From b783bc9711ff16bf6958da473d3ef9d22524e18b Mon Sep 17 00:00:00 2001 From: Chris Date: Sun, 24 Mar 2024 17:51:51 +0200 Subject: [PATCH] Added charts folder --- charts/README.md | 2 + charts/dev/sthome-webhook/.helmignore | 22 +++++ .../dev/sthome-webhook/0.0.1/ix_values.yaml | 38 ++++++++ charts/dev/sthome-webhook/CHANGELOG.md | 10 ++ charts/dev/sthome-webhook/Chart.yaml | 5 + charts/dev/sthome-webhook/icon.png | Bin 0 -> 35446 bytes charts/dev/sthome-webhook/templates/NOTES.txt | 0 .../dev/sthome-webhook/templates/_helpers.tpl | 55 +++++++++++ .../sthome-webhook/templates/apiservice.yaml | 19 ++++ .../sthome-webhook/templates/deployment.yaml | 71 ++++++++++++++ charts/dev/sthome-webhook/templates/pki.yaml | 76 +++++++++++++++ charts/dev/sthome-webhook/templates/rbac.yaml | 91 ++++++++++++++++++ .../dev/sthome-webhook/templates/service.yaml | 20 ++++ charts/dev/sthome-webhook/values.yaml | 59 ++++++++++++ 14 files changed, 468 insertions(+) create mode 100644 charts/README.md create mode 100644 charts/dev/sthome-webhook/.helmignore create mode 100644 charts/dev/sthome-webhook/0.0.1/ix_values.yaml create mode 100644 charts/dev/sthome-webhook/CHANGELOG.md create mode 100644 charts/dev/sthome-webhook/Chart.yaml create mode 100644 charts/dev/sthome-webhook/icon.png create mode 100644 charts/dev/sthome-webhook/templates/NOTES.txt create mode 100644 charts/dev/sthome-webhook/templates/_helpers.tpl create mode 100644 charts/dev/sthome-webhook/templates/apiservice.yaml create mode 100644 charts/dev/sthome-webhook/templates/deployment.yaml create mode 100644 charts/dev/sthome-webhook/templates/pki.yaml create mode 100644 charts/dev/sthome-webhook/templates/rbac.yaml create mode 100644 charts/dev/sthome-webhook/templates/service.yaml create mode 100644 charts/dev/sthome-webhook/values.yaml diff --git a/charts/README.md b/charts/README.md new file mode 100644 index 0000000..fea6378 --- /dev/null +++ b/charts/README.md @@ -0,0 +1,2 @@ +# catalog +Truenas catalog test diff --git a/charts/dev/sthome-webhook/.helmignore b/charts/dev/sthome-webhook/.helmignore new file mode 100644 index 0000000..bb15161 --- /dev/null +++ b/charts/dev/sthome-webhook/.helmignore @@ -0,0 +1,22 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.vs +.project +.idea/ +*.tmproj diff --git a/charts/dev/sthome-webhook/0.0.1/ix_values.yaml b/charts/dev/sthome-webhook/0.0.1/ix_values.yaml new file mode 100644 index 0000000..a27567a --- /dev/null +++ b/charts/dev/sthome-webhook/0.0.1/ix_values.yaml @@ -0,0 +1,38 @@ +image: + repository: docker.io/stuurmcp/cert-manager-webhook-sthome + pullPolicy: Always + tag: 0.0.1@sha256:06a1c99b0a4853d0a69a4076ea7fd8e04e8b7dd523aad5dbf06e887ff3145690 + +securityContext: + container: + readOnlyRootFilesystem: false + +service: + main: + ports: + main: + protocol: http + targetPort: 9117 + port: 9117 + +workload: + main: + podSpec: + containers: + main: + probes: + liveness: + path: "/UI/Login" + readiness: + path: "/UI/Login" + startup: + path: "/UI/Login" + +persistence: + config: + enabled: true + mountPath: "/config" + +portal: + open: + enabled: true \ No newline at end of file diff --git a/charts/dev/sthome-webhook/CHANGELOG.md b/charts/dev/sthome-webhook/CHANGELOG.md new file mode 100644 index 0000000..c95dbf6 --- /dev/null +++ b/charts/dev/sthome-webhook/CHANGELOG.md @@ -0,0 +1,10 @@ +--- +title: Changelog +--- + +## [sthome-webhook-0.0.1] + +### Chore + +- Development in progress + diff --git a/charts/dev/sthome-webhook/Chart.yaml b/charts/dev/sthome-webhook/Chart.yaml new file mode 100644 index 0000000..eb2c2c2 --- /dev/null +++ b/charts/dev/sthome-webhook/Chart.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +appVersion: "v0.0.1" +description: Cert-Manager webhook for sthome +name: sthome-webhook +version: 0.0.1 diff --git a/charts/dev/sthome-webhook/icon.png b/charts/dev/sthome-webhook/icon.png new file mode 100644 index 0000000000000000000000000000000000000000..38838994a40cd5c8bb67df8c045f7ae755d84056 GIT binary patch literal 35446 zcmbSycRbZ^`1jd|WADAUG9r5&WM+lzbYw({Q`z$zLMV>xt!&ClNX9{OjLhsE8D$qK zs06Sx$gVE?)P6jpf3O(a1}L% z03YR)#Rj;G$6sD0zj#_EMHmcxSVoTuqJek&%>KV#?mPM_*zU!4@bzjRbXn9#D$;^F zIbMcq>`fWk^gTZ3lJ;^;jGiPbZVu&7a ze*+vSP6|!~H;sLfR}|QLTkmKCm;&gIyIsr-;ZgDw=6%mDuYNig+e2cNvOt2B99X(N zS#t#}dxu1ZrMS?A8s7bdDu871={U9Ly2)*RFkSxh!QZ@v5{Biv7hlUYAo7qU;K{S^j)u&_FfNOKQUKo9i(;^y1o zRGaht8e=)JA-AOzxSpDajRBbbjS#rGW(u9B>UnjVgq#CE)3#H*l$r*dtuOaJ;enTL zYoOZ{>=+in=T&!9OY;SPusVdWgr!uYU$M^d4J+&p!8-3S-%N?)FPICN}ok4w# zZJf#D@RYJy1aHUyeDN+Ul3)@(34CGujS+)t-i7`7YI?)W$03$Q0uazGH zf?czgiMwc#F?`vxeQN9rK=i#hVX$~ICnSVwl{G=zHSaDyJeyjp{1c$X%&#^}5@VWW z&-`exg%^+N0}GOyXv>G)=&S#Mvo}J%v~+0L1f?8Idl2=9vgJ4Bpwbpo2a?rN2D+#Q-%l}X`Ul^5p+7S7GZ34^F4(DFK2xUC2UrVQw1 zNQGL9iF)0(mp2A9nh;nxbv<}1{!&t_SiN494B*&OtEiEA3S3W|R&YGHUHl@h7afYK zvWE}EwYJ^c`|Tu1$BOVodUBlX8u_xxe1DX_iMCt=TwHPCJZWI!O+QWwKSa1mJ2nvg zQ-RKf@ebq%eSI6zgt$PIB#~(ezh@AI>jL-WDh#Nxd76^dRrx7n7F7#NaA?fHBC>a2 z>W3{a3mcyznIdhbAqi#*`bLZgP?QPSY^q5!crlBbA6|h|z@I~Qp*P+x2b3V#I*!?G zE!tJEoHFmmCNK`=dk|^p@rVzv_}dM7%~Z)pN$+?0$MDDQGUoadEQ;KLe@)Y21!9G` zF}yl)n&e2cxpluFeUsPH4YmS&Nr~)d%R}P?