Local oauth dev with dex (#1285)

* Initial local deploy on kind with oidc/dex

* Move user rbac to file.

* Wait for api server before updating /etc/hosts

* kubeapps-user only has access to kubeapps-user-namespace

Makefile

@@ -6,6 +6,7 @@ VERSION ?= $$(git rev-parse HEAD)
 
 include ./script/cluster-kind.mk
 include ./script/cluster-openshift.mk
+include ./script/deploy-dev.mk
 
 IMG_MODIFIER ?= 
 

docs/user/manifests/kubeapps-local-dev-apiserver-config.json

@@ -7,8 +7,8 @@
       "extraMounts": [
         {
           "readOnly": true,
-          "hostPath": "./script/test-certs/ca.cert.pem",
-          "containerPath": "/etc/ssl/certs/kubeapps-local-ca.cert.pem"
+          "hostPath": "./script/test-certs/dex.cert.pem",
+          "containerPath": "/etc/ssl/certs/dex.cert.pem"
         }
       ]
     }
@@ -18,7 +18,7 @@
       "group": "kubeadm.k8s.io",
       "version": "v1beta2",
       "kind": "ClusterConfiguration",
-      "patch": "[{ \"op\": \"add\", \"path\": \"/apiServer/extraArgs\", \"value\": {}}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-issuer-url\", \"value\": \"https://dex.dex:32000\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-client-id\", \"value\": \"kubeapps\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-ca-file\", \"value\": \"/etc/ssl/certs/kubeapps-local-ca.cert.pem\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-username-claim\", \"value\": \"email\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-username-prefix\",\"value\": \"oidc:\"}]"
+      "patch": "[{ \"op\": \"add\", \"path\": \"/apiServer/extraArgs\", \"value\": {}}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-issuer-url\", \"value\": \"https://dex.dex:32000\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-client-id\", \"value\": \"kubeapps\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-ca-file\", \"value\": \"/etc/ssl/certs/dex.cert.pem\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-username-claim\", \"value\": \"email\"}, {\"op\": \"add\", \"path\": \"/apiServer/extraArgs/oidc-username-prefix\",\"value\": \"oidc:\"}]"
     }
   ]
 }

docs/user/manifests/kubeapps-local-dev-auth-proxy-values.yaml

@@ -0,0 +1,10 @@
+authProxy:
+  enabled: true
+  provider: oidc
+  clientID: kubeapps
+  clientSecret: ZXhhbXBsZS1hcHAtc2VjcmV0
+  cookieSecret: bm90LWdvb2Qtc2VjcmV0Cg==
+  additionalFlags:
+    - -cookie-secure=false
+    - -oidc-issuer-url=https://dex.dex:32000
+    - -ssl-insecure-skip-verify=true

docs/user/manifests/kubeapps-local-dev-dex-values.yaml

@@ -0,0 +1,27 @@
+https: true
+certs:
+  web:
+    create: false
+config:
+  issuer: https://dex.dex:32000
+  web:
+    tlsCert: /etc/dex/tls/https/server/tls.crt
+    tlsKey: /etc/dex/tls/https/server/tls.key
+  # Instead of reading from an external storage, use this list of clients.
+  staticClients:
+  - id: kubeapps
+    redirectURIs:
+    - 'http://localhost:3000/oauth2/callback'
+    name: 'Kubeapps'
+    secret: ZXhhbXBsZS1hcHAtc2VjcmV0
+  staticPasswords:
+  # Both users have a bcrypt hash of the string "password"
+  - email: "kubeapps-operator@example.com"
+    hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
+    username: "admin"
+    userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
+  - email: "kubeapps-user@example.com"
+    hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
+    username: "kubeapps-user"
+    userID: "08a8684b-db88-4b73-90a9-3cd1661f5467"
+grpc: false

docs/user/manifests/kubeapps-local-dev-tiller-rbac.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tiller
+  namespace: kube-system
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: tiller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- kind: ServiceAccount
+  name: tiller
+  namespace: kube-system
+

