From 4b665fc0bfee47f6e3e7afff64c36324dc68f39b Mon Sep 17 00:00:00 2001 From: TrueCharts-Bot Date: Tue, 15 Feb 2022 22:16:37 +0000 Subject: [PATCH] Commit new App releases for TrueCharts Signed-off-by: TrueCharts-Bot --- core/traefik/10.0.57/CHANGELOG.md | 99 + core/traefik/10.0.57/CONFIG.md | 8 + core/traefik/10.0.57/Chart.lock | 6 + core/traefik/10.0.57/Chart.yaml | 30 + core/traefik/10.0.57/README.md | 39 + core/traefik/10.0.57/app-readme.md | 3 + core/traefik/10.0.57/charts/common-8.15.4.tgz | Bin 0 -> 41411 bytes core/traefik/10.0.57/crds/ingressroute.yaml | 198 ++ .../traefik/10.0.57/crds/ingressroutetcp.yaml | 160 ++ .../traefik/10.0.57/crds/ingressrouteudp.yaml | 84 + core/traefik/10.0.57/crds/middlewares.yaml | 563 ++++ core/traefik/10.0.57/crds/middlewarestcp.yaml | 59 + .../10.0.57/crds/serverstransports.yaml | 101 + core/traefik/10.0.57/crds/tlsoptions.yaml | 87 + core/traefik/10.0.57/crds/tlsstores.yaml | 64 + .../traefik/10.0.57/crds/traefikservices.yaml | 270 ++ core/traefik/10.0.57/helm-values.md | 44 + core/traefik/10.0.57/ix_values.yaml | 316 +++ core/traefik/10.0.57/questions.yaml | 2462 +++++++++++++++++ core/traefik/10.0.57/security.md | 159 ++ core/traefik/10.0.57/templates/_args.tpl | 146 + core/traefik/10.0.57/templates/_helpers.tpl | 22 + .../10.0.57/templates/_ingressclass.tpl | 24 + .../10.0.57/templates/_ingressroute.tpl | 25 + .../traefik/10.0.57/templates/_portalhook.tpl | 26 + .../traefik/10.0.57/templates/_tlsoptions.tpl | 12 + core/traefik/10.0.57/templates/common.yaml | 24 + .../middlewares/basic-middleware.yaml | 65 + .../templates/middlewares/basicauth.yaml | 34 + .../10.0.57/templates/middlewares/chain.yaml | 21 + .../templates/middlewares/forwardauth.yaml | 30 + .../templates/middlewares/ipwhitelist.yaml | 33 + .../templates/middlewares/ratelimit.yaml | 19 + .../templates/middlewares/redirectScheme.yaml | 19 + .../templates/middlewares/redirectregex.yaml | 20 + .../templates/middlewares/tc-chains.yaml | 29 + .../templates/middlewares/tc-headers.yaml | 64 + .../templates/middlewares/tc-nextcloud.yaml | 25 + core/traefik/10.0.57/values.yaml | 0 39 files changed, 5390 insertions(+) create mode 100644 core/traefik/10.0.57/CHANGELOG.md create mode 100644 core/traefik/10.0.57/CONFIG.md create mode 100644 core/traefik/10.0.57/Chart.lock create mode 100644 core/traefik/10.0.57/Chart.yaml create mode 100644 core/traefik/10.0.57/README.md create mode 100644 core/traefik/10.0.57/app-readme.md create mode 100644 core/traefik/10.0.57/charts/common-8.15.4.tgz create mode 100644 core/traefik/10.0.57/crds/ingressroute.yaml create mode 100644 core/traefik/10.0.57/crds/ingressroutetcp.yaml create mode 100644 core/traefik/10.0.57/crds/ingressrouteudp.yaml create mode 100644 core/traefik/10.0.57/crds/middlewares.yaml create mode 100644 core/traefik/10.0.57/crds/middlewarestcp.yaml create mode 100644 core/traefik/10.0.57/crds/serverstransports.yaml create mode 100644 core/traefik/10.0.57/crds/tlsoptions.yaml create mode 100644 core/traefik/10.0.57/crds/tlsstores.yaml create mode 100644 core/traefik/10.0.57/crds/traefikservices.yaml create mode 100644 core/traefik/10.0.57/helm-values.md create mode 100644 core/traefik/10.0.57/ix_values.yaml create mode 100644 core/traefik/10.0.57/questions.yaml create mode 100644 core/traefik/10.0.57/security.md create mode 100644 core/traefik/10.0.57/templates/_args.tpl create mode 100644 core/traefik/10.0.57/templates/_helpers.tpl create mode 100644 core/traefik/10.0.57/templates/_ingressclass.tpl create mode 100644 core/traefik/10.0.57/templates/_ingressroute.tpl create mode 100644 core/traefik/10.0.57/templates/_portalhook.tpl create mode 100644 core/traefik/10.0.57/templates/_tlsoptions.tpl create mode 100644 core/traefik/10.0.57/templates/common.yaml create mode 100644 core/traefik/10.0.57/templates/middlewares/basic-middleware.yaml create mode 100644 core/traefik/10.0.57/templates/middlewares/basicauth.yaml create mode 100644 core/traefik/10.0.57/templates/middlewares/chain.yaml create mode 100644 core/traefik/10.0.57/templates/middlewares/forwardauth.yaml create mode 100644 core/traefik/10.0.57/templates/middlewares/ipwhitelist.yaml create mode 100644 core/traefik/10.0.57/templates/middlewares/ratelimit.yaml create mode 100644 core/traefik/10.0.57/templates/middlewares/redirectScheme.yaml create mode 100644 core/traefik/10.0.57/templates/middlewares/redirectregex.yaml create mode 100644 core/traefik/10.0.57/templates/middlewares/tc-chains.yaml create mode 100644 core/traefik/10.0.57/templates/middlewares/tc-headers.yaml create mode 100644 core/traefik/10.0.57/templates/middlewares/tc-nextcloud.yaml create mode 100644 core/traefik/10.0.57/values.yaml diff --git a/core/traefik/10.0.57/CHANGELOG.md b/core/traefik/10.0.57/CHANGELOG.md new file mode 100644 index 00000000000..54b301db1f7 --- /dev/null +++ b/core/traefik/10.0.57/CHANGELOG.md @@ -0,0 +1,99 @@ +# Changelog
+ + + +### [traefik-10.0.57](https://github.com/truecharts/apps/compare/traefik-10.0.56...traefik-10.0.57) (2022-02-15) + +#### Fix + +* fix errors rendering ingressroute + + + + +### [traefik-10.0.56](https://github.com/truecharts/apps/compare/traefik-10.0.55...traefik-10.0.56) (2022-02-15) + +#### Chore + +* update helm general non-major helm releases ([#1901](https://github.com/truecharts/apps/issues/1901)) + + + + +### [traefik-10.0.55](https://github.com/truecharts/apps/compare/traefik-10.0.54...traefik-10.0.55) (2022-02-08) + +#### Chore + +* update helm general non-major helm releases ([#1871](https://github.com/truecharts/apps/issues/1871)) + + + + +### [traefik-10.0.54](https://github.com/truecharts/apps/compare/traefik-10.0.53...traefik-10.0.54) (2022-02-06) + +#### Chore + +* update helm chart common to v8.15.0 ([#1859](https://github.com/truecharts/apps/issues/1859)) + + + + +### [traefik-10.0.53](https://github.com/truecharts/apps/compare/traefik-10.0.52...traefik-10.0.53) (2022-02-05) + +#### Chore + +* update helm general non-major helm releases ([#1852](https://github.com/truecharts/apps/issues/1852)) + + + + +### [traefik-10.0.52](https://github.com/truecharts/apps/compare/traefik-10.0.51...traefik-10.0.52) (2022-02-02) + +#### Chore + +* update helm general non-major helm releases ([#1828](https://github.com/truecharts/apps/issues/1828)) + + + + +### [traefik-10.0.51](https://github.com/truecharts/apps/compare/traefik-10.0.50...traefik-10.0.51) (2022-01-31) + +#### Chore + +* update docker general non-major ([#1824](https://github.com/truecharts/apps/issues/1824)) + + + + +### [traefik-10.0.50](https://github.com/truecharts/apps/compare/traefik-10.0.49...traefik-10.0.50) (2022-01-31) + +#### Chore + +* update docker general non-major docker tags ([#1823](https://github.com/truecharts/apps/issues/1823)) + + + + +### [traefik-10.0.49](https://github.com/truecharts/apps/compare/traefik-10.0.48...traefik-10.0.49) (2022-01-31) + +#### Fix + +* introduce two basic changes with different CORS policy + + + + +### [traefik-10.0.48](https://github.com/truecharts/apps/compare/traefik-10.0.47...traefik-10.0.48) (2022-01-31) + + + + +### [traefik-10.0.47](https://github.com/truecharts/apps/compare/traefik-10.0.46...traefik-10.0.47) (2022-01-31) + +#### Fix + +* replace depricated header references + + + + diff --git a/core/traefik/10.0.57/CONFIG.md b/core/traefik/10.0.57/CONFIG.md new file mode 100644 index 00000000000..fc9b2fa2d5f --- /dev/null +++ b/core/traefik/10.0.57/CONFIG.md @@ -0,0 +1,8 @@ +# Configuration Options + +##### Connecting to other apps +If you need to connect this App to other Apps on TrueNAS SCALE, please refer