From 75586fb172c770c869a6b46b66170bd4c2f9a8dd Mon Sep 17 00:00:00 2001 From: umagnus Date: Thu, 20 Jun 2024 09:04:09 +0000 Subject: [PATCH] fix shield guard on CSI node --- charts/latest/csi-driver-nfs-v0.0.0.tgz | Bin 11384 -> 11385 bytes .../templates/csi-nfs-node.yaml | 9 +++++++++ charts/v4.6.0/csi-driver-nfs-v4.6.0.tgz | Bin 11001 -> 11002 bytes .../templates/csi-nfs-node.yaml | 9 +++++++++ charts/v4.7.0/csi-driver-nfs-v4.7.0.tgz | Bin 11315 -> 11319 bytes .../templates/csi-nfs-node.yaml | 9 +++++++++ deploy/csi-nfs-node.yaml | 10 ++++++++++ deploy/v4.6.0/csi-nfs-node.yaml | 10 ++++++++++ deploy/v4.7.0/csi-nfs-node.yaml | 10 ++++++++++ 9 files changed, 57 insertions(+) diff --git a/charts/latest/csi-driver-nfs-v0.0.0.tgz b/charts/latest/csi-driver-nfs-v0.0.0.tgz index 340c251e0850fc855942a16d356b3b7c9d2bc108..695048bcd8dfec018221cb1aa3d2b7c4974f38c4 100644 GIT binary patch delta 11296 zcmV+*EZ@`kSov6xOn;I;lI+o~)TxY}nf2X?J>i_nRo*#d8bo%_{^u>$b(X*qkdPk?dlasGdZ-0k4G(MS-n19vVx~+QW z9?64K@)K}D8119!Q46PO@iWE}glt71LQYbt-<=IE(B*dnbgoGTjTlFN$%eowNDwWG z6X>HVNwua0_+F>i>9sz0kN1!J)YktL#~FwnGl0eG|ETxkXm0%NPBmJ4eT>jt6BC7}0QTTEiO-iUO4LC7y$tM{MPZ zf)5fn#qn0NmCsZVGAcQX<4tF*C4f&!2(QABWmGCmLJn9$A4#48IzWG&0M&mVB3l+= zQ&^x|5`V{N2)0V3h474J9W(%mBts({3qWL~UZPt}^~+3v`ppr$r5)8?(FG&0=}0); z3Is+6=n^M@*a!_Q1{Pff&S{=;1w3k**)O5#Dck@~iw|*F9})#!D;G+mXc@xjyDvMT zASHK76#OgT2@z_Ei$3bLS|h+R<9c-f#lslB8-IMyS(fHgWZN;{E@(_B{KVo+HK2#I zg;2^_ipN;OpP7(vR3mS-VkGh+t($BJG01bm`=~p`yc?5Y*S>7EoKY{3pCA2}CdrtD zSoG0R3n4}Q62`N4vlRO18qCP3Vi|o)-(aE0xj<6CJTuU)VoV+UJ#1nEIF^$u#$_KJ z|9|`QXUD1-8~*@Pi2LYS3!z)aZwMXh?wWqdByAxSQIQYbS)3^xz9U@7zY;l7!*dA| zp#y}cn8a#CkxvKZPc!MD_t zs`mTH41cWhs}-2s$-Qs{ z@4~22|NT-(vwHR!iSlF{qHIv?j1Z4X$!CbxufeS~&s7m#m(+8!>vnm*!}adgI$Imf z19YYZKbmT_r05MgyFM3MsneUeYk!NwIcNeeDY6(8tz;r}Kt@O?ol)zVM%T&5vHn}> z6F?=xG^&45qoz@)YomiebVyAffagDXiM4bVYQl)MTY*6FNqE=PDEk4x>JrNSTU$w_BB95q}FsS7LD^ zlrS5SamFD?S)?ff6AHYm-~}33ka9A`67ns`tlK&`FgxU{ERF{Tp+5Tgm(~FaERD5o zRRzVM+}8aXm|cV!uAEK~e85Q>L%$`Q&#v}s2>1Xwx^55(qTgUjnap|4fhHLXCRAW* z!kdV|YEpsz+(&IS^KD%-#eWVfGZ_iH)#Iu*yQ;Rs&={mtt15ytW;2Ks)79pKl2yNBD4aleQ?H$}NFX7x%)}u|W55E`mbBk$ zA*2{mC}R|qYvkp}kAJ9h4Z2+CGJlIceNs3WU_l_PV)n9))3naksF0X?0HIHx+9(Ka zu?#1ldzc^W)42ZMPasZ#i;hgUbpm6V3)`HB9MB!g@;A|FsYD1iZu^xp=x zSUWJZN-%*qDfMvV#mf{oz|7xDdC4UwVesdH+jw9^yWr!gZ+DaVj;WyyaY}O|BbFYlw$J5CFLmmaLduj`x@IwB7 zbo%`HNw3QPkCg=2^Z)yJ>{?cQJzuRJlS;>$4i=Vaw0}Mnwbil?f}rIFo#2!xU{vo3 z^G((CsC7eV)JJCxFk1;o9ASwy-*&gbdYe`{vc^C)yBuaDj(}JA<+RuNlXW2Clms|c zdpU@z?6r^Dxg}vtB&kj5Fu@f>z7V-H|lUY4x{Xlg$YI?iIu>(yEaiIAnxN5xJcY9VB2 zOhX9}jv`G1IKJY9O5kS-Mrn4f1T0<9h=huvDSs+g+Dc(GBLW#Slw(hlOlc01aX{Fj z*0Hv@zY9jMu$=T!$82soy7oKvqsTqxW}2?+uch|d4H=68Q!kDqgb{_?5;qDEiK>6} z5XlJ<$eO8ytA&+LXw^SsSGxM?42?KT(CvhT6H~VUe~Sfr!gy}4ds-OmJbg_e>=>9G zwSOHTLIRbB7S3W!5;akk{ttBFtDnv)-4~J*I&SQJfm+2jC>C^D|E){qaMj~CTC(Ba zA(Tp+F%EdOvvsSNYh>{NOnuNB2B21I#lg7FQ8ax`2qj6DAVGfBeYS>Q4*$pq&*^nC zi?~u2)pR?g;7s@;8rIZ4Aivg$xc+__=6~;MQ{yudTXQ!=XgKo}Y8w6NJgE6WcfYQP z@?|r+RlPD zDE24u4bYqnGa3PpXD%bL!qPf|n!Du+?Mf%k=0BJoL?(1Y;qQRU^_k9`7EpouYTN+K zst89$yoM7_-Zso1j0%t@~?|!t9REx6q#6EMNv<6kPFzT z9B!r5^21m&`p`?da|4VUEkGJG3>C6E|=$$4y0B4VZQpV4Ac2Nov(AHelS0AO;cpImJM*tyyj3lBYR*RTeQTGd@{Nrjp4FZfqz zOr}u8J?Z8rcnT=VVoB1tglrJ5HsF^IjFz=h;Myy1Jn|i5VyW@Hf?=6;?OPVO+HO50 z%-A_f@u;?_hJP`euqq#tnMAkw=wTsPNVG^TkwwJvPIr7)n|%k~Es+y5O%CK7Q9Uba zOmtM4oG4|Uu1aDiW=-vcu$@Gw1+BGLfa+Nt0#KA-elw>-8MO0$9@_Z6K}GWzVG?V| zW1yf7J&H*xMX`fkC#m$!oYk?3nPD8q?A8WM$%0|k)PE?nh!quVq4GAc%9BSqo#R+$ zySzX>H3b~K-e~I?=So&6<&r0b!32BuhvqqBROtt5H;@TyX_*!K%pu5IH5scKP`rB& zp~h8YVF*HuvKT!X&eU#(MA)i5SgvQLskLJEDiyQLQ#6E;BCJf9Cguz-wrZmSx!C-& zj8iYJy?+A3_I9)!QrE&pgkMGTn$|8x9+)LpBM==TA`8|nO5W{nV}kXP@c`9}xSaKP zW`@+5E*2^{Gmss0`S#swAKQM%5S}s;p_BpkgpSrG_BB{m)t|P6z}=!bHOnRTL?7FAtbb<>2FAK!5nWIe%_vSth(z6{Jl_`- zVgZK^7cZpRh{Q2ONPRNYjP4kDOUwqs$g2TveQm86smWvNn5W0*qh5T4CVQ9Z7|5SmB zAS4l})u~O=`e;FEg_VS6faZ+1nwBuplz(XSA!jzK2U3SvfZ7ZiZZJ#r?CF8=Zaoye z7-NNZ?HLlk0Z0|Ga?J}gV^P{%15g%*85j99R2Ow&PWmxrg#W564j zp%M_HND)wfs%nERTCw{^ATfyx4=mM3fq~~V*RYLlqC`b@#k#aoHpj4eSErtsjeo~# zDJx+`3ab;fbA|~;0;nL8Ou^MYJt7D#x5!AZ2$~x(xmf&|X}!h59X7vFVL9(uiuD51 zLmBz7gu|2t9TjYaKn&jydO|aN!n0XaE?5ey2v0`@X>{L9_C6EflPasq&c%{)fr7C} z186|gAm!y;D~Qgeg3>1uL3k~U_CL~?qpU*J$|Q#D$%RNQE7{n>eM%Uw6H?uE7ZrBmTk9n2Ntc%6iW%5 z_R;@+@}GbFEqMALPoDhT3;z9=KR)@-j{f7Dr~mQvxBSN+pFVx^tD#z z-+rc9a$|n|_T*=H{mY6#o_{|5k3Y z8NJ(qZ}*Arn`~G+UR;>f%z5>FXrw<%@OK#!`MVE=+=oEkQwZcvLmzh+^0>=T$1f?w z@zI7h4nblQ-*{lGOs<*%d4W8ruQ;8kPmq)$WkjGzah9;;?g!}A)qjN>`(>s(2gD%+ zGF4*l7IUioYG&+BRs;n)WmH&kSORxMw?&xQ1CFBN-OQmDDyUNVb(ESw3D!