docs/user/manifests/kubeapps-local-dev-users-rbac.yaml

@@ -0,0 +1,34 @@
+# kubeapps-operator has cluster-admin
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kubeapps-operator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: oidc:kubeapps-operator@example.com
+# kubeapps-user has access only to the kubeapps-user-namespace namespace
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: kubeapps-user-namespace
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: kubeapps-user
+  namespace: kubeapps-user-namespace
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit
+subjects:
+- apiGroup: rbac.authorization.k8s.io
+  kind: User
+  name: oidc:kubeapps-user@example.com
+

script/cluster-kind.mk

@@ -19,6 +19,7 @@ ${CLUSTER_CONFIG}: devel/local-dev-apiserver-config.json
 cluster-kind: ${CLUSTER_CONFIG}
 
 delete-cluster-kind:
-	kind delete cluster --name ${CLUSTER_NAME}
+	kind delete cluster --name ${CLUSTER_NAME} || true
+	rm devel/local-dev-apiserver-config.json || true
 
 .PHONY: cluster-kind cluster-kind-delete

script/deploy-dev.mk

@@ -0,0 +1,52 @@
+# Deploy a dev environment of Kubeapps using OIDC for authentication with a
+# local dex as the provider.
+#
+# Targets in this helper assume that kubectl is configured with a cluster
+# that has been setup with OIDC support (see ./cluster-kind.mk)
+
+deploy-helm:
+	kubectl apply -f ./docs/user/manifests/kubeapps-local-dev-tiller-rbac.yaml
+	helm init --service-account tiller --wait
+
+deploy-dex: deploy-helm
+	kubectl create namespace dex
+	kubectl -n dex create secret tls dex-web-server-tls \
+		--key ./script/test-certs/dex.key.pem \
+		--cert ./script/test-certs/dex.cert.pem
+	helm install stable/dex --namespace dex --name dex --version 2.4.0 \
+		--values ./docs/user/manifests/kubeapps-local-dev-dex-values.yaml
+
+# The api server does not have service dns entries (in kind or vanilla k8s), so
+# dex is normally required to be available on an external host. Short-circuit
+# that requirement by ensuring dex.dex resolves to the internal IP address on
+# the apiserver so that it can initialise the oidc plugin.
+update-apiserver-etc-hosts:
+	while ! kubectl -n kube-system get po kube-apiserver-kubeapps-control-plane; do \
+		echo "Waiting for api server" && sleep 1; \
+	done
+	kubectl -n kube-system exec kube-apiserver-kubeapps-control-plane -- \
+		sh -c "echo '$(shell kubectl -n dex get svc -o=jsonpath='{.items[0].spec.clusterIP}') dex.dex' >> /etc/hosts"
+
+deploy-dev: deploy-dex update-apiserver-etc-hosts
+	helm install ./chart/kubeapps --namespace kubeapps --name kubeapps \
+		--values ./docs/user/manifests/kubeapps-local-dev-values.yaml \
+		--values ./docs/user/manifests/kubeapps-local-dev-auth-proxy-values.yaml
+	kubectl apply -f ./docs/user/manifests/kubeapps-local-dev-users-rbac.yaml
+	@echo "\nEnsure you have the entry '127.0.0.1 dex.dex' in your /etc/hosts, then run\n"
+	@echo "kubectl -n dex port-forward svc/dex 32000\n"
+	@echo "and in another terminal using the same cluster,\n"
+	@echo "kubectl -n kubeapps port-forward svc/kubeapps 3000:80\n"
+	@echo "You can then open http://localhost:3000 and login as either of"
+	@echo "  kubeapps-operator@example.com:password"
+	@echo "  kubeapps-user@example.com:password"
+	@echo "to authenticate with the corresponding permissions."
+
+reset-dev:
+	helm delete --purge kubeapps || true
+	helm delete --purge dex || true
+	kubectl delete namespace dex kubeapps || true
+	helm reset || true
+	kubectl delete -f ./docs/user/manifests/kubeapps-local-dev-tiller-rbac.yaml || true
+	kubectl delete -f ./docs/user/manifests/kubeapps-local-dev-users-rbac.yaml
+
+.PHONY: deploy-dex deploy-dev reset-dev update-apiserver-etc-hosts