to our "Linking Apps Internally" quick-start guide: +https://truecharts.org/manual/Quick-Start%20Guides/14-linking-apps/ + +##### Available config options +In the future this page is going to contain an automated list of options available in the installation/edit UI. diff --git a/core/traefik/10.0.57/Chart.lock b/core/traefik/10.0.57/Chart.lock new file mode 100644 index 00000000000..538a7e405cd --- /dev/null +++ b/core/traefik/10.0.57/Chart.lock @@ -0,0 +1,6 @@ +dependencies: +- name: common + repository: https://truecharts.org + version: 8.15.4 +digest: sha256:d6aca168828f3fef09de9fbc634c303d040d74299b508a7cedf473f66f5a4503 +generated: "2022-02-15T22:12:14.992793261Z" diff --git a/core/traefik/10.0.57/Chart.yaml b/core/traefik/10.0.57/Chart.yaml new file mode 100644 index 00000000000..74937191df7 --- /dev/null +++ b/core/traefik/10.0.57/Chart.yaml @@ -0,0 +1,30 @@ +apiVersion: v2 +appVersion: "2.6.0" +dependencies: +- name: common + repository: https://truecharts.org + version: 8.15.4 +deprecated: false +description: Traefik is a flexible reverse proxy and Ingress Provider. +home: https://github.com/truecharts/apps/tree/master/charts/stable/traefik +icon: https://truecharts.org/_static/img/appicons/traefik-icon.png +keywords: +- traefik +- ingress +kubeVersion: '>=1.16.0-0' +maintainers: +- email: info@truecharts.org + name: TrueCharts + url: https://truecharts.org +name: traefik +sources: +- https://github.com/traefik/traefik +- https://github.com/traefik/traefik-helm-chart +- https://traefik.io/ +type: application +version: 10.0.57 +annotations: + truecharts.org/catagories: | + - network + truecharts.org/SCALE-support: "true" + truecharts.org/grade: U diff --git a/core/traefik/10.0.57/README.md b/core/traefik/10.0.57/README.md new file mode 100644 index 00000000000..b77d355dcf5 --- /dev/null +++ b/core/traefik/10.0.57/README.md @@ -0,0 +1,39 @@ +# Introduction + +Traefik is a flexible reverse proxy and Ingress Provider. + +TrueCharts are designed to be installed as TrueNAS SCALE app only. We can not guarantee this charts works as a stand-alone helm installation. +**This chart is not maintained by the upstream project and any issues with the chart should be raised [here](https://github.com/truecharts/apps/issues/new/choose)** + +## Source Code + +* +* +* + +## Requirements + +Kubernetes: `>=1.16.0-0` + +## Dependencies + +| Repository | Name | Version | +|------------|------|---------| +| https://truecharts.org | common | 8.15.4 | + +## Installing the Chart + +To install this App on TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/03-Installing-an-App/). + +## Uninstalling the Chart + +To remove this App from TrueNAS SCALE check our [Quick-Start Guide](https://truecharts.org/manual/Quick-Start%20Guides/07-Deleting-an-App/). + +## Support + +- Please check our [quick-start guides](https://truecharts.org/manual/Quick-Start%20Guides/01-Open-Apps/) first. +- See the [Wiki](https://truecharts.org) +- Check our [Discord](https://discord.gg/tVsPTHWTtr) +- Open a [issue](https://github.com/truecharts/apps/issues/new/choose) +--- +All Rights Reserved - The TrueCharts Project diff --git a/core/traefik/10.0.57/app-readme.md b/core/traefik/10.0.57/app-readme.md new file mode 100644 index 00000000000..0fa481e7ac5 --- /dev/null +++ b/core/traefik/10.0.57/app-readme.md @@ -0,0 +1,3 @@ +Traefik is a flexible reverse proxy and Ingress Provider. + +This App is supplied by TrueCharts, for more information please visit https://truecharts.org diff --git a/core/traefik/10.0.57/charts/common-8.15.4.tgz b/core/traefik/10.0.57/charts/common-8.15.4.tgz new file mode 100644 index 0000000000000000000000000000000000000000..4f4a29996001141ca329bc4d5314b4b4e69a7bb6 GIT binary patch literal 41411 zcmV)xK$E{8iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0POvHciT9UFb>b(`V@GW^wV~4bhRuy+ReP{cGBHGlQ=%HlYaM^ zo#Q|xBwOxyfLs|{o`SIY^~ zUH$g2ulk+-sMBlrzHKcaPAJ3)$~iE!fH)oloJ`aIHh?>6K5GGxK-OPt003C#u|dC3 zK@^u5&~=8!3cc1!;d0pN?{|i+N1A`R{#P(wBJw~CpmzQDd;7y-uekmX`g>37|1q9t zpxp-VGn9NfI|U>|A)ew8glRIxvtlP@G=3(hMc5EIC=g z85*|$;IPg)j5VNh1Y`ja#uz0OU{R1!^wA{R>yM)8 z03Jl6!^v>4KY1Ar4<~!Q#u#MFI0ji7<8a*q{MQ-(F$O2o)0Cd&h_DW|IJBQ}j(%Li zJlb~DuW^oMtYY=J8`uqpT*GVt%^v7gztigsdV_xNWq+v0`v9Wh^sv`I+&kPqMA2yP z;N@gAJ)9nlriW-coc1TfgW+T_7)%a(`v<7^vOj^n$q?;NM}wCyUpB#EtD(;FbU`7G zw;gF!uX><0>h<>q)5GX+INIyKJRD6S91QmMM+4|5=R(_Cjc$S{nWrh;c63#}>e1DZ8;-6j zzZq6Fv)J$LM|;D)9*Pdael*;hqNsluO`?AP;9znvLg8dI4fhU4{r=u09QLEVVFU+z zy>QqYz~SNkeuK8FNB1bchHE0nHB2K!P`*O>wj*n5R*x+!)0W^H4zE?E5k!ZChm29E zL7u)mINaMG_6Ff}uh$z*!|8PL679kLa55T3(?fJ{2;s1gro#!`@4>zP{$coXI2a5D zFQdWq05xlVD=LO@h7+{yNQ+w4qkJTwHXL99Z4(@4Sob=8i!}^;FZcIe4&h`1(aYWe zdO4i*r-NxUK!XU4!r^q#>%;xY%Y)u<|6p%0+za6$n)FA}jT2jRx1w`030p|c#3 zU$$qwx@HaQHPD+fUtOaKJXg#OJN-^ib6_+Xp$P56!@bFHI*R)HqrJWG<>6%ba(dX` zo9w;Z@4rNQgT1}U!2sjHU-@@NyDH{ewo$Hy!HMEKVmdHe-Y+fC)%fD9>?( z_y$d|cr?XdKsx2Wrpq{Hn-RH%c`r*lP*^#XP@E%P21ICz6U-+LXaIIiOwNyw-o6=w zDU1nfwb)KAPvaQn8ZJuUBt~+Fa|J5QVIq1G~sxdI$aB7 zSGUyycCELV&@uS?KLmWaRV3*G$$@_c0O0#B@s|H-<8pTl#^B~_MekxbLGd6Xpf9XVYtCMaiw93g^p6oD*_h*R)kXGxl~rGp9krtoJ=E4M+g7gqPp7#CVvz%O8#z!k(XTY9{f^?MsIWSP$d z0RC5@sx`HRx*5!=Vkp4;(%j;Mm{A5KM=MNlnt(YbjKhN%FEHh^ESF&U&@VKx7=O{)YO>+R_IK3vE0V7D(Aj9DmPG$gt2v4Ud zHyg(Yhx7%&i!9A4OsMABoSlLnKc0xrD9B?F@ZUj8HmsPir1ixDCeaSr)o_%MWy^pY zwpy|fU&1oSJ8Cs&yxtn{;fl2h^7QCj0BDI1MWHi82@;Bjl7bR|P)Zgsv*nPGVG@EKoHI!0 zU`g0C&QZJoE0|+ef$)+Ur1LTOw)<_V9&2r$68b`r!xy;7Vl-ysA%H;;E(uK+;N*a|_`jF?x1L#zHEDq}doO~n^pG{*x`L@WT7H@2K($bLjVQ_&I6(wl z&k-AFvmgZJv#KCpCInn#ItLdQ|D&j>)1q{()uP*hBQ(N^0my&4Ao(%`KczYT7lRao zvor!nOPZ1p#wagn+y50|!eRZj1!WnWaE@160u<&mM8}Mfj2Mste}R(^TJC~pT=XvB z7x!JSr=c95ef&sqjQ_>w`V8eEN+@I0tl*(3_YN)6d|g{q^!iwcWw!IfA%bC;E)!b0 zvyjD(M6trg0$Y;-6+|FG0y0mRaRep^2u&br0r{7n1_{lgWyS_!6e(_4fa%fJ6pV|x z)Vd|BDq=%Zuq0CBIGKVZrJTVsg+eMSm~dVC1%Lt&CW-^1NOB!}Cjcl~WHF>jpK1hw zJH!wi$4f#{{vnNp>SF!=9w!k_W|aew#fffjDXeL>6j`=@S})sXNvK%os$PgB&f`c*!oaT`K8- z_nDkQDZ*a>B>$B!+Tu4;NO{EzzPn{>*9#pf%^=1h=4y+0Bh;*hRbb2J7Q48~-gK|&A#SBFHA4PhD~ z$`cr$C;-ITh%$Xie;9)RC1fv<`%#?1#aR9=H~&F253``6?j-NkRb|^59I6sP{5&~3 zwk=ykR|2370;R|GI{iVfI~W!!e@K@Uxm6-WC{Ca_bPswR{(oJK7k_4uqHDMwJMi_M zK+gzGL6&CASg>%y_OVo`6pUWwu5_I)rIBvU=H+`iA%M;y*SQI@_peOapd`%K8C%#! zsed8l50{f%6`isjE8Cy34dydW2FZGoMr(lp3`0g)a_LxS&|r#V)M*K1_2&QV==}WW z_a9!5!D8KJByyeRk?ig}$hD&t&eMeNQnhB@0T)uT8SUvAIA13eeo^M5aqAg4+65Q? zZwx+O9J2w~6|KDBDUbhSU{O1<-|P^Mq?7rQM6>by{dQ2s-5yCz%xMBgrY^8^`#x=nC}zSWR4a$qeP`lC%vXRnXBFHldhuZp&$yAWE6;qFyK~%FlC@ zs4aF%=&2CUU;(cXAWSvjyb4heB}B=}6nvH%$qzUulr5Q`MBUFV3rKMbW<+;jR}TQ5 zI&EVjDsuJ~RJ7!)#T4*POC!oh&#ta)FPYrnzCJxy<3e8O!xE*cCs9g?WLaPV*C0nE zjaLXHBu>+-Wd<-IOQG1YjV}0`UTO^LG9w%pA*mSYYwjn6jv!6mN=xuBxoZykf!q~{ z12!dj34(bzN46p$^sKJbu{heU-NnnJIiV{_&)Dcx+Fy3Ev@sr!>Gvn)nzzF^EhsM(k0 zj^~UGC<1?;e0!+7fgm5DGj^6FGv>`y^hoc7MPz5=>7Y zBylV3nX31OgfNzBl?K2@;56lk>uOxoG!C=#+oPH-8zq}iP{OZ z+u*GP1u_rbtc)KD015}|BF{35GBg_YJ&Lg5?nLghwZKkrve61x6i@F@mbI^o70QqGtqt;1Q>p94C}bPW&uS$3OuP_iiZDIe=q6miiBe z1mo8zhU;?_rb$G`px={UGn8X4WDD;ZhfJ4Lf7qArrx3@>99_(FL>R*Ci#h6yAifo? z>t*IAcK!K5s9i&UBKK{`-5s`jrguN^-y6Z73z@Jrxl38%Cw5{3y=PLFu%8Hh8$!1S z?Vicp2l_sUyhzLg`Tp56VVzzem=J&|m@_>YEZ`TsSS}b=``_*LUiJ5TY*)zYax!9A zf@KCK!WfDvUlqi^qN*3psMl%Qw(#5y%GN8DN!BI{!tX1L3?=5Y$6c8*B8%tJ)FOod$ayU+B7 zsNLUX`zwhBH^*s)ags!ACy&59y>8wSb84%M;8B(P;Aggb{LF1UpMQXHJb~fWMfx_K zk@v})JWun_ztJ!#CnMSTYsn@7P7I}qb19G@B1ihG@EsadR}V~zCw@a@Mp06y}dAoo--ip2Q_LsNQg=`9@FN)o)lG0fEo#DD&>g*$Z%*M(9kqU@1YazX~go*IBs2wYJi^R(9YlPgktd6%JiO04(5| zn|aVLOPmW<==DMI`1{@xty_8hR(DB)s_9Ma_)wI@qySs6u zQ&tpn#sO`&C2k=yXq=p_hA-HEM|KmKTl2v`ykjS!p@~>P^_HbRkHddgvgh^e!MDc@un+zr-6dT?$tN~tDY4U|%4OF=$MO8PkxmDnS7*F!#i zp2r~bQ*PElv(gl%TzrX*ZWwlzVtjaP?v{h5| zZtALpQ?0HlcdzE^su}`^oobJ|T3)Jr*YBvWYIiw5FIBBPxW1|fw@zWzr{$@-NYLKeQj{D9D?jmDkKhRK)!