRBo|8pp(9yi9JbkExkW2Ank{E+*iVAKlhP=B&li@3^MJ@dR4=!29tT=zEHFgc1mF=Ca?qSCHQ!Z8NbP1N}X~pNx6L2J^I3p*?b72su46|mU z)nT)c%d`9Tk|;nFyw6YQd(W{+$VkX`BYJQFCsWCr%cGnl!W=+7kU6N3PBRXc+RM^m z)88M^srpV%_t7n!#~~W2Us(n9TMVk}hZsfNL$@5!2!^hbIDZf%B?kP5Z=e0`?ZxHk z!JDJ!jsYsrLD2$J5=pUn0Vx(67E?GJMGH%1Xs8Y*l+089uEc@~p3Y&MLHe1Jxq+rP zCGF#$=d)&y)GyOL@_1sD^R43d*`6+j^(>Wyv(yZN;bi+}Ny%4iKa?XUqujFuIRau` zbNOQ|d)Ld3v2wdk8$h`Y$;b!!?`&5;xR5YWE#&H}j#UD&A z5(dU-LMT!|RRqVADl2TJGG#{1s%PVnjE&9s74efasZ<}v*qaAWG)@X7DecPNIGWlj zx4AYjmsVdWElO|DWUn$J${dE7X(W*Kwq#B%!+N9(nU;SrGt}+L)s;)oFDWlTg3IXD zcqSS(iX~gJkW2+9G0~BL`?0GYtEVY%I+H5aaBsM)Uc{7e;*)R$E)UPtBaM=VXVhYS zf#dO+dF-19db0K7xX=IqhMygu8Fna(5LXm7_UFZ=pdVXwZk`Yr`~*W7`DGmJcNcPf zo(q{H*Sx{%k_utaH-;KZRW54?IWD()Lyn681SgD*_LIeF)@wz&!Xgu0#76N{vFWGg zr;$0*2LZW>ZXgW~&W^=1@%|L?8$z!$hAAE%pB?5OoE^W)9%M?T+Q*X+jlk1$@$?{C z3cw7V;3&DRf1kuAgIg%oQC3@ZqV?6f_bb#-6HfbzlK8NsiYoQf(agwCbpfBkiL@}A zJ)G$&mWC{KeYLzTJirwBJX}g=g9S{JieLubt1mq9#e3(8J}Hy=DvVYY=m20PIm@I{ zNZC#We5ov2sgGEM<5+CMV-%7b<$HRKmaEClPcLvt)yR-cbprp?RHTI!87fR=-8VWN zPKuad_qlH6jJ)8z`qm4{^hyGMFTn_e41RhP1)Lm;)*S>gb)Su^bU=6jG{v@YC2tLn zu0$K_V5>kVF10fp3~hW*$Tb%G07XphVX@GA^eL#f8OB-wOlbJtTWd_O@qt1l^#l>m z+$rSf1}@bhBaCr>G3>_)o23GV5co{CJc<$~O|2;bN^7i1}(r@Q*nG@>? z4V1N*q9Bn5w;+iE82L-}y)^$~29T8YVHhsK42AI|3Bk<_MPQzUTqeAGpDDLjEV$A_ z#Cs_pCJgEIm#{>^fC~gdNT*0{~S3yrMwbA8oM2v5*PS1&7lteBK2< z#aaYYzh!bEJF=gp65-PiFphud6^>+kpPuG(#!QQO6I}3nWj+#g8;g0byEP@fsd$wA zS(VyFElK%LRR#=rfX4O^=KVc?v_RGgsw- zaKY8p9C3JMt-qKAS3-=tlBd9F*Tiz;3WTys+3)YE=~UUOYqs#dzFGZyE*HtS!wel1 zLv1DNx52TDkOF`~b62KM`3vzj)hn7>&L3X4o{O9*ssG)#!~SSgMYl@O?LYIrdw$RT&lE15V9~CCiQZtZW{}O+f_5h` z>kYT|f;gVYgAh*4*+&p454KEKSB8i5>_HhhekWs3gOE~)kUJO%&^Vcv417ZBQU1O` za3MecA2L2s_~-*7U|cf(P7*0S#R&&9L=k||QeAf~1uJuskm?pnR?;yxmLBqyfu~9` zd_t8Mc0m%bUdl~nYv<~Vw7Gx$Q#Hr(SbWrkrQ~cFGP26kFK0-KDG3s}!u!{ZL=obd zmz-)zqwIxvtSU&-OGW9FPy9~CSITZv=vPYlM)JHW%Z495xPX(t!+DrGcI#%1@apB| zR`3x-I0{h2!EWa94M3$}oo6AGglLpYEL)hIeDzvpv}*0EYx?tx-{OTb7e93W<$C}8 z%YQw8=Bl5Qe|~tmH5`0;{$IIo>X>j9L*etdq5Tazqy`Aaae*b4de;I(Mg3-+o1oSW z@BjYichCOuzyJBqzdV2TpWb)Hiw)Y3XCB{s9=$qsrWsE4SNGiSszwR{AjK70+D`0+ zDOa8?GSqR2GAf!6WwNHhMMrexAFf~{N{6Up9}2_`=CfJ=70kIFiRN}R{>GAVnC(WH zZ@M{3k|{-U78%Pd51EyK_X#*w{(qU}jsTn*K_FvjE@O7&X<6A~VjDW(g5aQJ=U8QM zkU6aM&ZMkQW}&3!HWkN|A7W!x%Lb}w_Nw|SGjHj!1V9NIrp z9n2-Tx^vo6L+L#sdVav+@vHOAhUz$yE-`W-5?0ZBYmB7Lk`vwhQs20ej8TZVL4`?4 zIa6Emtul=rBPt((^k<@EjP!j9J`Sky%({Nb4q{v)4wb>+`XvJgXUBru#so(^8$`uY zUheMhtTA%7Dj_{8(_te8ylj7k*DqO`Fjh+c%1c-sgua#8Pc1jITqLHgCurk3CjG^* zC+nJwrbqfHP`Rw>S9VmaIx@`12f5l;LcbP0&Z>@~e~qHxQd%6ReypA0vP|8oS{{Dt z$dxuhV8UnHu1`_GtZD`o)uStgNJD7Qy~h7!@!+R#FOM!fe#^gUlmBgZyAc1gJs9kF z@js7IzPq2|fZtH)6O|<77o`=a@|Ban89+%J`Ftf}&rEG8xq5oIbZG0W7>2IV~_&Ucb4`#c1$we{7-!b_Iv zP6)k$Gys8&Ltuytxhjp>P7~negY8#}Zr=evp`nq~hTAW^fj97mqZQxvjhFrBrqHfD zWO*R|pUVfgg8%RC?GB3k|HWXhR23AI84BkfoAt8{JZ0g;&cIVy!MMAeXu!IrBJV1J4#sgIXr)4qv_AO= z{zwQ%!0L7-6qUd?aL3EqrweT6JlMR*rXPf1YKIrwQxBk_)v*@{L^iKM~7`?M6>0#>v(Xj=5ig^0>4dnhT{S{)yKYIo} zYyFS03_H4iHn1}P+jdd^-y3}O_dor6uK%ADjeOB;fF=6eM}@!3F68qhIN3Q#jgC?l zchj7rZBmKbP@4CpkB@ zYOKqKj;yhL)mS;rRHd&~zFHY)Lme7HYqkIYrMQ*#v3+T~Sd~URO?p+VRWZmVNI6%t z(p1TF{~7YHSu*eI5JsE!o=GJRc$azryq_RLXOPc8udhzNC0FY`mq@S~+}_(~$$V9J z4vI9iai0tcfh=an+Eg~#eX1}nCiTkdR^h~6CDUL_3Ct2C4154CvJ=2Xlh$jV8(vQiOt zUP~J}$}1*xvIwJ?>S>KtRBE>t`3hcH&Wu*wh~Gf9R%*y5%59|871Y_%o1rzWHc}^~ z(^AA}&$Z%of9NCbTW*qu6G`To`>;d;X|kGpleP0a+^(uv@;F`;5*68~rzwk6Iu5(o z$%gDMRYIUi@yd7mbK7yWc?c?UE8Xv4)D8Q?wTPlc^{AU9Lxq8pj><9xP~inoN2^*F zs(h!$TkMoxL;`8TZt@#935Pc9aIJrPWh0_XrI9K3^Db>mpUmpPE+o6OOCe{=Dj%Ty z$N9W2#g0%IO%eF^8ZEcLw>tO4=!g8!$P_b0z;31-c-nq$c$eYv%^L%R7eC2Z5)(1nvO%h@R=`#E|KXr` z|HJO~SAYNaS7QJB@Ii0*IfB)Z6N2(w*L6O8ka0}U48cAJ-)jG!?((OvyyzetbuqyM zodK*^|NF!3()u3`cDnWd8P5N5(T29YPp|>|tUy=9(bPKZQwIm9HjGs_2v+#JW$_X& ziNfV$93&V!Z8^eFEsV=$oaGBVj;0hbrhgroA4vXTDsf`VNM*P<%2l7_bjtDv&ZAC% z>WUjg>~jtNy&tty%wx^W6%=w;hcoW&*h+hy+-AtO9 zw2UQrcBjH!3%6Z@N`r}Jn<0vtVacdfTMe_juPrU2j%{IS14#4+$3KO{zs{>aqMkB~ zNU(L9ob4j~m^7)`o@Legw^-J6`PIO>EB%!Y8mn6^ zanZ6>AkSnA7NCOFu5BaDW~G%_Ta;F`^#*ss)CRn!>8ob#7y6So?tX^NN|__%3i)^D z4XZXRYk8(qqSM%{G{sxnT=C;3yL#THUi>gMt{0tTs{g!qHKi*LRALgCvyTU}0j#qB z?Uwxic3*pI zHBrdD^k-mb4;25OiziyO{`X((7UTc7hhO{p|4PdJtpCOk0L2ZY>-$Cwz>Qh_7{Xw4 z_)vOvZ)FHkaT~>`G8iafC)%8Vec5avi`{7xdt)Me)(!2E-Fd)JrIvi+f%bpP`@V(zKiDho|6hOn?^janRh+I> zo$T<7jr&nad0%PNa_-6|KkkR>+^aGPa0%Y$o`la>H2+YBx6gC_zrD9#%>TIaVy`>@ zf3*F7Esx)#QP^S{l9JZv8sCcD@WTh?B>WMC zF5FxThp;&NYV5EwpIeG^#4vSC6hYEmdH1SB2&qDBL32FgEEA>xi(mSG`K^ zpTz?-R;~&G(5gTsje#_+v*mHGYp4TrtEFZq{_18tbLDH^MY)nLEl=`wJ6UM3Y??WH+co29q*}81FPG+ zM_zJ|R*q_1Yi%Eum#sA!DOL@B-Z!$+hjWc#dARIMX^uzRJ+D%vTh(W44!`#O|0^j4xgMt3helwr?G3$w6CmbO9IFdXpPrCwJOUxUR(D?`K0^uH z0^>y8UmTJt^PW00V)STvVY0dpN(u>rRvhdLSmrf_H=epvIbn$E8#>F^E9;w;1LCv3 z_P-H?NW3_jI@ieIfCfje;K5NBzgT!7{fhaOa zCRf=Ao zoTt7r3h-Rt!8?ahB4OyOO977ZS9|L3D4Jw^B!5MQD>AfzPwj4&MV_jq$oIFp6i;g(effqYvMRotXJu>Ra^Sct`#lb>>H#M)3CUDYVD2_kF>+#d)U6|8h%Y$gXp)2%h}%Ty6baIKqKOu8 z3Vj?+<&*_zoJ_YsgycG89EKtI9il0s(rwTzbBd=ku3uciDT?@&z{1g>1gWT(2jbn| z1bI4+PUuHC?>%O?9Bf^_Wr!PZChIyhtJ>o z6nNy^Yr7|;Bu{B{Z_a((ByICHgO}~J>#m+YE<{2Wk13KRDBC(|-p~G9*cb?q;Gn@n zQn70_771)@OnYx^>_Pi73S;l;f(HL4L$r6aH#j)ZKBk0idsT5T6$i%Ki!8+v9g~z5 zNdrQMs1M)5U`)KZ7v_1kQ_&IrTwT*FPL0r5`~?c4DVfIUTzyH2${=|$#@ru#&=H@v zw$Q6!JSHhSDzPR+G$kr?i_a+WUG&<$bkWN=qBFUNw+w`~^7cKmR8{-=cV0nOD;tE*-RclyL)|V7Gq!`19^6l66{kIdK40{(TjX# zFiJX(Q;%HmQ}+cI&*Tzeo%Lxaf4pFG4&gipN8e65?65o`Q*5+o zqyrb>8PHyTukQ@{&fY=CnC(#blORbTgD>o9u zluE!SxA|Ihv?c4W5DdqR9M5yv4(Ge&)^$2{QN&=jbxvmO@3dz~$GE)v84 zi%EMJ(SU7BBm{@20G-bnqu5L|Y1M)$9&DwvkfdTR7{i3$f|rUNp*SnIpyCpXcm+Q+ z)~k;rIEwI3?9U4kaxR-DJ?f>9;{`rKpTz`U%+hculkn;vTzc*0y3yhD{_}kS8c6$A zfz@nPahfeoC}C0IBoGu3DBu(RVx1%Ed3K@2bRdb=*kjo04PAPsR>-Y~c9H0!*N3hR1q*bxXWU~N= zuSkfQgdInWM;sh>7Lpld;vOgWUGIrM9qFjk>lohl7SWwGdCv1ds|0!>3?;BR+Ts7I z0RaZJ7^3yUZN~@~$wjqAMuD&QUP4mAa~%=LvB%)N8AJAcN;27TNMCo(julVg6Ucr; zR@M!ppB)K)K9C*DVl%Ng_949&{k|4SNVD&HdTJy(^z zQ5=%D5S@*9EMpLewh*}uDC@w>5C>Df98O{%akw3oHbG4%`>3TJ=$M%Zq@_F8xUuHB zj$b?fnVgv0y+hIW80pVf$UY_GWq&`WBe+nBCNCvDwgwaVUw?Gzyvl|M=Y=YQn zs+41((@95|o7=!zQPNoMK%{n7Im+xhNre!5DG1w!+a8xPg|L^*m~ht@Cjy|SL$r5z z^e*V|gCU_t*+H@FVDH;^L8oJhB0Q$TgJ{t2_nD}d&Z1-MyZ3Q)8poL$EO_~ml2n%K z2x2x=HowZgx1(80cH|%l@vpq#!+hPZODu&U?K3MkB2tURHea!vP)SUK==d53A=?~mv2HQR@neMb zcb#&&7`_Zn<1h@O%a8C`&6~Kqvy#mG`VnXqRuaNneQ8)prFpS9=+jQ8kOhPdE#oRt zkZEZa*!YeJYf2{9CY*;RvF~=al=0nk?l5?{nhqozk$+({qw`UGJLDo?XG=@Hfqvbl zlkKNy+ws`{i8qPSgoI(d{ac62EM*im$!KvzQ*upGN*takP(u<&mn0nFG$kp1zSkRJ z8h8$#WfRA!GW5wcRO9IxIFoTu7tVCu{I}!G5}Kt1PhSY}5oA+1owF@&6oqE^Uf@X` zj3(hrkCll;ZilTr0=^}ci#}2^o`viqxlLlqj#v!4T>gj3d{C0Y%$8@hur7*xgHco7dlFrvYn%p* z<^XC5rnIWd(X}MSXF`t%XB2t5gaZ~uBRK!Z5l_kQ#~vJ8gqmUD^XD&&YIC(^KzuIY z;*iE%%*|ppNeJ^3qtFDgC6Ga?cP8t)=s1$+Rd$f2llUf*oI|$6(4=lh{=B&40R>h<*$%C+Cwio?T9oS@t%*JOg4t<%S`*NjgMyHbtZPjvCorw8PlM z&ZmFHqZj{wNWSd&ItMss!)iP)dngispEZI}8+$;cr+3Zby`JkWa=zBsVkP z$WH!APjv_SBo*-#PsxXClBR)A(4QzvXOV}F_TkT9dNv!6gIm;fa$wTQmm~L5Y9(bG zjEv0DA2S?+l&5sJZs!-mp+otMwZXbT(TI3>MhT+vl%SuKu7P(JQk7AJQ^Hk8Qiu;I z+8J^B`Re@{E6WHa6E1h%&YLkxIU(dggmgyvnDKW(em0mMIUPZx6By%CtUP1cH8}X7j-YX z%kQM(Hka<;!c(vUbDM9MWrf<^%pB!hpqAB6rEIWU1uPO7aE&EV0NWLRbXx&wn)j^c zYRE;ecvI>G4A&fCd>MFf%VPHHDXbicCWpaJc#w@pc`tM=3x}6=D~W>ky+jXe-(cv< z^&4qRRk_tkOx}GP;$JzTxhww9)f-csIG}EL82|rr{J;If!51$7tzWQSPk#%K*eRD8 z+R+mV6tq^ms9ziVherv2hm)qz@0JsuBinMgUBxn9z&J^44HZ%e!l>HH34W^z3Zbps zyeu#wX^?@kUoUZ%M@*4Juwdt92r~y-xzs|CTH+TM=BVhvmU~y#&Ho*o|D*}CA|;Lf zzk^cz-~Qev{_nj!pNjeZ`P@l65XFqyvVAWYa<#rj6{pu81jW$8h#9IFjY(57y(a0) zc$%=oRren+2JYa%=`%SOCw$=rgt|ZF9zO05K_(?$r{J1w%Td9Dk{g^`uR?A!5`mev zS(bYyasnrlxmd|tJ~>F?e+3%i&%y#1h{CJ*6kpFYAzgN`% z?(g+C^8bCx|Bd-S?;;PBMIQb-*ykc?rCN_m`<^y-p(gpLQ*yHzy{WoKC*tK^1P9iStF|;wMiJcq4LLfw`Y~>=a2%@m20gkdEQeA7AOsw(RnxEKhsTeEs zkQI|W79i)JEgA_kk8Am6N&BuYln#nkZRVX;y9ukEhdWu-o2Tt_C-NU(jIHgznXtF< z|9zNe&Gi54A^TN1ah6Y%)L<%IXhyfQu1IE?Cw?xnfq9~$B70MY8^G3kuk_!gAeCgY@M6jLrVUTWzAeg zI$41bw}eq{C3dQ7v|^-ytxN!0KM%#^uV(7kc6AC)sr3z7Q^Hyj!Y)vI<_g)^It>Yx28W+!##{GpAfo%>7EmU>Zv>O@`wtVO9 z=NT-t((C`zl5?+4;t(b-hwzyRcAh?X4)Pllej=b~@!cbJkBoJ~+yH`M8J z8wNVTdxuAKHf`$9aZ$Kjx>It8pgfL*c3NKWOkEOcjyRy<3W zbx>N=OT(jFWZmd$lgH7^Ga94MpNFN-8NNiHKX;3ePPF{Sr8;@?V-p9S!UJiKgSsLw zggXvG!jp0Egap#6NN-xZ8n`0!r|1bJrO|H)RN6IE@TX@jefk9T(C5!D*q^+z*}2kq zqf(|09jZ+^uBWCbV!=b5Sv2NGrF?-7_6h*3_~k1=Rm{V z*ew)L8NGDEkY^)v#rGo43&qs4qARipR`*uVHE4q%L+Mr3FMqd=zY&PRY{7CTB%eaM z7;W&xj^Jra-D1Yl@|v<;Ng>G0TgWeH_M@;4jnc*%G+Qj^BC7>!7O#b?B_3-4DN5Er ztK>Jb3pH+x@*&Z6{dSM8Z5zCVFDqA#Y2~Iav?ek{yM^@7RlDQ=cl`Q?*QXc9KfHc_ ze(~dnv-1L;K>bXHP~Aee3SS!m)L3ox6`{e8B|9$O6C!bES&p<~8D+hooyV&L=XGFY zAv*{?Ia(bQty~45`s8o=tkjj%)O@=4G+LIvR?