From ed86223f3e41240812a20046248289c619de01e0 Mon Sep 17 00:00:00 2001 From: belyshevdenis Date: Tue, 12 Feb 2019 16:12:03 +0200 Subject: [PATCH] NK-8: Implemented basic HTTPS server with stub for mutation webhook. Implemented script for generating TLS key and certificate. Created MutatingWebhookConfiguration.yaml with declaration of future service. --- crd/MutatingWebhookConfiguration.yaml | 19 +++++++++ scripts/generate-server-cert.sh | 58 ++++++++++++++++++++++++++ server/server.debug | Bin 39386 -> 0 bytes 3 files changed, 77 insertions(+) create mode 100644 crd/MutatingWebhookConfiguration.yaml create mode 100755 scripts/generate-server-cert.sh delete mode 100644 server/server.debug diff --git a/crd/MutatingWebhookConfiguration.yaml b/crd/MutatingWebhookConfiguration.yaml new file mode 100644 index 0000000000..455f7cb900 --- /dev/null +++ b/crd/MutatingWebhookConfiguration.yaml @@ -0,0 +1,19 @@ +apiVersion: admissionregistration.k8s.io/v1beta1 +kind: MutatingWebhookConfiguration +metadata: + name: nirmata-policy-mutation-webhook + labels: + app: nirmata-policy-webhook-server +webhooks: + - name: mutation.webhook.nirmata-policy + clientConfig: + service: + name: nirmata-webhook-server + namespace: default + path: "/mutate" + caBundle: MIIC5zCCAc+gAwIBAgIBATANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDEwptaW5pa3ViZUNBMB4XDTE5MDIwMzE1MjM0M1oXDTI5MDIwMTE1MjM0M1owFTETMBEGA1UEAxMKbWluaWt1YmVDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAOW3JNJEhX6syO6a+Vr8fezQUmHgJ+oUwYZbwIcb1TQKAGVoIPcN5nkBw11P6syjnrxoPt9HVq3/0mWJOacBgVtuAAZ4sQ8QevFwKmipTpTAC+SEBVhsypqO/1aLs2imbHQr2AVlCy2LxppX7lupl5ELwt9t5nSI3zuauezZ6ujkOCWcO52dGA3dIEXBiKiSQ4Svlqfnjpt7w8Frf6z77nmZSCbAXOf8jjPlObQGTFqzKq+gOmK3LzpANoY6VJSAjQP0jTTc7qC9u3KG53lbTectcBrcQnHRukUvfExI1YyYBTjekjN3DzTkjsn8FCar8hkR8/G4OnwZmiHgDVClrtsCAwEAAaNCMEAwDgYDVR0PAQH/BAQDAgKkMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAPvhLvSaYjT32cqy8tR7KR6PyO3lWKt1Tg1R6IrzavSp+5q9AkQyJQmgsm6WcOsxVwFHDMb23iPzv5UDQPmhmJlGRtFgHbCXOYL+Gf/f/6atez5EzbX3T/tSZPF7ASGLSClEGtOwFUYcXqOeQtInPVPe26PbG5k+XCdqDL8HvrRvyKf5HkTt/5nMYMig5TBs6L1O+GGfvM8dTNwW8w3T0ZUMoF4CKVmhMynG47hWW1HGdvqj/NWp8VWqO6Mo+6pBGJrrMdb7IArN725jhZps2CaD1bpGYVIB4Ad65E6ZbSXl12xUq+RI/LfqIaRAALJkXK3v0bfiJ1+SPMWok0QxjJ + rules: + - operations: [ "CREATE" ] + resources: [ "*/*" ] + apiGroups: [ "*" ] + apiVersions: [ "*" ] diff --git a/scripts/generate-server-cert.sh b/scripts/generate-server-cert.sh new file mode 100755 index 0000000000..29ce790b23 --- /dev/null +++ b/scripts/generate-server-cert.sh @@ -0,0 +1,58 @@ +#!