From 74512f8830137c716a39107fe6b0c3316f10539a Mon Sep 17 00:00:00 2001 From: bhearn Date: Fri, 11 Jun 2021 21:46:01 +0000 Subject: [PATCH] update redis dep --- CHANGELOG.md | 6 + chart/Chart.lock | 6 +- chart/Chart.yaml | 4 +- chart/charts/postgresql-1.0.1.tgz | Bin 8687 -> 8687 bytes chart/charts/redis-12.8.3-bb.0.tgz | Bin 54151 -> 0 bytes chart/charts/redis-14.1.0-bb.0.tgz | Bin 0 -> 82989 bytes chart/deps/redis/Chart.lock | 6 +- chart/deps/redis/Chart.yaml | 4 +- chart/deps/redis/Kptfile | 4 +- chart/deps/redis/README.md | 782 ++++--- chart/deps/redis/charts/common-1.4.1.tgz | Bin 12484 -> 0 bytes chart/deps/redis/charts/common-1.5.2.tgz | Bin 0 -> 12953 bytes chart/deps/redis/ci/extra-flags-values.yaml | 5 +- chart/deps/redis/ci/sentinel-values.yaml | 6 + chart/deps/redis/ci/standalone-values.yaml | 1 + chart/deps/redis/templates/NOTES.txt | 127 +- chart/deps/redis/templates/_helpers.tpl | 406 ++-- .../templates/bigbang/redis-upgrade.yaml | 98 + .../redis/templates/configmap-scripts.yaml | 430 ---- chart/deps/redis/templates/configmap.yaml | 72 +- chart/deps/redis/templates/extra-list.yaml | 4 + chart/deps/redis/templates/headless-svc.yaml | 28 +- .../redis/templates/health-configmap.yaml | 44 +- chart/deps/redis/templates/master/psp.yaml | 45 + .../deps/redis/templates/master/service.yaml | 46 + .../redis/templates/master/statefulset.yaml | 402 ++++ .../redis/templates/metrics-prometheus.yaml | 39 - .../redis/templates/metrics-sentinel-svc.yaml | 38 + chart/deps/redis/templates/metrics-svc.yaml | 42 +- chart/deps/redis/templates/networkpolicy.yaml | 53 +- chart/deps/redis/templates/pdb.yaml | 27 +- .../deps/redis/templates/prometheusrule.yaml | 26 +- chart/deps/redis/templates/psp.yaml | 43 - .../templates/redis-master-statefulset.yaml | 382 ---- .../redis/templates/redis-master-svc.yaml | 43 - .../templates/redis-node-statefulset.yaml | 507 ----- chart/deps/redis/templates/redis-role.yaml | 22 - .../redis/templates/redis-rolebinding.yaml | 19 - .../redis/templates/redis-serviceaccount.yaml | 15 - .../templates/redis-slave-statefulset.yaml | 386 ---- .../deps/redis/templates/redis-slave-svc.yaml | 43 - .../templates/redis-with-sentinel-svc.yaml | 43 - .../redis/templates/replicas/service.yaml | 46 + .../redis/templates/replicas/statefulset.yaml | 405 ++++ chart/deps/redis/templates/role.yaml | 27 + chart/deps/redis/templates/rolebinding.yaml | 21 + .../redis/templates/scripts-configmap.yaml | 450 ++++ chart/deps/redis/templates/secret.yaml | 24 +- .../redis/templates/sentinel/service.yaml | 54 + .../redis/templates/sentinel/statefulset.yaml | 580 ++++++ .../deps/redis/templates/serviceaccount.yaml | 20 + .../deps/redis/templates/servicemonitor.yaml | 85 + chart/deps/redis/values.schema.json | 64 +- chart/deps/redis/values.yaml | 1849 ++++++++++------- chart/templates/enterprise_ui_deployment.yaml | 2 +- chart/templates/enterprise_ui_secret.yaml | 2 +- chart/values.yaml | 3 +- 57 files changed, 4355 insertions(+), 3531 deletions(-) delete mode 100644 chart/charts/redis-12.8.3-bb.0.tgz create mode 100644 chart/charts/redis-14.1.0-bb.0.tgz delete mode 100644 chart/deps/redis/charts/common-1.4.1.tgz create mode 100644 chart/deps/redis/charts/common-1.5.2.tgz create mode 100644 chart/deps/redis/ci/sentinel-values.yaml create mode 100644 chart/deps/redis/ci/standalone-values.yaml create mode 100644 chart/deps/redis/templates/bigbang/redis-upgrade.yaml delete mode 100644 chart/deps/redis/templates/configmap-scripts.yaml create mode 100644 chart/deps/redis/templates/extra-list.yaml create mode 100644 chart/deps/redis/templates/master/psp.yaml create mode 100644 chart/deps/redis/templates/master/service.yaml create mode 100644 chart/deps/redis/templates/master/statefulset.yaml delete mode 100644 chart/deps/redis/templates/metrics-prometheus.yaml create mode 100644 chart/deps/redis/templates/metrics-sentinel-svc.yaml delete mode 100644 chart/deps/redis/templates/psp.yaml delete mode 100644 chart/deps/redis/templates/redis-master-statefulset.yaml delete mode 100644 chart/deps/redis/templates/redis-master-svc.yaml delete mode 100644 chart/deps/redis/templates/redis-node-statefulset.yaml delete mode 100644 chart/deps/redis/templates/redis-role.yaml delete mode 100644 chart/deps/redis/templates/redis-rolebinding.yaml delete mode 100644 chart/deps/redis/templates/redis-serviceaccount.yaml delete mode 100644 chart/deps/redis/templates/redis-slave-statefulset.yaml delete mode 100644 chart/deps/redis/templates/redis-slave-svc.yaml delete mode 100644 chart/deps/redis/templates/redis-with-sentinel-svc.yaml create mode 100644 chart/deps/redis/templates/replicas/service.yaml create mode 100644 chart/deps/redis/templates/replicas/statefulset.yaml create mode 100644 chart/deps/redis/templates/role.yaml create mode 100644 chart/deps/redis/templates/rolebinding.yaml create mode 100644 chart/deps/redis/templates/scripts-configmap.yaml create mode 100644 chart/deps/redis/templates/sentinel/service.yaml create mode 100644 chart/deps/redis/templates/sentinel/statefulset.yaml create mode 100644 chart/deps/redis/templates/serviceaccount.yaml create mode 100644 chart/deps/redis/templates/servicemonitor.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index 757147f..0cc235c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,6 +3,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). --- +## [1.12.15-bb.1] +### Changed +- Updated Redis dependency to 14.1.0-bb.0 +### UPGRADE NOTICE +- A clean upgrade job will run which requires complete deletion of the previous redis instance, which means downtime can be expected for Anchore Enterprise UI users. Multiple values were changed and shifted around - most importantly `anchore-ui-redis.password` is now `anchore-ui-redis.auth.password`. By default your old password (whatever is in the secret) will be used and will override any values specified + ## [1.12.15-bb.0] ### Changed - Updated docs for BB documentation standards diff --git a/chart/Chart.lock b/chart/Chart.lock index f6be325..72874de 100644 --- a/chart/Chart.lock +++ b/chart/Chart.lock @@ -7,9 +7,9 @@ dependencies: version: 1.0.1 - name: redis repository: file://./deps/redis - version: 12.8.3-bb.0 + version: 14.1.0-bb.0 - name: bb-test-lib repository: oci://registry.dso.mil/platform-one/big-bang/pipeline-templates/pipeline-templates version: 0.4.0 -digest: sha256:cdf6e2694ba10c26845caffc96343262185f697595fdcb658c1c6e9796ddb029 -generated: "2021-05-11T11:23:19.071211-04:00" +digest: sha256:95fc02eb4c73428f58530043f2ccea983eb2de36c3e2bed6566deaff6552285c +generated: "2021-06-11T14:51:29.578969-04:00" diff --git a/chart/Chart.yaml b/chart/Chart.yaml index 6d4387d..5f0ac86 100644 --- a/chart/Chart.yaml +++ b/chart/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v2 name: anchore-engine -version: 1.12.15-bb.0 +version: 1.12.15-bb.1 appVersion: 0.9.4 description: Anchore container analysis and policy evaluation engine service keywords: @@ -33,7 +33,7 @@ dependencies: condition: anchore-feeds-db.enabled,anchoreEnterpriseGlobal.enabled alias: anchore-feeds-db - name: redis - version: "12.8.3-bb.0" + version: "14.1.0-bb.0" repository: "file://./deps/redis" condition: anchore-ui-redis.enabled,anchoreEnterpriseGlobal.enabled alias: anchore-ui-redis diff --git a/chart/charts/postgresql-1.0.1.tgz b/chart/charts/postgresql-1.0.1.tgz index 1877132187aa7f054422eca0a279d6ed9bde09bc..89672a7c32ceaa26730e7451a05490010a0a6dcc 100644 GIT binary patch delta 8586 zcmV;5A$8vGL+?Y7uYYhbc(MQd*^9kz2D{Jqc6Yyl!4u=r`s7?7_RZk4+p2f&U*tg< z`2{mhXgY+&u7|R$`1yTs5bVD6BFsZZGNIm`PX3NV;WHc~`2xidA%P}{V@ObnW;nsA z0KVh`C$M#TcKpM;^KG~$Vh$(;oMdyv2?v@2{v>e9$%Mp2EPnx|k$lMoN+ZM~?uRtV zVuI2T2i}|}cnEVLGCu70udlCza@Gcv&H5e*C2}iDBse0dPm)<5O=vFq8N;0Sag4J$ zN=1;RGw%v7uPKZ8(DR|J?fmfkqO+b4@>_}|VoqUBa~5I+!Xh&xVxCWekS6`Be1chu z1?K%wt~K6XEPtZm6=r@+CJeDh-_7d+=hn zzWxvP2Vd9!mv}Zdiuns9K{M>B|Ch6RXxMt294#{*0NEaRDaXg|i377KY=23i& zmV6V)RDZreGawu`V&DGj)7wVg2LvT>3b?h41aT+icMLc;i+E2!@jdp0z&12 z;QgFq=Ff5x;l6^-`x_aX5zzz?o8^)$dOUO{Zj*GwdgMEJzk(zi5Z|_3|oSyqCMOLhdxPLQ2k*yaFVZla8hlHv=0%in07f zL12~;)rT2FA)e-Oyu26M1$(%r>?)=x;(z^&>i_jOEL1{MpH3w=FkH&{@LIMv!i>=9 zTw^zc=Yz_mVtFb^fk*JpZhCx<7><6( zr&G*$ZwS5p!QkBwy}QTG5QC4e@u|;}SL$tbS(vE`Q_3KlUCt*ckd-ToEuxT8p?|pm zu9kvq_R|DOz(ct8y$t|}X^3J#vHnl6oD21SPPr&vt3v8ctw6FYMb{;lD;svde-`W> zybK1xp#N+Sl4xJ`U?c@EE);)|69qx0-zcW17^7Fb3GvVaz^P<}(NH#uJphKaXlQmM zfDN?~+Sh)j-osBgP5`AT6?(eT6n{p)yb9nIN@0Q_B{5J2y(^5fp63B2pCDnqi4J=S_sT{;a;LC4Ue9<-Yn$ zQNu_aJ-^phsn^?q>p2PM5D_jZz#&?uC?O$aj4p^2x#hNLq2;N;0JijIqo(e*92e72 zn#b`Dq_oi(NLc}h=?lp6I}pw(<>l6;pp`9S765F`vS)HC9Q}H}Qyh_irWVfYzn<*K zkMJir&2V}yPnS3@D0-*xv%Kdh6I|<{1jjN z2AaPh$VZ0H`co2P4c|2St|X#-36g0>g;-)=0({J|>{##o~^Aq^>r<3;*M1P0`is>wvBVK^J%otga7|-xlQGEwCU!A^xfAZ>La~m#dl^s+r z<)kXBZNtgi^Ai}r$@^o8f&2|7G8)|e!Sg5A?%t(BRINncENwI9SJA+_Vr+LKpElPnk5FP4## zy(){Ux}=&5s$5PU$816Lekqn29>Oav?!6g#0CGVLVSn%WGsz!5De*FXGvY(|@VjPw z@9gd)`R;of;eQcj@(>c+?W@@4OhbWg#THduDK$Tao|j@F1vq)KqI#iV%plQ66vMJY^Gdaj1WekTx zLknXf_sJMdaIAM*bv`m3Fw9+vv`WTh0!DfM3B@tJJ~5+eL=HI><=E(c=}9VR zjJ4>_wcto2K%A4AI&nVq?5@^>g4WkSq&V)&DbU}L|K~Wyp`h$3;mVV#;66$t-|37$ z!27=#*6R9Zje5IJVRq=LVcEFk>Vt1%{X`a4HA=PrxvWi26HY zbb`63|B(~gmeOleLL?|Y#xYtB;b5R%N}-EY7SIeV$S^88xIjmV#XRp?`?23c_e8XE?=-gdj2PY8iY#Es*c(68OF( zmy+WTgMLGwDM_Z(IrG!8_CO;60kr_9KOd3 z%;fI`d|!wq_yl}y2`H!8ZxSWnmniq#5i9@h!Ea_}t8Us!RuM_9hGrYKFV?0;zZK4ko34F1oOd{z`G!1f9hT|0#&wx-AYz7y|$ zz^yV~O|P4qKZKU=slY=xCuxXl=K#X3;NKA6747fI3oDfOtRhX#aZy<@Vota#sarOA z??o07DWb@6WxRfX5%KGa|Ub1iiFcZ^QSvd6U0jeAW_kd-liR4W`oqwKR)cBH; z;qJ*Q9e%TU6A*zD{$cQYzy%UH4^R{_xlyTi=EvRUwrzWKdRA|nFTy{JA#UCTJi}oi zH%x_*Jy=SVEEN@JuaL4h@!pS?yU$((17-bpd+DwZxmPz~scl@&2+(SUlTSFz1#aiE zO7vvZelO2`MoXrZRWLd|zJGjw^zNiaWHs;aH@-3SP?jBbQM;t{4%77y>#*SNu2ul-h8Yh; z_7tulYvljugJ;j{^8bq$`(Ne%FY(;m^uL1zNrp-VCB;(7cMcOtmVa=Lhwxqh?#`2? zypvCvQpwD*mivwRQMob&o+;-W15L|H_R9ilK?K_2P_5%)14aohlpD7oSe}M(@Lc^# zlJk5zC7+<@m%!w5@%4`1|IRB-`KAqJ#D$MJipiAV2vC+O|>Qi~1FnjUVWU0tujz!A7A;aNzAWtNQe`z2E_g9qD z?}#X@X1P3jDWk4L-e9|my5+89iQ*iP?8kzrwoGS%dr@6(WcJ6mst3cv`wy&xXF&`N zrOMq4Tq|!Mj9|t{DyGo;5AOem6dWtibh{6kYF&TpDR_oO&VTgz1!Wnd86#?n6@HdV zyJZATZT4NWc&ajK0jDzD948CRUeP3zbF=rC!`)!dAMC(??FKLWK@WmgC_~EEl3*Ul zX>FhcuZggTNq9Zumq}CJU+hk>K)XH9m0fBr{l5n{VERMSS#b4IDcBaaiB6)Lb?qz| z$%%|Zq+Bd&(SMi~s7ooSdo^WM!CvPyac8mq+xFwOP$BmIvj@G)-XmDmYn)oLV}B2f6;GcTQI>VrtkeR{54%en zrd<>_qSdf*ZnFjEm=U2&>u!m2ef*MzZ2xMKlkpS?Dt;CksD5QVG}I!|2-ClzBwhpI z7Cz=w81yQtwHgA2!<+uSR#DSwCc@EHy2R0z z&VQ09EiSmO4!l>bSQe`aFJ`){TP9FEvSSRTGYsEe;pGl|t9<=j%~M1|(J%~ZY1RcS z3E+p7pPM%~3M$+JPtg?)wI%UTzShm$-EG!zsSvqk0@MV!&bH?hbg3Ky`dY^8yB8l; zHi^?kNgz9@qto+?*Jmf^mp`AMoH_MXH-Cl?G1az=2|(dj8QH5GgliWIqSan=jAAi2 z-e*A*z1M#PUX9Kl|FF7=6$a${fPeG;&BgH#mq%x>&mY=Od4+0aORtZQE{>Y8*ZJCa z%*EQ3yp?^kP6?MkzIl7nf`OcuEv_q-d1`!E*0xax|0AP`yXL`Y#{P+wRF_-Xi{ne>q})UuZnTj=B5VKFmn4kYI-}8>5!^vTQ*XWd zw2)BW_KL47r3v{c3v`n!IJeYGyo;S-m+8wyH^|iKlG*8w_QjcVE7EbO+lRM%j9` z4;5a$Vj(_cDRyq&b0MF{MwSglW#ZZp~s_f`gJ&W zopm+uMOP+OaaUPiRW{d}oyjC$ytl$>D^&MJG~7PGh+949*W_%RWPf6LO!O_Hj@jWj z8h3HZd(QMV^EtF;B$qUgQak`CufDqAqa^rM48fg#-R0IPays|b)w`;_R!|~R9!MT_ zXz8Xw_bJAuKv$`C{cqXGS8d~8X4uYeo2CcriJ|9{=RgZlli7ti*ef3^R8iKlJ|XuBj)+U+WL9=xjUu*2Na>Aj{_ zdei!M&nqgue1-rcG zeVG!+siV^Kn>5f*3neVme89b#A@uaknHGL;yPq+dU@^xz2Y((il;M@VSLcBLjg0$= zo>u;!EyAY^1G$d>AM7{$|98Loe|(vzpaJ7EB{fwRgBusNM6m|?BBup zqvjbP>-6S0P69sf*W!QmI!#9o#jByjTGU={VN~^0Xdb4!3a{}taU)2XPWfF&-Lhm= ztFKe^d_I>#A&9AC+e8Ft2(DZz$KU-|zRcv^(I=Iwx1Ct>~h--3l}f3(vKeax}r zE?i+Z^{~0xXSc3#8A64f)hpe?;1)bIc>y%D3lZT!MDxInN`i20fkH&t$*mPLbKqH?L96djF|W=TgtB0C~RYFY;PB4u_B&h8;15H)NjbteS}SUC+wuI z;>MwDIZUCw$vp;*@cs!mUKKH(b zIe(55m8t^8F>oQ-twS1F(4^52j7GWAt9#zXoY*)I6G{aa3}upht%P2m18Ca~iAhrl zs0>k|0oB7-ZrfN+P{vOC@Dq-cvR$K%+J+2;S7>HaIWbL%5yK3B%n2s~bI@`4ddPxtTg+MIPCdp6WlRq-!K{`>7w{ z7@J5^F4>)l+#CT@r!3y2Gs6j8U=DV;UFy;#qbW`W2gErIiHiGJ1}9b%LyuLgDme2a zsD#c&b`iT#veX=K2wseceC<%*gn!3zW3&}5i#aB&7Jpo=@~jxQ_jGI*<=8~bWjLdp2+Ecnv~g-Y zhBjmC_1Uc6f{j44l>lMH*}TRko7dRQuP|<6V|-x7?bsMS^IB|D5F{bzFlj-`QwZDZbW$Rs}Wj zUxPMmK6BpGm3}U53PqrefNfD~B4TQ^B>GxI&nh-G-?r+!(HX(?uHs|^o01sUa)7}C zF-aR0!2a>GxPBGOrHwk?=zrKr*QHq5JycIOQssrMu|pe`L`C1F`vuAPT8tS+T z+vc8V&&2gdU{f^`j4QC)a=gibJ5te>i>dU4*i^52RJlaeW8Iw=j~2g-GR-v!B}C2r9JstdZ)l$d2K*NIw-S6D^&>1cg@$rC(lk&_-di zm2)MRW^-ii!3IXDM%-SDO=&bA7b9iTYay;uHmO4rWo7!NIyRNOP7k6|6Pr>2I#&Bs zONO!1cc7IvH+PR5sDGA`BLArD3^o~#nz)8YD*?jz&&_)GfJLvc zDV$8&c=71x{yUYRsF@V)jK(UT(RfFK7{YjWFn>taVWhCBY3nP}*11rp zL*OLBeu$XssA%(p)kf+wrLD@{vzkP4Vq4Vbm-PT)ydtmJ8XTM0RL)h8!e%iDc7xr= z5T}VvSxW1S0kNJ<-P!6yubJSaY}(IHe#9KIyP4? zi^OQk0I8Ua((@@>qe=$W#ZK6-YDK`E1^n3<{AMLlz&-pZo)Ed)0j&}{K3+wFyPpc zDbrpQB%M;0m@KQ>P|fgEn=zEN|1t2**(Rc)(r;TUu}$WWQ8+LA>9`h*eP15&uki9v zNpc@{ia&oJ12XDziQ3pTwvTmx@F$dHG2VHAP5w6zK)30dc@C4MpL5K1>eiM+t&g@! z=zpEM#X(jqj0-AH*($5Q9&c-t*2-B9$Tj*ZgOWr#Qugm$*`Sm$x=@6Vt2m7V=M)t$ zfd~h3fm;dEz8VLfcVx8xWP#)54j}m3(Yv?WV57VNxEeoVjNaPtT&~q}-WsogOlxE# zxSm^^k7MrFnO`0|aQ@U9zLzNJ^r&&%5`X?ibA?yVam8)og9GOGE$4^!78#ZLC_QMk z^>AO$8@(X7pv+Lu8Dynb(|$yb=Ku$!t!L|1YF0sK913(Kn!va`D7OKn*wd~(Zj z<4+@bcNw+BHvv)l+Zsc{A*P|@c4Ab7gcoTu^$L%cDN0CazZc#;B%KBD#yC8*YJcqc zT(R1e3OTQ|gHbhO$Bs>RvBE|WcqRp(N>{CMa!LbEdEpr*`8y_Jj+vdtfZD9DRAtv} zShRM4%DUG?ep6F9&mtu7SSRY4+4LPq*&~e^wph~Fa}v%a{m3k(O!w3_ElG?_z8{@y zNX{DFnF*ew1)(_utd^=~0L5Wg?tdE@P9y76q#1{t<{PEOt#tsn=j{ey@~E^8)0)rv z`sQw6ov+Gq>t6ASDR+(K;pmrFI-6P>V>J`ZEOB1ZoFm}fDt5;#?Yw1_syzoSD2bd8 zn;hmOif{@Ro@9+GBO*x!W>c(Or4+j!6J_!p2LL9=EMge)Y{sM@IMd5WuYXkqV1lP| zceY7t#)Dul7>sw62E5&XAUDNcZ>)Wgj9Sg%05mJM1jz=u(HC3&TA?GB?EFKiJa!y8 zU8nSIz0!-?X_Qft3fNK_s_%DSzEGZ?a=|La5RMdsBSNLR{FLEPXVWz-&ccy2327Yb z&xVpkYRRiIwWL|ST%n}?B7X^q5d*{xcjqA^6D=YsF~;mMFsfhRhnkaI3s*0@?*2K6 z>7<_^iB7*F>GVxoZfW1)uFE9eHr%-&yVBY4(jlR)|I|5ZOZBMSH$LWA&bR>1F)lsm zHaU!)ZEUPYR2fAz0nA3j<>qH7qjBI>d99TaE41_*61#Nfr})~2Nq_Pe1o=9?51Fa( zM%xM-C3r?yAQBsg*=lGI?}8dfP@C$?YRF~na_8LfEW7xCpv(*fS)9+*xFZ2Xc3L}G zR6YH?s(wx~%(BZZd!a!5iuYB{XSw#6Z>C~D!eNXU_6-8YF14Xou)n0aKfyDSZtr-K z^lAZjXbWkZzyJK3!S3_D!TvWecw#(SpPUQCz8QRWTlLQUi##YJ zzhK4*O^2}9^-z`-KfezSg58&1gn7tFCe*vr$=`7(e1>BrU!WKwB+vwL3<*ln3@11h zz?WR$1h!7kj(>P}z75wz%mJlC4Znak}tVHX@pqB{g5VE zOi&u)z?;(q4`D7u#)tj>_4Rd7&f0*oS>Gd}L~cci1V;q*NiyrB3C%@6W0>wGze*gnmz5aK14_@rn z*S{?Ob^U*VXJez7zd#Z+!=CzoIje_;4R{+HaGv3iOqYOk(NP}9BN~%%DL-x=#n))b zH-Sv`=L<9g!eKK;0&}ss132awI2Ir%Y`&Skr((n~$A78Vl=T^&>LonvJ1Zq1R4xeK z&pBrPEGH4}E9ktxkumINc^s2;=IeLf#)h|1M{Zcbz4&;JLxu&fG|k)F4rv^sD_qlc?ijp;ThqAEwAuWVfl(-Bru?ot;&AOFUNR_ z@>rAuhX6^opoS?sRx5`WC7$ZBGaA;O$69Dyz4Z2&ecYRV5` zQ@6a?PV)*SCB$Nd=)ov{ADarb8I}?eO#rc3F3G}o00*-Gd|$%%!#NJGc%C#TUiTKD zCgCKelYWA@z^vF4)P%&T2$E>SzPr@zUm`YZw$ZXR>KUFhhEvh!0tpiKQI`1{OfVNo z?04$Ny z`Ww=8N@h93ev-$6WHI)Oc6eVeuj0jfxhpH=PBSZ{wU|5TWW=8_p zP#d9r?Puye{Dk8KP?}Pqrz=fi^nc5%0A8UKCKyr@17*;=!Z_=B9>B&197(}DM{&F~ z5_n|smDv5F*|rp~U&V+dy3QH?m=np*9IS&n%98s|A;MFV;%Gx;BwM7nGqHmWXrSM2PFp>Z@Av@PA+KtG^UA zjKtCNdu^3^y&brolW-0Z;gSLzqGgH_5<Tb(%F%6}8 z9PdC%8;yaK6@Zw&fGocQ;ha)lZe0pm*)nDUz}75#Ca1#Dujf0(5eaB&;k^Fq$&UO8 ze}dBtr{@BNSKI2NBEE~pP=Aua13+PjIe$kZJcKihqF)&i_%sdWz;p5sJcO68iTpdC zjF6ZQp;z(*KblAoN)*r^`wPVSF`4w8(}WzMm481!=9mlf3n0M> zWy>Kv+dp_m%)2nlhp;;sB3RwTuMqKKI7CCs^?378Jqa$TGIicW1vpy|v{@wIQD z`3r)4WcaKHGI5uP!#X;i6XALFH0T zsAQ~V5W)2vGsP+t)^e91DQs;DoMiHVG1%OJ;>WK1 zVTrrB-E-)W)afN3Uy-2tPChwTv#|H}=!cWHy~gK?W~8T9IDeh$b!_nN)tZt0yqqir z=G~3GKKl9f$-2hQCBbTqNrEWYJuTK+nW>oc#dKHuK}-@-JN~Rad4)8|a)JF~87bMT zvZ$&{s=1)b<>Yb97DVrtVwvF~ywc*{n~?_~7sL?u_ntqK{Na-lFXJ~OK7S->DW5~XGJ4GbU8NQe^%;z+YhH#*kx@oBm z-hL~%=jv@%J?iXBdLNbIff{Ko4rMW2D&2yd41a2f0hy z7=;+PU`XKE@{wmed7xo5R!7hhr~XC>wrIhQn-Lw1ywIjQQOh<%Y$4am*U!=D60 zC+R{>i6_$kITD-QJ$e8A>BY%;AU=twX=9E3XYb(opr-%b-~DR;`7)2g>_dIX)Vl}P zihn<~dB{yzowws?-yO(v#(>#ui4eM@Q%9zn-2QAAY-KahJ6W;`hSo ze!~Plg}-x}W=PBrdpA;)M?s?lcRjcTDUBZNf$v8+q!Ioz;BZd2)!5-Ql6{k%Gk*ew zWOS;Jg&fQB`dkZXlE@ukD=&`9I9(J>)5s$ey1?7jVU(brkOsbyynHDE3&h0Xd%VC* z{!YO6g;;`5z}J?5a+>`nQSyC>a?c&H^6wt}W@fhPrk!LJk<@BvwqZ+7?DjGh!D?HQ zS~aajs>9xcx_KzYGJ}~JHwDa&hJWuv#y`g3|18O8MUet*uRzhYQ%GWKdd%-T@$LuQ zD&y7ky1Ds7X!)KBJcM(ShPZYPAlwT64e?#k{+_(BLV3?B($pLml@%lAgu9ZuWs~<_ zWD$`fdc4$YhvtGyc~Y*dzrN%p3kLu*F^!dlL(d+d$}w;cSZ10?-t^Py`F}-?FDV)B zo~+X0H=8#B5jf!=2EPYfAd&L`MG=!5m3n7>+-+{#wnwLD^|tvU{KFXH=1sse90qd3 zR2bQVr9{b6QE~PPDT@>D{b;%S>_sq8)_=E`?)s2>brY7_#^sCvtyVbsgu`6mb}p+# zPe$$c^4w>%WLjATqtoNd_kTz4PHIF}^ZtJ08$%Ce*vH|Kc(y%vFLvIertOS_a^x8VMF7r-7h8owaWjOa~x-w@jzrx z;R>=w{(nAr_Pj3tzj(3xRsR1H&&^H$J6Mops8mo=ER}rcFp*>l=YMzz-}UeAJXy*+ z`IIS@%p7aE->4szD^uW^a=tOpw5(*mET9%dpdAj?IxaR~l;A?SaSMXwX$S|;)t@9e z&!PqAdwyUUH?n;&@&H>4OEQo5$bQZW5)#XNJe|)QYFg(2fz&dyq#L!Tx z+`YiH^7g?9W{jj_3cdf}{(nfpu>wuE`;e*D^|zjaXISJ+pMPIamNA+!qNZ5kXQ{MX zM$pt|-!+S;Dw7s)D#OijvcT*WO)@z*dw)6H4fg!O4*b_{@WLPTAb5o`qZH0Axp?gR_8+w)x6rPk8_dvF7$KO~(6S1*-pi7DQ0D-%z0h* zZ6(gS+dx`ucpqr&a#bCXEDTPvZ={&j0_#-d;`q zJ9z$8|NCX0n*aY5Nu!}L9lt}FXU|ab=%>Bi?{_x#z<*fr^qCQ5S$EA!Eztb1yR>22 zMR6lq4IAe+TVReE5z4ggmN?hPFImX;uO>MePl2G~XQ6@WSJp#AEfS3|{ToW+H4tv$ zV@`!ZucBJ3Ay7EH>93AA+|X4-m&LjuuNwc>^=w z;&Io%oqvB7QSNB;#uVVePlzj(jT8-gaCZmh?^3yScLz-Y(w&Q%!IT!+e+v#H`>#~N zcFne$ur)Z>P0n+83fuxoBb*A@a|O1$J5L@nhs`#u?OB5@EYbIa31EF8j2{mY;ry*b z?}t%*EfGufl-Gdr(>cT1240>1uN&WT(+aQ?3I_S*YTc($Zw5)?=D=y?cr>uJ21rqi&tY zv{|_(P?oCR9)O;+!PaZ^?%TUn4*pJmSKkA05V`+<|YEub-=VibyCLhCwaOx_~7C z{IK$K^X5iDg@r@rdO@P8qu+Lkc^DEulTdzFK5?P5W++G~zcEat}h zENG(l`j5b?(fQ*aRyVQ2fP5eDZ{EMTIR4@C=uoCCLfb>!#y zUy05I(w{}>63Qw{XPxp;15DN~5LK@IG?!NKv0Pib1Gl!m*7lC(Y1_i8aNWwaC>K@d zqFqs<+Rx&uRYx`R-L3R+9&fo^d6B4rb-yNdNb;Vh@v^uWShii`JogcQ3V%dq{(PdZ zHFcn&g`fu^(xJgKj#(ud776#l7PQN^7KW8`hh5(;(Cjf{a0SL{aky33lS0Df`RUJR zuTGS2N^`p|8UL`~e~_Qv|1I2&hH_{4Kb*%2jqstlDA_gcD-@?y+()l3PyT0gdUkPg zc6stY7bowJFaP`Jle52Fj(?6We(I7tT6C|g=48iiSReVuR`~ty%NLLCU^~MoTd($^ z!mC#-#D^@!&dqx+MD`ks>K2me_S*2#*Rbkex;L$-g1>@aTk?1E?FK#ccr;GG4(G13 zuI9by%A_jpD(kDt=328endFQ2Ryb{i>fVTk+XonNtLOZhoQ;!AEPs!QzD3kAI~+&j zE>3yRnZ9N|ht`bblIBs02LR>OR~LMg1iy+QxYMt@+&V>0=f1jnSGCs)N<_*7$)gS} z-8ASv#kdscDz&cvEgSi&ZT!m&d%KRr>1^Zsx^C9v^OOY}k$W2ZNnIn>3g(~S-nsT^ zwf|MUlRn!7xW@j!yMK33zyI~(+1`t<_P;Oj)C~b`mn2HNUFFV$SG65>m|Hr%*VIaH zTL12OMWy$zWdE~9o=hH2zoc1>q_ScWY~U!4={1m41!i$CbbFeYRfJ`~dIi5=m-oCc zQ{p&vRC<1s2Ks5Cgk_o!xHmI|p1wKL!tZVOGe#3E<~ZlTLw|-cyt4P|9Pq!9aX-=1 z%Kx)P_>^HF*YW>@{f7Vl?pObhFY~k<2HFlkm0NP1=a_BfKdQHiQQH~GtGS!~J2-#T zJOgB%-WBymYHI!J3+RH7Bs-6nX!*o~SHQpv}1S!)gzw4-5maJ;E z*2H2mVXM0Jp?~Bb6@V+K;6}i5if-YL%0YWwm2K;z(u^JERS)4UMY^!BqSW(hYRuZ7 zf0$o(EB`m~OP^{FSjYbdgL?e${TD9|zViPs@w5na&D#O3PQv>0zXc1|{%EHe`j}(K zUAV$->S1%W&u(4gGK2~{t5>>($-y2@!@4W4!(v)M-hbSvc)v$+Hb?Js74^3pP=m$% zvuEJf=b!ns^Zzd^|G#M7|J{B5{44+e5>E$fSFG>fg16ttX50|qOC3T$XkV)lD!PYi z0j)~teZTwiMXybk*87X=a@vRiQ79+wgKwLaGpm|41!6NSMm6hOMP<_AIivx#AZsHT z)WKKkTYu48g=WDY+k0F_7%}l#wv=6~QP{@V*xoM8Vnsa1HVo}YsNayO`v{xzPS{CZ z#f?MRa+qqXcW)Q_hpdv7)BZv0-{JpfCr8KcPJ$$QY96zi|37+)fD1ZFEWuqZhqrqC@%GQhXMgs*@pwEzeC~Y< zbAKEsDpduFW8gxvTZc5Vph=@47>#nJSNFV&Ik9mbCX@;;7|JC1S_!>A2hg?~5|gG9 zP#K~^1FDCw+_tftpp2dN;U^p?WxGZjwG9~xuh7h6mDGd@7;2Oyop|Y<5HpC9J})5=k~tF@rx;-u=F{QTe?MTpMsyL|>EAqRb4T7JrC| z>R4pZh#<jh90X}RdD7< zPzjxl>>_rfWT`pe5WE->`P!kr34f2{#%L>A7IREkG43Yumgn8V$kvC(a|_312=M0T zmgm+c*0@*cdS&kx{Pst~?)cbQ<$*P-)g?A#$6$C1sj28D*?jz``{pW_Ha}x*p&XGV;A-t9gQ-NV=#F})&PXD&VS`KmO`=9 zQNm%Yvw4k8Hm|XpUt!$D#`wUD+p#fv=C#$nD6zO&J+QhcogtqN-5 zzXomCeCE8VEB##B6pBC_0o$U~M8wo+N%Xabo>gpWzHQZcqcei(UB$@;HYG8x$=8uh^0gM=XV2owHPmqx zw#_}!o{8&^z@};>7*}Ao<#>|=cch{%7gOm8v8i75tYUL!GH01*uqxX+f-^NL4U2Rt;}7! zAx;yU%DJk6&Dw+2ZObv~ao99xvx7~?9ByLsRI|8pE6DJhqpqxYT>w8{E^ZoK#wBfx zGxD2}ifXPCUw=WT{^SK}|!1siLItDNpC`P+1$S;rzsxPu8i$-HU3 z>R@1-v~SfE532xvHZNY`NiVm}W14OXwXg}p)% z&(DLse!XegZ$%i6f+@eXx$0DD8*&076+*(L&G=yOd1r=|@jS+@*qAZ}bsTK=AB#*o zHuaz&<9`-xOc@YGJ$Pt(CJJkZbf+1|^Afr0n0hvOy_hbfE|zS8*B#&M7Kh z0uc`60=E*ReKig|@5pHX$pXjA9YFB6qjzt$!A5xla5a9!7`?UOxm>H|yft0}nbycg za6Pv+AIIFUGrv4`;QXmId@oVb=~3gjC4c;l<_fQz*2nhH+n&EL7AbRGssG>ru~Q<&jAidThG?3)U1NeI27neG=Xt>P;LWCv8P>!>dM!4 z$Dc;>?lNkLZvvw9w>5@@Lrg=*?Zl`E2`|!S>J=U>Q?r_2cv4njvbrsVug($@JtFmm9ARjV3qo@SSS?k}0E)w~+n8+IY+>|RqT#g+Ih<;ReKIvP!c&G zHaW~m6yX#sJjohWMnsYd%%)hmN-1_dCd%YH4ggG!S;R2p*^Eg+aHf}$UVp0!zywd_ z?rf9Pj0eG9Fc|MB4S2f&L2in@-dOt}8MT_j0ccii36c$Rqc67lwL(WM+4+Z3dF(iH zx=!iadZib&(c#b7Oq})-TiYC z(@8%;5}kfU(&?MF+|s_oU6)C`ZMbtmcBQl7r9(np|EY7-mg-TtZ+y(LoN)o1V_bUB zZE_ep+t^r*s4|Lb0+@}4%gxVFM&rP%@>(k;R%q!rBzEb{Pw}-4lYitd2=aA&A2L(n zjkXmwO7M)ZKqNK}v(?Zb-UT&|pf=T&)sV~D<<7a|S$6ROL75o}vN)fqaYq7(?6h{W zsCxQ&RsEb~m}Qq+_CkU974NH@&vNZC-%Q1Rgu@sy>>C7(U1~$GV1G$-e}ZQu-QMve z>D2=6&>qSqtaNXI=YL7L$Z<<0VrC;898j$$84uG}m+1(h+3rZs)zq)=*kDzTjA zg~vEuLYb|yG@AvWw?@T>)aHWa!63vgX2=q5Q$A_BQ>kH~g*VbmzC;-CfV~et(r*wn~B`rLJITIwfI| zB+tpd_jgIgB2T%YyPBUF!=c>1H9k9S16NVB9%>z~WQ>M{o=WA5bli|4p|2#H-T$Mi zGPatex18sJ_5|03Y$qbZvluN)7DscD<;pii?s3WkV4BBvM-9GS)%^N=eZD?V`TYL? Q00960j4tXP00W)?0JaSR6#xJL diff --git a/chart/charts/redis-12.8.3-bb.0.tgz b/chart/charts/redis-12.8.3-bb.0.tgz deleted file mode 100644 index 2993243961019ae4eeca7f5267ea5ad69eb19dc1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 54151 zcmV)XK&`(YiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYed)u~>IJ$r9Q_RxY6T55b#c`5WyE(hA?Y6#696z?({`NLq z7a}1E#}vU5pdFpW_aog8aX;C8@J52KqGZ`gTJb!mu}EMr00x7Z!C)rFK4HDXDT;Y_ zj%LBXJiycM_xmsQ_vOF+e!uwdV81{3m%)C2|HbpY{`2S0{-rBgAkAMdW83GeW~5-0XEw6s133 zbo<@GUdP7~4t*SY1hZksg%Hi~5Ij1Y(Xay$d- z*3*A?063aRWL(hi+!WT0X?oCo-+kZlG4o;)arx?PghOC7i9Ngv$iG3MhkdxlbN2=X z2?oY#jJt5cfiR$Bjzfs?7{@X8fm1*X5cr5AU_4Gdp2Qd!j&E=bjD#K*kQjI<1doOs zkx-N);e_qN6tO90yATk@*)A~58KBSyMq`eB`McYhQZXuK049V_labwVJtjRKW89k| z#&Mi}lB={sJkd=9!5%xrL>oQEk$25h=^mL))L*WA?e6XM-|s!!??&OIbB*V>H1_3e zDcG*)o*bu+D@Q@j{R|P=RUFHrc!o$YH2udh`)>=04(N&hR!?MB9{Vxz{@ce)fSaM1 zldwCE(+ar{9raFOrDjvM-7s*5N_^^F^nQ2H@yP@;J_I&Jd(U4CzaEV6 zzSqYizmL8ieDi#7fA867Z-4K_*ZAwb7vH?xdo~z-?e$-N^UVO`7yZ%Rv(Y!t`{VJz zANBjs&|YVPLmVTH{UJDe{k?(P-*fl&FZ(Zs&-aJ>{ciu8Z=OH@`sLn>|J(Viuk3b@ zTK|&qvxgD@o7ex#!HfQWas5AkKG>}P$9T5jTQd0;g_BNaN*Pzne?%rD6i&K6zUdIg z2^G>94$&wO3vY}9h9z(CiImd-w!lxY5Tf`L3+538_&wosKru~1ANZ6oAvKK2B#EW4 zxhqRb2yjDUo}fSqTg1acI`avWjlpORJ|3ea;If?(4gdif;eZX{!=3zT%d_U)1aW+e z<_cASh{k*fgXjDE&ouIvhi3x45PPyB_%wXVVTx`rh(UoVMm~;(WJlpEfnSXONJxx* zSzi><_&%T`6u^;`S%A#Y1Ve;kG{YRnOq4haFk*NY zLdr4lDdK7zZ%GgUy}@xzd@P5tSa}yn=mm*S!U@>?eK(y0CGjRq)t@L-l=Qc?1&2u- zw#E9PXoj;<4<=12TZ71ToykWpHhAnV}?Wiw9wOG zuXmk{a2#TerAY5nkM$CUV|S7eANOPfthW`#*o~4PAmPMS?@U*s6xAUp%v2k1r4osP zU=GZ5E(8?EXbyB-BFC;C2lWeP3F9!rFhgM?VR$hXQVNhzt}ww?S%f^?t(d!tE^)-J zSub6!ZbW@I)w+7352{;kaXIu%KeuF0t;Mrdy?g|@Ur0SxjD93kFxi2W!6@}Y5)a+bxEZN%~u_U(SpKmp&VWBYrb8$loj(MGjbr>WBjT~1sbMH9Vfak9k&bL7zq*hWxo9iLV9QN5 zvsl+)pn0vvBjvX?$JI~>)$cQ2TMbeP0E@Wo%KSEMXL-h}ducP@J=e!0fSGIygGM&c>bLByTqdnm(HZ2AMsp$*J6?4Iv1D=F-QFn zOCcnJZ68jtcYR4_m?nG(&pQBrBs5NDg4+T3^fo*ga~!`RK|mPxXy~&c>r`0h)sb3b#`nf)`*E3RWLdA2T>P z(>v`i;-gTy1j`1(6>F8HGY%EV8nAtSd~tj!gz6nJSttn9gb9cWnq{WqDk&wS;C>pA&$CA?njnln{3GK$q+BrF5vT=;OsbF{k@sMu!WSl8d@^e~A4!N5WKAi#a0dX}qNtD9SyUlLC2?ayyNJyY9wki%MM`EK7JRSx#jOE-IOnsU=-T-8i(%c?Bj z?3gZ^I%nebFt4%doibglMM{&55XXf2g_m3{$iiEecphf#avEbcrGc*&rdq~HjIH<2 zrP87M@SvCtR=~_l7^kz>xq(x9yZUmT$6S4q;!cS;Vyun}q;`&(K7$F!jPN3DEZn#} zI*Ss?xAhT(6g$!;Qi<9$Wqt$9@Jz}Zd(U6IA?aH$N`^4#_h+@(UufwtifM#nPBN86 z%Z)>`IW^Vh^9bjJhk1mDMovCCQxl{sompI5NlQLq>ZRfAiU+;tI2OE*$7nnz9z=4l zhHc5_nbopj#IGsxzeRzNTjQPO_ERJY$3>CkFoF@dTAJ^v9oxkk6*r*BcSpJzDPKrD z!imeL*!2Q}L++}%a!F*5hyih_I%DJxJw%G`=%qCx4~61w!lW_D0F{Dcad2`p!YK%?KvEP9gZY}r$H2~$ zh&@nMCc=UhF|e>dIUAP604+>NnL18Fp;rs4pqXHkEmARAO6e=AQc;YL-(&A^Cb*~L zm}ZP@%c+aae5ehA`Ery`aeP%S{as9F!}JxvnBc%a$7B1QetU-abeR2V1|x?Z{Q6tRmJr^c zNDX0bFmx{pl@H%o)s^(zx~?j&>Ze?QU?pGvn9`(S7f%@+(HSBk2>HBg*&o#FA?Tmo zfO;tCbTq|ku45b1L?gFTEQS{loZ97pO=%MNVzp__B}KhpTGk>l23>JReH=(SilSiN z)v~wJ?PQf*xdb7iLTVRdq$K4y#vWJD6fac^#FF`RM?mpxLzRLj**Y|nE)iI$0SX!o zH4;MT*tLpE$O2fzbEf!lOlOiqDQ2#qY!^`lA2UuuC5j6qcDk7%3Dqr&y&Whda}956|AQl^)n}lUus2IXw+h43!v0-K{r(jLaGKtbY5G!gcc@e z6)8Z3r7DIG2{U?F*}|uhk_;y0w7GpqFjl>XAcc^c*}U_TU^4{Gx|3@xHjRlFxw@9C zYYo9+=)a?w{sViwE6eHXGpEyuN64!k=JRh44l_xx?H~&&oCcW`cb*6xms4F# z`X!C2AV|e*L}6|2(87?}%|*r3THpeT$oDZ#BFlmRt`u`ZrgsDVHYdFr$rM~kuGmXr z!sk-7BiO2RgX2-LLZZ*!a!>^aEEb%2xSNDgOm0YkC;Gfhb-=LLj0Hs07wlT%A=p00 z@42#ks(1QTm1TF#vRt?KN z6q$4Pj=equP*gKo^}HTGu#zHB+p&%dd;J)(SCnyj5p!Iqht zEe3tpo1z$bvV0ItQJBndOg!zO2PDt0EIbU;Dh+7s12sh?QteRQg0AU@OG9@|V#eJ# zk^PU-&O7E$#|#^OPne`OrUaI4G6`vnnUE202u)ZzJUgAOw6qpiHk`&~TQd-VS_lnG}J3}FwVBdfj zz7F@o*$jkTQeacs~flw6E>Urh)kSzO)-oS*;qECyIbf=b6 zwqB*dF{E5<_u}=TDwU0l1b3Q~79`b5F9pp-)Hdefn5!L3ZYuUqL%aswVfIZ@nN~7H zmGAV=>cT(bd9lKecwSNGps9_+gK`b=#`H%l&Z8fc+XI7b5(15VHJbWxM|>V3p$~f` zn&Ma)2Em`6$vPQ$J+nmu&-;IL6ayRudb`SQ zoKq1`DaY_TeviH11#66AzX(*YgTK*h@(~Fa^%cjnKwB$OKcv<_q-Zj=^eLuoc zKBQS^c_(@rxZujKPVXMYEXZ0+kZiKvhDs=R{x^SA2cp) z%WJ6+g@6KSxZoI=H^qJu;CL5schUuiaT;GcOSu#we?~$f@Wh#EJ=G9qNx(@IU^i`v zS^h-n%Tu+7S<(laq8R%S#Z(%DGSdhNg=j~8iKCFFY}*rTYuC;leYBXWA8LV#9fO2m z7JUYGSNq3g)~K_SqgR7sBgz;dHice<5{5IVh{?0A6k$Ot>LW&xv^M>d&PGJSWxEor z#RzvTv&Lu+NS{=J*frHrq-aFS3jqx$LPVG%IS}$&{?x2%kE8VOlmbUS zuG8Kk3FvjBhEQ>EgD}UO`0pF@V0B->HtQweU zql&V&Kys}VX(Q8jQahrPt`;e<&Lc`f?pWVPNK5|ux9i!z)Vz2BQ5JHu$`mJj=lt#? zj(>mWz(<(GID)r7I;;5v)QAPA)W^VZfIUuQ#YZ>|us$a8w7qXZVuG|Q%4!I-DkvqnSC$UAgqRNFvV+bD{QL3A79L3($8G?gm z{)>G_`dHW_Ri$khot64Mc?OBbV?mbl9tt^e%`bz6`Q0>IE4e@v>b7x!h&DbBU#yQq zxN&1x-HkyFq5bwklFvB`C(@+g4EkO9zuwo5IYHO5sbwkEhk0cyt2Avct#4(fUsu^r zErl>|?X41H^wDL6^oel61UsWiCtK%xIkEK@&a@eqB zq&z94l}wMhP>ZBdy*xSkQWTh5Q6&SneTz!!c<`V0tG`=yw1(xlPE|F>+0{!%kdZu$vS~nC!6ZMaShTUpfr0Ok=WYye~Nr*&EP_Vp3HX*2i6mPPUSTL zU5ds)!y_DEj;*_(-G$ayo^Toy6v&tuT&z2L%k7O2Bc7XnVwm@~649dAUCnETGuyiL zZdk=>tC+C_h%a+*HWA4pv&_lQgo z*JndRvln%ZEQ~;Cj7V;N>G@ShZ;dflW_sxxmL6_NvlJ#$$u~|?K;vDZsHZ!@uG+#$ zIK?p$!WdVWVzr)Qye0(Nf*8 zyi~M{R?M^WA={?*g`CfB&g9iZuIETTYfJ5LxwGx6ljGORoD|>h81=&V6s~9xv;501 zq8KAz2n0eNBq3jeu`-hqBdY%6avITqPUbF??YUmoo^|r)!VJB?xW>22xGy9eQ}IVU zAEvh`0i2~ zhjxShXM3JlgPMN5IZ@o4D1L?~ib{w%$LT$!NA(D*#%9@*&2^mwelZS8RqBKfnNOJ< zH)Z(jtnP!BL9Q}zHQBZ{XDgetmCf18=4@qiI`Y>#9od{|JkI_7vzX2>pW=kU@p~D6 zEruSv!8|6Ox?`jMtP0aw6Jf3@rssmFo+w1YoD)w+=6A71MQK53GK4|*MOSG#mGLQ+ z_VHJXf>w@IDY4SC2WAu>A?}ZoFEfGP65u3Brsi8IS`-niy+v~nXP0Qen_}U=ZU z8z{vrFEW=bP-F~qnmmn-Y+G@~)}t||te3Up(nx3=ax2vm+8Y&Axge`%fuM7t5G|YG z7($GFefK=f%t%>~W=(Tr6a*vWU8lh;GUj1~oFoh|W9C}EhPkCqW^Pa*l(lrd+E=@B**l31| zWY*ba#XEP9;qYTJ!tf}Fn1#Y}qNb7C(g@*c%^?VW;bt#7nKmQ$dbPc=G{%ZNNs%j^ zr9lYAg0f`tx_jpJi=a0O=*V>MhP#}^Rvv6N!p&Sq~LUQQ!mitU5cfCQ^7+4Zxbxv!JyHs!&6Z}P9k=Nn&b5WwZ zMiI$HdjS_vfW`JJyKzKsLyJW5`zY3#ldh8JgNF3V`S2kN+wJ7TY&+0}yE|8l!Ok7L zdIfz82Kge&SVfF_ync9u2vHp7w4?XnCl6xgK`>WBMW478% zdsmG!o_OFE2 zaK$M{!Ag_=>+{)fJMecX&-s9Tc5^;OVjGkFmKpgTcCPK#s-{~d1=JdJfEb78Fe72Y zjX~K8c2%#jwLdl}xGffa5zXH7m-H|EiKW*3*Evr#6YvHz4k(SOW+G{yob4J2(l~ZY z7={3&8w{fWh1Z&hs+`*v_{3?i+LMrQD`%peI7fU|=EO4`&xo-GA5Kv?QDMgDZHVL4 zg;s}6(kCGD_(L9_O4D!}kV{8H6U~=_SA_>!F_nS|h{dKj2r^@qGw3@TTUOhM{&}ks zEEi;Yu=jOkkZHwh@`P6oBA0p>4wW1_rMICWHF?lArh$)RB_M@Hj;)Lk*GzIZH^RBw8#vY#lxcGpzg zE9#5oIFpBD3B&QTTZm3l8CT;)9#~K9v7{4R;7iqTi&IjRB~YOhiF=-LL!gSX$+R<{nsw@@S$UYCZ!+?8zus8`aRZmt~0;K+m# zI{MZ=PT!Ty*oXQkh%xf#hVzQ~V`77GRG`NT6{}LL*EHs%cyD}$BOH%uJToyZl?E-Q zNuGiGf_?rd7@8ICa$6Zafe9U#%#^l?ZYc5L7R8|`Bjf2QkSAsXC~Xa?N3pb#RPPRL z_6B=r_>1S@YRK*)HuN7T;}>&g=UIG+9b#(>&a$Pg<3$(a47PVJRsyDUDo#U->UT11 zW3j1*AjW01+J@LwR(I)84?baWA_)pci9f-uVy4#lN@u{B>CRF5>RSoEa`ntecwqEE z<2*e>?|%xB{q|Gl|IFooW!@CeQ1>5qo~cBj5%p>->oRPpyJT1@e*0-wIKtP7&jeS;BajZKN~#ax(Y$0gdmkY#9W?FH)nD&&1ECf1s&TMpE)u(To8^eC!=8j3PjKv1V|k(7gjJHP zc3rHP{U!>?QGv0xm?5`H-F1q8<>^C>%u?i$MqAW5z}UUW#FCKf2D^Ys9-A{u!nVS@ z$4d=<4RTOV$FPW&o7#ganzjd`RJfX~+q(=qIe>QsI%4FX#leRLj@d8?nKP^axzu>X zIP@hYIxHZ5VQnci<@+~848fr8D|+up>9*$kPazSD+WDT8;nyrdSg;JiUW)q6+M1cF zRSCJ32^CXfd5kvAOvTcGx|xv~MYJbS>Rr)H7)2k|^`c?{uES>uPNp`4Wf+-a(@XNP zRd(qb{(Sf7%#r1Kyy1---e`Y+Xx=EPZ^Ihfpt4@pSTY5-VUwRiu9t@usr8dJiuU^E zS;6EllSJ_};D#~rM_J!Z5_EY2pbycs=bALV>4e1EU^pfr3hc~c&LV+YAE>t&;i~N= zBZKsx^Y@`bp(v~*!57HpBw>$RY9*Mm}(6z=MKEg z-uO`4S;P3f)y{4vnvlVI(N2~QWxk$@Lx8;NbYk@WR&H^*U1lxvuR^IMXK%y9I^zF# zpVU73XMdFa*LVuC-s#)RJ&lg!QEV-ILG$Lap3OG z)D9_6E82P4WC>9Kg+6TCrE)1$%^~v+Y*&BJCI8$JU_0)5pAP(TaDIAn`n_^Q`Zhhh z6a(f|492VcScneV#$0t??#N3bQ*@&?!5L*-#;pkEdLQ-W{Mb3&lv9^+mI~(b5T7Po zg(}Nu~v#!GYyNb*=yKpNnUD9w8%z-7731&LYm%xwR60TC*IH?nw1KJDF zF~QrME*!8lP5`;VyRxz;g9k8bL$SvpcmL>y_+mT}+@OH?+35fcEsKBVTGd_uGz)^o zp>Jrn{HGylF`q!!E~$P~XghVMPjp&MbrPA{O;RTkNerMuok<}u zKd$Qg!_K;y->*|cMZWde( z>JW#DuCvrbNp&7v3jbg<6l&iq=R?;=9H~K1GvD4h@KI*Me6bI%>tm1lcqiBAOKQ@t zr?;o_qKuq~K^M-G5KtjWbSi!bau6Gbyv(LN$cH61%>!ohUjQ(J6DQ%yqf#IUoh9FO zV=UunzIu9!Z*cq+To;EorTNMK23L8KRkb5On1MHG|G;&D1sF#_LLF67^y`pDb2XMS zXRMWKHOtTME5b2D;6?35peJU#$7xS>v@3wO9+qK`&mz0#Ixx7#^VJZzmiOsbZ~yRM zmEP-Ga`1oBvQEa8%)D|6h;yAavU0*?R7lt5d=4&YPnhon3`;(((Uvl8s$SzNX;iMO z?mV=)bEMGG(%d_XBLK9U2GqIa6Pj1EW8~Hc=zFhH58xyOts`! z)?8`Ezt@FB&G<7REMxD7uTRPxyh6~<#;8fwHg_atxIlNhc+$a*T1(%}bB>@e!|D9y z>*aSRL1+OJj9zeR!=Y^B0-evW~It{iLHVk6n<^!*FVsmDisX$X&&HA}SMS z^QpQa*+R*(cc6}mIjO=5<+KM?Ih$IyM!^t@icm_F>PHjKh_9{O+UzBStAy7GXKYwD zd1ofhM(g+8T~1p&eS36#b#hiv(`0=7mO@Zo10x*I*suNHx{M>9urBibSm?*{o&Is> z?37SAdwYIaKw_2VS%kf=fGXQF88hyjG_+>xm8DS3Ey^c)u*B~3B*nV8`G3BPFeA$x z-QOGprUR*i$!CMW!?0o^%v=DA}wH&Xynoy z!qc4L;Kpl75Vwn`_-SqlTpXYOd~#T^3R<_>LSAvR0v|pIkvEpts<%n#jC{BW;rU(n;4k=xM|A%;bvhyJH&PqS$XY z!|cZEwdEXj2EbvRVeoI|nH=oBl-Xzog?Y@?`@&|gS`rAoAo0@ym5~Q^_|;1^VQOIY zW|uE258n{Ssu#N8r#`~oJok8t{vTIU97H%~T^A*qY()FCg+WDQ0!3HcbDe`D^y3Fc>aLjC3}3cW zyXCWS^D&)rQ>L~+E1ED0p!o4bB0qf9p6o0<({WHxaw1BGYwqpR2o?z{2TirR%tEO9 zTT$OR=1HuMLs1mPG>VC&u80__6-tEG_|?_@ikU4~1k%d6Ic9ivgX2Rwiv%q?e}6UT z?z{b6_|HN2rP~)P2SsQ^0>TMqT|vegO80xhi)%;@5;*uh$D#D%?%fPVn4>|{pr(kD zaMHd0THf%#88i>sqG6IjmE<6mA{0~%R4L*?*ML|wRD=Ch$4Jdu^SET=c)!uGiDu>T zXh}Tx9g%hv(@0@$Mo9UW7xSE`(EK$lQXiM39LvNIIn|uYa4A`?Yrfj$P3V=n8s>Xe zhoeckpm_NaIK5Dp)Lpab|A2!T>~#kN;|!*Jbh5lcLJUAU7L&XOe}iI~`Ok!*RayJe zY%st)8sXi}DB+-iep+H-Xi;AH7 zs0P!7cQHjx@r>Q~{*4VK$8V}#oLo6^uGM@>#LbQ5iE1%ao7C+V?gf4IMU)=TG_9ue zG^*`_%2!xwWtFNfTw;Y9o3*xCYoF6v%N7=F8$+_WUnIZPDoDCi>s6O4zto~D)?B#e z@)b5qZnNY*_a#@j&Z_RGy7u+e=EYc!`q*|^*3?{Tf!4!VxK!(^ZWirk(S9C_RwlsI z*&1-H?4-43FCMT%Y}*af8|ltr=94R7DC-)_O33)!m#;4bftq`?xkDq-{CB42$F%P~ z8u2vojk4*Bl43;a45m%}yT!Ai5Oz}BCt0x7;lduAintsvDeOKn6iow2k6AE?5obvEjJv95|XYVn@bu)JM3C$-L~cj}-??5lZN3fIwpIIV!xj@kE^YkJT} z)#^@1EfLsPJ}QOa%pre{;T7(B7W!KK+5)u1z*W_%9K-xQoF(j+)(sn7xo$wp!1XomZ9I$kyeL29 zEA7~#N@K}#0D zpOl#G8}|32W(nwl=(&NGt$`FJi|>XV&0#0FO?5*?PrMlWm-9%nGd_>-+c9))(TI!z z|6vt#W+?hqMdJHS=3yO6r$U*XN!Br$uRnZ{4yIjjlt7Vzv@QhLrMq^K>c9_rYoc-C zG|h_pUt^H0Dq(Zos_%7nl4$vvsH|A-eWAa381)@m9#&n~mxt7HkQPEMF}uw?|M}F{Ke4OkrKF$2{VNAtV7^qj%A{|ZOi$&WW>$;RA&g> z-R-2oTtX@}bi`#eMV18+im^v$GaUMAk5l<*)IHGR&?2$l`zrl4;P8gTRBpuG&cBmz zOw%kLKJ{2vkDSgpYhpN9(C$F4yu~0^##k14N{-msK(g+FKHNL z4BPk*>6_S4Z6{Z+s6W^xRocsU&O65`wPg!!?ch|XRgJwdB-E%>StFz=#0qj;55IBD z762-b-)f`SJeJFj=xV*U$GCRfo7Bz~$A4WT|M--vUjFEpx zL&jr7Le6qWZ8^{;PH6VhDWfL}{)3VboOhvP6?Lr$nrT^68PX|z7yf+k`lsUy`1#=V z$}F>ohoa+7|NeYvu#5|2qDELt>tw zz=U+U*EX<#|L^r*?iKj|%a{F4{^v(|9)bVMtF)T^|E$PL^S8QPV8i`CHTQ4ky${Ox z*UI)aW7ZtKC}N~+x8mU3YEu@=97H~R0O-O;_#>elSM;2Fk!nun2{c???k4T_57Sgk z6OK)ND-Yc;)d1`*s%D$2jzX5!5q+y9`N}X`_9@$^=3JX+9Zzxp_h>jKlNpL!m5+|C zK?7{w|M#E2Eam@tvDyD0>9M!(8?#FvN+NiJqKXZ=MR;IEIBhoZ91|^U=52QF_B-|z z$AqH^Zro{gAf)O&Tn$5oyi^QNUh=WXMI@KedCg) zGt_MzveVI@$QXY872JP<^JII1Wjb4=_D$!>561^bua7S-u5_qO2R_0i#t}IG`{aXw zdFQ~61Hb+DAHb(LwDz-G6o(Z6vI9MB^^>QECuiz15MeTH0vOm9yjUG;4)m)rG1!M= zTGh@JF__Ka-+lbG%|P2%%v<*Lei36Wjvl=sT_k<1Xq#S=KT2V^~s?;4Y+#q_UQPPPWj$h zne^NnL47$=2B%Df3$Rd9kwRlkI=00(p9M|@J~~uZ*>0SK2ka+?V|l8!y||c=boq{o zN-G;l7>>n&X9|EfrMDrt=Q_cf?dw%K2b1>#%cfy_G{a&b)2r`JULO~S$6T?wLdpAA zzk7(olMfZu?tZTt&MX&(4JJ31MP%L_TwETXuZmMu?P}BtB^P4oJgKG-2VT80IUvil zUB??i53aZ*|vIgF40T6y0Ez$5b90 zVE+qXC>CXHn95^};yM{iVM}e`CS^5g%TTacwaDX%OaLvH@2*yfVmd;jU=A~kLZ%mx z5bDK}lF3;F(aS}zNFI<}9W=x+$J}a7tSNaJM)D4m!;1#KEXz0vf-bxbJ**m@N{=LF zxQJe)a<$2X4?OX%CCm`t;20RjW@VOo*o9w212h78BS$D5K|pT{pgEPQp%B^RmjYuE zO-cSBxdQgHoEZ2$;YHmrFXuH2JJRk@7IoSPI%(B~z&jRl9~Nc0goE?%FJ5gst~`Ep z!0GE07UKQC%MUzY=A*ru#ddR7Sy(K5cT5B$cdB_uWwmQOud0%t)FKsu3hB6o@^W_cDBw-7{7fl{GX)zB&^QB2hhD|beHF>N8e$I#X&fmw6fN6o1W zpHtAuOfsizgIofRtuhrRWhp3zBULXCWp%*sd5pdb&?M(mQn(XZQ&J-%?`>v=;`;Sr zO-Qx3bBvGQWAAY0TgWt&`3RvoUtFdclgm}tkqKK%?PP@nfr_5~`rp54fuKl{5`vO* zlz&Q1l@u{$V$KpYK9rfcU_ov!ETc}Dc2n6#(9ada+%hr)1k^(TxG`Mg`77tihr#f_ zz6_sPFCns*M2kzpBk6%&DcKQ|H5LiOb7yYQ*= z92M z96LMf!rRbsyHhzOY&`f8;kpj~)^qN+1&0AfVY;ParXmeW<3tjxTdHQ>WU^OPoyPJP zkPx11!@c?eAHhqwU@`-6eRv8_;Ugp=`2%+T1ALm>NhGo|50u7925rb8ID{wSA7`QQ zGqpoESV7lksFS0$iiI_uK@VGg6T<+izsw|~h zt}~d?kZ>BeP_R>uVo{k>d}(b5P9+KbkyX}t=1^`SX~UC2UGDb6rdwmfuT#Ib1l7_T3=A{;;Rz%T;o6{#x&R%7TyU}+AxNfD^D{aDHjKTxBd%EKkNKV>36xF3B5cu2Q zzzxB9a&op3;iW$pQ{Ks0BiptuG}=0o;$bZ%g=(HwQ)Me(u0ju5a748(7lGUcTye^~ z*kzzbAZY75P%SAe<3vy?LoDSG(8}i^*G!f3!TQ|_a!t1PFUbF_;)x4RP^*erhp07; zm5(=-+digvnKUYrP0Ol;U5Grv_7lNY~LS-ql5S(lwR6{$^#Zn>} zBN9-tTg>MAZn|bsE85xDJwgi+&Gfvy!;kXbG1vAhHzN2PubEW@rmeYW2A|RCJlylX z)q~u&YK_;%=lF~DIsS6Ji7T*wc<$nZh0G5+1jG3`O4NK)2!)L z6l!#qt#4<6vuvr%MLDC%I+xh~i4c?V!)(W=}0DYrWW0+sY@t*ONcmDMayJ{i%)rwwB1> z>RAx~_1TLT#rUt!_Xc~L_-~K#tUvzSpEK^8wk1loIE0UGF&j|2ZZdxXA;7yViK2jD zA5?)P))73@aQ~(H-Qt;9jtN-Wq(nnB<&(IjA+AmdTY$TE^I6b^611kCRAb^3CZxhc z#YGuZ=Oe8xtL9SBifb6L&iVKjH0GEUJ7~6t1tTqs zEgI+|tR==-Rc$rQwMADM<+>B)yqayF>*i*{>G4^lw!{$$edu@P|Ktm)zcpCm)eIGU zrWSj1wDf4{cOT&bU7bf$vzJ!B<37C&T{Px6c4s6A2-EKTZ3d!LKma=su-@39icOl6 z57+qHuGE%+a;bq7TM-&d5a7UN^UzzdKL*By1kpgRix;p#Ytb4mLtM0sA0+N_QT{Wu z>I#xvlL)vd|I4%I#r!YNU+it-|31o7DgV`n=WoyKJ})t_QNn8_Cz^=zd>-K;94Zcd za@GOx%-=&eRepM{cDpDU1%ypcDL==^pC9;sj2Xjh2s}=3F{r#ul4)YWtGVD_r-J_n zeCn>%4A9K~2YdZz{bKz0{r!#p|0vG`#D7;L^m+0B^_c-85>Bp!sz*Z1*p&=HqYee# z(y3s*_4zvzq|GjOnAYYft>j^wRXKcpB2N}xmHeIb5U_}b48MA^ZFsg8yIls);K=~q z>Gzpym3af;PE|;rDPLV*f@FahnV?&gFX7+FGB~~%#JYa_hhuF-!RjUFK zl_e}OOv zs9@mg0-@mS409kM%&$=RzXga3f^YyUs=Co?*7U^4&`mplmh>dD|g(ic|A3|tYA!aNVD zBFxjWR}ufs#NOJ4le1lk+b%rmn;xoG3!N;SiWKBr+aG=XEUUpqYY7LfWf)ii(wg{K z#a;e)6^pU#uhO3H{bg9$CzN$J#J(Z+FND}XnY>$V3AsX{U$K1DE!iud#IKwu+dhe< z52Ev=Z|=Yg*jJ1rp0HQySl4-yRqE9kT^vEBA3x@5Kl!hP)l>W$>dVePu|8BQ#1Glu zlIp!wcgxIdsos8SyX5A1oTq62pJ5&okGWAyXP8fMvW5h(i}Js}eD<=K|9vp%Z|wh% z@mQBu((5Ri2F#AUQ~si(w!Tr$G+DtyK6veHL&8bdqcNte>(N=Sc+9M!tmtc4bR?_B zFwEzTFPuy)RX49^FL%a~+v`8`18>N=bU(Sq^IcF;>tXn6(U_U@Tgx9?K!CeD*`9`z z8=K1f?Kt!!NECUpzgTy{y|!u~F_yDU!inWV zm%bV*C?+z9M`tq{c6k)sn1lS#$FT$3;1iF7qw@+Z(Wc|6t7Q&6*|FS=Ufiow>h*cK zYo!kl)4_84OLa5vV=zP9o4&S|Wa~xQVzEhB-Roq8;}CPqx`g&TI*VwCLp}sYchIpJ z%0(GH$yJOKNS!m`a(4sj_Ww1ye=Xeq_nwvfzxH1~-|YX7@zktzOLV<+bYxH1H5xmU zq+{F8#I|isY}?kv={OVH)=X^M=EU~I{pI(*_m8{Q{cf*k_3EmwQ|mO&sr_K@!Zqyp zsXg2+L=GGLc#&SC^+JZVp^=knyP9(J5ID=AtzJaBo3<%VP6aZu z?vE9J5O-aOTOldaE;69u;~a0;LOGj zw?@)2anG4Yf1W2%bJVWPs$TLakv4m_l`!-B*@{Uso<A%y;u_YwpFUXIAc9VsQPA7RXH48X2uI0y zO=3}qj6spCVInZ=8GZ8HE?8Fm;=kk=xhXb3{R*gY$e;YHj;0J39>oC_e$c8y@`8&8 zt@OvE>O-CcT>d|y@bVzht1S}>I${3V0vTU-TT^zQKV^fUg*XmHh|b&^BQ(%X;7hd? z$ot9eFX)zL=BLZ-eBp_PUtZ#98%bj3rE&1}h|afBAAcbPIHtq5IsJcf|2}9&Z>KEi zs_J`x92w}d=#T!3T2)X6p5i_ws)&W5x6HNLOS4ed49S~hiiiJ=U7zzaxuk^%6P$~N zSmort>P1JKs@qG1Xz(liI+HbCa!`fk-U}#(47787?Kll0KBSFF#pcCnX(jPum5hd8 z%zT?jm8Aly^NnJ^H@b%oF*Hwk2hXt-Gu|;!aZ&W5`%Us=l&`9=NYa&!W%x6D<(x$s z8H#zmQW?MV!=tRKJz|BUXOHjK&I%*6F8CFHRn@mnOwPVNX_ThiCN~WrN!^O(0S*mw za|q0t$rcoZe6dXrdcFvpJSFdZ03%LIf|-kJHvYOmjD-`_|H)d)cqlsGytdGoi?0gHBhZIj=!-`vDP2k%sT&wfdh zDNW%=bm81TQ0Gec1&HrINZ^?!f*6bmzgS_ppQle-Gl#TSptIWa>Fy!!eXndNr298G z=&3hQ0B9{H1hiuiSl83@6;J#-_a+o)ydg+MPw?&fpa%=(LN*>m6P{n_vkZ>c-z7WQK^&Rk__MJ|9PNwjHs6kI|7&VUMZ+G*AKyM-*8*HssurBT*3OUz47tPr$kc?Qe=A1BABCl zH;wAW*xdQ0q`h-D4|9d*;I~6cK(&W4UHjm&4i6mx`o>Kquh*2kZT;`r9NF04lbyhS zD6XV=i7dX?K0_fIG8gW-1Dkaz2#jFdowS_Q7P=CCJVJuL{w`il-gi$AXHy$Re?w+6 zHmwj$tPb7O&CYf8=i~d-;tZH>6geC;#u`!x%or%BuoBcnt8hYVh=MCydnVd)Go@NS z$aC}lI=|S4Qq|CExh&H`3*0zjsY|sA z$uDTFNu^o?sULA-7&98^Y?r#`+=X~6BOc(fm8^XKm8ZmLt~s~EKtf_ys=?H*JMyus zzNIZ>MEq^S_7Uz0*qXuH`1d}_YDTG_jkXu+4SAu>be~4%>ISqF|c&1_byPU>Aiequ1s`DZl0lK&B&Nq`< zFSKQ>PGr{d3uV+G|M!iUzs-wRs#r=21zusfIOWvw)Sde zcnntT2k`QF_(eJU?&>Jv->BE6i3*;-qLISj|GGV`!z?ue@S6Y8Ny}AgE=_PC6KCkv zwMD;>(bueq(w}SBLj&XJTMupMf;vGibYS`;K6F9v{8;KdVTUG@*Db}ko?b2^{62VK8 znBHO1Nk>`gCc47e>7)iF!PWl(D+Fd_j%-7(&CujZZ^Gi2V{ zzcH*Py9_Ah1!M5QFngFBC1x8koF~UJydwX$Le<`2Va9O8{{4~Z#gt&UgnJC7Z^f{Wa9{y%<4En9kr-#4pJPqDRba3HW?2zD zES4mvOf;{a9vXKf=9;JMfEuGOR2zmEYGn#Sp?kcRd1p)G+X=+?r@r&#P^$0i5Y&f& zv9;rcR%^avU5!;d56-lM)X8dCDXHTnHEI=;0R!eKp6~kAeb{}(puDEv$LS--;~q4~ zwJ2sq)sEMs^0gW@gw?C6$==QE3y-2(kTHrAaI%Jr4)(b)e>J^*BO1LYq9I^ohPznc>`!hNZ5MK%z|Wm16o?E~q}Q|5KXNP0iEbubrPP}4b31i7)^hamp-Q}xPh zSdsc_O-WJ$E;k%kECTei*6iA*WFt0ylP+J@BQ}G4Pd}?{J`uOzvi?+@0(UEG>2%D( zG}tN`v@85IZv}}HQ~*v+*|No%I)?WL>rPlowgaQ16>q_80j!o2$|1n0q28rAkvjGK zkRW7V!$mPy4E2?s{q-hF{BwY@2-dg*xM)vQsSC4<=SqIK0IPuBRE$;yf(CaE(MossBg(GB+woG## zhxRk?EZ+M|)>E0f2e&E-rqkC&-rs9)Z(D_JmsP6OT}KKEO-hPx*%BYpHX-r6x;m>F zrF+y2kh-At0}IT%l9ns&k6X;v$Q+IEA3LC7*|etncxLlrJ?vag*XqroL~rlz9-*Bu zIf>vV@;4QoX@rtcRc-6HF!6O;)a2s1t_1>B1aLL5P0n~Era!eij1aVh&#iUpO0(<) zvh*ZQTWM%Pi07!W5QKE+GmBQHK+KY%NO}HLi~%! z(u>B00F%)cJj2%6^G2bq;-5OWz?M#)(olxI@ec8D=ziH-OYCd+rgoObr?{=OjXY%A zM2`!m7IL}Kk?SHH>`Qan%H@@ko0fuBFGXcC1o1>2cd9ax zxN-bgSzS+3qvcvOar{tO*TWqzb!o9omZv2#hPmK4{)xA-N`w_^Qj+0yLTKqOk7UYSB2bS4BoNpN`f|4)OK7?i zK}35MESOm6p)IM1EBFrzz}-A0eum65NVm}RsAo+*?qI345bBFLn_MN}S5we8c9!=lsolnN??fPdKk;KZZy((zj;x9RM^>(cJ z1_Axid%JXWb(}MRY1zKragFQXzWKftys8#~!8nuHcQHH!_~|_p9K3fW!W*zfL+pZ=?Wy)97nr$8Stb2{Y!4g;fiA+kU?KuB3KryAprjJDd2e2EoblJ`J6*C^^Ye%oG0Bj&zm_(fk6QR?= z^!eQLcw6&ziBa%%>nr1Yq3Nn1{@7(SQfdE-RMLdLGMF2y1jC}o*cDK=YFszhU|jA^ z+5=C|gR@%wh1D7mE()TH)99uWr_=Hx-OPmOi2#du47$SZQSPhxW|&dumG>N;T2mcN zzxmzAn7rQiKHNQmu{!KIst{{CkAoeS*UxEN+3K^&=-WS}p;a)OnnWCALI()e0NP-j zjZ^WZIh=9#o@SQVR1(mj3XUsH-C3)~MFOoUhn_oJQplI$0)?TwD~ZW=T>wc^yw!cd zD0ZOPtrnl?v%dWW_E#E^x@@FQ$kf#L+mQLU&-oUN7Ovi7yf^l=X95HitE8Eh`~21y zzXU;ga{q5Fm^F{3WA0gJYMZ)i7kVmhvdi+nMS($*O%_Dyl6(=gFTKlCXBJnM2HgU6Q`nuq_rjA$8;U#E8&mjxt-2EEKb1a092xbG5&FWM| zINueE@Z4R3Ygmeg;@X@{nW}s3yXSp$cnPFj~OLDDwa_wOsMX5r2nvhm|TBGnwxP`4uAM@nOJe{dr^2t(0V@U~W ztL}8#VK`o=bmhwp+?t-|JIZ{1SY`=O2raY1axvge?H>UJdzgpcR zSDp3zyEYvdEZd5>?B6`UC!*JW5RvpubbaqsS6)oI{n${JGS5wi{$+r5(jMcZmw0Jj z=k1SGUD1MTNaxzUsJcmYJ@IAfY5&ZB9fEpK1u_}x;&26tD43=B1g@FW&=16TuzXl2 zU2D!X_-vqM3SFq!63>}|;NtPd23?aV*M(5n3g?}eLD3JS$SO6+~X5k)b zve7P}6tcs|M;$Ya3e-hCY7ExUZXdx!mvj0ubZZ#*1UoX0pzCz`V(8hQkL4HTymaxTNHZoEl6>HEL8*Ex>(!e4D&zY{MfyDU%i=xgD{}x)T&_oE z*av-l)r-I68C*C%gNpbQMnOFqP%UdPSG*?v)(J!dbwBfmnfKK2k^^OPT6{k^&H?M- z^&WFip~FdYLiN-sqS!9D9c~zVRLU*45nKfSlpfXZ0|nlsr#}6E2SLC0fbP5#LH~tI zd-lE}fGM?5YZKiL)HD`g?C-^xmX48TpJn^Em@73drX4i2hA)j0_Ky-{hIr5JQ?Dqq zQ?CGFjyllC=Y+}UOjkglW4+GTB+YOXjaw-M>g$(8Oo%BwMlZ>(5ej%T_^VXNi)YsP zlOZp6cfySPa$6K3>;EtFSru1iyc16CgvR>zKt-5B$)KPTJ7aQY%#ke{G6h#~=DHN@ z@jWB$kDaQT{g*Kr?Jxt14B|CEpgmJ(5@rnY2#EA^I|aJFs&dMYN=q5hv_$4k!vnm0 zRfz9xgBuI6fE(AXE4J-R2+vzT(zm>}8U@|OEhEE}opiSj&ejjk=4Yt1Rt)LlPmb{g z-IA+p|JR%$sA#XM`O-CUPr3ls{xrvPbS*~Ib9DatJfWHz-%HwTW%D#rGb^EIHK-jK zE1GmgYr6cq$Fd%y?kq@mh}j`FDQ0ZYp6&`+l$x=R41yXX2q%;jDV%)=|x=MRi>A%RicHHmu}^-5B@eGe!7W`WRtW z;4l+mujM-k>@2ry1ie-pc48vO91@?uX@m=Yn%aYguMeT4cU7%9F@J)23#T5^PX|>? zGlyhx^(l1FjEH-97 zs0qB{=&Ab>{x9UB-Dn;0;5!kF_$5#Km4QlU{%7ED&@`pOF`7Yd=2xkldSrwaGOrMZTx#dB1Brs%labdrl242 zx0VTnu~B`)VMh1ELTIR(VA#coiMFrNll!PdBE;st^@TH`hYMaJjGo z1Utd<2CElxP`8so8YiCZMS;TtFNXIfyr)s1jJyk~3-ch!QFQ#-45$qE?z6^?@_P-> zuv$Jt_ZNmUzekW;>#ijRdL|1u53faz1I9w2QG#dt;7EDd_|OBfVPSFgGAIEJdn+)X z6RYOyPG?~Jfnw0Pc>wZB8A&UsCEtF$Rk*eY3bBfg6)%Y@5-m<*lc$ctNnp)1hslTE zBSZyhG$wszclv*_h|VYz3*lb`eh_>KBX{@B7z8wd9_3IHM&7=ZZ$DRz7fo$TgyQkb3ZEZc=!rNNd0K zgA)j^hY%v_M@qbr({Hx*TYMD~66E%A-OPDGnV0gjg4`W z#}M@y@Ny*NyKl&iF)?`YCK!8kQ`7#qcKWW%^tsWhUE-2BElzt;@oiBA0<#?h-7O+Vn^{@P*Vq=8CUN4h^*$^0V7sBSZ+$q8WH0JHGt9=uXv z-r!{43C<^mK|3INUr5$m)ZqqkW=X-^f@i!F?Kt92NphIFwjBYuW7Ooal<&K01f~Fp zXx2e(GUg7=a_~ag{(6q-!XehUrJ!9PI)-q{AewmwIHpNb?`Bzs46zO1b)FnwnHv^s z4mg*gAk$2rLXG#Ge}Hrc8gD{)8C(Uh3U{v;J3z*pGrjz!cJ`T2bgy{)ZznKaiy$vZ z8I?i_=HM-#8NBR5=T2jJsjh=4=a+APDcyf^A7D*wRUAJ?w+^;5KBD2w@NTpWVbMl84`eJr-NM`oJ|Hp&U#Dmy_V)KZFmLY=fbs; zA_yfrEE(r}D?KyHpLW;|mTv$87sFOxtOeX7wQRT$C`IzQPJ#r-Kz_cNeWym9b)k&ovPxEkk&}Y0UYQ&_VgGQ zok>hH7NAN)pwMDR#j%Vtjz_?mq`Bc)HiyGZBWd7y?7lxL&P^*Ke{)2d*3^L6u+~zy z*Zd)nFwmok_EAFBw$nOhR|vlXH0DB}=2KRiQx?YrQ+SaOc46j=Y3S4$f*Yw`a3m4znnavmpK zwv)@GG?;fgPfhPTz)O--d}r5di1mHwC;RDiuD zH<`0rV8;m0e0bAbSCN?az^y*&FM1c)SK_;3~tC)@v z6Ehcc50G+fW2%WTnn@Y98-Wsp9I^4HxT)KN?_bt~$6`#SHL;W}@hT$a8eq1+38DH;bcABm%7-U2 zVs$C!ev^nhVG-URe{0uJ0Y2UIA_Ea&7e?kZo8w=fLl(U6^0kdr2vKuU4=;6ROMuHP zgG$GDvQ>8-I4U>z`{XpDbJ~JDO_~P>k4b&#@~n+?;IBK2s7T=n;(BHiM4+S~ReKv% zs^0_iQHhx$+jhihu@0}f3Z7SfS{sLh>%f9aSXipHtx5t91=HH*^r{(Fo(o%&IJp9Z z$B-YJ;xkgY39g%-A7@zDA$KQ)5{z3v!`pXn&SLZuH)nfVs$wSgdaz~i&Us;hv2qk@ z>UIPGQE=aNG*vLg*l!u-0|jZZ1{fMJfc?B01O$1uvw9B)#dcmZ>Q|2<ZIPCC=Fx1|y$9+Zny$82!8HfZD1O-c0O|eyW>vZYRu&_ zdv@mN3bSql0~~J}g2m$BK`K>FzzDgqWhQ65(E(vE6pzq9?mTjlNmUdDKkIV>_K}4} zYPCIu)fF^`3@T>{ylJ_EXNR?{P`^9ooVI2xX_C%GTi`|OfDe2|mZ@P(rB+9GN0HQh z5%`vKkx#|NlHNQqruWR_He}l0 z7u$L9rfI-bTzXF}7!S7-Hm|CyH8mfJUos*<6KV<({6>gDR{AMR>9p^y+U~}Re&j-g z?!Ezze&92{TdbV(AmJ`Cm||Ig@{MEmv_|e4|1N`4dbFx1F8p~*{Z~f{u^c=Ct=5F0 ztBS1v*Fl~n)YOl}s`10jG!9^WQYS-k29M&ZwXy00yplIO+m$^;Z|0IDZdGZba}qgM{IjM;ra-bU2r_vEGG>BC}}USCv{E? z`HqhkJVTH`MKS&3zX*Zv(Npjc~jRF9ZZi>3Z zhQoFE*U|qf$uR91s@ZVEW+tup4nT49xB=s(PNMSi&a~U`Lt0pJA8Sr24HTw`3)dF= zFI5%)i_fhrWvnTNsqgF29jxBXGU2);S}lMm4=+yn^HOa8yD=m+>Y(DIU)Ht+9-xX$ zl958U!p(71CaNKY?dKUpiqCg*E8db< zLx<%Ckfs>b@qktC*KjB+Eo$WW3(h*MnLzsf;rZG(Av9`mSW_eEaIdbxPggZ&3ys%R zBOP0Qz0fcV;cW|2JvvYQ`jj9s#cxHFNi{-xNqn-v{D^Oh){JK- zVL3WrNiT2);0S}Qu{gJod$;t`WE`0rM(Y@WEH7ksVUu4_7KjE66=Wf3%br$<9i-TI z;zw#lqAGPIjM%~^4I&p2oj*}r-1WCNk-cV)bL$NrN#?%(rhm?#tVWaABdG#~wYnfF zf%HLy0LSr8xtfn;saVM{|NJIyvqz6*Wba8)Qj0?~TV*DZ}# zIRkXhoT!=?J6YD?!-^{Tu362mfOc5Yy`ds0%{P2g!4Cf+af!_xz{uj$+H9Gmh{?Ew z4**8JS#<||s5v=p>?q9StwpmT&QcA&IvSl-p=`qMdfJ*-q85)ps#G46lA2v$QSjoV z4Iv^WC+KUr^#w4lbV*bJQP)oVSXmrKB{0@vm z6au|M5=3ZW&F<3|6ttSJT*V?#_W)k!V}%;h+AYKQ-jnaSBwi{&bSsH^@s}L_B*jki zMGyzP>J!zSwr$~DBzj*@I_fUI3)(w==hSYy^2mPe7npfJ%Io8FoLlRUgdtd{Eg(96 zE-)&5?8~aPA9}PKwdWGqSoct zYfkOHCIu1wLR34`Z{$clZo(EI4Qj&U$)J6xsod`qItR@-Zk4|!6(o&_C`AgFgfM{1 zt!k{lgE_&bd_XYjLF~CDW_IgT#JP|`MEa>gW~wQ1`S9M@TV6%=u`BLfNRfwNC~Aa; z@HY#-OguzDS)JxUl#et}O?jug@OIj$(Oo+7aLiX%ShQrDCZr(Xa>Ivn$=(&@O_GGf zKiWO>4sVMl;45q5S> z!s~^9t^@jlH}0Yo*rFi;&pd^QM$Tdeb0}a@3?PU561!(RJhZZyfV#A@QYKRrCDle^ zaVSyC36Ung8}@e6fwF||PmdqIQh2pEkP)VpR%f2f%<>R{2h4w!OW3{#Nb&i8p&9^y zU9PMQXjI~FXGF@3C>edkvxTzk!Ab$)f|hI<=jBrKeadC zE}yo+=cU)EDmLe8c@Nts(N3Xqt)>r?acy9VWr_$viVban__@3C5$vrK4G-BD#n}4_ z!OC0p%;Y^)K!^BQtcrThMk}`FS57)7*EotP$M6wDibj1g1bdV-{qFIJeyz@wNs`2- zj!KIrSIjQclwtG>9WZGziDEV0&(lsbPG!E^v6~ixIAo)UCRV^WMt0~U>~A?PfUFqV z6Kf5zboc<=7>LqPCBrhCYd2vFfB!k`%jMaM_B#>7nGbjaN&0J84f^45dmQy!Rh3fO zUcLv@q4;B!f4oDgfpkUZ+rUH~bAaEc|3Bcakdi_71rz2H{c9Al=sKrM>o3JwlOuT< z{C*M>Cey`Z?aPqf?qO01)hBTYgCgZyl zc2kFxSfeTkqDb3`{buZ>y>9|iPHa9eW#~c_p%svZfr?`@6qmDRN@volgR8=VTOuJl zKC%iOG_!_+F-hm>kS-A8An8TP97;y2hTs>sw-^=e3cKh+;*kGPe|w4(r2=$v{1ZCuU6e@*u7o zDaiOC@Ue*#q8yY=)jlv#8|dy|qbk+CX6=Bt+|#0>BLE{cA53v{wo;KleZlLqfrVHA7g?Qt&9E?=77SFIK4=m! zC!CXqm4L6`48AB}_VuoOo3QkQ5DE^wOp!n75KIkZdilR&( zvGnz{3pPn3X*jrhPP&c9W``WRzT?sq~J%thqK&v2#vM7up}vQ(WjEM0Ln)H5I7G?@=E!{DQ`LSsSLF z^CBIen6ESmQM6QBR4=ce&koHG` zYU(qAK4Y!7i+4S(qB`ju8S@7+4}A!juQNi`wzuLd^4Er6VkRO6uTQ|$lKa%uID?NJ zG&QVNZe~Q%1{P+2U+D`r>JMaGk2k4vvwUs1sBrJo4Kb7SmovxF8;Z`-`?UCBj|m^? z19zPp9dtm)ilsyOVV!891Z5w-iwYA|DSx_L`j}!KauG$kSYas(&N5`vcyKCMkjFmj zBgsHBDsGAmm7@vP5BX4MSufGXUTPgT+}raL;OGW)*GxORoVO>V@nHl(&4RobLttd3Hs$Gb=tGiCZ>EVMAQ<*k2818KkFTcZforG(4-Bz`4bU|OcJ|}jI-u? z+zqn%6Pbxjk?g;*PX4=&zMd6}C%!qL(|VQ*e|-T1`nvFBSQMIwZaU)BS4^|!e1KIO z2hEzV-AT4ye@MtUs8994046r8mv5TZq2)Q7gO@~1er0Lc>b*=mn`{8Jk1Uq@HM{k2 zPIT-E{~PCFN^gjpfxkX}PSP+rbvDtQN=~8a+Em%bC%d%?-?low)sUH`@p4rTJ1|`b z+~|$6e>wStzK¬QOqqFm;V?%gkCz_w%eivT*P499h?HNnQ9lVu=j?;%c*+^RYrD zGcz@MgQ33jSEat_luRqtjuM^_Dt$W>i+JMJu8&J+v< zU^k@a-Ez=SWtK1{Ggw2tu*KqAU5M`7UmiG4PAdo{ckZxuF%8$Z3M+?EKLI? zYNpAQE2?Tg)9A56_DJnNs!{l2)Nbeecvs)fh3su07l5Nsd}X5g_hvlovoKgyGl{a> z0`iA<>>=+d`311I>%uX#0L8b75O(;e`hla%> z-3yPEoVt1|VVxsZQ$fE>$AwEg<%2>Cor9Z4CMguZ5Q{eZtC?%RMOXzTT!Z^joOqN5 zk>5IGACpoV?D^E0!%*2~ZzVpR8$(u9VIzys7|6MdrYz{^K^R7g%bGMhdfeos*!u!W z(o0Ub)0!K)-1_HI1HjBM)1L3MRWY+xs)Icav`Y5co0x1@ju6ipM7(Tdy1-*@m88~` z?wrkVFJN%Ecvw?cQ~RGc){%R^FIDsRihEOX|OTGiqeiaZ8=OTW$!(Tmspf3||VH zIJ+6etoG*g3(uT!k~DDhI&n1wS3$Vyt#@dMPV`LvaY2sydSSaiPQP{WiM6)8)gWu- z%~RV6kJQm6;Q&vKWk5u~L)fuT?EnctWKNiQx>`jT(x+^GpXlb(glF85(SI4&Zs}T> z+eT~HMpRMys3kz-dK6{Yl5D}F18OT5_TjnmPcvAjj$EWK8vh%7^S2{8@bmWdU@2xvQHGELE6u8Yn192YGU9Ls z88C3I9GD3+XKxu#sdq!sKr+XB z{)F6+`OB}3c4e$-MSnbEru3E&i(kCcnCC?ZkY>etpZxt`y%_r!uWhPp zE2P)Sr%P{(wLh365$kaB10xgyU$$VcbH&P}I8Bc&ID0V%o~g@@VmeD;3&mRRZ$Jb(C@huqrR(=#UtZ9mw zU-K*k?FX>As87Mu`#?eu-hn+Q@uB8>%myLyrncmIpi1AUBcZ4h3!&i?60{z=162=6 zaei##hX?OR#Ntss0Wbr-V>^>r?k3L>2wWN0 z0FvNc>&XGdKb1F>78&hRppDO<&|YMB7zc-&&O!NPV)p4tX=)C9@9lv7#e10Ou$N5fvmxW4+7rMWrW zs^Bf2oN#yTe}vx8H$PB?{J2R#W8X7kBjT8_-nY;8|M{OMK-zsvwLa*lm}F`~gJef- zoLFFxF-kb_xP@b*%dC5Qz9G zsC8)Mfs-%dk>OS|_ANwn~4NF!?qjOWMtls8izIo57UzUb;O!rL;@H+Ki$XA0;sRrOlII+${*)eKJz@ zllABWo7Nb_cE9w6p)=n$(Q89cCK(f&E)`x{lJ5+#UKr45Z;?#ZQ^6%L{do5HLnAj~Ts`$B<9dYzC*C#FVb&q9X5 z$v{nsB~l&+&n)uH^VZ=a7ru9hk%h=$#6l)Wma20r^C{)hBt#t0A(E%fs-VJD6w6xT*s(7v@b_BRLe(%n*@xe6dCT*(x8811u zVRB34;5c)6yu{MmJP0XY*9ewKm%nZ1pj>&zxZ*tEqShLi#2_0w`>79$MlC=1z-uB{ zfbKnrDP+ncn0H5$YL-NKfEjlZMp@g>i@%0i)I4Udun0*|age>rsaqSKXqnls-1n_T zL|8;SQ9_g)g3e2BJ9LPtUV(1hhzm{(f=PIB@Za(ZM+eOyo9qF6Cv9s2x?pm)Drt&f zy;FpbwWJtWw3!T4wUQQ`STz!bzzT5Tb5mK+X{~}y`V&GB^Mn!fFt@V9gh1pp-UsR8 znSa<|9epPZX=*CGe)0k2-}`uf=-kt?&ajgL zJ&kuYOUz%$S<)4@ISCZ0zK^`iYjB!P$mAXTZz<>m17}C%CjzN6R&=0r6O=%c*^E5S ztDb)Nu!sZ(n&2e$->}e8)aS`~J?6OvfH=a#MIn_nf;_Sd1jemC5v;o*8CPzZA-pIR zZVZxFLH{|`Wb-9gc{YjqM#7T*!|>^+FjfFf_})**5P36}-o9E|eNt+YwD z#1OJC!1jHKFD`rQG+Vse4$Yd5Mo-RI>rOqX=DU{}Zdyeeu7lU&uUZ3CU7>} zo@Y`x+-|6C#z-nFG(XMk6iA~baXpN356j_siW^yG5xkVQP#+Q=W6a{{g}{Gzg$v&Q z?m{9NB3vs_W!+8YiF>1^T&Iq4u^5rV`I-+6Qe2HeEU97pk%@CSuHK|1r5RLdin8!D zkx7C9`&6*843uoH_o%Tm;Q4oJJ7IsTwt@ebx7ds!|cI zTJ+L~1ErHL(!Ro6aolI?{u2UeG;9RGg-&pzGQX|O8){BRE8npr#`V11)hVU**zJal z3z4#WF<|6_a-J+A){(mRq%hbkhQwyNYGryvJM5C~k`PVrjEvY``3|8}(s$ukO9!QZ z!(ltkf4UHb51HeRao?DD*%5%e1Ps&5qD7WJykpyQe4xCS?K6C~g+qyiQeDRbn>aN; z{Kk%6W?s4l&i7r~U%Ugt%Lp-Jz4#mIkw+Uyl1lQa$)lNY;9*a$eaC*+yN$ES<<9K1 zfeZDb+v-XQY6@=uZ2D&p`V(k$OY_QdCe0-vq@Wa*KC8W>1hAF$)&Szc;}Cy_W7koX zl{W(n0I_$@+w=z%#}?Bzu_nCHx|p)vif?&Ezyu$!hDX1v;5(exlZr3J0Ydt*Z9goc zKL>VpMwHNS4?sqSEKBPb13?BkFzRE=q$~dn+g@{PR2YzCh?TR558uI1d@YJvwQ`)9 z-h3xnORIHJ5||l1Fz&IYD%@)gFL7+tl9IqBPIvBD8nq5WHsS~&srp5R4Q=3kz&U8e z8k1PbFt=j<58(UZ?sbWiW`{dJQmwX&+XF@_OyG&)69)ESn8+Z($z^^%9gZ8X4;2I0 zsbO6!udS9o3~TlgecJBnH?QJ+sy#Q{K^CPq%h|ZlRxQJLo&psc6Xl2{kuio%M98u9 zIr%%ninBJ+Y=Za6HZ#`)xN6TNCvE16$Nt%P;x_3P*RgOHrc*Z?iB6u3$&j$VwZ$`P ze+1?R6nCKzMi(6L?7KoeaQ-+I_ z2%wSL$7mpLuQ`g15u|c(4nB~nS7s}%a!?QsGC0YcEH@M45VI3P;QJZ)y^jphxm$Oh zE!OGmezfrdbisjt$sa&c{cB3~FQcgMV-R_dE`NU(#S(Wx+6&Hw513>s-b!kQTR|Ah z|MBvEy^oxRPy#tjGKjDTZ$vF)1ct0bhDE4`G6c0)j^tGbX1Yd^()T<2w z$Ify84*;t`RKIjOeV3f({9^f|&hf&Zv5!YCIaAgz1MXJ#v8u&IO&0oncK*vLIEvR< z&i3}m_td+TBIOCg72|u*m+ROu3YEmN7)}XdmX=_76iInG<)GD3BocFB$)1&W z+rVCr=91-a#0gSdlN11zvf+rpmz}S2Ek&n){Iz@J9=ZL&(??%_`yJdJpnv#7N%?=^ zO{rzb&YPbqZ3Mky^1b1ftLvFC#7B*Dem0AZI6t#eYRVlpxc_he^o;*W^= zhvSjLrtFcodMn;>y)9@40z->tr>gs)%siF{fx5h)e@KLe>!4cP&*G3%@bW_FDthgZ3y@qeo1WQQODzNxo-BEHQ`VkcgDWU|)`W z;_-N1K&p61xC+8l;PJ5<-Ds{zI+Y|YMxCjTJF3Z^@|rM9>sTi($s*!7D#092o+Vl2 z#N6*)^@$S@$4R6Nou+e%%rW9nY?C-O>&iEcR=3fKd2vpkCMN1 z%I-qllm?-iPT{>Xu6x__*;Oyf!mwNT?f2rRU9b*|zN_^I>h0dXAIp=Xu-=@hRWbE{aW zIFJxF7mxM5I#}{t;Fm?Jgr+-7gjbTmZV1la9(m1DDOllF!fmM3qY?g~-C*mr?1y@e zo%d9?0QwSU6Id5bNg%1|j77>#&5{TTV*{JGuDL1v6Q++AQ!>+?Bj3UAetmhh~K&c`G?@hvH#W`{MNOW^IP}R zr*5b7s}zEZAW(2s=166BRibj9uvBR&Af2Cf0qAJg3XAcrqMx$C7FtR{EDq^BSMKpF zjkC0au7cDKvRBCKs>zqILaqMw#Vfn)DXan&aG>`w@I~dMHDBa`$VC<3OwZ@sFLa)A zEE)>*LghCMB7DdEe5{h&3RqaJoradi2=z?o9UUsmti~RiHnvgvAFZSUvlk0}+qxoH zs)$u#adnD}I!K}d0|pxqJwyB3B5bVB)!bC?nvlIqcqRqyDd%wJIzI%FU-4Wcbi}ii zOeLSiiO*<=7%8~{9ubx#JP{;eAz)_8iE_vK|Nfu{H#6|$%dpN3Taa;m2_yVUk z#QRWtwAsxaN%b8Vz(F6p15_LQ98VGoia>BwP?GXnC7-6;m{I@5liU&OM7==0g7&&n z63jlhDP8s5WA_npz9U!1QiMAoLF6mDi{?WiOEsZUCx|>gi)jkZzoUfFOXV>s`;!uh z{BuU5jD}F~fJfT<=^ZEizU*IlmnikTGCUrt>DwWR+KTE(`EN+Bsf2h69(v4I#~u&7 zoCnDafZ$|O5-02`;F&PXMh6`g9H@su-MSj9tWt8xj|@Gc6)UbaJ$OR3JRvt0HpVB{ zJbI9#$5STcG?gy>nxfzMC1bJjAfzd+kuEEG03$?FBcy`;LbCPRbIx-4v%r0X;6{H6 zz!OD#hnAffkI?WicRp^amg1o+Q63FYuzeR5%$A276P4&wG@QZ)`nL5HDGgFGP}-GD zFNgBbf_f5#R@)8T=-$An0nselPd68)JqZI4rhit_kmV>@%y(c#i9T_U-2Tu)pVC^# zjHYs~B@FF2CoQ1{!6w2&YU+sP)vvmcW6tW_!^j zeMlm%P9!>xfePNwvE>`N$Zu+~rQ`;nFs9)8ozjT`x3R*Y!zL(juF3GK?|yJUXm3gb zCn3qj+%f}rVTM#h8Fk=#0;A6Z@Q1^5lnJJYuTRBv#A)KMWZfy)<^Z#UQE!saF^%XS zxlvAOy382vzXXpC+{hEC*@B6gXM;;+^X}< z`x;L=K-Lg>n#nDsnmQ{^sM(RycDwT#l!k*dCwRfN3B(edBO}+q2}p_vf`YtPm0ohh zKe*&X*aZlKD|TqBF0FH^8490A49@4<++lm5)w+~;q1C*3C6ZL{k8SQqxrrtGU(8FD ze=edAkLtIF`GU=7JWG1%m2_@r%iK%hYmQ)|DPjKRS#C$m$ z7Z`KNrV!GoV=kzUmuj5<@%qKDvg_}3&mD(Y#uu_LH^p*$KO{aUG{w7zUq>Vf#O1+2 z1u`iS)p6o1nXqB*)1I&yzsfH_tb&&(6ljG_hzFPi>dy>Sc;)?9vGmGBEztl@xk58k zt^$}UkStD}{NwG5moH8(UVK*pwfUu_q}T8}FYybxpB#F=N>VOCqHxL5KWa|}sdi^pg=pmqXg6XkGL0pCtW53u5aoePlq5eRo=z(~r8uxgDw!q=gI0d4 zAHV#WH3_kB78T>8!B@@YTA_VjF?eAPKF8qwX>+&oR$kyuYbj0Ghd2zpAPwi*3|uZ% zXzO9rHTM*+xi$w?u}YW0rc?K4Pi(pZj%)tc=L-nzKk8f2D;?bV_1DKwT?mx~X?+}gke6fYrb-~D zb}ZzOeMngZCtIzpKLn;uo|}=mVtmPP6hUZCSMg?WL5WAha1J3vE6wqnqel?iD|Ztl zO0^leQWd9Q*_hrby6tKMq$x=wlvg6M8MqD=;C*JDE44rqgWeQhVj+S`qin=J%jR6N zAlYgwSK<$G9FGc*`V1p~Epeh?{8GMIkx!T(q)n4TZfjo>9W8uIz7PrYfwj#wGmJqY zW?d%LsbKexlg?xIOv=&3iJv`q|FO$swB5-=*F7ZNSX(UR?({T*^sF<6JKg>C`-4>` zpcl36DQNYxQPJiqxMQR)@83k^HNRp|5wid2kQ^T!A047H`Rdpxe`fyg`J#yA%hYbwNf4gK9e?<5>YJsJ7C2 zwjlC&67xhmP~?HkN+Sjr1sY*+sgH=t#HCaHqU)I965uPf0urQxg=3Pi2~CU#tOnVO zH!s~z=i$R&A#_4b95}yR17~=J0ucW9hY#gN+rUHyq8O0F$S`+X7?7*}knC&bNaYRy z{u&w`!}1#$@?D*&dYN1T`^S_QFN|Rq;F560F48+ zCI+cy-M3$cgB=-!1=u#jq zG#cg7Eagc+L(xl^;NcYmQ`|B9_mLBGkvjQA6pLZ?*JdR(pN~R5>ERa)^}S#KygGJL zuKxL`S8qYniFt4{jNzbYaHnLF@GO?Z4LwDzj6T}5RJ11~JOmxolt#W4uLs>gQXYE6 z13x$ZDcvv_1%oh1=PHO@rMSGjSbE^888L9KuUWMX8eL1g*x;lqbQ?4RV(Y^O#8 ziEnfHuoC@YD34Z?sDrJ=2Ag38!>Obv9!+d{*3V4B7Re8av>d2V!#|k`c-&_$fqL?# zv#_!?px2Onr4UJFX#zl!lebM_?M=PIRa{8-ZGPET9~n0l9T1U_!;^Ppmu zu=(R)7AIPvtW2F$sZc?`B1J$zLzQgjkX$pxMc5iwwKaK|xYmNcll;Jp(Mahjt{DMo z8R77}u<;fXuJt`tU5TQA%HN|*Iz>q_V}i?aHq;NWzdX;tyy(0t#jnsUiJ)jd4MTn{ z@I)_(n=fR6!C>uXGs!vk1=-hT%No_uL9X6QYm!u;t-h(ay~*GaLX3`tiO%$4V?tvz z{eGnUX7r0{{(^(ULTop7H3t9aV!*j_dn5IZAn!GUD6lsD@B4eoSrE|4k%ZM4gb&=# z-~N&h=ECuUp4wc;BBWJiIgUPJKA`x^5Xs?&mMWnz)?VAIVbsFkkSe%<>?tovIukA z`2xLCMN!#VEXy85wjb(W^>lpsk2(LK$;C+4ZPS2d=l@avaq0X&dGz?n{rTU;gI5~( zWExez4jpxz8T~MWl(x#}S27)!Y%ZKI$vVX5RIrV40s@6&2QJE6>bvU3bWdZ}c+C0F zvl|+wW?OV%@%ex9=%`=5|G(}(dU}8Uck%4)k$;AKL__i%QY9)OF_*F-Dj8Hbhf-3h zgf`dM3iHN?mdl>cVix%<@&YL(6jSf$TqzTr3g8`N5LL{-$(XCZXqfB(-@Mhu3n1sH zd~=@H73%Emb+DHK1QHfn49IM*|NWZISpJ381GbY?EdTf?HpgF0E0OYqPS|Nkg^=A| zSbuknWBbQX7z3=-nIJapzk79{mZp8R_x4D_#sjiSZcDk)K&K8!%mPhy1$e6~Bn&Ek zPYY(1(g}W0n3JWjDAz48Wt#jz>=~6Mre=j)txUw|BcVQ(oTvkeIT)xz}VXFChi1I(ZQ0HRw>^{_yY2dK(zAC(bY*Exyys%Igsfh&>dJ^d?WSV=|sv_V6-dx(XWjm+^-}m-}#T zf~m`)L2k`%HpW+(lk3FX&z)y_awWJpCr*MZnle+CtEX4HN8(kEkwp6oH1C6RL6Qcr z4nuP=f@YkBAtXaHjy3y0nzU-l_7H?cAIPJz2mgGdx*C)QlYK592>a2mi+$;gu3FdG zF#&wl_?JBLZa^NPxlm}=aHG4mHi&1yS^v&7~<4fJen)(5zR3j^%i9-J(NCC0?P4c%kMe zmBSQ>Yjw26&KiF5f<7HtViX=jCk9Oy?ZUQ;kB19ux=%8^=2=3_T!EI)wb0@g$oK$Z>}d zpI=8O$-4gMgxy)b0q#XR!Ffb``no}>dzCX0vJ zDu9AO znE2UqEnY+SrzYDH=0nE3Z6Xiwvv7Zs+gyP>vbK!C`uP zR%3W`pqHrIfZKXW&7f`)gUxoid&Fi?Qsj>A`em^cx_(__U-~=kjQ7MxISc0XJR^_xkK8rITY^s(MT+3z%!))rI z^xuS_5^6w>pFDjPn73Y>4M_j!Xx2FU3&k{H+SoJzeAWrFHQ`>=FrCM^jq)D@%`cvv z*DpEszo(((+mJhat-ll2j6~~8$K#R5;#Bft z$X_~nf(QMsw?~K$GY(QBHRL6-ZFV*}{YxZa7 zN|q^94zjcUBceSJ>t zGwkl&lo8c##(fro2Syx+bC-Zui(&)eKB`R`;qfG4o|2xcc_ZNV(}_!TdQ)8lI7w}8 zTaXac&q1Vg9XwK#kn=sXK82oTXK|{tJK&WFjwR8YAPK@=_RCWxJ`-sWAyXnJap30C zGT8WEsN4qyNS#17u*z`dloP@w|A*u@CE%2kI!_AeMf}ol0MC7$+c%#~ZHflOzov`~ zpxjc3eu81w3()4G@L@CF;GYGiSl{QPa<{?vCPaR5tHoD*1Y0%kS3V#%o7AQPmKPEb67);#nv ztf;$NtCkVq;OmaDMtLm*aClBc>LghtFFXCiKm*F;O;PFK_k&5q6DD%MF5Tpyvqy@B z6QC2bj7v6Ge(VWLlYki)vmCrQ2I>!sUFlwaVspI6vHGe|$^)tr-rGS?Ryi_qrHj0m z>pd8%lBb!)JRz`om4bL=Kc6f{Z69<>Hd%QM(=-aTtParkU41@cI__{7KhG=dY2)eI3oBr zBmJY}$Fotl=&2yD8>RD@&8U;d6-vg?RBp0&U0AthnwP8*VFjP8o63>9X+0%54TmDVKlRX^f2E#jhkI$gX=z>O!AQK7u?S zJshG3`a{3K(8k<9DG6N-v;GUIFys|y;5Qoe$BMHkAXkNZX26_ecq5}TCa`DSjE|yUM6^d#<0R>bA%}O~R7hgz5H8qDe&KVAP zQw#3?5&l>M@V$C{>w?Z6)pw@HsKcy10=XN^q^;T#N@&b;C_8zIfUfoXh$<#U{q1=6 zUwQRA&_d`_23t;k>kfUIvf*!CaziEwi^-dxy6dT+8_4%-?n@~R19*jsKMhUzpwfq^ z#6~mYmeKkGDsW&u>;`Cz#JP3KFGym!1E~xZvNaegzm22jH539wFA#2#YN24@w^j~@w`tL=%wW`Lw)NG-? zJ^nIO>e0Q{e0{Asg3x|@0i4%ci0vDY_g&1I=^pjI>Hgj+7<}!ZEz}n_R6kjnEv%{5 zVw}eseWcATuC${uRa)ngkPJ!SnNMg61?$FHsA8tE#EXvWHX6vHH;O`R+4+D#;uL#K zk&R3Z`(gqmNbaRnvu4~NB0jsabs5?z15Or?7&-q1m2ir$G>%QKVl_tRFq3XKM>Zdl zK&ExYXp}=H(H@xDbe(Qpvu;<{PgSClFx7MHvN=|NS)^t` z_N^G31E>*;Lq%B_Lf+2ua3E5Xz^q7;$n=nSQ_hVZTgU8}(OKdWvOkHB36IFhuNQI^ zH1cU80iXBu&!1i#%Ad)9BX43BU8K~zJSZ9U3U04m2loPPEwAK#H|S_pue_&!O@frY zi9EzsDU1)uH~$O_^{VWexvljlt!N2Os_rc9Sr;%Nvx;#;y?gN?P8epTvaYC~A!~z_ ztZB+7^Fvd95clXU2Nxst6;B9{o@26>JepF8TZ?2A6ML>xyf~`5Jly>wDgw_jKM9uh z_8^;t6nO2VFv_Jv{fXOvX(uk!{0GGun@yleishrT;(Axv0!hLpX%#)sR2|P(1hbCy zINFww*t0RS7&P$*l2wDmyg@oQ$HCCb@(ZrGVMk_ z1?py0gB?Zt5|$@Xvm(~16l}2^pti6PobcTu*7*AW~sdHR;Cpz}C_?5Jvf8b$5@B>QrR?qt8}**Dy8p`d)u`ufO{Y^>;{! z-?H4bY8!Tv`cYQZ4{l4J_7^hSR4;L#R81bgeyL2wu9MUxW z#O8;y`5P&r{KP=owVLF^S75P(<*`{D#65F9Bs7GV&{*C?@&t5iK0tA!`)&WYkNkI$ zjp|rswjno10J&Wsm|_<-p0plM7#F>K9EZnP!8z9yzT%NQW3?H0NIBj&4=V`9kbX~j zZ|_+}NXZO)G}o!@EF4kq(gb4UghOA0SrjrM@)`-MB`C43XehaNbKTfJ$=6ewJ`hGo zobyci%ac={us0Xvy+x&T>3{kE1T*1?+H9Pf+Ni9`X~LMU6{dfxf$3fv`iZ`a3j=FW z0r6#M2pn8r>6+EZn+%{nt&_jdN(EFUuGM5?ND4~|kkVzsuuhVKhWf~4Zl*qsL0vtQ0EY@N z@^I(Z-79)2rHMq>%aSnJbOlttS-k=U_YK&Z$hiM ztcp<~f?cr$RG&}|*7}W>sk~{D&1O`xDwc$%a%hl`ABmjvS2&bw-hcYkC7(V)oP41# zp9wDsfHhgCKd6IccUc7TE6|br7)+-2pa|>l3iD8)N2SUilF0rsnx{;xw-XOZ|LCaL ze{aEXGx}kJ(TW{^N4_nLT*ZP~G+2NK&4{oGCImuOR$^tdVhMm8B$ ze}{AufBie~!IJSa8M<&zZWDg}#O5!q0?&$0vk%Jf-1U zoB#gF?Dqrm9jWelUwn3ZKBe*+gLM9F7tb=eusELi#IXTYG4|NY(uz#VFSc4Ahl}?NslZe6O7abk%ef(2E?o6w*P>?MoE=Ng{<6 z>${KQD-n`$4ra*0Vr`3Snnd!OgAVq0rcY4iY#E0GFypt+z*s(9_R*?6SofI%2~xx# zxkxYOBHw~rJ7VWxfrThJm9V1VF;Y2fi&U=|uh^47(vf#6h7odj#^s?FBvGhNt7Wc% zyUs&<|J==^@;{?GM-nU^_3~<6+Zkg?{`daTlPBf;??+FM?(;wI;wcF&9!=Q zPAFPZPSXEPdv150A~ zAJ$BCt{I&hw1a=CAOa1x|GRkh_DG2m?(LB?ptq*<>u63+&w8iNNy@p($q*;pV?r?Dc9hlN z7tB6{oj?Yl^qyXP{!iWc*H@P4{h_?P118)wUY8myIsZ?-KI#|G|M5}((f#?~$@B4J z?;*JgW&`kv8V4bR^4Bv77H`T1p45eoi=0DGpAevmD18WdX&LF>+di~-9^D=Z_f&_QaDEHi~ zaWm^^J-b6L*?d4gekATCo0CtUI=K#Bn|~!kZN0{24y-qX$W7kBWy! zp;^RJvX6Pr@?{^CKP7PzMCq7xX&jd#GEAcZ`Mc=au&WGbQCrLPra(;OAy<>vE=2BY z;~sZI{>*sF@=j77^N>&GKS>%?oY#~K$)2+niTn0YwLt2(hpIV!UjY2u65tZ~?`i+|s4V|IetfV0-^sIv{FhD{Nog`+sa;h-7t?Awdj(9A9b=z%~)gbSxuxWzLu2^!)XE99}>Heed_8&V(-Rh0n zi~{a~=@4#3(#@06_pbUQmePK=2-VW}G>+w$-K_!2ihODbDZ9lkL8X>{7eG>#A6f!P zf878ajrQuZ1wUCmn6FxVqVMFpLD>3%zukD?JiUv1`3TzQIEz!j`k~o zuAyans9|{xxiSep@Q(xs4aK~XK#)i7qyKO_C*+z!4GRd4Z20<`qEki?rBFPc`6P?d zAT%F5av!-zSe&WI^~i1%gmmP+@_7*8wwPyR>VEw6sY{4)L~%RHDMU^SD$$y;A;v3V z6ZQd$5ZMJXq|`ZXo&)*xiHw*>Gr_RuAexw*PnQh6SoF6+ME>!}eI(B*#2E%s`t3q2 z;#i8+5+Y-sMSd4U1l-QUhwoG|kQu*XK4x%$cqp3EkWU^6G7F+$mPK{D@$g|w_5%yL z3Tv(fT(%(7{kVVi{>b_E_k)M;|F2KKKm7FRt1j6ufQQ_Wl&f;cN^v3k0rXjfZFeot z+&`;5OXPpR;7x45e_Jm9A0Ho=?7#i5A07Aa<^Nqg?c{&BLf%aio=v7m)l?dqc#=?G z(g+L@LzSm4lO&XhjHFYVqK~;Gjw6QOxt-3>0(|E|1AIlpzz2Tdg&g4Mhzy=pbY%HQ zLK)axIdI5a=+fv8;kTbaWf;?R>ZaV)vpPEJk}g(LGXHoDVPf5Jz(OCIsG3nnN8SAT zuFSB1TQlshFvGr?VPz`n@Zu&h)4iz9#9o%stJdsD6$A%G3xMP|-fF)gQ$h^Fo&;*+ z%cBuTSKW7XWhmb@2@mtHRrwl`7uL#>2r{Pz;H`wH7o_BxM-NhxP7{8uFJL*Ynk8{` zow&ky=M(~ywX(eN#$5)|TvuBLm5|8tFCIi-)u=+j)@Ig{W>5o^8&rb;y}2{|`g|-RRD7 zOl8U_3|(Eo4P*_xU48cbv)Z%d{#R+lZukCw(myKS|Hn@r-QWMacviUoEx{X;N@G+R zQI^5V^`meH{?{e@1aBMo^DXCT*Qo6D{g+M|eoeZlz1LSt6E!Z5VD4!hOa|H32G59V z#&q>h_QyH^ul95OW8NU8lhRl6jU_JGddqr4hO$jy4|+!0v|C-mvxXLpRtM|f!MN0! ztx*`0?%zf4?_vN}=E7%XxWKZTbraB&?q)&5Hd-BpT+bm&l0bMRF>A({KPXu(79gD! zJXk_K!`?JvU;nWAx8s8xH;b00Hi%l7mBlJp?98Sn-_(H)=+B zrebl6Z{1pSD*n|e46X9_I@L+VJDNx^Ci}Llh1Jag>_-_agVIb31H&k~%C7CDSManb zYsdfMY|FCyUs+Q&VgQ!j|6f<+|Hn_izQ6x>@vLJ1|EH>mPDa$bl!y-*qfxpK1QaBt zX)p>Is(fh}+71FI=Vw~8DQwZdO2QS+sZorasuFxCNm%`={!+i4^CZoGQ-77^({oE2 zwfZ!Is0+7?ls;)>7lp>^461LtH59DSt$Sxt>JoSbmE!k#LZWOoV#$Hd<)L$4k+ak! z`b`rWi4bD$A)~)a>`Uf!7OH$?s&+PtyHr=x=82qU5T$IwDx&Ul2{>EMeK%$1XRY8i zd2>{{w17v=0&rz>3}0j!U3L3z~91nJ^db}M6OzrNZD6g*k1&Vndy=n1fJ zabMMot;(vMqcI9HRccd`Jlv95dN+?50VS10Qe~20ev8wt%@^mY7tGqU6c4M-EbQ5@ zvEO~Ovi+`Nz=Mnli!F5soWFpfWXb)noM3NN{_pqu#})bi@ss=ee;3aR^1pSLo8;q& zAC0F}p^yF?Pej$<+0eN1u>_}PH&5c$nX+)^iYX%Of+q00YEvCgr#(YjXnRK2e?OxU zoiN`S&5JE`xvW|;i9X}I|s1dpW3m#g$k5Vi{};{^^^7cU4e* zh6L^YS?O6q{}DqrBmYa~zoW;G%k;nBzt{inJIw-vO=Fyj zD>SqPYNEAi^2;|@EJ*^NksFdGS>%zYkKmud>>?YFgAb(ZRGBNBkNmy@)$`XE z@>`IEW9A*WowKpF24W}1fy;t@kPEl~cW}{?lUK7{4D&pJYmFNImLyj^*MWh^Z8hU2b+Y@fNPa{t`Iv*i94DqZ9)>VNxn z{$G!uJiWjFck!%n{~Pr$B84L13sgHAd60%HEv{CmUMT;jI#XNm8`4$uSCTa(UtQ9j z&CNd-DR@g=Ipjs*MbG#i=>)2-RgVp;7Fa4^G!&_%s8*URG6}9&q}hs0=;A}%+Gk8t0M*Kd*j`*YBr%T^tRE8p24ix~$P|kzUa^FRWta+iXW21ox2?}E;%MdO zuP6%3oJmn@ZJ3lA02R7^R=&Fxmr!lDBDd%$cl$El=Zpy$Oe>n_T*-;;Bb!apb9U?5 zgeuR}_^Cb790Gdz_1tfn?p(5YE3yL-;~P*Nj5xn!;K$ItCoQ`nEthOw?-Kgjk~!r^ znqolHNtIpQlC$J$ZIa*dF4c}9ZB zXCD@|`pQhY*+*jOanoHaKW)Z|mnS4)X%et22E{&uvB}G>GE28QmAT6-YE>=sZo%Q% zLHb%cg`}%IR{dX!IUveD)cqR2>f`PK>4q$tq|+|xAHg1SxrbOKx(oQKhAI4ep#fPP z{tCttr+~5#a3>$+Mf0wwEJ3eY1LHtIeNIeq-*^^EJ=Yut%wT2%ia6j?{SWNyyJBx; zvZOtCqlvDiRUu1Ie0U()F!5(-Al!AyuTtKR1MiZIgG8ix$qVHapv!e(XE;^d6XK8{ zN-cUR=ZwFol};3H`Xr%|&u0d3*bQzcame?ahm1zWu6|WX(o;^T?-Mbfjd*BEQ!VM* zphF#_Q`!&Ie*kF)|7k%3KhI)}%#GHCh-{?vXUlxliPPFiz4@paV(^tgxxq8i?P`MY zm7Y)Ob-w&^b{_MC{#19YcFy{~e?(lh)8=D^qvxv8Pe_)_v?EJ{P`DG8{>0`#Bzz_@ z+0H&Ey2LG^yLD)D7OiPmXtQu&_(Bf-lf_g3X{uer!qFAUklba+`DGT9?v*50nm74s zLCzkvx2CgTZ2GfrD!fG0FD}$q&ePfz_y5`Qk1Ncc9JL;XwF5MKYq`wckkQk}Eb{D} zL?5mE8I~uchK*w2RM8FFi6KYgXEx?GIT3!Pb4s0CN1_~~Q@_jl%2K;x!gBz8T|JGi zHKQ8DupL3mQ-Q#VwW5rwt8%J)^Gi*L3WomFPsHMewiRmBJeS%tgfp$G#np*4m4hTZE!yy> z_~kOL^v+nqEwc!Ewa%_Cr~3f%&+A#H|Hs1ox9b1h??0{B|L^txJ9<`+|FUCrE)YEk z)NHJ!stSKR`9U6uV-~sf)kex$ z|4C=zL4E7bD130q`9}rV?fQQ{J}RI8{@48{_xXQz@~m+FG43abFc(|EBT$}C7*y6q zF;D6An<)U|lTtNKSgOwbVqse+y-{zWjiX<-qzerLTe*D_ZS$|6GmQ6+zlg4Wp@~k* zjb+UVmPyABK7D%j)&6BRVqO{oaI`wWF&Wxh=Ve!+T1tW@4k!N-Jd(umS@$DoYF+sS z##?>*^r=g3$cPH|^f7T9pLyJ82Q>$m5DAnXo_9W^@@$XG+1ZT`~n^)e5S8V+`*+gx6qVf45s+kN++w*ajsF4 zt5Jp>YX{wKZhcoLP#IymR%5t^(l?`j$sfKdDgVu9YB$YD6|23~k5f%s)Q!=NIbl}; zyGF;1C=C*26y;;`;P2vr(jk%{BD($nn&KPN8s&+gGDe<}eQjyUCsV`_>xXB$S)HoP zC`+&8{^iy2#o$AiFo9wuiKzpv)Qg>y}xAh zei0ABX1^*X7RD?4e5mEi@$=sjcEu9Gev&T-&xra{eO1IV`_u9!uV+GZYt2Fj1&f}A z4kd>Xx4}@?q+M5sj(i^c=lyfH&l3LsnkG>YO*Rt&mg;|xD*E52_w^rl^Q^%C|BARk z=!j>jO8A-ZFqHpK>0}YxZ_r46|Bg-;r2l%$dAf+s*Y;-XOljnkeWRJ^YNx|4u@ZV6 zsMJB_>|Hl#q5UCX64!W3C=+~3Cug_lpb3oqat0z87nU^x3 z>`Rv1N*wm-(?GtF-+cOXa7Yxh5lI#wQ>Ub8N|AC$QP@US<3~YM~3!+ zHM2H~58{EKZnEa<02vBjT6J@Q`D$aE9ua6zcrqVwku#M+-h0*-jnP@5C$}vlW`Uyo1|3Mkjy%mOjE5(<4Gx?XCduc zdJ;^%)MjdQ2UKC{vj0Z~L@#Us>K1aq6xYX-rv0xJF5 zXMg(aMJ(C#@+qs^&f+iad@EPr|7SD_s6Sd=6|{u^|N2SU|L?f}^?m)<-8}2?|F0w> zJpX>{+`mS!&xZHc3vJ~5A^L4Iu3wLFJ3N04NLS+cb$itv&C==GOn<4bdX}Fi-ZV%V z)Ou?(A?x#UPgy!`79C3cNJ=alG>8pvIZqozhs64+TNt&bA4#9Jn}O9wrd}^?zg&D- z-2N?#!@vU+X7G@O}c?5p{{1rp}1 zZUIbnb6O0s|0;rfn+tAhviuhB`Zn`kLzvgy*7UcIAm6f^EsODb5i9Kbnj(BtFB=N* zy4%lOe7DKzDrc;~v)!Wbev8Mgu!K#{nSCRza7z$tdopukzGPAV;`S)KH`se+!< zl#ZwGVa8D^@=SFB%k3@cKnFnysQrv1hSFOkG{? zh1v&ugwIkTrs&vz0fiVgu+PvYqndt}tKoEMZ)?e=x!k@su5?{}R@ykh(iY0Noa!u7 z!>KP@AU%HX2$nh~SLhaXZ)zg!ud5!oIJo zb!+HlQ>~lo_A}SIwbsovG03;6o7t)m)3}0V>KW@et)ZT|RaNLBdE+mlG+VTUO^Dy^ zt3vNu+431aE9n1XF49TD#Gm1cD!?WBzy6c2pO)i4o;<$K|Fe^49sS=qBErT0e7SY~ zpM_(ejS4WIQ?m*%|7J5Spf%R*XaVa1ypkf&>SDt%keZ%qHGxLBHQ(E^@bX?I=b+z; zTtl~H49jU^fsUzuv|2YR_YR$>>Ot46MyP(?EJD{H|CWMGspQAMr5kUJ#VaUs_$6Mv zA!%yuSJpTddLpJk37n;^RQ4TPu~FRhJJWA1zam%Dcr5SFy2%hwjWsP+K+y6a%k3id zBA?Dtv|rv+YcBQrs)OQk7Knw7W31Zomepd`5?92S^^{`^I@(Y_W^dMCLq%5M`BvP5 z2EOqY^)%b%|68xCeWfy_|voKU_VU3-FfMXDqI;jK!p_b&aZDMvbUlxrORS zyah^PGpp;7k|MkN7sle+^=yy2*??Y=(v^E%($$vfojqE-KFO;UUjM@A(zvE2DARxv zap{=b_^{}^&r%`1g8mmiT_+LTlK9^z$B!SC{XZW+y3hZ!lc%$e0{E@Og#CA~w(tLm zIQH47eqlPzT3`5iGlegXa67u*3NTkv^J41_HN3@67AtofT|En(T(Y@vWB9hoLsNcU z@7@RrP)h@L%UZH(XFm(JLVsEQb@vW5zFBdyoA|X=7T>IFGfR}~u&1EdgrbJWa*itP z)dGJm`^#okXz@%o4!p7xmp%GlNzVy0C%2~QT1X|f=E9X0|WNAx!cyx zJ+^S-?RR%Qg;aeX8%k>m=AWY)3hyRN9j}EmTzzXugO)~JaknUUZH@P6zMz}88Qa)< z_W24)U+}Yn{AXWeD@lRN^1nWPbX4~LdHVRtz5KU}XC3iR$wTrRkn~2ZD(oQ(4c`Ny zJ>}8(=m_e{mRUSg?g3tPn}j`M>sBn0b9AIwwpQf~ah-R~R3qC%-?XXseYt$nJA!*fG?iCz%%|8x9#CqHpbA$~B1S=itiNm&v}QK8!<`&LkEH|K*7bVe@g zP1P8BRWXCw)#~JNP*+*ulL<>tvm{|rYHYdPN-<0t`G#^7>Zw&mTB$6a)xJE9Tzf{| z<&u+!pCD=vev5vKw6ogZ#cxrU?6<5V=pHoq0TqQo>>i4GRmhqt&_R8lJa8Pz7X4lP zT|E0rey*s1oCS@1_wT|+jePg5cN%~dNPHfl3U&OyJ7wW4m_$5bTNz^s|9|x4xa9xe ze{%fv-u|m#Ulm64MOZk8Lj~^f3pZ}da zd*pkp3#CuP%V3m9uH{ssM5l8?-v7wLS@HGn`vEBt*6zBpl)NciF@*|Ky_Cm+Cwd`% z`iDZQJ^9T6s6r+avE@{`co^JDuThC^_qn z&tew&Eb;=TxOaKC4pe_|&tI`b1Uwp$Blm;*K|5urVq61L5=#wY7sXQlmV?2FBPyny zuZWyJF$2#@7E3C_p0By3?hF(qy!&KUeUNSV=0x~vz#(cxJG1x^1$vm z3qy33gSw8o)ohNe5$XQO!jO|+c@p|voW$N9Ig3(L2&~fqB8`klobao_XM#`-bFJKy z>xx+-$n`Yvro^L>WPv~v41Vxe|37F~UyZ*U=ysWiBr8B3d=vRk^Dbp~rJZ4Z^AA|PoE8E3~0H%dT2{fqTyuDQI zO)U(cVHdw6Gi0Z;9Mc?C1`F?CrKKEJIDqne@jv~-_vZ69lKYokBb%` zmLm|xvMlA5yFPAIy8B!;S+ju?*d^m7{pKA%FUg)oDE=Xr6_R6E@bMVQXxEsxkoMu} zc+3Si+`{?E0%f&0FHl$npn~}M1TRqMij$WJTR)%R<;Tk1ws$6~+H8Iy`IN4IHvPV@ z*FGhmVCW^DHJHkTEHKk@Y=-a&+(o^>zm3YX9VAnxiVh_9i~EM8l7&af5>6^v1VE1LXJPm%z#2$$Ijf{VVH$Ya z4WeO}Pp*T+p=1dscLxax({om_5ihqCrzJw%NV>LvR>|RJQM;`O?fR@5ASQGk;W)GF zyI1AI?o>V9?Yd}~vP*ol279Xm9y%?Vm)x$5At!~8o6An4{()=SdC+JMGRq;^&?z$r zS3qA2Wvdml*7O)IK*_2~$x3nB#cf(GXw__2ithlWHq79-E;V+++!o6C{kwyb3rdFQ zB65-9YoHA8?}o@-p;RN5FM+rNly9CreGUq>tW}P?0J{^Exhhrxxiyr}-@Ld1B6sFX zzkgv3rWn)!r3RyFv{GxqC5x48tIJkyPqWj%?F&j;=wB)&)lN(Nov-fudUm$fw(E5V zJ#*(OW?#?U02&Jd5}##tHBqd4Z$jbrg)P4ix)4u2TseUkGQU9Oco5#;glnVb;G;rcu^H-x2{bH!?HmS&*Z+2M(9W=%Yd>uL zkTYlGtd)p8DWv-okG(x>^mJ(q!R1Sl-$ zyS-PdSfrDar{`ylE!IeaMs>+^46!0o_L}d`CB=k{nCf{6w!M4^qZL>w^rc;dG(2C} z?sG0)#^uqdl#`>AEQ8Ev=+>TVIP~_vfK)<6R98A z2+RA_G54qqV#=2^PwNbd!tJ3%>vrTqhX&wYSUs!tR=yvK&Kw{~;x+wxF~6ne z{0cSZj?em~>z1nVE7YtzJ~89Fn5nK%H=1}+tbKshdfEgHyp$ul!s1-Waq4-&woB^U zdQ2%Jz1h6^7`tXT!FqO08}baXcWgwq_7}9239I$#T;_d3`G{(f1Q}&)YqHo zVhDQvK)m?5dma^#9L65>mcKjc9YC){F)`B~4343vjgn&0CZF5&-w)II+%oYYxc3ji zy-UujYx{KOqi)^)ifqDiS8*RvR1Z6QmZ4^ywWjfsqLrEe;egtJKKFhG8_~D=aO!J% zf*v+fu?g<)Nc!_A-TfV8e;%#3zvJ(Qb1Q47X=8n>)r)4-V8vd}dHd@x5BpKuYxZ-9 zo8DEfIMu%Fx-Zy*+mq?_1shp0PnxQ1if4!dmE%YINjI4=l(S$LM#hD1G~R0 zbdld(jnJfXG-)KDr?M^!a3HwU+%U{x<6w*x{$8UnwZ+o~rw67ej32G``2Vox~4Z z#{pFu#$0I=O~FD;@tMr$S`~h(Qu(&tHzdQEO!5+h6lrK3Ph;7@zQFmQJ2^6|S542a zT0gfbUOPuX!545&{srsy`+jzg4cqHld&B2*kN*Wd@xrnp^D>V8*&>(tE}5=lmu*!8 zAQQLAI39X!cIdNct&iVi26lb>GXXi%wC^@=!zvD=sB9MnF=>y=rt&JN%}AAI@YXsr zKgSgWetFmrS+z9J1K2>nZaVvL75ze!>uW&3nE~Z>3j;l6)_`?E9duC^#do^txGJn$$MNQ5UAE3VoM|g{Yl<5UTiNkR z>ADdhw|z#w(gI|S4k!zKRSYYK;24o!Eo9&MoCs=IlH zJJT<^ooO#5T&7=i+sNl7VN^KyUZ}W%ehc+BoAZI)=ts5g{;BKgzux`$&m;T)?dZ5n zKUX60^ODZh9=k``+k$>M)0&Awu?`J)rQh?=%br%yW%@O6er6graNHLiH|alrljJS+ zpS#2K-xN;%^DdR3zjyjGD?tav{VG9n>)$gaxR`AA>9_FTZ{=cdbV|2y0B;wB6LIyG z$4aJTS#mLX$0pVS@W=u-lC|-fxV{A#Hlann2}&LA9;BM|`|!5HoU;-*VNmB&oG~4R zL))&}jA!Merk*4KW?tbF+aVW|1fXci^(2H^h2~L3BNtrDHIy=E28#p$KeAa>;u9$7 zt&GbgiITTB4E3gINsQcv|HeK0B<~|J;o@VG7&h6|t?S3IN!-mK8$8YiX@MioL^?Q5 z)#KA7sp_&kmnF|P!b-><&w;t_&zl#Unwzva`rv7K#pe0}@No-=#n}U@&uAVTy6Tx4 z4K+U-zmn!$p+;dIICy*jQVS4Mip>)MZqSv$S`TTc;8e~*2cU)P1mw5{-;a|eNr9s} z!s^IXAYHSjjKY{$iOJKN`h=i?LKQ7oh2?2I!a;t~RM<;irOpVkUC* zosIBG(r>sgW~_dvEI^kn`WDUC5V;Q#l_5rW(g!zn50OvK??ZIN*b0!ZJG&82p;)VH z577Z-79+vpF-f#L<$hi=tv9jYcT=fdQLh$213$~Mo?$pH2kPk%&c=bodTH+v;$dD< zJ%e7)Cy5taTR1fobBoa2RUpt@+V!ggaWCy93CnZT`bSydCUBopOPI-`z4PQ+xH|*A zK~}t1+~8{>fad?&IM`eMFWg~-e|*Q2q+({eso!&7Np92Up!;+<5e?h$Y&VFgWm_s=v0;{RrMD1!6hg`3$@RTcPQX@$q}m_3xDE&hzdNs4i)>e~qXD%KF|d7r#(1=iLb>+u zao(WP;*ut80jupw_1X_~ICapJLZ^8zQ}!@Zp% zVpX;MtB!