script/test-certs/ca.cert.pem

@@ -1,30 +1,29 @@
 -----BEGIN CERTIFICATE-----
-MIIFDTCCAvWgAwIBAgIUQLz2bm0fYy1ctWoRM2bwGoG1vBYwDQYJKoZIhvcNAQEL
-BQAwFjEUMBIGA1UEAwwLa3ViZWFwcHMtY2EwHhcNMTkxMTA1MDU0MjAwWhcNMzkx
-MDMxMDU0MjAwWjAWMRQwEgYDVQQDDAtrdWJlYXBwcy1jYTCCAiIwDQYJKoZIhvcN
-AQEBBQADggIPADCCAgoCggIBANhf6+66VFCDyDoPXecisT7adkSCb/sWb3eWbp7Z
-K2/VUM3kJlonrwPC+qMo7oBtWCT9tdk2QQZmLFGw+KD/2PO24sxQXYZcmjDED9IM
-2LpX+eHeE2370A20UbQb0go9D5nFVpk6rG+tYQkkYUvDB3FwCfQEEpsLFoHYjiER
-ZelyKfu882riot16DNPeWaLr5jsGL8wTHUJw7bLkA6SgmjdUzDKBmVp7glM+5UOY
-7htAb8UEq0+1eH2YXCZpxTCdEI53obuyl1Sua0F+vWADAf9zejFw7v7o8W3fCG4A
-6SUN4QByvsg5P8+OxmaOpzHz3g29GqAZLmOX96sN9+CLvoMRsmikyXHjcrJ4yrXr
-OdyLzWoukCgpiawyIHFDKBQ2spGiRiUPrj5GsBUpECRAenwMc/enx7QsljyIBGRc
-WcknONwi0opxemGlVrVy12x95BlgmcWUEbvxJlXCGo7ZQ/cKQ6rLoUMnh7Yi7LA+
-Gk0R+GWuk/oU5VgDz5mToeRLI+gvt/waf2FGfPasz6W66lWxaH7MR8ucLw3we6fE
-y1K0hX3t+nNOa1mJsMiXWzvmVsEgZdLKkY8cTgdfeqk/t37h3fTmQs+3CLoTUwOD
-+Z9b/Al1GAQHziFmtTn8B+Ej0PUImnCxo8dBjZTf5Iq0yN5RjT7XLhkmTyZ0IFyW
-YDkDAgMBAAGjUzBRMB0GA1UdDgQWBBTwC0pIDHG1nAh2lJgJkG21ooXibTAfBgNV
-HSMEGDAWgBTwC0pIDHG1nAh2lJgJkG21ooXibTAPBgNVHRMBAf8EBTADAQH/MA0G
-CSqGSIb3DQEBCwUAA4ICAQBC/C258X3hn38TzIK4EqyHDJwXhrPaKvPJvziD+zvT
-cEYfbFXJLKfd0t83YNzaQs1H49VV0Gu7FTbYuqN/MFMKnVJW/8QS2KXlKt6ovTm+
-YGcmK+xmEML2i2nw79x2d7dIL5AKOe7oIbBTScVtdHRaZ2Iv2gLbtP16WPX0uI4z
-e/7lvc3pv0wGTCE6b0RZ+4+4bFTPowfN+VYbwRwoUeZQhGIkW10jLPFPPiisHoRP
-QmWBF/dTvj8LJqHQwJjV0FE52zf/SEjZCzxFLxo4zVrTGQXWiHcA18AAzzAS0M6F
-kRs3BFNEgC255MqiGRhJi8klS82tJ0RKDgsJ2viI9JUVn84XAtbzJFebZHfj0B2X
-Csa9bDvdDmkc6LUkhGJWBLiCOGYzo1D5Vub1pPHLRWwRBg5wqKG1Vl+CtKA/MN3d
-D6pPe90/ybWd825I5xc6U9MCj9BhvO5+YJzJzpy3cghwdJkpZ1KjIvYz0qf/6Lta
-4Zmn9Jz4F4CaafFZlVXmhTOIXnRgTEbiy6j2A6V1ppEvPO6ITpYVfElMlPR9RhrX
-Xt3uXPbgpcVl5H1eU/6fn4LJFPAPErKxdqjIiJldMOMp+c4o8CVtO3dH0KjN0Y1x
-Jbp5ELrj63z6s3xSatZBu1ZMtVso9VmNDM2/sjucdXlt4Yye6VuhQWeVArl9tz7q