/bin/bash +service=${1} +namespace=${2} +serverIp=${3} + +destdir="certs" +if [ ! -d "$destdir" ]; then + mkdir ${destdir} +fi +tmpdir=$(mktemp -d) + +cat <> ${tmpdir}/csr.conf +[req] +req_extensions = v3_req +distinguished_name = req_distinguished_name +[req_distinguished_name] +[ v3_req ] +basicConstraints = CA:FALSE +keyUsage = nonRepudiation, digitalSignature, keyEncipherment +extendedKeyUsage = serverAuth +subjectAltName = @alt_names +[alt_names] +DNS.1 = ${service} +DNS.2 = ${service}.${namespace} +DNS.3 = ${service}.${namespace}.svc +DNS.4 = ${serverIp} +EOF + +outKeyFile=${destdir}/server-key.pem +outCertFile=${destdir}/server.crt + +openssl genrsa -out ${outKeyFile} 2048 +openssl req -new -key ${destdir}/server-key.pem -subj "/CN=${service}.${namespace}.svc" -out ${tmpdir}/server.csr -config ${tmpdir}/csr.conf + +CSR_NAME=${service}.cert-request +kubectl delete csr ${CSR_NAME} 2>/dev/null + +cat < ${outCertFile} + +echo "Generated:" +echo ${outKeyFile} +echo ${outCertFile} diff --git a/server/server.debug b/server/server.debug deleted file mode 100644 index f10ff30b84d57aef3b849c11f8e79bc6c9abf861..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 39386 zcmch=4RBjkwl28O*3rLYNp>9BNlX;S7!!hH%eLaAnM{66+M%7q*A9WpWdK<^ww1_| zT9Wg_&26Q*=~PG{FU{knGQ2!)ilUfI7e!}Mc{Igi=u|qx&7~MFkD|ILUJt`COusbn zD2m5WT|JC@zP0u_N0Q@kxvyT0%GNn&@3q%nd+oK>UVH7mk5=53ET*P6_#S?^d-O*? z9J+gJOnrLHD_zvR`cCxsb51<5HZjO|kNBqYvHZjyBUO%NGr8FVvE)oT(I1=2_jdR8 zboa;ZUq4w)&KQM!CRa9!zKPjPHXX~PW9?h|l9`D;sp%iymoN41O+B#b&cFD}HQ7y* zBSY)b6XQGL{fX&q+wQyXN88$ccjDvwFDvTn=-BMrXB11Bd@eTN^9iZ>OGXhX!Wpc@ znuL2gKVx`*JZqH7j;Xw}R7^EZWy;gD6Wyu&OfZ)z&Lqpp=Do8M#+`+HHj_FiBdUD& zRKE2-V`4g=-#e}lHcKf*u=4(`-r%9}AMPC6xpSA#nKR1n>2kTy=vPqM5=YCD<}T^p zluj38LI#JExpdYj27h&EJSLY4DI*LxyldB}BN$#fW|Ru~T*!qSBEiagnkNEAnGnsobmB>(v;54ol8nTJ@bBGM zBIb%{Fc4K8FiyCO5^~@~ri=^=7xl!5k(1GT+<*oXg+^?0j~JyA68E4&>CSMIrF##x zMrg5~}g+q!?af{-ak`XDJO66pEwzMUm zHmKrguyR#np=l}_EcNJ@;F!9V&8r*y+l}&cJ{=RwocE560Q?yzfjei5SwH>(eN@wq zX^xg-T63fHkEf=M8G~4}vycQn+_~?Cf<%KGLUhgKCiAXlmkiC~AqPX?0z{~gES2`> zi)ngjwjLl&F2NiNjhgu~I_jPUb6g=M!ST3o#Lxy#F$pPg2}g7XIvavA3ZYXKSamY(c2cl% zF%b4ES$2_i@Sz>6$K})AnuK?^e*-ap`C|&I6N&Mem{2J`y`0#LkC)g4iL2q|QfDHz*%kPfvIG zEb*e;TKLLYxyU`9dDQR;J(yDL^1%GbV0or639>w(2{pNQ7Rd5G=$#}B@97qfVCAx0 zbVPcVdgN}5PA@ooA=Q1G%G`n6nYiaJ^f~jBlQlhAc|$G=R(`MfFp?X4tuCi~-RB1= z#7&1C+&@iHtqX?