From 46c988d72d91304bc992dfe27f38ac4768b98054 Mon Sep 17 00:00:00 2001 From: TrueCharts-Bot Date: Mon, 31 Jan 2022 16:00:15 +0000 Subject: [PATCH] Commit new App releases for TrueCharts Signed-off-by: TrueCharts-Bot --- core/traefik/10.0.45/CHANGELOG.md | 99 + .../0.0.8 => core/traefik/10.0.45}/CONFIG.md | 0 core/traefik/10.0.45/Chart.lock | 6 + core/traefik/10.0.45/Chart.yaml | 30 + core/traefik/10.0.45/README.md | 39 + core/traefik/10.0.45/app-readme.md | 3 + .../traefik/10.0.45}/charts/common-8.14.2.tgz | Bin core/traefik/10.0.45/crds/ingressroute.yaml | 198 ++ .../traefik/10.0.45/crds/ingressroutetcp.yaml | 160 ++ .../traefik/10.0.45/crds/ingressrouteudp.yaml | 84 + core/traefik/10.0.45/crds/middlewares.yaml | 563 ++++ core/traefik/10.0.45/crds/middlewarestcp.yaml | 59 + .../10.0.45/crds/serverstransports.yaml | 101 + core/traefik/10.0.45/crds/tlsoptions.yaml | 87 + core/traefik/10.0.45/crds/tlsstores.yaml | 64 + .../traefik/10.0.45/crds/traefikservices.yaml | 270 ++ core/traefik/10.0.45/helm-values.md | 44 + core/traefik/10.0.45/ix_values.yaml | 316 +++ core/traefik/10.0.45/questions.yaml | 2462 +++++++++++++++++ core/traefik/10.0.45/security.md | 108 + core/traefik/10.0.45/templates/_args.tpl | 146 + core/traefik/10.0.45/templates/_helpers.tpl | 22 + .../10.0.45/templates/_ingressclass.tpl | 24 + .../10.0.45/templates/_ingressroute.tpl | 25 + .../traefik/10.0.45/templates/_portalhook.tpl | 26 + .../traefik/10.0.45/templates/_tlsoptions.tpl | 12 + core/traefik/10.0.45/templates/common.yaml | 24 + .../middlewares/basic-middleware.yaml | 65 + .../templates/middlewares/basicauth.yaml | 34 + .../10.0.45/templates/middlewares/chain.yaml | 21 + .../templates/middlewares/forwardauth.yaml | 30 + .../templates/middlewares/ipwhitelist.yaml | 33 + .../templates/middlewares/ratelimit.yaml | 19 + .../templates/middlewares/redirectScheme.yaml | 19 + .../templates/middlewares/redirectregex.yaml | 20 + .../templates/middlewares/tc-nextcloud.yaml | 25 + .../templates/middlewares/tc-synapse.yaml | 25 + .../traefik/10.0.45}/values.yaml | 0 .../synapse/{0.0.8 => 0.0.9}/CHANGELOG.md | 5 + incubator/synapse/0.0.9/CONFIG.md | 8 + incubator/synapse/{0.0.8 => 0.0.9}/Chart.lock | 2 +- incubator/synapse/{0.0.8 => 0.0.9}/Chart.yaml | 2 +- incubator/synapse/{0.0.8 => 0.0.9}/README.md | 0 .../synapse/{0.0.8 => 0.0.9}/app-readme.md | 0 .../synapse/0.0.9/charts/common-8.14.2.tgz | Bin 0 -> 40699 bytes .../charts/postgresql-6.0.58.tgz | Bin .../{0.0.8 => 0.0.9}/ci/base-values.yaml | 0 .../{0.0.8 => 0.0.9}/ci/basic-values.yaml | 0 .../synapse/{0.0.8 => 0.0.9}/helm-values.md | 0 .../synapse/{0.0.8 => 0.0.9}/ix_values.yaml | 0 .../synapse/{0.0.8 => 0.0.9}/questions.yaml | 0 .../synapse/{0.0.8 => 0.0.9}/security.md | 0 .../{0.0.8 => 0.0.9}/templates/_configmap.tpl | 0 .../{0.0.8 => 0.0.9}/templates/_helpers.tpl | 0 .../{0.0.8 => 0.0.9}/templates/_secret.tpl | 4 +- .../{0.0.8 => 0.0.9}/templates/common.yaml | 3 + incubator/synapse/0.0.9/values.yaml | 0 57 files changed, 5283 insertions(+), 4 deletions(-) create mode 100644 core/traefik/10.0.45/CHANGELOG.md rename {incubator/synapse/0.0.8 => core/traefik/10.0.45}/CONFIG.md (100%) create mode 100644 core/traefik/10.0.45/Chart.lock create mode 100644 core/traefik/10.0.45/Chart.yaml create mode 100644 core/traefik/10.0.45/README.md create mode 100644 core/traefik/10.0.45/app-readme.md rename {incubator/synapse/0.0.8 => core/traefik/10.0.45}/charts/common-8.14.2.tgz (100%) create mode 100644 core/traefik/10.0.45/crds/ingressroute.yaml create mode 100644 core/traefik/10.0.45/crds/ingressroutetcp.yaml create mode 100644 core/traefik/10.0.45/crds/ingressrouteudp.yaml create mode 100644 core/traefik/10.0.45/crds/middlewares.yaml create mode 100644 core/traefik/10.0.45/crds/middlewarestcp.yaml create mode 100644 core/traefik/10.0.45/crds/serverstransports.yaml create mode 100644 core/traefik/10.0.45/crds/tlsoptions.yaml create mode 100644 core/traefik/10.0.45/crds/tlsstores.yaml create mode 100644 core/traefik/10.0.45/crds/traefikservices.yaml create mode 100644 core/traefik/10.0.45/helm-values.md create mode 100644 core/traefik/10.0.45/ix_values.yaml create mode 100644 core/traefik/10.0.45/questions.yaml create mode 100644 core/traefik/10.0.45/security.md create mode 100644 core/traefik/10.0.45/templates/_args.tpl create mode 100644 core/traefik/10.0.45/templates/_helpers.tpl create mode 100644 core/traefik/10.0.45/templates/_ingressclass.tpl create mode 100644 core/traefik/10.0.45/templates/_ingressroute.tpl create mode 100644 core/traefik/10.0.45/templates/_portalhook.tpl create mode 100644 core/traefik/10.0.45/templates/_tlsoptions.tpl create mode 100644 core/traefik/10.0.45/templates/common.yaml create mode 100644 core/traefik/10.0.45/templates/middlewares/basic-middleware.yaml create mode 100644 core/traefik/10.0.45/templates/middlewares/basicauth.yaml create mode 100644 core/traefik/10.0.45/templates/middlewares/chain.yaml create mode 100644 core/traefik/10.0.45/templates/middlewares/forwardauth.yaml create mode 100644 core/traefik/10.0.45/templates/middlewares/ipwhitelist.yaml create mode 100644 core/traefik/10.0.45/templates/middlewares/ratelimit.yaml create mode 100644 core/traefik/10.0.45/templates/middlewares/redirectScheme.yaml create mode 100644 core/traefik/10.0.45/templates/middlewares/redirectregex.yaml create mode 100644 core/traefik/10.0.45/templates/middlewares/tc-nextcloud.yaml create mode 100644 core/traefik/10.0.45/templates/middlewares/tc-synapse.yaml rename {incubator/synapse/0.0.8 => core/traefik/10.0.45}/values.yaml (100%) rename incubator/synapse/{0.0.8 => 0.0.9}/CHANGELOG.md (91%) create mode 100644 incubator/synapse/0.0.9/CONFIG.md rename incubator/synapse/{0.0.8 => 0.0.9}/Chart.lock (84%) rename incubator/synapse/{0.0.8 => 0.0.9}/Chart.yaml (98%) rename incubator/synapse/{0.0.8 => 0.0.9}/README.md (100%) rename incubator/synapse/{0.0.8 => 0.0.9}/app-readme.md (100%) create mode 100644 incubator/synapse/0.0.9/charts/common-8.14.2.tgz rename incubator/synapse/{0.0.8 => 0.0.9}/charts/postgresql-6.0.58.tgz (100%) rename incubator/synapse/{0.0.8 => 0.0.9}/ci/base-values.yaml (100%) rename incubator/synapse/{0.0.8 => 0.0.9}/ci/basic-values.yaml (100%) rename incubator/synapse/{0.0.8 => 0.0.9}/helm-values.md (100%) rename incubator/synapse/{0.0.8 => 0.0.9}/ix_values.yaml (100%) rename incubator/synapse/{0.0.8 => 0.0.9}/questions.yaml (100%) rename incubator/synapse/{0.0.8 => 0.0.9}/security.md (100%) rename incubator/synapse/{0.0.8 => 0.0.9}/templates/_configmap.tpl (100%) rename incubator/synapse/{0.0.8 => 0.0.9}/templates/_helpers.tpl (100%) rename incubator/synapse/{0.0.8 => 0.0.9}/templates/_secret.tpl (96%) rename incubator/synapse/{0.0.8 => 0.0.9}/templates/common.yaml (63%) create mode 100644 incubator/synapse/0.0.9/values.yaml diff --git a/core/traefik/10.0.45/CHANGELOG.md b/core/traefik/10.0.45/CHANGELOG.md new file mode 100644 index 00000000000..d519429153d --- /dev/null +++ b/core/traefik/10.0.45/CHANGELOG.md @@ -0,0 +1,99 @@ +# Changelog
+ + + +### [traefik-10.0.45](https://github.com/truecharts/apps/compare/traefik-10.0.44...traefik-10.0.45) (2022-01-31) + + + + +### [traefik-10.0.44](https://github.com/truecharts/apps/compare/traefik-10.0.43...traefik-10.0.44) (2022-01-28) + + + + +### [traefik-10.0.43](https://github.com/truecharts/apps/compare/traefik-10.0.42...traefik-10.0.43) (2022-01-27) + +#### Fix + +* hide Traefik metrics port and enable prometheus metrics + + + + +### [traefik-10.0.42](https://github.com/truecharts/apps/compare/traefik-10.0.41...traefik-10.0.42) (2022-01-25) + +#### Chore + +* update helm general non-major helm releases ([#1791](https://github.com/truecharts/apps/issues/1791)) + + + + +### [traefik-10.0.41](https://github.com/truecharts/apps/compare/traefik-10.0.40...traefik-10.0.41) (2022-01-22) + +#### Chore + +* update helm general non-major helm releases ([#1766](https://github.com/truecharts/apps/issues/1766)) + + + + +### [traefik-10.0.40](https://github.com/truecharts/apps/compare/traefik-10.0.39...traefik-10.0.40) (2022-01-21) + +#### Chore + +* update helm general non-major helm releases ([#1759](https://github.com/truecharts/apps/issues/1759)) + +#### Fix + +* set additional_attrs: true on all dicts ([#1750](https://github.com/truecharts/apps/issues/1750)) + + + + +### [traefik-10.0.39](https://github.com/truecharts/apps/compare/traefik-10.0.38...traefik-10.0.39) (2022-01-18) + +#### Chore + +* update helm general non-major helm releases ([#1732](https://github.com/truecharts/apps/issues/1732)) + + + + +### [traefik-10.0.38](https://github.com/truecharts/apps/compare/traefik-10.0.37...traefik-10.0.38) (2022-01-13) + +#### Chore + +* update helm general non-major helm releases ([#1712](https://github.com/truecharts/apps/issues/1712)) + +#### Feat + +* expose capabilities in GUI ([#1709](https://github.com/truecharts/apps/issues/1709)) + + + + +### [traefik-10.0.37](https://github.com/truecharts/apps/compare/traefik-10.0.36...traefik-10.0.37) (2022-01-12) + +#### Chore + +* update helm general non-major helm releases ([#1704](https://github.com/truecharts/apps/issues/1704)) + + + + +### [traefik-10.0.36](https://github.com/truecharts/apps/compare/traefik-10.0.35...traefik-10.0.36) (2022-01-11) + +#### Chore + +* update helm general non-major helm releases ([#1693](https://github.com/truecharts/apps/issues/1693)) + + + + +### [traefik-10.0.34](https://github.com/truecharts/apps/compare/traefik-10.0.33...traefik-10.0.34) (2022-01-09) + +#### Fix + +* fix logic in tpl ([#1668](https://github.com/truecharts/apps/issues/1668)) diff --git a/incubator/synapse/0.0.8/CONFIG.md b/core/traefik/10.0.45/CONFIG.md similarity index 100% rename from incubator/synapse/0.0.8/CONFIG.md rename to core/traefik/10.0.45/CONFIG.md diff --git a/core/traefik/10.0.45/Chart.lock b/core/traefik/10.0.45/Chart.lock new file mode 100644 index 00000000000..4620e207e74 --- /dev/null +++ b/core/traefik/10.0.45/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: common + repository: https://truecharts.org + version: 8.14.2 +digest: sha256:add6a5e615f2accd0ebc68c6ccb45ed13078763b68888bc01ea839371d698449 +generated: "2022-01-31T15:56:55.454079544Z" diff --git a/core/traefik/10.0.45/Chart.yaml b/core/traefik/10.0.45/Chart.yaml new file mode 100644 index 00000000000..344ceea2ccd --- /dev/null +++ b/core/traefik/10.0.45/Chart.yaml @@ -0,0 +1,30 @@ +apiVersion: v2 +appVersion: "2.5.6" +dependencies: +- name: common + repository: https://truecharts.org + version: 8.14.2 +deprecated: false +description: Test App for Traefik +home: https://github.com/truecharts/apps/tree/master/charts/stable/traefik +icon: https://truecharts.org/_static/img/appicons/traefik-icon.png +keywords: +- traefik +- ingress +kubeVersion: '>=1.16.0-0' +maintainers: +- email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org +name: traefik +sources: +- https://github.com/traefik/traefik +- https://github.com/traefik/traefik-helm-chart +- https://traefik.io/ +type: application +version: 10.0.45 +annotations: + truecharts.org/catagories: | + - network + truecharts.org/SCALE-support: "true" + truecharts.org/grade: U diff --git a/core/traefik/10.0.45/README.md b/core/traefik/10.0.45/README.md new file mode 100644 index 00000000000..8aa099823f5 --- /dev/null +++ b/core/traefik/10.0.45/README.md @@ -0,0 +1,39 @@ +# Introduction + +Test App for Traefik + +TrueCharts are designed to be installed as TrueNAS SCALE app only. We can not guarantee this charts works as a stand-alone helm installation. +**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/apps/issues/new/choose)** + +## Source Code + +* +* +* + +## Requirements + +Kubernetes: `>=1.16.0-0` + +## Dependencies + +| Repository | Name | Version | +|------------|------|---------| +| https://truecharts.org | common | 8.14.2 | + +## Installing the Chart + +To install this App on TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/03-Installing-an-App/). + +## Uninstalling the Chart + +To remove this App from TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/07-Deleting-an-App/). + +## Support + +- Please check our [quick-start guides](https://truecharts.org/manual/Quick-Start%20Guides/01-Open-Apps/) first. +- See the [Wiki](https://truecharts.org) +- Check our [Discord](https://discord.gg/tVsPTHWTtr) +- Open a [issue](https://github.com/truecharts/apps/issues/new/choose) +--- +All Rights Reserved - The TrueCharts Project diff --git a/core/traefik/10.0.45/app-readme.md b/core/traefik/10.0.45/app-readme.md new file mode 100644 index 00000000000..823c75135e0 --- /dev/null +++ b/core/traefik/10.0.45/app-readme.md @@ -0,0 +1,3 @@ +Test App for Traefik + +This App is supplied by TrueCharts, for more information please visit https://truecharts.org diff --git a/incubator/synapse/0.0.8/charts/common-8.14.2.tgz b/core/traefik/10.0.45/charts/common-8.14.2.tgz similarity index 100% rename from incubator/synapse/0.0.8/charts/common-8.14.2.tgz rename to core/traefik/10.0.45/charts/common-8.14.2.tgz diff --git a/core/traefik/10.0.45/crds/ingressroute.yaml b/core/traefik/10.0.45/crds/ingressroute.yaml new file mode 100644 index 00000000000..3391ba532a4 --- /dev/null +++ b/core/traefik/10.0.45/crds/ingressroute.yaml @@ -0,0 +1,198 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + "helm.sh/resource-policy": keep + "helm.sh/hook": pre-install,pre-upgrade,pre-rollback + controller-gen.kubebuilder.io/version: v0.4.1 + creationTimestamp: null + name: ingressroutes.traefik.containo.us +spec: + group: traefik.containo.us + names: + kind: IngressRoute + listKind: IngressRouteList + plural: ingressroutes + singular: ingressroute + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: IngressRoute is an Ingress CRD specification. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IngressRouteSpec is a specification for a IngressRouteSpec + resource. + properties: + entryPoints: + items: + type: string + type: array + routes: + items: + description: Route contains the set of routes. + properties: + kind: + enum: + - Rule + type: string + match: + type: string + middlewares: + items: + description: MiddlewareRef is a ref to the Middleware resources. + properties: + name: + type: string + namespace: + type: string + required: + - name + type: object + type: array + priority: + type: integer + services: + items: + description: Service defines an upstream to proxy traffic. + properties: + kind: + enum: + - Service + - TraefikService + type: string + name: + description: Name is a reference to a Kubernetes Service + object (for a load-balancer of servers), or to a TraefikService + object (service load-balancer, mirroring, etc). The + differentiation between the two is specified in the + Kind field. + type: string + namespace: + type: string + passHostHeader: + type: boolean + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + responseForwarding: + description: ResponseForwarding holds configuration for + the forward of the response. + properties: + flushInterval: + type: string + type: object + scheme: + type: string + serversTransport: + type: string + sticky: + description: Sticky holds the sticky configuration. + properties: + cookie: + description: Cookie holds the sticky configuration + based on cookie. + properties: + httpOnly: + type: boolean + name: + type: string + sameSite: + type: string + secure: + type: boolean + type: object + type: object + strategy: + type: string + weight: + description: Weight should only be specified when Name + references a TraefikService object (and to be precise, + one that embeds a Weighted Round Robin). + type: integer + required: + - name + type: object + type: array + required: + - kind + - match + type: object + type: array + tls: + description: "TLS contains the TLS certificates configuration of the + routes. To enable Let's Encrypt, use an empty TLS struct, e.g. in + YAML: \n \t tls: {} # inline format \n \t tls: \t secretName: + # block format" + properties: + certResolver: + type: string + domains: + items: + description: Domain holds a domain name with SANs. + properties: + main: + type: string + sans: + items: + type: string + type: array + type: object + type: array + options: + description: Options is a reference to a TLSOption, that specifies + the parameters of the TLS connection. + properties: + name: + type: string + namespace: + type: string + required: + - name + type: object + secretName: + description: SecretName is the name of the referenced Kubernetes + Secret to specify the certificate details. + type: string + store: + description: Store is a reference to a TLSStore, that specifies + the parameters of the TLS store. + properties: + name: + type: string + namespace: + type: string + required: + - name + type: object + type: object + required: + - routes + type: object + required: + - metadata + - spec + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/core/traefik/10.0.45/crds/ingressroutetcp.yaml b/core/traefik/10.0.45/crds/ingressroutetcp.yaml new file mode 100644 index 00000000000..67e099b47da --- /dev/null +++ b/core/traefik/10.0.45/crds/ingressroutetcp.yaml @@ -0,0 +1,160 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + "helm.sh/resource-policy": keep + "helm.sh/hook": pre-install,pre-upgrade,pre-rollback + controller-gen.kubebuilder.io/version: v0.4.1 + creationTimestamp: null + name: ingressroutetcps.traefik.containo.us +spec: + group: traefik.containo.us + names: + kind: IngressRouteTCP + listKind: IngressRouteTCPList + plural: ingressroutetcps + singular: ingressroutetcp + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: IngressRouteTCP is an Ingress CRD specification. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IngressRouteTCPSpec is a specification for a IngressRouteTCPSpec + resource. + properties: + entryPoints: + items: + type: string + type: array + routes: + items: + description: RouteTCP contains the set of routes. + properties: + match: + type: string + middlewares: + description: Middlewares contains references to MiddlewareTCP + resources. + items: + description: ObjectReference is a generic reference to a Traefik + resource. + properties: + name: + type: string + namespace: + type: string + required: + - name + type: object + type: array + services: + items: + description: ServiceTCP defines an upstream to proxy traffic. + properties: + name: + type: string + namespace: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + proxyProtocol: + description: ProxyProtocol holds the ProxyProtocol configuration. + properties: + version: + type: integer + type: object + terminationDelay: + type: integer + weight: + type: integer + required: + - name + - port + type: object + type: array + required: + - match + type: object + type: array + tls: + description: "TLSTCP contains the TLS certificates configuration of + the routes. To enable Let's Encrypt, use an empty TLS struct, e.g. + in YAML: \n \t tls: {} # inline format \n \t tls: \t secretName: + # block format" + properties: + certResolver: + type: string + domains: + items: + description: Domain holds a domain name with SANs. + properties: + main: + type: string + sans: + items: + type: string + type: array + type: object + type: array + options: + description: Options is a reference to a TLSOption, that specifies + the parameters of the TLS connection. + properties: + name: + type: string + namespace: + type: string + required: + - name + type: object + passthrough: + type: boolean + secretName: + description: SecretName is the name of the referenced Kubernetes + Secret to specify the certificate details. + type: string + store: + description: Store is a reference to a TLSStore, that specifies + the parameters of the TLS store. + properties: + name: + type: string + namespace: + type: string + required: + - name + type: object + type: object + required: + - routes + type: object + required: + - metadata + - spec + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/core/traefik/10.0.45/crds/ingressrouteudp.yaml b/core/traefik/10.0.45/crds/ingressrouteudp.yaml new file mode 100644 index 00000000000..910acd6c270 --- /dev/null +++ b/core/traefik/10.0.45/crds/ingressrouteudp.yaml @@ -0,0 +1,84 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + "helm.sh/resource-policy": keep + "helm.sh/hook": pre-install,pre-upgrade,pre-rollback + controller-gen.kubebuilder.io/version: v0.4.1 + creationTimestamp: null + name: ingressrouteudps.traefik.containo.us +spec: + group: traefik.containo.us + names: + kind: IngressRouteUDP + listKind: IngressRouteUDPList + plural: ingressrouteudps + singular: ingressrouteudp + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: IngressRouteUDP is an Ingress CRD specification. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: IngressRouteUDPSpec is a specification for a IngressRouteUDPSpec + resource. + properties: + entryPoints: + items: + type: string + type: array + routes: + items: + description: RouteUDP contains the set of routes. + properties: + services: + items: + description: ServiceUDP defines an upstream to proxy traffic. + properties: + name: + type: string + namespace: + type: string + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + weight: + type: integer + required: + - name + - port + type: object + type: array + type: object + type: array + required: + - routes + type: object + required: + - metadata + - spec + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/core/traefik/10.0.45/crds/middlewares.yaml b/core/traefik/10.0.45/crds/middlewares.yaml new file mode 100644 index 00000000000..1770587a327 --- /dev/null +++ b/core/traefik/10.0.45/crds/middlewares.yaml @@ -0,0 +1,563 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + "helm.sh/resource-policy": keep + "helm.sh/hook": pre-install,pre-upgrade,pre-rollback + controller-gen.kubebuilder.io/version: v0.4.1 + creationTimestamp: null + name: middlewares.traefik.containo.us +spec: + group: traefik.containo.us + names: + kind: Middleware + listKind: MiddlewareList + plural: middlewares + singular: middleware + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: Middleware is a specification for a Middleware resource. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: MiddlewareSpec holds the Middleware configuration. + properties: + addPrefix: + description: AddPrefix holds the AddPrefix configuration. + properties: + prefix: + type: string + type: object + basicAuth: + description: BasicAuth holds the HTTP basic authentication configuration. + properties: + headerField: + type: string + realm: + type: string + removeHeader: + type: boolean + secret: + type: string + type: object + buffering: + description: Buffering holds the request/response buffering configuration. + properties: + maxRequestBodyBytes: + format: int64 + type: integer + maxResponseBodyBytes: + format: int64 + type: integer + memRequestBodyBytes: + format: int64 + type: integer + memResponseBodyBytes: + format: int64 + type: integer + retryExpression: + type: string + type: object + chain: + description: Chain holds a chain of middlewares. + properties: + middlewares: + items: + description: MiddlewareRef is a ref to the Middleware resources. + properties: + name: + type: string + namespace: + type: string + required: + - name + type: object + type: array + type: object + circuitBreaker: + description: CircuitBreaker holds the circuit breaker configuration. + properties: + expression: + type: string + type: object + compress: + description: Compress holds the compress configuration. + properties: + excludedContentTypes: + items: + type: string + type: array + type: object + contentType: + description: ContentType middleware - or rather its unique `autoDetect` + option - specifies whether to let the `Content-Type` header, if + it has not been set by the backend, be automatically set to a value + derived from the contents of the response. As a proxy, the default + behavior should be to leave the header alone, regardless of what + the backend did with it. However, the historic default was to always + auto-detect and set the header if it was nil, and it is going to + be kept that way in order to support users currently relying on + it. This middleware exists to enable the correct behavior until + at least the default one can be changed in a future version. + properties: + autoDetect: + type: boolean + type: object + digestAuth: + description: DigestAuth holds the Digest HTTP authentication configuration. + properties: + headerField: + type: string + realm: + type: string + removeHeader: + type: boolean + secret: + type: string + type: object + errors: + description: ErrorPage holds the custom error page configuration. + properties: + query: + type: string + service: + description: Service defines an upstream to proxy traffic. + properties: + kind: + enum: + - Service + - TraefikService + type: string + name: + description: Name is a reference to a Kubernetes Service object + (for a load-balancer of servers), or to a TraefikService + object (service load-balancer, mirroring, etc). The differentiation + between the two is specified in the Kind field. + type: string + namespace: + type: string + passHostHeader: + type: boolean + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + responseForwarding: + description: ResponseForwarding holds configuration for the + forward of the response. + properties: + flushInterval: + type: string + type: object + scheme: + type: string + serversTransport: + type: string + sticky: + description: Sticky holds the sticky configuration. + properties: + cookie: + description: Cookie holds the sticky configuration based + on cookie. + properties: + httpOnly: + type: boolean + name: + type: string + sameSite: + type: string + secure: + type: boolean + type: object + type: object + strategy: + type: string + weight: + description: Weight should only be specified when Name references + a TraefikService object (and to be precise, one that embeds + a Weighted Round Robin). + type: integer + required: + - name + type: object + status: + items: + type: string + type: array + type: object + forwardAuth: + description: ForwardAuth holds the http forward authentication configuration. + properties: + address: + type: string + authRequestHeaders: + items: + type: string + type: array + authResponseHeaders: + items: + type: string + type: array + authResponseHeadersRegex: + type: string + tls: + description: ClientTLS holds TLS specific configurations as client. + properties: + caOptional: + type: boolean + caSecret: + type: string + certSecret: + type: string + insecureSkipVerify: + type: boolean + type: object + trustForwardHeader: + type: boolean + type: object + headers: + description: Headers holds the custom header configuration. + properties: + accessControlAllowCredentials: + description: AccessControlAllowCredentials is only valid if true. + false is ignored. + type: boolean + accessControlAllowHeaders: + description: AccessControlAllowHeaders must be used in response + to a preflight request with Access-Control-Request-Headers set. + items: + type: string + type: array + accessControlAllowMethods: + description: AccessControlAllowMethods must be used in response + to a preflight request with Access-Control-Request-Method set. + items: + type: string + type: array + accessControlAllowOriginList: + description: AccessControlAllowOriginList is a list of allowable + origins. Can also be a wildcard origin "*". + items: + type: string + type: array + accessControlAllowOriginListRegex: + description: AccessControlAllowOriginListRegex is a list of allowable + origins written following the Regular Expression syntax (https://golang.org/pkg/regexp/). + items: + type: string + type: array + accessControlExposeHeaders: + description: AccessControlExposeHeaders sets valid headers for + the response. + items: + type: string + type: array + accessControlMaxAge: + description: AccessControlMaxAge sets the time that a preflight + request may be cached. + format: int64 + type: integer + addVaryHeader: + description: AddVaryHeader controls if the Vary header is automatically + added/updated when the AccessControlAllowOriginList is set. + type: boolean + allowedHosts: + items: + type: string + type: array + browserXssFilter: + type: boolean + contentSecurityPolicy: + type: string + contentTypeNosniff: + type: boolean + customBrowserXSSValue: + type: string + customFrameOptionsValue: + type: string + customRequestHeaders: + additionalProperties: + type: string + type: object + customResponseHeaders: + additionalProperties: + type: string + type: object + featurePolicy: + type: string + forceSTSHeader: + type: boolean + frameDeny: + type: boolean + hostsProxyHeaders: + items: + type: string + type: array + isDevelopment: + type: boolean + publicKey: + type: string + referrerPolicy: + type: string + sslForceHost: + description: 'Deprecated: use RedirectRegex instead.' + type: boolean + sslHost: + description: 'Deprecated: use RedirectRegex instead.' + type: string + sslProxyHeaders: + additionalProperties: + type: string + type: object + sslRedirect: + description: 'Deprecated: use EntryPoint redirection or RedirectScheme + instead.' + type: boolean + sslTemporaryRedirect: + description: 'Deprecated: use EntryPoint redirection or RedirectScheme + instead.' + type: boolean + stsIncludeSubdomains: + type: boolean + stsPreload: + type: boolean + stsSeconds: + format: int64 + type: integer + type: object + inFlightReq: + description: InFlightReq limits the number of requests being processed + and served concurrently. + properties: + amount: + format: int64 + type: integer + sourceCriterion: + description: SourceCriterion defines what criterion is used to + group requests as originating from a common source. If none + are set, the default is to use the request's remote address + field. All fields are mutually exclusive. + properties: + ipStrategy: + description: IPStrategy holds the ip strategy configuration. + properties: + depth: + type: integer + excludedIPs: + items: + type: string + type: array + type: object + requestHeaderName: + type: string + requestHost: + type: boolean + type: object + type: object + ipWhiteList: + description: IPWhiteList holds the ip white list configuration. + properties: + ipStrategy: + description: IPStrategy holds the ip strategy configuration. + properties: + depth: + type: integer + excludedIPs: + items: + type: string + type: array + type: object + sourceRange: + items: + type: string + type: array + type: object + passTLSClientCert: + description: PassTLSClientCert holds the TLS client cert headers configuration. + properties: + info: + description: TLSClientCertificateInfo holds the client TLS certificate + info configuration. + properties: + issuer: + description: TLSCLientCertificateDNInfo holds the client TLS + certificate distinguished name info configuration. cf https://tools.ietf.org/html/rfc3739 + properties: + commonName: + type: boolean + country: + type: boolean + domainComponent: + type: boolean + locality: + type: boolean + organization: + type: boolean + province: + type: boolean + serialNumber: + type: boolean + type: object + notAfter: + type: boolean + notBefore: + type: boolean + sans: + type: boolean + serialNumber: + type: boolean + subject: + description: TLSCLientCertificateDNInfo holds the client TLS + certificate distinguished name info configuration. cf https://tools.ietf.org/html/rfc3739 + properties: + commonName: + type: boolean + country: + type: boolean + domainComponent: + type: boolean + locality: + type: boolean + organization: + type: boolean + province: + type: boolean + serialNumber: + type: boolean + type: object + type: object + pem: + type: boolean + type: object + plugin: + additionalProperties: + x-kubernetes-preserve-unknown-fields: true + type: object + rateLimit: + description: RateLimit holds the rate limiting configuration for a + given router. + properties: + average: + format: int64 + type: integer + burst: + format: int64 + type: integer + period: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + sourceCriterion: + description: SourceCriterion defines what criterion is used to + group requests as originating from a common source. If none + are set, the default is to use the request's remote address + field. All fields are mutually exclusive. + properties: + ipStrategy: + description: IPStrategy holds the ip strategy configuration. + properties: + depth: + type: integer + excludedIPs: + items: + type: string + type: array + type: object + requestHeaderName: + type: string + requestHost: + type: boolean + type: object + type: object + redirectRegex: + description: RedirectRegex holds the redirection configuration. + properties: + permanent: + type: boolean + regex: + type: string + replacement: + type: string + type: object + redirectScheme: + description: RedirectScheme holds the scheme redirection configuration. + properties: + permanent: + type: boolean + port: + type: string + scheme: + type: string + type: object + replacePath: + description: ReplacePath holds the ReplacePath configuration. + properties: + path: + type: string + type: object + replacePathRegex: + description: ReplacePathRegex holds the ReplacePathRegex configuration. + properties: + regex: + type: string + replacement: + type: string + type: object + retry: + description: Retry holds the retry configuration. + properties: + attempts: + type: integer + initialInterval: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + type: object + stripPrefix: + description: StripPrefix holds the StripPrefix configuration. + properties: + forceSlash: + type: boolean + prefixes: + items: + type: string + type: array + type: object + stripPrefixRegex: + description: StripPrefixRegex holds the StripPrefixRegex configuration. + properties: + regex: + items: + type: string + type: array + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/core/traefik/10.0.45/crds/middlewarestcp.yaml b/core/traefik/10.0.45/crds/middlewarestcp.yaml new file mode 100644 index 00000000000..f0d1d5640bd --- /dev/null +++ b/core/traefik/10.0.45/crds/middlewarestcp.yaml @@ -0,0 +1,59 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + "helm.sh/resource-policy": keep + "helm.sh/hook": pre-install,pre-upgrade,pre-rollback + controller-gen.kubebuilder.io/version: v0.4.1 + creationTimestamp: null + name: middlewaretcps.traefik.containo.us +spec: + group: traefik.containo.us + names: + kind: MiddlewareTCP + listKind: MiddlewareTCPList + plural: middlewaretcps + singular: middlewaretcp + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: MiddlewareTCP is a specification for a MiddlewareTCP resource. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: MiddlewareTCPSpec holds the MiddlewareTCP configuration. + properties: + ipWhiteList: + description: TCPIPWhiteList holds the TCP ip white list configuration. + properties: + sourceRange: + items: + type: string + type: array + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/core/traefik/10.0.45/crds/serverstransports.yaml b/core/traefik/10.0.45/crds/serverstransports.yaml new file mode 100644 index 00000000000..78241697d1a --- /dev/null +++ b/core/traefik/10.0.45/crds/serverstransports.yaml @@ -0,0 +1,101 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + "helm.sh/resource-policy": keep + "helm.sh/hook": pre-install,pre-upgrade,pre-rollback + controller-gen.kubebuilder.io/version: v0.4.1 + creationTimestamp: null + name: serverstransports.traefik.containo.us +spec: + group: traefik.containo.us + names: + kind: ServersTransport + listKind: ServersTransportList + plural: serverstransports + singular: serverstransport + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: ServersTransport is a specification for a ServersTransport resource. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ServersTransportSpec options to configure communication between + Traefik and the servers. + properties: + certificatesSecrets: + description: Certificates for mTLS. + items: + type: string + type: array + disableHTTP2: + description: Disable HTTP/2 for connections with backend servers. + type: boolean + forwardingTimeouts: + description: Timeouts for requests forwarded to the backend servers. + properties: + dialTimeout: + anyOf: + - type: integer + - type: string + description: The amount of time to wait until a connection to + a backend server can be established. If zero, no timeout exists. + x-kubernetes-int-or-string: true + idleConnTimeout: + anyOf: + - type: integer + - type: string + description: The maximum period for which an idle HTTP keep-alive + connection will remain open before closing itself. + x-kubernetes-int-or-string: true + responseHeaderTimeout: + anyOf: + - type: integer + - type: string + description: The amount of time to wait for a server's response + headers after fully writing the request (including its body, + if any). If zero, no timeout exists. + x-kubernetes-int-or-string: true + type: object + insecureSkipVerify: + description: Disable SSL certificate verification. + type: boolean + maxIdleConnsPerHost: + description: If non-zero, controls the maximum idle (keep-alive) to + keep per-host. If zero, DefaultMaxIdleConnsPerHost is used. + type: integer + rootCAsSecrets: + description: Add cert file for self-signed certificate. + items: + type: string + type: array + serverName: + description: ServerName used to contact the server. + type: string + type: object + required: + - metadata + - spec + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/core/traefik/10.0.45/crds/tlsoptions.yaml b/core/traefik/10.0.45/crds/tlsoptions.yaml new file mode 100644 index 00000000000..c901ac2df5e --- /dev/null +++ b/core/traefik/10.0.45/crds/tlsoptions.yaml @@ -0,0 +1,87 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + "helm.sh/resource-policy": keep + "helm.sh/hook": pre-install,pre-upgrade,pre-rollback + controller-gen.kubebuilder.io/version: v0.4.1 + creationTimestamp: null + name: tlsoptions.traefik.containo.us +spec: + group: traefik.containo.us + names: + kind: TLSOption + listKind: TLSOptionList + plural: tlsoptions + singular: tlsoption + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: TLSOption is a specification for a TLSOption resource. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: TLSOptionSpec configures TLS for an entry point. + properties: + cipherSuites: + items: + type: string + type: array + clientAuth: + description: ClientAuth defines the parameters of the client authentication + part of the TLS connection, if any. + properties: + clientAuthType: + description: ClientAuthType defines the client authentication + type to apply. + enum: + - NoClientCert + - RequestClientCert + - VerifyClientCertIfGiven + - RequireAndVerifyClientCert + type: string + secretNames: + description: SecretName is the name of the referenced Kubernetes + Secret to specify the certificate details. + items: + type: string + type: array + type: object + curvePreferences: + items: + type: string + type: array + maxVersion: + type: string + minVersion: + type: string + preferServerCipherSuites: + type: boolean + sniStrict: + type: boolean + type: object + required: + - metadata + - spec + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/core/traefik/10.0.45/crds/tlsstores.yaml b/core/traefik/10.0.45/crds/tlsstores.yaml new file mode 100644 index 00000000000..7bb6193b026 --- /dev/null +++ b/core/traefik/10.0.45/crds/tlsstores.yaml @@ -0,0 +1,64 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + "helm.sh/resource-policy": keep + "helm.sh/hook": pre-install,pre-upgrade,pre-rollback + controller-gen.kubebuilder.io/version: v0.4.1 + creationTimestamp: null + name: tlsstores.traefik.containo.us +spec: + group: traefik.containo.us + names: + kind: TLSStore + listKind: TLSStoreList + plural: tlsstores + singular: tlsstore + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: TLSStore is a specification for a TLSStore resource. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: TLSStoreSpec configures a TLSStore resource. + properties: + defaultCertificate: + description: DefaultCertificate holds a secret name for the TLSOption + resource. + properties: + secretName: + description: SecretName is the name of the referenced Kubernetes + Secret to specify the certificate details. + type: string + required: + - secretName + type: object + required: + - defaultCertificate + type: object + required: + - metadata + - spec + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/core/traefik/10.0.45/crds/traefikservices.yaml b/core/traefik/10.0.45/crds/traefikservices.yaml new file mode 100644 index 00000000000..1d98c25d68d --- /dev/null +++ b/core/traefik/10.0.45/crds/traefikservices.yaml @@ -0,0 +1,270 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + "helm.sh/resource-policy": keep + "helm.sh/hook": pre-install,pre-upgrade,pre-rollback + controller-gen.kubebuilder.io/version: v0.4.1 + creationTimestamp: null + name: traefikservices.traefik.containo.us +spec: + group: traefik.containo.us + names: + kind: TraefikService + listKind: TraefikServiceList + plural: traefikservices + singular: traefikservice + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: TraefikService is the specification for a service (that an IngressRoute + refers to) that is usually not a terminal service (i.e. not a pod of servers), + as opposed to a Kubernetes Service. That is to say, it usually refers to + other (children) services, which themselves can be TraefikServices or Services. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ServiceSpec defines whether a TraefikService is a load-balancer + of services or a mirroring service. + properties: + mirroring: + description: Mirroring defines a mirroring service, which is composed + of a main load-balancer, and a list of mirrors. + properties: + kind: + enum: + - Service + - TraefikService + type: string + maxBodySize: + format: int64 + type: integer + mirrors: + items: + description: MirrorService defines one of the mirrors of a Mirroring + service. + properties: + kind: + enum: + - Service + - TraefikService + type: string + name: + description: Name is a reference to a Kubernetes Service + object (for a load-balancer of servers), or to a TraefikService + object (service load-balancer, mirroring, etc). The differentiation + between the two is specified in the Kind field. + type: string + namespace: + type: string + passHostHeader: + type: boolean + percent: + type: integer + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + responseForwarding: + description: ResponseForwarding holds configuration for + the forward of the response. + properties: + flushInterval: + type: string + type: object + scheme: + type: string + serversTransport: + type: string + sticky: + description: Sticky holds the sticky configuration. + properties: + cookie: + description: Cookie holds the sticky configuration based + on cookie. + properties: + httpOnly: + type: boolean + name: + type: string + sameSite: + type: string + secure: + type: boolean + type: object + type: object + strategy: + type: string + weight: + description: Weight should only be specified when Name references + a TraefikService object (and to be precise, one that embeds + a Weighted Round Robin). + type: integer + required: + - name + type: object + type: array + name: + description: Name is a reference to a Kubernetes Service object + (for a load-balancer of servers), or to a TraefikService object + (service load-balancer, mirroring, etc). The differentiation + between the two is specified in the Kind field. + type: string + namespace: + type: string + passHostHeader: + type: boolean + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + responseForwarding: + description: ResponseForwarding holds configuration for the forward + of the response. + properties: + flushInterval: + type: string + type: object + scheme: + type: string + serversTransport: + type: string + sticky: + description: Sticky holds the sticky configuration. + properties: + cookie: + description: Cookie holds the sticky configuration based on + cookie. + properties: + httpOnly: + type: boolean + name: + type: string + sameSite: + type: string + secure: + type: boolean + type: object + type: object + strategy: + type: string + weight: + description: Weight should only be specified when Name references + a TraefikService object (and to be precise, one that embeds + a Weighted Round Robin). + type: integer + required: + - name + type: object + weighted: + description: WeightedRoundRobin defines a load-balancer of services. + properties: + services: + items: + description: Service defines an upstream to proxy traffic. + properties: + kind: + enum: + - Service + - TraefikService + type: string + name: + description: Name is a reference to a Kubernetes Service + object (for a load-balancer of servers), or to a TraefikService + object (service load-balancer, mirroring, etc). The differentiation + between the two is specified in the Kind field. + type: string + namespace: + type: string + passHostHeader: + type: boolean + port: + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + responseForwarding: + description: ResponseForwarding holds configuration for + the forward of the response. + properties: + flushInterval: + type: string + type: object + scheme: + type: string + serversTransport: + type: string + sticky: + description: Sticky holds the sticky configuration. + properties: + cookie: + description: Cookie holds the sticky configuration based + on cookie. + properties: + httpOnly: + type: boolean + name: + type: string + sameSite: + type: string + secure: + type: boolean + type: object + type: object + strategy: + type: string + weight: + description: Weight should only be specified when Name references + a TraefikService object (and to be precise, one that embeds + a Weighted Round Robin). + type: integer + required: + - name + type: object + type: array + sticky: + description: Sticky holds the sticky configuration. + properties: + cookie: + description: Cookie holds the sticky configuration based on + cookie. + properties: + httpOnly: + type: boolean + name: + type: string + sameSite: + type: string + secure: + type: boolean + type: object + type: object + type: object + type: object + required: + - metadata + - spec + type: object + served: true + storage: true +status: + acceptedNames: + kind: "" + plural: "" + conditions: [] + storedVersions: [] diff --git a/core/traefik/10.0.45/helm-values.md b/core/traefik/10.0.45/helm-values.md new file mode 100644 index 00000000000..d51170d2347 --- /dev/null +++ b/core/traefik/10.0.45/helm-values.md @@ -0,0 +1,44 @@ +# Default Helm-Values + +TrueCharts is primarily build to supply TrueNAS SCALE Apps. +However, we also supply all Apps as standard Helm-Charts. In this document we aim to document the default values in our values.yaml file. + +Most of our Apps also consume our "common" Helm Chart. +If this is the case, this means that all values.yaml values are set to the common chart values.yaml by default. This values.yaml file will only contain values that deviate from the common chart. +You will, however, be able to use all values referenced in the common chart here, besides the values listed in this document. + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| additionalArguments | list | `["--metrics.prometheus","--ping","--serverstransport.insecureskipverify=true","--providers.kubernetesingress.allowexternalnameservices=true"]` | Additional arguments to be passed at Traefik's binary All available options available on https://docs.traefik.io/reference/static-configuration/cli/ | +| globalArguments[0] | string | `"--global.checknewversion"` | | +| image.pullPolicy | string | `"IfNotPresent"` | | +| image.repository | string | `"tccr.io/truecharts/traefik"` | | +| image.tag | string | `"v2.5.6@sha256:7388e9ce030fdb113e5bdc737aad201833e6c79c0540269d82c4322047604cb4"` | | +| ingressClass | object | `{"enabled":false,"fallbackApiVersion":"","isDefaultClass":false}` | Use ingressClass. Ignored if Traefik version < 2.3 / kubernetes < 1.18.x | +| ingressRoute | object | `{"dashboard":{"annotations":{},"enabled":true,"labels":{}}}` | Create an IngressRoute for the dashboard | +| logs | object | `{"access":{"enabled":false,"fields":{"general":{"defaultmode":"keep","names":{}},"headers":{"defaultmode":"drop","names":{}}},"filters":{}},"general":{"level":"ERROR"}}` | Logs https://docs.traefik.io/observability/logs/ | +| metrics.prometheus.entryPoint | string | `"metrics"` | | +| middlewares | object | `{"basicAuth":[],"chain":[],"forwardAuth":[],"ipWhiteList":[],"rateLimit":[],"redirectRegex":[],"redirectScheme":[]}` | SCALE Middleware Handlers | +| pilot | object | `{"enabled":false,"token":""}` | Activate Pilot integration | +| podAnnotations."prometheus.io/path" | string | `"/metrics"` | | +| podAnnotations."prometheus.io/port" | string | `"9180"` | | +| podAnnotations."prometheus.io/scrape" | string | `"true"` | | +| portalhook.enabled | bool | `true` | | +| probes.liveness | object | See below | Liveness probe configuration | +| probes.liveness.path | string | "/" | If a HTTP probe is used (default for HTTP/HTTPS services) this path is used | +| probes.liveness.type | string | "TCP" | sets the probe type when not using a custom probe | +| probes.readiness | object | See below | Redainess probe configuration | +| probes.readiness.path | string | "/" | If a HTTP probe is used (default for HTTP/HTTPS services) this path is used | +| probes.readiness.type | string | "TCP" | sets the probe type when not using a custom probe | +| probes.startup | object | See below | Startup probe configuration | +| probes.startup.path | string | "/" | If a HTTP probe is used (default for HTTP/HTTPS services) this path is used | +| probes.startup.type | string | "TCP" | sets the probe type when not using a custom probe | +| providers | object | `{"kubernetesCRD":{"enabled":true,"namespaces":[]},"kubernetesIngress":{"enabled":true,"namespaces":[],"publishedService":{"enabled":true}}}` | Configure providers | +| rbac | object | `{"enabled":true,"rules":[{"apiGroups":[""],"resources":["services","endpoints","secrets"],"verbs":["get","list","watch"]},{"apiGroups":["extensions","networking.k8s.io"],"resources":["ingresses","ingressclasses"],"verbs":["get","list","watch"]},{"apiGroups":["extensions","networking.k8s.io"],"resources":["ingresses/status"],"verbs":["update"]},{"apiGroups":["traefik.containo.us"],"resources":["ingressroutes","ingressroutetcps","ingressrouteudps","middlewares","middlewaretcps","tlsoptions","tlsstores","traefikservices","serverstransports"],"verbs":["get","list","watch"]}]}` | Whether Role Based Access Control objects like roles and rolebindings should be created | +| service | object | `{"main":{"ports":{"main":{"port":9000,"protocol":"HTTP","targetPort":9000}},"type":"LoadBalancer"},"metrics":{"enabled":true,"ports":{"metrics":{"enabled":true,"port":9180,"protocol":"HTTP","targetPort":9180}},"type":"ClusterIP"},"tcp":{"enabled":true,"ports":{"web":{"enabled":true,"port":9080,"protocol":"HTTP","redirectTo":"websecure"},"websecure":{"enabled":true,"port":9443,"protocol":"HTTPS"}},"type":"LoadBalancer"},"udp":{"enabled":false}}` | Options for the main traefik service, where the entrypoints traffic comes from from. | +| serviceAccount | object | `{"create":true}` | The service account the pods will use to interact with the Kubernetes API | +| tlsOptions | object | `{"default":{"cipherSuites":["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305","TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384","TLS_CHACHA20_POLY1305_SHA256"],"curvePreferences":["CurveP521","CurveP384"],"minVersion":"VersionTLS12","sniStrict":false}}` | TLS Options to be created as TLSOption CRDs https://doc.traefik.io/tccr.io/truecharts/https/tls/#tls-options Example: | + +All Rights Reserved - The TrueCharts Project diff --git a/core/traefik/10.0.45/ix_values.yaml b/core/traefik/10.0.45/ix_values.yaml new file mode 100644 index 00000000000..148472e322f --- /dev/null +++ b/core/traefik/10.0.45/ix_values.yaml @@ -0,0 +1,316 @@ +image: + repository: tccr.io/truecharts/traefik + # defaults to appVersion + tag: v2.5.6@sha256:7388e9ce030fdb113e5bdc737aad201833e6c79c0540269d82c4322047604cb4 + pullPolicy: IfNotPresent + +# -- Use ingressClass. Ignored if Traefik version < 2.3 / kubernetes < 1.18.x +ingressClass: + # true is not unit-testable yet, pending https://github.com/rancher/helm-unittest/pull/12 + enabled: false + isDefaultClass: false + # Use to force a networking.k8s.io API Version for certain CI/CD applications. E.g. "v1beta1" + fallbackApiVersion: "" + +# -- Activate Pilot integration +pilot: + enabled: false + token: "" + # Toggle Pilot Dashboard + # dashboard: false + +# -- Create an IngressRoute for the dashboard +ingressRoute: + dashboard: + enabled: true + # Additional ingressRoute annotations (e.g. for kubernetes.io/ingress.class) + annotations: {} + # Additional ingressRoute labels (e.g. for filtering IngressRoute by custom labels) + labels: {} + +podAnnotations: + prometheus.io/scrape: "true" + prometheus.io/path: "/metrics" + prometheus.io/port: "9180" + +# +# -- Configure providers +providers: + kubernetesCRD: + enabled: true + namespaces: [] + # - "default" + kubernetesIngress: + enabled: true + # labelSelector: environment=production,method=traefik + namespaces: [] + # - "default" + # IP used for Kubernetes Ingress endpoints + publishedService: + enabled: true + # Published Kubernetes Service to copy status from. Format: namespace/servicename + # By default this Traefik service + # pathOverride: "" + +# -- Logs +# https://docs.traefik.io/observability/logs/ +logs: + # Traefik logs concern everything that happens to Traefik itself (startup, configuration, events, shutdown, and so on). + general: + # By default, the logs use a text format (common), but you can + # also ask for the json format in the format option + # format: json + # By default, the level is set to ERROR. Alternative logging levels are DEBUG, PANIC, FATAL, ERROR, WARN, and INFO. + level: ERROR + access: + # To enable access logs + enabled: false + # By default, logs are written using the Common Log Format (CLF). + # To write logs in JSON, use json in the format option. + # If the given format is unsupported, the default (CLF) is used instead. + # format: json + # To write the logs in an asynchronous fashion, specify a bufferingSize option. + # This option represents the number of log lines Traefik will keep in memory before writing + # them to the selected output. In some cases, this option can greatly help performances. + # bufferingSize: 100 + # Filtering https://docs.traefik.io/observability/access-logs/#filtering + filters: {} + # statuscodes: "200,300-302" + # retryattempts: true + # minduration: 10ms + # Fields + # https://docs.traefik.io/observability/access-logs/#limiting-the-fieldsincluding-headers + fields: + general: + defaultmode: keep + names: {} + # Examples: + # ClientUsername: drop + headers: + defaultmode: drop + names: {} + # Examples: + # User-Agent: redact + # Authorization: drop + # Content-Type: keep + +metrics: + # datadog: + # address: 127.0.0.1:8125 + # influxdb: + # address: localhost:8089 + # protocol: udp + prometheus: + entryPoint: metrics + # statsd: + # address: localhost:8125 + +globalArguments: + - "--global.checknewversion" + +## +# -- Additional arguments to be passed at Traefik's binary +# All available options available on https://docs.traefik.io/reference/static-configuration/cli/ +## Use curly braces to pass values: `helm install --set="additionalArguments={--providers.kubernetesingress.ingressclass=traefik-internal,--log.level=DEBUG}"` +additionalArguments: + - "--metrics.prometheus" + - "--ping" + - "--serverstransport.insecureskipverify=true" + - "--providers.kubernetesingress.allowexternalnameservices=true" + +# -- TLS Options to be created as TLSOption CRDs +# https://doc.traefik.io/tccr.io/truecharts/https/tls/#tls-options +# Example: +tlsOptions: + default: + sniStrict: false + minVersion: VersionTLS12 + curvePreferences: + - CurveP521 + - CurveP384 + cipherSuites: + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_CHACHA20_POLY1305_SHA256 + +# -- Options for the main traefik service, where the entrypoints traffic comes from +# from. +service: + main: + type: LoadBalancer + ports: + main: + port: 9000 + targetPort: 9000 + protocol: HTTP + tcp: + enabled: true + type: LoadBalancer + ports: + web: + enabled: true + port: 9080 + protocol: HTTP + redirectTo: websecure + # Options: Empty, 0 (ingore), or positive int + # redirectPort: + websecure: + enabled: true + port: 9443 + protocol: HTTPS +# tcpexample: +# enabled: true +# targetPort: 9443 +# protocol: TCP +# tls: +# enabled: false +# # this is the name of a TLSOption definition +# options: "" +# certResolver: "" +# domains: [] +# # - main: example.com +# # sans: +# # - foo.example.com +# # - bar.example.com + metrics: + enabled: true + type: ClusterIP + ports: + metrics: + enabled: true + port: 9180 + targetPort: 9180 + protocol: HTTP + udp: + enabled: false + +probes: + # -- Liveness probe configuration + # @default -- See below + liveness: + # -- sets the probe type when not using a custom probe + # @default -- "TCP" + type: HTTP + # -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used + # @default -- "/" + path: "/ping" + + # -- Redainess probe configuration + # @default -- See below + readiness: + # -- sets the probe type when not using a custom probe + # @default -- "TCP" + type: HTTP + # -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used + # @default -- "/" + path: "/ping" + + # -- Startup probe configuration + # @default -- See below + startup: + # -- sets the probe type when not using a custom probe + # @default -- "TCP" + type: HTTP + # -- If a HTTP probe is used (default for HTTP/HTTPS services) this path is used + # @default -- "/" + path: "/ping" + +# -- Whether Role Based Access Control objects like roles and rolebindings should be created +rbac: + enabled: true + rules: + - apiGroups: + - "" + resources: + - services + - endpoints + - secrets + verbs: + - get + - list + - watch + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingresses + - ingressclasses + verbs: + - get + - list + - watch + - apiGroups: + - extensions + - networking.k8s.io + resources: + - ingresses/status + verbs: + - update + - apiGroups: + - traefik.containo.us + resources: + - ingressroutes + - ingressroutetcps + - ingressrouteudps + - middlewares + - middlewaretcps + - tlsoptions + - tlsstores + - traefikservices + - serverstransports + verbs: + - get + - list + - watch + +# -- The service account the pods will use to interact with the Kubernetes API +serviceAccount: + create: true + +# -- SCALE Middleware Handlers +middlewares: + basicAuth: [] + # - name: basicauthexample + # users: + # - username: testuser + # password: testpassword + forwardAuth: [] + # - name: forwardAuthexample + # address: https://auth.example.com/ + # authResponseHeaders: + # - X-Secret + # - X-Auth-User + # authRequestHeaders: + # - "Accept" + # - "X-CustomHeader" + # authResponseHeadersRegex: "^X-" + # trustForwardHeader: true + chain: [] + # - name: chainname + # middlewares: + # - name: compress + redirectScheme: [] + # - name: redirectSchemeName + # scheme: https + # permanent: true + rateLimit: [] + # - name: rateLimitName + # average: 300 + # burst: 200 + redirectRegex: [] + # - name: redirectRegexName + # regex: putregexhere + # replacement: replacementurlhere + # permanent: false + ipWhiteList: [] + # - name: ipWhiteListName + # sourceRange: [] + # ipStrategy: + # depth: 2 + # excludedIPs: [] + +portalhook: + enabled: true diff --git a/core/traefik/10.0.45/questions.yaml b/core/traefik/10.0.45/questions.yaml new file mode 100644 index 00000000000..0fed912f3cb --- /dev/null +++ b/core/traefik/10.0.45/questions.yaml @@ -0,0 +1,2462 @@ +groups: + - name: "Container Image" + description: "Image to be used for container" + - name: "Controller" + description: "Configure workload deployment" + - name: "Container Configuration" + description: "additional container configuration" + - name: "App Configuration" + description: "App specific config options" + - name: "Networking and Services" + description: "Configure Network and Services for container" + - name: "Storage and Persistence" + description: "Persist and share data that is separate from the container" + - name: "Ingress" + description: "Ingress Configuration" + - name: "Security and Permissions" + description: "Configure security context and permissions" + - name: "Resources and Devices" + description: "Specify resources/devices to be allocated to workload" + - name: "Middlewares" + description: "Traefik Middlewares" + - name: "Metrics" + description: "Metrics" + - name: "Addons" + description: "Addon Configuration" + - name: "Advanced" + description: "Advanced Configuration" +portals: + web_portal: + protocols: + - "http" + host: + - "$kubernetes-resource_configmap_portal_host" + ports: + - "$kubernetes-resource_configmap_portal_port" + path: "/dashboard/" +questions: + - variable: portal + group: "Container Image" + label: "Configure Portal Button" + schema: + type: dict + hidden: true + attrs: + - variable: enabled + label: "Enable" + description: "enable the portal button" + schema: + hidden: true + editable: false + type: boolean + default: true + - variable: global + label: "global settings" + group: "Controller" + schema: + type: dict + hidden: true + attrs: + - variable: isSCALE + label: "flag this is SCALE" + schema: + type: boolean + default: true + hidden: true + - variable: controller + group: "Controller" + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: advanced + label: "Show Advanced Controller Settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: type + description: "Please specify type of workload to deploy" + label: "(Advanced) Controller Type" + schema: + type: string + default: "deployment" + required: true + enum: + - value: "deployment" + description: "Deployment" + - value: "statefulset" + description: "Statefulset" + - value: "daemonset" + description: "Daemonset" + - variable: replicas + description: "Number of desired pod replicas" + label: "Desired Replicas" + schema: + type: int + default: 1 + required: true + - variable: strategy + description: "Please specify type of workload to deploy" + label: "(Advanced) Update Strategy" + schema: + type: string + default: "RollingUpdate" + required: true + enum: + - value: "Recreate" + description: "Recreate: Kill existing pods before creating new ones" + - value: "RollingUpdate" + description: "RollingUpdate: Create new pods and then kill old ones" + - value: "OnDelete" + description: "(Legacy) OnDelete: ignore .spec.template changes" + - variable: expert + label: "Show Expert Configuration Options" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: extraArgs + label: "Extra Args" + schema: + type: list + default: [] + items: + - variable: arg + label: "arg" + schema: + type: string + - variable: labelsList + label: "Controller Labels" + schema: + type: list + default: [] + items: + - variable: labelItem + label: "Label" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + - variable: value + label: "Value" + schema: + type: string + - variable: annotationsList + label: " Controller Annotations" + schema: + type: list + default: [] + items: + - variable: annotationItem + label: "Label" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + - variable: value + label: "Value" + schema: + type: string + + - variable: env + group: "Container Configuration" + label: "Image Environment" + schema: + additional_attrs: true + type: dict + attrs: + - variable: TZ + label: "Timezone" + schema: + type: string + default: "Etc/UTC" + $ref: + - "definitions/timezone" + - variable: UMASK + label: "UMASK" + description: "Sets the UMASK env var for LinuxServer.io (compatible) containers" + schema: + type: string + default: "002" + + - variable: envList + label: "Image environment" + group: "Container Configuration" + schema: + type: list + default: [] + items: + - variable: envItem + label: "Environment Variable" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + - variable: value + label: "Value" + schema: + type: string + + - variable: expertpodconf + group: "Container Configuration" + label: "Show Expert Config" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: tty + label: "Enable TTY" + description: "Determines whether containers in a pod runs with TTY enabled. By default pod has it disabled." + group: "Workload Details" + schema: + type: boolean + default: false + - variable: stdin + label: "Enable STDIN" + description: "Determines whether containers in a pod runs with stdin enabled. By default pod has it disabled." + group: "Workload Details" + schema: + type: boolean + default: false + - variable: termination + group: "Container Configuration" + label: "Termination settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: gracePeriodSeconds + label: "Grace Period Seconds" + schema: + type: int + default: 10 + - variable: podLabelsList + group: "Container Configuration" + label: "Pod Labels" + schema: + type: list + default: [] + items: + - variable: podLabelItem + label: "Label" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + - variable: value + label: "Value" + schema: + type: string + + - variable: podAnnotationsList + group: "Container Configuration" + label: "Pod Annotations" + schema: + type: list + default: [] + items: + - variable: podAnnotationItem + label: "Label" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + - variable: value + label: "Value" + schema: + type: string + + - variable: pilot + label: "Traefik Pilot" + group: "App Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: token + label: "token" + schema: + type: string + default: "" + - variable: dashboard + label: "Pilot Dashboard" + schema: + type: boolean + default: false + + - variable: ingressClass + label: "ingressClass" + group: "App Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: isDefaultClass + label: "isDefaultClass" + schema: + type: boolean + default: false + + - variable: logs + label: "Logs" + group: "App Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: general + label: "General Logs" + schema: + additional_attrs: true + type: dict + attrs: + - variable: level + label: "Log Level" + schema: + type: string + default: "ERROR" + enum: + - value: "INFO" + description: "Info" + - value: "WARN" + description: "Warnings" + - value: "ERROR" + description: "Errors" + - value: "FATAL" + description: "Fatal Errors" + - value: "PANIC" + description: "Panics" + - value: "DEBUG" + description: "Debug" + - variable: access + label: "Access Logs" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: enabledFilters + label: "Enable Filters" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: filters + label: "Filters" + schema: + additional_attrs: true + type: dict + attrs: + - variable: statuscodes + label: "Status codes" + schema: + type: string + default: "200,300-302" + - variable: retryattempts + label: "retryattempts" + schema: + type: boolean + default: true + - variable: minduration + label: "minduration" + schema: + type: string + default: "10ms" + - variable: fields + label: "Fields" + schema: + additional_attrs: true + type: dict + attrs: + - variable: general + label: "General" + schema: + additional_attrs: true + type: dict + attrs: + - variable: defaultmode + label: "Default Mode" + schema: + type: string + default: "keep" + enum: + - value: "keep" + description: "Keep" + - value: "drop" + description: "Drop" + - variable: headers + label: "Headers" + schema: + additional_attrs: true + type: dict + attrs: + - variable: defaultmode + label: "Default Mode" + schema: + type: string + default: "drop" + enum: + - value: "keep" + description: "Keep" + - value: "drop" + description: "Drop" + + - variable: middlewares + label: "" + group: "Middlewares" + schema: + additional_attrs: true + type: dict + attrs: + - variable: basicAuth + label: "basicAuth" + schema: + type: list + default: [] + items: + - variable: basicAuthEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + default: "" + - variable: users + label: "Users" + schema: + type: list + default: [] + items: + - variable: usersEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: username + label: "Username" + schema: + type: string + required: true + default: "" + - variable: password + label: "Password" + schema: + type: string + required: true + default: "" + + - variable: forwardAuth + label: "forwardAuth" + schema: + type: list + default: [] + items: + - variable: basicAuthEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + default: "" + - variable: address + label: "Address" + schema: + type: string + required: true + default: "" + - variable: trustForwardHeader + label: "trustForwardHeader" + schema: + type: boolean + default: false + - variable: authResponseHeadersRegex + label: "authResponseHeadersRegex" + schema: + type: string + default: "" + - variable: authResponseHeaders + label: "authResponseHeaders" + schema: + type: list + default: [] + items: + - variable: authResponseHeadersEntry + label: "" + schema: + type: string + default: "" + - variable: authRequestHeaders + label: "authRequestHeaders" + schema: + type: list + default: [] + items: + - variable: authRequestHeadersEntry + label: "" + schema: + type: string + default: "" + - variable: chain + label: "chain" + schema: + type: list + default: [] + items: + - variable: chainEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + - variable: middlewares + label: "Middlewares to Chain" + schema: + type: list + default: [] + items: + - variable: name + label: "Name" + schema: + type: string + required: true + default: "" + + - variable: redirectScheme + label: "redirectScheme" + schema: + type: list + default: [] + items: + - variable: redirectSchemeEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + - variable: scheme + label: "Scheme" + schema: + type: string + required: true + default: "https" + enum: + - value: "https" + description: "https" + - value: "http" + description: "http" + - variable: permanent + label: "Permanent" + schema: + type: boolean + required: true + default: false + + - variable: rateLimit + label: "rateLimit" + schema: + type: list + default: [] + items: + - variable: rateLimitEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + - variable: average + label: "Average" + schema: + type: int + required: true + default: 300 + - variable: burst + label: "Burst" + schema: + type: int + required: true + default: 200 + - variable: redirectRegex + label: "redirectRegex" + schema: + type: list + default: [] + items: + - variable: redirectRegexEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + - variable: regex + label: "Regex" + schema: + type: string + required: true + default: "" + - variable: replacement + label: "Replacement" + schema: + type: string + required: true + default: "" + - variable: permanent + label: "Permanent" + schema: + type: boolean + required: true + default: false + + - variable: ipWhiteList + label: "ipWhiteList" + schema: + type: list + default: [] + items: + - variable: ipWhiteListEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + default: "" + - variable: sourceRange + label: "Source Range" + schema: + type: list + default: [] + items: + - variable: sourceRangeEntry + label: "" + schema: + type: string + required: true + default: "" + - variable: ipStrategy + label: "IP Strategy" + schema: + additional_attrs: true + type: dict + attrs: + - variable: depth + label: "Depth" + schema: + type: int + required: true + - variable: excludedIPs + label: "Excluded IPs" + schema: + type: list + default: [] + items: + - variable: excludedIPsEntry + label: "" + schema: + type: string + required: true + default: "" + + + - variable: service + group: "Networking and Services" + label: "Configure Service Entrypoint" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Service" + description: "The Primary service on which the healthcheck runs, often the webUI" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable the service" + schema: + type: boolean + default: true + hidden: true + - variable: type + label: "Service Type" + description: "ClusterIP's are only internally available, nodePorts expose the container to the host node System, Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: "Simple" + enum: + - value: "Simple" + description: "Simple" + - value: "ClusterIP" + description: "ClusterIP" + - value: "NodePort" + description: "NodePort (Advanced)" + - value: "LoadBalancer" + description: "LoadBalancer (Advanced)" + - variable: loadBalancerIP + label: "LoadBalancer IP" + description: "LoadBalancerIP" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: externalIPs + label: "External IP's" + description: "External IP's" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: list + default: [] + items: + - variable: externalIP + label: "External IP" + schema: + type: string + - variable: ipFamilyPolicy + label: "IP Family Policy" + description: "(Advanced) Specify the ip policy" + schema: + show_if: [["type", "!=", "Simple"]] + type: string + default: "SingleStack" + enum: + - value: "SingleStack" + description: "SingleStack" + - value: "PreferDualStack" + description: "PreferDualStack" + - value: "RequireDualStack" + description: "RequireDualStack" + - variable: ipFamilies + label: "(advanced) IP families" + description: "(advanced) The ip families that should be used" + schema: + show_if: [["type", "!=", "Simple"]] + type: list + default: [] + items: + - variable: ipFamily + label: "IP family" + schema: + type: string + - variable: ports + label: "Service's Port(s) Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Entrypoint Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: advanced + label: "Show Advanced settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: protocol + label: "Port Type" + schema: + type: string + default: "HTTP" + enum: + - value: HTTP + description: "HTTP" + - value: "HTTPS" + description: "HTTPS" + - value: TCP + description: "TCP" + - value: "UDP" + description: "UDP" + - variable: nodePort + label: "Node Port (Optional)" + description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" + schema: + type: int + min: 9000 + max: 65535 + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + default: 9000 + + - variable: port + label: "Entrypoints Port" + schema: + type: int + default: 9000 + required: true + - variable: tcp + label: "TCP Service" + description: "The tcp Entrypoint service" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable the service" + schema: + type: boolean + default: true + hidden: true + - variable: type + label: "Service Type" + description: "ClusterIP's are only internally available, nodePorts expose the container to the host node System, Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: "Simple" + enum: + - value: "Simple" + description: "Simple" + - value: "ClusterIP" + description: "ClusterIP" + - value: "NodePort" + description: "NodePort (Advanced)" + - value: "LoadBalancer" + description: "LoadBalancer (Advanced)" + - variable: loadBalancerIP + label: "LoadBalancer IP" + description: "LoadBalancerIP" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: externalIPs + label: "External IP's" + description: "External IP's" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: list + default: [] + items: + - variable: externalIP + label: "External IP" + schema: + type: string + - variable: ipFamilyPolicy + label: "IP Family Policy" + description: "(Advanced) Specify the ip policy" + schema: + show_if: [["type", "!=", "Simple"]] + type: string + default: "SingleStack" + enum: + - value: "SingleStack" + description: "SingleStack" + - value: "PreferDualStack" + description: "PreferDualStack" + - value: "RequireDualStack" + description: "RequireDualStack" + - variable: ipFamilies + label: "(advanced) IP families" + description: "(advanced) The ip families that should be used" + schema: + show_if: [["type", "!=", "Simple"]] + type: list + default: [] + items: + - variable: ipFamily + label: "IP family" + schema: + type: string + - variable: ports + label: "Service's Port(s) Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: web + label: "web Entrypoint Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Entrypoints Port" + schema: + type: int + default: 9080 + required: true + - variable: advanced + label: "Show Advanced settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: protocol + label: "Port Type" + schema: + type: string + default: "HTTP" + enum: + - value: HTTP + description: "HTTP" + - value: "HTTPS" + description: "HTTPS" + - value: TCP + description: "TCP" + - value: "UDP" + description: "UDP" + - variable: nodePort + label: "Node Port (Optional)" + description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" + schema: + type: int + min: 9000 + max: 65535 + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + - variable: redirectPort + label: "Redirect to Port" + schema: + type: int + - variable: redirectTo + label: "Redirect to Entrypoint" + schema: + type: string + default: "websecure" + - variable: websecure + label: "websecure Entrypoints Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "Entrypoints Port" + schema: + type: int + default: 9443 + required: true + - variable: advanced + label: "Show Advanced settings" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: protocol + label: "Port Type" + schema: + type: string + default: "HTTPS" + enum: + - value: HTTP + description: "HTTP" + - value: "HTTPS" + description: "HTTPS" + - value: TCP + description: "TCP" + - value: "UDP" + description: "UDP" + - variable: nodePort + label: "Node Port (Optional)" + description: "This port gets exposed to the node. Only considered when service type is NodePort, Simple or LoadBalancer" + schema: + type: int + min: 9000 + max: 65535 + - variable: targetPort + label: "Target Port" + description: "The internal(!) port on the container the Application runs on" + schema: + type: int + - variable: redirectPort + label: "Redirect to Port" + schema: + type: int + - variable: redirectTo + label: "Redirect to Entrypoint" + schema: + type: string + - variable: tls + label: "websecure Entrypoints Configuration" + schema: + type: dict + hidden: true + attrs: + - variable: enabled + label: "Enabled" + schema: + type: boolean + default: true + hidden: true + - variable: portsList + label: "Additional TCP Entrypoints" + schema: + type: list + default: [] + items: + - variable: portsListEntry + label: "Custom Entrypoints" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable the port" + schema: + type: boolean + default: true + hidden: true + - variable: name + label: "Entrypoints Name" + schema: + type: string + default: "" + - variable: protocol + label: "Entrypoints Type" + schema: + type: string + default: "TCP" + enum: + - value: HTTP + description: "HTTP" + - value: "HTTPS" + description: "HTTPS" + - value: TCP + description: "TCP" + - variable: port + label: "Port" + description: "This port exposes the container port on the service" + schema: + type: int + required: true + - variable: tls + label: "websecure Entrypoints Configuration" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enabled" + schema: + type: boolean + default: true + - variable: redirectPort + label: "Redirect to Port" + schema: + type: int + - variable: redirectTo + label: "Redirect to Entrypoint" + schema: + type: string + - variable: ingress + label: "" + group: "Ingress" + schema: + additional_attrs: true + type: dict + attrs: + - variable: main + label: "Main Ingress" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable Ingress" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: hosts + label: "Hosts" + schema: + type: list + default: [] + items: + - variable: hostEntry + label: "Host" + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: "HostName" + schema: + type: string + default: "" + required: true + - variable: paths + label: "Paths" + schema: + type: list + default: [] + items: + - variable: pathEntry + label: "Host" + schema: + additional_attrs: true + type: dict + attrs: + - variable: path + label: "path" + schema: + type: string + required: true + default: "/" + - variable: pathType + label: "pathType" + schema: + type: string + required: true + default: "Prefix" + + - variable: tls + label: "TLS-Settings" + schema: + type: list + default: [] + items: + - variable: tlsEntry + label: "Host" + schema: + additional_attrs: true + type: dict + attrs: + - variable: hosts + label: "Certificate Hosts" + schema: + type: list + default: [] + items: + - variable: host + label: "Host" + schema: + type: string + default: "" + required: true + - variable: scaleCert + label: "Select TrueNAS SCALE Certificate" + schema: + type: int + $ref: + - "definitions/certificate" + + - variable: entrypoint + label: "(Advanced) Traefik Entrypoint" + description: "Entrypoint used by Traefik when using Traefik as Ingress Provider" + schema: + type: string + default: "websecure" + required: true + - variable: middlewares + label: "Traefik Middlewares" + description: "Add previously created Traefik Middlewares to this Ingress" + schema: + type: list + default: [] + items: + - variable: name + label: "Name" + schema: + type: string + default: "" + required: true + + - variable: expert + label: "Show Expert Configuration Options" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: enableFixedMiddlewares + description: "These middlewares enforce a number of best practices." + label: "Enable Default Middlewares" + schema: + type: boolean + default: true + - variable: ingressClassName + label: "IngressClass Name" + schema: + type: string + default: "" + - variable: labelsList + label: "Labels" + schema: + type: list + default: [] + items: + - variable: labelItem + label: "Label" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + - variable: value + label: "Value" + schema: + type: string + - variable: annotationsList + label: "Annotations" + schema: + type: list + default: [] + items: + - variable: annotationItem + label: "Label" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + - variable: value + label: "Value" + schema: + type: string + + - variable: ingressList + label: "Add Manual Custom Ingresses" + group: "Ingress" + schema: + type: list + default: [] + items: + - variable: ingressListEntry + label: "Custom Ingress" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable Ingress" + schema: + type: boolean + default: true + hidden: true + - variable: name + label: "Name" + schema: + type: string + default: "" + - variable: ingressClassName + label: "IngressClass Name" + schema: + type: string + default: "" + - variable: labelsList + label: "Labels" + schema: + type: list + default: [] + items: + - variable: labelItem + label: "Label" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + - variable: value + label: "Value" + schema: + type: string + - variable: annotationsList + label: "Annotations" + schema: + type: list + default: [] + items: + - variable: annotationItem + label: "Label" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + - variable: value + label: "Value" + schema: + type: string + - variable: hosts + label: "Hosts" + schema: + type: list + default: [] + items: + - variable: hostEntry + label: "Host" + schema: + additional_attrs: true + type: dict + attrs: + - variable: host + label: "HostName" + schema: + type: string + default: "" + required: true + - variable: paths + label: "Paths" + schema: + type: list + default: [] + items: + - variable: pathEntry + label: "Host" + schema: + additional_attrs: true + type: dict + attrs: + - variable: path + label: "path" + schema: + type: string + required: true + default: "/" + - variable: pathType + label: "pathType" + schema: + type: string + required: true + default: "Prefix" + - variable: service + label: "Linked Service" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Service Name" + schema: + type: string + default: "" + - variable: port + label: "Service Port" + schema: + type: int + - variable: tls + label: "TLS-Settings" + schema: + type: list + default: [] + items: + - variable: tlsEntry + label: "Host" + schema: + additional_attrs: true + type: dict + attrs: + - variable: hosts + label: "Certificate Hosts" + schema: + type: list + default: [] + items: + - variable: host + label: "Host" + schema: + type: string + default: "" + required: true + - variable: scaleCert + label: "Select TrueNAS SCALE Certificate" + schema: + type: int + $ref: + - "definitions/certificate" + - variable: entrypoint + label: "Traefik Entrypoint" + description: "Entrypoint used by Traefik when using Traefik as Ingress Provider" + schema: + type: string + default: "websecure" + required: true + - variable: middlewares + label: "Traefik Middlewares" + description: "Add previously created Traefik Middlewares to this Ingress" + schema: + type: list + default: [] + items: + - variable: name + label: "Name" + schema: + type: string + default: "" + required: true + + - variable: advancedSecurity + label: "Show Advanced Security Settings" + group: "Security and Permissions" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: securityContext + label: "Security Context" + schema: + additional_attrs: true + type: dict + attrs: + - variable: privileged + label: "Privileged mode" + schema: + type: boolean + default: false + - variable: readOnlyRootFilesystem + label: "ReadOnly Root Filesystem" + schema: + type: boolean + default: true + - variable: allowPrivilegeEscalation + label: "Allow Privilege Escalation" + schema: + type: boolean + default: false + - variable: runAsNonRoot + label: "runAsNonRoot" + schema: + type: boolean + default: true + - variable: capabilities + label: "Capabilities" + schema: + additional_attrs: true + type: dict + attrs: + - variable: drop + label: "Drop Capability" + schema: + type: list + default: [] + items: + - variable: dropEntry + label: "" + schema: + type: string + - variable: add + label: "Add Capability" + schema: + type: list + default: [] + items: + - variable: addEntry + label: "" + schema: + type: string + + - variable: podSecurityContext + group: "Security and Permissions" + label: "Pod Security Context" + schema: + additional_attrs: true + type: dict + attrs: + - variable: runAsUser + label: "runAsUser" + description: "The UserID of the user running the application" + schema: + type: int + default: 568 + - variable: runAsGroup + label: "runAsGroup" + description: The groupID this App of the user running the application" + schema: + type: int + default: 568 + - variable: fsGroup + label: "fsGroup" + description: "The group that should own ALL storage." + schema: + type: int + default: 568 + - variable: fsGroupChangePolicy + label: "When should we take ownership?" + schema: + type: string + default: "OnRootMismatch" + enum: + - value: "OnRootMismatch" + description: "OnRootMismatch" + - value: "Always" + description: "Always" + - variable: supplementalGroups + label: "supplemental Groups" + schema: + type: list + default: [] + items: + - variable: supplementalGroupsEntry + label: "supplemental Group" + schema: + type: int + + + - variable: advancedresources + label: "Set Custom Resource Limits/Requests (Advanced)" + group: "Resources and Devices" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: resources + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: limits + label: "Advanced Limit Resource Consumption" + schema: + additional_attrs: true + type: dict + attrs: + - variable: cpu + label: "CPU" + description: "1000m means 1 hyperthread. Detailed info: https://truecharts.org/manual/indepth/validation/" + schema: + type: string + default: "4000m" + valid_chars: '^(?!^0(\.0|m|)$)([0-9]+)(\.[0-9]|m?)$' + - variable: memory + label: "RAM" + description: "1Gi means 1 Gibibyte RAM. Detailed info: https://truecharts.org/manual/indepth/validation/" + schema: + type: string + default: "8Gi" + valid_chars: '^(?!^0(e[0-9]|[EPTGMK]i?|)$)([0-9]+)(|[EPTGMK]i?|e[0-9]+)$' + - variable: requests + label: "Minimum Resources Required (request)" + schema: + additional_attrs: true + type: dict + attrs: + - variable: cpu + label: "CPU" + description: "1000m means 1 hyperthread. Detailed info: https://truecharts.org/manual/indepth/validation/" + schema: + type: string + default: "10m" + valid_chars: '^(?!^0(\.0|m|)$)([0-9]+)(\.[0-9]|m?)$' + - variable: memory + label: "RAM" + description: "1Gi means 1 Gibibyte RAM. Detailed info: https://truecharts.org/manual/indepth/validation/" + schema: + type: string + default: "50Mi" + valid_chars: '^(?!^0(e[0-9]|[EPTGMK]i?|)$)([0-9]+)(|[EPTGMK]i?|e[0-9]+)$' + + - variable: deviceList + label: "Mount USB devices" + group: "Resources and Devices" + schema: + type: list + default: [] + items: + - variable: deviceListEntry + label: "Device" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "Enable the storage" + schema: + type: boolean + default: true + - variable: type + label: "(Advanced) Type of Storage" + description: "Sets the persistence type" + schema: + type: string + default: "hostPath" + hidden: true + - variable: readOnly + label: "readOnly" + schema: + type: boolean + default: false + - variable: hostPath + label: "Host Device Path" + description: "Path to the device on the host system" + schema: + type: path + - variable: mountPath + label: "Container Device Path" + description: "Path inside the container the device is mounted" + schema: + type: string + default: "/dev/ttyACM0" + + # Specify GPU configuration + - variable: scaleGPU + label: "GPU Configuration" + group: "Resources and Devices" + schema: + type: dict + $ref: + - "definitions/gpuConfiguration" + attrs: [] + + - variable: autoscaling + group: "Advanced" + label: "(Advanced) Horizontal Pod Autoscaler" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "enabled" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: target + label: "Target" + description: "deployment name, defaults to main deployment" + schema: + type: string + default: "" + - variable: minReplicas + label: "Minimum Replicas" + schema: + type: int + default: 1 + - variable: maxReplicas + label: "Maximum Replicas" + schema: + type: int + default: 5 + - variable: targetCPUUtilizationPercentage + label: "Target CPU Utilization Percentage" + schema: + type: int + default: 80 + - variable: targetMemoryUtilizationPercentage + label: "Target Memory Utilization Percentage" + schema: + type: int + default: 80 + - variable: networkPolicy + group: "Advanced" + label: "(Advanced) Network Policy" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "enabled" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: policyType + label: "Policy Type" + schema: + type: string + default: "" + enum: + - value: "" + description: "Default" + - value: "ingress" + description: "Ingress" + - value: "egress" + description: "Egress" + - value: "ingress-egress" + description: "Ingress and Egress" + - variable: egress + label: "Egress" + schema: + type: list + default: [] + items: + - variable: egressEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: to + label: "To" + schema: + type: list + default: [] + items: + - variable: toEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: ipBlock + label: "ipBlock" + schema: + additional_attrs: true + type: dict + attrs: + - variable: cidr + label: "cidr" + schema: + type: string + default: "" + - variable: except + label: "except" + schema: + type: list + default: [] + items: + - variable: exceptint + label: "" + schema: + type: int + - variable: namespaceSelector + label: "namespaceSelector" + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: "matchExpressions" + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: "Key" + schema: + type: string + - variable: operator + label: "operator" + schema: + type: string + default: "TCP" + enum: + - value: "In" + description: "In" + - value: "NotIn" + description: "NotIn" + - value: "Exists " + description: "Exists " + - value: "DoesNotExist " + description: "DoesNotExist " + - variable: values + label: "values" + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: podSelector + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: "matchExpressions" + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: "Key" + schema: + type: string + - variable: operator + label: "operator" + schema: + type: string + default: "TCP" + enum: + - value: "In" + description: "In" + - value: "NotIn" + description: "NotIn" + - value: "Exists " + description: "Exists " + - value: "DoesNotExist " + description: "DoesNotExist " + - variable: values + label: "values" + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: ports + label: "Ports" + schema: + type: list + default: [] + items: + - variable: portsEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "port" + schema: + type: int + - variable: endPort + label: "port" + schema: + type: int + - variable: protocol + label: "Protocol" + schema: + type: string + default: "TCP" + enum: + - value: "TCP" + description: "TCP" + - value: "UDP" + description: "UDP" + - value: "SCTP" + description: "SCTP" + - variable: ingress + label: "Ingress" + schema: + type: list + default: [] + items: + - variable: ingressEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: from + label: "From" + schema: + type: list + default: [] + items: + - variable: fromEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: ipBlock + label: "ipBlock" + schema: + additional_attrs: true + type: dict + attrs: + - variable: cidr + label: "cidr" + schema: + type: string + default: "" + - variable: except + label: "except" + schema: + type: list + default: [] + items: + - variable: exceptint + label: "" + schema: + type: int + - variable: namespaceSelector + label: "namespaceSelector" + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: "matchExpressions" + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: "Key" + schema: + type: string + - variable: operator + label: "operator" + schema: + type: string + default: "TCP" + enum: + - value: "In" + description: "In" + - value: "NotIn" + description: "NotIn" + - value: "Exists " + description: "Exists " + - value: "DoesNotExist " + description: "DoesNotExist " + - variable: values + label: "values" + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: podSelector + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: matchExpressions + label: "matchExpressions" + schema: + type: list + default: [] + items: + - variable: expressionEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: key + label: "Key" + schema: + type: string + - variable: operator + label: "operator" + schema: + type: string + default: "TCP" + enum: + - value: "In" + description: "In" + - value: "NotIn" + description: "NotIn" + - value: "Exists " + description: "Exists " + - value: "DoesNotExist " + description: "DoesNotExist " + - variable: values + label: "values" + schema: + type: list + default: [] + items: + - variable: value + label: "" + schema: + type: string + - variable: ports + label: "Ports" + schema: + type: list + default: [] + items: + - variable: portsEntry + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: port + label: "port" + schema: + type: int + - variable: endPort + label: "port" + schema: + type: int + - variable: protocol + label: "Protocol" + schema: + type: string + default: "TCP" + enum: + - value: "TCP" + description: "TCP" + - value: "UDP" + description: "UDP" + - value: "SCTP" + description: "SCTP" + + + - variable: addons + group: "Addons" + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: vpn + label: "VPN" + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: "Type" + schema: + type: string + default: "disabled" + enum: + - value: "disabled" + description: "disabled" + - value: "openvpn" + description: "OpenVPN" + - value: "wireguard" + description: "Wireguard" + - variable: openvpn + label: "OpenVPN Settings" + schema: + type: dict + show_if: [["type", "=", "openvpn"]] + attrs: + - variable: username + label: "authentication username" + description: "authentication username, optional" + schema: + type: string + default: "" + - variable: password + label: "authentication password" + description: "authentication credentials" + schema: + type: string + default: "" + required: true + - variable: killSwitch + label: "Enable killswitch" + schema: + type: boolean + show_if: [["type", "!=", "disabled"]] + default: true + - variable: excludedNetworks_IPv4 + label: "Killswitch Excluded IPv4 networks" + description: "list of killswitch excluded ipv4 addresses" + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: networkv4 + label: "IPv4 Network" + schema: + type: string + required: true + - variable: excludedNetworks_IPv6 + label: "Killswitch Excluded IPv6 networks" + description: "list of killswitch excluded ipv4 addresses" + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: networkv6 + label: "IPv6 Network" + schema: + type: string + required: true + + - variable: configFile + label: "VPN Config File Location" + schema: + type: dict + show_if: [["type", "!=", "disabled"]] + attrs: + - variable: enabled + label: "enabled" + schema: + type: boolean + default: true + hidden: true + - variable: type + label: "type" + schema: + type: string + default: "hostPath" + hidden: true + - variable: hostPathType + label: "hostPathType" + schema: + type: string + default: "File" + hidden: true + - variable: noMount + label: "noMount" + schema: + type: boolean + default: true + hidden: true + - variable: hostPath + label: "Full path to file" + description: "path to your local VPN config file for example: /mnt/tank/vpn.conf or /mnt/tank/vpn.ovpn" + schema: + type: string + default: "" + required: true + - variable: envList + label: "VPN environment Variables" + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: "Environment Variable" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + - variable: value + label: "Value" + schema: + type: string + required: true + + - variable: codeserver + label: "Codeserver" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "enabled" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: git + label: "Git Settings" + schema: + additional_attrs: true + type: dict + attrs: + - variable: deployKey + description: "Raw SSH private key" + label: "deployKey" + schema: + type: string + - variable: deployKeyBase64 + description: "Base64-encoded SSH private key. When both variables are set, the raw SSH key takes precedence" + label: "deployKeyBase64" + schema: + type: string + - variable: service + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: type + label: "Service Type" + description: "ClusterIP's are only internally available, nodePorts expose the container to the host node System, Loadbalancer exposes the service using the system loadbalancer" + schema: + type: string + default: "NodePort" + enum: + - value: "NodePort" + description: "NodePort" + - value: "ClusterIP" + description: "ClusterIP" + - value: "LoadBalancer" + description: "LoadBalancer" + - variable: loadBalancerIP + label: "LoadBalancer IP" + description: "LoadBalancerIP" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: string + default: "" + - variable: externalIPs + label: "External IP's" + description: "External IP's" + schema: + show_if: [["type", "=", "LoadBalancer"]] + type: list + default: [] + items: + - variable: externalIP + label: "External IP" + schema: + type: string + - variable: ports + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: codeserver + label: "" + schema: + additional_attrs: true + type: dict + attrs: + - variable: nodePort + description: "leave empty to disable" + label: "nodePort" + schema: + type: int + default: 36107 + - variable: envList + label: "Codeserver environment Variables" + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: "Environment Variable" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + - variable: value + label: "Value" + schema: + type: string + required: true + + + - variable: promtail + label: "Promtail" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "enabled" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: loki + label: "Loki URL" + schema: + type: string + required: true + - variable: logs + label: "Log Paths" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + - variable: path + label: "Path" + schema: + type: string + required: true + - variable: args + label: "Promtail ecommand line arguments" + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: arg + label: "Arg" + schema: + type: string + required: true + - variable: envList + label: "Promtail environment Variables" + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: "Environment Variable" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + - variable: value + label: "Value" + schema: + type: string + required: true + + + + + - variable: netshoot + label: "Netshoot" + schema: + additional_attrs: true + type: dict + attrs: + - variable: enabled + label: "enabled" + schema: + type: boolean + default: false + show_subquestions_if: true + subquestions: + - variable: envList + label: "Netshoot environment Variables" + schema: + type: list + show_if: [["type", "!