=PEB1ShO`(*Q8h`u|9l?A1{u7KI{~bl%6j%TA&!jWyqAJ@NXIbV;*`c_6 z(%hdKiq4!ref#$P>o+fw)|R{sXN6Ca*u-?Gq)QCO-Cx$AD-P6biVf+$m{D^CXL+T$4V*#Q8(Xy^YEe`VQxx#In;%vkOf__9GjenmKz|I@SB#x zg7W=Vp%_h zL}ee#Ct;8sXU9qM;kAHQ@)BnwR4_O_gp=cw<3peOe-g?b!WGj%4vF=N#$0ec#iC6a zn{YF&M^wVfGP18U*4KuaTBmZHnklBfg5bd+m?_sVW4}oi*B7AcBv9LFdvm7QtjecM zOi;TbQLb8-{k^S)4oTILJGK7bI0URvjb>754LM;%$py7F!`{cfKp%YC|v zTOdU_Kgi(2|DwY6rSU>ZJj(*C;(k&t7U_U|;G7A|Qw7WGCw|fHh{nAN76flz>Y;mv4Z^4*0IiOfGi4a=vh|ydM!_N%udZ z3Y%>yHmQ7YV_8kv2o29kpvc^v%9)&?Kuh^6Ht+1NhJtNT@i)t2&n=@CsGRb1l?mFC z1SBN9VI#*}XMWqkThXDyz(QLW;}u2KQ!0XEgiy=Q%grJ6=b|^o0|R5bd@(Txu62!i z`yrjZ?xo1{sm@U_#br}A$PvnihsJLg615#ZELcGrnV4HTwqUfgaLJKfS&OIUWX6K6 z*TLOIhSw(w$EdDc zVQyr3R8em|NM&qo0POu~cN;m9Fbel){R#~2X-oAgxyV~Lr`_+UBvo0rY*~*aS3h&A z>)K!@NMe*sWG6t$Y+3*P9&DKa61i}Zyp(umx-29R5dZ=}1Q1JxB20S+Q<$;t0?y(; z-NCQl@AqFkdnW$d@AuvR4xaVxG=(Xm^BJ0%y1zl37pv zdkX*tCxVs$sInl3b)_*6x}UnAwjxBs45v&Ky-QI7D4Ay=+66GWf=P%XaETVd6^!Qy zP)0J;1;-3v3doqD1Y~H8vJ6Fl5dbNGAc716%CdRL<{1JMWmhNz6el6#kSGXY0z#57 zh!b89Clk60rjSk%-32kGjP3%87zHqi03{hik@&m2H6?sh^Z-mSo6bjO$JLnhScXt< z1}Q^X{z)v-EgbT0Y6#}oLCSITD1+f8m9=|#Hj)1dL~*dU*Z;Kl^jSAeCR>+iaZR#F z%$9^5@a~Cm+6u%dh^e1JEV_y^Q5DS~j)%JcD5L*v5U~Z+#Q&%!vZ#-u42S<6A%*2TlT^vs6u4^!PIE~_!b_9|x;z3ij$vzKV}5=DD2(Tnkm7o-03zm7-!aX1+7h4A@b;o$jb^z5(C z(bK)BFJ8R(YkzBk5|lxPq9N$)_4fur|3%P$c`?`<_MZ>;{?dK=^yP~ee+l|8hW&o$ z55Kru{N(x? zq#L2DEle3ETpU9Q9L0R$jbTiY*c&1&1T_F2foP7n6vd{9ZysrkK4G>1FeCFM0&I#Y z7aPWSGS7stxhrZ42;d55Yz|`~ZQ&4c@hrkrAOoWXh|n0$VUmTor@)8t^h9Dxz69%U63IRSSV2WUbGA`N? z@B^nWL;srN3`L?nucF2w0G%H?TU#@d@I4bJ6VJeHJpzX)MhsDqX6Oo&IR%tKhQ{+) zh>jyPCK&>dF*HjVP9^{*V4hAg7@@64;4NH$5z0vbgiF0M1kS`@ip?3!(+F||YF6ec zWf_7qFv<|TwEJFzc@CxFX)2(Y%5IdA5XJ~>c%ND!x z&(nDvpQA9##d=0EI6((7q*RQ+e+vi-cGm*o9i2>ltY~ZEvzzONfQrxJu%<$DNdU|; z=z(YwtD&8nWqjIC`Jqi2AF5wTJfER$x>E)vCFvAW%9RHVOt9Vd#oHZ_f7#ZPO2J1s zXVbjRM-FvMg5%8e$R6(@m@V|bPvDHNZ+AfSGD|aj1sMwRp)3OvMP~Ph`JSaWhDSNg zLphOD?f~FG$Ui0<8^duqA0edzgLj&Jf0>U^mWWlYL?GT(qw3Irz~?P*c`npQ&c-R% zfM6Uiid7*6v96ft?sy)@{9hch3Bm-e>v+KPPi;WEAWZPG(HpVn0`(uRJV#Q8j$^(~ zW3u4;(&&Ft$oK}ZWwsK7?*iN}c5Pt(yDjK_XV*92$8)Yq9}=$1nzN)nfJlDPoww=_ zbuF$M!Po$cKCuiQ3VOgkUwMFxWuYdH6DiBn1i$@mvtO~Mj@|8) z*Hap{QB80@|CFI|A*gdjSt`XsNO$fNdJIlz&*+l?(#`i62fA<9(k--(;Ax{jm0B@4 zDOKlX+juscGqG870s+i87(UH>`;T@?fYNy!pOP4dW%T?LNX0jAGrh}t+sQqamKsKA zG@pPYaSp2bvS>ykF}0#hZZ>*f)BhTDBTBk696PEN&PXzX$)$7S13>j`^U;wNtT}Ia zKk|sq(^Onf1$>kPm_$K_Xv!Jz3aP4N9HSt{$)%)3Ud`!SKY{u@MIjz904z3YITiBr zp%mT3T6nS_U&94`0`S$e{7 zgX~t|o`*dNA9aNU`sfiz?KAYzBXNut=j|_OAwR2wR}50QS>@sTNUsQEEhs3Wq>z5S z`<&dyZ5_dpBA4ZG3zm6)!z`R)hU67*L4sM_1^aPKu2CdqNjd}{DT7G_W0IhcfMnof zhSC^^0{BP1>doeS!RKE&<^s$9oJ~=})HkP#tF2_jxRMaCDGKC;b)co1fF!{fXOsom zT*xC_8dKA+2ZPIJN~qUUm%uDdIlQvu zS>AOZ$Y2tY85r~ft{TCRpZPFOr!bk%P=-TwjnB8GgfPDSr(Dq6Hs7p=q)Vqbn4FaYklt*G&2q8DO5oh-#8; zTn^#Ja97ggp?^-1uJ99%5e09_JYnXra;<1AKH-Ei1S38%bE>pylw9#6cg8iIE0|%< zsG1HJw%)nK#&wBPwO1Wj+l#w+^H&E(QXJ|nybxHe)5u#krxIFxrO;Oy{6V6@&9Xp8~?;|#%Qq1QJ*qA0vVocm3| zSI&~`zzn99oG)v8LEm^_l zBU#q98y(aTrm#r*%BOe5j4P(H(0B<^S6*E6gh@ofZ$jqyU1=BY{-JAeB}2_GNjxOx z;KXIiNMFt|6fdkxwhZxuC7A#O!>QOf6M$wZTd3{PC$G3YrYM|em@OVj!2C=i<3LJL zI1Dt+xmaL#SZnq_y?KBB`tV2dul+Y~{8J}d7CN}PDJ&i+^*Dj;IYr}n46gYGD|Z3K zic%`vDdtHu5Gt7mCCnzY4xjkm8X2!$g(=O@(I*rh%pwZ*qX)SCEgo^Vl&Wc&}x z#PjK-#IX5kRsgKRDRk1GVy<-=Tn9_oL5vdw#-gHcjkvOB0auHj0q6w541SuS8Oaub zRMEf{i6P@U2V-%^tjVRRUJ(>3j-jq^N6FQ%Ftd6mb#~u* zVBS8|?E+3e6%IqlmUrquy?dvNfRrkSpfiG*-3Q&eMK2ECf)lmvdiGq!lVVBhF7mGV zXUyo2L&?Eg?`~yQQ4&yz7*)P0N_@ghv5CtCcuF$H2SF`IuHo|OBPkN{W<4?s$`HJG z`tq-O6IJ?`zTrvb?UYS_VHWWO#P|v&Tm<5)g`cWe{FP>8=4C}tC@uFV8^lyM7)p-lcJQ5snxa_c#1Mi zA`SLb{Iw1|hG&S(nFe?v|6B*+7~*)Ip^IsT=#<0}_(>K3mY1vmmCnNuQCdJfmj#Vb zw}4$ZwBOd0+691T)`sA@_+*W_F0=HiIw0I}u zs=gK{Ns{;615Q0&RbW1|*MmastdeDL+W-sXrDc{OX{{$7rV&+dr7@mi=AL+s*SB0r znTrcXWdYdpvzYqYl~{x(nine6f~|NDed?k*uj_&5{gL3sA1E>qwZ$MfIX7wKOr=3< z%LFM755eB^7jLmD3)A@!4Ep_G$ACRPizyih}Qc=5&Fb> zk0@g5I@10Uj7b(i-rTG5h$Si-DC(TuJ}M7!N+SBCqF0U3$Moln%u{fVm>2Ss@^}H& zCfBM;P^-2l)lkgMz@3{yWc`{aD2KT8G?}t-o5`xgl+BZU`ksn`@=RJC9+0;!3H&Xm zFb7~xqD?prrzo1oC==Sye#}soK!!kG?pJy^8!t1{Fq+{6^QM7%p*ALeHjf!jV-(~_ z)&98!fJL8Imy)JK=PZK^O%`3YNIg57VXp+JstR~j1yS6S`T=G{JjcBkrS1A0k|aba zqrGdAUB(1PqKI)wyl)0Ey+;yTpoqeSc4w2J%+?+OU2q|Zm+KNHV3fZ^o|yy#l7V-L zwBJ(Ir7*Eb(a^3cS;j1>I=aOr4rjj@QYsjyVxKEjEG~DP52ZH?g=$JD+mA7%i29L8 zgEuIvNC<6aM%nJsAVG}J5>6&P7)1d}ScVY|7!i9CVqqZ6<$`O>rsAK0!j-eAL1N|Q z7>Sha$&paVr48V^ODpdT7mcnky6&l-NMe;;M^7T_87IIS(*)5+Y?XP-{Sa)JM4D8) zHZ#86Yzi}Unh`D$pXjG+aL!8s1QaKe7=cuNFW$Dn2(fE~5@EAL#>ysCZ_EIDbhKsn zzsi%2lNKn7f}Ema`}1|EuqO4+-FVD3i-j;nU|fm!RGM_78mgyFoz zWC^RUReOlw9fo}aW5WIZMyJ&2A>dT17f=!*;B-$7!ClbK|F=XWFLWr>XPP~Q<%;s4 z7oBjZ7iZh%X3;q^1&g(#@DeQ~fno>N57aZr!f7k=Oyrknu@r9EArrkSS%m^{)D;hE z;@@hh^q&9(0PUdw{(Dd^+B3VL$GGC9N>8HhNcCX@By-JBvMi@subO2ZZCF*xXy9Yj zUi)#^`c_(fA9uwS!^g^5`VwMXMa>@;=s+g6g8G_LPNx0aK6Gp+g zC;?_sRWDZWM4?Xb!QlTBFp`p(OcsG8iHjDR0CfkY*6yQ6phUH4SO-6yU!rSyd#E1$ zH0)pa-jiqpIq`|}<@j=}KRR~fITaB%UHrc##N#F>D;;lN0Ow_8}6sVQkRo$o4ADd=9#i4O|)t$m{Zy_8{eHzrxm8O+SjT;1q^iji;YLzUfOT4gT1HEa^Ba3SFjh~ z!w-s4amI~*U3Sn`-AFjDLMfpoTU?vc!X~1A9;&CIX%-5jmM3)jWEVUMLjJ!foD$HP zqBthtnq+a*dGfm+Y=^{r$WIM>F~h=Y$@~4>>Wl?yZ5N7ZfuKTmHENU$R}Jbap8}Oh zPRZv99K;aMs3~HVuK;VQNg|nm&Bo^*&={xYK@SsH8kz0+Uk~XhJ4`ySXgwO{(7Kz zT|2sH|CZe0MM;VyGEX9V6HpGzv}PZ-Hd?s@o8$~Do}RVixN{&0Ujp%^g5lNIsy7Y= zl@%`o#=XUXe0DiLtp_bE(5eY0nRP3XnucdJQ299~Ox=VwDsWWTVJ>;|XCiMO-(BIEjbSn}|5hEi7t zOxD+Ke=UbVJ*$a*i!UJUyi+`{2}Tbznt+RY!3f4M2~j2-%>*UN4=0Q<7jEQZe}Ge) zr9BQx<x6RUb^T`vy$UHO0g-rlpSLA6>-9kphJmpfXkhQ0o*Enjz`Y=#q2=jRND z=+v^XJ5Csy2-w0sPMonu3ozkLlx0|c2+M$J?xWNe0JXS=;Ay|gH$^!D(i-m+RmFad zSA|{m-vc3YpUh_?lyQmNgCO@eFN}?frbDpj1>fHNCC9UI2N+GuCOlw#RDPE}FvSGk zpA(G6c@JJN8r25eU^GhfQ#NVSKCYUff}P9odXOjHgQt z9x*;zHsli1OpMPd#@O4J^osH0`(ydV=+Rr%F~+whYC&(xH^vWr4d)m?z_q+%{23&i!Kw32{{inHH>iS3WWo@YivYsQ|g2mrMoF_1$DD0Dt#>GWp?j|Bf;?>M!6a zldrdX^pz?2Y&B;YQ-Afj%aq}-;4f2!&G$O0=ooR*YZoOwT?aR8)SS-EFl;4E|jqXIf2Te|LD<7H)m=8`gzN?~Y zFB)g-Tf>h=WAi)GSa`l}R~lo7Z}z2GVV!N-o5rBGojc9l(Y%5~O}@e1xkt^)TjHJj z)R;54q*G0P^ZZTvjnsS9Sd6`*Tg|sUKFxkLU#~-r9{DvrYSx-S(BM*2Lt|^7nkoXD zooZ^ZFX>g&K*OE7)wsB;{Az3o;0t@!RPMMRckPdrzBSd8x2|)I3Au%L&3fayrhkp5 zwVi{_ov^^lE;hO3vAmCs*^vh?8~=ktgPV=2ct3tN)=T7O9c@fjXzOa@A!qZxHs#BU zrMzwO)v<=Vjc;teYlj;>Xlr`hc*pI*=cd-@=JcL@ZgL@E1*aSPd2vH-H$H+^_Pg=F zI~Wqw<~?tG^snW5)3y&QJKuOIe(=88nD>oueDB%)#yiF9`QLbZb+-;U-d=o#9ytCt z;ia8ea?!=_#Zm&ioF9t|-Em|olik*p#Rc5x%VJnkE_v)S{i!z;Mr30Y;gy9Ro51G{Tl!Yr`H6)vh~5PU`f#7;@o9tsT^+08yxukiOzL)t!jUwJb{+Q zSGqJ;-*`7Ya4l?{MN~JB-=4lZyVyUu7#i7owdW1zF6A{PExT>r7fd0+$YZB?>nv~; z2VW}X>Jd@eoXl*@0q0bTYmWSy$IS}u&6=3EmDvY%me%qd)~C%3^gyconcgw3Or_}% zVQ0{*g5pW9S%Q=2*{p$Nr`&Wvw936%1KgX2)4^fp<7@y`PR;3qrE_%F0IN^esjpsi z%1$$Br{V!jRC$rE)6Wo6s?IZH1`!%zm;{4OE zmx)m0TOom_9GO*8XfCkxV(CV}c_KcHLq;fbX8 zmXpJw<=i0d14ShcR$gx&pNej80pRWD5WL_Te|ld^zlFA7{%v{ zB&3E{aN!F)g$#t!0*`Otd9r*gMFrm2Oq`#f>-_u{4^Pk@A(0K!z?r|exs*{Z)`rK2 znyKaA1+yF(Yrc?i7)ln{wJ<1Y zWeTr&d-2)`69$eCxwIpZaWFyg(x&@SyYkvQPv`w_>pX3oDNXLv208cV3Y;Uo2VdZV z?bmk(K6l2o&KcO8=OrB}J@Z|5q}=Eo4pEB?D>JF7{81}9_DytBz<5F1#b3LERDyZu_RaQa%?!79Dqw4E$|@}7i&b?^s-IQ!d)9oszZtK)vfS3*?anh^ z4Q_YM*sA>QTH(4|zdPfkZ!lz}C1UT=lCij~-n=QJs{+*8F!~7Dyb)uW6WSRudLS%q zMo_5kemjB^ zRYnZ$!Q|`AhUAd@l^Q|huWVv4^dIJXRP87<*+`UF@jJDVC=HCyNTM_tOBzX(kW^Yp zlrVkWRuZ)xt1y#j=;DK!M9EB|G|H>mNw`Db)=nZP;LZ#s61fAf90c?oo1)CL*ydkP zB*z1_xmiNf*1Bs*{Zqye#7GzsY^g%EKt2;8NfKl}DE(uK68+dIFzo`8#0%+XB?1^q$LK6WA+zBX z_y39@Z9J>I5(;|))2^EeSq_O;9+Gq=0bH=&HEIda99qgulEF9=e7{h;hXlS|A~Qmi zX=db9>~!h&PIN{44+k2W-~N2^XNBM+0>YEqBd%&D5alk>O5 zIDt2gT{>5;`4*5%w_-;j;#A44AZQybrzA2Fosy_z1iu6_;i^=oU!BkuNX6Gjk2r39 zZ?X0fD5ZVjQJP;3sWN`>r7kM_@GE`pD%&(^ql1xn=NAJ2J!I1N?jMwTxs{Dz=)?~i!LXVJ0j0R=Yl*%DU+x#`R#w8)J4hZ_q1ZFTH)FSeDHhSV z+#N%Qv;e@lSF{(k;iq_ovXNV3q6yFi{PfMQD+MWhSqbA4A^hxzp>T*Q4KB65yYJ=Z zx4KDpurv;N>4bJr@pUBbZW9$3nD5yR5^0pt&FvWy!i2~JlStc6Vya{iC;?%bTSr9d zbzKS=vl&SQQraEQ<5*N?XqLu0Xw()^{*O*b5{K^P{dVk53I}UtXm0;nh)0G*T0+Ynmg_!cXs$0?=Fd$%|MS49$~PI4zh%J~tO{ z&dW=YOo^t&#G&tR8;#sO3Xoxa~ z$D)yr;C;a*esj6zp}eK(sTw$WZ7UzL#3&e$a?U70FOLha^AnDdz<5wJ0Ap2X0@D@! zV17XhFQi}4!VAr)?+19WU%=aMB(A7kh89hQQcQDr{2yje^uyQk{+fbqoB)zVNZRwv zQ*j@8_!^8LMG**bIz?G=Rqg^F+6wtw#4;RGOC_JlGMh+Mn6v3QgBcSx>oOWZnvogb z80J)1t7lBoCoI>kOi~g~9Z#3-)Q>bo!{K}x`*cl_$39*6tI|B(#_cyxcY%1U(@S8y z*6B7N+c>=v*3xF`HWsgyx`U$1O1%uJY^3f3Wg4kh*_!Kr4Z0B}-5HKcHs?4a$p|Kw z`E0`k#tVi+>dbp#hCb*H{?hH2thVz=1)_5g_S&|+ww!XkRpiV29!v|i)Vs+A%qEDv zCX@|9Cnh0`r-ZVOe~02K=YBTP(HmhlnG4^3=ayCXV^><=euA?!);lxmPP*nD0SA{$ z=HV2Dm%$}k&>@)dq1v4-#Kq<>XkqESqSd!&ET9K+1zUlfH(J{YG$N}q6=;R(j!XqS zRNSMTjUKX9&1}je*8qM6Bby2wE7;gLRJDrDnq&WRu~`jz&3LT8NkG5X1ZllH;#&l1 zl_z5^%W(`e%%F&&$k#;2Q$gO1cK$lp8+0ny$MOkD)c{u5V3YtanUmCk?wDYd$@a!_ z;9YJ2-1LB7!t|X!;Jf2e`Ltddkgx1%-II#DrfU_C>kXZJcw8@M*K`JX)wgwbYkfw|t9yjEXt3BAU@yk3XTdC<_~tG&kC_>J3|d#<~` z><&y9^1 zY}fXg@oL;HQLf`fQ;B!0^z!Y|_e&ao<3xECNl@6U8_HyD@0)D;%RQtQu%!P{CRtXtqsYSQb@lVmDCuW7HVm$5oTRNrnjR6*_F7?FbFarKQ^SMll)nWbl>VAqj;*snUL=xI2p;p(IKPF3f0DKNY8$V=BnU-FN`Xm{ zG-@X4$s;y%Q1J+cm${vGF>l&oc%HnUVUc+X^Z znFX1HF%c$^2P8x9&cSa6lN=|M!8jKG&F0d=`}b|nL~9iP59*s%CJn0<@uZn@MWqZmtpi3gfvj*+as-I0BFYXj4V3Me#Lm~QtSS1Q zL^fUvNX!1J;f--Jq4|5gRmkT*iuBf@&>Op{A-ETz&K_D%N8x9z5PM>so92Cd!=t3`2v9X6Oha;oG8BQ)!q^L}Yh(wxVFDme@S@q- zJQhg|Mo1?DSoN%ZB&7pQvVevQN1-iqx8PW-ILfZ&o{>-sA$B!zrnTn{pOp2)6{qKg zdH)7*Vk|L-Ql0;zuu*NlyEy1uFqzhy?UpT=r3HG+Y~47OM7eRFmiH#NT+d}$7$dGp z3JLO1h7!z0HuNdYhSK`x!#urF3+z?r<|f~oLC0%Q-2q*2dmAXSJGbD~E6_JVk4ZKJ zdo!~rE@uwl=iL>`M4~j5WjVW)Bv_}>d^UsGVrV+8iQsl20yj5+)Bjjv>*nRRw;gbM ztD`9zz#>G$42!GdRR9(d8Z}IN%-@R0%dhcdYN3@w|96`dH5D>g^9R0TeHbkmqHE2} z4`9&mJ9v6^cxUj_`e+>le+PfHY4GrepF!$4q=rS-;SsF2Ge!uQ&4m;(GoFupjPu#~ z2-d-?>j_y&ef>}Igu$p`884~oR2|+ob^Y{Lx33>do&DIxJpO!&;&^$Bc=g|a^5!0c_;R0}_j(V0zg2uS zr2K*256f#BUj>c9i5JY$R`FE`jE8q0o+{J$I&k_)xe{I*`}pQq?ABC^TH+nOGw3Tb zz6T5VO++kz^hoZYIXO@0eVPN88Ev_@M0*cw4Z8K4p$Gm7X2A9ce{Cl8ZHKSr3p#e$ zsll#Y1*j6SqzgzgE1$UO<7*hIRN|lm=ZtiA-NQ?0#(aZk1cXy^Emo?&!jB+>U`%4= zcE%wD5t7kggo`c8{w$8UT^-C?MW7ynk2nIs{Nqsk_h;}KgmVUhr~^7681H@57$jBV zDol|ZFMtY?%~|PPijwmw9_!0HE)&r(ltE5(g2TD!cSON9Uv7O4Eg?+0@$3D*(Fwq? z9+2T{L?TtXpdpJZg&uK*#E6cq4^(w|J;Q}8k*YG{JLxZ+8DkxOhk|W+@ee3h;qgp* zp2I7GBXA9~gxA>-9^3+?E5hyGW8 z_SP2iC8Z+Ow~dKHC3yEI|NQCUcdtKj$JLYf4P6>e(F}I~my%?YIQsp5|HZRs;=lcV z-}&#LKX~@?PlIRu7yXydpYFYU_NV^fS%2{2PoTd^BC39K%3$`V{@S?Q&V3`ln=Jr3 zkLAR7hM=RiBhCVWVh559MVze_^$meg@P3XOZ4=l7*%e!+<)C# ztRziCmSUznr)r))Q>rejF_Mu7y=oR6N^ELQi}vDtpV`#4o7M{AKsBd>CT_38XZJv9 zh~_|)Dm#2vZlYiGOR4Y=Vu)w7V*$K%n26$kyMqrJmQlqd=1$fd?3O8mKdn29(cx*8WW9WOOHm#YJknP& zY0-E65H9ZM)pNSC=@nNqLJDO1Ds7Atkw+~LvE6AB+LWC}ixKv1>%|f&Ow_btV1yXN zF}<59$`LEuMGt;$W?efi2Ss}J2n8X`?8#A1`eo>q4C6fnYy;M1&Vjqyx@*Qy8*n-X zvyHoUK9r83EhB(sFubg^7|k&*x1(-E#*!p$a1Yz!|Nn5U_tpO7{hu~sqrH=N7f0t^ z_K9r}NB#ZZ-r!mPS^55N@8SOMK7K#^08V2BDL+L)3Yo~6aXrPcObjkuc>tzhg!m>E zp)@876oDUp*xI_e2>>1!!Ed|2%3EZqsM$Wpoi~QFUedNic|$m7)BJT;RN*zm z>yKH@o3&&IZ2P}kSu}Py*sWl*zb){O{j-zflb@v@(vSJGARn=gXEa{fgTXu4G5h{X zY||a#k~W1`@(i63%0P@SQM^#ca8ydsXZtY63t=xHTyc_xbL%HzqHqcmOlMt5`cEVS z+UNsh2vU;JU2u&6Wf@5(@dD8KWP+#)d(7#h*I1m2DS)vc zjNvP^D;kF|0WhY-gklYZ6@~2zM>3256^wCITxXKRxUMWL6}p?BXwI`Ji8T9`|Eake z{i|SVLtW1m1|cIDt3X#S1yABIjRfG*FGu?Pq6l1JC^NL(+>}9B-uJh+T5y&=jv~tP z$+-+|EmA#jR>29MmP{uN8%nNdYvkPJRGcBPn{-cd2bJ5~F1-r728jy%A(=s(aME=0 zU75}&HzT22TR*8Uz3U7!WPI8MW1LZzr}3%CrzkP)Dl-~v8ja(mdF-rgg15IubbZPP zE|NVEg9u0D3Uwt1pqQeDsjHj~+G0A=3@2<1I{!%nwY~f&6@&brv;($r62|kWX0CR8 z)6_UQr6~a0?)W)-o#MP5583*{<~|4y9Ih(Ut*9vzURvhO6YE=({&Bhc6{)#n)rGm` z>}}>&KcCh)ccJ_`%`7tcTtL?|Q? zvZtN*OQrSV=acB3edda38FazfJOR-7mXfGACpnwUDU$BKGOC9h7~TJDp0w+@?10K{ z76cg*sdZmHIYCz_dje`_2?PO3u1b?&|IIxjd0RZhrI0*PoFx}eP>w*Kd;)?^nSl0({ zj)%)jdc|1P347WFk@p4!)7CpZ2+}q}V8iABfwL9lJAvKMUc;O{V#+rG&X(?a0ztr+ zgR=s7ZCKP-oLg)>kHDEv9=xmJapb&jXqa+QR|+7S&9tE68L*P@*iQ2Lc1ES4)A?KB zci8O;adp*YqZs6y83B(bzUhN$YwLtCGz8~337v$SGO~$)SxQVRv(T<~mgy)C(kS1O zMx`j`D4iaGl}o-{%2in%=ZxY=UGS-_;ryJRvkEzZ4(;)5b?EKX9(3;IVR2Pdy-SOm zL?zQ`ed6TZ;n9cVQ%8|VNQ7w1Q{UDRFheu?TmSbiWsuEj7e-OW6+2O;{LpKDSuMzD{k! zKGKEkn1LBw00u7+fMATSwI6wI&Tc{m$EPZKO@4>e&0oF#A(N<15s-W%R{an>v9#N( zuq97ix1QxE)?zq6I{Wqbz_T7&qi!!y1x3A^8!n}1Fqt5Jrbg%!(96e+5vcRgg1$Uf zyMlq_)OK$5qOv)*=ut}v_uJ=Y;~Kr)PN*lEk3cXc*)`0fcC$^d!d~kcZ!!48HWT#c z@-z?jUUvK4es}P_PI6f!YjOVh-q9XTzt#1ZKm3VU%}@{LVfA^qGQWNCGqU2@;hX1f z&k0$#SFU|NuFe6ClQC?bt|iXP?_|RL%Dko6>(Q4Au*j2fMnnM53pk;2FYwhArUQ^6 z*&|i&OWWXl$)9Wg^u44bPe%?49(}@rjU54uRk8>p5qOV|v#jAjdrwwodAc*jIj51!Ih9pJ1TcbGx3iw~e z1^!-l&<7DgGGLU#1~A(Nlz?j_k~44&c$UUUU}jUk&yNEkjK^ex!|v98Oo^}#4Phbx z3Hug6aWaX8#6ChH?Imrn9JP*nnm@RlgX$`Cf?jCgD$<%iNh@|tehP_&gw zSBvIAy`Vh~GZbBL6=L{GWIcK}23;{v%J@pY`xn(ZGnoD+-R6E5A@s*Wt+>?>{~!=c ze8}5!^|K2)QcEa68c%g*?XFqHZ+WWJBa+$Yq!mlayGeU%$YpX|`Mph~$CfkUZCLKT z(_b4#b%&ORRn_(7A+;Q&MyPrldYI=w&^%WiJuu~mPlkn4S&Dx}8AmCu=G2?DjIP!# zA3e^ScHX#?W5r`Y(d-Ik2V|DQ41vzyUk$p?g8nY}+o1b0=yyQ(0H$z+W6Ut3-CyP- zq@Z+v#!OSA;fX5~&_SOVO2o+Yt_CB-;GknOv{S#x1J=F#i-?4EWwuyhm}ERE358a!KdjO47y3uVG%JrsOXgX3MA~soEr+!kp%k**`cd3W zaUIw*6jFR+F+D&TD{$nl%AJG4ZdJe#LcNGhplXQFbr)~Wxs;|IEUmjWj{Yaz@^gOe z*dr;klTr70P1^fU4>vUT?-DIq_3;<9XzJ!K3e;*{{RJ)Vw6_QQEhlup&6FPOuhG?m z{X6aH;cMykL>v2h_*w+Kr`F;%sg0(xLQb!>-kPXx1*v*jDwk;;1XD+m*N$y43}wJZ z!c~px>l#seUsjgh0G`g;)w(hUrzzy?xRkBjQv5(gC)~};0pC&o=(GaTW=FGPkg30B zFs;4g%4=1Q7y5)L!^z|zhZh(sQ}IO70oyE%YnnaYDR1ayFo7LOt<@~F-}ke*kfot9 zIx^aTkseJaO{y9(@j367HD+j*vPI1h7(EuGG!y*|+JWz7d0nX*#P`S~T^oinZ!peqzfvqsY^r^Vo$DuC8Grz{-n`d#zQ z0J-dN`kH!2*7jdoLfA1JlT_oX@hJm;T<{YZzH%ScY`-g~4X?i)6LL9EL5EB89ogZI z@6FZ3vtv$*2BwRIQLS01*ORzj5y4?fBlQ`KUObCX=pQnrUMGZsZF~Ky8zXyccFaXw zTeA%c!4L)LzysT=QoVy_Fp2i#bP7-AGcf2kvj;esqVST_#il4jGT^s-N|h17RVW>K z&kCw`!_o_E;6A{rO+ZI^?`C;z_l0Mbmd?HWDj@6^48MRvW+{#lfN`9Ms|Pp{m$B;J zbA~8|6SOP#k&ss$LmXG`Mec)izIqfK%GXbfDf54UY04=q%C>7Cyt_2b5R48;LRkiJ z!l<c$}7BLA8Ey8q_=(K+~a z|IP8?{>AaTli@!Tz5(ZrK8smtu{wTLom9bO^DuW}BMpEvo|IAW%U>wCQi^S>N%u{P za~^Fw`t{!i-NB2t>h(_9&)G#N@Cn+6ZkL#hdw)tIa6wWMlgR>{iz>hbz{wIm4~2t0 zNyJ!yzrO;UTp3{kClQ#D3;~>sNj8%*DrBwF#b1-`GA1yhy_CrR378@&kW_Q2QIphL zZ)Qc5ewBGWk2zs^JG7fzds(>inxG0#3L^&OPE9r2;lh|jvzi$BRIiUxCKLd9~;-n2`wSS1R>7h9YU)ctKPU90$TKNcCXE!t-Y8`haqv0)!eBE0E_a zqw22Pcj*UI9y0y!b?iS}`=1e>j9@b9O&~+paM4}B+1hqM_4Ysg!HZ`D$NuNV(|-TK z{^ve^o~6gt5|XbwyHsv*`Wt7y;zD=`jO%+@U0mRcK;2KbE^!hK!OxPfwq}SyE~XE+ zfO;E|;=1CyEi*%LrGe&_oh1{dY1ckK@>dr(dO=|^ELu)cJnPb_%v|qnAifwa%D8kM z%QCsuZDufm6BGrbh22Vp46JUL!i)uEtVXS(Qb=YgNl?Pfnb|7&p_?&B2?Nh$yBpK>z6O_(u2j}_@|W^is77wKuAzXYDCEH8woEd~DFVQYPb$-l3<2Ty};a&5(v${vKQ-Jei8X&w)@J(;@h+1Jjgtez%fBf#0~Y!O(afQ^e%gE0m4ImkDB> zUC@a!75|k)b$)ljmO&P2m!+9TC_|&S1HRh){)m%^AF*wwIT)$R-_3NB7@eUpr%lgH z&A@E|V62Op)j;RsVMZ{LciUNWvvH?-1X(yOruF|Jqsr+No24=2_dSo#+f1W(uC!F7 z&;6ka2U_&g6<^%G0$;v){-ZcTAlTAqe6f5KI{8gWrGuFTkcKDFtrVG|5G8lU0MOJ;^1ED4Y_| zIX8}LAf_2bV4il}fbmGC$Mk_XAtt#Z(w_k212e{3EhZ(s3csew5aitDB%J^$+b)`EC8G^#3cIu{l4mr7Q7T7XS_V|6c#)o~!>q z_Ba9xuYJ|Uth&*4pBVCM*Rncb z;uO^i=d7C>0J`8a_}82;t+$p#{Uc;YrTc3=Qy{c=d57UEw-vgVZhpql~4eD27vNgSK4}HQAcd#iG7Te&Mw*Z zP3dXW1_t z0xE&FJrEJjJg2phPqZr>eR2%;u&I>X&BJD(-t4$}0WUjneqtj`xtejHVh{t{%Gq=d zuC1R5@1s0Jg}NLColX@cz8UomwBT%MP+2#nx=z)c(imQ$ph#4+K-4?e3Qmj3HmTa| zZ2KXvIo%p)>-lbIu#pM(j&^zf_2+QNOG|vw>9JWV2^rxe0(}w3t-qy(d2jU7{HFcX z5Z-gs#hJ=0>T4<4_8hTgV*3UOiBQn*wyr-#Fp3eSt0w?!7xT4T=U;P@&1a<{iO6*l zz%fHvFvD?-DGCW^kTye9s=$Hmb69UpP%g?b#4))-S-|iNk-2{&8*ynU7Yc}rC50J` zV-yE;k%TMuN5eQ5ASw=)9AootV=?knQ$clE!g&mQu>-pj9ix(W_Bls4|lKEm@x37?%dgI`v++JhGt0wO&i8(mlN*dJQZxj40PZcI69^rj z4#5dYP+Ju#osVKnrzeD+As8+8b)tcxh=|}msfcKZ`XxkiA`8=?c>V&#`$|3Pc1iM- zZB^qlij{l|0Ki~2LF`nJQV`c_KP|6?`{Hu?-yfBp~l24(-hXU_)@=l^~D)_l>C?DBB_fA8nN=7AI^lMfk! z5l#@LA7T>1xJ#$SyUu?I(_5KGmlyo@8wkd3eu)o19ltpOzyA*Y{O5|i;GM_Ye*>Mz zH=cI4ogI0BYPLLhbNpfd{l)879S2oMT?x~aBow`Rysb}0b;A}=@Dw~A$YjP=o{fJN zR?Sl&Iyxnkfq(jGI4 z|M3cRPT!sU+yS;FuCz}rD(d1-n1O-#LzuJ*7LM^1df?y(4*udC%o(Ws@y)ya!{d{m zb$$&BV#2pvnTee5#S}4s6EH(Fk}XzR2<@~qzE%od<6)K5t&;PjlZ)e%qc{0-`Ec_7 z?T<%i539yIN?+~(fEh(OSJN)MzRdZ$htnRo`RU#Jlfw_kr>_Q*s2*p)Y@K6pq+$Ez zV^5rkZQHhOc5K_pWMWKg+qP{_Y&)6Q=*|27cdNFx_Dfe+e|_rd`#$G7zjJlzk?}49 z8oYuEKNi;B6Awf`uLQlhKBsj3my^+jJrP=5&}*T1U!g(%C<6EiJ}}36pMbJ{e+vtL zkJ;fitrD3sjPwT_K}t-6Wx-3S*o)HaTOA=;q{6l<+-*c0LyrNA?ttG(@)uXlxfXbW zXE!8rjnc$c4n;1K(w=auPR#Bt!Co#No9%=w@0ppy-+%3YJL}k6<~IE5_4lyPo-W_; zvSGDuul+P?sbHk?6JWXrXAK~q`WS{#1{M!Mr-|hp34inam!iR}GYcp)Vy>4n2mbv% zX?}4L>Hz7+ikX7~<=XwPg2DEOdyC4)17Lv3eO6D#Q$b^F43a;_1H-$nihJt0y;q}7 zMJwPf=zdT0-Q^m1ME0!GAq*W?@(fI!eK&j04SNRqymDLUaPLLQMDKD1XoacyrC{x` zQSV^LP+Q>aV5UsAe%$ojRQE7izJp+YH~@Sxr&Km$xf;g6^z<`JGCrLap?Rf z%s4@m4kt<3-!u_T;UtVt3m=U%h&k77yBLnG57F5r&29+{`|n&0D?aih{9FQb*ZUx} zvoIUX90J0hkmdip)smdN4)jqOXJAmyew_xfu(9?|sJ_hJP3kc?cTDH3=W7Wzh?#1Ksy7B8SIV-T zRF6c2F7exj)E({>=OYr;2dd4d)eSrye%06UyDlj44|3u7W`Cz^MFCw`EpZpY7e^gw zxX&8TjIFQ9b3f2_&#fHSt8BM7Xlf#M5LXDG6WC*iVIz>k{;p}Ku+xk(C=7R4-S^(YoEF_p004=UEUzz{W4K`$auV@vyrS)T~b2U zpgC27z6j=sLHRW-eiqSx1+lXzO|^BC+3|tsts2y&yQG+SfU$YTi_}{TQILJ zIo2}u32gJp$EtfLEjmSSpg!dSy=+4S7Xar8@tFn8k*G-x2OowP17v-w3|h;14!J2_ zHx)JtReop;kk`bg3X$JawPH(Mcie9_**e}fbHo2LhuoI#{n*t!OH0@9FOX&s;2ah{ z%0JFsq0YAz9El?-yq7S#aOtu4mM7C7g1v@GqG(AV-AYYMsK#oh9h-^6HlOYjk`%rO zoPG1OldNHc3>`(N(wmM%0?eNwpb48IP_rMPM2$+kCqCylE^a4;q+YW+OtCJ#Boi+HjbSCy}8%E;q(vyFdirG>m=6D9eyU>J23lBA`>C_;Km zQ6}6W#@c3bgBoh4mXiwBNgSo+oU<5694e2hmNi0I(|SdvM_-xaSTdWg_}6^sj`*y1 zhWk{#;dRx$o}lNDzqYC{E)~u49LNgCDbf*PYLb+ys*C$DsW*ROpB(d067A{Ymob2l zZB8cU49x+y8?`X_yylaxhg3?>zK1S;k7f2`WQ^fcuX~k&gc9124(Ivh0wwAi$wD`y zmmsznme(Q-+RE$@Zxmn6g5fn|d|RB9LylR^H*2-8%Q-EW5|-yZWx^-1M-n}6Bf@|$ zd;hT^vAWu?*1UC{T<%VGk%8RgUx*dE_Jz8yg|X_LZ(Hp@c2l6Cp8dxfjWr*Ijuo;v z$vr$->TDQz_$4sCNLd8V1Ft$2 z~r^AW>O#KOOoh8tVS-OfYGB6(Z(XG zfwDXJ`3+Kwp8Q^gWF7jB5heo`KGi8Y;(y3y6ufqdMP-zD>$$8HItOfpC~4cq4h(1B zBS})e3-)kZ_iF?dLb$x*b+0?AhuEa$HY|8pU?!WYM?S|;dW$s8$Vl5WYOGTbVziaz1Xi=GLLt0tS3-|U`TwD^giJl|GIa9Qul-HsOXfX zI!=TpQvCVd>IOLCx0c4Ex;~mVal2{Zt8C|P^LSRIS*-Rhqg5=at<941(yNloC$v2Z zPKNsd-w;I6s{k#BUpMh@0@u0MKDsIO&`LsLEMP`U-BxEGNBODoZTscjHK8?I5hoB0Cb1$&CXG zt`UTa7yK{Fm4SSrG>AbeoJCbTPUrET*i+QqY3AVy(s=B#K^p@hTq#y@sez|0j>H9u z!@uSG3kas=@0t@=v0l{hw9B^1X*UCL&uVbB7ry57`CKN(E@NOT?8z6?NMDHT#C&G` z+NvL|*_$e>nhfyiGPUXu$JQ}6oY}dFRsaf!eezY5(1$Dac@s_$8Pot9>1^#fA^c7b z1{&z)Pz?+WjPQ}HTt;@7ecDK{p-oxg#zET@ zIQYzBA<~~uT}*3q)u4y|`d|AZkjui@gC=+)q3aFpMVXwgx|X#Ed_wIewC z%J@~yP&B0F4VhNO7#;jhbV1P>-e77N;EuPhhiN;OmXp0i+VrXZ(kd~WUtfPgJiw8d zWciFe8Q%qYt71lJDwY!?b+;&YJ$U2dzg~Z932Y-0gJaaW;~|sm$G@U22}+Gob&lWP z^7V*C>ECEE@nQAQxR9Q_`n{rp2kjn9G=a3X*1iauHEwJiZPS>JKJDOLuWU)RjKQ{^ zKlaFvz26tI3gV;S40=uZTGGuzT#t9$I|}X?1MU3)JprCt%(6i$JeQArnQ1TX#2*g^ zXcK)`SB~X2X>gIW;0^6+gr7VAd2u8y?nJaV2X^L%-Pn8Nw+CB&-Rs9!0r9~dlMiP9 zjwePbsCH&P-Rd|k1y(c`_+?@^OMEw@!h55IfInoC>BU$d`C>`Yc@%$S)}8$|%#?4Z znJOiqgb`PhDJiAOG?EGF-ndCNbMZgYpwi7vRWGcdS<;xH&D>WLNZ5sF{Joi1(a_mm zxEmB&mGmODU5f8{+3?YLMYMI9#oMQu@tSp0aeHHloB$crRJJ6MPQ^NNXDtpHEdgnw zU602;eq=p2*W1Toc$j6zl^%G7!=nqKwY~<5&t*}hD!@2M-L4?y2qmx&192ZKdb^X` zZ-G364MQ>qijN%qEKuXxtNbWqv#ZZ+oFu7G5hKyU^NP{x|I92r9ckfXo0nK(`ZH;c=c>md=aEDN?x%g zaK%!??rGlFpCF|%gaGkrt)MovnJrxP+weEXINY5KZRw&rX;FA`AIAPYq`teCJS;}E z7HP3hMN@pIETqPm$lQK4Ij3>G^s~5wQcUViFr&Y9br(4bPSDrn$*e3yih)T=p6!{f zhaHTrhO(_1YI16ANKc!k&KCh3D;urTCeMlrNKp_jt@p0c*u+Ur$+*ksO!I70Y2{?~ zXa+lFP{$pjeRAg}YvrIMh{m+ zP&5v#L^*VWE^cVK&~)&$pGq~QR49Z_V0W63jkFYOz0&E;h|f8_T3F9Eqz8_S$Qd6~)7x>yb-OoD`MVMs7RdcKHs=N#` z)@T{xD*%S2n^-U(OE&HvgxYhF_)X$O9ZL)2m4rwh*6-bjW!OMUrPv*rLO2zS$6|G} z5eg6xxXEw3G+UPN6+$Dd%hD=VgD43km+Vq|FC^F^!Vj21dJd>)jHZ< zKRq;;(CDZN(?jmi(lw^@>Y{lSgUD|k-eH7bwKs2z^&2i5`{f1}Y zP1YKEr~|um?nW&A>SoW*(bm{hhxqLv6ulM)pS8_%Hx#qRuE{v- zmL}~&0uKrMWQR?tgZUBp0wIbF^!AX&{JmH94Yk(jZ)k*o=XcP zXAw7}xo@+V0JDt)8X!F7q}~C$J>!7?j!v@Ttl!je0HSb7#yb(O?L5SFKZ=v)25H$^ z+-SX}Zr1x>bMNpe(@CL3bF%c?|;91?v+C(Os$1aCBg)gNh?uV z#G(kTqMPyj!p+6giM5Btq+iJyxwljT=dU$@-$BHZwe`lASm)*1$-b=Z zq<0R}9+j{CH=*tI4F!u=`5S96R%I&<48@j99?vW9(y*6l$F$=89xfF?skk<#u<@(A z_sJ5H$uzZBCW`$A98-BIP4y1vRsu`sElsWk-d6H}NIAWZk3fsh?y!&C=R21c9Dz?3 z?#%ZG(#Oi}rSDwV;;c|98P5<~W~m;{hZBK(MS_cf<#Pbc)%Kt~Yt|(|81G(Ht%X&V z&S@LaZLcH-|8nLBhL5hHjU7=s9>e+g2vtkfGjm_x1Uzw;=ZKv*{}UAY8Q@Us3w(b# z8~pmVF=Ib1Ou&Y+#Ampo)Y9Olq=K-=9a+vo$wb9$nYuRvcNf7Lw)2&V2Y6j6+(!zB za;eMJbvMjR+gT^qEjauG)#s23Vea|yM`*L{9${&5mDD}4=pIdhjwH1%Bmff*y9|z= zjY>p078b>9&i(TxD$V@^kwMJ3MKpJu-*%sWy1@wq+njyf1fM@NuTh&ybKf|LK-sc@ zvpE88pMnN_*Wd2%w~;n*Ui{B$3a;*SJMpT@j-`zIMzxY~+!HK-wbVnTKup~cF-maX>t2OQV#>0Om>zPJ{M z(NcDO1UGzGL13dhOO}LP70&dcVDYF4W{=&17V5U zePW>Wr%U9``gEL~%t73A%*_H_-zdIctS@fetF7O$z$x-~^A_8H z7lv)vp9&ZyJLZAEv@`!4q=sWW^Ie`4{m_=2ZPDV}b<%`>JpY2BMx8h06-OgJb?k=p zg>r@aJ}&a^wFke|tC{22la|?M9{(L)B3#@WL9%rnDg*XmEkBKN?~>4)X3j~8S>j~v zG>S8)%?$&O2B?4XpY&gAbQy+|B{X zPHka!IILuBqqMc58o4Bue+?eOVzh#m{8P4;{Kx1B6*)BYL?J| zQ>~%3W`q52$?9H~FwLZZ*h{{mHNWSga@Rb(VnXj%0jn9Pf{M|9w@OmI+KS$`fS^1C zfk(aM>ik%>z>t=^N{hA4<_9(QX!Re#iZ({escZ?BbXd+?EsK)h*8W7ULv@^AeLh*C z&Tl*Ugm>db%}}J>f&J8aV{3n4N~TfX8za9%wTW;`kup86uz=8i8c3F8hOB!wge5I4 zM-k=HI${2%I?~l|Aa4|^V0QP2woxXXMcFg^MSJ8eRDA~f-&UK(S`Ti;V_M&4bYs= zJRy&EI0mN?D}GQo%wch4&o{yTgJQ|hcsi_6v24RiNe@+_$RbA-q+jr%a!JR*@EQ+2 ze%90Y*{zALdxzMkMSM49 zZGRpN&TlM40n6nzY*>Xvc=8&VhBawX93T}es+W)cJ*wMf-u|8G(oKwOQcYamo}v6} z#jNNNHrpHF+gl!LGy1%7o#SCsL)QX*us{78R+#unxP#ZMRc!n#vbka?ERY2pt5MxEn?Vav~TKili;30mCmPcM}EXI@#}Ni+`@hJ z|H#oSG+D^X|BoE?W4|uIwb;XP<_oGs=tZ+_k&1 z0GN{}=_PwS{5<%N8g2DbVZ0`eQ`3iC{H^aN^BGYD=B81tP)KNh)I^`Cxz+6na#VF5 zBU`w|KY$^FTwIEc?S&=_YN%dcj)B?6Bp}ADx41R5s>N5m$t;J<=wTaI4z!m1!pb3L zv7lhX68{Yq=T3`Bksb9Qj=6v^PaRSCldVHuFU}+20rsdEB=-2IpdEZy3Ri%-Jx4mu8QPdHh+`kX6<)X&X^* zZ(w2ZvrY%f-oOg6PM*FQg9RiN*MZN(U7bgN_wdoK%i}?W@o2!U-W`oJQ z!=L91d+-g&fbzqkj#9YHxaSk~Yc?9)CZw1n$OC>zS?=B5l}_Lh!>DF=)wUpCRT{Z4 zHU5)#j=Y?2C-O{IEv(t@lY86dv?S#Cv7IaZnk4Y~VQX!8KD}!iLvz=|)kZJIAu)CL zJH%zn@}x;Xxu%icGnX(`feIJD_!@#L4IN2XEuCZtZL7$*S%2x7+H!eIG+;}n z@+}68G7bOm$vs(r#!nTK%``{rjw3DM$6;BOG%zpP7L%<3=>|1iq2~M1|aJ6MJ>pYEbdKndrGOmd3pZ}woIIubCIvW z!pwYM^L`nAIZ=JRv%Vk3SQFJG`c`xvVy5%S2FL}> zjPV^s4xICswbgaTN?R|BY?y#&`aSY7^ zOh-kgb+V?rBiqh7>I)lKT_vsC2cy^jZ1eZ+$(v-Tqs|XPu`zX5Oy*GWEEhsOaB3>^ zJ|Cl(w*Bk(OH}QEoP-8luvud}0p`c|>`~?%^xQxvB~Pwpi^*uRA|{5W&>6jT4)a-I z5+G|7YEJ$~_ap@_P|eXq9ElG>`!#NX&CC82?8^Q6?A-aH-hBF&q<*tyLjPa7x($!c zYgh1heIeeyEsQ;lbgj~ZF7+#Y8s-0V=H@ll3Y@*;G9WilgHhPVM~7klS6fODK>T0Y zG8O#4+OjyMx$Ws&Tki4ndn&E_Hi5&x+!2G?Po)1nuYsZ|-9+ie(`Yy{XzwTdu3~a^ zjNq%v#btz2GqFOEDd9oU*~vMHfk z`%HA_RQA(nevzPFNNPx+e6EoR&T16(*B86wA_f-~X?lvi4W#{tgTryd&qPt#o@M!4 z_|)!yx5hR{Xn^KQE{JmF^HAoZ5Y4V%Eh!Xp=|iRv2L%Zq8;xe0e8KiWME~NKSW{JP zKqNr*EA^`{2KZ%rb4UF3-uJ^bV0C; z5B}4Z^Sk(A0+W5E#DzA&9+wj^=23e`7yfPmKl6=O29+Swt`|*evP_-!XBgcjhOT z-=n9G3>8{GD_B=!a)8=DLLk)ls2OeOrB1{kF=*ysMe;q&;m^#hU>0Har?;=;B4}edr%+%x5siV(Vq==;7mom>DZ(ncYFvUP44do5E?B)+ zO5niDnj=Acem~!7NnFqx7+$V-AWh(3?*k3Q2>4y~lP?l?>4_qvx4)+=eKhUZAK=Cm z05T-S8BkIXiTEtEtUJM1G3tELMdaubdjhSN7f1eK<~!%YA;Wg~cF=VLH!&s-Ziq=% zQ^#Sizs62;C{?iEgL8_hzk^yagYw+gZ>SRCzMX3Z`CAr&Xf5Dx?N&os1<|nqC?uqu zvFPHHSiiB~O$543ZdTEzrZ^4SO*Bt#pLT>!ZevQf>?}%Ep|0Qo$Ai0zF37KWFuuCO zPfK2xxf_U{kPi5-?kHu;f<(U%@&>&O1$vubHQ*oOSkCeq2fwY&C2VESYtA(LQwtrKF)bt1La9%cRa z#sv&aWPZ(yJ~VJkN|ubq?Yb2L*>W?kqCl2=)b!hgC~s$SF%k)rUxb_pfQJB$qJ|0X zhMhxj7zRIZW0)U!EBkDCX+=)i_*YqrgPTTFLaH=CH4!vVg4|gYtEPRew;GS0WqiBB z$yA4X+0h@GQS?8PcEUf3{@%~l@3&7T*M^suTvySS1+@>p+I9XHK>rH|6S4CuOP-g{ zmbf#5Uk7Ul;#e%`j3B0ZfrcM2NYV*;ac2vBq65<$DjNovc(I`7B4V;ROhkX2tQyHS zj1ms#{?n=*yoPRO2$vY~E6bDwB0}zT8wK~1ZyXt+)c1{d-!^-fmVp+8q0Xa!82#w` zbydNH&8@Y-_kh$BrE6ieV>OeE^;UZszx@{z=UAfyV~ULm)@2!@jrq~06jusEcB*sz z24)t`_?jobhXFN3VJ1hxkQKMZbj}B%T1J;f)*?DKJgh`9_dc1Yh$s6a z<~QMp=h5FuCWiWoUP7&+6?H_vdWSA7BT;U>B*2+PWUD<8>f$qYLFV zP0{dfA(-2{{tp5)w*~R^ftT0o6{zTI$h<^2Jv^&eqw8SSqX=O#g%tcJpz@ZZQw$zZ z>5FuC5VUmqWV3#&A9PJXWwdBzF%tR6$-$Ur+O(QoF<%quU=1E!B1}{9`eroB+s*FC zEqx&WOz)xNax|01uIXc&?({+Kqg~C48rmAxPGUBbvzyU!dzXBZHey?q{vxy2i zao~siv*}}eqLXmNW>wj_;G$1y$3KmvnB{)WZ{+|H5jSKPxl19$yDop6xssNe7M3QN zPMMBm14<+ng#I`vy>8<7z7Zo0rUmlz=km4Lj9Qd0&THFxJr8KRh>sbOT790Uej^&#Wb7&Dj7Ro$h&Jyj$S|gPHHnRv)Fim z2wcwoj-;!GQpCG{VC9Z=po~KAMI_hml0q88< z7;--!cH>mz9#ou%Q(`*-AO3tFiZEBv7UvOz276(KDM~xp2tE?Bk()#0F{0RCQSnR) zER+e8Er9_DP`zI~FOMsL05@-jfLp@ffPl}~(C6N-lid{naN!kX>^DamABBG5-r|-2 z(zX8;&kfCH9@-N}^iIX_9lmI1xg)_9;$S@47O>d^sObcZ+F2rr|MJTVzH#_*9LDg= z8($~ZU<(EZA|%Ezk(&~*`Oe<6^0^=2KHj=h1E0wHHw*riPaATnSXRT}pZL#U3V7fX4TqAEEy{*9*J|f!Q7Cnf`)< zio2AD)6H$YF<3k@yu7#n#E2w62xBi}(EvS0WBN zf!!LvbY3ci6Ll`XbHq!{w%43xQi8WQ?1AS@L?p&jJJ({wVT>C-eI{8{B)i4Kyq3ZZ z5Iw8Ey4$Qr&QktNSYOC{h|9ANcB8vHyx-rZXI=<=zP^HIlKqn_@}T&OgI2EXW^t%! zPyV?nwOlh@>|uH_li+P3-7PLlb4%?l&6#TGg(s8KqJ*K9aky*T`Z3q8)nPF7W-+p0 z8*dY6iQKjH_7e0qSC=!Ye|H`GDe6;SSs?3n?2U1sxvGVuS-}6g-*%gY!KGx;{8g&s2a zc(PeTiy?tQTQg)2r2_JulKXCjEC`r$OQ%t(jh+C=5&%eIR)k(87aiS4jkY@vNIg{S z^k~*V$8a*!T$|kOZ40k~qi5PQHB}JY5dww1na}*4{Og&`*9A2Tk6(v%JOV4T|7Mhf z+0IZ8Q76T(N5%{@@`G)`p>5S{lEZ0skM4G_`xS&fT3$%*ok%Y`mEAbg+HgxY-Stu- z9Jmavc1MXDjXm}J92WE&TCfqb|FTu@OPOuz%<0ZMA=rd6Wz>p}5+Xa-IT=qm-fx!c z=ZlSyX?&>`%?|XT1&r{jaz7m_n8s43unS#jin6Nc+!W1;o=Ow*HG&DkfI zgBF>%Oad4H-!)I=1NV|c=@yGHfnTQNfEX?4#4frhGaaC&e)N_SA!d;%8%L=Yqh3gI zBwy+u` z9eV=%>yKP3*+PID+g{3xObue7OOBTeizDu8kU>Nc>7rf2uzFIl>cfqghrF&pd&W_-Gne}Q=VmmvS z=_=hO>P-@|%1Zvgy`h{a|NGQqH&)~%tIhT=?H3SksxO!SJn53h`C%5F`7M4GSuyLx z0=;MrM1hsI!9Co3P%4*Ch*|Ln?%91w*rOV=fJl2=!IQgoO#az3UIqM-toU_61DZtHL5>*S{NM? zC&b`rCO_GY?&ApV-41;{{PV4Z_Ow|adY%ZeFJ;S^pJc}G3wS`Et9zMzFM2XpTiqzV zLm3=SFy$Mw(qbJU-YxD^l5{Zq483UVj10SE4#nO-Eg>u4io8JZlk$60*|M3vK&vD3f(*wr zNqsj*o%WZ{!_v5N``3;p!2k6q`{S9}zm*DDO@no6tR=tIC;K^WmQ65EEe=`lo9lpI zA(+qis!dB0GiDlO6h==XvlWH-v#))gqw|&EDAg7hVoviB9?3iN(9b5%GlrjD7K~=C zSgzcZmA(KY*9$T_<9PaSaJ$xnGmoU!Cx?JKptF5>J-doRl>#YJ()PkchiM}rnwK{m3lOkTKya|7} ztOS#K!!0`N`%qg)l-j#Jmqgwab0jZXCJ$DQ@7l6iJ#o=0&-@c3(%%ZTKiUUw8qP6A_;e0Ur3VZ zy-D@A^i#VyTWxs*D~lsmDh)UJuGkJi%)~-G_u8t3c^39*89CLj^7=$;8zEhJzW>7+ zvO7fu*M97;e(4&=9Pl0n8qcQi#Kzp5QOI0MdlJ!kI;Str(Qj>qD4bhr<2Y)A$Fc|> zA}^?c(539v{Br5oL=}3pvN$bl53qb;j&#@sFonAmjBeI8Ue152$7cOha_e*;nj@ zp`cB}e|H4l&yHcD1-+p&Q*}(a>s~Hi#heI|yP-YBeELmbenX0Rv($-#^+&WE)jf}I zFv}fLsR5d{Yjca22Z}^!O}wxH8E0POidP5w#$0FC8o4T5d5#)>`QcZH<&>WF1T5m! z_F-};0Y$qdHhHJx*dxR>%nd(^ZLwOy5m`_z=#qbMDO510UOa94hD(uixKw{B+U!2( zN$W3~fr|}OO}c^j+>s)-9KY(wi+lVTsGfODTv#b}$jxf)J-irbwRtKgtHHJn&LLo25rv8DE^v z<{-L(1My2#7us(=?1t9uKfP{sU!Xz4517ZJ>fKe)6Ykyr#*MwM4jtv@{p0VL?*UdJ ziji|cP)QQ@$pnmg!^(Ws6EJo+h_N#3T{&b&H*1PRKq<7bqM`O857a))8}HR{EGVHX7Ef9zD;Bp9|EQIZ zW@nYFVyf8`$AlDdW2()B(Jwl0Z==xSbUgaj#r!ENv$x{TE*LS#ryvZ2FDrT!wd*^i z^=7eO(h1OnCS<9%q5qvoRc1snZrnnfX3&Z&KcRWp z1wxmdu2qTc$PAA@OsoXEQW*Q$%H|Ic^JHi{hfEX8OxB5^)g6QJGD%-1C#e===f|QW z^pdvtU2D!oSuuWo)^bN;>vB`QUQEsSmt}R%1ujXH{7SRb`Z8fZnKtJ#qFsW$QEWC2 zxu$!UPh}D7pRvrk$0l#1F^v72u!A0$sOxNr)8^7mpIGJv!^K9Lu!5ed-HucOSCc({<+y@j zAG9rgt~zs3?Y5Bj&^_hZR9QF1?+q_wkVxF#+%5@so23k-Cmi~_j&BRmVJp)xAazZu9dj;jQx1ZEN!9s`WXJx zvzn_UZT-ee%<`u z5>y5lHzE-(t12A~DdcA7a!}W-9}zLw+se|rqQvDgUOc#iX8xs1=rO90ewoxf?a#(( zha`5WcH;NDD>6?7QDMeI;0s3B?*2~u2|5#xhan9<>PdEkbXqS+9gw9a3f1HO}8jkV|pF=8DwyB?+~nW3eE5@%ob@)vO#;bZoE94`E>PtU&brZ?qcQe#JlJ@kHv6OS2`PTj^7>6~I z&)0ZnWnF5kE-%X*PjFnYDo-wX5~=Lbbzi*AxgG%Ty%p*CLL(MzkPxsG+E`IA`&Okc zPe|)k>BcT&n=EtYq04KYE9FnUz?2jJ3B{$W79+q#q@N+ZUA;ZjqVqt7AjOFLW3N{* z?%6a!`Y*gxs;jhvH_N&l(BMRKA7PWMbVYHTao6Y1m)b|%9i8&##xZMIyPd!YMYVbB zMyy1Kd)pJ9huL!%vK`3OAH1?kQhTyqPPaxElf4tmYn^F_MScC(uEp;8!P#|W`z<3M z>uQYVq78cRr9V2U%B^+Y(l`cTD4F$rg(`K>7E*uCos_{{qG~>dLEW)cfAKq*0~lMk zV5uB``X7oIFsvL8pXh;*a5(PeD6Tv1B}2nRQ!*N5tM8P=PzC*?t;)x(RrVwTo;BWO zLEB3G>2Vh8(|YBayo1Hh9x>;$+J_{$>*MOlNxzCF)a4OrdV@)34_y0!CJFs zC_P0%SedTx{hF>|Z$PcQ?vZ#>-9qY{$VY zOsHRziTWK&$Kf*DPwJ3pE48NkxHalQpFAuYK~jvW0jSFHrK=vHcEJ&@7AS-ZR6rQu z6S5|B&d#+pzyBSe`HM6OF<*b2iHYb=nU@*0n zR{;Ut6+OU-bvD9IvV-e@OXDbZ9}OdnbD8Jbn!~olR|f--9a37hSyvmQ{Fe6^+UJ0O z9(q4M0XJMpe4kVgz{&$?q{#CI@6}rN%8cv+iInS%BRM|4g+R*=DH5&#R@q%GH%|o@WL(x zN&a4mT}4JV0f=odLCY{bTlv8p^*cChS!^CWpoTa;vFMOv9Wj1DtKlI-qGl3Cz{(}M zqPjaJX2~#IS_bV22iy{$KIFaahYIzODXgbdllM` z7mOa&S{(lI%#NyRXltY9qT2=?4cybh`K1SIsqY|8gtc?#eSK(@d+o}`Bl#)L{zG_X zDoAf9&UMX5XXWib>#qNPwW}GCIh`kzI&gY+2`B@e&1yHnSTHND(MQ*d09_t#+Nyxu z%CY|*1PS+AB^k<+=wcw_vxwmGD*L$L3yGpF$nq0uc}xm+)<|nl@`*@fiD<&ZxuZx} zqF%716|rU!BMN@AbeZoO9q^Sp&8?9#XZDB4KP4u~4|>oMapq?w1_+)eraCo|@r9me0q_?R4e=lrYAItWBx4o+{Jy;%pXUS!X5ba3>P?^ukhxH!eV=HHfYDE(n=g`R zC~2{yq|zvY*fm4E8E+GuStvH?A)z@gtb32&T~(UMC4D6HVWxo~CeI7R++Pg=n}X*t zqo0L>`)ganNVCAo(o)47!7IifUF^c!k6b>_n=)e{xBtVqKfNi?P0BlTGD z$OyHHU#V%WC`+mF%n)&e2=Op63c^=zX#(V1tP>R`8w$v%Z+acueq;EoSnq-tYNWK- zAf&8YWIXU0_-idLX9O%B+YR53EX zpL`hiOx$WgSc;Ikby@_dIjB6@p~~TSt7+r7Bl|2|*)!V&UZ0l%d|pdu(GsNLgdagv zprDp4`NBf3#t5=GziJ|T{1IdnJ{=a=qC<+5#ePm2L>ACdo31E{_K%&^%X!7gqlafB z-ek`4V!JSe$Qf-&(c{oqn&)R(m|())?-=w^YSInM&_I(JN)M%4JHf=N*9vO?S|M>0 zh7ur3q*9dYW0+QP7_bndkUDsJhcI=$?0pRH zjCt|NrXz>#8f`AHa*-`inbac~Zbl_Bre!tC5tGI9DGv^M`#vuWSMDPuBtZ*dg0w%4 zt!24{fG~jlq*f9@!kUsSe2_Qk}0t?H1R}8h3uq|a=Hz$}AWr2=tYK}$)fx`8 zjy^a=EUQ0AWpi%AXH&x6jTKbMZJ&5+PtM1JnbTP+!h1S!VG0x5M-0T}ma0nlB46aO zW<#@Qe0GHF{I^4)2HgCwd9QtNzc}o*&dTm{^l;{V z)G79u$ly`#CDD0F9K%6UV~4T6h%ssFK|5oQG=|4#vL!_ahGt*F`-Zl;D1i^UfHy9v z#rg4K*wTMYM=^bLBAo$jlHTnE^`_YNao8>?Z!ZHE+1Rl5E`&_{+ezCd8C0P5FiDc+ zTzU8tb{G%a0(|dwc=`E$AtmAcJ&TV5NG04|D2uwDgNjlQ}62>&WBYQmg%aLx1=DA)`&H2yDP(h)ZEi z8&P!OK}|lI9xB|7+L7-3r^(@uq*OyVH2;kq*-JubF{WLdxa;5ccdcSGXTGxkb^`Dzp0AO{8nh`|NZDAp4*70P79>2??1H08xD2XQakYgE&e@%2kJN%AiXL;Gzg9s2g;j2$|o{Jt? z`E3$OJ;L@Snaoh*`3*xHLp}#PmS1xC8h!^)UgDmZ!$cp1+ z0aMSQNUl!n4_{OY`nBja6OXd~0u#AuEdn?s`90brI^NR*mX@t^|8JbHVQi=hjTFg> z9J(T5@#SXrPE*N^Xd9hd+T00=W9!bscKg;g09*Ey=(teD?WGl{AzS3j4|t}X zVypxdZ)gcVbJ77-mcK@of7?^C?W1Z@zW0z868?;lO1W32*P?Ud#J!%ED#4~DNEN}6 zCTyq;3K?CtlH9`oUjU^*TEBc-SX^eX(#XRUZvT5vM%}J6oU=#oLLtL=hLogu?}5k& z_b{I-M%sL9m~6N_owJ*=0QK!F^d&{+rVbV-?~0;t=1+3Pmg)i@E5a<(kX^HYOjEw7 zfY)waYG5g6t#KERK;ojpe5pVm2oQ!D4b+OEtgF^7z7A6!gP!@CrXe7k50(Ov)LaeD z>C7a18I>E=?a`UZCWG6wDzPTt#2B&*RM(|Us8OG^9icAF<5p;Pafp@z zOgyi<_CTIJ_k*cPKZxCx z+sH}7WZ_qE*Q{y{u+1dM1=7RV)B$-}NffmOge!q8E01^ zn*ixO-u~0QQz+NMN$>HlJKZ}3bFG#19`Cx-y;~p~R?<`U-J`raLs_6mbHL!An<8DW z0v@jkbB#Hu0A#U(c12BWfGjQD4xwxY(xy!8N8uurUhW(jHUvbaY$;mL0Zg`fJ$~LQ!3eP*_X@2N6ah02uUTIW|3f$ z2;CS0jW&T0fqccmPwQs@XjIY#g&cM{qC(WHrUyto)s@B@f>^b76jyT2g*=TyDp-@k z%D=6uEuq+WWAH4HO78!FOn~8bBTg2ak>p^lGFs=Yn%xTIl zQm!~Ln*gAq!MIdk5lXbLZGzwDi3Y5{J&hvc7w_DRp+^`hPOEAHFR$cuszjS5Sp0qZ zp!ej02M~m!J|hWy*C*!?mm839n(K}AHzN`X0v}ZkynHIrv^%G{A+q`4z;?^95l{_e zEW_SyLHgc2^8%?v&?1CYTKS&5-~lTyC6L8kLD{^L9w4vSvMhH4kZ`z-%@YE`TY*@2 zR!T#x2_#N;R0AZw-8GymOeD6yrXI{R8t4xdBAlTTeS=>!2~sO*GL_UT_Vbl&qLW*| z*$kxQ5lfpWIf@VYSGNXa!*+{AiGXK3R=i9YdnK{=Ui$>9oz!rh zE0hDJ5`Oi%AjsjO77URN!~4bzYnZWsQ0WD{oxLLe6r;VXp!B4tCR$?$r57oWX-x4Ud(X>YGe$8@sP5qS;KUoD5zXjje9l*Fs zS}fIK@#CatCBuJhZ&54&`SlNBtCg$~8;g!2sPv^J`B7o$#V==D0NIiRi5ixz0Ayst zFM#RY1%&I-N#h`>2wH(N|5+%3);c#RfNtjDWKI^DkPyiS1u7s4K7-p+vlL^V#ciBU zn-7l8@aNZ5*&eD2D{Qunj;ai#jzB%X7}Wxq)Vp9b0SPV{y8*Jn2g3lVZnQdI5iLFd zK%06etp>8icC&Y&CXHTW6*U_NL7G?6G_%#$Rs~4Z1F5%r)Bxn9h!Le8YJoJN%;y&y zE@2L2i49`+Vy#53w_^?~md3y}jS}$8h|v_53ykN^JWHoetbo~Sjzyj6eo72vKQNFT>zef5&A0CRUf>)Vm}8iC1xxht>r zZSSHQO`;#nPv*B?=j-SP^OJe5uLtHQ^IcyL%unXMz8;vL%zwSk#WiP(cjUpo3|g89k)*;j$NQ;&96 zFSMplduuRvxYszi=Q^bIJlsnsd}luHHJ%j) z%yoU-i<`SUFZWd%xoy4Nw?)bv%oXH)D?j%gLAeUdkMHU3pID8nySth@@O8J!=N&t{ z7dCxI-tODLTI23+y4-WAZNLPTlt>^m=!ED;}9r?by&~60miq+iI`(3xcZTI(r!Q~_Qzq?Cbc9d>o zzWSIR@Kp%~AYO%=x8(!hv~=Dv8aMrRyx`Y_u?4@m6F>NpMtcKK_*LqJTl0ipPfb(f z3hx7R$G-4u!MTdx{5-tjSIOz0i9h^G$@25?h_7>r_paur^NC-FAbmow_>}_inl9(L z4r#Ye=QTd(WiZ=1omarzk=ywSCyMRd&ew1>S`B6sL0Z@Gyt0}*ay_r{JTHUU*7dvs z=8l}tTdrnX=kp4fJ90nY0L&)$^A%uj?0~+CE#A2UdSxPQ!E6+OZ`%dEr2@2#54tJO zxH}*8Pm_B*f3>DF`lm@l?z~c%W6B{km3VL_|FdAeEiCZT3N`whudlzrh{1FVucxey zr!x<%YZSa`2d}p#PA$AneVp~+ZBaR=9lXVwrFl6GAH0P^JL|yPssv9vcpvqT`rj0) z^n8u3EFO3Z6?@i!w^c2lcJO-3{WQR9OaH75@2a9e?cnv+4XS~+P(#Sm*+xZ$)`Yhm zeZXL;ORrHX@9en=1C#Y-%C?1fu|!xZa#jJ}e`Y+*7LDW=oDeh?{O|Djt-yOy=UY&K zH{dt%=~S}xc^E~ZD0vZ^&W!6GmX(%lBAv3*woC~L1yTKN2JfSzqobph_%Nkm#IISZ zA@a_#2yepDDOX&P0vKdvh;h>WYyhi<_xS5J@J=E|A7PJ8TzwdKKVPDxsIJJ_PMAu@xiQzALZ1eT1A*^PL}Z7&wb6D}Sxw-Ce-ZR(P!Lx00^R5AUubkG4E@Rm)8)ct4}k8Li;` zjH+m~g7-5jsL=}EOWD|kPnG8;AU?krwuI|9*~K71yDORe$YGl^i@6yDFLBu6`V zKcDIx?cn`<3U$=L`@P6`er`GW9H15f@MXVS1v;n-k34q!VTHkM*1o5eyqkJgiVDnIxmUKvhmYxI*&u$lmN!4TzhxDf)W)=i zcU_kkJKSzvUaB51E8uPG`%-XuDJrJ6gttbVuYuP*@Tnmh;cc%ISpjc5{X^MlN8KAi zSav9@bK2S2ueH9f3U9Sge;MB0Ea`Uew)HluoVVS08&#c+R>0fV?Wh9pZrqO6Uf;I< zM-_N?#j*Ll9m;5nN`mu2VQhhdMW2D zB^Mj{A??NkDR(kj!>4FB-b8sXxPLK|H$1&UvRLmVWHnuoidxN`Pst0nts~4d%-a~l zJY&-+;x|t<(JlJYKjHB`335}IGBSxm7E2x0r*LG#;~1^C&0}jp!#8im6Q0MjlnIYZ zw`Lhbd{5F$C&E*>SzLqqvGt*^8~bT>=#MeB?)Jsyb1EluC&K$Zc~)`^R}zTYA$uK8 zQ@$V^&XNsD7L~Cz@n{Li@4RDc50xx#9@flTGo3KDj6@svT6>4Ses*c8*xJ9+ znyayCCg*2xDK=OLk&mlRpgByzJAo3|A0b|0)dcF} z7Fti>b^{pv697beP16~ZKXTC&9)LVJxuKB2$k>NyOsLMW7hbz`XU>J(fO~jPMiHOT zXx;!!k&G&d|Fng>D)x>^*JwJ+7Oa{?#vHgq^k;rY7fHm1>rS9f1?ZnZ8`H8ofr^dU zlK)$`F|RoR$JXrhUNkzl1AbRVXa5A+I8QjexAdZ@&a4gaWD^u><4sYSKpVG;4d<}- z1llA_bb4>doM<85DktG46Ihu_(doTDr{ZqlUw;B^4DL?v9)LfZ<-K_VO&0ie6WC1} ziuYvn&GE?^RH%&!w%r77-4@$CfhHSgy9w;f*jY+Uw7~?*M$b(qa0}MY<_R=eL7m>$ zF^5*B*m45vQlYit?>Ci+t!;OeaJ;rmynR6aZiVBuW#a84^mi*9*GA|&!g13C+K23~ zp2|kTG04PU^^Xf8@zFQ+GV%5?{JRy7*OrO559;5oaJ&H-b-gB6$d;=_N;|2|Wy{UU z=+zHFEWpX9gx@Og_QLP7as|kd$Wa%}n=>aETz9Cd<_{~D+ zK0dGq?ZGZg;K9)f4Pny+aNxSUJvad!ZmV5#@-4u&BoqXMmGyxqJJ^Agf#Nm_V;^7r z-a0P0-#LYpoq4c0NO-t*L4r-yDrN$69`m$TU2S~Dmc;ok&*Nxkvc)vEJ;Zqwmv0u{ zgvYMWmtX-AyopHZFN07__%%yeK*mdlJZ+#}w{2f#QGN1wGXYITsksG;&B-eb>gL3B z?HwphU<)!@n#;!`qooO~k3vQgD8aw!Z(9^ z!lmmY_;l5~bZzX&^$|R|>PJ9)!noH9mM%ge6kpj=S8Z}Z7OHM&!a4^g9F7OSiCH?B zLG4NH{(13>uF-(EgydvobrwTg=(3(9)qvejL;W2pU&-a1MZ3-xOBxl_E5L5nOZ&mz zjhhxJs-^XRdqNF0Y6g3iHrfaFu5!l`qsOY(;MRe?N(b!&dsi-58tl{PhAura-zu=1 zG|#nQ@4yj@G?Mrluy>#=EYX(@!LGSlSAxBbif~)V*9N=2Zn+4WuUznYrEN=K*G6Ez zCnK>G6WPulTIjUqy5VHO10|gN#8M1yg~-y4Y|~BGjRt!y7vay~x+#I($}#vexNZty zw{!>o46d63*e#uaKZEP00(J}6-_PK>(O|d9L|f>zlH^s0 zXIp$=KgWQ?Im5Egqk&Kjr##Z(G^2rf-V?35^N!Gl0Iua)`WamA6|h@4lz!^Vz0)xo zH%LI8tJ)Cz)bOKTPcTWY*zz${wtaJG|M}aZg?7Az&UTQz~=NTYtI^DTMt^7Ydpc^OX_k@HX}i8Gau zXPzYyU$Wqkgz$IFm6$0+2(+JT(G-TK2_*KGA&>6~Q}=F?vVg@hq>(rzBAd(!6(kcZ z1??5#Ic(xk@5hfUTJ*_lw{KDC-R)GXun|nPM~5U}5tEG2c$wFTls0|V{>3li0Ckk( zB^LRHxvG^+Sr0oRp*&QunI!7Psg1KRlD#k{G+2aj2*vlqYqcCa5+t1Fp|<@_=QIy~ zh?a+hlE0rme+Kb`DBBAgI1E)6v8=Myg;_<8QJE$wzYYTykehi3>>D7ML1UQ8`Z(E} z>Vf-9x`=#O_bs`9|8GCp&(fjfYSCRlygE!5KgBoRXrhZ(dihL0kphk zJ1HdnN3@0>)KaQz!YyY%)t_CfBZ3J?)aVNu#`$-LM1->#f?i{*hJuqZNkf2}TxU_t zQaTQ!P%12jSmZwL;~7rVLzncZoz813aMVyR10S5&Fm}n)Qe&bGH3A$AgPc*#(Pf^E z`ZVcujs!R4Lz7HQ zvVqJFiNY&pEzH8Ko6bEYdBP(;3mKk^J@N$4+E5o_>AlibAv&GEDsIY04G?!mG@Z;t z$tE&O*<)RT0ZJnPVF&clq>uV`L06EtlvFC_P076bJdT!-uvEW~wm*v2FbtXf`AlJk-JadC!N6 zGfnm2H)$vt;fbw)ZpbheJ7Ix;oL8l4b>)%FoXl9Tlu*Ci8A=INdO7=@&Us8GRFho2 z;FFY!xjK)svUoQ%lq8E~7`Y8h@tBl}gx3SKIDN+TY#HIYu(hCZCj-}=_mk9S)k+$m9KJ!00Y za{?-Y($EDam_O8(RcN22e8Hu;VD-#H=U~!_%xDDbGF9vh%+HuY5l2FGf11TJxEG35 zXlL>5DSRi;RqxS*ufECMmdfi*gC36L(3Cj9mM69;GU~RVNzHn8I^XNe;N?CK4XY2# zi=Gf(q!vcJILjwNVc$JLVy2qY6vBp`zMA&NY@wRZKQoqUPCiS4JJLIo-{wYC8ncMs zkbQiC;R2H=RQ!wx7hy!xgCX$Coy(^$UZ1~s`i#t&>|u938U$%?yzD{H@?T8;72xrn zo9bzO!uqozF*VG-H8LCEBEq0qHJPO`;!F@gE;4<+73W~kPty!s9Ts4=t}qs1fQYBp zqjXP{)}wG=_!43RXi&PVh~nxbXx8Ls+*l(|Dmez2xD5Et!t*-BRBT(!kiDK5M+}|0 z#>sMm@(=b0GU|OLq~0GAWZ1)n!Y&%?Y&Ys_7!)Xj+ZNLxjTuo~HVeoI_ub0Boz7_t z?l!R@f~vI=LKXk2SZIqz8c5iB>iFy+(oA?Pc*Hs&*SlmEpJakv=rO+!BPN_zCVvm= z2_F{$?7tHBDPfY;uzIF;AWE<2sq&n|7o7>!-J6XdeZ?J~Bh zo-J!EBheqZvMI`-u%1f9@u1IXc(rBrHvB`@Js4i?k zD+}qOhHg$M-K1~0X1JuaPR=y+P<=x; z8B($Bm6Q3XzP*#sXjqrLsMNaS2sgt{=ld`f^3a@6XD#drDZ?xXQ*1bimk! zZa!l%OT$T_bx%g3r{DK_insyRKkg6ISN()7e2>*ilpa&{tyPr8hgM7BL&74o4jw)3 zs&mxs_%Y;hw+8gQfmwU}RKb+Lb9Pq0zGBP#b-rawK4U_!nNngqorlVv>gAe4IBLJ6*3U?IT&p;-61$7D^@gE0I5+r~A)w z#K!}?<^}`%yy`29ykv&r`I{%Rz$Bzu3h4Y96z)IrG&YHjrK&fMr5+WObLhj zR`(Zhq=?rc^(9)#Kb(emw^s4-?AbY)Ms$YCPBr)&B{O-qjz{4&OOK8op|<9&>10py zRJ|ySSr2+UDClU0osNNog`jpZv#mni7gu2dr}>(tc)CL#>s3?hbQLB5r~4Wd*r1X% zw_{Fdv@RF4klu7OX5u;nuaiG8K_3*Ra6THLx zx(;$Zo8SxjZo=bugbM~NeGm#djx^^Ii-ZCjJI`i{t(&O}_cd2YDEMKn1!R(B38-en z>o8(7pc|n)D+-M`C|I%17j(u(nsn&xDh6MoFyMSW>=1L@h6I=`LR`zEeW)>W2xgof z8H~etAm;k7-bDZ7eXoN?Ds3(8-H@2c{)DHjZx`nA@zK%Ik^YcP=IZEPvy^;Gtc7xb zdooxo2F`-LRSTxpYoI|!WGGoA)O;OUblg8a`R|2A9f^|r3j!-fu4rtzI6W0S)GA=FK2IGoIZc*vvTe2k?-i_N>LH81`5ej zh7-rO%%Bd+{@98VSg=s_%-*p{CN=)+X&Gi&y(7I);?$HN zsMQZg1itKikt;4b$0uL)kNQXb%u&VbDJmiN<+QqXNj1h*M-)Mh2jfVTkaMDGmcurx&h!Az30o zBn8Q-3XNb^d>uLF(NWRTOGY$FSRC*;TEf7in2!!gIMoJtb8OY)oJ=d;1PGmiqMy@M zB+Cn$4DqhnGXnDI%kPQdv~V#(K9D>KCt~0no;?HxbbiQB5R$`3Vh(*i(M0vtlkbSr z_z*^M9^^C!@1wpV^XgjYYO3AS8Cy)@@`*KsxpL^mFJ~oj^^iDNS0E5EyFs)gWh-~z zxM9>N&W)Rfe$?0hJyV4L@dE?z3%~PRRi9;rK3)Gk3)YJl5nD4_Oou=DFUr!CE5((8esO(jnsr&-)fcrds=CcTjK zdZ`kprCch6PIy3iJzI_N@x9LPaH)1_68?g=*Y1#XuaCQj`1~r21NG#B2j;8b%tN!t>tL z_jC}j>p`4FQMd5!x8kQ=u+ge1n7d*T#$mw5r7rDE7fU;V@+WRJwCdb&71hfND(9-J z!6KGE$P0@KYhL)~!*8AZpLz4HBAPUn=s&62zfdfsGk^xrx9-&;OLI$n_jqAr?WYs< z>V?~3PxaWdXl!qX(!4sQ8Gh(|xJP>7aW1uccwR}xl^7UbDVFy1!VLm8iD=4t8h{>xyoV(idrO}6#%vbG2Zuzv zxz*O!QP(60>iSx6fW1EMKP3O5{__Yq1TY7H1_VqnJTA>=yeyPc(#qo}EM7VhmwDQN zK2f5^&=E6OJmo1Q)37`6mPXNAv}|hRv0V*2fX@c|bjNOVr*W|AD)DE`B<&X$xww3f zfB&_sYr*{59jZSBM;89q?(o;HGo4?%A3k(DoxdunxVQv*UA3W78)UWYtZx+-6blC# z>$!1qaaiCg`f2NIv1Jg7B%;e)+s8AR*cf$6bP3~W78&I2Yv5Z|;elEBi`*y<%7GWz zA&Bc}TVuzT)k*SFJ7J8^SdfoZav%cptFzP4(we9qGh4k0&9(-6sH|k*JG)7bO z%~U)#xYHRv8mz7+g@jrAM}G^9FPTy5L58K<1wLQp2-pnR_&ah zH&W0MH@?rjt=t|u?#COd5Z7Vd`d4Jvk&TcUZ*@8M@-B) zSLoO26wx9r;Kf{V`J4odMo0;9E`+5iPcajPL?KT*Wd48u*Z(chhKviMQ0Wa^5wbWg z0cB8wTPxDr$oRCn&3lUH=)nNJP>76)1DxB>$t50Y`F)PnIocpqLL z_fPr{Nbg&6ebPVbA03b|4zyLzh&Cyxo@m?&;|X6RRD%EaIAs+02Hl^MbRkm$jWZe% zibdqK>gY8m$6u=cftOP3Cyfe5Wb~L)lr2y@8H7Sfnl!~5VM?z#xa=sokjG4*>=X(; zK|M887rxeY5XpT|JKiUAD#)0z7}zR0$(_IPE6rrx2VGkV{KugSTavPA_|7=uj-b;K zSbSoBQ+{h4oko3t<;-zb&!v2fnBwV-#$f0{D*>QB&E(v5I)z?F#>2z%JdRES-1Jj6 z0VH(Ss^AsoHi3Pm6ChAT-f+#M4#~)I(?icO*OyGgQdS7xA2q?CPi!fOQunT2*2P)o z!)YfZV?()L@IFvWSvPhiPt^SpAWvV3?(D|xM(178mx>lP4_)tWa!u0^)WnA-qpUbA zMXrcL!sMin*i3_f1!^dCB+-n4enk^aGN!pU>5WS=a3@m3P&mHKEL!x%TwgQl%vd}De}V7lcCZk-I zL3NdnRJ<>g;rzIyUoTNA;Xr++)Ye0~1nhqo8Moc)HJ>U%Bbxz1}M8w(lA zOydt+EOU$>d|T|}Z7x5#b=&N&)U7^Z%iDYkZ$18PCNjdmfBEJ6059Lyl{-_1nbdk+ zV%&s|swl)`z-bvh>K~y9{-}R4I<)94FlI(K&{wOzG;^-RwJhh6Sjcjq&=TJR_dOaf z%M1rJ45d0SFt);*F%>$Vh7zHOKX_|rYPXq$J3)bqf>@c`J0uArValecb$;Vnjz|5I z99y|$4rNa1O&`f%CRnO21r|#TIDs$|{QpP&lfltZ@72?1PfstOzIgfi>E(g5Pbd8c zcAv~@gT5k+B}5%Dkw<$YBRV=Hl)Q<;aZ1xAE@RDgp;i3))3=&k-&5ZlsCA_3DrIrN z;>og4o~s2ah&-Ah2F6QmGI*-UC7BrUa>}zfXz=A|FDRHx1pn-5kdfa#=#vY5LKgIj z5s{_Z+-tpJOzc#SSaxP1Q{159^0X-qbnWrdTrY*qfJ5`Eu!%f4^l-Nd!I4;s zERu$dXlISUo(hOJVm2F|H|ETTsv+W z!?Gnx@Rgnc38i4sl%#A%Q|ljNmh9=vXZ=p+{{6qY366j@vS^;idleSpKkwgH7wv_i zbo#OOpbkaRcULjg){-$K*T*BWZw%WY!z{^|%Q-eWf$2RkYwvWVcGhAPFZFp+?Gu_l z00r7XU-5PBaqyi;a}pH_&?MB8>Vf*^z{>p71|b!N2MgB-RX>UkcwO9E)CeV*uHDey z`!G*n3-6;%)XGdyVUh)eM#-FxnT=PB2_wq(%hBx%X91a>U)h6d)xX%Np zzcw@Rd_Io&Y@o#m^hE}(%=Jl6a{bQ-gZw@@#{1;2dANbWOkwj47qst`*j#VuK;i`D z8&*lPv;*|9N_hkv^qj_ld_usvH_pTtEhjG!_!LGzNh8y+xhFZ#l_d;L}wqUAf$=sM~CAQo8E>7Tb zkTHYFkz#ITnc4Jkc236mfc44QoK3DuXCa}p^?XzZn3B0nvx|P#d7K(D+3L0_%)PF6 zxQe|cLCL-*zxMieGQ)M_@Bq_gU#%%#66k`t3i59yN z4W~4WvXmW?8?6W_c!JnKSQAhNjf7ejD#?P;Sj&btj4b%IS%)Wujdvmmg|;baJBK2> zbUIaBh^Bzr_){jGdEAv&3K-XOGmaoZi2dc^h|8i=3m7Q+K8{@*F5pD3h_EXJ=VM@3 zy$0ig2ZHQtCe8RXf@($^3lAXjur^>AH6@;o!4hC2VI%P1Rcm5`u3b#1jl0{AwGquc zsD?Qn92O*L>}m>rQ^nvkt@R{+?fe_VAZn$@Z~J@Ne*n;_rwFSp2;|CGE*aKQ2>L6t zI6~tV*j04o7+7pZa5{4)RU;lQnxd%=GgD?r?ClHUEl}Bf7$mKFtg`29pZtjD#<&?7 zhgP&Z8kt)ic#vfRa>KRYoH8Y=_sbm36=R9cP(da2c+XY*9IcZawF)e&H!~aIq?B-$ z`v{jCLr8(w&=%#96BUPsL9IYQU+`S@>wE_u+cM=5@Qz^2E$Bmve)LWT24=&w?Olrj zVz7aM8zqMJQ?$>5w!0Kza!BU<2E4G*E6+`dV_l3Pb_23ZnS3s}9t@ZuP#FHKJ-wVn z9K}LbBuPV#DXAXzkNU?W2YpI&H58$Qp`9N2s}4w4rxNY3!fy1KxuT8XMeXp#F);ST zxTh5u51p=J35Gb&_G0MWA&I#*4Ph<<6kc;|`C3i#YcIBx!W}inXo`(q5|YmBa2~ON-Zcqms0q4fv`{4eh zWD9+Nj`_Pj@z~KF*KFrp8a-CPW2S@gZ9<@-lQ=$dn%B=nk?Q@a>+_)_<55MT^S>ba z@YugSED&tD;8{9It|vVRT$r--07La+645N4%n2pal!>|3Oe(66+&!Flu9&}zU(WjA zZZsN=)PL$+>3vG|dUg3iS#LbEij~7!$<~NH?w0AqhC4+J}SR#3T*H)xl6_ zR@3fxyz^{Y{B*@Pbqbm%5B-Q`71KqfHL`oKUQDff`jAW+v9F5IF| zPGggj$b{6JgQ|J(*w}}GLkZ(KOG9Z`a?Pozn?tkk1s|s{CXW3SS70AQa{{fzbLbC*bIaV=>uq#4&$rm=y8z`!cphpF{ zVNrxp?Z!w2CA~0%3$TIs0NNEKWJvn1kmv$F*oQ1)$V4gf11iokPbm(Zk%ZSgkAqg; z`NuDR<^UlYp{T@IS$s8Iu9IePQcRAu%q5+IzD_hI5OG{V*}EhPC!vg%CfcoBV%GI8 z)z{o3yyn^*RLv^Im=?8=YT21plINW^eQ1wtBVSOBQf|JP%94{HOqD2fZApP-izHHa zmg+z)C5u66gFF(IrRxd3n^-dc{_-Ht&f`fGr{!f?OtYi#zABB9eT)>W3g-(h>^<$s z+y_QlNsCzmg~a43z%pv$RP?_%G{IH+I?m3sq+T3z zYcA*#sMSq~UZ08u0SO{r>K3K!CL_b=r`IeUb+osQ_LLlvaTwDyR0wcBEq!Y=%d!I0 z(-*H_{r%$Q`HR{j4S|^ypoh@HHTsm)08ejizQP~e;SziR9lqenff=($!a76<5uI+Ziiz^ zsGN^r#DbWKVV)Y-zVxupxWcHD8o`kpX}4*(dyxhtY|Y;rJzY@Yq4N9FxLQ zgo;lXxhytK5;3?w9y3W#MtyQFa|LV|)8Lw=lEpGwc0i4H2>iUUn2KzStdw+34O1FM zeR9bdX*PWhv>N`auTCEIAr&V`>(lU^x*S_K)dDef^}-|ePO=zIww~MZ2$(u`ZpQYC z2^7OoTta)giZ??aTtsOUEg@^#S}=Zn^gxkA*iDcq^=9O*;s}BhKl57C?Y{BR>POny zTMQ&qz21b12@Tj|5c3^z zq7c}lL(t=ZuppFmKq0ra4<1@t_*Q%&66gbGn>`RFpb&EvxD`;a`(95j6ZTli(WI9= zzW3($E>AEnNgcZGA?YS28cXfYz#z!LIb*of-4DOrTL%C$sa=Dh7Wdz7|A%fYlW?Gk zS}rgoqobooUw#SyJvurn|M%$l;nBYxe|hxi=&OehPQLo`-;R#IeE9IuzmcO| z0nqfzgrw=e9c?{Ud2)Y{-yV6!K;fsZD)1Emkxfw@Onr<5>g=4PS&aFz1A&oqqR6xq zl&XpjI+)b|7^r;r+u&!Gc-$-GVK6y3`SgghtU7TZ&$kW*y?HtFVn#<^$u<(eVbi)H}`Oyb$V!k3aQ_{;_`c z{O4Klt+i@bbfEeCKYVa>T)zLmI{xzH?)-m@-`*biA>v~ikteQec&;6VBud&pH}+&= z^2q#o<3q>v=DO@2mQsb9aD*9x0(b|NCbTy~9>+Lq1a^o|UYROlP@6(MxyVa5b@ui; z*vk+yo)lUP$zo~#{emu7{)N*6wo^1L|M(}i#J9GUkUXU`B>@Vdy1jJ%?%1%~-#=ik zBJE$9*Q_tN=&MgsHXV|6Y9OeIh9=WlYA0xGqQO&Bw`^FkUo=1^=?p(8z~u1^H-6tZ zCQ3|u)`t>Hc<6|i1a+PIQ^kq)z*7(g>JT;N5EOXd^a3^xY1}(L>ZL~r$E7VBVfRX> zQ-IfQ*4TSk?&}_;;jvZFLP74KZ`r*=!XjZU75C1kFSxuw2itq4S+7hChLs@(dr8WA zNrrVx@R^xbUJ7kU+@Wx!mw84|TN%UAYn2hRuUA9Y7&AITjNy!yHtAD2aY5g+o3+^= z?8$||XRECpsF~p8dPy2yQ>i3mM7n{Q?H)I{)IvRWMPgC)1SQ0fWh#Fd=gW>wGE$As2Q3EV1sReD z822lTi-&dIaPwV35+TQ1$vUd!9%6Z>K3iIY#)0Zv=U?J+K7^^8Am`vmQ}wPf?y1-S zH2Lv_37gE?H!H~Yg~=!DJbHLs90ubIJm^?XY-L(>2&woT)e$eW7)chDh--DUX7Xwo zBu!^Ea$8zkM{OJEZO@rc3(~tW@wMZuPlfd?n<(*0TD)^=yi0m)C)hxfH>Jv()8*Tz z%y!-t>b#oGS(s`Gd7%VIAQCD{4Nlju!v*7+9Fm6}LjIZYG+PYGNr#Yt-^8a=$P4U^nK_=UMr%sm{r#lOBMTMp7A0@^Q|epamTY7@7nF*!X;!n_S_wZ3IN# za{ffoU>rE(mhs8QBm}Xk!$*CMl%OVnm*DPj2=wN5?{>^Y6$ z$$^=oX#?&jB_)HtNh~%$VG&(k8Z>=~l)`mbF%KnTZ0V`adGvaoGBM{-fS5~+Z@u&U zAu#5yW6W(qcDw;(m{j3eVd0b%W8S?FnBb84xyI zjufutygI32HqB7xZ$eN7H6$kwA3YE4(@ByI$??(Aq89o~%`{<|3mF1Fo7z5xa5puS z%LKPk{bOkO#q$f?6#ex@fwXC{5g)>{@~vyK)2dG#ry=$D8K=Q_G*WyUa)&R>cfx^4 zw7zs~RwTn;_VV;|=GkCR^$E`Qibxl48#6}(hq-cKj`>3a&jr@Y1Y5P^E0E`J6FQ5v z_TI4W$hv@(&c~0b6HKQjOHpBQ-1WfVTFi|FVO%?2AJca);xy=uH3;rPITO^!iD+wc z{-*=|`GuBc3e`y6f^djv_XK&up+=;-%lk@{(Gm(i9@>bFh)-zLspc3f3}XEEX*s80 zUL6Lx97B7HTkwEI;CP=T(Xvk4bUS$!+z2Ily-h=MW zI+XyAtV0;e*M^{G5z86+9-&G2L&~$nVe(0j%j!bo8N%4@T|8Af<3Q$?ryDG#s!Du8|X8b*It7R45^U4G>g?`XI>1=LYYtqQ{8GmoW(q4B9Hkq zO%6JHq*&+;I6{;=4U>E$Q3#Ebkn(nGC0pt?Sn>&)m) zY}P4Nsk2liuZn^3ez19!^6F$i2Nt6*4mu@^th$DBCB_1Z%Lbkz6>68UAcU(E6va4{ zs_sxp!)zMHN|L?!91QP=%4Wl7W<)5%rD zXFU=Ai;?4_lP?$JZqZLcT{l|iu~^Vv?jNieLtAmy-F4x_jMh)tD26=E)r`&cMbu3J zIX814;vlb&tt8%vNfs>&e)^Dh6VkKM$sEphtX;a0{Q7J?RpmN@uxE=m_4u@BIE$VE z*G#eGk!>72zJK=f<&RIkbN@Ph_N-Gz9DTYR{Bbfb!%@oRpLQA}D|qp1#R#&SftI>3 zh@6ihUe9D!1pQ%9U}zyJZBgi|f%*@m!cbS76F13-n9Ny_MG$DwpY=&sNSyxtK)Sp7!9Rm(E%ARpH@7e5P&dakSJ47pJ8q=@(tf$e_5FrPn!1`*fpt9OWdr zRE(;$hc?L>4tU~S?&BkT=~?hSzrMAhvj_gp%osk*+9MEyWr21|;c1~Uuk+H&Lw&l= z`!Ur_ivGJdasSE-cY_wfoHE#Q@@sb#P{~HWcFB7(OIbo*{?y$}1zkhFU+_RlY3PVA zbV9s{RkE%_fbzn+WwgG4R^*EZ9!!tE+n&{yNVMuY6Y7nbq&=NkB1c=*OGcIL%jD$ELn!HO3bJNw=FLTL8&iq_1|S zcE}{gBeSA(a6LGINhN=AAARez(T0g`uj^~p?H=kwrbQ)Ti+#FPKArxuSVKYfofw+~ z0`egY6=zWd`FG00fk;h4J0nFReK z)zWc~UU6_S(qHkE@c0P^UFHGxTHI=qQEW0y6RO#R99XEw9YB`so_!^l9PB|3C?)W^ z!JXQrL;s1}fXSjRHT=UO#C8*CD&gMHpWFGavjvKTE7B?kI^`FLgAPE0y~K=TYze6g zjfG-Z#~&zG4H9gHa%qo)rIqCu#`n6Y>$^m)e$HX+?df#!rZPTUZ=ryUS#dytx>?m= zN7KHP<;f6A^(}Pua${j5JcUdt_QW3|an`9>h@5kw4lLAH0~fLKyww~)CvVJ8Fojmk zQhDC3Sf#y+2DKv3-0@F${8LN*$uWs&gBt8fQ9S-!bms`-u2tu#>N1LQp9cC_OO5k( zn%GNY(cDmAYv~&Zqx@-gcMpzyDzf9F&sKX^1Dbw(r@yg{sYrZF#3&_P&k)HbKe0x4+ZR-05fT^fPz*nLGW= z$JWoF+^o}Glcy$o^?*FbY+2wyh5xL&XKouxX>wj8TT5p{a@>E|f8Yiy9)F31@h;G> zU7#PHf#>DoF1PRfvR7j5oO>NaOe^xk#Zv~*qX$6I^fb+#$H-*PCRe>HwuCedKe6TE zV);@@C_gcfcAX~q@RhY#!Sc8)4&t6YA8IwkB&CVEiPQ<`dOkpLqx;SA$uaWZMK%f^ zX;uevbA*s{^`1>y>+z(W@RV^e$j9mNL@}U1YW3CqoX6^ndGqg(a=dRIRuE31B7yea z-pk(%$pU+{*Qx3(8q>*@4aCR^hq(r`IATKNxlVOUP-0!vNOAA>x^aDyZ{}3q6IMuE z^30UOJ>w~Rc}d3P;W&SCf| z8#D4z05PXT;Na#;H>^h9WJna1=;aTLQUO&7Ik2xXEXy%wh9B%$#ujzVp&(5Ci<*S6 zHfZAzO5hf9CFgZY6o-JRY80#0e`QJ#r=$;c?>u5wt24ESvaKOyc`XDW5QTZwp0-^7 zTw;No^OZB#j*>p#V~C`1qyT|sT>pXTvtc##N4At46qAPh@@l~$le0S9`E~a^FWbp6 zvN)xo4uMEb%!*rFDB(iRQYQWxS*wcSC<>7(q(^AP6ybxpJmEL7eMJ=MO@}B#yv>r| zbx)7GzyF>m0_heLcXUageE48;c6L9I$B)U8)8$kN>?aH7iB@?#PZauIvlLXHEKN0I zitlKd%G)N{VnG$F;z(#ZhX(omccNha0*C6`=N~?F$%hXRCtv6*U}BPnz?y8*ALO%l zyDTp9bI_6e7|!PIpt#oG7U0lJk4lxdipahlFC`P3?Zka@d~{Uof6y@8g1*~gv|`8K zl5YwlSFym01`T*nj|kgfLMTiq8s}t@P3BsmRUDvz9`B3q$Tp*z?~qR7+y4f9uwwjd zhAxDuUx!~mvE|e2aNtZ&l9ShznR_(3il13YC{+ox3-ww#Pq`K$F z;>|$s&w1X>>eJpk6(jyp9sDWV5cZNB=CW zvgujDD5-89Eu0W)Vgf9Ko%B@ z?cUHdR^J?Su)lM2f+}arIvju*zkLSA^5JrimiJ)YWeOxn5r5=DUM@wx1-Ev@F2Di{ zQF1zAMZsgFa@d+wuNbd5P>WQGN;Z*M%7*0sXYaj(n*6%`(Wq2G5s_X+0tyHup#;!GNElKCzq`i& z+W*1IV3mLU{Rd?T=zo6y;eX2&XJV{#;1A*mKf0&Ck!AeobRo}!0 z2-XCGkytY<)XUk-*n{AR3^2Eb<^@DxLb!|Elk0|))*idsY&otLaHi;Y5DmXn`z+?mSBjZ zrWMLmDa6268)5E+^mhyja07xhwVlu^ICp}nPOz(~JKmcB1Zx`k2AFvw@ZQFF0?yyu z38Eir=!7>4)B{_AwJ-=*UzDM#8{S!$;NfDaZE4^dU=^$ZQgZXb8>rAXW8((|BQZ#Q zl!dRpsWK3Z#JOlgfM88CKPMm;+C zW9wiOEs&?Vm#K!5w}J{%!5yma6B?wbZ62!R7^2pwjG^Ec7gFbfTI1AC}?x)|7Cbv=BH1D(BWLd-&eU`>Cpx0j=htA&@f3ewBT zhhS~s0|8t61}QpPIs2K0VFMg7W={UzUN*XZp(@TeHxn;!MHf#u940W-3#kf1VKua^ zofRxiwQvMgHv=672-w{f5u)K`=4W7y)^#*+Lz)}uIq54R%tK6pV5GCMHONXq9|%SU zqb;=X=H^Hbm?fX>09J%RqdXe~_V0h>wbv7ZioZpaPss{6I?HP>d=@0c{u< zYNBZ9Zh#C`!J7x_D1h-HCTJZ{5D<*?glHNA!APhE5TXSHBmd!*zg?7m`%m0~ASRbI ztN;KpfS$I7MM%!d=Wvtst&bh+6zz6bb$$tv@(6@xY+I|-5VjbrTxn!vp^$mS<%z+1 zO1ja?rM$;V4<7J~T)8g+HZ(N#cXzgVFrLAn?D%B%td=2{$r+wo&z7jIM+Q=E1XhzL zE1&nX6PJU=llp^uZME126pfC-cbhq`uSJO-PQ{)O6}WTf&K-eUxLbGb-0^4uX=rO} zD^F*MiHnP8`xu_$NYD?vfa7AEHk$6~1BfJv zmHFUXrhQ6US~NcdFLwSsORiert-3n(mX;O;m-k{>z4&*z>b&kBo;8z%)l=@?y;-1> z{B^j*ytAiA3yVD~%fogfTfU{GMRWGsx9Q;$b7`XbE1;R0uxa}j>8EJ<Skht~^{&LWPC8UlVE!Ho)|_%y%cuYHj+lf5gPxvV zbPiV!SY%eBXmyYBax%K-51%pr12M3D`iu!$7msfeV=OXBTcXptXZfmrI)tN8htL?8`hkUjc(F^_o z-@4OfLRManzRyRn$=cOp_Jy<@iNO?_P%`zi@IjqADbDTm>C^9vQKI$h9fI8r_dBiQ z! zvoUgHd1DNgxZO;%4Kd773q0P?&=3Jh%Drg)lHvOG>$@velZB`OrR_PsP|1588bR_o8xKV3{vshSIn%;O$6!!aExNzaZ{6InMCVy=c zEhm}!xrLU~pT6%O2f|ihrlzNFzI$i5U~X#`7N%BTUvFY(Cl?vdvMrTBt$^!2A0$sx zqT3yB*43$R{QOyj@^$5vv%Qg>o!t|;#D6fvyiK7=)Myf8M7S6k8P|4pGGS4r3xh>$ z@$vD6{XWOHi{Z=368trAt>idll0dWDYkjiDNLqS&p58slK?0QVU`TXZCpGaC8B5V# z`cSq`5hd!9HIzDgdv8}&Rc-R0Y^QA|Q140v`4(vmQv&P$%97-ZAon zF;P9RKJmuQj86M;}*kSRAvNI4M^ z8JSLP)>=kIE+CC1%6#{9KMzA+6J<&lz_dh5|6u?2`gG_@p|dRHR-;A!Du z)>xIdXa`AHCX#8qxktV+@fh<-U9zeCazAuTRL`uUaWPGlOY$D8o}S(yAw^h1Qd0cV zCENYPFf6fyzSDRrx_C3|{Dlh|Kfm`D^^2*y4HmL?cXt=|KjGRYT%v0-Jeiv&!UY0> zvJ_oYH~F1(W+=&&#gV5)|0;sTVs%ldOjy+Nc_k%oPEO82!Z7OrL}Xhh)nakgxSJF= zIB2Hm{=smc-S0+6lHg27lHed=IG)PSdvH!qdee%_nbKA@c|CzZjTKI_zXQHPnCnJAu%HV)%2ovVFknDh+{)<3$xn1=t_YJGS)JS8_b$?J11 zmUg%Yy?zK4310@awY5EZ^a${ax=PG*6;Ss6LJ#h{ySsF^LI0978Y*`ik+!W5G2IQG zT@_XjV$W3%&Y&MzGF8u!xQy~n6Xp^T5$Wvj&xFl*dw#0sl)T3pds6ronJn7f({ndH zoe>U)AFdLAJq-ip!XgD?IYgNNwr|6@3v`l^hKB6MWY`I#p|ue!`@H&kp}BrCWxSGb zfqoY0D!OLuf+G3?(h5<$fW*__F%6 zjV6Fx?YCOpK|2yp6mae zZ6wk%()j21-qww8J*Kv{i4a2HqxyOw3Q4&2s`uO5U*3k(y{77ImZ2mU9Ur7+X0|$3 zOns{Hryr>-PlBJkBzK1DKW#T!`d4rHM!SWn>CIQK6kQ%zZhdRW$;m0@9m)dX6#T!_ zgP0Q@uQ{YBYyFZzha_|}Gn3cP-~R}}{`wxUHgG8>K0dxwbOZO=rowGRdUtnss^vD@ z`HL6Z=LZTn&zy-)O+Ee1&QSVLMeCp3f))Lxw?1&`Ln-gjYxhyQoylISJp=Ih+Qu3Z z8amybE;Cjayy|KHFr2zIn&&ET{cv3;QBdW_8~MqV@k-{VvS4k|OChI~0V|gH}G??z$&sKsJ@x4(2+z*G%(rB<|-eXJx5)fAL)X z0-OmsSgBh7QMam37a`cvD-%+5ZzTIxz*7q~ ziAttHhPI8@g^jY6(_v9UQxC&`Xdn=`H~C*X57pY=rQreXrKLM^Y`9tP{6#& z-|~>t9gy$guJ7*No*r34d2M~Yx$B-(QNPQn?P3^xr5`U+&vq~X5(QOG`uh3~5=@Rg zv#mL8YHIrTbm(FTxKUhO{Bkuq5Y3ao==t&0U0AE!7&(ldPtAxi0$kxcKM-{H<+tEK z!KsSdtCRAPG1toBTjlUnr$QRLk|ZFIs2eW>{>mZaNL+LvN_4qU`MnGQS1_0?GkD_{ z?xM$!rKy)kUSo;-6q;@-=K*9k3jpx;_MZLzU7xI>1oi*Ut`;ya78#>e0jD|=CAywa z`GX7rSMEs~nOIs%Mlzwz&CG6n@69$KPoG&v5$U@5(P0e&f%pfk`BVdmPe>^GJFH;^ zoWFSSc6PR)oNcvOWW0fT@DCwHqt>mZ(IS+u^mZ`^-Jtz$)7asX0J_iH+1cqD7~F%k z1B)I%&c9X{G)TCECBCFb{aI;hO4p#0Bu#UbYTc7-US~xtI!T zH{p@9Wg!xYIqJd2`)97*y!vB|JX6tFha(14K&A=KJsEkC2its?!xT@7Tsj{~dLl|ZcnEqJ@|87U^^35K)$`~Pw{%$71!-yNa>w@L3=9lY zT~cIiP0d@IdUA1e3{58)j1=w5PEJl@($dF0KfY@2ynF6$PL4-4?}sEom2%%1WFjBv zXqnCHmbN&qyZ7&3h~&9Ry(_z|^LjeVEh@gf+TmVwWxnU8@U1j6S~xavhY2pzX~;iM0AnSEcTr zp4ONXf(pK0wJ&XSo|_*iU=|k_Pf1M`j}%Y>9GufzP6m)z>(u>bSsWc5*S;pm=Nn}! z^Qi@#*VNQhAoK~*87YM%?7w(=Db**FJ!b9UBATSw;{6v~&Y9vqXMEodmowZF5P+}Wx7?tv29Q_HfJ z4`o+GW;#wRpwa{G(2s;*D8zOAyo^k1 z=iPIr^oVo3M(j8J7l2BhS^E;cN@qkNJD-D#P-l66R~pQZQKFANP;zH78hZcC8nR&C z$yfnTZKDl0f%5!U-|mP!Q1(1-H1z(JtNC+(Kk46-sX-+Jp8KU+UH8eo2l*r249dfe zSna`S>m2_fW&@QBc;-6vcx`htx~fV=(MYQup2i|yIedRHJ`p1tSyN$mN;MH|?1)i^VhFm>B%6g7tb!B$dZ?r=knnhe?(*?$f@(xyDZQ#Jw3h7 zzCIqB@L9rdZE8-ESk(9DjOlV}Io$hsH#PN^J&`(6vNJn7 z>(G;NF$+$F8A@`+oDht$EVDTah4P7B-#rTkgLA?-RC(yHwm;C^c1e*PI#bS8&piyMC$hpq3ER3Lqy1-0HDO!QA70oePfa5#NhHzet2dbW%o90dO$}MVQZVSscOtED46i@a`@K@iilQ3ME$1f-ypr{o#8yK*i-!carD83!J@&rYKHA#wgZ0{{qI4z5SLQOFY1o(>f0U1 zkFQ*-!?sE{Rcrmeb#vEme{^>l$Y1 zL;-<777h*_2Zu*Pjj^B3kJ-0Yz$YpiV{pW(>cgxo5RU2a@UYx_61HHT_9l4ME?{w( zwUW@E0Yh9^?uU)px0b^X9Eft4B#m>`813!t8}4`XWyo3|g~Q>8+Y{b{#q$CO{_NXU zD$D&K+ZsB4t*EG&AFDX$=jT_50u|0sl4tT_MOr?-b}#x@tSiWcujI#9(($zd{vDq- z0-;CFlUeQ$9hQ`*Ma!tLxz26$P5~&Nv=#1Vr53ZFQck9;C-Gc)Ivc?DKyq$T7dQ^i=^=mgm*esSmp<&yB*P2)9|_EU|K2h&adn?P){(eR zC#R-#Ld2))CqWWY6^~>Z5x;zy?)`%VD8s=JoW8~wdAg%5+q)s|HXE-#StGFAq4}sG z8Fp=-z3x9Lmz&}8m$!n{{jGbjsKx2~gon++laW$?<7yDeXO=QHuie^Jgf2XO_Kf`x z-NP@VjOdK12;OuB=lCuQB)3Dz6Kr1`c?!CI7_tEIXrT?$_2k??#txQzSy?$yWWc)s z>11kXXy~R*o&9IV+17OP*!s6jdwsHovaX(8)TXXNtC~>xBnO?vjyAs#j(@l6>i) z5#rWPOQiE>?)|56FL7Tdyc^pq`(ZMX$SCeJXT;!e`+fFni$ld64ZmpN|BzM{IjB?r z^MK=zPc>PW!{2Q3Z)Id;Fo}wiyC*|JLPOEi@ntFFoGS<0E2b6}5)nnu7KVy(&9@l; zQLyzF+TPi*n13PJO^RdXl62Vl@p+IioY3xgv#}BW;rX?M{CsiSh6sKT2=rd@L}+Lz z)b}exeSN)&iHTTb>62@9K?}4b=jHzDF*2^avDWlYWmklF=zF+1gc>9a8yFiKkFXV+ zArOp`hFLdqa&ji@3@x8>`}+E#**I-mC;QY(0lH0|i-K4l!(d&Ft#yKgl0z101 zlwDPM-5P6(!CFm?d z(a~q+qtfo~uES(QWVub*?r0T5BgW#qep;jWzSoWUB_Oz4tdHyo+SPfZjI%55!USb zASNq|51=v`q2&HS*0wgF#4XaQA?wE>rV^htTU13t#;g_<7<0@cldwQJ4t`lJC6YF-@orN*>D-QKYuPd zCZ@&hwYa*vpq-r^lt{Z2pOAp9!1%09Y1r0>3@ng~%PcV8|G5SzO;c(8^vTxcK@89! zgUS_k1r2i{W8(Od$2WXAN$x98ZdtfAO?epz+kYdNYpk5{Lp9OMRr!!`7PIv z+P8xtmGEsTdis8A8f2)AKwQ{~{E+_KzLDfV*EgLEr(JP%UAXqE;ptmCjiJse1TH_#)_m@lW z9w-^?v-{nsn!GN!+HmmvU(1mdgnp6Dl?f}l%$K*}xXFgdfBS4^YiV@gm8%|UL%=l>qYiYRUI+%gKjU$yBX@9+>u9PZyf zN#aRh{PE)lJ)YLo)KI^1ydIGG+kL<(0fG3frBQmYOi4+(@h4dRt!U}^i$=YZn3x8O zT6P$IVhRmed$h^F)j~^*q6f=^r^b7rBLMmOwOgrhVUpK)eJCX6q_A`(GO8TDRRK>e z^dqLTgCt3!@RM*joSt7`Fc>s+qwsGD1l*PdxZyj~aaK;wc%R+vM!JlZxU{tXK6`dK zJg@?u>J&`_97|#atZi;uZ0D9g?{=(sWR$HuNEl;0F#ny87yC_cj;mkZvaqwK(KF>j zF}Z_AJt*ogXWK5OCx^sga$X0+qaPf4z6j(Y7O{*Hrl-d;cxw_XfQ5}s3yF-`cV}!T>Q!6V;pFY_xK%OuW`f@a4PYM_I`<&k{wx>_=8s17` z1-Sg<^S(!J`uh6s>qGtjh8EuA@}E3mq0wlA1QVrP^s>+zw$L zbOcaTROI9D-+G&kw-Dv)I@gyQ_1LxgI<aboz4!i(Oog}rH||NH^1UY;SWcX1f9*b6*l((DYRYLS$@MV&hiZ$OZ0zTw-pD!JLmIJ)fPM!*!=!sQyJesPGsEFZi>^Q9lbG_+Q!%4qjgU z0hM&455MxB6e-Y2?r4r;F6!spnn{L>i;Ev!`S_Y1l>fcYVsUCF8Q#H#x^(l$=Q`ZC z?(}k-vOy_T1OmZm`3!UO#tp!wz1e%Zy1FT_E?~u<$ktdpmGvYxF_B#xfygt;R;B~Y z)O+_%?6lPS&M+x^eY(SW4*3ZE)G`a|D-MQ0iu%RN;i>JkC(3lXHBKO(m5^Xa5>RSM zIjfbDmGxvfJL5PT+uf9u8;>4|DSCb4YmMcg#GDW;?9aC;r<3n_VnCTz%8;Rg3wCvNWkCoh zH8nNqwE2zagk#$sPE3U(qggmw6=bH|H9AS1pLdavk~$|PrL!9xo%6dW zF{cKVWJt@*oawxKZmh;%>g&u5JyjTHDIAGn=0IXFd`FKSomyIA^Y-=*2??QNTo!hA z?VsO!r>Ccnczb*A?(d6>i2<-!EZ?ONh5Y>dwLbM#y3?r#|IoIya-~IpL+Y*id0E5(jdH+8M z2+@Ej0wEe;u$-zg=>J0hzq!&y4-;&do;eclY_F>7XQ~+D`rp|9uVQKQpZ)({j=^S1 zAs!)Nm;jJ_V6dNshk}Wzx0OwBps62P)5_Y@83;z=J9)dmYO#1*47FjZ;&F`2na@cXolef zJ&lyY^fUuP0!?vvGi@9aX@=AZa#Yl{c7;NX5tD2BTZCPjY0xFlw5T}gF;ckDmVj>E*RwMtPBKenrQ&RNEav$ z<*SXts9HLjg<6{`8L9YsxP}H;<4jB~u`1^NC}VeTYkgxUV?EOlf2YvUu)tsiu&$%7 zmWQT6fR?_KlLy|~Kg84~z*|=VtgP(jrs0l8_!7+B+#s$9T?1t(0zm+RkzW2_Pe%o8 zsGdQvwXv2VSWnAHQwa(2_Hs4GArK%S7-<^dY2x%6n%hTWB>|^wDR$AcQOZu8ky78&}-tjh3G?rR05sNHNupXJ zgEb5>7#*8njJqd7SrcL$=IUYJR<`pp1ML2~7k;{YD^jRD=cmeY zHYJlCWORj-Zx-CYH|3c6(hz($|(amm$r0HxW~+tqpc8InCL1=f7}JB6{2d85E=(wDR$GbTq>|GF)_EV1SOB z*_nKoU3+waL~-c!lKDT`B=4G2RAqO`HL6ZOU#Q? z$mHal9HHeeZw2Gx;xOe7M-q|ekjWxR<>d-=@O=IHbv_85{d-?-LR#9HGiT1Q&`2p6 z6&89y$}s;ncpwS$#wMQs#k=pJMytJ zB?_vX%vB52)YWDA61j72c6PQ}k;7HcAYJIg*ci*bE+^{i$fg@dvXtC;V6q z{>EUcjzVf@7L5>7<0(01knZ8PJO*lOYr9fBG(Aor zxA*0$BXs=Yh1G+^E?p9W!C(pkNuAx@r-kDzZWZZYe2HykVi!f;dh|%lWBer|K*)?GL;48dI2#+tsq>UJ61njr#lynf zJnGIJ76wMfnnR`P!b`H~mQOYQbY{G{88BdKu`<;hH9zu{_j^BCUhOz*n^_>P*f{qV znJh{UxH}%tEi<*cnk-5@Gz~a&`bN>>b#99^?K|**|57gghEh!WL#Zc`4k*(%=68P z%c51V%Gm>XTFkTGzsHllX1uJd%o|!TvA363JFd!aFmfWR7atNHUhwRhVZfQHpy?LI zkg%`~pt}IYY@~W)!;gW9DW0UE!otFG#o4)No^Mt{7MszY+-|vt#z>Xzu?;0Wx6e4zg20)!m$*}$N4f~5S z10Y>VS@ektjO_ey2^Trb?0#*n+V1{-JV^tLEph8iyI{Us^Xjk`Gjjq-Or8^O zxP_yfX1{&AU0bU*0O~ZBMW-huCsPvnA=(r%exqD9?xoQeyuwk-ZD#12wKX3n0wIB< z0q*YXyyE0kIM3%Kl~Ec$^5H|iQMPhEE`^KEDf99)0@z<3GeEa*uTCaYM8XXN*!^zh zX~lkBdeO)u9JSnJhOW5H##{RJ^7r7?FDLX;ukVc71qKF&Y;;NGjV`UgT>QPfb1Kk4n2@=81+z#9U@~$icb<<}Qepwr)5K!)wq|6ko_ko9 z@+2_E#l?Mik(7{7*+3qmQ4jKl7R2;U+eL1nEv&3m)QLla0*{M}wO))CT&oMBhcy8K z0h6m&6Ef|>Sby#H6CaH(-MxGF?CgO5$lW+dM(qfv3D~wW3N;9u|toIcE4rXi|L&{DFnT7 z>(+Kk^72Z2;>OB>V;kVY}Y+bQPJd~Vw6_u?@qEOFJ4gge$M%BFIxjfe?5?ukzoTk zC<=hQzg$|{5`p>v!rqE-b91w>vs;XC!87Hq-AYbQp67F7&M1v%WMqsZy%(RT^49V3 zQ7C=-G;efiy_Ey*F#ggxWcBUN+DtOs#$ck5K~d%O_jj5$8$rkA3_7vg!T3H0RVF3Hvj(CQfx;D za;e!#mWS;_*;VGZcFAnKa*y7;;khS;Li+e9xVgDmSd~T?qTgalr5|Sye!=%|du^P!9SUs_|FI?(OXx+I;y`u+jJgN5bL#x8XZq_vXmFf7v@Cfk!F)P4=sq zB$Y2sSH0f?)tJU_7L__OpA>2;$F^!y#H9GZPAr2%Lw{N0^2gWi)!#C%((lldw1A-C zUw7oh#as3t7!AfGCbAnoP}B=xf5~Nl{`TRSb=1O8F+C1}1(I}ibx-|?PpXyU?B3qq z10Y@G!-o%hN#7BREoLJ(%F7izKG)L2s)nB*cv2tn4O1%MGyndqHUbex(g0^Ex}GKp zsfw#Hsop3mC_nh$_FkEjPNH;q-`5EL=y3JazD^72zO8Z94}a%?l~vhl-9 z7u1+k?-Z4u1%W`ihK6T^qn68qR&3fjI_Qzzp~NjQIhlj3YRO+Y&TemS|0fM3sfMhH zadGPxD)h|z;Kj#sS%84#oWO8$NpI%sqW8;;(L;CumFISyeFV$z|qtbwBXB?)~ zE5D&ZL@k#@vE!CFckbA=x*%@hDBBxFi+HA!LU)AKgYJ-~Ee$2Pm`(^ts4>;B7>t}S z%2rO&dF^*s@1ErPHPg@R1|vp5AaJ@*eN|gS;SU%D-TcDTi=y5bMiTmr^^<+GGZ7Yj4+hF*?(9^H_etlaHD9*W*Mk zhdB)7Bk~JUuE?T~{_ZMnjX9x(!SI!qmTFT>)4RL%`Pi8*(ROE`{@)Ylp%Q!s=?}(h z17&XAy0!K-LH_H;x1Ri&^ERQOs`%aqx2IcU&jEpd!K2T^>Z|op6W)!&mH1vw1mgBQ zG~Ue8GUh&n@Rg+gqp1}ARGV`4HnwDtZ1dWUyEb^0)OAm)jw(19N%ybBMD5Y%*DAuc z+y;Dg^Dw2u;;W6nU?LG~8k?(=qVA*5Z?`*g3U>ho1O+Sby#kvn6TBRkH&3PByNA#b zzl|$NHS+WGJ0&Q{W^ZqAm;>dMyr<{SIPw1djg^TiTuU@79W*>fkx8FE*$!0b0_l*J z1AcfaFE7t!q?EfOkw5C<)i+PJyUOC@k4s2Nor6O8L_|dR;MXs`@tlzSgJ+#8{O63d zwY49i$gugLVh;SfteeTOeU`a?GOzH;V|@dI3eO2;Lo!Tw=S#Re6Fc9H&Q9IJqM|qw zQkr5092bUP7g}Fm5BYwdFtxOlP=TX}D=MC0GYzYV4xH&W0MDKW`uchkH2U_tcZPC?sM3fs1GNxed~77ptx=#GDX(5ZUnL z2}{+NFqr_gYYB4w6bdu(U}Dl|akvC8iZV2u-PYGEx99?Ty-ELKXl!hp!1h{?LK419 zCKHGHeZzrPxRTVN!x76xw@-Fm+?Y~{y2Qjp9?znDpKu_-u_RU2>ytk72?2=+8P5w| zFCGq8Z0p{E)DwqgcC=G zH1$H6chSZ6m2{itBtZkfCyCNLy2bWQ^z$TW`SYlO5OT({%rK zC^=na#_Wv8x40>288mR)M&ZQkE*Soz@j}B&PIu@bVbQtEg=Sjlh&1A9qU2m8Tyo0kyC34!_9}Yf=_O2Qkjs8oUs>9#_=%@fOzFkViLx|!dzY|J_-kQ< zEqNaqU@d9Fy{Fo!$%wBaX$^i?5jP$z>4r1&~$B-nUxU4L`w)Xb3XU`s~3tG`MHa_X* z?v9wW5YHY5i&lLO61;TjlF!cP;MR!=!Ig=sxrk3!?iKA*cP7sPfsFoheFz^Pg|Mwf zMsIKL=-61?=KO$yKoX|f=d7~F*p1J1!RMr;nD_Sfpn;2L^bHJ5O-+wfjqK|L<{CW4@y(qdc2*k<8BYR`OrEPwofRl$OM%nXYQ-41Pt|PJeQ;q-K)YMzI zZXIo&r>UvwpukrivhG+|R5TqcdfmtM;n%N@ z%b#kv5_sifnjM;|eP`a6m`g=RNB_o~#>OOrpDE!p5!D&e2Co3VKtaDNDmW$Yb?v)% z-8gbg!Tp15#Nj%HP7kyxbtMVB^5RNL-17BnNB4JDlVOqjVzRRAB_$>K1$R4qU~OjT z60a}y{J4%pjinD|oB{&zX=!IH(C9dlbLLa47miCG%2-%gZ%XL#sRzlzcBhUFROq%t zMY|vEnt7`6#Tgg3R`$aZa@B+5Nwa6vgO;y^gg_%AA{-P2?xv>$)lQcH=Cnf3TrCw; z_Go&f5%p=qL4uW)l@ID8M&~Jog%Sh4x;LSs-MJj?>5CiRdIoCz3EDb3=gyte3J}U8 ziCm6<^5lHLk5BwER?p7}$DX=IAbQ!C) zK?C_bIuC1zsF{aK0On?rFL=VDGu{5V7{XCn_ix1zzaxD*Jr|r|(dlkj?AaK0{#%`$ zx>dU}Y^o!}!(!s%M>RAw6Y~6s`JulG+h)bcwx(}w>gS=;Hj1T zJ2Kop;7ls#oR&!b_tv7Ku*KmEyL)>V7B!qNVk#UN52@7knPhl8N%Q1X1T^;PT&r`@ zgOrpT4=;!3S67cMjD8~>XJhjny%vm}=}5{iND+pL_I>N#^U*62NJ8=@A&c#pucs0Y^wn% z6skc&2MZPLo_e;I^46lKr-u$7C%)aCIePS{iM90wHKv?SMew{D-pac|NbCpLw=^eX$-zYQA5! zh2Yn1V{~U_$H&K6I5>EPTQB;;(ooO$Qi?3>Be&49*J_8S6=ow0GGv=`RQ`EBiRoG!ImCab`XOYC&i6xoUx5kF83ZTUjyx zM%{|ZKl6-9eX&|aYR=tfXk|6}W%i9C=EcU`!dgR6(Zz3_5o6a%85tQ_SXj!J^!4}; z4-Z2C98%K}Psne7VuMRae-&MN=gxi8H89Zf@hP9@d(gIL0uP^SeQsuiLg@qqyy~?= zcK`h3-#@)J-I|YcIXmfj!qxNfWY?0KU2V-<1ZOGIXVCHZnnYeKUJ95N`e=% zGBbG>7Z+2~JtVKmd=cT1@85e7XhStnK(Omglmx(He-uZ`i`%T9_FLqZQ4v8%ALvGM+eJ>28t zE7r+~pCZ6Qu6@l_6~B z$DbDr6}^#E^f6D184XK`T>pwVJed3yV_aNGOUqUDmt0(0%Kq$XOoq|505pv}wE~51 zIJHqI1*N6O!`_N4EG(2`WJA8jNv%!CisnCg!jdX6y*yqCxUs(> zD+~t9$2}34i~4zF3{$G1p+TBGonKokkSTBfhE`W!FH}-ek|M!cQc}|ULlI8hKch^pJRc+m>p6%Tk`20cu ze@0X=A0kA938E;XCWw9p6r-RY2?mLv7~=~fh@cUJSuy(k?yKt7s~rk&;P^?zx%@bzqk7~^ShagFTVI+9(-{9GoQV$^5tJVa?iEj z)&KnLt`B|aLm$8G(0w1;^5)x*tX%=tuRrCxpP#<_=+ADy?317Dee;@=Pde$OH{E#u z4}Np(sgHc(6PJG5xa&P#TkZe&;g+kvw{z>E3GY+_`)BVg-gNrur@wpU^UvJ-@i*<* z@uGh$_22Q^Ur(KL%{W}koL_B*~k_4FOb z{{7n0)t^WAoP6H;`(HQn^!E;3cjCRzn=F3xuDkBK=}GVKj!#_h`AhMS@BP7#KX~!k z)#?+cU37uxttGgez3}>*Zo28@3!eV77o0M=?pk!u;|Gua>dCJ>_4TuQC~y4szdrq4 zeWS7Zn_J#-GW@r{uV0~c{n?Qpy>tD~AJ}ib{fg@kUU%XXpGM^SbDsC&$!~oUlJBn) zP8De)-a7T5eNXPT4OhPNq?^3QAE+3{Nv|3C=7!TALifykYvzsLy!`S%))4ykweLKs zyQ}LtSDmrrPhKlK$@aeel>6QB5GdE-x4?^$v9Cm+3W zcm3~P`Ri|9@tQaE)_(ft`|<;Cf9m>+p1$|8@7{3!o8SD$7hinwwO`-*|E_=V@k76O zcvSwHS;1T}fA{#`uYBO4Tc=+7>Q|pRci{?JzV?NuZg|NXYCp9fdgT6}U9rE?qs}Bvl_SU<%oU!BmU!LBw=au(f_V{ND8xM@%^u_=D)gON0se9jW z-q_gpfBCqx_1Ljvk3Mwknd_<#tsKmJ`)yDC;J_!YJMrqjSiR!9p`$0CaKZ_1{)}_ZZf|E3*3{NWG(>cPhkegBImT>aKt z9+)}y$kmVD_t(!mId}fb!OYh#f9iE7p7+%2{$}?H-+%aPSG{7L@ro~f=}TjK_B`^7 z$M^kh)a~=|A6|FjGjIREiSUMpG@{jJGGBT}&mEWFb9K)P?z#TCk390o`_@jKeCdg& zUGd)co^;=#ul~`7({eYy_t;C`dee@7tN-{l|9a6gPmltuSFhfD_j&LA^r!p&@w(T) zZ2DghJ#X*L=bt|K;^%+y*nbtzz4pYfy!YT$dp@@J`lG*k@_lctfBHLLc-?nz``$(G z`07{Bai4hT`@*}PciPNL{`;9<-Tlz5Q}9!7-n`X$`(1aP z{qeW_?Q>_JdHO3OCk|cm@Wa}D?-6S9|2cTob=RHx<-6|s(t{74^0HMsFZr7GjemX3 zN3OsAgzwyD-F?aPUq%dt?H}Cun$Laia~~?cCu47X@7Djg;mBVnIfm|hCe1PQiXV@> za`&E_)<5()yh>4&f4*_oX}^5z{^#|V{_%@jPn*4jtXfypCT_UlhHrhQ`sxqw`rs8u ze|GyR&w1_(-=t|PzwwQ4Y~I@Sq94v&{?`wU-+teJ{OInNo_5;1${(md_l`U6Aa=y2 zk&#bL-uVZA^WhKw@XK$1nfgx?V`D3>`r0Lb^n#PYz`#j&-g)Pv-?-rgXKa7p|5`is z0O;xY`VI9fZW(`Y#flTW(apoVzk2(jjR&^9?1o?O-?C*(?={;mf5$sU&N=6gkNoP% z7wy`$>lH72?w`LR{|D!tcOF@t9=Lh`WxF;W`@?Ilx#p|?^iNw39m=13?zv-o_g?z` z_rGezgYU|`b?@Fwue|b4PCDh3uJ!9rx#pT{{_EkZc73w;#QA@J?BB0#?lHRWmJO%f zd&AepZ@=c(zdmy6Sr?sp^y!}tkB|S!$+`0{(eMB84<5VmgJ&N;yy4eRKk^OlQWm(4z( zH2BuHzV=nGdevrP-5%Qb@Q>EraPH=ZGi&xJ$}2y$`|X!&UmibQx$>pk{^Ig;&hFSt zEw|?bM1%Oi!>|AE(;j%`XTS2h$8LITMdP4Jp8uO&=UB9=Rm<$5_Z)Wc0)Qs@zw^DZ z_`kKi>jswN{}$tkTv}FyE-KT@Pe#p>1KCZeo`W*b*7vf&x5#6MlTY$MHBoZZ9}uBO?EN1VU;cH z-_BEo&Xj7K<;)bSPg{7OHH-^1Qf+WN4`5XkBcxCn%@6x~3Cf6Jhyv$%v&-C=PDi1cpE?6@d^)j_EjgL38 zESuizN&9TnJ0-nrehq*Pg31XfprTu8-dT z)YqFISib*ZQJ$kmdsc&*UL6D&x%8e$q5%w530jI3GzeDr%+6*qq*!Jgxt?PJ2(VRh zfoW-In6XD41lO5^%+aGjH;aa+A)qjhQYAJb)v!uhP(Zh)7hRxCp}GQ;vv=)MfWp=u z1#}xac7d{Kcw8a>p08xHAU8Xkq2L@nn&Y>=H|v2^u^m)Gj)Sz#o}-)PiDCt5o}ruN z(XwgzueTgVMUQH)831yCRYIn?cou*vbc>ZOhiwN1*Qv562c}Sc5F9-U)G1U4v$L7t z4qkEnJ5i{m*KC-B(i;HCs2qCxtI9ryTO$3CF2D>p2-y-HNdpT@N7e(WBG#kU$w*q5Kn5zhma`i%Q4Eek?HMm#nqy#&x9pps5SpM2!>Yim+Nl^R3_M&VW&zqHdTs}X9In5cVde<7|anm0k@0$vXACKcN9bXhH|MOg_GhT3ub_+n;HQ)-y5Dh zoXt$j1>LA>yLD;U*=SK4PVjfR~iJTV@1YYtUF2Sg5av$kWe9$odd6q zBLhK<)SaSaTndO&xZ8*<3d2>gFj3c0n?k;GtQr#eonzHN&bPy=?XL;BWR~n4LvD~6 zq-AcLKQBf&G0ul=a$zex*nsOg#&CR#r0EE`q<8llM%{V2B~7i>@}Cl#afQTkgfG3tm6=eD4>Dq0a8q_!+iO5RIndT2>C zCDeho?O3*>Lzny(8#iR5-KTd^Gd2n`)*3x$oU zcMg>!cMu&G08y)B-b`jKoRU(Ej zSw+%d0JF28fQrz=h_$SnWy(cl+*61}v52y|3EtSR_LF()87_eUK%nTRi<}ZMqX|Yz zmS<`TK#pTMYG(E7-4-Yy;Gn8iLmHT_AjZE%=t9FPufm|Jn|jqVlc=$Jb&KkUXWN$J zVhPp|FH4wFj&|4f_vT)IL3Z{2x6WR$dUkfD0=h%!0W-k0CR~SLf;%cmJCuDIaoh2> zXO^G#o+kD`<>2}3{jO+k|M%wyBKyDj_5FRz`TrK>Y0dtpOUUkuV|nEYlWI(ed3M=> z8j%qmCjT-QrwuWt5pjHL47e5O0@5TEjs?WZshP|k49jScd3N}Ke3h4kAt>LRqETTxw06;So|DnP-g=pfhsu@hF20+f=D42@P{ zMRUEqO0ay#Aj~fmg!wig%=-|=K;e^@5efOt<2WSpuzWvi0!88|$c8=sMBf+}aYLd* zU_%G8&DR`=_6Bl*FEcqHYN}v60l+FrrHKlln`KOt61tWWeP#_=*mN4L#8^*v!L((r za)DcMtZA_TlYTjrAO}YLUqOFk&_Sjv3Z*NK%}^TnW}~RWgjo(+x=D92;#iP9&(PEo z>c?F7qj(R4BjkTtNnzwT9UKD60ds74Vq)K}@y!!p%lP=N@j>tw%VYD=cC4DNAyBtG z2NXSrVj-Bnkx5Q;7KeAPq<1>R_0`Zz<$wvI&rZulOgNw#G65{P$N>%_iW@WxI`%cd zGBi+hkcLcGhXw{!SSJi%BBU{;&#j=kcsqq`qK^WbC_vaHqp4YjS4E&`K)s4P0`}RS z<5rLZbhBhRRmPn~Xp;V|0u9{N0CfE@T+J%tP>^jInaF`gPsN(fxmJ(sSYE+ExMEpu zu7Zpzi=NBr7<&l!bOnRYG4{(%S9AmAe7f-RoHBS0Lp(iFiEl-Pip3dn29%&~bap>t z`B~hjiTG$e=C~ne**(+*GKigzV-df`rl$aZRmfJ^gO#Gm#Zg_4`!C zC%Ld~VcoS-ii?jy1s9ehrN|q}T$cUT$s1XGZ;G`bAQD^o@gWSQ)JWZRl78!@NMo`` zsRWeManI>^kVX}Ribe54hn?=5qAiJL8dPk>tH+sZvsIiz4j82j;g5NOYQum=Er4zf z*$yf~7ioilI&VUJ;UH5(&X{KytQHn7p=<+owS(djru7x$RKCrxN&nWD4Y)eIN7)LC zhoF*_OzAygN(vsqX_VJw4&-r(GE2!g%K0%Ru^xs1v~5DS&|5W;5yO9FLS3^#g{tu{ z_96kImq521lp{5hrSyoRWiSG1sAJkoj-Sq=ah(x3LSS@`{}C}Fp-Y4gx3q~mELQIZ zOdgvV9cT53QP_mN6X0pi+x3CI{q}%|M_nEybORQ`hOq!7SaC))-T6@Ey~kQ{MT0M zw{Q_Cz~U5{5y&J<5_RC{m?&R1boGLP*p?qO3^_n-cx+VcY+>2;8(*V1&+%S-X@Zec z(~F3ELitzz7ymY9Id1Tc{}uI5j!E7~sZHMzsnXRISS0{WfDY@JF0j0$7`t4X^yAm= z88uxM&{ssnfNskHrdKT>Crg?n3p}r;f>9St>xKae2)GV3F`0B4a4n$eC3^bE1$9_8 zfQE<^CQ$h9PRRYCz;Xzfy6K`ain%&B6U51W&fOK{e-;~@V!He4gk`2XKx4%5?ILLd zesHMC4tY`}P!LNk*)Em?y3wIf<4G|i*?6h+01wuIM0vIh$gB{2Cxi@rr<9G_LHygG ze?&i_K>%#hmTU-;sWys%!bqva`Vev4i2#Hm89Ay%gSzR4TgwLDN`?j9bpz4wqC3i} z@eXGQizTd-jjg&d7PsI!L=E6k2Sg4Km2r37Mu6^T5Ps&n*GOwYFo>P*G2V*8*6?O5 z8?PoYT6aRI$A-2;Jz}vQC1_yOIH-dm=XmX@H(CGrp@#+a|K;=fzL@`SZGL(EUyP>> z|DUv$V;7nlbToFB2B%Iv&OV|zWApg=7GK6i=Ndi4LjUD+yn>9XiYts^8&sj+d7XHF zbc4w(a=9v>gh?)6g(fT`Emx?AYfNyRAW`vM$wRMIY@?!z`SBz9I1%0U z!?j|#L^Irm&Lhniz3rmvf3#`zd+{`p|BOTCC;pq-f4y=0FP~qI|5=o$4f((2uuUWs z(cw&PAkiR3nk_C>Ovy4P7dr|=>r!bVyl$lAt{QS2T|;07xQ=HQ!Mc9>Q?E{VrILOa zD7m=C#DE-e5HV#~(l81pfmuXULd?Qg3-thWwuUtu0AEnzn;yB-u@W8#`z;KS8Q>t> zfJFq9GZmm*sLXv(&_`U!GmJVoTd`F|vQ%Z^*WlX_EcmscpU>+vJ zxffSBR3~_RYtk-axC~IZ{3T+Ii7y2x)w=()k%KqVR1Rzjz3A~{Pj}hu#0m3}5@^^O zh-4SAh$5ixr8J44tk;k!)CvzHho?~RS3c=53MnF16w5>^7&Z)R8nXkHF0W)U@1Tf{ z?LO#XmphMr0xV8VLq`i7@VcS9b(KPJrf!z3`K3nf660q*Q>?}aB1iECm}Geb z>G&rAOdWk3TAh~Xz|zfrj} zh3YMd9hxCz9#V&87@0yej!9V-EsG;srcgckNWf0X<|KuL#GqB1PjE_2pG!#tgF`IG zTWI1Y%$sl)pV-U^*9eC-#9Jgi?tr!}0tKbW3j)g!&`k{;Zd7Zf4|IC)MAPXenrJ@T z{6id;103W!I;tVUTlAcQ;UK8hL6O?0T1&GsI5NS!s?zpu=)g;k$=Ap%1PVW~pzRIk z{E42S$tRqv=~J>mF_2kyD+QW{!>hIE$(D3o7$H=*ARH<0<{k8v!>g;;hKqvR_8 zd^eb`AP2FCFM(qn1MFIa-5bq?NXrS6fn~6i5e0JeOwAivV;jS*Ma7bc^cQhu31Vpt zKx%oAsA2e!;bT})!9HT|+j?;dlynEX?CcM6k;8)m`25sZV+>SA6Of~OjDfr)Ftaaw zq-D;V8gQVgSydl#tQkg5kOP}6%RtZ!H?^;V=&23Y0#MTcu2%~d^Ut@?w9gJnicW+c z%>O|}Gd(|pp{@m4?3r>Sd?DB?aQ|7eGfE)W@*$=4spboVl|IW24gp0G0%N6sC-OQN zel#1K|3MTL4Rgv#<@3Ej<&^dda~>Vzm9{al9F-lOs~cD?BX=9BpY2#x!pU;hQLF$p z!tTur)!K}A#I7#jA@MF!C>4a=JHY@pPLxDvX_$_6>wIBosL z^pfA6yi&16gnv;r=t3!-X_)>)%?rnrJ<@A34ih^_DJzA{&w#?Z0b~~C9CSye{7F(g zb0kO;nXq6WO^!?mn0QF$+_dPzl_H1Wm^3A#XEc+kES4-z75{i9MV}(TP$Y;F7(wvYbHXi7BRLkR-2ug&e9Ikk!l7SK@UviSP z*uV**c6!wqcnz9N4jT$7r?$+pX`%A;a4KEUA+Q}((=886t2m#LLPMqMG;T#dWhI+w zrN>Pr?68U;Mw?r##c4T#$kKY6`Tt$Zfn~Iy@!$FUx_JEevj2Z^p7zgw%4d`&7<+&b z1LDN2S>Z+u>v%a|3vUd^FR0YuUnS?i}AE2|4j`!7(nh6r00J8Fc-lzY6BfR z;h-Q0pA<}33YfE?)dQvRE+P^<=D)86j*CF@xwav`$cIXkvPa8Rx_KR9XT1ehjcju5 zC3LQ^$^2&yu!W8P9O#YC|NQ#=+O^B`e=(jm=07{kqnj)jr*4_ld0r+~wy=4*Pd{A( zFn;2$#xipGyl-r5i==1#Ev=IiFI$ugDIMp6+-{E8^G}AE_P5*GV%GLTM_j{z4%?RF zf}=-+24-i6R(4N$1ypnmiX7n%$oV&Nw0sW-KZV6DXppnOL2Q{sI1VXCsi#&YCDzo*!)z0^)Fp5{!kSs1f}YC4)` zff=T&JA6~rDuGp}<5k>;2y_#O`)1fyd}wT+9GJ+H)Z>>0*7P-NjtN^a(GGZt)x?kZu%R*w9FhY-3rU4Z`(z7@25~b zALc{4XWuR-hWd-feDL9u{)2B0sv!rXZRF+P5a56EQeiHWi$;k&w=G09aa$-G+R>BP zArdg6rfk%udDr=*14~2yTz-!4(?tKDhK{M5<@uQaP5r;UG5_znf#v(Z7v*U~|KG=W z0lt6N(5rRDhJw zFUxZZMYH$KupQd7byEXM&N*;EJ9Fg>uE4&v>jo8;ZfM`|_|DOtTL-~-FnXXN7ZqKk zfo`IbONj$#X9vj}Qf78Gy9RJ&!}N3CvVZ3c!6FH*M}0dkG_@S>B}aP6NhLFq?_zoJ_#g5#mj6<}pttg#gT zt;8?|Eao?u<{T1R)rSVgEk z9-7xuL#%A11+B0LBWKJ(CH-(q%}k-X$|^-#5|Mmzj9*|C1@X&~KEp`}saiqZ3DKB; znte))mu2(`9|VX6)ZwUCs-0lO*l1EC5fgY*X$Dx};EI1s4l7K(!Zv{mtDfQNcI-L~ z(QZQIq8thsId0YLy7po3ux{wkse_VdGBt_2tm#z-db#2XUz+7a4)ipXT}@|#e?NA* zG&&Aap()rQ&zTy4C||G|iNFooWK$=4ghsftBY_5unrykDP7$8Z++Zl}(Ow9zWTLlD z4AD*tRFHju=@bzIYk>QZGm!