+cY;ef~+~ zJxL$^^5V#VSrtc~^QNwCt}(6tP^LYe!d`ATW>=(R)e2%B^A&n~&o0F&3szR3!lKya zL(3gZF@;b>usSO;+Z$gi0b-gd;G6ExLTIw6wOkQ^G6+;iZaJOm@Sp=Bt%sS$EHshpTZvimcl%TLC4_Tv#AQov-MxXA4Rn>!v? zKRUPXP8fO~8YVi9KX>J9R7@DI?Nk4AxySrx5#crnPpSR1(N2~;#3u`@iwwQs^Dv+h76%AFM^W;5Wv*^ZeBvuQ)Ge@UDZ^W%lJiF5_b zoxTKnIQ;(0GD^EQ(G8ah0?6xcqqft~J@Da&>Wt~VWtz+{Xj6LBCsrmmI#!4(#CiQ{ ze8Kmpj8C~A00x=|SeoWr*@IP17ZwoB$)h!g0xFqnx2Z1oN0vuA4eCn!(+=#?#0PiH zn2-X(LKF)mk18~y;ok`=K8)`-^=#5XPjDempA=MZS-N&rCyTvT9sHH zS-O`~mymrQ(1GC@wc%TKl`qdOZ^)7({vn{@_%`R4JB88u}T(G`WrW+Hhbe&B~@zrT2I1wPszU zWt<4hc&)WZ=YjB+_hCCmF=V7z6473>Ey1MDTeez`C#W?}#+_R|fNIP}=SGv9pMcENw5P zVUo&v-;_w!rODgvb`#yK@JCJ~!Zq$9tT&-=N;*pxyVCMI-SRbep9(@Q?Z1j%y0OIJ zvKtjbzqLJH+wpI z|K`l@r99fpI=W=2<;KG0MuCDK)ivw!HT~Cz8?6vp^ri?&WC`8tz7szEIsYsmEanS? z`~0M`sENft4T|(YP{5CJh_EKy-$BI=yK1MLTqc?$y9%f zw)iV={Z`$&LjPCSMb}9p_VlM}l#4Y_5Zk+<9Z;TTonSG2n#ZoNxQ!R0IfJ@0DjAy% z`dGRj%-?^iK0_lJPNSLJ-FUmR2m5YGN=$zrTe`-SY|P4}-`f+XPsz-=IPGf!ky_ zqERw{hTr7La^Wa~`5xeMV~0-sktGc==~Yp?CTQiI&n~xW^A}FDS*qhRq73PpZ+z-d}e1XVTokJ1@zCMj$Jr53cElxtw>@2MpNS%i<0 zcJ(ApN|9l_tfAtPe5~Ei`ego67kM6-ZY}N{ish*Kjtg{$hvJ6(ap9ptl%Fy`Lkzm_ zmyy-=nyM_tzFn&NUGPezE)~c8uh=of5>t2jTh_GeK_ki3f!yQ=Y)7+!zhRn<^va@` zbIf1BHGT{~Q4;B{D^_ziUQZ{<*sB>#bBoMd9slcHZj}02cG~mTof*`N4pftB;wQ58 z9h+Z>8ie9V`43$_AaNTYvNY(wo(%iG1^-eXV9B^ab?VQ;>Z>9R@8!7)uF+<$qhImQ zctoul&|rjCx}8yr9POI2Dy4rdncXK1z>q3Ib3$eIyJ}Ik!_V(Y4HE6X_|iPRwSSWZ z?QRX^eBGe%&a&X8GpEt(#OZpp7#0^^8`ydD7w$?I>TfRJH0=ZW96%FL-(ASBPlbkK z*DXk_KOsKb?Qc5uBdidK>J)E(7TXNl@=K$d`g@jM_)5wE>1aH#>yqt+%QJO1l(0>O z0&fW~UdKp9q@M7rfgtDVIf)@R&j{Q16`r>u_yrW?C$WkI_yE2cj9rJyI9og&VXZ-TNO!c6>9E0KR8`JR-Eb2vfJp#Pg%G!nzGifHFM82<%Q z<_|r3lzp5-W`=l;R_6Y!i{cgL>*p;w;i^}t!y8DiPzJ0$R{ZUo5k2O;s7}<fifV#H{X`-$SyD?Ew)0Dgc+CfW^e&*s zhqup5nXAA^dC~{;;|6uk>IR9nZsN2y{$+@s%P!k}2Ao=w+QwahZ0=jso-rpdVyq^y zm*howi%U#$Ent?9LzV zG92^9`J2wKJ+A$s`RBYhONa1IWU++$9-2P!U7+2_UtnG-7ISKv~e=XwNJws zS;H-&qFx6J*v8m2OPM3@c0VFglP2mc@Q<;wHMv0_pgg>CP!-k$c%X^{$X9!Lnxbf; z>wP@o@~}J*?*B)QmJ~*0O!KM}?9oq8TlrCjr5`H<5&d=N9`$C*z=QS-%$e6NB81|U z#beglj5Pzi=m=`}Nm~dWv_t6;!u@A`w5+a(ju-K^-YEO^Fb+VL8S=D$e`LSpv67rV zi)~@Mp*_TzAnwaiYLlbPZtE7%@SawSc&|V}H9XT&R*`2ZkUrywse{3Y82Ftd;QttM zZZ4Eg9HNUWhseOTzN}TyCi-KxsTmhq?mj5Dp0XUfodJQ$D8@jfLjhV`KRWFWno|1g z%lq#&=!ORxNILFi3+UXJw}sBRDU+oe5?uW?<7dmEgd1S(sK`__cS}H2eVBX2E%UJj z(USL~*L@yVx&2qPq7t-jwpF2P-@zCXwx3`Rfy z)P~UdK))44_l*Id+2V(qL0@K9!?qT9+FriJ`x_&jNE*0C^Wa`-X$m(kGL6IJ`hMF* z5CLH<-`lxRqT9!N@fO!TWt=eJML{u=*HCLR(|r0LRv0S~Go3x9hAK|$as}0p>t}J| zn$4DGXU~D`Bb8d33oTI1`=i6tUwIF=$$PmLDP|1oBsv@)N@q-2v6CtBP}Mxh@=&-y zKH#Lyi>Z#}$WU6YXG!`)q3;H{Ns@_Tb%+g$!h|F>hTLGz>&^PzKDt4MqK7QNhAOra zZq5F94*!%%{R%!S(AD>SH-XQ!P=F7^77{8r(DOO&L}p2-{gvVHKcFJ#cag5eJZ$w`p$@akpnk>no7a1y zFEjD1{Ti7K8H0cH=9~Gdrtrc14Eh%oTkgtat~3{VowA}mjsT!rtG4GorU^6hHy<@B z0>VK4!WR;dv5ji2%HVc}Gd<4EvT>Q}WknMUNF8A~sx#?!%AsmeSeh z0wOCu@!!8p4f=rkxB;qbSyO&}sfTDcrun+(GwI*1_?7CD;J>srFyU>GY<$7HO4G1z zU@vt{UJcjGJpi-*)_56{vB}F0csS6H5vHb3KD6LTx~93s>nWP`8b&jYK?ucs`kKx4 zDmgK+5=+ej1Kh!EG^wGn;dmH$<4UIw$m6Tq-0M|;3CJq(BiE`%ZX?}4rVle@vnd&u zA^`=3%?|j0s7?`=0Se9_ukDAl?CtNEeDhM9XqZv+?o{x-{l`B^QhY+XDoAm_oW8Xi z8zYB_>m^W|M5Gat;Px-p=g;q6anV^?H%gxmmcu1$rW~1oF9FE*H-+p4&oCJ-G=n_M z4-n7ZJlbwC3F314o93klX*&|hd-6+;3s)Bja9eMVEb0P048T8#*8HWgy1NJ_6l?$CUOTMu=RPO8xra(65`eb}HRVCl_1~B=b zV0j_%iV<>H-+${~X--wb;d(t?0VwTPnxDlUR5^aZ+Wf9%2t|BP^ zLU8zBhQ#~L%4h(5A>-XXpeth+t4p@+29(~>BJTXl36i+Hi>U1K>Q{MSD?CLdD#P_e z<~nd6r3od_r`1yP=!lr5LH(9}a0Jizx)9G3Tk(<1C zJg-Bdv#5EyJiiTj+{Yc&RK)uTVFyd{^|IxEn(lao=KY zp@gd(iE{GQBl#W1QnV%tIjQf|7DQa&C%vHr>W+y8o~{lo&Gh0A~zZhNx9K^{Bz80_uD?$Yx#ujt@CMZMSEVtGkJ&bhz$1wWR!++w>x ze7td#H&8MgMh9=%DrXvm+a=VBn5C# z_^ORCu<&uc!#nN@yZ6SBdxUF5MDsQ2EF`L5ULm#QXT8ma)ntG#K~{L9Yr68(PAmp|;UZD1yaU*SeTz(y{Q^w&R`*fYU>e%ZmK(uIhJ>+j)z)GbpNRg|f59I5j?Oys!hiB4OtQqC~dNZKZ7{ds*IZYHE`aueqR^a+4Fz4iBWTCkW~ z)RxS0`Kxs~=ShS7Ana|Z%41)xx5f>pVTz^`UFZkg*W}3cMJ~2AB|{Gid-wefSoyQg zQN+VTj6zo;*79x1-^Vj{Hsc0}@%h&5zX~$T2|w9WFBjC2W%kw-PbL|rU0kI+(;eS~ zZ?A8ndz1)oVd)kv$sw_NZ-!8q5{**Hm~J(vn`yHRD*qYYpkDDK{CF;5a54*4L~(&r zE6flI9Nw_=1`$_TFa~jGD9PWtu6i%@)3W`KjYnl$$e)PjH>!UI^8*|>b~nlbs0Jd! zNS%mWYJHZAeZNMeWmEH)G)mol1D}Dmmhc+jRv;bup%)uqJvX@p^@-S5>BSI!2Cu}l zMXk1|pEzk!)3jTJ{a=87fD3~5(jv79vS)E_pSBI?BtS<^PJUiO`!dJi; zHpP;*>}KUIx7TK>sdN~vb{J(`M%eK? zEezGL_Z6RWu8oZ~*~LR4?(wPg<2KG}>ZhIdEF}Fvb(6c%ZF?gWn@Km8nk0s0~DNhiAjXtNW?m?o87A>3SLY>6R8UBhbwJ}EO z08>%yXspTde_2@g3azm8M&M-#(#5qfQRQ)E3XpO9@c>Hi>{CyqvUnoEe0Hx9pJ_xl^@bo8!D>uy68{as!2GHaRyAnd;a__Qml%rzivP9=8}rJ2jMocNFdw2Ja(?xZjN> zN)Rj65tGBwIJn~6S?qR^cHx(!^)@rEe6`M+3DG8kb0$8XKfMHsWLfKye-|07@1 z7xOeFK;~U~KltAh*AJcJLwzY|mK*oJ= zhd&>hhorD)^U4h_PzY3(_??nHT7gF-=t0dx3j0_qrOo~65W>U(=jFK4Z#@N$-+w#vmgLrr(d5~iXG5vYzI&p&xcxU`iE}rdyH$?9GFLJfqY==Yes`or$ zAILVb+ZD)Y6e|F>MbGcayNfAkGO@$iT_ue2sNwL4nmga#3-5=nC5B7j$LTbDizg3d z__5!99_X!GKodccxb|k7_v*x-dTHkx`9Yj z68W@Tdtv8vdRaQ|7p09AY(1PNsX@OMSGbtigMS+ud+F_KG~%5Eole_%HhR%|xq-p8 zDU>eu%k+czXKsf&qp=~YCas(qQI{1?=@fhw_r-9WOVKAzTN?OSQgvKg^<9X>Z_6-_ zc*>#X@8v&|JuyKEE4j7Tn5KwU|L&ki-z$uBB$q5YTZp{Exxq{FR+Zz7kTgr-w8;VoKyH ziNuz4d?9WLEE!H#BIrviL6!`^RI1ILWc;?(ACZNzh({;2fuo42r2-OLA69DAm&nZ< z_KlY$5Y$(>o~TfjB21oK%1?q3hv@LfjA(W2{Cq7PC>H{Z0+fAWa|IaU0d6Iv-7v%s z^RpYfW}vUKEU&o5gBA39Ky<03APBL7$1wLWGvwGm6bH^DR55|CC=N-9j@&Zvz1j9* zF%T2bb2VhjegPtU3;0LDcd03nlj-BgeN~8+ z-I*uuG$3H)R}(iIt`A%lO#3N6^2_FT8MM%^Qgm_OU4UJ=1Q%__wQG@1w)vMjOEDjQ z;5$ek9>wn-P!Jlb@10S144Dwx?