}ALd#!TvqZ&f0T(`~rvuvo-%574~ z_he=&z4bzfy8458HD|9|)v`qOk`{2IIJ5Ff?JA)(B_-}$m=aq&Y6G^OX|r7mR{wf) zR6X{pd@!hQSD^~Ou5;M(047w)#pA0DPwQ#VvL$tt?7E0=ZKth5-qd#B^E&q3Z{c-j z0!^`EMF!?d$tw7_Md4pe8CzYwm|M2$G-OngBvw1xwV=*c5S1q}TL{F5)c-A||IP3J zdi+#Ye{I}k|MBdg;QzCC_-y}6zyJM09>cC|G(B(BLxS8CrOjbx6GM)3?+)ho$~AGd;Pt>6ULXZbNa(~&Si?{ z&SgqSBKgZVNc7j^ylI(t~42bj;Ura0}_(Ria+b=Dm0-bM|u0ctGil z(B5Eh^t?P6ny^t`@U=6nRdu-Laj`*oXcB#=&-(a3JI#u-U*SB^!2bt(CHv38-eAN3 z@8wx7osX3ZtwYtcc`Ve&oT@^4ON5IL8m^pp)@#cXDwS7}c zhEYCY<&HpnI!^S17JIl;SWdASn1lToiR<$zX zjz{|7XelDl=g+lOl9Y^t+mEMjH5G6^WRFB|^0hpx(tq(LpGAvCsEPjXA3ZD5|AV~^ z{lAx|M*p+t?ho8SodW1;HX>jq_>SKLm()P4fCKiR+EwxT)IkUCf%}cA49e*t3YhGf zFIB|vLO~qQf+=J)4G0DLJ7UDXGl}KJwuutMpr8>-@r^)lMoB8vK_Jm;J3)hxcV&uc zM$#UploE_`&7Sr|I} zcDmc?Y;B=e{4{TxaPp%9s0h4xn#55#ak6^9O-njGt|8mn>X=aBP@$7Ee#np=l`+l* zfOfxonehku$;m8joss-Ye$;VZ5 zY(^#|m3Y1u&2mJ=1_w-y@lck1FamO!@GWmh4z+cGHpt4{d{-RObHVVB8J;t7sY*0~ zqb|N2qU*l9x9|4hMWWg6z8Sxdvy+ri5@j}YN(SB%A&Xsjw<{pLoY5?vq94!CPr&Jr zEibmvPNgXz0$V@{if@WD>p$O)UX+fUFV16FpF!(pu_a?D#fHEs+xSdZ3 zVuyBqd`CD#H5mHFlq+d4q8W;vRZQ}kW(Cn#9X!Pq`|8T6-yX5!yR9dhMAtzYM{KUS zBkU;T>kfS%r<{~W9`CL1BMd_Hh1CA!)A>5Owl55$S2$d z;TN;{jf2rIPmU>^JUGxSM(;nIqe~KT9*(shNkcWc8?5bWyZl_c_Qqn-$i++9`z!OV znCrL&Igpo}tnhJRKXdcW@(_HV##6EH?yL8ClZB4+&ogfK3swS13N0f7F|YVdc!Ah$ zZJ~E;--AygbpDFWfj|UN0j7X4PUC5gW={knHjxZMQr@lZd>VF&sV%wK%NBG&>J{m{ z)t$Q_Mxqk@Q#|ePjlyWFW)$#`7ii!PzD4tRhUg@og+5&R2V;IKDv$wlp)?LdlA`MX z!zZvLkOg!Zgtc-;h*Emw%ZiCZqcFbg?e+Kiz5YS3zt;< z1d)>ia2T$=ErDSWT|#k>HSWY?2S>81K%mbtH9`DAsj${ZCUZ1 zV0K*MV@z(W>IW3%T2h4qPg|bz0fZcLdHeAc2a)T=Q>{e)vR9P8kx2O6lPj0~Jf9~( zvg0V6gGhSyty;sX&N(R0PC(F6L-Cpo5l=bJ_IZ+mQkeZou1Puv{LLNh@&j4`1`kZa zyP1#(iM+vl?D91MVv#S;Fx1Vbv>kLx#>l-x=M*i|GVYsWgDpMLdDe;4pcv-m& z_feWr;^gSmuYmKnXJ%Jr>4jw-eFbD;asG9|MAMH0PSnXls&z(7d%q=2m8%z!5L)!U zy&_2%&q0_}4%pc|0serf=DEG4t{6`V@0I}fKK6<3L;~x}7(ePwh(8O(X*2>Ga##n9 zH;MxbIwj*_1?}@=k1~nJBS}Vk#tif@rNL$7B(d)>z&*(_bgveD5nYk_5OuG}JeLEd z=5vU;um70g@J~1s)4YK6D}sOX*JL~<9%GpA<1^kv@+aFpB-LKLk6+&sZbmXF&oI5BJ?u||D4-dWzPOf0tx4icXJHm3A#qeo zd5^a8=3#R)B#Z7S4e|>Y2x0rN=|&ixC;*5Ovq1*uu7woZOVafa#sV@=nu-LsxL#ay`tn&9D%7Xw>+JTnUUI;D?{%x>O z_Irr-eh3zVa>jjy5Qw?9kt=&0{kQ(=A6gxu=k7XPTeWWYsW=e&0cF!g%bOsGE;V?w zNUFehH0{(b+diVHXcmS~Q52V&gM$bPRF9azlRZV=B#tStU`^YlZ9x~Ioy%ko#SuFG z<&5NBxrpfh9xve2B!djPg`ZBxP*swl+@ z4bgv>-u+{_fh@sUWF#38bj^{l;HvGPv)PDCrg1t4)k2HW$zr~5Bn+uS<@Wfzy=}@j zTn;>-a0LRi-`F*pPE10qB7IV5D7RdyLHT9Nh>%EIUmycx{~AXgDN*|-X+f+h8`0mQ zCT4OK8V-D0mgq=ZNVg8`(v0oPu2KB;ZNlXK+zoS!^N~+niqsUbPcw~r*Z@Jh7sFv#E{Dd9y%;LA;=xE;U-Ni|d^n^aDO<^Dqf(<( z2}go6O?u#trKBCj(_=B9B4$%zEHwioI6=L$538w8U>jZNg@Q4Y)?y#Y3w9&|$}rg< zBByBKHUmw4E_u8HM0vsRwcZ5z(2uY1OD5wj+?b}QWPKB4uhG@{Ail0+51#61^y>~n?RxuVs zU3pMd2#beT?+ZH5HX?=}(U&qLq15;TYX++(O_*}fz}<8A-2)}I;nbTDqeMgpF1_|- zRvAa=Gs!KUCLz%ZPUo&4QJ2GTDfo4X&svqh7#E)oS+3*Mk z?ulrAZKW=21gCTs9n+7Lt-GVc!~KK&<@-1~jbq(O173^N!g=Ab`6`dtSYEcbDNKeZ)U-=6_0ytLjCxBQV%sx{wsYkrMsG`5 zuLMc)z6svHIZ^gA5|xHDj&{%zu)hRl5mJQRvKNAv`{MaRURlQ z|BB%g20<|WHZ6VoISitF2Dc``<-`#K4c5hZLMb+xVraIuWLyTSU0-_>o)wAF*OL!t z=ad`MeLQ{Jslo1F!E_q^ zO_)m7K6UVmRz8($r9qTghcKfZ%yW@O&T1))lqu$v1Q&~_V+%ahRI6+*zS;4c9lzP} z>)!E?WW#rg4vZyViL!GUn-1=ZxRCF})>b_%b+{UZMCgrKof956hH3_3R&gu$n$&$I zds#{dm%GFZi?iI;R>y|hu+u3zzZfH9swx+DBT*_B6Ambb=>(_T0IEP$zX}}8iXxJM zPlvA61-R_%d;W1**e7pZ+2NkNdDR-GFnk7pJ$At8u|Ioh9A`R6c8D8O1F8wE&bz`W z*-(2){|d8-oYD{6mi`qR757HP{WYq%3tN5#$Dxmq;zXI)$(ptVDZ0yTT7&O7{|f&NpS9u}U^Rqkr` z`lZX4!+!l`P5HK_zvyj^b;AGR*EQ9fzaduVw1)aP<40y89ZbXEE$oc&5%F z>N1#J%PwVO!Om|gplI>FSB`8e<12Bk;fUi{5M9c5y)6mYk);5zcAW%Q4N{HJd@oaA zQV)7D0|EqGr92;qo0PTO)hKAC+m}4*1EaIKy%B$3aZJ3gSPct=Xb`;gyP*oIdqcn) zM239;Nh6A*Q$Z#_p1$3tXs6o~I*9Hra=`Knj)}lw;wgzEQB(B8!77qN5Rywmxm5_@ z454`;bOK}J^LX}D+B&DRC{mtCP)u+yIg-K|fIV8M3C$#K#Xu9Laoq}GCgec>Z#+Zq zKAxQ;9MTx3QJWMI{~?YDg%Je=h2?%0gRYOECF5oB$gcU?%iGbTMQ962_y^)CiN^vz zHtdr18iL*(e4+;!1=LWCb3Lmn{AVm5~`fAK7+hH8~rYs z)qnp)=KuJ;!>Kl~Nr`I-4fz2fbVEiOy^v~7krYolP?iBmK~8>>=}EZbHgXDF5`q@9 zEiZ#@vQ=M#T7$a@e~7+eqwjbiuQ-=sJi;Mu?rq*#9#2#DSC3Pv$~bC*l+(M42)c#N z^`87*SLt^&4K61c3gh^SqA|;qiVc~?zm4qT#U<)l_X`?KsQ30zIA_BC&4WcWG7-#Zu#*VNP)L?U4R0Qw%<@ogd zoA*Bqb&qd~W|4^B#~2}_yTaWDLjCY<_S3hNcb;v(>w!Dicl)l%>Ghr)On(!H#Ttjj zShZVQ=pCMqgt<6~0J?v-6s+=KEta?}rR`*0E(QLaM+X3jLbzW6O##LRYZ9Xr-{{7s zQyc|jLNiy+Fsn>(#928^Wx!48tvK+g3Nj>%h7tHaQg+DjtTlxQs*Y2yUcdWr@x$rs z*XM8E|DePpdHVX1gkj9vVpFIA?3UW(aV=`vludp-dwu%;_}y#S8Z`EO8c&D0c*ddq zMCR-;kiV7;eLAOk7zyzObWKcZ6EjVsYo)|g=aX@WFS&3gqn{{;DV*Xd$w*4Uft0fX z2RRPko6eZvY?hK2_);i{;G^(gapA3-l8i*)DL=)xP8Lkbi+woSi$=a@t;=8}5;;&b z!WT}enS4GH&VNoAjEOh*^23q#4a6b`Cjs;diHHWefJ8nFUp$^Ih8f*8o0rswmDWx7LgNylGQs&VzCmM9hecU9 z=T`M8P6*0ydPy>>ttNdsd7%qnL)SPQqQO*$7{<{hnnhU%Da67^3)*jX_S47-hK)cE?Y31d!iIujFSZUSc`rrZ6YEWAyYFah8 z`wN|>Nit1=(=^J=wO5<4X)A|Kt6l;R96L>r))ukT>?=s#BtxHSVy4lSrd+J)<1m0A z2Et>Q?K!xF${;&Q7IS6@NU}4N%){sDT6YbO6zicEK{7<$!QL~s@Aln6x1)C%MpC~t za8OrV&$GUE>x_uRtZuA_T3HX3x5Fl^+a|1AmArLtvE9l|f7Jor+IM%c_-?J?wh8i9 zr9OM8@NTU;w@i$;*1+w7-oDiWy|o6liS~BC(cW55%wIR;Tk9d(#C`j!;=YyV{Z4|v zS*6d$2yiICQx{M1zvBqsP&g^4kQ>N6FSiMkW^c6=AgwB}TJgBZb=&wbm^HzGHfLzkx~FA*bsOz6`vf}uos#^ySpUJUw4VH}O4 zm^y#VNE)cnYYa^8W^XyPmv9;MpZ5pqlOCdof2p!pOjT|*9*}_F5c7*%6`RN>A)c$$ zzWmz01@YlW{``E;h>udNY42sLjzY$v{9f7tJaR2S<|Sv0C}eP7{kk|VQ2NZ95VqNW zJU>6_puB@nZPm*lse>avQxl zK`-CDI)#D9{xsm0SvO=f0mE&a5;zEnyA(O3Mi7ZS@g=uu(mrapPfy_vlWk=@3g^lj z0Zx^SD`m0tM)*ERY4%HyO@8EnxR;$|9eN?&C}Z=|-w0l4&PV;{a`pX8(k$?B2m07lmv8d8@Mkh{z$$Yi?)^-Y4+mNiTc3n7Bok+D< z)G4e<<7!BnU%syOdH?yKN~c<&nJcF4Z#GXaDcBY;Ot02en4S2lt0llNee@77(9v zP{P7ssC{4(>jXy;VGaD>c|6>LM;WrlQ;wxwA*1- z_!I#%YS$Q>WByIdZYMXAq!#;bQ&3wXDh;fiAiBJO&^tZ3n$#OuPkaq+@$uKfg7Q`J zCSrt&M>6K}IMg)#WdUkl_EmfnY2O)(OVS~lCFsQq)HlA2<5bLa{w`GR3Hdv=w5~}C zckPL|xl^ACVz*w)C)7)WgkPj?fBJ-;aOiFza7CX#GxG4Sc!adC?C0mtXo4ws;PB&{ z2$o82OnZo?K{R7>({>Tl*>sB8`FC3m2&!n9f!!7XGG3pYzJ7Up{`wVq_4@nck8jV> z&&O{+zJ7{k5g5&q+k_n+vvAI4hSA4)JWKhqeTovE9|^?K(iF>i*L5VP#EVn^PF7tC zpp9i$c%`qqb#~p-Oh+zQ(RDNamptx;fv`Jl^Q<06*1 z0jns&j_EJi>oE3kIEiUCl-7EjLmbQKVuhe?K!bT0YK@G>5yJXSt~eIE3LM;p%_z8w zCOGA$3mSY*-9s(2Jsor-{B#w|wktS}X6};b}$P_2Pqm;nkV7&v^ z9Bw}3XZnD^c;wx#$C5zAe5#jcNRr4GnT|!QM6pD*lcc7L=1K^Ni7MyncLm{h9+8}l zHhdBNkk?~yp?XD#(!YyvnzDUNY3v1X*b$Wum0GtG3w6{BITjk#`sBhnj z+$&9uPDc~WUWtCnaDi+bVhB&hI_okyJ{9K8Ptm{FIaVB__^h!#1bK#07Hd#psD5{I zIw7q20jSonGYQ#&bx_oxNuvLModW5AZkJ5d3;HuX|3aUmc>(uJsTKK zu<0z4kxn$Qpp6!k5PirdB)thJd8$IOGoV7Z$_?zeCREu>u&u)H%r&6@ZChaf$mcc- zsd%X`IuBn6d!lQc_R?7-LzNY@N@53M&tu1{o`+p8%``Z0k_48{$S_2F3&tXXH3Um0 z;n<wBzG;Frf@tr#Hr)c|^V4C!hkwWKxZh)I-VNx8u>%ti0x3?w`g!OB`} z{vtRXT&7^Il4jg{3lz%)1<^RgG)re*HcL$mB~=twNkHyKB##UmMBF%%Up)A_qpb@; zlsz070GqowN3+O_rwoKVVTVB^oZ?&^nD%!N@xENpt01`mfO>K;_V9gu0sDHXH32ns zqVW?U2_KRMvTo7=NNC9j5Rh|D12m|>aI(YwA4)VVYGGE2az`|vF!;3b&Xv2#(yy(m1MXhCTwqQE#$i1Yu@(gFAxfT`> z`+`MW?6`m5wVcHHS5{YC5no&sKqn#gz!rI^TkFaQ^z_;r9vtj1%9X~jN*kuMVM>23 zrX*;MxtHNk1g_mM!f^!9Lz1C^`^??{yH@*Hq-^6##R7#n=9HChDozl6t**#f$JQ%X z#l@jdQa1kJpU%EPPDDoG1T~!yodcNEwU#vu4+hT<3j9G^`7vL2F@iYf7L!9SPD!la zbU4y9z86qBBeZw4zrSJi#eUoqtM5rBUZ>_R=?BWn?sHgQx$ay9(b0IS)L)zHU2qKL z&*&?N%5^MeumEV;Brr$d8}z#^mF@3C^nvX}(QJMbF~OO1nuQA?6p!=!07h?qe~QSh zM-uQcwZe927~lNPxjuA+*F%_s>e{WtjfpS655XvILe#~C8Wn)a=%CLT3MBFZXH=pM zQ6WHtP`IQ2MAMjNkO7SKobUu{zvq1Qcj*vpT=CT4%hp&K+eD<^iQ)|XE*I4AdFlg( zR~^te&B{O-O(P<~Fx*<@yccd24DPG>NV8E=gMpJIjgvIM842gL{Yvrl;=fhut$)-^ z30$k>NxJlllt|@FV;JCQo|kJ7qy_qp+F5J5s8~@!CUs!>j=RVQ?jndU_`+FC@ntaa zwc>HXHliIFKaKAZ8MdqKcnFeQOVN4#5-sQK0QUC(?5-PUwuhI;xRwXm*q9Ax#dGVl zvDF=j(`@+;RPlR``>+3R_}kxicm8KM{HOo--T(Qo9rjN(r+qRQKG|D?z|vyU7}+XG z2nI42qSTYY8ZoMnq88A&FFRGHPip&yb#4B#Z3`F+ww%O%m58@Mx3wdORWb|Xo3eQJ zUpxmXraZop$Pf-5%_wB>)0}(paAZ8dmH3FH_1_mG<#9=D0Z~tgY8we{BcUxSp}|_y z#I#aENM&qWPVTthr(cqMS0h*5uaLKqt4erp~y#3vJ=ZpkoJs6Wv=P`*zUNxEGur9 ztb0CTGHkxQ(Y+jWCJ$OBqM$` z$tnpmWi37k1>99a*k_F-d-OrYPf`~hM>0^U9vccgF;tZddsk_2P0~DyAqUGto`d<= z@yQ#;=Xh9D!Gi^7%ZKf8%TzXXf0JOfk%u0YJaqqB^m~@3?nigNkz_WK%tn&gNHX^$ z$!rPt%{+@iAx4Cer3iv{Y^h*w7||>R6>$t4RQd~G-$xkziSU?-D-ctibD@`#Hg8FZ zhc~aO=%qp~7k3PVIyPtsf`!^u{v~)a9!-UwcFWMx^1w9~9WDP<4*szvCRGdlkp}{j zrqrVEBC!6Joq26lE)PRZx@BEsB_(M!w4!R$4p38Unq9QhsVy7rsGF7H^TFVdEyrWF z9=HRFT1p{Fvx~wI!N==3@R2`*kja^d?L)!wK?@7k*^*Lr5TPG?$9niGu%O9}9b~jl z8DL~I%e zq@EegaQe6Y%54=pcl9lGvNQ;T_!?sODMuP_g42xl;t^%1r%@0F*<8My#!-;PjPuGj zTF|kKOcMw^ww{jj=hG(#1!Ls?41u;>9tuK6enrmb&z*B?PCE}rASgg2T%k081Lvnt zMPM=_gcjr&qR&NzYu{Jz&wxPjFkr$R5xoC|TjQ|v=@XKpfV!IWB3c^H!jM7eA{TxB z>@rkNd5V8m(Kq%%i{b4;%&rcDTpk9Q^hY0#?-_FOETjCOu6!