|llnCo2SN44IE>5p7dbfphS<(vy!B+)%PPHXJ`{Y41 zp?P$cC6P1yrM1|~HuV20babc{+IIyt(f`-4jmH1=<<~FY|GhZRT=f4Pgb_Ax>bUkV z7;MSt{$il1nm;}LHb1Rj^sz8He*#L|()dMv-W>GY%AA${NL$G&KXi%}-9_}S&sG4E zibq@W+)BFX5NU@tq)$qy*MxS6d=_B_QX3wB-L!sl^QCe9abz2M zk+MkIaN;H6tsWnfC`yD>vnW(B-8AAXkRufAuyquIAUqlhq|66%Idd4}rz8t09QP(C z&=0|ojmIx{+6Wbxjw89FW@t2=S{^>j4=oE9MPhZO0TNQ?Ogi@^ly89vgIWuKrX-je zW9;|EkZ)yy>zFOy!L_~>xaVNZi)Itrn~NdeVly2!;Z zi_>=ISV(7EK;wM@r(0+U^O}C_X07X z=jjIuI$9uCP#m@Gxq^88j<|xtZKb$^8ar^pO{6$*n!1xBgGzTNEj3rrX6V8K#L@a1 zf4x|)qzNQq`{Pa|_N{44!=78&67Y)Dj?Wh<4k-G1OFEmi<4TdCXkw`?DxPS#wy5jXgpj0>brGdCPB*#gtE z@;Qv$oS!SSgT6No$g)6*^)twgC5ByaBw~XSdgl526ja&(-Ue(#m|j zZoJtg?saR~HeAf^@#5(wbOQ5t=#WVqity+-iX=+4#bz>@0(J;{DH6Jf z5~KmL+YKIS$bBtQU||D^8jox#IXC8}-)pF-YsgP6&2NxGfM)~ca5h@h;>_k@q>2=# zp>#V_sGhS*Iq|L0!j*a}4ow=wFZL18YBZsXZgQx_8WoY!sjEig5rj4Th%TOzG&Ql5 z)Q`lTj8o_pI8AHu>^rh!BTV(<=HF_*M7HPgXx^T*k}*W3-f7VWgGM`PzAut&@`)Tp z-BFrKuq6Advf<%0Fbh-rXt&`GyTzm-w#hMbbB;A=XrBHtnOM&b7gidgB86 zX*#R_w>+W+ksd+OJ^rS4a|uHA;rP^Sz_&o2V|Gks3@2?(suVA2rm}Wy6-w@L0VIj6 ztjs{dB|%MhVY@{Cbn2ixazR>T97<9^N49CLcm;GQacIJEnC5Mt*FBWc>#LJP z(c)p8nvP}HWLv269gNM9Bo}QNJs~LfU^MKpD@EI*Cuia2FnSn`wFPE#Up^&RCms4; zfQ9*lEQT5Pj?0sKfA+hsn>nJG z5N)&`Cky`e+)v4E%+oewjV?*26I<0-qIhA7vC+4TY3h^Vi{k=XSsl|f(wFvhGP61| z%^IVAq=Jf5!4;nr-xPk@;wmgKikZ$PgfyFzpquLjVB-+T4`f@WM51aj5B^VVPd>jO z6%ax_yhL@kp;u+udZ(o5SEK`;^M8(OM- zxNNH7Y;QiM)Uhbh6m?CfWaxr1Syh&PE>D`poiq_UB-VQ5=6k;=y#PZRpX5mbRQ0lHIjAFjG|~Ti*Y-uuf8^KptzW+XV^N+iFa}*B zspw^{jOb+9F+su84UI@~8y2Tv8DTZk1$I|-46tY0mg8c8E66ZtNDQb#w^-55@*3bE z1G;*RFPp)8Xlj`*V4^Y$qV8sX3m&WrUYAwDF4L$3%cM04NWex8Fmw~C8Fll-g%f0v z%XEPe%B5iM$OO=I2WQl>?)K1s8Tc8saK!1M|B4rtau4}O{E2I3PtZ^S7NGOTeUN*FUoX*z0lDu4};OoTX06T9qS+}x*1j15bR;)9P404t>L1j zp`K@v%OYw1k8c^?ykm=6)jHHijiB43Kef0NE=j|GS;nU#Qm5B!enz_W>->X)K$L0jJ| z`mNh}e!*(=~(v6gU^oJu)sEIT%b=^kM}Rp-EIAx;H@2 zLDZ08*}z28oF4oNI?4?(`e(%=0jki1W#p)t%%%`ILmg0wzki!oK+v{v(ApG#L&?Ed zMnkq?)vH7~B+4plp8jc-0OiaP*1m3nqTyi|Iap=O6#dH3P=Oc}2#>i46B~o>V*#>TTM*i4}WkYX(fp!PjT++NE$eOK{Edrr~jg{CmEVodk^_sX#{yK|)?EHYB#Cag@Yx zVq2O3q=)=AT|EgfACjU~wJj5wt`AS(Aes#GNg5;!B{7^V93*ryjX)a~bfd-T6eGl( zW>@P^(mZTF)#f{e+I^BbkO^IsaI6yf&X@AZ@K8D3iClD{LqxnJgT;n(H(Mo(hE61- zIFqE8{L5~o_JNM6=K&)(s}c@TC)r{K#1-JFPzI}_8mJzV5h$T;JC^O})Qjtvima+? zyA*E&O6)=xl{^EZFqo}EDc4^(D0Pz_h6y7wO7R9ziu&y#vRx>h0xZTrYy-;iO~WI= zLD=$~B5DWNwxBFJS`v^gLpd_Oc@Btdn=iTlf+$Qfr~*pNq7roGtEL(&)vap5yzN)} z&+HVGRM2m69Ls4-#4osX@6^+_w$@s!ZLBj3zQlCuSr|a&iGV1dsh(YSpoW6raJFAU zWb>#Crgg&r$iyBEflrL^FY7gAGDqPwqHkD})U07vmkLHpU^3XDVJto=mOZxfq4VC{ ziepU!XaWi#wT$R{Ozbo|4H?7$Qe#66G^%I^(LHwYLE2&WU*)qPtbp;^I9i3}<_gzh zSub;bn$3~LGJ59x$egQFny~*SeN;;83RzVUW1W&`7=V_f{+2ieIPcIR&Jg$*YRjNG8H5Y!1fG-#fIa_!~tx! zic`p8JP5{7S;wwZ2Ry8QC#)h2x;11ws0dx84Uz>4gu8H%sUc@9=m_X0b`jLFk)ivO zC3W=qHR<2_vH@FdqE zzNdG6PkuuWwDp`+8|QR0m(S(b^+>|8Zo2TW?>;OdET+_USU|>NF1m}jJj#?e=r~1i zxE3-!WS@d409b|OQ8hMucvo~2mZ5jfGPi;4LJKsa+q?u}m~xDCjVL!SxzLPuY?Frk zI~f2+G!BAHQ;Kl%PgaoCc~Yz{q{OZoavWVllTE1?-Vq|@M;yfDgYYbok9Ba!g9gF3 zMr>;eM%;*QtuqQX=SWtT4$3yXz{k}R%~F|#ul%GnkeSTs+s`eaD95ouDgucK5!?w03 z6VT^J#99t;kn8BEhG?9WUINf?5Y+0RNLL0;mG!?+5Ot0xU;APGV0tO{qb3J zJGZlcd{({A#RK@9YZE;UyTrCi7MfCl1n1UR@b!Z3E~#vagNt(0ZkuIm>y%!%gf+Mh zsa{K1$&z`}wGBU;jHw}q@gw<#{i8wj5C;*AP&WfVT*yQ3rLZCkg%7U?{`nUFTn)e# z%QG~Pxt+tLadJFqu z3&?UEYg*>LgcBxgh2P}qh6a#X(;dsKvV$XzP9xW-vd%WAAX6XO(dB%WO*(7V&VnBw zM&zstnMY%eZo1Sp@33$~><14D{e+#JYnvCEC^2Gm{4MPyCtik~-O*u0PDwF!)eU4p z$+4=wzhe?ug@dT*a)RhCW@%ZWTWM<;Q=x;q?5}ndvBY6)Lv=EU?K+kt%rGeF4tAv> z5Qu5OD&&XHG(J?z;bpmPNEK(Qk{iIZ%$z7K4BFt-ZmSx3)vV zz!C@?Si)=jVn1yM%XL)N&ha_k{V$=FqDXpD3^3{fhp#OV;0h!PEQ@lXH^>>ZpkB)Kru>_OH zmvmBkyTzG%EzqwBF@~n*zz_}FrQe8Xr9%=lPCp;c<4i*zj>V#5v-OW(tvb*3k6r3} zhJ(s)Sja_?U&MZ#7eNNa;x2;JtltM6Q#Z@aZTc4M_j#GvO^wnP48ZvX;YeIP&9S07 zmSN~-c{eN*4S*vHz=Gwu{Ae;S0bE$7Lf((kooqj9H`CPxCTvvHp#gM?L0qh$D#TKJ zIB6<40`Bmrslf~YZrw(Mq(R**X8_Owat(@5D^XlZ@x-EybqoxPM)qa^K!;(~Hqao@ zXf0K@G8ySKdy}rl{gRZCgLr7UWq#_t$1LmS;Y`Mb$8?Zk8;k$|5&e zeg!NOiRJYrygh7EV;P!7#2YK1!AzIWmNLh6g%T))`K62CKZW{TKq5boDUs;{Z0H;! zp2naHNPCaL%;Gtlo8n0%I%eg8v~#J-NFaF3WH8(Q9x))s&3JQb#lkH8Spc95_F9Hl zMPeTv(3aMK(URajC8w+bayL6^<_AUL$LTd46F4!@>I9)hma75l77=VAh?Sg@$-rU} zVZ6iAP&06cX-QDEwBUB2RJcPOjU%Y-b95K&q6EPDk*1wZ=toc+J#5&jXEHW)E6v&+ z<2m;V0U@f0i#*$)H$w%Ex1A@WN zHgXywn`JifLG1!Euw4N7S|uqYvfyt+bsv=kmvq1cFpo&8ef)eG&2I=WGOQfLzKc_8lX##;PlfrrbQ2?UX!wt=W&#uDO7LR3TP7C{c2mBUidM=j8EPDPGAtuV8fgBfy$i{P1QDIChZG>G= zt@9kLG;w8wR6~lgCW6f&MWH;uDpIt?%$U&*R*I>9A!#C#Ei*miXU3m*=&)@$E|8iT zTG>726;RPNXl0Q>m&P(+8y1m&7$V>Xkh8!+Y?%bSA?2t_WS%PV;jBUg9K>kd0LbMu zRJ1gd%_JcrKPN=wWklpVgNXbBAR?cP2$5E7k2uoJgZwOzS9{goOlJQs6YR8Vs9Hb{ z$oH=SeZ76XYj~D~K9L|2OhXK)K|+kBl5Xm_g0$c)Sy^{0UV$e2B8<#)vUOn>x*pD1 zrJP$qIi71Vy9T%w9fK-7XgP8w26iZ8N!7r2)iB9vu`@aXWvZT7|6WVy+JWg7LY3ih9a9Mm|8 zphzA_SOD5O9~28x%2FG+2u;FM8mL+nOM&IfoI(VDs@V<{}M})>#gZdNk|` zEFf1e(g{V?-HKJU%E&~7^3$*$a=VJuc2b%=!eS$YQ8nc7%W`NAhahe zx!Zwj(IOW^q$~^mlEUrj83o1&BI_TYH*08nEUeR9<$@9sU(l=r9b*sS*1Kf-I-f=UR>q4cy}(Y#B9_Bf$01 zfBSQ`h22~L2%~e4)LttiNhnT_AhQxEN5(+=%hmdFuEl@$KbsQrETM chart and their default values. - -| Parameter | Description | Default | -|:------------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------|:--------------------------------------------------------| -| `global.imageRegistry` | Global Docker image registry | `nil` | -| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` (does not add image pull secrets to deployed pods) | -| `global.storageClass` | Global storage class for dynamic provisioning | `nil` | -| `global.redis.password` | RedisTM password (overrides `password`) | `nil` | -| `image.registry` | RedisTM Image registry | `docker.io` | -| `image.repository` | RedisTM Image name | `bitnami/redis` | -| `image.tag` | RedisTM Image tag | `{TAG_NAME}` | -| `image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | -| `nameOverride` | String to partially override redis.fullname template with a string (will prepend the release name) | `nil` | -| `fullnameOverride` | String to fully override redis.fullname template with a string | `nil` | -| `cluster.enabled` | Use master-slave topology | `true` | -| `cluster.slaveCount` | Number of slaves | `2` | -| `existingSecret` | Name of existing secret object (for password authentication) | `nil` | -| `existingSecretPasswordKey` | Name of key containing password to be retrieved from the existing secret | `nil` | -| `usePassword` | Use password | `true` | -| `usePasswordFile` | Mount passwords as files instead of environment variables | `false` | -| `password` | RedisTM password (ignored if existingSecret set) | Randomly generated | -| `configmap` | Additional common RedisTM node configuration (this value is evaluated as a template) | See values.yaml | -| `clusterDomain` | Kubernetes DNS Domain name to use | `cluster.local` | -| `networkPolicy.enabled` | Enable NetworkPolicy | `false` | -| `networkPolicy.allowExternal` | Don't require client label for connections | `true` | -| `networkPolicy.ingressNSMatchLabels` | Allow connections from other namespaces | `{}` | -| `networkPolicy.ingressNSPodMatchLabels` | For other namespaces match by pod labels and namespace labels | `{}` | -| `securityContext.*` | Other pod security context to be included as-is in the pod spec | `{}` | -| `securityContext.enabled` | Enable security context (both redis master and slave pods) | `true` | -| `securityContext.fsGroup` | Group ID for the container (both redis master and slave pods) | `1001` | -| `containerSecurityContext.*` | Other container security context to be included as-is in the container spec | `{}` | -| `containerSecurityContext.enabled` | Enable security context (both redis master and slave containers) | `true` | -| `containerSecurityContext.runAsUser` | User ID for the container (both redis master and slave containers) | `1001` | -| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `false` | -| `serviceAccount.name` | The name of the ServiceAccount to create | Generated using the fullname template | -| `serviceAccount.annotations` | Specifies annotations to add to ServiceAccount. | `nil` | -| `rbac.create` | Specifies whether RBAC resources should be created | `false` | -| `rbac.role.rules` | Rules to create | `[]` | -| `metrics.enabled` | Start a side-car prometheus exporter | `false` | -| `metrics.image.registry` | RedisTM exporter image registry | `docker.io` | -| `metrics.image.repository` | RedisTM exporter image name | `bitnami/redis-exporter` | -| `metrics.image.tag` | RedisTM exporter image tag | `{TAG_NAME}` | -| `metrics.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `metrics.image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | -| `metrics.extraArgs` | Extra arguments for the binary; possible values [here](https://github.com/oliver006/redis_exporter#flags) | {} | -| `metrics.podLabels` | Additional labels for Metrics exporter pod | {} | -| `metrics.podAnnotations` | Additional annotations for Metrics exporter pod | {} | -| `metrics.resources` | Exporter resource requests/limit | Memory: `256Mi`, CPU: `100m` | -| `metrics.serviceMonitor.enabled` | if `true`, creates a Prometheus Operator ServiceMonitor (also requires `metrics.enabled` to be `true`) | `false` | -| `metrics.serviceMonitor.namespace` | Optional namespace which Prometheus is running in | `nil` | -| `metrics.serviceMonitor.interval` | How frequently to scrape metrics (use by default, falling back to Prometheus' default) | `nil` | -| `metrics.serviceMonitor.selector` | Default to kube-prometheus install (CoreOS recommended), but should be set according to Prometheus install | `{ prometheus: kube-prometheus }` | -| `metrics.serviceMonitor.relabelings` | ServiceMonitor relabelings. Value is evaluated as a template | `[]` | -| `metrics.serviceMonitor.metricRelabelings` | ServiceMonitor metricRelabelings. Value is evaluated as a template | `[]` | -| `metrics.service.type` | Kubernetes Service type (redis metrics) | `ClusterIP` | -| `metrics.service.externalTrafficPolicy` | External traffic policy (when service type is LoadBalancer) | `Cluster` | -| `metrics.service.annotations` | Annotations for the services to monitor (redis master and redis slave service) | {} | -| `metrics.service.labels` | Additional labels for the metrics service | {} | -| `metrics.service.loadBalancerIP` | loadBalancerIP if redis metrics service type is `LoadBalancer` | `nil` | -| `metrics.priorityClassName` | Metrics exporter pod priorityClassName | `nil` | -| `metrics.prometheusRule.enabled` | Set this to true to create prometheusRules for Prometheus operator | `false` | -| `metrics.prometheusRule.additionalLabels` | Additional labels that can be used so prometheusRules will be discovered by Prometheus | `{}` | -| `metrics.prometheusRule.namespace` | namespace where prometheusRules resource should be created | Same namespace as redis | -| `metrics.prometheusRule.rules` | [rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/) to be created, check values for an example. | `[]` | -| `persistence.existingClaim` | Provide an existing PersistentVolumeClaim | `nil` | -| `master.persistence.enabled` | Use a PVC to persist data (master node) | `true` | -| `master.hostAliases` | Add deployment host aliases | `[]` | -| `master.persistence.path` | Path to mount the volume at, to use other images | `/data` | -| `master.persistence.subPath` | Subdirectory of the volume to mount at | `""` | -| `master.persistence.storageClass` | Storage class of backing PVC | `generic` | -| `master.persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | -| `master.persistence.size` | Size of data volume | `8Gi` | -| `master.persistence.matchLabels` | matchLabels persistent volume selector | `{}` | -| `master.persistence.matchExpressions` | matchExpressions persistent volume selector | `{}` | -| `master.persistence.volumes` | Additional volumes without creating PVC | `{}` | -| `master.statefulset.labels` | Additional labels for redis master StatefulSet | `{}` | -| `master.statefulset.annotations` | Additional annotations for redis master StatefulSet | `{}` | -| `master.statefulset.updateStrategy` | Update strategy for StatefulSet | onDelete | -| `master.statefulset.rollingUpdatePartition` | Partition update strategy | `nil` | -| `master.statefulset.volumeClaimTemplates.labels` | Additional labels for redis master StatefulSet volumeClaimTemplates | `{}` | -| `master.statefulset.volumeClaimTemplates.annotations` | Additional annotations for redis master StatefulSet volumeClaimTemplates | `{}` | -| `master.podLabels` | Additional labels for RedisTM master pod | {} | -| `master.podAnnotations` | Additional annotations for RedisTM master pod | {} | -| `master.extraEnvVars` | Additional Environment Variables passed to the pod of the master's stateful set set | `[]` | -| `master.extraEnvVarCMs` | Additional Environment Variables ConfigMappassed to the pod of the master's stateful set set | `[]` | -| `master.extraEnvVarsSecret` | Additional Environment Variables Secret passed to the master's stateful set | `[]` | -| `podDisruptionBudget.enabled` | Pod Disruption Budget toggle | `false` | -| `podDisruptionBudget.minAvailable` | Minimum available pods | `1` | -| `podDisruptionBudget.maxUnavailable` | Maximum unavailable | `nil` | -| `redisPort` | RedisTM port (in both master and slaves) | `6379` | -| `tls.enabled` | Enable TLS support for replication traffic | `false` | -| `tls.authClients` | Require clients to authenticate or not | `true` | -| `tls.certificatesSecret` | Name of the secret that contains the certificates | `nil` | -| `tls.certFilename` | Certificate filename | `nil` | -| `tls.certKeyFilename` | Certificate key filename | `nil` | -| `tls.certCAFilename` | CA Certificate filename | `nil` | -| `tls.dhParamsFilename` | DH params (in order to support DH based ciphers) | `nil` | -| `master.command` | RedisTM master entrypoint string. The command `redis-server` is executed if this is not provided. Note this is prepended with `exec` | `/run.sh` | -| `master.preExecCmds` | Text to inset into the startup script immediately prior to `master.command`. Use this if you need to run other ad-hoc commands as part of startup | `nil` | -| `master.configmap` | Additional RedisTM configuration for the master nodes (this value is evaluated as a template) | `nil` | -| `master.disableCommands` | Array of RedisTM commands to disable (master) | `["FLUSHDB", "FLUSHALL"]` | -| `master.extraFlags` | RedisTM master additional command line flags | [] | -| `master.nodeSelector` | RedisTM master Node labels for pod assignment | {"beta.kubernetes.io/arch": "amd64"} | -| `master.tolerations` | Toleration labels for RedisTM master pod assignment | [] | -| `master.affinity` | Affinity settings for RedisTM master pod assignment | {} | -| `master.schedulerName` | Name of an alternate scheduler | `nil` | -| `master.service.type` | Kubernetes Service type (redis master) | `ClusterIP` | -| `master.service.externalTrafficPolicy` | External traffic policy (when service type is LoadBalancer) | `Cluster` | -| `master.service.port` | Kubernetes Service port (redis master) | `6379` | -| `master.service.nodePort` | Kubernetes Service nodePort (redis master) | `nil` | -| `master.service.annotations` | annotations for redis master service | {} | -| `master.service.labels` | Additional labels for redis master service | {} | -| `master.service.loadBalancerIP` | loadBalancerIP if redis master service type is `LoadBalancer` | `nil` | -| `master.service.loadBalancerSourceRanges` | loadBalancerSourceRanges if redis master service type is `LoadBalancer` | `nil` | -| `master.resources` | RedisTM master CPU/Memory resource requests/limits | Memory: `256Mi`, CPU: `100m` | -| `master.livenessProbe.enabled` | Turn on and off liveness probe (redis master pod) | `true` | -| `master.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (redis master pod) | `5` | -| `master.livenessProbe.periodSeconds` | How often to perform the probe (redis master pod) | `5` | -| `master.livenessProbe.timeoutSeconds` | When the probe times out (redis master pod) | `5` | -| `master.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis master pod) | `1` | -| `master.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | -| `master.readinessProbe.enabled` | Turn on and off readiness probe (redis master pod) | `true` | -| `master.readinessProbe.initialDelaySeconds` | Delay before readiness probe is initiated (redis master pod) | `5` | -| `master.readinessProbe.periodSeconds` | How often to perform the probe (redis master pod) | `5` | -| `master.readinessProbe.timeoutSeconds` | When the probe times out (redis master pod) | `1` | -| `master.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis master pod) | `1` | -| `master.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | -| `master.shareProcessNamespace` | RedisTM Master pod `shareProcessNamespace` option. Enables /pause reap zombie PIDs. | `false` | -| `master.priorityClassName` | RedisTM Master pod priorityClassName | `nil` | -| `volumePermissions.enabled` | Enable init container that changes volume permissions in the registry (for cases where the default k8s `runAsUser` and `fsUser` values do not work) | `false` | -| `volumePermissions.image.registry` | Init container volume-permissions image registry | `docker.io` | -| `volumePermissions.image.repository` | Init container volume-permissions image name | `bitnami/bitnami-shell` | -| `volumePermissions.image.tag` | Init container volume-permissions image tag | `"10"` | -| `volumePermissions.image.pullPolicy` | Init container volume-permissions image pull policy | `Always` | -| `volumePermissions.resources ` | Init container volume-permissions CPU/Memory resource requests/limits | {} | -| `volumePermissions.securityContext.*` | Security context of the init container | `{}` | -| `volumePermissions.securityContext.runAsUser` | UserID for the init container (when facing issues in OpenShift or uid unknown, try value "auto") | 0 | -| `slave.hostAliases` | Add deployment host aliases | `[]` | -| `slave.service.type` | Kubernetes Service type (redis slave) | `ClusterIP` | -| `slave.service.externalTrafficPolicy` | External traffic policy (when service type is LoadBalancer) | `Cluster` | -| `slave.service.nodePort` | Kubernetes Service nodePort (redis slave) | `nil` | -| `slave.service.annotations` | annotations for redis slave service | {} | -| `slave.service.labels` | Additional labels for redis slave service | {} | -| `slave.service.port` | Kubernetes Service port (redis slave) | `6379` | -| `slave.service.loadBalancerIP` | LoadBalancerIP if RedisTM slave service type is `LoadBalancer` | `nil` | -| `slave.service.loadBalancerSourceRanges` | loadBalancerSourceRanges if RedisTM slave service type is `LoadBalancer` | `nil` | -| `slave.command` | RedisTM slave entrypoint string. The command `redis-server` is executed if this is not provided. Note this is prepended with `exec` | `/run.sh` | -| `slave.preExecCmds` | Text to inset into the startup script immediately prior to `slave.command`. Use this if you need to run other ad-hoc commands as part of startup | `nil` | -| `slave.configmap` | Additional RedisTM configuration for the slave nodes (this value is evaluated as a template) | `nil` | -| `slave.disableCommands` | Array of RedisTM commands to disable (slave) | `[FLUSHDB, FLUSHALL]` | -| `slave.extraFlags` | RedisTM slave additional command line flags | `[]` | -| `slave.livenessProbe.enabled` | Turn on and off liveness probe (redis slave pod) | `true` | -| `slave.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (redis slave pod) | `5` | -| `slave.livenessProbe.periodSeconds` | How often to perform the probe (redis slave pod) | `5` | -| `slave.livenessProbe.timeoutSeconds` | When the probe times out (redis slave pod) | `5` | -| `slave.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis slave pod) | `1` | -| `slave.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | -| `slave.readinessProbe.enabled` | Turn on and off slave.readiness probe (redis slave pod) | `true` | -| `slave.readinessProbe.initialDelaySeconds` | Delay before slave.readiness probe is initiated (redis slave pod) | `5` | -| `slave.readinessProbe.periodSeconds` | How often to perform the probe (redis slave pod) | `5` | -| `slave.readinessProbe.timeoutSeconds` | When the probe times out (redis slave pod) | `1` | -| `slave.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis slave pod) | `1` | -| `slave.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. (redis slave pod) | `5` | -| `slave.shareProcessNamespace` | RedisTM slave pod `shareProcessNamespace` option. Enables /pause reap zombie PIDs. | `false` | -| `slave.persistence.enabled` | Use a PVC to persist data (slave node) | `true` | -| `slave.persistence.path` | Path to mount the volume at, to use other images | `/data` | -| `slave.persistence.subPath` | Subdirectory of the volume to mount at | `""` | -| `slave.persistence.storageClass` | Storage class of backing PVC | `generic` | -| `slave.persistence.accessModes` | Persistent Volume Access Modes | `[ReadWriteOnce]` | -| `slave.persistence.size` | Size of data volume | `8Gi` | -| `slave.persistence.matchLabels` | matchLabels persistent volume selector | `{}` | -| `slave.persistence.matchExpressions` | matchExpressions persistent volume selector | `{}` | -| `slave.statefulset.labels` | Additional labels for redis slave StatefulSet | `{}` | -| `slave.statefulset.annotations` | Additional annotations for redis slave StatefulSet | `{}` | -| `slave.statefulset.updateStrategy` | Update strategy for StatefulSet | onDelete | -| `slave.statefulset.rollingUpdatePartition` | Partition update strategy | `nil` | -| `slave.statefulset.volumeClaimTemplates.labels` | Additional labels for redis slave StatefulSet volumeClaimTemplates | `{}` | -| `slave.statefulset.volumeClaimTemplates.annotations` | Additional annotations for redis slave StatefulSet volumeClaimTemplates | `{}` | -| `slave.extraEnvVars` | Additional Environment Variables passed to the pod of the slave's stateful set set | `[]` | -| `slave.extraEnvVarCMs` | Additional Environment Variables ConfigMappassed to the pod of the slave's stateful set set | `[]` | -| `masslaveter.extraEnvVarsSecret` | Additional Environment Variables Secret passed to the slave's stateful set | `[]` | -| `slave.podLabels` | Additional labels for RedisTM slave pod | `master.podLabels` | -| `slave.podAnnotations` | Additional annotations for RedisTM slave pod | `master.podAnnotations` | -| `slave.schedulerName` | Name of an alternate scheduler | `nil` | -| `slave.resources` | RedisTM slave CPU/Memory resource requests/limits | `{}` | -| `slave.affinity` | Enable node/pod affinity for slaves | {} | -| `slave.tolerations` | Toleration labels for RedisTM slave pod assignment | [] | -| `slave.spreadConstraints` | [Topology Spread Constraints](https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/) for RedisTM slave pod | {} | -| `slave.priorityClassName` | RedisTM Slave pod priorityClassName | `nil` | -| `sentinel.enabled` | Enable sentinel containers | `false` | -| `sentinel.usePassword` | Use password for sentinel containers | `true` | -| `sentinel.masterSet` | Name of the sentinel master set | `mymaster` | -| `sentinel.initialCheckTimeout` | Timeout for querying the redis sentinel service for the active sentinel list | `5` | -| `sentinel.quorum` | Quorum for electing a new master | `2` | -| `sentinel.downAfterMilliseconds` | Timeout for detecting a RedisTM node is down | `60000` | -| `sentinel.failoverTimeout` | Timeout for performing a election failover | `18000` | -| `sentinel.parallelSyncs` | Number of parallel syncs in the cluster | `1` | -| `sentinel.port` | RedisTM Sentinel port | `26379` | -| `sentinel.cleanDelaySeconds` | Delay seconds before issuing the the cleaning in the next node | `5` | -| `sentinel.configmap` | Additional RedisTM configuration for the sentinel nodes (this value is evaluated as a template) | `nil` | -| `sentinel.staticID` | Enable static IDs for sentinel replicas (If disabled IDs will be randomly generated on startup) | `false` | -| `sentinel.service.type` | Kubernetes Service type (redis sentinel) | `ClusterIP` | -| `sentinel.service.externalTrafficPolicy` | External traffic policy (when service type is LoadBalancer) | `Cluster` | -| `sentinel.service.nodePort` | Kubernetes Service nodePort (redis sentinel) | `nil` | -| `sentinel.service.annotations` | annotations for redis sentinel service | {} | -| `sentinel.service.labels` | Additional labels for redis sentinel service | {} | -| `sentinel.service.redisPort` | Kubernetes Service port for RedisTM read only operations | `6379` | -| `sentinel.service.sentinelPort` | Kubernetes Service port for RedisTM sentinel | `26379` | -| `sentinel.service.redisNodePort` | Kubernetes Service node port for RedisTM read only operations | `` | -| `sentinel.service.sentinelNodePort` | Kubernetes Service node port for RedisTM sentinel | `` | -| `sentinel.service.loadBalancerIP` | LoadBalancerIP if RedisTM sentinel service type is `LoadBalancer` | `nil` | -| `sentinel.livenessProbe.enabled` | Turn on and off liveness probe (redis sentinel pod) | `true` | -| `sentinel.livenessProbe.initialDelaySeconds` | Delay before liveness probe is initiated (redis sentinel pod) | `5` | -| `sentinel.livenessProbe.periodSeconds` | How often to perform the probe (redis sentinel container) | `5` | -| `sentinel.livenessProbe.timeoutSeconds` | When the probe times out (redis sentinel container) | `5` | -| `sentinel.livenessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis sentinel container) | `1` | -| `sentinel.livenessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. | `5` | -| `sentinel.readinessProbe.enabled` | Turn on and off sentinel.readiness probe (redis sentinel pod) | `true` | -| `sentinel.readinessProbe.initialDelaySeconds` | Delay before sentinel.readiness probe is initiated (redis sentinel pod) | `5` | -| `sentinel.readinessProbe.periodSeconds` | How often to perform the probe (redis sentinel pod) | `5` | -| `sentinel.readinessProbe.timeoutSeconds` | When the probe times out (redis sentinel container) | `1` | -| `sentinel.readinessProbe.successThreshold` | Minimum consecutive successes for the probe to be considered successful after having failed (redis sentinel container) | `1` | -| `sentinel.readinessProbe.failureThreshold` | Minimum consecutive failures for the probe to be considered failed after having succeeded. (redis sentinel container) | `5` | -| `sentinel.resources` | RedisTM sentinel CPU/Memory resource requests/limits | `{}` | -| `sentinel.image.registry` | RedisTM Sentinel Image registry | `docker.io` | -| `sentinel.image.repository` | RedisTM Sentinel Image name | `bitnami/redis-sentinel` | -| `sentinel.image.tag` | RedisTM Sentinel Image tag | `{TAG_NAME}` | -| `sentinel.image.pullPolicy` | Image pull policy | `IfNotPresent` | -| `sentinel.image.pullSecrets` | Specify docker-registry secret names as an array | `nil` | -| `sentinel.extraEnvVars` | Additional Environment Variables passed to the pod of the sentinel node stateful set set | `[]` | -| `sentinel.extraEnvVarCMs` | Additional Environment Variables ConfigMappassed to the pod of the sentinel node stateful set set | `[]` | -| `sentinel.extraEnvVarsSecret` | Additional Environment Variables Secret passed to the sentinel node statefulset | `[]` | -| `sentinel.preExecCmds` | Text to inset into the startup script immediately prior to `sentinel.command`. Use this if you need to run other ad-hoc commands as part of startup | `nil` | -| `sysctlImage.enabled` | Enable an init container to modify Kernel settings | `false` | -| `sysctlImage.command` | sysctlImage command to execute | [] | -| `sysctlImage.registry` | sysctlImage Init container registry | `docker.io` | -| `sysctlImage.repository` | sysctlImage Init container name | `bitnami/bitnami-shell` | -| `sysctlImage.tag` | sysctlImage Init container tag | `"10"` | -| `sysctlImage.pullPolicy` | sysctlImage Init container pull policy | `Always` | -| `sysctlImage.mountHostSys` | Mount the host `/sys` folder to `/host-sys` | `false` | -| `sysctlImage.resources` | sysctlImage Init container CPU/Memory resource requests/limits | {} | -| `podSecurityPolicy.create` | Specifies whether a PodSecurityPolicy should be created | `false` | +### Global parameters + +| Name | Description | Value | +| ------------------------- | ----------------------------------------------------- | ----- | +| `global.imageRegistry` | Global Docker image registry | `nil` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | +| `global.storageClass` | Global StorageClass for Persistent Volume(s) | `nil` | +| `global.redis.password` | Global Redis(TM) password (overrides `auth.password`) | `nil` | + + +### Common parameters + +| Name | Description | Value | +| ------------------- | -------------------------------------------------- | --------------- | +| `kubeVersion` | Override Kubernetes version | `nil` | +| `nameOverride` | String to partially override common.names.fullname | `nil` | +| `fullnameOverride` | String to fully override common.names.fullname | `nil` | +| `commonLabels` | Labels to add to all deployed objects | `{}` | +| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | +| `clusterDomain` | Kubernetes cluster domain name | `cluster.local` | +| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | + + +### Redis(TM) Image parameters + +| Name | Description | Value | +| ------------------- | ---------------------------------------------------- | --------------------- | +| `image.registry` | Redis(TM) image registry | `docker.io` | +| `image.repository` | Redis(TM) image repository | `bitnami/redis` | +| `image.tag` | Redis(TM) image tag (immutable tags are recommended) | `6.2.1-debian-10-r36` | +| `image.pullPolicy` | Redis(TM) image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Redis(TM) image pull secrets | `[]` | +| `image.debug` | Enable image debug mode | `false` | + + +### Redis(TM) common configuration parameters + +| Name | Description | Value | +| -------------------------------- | ------------------------------------------------------------------------------------ | ------------- | +| `architecture` | Redis(TM) architecture. Allowed values: `standalone` or `replication` | `replication` | +| `auth.enabled` | Enable password authentication | `true` | +| `auth.sentinel` | Enable password authentication on sentinels too | `true` | +| `auth.password` | Redis(TM) password | `""` | +| `auth.existingSecret` | The name of an existing secret with Redis(TM) credentials | `nil` | +| `auth.existingSecretPasswordKey` | Password key to be retrieved from existing secret | `nil` | +| `auth.usePasswordFiles` | Mount credentials as files instead of using an environment variable | `false` | +| `existingConfigmap` | The name of an existing ConfigMap with your custom configuration for Redis(TM) nodes | `nil` | + + +### Redis(TM) master configuration parameters + +| Name | Description | Value | +| ------------------------------------------- | ------------------------------------------------------------------------------------------------ | --------------- | +| `master.configuration` | Configuration for Redis(TM) master nodes | `nil` | +| `master.disableCommands` | Array with Redis(TM) commands to disable on master nodes | `[]` | +| `master.command` | Override default container command (useful when using custom images) | `[]` | +| `master.args` | Override default container args (useful when using custom images) | `[]` | +| `master.preExecCmds` | Additional commands to run prior to starting Redis(TM) master | `[]` | +| `master.extraFlags` | Array with additional command line flags for Redis(TM) master | `[]` | +| `master.extraEnvVars` | Array with extra environment variables to add to Redis(TM) master nodes | `[]` | +| `master.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for Redis(TM) master nodes | `nil` | +| `master.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for Redis(TM) master nodes | `nil` | +| `master.containerPort` | Container port to open on Redis(TM) master nodes | `6379` | +| `master.livenessProbe.enabled` | Enable livenessProbe on Redis(TM) master nodes | `true` | +| `master.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `master.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | +| `master.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `master.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` | +| `master.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `master.readinessProbe.enabled` | Enable readinessProbe on Redis(TM) master nodes | `true` | +| `master.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `master.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `master.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `master.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` | +| `master.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `master.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `master.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `master.resources.limits` | The resources limits for the Redis(TM) master containers | `{}` | +| `master.resources.requests` | The requested resources for the Redis(TM) master containers | `{}` | +| `master.podSecurityContext.enabled` | Enabled Redis(TM) master pods' Security Context | `true` | +| `master.podSecurityContext.fsGroup` | Set Redis(TM) master pod's Security Context fsGroup | `1001` | +| `master.containerSecurityContext.enabled` | Enabled Redis(TM) master containers' Security Context | `true` | +| `master.containerSecurityContext.runAsUser` | Set Redis(TM) master containers' Security Context runAsUser | `1001` | +| `master.schedulerName` | Alternate scheduler for Redis(TM) master pods | `nil` | +| `master.updateStrategy.type` | Redis(TM) master statefulset strategy type | `RollingUpdate` | +| `master.priorityClassName` | Redis(TM) master pods' priorityClassName | `""` | +| `master.hostAliases` | Redis(TM) master pods host aliases | `[]` | +| `master.podLabels` | Extra labels for Redis(TM) master pods | `{}` | +| `master.podAnnotations` | Annotations for Redis(TM) master pods | `{}` | +| `master.shareProcessNamespace` | Share a single process namespace between all of the containers in Redis(TM) master pods | `false` | +| `master.podAffinityPreset` | Pod affinity preset. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `master.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `master.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `master.nodeAffinityPreset.key` | Node label key to match. Ignored if `master.affinity` is set | `""` | +| `master.nodeAffinityPreset.values` | Node label values to match. Ignored if `master.affinity` is set | `[]` | +| `master.affinity` | Affinity for Redis(TM) master pods assignment | `{}` | +| `master.nodeSelector` | Node labels for Redis(TM) master pods assignment | `{}` | +| `master.tolerations` | Tolerations for Redis(TM) master pods assignment | `[]` | +| `master.spreadConstraints` | Spread Constraints for Redis(TM) master pod assignment | `{}` | +| `master.lifecycleHooks` | for the Redis(TM) master container(s) to automate configuration before or after startup | `{}` | +| `master.extraVolumes` | Optionally specify extra list of additional volumes for the Redis(TM) master pod(s) | `[]` | +| `master.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Redis(TM) master container(s) | `[]` | +| `master.sidecars` | Add additional sidecar containers to the Redis(TM) master pod(s) | `{}` | +| `master.initContainers` | Add additional init containers to the Redis(TM) master pod(s) | `{}` | +| `master.persistence.enabled` | Enable persistence on Redis(TM) master nodes using Persistent Volume Claims | `true` | +| `master.persistence.path` | The path the volume will be mounted at on Redis(TM) master containers | `/data` | +| `master.persistence.subPath` | The subdirectory of the volume to mount on Redis(TM) master containers | `""` | +| `master.persistence.storageClass` | Persistent Volume storage class | `nil` | +| `master.persistence.accessModes` | Persistent Volume access modes | `[]` | +| `master.persistence.size` | Persistent Volume size | `8Gi` | +| `master.persistence.annotations` | Additional custom annotations for the PVC | `{}` | +| `master.persistence.selector` | Additional labels to match for the PVC | `{}` | +| `master.persistence.existingClaim` | Use a existing PVC which must be created manually before bound | `nil` | +| `master.service.type` | Redis(TM) master service type | `ClusterIP` | +| `master.service.port` | Redis(TM) master service port | `6379` | +| `master.service.nodePort` | Node port for Redis(TM) master | `nil` | +| `master.service.externalTrafficPolicy` | Redis(TM) master service external traffic policy | `Cluster` | +| `master.service.clusterIP` | Redis(TM) master service Cluster IP | `nil` | +| `master.service.loadBalancerIP` | Redis(TM) master service Load Balancer IP | `nil` | +| `master.service.loadBalancerSourceRanges` | Redis(TM) master service Load Balancer sources | `[]` | +| `master.service.annotations` | Additional custom annotations for Redis(TM) master service | `{}` | +| `master.terminationGracePeriodSeconds` | Integer setting the termination grace period for the redis-master pods | `30` | + + +### Redis(TM) replicas configuration parameters + +| Name | Description | Value | +| -------------------------------------------- | ------------------------------------------------------------------------------------------------- | --------------- | +| `replica.replicaCount` | Number of Redis(TM) replicas to deploy | `3` | +| `replica.configuration` | Configuration for Redis(TM) replicas nodes | `nil` | +| `replica.disableCommands` | Array with Redis(TM) commands to disable on replicas nodes | `[]` | +| `replica.command` | Override default container command (useful when using custom images) | `[]` | +| `replica.args` | Override default container args (useful when using custom images) | `[]` | +| `replica.preExecCmds` | Additional commands to run prior to starting Redis(TM) replicas | `[]` | +| `replica.extraFlags` | Array with additional command line flags for Redis(TM) replicas | `[]` | +| `replica.extraEnvVars` | Array with extra environment variables to add to Redis(TM) replicas nodes | `[]` | +| `replica.extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars for Redis(TM) replicas nodes | `nil` | +| `replica.extraEnvVarsSecret` | Name of existing Secret containing extra env vars for Redis(TM) replicas nodes | `nil` | +| `replica.containerPort` | Container port to open on Redis(TM) replicas nodes | `6379` | +| `replica.livenessProbe.enabled` | Enable livenessProbe on Redis(TM) replicas nodes | `true` | +| `replica.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `replica.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | +| `replica.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `replica.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` | +| `replica.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `replica.readinessProbe.enabled` | Enable readinessProbe on Redis(TM) replicas nodes | `true` | +| `replica.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `replica.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `replica.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `replica.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` | +| `replica.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `replica.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `replica.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `replica.resources.limits` | The resources limits for the Redis(TM) replicas containers | `{}` | +| `replica.resources.requests` | The requested resources for the Redis(TM) replicas containers | `{}` | +| `replica.podSecurityContext.enabled` | Enabled Redis(TM) replicas pods' Security Context | `true` | +| `replica.podSecurityContext.fsGroup` | Set Redis(TM) replicas pod's Security Context fsGroup | `1001` | +| `replica.containerSecurityContext.enabled` | Enabled Redis(TM) replicas containers' Security Context | `true` | +| `replica.containerSecurityContext.runAsUser` | Set Redis(TM) replicas containers' Security Context runAsUser | `1001` | +| `replica.schedulerName` | Alternate scheduler for Redis(TM) replicas pods | `nil` | +| `replica.updateStrategy.type` | Redis(TM) replicas statefulset strategy type | `RollingUpdate` | +| `replica.priorityClassName` | Redis(TM) replicas pods' priorityClassName | `""` | +| `replica.hostAliases` | Redis(TM) replicas pods host aliases | `[]` | +| `replica.podLabels` | Extra labels for Redis(TM) replicas pods | `{}` | +| `replica.podAnnotations` | Annotations for Redis(TM) replicas pods | `{}` | +| `replica.shareProcessNamespace` | Share a single process namespace between all of the containers in Redis(TM) replicas pods | `false` | +| `replica.podAffinityPreset` | Pod affinity preset. Ignored if `replica.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `replica.podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `replica.affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `replica.nodeAffinityPreset.type` | Node affinity preset type. Ignored if `replica.affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `replica.nodeAffinityPreset.key` | Node label key to match. Ignored if `replica.affinity` is set | `""` | +| `replica.nodeAffinityPreset.values` | Node label values to match. Ignored if `replica.affinity` is set | `[]` | +| `replica.affinity` | Affinity for Redis(TM) replicas pods assignment | `{}` | +| `replica.nodeSelector` | Node labels for Redis(TM) replicas pods assignment | `{}` | +| `replica.tolerations` | Tolerations for Redis(TM) replicas pods assignment | `[]` | +| `replica.spreadConstraints` | Spread Constraints for Redis(TM) replicas pod assignment | `{}` | +| `replica.lifecycleHooks` | for the Redis(TM) replica container(s) to automate configuration before or after startup | `{}` | +| `replica.extraVolumes` | Optionally specify extra list of additional volumes for the Redis(TM) replicas pod(s) | `[]` | +| `replica.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Redis(TM) replicas container(s) | `[]` | +| `replica.sidecars` | Add additional sidecar containers to the Redis(TM) replicas pod(s) | `{}` | +| `replica.initContainers` | Add additional init containers to the Redis(TM) replicas pod(s) | `{}` | +| `replica.persistence.enabled` | Enable persistence on Redis(TM) replicas nodes using Persistent Volume Claims | `true` | +| `replica.persistence.path` | The path the volume will be mounted at on Redis(TM) replicas containers | `/data` | +| `replica.persistence.subPath` | The subdirectory of the volume to mount on Redis(TM) replicas containers | `""` | +| `replica.persistence.storageClass` | Persistent Volume storage class | `nil` | +| `replica.persistence.accessModes` | Persistent Volume access modes | `[]` | +| `replica.persistence.size` | Persistent Volume size | `8Gi` | +| `replica.persistence.annotations` | Additional custom annotations for the PVC | `{}` | +| `replica.persistence.selector` | Additional labels to match for the PVC | `{}` | +| `replica.service.type` | Redis(TM) replicas service type | `ClusterIP` | +| `replica.service.port` | Redis(TM) replicas service port | `6379` | +| `replica.service.nodePort` | Node port for Redis(TM) replicas | `nil` | +| `replica.service.externalTrafficPolicy` | Redis(TM) replicas service external traffic policy | `Cluster` | +| `replica.service.clusterIP` | Redis(TM) replicas service Cluster IP | `nil` | +| `replica.service.loadBalancerIP` | Redis(TM) replicas service Load Balancer IP | `nil` | +| `replica.service.loadBalancerSourceRanges` | Redis(TM) replicas service Load Balancer sources | `[]` | +| `replica.service.annotations` | Additional custom annotations for Redis(TM) replicas service | `{}` | +| `replica.terminationGracePeriodSeconds` | Integer setting the termination grace period for the redis-replicas pods | `30` | + + +### Redis(TM) Sentinel configuration parameters + +| Name | Description | Value | +| --------------------------------------------- | ------------------------------------------------------------------------------------------------ | ------------------------ | +| `sentinel.enabled` | Use Redis(TM) Sentinel on Redis(TM) pods. | `false` | +| `sentinel.image.registry` | Redis(TM) Sentinel image registry | `docker.io` | +| `sentinel.image.repository` | Redis(TM) Sentinel image repository | `bitnami/redis-sentinel` | +| `sentinel.image.tag` | Redis(TM) Sentinel image tag (immutable tags are recommended) | `6.0.9-debian-10-r38` | +| `sentinel.image.pullPolicy` | Redis(TM) Sentinel image pull policy | `IfNotPresent` | +| `sentinel.image.pullSecrets` | Redis(TM) Sentinel image pull secrets | `[]` | +| `sentinel.image.debug` | Enable image debug mode | `false` | +| `sentinel.masterSet` | Master set name | `mymaster` | +| `sentinel.quorum` | Sentinel Quorum | `2` | +| `sentinel.downAfterMilliseconds` | Timeout for detecting a Redis(TM) node is down | `60000` | +| `sentinel.failoverTimeout` | Timeout for performing a election failover | `18000` | +| `sentinel.cleanDelaySeconds` | Delay seconds when cleaning nodes IPs | `5` | +| `sentinel.parallelSyncs` | Number of replicas that can be reconfigured in parallel to use the new master after a failover | `1` | +| `sentinel.staticID` | Enable static Sentinel IDs for each replica | `false` | +| `sentinel.configuration` | Configuration for Redis(TM) Sentinel nodes | `nil` | +| `sentinel.command` | Override default container command (useful when using custom images) | `[]` | +| `sentinel.args` | Override default container args (useful when using custom images) | `[]` | +| `sentinel.preExecCmds` | Additional commands to run prior to starting Redis(TM) Sentinel | `[]` | +| `sentinel.containerPort` | Container port to open on Redis(TM) Sentinel nodes | `26379` | +| `sentinel.livenessProbe.enabled` | Enable livenessProbe on Redis(TM) Sentinel nodes | `true` | +| `sentinel.livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `5` | +| `sentinel.livenessProbe.periodSeconds` | Period seconds for livenessProbe | `5` | +| `sentinel.livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `5` | +| `sentinel.livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `5` | +| `sentinel.livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `sentinel.readinessProbe.enabled` | Enable readinessProbe on Redis(TM) Sentinel nodes | `true` | +| `sentinel.readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `5` | +| `sentinel.readinessProbe.periodSeconds` | Period seconds for readinessProbe | `5` | +| `sentinel.readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `sentinel.readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `5` | +| `sentinel.readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `sentinel.customLivenessProbe` | Custom livenessProbe that overrides the default one | `{}` | +| `sentinel.customReadinessProbe` | Custom readinessProbe that overrides the default one | `{}` | +| `sentinel.resources.limits` | The resources limits for the Redis(TM) Sentinel containers | `{}` | +| `sentinel.resources.requests` | The requested resources for the Redis(TM) Sentinel containers | `{}` | +| `sentinel.containerSecurityContext.enabled` | Enabled Redis(TM) Sentinel containers' Security Context | `true` | +| `sentinel.containerSecurityContext.runAsUser` | Set Redis(TM) Sentinel containers' Security Context runAsUser | `1001` | +| `sentinel.lifecycleHooks` | for the Redis(TM) sentinel container(s) to automate configuration before or after startup | `{}` | +| `sentinel.extraVolumes` | Optionally specify extra list of additional volumes for the Redis(TM) Sentinel | `[]` | +| `sentinel.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for the Redis(TM) Sentinel container(s) | `[]` | +| `sentinel.service.type` | Redis(TM) Sentinel service type | `ClusterIP` | +| `sentinel.service.port` | Redis(TM) service port for Redis(TM) | `6379` | +| `sentinel.service.sentinelPort` | Redis(TM) service port for Sentinel | `26379` | +| `sentinel.service.nodePorts.redis` | Node port for Redis(TM) | `nil` | +| `sentinel.service.nodePorts.sentinel` | Node port for Sentinel | `nil` | +| `sentinel.service.externalTrafficPolicy` | Redis(TM) Sentinel service external traffic policy | `Cluster` | +| `sentinel.service.clusterIP` | Redis(TM) Sentinel service Cluster IP | `nil` | +| `sentinel.service.loadBalancerIP` | Redis(TM) Sentinel service Load Balancer IP | `nil` | +| `sentinel.service.loadBalancerSourceRanges` | Redis(TM) Sentinel service Load Balancer sources | `[]` | +| `sentinel.service.annotations` | Additional custom annotations for Redis(TM) Sentinel service | `{}` | +| `sentinel.terminationGracePeriodSeconds` | Integer setting the termination grace period for the redis-node pods | `30` | + + +### Other Parameters + +| Name | Description | Value | +| --------------------------------------- | ------------------------------------------------------------------- | ------- | +| `networkPolicy.enabled` | Enable creation of NetworkPolicy resources | `false` | +| `networkPolicy.allowExternal` | Don't require client label for connections | `true` | +| `networkPolicy.extraIngress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `networkPolicy.extraEgress` | Add extra ingress rules to the NetworkPolicy | `[]` | +| `networkPolicy.ingressNSMatchLabels` | Labels to match to allow traffic from other namespaces | `{}` | +| `networkPolicy.ingressNSPodMatchLabels` | Pod labels to match to allow traffic from other namespaces | `{}` | +| `podSecurityPolicy.create` | Specifies whether a PodSecurityPolicy should be created | `false` | +| `rbac.create` | Specifies whether RBAC resources should be created | `false` | +| `rbac.rules` | Custom RBAC rules to set | `[]` | +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `serviceAccount.name` | The name of the ServiceAccount to use. | `""` | +| `serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` | +| `pdb.create` | Specifies whether a ServiceAccount should be created | `false` | +| `pdb.minAvailable` | Min number of pods that must still be available after the eviction | `1` | +| `pdb.maxUnavailable` | Max number of pods that can be unavailable after the eviction | `nil` | +| `tls.enabled` | Enable TLS traffic | `false` | +| `tls.authClients` | Require clients to authenticate | `true` | +| `tls.certificatesSecret` | Then name of the existing secret that contains the TLS certificates | `nil` | +| `tls.certFilename` | Certificate filename | `nil` | +| `tls.certKeyFilename` | Certificate Key filename | `nil` | +| `tls.certCAFilename` | CA Certificate filename | `nil` | +| `tls.dhParamsFilename` | File containing DH params (in order to support DH based ciphers) | `nil` | + + +### Metrics Parameters + +| Name | Description | Value | +| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------ | --------------------------------- | +| `metrics.enabled` | Start a sidecar prometheus exporter to expose Redis(TM) metrics | `false` | +| `metrics.image.registry` | Redis(TM) Exporter image registry | `docker.io` | +| `metrics.image.repository` | Redis(TM) Exporter image repository | `bitnami/redis-exporter` | +| `metrics.image.tag` | Redis(TM) Redis(TM) Exporter image tag (immutable tags are recommended) | `1.20.0-debian-10-r16` | +| `metrics.image.pullPolicy` | Redis(TM) Exporter image pull policy | `IfNotPresent` | +| `metrics.image.pullSecrets` | Redis(TM) Exporter image pull secrets | `[]` | +| `metrics.redisTargetHost` | A way to specify an alternative Redis(TM) hostname | `localhost` | +| `metrics.extraArgs` | Extra arguments for Redis(TM) exporter, for example: | `{}` | +| `metrics.containerSecurityContext.enabled` | Enabled Redis(TM) exporter containers' Security Context | `true` | +| `metrics.containerSecurityContext.runAsUser` | Set Redis(TM) exporter containers' Security Context runAsUser | `1001` | +| `metrics.resources.limits` | The resources limits for the Redis(TM) exporter container | `{}` | +| `metrics.resources.requests` | The requested resources for the Redis(TM) exporter container | `{}` | +| `metrics.podLabels` | Extra labels for Redis(TM) exporter pods | `{}` | +| `metrics.podAnnotations` | Annotations for Redis(TM) exporter pods | `{}` | +| `metrics.service.type` | Redis(TM) exporter service type | `ClusterIP` | +| `metrics.service.port` | Redis(TM) exporter service port | `9121` | +| `metrics.service.externalTrafficPolicy` | Redis(TM) exporter service external traffic policy | `Cluster` | +| `metrics.service.loadBalancerIP` | Redis(TM) exporter service Load Balancer IP | `""` | +| `metrics.service.loadBalancerSourceRanges` | Redis(TM) exporter service Load Balancer sources | `[]` | +| `metrics.service.annotations` | Additional custom annotations for Redis(TM) exporter service | `{}` | +| `metrics.sentinel.enabled` | Start a sidecar prometheus exporter to expose Redis(TM) Sentinel metrics | `false` | +| `metrics.sentinel.image.registry` | Redis(TM) Sentinel Exporter image registry | `docker.io` | +| `metrics.sentinel.image.repository` | Redis(TM) Sentinel Exporter image repository | `bitnami/redis-sentinel-exporter` | +| `metrics.sentinel.image.tag` | Redis(TM) Redis(TM) Sentinel Exporter image tag (immutable tags are recommended) | `1.7.1-debian-10-r109` | +| `metrics.sentinel.image.pullPolicy` | Redis(TM) Sentinel Exporter image pull policy | `IfNotPresent` | +| `metrics.sentinel.image.pullSecrets` | Redis(TM) Sentinel Exporter image pull secrets | `[]` | +| `metrics.sentinel.extraArgs` | Extra arguments for Redis(TM) Sentinel exporter, for example: | `{}` | +| `metrics.sentinel.containerSecurityContext.enabled` | Enabled Redis(TM) Sentinel exporter containers' Security Context | `true` | +| `metrics.sentinel.containerSecurityContext.runAsUser` | Set Redis(TM) Sentinel exporter containers' Security Context runAsUser | `1001` | +| `metrics.sentinel.resources.limits` | The resources limits for the Redis(TM) Sentinel exporter container | `{}` | +| `metrics.sentinel.resources.requests` | The requested resources for the Redis(TM) Sentinel exporter container | `{}` | +| `metrics.sentinel.service.type` | Redis(TM) Sentinel exporter service type | `ClusterIP` | +| `metrics.sentinel.service.port` | Redis(TM) Sentinel exporter service port | `9355` | +| `metrics.sentinel.service.externalTrafficPolicy` | Redis(TM) Sentinel exporter service external traffic policy | `Cluster` | +| `metrics.sentinel.service.loadBalancerIP` | Redis(TM) Sentinel exporter service Load Balancer IP | `""` | +| `metrics.sentinel.service.loadBalancerSourceRanges` | Redis(TM) Sentinel exporter service Load Balancer sources | `[]` | +| `metrics.sentinel.service.annotations` | Additional custom annotations for Redis(TM) Sentinel exporter service | `{}` | +| `metrics.serviceMonitor.enabled` | Create ServiceMonitor resource(s) for scraping metrics using PrometheusOperator | `false` | +| `metrics.serviceMonitor.namespace` | The namespace in which the ServiceMonitor will be created | `nil` | +| `metrics.serviceMonitor.interval` | The interval at which metrics should be scraped | `30s` | +| `metrics.serviceMonitor.scrapeTimeout` | The timeout after which the scrape is ended | `nil` | +| `metrics.serviceMonitor.relabellings` | Metrics relabellings to add to the scrape endpoint | `[]` | +| `metrics.serviceMonitor.honorLabels` | Specify honorLabels parameter to add the scrape endpoint | `false` | +| `metrics.serviceMonitor.additionalLabels` | Additional labels that can be used so ServiceMonitor resource(s) can be discovered by Prometheus | `{}` | +| `metrics.prometheusRule.enabled` | Create a custom prometheusRule Resource for scraping metrics using PrometheusOperator | `false` | +| `metrics.prometheusRule.namespace` | The namespace in which the prometheusRule will be created | `nil` | +| `metrics.prometheusRule.additionalLabels` | Additional labels for the prometheusRule | `{}` | +| `metrics.prometheusRule.rules` | Custom Prometheus rules | `[]` | + + +### Init Container Parameters + +| Name | Description | Value | +| ------------------------------------------------------ | ----------------------------------------------------------------------------------------------- | ----------------------- | +| `volumePermissions.enabled` | Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` | `false` | +| `volumePermissions.image.registry` | Bitnami Shell image registry | `docker.io` | +| `volumePermissions.image.repository` | Bitnami Shell image repository | `bitnami/bitnami-shell` | +| `volumePermissions.image.tag` | Bitnami Shell image tag (immutable tags are recommended) | `10` | +| `volumePermissions.image.pullPolicy` | Bitnami Shell image pull policy | `Always` | +| `volumePermissions.image.pullSecrets` | Bitnami Shell image pull secrets | `[]` | +| `volumePermissions.resources.limits` | The resources limits for the init container | `{}` | +| `volumePermissions.resources.requests` | The requested resources for the init container | `{}` | +| `volumePermissions.containerSecurityContext.runAsUser` | Set init container's Security Context runAsUser | `0` | +| `sysctl.enabled` | Enable init container to modify Kernel settings | `false` | +| `sysctl.image.registry` | Bitnami Shell image registry | `docker.io` | +| `sysctl.image.repository` | Bitnami Shell image repository | `bitnami/bitnami-shell` | +| `sysctl.image.tag` | Bitnami Shell image tag (immutable tags are recommended) | `10` | +| `sysctl.image.pullPolicy` | Bitnami Shell image pull policy | `Always` | +| `sysctl.image.pullSecrets` | Bitnami Shell image pull secrets | `[]` | +| `sysctl.command` | Override default init-sysctl container command (useful when using custom images) | `[]` | +| `sysctl.mountHostSys` | Mount the host `/sys` folder to `/host-sys` | `false` | +| `sysctl.resources.limits` | The resources limits for the init container | `{}` | +| `sysctl.resources.requests` | The requested resources for the init container | `{}` | + Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, ```bash $ helm install my-release \ - --set password=secretpassword \ + --set auth.password=secretpassword \ bitnami/redis ``` @@ -323,8 +442,6 @@ $ helm install my-release -f values.yaml bitnami/redis > **Tip**: You can use the default [values.yaml](values.yaml) -> **Note for minikube users**: Current versions of minikube (v0.24.1 at the time of writing) provision `hostPath` persistent volumes that are only writable by root. Using chart defaults cause pod failure for the RedisTM pod as it attempts to write to the `/bitnami` directory. Consider installing RedisTM with `--set persistence.enabled=false`. See minikube issue [1990](https://github.com/kubernetes/minikube/issues/1990) for more information. - ## Configuration and installation details ### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) @@ -339,31 +456,39 @@ To modify the RedisTM version used in this chart you can specify a [v ### Cluster topologies -#### Default: Master-Slave +#### Default: Master-Replicas + +When installing the chart with `architecture=replication`, it will deploy a RedisTM master StatefulSet (only one master node allowed) and a RedisTM replicas StatefulSet. The replicas will be read-replicas of the master. Two services will be exposed: + +- RedisTM Master service: Points to the master, where read-write operations can be performed +- RedisTM Replicas service: Points to the replicas, where only read operations are allowed. -When installing the chart with `cluster.enabled=true`, it will deploy a RedisTM master StatefulSet (only one master node allowed) and a RedisTM slave StatefulSet. The slaves will be read-replicas of the master. Two services will be exposed: +In case the master crashes, the replicas will wait until the master node is respawned again by the Kubernetes Controller Manager. - - RedisTM Master service: Points to the master, where read-write operations can be performed - - RedisTM Slave service: Points to the slaves, where only read operations are allowed. +#### Standalone -In case the master crashes, the slaves will wait until the master node is respawned again by the Kubernetes Controller Manager. +When installing the chart with `architecture=standalone`, it will deploy a standalone RedisTM StatefulSet (only one node allowed) and a RedisTM replicas StatefulSet. A single service will be exposed: -#### Master-Slave with Sentinel +- RedisTM Master service: Points to the master, where read-write operations can be performed -When installing the chart with `cluster.enabled=true` and `sentinel.enabled=true`, it will deploy a RedisTM master StatefulSet (only one master allowed) and a RedisTM slave StatefulSet. In this case, the pods will contain an extra container with RedisTM Sentinel. This container will form a cluster of RedisTM Sentinel nodes, which will promote a new master in case the actual one fails. In addition to this, only one service is exposed: +#### Master-Replicas with Sentinel - - RedisTM service: Exposes port 6379 for RedisTM read-only operations and port 26379 for accessing RedisTM Sentinel. +When installing the chart with `architecture=replication` and `sentinel.enabled=true`, it will deploy a RedisTM master StatefulSet (only one master allowed) and a RedisTM replicas StatefulSet. In this case, the pods will contain an extra container with RedisTM Sentinel. This container will form a cluster of RedisTM Sentinel nodes, which will promote a new master in case the actual one fails. In addition to this, only one service is exposed: -For read-only operations, access the service using port 6379. For write operations, it's necessary to access the RedisTM Sentinel cluster and query the current master using the command below (using redis-cli or similar: +- RedisTM service: Exposes port 6379 for RedisTM read-only operations and port 26379 for accessing RedisTM Sentinel. + +For read-only operations, access the service using port 6379. For write operations, it's necessary to access the RedisTM Sentinel cluster and query the current master using the command below (using redis-cli or similar): ``` -SENTINEL get-master-addr-by-name +SENTINEL get-master-addr-by-name ``` + This command will return the address of the current master, which can be accessed from inside the cluster. In case the current master crashes, the Sentinel containers will elect a new master node. ### Using password file + To use a password file for RedisTM you need to create a secret containing the password. > *NOTE*: It is important that the file with the password must be called `redis-password` @@ -371,9 +496,9 @@ To use a password file for RedisTM you need to create a secret contai And then deploy the Helm Chart using the secret name as parameter: ```console -usePassword=true -usePasswordFile=true -existingSecret=redis-password-file +auth.enabled=true +auth.usePasswordFiles=true +auth.existingSecret=redis-password-file sentinels.enabled=true metrics.enabled=true ``` @@ -390,7 +515,7 @@ TLS support can be enabled in the chart by specifying the `tls.