$=Bbe+ewVqQPisu;N}zKb-TaOCmcEnBcMb0@VM& zpYp^eN5nwm0BaJz$qWhyvZthei$|%_b)Hxz?DprHKcU3osdM)$bjO+K#Z~jK568fQ zrJB!)FSeKKOqY9Yev-oUWk7?vh*zZ1_62>qrCDUxpW7Y3B9p{G#-K0f7d^+(U|_qe zSBrdx!fo|mF0n5)_dAgai6yn?BVRw9SQ9(cby<8OafQanq#W9Vw|gSAQPw+A;h`w0 ze30uKSN(R8IyOJ>qr#!s&;dRAC`po~7Wdw_D(v{%y{U7}2jrtD#V5j`iYxOfyq|5F z{L$Lk(Dp3gAeFdT3%_^g(^ZE~8CZGAiu&Im^-n`?dL8dL#lo*cN2V%~!zjDwF;0t} zpB6RS7YnxUklxs*YfL~~g=*YEMzg4}X|6S|#9xAW&j-&d*WBp|ZkJ6V=!MjvY=Bul za#>vba`@mR|C`$J_Y*<;Wt^9uAR2NXZ?dO#}9|Nw=<%w zwf(rRX_<|)Tlqi9@**~WxhwEjuUK*H(r+J~|wv!wg!})KP(f!)K zrSwumNPK(&s01)nnfzf|iABp{e*{Xqz$EGMu0(30Kv*;@+LlOF61k@rqO@%1QrV|N zGPy~S#1kXqb8>|+*O$hybOBuRedRno6tpH&FlMg1Fg2lvw^apx){lP+#nx6(! z&8Y#ZYE*;$V7=41y|d%!uE>u~{!tFbSrfh=-#tTJ!2u0ZoVn&p1DwpV2auTY@mT1% zQr(AnsqsWNnZT^TrM$C(rUxPN)@5s^2P)_@zUPhsx z%`i)eJi6j{C|rt&{`%+|sEDJZkf^J#(3;pvb(NM|9@t#NMe))cF9?wjVq?&WcnJ6e zFC`lJP}nBjsxsZvV5TXSDcViKvD|{U&HX}SytXm&Wy)uO5ecigDB}*@V=U*he`>@M zb!yci+DUVQBX7PPGk7GmPz)m#$ys}wTV2OS$bf2#tLy`g95=|Yd{ga1eR$6E1o*%E zS0e)AmpPZ#f|ncP32+coKuZ+b-{m`ow$A^SR8hEAa8czQuSn+~ga`K`Mk~*66QMx0 zwNDqIrI{dMaE#Mk7EOZQPJ+IM)#L9;51c6QC)LqXRq!>w+!b?~`*inwUIw`=Hp5|s z#@=!=%@(eT)Wxq0$H0B{3Q5_q&pU~tW157hx!p-n`aG&9FV+RlL3nlJ^w`mN-x?+g zmo)C~RwE$i?kSTMdjc~Ybsfe4NO+{`2_m%y-i4NCQAbG2)TmKRtpqoD-<{ffP^4j|M>&3!>-zN- zIT`q($u2evpvjZA``_|RDc-3h^7y{&dp309P3-JLY^M@QG_<7)W2gsTfQA`=gC}EU zq=CwS;WUtDxyJVp)*Z4#pBsJ3PLHDem<|?EgZ|z|X`fU4(z^%ejp`+`l{XWRc~^n^ zmIv@N{R(yRJHnePN9faEr?D)w%?kultjE-mcU@RE z=mZ!)5#w-wTX2%SGQUpdut*CHFaGuBC74?yBxIRl_|7MqN@o*8B`D z?w#p^H6XKD)F1Kv1bKBo$%m8z#$ha7uWk|;s@8|83zbU7+|wpIfA#Gc*{NjoGDT+E zT_GrqtJye=WxhMyCLm871mkUDJu$@Uk@OuQ8Z2^DIh1GAdwJecvj{AOF0nB6xMBuduxt<_6U7krQ#_I;Kp*#7lk%45S2{NK1(!wK0jFb^Vm z3#NKknM}$h3KJy6Iqw0nZwzDhP+bkUx^(rN|7T7EgB2T4%4UM;Vcg?e1artjJb|ab z=oW=7Wi2!cyp>I$IPU@7K4#8nJVG?cay>CGFEPNOB4k|Np@+AgZ`Di!vsArgF-7W_ z#G~s|Z_Z?!UQ;y@+exaW+fQzO0;~nz-B0{b5~)vIBPwFbHqkHWz!P7(Qq_1MYy4_3 z&Nqx1WGy?+?v68zQ@|XJVKICzDaw=F>TLVmT+xi*c+HSY3$_7xCviB3`qW(GeU}dTR4KVTN1w=`O}1BNf@x6 zR20Af3udx0-lwB1wp#vqo9H<*J}&r&Z=HejJ32e*35&YiT7LYfh)Tlej8sFQky}<^ z2jv86ku<8$UWd5fSEenk(~^EmKluGfOzl7&eZbap9WnGb8iov6v3B5|&BrMOnO7(Q@_lM$YlZ>&o2XNk0E*2!cZ*-s4!n+l z#;w=de@H6Yx9S?ophkQ85ioB|MM~U{N5CFn0v3r1*nK%~tue02Jq`kZ-md(AEACxEfs{z`;5PN=}RhoeV32E=iTZ!WJMzbYg%QCaS) zZOSe*Hv#f(na`!fG*~I^8!=g2DHm5J{K<0MZhyABgMF8zoEe;-SjDE>is%vg9#=Jr`N`SFj@8`ECLqmDFu zYWSJuSGjw7>d|Y(Z*aFRhACw(c6?7>nrymOO5YLr>7r+EOR_>VhJu-<&2qo_yZ?Bi zJ!%rLdlau&)YXN)?eLnB%=`h)OYSw~B4z9i0&y85m$lTe6)T0aootK5gvU-+!6d_n zLf05=>?o{%1*J$QCq)G5X#J$bE7^&j~~(00iQ67a*{Nsk#7-%N!~t zJ=~qCmAi^wkW*X8bVBLZRu+iW7p=t*#nKZslH1b+dzOW$ReKxP^B`uzh5RgjIyCpNQh>NGV|{64)7y$v+UTsrBPxrxK2bgiPE=x1bl8P+`$_l zbaQn}5?bXcGjxhT$4N3}*=IY1%pJ}WPHr#xB=CWGqhO6tvG1@DQgYXqfsh#gfJPVe zI0UfgbO_gl^WwPJ`A?wx>!8e3=CNNkbrroRhW+L*T{u;BdnZ6;+2X@9C+u=%lcz{X zNqAD=&JBP9e~UKWWib4+eXk&Ulh@&xI-qMLDG<#yr;d8`!^t@B{Thx#)wr>J-u#SF!et$buQ%?B@495v?X`XiK|4m zWn14N0in2?h*>xXdQ@Vi{}~N@4BX@+Qd83n)DbyI_LK_Gqjlc!eQi2cKm1+@l%WiU zka$-#M`^w?`1nFa@6@E{fIy}Mu)aRn2_zU`BT-C>xBR&wsO2~*r><`=U{mIlQz=+7 zH|vhP?)d4(WAXwXNqH9KNg!;p)C-mU_sfIPTNz8wA)G&eV(Ktho|}f{AEm{0-u_Mx z+$VlwpK?>hZ|x@;(Z6OMro113wuK?~u;y-s1Om205$sa#trz(zO1TkTE zOAmVD99SL%P@1Y3-*P4nB@09({~{c4@e5tiNQZz4|_yj`}Foz(SyLC+R z!;UuAoLsi0XMJ)5*Mucov+C$p%PYP)!Rk=YAc^$a1D5rLNnUud&lk(SJ-^^5mH2T9 zZYKDQR`wt4XMgGH2hzGAb`-e(z7rapvv@}BQuArw`XNJIBbs&&@1tklXLzx!FTZ&) z7vo#pEGOVER*BE^wG-uP>Pc;RAd@HB(r;0NTSs87M{Tg6l{4k$XvfwQ2X6ca9XvLU13%azU%E!-Au^}LBDoo;Qg?2WHf9=5X|rnW$$i2i zIiV$<`rpF8$U4{~Lg|jnfg2`;)-mq<<(yd4dbbi>lKYkFiOG)xsxyj(kFL;{Z_fY^ z%;(cvPY#=cG)=B90&9J7kZ)%-tw5z<_R6xD7HNms6E~OaCy>(o zzmj{|-uS>DF7>%Jb%cwTTka`?(j`B3BQ$f}I$br0&yF^K_HzJ5>y{NuKlh)MqiE8; zJDNb>MhCRQD{6fLd2XOw`sX`;_z>$`jU+H7 z3n_Y1D?VSUk6vJ$S_F{aUA#FP+b3-gMP5K(PH|h11roP3D&>@1EZzQQo&zQ%z!?#E zv*y;UjLAlbhU5tXRxZ1^0-RIa1aL~!j==QZ^})F5J7b{GQewA8M?LNx!sMDLjG|(> z&e7C7<&a^RDy9&8iQL2@FHiq0&ioVLNF#QXFQ&X5j=4(>u5+6q8=ptaDT@wKI0j=H zwTPqatPZrx`SUyInOzk>3A459n1v5CB%qgR4q%V>2Wk%J?x*K?GdMty|3EP&cn|Qj z@Dv3=N$&cDCi+b;F5OA*5PiXj&{W611waQ>r{L55B~a|9F2*ZfuUnq%UMpzl6vF&2 zLcf^?e3cerHK~~xa_m1eOZXO%U@xE!y1XxTwfYwRZ2QS$!jAD9j#iZOxhXt{TCcod z201kiSlmF@CUcV$FHO}S&cAOW7C)3Mz96Q3tD^! zWlMMBpA}3h|M{Yjq-(_Shb>>vL{InWT42aR2!^+YZxnr>cQoWB%P?H_o6x1C>c_$_ zM$Td{C+9}^JpHc&9I@ee(JFR0W)-=${fhM1T4+uQ^j0*{vuFKu~ z14N9@Ls0q5H!%cv^>lRV7=r#m2jGBTsq1X(vBe&QC`8qPz$SHHF_Z+2M6urns z4_;^3bjZr^$kVYMWVs2qpjEQkX@q7x#m(O=)Oqq!cyYpS^*K4L54?f9UxvIckGT}2 zPGYG{&s##AJZh3oTb9-szNv=kz-_#RY#83~2i_Lo z7z8Q$@edRmcg^Xo74{(IaX{c^Bxwzwa1W{s>JOnBRIwmDaiuBB|0wU)MgGi#IIGW4 zmH#=KUiGh4a*J$|NLwkvbAGdZbAn{?m2!!n=c}QD0GSnJ4`o7+6Rl&tPc`>XDCHaA zf`#@o1sEfu|%HjCBTK#SSos0taC;<1T2; zR|e>>)Or;*db}D>V!y-YXhPtg1Ru*y4_0g(0KzhD-RK+-io4IFbJvJ-ewiQG3zYtE z{--p*doAn%=ehQ+s4CMT##!FoQd#`nB&6&(@Z+SpS%zao=6%ku%Ypv7Ytp~>_Hs7A z`d*L&kI^vjbL0uQvgLU$iu2oW=ML;$;D?$-lt+I+?{@D;2WvsoLsDV!5Vh| zu4;Qdgd3RexGtikEZ(3w?A6{mlI(OZwhDp$3W%ClFVYta`B*Vj^nifx#blw8{T^`_J#Q2%GbkaVMDs}wf* z<^5TVf=j56SqkLb$H#?CG~#+&#AlX{Q~4RT;pYGgTv2}RYE#LA{|9vH^uM{O^?C6X zh20gGxi#GDsp#fTzvmwePR74ALP8v_uQ9)E!2r?9#Mj5tlf7V(@%VS53>Bex3{-Vf zuRtATeb~m}!MS=oxvElBV_hCS2rUt~WDs%nZ^l()$OJhwk(cX(XV#_WDIXBRL8m6p zUl;7Hq%6Zz7X3jZl^u7WdW(+m^#9FfFSuz{cv3kCKx^Dpo=0h4O2NjEkIba3@Vi~_ z%Y73zLFTV14&qq_2T{7t*C8}#bktd>F<(YrvHwkUrz_gHsDqJ4poM)Y873?T$P{{8 zfJ3EN&KTmN9e2CN-y%+u#QZYztIh?;kTp#g4Ah=v4^s$%QrLZP_btp~M66kMRc%{g zZDRBYGVDFJH%o*j`&yStJ5j$0pHAdm9?=tMTAqzjIS!!u{K|TjVPa&IaowaBg=tav zkS0GyN;`18-Tf;CEMIeB)mw*(N-y{I2e&qO{OHUnODwPdd;VHnY0if?jPyki!