<^a(==`=i}+y9lDEf zN*K-#O2MzI0y^YdL7zW&L}+4$Hv7pclE_zohLj=S`9Y{9%5(DZ^er0ARYE9DdEKfx%;pIo0kI9)M85y<>h;CRhtu;HPj;AK z>t!LjBpGs?obgo619D>YFB(ToPS=jD4TG`F;LE^S@ib^36#B zN1lgf8BBwWOaVzIC(fv=0+X|M;>YJMAmB}68FTuHKx6nsjaojl#yq^$0*1Gk3r56; z=uL*Ec#blB#RT{1@>A9b$a3V!FBGfidQa+#Z}6(;J-n=!xt$Pn%q%r2Nm0o%dCRK`+wbt#v;FB0}hwGl2my*H}ylI?J^bB)*I4 z9v$L3dtEs>`rH`NptT7p2q#9Y={6#Y0rwsR6{Eeii7N)w#f27Q)apeSYfDQCFvo>v z*DkwQC-;#`Ff|L~tCM3I=H;uAW@_g2eq@>&1ny3lpZc{SptbnsCp>7}Z?`oqiJg4o~n~nj_;fOiQe|*i!{@2Xexr^c* zpUmjw2bovBg|Mtcy$4xYZ*Fa(vJP}{NmKVNs5xKhkyOWTc>F5Fia;x3@;PSDKY3QyK1BU{&#QhX#cQy|NCtJXmkI2Kli`A zZ_srx9fG;@I0y+N9xtYBSiA`tqHlVzKYHJEUf(7-0<&r^(Fv1cK-BGsa*jx-CN+B+$yw!;$XMP<}$ z5g-}X+lK+J#z2fepfDk6km1V$4rjvYyd@fj_9N5~VP}QN3uk^!d1Lg1{BEsf>8!gH zhNbyZ(><)b%YeoIC;DR+XQTy=mOeEjX`F#u45Ly0UWT!{#p+=+>fFaL>atObQPhjy z%OF-ZSUrX%aqo_YP+Z-%7(G$)UIxzAR`rPtVubymAj>g0x17G&j`T(QB`Rx4xc zx$DVeB6o(sQM+2LB`a5Jed#ZCwc5n9J6)|yHn`eqEgSbfrWISVm9(tYLYc}{T2<~# zU7w~Hcc&|J;igtwlltY?V_J=N6~1Lj+6q>#%i6+U>f*GV%kFfAF4tbGW%>ijU};HR z8|08@D<(;aBNSD-3cr30UFDECA_$qPN}O<2Z9u52HLFy8JK*j2eGvJmd;M$QdH&nq z|M^e1@JF{9&~8O{Pf0dQ`Sq?Ajv3)3kQj_(J>PbHceQdkgo1_>E_`V3dSIKG_84I@ zjU!5$5K_hN7$4znnQ$|Wdbv#ZxU9oV6bzzE_v%}?`dJalB=)JWCuxJI#r&iiSq`vw zJs6P;uZCti!kz^)cx}Ugkz!;0AD_Gtg{b=@rn2fRo5X4GZ@z7{5j8tfU$&Zf)z_>X zm8C{VT7HxVNq#Ag6Q?`D7%nb$8ivcd@OIG-CDUt?zKo{{iJ)m~txDD+<~A71`GcrJ88?`y zoXLQmK@p>kKeQ3IO}V?g`;Fh{>2Mk8PQp!WMtAh z6Yiynk?C_IRoji{$G{`U93U)K9ZKbSGOtrmB6%G1oCYY#%{m}ecJaIIT8s1>Pm}hj zcDv$_?h+uIj%Eu^kgmX3eu8u;ttQCOn=Cj%6)Lfs2`X!8R-T}0kZYbG{b0TH{AfU0 zO^<#wTX1$NZ04#b$721p;@nh1T=Ue(Xa~#A3a{U4LWDMF!MP~AEmu#2>59AJ4A_8G z4*n}XSg_bl%Mxz1r_4TrG1wu2rN0@MhOt_UxgU?I-DrITh3)r=W-H?ASgJXqJS-0A zI_#CoXN^h#HiN~=!CR-HSH&aD+tWBC?i^3=#0Ie5{;xk696T%7|2^C9_c!)`RrY^9 zU36FxZSAyK>uW7P!r58SC~JioCBjVkG!6;ciQ=rX;OpCfWqcf!bVXrRE89Pq9}-b5@qOs8&dQ5b4xf{cG6i$=&+=V zu5;*uz>7)nLmJN#fxmrqS7cJyx=uSN2<__5~DVdA^CBc-hI*>RuKC2 zH$}fRQg%O-Z1XJhX!L&+K)A{Evwwm+TYvI|F41muY;(6#~0=!r0sMz z`WNwdG*Aa|#Lo;t84#>*pivuAXP>AEx2$J+$Jm}eC1Zx0WF|vYsr&9AROY5)bu7Td zR~%52ohUeM+OBr#S#@iF&5t*|GqGPiP4s_nuV0Y=5BK*DHuV27(SM=3o+jDcUXX{y zeTNfi!N3UFZi_14r}6ZRcqz$t%V&V=fn)~~{3GN73z6nMR)gaYh9PMjXK45Wx$5-K z9m$_uk@-{fglEQJ-z_8feGn3g^jkw#3*3$_$?ZFEGG?}6rBG}H`27Il%#dv?TomJ$f;Ppf5nQQ{@s z$>I-HYTry(AomaHe3f(v^kzVMw9!I(060L1J1vKhXFJ{8(HnT4UqEYj3k zqKXy(k?4A8BpO=mkiwV5>*(4X0%K&w5yJS4cve9EowraZQJOy!?#YK&7jI5%FxioF zSonarV}eka6`#VHv|IoxpFqYT5hy5$eWP`pnz`#3qK+dn2#$l0yy%h4>+u)8s<{$p z<{%{RORI`Qq*v>`6^y(4sTLP%;uNkwFXCLIwo z>qXy%|At4;zTK~^gZ*ogW&tIt+OJP`_|)$HR;+5CO{XN_wt^ z&>&5>sJoza-2!5zv~3p?IrVV-Abn9yaDe4c;`j=pt@Los? zs$WTWBo&$4wiyLZ@?HgY@kATsTH!?Bg*7ax7M;hyqI4=!$Y;IW@V2LtPZrtw&f_Ah z*0oT0RUos9T5y)Bt5*tNYzwJWyR1;DZ{8f#*e7Q~&70$)zipJS3=pl50fTP4jyW8$1z$#~jdday>2lC%GGR+AOPdkmnVhQ=4Luw@ROZB{l zDb{zsY3b(cYat9*V&iLO;cMw)<5{~_15=axCP%1P>Sc(7f(F@RuiiJ2m2z{!f)OAJ z`m$ujH4_y(NdZFqDoBSd^^>x^OM`!tx4|^Xin~mGsHR6vK&sTfpKN5yu}E#sU)ErB zLa-kaN*#Lb-IWzkgZ<}Tf4^w|`E0+xiU0nn?0?#t{#09V3cL80Ry;arxkmM@N*05j zMr)4-h^G0+9hvnk+-DK+om=%R+`mwoKU8*YX)7Z~HnM`bktY+H4AJ{IVjNq$?U7u4 zl4XgY*!+^E(!9bp0)@mX0!|udu@{F!bpBG_(PlWkB$;-fwD45fFG6KEri4xsLQs<~DhQx&VD)KZWvytfb-6X7 z7E<=)Vo9_VLlv-9Bu^WVdlNPnuw61n`mK^XIUa_aPku?a9$9h)5mF;yjpU-X*TwjG zyi3Km)zW7@9AlhBNQg%LVJUH_ToO-aX~?FLCSj1h4QPhCJ9Y)IqCp?}D4Ec>M;kgMdBMU_EdEGkykY!wYI6qf{~1lLx$!VYPK zy(<#=Hj63^6PM8YTW6j^eDPzGO3oi8- z*;A?Ixa9Usj%md0=*H3;=kEu75`T2(0YDn)fB)IhQ8E6<;b0U0?>^~&mHXtYfTlAr zlK5`sUuxGp1%hv86%d5{q+I{2BIi?l`!Q0v^lQ9FEaPa_wdwPho)inNiJq)Ca6>^iSW94w{WkTC&Hn8* z^($43N*qmt>mVeT#2=zD4k0us4#W87M1FWpJsbkKyhKX=m<1{EU!`%Pr}~h>=JDIN zor0mKgSM3+*S36PwW(5HrOA(a!Oi@(C5puVF{WVZod-b0+2jQL7`Vy1Aet5%ceCuW zKC+XTX5y@pj}Ciz^5&KK;?2oRZTx1@G5tu1AoJ;rv5xIi_VzfMZv!8A8$`3)>hH58 z3CWa184mRrv7+d^8O@+LA3M-5Di*SZzK_#U;3Mq&L39ZrxgiAAB?IIt34IzwLzFu@ zPx0*#9UUI-A9fHLQyxt4UK^FucpAqU#J!r+j7-I(ZZ58ueUiH~`%+I6|39+u|GoVU z|G!86zesc^UE#ajy>X?{tp>RgqXtXZO8c`D8^1B+hlT8fSGp0bg;oJ`g*}f@ z`Y!fcxN(<9DX(miZdy;BFcXIxI<4{!`2+G$E)GP5z13fdfHd7gL|aRd_Kw;n+TDt1 zw+jsg7t=(5Wj3%J&C=^d@U+1!1luVDuV*49p}B%k^mL)Y3I3h8(|#owesKEvn}Jzq zZPMHy&T3QFHoNJnd}zVvP7{BKr}6&h*D0L+Hgsu}8H%&#wF$dfg3*C%;hku^vMH}o}l)5L^cP#H9vQn z_(MER^#9cdOe?$MjHu^6zqum2dUu(jUyC?1UlSSl7yMx=4^<)t#r4O-B_!{$v zSlCF}SGlh7YF3kn?p>8iJi13(hCiVH$NoXd|MO`7+2;Q5!SDaq?b0ch+G<{$79bDr zxG9io@2hE6xC{5prFC>|I;#9OIg*+iXQgkZt!7KDl?pT~f|Mfq?2yj;J{yP!+KIO6k><#wy1y)KeWT(5tYR@93Z)hCZ0(N6{~J`FKN*IZas- z`|sf6lth_~4c;bTk)@&#VmArGKDP_y_y`h&tv`%z+tcG0n3=40GB=68Hi^Ifiiy9B z5u8uMQpNkr@6|rWozbyn5_c_=Crn$75nF?^C<{Wg)6A$Dfz5X7aF+?H7QKIjTow`f z{MlWmvK(YjD?+d*Kij1I+NAud z==(#a{Q9)Xf%VtQffdFc4k0AkDmk#e(qvDcHkpey35BcxHu-$o!r0{VDbD|wmd|G) zw=qK~xX!&v&*cq`v~MxBwfRC_N1~e2We9)P?}o~wd{z#k)bESt*Y4kGHeYa8kuOdE zL4nu`UWC^95CP8`{Yj0=MX%B}Kn&f4)vHvSivpEctA}a3eN#lC@f`GZBoX>5+>(4u zrg22c9hv^X({TSkc(z~i|LGrY;y+a1|1&ApA-74KW~&+i6t*3M{8|8BIJ#%PmMVO6 zUO|D{yMF@#pCn;CpOPpm-DEbfxfWnnv>G>BSlSrLfU?G`_9d^!4Ro5W$LnTpmiRa$ zXIY9faw#-2=DWsOD}bntim|{QxzR?eJMsoROLyaIyBcp?V&7UM*CKAUP6<_oE3cr7 z0^f?4!g~8%U0|;zOYHpdCJM5b>eg1%N*M1OC(j0}JcD&71#<|OzO`-ybEmh~M(eGV zjYf?I<)WqRg33e-gaws{3C<>NlE&VczUWP2nlaAm*^ALRRi)^hRtu>HTCDhK9A{(e zeHZ{v;j@6uek^z$R%%a#pR2kOE8PE8&WSXHhv0Rk!2e6$6_)o|`L0k#GqB$BFK~@m zaSv)WFsRnI6kl3z0Hqs7mIhw&8f?kwLdAQ&<>skwG)hf8AN2dSx@D^h5z}x5#A+4i z2As7h%1ayD)Q{UYzpfrP_2W8dlNwkdmy1;B-Iu2(9G3$9up(1gCXEw(DFS=`7}M-L zRt#_v>}$wEH5rhBJMaD$vCaKpJ`Kf@scKmtyBvY)dhH2Lo6)OD&ixR>_o#1=nhCHG z!&NQt1)-k2d1XR`0IHHcQoaOJ-B2p>_t@N-<$D+7_$dcDe} zUM-+iuF?v;Y9h#|$^5ttkIC2UT&uQzUUYHhRKb{P+pE(sFV9EniC`TncqWNF@mduKRU9+|J&$)?^FM)`+r$=!1Cjl8~?vf)w*7lZ(aQV zqQ-5}`2P#kf8_E1C7E3|!oSAq8bkbRe66``Rl((XQaRs1na9)#+XnwJMAoVUc}dt+ zVrg9sCCF})7Tj&p0wY_59uUOL~P|5rN+E)&l8izVTC zI9-i7t=6A5ae4C?!<7++7Y>_bvEEpGKsMasL7zt%|LveZ=s(-g|HnxGi$Tnc!gn11 zZ9OKJcSXn+j{jzK=fUE?J$(MZ{lWfzN&mlz|M+dL|Go?J@irZ875}@rW=pHuW#fN00%;rn+dg-T#s6*zV+ADE7XN#RmR5@Yts7G= zY{65C7~aw_u_;jYq7ciLm+dfHE|$5p-u$$9B=2@U9zv8VN6@x*q7*^<0WukGo@E|E zkMHyvs7e3V-#aMk{|3)C`oC)VFPYKFCCOcxolbL3*m0t6aWm&B0+^2R)7FS(Uo9D}UH2QyM*FcT*|JgxN|97~*q5ppc z`oC>t-`IcM zC;hLZ{jI})s4yFq@jq0FYL&5$LEHEr$QtRt8Pck0Kkk|ftt$dZF^-ijS3pgsfO2vG zi&M-3QAYG0FO`Es2T)GIQL~_^5s-w|gd(xl`V(boFfD~5K_c*=mJZuioomUur-aK- zUG({L8i!#JU4Dd6Cqop?!Z6P@yljLMz3ml~fYg9mXAY32eN>kMq=4dEbp_M9SFJLD zp!EkoDa(S59b7T=NfW5WBA*z;xOCu?CMb6r_e5{JRoD}~LPOM(a?u5Yo|FN!j(O4? zoujlA?7=yn(2PkVs(Kcm!HddJ9Gnaq)w)?a18QfuGuFrFXbkAFa8`kK(LKuX{q>w5 zVQ@_r39T;%WQXmlTRHToYi#_k8vQQn-jI=-#&Vp>PELa}ldO~oR zP39$(?EyqYyEWBpu|pEuI96l^7}RG57?_y>7EE*S$mfFfXW^NssC2*cP!rq5l+zkR zyVUWQ+7P_*X^suEOlpQ&JQmK(Pz$X(F~g&cv0<>#rGiFOLRdUzgmL7%vyc&naKA#t zh&ni{;IvE>k*fNu;IUXTJZsGsaWht;8kIpeDhWjqCItRAiH*lzy|+Z9ugC2+pji-I z0zeU&ez|&$(desH4%X4N1Uz0nNfT=PJ%b|EMp(p(UJVYgm0nzk#z%6po`pHc~C6EIh!SLR(r#L=E{L8 zptPbwn?{)Ubv{p;fy;tcpefHNBC#|xjHpstMr2m1Ni$}-h$-2y z$VlV1tsASLSQt7~d|P=LP!Gl!Z(-I;oX=`BLhY&s&T0bvb8SEWyYreFl!)Tr}&z8;0vWUfm zAl%YSe5|Fscgjfc$AU^dLL!S1*>W?b)v-QSw$*9lEm}L}WCL6(b-@GzkY@#0DUDRWUqrJIAepFBL@bRDa_WGsx zPX~id{HF((|EsKLG;MPfXUkZrR7R9KvGEFn%P)fPDz|s-a^u^Q(SF%Cc?}8t>xame zzuy);tKJB*kWT-TJ&}HE7`xKj$C5|iyu+!_oxcdu-HOl(i;M%8qlAYv8&r;D>Gc9w z+CUZ@EDDh-n8-(HuD=ugTx4W|f0tteZ8U$6Oh8!j93u?a@okdM|$TP)&Z zI}ppGu(o)Qi#N1VxW`GBCDJ#v7$ULBaIt-aMDFR-E+k^B>($DLh&G%{0TCaoobx#1 zzZdWSo*fi>%|%=NN&9Q}PQN9Og1WLhrvyW#BgK%w8^xlZsy>;DFa2S+9S z-^TvyQOW-`#jZ)31s)EMXIV@=9M%Mm$D&9OU5e;r!en4ikcgiJtdrQ!!9BL%aL#pt zS5UBVDMbWugAi_Ne7ZPEXzzN!oqtO)lTc&Cx!Oz48AO>8ktP5bf5UZ16#|WAcJo^3 zPb9Pcbw7;9UGyjVV-{z`)FkOGYVj3#(9=a4E>+gr4+EN^KPA~!fqJa*ot)2~(Wg(n zZUIy*Sap})-SZgYKR-Jv`Tq?LH}OBK=|8u=Tub*Y@}IEntTX-CA=4zA z7i-KYd9AK_RIo`VWbHmouxNqTO44FEvBsAlBHG?B+W}lhWX@ua_iKe=`=Le%!EQeq}%N zsp;k~h4p$ayi|^c!m>v*oXx7xUmVvcj!s2$A5Y)v7|W6ERza>%L_CK0&x2C@&u54I z4gLS(=)V$v>Fxt@h-Je`-wmUvj0BV z8*KEy_euXNXuqSI-`EH`m%iTN(ypSu5X8TwW6gzJ6f1d_EPWnd>X1iotI%e!XYTL zp{IqJ=bwuzm$TV;9NePrKcjBmgCp&7(*`Of(>No)q(P><9msR~PZDNZrk z0%0reCs-uxub<^YF$1S+p>t&gwxD6T%A<=q^XiZmntOd5gu$H_+M=-Lt)o|6ODQ2g zeeO0cfXa36R4ft*yK&~FI3b*TDLaoOY%Ix%MD?|fXfRIEjsXf5#S};QGAGBog)(9t z>P7R_0B?ina%k-nd_5&VP0da<7E`mn$h7lSWMFDX%+{yEtTz@ng9etvbU5g0HX><6 zGD0t?f5DlU;rZ+!CM6G168q|H7E)1EFX`cnalnf9u5sE+XHk!Pw9sDOh#SN`^P;`y zVb@DD1!qKXO45rgz9P|5@SvswS2^W!Me*3PA5Y)v0Y(y>O)iq$(`LcymS8U_UpnOx zb`aNMTnN^We!aM062XNwGl~iSrVV#WE{Tqv9$5{CUHcf%z}?TJ?m;UznH$rdw3DV?ANGbR(Krbnw4W_5zvP&hMf6zZD`Tz8v zZQ?&ZuJfPn=_5+f3}<9K3(vH`0QZ|LNFcIWo}gMFtELEgEXP)RVxR@$3^YZ2sms@+ z4onTHdepjVo292%p?!j$Le2Zi%_Ev!F)fcB$~rUh)GXV&WIQ=ye2Ew(t9#KZ1CMxP zwN{s)md-*`1EA!}Wm&Mcgj)3}wd@sbZBa74Ch5y~n&6b6?mu1(+`+!n?;=-s!FPX} zjffzl?hipG{zSzv>Fl6sCHCTC;%yLJ!S&4_Ey}@JkSB!MMcx07g76=DmW*-*;RCMC zt8p;1Rgk{;sGN()SlKHkV>0ek>elv(DVS=YG-O}mFKoGw3W%y3@lz7U*mt##Te4;> zmpDng@hg0(X}wj3rJDK;36~mcE|`C*5nk(bOgwoJcfNG|Abrsznb+g+OT});XcEU) z&MXaIK$zHGZ?N~w?Yn(lsE~ zu4N9%eq$dX7MV5PyZmBPsMu>&$UD{f600?QnU|c!