From 1c2ba585dc3e4b4fd8d9ede2a08134c42ed0a298 Mon Sep 17 00:00:00 2001 From: SmokyZone Date: Fri, 18 Sep 2026 19:50:46 +0200 Subject: [PATCH] add openbao deployment --- Chart.lock | 6 +++ Chart.yaml | 25 +++++++++++ charts/openbao-0.29.5.tgz | Bin 0 -> 46877 bytes templates/bootstrap-job.yaml | 70 ++++++++++++++++++++++++++++++ templates/clustersecretstore.yaml | 20 +++++++++ values.yaml | 68 +++++++++++++++++++++++++++++ 6 files changed, 189 insertions(+) create mode 100644 Chart.lock create mode 100644 Chart.yaml create mode 100644 charts/openbao-0.29.5.tgz create mode 100644 templates/bootstrap-job.yaml create mode 100644 templates/clustersecretstore.yaml create mode 100644 values.yaml diff --git a/Chart.lock b/Chart.lock new file mode 100644 index 0000000..07af9d1 --- /dev/null +++ b/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: openbao + repository: https://openbao.github.io/openbao-helm + version: 0.29.5 +digest: sha256:010799b5366eec27e8e4d717e352e443850ac3a2e2bff05f13c6aefbd560a550 +generated: "2026-09-18T19:41:59.078705685+02:00" diff --git a/Chart.yaml b/Chart.yaml new file mode 100644 index 0000000..3ec1973 --- /dev/null +++ b/Chart.yaml @@ -0,0 +1,25 @@ +apiVersion: v2 +name: openbao-gitops +description: > + Deploys OpenBao (standalone, file storage) as the cluster's secret + management backend, plus the Kubernetes RBAC/CRDs needed to bind the + External Secrets Operator (ESO) to it via the Vault-compatible Kubernetes + auth method. +type: application +version: 0.1.0 +appVersion: "2.6.2" +home: https://git.smokyzone.de/SmokyZone/openbao-gitops +sources: + - https://git.smokyzone.de/SmokyZone/openbao-gitops + - https://github.com/openbao/openbao-helm +keywords: + - openbao + - vault + - secrets-management + - external-secrets +maintainers: + - name: SmokyZone +dependencies: + - name: openbao + version: "0.29.5" + repository: https://openbao.github.io/openbao-helm diff --git a/charts/openbao-0.29.5.tgz b/charts/openbao-0.29.5.tgz new file mode 100644 index 0000000000000000000000000000000000000000..c1b509b2cd8732359793b36c809299ce5fa55c90 GIT binary patch literal 46877 zcmV(~K+nG)iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYMcN;ghAezto6}VK+vE3sUDfy8M@8rxVvJz`z%UYu1KD~PN zvcW2lM5|b+22he2+xNHMg^fp{o-B%#Y^SYW9ZMvz0c>n+>^E3Sk|}1x;|1n2Sm9;- z-OhhTqtWQulPB=+Xf!JSd+=;@_}#(N!>5NoJbU)T(`Vm}4i29^8GVOFyPrz+CleC$ z??zjXRbJdz@`ICvNh~Q##JGnL=912EC>Pl@pllc}a55)ij6U`dLTG@lXcCRljJ_uk ze1cF!M968XAlPQ=XGY&Y6bVknf=N6li5!HSCI4j8M`M%;g5-jrka12ziDEn@ae|iw zVS!S@(bbOvMJ&vgB++v#jIJlO!T4&(G{TY~$Xa6 z@GLm&6;}0nHlrcMvF(rGu=W;AjlGaE731M>PGKn_TMq4+HvbM5BwqGts6g4)9Nz@G zMW1-1jC%ugjk8$x z2FSGP4UjNs?F|q~LcW5P>CZWlqBlTGoZvZ8JKh^0oJqFCrVUMI91F>_P-dL;uCgg{ z=z8#9KcR!*@hBJ#Mh|*wf@&8DhiQ-{rt#R$VqoX+e_|@^9*J4N_`HWuc_T9(=h!k3 zps8+XS0-4-Ljt39-H2;D_fc^8KZB>e&wKvu6t8id5pg#cKr8=0_~G%BX9p$z|M=kG z@i+c|A3uBOn58RD=L?A*hL6w-EEe>b@pK=ZCSlOqLzDC8|2=p~Ly`zGIE_dm>5M9F z_UioQ;4m2VdVA>T8q*k0V}er5@sdcw1;RyHCXpmEj^l6Cx!|=14A7JBB3B2x1%o+XhfKG>%O- z^+iMl{EFk)+(OHgB_xpo-B7upi3SCeLerI@f_|v-7-M5MUo7#UWfV5lLgV zLXrjOx$dlIwjk)8Vgc_EO@zd83>+@+8yG$We~eMT?}j*C;yFQS7RQETDtPJ|RjA}- zPKD$v#WfdddqRL4K8_RfRLNXT5^@f$Oe)1j`7F$+~1mV|&BOFDXh@8l1@=p><#(^A#|DKO zO$90fg0Wm9q4>L0_m@|VpO_aRRL&(VT3IKKIoGpo5kW8onIF^i?juWCKILT5JlWP)}M^I!6z@{W-H)u*`j1zr+9GYhY zs|!5Ur zKL8AKlEyT|VvG(P!jD-pqw|at&5IOq7O6`tSQbY}i54V5AhD`OWAx+b$C1Bp%Pf{O zjfoouVeTEneUIfJjADWnsRBh#6){S}mo$NS?;)X>3YLf^@d~lTCw3{xGSz%1d1veNxh0e5IETy{7LNa+r;BeXYluaftg~Iu!tb?UagdHq;{T$LLKUq(L^FF(a?OT zMl-*b#&Ja2c3|wnHa{}AWfwVjs5{;{`$K|AO%$A@Oka9--LO}+w7t*{ZA z#Pc!g9|S)Hhn0?Sg{3T}Vf~5%b*>e3Do{UGWGegn3dO2*|0uq}D>EAf=^Ox!(dq1r z$#YJG(jM%N0}D7^zeSdx*KUyg@<;&#$VO2lTm%SRDn4e8{*>5xs*bFzvzg_&zYl`P z!NLDPQ~*>?{*_TqfR6KtccKQv>gwp>Um0F?p@u35j~+@&%sN`|V4;EKWSS3wM3pPM z9VC`Czc4f3fzog^w!flmQ;x2%|FH|!V2(Nf)bG?_83HCe9v~3R#e|$yVr+MRNPwdBgh@=a$Bpk;zoxE?$ zoz3?Kmq=Y;F&J%Dsos5KEI>C4lAwg4FcXq3^M>jy+IuuG(9W3pQSe}ysV)O(chX=xSdaJhp35k0pMusA}JE{U*$-JD)4lFm{9 zTy8r?hxveK*>XxaXc#19NhA=SDd9n@VunW10tImK_jkw>(>Z@Np*{9#6md9+4t_hzi;dNz4@^!2|G|5uX zRwHN(whK=vkQ|3(A4O!E&G$ig+ebH;C;NzS4%UyD&0nfcW7Jn)w@yWiewBHY=Ac`N zG3qP1A;LWB?;GhP&;$MgE&K+0RBuQe$0aFM5kiPLNZy=WvnyhZv65YpM9WZOk!iD6 z#BLH`^{U*ij1OQf&P_DUnroa#U(@2n1xp;Wsx>=fc0uYW8%+2iG^8$t%cg? z2w=pq>cu-HguT>}(UJo=6}@~JN7k+`@sjSj3)B|*GhpHz$ZR>fa8Hu6%nbfjle^j zhnX=td5=SBaaQC=)|r5pz>z%mW>~&YIA$)+`bJ?hA_EwF4EZ$B=?qb+;G1TyL5aSL zTYN9rH8>C*5Lss6k4F}f&NDF~+FodJDeT|c86hO6p)scCxRea6lm?a|-Y^F$J{O(k zGce0&N0K70Wg0tyrh*mwg(b?DcuHd7eTpn=9yr4`%8k*e1|s_K$!-FhsxG_S0SLbM zY}nW9xgF|@xafd)ZO?4SehH|HC;^x!?^8}-UBYVe19U}JW5s`iBEHl%x@Z*Ud>Us= zo+j>dZBH1xzX#~UhuofFO>cpM)kgvP^l6}DY3$q!7sD}2A_|c_iY_qtA{2)^K6!~q zKJ(iUiQTWydKrXneVfrq2{}1QSU2SYivnH;c~F!`J~;}<=)nSuhniG^C6PG75(i!= z)g$zu|Cw(e$@MF9TFWD)P>t9?ycXT$~{rsq+MOtjhFS8 zaaGrIfdUU`xTNc@iVhcayBQU5yNfyTt7Ub*Rc@Kz$u?`uAs1z(UL_(PZYXfA?Vy* zo*3prL!vZOP`eDed|&&VBuYdgFa*0vDxnIL^a@1H)vvk0^+c$o=l9KjZqv(hFfEE%ZT zqb!MufS4;AVBqi+(<=g_4m66nb`vXjSA?XN0l0dvY%R45uk{0Jpr6Via_-5 zM%@LDW@&ClW8wwEIU<}n>D|1OP$M0$&rv2^I`ar-9>K!_!Qn z5GP>31dB5LgG35(2~q3_^OaecS;QF0SOg*0C^oCnA6}7F&#*il>kIZ>@?PfVQWoU` zwuw;83DH@DE3RSH&jt`58<^B_B%UQl;*2F1j7jIob6@<*S(c8KXdk@MVYbc|IHwW% z=mt3$jYjCxC%^CSg7EsTS-ET8b9UPy1qnm8OwTz}bdd8~xk||xU1W)*OJba%@TJ1w z%txFJXi#Ej9J8BqPOoW9=Hx_#SO+|gz1U2k*A!1_OeG~ghmSZ*y+4(-e)RGs#IhB3 zL9^17MZjPIpq-0lxy}i0n(TR>SX`UCD<5%5mJt7N`1IK;>OKwAOno$3nonZ7q?