From 20a38ce1296ab510db4dae13e3f118304767cef7 Mon Sep 17 00:00:00 2001 From: TrueCharts-Bot Date: Thu, 27 Jan 2022 23:33:08 +0000 Subject: [PATCH] Commit new App releases for TrueCharts Signed-off-by: TrueCharts-Bot --- core/traefik/10.0.43/CHANGELOG.md | 99 + core/traefik/10.0.43/CONFIG.md | 8 + core/traefik/10.0.43/Chart.lock | 6 + core/traefik/10.0.43/Chart.yaml | 30 + core/traefik/10.0.43/README.md | 39 + core/traefik/10.0.43/app-readme.md | 3 + core/traefik/10.0.43/charts/common-8.14.2.tgz | Bin 0 -> 40699 bytes core/traefik/10.0.43/crds/ingressroute.yaml | 198 ++ .../traefik/10.0.43/crds/ingressroutetcp.yaml | 160 ++ .../traefik/10.0.43/crds/ingressrouteudp.yaml | 84 + core/traefik/10.0.43/crds/middlewares.yaml | 563 ++++ core/traefik/10.0.43/crds/middlewarestcp.yaml | 59 + .../10.0.43/crds/serverstransports.yaml | 101 + core/traefik/10.0.43/crds/tlsoptions.yaml | 87 + core/traefik/10.0.43/crds/tlsstores.yaml | 64 + .../traefik/10.0.43/crds/traefikservices.yaml | 270 ++ core/traefik/10.0.43/helm-values.md | 51 + core/traefik/10.0.43/ix_values.yaml | 316 +++ core/traefik/10.0.43/questions.yaml | 2462 +++++++++++++++++ core/traefik/10.0.43/security.md | 102 + core/traefik/10.0.43/templates/_args.tpl | 146 + core/traefik/10.0.43/templates/_helpers.tpl | 22 + .../10.0.43/templates/_ingressclass.tpl | 24 + .../10.0.43/templates/_ingressroute.tpl | 25 + .../traefik/10.0.43/templates/_portalhook.tpl | 26 + .../traefik/10.0.43/templates/_tlsoptions.tpl | 12 + core/traefik/10.0.43/templates/common.yaml | 24 + .../middlewares/basic-middleware.yaml | 65 + .../templates/middlewares/basicauth.yaml | 34 + .../10.0.43/templates/middlewares/chain.yaml | 21 + .../templates/middlewares/forwardauth.yaml | 30 + .../templates/middlewares/ipwhitelist.yaml | 33 + .../templates/middlewares/ratelimit.yaml | 19 + .../templates/middlewares/redirectScheme.yaml | 19 + .../templates/middlewares/redirectregex.yaml | 20 + .../templates/middlewares/tc-nextcloud.yaml | 25 + core/traefik/10.0.43/values.yaml | 0 37 files changed, 5247 insertions(+) create mode 100644 core/traefik/10.0.43/CHANGELOG.md create mode 100644 core/traefik/10.0.43/CONFIG.md create mode 100644 core/traefik/10.0.43/Chart.lock create mode 100644 core/traefik/10.0.43/Chart.yaml create mode 100644 core/traefik/10.0.43/README.md create mode 100644 core/traefik/10.0.43/app-readme.md create mode 100644 core/traefik/10.0.43/charts/common-8.14.2.tgz create mode 100644 core/traefik/10.0.43/crds/ingressroute.yaml create mode 100644 core/traefik/10.0.43/crds/ingressroutetcp.yaml create mode 100644 core/traefik/10.0.43/crds/ingressrouteudp.yaml create mode 100644 core/traefik/10.0.43/crds/middlewares.yaml create mode 100644 core/traefik/10.0.43/crds/middlewarestcp.yaml create mode 100644 core/traefik/10.0.43/crds/serverstransports.yaml create mode 100644 core/traefik/10.0.43/crds/tlsoptions.yaml create mode 100644 core/traefik/10.0.43/crds/tlsstores.yaml create mode 100644 core/traefik/10.0.43/crds/traefikservices.yaml create mode 100644 core/traefik/10.0.43/helm-values.md create mode 100644 core/traefik/10.0.43/ix_values.yaml create mode 100644 core/traefik/10.0.43/questions.yaml create mode 100644 core/traefik/10.0.43/security.md create mode 100644 core/traefik/10.0.43/templates/_args.tpl create mode 100644 core/traefik/10.0.43/templates/_helpers.tpl create mode 100644 core/traefik/10.0.43/templates/_ingressclass.tpl create mode 100644 core/traefik/10.0.43/templates/_ingressroute.tpl create mode 100644 core/traefik/10.0.43/templates/_portalhook.tpl create mode 100644 core/traefik/10.0.43/templates/_tlsoptions.tpl create mode 100644 core/traefik/10.0.43/templates/common.yaml create mode 100644 core/traefik/10.0.43/templates/middlewares/basic-middleware.yaml create mode 100644 core/traefik/10.0.43/templates/middlewares/basicauth.yaml create mode 100644 core/traefik/10.0.43/templates/middlewares/chain.yaml create mode 100644 core/traefik/10.0.43/templates/middlewares/forwardauth.yaml create mode 100644 core/traefik/10.0.43/templates/middlewares/ipwhitelist.yaml create mode 100644 core/traefik/10.0.43/templates/middlewares/ratelimit.yaml create mode 100644 core/traefik/10.0.43/templates/middlewares/redirectScheme.yaml create mode 100644 core/traefik/10.0.43/templates/middlewares/redirectregex.yaml create mode 100644 core/traefik/10.0.43/templates/middlewares/tc-nextcloud.yaml create mode 100644 core/traefik/10.0.43/values.yaml diff --git a/core/traefik/10.0.43/CHANGELOG.md b/core/traefik/10.0.43/CHANGELOG.md new file mode 100644 index 00000000000..0a45dd8b16d --- /dev/null +++ b/core/traefik/10.0.43/CHANGELOG.md @@ -0,0 +1,99 @@ +# Changelog
+ + + +### [traefik-10.0.43](https://github.com/truecharts/apps/compare/traefik-10.0.42...traefik-10.0.43) (2022-01-27) + +#### Fix + +* hide Traefik metrics port and enable prometheus metrics + + + + +### [traefik-10.0.42](https://github.com/truecharts/apps/compare/traefik-10.0.41...traefik-10.0.42) (2022-01-25) + +#### Chore + +* update helm general non-major helm releases ([#1791](https://github.com/truecharts/apps/issues/1791)) + + + + +### [traefik-10.0.41](https://github.com/truecharts/apps/compare/traefik-10.0.40...traefik-10.0.41) (2022-01-22) + +#### Chore + +* update helm general non-major helm releases ([#1766](https://github.com/truecharts/apps/issues/1766)) + + + + +### [traefik-10.0.40](https://github.com/truecharts/apps/compare/traefik-10.0.39...traefik-10.0.40) (2022-01-21) + +#### Chore + +* update helm general non-major helm releases ([#1759](https://github.com/truecharts/apps/issues/1759)) + +#### Fix + +* set additional_attrs: true on all dicts ([#1750](https://github.com/truecharts/apps/issues/1750)) + + + + +### [traefik-10.0.39](https://github.com/truecharts/apps/compare/traefik-10.0.38...traefik-10.0.39) (2022-01-18) + +#### Chore + +* update helm general non-major helm releases ([#1732](https://github.com/truecharts/apps/issues/1732)) + + + + +### [traefik-10.0.38](https://github.com/truecharts/apps/compare/traefik-10.0.37...traefik-10.0.38) (2022-01-13) + +#### Chore + +* update helm general non-major helm releases ([#1712](https://github.com/truecharts/apps/issues/1712)) + +#### Feat + +* expose capabilities in GUI ([#1709](https://github.com/truecharts/apps/issues/1709)) + + + + +### [traefik-10.0.37](https://github.com/truecharts/apps/compare/traefik-10.0.36...traefik-10.0.37) (2022-01-12) + +#### Chore + +* update helm general non-major helm releases ([#1704](https://github.com/truecharts/apps/issues/1704)) + + + + +### [traefik-10.0.36](https://github.com/truecharts/apps/compare/traefik-10.0.35...traefik-10.0.36) (2022-01-11) + +#### Chore + +* update helm general non-major helm releases ([#1693](https://github.com/truecharts/apps/issues/1693)) + + + + +### [traefik-10.0.34](https://github.com/truecharts/apps/compare/traefik-10.0.33...traefik-10.0.34) (2022-01-09) + +#### Fix + +* fix logic in tpl ([#1668](https://github.com/truecharts/apps/issues/1668)) + + + + +### [traefik-10.0.33](https://github.com/truecharts/apps/compare/traefik-10.0.32...traefik-10.0.33) (2022-01-04) + +#### Chore + +* update helm general non-major helm releases + diff --git a/core/traefik/10.0.43/CONFIG.md b/core/traefik/10.0.43/CONFIG.md new file mode 100644 index 00000000000..fc9b2fa2d5f --- /dev/null +++ b/core/traefik/10.0.43/CONFIG.md @@ -0,0 +1,8 @@ +# Configuration Options + +##### Connecting to other apps +If you need to connect this App to other Apps on TrueNAS SCALE, please refer to our "Linking Apps Internally" quick-start guide: +https://truecharts.org/manual/Quick-Start%20Guides/14-linking-apps/ + +##### Available config options +In the future this page is going to contain an automated list of options available in the installation/edit UI. diff --git a/core/traefik/10.0.43/Chart.lock b/core/traefik/10.0.43/Chart.lock new file mode 100644 index 00000000000..679aa187159 --- /dev/null +++ b/core/traefik/10.0.43/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: common + repository: https://truecharts.org + version: 