From 90826a457eddfb9eea8e9b2b287d5d6d96e85d8f Mon Sep 17 00:00:00 2001 From: mo-auto4 <100681076+mo-auto4@users.noreply.github.com> Date: Mon, 14 Mar 2022 11:56:10 +0000 Subject: [PATCH] chore(charts): update helm package (#1018) Signed-off-by: mo-auto <54212639+mo-auto@users.noreply.github.com> Co-authored-by: mo-auto <54212639+mo-auto@users.noreply.github.com> --- charts/index.yaml | 220 ++---------------- charts/janssen-1.0.0-beta.16.tgz | Bin 0 -> 70275 bytes charts/janssen/Chart.yaml | 93 ++++---- charts/janssen/README.md | 63 ++--- .../auth-server-key-rotation/Chart.yaml | 2 +- .../charts/auth-server-key-rotation/README.md | 4 +- .../auth-server-key-rotation/values.yaml | 2 +- charts/janssen/charts/auth-server/Chart.yaml | 2 +- charts/janssen/charts/auth-server/README.md | 4 +- .../auth-server-virtual-services.yaml | 36 ++- charts/janssen/charts/auth-server/values.yaml | 2 +- charts/janssen/charts/client-api/Chart.yaml | 2 +- charts/janssen/charts/client-api/README.md | 4 +- charts/janssen/charts/client-api/values.yaml | 2 +- charts/janssen/charts/config-api/Chart.yaml | 2 +- charts/janssen/charts/config-api/README.md | 4 +- charts/janssen/charts/config-api/values.yaml | 2 +- charts/janssen/charts/config/Chart.yaml | 2 +- charts/janssen/charts/config/README.md | 4 +- charts/janssen/charts/config/values.yaml | 2 +- charts/janssen/charts/fido2/Chart.yaml | 2 +- charts/janssen/charts/fido2/README.md | 4 +- .../templates/fido2-virtual-services.yaml | 2 +- charts/janssen/charts/fido2/values.yaml | 2 +- .../janssen/charts/nginx-ingress/Chart.yaml | 2 +- charts/janssen/charts/nginx-ingress/README.md | 10 +- .../nginx-ingress/templates/ingress.yaml | 115 +++++++++ .../janssen/charts/nginx-ingress/values.yaml | 12 + charts/janssen/charts/opendj/Chart.yaml | 2 +- charts/janssen/charts/opendj/README.md | 2 +- charts/janssen/charts/persistence/Chart.yaml | 2 +- charts/janssen/charts/persistence/README.md | 4 +- charts/janssen/charts/persistence/values.yaml | 2 +- charts/janssen/charts/scim/Chart.yaml | 2 +- charts/janssen/charts/scim/README.md | 4 +- .../scim/templates/scim-virtual-services.yaml | 4 +- charts/janssen/charts/scim/values.yaml | 2 +- charts/janssen/values.yaml | 28 ++- 38 files changed, 331 insertions(+), 322 deletions(-) create mode 100644 charts/janssen-1.0.0-beta.16.tgz diff --git a/charts/index.yaml b/charts/index.yaml index d05c8ddac6b..9e638819af9 100644 --- a/charts/index.yaml +++ b/charts/index.yaml @@ -7,23 +7,23 @@ entries: artifacthub.io/containsSecurityUpdates: "true" artifacthub.io/images: | - name: auth-server - image: janssenproject/auth-server:1.0.0_dev + image: janssenproject/auth-server:1.0.0-beta.16 - name: auth-server-key-rotation - image: janssenproject/certmanager:1.0.0_dev + image: janssenproject/certmanager:1.0.0-beta.16 - name: client-api - image: janssenproject/client-api:1.0.0_dev + image: janssenproject/client-api:1.0.0-beta.16 - name: configuration-manager - image: janssenproject/configurator:1.0.0_dev + image: janssenproject/configurator:1.0.0-beta.16 - name: config-api - image: janssenproject/config-api:1.0.0_dev + image: janssenproject/config-api:1.0.0-beta.16 - name: fido2 - image: janssenproject/fido2:1.0.0_dev + image: janssenproject/fido2:1.0.0-beta.16 - name: opendj image: gluufederation/opendj:5.0.0_dev - name: persistence - image: janssenproject/persistence-loader:1.0.0_dev + image: janssenproject/persistence-loader:1.0.0-beta.16 - name: scim - image: janssenproject/scim:1.0.0_dev + image: janssenproject/scim:1.0.0-beta.16 artifacthub.io/license: Apache-2.0 artifacthub.io/prerelease: "true" catalog.cattle.io/certified: partner @@ -31,50 +31,50 @@ entries: catalog.cattle.io/release-name: janssen apiVersion: v2 appVersion: 1.0.0 - created: "2022-03-01T12:00:18.4873965Z" + created: "2022-03-14T11:31:01.16446907Z" dependencies: - condition: global.config.enabled name: config repository: "" - version: 1.0.0-dev + version: 1.0.0-beta.16 - condition: global.config-api.enabled name: config-api repository: "" - version: 1.0.0-dev + version: 1.0.0-beta.16 - condition: global.opendj.enabled name: opendj repository: "" - version: 1.0.0-dev + version: 1.0.0-beta.16 - condition: global.auth-server.enabled name: auth-server repository: "" - version: 1.0.0-dev + version: 1.0.0-beta.16 - condition: global.fido2.enabled name: fido2 repository: "" - version: 1.0.0-dev + version: 1.0.0-beta.16 - condition: global.scim.enabled name: scim repository: "" - version: 1.0.0-dev + version: 1.0.0-beta.16 - condition: global.nginx-ingress.enabled name: nginx-ingress repository: "" - version: 1.0.0-dev + version: 1.0.0-beta.16 - condition: global.auth-server-key-rotation.enabled name: auth-server-key-rotation repository: "" - version: 1.0.0-dev + version: 1.0.0-beta.16 - condition: global.client-api.enabled name: client-api repository: "" - version: 1.0.0-dev + version: 1.0.0-beta.16 - condition: global.persistence.enabled name: persistence repository: "" - version: 1.0.0-dev + version: 1.0.0-beta.16 description: Janssen Access and Identity Management - digest: d5003d2ea8fef2ceab85c7e40010cbd6457e8d4176e7d8cdc0e3111cc095423a + digest: a78e34cb0ffc779ac5108632acec52d8adb708dc0d14ce210b39814236920673 home: https://jans.io icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png kubeVersion: '>=v1.21.0-0' @@ -86,180 +86,6 @@ entries: - https://jans.io - https://github.com/JanssenProject/jans/charts/janssen urls: - - janssen-1.0.0-dev.tgz - version: 1.0.0-dev - - annotations: - artifacthub.io/changes: | - - Update always - artifacthub.io/containsSecurityUpdates: "true" - artifacthub.io/images: | - - name: auth-server - image: janssenproject/auth-server:1.0.0-beta.15 - - name: auth-server-key-rotation - image: janssenproject/certmanager:1.0.0-beta.15 - - name: client-api - image: janssenproject/client-api:1.0.0-beta.15 - - name: configuration-manager - image: janssenproject/configurator:1.0.0-beta.15 - - name: config-api - image: janssenproject/config-api:1.0.0-beta.15 - - name: fido2 - image: janssenproject/fido2:1.0.0-beta.15 - - name: opendj - image: gluufederation/opendj:5.0.0_dev - - name: persistence - image: janssenproject/persistence-loader:1.0.0-beta.15 - - name: scim - image: janssenproject/scim:1.0.0-beta.15 - artifacthub.io/license: Apache-2.0 - artifacthub.io/prerelease: "true" - catalog.cattle.io/certified: partner - catalog.cattle.io/display-name: Janssen Cloud Identity and Access Management - catalog.cattle.io/release-name: janssen - apiVersion: v2 - appVersion: 1.0.0 - created: "2022-03-01T12:00:18.4698386Z" - dependencies: - - condition: global.config.enabled - name: config - repository: "" - version: 1.0.0-beta.15 - - condition: global.config-api.enabled - name: config-api - repository: "" - version: 1.0.0-beta.15 - - condition: global.opendj.enabled - name: opendj - repository: "" - version: 1.0.0-beta.15 - - condition: global.auth-server.enabled - name: auth-server - repository: "" - version: 1.0.0-beta.15 - - condition: global.fido2.enabled - name: fido2 - repository: "" - version: 1.0.0-beta.15 - - condition: global.scim.enabled - name: scim - repository: "" - version: 1.0.0-beta.15 - - condition: global.nginx-ingress.enabled - name: nginx-ingress - repository: "" - version: 1.0.0-beta.15 - - condition: global.auth-server-key-rotation.enabled - name: auth-server-key-rotation - repository: "" - version: 1.0.0-beta.15 - - condition: global.client-api.enabled - name: client-api - repository: "" - version: 1.0.0-beta.15 - - condition: global.persistence.enabled - name: persistence - repository: "" - version: 1.0.0-beta.15 - description: Janssen Access and Identity Management - digest: c2505f6a003df19f3c449382db7b327c764ae2d94df8e04e73d6444b27745208 - home: https://jans.io - icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png - kubeVersion: '>=v1.21.0-0' - maintainers: - - email: support@jans.io - name: moabu - name: janssen - sources: - - https://jans.io - - https://github.com/JanssenProject/jans/charts/janssen - urls: - - janssen-1.0.0-beta.15.tgz - version: 1.0.0-beta.15 - - annotations: - artifacthub.io/changes: | - - Update always - artifacthub.io/containsSecurityUpdates: "true" - artifacthub.io/images: | - - name: auth-server - image: janssenproject/auth-server:1.0.0-beta.14 - - name: auth-server-key-rotation - image: janssenproject/certmanager:1.0.0-beta.14 - - name: client-api - image: janssenproject/client-api:1.0.0-beta.14 - - name: configuration-manager - image: janssenproject/configurator:1.0.0-beta.14 - - name: config-api - image: janssenproject/config-api:1.0.0-beta.14 - - name: fido2 - image: janssenproject/fido2:1.0.0-beta.14 - - name: opendj - image: gluufederation/opendj:5.0.0_dev - - name: persistence - image: janssenproject/persistence-loader:1.0.0-beta.14 - - name: scim - image: janssenproject/scim:1.0.0-beta.14 - artifacthub.io/license: Apache-2.0 - artifacthub.io/prerelease: "true" - catalog.cattle.io/certified: partner - catalog.cattle.io/display-name: Janssen Cloud Identity and Access Management - catalog.cattle.io/release-name: janssen - apiVersion: v2 - appVersion: 1.0.0 - created: "2022-03-01T12:00:18.4508397Z" - dependencies: - - condition: global.config.enabled - name: config - repository: "" - version: 1.0.0-beta.14 - - condition: global.config-api.enabled - name: config-api - repository: "" - version: 1.0.0-beta.14 - - condition: global.opendj.enabled - name: opendj - repository: "" - version: 1.0.0-beta.14 - - condition: global.auth-server.enabled - name: auth-server - repository: "" - version: 1.0.0-beta.14 - - condition: global.fido2.enabled - name: fido2 - repository: "" - version: 1.0.0-beta.14 - - condition: global.scim.enabled - name: scim - repository: "" - version: 1.0.0-beta.14 - - condition: global.nginx-ingress.enabled - name: nginx-ingress - repository: "" - version: 1.0.0-beta.14 - - condition: global.auth-server-key-rotation.enabled - name: auth-server-key-rotation - repository: "" - version: 1.0.0-beta.14 - - condition: global.client-api.enabled - name: client-api - repository: "" - version: 1.0.0-beta.14 - - condition: global.persistence.enabled - name: persistence - repository: "" - version: 1.0.0-beta.14 - description: Janssen Access and Identity Management - digest: 19e4af126d7b62435439749d1d0ca7c31f84fc4bfceef4adc1c63912cc9176d3 - home: https://jans.io - icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png - kubeVersion: '>=v1.21.0-0' - maintainers: - - email: support@jans.io - name: moabu - name: janssen - sources: - - https://jans.io - - https://github.com/JanssenProject/jans/charts/janssen - urls: - - janssen-1.0.0-beta.14.tgz - version: 1.0.0-beta.14 -generated: "2022-03-01T12:00:18.4318296Z" + - janssen-1.0.0-beta.16.tgz + version: 1.0.0-beta.16 +generated: "2022-03-14T11:31:01.153801232Z" diff --git a/charts/janssen-1.0.0-beta.16.tgz b/charts/janssen-1.0.0-beta.16.tgz new file mode 100644 index 0000000000000000000000000000000000000000..8811ad8265f0b800273cc7e320c29a9d0182e75b GIT binary patch literal 70275 zcmZ6yV{|6n6ZRY1w(VqMTX$^RPA2BWwr$(CF|lpi&Y9=`u7h>@L)GqHz4oVG)w{0W zRfLgHXh8p6Kh!|9hLTE5#*(t^G9FxPM!(dUOqAIywUoKo<<->KWz}u04DC!jR21#` zBu#B>fiAm!{BSv9IJbMhXkHh#UmB%m5=?odw72ZMBCeY3zM4`t?OM-<7vae33E(M3 zV({4}yncM35`JY#L=)iglzX>E)5jA5B@h9D>=Le?WWDl08skMQqsezME`KlBwQexx z@CEv9T)95)m^1dgpGR()dv$&=K0oL7x_^s#x!nvu)bgiLJ%_8u<>pMaZxv4pKnX1!uqjGrU2N_Ym?rhL!Qz zCY3`|Vpjd@0m&wc6))Zcn!StWO(-u3xhENwnHAJZ7Bqt#;EG?QZjIC+5Ju`+<(j>v z*12Sd5Y|_{g=spQ!C|rv$JU>mhmR5g{d`x3!s^5;?L9XHTpfbJQ3-U+Yi2sOs` zw7X<*Kv0DPu;3t^Y|{j&mhi`sMuYPzFXV8{)+#9NRFu?Q-#aJPa2{l5Mg~|HOOl+>d=d zCbF*pgkbS^Z|94RTW$8-&&!6s?c-1E{R79MO~LP-%z`jfO!yMXDCh!y%+&|URpBq@ zJupWSuqO$;cDOegB3?Wc38LI!s8F&cOpNQ4fQ{%Otnr_^xNqnHlqW%VJCTKlKd+;q zr+?mhf?Sasw9hjbYvnqFbu(p|OYjsCst?V?Mtg|z<-u@_Lf=Ub>!kX;_hE-Z#F?6B z>t8$1Nsl;OpiqqI6eLB_-tnMaMZ9~WeLstT+{k+@s`woll9`Wxk0VSN10{yRvJ$P` zX=}F_HUuLv9SG81fH}MhC6HH>-vqR8Nitmr4{Y13P zUv(7W{ptlwYoksU)Vma&p2Pn%(Yf>=&<9DE;_=-zBs$)Ne6TEC4B;LsobhzM9 zZ}NlT%o2t$GGgqf_O_JxBq;SYb>_}~oV4q;D^eKuFyE3aX-cS8xICB2Qgx8d$_Z86 zWx5^l8)V%CUXxg~G5Xq5yOsz}LxVEPQ0&nTRT!^)e-f2MRvs~IJOCtC*3fq1S*j3$ zn;?hT5gDb%CIGDt2B{@M!7k+lcwZ4*!Cztxl>u~@VPBZ*K_5`2l#)Ta-w6M!ST7NmWuo!C&Bp{k@g%N2qE z_fm!llWbFQf^w%G5~@Vnxra2yuy~LH^|JF=-tyjhu}a?60Z9e8h#wuzD|BdZfgpZ@ z?IzEMTmlqD>DWvF-C06>)JlSOd0ziQ^$U_qV4X8s}#jX@EY-h1VI9qNZONV?*66;Ar)bA9R8apslk;j@$ z_=4yPg&bONxG6gUR#+it7?2xlTQ?!48^g~bIUmdw@yPLCe(+@h2f|-WlW|01Jq(X0 z@&oDnC6R=^b`Qkh#KIA%v2rf~xQy~fNSit9 zQ!W*k6d!`r&lgalc!N)OYB!nXVKq}6Yn_05nidCrgS8+^dHL>VjjJK=v>!uDM-MZo z_H?HDOV_Q1?CmZbS`?V$)9u@A;s;!9;>T57WD3CASD`-6diJ3!t#WDE?=<-!#iT5=@!rHIwJnEeqbZW;d zHbTCO8tM=;SkC$~2eyM0Qzi)ZTUvPaW+K-rwmjIMAaWrdaWvwFM7DCsQL-*fc%XF- zAKe&3s&mH>^_G2%9WLGt7&_PySyBu1Xl6I85n9NY8;4XLAu{X+B5Gj5c+B+Ni#^B# z3)P#}?O5TDOoJT)M@&#O=^mqNRH^;SkFamh)-wp@bK{ZRWdpNx%%yqkWF*rlmP^5G zJ`R}fAh;!J(z4A+&>)@%QI{rs@ zYe2L1I*vWPUrg)u2~jPCwsV4fnF;HO8(k3jWj*p#1BjQ)W`JgR` z+RlEq$Z%6|4Oym8yQ+`~0tOftu_7~^HWZhN3{M%ZqtF*UDk6Ko|8OT^IFd4TY?1We zvs{C0gc2o$i(>O}^3&tj*%KvvOaZ|eg0Dp9*_FzhZwMS(o9G8%0AS7t@B(&n@$3C6C<=|GBwIS5i-D#(Lv}cQ0aPE$-VT?tH^;)4%TRmvxD3vHZN$u5Zoz2exUgZ$eHI^}m`er4Wwmk1!O3IKnfsnj*i$IfW#e zQ4H7nJRUrWNls}DSk!b_oAKV?;Ce%)*WRKYFFa>-ZX}^kQ&OQ$0kx06Sbqh?K->OM z>JXZga@I{RF+b=O5^IcN;3=6Iyi)k12A&a($|K?hnMm%8=i_5=8LuVTu&FC@?_n@65-&p^~8Ejgwz`T*iz}5T&Y699Ya1qZ9q^ zqS)OnI(A(Zk;#R)Lt*L$!f9|iCc+-o%G3Zi45QvBNuo$0nFkX<+A&lz4{u{#HNC-{ zaYogkCV{dBpxT>d)p_|W${xHH)I{L=TeLtNhx{dvRu zFgJ7Y&!)t-yyR`u%j*Gbmlr0t(K`c6M2U(^B!;P|FRhz1NUaWg2Z+z=%P~E}cBV0t z6V?l&2Kd}onYf#)fj)Fo;~2+0D~ZTyl9dWJ(A?IEu!sx?l@GI)6xR1!a*WO!L%+~v zSP&{gHb{hOmPnFEmw=%lC+~O)Xub^bG{K|Xuwpvjv9`}r*v~0iyR}@e0LTuY8j)`>MCSQ-3cXg4^NS(@0SS9OX>&* zWILvVC{EB?th+c8NmAJYYb=&CCig0G2q9@eW#kw|85ZpOTUC;ji~J3#*&m=W&qlxy zaso+aD29+&hqPXUk^GGgA2#|Ke>f#kpiAm;>H4@L8?CEcM={!3WO>i)-C7QxSz?gx zG6H(}K~`12-DIpWS{>Lj3=aGEaib?(G!)D=!WyWwwGzob(zSKExsmK{qDvhf}D0S3VzL|hSoH# zeH_OUbZi(b?~*Hc&i2Q?diCX1?Jo=i60{b0FWNv|5=+@nTftvXksg^8Ke3z&o@I0# zU;f*Q5NUTRBht4LCjmibxJ={mB<+8=5J!lYF-4lW;<@2>Syxhf-x*fP?{XP1u;4}5 zf%h~(ZVm`x67FI1x)ks$w()ZZTH5S$Xfpkhztm1K^qpQ5^$jT3f`an|p7o}Fmw7X) z5dyXUCi(Daghs{=6*z9%$KWP@O(B|!=8;)|C(}>Oc3QzuUCD_Iv=&(kj|5f7!R5Yj ze;NLUwJz|3FwbnVU$lH8?HLX$Z;Lzb{n_FgzG3Jrl?n=kpcNQF{c?n4>+#&S(pK<- z94%FvL>U5>L_J1v-tIpCVY(oEdT*>;sEPlBkgYQWFP{$JE(4~wbpUoeb*KnJy&N7= zi>E<()ssW$#5@gWty-OBvd3lpwmmd3muW#R4X~-SNwWnTrAXD@^)p&2G&o)YD9eIbqv zz~F`))*DdcMAPV-Wo{MqlraA~Xe>;;z~ENE&_ZKu5N4|1;RYA)9Asl=N)ke5lCl1s z5wZ=9VmJg&#ZT`{P?p*GWIWLA%PWUW;aHJ$|N8R2)i`)P{q#Cc&0<`;!nz`IL=d6|W5q3uypG zWHnuc2TcBw7V&X7FrKdE0nc((r0So z)swRL%CL;oUv!zSOPqw-3Mwf{iZVSwVlKrL0%yaM8+R1I;DKYTtO7+(9 zqtg7g-xH)Pav%rQDnaAC<4{GJbWawO$UL#8E4+C6l&3ZZab`}hGCF5$=Q&5K1J*`! z9~KpK4E$LauLH)hSk_?-1@=xdwIRI>jq5kItq{?@{jt|#>vd&$EQCzdTo8Pj#N!rt zFEX7ZcxH2pO7=+fd84Aww^oI`QvV}k(G#6gs@Zr0Youy1bKohuHGPte1LIWc{o}SG zGy4E8KifDa1J?BShcncpT~7zhXwHqHRWGJdjrxdD9=dn zy)v(R6mqdY@o!r?!Q(k+Mo~Be=`I5r^i}}BHHmiAr*L02jShYnRL;kwgnX3~{8Xnj zaxZrcu8N^x=oVra`uyuPaOI?C=_H5Y93nvi+-Makc!#DD1U2=YT|nWUoy?Tsu=uz% zOgKO!n`XoyS{SuVw?71`z_8pNuhF&0pFzT|=FkBti;7hVM^q=F>Zm?m?egj6egT#J ze9#1+dF`|^U-743;ZrRcCZ#Q8(UtEQlhiV+s=u0LsNgqS-xJ`8&m zI7KW%-!8DLr1HreGNzTKq5Y6B%?K*`S|#9_w_Z4@hSAGwMn7+I`+H?(*7WA>nt(e% zK4v$O^z{&gzx|Iq!y)C0JnEX9gg`v?P2Px790o~W#jm9N{LYVKu8vEW%#*D`SlCX| zo$z`YoCT6Tz9FTU$#K*f2K2bBmj6 zM!v#9;gS#hn{rp0=g@{NPlNBIj(WgbGzjU>;vZ+vpcwM`oE8qsR7aE0bL-u0g&q2! zOyCdHr>z)-{Um9x4pC))PeW6bl_dteL`dyCBebKtS1x3Rm_9=u|JS+2 zX>Joau>2GnHjtK}qwalUZY-wQFlHR3SO;e(-&sC?EXp0{3t%Bn8uEoIB%EHvYwUtB&%8>;;6pL~IlYd#fc_qNeb+5|V_y8+dtQxV4)DWur z`#^Cwh%wSOq&}j!2Ns8MupFjc;C2h5>^7=3c&v(Nyd&jT@G+om%WSdB-7W`JpMTo% zq@rbMcHgZ8Q&)qTjLwO0{=8pkrh|0_PrKwgV@fIwl=Q_p%H(#b*r^GkE@z0NU35cN z{zZOFk>pck*wiU&lNSBMhF$)mlwZe~=-I0>dc^`Nh!z8uDG5RpZU9R>q2KNDHObje zJojCUWL*4SgD+Z80<%tvHQk@jAf3cGs%{Fij61M7tZ^2nRXLJ1h@NIu`t=ZY|C&sV zslf&jDKg`KX=cZqfU9#`fJio)FSM*;1n4o!p`aK2^O*X%MtpW2AYOJqv>*IF5^}&{H$WkB{ZHA#rKp zRK!BjHz6oX0-57P(47#Igp9AyF(e4x^6 zqZ?g};4Qn!51TeBoNeoENUc5+)wrC4D<<`l$H}qJyZk6v8%nI7YRK;FEvbk%G#)WVZ%Jq=4OWvCCzFJH zQ^mD)At7-&Z?b|_Ifv&kFONm--n+H?1HppD+vKyWOsm@Kv*ofSIq&&pc1LQ47COGw>e6d2B+tYNqw&Bo8N$edM|Xz zP>7u@FEUL5x;5e%?2_dX(NYpZVI#uLSQihGfV1cYp=Q|MNLgOzxg0F}Aqrio+DkS<_V z3D^_Cd_RZw*JyrXz+V!9X`7U&yUMCoQ&#{;XBd65LuFgSpXwP@EV^-xo$%%zto^Sz zed*T$w3$Lx)C%S+J-m~#zdF(*ZWiP`!hU{^T|{f+TROm3kVk@*SV)69E|_rTlMyjd z-G)!$^&C3)eN2B~XCh(Bl1GQP9q_%WxOw&-tUU4O1JNVh*XvKvaa0ixU20>e3kY6C(<)N= z8yKm`qGU;5b3jJn6)NYA)&d0(v0usdXF%vcvK=zmn=ISTvCn&0-|}q2u74L4(E1jF zpXO01_g#hh{uG2FbO_S7)!K*ovI@FmC=jfiU*=6+p0Q)|PB^YbkiMuOGe#vrW(O;i zdNj4_xGvmeQFkfVz`NZW8#l=cb?0pN5(-PGbQ7iT8U(Vtj zbl{XQ&}~k{A&f9GX-^pQgh|C)ldb{{LNnN?9QTs{TE$I|Z}@kmFMZ?0-Cn8NA8WE# z#Be~8RtKtnnpxkH%)Q@1!iLQW4)iw>I)aMqY?r;fq%P12O<(?-0T$oSP5~N<`fhTOL1P} zpmo;ZKBKu3@}HvXzOt#9s1~-!eA!^caDQCc=d6Ke`Gek@sAQ!?uqk9kbP9Q&^N7nw z>05<|{)Ef$oC?giK{7Ik3+P_ue4kXFm_z<>-T3|R{a&ZU^g5}1-r4T)?Ei6p8GO`- z?A`wS^~+l@p`rvVAYr#>ASwyYS*QwdXjbKNw7O|GUFcJO-D$a8yfZLQJ7CVAZ~{&+ z=3@JoJ&YP%ZC+Ty34Z*H!;#_`x{3@9%+Ni@XKZ)w7az^$p#iZZ=i4dlmHnx^g|ydo zMe8=Q_&fD@8%?m;D*Jq~fpW4TIe{C6v;p%qZa+oqhQH^U=}HdF1hUKC{XFkF`rD(e z=std?ADJW#lg4<~E2+D*>|i&kjtyzRksnu}#ETEcgdbW!