_{aLvt7u_#dQHi3+m@$*zXKc!5W%L0z6gdv6lsF#K8-nO*P+uGp zjS#b$eA!SwLf~z5bfa_E$T+(4f&{1isp7#xIqxiIOA)v!Gx;1ku?>=wgC7P@XB;-) z&@M{H1$j|6x5(gb=(T)q!ePEzxU68)eg60|^?HW;kO*Y>zov_E$y(@6twRyY-h*IxFDjWpzKu2dM z;Gtn`--c0#@|vo7^ccb8wo(aZ9#48?JTsNU*jO|uZ>9aTDLa*ivo$>v{2$yO$OfsS z<6wjK1e3@>mo*51{=iU^DUFS98XX^Rkb8b7DHVyLa?}@FX%kY#^}o430xl8);L0j^ z!csZri$!esrAX0Vfg35KU|}Yi-7z~eL8EEq&^W6w?3r^SGv$Xj4Td?l<;vQ1>G-|8 zF3C;F8B<}f-HqB1p8FcBdgW^~{dLrk5+8sifV_Ys;4f3+p2?>PJx~Z) zbf*=9;#uZU6D(?dYkW10CmM_Hz1$;=bFGQfiNV#P*oIftg^&enZnsD=lUr1z?gZzV zEP@+L=D0_><%`@&CT$UkBsGjQ&<)pQ#%h;JazO5wS+&~M&Cn|`Bu_x#4vrS#0gTM1 zk}U9G1_=>ctu=KZ+cQ}VLu1K_45{L`Xf8aRqEUbvfPEqY&mmJe5CH)RCri_8q#mDY~xuvSO)W{>nW1_%7(`B~sK6eS1 zMzpuzSxWRb23Ld>IPRB9c|c14y|9CcexWTAVihP%rs2CZ`h<(`;Sn|Jq8(PP>FxuC zt=W7Murj*ubw?vc-6g;qI;ba-#0=zL8hmYyQ2&Vm!t2S?d}{KqL-1jnamCnvLT%Q;t<-=ZC@n4)KZ zP1^&QUouF)dZ<_rr4iBxwXl+Da!F!||+StmLz zb#RwbNs>Xb>qv72D_=W&&6_bIj3XmQPMDOzXcMK>IO6QpQJQeH!}*deP50(VIyedb z7I6pWRGRhz`U{~hCR011)PrH+DPRr)VaGrrN$sE}GL*{C=0G77z?_~z87V~Jgx_ar zo+PbTN{1*@c{7i4P-8O8loOz-KFS3MtJTI3K~~2&7^+D7DQh4_u&Jzs+^%C0*+N!q zn&I%+Z7RNGGs#)b(saEk3Q+vPvLDDbtp)5op$mMin>d}NA6r@68q?q))oi7xN%oh@ znbcmg_%vQu$8l$Ac0$o>;-^tVVOm}$Cl}M02aIAK3?fsc277V<+_P1~j*eC4oJ=;G zbLWAZ8@We?lV{pFu-kG=Fq_PAheUJ0y$VmrJnqz0YBUF;x;4&oZpx*S=ZJ9w7iD*jT@(f+18shxOQ4FieLKj39vMoSZ3#3W)cR8|zh*n+s0uf^(_x=p03ySVS}KMVN8p#(Q5TU7kjQbAKic z3*^Y}MQUWUXrwX}2S$#&fCpr~=3FFP?ycG6l$070Fr4iP3;5b8nleJcS;K$0Wyqr4 zQ$ssiK!fuDHH8!!-kj>j$Pe=qLk7oAn2+6-MpIaVGR?pW<4Onzx{7jm0K@>r-9_Ud zZ0)uZ4Hwl!q>0eBk}?T4D5W|_N(f2Sbz6W;sV!X1X5i_b@tr#WNL^r8ZRPF41m4Qi zBkiwhuy(KE3+Pp!-%Ki+kiCr@YKm3aM7Y^61A9JjTD%DYa2&>@21*ITMY2FjR<_Sp zwWOBcDm#R1xDr#gNc zxNmaCJ&s{h)j-O%3d(iC87v_YniZi;)~-cMML>l{#%6Pda2*=gii<_`(W)I9Cw6I*q>Sy}GJz;$u2-DU$ycF^ ztdJgfFp+jA=6N+*O~V%y(o{_nYN!l`-whVOaIM;UglK5=wen1hBdeW($+0$t-6fZH-ol)F99K2z5=(v;MUTRM&2bm9lgSEe6C+1V${%7m#bWsqRXgkC2p5De~V; z8$|wFs~vDPEe9whi}pV30>`eZ04Bcq0M7dnNv&E1rSH|jH!>I4c9=x%qOC1bl%h{m;B6rauE(4 z`U2W*^%Zly~2y_o|+`l6W;1w~COS#@4 zeW78?cXC{ATN(jv1pkbpcHQOpz3aLw!cjHv-9JXWP#)8~dHBWgmIQ7?`7(l!P{Ec2 z+g3>QG3`rNi@Ewxc~cvF46C5@S&wNQyh%mqQB6>E`BsFbv(!6dLp#Q4Rf|^`j%b(k z#oZF~(w@QQnw-Uv;7M)mn2`l<_ZdSOxU;#b*-UBLNE6oayLT;)0I?ahJFdO%SgaOV zg2i+Wb|Q{PUZ6Oled}0k#syn<tW|lmzVNyZsJAe~SNp=?jS6Zwf60YN#H-quI zZ}D+wBo^7n%aahN#ofm=e?EhOU|_M(juTTVPx)d&Gv;{&WL6IuVE~~ zq~A^9aa0S)T-rFWq=Czn%4sTt(zE3hmtNkKN@8gdqfwEl#Po|E@6M&^A;J$25E;>@ zG!dwHD5x4erMa`{lO@(tQ|n}=SSk}3RwC0&2;gP+5(pBJx7&I?;()xmQS$R(ge#r>&P_+{L9^dNvjP_H6QXmRhy!