#>@0*Kf zwK>A*Uk#i-YBwDD=;mPNV?9f(|F=#R*9@Un*=&D5U%=@X6lS`cz|wsvX>%y)j)F(` z;i9XAi{3+k=)(#L{eRK|K(`I`+%l+h%ka&u12rFSNahZLFSie~+&ZB04nrqDOT6N? z(TTf=Mch8}aO*h3ZKDcz7(;jm5rf;t2W}q?_}ec|z2yNK4>87*!ZiM2f?ZXIQ{ zqnN5~BdE5Gm)b{1?J7Ddzs5I77Wl@MLl^WU|NH#1LZr+IS}p5H)|(AbYd?I=d8q8oV%}Bdm-W8Dh>O6qK1&ui%%4m5-t!@tPXgX3m2KMh7isKoe{GT9cX;8dfqBB*byk;b2Ca zO`{sO8%SlRKx(DNYfUtwvb^yc!_FUn00hu1sXLkM6*<+H*ZHN6%L%f$D71+XiyKeo zg2rucYzaML6HKF6vyHj5bRMc}3iQ}#lL{6Ze*?3?%wvL6vvsZ!UM`Mn%{hQZ%n6Sy z(}SaT6A<9CDVE}YWcpe)C*oqW?V4BL(jQ#yatG&JRz2DBV07N!tFF6`&c2)IY(qfX zglKCByNc7^WG}MI9mvl29S?K2v5y7M$Mmju6!*cy*V#4fYM*c?JA+;91-=OF|3T~f zfBRz&k3^?`^jiGt{+PW7=5csn44=OT7mQgqaf2@_feci+1x-VOrSQexm(7JXtoV-AL2r;8$ zu}zYMW~bKXIIj`}UpKAiG4YnHR_oF=jPz}=3wpFhXUws>ZF{s`Pc#k-x^r18^SJ!B zc7$p%WG2-GYBL%{MBKD}uASn@#Nze&04x=C=fd7Ex_9k7z-{1?)9#hS?&V@Ke{rb` z?MAi1T7F!`ZzO1rgkNL=o9oANGuR5UseBfidsb1TJTP}+K=a|cBa_;?!?1#p%>!~r zW;YMy)eUjqF`kDZ>(onXqe=|V_rNV|67#{oIFl^F(t`0tDxVE57J!t%ksuL-*o|MV zYQ=5apjo6*^UY5oKJwDR!uc6ycK|B>jCH6g7n05C zAm(kNsL3vhnrx$Jap=3xMv7LqlP=tNc>26PBeAEkY>qAu$Rbq)cF-%lbtV0w??GP0 z*_cqJR6coXBFsnLl+$`SM)p*D^ZYCr*Nqd6*VXVW}H_IHeEHg|~R$5P|8uQem%Oc07;lPC$e;{;x*wnPA1$)9Z z*U|N9;@n5Bm9vP9MxZlu2+(Qwj7n}K3-*B&SvWa#56KRdgw{Yp&s z5)lre@oKmU6Ng~3e^GeP1Fom)9vUQc!mZWpkIh=2rtZilwsFv%;53ERwG$8IP4$%~ zV_W`I=8q6nxY z9E#aByvtayoU{g5$7E?DLjPy*_OkmuYXE8H3+r?O`sf}ce?aA-<{u_AlFmRlP+vL; zrep*{c5EBK#m~pTG^qoMc;N$1(ijeNM_i$TbhUhkU%Q^R zg`HcJLzGQ{PYK+1ZyCQKbQ~zs3~b7!u9iRD1O3m&ebEAJ)ecpp-Cg!dwIjM4bt-o) ztS-mC9^|1+wYoLUsNk^;i-`!7;0VeTJa&)`fetqP*l@uPo#(F=M< zLGQ=|vDfSC|Dhk>oi%5f)3`RUH#h98d_LR7sctScyG_-p*&bV7wFU{lzrpj1%E5*o z_WhkTq2v)k`#U^;hj)0cn&xd`0JN`1HY9q(%x+$T-r5vBmu_t-p?n5G1fJ)*Nn`>ZME*{7Cx+-Hg&^C_awq;l?4 z?5udQXX|r3J2)mWO-;?xyD$c71AL>oW>p%87(~IDfGHX@gy!E!g%X!LH5?>`w{QPYG;we;!~b zk^kGp_-`A{zjfUHP9pTTiN)V0>VBK}`h6t*+MU}+((fbb_c8PPnE8Fo{KLCPe7TA2 zcYBw3)v35m)cV#j>f1)7KhpT~FD}}Ae~b5*89{!hcX+QE9lpQE`yt)qy^|R3Z6mgK z5}&=lkNeTy$Nfknq_>WT-ZuLAe__NrKhSH$KYk1l&N|86i45JM>Q?NowgIQc<0kgsc;rpx;wB*zlQHfYK)6@Q() z*njpVo;3X3jKa=e;}-ZXf+~DaT78sYLEnv;VO&c0fZc+D52NCXzV2W8&2Zp z+69__DgovEt9UVCLSBNrW&Fkj>>_mFT%&_|MYCD7INH{?(5y^#QM1_rA zYZ!;3K-s?H_auZ@q24K7)~UAo*@0y!Gcc-?rzt$rHwHN^rue^(o%x#6KKf) z1U%66PZ(WZqP)`dWs?B*0D%vZ zki^6r8O~W+e;1%vKm6cj8E&SZ)mX-$tg&;J(FohSeBIKUvy2_Jxf;vZG0)hHBP?e; z4~Y%9Bi_UYHe0a{~?K0 z06o9Vs)aXP*}H0Sm33WRz)jR{O6u7t7TAfHD=?8V4e~QqFJl(sSna#|e)YDB`2=t* zCs&NiD$)k>^yTqdi?0fM6A`@e`q*GWSFn8~5}1y}Dhrd2#BP`49KiV{p^9v{^frNB zUuFwue<|f;N@5sS&JC|JGdR*0G7SDUc>n7B&Bf*1Z4Aq&PJ@YKc6*g0@mhp9#@5?g z#b)^$Qv=bovKm#023EkvKfn}XztC5EZ4$lw!;{Om=da&iocpwkg6sU@$=TrI{p-u~ ztG5@I?|em#jagB#i;X=OWKCF}YI?;7De!~{e{CrD)HYn9EaHchM|>HG5#bG^V#{g% zbWXS*m_1$|Flvq<*jtwyK-$u8sW~=QOx;R~k{y1ZqVyeSp3`aC3Ftj<;0AzeQ=vAf z%v~~&x9m=-Ur);@`Oxonn*>;e!&cE5VG?H?-c2}&35%mXdRFwVCI4HYu3 zfA%#slEDbIU+W(kmrXXGRfVFyCLG7-5aZdv1P1ldN!7_`C3W%nsQNhtPFUoxyj(J- zED|LJH%mvSn>X1|QJo>>t^(k###xHTmMOKrbq{RR$$#T*a;@^J%g@_@Ow#Q);dCS# zG zLPzY5{C~aPvtF<6|2utgviJYp#}foW#oafTjKq2e&juGZ&(T6hU{#e z9ap)x-K?`8$Oyt&80!nFij-kj3MFALl&Se4Mu7Fn5TJM%!v&2AwRc?EB^;pFf9V7g z;QA7H*RQb<(szUJIm=Qbp>^?*aNhKh((x+*Kll7?`z&4mN=4Xs<(p@j|NrFqv+DXk zdU5>x#eV(Y$K&|_F(ix*U<3ERrjfgK{F{t0gNiF&33NioKk84p;7#y{A1R(<5~~G0 zk7o6IF7mCP&IPzh{6K9W?#laLe{1Fu`27zM<7BMQ|0%62WRx2H(jK)O0vd9515`Uk zSteZ=NPu*b&)$6`fEwRbUB`MZK8Mp-H~d*55&WoZ)A|%Hv`I}WmvroCstL@klzN`U{?b=giQ%m_Bv|eAle+#U3@S&dY z4&|rnd|9&09>P17^M!-J+D3{}+F_kyIeGbqC+F7}KfS(wfBpLV_k*`*e|dlP>fN8` zuf|qT5*EQrKPb)P-SQjR^PVkbbX88WF7w-F7#gj}zKVXEZnLpUr}rv0hURBeH%zO4 z`SIJ=@3jH@^3|Ky_h!Ogf5D65Srqrm!OO~(XWt}3$Y}inX?Hk4hTXhuXRd5B$e@0A*+QV5Xs)Mof6Q_{nZLfD(@Pzj z`8a)QV|9^Kot|&GIRib1(`WO&Zqx7gR%x59)D~K%6mCQIi#xJ}xDCcim6@9#w0tS8 z+jMOSETfQS44jqctfSBEba_C}LjPYL?7!t9;3fY5XD6qpHUIz7v%UZSex4dbfe+^D z3pa?~xW>(~bbHy#f8Soc`2mec3`k7atw0lYizGvlK0;hgv{8~yOV{>(LL^CJo$^x@ zIWjqmQOsDXGqt+eHP9%dRwp2G)@dD}3pcMap+aJv`2vd~J*7@Viv_r8s3XN<$uKk7 zf+)fi;Z$)_P84%Fa8k=E6hfAyjA|4MYzZA3uzAAk3T8TEe}_d!mAoZ#(mFstVM^lI z&4_)dT`hqHlHeNbpz8ZaT)&g^qQ7cO3y-S%THW38^~IBV(6lhoEu&xS6xa#oH)i3Od`vdq%k&7H zU7wpPHL}uqf39H?iVmLjPAjkj7dDAw1RqGA;2U#&lgEqBGnD66)9G9^un;RmMubL{ zc13<`lulYxF7>fi1BxUuSOG~0)wlgs4Yp#Xz=1)=$53W%sfQAn3$py70!^-d11YXd z+qx51_3tlnWiJEuAOZw7Ir+ZW4e#sr@8u}>8jN*`f7#JjeWzx~r47s*4t-TtGE?4d z<2yLTSvyzRbjEtSGn|Vp1^ywiH5NDqmRqO13$nplbq8*S&yh>%F+Pp^KR(1^V2w6+ z8voflJvlj=i~l@5+VB7FM^Gosd^I}bJ-KhA^%e$8U2^ir3`nVc|Ael^Kz%Sir(UDY+Msu1MN+szQ8 z6Z)*&DW1iKT?YuKM90vJKKi+BU9XN*`njDJk^a^mZ3|6-4|Rbt$o3&>$3*CVZ`Dpn z{b7bh{bi2f>3SP97{-_+E4OMwk$r7d4^Q}7f3_t;rID`KPhUI!t7Cl)+7Y!C@^%kV z?Zan4#a!sK?x-K4c6w*HbWL){29#F7z}J+%(q#jZUZulJ`xy$NnAXPA>w~!!z>qN> z5$dugUmKd8-p!zSm!;Xf`r7-&F}OKg_giyy)Lk&&T4t`m-cq&tkqL91j^(~yp@-1= zf5Le+p{Im|jWn2-RGW((RLtRmVcskK>pzS2|J^u%mid2Pyf~@*e_os%@Ad!tc-Hp+ zTz~uO%(#AX--O4a+-V)`ojtp9_H4b2xj$czUsmo&NG|9`z%y!