` parameters whil For example: -First, create the secret with the cetificates files: +First, create the secret with the certificates files: ```console kubectl create secret generic certificates-tls-secret --from-file=./cert.pem --from-file=./cert.key --from-file=./ca.pem @@ -422,8 +547,7 @@ tls-ca-cert-file ### Host Kernel Settings -RedisTM may require some changes in the kernel of the host machine to work as expected, in particular increasing the `somaxconn` value and disabling transparent huge pages. -To do so, you can set up a privileged initContainer with the `sysctlImage` config values, for example: +RedisTM may require some changes in the kernel of the host machine to work as expected, in particular increasing the `somaxconn` value and disabling transparent huge pages. To do so, you can set up a privileged initContainer with the `sysctlImage` config values, for example: ``` sysctlImage: @@ -459,7 +583,7 @@ By default, the chart mounts a [Persistent Volume](http://kubernetes.io/docs/use 3. Install the chart ```bash -$ helm install my-release --set persistence.existingClaim=PVC_NAME bitnami/redis +$ helm install my-release --set master.persistence.existingClaim=PVC_NAME bitnami/redis ``` ## Backup and restore @@ -486,9 +610,7 @@ $ kubectl cp my-redis-master-0:/data/dump.rdb dump.rdb -c redis ### Restore -To restore in a new cluster, you will need to change a parameter in the redis.conf file and then upload the `dump.rdb` to the volume. - -Follow the following steps: +To restore in a new cluster, you will need to change a parameter in the redis.conf file and then upload the `dump.rdb` to the volume. Follow the following steps: - First you will need to set in the `values.yaml` the parameter `appendonly` to `no`, if it is already `no` you can skip this step. @@ -505,7 +627,7 @@ configmap: |- For example, : ```bash -helm install new-redis -f values.yaml . --set cluster.enabled=true --set cluster.slaveCount=3 +helm install new-redis -f values.yaml . --set architecture=replication --set replica.replicaCount=3 ``` - Now that the PVC were created, stop it and copy the `dump.rdp` on the persisted data by using a helping pod. @@ -551,23 +673,18 @@ $ kubectl delete pod volpod - Start again the cluster: ``` -helm install new-redis -f values.yaml . --set cluster.enabled=true --set cluster.slaveCount=3 +helm install new-redis -f values.yaml . --set architecture=replication --set replica.replicaCount=3 ``` ## NetworkPolicy -To enable network policy for RedisTM, install -[a networking plugin that implements the Kubernetes NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), -and set `networkPolicy.enabled` to `true`. +To enable network policy for RedisTM, install [a networking plugin that implements the Kubernetes NetworkPolicy spec](https://kubernetes.io/docs/tasks/administer-cluster/declare-network-policy#before-you-begin), and set `networkPolicy.enabled` to `true`. -For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting -the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace: +For Kubernetes v1.5 & v1.6, you must also turn on NetworkPolicy by setting the DefaultDeny namespace annotation. Note: this will enforce policy for _all_ pods in the namespace: kubectl annotate namespace default "net.beta.kubernetes.io/network-policy={\"ingress\":{\"isolation\":\"DefaultDeny\"}}" -With NetworkPolicy enabled, only pods with the generated client label will be -able to connect to RedisTM. This label will be displayed in the output -after a successful install. +With NetworkPolicy enabled, only pods with the generated client label will be able to connect to RedisTM. This label will be displayed in the output after a successful install. With `networkPolicy.ingressNSMatchLabels` pods from other namespaces can connect to redis. Set `networkPolicy.ingressNSPodMatchLabels` to match pod labels in matched namespace. For example, for a namespace labeled `redis=external` and pods in that namespace labeled `redis-client=true` the fields should be set: @@ -580,15 +697,89 @@ networkPolicy: redis-client: true ``` +### Setting Pod's affinity + +This chart allows you to set your custom affinity using the `XXX.affinity` parameter(s). Find more infomation about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). + +As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/master/bitnami/common#affinities) chart. To do so, set the `XXX.podAffinityPreset`, `XXX.podAntiAffinityPreset`, or `XXX.nodeAffinityPreset` parameters. + ## Troubleshooting Find more information about how to deal with common errors related to Bitnami’s Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). -## Upgrading an existing Release to a new major version +## Upgrading A major chart version change (like v1.2.3 -> v2.0.0) indicates that there is an incompatible breaking change needing manual actions. +### To 14.0.0 + +- Several parameters were renamed or disappeared in favor of new ones on this major version: + - The term *slave* has been replaced by the term *replica*. Therefore, parameters prefixed with `slave` are now prefixed with `replicas`. + - Credentials parameter are reorganized under the `auth` parameter. + - `cluster.enabled` parameter is deprecated in favor of `architecture` parameter that accepts two values: `standalone` and `replication`. + - `securityContext.*` is deprecated in favor of `XXX.podSecurityContext` and `XXX.containerSecurityContext`. + - `sentinel.metrics.*` parameters are deprecated in favor of `metrics.sentinel.*` ones. +- New parameters to add custom command, environment variables, sidecars, init containers, etc. were added. +- Chart labels were adapted to follow the [Helm charts standard labels](https://helm.sh/docs/chart_best_practices/labels/#standard-labels). +- values.yaml metadata was adapted to follow the format supported by [readmenator](https://github.com/bitnami-labs/readmenator). + +Consequences: + +Backwards compatibility is not guaranteed. To upgrade to `14.0.0`, install a new release of the RedisTM chart, and migrate the data from your previous release. You have 2 alternatives to do so: + +- Create a backup of the database, and restore it on the new release as explained in the [Backup and restore](#backup-and-restore) section. +- Reuse the PVC used to hold the master data on your previous release. To do so, use the `master.persistence.existingClaim` parameter. The following example assumes that the release name is `redis`: + +```bash +$ helm install redis bitnami/redis --set auth.password=[PASSWORD] --set master.persistence.existingClaim=[EXISTING_PVC] +``` + +| Note: you need to substitute the placeholder _[EXISTING_PVC]_ with the name of the PVC used on your previous release, and _[PASSWORD]_ with the password used in your previous release. + +### To 13.0.0 + +This major version updates the RedisTM docker image version used from `6.0` to `6.2`, the new stable version. There are no major changes in the chart and there shouldn't be any breaking changes in it as `6.2` is basically a stricter superset of `6.0`. For more information, please refer to [RedisTM 6.2 release notes](https://raw.githubusercontent.com/redis/redis/6.2/00-RELEASENOTES). + +### To 12.3.0 + +This version also introduces `bitnami/common`, a [library chart](https://helm.sh/docs/topics/library_charts/#helm) as a dependency. More documentation about this new utility could be found [here](https://github.com/bitnami/charts/tree/master/bitnami/common#bitnami-common-library-chart). Please, make sure that you have updated the chart dependencies before executing any upgrade. + +### To 12.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +**What changes were introduced in this major version?** + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts + +**Considerations when upgrading to this version** + +- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 + +**Useful links** + +- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ +- https://helm.sh/docs/topics/v2_v3_migration/ +- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ + +### To 11.0.0 + +When deployed with sentinel enabled, only a group of nodes is deployed and the master/slave role is handled in the group. To avoid breaking the compatibility, the settings for this nodes are given through the `slave.xxxx` parameters in `values.yaml` + +### To 9.0.0 + +The metrics exporter has been changed from a separate deployment to a sidecar container, due to the latest changes in the RedisTM exporter code. Check the [official page](https://github.com/oliver006/redis_exporter/) for more information. The metrics container image was changed from oliver006/redis_exporter to bitnami/redis-exporter (Bitnami's maintained package of oliver006/redis_exporter). + +### To 7.0.0 + +In order to improve the performance in case of slave failure, we added persistence to the read-only slaves. That means that we moved from Deployment to StatefulSets. This should not affect upgrades from previous versions of the chart, as the deployments did not contain any persistence at all. + +This version also allows enabling RedisTM Sentinel containers inside of the RedisTM Pods (feature disabled by default). In case the master crashes, a new RedisTM node will be elected as master. In order to query the current master (no redis master service is exposed), you need to query first the Sentinel cluster. Find more information [in this section](#master-slave-with-sentinel). + ### To 11.0.0 When using sentinel, a new statefulset called `-node` was introduced. This will break upgrading from a previous version where the statefulsets are called master and slave. Hence the PVC will not match the new naming and won't be reused. If you want to keep your data, you will need to perform a backup and then a restore the data in this new version. @@ -670,40 +861,3 @@ And edit the RedisTM slave (and metrics if enabled) deployment: kubectl patch deployments my-release-redis-slave --type=json -p='[{"op": "remove", "path": "/spec/selector/matchLabels/chart"}]' kubectl patch deployments my-release-redis-metrics --type=json -p='[{"op": "remove", "path": "/spec/selector/matchLabels/chart"}]' ``` - -## Upgrading - -### To 12.0.0 - -[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. - -**What changes were introduced in this major version?** - -- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. -- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts - -**Considerations when upgrading to this version** - -- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues -- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore -- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 - -**Useful links** - -- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ -- https://helm.sh/docs/topics/v2_v3_migration/ -- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ - -### To 11.0.0 - -When deployed with sentinel enabled, only a group of nodes is deployed and the master/slave role is handled in the group. To avoid breaking the compatibility, the settings for this nodes are given through the `slave.xxxx` parameters in `values.yaml` - -### To 9.0.0 - -The metrics exporter has been changed from a separate deployment to a sidecar container, due to the latest changes in the RedisTM exporter code. Check the [official page](https://github.com/oliver006/redis_exporter/) for more information. The metrics container image was changed from oliver006/redis_exporter to bitnami/redis-exporter (Bitnami's maintained package of oliver006/redis_exporter). - -### To 7.0.0 - -In order to improve the performance in case of slave failure, we added persistence to the read-only slaves. That means that we moved from Deployment to StatefulSets. This should not affect upgrades from previous versions of the chart, as the deployments did not contain any persistence at all. - -This version also allows enabling RedisTM Sentinel containers inside of the RedisTM Pods (feature disabled by default). In case the master crashes, a new RedisTM node will be elected as master. In order to query the current master (no redis master service is exposed), you need to query first the Sentinel cluster. Find more information [in this section](#master-slave-with-sentinel). diff --git a/chart/deps/redis/charts/common-1.4.1.tgz b/chart/deps/redis/charts/common-1.4.1.tgz deleted file mode 100644 index 110cf10636c084a920c9cbd8c77c9a3bb0368cad..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 12484 zcmV;#Fgwp5iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMZ{d)qjYDB3^suc%9>Z|qD&OLiW!-pSrgoXm{B?oNE|bn>0; z?$d@yNJ5(e*Z?R;llc7Y=fjHxUwYWGtDOAdgs282T{r-l7vxl5CFtT;xXg%13021j)dfSEOU+nl#vgZ3&Q9D%=QA5WyPO^ z=t(pP5-eg)GO1s^gdfR}BR+?J;&cj{yI{mPj5*6QLdRhE4pKHIF$}T1z?j02NQ$Ne zVpU#50l@nS5#~=I0w|M^;4EcxG)yrJ=Rl;u=_m>&Y>E$HB4s8Hc6Y}_PV!+Cv+1q{ zxobe~N{;dF6bXrW`AMS^kXT{vK-iBOM#3&=%1|P9Q#NM8ed|pTKaVmx4$krXg7HKg z1U=iapa&D2W|#*(ka(J`q?&W`am;?Y6 zsgAy~mCawaNx^a+V+~~~A#9n0-QA0ei^%V6AmaGWSPdw8^a_!=Z*sQ^S1 z$T*9!5LiS3{)DDkia#h0a;`Sb20n33rL2rOYlQmoeh7gI%+c!Ce$(eCAC5U66o36?phfIzU3 z1j-Wp((uY05^R`;Q3yVN214UBPcVdry&{jNR5cMP2qA1IB$g1K<9P_--`~9pAv6n7 z2-_(U62ez6PeS$Ye}y|c(7U`0G&-L@_e_gRTToRpjz^etoV?CCq2tqdf|EQYbbK_X zta$zA6OMDOy#@e1FqJTkvHDv*QzYZbn@<_XLO6BVJUuwa^8@(&8KQGMhs(?23joV7 zN0M=+Pp(R%Do`!G7tmgdyo@D|{=4com1O<# z$XHU7e=(b8jAAN_u~6n8{v<53xq3Tiwx9d_UgP(l-h@StCvJeJKUldz4anVfsw z-l-Rbj1wwH5TY!L&hsJW6iX~3!gh;F2k^ZJecCme^Q5gY$VG-?ToEQ}l3V1X6P#is zaP-!dgfH-C&Ll2@NS3jbjpsio8C1ny>^z| z97F!qXONY-@%p@2g6GDY&UXOoK<{?;x**W^J|mNG?>c?scQXZbXUX_3`Pu8H{^;r*Pq-6WGNY_zwb*c%FJlB&-kuMiGF##G@c>^L~KidCG z6ug8BGzZBbp5XYrqx1zbAsK{9&XPRF3FK6gv?#D2?MHpMAaYXEdK4H-p~rABA@RgT zJP1G(P?BhC5v34*zPtpL(Gn~N11RMU1kwhsQKNK(}luUElHX4r}t*CzFS;n{&9{d> z#gPVC_zv~AAGFIbLvj*H7CEf?{SZQdV~%C<<1L!v5W*3`X`-u`qP>1UESK*FhJ%~J zaIgl3g95__Dt0EDLBa)i(Zs~>R^eA|8IdLlcB(r7O5ZqfaYL>_$Phk9V3pZbcMPV$7LifeYJH`3B@dbFhcdNMw1G@CmPYDrGCSeeXRJ zrUx$|{FNTRJU#vR?&S3;yg4~}cX9x8mYeyQaW*3fRxdcjIoDJu=dU-(vDR3)Y5M!Z zcW&CWTN#z6n;rN9BSg}h^=IEd>pji&pG?tsbFp9Ft+4(-9n}5*Po6z}dcXeP#C^q(h;$*^$Qx%E#@uqh3p@!q>7rAr!DTPW6P zj>kkuK38j|l7LasX5>Ekg)=6IWF5ub$FhP%<60^8#xs|Ezh(PIhTWSm5FAEsYq!~j z7acV^cOAUnWK;v@dlW_xelK>v7YBNmxl*i77v1e{--L$bz$~b^idV-n*J~D^V-81} zA&NeqYHbMgF7^VZ%knfeMMaJE3iYOw`v#A@zwPamyjk68T7^+7Sb3^~_g=A2Q^G94eM5V_JoZerB{ixsC&o1akZso{kIz^n^ORmuK&*)@!$RDgZuUWHlB6% z|Nnt0=15`~qWD}fKBh_}YwMl}h}kqlk_=O9T)rqx{Q!ZN$4AbyDSXqvDZ(uS+ExlX zRbW0NF}9Yl{c8WR-;NoV13CD9l}C?O|YCp-HI3W85%xUn|1-cJBKLEY%>^89}Nzl~=N``=s3g+w$#JTbA=qH~s7UUJ3F zjA+I?7c#CsEpLKQ}_m8*VabbI+JqG*hh-f&*6 zacXsfRxxQ}#?@+`3k;0f(7Q-vIF5u3NB6_awcA(B;%bRyw5`OaUzfb=lIji$wEJhR zrz!spQ*2QDFSY;rPoC7}|I@*}|Mym&HRS)BPnnWXO5LN@K+-`hI(1N|nDS*zuMrBZ z>uPD@ylJZByBX%3BpAMc0m#CXHY*`2Fg3@$)_P!TkwIk-YGeo`s$61PE4B=lw2!9W+-YHZNZj`6#9RAEv zN=5`HfU-$j(> zthR(R9PdQI(a7xv8X!dgmq&Y28n~M7Iz&q$Z?RoWb5*d)I9@2Q`&jTwJrKB2U?sZy zy8HubcLY}ER}asE90p2t=`3)qyj>f?Iu}-;nReG38HbFop|f8;`1=W#*&9bILJ;`0l{lhOfCQX=P( z#^5i6j@b1Q<88VAo0c_I8w27;ag~%bd8Bmz8BOPES-ik7K{M5j8RjUh(^RN6%Ri%b z)Bfx#k2Y5RhNG~qnN+>jg_6=jpbF?0^|jk-3C((IYKuJ^ZeQp7QZdmRrVYEtx^ zsjsFuoTGL%p{X-<7WEM=Dd4)_uKm{K&N-g1BzE+P@oPvObK?9Q>o|t+UbNhfXgSC8 z_K?uGp3SKWIfp_8ZcZ|f+>E=KzpKV1DFXOGgnsSViImFsNO;(zf zWyq}Ys(RbIm4N4-k*~E`2%(KwO+Hj}K-6QX2Q6{cd*Kd*DW+pN31QIJW60DP>J1$T zHNVet4Dzv&-a*?}qY$Q>OSb7XN8XqV%O#GP^6b>W!sOnlXVM5Gp-+sc<%5Y){9QHxuB9CTv;|&VVt)2|aklSc(y?g8DeYa)P<) zBT5nw^XZTo|NIJ|3wCHzbZX;a{2y90>-cGbNK)o7Hp-3jg@}A;{b$Q!)Skb3u2 zD}=#=g5?fgKo~lK@xb9zdtG+Fo}H)o;EFoHcI3SBgFZxdq>I9qM~`i#AB}Q`7Aw)HH_a<$rqIET^>nv^#pPoGEeTbdv`Qa`xDE8|WzO zh0K0|;j<^0#(qws&tCovFA~zx#wu`_qG5^?KZv1Z;uk*Wb_EeWa5<%py(v*Yqtiah zZppHvQXJ3G}dp@&fmWB7rfbyW1hi7TBlYWAwv9Ged2=urd0{|w=aS{{Vt@N`w+rH-ey zJWGkPL}ki}Nj@5-xOMWiC&_7aToLMRK5d}40AzcFQAIh;e3tDB71xK8^n#8c<9J3` zF1%IT&Pb=BYIRzyqMw?Q%e2z3rV?&gMR2|C-PYoCe}MdMJuUu!$v7J0+l&7m44&2Z z|L^_(xAm-l{>wk3b82`64pSsrkK;IIidBK~Bu<98AVOjq<91)1S76n{V6~=7Q^$VL zIBKVl2Ry2LY&p4A_vYC1HjQe2R?cdRFBVr?=pxk;v{}oAx8gsw8@N(rr{-32E303| z1U>&6{u=tnko?ttSzV)Ev}4xUn|l#|_nxNwmsx5picPHmOXPq5S-*b&*V8Ba_xFF@ z%CnaIrwQf)kaY^`b3a9xi{qeZfsS3W7T2)K1wp@VUkZ$~pssOutpd#^Y7)HRzn_(k zi&FB*EOlQBJG~=&s9$B<)=_rW|3cGrr@i(aIzHH(|HkKai}9aN`i=Sj(lR+0EW4&t8t8_o%f54ZI|@MzSVVl?&XSdp`&3h zw-0xF{_QyH_TIBMboK#pmzEoU${3gM`Ev>2^76%l?elzyW0`8=ICns=$k4uWUUqv_ z%UaOTWAKMyR0+oy;b-lsjZ_J9-sW0v5Z76;0!oTLe0I)fSF zCQ#FCG9wcSx^(<%v@nC`24p(#7283}N2CVIb5iOrIuIgDiS|ec^+RU{Qd+O=wpT;D z@D7o{e{WRPp1{Tt_IewYG&)_-%2VrICAPsh6C>E^I=f!_6+5AH?9R$^0UmKSbxWoh z!KEX&a4VzOFg1UzHM1IkOOKN3josMsMlcG?-FG_!?Iuj)u$|2r|7p_{HtE_OA&eZsoyK$z9h6oG%re7N2+v}a4N!gAf)cD3F6b37kZ`B3lKugi&*_UbVow)?96@*Br9%mw~Iy*zjU_D@@? z%4L4h`XFCz3o&Zl7TT%o=y~i=3mAzyHtM>(>vqz?-OxYppRfBg_5TaRDWT&HngC1v zzx{^)ckllG$J=?<(EmRg#sD;AxwHvCIZIRZzeM9jYJb5~w)}fEUXcFlgfY2D&bLDI zeWr*euw8g2LKk!xf|t;1$EFUdXYcxAc4+@jXaZr6|N3k4mj_?O1noV2b`YAZLLXnA zyghpRj{`UkpZKaZXiNh{057Zk~=JImqF<51TDiz=fJV* zCZ>rwg@tB}Bu#4DywjOZey#IkVmc$7Q4=<;gENcR%!I|Fa>;jjz4-2gUGyZ|&9!ew zBAWDUD?Qap&np>tzKi?CJoI&sykvi!D<^upk@9Dk|`7Xx>VIOxYTQWcahd{Fvhr`Lq(4b3Bhsr5Yp` z$>+!Tl~z$1zg%mxnrl$2722IpkNMZxr(Azc@}KHKfJQ)_sC%W>2}W%6rZW<;g*U@x zh?Nem=C}5+!p62#{)%BfM4tjk&_ zvnJz-biOpkYX^E3%C4m|p|~%#TN-@@sjw97isvjUQS>j^t3}|JFwNAdAE9yX>{_6~ zB9JQs+SI_?nOk;cy|H(~t9{T{9}EX)g;DT*fZZeFI<|oJ6=$LnZXFTUZLaL=(%qe2 zG2^`!&3#Gl6of(*u<6(C{Ot2Pv1H8av#f16t6x@&tz4}CPZ1|58D7&Bv_$`Z{EZ`afMT^l!}^S6+6EsfvRx8P7N zCs$VbYp~i?e#GMmkyzjLwhBUC@j9ejPP$Ep8XP5wRfP_-;e;{SVLEW{Q&?%W1&)%> zF3iA#k=xfx>n}H77S}()SxREfB3<2SmS{r#Iwnzl5IW7GO2KZ^$g)6Bjo^l@qY4Jq z-e@F!KDf%6!v;UKSxD8mH$P8)1&5tx{PL!aP)F$|kvD3F*2Ag&?wkD3zHkXWRu2~t zp<~W;b6-pO6_~KBbpvE-!)Y&&r=&US;w`wdRFN*As(&-@i>or%>^Z^MomHGkI_ z*;0%CCP%eIf60jYQnGEt{P%bKi0cyn52Ist!~UN^f4{l^yMKTF^LCyq`F|8wyneNP zva@*?kY%{L;{q!C+U*50NMF+rR5o-&uAnAq*K-Bg`WtZtRbh3wf)+b)svtTXI7{70 zwN7=rlkS=;=rxjPh(x`9Vqf2uE9n%w*#4#y$$VQ1>18e_Z%SVA;1qn(;egVw-*mIt zI<6ESizR02`hG9teehejlMXQ}$NmR6#7qT$4qd0!0?u+boV(iF>v9d3oA<`mma9AE zjT2a|;EXG!&N4TgEx7{IoANz@Wv|E;x4TV)&IBGA3V9w|8pzP zRs4U)hAU40{~tH*|MM8`&bRIp22 z+oHU03onPNGza%qlpeYzZFoTw3w%uNt+j?xMPD&^s-1M*ZiHs>ZWFqN`8RaPq=`kf zca}unNUgi;YE=tiVRS@h>(Q+v4t(fV+6YA)bg@aI_8P#LR9 zTiYr%OVUo(ZmdG>E#816@s-u9iIS?i`weq(YkxK;-F!l?De3A^mw?)^yz^Vjt}gOg zjn{9OT{`=;gk?HdBCAbvpC1;LyOR#-#r|K86LS4Ta7)hrKHYn=UyuLnKe^BUb1P49 z6$kK%VvFtfKW#q#(=gnfas6s^y1l;o^Yt9QriGjF^)`sPmYdhqzNUw_3S_Z!w=>kU z0^}UeMU?5XT@jk9czbxGPJmi#FsysYn!tV*cnx@YSvvd*9^br*>~-SW8lCTUwiR7e z{qRw+YC_e+;{`|6#%e)4mtV5m6oei%Y#O1gCE%`Y$=5S-4u7y%!V=Ji_ zcGt#qkM0G!dzeiff6VT#k@VmAS#1CLYuDASz-9SgpY8YS@jrV{p5NPlxA9!X{Im9u zDx)pEA#NIbMupbpwV*v@bky(bdu8h?UUA)neie2Zd&OS2Rf&52zEzPsS{rP(wL#I^ zDk@%=W@j$EXr)bC7n+w})P?~vPwu;3wp+RHC-y=U$=sr(v8H1SicoK{isopVR`Ohx zXTv%S>T-qYG^pF#^)7DST|L2;z5i!f`=*%fn?)u;616wcy)C|i9$&6@=B|*aaF0}s zq;>CdZ}4zb40QJu^rqVjE>T~s=@eY%E*n}n+n4vLvoB#iMcL9RS-D`!SB$)$_mk#! zCrwT3Y(THwd|njQ7a(~3^E`>FhnZGJN8R_BFP%Gem(EqM=qYDh*AYM6M$xf@7a%dG z%2WtL*!B*!hNT|7<1%u2ZXB<$FYvU<)W7n;_b4<07!ZitzvJ zMDUKLb6`~0R474)Ii!T*D2QI4{(h!&68I7eO>8a##Or&<~>Fzxb~H z*S(mGchx`cPcfsrC7>aS&+|;%J|cJ&iHj_F6b;dN@F!034)8r=FSUmrq4xT-)=l|L3 z@88e=TY0wNmAMzn&4wSzkSnd_P%UIZ@DhIcCr+o;*S~GMo2AsU5s8VuVQN>hjKpF$ zHAR2dOQG1^Qe}3uD|F0Ro+*)HxDHY_CNT`LyueD}SVT;{Cc&d$!1 zW*sCr!!*G(CfI84YHdBR@bo%A!(0$X51=1?iaxoZ40{>ZL2)IPZN$G6%l=l4=@y4b zOo9iX(1)VoIpmqrQ;Sj>FO-oFuHD%nI43kY0A<0G@lPlVrdT4SJu8$A!Yw9~z8*Ll zoxR{W50x_aW1=5~i9S1+dDa(N33p*b63Np(q9c3 zCP=_g@tDLy*%;bypD7T(I5ZVDoMMRu9G91>o#a%KDXyZJah61c?e4(#s~?U}b|QGK zu>|#3aVK^z*;E@e?|(dn7;{NRBt{a8$BOUA`X)W9kIgIARDY`e&RNa@WknQ`od?Gp zYhQvO5{n?{`RER!!QNkjp6Ty?G>H19in4LBqKD!L3?r7N?800hH%!fau0m_GjuX%f zkyL-PhM%3umPK^@L(DR)4a0>q$Tkvu;B9us?@cg2XQmZ&gFjWM=9Q@}C zyv8EtL|cil^794We9Fvidq*_OkFLu!MA^Z_b#+CVDa*q6`g5 zy5e+d48)aY*XmE(JX}82t~-U+ecBrE2Rim>94Yy3m-4e}SM9hfxhN4=BHok1R_lOm zvr5J(QIgS}Ng<=+vQrN}5TQK}0?VC9aY%G#7Bg^HKzCwUu8L8qdYsj;L|MjJ#)Q4l$`7Fw_F-Hk5 zgM-a}iIUAn5-v!Z0;VF@A<(T6-eWSu)Hn(+uzq7eYO}^zT@f6O;H=!CF)V)OmOZoc zL2PSs!r28N3K~Ie8R_>z*=c$j8jJyHV{g-_jfb%R9w&^9ydH zhtQpFd~o&{1jg{ok*oIG_LeTg8IwCjw4abX*XgJtXz4(fr>P0?6lbj+c+KK-%nc91 z2_6$6`5bIi=vy?!qSk?eQ{G^{o9_X@?vcC1>G`*wBJ>d(&fM&%$}O zq1p1ytYPI-VScM64^e!Msdg^>!-g*aa-46u3~V95RB^uXy{d(UnR)W^_^8muikToV zpOF~5SP{m;;@vURF(E_5Lpy^NlwVwH3C=jSsa+_OB(AypjENT!wmVGOcz3Tq__y8u z^WDK;cTq-qUTx7Mv^VGtp6zE0NZ2k_T^Cq1Zr2io)sZtpw`k<9B^Q>Bo!OI6 z|DKh|sRdRMlX?L?Mc8;QFr2w%M3s0q!<>@@pDi7|>IR4^f5@?s56+RIKF;CK9Holh zi83WM8cmyVwZ=5smLpAB-Ki|iOP9_{W7f$mcBNlD&9Av~euFFKn$Kd9|n7LScvfg5K;TQttv8K=-rY$Z}p^N~I>5>DsEPv11tn)jPZ z{ol5?96({uQMTydo8Z0%`OfkD4C>^wk#y&HzIvrp}HUCi0s-P zgw1z*;SPi;reiq?VbF(ANY3cEJbbR?zip=SyJX_WVCp{xQ&$_SrtHh9jk-1d6;_1h zwsD^xQE^uBS-PBcN}I+r9j#OZ2s_d`@|pS(EG1w2=G3?JxOG@Ej>dR%Thd==(cRoe z_SaeUHn;s0xiCrt_dKBlS*BQUfBvCk9jZ}B?SvG#P zlk~#wZ0OSvK09@V_UI9ESA|vcI9`2No7$Phvscc#1<8%h%DH0?rHf($8TXmCm4?^^ z?J0b;JB~=ZaV&sQdysz4azlVzV0VeXwVK?fmLby($)hFX*LFA0+1lgh-OjX;A#9GH zciYI<9YQa0@U4vElJTqM+bs46)*C;a>+WwN&;H~6Pk-B0|6gw$o8xCvB!1nYGr7lZ zaqg`!elZdP(S)PQ7_K{hhYreyBxrN|3Ov8^7#4Wk);KO(|LjeY*IfV19j5;;$K!v$ z$wkoKJN=axL4(EZE`r*u|A;sxbiCZAU%`IAmWjR8C|$t-yj~EF$JG~>DiLRCO6d4K z8Y>OJ5)06f<@0Q0m$GL8`&l7Mx}{CMX4>DJbFzo+9CeLn~0_iDz!3 zrVauCInVHc0!ZjM07%N=I&h&@uDF-c$OP9C0V#`-#7O{vKcQ)s;sZ!@t%$H7@D6V; zY3igXsTsKp|Mel;L*Bb|Oz5W|kZ8ONtbrrZ*atI+2G62FFTq2CXm8N(@n`!%kmYH5 z%u*6B#Z?n~GzVnB9~TvioSWJ?`tW6Xf#%{NkWq<;qS-^8tWiFEY_ewxEOqgt(OV{u zITo18hXx-TfK(!cI7jmUfJkgoU@gYfWpGO8ARN-v00A~C(YNhHL6G2K?ooAUGLSYX zU{H1^ZM0OAJbq{nbHax511!pGn@^H%3G2t#{F zJRw5iDIl3Eg2pBTfgnuDuL{OtFAM?{$5@D;Sb~?K`%;&LDND*bPdf3gG<1Sd@{tpX z-{}DmCMF+xll5{v(veSevaoqp)4a*i;W5_ z`@TpLVqn_E{v6NE4p>`As`^N17ZL`4vtP52*d|{`f$A3c$Zi1?%A+de(zXA9=LIPh zEp>+#V!4u3AML3rowW}Hrh@2%NqR17Mbb}uL1?i*_80`4VvuBtg#vJasGgK#Ra-Iz zotv%Tj0r*XfycRNR%;3qOt`31Ly2rRx?4~t0=Bf$?|Z#odyW%Jm8&N>0UPdZ79x~o zt5-Ec_%1_#=D0|dQjW&w&)yci)$hN+@Yxeg<085G@$! zg)N?Y*$-E3(Ct}TFS%}2(J$EYQ)6nf)@D?7@-LfBQ1RQ^3HJ8g`!}bN{AA=*%&1@~ zzD^S2e*bpU5cdaHNJPA1CgP=+OHGU0zrnvLG@Pd3<;oDglQCe)a@#K0%SU^9dm+yEg4?Syd2vVL|4m2E5^ zgF)1f`a$r^I|^^v3{Quc!(jh0?DhBhkL}t2J(uj{OMNeMVc8j{%>~Jnh+sTpMSOpmxM_ru%(()UBqpho>FU1Gr!*8bE3E>oqe6F!!1;O~x%? zG@b86@XJ3j$BR?rxs-T{1yDw8r%Wu;j<$hgL={gZFlCxbrR8gUKZ?3%eu@nf^cD2r zXGI006WP37XAPWY`%wk05&Cm?%a-nGZq!(`?pE=$mkZpB zk-%cd&Jz2Hj?Lh?K1c?$eZ?$43p~nGNC`a`h8JARs>MoHNSRB<2};E-$AYCZ+*8Qy z>3{co856QsB4WmQ*Mql8Pg;uWlg6e5?x{ZL_Ik6uo@Dmt{pO{NDfo O0RR6Us#Y@qLID6$ubF88 diff --git a/chart/deps/redis/charts/common-1.5.2.tgz b/chart/deps/redis/charts/common-1.5.2.tgz new file mode 100644 index 0000000000000000000000000000000000000000..585f9b72ca009909d94e198722f546ebccc6ad7f GIT binary patch literal 12953 zcmV;KGG@&miwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYMd)qjYC_JC_E9#}wZ|qD&OLi`^-pQU#Cz+W%-JSS2>GZSP z-KPzaB?)bcU<05WP2%(0&x0EY-gL2L$JsGIBr*vU3WY+Us!%9IY&K)*{);K$GF*^Z z@~7=TgTY|%%bga|gnH)G%Upo+gaMVn1OMCfv9FjPSECODDZET%0o= zi=$rOcC6QjDJB{6ULPdRvV=(N^RuQ{=ij&InD8AY$(2e|nho z08*kl`mL>O{<2L9mh%WTl$C_AWsdgu&(F_8zq38L$nXdfGk(2!b(Fs}yWTxpeyseT zlO#uRO$)#Z`9ByQKCa9Er-y?(`F|77&JNV%;LZ-b*3y>aA35b1D>?h(_5O>OAQ?*p zkTiyjvj~Mi5%%ySnPmxnP#olBQC~}$J85zIA3Oiu8YT9BBjYhmsiY`EnQcWHteF3g zpB@Zr^Z)VV#|L-w|0bSKpY|WXoX(CwpoB3^P_6&ZW{ND)6p!G+{>4SFr;7DXQ06=Z z0)mYtq%6kghF2C4qhT7BLhsWjplOukF+yP2EA)6uRTH6t5WsFsBMHG7E&>St_V#T6 zfmw(G*iERA5PbXmBvAkUcd)ky{fmp9M(5L~zG-n~3#v-Sag3Z}{4(b>oxF>t80QI1 zC$A?dD_+0)h*7S!*B(G0OeIVsRDY{yMr1U7^)cfpgj1Kz(}y!$9Kokg5T4-zE-s2M z04zgJB;!h<_FkKA9(iv7RIfNmCkUbWT!p0CQBA;S_#t9uMOk?-@9O+~#k6_qy zANtLKoDv>)4dhzmr~q8=IGPqz6}KL(Ka2{(J4`T=jK4=dvjp#dO=G!a^sX>)#h9tt z9zbAb%e9Q489dV`ItKg$Le;2i)An3{T~BI+9zaY4R-qbx*#xSoQGsgdy@d8!1ZFID z^xs#%Q%N@;kBr4Nc^I)-#!^gWF&4@k#E&w7du!9)1M9kSuK)~3&s0^CClZ1H!t%rA z1!hSLHPzg7NXQ5iHwVi(q9@?@>YF&yB;T!5NLLi0S5V`r>97Z%A*E@o5FQSylgF}I z$|UUKERzeb+k5q*ka3#IF$5&b!n1sYJVl8jq-?*abOhgsz^7fKIZx^u16^b!!irE) zliea8o?wDRVED$BY)S#iGM2E(;yWdas(4MAQ0h8vDCD=tsuhvHJytE{{3fir`I^vg zXUXj`patW=)d-QGgw&5%{=)Q0+h z)BcM{Mn*K*q6N6Z{(CY!7}V^)Cxge2?(DytcrIc8$ti*)e1a0bE5rg=M{(y|tFV<4 zCwBj!l=*ZF;RoY~oFr^SlFH<$fAnGa1(%fSd&Ts8^!|2BO!&gb^SiQk=%Ba;IwAX$ z(zddl7S>Wt)##8c<1FKpNcG!o+~^G$vwbqdREFyfl~u0H z{yFSDhjX$3$sn3ybk%Ji-|ARMMm#~+l94m1@KNepbP3}3a1 zbm0IO7cjzzj%@e6G00IF`CGxQ{qZLKQEKlPA zkaNbv-h&748H^A(&e$AdIG>{7--t+(u*rP^Gn&#_p0A92KM(r<_Uqn*pa0LruMaLR?gg-0ArE{8$=*q>C}ABH3XW!;RM^6u*-r4^*@vLY6>m}s)>#z0Pq1O-wH#}S%xVXyb2AQLtSE_-*0FItDd}3uGVK>%7 z)o_BL23hzD^|$Y|i!dW{8cG&AtOkPs0)Y`nS^RiIW*9&)rkKRKiYeM341#j`ZeTdP zE)0hoU^px=Y@lLivKb^Sz>6j(ezyugYRiZ;Nw8P-_$z(m#KjG{1|cJyn9bKd)LVl- z*kz^-kaL&^E66BP#bGHDib}g3B zhZn`Kvb|%%F_o@Rx8k^pq@{1RPAZ|8<#$F?y^GPLg70}IY1~r3;kthoYM&XRnF5G91p#8%M$Th8SaInZ>>_{?x;L{im08|kp! z7>F!_aAOvUN{H|OlBr}u1|%?QS9%Oo$nj=>z_|) zg8gD#YCcje&LJ>Dp^Ny_pz)X$)r|Fz46Rt-*4T% zk!AO$3kyD9BAVbeU|cR)GuO6 z8ZA5nl4WY#DsRJ9My&qTt2AvoRjFpbWH*Ee9mB34l;eTf)8kPm%TW!}O2fL9zCD|z z<2q}2RM6NS|D!S@iBv+zTG~n-c1!sZCU4A)t+RT~C|tqbE%>Zva{JX8c1k9@-<5%O zCAxzP?2xvW+rk8C>=wu@v91Br@v2iGfY7I(3o+ZfEz|7AyK{>s>z7v7w*Iu}|8@g? zdj`M?{r^CHtDXND4({T=Zsge{{_F4BZy^yzBsx_yi9kN55n4~E{c8WR-;NoVS<$oCXTwZPkIA-tAwPLl*i z2$GXjs2Lc8WDwJ_K7Ax%L1qcWsHCvMqHuQ->kkFS6`C}aIKhUi^Q9u3@8^6!#p1Ku z;B<4pP$yX0?Eq~IPGJ{$8}LWZR_u_sMFN$v)Sm6aIPBsd72s_#BYVwK-2on^0dM5Z zGT^g9`CScU<+~o)x*cS{9Tf-kTL1!N3YKpOs;Tx`KwyS4Xtd$txLXmZL^4`ZIe;{k zRcL$Vw{gOVeDbLN-8H9Kwb|fj#bPZh<#Ma;*u*VJuG9bv<+pOj>+HOmz$6q!M^=QO;j7cJJc~FNT&X?L#Z?6CLoWsre z|AxciLEZoNnSPWBQGwFuJamCeG`oO1_;V=QKw6 z43g(*1Wyk2Pda;-kH_>Q1pTJQWRQHpQJFF(Wtc`&;p`$Ri7;WTqeY3jS;JO!z%D4w zO^^OJBB*x6{C0-OXW*D6Bti)O96<0}aQRM=f^g$JNfz)&P7*q%7z4>N-Py4B6B_8c zyi{!{%taC2D%cEtt6Y;vYvBTv;+xPJwMM9%QUSY`R4?DWQ)RU!oME&V_Fj)&EQkS8 z1n_#ar=@|b>8?X`74jC_Ua21hX%twC?!JP4FSR>@YxApzXF(1F zrMh$$xK`e7j9{G$E6_~4n=sp52*N^|X+O~^WEdzm-ze=nb@fAQYTNFQ+Ie2TJ`tYjqV!wzz zeVdsRC&ovrurX^O`YvD>MWEk%ITK+*=a@RRA{WSQ3WZ|j^A4k^B5p-tDTeSoN!YnC z2P&nl#Ef^)#m4Ubo(pN6#|82Cbd?c_&dv#sO9wnns9b~^gFn-B%&wLgb;tGJw5+Mx z7!W^-x1^-WBdGh&(qy5Q#dCxynX7Khk&~oOQ=!%@|BUi=`?IS&+F1D;-oLtLQuSIF zN=gfXDxja$*KVsNH0y1sE%xnkt2*D8iizGyZFrtb&!wrK`f7^9Ic!%GnmSWwQ6JHg z0Hm54&B!;fKdV=fG zEVxtwIC^Gsyj3P{%e<*(@oCJQYK>}GLldHE@duJ+E>O^myimA21DeM8aapZ<1=8KY z6Dy~i1F?Fx6^A$&2ab|coTK6`eNG|aNa6)V+CGifnw8~|3FB4uws$KBUiwD9)@C6D z_QXQ`p_=ojeuie)a<1ke*n=R!bRwq#3x~Ezp4DJ;yck~Q`zzK|d4xifV zvitRHY{dsx)B(05=anB0AhaW06t+BiY%6_d#ByDB7?ZeX6t;kT?Wy085ozhJ_m<>nvtwHT zqvHaezfze+#C{25B8ivIv^xIJRu^t4d#crT8n!mjQPvBY{|uuik1&n=9CV+&{7GIs zb1g^{Q!+|0_9GKYCVu8~ZdY{SJ(ol9*qajdGn(zA?3OG$D#h_kO}@aP5qKE2FoqxL zT1Q16w7S$O(`K*w&9V8=azxP_{cK0X(}uQn)U+Fy);VM_@Yuo1{Mzuplf3B5Zo*F+&y#FQV7Rwu{(O_qkkbf;d$5~lS+mq|DQQDAvT@`SGA5YAd z!1E;eo=R;82fzIClSd5*{xg8jYIzWn!{c>9F5|t?@rulfBVC&>-PmeAYm33CQ-ap^9>v`7GNNDz6Wx>II!Z#&J$rF1%IT&Pb=BYIRzyqo10RtF+QD zrV?&hMR2|C-_+uCmq6rpJuUu!$vBzd&BcEYhff;u-*^818+tZB|LLDmdS`eAUL-`c zo;PyL6sZE`A*14WeuVA5IIqCEhe2yim8OpUpmEer9}jp~`Pg!Dv+m8Yhk_c_{4C7X z7N0GzwA4kaC1|sji&@1#v>UimWUuB{ax1G}#soe868sYQ=dAqIepOwgUbJJ@*_%5N zfBT-M{4Y;)ZEFQsA^!(Y2KDp*j~_j{yZ`Y1pv*s>HDXTiD$N}Em8BzVJrKQA2@rR0-Y;=cHYO53tW`&D*r9c5?z7nvn{?X_>w zxx(iBH$JZ$jQ@NzXw3gdkDolgoBucQY%u@LVIG>AT%44p+Ic=vR<^TwtxvyO0vP79 zuEq&UJMWhp+b-#ueXHyA-ODxQLPx{>GPfIdd;aY>>-OHWSLyr%;qDp+{FpH=;nSxQ zz{SP0d%I`(2qT$j;y8CezqpZO?Rz-vDJ*M2L!ZI#f~870J_|l+Pi?45m_t+-7Z(A1 zh7l3?eE>z;q6C!cCy2*<>ar5_IMG)o5V`&ke|I(J!`xR*y&x zl;@<>UvwZumQd}H5bB4{45zeS+ikCgcHzAs0{_;isy%^?6Y}*o{H3B3T6rkGtHdrC zXJQC@U5DCBzhWnpj@?;VF2G~XW^TzeBe-(pmTqMf8>Z&3jb>H@aOqJ}y|EiR-Ux<4 zx%+NspxuNCyvlk_l5a=9s}J{T&i|sA9nGSp#;&~wr{7F-7Gx%jnd6+|xe3fjCFOQg zl#Sv3H{!naAp%Xo-8W;l;ycrzm5BgzglDkpc3MhgsvP2dc;>3LxylM>>0FIpxf^Gy zXo#@HZ))~s9Sv0v+ID7vaa+=QEA#$t+wq0%a{tOqxDj(`S`%O8q z(q290!**Y_Uw-2_M=tO?_44Q$*gtKlDwp|1>w|o`EyS>OTWGJcqvx?hEnp<<*r@CB zuG>imw?qHDd%o<`)c?;3PiZ>Yq6x6l|2t^-e-9qt-T!?f&j$McPlhpoj94yh!e`Es zL}!L2lVxgu!Be*Udoo#){_lh_xlGQtLi2s5B#mLW@Js|Q=r8~;q2Hd(DOAti_u1^w z{*9(F1bzO?FY%x6eHK%4@c7A5VA2i!^!((_>o%9V#oj}(%0^n`zBLIw%tm&y0FJ7gn8xN57MU{|H>qv!9mw?M2RZ{SrgO?!YQm;< zaAtP~T1y+`!X=^2wQom~H16A0`l^+_SF-2%F76hO{~=F9{(F%n`@cm*2$IH}Txl^_ z<^Os5_;F4CKYcp9%l~>K&j#|}M(7~Ca9jbrp6cBkB2|L5k>Y=y7^afn3V>bCA(!~6 z2(ofPyj5Fay}*oWbh#~Of-%a@x)h5XZA6BPfi18u93P@@u{G_w=&!cO)UXIlEn9Mj zW{4>3GOoxP!b@ZC9hv@iu952!*Rwurq3KH>+Dmmzb2zk^&mhapib1i zQkw)LHhR+;iP*xM!79W`2Uqi3dst!T6}By0ILi}Bv&MB84sJ{2q8|!aJ8re=y7uS! zN19N=7ckCKqb6CGwZ6)LPNvfN(ipED=vgYeR?dXte(Y{(^aZ5CO0+AUv#>T7}#<{a=fdq!S?}nkBIBo653as ziAuP2L|C`Evad>acY4K)_eM1LCB0J+3RS@7RJ--F&+o*FF|W_Ew&ARPSueJ7x&A*R zoRWBSMOV-Y{r~CXM*QE?!@K*xZ|1p-{{MsGikIJRUHf<3c58Hh*U?VRU!Q)vn%3{y zxE`Iqg`^v4{I0$QM{+s6w9;RL)vodr9!;r4eb?tY2zkZpka9WgHXUkklq6OaI?RR> z#$<=-z`ajFrPUTVNM?JeTtSD6V+t;K#!MI=6>(&9~s$Mq>_Lh6y*7nVGDahC9o7t)n)7gVn z?ip`7UBW$ct*+2z_QqG@G+Wk%s|dgAcZGgwXUi>omizxQCgg;p_#?TB3vh-1Z}|A> zldAvkU@&}qm;dKRp3C_Ejty75``_Ph-T&t?+^ul|mN<300LwC0^8$KpU5^*AoxmG8 z0zD8{JO zbK`RQeT)%}u}Cd#Z;(Q;*+4Cx%NDgJv*iLqm%_A?Zs!aaeKzj9Z_5_0&RcPG(ja@W zkHa?B30-Jvv36@zO-gsJ8q0f7)$nV&ct_II)>2+O9(x*2(O2NCtYx$B_>PV0sDCm4 z*6Jm4Gmpn=c-~582-SI~#Rd#oZ)EkpNW01Baun^>$JE26-Cwm=?amUju(OR#0dLtY z=5=vHj=7w3Yzd$%`p5ji`Z`=>4V`bpA?VN>uhCDlUHyOU9$ky{D2x7BY-+ETAX*=8 zPR%8J3;rC-8Y*KoX=_`hX34aZwHvEYdyCf~NqlAXa-yWF?taBw+}fY*NjIO+8%nx5 z)D@t%Ebsi*vdfFSR^#<6W|z)BtzelBmdI+;+~p5gQ!!s*D&Tt{ZOqZCooA+yIt5)>7RT7yR{3_ zYW)b>0y_3q)@oM3KU%xy9EV-r_AA{(S--xzJru1O#u-!LyCydxRpDSMZ0~dMgJ83u4$|JRh@QT zyjzWw1+V$_UYA>v6l_-^~5g4&#cpnE`q$ola&| zGl}AzDQ0@VHl?*s#x9Q6Xk~3p)97B>yNB7-@yBdA>0eASIxDaE)b!T)Yl!!Sqo^=C zn-kJzPQtF$3*bMV!SK=E+9T1bT3mtuTjBZV7rX*as8^S$-3|1rJ+s~g9r~4Oz~=nF zeW175Nd6!EEVuvth3@iRfK~Z_pBxVA@m~i|hIjV=O+1$| z|E)c&%4kb}giT}LDDS$wp7k$SIvx!4y~1^Uu(<9+zY4mH{UX-E>QDW_!0ON)tqr%^ z+OTMC9euD%4Kx>?w9=-n3(d<|^XwDvk2Dy7cR=}>8J*SolTfBgh&_Wq|;?VDn@Zx)%DNYdU!cUZ(4N`JYInY&`b z!aY{8rZ&CHzrn*{G0>exlf4~l$tC*B6|jQK++|ZsXZz|tb@nBwr>I*wB`X(<`Kq$_ z^KR1I?4+sLAr0uYo9~OF`T`8Ef1W2<^)S=s$+-I-`;~L2?zFt@6;0)g>pJ3T^ljHM z&q);ozT+tjO3P@^Wn}Z-G&jTNjcsuMwn8->>{3=KGC}zw=N!}0s~9vcLnUckNRG;V zdX1Jgx)#x^Uq_=faNvDuOGl=NVeO+|(qB>+toV)iC2cW-I<9jJ_d4Rhs_p>;USI0g z5NpK+EhLWNe!s8OB4vv`yQhj8!KrK5djB=X9N{VMBIwKPlVQ&ZC zPpJTrXBp#CfS6*E=#Utg5gAQsI(Y~j6C&x{E}P|hlE%FqNO59iPe)v7EicqU*6TfopZ|f$tor)bU3asXS~fy4)i;doOP0|{ z>?fw^Z+a;d`#Y-4o_3B;ILk97QViEY!X`9=5z2E^0>>g^>V>`D&JMi){@-7o^m?bK zr%JQ##h76lV;WJk+Phj?k1RaB&Rak05e&kQ;YSygV=rSnDy~Gcjrf>E8ChGk;R61JErg$VF(DDgD)u zVM+vy6pu+1%Er(;Ihg|SvqMv1!&8(f;JCb0?<7wponaNljI%hTY<~}Szy0p`WG{r5 z8cR@r6?dZNlFhV1^ZxsH5FwXzOd}#uJXCx?(KjikI&FetP4%bh?}FtVNLECV*?Dlx zQTq}El_+|>zK`xO93K3+*Ejt=42R*sR8clADtai6Kp3+mVdv)hz)@oE^EKNijuXh7 z&_sW;hM%3umPK^@OT;qNhG9&{W7JB!z^KG@2cD0|G^LU%JU=U>)GAJ6Oceo;ga3Sn zmnb4mwUr2KKcC^%$IRTe_&UvUxw=B{bAS1>>if2;eeQjRQ#<2HL8&lhF@}PToc7C!PkF#`!=v{mhzhAZ=at8>fiqk_D*3LCR4)W3MT5s zO=FU=*pj3{lZ?d^7Wt z%_%)?!`Y=qDko6H?f~Bj!86h{tl8;E#Kyd>s zPriNr0yqkm^9VOVb|Wk!9=9R6HkL0=US5Kb8}p_0UnqsiN7Z2|OjH6jzG|(pYTasH z&fCNA@Xy=AQVaT5oHM?Wh`)B}zO83tZEZcM8>}s@)qwpN{8v|0CHOA@+;q@3!%N-iS;-_xeGdmyD zwkD^XodZchBd9GS{az?LO;1CEF%WHRgr!DRZ=k-%?ml=s?8U3$9#j=DI~!lm$Yiy` zbyL>MrJq%E(etzw${kprO%W%fzUJ?H(B+qp^vJhH2kmX5YV#CF0YX@Gk z=nT2xK{&w)6_PK&hV{Q8GZe5JW5zKe65}JaKtZ($j%keixNHb$DkPG4uh#WqvUK)- z_^|ui!Cpz5YLkV*8zJlMqJhTPh;9v_jvUyx7{aRPby` ze0(*Fdihi)g*6*SBs#-Xdt3f)<2iu1xnQ{rY$3o@%?0C(Rx2$tGw1p7>q0p#cwZo& z(+FMg3}Zp@?wIKynGxZE6=@2}&#pBmTokyJNgCDspT_15Dcc_mGdiHF*kgci>@m!jbGu)y5Zw9z6m0$ zPU>PMu1{+lakhMH+zQ-Ci`k-M)=%x)iLFHHyL_w<_5`y<@zd8twJGwdQvcW89S2a@ zRFW-5$u_vJLB2CwoI;&^Hni{z7wflrCGr)C^|adaC26#*haUM#2aMU;K5Zdi5fRHc zaFm?l9Ce%&9Ro=?l6V1;UK!%h*Z(R()P0+PsY)RTY=l7kp}Ilmi0s-P2F-T|!5#z& zrV}|0U^sw4NY2tpnTvf z{I@wxV!(7xIZJ2e;0UKWa!o7iW^;-d^qB|wZR3zIxCMa&w|H&8>1X3$xvk3D zOFmz^{af_-f@Q@~R6iJMjl1|lm=jl1!Tl> zX^$q`5+KP$3;7~S_jL29-QLa)yvs16Bmt@^D55FOi16aW6{zwEIJZ$#M?CmZfg{Pp2Qv(ZPr_k8#t|iHe>mv#Cx^XWmM6(EOK7wbS555k z0*C>BTvRO5(rV}E{pZO!S%~{U$0Z($X7_dIue|@zB$yQ_b@A8ZH%uOL6qw5U1|J)M zR3bz;CyO2cm1uH;EyvWQv`Q8r9MY))0&HBO??SJ4%WL^6QOaSj7vm`R$UQRIdmE%N zeQ{@!w7AmJEum+qz9{a-kCGFh>6r1EiQF{#6@))XCalP!M#$X4$y~lE9*__QQ>Esd}oATi8T!uao z6dij#VYa_tBt(c+y!rPj6DIvxiJ*iJEXil+_R&E@dI+z_j`xCo@DTiF-ssE^L12&5 z$5bdh1;h(Q(8%O!5R@swR>3&v2fZGNA{62W7UL>(pX-t^V{v&qP$%A%hE9;gKXEGY ztsVeD|GBcUcl4jQK?{HRJMHx{BB!h19^0IIqjDhQ3Zx=k$1-+ytYZd!r!pLdt~=ln zwnl&*&=k-}@913%ui1iUtIC7>}+A7pW)&Ml4Ug2Vxt1f zzAw_L7?@TIIKze68f%MHRUc{Eg@nQ1Y~(B@w#jT#pt=J-vO55UR;dcPEcoByq9CQB zrS7moELW21Cwsn3=Qjj_sh~Qwl%9)P!}Jq`(6rb%dkBKf5G0+UPyo(Jswd?{)s{>_ z=Vp&MV?t1UG<0E_)hfgkDHnBWh_D>pol=tTTUzP&{eHha8;qsONJU|IaXb@(9zYxL@_+qF3p3oF!$C!!Wc-|1g~&6*mpL z^gPGU-@W_k?a9ktsbtRGCgM@g*F6m>_1zHT>X#+t@*_Blw2fWSgPqr;+_QNc{pSo9 zOItki@vOS6X6f^< zh(?r=1i2KIVY9iZv@lkdHVO%|h0VdL6Ia%T>RAvxtWon>5NMviUn{z1X3Tm6_uN$f zO@XLo%k0kh*(>H9e#{t`;DLE|Z}%)8VI&h>*=5kxu?!+35f+CbN^XEYgWm;96?)Ht zPoa`|p~r_8ff8^;;FCwt@5dOi825T@gcx3m5JR63!|f1acnyRYwiCjo75mX0>9#?B z42Iz#9Q1lWzfIu{o8xSR9EOJv;b3qucxbaE9JmCLa83khgG3oiW13Pi#kf36HlcEw zk94vx#mF`%+m4V#=AzHWeL2Ox&9%7q5ag5!n33NZ_cJk=t3ib7wpC{eFIF@q=>&yI zr)Bb*sqbahFgxS4xgePm5sYW72>dToT#b>)oGVaqY|>wut{xhFN<&ez(kj3@T%>5q z_5i39n2eQ)MR;trjDlpZ-hLnUdJi7_q+{tU;^)W_sLkz$HXn1H2>$1cX% zz7~cYE)SaNuRe@aRZmV~*9s6#hS35>OioRu1KqttM|%&D8d;MFPj|lx^PmaSsGfhMe8`yc3B zq-D}N#%*78SRvOKs<+$x|%$LNRKL++LQWb2yaA z8}uZh1sfUWdTrefR*QDI7;0rr@Rt{Eug@qLMsQjG?7VrX;hC_`^uC0#5?>@;02Lxf zv3`?AU$?W!@~Mb0C7iM%!IBv$>wxiV#|(vP-U%!>8%erQ<5;3m_QIT+tj;yRYi7wPf#W=Zgr;Z0@PcbuwOGlYDRapK{h3@ulk_d>(3ARlG&e!UsFQfyXWq?d+weadj4Mk P00960<_VnJ089Y@bqU3V literal 0 HcmV?d00001 diff --git a/chart/deps/redis/ci/extra-flags-values.yaml b/chart/deps/redis/ci/extra-flags-values.yaml index 71132f7..8c1dcef 100644 --- a/chart/deps/redis/ci/extra-flags-values.yaml +++ b/chart/deps/redis/ci/extra-flags-values.yaml @@ -3,9 +3,10 @@ master: - --maxmemory-policy allkeys-lru persistence: enabled: false -slave: +replica: extraFlags: - --maxmemory-policy allkeys-lru persistence: enabled: false -usePassword: false +auth: + enabled: false diff --git a/chart/deps/redis/ci/sentinel-values.yaml b/chart/deps/redis/ci/sentinel-values.yaml new file mode 100644 index 0000000..48dfa1d --- /dev/null +++ b/chart/deps/redis/ci/sentinel-values.yaml @@ -0,0 +1,6 @@ +sentinel: + enabled: true +metrics: + enabled: true + sentinel: + enabled: true diff --git a/chart/deps/redis/ci/standalone-values.yaml b/chart/deps/redis/ci/standalone-values.yaml new file mode 100644 index 0000000..dfef688 --- /dev/null +++ b/chart/deps/redis/ci/standalone-values.yaml @@ -0,0 +1 @@ +architecture: standalone diff --git a/chart/deps/redis/templates/NOTES.txt b/chart/deps/redis/templates/NOTES.txt index 5c27951..2c62195 100644 --- a/chart/deps/redis/templates/NOTES.txt +++ b/chart/deps/redis/templates/NOTES.txt @@ -1,18 +1,18 @@ ** Please be patient while the chart is being deployed ** {{- if contains .Values.master.service.type "LoadBalancer" }} -{{- if not .Values.usePassword }} +{{- if not .Values.auth.enabled }} {{ if and (not .Values.networkPolicy.enabled) (.Values.networkPolicy.allowExternal) }} ------------------------------------------------------------------------------- WARNING - By specifying "master.service.type=LoadBalancer" and "usePassword=false" you have + By specifying "master.service.type=LoadBalancer" and "auth.enabled=false" you have most likely exposed the Redis(TM) service externally without any authentication mechanism. For security reasons, we strongly suggest that you switch to "ClusterIP" or - "NodePort". As alternative, you can also switch to "usePassword=true" + "NodePort". As alternative, you can also switch to "auth.enabled=true" providing a valid password on "password" parameter. ------------------------------------------------------------------------------- @@ -20,117 +20,128 @@ {{- end }} {{- end }} -{{- if and .Values.sentinel.enabled (not .Values.cluster.enabled)}} - -------------------------------------------------------------------------------- - WARNING - - Using redis sentinel without a cluster is not supported. A single pod with - standalone redis has been deployed. - - To deploy redis sentinel, please use the values "cluster.enabled=true" and - "sentinel.enabled=true". - -------------------------------------------------------------------------------- -{{- end }} - -{{- if .Values.cluster.enabled }} +{{- if eq .Values.architecture "replication" }} {{- if .Values.sentinel.enabled }} -Redis(TM) can be accessed via port {{ .Values.sentinel.service.redisPort }} on the following DNS name from within your cluster: -{{ template "redis.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} for read only operations +Redis(TM) can be accessed via port {{ .Values.sentinel.service.port }} on the following DNS name from within your cluster: + + {{ template "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} for read only operations For read/write operations, first access the Redis(TM) Sentinel cluster, which is available in port {{ .Values.sentinel.service.sentinelPort }} using the same domain name above. {{- else }} -Redis(TM) can be accessed via port {{ .Values.redisPort }} on the following DNS names from within your cluster: -{{ template "redis.fullname" . }}-master.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} for read/write operations -{{ template "redis.fullname" . }}-slave.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} for read-only operations -{{- end }} +Redis(TM) can be accessed on the following DNS names from within your cluster: + + {{ printf "%s-master.%s.svc.%s" (include "common.names.fullname" .) .Release.Namespace .Values.clusterDomain }} for read/write operations (port {{ .Values.master.service.port }}) + {{ printf "%s-replicas.%s.svc.%s" (include "common.names.fullname" .) .Release.Namespace .Values.clusterDomain }} for read-only operations (port {{ .Values.replica.service.port }}) +{{- end }} {{- else }} -Redis(TM) can be accessed via port {{ .Values.redisPort }} on the following DNS name from within your cluster: -{{ template "redis.fullname" . }}-master.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} +Redis(TM) can be accessed via port {{ .Values.master.service.port }} on the following DNS name from within your cluster: + + {{ template "common.names.fullname" . }}-master.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} {{- end }} -{{ if .Values.usePassword }} +{{ if .Values.auth.enabled }} + To get your password run: export REDIS_PASSWORD=$(kubectl get secret --namespace {{ .Release.Namespace }} {{ template "redis.secretName" . }} -o jsonpath="{.data.redis-password}" | base64 --decode) + {{- end }} To connect to your Redis(TM) server: 1. Run a Redis(TM) pod that you can use as a client: + kubectl run --namespace {{ .Release.Namespace }} redis-client --restart='Never' {{ if .Values.auth.enabled }} --env REDIS_PASSWORD=$REDIS_PASSWORD {{ end }} --image {{ template "redis.image" . }} --command -- sleep infinity + {{- if .Values.tls.enabled }} - kubectl run --namespace {{ .Release.Namespace }} {{ template "redis.fullname" . }}-client --restart='Never' --env REDIS_PASSWORD=$REDIS_PASSWORD --image {{ template "redis.image" . }} --command -- sleep infinity Copy your TLS certificates to the pod: - kubectl cp --namespace {{ .Release.Namespace }} /path/to/client.cert {{ template "redis.fullname" . }}-client:/tmp/client.cert - kubectl cp --namespace {{ .Release.Namespace }} /path/to/client.key {{ template "redis.fullname" . }}-client:/tmp/client.key - kubectl cp --namespace {{ .Release.Namespace }} /path/to/CA.cert {{ template "redis.fullname" . }}-client:/tmp/CA.cert + kubectl cp --namespace {{ .Release.Namespace }} /path/to/client.cert redis-client:/tmp/client.cert + kubectl cp --namespace {{ .Release.Namespace }} /path/to/client.key redis-client:/tmp/client.key + kubectl cp --namespace {{ .Release.Namespace }} /path/to/CA.cert redis-client:/tmp/CA.cert + +{{- end }} Use the following command to attach to the pod: - kubectl exec --tty -i {{ template "redis.fullname" . }}-client \ - {{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}--labels="{{ template "redis.fullname" . }}-client=true" \{{- end }} + kubectl exec --tty -i redis-client \ + {{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}--labels="{{ template "common.names.fullname" . }}-client=true" \{{- end }} --namespace {{ .Release.Namespace }} -- bash -{{- else }} - kubectl run --namespace {{ .Release.Namespace }} {{ template "redis.fullname" . }}-client --rm --tty -i --restart='Never' \ - {{ if .Values.usePassword }} --env REDIS_PASSWORD=$REDIS_PASSWORD \{{ end }} - {{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }}--labels="{{ template "redis.fullname" . }}-client=true" \{{- end }} - --image {{ template "redis.image" . }} -- bash -{{- end }} 2. Connect using the Redis(TM) CLI: -{{- if .Values.cluster.enabled }} +{{- if eq .Values.architecture "replication" }} {{- if .Values.sentinel.enabled }} - redis-cli -h {{ template "redis.fullname" . }} -p {{ .Values.sentinel.service.redisPort }}{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} # Read only operations - redis-cli -h {{ template "redis.fullname" . }} -p {{ .Values.sentinel.service.sentinelPort }}{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} # Sentinel access + redis-cli -h {{ template "common.names.fullname" . }} -p {{ .Values.sentinel.service.port }}{{ if .Values.auth.enabled }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} # Read only operations + redis-cli -h {{ template "common.names.fullname" . }} -p {{ .Values.sentinel.service.sentinelPort }}{{ if .Values.auth.enabled }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} # Sentinel access {{- else }} - redis-cli -h {{ template "redis.fullname" . }}-master{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} - redis-cli -h {{ template "redis.fullname" . }}-slave{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + redis-cli -h {{ printf "%s-master" (include "common.names.fullname" .) }}{{ if .Values.auth.enabled }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + redis-cli -h {{ printf "%s-replicas" (include "common.names.fullname" .) }}{{ if .Values.auth.enabled }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} {{- end }} {{- else }} - redis-cli -h {{ template "redis.fullname" . }}-master{{ if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + redis-cli -h {{ template "common.names.fullname" . }}-master{{ if .Values.auth.enabled }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} {{- end }} -{{ if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} -Note: Since NetworkPolicy is enabled, only pods with label -{{ template "redis.fullname" . }}-client=true" -will be able to connect to redis. -{{- else -}} +{{- if and (.Values.networkPolicy.enabled) (not .Values.networkPolicy.allowExternal) }} + +Note: Since NetworkPolicy is enabled, only pods with label {{ template "common.names.fullname" . }}-client=true" will be able to connect to redis. + +{{- else }} To connect to your database from outside the cluster execute the following commands: +{{- if and (eq .Values.architecture "replication") .Values.sentinel.enabled }} +{{- if contains "NodePort" .Values.sentinel.service.type }} + + export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "common.names.fullname" . }}) + redis-cli -h $NODE_IP -p $NODE_PORT {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + +{{- else if contains "LoadBalancer" .Values.sentinel.service.type }} + + NOTE: It may take a few minutes for the LoadBalancer IP to be available. + Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "common.names.fullname" . }}' + + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "common.names.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + redis-cli -h $SERVICE_IP -p {{ .Values.sentinel.service.port }} {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + +{{- else if contains "ClusterIP" .Values.sentinel.service.type }} + + kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "common.names.fullname" . }} {{ .Values.sentinel.service.port }}:{{ .Values.sentinel.service.port }} & + redis-cli -h 127.0.0.1 -p {{ .Values.sentinel.service.port }} {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + +{{- end }} +{{- else }} {{- if contains "NodePort" .Values.master.service.type }} export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}") - export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ template "redis.fullname" . }}-master) - redis-cli -h $NODE_IP -p $NODE_PORT {{- if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ printf "%s-master" (include "common.names.fullname" .) }}) + redis-cli -h $NODE_IP -p $NODE_PORT {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} {{- else if contains "LoadBalancer" .Values.master.service.type }} NOTE: It may take a few minutes for the LoadBalancer IP to be available. - Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "redis.fullname" . }}' + Watch the status with: 'kubectl get svc --namespace {{ .Release.Namespace }} -w {{ template "common.names.fullname" . }}' - export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ template "redis.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") - redis-cli -h $SERVICE_IP -p {{ .Values.master.service.port }} {{- if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ printf "%s-master" (include "common.names.fullname" .) }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}") + redis-cli -h $SERVICE_IP -p {{ .Values.master.service.port }} {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} {{- else if contains "ClusterIP" .Values.master.service.type }} - kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ template "redis.fullname" . }}-master {{ .Values.redisPort }}:{{ .Values.redisPort }} & - redis-cli -h 127.0.0.1 -p {{ .Values.redisPort }} {{- if .Values.usePassword }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} + kubectl port-forward --namespace {{ .Release.Namespace }} svc/{{ printf "%s-master" (include "common.names.fullname" .) }} {{ .Values.master.service.port }}:{{ .Values.master.service.port }} & + redis-cli -h 127.0.0.1 -p {{ .Values.master.service.port }} {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD{{ end }}{{ if .Values.tls.enabled }} --tls --cert /tmp/client.cert --key /tmp/client.key --cacert /tmp/CA.cert{{ end }} {{- end }} {{- end }} -{{ include "redis.checkRollingTags" . }} +{{- end }} +{{- include "redis.checkRollingTags" . }} {{- include "redis.validateValues" . }} diff --git a/chart/deps/redis/templates/_helpers.tpl b/chart/deps/redis/templates/_helpers.tpl index 65735a7..ecaba7d 100644 --- a/chart/deps/redis/templates/_helpers.tpl +++ b/chart/deps/redis/templates/_helpers.tpl @@ -1,158 +1,129 @@ {{/* vim: set filetype=mustache: */}} + {{/* -Expand the name of the chart. +Return the proper Redis image name */}} -{{- define "redis.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- define "redis.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }} {{- end -}} {{/* -Expand the chart plus release name (used by the chart label) +Return the proper Redis Sentinel image name */}} -{{- define "redis.chart" -}} -{{- printf "%s-%s" .Chart.Name .Chart.Version -}} +{{- define "redis.sentinel.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.sentinel.image "global" .Values.global) }} {{- end -}} {{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. +Return the proper image name (for the metrics image) */}} -{{- define "redis.fullname" -}} -{{- if .Values.fullnameOverride -}} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- $name := default .Chart.Name .Values.nameOverride -}} -{{- if contains $name .Release.Name -}} -{{- .Release.Name | trunc 63 | trimSuffix "-" -}} -{{- else -}} -{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} -{{- end -}} -{{- end -}} +{{- define "redis.metrics.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.metrics.image "global" .Values.global) }} {{- end -}} {{/* -Return the appropriate apiVersion for networkpolicy. +Return the proper image name (for the metrics image) */}} -{{- define "networkPolicy.apiVersion" -}} -{{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.GitVersion -}} -{{- print "extensions/v1beta1" -}} -{{- else -}} -{{- print "networking.k8s.io/v1" -}} -{{- end -}} +{{- define "redis.metrics.sentinel.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.metrics.sentinel.image "global" .Values.global) }} {{- end -}} {{/* -Return the appropriate apiGroup for PodSecurityPolicy. +Return the proper image name (for the init container volume-permissions image) */}} -{{- define "podSecurityPolicy.apiGroup" -}} -{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} -{{- print "policy" -}} -{{- else -}} -{{- print "extensions" -}} -{{- end -}} +{{- define "redis.volumePermissions.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.volumePermissions.image "global" .Values.global) }} {{- end -}} {{/* -Return the appropriate apiVersion for PodSecurityPolicy. +Return sysctl image */}} -{{- define "podSecurityPolicy.apiVersion" -}} -{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} -{{- print "policy/v1beta1" -}} -{{- else -}} -{{- print "extensions/v1beta1" -}} -{{- end -}} +{{- define "redis.sysctl.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.sysctl.image "global" .Values.global) }} {{- end -}} {{/* -Return the proper Redis(TM) image name +Return the proper Docker Image Registry Secret Names */}} -{{- define "redis.image" -}} -{{- $registryName := .Values.image.registry -}} -{{- $repositoryName := .Values.image.repository -}} -{{- $tag := .Values.image.tag | toString -}} +{{- define "redis.imagePullSecrets" -}} {{/* Helm 2.11 supports the assignment of a value to a variable defined in a different scope, -but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. -Also, we can't use a single if because lazy evaluation is not an option +but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. +Also, we can not use a single if because lazy evaluation is not an option */}} {{- if .Values.global }} - {{- if .Values.global.imageRegistry }} - {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} - {{- else -}} - {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} - {{- end -}} -{{- else -}} - {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- if .Values.global.imagePullSecrets }} +imagePullSecrets: +{{- range .Values.global.imagePullSecrets }} + {{- $credType := typeOf . -}} + {{ if eq $credType "map[string]interface {}" }} + - name: {{ get . "name" }} + {{ else }} + - name: {{ . }} + {{ end }} +{{- end }} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.sysctlImage.pullSecrets .Values.volumePermissions.image.pullSecrets }} +imagePullSecrets: +{{- range .Values.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.metrics.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.sysctlImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- end -}} +{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.sysctlImage.pullSecrets .Values.volumePermissions.image.pullSecrets }} +imagePullSecrets: +{{- range .Values.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.metrics.image.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.sysctlImage.pullSecrets }} + - name: {{ . }} +{{- end }} +{{- range .Values.volumePermissions.image.pullSecrets }} + - name: {{ . }} +{{- end }} {{- end -}} {{- end -}} {{/* -Return the proper Redis(TM) Sentinel image name -*/}} -{{- define "sentinel.image" -}} -{{- $registryName := .Values.sentinel.image.registry -}} -{{- $repositoryName := .Values.sentinel.image.repository -}} -{{- $tag := .Values.sentinel.image.tag | toString -}} -{{/* -Helm 2.11 supports the assignment of a value to a variable defined in a different scope, -but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. -Also, we can't use a single if because lazy evaluation is not an option +Return the appropriate apiVersion for networkpolicy. */}} -{{- if .Values.global }} - {{- if .Values.global.imageRegistry }} - {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} - {{- else -}} - {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} - {{- end -}} +{{- define "networkPolicy.apiVersion" -}} +{{- if semverCompare ">=1.4-0, <1.7-0" .Capabilities.KubeVersion.GitVersion -}} +{{- print "extensions/v1beta1" -}} {{- else -}} - {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- print "networking.k8s.io/v1" -}} {{- end -}} {{- end -}} {{/* -Return the proper image name (for the metrics image) -*/}} -{{- define "redis.metrics.image" -}} -{{- $registryName := .Values.metrics.image.registry -}} -{{- $repositoryName := .Values.metrics.image.repository -}} -{{- $tag := .Values.metrics.image.tag | toString -}} -{{/* -Helm 2.11 supports the assignment of a value to a variable defined in a different scope, -but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. -Also, we can't use a single if because lazy evaluation is not an option +Return the appropriate apiGroup for PodSecurityPolicy. */}} -{{- if .Values.global }} - {{- if .Values.global.imageRegistry }} - {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} - {{- else -}} - {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} - {{- end -}} +{{- define "podSecurityPolicy.apiGroup" -}} +{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +{{- print "policy" -}} {{- else -}} - {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- print "extensions" -}} {{- end -}} {{- end -}} {{/* -Return the proper image name (for the init container volume-permissions image) -*/}} -{{- define "redis.volumePermissions.image" -}} -{{- $registryName := .Values.volumePermissions.image.registry -}} -{{- $repositoryName := .Values.volumePermissions.image.repository -}} -{{- $tag := .Values.volumePermissions.image.tag | toString -}} -{{/* -Helm 2.11 supports the assignment of a value to a variable defined in a different scope, -but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. -Also, we can't use a single if because lazy evaluation is not an option +Return the appropriate apiVersion for PodSecurityPolicy. */}} -{{- if .Values.global }} - {{- if .Values.global.imageRegistry }} - {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} - {{- else -}} - {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} - {{- end -}} +{{- define "podSecurityPolicy.apiVersion" -}} +{{- if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +{{- print "policy/v1beta1" -}} {{- else -}} - {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- print "extensions/v1beta1" -}} {{- end -}} {{- end -}} @@ -191,202 +162,78 @@ Create the name of the service account to use */}} {{- define "redis.serviceAccountName" -}} {{- if .Values.serviceAccount.create -}} - {{ default (include "redis.fullname" .) .Values.serviceAccount.name }} + {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }} {{- else -}} {{ default "default" .Values.serviceAccount.name }} {{- end -}} {{- end -}} {{/* -Get the password secret. +Return the configuration configmap name */}} -{{- define "redis.secretName" -}} -{{- if .Values.existingSecret -}} -{{- printf "%s" .Values.existingSecret -}} +{{- define "redis.configmapName" -}} +{{- if .Values.existingConfigmap -}} + {{- printf "%s" (tpl .Values.existingConfigmap $) -}} {{- else -}} -{{- printf "%s" (include "redis.fullname" .) -}} + {{- printf "%s-configuration" (include "common.names.fullname" .) -}} {{- end -}} {{- end -}} {{/* -Get the password key to be retrieved from Redis(TM) secret. +Return true if a configmap object should be created */}} -{{- define "redis.secretPasswordKey" -}} -{{- if and .Values.existingSecret .Values.existingSecretPasswordKey -}} -{{- printf "%s" .Values.existingSecretPasswordKey -}} -{{- else -}} -{{- printf "redis-password" -}} +{{- define "redis.createConfigmap" -}} +{{- if empty .Values.existingConfigmap }} + {{- true -}} {{- end -}} {{- end -}} {{/* -Return Redis(TM) password +Get the password secret. */}} -{{- define "redis.password" -}} -{{- if not (empty .Values.global.redis.password) }} - {{- .Values.global.redis.password -}} -{{- else if not (empty .Values.password) -}} - {{- .Values.password -}} +{{- define "redis.secretName" -}} +{{- if .Values.auth.existingSecret -}} +{{- printf "%s" .Values.auth.existingSecret -}} {{- else -}} - {{- randAlphaNum 10 -}} +{{- printf "%s" (include "common.names.fullname" .) -}} {{- end -}} {{- end -}} {{/* -Return sysctl image -*/}} -{{- define "redis.sysctl.image" -}} -{{- $registryName := default "docker.io" .Values.sysctlImage.registry -}} -{{- $repositoryName := .Values.sysctlImage.repository -}} -{{- $tag := default "buster" .Values.sysctlImage.tag | toString -}} -{{/* -Helm 2.11 supports the assignment of a value to a variable defined in a different scope, -but Helm 2.9 and 2.10 doesn't support it, so we need to implement this if-else logic. -Also, we can't use a single if because lazy evaluation is not an option +Get the password key to be retrieved from Redis(TM) secret. */}} -{{- if .Values.global }} - {{- if .Values.global.imageRegistry }} - {{- printf "%s/%s:%s" .Values.global.imageRegistry $repositoryName $tag -}} - {{- else -}} - {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} - {{- end -}} +{{- define "redis.secretPasswordKey" -}} +{{- if and .Values.auth.existingSecret .Values.auth.existingSecretPasswordKey -}} +{{- printf "%s" .Values.auth.existingSecretPasswordKey -}} {{- else -}} - {{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- printf "redis-password" -}} {{- end -}} {{- end -}} {{/* -Return the proper Docker Image Registry Secret Names -*/}} -{{- define "redis.imagePullSecrets" -}} -{{/* -Helm 2.11 supports the assignment of a value to a variable defined in a different scope, -but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. -Also, we can not use a single if because lazy evaluation is not an option +Return Redis(TM) password */}} -{{- if .Values.global }} -{{- if .Values.global.imagePullSecrets }} -imagePullSecrets: -{{- range .Values.global.imagePullSecrets }} - {{- $credType := typeOf . -}} - {{ if eq $credType "map[string]interface {}" }} - - name: {{ get . "name" }} - {{ else }} - - name: {{ . }} - {{ end }} -{{- end }} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.sysctlImage.pullSecrets .Values.volumePermissions.image.pullSecrets }} -imagePullSecrets: -{{- range .Values.image.pullSecrets }} - - name: {{ . }} -{{- end }} -{{- range .Values.metrics.image.pullSecrets }} - - name: {{ . }} -{{- end }} -{{- range .Values.sysctlImage.pullSecrets }} - - name: {{ . }} -{{- end }} -{{- range .Values.volumePermissions.image.pullSecrets }} - - name: {{ . }} -{{- end }} +{{- define "redis.password" -}} +{{- $secretName := include "redis.secretName" . -}} +{{- $secret := (lookup "v1" "Secret" .Release.Namespace $secretName ) -}} +{{- if $secret -}} +{{- with $secret -}} + {{- get .data "redis-password" | b64dec -}} {{- end -}} -{{- else if or .Values.image.pullSecrets .Values.metrics.image.pullSecrets .Values.sysctlImage.pullSecrets .Values.volumePermissions.image.pullSecrets }} -imagePullSecrets: -{{- range .Values.image.pullSecrets }} - - name: {{ . }} -{{- end }} -{{- range .Values.metrics.image.pullSecrets }} - - name: {{ . }} -{{- end }} -{{- range .Values.sysctlImage.pullSecrets }} - - name: {{ . }} -{{- end }} -{{- range .Values.volumePermissions.image.pullSecrets }} - - name: {{ . }} -{{- end }} +{{- else if not (empty .Values.global.redis.password) }} + {{- .Values.global.redis.password -}} +{{- else if not (empty .Values.auth.password) -}} + {{- .Values.auth.password -}} +{{- else -}} + {{- randAlphaNum 10 -}} {{- end -}} {{- end -}} {{/* Check if there are rolling tags in the images */}} {{- define "redis.checkRollingTags" -}} -{{- if and (contains "bitnami/" .Values.image.repository) (not (.Values.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} -WARNING: Rolling tag detected ({{ .Values.image.repository }}:{{ .Values.