=", "disabled"]] + default: [] + items: + - variable: envItem + label: "Environment Variable" + schema: + additional_attrs: true + type: dict + attrs: + - variable: name + label: "Name" + schema: + type: string + required: true + - variable: value + label: "Value" + schema: + type: string + required: true diff --git a/core/traefik/10.0.45/security.md b/core/traefik/10.0.45/security.md new file mode 100644 index 00000000000..48e09d3d3df --- /dev/null +++ b/core/traefik/10.0.45/security.md @@ -0,0 +1,108 @@ +--- +hide: + - toc +--- + +# Security Overview + + + +## Helm-Chart + +##### Scan Results + +#### Chart Object: traefik/templates/common.yaml + + + +| Type | Misconfiguration ID | Check | Severity | Explaination | Links | +|:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| +| Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| +| Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| +| Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| +| Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| +| Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| +| Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-traefik' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| + + +| No Misconfigurations found | +|:---------------------------------| + + + + +| No Misconfigurations found | +|:---------------------------------| + + + + +| No Misconfigurations found | +|:---------------------------------| + + + +## Containers + +##### Detected Containers + + tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c + tccr.io/truecharts/traefik:v2.5.6@sha256:7388e9ce030fdb113e5bdc737aad201833e6c79c0540269d82c4322047604cb4 + +##### Scan Results + + +#### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) + + +**alpine** + + +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| busybox | CVE-2021-42378 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42378
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42379 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42379
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42380 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42380
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42381 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42381
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42382 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42382
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42383 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| +| busybox | CVE-2021-42384 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42384
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42385 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42385
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42386 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42386
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42374 | MEDIUM | 1.33.1-r3 | 1.33.1-r4 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42374
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| +| ssl_client | CVE-2021-42378 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42378
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42379 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42379
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42380 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42380
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42381 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42381
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42382 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42382
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42383 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| +| ssl_client | CVE-2021-42384 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42384
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42385 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42385
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42386 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42386
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42374 | MEDIUM | 1.33.1-r3 | 1.33.1-r4 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42374
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| + + +#### Container: tccr.io/truecharts/traefik:v2.5.6@sha256:7388e9ce030fdb113e5bdc737aad201833e6c79c0540269d82c4322047604cb4 (alpine 3.14.3) + + +**alpine** + + +| No Vulnerabilities found | +|:---------------------------------| + + + +**gobinary** + + +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| github.com/hashicorp/consul | CVE-2021-41805 | HIGH | v1.10.3 | 1.8.17, 1.9.11, 1.10.4 |
Expand...https://discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871
https://nvd.nist.gov/vuln/detail/CVE-2021-41805
https://security.netapp.com/advisory/ntap-20211229-0007/
https://www.hashicorp.com/blog/category/consul
| +| github.com/opencontainers/image-spec | GMS-2021-101 | UNKNOWN | v1.0.1 | 1.0.2 |
Expand...https://github.com/advisories/GHSA-77vh-xpmg-72qh
https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m
https://github.com/opencontainers/image-spec/commit/693428a734f5bab1a84bd2f990d92ef1111cd60c
https://github.com/opencontainers/image-spec/releases/tag/v1.0.2
https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| + diff --git a/core/traefik/10.0.45/templates/_args.tpl b/core/traefik/10.0.45/templates/_args.tpl new file mode 100644 index 00000000000..fd8f62c1442 --- /dev/null +++ b/core/traefik/10.0.45/templates/_args.tpl @@ -0,0 +1,146 @@ +{{/* Define the args */}} +{{- define "traefik.args" -}} +args: + {{/* merge all ports */}} + {{- $ports := dict }} + {{- range $.Values.service }} + {{- range $name, $value := .ports }} + {{- $_ := set $ports $name $value }} + {{- end }} + {{- end }} + {{/* start of actual arguments */}} + {{- with .Values.globalArguments }} + {{- range . }} + - {{ . | quote }} + {{- end }} + {{- end }} + {{- range $name, $config := $ports }} + {{- if $config }} + {{- if or ( eq $config.protocol "HTTP" ) ( eq $config.protocol "HTTPS" ) ( eq $config.protocol "TCP" ) }} + {{- $_ := set $config "protocol" "TCP" }} + {{- end }} + - "--entryPoints.{{$name}}.address=:{{ $config.port }}/{{ default "tcp" $config.protocol | lower }}" + {{- end }} + {{- end }} + - "--api.dashboard=true" + - "--ping=true" + {{- if .Values.metrics }} + {{- if .Values.metrics.datadog }} + - "--metrics.datadog=true" + - "--metrics.datadog.address={{ .Values.metrics.datadog.address }}" + {{- end }} + {{- if .Values.metrics.influxdb }} + - "--metrics.influxdb=true" + - "--metrics.influxdb.address={{ .Values.metrics.influxdb.address }}" + - "--metrics.influxdb.protocol={{ .Values.metrics.influxdb.protocol }}" + {{- end }} + {{- if .Values.metrics.prometheus }} + - "--metrics.prometheus=true" + - "--metrics.prometheus.entrypoint={{ .Values.metrics.prometheus.entryPoint }}" + {{- end }} + {{- if .Values.metrics.statsd }} + - "--metrics.statsd=true" + - "--metrics.statsd.address={{ .Values.metrics.statsd.address }}" + {{- end }} + {{- end }} + {{- if .Values.providers.kubernetesCRD.enabled }} + - "--providers.kubernetescrd" + {{- end }} + {{- if .Values.providers.kubernetesIngress.enabled }} + - "--providers.kubernetesingress" + {{- if .Values.providers.kubernetesIngress.publishedService.enabled }} + - "--providers.kubernetesingress.ingressendpoint.publishedservice={{ template "providers.kubernetesIngress.publishedServicePath" . }}" + {{- end }} + {{- if .Values.providers.kubernetesIngress.labelSelector }} + - "--providers.kubernetesingress.labelSelector={{ .Values.providers.kubernetesIngress.labelSelector }}" + {{- end }} + {{- end }} + {{- if and .Values.rbac.enabled .Values.rbac.namespaced }} + {{- if .Values.providers.kubernetesCRD.enabled }} + - "--providers.kubernetescrd.namespaces={{ template "providers.kubernetesCRD.namespaces" . }}" + {{- end }} + {{- if .Values.providers.kubernetesIngress.enabled }} + - "--providers.kubernetesingress.namespaces={{ template "providers.kubernetesIngress.namespaces" . }}" + {{- end }} + {{- end }} + {{- range $entrypoint, $config := $ports }} + {{- if $config.redirectTo }} + {{- $toPort := index $ports $config.redirectTo }} + - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.to=:{{ $toPort.port }}" + - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.scheme=https" + {{- else if $config.redirectPort }} + {{ if gt $config.redirectPort 0.0 }} + - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.to=:{{ $config.redirectPort }}" + - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.scheme=https" + {{- end }} + {{- end }} + {{- if or ( $config.tls ) ( eq $config.protocol "HTTPS" ) }} + {{- if or ( $config.tls.enabled ) ( eq $config.protocol "HTTPS" ) }} + - "--entrypoints.{{ $entrypoint }}.http.tls=true" + {{- if $config.tls.options }} + - "--entrypoints.{{ $entrypoint }}.http.tls.options={{ $config.tls.options }}" + {{- end }} + {{- if $config.tls.certResolver }} + - "--entrypoints.{{ $entrypoint }}.http.tls.certResolver={{ $config.tls.certResolver }}" + {{- end }} + {{- if $config.tls.domains }} + {{- range $index, $domain := $config.tls.domains }} + {{- if $domain.main }} + - "--entrypoints.{{ $entrypoint }}.http.tls.domains[{{ $index }}].main={{ $domain.main }}" + {{- end }} + {{- if $domain.sans }} + - "--entrypoints.{{ $entrypoint }}.http.tls.domains[{{ $index }}].sans={{ join "," $domain.sans }}" + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- with .Values.logs }} + {{- if .general.format }} + - "--log.format={{ .general.format }}" + {{- end }} + {{- if ne .general.level "ERROR" }} + - "--log.level={{ .general.level | upper }}" + {{- end }} + {{- if .access.enabled }} + - "--accesslog=true" + {{- if .access.format }} + - "--accesslog.format={{ .access.format }}" + {{- end }} + {{- if .access.bufferingsize }} + - "--accesslog.bufferingsize={{ .access.bufferingsize }}" + {{- end }} + {{- if .access.filters }} + {{- if .access.filters.statuscodes }} + - "--accesslog.filters.statuscodes={{ .access.filters.statuscodes }}" + {{- end }} + {{- if .access.filters.retryattempts }} + - "--accesslog.filters.retryattempts" + {{- end }} + {{- if .access.filters.minduration }} + - "--accesslog.filters.minduration={{ .access.filters.minduration }}" + {{- end }} + {{- end }} + - "--accesslog.fields.defaultmode={{ .access.fields.general.defaultmode }}" + {{- range $fieldname, $fieldaction := .access.fields.general.names }} + - "--accesslog.fields.names.{{ $fieldname }}={{ $fieldaction }}" + {{- end }} + - "--accesslog.fields.headers.defaultmode={{ .access.fields.headers.defaultmode }}" + {{- range $fieldname, $fieldaction := .access.fields.headers.names }} + - "--accesslog.fields.headers.names.{{ $fieldname }}={{ $fieldaction }}" + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.pilot.enabled }} + - "--pilot.token={{ .Values.pilot.token }}" + {{- end }} + {{- if hasKey .Values.pilot "dashboard" }} + - "--pilot.dashboard={{ .Values.pilot.dashboard }}" + {{- end }} + {{- with .Values.additionalArguments }} + {{- range . }} + - {{ . | quote }} + {{- end }} + {{- end }} +{{- end -}} diff --git a/core/traefik/10.0.45/templates/_helpers.tpl b/core/traefik/10.0.45/templates/_helpers.tpl new file mode 100644 index 00000000000..8c6c4ac96bc --- /dev/null +++ b/core/traefik/10.0.45/templates/_helpers.tpl @@ -0,0 +1,22 @@ +{{/* +Construct the path for the providers.kubernetesingress.ingressendpoint.publishedservice. +By convention this will simply use the / to match the name of the +service generated. +Users can provide an override for an explicit service they want bound via `.Values.providers.kubernetesIngress.publishedService.pathOverride` +*/}} +{{- define "providers.kubernetesIngress.publishedServicePath" -}} +{{- $fullName := include "common.names.fullname" . -}} +{{- $defServiceName := printf "%s/%s-tcp" .Release.Namespace $fullName -}} +{{- $servicePath := default $defServiceName .Values.providers.kubernetesIngress.publishedService.pathOverride }} +{{- print $servicePath | trimSuffix "-" -}} +{{- end -}} + +{{/* +Construct a comma-separated list of whitelisted namespaces +*/}} +{{- define "providers.kubernetesIngress.namespaces" -}} +{{- default .Release.Namespace (join "," .Values.providers.kubernetesIngress.namespaces) }} +{{- end -}} +{{- define "providers.kubernetesCRD.namespaces" -}} +{{- default .Release.Namespace (join "," .Values.providers.kubernetesCRD.namespaces) }} +{{- end -}} diff --git a/core/traefik/10.0.45/templates/_ingressclass.tpl b/core/traefik/10.0.45/templates/_ingressclass.tpl new file mode 100644 index 00000000000..27f8467fc9e --- /dev/null +++ b/core/traefik/10.0.45/templates/_ingressclass.tpl @@ -0,0 +1,24 @@ +{{/* Define the ingressClass */}} +{{- define "traefik.ingressClass" -}} +{{- if .Values.ingressClass.enabled }} + {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1/IngressClass" }} +apiVersion: networking.k8s.io/v1 + {{- else if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/IngressClass" }} +apiVersion: networking.k8s.io/v1beta1 + {{- else if or (eq .Values.ingressClass.fallbackApiVersion "v1beta1") (eq .Values.ingressClass.fallbackApiVersion "v1") }} +apiVersion: {{ printf "networking.k8s.io/%s" .Values.ingressClass.fallbackApiVersion }} + {{- else }} + {{- fail "\n\n ERROR: You must have at least networking.k8s.io/v1beta1 to use ingressClass" }} + {{- end }} +--- +kind: IngressClass +metadata: + annotations: + ingressclass.kubernetes.io/is-default-class: {{ .Values.ingressClass.isDefaultClass | quote }} + labels: + {{- include "common.labels" . | nindent 4 }} + name: {{ .Release.Name }} +spec: + controller: traefik.io/ingress-controller +{{- end }} +{{- end }} diff --git a/core/traefik/10.0.45/templates/_ingressroute.tpl b/core/traefik/10.0.45/templates/_ingressroute.tpl new file mode 100644 index 00000000000..f848bc108fc --- /dev/null +++ b/core/traefik/10.0.45/templates/_ingressroute.tpl @@ -0,0 +1,25 @@ +{{/* Define the ingressRoute */}} +{{- define "traefik.ingressRoute" -}} +{{- if .Values.ingressRoute.dashboard.enabled }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: {{ include "common.names.fullname" . }}-dashboard + annotations: + {{- with .Values.ingressRoute.dashboard.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "common.labels" . | nindent 4 }} +spec: + entryPoints: + - main + routes: + - match: PathPrefix(`/dashboard`) || PathPrefix(`/api`) + kind: Rule + services: + - name: api@internal + kind: TraefikService +{{- end -}} +{{- end -}} diff --git a/core/traefik/10.0.45/templates/_portalhook.tpl b/core/traefik/10.0.45/templates/_portalhook.tpl new file mode 100644 index 00000000000..e3586c5d4e9 --- /dev/null +++ b/core/traefik/10.0.45/templates/_portalhook.tpl @@ -0,0 +1,26 @@ +{{/* Define the portalHook */}} +{{- define "traefik.portalhook" -}} +{{- if .Values.portalhook.enabled }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +--- + +apiVersion: v1 +kind: ConfigMap +metadata: + name: portalhook + namespace: {{ $namespace }} +data: + {{- $ports := dict }} + {{- range $.Values.service }} + {{- range $name, $value := .ports }} + {{- $_ := set $ports $name $value }} + {{- end }} + {{- end }} + {{- range $name, $value := $ports }} + {{ $name }}: {{ $value.port | quote }} + {{- end }} +{{- end }} +{{- end -}} diff --git a/core/traefik/10.0.45/templates/_tlsoptions.tpl b/core/traefik/10.0.45/templates/_tlsoptions.tpl new file mode 100644 index 00000000000..3e5aad3bee9 --- /dev/null +++ b/core/traefik/10.0.45/templates/_tlsoptions.tpl @@ -0,0 +1,12 @@ +{{/* Define the tlsOptions */}} +{{- define "traefik.tlsOptions" -}} +{{- range $name, $config := .Values.tlsOptions }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: TLSOption +metadata: + name: {{ $name }} +spec: + {{- toYaml $config | nindent 2 }} +{{- end }} +{{- end -}} diff --git a/core/traefik/10.0.45/templates/common.yaml b/core/traefik/10.0.45/templates/common.yaml new file mode 100644 index 00000000000..c87583e25bd --- /dev/null +++ b/core/traefik/10.0.45/templates/common.yaml @@ -0,0 +1,24 @@ +{{/* Make sure all variables are set properly */}} +{{- include "common.setup" . }} + +{{- if .Values.metrics }} +{{- if .Values.metrics.prometheus }} +{{- $_ := set .Values.podAnnotations "prometheus.io/scrape" "true" -}} +{{- $_ := set .Values.podAnnotations "prometheus.io/path" "/metrics" -}} +{{- $_ := set .Values.podAnnotations "prometheus.io/scrape" "9180" -}} +{{- end }} +{{- end }} + +{{- $newArgs := (include "traefik.args" . | fromYaml) }} +{{- $_ := set .Values "newArgs" $newArgs -}} +{{- $mergedargs := concat .Values.args .Values.newArgs.args }} +{{- $_ := set .Values "args" $mergedargs -}} + +{{- include "traefik.portalhook" . }} +{{- include "traefik.tlsOptions" . }} +{{- include "traefik.ingressRoute" . }} +{{- include "traefik.ingressClass" . }} + + +{{/* Render the templates */}} +{{ include "common.postSetup" . }} diff --git a/core/traefik/10.0.45/templates/middlewares/basic-middleware.yaml b/core/traefik/10.0.45/templates/middlewares/basic-middleware.yaml new file mode 100644 index 00000000000..fca94384953 --- /dev/null +++ b/core/traefik/10.0.45/templates/middlewares/basic-middleware.yaml @@ -0,0 +1,65 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: compress + namespace: {{ $namespace }} +spec: + compress: {} +--- +# Here, an average of 300 requests per second is allowed. +# In addition, a burst of 200 requests is allowed. +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: basic-ratelimit + namespace: {{ $namespace }} +spec: + rateLimit: + average: 300 + burst: 200 +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: basic-secure-headers + namespace: {{ $namespace }} +spec: + headers: + accessControlAllowMethods: + - GET + - OPTIONS + - HEAD + - PUT + accessControlMaxAge: 100 + sslRedirect: true + stsSeconds: 63072000 + # stsIncludeSubdomains: false + # stsPreload: false + forceSTSHeader: true + contentTypeNosniff: true + browserXssFilter: true + sslForceHost: true + referrerPolicy: same-origin + customRequestHeaders: + X-Forwarded-Proto: "https" + customResponseHeaders: + X-Robots-Tag: 'none' + server: '' +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: chain-basic + namespace: {{ $namespace }} +spec: + chain: + middlewares: + - name: basic-ratelimit + - name: basic-secure-headers + - name: compress diff --git a/core/traefik/10.0.45/templates/middlewares/basicauth.yaml b/core/traefik/10.0.45/templates/middlewares/basicauth.yaml new file mode 100644 index 00000000000..ccb541742f0 --- /dev/null +++ b/core/traefik/10.0.45/templates/middlewares/basicauth.yaml @@ -0,0 +1,34 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.basicAuth }} +--- +{{- $users := list }} +{{ range $index, $userdata := $middlewareData.users }} + {{ $users = append $users ( htpasswd $userdata.username $userdata.password ) }} +{{ end }} + +apiVersion: v1 +kind: Secret +metadata: + name: {{printf "%v-%v" $middlewareData.name "secret" }} + namespace: {{ $namespace }} +type: Opaque +stringData: + users: | + {{- range $index, $user := $users }} + {{ printf "%s" $user }} + {{- end }} +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + basicAuth: + secret: {{printf "%v-%v" $middlewareData.name "secret" }} +{{ end }} diff --git a/core/traefik/10.0.45/templates/middlewares/chain.yaml b/core/traefik/10.0.45/templates/middlewares/chain.yaml new file mode 100644 index 00000000000..e22eb312207 --- /dev/null +++ b/core/traefik/10.0.45/templates/middlewares/chain.yaml @@ -0,0 +1,21 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.chain }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + chain: + middlewares: + {{ range $index, $chainData := . }} + - name: {{ printf "%v-%v@%v" $namespace $chainData.name "kubernetescrd" }} + {{ end }} +{{ end }} diff --git a/core/traefik/10.0.45/templates/middlewares/forwardauth.yaml b/core/traefik/10.0.45/templates/middlewares/forwardauth.yaml new file mode 100644 index 00000000000..7a3e32fdbf7 --- /dev/null +++ b/core/traefik/10.0.45/templates/middlewares/forwardauth.yaml @@ -0,0 +1,30 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.forwardAuth }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + forwardAuth: + address: {{ $middlewareData.address }} + {{- with $middlewareData.authResponseHeaders }} + authResponseHeaders: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $middlewareData.authRequestHeaders }} + authRequestHeaders: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if $middlewareData.authResponseHeadersRegex }} + authResponseHeadersRegex: {{ $middlewareData.authResponseHeadersRegex }} + {{- end }} + {{- if $middlewareData.trustForwardHeader }} + trustForwardHeader: true + {{- end }} +{{ end }} diff --git a/core/traefik/10.0.45/templates/middlewares/ipwhitelist.yaml b/core/traefik/10.0.45/templates/middlewares/ipwhitelist.yaml new file mode 100644 index 00000000000..1179245017e --- /dev/null +++ b/core/traefik/10.0.45/templates/middlewares/ipwhitelist.yaml @@ -0,0 +1,33 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.ipWhiteList }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + ipWhiteList: + sourceRange: + {{- range $middlewareData.sourceRange }} + - {{ . }} + {{- end }} + {{- if $middlewareData.ipStrategy }} + ipStrategy: + {{- if $middlewareData.ipStrategy.depth }} + depth: {{ $middlewareData.ipStrategy.depth }} + {{- end }} + {{- if $middlewareData.ipStrategy.excludedIPs }} + excludedIPs: + {{- range $middlewareData.ipStrategy.excludedIPs }} + - {{ . }} + {{- end }} + {{- end }} + {{- end }} +{{ end }} diff --git a/core/traefik/10.0.45/templates/middlewares/ratelimit.yaml b/core/traefik/10.0.45/templates/middlewares/ratelimit.yaml new file mode 100644 index 00000000000..144b9d8bf38 --- /dev/null +++ b/core/traefik/10.0.45/templates/middlewares/ratelimit.yaml @@ -0,0 +1,19 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.rateLimit }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + rateLimit: + average: {{ $middlewareData.average }} + burst: {{ $middlewareData.burst }} +{{ end }} diff --git a/core/traefik/10.0.45/templates/middlewares/redirectScheme.yaml b/core/traefik/10.0.45/templates/middlewares/redirectScheme.yaml new file mode 100644 index 00000000000..f2413f84e19 --- /dev/null +++ b/core/traefik/10.0.45/templates/middlewares/redirectScheme.yaml @@ -0,0 +1,19 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.redirectScheme }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + redirectScheme: + scheme: {{ $middlewareData.scheme }} + permanent: {{ $middlewareData.permanent }} +{{ end }} diff --git a/core/traefik/10.0.45/templates/middlewares/redirectregex.yaml b/core/traefik/10.0.45/templates/middlewares/redirectregex.yaml new file mode 100644 index 00000000000..46e3e724dd6 --- /dev/null +++ b/core/traefik/10.0.45/templates/middlewares/redirectregex.yaml @@ -0,0 +1,20 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.redirectRegex }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + redirectRegex: + regex: {{ $middlewareData.regex | quote }} + replacement: {{ $middlewareData.replacement | quote }} + permanent: {{ $middlewareData.permanent }} +{{ end }} diff --git a/core/traefik/10.0.45/templates/middlewares/tc-nextcloud.yaml b/core/traefik/10.0.45/templates/middlewares/tc-nextcloud.yaml new file mode 100644 index 00000000000..6a3019d56c5 --- /dev/null +++ b/core/traefik/10.0.45/templates/middlewares/tc-nextcloud.yaml @@ -0,0 +1,25 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-nextcloud-redirectregex-dav + namespace: {{ $namespace }} +spec: + redirectRegex: + regex: "https://(.*)/.well-known/(card|cal)dav" + replacement: "https://${1}/remote.php/dav/" +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-nextcloud-chain + namespace: {{ $namespace }} +spec: + chain: + middlewares: + - name: tc-nextcloud-redirectregex-dav diff --git a/core/traefik/10.0.45/templates/middlewares/tc-synapse.yaml b/core/traefik/10.0.45/templates/middlewares/tc-synapse.yaml new file mode 100644 index 00000000000..183dea0f761 --- /dev/null +++ b/core/traefik/10.0.45/templates/middlewares/tc-synapse.yaml @@ -0,0 +1,25 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-synapse-headers + namespace: {{ $namespace }} +spec: + headers: + accesscontrolalloworigin: '*' + +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-synapse-chain + namespace: {{ $namespace }} +spec: + chain: + middlewares: + - name: tc-synapse-headers diff --git a/incubator/synapse/0.0.8/values.yaml b/core/traefik/10.0.45/values.yaml similarity index 100% rename from incubator/synapse/0.0.8/values.yaml rename to core/traefik/10.0.45/values.yaml diff --git a/incubator/synapse/0.0.8/CHANGELOG.md b/incubator/synapse/0.0.9/CHANGELOG.md similarity index 91% rename from incubator/synapse/0.0.8/CHANGELOG.md rename to incubator/synapse/0.0.9/CHANGELOG.md index 82b5347dc8e..972ec2e7d4e 100644 --- a/incubator/synapse/0.0.8/CHANGELOG.md +++ b/incubator/synapse/0.0.9/CHANGELOG.md @@ -1,6 +1,11 @@ # Changelog
+ +### [synapse-0.0.9](https://github.com/truecharts/apps/compare/synapse-0.0.8...synapse-0.0.9) (2022-01-31) + + + ### [synapse-0.0.8](https://github.com/truecharts/apps/compare/synapse-0.0.7...synapse-0.0.8) (2022-01-31) diff --git a/incubator/synapse/0.0.9/CONFIG.md b/incubator/synapse/0.0.9/CONFIG.md new file mode 100644 index 00000000000..fc9b2fa2d5f --- /dev/null +++ b/incubator/synapse/0.0.9/CONFIG.md @@ -0,0 +1,8 @@ +# Configuration Options + +##### Connecting to other apps +If you need to connect this App to other Apps on TrueNAS SCALE, please refer to our "Linking Apps Internally" quick-start guide: +https://truecharts.org/manual/Quick-Start%20Guides/14-linking-apps/ + +##### Available config options +In the future this page is going to contain an automated list of options available in the installation/edit UI. diff --git a/incubator/synapse/0.0.8/Chart.lock b/incubator/synapse/0.0.9/Chart.lock similarity index 84% rename from incubator/synapse/0.0.8/Chart.lock rename to incubator/synapse/0.0.9/Chart.lock index 764af8e02e5..fe6696cd350 100644 --- a/incubator/synapse/0.0.8/Chart.lock +++ b/incubator/synapse/0.0.9/Chart.lock @@ -6,4 +6,4 @@ dependencies: repository: https://truecharts.org/ version: 6.0.58 digest: sha256:a28ed48da9797a2e9d6e9a194aa6f65b07fc1cc0169d5ffdb0ba7c44c94806b1 -generated: "2022-01-31T15:01:27.465903657Z" +generated: "2022-01-31T15:56:55.805607216Z" diff --git a/incubator/synapse/0.0.8/Chart.yaml b/incubator/synapse/0.0.9/Chart.yaml similarity index 98% rename from incubator/synapse/0.0.8/Chart.yaml rename to incubator/synapse/0.0.9/Chart.yaml index 45cc41971ce..b534d133e4b 100644 --- a/incubator/synapse/0.0.8/Chart.yaml +++ b/incubator/synapse/0.0.9/Chart.yaml @@ -24,7 +24,7 @@ maintainers: name: synapse sources: [] type: application -version: 0.0.8 +version: 0.0.9 annotations: truecharts.org/catagories: | - cloud diff --git a/incubator/synapse/0.0.8/README.md b/incubator/synapse/0.0.9/README.md similarity index 100% rename from incubator/synapse/0.0.8/README.md rename to incubator/synapse/0.0.9/README.md diff --git a/incubator/synapse/0.0.8/app-readme.md b/incubator/synapse/0.0.9/app-readme.md similarity index 100% rename from incubator/synapse/0.0.8/app-readme.md rename to incubator/synapse/0.0.9/app-readme.md diff --git a/incubator/synapse/0.0.9/charts/common-8.14.2.tgz b/incubator/synapse/0.0.9/charts/common-8.14.2.tgz new file mode 100644 index 0000000000000000000000000000000000000000..8e9f52707c284d237f7707f5b1a60556c6374148 GIT binary patch literal 40699 zcmV)iK%&1NiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYcciT9UI68mpQ{cy>Z`-}r)3TgsH*?qRq`Pw_aeQJYefKvz zCxJ-F!k8l21SCh}&Ue2D?*~Cj@~a2ogrFZML z{LcMB9$4Uys3bVg#$Y*U!J^PVQ%Dh^tpt&{#0BN=epqBN`wOIaQo?ctrg;g@%LU>D zL|U_aj>cd{X+g%_?ggf^#iSGG^DZqHDCT9luqa5EmI!s{kWf^1<$FPjEgZ9k6bQJ4 z6qckTKrIL=<2<7%qa5m@dpH{QdWQ!GtxL4J%FBd|TWw$(Yqb@oZT_Ow2C|vU#RTcD ze*4!K{Z4<>>9u>`w&oCL6ygk(92lBIoQ?s`rulyxz@5CjXaSHx)?aG?09cf%LEoz& zic1XWsz76fUTdjvdDiI8(&A(j#OPDSYxhDqDxc>XSgW<5}um8ir;p6&$i027t zx52vtWgkyZ04Y$6r#J?2o=x$^qJ(U%x1NCiPS6xCQpyUSAp|BU&97Q{fwE2TVg3=fBs!C)|X);l;vz32T2>`jK~U^*H+fBt+E9JU(jqRi(M z;&j`QR`u!!T0`D&oK^Ytu$)mIbcUUQ8s7e4AN8Ikagy|tQQUhznNFV%pU3-$F&a*X zhXR{lWBE@@zQT?>~PwnnE}j>>rEhx9jalhHKZKOFV@`;&OsPxgli z9PIbvVQ&D3&khbYXuE!NkJ2l+B63{gJV6ANOH^(8)`0OCarK-(uMa3{JaE7)WX;G_wl#c||4F_02TL;G()_txls&O6mo*(Q#AHvB5 zqUXIs^n5t!PY2UvfCdQ~#lz{K*M|p_=ZC%F!QuX3xF5r3Xwn}glV@=_mg2C^@fuH8YcZ`{Xy^G z*<>)9^rn;Pu=jj2I*8Hp{ewaBEI#ZHr_=rYX*?P|e>U2v`Avtqb&=*1n3^#{6u=DR zOH`IPL41QISUj5IFCd@tU(-dJvdxIx!n~8E9Vo0E$|x=oF9Q-Z#Tn)k2Q&b?CMIXc zM{iz@!4#$hwOVYaR_1AnN(~ofaFQaqVAa=73&;=2nD51F zB>SZz?CQ2!z^?TM6FLTe|A&Atw~8d6BRTL-004a7CEoHsZCq}T!5CbBt?69~Cn((p ztf+9?KHaccyCWxy`2>}WkP}33i4suc2@%Ub#W5sf&~G51MR8HW1OY-zNYTZL7yThG z!Ap${*<*dciRg)-t@kJ{5u^z0NRG7&V3vUQd79$v;zN-@D(RBJI+MLQLqTBgvX>}D z6jebO@B-LNJ`@ZLz!zCwvZaFw`=;<`ORKa&uoqVM%@}(v&EXfY$lwyoM4GwXh>P1XDE8DZ}~Q_q8lp3Op{Xz!^$WO!E@JG|jIFXTS)O6)13giL(m; zL4v1KRGN)rf@8V|@Vv-N3NxyCHfN{c#}BVXXB6Zyi1_cQB^y>uSkn4@4zpy3>}ohl z$g*X?4O=Z)h%e;;3|L-}hT812RrM%IL=Bv276WLmAT9Ws0&MyxD+R67dIC;MJclJt zSAhhmwL4fKW>2u(0KjkYN&n z9-LE1XJA3tG|o^u2TNFDR)O%61*Eev__q6Pr55rauMx)Ls2of%GI)@a;FiltB0@4{`3=wBcl_0!-yql1QQPHuPrFc;EZ#;$`YWkyg+o!2+4>6De&hwd#~j# zc)~^R9DZ@%^?Dl0@#%*T6sP!Ke6CMX8KaCcM$HO7Gv(f*d0ws>i;7+!3$e_0emF)j zj`KxEYj+m1*pVpaZ7i@g8Bjq45+oqAe32$#f`HHj*e+E3rKdqcvuK&IL6{_p8+tGU z+M0rKK9gFvWK}*kGzSYJHICO)kmZy!Sf)@&MFkVCOYZ?F0AZpyAW9_Hv3CN1qIr=* ziu9>Q6uCnT!Ew4E6qWDuRH!c2@9%Mz;OwGy;L8b&^>Dx96h@e8E~$`kTsDATAx~S? zJF2o53j~`l^UGe~wF+u&?Fzfv7z@=A7oL2(EmCGws<4_+e81qsAL?YuJ~@`(o+Zi0I z5pg*<5t@S{FBYj_;e_pDsZc2xy~rzwIbo9W>(_5vPr$J*(vnkxvgHqDKG(ki z=yWaxTiUUVdb#@rh7$UShfeaSDmpf*WH2Ws;N=_e2aEssZO!h=L>|N>=9Jv(!j_z$Kw<$^0bher{Pn{4JOf z-H}~A0(k1Qjftqp*;`c8Qm7VFz&kCCC?7q$y0X0#a)bNw$I2oD#{h zz#OhXiAbI<5y(iI=a-8DU_ur`v11!u@Hf5G7}P~UI4(j`G1AxEPY4}Bn!J^k;9qjr z9Q7l)D-Z{4O7ao}%Xo%tML_6TU8!Snv|YPPkVkVuSCXEw=fD5GMALu#W2b>>#CaB@ zf|9PP*Os~*&Mw%;j4>07kC3)3*nJ}84$dyxbcWRH-Ifp!XX57@oLv%^V2)wNRFwrm zT%%z$NKm}s>n_hI`a(M~EZ_vEn6kZOzMuprdJFgChu3UoTvL@;bH`RSHXBKq7jleY zVq58qg3QfjvUMPv*Lw1)Fk+m!*l|b)W{Or=_-0k9D`$vNV>TI|h;GbhcnlHw_fS8wSusC}SH_wlFdOi%?k7MbR!;^Q61m zwjSgssV4%91d#6C3Cqle&cc zNa))Tx;knoDCUpS*)t0gp6=(xzZTMs_BkbI9;z(omTG+m_W>VdH5 zxbs#|EAqnMFI#&b#iq78>?6upBfURD`|&k^j{+#jJrzt6alXOOl%8993&*yS1kZ5_ zOLc&aJabm0nTx{QdU+A zM9bCBZ~>;QDCUd<+HOnSLS)c*eYza(vHy}mLuE3` zVyGKUiBj_nYhBA;3$;pX`0E-T%g163gSFt?kjIJ>T zaV^#ln#XzCvA&%x3J$|^2KdZ&8K3vWzh~@^^W#&gMtyjB`q{27HYDtm+?o{dDg%)1 zZ;XdqmVgUH4d3S;BaDm8{+igvT7Z*ClPHH5{Hh8uG4sdp~jH>WBm0 zYjH|HL%=##;$J%M?0z<&KeHK=;ZG=$n;UByw1mT%j#Lm9U~9*NGeQweKt8qFVWmG8 zya_%V9X7+#<${e+BA1?W*dSu+Y+=ebSq685wNDRDG^3Pi($zpIRkjr5v!tY-BTJ9W*OVVLGm;h0=kEG4J(SA-C1nb1?DQVq6lqr~Uo?A1$lZT4hz1 z*+g44MQ^9BN;viEs&e<*TwPT|;ILEeQP;>zmGAm3^;PXI7v`m^m3!A$_24!stopP( zS5ZDN(@s@jj*}$4f+e!Y^9TF|C2!dm#6MN=oa^atPk-0`+aZHnc9 za__QD7~K=KjUl!V5>K-9TtDGR|^Bja0NH4F6&lsX+awobcEo zj+A?5uH+^6GPd*|5p>1nZCkoCcG5hCsnJ<{qzXu91}O%>Xrt_t*?$$k(BoHcg3zkqV!YzSn#g0l7PvJ_B)OT8v7Hr`+1DnGE1jT*s)S&RLdA z{@Q;$M8v+jSuk25l#OtMBK$#myUC~`nAvQF^#KXzFec^%_6*KEUu2XC*$-#mg9Hf= z{#$9)7PeK*TC`BBSZ~(T`$EoZJ&2)pD&9cvx60mB@fRSz1v!tvsn`5G|$Ii z0?Q^!yET<TWrQdS}SLY0#9~_cS<5B#^1Yx(tI$cK>cdBIaa9EdE zPCp(?lK&Ihy>+Kky|BFg)~R^aNwN+XHGdCH~T*xWmz>uelIZ~T7_iR}WupKe*x%*!Xolp7n6P=+?qWWJy z@5!Rli=UPJw*9S?p2TixvY_rN5%1qJj6{PRIT4cro&f1$Sv_aKQyZ+Y_w(u~;r>8v z;Su46ks2u>@kV6oUYyRB+ya$q12In|t8kxxN z!3LAZ7ZQsxJJq=M(f+?boPFMNd{8t9R0iw^vR_qrY)#V{k6lR#5+E<|5@mphUWras z>n}2HxS?)mM>L_=w;m4e8?aXp*sR;E(v}wZ-+o-lp>eAch z3W}id5-oTf3qW5m;S?ID5YP9_q)Yc2{hcj5XLn+q^r%9|3^B=JWE{qB}-^2)tWK33st$aKNiz3g!XP#VTk;xc_ z&ysPmf_~ipvEG*`;iD*nO~wqCOkbf_2xS1Kwp)J78s%*US&uAlFTv$*v%exkAsM?W zkKVuu;ioY7xqeqv4j5$SD8UPEy^KVrjL1kc2zw=ck8g^L?Ka@Jd|3c#9_q_FwV#Gd!DT0(OlM9)jLXO8C z=TI@slcxs z4#D)$yvTV5d^t9aGtElhaGL47_#IBLoZUa)+G(k~a;BVBAx7dj7& z%$1N&0W>?(xlBoOyQyd3n2Omv^{iAoLCZChuW++Bt!(elHDYN|U}dTszK%W=k>rw~ zrKQ-a<3+w1DNs4bgz&w+h)sxR`Bf(Jc+BRxAP0izsVP|5I0kmpQg7dIFRcRz*tC3B zn1A-^K8n~jc)ogR_vg&cV4$j=uL^EGVcUp!hT==*eoxDl+?BhyDy-NRg*vBl0@o#j_aR=A-4hLkHTJ{u6QG7a69fJKk*o{SaTM`HfX zh*?HK85*v&H1mS(xk}pCKz5d8@ege3v-*2~2EUiwOeIWmVkSOHkOhjlmFE_=2*q23 z%|ZNP9dOQ3v~_r_Ujb$55(bLlpl5v&R`~gI{dCL3OPkHLD7=26W$PQxvJdrf zhU*wqVi=TmhU8;3x9zglcsi`(@bECm>*Q>S)7R=`@%P4?=n}2QU_nr+51)Yc$(gU( z7iGREy7N_A7iq0Ad0Y1$NGdajfuAi;3!Ei*iIW9P+00z3MB+RH3ZXEIQKuzFm>bVk zk~<<3mGLuco^#CJIkLC>rELU`94m0dzYEJP-#R^c0^XH?9~*!a6KbVcW}B}?QEA0` zt_bK%#bnA;jd|bsk+_+* z{}P<~uU={&$_Ihwsf;)wcQ9uhCZ8VzmydyN#7nQr^z)+>LxQy9i`3dsMoTQ-b`g!c z!k>+eR#7mv|N2xpLW)8vKo-n-WYs8D5fY(+p<+#W${5_EN1I=Xq> z0#Crt2rS5gr`Ru1oX_VdOStcWl_tVu_K-D&<8=;F1eY?*f#(ZgBp>5^K^WwCmSf9P zh{=$S$T9#^k^`JES->MaW{lwz;Y&n7xyaZS+RCLT({iSm(iAb!8j(Ff7V(TV{uXDL zO>ajX3MaWf7gqhSsx30nS22pyJWcZ}o^1LFNEy4>12FmLf>7Z|4++Q+HX`hP_^IE{%(Gey7v3A2H8&BWBSm z+V=_`^xk5V=}g|YD*dqJ2`m8wEl~+mwlvyo6ReV=iKA|v&nn^P`O@d1(bozliO&4n z*s}KU`gnRGo9}?vbc3dWykCY#y5MY@?@5b5zM$am`J!Z-d?FU}xXV{>=kgh8L)xC@ zbG|yd`J!x_EY<4T-L|?WR}M$_iM|uEy)3e@VaUqZ+X7%&*r7qTuFU$$FK!B5+9Vx1 z_Vk^ac?sz%Y?!*JXmhVfErdFy?9SkY*;;Bp{!v9g(&x#BX zoS+z5*J4;!Exsdg%vo|L#(E|0)R~GKc(k(-$5?LnmW~lZWqtlVBkcGi0`SCkNJQDv zm`JMkoPdf~p-E_;aKx*QpK@EoDSV>Wu-L7M(m&u-JM>r2G=qm2H?jgd2N}yEWB=YA3_Z<3QHn;K$xwh|o?}>aj9)&c z%`@#bTxkB%23ek2T);=b`VvWZ+HPk_Sc_3j0uQ;(0UZ4qq)?*H{JyCYFCj(X?CdATH`c087nnM#(|dTu>nb=329Tcbe0Q!D z9$w{pNYH55Mj0Ey#IM~Ex!@-`zi&XTGp00h_gKESlWkriwoAW6gwavVR5+C`#A;o% z=Hu{6Il4-_pj?pbO}IBAv#`+V(U*c>i-VQfw-EQTY95ThXPkU03H+>hv4hf?yx~GA zeO?fr%??fC3gbuZ3y98IiR>mI;ta>4cI{;BC3jIus-0e?%DhdXG3XEW2Yu^p2qWO+ z>`*xlCAKCPh1HH#;K`GF$x6WimuNa}y078}St*>nme1=t_;dxwG!tdt8CI>>bP zf-MNaSk~);sKGX2)Lvwk7lRArtvX`rI!zI^fjC)KI~4QE8S1tnueCw1Dw=aUolIYp zZxk}4lco8EF#C`hE_8Z0&@cs?!^_%<>^AC(TTxW}O9aYY0=R${%2@OEja$(C}q`8U? z(m~@=$zc_`-*s4l;C@|p+`1g1x81tP5GAu*gk!07QRWLq0{nHR??mAjlw4st<2uJ_ zp4{2mP&hQL4UOl0Y$G)AyIdR^=#3VKu6@5Yh9^&2GCM9YM{goIFps@qN||VqVKC(; z+>ENEE(t17##AYWDlj+V>jJCF-32vauexsVLQ@rWq_wYP5|=0;k)rw7z3GML z5Q3Sw##u0XPFGn@kqpWF@czx2yp+?D2y6;oe$R+^QKr^`+k2E?vVFHoR&BE$@uCmg zsX3$TWU_s?WW~)oCJR4Q*Z%S+e*|am>gzm zUeEt`us=HZOMlou+&>uf2m7PH^aj1baQ`o$cgKAVJ`1*C|4Z-IZTX%1gFM&Q-S1kQ zbL-Rxd?O)GD<|m!6(yE;($CD@(nT&ZRSDvd9!@eh5Zj@vJCe;s!>$g|X?@rI`n7d^ zt-X9AQJ^y`UA!JYV%sS> z3IJHRhbBslEcjL17VNR+0GuntYoJ(VEKq$3z`k$14uC0R0oa!S5G`?R4|AC4ny)Zd z!_k(emiO|2TPfG_r`hVtTO*5wej^$ZO%aQQDU zPp0Ln$d#-uge-KNvl(|A%<^`hU+?vX{I~F9wxnN_m3F+db~@63k0ixiO_HTLr1|>jDB218OzV{`$40OLxB$ znR~1gGCSi@B>|lX4&ei28k9#Ce!Cq9lEG18`HA7h8n56R*%c!(N=_d&Pih6>f#@Bd zU;!=yI|+^{n?*f+ev`Z25c-UfpA*@05`m|UdYPq`{Q+6$pW>ZF*Vl$#0{jJK+bf)Tfpig&v&*l`)IO@g2okTrVu6yjX~IivXS}b z7Pb{tf&2bif=GpR$pnlJucZ0^zD)(n;=_3*S>o* zs5clYDe@#RiH}Ocy*&Z>uhZ1tl>)Fv{_hVD4}AGQ>K#7H|A%;PBL6jk+^qtj!ET}f z=)#XGz@I<`C_~3LPEC1qqtSRuXbCC0Sh4-A+LTA{ks!b*1Vq=c&lX{pfSn9k@C=aM z%9lJ%adz>cNW^Dr(54WlV23Z1DTq#T3LseWU^iWz-vrJUk+pz!z9GAjX=1lB&Op}} zR4PtguCFb$HXz5+MjZHN2|fnsm!_WXVL}X`|i#F*Xn=!75h)` zu=l9{J;cL}+qV7xwTvxjwElxSB~B7gv+3VlT)Cm;U&T9Ec7OHCv-&IIt+Dyb&z8ks z!3o*>6P019YRMOBLry)Ajxk@V58N)lsX=4);L?VB0@_4K*z zZEE;8)q&fxoKD6@zwCjhG_|I{A3|DX@puY4`uZ#TqwJS+gfe~sc7RgEzFD@vSw!%U_7m(IH<`5D&pRPv73noF@A1{;_g zu&4HR{K-sB1qrdnUAING#w#nH11k|>o1*ax5Jj8dUTxFEo-@4}B!5FIQ!!FQxNCZ+ zCd2EUMCgUbuh#ZNot(=0j^n0=d5Kme(1l-RByAPA3*g_?MXaj-$xxlsJjL=b{LhCpHTbC7b3gC_j8bNP(Nt}gqIVel4)zU^#^YI|Aa$(dzJXzZ+2w#I0; zro5=ZaF?6mTFafq22-M~Clxct?Tj3@%wF4d_76|XVq4|VFYC)2WtG=7U&t8zJ(3b2 z`iI@!O(CNOz^@eCn*f$5x0@PJnC}78)@DMoW+_=4C8VRujV7?ZRvXaV(1ol;bDQ>_ zWnpW4w?2lqYt=V_jVI{no7^=c*abU6OJc*bTj^+C2CH?frO!ds z6?yfgU#;-8Jo0Xvxt_MEJifW~GIx)k8+LddQ80nq&U6lBKK@Yfim3zlyyg+4%kJ zkFxDiwmr(WO*zw}YXC zxc%=8#d(&%a%BgBGM1_g`DqRld3!qb(wf(r{H!oZ=P+0tHp@H4DJnCVzRoBrr#v~l zbqZX2%vh}!fex@%WDhujo-zwmAfGOt)|@}v;qg4Jd&eXpw2hOX&P9itLrop+aTs7b z21An%z7aDv$SNCpZ&_rU;pJz&+hW*M)y)S@)z}O*Kk?WWsHv)( zqo!)CLGAkmP7@OmIEO_uS(|XVPCXGDpeDk)IZSyOyCKijsA!(3@+gk;MMk}{(~uis zXrLU+r+2pzh&-oWOMCE;u?tp4K~xHvTB{8@VMGn>nR2&j&bqrP0?jQtMH}06z|=dI z`p5`h(i&8E{eyN+I2HP>U|mjNTt}Cc!aQ})hGix7ZCqYk`)fJ9MYA%MuVI0K=7p0& z6Y=9^?NXW?O;OOx0 zf+_MByV8}9SCjb$d8aGJAgf)=hmaxH_N@UNVx|1X(f-wzd^a!QI<{`hyWZQ&YAFh| zyQ%M=7+Hs%`CD!OaQOO9PhFaP_W85+Ku$Z#RA4<1E41#p5h)*G!qGNG1Y>1^%(j z7e&L!w^UM4d);j961Nb{Va$(Q1-vuI_P~)`1Jt!voY>O{%z>OZ7JZLW1PSV#sMi(M zqi%2&uBJ?2TnDw9%pcElxGMj}&iF1hfHm^JchDR8^8c_me3btW@ksfPz**o9dnv^0 zMYXb`1cb5X*#huy!>2{G^t%H7vOrYc~HJE=?R_ zT}PBn(SB!&B-aJ|HPE6T?6-y(E5UvmhkJ_kvrw-z*%a!h>e-=w-jM!wp?i zd1~c96dSF(Py^QK|A&?HpV4stG5^Qg5dr^ zN#}~_tZXE9>oCb~f7eRDnBX;1vDpM|JsTz7y5kKtAZT^scVt4os|-=Re{o)Jn(=Q$Q2up$P1NkWUhu$mk-?Coqk`(~2kSpT!jan>-c$UpU8itze1n zCoA^hCOd+4`v0Ks<$oOX2gAqsp9gt_{;yPjnyXvgykMC;YpHAB)DrFjoXNC6$XM}f zu7A70OO&m@`>hf+6Yv76kH=BAzV3J6s3;ge5Ze#a6LagkG~vS};VKABkJTrg?(tgQ z5+!Q{?uGU7?dZ}%dQHoG&PAjXhGM~V?3>yiZ1uE?T*Mn~+k;dASTU@2zXPu&?&46R zNb}X-&`KWqN~!#$sT1HbAt8tQ>Hr?Q?9>1r;;FL(N6 ziLE*y{MycRKINKOl%SiZ&~{Xo!7!I-r4Lgi4b=93>gb&o#!l@as=EJMV=LrD-H$AV~@U*Jh z>LLrayWMQ4gcO_3MqL8Q>tK4@wQ%YNvoYOlWi}*)?swoNqNtoRp3WoH#NE%%IqCny zW2((@sUV|etn4^e8dbZQO)R`^59BFpXcL+gG2iwFj-w4v?kzs;fv2;aP&;?9gw9@* z+B3c#v7_LXI|ZaO0(!d^bxLX#ebM6)F+3vOncbR$v`yE-+Vs9nYr#tHdyBPD_xEqD z2mQM~8|wd3zqr|fz&ih*!^4rU|Mz>3`u~GG`uxvP5paTH=&8#*=_f&D<3V7PM$DGE zyz*XuZ{ayNCPa?GPYqQrE?^lkKoCrBz6*%A3bP&o!Y^;5b{_gW}hj$4*^K-uyQCToO_D&!lVRc&EH z(!cnoNfd5d<|3!Cj4{_v8X9e~j!yac2{$|8>54bi71gJCY0Vix*%Fs| z#xJm0!V)u0B&s{83`GtE$3)eULwUIeo-X-7R{MS#=P*f$ z6tk_?z)>s8oaS+!j=}lyX$zJY#HN#a(5xgsyb`&#!d+^EsNLq80sHe-s7A7-S^zSw z?n_+SHok7;M1)k7Gs~1KHYsn}zD8P|X^H3Dh-ZHiez%sdZ6`2~B5hMWvKN?|ZQQ2i zzJ~;jhMSf?(>}w7B=x>d915r{+!%DrJg40bA+s({K9vLtJNRNEKFfF44KX%VY_zGC zM|0SA+b!Leh1Ru^{J&*Lz#94A?;m>izYlu*hx?E6{~;bN|KAlT`*?Z+;u0~k!7wG# z%tEyE7b(BDkp2~;Q2PN^@=b#gv;#!b8DQI9>~|NJ(75M!2cr_MAlS$nndQRp<%-k> zk{d&mL%&u8KW_PcXU|6bUkK{^bWc1pgkV6&&NX*@{&zBjSMvt$pl<~Utud*<6{ZHmPy)XT5IP6!} z|LF1l?+1Cb{-<+%i}~Kt=Bv|uTgj~J7jP&kc&*9ym_vLEi<`%3wN-?@xh(*9#^f7)XE7`Fe|JKDRq|Af?>d$#|WvDrG}PjAcXWBp8#jrwe^tg3WW zf^j-(UT+=j=UXOjAN8mEvAnNPKTp!%d%)j~cdzUD|1F(=Hn9Ki4=Ve=-rzC*<3XNA z{~tlTcjWjJTy$-I_$Cc}x3KFy>Wepg>em0V$hx2SU6S{n|FPd2^!)sfgVDj``hSS0 zPXCivkv^pA$FC!`w7zYwIlb0bQAT-zGI6u%jW0$uAV63_(T!c<5?w4{d8>O^Z6JXL zTN`N{%OX>{MgSA>=?9$3OxORe=I+PGdz$#aTn61wf=usi|KC3x`ug8s_;~-@f9Tk96g5?