+SU!~9$!Fe)tgeV| zsex|06L~1xjCyKnG8e{8^-x;x+I>hkJ5=lBp6Uln84OmD~A9LIcf z54(khjBp(z&89nrWj@Bc*eI;P{a4#0I5Tul!pS&ra{tYaMQ)QQ+r>t^So=A>mz=L$ znU-_@QXkm+qxm}>-@8~NbF{w+(a-gIqaAYN{?D~k-mU-V=(soM|2cj3Y`_1ze~+i` z|1qs|02t8)8xk#Hchd7uba=&Tz-ked>O< zBHgh@>GNuxP!M-PHMg5$juVi;b+hHKhR~1WT3i7)`vH%Sz0yjhn5t)#E6af2uxP>1 z&lU9s%T=l*wfJ)P_lh0c$6`N}f2YR(I}?Z#GNz2f?%G(I|LypBjsKq>pYHE}x|inw zU16nGP<`u;nR#>D=rAL(VhSk5;SC;x=;YDg#l3%G0&$GSF&mobR6@sxh(nC^jj1V? z6X!jqQR@IvFsHlFlT-(xh8w*)lA;Z2rmo2F=e(-F66 z>zmFH-?YBz$Rurj^Z&FNj}w*&baDP#v^ptg`cAnHi2!#^InMsx>P$t*BIxd!+Wy%; W`{xln|33f#|Nl_NJ&yon0s#Oa+y~YG delta 11295 zcmV+)Ea21mSom0wOn;U?lG&qMsZ$v{GwZt($7N-*wUskB2O?V%)+E3MKslOBZta7d z^K$znx9~v{q(FW9D-mmVVv#_j0W`WB-Hk>lNDy%{0UpqyI5-_+E<014#NTZ1>2|x_ z=O-un-)^^C|F?Vi{OFs*ljq0B-R@!c`0$(V;Ys)K=o{4CB7Y8zPbMVh-*h)_tKPXs z^5B%b11<=oJv2FN;WRCN##n-otq4TONh><5t2_k*MAZn!t_@<6sDMZIHXJv$@sK~Mj`JI zc5wYC5eSJ#gpLA1MuCuw;}IOtp-AIwL}*c2;!zKUm|{LH-lbU_U$U5l(;hk>UNCvd zK>(GyKq$y1XA`3M3UEIbHIxrr6co{?C4ed-lM~IRmVZU0PjM>7Ov-f;5hZ{cBF{U= zo#W*YiOB>g2yw~T09MB%ub!&vH7t%gheykf2W1f$(Qsv2!)p$T0+jP5o`af2Z0U)D zj}kb=@kX!R4PnD4p>4DNuB}PLw_9u)qn3JTNYtc zSfCpc$A4%5wo0Uh@RVg8)CY+qLqi-3KxC+1q8m*0%S?d!%@Mny9o1gZ1tYNOP&nNR z1V(%40w;jj5cMqv7F`9-X`XQfJZhQQFQMrvTmw#v4{%r?5(Ql=7fPdO8N%qfFFTp--h|Nk2pxIB@G@92_ zWt<_^KEx18#_g+=6UK?0p2k>+3q3VrDt{y-L1@qkLQW(Jaoj>kvKTlvQ?G|HK-Vzs zp|+-a&SL0X7kaVcBZ;1*w&e{hRkc;q?N=X(kRty8!y$yShuRmcAC4i)VrVY~-%?Mi z=KI!L2{vkmgJ2mC!H%3?n8zd`(orxHNHl*w>2_a}R?fHok%4eag=yA9huvhR+J8}A z%P+B;T07dXHLqB1YV2^s#vFz0Hu}@j?0tr9ske8@3=;hD7h1qE{ISZfmSA$ncft|8 z3!_H;cS|A7>e)RK)ow&wlTW)itI3VTCKf3bOl4;KtoXa zA)}xa!-R1_Lg_tHShZ23cTfHMDVJDxnn5lJPtBf&+9y-W> zW&@=!+F!FedAr-T-<0xhG0!(%&i>pEBO(GZ8cz`gi0r;cmx|QvCyq9*Xv*k{hE!K+ zC9t!o;RVb9TnSGNL8LfTVC;|?09?%rNpeAHP}E<{ivEGnNNd_^AAfb8BoGm73%K3O zM>J4#GXXAMoOBM?w5!(ae-e^Z+kFo%-n@O)@5qmGa~snl`~UID_ci<9vu8(#JNw^V zJm~Eh>Q;Rs&bh1)79pKl2yNDC>%q0U9X+8NFX7x%)~xQW55E`mbBMu zA*2{mC}R|qYvjeJPk*R$1-e}4B7ciMe^xjcU_l_PV)mkq)3naksF0X?0HM#H+b9Tb zunfodJy8Zw8N%v&8{_o=X^y%O`G$Bb(Yl1@( zgPf-DB2mK(beF{*d)J{NcIuspM ztc`;5i;{(?W4z3IjdtD{kCQ6-W&)g(2+;3JC8Z&Heysl_Nk1D7$w$-Bt%Z)$DSRkvIZg;g^$c=TFvwh*J{a zRPE&;s?b2!ol|opaz^GzF>N2DW?X z8X(Pg{C|Yew*IZHW}L|7^rrmXrm;z~>aU9QJ*E041#^puXN`NNz1EHfV#=Kswg^&nY3O!Wp1fmu~ zcE&W60O2UoG=SqvPN)Qas$i66*GjlMl&LiF+(}_B*~QKAQ=aQ zEovQWi~GA^^b*T)4|UAurlV`WWxt5rV{WGDs{UGPuib#L7%=tXI7ApxxG8a?0FkKr zNB5B&6M?LmO1N5B>4aAOGj^rRcc*B`S%PlHBpjQ%1^62*&=baUd)?E*VCU&;3Sq~< z?0=~301*Qkb*Pe^JrL8d!PJPC*u11MSqyTtxb*3NNmmB5TU`;Q>bb5C$pet2i^U; zB+3`f=vE0wvSJz4OBMreizdR3B zFsmXQ8u1#AA;G=UKTls?p1(WpSASlk>hRTQiU@?2Oyu7d%U18MfhaPux{9Kn>L3@e zQ90a9G5At;SSGfQ7%vE4GF5~_(8!TZ>eXnxKO%I7Dq}{O@J#|6S5H{zZI}GOMg&}+OX;> zOs&UI92>v*zFyJ^o+1vKt7O!HXJd5HYo(?TI%K75zt~OjXm1S&@A8 zs{gk1j;YD0kA6*-i*gFofPWD>1a2l#t3O)I(?}Dku~x;T@MFGXBhSicWC?@hKK?>l2_xS_Eofmz#oI?{As{^}Ry=5eThCgk#KcD1ocB7Yegr zi{)Dg?b?_Prj|o^2g2iZ4H*p~mEs_er!3B`K_5wxd(g&$g!?p@*xf5xC>I}DKq;4329$B@cQ4BRE6qH;b=lwcz^V_f{#11XE100Isk1cukR)!2103g#l}T(aL+c*M>wdNc>Kj1 z7(o6sZc~;Zl*YOZgn}FTQxWFN@5(Tp-P8FxSLz3|6W26Fc5B%H*UX!qwj#(tiL0tA zpa`x!@Z>h$0CvO4G#|}K&3t4O-VA5wG${6mJ@mfaxboY-E`O-mND4DG8#ZVQIPbTf zEuyA0GP}|D6!i?|qWz^0jBZhB4g((>iD4)aC9zt>#F~=K9?l3**mZdE=4q7!ym4?-dNotZU!0z}0r^ zAz{YOQHn>kMSnGn*@RX3kjx~y$wvHvVE1oP_|9m=4c_jBLI_w_59#}JcP zLmmMIZRk-ZvK<==DZh&p21ILMfL#DGVmqvp+P?DWgh1P`iOlSWC;a*k=wv-l)k~)_~&O zdk8hIA`3$hVwlC~$zZB>GbF-R?ZI+2Gfk}(vsbB@WuBq|3>9Hz!Za~saIsYz70CJK zmqnasWxf+3J9}!uwZc*}Xe;Z@0my8FfUc}|B z$5S(;#&j`P!I^^Wpo=$eU-{VfTZZt2kqD(s2%@$N0>X?FIYmT>48%SP=aIA*)76OF zPu3p5+a`3hGO@3~va0^H1qALE&8b-~uqXQ1u76`aYcMd@4U6cUqG(ESLP8|!Hs#sA zpb!h#cer>V)rKUFAyWFOZL>heb6T-{tfU0g&YSq4I@d1jGcx1UZhEz-Ygc7d+XHiS zb$NqZX82%if$`Y>KC}F^%n?iI6#_VlJxrZo$MtAd#gh<7!Pvtt!m26k}{M zY=6ZAxZpFz%xN1mn{`5F^qSg3nbpTgJY(baQ`{Wl2hJH^K=ryzPVO-liWBHa@5p|N zGVab;(U*NshjkFaw6Yxwb3J$rajGPxWGG9OavH+~Vuvur6Vic>4=hgg@d`uxMfs-+ zR0JW3K&?(~lGaBHN-L}+Gy^nayw$XXiGQX< zm>$Z=hXov_Ea<3UO9W#0hR_q5;S-+CqH@ksSVnj{B1ohAL9!2-0H0J@R(8&plyek} zc^W_ing%H^=UPH^E)AI;iH8WDqo>K#egdHvJd%U8dW zr@z0aS#oWD{r==Vy!v%XAb(Gv{>L9?Q27`*;hk#7$9Q1YeUT)@nH`^)oVAw)dWc$$ zwT#~Fz_7bI|_l^YUtzkLLRpn>i8vv zI6m6Y#sNrd;v4sjmC02zATN*y^%bWR^$C(Pq>Km@Db5m>+#rr;G|K4ol#U=(Y$md%#gtyqh`HLIqVSzm8H9D8YIO;J7&#Wh2yRW{q-`wKYzg2GI<6Ii+nC2bBR-BR%A zE?jh(aM3#m5Peu7p?_am0O+Qno*M>rZWz9~aiHeo4awX>@a5)VmKz6D-eTzFy~HbS z8lAX}Sj5dE4>yi8+%&3ii!p?^5HYxEeBkEMfL~MW-NNgI>^@Yc8Z6jK1YqYpwB-ZAXxN(%# zmSUIS}p5H!CMVbYd?I=d8q8oVl+SMVy?01fFOYV7_ZBdm))kQZ>O6qK1&ui%%4m5-uv@tPXgX3m59Mh7isKoe{GN|Txu8df|NB*byk;b2Ca zO`{sOYe;3MKx(PRYfUtwvbgaY!