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. -+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ -{{- end }} -{{- if and (contains "bitnami/" .Values.sentinel.image.repository) (not (.Values.sentinel.image.tag | toString | regexFind "-r\\d+$|sha256:")) }} -WARNING: Rolling tag detected ({{ .Values.sentinel.image.repository }}:{{ .Values.sentinel.image.tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. -+info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ -{{- end }} -{{- end -}} - -{{/* -Return the proper Storage Class for master -*/}} -{{- define "redis.master.storageClass" -}} -{{/* -Helm 2.11 supports the assignment of a value to a variable defined in a different scope, -but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. -*/}} -{{- if .Values.global -}} - {{- if .Values.global.storageClass -}} - {{- if (eq "-" .Values.global.storageClass) -}} - {{- printf "storageClassName: \"\"" -}} - {{- else }} - {{- printf "storageClassName: %s" .Values.global.storageClass -}} - {{- end -}} - {{- else -}} - {{- if .Values.master.persistence.storageClass -}} - {{- if (eq "-" .Values.master.persistence.storageClass) -}} - {{- printf "storageClassName: \"\"" -}} - {{- else }} - {{- printf "storageClassName: %s" .Values.master.persistence.storageClass -}} - {{- end -}} - {{- end -}} - {{- end -}} -{{- else -}} - {{- if .Values.master.persistence.storageClass -}} - {{- if (eq "-" .Values.master.persistence.storageClass) -}} - {{- printf "storageClassName: \"\"" -}} - {{- else }} - {{- printf "storageClassName: %s" .Values.master.persistence.storageClass -}} - {{- end -}} - {{- end -}} -{{- end -}} -{{- end -}} - -{{/* -Return the proper Storage Class for slave -*/}} -{{- define "redis.slave.storageClass" -}} -{{/* -Helm 2.11 supports the assignment of a value to a variable defined in a different scope, -but Helm 2.9 and 2.10 does not support it, so we need to implement this if-else logic. -*/}} -{{- if .Values.global -}} - {{- if .Values.global.storageClass -}} - {{- if (eq "-" .Values.global.storageClass) -}} - {{- printf "storageClassName: \"\"" -}} - {{- else }} - {{- printf "storageClassName: %s" .Values.global.storageClass -}} - {{- end -}} - {{- else -}} - {{- if .Values.slave.persistence.storageClass -}} - {{- if (eq "-" .Values.slave.persistence.storageClass) -}} - {{- printf "storageClassName: \"\"" -}} - {{- else }} - {{- printf "storageClassName: %s" .Values.slave.persistence.storageClass -}} - {{- end -}} - {{- end -}} - {{- end -}} -{{- else -}} - {{- if .Values.slave.persistence.storageClass -}} - {{- if (eq "-" .Values.slave.persistence.storageClass) -}} - {{- printf "storageClassName: \"\"" -}} - {{- else }} - {{- printf "storageClassName: %s" .Values.slave.persistence.storageClass -}} - {{- end -}} - {{- end -}} -{{- end -}} +{{- include "common.warnings.rollingTag" .Values.image }} +{{- include "common.warnings.rollingTag" .Values.sentinel.image }} +{{- include "common.warnings.rollingTag" .Values.metrics.image }} {{- end -}} {{/* @@ -395,6 +242,7 @@ Compile all warnings into a single message, and call fail. {{- define "redis.validateValues" -}} {{- $messages := list -}} {{- $messages := append $messages (include "redis.validateValues.spreadConstraints" .) -}} +{{- $messages := append $messages (include "redis.validateValues.architecture" .) -}} {{- $messages := without $messages "" -}} {{- $message := join "\n" $messages -}} @@ -405,22 +253,24 @@ Compile all warnings into a single message, and call fail. {{/* Validate values of Redis(TM) - spreadConstrainsts K8s version */}} {{- define "redis.validateValues.spreadConstraints" -}} -{{- if and (semverCompare "<1.16-0" .Capabilities.KubeVersion.GitVersion) .Values.slave.spreadConstraints -}} +{{- if and (semverCompare "<1.16-0" .Capabilities.KubeVersion.GitVersion) .Values.replica.spreadConstraints -}} redis: spreadConstraints Pod Topology Spread Constraints are only available on K8s >= 1.16 Find more information at https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ {{- end -}} {{- end -}} -{{/* -Renders a value that contains template. -Usage: -{{ include "redis.tplValue" (dict "value" .Values.path.to.the.Value "context" $) }} -*/}} -{{- define "redis.tplValue" -}} - {{- if typeIs "string" .value }} - {{- tpl .value .context }} - {{- else }} - {{- tpl (.value | toYaml) .context }} - {{- end }} +{{/* Validate values of Redis(TM) - must provide a valid architecture */}} +{{- define "redis.validateValues.architecture" -}} +{{- if and (ne .Values.architecture "standalone") (ne .Values.architecture "replication") -}} +redis: architecture + Invalid architecture selected. Valid values are "standalone" and + "replication". Please set a valid architecture (--set architecture="xxxx") +{{- end -}} +{{- if and .Values.sentinel.enabled (not (eq .Values.architecture "replication")) }} +redis: architecture + Using redis sentinel on standalone mode is not supported. + To deploy redis sentinel, please select the "replication" mode + (--set "architecture=replication,sentinel.enabled=true") +{{- end -}} {{- end -}} diff --git a/chart/deps/redis/templates/bigbang/redis-upgrade.yaml b/chart/deps/redis/templates/bigbang/redis-upgrade.yaml new file mode 100644 index 0000000..bcc8e74 --- /dev/null +++ b/chart/deps/redis/templates/bigbang/redis-upgrade.yaml @@ -0,0 +1,98 @@ +{{- if .Values.cleanUpgrade.enabled }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: redis-upgrade-sa + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": pre-upgrade + "helm.sh/hook-weight": "-10" + "helm.sh/hook-delete-policy": hook-succeeded,hook-failed,before-hook-creation +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: redis-upgrade-role + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": pre-upgrade + "helm.sh/hook-weight": "-10" + "helm.sh/hook-delete-policy": hook-succeeded,hook-failed,before-hook-creation +rules: +- apiGroups: ["apps"] + resources: ["statefulsets"] + verbs: ["get", "list", "delete"] +- apiGroups: [""] + resources: ["persistentvolumeclaims"] + verbs: ["get", "list", "delete"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: redis-upgrade-role-binding + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": pre-upgrade + "helm.sh/hook-weight": "-10" + "helm.sh/hook-delete-policy": hook-succeeded,hook-failed,before-hook-creation +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: redis-upgrade-role +subjects: +- kind: ServiceAccount + name: redis-upgrade-sa + namespace: {{ .Release.Namespace }} +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: redis-clean-upgrade + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": pre-upgrade + "helm.sh/hook-weight": "-5" + "helm.sh/hook-delete-policy": before-hook-creation +spec: + template: + metadata: + name: redis-clean-upgrade + annotations: + sidecar.istio.io/inject: 'false' + spec: + serviceAccountName: redis-upgrade-sa + imagePullSecrets: + {{- if .Values.global.imagePullSecrets }} + {{- range .Values.global.imagePullSecrets }} + {{- $credType := typeOf . -}} + {{- if eq $credType "map[string]interface {}" }} + - name: {{ get . "name" }} + {{- else }} + - name: {{ . }} + {{- end }} + {{- end }} + {{- end }} + restartPolicy: OnFailure + containers: + - name: redis-clean-upgrade + image: "registry1.dso.mil/ironbank/gitlab/gitlab/kubectl:13.9.0" + command: + - /bin/sh + - -c + - | + set -e + if [[ $(kubectl get statefulset -l app={{ include "common.names.name" . }} -n {{ .Release.Namespace }} 2> /dev/null | wc -l) -gt 0 ]]; then + kubectl delete statefulset -n {{ .Release.Namespace }} -l app={{ include "common.names.name" . }} + echo "Statefulsets cleaned up." + else + echo "No statefulsets to clean up." + fi + + if [[ $(kubectl get pvc -l app={{ include "common.names.name" . }} -n {{ .Release.Namespace }} 2> /dev/null | wc -l) -gt 0 ]]; then + kubectl delete pvc -n {{ .Release.Namespace }} -l app={{ include "common.names.name" . }} + echo "PVCs cleaned up." + else + echo "No PVCs to clean up." + fi + echo "Done with upgrade steps." +{{- end }} diff --git a/chart/deps/redis/templates/configmap-scripts.yaml b/chart/deps/redis/templates/configmap-scripts.yaml deleted file mode 100644 index 6d74027..0000000 --- a/chart/deps/redis/templates/configmap-scripts.yaml +++ /dev/null @@ -1,430 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: {{ template "redis.fullname" . }}-scripts - namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -data: -{{- if and .Values.cluster.enabled .Values.sentinel.enabled }} - start-node.sh: | - #!/bin/bash - - . /opt/bitnami/scripts/libos.sh - . /opt/bitnami/scripts/liblog.sh - . /opt/bitnami/scripts/libvalidations.sh - - not_exists_dns_entry() { - myip=$(hostname -i) - - if [[ -z "$(getent ahosts "$HEADLESS_SERVICE" | grep "^${myip}" )" ]]; then - warn "$HEADLESS_SERVICE does not contain the IP of this pod: ${myip}" - return 1 - fi - info "$HEADLESS_SERVICE has my IP: ${myip}" - return 0 - } - - HEADLESS_SERVICE="{{ template "redis.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" - REDIS_SERVICE="{{ template "redis.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" - - # Waits for DNS to add this ip to the service DNS entry - retry_while not_exists_dns_entry - - export REDIS_REPLICATION_MODE="slave" - if [[ -z "$(getent ahosts "$HEADLESS_SERVICE" | grep -v "^$(hostname -i) ")" ]]; then - export REDIS_REPLICATION_MODE="master" - fi - - {{- if and .Values.securityContext.runAsUser (eq (.Values.securityContext.runAsUser | int) 0) }} - useradd redis - chown -R redis {{ .Values.slave.persistence.path }} - {{- end }} - - if [[ -n $REDIS_PASSWORD_FILE ]]; then - password_aux=`cat ${REDIS_PASSWORD_FILE}` - export REDIS_PASSWORD=$password_aux - fi - - if [[ -n $REDIS_MASTER_PASSWORD_FILE ]]; then - password_aux=`cat ${REDIS_MASTER_PASSWORD_FILE}` - export REDIS_MASTER_PASSWORD=$password_aux - fi - - if [[ "$REDIS_REPLICATION_MODE" == "master" ]]; then - echo "I am master" - if [[ ! -f /opt/bitnami/redis/etc/master.conf ]];then - cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf - fi - else - if [[ ! -f /opt/bitnami/redis/etc/replica.conf ]];then - cp /opt/bitnami/redis/mounted-etc/replica.conf /opt/bitnami/redis/etc/replica.conf - fi - - if is_boolean_yes "$REDIS_TLS_ENABLED"; then - sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_SERVICE -p {{ .Values.sentinel.port }} --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" - else - sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_SERVICE -p {{ .Values.sentinel.port }} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" - fi - REDIS_SENTINEL_INFO=($($sentinel_info_command)) - REDIS_MASTER_HOST=${REDIS_SENTINEL_INFO[0]} - REDIS_MASTER_PORT_NUMBER=${REDIS_SENTINEL_INFO[1]} - - - # Immediately attempt to connect to the reported master. If it doesn't exist the connection attempt will either hang - # or fail with "port unreachable" and give no data. The liveness check will then timeout waiting for the redis - # container to be ready and restart the it. By then the new master will likely have been elected - if is_boolean_yes "$REDIS_TLS_ENABLED"; then - sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_MASTER_HOST -p {{ .Values.sentinel.port }} --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" - else - sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_MASTER_HOST -p {{ .Values.sentinel.port }} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" - fi - - if [[ ! ($($sentinel_info_command)) ]]; then - # master doesn't actually exist, this probably means the remaining pods haven't elected a new one yet - # and are reporting the old one still. Once this happens the container will get stuck and never see the new - # master. We stop here to allow the container to not pass the liveness check and be restarted. - exit 1 - fi - fi - - if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then - cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf - fi - {{- if .Values.tls.enabled }} - ARGS=("--port" "0") - ARGS+=("--tls-port" "${REDIS_TLS_PORT}") - ARGS+=("--tls-cert-file" "${REDIS_TLS_CERT_FILE}") - ARGS+=("--tls-key-file" "${REDIS_TLS_KEY_FILE}") - ARGS+=("--tls-ca-cert-file" "${REDIS_TLS_CA_FILE}") - ARGS+=("--tls-auth-clients" "${REDIS_TLS_AUTH_CLIENTS}") - ARGS+=("--tls-replication" "yes") - {{- if .Values.tls.dhParamsFilename }} - ARGS+=("--tls-dh-params-file" "${REDIS_TLS_DH_PARAMS_FILE}") - {{- end }} - {{- else }} - ARGS=("--port" "${REDIS_PORT}") - {{- end }} - - if [[ "$REDIS_REPLICATION_MODE" == "slave" ]]; then - ARGS+=("--slaveof" "${REDIS_MASTER_HOST}" "${REDIS_MASTER_PORT_NUMBER}") - fi - - {{- if .Values.usePassword }} - ARGS+=("--requirepass" "${REDIS_PASSWORD}") - ARGS+=("--masterauth" "${REDIS_MASTER_PASSWORD}") - {{- else }} - ARGS+=("--protected-mode" "no") - {{- end }} - - if [[ "$REDIS_REPLICATION_MODE" == "master" ]]; then - ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf") - else - ARGS+=("--include" "/opt/bitnami/redis/etc/replica.conf") - fi - - ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") - {{- if .Values.slave.extraFlags }} - {{- range .Values.slave.extraFlags }} - ARGS+=({{ . | quote }}) - {{- end }} - {{- end }} - - {{- if .Values.slave.preExecCmds }} - {{ .Values.slave.preExecCmds | nindent 4}} - {{- end }} - - {{- if .Values.slave.command }} - exec {{ .Values.slave.command }} "${ARGS[@]}" - {{- else }} - exec redis-server "${ARGS[@]}" - {{- end }} - - start-sentinel.sh: | - #!/bin/bash - - . /opt/bitnami/scripts/libos.sh - . /opt/bitnami/scripts/libvalidations.sh - . /opt/bitnami/scripts/libfile.sh - - sentinel_conf_set() { - local -r key="${1:?missing key}" - local value="${2:-}" - - # Sanitize inputs - value="${value//\\/\\\\}" - value="${value//&/\\&}" - value="${value//\?/\\?}" - [[ "$value" = "" ]] && value="\"$value\"" - - replace_in_file "/opt/bitnami/redis-sentinel/etc/sentinel.conf" "^#*\s*${key} .*" "${key} ${value}" false - } - sentinel_conf_add() { - echo $'\n'"$@" >> "/opt/bitnami/redis-sentinel/etc/sentinel.conf" - } - host_id() { - echo "$1" | openssl sha1 | awk '{print $2}' - } - not_exists_dns_entry() { - myip=$(hostname -i) - - if [[ -z "$(getent ahosts "$HEADLESS_SERVICE" | grep "^${myip}" )" ]]; then - warn "$HEADLESS_SERVICE does not contain the IP of this pod: ${myip}" - return 1 - fi - info "$HEADLESS_SERVICE has my IP: ${myip}" - return 0 - } - - HEADLESS_SERVICE="{{ template "redis.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" - REDIS_SERVICE="{{ template "redis.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" - - if [[ -n $REDIS_PASSWORD_FILE ]]; then - password_aux=`cat ${REDIS_PASSWORD_FILE}` - export REDIS_PASSWORD=$password_aux - fi - - if [[ ! -f /opt/bitnami/redis-sentinel/etc/sentinel.conf ]]; then - cp /opt/bitnami/redis-sentinel/mounted-etc/sentinel.conf /opt/bitnami/redis-sentinel/etc/sentinel.conf - {{- if .Values.usePassword }} - printf "\nsentinel auth-pass %s %s" "{{ .Values.sentinel.masterSet }}" "$REDIS_PASSWORD" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf - {{- if .Values.sentinel.usePassword }} - printf "\nrequirepass %s" "$REDIS_PASSWORD" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf - {{- end }} - {{- end }} - {{- if .Values.sentinel.staticID }} - printf "\nsentinel myid %s" "$(host_id "$HOSTNAME")" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf - {{- end }} - fi - - export REDIS_REPLICATION_MODE="slave" - - # Waits for DNS to add this ip to the service DNS entry - retry_while not_exists_dns_entry - - if [[ -z "$(getent ahosts "$HEADLESS_SERVICE" | grep -v "^$(hostname -i)")" ]]; then - export REDIS_REPLICATION_MODE="master" - fi - - # Clean sentineles from the current sentinel nodes - for node in $( getent ahosts "$HEADLESS_SERVICE" | grep -v "^$(hostname -i)" | cut -f 1 -d ' ' | uniq ); do - info "Cleaning sentinels in sentinel node: $node" - if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then - redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $node -p {{ .Values.sentinel.port }} --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel reset "*" - else - redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $node -p {{ .Values.sentinel.port }} sentinel reset "*" - fi - sleep {{ .Values.sentinel.cleanDelaySeconds }} - done - info "Sentinels clean up done" - - if [[ "$REDIS_REPLICATION_MODE" == "master" ]]; then - REDIS_MASTER_HOST="$(hostname -i)" - REDIS_MASTER_PORT_NUMBER="{{ .Values.redisPort }}" - else - if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then - sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_SERVICE -p {{ .Values.sentinel.port }} --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" - else - sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_SERVICE -p {{ .Values.sentinel.port }} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" - fi - REDIS_SENTINEL_INFO=($($sentinel_info_command)) - REDIS_MASTER_HOST=${REDIS_SENTINEL_INFO[0]} - REDIS_MASTER_PORT_NUMBER=${REDIS_SENTINEL_INFO[1]} - - # Immediately attempt to connect to the reported master. If it doesn't exist the connection attempt will either hang - # or fail with "port unreachable" and give no data. The liveness check will then timeout waiting for the sentinel - # container to be ready and restart the it. By then the new master will likely have been elected - if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then - sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_MASTER_HOST -p {{ .Values.sentinel.port }} --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" - else - sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_MASTER_HOST -p {{ .Values.sentinel.port }} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" - fi - - if [[ ! ($($sentinel_info_command)) ]]; then - # master doesn't actually exist, this probably means the remaining pods haven't elected a new one yet - # and are reporting the old one still. Once this happens the container will get stuck and never see the new - # master. We stop here to allow the container to not pass the liveness check and be restarted. - exit 1 - fi - fi - sentinel_conf_set "sentinel monitor" "{{ .Values.sentinel.masterSet }} "$REDIS_MASTER_HOST" "$REDIS_MASTER_PORT_NUMBER" {{ .Values.sentinel.quorum }}" - - add_replica() { - if [[ "$1" != "$REDIS_MASTER_HOST" ]]; then - sentinel_conf_add "sentinel known-replica {{ .Values.sentinel.masterSet }} $1 {{ .Values.redisPort }}" - fi - } - - {{- if .Values.sentinel.staticID }} - # remove generated known sentinels and replicas - tmp="$(sed -e '/^sentinel known-/d' -e '/^$/d' /opt/bitnami/redis-sentinel/etc/sentinel.conf)" - echo "$tmp" > /opt/bitnami/redis-sentinel/etc/sentinel.conf - - for node in $(seq 0 {{ .Values.cluster.slaveCount }}); do - NAME="{{ template "redis.fullname" . }}-node-$node" - IP="$(getent hosts "$NAME.$HEADLESS_SERVICE" | awk ' {print $1 }')" - if [[ "$NAME" != "$HOSTNAME" && -n "$IP" ]]; then - sentinel_conf_add "sentinel known-sentinel {{ .Values.sentinel.masterSet }} $IP {{ .Values.sentinel.port }} $(host_id "$NAME")" - add_replica "$IP" - fi - done - add_replica "$(hostname -i)" - {{- end }} - - {{- if .Values.tls.enabled }} - ARGS=("--port" "0") - ARGS+=("--tls-port" "${REDIS_SENTINEL_TLS_PORT_NUMBER}") - ARGS+=("--tls-cert-file" "${REDIS_SENTINEL_TLS_CERT_FILE}") - ARGS+=("--tls-key-file" "${REDIS_SENTINEL_TLS_KEY_FILE}") - ARGS+=("--tls-ca-cert-file" "${REDIS_SENTINEL_TLS_CA_FILE}") - ARGS+=("--tls-replication" "yes") - ARGS+=("--tls-auth-clients" "${REDIS_SENTINEL_TLS_AUTH_CLIENTS}") - {{- if .Values.tls.dhParamsFilename }} - ARGS+=("--tls-dh-params-file" "${REDIS_SENTINEL_TLS_DH_PARAMS_FILE}") - {{- end }} - {{- end }} - {{- if .Values.sentinel.preExecCmds }} - {{ .Values.sentinel.preExecCmds | nindent 4 }} - {{- end }} - exec redis-server /opt/bitnami/redis-sentinel/etc/sentinel.conf --sentinel {{- if .Values.tls.enabled }} "${ARGS[@]}" {{- end }} - prestop-sentinel.sh: | - #!/bin/bash - - . /opt/bitnami/scripts/libvalidations.sh - - REDIS_SERVICE="{{ include "redis.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" - - if [[ -n "$REDIS_PASSWORD_FILE" ]]; then - password_aux=$(cat "$REDIS_PASSWORD_FILE") - export REDIS_PASSWORD="$password_aux" - fi - - if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then - sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a ${REDIS_PASSWORD} {{- end }} -h ${REDIS_SERVICE} -p {{ .Values.sentinel.port }} --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" - else - sentinel_info_command="redis-cli {{- if .Values.usePassword }} -a ${REDIS_PASSWORD} {{- end }} -h ${REDIS_SERVICE} -p {{ .Values.sentinel.port }} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" - fi - REDIS_SENTINEL_INFO=($($sentinel_info_command)) - REDIS_MASTER_HOST="${REDIS_SENTINEL_INFO[0]}" - - if [[ "$REDIS_MASTER_HOST" == "$(hostname -i)" ]]; then - if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then - redis-cli {{- if .Values.usePassword }} -a "$REDIS_PASSWORD" {{- end }} -h "$REDIS_SERVICE" -p {{ .Values.sentinel.port }} --tls --cert "$REDIS_SENTINEL_TLS_CERT_FILE" --key "$REDIS_SENTINEL_TLS_KEY_FILE" --cacert "$REDIS_SENTINEL_TLS_CA_FILE" sentinel failover mymaster - else - redis-cli {{- if .Values.usePassword }} -a "$REDIS_PASSWORD" {{- end }} -h "$REDIS_SERVICE" -p {{ .Values.sentinel.port }} sentinel failover mymaster - fi - fi -{{- else }} - start-master.sh: | - #!/bin/bash - {{- if and .Values.securityContext.runAsUser (eq (.Values.securityContext.runAsUser | int) 0) }} - useradd redis - chown -R redis {{ .Values.master.persistence.path }} - {{- end }} - if [[ -n $REDIS_PASSWORD_FILE ]]; then - password_aux=`cat ${REDIS_PASSWORD_FILE}` - export REDIS_PASSWORD=$password_aux - fi - if [[ ! -f /opt/bitnami/redis/etc/master.conf ]];then - cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf - fi - if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then - cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf - fi - {{- if .Values.tls.enabled }} - ARGS=("--port" "0") - ARGS+=("--tls-port" "${REDIS_TLS_PORT}") - ARGS+=("--tls-cert-file" "${REDIS_TLS_CERT_FILE}") - ARGS+=("--tls-key-file" "${REDIS_TLS_KEY_FILE}") - ARGS+=("--tls-ca-cert-file" "${REDIS_TLS_CA_FILE}") - ARGS+=("--tls-auth-clients" "${REDIS_TLS_AUTH_CLIENTS}") - {{- if .Values.tls.dhParamsFilename }} - ARGS+=("--tls-dh-params-file" "${REDIS_TLS_DH_PARAMS_FILE}") - {{- end }} - {{- else }} - ARGS=("--port" "${REDIS_PORT}") - {{- end }} - {{- if .Values.usePassword }} - ARGS+=("--requirepass" "${REDIS_PASSWORD}") - ARGS+=("--masterauth" "${REDIS_PASSWORD}") - {{- else }} - ARGS+=("--protected-mode" "no") - {{- end }} - ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") - ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf") - {{- if .Values.master.extraFlags }} - {{- range .Values.master.extraFlags }} - ARGS+=({{ . | quote }}) - {{- end }} - {{- end }} - {{- if .Values.master.preExecCmds }} - {{ .Values.master.preExecCmds | nindent 4}} - {{- end }} - {{- if .Values.master.command }} - exec {{ .Values.master.command }} "${ARGS[@]}" - {{- else }} - exec redis-server "${ARGS[@]}" - {{- end }} - {{- if .Values.cluster.enabled }} - start-slave.sh: | - #!/bin/bash - {{- if and .Values.securityContext.runAsUser (eq (.Values.securityContext.runAsUser | int) 0) }} - useradd redis - chown -R redis {{ .Values.slave.persistence.path }} - {{- end }} - if [[ -n $REDIS_PASSWORD_FILE ]]; then - password_aux=`cat ${REDIS_PASSWORD_FILE}` - export REDIS_PASSWORD=$password_aux - fi - if [[ -n $REDIS_MASTER_PASSWORD_FILE ]]; then - password_aux=`cat ${REDIS_MASTER_PASSWORD_FILE}` - export REDIS_MASTER_PASSWORD=$password_aux - fi - if [[ ! -f /opt/bitnami/redis/etc/replica.conf ]];then - cp /opt/bitnami/redis/mounted-etc/replica.conf /opt/bitnami/redis/etc/replica.conf - fi - if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then - cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf - fi - {{- if .Values.tls.enabled }} - ARGS=("--port" "0") - ARGS+=("--tls-port" "${REDIS_TLS_PORT}") - ARGS+=("--tls-cert-file" "${REDIS_TLS_CERT_FILE}") - ARGS+=("--tls-key-file" "${REDIS_TLS_KEY_FILE}") - ARGS+=("--tls-ca-cert-file" "${REDIS_TLS_CA_FILE}") - ARGS+=("--tls-auth-clients" "${REDIS_TLS_AUTH_CLIENTS}") - ARGS+=("--tls-replication" "yes") - {{- if .Values.tls.dhParamsFilename }} - ARGS+=("--tls-dh-params-file" "${REDIS_TLS_DH_PARAMS_FILE}") - {{- end }} - {{- else }} - ARGS=("--port" "${REDIS_PORT}") - {{- end }} - ARGS+=("--slaveof" "${REDIS_MASTER_HOST}" "${REDIS_MASTER_PORT_NUMBER}") - {{- if .Values.usePassword }} - ARGS+=("--requirepass" "${REDIS_PASSWORD}") - ARGS+=("--masterauth" "${REDIS_MASTER_PASSWORD}") - {{- else }} - ARGS+=("--protected-mode" "no") - {{- end }} - ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") - ARGS+=("--include" "/opt/bitnami/redis/etc/replica.conf") - {{- if .Values.slave.extraFlags }} - {{- range .Values.slave.extraFlags }} - ARGS+=({{ . | quote }}) - {{- end }} - {{- end }} - {{- if .Values.slave.preExecCmds }} - {{ .Values.slave.preExecCmds | nindent 4}} - {{- end }} - {{- if .Values.slave.command }} - exec {{ .Values.slave.command }} "${ARGS[@]}" - {{- else }} - exec redis-server "${ARGS[@]}" - {{- end }} - {{- end }} - -{{- end -}} diff --git a/chart/deps/redis/templates/configmap.yaml b/chart/deps/redis/templates/configmap.yaml index 77bdc81..220c11f 100644 --- a/chart/deps/redis/templates/configmap.yaml +++ b/chart/deps/redis/templates/configmap.yaml @@ -1,53 +1,61 @@ +{{- if (include "redis.createConfigmap" .) }} apiVersion: v1 kind: ConfigMap metadata: - name: {{ template "redis.fullname" . }} + name: {{ printf "%s-configuration" (include "common.names.fullname" .) }} namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} data: redis.conf: |- -{{- if .Values.configmap }} - # User-supplied configuration: -{{- tpl .Values.configmap . | nindent 4 }} -{{- end }} + # User-supplied common configuration: + {{- if .Values.commonConfiguration }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonConfiguration "context" $ ) | nindent 4 }} + {{- end }} + # End of common configuration master.conf: |- dir {{ .Values.master.persistence.path }} -{{- if .Values.master.configmap }} # User-supplied master configuration: -{{- tpl .Values.master.configmap . | nindent 4 }} -{{- end }} -{{- if .Values.master.disableCommands }} -{{- range .Values.master.disableCommands }} + {{- if .Values.master.configuration }} + {{- include "common.tplvalues.render" ( dict "value" .Values.master.configuration "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.master.disableCommands }} + {{- range .Values.master.disableCommands }} rename-command {{ . }} "" -{{- end }} -{{- end }} + {{- end }} + {{- end }} + # End of master configuration replica.conf: |- - dir {{ .Values.slave.persistence.path }} + dir {{ .Values.replica.persistence.path }} slave-read-only yes -{{- if .Values.slave.configmap }} - # User-supplied slave configuration: -{{- tpl .Values.slave.configmap . | nindent 4 }} -{{- end }} -{{- if .Values.slave.disableCommands }} -{{- range .Values.slave.disableCommands }} + # User-supplied replica configuration: + {{- if .Values.replica.configuration }} + {{- include "common.tplvalues.render" ( dict "value" .Values.replica.configuration "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.replica.disableCommands }} + {{- range .Values.replica.disableCommands }} rename-command {{ . }} "" -{{- end }} -{{- end }} -{{- if .Values.sentinel.enabled }} + {{- end }} + {{- end }} + # End of replica configuration + {{- if .Values.sentinel.enabled }} sentinel.conf: |- dir "/tmp" bind 0.0.0.0 - port {{ .Values.sentinel.port }} - sentinel monitor {{ .Values.sentinel.masterSet }} {{ template "redis.fullname" . }}-node-0.{{ template "redis.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} {{ .Values.redisPort }} {{ .Values.sentinel.quorum }} + port {{ .Values.sentinel.containerPort }} + sentinel monitor {{ .Values.sentinel.masterSet }} {{ template "common.names.fullname" . }}-node-0.{{ template "common.names.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} {{ .Values.sentinel.service.port }} {{ .Values.sentinel.quorum }} sentinel down-after-milliseconds {{ .Values.sentinel.masterSet }} {{ .Values.sentinel.downAfterMilliseconds }} sentinel failover-timeout {{ .Values.sentinel.masterSet }} {{ .Values.sentinel.failoverTimeout }} sentinel parallel-syncs {{ .Values.sentinel.masterSet }} {{ .Values.sentinel.parallelSyncs }} -{{- if .Values.sentinel.configmap }} # User-supplied sentinel configuration: -{{- tpl .Values.sentinel.configmap . | nindent 4 }} -{{- end }} + {{- if .Values.sentinel.configuration }} + {{- include "common.tplvalues.render" ( dict "value" .Values.sentinel.configuration "context" $ ) | nindent 4 }} + {{- end }} + # End of sentinel configuration + {{- end }} {{- end }} diff --git a/chart/deps/redis/templates/extra-list.yaml b/chart/deps/redis/templates/extra-list.yaml new file mode 100644 index 0000000..9ac65f9 --- /dev/null +++ b/chart/deps/redis/templates/extra-list.yaml @@ -0,0 +1,4 @@ +{{- range .Values.extraDeploy }} +--- +{{ include "common.tplvalues.render" (dict "value" . "context" $) }} +{{- end }} diff --git a/chart/deps/redis/templates/headless-svc.yaml b/chart/deps/redis/templates/headless-svc.yaml index d758c0d..f579c22 100644 --- a/chart/deps/redis/templates/headless-svc.yaml +++ b/chart/deps/redis/templates/headless-svc.yaml @@ -1,13 +1,15 @@ apiVersion: v1 kind: Service metadata: - name: {{ template "redis.fullname" . }}-headless + name: {{ printf "%s-headless" (include "common.names.fullname" .) }} namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} spec: type: ClusterIP clusterIP: None @@ -16,13 +18,11 @@ spec: {{- end }} ports: - name: tcp-redis - port: {{ .Values.redisPort }} + port: {{ if .Values.sentinel.enabled }}{{ .Values.sentinel.service.port }}{{ else }}{{ .Values.master.service.port }}{{ end }} targetPort: redis - {{- if .Values.sentinel.enabled }} + {{- if .Values.sentinel.enabled }} - name: tcp-sentinel - port: {{ .Values.sentinel.port }} - targetPort: redis-sentinel - {{- end }} - selector: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} + port: {{ .Values.sentinel.service.sentinelPort }} + targetPort: sentinel + {{- end }} + selector: {{- include "common.labels.matchLabels" . | nindent 4 }} diff --git a/chart/deps/redis/templates/health-configmap.yaml b/chart/deps/redis/templates/health-configmap.yaml index 1bb8e74..c284ca4 100644 --- a/chart/deps/redis/templates/health-configmap.yaml +++ b/chart/deps/redis/templates/health-configmap.yaml @@ -1,20 +1,20 @@ apiVersion: v1 kind: ConfigMap metadata: - name: {{ template "redis.fullname" . }}-health + name: {{ printf "%s-health" (include "common.names.fullname" .) }} namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} data: ping_readiness_local.sh: |- #!/bin/bash -{{- if .Values.usePasswordFile }} - password_aux=`cat ${REDIS_PASSWORD_FILE}` - export REDIS_PASSWORD=$password_aux -{{- end }} + + [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" export REDISCLI_AUTH="$REDIS_PASSWORD" response=$( timeout -s 3 $1 \ @@ -39,10 +39,8 @@ data: fi ping_liveness_local.sh: |- #!/bin/bash -{{- if .Values.usePasswordFile }} - password_aux=`cat ${REDIS_PASSWORD_FILE}` - export REDIS_PASSWORD=$password_aux -{{- end }} + + [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" export REDISCLI_AUTH="$REDIS_PASSWORD" response=$( timeout -s 3 $1 \ @@ -68,10 +66,8 @@ data: {{- if .Values.sentinel.enabled }} ping_sentinel.sh: |- #!/bin/bash -{{- if .Values.usePasswordFile }} - password_aux=`cat ${REDIS_PASSWORD_FILE}` - export REDIS_PASSWORD=$password_aux -{{- end }} + + [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" export REDISCLI_AUTH="$REDIS_PASSWORD" response=$( timeout -s 3 $1 \ @@ -112,10 +108,8 @@ data: {{- end }} ping_readiness_master.sh: |- #!/bin/bash -{{- if .Values.usePasswordFile }} - password_aux=`cat ${REDIS_MASTER_PASSWORD_FILE}` - export REDIS_MASTER_PASSWORD=$password_aux -{{- end }} + + [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD" response=$( timeout -s 3 $1 \ @@ -138,10 +132,8 @@ data: fi ping_liveness_master.sh: |- #!/bin/bash -{{- if .Values.usePasswordFile }} - password_aux=`cat ${REDIS_MASTER_PASSWORD_FILE}` - export REDIS_MASTER_PASSWORD=$password_aux -{{- end }} + + [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" export REDISCLI_AUTH="$REDIS_MASTER_PASSWORD" response=$( timeout -s 3 $1 \ diff --git a/chart/deps/redis/templates/master/psp.yaml b/chart/deps/redis/templates/master/psp.yaml new file mode 100644 index 0000000..161ee09 --- /dev/null +++ b/chart/deps/redis/templates/master/psp.yaml @@ -0,0 +1,45 @@ +{{- if .Values.podSecurityPolicy.create }} +apiVersion: {{ template "podSecurityPolicy.apiVersion" . }} +kind: PodSecurityPolicy +metadata: + name: {{ printf "%s-master" (include "common.names.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + allowPrivilegeEscalation: false + fsGroup: + rule: 'MustRunAs' + ranges: + - min: {{ .Values.master.podSecurityContext.fsGroup }} + max: {{ .Values.master.podSecurityContext.fsGroup }} + hostIPC: false + hostNetwork: false + hostPID: false + privileged: false + readOnlyRootFilesystem: false + requiredDropCapabilities: + - ALL + runAsUser: + rule: 'MustRunAs' + ranges: + - min: {{ .Values.master.containerSecurityContext.runAsUser }} + max: {{ .Values.master.containerSecurityContext.runAsUser }} + seLinux: + rule: 'RunAsAny' + supplementalGroups: + rule: 'MustRunAs' + ranges: + - min: {{ .Values.master.containerSecurityContext.runAsUser }} + max: {{ .Values.master.containerSecurityContext.runAsUser }} + volumes: + - 'configMap' + - 'secret' + - 'emptyDir' + - 'persistentVolumeClaim' +{{- end }} diff --git a/chart/deps/redis/templates/master/service.yaml b/chart/deps/redis/templates/master/service.yaml new file mode 100644 index 0000000..c253d1d --- /dev/null +++ b/chart/deps/redis/templates/master/service.yaml @@ -0,0 +1,46 @@ +{{- if not .Values.sentinel.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ printf "%s-master" (include "common.names.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: master + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if or .Values.master.service.annotations .Values.commonAnnotations }} + annotations: + {{- if .Values.master.service.annotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.master.service.annotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +spec: + type: {{ .Values.master.service.type }} + {{ if eq .Values.master.service.type "LoadBalancer" }} + externalTrafficPolicy: {{ .Values.master.service.externalTrafficPolicy }} + {{- end }} + {{- if and (eq .Values.master.service.type "LoadBalancer") .Values.master.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.master.service.loadBalancerIP }} + {{- end }} + {{- if and (eq .Values.master.service.type "LoadBalancer") .Values.master.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: {{- toYaml .Values.master.service.loadBalancerSourceRanges | nindent 4 }} + {{- end }} + {{- if and (eq .Values.master.service.type "ClusterIP") .Values.master.service.clusterIP }} + clusterIP: {{ .Values.master.service.clusterIP }} + {{- end }} + ports: + - name: tcp-redis + port: {{ .Values.master.service.port }} + targetPort: redis + {{- if and (or (eq .Values.master.service.type "NodePort") (eq .Values.master.service.type "LoadBalancer")) .Values.master.service.nodePort }} + nodePort: {{ .Values.master.service.nodePort }} + {{- else if eq .Values.master.service.type "ClusterIP" }} + nodePort: null + {{- end }} + selector: {{- include "common.labels.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: master +{{- end }} diff --git a/chart/deps/redis/templates/master/statefulset.yaml b/chart/deps/redis/templates/master/statefulset.yaml new file mode 100644 index 0000000..8ea35bd --- /dev/null +++ b/chart/deps/redis/templates/master/statefulset.yaml @@ -0,0 +1,402 @@ +{{- if or (not (eq .Values.architecture "replication")) (not .Values.sentinel.enabled) }} +apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} +kind: StatefulSet +metadata: + name: {{ printf "%s-master" (include "common.names.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: master + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: master + serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) }} + {{- if .Values.master.updateStrategy }} + updateStrategy: {{- toYaml .Values.master.updateStrategy | nindent 4 }} + {{- end }} + template: + metadata: + labels: {{- include "common.labels.standard" . | nindent 8 }} + app.kubernetes.io/component: master + {{- if .Values.master.podLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.master.podLabels "context" $ ) | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.podLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.podLabels "context" $ ) | nindent 8 }} + {{- end }} + annotations: + {{- if (include "redis.createConfigmap" .) }} + checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + {{- end }} + checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }} + checksum/scripts: {{ include (print $.Template.BasePath "/scripts-configmap.yaml") . | sha256sum }} + checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} + {{- if .Values.master.podAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.master.podAnnotations "context" $ ) | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.podAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.podAnnotations "context" $ ) | nindent 8 }} + {{- end }} + spec: + {{- include "redis.imagePullSecrets" . | nindent 6 }} + {{- if .Values.master.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.master.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.master.podSecurityContext.enabled }} + securityContext: {{- omit .Values.master.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + serviceAccountName: {{ template "redis.serviceAccountName" . }} + {{- if .Values.master.priorityClassName }} + priorityClassName: {{ .Values.master.priorityClassName | quote }} + {{- end }} + {{- if .Values.master.affinity }} + affinity: {{- include "common.tplvalues.render" (dict "value" .Values.master.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.master.podAffinityPreset "component" "master" "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.master.podAntiAffinityPreset "component" "master" "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.master.nodeAffinityPreset.type "key" .Values.master.nodeAffinityPreset.key "values" .Values.master.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.master.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.master.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.master.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.master.tolerations "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.master.spreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.master.spreadConstraints "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.master.shareProcessNamespace }} + shareProcessNamespace: {{ .Values.master.shareProcessNamespace }} + {{- end }} + {{- if .Values.master.schedulerName }} + schedulerName: {{ .Values.master.schedulerName | quote }} + {{- end }} + terminationGracePeriodSeconds: {{ .Values.master.terminationGracePeriodSeconds }} + containers: + - name: redis + image: {{ template "redis.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + {{- if .Values.master.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.master.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.master.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.master.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.master.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.master.command "context" $) | nindent 12 }} + {{- else }} + command: + - /bin/bash + {{- end }} + {{- if .Values.master.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.master.args "context" $) | nindent 12 }} + {{- else }} + args: + - -c + - /opt/bitnami/scripts/start-scripts/start-master.sh + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.image.debug | quote }} + - name: REDIS_REPLICATION_MODE + value: master + - name: ALLOW_EMPTY_PASSWORD + value: {{ ternary "no" "yes" .Values.auth.enabled | quote }} + {{- if .Values.auth.enabled }} + {{- if .Values.auth.usePasswordFiles }} + - name: REDIS_PASSWORD_FILE + value: "/opt/bitnami/redis/secrets/redis-password" + {{- else }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + {{- end }} + {{- end }} + - name: REDIS_TLS_ENABLED + value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} + {{- if .Values.tls.enabled }} + - name: REDIS_TLS_PORT + value: {{ .Values.master.containerPort | quote }} + - name: REDIS_TLS_AUTH_CLIENTS + value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} + - name: REDIS_TLS_CERT_FILE + value: {{ template "redis.tlsCert" . }} + - name: REDIS_TLS_KEY_FILE + value: {{ template "redis.tlsCertKey" . }} + - name: REDIS_TLS_CA_FILE + value: {{ template "redis.tlsCACert" . }} + {{- if .Values.tls.dhParamsFilename }} + - name: REDIS_TLS_DH_PARAMS_FILE + value: {{ template "redis.tlsDHParams" . }} + {{- end }} + {{- else }} + - name: REDIS_PORT + value: {{ .Values.master.containerPort | quote }} + {{- end }} + {{- if .Values.master.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.master.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.master.extraEnvVarsCM .Values.master.extraEnvVarsSecret }} + envFrom: + {{- if .Values.master.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.master.extraEnvVarsCM }} + {{- end }} + {{- if .Values.master.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.master.extraEnvVarsSecret }} + {{- end }} + {{- end }} + ports: + - name: redis + containerPort: {{ .Values.master.containerPort }} + {{- if .Values.master.livenessProbe.enabled }} + livenessProbe: + initialDelaySeconds: {{ .Values.master.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.master.livenessProbe.periodSeconds }} + # One second longer than command timeout should prevent generation of zombie processes. + timeoutSeconds: {{ add1 .Values.master.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.master.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.master.livenessProbe.failureThreshold }} + exec: + command: + - sh + - -c + - /health/ping_liveness_local.sh {{ .Values.master.livenessProbe.timeoutSeconds }} + {{- else if .Values.master.customLivenessProbe }} + livenessProbe: {{- toYaml .Values.master.customLivenessProbe | nindent 12 }} + {{- end }} + {{- if .Values.master.readinessProbe.enabled}} + readinessProbe: + initialDelaySeconds: {{ .Values.master.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.master.readinessProbe.periodSeconds }} + timeoutSeconds: {{ add1 .Values.master.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.master.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.master.readinessProbe.failureThreshold }} + exec: + command: + - sh + - -c + - /health/ping_readiness_local.sh {{ .Values.master.readinessProbe.timeoutSeconds }} + {{- else if .Values.master.customReadinessProbe }} + readinessProbe: {{- toYaml .Values.master.customReadinessProbe | nindent 12 }} + {{- end }} + {{- if .Values.master.resources }} + resources: {{- toYaml .Values.master.resources | nindent 12 }} + {{- end }} + volumeMounts: + - name: start-scripts + mountPath: /opt/bitnami/scripts/start-scripts + - name: health + mountPath: /health + {{- if .Values.auth.usePasswordFiles }} + - name: redis-password + mountPath: /opt/bitnami/redis/secrets/ + {{- end }} + - name: redis-data + mountPath: {{ .Values.master.persistence.path }} + subPath: {{ .Values.master.persistence.subPath }} + - name: config + mountPath: /opt/bitnami/redis/mounted-etc + - name: redis-tmp-conf + mountPath: /opt/bitnami/redis/etc/ + - name: tmp + mountPath: /tmp + {{- if .Values.tls.enabled }} + - name: redis-certificates + mountPath: /opt/bitnami/redis/certs + readOnly: true + {{- end }} + {{- if .Values.master.extraVolumeMounts }} + {{- include "common.tplvalues.render" ( dict "value" .Values.master.extraVolumeMounts "context" $ ) | nindent 12 }} + {{- end }} + {{- if .Values.metrics.enabled }} + - name: metrics + image: {{ include "redis.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + {{- if .Values.metrics.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.metrics.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + command: + - /bin/bash + - -c + - | + if [[ -f '/secrets/redis-password' ]]; then + export REDIS_PASSWORD=$(cat /secrets/redis-password) + fi + redis_exporter{{- range $key, $value := .Values.metrics.extraArgs }} --{{ $key }}={{ $value }}{{- end }} + env: + - name: REDIS_ALIAS + value: {{ template "common.names.fullname" . }} + {{- if .Values.auth.enabled }} + - name: REDIS_USER + value: default + {{- if (not .Values.auth.usePasswordFiles) }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + {{- end }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: REDIS_ADDR + value: rediss://{{ .Values.metrics.redisTargetHost }}:{{ .Values.master.containerPort }} + {{- if .Values.tls.authClients }} + - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE + value: {{ template "redis.tlsCertKey" . }} + - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE + value: {{ template "redis.tlsCert" . }} + {{- end }} + - name: REDIS_EXPORTER_TLS_CA_CERT_FILE + value: {{ template "redis.tlsCACert" . }} + {{- end }} + ports: + - name: metrics + containerPort: 9121 + {{- if .Values.metrics.resources }} + resources: {{- toYaml .Values.metrics.resources | nindent 12 }} + {{- end }} + volumeMounts: + {{- if .Values.auth.usePasswordFiles }} + - name: redis-password + mountPath: /secrets/ + {{- end }} + {{- if .Values.tls.enabled }} + - name: redis-certificates + mountPath: /opt/bitnami/redis/certs + readOnly: true + {{- end }} + {{- end }} + {{- if .Values.master.sidecars }} + {{- include "common.tplvalues.render" (dict "value" .Values.master.sidecars "context" $) | nindent 8 }} + {{- end }} + {{- $needsVolumePermissions := and .Values.volumePermissions.enabled .Values.master.persistence.enabled .Values.master.podSecurityContext.enabled .Values.master.containerSecurityContext.enabled }} + {{- if or .Values.master.initContainers $needsVolumePermissions .Values.sysctl.enabled }} + initContainers: + {{- if .Values.master.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.master.initContainers "context" $) | nindent 8 }} + {{- end }} + {{- if $needsVolumePermissions }} + - name: volume-permissions + image: {{ include "redis.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: + - /bin/bash + - -ec + - | + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + chown -R `id -u`:`id -G | cut -d " " -f2` {{ .Values.master.persistence.path }} + {{- else }} + chown -R {{ .Values.master.containerSecurityContext.runAsUser }}:{{ .Values.master.podSecurityContext.fsGroup }} {{ .Values.master.persistence.path }} + {{- end }} + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "runAsUser" | toYaml | nindent 12 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.volumePermissions.resources }} + resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} + {{- end }} + volumeMounts: + - name: redis-data + mountPath: {{ .Values.master.persistence.path }} + subPath: {{ .Values.master.persistence.subPath }} + {{- end }} + {{- if .Values.sysctl.enabled }} + - name: init-sysctl + image: {{ include "redis.sysctl.image" . }} + imagePullPolicy: {{ default "" .Values.sysctl.image.pullPolicy | quote }} + securityContext: + privileged: true + runAsUser: 0 + {{- if .Values.sysctl.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.sysctl.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.sysctl.resources }} + resources: {{- toYaml .Values.sysctl.resources | nindent 12 }} + {{- end }} + {{- if .Values.sysctl.mountHostSys }} + volumeMounts: + - name: host-sys + mountPath: /host-sys + {{- end }} + {{- end }} + {{- end }} + volumes: + - name: start-scripts + configMap: + name: {{ printf "%s-scripts" (include "common.names.fullname" .) }} + defaultMode: 0755 + - name: health + configMap: + name: {{ printf "%s-health" (include "common.names.fullname" .) }} + defaultMode: 0755 + {{- if .Values.auth.usePasswordFiles }} + - name: redis-password + secret: + secretName: {{ template "redis.secretName" . }} + items: + - key: {{ template "redis.secretPasswordKey" . }} + path: redis-password + {{- end }} + - name: config + configMap: + name: {{ include "redis.configmapName" . }} + {{- if .Values.sysctl.mountHostSys }} + - name: host-sys + hostPath: + path: /sys + {{- end }} + - name: redis-tmp-conf + emptyDir: {} + - name: tmp + emptyDir: {} + {{- if .Values.tls.enabled }} + - name: redis-certificates + secret: + secretName: {{ required "A secret containing the certificates for the TLS traffic is required when TLS in enabled" .Values.tls.certificatesSecret }} + defaultMode: 256 + {{- end }} + {{- if .Values.master.extraVolumes }} + {{- include "common.tplvalues.render" ( dict "value" .Values.master.extraVolumes "context" $ ) | nindent 8 }} + {{- end }} + {{- if not .Values.master.persistence.enabled }} + - name: redis-data + emptyDir: {} + {{- else if .Values.master.persistence.existingClaim }} + - name: redis-data + persistentVolumeClaim: + claimName: {{ printf "%s" (tpl .Values.master.persistence.existingClaim .) }} + {{- else }} + volumeClaimTemplates: + - metadata: + name: redis-data + labels: {{- include "common.labels.matchLabels" . | nindent 10 }} + app.kubernetes.io/component: master + {{- if .Values.master.persistence.annotations }} + annotations: {{- toYaml .Values.master.persistence.annotations | nindent 10 }} + {{- end }} + spec: + accessModes: + {{- range .Values.master.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.master.persistence.size | quote }} + {{- if .Values.master.persistence.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.master.persistence.selector "context" $) | nindent 10 }} + {{- end }} + {{- include "common.storage.class" (dict "persistence" .Values.master.persistence "global" .Values.global) | nindent 8 }} + {{- end }} +{{- end }} diff --git a/chart/deps/redis/templates/metrics-prometheus.yaml b/chart/deps/redis/templates/metrics-prometheus.yaml deleted file mode 100644 index ed53dc6..0000000 --- a/chart/deps/redis/templates/metrics-prometheus.yaml +++ /dev/null @@ -1,39 +0,0 @@ -{{- if and (.Values.metrics.enabled) (.Values.metrics.serviceMonitor.enabled) }} -apiVersion: monitoring.coreos.com/v1 -kind: ServiceMonitor -metadata: - name: {{ template "redis.fullname" . }} - {{- if .Values.metrics.serviceMonitor.namespace }} - namespace: {{ .Values.metrics.serviceMonitor.namespace }} - {{- else }} - namespace: {{ .Release.Namespace | quote }} - {{- end }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- range $key, $value := .Values.metrics.serviceMonitor.selector }} - {{ $key }}: {{ $value | quote }} - {{- end }} -spec: - endpoints: - - port: metrics - {{- if .Values.metrics.serviceMonitor.interval }} - interval: {{ .Values.metrics.serviceMonitor.interval }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.relabelings }} - relabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.relabelings "context" $) | nindent 6 }} - {{- end }} - {{- if .Values.metrics.serviceMonitor.metricRelabelings }} - metricRelabelings: {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.serviceMonitor.metricRelabelings "context" $) | nindent 6 }} - {{- end }} - selector: - matchLabels: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} - app.kubernetes.io/component: "metrics" - namespaceSelector: - matchNames: - - {{ .Release.Namespace }} -{{- end -}} diff --git a/chart/deps/redis/templates/metrics-sentinel-svc.yaml b/chart/deps/redis/templates/metrics-sentinel-svc.yaml new file mode 100644 index 0000000..cea413c --- /dev/null +++ b/chart/deps/redis/templates/metrics-sentinel-svc.yaml @@ -0,0 +1,38 @@ +{{- if and .Values.sentinel.enabled .Values.metrics.sentinel.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ printf "%s-sentinel-metrics" (include "common.names.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: sentinel-metrics + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if or .Values.metrics.sentinel.service.annotations .Values.commonAnnotations }} + annotations: + {{- if .Values.metrics.sentinel.service.annotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.sentinel.service.annotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +spec: + type: {{ .Values.metrics.sentinel.service.type }} + {{- if eq .Values.metrics.sentinel.service.type "LoadBalancer" }} + externalTrafficPolicy: {{ .Values.metrics.sentinel.service.externalTrafficPolicy }} + {{- end }} + {{- if and (eq .Values.metrics.sentinel.service.type "LoadBalancer") .Values.metrics.sentinel.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.metrics.sentinel.service.loadBalancerIP }} + {{- end }} + {{- if and (eq .Values.metrics.sentinel.service.type "LoadBalancer") .Values.metrics.sentinel.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: {{- toYaml .Values.metrics.sentinel.service.loadBalancerSourceRanges | nindent 4 }} + {{- end }} + ports: + - name: tcp-metrics + port: {{ .Values.metrics.sentinel.service.port }} + protocol: TCP + targetPort: sentinelmetrics + selector: {{- include "common.labels.matchLabels" . | nindent 4 }} +{{- end }} diff --git a/chart/deps/redis/templates/metrics-svc.yaml b/chart/deps/redis/templates/metrics-svc.yaml index 767a464..7b88b2f 100644 --- a/chart/deps/redis/templates/metrics-svc.yaml +++ b/chart/deps/redis/templates/metrics-svc.yaml @@ -2,33 +2,37 @@ apiVersion: v1 kind: Service metadata: - name: {{ template "redis.fullname" . }}-metrics + name: {{ printf "%s-metrics" (include "common.names.fullname" .) }} namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - app.kubernetes.io/component: "metrics" - {{- if .Values.metrics.service.labels -}} - {{- toYaml .Values.metrics.service.labels | nindent 4 }} - {{- end -}} - {{- if .Values.metrics.service.annotations }} - annotations: {{- toYaml .Values.metrics.service.annotations | nindent 4 }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: metrics + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if or .Values.metrics.service.annotations .Values.commonAnnotations }} + annotations: + {{- if .Values.metrics.service.annotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.service.annotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} {{- end }} spec: type: {{ .Values.metrics.service.type }} - {{ if eq .Values.metrics.service.type "LoadBalancer" }} + {{- if eq .Values.metrics.service.type "LoadBalancer" }} externalTrafficPolicy: {{ .Values.metrics.service.externalTrafficPolicy }} {{- end }} - {{ if and (eq .Values.metrics.service.type "LoadBalancer") .Values.metrics.service.loadBalancerIP }} + {{- if and (eq .Values.metrics.service.type "LoadBalancer") .Values.metrics.service.loadBalancerIP }} loadBalancerIP: {{ .Values.metrics.service.loadBalancerIP }} {{- end }} + {{- if and (eq .Values.metrics.service.type "LoadBalancer") .Values.metrics.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: {{- toYaml .Values.metrics.service.loadBalancerSourceRanges | nindent 4 }} + {{- end }} ports: - - name: metrics - port: 9121 + - name: tcp-metrics + port: {{ .Values.metrics.service.port }} + protocol: TCP targetPort: metrics - selector: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} + selector: {{- include "common.labels.matchLabels" . | nindent 4 }} {{- end }} diff --git a/chart/deps/redis/templates/networkpolicy.yaml b/chart/deps/redis/templates/networkpolicy.yaml index 0249bc0..ec48bc2 100644 --- a/chart/deps/redis/templates/networkpolicy.yaml +++ b/chart/deps/redis/templates/networkpolicy.yaml @@ -2,55 +2,56 @@ kind: NetworkPolicy apiVersion: {{ template "networkPolicy.apiVersion" . }} metadata: - name: {{ template "redis.fullname" . }} + name: {{ template "common.names.fullname" . }} namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} spec: podSelector: - matchLabels: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} - {{- if .Values.cluster.enabled }} + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} policyTypes: - Ingress + {{- if or (eq .Values.architecture "replication") .Values.networkPolicy.extraEgress }} - Egress egress: + {{- if eq .Values.architecture "replication" }} # Allow dns resolution - ports: - port: 53 protocol: UDP # Allow outbound connections to other cluster pods - ports: - - port: {{ .Values.redisPort }} + - port: {{ .Values.master.containerPort }} {{- if .Values.sentinel.enabled }} - - port: {{ .Values.sentinel.port }} + - port: {{ .Values.sentinel.containerPort }} {{- end }} to: - podSelector: - matchLabels: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} + matchLabels: {{- include "common.labels.matchLabels" . | nindent 14 }} + {{- end }} + {{- if .Values.networkPolicy.extraEgress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraEgress "context" $ ) | nindent 4 }} + {{- end }} {{- end }} ingress: # Allow inbound connections - ports: - - port: {{ .Values.redisPort }} + - port: {{ .Values.master.containerPort }} {{- if .Values.sentinel.enabled }} - - port: {{ .Values.sentinel.port }} + - port: {{ .Values.sentinel.containerPort }} {{- end }} {{- if not .Values.networkPolicy.allowExternal }} from: - podSelector: matchLabels: - {{ template "redis.fullname" . }}-client: "true" + {{ template "common.names.fullname" . }}-client: "true" - podSelector: - matchLabels: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} + matchLabels: {{- include "common.labels.matchLabels" . | nindent 14 }} {{- if .Values.networkPolicy.ingressNSMatchLabels }} - namespaceSelector: matchLabels: @@ -65,10 +66,18 @@ spec: {{- end }} {{- end }} {{- end }} - {{- end }} + {{- end }} {{- if .Values.metrics.enabled }} # Allow prometheus scrapes for metrics - ports: - port: 9121 {{- end }} + {{- if .Values.metrics.sentinel.enabled }} + # Allow prometheus scrapes for sentinel metrics + - ports: + - port: 9355 + {{- end }} + {{- if .Values.networkPolicy.extraIngress }} + {{- include "common.tplvalues.render" ( dict "value" .Values.networkPolicy.extraIngress "context" $ ) | nindent 4 }} + {{- end }} {{- end }} diff --git a/chart/deps/redis/templates/pdb.yaml b/chart/deps/redis/templates/pdb.yaml index b9dc54b..d8a3150 100644 --- a/chart/deps/redis/templates/pdb.yaml +++ b/chart/deps/redis/templates/pdb.yaml @@ -1,22 +1,23 @@ -{{- if .Values.podDisruptionBudget.enabled }} +{{- if .Values.pdb.create }} apiVersion: policy/v1beta1 kind: PodDisruptionBudget metadata: - name: {{ template "redis.fullname" . }} + name: {{ template "common.names.fullname" . }} namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} spec: - {{- if .Values.podDisruptionBudget.minAvailable }} - minAvailable: {{ .Values.podDisruptionBudget.minAvailable }} + {{- if .Values.pdb.minAvailable }} + minAvailable: {{ .Values.pdb.minAvailable }} {{- end }} - {{- if .Values.podDisruptionBudget.maxUnavailable }} - maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }} + {{- if .Values.pdb.maxUnavailable }} + maxUnavailable: {{ .Values.pdb.maxUnavailable }} {{- end }} selector: - matchLabels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name }} + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} {{- end }} diff --git a/chart/deps/redis/templates/prometheusrule.yaml b/chart/deps/redis/templates/prometheusrule.yaml index 48ae017..cd8bc68 100644 --- a/chart/deps/redis/templates/prometheusrule.yaml +++ b/chart/deps/redis/templates/prometheusrule.yaml @@ -2,24 +2,26 @@ apiVersion: monitoring.coreos.com/v1 kind: PrometheusRule metadata: - name: {{ template "redis.fullname" . }} + name: {{ template "common.names.fullname" . }} {{- if .Values.metrics.prometheusRule.namespace }} namespace: {{ .Values.metrics.prometheusRule.namespace }} {{- else }} namespace: {{ .Release.Namespace | quote }} {{- end }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name | quote }} - heritage: {{ .Release.Service | quote }} -{{- with .Values.metrics.prometheusRule.additionalLabels }} -{{- toYaml . | nindent 4 }} -{{- end }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.metrics.prometheusRule.additionalLabels }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.prometheusRule.additionalLabels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} spec: -{{- with .Values.metrics.prometheusRule.rules }} + {{- with .Values.metrics.prometheusRule.rules }} groups: - - name: {{ template "redis.name" $ }} + - name: {{ template "common.names.name" $ }} rules: {{- tpl (toYaml .) $ | nindent 8 }} -{{- end }} + {{- end }} {{- end }} diff --git a/chart/deps/redis/templates/psp.yaml b/chart/deps/redis/templates/psp.yaml deleted file mode 100644 index eca04c1..0000000 --- a/chart/deps/redis/templates/psp.yaml +++ /dev/null @@ -1,43 +0,0 @@ -{{- if .Values.podSecurityPolicy.create }} -apiVersion: {{ template "podSecurityPolicy.apiVersion" . }} -kind: PodSecurityPolicy -metadata: - name: {{ template "redis.fullname" . }} - namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - heritage: {{ .Release.Service }} - release: {{ .Release.Name }} -spec: - allowPrivilegeEscalation: false - fsGroup: - rule: 'MustRunAs' - ranges: - - min: {{ .Values.securityContext.fsGroup }} - max: {{ .Values.securityContext.fsGroup }} - hostIPC: false - hostNetwork: false - hostPID: false - privileged: false - readOnlyRootFilesystem: false - requiredDropCapabilities: - - ALL - runAsUser: - rule: 'MustRunAs' - ranges: - - min: {{ .Values.containerSecurityContext.runAsUser }} - max: {{ .Values.containerSecurityContext.runAsUser }} - seLinux: - rule: 'RunAsAny' - supplementalGroups: - rule: 'MustRunAs' - ranges: - - min: {{ .Values.containerSecurityContext.runAsUser }} - max: {{ .Values.containerSecurityContext.runAsUser }} - volumes: - - 'configMap' - - 'secret' - - 'emptyDir' - - 'persistentVolumeClaim' -{{- end }} diff --git a/chart/deps/redis/templates/redis-master-statefulset.yaml b/chart/deps/redis/templates/redis-master-statefulset.yaml deleted file mode 100644 index ae138c0..0000000 --- a/chart/deps/redis/templates/redis-master-statefulset.yaml +++ /dev/null @@ -1,382 +0,0 @@ -{{- if or (not .Values.cluster.enabled) (not .Values.sentinel.enabled) }} -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: {{ template "redis.fullname" . }}-master - namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.master.statefulset.labels }} - {{- toYaml .Values.master.statefulset.labels | nindent 4 }} - {{- end }} -{{- if .Values.master.statefulset.annotations }} - annotations: - {{- toYaml .Values.master.statefulset.annotations | nindent 4 }} -{{- end }} -spec: - selector: - matchLabels: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} - role: master - serviceName: {{ template "redis.fullname" . }}-headless - template: - metadata: - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name }} - role: master - {{- if .Values.master.podLabels }} - {{- toYaml .Values.master.podLabels | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.podLabels }} - {{- toYaml .Values.metrics.podLabels | nindent 8 }} - {{- end }} - annotations: - checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }} - checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} - checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} - {{- if .Values.master.podAnnotations }} - {{- toYaml .Values.master.podAnnotations | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.podAnnotations }} - {{- toYaml .Values.metrics.podAnnotations | nindent 8 }} - {{- end }} - spec: - {{- include "redis.imagePullSecrets" . | nindent 6 }} - {{- if .Values.master.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.master.hostAliases "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.securityContext.enabled }} - securityContext: {{- omit .Values.securityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - serviceAccountName: {{ template "redis.serviceAccountName" . }} - {{- if .Values.master.priorityClassName }} - priorityClassName: {{ .Values.master.priorityClassName | quote }} - {{- end }} - {{- with .Values.master.affinity }} - affinity: {{- tpl (toYaml .) $ | nindent 8 }} - {{- end }} - {{- if .Values.master.nodeSelector }} - nodeSelector: {{- toYaml .Values.master.nodeSelector | nindent 8 }} - {{- end }} - {{- if .Values.master.tolerations }} - tolerations: {{- toYaml .Values.master.tolerations | nindent 8 }} - {{- end }} - {{- if .Values.master.shareProcessNamespace }} - shareProcessNamespace: {{ .Values.master.shareProcessNamespace }} - {{- end }} - {{- if .Values.master.schedulerName }} - schedulerName: {{ .Values.master.schedulerName }} - {{- end }} - containers: - - name: {{ template "redis.name" . }} - image: {{ template "redis.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy | quote }} - {{- if .Values.