#bL~ z%Q}WvOd${b_?F;ir1_}+f=eK$JTE)!B{M^V#9)^z@Sp9hANn=UK1_mv93Yk_OxcE) zLX!rIrTA}EjOq#tgM0WN2u6O1@`8?mi-@;i_k}*r5;uSjGk@g^fM47&%cV-4wxirA z2I%q4PWb%o!dpj;P3|HNkwB?xhco6Git~;l^^l7lJyxJD)O(mQo0@p{jBG*tDZs*} zsZIVd`(?x5&ip`VI#T>k(tY~&L`@%Gu+rENoWxCIs5B0@rTQi9fu*53Wm)RvAo>Eu zDZ)ycJFj;fINO_g2BCS5uzGjFc#z$Xmzuqu{8YHWd)I*+L1|w7Rq##>N&I%tW62p4 z8=o}OUNZ@;O{T{K6lU+$SVeq=0iN)6cGw;klz53C`kAp?YOFM zH7#ZeWCs@iH&u^je5@k55k{Ty%^oA3`+)3}GRH%iaIH9)z6Lyc5^n$2N$^3`7_{p~ zS#QKmILwL44m_Htq@TkAO(Pz)cW#DnAT-Nqy+uOqtlyq$+F){MV4&X0ZmR1fThagy zc1>9XY|lr9`15+KKC((G(bPmzP|T!?R4uGQU0dP z@0NPC2C1+aM#T#v^JS@|!-zxiH^)>Ec;G>0H?I5zQ$%Je7Sqe=ckkq~q#m>$PcWRI z#asq|_kWRKK+MxmFZHSD`1_?-Gl`bbx?}eiULKv>t|_#6^8)+aCjWE<(7_w3T#|q2 z+!&En`m%f93u_v)%2FndaCQxHr8~vTfQVOYaYB$7U97v9 zUG)n1k?I@q+lQcY1R@ilrHeQbpe}KVXXltQ?ozS5KyKX#FIf!6Pj2g0%hN~|)hGRa zoz3Gl2YqBY%yb+nCI&?Ai!$b3$C(Lr+>?SH_Tws%QyEYu^*ak>5sN>eNgOfvLqyRl zf*G2{2u~aDOl{@n8(?&)4A9Hm4~ejTU9oj2b$Qn~S<-+wNW2S3(qxhz?Zv+ot*?v_ zQP7tESl=i*JTmE=bdnVMDVqgur@cVmv_b()4jgVC%rc>!Fivuw3(aw39~Pj$h~0Zr z#Z9crW)<)r{xPUk8nU!&_KOM88j#xyS1h|%LD7Xv-7~ly5Kd8ao|)@BtO7+|9Q&r? zwhJr3#$QxpF4*|<2}lMrbw`ePQ_=d*`XTP;f{=ur?Qg`JZHQ8t&t9bZSH9ifHBBLZ z1%lN}3$G|<#3Vc^DALM%C^?VZl-Q_vXJ*(6)Wp(rKGXD+fd87{DZ(eHB0TB-xAM?< zGLI>Xok@azTq#d!kNJK3BQ)wKYv3GXlAw?T|HN6L^jHb)=4#nHj~Ib*IMfD6vR< z>eSy`t#lheKcm{Wj78RIGB{M_?MPWVFW@H{p}Ppi~046dv*?h*6L)3ZvRr>{L+p#!2`$c z*#dol-kYiOLozo6Si&|?F^LiB3lR@-6u6>ZBg%*qH*h2R+qz~BRC5!+#8ZJp{VlMD23YCP zoVM&8=%|-UGf{PF`FE00l_I^Z?~gK*`%(z*08J4*#wMLIyZ!zCCn>WEy{}KHcbZ2`*Ms z5JDm*JElt_MnFUPeytpsjL+69_<~)sn51Rv0_lef%sj72MXFY_Z5I1=TQ|Iq*7 z!R8Vd4=HNp#=nnAl4 zjt1htjM-6AhfBMN&DF@xg)r72vh_e9ZULLKsYNg~P;?TNVPKCo)g>~=7pc`$k=57> zqCzQ_PDUj;uP%#BxDF?TP;PD8V|&@+jch{@Au*~pu$$xuyCKpw8j^lERFgMuSy+-Y zMX*5a#d1mi+ll)`Us8xeJVX%=l4i~Hr+ne3AL#n?71~tU>7f0$DKl-<7hV69Ra(g15 zp}IM2cSCK9ZHbYm>wYf{F}QXT7WpuvMhOdfl)UAo$gH78=8)1yF%!x`m&kAmD?n}X zwMs}b;9920h!QFt68m(Z69!x|xfMj3O@tgovaw{IJBIs+$1p`@fnWx#8MooH4Pxu{ zRsLYLha)D(A?AxF0g~pjS1G5sn{o%PgV52QlDfJsgSu-YV*R!#V8CJj1gycU;%+j$p=EPQ&lV zY)2Njw}^B{kfGHA;z{h;p`<=Aa~jCCh1z{dJQY;Mf`tu2=|j1|eqc6iIZ_T?&WLuE zo+WBa7@+}!jX%#NAL62I{iCbv!HxVb>z(;nBefrN0ndNk5B36-alt9j7Jw&kpQa_l zq%=({vaYxG?e|T_1xp>nIqom@KpdOGV$TaLPkql4;0ADM^8;QFGL%zX93I$hqkzxm z)}OzW27VwUXA_~oUx@=Wd1Pq3x*dj%_ahSMR&J&9N zxh0Uj%T92UrRPGz1SO z*}xQlWuFRgK<->{=qZ>$^s`qrDl&NgXi9++ryQ5xOJ-^zGFG3NF~k8QA6~YX&GNc6 z+K%&;^o(okVJ!w16RHKDBWqhJ{i(Rvs4Md54b*gv#L-R3 zwj(RRPcg93h^`CMSaVBa9eWmy9f-omwF<3sWM2gmP!d;S+_X$=osnaTO z|LxYvDSLO$Js z7MbYTX`h#5WdPxYycYW1Db(8(7uVdyHqV;`2q9cj?zi0u@TcXmrzZipp-@V+d1}9=fVj=?VMKxnK$g~ zpL0HXZ~0u}ii64z*D?LSR)Zhp=KkL5ERZST7y|4N^(8xP+arQDH z_Y|@f(xSYe&9Jiv)k??lg+%Ca%%FAJ_!x$A%is6^2)Aby9?9yy66UO7&@SQ|y_FY% z;EdgcD3m*A{Y)A6%y8TtIm&)So%-`PDvDyMzdci==flH{4N0b(%lh~Us~;0Z;}l*c zcIHQtdqWbUc5J9T-hmBt3E%lT-onhk(kgU^37q%o7-3c(*|D!(J4D}fyS}7Y+LJrt zPM4uDmOpiH#9v zPyKNK$N67XSXF?Z5BrKBb;%!v#FaP44?LFLHDU|*69Ur6k=k7)guCY{yWiCdih1#} zb;cbdOVWUTW#~1PXyW>a_Q1Cp#Nf}9AK!-Fbf~xO#W~Dhuh(g`^DUJ8Xucea(TNw5 zHPd%^e9_IKTU3*08~2HnyE61-v}t#B2lHa>JgEEwo?K2EIlV2GnzT3#T1Qsk496dl zsTcDkBFx}!0mv*o)LGF#1Y?U|-$9Jt+9+5EaFGu+BX_+uTK%^3R9m z%!{-f&9xy~v9m*jx>KT_(`u+B)p?O+@nw5*|9>9F=t0K4WnG>Jq5Lli&v|g?>brN7 znK)kP9AgE}|I{VQBXN}>?+PHdZ;UbnVh-DHr5JA%>P~LhY%4JyP|HN2Smz}ZFh>n} zKh7v$zuZ2_u7PW}!AS{R^7$btaat?kvctmqk-WEEq*B3kubwD#OC;sa9fz+FI3)E8 z^$eoc)|8Ig2a)ge^)y+*@&|Z+RGy7VXh*#Qf9O8;-uG?RtS0Do`cY+H-oS!EY%a&Y z&M-U`|8uS@J22e1LS36E?3?EA!2*_+RVMs6)H1K3wsTq0qWWk=MH978kP7Q}bmH~X znbaodtP18lr2-J#%6!%g-f`Gkv|=%$L0hIO7PUP3=jX==2Z5$QzU`-WwAet_j$eL@ z6a7NqUmW_l#LC5J+g3)@@8#xCyVkuS zeHlX$_FdGa>u zm@|EOF0)(ous~00f#r#eRqM02W1V4i^VDJAhk1K;%22i_ahdlAjbuZ_x9{C|SrZYV zVv8-`s^nGwEmWyuMe>9lMfJH2GOb5nQa;3UDU$DD3=_g_OM#~qZ`~-t>Dg$#f{o%j zayCFnTDY!DF^{%9_m{>|)klk!Eh4Rhf80R$Wt75wGM(A|=jZyz2XsBj(}}yS*4JY& zRlz}ys%6~Cgi=p_7S~X7J8*^|P73$H`2gs-qWsAZ zfSL`{>-s}x98&ofjIMW(fX}^mB4)UG8BcO4kz--nr+pa>NSLDWx3~|CqjMr4XF%qM z#e3wBNkx_-*p8#_vmndzQy+SdyOBASVVNC^A%A`9dYl)2G2i&( z78U#O6C-YnY~2#jUw=`0Z7^tMH>4GJma0szW`1ITnE`ch%Vv_p+!x0M61L*MIysdd z6C>zzH_BzS z>1S4XypB;f_K`iF`Q0ulND%oGKl4gSf=xVi1V~5UgnvmX6yN^Gk7th6{2NP@Hhd;? z!B}w)r~D@!hU@#8mzU33zb$<|ZJix578bnT%MOg5B? z?FTErr($D2*op+OTQFM04`TjqVNhSD)DrYzRN5%NTi68D=Qh(Aa)7YQwzfJUH8H(} z?kMr|RScQSi6rG(02!)p0)K^_(}SPNaSvqx~LgtVApb6wCEK`< zGji?z_)eD#(^TFK@_j}enyvNv{{pCoBzP1`R)b#S2$Vdcy2y}LM;>=16f4+fg>~8U zjpwy>QSgY-7;Uub3*rfq1s?SI*OjC<%}GGbc;5g#{~OOIoBzw-vjf$Og27Ojet_L= z5JtzZ{UJym6MC=*eMdK}zKg+U8ng_OrMIlaC_1j_dDHQq+0I<-+I+!-^817? zs5mhN?W_AKC$o*e57wd|JLD6EA445sdaLi{?kVkQLC7Qv3ue@xH3L$NF|+{YAR>h3L4|jw3RrkI(f}nIsb)a01ak4J1md0SYcX zu<`W+GTvDF$HF-YGQyT;jj<55iP{SuOhW{#=6?3bkQ_QO&xobs3&glP-bNV-*A)={ zUZOq7HC~@`VE*-dLlS6m{-iKgQOV;pZi6`M(-%Js(!(#(bCEQ@wDJ-j?qSV;KH#g; zC5<8o5_H3!goaCZ#knxRMF;<}uS}od!1->7spBv{LDsIGb-=&2Bu}1%+@J-?gfLQ9 z8v-@JBQW-Bq_ghJ z>hDytZ7h1+hwC&&pkZbj(YHgMK4O-{Wy#J}WS&IzGdJBR8RbILQc=AvL7K%zZ*vm) z_s{veDQnhkpl%J_N^RAW>d@59SEg3c!kKwD>ChIcnisJ#+0>*TV<8;^(A{g55sSO0 z==&dzwd}Tt)y=abxW{$XTfLs?ar??%^9tiLET=w#I>P!O?tFY*U&%#=fR4FkxNBqL z&gHa+igSvqm#^33^f>bdA>DZP2kX%FEb264Hm^aZNTTJKsn32A^i*qj=R3y-PMiX6 z1<7xI6T+2dI_20J@>|}J>Xn4ZB6BNZ?4xX)S?&stn(^5E&^YSeS`f}1!{(7NB+q8% zwlOh3>8%mE#p*eO0M0}^=^71m`rno@kDQAQp1@pDmgF3uyg^reThzX94sBn!VT4z9 z7wY-+LPf?oaqghu9Uq~g)A||vbvsUC51CG?CXH(@Z`Fp zDaW^3s1~L#8cMqLRh2$t6o*w~o-$qY8egb;z=f{3W%-CP>fel!_r$Jmbhf%r{|y)@MrTTX-5|3la!b&ustttll|shk+SoY% z0Ei5P9=RmcskL%@_qvIW4L{1pos4>I({{=J@x!PQZu~zYed246yC+sa&kyWRn=APA zQ8@5E5H5(HlIDiwNlDRrba8>-cbo0m6z$aQsUO+cFdUoTF-$ytf*z**mq?qqsc^Ds zFqj$K#IDp-DRjVKQN^YEqK)*RrYxCQ8foWvc%lVyKl@jdPgqqR9xl;=_I>c%S5)Bf zKdXpPOUlQH&rR1ifx~`u-INa!