-WAE9)@xhNy^3^;C{I4nB&-&5 z7;4E1`$dt!n~*~K2L&}Aku&&Q9>c1Y8;{731pA~cRPtVlkG4Do);+F6ECJM{iwe;Q zA=rw%h-Ft+PHxSIDypnzwlr<_v9ADc%^zvweERBpqg5&bOh_7lC4D?4 zR#=!I7|@c{2!a92EWWD3Q1R@CR}L3WrectwiqDmc~It*cMWG8%NFcJgtn8=Jbh zgcjCv1@lD@0Z%~wRm^k6t>Mqw-Y-+`x|>3yrY*}(1ws|_L*Nq+r?v}BL&d~K`YC!s z6XK!a3$zdzeZ`h%OyG4DME)C!x)iREyP_!zPXkM9`1nNce&5o43-{BVD*#9Xhz7+^ z>4gzp-maw)pJkm2-FHNlwqAf%uWW!z1pbsJtWsY&wp^08>KEDHJbjn%Ao?*}5N5PV0?1eksh#t8X_{wI$n?kp$RoCAZo^ zsPLiA%BlcjNldahBx%v`Nqbp?fnIgV*711EPPN(=lW%I;Rh1eWMJOZbG>8DnA5!d@ zr&!xAuC0*6HL_};MtM;>yHq>veV@itzL!lBs9gF?@l=uX@|aqk0MX~qtglAqYwN{n zb!|n>7c!2lBH<;*!2K%BUh;RP9K$UJ&dMg1k!$N^or$PtqMe_=<@XwPwN@K}wb}8@7d zn&#;4hoSMXP!UqvRxsyH_JrUKih&BPSyc`Yqm$MQPv$^-?A7~f9@3C7gfo+ctK2aM z0q*)LFjA>jOsOad*%00a)1ah^Rv&DPr>T17$;WoKaV%WxvAZd4o;!Lb1p6VO)S-8m z2&y6e$KKwvQvQd*(Z>Jlaru9hmFbPXU+oh`Sb)lfxp2aWwy-MW1gyugYk?ltC68!P zucjkQ_?9^m{0dHHT4sp%aYPnR15np%x@0S&3g_(W$RW$SNh$(&Q{ zGbjnmRb@{T_SsfPj!#WJD5C0uk^&Ms*HqIA)kYAIZTWJ_E1dk`mE zS^gU%`c_Gnylp+;oM!mHs?4~8sQ4+5c-FY(D|#9f%Rx7aZ*8(pJp^M^L;$oJJ*@;b ziD^c4q3Fph4cSD|Bn+~*0nJdir#TuspwkER#z9ImUOvB>%(DNFy?^g++g28b;rDNS z3T!E7JMJ+h%XXY>os+$`o4BdpCXRo$(>{Ck>Cc5oNa8j{umoktP4nHKg~6Q!Daw~z zTCr<27KzJX01RdZbFp-mnMjN-RA~0razkWUAB-i^c4exKYEWMwIOM^j$>iPEQO&Y( zmwaDo*H^g4;%tn=OOi%Dn>-5=`>?6ndk7*}Zo*pV4lSv=%gz6z-ZdsYYr_y$8>nFlPs#=FOi%7BerHK#SVKd{dq*$b7e^;A%!_=H9E%m{+W=#Z+SuSJx3oQ}{? ztFPwx{Rr(pd9wSYgV2PD3{{`BQ#BE%lopUj<%ShxuF(2tlAW@LGyBrd^7Fr(|9fxu z>C^T3|3&G4R*3(-qA786Crhk+Yi-U>e5a4YG_(ZsmUo1W?bIpE?~yI}wAXkTqFB74 zQKSD{6(^>ehnZ2aey9;V1)N`Xt zK&3Uoe#v~7kc%BatGsRpo3FL5dskRWbDNXj7K9l+qa0mJRK&lV9@@;Z<1cE9&z5U% z>qc6dm;E&^u^u$>uY8u>|Li;|%m4e^>+}C>kpE@T`n0|k2X37rSnefd)Y4oo2!a)I z13xlqgL_O0{OHbS>?2bP#%BD*9y(L-qjsnJqX*3tT%O~GRU@D^6!%X=aKErenF@YZ z``_&{{eQBvx6c3jg~)$*^XQSw>$Xljp6Z{+Z$|>s##P5HdcWQ|w-(Wwhov2M1Ynl` zj>kd7S7)gJqiU&W%tt43Ay_Y3ECjpyvP7?S^Fnd-ElzM6ngP4-nnqo%eXEYoK$bcM z#bp%)`>Shn`Y4Q}yusqTxev}<@Pil{DJveFrFlz#Esx##y}4+~wpa9Ks;TAiU8?W$ zu8v@KGY{kYW%qD91g+@dRh7d1LWEC6Shr|oQAUbWktnW=bE`z(O@^D%D7cNUW5W`z zLL<}HSsN!|M0?ZU*~P7XS{Y&d_&sn!7nNQ%Z^ue~uWhif`UQ(^U#>FQS|O~ryMHo8 z$Y1nfP8#Wl5d)Ulf9>y;?Z5W-him(hL*?+N||v-Rm`ofJDL*y z-Nv@8g#_clQ!7d46J9X0;$eM%|9?yO|IX8$VdegJZ@AX~e!2U*UZCz}Cs3*U6#R$)VTDq1VZwC6?F8p}hdL1z?>V+J4r_p*^Tr zCxbm$V_nn%$0afe7)K+hwBr)|mEp#hR=P#QU zx{fHUGb2|UTW3c83NxX884G-!9N5g_{U!%qXCz%`Bwc4DeLxial{1n)L_X3Q!LL4z z=!bPK(uVw5mGA33q;0xaRBD}vbe)HEorlyK)H)C8IuEJ;)LiEwb(h{c59vA&={gT- zO~JZ6q%}8ajR{7tOz56-b=jf3(p*zIgT%Y#H?3HkiswFK{vJ(wTfu0e;%;yK?7C)n#9A)>*%a z-Y4{SSU=_GD#M>U{@-war=0&`Z+Cxx?f>y5`+r=Kyof`b94rdTLYy=Njli-Xk#4SVUKoA{`m9F%TsSASUbFh(gw(3t) zro^JeOOhq@W=_(gY!Q9Cc*%<_!Ud6fKxjw25pm|K=Z9yFmUlS`1I0m3mg!Nz4i`R0po=4^-swydgjw`tV`!&1$>hn}M&1 zn*9ca?`2=NeO_=f^S~#-Qvctbvj5-y?(W+Ew@m-#o6E(R1V9~vIVtiuWOo7E@z&kx z;4ITWclx{i?M_5kn8%rj5Pp=h0w)Qo!hi~jrX=NKBoGLKyw4~jDwIr+kSmfPS-3N! zDxwG*4F=P=m@UTrkj@7ttb=EqgU%(nxu$ujcQ)s}ms8T4#=9;~Nnm zGRJW;LNcG{zr;j|7-oVtp2M4t_)!I=qh+Vy7Q+xR7H|fBXB@MgD~0sE{$79g6Ow={ zL5DtL{;%QFz3s~WfAaLndjEfl{og|`nPtF!G&!clNlqB&V>*>9LiF=5ot_q&yYM~W z^#h?%>~=ambTmPX6r4tJptn#liy69(lLSS;Bl!p#W(eC%7ErZfMi6I8J3Uc-On|+e zV>tek8^mTfk4S`Ym{Z2k|EhytIiUU%Wi(=F!BlAa@gh!&AWl0yXeo+WNUunKgC+zQ zi~JU3vL_)TQ2@|z!q`LSe8@3FIOU|71LE;2fs~A*|m4 zW?r_+r(JR`$`!9;9Bqdj@sRG6P9PS)R9c2fjBq|(@c!Z05E@SogJ)&*U_p}ic%CI> zgn~eH7)*bUvw)-_<$!FVAV}ymn8XR$LZk@$9Ggi32+k;D@i-yiVSqxM@=2S}MH(SK z+*=$&31tR~E?a$xK78zSdOdVtrbPOc7nIKv{F5X` zKiCNute|u0k1e!2J$`z54@Ta!wbyi`GlFDdY|$NJ6fsUo_(q@;C?N49si4qyLl=hl z@ZQ2pbWQV1hUlVDRmb#wN45`u>ILaZoYBe07{oIm41yxa_$7Zw3r5iCw+An*@gw9M|QW8Fwq(G13Nf{FU9XjOX2LO*b_2U$h*@0pa%^_GX zhl~#y6?Bt}oQzn7)C9OLx?(2JG7`oUF5O+v_)^I^^>)f3HlvFq;@e-$XS4n9 z)KnKnHx0cEkHwsOk zk_pL48Ul)F3K*NyoXDFr*uG;TaCR!h><|rJ1!?+Mn>r1r!#c;!x=g{ zcmpe4up@H1k=z=dp>W{)_?q?c9RE&JpyA|_4M1I13>J*!(?uMS0fSX?6UZh5*(7X` z{;ZfMK4NL859EOp)Jf8VUhmIw&k}u-4;7p-;0TfahDC@Ub zPT$|W%dKM47D<^d=sssOrMZH`z$l3IDFI3xr&BdooQ-qeadIxU)(wRCLnkysDkT+? zW?z1u5zQB@uyz}7>U7Bh3~3sYjPt!Btsq~3%HAiC?>fC+r;-=T!;4gBk`K@tPevoV zi28gVF!pek;e1Z>du^1Fkh25#+vW`mi$pdl{z0-IZE4lVNjAf!n2Rzg*GWz}+jYzr z_Xur#v$0AWQVnOdF+v*=4KF!oCBCWl6hcjdV^XwgFJGiZJSV2Xj=f3cwY6f@N=9hb zqLRk}WYm(O(D$D_+1+!pZ0T1Mw~W1wR44qD;K!sOau{jjRp8Dzb{V2_Lo+x|EG}By z^)ta9<^;I5$0sz}EF03b*>%liUoV+Zw8+Qmc(}1H$EFmEf2((j0d4^$;Jhs&Vn zT&Ns@AYh++1TST=WdpEi+z)zfNRjc9+%QzkaG{ki!0pDV6fcFqw!u0*MN>rIee~^( zzVhKkUO}T7hv>eFuokg7X$<$gX1kNe@E-Bk?IfjB}JFiyS9> zoyf*>lP%@>&zH|w0PO_BE%SG} z)$jLz+2T9&`Oi4Ze&N42H~7d75Enoa!q0A{9+BgTP)2eylsIJt!I1$5r#Bh}T%3ie znPEN@My^Osczr%p%*B>?u6HwYz!y+`^UKDjS}cNNbr(Hn0s_=xsEy0ZT2r=hR?C(3 z$rhFk+dVBV)8t)Om_xD)g6H<)s(!t{wPs=Eo)?^T*ukoM?XEgGv}Y_ZAjm~$y$~z! zKqvbSX(E`9daZiTT0mQ%b~CxcjqfI>tdfjxanj8h1yFt!6h$%PANn2Bo5&&*lDvo~ zeEftT+HpEn#(f^Rh(DBGTYZqfd3nCsbB_F6eG>Eb+kzHYypk#!`8TK@H&X%HR)0yZy`nq=<{xI?Eot@ zPN#vtQ@%G2Wf9m5VicA?KFJ#PuqJ-cpA~d#e2^P|ng)v=-MHS9y z91?X*@N+Wn3(gYsz;PPp1U%Ei8K=VVZ(cAiBqN$4l3v9*O~vgGX!w)3C=w!-dJ>c^ z#1`R3pC8i);lP0Y^%pw~0hkN~h@D2CojbM{Un3Ibxi7);F?((N2JIV(K)uM5%+5BP2{2 zVY{o#EvCr>9s|2NBZA{mH)&L)z3g|+XIj-_NJ{0ZzH|4h`qRUMmv0XH^Qb4gGZ)wA zT7Hup_xp_IoE@M-3jF^3{6zD1QG&*uWm}4U80~ETF~)g z!dVg`E~Dj`55kaS1)32Yk-Tr(i$LNK8pScNZEP_&9gJ`IF(;QbiVHYMD7?q=#w!;q zE@s;PAt8cW&^80uZX`@%e&(y$>39CZBz>jlVnz}!6ZMPiv*rJMy7RP5|DW#et?B=# zp#NZveihG0V6(tQqv9qb&*vO1;f#!w{rcdW&f)t^nZViB5CB%cqwU-!qgqF{y4tBk z$sc`TgYKk@<|VB_twp{_L$tpuE%eV8lS%v@Tms7(*#)RCgx!S^a5;UwLBB0<5>H|h zA)I9}h<@iMB3g&?1@D6oh@mkF@q!V==-fH#VCa*WB#}5JKmt&gCow~h$2WkMm&a$k zELiqrB;4$Gjwady3L4Q$LcpN33@IrfLH^>vOK96**_v`(TW?lLBs02T^YbEkJDm;y8p$3|6<)zYogy(mR#N6&QdJznvzY6 zG$Lv>ztsc<-kElbsRUgnU7?njgOD~quZ*HT5N)H)-fhD zI(5Np7%>rq%K0KG;=mNLbeSklId?IRIj16sYilYdnJ+QW65=Zw8Yf5OvQi!-mKMAi zh*f&o+Oy~jC*Vq{fTbaxBv_&pTuij1Gf<&hyQ}O?FaB0(NB#iqDIY}lzq_b=(Y*zQ zf2Dj)#+b#SyiaKbwsH{s_^~r1$-K{I;$$5yWzyw)Z+_-HFt zEO);8AP}}?u|L8@wM1Q8w)HRnEPuO`aa^J@?w?|5>A+qqEUGd(y$Ca*iy9`zn!{=f zamosuhRX-ln*Wnhqh)D)|Gq%W^glag|G&N6;r`nH?-TL=mDJ7o7>9~oaNfDb*cCr- zD1#RTTnK{d*0_61Pj9RGw_>%mbMtN>C`S7ENFap=}#=0_4rg+O`WH1KKw*N*m`Dby(|k(x2rq{P4s1 zfG+X>+!+pcO7wrYw>MnV|4%{xefe5Tgv@sNvqModhoNW+L1EMUTT!(;5t{osXH5Rn zRWg^h;>2}FP035uOXL$l>!z$JU27YxSB-1^=Cw7E+k`=td#bS(jXBXvni8rm$zj@V zdY@I|k14da%FJ4oVJfLum!@*GW5Cr#b@qgFZjtD6wd33yTFkNJuV#((_)v&PyF@s5 zQ*LXrj1#BMa=2)yX^K@U3(t&Yb$O}U2`Mjxm2$~iJ=a#OM2V~B^0Wg>TFRADEWuV( zKs=DaP5n@% zFqyJ(QwqmhO*v;{&t$49qu31<>Ms{mVsI(|%I~}{t9o2@eQWg)1pHk&d6h0}q8vTj zezx7FS2t0tHeN0Fs%@a2I|)&B`9IKqXq=+%R(I90dab|9-HSrP+M5O18Nmj|-%dST zo;b}FsC*{EHK1ANK@)u57Vik;5~MXjb5D3ujvh4-D0h)60J`FB`?riOOMP4B>-;p# z5|h8$s$}}zM2}YMdKsw|n>Bj==&>Sto8@l?NUIc(#?2J~F@~{qV3-om2Q(`Nm(SP$ zs+Dv1Ebq*+!|OX1cjZ3y$AEJ!F2!omga;D0)hZqIw0cq@io;tY(w{U*9c-qqbyV4z zl3cu7g=%v5dJs@a^lA;?li<~@=LWQ0l5y6bYPOW)u#(?!y zz*v1zXrLss+-;hY+GKOyTyY{+zRU#oyZh<381&|3dtwzRXGSyM>N7z$LI2sou3Q2s zTXuh>>#A_(%aFFcgKwogCJhNpmUnf#j6F+I z^(^o9HhE&26T~d)732`D12O#>;zvYk+0(U!Uym zmGu8R`}^zokDv1Xw}I;|U-RnATybpNS()z=mCvr%7aHid8UAfSI%-_f)evo1%#DRA zrm`??e08^&Sv3CK@&C7<4$J$0dwU)K`LpbQPgs=-0g#cSL=1mL3{I*Q|61344d!0$ zZT37jN0sStGY#C8-efdVqKcT;Pk;UopANUn_Fvmi*606c+W)RYv8`ljLj>H~_dx>g zV;3(SWhL#`@+;kj7OI^q6D&zhvOKNz7Vy$F zw1SzxJUV&dzBoC0X9MQ{;CoWTu#9E%8gGTLfRX@RD^p}xLgoyX}24Yjm9$L~b|zb95i zzfan!(g$-SeHSN$-LQhp6?*SM`p#GuST?{9!V507|E<`6?dqyZ86asO~X2u7@1#@ z{DlbRiMszp!~XC|e>>Rj`XKrEu@jg$AS3kihB%BjesK)&N@d9Vf~34YQ{@z8H|lX{ z%H;=R!pkFcMe;El0fG8?W5Ec#R5eBL*N(J$xTSgWT{qzRxy@6e{}18=vW)%@w=4Yr z(MU zpOp2#JG*QDk55hiACup_6u!t8WD`A3Y0>Dgwy8a}g?;Sfg5)XAZ_s0wC2;}fd{v{n zP4pOS{<_^w0N_!R$010)n~>Q%2!i&AMz+c&jtaP`5s=Y}fQ@Sp!!@5vK(?OWj{OrHu4T0@zA<4zT zy~ag2>vGY?3W#8U*3oX;0_lawj+whE1Tw&G+y2M0wJH!MQtyf&n6SQWfiOZNZyjeD z^Fic<3tkl_6OZGbfpUTtuLzZnaD125VuwjyvH!Z5%5A~1Qf~VoYY5rABA`0H^X(>2 zhH*BT!F|x$F{D=n?_M_C?KYbg;`%O&$c>b}A`FdTwOg;HXdW{@V=~v5eYjR3ZWGOW z#Zee$;Vy`D0*J2)fg5eSEf}p=>c1USrKtXQ!A@_LtyO8=gqQl3kjhaP=79uw$S>c6W&$VwtnvI zdCzEOxBIkw|2KTHzt;bL4*hSF0=TRm_9|z~N?@b=edJUAuByp3n%VohIlL#m zt5=VD%d12?njEOzE2>;q?|wIJu_wS>V}E6n#)ph5=S6MXtI9`Z`{?x%RDG0-?n7Py zE}{QBJ3AHskEc89`2U|g{+s351&iWO;lNQc<@Pw+8Wf*F?h$1mVczq@N8}}OUBEmw zH##2w-kOL$6{B-evShdIEByyb-7z{{Dl2p0%GUKbl_Rhp5a zS8XnUenN5dElzM6lKkjIZZhYcf4x-dbzKuu*E{MC5fAs)HbtNIkuxmQP&^D9u;l#T ze)@E`Z2!MI++LsmpTYmDK50l3qo7#*&lSu2;Q~_Eqh?i)v4-lkURQ0RxRlzh59;D~ z7nRlJ!uu@yfA8sb#s6n_cb)(7v-p1+o_Aj5hin>PK<$S#CzL@p#xiA4319ylk_4{_ zNeCOzWt=Ka(vmV~U*+FD-1~p%7+M%PX_WkK=G`WUR6{;it>VbOd_AZJD%p*I|13M5 zwy1BAv2T!Nsip47Qto>sBxH=U%w;-fy}9hu5)W}&@C}?8Ak~{v#NVYgm&F>cq7bCb za}gBH^zXc0286ebl_AM;`u^r!ZXrRvS=PTQciWz4G*#1WI=5b05foQ$Tdb;60+b+5 zr&bS@Pi_F=<;%a?wpstrZaojV57zwlQ06PZ*FHj{+GQ%$)q10?H`;omt+dgqNz3lW zwz7gnF$?Jx$!~%Oat2y<|GWL9od0X*>Hhwj|Nl(>pWay3_vHFn@%b0RfU^p}KFL5j z$=D_~pgZn%mzYb!n<*)(RdEJRCU^I+Z)bU?0TDLmO#A^RJ!@~zKl4+e{|{gcw2b}_ zpO)``_jY&I{{Meg`tP&c`EwitcQE(44-~9p2dtk}pIecstC%ftBA4?