%reCGrwl&(Et@uNY40ynQ+$-|nL8qST%7}SjjLG~ zI|OCi&3V^BhvAqmDd3(%(xqadT1QFLUJ@x4r^T_A9Hq_HB2L;9NN{KkwY4Vy6r;Yd z$x0n~|30@WN|d;wLoGV)L^TG<3@2YIiqe?0VaVOx*#Zjw;G3U&-ZrUCu^dqDUDkxr zJyY8lV*4QRAWJXBZo>ko{mKG9QF02NJu67Yc}l2}infH|U(6yEsQ;7_es_o?<(`=< zdC9$uE&WGay5jP-E!`PAaT>zd=qyE~GDznJDF(o3qwJH}e;CZpAf0zWGn9a~#CM%{ z!XnCLMZ~mMrr=o-t-xPjfqthyZ1+l#gn#%MzYXquw2V@vmXy$Pj8Q`RX;Yyg1=dUf zig56244Es)%^+Lbmx4NV@%Fq(E*CAY!p21n9%Y-r^`|t;QDDC7#Qdok2b#SQd+tL$wRe*xlKkn$Ti)tbM)8Oz8k)PAEIw117D zPyg4o#a*Yu1v$5>bNL@^x?Jbh^=S$mfG!3iNFh++1PlCFUlm~WSV2eKn5O9%OkiF| zX?LcwhI1&r!YUl93_kkEQ2ITWaCOe$`N1LS)E>n*CJ4JF*6Av`xK|~UUx#&x6v~-CK7$)(fl9-zpWaJW1B!N9mk&%qTI7(b=ct7xK@a&R&3Q6}|vykvS~f&`^@fden&xnZz_Gr~Vi>gpfE#iM;`f?Aw?DrC(K>+(95Rhe#P?u> z$?q2ui!nRZxc1The?Odme&P6_Xb>p(*bijC%JA5lrgMIGB_>FKoZ%Hp01>?sohsK~ zCfsz3BCunjvCBzQfKHZi`~oDY1Bt7n+`Wb$bF#HFPqn4O*BjBM4MS|B+BT_6Z<}i< zE{*4C$?vfM^aT@6p0YD1vxVpEPOOt2Rp^+(;Ek`-W!~l>EgU{dQ(l-R z|5O2lx$)w&1K@MVx`+<}Sx(x*St%ikEcKosG7DDO#<`z#F5>_3+r@h6u&Hd5<%Dk^ zBwAu|ALPm7eR#;&$UAjgVeK#t1)=u4Qui z#Jol*|34DwR>pAwqiZm13k-?6>(XXe5MdgJx@%+b0m10!98>h3sjjB`7jp!lV2zSD4}v}2>urugO@K~{)jbjVN^)@CPq*sW3uAf%BN$n%+dsW=D}5#iM+$` zSu!qGuz2tPSno@e@KKb(CSwkBrmxUzgc1N_+bzFkjq)~wtVfo&7vX%j-d~ZS5RF}x zM{nSS@KcxDA{R_>hQnB`de^tK=wvXfuS)O^$9!!eL-n|2+~-=JWglimb9^gd6!jxqK-$V z4#D)$B1?G$d^t9?GtElha+>KP`yEcOoZUa)F3Mji7uMcg^mLw zVV4$jAtTS#sVcUpsj>0SDeoynY+?BhyDy-NA7tU4{-L|@J+Q`tMx zGNBnXgb|)mh?yo{Uwk-~-7*1${=oG6(B$i#ae1`9dAeobrDk(23U8ih*?PlSE<$~p z;VK3d83v`DA^8|BY`d&Ao(}6cI5_a~Iyqb7^tC)${Jrrex5kBCQQ3Z!7PCq%w0D_}TKbz)6HxI9kG(&CHbwB+etC5DJqJby{MCx$#^D zxg#=A89%e;F~{tkBYVqV+D72Ou>uGDyRh8yt<$q-;C&AGu>puNp;m}xw)t9SrBV}mT|~pK z@MmMAm1T_WpPVU2NKr^d+`E@ZYcPu15`i{NISnEjwmA-M#_{-{Z74AB?zXIc=y}DN z6~(mQ>Gyhq3usIQCu@U1xwM7pB2e$Hudh4KdpBKxx~i;>tqACf>=C3QKv$=wZ#R!y z;2HQCfhAe;5c@d_)5QWM5%)c?!bF(J9ajX3P-6v7gqhSsx1@IS22pyG>+429&Gv=}hKZm3~uUw0NJsvy zZCQJGeL6dp&3C{FZO}B3`DOS`7o1Gf7t$h-E-CnXy3E-opNPdg?()^!xjH0mNZa#t z!BsAL>TW!GViojVum`KoKf zT@8aNveE{nLKF+TcDkG?-({sMYBLMaWsRfK6^`TcYfQtrby$SH@c8PHj4?_sPtI0D z?WpGaIx5~ymRyl_#R@m4Mz9ccv0@C}i3i16MPG_IwnBaC%a9^2o{BUg{2!J5EK2~v z5elJ|7Q?b?@g0F<&XPMZ)+>=yXDTxAXlEmivE1&h93zB^`uuxF*zrdM;F;}^h?12t zk(BeCfRb0C31}a2#LJGKa$CeHe4^K|*sY1uKj2t9^q0>xy@wdLvI08?8LKQ||LZUm zHFmW8^A$=FT?=Q=?r&Iz?>%Cg6C*b=YTI2S?MY^6xJjK^yc`&e-d z2!6!WN_xi_JJUM2V=d1&mE#qp2%Mk)#Q4TW^=XEwqdI+n*SxNRqhJ8(`ObIeTH)bU zzJ~;jhHaFv5sZqpJ0ceRB<1-A)H-8IBX^JGdpp_Y6=J*eD?}I_g-nH0;X`X&00WlD+ZwMno1CIz9T5@w7NtnSC>nmsRs%1U}>FGAHn};>8Y1=Q6{EQu+#) z@N9Ny0#_J6>Y{+?Y?R1u03yzCENa(I#)aT6N=dcDtCX3yDKrNC!QP;6z4c)PoR}Rd z#-YU4#GJl~B<{EY3W>(=2E|6Ju#ME`_Zq$12$+FtMJFlFfZhPgm^3toi&AFXUrW55G zh0N$=aXJ%bA2P?84lfX=S9l9WtzKVJ?bm5b8po!p5@@a|Y1m#h>6TiN26`){&}j$0g?IO#}z#cW;v|KKs#`}|`-&!Ejv^8$nh)JfFFb}2 zOhg)I!R$F*B`HPnO6JE8Z_i~?PD>)NDR})oBi>~mTL*3*P=v|$-O5?DW?;O#0vs&Ei|O(d+ekqv4SM+w1j; z{|@#>`+w;V2fe{?*y|7W{?Z%t27`mYfZjd#)%z^jhW#(SJGWKr+#lq*x#@n_;+$KD zKHwV(d0IJ%mnh4z%t=2txuvsIM5+?RAw8UAY#_EnS2>bRqG4Bu=(N7;e*N0IxzS!e zfhf?KXD|TmuS{sNuXqYNpM;#Z@>F*uqmTtf(dY9F@>{gyS1J*$hAPgxRkGs%bljR^ zyV<<**RQR1yWN5rmfMdpu(0c{1`|YKzjcL^XbdV=RBM4K6mB}ov+?G}bb_NN_gNaz zB4*+{!{}F#V8(SR7_zD=-aT*Xg7;45I|RVNI?G6R)t4tu4BMNVivAnNCAOWCqX2+~ zyKkbz$bw(BZNVOE4!}tvUIE1_V}a^R0Cv9dDgdU81z=ACKs3jpJ`ykk!bB(cOd*>k>*L`)6$rYm%?uvXcvQFX#^a zY=D>3RrRASIgR@Jw`RJ(qo*wYVI1E<*883f^1rt~=(+O0KkN^mi`C$uwVQ zsgm_&kuB5uvF$qFspg1p(b;~IZ`NaRgsKzMO(0XprS(FFH;B}py;A(cIJU)q_dD>T zi1e&X?l6h$EryIl{ax4A84B`?CqI<}%L6w@3u*9IYD_IOwz)jFA^wqBOL_h4TMPHb z1vaez{-D2CSpWNb!@<+~e~gE({||g67lOCx#h}7WDNhiY-Lq-|Yx=2L#v(Ym6~zu( zZ8$40hsg|q=d8jD@Z4Od8Nbp>f_dpGH>PxHs~}Z=T|hu$K&>X)U%$3=>F#$Ta*uUF zW=A|K1)vj`L-+uh2IY}OvE7aX$>1olykvN>#!L7HcEv!9lG8`clUiPQAb8IwSbz(_ zPJ~0sW>HUHvB}-S5EdCDKPR&1BmmEA^)gE>`vbDhKgCn#|2iJsWAXpNU{uuq_V-5p zC;tB!Pp$ojF*Vl$#0{jJK+g4rH;>gvp6_g9_R(Y)c#SL4Od(7Z8Uw!xrIGpO4z?9l zf&2bif=FHKk^vYUUP;scfs42rmgbH2;e3SxY8C0IOEz9K>yWfVV_JAr<7r{3j7vEZ zq3C|Xgr@mghTO2W@K$@ivI4M9$idmjbXs{_hPB_KWg=|6uP){y)ZZ8~LvZOxvr<1YKFE7Az8e3CP970-V@puY4I{lUXQTEF@LK(jTJ3uL7->ll-tO5|wSad2v zUw}K#CED3^EaPjl)Ff}U4&p|P3VKgz2F)1yh@lSi%|}2er$41}gz~^@$2)9ALO?m~ zh-BM5)xvKyKakWjh9wD2bLqkHbvuCAPAb^UT(91J!g7zNdAV_redImaM$!sO-7-2 z5}{WGezmbD>f}_`cN{l0%qz4eo-X_=C=ad?4VZI&0R zOLmGsN<*M9`Z-8B#zAxawsUpJ@2;-;j$!Z)hQ94=ifVhArO~-%N~rCuRkp%tx1qeK z!El$G;Y!P$#Rg-dttTZj$K8w^w#?qxb@mSr%VJyQ&@Y?I8)cQ(G+)RV{5_BoAoz#f z-KLOH4d6El?ri`|l-qR;D9m2~(^fMfS+SI?jS|wg%8e$lxmFv{)X;^jMN^yho+m+5YJ{XK~_I;d&SCt<+A&zoT*u-TM@JghQ($46zxD}fKN4YQsRztGeL0>|Y zIeQE7#NUEW)N5D5E=aK!$=f?Xc^P3YMJQNq#s*c4G4 z-uBquf^=-@(THfQ3T1LBeRK(>2$7SDepwKb8hwjZv?~ia`(rg}Rk${#rmFgPprhIm z+KPf|A>B9alxWG(OT_hmSllHD)o?C2{p(3X9Y{yB-WgIZJvs~B-wa=_9xl) zB-@^3TT{;TB-@^3+aFoBJ*sGP?2Ny)&9Q9%)7RS`%m06Gv{$tM?GO8-C;Q)HJly_w zj>0sFV7|65fijk=4Eb>iBbhy&7Q&iWn*6M5lFnhUIBb?V#wp4Z7@s5*rVc+t=fHSoe+zLTDQ&L6wURH;0-!+T+l}b_|9l z9(*lkY>-tn^q`36Doc1?8TatUi{2_rn&DN9dbh=}sjAHfP1R_IS~2k07O1JJ%~4Y| zHlX(X633Cb5x9U^Jz1OUa-C`-HbBh{>-uZTtI)mjT)q{}163Y{VY*Ccq3qP>M(7(T z$MRXoZ3KdXQ?I2x6p*nCmPSET@|jx84La9|YT7g9?$Vrw_NsZxudn{Ez;icTkG|aqx8i|52XO{r@u)o?T`G z<>}>a8x4RJRC?Q6+IzHFx9$R{N}JX6{-?^-Wm$mKE7$s?N><&klAkTxje>KV zc#o=XMYKnAN7QMy`5jT!nWlF{-QGP=d`LaPZgWk|M5ek|2llhqmZVaB^G}^i6Ngwg z5oO(NzjH;Bn=bp+&|>kj-v(kVUG~#BJkVV~3-wZybyxjVJ^QL(VMu?wtA4r%PdEK; z^Hj=zC^lO6p$2Ty{|`#%KcnH`DgM`^JeK}%@2|Js2e_^TW!s%wq9Y(~*f%&P0`LAo zN#~O2ENvuqt1wCKo@>QpOei!`ve|fTJ&giy-SY;-v;K{r!aeN)Hmv{Q-k@L9{||;w z_kSPdxkdcHb4eig9Rb*JkdZ~6ue7QzmzMsL3nQP(+2k1ge2m2nAZT^scVt4ouLy#5 zfbWqP{Z4}bInUM- zAN&S&gB_? zDQ`zKZHiba?t%{pMnC76qW9dxXBYemep#k=7*Lb8%>m7`^g3DHIaV~y;mqLNA^2ZT zdoN$U{1FGfR(x)l0-7)n1z-pGe3IBi2D3Pwz&HTUOP;KM7E}Ch@|5&{;T+$!E=zPT zt-BAm*%55g{|Eg-{Kr9mFnGHE^C*wd|CQ=bQ-$>wX80vW)QqvHdVTF*k2f+) zl&s;&3tPmuqe~0vHOjju5!>+N07ku&!{Ib)iuLstg%6dYitGN`v-071g zw(5ZJYdhERlq+UYg07!J+fi9whPgs(eV8ICHvj?6mnZS8es&+F?EWGUk$TQYZ6PgrvzU>bjM;o5pTU@>X&*v$jcI;pYoxLWN zXM8(iN5Lz1GDznH^mZ-kl+-HvqQ@g(cm%pLyA=m%P1nN4@V<3x!3yqshqX}k_iwES z{kuL5^?#{f-0nbNlmE}b!KkSJ_eM|p|D!zm{LfJlaD+lwP?veoPlEE=gTOkCm@RXe z@?L*$;RQD)1dhQ_eLZ0xJ2}cyf@zws!Pl?jnt~M0z}K&VfO)ozV-fVJV2yO^WV#qP zXrpkMW4dPgHu}N?B<0KGhCU z6WFX^j+rJBR2@|MZVq_IMAeZ)dG!K3U-5w~_x;M#;g#J$2q`INmMK?kQr@wBjkG$`951*L&;BI*ZY^Kij%OZ4*rsY^XPBC8T+?#j zLxM)brlrrd&#)m$y{{980%{942HiYOX}3ejyo;mDoIqg*Urxkl`R=CXj!hXGZK~zB zIc&S_mTt>J>uMzb?|3C(gZ%IJ4+{C;2fe-hgD3g_7>}0!?=zHqIy(hnju_cs7!zq` zAzJ#2kl$NK|B_Lt{Rk`hwwDpK14P{!VB22o_jfO$cF*q)M(MhOU?Ur3mJ6dOSEM!& z-5R1C`i&y^Y0LLJdm8b7A*dgY|L+y|f4yPv>Hf!~JevPYbM{V-rYJ{Ah?5zZVQQ3{ z-NGgi;Dn~u0g5o2Z*jWgx41usgxFfw6N1o_$YBd@QNYj+C%1s$Zrlp+nmDjH!pm_^ zkedCwG(uxA*dH+=K+!_Vwl=szYpt&e^JeB#VV|sef3&BH|Eo}UcQ*bt;QymxN&nyP zJ^BAX%A@(e4y1TjHhvt%I6+?#ni4kH^DX1{ndvBoYxSx)Ypq$(;Y) z4*5SMMkoU~nc@V~^=72+*+}z%&u0FwJ9X>JARG99?_j@d{~0~q|9F(A%KyubtNWPF zUnazEwd+?YaIfF-OLyTxyuN&5?ty*2%-Ga=d~KzSSFL{)g_-MrGS=xs>3_pvzqJ1! zKIQ*@lt=4-I>xt{?=5Ydkyx3Zx|}B5d52& zFdFgyhu!}V2Ic+#aP-9gALS|Y|GV!0ZBbC(|7%X{+5f9=8}|Qhu_pU}x5gd!|66S8 zEjjl`+|+B5xUWsUJsuCgso&srqmgOsb0fr6he_sFT|`5}Bpt0FC^@#M&ZuG%QpsJU z8m8+wQvQ@97`;#8^_XX>yR&Cb17Dol`TgVAKmOgH&GKJQ>OdZ?>@1xf$l7yfR&d)>_c@96x~!2Z8CDDD4xy{G#hkMh*| z{|Mr}C&wS}qHFWRH)-IzgI(`QU%cg0wfD0TmZowqtHKFHr5#yx7{yfE-4;M6N_HX%9b&2UAcKovK zN8Ir1-fq3$CwC0&qxwqjJDAUttoeOCjrjk=#(&s57!~zI*@r}C=x$HY7`Uitf zf7I!9dfomY@F%(!gIPfoUxYK>smLKuE>F%@Ll-mA?9B~Vw`3ICfp1(Yrd&^ne?WW~ zj7;_C>buNxPgWz5l17*Cp2TnHTQ%%g0PI)+!~XM|Rp2ex0lURM-pk;RJcBX%2RL=qa|lBq-<0eYd_`1_`-N^GJ*gN>)GQ=|cD_2t7_F2?d)oa~5o}ipN{X zm;E6uuLs*t#~3s^WDau_b#y^Bi~yg~^g zej!uOW)A~xN-fD%J+Yt z{C^(jsj~n5tmgh+EP#?