`1D zkBGWSPLgZNS)#b-8_Y{88?-S1 za&dNYc`|uBIk|XqdVKQs#p}uC7KnjCd5RSBF53*j$XY)R))}Fhb)?;Bzzzcwxi7`iKD`%qo zk^j_NCB~Z?8P)-XXyyb$mKDRfARtx+aLIi7)GzgS@z&#llB$0sOIgh3tKZ0~K!}tL z7feVnsu&$mH*^li214XyHtrNYbHn&m%y1-zs;~Obz)of$QciHB#9kperip|Yn!R%P zm!b8}gl^$a0Q_+dT}NS?vyHGl5sK0p`&j#cLQPCeC~ucjdi(i%1GP=qHu9#ZPL$Ji zw5nnvd>|-OUA9_;RL67QxX7dlQg5AJ8f>=h#i%Jg=s<10n&NOz{kNdV6!l7P8TJmC z5{XOa1M_e(MtB)Ld!iIbzmro-&N*dTV2QD)->=j(IaV#S%wvOrI_M^ycr+l9DH2e> z4RXADD7Ty=vdCZJR4Z^=f-KJ>P2*M5Bx)^FdNGD7D(k55rV1HjM+Lh#S*)F_nYulUkc6;F!yxGR>{OkRliwzfdI-9o z>E4A%=u;P0Zd3xN*lU6{G5s`jR?baGz;vxO4*Jl%lc`k!Jr@Z7puTf(+Z`y(sCF;P z2stvUWFuZogDucwAT*m$k5EJf&r+S}kVSJMjXH=S*m~4R%WAl zDxEA+>aU>c$l-*rOvEcR<7|npS)3&j^OZL)Fa{PqcOU!=^Kg=G-FJplE%E!`a}%k{ zc2F0JB=Z$)J7|`c-+SU^&ODkWI}G4_zHC9e+2tR6w1PN`l|-b|Z#}shzn^4$PLvq^ zAO5F>73AL;g~bQf>*?D?19b@vjHCXbuajPisUfC8G2bV52I~|q66H2FD@lPdgeK_i zg2XA|B9LjUIl8(!TyU>%3oGZK?4b*zqBzxL-_X`RA~FmLhmvp<#u=o?r7;dkzC{|# z`e3T#7*S3_nIAx%3uX?f(~7jbts}1eyL=D*oF}Iw%s_MfoWq<7w8Rk!dK;xRn3Zf5 z$zB8F_Mz-Pu-(V9`_Ok4%*P6!i6rHCCTFSfEQ|($_b`1W{pAB|e~n&5%A!~9 z3%d*b*BnCbE(nfRwJV9)e6Dz69-3B8FUfNWcN(GAIvW$6)_p1_P%WQ}4M*EY{}gZp z{8+XAmuPu8P3Dm81y%sH68)#s?M)aZB+NmiD>TdvwAw+UJsRpp_M#U};FS;#lj_zF z>}BIw8z?wCUCO3T%AGMalG+#T+RWpK42T3VZn9R%`;?gy8fNDEuBHZOnIy&ROT~os zLTfYc)JJhHZD~DxPZ8Q|M#HgNe516eT7PuEl}!UMZ~$7(7$tL>yl-eKV==%XXf^8M z?Ym|OIUB?-!5cRH8YCke$19U)2oRl)WnDn(j*Oh^$issd646cLw8SM82<#A<1tFHT)>TBRbUbY)odt}!0Y9> zWsupX(`(UEsXrkWh4`%<;6Y7ppoBQBeK1f^(_$`Q8LUZ)&Vr}|8LVH%NfsbKE9HJ@goIp7(SU8N}P6hH+ zRfB#l1m|>T;zsR81-W*1UYrLSz!b)4_!k#2GsWQ*Ng_W0tE92&A8nBoA|7y}<;lX= zkVIYh1R2E&>IjujiH!Yep+UiESitN+#v+I7?Zlqlj=GHiUi>STUbop{}0qk5U*Y+yzRSwx)Lmc3g z27=B-aP=b`w;n>~tD2~74|;%ffj$aZ}siYRcmCkVSVB7^A)JoZS0 zB*C0AeYTf$?nfHSSirPgs$BK9+TgxwzOihxL6nF9$LXSMwX^o-`V(p3Xu7c!XAeV5 zhdp$pWe;{uIH!@brJCIkC@&7B7_8#02&0J3AV@=^>pU>ZBPEa*tVU{WQ${BYEGE3F zQ-&~tocCI)xjq17JkBS)D^9u_URuvh-2g9*2kjgyY+aC<2-Nim+>pdeqqv3nK}eWI zhCoyb63_D4%G&g9EKy9b8YUsOuV$U<0~_da`Ep{aK@cu_mVMhvRY*ot+Hy6R-*}%F z>cQA^?mj9s+_OTT4K!dzuu)T<(f2TOFFwdjtpLM=Fm^2l*6C8=ATKU2&%Z<#vWNb9 zba8fi_Ujm3Lb(jhP}Po@D1T0H?#8f_o*0E((S$^tgy3n645dT898U0+qKafL@*oWt zic>7V1M&#rC=+-NCYE>hjK9;T3b zD+8=dv@;q@!u@Smn{JHodf*pOYUmYppKYVNyWJSv`xs=Sj2p8@+o|Y zk2;>M8@QXG=T4$hmI3b`S%vsGm!hDL$3t|=#u^^=&J8VAGMqeC7T3;U$83HAX08I+j5w$NU)0RvmV4IA5TtpT{~oCB&iW^CQf`Yn~fy-Ep6u@G{>SvFtv zkZ#jdnC&jjX>Lth8Pn>F*mYd2-NLq~SgAvlLJ)~69#fd`1INE-biS{PBG~0=Z6`CO zGV;}G8>Y|Cmr(0Kn3!_&g$<8Z@J*;W49T5+%bu|u(zvjjI_4yki{~UJb1a!HnyN_H z`iVJ<37XO*G8H7%34myb+-T*KmWkZACC_T1lvXZ?%u?U-rKSYH^tywB&(6=413Pi4 z=7T8+;g-}^tPo6;rwNtEuI5$oIF$sVSBvVdj=hHfx@eW)B@L0fnrwJdaYde))6CEiw7ve+Lee;!(*&Hx zB+^oxE>DeUVs?3$2|k1~FpTMxyeFZq`!{3?-#AUtjKvY*`))8@0)z@v1|~A0$Pk{g zBti>ZfwK&og4qU|GqLKp0My5EN)ys|pDV2!E1v&%vDin0(Ajbk=JSGyc7VbN4dpUL z|M{N<3-OJ*oNCH(r&*d38RMxir42QDOl?{*uyY)89l+ihm52ETNJqT(uS5 z+pKn4@y>FRx4+yBR2?+~FhKY|XkQpt=fwap?ziiMp;*Cl4Y6GOZ-~#BuGrO2xsbGn z)QVkfVq&;?X$e*a3Kt~2vWaD;p7EhW)%_NLyT2-4J1XJz`RaG=sCd`o0?oUk&&3*( zUSeHCoyi(=MCByqP=Ttg6acBJreM3`is~z>_%WFg&NT#eOnxO2Jyd7l5i)tQ#Yt+T z3%4F@5*|A#Bj*XjDNTlA;rR%@rC`ES%=N`H1%@ND#r7nFEG&ySWukyTo9thlI6 zb&cuk+3K`t&T*(N>39`X0~pri=h(8v?$<#~X9Vorg9T$(kc{PN!@sJr&WrnSFe+Z) zwj79v2}!jPJkn*EHAcupvJ?qPQb@dkKPRefxw2tdBG7zAIK|M>r9uo9aM7-UV*ZV% zG@ImlVnt3b-_X!0{Uc8qU>r>ulR|QwLRPpE&#hS@fPhsYC+Y}z7OI@hIVRW4;)<+o zciF4%jR`BgsZVXbcxYTwFr3AVi8}Q_*=$NJ7H5(TvP2LZcgTJH_4VstU!J_ZIQjMT z^_hJVqWInU#q0lja(p>P%T>zRKl8XG^Zn8J`ODMeqs!CRXK#-$PM)8fU7jAjoQxX~ zX<+2P4MI*L5kTZ@j#pjt`EIalbJ~TEM2W9#766zB$a^ZlTdrqfOvkzGUpv9VHA<3e z?O{9m>*Vd^0TN}c$x;X55$>Bm%>>dc?J8)fxPW#~!M+CX#923h?P}enrF~nmeaMfw36eG$0hLT?m zGL@_6)Jy90ts`|vGT+$ie~GDcL%L~vMQAc+pdzliSbHo6>+!0t%-2c0@~ym;Is|uC z8=z|$fL$b1w^cs)bCnoa3+2`|1@!sxLpHW6DUhe6e=8_ZDkxA!&9`y_UrafH6Jxoy zndx5kTyfV-13!SI#$H2o`cN)x5HFtyL=Wbd)uidqF$=GXar+^SxKhNxH9i_1KFK8y z#$}-_XUdsmA&bZ8^7z~XqRkFZo;)^+yEh5dO$o3*e;PCt>$Bf`zX+!`4ZlMgeeG=Sx6DLw3iY}BQ3R5Ap6pWWs}Him znRV&-eg*}3UrS+1fH5kac}IFi=L0aViEO#Ao%2y^L$j&idu6I%AL^-KE@v4B?x0j2dBqnCV z6xb~0Y{Hfqn2;+6$3+K1Ed`0M)jEV9Se8H2sIg`4f>&3AJAg?Ud%#LOhn4jXP{Wh4FnsJ5ion+g5}8(WF$4 zRiDmdeP~b5$LNeDB z`=U3tCe_U+a_JXQ0gGJ;wE;rMT6%L7V<0k)&R9gwSx%7JWSckaS>N0s*4Qrj4QSK$v=V|eNcdmrtz?+*+ z0eqg}*v#+9jeB~2{lx6-^)nBMC{MzNccHC&wE#_X6o{0Bfg>rQS>cq)MQKdSXSfsL z5u)iYfOc2h#?_dZ*f*3N8R}BmUSSBkc~)c61xsj>`7R*6S9B#!Nx z%|WvB9x@J7FU*ya!rK_n88G-8Om%G=Etr9h0lrro3ZQQ%v%5>=s$FYF^uV4^NMsO! zcXRlXLiyg@&x2!udF55J%?9U}OU~4s%#vo)n2N<2lTb_ONbiqYo*%z;sjc|{m|d{&xSoh6U(m(>`w&VREpI?sIUXt zHl0mpb@f2ZXTv?0dSr5z{D;$Ok>QxCm+}RyTZx3Gu9jU~f8S3XOze{Nifm zv~>(}oJ4Gi=nTbVCebv;iF=~X!WyH;qtR%zCYj=M&Q$9hXNCD5e8KZIGJ0{shlLnN z7yncWXr;m=f9m?2HPK9$I=@MMuJ1e>D&r(w$HkU7O@WE&s2S*Zp2M>S(jCOeqV1w& z_1f(Ms)4eNp|ZwbOeCkFDA;Vr=zkuJ4%|on;^B+lo#>=H*Ms&-2`|P_^EvCHt}TbE zu~d|!YRqOJJzEj{{LL{;Il>Z~>YI$?Iq}NX8c9c6LpWB4&L;etwj`O;r0xNrN&-*O z6=M5KhOQEJ16kxf1aq0_ubK^e6Z(g%QK=ST65F&@g#JOs=wS3KHI3CJXWoM%CdW+m zu{;Ib(Ke#l^G)|%l!Ka*4W~TwUt=*V(B^v`#2Fw+n#`28Yo0zah1l%1pUaE(qBP4z zVCJ``9r)rH&uanTd zu-allcQ9&C!OME8wVmP;v7QqyfZ8aoULR9m4|F1@d93s^5)j< zPS$KQBG&^W5|(dda^02(J|PmlIr{zO<=f{cZ{A+Ketr4&^7U^gXKzoRYq1{MMdbQ| zF?q?ZNHRu!&Y0}i@1?FG8?%HIwv-m^N#*CoH0wfiX2K@&95t|sX=|o-gf7c8Qj~*` zCzoXAO(HdLUkO2dEB#nzX7!