*^(9V-jM3qI2n>Mm$@U@ zzh;U3uEavr8wA>pA`lv4l3(4)Y@iM43B16rGLFs$Y5`EY^$Ecqd7K=Mw@|BaR@w|y z6|XezW4Jkrz_~C2)m5Y3*91+r6jdLac4GoM8{^|1Uec|K6I%#=Q$4L+=tq-3wdc5a zva>+18W%7s&&fdyI$-0O+b+t-vCf36xm4@^e7W}P!GAe{r_9eGUqBgVQLLjph@p9+ zz0d8X_q&ARwyhj^`b5O9{-=P!c|k=uwbPK{wzjuC+H+F{Bz3^x-%XE)8smwCf}Qt@Hxz6rf{5x7Xi#{)YWtE#+&7Z#D}rXu@t zlzdI|sL6^H1N?YzhHLBse`!Efp8$V#Y_6*yzF$^AevLuI&E_qUJ_$y80(Ly51)ief z7?f>8f0fJpt&Zxczccl&>48(On$5T^8La~lTnmLJKSF&3`EAZ%+63L1(?xm3v4VXZ z3dU?XuYoBO;)~q3rkytsC}{0T-R!s5A}&XckuJVlFqF*-vPC%O?>_HV}C z6ZBm-h+i2Yf(#8#)yBYDYOd|K!5&#@Hajk$+NO@^Lha8dJE|saWEHffDdqnu3Bh@r#uZGpCrCBGwZgV*F^Cc zv-B$fTlyF`ZCpJ^n$PU+xOQfLyWOm9UtfP?cFsJzzUW_G3HaT8Mm}FRew|z~DtP%& zCH;u%?A}H`PZ*nqe~9{S+Y>LoGO}GoBUoXrRO$fBcH?Mpt~-kGqVafLb-Vs{vzPF> zYaMC1q%Q%E*Ig5&i9By4G69ALC-0gQy4j<$(0C#{Kt#4`6MeI$e!#u0aU>fFo@uci zEq?^B?I~xR)bqAx50;}&u1*?;td&Of4_TcU93@xF;X}M4C%)<^D=IE2Q8bHQ z_GY||bj*wTo6eCVcz#=g6PJ^Uc{*u1Z^-387mu)03xp@s=Ou)`!C8CpG-6Quhnxg3 zo?GWMCki4b!>{ACM|9lo-*%6Jvbl*1|o1cvvpEEZW-PyL<{q1-!IWi@m z)h~k-z5+~om|XbE_>kDaVGtfNbpm{;fQQy8Oezit8vQZFQ#N?1c0IxdV+ODc z2=usLxu1HWftYkUae?zG^tndouq-5o)oVP1s12*DB_`$fn`xCjOBh+3HGf?nG8cWT z``#l;A8Tl;jGf6-l=wqYZekJXN7|Us-uVvQ+sxaUDjhCiGddY%@g*YVfR`JiAgiYHf2H1g{o-oSbgB29?VM&{Nvs zL+GGT@MaEyqe}V?>B-R0HTjlXuVz)?(x_0$m{yVQg;$s&nVL(@+qh_=khi?V%0_k^ z9l&*YQc>4Sq6P)m0d9X(#>>mJhho`sK?|JVmwH@(=|MMZY@loP~@cZqt^ZmEOW#{3RChOcDoJ*@smW@%3TR*rM zIa8t(ioW2xj74geq>E~`&vAmucAESw)O#pRQ*T)$wz3=*hJ|nuh)n336ze3R6;v#< zgjYFnDP4lK(6r{Rq3%-4AEsun5ocC*&MUPkTUk`{V?Y0&LQhn%7SFO8sw2;U^EA_S zqfJ~rV};*BMQ4PMu6SOqyBItK2xgKyt^KU+&Z5KYpE%&a(D>om5{D>i|2JSG z0sJ4pHoLB>E@H+ABdM{FbUs*a+%{<{KRimA*T$#nrx5}DDcdYD6)mhv58Guql1s0? zDUnjlJYLC26$zsR?$aA?SCT*u$%9NOgiguhnn^}~o{dRFTyI$XG=b#x;U^gI%Wh_&_F__6{ z=lnoB?rZyY_AsVnyFSji#%%v-Ao?(5WC2li((7L8JU2}Rw+Mnhq*oF1lEBCJn2n(6dG+ zsi^&5?kEgZ3&jyU1p`v6YXo(2_{7u6J z&u^#|t2`pD?Cr+SjjZe1GGVV}-_GM}-DhWe`{VZT=_2LR$Ia_zaN)+R^Qz^u=xb}? z#%gn($Jq&)C4ZZn%haygJtXiznF_K%UoxF3HSghC^(R#G=U=hb&308MqldTQ$6l_8 zr+rf4TUQT7(~U!o;XvvNHxD|{Mqh-GcjqV)6+|Nme%_YGUHbMn;C!5^ZF zcJHr?1q^QG6_BKj6)md`Sg3ol!ThH6<12Wt-&8w;6&r)RHv)-^f5}vT`9U=lk|g-2}9Y5u%ko*s4tBP40l zcq|tq$>4p&gMb2~vAJtSl5SpvB4gf?c>2UV%Be)_oGuHWbo5;xsVmg(B#9MbC0Q_TToHUGOt zNOOMp)E()-5Qe0*xeu4+s0Bv_P}qof+7ZXxdJxDTGF(9rSKS}I7@2d-B1p5jrSGW# zY#_6EC4whppqHdOh_glW&WF!L@J5nFaM+v^Z~?rA!li)lMAPzg$;41T07$eS-+ita zb7kpg?W}H~A{b|1(~8|KD%AvfD_Ial)0uvFHFR8_6VXimPLe#7$q(VQ4ydRr^AUit-Mk zi^1n4jKWUUCpR^M3?ni`f%KAs@luxTi&3|B=xi?|!RiYxqXJ5mp^t7$MKNLb$#0Hq z8E(pr7r|a03I!C>}8{({Qx_m zKNY)EFJ<;(K?;QMX;_8OxC*hS04iTnjkpLP{dmZU=?a4Zu>>@jhbnG&<&X3dtP|!t ziet-Dbftjq{*EToFL4EU@TLnWPgq7I7kRym&{7PxoD=Dg{Q(%-_%gr}{jL?2$HdNn zZ0|85^xLtoT#ae5N;EZ{f%|}w>W}b!Mmj=AMS8u5S#jiQ*h-mKGl8;E%~oLGZcwy1 zSyyVJ-aKCKkKO}Tw0=(`L6ZKA=6lhK0B`U4j2?b2o++O{cvn63pOuqT5+G@YD(D~e zE#DUtS7#3oU#^d0FAsJeelHh(9$rt6r>`o%HNG<0C5REwWtp+UEXv7GJx|>3dfV60y5f0J`sPL_R=(#op2dG(>(oB(ifAQo!&y_Aj)&HQ zDF4LUlMbFFXn3u;8hIPXT{FEOTB3Dg+j|m*;wzQ8+FZkDQ$;M{Fx*HH9fuDFd8|{3 z!=Y0BJ_Q(7tWkr~A{~bzG&7=rJ}q~d)ncAV>;T2zG&dAYlQ_288Y^R$ua2-#)zh1&?*HI1KYgDV5j`chT)7J|L7wDhn zXeiO`(;iwuK&PqXf&rooM;rju*#&}zf9R@vP3)hcBct!;I8yHh>AUA%H0+7cMe;NJ z{edAK?LDLk_q;Q>h+Zl^!rx`mfu61;Ol?g!hFY+p;($!(3i(ZTnTCfBCN&X-aH$+s z{<46wMiuRt8Lx#MKQgNsn}z?)c==8vDN%Ov+Eb{F6J+$KNDt1{%4;^?V?k7G9WVku zE&_Ll3hgkH2a7Be6M40x|AU8dyhl}Zpd!@WmJR)Kwlrm9_ZPeD%b7e;;>c@p?8tMM9( zBeXkQcpdZ#aMC!wSm}DA``PcZ%eI}+Ib?E|!}^|dEyByZRkqgnVVk@BZ6tvKr|6m_ z9-lpP+}`E<^GNX3$~!INQU4#@N?bLLuhh?6KwKeeqjp7t-yM6ZT4de+_YafrfGsjH zR=!wQ+2{8t9{>iHp63c>Sm41q!}- z+=s!TYPY5TaV%<*!(aLOpusBS*1v_#l<lV)(u^r?iVu#wNH@ z1vI9Z(n;y~Vz2nTzSm|05w$;3MP-?y0vUl2Y*%R3(&H$X!lsl1bZbqX7BA$@6rrI=HDyryf--IQj#LvDXU26(9{54rG- z5W_~h6fPtvi+7*~6W;}MMDGkIcownZK(6-s8}+KNSRj>KQ#}Z>tu&)#hrzPf6HX87 zXn$MNd;;5hm9K6Vx&c3X@Jr*;`wEcwqqNR|9M>z>M_`K#8HT}bM-~RiNUJPVOn5w0 z7|UoJ!m6&_AR8vj+;;0wC8Hx$`McGFwU3XA)`Bq_RH-1)gT~H8%IQOQXn=1UU67cx zs@RS1r>bI56Jw){4mua)n(H8^Nwd34`J}!VHYl|u1D!}8Q(*;j>eFA7@{lD=gc%+V zK71<#2$Mppa@5^qyaGST6}-=P$$^gwe?ALj%a8!az>5J%kiluT)r_ssf9NX*6i(S@ z{&x8z(6Q)&W89{KAD30wRF%difz{4R7Gtot$eU3;*(n1OdumQShwl>ZIe=DA%$;9Y z-$r`hd&+dZr8<+L7bL?J>Os>G?Y{emL*2$3S8?Z#B(2Wy(Bt;HN22})$wkD;X|=m; zOCnIR3=`i2O>kVnPVbR*s36qAV9YscVfrw(4(4B=8WvI&hxpz+ruDQ=%C(VbKn zxMFY?bC(S@)w2v#3BF08_1Wq)0R4A6P7k)csho1)B(dNjkx3SZ3+F6z5KcsS4Gm)b zjJ)SRUz+>@Cd9MW6}jTZ{HfH@sHdO6Nd4=?@HF2qk_ieI|7+KrEta~3!?0q{QQ&~d z$B?oBQ|=Oz4Hlpz9j%hm=Caf?h82gB9Sq^#L6nB|;mI!KLs%U4I)Ucp3_h9+<3Kiw zMFHY($tYa>M;A>d;SRtW>OBML#AZ4Yihyiogv8bhX_O_{l4gd$r>z!h6XjxQqD6pS z-&;ub=Z8BxEdhA*LsQ9nW9-f_p5@77=*~iEAVpca!-0>QsM(05ukYah}R zpM@e)KsiB=^LS9an}*fzYJs{L?Igabi56I`+E5>i%$(1i%O~sa$MM8^B;cQ#hxe!H zixnRE-jA!Ni_YVJirIgS$@kNlU$5`h`?b``ll4n)uI~#N&U26V`_@8m>GAnJ*qJ~y ztTcl+mv(*6h9{Puc0akb`O^=d$JhJhS|X*_jGr|}?hpUQNA;HXbEoJ2Y3uX#%}#&q zZSGA@kMEY}yYG)k_lW$D^&S_eF^HjaB;R?#K_uk9YrLLieKx|veaoWL^oo7f3Mr3w zJ-{kvvSQv~1s?DCH&Rrbt@@D`|gQV0XZ1$Vn&5N+Sym zALV&zUv=qX3}A4#eHM0Sw>BtdXN%O?rQF%U(S^Ls19r>v=bT`Sn50M!oI0JYaAQy# zEx9ctF*0>C{;2D*S&<-)xu>{Fg93eT^LHI3qWo=!Qo@caw)bO$o*dRui}TPR=}*g0 zc`m)se#dc(Wbi~qE23%+?VbHWm=%7nvwo&Byk2I%N7KcgR*?ObY2Tz?T6*Mx@Ml%z z0SfKllSeseZvxQ2u^t6JS`5LnY+J3fd3%;=gvEpVT8ps-zfa-eSICiJY~;pY$BCNX zFs*Sdfdx)L%@zy6V8@Kt?G|W!6-sbcDkx{ido**gqq ztZCWt+9=a8q2@9=K|!ecXj?<6wk;DcCKXWCFBMbsi>hEh>ha2->oRQk%{y6|*=e62 zzcSLugJd*{s}A+gRaXc*5`E>X!-hO?B#=pl84J;jm7e&eAp%v|9nK=DT}I0|5SnQG zTnp2{f9olY8)&poDcF@K^AG0x!nDE*Kja)zQJ8%5(9$j_-HV1&l-xcP$WI38pJ~%! z4-s0WtMqsz^xxevCVdo}=>m>&K2e4OF)zii;^|fPVQIR^ys<_VR1Igj>t@Z*$SaN~ z@UHFPMxy&QB!@=~HnE~`10C7U*&z<_oNzfzCge}+Oi)c;49P|)x)@bmw1tHT@KHp4 z{*A?G9J*{_#YaX3vWp*%gl%HQKS;h+MUPGK-72}whzFzqz85ijYc1L^M2mbym7AMt ze6zPtADHE6Umf(3;o57X{wC?^WzL4kS`1P&3Ats_LC^z4!*#2*c=fsf@ zk6WA6?{tuy@p3jo`-FutadMViaaK$9gmlyxBTy1rb}5#@-92Z1NKA7w7=!klByVe%YZdVZOsAFXM?;$S7+=y%wip#(JZ+E+b=*%&Lc1P5|AI=99 zo^Y_H2NX08sKt|$KB9<?Ws@zCor3%IEOn#*UWWTM3{ptaAfWT31zR6vp{o8N*YH@u>%iCCs zPgTBDZAhSZ@2Ea2wJH-o)qA&Z*Qz>^JueKT+>Qwt?)l$}?meRaEDeQg|2Y=~NcOta z7>*D+$@iKX@>v=>fU8Gr?KMEz@WSgo>+;PS|1s`;sQu?P_&e)XcKgLtX9wLf@7V5| zn~SX7eQk4U?~&o1zJu#wedyQ|xA7YQ^m#$EqPkk;bJ(k0Um4@9+(nGL-ouEw+jk7e zrn7TYcm+6%gd8K@xuLON0OU|5;g~{@{-;9}GjbfHpmy9=bRdvo3>bqp6|IihiQBdo zg-}5E3AH4Xz5|Gf#KZPP;2j_3#PYy1*7GVkC2ADrVN>*(2w`0Cax?7m z6O0Nt1P01{ouA-6j1MrZDE-AY6y;Vtma+eJ*-1XI(5g##WF0CC!c8j%zn`?v#}f^^ z=*_=@;A1eocsT8(D}`xN6xZ2{5D75K9#lEdIXL0t9y@Oh4)vtp#@B4(cd*MHif=s2 z9YW(g(a(X#!MYdvV}D-E7|=~`s8aP{7z;wmHJ+ItcJEdQ-@hUWxKByAI^%d9L`r^t z9aPr0FJ~)nX_vNJ8v`#|qvU1McWN!l-}%5-bfiW6#-d@Abe>#akpaiVF>S?ON)y;t zXq)mXCA{M%djWCY$~k>#hos)?KS70WmCD^Ll3%7UPvlP@{1@7#a&@pq$<;6iZ|IMvwo!!&p_C38brb=>NcC;pdW;yF}T#60;qXU^5vZk>?B0=zYLAsb( zI!L6tDKx!)@+*`$pcpByXUhYedtkDca%De`1zZ2bd{~SW>!Gsi`>F^rM5|Z@ z!-#2Y5|aR~s?AT0f1Wze>X|x^!^NG`VVrPORz6I~%;ttwB)_BP`}lba_DIuwMS?ve zXeougskN%)0^;uqYcZOw|MSjpGfMlvl_u?jz{cT{{r$N>vh$g&-WNq}Pe#%VU9E5B zWvyvJ2A%z(ND%v9mymDO{mcri`t`)ba{FcM`lj&s)gehVrTYJ68zVBcLOWDa=FrXP zy;kN=_K=;C+e#8sXcyIQx_>)RCC9W$ZkKgYenxK10JOn!~}=JDfu0&oUU z;tz!jiku@;hkSFz+c=IC1@>&d-5LT~*8eZE?t#gcHR=|0*|zPfT{d>vwrzWtZQHhO z+qP}n>N?-;zPCGi{ez5^kvTKw7|+Y;j;^-@Du1GBFoSs@*VydTQB0LDDmQSaS+5Sv zl0aAZDOd%33Yg#U#Pm$mpLg{32U74Hi8&#E$YnOd>orM6>6^)d8Ch@8WzQvOonNe$ z0Aj=thIl3;zXkF6G!_XR3T>Q0L$e0~6n7n(Bbdau0MNd+QJy^m;Zc$KzaI5o_#z=` z_5>nan8I+b1QC+q_*_CC%Br2~a)NakFVNJ7x#fjxs6f69AizGot{zpDlX%a2B$+ZK zG40(U1n@o922u5R%|d3;Kx*9aL~2^Gw0VHW=Cdo%Sr5R&H1CCMX^`n82xyUW8G9k; zNNe$5ZHzvG!fuTG;h%%4pAl?KGmA~(WVN-MvLe%|vQ3hfUo_y&;jg~V6OnvXZoJ9e zra*uQB`Isc(hcv0pNXEkK}hbf51ZV9v>_o9z6O-FH{SV3=1+>~*1$r+@?cj81J%q= z*T0XoZ`HI1AKRL)4vrt*;hCLS9Y9UZpB-C`RHs>+iY*H^aG~Ah>xiA4$RG$;Q_~O` zkw1Tf8)}8urU5#L>kGJ8l<^nJ#J!X`(Jk)0M}`)Oe{kH@nBO)aLJle4f4nci_}vFN zh)J)W^d5#+*Wcw4L)xPS*}>;L{})P7A~)_L;91x7bdeT&-^fi!6=(do5 zxlvWs^97q_0A-2}`L?_abJlQX=3f?Ka!U0$Yh@XnK4pSj<}*om`xdyzA7~OP%HJz+ z*Mr5JPRI;=%X8GsrANEAPSxM{ZY4Ctj@5|6x;BUM`$4DCGwTj6gVukt;%j~wu*SLo>T&gFb9oO{iO#+8IZH#mNIAFMT8m1qr#kX4 z>d@!%+ukxDJvkvKA}{8JCBg852JIQD4s%Vve^`)`-ck8io`?)OHT(2YFR^*UYo)21 z7JqQBcyTT9V}9+56=jX8eYf2nlx)3k28JkN#Dz;zyRj`(z2@`b#f6(&+rjfP|Ks*C z(A+lWp40AVvHHRhW&J9n9K0;J_QDF=6$jKcLKDr>yp$wH%wiY?zXAK(CeN|+Myv;f zk=;fV{l2Ij1NpEic+ezH4QF_G!QP1a4d-xKyuVJT>d8iCG1%K^^flgfko1@M8{EYH zA``@L58B(Omn|*WfRL1qiujP6gfvKZrZc=^4z-dum|0yX98QO#L#JvDW?QzMF*m5& z)GjuLH*Os~=2jyz@~^vztN@{Rv@_P9`dndTuK2q16HlhJ13MF}<&m?L5uOb&i{!T> zA(qU7CvuFs-yuQneT2#pKG-Oq|C>M96hSBKD5`$DKX24rZCV47jCU|&>01;X=>~X< z3|@^R`|Y#?K7_$1oi>fy=KYsS+3Bxfd?7@XKXp_d$+0cK_c{B~#`Rjn@k(_>>i@TF z+yVn&{vv6}%;XJiOd_meuv4(A_Vev5M&X3}bN}TbSo|3XCtmPydBI`n#M^NGJfUhP zzR*-PBiRpp?8te$Xl?o1DJLgHb3p9-kZ*g5iCr*mFNQIUG7nzK0 z7l_@(iUP9pvrz?wYu28CY7yg?w&vv!=sJyT7d)?uG#M?xS-s!58KXdtJIQMu^9;?a zn$Zwa3Jo%HFkk)1zU2Sn z?BGpy$At8O2az4^w7PiZsXZD@>^RH9 z)&?C=739Ek`Ytp+={2^O7{}P;Pj3mkGoMRkY~*%J(mq6(L^f;#z9j)|(Xw5Nbulha zO`&P0^r1Hc*+sIB^P!lSY1V#Dy0W#qcpuiD9t)o0i;c6ATg-D~v|YR+hc04B3k2xc zK0u}dSST1fHkc)7B^jTR z=L#u7S}b}KiVT@=lyPl#uqN>EwMy$~Beoiu%kLXAg$AbB_a&VCD2#HN^-sihgH`$EcnNR zFiIs&LU%=Ev_J*wu3!Tce+uQ*Z2bqA`tzmcpoI2<)kT8EbDm*9r9;6Xf7a59EuAf% z(Apha1!Sq98kd1$MXW>YJa1h-s)Q+B$Ulvae=oOMwh%_BvrHf-0j~pd={A8shU;_B>tqio_<5-3<0bjWQrf??!rArA)@Z8e(YKIKOaBPpYKi3 zpa7cFKcju69!v>1(M_J9ZT8DYRJ8zfr4m>CPU_}xS-`yy2 zENj;s3TVyMid`3&E0*$+<5Cwyo)Uj7LA!eEtNj&>y8c$wRzT|~Wh|LzDu~#z6l%C8 z^?k6jI(zqiFqAX`0|%RV3vmee}#RLjSukN7#qG0hg4vsaNwRf^FkWU z4rPOnN$ZdJ_iOuE7F!xt&L}!%V7_~gVG%s}@L|mC*ofF($25^B3iEQo^cYfdf+u-3 z*aQIcrT`itzEusqNr`U8X=#1>5rA18SarE+1rcl89JXW zt`27(x8D}lwkvmPtIkhK&PKp9+nmq$(05v}{r{bd;rzWa887Rplc666?-jT$rym`Z z*xT@g+BtdZ+{26dpg86(D4wxEzhlb@BjyLq5@Vf?K;*v*(oxnk!Rg??Vh|=qAGvhZ zJqxI%gQsLVnZ<@nh6ML*u^t)(OA=KgK1C}=NNNHOENInJ-MTYQ+gC~!87zBmw`{*4 z4ZT!a#in9fO^g?9?Two5k62);PPyP7xW6{i^X}V3jZ4p3!cI;ryPTG4-ci;T`UhR^ z38lA782LJdnG=>Sk8RUlLj0ADGCU87YI@2Bi7-Mj0j3qt*Op2D$cTUo@kZ31P(82Y?=^f z5ns?4Z_Mn?|$;>F(fthr;Tjt^w&jf5kI(eI`5Xq7!&G@HUNXmHe1h0zh-XB@5tb(EWh2 zAMr80u(fi-CA+&*aMNiPE9`Zmj^XTeGIpjk5I>nGUMCx^|O5AY!hEJT}I(VYr(7Lj5{e{uF4f;y6_f+j$U%S!) zvFxC8BOxZ~+J)?jKX#FYeVg66{bqkXa*-AJfS_}8dHQnw^xdemtTH~9y^RsZC6dRL zH($E)2UHLb8xSuXT6N?(*qlSj=sE3q33#F`wRtwFk&&P?B+ws@^0!JWkdNe{&>QK} zW8C(%77D{rPNfSb-NaX zQPyNay98mpN|Ya*yO3n$Q+TXt^twr!3vIWCXl~V7Ga(mZ|oWnRc@YyBO{hKPAQ$H(l)W#okUP=1F>$$t_4Dpm_NX z<=NKkDJuL8FG`R$O&5j==3H8OtT0^7Ac8r1{Vy>k%$dDS z%!U^{1-cTAsh@{t!mAj#K&6)EBn8*~ONcn8YD&U<_8mc>YB?OYNJPryV$~8lNXat$ zR*S$yhN0Vq;s|Ggs1fsfF%#@ZBjC3=v6JMX{2S~kB7DfxK&{2_!0R}un;KH)mu8CY zHmE~i*R${gR^^agl1USN;-{D&r1j(~Rm#Hjc4$Ki|^AsT@_9E7N4Ofg~KudN=xZH zZXkE0%v!a%a&`0XB6GvTcJILDJ;RgMS?br)*tGkU{IYC352A&}~I)CfZ z&HnL;8Ig2(ePnSPZI;mP$q4(<5&)1@A`naDiylK?rw7wcc-1L}8|L)(0* z!fsJ)v9+vqrRNq1iR8al)>HqyB<;Y6tVE56SuR3}}GO9TE~1ZY(O-(s_~B zWzHcQj4Jkr`tEYbfe;z&1aP=ANhrWiWE{mugh0bnWBM;ZJaO*e*jQxN18yx*IG2%Q ztour_*2>oo*!+4ZCy8%A$Q_*^Og(?C^O%e+^-|Igr)i3( z;nHfzsNaBuwW>pBfsd>E{Jb7zZK!-&`0Hs2D|56Yu&(Tm|NUPq1uqb<<9?xtoVCF4 z(h(#M10Zw|gUSzL&~{6f&uC2d7sRWe7F~KCU_vlZdoX}**q-DQSra63tfc=t)QyKQ zHNIM=No_a-Se}!eCzZ1N7K*fy=BxWM@A;FdYRT3-KUIGM`aMIk-_XkF{JPAVzIYycP5j4m|F}Ms0Q%}F=16q3-18@hdhLp}__D#mT}g~j zh>U75Zd#=(3uLI&3D)m)h;TLk-AmNP=vp(?+Szep1j6+hfn?0xgQ(Mm76#9c(VxkC zHzr0t*adnW5UFgme&ZC+Thu4&U9=0F<+v%RC>-GNBc9WcL8oNW0@s@Po#A8}kBg@O zt9QCK27{K#V!HjI%d1PNZF}hH&6!b)fHqSNJT0Rjv75$%M}T+!sPR3pFOU&i zdy8P*TELE(0hs_D!N24A zL4Ur(o&UmjTNVGW@Etbo|Ag;=EJzi06(J#}i9YnsETQ6#XkuG$kibIEKg^FRhS=#c z%ab3qJd)FaynG-n)L)_3E&jcv7pEhcHd!%azqd;hH^#V;(WZtLD-}vXX#f^E z*Uz94HmJO(^%vBuZ5Xm&qyM>7>3bl(UzZwjN4vpVjAD#n3lJ;o(^SFgD)fo-Q&&dj zfiB+M{6iP4166>=2$~y7d3?f6yDUHhHLqd`T77g~ijlE^{Wt203m3sdP|UYfOc?A? z9zucExD2H~D*lt1<=9}BS4Km}qVi*GR1)5vZp_sp6uh?M%I{|GQUzU9y<-ErlxpV| zqrQ5FB+BMOK4tm?49*{!6)O$_1Tk8R${h&WyI+L-Fxho}oX5j?dsW6~1$?P=&b*WJ zFNXz1sj&9$LhG+^=IXt)QY7*)^;Dw1`fK+fWnR|QZ_)5x=5;$v08`i~0hS{P@vAKWE=u=lxO?5Pv!RWodU4pkEIKyyr(tzs`md++$&&wlbRUBsvaw`UJQc zSs*Dll2X4ggM@tY0$`>47_D2oIod9bvA%`8TIS44C!9;OQb-PuRO$@l_wTJ*dd6ud z;Fni~VPsJMPRd`n(l{KQ`rFxqh}?mccMrjS3LXpHGl?hcjg7tWzYLZOn4S;@gKPs0 zXJ_`~65)I~a6g1_aTczKuQz`0PR^*LEEJr&n+;bbXQ(1WYK=-e*XfK(UsQaO{X|@C zq+$kHlIz=fs~!oUV`Ygr%-}z8pd!Uu=QF2o9`=p6QB97#iEE}CyO9IJ#G43O0l@6E z|4rn|{C|W53uodGtyc3n#8&BpWeY1d3ZJLtC%S`)y;e@bBY(!-{(PO2NAGR07CiV` zUw8LcBcSfJKKt2I=KrbxV{gFv2z|Lsy|zx>FreC`rzEeV9HU?EW3x0!ksdO?_?5}gASCblg)Bu1cpuEzxmoiETl)|1iv1~$$YE1p^5qX+u0#~b<*ImH{RDvmt9bHcMs2#2KlDu}TLBa` z*CV4t&Pcj_T1gZ(tT1fvB+ok*@z3Hjd-SMu>TXeC+t~H~#*mRDD*e~1r={esKlv!< zEv*b|9VOKApaxyc!1^J7?i_UCCff$#FvP+7sf~8*-_9*+k(5UREHQomw22lo|cxUFD0Lr|K(AvKp-X+bv&({~8*s zj0!Tk@KE45AjKD6U!lcV_?O?s(4f=JYS56*M@$RroSp&H4iMk|7ml~6;o}nk8I3-3QBYBfHrz5>G z>P6()d!Pv6(4W(j5a>a`=o%@5&B?l)I&e|ovEz4th}d5dxFbL#7S#=NH8I;sQzjYL zieYS?$D2YSskc-_?&w)5PevA<#XMUXBiawXQBWpnhk!1w4B|nIrofP0$S9K*ldUGM zw1R22B3p4gwpN~I^*sqaYnoiL`Ci?8(+&fDR66cpjG3d%vz=D*z!<4%(ChGgyd-B% zxi~9eJ#1n8po%s$hA70KRr<-^hhWxX{$0#%Yu>ETT!94DXT-NY?B_`(6w;n8{*sb? zCr|>2{&CG1Qgbz&!J7y|xm1vGpXZ(LO;)_b4#Zyq3<35YWu*zS1!mLpu3B76cOmQ< zXkkLwR)yn7I=|?xQ7INZ9r9OHcmgIiC0`}L0p8lUk5$u7-FXi!Q4uiD7$}lT3`9*&Y8WXd%vG>ng!5VI7qn?#7O!5IL1zVct1!wUe={4 zk{$`0Gk(^MO}ssU=}4j6dfRQ0_`}&Hd{%-nivaNDCIY^Z0LGg=8PTG0Z23J6Ei$9x z*fi7ka>iYLAGEPdct;u=G22|bt69-Mmz0N z1ojlEn3CpH1WY#!^s(BMV~B3foR(=RDTP*Otp;lYi%ilSw`pK|p%T{AGR9F#Ii@pR zo9_B(@_a3{)de7C`$u09lPz3?OO3zS4W*6Fb4U+2n!#$xI1`l{RZe zEk~6QMit0~){~U*!hU*ZJ66K{mWhgj2V8*@(Wkrpe4LSU?3^2raruO3r>RfiiBB>| z6$+OGNHm-~EfQnV?Q!NK4-iJg;e>#GD$p5GE=$Bs8jZI=T>)6RR0< zlr0jQM{-1(wp^=80QWrb+8v%l>wg{$H}^WhM4M|p1JTnTXXZKKI%X1EI~>020R2Tx zw(7s=^eM!Yjzv?|#H_$i@903Nll;s8#H$Sw__t`BD_-;3x#f`25v>>OGYKieEzEP-9=aFCstGmy?XQjU;%wvda%$!4ErAxl?K!f)er}dk%US?MtYV!a8`B? z>36qSC~!v>>^!F^(ZoK}oV^8*Mikf_-#J4)6+kC+$Hz&1C3Q&R&W8sJcmM<#jL;!O z1}<*(qf!ZB+KMvNmFes(wz|(ckdY)H@KThk^bZd6o&$ch6^Oxu09Lfqe079m92Nh9 za8sHR_;FSAz;u_MC9c2Hc8NX&F@+(c&>Me*i-jwe@LDLHR4|Xy+)d9Nupniddrw_j?w&GeTd^FQ4Obb_qEvE?jH7w>g|#FO~&+$*-K&%PWb;oaz0VCj)lh4@$q&v!t)k8BSIzQNfV+p z0yXEV3^!822_B5t6pj}QMob;Uxo;o;w`vz@=#BhTfnUI(Y`H_VnfsrHhj5HhT2eN^iIQ7#DD%KWAG}o+5NdcuT!wJxx+ly#}d>o-Y$0iP0 z==f`rJX$f|p5Hb>r#MBj60r8sXyGnAaN0=U&P==TgXpq5`aO40;o&M21DLT1Md*T@ zwZ1kS)Owi~d`+0~UY5FtHU1O6lCoFfd4i0eIYEdf9uRC(z3Ky?KH^bky^?7RXecio zgc!~Y1&KRljTeh$xV*xPnP?~0w_VH>S<9AL7GEf2)AL{QMFMqf<<9AZoeJ_Hv}fT{ zE>?zsx}ym(2w2hyU0vW}vN1DJxJFo%aDhtsNPe}hr<0To0Uii~B(5$}P4Sq!eF+F) z9Ua^YzJDc$Us)kXMSC098mN6kg6Qlw*i+ZG47hG=S0&H;;lJsuW zRQZL+0|;GOkG70y#@dFo)Yy;fpHbEGTBLg!PA_nWH5^fi1bvbxWQ)LZU5BF!fxG8Q zbi!5Y5lPIp%UfJ>UH7pnXgCc$KCcMOIu7?07H@m6>U&CUj9i8YSTT0rrR^5rH|&)Y zA7E9-L*#PoD}vtjHbORJKgz1MXZ+nkU>;hkSnV5WEuHtCU4JGHRx&kq- zj`zL`tTpm#Nep$k4R?i8Wt1wHo4CX63ZM$hk2t)Ao{Dlcl@jV;xg5rhoEgd=F5v65 z$`DDrxyx=4L@8z&Dx^%#tL|*oW2<8FmdggDWfvW8Y#J-2qvH&_sCc2{m`5AsBri=@E71NAy&X}XmgV<&5y8MK>@i#H;cvurVvF|V9;L! zSHXY#qOn5`ozRfRS+%=5*1CP}gWWDgWOB&;5ALw{PP(T;${CqAy3y+xuSmXt55N5T za!E2DFR95G`-LMrpdc1LX5_l(#JC+z1gp9ntIl@m)x3iAPVk%{&5~`?LC$> zOz-*VT;V+ZIC{Q+y>u`A#jwHa*?M<<`j_(kd=@e^^QB9-6B;fEv~qHD1cB+P1+$hv z$7+GC+oTbq{2>>KD4MmicE9?Dw=V_mJsKb-s-ovhO&xP>oIn^enKgL2{rd~f_!({S zRJ}Pb`O2d`d7`Iu=m5;s!Uk84<5Ee7_D2kO}s;R8SaEXXO%wN;&8*QN#W`BWUxJfcB zN`N=+UaN-l&{2Qwb0`@d+(ywKw1)YzBTVY=&yE!*jvWBece+{y30lqYKbrPq$`W1) z{EB#vU+0-H@Ys`s!F2&4r^UdLoB?h3!p5kGedZ|{l;ehT2RfFTR1v4M??r)6E8(Gw^$sJJhva|^p>=)*`zDBPiJp8ToOffxM|Zrc>D$1DfdUCBtoHdW9{CNu>doNj;|Gaucz=Ce zARg|{R=02COuqw5B&S6e~jC zrSAF2oE5N}_vrV)kh4)bSy&~>5my@c91zFZF_OW|^T{=kbeO0>_H9?WF3WL&060Og zZWXB8UCe7RxTY9?iNLOo)ZU}Qe#b8ODx>7R>2_tMED zaQ{jM99thEW!&r=!se!325fk-7S1qj3DnM|azzkDATk>mj1W$-h-9m88{=}(- zu$%VpCN&WDa4~jK@_+z-TW0!b_mF^o{<{a$B6+ib16L1A&+o`?#vOe&GUko3@Bqg4 zE@NcX!p|!!J9|{(xKSSQG~&}9KOwSnDFch(z9y%6^(!Y$4hrR0lVp!622Bq5NHKPP zwSI}%5*)oS9E!F;3|j_Xsl(Jmaq!}3R^GTxvd(y-0Nr10*xMFp;yIp%9g`8RFO-&B z5^C5$f9|{}u~by)ZQuNfM0^D({y3X_Hw?D;t{y#2rt~lO;v3J&VckPl!E^~V;xWQ_ z5xvDi8P64FH-)qkxy%R9{vd9A9VttOv7raS(4ereNHaHU66G4FGRImuLE;fV@~Kv$ zi7_=mxy;0J+4O`8Y!Rk_ac?%6qk41Qh`4sL<$=6IN*HT5-+jH*L`-Uzl(VG!;^H2B z&VVNWmL4OE(RR7msdfeZ*0_Col|{9Z{9|8Y5%0TUs58+t$>=a*Fz5-Nopc$k0?}Ur z8~+SUF+>GQwr(G^FMW=2U8%6rd`Gq+9k_nnMh~jM5k<+Qmil~~a)?6x?t}QFO)*7f ztJ^#Uf{NITad!A#$@0St1t+SY%qsuL1{|?8wK`?u<3!+!Wanlo;VjZvEJ78?TXUoA zcr<*`TT07Q`9l1rJURj()C?aXj!v~}UTH{r2gy1b0gHktmB7wO47)-0O zA5y1`RzA_V@K=JquV#L(&k&(%J*?+9_|+4!P-Y8OL{-OjUj_zLyY_5vN-A9e zdQi$gS}D^=M@coA3E}YGdoZ#1veh$wy7IZI7Ho-!3AbF5#x9`Gf{<6-@d{Ia9?&;q zR9a<^X$2Cblrjxgq~+xxkRQU3s|vW&PEmQpl1s)k`#1|gH#Y& zcki2$`O6$!aeCc+0fRa@gV`QsvFm9HM;JXtf*Ziz3)B8I>_!Vk`*~{3of4tK5GwWx|md(k} zhFep|L(BBDiK(TFqot|KiS5<2jj79pZRr=icBPL2*50k{l}Ag`&1TMFpWj1tj%>%N zh2j8z>?b5qxe2m&8(a+>?#90{mfr(EU|-e@vJu(%*rzIktsI24cz6BWwTFx6?BQuv zqk;FYZU}i75jeRnA&K9Zz4x2omkm}LK;gw_q7es)68G)&^S>ab?nnVINd3zM1rU5* z1D9ggs}XX9Js68HHs}&Ni;?{c*hvyI@ZanMhX?OZDoGOWSOP~&d<*vo)nkO&ZNp1> z$<2HMxWnY>UgFhx()h=Nemo1SszXcH4X3RQNUrv1i>BD+o@Pa3=U>% z9YSj~9WQ;4K&;!o7j46yylG{aPLMr^__9R_pUr-cOcFlfy4pqlGz8mL>L7`*$f;B9P$k_ zbFwPZWp8ybn>SS}|KU-gE1z$KEOXdDwd7$XZ0-iWq= zrT`!$&TxoUhTW7k*?7N>{?XdT1dqe99au zSFw>-NkKdc9p)=k6!ysN;6u*N2jT*f;2ETs_EG*{4q(=S>@;^ax%9$l9WA;qk)eLu zd!(tdAi87}d@RM#j{rr5sj=Zp`xfoNR+5F~t)N`MUotAyKLxEaA}(bOh&YU)qzK1& z(nz|%>h`B(J{T!uvXo}+-9cMvvIW-{S65Y$%PNAULf~7%npP>J6nR4(+|K{TDHLmh zs|lo4AgA0@R+Ap8>jnAI>u8nqyELQq^T;zmD{rcE=7rQ(;j#I()#r-K+%6stK0BU3kOMGb*V%`R~+5=cbqb{{~?