-WA==
+MIIE/zCCAuegAwIBAgIJAKOL4oBWQrNSMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNV
+BAMMC2t1YmVhcHBzLWNhMB4XDTE5MTExMzAwNDYzN1oXDTM5MTEwODAwNDYzN1ow
+FjEUMBIGA1UEAwwLa3ViZWFwcHMtY2EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
+ggIKAoICAQC1Hul/DCsWQO0RuDR4RutxUIdCf2OB86ikYc3TWJ2aQPir1jP/vEkx
+zjx1VPeC1XtfW/1bQKz2iCV3G9XjnM5oe1hOVind/XV5KpHGbaPkaJqBFAeXEpHq
+5c8NkufQNddNPO90tIqLWfRyxBGJMcGKeMM8lefnlWCBqvT//3BRjsZImrS8B8cC
+bx/PoyelvMBZH4g3FmRIBJR9nY6MzJbaEjmzQjESFUOrZJbFe9crqaIZ51LHvX2t
+U0meV6BmeJir+Ow1IlpycaMAHH41ZUfPu2UBw0w9mLHVTnWn6S0LzbmEwRAek9Jt
+IOsp10XxN4Sq54xuoBpfidn3fdGvKIba+IAdYEPHlgyyv9XBSIDe05HA0mFSjILk
+LPlAUo2tAhOKD5Oq48HbcOjCvt8uOthA/9/eDyZBZStNRSVBBwOtqFeeT6Y1ecX1
+vC08Ck2XhHvKVH+MB4F57YxyK/ReVPfDdlLML56LgH2sFhmOLBRt+rtwj9AD41w6
+dCYquNsfHXTpnYlA7vgnXCnQckkBNkc1JXAeVLQ/J5N83FuRB+I8NVkmM8FUMjgv
+HXgLYrn6o8QUQeTenYJTC2FnPrZbOzh9T68rWye+OhdYxD3g8vHwoUNEuywmZ/ch
+g5hfLqOjpOIu5rDX2RWLF94EW/oF3cq6+Ntoy6+Sm74wtqaLhoYihwIDAQABo1Aw
+TjAdBgNVHQ4EFgQUC9T3gVtFcjQPszRq3ZRJEwF6t0IwHwYDVR0jBBgwFoAUC9T3
+gVtFcjQPszRq3ZRJEwF6t0IwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC
+AgEAVE7tZjE05qVM/54Rh9Y/SwAt3agZmkiNmOTVp3Nhw/OVxWW6s9VxX3CvZahe
+bN+qRKdigW6YigmLMf2mUvEEd6GjZuOWTQqvJjglA+WRGQuhZDE7VfAwIBuSf9xT
+fgHNLRY8q+RfDvVKdndyP8mxoQFN4I/YQmUhAnMw1aZwMb7YWyUNl95P86+EEs64
+eMTGgc45Gc/hTNoRmoS45bzWZTccHypxr0wkmZZEPvRt8uia55YyKUu+a88F1HIH
+pLx8o6D48pv1kF3V9HL9zFjDLekNREtHQxNYAitupUDz/hbf/Fv2DMKdKiTV8RhA
+QkPrLyyt53sBJoopxyZzFXTucFw/N2reymYOTInRDpfc9Jj8QAyGhVBF2cFFBEbU
+56TZ3bSsxFPvLpG51ccVJogGb4073nH9iZDbdOI9HGK7dZK1VlLJ0ftEqZyjwdij
+h7i0hKBBRjSAkH1bXD5ti6XwOkqR2/huC0kv7RsQno2d59NN4hdM36lk0LL/Gr7p
+922aWxR34qcRC71vx/vvuqrHfX/BPf8ZdXAPHHpmjLaHTNsk0oLeoHEXNovozUX3
+qIutu5NeYwcOYabXVU1RRoXrVZesweBJzE6RFAM3BjRh55xyVQ7/6QYJ9ikl+6eb
+nER96EAilscq0RRl7QktQzkeNtIAuCAbyN+OF203SGDqiiQ=
 -----END CERTIFICATE-----