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - command: - - /bin/bash - - -c - - /opt/bitnami/scripts/start-scripts/start-master.sh - env: - - name: REDIS_REPLICATION_MODE - value: master - {{- if .Values.usePassword }} - {{- if .Values.usePasswordFile }} - - name: REDIS_PASSWORD_FILE - value: "/opt/bitnami/redis/secrets/redis-password" - {{- else }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - {{- end }} - {{- else }} - - name: ALLOW_EMPTY_PASSWORD - value: "yes" - {{- end }} - - name: REDIS_TLS_ENABLED - value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} - {{- if .Values.tls.enabled }} - - name: REDIS_TLS_PORT - value: {{ .Values.redisPort | quote }} - - name: REDIS_TLS_AUTH_CLIENTS - value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} - - name: REDIS_TLS_CERT_FILE - value: {{ template "redis.tlsCert" . }} - - name: REDIS_TLS_KEY_FILE - value: {{ template "redis.tlsCertKey" . }} - - name: REDIS_TLS_CA_FILE - value: {{ template "redis.tlsCACert" . }} - {{- if .Values.tls.dhParamsFilename }} - - name: REDIS_TLS_DH_PARAMS_FILE - value: {{ template "redis.tlsDHParams" . }} - {{- end }} - {{- else }} - - name: REDIS_PORT - value: {{ .Values.redisPort | quote }} - {{- end }} - {{- if .Values.master.extraEnvVars }} - {{- include "redis.tplValue" (dict "value" .Values.master.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if or .Values.master.extraEnvVarsCM .Values.master.extraEnvVarsSecret }} - envFrom: - {{- if .Values.master.extraEnvVarsCM }} - - configMapRef: - name: {{ .Values.master.extraEnvVarsCM }} - {{- end }} - {{- if .Values.master.extraEnvVarsSecret }} - - secretRef: - name: {{ .Values.master.extraEnvVarsSecret }} - {{- end }} - {{- end }} - ports: - - name: redis - containerPort: {{ .Values.redisPort }} - {{- if .Values.master.livenessProbe.enabled }} - livenessProbe: - initialDelaySeconds: {{ .Values.master.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.master.livenessProbe.periodSeconds }} - # One second longer than command timeout should prevent generation of zombie processes. - timeoutSeconds: {{ add1 .Values.master.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.master.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.master.livenessProbe.failureThreshold }} - exec: - command: - - sh - - -c - - /health/ping_liveness_local.sh {{ .Values.master.livenessProbe.timeoutSeconds }} - {{- else if .Values.master.customLivenessProbe }} - livenessProbe: {{- toYaml .Values.master.customLivenessProbe | nindent 12 }} - {{- end }} - {{- if .Values.master.readinessProbe.enabled}} - readinessProbe: - initialDelaySeconds: {{ .Values.master.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.master.readinessProbe.periodSeconds }} - timeoutSeconds: {{ add1 .Values.master.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.master.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.master.readinessProbe.failureThreshold }} - exec: - command: - - sh - - -c - - /health/ping_readiness_local.sh {{ .Values.master.readinessProbe.timeoutSeconds }} - {{- else if .Values.master.customReadinessProbe }} - readinessProbe: {{- toYaml .Values.master.customReadinessProbe | nindent 12 }} - {{- end }} - resources: {{- toYaml .Values.master.resources | nindent 12 }} - volumeMounts: - - name: start-scripts - mountPath: /opt/bitnami/scripts/start-scripts - - name: health - mountPath: /health - {{- if .Values.usePasswordFile }} - - name: redis-password - mountPath: /opt/bitnami/redis/secrets/ - {{- end }} - - name: redis-data - mountPath: {{ .Values.master.persistence.path }} - subPath: {{ .Values.master.persistence.subPath }} - - name: config - mountPath: /opt/bitnami/redis/mounted-etc - - name: redis-tmp-conf - mountPath: /opt/bitnami/redis/etc/ - - name: tmp - mountPath: /tmp - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - {{- if .Values.metrics.enabled }} - - name: metrics - image: {{ template "redis.metrics.image" . }} - imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} - {{- if .Values.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - command: - - /bin/bash - - -c - - | - if [[ -f '/secrets/redis-password' ]]; then - export REDIS_PASSWORD=$(cat /secrets/redis-password) - fi - redis_exporter{{- range $key, $value := .Values.metrics.extraArgs }} --{{ $key }}={{ $value }}{{- end }} - env: - - name: REDIS_ALIAS - value: {{ template "redis.fullname" . }} - {{- if and .Values.usePassword (not .Values.usePasswordFile) }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - {{- end }} - {{- if .Values.tls.enabled }} - - name: REDIS_ADDR - value: rediss://localhost:{{ .Values.redisPort }} - - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE - value: {{ template "redis.tlsCertKey" . }} - - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE - value: {{ template "redis.tlsCert" . }} - - name: REDIS_EXPORTER_TLS_CA_CERT_FILE - value: {{ template "redis.tlsCACert" . }} - {{- end }} - volumeMounts: - {{- if .Values.usePasswordFile }} - - name: redis-password - mountPath: /secrets/ - {{- end }} - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - ports: - - name: metrics - containerPort: 9121 - resources: {{- toYaml .Values.metrics.resources | nindent 12 }} - {{- end }} - {{- $needsVolumePermissions := and .Values.volumePermissions.enabled .Values.master.persistence.enabled .Values.securityContext.enabled .Values.containerSecurityContext.enabled }} - {{- if or $needsVolumePermissions .Values.sysctlImage.enabled }} - initContainers: - {{- if $needsVolumePermissions }} - - name: volume-permissions - image: "{{ template "redis.volumePermissions.image" . }}" - imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} - command: - - /bin/bash - - -ec - - | - {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} - chown -R `id -u`:`id -G | cut -d " " -f2` {{ .Values.master.persistence.path }} - {{- else }} - chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} {{ .Values.master.persistence.path }} - {{- end }} - {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto "}} - securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 12 }} - {{- else }} - securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 12 }} - {{- end }} - resources: {{- toYaml .Values.volumePermissions.resources | nindent 10 }} - volumeMounts: - - name: redis-data - mountPath: {{ .Values.master.persistence.path }} - subPath: {{ .Values.master.persistence.subPath }} - {{- end }} - {{- if .Values.sysctlImage.enabled }} - - name: init-sysctl - image: {{ template "redis.sysctl.image" . }} - imagePullPolicy: {{ default "" .Values.sysctlImage.pullPolicy | quote }} - resources: {{- toYaml .Values.sysctlImage.resources | nindent 10 }} - {{- if .Values.sysctlImage.mountHostSys }} - volumeMounts: - - name: host-sys - mountPath: /host-sys - {{- end }} - command: {{- toYaml .Values.sysctlImage.command | nindent 10 }} - securityContext: - privileged: true - runAsUser: 0 - {{- end }} - {{- end }} - volumes: - - name: start-scripts - configMap: - name: {{ include "redis.fullname" . }}-scripts - defaultMode: 0755 - - name: health - configMap: - name: {{ template "redis.fullname" . }}-health - defaultMode: 0755 - {{- if .Values.usePasswordFile }} - - name: redis-password - secret: - secretName: {{ template "redis.secretName" . }} - items: - - key: {{ template "redis.secretPasswordKey" . }} - path: redis-password - {{- end }} - - name: config - configMap: - name: {{ template "redis.fullname" . }} - {{- if not .Values.master.persistence.enabled }} - - name: "redis-data" - emptyDir: {} - {{- else }} - {{- if .Values.persistence.existingClaim }} - - name: "redis-data" - persistentVolumeClaim: - claimName: {{ include "redis.tplValue" (dict "value" .Values.persistence.existingClaim "context" $) }} - {{- end }} - {{- if .Values.master.persistence.volumes }} - {{- toYaml .Values.master.persistence.volumes | nindent 8 }} - {{- end }} - {{- end }} - {{- if .Values.sysctlImage.mountHostSys }} - - name: host-sys - hostPath: - path: /sys - {{- end }} - - name: redis-tmp-conf - emptyDir: {} - - name: tmp - emptyDir: {} - {{- if .Values.tls.enabled }} - - name: redis-certificates - secret: - secretName: {{ required "A secret containing the certificates for the TLS traffic is required when TLS in enabled" .Values.tls.certificatesSecret }} - defaultMode: 256 - {{- end }} - {{- if and .Values.master.persistence.enabled (not .Values.persistence.existingClaim) (not .Values.master.persistence.volumes) }} - volumeClaimTemplates: - - metadata: - name: redis-data - labels: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - component: master - {{- if .Values.master.statefulset.volumeClaimTemplates.labels }} - {{- toYaml .Values.master.statefulset.volumeClaimTemplates.labels | nindent 10 }} - {{- end }} - {{- if .Values.master.statefulset.volumeClaimTemplates.annotations }} - annotations: - {{- toYaml .Values.master.statefulset.volumeClaimTemplates.annotations | nindent 10 }} - {{- end }} - spec: - accessModes: - {{- range .Values.master.persistence.accessModes }} - - {{ . | quote }} - {{- end }} - resources: - requests: - storage: {{ .Values.master.persistence.size | quote }} - {{ include "redis.master.storageClass" . }} - selector: - {{- if .Values.master.persistence.matchLabels }} - matchLabels: {{- toYaml .Values.master.persistence.matchLabels | nindent 12 }} - {{- end -}} - {{- if .Values.master.persistence.matchExpressions }} - matchExpressions: {{- toYaml .Values.master.persistence.matchExpressions | nindent 12 }} - {{- end -}} - {{- end }} - updateStrategy: - type: {{ .Values.master.statefulset.updateStrategy }} - {{- if .Values.master.statefulset.rollingUpdatePartition }} - {{- if (eq "Recreate" .Values.master.statefulset.updateStrategy) }} - rollingUpdate: null - {{- else }} - rollingUpdate: - partition: {{ .Values.master.statefulset.rollingUpdatePartition }} - {{- end }} - {{- end }} -{{- end }} diff --git a/chart/deps/redis/templates/redis-master-svc.yaml b/chart/deps/redis/templates/redis-master-svc.yaml deleted file mode 100644 index 8bd2f8c..0000000 --- a/chart/deps/redis/templates/redis-master-svc.yaml +++ /dev/null @@ -1,43 +0,0 @@ -{{- if not .Values.sentinel.enabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "redis.fullname" . }}-master - namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.master.service.labels -}} - {{- toYaml .Values.master.service.labels | nindent 4 }} - {{- end -}} -{{- if .Values.master.service.annotations }} - annotations: {{- toYaml .Values.master.service.annotations | nindent 4 }} -{{- end }} -spec: - type: {{ .Values.master.service.type }} - {{ if eq .Values.master.service.type "LoadBalancer" }} - externalTrafficPolicy: {{ .Values.master.service.externalTrafficPolicy }} - {{- end }} - {{- if and (eq .Values.master.service.type "LoadBalancer") .Values.master.service.loadBalancerIP }} - loadBalancerIP: {{ .Values.master.service.loadBalancerIP }} - {{- end }} - {{- if and (eq .Values.master.service.type "LoadBalancer") .Values.master.service.loadBalancerSourceRanges }} - loadBalancerSourceRanges: - {{- with .Values.master.service.loadBalancerSourceRanges }} -{{- toYaml . | nindent 4 }} -{{- end }} - {{- end }} - ports: - - name: tcp-redis - port: {{ .Values.master.service.port }} - targetPort: redis - {{- if .Values.master.service.nodePort }} - nodePort: {{ .Values.master.service.nodePort }} - {{- end }} - selector: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} - role: master -{{- end }} diff --git a/chart/deps/redis/templates/redis-node-statefulset.yaml b/chart/deps/redis/templates/redis-node-statefulset.yaml deleted file mode 100644 index 5a83a62..0000000 --- a/chart/deps/redis/templates/redis-node-statefulset.yaml +++ /dev/null @@ -1,507 +0,0 @@ -{{- if and .Values.cluster.enabled .Values.sentinel.enabled }} -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: {{ template "redis.fullname" . }}-node - namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.slave.statefulset.labels }} - {{- toYaml .Values.slave.statefulset.labels | nindent 4 }} - {{- end }} -{{- if .Values.slave.statefulset.annotations }} - annotations: - {{- toYaml .Values.slave.statefulset.annotations | nindent 4 }} -{{- end }} -spec: -{{- if .Values.slave.updateStrategy }} - strategy: {{- toYaml .Values.slave.updateStrategy | nindent 4 }} -{{- end }} - replicas: {{ .Values.cluster.slaveCount }} - serviceName: {{ template "redis.fullname" . }}-headless - selector: - matchLabels: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} - role: node - template: - metadata: - labels: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} - chart: {{ template "redis.chart" . }} - role: node - {{- if .Values.slave.podLabels }} - {{- toYaml .Values.slave.podLabels | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.podLabels }} - {{- toYaml .Values.metrics.podLabels | nindent 8 }} - {{- end }} - annotations: - checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }} - checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} - checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} - {{- if .Values.slave.podAnnotations }} - {{- toYaml .Values.slave.podAnnotations | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.podAnnotations }} - {{- toYaml .Values.metrics.podAnnotations | nindent 8 }} - {{- end }} - spec: - {{- include "redis.imagePullSecrets" . | nindent 6 }} - {{- if .Values.slave.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.slave.hostAliases "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.securityContext.enabled }} - securityContext: {{- omit .Values.securityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - serviceAccountName: {{ template "redis.serviceAccountName" . }} - {{- if .Values.slave.priorityClassName }} - priorityClassName: "{{ .Values.slave.priorityClassName }}" - {{- end }} - {{- if .Values.slave.nodeSelector }} - nodeSelector: {{- toYaml .Values.slave.nodeSelector | nindent 8 }} - {{- end }} - {{- if .Values.slave.tolerations }} - tolerations: {{- toYaml .Values.slave.tolerations | nindent 8 }} - {{- end }} - {{- if .Values.slave.schedulerName }} - schedulerName: {{ .Values.slave.schedulerName }} - {{- end }} - {{- if .Values.master.spreadConstraints }} - topologySpreadConstraints: {{- toYaml .Values.master.spreadConstraints | nindent 8 }} - {{- end }} - {{- with .Values.slave.affinity }} - affinity: {{- tpl (toYaml .) $ | nindent 8 }} - {{- end }} - containers: - - name: {{ template "redis.name" . }} - image: {{ template "redis.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy | quote }} - {{- if .Values.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - command: - - /bin/bash - - -c - - /opt/bitnami/scripts/start-scripts/start-node.sh - env: - - name: REDIS_MASTER_PORT_NUMBER - value: {{ .Values.redisPort | quote }} - {{- if .Values.usePassword }} - {{- if .Values.usePasswordFile }} - - name: REDIS_PASSWORD_FILE - value: "/opt/bitnami/redis/secrets/redis-password" - - name: REDIS_MASTER_PASSWORD_FILE - value: "/opt/bitnami/redis/secrets/redis-password" - {{- else }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - - name: REDIS_MASTER_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - {{- end }} - {{- else }} - - name: ALLOW_EMPTY_PASSWORD - value: "yes" - {{- end }} - - name: REDIS_TLS_ENABLED - value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} - {{- if .Values.tls.enabled }} - - name: REDIS_TLS_PORT - value: {{ .Values.redisPort | quote }} - - name: REDIS_TLS_AUTH_CLIENTS - value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} - - name: REDIS_TLS_CERT_FILE - value: {{ template "redis.tlsCert" . }} - - name: REDIS_TLS_KEY_FILE - value: {{ template "redis.tlsCertKey" . }} - - name: REDIS_TLS_CA_FILE - value: {{ template "redis.tlsCACert" . }} - {{- if .Values.tls.dhParamsFilename }} - - name: REDIS_TLS_DH_PARAMS_FILE - value: {{ template "redis.tlsDHParams" . }} - {{- end }} - {{- else }} - - name: REDIS_PORT - value: {{ .Values.redisPort | quote }} - {{- end }} - - name: REDIS_DATA_DIR - value: {{ .Values.slave.persistence.path }} - {{- if .Values.sentinel.extraEnvVars }} - {{- include "redis.tplValue" (dict "value" .Values.sentinel.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if or .Values.sentinel.extraEnvVarsCM .Values.sentinel.extraEnvVarsSecret }} - envFrom: - {{- if .Values.sentinel.extraEnvVarsCM }} - - configMapRef: - name: {{ .Values.sentinel.extraEnvVarsCM }} - {{- end }} - {{- if .Values.sentinel.extraEnvVarsSecret }} - - secretRef: - name: {{ .Values.sentinel.extraEnvVarsSecret }} - {{- end }} - {{- end }} - ports: - - name: redis - containerPort: {{ .Values.redisPort }} - {{- if .Values.slave.livenessProbe.enabled }} - livenessProbe: - initialDelaySeconds: {{ .Values.slave.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.slave.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.slave.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.slave.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.slave.livenessProbe.failureThreshold}} - exec: - command: - - sh - - -c - {{- if .Values.sentinel.enabled }} - - /health/ping_liveness_local.sh {{ .Values.slave.livenessProbe.timeoutSeconds }} - {{- else }} - - /health/ping_liveness_local_and_master.sh {{ .Values.slave.livenessProbe.timeoutSeconds }} - {{- end }} - {{- else if .Values.slave.customLivenessProbe }} - livenessProbe: {{- toYaml .Values.slave.customLivenessProbe | nindent 12 }} - {{- end }} - {{- if .Values.slave.readinessProbe.enabled }} - readinessProbe: - initialDelaySeconds: {{ .Values.slave.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.slave.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.slave.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.slave.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.slave.readinessProbe.failureThreshold }} - exec: - command: - - sh - - -c - {{- if .Values.sentinel.enabled }} - - /health/ping_readiness_local.sh {{ .Values.slave.livenessProbe.timeoutSeconds }} - {{- else }} - - /health/ping_readiness_local_and_master.sh {{ .Values.slave.livenessProbe.timeoutSeconds }} - {{- end }} - {{- else if .Values.slave.customReadinessProbe }} - readinessProbe: {{- toYaml .Values.slave.customReadinessProbe | nindent 12 }} - {{- end }} - resources: {{- toYaml .Values.slave.resources | nindent 12 }} - volumeMounts: - - name: start-scripts - mountPath: /opt/bitnami/scripts/start-scripts - - name: health - mountPath: /health - {{- if .Values.usePasswordFile }} - - name: redis-password - mountPath: /opt/bitnami/redis/secrets/ - {{- end }} - - name: redis-data - mountPath: {{ .Values.slave.persistence.path }} - subPath: {{ .Values.slave.persistence.subPath }} - - name: config - mountPath: /opt/bitnami/redis/mounted-etc - - name: redis-tmp-conf - mountPath: /opt/bitnami/redis/etc - - name: tmp - mountPath: /tmp - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - {{- if and .Values.cluster.enabled .Values.sentinel.enabled }} - - name: sentinel - image: {{ template "sentinel.image" . }} - imagePullPolicy: {{ .Values.sentinel.image.pullPolicy | quote }} - {{- if .Values.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - command: - - /bin/bash - - -c - - /opt/bitnami/scripts/start-scripts/start-sentinel.sh - env: - {{- if .Values.usePassword }} - {{- if .Values.usePasswordFile }} - - name: REDIS_PASSWORD_FILE - value: "/opt/bitnami/redis/secrets/redis-password" - {{- else }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - {{- end }} - {{- else }} - - name: ALLOW_EMPTY_PASSWORD - value: "yes" - {{- end }} - - name: REDIS_SENTINEL_TLS_ENABLED - value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} - {{- if .Values.tls.enabled }} - - name: REDIS_SENTINEL_TLS_PORT_NUMBER - value: {{ .Values.sentinel.port | quote }} - - name: REDIS_SENTINEL_TLS_AUTH_CLIENTS - value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} - - name: REDIS_SENTINEL_TLS_CERT_FILE - value: {{ template "redis.tlsCert" . }} - - name: REDIS_SENTINEL_TLS_KEY_FILE - value: {{ template "redis.tlsCertKey" . }} - - name: REDIS_SENTINEL_TLS_CA_FILE - value: {{ template "redis.tlsCACert" . }} - {{- if .Values.tls.dhParamsFilename }} - - name: REDIS_SENTINEL_TLS_DH_PARAMS_FILE - value: {{ template "redis.dhParams" . }} - {{- end }} - {{- else }} - - name: REDIS_SENTINEL_PORT - value: {{ .Values.sentinel.port | quote }} - {{- end }} - ports: - - name: redis-sentinel - containerPort: {{ .Values.sentinel.port }} - {{- if .Values.sentinel.livenessProbe.enabled }} - livenessProbe: - initialDelaySeconds: {{ .Values.sentinel.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.sentinel.livenessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.sentinel.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.sentinel.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.sentinel.livenessProbe.failureThreshold }} - exec: - command: - - sh - - -c - - /health/ping_sentinel.sh {{ .Values.sentinel.livenessProbe.timeoutSeconds }} - {{- else if .Values.sentinel.customLivenessProbe }} - livenessProbe: {{- toYaml .Values.sentinel.customLivenessProbe | nindent 12 }} - {{- end }} - {{- if .Values.sentinel.readinessProbe.enabled}} - readinessProbe: - initialDelaySeconds: {{ .Values.sentinel.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.sentinel.readinessProbe.periodSeconds }} - timeoutSeconds: {{ .Values.sentinel.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.sentinel.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.sentinel.readinessProbe.failureThreshold }} - exec: - command: - - sh - - -c - - /health/ping_sentinel.sh {{ .Values.sentinel.livenessProbe.timeoutSeconds }} - {{- else if .Values.sentinel.customReadinessProbe }} - readinessProbe: {{- toYaml .Values.sentinel.customReadinessProbe | nindent 12 }} - {{- end }} - lifecycle: - preStop: - exec: - command: - - /bin/bash - - -c - - /opt/bitnami/scripts/start-scripts/prestop-sentinel.sh - resources: {{- toYaml .Values.sentinel.resources | nindent 12 }} - volumeMounts: - - name: start-scripts - mountPath: /opt/bitnami/scripts/start-scripts - - name: health - mountPath: /health - {{- if .Values.usePasswordFile }} - - name: redis-password - mountPath: /opt/bitnami/redis/secrets/ - {{- end }} - - name: redis-data - mountPath: {{ .Values.slave.persistence.path }} - subPath: {{ .Values.slave.persistence.subPath }} - - name: config - mountPath: /opt/bitnami/redis-sentinel/mounted-etc - - name: sentinel-tmp-conf - mountPath: /opt/bitnami/redis-sentinel/etc - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - {{- end }} - {{- if .Values.metrics.enabled }} - - name: metrics - image: {{ template "redis.metrics.image" . }} - imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} - {{- if .Values.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - command: - - /bin/bash - - -c - - | - if [[ -f '/secrets/redis-password' ]]; then - export REDIS_PASSWORD=$(cat /secrets/redis-password) - fi - redis_exporter{{- range $key, $value := .Values.metrics.extraArgs }} --{{ $key }}={{ $value }}{{- end }} - env: - - name: REDIS_ALIAS - value: {{ template "redis.fullname" . }} - {{- if and .Values.usePassword (not .Values.usePasswordFile) }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - {{- end }} - {{- if .Values.tls.enabled }} - - name: REDIS_ADDR - value: rediss://localhost:{{ .Values.redisPort }} - - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE - value: {{ template "redis.tlsCertKey" . }} - - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE - value: {{ template "redis.tlsCert" . }} - - name: REDIS_EXPORTER_TLS_CA_CERT_FILE - value: {{ template "redis.tlsCACert" . }} - {{- end }} - volumeMounts: - {{- if .Values.usePasswordFile }} - - name: redis-password - mountPath: /secrets/ - {{- end }} - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - ports: - - name: metrics - containerPort: 9121 - resources: {{- toYaml .Values.metrics.resources | nindent 12 }} - {{- end }} - {{- $needsVolumePermissions := and .Values.volumePermissions.enabled .Values.slave.persistence.enabled .Values.securityContext.enabled .Values.containerSecurityContext.enabled }} - {{- if or $needsVolumePermissions .Values.sysctlImage.enabled }} - initContainers: - {{- if $needsVolumePermissions }} - - name: volume-permissions - image: {{ template "redis.volumePermissions.image" . }} - imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} - command: - - /bin/bash - - -ec - - | - {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} - chown -R `id -u`:`id -G | cut -d " " -f2` {{ .Values.slave.persistence.path }} - {{- else }} - chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} {{ .Values.slave.persistence.path }} - {{- end }} - {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto "}} - securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 12 }} - {{- else }} - securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 12 }} - {{- end }} - resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} - volumeMounts: - - name: redis-data - mountPath: {{ .Values.slave.persistence.path }} - subPath: {{ .Values.slave.persistence.subPath }} - {{- end }} - {{- if .Values.sysctlImage.enabled }} - - name: init-sysctl - image: {{ template "redis.sysctl.image" . }} - imagePullPolicy: {{ default "" .Values.sysctlImage.pullPolicy | quote }} - resources: {{- toYaml .Values.sysctlImage.resources | nindent 12 }} - {{- if .Values.sysctlImage.mountHostSys }} - volumeMounts: - - name: host-sys - mountPath: /host-sys - {{- end }} - command: {{- toYaml .Values.sysctlImage.command | nindent 12 }} - securityContext: - privileged: true - runAsUser: 0 - {{- end }} - {{- end }} - volumes: - - name: start-scripts - configMap: - name: {{ include "redis.fullname" . }}-scripts - defaultMode: 0755 - - name: health - configMap: - name: {{ template "redis.fullname" . }}-health - defaultMode: 0755 - {{- if .Values.usePasswordFile }} - - name: redis-password - secret: - secretName: {{ template "redis.secretName" . }} - items: - - key: {{ template "redis.secretPasswordKey" . }} - path: redis-password - {{- end }} - - name: config - configMap: - name: {{ template "redis.fullname" . }} - {{- if .Values.sysctlImage.mountHostSys }} - - name: host-sys - hostPath: - path: /sys - {{- end }} - - name: sentinel-tmp-conf - emptyDir: {} - - name: redis-tmp-conf - emptyDir: {} - - name: tmp - emptyDir: {} - {{- if .Values.tls.enabled }} - - name: redis-certificates - secret: - secretName: {{ required "A secret containing the certificates for the TLS traffic is required when TLS in enabled" .Values.tls.certificatesSecret }} - defaultMode: 256 - {{- end }} - {{- if not .Values.slave.persistence.enabled }} - - name: redis-data - emptyDir: {} - {{- else }} - volumeClaimTemplates: - - metadata: - name: redis-data - labels: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - component: slave - {{- if .Values.slave.statefulset.volumeClaimTemplates }} - {{- if .Values.slave.statefulset.volumeClaimTemplates.labels }} - {{- toYaml .Values.slave.statefulset.volumeClaimTemplates.labels | nindent 10 }} - {{- end }} - {{- if .Values.slave.statefulset.volumeClaimTemplates.annotations }} - annotations: - {{- toYaml .Values.slave.statefulset.volumeClaimTemplates.annotations | nindent 10 }} - {{- end }} - {{- end }} - spec: - accessModes: - {{- range .Values.slave.persistence.accessModes }} - - {{ . | quote }} - {{- end }} - resources: - requests: - storage: {{ .Values.slave.persistence.size | quote }} - {{ include "redis.slave.storageClass" . }} - selector: - {{- if .Values.slave.persistence.matchLabels }} - matchLabels: {{- toYaml .Values.slave.persistence.matchLabels | nindent 12 }} - {{- end -}} - {{- if .Values.slave.persistence.matchExpressions }} - matchExpressions: {{- toYaml .Values.slave.persistence.matchExpressions | nindent 12 }} - {{- end -}} - {{- end }} - updateStrategy: - type: {{ .Values.slave.statefulset.updateStrategy }} - {{- if .Values.slave.statefulset.rollingUpdatePartition }} - {{- if (eq "Recreate" .Values.slave.statefulset.updateStrategy) }} - rollingUpdate: null - {{- else }} - rollingUpdate: - partition: {{ .Values.slave.statefulset.rollingUpdatePartition }} - {{- end }} - {{- end }} -{{- end }} diff --git a/chart/deps/redis/templates/redis-role.yaml b/chart/deps/redis/templates/redis-role.yaml deleted file mode 100644 index 080a7f9..0000000 --- a/chart/deps/redis/templates/redis-role.yaml +++ /dev/null @@ -1,22 +0,0 @@ -{{- if .Values.rbac.create -}} -apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} -kind: Role -metadata: - name: {{ template "redis.fullname" . }} - namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -rules: -{{- if .Values.podSecurityPolicy.create }} - - apiGroups: ['{{ template "podSecurityPolicy.apiGroup" . }}'] - resources: ['podsecuritypolicies'] - verbs: ['use'] - resourceNames: [{{ template "redis.fullname" . }}] -{{- end -}} -{{- if .Values.rbac.role.rules }} -{{- toYaml .Values.rbac.role.rules | nindent 2 }} -{{- end -}} -{{- end -}} diff --git a/chart/deps/redis/templates/redis-rolebinding.yaml b/chart/deps/redis/templates/redis-rolebinding.yaml deleted file mode 100644 index 835aa03..0000000 --- a/chart/deps/redis/templates/redis-rolebinding.yaml +++ /dev/null @@ -1,19 +0,0 @@ -{{- if .Values.rbac.create -}} -apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} -kind: RoleBinding -metadata: - name: {{ template "redis.fullname" . }} - namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: Role - name: {{ template "redis.fullname" . }} -subjects: -- kind: ServiceAccount - name: {{ template "redis.serviceAccountName" . }} -{{- end -}} diff --git a/chart/deps/redis/templates/redis-serviceaccount.yaml b/chart/deps/redis/templates/redis-serviceaccount.yaml deleted file mode 100644 index 081691d..0000000 --- a/chart/deps/redis/templates/redis-serviceaccount.yaml +++ /dev/null @@ -1,15 +0,0 @@ -{{- if .Values.serviceAccount.create -}} -apiVersion: v1 -kind: ServiceAccount -metadata: - name: {{ template "redis.serviceAccountName" . }} - namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.serviceAccount.annotations }} - annotations: {{ toYaml .Values.serviceAccount.annotations | nindent 4 }} - {{- end }} -{{- end -}} diff --git a/chart/deps/redis/templates/redis-slave-statefulset.yaml b/chart/deps/redis/templates/redis-slave-statefulset.yaml deleted file mode 100644 index ef653b0..0000000 --- a/chart/deps/redis/templates/redis-slave-statefulset.yaml +++ /dev/null @@ -1,386 +0,0 @@ -{{- if and .Values.cluster.enabled (not .Values.sentinel.enabled) }} -apiVersion: apps/v1 -kind: StatefulSet -metadata: - name: {{ template "redis.fullname" . }}-slave - namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.slave.statefulset.labels }} - {{- toYaml .Values.slave.statefulset.labels | nindent 4 }} - {{- end }} -{{- if .Values.slave.statefulset.annotations }} - annotations: - {{- toYaml .Values.slave.statefulset.annotations | nindent 4 }} -{{- end }} -spec: -{{- if .Values.slave.updateStrategy }} - strategy: {{- toYaml .Values.slave.updateStrategy | nindent 4 }} -{{- end }} - replicas: {{ .Values.cluster.slaveCount }} - serviceName: {{ template "redis.fullname" . }}-headless - selector: - matchLabels: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} - role: slave - template: - metadata: - labels: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} - chart: {{ template "redis.chart" . }} - role: slave - {{- if .Values.slave.podLabels }} - {{- toYaml .Values.slave.podLabels | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.podLabels }} - {{- toYaml .Values.metrics.podLabels | nindent 8 }} - {{- end }} - annotations: - checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }} - checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} - checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} - {{- if .Values.slave.podAnnotations }} - {{- toYaml .Values.slave.podAnnotations | nindent 8 }} - {{- end }} - {{- if and .Values.metrics.enabled .Values.metrics.podAnnotations }} - {{- toYaml .Values.metrics.podAnnotations | nindent 8 }} - {{- end }} - spec: - {{- include "redis.imagePullSecrets" . | nindent 6 }} - {{- if .Values.slave.hostAliases }} - hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.slave.hostAliases "context" $) | nindent 8 }} - {{- end }} - {{- if .Values.securityContext.enabled }} - securityContext: {{- omit .Values.securityContext "enabled" | toYaml | nindent 8 }} - {{- end }} - serviceAccountName: {{ template "redis.serviceAccountName" . }} - {{- if .Values.slave.priorityClassName }} - priorityClassName: {{ .Values.slave.priorityClassName | quote }} - {{- end }} - {{- if .Values.slave.nodeSelector }} - nodeSelector: {{- toYaml .Values.slave.nodeSelector | nindent 8 }} - {{- end }} - {{- if .Values.slave.tolerations }} - tolerations: {{- toYaml .Values.slave.tolerations | nindent 8 }} - {{- end }} - {{- if .Values.slave.shareProcessNamespace }} - shareProcessNamespace: {{ .Values.slave.shareProcessNamespace }} - {{- end }} - {{- if .Values.slave.schedulerName }} - schedulerName: {{ .Values.slave.schedulerName }} - {{- end }} - {{- if .Values.master.spreadConstraints }} - topologySpreadConstraints: {{- toYaml .Values.master.spreadConstraints | nindent 8 }} - {{- end }} - {{- with .Values.slave.affinity }} - affinity: {{- tpl (toYaml .) $ | nindent 8 }} - {{- end }} - containers: - - name: {{ template "redis.name" . }} - image: {{ template "redis.image" . }} - imagePullPolicy: {{ .Values.image.pullPolicy | quote }} - {{- if .Values.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - command: - - /bin/bash - - -c - - /opt/bitnami/scripts/start-scripts/start-slave.sh - env: - - name: REDIS_REPLICATION_MODE - value: slave - - name: REDIS_MASTER_HOST - value: {{ template "redis.fullname" . }}-master-0.{{ template "redis.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} - - name: REDIS_MASTER_PORT_NUMBER - value: {{ .Values.redisPort | quote }} - {{- if .Values.usePassword }} - {{- if .Values.usePasswordFile }} - - name: REDIS_PASSWORD_FILE - value: "/opt/bitnami/redis/secrets/redis-password" - - name: REDIS_MASTER_PASSWORD_FILE - value: "/opt/bitnami/redis/secrets/redis-password" - {{- else }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - - name: REDIS_MASTER_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - {{- end }} - {{- else }} - - name: ALLOW_EMPTY_PASSWORD - value: "yes" - {{- end }} - - name: REDIS_TLS_ENABLED - value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} - {{- if .Values.tls.enabled }} - - name: REDIS_TLS_PORT - value: {{ .Values.redisPort | quote }} - - name: REDIS_TLS_AUTH_CLIENTS - value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} - - name: REDIS_TLS_CERT_FILE - value: {{ template "redis.tlsCert" . }} - - name: REDIS_TLS_KEY_FILE - value: {{ template "redis.tlsCertKey" . }} - - name: REDIS_TLS_CA_FILE - value: {{ template "redis.tlsCACert" . }} - {{- if .Values.tls.dhParamsFilename }} - - name: REDIS_TLS_DH_PARAMS_FILE - value: {{ template "redis.tlsDHParams" . }} - {{- end }} - {{- else }} - - name: REDIS_PORT - value: {{ .Values.redisPort | quote }} - {{- end }} - {{- if .Values.slave.extraEnvVars }} - {{- include "redis.tplValue" (dict "value" .Values.slave.extraEnvVars "context" $) | nindent 12 }} - {{- end }} - {{- if or .Values.slave.extraEnvVarsCM .Values.slave.extraEnvVarsSecret }} - envFrom: - {{- if .Values.slave.extraEnvVarsCM }} - - configMapRef: - name: {{ .Values.slave.extraEnvVarsCM }} - {{- end }} - {{- if .Values.slave.extraEnvVarsSecret }} - - secretRef: - name: {{ .Values.slave.extraEnvVarsSecret }} - {{- end }} - {{- end }} - ports: - - name: redis - containerPort: {{ .Values.redisPort }} - {{- if .Values.slave.livenessProbe.enabled }} - livenessProbe: - initialDelaySeconds: {{ .Values.slave.livenessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.slave.livenessProbe.periodSeconds }} - timeoutSeconds: {{ add1 .Values.slave.livenessProbe.timeoutSeconds }} - successThreshold: {{ .Values.slave.livenessProbe.successThreshold }} - failureThreshold: {{ .Values.slave.livenessProbe.failureThreshold}} - exec: - command: - - sh - - -c - - /health/ping_liveness_local_and_master.sh {{ .Values.slave.livenessProbe.timeoutSeconds }} - {{- else if .Values.slave.customLivenessProbe }} - livenessProbe: {{- toYaml .Values.slave.customLivenessProbe | nindent 12 }} - {{- end }} - {{- if .Values.slave.readinessProbe.enabled }} - readinessProbe: - initialDelaySeconds: {{ .Values.slave.readinessProbe.initialDelaySeconds }} - periodSeconds: {{ .Values.slave.readinessProbe.periodSeconds }} - timeoutSeconds: {{ add1 .Values.slave.readinessProbe.timeoutSeconds }} - successThreshold: {{ .Values.slave.readinessProbe.successThreshold }} - failureThreshold: {{ .Values.slave.readinessProbe.failureThreshold }} - exec: - command: - - sh - - -c - - /health/ping_readiness_local_and_master.sh {{ .Values.slave.readinessProbe.timeoutSeconds }} - {{- else if .Values.slave.customReadinessProbe }} - readinessProbe: {{- toYaml .Values.slave.customReadinessProbe | nindent 12 }} - {{- end }} - resources: {{- toYaml .Values.slave.resources | nindent 12 }} - volumeMounts: - - name: start-scripts - mountPath: /opt/bitnami/scripts/start-scripts - - name: health - mountPath: /health - {{- if .Values.usePasswordFile }} - - name: redis-password - mountPath: /opt/bitnami/redis/secrets/ - {{- end }} - - name: redis-data - mountPath: /data - - name: config - mountPath: /opt/bitnami/redis/mounted-etc - - name: redis-tmp-conf - mountPath: /opt/bitnami/redis/etc - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - {{- if .Values.metrics.enabled }} - - name: metrics - image: {{ template "redis.metrics.image" . }} - imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} - {{- if .Values.containerSecurityContext.enabled }} - securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} - {{- end }} - command: - - /bin/bash - - -c - - | - if [[ -f '/secrets/redis-password' ]]; then - export REDIS_PASSWORD=$(cat /secrets/redis-password) - fi - redis_exporter{{- range $key, $value := .Values.metrics.extraArgs }} --{{ $key }}={{ $value }}{{- end }} - env: - - name: REDIS_ALIAS - value: {{ template "redis.fullname" . }} - {{- if and .Values.usePassword (not .Values.usePasswordFile) }} - - name: REDIS_PASSWORD - valueFrom: - secretKeyRef: - name: {{ template "redis.secretName" . }} - key: {{ template "redis.secretPasswordKey" . }} - {{- end }} - {{- if .Values.tls.enabled }} - - name: REDIS_ADDR - value: rediss://localhost:{{ .Values.redisPort }} - - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE - value: {{ template "redis.tlsCertKey" . }} - - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE - value: {{ template "redis.tlsCert" . }} - - name: REDIS_EXPORTER_TLS_CA_CERT_FILE - value: {{ template "redis.tlsCACert" . }} - {{- end }} - volumeMounts: - {{- if .Values.usePasswordFile }} - - name: redis-password - mountPath: /secrets/ - {{- end }} - {{- if .Values.tls.enabled }} - - name: redis-certificates - mountPath: /opt/bitnami/redis/certs - readOnly: true - {{- end }} - ports: - - name: metrics - containerPort: 9121 - resources: {{- toYaml .Values.metrics.resources | nindent 12 }} - {{- end }} - {{- $needsVolumePermissions := and .Values.volumePermissions.enabled .Values.slave.persistence.enabled .Values.securityContext.enabled .Values.containerSecurityContext.enabled }} - {{- if or $needsVolumePermissions .Values.sysctlImage.enabled }} - initContainers: - {{- if $needsVolumePermissions }} - - name: volume-permissions - image: {{ template "redis.volumePermissions.image" . }} - imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} - command: - - /bin/bash - - -ec - - | - {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} - chown -R `id -u`:`id -G | cut -d " " -f2` {{ .Values.slave.persistence.path }} - {{- else }} - chown -R {{ .Values.containerSecurityContext.runAsUser }}:{{ .Values.securityContext.fsGroup }} {{ .Values.slave.persistence.path }} - {{- end }} - {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto "}} - securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 12 }} - {{- else }} - securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 12 }} - {{- end }} - resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} - volumeMounts: - - name: redis-data - mountPath: {{ .Values.slave.persistence.path }} - subPath: {{ .Values.slave.persistence.subPath }} - {{- end }} - {{- if .Values.sysctlImage.enabled }} - - name: init-sysctl - image: {{ template "redis.sysctl.image" . }} - imagePullPolicy: {{ default "" .Values.sysctlImage.pullPolicy | quote }} - resources: {{- toYaml .Values.sysctlImage.resources | nindent 12 }} - {{- if .Values.sysctlImage.mountHostSys }} - volumeMounts: - - name: host-sys - mountPath: /host-sys - {{- end }} - command: {{- toYaml .Values.sysctlImage.command | nindent 12 }} - securityContext: - privileged: true - runAsUser: 0 - {{- end }} - {{- end }} - volumes: - - name: start-scripts - configMap: - name: {{ include "redis.fullname" . }}-scripts - defaultMode: 0755 - - name: health - configMap: - name: {{ template "redis.fullname" . }}-health - defaultMode: 0755 - {{- if .Values.usePasswordFile }} - - name: redis-password - secret: - secretName: {{ template "redis.secretName" . }} - items: - - key: {{ template "redis.secretPasswordKey" . }} - path: redis-password - {{- end }} - - name: config - configMap: - name: {{ template "redis.fullname" . }} - {{- if .Values.sysctlImage.mountHostSys }} - - name: host-sys - hostPath: - path: /sys - {{- end }} - - name: redis-tmp-conf - emptyDir: {} - {{- if .Values.tls.enabled }} - - name: redis-certificates - secret: - secretName: {{ required "A secret containing the certificates for the TLS traffic is required when TLS in enabled" .Values.tls.certificatesSecret }} - defaultMode: 256 - {{- end }} - {{- if not .Values.slave.persistence.enabled }} - - name: redis-data - emptyDir: {} - {{- else }} - volumeClaimTemplates: - - metadata: - name: redis-data - labels: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - component: slave - {{- if .Values.slave.statefulset.volumeClaimTemplates }} - {{- if .Values.slave.statefulset.volumeClaimTemplates.labels }} - {{- toYaml .Values.slave.statefulset.volumeClaimTemplates.labels | nindent 10 }} - {{- end }} - {{- if .Values.slave.statefulset.volumeClaimTemplates.annotations }} - annotations: - {{- toYaml .Values.slave.statefulset.volumeClaimTemplates.annotations | nindent 10 }} - {{- end }} - {{- end }} - spec: - accessModes: - {{- range .Values.slave.persistence.accessModes }} - - {{ . | quote }} - {{- end }} - resources: - requests: - storage: {{ .Values.slave.persistence.size | quote }} - {{ include "redis.slave.storageClass" . }} - selector: - {{- if .Values.slave.persistence.matchLabels }} - matchLabels: {{- toYaml .Values.slave.persistence.matchLabels | nindent 12 }} - {{- end -}} - {{- if .Values.slave.persistence.matchExpressions }} - matchExpressions: {{- toYaml .Values.slave.persistence.matchExpressions | nindent 12 }} - {{- end -}} - {{- end }} - updateStrategy: - type: {{ .Values.slave.statefulset.updateStrategy }} - {{- if .Values.slave.statefulset.rollingUpdatePartition }} - {{- if (eq "Recreate" .Values.slave.statefulset.updateStrategy) }} - rollingUpdate: null - {{- else }} - rollingUpdate: - partition: {{ .Values.slave.statefulset.rollingUpdatePartition }} - {{- end }} - {{- end }} -{{- end }} diff --git a/chart/deps/redis/templates/redis-slave-svc.yaml b/chart/deps/redis/templates/redis-slave-svc.yaml deleted file mode 100644 index a67ebb0..0000000 --- a/chart/deps/redis/templates/redis-slave-svc.yaml +++ /dev/null @@ -1,43 +0,0 @@ -{{- if and .Values.cluster.enabled (not .Values.sentinel.enabled) }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "redis.fullname" . }}-slave - namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.slave.service.labels -}} - {{- toYaml .Values.slave.service.labels | nindent 4 }} - {{- end -}} -{{- if .Values.slave.service.annotations }} - annotations: {{- toYaml .Values.slave.service.annotations | nindent 4 }} -{{- end }} -spec: - type: {{ .Values.slave.service.type }} - {{ if eq .Values.slave.service.type "LoadBalancer" }} - externalTrafficPolicy: {{ .Values.slave.service.externalTrafficPolicy }} - {{- end }} - {{- if and (eq .Values.slave.service.type "LoadBalancer") .Values.slave.service.loadBalancerIP }} - loadBalancerIP: {{ .Values.slave.service.loadBalancerIP }} - {{- end }} - {{- if and (eq .Values.slave.service.type "LoadBalancer") .Values.slave.service.loadBalancerSourceRanges }} - loadBalancerSourceRanges: - {{- with .Values.slave.service.loadBalancerSourceRanges }} - {{- toYaml . | nindent 4 }} - {{- end }} - {{- end }} - ports: - - name: tcp-redis - port: {{ .Values.slave.service.port }} - targetPort: redis - {{- if .Values.slave.service.nodePort }} - nodePort: {{ .Values.slave.service.nodePort }} - {{- end }} - selector: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} - role: slave -{{- end }} diff --git a/chart/deps/redis/templates/redis-with-sentinel-svc.yaml b/chart/deps/redis/templates/redis-with-sentinel-svc.yaml deleted file mode 100644 index e1c9073..0000000 --- a/chart/deps/redis/templates/redis-with-sentinel-svc.yaml +++ /dev/null @@ -1,43 +0,0 @@ -{{- if .Values.sentinel.enabled }} -apiVersion: v1 -kind: Service -metadata: - name: {{ template "redis.fullname" . }} - namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: {{ .Release.Name }} - heritage: {{ .Release.Service }} - {{- if .Values.sentinel.service.labels }} - {{- toYaml .Values.sentinel.service.labels | nindent 4 }} - {{- end }} -{{- if .Values.sentinel.service.annotations }} - annotations: {{- toYaml .Values.sentinel.service.annotations | nindent 4 }} -{{- end }} -spec: - type: {{ .Values.sentinel.service.type }} - {{ if eq .Values.sentinel.service.type "LoadBalancer" }} - externalTrafficPolicy: {{ .Values.sentinel.service.externalTrafficPolicy }} - {{- end }} - {{ if eq .Values.sentinel.service.type "LoadBalancer" -}} {{ if .Values.sentinel.service.loadBalancerIP }} - loadBalancerIP: {{ .Values.sentinel.service.loadBalancerIP }} - {{ end -}} - {{- end -}} - ports: - - name: tcp-redis - port: {{ .Values.sentinel.service.redisPort }} - targetPort: redis - {{- if .Values.sentinel.service.redisNodePort }} - nodePort: {{ .Values.sentinel.service.redisNodePort }} - {{- end }} - - name: tcp-sentinel - port: {{ .Values.sentinel.service.sentinelPort }} - targetPort: redis-sentinel - {{- if .Values.sentinel.service.sentinelNodePort }} - nodePort: {{ .Values.sentinel.service.sentinelNodePort }} - {{- end }} - selector: - app: {{ template "redis.name" . }} - release: {{ .Release.Name }} -{{- end }} diff --git a/chart/deps/redis/templates/replicas/service.yaml b/chart/deps/redis/templates/replicas/service.yaml new file mode 100644 index 0000000..fd9c617 --- /dev/null +++ b/chart/deps/redis/templates/replicas/service.yaml @@ -0,0 +1,46 @@ +{{- if and (eq .Values.architecture "replication") (not .Values.sentinel.enabled) }} +apiVersion: v1 +kind: Service +metadata: + name: {{ printf "%s-replicas" (include "common.names.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: replica + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if or .Values.replica.service.annotations .Values.commonAnnotations }} + annotations: + {{- if .Values.replica.service.annotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.replica.service.annotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +spec: + type: {{ .Values.replica.service.type }} + {{- if eq .Values.replica.service.type "LoadBalancer" }} + externalTrafficPolicy: {{ .Values.replica.service.externalTrafficPolicy }} + {{- end }} + {{- if and (eq .Values.replica.service.type "LoadBalancer") .Values.replica.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.replica.service.loadBalancerIP }} + {{- end }} + {{- if and (eq .Values.replica.service.type "LoadBalancer") .Values.replica.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: {{- toYaml .Values.replica.service.loadBalancerSourceRanges | nindent 4 }} + {{- end }} + {{- if and (eq .Values.replica.service.type "ClusterIP") .Values.replica.service.clusterIP }} + clusterIP: {{ .Values.replica.service.clusterIP }} + {{- end }} + ports: + - name: tcp-redis + port: {{ .Values.replica.service.port }} + targetPort: redis + {{- if and (or (eq .Values.replica.service.type "NodePort") (eq .Values.replica.service.type "LoadBalancer")) .Values.replica.service.nodePort }} + nodePort: {{ .Values.replica.service.nodePort }} + {{- else if eq .Values.replica.service.type "ClusterIP" }} + nodePort: null + {{- end }} + selector: {{- include "common.labels.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: replica +{{- end }} diff --git a/chart/deps/redis/templates/replicas/statefulset.yaml b/chart/deps/redis/templates/replicas/statefulset.yaml new file mode 100644 index 0000000..4fd3029 --- /dev/null +++ b/chart/deps/redis/templates/replicas/statefulset.yaml @@ -0,0 +1,405 @@ +{{- if and (eq .Values.architecture "replication") (not .Values.sentinel.enabled) }} +apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} +kind: StatefulSet +metadata: + name: {{ printf "%s-replicas" (include "common.names.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: replica + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + replicas: {{ .Values.replica.replicaCount }} + selector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: replica + serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) }} + {{- if .Values.replica.updateStrategy }} + updateStrategy: {{- toYaml .Values.replica.updateStrategy | nindent 4 }} + {{- end }} + template: + metadata: + labels: {{- include "common.labels.standard" . | nindent 8 }} + app.kubernetes.io/component: replica + {{- if .Values.replica.podLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.replica.podLabels "context" $ ) | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.podLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.podLabels "context" $ ) | nindent 8 }} + {{- end }} + annotations: + {{- if (include "redis.createConfigmap" .) }} + checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + {{- end }} + checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }} + checksum/scripts: {{ include (print $.Template.BasePath "/scripts-configmap.yaml") . | sha256sum }} + checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} + {{- if .Values.replica.podAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.replica.podAnnotations "context" $ ) | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.podAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.podAnnotations "context" $ ) | nindent 8 }} + {{- end }} + spec: + {{- include "redis.imagePullSecrets" . | nindent 6 }} + {{- if .Values.replica.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.replica.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.replica.podSecurityContext.enabled }} + securityContext: {{- omit .Values.replica.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + serviceAccountName: {{ template "redis.serviceAccountName" . }} + {{- if .Values.replica.priorityClassName }} + priorityClassName: {{ .Values.replica.priorityClassName | quote }} + {{- end }} + {{- if .Values.replica.affinity }} + affinity: {{- include "common.tplvalues.render" (dict "value" .Values.replica.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.replica.podAffinityPreset "component" "replica" "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.replica.podAntiAffinityPreset "component" "replica" "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.replica.nodeAffinityPreset.type "key" .Values.replica.nodeAffinityPreset.key "values" .Values.replica.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.replica.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.replica.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.replica.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.replica.tolerations "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.replica.spreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.replica.spreadConstraints "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.replica.shareProcessNamespace }} + shareProcessNamespace: {{ .Values.replica.shareProcessNamespace }} + {{- end }} + {{- if .Values.replica.schedulerName }} + schedulerName: {{ .Values.replica.schedulerName | quote }} + {{- end }} + terminationGracePeriodSeconds: {{ .Values.replica.terminationGracePeriodSeconds }} + containers: + - name: redis + image: {{ template "redis.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + {{- if .Values.replica.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.replica.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.replica.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.replica.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.replica.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.replica.command "context" $) | nindent 12 }} + {{- else }} + command: + - /bin/bash + {{- end }} + {{- if .Values.replica.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.replica.args "context" $) | nindent 12 }} + {{- else }} + args: + - -c + - /opt/bitnami/scripts/start-scripts/start-replica.sh + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.image.debug | quote }} + - name: REDIS_REPLICATION_MODE + value: slave + - name: REDIS_MASTER_HOST + value: {{ template "common.names.fullname" . }}-master-0.{{ template "common.names.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }} + - name: REDIS_MASTER_PORT_NUMBER + value: {{ .Values.master.service.port | quote }} + - name: ALLOW_EMPTY_PASSWORD + value: {{ ternary "no" "yes" .Values.auth.enabled | quote }} + {{- if .Values.auth.enabled }} + {{- if .Values.auth.usePasswordFiles }} + - name: REDIS_PASSWORD_FILE + value: "/opt/bitnami/redis/secrets/redis-password" + - name: REDIS_MASTER_PASSWORD_FILE + value: "/opt/bitnami/redis/secrets/redis-password" + {{- else }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + - name: REDIS_MASTER_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + {{- end }} + {{- end }} + - name: REDIS_TLS_ENABLED + value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} + {{- if .Values.tls.enabled }} + - name: REDIS_TLS_PORT + value: {{ .Values.replica.containerPort | quote }} + - name: REDIS_TLS_AUTH_CLIENTS + value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} + - name: REDIS_TLS_CERT_FILE + value: {{ template "redis.tlsCert" . }} + - name: REDIS_TLS_KEY_FILE + value: {{ template "redis.tlsCertKey" . }} + - name: REDIS_TLS_CA_FILE + value: {{ template "redis.tlsCACert" . }} + {{- if .Values.tls.dhParamsFilename }} + - name: REDIS_TLS_DH_PARAMS_FILE + value: {{ template "redis.tlsDHParams" . }} + {{- end }} + {{- else }} + - name: REDIS_PORT + value: {{ .Values.replica.containerPort | quote }} + {{- end }} + {{- if .Values.replica.extraEnvVars }} + {{- include "common.tplvalues.render" (dict "value" .Values.replica.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.replica.extraEnvVarsCM .Values.replica.extraEnvVarsSecret }} + envFrom: + {{- if .Values.replica.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.replica.extraEnvVarsCM }} + {{- end }} + {{- if .Values.replica.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.replica.extraEnvVarsSecret }} + {{- end }} + {{- end }} + ports: + - name: redis + containerPort: {{ .Values.replica.containerPort }} + {{- if .Values.replica.livenessProbe.enabled }} + livenessProbe: + initialDelaySeconds: {{ .Values.replica.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.replica.livenessProbe.periodSeconds }} + timeoutSeconds: {{ add1 .Values.replica.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.replica.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.replica.livenessProbe.failureThreshold}} + exec: + command: + - sh + - -c + - /health/ping_liveness_local_and_master.sh {{ .Values.replica.livenessProbe.timeoutSeconds }} + {{- else if .Values.replica.customLivenessProbe }} + livenessProbe: {{- toYaml .Values.replica.customLivenessProbe | nindent 12 }} + {{- end }} + {{- if .Values.replica.readinessProbe.enabled }} + readinessProbe: + initialDelaySeconds: {{ .Values.replica.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.replica.readinessProbe.periodSeconds }} + timeoutSeconds: {{ add1 .Values.replica.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.replica.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.replica.readinessProbe.failureThreshold }} + exec: + command: + - sh + - -c + - /health/ping_readiness_local_and_master.sh {{ .Values.replica.readinessProbe.timeoutSeconds }} + {{- else if .Values.replica.customReadinessProbe }} + readinessProbe: {{- toYaml .Values.replica.customReadinessProbe | nindent 12 }} + {{- end }} + {{- if .Values.replica.resources }} + resources: {{- toYaml .Values.replica.resources | nindent 12 }} + {{- end }} + volumeMounts: + - name: start-scripts + mountPath: /opt/bitnami/scripts/start-scripts + - name: health + mountPath: /health + {{- if .Values.auth.usePasswordFiles }} + - name: redis-password + mountPath: /opt/bitnami/redis/secrets/ + {{- end }} + - name: redis-data + mountPath: /data + subPath: {{ .Values.replica.persistence.subPath }} + - name: config + mountPath: /opt/bitnami/redis/mounted-etc + - name: redis-tmp-conf + mountPath: /opt/bitnami/redis/etc + {{- if .Values.tls.enabled }} + - name: redis-certificates + mountPath: /opt/bitnami/redis/certs + readOnly: true + {{- end }} + {{- if .Values.replica.extraVolumeMounts }} + {{- include "common.tplvalues.render" ( dict "value" .Values.replica.extraVolumeMounts "context" $ ) | nindent 12 }} + {{- end }} + {{- if .Values.metrics.enabled }} + - name: metrics + image: {{ include "redis.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + {{- if .Values.metrics.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.metrics.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + command: + - /bin/bash + - -c + - | + if [[ -f '/secrets/redis-password' ]]; then + export REDIS_PASSWORD=$(cat /secrets/redis-password) + fi + redis_exporter{{- range $key, $value := .Values.metrics.extraArgs }} --{{ $key }}={{ $value }}{{- end }} + env: + - name: REDIS_ALIAS + value: {{ template "common.names.fullname" . }} + {{- if .Values.auth.enabled }} + - name: REDIS_USER + value: default + {{- if (not .Values.auth.usePasswordFiles) }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + {{- end }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: REDIS_ADDR + value: rediss://{{ .Values.metrics.redisTargetHost }}:{{ .Values.replica.containerPort }} + {{- if .Values.tls.authClients }} + - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE + value: {{ template "redis.tlsCertKey" . }} + - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE + value: {{ template "redis.tlsCert" . }} + {{- end }} + - name: REDIS_EXPORTER_TLS_CA_CERT_FILE + value: {{ template "redis.tlsCACert" . }} + {{- end }} + ports: + - name: metrics + containerPort: 9121 + {{- if .Values.metrics.resources }} + resources: {{- toYaml .Values.metrics.resources | nindent 12 }} + {{- end }} + volumeMounts: + {{- if .Values.auth.usePasswordFiles }} + - name: redis-password + mountPath: /secrets/ + {{- end }} + {{- if .Values.tls.enabled }} + - name: redis-certificates + mountPath: /opt/bitnami/redis/certs + readOnly: true + {{- end }} + {{- end }} + {{- if .Values.replica.sidecars }} + {{- include "common.tplvalues.render" (dict "value" .Values.replica.sidecars "context" $) | nindent 8 }} + {{- end }} + {{- $needsVolumePermissions := and .Values.volumePermissions.enabled .Values.replica.persistence.enabled .Values.replica.podSecurityContext.enabled .Values.replica.containerSecurityContext.enabled }} + {{- if or .Values.replica.initContainers $needsVolumePermissions .Values.sysctl.enabled }} + initContainers: + {{- if .Values.replica.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.replica.initContainers "context" $) | nindent 8 }} + {{- end }} + {{- if $needsVolumePermissions }} + - name: volume-permissions + image: {{ include "redis.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: + - /bin/bash + - -ec + - | + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + chown -R `id -u`:`id -G | cut -d " " -f2` {{ .Values.replica.persistence.path }} + {{- else }} + chown -R {{ .Values.replica.containerSecurityContext.runAsUser }}:{{ .Values.replica.podSecurityContext.fsGroup }} {{ .Values.replica.persistence.path }} + {{- end }} + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "runAsUser" | toYaml | nindent 12 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.volumePermissions.resources }} + resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} + {{- end }} + volumeMounts: + - name: redis-data + mountPath: {{ .Values.replica.persistence.path }} + subPath: {{ .Values.replica.persistence.subPath }} + {{- end }} + {{- if .Values.sysctl.enabled }} + - name: init-sysctl + image: {{ include "redis.sysctl.image" . }} + imagePullPolicy: {{ default "" .Values.sysctl.image.pullPolicy | quote }} + securityContext: + privileged: true + runAsUser: 0 + {{- if .Values.sysctl.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.sysctl.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.sysctl.resources }} + resources: {{- toYaml .Values.sysctl.resources | nindent 12 }} + {{- end }} + {{- if .Values.sysctl.mountHostSys }} + volumeMounts: + - name: host-sys + mountPath: /host-sys + {{- end }} + {{- end }} + {{- end }} + volumes: + - name: start-scripts + configMap: + name: {{ printf "%s-scripts" (include "common.names.fullname" .) }} + defaultMode: 0755 + - name: health + configMap: + name: {{ printf "%s-health" (include "common.names.fullname" .) }} + defaultMode: 0755 + {{- if .Values.auth.usePasswordFiles }} + - name: redis-password + secret: + secretName: {{ template "redis.secretName" . }} + items: + - key: {{ template "redis.secretPasswordKey" . }} + path: redis-password + {{- end }} + - name: config + configMap: + name: {{ include "redis.configmapName" . }} + {{- if .Values.sysctl.mountHostSys }} + - name: host-sys + hostPath: + path: /sys + {{- end }} + - name: redis-tmp-conf + emptyDir: {} + {{- if .Values.tls.enabled }} + - name: redis-certificates + secret: + secretName: {{ required "A secret containing the certificates for the TLS traffic is required when TLS in enabled" .Values.tls.certificatesSecret }} + defaultMode: 256 + {{- end }} + {{- if .Values.replica.extraVolumes }} + {{- include "common.tplvalues.render" ( dict "value" .Values.replica.extraVolumes "context" $ ) | nindent 8 }} + {{- end }} + {{- if not .Values.replica.persistence.enabled }} + - name: redis-data + emptyDir: {} + {{- else }} + volumeClaimTemplates: + - metadata: + name: redis-data + labels: {{- include "common.labels.matchLabels" . | nindent 10 }} + app.kubernetes.io/component: replica + {{- if .Values.replica.persistence.annotations }} + annotations: {{- toYaml .Values.replica.persistence.annotations | nindent 10 }} + {{- end }} + spec: + accessModes: + {{- range .Values.replica.