&;c6SIL`?9Hsh%;!M zr~Vgxlak#2!!G;uM#u9nyI}wTvJ4Z{g%gUF>hY65<(w4$a$zG-x)KEipgDncy89VZ=Eca_iseR693@ z;a^tR0J|&#z2<- zgA22PaT@*L;gYlBMvjp-Ht0`^{>5I_emk_f2EA}<$kXoXvV02agu-eX2}lw?a{f4D z5-67ZRuN@kO)mHr+Z4D;9}^*1h(WfU#N9Y#by^EGF-BlCx^(O}yv1k0Ift39Ta?tqsLPn5&@?zVmWi8&P`k-;wp{%$s;%%6Axz%%~9Fz`TZW!z;D()z&sv zWd_&{*)El@R=jZWk%PaN-&arAXG%A-l>qSwu>3lNVawWAZ~e#4)Rij7o2^I7*SY$) zM>sh-ZDMh(iKKcL`LmeQRY*!S8!9NK$E6-y>fWEL`MXQnb;*-4@k=CWEHft-V}8`- z1jf1JI7wl3h{--GqwxVvwE@q8y@@6^oNW9jIPkQNzVI$V8znLfwza{CSyn0uInWDJ z3V)&>Rc@CGNmPBRi!PK-3kWz|MVYy+b+QJsL)0rq^F&0*M`2IirZI9z*fY;l=Om#q z{I1@;=u`;>3EZvi^f&p#I&~XcX?No>Uk=9LiqU7_%7|4T9shhKV5B=Qivw9ImN|-$z`EThm~0ca5L1{rGoNf zwL)Zs-1%<@&dw03c?GB*dMT&E_dqfHI$;g)2^fkpqaxaohQ` zQ`KvXx3nH0DA6~@4;8*j;uCBrlgkp4p%k_!C?yH9j+aIYRY}cbBHiJX7+?MWY8O)T zP`!R`ZvTVMA)ai{qmB)ASyKK+SttgHIozyzZfr;!s_1TaKdcH62ty6|yk{cH$*1ww zzkE8yBqi*rr1j>y??T>*K~hYFnF8BIOEr~teJ-j8G813*;P)t&iA;zCG$qHB5S z`iFC(i-ji9!!hA4gQqGrSWa^rlsv9tzjyf8jFZs=gMR!$wJi7h6NVlHO)ta9WQMW~ zkJM7Zyc1-k4|}wA@jQ>Dxn>+|Ab;MK)` z>A37i7;S=SlJ5JChjm^glJXVntI6@t94|GK6o(^Ve^V7J#!WEaH_4yTr=VL^rici+ zCRed;BN<<_fuVQ`l0`F8aD;YVyiu#&@o-T={T`~|woX4tJ{kw==m{;XGFf=Hl{${K zihjOAES0j!vr3sUyl1q!)gQv7a6{wCchtHH)0q0i$T{XX8udM;CQp(nM`U+8LWLxv zl-K1K^Ij7Js5*HoXp}ibD@%iGOH8~(OTHLs#ze$|?W87uBy=6L;G>pEaXevORx})@ zw9ZQul!OeZKA5U$Ag_XXr0b85!h)l+@?~OToWfMAV>{VJSvy~-SNhXpp|V$!)cHso zI0i_G`PHxR6LCB4aX%&`F*)C%!A;|*AaPZ`7F%GU5OUX^eW91`007LvpN4V}{Q{f> zQb~0RumtQ`w|-b~l{6h{s@OH+m45nT3fP^3y&C`fjC!6nnf|$0x}Lsn`2L~HzPw9{ zYTSg2{A{8_(~*j1lcs|#|IEDhHoWyjubtNhnEgQ6>_jpaSj&R*&~05Avm%cYAwMWB zzO@glQs44`rD^r z%WeB7=WtK69}!>QJ5AB}f|Qv+HLL%)`_rEnzorktrg3KDD|~~e1e@y$Ivvw2M^|P* z)MN2$NA)D_hj%DJ|9PxTCe_UZ z<11qE0eXJC4{G1LM`AE-(rthHxo8H=D5fc*6y}dDP_HO`z5fxI3im|^LsS-bZB+*V zG>~8*n=ggFI&rf{njdOD0>z2I*v@?%SbT%rv6iyD28(++goK>MrxLdh&)K_e|BtdG z@DN$qop){IPm9a_caLU==FE4G?7h*GkMKcy`In!U?deh+=j0N*I1kgU2ux;(D;M1D zNUB-Xb&;B7($oAZn`Aqxmp^(p? z%)71&uqa6AqSL5{N!gS)b*7edv7*J?*}EDD@nH{Pt6J^vAMIh$JT88ovL=PcWo_Cc z#Kk7pQPZMvzjSPnld#VUKH&yrnTbqRDd>;GBa7pw$Ev^2QN&u~(082AJatVH5SHNu zBOJjq=#ozQBj>D6x}j%T7juDIZr7*JI`ku4NHo4;V-H(yI;DS!d9fk#=KhhuPYdsX zw)4|FFXrPj9Qg5Ow+pu9XU}@a#@ka*!-8A#Pxhf(-niQO&Q1??6h_9dtjn=t!ZZO) z_}Oa}Lvu+XDHUdCbfpnHUd$25{?t$2TtBHT8ErJoJHs%cx~PwjPddDMMzQTh%2O+*8d0?ZN(!zYLgtk*22wabE{pVso*bR9-9~*=ewr#vv+NCN| zd^RjrB;k+hH~9nf_q@$)L6MfnCi_2%h>w6my$)3vzUWw`cvM8c8<&Zte=W?`KGiVR zF5=VA6mDyHbfg38r251;p`dTnZ9lo&UNxHbr{~!1_GPxG zu>CFP_}PrOn$EY&2CCA_ZCXAzOR~Wy^XzTDAz0W=;WvxLPSm8QHgUPJNz%imK_GVA zEgR3z%U6PjmKAwVxQwMN(%agj1?^n|(@R&RXB{_jeO2=J%~$E0)-O^U%k+ktfB{zh z&EZ^yFrmad!~lDAcuyVCM8*n!w1UnJkg2*l2*nw)ogc!`;FXDH<3ZApP~6fc?V{2W zFQsp%-F#H-Cp1nmFNZVMeDmOwU(YRIFFl%XA3M|2%N3>{Gvsb66F+3CII8Bq2VgoP z)ftbIV9TKaJRmzHv#*Wq`!DIuEEn2hJKXszr!d$D83@!9P$d)@KVd^E@qW&~%`U=O zFusC(5f_RateGY@nk_MRY92QfBj71c405@pbehh<`;5Q+3>7MO@r#e5QQUqfRgQKYv+4M9F`B7j%byDAb;Z0Pme)I6klqODh#~g$Wvv#b!)2;^0v^oEqJts4#**7eZ0nx@8b#Zymsa!}GgP*=ZgP>7e9(dt zH^-~@weOvu|DETn!D0$j)B|t@d|r5(hRa-+giTAlniLq_Vh`$YlUE&P0}hjj= z(?}E(>I7j8I&#BkquonBZop0k`o?|-RZjMEcv{xkp)oyMA1D3(+bjGmd^ormS?@0T zA|fCa0d?iUI$yL`ZRW@%nck=` z3JUvLV?+s57FYtgaF*gzQagixop4?&M~rOKZa&6#Kht-YU%BK-zcXdeA`2<)K_2`4 zeNiHmP5mz+V8kFHkklP%leeij<++lK1#ol-Py!N-(J7lp!q+}}zbMk?jA+RkmhV4Y z=PVvSae-+MJRTK8p)ZPQ7H%(xq>a2!xRE9W!39u?O$-WUu<}%6oT@_&^TKgx@ zDb_Rt1!uG)agU5ukwKrt_Xc2w@R4A``rRCR+|yWV8$Qd7&?zcEV7G{YEYvmG7FpAb zRPAcZS{}qCRuXU~41Zt__RlA~lDlJbj0jOL$vaxst9RhL`2pGb%k1Z)9*IX12IVWF znOK@p+=Xrq!`U32ZNb9Z?^&8VxNXTVIlC)UE<0cCZcfHO^$Xu_j;z=-)-R7KE?4#+ z8Lzy&AGVB4P>nm0zG3a$0P2HeIj_&+R>-iz)404yoQo8SNh!~s8HI)SJpRRUIj}U( z5*4GYn6UPN#~>bdAISw7nV{V#w6idZjcMizX8M?EuHMO|ora!BQ<-N{`-@|7jye21 z;V1j+^%3hsXYrS;4&%XrQ>d%|TutEA#7u~cQYC<`KKL^O;WC;L?_Mkaai6aWq2~Eg zNI3GT_5JZ}Z)S4NhkeBa2Za0+oF$nb8u(dtq08hnzf!xqir$_Y}iG{B3N^55ZI4*tg2uScrPKgs>PjL2I7f^X+Tu zZgwN*CAx48sDR0ysM$b((ez>m9uXpr3jF9o5kc~@r5AAoM86qXNb1`$L3Z3qmW>mV zOfs%v_KL`o25x1-cpar;v%Qn8$ibELo|@D%zxzagVtUQ~6xcrlo__a8!lB#vwly*A zmZ}=O*7&Us{SKG;aZMia+uHt3IlaT~EarxDOeJxxY2heUbzTq6Kp$%<6$;ZEzN3-;|6=POqa*9X_Dwjp&5o_^*tTukwr$%^I(E{rJGO0g zY^Q2+KhOJrXJ)PWR`spcuD$m9?dv>_^Ww*98)KIOgvO}0>zdIwfbFO>`>ouNJa&l= zR~n!OgqPj6KOR{;b=5a6Y!36(agN3`q%n3Y&na{PqL(VQ1D%R~Yz??@|32WQ3_!v={8j!Z z;Tx7Ti`W?#0POOK6v%r-Qkhf(8P`AP@LU&ruO@8H6C{8fcBX`%VKXc$jR2=C2{b-5 ztmhE5xx_eBFlFKpoZ1n@YBM(lSE3@tr@m*3`V(YG1nyD{lydb;VhX6sIg6~uBFOIG z4#GtX(tyg6%|!VV8%~Sbfx-QLeyJX%(HIQj8zyAl8c>u0Wx_j9HDolh-| z^zs%|(EX}l0X9iAZ{+nOeK2KNRWJB2YWB%EnyMqI*U0qM-Iib$GZ@n@NRJCR6 zg4{nwzlxMfOhvaDvkfySsg%Vk=`}ejaxM5@45pc1WSR=MR>_C!8pN>WHy9L;GRAUBpk5vW5Pb zK}chX^J9&uZbzbI`usRfh-*v=R8(k1&ITSsb zQ}naEeqf=f#u7UZpu^bpp_6CLTma?`EW%w%W3XtIbN|C?@oe z$*P)72zTqe4M2p4OpzenOb*aX) zI0ZY9VW~3GC&@U5_^W_>VfKlqhLVy!=2cSHw?b4!e9y!!C+tiW7kv23^dNlyeQm{j zI4{R_aSas`7)#FRIO?j~aa8^>-u{vFVR!0~bS}&SNVqg61#%NwK|M^^ zByHO-eN(68)ibx0D4j?c5`qeQk@MyA0m&w$m|3|&uyQHsG+#AR&cg6^HxoSa1{`Q5 zb8GGJ4r5Qfn7-_1&oKMadBp0jq?4NCvH((e3UC|kYFmJRD{mylktRuu>?C63F}xU6 zaXJwSoPK;7Msk>hVmdmE-*M6fc!YQ?;~rU-ygNmnRwX0Ize12XC8P!XHUnnc6b>6* ziV7-~074Qr?o#!fk(;8$O@<-1FvdGQrlB@1z_*r8_Ac0wydq5+9zF7U6*<+hR0z8| zBIK4Zk)6re*4H5nujt=OS#dn2VHt#Jupn5nw$EHAld@j8)K!^@m;@wy>SkEN=d87kUafAqo#uBAb$Fes$-aFXomri30(G+C9{|0B_Xn{ zfAXUnwmZ+decAXcK^uj3o*Bc@Bqbfn`MQRblfWkaZ0%NbUisJK|6h%}YKGKJ`m+HG zf{4!^&G)KRFF+;NMgOl;d3dq?fq<|#aa$_o@~m7_t;vm2SL?euVv?~8^QwSii+=#7 zS%jBcsQO*tAN?y^_xrbiHV=>d7vOKti3c8XdpDZjBCWDAnSnYFALf@{J3Gtni(4|) z@7^y7GXVs-`2cT!=GQmdpWJ*vqq$A|+}wm`Aj=qepHdpw@%4UH)y25WQ~g=d{ny>y z3v|fCj-zM8?oHk`5mDZY0+dfk$>P_}Kn1-~N6Uj+kE_U__|U*liqu~Cv!RqjBIvKh zhp!%K=@VV5d-ACxZM(W~l+tmP6Qv%ycZt*D%@U)VGfPM3-T+qaE5aw}$q$3uqOpY{ z81H(IjgLAGYb5Tcl(FDCj|@w85Vn+#xiNH4y~l(Zi4ef}9xDkR@M3$es$!OX&eJ zKf@B?X^bBt6+UEJa(q63g#S`oAi-QDk@og#P!yP9RIOyrw zxn*6oEwd4{-(jlFF%#%W58(c=cXVduB#aHzEitMWs7UUh#oF-`#Aw`eK=K))Na-Q> z|9)NkoJNyRg#0rxqdItFUFYxdZA<4gg{|P%U%gvOB z4T`1u^}wOM&&O3Gw!p`DN&~N(_5gQIPHsM;ydMRrf>NfDe7n)7!!g7j@~BHYcSa7t zikkE9;VWkLRbC#zksmL&`}-CMSiJzUavpRq4x(yTFRjyQ1^qRk=-^*X+VR`=-@Li^; zy@u_2uUfIY>p{hXYhZR|ZkV`rwj+ooB~Ze|f4S39Sh{HMj{H#tGp_uq;5461T4e;FA+~mQH6%SEj%c+HNS2bOyc`VnZUhJZjr7jBO z-uXP{LdrcC(x998HM?9*=y}YmDgYna9PpPOg?XNqTp5&|6g8vDnLIc{MzT~@Rx-8r zWy%C-<9T^c(T}umlTUPPMi$ZgW$8l|<$|RxVRH=k%e{P5Wx?ZD8Kvoj@oxz*0xRYw0p=lMkYw zW?Jiy5_7M*$)GJVqU` zDD(-geIZv!x#iVuU4yY+93!(QB&B=Z6OmZX?(3Q`iVR4qgSeve;@!74qM!Kzz#xx*}y??P2^|5^)^90P`a6i))oJOArN32#;J-R0RbfON+TY`bi;#l+X`hXB+ZM=vP# z&B5xos@JEA5>!<9j;u{vYHjXC8Gr`;3S3NSo~JqceGY1N@Jn?79hGLLPk@WRdW8|I zM0QEPJ1wh;d1hZmX9bNt_xaq{ap~ilc$VkQp9wb8-+HdaS}dnZXJv?im+(9&c}gL^6ib)hsrsfpmc|`Du}tq_=;Yksy_#fkW* zus02;sP`p>y(H}XsHa+%irgW0EGIv3F_ufvwI=slU1c*`#9NeoR5lumWHeA=b*uAa zUF`qU(U-_-bKmHP)F#hLy3ZBR)y5bddbH(C_$aP8efdG+wfYZoCfjm}5*=f2EIaRG zp9@*TJzvvk{h$qJtSv~Fij>5iqg`aFLx4+Rhg@yvOt^i8BUD2rMM76P1lZtDu$S;_ zo?}gCx7m!$A>KEE+AhOSuSkj=v1q}Yqq6McJ#k)moC8vd{R<{Z0Vz(D_fM%W_JXF< zX4|JskjB1WzIzy0C891MM!2lW0gkOoM^9OvQT~pZT#3LN7mT9MfY?44os08eQC+v- zJ~c?HqtStB0rs_SNG1w5ns_*R%b z8SIe*_RZkn%+D-_esQoKrBSiJrO`{%cjHV!_RE~*krMl)o5@F@lm^FYHauQ^pzXC5 zhK}my+&jYtAKJ0Z@4hhvOtqtce52@*P|w^FlndQ&~8kmdGbvOcX{S4TU3?D6T}UBhh{QPdY!vYojn9dVN4kHNkp#ZNu?{fB-b+X zqnVtjtd&z8n8_V-<;>DkoVK>z(T&tL*F?C5BE4$I2Hq)S{w3PZ} z!=0w!UpnlD^tWc&wq`15c{=2=XW7K6{wHQ$TIf4;p2WhbohT=;ZDBG^d%@CJMA{Ry zG;W}Dk5Knd<~uBc9jhpZg0h2&hFzv`j8}Sf>pX+tSWf^O*s}{{$X9}|kB~m{n0kTI zLz419TThX;vNGjK0-l}hg+tf*ZlMAJ4SbUA@+oB@c-mTH@>H(9`v{W>nkH9L+7D_0 zu0lG31zCqVe2C;?G#%NjCZ@frH1YTZ;%MqzwdDFwU6raL$8IZ0YBiMEq`I194Uv&0 zOm>#Aw6f&9jOime!@6oo*Q|W%8ZR*v)1Cy-&oc7|bA3@`KAbgQM@| zkQ1>WuNl|aD0hjLY^S+ zqky{?b=jenwL9(MF5v;v?6;lt*s0eA!E^_a#{=q zmL<;nQ%-04%T9QGruAH8f*8-sCAmSaG~5|m)B*W8;vMMv1u_CI4G2U}*k3QEfQ^d_ z8+7QkY}7^M-wYWc<+UMSfIUmrpX}4_3++|Cg}rW4%y5VW>6IL*8c8fv8_Epezgzd? z5vk_X%0i{2AguFRi#GOx-nIH zi?t2kN`lIsC_zctZZ?_OwAEdH{^wQ6YcyFsL9wH2Q-UIwNUEUTIe`~twg`3 z+re(K&w=+Cl>wq$OG^Ual1<^tzcMt(t1cix*%@@mI;DZpOY91E>hmVu#iyzshHurR%boDQg`Nh<$fAaIK%iVKa812(gso3eI=?<~ z6M(Pzme?FWRVF4*o*ERv#eEXI{W6G^p#xe*tN>cqv%Bjy%nOz~1GDTh@n zFDzkQLt{szTRMn*l73O-50naudG1g2Z0U&|^zJ~gg1_TGxg_S4q|e`sk0uw(V>SEq z`yK>RY0*Z;R%6tQzYQwW57JCUv${n>=&@kn+Sk|oWn4&G9@4PSUV+~JU;ZdPwr=NC zu<5P$M(jwXyx^NMqMkL{vih_6#w5|}aqyvpEq1O)b62N|(?9CcBUMaUUESPV`CQjo zj91s*=}(C-gJeCvfb~zmYSrVn-Z0~zv2~Ead%^?D6)^?^2nL@mG)kG_&p4gt+FnUo zFEC-&9}g>4+T+E;8F+Tb(_=rZugn#ztd3%8?g)OVBgv(LhFRl;bJKq|rv;BAD~^kj z?x^8$<{aiVXi@mO+qYPogjSl)K6T>E^4O*K=@iK!HPfnlSUK1vNt=}ICSZB=%Z#^| z-9rRfWV8N`mKZzB&U(Y<%1`k!l5Gya%M#dkj+ki@tC=d`;KG!Wx0i3iH$!w`L3X4a z$BV=ci|P019xG)@B8Va;lly17CSSpr-vY^ooJ!h9GNjnd&rq37ZbZw1r6@sn_inS1 zA^JQmGSTdWB)L-?<S81JtS? zZ0$~mw_`5|pS2?_{_41Vr4tn>s#>DgCn2KPtfUWhw+bkrU0rITHxrlgOenDxB1vI1 zLaClhQMq&rKQUU+xVZD2QNXr}wqV_5UwH)Rpp8`TdSm5sV zmF>wf(B0?bKXgXr2e80~=f>16uW#AQ{0@2KV88;yX;wQ*`mmM z-hw~QFcvS=J8cJoI~RWNZ^!XwNA!V=06rOMB@FCCGuxh;6`6d?7^p|Fn3mL-jO!0w z3z?x!lJdt5n4X$yh$tlZ);&8twlR;?+94IdqT%h2V`^Bg{%G=?CSH;>w`Y+)# zEv{6P)QKV`dd;(|lkEDESI~Q}1Yu4nHMt9L;;vlkC>b^<_aF~LYYkUFP~taB1Zl)Q zPDIw{ebLR=S%Mdc>b12Ye?Pg|9s<-R%+In}mR52VY~dgjxO0e^yKDBln#=AF=F`68 z(*RAH1TVmity|mu`>w|98!-O_^`ZAO{A~FqO2fv6%mwpQeZt zBUcdIG9sMED3%<3>7DDC~sD7%(5A?A(U2X=vNacr9W+FQcRL7mlj+&#G&I)4wmIZvtpx(YxzC=l!r`r}f-CV*CBK%(INR=JyQ`?qA4IJYDZsL|V(T7C z9)iS2N6tiE1hXgOYjE$lhFEmF*TKL!va0Nu%&zDYC&+pwC$xe%-%1kp@2<+ZUUtAA z`6#9og@O%|C1qxJaBxQulovAP&H5qtTqGo3g{rdrmR|}E;Cj#I0`S=m^xglp-7p4@ z3H(c2l?HYCqJ~f@+K@@nhu)BJiDhcdFlR+>$p9+&1nun4-I+u`zd)(7fakC3u@L6$ zVKHI9_gO(I#4_=9P8Qrh1u&mo5h6`>d=c9%)dQ!ux3Apoza08Dy!nBA;}61-qS?Sjxls^$?XPq>OitJI5~0~CjnhXl^=bY8!&J2ek*Tq@LNLZ?Nr@6a zO39q%nBOjCwtB+7%ws*8VKAJ?jE7Fmj-F9B z1^fQ6gWUhBF)b%+`~SHy{h6)7VWx3bd+K6LBM_zPG!I9n0{T#ID3s>^N5|V zzCJte^jhKSjQ*3SLLFj|$93rBV4ZFj{0qyixP+9YvsUHn%k zurfrfWCs}+^w5+JwDw6OV~HQ_zE(op8#!STMU+CBU|mtua`UX`PDa~Ca5hcBCX=3; zB0qgW_c|pDm>f~g{(u$L6yg5qGg&+P9V(tTU3-PiEn#!*InF?wQl%RJH|=r~ z0>{GvDbG}%bO@T*i_ReHFE+RqiD!jvTSK^uu1I_Tm(DQZe*hk9X^tHTI>d8VbUlno zUE4x<$zC@jQUOuy4~f%=kfFmA114E679msm>S$?4I)$|I!pc%&a-{G-c2?#zWriY8reyN^Mt%wV7P%d`85!yC%7Ad;w z?@42FapVKqr`CnoW*1eOmz58Lgz$yByBye8mQ#C3f~0-IjVeyE?!`cyV;L~`G1#U= zmwXeaJeU09C;+2VWB7A6kVS0-N=lPxAb!eH)ueFvyMu?@@h~Gfh$&Ha?AHgEIpn4W z1O)na-vQ*ndYt0`xM%#v0KFY2f}l16=PFJoeCW1KcVVQsC&}6`eO^-B{LJ2e{Q1;P zE(k#ie;0F8jI^1S1L?Y!r#$TTGr#NIP#|S~(#V+UXkxMi%W$rWFb@oTKpeC)KQZ|{!4BX6}EP%l1-m_PjIOi z;SbTVbM>XY!1uaKg0Fja?!16Sz|(e;jTaEsf7|zEyFN!kAJqdbesoIXi4F5sk3V9lhLMb60E(a+Y<~h; zRnAQd8N^_`B8T~?8;Od7@7+Ou$kPhQ;>mbP4d?ftFk!l}EjDM$Qv#Qs#1yS5Sva$! zsr;J3e*3G9df<WN{ z3)4c1Ps+R5nnX*&M5x_KX$eb@NR2C2NvUTZRk3Crr0ATy{8suw#@GsbEUvGQzA__x zY%AI;bcdNV(9&QL1LC?A=}Q77A~l?SyZ{Xy1OYQ(E%=Bo;mS%`cO!@U;wzj~HO!b( zd$Uh(s#>qLU!&SDQ#lAwzSGZ^p(3rD6Kzn}bg)hSgw^^YX2U5_hwNsOs?3G__<|$@ zMTznx)+Go%L;f__how*B{=}IPEBapk3Zsxb=UY#=exjKm5-cVgk2e4Ek7nwN``Iy6 zsA+;htS}`PzMDGPY#y*99V^tHNIwutb=rbwbgu~WDOqgkB+Ne&DlULxo8ox%DX-jk z?{=Cax5Aq$!a^NHO*cq643_-mER`s=9O;vTsr}8=D6Tbs4%ds2+O{#OC zX&PjP0NSUAMBAh|SRl!CJrL0bTx%^m2~jjJ(zbA{k9-FzcoKF32>?tv%OEuX=yJ@X z3cv_zcOK1+QfYiY*~LtmjW)-bi>p;nH;rJoWmsNLsdzDjn=pcnDY>BlgW7wUsgmxB zjXxp9|BE9_1_r{S-gVm}Q>0YkDCg_V`z0x?yfP|$@J3jRlZcYf8RL)?Q!!ZP8*j^f zMTeuU59Y0IEbBcSeOVQMqIYXoMJ+O87h+r!<;Hzy5D8KPU@0I>w%0Lw7*<_fI`zFu zw*ov|fzzO9_ECoieFt-2Z68d}=bNLVxyh)Ibkqf~*JsATdeS)7|3NrEske-!4Ic>; z$UZq=Z?|tjA1hxL3#FGU1MmO3m5ViPX;{#9KK@qBOIIl&7qeFCsjOfTOAuP;dgvHX zR8Q?9hp)PxjZ0LWaav^=%^o;5^hQ?>{*v%;=sq>fFhHf{oW=g0^_|E2^9S-_9I@qO zu+2ka?0wQ_4$dm?3B0y|tiyCzRe}CY&uw9u77;Gtr0*CE8X0Eu%aZ2+53kme7DDh- z%!I47v#IXUshHL@6uVNfkoUJ(5QU0rUi3$eki@7BRP~=?3^w}K+dSYvX=#xo5X_5% zgyKizyLE-7XM0-a!ejjcs1Xul9u+LeSyRCG;(gi((`|2|`P&xB(}j%&G{tT*P@P}j z2w2IZ20bQ9sl<+}!?l$njLDZVE_sZh8^p0ktn#B5@ZE-ME3|%DC6QWFc>TQBn_7lj z;Nipl6s=5ZCIki9!VyE0pk~+${5J<<%dIGDGD3#`T?BEMp-L@c2aA?g8TCQaO$O7d~$-0H-pS+)3qnN2LomCQ_K#nl$76rEGj)OPo>k5Xt|5{-S&(^ zsr9MudSgaZLx8(zXITeJ%Eb5LC*KG7$}9ktTXv&lI9dHy1&(&N_;Yr9u61|C0=VM) zBQ#g!@m;?fYLHtnTcWUXNbF`Pp`Dh|uF5~?k>A73a;yjNA#1`f5Kq*DBti(!;#Gp5 zrw&Um>_?!0f>+u{4#mAiOFXpqdCY<=UXU)dPdoMJ(Q&6*`faU*=Ufy5F6?or1U-$i z%tN%^pWRT^jB$>oz5pdup8tWRjPo2|5V8FD*;UN*O^*2^3gDyBzwDLU@Z1gZ-nP7j zZ~RwkiC4Pb)w}pCTym$r90!2>u8*6Dd`Hpg$6^j#_uX8Q8KN%KncYf@a0m3DAf)t# z`?!BDDk{b|=~elURv02aZD>H&<0#@{jMG~2NfJRx!DA}#`};bGQJm0o!as^{t;gfY zuxFmGPd5=!VNFv)MX^FYWvgme)5_KD zY%I8g?TT|G9{Yw#T>MR961iIUtp?egCEw5fiRvlvZFM&I#S~Y^ze%(4sM9O+33NaE zef&{Z?xdJOZ~0qYE6@ooG!yD}um&)X;aS~gI%~eCj{!FJY>s~bUEA0Tu7CvxaPS`!$yFB7K=J>UZ200hDI>SGXaG~r3?ntdpCCM(=Ia}VOkBqUz7&}Nw zu(EE$-b&<>FNh(bj*MUUBt>(#aJYWpeas_Fe>EPWIax_CkqL}xQf6&TWhBw9Wur&L zrJrclU?U<4z z!h(~s3>_>WU^vLLy64JLf3+H;0b1D=7@oBlI7Qta#9yL9Z0CgyM5vLr7wm(TdPnG- zZIg3_#gnwfRiuLudoQ;Mr(QBN{6wq$c05x(#OLdzdyD`OjCyo@WuL%ko_GEwsD@DB zjji43p}>`GkM}dsH(A0b2;q?A?cK!LE#8*)g>VVaqa9^|5_}i=k~t`6 zGrXE$GP?7%=b&P;yHZ3?e?cmCqBM3f?o)(?MG_f9_rm5Du^o#6NhN)-t!C5!Lzs}Z(e?=hjl({NGLp`b?F!kH~-7(6sc z+pZv{;BT0Es2EyL(gZ857iGTU@}uMBr-k6bpkLE%lf?J7rD#fZH1Ni&nA%gyep%tE zqpIf{0}@Vp+ljmJQYkQbkBuW zzGDeMs^Q&Y0?nmKhh!+%V}AD1@x_7hC-J=!W%&n$bVvbj_!-_yPA({4s+~<9jE$}y zJ5@0lCsUqgehbFth$om_7a)A>dgKFfrQoSgdO6U=)k_}f%ow>pF@M;pI5As>1IZan zKJFvIhGJv}E zHMICHxQNIpMhm(f?1giKXz&0!k`J^2-Y<3ALh$r8g(cxsYLV5sW)iY+?A5N0-=txA z&J4>wQ>8c+L1q->-HF_}x|w0mtxK21hChHwg$J5f%$}C`&snfkLyZ%-_UeM8Z`L?w73qMW1EAUrW+cKj&;ts>r#&()Sw(R^2`<=L= zhI*h?R_=UFp6Q1VUY`cTP3Wdr!Mq)4ltA!ogZlZ!)ZNzt=`+zg4Ii)!`sCqTRzOo` zfxGs{(8U5eS@=*90X`fbFf8W&~k zuNVyv;`~9RQv@pL#|Sf~FbhVsQJi(+?}$fuY`!@Nbm?8Zv4d;PbJtj(t|uj)%uf6y z|HrlO;?GPV$!+-+rRNdEKeFaViF7C;)L)O@Y5)^~bWFAabpbABVr)biqY{wsv>v)6 zPpk~nmtdw`d-P2v+mN2W@61Q0g~42dHm=Co1q6qR7l5Nqk$d>1b}M_Wv150(yV~1-lkfbMqIvr_NfTRzB#cU#_Vlop{o6`E1VT;zt<4K z5d0W$E-A2j(~zEdOA&111X}_pgUgttW{0t@Wd?^*>Lb3@A!XqU92b9@K>>q1B>t(= z!w3UAC{)~XY^vr6SJvn^VMGD9%i3G2EH)0PgHWUw-bahIi^bN;JyPnne|MY}Em{W= z-h@%5ReMaZg1KXKyK9wN6Q_{2!81{Ta9Bdom^BslOFz}rif%7Ptr97~*6F~OmYtu_ z??(Lc(ikR%-c)Zw!Hrx`S)t8oG+;>hIgu~ZG}fXkU(M7rzRD|eBv6-}jn2f3?a_-+ zkpbk++t%28`%K82aREe7c`@&MI-$&|qosH-;eJs3!@dWL8tZi|m`eEUHn1(F=f5%F z;H{UPPOP$FS%(oD1GnVNu>&o(|3RHz6$DZv3-R2Z#U4%8u6!PmykbV% zV?5`SUpRbMZpfO8F@q3jo5#)G=tzC>TKoUh$5T~Fu1NX5dqy%WZe3-4T zp;4Xn|1K)dQE)U?Jh~L*7(-XtYpv0dB(Bg6rEV5vo05k}Ri;-Na=F-s^hEkbcS=*H{CxI) zj7@Hc;l6U`0UnRN$omRN+oQjUbkku%O|8C2v6yE#_}ZuVc>+34>)X6ewxeOf9iNT6@N9<0rW7LNnk&p$;#@o zy(Yjno==D3caXNpsLj0ANuH4zpj!!GtUy;zq6+^%-FAvGI=|+z6lAaC^ZF66&VZAv z-<>)b6#5v9f*cOCwZHc#k8`5CxvbxHoRE*ALZmhfn-V>rbCbCpRmzq~cGPIs?w{## zRisfJ-c(XDlA#kDPNYZi%D|*@j&Ia0o4IpD!duq8wyF1rzbu`gyO}%RWCsuyr!%Lb zr+Y##JT~51b*00pCM>g(rvzQX-%+k@qO(fOTEN((jkD8!!Ama~$hl_mf2UL8w8=c_ z^C$HqALq}CV(sP;^Pv%DkrlCNj9Hob0@do1u36^0dR*IO-1<^Oa!t2bl|wA&#piV? zW7b-s5=Uyu6X(Y)j4G57Ca^uu_0BKd=kMv2M9XMtHv9o5+F;Z=rRhGZNY+nBxjgD; z2H#8BxE`!9_AH^K(lxXxy8&Bw1Z~E#5Odyb^$YExn`kt{ZZtIeFaJjf@Be{7s>BMd zsoj)2SjnLvvZBk8;$llxJ3O}FLMR(W%FiQ&8{;K%K%CN}#^Of%bTH2@9T$V=E>V zrSiFtvj?S^t&J0)Z``}Bs+79U|EsE~74^uS%1l|S9oyB(y!UOJCd)Wk9u>Q~YrbzU zy3dqCFiQ?I)Vnlr;-Cp1s99LSKFqd+5hKZ$C6J-MHzY4sCF6auTM+yBevdqS7;0W@ z-Wm9A4$3v3`zP^*$_~?wF(^;u8vx4EA z7{fz$d!5t2w^jXWxY+jflvdor*di}UOV?#o-@4LHqR9y;<>4Ls6Oi6>cWrh984i_s zBY`P`@%GjDWNo4%n*&)3R9)rm**Q~KU;*SSz`pQ1dNB84aR7F8edGdftnx3v;PCBf zp76ce62e@{4&_wHl4xHhd9-4AS#FOJ2+n-qcFM;QHL?(qeGD27$1Mrc)wUieN+ow^2f-@*q`ya2%c<&W(9;agngZ^;jM}wLY0;4 zM|t!7v#=IS2F|by);y0-dH2Stc+GD&J+S5$m5D8s{yNvddz*i$ITTn;sT56eFth_~ z`NQ$>-naeyKm9qEZ}pZ}8m$5iH;BvLl{{*3EYlA^6t@{I&PPE3IOuW-Cc6LbVK_K&jrZf0aw3MfjQr;VR@CO5l18&nuEYip1f{=gN4m^z7ml9ov$2F zlNLdPdcS5q@Dd)b?a%lAA2VIJ)Z?g#`hU#y#JP~_8$yT9AmM|9u?|v{V==D;J{_MR zUgl$`qm_2;f;C;okN?%uLB|=vD^OtPFUSN6C3kbEPD$V9{E5`bq zoL`-~yD@?Xq%oN&(GH` zpQBV>`Y^aMA0HncWuOX+W6LwX)(g0y13wA-*hZdHTSO^BR+G{YMh}zx1jqir(v$~O zjf|Gz34G~0O1sDV{n(6_q;zaT?UnHIFD+qe^H{Q==!Lzk?(0mReYO<*@ar_e+=x=>@0j8Ql z&va4e)8RW6-UMSo^rDJUIGRof|--Tj2D}wfW2ue)$A}Uydz_CSU1x_ z2Sc(fpAt?AqFzViVpraCIAdM=Zx0@P?=P{Ooo%aKa~Jld;j6T@@)s?! zgQJjRO1C31U4ETmy@SUSWzn>GT||^>a#L+A^Jmx;1<;RIQmx<4@(Slu=taa&*A|4n zA)VfOM`OraRWyV^jKUBoEd>qGC*8SAxk?4JDNHvwzw3X&4se8CMtN z-L%W2i(e!sTU-iSWO-g>zd!7@$U;IiS!FH76wC6Nc{ffV6XbC%dM1tszIA?eB3jwq zpp|ifa|A%9{oDPn2Fqu^swW)k_?F*|;~2r2nkmvwF;HBy>dQX<`uk_A>LX{4Unrq_ z@txki*N-2%tx|dHJeJ45jH6IOBBw#yu7BN}%$V;0UY5;2zR%tmv(|5Y@oSHQ3kRZn zkAt5y3SCcO&GrMSD+p0fM8ps3=1FO0d&=iD*`!JXiG;~z&AqdN?2|9_XrfVHKiHHD z2w{Ko_pOqhw=``79pt*7puMc$fZ)fVI^N$<#LQ-ZySqN$!?!%)$sS?mtLIB2Qvvw| z%^Tw`yH9YMOw)!{!Lg-4YDmWzLMlF`7Qt|dlyV3WB1Qu(MA-bWar9?8u`*}obFDQC z1Sh#8K+N_iNkIurA4+TVdzSnb=Il=Sn?TB0DV}`FPDKRllrdOzUpu*&e04zdBl%A3 z0sMf=eE>JE?*#3-FxJ}aDOo6S)UhavQOYaHPH1|r5zSY(s+t4+wbPi=S~TQmH4 zv!?#DzSki|nU*?COSmTF9cQMN1%Wt7XVpj0Rd<585-a(zy9ZMC@K~WU0c;D4>I=-6LnYTpy&kb?-oS!P~dfn-K3OobnyD)nVsr8c% zjgj;9XqJ|l98$eZRJk!1ht1LEU(!++lN7y$z9#aenLXc_+`0dwBxr`B$=W0)`e;IdNa;f64u-|r0O5?BW*5!HNcy~ zkL~1t6uyYHAv;{0aIG%y20_6cq0ugd)NaC~SH%4b($i?knDY1*6K3f=+Ddc4Li7oy z1$ktJ-KO6P90{gbA)dv_UUj+Qm(M+LqAV`t*v4}r;6^Cb zELs1=TZK=4C7=EJ92Q0WBZrXBvVUTsWy4O55JCShC|xFWC>lRWCXNn`JLNBMb|=Su zG*0JYaQBT4WrE7?BeF&)q>Jv4ivgj`wvzF9XYv*omA}t8HJaLAte8^R^rPsqkIkDw z(O_cErNU%WbS((KMPde@jsh8+UcOOVVS-{&1_ zCfwZn5++LY>e6AXYk~7k~};a$NeViNQ27%>>41E zb_)QGQk@JqEGR%#$1KaN(b#*%>QAf3eUpM?di3w@;VZ-7S}wrFo9kYsPoOtX&kE3l zY=8fi$VH^`I7n9j*|axEhkwi=6`6T=I$;?8ZEaB%{|7be643aS!3|Th7Wm@L^T7l8 z)wj3#RP?_-rgw9!9~ zkHsxi49tw~p&IGMBwLM15@Fwc)Sax6!~DCS(Sb>JroAQU3Nn>v|A*h~T5x_a2wTi` zbrx0VqTZHEo_d{Sb;NHTdhbl7Em6t|}QjtRYStNZ}pXEI! zeW0IevL7i-`D?kr&=7T;l>5tqxlZV;YHaR;=ztpJ0_4BGZGW!4I}RTlYmlK_Xa^cqg+ykC5C_ z*V`!EtJDhrMziCz%PSLHUQ-$0NjD%e5$-1-DEXF*p$$K=d4Oqiqq1o}ve4B!VD&o4 z36j%sh$8je@GD5O8crwEoYu?b1YcIva?7Hn++D(#H+n`B;;hLl#tHRfyGB!b)K^l> zdI|FMDf+vkGG{}b!?p6ZZpEeO59r3#09KKPsfDXI>w#h|19Yq<^ zUJpbq^LrY)mL|^c?M`Llzva3DU~AVE#jAOBj%jFS;U3OzbW+YStp*U@->enKr@Erf zQ%eL8^D49BH7qnDzj|!Oty2QDa-7`DjZ2@XCzbEi2>U{V=@nMaht;Xl37V|)jCviW zHH-1oII>Qwam`K(w0kne{PDDv?&zy#@iMk`D+DyFZj%?Z;-%^d=2#BW15%X2qg|}7mMTUZ)QnqQ9JAmS|LXM>FLly! z;2=y^PG=w0p4hTkM4iw(RXe0rnCoKcUKG^Br4@o_TPkwBFDe$&;t9FAhppA#*90f+ zNyl}gL=^s&q`R21zI*!q^;I=8TeK7EO6fGxgliMv)ly--X&6BO72+8`db?M-vw?EB zTUe{!a&Cw14MvwbY;=E|gi3exu_AE8kD?o>a?UDb4(cWiTSiBGT&+oMlW3hKly=pE+K|PxiCd`;bJnGoD2#NX z?