(hNwlEzMZEF?92G?wQBQrZ6mj7G`bxnRMg;y&2-UbC~U%JJa^dHTii%fKS(j7c&^$2AGn z5JD^ANp70tr6dFrkY6b%cnZDc*wDTd3vt7ER1?(Xt}|nMZjO!4ZNIiH1}nLV(+v>% z#THefiB@VTRHJcqG8<2`Qgu|1;nj~~sAzr2vt+oJawZ8p6FG3p8(8N?fl~D3^hfzq z#~DRG6-tWOQc0*U!?ce+n2(_v!CUJy{R!m}FxIm86YBqcJpRX6sls{4o-u{Jt!Z_T zw{m{jEb$7fDRob4qPE)dL-$G?9O`q76d@|xGb z9-qS;Y-=@9)SriGc(oKcLiTiM6jY;8KR>zH(1D`gfx6kfrkuOM+eNoON z(OD@9P@7U?z@7U_=udQ@I+XnBygp#9c_IGi$B2Pr!QGn)$}W zq@&YwWSkLNs86Z-v-k?DU6Rk;ztCmb;l6+P;`QY6?C90Wqo6ikeU`qV8EDgCzX^3Ncj)c}it;^QIDxE?1Ji$XN zx#&aiXg}voFeaQ$&o6HP=SB&a=HYLZWWI2xt_5y29g}eD?Qxbw#0Itoo^{W68M)v` zbNd)B0bmvWO*9>ZRA@(c5<#*nyM{6#W*cH-x8``}l?Sw#hXs2`H~2Q~YD?thM0}9-Lh_{l7??WoC%EdL3af@u+ zEFG_tkGo39cOxS=NXfU7lRZh*u!OzOf(Ow+5|w zuM=rr995*6dgstLW%kdi%vQ9-5J;p>Pb|DlRvKLiD{oKF$3H&JC*aOQ_tWrA-SpMX z!QqokR}d!>tC<INa3RGJuznC6 zJ_$yJ8c=qZ?X1oF19}F)(Qvq^pvE)Xm_a;{3A@SP=@14BV!^l^#Pk}5Q@fle1As%y z6r|Uy=JtXhQC`l%1d-F3GZERrop@v3ZrxY1%`Gy6^|FV1X1Qjy1DLNZ?r8-8+G~Yo1`4*`ulf=$$V*%GU;J*#p}iuVtX!Hp$Z*5(8yj znx}^uZJSyjwpE+4T6*t!>(DJ9Sl6_(Du*f5S9Vo>Qo@&12*8P71gT;t@{UTad}!1n z&0>Si4RQwPzz15a+3eWsb1Fi0Z#3ku8P~N}T)oE=QszC{ z$Ft-}oU!DBF}<}^Yd-LMCv(a2W)aD9Ilgx7V=%3b}Q zv)c|SNEotZdd`_rr2PaE^Gr#WD4Eh|^ts(YBRp>pMPkl5y{0jllM@l*xRCA)?Ka-`Q1>dn?7WkrIpg;;aHj1GT_xn6NGQxIXKgQIU8r5gZBGr zFQYmb?viK3h9uwMq!^ZFvr|YSdG-C{-%mm0>v{K`ewwsWOdoQ1jH#UHs)i;FM~h&A zx}r_NFHoKKT@4_(3ME5*Kg*$C%v1AZ$(UgsyJ7Ri&_k%%;L==v`*C7xt?Q%v$kR~O z6!oeqrsg$i9#&v1#hUBKA@zQGnU)Y4q;s9UWXPUPG=Hrb_&GBblr^t>)z z?Vgj>G;uU%sukzzrK{~Cmum-^Tn+@_)Zm;4Lrcp^x*>j2Xp`Zg3 zrNMilFk-@BP%9~zn-uIzHT_Y9$&w|uj;W4su`!*duVsGraSSkI0F;PRo&A(zjwMn2 z+4v-Kk3>_i!kfx-ElUhcUFo5J|GRnp)hcRcSatl|I^5%AxoHjjFP`lR=AmC`F(wIp zCDA2~F-N60l8)y3E%twcM4%-~3mFV%VwHqQE|?$%*ky~D`L0G}>Dkv>j4(PF=)dh_ zPb+I|Py`nWs=qa{FS^AT_5YRORX|z43M6H108%EXWB|hY1nUT-0$1XBGgyh|W7Izk zM#1As$25!M{CTu0fIyM1f=&hMtD`Jr-<3(|AH_F#Wo*(4l4WJ5voj{oIT0k0?%|Ao zqXMd~{etuvV!yeBR8trj-fA!6?BA}aY9sz?vruFVB)C^wKGiyOtTk%S`^0qu z8>#nVU6^KL^mMdzA1uidPUXSjkFTitRQpgmchbVV^(OcM|Hdo~mTbF|$CFcZZch6H zfnK~iI!0Gy8NnI@;W)ML3qG_c$ zW0po(l8LFr=H6-3<^=}#)9-0yZSqx@iL=i)Td>@SpVfYq&!WZVYPU+;6Trd!5Ukcv z^waHVn(rt);Gr3(`A|SP91&Ik}akEE1oUL8UBeHLN#PG%l>5{^;$XsxhjmYg}8| z7`44#0l6}99hhdduLfXA*Yn_^fwSv^ z2VsFZ)NnEnfLj?2)WI6S4Z5H=KzD7hT^~d!X7gX*0FO;pD39#tFUd8D#}HH5Giq^B zgs%wkRWZISf*(G8_KJF+gRFk2h4r#D-@R{BscXZoTI*cbN8m zYV4hhss8Zk9S9bGU?f>@ui!)|zC+;U2V*oNH~Dj9rlzxd^ZlK94@?n&@#^bD;V#o&1m%(^FR?ddd?J$E`_ zz`Qz1U^iO7K@Qs*GDQ@USn|-)1{Jx7?lf^{a~~QK=oivSun=MWTdbX>{E$R7(YOxQ%Hq!$^A!JN>9j4G&defz?aD2LA`xny>>|Bx}yKsJ9WnRXyVp;MQJ)@CE@q=;w;2y>qtra6y*j9Xx{rk8J2f%)C04u3eg!wjKUYy{ zj1Kb7G8USl<)z>p&J`KF(Pg;I1$T6QY9u+^&EL=BwYd?zLe~-Cg1Sg}XmwKqS@hB!-zJfY_98EDi zRIfgAvF|P(2!j0z&8bkcNePcvuJGmUnPPFW;!e2Yge`Nyis!??uU>&>G|*TW>!-*D zFX()6K}4#QL3Pq|E1hqI@;y{bA_Sh3F%T6uUGG`>Pr#^JeAl58x>+;nl2x{9OD>zqTVWiPt!3Epb9;M3nK@^I-wQavni3?%A|p{Wdd36Hpu=R2_`hx?k=>+_RIm0DC&T7pK&? za>nTTpr^_AiYC$6Td{RsNE~5_$35$s*P&D);c}qs!}5W9_i<43G8I@ges^U-K-Ghr zDZ0isJDkE2~Nd=NfSw0P;7g` ze0gNOhi3wX)uP^3T1??MMih2#uY&#RG4v2lF$VG zyFO;9z=q=Yj}-a#_fh{B#-}vu@2eU2FGw0I#;9McEW#SQwmRTezn<;Vw)4fH;P3Z4W{T_ER6{{@UUjX|%437IYMA~~&%^-U?z zG=Hbx4sDL}19gbVrW&dNWY=`^o(kY&l?ZX2hdga#dhgpFrn5!j{Z7% zdvtt!GMT*n?c{H7PoIOSTYWk?Ilef#^uE-POyZA=v{#^1%E@!QQhK4SRwEvV%LuOhUt)+~7+m)~^$;Q#4d?PU(K84` z@e}jDhxd-%LlVpb^e&Idd8dOiroZLT6h$SB-i>rtfeTYN!Hw)rSEqC#L zA;IpdY={SLER)byB%yG5H5D#ssgzLY-%v22v0OsO!EI>*FVNeG6YFEMp;kgL-R1dYc1!o9DY#jPIRA_?8|`Do6Kr zitVk7?5&CGy@&m53;HdD{C@Z6`muM?wc!onf-G_HPr;JijWHUHM$eu+fqzG%QSsk{ zgC8Crj=np1dieD4hiA`zc>3(S(ZQ3)PY=FBquouR`6pBA`gfzP$0{%GEBVoN7W?1p zjqi_9UvY}@aHvRNV90^-`B4A5*Vi7SzPb!mYb`q1PqmLlar^$*t8Us41ucBg48nce z0Lpz2T%h)=^}xFh;@TPGRcoWduv5ljf|Gt@>reGF(xcg!vF_u+9dx_Vz_!zUq*jEw z)*TU>w|9~8o!S>>q}h7&;_Xih5**Cjy7hVIA@TeUC(zoW`P()sa>)zbDQVqw*9-?a z5%)8iQzAD$Ce6duepCIlW?FrhTX|pX&oe1^#=zg#6L}|A0xi2x_CIdVYqe#3hnw3n zU@-;xe(2Xvr@o&NON!j*zFwT#xG_^*PsXlCXL5Eux-x9kO5XOT%e|7a^+Jqm{1u|$ z4sNz$Rfo?_$;FxxpIJ!JFuyb@Wt*FoOtWUeYrS+|2Xme7u>P32@!A+}3s$S=rgold zwT^Y#Mjh04?PAAr$_84*j^x75+QLr8>!KBOA83nnQb^OguiY)D>~%*4JOf7fE%oDS z3g11AT*&vkr!mXPe)lwNF(q)9gKk0PZNk#7H7sLd-kEyUPqH{(D~NR!*zQmP`=(p! z#=FoheRs;gA0>I-wp~(Er{yCn6x}_+ZNt#Yl{eP2x2DO~fiD(%_$C(I(a7J#f*lOH z#VJ~E4PML4>%bNxeZQG@y`L}X`rU$X{Gi}%%mHg|q&8<@H&cMAOZ(-_u~+|>H+TC? z`E+2N$GW%WC-O+v7TP1C!tt1(Qomvl+*$)g>n znR%G-e#Tppfl)4&7DuUY&FB}bhIn7y1&8l%%9I;i~W2i*00Fhf5*CFB`t2Z=CUr< zom&Am_T)8j1h>M9_mt|6HPLTj7CRj8i@Ez_f+NCD);RRO{9K1^P_QZoWmlJN+qP}n^-cZf%xB z2Y0qFq=&W+Nbi_0yB%sB9%kqztc)2ajD>HJ@uu>(55M1Nt6ktN08-xQI|fhvB4pS1 zubH}U?BwlkPUM-t=*RQkog|?Q(zxzJHt+QcPF#;)dJa;G=u97$$d14yN9dGvgl@=> z_vKeyL`z_Yc{CBav)9-;tvONSth!MlsZ#g$1t2f0W7R^pD8SkZEma5}Xo<5JSqSEC zLkbxel@==i6Nq+m;x7Q3Af4{nn2M)caaDP;gBNp~WjpjP!#RGB>hHl9{Z1{WOO5(+ zxv4z-)TV9llZ@@HcHOZZulv<`!RramN^Gdr?