_FUn00hu1sXLkM6*<+HSNWxmiwUy0D71+XiyKd7 zg2rucYzaMLV@#u1vyGXwbRMc}3iQ}zlL{6Ze+|>X%wvL6vvsZ!UM`Mn%{hRE%n6Sy z(}Sb8V-Vo7DVE}YWcpe)C*oqg?V4BL(jQ#yatr5NmOa_>V07NERoC4`XWveAwjrQR zLbNr6ZN+J?vlrRs4rJ^5j)%G1*u{e9V|v>=io4+9tLz%KwNJQ}oxwKt0$+so|Dg5# zf88;MN21d|dM$o=f6UGU^Ef;(hR@%D3&t@uH9BETnMH0Gi*mCcru=Jx`=!8XLkG;G zOS4crYag;CRg$;jG%wMnNIUiCptahGdNqV2%Wf9$#eL$pK|3iJn5(7CjV4{*QoPEJ zT_54!!nVEf=>BQ{JeMsw71=Np9b)TIf7VLgzUtv{-IonbEOXKhXkEJ+PF|orfSA#d z*d$3pvr}t*oRGLz~8wHXZ}BCgv$*G_R{V*dJk0G5inb7AKf-MMxi;5Kl)MOV$O}0@qKlI&aBSp*GN#|}nJbhlBk=WB%Hb<8SWRWTYJLnbOx|06TParSj zY(%J1DxW+x5#~d0%4xkEBYUd7d4A@M>)MG%@{?f|Gr<$a%bn>{55f)0e;6@7lRi-K zlD}s{mYLSDV@YhJ)0*0M``J$N{{LB<-IqB3RIN};j-k&PVJ0lJ z7IR)B222r-(=oQWFjisf>t&8vlo_TeE3Kzfjd^O(MUi9EaNt4=e-Jv_Z))1pf<57y z>*)G4aqc76%2`B)L(rKy1n9JTMkP0r1^YmXEFABx}oERByN3n>D@&fwSM#tC_<-T1R zi3o?#cs1OFi32d%e<-}?0asIX_YD#{;ns5Y$7ZchQ+H$&+c@Zsahk&N+KC79y823! zu`Pcp^!M`eydDZ?r_#GyTqwD9Pqh_vaogXX4^3md%!x_BOhsY4Lxc(mIGUp-Q3O;H z4#n&m-eoLUPFe%3W3n_6q5so=b8+w!YXE8H3+r?O`sf}ce?aBF<{u_AlFmTbS6?~_ zrep|0c5EBK#rvaQo74eCyzmhxX$`b>dY+hUgKbr)ZICO>qplz+ku=5wPDUf}-ywnQ zHc97+da77De^CApQR6*G7!1V$E6HBXcxpp+Ac;~?Mr-{7elg?!>{T3F2GTxu;+1-?0Z(=(VUf*R30SJsdy z-e(er%~vguF^lFtl5mXasK{G5%w)!4y;Kjgmg4;Je^`v`jN{&Hu1j`~E|>4{Ti4Sz zw{!Dyh_VUr34xn~8^*5*9R-Rs1DkT`K+B(lJ^jzxebEAJ*$!2t-EHQwGp zSYD2O+s{LpYISRxQNd#y784OD!4Z@xcy5`L)qv{sa^WkvRT~M|Y)*yyzBGfNUnu$Lm2H#>2$@dSs2~CjS!9xv zVu}cr&rdq&4b}Dc^N6uTDNg?t`L9F$zFkT7!h&-Qf8}A$^h!vb(yNgG6Ct_AU5wpdUFpvEN%#ayVMeo`%KYeK1Fm-D(5c6 z&XOm4Ha^F*g;P6QIis_}iJZB5+!uTRXXE2Gn;))u;74h;cW~y*Jtni!ftXE>zC6xD zE*l>?vz0Nl)y&ke*v}< z`M+6=|EAIW8^`T$B|?9bSo}?*?l+0A-$l}|+__yO{VtMz7c;+$ncv0CKfHUy7n{hw z+PlQ7PQ^{4);Eq(-!vlqk;b2Yana_xTfD!_2=ZIK!+XW(@ZCM$59uE7t;BF|8nL~V z`0U+%+>iD??nfFSy>UGBrqRz2e zggWm`_?tr{+D`rXbIUdC>7rK<0~XLJO?aO_w?2JBgobez0cz8s=)`ycv1p?X`dyo@ zsYFMrTpnu0A&p6hMN{kfcY}d|7($tErxGl~@z1(}d|l%-UEB{LIhHW8K~sjQ`0L~) z-%e9oH(yT{gJKMq==XC2e_;hgs}X66n~-5qgCuwamsuS5A><%M3BCSBV<*|)a1uAy zF3|i_2`J}Z#fvc$@&e=yEJDs1dp z!#ETL%Jvn%Cn3BH^-k%cPPNs~4lF~Nfl-}2P2r)wG015te^VK|f7&3;3=d@y^eZH) zWk|(-$wUvugl6SA{o1^`#GlbO^feX|xI;Rsm4LGtsy7fFB)VWBt(*yTDlcg4)cn4T zF@+_X%&o?$D&NrZym5C2%yN%q$2#SNaU!Q>s6zu8%@lOWDa`aIMkRcd<&+5s)o$aG zvmvP}ZiZW2WmN6If6q)%`rIx`7K71SofYc5T#3L+-=M1_8Sbs*dl~S=TXv?$SX^=# zl8>l;(5^23PAJG_Swrz!CWvHw>T)W}PkN~BjIXIbzyhuyW$5$gnQ!x8_ZF3wc!WNG zZkqv!1uTir_S$p@U9$r|5_NNbJD9vUYR|k3)I{JYQX27#e?L5Vd3JX7s^5R=DHsEe zfCrlX38RZklvkR*XcE94An;Lg92ou^qm@G5!I%i|@C&Vcp zkeGNQ!#PXq?*jDl=bybS!_D-w9LwmJHMY(&8ew~vuUmS3ma(Namtz@Q<{9g8gvE^K zA+Z5>#GBZ_dMnm}JZHtuV=;4>hys1McP1~yf|8E@l|23BZAjnA8Rb=3bv0#0@I;bW?|By*zR(i0XVxPRFO58-a63h z%WUo}f2EvENDQOOx#4AI21oirhW_9BA6}llKEIf`jbZWBX)tljZZ2~qUWpLL*m`@b z*eqUSY9N|cR-+2hzzW#tXP7|j7y4?iO`;cncyjUP?A3?!GoN-*aGgIqIqjc+cy)1h z`R4rMt*@xDF)J!|v9afZtO?6gO|SSM1)dP0e+}iH+J-BXMf{NRh%W;%BD`T#Y&p%J z&ItDdv&YK=M$Hifd+TxoNL%_1HOIz^sar}>vcvCFlz!yQb2?2s0lnu9+yHQGD%1v* znM(%pmfb1!>uDJ!AA1J}O#-aKVXNp2F^Mw{Z^s77oO?Ce`kC;)4X?FAxY)*jBuNbsaj)ppen@|`~S>G zLWk^@{D0lS680!nFij-lO3MFALl&Se4hJf|S5TJMv!#Rx!wRc?EB^;nvf9V(! z;QA7H*RL@b(vSV0ILlHap>^@0aNhKg((x+*?|c3>eHN~Nr6R1o^3Aiz|KEM~yt@7m zzdt(J`Ty_aas2-n5=Q&5hWlUB$n84*O-7i0#TBmvI-#Rq^ru|#Civqo6i+aT)qb`MYGGe%ByYJj=iV>kLB4@WnDY>Ewo-=e|mFlZt$_5 zt`6mA;(R%-%nraim9vF|z*;tnQrg{|VmW^ChbL!O=kH!!eYkq{(}(_>)4zPUeEIgz zvlm+{C<%+;g&&mW&~Ev)tZ~m4vZ*Q`Se12cG7OD2U|&VQMYh@0q?2)1}%%i}bNg$bNoD77(|=SgA5I^Me*IrB$1* zErCT8(u{$#@|<;a-`)ge=lGEjD{ozB*yGUpfS5alA%Z+A+9FcC`qTKYkNN-lBBUt`6-GV znViKaW-Qg2THWj#XqZu}+7LPIwD!=sn^&1oA+gSUfkly?Qm3KC0^Bszk&+Z-keO^j z6k&>RsssWjibw7_sbv)kAxlz5HHrncgpLf@JmGZ(Go7)+f1;yG-Vix%?V)#=k~nrV zV()8LOJIQ{_!@-HJXEI8El}ySwsT_JH_^A_!9^Yi=DgNtTtdFWrZJ0#YSAikMbjsX z98Er``u-8u@8rDbE!)!Eqw2m^w|9Jf{-o|TElhO7=(jorc7pk}SvV#ilg;-sIYg&d zXXZ+ctaP4hf0%@#y=UE%3hcmzP2w2AN0KM_#$4az@qOnR%5$sfbS@fLh!rA3LZeE% zBEL0CC#@-$`bcXtMUoh-fFy+K+y1I1U$Io+KtJOnD6_WILkY|US^iLgCRe|K6j!Eg z)rqV6_ZPUb7lC>Z0Rrose4p=z_jUVgIm*2PV_jf9fAv-0sx@_C1GDx|UzMe-t+(6w z7EW>2&Q&&@vEJ+q=X`^Qe@JYNInLt6MmFz)Y%sdr!s*8Q$fficpT_+kAK);swx?T- z|LmR|A0N)de;##r`@g$*YRW)8C639$qZUy;P`ro??^mkK-*wE*xU=1D$8F$S#szL0 zQ%9KSe|qJNsCDShgAK=zGa-Rru^1}7)TMDI$BdKTOtRWCl7DVjbxo@(1Ud6|GsNhG zK1+9sXR%?|0m3QKG4!H`-nXr1*pW)_+i4N$Z_Vnq&;0uj7hR|t0olL*H-oLgs){=e5~2Qwd21!*4LmNQClHzcOTV0 z+yg4+LZ4MfeIK>cTf^nRBzJ5;X$cH`P3bFL)*$I+I=rx-p&*KBtv$Uym>U5M8RHS5 zE^G3&q1ox}44QXYn$4@Py83#`8zuB_LZ4zbM*k~7PKd1MS^OY;p za?W4t1ABKgf2-qr8*5~S_SYf$nO?88LvGyvxt7Y?_5U0mb!YrPC&wqd{oh?Ye|7(l znROj8k$W9H&XlGsL4BwC0?&%uP#K}HY)DxpFbmlblS&{)rGc5iE>v-bJC5!X_q!G8 zjx|ajr|X1*xC^Se-4t`2fCR3aEq^tHejL@}3b@%1czo=YRw~6*J)>M%2K<^ubB2DV zs5e-yQYEQ{$-BRo?AR`({GmKGfBxSYL!6KiWgNEG#=`t>NA>(qCr3xS{7-lC?4e7n z)C#I^-7zz7ZW|qBBvwoTr8vCCBM_ZD`n$OIPmCds(I{pE6P-%vXdiKivA!