}x~-*5Ai`P&Jd~KgFxqq=3b~j=oo?fQxAGf zI3Y0HtB$b^cDBF7|1YxMIk=K9?EXEmok=pWZQHgzaVB;qwmGqF+t$R!Ol;du&bj%% z_r3R5x9dw%UFn@O+6WXKdh2za2W*wa-jq;6)UFPhKjahy| zHNdO8G{gN~2dZm;@(XUjo?+$|hlRz=vBd29WcJ&$YrRXRb0XWTO$GsCx`Af5PxWgm@}8 zvomR@=*Kp9#{0=}0tyC#f9?QI54iuEM+Lg@@`3oCp6UaoCw_VJ5r?PQt!L=j9disX z{Ez*|^S)3u%mEhMZa*YonrI?WYiMN+oa#GRhw%oOqN^i&XfDcCfA|WF`v^fj{UrE> z&>qTLx3o0!mHLyjqt=8X@|ERxMx6bB>vIxeB;T6BXkHBuUnUn4K`rEqNEk^?$h#p@ zYMA6J%&d&@U@zn>qyB|XtGa0q>q2w*8(^%;0|eX$J~#(;$+CG5*q4G&buUU+OmCCz z5V-cp*?+{@wgZ()U*R^u);>)xHUk}{moPj(|1R0jO$}%@nHbt3zx2NOt*ghue;wa7 zdmUFu?!j;#5l31``;kmmgYB!6(XeVfXkrl@lKmwZZxkQS!gdj!opq@@ur-74^V#sJ zrfj#OaEe>Xv_yN=Ht8H^haplxN=tctZyg`2T@2F94`TDgc2=| z|5-845UsO6SRkpYr}GFov3G7V;e>uSI$GCKlX3~14y3;|5_@0{-zUfOSI^f z#K0easkmd|JTlQw2zRnV9^trUs-5U*C%@iv&W=9c*Q+L)b34SDse@SYpd9l2B#)(_ zP(ZmasZ;#SCrq^9Fsxo{x)G&GBhF?RSJju^3^c|`EP10^7$Q%i?Czovoy>BF!rIa| zc)U5b{>MuGp=zgDEJbbC6eFNJqrp_&TtkbnQJ#RSzh9NXI85^+)v6)q#7lBr`4=Y^ zg-&womUH&{uvF;PHED)hMryE{`qS)zN4gjLHVbaN^?gu!N(kkesiR^uWG(6WnfyGwXN`7g zFbD?qyNwqus#Tel)hj8N>i!E3+6YklMyVmDnE5!AV^Brh*>?~e#$~WS(+_T)f<7t^ z!;qo51m0tPWGH`pgjx%4<-ALUtAsO2JXOPS zJPGxD)((O;*4HnuTAx8#u#Hyt3flo^5*@og(^4UB1VsmSx5q=Ez+4#M_B*(vI&(Z` zAe9BguI0cW+sx2S!{T>gyYEMm4zLpZkpRex4=}&Qjz*if$b^+3$UKLKerKjdqATquBr+?jDYAO%P#CkitY3S;Hzgave@`VvgYZ=Q@yE z14jJ8rjQ1N2HD+Rr+tl}@7^*&V}c`qo$DKD`)IH5BD5%$^qG%8U*2g{)TPyLAMIXv z!kQRVh>6?}71J2$gGR`6X^>Fq)>NkGit_;KXHeL2JTzn9v!E%b6uTc)Slh)+)=Zxt zH}de0r*CZvowx&dq<6HD#sOqFMZ_Iz=aPmeLT;Ebu{P{|NT%2*h|!!m#N;S41&ZKMRBx3TPfa0p8TW`!r@h zrkN5|9K{%-S2tNNDNMumi*~}^sFPvmN=OqNj4l$w&XE8)h0<~jM;{#_rX-5TS_&qGhcpYHr4FY5gqA##)S> z<5c`)M7L0OqEiSn{z&~&H(erq&27LKA1f=q8zgQJ1rUel)v>)tgu~Y03 z&J;NI@D4^*1Vb5!+~4M*UiDy{txNb8R`?luI5PY+5`432f7SB9cm9VS6^Za%#?7~= zbb4Fbe@$rILSF8!j!tGdgxUDFp%LGTSOiMyd;Nytl<#R>&E z*%Z5&l(`VT{>V4{j(^O1h9*Mnavz1}d;q|fWxT7rSkP^O`&}KEcbNm|5qP(3C|34< zRSg2B<;-&RUF-|>e%Jy1w}7*cvmMoBAtv*Cu`VJ9X@9jtI;0rHoQ(vtN{U9P=O<;Jl{zsDj-Hm3>Ojd+LPx(Wvi z{D?mus^7Wv0*hxJKH*Nh*ZHp8PQi|+S_VDOFfc09x%ASx6bvQEv?4GI&6 zd94t)EY|~4b$rBkBQ!`{2Wr}r^r~T2HY5b=+ji-t)2$D3c8zyBh=s>W6a>VLusrfC zs6RzZ_(TN@Bi_Po{bY#d%>`4uq8%HNP{~1ij;Zpkk@h4YV+n{>yP`iNNP9&p;B)M< zN5!*$Akl{Uk;;Jh#btJ8u=g>)e^kEbwvQz79 z_9kN6XD>DBxDqVdlCn(_RmZHEfFgRq&UnR*LOLrKk4oiEfZD9UuFoKc{XrY%4)4wk z+4VIps0>??`w!RI-a;5kW)3XHORopZRm~iZNAqwa4(3Co^%-3JE&3wmv0}%_^HfU4 zi2SY967qd%KaE(#R#c;;;ZUf!Em?9t9arDisy!w>eW zjIc*>HWJ5sG=m&^=-XW)U>Rvtuy5mkGKh~e8L$3aIfzpcvD(-%IBhI^f7`8ZvblC$ z2_(6aeqEX0Kz+>{-et~W_}xovAz4aLNqaO-j_7uPp14-PG-hmf5VA;v2^>p}nDzf< zgqdQF3}~Sb0g~M9et`2B@9crCkYts@4jY^t^U^;)e+?dL~G{e47cI5f{A{W!S$-n(5K(i}~}VP<=)Q7Dm# zvmuXkcYlMzgLI10s%9p@MxivD-sguyu_w$Jnv6+RrO!;ql~M4O4F}L5m5!kW+r?Ri zg&l1d4dAO*yh5f!PwL5`yc% zvr$l-{OaU9o%L^mxT=D?8z-GrEG&r&vbh4eJv}|$ANPIQw=LVv`g5W6`dxNIb8Wc_ zb9s`@N|}KH*;exsJDdRq?$kb#$1P3|6hVP-p}~fuMsu`{GGQ_rj(6@6-?qlc z@(eKNgVslc(2^AQsmM`O;Sj^d0@-2!$Yro*Gr85BWM^dZIbtW7iYI6&!D(VgUCtg} zB70r~>9wSWt0TA6eOgDfQtj;X77NIUSLVdf@dRN_3#l!(&{pQ(NPOWHi%1o%LL?ck z_T?9%1H|k(uGA~Ct;CpVo_K61Qn?vyu1*J`VoaE%CHp^6Y(HT*zgf|5ON8mHZg=cb zJ<`2uhx}zZcvlxx)~2sCns`r>WRs${+20!x8?C)kxdIM}`?Q z@@i?$zGxXwSiteo>8)8kRg0QR&H8TZ=ElFL)$O#jMIeo;xrw zxY@HT589?=s?CszuBU{e5MGA-h5}BloI13^ei?V>-W>gXzLJG~h+5GB-BPbBz`!`! zZ2)l;E7It0`NH~Ym?P667@KP@ZT|A*GJ3jB_v#u+PPBqd4$kXFN=a*_2@k6VQn8}; zVBwp*`KwNMXw|^5mgasMcXs0;NAxEOyO0za7*$HiLhKs$UAUXSLjtXCbyRb;{uoE* zvGYH!f2KC?CgpmdhS*U|NjhzarB(l5-U7cq+q$-EL7eEx=3-YS0fyQ0b^I1olmMnx z!4F7D+%dTttbS@j9W+ut`&0G~Zkwher#CPJNBLMq)Trao5H4+fI1aH9eO$CAOg5Fk z#_EYiG}l7Qt!g9&d32s9qV$Ief}BWloaI3Zlpbj^gn*mtbgMop0ge`9hypiY+|W*( zV|yZlcI>B?dtY1C45;VRj}PQPO5OB*XmE1+!>97=l?(2OZ2WBvzyhybC%T?(QZ zA0(W}bx1(s2HqnBTw+0-dijGDTCB#PV~PozMursUw0!WNB?fl!QYbH94QJ$v)XhjU ztPWQ8$`(tmg9MF?3UuZY-9;(4p9+vy*D#^WaO8j4zgbbYk8AF}s`8qABdHm`ClRC8 z!p6*Ao5-L&U9d6aIcddYBX^+1sV;%``!}JRvB`YrJ0G*8wZV6W4!&6`&Y)f(=NWyf z8y)HW-^}>2?HM~Q6ETG$4tL>b<~nGpKBeZ0)f?K$@0Rm8Y*dl0JO`|=1H4U{l^t~i zDSiFy)ny0L&8oLAq^aLLHB%lZX*Q-?`}8Yk%!Ch&PToyFtw#2dryk2SC~?`9>bQ%! z^A4P;BQu1%;wr4^`Phz&-<2z#si_kWc>eNmb9U2w85w>KcR_JteF9ah7n21dM`mOM zz5+iSZ)fHR=1wN7)L@E}v27qm{Tfc6{@!5$)Ee=vL4`Z#6Cr!M~j zg`M#IJi~5RBh~irm&`VveAyIrK=83bRuM+Uy}ap3I92(-Du|S*(b9m~auLj)I%W{~ znAZhaJrHRM+t4#tPp{610P{x8o3#aPyn455fn1(9tFnk>a)iVV_V>xxAJ~q>A$+ zOn0CbGvR((UB8x{lmpA+lTM6u@D}M#KOjVn2`rBr@JSW03;XI~=Pcx!kFsFv$LWHI zZXLhZ^O6Z{hxz9ZdfpKdGJ4RgCS+^}fqOcE_hl1hn;pFf^}W2EccBo~Dk1~l&pvhz z&MrY z2?9Y!f3JlCh!ki2fgR5&TYUl8pYKEl-%1dMO0wY=7#`61GOduuPy2Fi(J@>|tUz zEUxmx(8eODJyLXkKG*8mblbvx2KLISqFwrU(3;(HBzQQDq~v-qEV28}rVIW?Ii;BK z#G&jjl=uiO7yBDuelKb#Zlr@rao7Lcaw+NXb9tTnznPa(=fqhnqonIi^nHjLIc$#h z)F?Nof)A7>?r6?6m-(LO*QR#>I%)kN!h`dy1eu}z&B$r3xXUF}KI zV*6I}(D))It*B8Aemf8J0!5HZk`4Cm9|W9jc=HZDGZkeEP(xGE7U=R}yZPzsmVHR! zO>fYBHNP7Xu=>M;1Z6Eu-WX%1w2;V@j)qoTrnPVtCNMm?ZwFPyFyP=*C5nye=i(?G z!|Q~Qn*u!r?-Tqs3xue$Dg6czODsbdYUNzd6O$8FPnG7W8Ds9U2i!6u<6<4~^*nqQ z#kdMzO}TMBk+-Q?o&|+^X0yT=aRc_FC-bJH3PqB@cFD{aU1>teD*$jRq9*6Y~2P)4ni;cS6ohWdN@Hq3kB=MdkA_| z5bd*G!F&dw3mC$vK_#?o7iIC{rf}gj?y7gCR6oC#;}f zCQnjN-D+r-Fg5=yDGbYivPy0uU}(Tjq0_hX$!rNshVoC9L{Gx-X2^uK4AY}5{@RB* zochFU*Rm*nEbmac;*b<;;v4Op08m3Y%QpsGaFy<7*4dy&#e3Y??}e{ zSPKp+MN?Ugm!d>NDnju2-`h;&O zSLqL8P>^w@?()WT_YUKvWW)y)T*it^0>u7BqM&43Lt1_?_1pU4;dhCGn1&sJz?12zqVFvU<44!n@8He7lAc*u3}?!@i&ZP0#^0`Z+R03)qT9gqL{9G$us;4Q2^|B-6V zjPLO6E5CjBQ@MPp;bvZh)`HL7(;SaZ>7MlV6#dRz$^Tin&u?RS=J?CW6*&2KVAnzF zIBgVLN(&}D{I~=8h*_t!H#*~1e>KB23ehn8GEL;1h~B5$D)n!s7w=e$Adeu!8&7m6 zlMnGGyW!n^A?-F)9Y^Mox1a0N)yw6;;qCi`E|bTAQR=x7z{epZyJMg1H7U}>H6dgo zIWf@KLWJ8PD3022#Pe zZ23|rd9HB>AyZS5NP@5DxE-aKC0UaWyTsL~Vh+eF^U9rK%Fg$umW54aj5vBygTm5U z#NB;cj}1)?eYE7Vck?C%@4^e`gg#(q5~PJ7y9-`wu=8U!Y)qD-XF^M>-jUglt0J%i zJ1(^H_OL@9L!RHOR~>%F+CShJ|M_>R+btmu z-Hb(2%>@uY`h?y!wy2U}%1al`tiJG0dPbNWu7 zX32#X&9xSQB~K_}TUflb1urhp%B>V6v5y!a^D3=CR>y@`rNGKQA3srQuU65SY`~4G zHx;1Zp$WDl+zN-G!p(D;<2*GcBymSz(Ix2iK!VwvxYtK4X|cM`?sW`3QXQemShDo2 zI_%o2R1zES8_euDAcvZNbg9)D^Fvy8nAJ^0q+=f3p&>NPLxRSXRe3Wsw0#$K9r?+2 z8P6N;K@4V~-)-=8FcIF=by)NDnO-vWeAlK_l@w=)M)rin(+M~aucUTDN!lBbJk0oL zb@q-f{Zu^6g6z=nFy7Ek<|AWT#57(DZcy*z^paoBIK3ibVPC+1P7|;c{Q*p;;CIAt zWay)}Ax^v~L`{h_nhZY^2i-Um!^$lceGF+U*pI8{ZZC-&pP)c4D~|6_+p6SWhqqnS z$1ZT0Pf>m|U!))%Trqg)>+XLHx`q2SSd*YGE%N7&xQv$?Qe~r}I3uTw;;j9aRM0{- zZwo$8xR26##Kt5u{HNnZftN}s<~C%a-zHE=urrl$18WWb->#6Ww}bjexP3IJHzR)3 zpLT1qdf=98U!`(q&gw@{m447KY`VW@(qGXQ~zXs)%pIL7NMChdpm z#yDRHY3vzHhn}TK>;J%C;&r1_9z=ap1W3y%MRx;97FUZoEHsgt|xufFJS^7?i&T5D3~Ot@DDP-y{!Bs zIFpmQ~Z|x(rfR%+?KC& zA5fdxK<{z`%KuA(^&2$^{y!v`)u!|2_5V+T$6D){Wpf^^ok?#QXuOj6S&tMAsxtW- zU%EwqdE$iaJd6SoUn7P-T&8^e{_)59uuF)D?rnH6?nQSvLT-8P%M8w(QX~dIc$p&1 zw1Wr*HjD3Rofp3Xcc!%_FfaX&-uvOo60QdV2u-LkqFj9cm;QvCY?UqnJVn80MRp)Z z%y4~Rf^QLjqj`9GINe>9f+m0#7Zh;tIAFs_8(8r>yOtp)h~)&)9HHDIEb;n`ZLbs@ z91>AtdDZ~t&;k5>Cb+^f_!Z8WwCxaiy<7g^ z?n<#*L>y%t;tS~bCV(XD zV*%j35WV46L2-Rakb50ml>^K_F@@pGFNj4E!d^R$1pXh!gTA&jO3oW!NJWxv%xebN z_r3{gsFB8EWVbHJsAnsbUZA!T9e)ziA{U&EX{?A=;84A_Mo8&*GNAt3{T~353EYR5 zsl3hRznjB8NDr=~03&?iUz+1??*($MdOWX#kgX=0ZwBy`PTI-dS zST8ABoP-a})b^;U&YD21CAX7pN69r4Rvgb`A55W#SaCoFN8%?P)w)N|$uq`qO_tP% zxL1oo{tSH1`0+$`A}?Hu3AF{5Awx1r<}0p2(=Nfi3Jsg+@5C)fxlRmgdPj5=2WGo2 z842-Qs$Z%IGT$nBDlkpqFvj;!o<)pNCOjO%Up{6;u|}g;aR;E){hU@|)}cD)VKPRj z3IsG|Xu?Z8XNRQA6i>h4ZIUX_XPF7loju$}#T&BESz@9YH0wb{nsf5uI&RcIs#~Ei5 ze%rpnWDYg$yTPjxoO7kr_5RRwygdpPB?W-jv8rIfDAzHKwdS)g`4+rP@JL-riSLPq+j8o31P&wW2yl>(5%c>0-)Eu@SN!lhyB_(yAxV=eH2olNuuL%7JKzX$Cz^{4n~=b7C**Io}eos zQznsXh%#~pj*(f4wfDbC7RsqCMz_g-;MO0w`~C6rX9ot$+$RmSUn(f&t<^naHH1aPE2>?+emGXCRPn5d5qrSW&=0igYxh69o^S0WUe5?oXPJ1E3eM5cZ696NEh#5|m8jr$ zKdgHNA3Bm@-6rke@O3z&a3$xPpTbY?>9KdWw$D;yN80b;VSeAVfBwUE-KMZRwMfir z*Xm*niuvMOB{-auD{h4ujT&XFR!w=n0Cr6o)l?fn4kmz%-=KjFMMUM2`RslQrGsWj zHm1FHfh)v4%1@B-_*QOW@&K zvHO#YAHtDk6fRTs@ip~=ih(OzlnF4(2#?N`5scy0Bdbl z0}&tm$OuQ~c349+Oc<0j4H5!=HUZvp6N#)1DA@J;Q!vXkBe4wWmx4@4`5IM?Zfq~K z2&|v}simdZJqG$Y$Gy8E;q6dY0Wb8!biO$@>Bd~XDH+9sP3B%vT@J7>X%lsWk7S$c zF*gmumo>G6&z}LcJ(rfvfcQTD0UgK&R=`tR&bk%N**onyDA719kF-c3;{UJ}JI_9; z`>h(Zf#F>cMvBWdPCZtMzrzax8ObZS`dC@$Uc6>$druO#cj)c{$4chUawQq*2O}p6 zWVka!Y3m9x&F{Fg^J={^SOQ1_DKfug41Bm8tN?M+go4S)AkMBn&Hzkvz=7V)e^Q0j z%ST~-i<@EaMWLwV#;l*bu%nfV6BMa+vz{GL%oH!Me#eGce#Z`D0cAWM$gQD-j@VXr zH6>YgM+oxhKS~ z-82GX#m{PcXL07!c4sA(nvZRb$mL=VCdPpGpXv$<9LdvC_2f%lraHXCkq*m2aR^|M9O5s`cPj5Jkw#I|9wfV@V z+{?dC``24_>)9mH4h}d+8uhKDDz;zG-N?zTG6O2i4qZDF<{k}>Jg%;o zlJ3^1!Aol(^d^vLy}?i+o~Qt4U8Z?Zv;HTjt*Nc(&A(@L)8SKy6aD|?uW7tr{B@jP zR7gpti5r6*P{+3<)O^2|uMJ?#Av!3*C*Wxv*w?Y;6zeA!izHLiTczu)Oxz3%rHM6} zPWaQ*5BARYpyV*2U?u+_c})XO!;fB-fyv+FO#ApF3(n?W$MUmoOQ12d+I?WKoU;3g z-Vtl`8%5wtV|{XGlg6(OH%wF}A^@ZS{DWIbfh8VR#sn&>EqJTcG0o&YkoSl#hOrsqWZKa?=iwT{pY(RDVQW~Ezy)6f(ZzZ- z=XKu8VSo=?W2Eagw|Y8qb$qjhCd97r&;?U8$`AHT>Uq|=H#7L*rE_ZK0eF^MY#HFM0A6#!vY{x22zJfr9rTzP=% z(&U=6oQ2}IlC=4E>~iriM`eRZ#EI--AWWuQ{^mEw%?D!!btt%?+#d%YwqT-F%l;P^ zHc>%;a)mHK-gRw#i%d6t*WFgj{#mf!)UCs2M!#I6c zQ<7^2(5aBP1tv*L$t1@@A559J;pgNt@k~^DVBzne;0#~Di}||XLLVEa7eA-atFz!A zrdc_!Yu@2mElV9%m_IBM%SYu+Fy(FTWMh0SSGvKO9;IjH07WkpWLP6A!WwaX?)T8>BRmg5^n4;{+f&9elgV2dprUtZ6zCQ z_4Fl|*mkqDZy~WwRJQ5-#xhrsSeQTYtE5vH?calvzYE|Q(GvX5q*TRmN-Yw%o{DIe z6fJ(dC8j=Z=Ucg{Q7Mw5l1D*0@zVcHoI38=E&c5DKC~~*$R#7oHPg67 zLy70>2Em|$=cZ~r}*BZl$X4z>tTl_9i z4x?O3bavv8P@^BOYWZ(E8>Ep3QY3AMX1mFJ2l@S1ysxh>+dh==;9f(8P90bVv}xbC z4m39mm}ih9Coj6wcv$RbgU)Ayto995vz}bHOZfV!W)Z?)I^Zfw>71Wl7T$sjbIq?k z%vLoGW3ziEg-27+v`mXB9?N3$I9)i?Kf!p=je-)$0+0~Ht|=y#!*UO zX>bT)<2&(_zlr|t)u(9`BJvis9+DJm0a6Ju{0~byu;;(Wenzai2Qj?(KfZVMJOSOw z3eKVw)~pY(z`)6j0vgA+L(vM^Dpv@?OhH)L;qh7ypc2KHjdSA||0y z>DrSmkRK4)=l*%`XSA`!+vWz(oX4^al0lRro83+GY{pLf&-RX{@HZ1<+_qtkPy2`C zP3>PcB?k6%kV7|jhRF6F7ezE5^ztRh%^l(1-`}Ax2gHSjo2gCD3j&RdAm-`eDuUE; z)WA19n>8TL)giJSde68$5iwj5j#Z};<+`1m5n9XBOt>EtmuLdW#(swoL*Gtx<2OB{ zLI_qABWG^t#2$97pzdNRRX;N@NB3Ny{!W-e6dvuB=ymu3vuih(kT{D|4HY}95G-y& zD)kf;jizYtRT4R*lez@Hkf|exrmz1UTgoSrR?!B3WFnBsg-Ox(QQIgPV`-(tDT&M0 zhRudu%`Pi3)$_(pMNeXp(m9%+32#e7G!}ULRK-CdbD9bLAjT#N0c~C4i2ac_pNwL9{$m0W1EkQqjfm_JFVd!N>9HIa}JjM zdsPI)>Gz*k{LSR8wg5eF#e9wshTJT{C+w~*WdTrK@Mjws=-OUu6Lfjm{POkYDaC@? z{(>`*IO1_)yWWGmR{hiVK$q8T$NqS53?PR|P?aC(+#FQ%2)cZ7chdlFZ>EC0*^HxW z8g!qwDOUZp#1%iGR~;V5mN+)rQdXAYMzbcJ9dumu{%xdayXbLlTt^{kjbIt%z-m$d zeT?6A7FV7qflP|zVWtZZWcyil6}S10w6H}xR*D;@YkyU?t$bc~_pYCc!@=%ab= z&}HTnMgVxn2=&_``k||gh07FJ!ow{D$Snm@xPbsh&U}fT*zHN{*rbMN6^$aj=L5q!eUZo zCH$^|Ufx8{X%V;B7M$0?YZh6(8Ps7d2}>yyLGT z5PjR1Lxvv;_7o<#?(rvL7WQDM%=8#{nnj=u1Wvh2KcbX)e`%B|4`4XuA=*|7c(1uw z)Qdq;6y$SJ&b|@L8ZC6Et5KJGePS0~eD(jP*v<=z>oG6}USGF7e{H(QaGFJW_LK;E zUoBZQdaW=+;A-^SW)>_%nPeKvu0Bh`dVmpG9?bJOgg_fTkGeKbs2?8cTP1hfN;#&% zMKuyIeClXySSTuChA?)bwsx9PFE18HyvT0ekhvbdr? zwfrsGw(tBM$ocU>N~_A&Jc0ja;ndguF(}P(O<<_6?JMQ*l{fDo+{68qXa0pR_KRWV z4w>Vk-C|NgU8m?eB+v5pF%KhrfN0k-uqi+DaXYIA*xLzQzivGS;lWMio!j9<`=f;O zSk#foXUiOyO1ZuE;PQ_`pT}|3gQpNuvOPf4R@my=D{JQH>6Gj*-#^h!GE-2E<-A$~ zrWido6Yw2|#}V55VCu#}^1-B=yiMGafo#~Ls(m51b1p~#AZ&OV&qRI9tGuAW4UBUl7_-#eD76@A+P!{EBaHgOQvmdmfN-33FLP*I>j5q<(OkepnKX_X z^^b(ba3}(D=Ohj6F{qhMQ%0#RQ`!a0nVf3PM~bDU+Y4;D?udTXT*BB5^VK-*ITz!I zJ3(+tZ%+Atl13z=JS$zWv2Y9rj0`b8_3&8{rQvjJtNcVEiSMNOcRI(ZH)0X>)Joz7 z5RX1+vAXK-h5Z{z8YS5+k|7f5K8=a=e@>FVm4&R9_0s>6=WVfTX5OFmT5~*f7V@28 zzSC1B8>FjC-hj4Zw zMw=L!7>Usg^+YPp^OZ=;Nl;-~8C# z)OZCwyKg_Nz4~M9R_yk*P(3n$>wo>dGG{F2&>wO66{&793I>nSqhs*TFR;SfD^40||-N(UU6+COBEx5Aqf&^`zcPYU2Y z1BlL&3}YjKJGp#?84sU=(DgcAI_Y~Dmq2N}?hZbZ6f(X)DM$#fqUvFPjDev?J5{IR zY%WGuu3c&_>t@Ko7tfIvTMk)+J@uTl(`vU?#S-z|5AZ#!K~K&30t}W)c$!EPYY})n z17mt{w^T%DGa&cpZ@{!IKZmwq{}pL%L{K>W%&R&yGAR?3&mT-~rFJ?>632zp-?i^0 z6wj?-{g;1SD9u)3Ay6f$>)Wrqi3)aJ;>}P|2^_J)xpJdTZtgx;=_)G(v+6OUcAtHm7&ueVpnv^=e2?HayDLX9pGl5KT>~g^8EX}fKLgO2 zgOG=VRBq&GjfTG(7_R9%MCJkHw}{^X(#l5=b7Uy22lrqnzmSxJaRdS0Kfr{V5U1L~ z#985k2PrCGkD&qJC^@@DIE|yc5@4zVho?hWWT&sD|aIPdnh*jWr@;P zwdVip*{$mm=zy`id$ZkGuteHhLv*WPy@|Ddi8t(#^!8Fw)F~tJ181~`S!Ic&?b~|E zu=S)njGmd0p&4hz$2J`Dx@joodEZ6BA!)V;7+Y(Mg=-uo+AP9{BDjrRWRvh!?ypH7g<_96DxF!r0tQi)qmx8)JA6I& zsc@aRyN`u|+2FoAx=Df3j|T~92+DIWHT%McQIUg&Xt&xj#fseCzP3r`4_lx86=avK zme0AsUNB+wq4_bF7a4)ex<5)Jf~5t~&^s@CcQ2oR$HOO4V6JuZw!={rj{My^SR@7# zkA(l;``0aBTfZ3Ug0^ErHvS+N!MdwbZ4WiC+c1A`_MYe1@oiP}7{|=r1e2APrP*ej z=8l^b?z!2LiQPc06zStoYv9+wR}xB_kJ5ol&w+Pc#xIU{qu7Vq$1#SpQAS|X4Zw+= zxBC)I5=Q~uJUt~HNdN2CN1s*gSAqIQEk^VM(z6-=S2MCxGeEYPc)=1Qd7d|9{%-Ij zK;l<^;oqD-MOc-XY@MlEGK>cak?1Ik0We^I3O}I7zD>`^{r_IlLDP5KF+g36OEDno z->621Jx*G1aZ8!TRTsx27zCz82W=lJ5$`ax&Y_;8bx(wbpux|@%jQq=-2bKfCg#Q) z8dwEB<`!l!H-K?iaR@jZ{{hxo#WuvEz+i8&ST(3~FbMf7#?)BE^Wwrn5mU&{3ZLkq z7^{A%&(dsZfR3xE+3bqSwv(0T=I&l)dgCpL*6fk|i#sZMSDDs*1J|cdKL$R8|8YwL z;amC5e%d%KMD-6`$H&N`*P3roZP2*&Ja08V)M@^2m%<>1V3Boze=85-4i|d@Q+`2> zEhXbMDhmde&1xC)m2Oy1CwjR}&0OM2Y@q%*r6QEwFSz2rME3}{*$+|~iBg}1-^24QB`^SifBwO_} za?H$q#~al`EdZ)px-I55d^BMLnw&;pKY`0**sN&QKA!-6c3AOD4@qIhp9)QX9I5;W zShu~Yc0=Ut@btBd+7}zb4)YFC^VUe(`GS%u)rlk^g}hg z?15Osy;Ldp%W~D_tyJauK)oc?IuYEt$u%8{(;*2`1*GI%$a(>hjsD768qGu_Zny@@?&Lx(0Mtzra;vlBq zFL@}xp1$hUX3*#JOqS-CUYdP$Z+n8iuZ%6bo=@Tko4jNC_+fnFiQ*FK4qEvu!B;o< z(P&Tn5xW^{#7{BC^|>JeXNIR9GD~>%ukk>KiY{yfoWd_7`4mINgw#K&4l;5+1TAeP z5~1(u+y1W~eeioOf=mC^&*LrNjQy8Do4omDmI2rVd^d!;DAY^UP55tP?94_=zrnipWulpb9 zs0@aKRThP4lD>_d9!#EFV5i2r%mLGL)jEzMIz2GD-KKCFv4a25I(@dU?NYzoGh1}5 znI99m@Utv;SW>;9XMugMU32*I2eih;dcfO^q7@<7sUC+`aySu85DScvV4h3-QVC^UjjZ#s&G=!r~d@w{Nh-*0(}WPY5sD-Zh`wl7m4XD7*1f z3?^;>S5D%y0H%WB3P_!EczGv3ESgw)FGC@zhEMWW+~S}hYRP#FVw?DNd#6_D*JQOs zvsV&Vl@IL$1m~Pyy{FJolyCQ-HCW=ai@xXRXOM#z187JR{44xrvYYYeW9rjR#{ywY zrB027-E)zYx?Th;ndf*I!Po0t#R#1ZdyrW&nTTiUKgY-xY}lEcg3Q9_r(O zy0}%AzyfSC54(f`T4e@KNnixw)oU-6-JRYZnGmT5&9?u>q?!mc0d!Daazc-3YX%7) zl7=bch{XodeVP)T;~-`{xQcgjY+>azx_evWrN6Sx+GlpkqD7A&qA!ikeMuac&A+d< z`_CYdMc?w;*9UO$Ar$`AlJLECXnV*Q>9^Q;a$o0h=}~SW{r2@zD4UFry{I#@tnx=R zwueX12H44CR|{;ZI_lQT7X^j6oM?0Tr}- z9=@<$-(EToPddM?bW*pg6o|EG$SzwtyPP>*%c@OA7dew4y|RkCBGJ}Dp)=h$qf|Qq z%TnHTLgrcm4iEf}=3Vf1x50O&Oo+5WNHbf8`U`wJBH;tsDq#^@25tXW04NUE@!#!y zo_UG*e>v!w2IIC0-*ypf+dMuIZ|>s4G|QGfTOdy+vux2>f?rorsBGoGT3akpuC)X1 zc59(e9|>-Etzf%VP`izRcFSQ7HvtH#wvLSNn1|Y494fa4C|6VQB@jxxEf^_KpDhJO z`lv&%eBiB&EZT1IA0#x||E~xDRcHUX)88rH|F!m?8wm~9vs>Vu=b!*1kf3;q>5T^2 ze0qFan{mM3-rm|Ug3bilVLa~mEE(>+JAQj~dU0g+?XIx}K41a-aZIvmjzYEI8AN-! zu-xfFfeJ&+>>Q{`1OfUaJz{RMf(e7a$^$!rH5?Bxo6)z7V($2?1u9%FG@AeAJ&3eT zZmJLJ=KpSA<$vGp_4nKPe-k0Ul`U?p%VuWsz9Fk;c3oO=!6PQ>b{?krvf1r@1V7J^ zA)0vc`#K=qmu0t&cVM``ivlMHM3?2?&Y<5>sF?rP1^`$y|9AKL1^=)8{g(f8Bca9r zTOtgJLSk%B~e$v zz1k_jUNuL(+F23wYG+l`QAfan*FoF*GoSkqQg#ila z;*ReGY;c_XfED-#I_tzJnXx0SYZTyZ@b`aS{=hD+J!-v`%mKt0#dPs#^HVK8@ltZ5 zAxcYN0A7Zt30Fi~6s0X{@h*4*phePDvN&jwjEvtXk-VjBn)U&Al5!EAG`dm6{J$yu zpS}Gz-NO0*ZnvHPHxU>_#(L-VbL^d+nU ztc zd^XMGMY1Ix74?mybL+?-NgYM?S3}t@XM3dMipLUmj(M_I=8z#Z-&c9@Nl^O;}b!dv)`2dj`EdE+;9cv~``}^W`Txd?lNt0ae)!zvez<1-f79RXtMh-a+xq`* zBs|dk{~H@6l?V=n>7NR-^4D6q`M)^Rw6p)Rvp;PwOM{&?`s@ZQ^D#`&Eu2d+OEAjD z$t~ETw>sg}OVSe}rVG505ClAWLQ8LjviA@JKBuG?TBL|c60v;QcrnWdOc18B>;&^V900Rp-y+|)u7mJ4=;TDq*r`5~6r9$^vF)qSRDM zILl;^y-m70k`a*}M=9r^Jo30`^j23w@gU(AdE-e!Asm}^kBdmzEGKkP^Uf(Gs_O@q z;0nriDE1_ow(URiVl;#pSyO~D9DBh6-$*g7g>UUYaI-$CN&Ox7$!rSyD@|CEfQ6>3 z7~$lmSDySk?vqP->Wzyi`9 z;glZXWR}*_366NkGR|XeQYG~+N93`}&3qlhNI7Ll{(Ns8B>^?O3|=sf5td-zb6q0J zfISyEFwTxNxjH_GqQ6~Uo>61X7!QD%#4}_TQK>=8S)vrC88Jy^w@QtpsaF9xqey77 z9G^)lrHXz;YhKZqex%B-p+?B9#bAC zVGPIUtq(D_qd2_rh)O{*F!QD_@D^KWi1je@Qybx%EG)U0CZ+J zrpbied}?Yvi(Hr>f9OSaGzWiH)73MsWH6iJNeRNTG$h4&xF9*qGE6@$hO?|mLw!(M zhL&f+(6SzWmZr_%1n-AOUy=)N9C*R_@3+_ZA839CF+Q8b5Tg<*k-!Rv7W$G{n5DD+ zxV^^KHJV!y#5kf!bL}P(jYvErc_DV>1-V2i*GNUYmFl@@?G~?+ny9Qwa=hiM^fv#M z*H%epZfRU4HBniWYG`3ft8__`4#GHTJP;F+VyO|Brmh@+`dG`>t8r}>twPm!)5lt> z3N-^Qt3u-umKCmQeCcB?RfWrVh7*b++pH!DiH|Aj>|zy?Qrc0kUthPf1TEp#GK5>t zeKlLZPm)eq?(eN^ZCW-?O|dvNb z7^RCj)k###qb5hGTo#sgYWWzQdQKc(|40YvB*aMslZgoy9Oyj#)C)ZF;aI7lS9-cQ z1_dECu8)y!R`eceHEv76h7uwA{p%znDu%#`QMO>l9^c#$2_qk7~8P%kv&6q`O-i&4YfM&aZC0i*c zZkgsO-(ut%M;C30rm6fK%l3GW-!zq-oA?e((CqH`=3pOyec9cEv6Mqb^C%G3)2h6nUPQ#TILECL#-{) zg0?`k$uB8hXnK38GwUMH3#MJUS*ckEJuL|(zx7i{H?hYK*jnqsI>zNvD{Daw-AvMp>0 z>aW%&wy01a`#UcSjpqM{=KtS&qw@cETmO&Egr~;;-%j>5lRcZg-$(HC3>l*F7e~PZ z5(-_0;dcjy`@1M`a?@9qf4c$r=0e5%zd8Q@-d=(Kr`z)XY$UY&|7+y`f9%d&B2;|; z8{+@(^}0I>{#$SFO~1we+(_8Ut+87E|0VhVzgq$|6hxB%{$k z$rvXM;|_2P_oFHF$ddCz>{Fs)%d#xM{v-aN&x;I{;7+Bh1b3x$l;Dn*;ezo{y$xMt z7*au-^HBb^S+Wu)%9_-h;i6>SagILEyckVUkYK~eC=LeTlSCByiN<9c2-0i+Kyz>h zsJ+5nN+Cu5O8H?)Z_&g{x%vTIxKSY7#+(on2foF@AP_eQXYrc!su3>59)B^t#(7zY{YDAAjFA zrQ1St(AzevZ|2OwUiUsvJzhcBC`y}MfE61@Wl2oah?