script/test-certs/dex.cert.pem

@@ -1,28 +1,27 @@
 -----BEGIN CERTIFICATE-----
-MIIEszCCApsCFBCLdNSO4+LHZUmF5XkvJcjmniYCMA0GCSqGSIb3DQEBCwUAMBYx
-FDASBgNVBAMMC2t1YmVhcHBzLWNhMB4XDTE5MTEwNTA1NDIwM1oXDTM5MTAzMTA1
-NDIwM1owFjEUMBIGA1UEAwwLa3ViZWFwcHMtY2EwggIiMA0GCSqGSIb3DQEBAQUA
-A4ICDwAwggIKAoICAQCYl5Ad2EvX3Gg9AK0yBUIxz3XfNzPP4DifnbHVuYDM80U/
-o2W4DT1p+QNbWWr8Cbu+Rab2eqob/hPovmd3olHE50l7ADlVx6idKgx481qAKukP
-kVV9vo6FGZVD1HLe+5JAhLDgOkbi9OBR0cqnQszyCSfjVCoaQ7vbYjXBv/RLFP6/
-b8/I/387hWIZawMWC7IOxm7rY3L0vZMIEdvh5Q6GKtNdZcfQ42CyQkeuDDTidaQb
-VZfKCsf1qrbDX9EvlfDNIhhMRXgCiJFJ5WctP+Ns06k8MJ2Ng7KcngTSjF7YEDph
-qtfV4Km7MxAtYlDuscPIig0X6JLBX77N8F9asYCFQlozcEPSnHa1/ywkPJrp1yqS
-jlDaaYzVoSj4hzimwFBYqtb4GV0vk0HIHbLkjVMdujLqjGNOw+TMv+LNbNBZjWAT
-p/Iwz84+1sYSd5TC0OodrTpUcuvCLn9EFG+gINn/adgwEMXZEEnHVDMszn9tYGuY
-1hpDrsHhxY2HVN3hR9Y8ubf/Ew0ACRYHlfb04+j8W+H2kMCQj0vCnuPCjqePU13g
-vK0HqLZ5/1zFw1cosm8KmMh0MfYqMgl8AQK1iVE5e4Az9Sgx1besELByJbhO/dNj
-cOYSbN5CE/hzWT/CuyhBUgMhxbaIV0TP9Cq2JmRgn36JymgWiWsLsoNnayidMwID
-AQABMA0GCSqGSIb3DQEBCwUAA4ICAQClAfWvNGFgsmsxMdm6xkg5DUOM2t0idw18
-TJcZRrSNvKv3o2b4gz47hW0lwCaxchq5UJbMf+jl/jsJCz9ClEOBNI2w9/YR0QGN
-Ha97pjB/+wXqyVZCJ6FrUiQ7hpnOkFt6CzOsLXNhGbPnqNFay++8W7gjUXXzK8jj
-MFfJVErGoPvloYpiqwx/XlSrbkWYn6PsjYt5tqYzTGbYgc/Dq8ceN1rC9G8hRGVr
-uQvWfS0C6ykVy0CttNyvT2GZ0Em4tdhnbWfaRkBWfYmPMx0YPJAi8a6Z/AUNldf7
-+iNHj+FvAdlrcCalc2QEQuFVuoiz7jg0XgCgQmCEEIYwNBjQaN0oe33SYbyzkfNq
-xb5RGEP40+Y7TBNShDc8PHa3PbkCTa9TXZr+GlHAoMNPcbrw1HgIUYb4Hkwi9Nuw
-RDD/7nA/MzpK7cGmtlYaOuVUMCed7Vj3OBG5QveU6XRpeJR8Erv1vkCp4iZf6Q8W
-jufnd2bnB3YqOLTIf8KeRgKXToAQocu0YK5ZLLgnMzYp/Bz9nXoK8kc083377q4Y
-chKQYysByxH0Ju0uPn04MKkzCxtneSCZX3y8zKn7siE/UTmazE/H/Kf6QYb9MYmQ
-ehGbF0tjzAMUjMh7tMlsFqA5kT1iAw5CWELHldaInl86BozQD9Hw1mBp9MUkZfgY