(JKqlZvNT(J5zx(~2z5cKh5fVTV|IKRjc>IV|lTL3e(TX;+*L-jUN(zY~YNeFf$9^>ttD z3l8CR7KAh{NLmaQSweBd20Pn3!@>4&AbJRPws*FJgidL2`s&+Yn&X>bniG=tvvk_I zG$F!9Xyc#HhyCF{`rExduDHtbxv^VV|y z?_vMTmvUY`<)d48AFrpfjU<`IZSnN{Z4Z%<;7(6AMOixdY*zQ7tz0?;Nv& zv7cYt&r!2!cNsEiU?d|u~-S~fp{bzhD-fbr;il+tbz>H3iIS z)I2t1$?RcC`W}A%?|=Va2|>Xk0L}Y<|LM-&u)P2Gx4(Az?<;w@cmf#?K%~>U{9X^e zV+7$85o!8w$GsVVAHZY58t`v46>^Sd_9NjAG62^R-X1D>5sY9P1#}WHIw!$n8G~>$ z7s61+vO~dDm{7tQ%ib|^kYxw?oaW}e>D0V~q@28;Q&7!`#KS%0I>Cu|ZU9X6PPw=J zq8hV?fA= zf}?~mrrc@aB;Z_^iM!HKWuy$MX2)vhdmV`6ghmJ2zYtLnWT8#d9@sN?dL7GkaRfK{ z&N|_EnaAm=1$a+HRkmJji+AEY61WUh?rAx30>OG7CBn7%9A*psM%eBiT#+14$-5#} zlyQXiw{O$-oXlx{)2?}r%ripJuaJ(UNDz6SB{)uf!2$X#BjK-r)j7=xubPvIIc{CM zl8AK9rMyocJ9kg-l-qs1pA?5C_YXga$7+V z3uh!+BqZNLq(AKozw^s(zx~R=(L7FLPB>MRS!?mk7fBIk2?=yRY|!cTIz7{|$Wqpo z=1-_IQ-sb!iFokfn4nI zK>su1sbVOELpD|F0EZhqd;d59Ppt8 z08xV516>7klUZENc`hkD$qN?fkZ%%ab{1DsgqrJREE&imY%vxEoH%!3UZ5U&Oy$Db zl!Zn6Z*W%EVJRc51paWI6*n*Ayax6xr&lqTB;s@$q?AJ;y!M-hU{@NLN}Wy*R3|rr z50aX4R8SPs`JATmMPC4>Y(hAidp&f(SUgP;MkkfT_XUN!P!a#U==409^E;i0UZUPwHBZDpYHazTkiX6S7PB`!C>I8?{Yd9+hkO}+f@TT zp%Jq3dh=n?$a>)v6vz@~Y{X?WI-$8t(Wponuk_L|Ll!gGu^B_eH{LX*ISIlU2`|A~ zG)TY{iW3x*dIYj2Gc-co^I6PnMk^&Gf*H;iDd+7?9pNs9o^5xRbiH?My-)EEw9iS?& zxYUAjx{Sk+Fvf)x-U(e4ERIBZc}SthuPu)!ReKW-KAOw=D3(xO$Hh!ic3oeJ3r8oW zGCCs#6w<)lWCXzHFTqi*pzx8PxNr|y|GB`&A50f zU>7VWG|5|Vl3~Bz8$KJNbHL()V-U=tu`otMimnRcTk?qzyC^ZsTy!lKxrDf*K$ixD zBXK?+O#u8YgiChi=*8(v6f=Fk@+E>T$4#Wv8KNDJPDa?STi2|CQ>7|jXpYPnG4`Ab zF>{BDxQGml3#{&iT$8#iD)>eK^$F5D0@T=>WlR~1$KjmQvv5X~3XRWO!d}P>g;2U= zpSZg%Oi7H98b2@OK>~Z_1e`$O6fuX$CAkR`iZ45GYN%zx7fP?>uxPz4Ew4@wQEBJR zIF%E8{EV{VAc-*}OtD02qZ+cX!Gx`hRoFV`;%tPv!~RZxx4+kw2OBS$Dnl6|Jq4&c zzk&YvY;&$r1e5d#jxu2n`a$nA^v~yL*dIPaH*|s6j4qN$bAuda*;Zhr33L@>_%w-0 z5~%|EK!ZNGq~quH#tEGccD8r62itpt?VUk9=SMQ6JYqpXgJMPk)hEv4AWj3*K)@j# z^dx-z+~>t1j#EG<0Zvs_0HO@p2&L0FeGlKnO+N~8%6GZC+>N~3nU{A5AzSW4&!*XG z!6IP+4uQSro4Z>f4l={I;9hYtJLlvwW{9TA4ea#GXKIR`%kt;2{7!N*iQji*Ix219 z4;w8Y@9{iKNI#(=P6Syv1ipsXhkcsmpx5Gmk}HzmKr6@zC)G!AhQ*9;>d7KO*E5nL z8SGKgM2#yn#+*_r3f)&4CC-A`OIi;28@YJLIJ_ijWY)55KoU%r1UZS~oP9VPJzn zDb_;VvySzYMkEl9I1knh{ynO6~o=PGQVBxfg1NDXjrqj!_1bS6PyC8hLeO|tL$z#MR-xnNLolOndFIhIeofiH0qSv1xcb;?rntr=s4os zd!Y}Ma`$fwe8cfJ#q%*u{_&52I;#UHIs#*`0&3uVsx_PehC1y$+L@q(u-% z&r5H_w$pD#t$^m!=l}cm^wq`j!JET>s*iAE7DRN8zRSQ7B6 z%>5F0n*d6&s-OXMZns9}S#c9YaUO_v3XmKxL)lKxD15qt6IEAcfVxpf%P=;& zV+IRIj(bap0zgoJ2Z4#@oTR7>Czrwqiqk+GJG`W15_#hjn$NKqJxDHb`bL~iFun?k zq2==#L38{*o-gKT!FcO5m4_OdlPF%ykdN|J_1;4-$s|q*=xMPKXvPGQ z_at2K6U!`hG``U+ie7}k%Mudtb8sS2^s6uuA?ekxma&}-=ZqdZ9NrkGzvDPe=pq75 z3rM$d`X3T1zJdjDT2Ri}u>cw#Y)YuXUN2^-n=jHnn{^RpochP9IFu!<8w|aq;U&o@ zal%hJInEJqPF*(Zia!RjkuUm=ODZn8AWG7!IH$liYvrfSc#H{5Jff+G=ip8EgcJ*` zo}O1hoP^@Cpy&mkm!EJE&N#t8_~{HC{%|(pb%%YaPUCor@f_teA)FwCy0ZHd8KW4s zP;t{0ttze((KrhG%52eYjHi)?f7AebcS}OF+eacyH5|YE z5aG+mOw0{k0ME=(kI{G$^PQWjq9INa5?QP5R9K$R3LjuLfO28z|KtOcwLmJlA(D;W12 zUvd^MC*uA_%-6~ov}O;c3Fm32qpsd~H(lT_zsu>o>!pvJRFj-@)+I`bqsT9uwIJ`h z&B2tUe0z|{Di+`@9$XFk!+#8VB)z)AxnOC6t6>mI)09(^Mv{3o%pGTk5oU7jnN^5T zzu#AXDuM2QFUie6)k}ml8b;KaO1L5Igbg6OVQ zW%?5O2XZ4Fn0k(}le&|J88crmIo|<&UtE$Kp^1_g9KgXVen%}L{@x(aqJr16IGiaI zi58iaaj+A%tKD&Nm}GL>aIgIfyInolAA4{ zq?!d8Nw*uO-V?qHgB^u6H-B9lwVTYArDD}bY&$;_0SP;mG;ez zQnvG{@y=ww({vN#>LXQSfl27ZKc<|Mwans#L>Pwz=z;1o&|P+f1SoGXU&rYs(?j55 zii#WMTw25Jv%n>g?~dZ?88VTkuMu2ZCb>kW;_2<`1`n|l@`D=VTOl#b+c4zhcn7Aj>=+P7M;_OIBPY1tqR^SJ6gM`mjWl}tgi3MEb zB0-#ThFkP#W8K2I_~^rD$YMSED37nWnC>*+4_RzHZ+ob2UZg_ypeXWqyeJ&3iv~}m z6!AjbaCY(KRiIaP7OLB55z}}vPGU9_TM85>{-=jHAfVfb`H2Fm2_eZS*&)m0G>kLY z?GdS5xhV)ZG+|C6b|0NI6DEPFM#AJ2k@Q6l#p8EVB50?=V>tzpSPQ~m#c$S zT6V}NSKr^TvA2KdjRngGY=(0Z4TPl^7uG=%P8QQRWgs$LBm^YPK)PjM z_S2CC!Imq~Gn>Uk+-GJuC5aqG6i@RwoCV{>c$|2?tIA;-Xg<{{4|zrBSPu5whC0?yWfg9{0zV;n%VGPXi7Ozxq%5Q+?nKM3>WW0( zCsf`q@*)NS_+omcnu>WV~vk}pol6wqqKM|TkzbI&_XJx)koNP|k zW$r393cvD0{#VU40@IVkV{ImEDh&Qt!2sC$r`YZCt2!mEO)tM_z?bZOU9PkaHsl0s zSkrZ6PvwLr5kLPoHrz!b)x=_7#EkE)mmKZTsk6t-*0bkW2p;wnXNE7VL6O>!%VtyD z-K!Bq-7#oFeYDpi`6>U~*Q{*rZ;_0Uw;bR<7Vq`+}f+oV&fQh6x~OXbQ9 zWC>2&L12~iHqsIjr>tp6#RpmjOR1b`U}^W&KGgzP(xqFhT77BH<$~5ygQd3&0H>6y z+_QHd$j@|60$s}pGQ9i<{b9)vk4_JMy7>Q}y**ZLDGOH6xvy>olyXr64RUVF3v3(b zO;b{EqP?TvIr>P#q1wSn>^v8?VjE8f~f{C+imm|E|fI5qr z`bMXgFC{`+GOg5uvg5BwRTcb;qYl3Ry13qCLunFU`qaxHo zXFpja2@*DYRYzIbMXXnyZ0n1lU>AZ7aJIJY zu|#bF6%|r@u5RM^nZiNWQ3T@@UCc<5aS5@=5=S5su-YC&97FoF(z1}cYEom>G0N^h zt$Vz+fVZ|_=ORGi-(&ast7`!EE1y4X?zh39ylPS=@9L!K3(S5A=So+v77<+R zaR%X6UO3DC8^d^`gm}#e2(^a_vMQPBNvP% zs@aB@u*EKlgrVowL?Ogja=|X+?Ba^#@#LoTbsVSBMU--g7IF0azt|RCJm(~bZAIbp z`3=pd{14%m=IofWH|L%mQ`!Vut#$yL7x%OHc|#rkztR1zQr=wiDy?0R+90ya|LT^F zA-k?e@L3#@5G(V2nHXO!V`18$Zcml1vT)&n!x)w^lP-S{7B&Jg2wu%moGODT!fO}t z6_F|^CfInmZea))C?S{?dIvt?Sh}Y9rMgw$D75QAL8sz2U0B%R9M4HXa^_L;Y}s0J zXv)&;FfsB`y&bXgCAo~R<7pm8gUe?ukkyQF@vuL9(%&zc7B36%;9B{*X1-;^U1PZm zcHF3H=__hHsZ@9(%KM^8fQk5JoSi4^N3li02b;p?hQsqR&Jf?&u!Ge>4L)*%Oo?L&hV0{bKlGSid&>ZKN za?cA~i_}qyIo73RokOww;T@hEEJC2Mg4K;K&xx46F`1j&-hkal40(CWgdp2_h)Ant+WF zoQE@5fMO~FJ{JRH`=d->nPs;DE~Rk2%fY*jD}Ls2Dvg5d{$hsmMVbnSRdHT(%A?vk zDmIwVGiQ_ulPJDlq^-}v>(?S!0f5U{i6p52B)%RS*LVvtZ%8qtk#>uxC?W-?0Fyv$ zzsW{T5YBKqC9IEr;tTPogYy^PSMe25gylCyEw;qUJ$rq4c%tW=BOhQiY68H1idaHO z1_<)HFV+CZth(yw~U7C=Jjr7#jRwwO{- zh=q|CL|zd~Sgu~RRHr%4X5d_-Ch^~vaV|8V50cUW^Q%@Q$&>55oX$BlV`pGEv&hM> zaHIoJ4xNCr%YlcfDt&9aniwd~Iye|Jnk)(ex(QfPGs5=)#2gihFK|~tc*3E^re`#z zU@}f|Bt45nC8v3q!!zImbvOjMP?Q;*;1ahGX5hRX!-p^-I8AO)n5al1(%_5FhX94s zHHBw8%)|aRBjNv``68U5Sv=(^mSSBJUlO#tzpd99dOVzM0%4sHEcO_m`jn=DG^BZU z)-Vv>l=y5HdI7SiE(Cm;a_0o%A--&B#*2>{OmC%^84WLq9@)_Z)D|;*#VMvVfJ1aq z;3+{-PO}VLXOaYEnAel%MoQ7?+4=|VN-)U&-6L3sf#*PtBat3qoN zT}A?;@^C2M9m$$d?_K<^tW~sIRcyI5WQVw2)(x$uYNB}%0KmV(L70bdIv$s{IhED6 zJOW&cDqt7i7ddupr5uwOKS$Yud9(zEHr%5szB2ph_OqOSY|kH=wry6)ut+g;k;Zo)dn18Gs+4G5&+RN!3xGTez6)F zh(@II>}8yt!f$u)ituZan(Ec35RMsm%-O*vVB+P57m*;e8%SS^E8<*CwX3D+9dvCF z_^O}?Uf}e`*;ML!&hq8t=euZ}gYwe0zS9w`nh)@_Szd1X$yKMD4^yv82#lh*Tvk?k{lm-l^ z(U`v93IZv@1=DP?6$ICD8qw>3#lMs1!<}c_@1H(-R%z$W+n0wU6+Tr(ia|%Oj^Cah zUT{dxE)Gvm-=3aXm(lgBft9n~RkPXYYsaQmoEwFPJBIo;zNf4}GJK^BNLUVLSzlR2 zL`D!ykuz?U5XnM5w*v7s?-;X5{BonexVSr&zQ1JkGw4fnPbnMk0I!aN9nY>T{%PbifGOB{&IN+A3q3Yapc2){3 zW$Tqn*aj?9ed_|jb*&)M8rW3R_EH0qMsj2Uu$P2n9b=VQA@WEm10{iRmmWsP_E+Fb zAQn`dj_D$eP?6)wBo6rp&;r>80#>v6MJtb-xn0N*g!SKm%&D zLuDTNlBOGlayC?oUcoiW>n*9wWgQ)fOhP-S5dqsKoMp*PAN>S^g}AwufxKWAA%46z zqmr9iwC3~&%p0h%l>*xY!m*}5FBGpV^D;ocg0Y_3rdPanR@g%jIzi5LYdu-7haQ(< zLlI#`oXYr+G%q$amL25Td6@hY|DNyGxG?vNDkdm8u>Ig6Ql0(;*D0c6awDVJSuClH zW-i!ZxiCVdDV7FtI-ptu1TjPNn1Np@&DFep_$Vh$&ddp)I}jf*+^7nE+#ckH#lDMf zMaVc@pt%TK1ou~A9v38!v5*vKs-iT&e1oAFrP7*X3ogTQf+e3nHAW`A9{P4sfWAXwGFL6O zl!6~*6A1aGCmjwTz33q3lr+SKU-h#p3m}2}*E(IYG|J8)r`IG0tFXu^d-y)%v_=|G z$_fGc0MSE45Fr(PXoQZ^EqPrwLO-kKe)*_rQ9XPjXoez%{2;x?d4xhb&u|fo1a_P- zS}`-O;Wl3;-4k(f(6B$;MG+;8Q!l-Ss-YXCH<%3Sz_;ADvdb5Ck0$Ar$(GUp(}o+W0A^Y{sJn6MP$e3)6IE}WB>G{WS@Ita*nl|MkzXk6w{NT*hyF_@MLr>u8tg z%*wOtI0yN zW!Wd8cc-r(GcXn!bv}FuP>$0nsZ2PeK#rV*s0=vMX;7?T7FQt}@5*74hyhZiSr zPtTt}dTdjbmB~qoR6y1lh!X$v_AmWZ0`;+L;)J!>nwwQnk4{Q}@}}9H!Ho+t2S{0g ziv=gfGLi&;Cx3kGDtN*fRWtoaLN$7%F{!88nHM{~RrA~kuY)5lbKRfoyLKKmWTcOJ1EX`&CFTo0up`i|z&lxcx zCDrh19cVqCfd92BU?m=~S%ThuKe9!H&`$@a$4AGnMkb+z$ax@dhN8dy?QcK`q|GxU zf?ERDa0pAr<$b3`{n!UpM#bGX$>(tjVLeg9W4CypqqgSrK3Vfm^4Ol157kGr{5Ra$ zep=4|zq`NpbS?jV3izAt0cw zMXg~a6hedd&#)5uGTk%Ue2B-DXyXdWnvL z{u|Ge`T`Z1%}kfRuw6D`Wef-2(P*izGDAl0^;A=GuZx0X54~DxkvV3V_r2uY#{cvS zuyNT4yG@0Rwi9xHOR8+ZdiNFfn$k-q;}PX#gZbish^qvMg;g-E@c{35h#OZRm2ri2 zQgUr{BD|ug*1$FC*dK;bmHm#MqsIxQmx~N_uZCUJ6<63@&w*;|b~cwCxSQ_TqPnvW z1r(bmz=-KJyZagNjIAjxL` z`3HPXtPu-lXG!@6jJ2pgCIxmIxg+A#O-#d9mL+P@#~1nIB{(#xNGx1zqQ{KPuSgCi zC^~kQS0%N73(!^Fqf%9SC^Scp z8;4`Y&j$l3{WsBLSj%@tgP6p+<^8PP^4?q>mnsqd3OGEGRsQU_yH6$L`uS|n1FES9 z7a5KEMV2({|M!PaclXQs|Ly&quU!BCl{|h1nnr##m7TJdGiq)QThz5Lpi5=Dwk+jy z$MW8=`gDjw5?&M(!epFz(qMUPx0J?;*Mo2x9`!)Uj!6JoGHt5r49d0s08T$G(2hri zVD)CXg7L4mXPBoKyL8(gD&AtejK_t{!j`v6wTH(bnK#@nt8Z3N7L70AT-!IfU&@t0 z3v*=qN3%`dx#Kd;Mqar1nb`&~C+WHVx+$a&m1%?*3PN5g;NqI*GaXAiyB(olU^A?w z7~yN`Yz$uw<6(+EejF_+EHobfVl%w+WPe#<0ZUhdZdrXjAaGWHY2O;0H;+|WK18$@Mbh<@(Eymq%xH#p`0cSwfQO<%WC8o#$3*fVkzY@u#B zNP71d$79>O(OpdFqGr?YD{NfZdDJ?})?S8_Drk