%2kU`x`*l ze7OdBcL?MB`FVWi^2+Ry>Gsm*DGQ?8;~BMg)*@=V!fUU=8+2*Ki*1=YCQX=R+Gv2v zi~Nk%u4#AJ$Zg$>x|07nUC=X=TPj>1nB*MZ;tno)6{psC3U1TwV*S3;gTm>@buN>> z;7(m1NJ9(3<2BHvZpg}OpZ|L07d}7T{9R$(18(Hhq%EwNY&}*PB}*(|o#I%Dp#i82 z)(v$35Ug07u4>C&g#&UQTCbw1Be+BEZ z0jzxPj<;{{eW#p{gEr`krLH&118s4%)=4H+MxZ*IzjKR6pT1bO{d(5_ zz8u5Z$XQlIH!c;7dZ7?B9HCI+TJK`KoV0)x@nSjS4nMLViBYz1_kDSmNOxQ-VY@^P z*!RGBWvi=UUm@I#2&zc9jt6H+ZIUB;fKEt^kBQYgqo5{M8xb3r=RBPJJN=S_XkSR^ z(cAg?8f>?RhSoQoRT;?J)aLTy{m#th@)+CW5;ipl3+|@L-{aoYA7QeZ@*PZY{*Xn#jZX7T1rqZfP0Dhx%S;bW8$K*P1ZOF*nZjeCg~m+)LZY zG0tRnkB+aD#CXLxiKw+keX;fGs~vts>$m(gH*AC}h_knjbpuWAIZr>c?DbUb-N|Hi zYmn~4^~AZ@keeDLvMkHQ{usnkP>)_jOg!)MrVIWx-$uR>{q}uuH^o$$Y>{c$dRO(G zMtI=!4u>JcJE| z!Q?r;g*XnPZh2{zq021snxs}yxEzy>8Id7D3D*>ZUD2{E~*h@pFS+ zUhh4*o;yAtYo}pnycXt!t{4LiD`}KTLfvV+xJGO^F**DmAb?nj!uuXb1wuk^x7)|t zvpvL_oUhx*HMhbb%D7y<_ynJOrc; z%p{QFA;%)l_MdLvPCfM=bb=U>h9)>Y6y<@w9kB_`@IZe4jQ`IV6@c^X+0|1QO)75~ z2rjIe2gWEJEZ{BF7xK--H6R-(-~%&DF3Q};CoDS*-LH}=ot|>m759T`@Zt~dmV`xN zOo-PsEkID;HkBvS-VdG*k8h&)A`~Fv5#@@Q9SD|2>+Exo5Mzp4LmLT*9&(~tG$d@R zY5Yc+tRv%eNB_5EQ2Q&fcT@)E(jbmuT7JeCzfjf+S^D_&{s>HN>{nGRDjvh4nPmXR z94Zi;rXh+0O8rqH8FGZDrKfDCh>H9zdSZF05OWs^m1@Cdbf_juFl!r8gsPunD%fdO z683*p0ePg%e77`4N~Q%j;hTXlU=rv_wJ%FWMco3GIS{9)PDALF=#CIqYXS0fRD>g> z9}Sgy*KD9#mCEy2tcr78@-NY89}W@>ZS;a55H;fNA`%`t(`_4~>qssQz^{YIL8cYT z80W?`TK(J4{`GaO!HoR7=KFORaC2}n5VmLFIYOuBz+)iw$mAWY|GO@4B)atDlnpv) z`|$J44^e+Uo-7bfo^%M_H2Id<)8*UoCqwP&hizF>N)*6~`v)xnd)hF)4IOr{lR*OwN5X&_IGnQn z6Lan^X)J*n`2K9DY}1UWMA(#3+IaFC@mmS=`4w@FQF!6N zHSn)kRS)Lr%!Z~5xE?A4mF!|k|1pltTosXIzDZENT8{&_K=ad$-K04oGNnbdXy7}b zFz(&%1Gh@0=H$?)93#&Zw&G8N_c6T_1B$WP_^P+Bqyt<(F?AMGxS&vCJ~gm#`~nq; z^oO&{q=?J3K%03hxdRPhZ2;LS%M_W?A;LdYH1RB){81@qQ zyzZS{;sgF*f<(XkFxS-lJo)CgaI#GQ_b;d?@);>Wf+a$rVW~jSccGzdP*5r`0l#JM z1UNEXH-$f%RcyWC!7V%yp;cyrIKJFBw5g65>Y%$=D~TjIS3)=$G4=}r$O=U*k>Bto zRiyh(?J+MFcz2VA6gnV9UQq&VIY2RDiv!+P`{EfN7xQ&>z1x=D_r{b#jcg3BMh|Mf z*|v0CrUK{35UeBiX?EKrPe^4V&*EqxP-wT|O_i~+v^Pd;kYiq4zPi3MYDBLjRpb<2 zDMIR42lsg5hg06&T_i5SBE>z$8qG*4l*9qE{)JlmJXQACZsm;23WX)ZlqfSJ<{5x2 zMS4pE2~~|Cwe2;4KmVtY=t(ivy4&FC%dN>Pjw2|KQl*1<>C1crsW_)_w7a2k$bpNd zb7e7f*>J)IimnrMNhE^%?dCTjka9nnzhxL$y{Q3yaLvix2_6|Re`AC3i&5ErF<}!3;NazDg71Nm!z|^cw=t)ReNj}Vnw~Bs z_aJ&oDg`rPkyFJg{c9v=2jJYXRO^`nz zc`Ed^+~-{zAkU_kZ!g?Wn=zR{q20QfP3H%nWT}!uSEhkpJkQzYI9EWK^4@4J{dBN= z&Rr#^!(KE@?mQPqA?9WA(|Q&{L`|s@5;fW5Edyu zlSC2t9yJD;2;H2oHcuw9JPP!Q3{kdEl7mnEVwt4?ceP?yX6%|Om&y>jCvAP&hVb?j zDb#|-Rnf}G!qU2~1d*>?QbFGd4-f~MO) zxNEwH)$5t^bXrsr_foVHQsgNM#i#|$0q$o%58mNws7`^q%|U76>A00RoY~hN)P%+{G}BE zyBFO$ngAu_z?N3+S8j!;yfgml!1>(VDp2#gL_m7OU8HzP=?n1tY3y{;05VN&A5YoH z?sI#%dh5yB&Mk|rz~+LN*x6TFye| zIm)BQ&GAeyws`XH`F`q&qC~3FOMa3YmHx6s8sxq}lx>v(8XRP#NKj;AxPBaeaq}8X ze?ilTQNzc;!HLv|f2qocm&XKEjxUnmC$PE{A;9mNt2<2M9KB}$l$gNQIS2UlH-eq+{B7P|p5JA0-vQqbf(h-X5R_<7Ly`|u zk}Jo4e(zj2c3_{MPY<4}?@@8hL&xz;$;Y|mSm0I3vuY*-GTHFE&_QAmS|0P@mGJc z#2RG@RP1o@3`0|P$r+np!XN#jH5(F-YU1<%fnJdrGy|mE{5)>GBX%?EVBV zyO|;~uvq&StQ+x|OW~&GkdQBQ_x~@gm?jb$;1z9!QT2!gklT71=;X`R&B+2L&i+O5 zbnpleAOIMB9_*Pf-UN?jf~$cj$0~STU_HzvCwGA}EHrBf*HhNFShmHls}H*`iQp?) zY@gYw4C2f}Y{_yt)+DT4N&ewmssELr$3SG|^=OyR^HU{waHrU)s&31gEkZPku#2Nu z@Z*%+PC12Nvbv`v`DzNPhSNBRTB7@`uZp2MG^A91)vae{sisqOLCy zkmSptb#MzWKv`dCGsKLXs|7F<$?oO4>np(CZF(`PV6^&E>8BOQe2EzP<;ICB|wk?_7!RHXGO|0JAsWbAws z4ZG4us)IY>EZ6x71O6!$RM3^oN&;Zxz+Zj7W}Mi4oVeH{J7*TVq-_};F0)LdNMz}Y zg_H1=Y`~X)+6lllxnZ`jDyK57L-IO`wv<9vQf^&Th!VML(G;rHy|+pAP{OZ_RFd{x z_jJ-|uqDvr++3URjIoVtT~lyI{%&pi<5;y1j#dr1(flOhI}>Ozej<)3i7QK2|9Wo` z8_q3RWh=~6EW}eCcD)?|bHVs&BUCu6N)_>kKp(#+Zh34gs6x#+?Ce}tbi<7Yn$<+8 zTh6DG(6jEl79a#yk-JcqD#!eWY#pk5G?1E1JNH|E`@J00el*&Sfu9>scytfT1gt9$|lmoKpoe#ic_caujGEoS;wYX+Dr% zAh`?rLpeO>Lgo$0d+Dg9$SD`54I?~7O52qt)m|B<=X7{eLh@%#I@|a5Ozqs!4w&>E>)cdoCn|g27IaM8Lv-y9P+4M+HNm8 zp{jrHwa!6n2V8DxxEA~{57~_Q;6<9*7!H6B4Z^Lp6w;O%E4b=4cLz#m#G0*t7wpVP zi*UiCOE*?l2w_*pwZ!QmjKsa|)e;e;aJbv#M7FG42kLd4we3yqJPFgHoWC~~=GULO zMf^3jUbOGw;2tpE-GX3c_t{`_wz}kNBX^Zi0B_A|0ofZoY;T5&Y#9ehCNi1R&aYe_ zaxz2j!NVk5bOF)9-KDQmcc~3hr=6DwE$6x2`lVV-mTQQTK!RJB$GQgG7Z^;eQ*x3u zW&X>XFsJ|Je?c<$y1bB13cpkFB3M&(nJ8qLS#OtWvP>-czK${YOA}6P_59lMqA&lRa;1SBbUcn3syKu+}y~-u>n1Cb8sUCSpFFM|4XYOr{op+ ziNn0H21A^l9!+e_H~VBrB0;AGEJ0eD^Tr`J#=TkFvpQdNF5%amA?a}UF2~e=b3TEcJnX8wLQJDfaG9~_++v+UsJ4s4MOl)S2(piT$mIxySdL8XkE+Mv>Lj$*v_+QrSR&QJ?j!_e?W0KiR#|9{JJ>z z@FEXgL^3SAVXc=QKMN2_!;n9I$#W*Jy7?Q^J+caA9+bcjrbQNErlp;<^eTUA&tJ`{ z!XC&DEzIyFyx$**2|~6qE1lVHD5;?jr$sVsXBWNFkNum!ksS(Q7s47CG)B!o!%#vg zh8Zzn3?w+G^d__kr#@W_XZmu%?WXy13$`oX`#aZ>=Xiw8=@M4XZxH%?Wu&!&+QuJf!=H$sUs{zwFrG|0@8|rut)6dvR{PVn zZ;ES%Fr{p{tU^p?*lDsI*r-@@=20G6XVJ+ndw&=8rVTvISwjvk1jmrtxvxltGhAuelFLP8rs68@dY5fGDXOb^ zC~Zyj$7f+{(J6HjsnRiT+M|%II{U)Lz=dgd%?{znq^nzXFso3hJa>0|7s@Ma3#2p` z6Pe`HWmos%t?F8IRDnzGunP}MZLkvkX+->o?v06^QfR#Ws1e+Gs^a81h9`1dbD49;_i}@}?z-yM7+$@)u8C^g21ag#RMW7? zN7-xPXzo%?XX}Y;*LZ#&&_t9dRC4Nd`)-i7jHlP}=}Z3%85XMyCY#70S)P){G1n`A zXzxHPvbmryqnFlN%->X&o4~ulRnxHyX}m_ucN~l7G3PBiP=<8ZP}4;_`Sm}f;1C(E z%uB5>96sL#8`;~&f%d2Ft8O3#`a_)?-HBoL6-Jx*_od3^MMiqg3Ca%Pw|P?{J&yA4 za+=-^t)V`c!;KZp%A|=c^(y+~U5fg@iu&jC6tRUfy5quoMukLtP2C%iyG<|O1&^sJ zt-SCVGK{yqQ4QyZGgt!h|n^VP&A;{VUoEQ^;^nLfNp&!dM z?r^n!uqA({J$gQ?1V+HopgnfJB-CwQD|a#E`oXo%ORF)#MjZ1A%jt`jWn1j0G~>Wo7+Xh7Jr!cq;CUNA_dT;LsJD~QXk~%enPKv1OM;4CcX`wE+8MI3aQ~LnL?lg)%N^bZ z>J)SYY?r>gY3?^TW(RjsHGylKk7;b5ToNEhg_)8=HmoWZI#3Z{JZBAyO**~sw&wO#ESN7wC0*wnPf>z-BS*X++ z0F7F*mqETVc{lu3c%o(VZ!5NtnEHYHB9{Yu9RIt93d%|+7%iQe)L-?wf>>1Of8|`(jY)f3poGt0{G$Amt3|B| z-%Y}ccSpV{GhL%O=_echBAu@^b;xbMRc{Y*TwCwpTm+$U)K#IF{q5$_nAKXb6D8DY z0qrzRwl&>iplsWM?6N5?Z3^<4zL(eWeAOPW%TM*>15a+$FcqCT@_)tiv{aZ=DxKQPWO<7gs@KLzVrT;?Oah7ibh3~E`81z2i6?LG4D?iJ2>N?_n zWov^1JbRsKcR%g+IP)=m5PHz7RS+DLyrkJ3g=KJ4WM^$KXb{suU?X%8W8b0VtQBVy ztk>>QZaZuWqc7X_r2lnayr4%^#&y@S{xgnzS%#IX5U_K-ajspOj`FTvNt^(xTRMm_ zcAr1=ZollBR;)lk&T%nI_2A)Gh3x)?v<7um!DFmGbuSOXZ<;FfY^=p8!G>}4s=2LM555wSEFb{0)WF>5*4 zyT%D4WLTdRD_ov}tauKh&@8Hr+ZCo>^l$U~ZiY46jzRtN-x2eyx9`BOMnqd0Tvu;1 zUA%V2E;%`ONIvguiebGF2Wav^0VK+J9Gzi@-LAGOf_Ij}`zAyf1NH%J*6ytmK1V#H z!3%7y<0ZkAVkpRp9L^X2@Hy$mAzQ0%1{5>7;gf0Tn)}TzyU`@Ff+7jG5qo zGnJVF9V0r;;5#fIF#DCf93Lu3H?