8.14.2 +digest: sha256:add6a5e615f2accd0ebc68c6ccb45ed13078763b68888bc01ea839371d698449 +generated: "2022-01-27T23:30:03.584154842Z" diff --git a/core/traefik/10.0.43/Chart.yaml b/core/traefik/10.0.43/Chart.yaml new file mode 100644 index 00000000000..ccb76510a49 --- /dev/null +++ b/core/traefik/10.0.43/Chart.yaml @@ -0,0 +1,30 @@ +apiVersion: v2 +appVersion: "2.5.6" +dependencies: +- name: common + repository: https://truecharts.org + version: 8.14.2 +deprecated: false +description: Test App for Traefik +home: https://github.com/truecharts/apps/tree/master/charts/stable/traefik +icon: https://truecharts.org/_static/img/appicons/traefik-icon.png +keywords: +- traefik +- ingress +kubeVersion: '>=1.16.0-0' +maintainers: +- email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org +name: traefik +sources: +- https://github.com/traefik/traefik +- https://github.com/traefik/traefik-helm-chart +- https://traefik.io/ +type: application +version: 10.0.43 +annotations: + truecharts.org/catagories: | + - network + truecharts.org/SCALE-support: "true" + truecharts.org/grade: U diff --git a/core/traefik/10.0.43/README.md b/core/traefik/10.0.43/README.md new file mode 100644 index 00000000000..8aa099823f5 --- /dev/null +++ b/core/traefik/10.0.43/README.md @@ -0,0 +1,39 @@ +# Introduction + +Test App for Traefik + +TrueCharts are designed to be installed as TrueNAS SCALE app only. We can not guarantee this charts works as a stand-alone helm installation. +**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/apps/issues/new/choose)** + +## Source Code + +* +* +* + +## Requirements + +Kubernetes: `>=1.16.0-0` + +## Dependencies + +| Repository | Name | Version | +|------------|------|---------| +| https://truecharts.org | common | 8.14.2 | + +## Installing the Chart + +To install this App on TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/03-Installing-an-App/). + +## Uninstalling the Chart + +To remove this App from TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/07-Deleting-an-App/). + +## Support + +- Please check our [quick-start guides](https://truecharts.org/manual/Quick-Start%20Guides/01-Open-Apps/) first. +- See the [Wiki](https://truecharts.org) +- Check our [Discord](https://discord.gg/tVsPTHWTtr) +- Open a [issue](https://github.com/truecharts/apps/issues/new/choose) +--- +All Rights Reserved - The TrueCharts Project diff --git a/core/traefik/10.0.43/app-readme.md b/core/traefik/10.0.43/app-readme.md new file mode 100644 index 00000000000..823c75135e0 --- /dev/null +++ b/core/traefik/10.0.43/app-readme.md @@ -0,0 +1,3 @@ +Test App for Traefik + +This App is supplied by TrueCharts, for more information please visit https://truecharts.org diff --git a/core/traefik/10.0.43/charts/common-8.14.2.tgz b/core/traefik/10.0.43/charts/common-8.14.2.tgz new file mode 100644 index 0000000000000000000000000000000000000000..8e9f52707c284d237f7707f5b1a60556c6374148 GIT binary patch literal 40699 zcmV)iK%&1NiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYcciT9UI68mpQ{cy>Z`-}r)3TgsH*?qRq`Pw_aeQJYefKvz zCxJ-F!k8l21SCh}&Ue2D?*~Cj@~a2ogrFZML z{LcMB9$4Uys3bVg#$Y*U!J^PVQ%Dh^tpt&{#0BN=epqBN`wOIaQo?ctrg;g@%LU>D zL|U_aj>cd{X+g%_?ggf^#iSGG^DZqHDCT9luqa5EmI!s{kWf^1<$FPjEgZ9k6bQJ4 z6qckTKrIL=<2<7%qa5m@dpH{QdWQ!GtxL4J%FBd|TWw$(Yqb@oZT_Ow2C|vU#RTcD ze*4!K{Z4<>>9u>`w&oCL6ygk(92lBIoQ?s`rulyxz@5CjXaSHx)?aG?09cf%LEoz& zic1XWsz76fUTdjvdDiI8(&A(j#OPDSYxhDqDxc>XSgW<5}um8ir;p6&$i027t zx52vtWgkyZ04Y$6r#J?2o=x$^qJ(U%x1NCiPS6xCQpyUSAp|BU&97Q{fwE2TVg3=fBs!C)|X);l;vz32T2>`jK~U^*H+fBt+E9JU(jqRi(M z;&j`QR`u!!T0`D&oK^Ytu$)mIbcUUQ8s7e4AN8Ikagy|tQQUhznNFV%pU3-$F&a*X zhXR{lWBE@@zQT?>~PwnnE}j>>rEhx9jalhHKZKOFV@`;&OsPxgli z9PIbvVQ&D3&khbYXuE!NkJ2l+B63{gJV6ANOH^(8)`0OCarK-(uMa3{JaE7)WX;G_wl#c||4F_02TL;G()_txls&O6mo*(Q#AHvB5 zqUXIs^n5t!PY2UvfCdQ~#lz{K*M|p_=ZC%F!QuX3xF5r3Xwn}glV@=_mg2C^@fuH8YcZ`{Xy^G z*<>)9^rn;Pu=jj2I*8Hp{ewaBEI#ZHr_=rYX*?P|e>U2v`Avtqb&=*1n3^#{6u=DR zOH`IPL41QISUj5IFCd@tU(-dJvdxIx!n~8E9Vo0E$|x=oF9Q-Z#Tn)k2Q&b?CMIXc zM{iz@!4#$hwOVYaR_1AnN(~ofaFQaqVAa=73&;=2nD51F zB>SZz?CQ2!z^?TM6FLTe|A&Atw~8d6BRTL-004a7CEoHsZCq}T!5CbBt?69~Cn((p ztf+9?KHaccyCWxy`2>}WkP}33i4suc2@%Ub#W5sf&~G51MR8HW1OY-zNYTZL7yThG z!Ap${*<*dciRg)-t@kJ{5u^z0NRG7&V3vUQd79$v;zN-@D(RBJI+MLQLqTBgvX>}D z6jebO@B-LNJ`@ZLz!zCwvZaFw`=;<`ORKa&uoqVM%@}(v&EXfY$lwyoM4GwXh>P1XDE8DZ}~Q_q8lp3Op{Xz!^$WO!E@JG|jIFXTS)O6)13giL(m; zL4v1KRGN)rf@8V|@Vv-N3NxyCHfN{c#}BVXXB6Zyi1_cQB^y>uSkn4@4zpy3>}ohl z$g*X?4O=Z)h%e;;3|L-}hT812RrM%IL=Bv276WLmAT9Ws0&MyxD+R67dIC;MJclJt zSAhhmwL4fKW>2u(0KjkYN&n z9-LE1XJA3tG|o^u2TNFDR)O%61*Eev__q6Pr55rauMx)Ls2of%GI)@a;FiltB0@4{`3=wBcl_0!-yql1QQPHuPrFc;EZ#;$`YWkyg+o!2+4>6De&hwd#~j# zc)~^R9DZ@%^?Dl0@#%*T6sP!Ke6CMX8KaCcM$HO7Gv(f*d0ws>i;7+!3$e_0emF)j zj`KxEYj+m1*pVpaZ7i@g8Bjq45+oqAe32$#f`HHj*e+E3rKdqcvuK&IL6{_p8+tGU z+M0rKK9gFvWK}*kGzSYJHICO)kmZy!Sf)@&MFkVCOYZ?F0AZpyAW9_Hv3CN1qIr=* ziu9>Q6uCnT!Ew4E6qWDuRH!c2@9%Mz;OwGy;L8b&^>Dx96h@e8E~$`kTsDATAx~S? zJF2o53j~`l^UGe~wF+u&?Fzfv7z@=A7oL2(EmCGws<4_+e81qsAL?YuJ~@`(o+Zi0I z5pg*<5t@S{FBYj_;e_pDsZc2xy~rzwIbo9W>(_5vPr$J*(vnkxvgHqDKG(ki z=yWaxTiUUVdb#@rh7$UShfeaSDmpf*WH2Ws;N=_e2aEssZO!h=L>|N>=9Jv(!j_z$Kw<$^0bher{Pn{4JOf z-H}~A0(k1Qjftqp*;`c8Qm7VFz&kCCC?7q$y0X0#a)bNw$I2oD#{h zz#OhXiAbI<5y(iI=a-8DU_ur`v11!u@Hf5G7}P~UI4(j`G1AxEPY4}Bn!J^k;9qjr z9Q7l)D-Z{4O7ao}%Xo%tML_6TU8!Snv|YPPkVkVuSCXEw=fD5GMALu#W2b>>#CaB@ zf|9PP*Os~*&Mw%;j4>07kC3)3*nJ}84$dyxbcWRH-Ifp!XX57@oLv%^V2)wNRFwrm zT%%z$NKm}s>n_hI`a(M~EZ_vEn6kZOzMuprdJFgChu3UoTvL@;bH`RSHXBKq7jleY zVq58qg3QfjvUMPv*Lw1)Fk+m!*l|b)W{Or=_-0k9D`$vNV>TI|h;GbhcnlHw_fS8wSusC}SH_wlFdOi%?k7MbR!;^Q61m zwjSgssV4%91d#6C3Cqle&cc zNa))Tx;knoDCUpS*)t0gp6=(xzZTMs_BkbI9;z(omTG+m_W>VdH5 zxbs#|EAqnMFI#&b#iq78>?6upBfURD`|&k^j{+#jJrzt6alXOOl%8993&*yS1kZ5_ zOLc&aJabm0nTx{QdU+A zM9bCBZ~>;QDCUd<+HOnSLS)c*eYza(vHy}mLuE3` zVyGKUiBj_nYhBA;3$;pX`0E-T%g163gSFt?kjIJ>T zaV^#ln#XzCvA&%x3J$|^2KdZ&8K3vWzh~@^^W#&gMtyjB`q{27HYDtm+?o{dDg%)1 zZ;XdqmVgUH4d3S;BaDm8{+igvT7Z*ClPHH5{Hh8uG4sdp~jH>WBm0 zYjH|HL%=##;$J%M?0z<&KeHK=;ZG=$n;UByw1mT%j#Lm9U~9*NGeQweKt8qFVWmG8 zya_%V9X7+#<${e+BA1?W*dSu+Y+=ebSq685wNDRDG^3Pi($zpIRkjr5v!tY-BTJ9W*OVVLGm;h0=kEG4J(SA-C1nb1?DQVq6lqr~Uo?A1$lZT4hz1 z*+g44MQ^9BN;viEs&e<*TwPT|;ILEeQP;>zmGAm3^;PXI7v`m^m3!A$_24!stopP( zS5ZDN(@s@jj*}$4f+e!Y^9TF|C2!dm#6MN=oa^atPk-0`+aZHnc9 za__QD7~K=KjUl!V5>K-9TtDGR|^Bja0NH4F6&lsX+awobcEo zj+A?5uH+^6GPd*|5p>1nZCkoCcG5hCsnJ<{qzXu91}O%>Xrt_t*?$$k(BoHcg3zkqV!YzSn#g0l7PvJ_B)OT8v7Hr`+1DnGE1jT*s)S&RLdA z{@Q;$M8v+jSuk25l#OtMBK$#myUC~`nAvQF^#KXzFec^%_6*KEUu2XC*$-#mg9Hf= z{#$9)7PeK*TC`BBSZ~(T`$EoZJ&2)pD&9cvx60mB@fRSz1v!tvsn`5G|$Ii z0?Q^!yET<TWrQdS}SLY0#9~_cS<5B#^1Yx(tI$cK>cdBIaa9EdE zPCp(?lK&Ihy>+Kky|BFg)~R^aNwN+XHGdCH~T*xWmz>uelIZ~T7_iR}WupKe*x%*!Xolp7n6P=+?qWWJy z@5!Rli=UPJw*9S?p2TixvY_rN5%1qJj6{PRIT4cro&f1$Sv_aKQyZ+Y_w(u~;r>8v z;Su46ks2u>@kV6oUYyRB+ya$q12In|t8kxxN z!3LAZ7ZQsxJJq=M(f+?boPFMNd{8t9R0iw^vR_qrY)#V{k6lR#5+E<|5@mphUWras z>n}2HxS?)mM>L_=w;m4e8?aXp*sR;E(v}wZ-+o-lp>eAch z3W}id5-oTf3qW5m;S?ID5YP9_q)Yc2{hcj5XLn+q^r%9|3^B=JWE{qB}-^2)tWK33st$aKNiz3g!XP#VTk;xc_ z&ysPmf_~ipvEG*`;iD*nO~wqCOkbf_2xS1Kwp)J78s%*US&uAlFTv$*v%exkAsM?W zkKVuu;ioY7xqeqv4j5$SD8UPEy^KVrjL1kc2zw=ck8g^L?Ka@Jd|3c#9_q_FwV#Gd!DT0(OlM9)jLXO8C z=TI@slcxs z4#D)$yvTV5d^t9aGtElhaGL47_#IBLoZUa)+G(k~a;BVBAx7dj7& z%$1N&0W>?(xlBoOyQyd3n2Omv^{iAoLCZChuW++Bt!(elHDYN|U}dTszK%W=k>rw~ zrKQ-a<3+w1DNs4bgz&w+h)sxR`Bf(Jc+BRxAP0izsVP|5I0kmpQg7dIFRcRz*tC3B zn1A-^K8n~jc)ogR_vg&cV4$j=uL^EGVcUp!hT==*eoxDl+?BhyDy-NRg*vBl0@o#j_aR=A-4hLkHTJ{u6QG7a69fJKk*o{SaTM`HfX zh*?HK85*v&H1mS(xk}pCKz5d8@ege3v-*2~2EUiwOeIWmVkSOHkOhjlmFE_=2*q23 z%|ZNP9dOQ3v~_r_Ujb$55(bLlpl5v&R`~gI{dCL3OPkHLD7=26W$PQxvJdrf zhU*wqVi=TmhU8;3x9zglcsi`(@bECm>*Q>S)7R=`@%P4?=n}2QU_nr+51)Yc$(gU( z7iGREy7N_A7iq0Ad0Y1$NGdajfuAi;3!Ei*iIW9P+00z3MB+RH3ZXEIQKuzFm>bVk zk~<<3mGLuco^#CJIkLC>rELU`94m0dzYEJP-#R^c0^XH?9~*!a6KbVcW}B}?QEA0` zt_bK%#bnA;jd|bsk+_+* z{}P<~uU={&$_Ihwsf;)wcQ9uhCZ8VzmydyN#7nQr^z)+>LxQy9i`3dsMoTQ-b`g!c z!k>+eR#7mv|N2xpLW)8vKo-n-WYs8D5fY(+p<+#W${5_EN1I=Xq> z0#Crt2rS5gr`Ru1oX_VdOStcWl_tVu_K-D&<8=;F1eY?*f#(ZgBp>5^K^WwCmSf9P zh{=$S$T9#^k^`JES->MaW{lwz;Y&n7xyaZS+RCLT({iSm(iAb!8j(Ff7V(TV{uXDL zO>ajX3MaWf7gqhSsx30nS22pyJWcZ}o^1LFNEy4>12FmLf>7Z|4++Q+HX`hP_^IE{%(Gey7v3A2H8&BWBSm z+V=_`^xk5V=}g|YD*dqJ2`m8wEl~+mwlvyo6ReV=iKA|v&nn^P`O@d1(bozliO&4n z*s}KU`gnRGo9}?vbc3dWykCY#y5MY@?