`i#d7St z$24l~AqwV@8hVoIAhi5~!vFQOgWk}1iWt>36-p=tj$%Tg)9Re{KPce>f2}=q%94ap z^zO8eBEm(hGa~Xp|JR`3>I{D42l~JHi}C0{{U`q^CiI{LG{E6?mTH@(XnofaH)-p; z&H!JxzU#;&ZGHFuv>A^RmI-uz_DZxmDQEglxekc{ADD8S{k_$hh>%5auw!bwXZP%$ VNAUdr00030|5s_hRsduH0RS)M5Q_i+ diff --git a/charts/latest/csi-driver-nfs/templates/csi-nfs-node.yaml b/charts/latest/csi-driver-nfs/templates/csi-nfs-node.yaml index cb42d57e..89778b4b 100644 --- a/charts/latest/csi-driver-nfs/templates/csi-nfs-node.yaml +++ b/charts/latest/csi-driver-nfs/templates/csi-nfs-node.yaml @@ -61,6 +61,9 @@ spec: resources: {{- toYaml .Values.node.resources.livenessProbe | nindent 12 }} securityContext: readOnlyRootFilesystem: true + capabilities: + drop: + - ALL - name: node-driver-registrar {{- if hasPrefix "/" .Values.image.nodeDriverRegistrar.repository }} image: "{{ .Values.image.baseRepo }}{{ .Values.image.nodeDriverRegistrar.repository }}:{{ .Values.image.nodeDriverRegistrar.tag }}" @@ -93,11 +96,17 @@ spec: - name: registration-dir mountPath: /registration resources: {{- toYaml .Values.node.resources.nodeDriverRegistrar | nindent 12 }} + securityContext: + capabilities: + drop: + - ALL - name: nfs securityContext: privileged: true capabilities: add: ["SYS_ADMIN"] + drop: + - ALL allowPrivilegeEscalation: true readOnlyRootFilesystem: true {{- if hasPrefix "/" .Values.image.nfs.repository }} diff --git a/charts/v4.6.0/csi-driver-nfs-v4.6.0.tgz b/charts/v4.6.0/csi-driver-nfs-v4.6.0.tgz index 53cc4487789a83be466474c0d2ce145216600a3b..0d3e69242f5e37a46ff777a6936a203931c15374 100644 GIT binary patch delta 10187 zcmV;+Cp6gkRr*zsP7K=#Z@E$)$urTNv80h&JAac2=CU)xQTWaFo?frldwzVZ|J&>J zs{idBJU{&A;Q0B`@rxI|gBQJTdI!h7qvLN-Z;Lq8K8cW+f75H+S9NfY9qn7J}0r%znu)u(D@GobgD@PjTlEiB}3p8B#0Kp5%f`+q*~Jo zynp*1@$M-;mHj`(VFF^y3}DIrfAQ@2sJj1;db|C9Cy$>9$)ca}5JJ&MpFX!pgvZct zA%xHn3%G)q^$~|L5t7e3*MAZn!t`4@5~i7YIK)g4$@pxpaaWMBCnV!|3|%@BahQw= z&Aya)oUw-Vw>SyIOBND;)<W$n(xo=V&!VLNWykLR@k-g!S=AKabVt6)X-r2ZyW92W0^mxo~BA z!y8VD0+cc(o`RZ3Y~_W5j}kb=VWZVbSIYAlm7Im)rYqJGz^BBASH8~@DitO^2Y)P~ zk0eh3?V-O-fa-tmBij~X(^#Mz5{769_LD$M;2BFgXaEvPhDJCPfXGPwh;A^|KPCdy z-yE?U+EM*wLom{sjznQtp1^1io#O})8=-;4z@n?b6}o3!0S{Vc^>b)?2{(Y#;zR6L zr$j;5nuSs)T81$C#UDGqAUSJ_6o33n;1LmOi;F($wOS*pB@i2=bKhKI%>}?}lX9 zwLi96g;~##pP&7fCdrWaSoG0B3n4}Q62`N)vl#m53e3!?W(mEZZ?I70oPQyye>^eJ zE<;QU_&eCd1aK%PmyF9kI{fqVXNRg88~+Sb2>a++3!xjvuL&LN;hJ&DC~hGXP?1jE zNth@cejr@PzY#f6({m0Ip*@7Bn1pIZkx?xA=oCgc3FUs>SLGL~BlE!pJyo*^X{Uky z%iV{0w~shTtR)Q|jR+-jrhf&TA=Lqd;7i8sPcbKq6FEBxu@L8aX~axOh&APJ$p5`0TNv0Cq2@5O7>4F|yz?t`5WJm4CrjW^)gnXu*%BS}n;&gHEnag;wgcC3j_UI0a4MIYnlZqLoa9 z_Q(hcr88NR_ zM-wSy(eHN45-ec8=t?ZEg%V~XGEO*nF$*+BU_ya+6+BM^^I}e>SVC%o%(|_;J!2kU zCSf=*2=&qXUt4>~vozMWpDHK@<@UpNcvbvA5~4W75=8g>;_d4}M}Cye`&j1xJvx3- z@&7z~c6_w+|9{-YgWgV{>eVFzjX_GatpbQcHiJOzJ8ePcyY($Y{sjE%>en#~1QHU< zMC_wD1S~*VCH+R_!odLZJYi+?%QlYV zidssjkeE6Eq0gV&$n$Qn^e6W{%@6je-TxmZ5XQhoM}NjmUBOHC|H0u=HU9Jb`0)8| z|KG*)=~MSRG$m1AD+41Ef}F+hGE&pxPoR&!>wf;+YUyULKgLP}kQ30-4lym#k*{Nh zy4|Nwo-)`81=OY^(NWFX$jjd-bsu$1lu_@|&N~xvP%ST}z&Qy3{jRhU>Z9jJ`ky2k zB%=}eh=1B%4h(3Z|7}nUwF6sw!zK_$xhjU7c$ww~nEAI-lInR&AGKZF#raKyDIP=M z4QG|FQV&?&hgO65^a-WAusDgG+V8Reo9@lb?W-(~XFpT3(h-xcUaV46I~XtjCH?Yu zt=}qc-2P)5wLi2iEH#^Clr3E`gn;y9Bgy`bqkqud;&()7ptQ+DJ^copTFuJB-uKS< zI-Xko@AJSbMkpG@1Q+uEgX8DVk9uYPf7m;C{%ptp@8Yq0S@HFBw>qrqjlSS`KA(k-)s@df* zA%9^2yu>f3z0RL(3<<}?!*R^n6oN8)?W1;TOpb}1B*Tu+qJmwiHc2;~j$%Ado08q< z&z~8OXglS=sc7+Joq1JJW`!(g=u% zL5EProF#GY_NX>9VC{^V*)H4m)`=nHPk)Y=KNDdZ#9_j5IES5nCnk)`^Sl=iP3;Rp z$4Q8J^|Ka2!e=q`QDzAQErjffX(%4TL7-^>hnJjC3H(IC$USeRgq1TI5MMDgMdeCc z$^0fnAmfQBxD+H)nuBB<5VojwtUKl(g3(JXCwWuC+6D> z{0$c93FE2D=4s}$af~$vzhhu_lsQ0z1S$kiOV#9xcFMpLbV`8w%vMqj|?~%n5Fm*w%nSe^G6({2=MbV5k zB9uf)gar9bkJ+ysD4QGxd|r=knQ$b_wo$cZHsQ9ZVo22PU80O7)_*~l#tA~1 z1SBU|Dt<;riY+NEn~ii!MTXdy2@bZ@@LFsmXQ81d>)Aj17TL`z>?p1nI7lzv9#>8sEb5eO@p z$iL0Dt+uX#C^E6SilUzKBxkTuKHW?)_*`~aCbo|l&j?>K)r5mr%YTtg`UP-Fpb#I@ zid(8m7JjXa?OQc`Yt$MyfMKszuYkbLm|+H5F|ce{FGUG3(&M2iz3aRd;6mv-Nf;0=cuLo~4?~PuJ>g-o!xyYA5O&Fmg;ARoE`lH1>4K$G& zZ&gTgo|4gOGK`4KC|zi_eWL9OtsBOH32B{Cbb=!YPq2VnUw;5K)522|yV??@dVk## zsP`rE4?t)w!k=J{eFVGaSswsDzMV&dI2))%rMF00DJu|4?YA|Af`4nqQxfK@TVF8Q*S6z0CHG0>K9-ftZyqNX%5Z|FOkIwo_Oedz+DdsLdk(8WeV7)eA)s5UXN zt|Vi_8Giw40$OD&H>bixxHtSOG$vEXQeSlU6FdbJC7~p7m_s%QmpgDv2S)R+V&FO| zZzA#?<6^1sy^LX*eeK#7xZH0wE6Dgca`C84RKu7}W{nHUM53E?_OKAlCt9TD$Rc8S zXK{X4Tm1sO8zLuWnF^3oMD?nuInjwla-x)Zx_>H(nY1Nk31Pd4g&wrlUIMCDbqGLF zg!%QH4rS0z$GLA)yapxBV}wblA&-HAcJwGFsT9QydL6~mwQ^R+CT4|k7_u9CRzPM9 ztD;7sMXV@e3#DH@t2{ZB(>ac1%;g2@scBHq>y5UaaIR#9QZ9LvIZUv_J~Yn>qe?