(*)@_I>TNTE9C|mqZnO-HAKeC7O}1o$LWN1E#ysZ z(&1oq*^Tqo{-((dY08J5BW4@H`0>x52=J`en_BbeCGjW#O;$1YDgMMXfHgU#uCH4c zBq~a>IjX|3;3k8nH=X%*n!aiBxWVL0Lc|SC*Ya4Lh@RxjFU$)++XwhM2))RAw1sit zv*+ob*>IVFW^-X{3pKn3ZS6`RmDvqSI`Ft*N6ZiH7FqG}kPvucJ5r5Nn_Yu1*L0!B zNphvU1m@cN2aX2{$h-c4{S2ucUjB|R36%M7GsNz6$t|=GW+j_#=>%xP@xC0W38;>h zOrAC~0MMdWtAXF!oGu-#H7^(0CcM%}LeI52z`>KduBcM%D#0nL zRZ==0Pl=V8qkqR<)Hh$7C5ihV$rF4nwOd-jq{>*gwtA=MI(if0mkz}{J+&DAH@VU1 z(=7Q&N`GH#{ftJHI1)0?Fipk7Lsz{M;_+YzlbK^M&zv222yr_mdu+dXb{3!VW!#Ok z=YzKHlbG+~5%>3#;A*y-XAm=vGdfNa9N{Ujn_G;m zl^r;}qB_J}V*!iALcfc6uhPIQMM->=BkRKo@Y|OnIaA7)Y?|UnNsIheF@k#9ne!S{ z_SELy6y5Z`&yTFhEN=pKJuVqwuSn*30Jf;^#@q0DkFqB^KMjd>eop!)3e%Mjyl6Dq zpF$b@$MxY=e0Jegp8T(!hF>zkt-`(f3wK_#v6|eM|BgzmFi-Pdx{^uYTO^=!WLR@m z;joJ;gjp@8GK2Ekfxj}3A4}raS3|hFCIvKcH@s%VJn$_`uJ6;usFj}GXr#K}#&+BR zPTIIK;UmiLy{b7!(>@p6+@DG#lA@=l4|k?~hasTkh&G;x=uIV1!`8Rlb~R&6=fFY4 z0V-E^%*8H!4!ihOJj=JQkL|*>tXRNJcs{9=ZSFem$_E3fPGza2ue1xQl8M_XI<75% z4K>ujj7o*^YV!2qjQn6jS@2UR<^KjZ1KLQvLl1TS=K9gpnoyLf1k=?vu1F#go$4% zCnBskx(oD1K59kQnA`5R#qRi}Ko`!@S!P@7MDW}y^U5%q)et;NwCMwXJIqLz4CRgb zhgM<%zn>kOKG$2$|JLBx77JybRc>O{a3^I+k!z~d&dvqS@;r4@=r0bKh`k2!A-w=W z|H~`Sfc4p|OVQkf&*MO4v*Mmt!-KjrhtUi2ueD({J1s9D_AFkODah6q4!o*xEi%17 z39nZ9MNfdRFNa6k{nHsIc3m+)Z#j(NP+_8iG9Z;vl1EZhI{m2P{dey`IJpk`>b#s% zTnM;Yr90VLmt!ZnaxjdL@ZA3Sv#S%uqfJBNx`DzAX0Gz9g-N7A{2!~><&RrV3k};$ z`k%Z4;k;k1(K^*%x*cZz!B_uFmZGO+C@IYk1rk4zjBv~pr6%um*gN3nOx@&Z)U%b1 zMRrvp^;Gu6U-6te)Xy8$+#TKwNiBGy16=-*nZ0!dygP%&cLoQ^7GDtvq=AGV6o_SniJdP5cs~#rZBfRd`m*~jCz_2oEr+v8`gaK=JfL^ z#Mx&56~~>B4GEL6p}P2&m4nbl2KHKyZ-;FnemX1btcxUm{S65SCE9E@)0c@BafVc> zEMd#Mit3_S+V_FL=1Sqp6_XJlI5!5G-ZuV+4x1PSJmD$z>03Lie_xuInrr$L@z64Z z)yTfQE9qKF>pKYbe+hKF(3~_gyd-sI$kc8DdvVVKSja7ePL)dXXpiS<#ozz1O5YiOlHtn~CD$q9N5U z=b!SsKC99Ul9m&x^BJkFNPgqYi9dMN@Vrh0(!hBucAuQOP+z_vz$aNgehs{q7ZA*! zaUu~B)h|CU@;j324IW6Hy`xWeskHwA9gvg|XtG8Hf9a7ylf-n7Z2h4I*wv|yE>U6p z+!c|-WN4>0Pd3ID1c~eVN10J2bFFH!p|f!LWoNP1kosNJ-xu37$4)uP?!N(fBdH@= z_HOTk{!1$=tm5D!l;!`oB~@WI?ShOsF~ZOX?JQ5;UG~#=EfJ^u&uS=Ag7K89Uy0K4 zVw|G!3MF!t5vn{N;xN(-urnX=q)VS-^1`O`F+% z!H$Ewgc9#YdG*=2wJ$t1e|Tzwy8^Yy{eCrTU4f9Kp|iwt2*yD(>RlKEo^UkJnzjA) zuhGcqpG72CrI`*beLh~u^+I%D(0NhaiA!FuFMjDBclM0yP^QCuHSc)yrMw$JrVC9E z>e{u5X3?4?qLIus?atT#Ix7>e;jvUa3Kh3v1p_-=Lt0A8p`ae&_F8PEK?aZlFt|2h z@!rt7%My!bvaW+HK1oX#gdYoJedzwL+t6x=HX0JOxW#tH^)Vtr?iyaTwQZn@VSW|OWAX=Bze zsp13rlj8jZh#yZPu~qaxs-*c8@+uwuy&V`7)eKvLbOzl=3of4wsTY#(ywCrNzh>D* zM|;1I--+=mo2faYfdfOC2Kgw!NPH z+12zqUjn!?&w(z&4S3T=m4yH4vm9%Fd$len6(BekjrvL~<_kG~hOv)W@y-%oilGpg zSw`Ig9ebsmTF#Blc=%;W?~40s6jl41=>foS+G-R#U1Bm)t-c{%irI|Q7o(vCYU`H~ zb`l}O(}tcTA)YN5l7%E2vjM8Pb4I@#5_U5z(k&sPG|0-nA@$QDVzIf&gqL|dS&!n! zB2@MnROq1gL$F*DBCl;304N?hQGacTXG9N8;(Q)h_fx0n>p;@-4zE>KKT}fAEwjy2 zUt!oAUy|4K)G54So$8yLZ;`qTd$%|%pu3-j+)sZJX5o!1Bk=hz30j=Kep;Y7?$r&m zOn)G?0kTDd=j7m80JRQV{rTSxY1`}diiyu>ZR60xO8rVZ(PukO~bi5{s_FO4B3yDI3Ep=bR+{rP7$~9EJC){qbJ{H1JoSc+%^P&ulU8 zZ33RH2;(%}z{)SYMJ_F(Ee*Gt{$a3r1QQj-*kUPn;oKYbX89(TJ>9PQ@XW{c*3#hj zcT8nq8L<|d|1Be6yC?iYJD;;&JW;M`*~O;scPu z)a89I)jU1Hs~^#d`NlGLI!hU)PpqT2U*<4_7>?B;!EujKbZRJ9i{r^G2#enxG>0Z3 z2z|-04^vyAokdOs;As(nnggC{XPCrt=Q;&Hb0;;ew#3`(!kiCe!$zPlzs~v(k@!F_ z0&vu;@mc`0AGjG5b<(=X@Sg(yM;qmScyg=%`ELD_db(A1XIH6OhKynZ@Dr^cVW-Ga$){sX$B81J_A#+ynLRd(9I2iiX%ZaKFFAukFxO z7fu76l?Y4pd3mqIr0~N6{uZnpbE)?p8siuxn=iStw>l&eFr6Lives*vHxzQmGRrzc z-K}zk*dR#~J#}`c5Bf;+xJ<J5%sTbw*jIMhb3LFJnYNTPSLaO2>ujk|ez>a!Wj zmVAW-r9zRvfE$-pDYOcCjFw9kxq_71v5VS1X?RW;*ZI8ao$0a7G#EOgfqKG2V?Y<- z-da~jS(Eh_>rL)u5g%wM=vt>%Yd2JF=s^VWhX!q{ORnv>`TXGSV+)4U)=~K}mgYWm znGX@4g9v{F@6aH_rc(8*1d)ww=@Ki=gbT2nhQ&fkO>oxf(@%bYE;Do%UHKL)lkMGDCw?&M!9~ z3g2H07eRfp?+Yfk=?a5a>xbz!jYFA|WLn?8S{`L?ZrJ!Y6Y+AI$&0mg&nRb9j-12Di&o%#M zT|z5GF#{E=vJB6%oI6k0rVh>D{DnbJo|n!$wq>auo;0R2Lxae`@A!sEB+*Ek3RY1A zZLOBWT3LrE#_fKY-N;I8Cc1_X$R{i&sYL;?-x|lx#NHIAMt20ku~1OQM@uz1 ztl^^CtF7%tB8vH^O(u-`Xt%l8!ec5>T1Cz+Yvq5DrR~NDTfkZ>1DTL70V#LcT0%gc z*#HuE!!L8j+mIrXtdT{tb_MM(%cr{E!+;*#R{xPEj)qPtV^oRiu61)g+*O>=>GGMn zQCTFv?wjY0?-jnl5dr7D!smNBz>QFeYz|7l{Ui1Cs4={7Yr zGpJFQ!VF4RyFcLOrOX(fWauY`GXZM{yhE`iIQN>6HHBcNH-R0IfZh1*gpEwU2C$BG z@y+tkX5@hKW7M%qZVfNSZ;!LGD^0LTD##nP#ZpFFhPDQ{XPta>hX{-rJPtKpPjED0 z=d(Vvm&Y?~KauLv7no7OEoW17Gk6H`4>Bs;f~#!Fa`_enjp4W-U9fJAu#AxB$j&n= zef=>%0dG=yt>b4&6%mTg-zX4IQrZz0c(S{B=5|JBmGd1<7F0?35RrRpSNpB&XOYx4 z>o$P!s{6%wvoEW&;XaGPEBbZ(OD58B#KeXxixu?65HuJFW?GL#cYA4-@O}fxqEwH6Dh6@?Luu%HRGML;QO9c#XdigYW+(i_VAdd z-$*c}ynX@Q;4dnzdhyW2Rk^N)a``%Q$8v?EDj(qnoY9Lj{ou7G12Tv@qdYg8GY@YN!KR!AWQkvhhc^_`gre`k?U+yI-UrIllim3qqTA z@IW(kb^IyEMg$34NWX@LsBPJW;>ObrtjAZl@Bet#iEF!&2J8%XAAq-V?Z0P)5H70{ z(6uQZM@D7N`xgy|z3ff`)in#Q36{600;^{f5#FfJ*IA+5c50(b#1rbS8q3lhiVeZs zAQ{Xh%i=(^B;Oq~ZveH*GQ}NG1A@O)%RhepGl9JzfJyYAS9{Ai8!!Jy$WuoH^BW1G zijbN=n7KP8_d}IloN&_V+G=o?klLf$A)h|*vJb~oSg_Z&*)y;x+nhn&K8D^255)mr z8c*B=cpl%>&Ay~I+Kcac@Y05C)| ziU|CD4hThf63vst6*owVeh-ucncw+Jdj@D=3TuM!vrj3yKj*%m;kZo&9V3D=Kk^jI zS8hb=0Tv>ug6ttv))R0loR zLpwdPW&#lfYJ#o@x^zK~_BhkyO+B%lk)7z=aZ4Hj#k_c#+@UA!J)5O{8Ly;PzMO}6 zgGCf^aBu0=wAtVqqmUwx=M)^QmC88c#*FQMe<+X(XvcO+Ex!oI(qY%lI)5s4C&TUT zc8`V9ffG+E^V!bx+6`O{M>&w6^s)$AF`wDXm&`JDH>Grl-N?o5i-n%KSW5S~e~?P~ zePI5fyn!+uCunB42cT0PBdZ`34ZGffIgk&T;iUM>aQyR)Ic8Z&3=vy+Un8h{u${qT5XM*CtMr@#o{(ojM z3kzRWS$Jd^C!)64LNs4o%EcXBN^WJbLG+Oc?Ia0dKXYU-j!H`tUd*LRii^oW2+^-; zp7235)gYeO*DN3qQ^sv>c?LeniS(jbI68IzMf7}-gNluw%6!Hw9{AhMl}?nhW|Qr>qN1MB1EJQ&Ht(uzx1tZvoX8WV1AW&T4RN5pW+yxDnUL5=RBpxqD+#-nIf`bXY(>2`9I zJ*keg+?oR8I3`nuslNntzO(+S`%L?p{ST)ie((bNyV5rEl_=I(HPFx-5pyy~Zppub zMIw`I0usr-XCxcI@RAKWBvGhu)p8%R>d&LccKKU9ze`iUUBjXH5g}D0A@uHy;ajL+ zH#ySV%!