`D1gBBO!e32yA#A08M4rmS}VuWA8?=I=)U~_gc z@7k~{5+qcL2Ya=k%;5O{$dFd{TD7B=J*iZNO3^`5kf<- z|0>DgHbaC_^Ovi`kQbOidu>nqMw%Hj^1(LHUUJ|X8U~Ay&(K_#nCR2rHiPIMB{=d9 z5^2PItNzlGi04t?gD1cF+@?=InWS)v2b<~umruYQ;!NZxz~1@wG0g50AmIBA_6abP z%jfNefZOtWY5|UlhNtl$<{3=3A#V9XZ~4h*N5*0M>`dd-v@PVN~Oi7 z$ylPdY?s@Lery$)ev^@%?Ac^i$wY{hridIe9*A>+Mg7isXRk;7186TSP#~rr9c>v` zj|ClyoA>MOmf)JW0c%2fN7@?p{ghe>pX+C?r!-^0drdzeJLtX(Y4W0QodOj7~aRZyI9<_!5W+GwB|h z_nV_NegCf1!tX)Qwpcy|7rcoj*m;mpcwsJ<=-iCFwO@SFesp33Wi@5_?I%roY|#>J z<)0=2Z{^yyd;#);H~bZBGqP;O6Xr<+A!{lgu;Lt$;Pg7Wvr(^XN*@GrQB@kUlnhLJ z(p&}XmBf$tO;u(|kZ*{`ITM914`UxueOF^^YjOc8cOt?*%9Kv|(!ASSRr%}-&DH|= zrQ1(gGSe)x)OOzdY}p~TM5HzPFnvwv8VVW@+Vl0~2^Sz*e0+1kz5Z8GP3l};S|pZ?xrXD(8qq3rMJb-VE6T3ry1?JQKi zw&8ia?6UFk_(5q`X`Xmhyy0C`VnGh!r|Ist*XOgt^DI%B7kzdfa9ym2eHMh=gKie$ zQK>klg}^Y(4j1gDDN}zDBx8f9s(7^;TG#LfP{l~p?S6ay>7wp7aM$C|C7e`t-86UH zqvu@Lv7U(;#@KW&Y}(f|08y@#rjxyqFd4a2t+@1%UstQq73nJn=f=-;xeW|)cf>E? z{e)&Cz{zvr2_?451{0>6T+c~3RqLQ3@o};iV&JI}mf$jG3Fx-kPV5l9yqT|)mLn+* zocy-NTQ>(e<2P^FkQ|15gy#MY1#Qj;mp~PN1I*epRMZCz^>E+Z5sqOlICx>7o+cm@Z%YY^A>*?Nj)*N^N+2us z{KetbObKn{sYjOOGdh>%Be&3YWfnkiX>%#4@laX(-4gmWQx7LNFxh`JQ;61_9v*0b z6Jx**s&p$$ieN`2AeE$eD{B;-uAUetp#adJU$D*KEbmIEZn2)OFKXA+={uU~b({b9 z#5-N5z*O8{v5aiV#U$o!N;fEv_sIIUG`P0POr%vf&du$~#4SS9P1HF|LH!BF*UU z{34Iwoonj=x*1=k$a(e@q_c_bPMU$KAtj$Gg~us;9-oZO4bq2Gogg0o*N%;`IRNel z0G;2@n7RJ|mEjp6V=E}=G-cYrMlXb-3dslA_IkZP5tSP6?8H`Ig*IQfZjJD=!1wkb z2(yR(xMz#=ReC1ELx6(S?qnDg`LJ^|*?kRIvmmrN?4k9TJk{&RvGeC+6Q;{*HvG*c zOH4GUM?OY*T^sgK>Wqe(XWxv7#Wxw5XKM$z>F7}h`aZ~`c z>cS+q^a|$v^i>k60QudSbOAiuoxr^F^=A2{V}nt9$IkDS$kTT_J|<}RL9pEb2ii1~ z(sLFrVKmn+Gw2IW6YC9uYcq;8>Zy?T5C6PsJ<6qT4|uO#gzGJ*zX{uLoY5hu3`O{> zl&PRJNe67C3oMWX5SYN-k2!~vpA)q(?fyy-u(RF+j1st`FB(^{)9i1a#tEHwAVw_C z0EJvMxC6q18z;@wBP9WzvjUOP7-F;JToV20+g(NJp&k80Fp*~^Pz#+pN7|n`DICnz zh~IxoW6-A;)~Ada46$AKix(tO`X{pO_ToNQAVN??s^6F3Xrcml- zJnUy~_t;b6L7?-UB%~66H2Rtai}Vj?mdr$lAdmsZYd)cZO<*?)xnU78VHARb^|Zle z7WvHp222s}o!(f8ucyRUJ4dRM4Bk00zf!%oaqp=6yc7<=NDHNl{w+8<<`)}_z;U0O z!e(=8m&~1r1Aj?AU9&w0-CDgQfBvhe!C~jg62T>Y87EM%mmcp$k6maPkFs$J z1)G0phq!P#A~~An@J<`wlXKc$!`6zty)WLNqT=bdAe*0C9MGc?WVMwa0W(i4Wt?i z;I8Mq0>mL8aNY@O+*cBR`$0@AkIF7A6`gdF$?IxcQDgSzDyEWtjZ*;MCCtPM|GFu? zTSXDkeh8aLT7w;7ppAht)ynlC4b&>JT%{~dDs)(Fb}rRG{hs7mdjrkWqO5$|J8E$$ z*)?C*c9M{k-N<0((^j9s=$X(@PVjd(X1jtU4!owmd-FBQ{i`%|=@Mlazb2D5Or(N# zXA#mC)U;%guRhp3eA(Kd)D8hoe35aiy(nADMUmVkdPxd>bM>GBlRVi;SBpEu;P^XT zFkGCK4q@nbgi*qB25Gc-wXHB3Y@u$jrn zHQQ&q&-y&fo-p|)KYHzh9*OA1{Z6>cqG zEjN&68h*5``&F-0Vu*(XdT(D2gSz)~8ll7@Kx)K+fYKYgX-GgTf0rlc z=~ow3Vj`AU%)itjEXzR6aQt%ZU3J2!ZSk9W&ek`{G4T1-7@Zsw=ZfWJwdqHn9yhN! zUha#n&1VMB(x8eT&|~Cu)m0a7+vQV@f_zo$ql*;9TjjYMmWM5!PK$4nLlVlJkSzOB zm9FIlpF+*f&i3Q?%!huD#3aKPM9hKZTq>#<=V>l-!JAY?h>w1jK@Q{M0eH@C#+TkR z17^+vn4D<_>5WqzxBTp&z(@gTm4+m6siNqq$v`!M%gwvZO}(3wW8JN%R=WX|4tirw zpWzd6)@5S~b*Vt{W(dUC((Du{}B|8Wi!=KuxxDe?==zQ}Tzh2@y%26}Hf%s!` zv|@*w#G$rso{poJr2~C686_P&#S}Jn0T;kQ4gS&6!BA*33?IEWCy+9jJ=`_|#0pQC zB90yxsdXxjN_*Z~NC6yXBe!4CULXW!IEU`+KI+h4ef(QGZUGmijtSu0V)1eYO9yNq zRbEqepya-I@xB!}!E>}!NPg{#i2(enF>;~UC>bsr#NLxEMlf21Ga<>jTf z0Qk5yKLFGvn!#WBvBU15NH$$|w?-2`*`X*Zs6jT7zkzN0fW{JqKxp3q3yxuH4-*b1 zqaF(#ew)W|$8(XvX(Rl#rjD*mTsalj@4)12?b@1;q+MUvMeq8}=jU*>cqKz!X<6!( zn>V1m#5TlmzO@DYf_5AGs{CrPMPRMFogs*EeEG@MJNa>s$`uek$e#qL$qq!d9OyojVJgsNL`n# zt_0#UsL*9ohJ7)a6rJ@OPWJYrJOqEY{7ucwt3gi*=~#zz$xV#fbhm|kF0g|Io;>~z zFp4(X;u+1Ok%&2NCshcvY>0bC8{-IxX-<)nsdeKel$OLTHrZz5@GndvC~WxpnpJvQ zsZRIw`@?LMogta@oYzOwnk6mFrWC7kdl1~VUOENnuM^qKvy#JUj9cJ}Xh8e}z~%S8_P~i*Q+23i@Ciu1+acft{@WKYcE)D3`IwA7woIg$P)l2H@35?^$(xrTQC8w0Os*LR zwSrnYI<8+d7cm(xCecZ9#|pFA>KgNBXtK}-&9gLMt}Kdg(5r5E-fQ#0AOMh-2v!LL zAZ&7aGl=EMhW|DgYUl&N?gEO3aapPZN~a{A(T8cZ*%TA5aHc^p9QgE*>dlFp9TLP$ zCR#~lZvFO$+nHb$r2&L^>90LLtJ}K(wg0Ao36=nQ$R(NVkzDwizbI$9Bm&TUdm381IUIe?3d0iL8+x%no;f-4uzH)2Y{g@ zA@x1L^PiDqz>OQ{U9QHxx5=wt-LLpeAiE>?7COj-7NW~-zBbA@Kv4WIB;3Mqjt0RH zXWMPsJP?2zZ^>ur#@V&aEkGv6WFMevsgmqS9aM@7tN>EpOdj(l!rmP5)HU=}6D%HI z+f}xqMMt>~v7wW?X@|ORBq4Gcr;PxOoKGM23oXjIs_v~iw`TbL(_%Go>n0$%Im*2T zT1h@Y77wPD(I=A}0VU#g7Bn&ck5L09Oz0>nVE}9BH&j#aO9#%y9iP?R>qx(M7{#n{ zN_4d4G9q(SkvHAAcZrw^%uymwH)HYEE^V3YLE z@g-RN;`a+VKkMy`XIgh;BL=*B1Y&6Q`gHs&@P2q*UJh9SvY@2fi3yIzd8unb_>SA#ajLlgPu^Q1R#JEEJWHN zSHgD`;-odiBEc%K7rIUW;CP)uMXxki{}zr)Rhq6J%n%XmGF(h!rE_6{i_(ybY~?~x zx~%8$2)uvn*{nZC;&~Z$`zuMf0Whj@TAe=g+wu%v*^+Vxks;Yg6f9 zXHsW~SXy5+TZA+uqDhIsZdfl`FMKh}8Q$78zS%YA``L_2;GQ8FeHO9szWsYltt&qA zuo(mIN*wXEpEDTbHywaXxff2Qov-J26!u?&DvZC9Vi5lLQ`;+)UmU`g*DCDR7|&eS zn6@-NtYp{ToH4X8CC5?Nn4v813D^B0Um0a9RJ3+sF+xLZn=p`ephx`puZ?Unflmmr z17c6v?p67PUya)*?BDo#5W1++sYm0tf$xnP}K}r<7K(>D3Ry^*PI6XW%_}%5kpE zf};X(mZhWO|L$erGtW+dZg}SOMxGzg1;_~+Ztj-M{uPAjI9jq8d zhhn;F8$~LXaR+oi4(UmbL{eZ1N{BJvAD+;yAWXn`Ez?Qg$X?LeLqZ7Om8Zx~=jJ~Mvj#~eCy=13pl z{|J`}Esh1?lND+nq;!{8*x7_UZCa)fCNi$$@3G>KLPnP|O_Y zjyYpZEeS+Q1T_bGk8M9k6^v&!k~+~ziBvHPgd0YN6Vs9t5iKJSw8!>EA(!$WXGfmH zE%HfT`WFtx?ZQtpKL&Ocm*iMyqKEN8WwiJFzjoI5C`(2fM|j1f{*%vLqmms zP&q`4G2+r0nCofmzy1jopjmxrzl$rc&;S>vf$%8qGyLG|03k1%E&)dIxfirP&a)Jr zil_hTXm!Br3`M<^Tgsw)@2DrRX>vODPRTYBYl>yAZ{u6D^pS6#m%3$NpfY^F{?x{h z_e+iG`&n+z@MIS&6N!