    paM8O^FtRp^GbZ)6HaZ3tv% zWwhyrzlz`JrPQ58Bb?nA(d#s!I0{Pfw#wCIv6s5kQHxzzSF3ih*Hx(9jm>bi-jVkV z=*l~@uDR;&wD#6u9H#>|lj|MlQ#L|BqizuLT`|9m;v5B8oAd?f?|(2bS>CLzGwvl)43=+#xzQ+ii@lfOKulstKwx;Nf=7|iBgN1tx_O=!7rW` zsx9c+a95J=R#y)1McqYvhQmMWpLQ9OvXU23zid!yskF^dDb~%--&kg>d}T_3s9Z9? z#MUzaCX9taIqFxLd6)gRVZq$8wUpE?R!iu8J+~(BcK~H&QtmWzQlZ~E@Q0b3H;3on zzkOMuQLm5A&by_euMfUGeC?xVO$$S~XB#qDGpCg*KS~1WgW=-GgV*m4%aDBdAg@SP zZM%eD)7f`#U%xy&t&F%f+l?Jo$cYR2G&O?fyQMWy!%ql1!P`4)jy2(3}egoW} ziSV0I-7nd%Z+A`fzf_{H=j?VQ-`Z-j-x^CmSH;|55m+kNR{w6)m@-lZD6th?lkdFV zyuOOA6lnGAg~4|JS`wm!*Q&-hafq@f{E6FZSW?S-SvyOMaJ#eB&0@1YTR+#?>SeF> z>{@YtYeckm{JL(iwUp@AxK|;uvFTN1#OC43Ci$rX2Z7Ts&JIt1JUqQPKYDZc_T8$Wdb_zR*iM?AI;i~`YyNk2K7w=Aw&i{RJ@bb;k@x{Bd!_&>? zf-jHG4!(VTcyV-mbbfU3T2_2 z&awut7%?nyXpiyprP7f9Mp|)HfU6Z4 zw2{Tx?U!h68@FGhZM`~7@PgRm%3*!=^At&hvr<9>3kd#oIS9~3LFb7F0R63rSb97* zUa0J>_wBUd_?9R~5{t}t?ZV9-9u2Jdm**Yxp~*eaOu{1|bP>t7&?Bpi?T=Mgv*f?^ zs9G?dpvN>vk7tMNqwhQ`t64PAT>;V%hv6~=htWYd-T8lalm=eb##1oe(?JB#mVb;ua1t-n$Z+0(WVho%W{BKF<@WmwzzGX z7g>1%yer|&`N{q6*~XszGYVBa8?m$n%V6L8vb`Cy2kW%un-x|>{&%a&UyVg@gBL$6xjJyWk#L>J zBa(yEYOpJht~{P)5S^9PUbULGSKnQn9GriDcJcDy{J=Bt$5Wyyza8o|?r!!oT+DzqrS}~m-yI;g|SMi>FHJCocolsLHV&{!bwOTkTPwXkreyjHD4559`%cv+xuUd*h z4z}7uP!Wp|qFE8s6er@l`emI%5d5$KGuF=}z9K1M>?EgS;=4a}3V5QTad|LqY{4zz zZKC1+w&~v1af?*fFeOKBzI4!|W^Zk$os>pIr|0I>JekC)bh1`|-?puS zCPXBehA~<{Tec|FFCZ#=^qiWRRjaW*1G~!ASe@Ws-+f`pqX=Gd zA#poIacUgYwCKD4T{1xT7DhCJ9_5rmmXp5cAhhnwQkl1Jd9y8VvKmmrPcGsE>9pg{aC!UOf9>)muf3Qxr07F^M!yyBrk34HRr*}*nrZnJ)9nwoKvcCO5U+S$ zx5P2E{`RPGCRX(#@ZSin+QpLKXmvL|joq}kzfsT_GTY2ZxW_@6#Fty)kEB0uXe0|+ zFUnMhi<|!;Vc~JqaG=n|Mvh;!sqHhkQhkIhUcxM~*lm~Bs5jyA3ZYAGo9en&)8P_v zHR=@(25$on8fKI^_de>kYB1ARMCFo=bPYAeylr`hRfnFoo5~eh1h$%DP*sXH$_=D# zI{GkKu!7_{O$gkNKSYj^=KL?)!zaVtQvR2{Cr@_2^87DfP5$=^w+QL-WC~*EHVQsy z)oHZp`MO}_P;To}nh;>DF5@&Bp%-GI@wXk5wrYf$lJj-uq`>@q&o zcMEmJG0h-@z!k~IP-IF9{tf);_#a8kitaBZGZkm1>oHOywPvQbQ8l!lJV^us(a+^B z#b5WiEkD^~t<5o?t#o?-$G|fBzq_|xqW}BD?Y%Yq|KjPtkGOv;R?+Qf{Hodiqh|IY6Iutfi#KHdG=^FMxF^uL`h&!*{D zLq+?QcJ0r?tyffjtJ7MA1!pIX&>sQd!$#v!DT{;+yFi%IEo?N~=&i5r#%%-DRBH=A0rp)^=ikK%VP{3Y2#ZB-Y1c%N_M_49Z#UeV65U{NlPwKG ztXl(ZztQx?jIZXGBq0Uhzhx_SJ*zpKB=q`S{4R_5zHHr^Tg^1LfEPz;!6`#>MnalK z?OXNMwr*E;w@pvNbilf8s-4Hy-M3f?w#II$>&bn_KmOXKw1<22`Tt)YrFSEVJA^Gb-mWG*cj^Q&?fv*o5wF z+9oh{m+Or#ylsH2R49X31Knz1`Q2~ZA+fIJ!ve~XsOZlb%KPMtsrR?Rg5{8MmZVom zCKF|(Kml1yd={p4<3X*=keg~d^`WNbwsa|-OxGBMGO&v-H&gLM@b92boyl065DU#i zepD^2k?9MzFilBu6nVleEb_#Pwh%7z1O@DJg8pA2JaGvwC1DX1GD`gZw*EB7@8Pw1 z=SVyf%j5mMkfsG+ZL*W#d(=G$Ly{FEgtIJ(LvchyTm{{dZcDaP&`Xj!P1x$H5fa~Z z#$R2&+@dvAyp0v82=jdY)$UZi=WUyM`mN;OW#>a{kL&!vUF)TA zPnV4tLd_46KM*4k+86`@>VJcRVDLA@23=F8JL-S4<-V};FuRR)w+7PZ-8KLJIrM+! zNI2-xgv;_k@(lV8= zUxk}Lf{vlS{ENo{#I?Khf$LuIKb9-G|BC2ip1(kw7H7FME|QyHuZ#vkbn7YxK~RxT zTAOJ-*b|W~p*M4q77wQYT0;MKpFZ6y>wosP*Y;nZi2iF*V5|H+_Vk-=Tn0AFR32v; z8)#DhQm?kJMzdtQl0Z4Xji&rot5A9n1A~l&qfUKv3cM&N3vm*sQ)?29dmYFP%6(J) zbg$&)%L+fq%L_jJ`|vfGjnU@WEp5Nlsj=o6{3E<^BW4lmgOh3P8NRbxu1T54g?E`wC8D&yeudXgwFA zd?VKV9yzss;1ys3l3uL}5Up26LRo6T%Ai zAWYyA{%?D@yxjCW%|Ei<^KQ4-tPW-|9?XLpXCgqR)jQFb~y&GpLMO^Xgl~V6CWLa?9Dn| zp#Z6kpI;JV9NLMRMAyShmZ0ugB);m^|&A=0=GIOI@7C4`h z!U}QuWhlGWPvv<)GBucG7><)=^nd3`+5cyEd-us#PXE7>rz9qMR7Mqzo+&c8+8L7q zE8_e;&Ewx`THxe_MhCJO$#1Rdvnejlvi{{_O!AZz1YCz2S}Mg_nUQ4PXEU)-YpTFE zt4_7QIZpAEM8Q}Fg*+t*!Ho3PIaymVPFaCddD7@=DguEbHF;Ix5~&$`2F%qri`paiaZXz@x7dSqFDWT_qq4UpY?HLfd&t99n?(! zhub^bW%~bgXYXsL|6dLN-zp^S!(Hi=qR~DKYwnJ#?R}50mjCw0TeAIKkX!v8r33G! zj@z4i#k2HQr(F4d?|90gg;%}taqEA9_do3i=)Vne>whhGL(7M8Hzl|~@?Qzp;fzF! zL^}zo@KE+^Pm00X`fXF;dZT4q9^Dowm2Zvk_*%LxP~LQco`iz-+HNF)^%*dq)mkAh zfpSJ!agfBA*&cJ&%N3xro4NnB^ z)mLuP4TV*Kxqb{f6^aw|GWDk>t+ELYooz;imA%wLL(}eRlU}q`xH-S67ou)y7;ae6 zhXu6Kw>>qeO@>s@;&5~4FP)uAR#a5Zq}pzEdfO@ISgjpud7+|mN}=k~Y@*2CG()8o zUr9F9m{XzDiZ1~Xss{A7tIUcbdqs*-xh3$%9hBd;2d+9yD`Sz1w(rl+PcBa0o}QO_ zTbB62!G$Lre;X&8vRHFfT`5b${+FTEZb>x|RrXWuVG1h)XF?Q=2`kT1l+$d4e%`=I zvhj=a4gAPY^7txF$dnwi5GT^J1dM{6vMPJmDWwHia^J9m%tv6kYZde*`c*ix(sB)o zc~$~bV6dc5DCXJ3PGi%+1)6a04%+-7;;l>zJ4=qqhAzti-{nA-hkakhDl|!VRzP?; zi_Kx-@6cB%V7#caJZyYZk5&kIwJerSJgN(exz_7__NO#$DJiaLei>wNkl&LIaLN78 z-rj!6|7UM|`{~;L`%}k%d)%l6+^qX9myBTj`bj*Gi=%X!6DBN+gCKCUhq8E_POTVl zLX~)Iw{$Ps#2^-s+)Arh(UNdBlcdE62|btF6_Q<{BIg7>M3bD(m79-N$YnG-`xKfn ztEF10)m9!UGQCW-X)4urXdHmM?q~}ATOMNIY+`%ebsLL?;*yD+lCoV9H z!JQ2CcqYZ=a$2q+4N`g5TXeLt;l^;U%C43cfOpF4r`|W&b-ifSb~*mS{Zf|0FNLs> zPexaWOI8ZHCMqSOa;WBlSR|zBzg6CvA%=lG8&4PA(Bm zlN)=+8hdY%d)QCi3c99kpOm)UCj<7GpAuPn5G&wi_FqqT%l5zfPj=V#|6kJme^W8F zW|jpCy_@as*J381u+iRJpj6|wW&^63do&-Y8UeQ&y0%Fc{aYr=OWFBS)ej$(V%|D4 z@1Tgkl~Cb5axDYrrOlbbKHG>pa%Ow((X{FzCB?7@jQ+Tk{y!O3?7w#RpRD~qK1ci) zwHy>JSJBlT$qxrve8kQQ{t=CyBl4RkXP;^#mIWbqU$@8?q+4n4Y>~mvmU;nm^}Vcd zR#UM}XD7IraRH)rC#r(CaehuIkel)sni`TW070;BsT}H4h8=8e>?0PIQ2HM)4`5LFxg$NOQ8XUnZkYzVv6{x4 z4{FrzX0xs>H=d%3y(#KHD&JaGpsf!uv2^2>A&biepp)`j_Y`fc`k_9jnyOeRDX>T+ z%VT@5Rts<1X`-w1C-WxNPUMWTLPeMKm?}7>R2V<7Trw%n(IaEhR1}#Jm?6czj+$ie zRcBG!A4*B+y_eB}iNx(tn3DXfx~(IirQ(XVRND0w_QHkG7>Ad{HUIEHVxL15nOzdn zaufBG#(jWEth_}iUChTSoR>|){W^n+DUSu&aSJ%C9@=(Un@-sVCh#vX(^RmYg1b*a zE!KRyto2r0-u%Pu&@$Qm^QprAl8?MKx!3#t^7H?(_omHl8`=Kwdw&WP;yaO3qy&Jw zE6$W`#}ofYj(si1_sNYsDv)TAh(G`XfLfx_{p?Sn8%wWPNN`oNDzONF=^WPTEf27MzV9{Hzr%htK@l0{$KEB#cl|G@0a~<&ot|{86rSNM9 zkpu-@azEciAaHXyf7U&}oKLArF*+OiSFciID0-HfB)43-a;$ z&Qeq5M!2Dl0+nFdxvRKicpkFAbHGa&UdsAwrJ}IwAK$YqI}8@Ea=>_DO+oWOu%-A9 zeH#C@-_dm`|F<@0$wx82hl({}Qc zGk%2-wpD)qAjCZ6{@T3z%{8g!iEHH@U|vB8qBWwsN>S4I$M>u>F=cIMz_RmSx68zT zXtMtIR`@?Gs_cjU&-|00i1(i-B(&nWZ+Sk>ah`-=GV$hqmWq6AI{wV0uzBEt1X!N} z@5*+dQ80X|d~bP^YY?0ywIy4@!j0@XNWXty{q@N&u-Cs-=+}S$jB^4>*WtGiocjK0 zFwYMgrth2a_q^qJF)EFVJCI86;}3-UKHlLqO;NM*%(U{{wE+BkVF$o^8+iU3CO_^w z3#l!6#6jw3R{Qhi1FQ- z7ei;$P1s|zs06$;hu)Sg&+~Q!6Fvn-+zv;p1SwnLy3H5yNf&V{e|y4 zU=G~KbYOAyka+aNB8=eUXb8}|l?n6jly_b*wk^f9EZdzb(F`cC$lWx4(Q!84b2}?` zjMRd=mrB3a>-3%}%2kL;x^J{mQ9dM^)+eKFtP}swznN6R{~Krn2LEsG>%Z>F2XpPO zALA942oZ&ce&X@Py*Na2@^JC7<5u8WW?+s7PT0tm?Z!J21Zf-jh00B&;@X@{Kp1}T zEWpH}aL1QFo;#T#@{)BM-%aQL z5@(M|0AhYg@O^k=5rUr+p8wf%zzbefAj@vyPX#f7@oV;i&#%M3_rTz<(?{?lW^J-D zq1rN;XU?|3#0;>Ki@EsbK9&`;&YmNhfgxq_;(T5>Abf#pdnK`OTFjPvY$jk24c50Ltm7_vlDNPSzi42DuliEk#9#&QQf>>JN1aqWIoz zELh?{96O9uX5<7pb5>muf$`y?h3Q{OycHr5Fhy}-g>>?haQmuF9l8_0Ea&dXSO zN^fW6RGb}1MeK97MnaU9>9-?q?&N8!_)m~c3TDy@$02P&yY^XQ+1Kn-BL6!&TmP@$ zmH1Cvz<=5Zl+$)YysO|dEse<3I0jQ{0*duBEVLp^!h&HH89U92B&*;hX-xl}(hlCukb07`3 zpHPhLPLC&E0KD*c;>}NJ){wkt>4Rc%_p<%Q+n&{aLvV#vLcq)V>JZ@M4{V7_{_}!% zsEBRgTE1r|CA&)S4Pu!9C(XNWhX8c zzJBJpsm6&_FUv5r1daL_q*geY0ses_?_&H!wS|qG@C`D3CXZ(qURGS{{0*G?2b{?j z_ay+3Y;1R$Q5trsYJc#z6w{xg{OOJ1S|l|pKLZDtAvnhB(KeqCKBTrg2N(y1gJy|f zbk{Nlum=))y`L~LBXG5F!ZkX9OXPo7W8(k2J&FIkwfO(_<$qzs#^iySz8_-hL-OSL z6Lz~67V#&`_OA(ZgGI|MjqRBM({fNXo(9V0*DsL2FD3DrCh~-W_Mf5Ww(B;@|9!14 zgp+pmmbM>wH?{?W+8xOn=De(+FL*q`?nI-k7ErQUFbjW;;H#^z1{UANoA)ATmhV}o zBp0i^pHkK(+}OTnarwMGK+12z092^iy;Rh<=a-*8fBf+CmtTJV z?Obi8x1kaj-~SYNa}dqIBFt}EAe;m?M2?Fe$#2Amf%rel z7LRF#zMQo~-@sZL92>`aadW&WwS|-EveU?GS3lN{wc>WUQyJRs)B*9Kk8SdtbFcEG z@>}D#(_jmzni12)7xHogZL~ed611Znd5-m>vDUyHXU@J5R|x{tGeXFA8g_D0UncFM zY~ys}<-Ji9_4)Ie8P5I*?&BAFFpKP^p=He}iaK7{PV_!*P{*!fl>Jgs+ifM;DN4JI z{}?IfDzXe?*JrlHxoS^5_l@UxLHy2OIyR5AmSX67OEG%AmZHDFUkwWo$Gy@t>}on` zxT^d&<Prg(~mR#C*?KNCX}~OoA~i$rvLQgNpc^P3&cu3e;{PbWB%Ng4IB#@#xue~ zFF?R=A#pYC)gp|%d3-fLI6Y#s?cIPNuq`AKzCEKJP^W=yee%e+sx$SaVqovMjlXxX z3wP9##&oSQ?}ls8$>>>~dypK}Sv1EsrRS5|Xyv)4TVnc!#OYUhi|3-+o`ZJ*oYa(p zvg_wF`zm5@M372xaUYm&=$io=1ik|^`iFdo%f2>2EG_){-1L3ho#vYWyK_hH{`jg* zZR&VfvjBuM&#~xMvGp*=uqHK7Tjc#P0)B|G&h+y@eTS5ha4yRXuG;~ysCU7KV9Bp! zm8iRq^y5Ws1k>>mWQytkUKF*auhJA8&NKkPEo?&5=thX|-<}DYR~Ihie5noU7DA}ouMcFJm2Y5nd*QVNSsVy7B7&F4X6U;a;dM+YKYraV|3l0=)e`xtjSGFVt2N z6bRcT!~PI&(3s1qae@CMC|%3X-UkY8nF1~oFFJc}6wG^Kw? z6taoux)9h|-Ks9PW;L#gs@PshdmG0uDR?`hwbglfxmLKMP8iO-pka+rr!+$P^f;`h z5%#qFdoJ_|IY*w}mE_R!){M+gFglPtzGUP(H-l>n--x9LQQiSFdrK8%jXY#7r>xoT zmB-c3NWDzzW7{~lPdsNacPV15s&WZE2b(qtU3qSFZvTZ89ZmZ$wZd-iQQKWNsQpe{ zC^`ZfMH|~Ury%JXv5@gG>K9;IAfOj5j5!;%qhmVNaRwAmy^6)v;=Kx^dj}M3Q=Vy8 z*Sg&SNx`OLoA4m{5k8{8%KG#ZQ{J%_kr2o?$?w1a{(JkwhxXgI$}hjXoX=lU`X8J) z-ZqV|=XO%{eCFLMACd@z#H7Y~({BOX*SRO|#2TNZfeDEZ_3t-k&_=B2)$<4R$K&7P zi)gsrxu~%V*2ZmsQ&q+^I+1f%WpQvLvP3Jc`RtspgH@dx+((9uCwBr$Nn@XPQ z3|fkAj9N-piys>bp6h8XMIRU~C4Q@RJQ}ZBuFDpvces!*FZ(<4%;PNkVxyI$4$`9c}rD@VCR zYAF;`dm+@v8QaxznmDa$Z&tz1)QtD;l}BmY@mM*L2AR5@1qbkT?gA62w07c;NNXo& zY|`3UX<*XYDXpE-+F3bRrbk&n29)um!@L?9Kl=IiW~`k8n`W+bCbNq54+_J2PV_l2 zT|!^vPA-hoN}F{(muU6RMHtyv_vvlgwZ8_>|CJrA$@L#IKXQ7RI zqZxC;B=}1bLP7LkZr**(gQ~D5=C+&Oz%Pe0@0Jt56P1SeL~M8u*U&5!E*(m^^eN#& z2Uqn4!ey|WaN*i!@ar{=3=2;ycWJ)5Ell)B+%KPZ^nn6F+twoC2XE8B6%==F}?QgnUTQuN^{ zW@7q~U}9HsJM6ZM-;BQpy~fa5iazQPFA(hfdlVW=TJ6+(6dH@^@Q;{KA3JfIi#c3V zB&VB^`N~Fx{w|rM@Ut5(nU|LCFwKe;t0pd zT-iCfY=6NA)0{F)8J22_R8!WWru3_+DV-(Hz*0@gnv`k^JKs`GSxrsx9n+Pn%8scj zNjBUka&4Zx#b3(OubEeF-q<9 zJU<5Uy*X3;Gf|gSi2VY?0vVSV$_5|b6AFL+{>+%HzN0P0j7LND1J4IRWHa4iyM(o! zkOsE{_{R8(8$HtOUE#B| zkf8%Z^Pr6k|3I(~h{zFhdk5VquUT5>Qb{r)5I>8zb>T{JcABE7@ky1pnTmo4lSdLl z5#646bKe2+3oauz1|i-?o_Ec=9>&6!cRezLNboL1fV znjwE$#dSgta{|?PPBsyz;!rFe|3l+%1mG%`cJL&C=1+z2#b(Yn37gFo!G~e>RzDToNTr z;*@`QN>+jD^L*h%Hs|qlRT9o#XFZDhU9v7G$3LWk;3*&xBQd2Cj7#jd5wFrX~uik}0Ta4O(Qh+ZE|@ znUR-MDyx}Gs%?g9@k0@JrK+EbnxW>`q&Ktz3A4YbNVn@6dpSKPr_X~RV)$*6}YL z4ZkzX|2D9{^(5JV9Nu4^o5z1KR#O9y7P04*ypOO1m-yZgC>va8*3oHDu$_k%;sj zuLwniAy=2D(T(#USnTa}Qr^%;C(Ie!gS$QX*Qw(?Kj8%GR8M__{jI{DmhTmO`fOkB5TA8&BAR5r=d^ZOf%rF!CAoQ@|Kaq(PL)T*E^@4s#_)O2tHn?