_)bkDN7{qVgGdSJRzNbxgCHKezCXTId_W>+?R-YT+>AKhX zZ@B*NWC7Y_{~7HS<$r&;_vHWoD36x^W^vus0_0si#s;K6`>a6v;|4oWpj9ueV*-Xq2ZJxOo+YF+irI1|DdjC#VnumKz`kxHp$)P9_6Xc{|XD)Utz4A@ZZ7gUUR>yBol@30g~lTmvOA}gKV}zw~Kcg z-oZ@OHlVChr5v*z_Y#BAr({O_jz7E!HxpA>liVsWJog+QqBL-7mD%(#wQ6y`4onTJed7&Sn~fH9X$DeKgzQe|9>M% z0%)4376MCxlbOgDeth)y4fyfn$!7Lnra9vgUO218ym^af<1cSYwFTQ*=6qoSABPIA z4oN3Wa3@T{X$Pm>RX>nCORCXFl)`Y%Hm9!K;zkd5$XoA)2Uu7D*`vs8t_22Iei}64Dqy7F<{Le>uw$}enWa7Ao(EfCa zvHQ^dB(Nt#-%8A1WQ*0TQ9t$=rb&IH`LE>v{x76R_X2Ii=LpgBZSe5LzrsEO^O@^ndgT0fevvlJ(k1eWV7u|C*o z<*w0$AH=HDzoyMt^DLXOXTEewS#QbN!gQmybM|SgmYMa!toYU$ooe~#a6d~bQ8l$R zE`{sVT#v?9YUpxR0NQ{jF*boUEg-tGOmu7r3Gl#aG-IRn+#PKXJF$7Hfk{FbqhqAf zCjwB)Z&F}y_Wu_Y*MP<%#W7>p0sayqoKr74^te5NJDd-qp%A~&@)d-`^tR_uM+ zZo6C~lgg_{r*-pdJ48_cu0T=0$`kL!;+19^`jysrlQKRwMpjk++tHLgI60In#ynFe zqkPPHL|HH4+qACvLg72BeZkYg-P{;Xc$T9n{t^h_?6VJS2{QmDFuX!ZG*ST@eWrmgIsR3EN1{U3=7rES=kCSUzKY;~ISssg`SM2`6gP;a zfs&vEV+z0y5H?hcX9Q;1&f;_e;{ZIj?G+Zu2xmJ(l;*dCs#VN)PxRi72&?74Qi~t@ z{I7Q~Jm{Ct|DOE69_86u{;LC(hmiP^7#0oty<5O1@2D^gWDW5~92w zuOiu671cPn?;PZP#p_Jbs- zt=lSSl_cJFr)tw=RCR+O!g$-!ROA^IWeP7{h1OT09;k4M^MV$isz${Rr^%31aun_E zcSc+SIXT@Um7T?pTgM$cY{xdniu`V_p|)dQ zTC(lAeF4#FO$$QzBM*$j7^GW>i^qT;Ojmq7ul#y(d}bYstM_AYaeUVD*{)3q(|HfF z#RDKO1g8yC!RR%f@!8=@r6VLx(}>%}nOGI}At75ia*6!7yQ@2?URhmGuPmAGw>J0| zgm4r{P^CQGt@_La;I8CSF$!s#kA1vNe5zO_?q|tOsy*qexQabP)f%I2?QOjRS#{d5 zK@+G{f8QjLIAOnU1-LXcWH}*7T@i$uW$N3_IP=PKr8HQ)W=n2U$8SW_KAvNk$zjhv z^r>D${-fDH^{LQC`_HA=qTR&`wCVoeUdjLa;9zj@WdC`LhueQXAiB&GnQVt|Ir)MT zHXj+o-?jTRw&fIe_?G!XF5@%4&d0BWRn>g=bBB(@9olv5q2P6`H6<*XmxA@QGlHt_%9!NH((|9kj!|L0L29|zYL|Hb?V#^h}U za}eJ^IZTHn8cRvLx##;Kb>`>CyCiX=uG0wHe}ul2E)nf;E>?Ui`IrTTd+jk^{+w;L zE^!u^KFZDwhkI7P<))HV;kH|=Jfw5}zH8peh6|wdaXs&Yv#V!sidy!K?N2((i(a6L z2-xe3EVlJ+rfKsYz5+YOOOX|NUg>Sg%llyzz7;oUh0^YjRycww@~9^SwOj%xXEw#$k7uE2;Bls4S7kM0$&Tom0*1@Fiq;3jvQP__4Wf|_Z>?0GA5PwINhlo}(I0nUKV&!z2W z1uEs!sce?TxwVL*z;!)9o|jlb#bU~Ih$n|7`T$FJ=n~*|yWQG8IEVmR@MYTO%(mph zm8Wqm4L~_eqN6yQ!_(yg?Awku3Wj+>5ak1Bjq-s55zoo~xLF5Pw* zce~%L#^0=jZ=OOyG%COgK)ahmeU-OGCH+6flWvG|+P!4|J-=JzZ}DvM|LqTo{yztU z-c$U~M|phuKgy{Syjyv@=!-3lon16Hal;{@oc@%?krV0G^5dy0?E1&}l21uj81G%7 zz$sMKNWp7X-5#neZtfE8dQX9yq37auyH*`PC0Aq_(^t_&O73(FXdUT%*Yz~oZgc~V zpy-6@P3ij8uGgX`73gTGYFlQo0X3;h&Efr?}n|wq5Hwi${ZnwFl-8%UE zbLYZW`{o9e?~2*SDO-sp;Tz!k=FpgEu|s3h38e(_4+KA(4*!PMVjzA6G(D#|PG%;) zydzi`#4EI}gP7wLq^K##o5zSw{q#KavqApfNBEzO@xS}~qf-9or~IFf^QiNm9HSKi zjGcC;P;Pk{0pKYPAw>Wa8MJDdqp14ur@*5vht~$O%;WXD!&v8HN$6{Yvg0&cTUIk8 z)s+9Nz=FYgpK*=f5paJ)YvFUCPM9}hWE#`X(RNQSvm6nWP~-jIwzrJxhZxTypL7mJ zTJAIm<_@mV8l=uN)DOHR6MlC?2?7f{MrK;}`-G7h(M=;Igx2;$WeL0A-B{gnXtr3& zdWiy@0Q}|Hd?mHxW+>k0p|4-Me(feepWP1F(Jr~g;pXm09vNAhxGsHjRvLo-=qFh{MSc$c#frGaZk&>;2|RT0~qG173{Gx z@ry+%*J*wgr!eY}49N@JjZCfu!}G>)t~{z0t9W%tI;*}D#8u^7;7$HB#R&*rfZ!Ie zD{QAt$6(9u{|0QbZv8v4t?s}8Hv0b!dZqP$@Ra}YQ67>Ae zXoQkZ<CK)W)aZ1*(fkJ~x6D_QM!RQqbBT7U}o77L0muzVO{mgQ-dW2U?qyB~MA zD@L!~s#kVcH`6I`JvNXm2Pd-*V@M*Bv}@lcXt6^1ak|KO{JsC`cls{_k2P-Nh<4mi z4ibY2qR?s5yVVp7e~!W{Js5yi^CZ?}E~rSE>e^o34+(lBrT z)bW3Lui?%Xz)k$WSGND{_n+ebJj!G1fAYTacB-E`<6w(V#XsTnQZ29I!9Ti_&Y!4$qF}~S61xKa+Rvk8f7>On7|o|+7p>nP@M&xo1kQ6HhZq_ zAKhVOOT*Ci;Yr`~+Ypv#8H?pAAmSgL+FlgJTPl{T$EQNnB*&-21L_sn z(Km!WpVhWOd~$p_b}R3Vm|Y1M51jAmRun|XEyU9_KQGUhNeD)J{7<|%Urwj^3kceQ zUkh&?^N2YBY7C~!I9`KamN3Rs%mhW2@d@d)entX1FHcz;Y;p*gpb#zz0wi4^zJU{5 zT}*j$*vP6h$IkHYQ+avgT9#`t+QY#mS5(Xx;6!PNpCi5^mduv zB8oLAsx@1QK(0iK#2G)7x+5cRPUdpWh*DfT+rS*9o?EaLSRJ)Ej{Mtbra8)D?qB~O z0SGRG?fHx9RgtYrmGvkL(`7;#OJE$Nz9+<~b6Qxvmf6-V*bza&oY_;fS~3!pTnKlo zpeAlm$r9=607?2jMMFT91{3FoY?`4wUV{)aqEJMlWM-PsJdIn zgwAqAeu+T_3As-5i17R42t_EWgB_s^B@s$O%x|VBFddxylUq~jTFp^}$( z-(0#mc&6E%wg&=;)Nk*U2{63Rz{?T)TXlyEzAx z_6h8Oz+A0R*f=fuG>;aC)BO(cf*?zyBjZf)785GMTDkAV(3|U$_P5tKq&lREDJ4_9 z==*x5W-Nfl&Cvr|D9&P%txD!bross(Ny^8Tcg)|iw*?<2dOqFq&QQxXcPqwK7}1>} z6|YL8DPA`kNK3bj4g9LHv;a3A#u!e@qgZOT2)y^<#&F^tMN`vDq~6c& z=z5E6JJPTT=~lPYZ0JpWKOy_^scX0CoWKhDb}`y8K}BjWeyN(4hoOBh{B7r<=}Pc6 zR?Ad8tH5bij^D(WI6otmL@>|AT2c4)S zf|A-){Pbv3-#|18FdH>7FU(uawUY&)h^`~9O0&E{G|36}sb@|L4W`zaSm}Ugrc*_x zvV|2+X15YnHt^rKpi(_-z=jz@B{r-^O#`Z9!LqP3i~4F%aplRvUe;Uww$0j8I5%5& z<+kpN-Bv)pKUOOn@Uhv7wr{~=twy$IuWF$bSgZ5;!Ke1#*l8Kwy|7XV*26~24Q|Im z4dmwR^9>(Ie(4m)Xoe!dgPLKwW;+G+g@WrjN^E@=%cEn9vpR>RqV}<<-LU|dPS-qo zZZ*FtLgq1DCFr2&M%|z`jN|nBOo4bqLKySqP=aOAIv+6tR|t@0mc?j+5(?uV^K_XJ zKvTfauI3`Li@K-jiXfh$T~-*s0!&OIOb_J$|QW1X7msqg^Vj*v}3 z-{`BU1N|Nt^uVAT4FC2h@=Mb{o_*Z3(o``Y1xWmcL(uOXRN@w zZ6)??Y9`CfP+XWMA*3#eJCkk=pM`17nk~}?2+GI>HXiMgW+>ewj5JblSsgP*np2O+ zXdt3&@Xo=2PfYzzwMNtX&3dD&M3Q_}RwC5^TX5^tNSz_il4K-b?Rw^t1GFvOIVD@z zQ{4P`)$_CsNepB=16E7|Gia7u8r+s71`TLpu!$%JccqF!6(u-IPa&(009D#F)=`I4 za(J176`x0?FNx>sADV{XlBNqtaR}ph&09G>I=ei5b8-3o$?5CM^EV$pogBX@i|b>U z9Yv8x;D$>=(?#WH&ig9AM(YGFa9H_WHT^nIv%0n`zN^M7KAYD41!^=p=i(cTqKY2B zx&?q@jMYXEBG!S5jyFWY1yO~C9`dU0JM{3XalI|tEA-VRg4!0nUDWF{$14?bT*Ox? z@VX)gEwVzHoxut-QckQT;=bw>oF+roF4zHAIEhZUO~FKiam(1Cc1rh7Ux9vaFl5|P z^GGigJCv;M^(&$BS8x%zS#ixnQ^$MlE z)~ZxV!v`HbQoeRLO94v*LApE_{8;U&85!I!a8+VirM*#s_Z-IeRA+KapZa21U z2}V(%p_I3+zGYl8S1Zm#iwQQ-FF?7w;zbstvror?7gZ2Y?(Q38tFTNTmGFK#+W>B! z5_$&d+>P+vA&8!#e1UoXMsm(!RRD5}2Ak@ZxUs^Zwh@D7W%*mJQ+M7(2KD0@;>CsX zZhOoLY>a40PHezUjMWCjJb~34VR-X&+w~y-l&3cTKb<2miI+&+(U_(=f3rxJi7gbsKhp`IbI6T^`7&uu&@|1}Jt=;< zJQn8Snyhh_Bb7^VR$xAE8govP%l6PI;l?dfNlBP@3~M*fTv;dQU8_2)ZWk4FQC!<7 zGyNs>T zspO+fgH(S5&<00u-?jkA5#i~(b$(-R2~)`HueMF6Vb)|uwlIlAlWh=mCphVnd7yr` zL;WWT=PCI1$g!t{X`Z8yvKhB|Yp3(=f8N}b^M1f6VxL!;O3w8Ij*+H2oN zDa0z7;VMgHl;9Wq*6})BvWZVvKTm%+Uk$<0@muo$kDMF&L6?pjqJfCOW1X(0- z3tL8fk`H|SDspdRi;mz(BAEtJ5j_fhsK&YsNmY|MMu%jkuF`!Sp(a6QHMCT{(*YPKr01t&3^Z zdK?3Hte^=k&SDIk^T+VzYxI(01^&fEM{;YNE#vqsjd8ekbQ=Dxlj)B}use!@6z(2L zFFBL4V-l{k>82UyW34%y$4O0ib5o;WY}%oVco9Zqpf5CsNBN9!@t~!Gc)@G2zrCst zFXWzy-Lg-2>XCz!>CSJDnEpYjOF@)Mq9HWGiSvoSspwnLp{80--a-d0wG!hg3fG~s zqv@Y_hfJB0nutBz0ujQNn3lQL$9Lx2*qWW~fm_Sd1KwKMJ`)>CR%1sIIs5VCwOoPR zs_o2M%_hv&;Jhc^}YxOrmHG&k>B?C-M42no_1>k~N`d;c$>r6}ELd zO%qlHloZSJ(dCCXN3Sp6pT7N{%Mb70U%34U`hnlIPG$k$DZA*DnmGM*^7`cH^3%!r z$@g#HT)uwu>E!s$d7+(Eild6Ar0#l!*6P^J-r}QVWhJb&bypeKzBn&5ixrsXo*CG( zZT{B}dAewZ0V`=Xx;J)sf0?uGZ)p7iO-(h#gtB6&5WW}9fTq3dj zZXE-Z{3QFUe%UU!4mml+J(OL5P#A-jASUp(=~6fD?qUQHA+@EPm={3 z5#=W7%eAV1ROkoE%CjN8V#`Y8>TouI+Dqv9RpEnPgwI!{EvI`x?GBS`!pqSwOPr$! z1itPO5fY7`2&Yr9fEiIW0JMU$sZ(%|E0VQ?wWd%^$n$b>3;6|4&@8&yE}&mbKq8Zz z2ksJaM(UNq(GO8AWgl3^tO}qlEkv&ywOmG3X#A4d-(hDV*Jfpc= zgyzvspF4}sGnkI_sKd@IOF8KU$kk?!!Vi?Jl+-96KFW`-aT`chZn5Jw(60<9cKEQV z<7K}#tpG2_Z&&bpx0Q{2-X$FGuvA1YW9T>QZ^PZI(>QnXQIk*#kZ$(P(v7bpV>tO$ zb

fVb%>4+w5q7NecGaB&}AewDvlr^K^pzSZgoH?sqL9LXC)%rHg!tPLIyP`SH=) zH$X+ii2(QJPNu2oBr93A*fSo`0*+IR`KZo#0v`2}yM>mN%wP2(3@>Us4;et(2h+T& zI6Uy5G(5lk5yNAdDmU8yaFS9yT|Z#{kKRFluW0}4J;i^2oags<{woR2wHV5mzxhce z&6jAq<3F+{A&o)%8cd1mTW0~kTrLU9FRvjD=ZL)89}EYFhv5JIUr=9Og=#0S_WJ`6 z+?`EqT>n`b-8BN(Ci{Q?pcwz}fc^8d{vY8H_W#z!oQFpe%M!D-T4Vob%ecV-K$b>! z{4ZxSr>*oN1vi(E#do!4%ktfda){a*Rm~UAwo_rB^xUlC%{8~)R$T;fo5^v?0mhIJ zm3*P}vbkB6gmV-vW0Wgc&Wq-7<|(14A~g>yVg1|=hT5~LziVsTcMB6@%)$DHBLSQu z?pC9s7Z#l3cu6SAf517RKVv%oNt7(?Bq}PDl{Po3ca+G)a-CEp-1L0m6vRh+B4h>1)S zXm-TK&kfEkW;qPe8Okx|6=@RjN>+&UGKs_&ib?#(2210ee@k%D|y+UhJ)6B16nc!c* zuYjaE<(V3H3-&{ELax&BRzq_Q_?CIeKyf|&K-t^Rv?pUwmw}dySe_Aj1)#WG?fGW4 z;j<>mWtPQYN15(QFm|~aW|P1x@pwZGAG28wBjlxqrTA7s4dt)5q=qt}yHGCos*aOeJKu=aeX4s$b+-p|`lrw>fC<=W8Z zTr@Y!w?_Xo?KIvy9K{$Cp#)k#@4n|s(g^7!eP6$}?B92X4ySxG&DXB_`|eO_nx%0% zTc2k+g3)oB5Sl|Q-ES*D-bcGJ%1xjx>*toRAIr4;^fY)H*#B~R#~c6~?En3PVJZLj ze(x#&-=jR-{(r{f4`_p*%5&uy{2G}1__?JOS4>ATiQVun{_C%W+++IggPStU72BDN z!yqFl)QDtW(vilc!UBfK10VxY$#naYY;mXFrkUDNV!FH8F7a zNc4;KHTdb`;w<1kkmdL1z7H42yu3Kqmv6`5;`prOe_*~c#LEbk!)H_jb;M^ukXHS@ zY5i~J|NLbCP6A-l{om2SpveD6dr#-TkMaoq&*vD3yA(K0K%CBS*o^B-#}9qqHp}q> z=4+J~Tke;O%)YdZkRLj-I!}65gsGzL1g1F|n#FF>7C=@#xo>w1OSw_r)WnbwgRUrM zaN7~?CGx8{J!;gWK&8bg;IX^wUBu7%=w7Tdk=K-S9i5g-3I|@~REk6Pw{v}2OsviR zM4^&&Ei`AhralLOrPlXAsiHh*;>6@!myu11Kug6GpyC_JQ0Q~u8#pqyaF@pT!4^os znRr{y7g6H(Cfx$M2>Qh-6&!uMcpsDsdq&P~-Ee$gD}|J(6%e`buSeH0CKO(lJFg_5 z)kZni&A844Jr{Pt7FKUO>nR81$@wBGLfU7gI1K!FTd$T?CY%^RRDJiJjHvq=3Q4H7m z7|WVQwv0QTLZE(F6?mp{E^~A-&k>oYaa4v~EYT1!