_f=^n4kDMk=)6s-A0enHi9_ ze=~kTMX~@EPzzlo_LCAy{_wdXm6Huh1*|Pr0>^o=xm86@QW<9M|r+1bFilwj7#vi6)R|yDk-&G zqIRTowQO(?z;H$@RPauD*e>hu6}pT(YSLxPFvC4ut8sIPJKzPhv3hi#((`TdB$<QI)#v1A#IsgCw literal 0 HcmV?d00001 diff --git a/charts/janssen/Chart.yaml b/charts/janssen/Chart.yaml index 27702d4fc4c..9666c5460f8 100644 --- a/charts/janssen/Chart.yaml +++ b/charts/janssen/Chart.yaml @@ -1,36 +1,35 @@ -kubeVersion: '>=v1.21.0-0' +kubeVersion: ">=v1.21.0-0" annotations: - artifacthub.io/changes: | - - Update always - artifacthub.io/containsSecurityUpdates: 'true' - artifacthub.io/images: | - - name: auth-server - image: janssenproject/auth-server:1.0.0-beta.15 - - name: auth-server-key-rotation - image: janssenproject/certmanager:1.0.0-beta.15 - - name: client-api - image: janssenproject/client-api:1.0.0-beta.15 - - name: configuration-manager - image: janssenproject/configurator:1.0.0-beta.15 - - name: config-api - image: janssenproject/config-api:1.0.0-beta.15 - - name: fido2 - image: janssenproject/fido2:1.0.0-beta.15 - - name: opendj - image: gluufederation/opendj:5.0.0_dev - - name: persistence - image: janssenproject/persistence-loader:1.0.0-beta.15 - - name: scim - image: janssenproject/scim:1.0.0-beta.15 - artifacthub.io/license: Apache-2.0 - artifacthub.io/prerelease: 'true' - catalog.cattle.io/certified: partner - catalog.cattle.io/release-name: janssen - catalog.cattle.io/display-name: Janssen Cloud Identity and Access Management + artifacthub.io/changes: | + - Update always + artifacthub.io/containsSecurityUpdates: "true" + artifacthub.io/images: | + - name: auth-server + image: janssenproject/auth-server:1.0.0-beta.16 + - name: auth-server-key-rotation + image: janssenproject/certmanager:1.0.0-beta.16 + - name: client-api + image: janssenproject/client-api:1.0.0-beta.16 + - name: configuration-manager + image: janssenproject/configurator:1.0.0-beta.16 + - name: config-api + image: janssenproject/config-api:1.0.0-beta.16 + - name: fido2 + image: janssenproject/fido2:1.0.0-beta.16 + - name: opendj + image: gluufederation/opendj:5.0.0_dev + - name: persistence + image: janssenproject/persistence-loader:1.0.0-beta.16 + - name: scim + image: janssenproject/scim:1.0.0-beta.16 + artifacthub.io/license: Apache-2.0 + artifacthub.io/prerelease: "true" + catalog.cattle.io/certified: partner + catalog.cattle.io/release-name: janssen + catalog.cattle.io/display-name: Janssen Cloud Identity and Access Management apiVersion: v2 -appVersion: 1.0.0 -icon: >- - https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png +appVersion: "1.0.0" +icon: https://github.com/JanssenProject/jans/raw/main/docs/logo/janssen_project_favicon_transparent_50px_50px.png home: https://jans.io sources: - https://jans.io @@ -40,35 +39,45 @@ maintainers: email: support@jans.io description: Janssen Access and Identity Management name: janssen -version: 1.0.0-beta.15 +version: 1.0.0-beta.16 dependencies: - name: config condition: global.config.enabled - version: 1.0.0-beta.15 + version: 1.0.0-beta.16 + - name: config-api condition: global.config-api.enabled - version: 1.0.0-beta.15 + version: 1.0.0-beta.16 + - name: opendj condition: global.opendj.enabled - version: 1.0.0-beta.15 + version: 1.0.0-beta.16 + - name: auth-server condition: global.auth-server.enabled - version: 1.0.0-beta.15 + version: 1.0.0-beta.16 + - name: fido2 condition: global.fido2.enabled - version: 1.0.0-beta.15 + version: 1.0.0-beta.16 + - name: scim condition: global.scim.enabled - version: 1.0.0-beta.15 + version: 1.0.0-beta.16 + - name: nginx-ingress condition: global.nginx-ingress.enabled - version: 1.0.0-beta.15 + version: 1.0.0-beta.16 + - name: auth-server-key-rotation condition: global.auth-server-key-rotation.enabled - version: 1.0.0-beta.15 + version: 1.0.0-beta.16 + - name: client-api condition: global.client-api.enabled - version: 1.0.0-beta.15 + version: 1.0.0-beta.16 + - name: persistence condition: global.persistence.enabled - version: 1.0.0-beta.15 + version: 1.0.0-beta.16 + diff --git a/charts/janssen/README.md b/charts/janssen/README.md index 3b2adafe39e..b60675f6a50 100644 --- a/charts/janssen/README.md +++ b/charts/janssen/README.md @@ -1,6 +1,6 @@ # janssen -![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) +![Version: 1.0.0-beta.16](https://img.shields.io/badge/Version-1.0.0--beta.16-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) Janssen Access and Identity Management @@ -23,23 +23,23 @@ Kubernetes: `>=v1.21.0-0` | Repository | Name | Version | |------------|------|---------| -| | auth-server | 1.0.0-beta.15 | -| | auth-server-key-rotation | 1.0.0-beta.15 | -| | client-api | 1.0.0-beta.15 | -| | config | 1.0.0-beta.15 | -| | config-api | 1.0.0-beta.15 | -| | fido2 | 1.0.0-beta.15 | -| | nginx-ingress | 1.0.0-beta.15 | -| | opendj | 1.0.0-beta.15 | -| | persistence | 1.0.0-beta.15 | -| | scim | 1.0.0-beta.15 | +| | auth-server | 1.0.0-beta.16 | +| | auth-server-key-rotation | 1.0.0-beta.16 | +| | client-api | 1.0.0-beta.16 | +| | config | 1.0.0-beta.16 | +| | config-api | 1.0.0-beta.16 | +| | fido2 | 1.0.0-beta.16 | +| | nginx-ingress | 1.0.0-beta.16 | +| | opendj | 1.0.0-beta.16 | +| | persistence | 1.0.0-beta.16 | +| | scim | 1.0.0-beta.16 | ## Values | Key | Type | Default | Description | |-----|------|---------|-------------| -| auth-server | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/auth-server","tag":"1.0.0-beta.15"},"livenessProbe":{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"readinessProbe":{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"2500m","memory":"2500Mi"},"requests":{"cpu":"2500m","memory":"2500Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Janssen. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing. | -| auth-server-key-rotation | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/certmanager","tag":"1.0.0-beta.15"},"keysLife":48,"resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Responsible for regenerating auth-keys per x hours | +| auth-server | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/auth-server","tag":"1.0.0-beta.16"},"livenessProbe":{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"readinessProbe":{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"2500m","memory":"2500Mi"},"requests":{"cpu":"2500m","memory":"2500Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Janssen. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing. | +| auth-server-key-rotation | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/certmanager","tag":"1.0.0-beta.16"},"keysLife":48,"resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Responsible for regenerating auth-keys per x hours | | auth-server-key-rotation.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | | auth-server-key-rotation.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | | auth-server-key-rotation.dnsConfig | object | `{}` | Add custom dns config | @@ -47,7 +47,7 @@ Kubernetes: `>=v1.21.0-0` | auth-server-key-rotation.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | | auth-server-key-rotation.image.pullSecrets | list | `[]` | Image Pull Secrets | | auth-server-key-rotation.image.repository | string | `"janssenproject/certmanager"` | Image to use for deploying. | -| auth-server-key-rotation.image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| auth-server-key-rotation.image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | auth-server-key-rotation.keysLife | int | `48` | Auth server key rotation keys life in hours | | auth-server-key-rotation.resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. | | auth-server-key-rotation.resources.limits.cpu | string | `"300m"` | CPU limit. | @@ -69,7 +69,7 @@ Kubernetes: `>=v1.21.0-0` | auth-server.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | | auth-server.image.pullSecrets | list | `[]` | Image Pull Secrets | | auth-server.image.repository | string | `"janssenproject/auth-server"` | Image to use for deploying. | -| auth-server.image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| auth-server.image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | auth-server.livenessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. | | auth-server.livenessProbe.exec | object | `{"command":["python3","/app/scripts/healthcheck.py"]}` | Executes the python3 healthcheck. https://github.com/JanssenProject/docker-jans-auth-server/blob/master/scripts/healthcheck.py | | auth-server.readinessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the auth server if needed. https://github.com/JanssenProject/docker-jans-auth-server/blob/master/scripts/healthcheck.py | @@ -84,7 +84,7 @@ Kubernetes: `>=v1.21.0-0` | auth-server.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | | auth-server.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | | auth-server.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| client-api | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/client-api","tag":"1.0.0-beta.15"},"livenessProbe":{"exec":{"command":["curl","-k","https://localhost:8443/health-check"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"readinessProbe":{"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":8443},"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"400Mi"},"requests":{"cpu":"1000m","memory":"400Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Middleware API to help application developers call an OAuth, OpenID or UMA server. You may wonder why this is necessary. It makes it easier for client developers to use OpenID signing and encryption features, without becoming crypto experts. This API provides some high level endpoints to do some of the heavy lifting. | +| client-api | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/client-api","tag":"1.0.0-beta.16"},"livenessProbe":{"exec":{"command":["curl","-k","https://localhost:8443/health-check"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"readinessProbe":{"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":8443},"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"400Mi"},"requests":{"cpu":"1000m","memory":"400Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Middleware API to help application developers call an OAuth, OpenID or UMA server. You may wonder why this is necessary. It makes it easier for client developers to use OpenID signing and encryption features, without becoming crypto experts. This API provides some high level endpoints to do some of the heavy lifting. | | client-api.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | | client-api.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | | client-api.dnsConfig | object | `{}` | Add custom dns config | @@ -95,7 +95,7 @@ Kubernetes: `>=v1.21.0-0` | client-api.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | | client-api.image.pullSecrets | list | `[]` | Image Pull Secrets | | client-api.image.repository | string | `"janssenproject/client-api"` | Image to use for deploying. | -| client-api.image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| client-api.image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | client-api.livenessProbe | object | `{"exec":{"command":["curl","-k","https://localhost:8443/health-check"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. | | client-api.livenessProbe.exec | object | `{"command":["curl","-k","https://localhost:8443/health-check"]}` | Executes the python3 healthcheck. | | client-api.readinessProbe | object | `{"initialDelaySeconds":60,"periodSeconds":25,"tcpSocket":{"port":8443},"timeoutSeconds":5}` | Configure the readiness healthcheck for the auth server if needed. | @@ -110,8 +110,8 @@ Kubernetes: `>=v1.21.0-0` | client-api.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | | client-api.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | | client-api.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| config | object | `{"additionalAnnotations":{},"additionalLabels":{},"adminPassword":"Test1234#","city":"Austin","configmap":{"cnCacheType":"NATIVE_PERSISTENCE","cnClientApiAdminCertCn":"client-api","cnClientApiApplicationCertCn":"client-api","cnClientApiBindIpAddresses":"*","cnConfigGoogleSecretNamePrefix":"janssen","cnConfigGoogleSecretVersionId":"latest","cnConfigKubernetesConfigMap":"cn","cnCouchbaseBucketPrefix":"jans","cnCouchbaseCrt":"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo=","cnCouchbaseIndexNumReplica":0,"cnCouchbasePassword":"P@ssw0rd","cnCouchbaseSuperUser":"admin","cnCouchbaseSuperUserPassword":"Test1234#","cnCouchbaseUrl":"cbjanssen.default.svc.cluster.local","cnCouchbaseUser":"janssen","cnGoogleProjectId":"google-project-to-save-config-and-secrets-to","cnGoogleSecretManagerPassPhrase":"Test1234#","cnGoogleSecretManagerServiceAccount":"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo=","cnGoogleSpannerDatabaseId":"","cnGoogleSpannerInstanceId":"","cnJettyRequestHeaderSize":8192,"cnLdapUrl":"opendj:1636","cnMaxRamPercent":"75.0","cnPersistenceLdapMapping":"default","cnRedisSentinelGroup":"","cnRedisSslTruststore":"","cnRedisType":"STANDALONE","cnRedisUrl":"redis.redis.svc.cluster.local:6379","cnRedisUseSsl":false,"cnScimProtectionMode":"OAUTH","cnSecretGoogleSecretNamePrefix":"janssen","cnSecretGoogleSecretVersionId":"latest","cnSecretKubernetesSecret":"cn","cnSqlDbDialect":"mysql","cnSqlDbHost":"my-release-mysql.default.svc.cluster.local","cnSqlDbName":"jans","cnSqlDbPort":3306,"cnSqlDbTimezone":"UTC","cnSqlDbUser":"jans","cnSqldbUserPassword":"Test1234#","lbAddr":""},"countryCode":"US","dnsConfig":{},"dnsPolicy":"","email":"support@jans.io","image":{"pullSecrets":[],"repository":"janssenproject/configurator","tag":"1.0.0-beta.15"},"ldapPassword":"P@ssw0rds","orgName":"Janssen","redisPassword":"P@assw0rd","resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"state":"TX","usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Configuration parameters for setup and initial configuration secret and config layers used by Janssen services. | -| config-api | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/config-api","tag":"1.0.0-beta.15"},"livenessProbe":{"httpGet":{"path":"/jans-config-api/api/v1/health/live","port":8074},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"readinessProbe":{"httpGet":{"path":"jans-config-api/api/v1/health/ready","port":8074},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"400Mi"},"requests":{"cpu":"1000m","memory":"400Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Config Api endpoints can be used to configure the auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS). | +| config | object | `{"additionalAnnotations":{},"additionalLabels":{},"adminPassword":"Test1234#","city":"Austin","configmap":{"cnCacheType":"NATIVE_PERSISTENCE","cnClientApiAdminCertCn":"client-api","cnClientApiApplicationCertCn":"client-api","cnClientApiBindIpAddresses":"*","cnConfigGoogleSecretNamePrefix":"janssen","cnConfigGoogleSecretVersionId":"latest","cnConfigKubernetesConfigMap":"cn","cnCouchbaseBucketPrefix":"jans","cnCouchbaseCrt":"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo=","cnCouchbaseIndexNumReplica":0,"cnCouchbasePassword":"P@ssw0rd","cnCouchbaseSuperUser":"admin","cnCouchbaseSuperUserPassword":"Test1234#","cnCouchbaseUrl":"cbjanssen.default.svc.cluster.local","cnCouchbaseUser":"janssen","cnGoogleProjectId":"google-project-to-save-config-and-secrets-to","cnGoogleSecretManagerPassPhrase":"Test1234#","cnGoogleSecretManagerServiceAccount":"SWFtTm90YVNlcnZpY2VBY2NvdW50Q2hhbmdlTWV0b09uZQo=","cnGoogleSpannerDatabaseId":"","cnGoogleSpannerInstanceId":"","cnJettyRequestHeaderSize":8192,"cnLdapUrl":"opendj:1636","cnMaxRamPercent":"75.0","cnPersistenceLdapMapping":"default","cnRedisSentinelGroup":"","cnRedisSslTruststore":"","cnRedisType":"STANDALONE","cnRedisUrl":"redis.redis.svc.cluster.local:6379","cnRedisUseSsl":false,"cnScimProtectionMode":"OAUTH","cnSecretGoogleSecretNamePrefix":"janssen","cnSecretGoogleSecretVersionId":"latest","cnSecretKubernetesSecret":"cn","cnSqlDbDialect":"mysql","cnSqlDbHost":"my-release-mysql.default.svc.cluster.local","cnSqlDbName":"jans","cnSqlDbPort":3306,"cnSqlDbTimezone":"UTC","cnSqlDbUser":"jans","cnSqldbUserPassword":"Test1234#","lbAddr":""},"countryCode":"US","dnsConfig":{},"dnsPolicy":"","email":"support@jans.io","image":{"pullSecrets":[],"repository":"janssenproject/configurator","tag":"1.0.0-beta.16"},"ldapPassword":"P@ssw0rds","orgName":"Janssen","redisPassword":"P@assw0rd","resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"state":"TX","usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Configuration parameters for setup and initial configuration secret and config layers used by Janssen services. | +| config-api | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/config-api","tag":"1.0.0-beta.16"},"livenessProbe":{"httpGet":{"path":"/jans-config-api/api/v1/health/live","port":8074},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"readinessProbe":{"httpGet":{"path":"jans-config-api/api/v1/health/ready","port":8074},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"400Mi"},"requests":{"cpu":"1000m","memory":"400Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Config Api endpoints can be used to configure the auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS). | | config-api.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | | config-api.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | | config-api.dnsConfig | object | `{}` | Add custom dns config | @@ -122,7 +122,7 @@ Kubernetes: `>=v1.21.0-0` | config-api.