-~n5UX1&A^cFEO@!l_9=n6=8kEP&@34iWq}|OS?y`^3 z0Ci@fe-f%jR!cs{{;{NdgaLNR(#K8@{>y+#_7wVnt&5alU+pS7$d!aGD|gY#+ARD1 zuA{#1yz3lvxjwg_s8xPoGOgy?3<+HL7`He?SQdY^5#D{x#*NMjuZIEBDPYFkqkPbY zRye0(Z+c{0qJ=m-6{0Pck=geMWHTQ82JNj7m=g#~ilh&}O+---a!tmE z>{_WRdB>n9c`HaU(8pM7F`)+9qEkVuW;Yk$f0zLvOuDTR(ql6^z!No*}hY~ z!ZPz~T-$mq{<_^gVrZ%uJW|AwjSV<{7!X0yuYK>V(G^V~qr+>Ck$LGyKzH>*no2!Z z6bHT~vYDUNr>g{M4ymy>wIhlco}Ay@k}V4K23jwr@!wHS=ZvJl-soR$&gRDeem<`C zRY1+57Ui2lPU0_rCP_h=K2~ER*?%{c>guOf6nsf%mAq}#=eJfCOz?_h%|+tBaF!(h zySo2OhHtys6YaPp&f;R`^%`+Po+Z1wLiVXfAgR%z9!HPn)gY7^VAAEv$PQ{Ts`Mlp zRpWe-Sx9wkn#Qyr*`%B?f>9?}0NVXKGy1=FHhg+ou&(_rj$d#zIe=vThn{=bLFv{5 zXY4nn(h-L|0(1-6(qXd9!23PcaN+WWY54WcW=xP2MfUQ}Flx}4t>NcpZSvx@qiRco zLn6qCGqKR#Xk}(U`^qjbqT#^f3mFOFvz!LFwick*Ipa~gH4xK&&vjEuPuQ~_ENo89 z*l#`3?*n0Zz>2{7DM0<6juTL!$4(fOh68S{zR;#_%KZ0fdb(b# zBb5wXAybcB;&X(&+5SCr82z#!^^@LAD5#Qle4;0=Wqk6svWcGGF0gaa3+4`x=q%`0 z_6IOGb>@fA;g$IsN9&Oq3y48O!s|Z8+Ntvp2im(wlWJhv+8bx*lg3L5C*~K4!IEx| zy`yja6Ra@+6&6<<0BvQiXHBP{ey(mPkUrY=mwBR3a&YE@`LuCEhX&D5Q@D{;zT;9o zHOMf7x>GkM=F_JuxBtV>p<(8+>>j{#dVBc|v@L_DY_zlH*{3NBa{yj)DcSIime&aUVkDd@KOO^m zmEt8YR4sGK?xh~#ZFM(z#sM*nR~ypeCH34WO-3CTlSE0Mw0W1b96Ji zgrSSXd({h>K1n%=>jXhWo7|sYf|KU9j!>w!XOVW^=K2T4FS?wa4|O!oJx{(b4g%sT z0D|K~fJvRA7nbnD+Zz}chBctBl89nyDWx6kg|?<^TTut zRi`Sno+;(vcmy-=)01*VjmqylDo{%T@Y@1t9I9$pw=kc{lJ#;eSr!zexag8EBC%P1 zasdhosv@c2n$l^4>fW}oEpQ;aM& z6`2}B0<>~0`~Ns614g%!+~N1gIqp~`?>)xqcd|Z;>SFmE`9zWXZ|jmIw^MC#*gII^ zK0`aWK$Tr9km&Ba;?OV)nVZXc`%#c*nx3*4yxS=7G1?K~TzVD*k1YMDT#-Sve|^aJcpW?w8)%+Rp&aPfv(nfEy7n#=oU1*%f< zU1^dJBr1t%N#RmByR9Lep{3|F78KT&$n6oOK>g>Xz%Fd$7XGEjV|!|sIjXeNYp*KS zc&E@-oP$kRgqv#x^M=@NrVfH=SMwgU@nAJzC3^_zho30Doqd5oIuo;iqurwi`@$wL zDfPaIT}8=nV35skI0Ebd`|ji7=<=~J@lAgN*cvmjJ0q2n;&6ydMhI}*=@H=eIb;sc zEVU=1G&AFD{B{4pi3oa3~w)H{~Aeb;PSaEH2db2mI`dM|6iLB03eiAUS8hm9I^ zHOW)JA|L+^SviE33HT8UyKbZIMim&hUm&|O|GElb*iUwUSPo@z)~wrbll{nbbz5WmHZ7)mx7^OomLg$$6Mv+E zu=_jii{eb4s0?qyqo%LeVTn?1Hm1fd`mQ=E8n&Ot?B%`Y8E967iD zhT6o$kl&AVV~ z9=-=}P%f527WkpM#lj1)$kf$r#0bzJAGwD!8i8snZ@GG(fzvT^?qkaRe}c%T2=ay2 zH6Ij&h()0f+D7fc7y6~QklgSaEP!X3~MGZRAtP3F-iy~jcG0fqQ(+W55&cD{qyi$XLQ zhlq}e=hoO&vx?ay_A$fIJ3}6vmdM|XRxP#6hJz}Ro(X<-iCzqak>emrXPLNJ#cVPT z2UvfAdWAeTsfl7d{D3Mjj8>!$f-&0sgq%|ehvuZqKsHChsljS$_Ln0uK}kHKisdUt zA2T9LeYEr8N~4WOLY4EKcztY3I`Dd<%Q)}G5-xh&_2w2o?RtANA9fGlA!q7%$h>uu zD=j6YfJ+edzhfXo4#E!z^v~Z6dN-HgE+iB1Q>tMz+To`e-pQ2x2#iALpm@#sVCash z2`K-YxA@cf#YGE%!5EtjIWVG#0!(RysPr2bt=&Z)pyPN66UC)b9S)VtKeT>_w8uufygTId-# zaa}%g2&jip0LCapfDtg_E6-Ol;0ySG9fpYyU_m3!7z%GE0)mhPa0D6J0hE9c{WC(8 z@n!Tpp@kVDFoCYg86@p6B0Z*frys}ILjbeyXr>PHNA{`8vDpP1OVH zsdcJVIz^hN=ezK|IOZ5q{Odh6?Tfm`9ft0;nqf&%sgK^#4CP z-1z^j+jvZdVl&;uU55Jk#moj-E!St!i*vC`TBY~*>+_r5?b*pc`gN-IJ_R^LXK+gO zn@SkrydS*1y*?Sdt!`)t$w|b<*Qs`@&N>buF$`gOuc?(&tzL}=N@MJl4BRpfG5gsD zV`*ug0ZA@BTT4Ege(&_AH>kfGW*ak)L->_v^#@l!_1@L&-l(c|EzCu(F6yo44e@k` zk{oi1?UfVW?8J35W5&cYirSf1ql9eg5!ZC(d!Ou;{s{X z2ghPDn-5>4D^Zp`;^hx@25D3!{TCAdcQSlT|Nn!dZZ7_Rr?bDI|5owTCH**=sFHs} z$eeNJJb4-t|G&skBLTk|-$rdsY_3hKAa)a;+#$Xbg(31CYZO593en5T;c^t^Mjk4u znH15fq2I}HFq5C%0^2_C*4yi;4s`KEn*za!I;vxu?nr2xq-~;0nCv1Go@dhL#DTEO z;@HsYUaNtJR!$#Cf%{nHxvKIe1E!UsS>5L3RkwDLPhds0LhrzedR9M2P~d}<$)bjk zs0bu`kpGakEf#i%k~6nj7te*Xv_A7@HM-U%V;*N3)Bg+{ErrL2jWOuuW7w53u8J^$0BkVdvRK2w<4zxAa!r~zdEXE2& zlg`c8=15;$Sy_&DUAxD6b_+?Oy!kW>Rs7#F!oXF=f9sm^|IYp<|Lg_b^vRS#Vg+iTZLXl+Ye?EDCF)*F^ zGnf2z(;!(GkU5=)UuF&F?A4nfc0EwuG#%x~XJxUFGbW%R{2j4B5~)#QXGiSc5rBR0 zUFH|~9Uu`4BBuIkp9}`Q%j-e^$Bya->HnzyihPDW@C#@>_Zy%&Lg0B)OS9~EiOyAu zp`9?kMXUjy`>mGluAw?C-bp|5smzNr3Q+)>J@DOs%gG#bh>y_cJLplg{T=x0U%@a$ z@Lp@q|MB^Y7yiF@wzsv{(z)S48>g>&P~bc83wZ9E6Z@ZljYV{Ob4CnLkjqyRc!bQk z>OeY}svgsKcx%h}oa}*J&|$YQekhbf6oeO%_&}0l{!zeJ%v==q=r4&+{F)K|YUBxW ztWPXbh;V(ufl;=Oc)$)FCARAZ#*T18>YQKClvl63VwpWzu4Yv>J!^%UiS(A1dTSma zvWKVr!;-d*Z<(;qx{|$L6ZgvZrrSBovbg1Vkg-vh7PL!uBB+xVFT$%!g(pE=;J52K zY49RkmijIaA@6bt=&Wh$$|`6Jm(QV9Uy;~4p17-3Ji z{Rhywha*H=ThBx+1VE!eU`jy8$n(I+BSRS)9{Zym5F!t9WG!NeDDR=~Zao7&8j0%~ zya>{x9G=U z>-*La-fw;1Vv}I&`~SQ34Ezj3Od<--&w6yL6@=t>EPCM;%)JAyQ{`;$@#zOot$0vS`+sX`Y1pDhewA;X8xCM zx7*#E|5ZF`aFwmC|M5%8L$zDoA6f^$zDS~a;>oB*#~698pa_T19iiR0bW;{?Vqc24 zF!7=HzbTt~=*K$`vL^j!1Vgk9{>Lww==K;qbX$k5ZbcVag{CZD*~`|}6{kWl^wNy) zLTtRX_5Js6$pi&(gpR-e9{jJQUwIf?4w)pO29tlA{7U?ft*vLzz$L_qSbb~jGZ3`z zXV9BK%<1y?p$9&1eFn{DvkBxs$sgi@Y{d<2s*93cB|cN|0c>xVvJAs zCo~10!9XTYK8vOE{4eT+I1t$U^VVlEYx&>gAMG#kYwI&`C~iT`wBR!s62ceqH%{IE z20jB|6y(g}NjT!%5MMA}^p{^P1#^=5&wvV_6JDdC8WS~mZBZQX;vkUanaI8^WSyc# zS)?UWc*7CE6f}gCj5T%um5GNMC*DUmr48#)6pe{8kbg#S+QLK`Lt4&0fP%JDor>1F zvHe;v0hy%-sgF^bR@&m<3YuyrDjY#m2pI=wE0gd7dQVw+Rjnt^a=I{d8wyUEJR&@Acsv6Yk>s2)1(p~uZ-tuZl4?C2NVK| z0?23SO*uA8!q^_~S~gtPXi+?(t^1eaiXI`xus>=FjRkUd<6b3s5B|ofdft277pH{N zQO8A*yCWv+Kwp}vrdMS=0Dyf)5={)Cc!E6`$_QX6Ei0{svH!aefC)w;Z54Wy06O&@ zz{Z3kz1{5oOWwD#ZK}R<#uMmBRenql6vEaruO)}#c`l{JucNf%T${D7Aq{Lx?xdn_ za(7X;)o$$-Ur70ODq=i-1`>(?*46f|I*4Oh@t~xl9;>ldm0Uc=v{t92mJxL^t+S`q z35c6|p_Cz3QLf&N$cxsz$9PenxTqfst*go^?m5NBF`qlDg28X(Mi!VQNfrsy9+)K^EUs&{rMnMpT0l#gq zAb=a<>k>V`9)P{(CM95bRw_3&;6iwecb1Fh-f{f&01aSI6ZGNriE!w^k zP*HH$lZXX{++*?u(|GqOLt*-se#Fcfw?JQ#FEW@YCn-4fMM5CRF&T_hR^cyQOvRsk zDS4Zz#!E(j#lCDt@;bw5!T`0j0mq7xSCGWnR!sENi%XcQ}6kdRDls2BcEYMV5Al}@kG}QKM4AkubTi>Fo9DrM8fwK z-(lneNclRzFoaXSCUS;U8)K^Jx2yn%{Omg;@e%_@T8XrTCN%4BW8_VK0~)EE*428< zat~TKh4Z_(6S2oc>|tLP&RR&UAU!leESz$FZ-UquMf57**QvO7b4^RT3VunTk-T%I zfS!;3I&A@@P4tn(35*256I{8`FW)oK%n*6xBN(DP5+ZrDQV6|6kVT=s0L-IjG0f(V z_~4>1b|3j}laVI!U4VQioCXZJfQ8Vf!l02immC(A-chzNAnu9J@Jamf_=68bNMal! z_blSY`qCF3`=fKAGl*aJJ|QRK6BAVcXiDRcgrUKGftGw45Ni zz!Pi;OAgxYNu8=UGE}s|2OQL>JV6snzn$*OOI)X}wd2G68kN(H)T&NkP`jp#uhv4J zFuU?^_=$QgsnsI6X}$I+r`%%x^+u2Z=RQN>1N4gMX1!gBlr;jbk#V?a4eFUMDM?gn-k=#NR4HRm-_@P{{Edd=>d_v9QuCjzWw4iFvf;gsiaEJ(}7p-J@w? zC2ALT`Pj?X$f$FrgJz>h%$ZQyG2IIlk)9yt{xjaG;~e#`b-H{CJ0Ym8{melZ7mih< zjMY*(kBdt9tHEKXWn;;Q6(tF3#{vy%lItQ-cUpLvvd{aMbZ(?qCIHQRn94C;+P}SN zJE|K)I>rtOgWU%XF3tOwv;^Iic9Fw#oz_vSTa4@q8uJizQP{J|-Wu__Y8-Qt;!DhH zOd^lrz!RhOu*3PKP+_2U6pj}_Ae)z5=a4g;GBpQhz4?U-86b(FPsYef2O5cpr4u