#S4@!X(h_;_l7_-_cX5v)A{U& z*l-`=|MPz2|3>}K_7%OQ7PvwG8|?M=i}7E2`@JXq?=c>}Mg1g9v^5rh$~=FSF2}{~ ze)Du7w#{7x=S?|KN8>PI1IDk+F15=SA#Z87Xiz}E*pbI{T6Yn`OEhF>2KKb1BDN|h z6-mi0+o>pTAk={Fl%Tojb3Mlizq^wl8${3!c7-jV5M`kdVZmGn648?#lq{^BxC(aE zh0cb93=4+3Z72$;U)w?v9mvxR&bYx@6fC~o0JVy_76tpw=H%N>GVAK2$5rTDm7GKTkvXefK=DOd3qxc%G z3CMCZMLB>8aEs%qzDPk3)!BcFXuhgzvR$;8w2Mf*r*o8FV}gJ{gQk48&psUsQ+=V? zVh>rF_bZg=IPzXF<<}><5uvIQS5?Y(8LNLk!&l!>5#*%ZREn{bbYHDEnApZGiwSGP-_^ zb9a5Iw@&y)SJSgWEl`A)B}<_>%+ufkQ8Mso&-E=3{4ewtFaAIF-nF}J8*3Py&-xX3 zm6_GJuSN5si{&%zd0i)MeI`kLY$sjM)2FM3NJv6W5i9}8(KJ23{Vd!_@B&F>oHU&k zeMl@3+}In~*f(r!;OeekV<&mzrhdd%-S(_PZbL+KSRYA})z^z0&HS)y|H#%v9#id? zuDJL+nf;1FmW#CfuzJqLMgy^zhve}tQxpq7jkCID<5K4Z0Bg_cth4dU-$BhK+evi3 z0Vuyq{w&150l6_sEQdzECI5c4@7=QHS?3$2TV9eVf6w^otX`35A3#3Jxf>w9oEhxc zkWVwVo5njAW~DZ`{wjM*wT)hsHOQS@#UB+-nm^u2oo;oTSF;9yqqAe6_ERGF5lR9^ zC%2i6r8RORHx`<*k(x?b+jBx~NC_ELr*A14%VUfE>58}PYr_ug5llxD8 zS-}j$Xm*+WD)Qpmdjfmx|Ix^++W+3wsgYQ&!JF>HV9>r!|^N-Cy^>P*j?pTD}s|!s1 z|C*vqmS|B(m)EN0t!I$I8Kem4`L9vA&fkiBJ`Cill;-KPGg9Zlw^zx zvI^=#mI+Ml0&OQ;8_f3LevM{f1(NuQ{uaw4o??s}c;InHiT5>FZTVa_AR!-o1OycD zCKS}84~T>`k$*_xZ)?>1z44kO1u37;t6U&GHAIAjn2V_WV6K&r$UzxW<4|DEI*UPH za3u%PiXl7n!8!k9^ut$fLq7*B+K!!B2z&GnL$XR^#8A1fKT+hjL!U3oGU^{nTp4&Z zxpRNXou~u+KYhCUGQq6VHqgHFAO5(O|KU$Qpa1wMp9cR=`*$gcsJ=T`pYI1bYiz+1 zZV-SVLNVN;2=H+{(9NsW3ux`-6%hKyo>5V;C5PXzb5uMX@ZO7>QvFiVW!eG8EzN z&ffv&|2=nHjsFeZ&-vdU<@0Ize}dKC$Mq8c8ofRV`pS_7IIG9XJD%u$4 zJ&HM>u*b9b)lzsIV}B>G1I%mjz5>(HsFs7-&ImTpZVmrX)AxP)uo=9ZlODYzo0;39 zv(HA>f7++f{#!E~)01CR%}V^9<)8N1f8()VtN%CrT>t6ge8lXy(V099CMwzWt`S>j34nl-IRgoa(7CQ~THG7bYq)d6U?lz)bvS^$jM6>Y_Cf#K zAAaZ;^^u;68hQP1&aeCY-~aBb3Q0CA($d2~T%m#HD9cdvY@Oj`aU*ZRz{%ork&yi7 z=WkKC7RShY01VUtJ(Pq<@64_s3zyH|rWulD_RSqzeWj>VD%8wBB;}?w$3u39uQtE*%|Oka=J2)OPEFPHIE#?hn+{+1Aj#yO*woT z&1$~4DAPx427jfw+%bFaF>(2v@x|T;eYsjb$PD(&w=JUIfIhe;`ZN!O9VRs#1E6tG zNFQ?&{L%)he4_-lp^jpc1WZY!$Nz-?oiN;fK2j1@nQr+mOX87SlqcaB8Kh3o^Tc#yZPAz{2CXgUIQM7xXTV$}Jf)(cO# z;N{xgx!9In%EOtpgS*mqcUGn0Rik)h`176%YA2TS)6T1uZH+-Ysy59{ZkVRd{d$J7 z1TjP%OiuEb&g5y!Vt{MiHP+^8zG1vRDOHTrtpchvN7IGRmW~r0k0{AaF3;4cHAF6I zkaeN*e{peJ9uR#&R7*Yfc&o9b)&88-Sg5^^w;J0k*g^BEd%QJQyFmS*1^52Ttzofs zTxtg|v`UxtMb>hO9kRf7EU8CZO&`b9kUc$urD5p8$1^mHCB4ti_}Kp6F8^QTX1=HI z|F;9`|Bby${(e)x04%e}Tb8r4|3>9bn`} zl*rFp7DZsrgz~8LBmnL79QfcBqXyQLL+3wIr9*cNq;8^aD%~?EMeCeQ@#GnnW$BEn z+-g#a-6Q!fip(laqKSD|juNv=NdJYlIjG{@davb9Yb_0rw_yqkI6J1$X!IdxP_h3r z65gW>h{S(zjTV@)Y^$~pfl$ogX@t@Yg^;1>46G>vwk9?RPTQnk4B&KKR(K*h5r9n?nD5}U=nesTe66i^%V!{=El7Z z)&z=1$)WrzMuZF{35ZY{ldUYYtu>wLPKrbox(UlI_TgFbM|Y!|!+c@G{Lh}*!#=y# zKV>8nXWHIV0PM5>gJI47pNv1(|NbbS_V&N2zi%Xm0C7EilP=aQBra4b6tGb_tJw`O z3(*zM0NAN#D}Ch`rTkqz5J<|~!pus5=EK~aBx{zg&C6!;tf*T1JmByY{RaAjez{4x zSg3~k73lv@|9|@Zh6saza&vM1;`!jezrCqI1C?TX8d{Okf!_|)3j;9@qF5zRc3e5f zkEMD(5gM|f1{z#+)a6Vv4j~@hi*UQXw~~x)YopZ zYiiXz5PODV*Q>ub)Vh9O~vHOB0__^5>5I-I4Y}dP}2t-a^>GDfSOl2pArLlgZw_HGD zjoI=mPaVC#BWp1nHNX7{B~b2K{|_)raI$#s2*958@43OSy8gXj{CWL*NETv~BClLv$Gs7%_E9``1b&}teOHY>MVZg}ATF7h$lW3rN8Sq{PMoTmJ{%HuM z&!3O>QS#qeqIiWxqQ~R+u|NJ>jsN)L&-=e0=ko+yLB>#)i0G>10PwIx37D;M9C4|X z!th?~VDz28GA`YYWeCk3Dx4DZ*e(0#P`r9&Um-j~h{-uJ$A*oyy6GQ8-0 z`TzBvfHyD`=ix4&J*Pb<&B(7PWIYE*2%gC18Tqy6Y-mU#bn;gaplbbJe1HDxyXP-{ z_|92HkKV`b^*{0badrR44~C!ZzmM{H0xp&?S)iCK{yEFO?)7^Agd#WLD`jmBP91OL z4EtaI^8|j~d-CK7_^I^Z=cn2lSzxwY&x9SqvNaONe(4EJQ!0|~V1`c2Hv`9UN|27g zQ{VOdf$I;v;ZcwG#j)cnw)dqvS_~q&V=T`o#~>leU2B6Yq37ItU$1=^D`! z-u~#QXQMf=(HwN9*{{$Xm^8cHXr7GQ(L5RNpxL+4?02TwtI+HlG`pwWXdX}7(LA2+ zpxLw0>~*HutGpmGzUjVhr%AUTsNa#>&CT>r`vHnht8-no~}8b<8I?Q zY{^4I!9${>ZxLj?9~eadCO}5Kn8+04kprt?x>;h?MQ#`}Yif33+JVQhAc!R)eO|yC+e0M>=-*Tb)!4CQ@ zN@&SYgWGy|^hF6&SE&Ih~c0l zhP`PwnujfE9`2&qB4~rof;OlK+Mpz8yVC5pQ!W$Vu;Zk36J{KkqX)1e83GhBhLZ&? zE<>D?O#cejDR_PJ4T#VNhsZ7%ED}5DEU|-%#12Xl+w103O#IW9gLk@vVJuQT=q%O! z+9ENfy4NVxzk7Wt<|{$$fn@ixth^-FI}DGUSkDz66ndKyib|#Xx&GrF39xQU26XM# zjc;3Ye&$Vu0A`Ck?5l`w$vCc^aeUii@jEXTzp_~T z@?!BT0w5ycdW8}uQyWRfV61MPUBOh?2jZ>^%s>h=io{kw=P}tv49M6!Y=ZQFj6HwH zfLKrA%m zj7wyDb+Q{#ah-89Dz0;wS>J?8*+O-lv588z;NSSPUEpSXY7gAFHe=T9Y|Oe9W7aJh zvt4PPOxn>rne3q1V$8aojaj#1%(^9G_F$SDVhiG@BQ*x?#P4`w7r(B}xOF=lw{Asm zyCvh+omRx}9KQuISqQI7rcrSc$1O=5?;_EnR^85O)vc&ix1?6xZb5_buqDmIT{K&? zs@qwsx)mkjmb7ZeaN&5^E>JQa+5;u7O@p{yHOSQQCl#8N2I1;s;7^+rr&f^MM1aR2 zLkZdNaS+fMp2g@`9Rk*eh~!B4Ed`rz6>J>s#*yF;I*&w2mvTtvNOW^R#$HPW=2;aO zN6MH2W2r1C!>{h5(E% zQ54N&C1@@@Wz}FwZ@W#E(b&4F!jZGl+tC`BI=)w-*Kefv&^fN#M{+1~ziTvZ7wH>~ zt&u*Cylp%>S_)IgcPr!Jnd8yTQWym-X%2SL+-xcE2VH6QrWKk^OTp_FxgUA$EW(jz zwFo(a7Mc&-pKGG|v`n)%ZKPQ-vNnt;Ss@VNxhS#9#4SN!oyA{JvFi1m)cP6#D>HVB-+nN&zRHA%8=M$|Th#q_mQ^&@wOnD%TYo!8l<^C~8tXPR_wRZO#N zs}j~Bph#3hMTK>{$jCYs6KLEK%QA=)D?v7U&FgHhc@=xj8#fYUpFBQm!_#()Zg{$D z(b|{0NOR>tH!%l>@GY^N89p<5D zno6bL4a7z@#8za30F2{eZye+WrbXiQ?Zw5l#I|J!U?@TWU#d%4n&HC?fpWI>ruQWX zV+50RDz9k4V&Td{RPx$lka7nVf*EGLFTrfRN)^4mFF}S_h8GKzsh>b5&-GfTVBF5f zACAYS$5R2;GI47t61S|t+S!%EVXy;OO9y`FPj&%oiJ4!*OwCnEehV&)P)bG0J7>Ga zGR)*|8F_H5Ja01(y-wy~zPKwcf@hkD4QuETIqOkI#b!VrxXWl8m5L+bnMR}tu{EP( zGwnKCb``^JT1BHgIqk*IhZl*DC_OBLZZkkT*`NHyis@-up6&sbXLpHaA<$-Vb~ZRG z3cWBly+L4&{yc`1wGe1C&N|y>71L~F5a?I;Jz)F*w^U_VLT*XJl}ty=P?#Z3I+=qI zWo$rIc|elrL6JkzZqs?_TQ{AjmYuL^*Nw2LQwe(w&7r8e7BXd8Srgg;jB#?0tnQyJ zXw^MtRmL|k@wG-Q%Dfqzwo9}NPOXV{Q_G&!wCk4Dw5nSCMgrA@D1lxrv;r2K3uS2q z6zROsc&n&yXK4q!0eWs-|6cs!prZ>oyXo z_o*&dX^ce9iwMS0yh>v{$Duf!Nx?iLEAWjxSuRO$x#Jwzcbrcxb9>r#Zcoc|ds?1b zuO@XV;f4o!kUo#Be1Ve%zzLuz+u+bB$7`XWdGb!XPTr(Ed8g&ctL5Yu*oSM%$g0>! zl*I|TnoyKbM@?T#!8EZ7rio?xCS9j*Ql7ra?&;I1=z?v{d~}(N^%ACF36m&R6RK2- z7=xCl#sd4Pv5AENCS4g|T+R-fSQsD|Po_U!-+(UXu1VVgm?ibd>{k>rs)nWI%C;w3 zj4k%mxT`%iF56S%vOQI04V);eDb2`?`*bnfiVk1{~Fl%bU+e|Ky# zhQ?iup>f$58kdYA`}R;p`;1y@pOIDjj4jsFxU2OvE?ZCIlJ(?SPv}($9JVuOgQ3-& z9b2rYaaZeUT$a$|lJ(>r7_A6e9*qm^N8`p8DLn2fg~w$nJT6J$g21vAmTAIz?^bT# zY)HIbp)iJcl~V{+VBI*m)DG;?Eoh@9+bi1IXD;Wq^(#Gd4UGzY@=sBjW zrsA5%vU&e#)HO$UR93FwTS&?@xQc6Mta8E{9utRJ>?sZ=p4DgB1Q5GUoLNZkDeV*q0eDMeE6ix2_=OG25b{A7-e9EWyF!9TUe zZEZCsI+vIjR>#3@90$E}al%A>J{31XS8p!l^z(1q@2|=OV-5t{riiNHXes^d2gGgX zsXHI14l21!!#(419z}ZkRoFq?kp?M%;01xvH!y}th%#`_$3>Cf&II)BkdTnC>LroK%QBHHkcM!^v-%n(5n9GXqJCdrv79O3E|w+Jr~WqgFjlVCC*j^${y+=2AVITgE4 zKKVh*B^B&iQq4AY&^b3NsN`k^W^UH5p{^{cpd~*AyZEWu$_?H(H_NRMIy4D&E6Yk= zeI_HfTw9i|Fc8+dOe{34U!gsWR6>#fc@2RWp_a#Oefx3Spq$iI8ljFxbl`Y?Wpn~# zbQ*I0uVg97!SgW2DMcWK83X?jDUMZBOtrB64Pw32OV>##GBQH=QR_fY%{LV^6O;uqLTWpMijSJ<*cc4PHZW*Q7Bm8 z4NBxzlGkz@#j|gt1hy=ypko#le{)(H9@iY6NoB78pEYG5&Bz8v2&lT^lK61BA`zHF zEVt9(nvoP`D@>`-{$eCX?K~Q9Wc6qQO9EHWHGwN|DhBM-9EN(lntOH|m~ok+*g|?V zEJJV=;{<_d2G&_j0bE#9x&uo_RM0ges*;Q!7#UHDie@xyR%B-*vSLF{8V569ayn#S zXtQ+|t0NxzxTn|h;Hzgp_!?Lup+VP3Xr-K1;Ft!Z{rHZ(D4y3c;_ulb{zht5RPpa7e z&VHR+@#|c}uXCp|!PkOH^LlYRJ2h^_sc{XbW)CXO)8lqFx!tnK?HVTcZcLg@Ubmac ztKt$~*>Z6UyO-l~YQ?45aCN&Hu5Q_Ibqm9lqcOIk(QLT7T@BYt{VTUHTz8|fG6PwzdbXL2QirSr2)vo=rkdliwZMXkC zwQWC7Z0dZ{S)ETR>U>gF=bq(w#skjKVhythpkxC!Fr#3B7?5eOjVU9tD;xHmmallz ztzd61;94DsWPLBs{=K<+rSb)-yfg0sfrunuFtK6qbc@&#AZrH5TwT^=C8)vhVzGB7UG1Go+1{B{?45>5lN%MAG^u9p z*zj#Kj3!+Tqeaa`yHrc83UIDR6( z%4N)@QJRquQL5@_N0@TnkIXX&(@Cq!KGTV%u+PL|GfukNjFYm>IH}l-2L=bH?a~9L zGCQDLl^G{H4@=9PcsZEu@-e0|9YgeXxk@v#5gAV6F9f1QPAp#{>Rx4$GEBD#gKx2# zy;j+NQ(Lm%#A0esx|-Vj#fsrjvK#6NE<(zQBJeVRyn!*{fA{^xHCW*+Q&T%? zb$DhvI<4-OD$yFP(-?=Gb+jbX7e|YucomDzHhea-q`Os89=?)I;#QgTB_~9j%aX5D zhK{T=ZhDsP2NCaIqdAm^?Y>l7+p0Wf47XhSGolq{UTjD%Gs+DEiX#+qBIJCuN)MUZ zF0z_fe4I&FA7@hbaV8ZXr#_gX;y72N+!BH!t?~-8WnQO6>eo4rkw^ilAXeXWMlceG z#dGZ}2BV!M7zK^BF|u`XPG6BkT+7UeA%m*vu1p`S6q(DFiD~Cx*e=4FSiHVTSFdke zxeRAg@%V~r#U`6xBg(RM$YjwA!R+Gh8!ju21leM!3RaG=)_U#Eb4_i>xyH5|b;g}< z)ESHWC5**CHm=mE3`?$}NX9tr`SIcVQ#ycbup}y7LJkuryj?+$sjbSf!m^q2t|=Ds zRkuWXQ1)kBYt2qYBSVxGsY_U9{7&0d9+}z-k0=DKRCk~7X_aWpgqJG>tW$N89L6HN zP|D|0*QAIVFfe3m7{^=AB=TmkX}be|Q*qw!&%QDBKkFms`{erh`LmbLKg8v~`|tnu zMt<%7U)K#j-~anDK2N};a)fT1OJRh$(RcN~va+Z2=6I7;QL;3j$+~;|y_8_3Zk;94_I&wY>I;i!