@5b5zM$am`J!Z-d?FU}xXV{>=kgh8L)xC@ zbG|yd`J!x_EY<4T-L|?WR}M$_iM|uEy)3e@VaUqZ+X7%&*r7qTuFU$$FK!B5+9Vx1 z_Vk^ac?sz%Y?!*JXmhVfErdFy?9SkY*;;Bp{!v9g(&x#BX zoS+z5*J4;!Exsdg%vo|L#(E|0)R~GKc(k(-$5?LnmW~lZWqtlVBkcGi0`SCkNJQDv zm`JMkoPdf~p-E_;aKx*QpK@EoDSV>Wu-L7M(m&u-JM>r2G=qm2H?jgd2N}yEWB=YA3_Z<3QHn;K$xwh|o?}>aj9)&c z%`@#bTxkB%23ek2T);=b`VvWZ+HPk_Sc_3j0uQ;(0UZ4qq)?*H{JyCYFCj(X?CdATH`c087nnM#(|dTu>nb=329Tcbe0Q!D z9$w{pNYH55Mj0Ey#IM~Ex!@-`zi&XTGp00h_gKESlWkriwoAW6gwavVR5+C`#A;o% z=Hu{6Il4-_pj?pbO}IBAv#`+V(U*c>i-VQfw-EQTY95ThXPkU03H+>hv4hf?yx~GA zeO?fr%??fC3gbuZ3y98IiR>mI;ta>4cI{;BC3jIus-0e?%DhdXG3XEW2Yu^p2qWO+ z>`*xlCAKCPh1HH#;K`GF$x6WimuNa}y078}St*>nme1=t_;dxwG!tdt8CI>>bP zf-MNaSk~);sKGX2)Lvwk7lRArtvX`rI!zI^fjC)KI~4QE8S1tnueCw1Dw=aUolIYp zZxk}4lco8EF#C`hE_8Z0&@cs?!^_%<>^AC(TTxW}O9aYY0=R${%2@OEja$(C}q`8U? z(m~@=$zc_`-*s4l;C@|p+`1g1x81tP5GAu*gk!07QRWLq0{nHR??mAjlw4st<2uJ_ zp4{2mP&hQL4UOl0Y$G)AyIdR^=#3VKu6@5Yh9^&2GCM9YM{goIFps@qN||VqVKC(; z+>ENEE(t17##AYWDlj+V>jJCF-32vauexsVLQ@rWq_wYP5|=0;k)rw7z3GML z5Q3Sw##u0XPFGn@kqpWF@czx2yp+?D2y6;oe$R+^QKr^`+k2E?vVFHoR&BE$@uCmg zsX3$TWU_s?WW~)oCJR4Q*Z%S+e*|am>gzm zUeEt`us=HZOMlou+&>uf2m7PH^aj1baQ`o$cgKAVJ`1*C|4Z-IZTX%1gFM&Q-S1kQ zbL-Rxd?O)GD<|m!6(yE;($CD@(nT&ZRSDvd9!@eh5Zj@vJCe;s!>$g|X?@rI`n7d^ zt-X9AQJ^y`UA!JYV%sS> z3IJHRhbBslEcjL17VNR+0GuntYoJ(VEKq$3z`k$14uC0R0oa!S5G`?R4|AC4ny)Zd z!_k(emiO|2TPfG_r`hVtTO*5wej^$ZO%aQQDU zPp0Ln$d#-uge-KNvl(|A%<^`hU+?vX{I~F9wxnN_m3F+db~@63k0ixiO_HTLr1|>jDB218OzV{`$40OLxB$ znR~1gGCSi@B>|lX4&ei28k9#Ce!Cq9lEG18`HA7h8n56R*%c!(N=_d&Pih6>f#@Bd zU;!=yI|+^{n?*f+ev`Z25c-UfpA*@05`m|UdYPq`{Q+6$pW>ZF*Vl$#0{jJK+bf)Tfpig&v&*l`)IO@g2okTrVu6yjX~IivXS}b z7Pb{tf&2bif=GpR$pnlJucZ0^zD)(n;=_3*S>o* zs5clYDe@#RiH}Ocy*&Z>uhZ1tl>)Fv{_hVD4}AGQ>K#7H|A%;PBL6jk+^qtj!ET}f z=)#XGz@I<`C_~3LPEC1qqtSRuXbCC0Sh4-A+LTA{ks!b*1Vq=c&lX{pfSn9k@C=aM z%9lJ%adz>cNW^Dr(54WlV23Z1DTq#T3LseWU^iWz-vrJUk+pz!z9GAjX=1lB&Op}} zR4PtguCFb$HXz5+MjZHN2|fnsm!_WXVL}X`|i#F*Xn=!75h)` zu=l9{J;cL}+qV7xwTvxjwElxSB~B7gv+3VlT)Cm;U&T9Ec7OHCv-&IIt+Dyb&z8ks z!3o*>6P019YRMOBLry)Ajxk@V58N)lsX=4);L?VB0@_4K*z zZEE;8)q&fxoKD6@zwCjhG_|I{A3|DX@puY4`uZ#TqwJS+gfe~sc7RgEzFD@vSw!%U_7m(IH<`5D&pRPv73noF@A1{;_g zu&4HR{K-sB1qrdnUAING#w#nH11k|>o1*ax5Jj8dUTxFEo-@4}B!5FIQ!!FQxNCZ+ zCd2EUMCgUbuh#ZNot(=0j^n0=d5Kme(1l-RByAPA3*g_?MXaj-$xxlsJjL=b{LhCpHTbC7b3gC_j8bNP(Nt}gqIVel4)zU^#^YI|Aa$(dzJXzZ+2w#I0; zro5=ZaF?6mTFafq22-M~Clxct?Tj3@%wF4d_76|XVq4|VFYC)2WtG=7U&t8zJ(3b2 z`iI@!O(CNOz^@eCn*f$5x0@PJnC}78)@DMoW+_=4C8VRujV7?ZRvXaV(1ol;bDQ>_ zWnpW4w?2lqYt=V_jVI{no7^=c*abU6OJc*bTj^+C2CH?frO!ds z6?yfgU#;-8Jo0Xvxt_MEJifW~GIx)k8+LddQ80nq&U6lBKK@Yfim3zlyyg+4%kJ zkFxDiwmr(WO*zw}YXC zxc%=8#d(&%a%BgBGM1_g`DqRld3!qb(wf(r{H!oZ=P+0tHp@H4DJnCVzRoBrr#v~l zbqZX2%vh}!fex@%WDhujo-zwmAfGOt)|@}v;qg4Jd&eXpw2hOX&P9itLrop+aTs7b z21An%z7aDv$SNCpZ&_rU;pJz&+hW*M)y)S@)z}O*Kk?WWsHv)( zqo!)CLGAkmP7@OmIEO_uS(|XVPCXGDpeDk)IZSyOyCKijsA!(3@+gk;MMk}{(~uis zXrLU+r+2pzh&-oWOMCE;u?tp4K~xHvTB{8@VMGn>nR2&j&bqrP0?jQtMH}06z|=dI z`p5`h(i&8E{eyN+I2HP>U|mjNTt}Cc!aQ})hGix7ZCqYk`)fJ9MYA%MuVI0K=7p0& z6Y=9^?NXW?O;OOx0 zf+_MByV8}9SCjb$d8aGJAgf)=hmaxH_N@UNVx|1X(f-wzd^a!QI<{`hyWZQ&YAFh| zyQ%M=7+Hs%`CD!OaQOO9PhFaP_W85+Ku$Z#RA4<1E41#p5h)*G!qGNG1Y>1^%(j z7e&L!w^UM4d);j961Nb{Va$(Q1-vuI_P~)`1Jt!voY>O{%z>OZ7JZLW1PSV#sMi(M zqi%2&uBJ?2TnDw9%pcElxGMj}&iF1hfHm^JchDR8^8c_me3btW@ksfPz**o9dnv^0 zMYXb`1cb5X*#huy!>2{G^t%H7vOrYc~HJE=?R_ zT}PBn(SB!&B-aJ|HPE6T?6-y(E5UvmhkJ_kvrw-z*%a!h>e-=w-jM!wp?i zd1~c96dSF(Py^QK|A&?HpV4stG5^Qg5dr^ zN#}~_tZXE9>oCb~f7eRDnBX;1vDpM|JsTz7y5kKtAZT^scVt4os|-=Re{o)Jn(=Q$Q2up$P1NkWUhu$mk-?Coqk`(~2kSpT!jan>-c$UpU8itze1n zCoA^hCOd+4`v0Ks<$oOX2gAqsp9gt_{;yPjnyXvgykMC;YpHAB)DrFjoXNC6$XM}f zu7A70OO&m@`>hf+6Yv76kH=BAzV3J6s3;ge5Ze#a6LagkG~vS};VKABkJTrg?(tgQ z5+!Q{?uGU7?dZ}%dQHoG&PAjXhGM~V?3>yiZ1uE?T*Mn~+k;dASTU@2zXPu&?&46R zNb}X-&`KWqN~!#$sT1HbAt8tQ>Hr?Q?9>1r;;FL(N6 ziLE*y{MycRKINKOl%SiZ&~{Xo!7!I-r4Lgi4b=93>gb&o#!l@as=EJMV=LrD-H$AV~@U*Jh z>LLrayWMQ4gcO_3MqL8Q>tK4@wQ%YNvoYOlWi}*)?swoNqNtoRp3WoH#NE%%IqCny zW2((@sUV|etn4^e8dbZQO)R`^59BFpXcL+gG2iwFj-w4v?kzs;fv2;aP&;?9gw9@* z+B3c#v7_LXI|ZaO0(!d^bxLX#ebM6)F+3vOncbR$v`yE-+Vs9nYr#tHdyBPD_xEqD z2mQM~8|wd3zqr|fz&ih*!^4rU|Mz>3`u~GG`uxvP5paTH=&8#*=_f&D<3V7PM$DGE zyz*XuZ{ayNCPa?GPYqQrE?^lkKoCrBz6*%A3bP&o!Y^;5b{_gW}hj$4*^K-uyQCToO_D&!lVRc&EH z(!cnoNfd5d<|3!Cj4{_v8X9e~j!yac2{$|8>54bi71gJCY0Vix*%Fs| z#xJm0!V)u0B&s{83`GtE$3)eULwUIeo-X-7R{MS#=P*f$ z6tk_?z)>s8oaS+!j=}lyX$zJY#HN#a(5xgsyb`&#!d+^EsNLq80sHe-s7A7-S^zSw z?n_+SHok7;M1)k7Gs~1KHYsn}zD8P|X^H3Dh-ZHiez%sdZ6`2~B5hMWvKN?|ZQQ2i zzJ~;jhMSf?(>}w7B=x>d915r{+!%DrJg40bA+s({K9vLtJNRNEKFfF44KX%VY_zGC zM|0SA+b!Leh1Ru^{J&*Lz#94A?;m>izYlu*hx?E6{~;bN|KAlT`*?Z+;u0~k!7wG# z%tEyE7b(BDkp2~;Q2PN^@=b#gv;#!b8DQI9>~|NJ(75M!2cr_MAlS$nndQRp<%-k> zk{d&mL%&u8KW_PcXU|6bUkK{^bWc1pgkV6&&NX*@{&zBjSMvt$pl<~Utud*<6{ZHmPy)XT5IP6!} z|LF1l?+1Cb{-<+%i}~Kt=Bv|uTgj~J7jP&kc&*9ym_vLEi<`%3wN-?@xh(*9#^f7)XE7`Fe|JKDRq|Af?>d$#|WvDrG}PjAcXWBp8#jrwe^tg3WW zf^j-(UT+=j=UXOjAN8mEvAnNPKTp!%d%)j~cdzUD|1F(=Hn9Ki4=Ve=-rzC*<3XNA z{~tlTcjWjJTy$-I_$Cc}x3KFy>Wepg>em0V$hx2SU6S{n|FPd2^!)sfgVDj``hSS0 zPXCivkv^pA$FC!`w7zYwIlb0bQAT-zGI6u%jW0$uAV63_(T!c<5?w4{d8>O^Z6JXL zTN`N{%OX>{MgSA>=?9$3OxORe=I+PGdz$#aTn61wf=usi|KC3x`ug8s_;~-@f9Tk96g5?&JqqKgGO${^7{y|NZ{KgS_3Z|v5hcPEim3r z62f3)sy|iVk@Vq{RZ{GrU}!dF4)aq^N-u>NLF&nByQ zyoG$#AHwo_u>Ew5L8C)vutZ5m7gWP2kP%<&14TWXhcivuQd051V9JiFxrx66E1Tja z$`B!^Wj^5zIWIPKd1$X`<=z}BHq!s@H~&X()E`v*zaR7eKFo6u`9J)^?;boAl;r?JSW?unI6Sng)*_E#_&4N(^VKHQv|*1xt(-_ioOcKwg4 z{=bj@KM(WN+5di4bAKlmK*=(i`G$2261MIcoNj5~(rPS0IjqCjP`x`-ya@4`u{)3qvgL@T(`9V1y_%;0qM^nE0F%U#t!6_+r$#& zRoTWCbTE46S%buzTib)orsV9^>CyY6^LOtZi@|?Jk0zt4$>H*d~Ju%<6dFD=RGl<5PLUMJ{`**U^+}~5t|75!VyNLT& z&pQ8)!~Fx#|L?Fjc-;Rz$kTZLEA(!Eg{gAFe+!E{z57*NGU25UkSuq)NKVfy&(`|iYk6_p zeQ1CBim|)U{Uoq0H9z}ayj$yi{v~_A1Fg>*kns#cT*_KpD#${?h)2^{EcZZbkRjOa^~J$y=NxDY}BC z;0RF|Hxa@8gI__dTTe^z0E=7V1)xfs4wGOlI+xIM=v72tIF`pfzzOodIZal|`h!=& zF1lPyP?;f$NL(fn*mZF-*8L69(Wu#slwp;11zgY8J&9h=Wstu zDp57HG_9oT)Lf6I*45C}ssOYBzr@%i*0g}=%JQOPLr8!pPNM}It*7p22iS?tQw>ZK z!xSAOb$ucLmHSOR_GbUTr?^Hm6;~WHh8^KAG2(Y9hZ-~6_4jCr*@6vnT|5OHgHA1q zd z0Ixt$zq(H=_91PzU9C|_R~f2D(xg@GIS`RRPEr^9d?Nb#pmtr5}!F<6(5NzI|c{Yi(2hkku{0 z?X2j3+^63DS1jYZNdB_P{og$=|6l)Lbntlp!-G6q+y73L69^S~pN>UAJcn z*{U&1eQ9jc9|Y4IZQ#gDM>+6X4Hq-e*yc;@n}Q_gpEHLyRjN6Aobpn)T_Or`w&kg= z)kRrfZB}L|op;Ert6YED1$Quw#^4g6B9v(V_S=yrE%JtU9jx6wZoNT*af}Fgn-YX!T)j^c>etP zk2vx-h?Rkopaf%zzzz^LREuXsX4zh(`2?mBcxu}#ERqq$xrrM|sAyp6>7x0zc>`uye`#2>r6jlN})B5O1Ndl+tO zR`po9FBFwb^u9L<$cl<_t#b?RIOE$X%ADqLp1M=93!^!L-?4s)k)$SVTxX zLu{O8loljpVO+18+{jS6lb1qMRpb^Orwc++`T8{41v?^LmHN0V<*2wbUl*)SN31@H z^7^MESG_{l*LFGxW$bfMQ(i?Ud=XoyaO#q!_-ka9bgkXihw33lu(j8x(VCKPa+rJ% zQ<%l5Y{ttcTdSfP2lt(We5iPnDOz>*yoA#!j!le}86f9VaHIm2o7%K-JmXs7dzf9Q zhZtF!`>2|T0q?pW3a>}+5tD_`g{7{iZ-B)LHn?W=+j*B1Q9H%Rr ze%*KOc~78t^T^2>SRrG6`_s2>*ti7tP8yi>+_Mb$j!bv@%U;>H_;KsFV~6e7##nK` zn`@};n3tApduj(DI<09z=ziphaTtSi3vuxn@q_7_k7u=C&yP>7V{!F<49<^FTOr%E zDPcMvK-ND13PNz&Fcpkm6BwTzu2ecg;v`SFU7U$kVILB*l_QtQkGs3Nlj@b#1@+33 z`C)5AXh8@^feh8k)7`qyOaSgmE|sE~=H)oV+r+1uRpNe@+@#)ek*g zE0A@k4Qn)kTJ`r;mWUJfyHekg)GSj+H{&8G%azh#@tQ5UO%uNnO^0}n zVJ6Rd_MuPx8VVoH{;5xe*4lqQi7nb~tU&AH|Mn~X--n08{YU%HLplLReMJ_b_+pINYJ##2!4aYn_+HZCEgY zdQa?{%>O;GlcLOpwQDmEp8Q}(8D&m#!Th+TOd-gISDB&yH~NPBZ}fj6?T*0sb-lxC zi3nqC!pU*nn7JMH#>{n^W;G%;S-V<^5j5cqsKnug9Kvk|kf|c7zGHyXFfY-Hc!>WB zrnn@u-gnvpcqg{;e}|{a|5dCi>2lT&Z*lRTeAe*);o;$+690Yh82|GiPl$u-z<)9S zkuiB&$sEKtP)*YziN;dWuJ1TLq{;mJa6uB+Dx5~x{uA`25=6AaxtRY}@-Yhv_u6B; z{3+XPeZoa#`Y1a$9PV5FmYYgeh1+he@{rE>`>uH>8}>ly<9gl)XIIbO_*(Y0?N549 z`d*-l2-xfMBDM8xrfKsYz5qMMOOX|NTI+4e%ZFij-~0`lSK1xY8b>gNe8u4oeIHmhR9M!0mRswS96B0o3zl+UCr* z;=)ztX(|msCCrkew3xw@#T*>ijy4Jj&!p>EbG7Ha7-z>#$F)a!-<0>b7)IyYqD(8% z4&!e3o8|bMrSQ#DD2PS{cmZg4eX6hOwy2{2r+CthQAxX>*niJ%m-$;f>->NF1Kkx|M?(KNdHGAb&_{0ZxKgI9W>xf1ZE+Jzv>QAH-V8k#x0|)<_$j#}%b31=7b&^ZF`#v(^Ig}|XuHvk zID(=RrZ<)FtKFbqm2`ip?AaJu!X?D1h%jd&M&6=ruC!E`{crXS`QI!8QM=vdl6LFl z^G}_CulDsdsK$!f$0=KhCE*+3`sUD-Xt6_6(ut)62@eE6n~wj6R$?H21vEdSCC)BP zetAc*Fo>6E)daD`OGweCAg>=HJN4sp-_IKPe;4V0*5?22AB-yZKR@38`7n<<|0ywA zBEZ;bcM9c}mk|J-;uul{Fp){C79~pR4}Ux!Z8^MdAj<+?zdMX|&KHEfM5s8p>?Hq0Q^ixqHf--8n|J(MKQT-6(>GMhF zV5H?vgJAC960Jb)Ohfa)TQcEyHafF13U>knVY8a7J}*|RdGe6F*} zbG5FqXKQ-&RHDR*)I~T6^!