}Yi0l2%4TLEV-8Oi5PM})SUj9NC7>t7buq5VZp*TD zm*hA+Nv2mUkJ0HoWx0hglJ;F_p;1VQwTi@|(6SCsTJ@~)co`^kQ))gz2bOukEStmH3`_8G8 zVMsQ;3Y(@eUspuQTcxJTK9o+ODBU4$!gDB+ zl2uY(dg9RVeLVRQPQ92GPn z)ZjF}cFan04?SH^?x7QfK<=RzZd~qh03o)_@kSy#Kd137B$cmP`-*`OS-JF;1t#PB z2!zWnzpix!%l|1WBrl1eQ6gAF0kov(|B^(Y8v{+m1EA?a5&)L~meO`Y&Wvuc{+%%r z)jmv)J+&&F%Jr{!>|xQVwyFgTJ0sD#N3MNyYro6o6iItJ;!>A>rURtLbqEat|J(z_ zy_$t+Hfvv}4C^(^CrSu4385w-)OH-0>jmsM9Kh zf=fbtq>Ltup7=~Vq1jfRvy{eLmLtiAT%Zi1X-(FnzD`uM)BnCquGT1@@+8d`y*2Je z!O+!h);>Ct;6EZuGJLkn7tDq~<-B=1i!@HwV|rY~(7EH|cZ^BXsdN(mR56w@=S(KK zyfu?){wJ`igZcc5*}%g{z0Tc&NMtPvqfV|lfq;3?KeHAa@N8I%?|+R}dF!AWEAx=p zZYy8-AgS+s#szl$kn@%iJ0f*0RyR)B(lGWjn8d!OV=QVF){UX!%+TP( zGns5wx92KYN206XG61f#D9A2JR&Z^o+S7>h0v9iGRqsO$3yHKWxpo!!9C>cQDecoG zAXo0!S*HpD5A5YQZgQYf)^YG(tk5J4!6*n@p@O#gN&Y(P8e8C#%VHbeLB)&1uXjP8%*-!r4|Zz*apLc%k-vS6Dvl?b8lLAFO>D& zh*?zdCn0z%9;ju50O<|u)1ha9lj5^>5F|+RZp4)IV_tis1zi7%>rovB@(1LR!aG=t z+ed4U(cb|KR8Jz$-d`gu5g9JDfdmqVOLm!o3G#Aazj#M7&lxvr*lEU69gEUuDyh71*=BYJbPPN@ zZ#?7qqT^kjJP?%BbC z9(h;E-z`IXDh1(g2+PNWK%Z@2_}N+-@L#GB#u&S}yOYmpw`y~3wM@H?_;7Bb7=gb& zmc=2L;uR*~g2amx62wg7LqiPF+j|z$RfBk_edK*0ynW=2OCe=QY{G0agG$2F_f-5C$qF=vQ{noUHhY4PxDMj+V)#GH^MI~v*? z8KCGy68*yV5GpR6W3Y^>>^nyM_et$=EHfhIm}asV)iN;+2I&cPR8?(Cl$u|YLLz95 za+pD4Y=M(-SFuqX|&@FMnU0O!z{#3H&4 zCRRJ92G&$0AC57mNVXiTPE^Kg~*9%2Z;DZGsTlmGHBF$hbCY`fD_xwdH=StB>O0HX-ZE7mZykc3Ek_ zbfYLkElWz|)droqTZCgSyb@*fd6~n^!On!5WWbG9L$niw?i{aj?`k!?)uAmY;6a9; za17Sso9tZEI0Hj|X~OPYNO=os^c&xuiRDNn5_b#m$^_}eC+740=}OjF?M6_tjK0>T6+EXojLhZmXgR|&7*hx&m9L?N)cF=_>QXxR^Zbh>%eU8t|B^{ z0d@Qxg%Q?$(qRA8i%lcRPfPY9oe3^v&}ZxiZn8?D^5>dVl>Z^XU{EQe=C)k01L(w@ zPA$;~nGbzsttBS3zesQ?F>Yn7`%HI_m7Il5e_QggSIxRaUR@_uxGg|`Y9RSGn$DzO zcK6=C=#?6Bt2GKY;HQ9oWMS(3id2JP1mFqR;Yv_Ftwuv6>itqdgD9lm+w^iu&xcdZxyIma4{ObdI+Lce)!CUXUzzW9bORtR#nTJUn zMWOoTHaf(wSgo-uo(I}aGu4a@;;vn8zD=9mimZCv=RHo5v_I6m#Gf4dR_`{?isbL7HwlcE>{udSb+z5xD02gr3n% zV_Ci6%A_~oUzYkXyKLq5;av>V_4yK@3As~{ftTKzcsppF)6Z2wIu6gZ!vlUT{NLg? z4!l8MWfo)8|&p1K9 z-^vA-2ESUE^zo)Atc|LR_h4*zH2WZCZ2rZaLdf(a`8~(@*?Zszu>9yy+vt)5u89Vx z7Bk3r#Y?~9#858DR%{7Z*vC(eaXK=}be$I(hI#flO?&%+)%^G?E9gcDy{QmD+;vEV z1Zk{GY;cl0Nu(frSdh(^ROz?-N)qwoYAne`QNl{!e4BT=iZ@%aWbRI1PP`r{1vI`= zaZX0Hnj}<%y3OhR?Imec9ROG;y8uFAP&WN_tv6lNcZ?85c1aZyIS z%PXz}&%V*xVWpmxfVNkAavh$iCb_GXX^aAMH=goj3lhQ+88ycecO`Fb3i-odVnr3n zA;QD|DtDe0J3&?oU20OYC{U%&f=(Y(g1IS*0&ojY zZGLBYT$8h)o<@SWnIov74W%bv1q9M(j3G8h+d#I#dcBE)Hw7-nFv)=P%aCU>cDU9a z3bLKXqk)5+xo~Wj61fbR4WH4kF$q$~hncvG34;h6UDHFE^U;;c_x&kwbV2uD&l*|&-5#L%(;HUl zxHCqumD!%SeyU}i3U$Bb8=0qtx2T@9VbEjKRld{^=<&?}0BSM2^|vAhz2;)RdK?>U zAP>Lu4xW!%3$J1g#Sp~aXJtmy?hbAyra#mDsde{V3+gX_bMjvkdSSnE{LpE1(Z8B6kS!t}sMAg9wl)9iEufvEYQd}hB^fKxkb;UZ0ZE++Y>WC^+a{7TA5_S0> zTv32Z^^}UtK&cs&+Ux3+wyln2WXsT72UZ8WjPV2m53mIxj_hTX41|8aMzkbB%j-IFy5CPWli(1hm;mNVhg7?}P8zGx_bK2^}9WcB2Un zJ}n^$z3R!~uPqEW==tT6^-C6uDFff5?R@!-yXx=t)10qT_jO>%M^N(fjpz2fZb>aj zoED1;VMHii{$|hA4+{N}$tWzG7t5qwJSi`|LV@R{${^f6006HpFP<2U$h zn*m3o-i#$1Ui)I5=2ZBp`x+a%1~FRpHq1vn2M1_ycl}~Xs&R6>h7=>I?LqplGay>r zv$>s1T*5uqf~&Y}=9Iz?%BPtN0U+p@U&|j2o-u^Y_*NGryEvvIe{vI)fmI>@CF`I z(0VgQ;2`w8$#59)EbX3rp!pHB876=hA1|t!c*F=t-P=n+y|DCen09Y9ofOV<6G5qDW#S(+BPFl! zlFeU%kE(6TuN5@S6$u{7SPQ-5VJm0abe!_FO%GQp{d&Y2DceOB8eTP`7RaIXC%vvKrUapysjisV z>lO`VLK%IWa3OGQu*UKREm)tVr3EkAjx0<%i5Z|2U@Z$+jH|ozpfHl`k*w?O?J$zH z9Vrq&KjanG63ueNc>w9n6p{W}1sX56ZkU7N8rr)KHPbse3nPJr{pk^58kcA~4Dc^` zDM7gql315%>9^mBVRA&d#`Sp%H;BTr3!T56d2~>wrr^)sy{@FPcV#@U{Y7`3ev(p# zwIQV9z0t{s3!Yq!BsJ=bJm69WW9hmXRaT zf?-!IR5zU<6V^#xV(IK2>WF^M(|adp(D&XjV>}MFz9M)#eZg`E;T;69Xtg=CcPNWaZl z&gUS&i{KFP!#CoaDkjyXlgL~owIthBIjpY(|1^apY*{qEG{39%C`&fi|ON|`W>QMhx`6V2&kCEoIlA@w#5&O9~ zZ&fE?Wh<0r6OMgJQ7EPE_^b~0&6M#?Z2{s84ek|$aY_ z%t@C7#hFj7|N3>eVe>uGg0OMPjicCHnkM8pRN3HcF>5ao~jxU%)9s$zJ___25llu<2s!D!$CiBw#AB0Sp1@BwTlCy`*Xa zp>e)W5*wjmUY4~pacDE44>9$82^ZJUpgpte*L(2z65>#^dt@koy zLfsjM`IaTpa`awgI)SNnb>^g)i!(XIPIBim8H7VG@nz4*>*s6ZtB(em<$w#nr#oHx_d@FOU=>GhT}-M&g6j@m>7rhbee+t_kamsEyL@2#=X7 z=SR!q-EZ%o$F)13&jUt(ZBc5%Sej7KE?iN_*pCnG5vi(bO0YcPKdnaovb^Nw_(|>i zU*UY7bT5IJM!@Vb@?0E$5T1Lhqj~fG7~^9U8SMXaqWyz?HhYWV&T0x`C)i9d>yHIE zdt0f@CRP+VdCw`_vtM(bCp&jCzg zGjtfaxVF*N=ztx+JpB*Ou3rUz=5Khy_!ojc1v?^?E)|znb$?o?*rk`~k%mQ= z(y6w_b&WL3``a{kOk?yjDYgAUZg#A}i?Btt2 zKI*Ext@olaZ1DnQRQ}ku(hLGQd&baZ;Ed`v>}b1~-jw()XQ3+#(F#v~>B`N)O3Fp< zR1n3(Fb|T|QkCfFUtFIdMuz4%YbNJ04CtL^>Z;~H$joZkLN#MINO{)p3nD2KJ zXEv%0dOwdBK}7D?H;_+}M>gaecuIW((h~!Ji*WV*Zm%6T$8Xw2B9T3j z5LF}x%Ce~N{(Y%rOyP0iGjFSP6wRuJ|J&&PH}z3=zSSNZH(9QW!eWWW@=Zw}N8JQ!h064vM{diw zP53{!htj_3Q9~Cmnbdi5L#u*_2N}#59)?*#x+mwQJ5^eO@XPZG9EGBbn)hhq^oJMK z!rb64+4=9l^rFZx1vQ)&;ETBMF^{!V(N1uRh~6$DO;oMVjd`a3M5zBoQNwW5K1}nw z1Zfu;mS+eGgd_qO`$tBmDy&m9HF@naA!~q7vz@G~nUXyk@Omy+ZSIHA^u2b@vrO#0 zL?{{ZwE9ZW0(>YK3W8N_CG~V;SctW}*7K>s-iG%vit$j+It7 zejEB=(nipV0}U;NX}ub#bncb>p{LXCau zX+OYBeYoiFgqDH?s)p#!4kjk1dSk;53caFAn8>v8f4kWs{!Gj+aEY0|65XZ0ejAZ9 zu3Le4&-RJB&FlE+-Y&Sw>j-1I&7=IhH`x<*af(hJUhhWUb#4KcvEf-0&^YYFwpO2y ze0+%I{n-LSLg6iDdv8b<{=^__uS73c;77zTz(#4OJv`aAUepDD_2OWAD?ihaIJBy0 zvK7h~Sllfs^jiTS!4B*B^hPRW>Aj(O9FL%O^85Z{e-%07QOuWb&qQ)LRv0vVb{Gs14ma|Iy(~u1wMBMiLsl*6 zjaTYGVs<1Kfg|K(XXDp4a@3NGc8EN|nuZP@Nq!A1Oe#`#7c2eQB>^DqSFPSuM_>F$ zF|G3PL&+);V>p}2pKQx}jecxg`7{#D(vqTXN1QV4Vh);_7IKaEYcjYjwFSk=!WXiW z)T68`=}zeT_)hxoU;QZL7*DQCpJ;lD#dl`)9hg%>o!pLIyFZeF9>|~6v?LWw@hk)N zJhW5ducRZ@JSnv*Eq669v6!*~Mw2I0?oDN!5(Q~6EeaJWrTlS~=zwHA*x&8npofgONzqk} zKk>;(>+!xt$zxXA{j z25>%s2?rm?w;P(80^nZE;-n)*Ee`pde6x`{_exFJU?h8_=Izt0ev4+ZJzIob&IA77 z+z?&+O;4WT1meILe8)}bW$tw?TvI)-RSYgzwPoZV2`M1uG|oVpv6VdjN(eaBj2N^ zt#SWzt}VEKiJBWnMiyT|uRSBG;)mFZ3velP-z{{BQ!==ON+!cBGTwprXTf90s=y5z zLkaZLOVm8s;pAT&N(q1Ch=g$3@;EHp-rPCKELOMAN12$7 zh@KS9=16dgq+aHOEj6%a`9WsfSV?uW_v$E4)pRUE-p~`YH!U!Xd5tuJSw@X<0C&Ga9B9eiQp0Etn|CT^4;rl`}IR*V{@EcC^ z$(~4v)IaRjG~C63qSQeZSwe0{-8G#pGKU1}azQ~+bU((2N-AGnUf`ec!VQ!IYiO$k z%+|V}#e5@(hFQtyHoJ`Z;h70&fBo=*!)+26QExe{_zLa5o4y7nkiZ?Ct(rAf4NIYC zv{E5T;{FGq;?z(I!c<0<$LXLcp3E)shJwRxdNL0f-y8P zCM)DBZl5X^B2EpeMT7E*)bALPEe{j1PsI8$9(II?!LlE*h(0R>LzcOFK%PSUC5ag9 ziTft=hT6vgjde#y^D5}6w!|;cNJ$Y$VE7aq)Q0TK-s+x_QSl$u6qEh`QB4kCRFi`i zqF-U_CB(bnUrx!Y?=gJLJftEIh*w{y;w(dd;T8jo)@$_SD>Le!F04|(d+wEVj&?75 z0=l^Odgq&cLpU#e*a0;Pt%l0^n~&GM=yW|?7Z{%zq#MD3=X#Aj6$57>0qw*CjUk29 zw$)NW~)e;G~| z=@#d-f58^iOQY$+i_wc(dk`(!ed**uv-5*gqSlmf)ldanu!{qbu!0mx1ZqtKM$=81)GL7+pEP<8Gl8+9{-oA(Rovvl+wim-y2w%rMiUD;F-+_4|u)U(|_c08B!lC zsUW>@?&L$BpMXqmulYcnr8(S|@XPHh*Qeq?e>zjBW3)h<)A}#w_{l=&wtu2<- zwoPPX?8-r*=c?vJj$hH$<{T237yapaDFJi0b_w5p1vXyr=?mQ5(1XA01>M}bYzf|; z11mQ{I$D@OQbf=f91~v3x2Wzl9S+=2|zx1aVji+_OEuN7@HA7&g)C1xKqgW$h zeVeiQG;#d2T)N^)m~Y>F&O!k!8_;2>SO~#Q37goOD{BjQ-cIum6x)(OVhe%K6O-al zw1Vvf*4IAKG@T=T&f!qX!Qe*Mm|)~9I6{~5@Oz>-O%<@{nqJ6|zMR}>>wSGIUF~M& z|8q%F>IVnRJ0mimF_MgQ*3uVh{N+tA;(+3)UF{XxhxZ#d>AaD|5v*8&gkb>SZzwkx zm}ta&SpbmJTh{+$jMK2@tsValU_3vrs_<1fMnM7YA6Jt*q^TXn3-E@7aXX&)Ad${Y>muvTfbQh<|~*H9WO<2YSI+<%MD;q^-Y+}T+u&}52d%E>C76I@{QGZ5nD~wmrIGcHeIBzB9hP&VPWO*w zwh1lE*BZ(RZuCXuNMDNqXa960wb(L{pJke4f2y>F1RXsx4ZZ6cZ(xI|wW^*;X3Bch zqUN8H>im5_Rh>0KizCi1HYG!?wSeA{nteY%Sbd464RUkvztGEmrtB+#!#^{SP^uDvP};^Clvm5G9Gq$B(i6)%*L-E z_7s96%Q{8bpsczK;bh22~sTv=Z% zBWr3)9u7&!ffsc_KhOXotl1a0?y`LyT8tPVa?aOs!Q<+tpQsJ=(_z z+X_=~GLrs)cTk)m^t+a4Ra^*4a5|+co_$intjSkM`oRSbxXfRc%vB24j1ZLMSrer! z+sFk(4`2ncVJ4~7I=^OM1g|hqy4{Yz?`x1H^-yrW`HKTKnn0HhR_C`k?-siVPYQkb z_TRhvA3Ze=5~43XNKA$va;=_9N6GsjFL>QOJ~S}78&G?2oZy(Y6NFD{-Hds1P?JQtHG{+zaihM zqeqt|pVT{vJ&e1|4||c&E*s~(vo;CBn+h5*b7m6 z0pT^J&p0+KBZI?y(pd1Ve646!`{i*^ODg81X|1$Loq~ySm@26SI62}&6v=E(A{I;t z%V=NZlOg`$_r!f;Y^UD7%A`BvtUF`))e^zo)vYK(ZyH{%zIyb-^=%hB4x}-l*4`r4 z+qPxvgRb%hYNoH!h*YqO++4>OO9#nOdp-~~>2pJo@fx_X!u~Bcz+9H98v(N{QPKa%TmVz*$*wk_vrsQg|5%ZPk&$vVoO29Rp-Bb|WQ3u?ER}sQ+j?SbP^6YmGIl zz_Ayh!uU#`D!Ndut)LcUn9O1Agb+9luVC9W#00+x2rRkl(Kur%Ka)O*!??}SIB{WM z3wffBbRGE|B6l}A?+u4ub=F9L-tiEo%?**vX(b&oQtsS%yVP(@y6#8r@^zFZ@jCL+ zo6CwnkX(B7_Z(y1cZq1`^sY9Goujwt5{paBS~zj)K>sUn4x_0;&MdbWM**^n)zBpz z%BU=Hr(~L+9VnL#dQcQ9o7SdZJB%TP!d5~1iXk)qGiCD7@qs#@Qvw*wocU@jPXF!i6^L_KZ-8!r+^&xj8%V)Rt&`HGhdew!5O%Wm>JW3 zMP>o7+`gougZzd`C&Ek9*<>t3l{hm4%McQ^pflXB8LpHH?|0&o?