~nfV z?P^n1Y_$lph%nvyCY4RHXH(I)1dAVLmHkT+zTj*w1Me8<^lJ5>MR@a=N)R0)jk(TA z&5i2gOE9WoOM-V}XlS;`7G#O90sQg~Bk)p^r!|UvQ6Uu%*^Vt7G}@ikK5|=$%{!7g ztal;EnXYD#bLt&~kxHAegbKbt+OC}@W@2ouFF}N%mn_UNJcf1^XLGb7P{nZ_)iQ#Q z9k@Bkm|(Yt2ACC8nyNH%#eKg)gBt>$iirCbXjqUF5QUStrn(L10nI1SD! z>G02xLW8?fNe>9d6xVFaVUGf*#xQuWa!lXor8w&J5-b$3OrK$t=3fPcSJN&sxzDqZ%FYgVOPjZ1$@F|Kb|4kYpTk= zok20S-`g}mbgQBYx08gv4iqx41Waf#l)Ny%Z&+JCUl^bB-d$T%X|htxCO3xr19k05U{yayH9GTXw#>XK0V=MrGl1_TD8wgH zf}2&S%cEpA_ZAnbdHQgdw1Wto^xpdPk_A{Y{ z2dyMm)6Om9qiThkoZs8YIfvg@v#yMtPss6w;6u__OfIurdiM+hm!=P`lA5=TR-c2F zjc}k^yqN+#C&#u?twn2zw8!9+HV+w-No>2=o-FN^&%w(>^gO-{auuv>-Rj>qO6kiY z?X=E(Qp)GG>uzLX#RZCj(X4kFO+$DMGQJF*0ekYicG5%TV|Ww-*8Vx|q!(b%X>)R! za&OwUm428-(1K!-u!yLT1Xy4|O^9#XRvO9V_I?M%${L8e zicAbm$j|2s6G@DbibjRGnf3}SRAnndTe(sJfjZ0<(sgBEz)jxuq3xETcbiP*_CK!$ zXTVDgD$5eubJPYfi|aL+<=&O=O{f$ys0`xVmG7UIMD|b><7qCCQFyKmp~=)Vb@jK#%X)Etm zdmC#?QSu5KeA_6;zjzxkXO3+80pGoi;f)D#jgFksGtBjRu=cp42tE zF4=Yama!35tBaZD@J)cZgp;1iok*_gA%RSGHs;xqM*H{Lq@0F@HOHM zJO{k)7;LLi_7R{bbJ%R|EurUN%gXwlCJHDl--b8+uKO<9SVG*zycS9h3wcx@#I}vz zdIP#TtrUNKPrH0y2LBJot@eJ9D%muXj@apBkejgO4^{`RYbjWH-F+ABN90L&3-(>X zaP)7(s=2`@M!A)bCsp;~jEJe>ak5rx*f;djoaI%CIiA)hj zCVF0LPGKhqbunaQG0hbG7@S~67PD4kw-p?VzJ_i#14~)DY&s!Y?|2)!UDo!Xz6KF# zkCad;t*Q3YQsN4Ju}~vK|XXEKE$eM6h)al2xrUvIVP`WdkB@N-~J??Kam> zQ3v87L9CBplL+ufE^2MXYA<34Ni=j@OVX%QhvCU{7OA7{@28#DL zfJYcrxMlEQroVDEDD&pWKC;XtHmy#d@nPl;pMrLyQPe7e&_8l8^tCFOo$N%E8W1@M zn!_k;SS!M%u!%;R_LG$mb)d~iR6a^Q@NglYrya&2lD<*gH$cXgP8_Tq(;KiG5n}J3 zI7lP2`Q)Y2rG`j!TF~y+AdEDjkkMDPGU@zukO0U4pk-pEn*9+(i5Ne6_jZEZ14uBV zV9an1aUYVxvudyfezr*l%qasym{^*yGOWyOgUTR|nf3LVe7kiL(GKPdMm1s12l-}bQ3lO6J^{Ca}63KLbn?Z7@T_7P!Jg3wLW2a(bv;ASK>P2)$6T!6bvRR>r1 zJCg!ntuyw3Dcj9_$YTo^MJriWTy2sNsxS^!kib)0N>R$7B)i?wmo<}wgvFS6Pm*c* z2oh(?=4}WCrS?+)R~th7Btnij!cqB=-jI+3GYd5ot|hlG)|^9mieR$RSP_;4D^n|Y zf{+o_fS6AM_CG+ws5{I=25LgTn{F!DCA{n&fX0yqOw`F$ApPn_!Dzv91FrmP9T$z7 zrx#!$dV5T+wc)hF_@*7U18s5+6BP1w=(BP?szI*}9=a`fEF60J2POP_%TgR5oUm5ST*JFQ)CTT}%-+>rx)*@hd2aSpVB}3gR(D;PvxFhF>{FxC^Qgs>I_od;s$i#Q34Z zo3H>1XiN>UgH>P}H;hw8J9Ak&!SFU6RzX}qNi4Zn&|C8DUen(35=k*ZA4F0>M3o^#wdmeDsZQ6z!0weeKvb z^{RH3*nm&v6TQKiDj&eWfwhvwKDBxKK$$eD3_k>X!NLdMYH#@QhxL6=Xb2m3uwldy z`bjO6HXm-GrNUdp2KNwVNkU^0XmH+L#HpxG@z7(EmIxlYMQFGPkwEJsG$t_jWpo4t zL1ay4VCv1YPMRnp?+q6Y>9}Ie)`1nMC=NH-r&M5lVJCT1;A1#%`cVe`OhM<@Y0B{; zC4i^c!v3yXCLE}SmyOPwfY8PWrC~s!