}v@mNaaOnfav;^uW;}G_M!Qj?H>kOMa$MrS0PS;0m z*n9EU=eHeQ79uon#DymoC^ptna&Y{I0Qh?+yZT8Hz4(=FIu()mMUa13@Ke+DZL>f! zId=;DbbiKJKzn}ii>16p2SV%hMu*cFQ^=d=x`_m1(Hvl4EgD#hNkVYV`s$yHJrFE7 zv3At4NPQ8mI*xQD(x;VNC{a1^+sgHogI?dzjQs^)XJJ(0zO;DqcZoaqF}|Hp@-3F@ zzBPbXDCt*${(Ey=6kkT|4Q2Cwi1ov&}LCPgx-VpTq*7gKLt5LOnw!q*T z+tC&K+O1(>!4t3PRW+`H8q1{xI*@}jnD^rL*(ezoeRqIyP@kE_v)32oSN97A;$&Up zQuC{=eX=K4=znN^jPxCR@b_&+E4xyUmjUyXE0K%XUC2G!ign*U(X2rekd-EP1N6(90?E&{K8 ze?NfwV*Bz>Ig%=&@ln|He48#0YD0+O{G8Y`0hs9ldxLZ{ZF@6$Id5X&#W3%73K?~_ zc^PXkd|QTrw%o5$fTW4cueSM~p+zlx#zH=OjKEuoRNW+*#9YV(Auc04`?pm=stoFn zMQEq<0!0_8^B1-?iU}E^Kh^i!Fo5*O;}&Hc^wNMXZ5@4hxH172<#N^(Nlz^qB7fYi z@iNoDZXR#JjukJHAc6n83vQ!nXxrJ~l_EK5vmmvKMhW9^w6n7PCusjH!}QduSlPDj z@1u~X*>7yr?V>$mWGZ8xtHp7n1qMw1w&1^)KP-?&=BSz$opN=Owd1bjqG|aC)Exjt zKO65U@QsH=9Y?Cr5-=>Uj=U{(n7D88*XCZ%se<-RIi}_z$fr61GlD&laE6fy{i-UY zQ68(cCo17t0rgxgnc?$6Lw@gPuA+2JnYfv}?|lscjY}$-S|Tyd+7CK7&46MNblO+) z)!^?0qtPm6(DuIja9cfn925~%{1_sp<23D!`$qCjWVL3fSBjrysa^e)qJu&*H>@E-vBM~ zMhw#cHH_~bXfb9z6@l=7^ie+XSZDP=+0SM4a9f3S^uW?1HsQ1UHY~1RNdecIRb^hD z(b8QFdosf#Najj3Ipz}!z6f;`Ng?uAh9Ry1A2#SOOB}sVU}a0iJdee~meYA3f3@C2 z{Es8cOuZ)&abHRw$Bkhd=jqMQf`5ggG~p31jX3)bKEi24N)0?9QSE=BREdaKWN97! z4b1|Ee@&AX=}=|V-0VaNPJN+H3al9YO`nx6{YN=dS_Avh$C&qaLiu^*I7izT(Ur{D z>@`SP2c8B-BEK(+kE!1 zsZ{EeM4B~h6Lj}5r;=|-e#wJaG-RN)^dySs7NbkQPNS6MEVfnx3!K<&t$|=ygLbgY z;a*gWnySY&;JW{b;)fHw&qgiEJD)$!k%zAW zSha}^Du~<($9;iWKs<$ZLvCtK1}$E&u5(QJPK)hWMr%4S{W)twXzbuxXz*=tDuYs` zi9SJ$i_`%RGWmw4%u>XAG$O?ZP?t;lxo(<%;#sFMiP`QRm`Z(%Gy^UB(1%JhxTZ5! zplboiBJMr1JTw-V#cHt(DFfzd9r9UzQ5vhghYf9um!aAaaWZK668%+F&@f%pahVBLh zFyGdjh)&D;qm&T&v$jhe<X2yYI#vD+J~1GP&W*IyeMKm6*ZuK8j`)-eL!?eGoi(`65>^H2ol%Uwsdgm@ z=90v6l5fihJ5`t1;my|{(~I^pn&5R2jxgQXj;wrK68p-Vp`;YVHFCIIS5cE@*GOZk zHyttS!!nc<%mpv&CQUCeUD){7lw5j-*HfV_DX>VgkOoDNzTy@JhGj-FNZMt;cfW96 zDo2IX{c-3J*R>G2)8X_#8+#es%=x2OU@A`B&@x>=CH_wR8}1dQY@-TgM@7P9q%*v` zWgw>flkAx&c{1>J*JfH~W&JiMI%GFQ9;=;+&kSBfX{d&7MVL%Ei-nWYn>$MU&UVYU z90({4{|EUS|oII0KC0Akt&@&RZqj6dIeGD0Fa>f>Cjg>q`+vNB*cl0 zd>d-Rd|CnUltu^@5+;}FSwQqkmp)cmL%Yl%xT?^HX~=8o1cs7?p*HHBc;XFo_(ONp zrb*&6f}5!Se<+GkT0w-LD$*qvbQ0hru$+WouLB@ZQl6CO?K!86;{5t*ptWW-z_sT08ydNtnCX z=~ID|cO*TF@{{D|5M#6`inu8 zQz|NI8uYqJ8;JX;4}AKha5z-|68z{6W&c7Xka#Y5kOBh05CF(^XM_VKw!u^sSy;Tj zPHYnbpB>RGdivr^{8{;93V{@Mhn6P^V&`V2n_d-o4U%^qq$=fxdItqiE(~~bi!6an z--st%R+gJ!90TaGodu(z)cSFxA6i8d%5LZ+P-kfhV{voHTXO=}{ZD`CeRfzXwCZ`} z+SFuu6_vmW@ZA>?gQSc6O}$LRa30Z8T{p1nZV1gq&`3*IKdYDj@p))0b;Mjcq5Sha zw$)XL?W3a6vl~W7pnT-F;Ruj59YcyduGFngzPGNFdw5Zv^rLK zJDyiHb4N7c@6<8^2K?IXg>38^2^M9PO#%i>q%*dB*dTRX-t~h={8$~riOtIl?>M>T zEK>ui?gj$*IK4bVj_AM$AMBn@D5%IrGCa_Pau*V%pAnwJ%a4tpCz^j{eTh~yy5Aj&nLws^c!IAO&D~is zT{pa@im3}66dN==hpQU@mrm4-=?d+3@IeYFBwsV>DGCT*zb#LV?fB^Sq3U3r^ZL+{ zo;*`3#+AJ|Y?EUeOh5Wc1@xJ*P=ya1^GO+QMO)u9C!6pm#oL=fk2IV300~8W&+JhA zXOtj0$#w1Ag8oaB`Dt1--m@|AE|Ui{S7-*b))32EE|TvZgXsMOir$8Pf~V)Ar1CTN z9PLiJJG<{y0bs2~TM5&|ltBx05Gt6V3j1`EgYdrBFpg(risS$=7oZ_Rf3WZUdB&XR zwew0+7r7e5h;fv66xmclrrJJTvG7_+bybx}uXP2(sYw^|l}&K>H0es)+(I>b%ta*WsvB!G&zY3- zyiLBsW--d9lh2+>^gEhu$OEluumsLi9#!uVzLZGDd*W-5uaYvY;4mDITomIVYBhE` zf#C!QfC>brf>iCAadPsEGd$?tt$vt!xclI}dWXJvV$=9#NRhYhnLzXxntEKvwm;}j zV^Z6-kU5d~&AQ_(TV>L&qrOG+PL9;P(0 z0)|sVg2MDd zgibaN)tXumxeNzae1P6dXxABqEH;#Q%w1z;$aLdKsfu~US7{eOO!yY;2{j`vdT@U_ z<*L*S9-}4z8pr5nJoVph!vQhk^CX1Nn%t6c*DK%{vBt>UkIk^bd_5QFKe;?&L2$bL z13(4`$hW86_SB)=PHs!m`7I6SZykc?}ADTO^g+k|9r_KxQsw05g=h)TC^8CRn{@9CiC%%=g|L*h0mchIwnBv-_2U@y z&efFJ5{M)b^6w+SC7-A#K+@Fl?ww>hmThpUG~KU$0{z%3Pd16U^s{ybF1DCxsB_aC z;1U5-4fcLRF!Egbr-!k&-v#6z$R#)KGF4kW3ekM1AK)yq+IO9@sRbbFE2ba3W0q;% zIEmqOpk?~*eu(jbt|DWy|Wv}O{b{|<2(yH0g8;>tb}p^eB+kciL48!QMb z#_$I%P^GzxklLXj8)XYz)g@6v*s5cts2WxI#kW9Ubo2-PTzUzU!cB~v%r%$s0`)c> zU$OXm;ZSt`JdjiXBeFZr80zKwdxl^ti<>0d!)|ZC?rZy(;&YI$QQrq?JIFE+`0p_& z6*vLla*xiK6;EG?6+g8`Nd@{txa)E&!TEMcGF`Ar@OnI>4eXUc139FW(MQ2L9ri6G z1A4P%zM+^$=ZRT2`C59)@#FK;T>&it>0}OxI0#*y&uV+MXVN^A6Igf%=>W2VP ztu`H%G8B72DnMT;w1Eb1)e6}lhpT&OvJP^j{CqBXz~=Bq ziG`jHum1AgVc=mbW0Ye{lk8E~P-EDx=y}D=qjcN5-|KQrrC+*8&KHVFHj%m-z_L>M z7RO6bqkF((&{BbO_lIj`t798PB;NLiY|c+H(&+xv67pj|`=1;Ov86&AIc5s&5w{TD z`SOd2RN%8H<{lO~r%5Kj+R#MUK`Ak=cDBp>@q`o?l<4qZO;; z?zZWj+cqtG$(eE?|9&%9NL6soTo=fjA(XKEe$x8(#+n3f70DZno&vjObDs?c4uk)B zpS<3_$8GVH|5+1%El6)%+gPvQ&2xJej~1_MWBA1S^xTj4fG6p_32!Y??kQI}0~~TP zGrh^9nI+ltcQLE+#I0A7C+_Ol_+rk!Q#tk<*PZyv@qi^^$Hk7Oe4QYTKSowh-UBbz zI~d$=WBC8#gZD)fpX&ad_-)$WM!6Fmj^zuK|JAS8o^ZB8OsRI;b7k{?nJ0w*%gkTD zJ|ti*)4ZO&W{iA}VS96O4VEd)?770Xx6?;e3wX%22fyioB{x=Y%u(TdA@ci%;u;U$H$G=&z|5~^tX|D;!20D z=U7r^{EuDI=b`E`x#3HAdx%E%b*H6GsZMW7)h`v~@F(am(XCW(E}R+Ac!jsuY2L4T zb7?=&)pwdp-=LcV4L3$R;WHlQUBDi|(dFPL)2B8J14r znx?gc^=J4-`*da2L(xa#W-A^&lp7=;<&@QEKXLXy{S*7->lgesSkj`#=%p!|Q@SQP z>`%&@_qUXCx3V9PW1jG?b#FrwvtiQ}v9s=0OZ;5({!C6@f3z*>RK+Y7jin*KG+nC- zOx|sYZ1IsTaSszHb(|(%&g3=WVsn_s!~(`3gE?0pD0^%y2yO1adP0s<^n^j(o`ed` zpzbXUk)|f{k(>*4gu2`oFG~*a(p)-)aaZGnATLeuO$0!`5%9cRAQjREJT?_5dkT0# zlE%_0L6Tk|j|G8`JDw8cm8t=}zahwLCC^gN2GTXJ_|JZ1XO-;_LG|qnK;Y@>=d#Wz Gp$Pzn2QNGT literal 0 HcmV?d00001 diff --git a/charts/dev/sthome-webhook/templates/NOTES.txt b/charts/dev/sthome-webhook/templates/NOTES.txt new file mode 100644 index 0000000..e69de29 diff --git a/charts/dev/sthome-webhook/templates/_helpers.tpl b/charts/dev/sthome-webhook/templates/_helpers.tpl new file mode 100644 index 0000000..d889995 --- /dev/null +++ b/charts/dev/sthome-webhook/templates/_helpers.tpl @@ -0,0 +1,55 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "sthome-webhook.