&JqqKgGO${^7{y|NZ{KgS_3Z|v5hcPEim3r z62f3)sy|iVk@Vq{RZ{GrU}!dF4)aq^N-u>NLF&nByQ zyoG$#AHwo_u>Ew5L8C)vutZ5m7gWP2kP%<&14TWXhcivuQd051V9JiFxrx66E1Tja z$`B!^Wj^5zIWIPKd1$X`<=z}BHq!s@H~&X()E`v*zaR7eKFo6u`9J)^?;boAl;r?JSW?unI6Sng)*_E#_&4N(^VKHQv|*1xt(-_ioOcKwg4 z{=bj@KM(WN+5di4bAKlmK*=(i`G$2261MIcoNj5~(rPS0IjqCjP`x`-ya@4`u{)3qvgL@T(`9V1y_%;0qM^nE0F%U#t!6_+r$#& zRoTWCbTE46S%buzTib)orsV9^>CyY6^LOtZi@|?Jk0zt4$>H*d~Ju%<6dFD=RGl<5PLUMJ{`**U^+}~5t|75!VyNLT& z&pQ8)!~Fx#|L?Fjc-;Rz$kTZLEA(!Eg{gAFe+!E{z57*NGU25UkSuq)NKVfy&(`|iYk6_p zeQ1CBim|)U{Uoq0H9z}ayj$yi{v~_A1Fg>*kns#cT*_KpD#${?h)2^{EcZZbkRjOa^~J$y=NxDY}BC z;0RF|Hxa@8gI__dTTe^z0E=7V1)xfs4wGOlI+xIM=v72tIF`pfzzOodIZal|`h!=& zF1lPyP?;f$NL(fn*mZF-*8L69(Wu#slwp;11zgY8J&9h=Wstu zDp57HG_9oT)Lf6I*45C}ssOYBzr@%i*0g}=%JQOPLr8!pPNM}It*7p22iS?tQw>ZK z!xSAOb$ucLmHSOR_GbUTr?^Hm6;~WHh8^KAG2(Y9hZ-~6_4jCr*@6vnT|5OHgHA1q zd z0Ixt$zq(H=_91PzU9C|_R~f2D(xg@GIS`RRPEr^9d?Nb#pmtr5}!F<6(5NzI|c{Yi(2hkku{0 z?X2j3+^63DS1jYZNdB_P{og$=|6l)Lbntlp!-G6q+y73L69^S~pN>UAJcn z*{U&1eQ9jc9|Y4IZQ#gDM>+6X4Hq-e*yc;@n}Q_gpEHLyRjN6Aobpn)T_Or`w&kg= z)kRrfZB}L|op;Ert6YED1$Quw#^4g6B9v(V_S=yrE%JtU9jx6wZoNT*af}Fgn-YX!T)j^c>etP zk2vx-h?Rkopaf%zzzz^LREuXsX4zh(`2?mBcxu}#ERqq$xrrM|sAyp6>7x0zc>`uye`#2>r6jlN})B5O1Ndl+tO zR`po9FBFwb^u9L<$cl<_t#b?RIOE$X%ADqLp1M=93!^!L-?4s)k)$SVTxX zLu{O8loljpVO+18+{jS6lb1qMRpb^Orwc++`T8{41v?^LmHN0V<*2wbUl*)SN31@H z^7^MESG_{l*LFGxW$bfMQ(i?Ud=XoyaO#q!_-ka9bgkXihw33lu(j8x(VCKPa+rJ% zQ<%l5Y{ttcTdSfP2lt(We5iPnDOz>*yoA#!j!le}86f9VaHIm2o7%K-JmXs7dzf9Q zhZtF!`>2|T0q?pW3a>}+5tD_`g{7{iZ-B)LHn?W=+j*B1Q9H%Rr ze%*KOc~78t^T^2>SRrG6`_s2>*ti7tP8yi>+_Mb$j!bv@%U;>H_;KsFV~6e7##nK` zn`@};n3tApduj(DI<09z=ziphaTtSi3vuxn@q_7_k7u=C&yP>7V{!F<49<^FTOr%E zDPcMvK-ND13PNz&Fcpkm6BwTzu2ecg;v`SFU7U$kVILB*l_QtQkGs3Nlj@b#1@+33 z`C)5AXh8@^feh8k)7`qyOaSgmE|sE~=H)oV+r+1uRpNe@+@#)ek*g zE0A@k4Qn)kTJ`r;mWUJfyHekg)GSj+H{&8G%azh#@tQ5UO%uNnO^0}n zVJ6Rd_MuPx8VVoH{;5xe*4lqQi7nb~tU&AH|Mn~X--n08{YU%HLplLReMJ_b_+pINYJ##2!4aYn_+HZCEgY zdQa?{%>O;GlcLOpwQDmEp8Q}(8D&m#!Th+TOd-gISDB&yH~NPBZ}fj6?T*0sb-lxC zi3nqC!pU*nn7JMH#>{n^W;G%;S-V<^5j5cqsKnug9Kvk|kf|c7zGHyXFfY-Hc!>WB zrnn@u-gnvpcqg{;e}|{a|5dCi>2lT&Z*lRTeAe*);o;$+690Yh82|GiPl$u-z<)9S zkuiB&$sEKtP)*YziN;dWuJ1TLq{;mJa6uB+Dx5~x{uA`25=6AaxtRY}@-Yhv_u6B; z{3+XPeZoa#`Y1a$9PV5FmYYgeh1+he@{rE>`>uH>8}>ly<9gl)XIIbO_*(Y0?N549 z`d*-l2-xfMBDM8xrfKsYz5qMMOOX|NTI+4e%ZFij-~0`lSK1xY8b>gNe8u4oeIHmhR9M!0mRswS96B0o3zl+UCr* z;=)ztX(|msCCrkew3xw@#T*>ijy4Jj&!p>EbG7Ha7-z>#$F)a!-<0>b7)IyYqD(8% z4&!e3o8|bMrSQ#DD2PS{cmZg4eX6hOwy2{2r+CthQAxX>*niJ%m-$;f>->NF1Kkx|M?(KNdHGAb&_{0ZxKgI9W>xf1ZE+Jzv>QAH-V8k#x0|)<_$j#}%b31=7b&^ZF`#v(^Ig}|XuHvk zID(=RrZ<)FtKFbqm2`ip?AaJu!X?D1h%jd&M&6=ruC!E`{crXS`QI!8QM=vdl6LFl z^G}_CulDsdsK$!f$0=KhCE*+3`sUD-Xt6_6(ut)62@eE6n~wj6R$?H21vEdSCC)BP zetAc*Fo>6E)daD`OGweCAg>=HJN4sp-_IKPe;4V0*5?22AB-yZKR@38`7n<<|0ywA zBEZ;bcM9c}mk|J-;uul{Fp){C79~pR4}Ux!Z8^MdAj<+?zdMX|&KHEfM5s8p>?Hq0Q^ixqHf--8n|J(MKQT-6(>GMhF zV5H?vgJAC960Jb)Ohfa)TQcEyHafF13U>knVY8a7J}*|RdGe6F*} zbG5FqXKQ-&RHDR*)I~T6^!+&R5Zt{ckGd@@-$gUE+V$} z8kpOoa`=0G!usC~G6m2wo!zJZPj57+_8*lQ%x) z!Va3CtW&%6g9*?s4Jg|^P5I+?j_pcTyB*cOTB#NwFK*FOe1YY|2#cc3ixM;C#n}D0 zyPcoCcB@|5Y28exM0ji@Sq{!FI*cKSOwz7>o1pm;mB;zK;Q9CdtKaEAj{?@XwIkYb zQ#nWsCWu0($>3H~F#H*cFZEy$D%x9ZHykF}XWKjL-K8IfeU;bUD#;iRy z3B=RbY^HO}fOL+ELh*Ng%2Rj|&r2(JXSGUQYKhaObn&kL&1VFt2 zJ32x*@L6pe#3#p>W4AVL#OzAAc;I|bx1u0AZXtoD`FVM{$YLS7wF7^R5_IZE*yQs0Lm%n8YMprqY00$>e3{Uh6K5O{2^7 z7E!E0QEju82;@q%NSyIQsXH?A=439{j3~vmvo*|7>bah+!0M>Qapd1dGc8e(a{v1O zh(Poy+Md6tUioZYs;ozGoG&uUSOVi9%{?JbofB{MT4r0fU`Hecb7oJ`YQ;!UaUtBT zgPOTXB`c(>6C~+)iVXqP8cduB*}Onyx&kp|M4^a8$;>>XWuB&}lxY_ETNF1=_2KTLy*s8 zfe`F=Ls%^Z5G-Me6X3VG^9|XJ>M#m%aP8(+%R4OhmX#c=mXatz zIXf8%(OgiINY}f@S_^{8K$V?*j;Y!4iJE=_^f~KwVrtJ9gz}MKyQ8ZTQ{-c1H|K!T zK7kz&na~P_jnh&{^JsB6-R}S|2#P#8GR_2VFrgx?mHS={y$P4JzrDmU)hSg>DS5?< zj@PR+V*xa7jseg@aTb$oRWcEo3MZIlIUifzv2e@57DAZl`E<)WLoM6ftr=HgM0bW% zysC_*c)ig;TDoOw;Ma|%1$g6OOyQ(Dij`)4@C{>VRR)nd!f}T&g_GbYnwmi(4Sse< zH&|rbk%pU)ZhcFe4ZW!!Cgd+vC$NUTU5wUDkWcOYm%3@WAKDMX-*z50T?xU) z8ktI96*$exu@+g33{Nqa0GM&+7gmVNMC1sIg^bGTm|h32Hm7J_bI}QJqiO+kazCV) zP;Oq@QJ0`upuT`5&EjM)MSam3|9sUQ!vrny`r%tM zNEVPa<0DG`&PT|QOh9~Em(^%sfoM-7FYTKuY%Y&VMb)5=s>7N{@VmoKHm7N8S?a-d zlh3H32(;PAqy(&uBt--C%~%wj7d+RR-(*b}TzSH4H{lS(nU86$r0^Qk%5N2Sophp> z2r6om|LMV|egn}Yz^v88f-r9|*Ul{fKDv&$s?72l(Ih80q@Fn~Y%sOX#7YM|Go30k zl`X7rc5x$NWdr|x3o6ya4cIV4sKSQTsA)h=ELawHW>JR*`72Kr4zk|rw{6y*!g;fG zS8eOA*li8uyJNMofe@RmY5N8&)@o#X_No?&$6B4&_dd0E#!jp7?u3;}umLt&ZE!ml zY9MdUK40;1{pQ4V;g&F86SVxX?%PGNsD4ve7YoX! zt!$%=qLNLs)dSfa&VoItndu@=&b-MEj7qp;FK!COqu!&UU~l+Ed8|_xdMW}ywj*Ry zFf{sV>Oj8-20bvSCd0ouiacog$I}n%R+=gnq5z5Ca0vRn!&=bMYEQZu2ac9!4;j=JpShH2y08tgW$i|~x(F~<~gpo!nFRNq5$V(a! z85@Ww8@zKc5E4_rQ?1eTe!br4Dv_jIR+UIKz!uylHB#S@XGt?!X3c=hwN4M_}SI|Eis0yAhPyBnBJM#9$p!3~oymgE~rZlpgO^9RaGcX>6hn zspRl7o)w>GrLTzR`X8Ex;DY9JNO26)bj4daK05t$^6LE4_peW0emZ;g{^RT8S5A2?*SHL1;d&{mgk^?bl?L!8wj=zpJKSmU+?CcFlLyc+F?idbmJ?M&|^+!6d2a z@rxS(@N=wg1R-G^sOk8INVp*Cu+T$Z*L{Z`UTj=%i}t*}x2wXa zSx)FFq%$|ecZVQ)ipn|W_cxL=4yy)`TQpi%x5AAT291pvG;7P>Xq~$ACT>taP9dJ3 zEAO_4oWP9{t;mTrxQVe^gIFN3`bHRDKSq20TRma_Pwn^6{lqo`h2a356`XJD4!Xww zdw<`*|9{Xw96jcLd61{^{(m|{V3ID7h|!qlC4V!|7nv;-z(4Z|pfkvggykY@P0%zi zRh$$LE>DHIxZ&0~%aO_@I4dz9H;p+b$yIyklyKvgsiY*#TZXlJ&s;pL z&tY2N483OWJ0&V|f@xl^z}K(innD!nTcw>Tk+&`^vLo_=pmGd){DnD?7>jKbe_MCZ zV3)BqI(7Ld(;(H~0JOo;n>Q^0N<{ee-THoGZV6M!>#w#=XTw{Q8QH=t5lyy1)Sck0 zOJq z=2YAV5~v~ryD;I!BfxL_jc55)2HNkz!RXoeVDt=hmqpf9E&L~lXY)K^-!J~-%KZj@ z{S}Bli851&)n$guB9mEy_juItDqpaP&saZCemGkW!O`&>^8fNqilG!K(bx+7vja3pb=22mM3ygt-pU4`=XYcu|98rHpIG$7Pa(UY-l zguM4DmINr4{IbXdT)9Xz=3{qu>ujAapRAoIr%nHgU8mL1sJEQ!xcFzXn7AM13j?51 zB7ps)a$EPT)&FD+I4W-*2h^4qgECD$4 zBb%+jw0b>`fjd^vgcfHphV}Qy@a1dt62AifVzMK-HBJ|4dYY#=UO74q|JEt=MxdBO9k~=bfcx?NyAP+I?iS=-KnpPm-yB{dn7qr<)%!fBOvNNCLebpe zAeAa?>voc7tO}?omS>|+?_V9g{PgbR&HsFQ|L)zn+mEOpgMYFOccW}+ z-6Cr%lrr1AKUlO#6_}@iVcD{6{?`v>KHm%jR?_S~ukD=s@*=grq1AgdHP!g)*Y8bT z>jEm%BL{}C4ETMNkGkQht}a78Sk*qflNDoiE2D?F{eB(dcG+zacj~T3+sW>4C)r>1%l3nH$jK=lpllCX^&8J`v3!-WOXk|=ON7DiSAZuG`O`({O zr`6&X@^gM`vgl^pL*Ks@MBY3exl6q85uj8C1#7Z^-OdNg5YmZh9@4|2Wj!TW)-rIH%e z6G8dWwKxOG$}M)>2KtrZ#10=eb%N~IrWFw6`0W~g@3yj*&%1;Z9G04NVhsJw`n%zl z(rKJ~-l$2aWGy$FS?OEXk%^VU`ZMQ@)!gR>ifs!tz$68S424!Jb*gj|(q%qDVXU=l zV)wfi5cxmEanE_VKqp6M;OzM5%`2eN)FgnrSZC8*bdr^&du{}p+1+YCVK?0@~xl8*AIKMHw;XApOI!kT^wLt)`|I7M$aBK`1JJz$KwSV>noEl&HM@$8U6+Q3P@g3e%sovXKpa3TNbFNGaFaLPlNRFj`?e(hI{&)Bz%hj>tsW)Ks}vErzB^B zJ9j^WjppDc%*{jwKW{&sAuyXQ*9}cnzI95zH9DkeXJh^UD8-NnMb7$p`+ZZECrDqk z_4RAZ{(XDsaLPBteC?{gZx5B`MV{sttFxj+FgeaMLQ9CH3tjEUyJ$B>rAd}!{oE4v zpU@Ka@A+(C|10S&bAYdj|L7kMEBF5%3?A?QdXR^o0G#spV{PzL_uM!JzYWZN{D{QL zE2J|Sq;7hLaQK^d_mK8|cCQR_MSdaUuw?{wgE;3U9Z6m(EMSN{;4%@7d?#wRw>{+( zSI3|)tai6#TWt|QqfVf$lpNP8%vkrs>MZZYQynDk50L9vX`NbM8>a+2uzRQCQD;6{ zM=tJ7EAJMi2nK%Jc9r8 zIR?U)8s`~E^9vkr#`WbHvyQhbN<4?M(%s;nE4X-=kQ zuv@eRkX29a`Q5@&Zd5l!DI~<8D~cK1cEm}x{3=e5HtJENuEp^1*xd~-;-`Fc&sT-G z*N}4^eJzg^4!p>T6o>3@Cwx&%tj+#Jp^9|%nzLI|pQFgy67)c&qC98f#N@ck%O*vl z75@rA@r@KH4*3cV92x8R(i@jMj|7~Fx8=N#5|5j53+N)~7pGKo^x^znR4E)7IlFbk z@k6b6S0dIxPetAJqBEzksSzD zUfY}Pp%?4nhDb?4<-P$heTh=I(#KfVG_qyf2^0d&!>YhDm2**|^I3_=EKidvY`?^Y zfGM7%d_ikbcE4{3v~W-Je3;JXFvJb_5#c}YM*gqW|7^Fk8)|`T^uNJ=@4(Oh&>KDa z|2)XUx2PY5dAGp=P z7d!KizSdc!@DUB!H-iRRQW+Z+l$uM4ExW5IZy+>)?o^<;=yN^CNx!+1Asa;0j&_AD zz>Bi>BCJj1fykcfpk!g~#8ul-*PS(oAQlW2Z6pe)U)w?v9VqhxUT|ZzDCoak1GSF1 z`hxv>{pGvPWw!Olmdn_Q7^%-kC8=Q+kUl&1?AMAR+LFFr0nj@t^SZ{=ZF5P(wtdNN!w~}B%G#$k+spVwWtCnRM)I_x zS-7Zv!Gz-Mf-`!T&2_&6N9h$@5m1z9ib?=8;1Z)%du~KUb<42krtPPZ6za+aKU*UJ9#X6GCfigp^Vf_oOP*k47yKM!T5( zsa?c%i|!$XvX6Od3q)vM(A7&^y6a25b<(f7nw|}6juO16SPIQyo(30*l2Jf=Zf=3# zf1x*cj{Q@;U?aM4s2%=Ol^uKC4OldX)sf80>Ut5QspIOR-MS(oA}(@L+&|4H|3op> zEKSG7YAUu0@UuK5()-!0nD5gVsVg#e8aDuHTb5y!)|;oGvL$Qmv_1e7zXg37_HRKB zT8YKbh+5+BlXZ1n&9h23QntL!6J5`GHLhkPSqG4fvfc*pA7hIg1HL$;deyjbVS2fN z)lbn{p>%W;L9I8rl0H01sy{dOPL(>>*=zw|=rjz}`kws%?0x%p+cwtV{;a5i9}9(KOw^eGgtF_<$rbj+^O;en>14 zyto&*xG!8>$bE#8fYFI@W@BlMT+5Axrc9=$Q}g)(c|#b0U;`r@f*J}>#qM>3WpP;K z?!kk2AMk0k|ILE|C%>#=ieWgvi2o^a>e_n(d+h)5*sI$A-qf3Zw*MdF(@_6aANr*L zatl5rYmh)n?@1bpC=`lmmU3@_>6JkN3{pZV$dXVn5ehM*+O8C7BUb;RbO=SUnu8Uu znfuC1E=;&O%Pq0Z;4hngasEIE^S%Pn2YR2>NJ`h>O?P52=)na4zzHGo8Q6HeI~<2+ zKpsNutr3GEWRS~Ad5fH}wOKI%^(}J^Cy}JmQvC-h3aO+joF^&TV3Nr^DMIeD1oSsv zAM_;x75ZobgMvr_sINuJe}wZ(NU7Q(*FUC&u=3B69Bp_S7!(`l3es2LDUd#v(ahoR z=O_#`YxKbpcn{{2QHTQLGKZr7LxAzdyC7CO6?&u{jwLvy{tg6I!%<80Qh9@72>B8c z2NK?7YcO`3ho-SnBefc^7#S1?c_2hZ!Z_ z*I>QnbJ>7|eDDYeDBw*fs7D_W327pKpTJ);)cdXRniB;npU=x&AU!oigoK!jsQqBB zl#s|l8B*g=U{01spf9+RgJ{K&9s1y${}}!7mD|wI0gJX{XBNU9yu*O3lL#?X?&}W} z`R&l>i?WRR#}ZctUQO=YzvWKU0sfyp8GaFC)@d7P-}#T>q?Z5Td!NsLJj$oR|I_|m zLPDzV4%M{*K+YOlu!0)|AP7+ew%LgLA?z|m6vgaMBV|9`Pb>M~F#xzP z{^yUX_5X+7lA0h^LSokklevIIsp+fh?{}cj; zLQ{Y40^88}p3t2I-5RuN=PkfC;oUhfn2%Xw6C3@zBZGVC)V+2H4;HXZm(lojJo1Mn zuW`5eu-kWRe7AGZ@KD_C;ln?Gmc60Goig!Z0*Qw}w8auDgWk+44>w>3#M2BH$DpiZ zRILeEVuH$-S_@Du!)n#(>DJSs!L^6!%@$(gJn<2`v<2EePPfhBwogukwx-Jxhx@2Y z{m&SYd)&_f{$Gkh+}-&*;QYVmPO9<0k@q?O`%ylhmj5SM?L%BY0ie*7{5bh*o2+T-sC zXr`W)KTQ1TtfZoiVcw&d^9g%6i(f5;hcWhd0z1IG7Vj%C9gS)^nC*;U1MSxE4>f&1 zqz{|H%Q@-6JF=O%Ejs&bWc}GbjrL#0a70gjQS~nI2bO=@Xa7wm!&?2n(dYV4kMj}d z|2KGjCeMK22ytot)tV1WutI0@Fqo)h*SkV2OJe{5B?|^(5~63iI%;umNU!0}4TF*R zTh!qI@-j+yXxj(S(U(`o>Dr)5Qzj=1m=l}k9UsXu5S&^0=2I2}0v_NT!!sl6v zsPc^x)P_2WO%gC6p&tJe{&&o9`}s&nSdoVTStle$ zG0W#dT#fyjGwmzwXquO18&AaPIfmY`{G9Ru^JJiqJKQ-EB^R;}oZ>;=wuXf9ilFHT z)Di72nu}5Ai&`%{;ewaze&=Fab}0{M)(-AU-`!c4hF6W^k>SsKE~uSY&QCk96Sg%5 z?Wo!`H@RVwICt3`r7>cNI+&c~FP+KLmc;)qI(8eNw6zsT&DYX^y75Wi1`Y zIv!Dyn_Ql$QEP}?)FA63=YQkkwmcyEf~b~y?BP~pNvr)atFcgfkGC4zE7(Evs(ZLK zSG%kEpau8g%dKItbzEu(FSJUR^+ncli5;@Qb}Xp}TTPE+YRH}*z|t^u;lmjk#**G= zXFRt5x6A(*xtSm6`~Qyv>id$2L`iJ{ zDE1Nm^}$nh{jd0XMF=x?vLRbJj5utCWNXl0Mq~~np*D92fN~GH1}t*5bp;G3@6|}; zE?!`8S!u<8c@G%57A5lYmPHYmGod^xJqbWNJqJE`#i)Uda_Ia=s&wd%fz(aZO{IGV zrD&a#DV{vXvMilZm0L|pv3n%nMWI=xNi;F<+4-$>bG-&tyj$QMB2b4=#== zLohtr!3Rmvyt1rv9co=!-m(4J@TgdKx{>^T$RaFZ^?)OYxOD&-pFBtGL8HF1Jr=eAFcfN=znFUe{B8lj{WNW50mlabNB@x-mLfcx?neL=WRH2)o++rV|C4Y1`syWP8 zHq8I%nLX^YYyDG3QgNp30|mf7``;hc?EmTXbN%l}`LwtHP5pf>IRuF7>6>)1W+8E* zN}+&_%2~~BfLVyHa0b9mJzME3zbNHD)B}N}ye-VE1ZY0Y%}J86Br`9Y$+Mzr?el=c zQ}iq75BlXMl28_eRh*f=j^*ec8V32AHFwyVe%~)uB~;-2X;HpShdz?tBGPrVibH z%+ad%t*EcvWY^THc_8)-#jaO>Yp8pv?|NwlQyHowdqXPt5!6cKKg@_)s(d$Hh?Ezn zFh)SubQI2iGOaHSZ+NgVDKga^uXa7&!X*K`HAAPp}ALY|Z|8obH z%CeXll9j5}?Tm#>?)2VLxI|}7))&(zQFZ-$;Ff|4gk(c##HD!B~c_o*l@XP;pd#B+TXzCj`05#A#B$gZ-izV>0*nx8UcO} zQnW!U~k7Td2W2{U;YCyF;X zCGi@?%<26nju!;17)$8c$w^28>dY~V;Tk&uS)b&0<puqF9Y7o zz-Va(-#-nZ^!f8>A0_{t6^hnaBzio2AN%9K)%eeF@_GOFaXwGLC1ebxv52lp4gmKn z6oYw&qmWCb1O|6v2c!1{h?9cq=5Gq<3Plm%zMahZ!SV7Kq$q+6Z;&V|Z~PA9u=fPS zNZsM}G)d6{zeAxcZ1q2n93XBABe8gsqXZI^f(XaR={e7@f4OEPMZG8BT(B(o;rtqe zIHf&jiP?$xSEAo@=Ko4h#J~E7)$)Y@qrcKkd{O|K!{9DUgzlrgFCBWH^uBcF@UHiz z!`A$7lHz6W%m3GV0)Bw0I1hL6`~~efNlN~S0@ibIh~SBAo|1p|oDB^~h)(_;1gKj7 z=P#eV`R>K5@4s`_;e+?Fd;L!)?x^bj4gJsiKacZy0?t=3UZRLB|2j{m)n4%N& zP0w+h5~L&Wbm$I;1J@f2M@K#07srmT*xr}wXfX)ojfo_N#K z$wBB~N;5=Hc>ANHo{eVDMzhzMX17AKXVUCzn!m;GIK=@;Qxq_;#+1Q3aXptv4}ei5 zwzslmnZghO9OK*%M=7<^5d$*u4x1o7AQNx6V?Zn`Y1nxsd9?v?n+L>LNjEotKL*z~&oADHA-K5w7OpX8 zj1nKTTvM)VCEK%+?R6&GbtWaUy*k;AsJPCg85P$#%&c!hrEH0S+``&cBOebZAbHTx`SqmG3$0VX5ET0>z0h!gK3uZsvku# z{;BxsNR2@|@jIE?#jk5KZr#qtty|ICZppZHXBF|g!0$jrmcr|jdzYNVNlOwZyGXRC zRkyQRbt`JsEvZ$vThL%KYDx2G7tI!}>UP$uZbgZ>C9UfE9cgYCD4C4xffCoILENqy zWabQ~6`GX>;p$^BoHZ#`zOqx5ca<}C?yHnwZ90Geh zYd4Jc0DsV#=3#|q-=z7pApoQ60)%r}evu1LS*lOcdl)JOz5Wh*o2>!G0oDg$`XTsB2j`271r%CC0QaS(72e5r4Ywff^7Dh z*V$h4D)yQ;X(Y%#d3@GJr|lNq=ycbjvl&qbTE0z0R*WdmG@@LqAzmSJ+AeH8np(rw z93vZ%ovfyODOTBY)QQk`=HY0%!#wm%Q>pa3f!Mf)*qUq*fKgQJjf1?ZqsVr;IX}OW z*tQG-j6?|FOH~QI89q!AD5p4WdS8MdLNLw}Sr;9Pg)6H+$h!hT!W~oy=9u-q1oLd2 zD0+Kef)ue7FPA7)KY>&prm;@Jq@9mHnoLZOrvhx$l5t0~UBKGem7|fr16WH3el(o! z0@f0E;>ulLo47*tsjq>EQ7e60gBtD?@unfA*0PSRd z@)s+nr)hb*2UwonC7Ojmo5k7L;H)V0!rb%*zBT&u5K`7cpv^ezY@1a~v#~+ou)6O7 zqkFg&K2N|kZHh!8CK!hxML~)<>0|){l(GR;HF-#^2SpA=yG`fO(7Ne7v+RV;x^9Hc zoJ!bhWDZ5uwMZZfR@$1-4q$}iJ7jhLY(cB;F{?7ZzKO3jVo~Nz|Fm7AoquXgw3}J> ztY%%etY%f!GHfJJO^6cc)zi&j$+=LTXGEdS3yrpl`gWGKzbg=HH9ERdUx`S0CiT|f zOm%wOWjpw%)@+BFWvgn|b*JjII=yZqfqI|nVx2@t)4R_KT*J_8kUwT+n#7KvDj0SuJ+WVY)?(f_EeQMaICDRBqek1 z(?xJAMu6cpBAMKfzen&6rGRcJLu*U^?!;mYO}ZLGld>^1DH%id?V*bH8Mo9vW2^R= zSgfZ>SL>&crONZ_cQIqQ$C=Iq2`Jx#h=Pm{8Qo|LR7@4#q<@3)Iq_`WsQ zWnz)Slde*DQkKG#k`yioEK6aTCam{v<@U{nMA;ez5yb1fl!I7>$tL(hi5$PBHuA07 zXkwAXldh6@Tz0}IB}r_IgCTCUzoNIdBDl4=En|yIJ?`pKkIOFgxa3lM^#m0W^#xf1 zM8PFz3)eE;&Tr{T`ofj8@p(%Z-Ip$Ujw!3DxaP5J-ai_5&Cwl~mGIb^m}A+PBQ3Y( zpCyT;yX8>;-+mNeY*D4-uBvogR;A;TDz&GjRwmYM$tCU%E*Z|+NyFi+7Q2<15weh% z2%gBc^3=FG(}&}wZHSw-{J5)@AD6ZKxTNKc-PGKQr$mTP8Sz=8^&F+ZxUfAXgyr|$ z+GuE22xB0;$ zS?`s*&c`L2TAA8n^Gp}A6N7QuPACjdcL;@Mr9bYf^v7kTKQ1Z#hQSag<-$;0xB(*o zBMd1;Qtyip0s<>SnJBklj*T3Lc1mG*YK_~DElPjfRq2na8fW}+yLikqOz zAI|0U^KaXim*s&m2ZC)AMAdM#lz#RD;5~)+v3U>y?A(2BUyZEWu%Jn}qH_NRMIx-1$E6YmWHzFgqTw9jv1`BIlCKejjuh1SwDj|u1 ztoOjZjA;+IPHRWpsRFbQ*I0FJ=9v!HXcm2}K}*DFee}07ICF zy$LRWgzwJ31iDU+7z=OOZoPTa9XU*1%Z&n0ZWJ^{=;dt5qJ@~mVpD=ah89^AQN*mX z(QNSZ2c2ibtIWpGoQ>*U^f^hkpj?sKsqKR@0)iEeLLj@g64Pw3`yF$q#GBQH=QR_f zY%{LV@*3`XQAzz)BZ^zAa@NF>j0szbZ4?TYc!OfOmE^VDM)B<1D84O=%I}y(#owG& zhQ~FBXIh!-|C3P$l9X(4h=3~QDTxnOYZ8J5#Bw_gW{e~#U1NDovmA+WJCDX2TRj@z zlECG6P2lpKiUB(_hoK&?=APXKrd*~dwvZkTOA%a0I7T3xgDj0GfJUWKV zR?2Dlj%hI3kMGpZKuGhA6WcQ4@7W{%wxU~|Yi?CaZuyRBvf0n=RP<)c__=3K#j;h{ z>Re!}QeVq=OjAvq#&1T$W)^j}iYi8te;67zd!V~HP)1{T7#dbh-W83i9zP5Xo5Jj< zFNf7haSuVmR;Q?QnW9RSqG5SbMpiVMC#7@Ypi14KVR=&QXf#hs_i{be(Qpqz!?RU< z=v?rjQtzQW8n#??YZ;%eqv1MUxui;YIBa;hHowm8?AN&!zs@!MI(H@$d@ZOnuNSwo zQ{z^g8rN`Y_Mp-{J#J@{+bx^iu3>WT#-!Qgb-S6oDlXxbEf=@2dpRzrR$Q75SGTL- z>Xr>xw=i5e8WSrT&4#Pn)o`uUzj6!1bvGK#=49vMS8jDuCWoQXYzK9&%~UDP8Om0e;6({InrH>l+hR-hDNid>0DZBg8}^-+uXxj~U~ewqS{;ZuyOU@Cez<(2@&&29 zsOBDlki=gwv0?CZi`Wq$83SaYZb-0_)FcU}osF7l*{GRTjhY%o{QU?qBrewxM;o&^ zqbSU&6Y=|e#i1C^BLqq<79{24VWY6gSekYV5YUC-JNMy+^H%@LUGE}=0 z8l*UBj*m|*_Rh4cy)!M_JJX82(=cgrqhgc9)yy3mzDEgMGDieY3aPb%KB zpwTG;#$Ozj(HQR%!%6&wKp4x3nOZJ;uOzmk`Q=7k7F&s*E zLp{MoNI6jiUIwsN+1$9!f)Dg}FVC;Q8mFn6+HtGHGqdq&b+=TB)-X#V9B|grl1Sgy zD30P)EIQlp+02seR!MpIN;ZjGWzyH25OFR`zET-FlBL}AEZq+x-oHW%C=c6xskXLN zdCUlIx%Ov7E6lvukX&Yz8wM1IDBwiM`Dm3MG852mO% z&J`)QgrG>Pyo79(*J+XZb%7%!5}gqY#bNPWJBz_+Cke)WV{MEyi=WXqBo=oeGGfS} zYPu`a2P;M9a%E!LIT+&|4u;Lv>tyOpDwp9*D;{4_t=MGKD@0kE1xyyb5X>&_zTvXc zNRTats$k_1YpvJrJlD*2oNHpcQD@TmMxBYcU&2`Y6XQyq%CO`rilmIwo*y5+JEa52 z1}mb{CFC%1!rK+}nAxfvD=eES@0wyEUv*2Q`(=N|wbtxZG%`e4k-CIs#_z0M<&l}K z@Q6atN_F=MpH+#rOnA9MK$fVJOt-@Hxk)p0u2SyyHMqv&Tn>nch#+yRsdx&WC5iNH)b|AurV9iVuW#RcZUmGa3yb`;?kA&dVkC20q-3U;wX&~L-Y*Xe*Kl_coWARxVNI| zb3@(qdhfwiaXs{VAhP@3gC9`J-3Rc#_kLh}-k1L4e+h^e`T03PhZv?_Ph7i-DS+T5 ziq_zj8Wwq+w79qW=HIPg~gE!ybfY&dcy}1E5--B;nfQvWRH_u+Zdhr}Q zzqopFe)H<@qQ`4_fVS5gfJ=FWb+AIgo$wrf`ZdGB-GDC<29_BP5iN8_p)eehE>G4l z&R}%%f5jWu{Efd1-S5OZC$2a6K0)z-PyfjgSm2a0r#ArC2njNO`Vrq@8|0(j0Gt;n zJ;yX4X;`!lg^gTbKpEQ-Jt zUalDBHYiFrC=vMImn`hT5ftfFFr}vWFqYX-r!97yP zZDm^+MN0ltAa10GX()S@JvrbamSR7@8jM50YvI6|w}t6kYRRww$3ilw>ztKP6e3fs zZBBs*`p>t8Ug9qZWEja)ktvK(QC2~OR>=|vQY+|@c@O@ExOBhSCS1Df(c^!~u)8Vi z>q34|(gD5qhT~e?dEQgQl^ySn^gx&@e_ zHFdxX7_6EdWV#|*lwY()MWpBsZ5^p*ib@gzjKN%Poj5>Y&0S6dPcF*mh%58=LNe-T zl$e3y#&FIVFyikINK75xR9y2X;LAWtmZA`3afnjM4FaK}Qzsyy6vAn>e=}HG!a~~- zIUam8L`iK9Y@nb?q(nd^2oR<6N^l2UumceMmZUO>iQ@%1&UGjQKXFzINuV?*S6C#V zj^U^aRYbCMAf&L;N6IHum=Dx|ojfrRK58BnN5<_!@E*(w;UjUofDuKUjb5mbUKYo7 z`U}3mvAUHnw05y+Vp4IgehW~%!6}KwdfmVj^FFD%yszj^Fsv2)D@-}$Nd9;G)6cvE zu80eO>fT@!N>KMWiufc+PnQuDvCEl7g~kjrwfUiii@cd$S*^yKGB7G`7K-#Gg!#Y-LOwlo!4pi*ZgB zLL3oUS1d_UfVfqSEbG3E+O^yct)uqh9j4+Om)bB@6VHFCj=+uf831~hh#fL4e2uxN zqDwg=>jjU%Ee?N4DZJewnH(H1Q$*M09MIC z8LW~U7ZF)XBa^PMxDY_txe>X;?b$?k)QU}V?DnyV0lgcW)B_pzTxw0TzIf6NhSZZYr^3|qFeALiw7CP+(gGe}QClmPEI8YoYOdm*yeSBQG zLDnEX3MU1{9HK%tsBm^OFejrZjb+rkD#gxIZqYLgBdXFFV&1Ewmv?oo?9-=Wt%xft z2Ji@cA4mEEEM1iiU+NkHNNC5)cXV1>dg!tru|HZqKK!adMsJV;15h)IY}p6I>?Fb)SW zW_X}~Q9?ROaEvYlD_XcqHrdHs1rR66qUe%DIHl~A#;mBytccmDtHE$Ww;wru4edObOndw$=S%Ajs4jO&gT%#+$oxk z=H6ns2#07GqDe4X3|$Y7=d-Ch8c+S<$PeHtntPLQej0@HX|Nj`(L2W|ZLm?k-=H+* zYE1ZByoGiRwa-Gsw4t;5vZ@DQqsD<`@Tlp>M$%u(W&!h3M*@jl*Uq8Kh&fDlp4 zeZPc+wEpr2Q%vHQm~#2|3a>@1TLJP#j9J3J7Kc=1Yp{~dK_uH(U=oq?@Kz-BISEV| zmJ;5OdNGdlKo~@VEAv%gyt=Cgnx#u*gIez_xV z+cC7<+TfNM5oF0Sg&_j@YutB#p7%|UxkZda?ILh{^h#fX^;F61BN3x2VJTw(*J={3 zQ6r%5WU()OaF=Mp}9BD$Nug0 zH+g=kp>@Shvt8lJ$A+FY%kv82Vk*g~3^Dg6r6oe;P^+2jpZz2s_RspFVrc)kFPN`? z*7y3q|9sr12&Tab(R^O?z8iS{=99&Zc^6pf*f! zygX51fdNe9!5lu-1J&^4i42@`@06{O{`pAJ*c2ps4RPFzw*zi!M$@%8UZrKl8F+RC zZvOiWyuCRG-yDIdCJ?_YrPqJj9Jc=K&a*6JGoj-%&7 z{9aS<`r%Cy+3W-qZ$u7?dcV2NJBHF2Mi((d=>i6*?)AN;NF~`|buJb%CK5zM*q@th zYTaWE#LKv zSj=XJbO>WWbQ4X1yqz`Q$5f~b$b2b_s@<0PGoLFPTir>9VwPh0>j`4P32#Zk0IXq> zaI`KidFvEW^(ucZWbB8pT^NP~)%}1G5imk57zhjo_n583p93iIJ~_%M)k3RboPR71 zHJB}nq6=G+$?DO$v}FX`TEygS-eoOFspjfg6p?!!q7{*B^o~m+%!=2P>JYH-u9$;@ z*&I;7yTS;iH_bNri`9@o=?(3zi*MKZmb#MpBpwONNycFER#1)rXHo>|79=>h(@yh3 z9DdassoaS^26&y2l);!;R;EsE*z4i*S5;%Q*U2v$cJ=Ys5XWC=IF5;`!yhT1?_2y1 zg|BfKMu^Kj+Ta4_3X^CH7RI^c0&D)RdbPQWR{nTCnpIefI-g5n9Ee1wb74$UVNK@#wv6G6qzwa_ zIINc>C=MlLnU*g)EqbAOx<~$|d}wHbOdoD9o5~u$f?1wYlyEx+9hDH_*pW;m{1B?F zzqRfc#o-{MDo#}zX(7*ka(@c{rD1o9#is*S7;Ng|dP0pAwz}194;_&rXz;nFOz&)fRow{U` z#agFI&ez#XqIG@@U&#qf zp{C0rPNdB0IINpxfwsZ)+W0q?1T~WP8Dga%wN&NVf}3D_hP~F2Oo!h#D1+DBFcEJ{ z3s1JwQd{n9;#gjlNssyZ;r}5PIF57VfD2&@ridf6mcbAh15X1uHVhwuGl`>Z@mRbC z(>oLbsB`wW4d}C|&Ju+lzIk<>Yu|hbz9DR-vMAr^>(ZrZ$pwt6HKI=^Y2j1qdS~3i zY_m`Ew+u9tH6~^UC)rmT@5!z&wYI0#->gs-g0N0hrXxe?8po1BNgASbeE%KCyv4CNkQXnxS%dj>Gu@A1IoWfB7bw^U)dZa1Z);{<(Na$? z=flcokiO5+Vkqjz#@!V4%|O-2$v#j)yZlwr5ny3{Z3>#*KQ zZOc-yFVkC=V|N_-Bi}{gH1NWazd)gP8qPz{n@;D`2@2+uMc_{-p6Ablkr(=-5DtAe z7`a0@IvtPqA*4MZ<(}q4xyJ`7H*b9%>V^Janw7tU#Q36#2Nu>#b40}1@FzH9yM zSq$^QhvUh77w?s;Of(X-lZwqdJJ;8k(0=VDSD=q{_z>`v%$8)$V1 z(f)yQn=B1N|Zpw>lpeR;!8_=FcyGI4}EohOBBpXhG5d)!Y)9 zr6->0Bo0wqQ9u{n{>Y7nSe|JfFtF5$n)Bu!kYLwDy)F z7>ex22Cmf09WP9xYPr9F!x$7cTSG4t|Et0Yv)SxBoTr{cIWc6BUs0opNztzvqAaJ# zSQBg?ZKbQon%ra6muyfjzm>zjScup!XN1A+F$lLYT;o6<=cSm$>KY}TpH_Myzn$s! zxRjxkzl_p`;F6j`6A~qBByVg&5k(T1ILB1JZq0l%i^YZm3c*vO>m#v}B+xjEBJLj6 zZ;RrplmipT=R}PHy>ZzpT9*CeT~`bqOq**Y^6)imPIe)t@gfk3q5tjsaRH zZ2KIi$I7ogF7lI(i^6YQkI0>sW<1w0(E&f3etMxElZ7~Lt5e?A`4P39Q2#vA({uB&h(({Nj z;Ya`+sx_HjvX`8VA5?$5y%^Y5d!$lypQuvPYQxh+P3(t;Xmb#Q2UUFXAkwghClGwQ6r|!3$EX{tT&|w_pUa<&@jrx{N8F3Z|!(AEEFAg zuB;P*LaSAhcR~@nG%hh{Sd-6myk8hA=8Xq(qdr)X`&gD<7q>Y!b|sbZ!OVYMTyy_8 zYoNd{XH_SRMvCAAOY=eU%qW&L9uIWTb`K%Ft9LFPiO%GCW6l z4zG#uYE>flbUGF34TVz7a~cH9H8FCTRBwCwks%@@9Qj-S4sH8qeSL1Qf80;xS>5$^ zAnKZ)tha;w>F+;R)U@hW!rg5FR#5p97*Q39>?XBrxYL|g19^}wUFr8Dn{RXlQxTYJ zj#TDJ%-WsPop8^bznWKtEEV#nAEY}(Um;HGx{>S1QbpbT|TA_79WVsGCZcTkR&7hvBPiPtis-Ns6%A2k2sehl?+EwU&`ioa1 z`YBI*npsN=e1h|yX7RttidV>fs#E{Lr;{G=NKrzwJ&nRy?@sKUR*Zv8q+mo!K#1U z7k7}D?};DYQk1Ii<~0POU2)o~oB^bf0~$L$_m?>VDT9%%l#ehde>az*POVe#)pu$N zpu0AA)%o4>K_@w|0Rr33f9`?}XNsYh4`r$rZNodxSSAMwAY?r-#K~qVi*w3?yngIxfCA zy15PESNeIPPxwFA`N_N^BWGQ|)6^@iY>!kcJB#NF zjO4wPe6DE`t*aN2DGisS(_N@YFGC@?m2-0@4y@j)dmkk96^TNsVd(>UN)L8;E#teiX$`cN>;@$<`far3t8`QCY6=S~Dq2J+v_>)rb%J%6}34NpfC->Hi z|LnJZkYxR{{>XLRb^o|8!*2bv{^@tP|NC)Y<=h%Ay>h#;`x^IuFU3l9pE_Zef)iPV zi(1ZONmNxaP?Xv{%X+bdTmj_og1n}M-Xg9Ib6${y5s;81i=@0!?emkPN=XVGD0_6k zH>w_qjGZ!Z%*`l4#WfR(gLIoP89Y>)^;mATi(N=@-csaBY%s;@AU}+^a}sW4=Xw^6 zlmt~mc7Y?MLwD4jz5T5(YARf&c!MLfL@#InBf)_xuyx!w>p}6EtrwO$?kD>FFn>*N zy%hvA^at_PwRs{R#|x6Kr8KW` zmIT_BtyYXByVy!V@5*7a_`nX3F$vM7r9wd|heNlMnNoVKy&^FD21YOrP%32I8{JM% z0XN?tpyp3rnv25|^`SWtM>}b=RbIH!0~5Wdu?c3*XmpZ*0r%ivWqAN(s$%fqvMjSJq9_v<3i>dXgt%d z%T8yz!Otnb-?{j7zUu9uRb5bPHXpZc?pKJ?~6lpi7iukq1EH&@AojiXOGsi(~Gsh$cFNAVw&Z z4vqqefB?wHYFq3C?y?f{vwp_I0Zi}-w-h1*!$I!(o+Kn3Y`l{vd0CL7pKAoIxp%!p zwhY~}O(^2BkSQlz%(A+9r}(Ap&wN46-hk>YuZwb@V#ZMHJOb?lZwK|(nt~T`$aNnA zD{_B0dBx(?esa4(%Z)!7!oPdqwaR)wy?PI z#BBMY*PaN7;);_3s@kMxBq0%5Zm$#WfS>0#uGG=f*R$B(=yFGk9y>8)a@;id0Tu8E z#U(I$U!AeW{Os0Z=;r3{Wg(<0jDPgdfI=(^b!W1SxIPLh?t2#4$h0(ZKKUju znbc4~)pEeOQgHmttO$N<)Xc_lh&MRQV8q?JJ6$bPl!2lQ=J%H7*ZAz*{rC~5=sR)Q z&yMYnGN^9*A4Nya8z7ZFTI_)2Z|?20p`V6)8pm~p?$C2*-Y74UGKFZgICZ^K|8#tc z!ihhf%_ob~#dNYbMT^nGn~$cW`EWR#pSt5Ia%bKgy7LhlFDAp;Y_=COxf$|jzUsg6 zqwfFL0nCTL{D1HL|E@clx|RF?hf{y}`TqaM_zVVv-U^54tOvjVFcS3mFTE#4WSIL` z8;tIIy}w2{z5}ZiExzh&RaHm_mJ|QS?=x zvTcOu3L(}9Ctr&T_FtlCJrE0we|_@g3Ahem%vWI+G1}|(dhfv-0$yWU5|3Q^W^t$s zt#b);HrV%hFM2GrmhO=&M6tVWK5E3~kDj;BpU