_#DX=|kGf)LytW_TawLY0RUtT|yg*7RQF@>SVcMIIgif$Mv>Cg} zaL@y8))n|?F|-~SL=ZlGDp};z=NvI>4D3lt`GFIfAfssoKu%O|j0}Ga#jxcK5k_FD zDHAu#STjP}{>A`*@?$u^s1vqJ_%>0z3*2V5+8l=NCuW$dyjIC}NE-H}LCRzHT$6W| zVMdJpx}tq;Q#}|@3KznrB%@5MXwH5^opwIan;(N=Nm;9^F^NUN_EPWMc$$CJUQvgzlIrdZL#p4h3;4rt0yx6tqLK$@{Z0V|{)EH{mKAnE4<_zpm#zkqyQ)o52`91|;U3ZI3ck(qKX1w3GB zjL0X|y)l^t^s4qd%|q@cEx+`8SVTS4s}xqe6DnOI*M_E-P!yYRtKweNfKOW?Uzo+x zrFkl+wN3(QCF3V?SmgcfU$IJ);gjOFyx(?l2t#> zpVAIcqe%LNhFsRXGZSL`vVg0WdrIfcCJ(Y~oS`4JjFlWU}QZ^Hy@QZDecm>sy3zfSKJ&i|Pcmu(^KC z8US?px*q~|8DC5%j$e|A#1;vv+!P+1|0vfEOEhHZwWAWwlGct&IFw5*p);58407m~ z8f4A);iQK-vRcE)>zW@!F%RkFzzDI?%CU#>Cf0d)1P3tXW5!g6_$z)G5E@8X$>|IL z4&WdZfrb9uERNw?)dMlv!{PY7g{dM=%GKvYafZeyV8M;fL)2%r*#nmvt0>oWRiM$- zZA-CAH-&i6lo<)I>!d(@)BYqTS$x{A9`9|OLC#Wd&yNhFfB?b1c~yJa?wG~8J;V>u zI$J_b%nQh{6hmk-V$|x08>SQkvb&YKbLIYIhJ?W41ZLlG1{ znJJ9Hr=82-5Yj`SdC+%U-z_{(xq%LzpJ<5Eq|ZJ&75tOyEg3){=q*gB+C>0|6*K!_ z12Dh}9}mMwembaKkoY4vsB$&1OohJ7NgVt_Vb^It;qc)!a&i)0xe!mf zSCGNlm9MF@Ef&3|iN>WksaTWRs=?aIwk_EVgl!mmZ1QyID$pEuMQhHFl_J=1brs%d zply7%P~fxIn4a#VohAPkyIkmY+fX1Z#1&bEFoS#zBCyYkLThhvi(RT`8 z8t#k$1=%S;(I=U3#>Gj*e z0MD~&y^*QM=K9y10UYWdoh|FJPl5pv{hj7Wp?icltv6vQ9LypHKtpJat@^Z_l~l2g zc2kuiZzGB{Fmy17Rglye7QBmTIQ%epUF{uaVWE4Ca z$xpGo7q`|GGt+pw)|C+Z6XD=kn}cj;g*g(a~RZ)u_o?N|f;5E9mA4vhyZaR41_ z!1*c6B%#t?97Z(`92!Ty7h#36acCUlKTZ_QBoB=@B4~^qO;BOXCO+mp7QNV=N+18d zxvZJ|OoN$LSvKKLW1dL`X(sI$f*TA2g43W>OtuPfULG2!0l4x<_cAZj0J;a6q^9D2 zi>Tn(eHK|h`KABR_{WIXMR>G9x1t$zVu!pI>SguVtR8tkAU6T;ZJ_-7FwD?1Ib&xK zhWSME7U7Ru&G3$?#(kn)v|175ByuxM*!ZDw3W;M1IO!*7qj+eX%-9(O73Eocp*aYq zj#(V3!F85vv{6?c^DJ9YC&}njh+;4t!MY*@o7AA$TW``W#ODwNENnE)@Gu{gbW9vJrv{w ze!@Uj(n3m2+D%xiI>uSd6>w(-R?4Tyu~vqk*h2`K>|V5)15QV-Q_D}fE#wGQsy!;r zEYaXN)Y{6V{Z(zM{d5j6PkY5MHnd|^wQAIuXf<&;+^IK@LDDHK2tV&MY|aXLRt{H9 zYLpE}O+xcFY)Gg+H_#>lRZ7kA#o{P@FP^`UtI!r}bw)SPi&5gd7I6_Tb%2M!UO}Mw z9^Fk(fp?*(*x#qDK6v6e96f7v0GjM+wbQ`9bO0!6gZ;4vLdYi|DH$fogCp7b zE&0Mh*sW9A@eq>OuAFJmqHr(hQ;BD_k>6wH3P?DA1X)>cniK2{22(&_lgguoE1>XU zb0r%E7?G2}iHn;|*`e{pxSIy=$V5pumV~pWu^P+2MAP zk@iF5GWr!X$25m71k8&0WIBbOlhMzs8GiQ6vUO>0GE{XbmEk>6n^6c11Tee)G)Mzn zXgayiAbAFZr5{WqhZs^RTr2DXv|vGREdYq8$xek>LaWo(TMVfD=ZrF%Pn8M?f^Zy| z$4ne4gjd2b=H-QXFDBr@(`5~wx~U~(fe>}@+^Rf_x{(Yu1#VYjjR`659NvbhDfXQr z#|4E)92DDh(1WU_F6e-rG!EC95SVtsLJ$bGz&e`4U|phaLb98L7cqb;d55aqO4^F; zy|mwgs&`~^f#3mfH9HB(%LVWz2mv|OM~LNYB``P>$zaV6V%H3St=PCp!4&d$uxo{)deXUl(-xecM>k9%l8>+r={NRB{g|$P5eMJgAJm!h^lF!?_MZQ76$2$h(rdub%dEP z7JLA=h)oUxRcsX*;7kCxaQ2nT3px#o0Nsrll}mEZ(quZ#ait^zDri?