-BEniXEI64Q==
+MIIEpDCCAowCCQDQ1XUVemTFBjANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtr
+dWJlYXBwcy1jYTAeFw0xOTExMTMwMDQ2MzlaFw0zOTExMDgwMDQ2MzlaMBIxEDAO
+BgNVBAMMB2RleC5kZXgwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCr
+Lvi4QuqIgFMWmMVjk+8XX0ECJo8NpOKVIQCDAY9KdHT+BM9/tfbfZMJwOiMn8qz2
+XLyI4nzohyLyx++B+nfmoVQW1pu35ayppscQbI0C2jyhakAOp2a+uzvEUcCUmgzs
+VM18EvnIElHWIg+XcUxY2DXI7uI27ECVGcch1znLuWQnqxj/ukskBAVLus4coPWT
+rs2jGikZ4f5c+lI7ijM86pCUK3gsHDMqMoUEpab/+3WmI0M3WahLS7rVtNkJiuQl
+flRiMW0F8rr3noyIf72B1z/SaDOJV0+DM9ExKLAyhSYK31XlyWTuRMYH9u7gZ1nN
+wKBHHFS23S52oq8PBdJEVELoMpKBa3BW7hiUNGgC89kdyOn+Hv+Emh0zNYHGeK0P
++olyQQmtL+alaQmEph+YNp4TVXmTkSInSFo5JeOL3ZXWX4eAMcAJcGsGMpSQ2qPc
+itn6l+ObYZjHYtZeXV09SNDjs2WBfjLMsL5pCny2TJU5bvuLbGUU2w1K8xUNDQIY
+e+3uA3Mb+GXGU1lJrjUT9sgndGT6h9NNCLd/HQTQTqCJ1xZJWC/KqxYbGbylP1QF
+SxKkev8I5TfAaVHBLBR2xzx+RCXQW1roONIrtFqqL2yQQoW5dRHFf49D3T10eO8p
+WW+7g0rkmr0OVYtssQ0fIejy9HBqZ39W2P3U3+UQuwIDAQABMA0GCSqGSIb3DQEB
+CwUAA4ICAQBprzbKfHHSlAQmJWDLz6NgjQ6/TE6FGjvibIpAg2s7oG80v4qVbqSR
+e6pF6BQAG5zSW+PTBag89INVbpGUNoXkUdHhHdZMNOrVgmiosdmzA7rTBYfnv4Be
+m/FaJogdRedCOtRUcQoBHMCVE38ScltdwRcGqdQfc8k6ITKA+5GTAt+CPMxzZyKE
+k40lbiF/F73pEBBk945JAucMIq+w+11PDF194vC4SurJI4qs1IBByjGpK+T3b0rK
+H8av/n+uFMT0HToWYU/ynHqVdngE65LHsuHmz9NmTG39W2i+IpsblPsO0QlaAvgN
+KLmgeemmxjFl2Ju3OXKq747DFzyuGSGbrGox04dwiysSNcV4JmB2uAhRzyu0+qFm
+z2CuVT815cvLPT3gwYnoGReP4YZuUdaCIr1T7FZ7f3A0gjUA/uzsRGWlgDLtzq6r
+1AnssRIoXnyHIrB+fzFLbo/UZGUc26q3d+lshwLvFDN0MHaAFPJFhvfUcVzmTwkt
+E7JUG5drdhw2xKXKQQennVJY2/X9LPFXSYwXNpgdYWXC15sPBUCrX14gjqUE35wQ
+Ds5Nk7ApS8qdFgr4/YsUuO4W47Aqf7fZNGrOxK6AsvPlnlS6k6W0Gco2gqa3i9su
+B4ss7jmPIf/u4ED0Tbyc/nci+uatdN1HoI5tFqme/32hh8wd/EZj9Q==
 -----END CERTIFICATE-----