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.replica.persistence.size | quote }} + {{- if .Values.replica.persistence.selector }} + selector: {{- include "common.tplvalues.render" (dict "value" .Values.replica.persistence.selector "context" $) | nindent 10 }} + {{- end }} + {{- include "common.storage.class" (dict "persistence" .Values.replica.persistence "global" .Values.global) | nindent 8 }} + {{- end }} +{{- end }} diff --git a/chart/deps/redis/templates/role.yaml b/chart/deps/redis/templates/role.yaml new file mode 100644 index 0000000..dc61b44 --- /dev/null +++ b/chart/deps/redis/templates/role.yaml @@ -0,0 +1,27 @@ +{{- if .Values.rbac.create }} +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +kind: Role +metadata: + name: {{ template "common.names.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +rules: + {{- if .Values.podSecurityPolicy.create }} + - apiGroups: + - '{{ template "podSecurityPolicy.apiGroup" . }}' + resources: + - 'podsecuritypolicies' + verbs: + - 'use' + resourceNames: [{{ template "common.names.fullname" . }}] + {{- end }} + {{- if .Values.rbac.rules }} + {{- include "common.tplvalues.render" ( dict "value" .Values.rbac.rules "context" $ ) | nindent 2 }} + {{- end }} +{{- end }} diff --git a/chart/deps/redis/templates/rolebinding.yaml b/chart/deps/redis/templates/rolebinding.yaml new file mode 100644 index 0000000..74968b8 --- /dev/null +++ b/chart/deps/redis/templates/rolebinding.yaml @@ -0,0 +1,21 @@ +{{- if .Values.rbac.create }} +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +kind: RoleBinding +metadata: + name: {{ template "common.names.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ template "common.names.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ template "redis.serviceAccountName" . }} +{{- end }} diff --git a/chart/deps/redis/templates/scripts-configmap.yaml b/chart/deps/redis/templates/scripts-configmap.yaml new file mode 100644 index 0000000..7e98d68 --- /dev/null +++ b/chart/deps/redis/templates/scripts-configmap.yaml @@ -0,0 +1,450 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-scripts" (include "common.names.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: +{{- if and (eq .Values.architecture "replication") .Values.sentinel.enabled }} + start-node.sh: | + #!/bin/bash + + . /opt/bitnami/scripts/libos.sh + . /opt/bitnami/scripts/liblog.sh + . /opt/bitnami/scripts/libvalidations.sh + + not_exists_dns_entry() { + myip=$(hostname -i) + + if [[ -z "$(getent ahosts "$HEADLESS_SERVICE" | grep "^${myip}" )" ]]; then + warn "$HEADLESS_SERVICE does not contain the IP of this pod: ${myip}" + return 1 + fi + debug "$HEADLESS_SERVICE has my IP: ${myip}" + return 0 + } + + HEADLESS_SERVICE="{{ template "common.names.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" + REDIS_SERVICE="{{ template "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" + + # Waits for DNS to add this ip to the service DNS entry + retry_while not_exists_dns_entry + + export REDIS_REPLICATION_MODE="slave" + [[ -z "$(getent ahosts "$HEADLESS_SERVICE" | grep -v "^$(hostname -i) ")" ]] && export REDIS_REPLICATION_MODE="master" + + {{- if and .Values.replica.containerSecurityContext.runAsUser (eq (.Values.replica.containerSecurityContext.runAsUser | int) 0) }} + useradd redis + chown -R redis {{ .Values.replica.persistence.path }} + {{- end }} + + [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" + [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" + + if [[ "$REDIS_REPLICATION_MODE" = "master" ]]; then + debug "Starting as master node" + if [[ ! -f /opt/bitnami/redis/etc/master.conf ]]; then + cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf + fi + else + debug "Starting as replica node" + if [[ ! -f /opt/bitnami/redis/etc/replica.conf ]];then + cp /opt/bitnami/redis/mounted-etc/replica.conf /opt/bitnami/redis/etc/replica.conf + fi + if is_boolean_yes "$REDIS_TLS_ENABLED"; then + sentinel_info_command="redis-cli {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_SERVICE -p {{ .Values.sentinel.service.sentinelPort }} --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + else + sentinel_info_command="redis-cli {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_SERVICE -p {{ .Values.sentinel.service.sentinelPort }} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + fi + REDIS_SENTINEL_INFO=($($sentinel_info_command)) + REDIS_MASTER_HOST=${REDIS_SENTINEL_INFO[0]} + REDIS_MASTER_PORT_NUMBER=${REDIS_SENTINEL_INFO[1]} + + # Immediately attempt to connect to the reported master. If it doesn't exist the connection attempt will either hang + # or fail with "port unreachable" and give no data. The liveness check will then timeout waiting for the redis + # container to be ready and restart the it. By then the new master will likely have been elected + if is_boolean_yes "$REDIS_TLS_ENABLED"; then + sentinel_info_command="redis-cli {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_MASTER_HOST -p {{ .Values.sentinel.service.sentinelPort }} --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + else + sentinel_info_command="redis-cli {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_MASTER_HOST -p {{ .Values.sentinel.service.sentinelPort }} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + fi + + if [[ ! ($($sentinel_info_command)) ]]; then + # master doesn't actually exist, this probably means the remaining pods haven't elected a new one yet + # and are reporting the old one still. Once this happens the container will get stuck and never see the new + # master. We stop here to allow the container to not pass the liveness check and be restarted. + exit 1 + fi + fi + + if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then + cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf + fi + {{- if .Values.tls.enabled }} + ARGS=("--port" "0") + ARGS+=("--tls-port" "${REDIS_TLS_PORT}") + ARGS+=("--tls-cert-file" "${REDIS_TLS_CERT_FILE}") + ARGS+=("--tls-key-file" "${REDIS_TLS_KEY_FILE}") + ARGS+=("--tls-ca-cert-file" "${REDIS_TLS_CA_FILE}") + ARGS+=("--tls-auth-clients" "${REDIS_TLS_AUTH_CLIENTS}") + ARGS+=("--tls-replication" "yes") + {{- if .Values.tls.dhParamsFilename }} + ARGS+=("--tls-dh-params-file" "${REDIS_TLS_DH_PARAMS_FILE}") + {{- end }} + {{- else }} + ARGS=("--port" "${REDIS_PORT}") + {{- end }} + + if [[ "$REDIS_REPLICATION_MODE" = "slave" ]]; then + ARGS+=("--slaveof" "${REDIS_MASTER_HOST}" "${REDIS_MASTER_PORT_NUMBER}") + fi + + {{- if .Values.auth.enabled }} + ARGS+=("--requirepass" "${REDIS_PASSWORD}") + ARGS+=("--masterauth" "${REDIS_MASTER_PASSWORD}") + {{- else }} + ARGS+=("--protected-mode" "no") + {{- end }} + if [[ "$REDIS_REPLICATION_MODE" = "master" ]]; then + ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf") + else + ARGS+=("--include" "/opt/bitnami/redis/etc/replica.conf") + fi + ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") + {{- if .Values.replica.extraFlags }} + {{- range .Values.replica.extraFlags }} + ARGS+=({{ . | quote }}) + {{- end }} + {{- end }} + + {{- if .Values.replica.preExecCmds }} + {{- .Values.replica.preExecCmds | nindent 4}} + {{- end }} + + {{- if .Values.replica.command }} + exec {{ .Values.replica.command }} "${ARGS[@]}" + {{- else }} + exec redis-server "${ARGS[@]}" + {{- end }} + + start-sentinel.sh: | + #!/bin/bash + + . /opt/bitnami/scripts/libos.sh + . /opt/bitnami/scripts/libvalidations.sh + . /opt/bitnami/scripts/libfile.sh + + sentinel_conf_set() { + local -r key="${1:?missing key}" + local value="${2:-}" + + # Sanitize inputs + value="${value//\\/\\\\}" + value="${value//&/\\&}" + value="${value//\?/\\?}" + [[ "$value" = "" ]] && value="\"$value\"" + + replace_in_file "/opt/bitnami/redis-sentinel/etc/sentinel.conf" "^#*\s*${key} .*" "${key} ${value}" false + } + sentinel_conf_add() { + echo $'\n'"$@" >> "/opt/bitnami/redis-sentinel/etc/sentinel.conf" + } + host_id() { + echo "$1" | openssl sha1 | awk '{print $2}' + } + not_exists_dns_entry() { + myip=$(hostname -i) + + if [[ -z "$(getent ahosts "$HEADLESS_SERVICE" | grep "^${myip}" )" ]]; then + warn "$HEADLESS_SERVICE does not contain the IP of this pod: ${myip}" + return 1 + fi + debug "$HEADLESS_SERVICE has my IP: ${myip}" + return 0 + } + + HEADLESS_SERVICE="{{ template "common.names.fullname" . }}-headless.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" + REDIS_SERVICE="{{ template "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" + + [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" + + if [[ ! -f /opt/bitnami/redis-sentinel/etc/sentinel.conf ]]; then + cp /opt/bitnami/redis-sentinel/mounted-etc/sentinel.conf /opt/bitnami/redis-sentinel/etc/sentinel.conf + {{- if .Values.auth.enabled }} + printf "\nsentinel auth-pass %s %s" "{{ .Values.sentinel.masterSet }}" "$REDIS_PASSWORD" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf + {{- if .Values.auth.sentinel }} + printf "\nrequirepass %s" "$REDIS_PASSWORD" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf + {{- end }} + {{- end }} + {{- if .Values.sentinel.staticID }} + printf "\nsentinel myid %s" "$(host_id "$HOSTNAME")" >> /opt/bitnami/redis-sentinel/etc/sentinel.conf + {{- end }} + fi + + export REDIS_REPLICATION_MODE="slave" + + # Waits for DNS to add this ip to the service DNS entry + retry_while not_exists_dns_entry + + if [[ -z "$(getent ahosts "$HEADLESS_SERVICE" | grep -v "^$(hostname -i)")" ]]; then + export REDIS_REPLICATION_MODE="master" + fi + + # Clean sentineles from the current sentinel nodes + for node in $( getent ahosts "$HEADLESS_SERVICE" | grep -v "^$(hostname -i)" | cut -f 1 -d ' ' | uniq ); do + info "Cleaning sentinels in sentinel node: $node" + if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then + redis-cli {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD {{- end }} -h $node -p {{ .Values.sentinel.service.sentinelPort }} --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel reset "*" + else + redis-cli {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD {{- end }} -h $node -p {{ .Values.sentinel.service.sentinelPort }} sentinel reset "*" + fi + sleep {{ .Values.sentinel.cleanDelaySeconds }} + done + info "Sentinels clean up done" + + if [[ "$REDIS_REPLICATION_MODE" = "master" ]]; then + REDIS_MASTER_HOST="$(hostname -i)" + REDIS_MASTER_PORT_NUMBER="{{ .Values.master.service.port }}" + else + if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then + sentinel_info_command="redis-cli {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_SERVICE -p {{ .Values.sentinel.service.sentinelPort }} --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + else + sentinel_info_command="redis-cli {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_SERVICE -p {{ .Values.sentinel.service.sentinelPort }} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + fi + REDIS_SENTINEL_INFO=($($sentinel_info_command)) + REDIS_MASTER_HOST=${REDIS_SENTINEL_INFO[0]} + REDIS_MASTER_PORT_NUMBER=${REDIS_SENTINEL_INFO[1]} + + # Immediately attempt to connect to the reported master. If it doesn't exist the connection attempt will either hang + # or fail with "port unreachable" and give no data. The liveness check will then timeout waiting for the sentinel + # container to be ready and restart the it. By then the new master will likely have been elected + if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then + sentinel_info_command="redis-cli {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_MASTER_HOST -p {{ .Values.sentinel.service.sentinelPort }} --tls --cert ${REDIS_SENTINEL_TLS_CERT_FILE} --key ${REDIS_SENTINEL_TLS_KEY_FILE} --cacert ${REDIS_SENTINEL_TLS_CA_FILE} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + else + sentinel_info_command="redis-cli {{- if .Values.auth.enabled }} -a $REDIS_PASSWORD {{- end }} -h $REDIS_MASTER_HOST -p {{ .Values.sentinel.service.sentinelPort }} sentinel get-master-addr-by-name {{ .Values.sentinel.masterSet }}" + fi + + if [[ ! ($($sentinel_info_command)) ]]; then + # master doesn't actually exist, this probably means the remaining pods haven't elected a new one yet + # and are reporting the old one still. Once this happens the container will get stuck and never see the new + # master. We stop here to allow the container to not pass the liveness check and be restarted. + exit 1 + fi + fi + sentinel_conf_set "sentinel monitor" "{{ .Values.sentinel.masterSet }} "$REDIS_MASTER_HOST" "$REDIS_MASTER_PORT_NUMBER" {{ .Values.sentinel.quorum }}" + + add_replica() { + if [[ "$1" != "$REDIS_MASTER_HOST" ]]; then + sentinel_conf_add "sentinel known-replica {{ .Values.sentinel.masterSet }} $1 {{ .Values.sentinel.service.port }}" + fi + } + + {{- if .Values.sentinel.staticID }} + # remove generated known sentinels and replicas + tmp="$(sed -e '/^sentinel known-/d' -e '/^$/d' /opt/bitnami/redis-sentinel/etc/sentinel.conf)" + echo "$tmp" > /opt/bitnami/redis-sentinel/etc/sentinel.conf + + for node in $(seq 0 {{ .Values.replica.replicaCount }}); do + NAME="{{ template "common.names.fullname" . }}-node-$node" + IP="$(getent hosts "$NAME.$HEADLESS_SERVICE" | awk ' {print $1 }')" + if [[ "$NAME" != "$HOSTNAME" && -n "$IP" ]]; then + sentinel_conf_add "sentinel known-sentinel {{ .Values.sentinel.masterSet }} $IP {{ .Values.sentinel.service.sentinelPort }} $(host_id "$NAME")" + add_replica "$IP" + fi + done + add_replica "$(hostname -i)" + {{- end }} + + {{- if .Values.tls.enabled }} + ARGS=("--port" "0") + ARGS+=("--tls-port" "${REDIS_SENTINEL_TLS_PORT_NUMBER}") + ARGS+=("--tls-cert-file" "${REDIS_SENTINEL_TLS_CERT_FILE}") + ARGS+=("--tls-key-file" "${REDIS_SENTINEL_TLS_KEY_FILE}") + ARGS+=("--tls-ca-cert-file" "${REDIS_SENTINEL_TLS_CA_FILE}") + ARGS+=("--tls-replication" "yes") + ARGS+=("--tls-auth-clients" "${REDIS_SENTINEL_TLS_AUTH_CLIENTS}") + {{- if .Values.tls.dhParamsFilename }} + ARGS+=("--tls-dh-params-file" "${REDIS_SENTINEL_TLS_DH_PARAMS_FILE}") + {{- end }} + {{- end }} + {{- if .Values.sentinel.preExecCmds }} + {{ .Values.sentinel.preExecCmds | nindent 4 }} + {{- end }} + exec redis-server /opt/bitnami/redis-sentinel/etc/sentinel.conf --sentinel {{- if .Values.tls.enabled }} "${ARGS[@]}" {{- end }} + prestop-sentinel.sh: | + #!/bin/bash + + . /opt/bitnami/scripts/libvalidations.sh + . /opt/bitnami/scripts/libos.sh + + run_sentinel_command() { + if is_boolean_yes "$REDIS_SENTINEL_TLS_ENABLED"; then + redis-cli -h "$REDIS_SERVICE" -p "{{ .Values.sentinel.service.sentinelPort }}" --tls --cert "$REDIS_SENTINEL_TLS_CERT_FILE" --key "$REDIS_SENTINEL_TLS_KEY_FILE" --cacert "$REDIS_SENTINEL_TLS_CA_FILE" sentinel "$@" + else + redis-cli -h "$REDIS_SERVICE" -p "{{ .Values.sentinel.service.sentinelPort }}" sentinel "$@" + fi + } + failover_finished() { + REDIS_SENTINEL_INFO=($(run_sentinel_command get-master-addr-by-name "{{ .Values.sentinel.masterSet }}")) + REDIS_MASTER_HOST="${REDIS_SENTINEL_INFO[0]}" + [[ "$REDIS_MASTER_HOST" != "$(hostname -i)" ]] + } + + REDIS_SERVICE="{{ include "common.names.fullname" . }}.{{ .Release.Namespace }}.svc.{{ .Values.clusterDomain }}" + + # redis-cli automatically consumes credentials from the REDISCLI_AUTH variable + [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD" + [[ -f "$REDIS_PASSWORD_FILE" ]] && export REDISCLI_AUTH="$(< "${REDIS_PASSWORD_FILE}")" + + if ! failover_finished; then + echo "I am the master pod and you are stopping me. Starting sentinel failover" + # if I am the master, issue a command to failover once and then wait for the failover to finish + run_sentinel_command failover "{{ .Values.sentinel.masterSet }}" + if retry_while "failover_finished" "{{ sub .Values.sentinel.terminationGracePeriodSeconds 10 }}" 1; then + echo "Master has been successfuly failed over to a different pod." + exit 0 + else + echo "Master failover failed" + exit 1 + fi + else + exit 0 + fi + prestop-redis.sh: | + #!/bin/bash + + . /opt/bitnami/scripts/libvalidations.sh + . /opt/bitnami/scripts/libos.sh + + run_redis_command() { + if is_boolean_yes "$REDIS_TLS_ENABLED"; then + redis-cli -h 127.0.0.1 -p "$REDIS_TLS_PORT" --tls --cert "$REDIS_TLS_CERT_FILE" --key "$REDIS_TLS_KEY_FILE" --cacert "$REDIS_TLS_CA_FILE" "$@" + else + redis-cli -h 127.0.0.1 -p ${REDIS_PORT} "$@" + fi + } + failover_finished() { + REDIS_ROLE=$(run_redis_command role | head -1) + [[ "$REDIS_ROLE" != "master" ]] + } + + # redis-cli automatically consumes credentials from the REDISCLI_AUTH variable + [[ -n "$REDIS_PASSWORD" ]] && export REDISCLI_AUTH="$REDIS_PASSWORD" + [[ -f "$REDIS_PASSWORD_FILE" ]] && export REDISCLI_AUTH="$(< "${REDIS_PASSWORD_FILE}")" + + if ! failover_finished; then + echo "Waiting for sentinel to run failover for up to {{ sub .Values.sentinel.terminationGracePeriodSeconds 10 }}s" + retry_while "failover_finished" "{{ sub .Values.sentinel.terminationGracePeriodSeconds 10 }}" 1 + else + exit 0 + fi + +{{- else }} + start-master.sh: | + #!/bin/bash + + [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" + {{- if and .Values.master.containerSecurityContext.runAsUser (eq (.Values.master.containerSecurityContext.runAsUser | int) 0) }} + useradd redis + chown -R redis {{ .Values.master.persistence.path }} + {{- end }} + if [[ ! -f /opt/bitnami/redis/etc/master.conf ]];then + cp /opt/bitnami/redis/mounted-etc/master.conf /opt/bitnami/redis/etc/master.conf + fi + if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then + cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf + fi + {{- if .Values.tls.enabled }} + ARGS=("--port" "0") + ARGS+=("--tls-port" "${REDIS_TLS_PORT}") + ARGS+=("--tls-cert-file" "${REDIS_TLS_CERT_FILE}") + ARGS+=("--tls-key-file" "${REDIS_TLS_KEY_FILE}") + ARGS+=("--tls-ca-cert-file" "${REDIS_TLS_CA_FILE}") + ARGS+=("--tls-auth-clients" "${REDIS_TLS_AUTH_CLIENTS}") + {{- if .Values.tls.dhParamsFilename }} + ARGS+=("--tls-dh-params-file" "${REDIS_TLS_DH_PARAMS_FILE}") + {{- end }} + {{- else }} + ARGS=("--port" "${REDIS_PORT}") + {{- end }} + {{- if .Values.auth.enabled }} + ARGS+=("--requirepass" "${REDIS_PASSWORD}") + ARGS+=("--masterauth" "${REDIS_PASSWORD}") + {{- else }} + ARGS+=("--protected-mode" "no") + {{- end }} + ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") + ARGS+=("--include" "/opt/bitnami/redis/etc/master.conf") + {{- if .Values.master.extraFlags }} + {{- range .Values.master.extraFlags }} + ARGS+=({{ . | quote }}) + {{- end }} + {{- end }} + {{- if .Values.master.preExecCmds }} + {{ .Values.master.preExecCmds | nindent 4}} + {{- end }} + {{- if .Values.master.command }} + exec {{ .Values.master.command }} "${ARGS[@]}" + {{- else }} + exec redis-server "${ARGS[@]}" + {{- end }} + {{- if eq .Values.architecture "replication" }} + start-replica.sh: | + #!/bin/bash + + [[ -f $REDIS_PASSWORD_FILE ]] && export REDIS_PASSWORD="$(< "${REDIS_PASSWORD_FILE}")" + [[ -f $REDIS_MASTER_PASSWORD_FILE ]] && export REDIS_MASTER_PASSWORD="$(< "${REDIS_MASTER_PASSWORD_FILE}")" + {{- if and .Values.replica.containerSecurityContext.runAsUser (eq (.Values.replica.containerSecurityContext.runAsUser | int) 0) }} + useradd redis + chown -R redis {{ .Values.replica.persistence.path }} + {{- end }} + if [[ ! -f /opt/bitnami/redis/etc/replica.conf ]];then + cp /opt/bitnami/redis/mounted-etc/replica.conf /opt/bitnami/redis/etc/replica.conf + fi + if [[ ! -f /opt/bitnami/redis/etc/redis.conf ]];then + cp /opt/bitnami/redis/mounted-etc/redis.conf /opt/bitnami/redis/etc/redis.conf + fi + {{- if .Values.tls.enabled }} + ARGS=("--port" "0") + ARGS+=("--tls-port" "${REDIS_TLS_PORT}") + ARGS+=("--tls-cert-file" "${REDIS_TLS_CERT_FILE}") + ARGS+=("--tls-key-file" "${REDIS_TLS_KEY_FILE}") + ARGS+=("--tls-ca-cert-file" "${REDIS_TLS_CA_FILE}") + ARGS+=("--tls-auth-clients" "${REDIS_TLS_AUTH_CLIENTS}") + ARGS+=("--tls-replication" "yes") + {{- if .Values.tls.dhParamsFilename }} + ARGS+=("--tls-dh-params-file" "${REDIS_TLS_DH_PARAMS_FILE}") + {{- end }} + {{- else }} + ARGS=("--port" "${REDIS_PORT}") + {{- end }} + ARGS+=("--slaveof" "${REDIS_MASTER_HOST}" "${REDIS_MASTER_PORT_NUMBER}") + {{- if .Values.auth.enabled }} + ARGS+=("--requirepass" "${REDIS_PASSWORD}") + ARGS+=("--masterauth" "${REDIS_MASTER_PASSWORD}") + {{- else }} + ARGS+=("--protected-mode" "no") + {{- end }} + ARGS+=("--include" "/opt/bitnami/redis/etc/redis.conf") + ARGS+=("--include" "/opt/bitnami/redis/etc/replica.conf") + {{- if .Values.replica.extraFlags }} + {{- range .Values.replica.extraFlags }} + ARGS+=({{ . | quote }}) + {{- end }} + {{- end }} + {{- if .Values.replica.preExecCmds }} + {{ .Values.replica.preExecCmds | nindent 4}} + {{- end }} + {{- if .Values.replica.command }} + exec {{ .Values.replica.command }} "${ARGS[@]}" + {{- else }} + exec redis-server "${ARGS[@]}" + {{- end }} + {{- end }} +{{- end }} diff --git a/chart/deps/redis/templates/secret.yaml b/chart/deps/redis/templates/secret.yaml index 043edfe..a397608 100644 --- a/chart/deps/redis/templates/secret.yaml +++ b/chart/deps/redis/templates/secret.yaml @@ -1,23 +1,17 @@ -{{- if and .Values.usePassword (not .Values.existingSecret) -}} -{{- $secretName := include "redis.fullname" . -}} -{{- $secret := (lookup "v1" "Secret" .Release.Namespace $secretName ) -}} +{{- if and .Values.auth.enabled (not .Values.auth.existingSecret) -}} apiVersion: v1 kind: Secret metadata: - name: {{ $secretName }} + name: {{ include "redis.secretName" . }} namespace: {{ .Release.Namespace | quote }} - labels: - app: {{ template "redis.name" . }} - chart: {{ template "redis.chart" . }} - release: "{{ .Release.Name }}" - heritage: "{{ .Release.Service }}" + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} type: Opaque data: -{{ if $secret }} -{{ with $secret }} - redis-password: {{ get .data "redis-password" }} -{{ end }} -{{ else }} redis-password: {{ include "redis.password" . | b64enc | quote }} {{- end -}} -{{- end -}} \ No newline at end of file diff --git a/chart/deps/redis/templates/sentinel/service.yaml b/chart/deps/redis/templates/sentinel/service.yaml new file mode 100644 index 0000000..0f68fc3 --- /dev/null +++ b/chart/deps/redis/templates/sentinel/service.yaml @@ -0,0 +1,54 @@ +{{- if and (eq .Values.architecture "replication") .Values.sentinel.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ template "common.names.fullname" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: node + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if or .Values.sentinel.service.annotations .Values.commonAnnotations }} + annotations: + {{- if .Values.sentinel.service.annotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.sentinel.service.annotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +spec: + type: {{ .Values.sentinel.service.type }} + {{- if eq .Values.sentinel.service.type "LoadBalancer" }} + externalTrafficPolicy: {{ .Values.sentinel.service.externalTrafficPolicy }} + {{- end }} + {{- if and (eq .Values.sentinel.service.type "LoadBalancer") .Values.sentinel.service.loadBalancerIP }} + loadBalancerIP: {{ .Values.sentinel.service.loadBalancerIP }} + {{- end }} + {{- if and (eq .Values.sentinel.service.type "LoadBalancer") .Values.sentinel.service.loadBalancerSourceRanges }} + loadBalancerSourceRanges: {{- toYaml .Values.sentinel.service.loadBalancerSourceRanges | nindent 4 }} + {{- end }} + {{- if and (eq .Values.sentinel.service.type "ClusterIP") .Values.sentinel.service.clusterIP }} + clusterIP: {{ .Values.sentinel.service.clusterIP }} + {{- end }} + ports: + - name: tcp-redis + port: {{ .Values.sentinel.service.port }} + targetPort: redis + {{- if and (or (eq .Values.sentinel.service.type "NodePort") (eq .Values.sentinel.service.type "LoadBalancer")) .Values.sentinel.service.nodePorts.redis }} + nodePort: {{ .Values.sentinel.service.nodePorts.redis }} + {{- else if eq .Values.sentinel.service.type "ClusterIP" }} + nodePort: null + {{- end }} + - name: tcp-sentinel + port: {{ .Values.sentinel.service.sentinelPort }} + targetPort: redis-sentinel + {{- if and (or (eq .Values.sentinel.service.type "NodePort") (eq .Values.sentinel.service.type "LoadBalancer")) .Values.sentinel.service.nodePorts.sentinel }} + nodePort: {{ .Values.sentinel.service.nodePorts.sentinel }} + {{- else if eq .Values.sentinel.service.type "ClusterIP" }} + nodePort: null + {{- end }} + selector: {{- include "common.labels.matchLabels" . | nindent 4 }} + app.kubernetes.io/component: node +{{- end }} diff --git a/chart/deps/redis/templates/sentinel/statefulset.yaml b/chart/deps/redis/templates/sentinel/statefulset.yaml new file mode 100644 index 0000000..e299753 --- /dev/null +++ b/chart/deps/redis/templates/sentinel/statefulset.yaml @@ -0,0 +1,580 @@ +{{- if and (eq .Values.architecture "replication") .Values.sentinel.enabled }} +apiVersion: {{ include "common.capabilities.statefulset.apiVersion" . }} +kind: StatefulSet +metadata: + name: {{ printf "%s-node" (include "common.names.fullname" .) }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + app.kubernetes.io/component: node + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if or .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + replicas: {{ .Values.replica.replicaCount }} + selector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: node + serviceName: {{ printf "%s-headless" (include "common.names.fullname" .) }} + {{- if .Values.replica.updateStrategy }} + updateStrategy: {{- toYaml .Values.replica.updateStrategy | nindent 4 }} + {{- end }} + template: + metadata: + labels: {{- include "common.labels.standard" . | nindent 8 }} + app.kubernetes.io/component: node + {{- if .Values.replica.podLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.replica.podLabels "context" $ ) | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.podLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.podLabels "context" $ ) | nindent 8 }} + {{- end }} + annotations: + {{- if (include "redis.createConfigmap" .) }} + checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + {{- end }} + checksum/health: {{ include (print $.Template.BasePath "/health-configmap.yaml") . | sha256sum }} + checksum/scripts: {{ include (print $.Template.BasePath "/scripts-configmap.yaml") . | sha256sum }} + checksum/secret: {{ include (print $.Template.BasePath "/secret.yaml") . | sha256sum }} + {{- if .Values.replica.podAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.replica.podAnnotations "context" $ ) | nindent 8 }} + {{- end }} + {{- if and .Values.metrics.enabled .Values.metrics.podAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.metrics.podAnnotations "context" $ ) | nindent 8 }} + {{- end }} + spec: + {{- include "redis.imagePullSecrets" . | nindent 6 }} + {{- if .Values.replica.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.replica.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.replica.podSecurityContext.enabled }} + securityContext: {{- omit .Values.replica.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + serviceAccountName: {{ template "redis.serviceAccountName" . }} + {{- if .Values.replica.priorityClassName }} + priorityClassName: {{ .Values.replica.priorityClassName | quote }} + {{- end }} + {{- if .Values.replica.affinity }} + affinity: {{- include "common.tplvalues.render" (dict "value" .Values.replica.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.replica.podAffinityPreset "component" "node" "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.replica.podAntiAffinityPreset "component" "node" "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.replica.nodeAffinityPreset.type "key" .Values.replica.nodeAffinityPreset.key "values" .Values.replica.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.replica.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.replica.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.replica.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.replica.tolerations "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.replica.spreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.replica.spreadConstraints "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.replica.shareProcessNamespace }} + shareProcessNamespace: {{ .Values.replica.shareProcessNamespace }} + {{- end }} + {{- if .Values.replica.schedulerName }} + schedulerName: {{ .Values.replica.schedulerName | quote }} + {{- end }} + terminationGracePeriodSeconds: {{ .Values.sentinel.terminationGracePeriodSeconds }} + containers: + - name: redis + image: {{ template "redis.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy | quote }} + {{- if .Values.replica.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.replica.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.replica.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.replica.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.replica.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.replica.command "context" $) | nindent 12 }} + {{- else }} + command: + - /bin/bash + {{- end }} + {{- if .Values.replica.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.replica.args "context" $) | nindent 12 }} + {{- else }} + args: + - -c + - /opt/bitnami/scripts/start-scripts/start-node.sh + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.image.debug | quote }} + - name: REDIS_MASTER_PORT_NUMBER + value: {{ .Values.replica.containerPort | quote }} + - name: ALLOW_EMPTY_PASSWORD + value: {{ ternary "no" "yes" .Values.auth.enabled | quote }} + {{- if .Values.auth.enabled }} + {{- if .Values.auth.usePasswordFiles }} + - name: REDIS_PASSWORD_FILE + value: "/opt/bitnami/redis/secrets/redis-password" + - name: REDIS_MASTER_PASSWORD_FILE + value: "/opt/bitnami/redis/secrets/redis-password" + {{- else }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + - name: REDIS_MASTER_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + {{- end }} + {{- end }} + - name: REDIS_TLS_ENABLED + value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} + {{- if .Values.tls.enabled }} + - name: REDIS_TLS_PORT + value: {{ .Values.replica.containerPort | quote }} + - name: REDIS_TLS_AUTH_CLIENTS + value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} + - name: REDIS_TLS_CERT_FILE + value: {{ template "redis.tlsCert" . }} + - name: REDIS_TLS_KEY_FILE + value: {{ template "redis.tlsCertKey" . }} + - name: REDIS_TLS_CA_FILE + value: {{ template "redis.tlsCACert" . }} + {{- if .Values.tls.dhParamsFilename }} + - name: REDIS_TLS_DH_PARAMS_FILE + value: {{ template "redis.tlsDHParams" . }} + {{- end }} + {{- else }} + - name: REDIS_PORT + value: {{ .Values.replica.containerPort | quote }} + {{- end }} + - name: REDIS_DATA_DIR + value: {{ .Values.replica.persistence.path }} + {{- if .Values.replica.extraEnvVars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.replica.extraEnvVars "context" $ ) | nindent 12 }} + {{- end }} + {{- if or .Values.replica.extraEnvVarsCM .Values.replica.extraEnvVarsSecret }} + envFrom: + {{- if .Values.replica.extraEnvVarsCM }} + - configMapRef: + name: {{ .Values.replica.extraEnvVarsCM }} + {{- end }} + {{- if .Values.replica.extraEnvVarsSecret }} + - secretRef: + name: {{ .Values.replica.extraEnvVarsSecret }} + {{- end }} + {{- end }} + ports: + - name: redis + containerPort: {{ .Values.replica.containerPort }} + {{- if .Values.replica.livenessProbe.enabled }} + livenessProbe: + initialDelaySeconds: {{ .Values.replica.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.replica.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.replica.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.replica.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.replica.livenessProbe.failureThreshold}} + exec: + command: + - sh + - -c + - /health/ping_liveness_local.sh {{ .Values.replica.livenessProbe.timeoutSeconds }} + {{- else if .Values.replica.customLivenessProbe }} + livenessProbe: {{- toYaml .Values.replica.customLivenessProbe | nindent 12 }} + {{- end }} + {{- if .Values.replica.readinessProbe.enabled }} + readinessProbe: + initialDelaySeconds: {{ .Values.replica.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.replica.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.replica.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.replica.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.replica.readinessProbe.failureThreshold }} + exec: + command: + - sh + - -c + - /health/ping_readiness_local.sh {{ .Values.replica.livenessProbe.timeoutSeconds }} + {{- else if .Values.replica.customReadinessProbe }} + readinessProbe: {{- toYaml .Values.replica.customReadinessProbe | nindent 12 }} + {{- end }} + {{- if .Values.replica.resources }} + resources: {{- toYaml .Values.replica.resources | nindent 12 }} + {{- end }} + volumeMounts: + - name: start-scripts + mountPath: /opt/bitnami/scripts/start-scripts + - name: health + mountPath: /health + {{- if .Values.auth.usePasswordFiles }} + - name: redis-password + mountPath: /opt/bitnami/redis/secrets/ + {{- end }} + - name: redis-data + mountPath: {{ .Values.replica.persistence.path }} + subPath: {{ .Values.replica.persistence.subPath }} + - name: config + mountPath: /opt/bitnami/redis/mounted-etc + - name: redis-tmp-conf + mountPath: /opt/bitnami/redis/etc + - name: tmp + mountPath: /tmp + {{- if .Values.tls.enabled }} + - name: redis-certificates + mountPath: /opt/bitnami/redis/certs + readOnly: true + {{- end }} + {{- if .Values.replica.extraVolumeMounts }} + {{- include "common.tplvalues.render" ( dict "value" .Values.replica.extraVolumeMounts "context" $ ) | nindent 12 }} + {{- end }} + lifecycle: + preStop: + exec: + command: + - /bin/bash + - -c + - /opt/bitnami/scripts/start-scripts/prestop-redis.sh + - name: sentinel + image: {{ template "redis.sentinel.image" . }} + imagePullPolicy: {{ .Values.sentinel.image.pullPolicy | quote }} + {{- if .Values.sentinel.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.sentinel.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.sentinel.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.sentinel.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.sentinel.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.sentinel.command "context" $) | nindent 12 }} + {{- else }} + command: + - /bin/bash + {{- end }} + {{- if .Values.sentinel.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.sentinel.args "context" $) | nindent 12 }} + {{- else }} + args: + - -c + - /opt/bitnami/scripts/start-scripts/start-sentinel.sh + {{- end }} + env: + - name: BITNAMI_DEBUG + value: {{ ternary "true" "false" .Values.sentinel.image.debug | quote }} + {{- if .Values.auth.enabled }} + {{- if .Values.auth.usePasswordFiles }} + - name: REDIS_PASSWORD_FILE + value: "/opt/bitnami/redis/secrets/redis-password" + {{- else }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + {{- end }} + {{- else }} + - name: ALLOW_EMPTY_PASSWORD + value: "yes" + {{- end }} + - name: REDIS_SENTINEL_TLS_ENABLED + value: {{ ternary "yes" "no" .Values.tls.enabled | quote }} + {{- if .Values.tls.enabled }} + - name: REDIS_SENTINEL_TLS_PORT_NUMBER + value: {{ .Values.sentinel.containerPort | quote }} + - name: REDIS_SENTINEL_TLS_AUTH_CLIENTS + value: {{ ternary "yes" "no" .Values.tls.authClients | quote }} + - name: REDIS_SENTINEL_TLS_CERT_FILE + value: {{ template "redis.tlsCert" . }} + - name: REDIS_SENTINEL_TLS_KEY_FILE + value: {{ template "redis.tlsCertKey" . }} + - name: REDIS_SENTINEL_TLS_CA_FILE + value: {{ template "redis.tlsCACert" . }} + {{- if .Values.tls.dhParamsFilename }} + - name: REDIS_SENTINEL_TLS_DH_PARAMS_FILE + value: {{ template "redis.tls.dhParamsFilename" . }} + {{- end }} + {{- else }} + - name: REDIS_SENTINEL_PORT + value: {{ .Values.sentinel.containerPort | quote }} + {{- end }} + ports: + - name: redis-sentinel + containerPort: {{ .Values.sentinel.containerPort }} + {{- if .Values.sentinel.livenessProbe.enabled }} + livenessProbe: + initialDelaySeconds: {{ .Values.sentinel.livenessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.sentinel.livenessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.sentinel.livenessProbe.timeoutSeconds }} + successThreshold: {{ .Values.sentinel.livenessProbe.successThreshold }} + failureThreshold: {{ .Values.sentinel.livenessProbe.failureThreshold }} + exec: + command: + - sh + - -c + - /health/ping_sentinel.sh {{ .Values.sentinel.livenessProbe.timeoutSeconds }} + {{- else if .Values.sentinel.customLivenessProbe }} + livenessProbe: {{- toYaml .Values.sentinel.customLivenessProbe | nindent 12 }} + {{- end }} + {{- if .Values.sentinel.readinessProbe.enabled}} + readinessProbe: + initialDelaySeconds: {{ .Values.sentinel.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.sentinel.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.sentinel.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.sentinel.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.sentinel.readinessProbe.failureThreshold }} + exec: + command: + - sh + - -c + - /health/ping_sentinel.sh {{ .Values.sentinel.livenessProbe.timeoutSeconds }} + {{- else if .Values.sentinel.customReadinessProbe }} + readinessProbe: {{- toYaml .Values.sentinel.customReadinessProbe | nindent 12 }} + {{- end }} + lifecycle: + preStop: + exec: + command: + - /bin/bash + - -c + - /opt/bitnami/scripts/start-scripts/prestop-sentinel.sh + {{- if .Values.sentinel.resources }} + resources: {{- toYaml .Values.sentinel.resources | nindent 12 }} + {{- end }} + volumeMounts: + - name: start-scripts + mountPath: /opt/bitnami/scripts/start-scripts + - name: health + mountPath: /health + {{- if .Values.auth.usePasswordFiles }} + - name: redis-password + mountPath: /opt/bitnami/redis/secrets/ + {{- end }} + - name: redis-data + mountPath: {{ .Values.replica.persistence.path }} + subPath: {{ .Values.replica.persistence.subPath }} + - name: config + mountPath: /opt/bitnami/redis-sentinel/mounted-etc + - name: sentinel-tmp-conf + mountPath: /opt/bitnami/redis-sentinel/etc + {{- if .Values.tls.enabled }} + - name: redis-certificates + mountPath: /opt/bitnami/redis/certs + readOnly: true + {{- end }} + {{- if .Values.sentinel.extraVolumeMounts }} + {{- include "common.tplvalues.render" ( dict "value" .Values.sentinel.extraVolumeMounts "context" $ ) | nindent 12 }} + {{- end }} + {{- if .Values.metrics.enabled }} + - name: metrics + image: {{ template "redis.metrics.image" . }} + imagePullPolicy: {{ .Values.metrics.image.pullPolicy | quote }} + {{- if .Values.metrics.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.metrics.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + command: + - /bin/bash + - -c + - | + if [[ -f '/secrets/redis-password' ]]; then + export REDIS_PASSWORD=$(cat /secrets/redis-password) + fi + redis_exporter{{- range $key, $value := .Values.metrics.extraArgs }} --{{ $key }}={{ $value }}{{- end }} + env: + - name: REDIS_ALIAS + value: {{ template "common.names.fullname" . }} + {{- if .Values.auth.enabled }} + - name: REDIS_USER + value: default + {{- if (not .Values.auth.usePasswordFiles) }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ template "redis.secretName" . }} + key: {{ template "redis.secretPasswordKey" . }} + {{- end }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: REDIS_ADDR + value: rediss://{{ .Values.metrics.redisTargetHost }}:{{ .Values.replica.containerPort }} + {{- if .Values.tls.authClients }} + - name: REDIS_EXPORTER_TLS_CLIENT_KEY_FILE + value: {{ template "redis.tlsCertKey" . }} + - name: REDIS_EXPORTER_TLS_CLIENT_CERT_FILE + value: {{ template "redis.tlsCert" . }} + {{- end }} + - name: REDIS_EXPORTER_TLS_CA_CERT_FILE + value: {{ template "redis.tlsCACert" . }} + {{- end }} + ports: + - name: metrics + containerPort: 9121 + {{- if .Values.metrics.resources }} + resources: {{- toYaml .Values.metrics.resources | nindent 12 }} + {{- end }} + volumeMounts: + {{- if .Values.auth.usePasswordFiles }} + - name: redis-password + mountPath: /secrets/ + {{- end }} + {{- if .Values.tls.enabled }} + - name: redis-certificates + mountPath: /opt/bitnami/redis/certs + readOnly: true + {{- end }} + {{- end }} + {{- if .Values.metrics.sentinel.enabled }} + - name: sentinel-metrics + image: {{ include "redis.metrics.sentinel.image" . }} + imagePullPolicy: {{ .Values.metrics.sentinel.image.pullPolicy | quote }} + {{- if .Values.metrics.sentinel.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.metrics.sentinel.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + command: + - redis_sentinel_exporter{{- range $key, $value := .Values.metrics.sentinel.extraArgs }} --{{ $key }}={{ $value }}{{- end }} + env: + {{- if and .Values.auth.sentinel (and .Values.auth.enabled (not .Values.auth.usePasswordFiles)) }} + - name: SENTINEL_PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "redis.secretName" . }} + key: {{ include "redis.secretPasswordKey" . }} + {{- end }} + {{- if and .Values.auth.sentinel .Values.auth.enabled .Values.auth.usePasswordFiles }} + - name: SENTINEL_PASSWORD_FILE + value: /secrets/redis-password + {{- end }} + ports: + - name: sentinelmetrics + containerPort: 9355 + {{- if .Values.metrics.sentinel.resources }} + resources: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.sentinel.resources "context" $) | nindent 12 }} + {{- end }} + {{- if and .Values.auth.sentinel .Values.auth.enabled .Values.auth.usePasswordFiles }} + volumeMounts: + - name: redis-password + mountPath: /secrets/ + {{- end }} + {{- end }} + {{- if .Values.replica.sidecars }} + {{- include "common.tplvalues.render" (dict "value" .Values.replica.sidecars "context" $) | nindent 8 }} + {{- end }} + {{- $needsVolumePermissions := and .Values.volumePermissions.enabled .Values.replica.persistence.enabled .Values.replica.podSecurityContext.enabled .Values.replica.containerSecurityContext.enabled }} + {{- if or .Values.replica.initContainers $needsVolumePermissions .Values.sysctl.enabled }} + initContainers: + {{- if .Values.replica.initContainers }} + {{- include "common.tplvalues.render" (dict "value" .Values.replica.initContainers "context" $) | nindent 8 }} + {{- end }} + {{- if $needsVolumePermissions }} + - name: volume-permissions + image: {{ include "redis.volumePermissions.image" . }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | quote }} + command: + - /bin/bash + - -ec + - | + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + chown -R `id -u`:`id -G | cut -d " " -f2` {{ .Values.replica.persistence.path }} + {{- else }} + chown -R {{ .Values.replica.containerSecurityContext.runAsUser }}:{{ .Values.replica.podSecurityContext.fsGroup }} {{ .Values.replica.persistence.path }} + {{- end }} + {{- if eq ( toString ( .Values.volumePermissions.containerSecurityContext.runAsUser )) "auto" }} + securityContext: {{- omit .Values.volumePermissions.containerSecurityContext "runAsUser" | toYaml | nindent 12 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.containerSecurityContext | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.volumePermissions.resources }} + resources: {{- toYaml .Values.volumePermissions.resources | nindent 12 }} + {{- end }} + volumeMounts: + - name: redis-data + mountPath: {{ .Values.replica.persistence.path }} + subPath: {{ .Values.replica.persistence.subPath }} + {{- end }} + {{- if .Values.sysctl.enabled }} + - name: init-sysctl + image: {{ include "redis.sysctl.image" . }} + imagePullPolicy: {{ default "" .Values.sysctl.image.pullPolicy | quote }} + securityContext: + privileged: true + runAsUser: 0 + {{- if .Values.sysctl.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.sysctl.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.sysctl.resources }} + resources: {{- toYaml .Values.sysctl.resources | nindent 12 }} + {{- end }} + {{- if .Values.sysctl.mountHostSys }} + volumeMounts: + - name: host-sys + mountPath: /host-sys + {{- end }} + {{- end }} + {{- end }} + volumes: + - name: start-scripts + configMap: + name: {{ printf "%s-scripts" (include "common.names.fullname" .) }} + defaultMode: 0755 + - name: health + configMap: + name: {{ printf "%s-health" (include "common.names.fullname" .) }} + defaultMode: 0755 + {{- if .Values.auth.usePasswordFiles }} + - name: redis-password + secret: + secretName: {{ template "redis.secretName" . }} + items: + - key: {{ template "redis.secretPasswordKey" . }} + path: redis-password + {{- end }} + - name: config + configMap: + name: {{ include "redis.configmapName" . }} + {{- if .Values.sysctl.mountHostSys }} + - name: host-sys + hostPath: + path: /sys + {{- end }} + - name: sentinel-tmp-conf + emptyDir: {} + - name: redis-tmp-conf + emptyDir: {} + - name: tmp + emptyDir: {} + {{- if .Values.replica.extraVolumes }} + {{- include "common.tplvalues.render" ( dict "value" .Values.replica.extraVolumes "context" $ ) | nindent 8 }} + {{- end }} + {{- if .Values.sentinel.extraVolumes }} + {{- include "common.tplvalues.render" ( dict "value" .Values.sentinel.extraVolumes "context" $ ) | nindent 8 }} + {{- end }} + {{- if .Values.tls.enabled }} + - name: redis-certificates + secret: + secretName: {{ required "A secret containing the certificates for the TLS traffic is required when TLS in enabled" .Values.tls.certificatesSecret }} + defaultMode: 256 + {{- end }} + {{- if not .Values.replica.persistence.enabled }} + - name: redis-data + emptyDir: {} + {{- else }} + volumeClaimTemplates: + - metadata: + name: redis-data + labels: {{- include "common.labels.matchLabels" . | nindent 10 }} + app.kubernetes.io/component: node + {{- if .Values.replica.persistence.annotations }} + annotations: {{- toYaml .Values.replica.persistence.annotations | nindent 10 }} + {{- end }} + spec: + accessModes: + {{- range .Values.replica.persistence.accessModes }} + - {{ . | quote }} + {{- end }} + resources: + requests: + storage: {{ .Values.replica.persistence.size | quote }} + {{- if .Values.replica.persistence.selector }} + selector: {{- include "common.tplvalues.render" ( dict "value" .Values.replica.persistence.selector "context" $) | nindent 10 }} + {{- end }} + {{- include "common.storage.class" (dict "persistence" .Values.replica.persistence "global" .Values.global) | nindent 8 }} + {{- end }} +{{- end }} diff --git a/chart/deps/redis/templates/serviceaccount.yaml b/chart/deps/redis/templates/serviceaccount.yaml new file mode 100644 index 0000000..4f97490 --- /dev/null +++ b/chart/deps/redis/templates/serviceaccount.yaml @@ -0,0 +1,20 @@ +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "redis.serviceAccountName" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if or .Values.commonAnnotations .Values.serviceAccount.annotations }} + annotations: + {{- if or .Values.commonAnnotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.serviceAccount.annotations }} + {{- include "common.tplvalues.render" ( dict "value" .Values.serviceAccount.annotations "context" $ ) | nindent 4 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/chart/deps/redis/templates/servicemonitor.yaml b/chart/deps/redis/templates/servicemonitor.yaml new file mode 100644 index 0000000..fc142d6 --- /dev/null +++ b/chart/deps/redis/templates/servicemonitor.yaml @@ -0,0 +1,85 @@ +{{- if and .Values.metrics.enabled .Values.metrics.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ template "common.names.fullname" . }} + {{- if .Values.metrics.serviceMonitor.namespace }} + namespace: {{ .Values.metrics.serviceMonitor.namespace }} + {{- else }} + namespace: {{ .Release.Namespace | quote }} + {{- end }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.metrics.serviceMonitor.additionalLabels }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.additionalLabels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + endpoints: + - port: tcp-metrics + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.honorLabels }} + honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.relabellings }} + metricRelabelings: {{- toYaml .Values.metrics.serviceMonitor.relabellings | nindent 6 }} + {{- end }} + namespaceSelector: + matchNames: + - {{ .Release.Namespace }} + selector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: metrics +{{- if .Values.metrics.sentinel.enabled }} +--- +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ printf "%s-sentinel" (include "common.names.fullname" .) }} + {{- if .Values.metrics.serviceMonitor.namespace }} + namespace: {{ .Values.metrics.serviceMonitor.namespace }} + {{- else }} + namespace: {{ .Release.Namespace | quote }} + {{- end }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.metrics.serviceMonitor.additionalLabels }} + {{- include "common.tplvalues.render" (dict "value" .Values.metrics.serviceMonitor.additionalLabels "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + endpoints: + - port: tcp-metrics + {{- if .Values.metrics.serviceMonitor.interval }} + interval: {{ .Values.metrics.serviceMonitor.interval }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.scrapeTimeout }} + scrapeTimeout: {{ .Values.metrics.serviceMonitor.scrapeTimeout }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.honorLabels }} + honorLabels: {{ .Values.metrics.serviceMonitor.honorLabels }} + {{- end }} + {{- if .Values.metrics.serviceMonitor.relabellings }} + metricRelabelings: {{- toYaml .Values.metrics.serviceMonitor.relabellings | nindent 6 }} + {{- end }} + namespaceSelector: + matchNames: + - {{ .Release.Namespace }} + selector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + app.kubernetes.io/component: sentinel-metrics +{{- end }} +{{- end }} diff --git a/chart/deps/redis/values.schema.json b/chart/deps/redis/values.schema.json index 3188d0c..7781b63 100644 --- a/chart/deps/redis/values.schema.json +++ b/chart/deps/redis/values.schema.json @@ -2,39 +2,30 @@ "$schema": "http://json-schema.org/schema#", "type": "object", "properties": { - "usePassword": { - "type": "boolean", - "title": "Use password authentication", - "form": true - }, - "password": { + "architecture": { "type": "string", - "title": "Password", + "title": "Redis architecture", "form": true, - "description": "Defaults to a random 10-character alphanumeric string if not set", - "hidden": { - "value": false, - "path": "usePassword" - } + "description": "Allowed values: `standalone` or `replication`" }, - "cluster": { + "auth": { "type": "object", - "title": "Cluster Settings", + "title": "Authentication configuration", "form": true, "properties": { "enabled": { "type": "boolean", "form": true, - "title": "Enable master-slave", - "description": "Enable master-slave architecture" + "title": "Use password authentication" }, - "slaveCount": { - "type": "integer", - "title": "Slave Replicas", + "password": { + "type": "string", + "title": "Redis password", "form": true, + "description": "Defaults to a random 10-character alphanumeric string if not set", "hidden": { "value": false, - "path": "cluster/enabled" + "path": "auth/enabled" } } } @@ -67,31 +58,28 @@ "value": false, "path": "master/persistence/enabled" } - }, - "matchLabels": { - "type": "object", - "title": "Persistent Match Labels Selector" - }, - "matchExpressions": { - "type": "object", - "title": "Persistent Match Expressions Selector" } } } } }, - "slave": { + "replica": { "type": "object", - "title": "Slave replicas settings", + "title": "Redis replicas settings", "form": true, "hidden": { - "value": false, - "path": "cluster/enabled" + "value": "standalone", + "path": "architecture" }, "properties": { + "replicaCount": { + "type": "integer", + "form": true, + "title": "Number of Redis replicas" + }, "persistence": { "type": "object", - "title": "Persistence for slave replicas", + "title": "Persistence for Redis replicas", "form": true, "properties": { "enabled": { @@ -110,16 +98,8 @@ "sliderUnit": "Gi", "hidden": { "value": false, - "path": "slave/persistence/enabled" + "path": "replica/persistence/enabled" } - }, - "matchLabels": { - "type": "object", - "title": "Persistent Match Labels Selector" - }, - "matchExpressions": { - "type": "object", - "title": "Persistent Match Expressions Selector" } } } diff --git a/chart/deps/redis/values.yaml b/chart/deps/redis/values.yaml index 2bbdac4..c96c309 100644 --- a/chart/deps/redis/values.yaml +++ b/chart/deps/redis/values.yaml @@ -17,22 +17,64 @@ istio: monitoring: enabled: false - - +# Deletes previous statefulsets before attempting an upgrade +# May be required on some Redis chart updates due to upstream breaking changes +# REQUIRED for Chart v14 upgrade +cleanUpgrade: + enabled: true ## Global Docker image parameters ## Please, note that this will override the image parameters, including dependencies, configured to use the global value -## Current available global Docker image parameters: imageRegistry and imagePullSecrets +## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass + +## @param global.imageRegistry Global Docker image registry +## @param global.imagePullSecrets Global Docker registry secret names as an array +## @param global.storageClass Global StorageClass for Persistent Volume(s) +## @param global.redis.password Global Redis(TM) password (overrides `auth.password`) ## global: # imageRegistry: myRegistryName imagePullSecrets: - private-registry - # storageClass: myStorageClass + # imageRegistry: + # storageClass: redis: {} + # password: + +## @section Common parameters -## Bitnami Redis(TM) image version +## @param kubeVersion Override Kubernetes version +## +kubeVersion: +## @param nameOverride String to partially override common.names.fullname +## +nameOverride: +## @param fullnameOverride String to fully override common.names.fullname +## +fullnameOverride: +## @param commonLabels Labels to add to all deployed objects +## +commonLabels: {} +## @param commonAnnotations Annotations to add to all deployed objects +## +commonAnnotations: {} +## @param clusterDomain Kubernetes cluster domain name +## +clusterDomain: cluster.local +## @param extraDeploy Array of extra objects to deploy with the release +## +extraDeploy: [] + +## @section Redis(TM) Image parameters + +## Bitnami Redis(TM) image ## ref: https://hub.docker.com/r/bitnami/redis/tags/ +## @param image.registry Redis(TM) image registry +## @param image.repository Redis(TM) image repository +## @param image.tag Redis(TM) image tag (immutable tags are recommended) +## @param image.pullPolicy Redis(TM) image pull policy +## @param image.pullSecrets Redis(TM) image pull secrets +## @param image.debug Enable image debug mode ## image: registry: registry1.dso.mil @@ -40,7 +82,7 @@ image: ## Bitnami Redis(TM) image tag ## ref: https://github.com/bitnami/bitnami-docker-redis#supported-tags-and-respective-dockerfile-links ## - tag: 6.0.10 + tag: 6.2.2 ## Specify a imagePullPolicy ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images @@ -49,79 +91,113 @@ image: ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName ## # pullSecrets: # - private-registry + ## Enable debug mode + ## + debug: false -## String to partially override redis.fullname template (will maintain the release name) -## -# nameOverride: +## @section Redis(TM) common configuration parameters +## https://github.com/bitnami/bitnami-docker-redis#configuration -## String to fully override redis.fullname template +## @param architecture Redis(TM) architecture. Allowed values: `standalone` or `replication` ## -# fullnameOverride: - -## Cluster settings +architecture: replication +## Redis(TM) Authentication parameters +## ref: https://github.com/bitnami/bitnami-docker-redis#setting-the-server-password-on-first-run ## -cluster: +auth: + ## @param auth.enabled Enable password authentication + ## enabled: true - slaveCount: 2 - -## Use redis sentinel in the redis pod. This will disable the master and slave services and -## create one redis service with ports to the sentinel and the redis instances -## -sentinel: - enabled: false - ## Require password authentication on the sentinel itself - ## ref: https://redis.io/topics/sentinel + ## @param auth.sentinel Enable password authentication on sentinels too ## - usePassword: true - ## Bitnami Redis(TM) Sentintel image version - ## ref: https://hub.docker.com/r/bitnami/redis-sentinel/tags/ + sentinel: true + ## @param auth.password Redis(TM) password + ## Defaults to a random 10-character alphanumeric string if not set ## - image: - registry: docker.io - repository: bitnami/redis-sentinel - ## Bitnami Redis(TM) image tag - ## ref: https://github.com/bitnami/bitnami-docker-redis-sentinel#supported-tags-and-respective-dockerfile-links - ## - tag: 6.0.12-debian-10-r0 - ## Specify a imagePullPolicy - ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' - ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images - ## - pullPolicy: IfNotPresent - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## - # pullSecrets: - # - myRegistryKeySecretName - masterSet: mymaster - initialCheckTimeout: 5 - quorum: 2 - downAfterMilliseconds: 20000 - failoverTimeout: 18000 - parallelSyncs: 1 - port: 26379 - - ## Delay seconds when cleaning nodes IPs - ## When starting it will clean the sentiles IP (RESET "*") in all the nodes - ## This is the delay time before sending the command to the next node + password: "" + ## @param auth.existingSecret The name of an existing secret with Redis(TM) credentials + ## NOTE: When it's set, the previous `auth.password` parameter is ignored ## - cleanDelaySeconds: 5 + existingSecret: + ## @param auth.existingSecretPasswordKey Password key to be retrieved from existing secret + ## NOTE: ignored unless `auth.existingSecret` parameter is set + ## + existingSecretPasswordKey: + ## @param auth.usePasswordFiles Mount credentials as files instead of using an environment variable + ## + usePasswordFiles: false +## @skip commonConfiguration +## ref: https://redis.io/topics/config +## +commonConfiguration: |- + # Enable AOF https://redis.io/topics/persistence#append-only-file + appendonly yes + # Disable RDB persistence, AOF persistence already enabled. + save "" +## @param existingConfigmap The name of an existing ConfigMap with your custom configuration for Redis(TM) nodes +## +existingConfigmap: + +## @section Redis(TM) master configuration parameters - ## Additional Redis(TM) configuration for the sentinel nodes +master: + ## @param master.configuration Configuration for Redis(TM) master nodes ## ref: https://redis.io/topics/config ## - configmap: - ## Enable or disable static sentinel IDs for each replicas - ## If disabled each sentinel will generate a random id at startup - ## If enabled, each replicas will have a constant ID on each start-up + configuration: + ## @param master.disableCommands [array] Array with Redis(TM) commands to disable on master nodes + ## Commands will be completely disabled by renaming each to an empty string. + ## ref: https://redis.io/topics/security#disabling-of-specific-commands ## - staticID: false - ## Configure extra options for Redis(TM) Sentinel liveness and readiness probes - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + disableCommands: + - FLUSHDB + - FLUSHALL + ## @param master.command Override default container command (useful when using custom images) + ## + command: [] + ## @param master.args Override default container args (useful when using custom images) + ## + args: [] + ## @param master.preExecCmds Additional commands to run prior to starting Redis(TM) master + ## + preExecCmds: [] + ## @param master.extraFlags Array with additional command line flags for Redis(TM) master + ## e.g: + ## extraFlags: + ## - "--maxmemory-policy volatile-ttl" + ## - "--repl-backlog-size 1024mb" + ## + extraFlags: [] + ## @param master.extraEnvVars Array with extra environment variables to add to Redis(TM) master nodes + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" + ## + extraEnvVars: [] + ## @param master.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for Redis(TM) master nodes + ## + extraEnvVarsCM: + ## @param master.extraEnvVarsSecret Name of existing Secret containing extra env vars for Redis(TM) master nodes + ## + extraEnvVarsSecret: + ## @param master.containerPort Container port to open on Redis(TM) master nodes + ## + containerPort: 6379 + ## Configure extra options for Redis(TM) containers' liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes + ## @param master.livenessProbe.enabled Enable livenessProbe on Redis(TM) master nodes + ## @param master.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param master.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param master.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param master.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param master.livenessProbe.successThreshold Success threshold for livenessProbe ## livenessProbe: enabled: true @@ -130,6 +206,13 @@ sentinel: timeoutSeconds: 5 successThreshold: 1 failureThreshold: 5 + ## @param master.readinessProbe.enabled Enable readinessProbe on Redis(TM) master nodes + ## @param master.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param master.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param master.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param master.