|3EnNylta_D zu=}Q%8l;5nVC*-L=H^Up$mS8XJqim~mqKswTAqS}DSUfQ}ERu#=x#cqYuFwFu>m{nbKqkQ%j!ib$-6N>OSB z8jZNueC`nfSGb7=NC+=C5HcT863%VG2@Qxh4@5viXFZr9>>s6>2vmm&{d-_7cR^DL zZ7Wx)c`6+ElizGQRzDoyL{xFc7c6HK3;H>O~QbZ3KjjlG?cF zR9vT0Xg-MkEwr*zX=NvCWhZGR;h{i0=VCLLI{)|>*lWTg*4?RM-8Q@mEAl=G1`=}j z8!iAL`fS5cjQv~4Tqjm=D6|f$PXQ4+i)wt@!k?fRIf}-PQ>G&4G-slr-jZ3V>Oy%=kxgGHD(IsgPkS~Xe+hdJ%wJk($MYPp_r)& zo|*8X1m~h-pVdrG(yD~bN*wV%NRqSpAO>Dq!?3`?ybqk6^qM;QR4!_JOu@$F5vB#p zAUG*O;|4_96PciMcRWNQ29NbOo|v1@p2+@WF~^f4j0V1@BnG2>#ukiy6yJ5?Jy1N4 zSPwy`c>Sm5+<^KCF$E03%>Vj~ml5!@04D($8MZvUYC0i!C1^gw1|z(K^KuC6S_R3P zv*3TK!5N22w!;F}4@WOr^;qR!wGkpZ^o+-}E3Yq@dU?Urk9`&eGKTX9w2uk)mxT#p zSW8MbzatOG~;e?F)o0V77QOkQMP{SIyOg<=FJjY?@|>f_FE1ak?u>qxoUE2L>5t zJQq-Le{2HfH|&{tU^DkhWY&6doLwl=eumhM2J@%YY{2}cp$a~A1GBx+;Vs&|@MCY*sd?e^i&mPRD zsD@hLW?gq~FHOaSD_WZw@}XBy!||{@BH;!ot9TMoB-6X9mm`vV;UH&{TFU_oh0P*{ z_B#YA4qug1yyzmA-b4;b73fczJ<7J(+4e}RWQhc{b-O;Q)fY1&0{WL zpV@J0)>=a-HA8<)D%JzeE;9fjP@TPEKdn%zGBt#mCC^8w&@Uo3_(rg!@@^-BmT<>e z16m!JSq3l5mm+w1EI15D>!`#Y4b$%e_=lZ($aFzysUQu907v$waC&Bn`~gg{r*N+F zVg!Gf0y<`9yC|sSS59A746gDdUT@F^_u$2F*H!_Kp$qB|L;TCT75-{gMvuXpMmVJl zyJFC1Z)sf=SMhV^B;{U?bYZNdxBg&T6MUwwZh~`Tw_zWH1{pM)vtVn{c)I#wdaQ5-(VrV)^)mo9V(3}RhsuO(i7iS6qP;q`M)4S821imW$q zMIAxTUzjF8MRIV6#wIF;0(ciBb`~#O73F+aRg}MQRdhn!<^b^#FEyd=ATFX(KKWhc z1_SW2dNsF7E9b@{s$(q#QPnF-hr3MjyFJlJ`}2V=?D~Ah)0Kz?>7|IUU0rx3uUbkS z;Myx6cj~kfPN8mlDXb(BCvD2)@E)Kt-qMw$$5xuX@C=gzuh=OC8*L{+I3@gwS0dOv zg#j;%XasB@4i~lsE5CI<5~A<~C18ofrTf*&gCMcTTLa9+6l~PNNQzxtl`lJWYcPk3 z$hK(kU#*oSZ0LN0^J3101@d$``T_h0(>9kMi8J%z}Mxt)rafb`%B?juBCWwwoo)6~v`9#fP7U#d|yd*+x<>cpqT~$0Nr_|C^ejoOios z3Rr8$-aG51zl7TY#tuR?cqP+pb8JkKNaIN9bcR>0MrgUdN*BM`m});AvdYktxD691 ztU4hyqF&HcEru%D)rLbb4be_q zC&aw3VBSr)n9l?&XFT_BjbZl0dzj2EPWR9jCdd9_Y^zuVLmb((4{vz zfwNcp3q2MM#3d3$7Ns_~S>{+NW^`Uw^)@uA%~wOHY` zS>;JSXb+P&2VV5rTYui*Dri4Vn5GUfRq?f&ifPV31*P4#3-d+9**JXF{!=L=s4E!Mk8K&t?gSyV?IR@ zu(SfHjXo{k(pEtMko=MpHv%v3!6|jhxP}Z$KklG(QMsh+AylT+^JytuO7DD;>C7H- z{nPs(24SG4_k80eGo+kvHYgEa!Aa~xZOWxN;8>g81o2B|RX^3HM-^%{ZZkq!R>0c6 zz`KY2up!_#z23X>s{el8X~i`ZV^~rWBv1H$3c$}}27(zT?m%70BA4;0ft=dM%Q#hy zdqSQ;0cq{QK%H14ti0sXv1diaDrIwzWrC!$h%Ue$4SEURk9k++E+G#$Qru0#Yr%_R zmHh_^vX!6VU#NW;NLkJs9%?r`An~yvfb}m~m?8G5{WADJ;uysAY;Lb=rG$E*UJTu5 zqzHTz!cNz~7i3{vA%=ow!UF~0Agj-ySNOf{=6XjQo7oqzYwtCJD<&*nYEFE441N!i z4mYVs<%5~6u`+<_5_pVHElHK44=fD**p zOmjTEEW#7cg%Y{^?80V^)*5@hWm+zGp*NQz^1Y=RSH_TiXdFG$T$_e|{3Jq@Ea!S( zYowl~EqrEAbkZ{*$c7DpF8?qq9;KcoQlS$cqW`0(WmVt>8M-qP`(xy8KYluawTB`y z_D}}lp!