$e z)_*`Etfys`*_lI-H)=6fb)YzH525B&B)$(qjFJ#N8P1e7Ljr8o9xT^$(^Psfwo1t@ z^ArtXqzEe!ri(d;i~Y1#fn4lL9%7+5fdD>*z`hC+UVmJ%Y%KeZ0qZ1!S;-vpQ$2VBVXP#jWGIQ1avH)E z!UAE6C!_-%7g!wY40}WSS^K97Q~*8+K^ZDmxcT$^{C>A`PGhO@ow^bFCmcmkLUkM3DPNp}Qe9I*Tx8*4uA+ z0&Rz!bpk~ZV4Dh}21qD~YRF=dRGrVpDNaR}^)OG^3pY!J>N7A^dw+IGLWi5~jX=uC zK3%9{g2%$0;L<0XsF9k)oH`Gnwi?-o;Y@;9U56~}0|(g6bjWNUI3O-Xa_KH`D?oJ$ zq%P=SsKUg|YZuZ*@_H34y%b_9Izi+7LMLg62ekZdts`)z=REgdt1(i12sfF(i zAI-c_=?--r@z0aNpx-g`u)j!c>U{&K%PGR%OB=Y`REnWJC()9 zxM%i#RwtscIxaCe?=SQ86t!x?@}Y(S%P0>O5|6c z3b{*xyrUGzt)@P1FXeHYsg7S#isPeAZ5)EcCckmdc$tc72BZzrq`vHQqCP>Ar<4(a z0>xSUoV)L#SC?nS+%L1-DIg9$kf{=TH<(i$S2J_3Wj0r!V@8D)hdJZ_MlCRh_J8>Jih|Mz(8|N7|&3`J~Vh-UgWDGXV4{V+d_%-GJ zZ8_WTw(|SF;EcZJ`FmT)*4s*MUgJ!>$4YJwDW`5*8FX99musFK*E|<)E17Rw%5(d| zv)Z(`PiWb@b8uUt6YU2;QY7>C}(Anugn{Y3Lg#XV%rj)_${Xqy zOKKciYz^%>DjoV+FWFzPxcp)Ig{^^TFF#qk0Dod3_rh?_Ql7+(U zS}k=RmDDVe6V8%xIrY}%Da~Ee=DsF-p#zb^dT(4=3c8^qWktUsjGAj`%Hwsta*X@o z7UQz>l?8iZ%yFa^#!3+E@QxJSui8(dG-F|=xR6UR7v_1D_Tw)(5U-?_FtH5l+1FlY zDSwR9kkI*1KpLxa0EQxH%mGnG^E(292augnk%PM;U=CfnybBksMY*A})K}y(E_Y;^ z=WN7lDq!n54;mO9G+O~ptnDj((_CAxSle7w*RCpYS)k=9ABS~^ zgBh)NjcVMkA(ovCsg*jfbWw}S^3E#^JAZxL2@pV&s2XH4Xjgu`O7HbsPLSDMk#&Ta z-FPyWG;T*@Tj&{^U>by)ZOoOWb5LDfqQ|a+-a}1^$^~nAA&LrDox`%$y--fW$wjwb z%4?W;W*s9O8`HT$c&Rw9bXNd0Vukd`ygWF1I{^VjHpOE6&qUv>Rmiy5%v^KoTYvgR zQM=s2IhR#WwmcY}_iNR4ciGvulbvk{s7Z>phOn(X?M-ZvZCW5(w>uuDwXw?uPv`Wu zEsDF~;p3XeT=|v3P$z08d3V zxUh?h?m{~c&N_wFLj~cs4`j0kE^(y1ofHli(FuH<5=znTR}GE&q8<4 zDvFc?=2jeNE?l?dQd@T#R)27^IY4g7?dE{Ix+Crf#?v%pU3y6ws>JYo2i(jjF`xX4 z6UibhEf`m(^2y+A0Z0iP2@-&hi}}lCt+;JFG@CT2zxl~$+{AnW$LV+Dr&9xW<~56b zU9iGMUOHJgJ;Pj_fKohT9jZ!&WPLe^d7mh%^NXT7-zZv~`tI_PqJP!>qzerX$C%e= zB=$6xtl)K z>B+E?o8SrKxn=s)fpE<>MvTvu4^+J5ABm88r8QjeB-YYtMeV!&YA5OV|Ek^YE1Z8S ze^4ooq0bqlEk2N-U4Oj5w*1tbc~~y;+_a>gv>r-6&+b{x%1|y`Y?Nod-A0v?l_$K| z+%?_iy`AhDhLCr=v~o<5#?9H_x|?b1XR@{SuU5p?X8ZTQ{`&_Kg4qTC{(sm1D6aGGfBpCOA@i^Q z{jdL7xv+ORW5hB?gWR{mU|cvOQ(j>g#B9wg#DFQnVLZXM7REYkeY46j%PPavRi$+d zs8V{ z_>=wOA=#ml(0>|;54zxj^yW_&Z@w;9;MkH2YARj9sKURT?l704uz`cDTK8uVgWp+J zHnjK{LXM0Kx3ie#ML7X|YqMkQiE@`!MgqdYH&KmZ!Neh$Y81}%fa|Hc`vwVJaBDUH zW4+d=sXMTRZ3^g4a2&(x+KB`5rus^qvn_o}^!MuWtbdvcXP44xEiRSZdZgM5y1egi z&qk&*p4Y@AV3s2D-62AS1RN|-lPCfz35RTT4ev4@tU_4>taGw75uyJxxH#|r$Z9~E z^}@QGfIhkh5m33W`G={Dq$>~()SFI(DH(x~9oq+R@&54FI(0x1FMPyN9KwDYh|5&4 zbPo|>rhg-Ys2QHapt3W7VwM&kztO{0;!){|*n03nat(dd)(-F-%}awLuOfRphU+;>PIYbNPBQBM_1CrTn0Ku}xsClk?gNWVY)wHD*@ zd?`5&AJL&P(TPyA^wjQ1F{2WHR6Y4h+o+paT_Z3~@8+pe1e9_DVd$l{{|%n0Sx6Vo zmW9P!E~M71RN%$wMU#XYsseU;lQ0`717vVklUo})Jw89~pbM(M-%m5fBBeO}SKz)5 z^^gA{{^R_=?9`R_pTU`ydKE;e;|G6!(eru-UhlvGvDfSC|3kmLJ*l(O8wdh__x$)+ z|F_rcRsMT${NlxnZw`*1A05AV(K~q2`=)o;dv^5f8`RtWaOa;yNX)$#6t*wMH_X{@7i@uB|22?(o`!BaY%eD>UvM#8w>=5;LFsU zim>!2KkE+CeU0OI`8b5+Si;yQO&O-*{w8htb{5-j)BR*I$mVc`aX&W@)Ov#!uqc>H2;(XO8Hmz!-NTW4)TV7@oST?i_l)- z8Xbf~!4L%qbf6?s<_w}EQAlD5NGc=)Ds1jr%{*ic^8OXSCqBILwWV}krP}iA0xUzB zo>83~UEz_wF{sc}`b%l4uqqv??rM;o~KpotVEbLrh_XE>o{@tlHP~ylCEw6K1)`s&gH4 z!Z?w$Jk_CwjOH2^$;nUjD@G-Jl=+eg@RhZ3$=QgM6*t2zt`e&3?^BbMzHo?=g<$m7 z!VWF`xE6usvB9E_WVpAI?|H%#Z`qZeU~$P|L_VT+w_V=;9bb@t%lr$)YndRD@mY~m zS$@(-?ZW(;?}u2x6~qjE{yg_?5$yi5))J4==g)030il2u@!4LV#YxxffR9Dh-QV`6 zFAv*uKYD5*a1bbs_~jp-ygEI-dOa9Cbu)(G#H4>IB%MC}x1wY#BAveWbKb_5U5g{OjrxD)HkG z0nXKlv$o}hnc70Q36*mTq~(t}SEF#KU}&&cc!BhCv4jf2KCP8_Rnb|}PHe*py6AUA z?M6O0EF)aYbCC7HUC?lL#hA=1@D|R-q>qndJR~7;W`=Wr7FU1s(5s(+cCw6OrJvPU z#vuP<>nx)dwsZRyTW`)Xw$$fpEMv<&V>6Dhobfy)Hc*`LIySJ`jx9i5uwxgom<3Ek zJ@p)DAsg7v?heTmC?sl95IKL%SlMT1tCeW+fY~d=!oJ>gwv((E96bwkkX7V12G`HW>#!F&7V#QcLTG>%RNTT5d?edat%n^`huEc zW7*Pwt)wW~>31ngKXB$aou-3;&hrMv1aR#t)DD%oO9s-Oi%aU((-KNP_PgCW0aoI$ zWpqZEgb9bY6Aog+!k~|ymEJ3%_9MvZ7_?wRnT)Hvjg4e5LhZNeOU7lL&u3MksILjf z;VFc8HZX}neRNa~@>xlpy*?20PB+>K=CkyGa3?V@3^vC*h8=52}Hp4CGf?##zIIx41VM+iH(HT%}1i} zOCKp6zXb5U*RScbbpI$IZvWrKQ;7d#h!`Ef2H}5A zBexs)Hx*$9rBJ*Q=!A}c(XUd$8{v}NH zn@14$-$RU(u|EH&v@V}fYV=Ec)N%-D$k{be9T;VaEW$tnWTE)%?Pmh0`CT=Cbgb9n zK7z)&<9o?OaHFzOaNZ5-&Vt}OpZ6E*^VWp)ReHPi$RD|%n+1@nr5wgYNRC&EH>(eg zopP0awq;NFvJM=+YsV*>ddhF1_v+?d;I)H~)q-~@Jyqwbl4WcN=Tgo$_B`tw$y(`v zb&TcYKOs_xv^8M=%+JSxk>dosrb78L#MR9D3 zJLTZ{$E9Un45HX{Q)%EB`KB^qdm+sgJA5=@ye0B-7s0Jl8qu=wrP1ntzK+1HcJJ#WubNdamX4ser&&ozcL~9@Gs(uAE7)FMKemBF@y0LtzIBqoDPtF zH*MRQYg-S}tKMC<5NIcu8|fUgTuRN19}$5 z|I%dthKGQc#Q&ci9UoWX{|C=@@&CJdDhvfanyW90N%ST(ZjPnf%U1sW>dnt+L_$Df z!fphbup1;93iJ`;a-of!bXxjr=PN{_IMgLSMOGt|vk--h#kx{|Yq7cp8YR@~1Vqj{ ztvz&BtgB3@kXTo~z#=P8smst}0mU-Zfnu>_n3!ro6k&>RtT-trin;6+O3Nw~d=|xw zY7{eU2^|}-X~F9fX1ZdBMMt%~A#&2%L+>ypVOXq)y{|(po&^%&YY@8fP+meeL#5N& z&WUZ;Lf=jV7dZldn2UO!3kkUzo6am6sz<8ib8Eai_u${Z)HfcvRih z>-LVXFJ9EWx{Zl$82wh4z>YA#HXFy(W3u&LrU&Tc>eO7Rk>tU14UB!K&P47q6HRv&9MAS)7s6_AKf zecNBzVJlWj92g{g40+X-YAS)bAj_R9P#5Yqkiyckt-EmL`2Lbm_A*cpB0*r2lkbbe z@UCHhEl0W6V602rj;_zQ>V{m}!Mx+p^~p+Z%G>RH3#T|M=PK*YST{Svx!6$JJm{LkL;(b2(N{^#-G&i=cLr=kp0 zOX8R+JZckF6UDR4@ImR5#a73{iaXmiJ8lEtJTGwDm==VI{w`k;wGWHyVAJu#L`dLQ zEQHc1b!