|En z{cAl#S%Mg%XW;JZuRO;aJMO@}6HT8PGQQV)2d+^{C}t$vf_Ffq)V%|5P{wU`@UHi6 zV0_+{{^NfMh?n`HH9?0Mre056yN)S<;CmFWzza1j@(gG1$Mfq~m#@A%1GnE_-hhkm z&#!O6p%Ur#^L>dFA)Y7YaAh32<$>iJ0x42tYET+@yY)y-nij!{KI#@6Yre3 z-r$E6B?CVFCr4n8Gs>La0NfxX$o%O?e2;CAk9q@eQK0k;(~x9Q(K?bpIE%#zdqb~o zzyI-;W&9=HC4k^3p+4Fungl(ZgiAswI_eDugWh=@gKNB4GRh4{L+A4+j zFQ%WA{9mGYHBb)zqbq@(^51jai94yt|G=M&KFj})@!>K|W&?A{GI%3cpw~0_8dH#F zcm*>YZ-o$!xDXa*-&XMdtMeO`HO!Z{)BB!0pbg57!2?ofTxDAr$4dTFKp9LTm_@Qz z*^>h<6Djud`?xp+yb@lMc}15_V3rIEa3Umw+#%3HQHV^jwmAhN(mvZ3dWpXvkYOax z|D`ZNMJ)pn&m;>RO0A$r<{kJK;?n(gn{w%{N00v{W8J2#uM7D>NeA@a8Qx-X-6(jc zqNCs)xcmK&JMa$Nh>JNwo12teLPYi^Qnn%SExAnaPF{Xlne(DbfaLtze<9r zvxQh|)BzVHp*TXt^_PRenxbqFK?VmA&ct99CtMkbi7X)|*Odfc8e|Pf2KuOl1R3v( zz&kJ_giq$(9L5xJ%%7`J;5td_Q&_MzPSkCFk+q9W(>fF9@wWga8=R3uh@1_~Fz=J9 zOaF@Q#G12$e<3Fzp9eAU+?FT+s{4jfBtbpkIOcpNJ!D2yq%WT)6;d-&dPN)jp5x&1EJ3k2U`2C~8ko^3__0#%C(az!G- zw>LN6^HpQ-*^#I0rKqJW;}G6~yMCV!;Wc~^5Hz#{A$Xb1eb zLYUu z1a7t41JK)4?5ttoF3pf!hzZMO76NxT`X!_AZijGnaI(k{r3b7tu;jBE!Cw)`7a+sQk0-b9S$-D8WU#H zrx{r>h~r0Kl^m48D!F|WlZCXC=@N^J1ca#`lY88rO>{>!>m@f=a#Wg)l}2D~ zc+P;oo97JZ-FPnVsmgOEbnNt1(FzT%kV4FBfpRjx}uDZ@X{^&4!`+oySOu@cgqf} ztuN)=8~usVFl+_MET#4^ins|Z8DNIyoF`Z&S~4Pgmn#dhr6ZWLh%HyvAYW~&&PWa2 zW}(wwFo>+Tb~1sljRVDj!t{}Z*oViJTXzlOqwsi8!XYYT!wP3N19P~moXA~(sua7( zxO>1bjH$}0NO-S`Uf$J>GIpPewIc4#7{DX&LlWy-xO8bafGI!;Sud7VM5+lIJB1_H zTe@>2M5HOM!76vfYD-3E`qfNq-T`m!fHyG4k>+&aQ|XtEfu0eP8EMX<)A<}Hm~9(Y z!80_+3HQ!)laM4-+(E`bwidyhpMJ{F{O4jf;67i24kkiEpM)d{QOf8E4VNfd$2eIG z&_;&UPPjX}NCqj11__DK$rIhz04C7@CJYbsFG@(qDNfL(U_}de$tF9Qs{rDp>o~q5 zF%B!f@#Xv#VOP@CtBv`&>_V;x4gsVJLiolz>lx-pCC-ZpbgwVM`PV*o#(dm=koNi}*(kM=NBk-TSNfeUSg7RBz3h>I|2xej$W+Zn-r-BQ`I zQnSvsh0SYh8Qi07z89~Q(H9cL7YZk*jH@!AoFW~(Y5U^bc*_09$cS$0vi*%&RvPL5d#(RB33W|JndI+-W_JumSFXV$gl(US)G0OG~C0EnHY@)2) zqAux)F0(`tJBc7#k%S_)qnAc2O}Mc}tAh-Hbo=W2*5T!-7B^pXK~27W z$T+-TKN%8f-kb<-le`0W9`EDTTGaj}a}XhlxtE!eh}K`;V2VldJ*HgJzQ8LHqE~#K1+dOD$3qIKP&i7AG`ek~QN_rS=%Vdwt25bvdPhqa%}8%fjKOpG*4KsPQY> zH7VuS3NJOyFfqjn?;NQcnXs;OC~m_h>qP7Ty}tP-Pp38XyV&Emt9JR=(CB70VnJL& zB^i|==61=MoExt?*G-mNmEC|9+=2{I5^oSlXiUicI@S9TB$1~~jPMCXY@I6ZjS|{m@v61@ zOs97+0{R#6nlhAqi!;jl0MA7{=T*M>0fapumQktckC-jLmo1y#;z~_oBGsC5Dn96fVe5wbk;mH#j@8^Cn zTO$4Qk)p9F9Q6|7q#17q+}6yq8*!RU%Zf8_egtm+`wYCky#U`FfvfYIn;)N@fiHgl z9XQvj+P_Gy{Ns-=z(vtOd{DCaHX|$b4FJc{b0L1OsdxSGHjNwT&`(A7k9xnk&0B`D z1jd&ML)jdLsP13BrbwkXVRZ}`GA2@U#0G=Nq>$?#YaotJ$>eMM0cPk7h`grRHkI|o z?@wvY1R9SFo;SI-!WHEYa3OfKDOzlzaG^QdY6ryuS9$7}7HJYiF0XihikAr1@gif$;F&7ljtD_~K2(`=K!SPedu-q3LY@$E)m z%2zU<#3Nxj$!JgB3d#}SOo|}gf)t1M+C86(v%Y%&m%Ho70IyP#F_~%^;(q=nG@$^BXUQC_)XMGVkexJqN>#3Y2VSjSw(Y1v+lK&eF{v~?37=G}?S zas5YAj?$IbHGCBC_1(=Yp%JB25?mf}yEY*Va9yNNuzdX$@EmVAa1ZH7r*+u`zE<3l z^L1vIXq}ffP{IgPxvkrxS8*8i;9f=RgL_q9in7@|Y#p<$OefRH=y@l(Bvj{)sOi^; z14q+34%SdugM3tN4;788W-+5}NDcKbEM#gV?=vJz;e2U|tmoW>+%u!Kj^sg#ZG)b9 z$qg&1|7S~y#up@3?+~n3nJ_O$owp7Whuk`Kq(lq9>OO=Mv=i0Pf zD|Njy?qastXSuWtl$4b*W(Ob7s5IVlE~C`iejwv^iK-BUb)^za8Ol~Tkqk<*2xa?^ zaH#9?c9Nw|XB16zc1E^Nj>TmHvhG3N;#eHzOcvZ?!hE`!?nkhk>^a7B6mG+6s?r~K zHM6v6sVA57VP)G)U%zQFboFE7Dv|oOscPh`v!*COSPm?TwFDDsrpwTXuo3y9RATn^ z^@|(cbWM?wFUbjb_Kh3_ozuB<&$mbzweR?r09p5Y&*KNUrM0ciN@i)*S1QA9vB|4n z+}B~fliKF4U|*&;cSr6h3WkA;qDkmQ!(fgg?=+f4o;R7yCSw%N#`7?kj6E-yg+nh2 zh7t4wHypY?9G;Fw`w-F|oN}-8q1@v`m76z7q8d;KY5%M&P`PF#nXU_@8i_fA!F+D5v7gGPL9|oup&IyT3U%R?^Uy(@P z=Z|GgBApTR=&3-7NK}xR$S8|SV%oXL56CSu!E{UM(AiXBjEg`*b-91^na zX47zZIt$#xu+q!Fv`eyY@tcj`&j>j%5hKr?H+oh%2sUi>In^qz^$cBV1MNsH_L5YL z7)_I|jUedSo4o-RUmeyD6uB;%Ajr+x6egh! zv^qw15ktIc@^CKaBB1*K6IEhER2@rzei4ZK+>Z+fNCnUH=bXG!G{R7O4G7Ii7NVN- zEER)zrZcBRRaF69bo(Q>KNER!Nf_HYmY->t%+jINVdhg6=jl27XG!eG*7DKSF#afv z{Zh8KI^dvO%o2>4>~h1x%+CiK~wl^Mf0 zLuQ?WNA`O4sRbOI1^7LZW1a<^36@A8bV4i84flFrL6a#vl{JhWg~&!R~;p-!Kvi*nJtmOpb= z+%|oz{`~&x7^Iu<7@$?kw$E^OtYR(4MRwtFQ9F|Bd%0WLjOPlbI=*eQBc7|rWG+tL z>x9)+ep+=W)c+jmX%Zy|s;W0poFnvUYa74U&1AMNaXDe;zHQQ zuB0+PnE7u+^N+X&3jA_LRXBW*1<}ymr@bx=gg=GlVW9KDSBcSAd9maS^5{!OTBxlI zO;!D-*`6rFbClI6t8pZSu%n=mT{1ptn`Tf?)F(8J0@Y7;66NLi_H^1$ zZ0#y^KmEn45&e`WK3iK0gM5PXo~@I=$ck6UeyUUd-Y5PZ@t9spqVv7S!W+(L>(XWA z_d6c=Hh{f2{493ut@g*P4G=f>k~Vk0_viFGZfN(fL;wGb) zn64lTm;K|uxZucqPyFzjqD*}^?>G_dinER7d^L?6(Aa6NxXKC07>sQtx`e6uhq*v? zBB*+=zK2r)-L-$L&exZZ70Q7XaE;0n0v=_H4AI|e1q8L!yDD1jOsgv(eZcv#Nq2oEO&b#r@Y>Xl_f~Uc3I3Gve zXdDFL^mI0y&QHBy7EDLp6a{_|%qBh>MZV|5$#_0N{&W^b-ef;kdCpCSiCEdY66-Hy zEL*n)VZNnWoRVT(CyP_3s=}N~-ctFZGKbp676$~y8Kn0@JIj?X62NlBZu}nO4N4HD z1MU%G@s}tTyG{oZ2OUKhUmV@shS>}KT(ocE)iNAM@AWmfvO>II>Eg?P5>^=?m@b9s zqGoKXZ|&1iuSDlf-R&*lD>HgaL^Q#vo`C6}^ramD!S}bfSL#ijf1pbm2p-_iPxwDK z`Kj0=<0yxIr>R$3*+!|>vlq|j7|APe`CQW?s#h-+RT?fw=hw(2ClrA@IX7qGu=t(2 z?M6ahk~pFomOdP-#B~K~6CKs9=Kk%)6(7I+4sbbqqM4{=oDil0clo|uZEkV~wvEs= ziXc9OIde#l%bhvc8haKU9>kvorS?JixExw^`^YR>9z&jsPTw&qKzb7oxu;PWMP4)x-RW#TpAM&CFbUCc zKAeokvnfKZ7x?qj=yW&^yy@w94x#S{qp=Sg61^)3X>&81K`YhAz!va2)jn_?5eMKTjMw^DGMteOQd??~7RN9Q^WD!3MR=DfhUsp% zT)h7gJ@O1uvd+R<881wtpjIlCtMAIn$#x)a4!fczW;}S}<9?LCxv0Ew53X7bI z4W?Mtw}8oZMxw3kT+gDBx}XY0&vC4D=#J{rcfa>VJ(H^pZ*Ytj=s68xEI3ewxsLm0 zEjB*0^`dUa{Zzjn<*(^2+G|4Cw|P8T*QYlxE0@2u3DY&4F4Z*x4l1LPmtxuz4bI!W zUlA2u?Z8Cz!xm8~b+XTBt;^(mFsq<&`Yl}H7&p`$;5H;q!CXHVTwmGN;%}e)Ny&-0uCk6 zk9@AfI%o3YjDyz2jag^|Cv%dmq&BLp3<f?phWCdROL^HAQxSOh|;TEQLo( zxhlGy%m~x6;st@xH!y}th%zCoU+H#w3e@S?_pKL}m-XZD#L-nw#L-ULYz0+r^}r;u zgzZikEvsJ$xO+-pSSw#BBy5#0Bqv(SUf4+>jD!MtLwIn%Sr+NxP<0zeU#)Cv=R4l^ z?pXeR!~eLwxVjV5efRp=)tv*R6V887?sy6x5&*&N#Z}G-{OJO*Vx@|TfqebEzJ4K| zigj)5_v|8y!EAxpKF%$!Uo+ZQ;vO;vUlR3V0OlE4Nz=9{FDae~5C5(JcqdK+=^H_m ze{b@a7Eda7trr*67SD zpBV_YT!TApbODw{IB6QnXS&QzF_uO?kG$ZNL?BxyvizKaRJw&gLJ-sJEHW6PE0kf8 z)j*QSEDP`6<(rYa6n%ay(Ret3DL&!KJ|-|4*7h1$Lol|{^!?^|U=Kopk?6;Rd2F(WC7$zpqxa;Nwr zuWV9BPhX5=d!x(kNP6tVkjZh=;0IK|9~8w_^j7&K2ME>U9J{$UJ zNQH4+$9H|toqEH(5X}Ul;r!I~PJ`3YDT>CyWI7wqPv?{I{1nZHb8j}B3}?RY&raRZ z1i4dh2Hn{Zjpk#2I-TytOm0y0&f^$d|K<&S*B=gD&kz3Qdj7;4{|&g0k4pWs zrVM6(bKkqKDsg|2&tNd>N#b5O)+s2445n_FC@^!EG_&8SV9Yy?5Xh0WUEv2_-J`)=8wx{quEwHrV%hCweS&h3=87 nA+gVFK5E3~&z`r>pU + +## Helm-Chart + +##### Scan Results + +#### Chart Object: traefik/templates/common.yaml + + + +| Type | Misconfiguration ID | Check | Severity | Explaination | Links | +|:----------------|:------------------:|:-----------:|:------------------:|-----------------------------------------|-----------------------------------------| +| Kubernetes Security Check | KSV001 | Process can elevate its own privileges | MEDIUM |

Expand... A program inside the container can elevate its own privileges and run as root, which might give the program control over the container and node.

Container 'inotify' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.allowPrivilegeEscalation' to false
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv001
| +| Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| +| Kubernetes Security Check | KSV003 | Default capabilities not dropped | LOW |
Expand... The container should drop all default capabilities and add only those that are needed for its execution.

Container 'inotify' of Deployment 'RELEASE-NAME-traefik' should add 'ALL' to 'securityContext.capabilities.drop'
|
Expand...https://kubesec.io/basics/containers-securitycontext-capabilities-drop-index-all/
https://avd.aquasec.com/appshield/ksv003
| +| Kubernetes Security Check | KSV011 | CPU not limited | LOW |
Expand... Enforcing CPU limits prevents DoS via resource exhaustion.

Container 'inotify' of Deployment 'RELEASE-NAME-traefik' should set 'resources.limits.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv011
| +| Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| +| Kubernetes Security Check | KSV012 | Runs as root user | MEDIUM |
Expand... 'runAsNonRoot' forces the running image to run as a non-root user to ensure least privileges.