+&R5Zt{ckGd@@-$gUE+V$} z8kpOoa`=0G!usC~G6m2wo!zJZPj57+_8*lQ%x) z!Va3CtW&%6g9*?s4Jg|^P5I+?j_pcTyB*cOTB#NwFK*FOe1YY|2#cc3ixM;C#n}D0 zyPcoCcB@|5Y28exM0ji@Sq{!FI*cKSOwz7>o1pm;mB;zK;Q9CdtKaEAj{?@XwIkYb zQ#nWsCWu0($>3H~F#H*cFZEy$D%x9ZHykF}XWKjL-K8IfeU;bUD#;iRy z3B=RbY^HO}fOL+ELh*Ng%2Rj|&r2(JXSGUQYKhaObn&kL&1VFt2 zJ32x*@L6pe#3#p>W4AVL#OzAAc;I|bx1u0AZXtoD`FVM{$YLS7wF7^R5_IZE*yQs0Lm%n8YMprqY00$>e3{Uh6K5O{2^7 z7E!E0QEju82;@q%NSyIQsXH?A=439{j3~vmvo*|7>bah+!0M>Qapd1dGc8e(a{v1O zh(Poy+Md6tUioZYs;ozGoG&uUSOVi9%{?JbofB{MT4r0fU`Hecb7oJ`YQ;!UaUtBT zgPOTXB`c(>6C~+)iVXqP8cduB*}Onyx&kp|M4^a8$;>>XWuB&}lxY_ETNF1=_2KTLy*s8 zfe`F=Ls%^Z5G-Me6X3VG^9|XJ>M#m%aP8(+%R4OhmX#c=mXatz zIXf8%(OgiINY}f@S_^{8K$V?*j;Y!4iJE=_^f~KwVrtJ9gz}MKyQ8ZTQ{-c1H|K!T zK7kz&na~P_jnh&{^JsB6-R}S|2#P#8GR_2VFrgx?mHS={y$P4JzrDmU)hSg>DS5?< zj@PR+V*xa7jseg@aTb$oRWcEo3MZIlIUifzv2e@57DAZl`E<)WLoM6ftr=HgM0bW% zysC_*c)ig;TDoOw;Ma|%1$g6OOyQ(Dij`)4@C{>VRR)nd!f}T&g_GbYnwmi(4Sse< zH&|rbk%pU)ZhcFe4ZW!!Cgd+vC$NUTU5wUDkWcOYm%3@WAKDMX-*z50T?xU) z8ktI96*$exu@+g33{Nqa0GM&+7gmVNMC1sIg^bGTm|h32Hm7J_bI}QJqiO+kazCV) zP;Oq@QJ0`upuT`5&EjM)MSam3|9sUQ!vrny`r%tM zNEVPa<0DG`&PT|QOh9~Em(^%sfoM-7FYTKuY%Y&VMb)5=s>7N{@VmoKHm7N8S?a-d zlh3H32(;PAqy(&uBt--C%~%wj7d+RR-(*b}TzSH4H{lS(nU86$r0^Qk%5N2Sophp> z2r6om|LMV|egn}Yz^v88f-r9|*Ul{fKDv&$s?72l(Ih80q@Fn~Y%sOX#7YM|Go30k zl`X7rc5x$NWdr|x3o6ya4cIV4sKSQTsA)h=ELawHW>JR*`72Kr4zk|rw{6y*!g;fG zS8eOA*li8uyJNMofe@RmY5N8&)@o#X_No?&$6B4&_dd0E#!jp7?u3;}umLt&ZE!ml zY9MdUK40;1{pQ4V;g&F86SVxX?%PGNsD4ve7YoX! zt!$%=qLNLs)dSfa&VoItndu@=&b-MEj7qp;FK!COqu!&UU~l+Ed8|_xdMW}ywj*Ry zFf{sV>Oj8-20bvSCd0ouiacog$I}n%R+=gnq5z5Ca0vRn!&=bMYEQZu2ac9!4;j=JpShH2y08tgW$i|~x(F~<~gpo!nFRNq5$V(a! z85@Ww8@zKc5E4_rQ?1eTe!br4Dv_jIR+UIKz!uylHB#S@XGt?!X3c=hwN4M_}SI|Eis0yAhPyBnBJM#9$p!3~oymgE~rZlpgO^9RaGcX>6hn zspRl7o)w>GrLTzR`X8Ex;DY9JNO26)bj4daK05t$^6LE4_peW0emZ;g{^RT8S5A2?*SHL1;d&{mgk^?bl?L!8wj=zpJKSmU+?CcFlLyc+F?idbmJ?M&|^+!6d2a z@rxS(@N=wg1R-G^sOk8INVp*Cu+T$Z*L{Z`UTj=%i}t*}x2wXa zSx)FFq%$|ecZVQ)ipn|W_cxL=4yy)`TQpi%x5AAT291pvG;7P>Xq~$ACT>taP9dJ3 zEAO_4oWP9{t;mTrxQVe^gIFN3`bHRDKSq20TRma_Pwn^6{lqo`h2a356`XJD4!Xww zdw<`*|9{Xw96jcLd61{^{(m|{V3ID7h|!qlC4V!|7nv;-z(4Z|pfkvggykY@P0%zi zRh$$LE>DHIxZ&0~%aO_@I4dz9H;p+b$yIyklyKvgsiY*#TZXlJ&s;pL z&tY2N483OWJ0&V|f@xl^z}K(innD!nTcw>Tk+&`^vLo_=pmGd){DnD?7>jKbe_MCZ zV3)BqI(7Ld(;(H~0JOo;n>Q^0N<{ee-THoGZV6M!>#w#=XTw{Q8QH=t5lyy1)Sck0 zOJq z=2YAV5~v~ryD;I!BfxL_jc55)2HNkz!RXoeVDt=hmqpf9E&L~lXY)K^-!J~-%KZj@ z{S}Bli851&)n$guB9mEy_juItDqpaP&saZCemGkW!O`&>^8fNqilG!K(bx+7vja3pb=22mM3ygt-pU4`=XYcu|98rHpIG$7Pa(UY-l zguM4DmINr4{IbXdT)9Xz=3{qu>ujAapRAoIr%nHgU8mL1sJEQ!xcFzXn7AM13j?51 zB7ps)a$EPT)&FD+I4W-*2h^4qgECD$4 zBb%+jw0b>`fjd^vgcfHphV}Qy@a1dt62AifVzMK-HBJ|4dYY#=UO74q|JEt=MxdBO9k~=bfcx?NyAP+I?iS=-KnpPm-yB{dn7qr<)%!fBOvNNCLebpe zAeAa?>voc7tO}?omS>|+?_V9g{PgbR&HsFQ|L)zn+mEOpgMYFOccW}+ z-6Cr%lrr1AKUlO#6_}@iVcD{6{?`v>KHm%jR?_S~ukD=s@*=grq1AgdHP!g)*Y8bT z>jEm%BL{}C4ETMNkGkQht}a78Sk*qflNDoiE2D?F{eB(dcG+zacj~T3+sW>4C)r>1%l3nH$jK=lpllCX^&8J`v3!-WOXk|=ON7DiSAZuG`O`({O zr`6&X@^gM`vgl^pL*Ks@MBY3exl6q85uj8C1#7Z^-OdNg5YmZh9@4|2Wj!TW)-rIH%e z6G8dWwKxOG$}M)>2KtrZ#10=eb%N~IrWFw6`0W~g@3yj*&%1;Z9G04NVhsJw`n%zl z(rKJ~-l$2aWGy$FS?OEXk%^VU`ZMQ@)!gR>ifs!tz$68S424!Jb*gj|(q%qDVXU=l zV)wfi5cxmEanE_VKqp6M;OzM5%`2eN)FgnrSZC8*bdr^&du{}p+1+YCVK?0@~xl8*AIKMHw;XApOI!kT^wLt)`|I7M$aBK`1JJz$KwSV>noEl&HM@$8U6+Q3P@g3e%sovXKpa3TNbFNGaFaLPlNRFj`?e(hI{&)Bz%hj>tsW)Ks}vErzB^B zJ9j^WjppDc%*{jwKW{&sAuyXQ*9}cnzI95zH9DkeXJh^UD8-NnMb7$p`+ZZECrDqk z_4RAZ{(XDsaLPBteC?{gZx5B`MV{sttFxj+FgeaMLQ9CH3tjEUyJ$B>rAd}!{oE4v zpU@Ka@A+(C|10S&bAYdj|L7kMEBF5%3?A?QdXR^o0G#spV{PzL_uM!JzYWZN{D{QL zE2J|Sq;7hLaQK^d_mK8|cCQR_MSdaUuw?{wgE;3U9Z6m(EMSN{;4%@7d?#wRw>{+( zSI3|)tai6#TWt|QqfVf$lpNP8%vkrs>MZZYQynDk50L9vX`NbM8>a+2uzRQCQD;6{ zM=tJ7EAJMi2nK%Jc9r8 zIR?U)8s`~E^9vkr#`WbHvyQhbN<4?M(%s;nE4X-=kQ zuv@eRkX29a`Q5@&Zd5l!DI~<8D~cK1cEm}x{3=e5HtJENuEp^1*xd~-;-`Fc&sT-G z*N}4^eJzg^4!p>T6o>3@Cwx&%tj+#Jp^9|%nzLI|pQFgy67)c&qC98f#N@ck%O*vl z75@rA@r@KH4*3cV92x8R(i@jMj|7~Fx8=N#5|5j53+N)~7pGKo^x^znR4E)7IlFbk z@k6b6S0dIxPetAJqBEzksSzD zUfY}Pp%?4nhDb?4<-P$heTh=I(#KfVG_qyf2^0d&!>YhDm2**|^I3_=EKidvY`?^Y zfGM7%d_ikbcE4{3v~W-Je3;JXFvJb_5#c}YM*gqW|7^Fk8)|`T^uNJ=@4(Oh&>KDa z|2)XUx2PY5dAGp=P z7d!KizSdc!@DUB!H-iRRQW+Z+l$uM4ExW5IZy+>)?o^<;=yN^CNx!+1Asa;0j&_AD zz>Bi>BCJj1fykcfpk!g~#8ul-*PS(oAQlW2Z6pe)U)w?v9VqhxUT|ZzDCoak1GSF1 z`hxv>{pGvPWw!Olmdn_Q7^%-kC8=Q+kUl&1?AMAR+LFFr0nj@t^SZ{=ZF5P(wtdNN!w~}B%G#$k+spVwWtCnRM)I_x zS-7Zv!Gz-Mf-`!T&2_&6N9h$@5m1z9ib?=8;1Z)%du~KUb<42krtPPZ6za+aKU*UJ9#X6GCfigp^Vf_oOP*k47yKM!T5( zsa?c%i|!$XvX6Od3q)vM(A7&^y6a25b<(f7nw|}6juO16SPIQyo(30*l2Jf=Zf=3# zf1x*cj{Q@;U?aM4s2%=Ol^uKC4OldX)sf80>Ut5QspIOR-MS(oA}(@L+&|4H|3op> zEKSG7YAUu0@UuK5()-!0nD5gVsVg#e8aDuHTb5y!)|;oGvL$Qmv_1e7zXg37_HRKB zT8YKbh+5+BlXZ1n&9h23QntL!6J5`GHLhkPSqG4fvfc*pA7hIg1HL$;deyjbVS2fN z)lbn{p>%W;L9I8rl0H01sy{dOPL(>>*=zw|=rjz}`kws%?0x%p+cwtV{;a5i9}9(KOw^eGgtF_<$rbj+^O;en>14 zyto&*xG!8>$bE#8fYFI@W@BlMT+5Axrc9=$Q}g)(c|#b0U;`r@f*J}>#qM>3WpP;K z?!kk2AMk0k|ILE|C%>#=ieWgvi2o^a>e_n(d+h)5*sI$A-qf3Zw*MdF(@_6aANr*L zatl5rYmh)n?@1bpC=`lmmU3@_>6JkN3{pZV$dXVn5ehM*+O8C7BUb;RbO=SUnu8Uu znfuC1E=;&O%Pq0Z;4hngasEIE^S%Pn2YR2>NJ`h>O?P52=)na4zzHGo8Q6HeI~<2+ zKpsNutr3GEWRS~Ad5fH}wOKI%^(}J^Cy}JmQvC-h3aO+joF^&TV3Nr^DMIeD1oSsv zAM_;x75ZobgMvr_sINuJe}wZ(NU7Q(*FUC&u=3B69Bp_S7!(`l3es2LDUd#v(ahoR z=O_#`YxKbpcn{{2QHTQLGKZr7LxAzdyC7CO6?&u{jwLvy{tg6I!%<80Qh9@72>B8c z2NK?7YcO`3ho-SnBefc^7#S1?c_2hZ!Z_ z*I>QnbJ>7|eDDYeDBw*fs7D_W327pKpTJ);)cdXRniB;npU=x&AU!oigoK!jsQqBB zl#s|l8B*g=U{01spf9+RgJ{K&9s1y${}}!7mD|wI0gJX{XBNU9yu*O3lL#?X?&}W} z`R&l>i?WRR#}ZctUQO=YzvWKU0sfyp8GaFC)@d7P-}#T>q?Z5Td!NsLJj$oR|I_|m zLPDzV4%M{*K+YOlu!0)|AP7+ew%LgLA?z|m6vgaMBV|9`Pb>M~F#xzP z{^yUX_5X+7lA0h^LSokklevIIsp+fh?{}cj; zLQ{Y40^88}p3t2I-5RuN=PkfC;oUhfn2%Xw6C3@zBZGVC)V+2H4;HXZm(lojJo1Mn zuW`5eu-kWRe7AGZ@KD_C;ln?Gmc60Goig!Z0*Qw}w8auDgWk+44>w>3#M2BH$DpiZ zRILeEVuH$-S_@Du!)n#(>DJSs!L^6!%@$(gJn<2`v<2EePPfhBwogukwx-Jxhx@2Y z{m&SYd)&_f{$Gkh+}-&*;QYVmPO9<0k@q?O`%ylhmj5SM?L%BY0ie*7{5bh*o2+T-sC zXr`W)KTQ1TtfZoiVcw&d^9g%6i(f5;hcWhd0z1IG7Vj%C9gS)^nC*;U1MSxE4>f&1 zqz{|H%Q@-6JF=O%Ejs&bWc}GbjrL#0a70gjQS~nI2bO=@Xa7wm!&?2n(dYV4kMj}d z|2KGjCeMK22ytot)tV1WutI0@Fqo)h*SkV2OJe{5B?|^(5~63iI%;umNU!0}4TF*R zTh!qI@-j+yXxj(S(U(`o>Dr)5Qzj=1m=l}k9UsXu5S&^0=2I2}0v_NT!!sl6v zsPc^x)P_2WO%gC6p&tJe{&&o9`}s&nSdoVTStle$ zG0W#dT#fyjGwmzwXquO18&AaPIfmY`{G9Ru^JJiqJKQ-EB^R;}oZ>;=wuXf9ilFHT z)Di72nu}5Ai&`%{;ewaze&=Fab}0{M)(-AU-`!c4hF6W^k>SsKE~uSY&QCk96Sg%5 z?Wo!`H@RVwICt3`r7>cNI+&c~FP+KLmc;)qI(8eNw6zsT&DYX^y75Wi1`Y zIv!Dyn_Ql$QEP}?)FA63=YQkkwmcyEf~b~y?BP~pNvr)atFcgfkGC4zE7(Evs(ZLK zSG%kEpau8g%dKItbzEu(FSJUR^+ncli5;@Qb}Xp}TTPE+YRH}*z|t^u;lmjk#**G= zXFRt5x6A(*xtSm6`~Qyv>id$2L`iJ{ zDE1Nm^}$nh{jd0XMF=x?vLRbJj5utCWNXl0Mq~~np*D92fN~GH1}t*5bp;G3@6|}; zE?!`8S!u<8c@G%57A5lYmPHYmGod^xJqbWNJqJE`#i)Uda_Ia=s&wd%fz(aZO{IGV zrD&a#DV{vXvMilZm0L|pv3n%nMWI=xNi;F<+4-$>bG-&tyj$QMB2b4=#== zLohtr!3Rmvyt1rv9co=!-m(4J@TgdKx{>^T$RaFZ^?)OYxOD&-pFBtGL8HF1Jr=eAFcfN=znFUe{B8lj{WNW50mlabNB@x-mLfcx?neL=WRH2)o++rV|C4Y1`syWP8 zHq8I%nLX^YYyDG3QgNp30|mf7``;hc?EmTXbN%l}`LwtHP5pf>IRuF7>6>)1W+8E* zN}+&_%2~~BfLVyHa0b9mJzME3zbNHD)B}N}ye-VE1ZY0Y%}J86Br`9Y$+Mzr?el=c zQ}iq75BlXMl28_eRh*f=j^*ec8V32AHFwyVe%~)uB~;-2X;HpShdz?tBGPrVibH z%+ad%t*EcvWY^THc_8)-#jaO>Yp8pv?|NwlQyHowdqXPt5!6cKKg@_)s(d$Hh?Ezn zFh)SubQI2iGOaHSZ+NgVDKga^uXa7&!X*K`HAAPp}ALY|Z|8obH z%CeXll9j5}?Tm#>?)2VLxI|}7))&(zQFZ-$;Ff|4gk(c##HD!B~c_o*l@XP;pd#B+TXzCj`05#A#B$gZ-izV>0*nx8UcO} zQnW!U~k7Td2W2{U;YCyF;X zCGi@?%<26nju!;17)$8c$w^28>dY~V;Tk&uS)b&0<puqF9Y7o zz-Va(-#-nZ^!f8>A0_{t6^hnaBzio2AN%9K)%eeF@_GOFaXwGLC1ebxv52lp4gmKn z6oYw&qmWCb1O|6v2c!1{h?9cq=5Gq<3Plm%zMahZ!SV7Kq$q+6Z;&V|Z~PA9u=fPS zNZsM}G)d6{zeAxcZ1q2n93XBABe8gsqXZI^f(XaR={e7@f4OEPMZG8BT(B(o;rtqe zIHf&jiP?$xSEAo@=Ko4h#J~E7)$)Y@qrcKkd{O|K!{9DUgzlrgFCBWH^uBcF@UHiz z!`A$7lHz6W%m3GV0)Bw0I1hL6`~~efNlN~S0@ibIh~SBAo|1p|oDB^~h)(_;1gKj7 z=P#eV`R>K5@4s`_;e+?Fd;L!)?x^bj4gJsiKacZy0?t=3UZRLB|2j{m)n4%N& zP0w+h5~L&Wbm$I;1J@f2M@K#07srmT*xr}wXfX)ojfo_N#K z$wBB~N;5=Hc>ANHo{eVDMzhzMX17AKXVUCzn!m;GIK=@;Qxq_;#+1Q3aXptv4}ei5 zwzslmnZghO9OK*%M=7<^5d$*u4x1o7AQNx6V?Zn`Y1nxsd9?v?n+L>LNjEotKL*z~&oADHA-K5w7OpX8 zj1nKTTvM)VCEK%+?R6&GbtWaUy*k;AsJPCg85P$#%&c!hrEH0S+``&cBOebZAbHTx`SqmG3$0VX5ET0>z0h!gK3uZsvku# z{;BxsNR2@|@jIE?