(i+3FG89Q>-@6c{iRhEyp(wtE5zu3f<7w`iYK9A*B-(#(K+;@kKVU! z=(Qk~-nZi{)8G1|ZKEmhp>8k++1^L(kO=+X8)XTpf0$`e|1!t$^miL{=!cj@EB9(r zkzIY24^Oyywk>?6k*+vSS3mBnV_hBE8MPmz{qCd6i+e!DTxH> zlvcohz}1z$(q#jZUS+^b$LR~AnAXP2>w?(`pwAc&2raTES09?4-p-^sx1}*&UH$!9 zaJUt??)T>EsM}z^mC9V6y`^gPBNOI29m{>4LJy(!h4X4cPYDT|X)rITHWxc6Tf+s@ zyi@wue-`Wi+X(Hl|s@vI&Hx%&Rqi3$Cru?dGqxzpO)1$(v? z>}hPp++D24Ei1PqBo_?B;|VoIEFX$>a?h5?>WXMX4Ya8x@=(l(-;7Ba$hoHUzS3d>@Qw_zx(!2MT$ zGZG3bbVtI;1aQ*$&6Y)OohaLep`Gphl-_gBm+wr=Ie)EA?A_7)tcJ#e-58l;y=fS$GiJK?&R4+mspV%)weE~l{dG|4HFXT z+tFj}U*j=|PMZCf-TNda5Qb^!f2mMHF>n+T3Y}Kxbnsyy8CRCt35y~|(YuoY3J4di&X~xq{$GQB zt26wKclH0KKTO75^*`yKVoJL?pdt3JlUUodqV-)z+{CT#IzxQj`mQ6Rxb@vS|I=n1 zCoB=@?DVy0bz;u+okATF0PdQ0oc*KKnF^l;(A_zocF*qFJ&)k|{{a91|Nr0ka(Mt; F0RWgi&Mp7| delta 10186 zcmV;*CpFmmRrytrP7KQlZ@E$)$urTNv8<6=JAcy&=CU)xQTWaFo?frlJ2^hq|Lyg9 z)&KSmP7c30I6gT#dVcuqS$Nvgl_#gi!R+r_U`C;W6}E z2q84Y0{g2iFy;BeLXpez6*7p_ci zc*99ifKsN!Q&97Wt-Mh1Q39tpY_wYGN_jq`lCv<}bj4Z%_>}nY()U?HrNYGLfPW?Q zk>m-WJ@mH;Q2p`*`aF2#y`Up!ajP|Lg9WE6`&I)f2TLb+e}Rr!VL$b9gIo~c=cw9`QU z+J@FnB+riT>!Y@&dd@=VTxUwL;vq_*V^ELLBuuG_CZ5+OzU0!Ab7 zWgoRK*ubAakc7})3BIMCSgrT1_u@6`hJ#=U_rcDbTbPF=BC?=eM1K%z{(Ri)y(X=c zZ~rp^QEcVMNgo~bqPfow)34kTyRNsxhP^q(a$RQ!4Ld7nW4AG$mS*pBY)k!mm&_o- zAAg}49K#>W{AvXzcXTHl!MQOi)PJ`WQm>xfBT*hTA<7!X&Is`!mwbk3-5T6l>s%J$ zRY^U!y2T;S54bwq%70)hv$=;(wctlnt(Ih?L8n(|LMwIJlDo1voPj3roFcPH(Ml#l zdt`)!(iyd$X>^@*9;<&VeFCUNmNW2PBlNSm!ff#5Le zqluKU=y$ti2^KJ4bR`zoLJ6}G87CaPm<5_5FrmP^3ZAEdc`+wbEFm>PX5H4_o-vOv zlQ0|@g!<_HudO}gSsH8GPZbn{a{FOByej@52~iwk38H)P=IyINM}Cye`&j1xJvx3~ z@&7z~_UvHi|9`oQ2fdv@)vHSc8iSN-TLln@YzBeaciMu?ck5e*{0aEi)vsd~2qYwy ziP%SR2v~r!O8Tu9LTWquGDM!Iwu^|d4=+A_LY*tn?K&6fujun}lD=}+!^njh>_yZ=8-AdG>Fj(?1sx`LPN|AWJ$YW(Nq_~>}I z|L@}Y^r`zDnv$rmm4OinLC#`$5vghMC(uXVbw7V@wRE#rA7iBf$O&j^hnN=W$k#DL z-R{#TPZ{il0&3Hd=%{9GZ6k*{ZA4N zlF^8KM1O5B2L?3I|2C+F+JUXTVG{_WTopr3yi9Wg%=}v^N%g#?kJ>Ko;`}DU6ptbB zhO^37sRyj?L#si2`h?P5Se(R8?RQy#P4{Nz_GK2wv!AJ1>4-^JFIK6k9gLU%l79KS z)^8OzZvU~3+8^2$mYPj6%9gGeLO^=5kz{|zQGe)e@jD_kP}=07o_+&Pt!8Cm?|Wx_ z9ZxO)_j%wIBNPo{f(!Zo!STt-QLoJZ4|@mCk9Pe3E*`s=6<<$xtHY}9SnF|Nn_2@j z`&w;l&+}Tvqyroi1&nG}eHwU~9<;6r4f^P`24*V)i32RL=G&AqS@gaXVi{wgnq3YP z5`PB3OZ;-$>-@>akZ?>q9LJnZAt%7R?cZae8tcdl`Cx} z^P3QXj3=VtQjkn(4w7*|*rL|4?wEfFMlZ3P^ijtcHy!=;TlR}cgQjMguBtyv9e=nP zG8O`+P8>%FBMLV;ZWJI8jG1eITj)B=x<^T~As5G>28e$Tug({7Ipc`MlJ1q@gNKWXucJvu) zCHIh6Flha6-71Bv9=G3$4gUeYRDarxiNPw%w)lCzM;1@O)CIj}0xGRmoQ$g!MKjij zP!c5(667~MX6yUo@Xv(slwK#ZfGcHDEq8$w3Jbo7hBdVh$Zu65uKvCZ^S70yarp_Y z#}fiHoH-iR&Hi*A)cm9u->!)AMLoJ@!jUZ7M%9+tgxjWyAyK<`i87X02Y+1}CkSN{ zkepzt_!$`~wxqOdHqtE>8Dd{1I1Fcn`ZO9TDII*l> z%eA&nCN_;@SS^(vqerMGNq^B}uGpW%*FaM;OlSZ+oD~^~6_z#@P(Q4q&@K()bpC}I zL13cy3jYGQRG;b0X#pjuFUK{&tcq}8#H&An2>0_4Eq!@;{_bc{`Wcm{uR>EqAgp8} z|2EsU+PVg!$i(U@ih9bEoWVx&Z`JUvQES`)hP_(70s=c@h8bwZz_MYz6eYk&kB6r8uJc-e3#IEMVW33S z6u6Q#J{wc=TLxRR1l6fFuVe+L)?+9RO=xsqZ|Mln5C_dw5?X*~b2QOwrKS)%VtKe@ zOk}D;`z(qQO61JM?SIKIk&KIO08j~4SZ&_rsy zRUyfFN=B>6Fd{OebfMYyskSS$ZWsq9q;*cwDUKjK#R6`90e{p?3r|h#YDQJun@Q}s zY>521vRY54JR5GlpeIBVQT5l#v{*`0lcVIEP|`!I|GBuRrrdEBb>@H~^i~rcflw1V ziK0a6YzI7&8GpxQw3Clx4o3Y@^xHc1+ts)-%Gz%W1FtC8PM`=~x**kR*j8c9Es+|i zh3U48v=~X&Gpj5b#Xy8eBBS~a711p~Rj9#afhL57Lx0QocwzMn1~ov3pgrYPYcgOU zl!liXE{cOY%s3a}pnBqQH?Ls;=~HW_tUxHW-_{Tcu74R%Ntmy0m0>z>)42wh>j(1- zSGPpgw5)+^)=e)Pqv6c19j>SXis14CFU8Jlz&2b=^U}=J+)GB`&1im2z05xBqxbFF zo!|a-$(OaHF!yDRfwqM6e(Nw1HKmbxL*LQVF`3KkOBWd3qtYCPE;bUvNFqu?wTX#! zB^eve2!Bu$&?;NGITa?tz2RS?F_}V^`l7p^;3=Re2_=cc9I`>U+<{vKEYM5IHf+RDhf!s#itLiB2q%6Q#`4Rewp$q%A2+2-`(0^q{r&5>UOWLjZ~* z%&+HkD1&x7&V8HWH7IEwBTPaKc?=Y^qen4Gr6_jLt0=92VS*j@p?OXjRr-Ol z27eM^JuS1$&K!cgQH!yv1I1~32sN)F@qG|tl!WNXaHgyo5@4(LV7Z=~rqYYCRZ4D| zr)UTxMOcY2UCcRL?5DK~BGETkt>lGNbbD;T@7Cmf4xK%W#YwdjGfSGeO0>M5a zGGpB$=iTl;CRlG72T;9<^HmRLW=f6gVt=86GXvQ{7jNFaaV( z!B}-HqH~IZ8O0Itk*NBV=f{G4EMULD#WSfkB4G%D(ob!l88VIoYx!d(C7^cN#eWAi zxOV2BkqM{P=+&aGU6xU82h8!+lna)b7+SX`Nl3dtoJ^37|RWt)?YRG$k5+sIVI4 zGl@eiKpBIE8_Z(8dU|4zr*ErX{~`01}fhi@;KS8Wea+b2Vmk z9VIHV%l4&}vMGl3R-Jl6HXf_3tb`TGyiU}v87347pn^y;g`)Q95J70UM@BkD(AkSsgX>&Ujmh+CKSbr~YJ>;1WOE^s4u%Lpikci=$LPu(bOL*3c$^~0t72#PB zK^ol;l6^=7xTMOevU9PdT%ceq(g14EG)Or)*9xL@si1U81i5b%x*JlXvj}r$z5SLa z(00gKCr}gtwy7X$fP{jmhAb9I)%k3k;#6c=5A%e*aI;jXJ_A#=XMdL@bhzo>2&9bc z(}gM~cr4rrE`73z8mURlsq+A8tC4*e&LoJ{b;!a#aDd%Rhs^eY1L9I7m+k_$0#v6! z>Vgi2Doo70b|GCPuUEm+OChGB6ErT~=p+phVZAWg?