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param master.readinessProbe.successThreshold Success threshold for readinessProbe + ## readinessProbe: enabled: true initialDelaySeconds: 5 @@ -137,260 +220,288 @@ sentinel: timeoutSeconds: 1 successThreshold: 1 failureThreshold: 5 + ## @param master.customLivenessProbe Custom livenessProbe that overrides the default one + ## customLivenessProbe: {} + ## @param master.customReadinessProbe Custom readinessProbe that overrides the default one + ## customReadinessProbe: {} - ## Redis(TM) Sentinel resource requests and limits + ## Redis(TM) master resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ - # resources: - # requests: - # memory: 256Mi - # cpu: 100m - ## Redis(TM) Sentinel Service properties + ## @param master.resources.limits The resources limits for the Redis(TM) master containers + ## @param master.resources.requests The requested resources for the Redis(TM) master containers ## - service: - ## Redis(TM) Sentinel Service type - ## - type: ClusterIP - sentinelPort: 26379 - redisPort: 6379 - - ## External traffic policy (when service type is LoadBalancer) - ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip - ## - externalTrafficPolicy: Cluster - - ## Specify the nodePort value for the LoadBalancer and NodePort service types. - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport - ## - # sentinelNodePort: - # redisNodePort: - - ## Provide any additional annotations which may be required. This can be used to - ## set the LoadBalancer service type to internal only. - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + resources: + requests: + memory: 256Mi + cpu: 100m + limits: + memory: 256Mi + cpu: 100m + ## Configure Pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param master.podSecurityContext.enabled Enabled Redis(TM) master pods' Security Context + ## @param master.podSecurityContext.fsGroup Set Redis(TM) master pod's Security Context fsGroup + ## + podSecurityContext: + enabled: true + fsGroup: 1001 + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param master.containerSecurityContext.enabled Enabled Redis(TM) master containers' Security Context + ## @param master.containerSecurityContext.runAsUser Set Redis(TM) master containers' Security Context runAsUser + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + ## @param master.schedulerName Alternate scheduler for Redis(TM) master pods + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: + ## @param master.updateStrategy.type Redis(TM) master statefulset strategy type + ## @skip master.updateStrategy.rollingUpdate + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + ## StrategyType + ## Can be set to RollingUpdate or OnDelete ## - annotations: {} - labels: {} - loadBalancerIP: - - ## Additional commands to run prior to starting Redis(TM) node with sentinel + type: RollingUpdate + rollingUpdate: {} + ## @param master.priorityClassName Redis(TM) master pods' priorityClassName ## - preExecCmds: "" - - ## An array to add extra env var to the sentinel node configurations - ## For example: - ## extraEnvVars: - ## - name: name - ## value: value - ## - name: other_name - ## valueFrom: - ## fieldRef: - ## fieldPath: fieldPath + priorityClassName: "" + ## @param master.hostAliases Redis(TM) master pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ ## - extraEnvVars: [] - - ## ConfigMap with extra env vars: + hostAliases: [] + ## @param master.podLabels Extra labels for Redis(TM) master pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ ## - extraEnvVarsCM: [] - - ## Secret with extra env vars: + podLabels: {} + ## @param master.podAnnotations Annotations for Redis(TM) master pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ ## - extraEnvVarsSecret: [] - -## Specifies the Kubernetes Cluster's Domain Name. -## -clusterDomain: cluster.local - -networkPolicy: - ## Specifies whether a NetworkPolicy should be created + podAnnotations: {} + ## @param master.shareProcessNamespace Share a single process namespace between all of the containers in Redis(TM) master pods + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/ ## - enabled: false - - ## The Policy model to apply. When set to false, only pods with the correct - ## client label will have network access to the port Redis(TM) is listening - ## on. When true, Redis(TM) will accept connections from any source - ## (with the correct destination port). + shareProcessNamespace: false + ## @param master.podAffinityPreset Pod affinity preset. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity ## - # allowExternal: true - - ## Allow connections from other namespaces. Just set label for namespace and set label for pods (optional). + podAffinityPreset: "" + ## @param master.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity ## - ingressNSMatchLabels: {} - ingressNSPodMatchLabels: {} - -serviceAccount: - ## Specifies whether a ServiceAccount should be created + podAntiAffinityPreset: soft + ## Node master.affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity ## - create: false - ## The name of the ServiceAccount to use. - ## If not set and create is true, a name is generated using the fullname template + nodeAffinityPreset: + ## @param master.nodeAffinityPreset.type Node affinity preset type. Ignored if `master.affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param master.nodeAffinityPreset.key Node label key to match. Ignored if `master.affinity` is set + ## + key: "" + ## @param master.nodeAffinityPreset.values Node label values to match. Ignored if `master.affinity` is set + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] + ## @param master.affinity Affinity for Redis(TM) master pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## NOTE: `master.podAffinityPreset`, `master.podAntiAffinityPreset`, and `master.nodeAffinityPreset` will be ignored when it's set ## - name: - ## Add annotations to service account - # annotations: - # iam.gke.io/gcp-service-account: "sa@project.iam.gserviceaccount.com" - -rbac: - ## Specifies whether RBAC resources should be created + affinity: {} + ## @param master.nodeSelector Node labels for Redis(TM) master pods assignment + ## ref: https://kubernetes.io/docs/user-guide/node-selection/ ## - create: false - - role: - ## Rules to create. It follows the role specification - # rules: - # - apiGroups: - # - extensions - # resources: - # - podsecuritypolicies - # verbs: - # - use - # resourceNames: - # - gce.unprivileged - rules: [] - -## Redis(TM) pod Security Context -## -securityContext: - enabled: true - fsGroup: 1001 - ## sysctl settings for master and slave pods + nodeSelector: {} + ## @param master.tolerations Tolerations for Redis(TM) master pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ ## - ## Uncomment the setting below to increase the net.core.somaxconn value + tolerations: [] + ## @param master.spreadConstraints Spread Constraints for Redis(TM) master pod assignment + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + ## E.g. + ## spreadConstraints: + ## - maxSkew: 1 + ## topologyKey: node + ## whenUnsatisfiable: DoNotSchedule ## - # sysctls: - # - name: net.core.somaxconn - # value: "10000" - -## Container Security Context -## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ -## -containerSecurityContext: - enabled: true - runAsUser: 1001 - -## Use password authentication -## -usePassword: true -## Redis(TM) password (both master and slave) -## Defaults to a random 10-character alphanumeric string if not set and usePassword is true -## ref: https://github.com/bitnami/bitnami-docker-redis#setting-the-server-password-on-first-run -## -password: "password" -## Use existing secret (ignores previous password) -# existingSecret: -## Password key to be retrieved from Redis(TM) secret -## -# existingSecretPasswordKey: - -## Mount secrets as files instead of environment variables -## -usePasswordFile: false - -## Persist data to a persistent volume (Redis(TM) Master) -## -persistence: - ## A manually managed Persistent Volume and Claim - ## Requires persistence.enabled: true - ## If defined, PVC must be created manually before volume will be bound + spreadConstraints: {} + ## @param master.lifecycleHooks for the Redis(TM) master container(s) to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param master.extraVolumes Optionally specify extra list of additional volumes for the Redis(TM) master pod(s) + ## + extraVolumes: [] + ## @param master.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Redis(TM) master container(s) + ## + extraVolumeMounts: [] + ## @param master.sidecars Add additional sidecar containers to the Redis(TM) master pod(s) + ## e.g: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: {} + ## @param master.initContainers Add additional init containers to the Redis(TM) master pod(s) + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + ## e.g: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## command: ['sh', '-c', 'echo "hello world"'] + ## + initContainers: {} + ## Persistence parameters + ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ ## - existingClaim: - -# Redis(TM) port -redisPort: 6379 + persistence: + ## @param master.persistence.enabled Enable persistence on Redis(TM) master nodes using Persistent Volume Claims + ## + enabled: true + ## @param master.persistence.path The path the volume will be mounted at on Redis(TM) master containers + ## NOTE: Useful when using different Redis(TM) images + ## + path: /data + ## @param master.persistence.subPath The subdirectory of the volume to mount on Redis(TM) master containers + ## NOTE: Useful in dev environments + ## + subPath: "" + ## @param master.persistence.storageClass Persistent Volume storage class + ## If defined, storageClassName: + ## If set to "-", storageClassName: "", which disables dynamic provisioning + ## If undefined (the default) or set to null, no storageClassName spec is set, choosing the default provisioner + ## + storageClass: + ## @param master.persistence.accessModes [array] Persistent Volume access modes + ## + accessModes: + - ReadWriteOnce + ## @param master.persistence.size Persistent Volume size + ## + size: 8Gi + ## @param master.persistence.annotations Additional custom annotations for the PVC + ## + annotations: {} + ## @param master.persistence.selector Additional labels to match for the PVC + ## e.g: + ## selector: + ## matchLabels: + ## app: my-app + ## + selector: {} + ## @param master.persistence.existingClaim Use a existing PVC which must be created manually before bound + ## NOTE: requires master.persistence.enabled: true + ## + existingClaim: + ## Redis(TM) master service parameters + ## + service: + ## @param master.service.type Redis(TM) master service type + ## + type: ClusterIP + ## @param master.service.port Redis(TM) master service port + ## + port: 6379 + ## @param master.service.nodePort Node port for Redis(TM) master + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## NOTE: choose port between <30000-32767> + ## + nodePort: + ## @param master.service.externalTrafficPolicy Redis(TM) master service external traffic policy + ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + ## @param master.service.clusterIP Redis(TM) master service Cluster IP + ## + clusterIP: + ## @param master.service.loadBalancerIP Redis(TM) master service Load Balancer IP + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + loadBalancerIP: + ## @param master.service.loadBalancerSourceRanges Redis(TM) master service Load Balancer sources + ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## e.g. + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param master.service.annotations Additional custom annotations for Redis(TM) master service + ## + annotations: {} + ## @param master.terminationGracePeriodSeconds Integer setting the termination grace period for the redis-master pods + ## + terminationGracePeriodSeconds: 30 -## -## TLS configuration -## -tls: - # Enable TLS traffic - enabled: false - # - # Whether to require clients to authenticate or not. - authClients: true - # - # Name of the Secret that contains the certificates - certificatesSecret: - # - # Certificate filename - certFilename: - # - # Certificate Key filename - certKeyFilename: - # - # CA Certificate filename - certCAFilename: - # - # File containing DH params (in order to support DH based ciphers) - # dhParamsFilename: +## @section Redis(TM) replicas configuration parameters -## -## Redis(TM) Master parameters -## -master: - ## Redis(TM) command arguments +replica: + ## @param replica.replicaCount Number of Redis(TM) replicas to deploy ## - ## Can be used to specify command line arguments, for example: - ## Note `exec` is prepended to command + replicaCount: 2 + ## @param replica.configuration Configuration for Redis(TM) replicas nodes + ## ref: https://redis.io/topics/config ## - command: "/run.sh" - ## Additional commands to run prior to starting Redis(TM) + configuration: + ## @param replica.disableCommands [array] Array with Redis(TM) commands to disable on replicas nodes + ## Commands will be completely disabled by renaming each to an empty string. + ## ref: https://redis.io/topics/security#disabling-of-specific-commands ## - preExecCmds: "" - ## Additional Redis(TM) configuration for the master nodes - ## ref: https://redis.io/topics/config + disableCommands: + - FLUSHDB + - FLUSHALL + ## @param replica.command Override default container command (useful when using custom images) ## - configmap: - ## Deployment pod host aliases - ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + command: [] + ## @param replica.args Override default container args (useful when using custom images) ## - hostAliases: [] - ## Redis(TM) additional command line flags + args: [] + ## @param replica.preExecCmds Additional commands to run prior to starting Redis(TM) replicas ## - ## Can be used to specify command line flags, for example: + preExecCmds: [] + ## @param replica.extraFlags Array with additional command line flags for Redis(TM) replicas + ## e.g: ## extraFlags: ## - "--maxmemory-policy volatile-ttl" ## - "--repl-backlog-size 1024mb" ## extraFlags: [] - ## Comma-separated list of Redis(TM) commands to disable + ## @param replica.extraEnvVars Array with extra environment variables to add to Redis(TM) replicas nodes + ## e.g: + ## extraEnvVars: + ## - name: FOO + ## value: "bar" ## - ## Can be used to disable Redis(TM) commands for security reasons. - ## Commands will be completely disabled by renaming each to an empty string. - ## ref: https://redis.io/topics/security#disabling-of-specific-commands + extraEnvVars: [] + ## @param replica.extraEnvVarsCM Name of existing ConfigMap containing extra env vars for Redis(TM) replicas nodes ## - disableCommands: - - FLUSHDB - - FLUSHALL - - ## Redis(TM) Master additional pod labels and annotations - ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + extraEnvVarsCM: + ## @param replica.extraEnvVarsSecret Name of existing Secret containing extra env vars for Redis(TM) replicas nodes ## - podLabels: {} - podAnnotations: {} - - ## Redis(TM) Master resource requests and limits - ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ - resources: - requests: - memory: 256Mi - cpu: 100m - limits: - memory: 256Mi - cpu: 100m - ## Use an alternate scheduler, e.g. "stork". - ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + extraEnvVarsSecret: + ## @param replica.containerPort Container port to open on Redis(TM) replicas nodes ## - # schedulerName: - - # Enable shared process namespace in a pod. - # If set to false (default), each container will run in separate namespace, redis will have PID=1. - # If set to true, the /pause will run as init process and will reap any zombie PIDs, - # for example, generated by a custom exec probe running longer than a probe timeoutSeconds. - # Enable this only if customLivenessProbe or customReadinessProbe is used and zombie PIDs are accumulating. - # Ref: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/ - shareProcessNamespace: false - ## Configure extra options for Redis(TM) Master liveness and readiness probes - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + containerPort: 6379 + ## Configure extra options for Redis(TM) containers' liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes + ## @param replica.livenessProbe.enabled Enable livenessProbe on Redis(TM) replicas nodes + ## @param replica.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param replica.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param replica.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param replica.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param replica.livenessProbe.successThreshold Success threshold for livenessProbe ## livenessProbe: enabled: true @@ -399,6 +510,13 @@ master: timeoutSeconds: 5 successThreshold: 1 failureThreshold: 5 + ## @param replica.readinessProbe.enabled Enable readinessProbe on Redis(TM) replicas nodes + ## @param replica.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param replica.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param replica.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param replica.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param replica.readinessProbe.successThreshold Success threshold for readinessProbe + ## readinessProbe: enabled: true initialDelaySeconds: 5 @@ -406,384 +524,721 @@ master: timeoutSeconds: 1 successThreshold: 1 failureThreshold: 5 - - ## Configure custom probes for images other images like - ## rhscl/redis-32-rhel7 rhscl/redis-5-rhel7 - ## Only used if readinessProbe.enabled: false / livenessProbe.enabled: false - ## - # customLivenessProbe: - # tcpSocket: - # port: 6379 - # initialDelaySeconds: 10 - # periodSeconds: 5 - # customReadinessProbe: - # initialDelaySeconds: 30 - # periodSeconds: 10 - # timeoutSeconds: 5 - # exec: - # command: - # - "container-entrypoint" - # - "bash" - # - "-c" - # - "redis-cli set liveness-probe \"`date`\" | grep OK" + ## @param replica.customLivenessProbe Custom livenessProbe that overrides the default one + ## customLivenessProbe: {} + ## @param replica.customReadinessProbe Custom readinessProbe that overrides the default one + ## customReadinessProbe: {} - - ## Redis(TM) Master Node selectors and tolerations for pod assignment - ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector - ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature + ## Redis(TM) replicas resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## @param replica.resources.limits The resources limits for the Redis(TM) replicas containers + ## @param replica.resources.requests The requested resources for the Redis(TM) replicas containers ## - # nodeSelector: {"beta.kubernetes.io/arch": "amd64"} - # tolerations: [] - ## Redis(TM) Master pod/node affinity/anti-affinity + resources: + requests: + memory: 256Mi + cpu: 100m + limits: + memory: 256Mi + cpu: 100m + ## Configure Pods Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param replica.podSecurityContext.enabled Enabled Redis(TM) replicas pods' Security Context + ## @param replica.podSecurityContext.fsGroup Set Redis(TM) replicas pod's Security Context fsGroup ## - affinity: {} - - ## Redis(TM) Master Service properties + podSecurityContext: + enabled: true + fsGroup: 1001 + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param replica.containerSecurityContext.enabled Enabled Redis(TM) replicas containers' Security Context + ## @param replica.containerSecurityContext.runAsUser Set Redis(TM) replicas containers' Security Context runAsUser ## - service: - ## Redis(TM) Master Service type + containerSecurityContext: + enabled: true + runAsUser: 1001 + ## @param replica.schedulerName Alternate scheduler for Redis(TM) replicas pods + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + ## + schedulerName: + ## @param replica.updateStrategy.type Redis(TM) replicas statefulset strategy type + ## @skip replica.updateStrategy.rollingUpdate + ## ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies + ## + updateStrategy: + ## StrategyType + ## Can be set to RollingUpdate or OnDelete ## - type: ClusterIP - port: 6379 - - ## External traffic policy (when service type is LoadBalancer) - ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + type: RollingUpdate + rollingUpdate: {} + ## @param replica.priorityClassName Redis(TM) replicas pods' priorityClassName + ## + priorityClassName: "" + ## @param replica.hostAliases Redis(TM) replicas pods host aliases + ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## + hostAliases: [] + ## @param replica.podLabels Extra labels for Redis(TM) replicas pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param replica.podAnnotations Annotations for Redis(TM) replicas pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + ## + podAnnotations: {} + ## @param replica.shareProcessNamespace Share a single process namespace between all of the containers in Redis(TM) replicas pods + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/ + ## + shareProcessNamespace: false + ## @param replica.podAffinityPreset Pod affinity preset. Ignored if `replica.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAffinityPreset: "" + ## @param replica.podAntiAffinityPreset Pod anti-affinity preset. Ignored if `replica.affinity` is set. Allowed values: `soft` or `hard` + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity + ## + podAntiAffinityPreset: soft + ## Node affinity preset + ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity + ## + nodeAffinityPreset: + ## @param replica.nodeAffinityPreset.type Node affinity preset type. Ignored if `replica.affinity` is set. Allowed values: `soft` or `hard` ## - externalTrafficPolicy: Cluster - - ## Specify the nodePort value for the LoadBalancer and NodePort service types. - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + type: "" + ## @param replica.nodeAffinityPreset.key Node label key to match. Ignored if `replica.affinity` is set ## - # nodePort: - - ## Provide any additional annotations which may be required. This can be used to - ## set the LoadBalancer service type to internal only. - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + key: "" + ## @param replica.nodeAffinityPreset.values Node label values to match. Ignored if `replica.affinity` is set + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 ## - annotations: {} - labels: {} - loadBalancerIP: - # loadBalancerSourceRanges: ["10.0.0.0/8"] - - ## Enable persistence using Persistent Volume Claims + values: [] + ## @param replica.affinity Affinity for Redis(TM) replicas pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## NOTE: `replica.podAffinityPreset`, `replica.podAntiAffinityPreset`, and `replica.nodeAffinityPreset` will be ignored when it's set + ## + affinity: {} + ## @param replica.nodeSelector Node labels for Redis(TM) replicas pods assignment + ## ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## @param replica.tolerations Tolerations for Redis(TM) replicas pods assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + ## + tolerations: [] + ## @param replica.spreadConstraints Spread Constraints for Redis(TM) replicas pod assignment + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + ## E.g. + ## spreadConstraints: + ## - maxSkew: 1 + ## topologyKey: node + ## whenUnsatisfiable: DoNotSchedule + ## + spreadConstraints: {} + ## @param replica.lifecycleHooks for the Redis(TM) replica container(s) to automate configuration before or after startup + ## + lifecycleHooks: {} + ## @param replica.extraVolumes Optionally specify extra list of additional volumes for the Redis(TM) replicas pod(s) + ## + extraVolumes: [] + ## @param replica.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Redis(TM) replicas container(s) + ## + extraVolumeMounts: [] + ## @param replica.sidecars Add additional sidecar containers to the Redis(TM) replicas pod(s) + ## e.g: + ## sidecars: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## ports: + ## - name: portname + ## containerPort: 1234 + ## + sidecars: {} + ## @param replica.initContainers Add additional init containers to the Redis(TM) replicas pod(s) + ## ref: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + ## e.g: + ## initContainers: + ## - name: your-image-name + ## image: your-image + ## imagePullPolicy: Always + ## command: ['sh', '-c', 'echo "hello world"'] + ## + initContainers: {} + ## Persistence Parameters ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ ## persistence: + ## @param replica.persistence.enabled Enable persistence on Redis(TM) replicas nodes using Persistent Volume Claims + ## enabled: true - ## The path the volume will be mounted at, useful when using different - ## Redis(TM) images. + ## @param replica.persistence.path The path the volume will be mounted at on Redis(TM) replicas containers + ## NOTE: Useful when using different Redis(TM) images ## path: /data - ## The subdirectory of the volume to mount to, useful in dev environments - ## and one PV for multiple services. + ## @param replica.persistence.subPath The subdirectory of the volume to mount on Redis(TM) replicas containers + ## NOTE: Useful in dev environments ## subPath: "" - ## redis data Persistent Volume Storage Class + ## @param replica.persistence.storageClass Persistent Volume storage class ## If defined, storageClassName: ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) + ## If undefined (the default) or set to null, no storageClassName spec is set, choosing the default provisioner + ## + storageClass: + ## @param replica.persistence.accessModes [array] Persistent Volume access modes ## - # storageClass: "-" accessModes: - ReadWriteOnce + ## @param replica.persistence.size Persistent Volume size + ## size: 8Gi - ## Persistent Volume selectors - ## https://kubernetes.io/docs/concepts/storage/persistent-volumes/#selector - ## - matchLabels: {} - matchExpressions: {} - volumes: - # - name: volume_name - # emptyDir: {} - - ## Update strategy, can be set to RollingUpdate or onDelete by default. - ## https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets - ## - statefulset: - labels: {} + ## @param replica.persistence.annotations Additional custom annotations for the PVC + ## annotations: {} - updateStrategy: RollingUpdate - ## Partition update strategy - ## https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#partitions - # rollingUpdatePartition: - volumeClaimTemplates: - labels: {} - annotations: {} - - ## Redis(TM) Master pod priorityClassName - ## - priorityClassName: {} - - ## An array to add extra env vars - ## For example: - ## extraEnvVars: - ## - name: name - ## value: value - ## - name: other_name - ## valueFrom: - ## fieldRef: - ## fieldPath: fieldPath - ## - extraEnvVars: [] - - ## ConfigMap with extra env vars: - ## - extraEnvVarsCM: [] - - ## Secret with extra env vars: - ## - extraEnvVarsSecret: [] - -## -## Redis(TM) Slave properties -## Note: service.type is a mandatory parameter -## The rest of the parameters are either optional or, if undefined, will inherit those declared in Redis(TM) Master -## -slave: - ## Slave Service properties + ## @param replica.persistence.selector Additional labels to match for the PVC + ## e.g: + ## selector: + ## matchLabels: + ## app: my-app + ## + selector: {} + ## Redis(TM) replicas service parameters ## service: - ## Redis(TM) Slave Service type + ## @param replica.service.type Redis(TM) replicas service type ## type: ClusterIP - ## Redis(TM) port + ## @param replica.service.port Redis(TM) replicas service port ## port: 6379 - - ## External traffic policy (when service type is LoadBalancer) + ## @param replica.service.nodePort Node port for Redis(TM) replicas + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## NOTE: choose port between <30000-32767> + ## + nodePort: + ## @param replica.service.externalTrafficPolicy Redis(TM) replicas service external traffic policy ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip ## - externalTrafficPolicy: Cluster - - ## Specify the nodePort value for the LoadBalancer and NodePort service types. - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + externalTrafficPolicy: Cluster + ## @param replica.service.clusterIP Redis(TM) replicas service Cluster IP + ## + clusterIP: + ## @param replica.service.loadBalancerIP Redis(TM) replicas service Load Balancer IP + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + loadBalancerIP: + ## @param replica.service.loadBalancerSourceRanges Redis(TM) replicas service Load Balancer sources + ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## e.g. + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param replica.service.annotations Additional custom annotations for Redis(TM) replicas service + ## + annotations: {} + ## @param replica.terminationGracePeriodSeconds Integer setting the termination grace period for the redis-replicas pods + ## + terminationGracePeriodSeconds: 30 + + ## Redis(TM) Master resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + resources: + requests: + memory: 256Mi + cpu: 100m + limits: + memory: 256Mi + cpu: 100m + ## Use an alternate scheduler, e.g. "stork". + ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ +## @section Redis(TM) Sentinel configuration parameters + +sentinel: + ## @param sentinel.enabled Use Redis(TM) Sentinel on Redis(TM) pods. + ## IMPORTANT: this will disable the master and replicas services and + ## create a single Redis(TM) service exposing both the Redis and Sentinel ports + ## + enabled: false + ## Bitnami Redis(TM) Sentinel image version + ## ref: https://hub.docker.com/r/bitnami/redis-sentinel/tags/ + ## @param sentinel.image.registry Redis(TM) Sentinel image registry + ## @param sentinel.image.repository Redis(TM) Sentinel image repository + ## @param sentinel.image.tag Redis(TM) Sentinel image tag (immutable tags are recommended) + ## @param sentinel.image.pullPolicy Redis(TM) Sentinel image pull policy + ## @param sentinel.image.pullSecrets Redis(TM) Sentinel image pull secrets + ## @param sentinel.image.debug Enable image debug mode + ## + image: + registry: docker.io + repository: bitnami/redis-sentinel + tag: 6.2.2-debian-10-r2 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName ## - # nodePort: - - ## Provide any additional annotations which may be required. This can be used to - ## set the LoadBalancer service type to internal only. - ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + pullSecrets: [] + ## Enable debug mode ## - annotations: {} - labels: {} - loadBalancerIP: - # loadBalancerSourceRanges: ["10.0.0.0/8"] - - ## Redis(TM) slave port + debug: false + ## @param sentinel.masterSet Master set name ## - port: 6379 - ## Deployment pod host aliases - ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + masterSet: mymaster + ## @param sentinel.quorum Sentinel Quorum ## - hostAliases: [] - ## Can be used to specify command line arguments, for example: - ## Note `exec` is prepended to command + quorum: 2 + ## Sentinel timing restrictions + ## @param sentinel.downAfterMilliseconds Timeout for detecting a Redis(TM) node is down + ## @param sentinel.failoverTimeout Timeout for performing a election failover + ## @param sentinel.cleanDelaySeconds Delay seconds when cleaning nodes IPs + # + downAfterMilliseconds: 60000 + failoverTimeout: 18000 + cleanDelaySeconds: 5 + ## @param sentinel.parallelSyncs Number of replicas that can be reconfigured in parallel to use the new master after a failover ## - command: "/run.sh" - ## Additional commands to run prior to starting Redis(TM) + parallelSyncs: 1 + ## @param sentinel.staticID Enable static Sentinel IDs for each replica + ## If disabled each sentinel will generate a random id at startup + ## If enabled, each replicas will have a constant ID on each start-up ## - preExecCmds: "" - ## Additional Redis(TM) configuration for the slave nodes - ## ref: https://redis.io/topics/config + staticID: false + ## @param sentinel.configuration Configuration for Redis(TM) Sentinel nodes + ## ref: https://redis.io/topics/sentinel ## - configmap: - ## Redis(TM) extra flags + configuration: + ## @param sentinel.command Override default container command (useful when using custom images) ## - extraFlags: [] - ## List of Redis(TM) commands to disable + command: [] + ## @param sentinel.args Override default container args (useful when using custom images) ## - disableCommands: - - FLUSHDB - - FLUSHALL - - ## Redis(TM) Slave pod/node affinity/anti-affinity + args: [] + ## @param sentinel.preExecCmds Additional commands to run prior to starting Redis(TM) Sentinel ## - affinity: {} - - ## Kubernetes Spread Constraints for pod assignment - ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + preExecCmds: [] + ## @param sentinel.containerPort Container port to open on Redis(TM) Sentinel nodes ## - # - maxSkew: 1 - # topologyKey: node - # whenUnsatisfiable: DoNotSchedule - spreadConstraints: {} - - # Enable shared process namespace in a pod. - # If set to false (default), each container will run in separate namespace, redis will have PID=1. - # If set to true, the /pause will run as init process and will reap any zombie PIDs, - # for example, generated by a custom exec probe running longer than a probe timeoutSeconds. - # Enable this only if customLivenessProbe or customReadinessProbe is used and zombie PIDs are accumulating. - # Ref: https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/ - shareProcessNamespace: false - ## Configure extra options for Redis(TM) Slave liveness and readiness probes - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes) + containerPort: 26379 + ## Configure extra options for Redis(TM) containers' liveness and readiness probes + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes + ## @param sentinel.livenessProbe.enabled Enable livenessProbe on Redis(TM) Sentinel nodes + ## @param sentinel.livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe + ## @param sentinel.livenessProbe.periodSeconds Period seconds for livenessProbe + ## @param sentinel.livenessProbe.timeoutSeconds Timeout seconds for livenessProbe + ## @param sentinel.livenessProbe.failureThreshold Failure threshold for livenessProbe + ## @param sentinel.livenessProbe.successThreshold Success threshold for livenessProbe ## livenessProbe: enabled: true - initialDelaySeconds: 30 - periodSeconds: 10 + initialDelaySeconds: 5 + periodSeconds: 5 timeoutSeconds: 5 successThreshold: 1 failureThreshold: 5 + ## @param sentinel.readinessProbe.enabled Enable readinessProbe on Redis(TM) Sentinel nodes + ## @param sentinel.readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe + ## @param sentinel.readinessProbe.periodSeconds Period seconds for readinessProbe + ## @param sentinel.readinessProbe.timeoutSeconds Timeout seconds for readinessProbe + ## @param sentinel.readinessProbe.failureThreshold Failure threshold for readinessProbe + ## @param sentinel.readinessProbe.successThreshold Success threshold for readinessProbe + ## readinessProbe: enabled: true initialDelaySeconds: 5 - periodSeconds: 10 - timeoutSeconds: 10 + periodSeconds: 5 + timeoutSeconds: 1 successThreshold: 1 failureThreshold: 5 - - ## Configure custom probes for images other images like - ## rhscl/redis-32-rhel7 rhscl/redis-5-rhel7 - ## Only used if readinessProbe.enabled: false / livenessProbe.enabled: false - ## - # customLivenessProbe: - # tcpSocket: - # port: 6379 - # initialDelaySeconds: 10 - # periodSeconds: 5 - # customReadinessProbe: - # initialDelaySeconds: 30 - # periodSeconds: 10 - # timeoutSeconds: 5 - # exec: - # command: - # - "container-entrypoint" - # - "bash" - # - "-c" - # - "redis-cli set liveness-probe \"`date`\" | grep OK" + ## @param sentinel.customLivenessProbe Custom livenessProbe that overrides the default one + ## customLivenessProbe: {} + ## @param sentinel.customReadinessProbe Custom readinessProbe that overrides the default one + ## customReadinessProbe: {} - - ## Redis(TM) slave Resource + ## Redis(TM) Sentinel resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## @param sentinel.resources.limits The resources limits for the Redis(TM) Sentinel containers + ## @param sentinel.resources.requests The requested resources for the Redis(TM) Sentinel containers + ## resources: - requests: - memory: 256Mi - cpu: 100m - limits: - memory: 256Mi - cpu: 100m - - ## Redis(TM) slave selectors and tolerations for pod assignment - # nodeSelector: {"beta.kubernetes.io/arch": "amd64"} - # tolerations: [] - - ## Use an alternate scheduler, e.g. "stork". - ## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ + limits: {} + requests: {} + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param sentinel.containerSecurityContext.enabled Enabled Redis(TM) Sentinel containers' Security Context + ## @param sentinel.containerSecurityContext.runAsUser Set Redis(TM) Sentinel containers' Security Context runAsUser + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + ## @param sentinel.lifecycleHooks for the Redis(TM) sentinel container(s) to automate configuration before or after startup ## - # schedulerName: - - ## Redis(TM) slave pod Annotation and Labels + lifecycleHooks: {} + ## @param sentinel.extraVolumes Optionally specify extra list of additional volumes for the Redis(TM) Sentinel ## - podLabels: {} - podAnnotations: {} - - ## Redis(TM) slave pod priorityClassName - priorityClassName: {} - - ## Enable persistence using Persistent Volume Claims - ## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/ + extraVolumes: [] + ## @param sentinel.extraVolumeMounts Optionally specify extra list of additional volumeMounts for the Redis(TM) Sentinel container(s) ## - persistence: - enabled: true - ## The path the volume will be mounted at, useful when using different - ## Redis(TM) images. + extraVolumeMounts: [] + ## Redis(TM) Sentinel service parameters + ## + service: + ## @param sentinel.service.type Redis(TM) Sentinel service type ## - path: /data - ## The subdirectory of the volume to mount to, useful in dev environments - ## and one PV for multiple services. + type: ClusterIP + ## @param sentinel.service.port Redis(TM) service port for Redis(TM) ## - subPath: "" - ## redis data Persistent Volume Storage Class - ## If defined, storageClassName: - ## If set to "-", storageClassName: "", which disables dynamic provisioning - ## If undefined (the default) or set to null, no storageClassName spec is - ## set, choosing the default provisioner. (gp2 on AWS, standard on - ## GKE, AWS & OpenStack) + port: 6379 + ## @param sentinel.service.sentinelPort Redis(TM) service port for Sentinel ## - # storageClass: "-" - accessModes: - - ReadWriteOnce - size: 8Gi - ## Persistent Volume selectors - ## https://kubernetes.io/docs/concepts/storage/persistent-volumes/#selector + sentinelPort: 26379 + ## @param sentinel.service.nodePorts.redis Node port for Redis(TM) + ## @param sentinel.service.nodePorts.sentinel Node port for Sentinel + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + ## NOTE: choose port between <30000-32767> + ## + nodePorts: + redis: + sentinel: + ## @param sentinel.service.externalTrafficPolicy Redis(TM) Sentinel service external traffic policy + ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + ## @param sentinel.service.clusterIP Redis(TM) Sentinel service Cluster IP + ## + clusterIP: + ## @param sentinel.service.loadBalancerIP Redis(TM) Sentinel service Load Balancer IP + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + loadBalancerIP: + ## @param sentinel.service.loadBalancerSourceRanges Redis(TM) Sentinel service Load Balancer sources + ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## e.g. + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param sentinel.service.annotations Additional custom annotations for Redis(TM) Sentinel service ## - matchLabels: {} - matchExpressions: {} - - ## Update strategy, can be set to RollingUpdate or onDelete by default. - ## https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#updating-statefulsets - ## - statefulset: - labels: {} annotations: {} - updateStrategy: RollingUpdate - ## Partition update strategy - ## https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#partitions - # rollingUpdatePartition: - volumeClaimTemplates: - labels: {} - annotations: {} - - ## An array to add extra env vars - ## For example: - ## extraEnvVars: - ## - name: name - ## value: value - ## - name: other_name - ## valueFrom: - ## fieldRef: - ## fieldPath: fieldPath + ## @param sentinel.terminationGracePeriodSeconds Integer setting the termination grace period for the redis-node pods ## - extraEnvVars: [] + terminationGracePeriodSeconds: 30 - ## ConfigMap with extra env vars: - ## - extraEnvVarsCM: [] +## @section Other Parameters - ## Secret with extra env vars: +## Network Policy configuration +## ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ +## +networkPolicy: + ## @param networkPolicy.enabled Enable creation of NetworkPolicy resources ## - extraEnvVarsSecret: [] - -## Prometheus Exporter / Metrics + enabled: false + ## @param networkPolicy.allowExternal Don't require client label for connections + ## When set to false, only pods with the correct client label will have network access to the ports + ## Redis(TM) is listening on. When true, Redis(TM) will accept connections from any source + ## (with the correct destination port). + ## + allowExternal: true + ## @param networkPolicy.extraIngress Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraIngress: + ## - ports: + ## - port: 1234 + ## from: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + ## + extraIngress: [] + ## @param networkPolicy.extraEgress Add extra ingress rules to the NetworkPolicy + ## e.g: + ## extraEgress: + ## - ports: + ## - port: 1234 + ## to: + ## - podSelector: + ## - matchLabels: + ## - role: frontend + ## - podSelector: + ## - matchExpressions: + ## - key: role + ## operator: In + ## values: + ## - frontend + ## + extraEgress: [] + ## @param networkPolicy.ingressNSMatchLabels Labels to match to allow traffic from other namespaces + ## @param networkPolicy.ingressNSPodMatchLabels Pod labels to match to allow traffic from other namespaces + ## + ingressNSMatchLabels: {} + ingressNSPodMatchLabels: {} +## PodSecurityPolicy configuration +## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/ ## -metrics: +podSecurityPolicy: + ## @param podSecurityPolicy.create Specifies whether a PodSecurityPolicy should be created + ## + create: false +## RBAC configuration +## +rbac: + ## @param rbac.create Specifies whether RBAC resources should be created + ## + create: false + ## @param rbac.rules Custom RBAC rules to set + ## e.g: + ## rules: + ## - apiGroups: + ## - "" + ## resources: + ## - pods + ## verbs: + ## - get + ## - list + ## + rules: [] +## ServiceAccount configuration +## +serviceAccount: + ## @param serviceAccount.create Specifies whether a ServiceAccount should be created + ## + create: true + ## @param serviceAccount.name The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the common.names.fullname template + ## + name: "" + ## @param serviceAccount.annotations Additional custom annotations for the ServiceAccount + ## + annotations: {} +## Redis(TM) Pod Disruption Budget configuration +## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/ +## +pdb: + ## @param pdb.create Specifies whether a ServiceAccount should be created + ## + create: false + ## @param pdb.minAvailable Min number of pods that must still be available after the eviction + ## + minAvailable: 1 + ## @param pdb.maxUnavailable Max number of pods that can be unavailable after the eviction + ## + maxUnavailable: +## TLS configuration +## +tls: + ## @param tls.enabled Enable TLS traffic + ## enabled: false + ## @param tls.authClients Require clients to authenticate + ## + authClients: true + ## @param tls.certificatesSecret Then name of the existing secret that contains the TLS certificates + ## + certificatesSecret: + ## @param tls.certFilename Certificate filename + ## + certFilename: + ## @param tls.certKeyFilename Certificate Key filename + ## + certKeyFilename: + ## @param tls.certCAFilename CA Certificate filename + ## + certCAFilename: + ## @param tls.dhParamsFilename File containing DH params (in order to support DH based ciphers) + ## + dhParamsFilename: + +## @section Metrics Parameters +metrics: + ## @param metrics.enabled Start a sidecar prometheus exporter to expose Redis(TM) metrics + ## + enabled: false + ## Bitnami Redis(TM) Exporter image + ## ref: https://hub.docker.com/r/bitnami/redis-exporter/tags/ + ## @param metrics.image.registry Redis(TM) Exporter image registry + ## @param metrics.image.repository Redis(TM) Exporter image repository + ## @param metrics.image.tag Redis(TM) Redis(TM) Exporter image tag (immutable tags are recommended) + ## @param metrics.image.pullPolicy Redis(TM) Exporter image pull policy + ## @param metrics.image.pullSecrets Redis(TM) Exporter image pull secrets + ## image: registry: registry1.dso.mil repository: ironbank/bitnami/analytics/redis-exporter - tag: 1.6.1 + tag: 1.18.0 pullPolicy: Always ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ - ## - # pullSecrets: - # - private-registry + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName ## Metrics exporter resource requests and limits ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ ## - # resources: {} - - ## Extra arguments for Metrics exporter, for example: + redisTargetHost: "localhost" + ## @param metrics.extraArgs Extra arguments for Redis(TM) exporter, for example: + ## e.g.: ## extraArgs: ## check-keys: myKey,myOtherKey - # extraArgs: {} - - ## Metrics exporter pod Annotation and Labels + ## + extraArgs: {} + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param metrics.containerSecurityContext.enabled Enabled Redis(TM) exporter containers' Security Context + ## @param metrics.containerSecurityContext.runAsUser Set Redis(TM) exporter containers' Security Context runAsUser + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + ## Redis(TM) exporter resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## @param metrics.resources.limits The resources limits for the Redis(TM) exporter container + ## @param metrics.resources.requests The requested resources for the Redis(TM) exporter container + ## + resources: + limits: {} + requests: {} + ## @param metrics.podLabels Extra labels for Redis(TM) exporter pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + ## + podLabels: {} + ## @param metrics.podAnnotations [object] Annotations for Redis(TM) exporter pods + ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ ## podAnnotations: prometheus.io/scrape: "true" prometheus.io/port: "9121" - # podLabels: {} - - # Enable this if you're using https://github.com/coreos/prometheus-operator + ## Redis(TM) exporter service parameters + ## + service: + ## @param metrics.service.type Redis(TM) exporter service type + ## + type: ClusterIP + ## @param metrics.service.port Redis(TM) exporter service port + ## + port: 9121 + ## @param metrics.service.externalTrafficPolicy Redis(TM) exporter service external traffic policy + ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + ## @param metrics.service.loadBalancerIP Redis(TM) exporter service Load Balancer IP + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + loadBalancerIP: "" + ## @param metrics.service.loadBalancerSourceRanges Redis(TM) exporter service Load Balancer sources + ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## e.g. + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param metrics.service.annotations Additional custom annotations for Redis(TM) exporter service + ## + annotations: {} + ## Redis(TM) Sentinel Exporter + ## + sentinel: + ## @param metrics.sentinel.enabled Start a sidecar prometheus exporter to expose Redis(TM) Sentinel metrics + ## + enabled: false + ## Bitnami Redis(TM) Sentinel Exporter image + ## ref: https://hub.docker.com/r/bitnami/redis-sentinel-exporter/tags/ + ## @param metrics.sentinel.image.registry Redis(TM) Sentinel Exporter image registry + ## @param metrics.sentinel.image.repository Redis(TM) Sentinel Exporter image repository + ## @param metrics.sentinel.image.tag Redis(TM) Redis(TM) Sentinel Exporter image tag (immutable tags are recommended) + ## @param metrics.sentinel.image.pullPolicy Redis(TM) Sentinel Exporter image pull policy + ## @param metrics.sentinel.image.pullSecrets Redis(TM) Sentinel Exporter image pull secrets + ## + image: + registry: docker.io + repository: bitnami/redis-sentinel-exporter + tag: 1.7.1-debian-10-r122 + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param metrics.sentinel.extraArgs Extra arguments for Redis(TM) Sentinel exporter, for example: + ## e.g.: + ## extraArgs: + ## check-keys: myKey,myOtherKey + ## + extraArgs: {} + ## Configure Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod + ## @param metrics.sentinel.containerSecurityContext.enabled Enabled Redis(TM) Sentinel exporter containers' Security Context + ## @param metrics.sentinel.containerSecurityContext.runAsUser Set Redis(TM) Sentinel exporter containers' Security Context runAsUser + ## + containerSecurityContext: + enabled: true + runAsUser: 1001 + ## Redis(TM) Sentinel exporter resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## @param metrics.sentinel.resources.limits The resources limits for the Redis(TM) Sentinel exporter container + ## @param metrics.sentinel.resources.requests The requested resources for the Redis(TM) Sentinel exporter container + ## + resources: + limits: {} + requests: {} + ## Redis(TM) Sentinel exporter service parameters + ## + service: + ## @param metrics.sentinel.service.type Redis(TM) Sentinel exporter service type + ## + type: ClusterIP + ## @param metrics.sentinel.service.port Redis(TM) Sentinel exporter service port + ## + port: 9355 + ## @param metrics.sentinel.service.externalTrafficPolicy Redis(TM) Sentinel exporter service external traffic policy + ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## + externalTrafficPolicy: Cluster + ## @param metrics.sentinel.service.loadBalancerIP Redis(TM) Sentinel exporter service Load Balancer IP + ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#internal-load-balancer + ## + loadBalancerIP: "" + ## @param metrics.sentinel.service.loadBalancerSourceRanges Redis(TM) Sentinel exporter service Load Balancer sources + ## https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service + ## e.g. + ## loadBalancerSourceRanges: + ## - 10.10.10.0/24 + ## + loadBalancerSourceRanges: [] + ## @param metrics.sentinel.service.annotations Additional custom annotations for Redis(TM) Sentinel exporter service + ## + annotations: {} + ## Prometheus Service Monitor + ## ref: https://github.com/coreos/prometheus-operator + ## https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#endpoint + ## serviceMonitor: + ## @param metrics.serviceMonitor.enabled Create ServiceMonitor resource(s) for scraping metrics using PrometheusOperator + ## enabled: false ## Specify a namespace if needed namespace: monitoring @@ -800,87 +1255,90 @@ metrics: ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig ## Value is evalued as a template ## - relabelings: [] - - ## MetricRelabelConfigs to apply to samples before ingestion - ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#relabelconfig - ## Value is evalued as a template + namespace: + ## @param metrics.serviceMonitor.interval The interval at which metrics should be scraped ## - metricRelabelings: [] - # - sourceLabels: - # - "__name__" - # targetLabel: "__name__" - # action: replace - # regex: '(.*)' - # replacement: 'example_prefix_$1' - + interval: 30s + ## @param metrics.serviceMonitor.scrapeTimeout The timeout after which the scrape is ended + ## + scrapeTimeout: + ## @param metrics.serviceMonitor.relabellings Metrics relabellings to add to the scrape endpoint + ## + relabellings: [] + ## @param metrics.serviceMonitor.honorLabels Specify honorLabels parameter to add the scrape endpoint + ## + honorLabels: false + ## @param metrics.serviceMonitor.additionalLabels Additional labels that can be used so ServiceMonitor resource(s) can be discovered by Prometheus + ## + additionalLabels: {} ## Custom PrometheusRule to be defined - ## The value is evaluated as a template, so, for example, the value can depend on .Release or .Chart ## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions ## prometheusRule: + ## @param metrics.prometheusRule.enabled Create a custom prometheusRule Resource for scraping metrics using PrometheusOperator + ## enabled: false + ## @param metrics.prometheusRule.namespace The namespace in which the prometheusRule will be created + ## + namespace: + ## @param metrics.prometheusRule.additionalLabels Additional labels for the prometheusRule + ## additionalLabels: {} - namespace: "" - ## Redis(TM) prometheus rules - ## These are just examples rules, please adapt them to your needs. - ## Make sure to constraint the rules to the current redis service. - # rules: - # - alert: RedisDown - # expr: redis_up{service="{{ template "redis.fullname" . }}-metrics"} == 0 - # for: 2m - # labels: - # severity: error - # annotations: - # summary: Redis(TM) instance {{ "{{ $labels.instance }}" }} down - # description: Redis(TM) instance {{ "{{ $labels.instance }}" }} is down - # - alert: RedisMemoryHigh - # expr: > - # redis_memory_used_bytes{service="{{ template "redis.fullname" . }}-metrics"} * 100 - # / - # redis_memory_max_bytes{service="{{ template "redis.fullname" . }}-metrics"} - # > 90 - # for: 2m - # labels: - # severity: error - # annotations: - # summary: Redis(TM) instance {{ "{{ $labels.instance }}" }} is using too much memory - # description: | - # Redis(TM) instance {{ "{{ $labels.instance }}" }} is using {{ "{{ $value }}" }}% of its available memory. - # - alert: RedisKeyEviction - # expr: | - # increase(redis_evicted_keys_total{service="{{ template "redis.fullname" . }}-metrics"}[5m]) > 0 - # for: 1s - # labels: - # severity: error - # annotations: - # summary: Redis(TM) instance {{ "{{ $labels.instance }}" }} has evicted keys - # description: | - # Redis(TM) instance {{ "{{ $labels.instance }}" }} has evicted {{ "{{ $value }}" }} keys in the last 5 minutes. - rules: [] - - ## Metrics exporter pod priorityClassName - priorityClassName: {} - service: - type: ClusterIP - - ## External traffic policy (when service type is LoadBalancer) - ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + ## @param metrics.prometheusRule.rules Custom Prometheus rules + ## e.g: + ## rules: + ## - alert: RedisDown + ## expr: redis_up{service="{{ template "common.names.fullname" . }}-metrics"} == 0 + ## for: 2m + ## labels: + ## severity: error + ## annotations: + ## summary: Redis(TM) instance {{ "{{ $labels.instance }}" }} down + ## description: Redis(TM) instance {{ "{{ $labels.instance }}" }} is down + ## - alert: RedisMemoryHigh + ## expr: > + ## redis_memory_used_bytes{service="{{ template "common.names.fullname" . }}-metrics"} * 100 + ## / + ## redis_memory_max_bytes{service="{{ template "common.names.fullname" . }}-metrics"} + ## > 90 + ## for: 2m + ## labels: + ## severity: error + ## annotations: + ## summary: Redis(TM) instance {{ "{{ $labels.instance }}" }} is using too much memory + ## description: | + ## Redis(TM) instance {{ "{{ $labels.instance }}" }} is using {{ "{{ $value }}" }}% of its available memory. + ## - alert: RedisKeyEviction + ## expr: | + ## increase(redis_evicted_keys_total{service="{{ template "common.names.fullname" . }}-metrics"}[5m]) > 0 + ## for: 1s + ## labels: + ## severity: error + ## annotations: + ## summary: Redis(TM) instance {{ "{{ $labels.instance }}" }} has evicted keys + ## description: | + ## Redis(TM) instance {{ "{{ $labels.instance }}" }} has evicted {{ "{{ $value }}" }} keys in the last 5 minutes. ## - externalTrafficPolicy: Cluster + rules: [] - ## Use serviceLoadBalancerIP to request a specific static IP, - ## otherwise leave blank - # loadBalancerIP: - annotations: {} - labels: {} +## @section Init Container Parameters -## -## Init containers parameters: -## volumePermissions: Change the owner of the persist volume mountpoint to RunAsUser:fsGroup +## 'volumePermissions' init container parameters +## Changes the owner and group of the persistent volume mount point to runAsUser:fsGroup values +## based on the *podSecurityContext/*containerSecurityContext parameters ## volumePermissions: + ## @param volumePermissions.enabled Enable init container that changes the owner/group of the PV mount point to `runAsUser:fsGroup` + ## enabled: false + ## Bitnami Shell image + ## ref: https://hub.docker.com/r/bitnami/bitnami-shell/tags/ + ## @param volumePermissions.image.registry Bitnami Shell image registry + ## @param volumePermissions.image.repository Bitnami Shell image repository + ## @param volumePermissions.image.tag Bitnami Shell image tag (immutable tags are recommended) + ## @param volumePermissions.image.pullPolicy Bitnami Shell image pull policy + ## @param volumePermissions.image.pullSecrets Bitnami Shell image pull secrets + ## image: registry: docker.io repository: bitnami/bitnami-shell @@ -889,71 +1347,68 @@ volumePermissions: ## Optionally specify an array of imagePullSecrets. ## Secrets must be manually created in the namespace. ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName ## - # pullSecrets: - # - myRegistryKeySecretName - resources: {} - # resources: - # requests: - # memory: 128Mi - # cpu: 100m - - ## Init container Security Context - ## Note: the chown of the data folder is done to containerSecurityContext.runAsUser - ## and not the below volumePermissions.securityContext.runAsUser - ## When runAsUser is set to special value "auto", init container will try to chwon the - ## data folder to autodetermined user&group, using commands: `id -u`:`id -G | cut -d" " -f2` - ## "auto" is especially useful for OpenShift which has scc with dynamic userids (and 0 is not allowed). - ## You may want to use this volumePermissions.securityContext.runAsUser="auto" in combination with - ## podSecurityContext.enabled=false,containerSecurityContext.enabled=false - ## - securityContext: + pullSecrets: [] + ## Init container's resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## @param volumePermissions.resources.limits The resources limits for the init container + ## @param volumePermissions.resources.requests The requested resources for the init container + ## + resources: + limits: {} + requests: {} + ## Init container Container Security Context + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container + ## @param volumePermissions.containerSecurityContext.runAsUser Set init container's Security Context runAsUser + ## NOTE: when runAsUser is set to special value "auto", init container will try to chown the + ## data folder to auto-determined user&group, using commands: `id -u`:`id -G | cut -d" " -f2` + ## "auto" is especially useful for OpenShift which has scc with dynamic user ids (and 0 is not allowed) + ## + containerSecurityContext: runAsUser: 0 -## Redis(TM) config file -## ref: https://redis.io/topics/config -## -configmap: |- - # Enable AOF https://redis.io/topics/persistence#append-only-file - appendonly yes - # Disable RDB persistence, AOF persistence already enabled. - save "" - -## Sysctl InitContainer +## init-sysctl container parameters ## used to perform sysctl operation to modify Kernel settings (needed sometimes to avoid warnings) ## -sysctlImage: +sysctl: + ## @param sysctl.enabled Enable init container to modify Kernel settings + ## enabled: false + ## Bitnami Shell image + ## ref: https://hub.docker.com/r/bitnami/bitnami-shell/tags/ + ## @param sysctl.image.registry Bitnami Shell image registry + ## @param sysctl.image.repository Bitnami Shell image repository + ## @param sysctl.image.tag Bitnami Shell image tag (immutable tags are recommended) + ## @param sysctl.image.pullPolicy Bitnami Shell image pull policy + ## @param sysctl.image.pullSecrets Bitnami Shell image pull secrets + ## + image: + registry: docker.io + repository: bitnami/bitnami-shell + tag: "10" + pullPolicy: Always + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## e.g: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] + ## @param sysctl.command Override default init-sysctl container command (useful when using custom images) + ## command: [] - registry: docker.io - repository: bitnami/bitnami-shell - tag: "10" - pullPolicy: Always - ## Optionally specify an array of imagePullSecrets. - ## Secrets must be manually created in the namespace. - ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## @param sysctl.mountHostSys Mount the host `/sys` folder to `/host-sys` ## - # pullSecrets: - # - myRegistryKeySecretName mountHostSys: false - resources: {} - # resources: - # requests: - # memory: 128Mi - # cpu: 100m - -## PodSecurityPolicy configuration -## ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/ -## -podSecurityPolicy: - ## Specifies whether a PodSecurityPolicy should be created + ## Init container's resource requests and limits + ## ref: http://kubernetes.io/docs/user-guide/compute-resources/ + ## @param sysctl.resources.limits The resources limits for the init container + ## @param sysctl.resources.requests The requested resources for the init container ## - create: false - -## Define a disruption budget -## ref: https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ -## -podDisruptionBudget: - enabled: false - minAvailable: 1 - # maxUnavailable: 1 + resources: + limits: {} + requests: {} diff --git a/chart/templates/enterprise_ui_deployment.yaml b/chart/templates/enterprise_ui_deployment.yaml index f6b45dd..a32bbce 100644 --- a/chart/templates/enterprise_ui_deployment.yaml +++ b/chart/templates/enterprise_ui_deployment.yaml @@ -80,7 +80,7 @@ spec: env: {{- if and (index .Values "anchoreEnterpriseUi" "existingSecret") (not (index .Values "anchore-ui-redis" "externalEndpoint")) }} - name: ANCHORE_REDIS_URI - value: redis://nouser:{{ index .Values "anchore-ui-redis" "password" }}@{{ template "redis.fullname" . }}-master:6379 + value: redis://nouser:{{ index .Values "anchore-ui-redis" "auth" "password" }}@{{ template "redis.fullname" . }}-master:6379 {{- end }} {{ if .Values.anchoreGlobal.dbConfig.ssl }} - name: PGSSLROOTCERT diff --git a/chart/templates/enterprise_ui_secret.yaml b/chart/templates/enterprise_ui_secret.yaml index 90df31c..01c21a2 100644 --- a/chart/templates/enterprise_ui_secret.yaml +++ b/chart/templates/enterprise_ui_secret.yaml @@ -23,7 +23,7 @@ stringData: {{- if and (index .Values "anchore-ui-redis" "externalEndpoint") (not (index .Values "anchore-ui-redis" "enabled")) }} ANCHORE_REDIS_URI: '{{ index .Values "anchore-ui-redis" "externalEndpoint" }}' {{- else }} - ANCHORE_REDIS_URI: 'redis://nouser:{{ index .Values "anchore-ui-redis" "password" }}@{{ template "redis.fullname" . }}-master:6379' + ANCHORE_REDIS_URI: 'redis://nouser:{{ index .Values "anchore-ui-redis" "auth" "password" }}@{{ template "redis.fullname" . }}-master:6379' {{- end }} {{- end }} {{- end }} diff --git a/chart/values.yaml b/chart/values.yaml index 7e610d6..da6a28f 100644 --- a/chart/values.yaml +++ b/chart/values.yaml @@ -1067,7 +1067,8 @@ anchoreEnterpriseUi: # Anchore Engine Enterprise UI is dependent on redis for storing sessions # Only utilized if 'anchoreEnterpriseUi.enabled: true' anchore-ui-redis: - password: anchore-redis,123 + auth: + password: anchore-redis,123 # To use an external redis endpoint, uncomment to set 'enabled: false' # enabled: false -- GitLab