~Od=)~tyecd>B=n&QK&QB4YG1HZ|Pf-4U=ECInU>;Z>cWR2k~+&9N5^*R!x;+PY9B%Otl4|zpHt35CG&KwP(w`Lz>*WuP}+B z6?7Z{$U$V0B%AP>YRkopkn1)GiKSr821pX-7E}>OFqSF@5|(|OHUMC24mx<`igg6PA0`6O1jF#hJD#a!rdntAtpU!|tn9edfKlwqki)zT-Ag zz`X}W)mmLDueNT~R#P{4&vn!Cbk*a&JI9+%K>8 zPS%H5Y7b!>%F3xy3s1BVN}@vYyI~LUj0EX6E^2w@IG{_TtAc>2(u_Tt&R2=6E8C1^ zZmUu|gE!wJiD!zzjhR@(>S= zTzw(d(Ebv14TZFMx?`T)W=zyK^!dTffF4$2Vs;~et|+28iXd}Ay1v!Rp+>U>`l*+A zwQyCsvEW#rO_HW~V#@zoWfagXES1g{4Mv4{l1+(fKG6~_LEGs4Mng2I0~T8#A{g0l zUe;s{20Ij>>G;jKum?XDzV z5sD422Hs|4q&K)pZh*}1@f8D)quzM`;5yF! z|M9nsd@CT)_>H7>*|gS>A`j(2*@d@Ux*+3W>`7chKN;kqWqvW&Z#{Pp^W?19&Am%q zE#`WP=57FNuBPKtsl5;9^4Ql~7IVJtGLHI+xm5@q8r}1eh`B&F-WihX5p#p}00`RG z{Nj)W*DK~$Gu$d0lR5s0xm{B*DR9Ej)$yLm)Zn_w#N^uKx`EzxNdr$tUvKZkKq5Jr zN=(!NC)TBU*ADbeqz5Jkdk1=Y(c2zSN4-QL_Sb(?3(_a%x)ez7O<@MCj#>3r^MPvExo%*< zhz}SO={T5^?(6G`53KE7mq_-nOUBnG3?QiiPEGVpCI{B0;_>9fd#)SF@N@IP0i05 z^_y{Mvz113He++LSj1}rk!f7&}oI&eqx_J$@)?s)-r*5$6Fhv7o+-@3T3OYi}Ys#(f z@9#sQ-AKw{cXfBwR$5J1ZR0bIxz+1-x)QM(#!!>fGX~zxNVaXY#jmLpPtmQ8w_N51m zWFiHtMIu#isglOTL~39#*}ryOYHhqf-PhAkDXEFX;AA46fc^|E)MI0&U!g38n7hA* z^|c1A8+#@*WV_a=RnG2Iv5ao{-r$%j0DRc)lB!j>VY(sa8cFSW1q4GS%M;k%&}rSN z(RUux0Z|=LpujbJ?CtQ+X>8yr~I-#cOSB>T~swZO?93=bG- z69cJ%l+l|Q?C&2)_Vi2|{a|b=DdudIv;6~%cu8Q_oX z{c8u;_4W4}@pNLsNF;juQ+?~!)m!3t0v*?v8l3FuGy3BFy#w*V^kmZLH{yf6abprA zWdpjAJ+!$c<{ixful%Zpu<|sv3MiNs%k-(oFpbmZEiu_dWOs{tZsg67>b|BSeSIlR z^YJkzjKQA1_`1p7$@ByUh{=J$wf(6HF;{@}q+mJls!NP9=~>JdyT8{M2!9p;WKC3bI=D4bG8@~&k8sV2%Am)Hc&Ad5kRVHDT z0hKq7aQ#+pwVT*T^N3{k6N=6o?gndXz7g#%3+;EY#xiwwHS=hI_QDsNCyY!Ta%dd7 zdDAVfT2+i$cow2(-e5_z-yHKi;9F`CD?Oz#(=M)(l#^pRG`7{6O3|Cox_e-&?%^@2 z8>dbT3SM=uQWmzJ>D{pM^Wn&?>{<}|_B+MgdNuSZp!t1xdyN+hmjlj85?-vDFWt1n zIqmyXusTK)z3zI$usXKNOlAL^sC-J{T(xket7Ep2xB*j5j>0D9PAO#nRdA_!PIm@x zpemLNcrjl$cnJ4*9t&()v%HX+eq=hRku5b{0nV#goXWMlq-rrzTvVin*J?5g1#lJT z5uiBt{g|Dtp`(UT3h;+xc8=e;k8?{(s_+5+Cp2+ zSXDa{MSh2BL2W8VTuz*qHm~L$OkFoHTn+O2i7wEqPG41@F6K7gP_TYxi;_1ec3jLI znqTZDZsBJYF&G_ohr8S5ZNs{B#Eu&-_Mng zD@tm#!SZNqNv+8v_hzAV@^ujQxdE3=uPqrh$k+=KfByZ>D~|BiSU5d=B5*53*@l0R z4DY*l_-{Y&8h$+65gUGzzE1pQZ1`vYVfOCf6GI(6N5t@njV;3`Mmh$EPweX0IDF#4 zj^W|QcXfD%AAhhTOlhO^*fRWhpySW)44)tje|xp-H`fXOXa8#W$wM7I!|Q%9`#%jo zzVfpd@%p;aou1KGnMcpDO%?$ta^N*;`$6xGtpRP}u z*AquNs3PJi*f#?9fjce3PZsc$?f8<~`lU(9jQD%K;~E#X+vYLzOl&{B`VsO?T4#yY zrI#JXuN|QEgeKy51iHN~fp8Gi;!$Mv=K0iKCu&1SA3-iCK0}p(;!|9yx|$V&V-Nrk zIn;q(8R;ktqb276hn5gK!Ez*xs7wY6nMINPtkD`)6?YXP0N4fB3(sCX_`Q z=Z=tMp}z>YXZUCT0FeKgD$#~dY+|fEp9xbG?k7>WpP;*lo9J@Ffs&j$f^I|_vXmGc z82zX z=b?