=MrFh%kHbe)@bo z)g;zo+A|rMyXZ>#;TW84d+&`+tqg*LFzA#F?5#i3i)q=*G2HNt&(GMdS5BWXcP18& zjrX;S2)h~VYRD`la={ELv#VN-ZM|~0kg;DQGYq>ZTEEN&{f(138+>ivuD0J&+qmx` z{xQ$Q%7=423e3F=-dko`UKi|;oYTJ%Wa=h1IgoiP{Vg-J8{W3un(F~uh_t-u>mb?s zsnv`u`xBnM#6z=C0Vd5d_Dr@Z6QY2{u!^-nBp7-nd?-QHgk6f$iq2 z?}Wh|%HslLTs0NT6b0mAjV*gx?jhHcLFc^&$pZ$(SSEY?1$eHE6$zPRYJRZUGIvF! zPh9VzA^bo00&PuQ-fI#rM^bZLfZx6q6EK(f&C>C5m8sdG_Qwe6)G^T)9rjjN@^?UG za_fP#Z>t99od>W1{o*}qhg4niw+Q7HqHnqk88D%9pkPjaIzW zgx1bb|BxT2mq%p z!np1;4Kn!nCXMg;COa~?pmmXoH;$b7VFi8Fi*St~@G&UQ#pN+ov)0E*vde%RZWXi& z1`2cv^2w?;NwN!nQc4MSbqz^0N{Q5dclTSUJV}{h==qNS$xzoQu4quvDDh(y23AOG zK=)8-q+SB)9Ia&BEU1^TZS9N4$u!a)fedMYzBWPRo$&3zGbTY@4}iv^0gS50S5eX) zy=d^Kq(dIUc%J52)oTs;=t!ZH>vo@}o(G=XcjZcw?{G=&%$%!lm zTLIU3zN09&d^WVoiNucZ!Z0>i18vDW(@_4RVSHgv%WK{{6HQzA%hD-ePq*5}rgSve zTOl&BBEZ`8Gd%MUB2-RgS?59g+NQsdx&bXDK^nCLEo6IvQ-w8PfdDN-Ex(hKTX7O|yrj?IUb(9D{EY&~2w)RpcX)>nvJ4pbDmue91Vhpr~ zhSW*f=(I?a^6Y)lw5+KUiDho9XQiJJgK<3uIQzYlYZk*K{$&Y#Nm7fc1BmUhp zUQ$%;)17wwJ)O=|)Zv~)I+yTV5;}rR%z=={U_+{)`kZy8frG31dU0%0IKZU+cpj%- z?dWZ3_Pnaq;Lb; z3QmM|^bL)v)3B|A^^UqK-+fN_4SQMP2S(>E&d4G!p#I+Wc=tVYJ<5WzAZrS>{PpuI zem5dELxVyMcVfOT3j{swt*y#=S>42-f1U+G!%7Snh>u6ab!D$0 zCgbDh(6`H5f;oZaB&|7Q19A2l7_t4%Y<7@E>&?It+pxt(`>dooz zN-RR?KM#;0CI@UlcKE`7%b~x$X(Eh%k;0kia)0p6#Tq`Mu;_c{5@0wV4E2X9wJ2iu z7lKa3+)blV58HG)DMy179CMt$8}vKWBkM5PmglwF*mM@%5e14)YGmLKW+y=Z4mC8t zn?%wV0r?ciT{?&18Fe*RNAR390&K-maC=CC0ntrJQJN`UyTSi~L)i_H74o(Os;zhb zoWf1tw9%OKTyuzY!1NKJZYXLDdA|+MtE{ERLwOx@`?^4Q60pWhj&Ux?;(_nLE(69T z$*)s?*+FM%)2@!n?pbPPB$0ahhDNqH7EO5S8A?785(;K?gU-ZC;#hEP5&3AQ;G=rG zl&Z2GB+hs@OmiEm5u34z{V(99uTPAa7p0DbYq311kf<6FHC_*1Ei9>CpMsnzxpPsT zU{5zckV<1r6k^#p55afREx{NxnGdy_c5^%BSLXk>R9+@V>TcSngy?acqhR0E^b@&B zrT!x5Onn%ehv8+rvoZ&IkvK}={cG&VNLDx3cdjUilOFrOWcAi(94=M%wj9NL{O7|kb7sVmvXXDlG}-U&>s3s1KVYM>gfFvB^8qo< zaI+=%LA%dZGf9C2ACJ-*2R&^AmjwLc*hD zd&x_nIh0thcbMdu|1@(nbFlfyXiO;DVK3d)mmIE}vzvRwZEGbT-WgWqY-(nu8x)PK zzg386F)pfcUWpBG5F7;q6f6a12>FuW(lE~<-9!dpM9Y{XBuU3VrrCSi7S)WbV)cl< zJ;+vac-m!Z3AR#-8_^8bTE5zvnx)co)Z0-2L-!+ zY7XG7VV{akt9mGjvh7*orBo&&V=WZ;)<-P)NiTUd%a^LR!oM8yCtipFAo2r$o~g0_ zy{Z@n#XL;cZG6|%{+}o2@9{C9#9LvuPpM(h58h8$qKG=`8^pnnD$2X07}6wGaken& zVKmkePQdpj6M%EVo!BsGvpJ#aFN0yyF&+v)IK@GNIpMsbRLtmqyQXR$3e~kAVRu5M z*Hu%%(e1CHO&c5294N2d`=94K-}`^(ec$i@&hwn-WP7+d$%56u00783 z<8eemh6+PULU3ow{#GbRplG6#J<89AfqS@5OAqnMc{Ula*V_xxe}~H=uzmPP-ZyxuMBGe7M3vx_*V)m@(6H&A4GsEDPXk)Z7!Uhb7!?DcJaBCv&=#E^lJAxpy zSPW|nCN3@x9cPB7Gf!hotgNgs#-%mXHvohorV53 zCfKjc|Eulv!D58X|K~8@CjD9!jA{eMVs>Af4OrEmF9`q=;?6j`V|dvc$9>4Y-b#M! zRxP81eBFZDhYkh06Ft59Td2A(q~)h@qp7o{^7~}Akkc(2bD87v>D7qptXo8nK4k?@ zE-6R8wjJL}`PCeCBjI8=wV>>mio|&vzj?RSE7M9?htdMG`SSM3mys=rb?krGC_X zu8VdfY|BtkUN<;)qn@1)UcWq>FIF%f;fKxC|FHTl(iPf;{37zRr z@jG;T0TSDWb(qi{oP8B*axOqGskic@xOH`+$J#Zx^J}8r`F*Oz;??On<*_X@*Xy@N zYSmUY0^Da)256xVgGl~zj>BhX9+0yRR$ZIb!A^ccKTFc6KO}|Zf)V}_$X?FU=@*6^ ze8XI9`NJfce$$ns!+I+BD{R?qpjJHiOuK~5d!trI0&g&*%W3?1lG2HX1z8WCE{oR3 z{X&x9?lFApJ8-@W#_H%6F)QtDD;PX|LaxT(rs~g;7ZA<04B8rm_FA&CK|jSSh*3su2F^7*CYy2>EPJ@ny+)K;#c9Fb7WyA6;%$*JfQp2S(3LTRF#Ky*~ z!5dESD-78VZiws0RG3p($WO4$6M?v`A7~ilcfoiOsD*{g=iEMl4|JE<63X|#8xgXFQMeZ%u@YwBB&Cd zJ9f#_aPxNei;(HPh26X)!^t4j_@*C>ZPBc&T61XrQC0l3LB5}^w&|T{Ipe?x#8L~D z0!^8PyO_m_rn8@BcTc(}IQ83x%a5@O+Kg!rc-2lSM}$ya;^cH6MaEj{MFtqNtth9(S(|?4e}A zy83qTYTmI$QgXvzVQ`Ne8z^k$P^Mqr&|pa?_Np%po8-`%3J#w#V}zPrU9!I@FzujbAWW2)a{Cp@rb zF%71@9E+Uy85bVWZxTL6T*``X^cl)TG#Ya_jsZGPtdB16Yx?}DS%38PxBGaiH#!m; zg1InFzXXD62ZOR02Pq9WP!r`;^mvbr;7gX~=0Nrj!F$COFI$Xuikd?=P+n-rm}~~6 z)A+t!hb@Tl_h5_x<-Tm9*`-ZQ~F@VeS!hfr?qZ_W-J}~ufT?=tk diff --git a/packs/triliovault-2.9.1/pack.json b/packs/triliovault-2.9.1/pack.json deleted file mode 100644 index b81fbdd5..00000000 --- a/packs/triliovault-2.9.1/pack.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "name": "triliovault", - "displayName": "TrilioVault", - "annotations": { - "docsURL": "https://docs.trilio.io/kubernetes/overview/readme", - "description": "TrilioVault for Kubernetes", - "source": "community", - "contributor" : "spectrocloud" - }, - "version": "2.9.1", - "charts": [ - "charts/k8s-triliovault-operator-2.9.1.tgz" - ], - "layer": "addon", - "addonType": "system app", - "cloudTypes": [ - "eks", - "aws" - ], - "constraints": { - "dependencies": [ - { - "packName": "external-snapshotter", - "minVersion": "4.0.1", - "maxVersion": "", - "layer": "addon", - "type": "required" - } - ] - } -} \ No newline at end of file diff --git a/packs/triliovault-2.9.1/schema.yaml b/packs/triliovault-2.9.1/schema.yaml deleted file mode 100644 index 460d4254..00000000 --- a/packs/triliovault-2.9.1/schema.yaml +++ /dev/null @@ -1,8 +0,0 @@ -pack.namespace: - schema: '{{ required | format "${string}" }}' -charts.k8s-triliovault-operator.tag: - schema: '{{ readonly }}' -charts.k8s-triliovault-operator.operator-webhook-init.repository: - schema: '{{ readonly }}' -charts.k8s-triliovault-operator.k8s-triliovault-operator.repository: - schema: '{{ readonly }}' \ No newline at end of file diff --git a/packs/triliovault-2.9.1/values.yaml b/packs/triliovault-2.9.1/values.yaml deleted file mode 100644 index 3dc07ee1..00000000 --- a/packs/triliovault-2.9.1/values.yaml +++ /dev/null @@ -1,134 +0,0 @@ -pack: - namespace: "" - -charts: - k8s-triliovault-operator: - # Default values for k8s-triliovault-operator. - # This is a YAML-formatted file. - # Declare variables to be passed into your templates. - - # Configuration values for optional preflight validation - # See: https://docs.trilio.io/kubernetes/getting-started-3/getting-started/install-and-configure/upstream-kubernetes#tvk-quickstart-preflight-configuration-defaults - preflight: - enabled: false - repository: preflight - logLevel: "INFO" - cleanupOnFailure: false - imagePullSecret: "" - limits: "" - localRegistry: "" - nodeSelector: "" - pvcStorageRequest: "" - requests: "" - storageClass: "" - volumeSnapshotClass: "" - - # Prefix override for all names and labels for k8s-triliovault-operator resources - nameOverride: "" - - # Private Helm repo details - tvkHelmRepo: "" - tls: - secretName: "helm-client-certs" - verify: false - enable: false - keyFile: "tls.key" - certFile: "tls.crt" - caContent: "" - hostname: "" - - # Operator behaviour configuration - installTVK: - enabled: true - # Scope of TVK application created. One of: [Cluster, Namespaced] - applicationScope: Cluster - # If applicationScope == Namespaced, restoreNamespaces is required - # restoreNamespaces: ["kube-system", "default", "restore-namespace"] - tvkInstanceName: "" - ingressConfig: - host: "" # Host of the ingress resource created - tlsSecretName: "" # TLS secret name containing ingress cert & key - annotations: {} # Annotations to be added on ingress resource - ingressClass: "" # Ingress class name for the ingress resource - ComponentConfiguration: - ingressController: - enabled: true # Whether or not to deploy TVK ingress controller - service: - # TVK ingress controller service type. One of: [LoadBalancer, NodePort] - type: LoadBalancer - - observability: - enabled: false - logging: - loki: - enabled: true - promtail: - enabled: true - monitoring: - prometheus: - enabled: true - server: - enabled: true - kubeStateMetrics: - enabled: false - nodeExporter: - enabled: false - pushgateway: - enabled: false - alertmanager: - enabled: false - visualization: - grafana: - enabled: true - - # Deployment configuration - replicaCount: 1 - - image: - pullPolicy: Always - registry: "eu.gcr.io/amazing-chalice-243510" - tag: "2.9.1" - - affinity: - nodeAffinity: - requiredDuringSchedulingIgnoredDuringExecution: - nodeSelectorTerms: - - matchExpressions: - - key: kubernetes.io/arch - operator: In - values: - - amd64 - - # Use when installing the TVK operator in proxy enabled environments. - # TVM will pick up these settings and leverage them directly for operations. - # See: https://docs.trilio.io/kubernetes/getting-started-3/getting-started/install-and-configure/upstream-kubernetes#proxy-enabled-environments - proxySettings: - PROXY_ENABLED: false - NO_PROXY: "" - HTTP_PROXY: "" - HTTPS_PROXY: "" - CA_BUNDLE_CONFIGMAP: "" - - podSpec: - hostIPC: false - hostNetwork: false - hostPID: false - securityContext: - runAsNonRoot: true - runAsUser: 1001 - - securityContext: - allowPrivilegeEscalation: false - privileged: false - readOnlyRootFilesystem: false - runAsNonRoot: true - runAsUser: 1001 - capabilities: - drop: - - ALL - - # TVK Helm chart constants - operator-webhook-init: - repository: "operator-webhook-init" - k8s-triliovault-operator: - repository: "k8s-triliovault-operator" \ No newline at end of file