#jk5KZr#qtty|ICZppZHXBF|g!0$jrmcr|jdzYNVNlOwZyGXRC zRkyQRbt`JsEvZ$vThL%KYDx2G7tI!}>UP$uZbgZ>C9UfE9cgYCD4C4xffCoILENqy zWabQ~6`GX>;p$^BoHZ#`zOqx5ca<}C?yHnwZ90Geh zYd4Jc0DsV#=3#|q-=z7pApoQ60)%r}evu1LS*lOcdl)JOz5Wh*o2>!G0oDg$`XTsB2j`271r%CC0QaS(72e5r4Ywff^7Dh z*V$h4D)yQ;X(Y%#d3@GJr|lNq=ycbjvl&qbTE0z0R*WdmG@@LqAzmSJ+AeH8np(rw z93vZ%ovfyODOTBY)QQk`=HY0%!#wm%Q>pa3f!Mf)*qUq*fKgQJjf1?ZqsVr;IX}OW z*tQG-j6?|FOH~QI89q!AD5p4WdS8MdLNLw}Sr;9Pg)6H+$h!hT!W~oy=9u-q1oLd2 zD0+Kef)ue7FPA7)KY>&prm;@Jq@9mHnoLZOrvhx$l5t0~UBKGem7|fr16WH3el(o! z0@f0E;>ulLo47*tsjq>EQ7e60gBtD?@unfA*0PSRd z@)s+nr)hb*2UwonC7Ojmo5k7L;H)V0!rb%*zBT&u5K`7cpv^ezY@1a~v#~+ou)6O7 zqkFg&K2N|kZHh!8CK!hxML~)<>0|){l(GR;HF-#^2SpA=yG`fO(7Ne7v+RV;x^9Hc zoJ!bhWDZ5uwMZZfR@$1-4q$}iJ7jhLY(cB;F{?7ZzKO3jVo~Nz|Fm7AoquXgw3}J> ztY%%etY%f!GHfJJO^6cc)zi&j$+=LTXGEdS3yrpl`gWGKzbg=HH9ERdUx`S0CiT|f zOm%wOWjpw%)@+BFWvgn|b*JjII=yZqfqI|nVx2@t)4R_KT*J_8kUwT+n#7KvDj0SuJ+WVY)?(f_EeQMaICDRBqek1 z(?xJAMu6cpBAMKfzen&6rGRcJLu*U^?!;mYO}ZLGld>^1DH%id?V*bH8Mo9vW2^R= zSgfZ>SL>&crONZ_cQIqQ$C=Iq2`Jx#h=Pm{8Qo|LR7@4#q<@3)Iq_`WsQ zWnz)Slde*DQkKG#k`yioEK6aTCam{v<@U{nMA;ez5yb1fl!I7>$tL(hi5$PBHuA07 zXkwAXldh6@Tz0}IB}r_IgCTCUzoNIdBDl4=En|yIJ?`pKkIOFgxa3lM^#m0W^#xf1 zM8PFz3)eE;&Tr{T`ofj8@p(%Z-Ip$Ujw!3DxaP5J-ai_5&Cwl~mGIb^m}A+PBQ3Y( zpCyT;yX8>;-+mNeY*D4-uBvogR;A;TDz&GjRwmYM$tCU%E*Z|+NyFi+7Q2<15weh% z2%gBc^3=FG(}&}wZHSw-{J5)@AD6ZKxTNKc-PGKQr$mTP8Sz=8^&F+ZxUfAXgyr|$ z+GuE22xB0;$ zS?`s*&c`L2TAA8n^Gp}A6N7QuPACjdcL;@Mr9bYf^v7kTKQ1Z#hQSag<-$;0xB(*o zBMd1;Qtyip0s<>SnJBklj*T3Lc1mG*YK_~DElPjfRq2na8fW}+yLikqOz zAI|0U^KaXim*s&m2ZC)AMAdM#lz#RD;5~)+v3U>y?A(2BUyZEWu%Jn}qH_NRMIx-1$E6YmWHzFgqTw9jv1`BIlCKejjuh1SwDj|u1 ztoOjZjA;+IPHRWpsRFbQ*I0FJ=9v!HXcm2}K}*DFee}07ICF zy$LRWgzwJ31iDU+7z=OOZoPTa9XU*1%Z&n0ZWJ^{=;dt5qJ@~mVpD=ah89^AQN*mX z(QNSZ2c2ibtIWpGoQ>*U^f^hkpj?sKsqKR@0)iEeLLj@g64Pw3`yF$q#GBQH=QR_f zY%{LV@*3`XQAzz)BZ^zAa@NF>j0szbZ4?TYc!OfOmE^VDM)B<1D84O=%I}y(#owG& zhQ~FBXIh!-|C3P$l9X(4h=3~QDTxnOYZ8J5#Bw_gW{e~#U1NDovmA+WJCDX2TRj@z zlECG6P2lpKiUB(_hoK&?=APXKrd*~dwvZkTOA%a0I7T3xgDj0GfJUWKV zR?2Dlj%hI3kMGpZKuGhA6WcQ4@7W{%wxU~|Yi?CaZuyRBvf0n=RP<)c__=3K#j;h{ z>Re!}QeVq=OjAvq#&1T$W)^j}iYi8te;67zd!V~HP)1{T7#dbh-W83i9zP5Xo5Jj< zFNf7haSuVmR;Q?QnW9RSqG5SbMpiVMC#7@Ypi14KVR=&QXf#hs_i{be(Qpqz!?RU< z=v?rjQtzQW8n#??YZ;%eqv1MUxui;YIBa;hHowm8?AN&!zs@!MI(H@$d@ZOnuNSwo zQ{z^g8rN`Y_Mp-{J#J@{+bx^iu3>WT#-!Qgb-S6oDlXxbEf=@2dpRzrR$Q75SGTL- z>Xr>xw=i5e8WSrT&4#Pn)o`uUzj6!1bvGK#=49vMS8jDuCWoQXYzK9&%~UDP8Om0e;6({InrH>l+hR-hDNid>0DZBg8}^-+uXxj~U~ewqS{;ZuyOU@Cez<(2@&&29 zsOBDlki=gwv0?CZi`Wq$83SaYZb-0_)FcU}osF7l*{GRTjhY%o{QU?qBrewxM;o&^ zqbSU&6Y=|e#i1C^BLqq<79{24VWY6gSekYV5YUC-JNMy+^H%@LUGE}=0 z8l*UBj*m|*_Rh4cy)!M_JJX82(=cgrqhgc9)yy3mzDEgMGDieY3aPb%KB zpwTG;#$Ozj(HQR%!%6&wKp4x3nOZJ;uOzmk`Q=7k7F&s*E zLp{MoNI6jiUIwsN+1$9!f)Dg}FVC;Q8mFn6+HtGHGqdq&b+=TB)-X#V9B|grl1Sgy zD30P)EIQlp+02seR!MpIN;ZjGWzyH25OFR`zET-FlBL}AEZq+x-oHW%C=c6xskXLN zdCUlIx%Ov7E6lvukX&Yz8wM1IDBwiM`Dm3MG852mO% z&J`)QgrG>Pyo79(*J+XZb%7%!5}gqY#bNPWJBz_+Cke)WV{MEyi=WXqBo=oeGGfS} zYPu`a2P;M9a%E!LIT+&|4u;Lv>tyOpDwp9*D;{4_t=MGKD@0kE1xyyb5X>&_zTvXc zNRTats$k_1YpvJrJlD*2oNHpcQD@TmMxBYcU&2`Y6XQyq%CO`rilmIwo*y5+JEa52 z1}mb{CFC%1!rK+}nAxfvD=eES@0wyEUv*2Q`(=N|wbtxZG%`e4k-CIs#_z0M<&l}K z@Q6atN_F=MpH+#rOnA9MK$fVJOt-@Hxk)p0u2SyyHMqv&Tn>nch#+yRsdx&WC5iNH)b|AurV9iVuW#RcZUmGa3yb`;?kA&dVkC20q-3U;wX&~L-Y*Xe*Kl_coWARxVNI| zb3@(qdhfwiaXs{VAhP@3gC9`J-3Rc#_kLh}-k1L4e+h^e`T03PhZv?_Ph7i-DS+T5 ziq_zj8Wwq+w79qW=HIPg~gE!ybfY&dcy}1E5--B;nfQvWRH_u+Zdhr}Q zzqopFe)H<@qQ`4_fVS5gfJ=FWb+AIgo$wrf`ZdGB-GDC<29_BP5iN8_p)eehE>G4l z&R}%%f5jWu{Efd1-S5OZC$2a6K0)z-PyfjgSm2a0r#ArC2njNO`Vrq@8|0(j0Gt;n zJ;yX4X;`!lg^gTbKpEQ-Jt zUalDBHYiFrC=vMImn`hT5ftfFFr}vWFqYX-r!97yP zZDm^+MN0ltAa10GX()S@JvrbamSR7@8jM50YvI6|w}t6kYRRww$3ilw>ztKP6e3fs zZBBs*`p>t8Ug9qZWEja)ktvK(QC2~OR>=|vQY+|@c@O@ExOBhSCS1Df(c^!~u)8Vi z>q34|(gD5qhT~e?dEQgQl^ySn^gx&@e_ zHFdxX7_6EdWV#|*lwY()MWpBsZ5^p*ib@gzjKN%Poj5>Y&0S6dPcF*mh%58=LNe-T zl$e3y#&FIVFyikINK75xR9y2X;LAWtmZA`3afnjM4FaK}Qzsyy6vAn>e=}HG!a~~- zIUam8L`iK9Y@nb?q(nd^2oR<6N^l2UumceMmZUO>iQ@%1&UGjQKXFzINuV?*S6C#V zj^U^aRYbCMAf&L;N6IHum=Dx|ojfrRK58BnN5<_!@E*(w;UjUofDuKUjb5mbUKYo7 z`U}3mvAUHnw05y+Vp4IgehW~%!6}KwdfmVj^FFD%yszj^Fsv2)D@-}$Nd9;G)6cvE zu80eO>fT@!N>KMWiufc+PnQuDvCEl7g~kjrwfUiii@cd$S*^yKGB7G`7K-#Gg!#Y-LOwlo!4pi*ZgB zLL3oUS1d_UfVfqSEbG3E+O^yct)uqh9j4+Om)bB@6VHFCj=+uf831~hh#fL4e2uxN zqDwg=>jjU%Ee?N4DZJewnH(H1Q$*M09MIC z8LW~U7ZF)XBa^PMxDY_txe>X;?b$?k)QU}V?DnyV0lgcW)B_pzTxw0TzIf6NhSZZYr^3|qFeALiw7CP+(gGe}QClmPEI8YoYOdm*yeSBQG zLDnEX3MU1{9HK%tsBm^OFejrZjb+rkD#gxIZqYLgBdXFFV&1Ewmv?oo?9-=Wt%xft z2Ji@cA4mEEEM1iiU+NkHNNC5)cXV1>dg!tru|HZqKK!adMsJV;15h)IY}p6I>?Fb)SW zW_X}~Q9?ROaEvYlD_XcqHrdHs1rR66qUe%DIHl~A#;mBytccmDtHE$Ww;wru4edObOndw$=S%Ajs4jO&gT%#+$oxk z=H6ns2#07GqDe4X3|$Y7=d-Ch8c+S<$PeHtntPLQej0@HX|Nj`(L2W|ZLm?k-=H+* zYE1ZByoGiRwa-Gsw4t;5vZ@DQqsD<`@Tlp>M$%u(W&!h3M*@jl*Uq8Kh&fDlp4 zeZPc+wEpr2Q%vHQm~#2|3a>@1TLJP#j9J3J7Kc=1Yp{~dK_uH(U=oq?@Kz-BISEV| zmJ;5OdNGdlKo~@VEAv%gyt=Cgnx#u*gIez_xV z+cC7<+TfNM5oF0Sg&_j@YutB#p7%|UxkZda?ILh{^h#fX^;F61BN3x2VJTw(*J={3 zQ6r%5WU()OaF=Mp}9BD$Nug0 zH+g=kp>@Shvt8lJ$A+FY%kv82Vk*g~3^Dg6r6oe;P^+2jpZz2s_RspFVrc)kFPN`? z*7y3q|9sr12&Tab(R^O?z8iS{=99&Zc^6pf*f! zygX51fdNe9!5lu-1J&^4i42@`@06{O{`pAJ*c2ps4RPFzw*zi!M$@%8UZrKl8F+RC zZvOiWyuCRG-yDIdCJ?_YrPqJj9Jc=K&a*6JGoj-%&7 z{9aS<`r%Cy+3W-qZ$u7?dcV2NJBHF2Mi((d=>i6*?)AN;NF~`|buJb%CK5zM*q@th zYTaWE#LKv zSj=XJbO>WWbQ4X1yqz`Q$5f~b$b2b_s@<0PGoLFPTir>9VwPh0>j`4P32#Zk0IXq> zaI`KidFvEW^(ucZWbB8pT^NP~)%}1G5imk57zhjo_n583p93iIJ~_%M)k3RboPR71 zHJB}nq6=G+$?DO$v}FX`TEygS-eoOFspjfg6p?!!q7{*B^o~m+%!=2P>JYH-u9$;@ z*&I;7yTS;iH_bNri`9@o=?(3zi*MKZmb#MpBpwONNycFER#1)rXHo>|79=>h(@yh3 z9DdassoaS^26&y2l);!;R;EsE*z4i*S5;%Q*U2v$cJ=Ys5XWC=IF5;`!yhT1?_2y1 zg|BfKMu^Kj+Ta4_3X^CH7RI^c0&D)RdbPQWR{nTCnpIefI-g5n9Ee1wb74$UVNK@#wv6G6qzwa_ zIINc>C=MlLnU*g)EqbAOx<~$|d}wHbOdoD9o5~u$f?1wYlyEx+9hDH_*pW;m{1B?F zzqRfc#o-{MDo#}zX(7*ka(@c{rD1o9#is*S7;Ng|dP0pAwz}194;_&rXz;nFOz&)fRow{U` z#agFI&ez#XqIG@@U&#qf zp{C0rPNdB0IINpxfwsZ)+W0q?1T~WP8Dga%wN&NVf}3D_hP~F2Oo!h#D1+DBFcEJ{ z3s1JwQd{n9;#gjlNssyZ;r}5PIF57VfD2&@ridf6mcbAh15X1uHVhwuGl`>Z@mRbC z(>oLbsB`wW4d}C|&Ju+lzIk<>Yu|hbz9DR-vMAr^>(ZrZ$pwt6HKI=^Y2j1qdS~3i zY_m`Ew+u9tH6~^UC)rmT@5!z&wYI0#->gs-g0N0hrXxe?8po1BNgASbeE%KCyv4CNkQXnxS%dj>Gu@A1IoWfB7bw^U)dZa1Z);{<(Na$? z=flcokiO5+Vkqjz#@!V4%|O-2$v#j)yZlwr5ny3{Z3>#*KQ zZOc-yFVkC=V|N_-Bi}{gH1NWazd)gP8qPz{n@;D`2@2+uMc_{-p6Ablkr(=-5DtAe z7`a0@IvtPqA*4MZ<(}q4xyJ`7H*b9%>V^Janw7tU#Q36#2Nu>#b40}1@FzH9yM zSq$^QhvUh77w?s;Of(X-lZwqdJJ;8k(0=VDSD=q{_z>`v%$8)$V1 z(f)yQn=B1N|Zpw>lpeR;!8_=FcyGI4}EohOBBpXhG5d)!Y)9 zr6->0Bo0wqQ9u{n{>Y7nSe|JfFtF5$n)Bu!kYLwDy)F z7>ex22Cmf09WP9xYPr9F!x$7cTSG4t|Et0Yv)SxBoTr{cIWc6BUs0opNztzvqAaJ# zSQBg?ZKbQon%ra6muyfjzm>zjScup!XN1A+F$lLYT;o6<=cSm$>KY}TpH_Myzn$s! zxRjxkzl_p`;F6j`6A~qBByVg&5k(T1ILB1JZq0l%i^YZm3c*vO>m#v}B+xjEBJLj6 zZ;RrplmipT=R}PHy>ZzpT9*CeT~`bqOq**Y^6)imPIe)t@gfk3q5tjsaRH zZ2KIi$I7ogF7lI(i^6YQkI0>sW<1w0(E&f3etMxElZ7~Lt5e?A`4P39Q2#vA({uB&h(({Nj z;Ya`+sx_HjvX`8VA5?$5y%^Y5d!$lypQuvPYQxh+P3(t;Xmb#Q2UUFXAkwghClGwQ6r|!3$EX{tT&|w_pUa<&@jrx{N8F3Z|!(AEEFAg zuB;P*LaSAhcR~@nG%hh{Sd-6myk8hA=8Xq(qdr)X`&gD<7q>Y!b|sbZ!OVYMTyy_8 zYoNd{XH_SRMvCAAOY=eU%qW&L9uIWTb`K%Ft9LFPiO%GCW6l z4zG#uYE>flbUGF34TVz7a~cH9H8FCTRBwCwks%@@9Qj-S4sH8qeSL1Qf80;xS>5$^ zAnKZ)tha;w>F+;R)U@hW!rg5FR#5p97*Q39>?XBrxYL|g19^}wUFr8Dn{RXlQxTYJ zj#TDJ%-WsPop8^bznWKtEEV#nAEY}(Um;HGx{>S1QbpbT|TA_79WVsGCZcTkR&7hvBPiPtis-Ns6%A2k2sehl?+EwU&`ioa1 z`YBI*npsN=e1h|yX7RttidV>fs#E{Lr;{G=NKrzwJ&nRy?@sKUR*Zv8q+mo!K#1U z7k7}D?};DYQk1Ii<~0POU2)o~oB^bf0~$L$_m?>VDT9%%l#ehde>az*POVe#)pu$N zpu0AA)%o4>K_@w|0Rr33f9`?}XNsYh4`r$rZNodxSSAMwAY?r-#K~qVi*w3?yngIxfCA zy15PESNeIPPxwFA`N_N^BWGQ|)6^@iY>!kcJB#NF zjO4wPe6DE`t*aN2DGisS(_N@YFGC@?m2-0@4y@j)dmkk96^TNsVd(>UN)L8;E#teiX$`cN>;@$<`far3t8`QCY6=S~Dq2J+v_>)rb%J%6}34NpfC->Hi z|LnJZkYxR{{>XLRb^o|8!*2bv{^@tP|NC)Y<=h%Ay>h#;`x^IuFU3l9pE_Zef)iPV zi(1ZONmNxaP?Xv{%X+bdTmj_og1n}M-Xg9Ib6${y5s;81i=@0!?emkPN=XVGD0_6k zH>w_qjGZ!Z%*`l4#WfR(gLIoP89Y>)^;mATi(N=@-csaBY%s;@AU}+^a}sW4=Xw^6 zlmt~mc7Y?MLwD4jz5T5(YARf&c!MLfL@#InBf)_xuyx!w>p}6EtrwO$?kD>FFn>*N zy%hvA^at_PwRs{R#|x6Kr8KW` zmIT_BtyYXByVy!V@5*7a_`nX3F$vM7r9wd|heNlMnNoVKy&^FD21YOrP%32I8{JM% z0XN?tpyp3rnv25|^`SWtM>}b=RbIH!0~5Wdu?c3*XmpZ*0r%ivWqAN(s$%fqvMjSJq9_v<3i>dXgt%d z%T8yz!Otnb-?