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "sthome-webhook.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "sthome-webhook.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- define "sthome-webhook.selfSignedIssuer" -}} +{{ printf "%s-selfsign" (include "sthome-webhook.fullname" .) }} +{{- end -}} + +{{- define "sthome-webhook.rootCAIssuer" -}} +{{ printf "%s-ca" (include "sthome-webhook.fullname" .) }} +{{- end -}} + +{{- define "sthome-webhook.rootCACertificate" -}} +{{ printf "%s-ca" (include "sthome-webhook.fullname" .) }} +{{- end -}} + +{{- define "sthome-webhook.servingCertificate" -}} +{{ printf "%s-webhook-tls" (include "sthome-webhook.fullname" .) }} +{{- end -}} + +{{/* +Create base64 imagePullSecret using username and password. +*/}} +{{- define "imagePullSecret" }} +{{- printf "{\"auths\": {\"%s\": {\"auth\": \"%s\"}}}" .Values.imageCredentials.registry (printf "%s:%s" .Values.imageCredentials.username .Values.imageCredentials.password | b64enc) | b64enc }} +{{- end }} \ No newline at end of file diff --git a/charts/dev/sthome-webhook/templates/apiservice.yaml b/charts/dev/sthome-webhook/templates/apiservice.yaml new file mode 100644 index 0000000..7f79f6d --- /dev/null +++ b/charts/dev/sthome-webhook/templates/apiservice.yaml @@ -0,0 +1,19 @@ +apiVersion: apiregistration.k8s.io/v1 +kind: APIService +metadata: + name: v1alpha1.{{ .Values.groupName }} + labels: + app: {{ include "sthome-webhook.name" . }} + chart: {{ include "sthome-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} + annotations: + cert-manager.io/inject-ca-from: "{{ .Release.Namespace }}/{{ include "sthome-webhook.servingCertificate" . }}" +spec: + group: {{ .Values.groupName }} + groupPriorityMinimum: 1000 + versionPriority: 15 + service: + name: {{ include "sthome-webhook.fullname" . }} + namespace: {{ .Release.Namespace }} + version: v1alpha1 diff --git a/charts/dev/sthome-webhook/templates/deployment.yaml b/charts/dev/sthome-webhook/templates/deployment.yaml new file mode 100644 index 0000000..b505a12 --- /dev/null +++ b/charts/dev/sthome-webhook/templates/deployment.yaml @@ -0,0 +1,71 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "sthome-webhook.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "sthome-webhook.name" . }} + chart: {{ include "sthome-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: + app: {{ include "sthome-webhook.name" . }} + release: {{ .Release.Name }} + template: + metadata: + labels: + app: {{ include "sthome-webhook.name" . }} + release: {{ .Release.Name }} + spec: + serviceAccountName: {{ include "sthome-webhook.fullname" . }} + imagePullSecrets: + - name: {{ .Values.imageCredentials.name }} + containers: + - name: {{ .Chart.Name }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + args: + - --tls-cert-file=/tls/tls.crt + - --tls-private-key-file=/tls/tls.key + env: + - name: GROUP_NAME + value: {{ .Values.groupName | quote }} + ports: + - name: https + containerPort: 443 + protocol: TCP + livenessProbe: + httpGet: + scheme: HTTPS + path: /healthz + port: https + readinessProbe: + httpGet: + scheme: HTTPS + path: /healthz + port: https + volumeMounts: + - name: certs + mountPath: /tls + readOnly: true + resources: +{{ toYaml .Values.resources | indent 12 }} + volumes: + - name: certs + secret: + secretName: {{ include "sthome-webhook.servingCertificate" . }} + {{- with .Values.nodeSelector }} + nodeSelector: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: +{{ toYaml . | indent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: +{{ toYaml . | indent 8 }} + {{- end }} diff --git a/charts/dev/sthome-webhook/templates/pki.yaml b/charts/dev/sthome-webhook/templates/pki.yaml new file mode 100644 index 0000000..1c61fa5 --- /dev/null +++ b/charts/dev/sthome-webhook/templates/pki.yaml @@ -0,0 +1,76 @@ +--- +# Create a selfsigned Issuer, in order to create a root CA certificate for +# signing webhook serving certificates +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: {{ include "sthome-webhook.selfSignedIssuer" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "sthome-webhook.name" . }} + chart: {{ include "sthome-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + selfSigned: {} + +--- + +# Generate a CA Certificate used to sign certificates for the webhook +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ include "sthome-webhook.rootCACertificate" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "sthome-webhook.name" . }} + chart: {{ include "sthome-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + secretName: {{ include "sthome-webhook.rootCACertificate" . }} + duration: 43800h # 5y + issuerRef: + name: {{ include "sthome-webhook.selfSignedIssuer" . }} + commonName: "ca.sthome-webhook.cert-manager" + isCA: true + +--- + +# Create an Issuer that uses the above generated CA certificate to issue certs +apiVersion: cert-manager.io/v1 +kind: Issuer +metadata: + name: {{ include "sthome-webhook.rootCAIssuer" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "sthome-webhook.name" . }} + chart: {{ include "sthome-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + ca: + secretName: {{ include "sthome-webhook.rootCACertificate" . }} + +--- + +# Finally, generate a serving certificate for the webhook to use +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: {{ include "sthome-webhook.servingCertificate" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "sthome-webhook.name" . }} + chart: {{ include "sthome-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + secretName: {{ include "sthome-webhook.servingCertificate" . }} + duration: 8760h # 1y + issuerRef: + name: {{ include "sthome-webhook.rootCAIssuer" . }} + dnsNames: + - {{ include "sthome-webhook.fullname" . }} + - {{ include "sthome-webhook.fullname" . }}.