Container 'inotify' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsNonRoot' to true
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv012
| +| Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| +| Kubernetes Security Check | KSV014 | Root file system is not read-only | LOW |
Expand... An immutable root file system prevents applications from writing to their local disk. This can limit intrusions, as attackers will not be able to tamper with the file system or write foreign executables to disk.

Container 'inotify' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.readOnlyRootFilesystem' to true
|
Expand...https://kubesec.io/basics/containers-securitycontext-readonlyrootfilesystem-true/
https://avd.aquasec.com/appshield/ksv014
| +| Kubernetes Security Check | KSV015 | CPU requests not specified | LOW |
Expand... When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'inotify' of Deployment 'RELEASE-NAME-traefik' should set 'resources.requests.cpu'
|
Expand...https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits
https://avd.aquasec.com/appshield/ksv015
| +| Kubernetes Security Check | KSV016 | Memory requests not specified | LOW |
Expand... When containers have memory requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention.

Container 'inotify' of Deployment 'RELEASE-NAME-traefik' should set 'resources.requests.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv016
| +| Kubernetes Security Check | KSV017 | Privileged container | HIGH |
Expand... Privileged containers share namespaces with the host system and do not offer any security. They should be used exclusively for system containers that require high privileges.

Container 'inotify' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.privileged' to false
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline
https://avd.aquasec.com/appshield/ksv017
| +| Kubernetes Security Check | KSV018 | Memory not limited | LOW |
Expand... Enforcing memory limits prevents DoS via resource exhaustion.

Container 'inotify' of Deployment 'RELEASE-NAME-traefik' should set 'resources.limits.memory'
|
Expand...https://kubesec.io/basics/containers-resources-limits-memory/
https://avd.aquasec.com/appshield/ksv018
| +| Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| +| Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| +| Kubernetes Security Check | KSV020 | Runs with low user ID | MEDIUM |
Expand... Force the container to run with user ID > 10000 to avoid conflicts with the host’s user table.

Container 'inotify' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsUser' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv020
| +| Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'RELEASE-NAME-traefik' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'autopermissions' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV021 | Runs with low group ID | MEDIUM |
Expand... Force the container to run with group ID > 10000 to avoid conflicts with the host’s user table.

Container 'inotify' of Deployment 'RELEASE-NAME-traefik' should set 'securityContext.runAsGroup' > 10000
|
Expand...https://kubesec.io/basics/containers-securitycontext-runasuser/
https://avd.aquasec.com/appshield/ksv021
| +| Kubernetes Security Check | KSV029 | A root primary or supplementary GID set | LOW |
Expand... Containers should be forbidden from running with a root primary or supplementary GID.

Deployment 'RELEASE-NAME-traefik' should set 'spec.securityContext.runAsGroup', 'spec.securityContext.supplementalGroups[*]' and 'spec.securityContext.fsGroup' to integer greater than 0
|
Expand...https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted
https://avd.aquasec.com/appshield/ksv029
| + + +| No Misconfigurations found | +|:---------------------------------| + + + + +| No Misconfigurations found | +|:---------------------------------| + + + + +| No Misconfigurations found | +|:---------------------------------| + + + + +| No Misconfigurations found | +|:---------------------------------| + + + +## Containers + +##### Detected Containers + + tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c + tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c + tccr.io/truecharts/traefik:v2.6.0@sha256:cc9fc0d653690523166b8a32b6bb6e1c609283b7c1010fe32cc4d6b43feca3ac + +##### Scan Results + + +#### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) + + +**alpine** + + +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| busybox | CVE-2021-42378 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42378
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42379 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42379
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42380 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42380
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42381 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42381
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42382 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42382
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42383 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| +| busybox | CVE-2021-42384 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42384
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42385 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42385
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42386 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42386
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42374 | MEDIUM | 1.33.1-r3 | 1.33.1-r4 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42374
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| +| ssl_client | CVE-2021-42378 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42378
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42379 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42379
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42380 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42380
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42381 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42381
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42382 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42382
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42383 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| +| ssl_client | CVE-2021-42384 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42384
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42385 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42385
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42386 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42386
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42374 | MEDIUM | 1.33.1-r3 | 1.33.1-r4 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42374
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| + + +#### Container: tccr.io/truecharts/alpine:v3.14.2@sha256:4095394abbae907e94b1f2fd2e2de6c4f201a5b9704573243ca8eb16db8cdb7c (alpine 3.14.2) + + +**alpine** + + +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| busybox | CVE-2021-42378 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42378
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42379 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42379
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42380 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42380
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42381 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42381
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42382 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42382
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42383 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| +| busybox | CVE-2021-42384 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42384
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42385 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42385
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42386 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42386
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42374 | MEDIUM | 1.33.1-r3 | 1.33.1-r4 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42374
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| busybox | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| +| ssl_client | CVE-2021-42378 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42378
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42379 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42379
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42380 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42380
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42381 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42381
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42382 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42382
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42383 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| +| ssl_client | CVE-2021-42384 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42384
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42385 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42385
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42386 | HIGH | 1.33.1-r3 | 1.33.1-r6 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42386
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42374 | MEDIUM | 1.33.1-r3 | 1.33.1-r4 |
Expand...https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42374
https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
https://ubuntu.com/security/notices/USN-5179-1
| +| ssl_client | CVE-2021-42375 | MEDIUM | 1.33.1-r3 | 1.33.1-r5 |
Expand...https://jfrog.com/blog/unboxing-busybox-14-new-vulnerabilities-uncovered-by-claroty-and-jfrog/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T2TURBYYJGBMQTTN2DSOAIQGP7WCPGV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UQXGOGWBIYWOIVXJVRKHZR34UMEHQBXS/
https://security.netapp.com/advisory/ntap-20211223-0002/
| + + +#### Container: tccr.io/truecharts/traefik:v2.6.0@sha256:cc9fc0d653690523166b8a32b6bb6e1c609283b7c1010fe32cc4d6b43feca3ac (alpine 3.14.3) + + +**alpine** + + +| No Vulnerabilities found | +|:---------------------------------| + + + +**gobinary** + + +| Package | Vulnerability | Severity | Installed Version | Fixed Version | Links | +|:----------------|:------------------:|:-----------:|:------------------:|:-------------:|-----------------------------------------| +| github.com/containerd/containerd | CVE-2021-43816 | CRITICAL | v1.5.8 | 1.5.9 |
Expand...https://github.com/containerd/containerd/commit/a731039238c62be081eb8c31525b988415745eea
https://github.com/containerd/containerd/issues/6194
https://github.com/containerd/containerd/security/advisories/GHSA-mvff-h3cj-wj9c
https://github.com/dweomer/containerd/commit/f7f08f0e34fb97392b0d382e58916d6865100299
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD5GH7NMK5VJMA2Y5CYB5O5GTPYMWMLX/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MPDIZMI7ZPERSZE2XO265UCK5IWM7CID/
https://nvd.nist.gov/vuln/detail/CVE-2021-43816
| +| github.com/hashicorp/consul | CVE-2021-41805 | HIGH | v1.10.3 | 1.8.17, 1.9.11, 1.10.4 |
Expand...https://discuss.hashicorp.com/t/hcsec-2021-29-consul-enterprise-namespace-default-acls-allow-privilege-escalation/31871
https://nvd.nist.gov/vuln/detail/CVE-2021-41805
https://security.netapp.com/advisory/ntap-20211229-0007/
https://www.hashicorp.com/blog/category/consul
| +| github.com/opencontainers/image-spec | GMS-2021-101 | UNKNOWN | v1.0.1 | 1.0.2 |
Expand...https://github.com/advisories/GHSA-77vh-xpmg-72qh
https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m
https://github.com/opencontainers/image-spec/commit/693428a734f5bab1a84bd2f990d92ef1111cd60c
https://github.com/opencontainers/image-spec/releases/tag/v1.0.2
https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh
| +| golang.org/x/text | CVE-2021-38561 | UNKNOWN | v0.3.6 | 0.3.7 |
Expand...
| + diff --git a/core/traefik/10.0.57/templates/_args.tpl b/core/traefik/10.0.57/templates/_args.tpl new file mode 100644 index 00000000000..fd8f62c1442 --- /dev/null +++ b/core/traefik/10.0.57/templates/_args.tpl @@ -0,0 +1,146 @@ +{{/* Define the args */}} +{{- define "traefik.args" -}} +args: + {{/* merge all ports */}} + {{- $ports := dict }} + {{- range $.Values.service }} + {{- range $name, $value := .ports }} + {{- $_ := set $ports $name $value }} + {{- end }} + {{- end }} + {{/* start of actual arguments */}} + {{- with .Values.globalArguments }} + {{- range . }} + - {{ . | quote }} + {{- end }} + {{- end }} + {{- range $name, $config := $ports }} + {{- if $config }} + {{- if or ( eq $config.protocol "HTTP" ) ( eq $config.protocol "HTTPS" ) ( eq $config.protocol "TCP" ) }} + {{- $_ := set $config "protocol" "TCP" }} + {{- end }} + - "--entryPoints.{{$name}}.address=:{{ $config.port }}/{{ default "tcp" $config.protocol | lower }}" + {{- end }} + {{- end }} + - "--api.dashboard=true" + - "--ping=true" + {{- if .Values.metrics }} + {{- if .Values.metrics.datadog }} + - "--metrics.datadog=true" + - "--metrics.datadog.address={{ .Values.metrics.datadog.address }}" + {{- end }} + {{- if .Values.metrics.influxdb }} + - "--metrics.influxdb=true" + - "--metrics.influxdb.address={{ .Values.metrics.influxdb.address }}" + - "--metrics.influxdb.protocol={{ .Values.metrics.influxdb.protocol }}" + {{- end }} + {{- if .Values.metrics.prometheus }} + - "--metrics.prometheus=true" + - "--metrics.prometheus.entrypoint={{ .Values.metrics.prometheus.entryPoint }}" + {{- end }} + {{- if .Values.metrics.statsd }} + - "--metrics.statsd=true" + - "--metrics.statsd.address={{ .Values.metrics.statsd.address }}" + {{- end }} + {{- end }} + {{- if .Values.providers.kubernetesCRD.enabled }} + - "--providers.kubernetescrd" + {{- end }} + {{- if .Values.providers.kubernetesIngress.enabled }} + - "--providers.kubernetesingress" + {{- if .Values.providers.kubernetesIngress.publishedService.enabled }} + - "--providers.kubernetesingress.ingressendpoint.publishedservice={{ template "providers.kubernetesIngress.publishedServicePath" . }}" + {{- end }} + {{- if .Values.providers.kubernetesIngress.labelSelector }} + - "--providers.kubernetesingress.labelSelector={{ .Values.providers.kubernetesIngress.labelSelector }}" + {{- end }} + {{- end }} + {{- if and .Values.rbac.enabled .Values.rbac.namespaced }} + {{- if .Values.providers.kubernetesCRD.enabled }} + - "--providers.kubernetescrd.namespaces={{ template "providers.kubernetesCRD.namespaces" . }}" + {{- end }} + {{- if .Values.providers.kubernetesIngress.enabled }} + - "--providers.kubernetesingress.namespaces={{ template "providers.kubernetesIngress.namespaces" . }}" + {{- end }} + {{- end }} + {{- range $entrypoint, $config := $ports }} + {{- if $config.redirectTo }} + {{- $toPort := index $ports $config.redirectTo }} + - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.to=:{{ $toPort.port }}" + - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.scheme=https" + {{- else if $config.redirectPort }} + {{ if gt $config.redirectPort 0.0 }} + - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.to=:{{ $config.redirectPort }}" + - "--entrypoints.{{ $entrypoint }}.http.redirections.entryPoint.scheme=https" + {{- end }} + {{- end }} + {{- if or ( $config.tls ) ( eq $config.protocol "HTTPS" ) }} + {{- if or ( $config.tls.enabled ) ( eq $config.protocol "HTTPS" ) }} + - "--entrypoints.{{ $entrypoint }}.http.tls=true" + {{- if $config.tls.options }} + - "--entrypoints.{{ $entrypoint }}.http.tls.options={{ $config.tls.options }}" + {{- end }} + {{- if $config.tls.certResolver }} + - "--entrypoints.{{ $entrypoint }}.http.tls.certResolver={{ $config.tls.certResolver }}" + {{- end }} + {{- if $config.tls.domains }} + {{- range $index, $domain := $config.tls.domains }} + {{- if $domain.main }} + - "--entrypoints.{{ $entrypoint }}.http.tls.domains[{{ $index }}].main={{ $domain.main }}" + {{- end }} + {{- if $domain.sans }} + - "--entrypoints.