Ji~N#p}cbYT6p;OFKH` zDy8T#$lBWhjo&Hp8~I_B>Ax)_ctGKhBd2NAAOr_b6GPo&&PqFI2MD$1j_~{10Uu%L z@5nTN`nWi|j~!ZsQN#t2pcIZ?b~Gs)6c)??eG2(cP6%SK>oK2dwwnika zF`HWCQL*aGs+Pw=tM&9Yi{aJT^gJs=tTpvWOTnxuVPVl}DTOL@R7%MQa*wY3ew>S~ znoOP9UZt>RiK&WGCytRk16Qf|ThylRXII!|Rrw)_f+|GNd3;QujpV8DfHsIS?d{xH zK&vaapI`i<;NnN2Q zI3>P|>&#B8W$Ul^2|6|jP*QPrswt_NBZxH7Hgm?kPeF(%6;Vy2U`7~^K6H&V; zTs}XF|79#rr~L+3)RF%R9-~k!oK|GxGvuKW)J4QrHC9|l1~JY~VAU$Rkio^aTx+5B zj;pom%}lLPYrEA7RlCj0md>o^UTalm*lHI&@c-Ws!Up6X`Fd9&A$d^bRcaoU677Ok zOflj$8Q<)iu%e1T#{{CtcI?V~SW)~X%7Snd2^X4Ht}`XSZN&o3BH34~ocow*z34Q8 zt&CnE)nw3-+FO=Ye1INy6N;>6pYtOgTe8}j`<-LQ zpcjncUfI6Qg?o%txiwdQ4qRbNms{4`81iMxnKW4FmoaQPUPKuR>y{SxzP|Jk20sc_ z&+#EOyDeGHcu2Rl zA{}1j%LhLuW5I`pLwp)}NlzkP#g7>`EL&7tdVAF$+@4<_zdVrrec{87WvsWc!GJsx z9~v1u%i9+vpMjpd7fc$6gdn1V=8PC=Mm|N*+lgPjA!OtsaO#oB1wUQ(g{3`j>&;J> zeQ=Ma6igz@0Q5ox-6=qyFlEvSPDniEg2*ys_<%Ug79YJhs6TH^sO33f6tOW0@xNla zM(|JI&FQu1`GfzAj|_ZhjGVx^pHR7S&j0{%6b!-DD@!O`&zmlKXmrJ;~R5G`$rdVrxvUPV+uYN(-xBa(j=aC8g0+6tCQd)GS#sbxw4Syym$i z{9uUU?Xj6eC(ehdVl&2dm&C_Rn5;`ZhO~$l?f!#A!Y=(Irenn(D)JSpcI2iyQQ>cZ zKzd?^9&zpg9Fhmbn`5c%wcMV}^7}SKj5kO8TYl$?1>0-WcrD{|cAE%a(!jWU|Qg8TQsNb zHE-T*_%?3%Hg1@YNz7Re=SzadQmn|AD~A&`!NSbA&jveUS7zKqir72iqVrl6aw^5W zTq#1?iH9MrV4mt2ycNZUUclTf7B|dj@m3VEduIDywR>C3i(2-Uw?BhTuhvivqu!(+ zf5Z>zO!R14r#2ay)TjyRX>lR1fNWe2nMv`485Mub&XMMt32OHo|66HeVpOX|#U_RM zXa;%q*3Q}{m6%sP0o`t_=JptsJ|X8+MmC?Jt2)lc){3RN@56R^b5J!T*u?tTCv*aIjLs1=*!REYI2t=7PF8E zFE0SG6f%qo^?*>X6vI0|wRa(z@PBJ-cB>i`lFa0f@|~;EMo1WOh_Qx))9Z?5%(d0A zj3);WHQJ~@o*LGIanXR^Gn|lQQYw4uK|Hxhi0+goC~bncmm&u91o_NHMO=l#kV8bU z&5bo6l=T@D%To+@L5TW{1bq*op!yWoHYAM88m+WBSz~R8X7fb8<;f+w7#0Bk~c0~$=N5hmg+vqizFhp z5{+Lni!p+(HyclpR86dKlDlcfP0Pa2m);dd@u_Wd3wN~|F{UMpLbKPKOiaGcv5HB} z*%mLYH8a>Mao+1J%nZi6_KLATRjq01b>cML6$qQo9N))Y(XS>fj2iLJGfW-wfWq2a zIEEp*mSJt)DSGJY1lS5(k&Kwn949DI0>vx;40(vC(l7PGCaSQeFO6v8{`!!t<7Ljps$6^pOM z4O)JYl{8Y1*D7m3m`B!yxvGYe$;{V8S@11u3)%U-i9A$S_Fh~+UUlUZ&a$ zNHtw?E5YD3ENu$g7$O*=P?+Jq#&+GRS;R$m*pJ;#`IRUPJ`r@|f`AE|UZH$(LKq~G zh9zm+(t=;SrwDvE%PhaEGpAX%)ToZFv5xlIv>2$27GlQ6ghxTvOP?p@>WMfXBeJTb z%awXEpWgvA3D{J6$wd@_-}FRNzkxCG0u+kn#w?DwSZ9o~zGam0hggRu2BwTwj1kcl z4UzYiHz_YU-PRTcQYvOzwAbIyMGq?T=xIV@+v{uD?5l$B8l`I>Vy%Khd?yM+z9p6O9tySyNJTBo-SrJI<0mC0tLsXpH$U)-nso0~ z)rL2dDpixFd%aHq4$&E$8t0+2Us?5SPG(B?S}1BFNLjPff)n^J;=_-$<&a5b zWA8(3wv{C$nPEQ8#O-ks;I(He^qUVAmBl4fen zD9yCMWkgfQB`GLzL<$LT^0)r&$?0jY-@pB-_mA82Ga)VEZ~MK|o8CbAC`cKfuq0q| zoPR<{Q{q?Px4OslH`~;uAFpxwe81Z{0N>016)xJ$oO)^XGA7-qIJ1CxvXj( z!EssrQu(n~u~N)XkfyfqYSA+h7mYqD&Hj=WQPalS6$DDDSrl%$w97@KoK+Q5khs{s zu+*AOxnSQc`D=>=D@MXv+ftlgYb{qOVz!zyJzFOcBO~N<$U?5XPo?=`l7KuG0skVU zsKlY*q0{Q@t6A`rEN(stKN8~pzMB@`4W*Yo-Hq#QFP<$jxw2xR%dVS9U1;`a>vu~0 z1^Ot>|JXS^JUTiw@;@GRj}ABaA6N1Gu?0Zm_7?j=#AxFf{33H}$0?#4B02amXq@$L zuWzm{|Nf80PVz}uS@3U}R(rnQgRym@>T9K=@;+=EiVL^W&u^lAZtc0|Mj2%J z&idNh+B38E!1z6$?_!|8&i9c5sX{L_j^j=n{KiaSHX8~6jbVg6cFtSs>|}41ML!0O z=YOQf^h-l2C5ev4u?)JHy&q%O@)kS9KP4Usd6VI22w${!K)2J`0o{Xx9njfUn@;Af zY6|`ePCOJcs+P;3B)(G`@i&=_{@1N|`Ax);D#S0PEK;=DKrUv+lq5J02=N#Wl2wv> zq>lOr3W62wL70g>!6zA4C^~60cFZqgq1w6ENnj>> zCC+HX=gN17Q%eC-P*FldC-*^!B6yv4L;Lh)XQ7GZJE}La6Tt&4b6y=|UdpduwM}J- zVW%~_LC0)e z`~7Pn@JButTXl)4ldY{%ra>N17-Clv14%<^fyOAr?lsX@xiM}WgMFoqkBwvSgYx^6 zep(t+{yW#SfW5u6USk43ok0e#3HAjF=(N)|8YIxKf^7LNr^zV`9= zh%$UPO+Lej5%n_(G4ff040E4D@}NUhunH z<~DyZh`gUo>MA231=FU3w>CWVDG(qR1%LcbhChC2Jm>#@`Ox^Hk4VN_7I!(Gpj(PU zjHq5D(GupTN%k%A#l+fx#G@7|`CLOUWp-mM56zYShI|0A&i4TRI^ms_c6 zxV?Y46~bfls@N{PD>MdA?wCOQ%(7;)T_DPkSAK`YsTY+!2%%5qv||t}*o&Cq7Pses zoDwgZ_{KGA15@!~IDO4;7v6v}c{>;>h{Do82}jV!|3Wo8MxR7}gI5VG=kVG9Px7pB z{OwkN+3ju7_t-|a=ri&kiasSIMA7%($*|~C3i(9^Vw2wZb14qSzKcF(Yh!*65$~*c z?S4*}ojiibjY{2i{g%kDTkepHKGGlhlfmk-m;zj zde`jH%demRdPms1$n(~g4TBFO%k_(eUY|{G{b+J4{=|q@T*CD))79Rc8JatfXT|ZI zn9(fE81yitLhwp8ywDhi2;N^ODDt5FZ&|AjbjFG4qd7i@OorIkF?6Q1xng4!>LS_% z!C22r9W3Y~2T!07nrb6?I&tV%h(gzvKg{FjJL0oGC%TS7HF0Y*uG0nX`Si}62Y zA-PXy*_iWY5SCsfVlNWP*UGDz%xMx%WdU@@(f=o7sAJ{c?Zrv=o6Z)ZCXVa((wiIM}qb4v~%AwC^bIS zFc#Itck@g`*r}*F}C`(nYrY5U`@cm|ZvpKqC1(p#!TSuPpH}vh@Now%-1A zj9t{51Z-OJ{r^EBDfm2rpX}qAV85VBh(}}Am$t{Y?^dCj{6az#pD16>q~U_)D2xH8A;Av=IToCI(W8 z0qi>=zbh?Nfe2@ME4?popZ}39^_N?_r1Y1A$*j21n2Q25;AUO^u`N}5Y zaVmzLFJ~h`ayz)_nzvi^+AWA%M2%Y<7oY(>@tl8G$CLU19 zdi3UU`!EGPc2+C>b|Zo@7F4wHVxWK@lMyzBFBkT~hsN`4oj({%B1;{v{xFF+7#7^+ z2^nXS)8YcZO_)FIyZ8aS5%h{p!4)l6pj(VJKEY4eW^pKD^q3Y3@yA43#@EY~l*Nv2 zHqx_@Tuo`q5*lp^KUqwjb0_5a^D(63pU_koI|{e`9@g-zhFkyAW{oFeyf8G?$vgQW^8EFU&uokc zMUEfc$SF2*3hOdGil8EdY*rx!jV3wby)*fB8|;EPTC+0)qP_1yr`>MP&qo#NQ^1_O z=VMAgN|(+q`IvVjW|5VHOa>{D1$ig}_LK zFbNzG9|4lU!jfe$jds4lWr|=n5*Y1UwFG9%=&li>0Lj%-_>%N%iZn!