{j7zUu9uRb5bPHXpZc?pKJ?~6lpi7iukq1EH&@AojiXOGsi(~Gsh$cFNAVw&Z z4vqqefB?wHYFq3C?y?f{vwp_I0Zi}-w-h1*!$I!(o+Kn3Y`l{vd0CL7pKAoIxp%!p zwhY~}O(^2BkSQlz%(A+9r}(Ap&wN46-hk>YuZwb@V#ZMHJOb?lZwK|(nt~T`$aNnA zD{_B0dBx(?esa4(%Z)!7!oPdqwaR)wy?PI z#BBMY*PaN7;);_3s@kMxBq0%5Zm$#WfS>0#uGG=f*R$B(=yFGk9y>8)a@;id0Tu8E z#U(I$U!AeW{Os0Z=;r3{Wg(<0jDPgdfI=(^b!W1SxIPLh?t2#4$h0(ZKKUju znbc4~)pEeOQgHmttO$N<)Xc_lh&MRQV8q?JJ6$bPl!2lQ=J%H7*ZAz*{rC~5=sR)Q z&yMYnGN^9*A4Nya8z7ZFTI_)2Z|?20p`V6)8pm~p?$C2*-Y74UGKFZgICZ^K|8#tc z!ihhf%_ob~#dNYbMT^nGn~$cW`EWR#pSt5Ia%bKgy7LhlFDAp;Y_=COxf$|jzUsg6 zqwfFL0nCTL{D1HL|E@clx|RF?hf{y}`TqaM_zVVv-U^54tOvjVFcS3mFTE#4WSIL` z8;tIIy}w2{z5}ZiExzh&RaHm_mJ|QS?=x zvTcOu3L(}9Ctr&T_FtlCJrE0we|_@g3Ahem%vWI+G1}|(dhfv-0$yWU5|3Q^W^t$s zt#b);HrV%hFM2GrmhO=&M6tVWK5E3~kDj;BpU + +## Helm-Chart + +##### Scan Results + +#### Chart Object: traefik/templates/common.yaml + + + +| Type | Misconfiguration ID | Check | Severity | Explaination | Links | +|:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| +| Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| +| Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| +| Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| +| Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| +| Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| +| Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-traefik' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| + + +| No Misconfigurations found | +|:---------------------------------| + + + + +| No Misconfigurations found | +|:---------------------------------| + + + +## Containers + +##### Detected Containers + + tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c + tccr.io/truecharts/traefik:v2.5.6@sha256:7388e9ce030fdb113e5bdc737aad201833e6c79c0540269d82c4322047604cb4 + +##### Scan Results + + +#### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) + + +**alpine** + + +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| busybox | CVE-2021-42378 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42378
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42379 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42379
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42380 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42380
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42381 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42381
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42382 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42382
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42383 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| +| busybox | CVE-2021-42384 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42384
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42385 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42385
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42386 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42386
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42374 | MEDIUM | 1.33.1-r3 | 1.33.1-r4 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42374
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| +| ssl_client | CVE-2021-42378 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42378
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42379 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42379
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42380 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42380
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42381 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42381
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42382 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42382
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42383 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| +| ssl_client | CVE-2021-42384 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42384
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42385 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42385
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42386 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42386
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42374 | MEDIUM | 1.33.1-r3 | 1.33.1-r4 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42374
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| + + +#### Container: tccr.io/truecharts/traefik:v2.5.6@sha256:7388e9ce030fdb113e5bdc737aad201833e6c79c0540269d82c4322047604cb4 (alpine 3.14.3) + + +**alpine** + + +| No Vulnerabilities found | +|:---------------------------------| + + + +**gobinary** + + +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| github.com/hashicorp/consul | CVE-2021-41805 | HIGH | v1.10.3 | 1.8.17, 1.9.11, 1.10.4 |
Expand...https://discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871
https://nvd.nist.gov/vuln/detail/CVE-2021-41805
https://security.netapp.com/advisory/ntap-20211229-0007/
https://www.hashicorp.com/blog/category/consul
| +| github.com/opencontainers/image-spec | GMS-2021-101 | UNKNOWN | v1.0.1 | 1.0.2 |
Expand...https://github.com/advisories/GHSA-77vh-xpmg-72qh
https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m
https://github.com/opencontainers/image-spec/commit/693428a734f5bab1a84bd2f990d92ef1111cd60c
https://github.com/opencontainers/image-spec/releases/tag/v1.0.2
https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| + diff --git a/core/traefik/10.0.43/templates/_args.tpl b/core/traefik/10.0.43/templates/_args.tpl new file mode 100644 index 00000000000..fd8f62c1442 --- /dev/null +++ b/core/traefik/10.0.43/templates/_args.tpl @@ -0,0 +1,146 @@ +{{/* Define the args */}} +{{- define "traefik.args" -}} +args: + {{/* merge all ports */}} + {{- $ports := dict }} + {{- range $.Values.service }} + {{- range $name, $value := .ports }} + {{- $_ := set $ports $name $value }} + {{- end }} + {{- end }} + {{/* start of actual arguments */}} + {{- with .Values.globalArguments }} + {{- range . }} + - {{ . | quote }} + {{- end }} + {{- end }} + {{- range $name, $config := $ports }} + {{- if $config }} + {{- if or ( eq $config.protocol "HTTP" ) ( eq $config.protocol "HTTPS" ) ( eq $config.protocol "TCP" ) }} + {{- $_ := set $config "protocol" "TCP" }} + {{- end }} + - "--entryPoints.{{$name}}.address=:{{ $config.port }}/{{ default "tcp" $config.protocol | lower }}" + {{- end }} + {{- end }} + - "--api.dashboard=true" + - "--ping=true" + {{- if .Values.metrics }} + {{- if .Values.metrics.datadog }} + - "--metrics.datadog=true" + - "--metrics.datadog.address={{ .Values.metrics.datadog.address }}" + {{- end }} + {{- if .Values.metrics.influxdb }} + - "--metrics.influxdb=true" + - "--metrics.influxdb.address={{ .Values.metrics.influxdb.address }}" + - "--metrics.influxdb.protocol={{ .Values.metrics.influxdb.protocol }}" + {{- end }} + {{- if .Values.metrics.prometheus }} + - "--metrics.prometheus=true" + - "--metrics.prometheus.entrypoint={{ .Values.metrics.prometheus.entryPoint }}" + {{- end }} + {{- if .Values.metrics.statsd }} + - "--metrics.statsd=true" + - "--metrics.statsd.address={{ .Values.metrics.statsd.address }}" + {{- end }} + {{- end }} + {{- if .Values.providers.kubernetesCRD.enabled }} + - "--providers.kubernetescrd" + {{- end }} + {{- if .Values.providers.kubernetesIngress.enabled }} + - "--providers.kubernetesingress" + {{- if .Values.providers.kubernetesIngress.publishedService.enabled }} + - "--providers.kubernetesingress.ingressendpoint.publishedservice={{ template "providers.kubernetesIngress.publishedServicePath" . }}" + {{- end }} + {{- if .Values.providers.kubernetesIngress.labelSelector }} + - "--providers.kubernetesingress.labelSelector={{ .Values.providers.kubernetesIngress.labelSelector }}" + {{- end }} + {{- end }} + {{- if and .Values.rbac.enabled .Values.rbac.namespaced }} + {{- if .Values.providers.kubernetesCRD.enabled }} + - "--providers.kubernetescrd.namespaces={{ template "providers.kubernetesCRD.namespaces" . }}" + {{- end }} + {{- if .Values.providers.kubernetesIngress.enabled }} + - "--providers.kubernetesingress.namespaces={{ template "providers.kubernetesIngress.namespaces" . }}" + {{- end }} + {{- end }} + {{- range $entrypoint, $config := $ports }} + {{- if $config.redirectTo }} + {{- $toPort := index $ports $config.redirectTo }} + - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.to=:{{ $toPort.port }}" + - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.scheme=https" + {{- else if $config.redirectPort }} + {{ if gt $config.redirectPort 0.0 }} + - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.to=:{{ $config.redirectPort }}" + - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.scheme=https" + {{- end }} + {{- end }} + {{- if or ( $config.tls ) ( eq $config.protocol "HTTPS" ) }} + {{- if or ( $config.tls.enabled ) ( eq $config.protocol "HTTPS" ) }} + - "--entrypoints.