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | | config-api.image.pullSecrets | list | `[]` | Image Pull Secrets | | config-api.image.repository | string | `"janssenproject/config-api"` | Image to use for deploying. | -| config-api.image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| config-api.image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | config-api.livenessProbe | object | `{"httpGet":{"path":"/jans-config-api/api/v1/health/live","port":8074},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. | | config-api.livenessProbe.httpGet | object | `{"path":"/jans-config-api/api/v1/health/live","port":8074}` | http liveness probe endpoint | | config-api.readinessProbe.httpGet | object | `{"path":"jans-config-api/api/v1/health/ready","port":8074}` | http readiness probe endpoint | @@ -187,7 +187,7 @@ Kubernetes: `>=v1.21.0-0` | config.email | string | `"support@jans.io"` | Email address of the administrator usually. Used for certificate creation. | | config.image.pullSecrets | list | `[]` | Image Pull Secrets | | config.image.repository | string | `"janssenproject/configurator"` | Image to use for deploying. | -| config.image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| config.image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | config.ldapPassword | string | `"P@ssw0rds"` | LDAP admin password if OpennDJ is used for persistence. | | config.orgName | string | `"Janssen"` | Organization name. Used for certificate creation. | | config.redisPassword | string | `"P@assw0rd"` | Redis admin password if `config.configmap.cnCacheType` is set to `REDIS`. | @@ -202,7 +202,7 @@ Kubernetes: `>=v1.21.0-0` | config.usrEnvs.secret | object | `{}` | Add custom secret envs to the service. variable1: value1 | | config.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | | config.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| fido2 | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/fido2","tag":"1.0.0-beta.15"},"livenessProbe":{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"readinessProbe":{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"500m","memory":"500Mi"},"requests":{"cpu":"500m","memory":"500Mi"}},"service":{"name":"http-fido2","port":8080},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments. | +| fido2 | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/fido2","tag":"1.0.0-beta.16"},"livenessProbe":{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"readinessProbe":{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"500m","memory":"500Mi"},"requests":{"cpu":"500m","memory":"500Mi"}},"service":{"name":"http-fido2","port":8080},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments. | | fido2.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | | fido2.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | | fido2.dnsConfig | object | `{}` | Add custom dns config | @@ -213,7 +213,7 @@ Kubernetes: `>=v1.21.0-0` | fido2.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | | fido2.image.pullSecrets | list | `[]` | Image Pull Secrets | | fido2.image.repository | string | `"janssenproject/fido2"` | Image to use for deploying. | -| fido2.image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| fido2.image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | fido2.livenessProbe | object | `{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the liveness healthcheck for the fido2 if needed. | | fido2.livenessProbe.httpGet | object | `{"path":"/jans-fido2/sys/health-check","port":"http-fido2"}` | http liveness probe endpoint | | fido2.readinessProbe | object | `{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the readiness healthcheck for the fido2 if needed. | @@ -318,7 +318,7 @@ Kubernetes: `>=v1.21.0-0` | global.usrEnvs | object | `{"normal":{},"secret":{}}` | Add custom normal and secret envs to the service. Envs defined in global.userEnvs will be globally available to all services | | global.usrEnvs.normal | object | `{}` | Add custom normal envs to the service. variable1: value1 | | global.usrEnvs.secret | object | `{}` | Add custom secret envs to the service. variable1: value1 | -| nginx-ingress | object | `{"ingress":{"additionalAnnotations":{},"additionalLabels":{},"authServerAdditionalAnnotations":{},"authServerEnabled":true,"authServerLabels":{},"configApiAdditionalAnnotations":{},"configApiEnabled":true,"configApiLabels":{},"fido2ConfigAdditionalAnnotations":{},"fido2ConfigEnabled":false,"fido2ConfigLabels":{},"hosts":["demoexample.jans.io"],"openidAdditionalAnnotations":{},"openidConfigEnabled":true,"openidConfigLabels":{},"path":"/","scimAdditionalAnnotations":{},"scimConfigAdditionalAnnotations":{},"scimConfigEnabled":false,"scimConfigLabels":{},"scimEnabled":false,"scimLabels":{},"tls":[{"hosts":["demoexample.jans.io"],"secretName":"tls-certificate"}],"u2fAdditionalAnnotations":{},"u2fConfigEnabled":true,"u2fConfigLabels":{},"uma2AdditionalAnnotations":{},"uma2ConfigEnabled":true,"uma2ConfigLabels":{},"webdiscoveryAdditionalAnnotations":{},"webdiscoveryEnabled":true,"webdiscoveryLabels":{},"webfingerAdditionalAnnotations":{},"webfingerEnabled":true,"webfingerLabels":{}}}` | Nginx ingress definitions chart | +| nginx-ingress | object | `{"ingress":{"additionalAnnotations":{},"additionalLabels":{},"authServerAdditionalAnnotations":{},"authServerEnabled":true,"authServerLabels":{},"configApiAdditionalAnnotations":{},"configApiEnabled":true,"configApiLabels":{},"deviceCodeAdditionalAnnotations":{},"deviceCodeEnabled":true,"deviceCodeLabels":{},"fido2ConfigAdditionalAnnotations":{},"fido2ConfigEnabled":false,"fido2ConfigLabels":{},"firebaseMessagingAdditionalAnnotations":{},"firebaseMessagingEnabled":true,"firebaseMessagingLabels":{},"hosts":["demoexample.jans.io"],"openidAdditionalAnnotations":{},"openidConfigEnabled":true,"openidConfigLabels":{},"path":"/","scimAdditionalAnnotations":{},"scimConfigAdditionalAnnotations":{},"scimConfigEnabled":false,"scimConfigLabels":{},"scimEnabled":false,"scimLabels":{},"tls":[{"hosts":["demoexample.jans.io"],"secretName":"tls-certificate"}],"u2fAdditionalAnnotations":{},"u2fConfigEnabled":true,"u2fConfigLabels":{},"uma2AdditionalAnnotations":{},"uma2ConfigEnabled":true,"uma2ConfigLabels":{},"webdiscoveryAdditionalAnnotations":{},"webdiscoveryEnabled":true,"webdiscoveryLabels":{},"webfingerAdditionalAnnotations":{},"webfingerEnabled":true,"webfingerLabels":{}}}` | Nginx ingress definitions chart | | nginx-ingress.ingress.additionalAnnotations | object | `{}` | Additional annotations that will be added across all ingress definitions in the format of {cert-manager.io/issuer: "letsencrypt-prod"} Enable client certificate authentication nginx.ingress.kubernetes.io/auth-tls-verify-client: "optional" Create the secret containing the trusted ca certificates nginx.ingress.kubernetes.io/auth-tls-secret: "janssen/tls-certificate" Specify the verification depth in the client certificates chain nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1" Specify if certificates are passed to upstream server nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true" | | nginx-ingress.ingress.additionalLabels | object | `{}` | Additional labels that will be added across all ingress definitions in the format of {mylabel: "myapp"} | | nginx-ingress.ingress.authServerAdditionalAnnotations | object | `{}` | Auth server ingress resource additional annotations. | @@ -326,9 +326,15 @@ Kubernetes: `>=v1.21.0-0` | nginx-ingress.ingress.authServerLabels | object | `{}` | Auth server ingress resource labels. key app is taken | | nginx-ingress.ingress.configApiAdditionalAnnotations | object | `{}` | ConfigAPI ingress resource additional annotations. | | nginx-ingress.ingress.configApiLabels | object | `{}` | configAPI ingress resource labels. key app is taken | +| nginx-ingress.ingress.deviceCodeAdditionalAnnotations | object | `{}` | device-code ingress resource additional annotations. | +| nginx-ingress.ingress.deviceCodeEnabled | bool | `true` | Enable endpoint /device-code | +| nginx-ingress.ingress.deviceCodeLabels | object | `{}` | device-code ingress resource labels. key app is taken | | nginx-ingress.ingress.fido2ConfigAdditionalAnnotations | object | `{}` | fido2 config ingress resource additional annotations. | | nginx-ingress.ingress.fido2ConfigEnabled | bool | `false` | Enable endpoint /.well-known/fido2-configuration | | nginx-ingress.ingress.fido2ConfigLabels | object | `{}` | fido2 config ingress resource labels. key app is taken | +| nginx-ingress.ingress.firebaseMessagingAdditionalAnnotations | object | `{}` | Firebase Messaging ingress resource additional annotations. | +| nginx-ingress.ingress.firebaseMessagingEnabled | bool | `true` | Enable endpoint /firebase-messaging-sw.js | +| nginx-ingress.ingress.firebaseMessagingLabels | object | `{}` | Firebase Messaging ingress resource labels. key app is taken | | nginx-ingress.ingress.openidAdditionalAnnotations | object | `{}` | openid-configuration ingress resource additional annotations. | | nginx-ingress.ingress.openidConfigEnabled | bool | `true` | Enable endpoint /.well-known/openid-configuration | | nginx-ingress.ingress.openidConfigLabels | object | `{}` | openid-configuration ingress resource labels. key app is taken | @@ -386,7 +392,7 @@ Kubernetes: `>=v1.21.0-0` | opendj.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | | opendj.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | | opendj.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| persistence | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/persistence-loader","tag":"1.0.0-beta.15"},"resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Job to generate data and intial config for Janssen Server persistence layer. | +| persistence | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/persistence-loader","tag":"1.0.0-beta.16"},"resources":{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | Job to generate data and intial config for Janssen Server persistence layer. | | persistence.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | | persistence.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | | persistence.dnsConfig | object | `{}` | Add custom dns config | @@ -394,7 +400,7 @@ Kubernetes: `>=v1.21.0-0` | persistence.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | | persistence.image.pullSecrets | list | `[]` | Image Pull Secrets | | persistence.image.repository | string | `"janssenproject/persistence-loader"` | Image to use for deploying. | -| persistence.image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| persistence.image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | persistence.resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. | | persistence.resources.limits.cpu | string | `"300m"` | CPU limit | | persistence.resources.limits.memory | string | `"300Mi"` | Memory limit. | @@ -405,7 +411,7 @@ Kubernetes: `>=v1.21.0-0` | persistence.usrEnvs.secret | object | `{}` | Add custom secret envs to the service variable1: value1 | | persistence.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | | persistence.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | -| scim | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/scim","tag":"1.0.0-beta.15"},"livenessProbe":{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"readinessProbe":{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"1000Mi"},"requests":{"cpu":"1000m","memory":"1000Mi"}},"service":{"name":"http-scim","port":8080},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | System for Cross-domain Identity Management (SCIM) version 2.0 | +| scim | object | `{"additionalAnnotations":{},"additionalLabels":{},"dnsConfig":{},"dnsPolicy":"","hpa":{"behavior":{},"enabled":true,"maxReplicas":10,"metrics":[],"minReplicas":1,"targetCPUUtilizationPercentage":50},"image":{"pullPolicy":"IfNotPresent","pullSecrets":[],"repository":"janssenproject/scim","tag":"1.0.0-beta.16"},"livenessProbe":{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5},"readinessProbe":{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5},"replicas":1,"resources":{"limits":{"cpu":"1000m","memory":"1000Mi"},"requests":{"cpu":"1000m","memory":"1000Mi"}},"service":{"name":"http-scim","port":8080},"usrEnvs":{"normal":{},"secret":{}},"volumeMounts":[],"volumes":[]}` | System for Cross-domain Identity Management (SCIM) version 2.0 | | scim.additionalAnnotations | object | `{}` | Additional annotations that will be added across the gateway in the format of {cert-manager.io/issuer: "letsencrypt-prod"} | | scim.additionalLabels | object | `{}` | Additional labels that will be added across the gateway in the format of {mylabel: "myapp"} | | scim.dnsConfig | object | `{}` | Add custom dns config | @@ -416,7 +422,7 @@ Kubernetes: `>=v1.21.0-0` | scim.image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | | scim.image.pullSecrets | list | `[]` | Image Pull Secrets | | scim.image.repository | string | `"janssenproject/scim"` | Image to use for deploying. | -| scim.image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| scim.image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | scim.livenessProbe | object | `{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for SCIM if needed. | | scim.livenessProbe.httpGet.path | string | `"/jans-scim/sys/health-check"` | http liveness probe endpoint | | scim.readinessProbe | object | `{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the SCIM if needed. | @@ -434,6 +440,5 @@ Kubernetes: `>=v1.21.0-0` | scim.volumeMounts | list | `[]` | Configure any additional volumesMounts that need to be attached to the containers | | scim.volumes | list | `[]` | Configure any additional volumes that need to be attached to the pod | - ---------------------------------------------- Autogenerated from chart metadata using [helm-docs v1.7.0](https://github.com/norwoodj/helm-docs/releases/v1.7.0) diff --git a/charts/janssen/charts/auth-server-key-rotation/Chart.yaml b/charts/janssen/charts/auth-server-key-rotation/Chart.yaml index a140028787f..a5973e5fc65 100644 --- a/charts/janssen/charts/auth-server-key-rotation/Chart.yaml +++ b/charts/janssen/charts/auth-server-key-rotation/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: auth-server-key-rotation -version: 1.0.0-beta.15 +version: 1.0.0-beta.16 kubeVersion: ">=v1.21.0-0" description: Responsible for regenerating auth-keys per x hours type: application diff --git a/charts/janssen/charts/auth-server-key-rotation/README.md b/charts/janssen/charts/auth-server-key-rotation/README.md index 68a914114fb..07ce66643bc 100644 --- a/charts/janssen/charts/auth-server-key-rotation/README.md +++ b/charts/janssen/charts/auth-server-key-rotation/README.md @@ -1,6 +1,6 @@ # auth-server-key-rotation -![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) +![Version: 1.0.0-beta.16](https://img.shields.io/badge/Version-1.0.0--beta.16-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) Responsible for regenerating auth-keys per x hours @@ -33,7 +33,7 @@ Kubernetes: `>=v1.21.0-0` | image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | | image.pullSecrets | list | `[]` | Image Pull Secrets | | image.repository | string | `"janssenproject/certmanager"` | Image to use for deploying. | -| image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | keysLife | int | `48` | Auth server key rotation keys life in hours | | nodeSelector | object | `{}` | | | resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. | diff --git a/charts/janssen/charts/auth-server-key-rotation/values.yaml b/charts/janssen/charts/auth-server-key-rotation/values.yaml index cd029dea4bc..e48661c5be3 100644 --- a/charts/janssen/charts/auth-server-key-rotation/values.yaml +++ b/charts/janssen/charts/auth-server-key-rotation/values.yaml @@ -18,7 +18,7 @@ image: # -- Image to use for deploying. repository: janssenproject/certmanager # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [ ] # -- Auth server key rotation keys life in hours diff --git a/charts/janssen/charts/auth-server/Chart.yaml b/charts/janssen/charts/auth-server/Chart.yaml index 3cbd7c4d09b..545d9fbc81d 100644 --- a/charts/janssen/charts/auth-server/Chart.yaml +++ b/charts/janssen/charts/auth-server/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: auth-server -version: 1.0.0-beta.15 +version: 1.0.0-beta.16 kubeVersion: ">=v1.21.0-0" description: OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Janssen. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing. type: application diff --git a/charts/janssen/charts/auth-server/README.md b/charts/janssen/charts/auth-server/README.md index ff10c660c59..60b35f24185 100644 --- a/charts/janssen/charts/auth-server/README.md +++ b/charts/janssen/charts/auth-server/README.md @@ -1,6 +1,6 @@ # auth-server -![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) +![Version: 1.0.0-beta.16](https://img.shields.io/badge/Version-1.0.0--beta.16-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) OAuth Authorization Server, the OpenID Connect Provider, the UMA Authorization Server--this is the main Internet facing component of Janssen. It's the service that returns tokens, JWT's and identity assertions. This service must be Internet facing. @@ -36,7 +36,7 @@ Kubernetes: `>=v1.21.0-0` | image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | | image.pullSecrets | list | `[]` | Image Pull Secrets | | image.repository | string | `"janssenproject/auth-server"` | Image to use for deploying. | -| image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | livenessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. | | livenessProbe.exec | object | `{"command":["python3","/app/scripts/healthcheck.py"]}` | Executes the python3 healthcheck. https://github.com/JanssenFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py | | readinessProbe | object | `{"exec":{"command":["python3","/app/scripts/healthcheck.py"]},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the auth server if needed. https://github.com/JanssenFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py | diff --git a/charts/janssen/charts/auth-server/templates/auth-server-virtual-services.yaml b/charts/janssen/charts/auth-server/templates/auth-server-virtual-services.yaml index 352f3dcc5c4..67d9e8ba8fa 100644 --- a/charts/janssen/charts/auth-server/templates/auth-server-virtual-services.yaml +++ b/charts/janssen/charts/auth-server/templates/auth-server-virtual-services.yaml @@ -26,7 +26,31 @@ spec: - uri: prefix: "/.well-known/openid-configuration" rewrite: - uri: "/auth-server/.well-known/openid-configuration" + uri: "/jans-auth/.well-known/openid-configuration" + route: + - destination: + host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local + port: + number: 8080 + weight: 100 + - name: "{{ .Release.Name }}-istio-device-code" + match: + - uri: + prefix: "/device-code" + rewrite: + uri: "/jans-auth/device_authorization.htm" + route: + - destination: + host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local + port: + number: 8080 + weight: 100 + - name: "{{ .Release.Name }}-istio-firebase-messaging" + match: + - uri: + prefix: "/firebase-messaging-sw.js" + rewrite: + uri: "/jans-auth/firebase-messaging-sw.js" route: - destination: host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local @@ -38,7 +62,7 @@ spec: - uri: prefix: "/.well-known/uma2-configuration" rewrite: - uri: "/auth-server/restv1/uma2-configuration" + uri: "/jans-auth/restv1/uma2-configuration" route: - destination: host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local @@ -50,7 +74,7 @@ spec: - uri: prefix: "/.well-known/simple-web-discovery" rewrite: - uri: "/auth-server/.well-known/simple-web-discovery" + uri: "/jans-auth/.well-known/simple-web-discovery" route: - destination: host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local @@ -60,7 +84,7 @@ spec: - name: "{{ .Release.Name }}-istio-cn" match: - uri: - prefix: "/auth-server" + prefix: "/jans-auth" route: - destination: host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local @@ -71,7 +95,7 @@ spec: - uri: prefix: "/.well-known/webfinger" rewrite: - uri: "/auth-server/.well-known/webfinger" + uri: "/jans-auth/.well-known/webfinger" route: - destination: host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local @@ -83,7 +107,7 @@ spec: - uri: prefix: "/.well-known/fido-configuration" rewrite: - uri: "/auth-server/restv1/fido-configuration" + uri: "/jans-auth/restv1/fido-configuration" route: - destination: host: {{ index .Values "global" "auth-server" "authServerServiceName" }}.{{ .Release.Namespace }}.svc.cluster.local diff --git a/charts/janssen/charts/auth-server/values.yaml b/charts/janssen/charts/auth-server/values.yaml index a575d30d184..adad04dad5f 100644 --- a/charts/janssen/charts/auth-server/values.yaml +++ b/charts/janssen/charts/auth-server/values.yaml @@ -28,7 +28,7 @@ image: # -- Image to use for deploying. repository: janssenproject/auth-server # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [ ] # -- Service replica number. diff --git a/charts/janssen/charts/client-api/Chart.yaml b/charts/janssen/charts/client-api/Chart.yaml index 024e9868161..cdb1d29a026 100644 --- a/charts/janssen/charts/client-api/Chart.yaml +++ b/charts/janssen/charts/client-api/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: client-api -version: 1.0.0-beta.15 +version: 1.0.0-beta.16 kubeVersion: ">=v1.21.0-0" description: Middleware API to help application developers call an OAuth, OpenID or UMA server. You may wonder why this is necessary. It makes it easier for client developers to use OpenID signing and encryption features, without becoming crypto experts. This API provides some high level endpoints to do some of the heavy lifting. type: application diff --git a/charts/janssen/charts/client-api/README.md b/charts/janssen/charts/client-api/README.md index 5a665366b52..1fd862d39b2 100644 --- a/charts/janssen/charts/client-api/README.md +++ b/charts/janssen/charts/client-api/README.md @@ -1,6 +1,6 @@ # client-api -![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) +![Version: 1.0.0-beta.16](https://img.shields.io/badge/Version-1.0.0--beta.16-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) Middleware API to help application developers call an OAuth, OpenID or UMA server. You may wonder why this is necessary. It makes it easier for client developers to use OpenID signing and encryption features, without becoming crypto experts. This API provides some high level endpoints to do some of the heavy lifting. @@ -37,7 +37,7 @@ Kubernetes: `>=v1.21.0-0` | image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | | image.pullSecrets | list | `[]` | Image Pull Secrets | | image.repository | string | `"janssenproject/client-api"` | Image to use for deploying. | -| image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | livenessProbe | object | `{"exec":{"command":["curl","-k","https://localhost:8443/health-check"]},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. | | livenessProbe.exec | object | `{"command":["curl","-k","https://localhost:8443/health-check"]}` | Executes the python3 healthcheck. | | nodeSelector | object | `{}` | | diff --git a/charts/janssen/charts/client-api/values.yaml b/charts/janssen/charts/client-api/values.yaml index 3f34c1dc728..c956c5e2d41 100644 --- a/charts/janssen/charts/client-api/values.yaml +++ b/charts/janssen/charts/client-api/values.yaml @@ -28,7 +28,7 @@ image: # -- Image to use for deploying. repository: janssenproject/client-api # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [ ] # -- Service replica number. diff --git a/charts/janssen/charts/config-api/Chart.yaml b/charts/janssen/charts/config-api/Chart.yaml index ba503a916e8..fe8f0c15719 100644 --- a/charts/janssen/charts/config-api/Chart.yaml +++ b/charts/janssen/charts/config-api/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: config-api -version: 1.0.0-beta.15 +version: 1.0.0-beta.16 kubeVersion: ">=v1.21.0-0" description: Jans Config Api endpoints can be used to configure jans-auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS) type: application diff --git a/charts/janssen/charts/config-api/README.md b/charts/janssen/charts/config-api/README.md index be4c43c52a0..7b559f0ad48 100644 --- a/charts/janssen/charts/config-api/README.md +++ b/charts/janssen/charts/config-api/README.md @@ -1,6 +1,6 @@ # config-api -![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) +![Version: 1.0.0-beta.16](https://img.shields.io/badge/Version-1.0.0--beta.16-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) Jans Config Api endpoints can be used to configure jans-auth-server, which is an open-source OpenID Connect Provider (OP) and UMA Authorization Server (AS) @@ -38,7 +38,7 @@ Kubernetes: `>=v1.21.0-0` | image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | | image.pullSecrets | list | `[]` | Image Pull Secrets | | image.repository | string | `"janssenproject/config-api"` | Image to use for deploying. | -| image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | livenessProbe | object | `{"httpGet":{"path":"/jans-config-api/api/v1/health/live","port":8074},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for the auth server if needed. | | livenessProbe.httpGet | object | `{"path":"/jans-config-api/api/v1/health/live","port":8074}` | Executes the python3 healthcheck. https://github.com/JanssenFederation/docker-oxauth/blob/4.3/scripts/healthcheck.py | | nameOverride | string | `""` | | diff --git a/charts/janssen/charts/config-api/values.yaml b/charts/janssen/charts/config-api/values.yaml index 041dd403df5..afa47a47d81 100644 --- a/charts/janssen/charts/config-api/values.yaml +++ b/charts/janssen/charts/config-api/values.yaml @@ -33,7 +33,7 @@ image: # -- Image to use for deploying. repository: janssenproject/config-api # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [ ] # -- Service replica number. diff --git a/charts/janssen/charts/config/Chart.yaml b/charts/janssen/charts/config/Chart.yaml index 7fbfccdba84..9cdbd553c3c 100644 --- a/charts/janssen/charts/config/Chart.yaml +++ b/charts/janssen/charts/config/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: config -version: 1.0.0-beta.15 +version: 1.0.0-beta.16 kubeVersion: ">=v1.21.0-0" description: Configuration parameters for setup and initial configuration secret and config layers used by Janssen services. type: application diff --git a/charts/janssen/charts/config/README.md b/charts/janssen/charts/config/README.md index 89eb4743fac..f35b305e2d0 100644 --- a/charts/janssen/charts/config/README.md +++ b/charts/janssen/charts/config/README.md @@ -1,6 +1,6 @@ # config -![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) +![Version: 1.0.0-beta.16](https://img.shields.io/badge/Version-1.0.0--beta.16-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) Configuration parameters for setup and initial configuration secret and config layers used by Janssen services. @@ -78,7 +78,7 @@ Kubernetes: `>=v1.21.0-0` | fullNameOverride | string | `""` | | | image.pullSecrets | list | `[]` | Image Pull Secrets | | image.repository | string | `"janssenproject/configurator"` | Image to use for deploying. | -| image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | ldapPassword | string | `"P@ssw0rds"` | LDAP admin password if OpennDJ is used for persistence. | | migration | object | `{"enabled":false,"migrationDataFormat":"ldif","migrationDir":"/ce-migration"}` | CE to CN Migration section | | migration.enabled | bool | `false` | Boolean flag to enable migration from CE | diff --git a/charts/janssen/charts/config/values.yaml b/charts/janssen/charts/config/values.yaml index cb75f0ed1b8..34459eaa5d4 100644 --- a/charts/janssen/charts/config/values.yaml +++ b/charts/janssen/charts/config/values.yaml @@ -108,7 +108,7 @@ image: # -- Image to use for deploying. repository: janssenproject/configurator # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [ ] # -- LDAP admin password if OpennDJ is used for persistence. diff --git a/charts/janssen/charts/fido2/Chart.yaml b/charts/janssen/charts/fido2/Chart.yaml index ecec76a5f67..187a53dd38b 100644 --- a/charts/janssen/charts/fido2/Chart.yaml +++ b/charts/janssen/charts/fido2/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: fido2 -version: 1.0.0-beta.15 +version: 1.0.0-beta.16 kubeVersion: ">=v1.21.0-0" description: FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments. type: application diff --git a/charts/janssen/charts/fido2/README.md b/charts/janssen/charts/fido2/README.md index 8934aaeb507..32dbce245b6 100644 --- a/charts/janssen/charts/fido2/README.md +++ b/charts/janssen/charts/fido2/README.md @@ -1,6 +1,6 @@ # fido2 -![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) +![Version: 1.0.0-beta.16](https://img.shields.io/badge/Version-1.0.0--beta.16-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) FIDO 2.0 (FIDO2) is an open authentication standard that enables leveraging common devices to authenticate to online services in both mobile and desktop environments. @@ -37,7 +37,7 @@ Kubernetes: `>=v1.21.0-0` | image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | | image.pullSecrets | list | `[]` | Image Pull Secrets | | image.repository | string | `"janssenproject/fido2"` | Image to use for deploying. | -| image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | livenessProbe | object | `{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the liveness healthcheck for the fido2 if needed. | | livenessProbe.httpGet | object | `{"path":"/jans-fido2/sys/health-check","port":"http-fido2"}` | http liveness probe endpoint | | readinessProbe | object | `{"httpGet":{"path":"/jans-fido2/sys/health-check","port":"http-fido2"},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the readiness healthcheck for the fido2 if needed. | diff --git a/charts/janssen/charts/fido2/templates/fido2-virtual-services.yaml b/charts/janssen/charts/fido2/templates/fido2-virtual-services.yaml index ab39bcc63e2..970ab77807b 100644 --- a/charts/janssen/charts/fido2/templates/fido2-virtual-services.yaml +++ b/charts/janssen/charts/fido2/templates/fido2-virtual-services.yaml @@ -26,7 +26,7 @@ spec: - uri: prefix: /.well-known/fido2-configuration rewrite: - uri: /fido2/restv1/fido2/configuration + uri: /jans-fido2/restv1/fido2/configuration route: - destination: host: {{ .Values.global.fido2.fido2ServiceName }}.{{.Release.Namespace}}.svc.cluster.local diff --git a/charts/janssen/charts/fido2/values.yaml b/charts/janssen/charts/fido2/values.yaml index e1d14f189de..c53add5598c 100644 --- a/charts/janssen/charts/fido2/values.yaml +++ b/charts/janssen/charts/fido2/values.yaml @@ -29,7 +29,7 @@ image: # -- Image to use for deploying. repository: janssenproject/fido2 # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [ ] # -- Service replica number. diff --git a/charts/janssen/charts/nginx-ingress/Chart.yaml b/charts/janssen/charts/nginx-ingress/Chart.yaml index 383ab92545f..994a5751d9d 100644 --- a/charts/janssen/charts/nginx-ingress/Chart.yaml +++ b/charts/janssen/charts/nginx-ingress/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: nginx-ingress -version: 1.0.0-beta.15 +version: 1.0.0-beta.16 kubeVersion: ">=v1.21.0-0" description: Nginx ingress definitions chart type: application diff --git a/charts/janssen/charts/nginx-ingress/README.md b/charts/janssen/charts/nginx-ingress/README.md index 751af736128..026e4365f41 100644 --- a/charts/janssen/charts/nginx-ingress/README.md +++ b/charts/janssen/charts/nginx-ingress/README.md @@ -1,6 +1,6 @@ # nginx-ingress -![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) +![Version: 1.0.0-beta.16](https://img.shields.io/badge/Version-1.0.0--beta.16-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) Nginx ingress definitions chart @@ -27,18 +27,24 @@ Kubernetes: `>=v1.21.