{{ .Release.Namespace }} + - {{ include "sthome-webhook.fullname" . }}.{{ .Release.Namespace }}.svc diff --git a/charts/dev/sthome-webhook/templates/rbac.yaml b/charts/dev/sthome-webhook/templates/rbac.yaml new file mode 100644 index 0000000..4c9a49d --- /dev/null +++ b/charts/dev/sthome-webhook/templates/rbac.yaml @@ -0,0 +1,91 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "sthome-webhook.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "sthome-webhook.name" . }} + chart: {{ include "sthome-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +--- +# Grant the webhook permission to read the ConfigMap containing the Kubernetes +# apiserver's requestheader-ca-certificate. +# This ConfigMap is automatically created by the Kubernetes apiserver. +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "sthome-webhook.fullname" . }}:webhook-authentication-reader + namespace: kube-system + labels: + app: {{ include "sthome-webhook.name" . }} + chart: {{ include "sthome-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: extension-apiserver-authentication-reader +subjects: + - apiGroup: "" + kind: ServiceAccount + name: {{ include "sthome-webhook.fullname" . }} + namespace: {{ .Release.Namespace }} +--- +# apiserver gets the auth-delegator role to delegate auth decisions to +# the core apiserver +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "sthome-webhook.fullname" . }}:auth-delegator + labels: + app: {{ include "sthome-webhook.name" . }} + chart: {{ include "sthome-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: system:auth-delegator +subjects: + - apiGroup: "" + kind: ServiceAccount + name: {{ include "sthome-webhook.fullname" . }} + namespace: {{ .Release.Namespace }} +--- +# Grant cert-manager permission to validate using our apiserver +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "sthome-webhook.fullname" . }}:domain-solver + labels: + app: {{ include "sthome-webhook.name" . }} + chart: {{ include "sthome-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +rules: + - apiGroups: + - {{ .Values.groupName }} + resources: + - '*' + verbs: + - 'create' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ include "sthome-webhook.fullname" . }}:domain-solver + labels: + app: {{ include "sthome-webhook.name" . }} + chart: {{ include "sthome-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "sthome-webhook.fullname" . }}:domain-solver +subjects: + - apiGroup: "" + kind: ServiceAccount + name: {{ .Values.certManager.serviceAccountName }} + namespace: {{ .Values.certManager.namespace }} diff --git a/charts/dev/sthome-webhook/templates/service.yaml b/charts/dev/sthome-webhook/templates/service.yaml new file mode 100644 index 0000000..35c40de --- /dev/null +++ b/charts/dev/sthome-webhook/templates/service.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "sthome-webhook.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: + app: {{ include "sthome-webhook.name" . }} + chart: {{ include "sthome-webhook.chart" . }} + release: {{ .Release.Name }} + heritage: {{ .Release.Service }} +spec: + type: {{ .Values.service.type }} + ports: + - port: {{ .Values.service.port }} + targetPort: https + protocol: TCP + name: https + selector: + app: {{ include "sthome-webhook.name" . }} + release: {{ .Release.Name }} diff --git a/charts/dev/sthome-webhook/values.yaml b/charts/dev/sthome-webhook/values.yaml new file mode 100644 index 0000000..b7d6369 --- /dev/null +++ b/charts/dev/sthome-webhook/values.yaml @@ -0,0 +1,59 @@ +# The GroupName here is used to identify your company or business unit that +# created this webhook. +# For sthome, this may be "webhook.acme.cert-manager.io". +# This name will need to be referenced in each Issuer's `webhook` stanza to +# inform cert-manager of where to send ChallengePayload resources in order to +# solve the DNS01 challenge. +# This group name should be **unique**, hence using your own company's domain +# here is recommended. +groupName: acme.sthome.net + +certManager: + namespace: ix-cert-manager + serviceAccountName: cert-manager + +image: + repository: stuurmcp/cert-manager-webhook-sthome + tag: 0.0.1 + #pullPolicy should be IfNotPresent. Set to Always for testing purposes + pullPolicy: Always + +imageCredentials: + name: docker-registry-credentials + +nameOverride: "" +fullnameOverride: "" + +replicaCount: 1 + +pki: + caDuration: 43800h # 5y + servingCertificateDuration: 8760h # 1y + +secret: + accessKey: "" + secretKey: "" + name: sthome-webhook-secret + +service: + type: ClusterIP + port: 443 + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +nodeSelector: {} + +tolerations: [] + +affinity: {} + \ No newline at end of file