{{ $entrypoint }}.http.tls=true" + {{- if $config.tls.options }} + - "--entrypoints.{{ $entrypoint }}.http.tls.options={{ $config.tls.options }}" + {{- end }} + {{- if $config.tls.certResolver }} + - "--entrypoints.{{ $entrypoint }}.http.tls.certResolver={{ $config.tls.certResolver }}" + {{- end }} + {{- if $config.tls.domains }} + {{- range $index, $domain := $config.tls.domains }} + {{- if $domain.main }} + - "--entrypoints.{{ $entrypoint }}.http.tls.domains[{{ $index }}].main={{ $domain.main }}" + {{- end }} + {{- if $domain.sans }} + - "--entrypoints.{{ $entrypoint }}.http.tls.domains[{{ $index }}].sans={{ join "," $domain.sans }}" + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- with .Values.logs }} + {{- if .general.format }} + - "--log.format={{ .general.format }}" + {{- end }} + {{- if ne .general.level "ERROR" }} + - "--log.level={{ .general.level | upper }}" + {{- end }} + {{- if .access.enabled }} + - "--accesslog=true" + {{- if .access.format }} + - "--accesslog.format={{ .access.format }}" + {{- end }} + {{- if .access.bufferingsize }} + - "--accesslog.bufferingsize={{ .access.bufferingsize }}" + {{- end }} + {{- if .access.filters }} + {{- if .access.filters.statuscodes }} + - "--accesslog.filters.statuscodes={{ .access.filters.statuscodes }}" + {{- end }} + {{- if .access.filters.retryattempts }} + - "--accesslog.filters.retryattempts" + {{- end }} + {{- if .access.filters.minduration }} + - "--accesslog.filters.minduration={{ .access.filters.minduration }}" + {{- end }} + {{- end }} + - "--accesslog.fields.defaultmode={{ .access.fields.general.defaultmode }}" + {{- range $fieldname, $fieldaction := .access.fields.general.names }} + - "--accesslog.fields.names.{{ $fieldname }}={{ $fieldaction }}" + {{- end }} + - "--accesslog.fields.headers.defaultmode={{ .access.fields.headers.defaultmode }}" + {{- range $fieldname, $fieldaction := .access.fields.headers.names }} + - "--accesslog.fields.headers.names.{{ $fieldname }}={{ $fieldaction }}" + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.pilot.enabled }} + - "--pilot.token={{ .Values.pilot.token }}" + {{- end }} + {{- if hasKey .Values.pilot "dashboard" }} + - "--pilot.dashboard={{ .Values.pilot.dashboard }}" + {{- end }} + {{- with .Values.additionalArguments }} + {{- range . }} + - {{ . | quote }} + {{- end }} + {{- end }} +{{- end -}} diff --git a/core/traefik/10.0.43/templates/_helpers.tpl b/core/traefik/10.0.43/templates/_helpers.tpl new file mode 100644 index 00000000000..8c6c4ac96bc --- /dev/null +++ b/core/traefik/10.0.43/templates/_helpers.tpl @@ -0,0 +1,22 @@ +{{/* +Construct the path for the providers.kubernetesingress.ingressendpoint.publishedservice. +By convention this will simply use the / to match the name of the +service generated. +Users can provide an override for an explicit service they want bound via `.Values.providers.kubernetesIngress.publishedService.pathOverride` +*/}} +{{- define "providers.kubernetesIngress.publishedServicePath" -}} +{{- $fullName := include "common.names.fullname" . -}} +{{- $defServiceName := printf "%s/%s-tcp" .Release.Namespace $fullName -}} +{{- $servicePath := default $defServiceName .Values.providers.kubernetesIngress.publishedService.pathOverride }} +{{- print $servicePath | trimSuffix "-" -}} +{{- end -}} + +{{/* +Construct a comma-separated list of whitelisted namespaces +*/}} +{{- define "providers.kubernetesIngress.namespaces" -}} +{{- default .Release.Namespace (join "," .Values.providers.kubernetesIngress.namespaces) }} +{{- end -}} +{{- define "providers.kubernetesCRD.namespaces" -}} +{{- default .Release.Namespace (join "," .Values.providers.kubernetesCRD.namespaces) }} +{{- end -}} diff --git a/core/traefik/10.0.43/templates/_ingressclass.tpl b/core/traefik/10.0.43/templates/_ingressclass.tpl new file mode 100644 index 00000000000..27f8467fc9e --- /dev/null +++ b/core/traefik/10.0.43/templates/_ingressclass.tpl @@ -0,0 +1,24 @@ +{{/* Define the ingressClass */}} +{{- define "traefik.ingressClass" -}} +{{- if .Values.ingressClass.enabled }} + {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1/IngressClass" }} +apiVersion: networking.k8s.io/v1 + {{- else if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/IngressClass" }} +apiVersion: networking.k8s.io/v1beta1 + {{- else if or (eq .Values.ingressClass.fallbackApiVersion "v1beta1") (eq .Values.ingressClass.fallbackApiVersion "v1") }} +apiVersion: {{ printf "networking.k8s.io/%s" .Values.ingressClass.fallbackApiVersion }} + {{- else }} + {{- fail "\n\n ERROR: You must have at least networking.k8s.io/v1beta1 to use ingressClass" }} + {{- end }} +--- +kind: IngressClass +metadata: + annotations: + ingressclass.kubernetes.io/is-default-class: {{ .Values.ingressClass.isDefaultClass | quote }} + labels: + {{- include "common.labels" . | nindent 4 }} + name: {{ .Release.Name }} +spec: + controller: traefik.io/ingress-controller +{{- end }} +{{- end }} diff --git a/core/traefik/10.0.43/templates/_ingressroute.tpl b/core/traefik/10.0.43/templates/_ingressroute.tpl new file mode 100644 index 00000000000..f848bc108fc --- /dev/null +++ b/core/traefik/10.0.43/templates/_ingressroute.tpl @@ -0,0 +1,25 @@ +{{/* Define the ingressRoute */}} +{{- define "traefik.ingressRoute" -}} +{{- if .Values.ingressRoute.dashboard.enabled }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: {{ include "common.names.fullname" . }}-dashboard + annotations: + {{- with .Values.ingressRoute.dashboard.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "common.labels" . | nindent 4 }} +spec: + entryPoints: + - main + routes: + - match: PathPrefix(`/dashboard`) || PathPrefix(`/api`) + kind: Rule + services: + - name: api@internal + kind: TraefikService +{{- end -}} +{{- end -}} diff --git a/core/traefik/10.0.43/templates/_portalhook.tpl b/core/traefik/10.0.43/templates/_portalhook.tpl new file mode 100644 index 00000000000..e3586c5d4e9 --- /dev/null +++ b/core/traefik/10.0.43/templates/_portalhook.tpl @@ -0,0 +1,26 @@ +{{/* Define the portalHook */}} +{{- define "traefik.portalhook" -}} +{{- if .Values.portalhook.enabled }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +--- + +apiVersion: v1 +kind: ConfigMap +metadata: + name: portalhook + namespace: {{ $namespace }} +data: + {{- $ports := dict }} + {{- range $.Values.service }} + {{- range $name, $value := .ports }} + {{- $_ := set $ports $name $value }} + {{- end }} + {{- end }} + {{- range $name, $value := $ports }} + {{ $name }}: {{ $value.port | quote }} + {{- end }} +{{- end }} +{{- end -}} diff --git a/core/traefik/10.0.43/templates/_tlsoptions.tpl b/core/traefik/10.0.43/templates/_tlsoptions.tpl new file mode 100644 index 00000000000..3e5aad3bee9 --- /dev/null +++ b/core/traefik/10.0.43/templates/_tlsoptions.tpl @@ -0,0 +1,12 @@ +{{/* Define the tlsOptions */}} +{{- define "traefik.tlsOptions" -}} +{{- range $name, $config := .Values.tlsOptions }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: TLSOption +metadata: + name: {{ $name }} +spec: + {{- toYaml $config | nindent 2 }} +{{- end }} +{{- end -}} diff --git a/core/traefik/10.0.43/templates/common.yaml b/core/traefik/10.0.43/templates/common.yaml