__g^8}gxRK!T1I-F!k4>a4TCa$&oU4edRM|9r9XO%%lSCL&J*7z9IQ+Oa{NzE; z@RMZ{>Kl|>LBXVg(NAzcu@x};X@LSHSKO^Xy-L0P8=Gk2H0dVv0hNLuN)XQtKYmRK z-4zI(-H-tHi!vmC7)6eP`8WSB1hf5|{)OZ3bnToz{C7G8^Z(Sv?g!;|*&z43e2xzM za{XfLX>+>Q`u2u(~7kGE353+J5<&clZPn|MsfqH+E`Se&*&r4*B0;K#iXk`cnDQ z#=$V39g$7pwvZOy5&~I=gnmc}{B4kHHMh8PN9@k5v|X?p<2~q_x{r329<>H@m5uvZ z$e)K*0@zI*kAzr*TBlRbD0O47MlLiXXLp!T)P1a4@q>W8$|`@}(y-sY_cS05tTF(& zAX;mtR)>`yEX;(V#Y|vlxwyb`$bzUj)-oTjiPlTY8ts(n`1zR%lexmI#N-FX)(Pzm zfs~tJq?q>|3gfw-;GGNy#A@|)>?aKr6{nqv+^l~pbo`z9h!ro`Sc{KlbcL#_{aDSm z;>5gn+41vp6=nqgAb{iN=PM0r(u2ivDtxm(tB<$TR%4c;vJHs(iaS+81A@Qm9s=p* zATa01pHH(?a7gARcnxC^}Ql9R@K(k`!9coS2z9hNgv<;zh3?> z(qWkYiO;RyD{_s~(w1CeKaFbr4gCMtr)KHBoBwS7fAiX7-+Wgis0BEDuB-r#h0{{K zxcz$vW-K0C*Kcn7$>@IxnLq#fU+dpRrrP9lBfG77t?R%49THadJWcvm@FPx*PWr$|K|Jj zh50^`Dl`7$edk)x8EQk&O)LMdjL^I=ltq$t{m=R{|MB~f#zPt^vdR_y<)>>vS@gT= zR(aw1J2-#*7d}H`d@JV=ljc-r90O3`?lDs&uXc4{lA}n{@C|v@%(x`uMFKpC+M&a@2U_E zgx{c<2)3cqEx!(%$0?9T^pgj<9GfxKhpsefgvW+|?77Al-BDlRjcC@Ly5)JVxQs-~ zm`@3%wc(#W)KD+}2{pm7vg2xfD4h;j(&wV+3I4$v~ zFg^z=F8J?ygK%#6fJoYSgmH#1qcxInHhLCQ`OQQTl^?H{!_Vu$ zanC6y?nhpx?;T&!w;o0VM3^v*f~v8da@Xp-?C$y(n%sT=FY(p$YfV1z;6G|I9`kf~ zWQ+dLBW6t#;tenU;#|{tRPu!*{W?)P`3}`M{UzP+c^&j3<2@of`?W+;?x=&Z&pU8m zc$dESJVV44-_wy^J`b`8lM_k%K;tdqz^g6-I^||&e5EeuJxF`>eGiHp`kcOha>R?2 z$#Y)ZAJ#6>ML*>@2T2G#hT(H^^j|pSqeryAbIA6tUpnMbt>@Pc{6yw)?H}nO=Gp9# z%k(GsMNG`dQ<}K$!e0xwFHN=W1J3Ew+^lcVMD)ya)S#!dx9IY;_7yeqwDvAB_Kfxf zQT^x@7ak7%mcBvGWn%U-Am`Bs!R;=Rfjk&Z+&-)QorbqzkAmqBoYTN{F#Hyx={XI* zOQSlsAn^k1*Gxfuin!czfxchRdeAGb^FSQJipV>bNKW1qr}h<&TYGf?zd|C z5Yl26{KzU;bTx~-Ad^1v$1c|O*}i}V**1q2i8!}1O9#12A`=8`ZEgW?nIS-Sil zq+Yl1Jf*odij6?@w0VQKY6{T*z7_z(#3}9mu)OX%rDX{hlkvIs0%7@3gRL4AUjW&c zR=dB_Bwi|fRSSSsqOdy*u_^4Kf?WMI?F^N86FrR!F%12o7>2j(Y!;hcjVN|eYY)pm zY8SNx3ND`WLU0%czmyeQ5|aWT?`U(bOE}L(Z={*SFG`0g5r3!f!%p97u=5hhFt0rV z8)xKUDL04>xOq(a3ZmfY3FFlE5xEfszSTzY!sx^D5!@e@b2!TFJFG#AeSi`5Aot_N z1CPl9(%a|cF$vWb_?yG&f`ySDW28?2=@Zg-PQx2Y8s;NCCJE_rh4ion)PYm<9iGEU zF*zzmf&P?)NJFUQQ&KKMBmn(%lM0{W3Qwa#Sn-0Grgqk~;VG`}X#gOGt%Tp7ktj6u++9|D=`wZ2^RNZD zJUS;|kQnx2z;ym59D0E{^b2t4MQMuQFC^N6o+oiSCzU+C$ko2UygE-cp3|tzOH#7Q zfrarcD5Nhj`c-ps73JR`pf54P3pNcGCC+$vg52(EZ`G4<-g!Q1Mc|3bzfw( z-E;Di)iS($WkO)ZTjEEw*#5{@t(zPa4k}f{=}X+?m$|-U8aFw2j@bGNLYKI_rkMOH zIuTFpP%mv^I$mZv@U!s;By5&T0NNAA7sgb4zYaEDW`TwZNpWCKUa@rMs+0lvWpnZk z>*kuJS8rOn&}iz{B2y*$&F6%9-E3YTG8OU>7^G!D`Gh9BL>F#OS~t&GmgjlRl$n<_ VvoJ!nN{g>(T+N^VtPT~3{}1ltYXblP