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| | fullnameOverride | string | `""` | | -| ingress | object | `{"additionalAnnotations":{"kubernetes.io/ingress.class":"nginx"},"additionalLabels":{},"authServerAdditionalAnnotations":{},"authServerEnabled":true,"authServerLabels":{},"enabled":true,"fido2ConfigAdditionalAnnotations":{},"fido2ConfigEnabled":false,"fido2ConfigLabels":{},"fido2Enabled":false,"fido2Labels":{},"hosts":["demoexample.jans.io"],"legacy":false,"openidAdditionalAnnotations":{},"openidConfigEnabled":true,"openidConfigLabels":{},"path":"/","scimAdditionalAnnotations":{},"scimConfigAdditionalAnnotations":{},"scimConfigEnabled":false,"scimConfigLabels":{},"scimEnabled":false,"scimLabels":{},"tls":[{"hosts":["demoexample.jans.io"],"secretName":"tls-certificate"}],"u2fAdditionalAnnotations":{},"u2fConfigEnabled":true,"u2fConfigLabels":{},"uma2AdditionalAnnotations":{},"uma2ConfigEnabled":true,"uma2ConfigLabels":{},"webdiscoveryAdditionalAnnotations":{},"webdiscoveryEnabled":true,"webdiscoveryLabels":{},"webfingerAdditionalAnnotations":{},"webfingerEnabled":true,"webfingerLabels":{}}` | Nginx ingress definitions chart | +| ingress | object | `{"additionalAnnotations":{"kubernetes.io/ingress.class":"nginx"},"additionalLabels":{},"authServerAdditionalAnnotations":{},"authServerEnabled":true,"authServerLabels":{},"deviceCodeAdditionalAnnotations":{},"deviceCodeEnabled":true,"deviceCodeLabels":{},"enabled":true,"fido2ConfigAdditionalAnnotations":{},"fido2ConfigEnabled":false,"fido2ConfigLabels":{},"fido2Enabled":false,"fido2Labels":{},"firebaseMessagingAdditionalAnnotations":{},"firebaseMessagingEnabled":true,"firebaseMessagingLabels":{},"hosts":["demoexample.jans.io"],"legacy":false,"openidAdditionalAnnotations":{},"openidConfigEnabled":true,"openidConfigLabels":{},"path":"/","scimAdditionalAnnotations":{},"scimConfigAdditionalAnnotations":{},"scimConfigEnabled":false,"scimConfigLabels":{},"scimEnabled":false,"scimLabels":{},"tls":[{"hosts":["demoexample.jans.io"],"secretName":"tls-certificate"}],"u2fAdditionalAnnotations":{},"u2fConfigEnabled":true,"u2fConfigLabels":{},"uma2AdditionalAnnotations":{},"uma2ConfigEnabled":true,"uma2ConfigLabels":{},"webdiscoveryAdditionalAnnotations":{},"webdiscoveryEnabled":true,"webdiscoveryLabels":{},"webfingerAdditionalAnnotations":{},"webfingerEnabled":true,"webfingerLabels":{}}` | Nginx ingress definitions chart | | ingress.additionalAnnotations | object | `{"kubernetes.io/ingress.class":"nginx"}` | Additional annotations that will be added across all ingress definitions in the format of {cert-manager.io/issuer: "letsencrypt-prod"}. key app is taken Enable client certificate authentication nginx.ingress.kubernetes.io/auth-tls-verify-client: "optional" Create the secret containing the trusted ca certificates nginx.ingress.kubernetes.io/auth-tls-secret: "janssen/tls-certificate" Specify the verification depth in the client certificates chain nginx.ingress.kubernetes.io/auth-tls-verify-depth: "1" Specify if certificates are passed to upstream server nginx.ingress.kubernetes.io/auth-tls-pass-certificate-to-upstream: "true" | | ingress.additionalAnnotations."kubernetes.io/ingress.class" | string | `"nginx"` | Required annotation below. Use kubernetes.io/ingress.class: "public" for microk8s. | | ingress.additionalLabels | object | `{}` | Additional labels that will be added across all ingress definitions in the format of {mylabel: "myapp"} | | ingress.authServerAdditionalAnnotations | object | `{}` | Auth server ingress resource additional annotations. | | ingress.authServerEnabled | bool | `true` | Enable Auth server endpoints /oxauth | | ingress.authServerLabels | object | `{}` | Auth server config ingress resource labels. key app is taken | +| ingress.deviceCodeAdditionalAnnotations | object | `{}` | device-code ingress resource additional annotations. | +| ingress.deviceCodeEnabled | bool | `true` | Enable endpoint /device-code | +| ingress.deviceCodeLabels | object | `{}` | device-code ingress resource labels. key app is taken | | ingress.fido2ConfigAdditionalAnnotations | object | `{}` | fido2 config ingress resource additional annotations. | | ingress.fido2ConfigEnabled | bool | `false` | Enable endpoint /.well-known/fido2-configuration | | ingress.fido2ConfigLabels | object | `{}` | fido2 config ingress resource labels. key app is taken | | ingress.fido2Enabled | bool | `false` | Enable all fido2 endpoints | | ingress.fido2Labels | object | `{}` | fido2 ingress resource labels. key app is taken | +| ingress.firebaseMessagingAdditionalAnnotations | object | `{}` | Firebase Messaging ingress resource additional annotations. | +| ingress.firebaseMessagingEnabled | bool | `true` | Enable endpoint /firebase-messaging-sw.js | +| ingress.firebaseMessagingLabels | object | `{}` | Firebase Messaging ingress resource labels. key app is taken | | ingress.legacy | bool | `false` | Enable use of legacy API version networking.k8s.io/v1beta1 to support kubernetes 1.18. This flag should be removed next version release along with nginx-ingress/templates/ingress-legacy.yaml. | | ingress.openidAdditionalAnnotations | object | `{}` | openid-configuration ingress resource additional annotations. | | ingress.openidConfigEnabled | bool | `true` | Enable endpoint /.well-known/openid-configuration | diff --git a/charts/janssen/charts/nginx-ingress/templates/ingress.yaml b/charts/janssen/charts/nginx-ingress/templates/ingress.yaml index c190f43b212..894ccedf81a 100644 --- a/charts/janssen/charts/nginx-ingress/templates/ingress.yaml +++ b/charts/janssen/charts/nginx-ingress/templates/ingress.yaml @@ -56,6 +56,121 @@ spec: --- +{{ if .Values.ingress.deviceCodeEnabled -}} +{{ $fullName := include "nginx-ingress.fullname" . -}} +{{- $ingressPath := .Values.ingress.path -}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ $fullName }}-device-code + labels: + app: {{ $fullName }}-device-code +{{- if .Values.ingress.additionalLabels }} +{{ toYaml .Values.ingress.additionalLabels | indent 4 }} +{{- end }} +{{- if .Values.ingress.deviceCodeLabels }} +{{ toYaml .Values.ingress.deviceCodeLabels | indent 4 }} +{{- end }} + annotations: + kubernetes.io/ingress.class: nginx + nginx.ingress.kubernetes.io/ssl-redirect: "false" + nginx.ingress.kubernetes.io/proxy-read-timeout: "300" + nginx.ingress.kubernetes.io/configuration-snippet: "rewrite /device-code /jans-auth/device_authorization.htm$1 break;" + nginx.ingress.kubernetes.io/rewrite-target: /jans-auth/device_authorization.htm +{{- if .Values.ingress.deviceCodeAdditionalAnnotations }} +{{ toYaml .Values.ingress.deviceCodeAdditionalAnnotations | indent 4 }} +{{- end }} +{{- if .Values.ingress.additionalAnnotations }} +{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} +{{- end }} +spec: +{{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} +{{- end }} + rules: + {{- range .Values.ingress.hosts }} + {{- $host := . -}} + {{- with $ }} + - host: {{ $host | quote }} + http: + paths: + - path: /device-code + pathType: Exact + backend: + service: + name: {{ index .Values "global" "auth-server" "authServerServiceName" }} + port: + number: 8080 + {{- end }} + {{- end }} +{{- end }} + +--- + +{{ if .Values.ingress.firebaseMessagingEnabled -}} +{{ $fullName := include "nginx-ingress.fullname" . -}} +{{- $ingressPath := .Values.ingress.path -}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ $fullName }}-firebase-messaging + labels: + app: {{ $fullName }}-firebase-messaging +{{- if .Values.ingress.additionalLabels }} +{{ toYaml .Values.ingress.additionalLabels | indent 4 }} +{{- end }} +{{- if .Values.ingress.firebaseMessagingLabels }} +{{ toYaml .Values.ingress.firebaseMessagingLabels | indent 4 }} +{{- end }} + annotations: + kubernetes.io/ingress.class: nginx + nginx.ingress.kubernetes.io/ssl-redirect: "false" + nginx.ingress.kubernetes.io/proxy-read-timeout: "300" + nginx.ingress.kubernetes.io/configuration-snippet: "rewrite /firebase-messaging-sw.js /jans-auth/firebase-messaging-sw.js$1 break;" + nginx.ingress.kubernetes.io/rewrite-target: /jans-auth/firebase-messaging-sw.js +{{- if .Values.ingress.firebaseMessagingAdditionalAnnotations }} +{{ toYaml .Values.ingress.firebaseMessagingAdditionalAnnotations | indent 4 }} +{{- end }} +{{- if .Values.ingress.additionalAnnotations }} +{{ toYaml .Values.ingress.additionalAnnotations | indent 4 }} +{{- end }} +spec: +{{- if .Values.ingress.tls }} + tls: + {{- range .Values.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} +{{- end }} + rules: + {{- range .Values.ingress.hosts }} + {{- $host := . -}} + {{- with $ }} + - host: {{ $host | quote }} + http: + paths: + - path: /firebase-messaging-sw.js + pathType: Exact + backend: + service: + name: {{ index .Values "global" "auth-server" "authServerServiceName" }} + port: + number: 8080 + {{- end }} + {{- end }} +{{- end }} + +--- {{ if .Values.ingress.uma2ConfigEnabled -}} {{ $fullName := include "nginx-ingress.fullname" . -}} {{- $ingressPath := .Values.ingress.path -}} diff --git a/charts/janssen/charts/nginx-ingress/values.yaml b/charts/janssen/charts/nginx-ingress/values.yaml index 93cde50c501..41cd3026032 100644 --- a/charts/janssen/charts/nginx-ingress/values.yaml +++ b/charts/janssen/charts/nginx-ingress/values.yaml @@ -11,6 +11,18 @@ ingress: openidConfigLabels: { } # -- openid-configuration ingress resource additional annotations. openidAdditionalAnnotations: { } + # -- Enable endpoint /device-code + deviceCodeEnabled: true + # -- device-code ingress resource labels. key app is taken + deviceCodeLabels: { } + # -- device-code ingress resource additional annotations. + deviceCodeAdditionalAnnotations: { } + # -- Enable endpoint /firebase-messaging-sw.js + firebaseMessagingEnabled: true + # -- Firebase Messaging ingress resource labels. key app is taken + firebaseMessagingLabels: { } + # -- Firebase Messaging ingress resource additional annotations. + firebaseMessagingAdditionalAnnotations: { } # -- Enable endpoint /.well-known/uma2-configuration uma2ConfigEnabled: true # -- uma 2 config ingress resource labels. key app is taken diff --git a/charts/janssen/charts/opendj/Chart.yaml b/charts/janssen/charts/opendj/Chart.yaml index 7aa89545e68..c94d6db3509 100644 --- a/charts/janssen/charts/opendj/Chart.yaml +++ b/charts/janssen/charts/opendj/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: opendj -version: 1.0.0-beta.15 +version: 1.0.0-beta.16 kubeVersion: ">=v1.21.0-0" description: OpenDJ is a directory server which implements a wide range of Lightweight Directory Access Protocol and related standards, including full compliance with LDAPv3 but also support for Directory Service Markup Language (DSMLv2).Written in Java, OpenDJ offers multi-master replication, access control, and many extensions. type: application diff --git a/charts/janssen/charts/opendj/README.md b/charts/janssen/charts/opendj/README.md index 3b2effa4094..5657f14e44f 100644 --- a/charts/janssen/charts/opendj/README.md +++ b/charts/janssen/charts/opendj/README.md @@ -1,6 +1,6 @@ # opendj -![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) +![Version: 1.0.0-beta.16](https://img.shields.io/badge/Version-1.0.0--beta.16-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) OpenDJ is a directory server which implements a wide range of Lightweight Directory Access Protocol and related standards, including full compliance with LDAPv3 but also support for Directory Service Markup Language (DSMLv2).Written in Java, OpenDJ offers multi-master replication, access control, and many extensions. diff --git a/charts/janssen/charts/persistence/Chart.yaml b/charts/janssen/charts/persistence/Chart.yaml index b5003935387..8ad6dc54ccd 100644 --- a/charts/janssen/charts/persistence/Chart.yaml +++ b/charts/janssen/charts/persistence/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: persistence -version: 1.0.0-beta.15 +version: 1.0.0-beta.16 kubeVersion: ">=v1.21.0-0" description: Job to generate data and initial config for Janssen Server persistence layer. type: application diff --git a/charts/janssen/charts/persistence/README.md b/charts/janssen/charts/persistence/README.md index 16c3aace37a..c22a410726b 100644 --- a/charts/janssen/charts/persistence/README.md +++ b/charts/janssen/charts/persistence/README.md @@ -1,6 +1,6 @@ # persistence -![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) +![Version: 1.0.0-beta.16](https://img.shields.io/badge/Version-1.0.0--beta.16-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) Job to generate data and initial config for Janssen Server persistence layer. @@ -33,7 +33,7 @@ Kubernetes: `>=v1.21.0-0` | image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | | image.pullSecrets | list | `[]` | Image Pull Secrets | | image.repository | string | `"janssenfederation/persistence"` | Image to use for deploying. | -| image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | imagePullSecrets | list | `[]` | | | nameOverride | string | `""` | | | resources | object | `{"limits":{"cpu":"300m","memory":"300Mi"},"requests":{"cpu":"300m","memory":"300Mi"}}` | Resource specs. | diff --git a/charts/janssen/charts/persistence/values.yaml b/charts/janssen/charts/persistence/values.yaml index da110e05a33..2cdf886cf08 100644 --- a/charts/janssen/charts/persistence/values.yaml +++ b/charts/janssen/charts/persistence/values.yaml @@ -18,7 +18,7 @@ image: # -- Image to use for deploying. repository: janssenfederation/persistence # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [ ] # -- Resource specs. diff --git a/charts/janssen/charts/scim/Chart.yaml b/charts/janssen/charts/scim/Chart.yaml index ee60b99f1b8..6bb40ea2c15 100644 --- a/charts/janssen/charts/scim/Chart.yaml +++ b/charts/janssen/charts/scim/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v2 name: scim -version: 1.0.0-beta.15 +version: 1.0.0-beta.16 kubeVersion: ">=v1.21.0-0" description: System for Cross-domain Identity Management (SCIM) version 2.0 type: application diff --git a/charts/janssen/charts/scim/README.md b/charts/janssen/charts/scim/README.md index 41b415be6f5..82f3d8b2a2d 100644 --- a/charts/janssen/charts/scim/README.md +++ b/charts/janssen/charts/scim/README.md @@ -1,6 +1,6 @@ # scim -![Version: 1.0.0-beta.15](https://img.shields.io/badge/Version-1.0.0--beta.15-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) +![Version: 1.0.0-beta.16](https://img.shields.io/badge/Version-1.0.0--beta.16-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0](https://img.shields.io/badge/AppVersion-1.0.0-informational?style=flat-square) System for Cross-domain Identity Management (SCIM) version 2.0 @@ -36,7 +36,7 @@ Kubernetes: `>=v1.21.0-0` | image.pullPolicy | string | `"IfNotPresent"` | Image pullPolicy to use for deploying. | | image.pullSecrets | list | `[]` | Image Pull Secrets | | image.repository | string | `"janssenproject/scim"` | Image to use for deploying. | -| image.tag | string | `"1.0.0-beta.15"` | Image tag to use for deploying. | +| image.tag | string | `"1.0.0-beta.16"` | Image tag to use for deploying. | | livenessProbe | object | `{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":30,"periodSeconds":30,"timeoutSeconds":5}` | Configure the liveness healthcheck for SCIM if needed. | | livenessProbe.httpGet.path | string | `"/jans-scim/sys/health-check"` | http liveness probe endpoint | | readinessProbe | object | `{"httpGet":{"path":"/jans-scim/sys/health-check","port":8080},"initialDelaySeconds":25,"periodSeconds":25,"timeoutSeconds":5}` | Configure the readiness healthcheck for the SCIM if needed. | diff --git a/charts/janssen/charts/scim/templates/scim-virtual-services.yaml b/charts/janssen/charts/scim/templates/scim-virtual-services.yaml index d33804a85fe..9215e7640bb 100644 --- a/charts/janssen/charts/scim/templates/scim-virtual-services.yaml +++ b/charts/janssen/charts/scim/templates/scim-virtual-services.yaml @@ -26,7 +26,7 @@ spec: - uri: prefix: /.well-known/scim-configuration rewrite: - uri: /scim/restv1/scim-configuration + uri: /jans-scim/restv1/scim-configuration route: - destination: host: {{ .Values.global.scim.scimServiceName }}.{{.Release.Namespace}}.svc.cluster.local @@ -36,7 +36,7 @@ spec: - name: {{ .Release.Name }}-istio-scim match: - uri: - prefix: "/scim" + prefix: "/jans-scim" route: - destination: host: {{ .Values.global.scim.scimServiceName }}.{{.Release.Namespace}}.svc.cluster.local diff --git a/charts/janssen/charts/scim/values.yaml b/charts/janssen/charts/scim/values.yaml index bca9ad613f5..b0db52dcad9 100644 --- a/charts/janssen/charts/scim/values.yaml +++ b/charts/janssen/charts/scim/values.yaml @@ -28,7 +28,7 @@ image: # -- Image to use for deploying. repository: janssenproject/scim # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [ ] # -- Service replica number. diff --git a/charts/janssen/values.yaml b/charts/janssen/values.yaml index a1836770a3a..6b3437484d9 100644 --- a/charts/janssen/values.yaml +++ b/charts/janssen/values.yaml @@ -29,7 +29,7 @@ auth-server: # -- Image to use for deploying. repository: janssenproject/auth-server # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [] # -- Service replica number. @@ -96,7 +96,7 @@ auth-server-key-rotation: # -- Image to use for deploying. repository: janssenproject/certmanager # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [] # -- Auth server key rotation keys life in hours @@ -152,7 +152,7 @@ client-api: # -- Image to use for deploying. repository: janssenproject/client-api # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [] # -- Service replica number. @@ -307,7 +307,7 @@ config: # -- Image to use for deploying. repository: janssenproject/configurator # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [] # -- LDAP admin password if OpennDJ is used for persistence. @@ -371,7 +371,7 @@ config-api: # -- Image to use for deploying. repository: janssenproject/config-api # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [] # -- Service replica number. @@ -444,7 +444,7 @@ fido2: # -- Image to use for deploying. repository: janssenproject/fido2 # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [] # -- Service replica number. @@ -710,6 +710,18 @@ nginx-ingress: openidConfigLabels: {} # -- openid-configuration ingress resource additional annotations. openidAdditionalAnnotations: {} + # -- Enable endpoint /device-code + deviceCodeEnabled: true + # -- device-code ingress resource labels. key app is taken + deviceCodeLabels: {} + # -- device-code ingress resource additional annotations. + deviceCodeAdditionalAnnotations: {} + # -- Enable endpoint /firebase-messaging-sw.js + firebaseMessagingEnabled: true + # -- Firebase Messaging ingress resource labels. key app is taken + firebaseMessagingLabels: {} + # -- Firebase Messaging ingress resource additional annotations. + firebaseMessagingAdditionalAnnotations: {} # -- Enable endpoint /.well-known/uma2-configuration uma2ConfigEnabled: true # -- uma2 config ingress resource labels. key app is taken @@ -943,7 +955,7 @@ persistence: # -- Image to use for deploying. repository: janssenproject/persistence-loader # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [] # -- Resource specs. @@ -997,7 +1009,7 @@ scim: # -- Image to use for deploying. repository: janssenproject/scim # -- Image tag to use for deploying. - tag: 1.0.0-beta.15 + tag: 1.0.0-beta.16 # -- Image Pull Secrets pullSecrets: [] # -- Service replica number.