=>~sH)9E0c9 zg7Fy*$;WD&8g2Y5HmXSk6{bmWW^k4n)mT=^ZftaV{eJfnO_BxjiRx5Sxis~h-wGlg zuD}Fzoeb-r+Uc#`dMexZ0|V0cDgeDxRStGo@qIgJ0*@gNL+ccHGkK2GhtG?40HHBv3pXU7zF24=Qs z5T!b7tNvQiU0Y&o7pSdERMu8?bu7X#UY2O73&K+rXql^GQ&=?1cCE5qb=)Yw5m#Ony85`Qzt00mq1w1q16!zlwQF9>w64p#+ayOaoU#Qjwj4)dGXlx(JzcH> zX1M(9!uHZj(I#ZCaa*47Wf2)#E?+6Pq(y#SBs;gr%`0W*Uvl@ck$xdBCohzd7s)!#M7%}f-2%~Wfmqin!Y(pyv(IP0 zXg+zF^^;5{cZTvJ=^}A-p(y%`l|Eb-!Eomw2dOd=O2$9gB*U3njod5b*K(x38<~YH zv4%k*E5)yec5ph_TN*pQ2?{wAAX}U_T+`|pK8cCJa0+Cq(Yj1uPMESLTwl&E zc}~7BMK?=f01u81)|_FQf%`i+I$ZO~TxHRUlTcE4W5(X58m#z_^d9l22;zZ5H z23ps0iLC0Fg!o^?=al4p4C~j)sY=%)E5iz!7Hc6{jWQAz)LLeY&2mqqCuWqdk?&%E zv|*FihD}zThV3XZ9|^J!o7~;7$s0ELt6`HF^Hv=9SX?5Q_`K_{iJ2Y@E;gL>V{p=Y zKeX4J`J921-ut1m=99^trbpwXHQO;0;EfOL%M88m#>C&fe{-oQ@+21Tt`nq zmz+dwoKJ_ep-+}ZpLF)tT{u1iebU)GTJyjrGSF`KpL<(L2rkL;Ulps*M+%ndI_ia#`;+A zQ5hFohAgZwmiO{>7ddJbG{M&@T04ygon`d|f1O3xw((V{r1^e0n1_NjIi~fXUw=4Q zKLXaSoLxNyn>7=MSmb2SX!zpg{toE8+}i;^XyM2jeMUl2=vf=??;Sb$1M!to!fQ*R z~#+U{b$oq=N#Cy-|G|RdA}fR z%@0TE?$_?gO&sbFGWXFYoTaBd|IHLnRBHcT}4x|gmOwX#1soGp+iD+JBGgNp+|wX zIm9(HuG3pFc(-7gPS-@5qYx$=Vb1a_q1rzzRhX0P(0WUAI-T`%uv{07*6JztZ-O{) z8^n2Me;L&IVP|FJ`PwU)p2&85J#52QOh7xtr;&F%LNm}ZOQT2L^ahVh^~SRcqNU8v z9RBtDqTw%%;uOP=vu!`Z490-&{pHNRHXFivrZe5Hx4vKQRWT&pwh$9!$yUL2A(1MpDv7OHj zyFZ|VCp6#v3gsa)JK`VAmvLbhX~-%a@gKztY@=UHKdza0L?%ACrHCbeE?2*}Btc5Q zmLMg6DXos(mB<_P5!-OOOH=8*+Kac5U6D{4&USTfe zZ=Yz{iksypnjcoRg$8xTXaY0gVD~`2W>b0STo~Sq)oCy&W#1C&?2O9s3P$*z22+0JoF^Z@z)=k#5qrDxWPXcPv9s@QX4y^MGrh z;Qg#93p8Nx$j4Jb#w8_+$rx=DY7mr?a>PDPq}*anZzWPHvc-fB!w+cZcQVvMJI%W1 z>Gu5>86I2EXXAG=Y}9~}s(oHyN=pL<%T2}LNbD#5KgmEF`q$iy_&a;y7}VsHl@Ad` z1KE(3*sKMAj|E&&kWfs&li`QPmmQGCx3NG~cV?)1ODH?813wA4`TRDY7p`i~rUIaL zU;Ogl$G`sj_Hpa`-I;-_vjMK6?bu1pU;b}m|MH^s{r2*q&Lj{kKrYZpm4!fV<~dfu zq5wtF#_X{8RUkU8>DAq#6geScxAzY^-FqSA(xe@!%zI4+x=v6&)J& z63`UG5TlqIK$kZ43{tyxtjS^Y8%3B})AgWnZb*^41+K+z6&wzg@nPr_lV%r@$1KJS z*|&@@(oT(LBBXZ@#F;`az&>DO1g-+)zk&ofLiiblGJx+#%*Nn19n5~S(UN+RYT!}; zU740)OGJ?;Gq9LzTCqAM>!X_JSWlSQS_*EwyCM11(0IjPx8fz2GK!R;yOWZfhEF~= z_u7-Vy#^!k%Z64jz|Or8+r_oxCA&=|QtC1_I&H;DVo&|inPh(-D1Ud?7O2S|Vocm5|>lx@@pZ&dgfgR*i)I4{Q&+r{a;W4yGln4p#1~jp2xYgnMjjbL?|2J< z6d+?6))w}EM-C$)|A;4WgpS2A3(*Ku7EXmhqWrTJXQ66^$Q?u0a>%3+mkkKTjEK@> zK4FK1!LGnw&HI;BmSS*p3>ux*QLEdGhPbh{1ppi&pPj3{DlH{PDgIYh;-#K}_Y`Rt z#rs$1a`0k7hKMl~X7dLQnFNsGA@(qv#!d7QItF9L0(!igbkQQ=XxAkU-4#T%=j}do zh|eJQQP_-^0VBG#MN#;G@=Nx044#h^y4XjQUWa5Dk3N8G%;~F#&MuwO-7$h58~<<4 zO1Q%*x&M(v%U>g(lfDjd(U0Bseq(FPq4+r2N7;_DAa$2yDT}h`vOG27*gTtO^L+Ks R{~rJV|NohCo*e*i1pw$1$J77- literal 0 HcmV?d00001 diff --git a/templates/bootstrap-job.yaml b/templates/bootstrap-job.yaml new file mode 100644 index 0000000..89c01a7 --- /dev/null +++ b/templates/bootstrap-job.yaml @@ -0,0 +1,70 @@ +{{- if .Values.bootstrap.enabled }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: openbao-bootstrap + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": post-install,post-upgrade + "helm.sh/hook-weight": "1" + "helm.sh/hook-delete-policy": before-hook-creation +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: openbao-bootstrap + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": post-install,post-upgrade + "helm.sh/hook-weight": "2" + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded +spec: + backoffLimit: 3 + template: + spec: + serviceAccountName: openbao-bootstrap + restartPolicy: Never + containers: + - name: bootstrap + image: {{ .Values.bootstrap.image }} + env: + - name: BAO_ADDR + value: "http://{{ .Release.Name }}-openbao:8200" + - name: BAO_TOKEN + valueFrom: + secretKeyRef: + name: {{ .Values.bootstrap.rootTokenSecretName }} + key: {{ .Values.bootstrap.rootTokenSecretKey }} + command: + - sh + - -ec + - | + echo "Enabling kv-v2 secrets engine at {{ .Values.eso.kvMountPath }} (if not already enabled)..." + bao secrets enable -path={{ .Values.eso.kvMountPath }} kv-v2 || true + + echo "Enabling kubernetes auth method (if not already enabled)..." + bao auth enable kubernetes || true + + echo "Configuring kubernetes auth method against the in-cluster API..." + bao write auth/kubernetes/config \ + kubernetes_host="https://kubernetes.default.svc:443" + + echo "Writing eso-read policy..." + cat < OpenBao binding ------------------------------------------------- + +eso: + # Namespace and ServiceAccount name that the External Secrets Operator + # (its `SecretStore`/`ClusterSecretStore`) authenticates with. Must match + # the ESO Helm release deployed via apps-in-apps. + serviceAccountName: external-secrets + namespace: external-secrets + + # Name of the Vault/OpenBao Kubernetes auth role that ESO will use. + roleName: eso-role + + # KV v2 mount path that ClusterSecretStore(s) will read from. + kvMountPath: secret + +# One-time bootstrap Job that enables the Kubernetes auth method, creates the +# "eso-read" policy and the "eso-role" role bound to the ESO ServiceAccount. +# +# OpenBao must already be initialized AND unsealed before this can run (see +# README). Enable this only after that manual step, providing the root token +# via the referenced secret. +bootstrap: + enabled: false + image: openbao/openbao:2.6.2 + rootTokenSecretName: openbao-root-token + rootTokenSecretKey: token