{{ $entrypoint }}.http.tls.domains[{{ $index }}].sans={{ join "," $domain.sans }}" + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- end }} + {{- with .Values.logs }} + {{- if .general.format }} + - "--log.format={{ .general.format }}" + {{- end }} + {{- if ne .general.level "ERROR" }} + - "--log.level={{ .general.level | upper }}" + {{- end }} + {{- if .access.enabled }} + - "--accesslog=true" + {{- if .access.format }} + - "--accesslog.format={{ .access.format }}" + {{- end }} + {{- if .access.bufferingsize }} + - "--accesslog.bufferingsize={{ .access.bufferingsize }}" + {{- end }} + {{- if .access.filters }} + {{- if .access.filters.statuscodes }} + - "--accesslog.filters.statuscodes={{ .access.filters.statuscodes }}" + {{- end }} + {{- if .access.filters.retryattempts }} + - "--accesslog.filters.retryattempts" + {{- end }} + {{- if .access.filters.minduration }} + - "--accesslog.filters.minduration={{ .access.filters.minduration }}" + {{- end }} + {{- end }} + - "--accesslog.fields.defaultmode={{ .access.fields.general.defaultmode }}" + {{- range $fieldname, $fieldaction := .access.fields.general.names }} + - "--accesslog.fields.names.{{ $fieldname }}={{ $fieldaction }}" + {{- end }} + - "--accesslog.fields.headers.defaultmode={{ .access.fields.headers.defaultmode }}" + {{- range $fieldname, $fieldaction := .access.fields.headers.names }} + - "--accesslog.fields.headers.names.{{ $fieldname }}={{ $fieldaction }}" + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.pilot.enabled }} + - "--pilot.token={{ .Values.pilot.token }}" + {{- end }} + {{- if hasKey .Values.pilot "dashboard" }} + - "--pilot.dashboard={{ .Values.pilot.dashboard }}" + {{- end }} + {{- with .Values.additionalArguments }} + {{- range . }} + - {{ . | quote }} + {{- end }} + {{- end }} +{{- end -}} diff --git a/core/traefik/10.0.57/templates/_helpers.tpl b/core/traefik/10.0.57/templates/_helpers.tpl new file mode 100644 index 00000000000..8c6c4ac96bc --- /dev/null +++ b/core/traefik/10.0.57/templates/_helpers.tpl @@ -0,0 +1,22 @@ +{{/* +Construct the path for the providers.kubernetesingress.ingressendpoint.publishedservice. +By convention this will simply use the / to match the name of the +service generated. +Users can provide an override for an explicit service they want bound via `.Values.providers.kubernetesIngress.publishedService.pathOverride` +*/}} +{{- define "providers.kubernetesIngress.publishedServicePath" -}} +{{- $fullName := include "common.names.fullname" . -}} +{{- $defServiceName := printf "%s/%s-tcp" .Release.Namespace $fullName -}} +{{- $servicePath := default $defServiceName .Values.providers.kubernetesIngress.publishedService.pathOverride }} +{{- print $servicePath | trimSuffix "-" -}} +{{- end -}} + +{{/* +Construct a comma-separated list of whitelisted namespaces +*/}} +{{- define "providers.kubernetesIngress.namespaces" -}} +{{- default .Release.Namespace (join "," .Values.providers.kubernetesIngress.namespaces) }} +{{- end -}} +{{- define "providers.kubernetesCRD.namespaces" -}} +{{- default .Release.Namespace (join "," .Values.providers.kubernetesCRD.namespaces) }} +{{- end -}} diff --git a/core/traefik/10.0.57/templates/_ingressclass.tpl b/core/traefik/10.0.57/templates/_ingressclass.tpl new file mode 100644 index 00000000000..681ecc6fd0c --- /dev/null +++ b/core/traefik/10.0.57/templates/_ingressclass.tpl @@ -0,0 +1,24 @@ +{{/* Define the ingressClass */}} +{{- define "traefik.ingressClass" -}} +--- +{{ if .Values.ingressClass.enabled }} + {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1/IngressClass" }} +apiVersion: networking.k8s.io/v1 + {{- else if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1/IngressClass" }} +apiVersion: networking.k8s.io/v1beta1 + {{- else if or (eq .Values.ingressClass.fallbackApiVersion "v1beta1") (eq .Values.ingressClass.fallbackApiVersion "v1") }} +apiVersion: {{ printf "networking.k8s.io/%s" .Values.ingressClass.fallbackApiVersion }} + {{- else }} + {{- fail "\n\n ERROR: You must have at least networking.k8s.io/v1beta1 to use ingressClass" }} + {{- end }} +kind: IngressClass +metadata: + annotations: + ingressclass.kubernetes.io/is-default-class: {{ .Values.ingressClass.isDefaultClass | quote }} + labels: + {{- include "common.labels" . | nindent 4 }} + name: {{ .Release.Name }} +spec: + controller: traefik.io/ingress-controller +{{- end }} +{{- end }} diff --git a/core/traefik/10.0.57/templates/_ingressroute.tpl b/core/traefik/10.0.57/templates/_ingressroute.tpl new file mode 100644 index 00000000000..ac0deaff2a3 --- /dev/null +++ b/core/traefik/10.0.57/templates/_ingressroute.tpl @@ -0,0 +1,25 @@ +{{/* Define the ingressRoute */}} +{{- define "traefik.ingressRoute" -}} +{{ if .Values.ingressRoute.dashboard.enabled }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + name: {{ include "common.names.fullname" . }}-dashboard + annotations: + {{- with .Values.ingressRoute.dashboard.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "common.labels" . | nindent 4 }} +spec: + entryPoints: + - main + routes: + - match: PathPrefix(`/dashboard`) || PathPrefix(`/api`) + kind: Rule + services: + - name: api@internal + kind: TraefikService +{{ end }} +{{- end -}} diff --git a/core/traefik/10.0.57/templates/_portalhook.tpl b/core/traefik/10.0.57/templates/_portalhook.tpl new file mode 100644 index 00000000000..e3586c5d4e9 --- /dev/null +++ b/core/traefik/10.0.57/templates/_portalhook.tpl @@ -0,0 +1,26 @@ +{{/* Define the portalHook */}} +{{- define "traefik.portalhook" -}} +{{- if .Values.portalhook.enabled }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +--- + +apiVersion: v1 +kind: ConfigMap +metadata: + name: portalhook + namespace: {{ $namespace }} +data: + {{- $ports := dict }} + {{- range $.Values.service }} + {{- range $name, $value := .ports }} + {{- $_ := set $ports $name $value }} + {{- end }} + {{- end }} + {{- range $name, $value := $ports }} + {{ $name }}: {{ $value.port | quote }} + {{- end }} +{{- end }} +{{- end -}} diff --git a/core/traefik/10.0.57/templates/_tlsoptions.tpl b/core/traefik/10.0.57/templates/_tlsoptions.tpl new file mode 100644 index 00000000000..3e5aad3bee9 --- /dev/null +++ b/core/traefik/10.0.57/templates/_tlsoptions.tpl @@ -0,0 +1,12 @@ +{{/* Define the tlsOptions */}} +{{- define "traefik.tlsOptions" -}} +{{- range $name, $config := .Values.tlsOptions }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: TLSOption +metadata: + name: {{ $name }} +spec: + {{- toYaml $config | nindent 2 }} +{{- end }} +{{- end -}} diff --git a/core/traefik/10.0.57/templates/common.yaml b/core/traefik/10.0.57/templates/common.yaml new file mode 100644 index 00000000000..c87583e25bd --- /dev/null +++ b/core/traefik/10.0.57/templates/common.yaml @@ -0,0 +1,24 @@ +{{/* Make sure all variables are set properly */}} +{{- include "common.setup" . }} + +{{- if .Values.metrics }} +{{- if .Values.metrics.prometheus }} +{{- $_ := set .Values.podAnnotations "prometheus.io/scrape" "true" -}} +{{- $_ := set .Values.podAnnotations "prometheus.io/path" "/metrics" -}} +{{- $_ := set .Values.podAnnotations "prometheus.io/scrape" "9180" -}} +{{- end }} +{{- end }} + +{{- $newArgs := (include "traefik.args" . | fromYaml) }} +{{- $_ := set .Values "newArgs" $newArgs -}} +{{- $mergedargs := concat .Values.args .Values.newArgs.args }} +{{- $_ := set .Values "args" $mergedargs -}} + +{{- include "traefik.portalhook" . }} +{{- include "traefik.tlsOptions" . }} +{{- include "traefik.ingressRoute" . }} +{{- include "traefik.ingressClass" . }} + + +{{/* Render the templates */}} +{{ include "common.postSetup" . }} diff --git a/core/traefik/10.0.57/templates/middlewares/basic-middleware.yaml b/core/traefik/10.0.57/templates/middlewares/basic-middleware.yaml new file mode 100644 index 00000000000..144f94e7333 --- /dev/null +++ b/core/traefik/10.0.57/templates/middlewares/basic-middleware.yaml @@ -0,0 +1,65 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: compress + namespace: {{ $namespace }} +spec: + compress: {} +--- +# Here, an average of 300 requests per second is allowed. +# In addition, a burst of 200 requests is allowed. +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: basic-ratelimit + namespace: {{ $namespace }} +spec: + rateLimit: + average: 600 + burst: 400 +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: basic-secure-headers + namespace: {{ $namespace }} +spec: + headers: + accessControlAllowMethods: + - GET + - OPTIONS + - HEAD + - PUT + accessControlMaxAge: 100 + sslRedirect: true + stsSeconds: 63072000 + # stsIncludeSubdomains: false + # stsPreload: false + forceSTSHeader: true + contentTypeNosniff: true + browserXssFilter: true + sslForceHost: true + referrerPolicy: same-origin + customRequestHeaders: + X-Forwarded-Proto: "https" + customResponseHeaders: + X-Robots-Tag: 'none' + server: '' +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: chain-basic + namespace: {{ $namespace }} +spec: + chain: + middlewares: + - name: basic-ratelimit + - name: basic-secure-headers + - name: compress diff --git a/core/traefik/10.0.57/templates/middlewares/basicauth.yaml b/core/traefik/10.0.57/templates/middlewares/basicauth.yaml new file mode 100644 index 00000000000..ccb541742f0 --- /dev/null +++ b/core/traefik/10.0.57/templates/middlewares/basicauth.yaml @@ -0,0 +1,34 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.basicAuth }} +--- +{{- $users := list }} +{{ range $index, $userdata := $middlewareData.users }} + {{ $users = append $users ( htpasswd $userdata.username $userdata.password ) }} +{{ end }} + +apiVersion: v1 +kind: Secret +metadata: + name: {{printf "%v-%v" $middlewareData.name "secret" }} + namespace: {{ $namespace }} +type: Opaque +stringData: + users: | + {{- range $index, $user := $users }} + {{ printf "%s" $user }} + {{- end }} +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + basicAuth: + secret: {{printf "%v-%v" $middlewareData.name "secret" }} +{{ end }} diff --git a/core/traefik/10.0.57/templates/middlewares/chain.yaml b/core/traefik/10.0.57/templates/middlewares/chain.yaml new file mode 100644 index 00000000000..e22eb312207 --- /dev/null +++ b/core/traefik/10.0.57/templates/middlewares/chain.yaml @@ -0,0 +1,21 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.chain }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + chain: + middlewares: + {{ range $index, $chainData := . }} + - name: {{ printf "%v-%v@%v" $namespace $chainData.name "kubernetescrd" }} + {{ end }} +{{ end }} diff --git a/core/traefik/10.0.57/templates/middlewares/forwardauth.yaml b/core/traefik/10.0.57/templates/middlewares/forwardauth.yaml new file mode 100644 index 00000000000..7a3e32fdbf7 --- /dev/null +++ b/core/traefik/10.0.57/templates/middlewares/forwardauth.yaml @@ -0,0 +1,30 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.forwardAuth }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + forwardAuth: + address: {{ $middlewareData.address }} + {{- with $middlewareData.authResponseHeaders }} + authResponseHeaders: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $middlewareData.authRequestHeaders }} + authRequestHeaders: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if $middlewareData.authResponseHeadersRegex }} + authResponseHeadersRegex: {{ $middlewareData.authResponseHeadersRegex }} + {{- end }} + {{- if $middlewareData.trustForwardHeader }} + trustForwardHeader: true + {{- end }} +{{ end }} diff --git a/core/traefik/10.0.57/templates/middlewares/ipwhitelist.yaml b/core/traefik/10.0.57/templates/middlewares/ipwhitelist.yaml new file mode 100644 index 00000000000..1179245017e --- /dev/null +++ b/core/traefik/10.0.57/templates/middlewares/ipwhitelist.yaml @@ -0,0 +1,33 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.ipWhiteList }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + ipWhiteList: + sourceRange: + {{- range $middlewareData.sourceRange }} + - {{ . }} + {{- end }} + {{- if $middlewareData.ipStrategy }} + ipStrategy: + {{- if $middlewareData.ipStrategy.depth }} + depth: {{ $middlewareData.ipStrategy.depth }} + {{- end }} + {{- if $middlewareData.ipStrategy.excludedIPs }} + excludedIPs: + {{- range $middlewareData.ipStrategy.excludedIPs }} + - {{ . }} + {{- end }} + {{- end }} + {{- end }} +{{ end }} diff --git a/core/traefik/10.0.57/templates/middlewares/ratelimit.yaml b/core/traefik/10.0.57/templates/middlewares/ratelimit.yaml new file mode 100644 index 00000000000..144b9d8bf38 --- /dev/null +++ b/core/traefik/10.0.57/templates/middlewares/ratelimit.yaml @@ -0,0 +1,19 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.rateLimit }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + rateLimit: + average: {{ $middlewareData.average }} + burst: {{ $middlewareData.burst }} +{{ end }} diff --git a/core/traefik/10.0.57/templates/middlewares/redirectScheme.yaml b/core/traefik/10.0.57/templates/middlewares/redirectScheme.yaml new file mode 100644 index 00000000000..f2413f84e19 --- /dev/null +++ b/core/traefik/10.0.57/templates/middlewares/redirectScheme.yaml @@ -0,0 +1,19 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.redirectScheme }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + redirectScheme: + scheme: {{ $middlewareData.scheme }} + permanent: {{ $middlewareData.permanent }} +{{ end }} diff --git a/core/traefik/10.0.57/templates/middlewares/redirectregex.yaml b/core/traefik/10.0.57/templates/middlewares/redirectregex.yaml new file mode 100644 index 00000000000..46e3e724dd6 --- /dev/null +++ b/core/traefik/10.0.57/templates/middlewares/redirectregex.yaml @@ -0,0 +1,20 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +{{ range $index, $middlewareData := .Values.middlewares.redirectRegex }} + +--- +# Declaring the user list +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: {{ $middlewareData.name }} + namespace: {{ $namespace }} +spec: + redirectRegex: + regex: {{ $middlewareData.regex | quote }} + replacement: {{ $middlewareData.replacement | quote }} + permanent: {{ $middlewareData.permanent }} +{{ end }} diff --git a/core/traefik/10.0.57/templates/middlewares/tc-chains.yaml b/core/traefik/10.0.57/templates/middlewares/tc-chains.yaml new file mode 100644 index 00000000000..409766daa89 --- /dev/null +++ b/core/traefik/10.0.57/templates/middlewares/tc-chains.yaml @@ -0,0 +1,29 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-opencors-chain + namespace: {{ $namespace }} +spec: + chain: + middlewares: + - name: basic-ratelimit + - name: tc-opencors-headers + - name: compress +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-closedcors-chain + namespace: {{ $namespace }} +spec: + chain: + middlewares: + - name: basic-ratelimit + - name: tc-closedcors-headers + - name: compress diff --git a/core/traefik/10.0.57/templates/middlewares/tc-headers.yaml b/core/traefik/10.0.57/templates/middlewares/tc-headers.yaml new file mode 100644 index 00000000000..330fbe4467a --- /dev/null +++ b/core/traefik/10.0.57/templates/middlewares/tc-headers.yaml @@ -0,0 +1,64 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-opencors-headers + namespace: {{ $namespace }} +spec: + headers: + accessControlAllowHeaders: + - '*' + accessControlAllowMethods: + - GET + - OPTIONS + - HEAD + - PUT + - POST + accessControlAllowOriginList: + - '*' + accessControlMaxAge: 100 + browserXssFilter: true + contentTypeNosniff: true + customRequestHeaders: + X-Forwarded-Proto: https + customResponseHeaders: + X-Robots-Tag: none + server: "" + forceSTSHeader: true + referrerPolicy: same-origin + sslForceHost: true + sslRedirect: true + stsSeconds: 63072000 +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-closedcors-headers + namespace: {{ $namespace }} +spec: + headers: + accessControlAllowMethods: + - GET + - OPTIONS + - HEAD + - PUT + accessControlMaxAge: 100 + sslRedirect: true + stsSeconds: 63072000 + # stsIncludeSubdomains: false + # stsPreload: false + forceSTSHeader: true + contentTypeNosniff: true + browserXssFilter: true + sslForceHost: true + referrerPolicy: same-origin + customRequestHeaders: + X-Forwarded-Proto: "https" + customResponseHeaders: + X-Robots-Tag: 'none' + server: '' diff --git a/core/traefik/10.0.57/templates/middlewares/tc-nextcloud.yaml b/core/traefik/10.0.57/templates/middlewares/tc-nextcloud.yaml new file mode 100644 index 00000000000..6a3019d56c5 --- /dev/null +++ b/core/traefik/10.0.57/templates/middlewares/tc-nextcloud.yaml @@ -0,0 +1,25 @@ +{{- $values := .Values }} +{{- $namespace := ( printf "ix-%s" .Release.Name ) }} +{{- if or ( not .Values.ingressClass.enabled ) ( and ( .Values.ingressClass.enabled ) ( .Values.ingressClass.isDefaultClass ) ) }} +{{- $namespace = "default" }} +{{- end }} +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-nextcloud-redirectregex-dav + namespace: {{ $namespace }} +spec: + redirectRegex: + regex: "https://(.*)/.well-known/(card|cal)dav" + replacement: "https://${1}/remote.php/dav/" +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: tc-nextcloud-chain + namespace: {{ $namespace }} +spec: + chain: + middlewares: + - name: tc-nextcloud-redirectregex-dav diff --git a/core/traefik/10.0.57/values.yaml b/core/traefik/10.0.57/values.yaml new file mode 100644 index 00000000000..e69de29bb2d