new file mode 100644 index 00000000000..72c57659973 --- /dev/null +++ b/core/traefik/10.0.43/templates/common.yaml @@ -0,0 +1,24 @@ +{{/* Make sure all variables are set properly */}} +{{- include "common.setup" . }} + +{{- if .Values.metrics }} +{{- if .Values.metrics.prometheus }} +{{- $_ := set .Values.podAnnotations "prometheus.io/scrape" "true" -}} +{{- $_ := set .Values.podAnnotations "prometheus.io/path" "/metrics" -}} +{{- $_ := set .Values.podAnnotations "prometheus.io/scrape" "9100" -}} +{{- end }} +{{- end }} + +{{- $newArgs := (include "traefik.args" . | fromYaml) }} +{{- $_ := set .Values "newArgs" $newArgs -}} +{{- $mergedargs := concat .Values.args .Values.newArgs.args }} +{{- $_ := set .Values "args" $mergedargs -}} + +{{- include "traefik.portalhook" . }} +{{- include "traefik.tlsOptions" . }} +{{- include "traefik.ingressRoute" . }} +{{- include "traefik.ingressClass" . }} + + +{{/* Render the templates */}} +{{ include "common.postSetup" . }} diff --git a/core/traefik/10.0.43/templates/middlewares/basic-middleware.yaml b/core/traefik/10.0.43/templates/middlewares/basic-middleware.yaml new file mode 100644 index 00000000000..fca94384953 --- /dev/null +++ b/core/traefik/10.0.43/templates/middlewares/basic-middleware.yaml @@ -0,0 +1,65 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: compress + namespace: {{ $namespace }} +spec: + compress: {} +--- +# Here, an average of 300 requests per second is allowed. +# In addition, a burst of 200 requests is allowed. +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: basic-ratelimit + namespace: {{ $namespace }} +spec: + rateLimit: + average: 300 + burst: 200 +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: basic-secure-headers + namespace: {{ $namespace }} +spec: + headers: + accessControlAllowMethods: + - GET + - OPTIONS + - HEAD + - PUT + accessControlMaxAge: 100 + sslRedirect: true + stsSeconds: 63072000 + # stsIncludeSubdomains: false + # stsPreload: false + forceSTSHeader: true + contentTypeNosniff: true + browserXssFilter: true + sslForceHost: true + referrerPolicy: same-origin + customRequestHeaders: + X-Forwarded-Proto: "https" + customResponseHeaders: + X-Robots-Tag: 'none' + server: '' +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: chain-basic + namespace: {{ $namespace }} +spec: + chain: + middlewares: + - name: basic-ratelimit + - name: basic-secure-headers + - name: compress diff --git a/core/traefik/10.0.43/templates/middlewares/basicauth.yaml b/core/traefik/10.0.43/templates/middlewares/basicauth.yaml new file mode 100644 index 00000000000..ccb541742f0 --- /dev/null +++ b/core/traefik/10.0.43/templates/middlewares/basicauth.yaml @@ -0,0 +1,34 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.basicAuth }} +--- +{{- $users := list }} +{{ range $index, $userdata := $middlewareData.users }} + {{ $users = append $users ( htpasswd $userdata.username $userdata.password ) }} +{{ end }} + +apiVersion: v1 +kind: Secret +metadata: + name: {{printf "%v-%v" $middlewareData.name "secret" }} + namespace: {{ $namespace }} +type: Opaque +stringData: + users: | + {{- range $index, $user := $users }} + {{ printf "%s" $user }} + {{- end }} +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + basicAuth: + secret: {{printf "%v-%v" $middlewareData.name "secret" }} +{{ end }} diff --git a/core/traefik/10.0.43/templates/middlewares/chain.yaml b/core/traefik/10.0.43/templates/middlewares/chain.yaml new file mode 100644 index 00000000000..e22eb312207 --- /dev/null +++ b/core/traefik/10.0.43/templates/middlewares/chain.yaml @@ -0,0 +1,21 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.chain }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + chain: + middlewares: + {{ range $index, $chainData := . }} + - name: {{ printf "%v-%v@%v" $namespace $chainData.name "kubernetescrd" }} + {{ end }} +{{ end }} diff --git a/core/traefik/10.0.43/templates/middlewares/forwardauth.yaml b/core/traefik/10.0.43/templates/middlewares/forwardauth.yaml new file mode 100644 index 00000000000..7a3e32fdbf7 --- /dev/null +++ b/core/traefik/10.0.43/templates/middlewares/forwardauth.yaml @@ -0,0 +1,30 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.forwardAuth }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + forwardAuth: + address: {{ $middlewareData.address }} + {{- with $middlewareData.authResponseHeaders }} + authResponseHeaders: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $middlewareData.authRequestHeaders }} + authRequestHeaders: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if $middlewareData.authResponseHeadersRegex }} + authResponseHeadersRegex: {{ $middlewareData.authResponseHeadersRegex }} + {{- end }} + {{- if $middlewareData.trustForwardHeader }} + trustForwardHeader: true + {{- end }} +{{ end }} diff --git a/core/traefik/10.0.43/templates/middlewares/ipwhitelist.yaml b/core/traefik/10.0.43/templates/middlewares/ipwhitelist.yaml new file mode 100644 index 00000000000..1179245017e --- /dev/null +++ b/core/traefik/10.0.43/templates/middlewares/ipwhitelist.yaml @@ -0,0 +1,33 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.ipWhiteList }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + ipWhiteList: + sourceRange: + {{- range $middlewareData.sourceRange }} + - {{ . }} + {{- end }} + {{- if $middlewareData.ipStrategy }} + ipStrategy: + {{- if $middlewareData.ipStrategy.depth }} + depth: {{ $middlewareData.ipStrategy.depth }} + {{- end }} + {{- if $middlewareData.ipStrategy.excludedIPs }} + excludedIPs: + {{- range $middlewareData.ipStrategy.excludedIPs }} + - {{ . }} + {{- end }} + {{- end }} + {{- end }} +{{ end }} diff --git a/core/traefik/10.0.43/templates/middlewares/ratelimit.yaml b/core/traefik/10.0.43/templates/middlewares/ratelimit.yaml new file mode 100644 index 00000000000..144b9d8bf38 --- /dev/null +++ b/core/traefik/10.0.43/templates/middlewares/ratelimit.yaml @@ -0,0 +1,19 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.rateLimit }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + rateLimit: + average: {{ $middlewareData.average }} + burst: {{ $middlewareData.burst }} +{{ end }} diff --git a/core/traefik/10.0.43/templates/middlewares/redirectScheme.yaml b/core/traefik/10.0.43/templates/middlewares/redirectScheme.yaml new file mode 100644 index 00000000000..f2413f84e19 --- /dev/null +++ b/core/traefik/10.0.43/templates/middlewares/redirectScheme.yaml @@ -0,0 +1,19 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.redirectScheme }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + redirectScheme: + scheme: {{ $middlewareData.scheme }} + permanent: {{ $middlewareData.permanent }} +{{ end }} diff --git a/core/traefik/10.0.43/templates/middlewares/redirectregex.yaml b/core/traefik/10.0.43/templates/middlewares/redirectregex.yaml new file mode 100644 index 00000000000..46e3e724dd6 --- /dev/null +++ b/core/traefik/10.0.43/templates/middlewares/redirectregex.yaml @@ -0,0 +1,20 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.redirectRegex }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + redirectRegex: + regex: {{ $middlewareData.regex | quote }} + replacement: {{ $middlewareData.replacement | quote }} + permanent: {{ $middlewareData.permanent }} +{{ end }} diff --git a/core/traefik/10.0.43/templates/middlewares/tc-nextcloud.yaml b/core/traefik/10.0.43/templates/middlewares/tc-nextcloud.yaml new file mode 100644 index 00000000000..6a3019d56c5 --- /dev/null +++ b/core/traefik/10.0.43/templates/middlewares/tc-nextcloud.yaml @@ -0,0 +1,25 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-nextcloud-redirectregex-dav + namespace: {{ $namespace }} +spec: + redirectRegex: + regex: "https://(.*)/.well-known/(card|cal)dav" + replacement: "https://${1}/remote.php/dav/" +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-nextcloud-chain + namespace: {{ $namespace }} +spec: + chain: + middlewares: + - name: tc-nextcloud-redirectregex-dav diff --git a/core/traefik/10.0.43/values.yaml b/core/traefik/10.0.43/values.yaml new file mode 100644 index 00000000000..e69de29bb2d