__pHHGijqD$%>7pwebLweY>+ zqnQ^f-JveVw9MSr1AkbwFJmkvaN0-z_sM_$@ptd(U!FX9-}CmQ%|XGj0zyQhD7 z`g{7vAD=#b^5p$buYY`d`RZ5l^!N8PiLT9Gzdv~ouYO$-$kV5P`NJG4AH70)r?U7M z_sqV}>O>S)$0a7`{bin>qE_u!M(-}bw{~Ljmt6p1;oJzGF4*l26L+8YG&@W%;pMo%&4&9Fb7@`-4*ca zbTfsTsh~>b*MC`R0!3JFfply|Jj>k?M*n8u^ijL!$VWE?GoS03WBtE%wXk{!m5+`2 zdw&V1Ur?Iqb`nc>sigI(q+3cJ-KC4Jk}i4&38D`xCG<;60BxG;*)XZIVftp{M9s&W zlDUQC%jRj8jT0(wF?I4@@)etACvGDbv3cfU<2=KrS$~CF%ptsmjKQY)fz7i4zoy*3 zEob}PR({_XoYB`je{T!fdRxiOYn+MqSjp`n<Tu!Mn61o%(TC({MXA4SnNey!Fb4d4^0~c|+Y| zNsU8`t)V?fr9(gKCHo5&mp@Fuur(0v;nrrJ7YnzMe+EpbkYn0kQPSAil-2{OAYvW^h5 z8&Bqv#_ecq3q4~KOoLFfjk&UP4yvn5^w?F(v|FBQj??h1fLtdJg=mj_30Cm^86rdW*sndqCf3Kt->73rS zMR6BAd>yM{TXw>&SO(j$1-=OF|3T~fyJHTIM5llBTKwwqm|XeUpE zExTE6i@U^cjdqeTu%ec-Fq?FBPw_eyyFS9d1+%^O=>F;8Je4ge71=Ztonq@y)^gsy z?%{AfmWD2t1!V`cu3b(i&(I!1$mm!!DUwhh)Y=^9Rg&PVuJtr0-jda7Lw~x0k-iOf z!HCuvj5$`z2n^7+y;=1h$?PNzL7Vpmo;Hjtv z7j|*cU1;Y4nt@AByO$2T=bOpor7rXvRVHisaTT|dpgt3Rkqc~Y9LwEcE6Aq&S?KOr zMUisA+=>Iuh3l4FYU@tJ3V%*E2gohC-5iitcf|d`c$$W+OD`!yl^CAyfSdUw=97PM zB3Xo`1>?$8J{_Dd04aeZK?3k`F@L$N6}N4NW|Ic>H$VA|o0w1FIQ?$?bZX$vyk@bl z3s$(uOD7AbXPAo

N@)LshAetS<*K?-NCJeo<8C8%2v#-(5aZw12vvbfMwl81wp! z#Gb~oHM$%ivr-YbfL<1@%jpmO2=X#a#)K-R^2t+^VLoz}oYvbhu&3JV*Jr`JZd_<2 zJsDPV6Fgx&w@jZp5U$zAi1E4dfr^*>BM~yMw1x|w#9BJ7sC~Cz?Ia!lU$xtPh4WA4 z4=Tkm^f`mH#Rn3!i+>l`mYVGS!I~Is!>!+|p~K;fqg zf3jaZBs)|RT7LuaK^I(*-u&s}&DZ4$99wchO{FUsRrr_F9p+LLHgJ$t>;4R4@H@-O zh87<~$dQrZb{4a|C?}wAZFY=3QSP$JNI*FFCaO^^m^cJejly{za6MIb-yoq2Zms5j ztk?Q9bqBVvO#$5rj$>F|J8?kXR9~rcwxv&r{$5_5SASFC>{2?d#if#4k5qd>m-qec z`N(v}^O~3h%u-~&J4C3EfP)2U5=B5I;gGGa;a$dqRVZtKbxxKhBJ_U-Z!Wq&vKo+P zy|6APppWiB1XS*8{$VO3=?a7c^`;YHN=6`L$MykSyg&T4P90Fh3m3_%|YKG@9sO$`&n5D(XZ}f1LcvN~KwjR8YTtgqVwF5jy^OK_f&#sF@)bqqt z8*HmaZG&9q9xV!z97*Fm;AA`o_ZO11-%m5fBBeO}SKz)5 z^^gA{{^R1m?9`R_pTU`ydKE;e;|G6!-t&3~UhlvGvDfSC|3kmLJ*~6S8wdh_cXE8J z|J&>JD*rt=e*XOVHwVWjM@P>OpPd|?eA7GZJv%=72KBZ--1#RF67z3*jr*z&?vXs6 z=h;h9&L9riECMPkH>t#;J3S~}jbgG!KYc=-cP9Oh_%b!8 zA}syM&$@$jU*kAlJ`N!{mN2$SQ--Oyze!uZoyGRsbU#@PvN>E~+$RRY8iKl!nWPis|SpRi~=AUvvDgVlTm@pwPK;AHaer*zV5!x$U zql0iL7@`1y4wOX7oI!LX3P~&hNrhxUh0R^7nTM=F-oN7a#D|x@wv;ZaR9k*sfMqDt zGpduLD?HLS1{Hcre<{sfWs>Hmhq3?$B@)##q~yP3qK`sCll+{1WnGKJpU^k-H5L+h zfpkRiX1 zFizwwPj#pvqq&Afa`F@Xictw4Wxiwrd}VE1ayBAm#m#VwtAr~1`^+SzFC3y|AsD^2 zutN(!u0>#ZY_O;!8Sbs*d!F#bTXv-tqR=;hBpJ6T4t($8uv zV~~Hbb(T>J+qr#GTk3N)ma%1?u^C5L&UhXY8z|0r9UIte#}*(j*s+UP%mOB& zo_Y?nkPU2ScZXyO6ogP(!4Ov2-02sW>Vxg>?FFFcw^_OIhC6#(J+88^%Nw|k+D%Kn z8rcRr5_1iICQ`;;ddBKS$b1|syQ}Y3Z_AiZ0EcpN$+#>dZ6Hry9Imzb%CI*P!5i<7 z4K{QM+eadS=}4@yG3iKbcRS7joZk|v$%b2R6X?}#ws4hVPNpP;ap~OfDl3BneIdi( z?}HC7&t9Kj%-zPYeCafpFl0BEDH5-Qk3(#uy=82FmhUk&5p_GOR)wfx1#J8?Od)g& zePwHt;Kd)FT)a7Z_2K-?rCnrP=MPU#2j?GNU7TIMIlp-8YHEDUii(Ta*mFVFh2{86 z?|3f;9uc7(<&LinSIC>VA*C5#24X;X&8*mVnm?Tp?gnO$mwSwwBMA1^myU&DUME9Eb%vC?3V`!7 z&SE^aOsV~S@xVrv{5Lj}D<7}A{hS@hC~j_q(~+o=`}SV&d9PXR0w{8vKUop4xf;e@ zc%~ma{X$Z84_u7xNQUYQ8-FXI>IIVz(6k>-C=XdUNr=-r+9(cNdR; z=Xs@Y-&`>g8y!3yoZC7_3j={=fu4o!u$0)JTxEA$rO|e?&weH&@MnIgFR02&hFvO@ zguPIv5{DQ8)+a-N;$aBqG$hpCab>r#hhD`Kh=A)$;EQpMg^+$2{K#1n8wstOk3`{@ zK2kb<3E+LNU(;vl{#Po(#yj6U%i{lky=N!o{eSTM@cAzOef)cg719ZU#!nt6Vg}d?bai|4?lP2rDg%7N+pLe5t8GTqQ&Y% zV`W^WpKaNXy{rR==h^Yerhe{Q=)Jo27WmxYW3^lzO3%c(YFrr$z`2z3jXlqLHnLVa z+#F*$dGUuQXIJO%UR`~-diCRfhryfEpFUi^eEZk=i>(!uhz0P%4N7z9V*8D}anF{r zsWKl}mvuFnhFTx6>qECkw%*mGi*sdWo%yqF7^c^se);~@2km~oc=`I(ojIUah=DjZ z#hvos{NvIxF9uO;x+yPrjJ%ek7h{HbclQz}TRHx794bGY>T3WZ@4);{BVMnO~(Df z>Pxeg`a;X}u_k1{cpyuEh}&SSRGGQ;LCd$&x?NYcz%mM{$DpwD3j653qZPYn+t0%I zUz+US@DT8l`2Vw`_(soyFrqnKp!D47uv{4r=`DkzCt95LtXMyWHmB53sJ~etShyD7OQKZQ9`Y1L*%T} z+C%5Xy2^wKiFM@*EVA;Hx(qEAP%J|oC`mzviK!Mu5vB;oN+58ec;sH8w5&qGXHm?k zMlr*d(6IrV7Q8NDrYm+>bX3b5A}6gq^bS)JhQ*55`#RL(Ss)R<2B9ktCB>`dbEmM*7fnSK$8oqzJH_`cPjkQU$v)&N7Y@u zZtwW|;zix7+nDHv(QkDL>Ngh1cFbPF_&w9rt*j^Df z2}1-QNm}3=bA6M?^UgDr)>hNyTr@BrD?~iT@E-qfWX%=^iya>BDY0KH z2o^7QvN<<@WR2797EU+bM=hnt_|)2ee29I|`krnz|Fd^|baXJ6|M{%9v;XemsVD>0 zk~pRckJ?1lMDZ*$d{FvivDLA#;?8!>j@!UD&kNi(rUhZ5zspxd?Ze_a*mV3b5fb-(r3-x@AmQ{1rz zr4=xLaCN1xblHHUR~hiqar%NNrnT|%x?nZ}=rhIxLW``))rV%Mw=-$ZZE1{GSAV}2 z9Bu`!`@Ok3>Nc2fr81XiZ>d`S$b`90$8uk%&_if_;k=sAQ$oTfOw3EF&BYGN)^Ncz z@09-apT+wBb^<`l;y=%yA64T&&yNpw`u|;jJZr~)uD*YHYC=D0Y{KDD?zHxH!Jcge zdm39YcNgn%%gQYY$pypkctTAP%ZFl}+_NRJx+2<818r)FJQTAdAN6tr#2TCTVTx?O z!v|r2)eU#P&(-DCS<3Mt$lfZ(teM`H&76Y!<_@fdg^X|=C(Wjo!m=3SZ5RqGaR1eR zjD*4p-H~uI0h}~`vt^N6C(5>AXlHvrrT3ik z=rQ)M@fbuW&Hl^oeG(H0Lo^QA&}1in={x&5gjnC07h^do{Elg$%q%d66ws4cCn2O4 zRQ<1~9rT8VGsLL=QlW%m;3y;%I<3yx;KM*Nt}L}v7DbGrcc%js5H4DsF_B&UzXttQ zXZRcM>i${G)iCf=whWNVmT}MW7>%0Fsr_DG{ zSR&B**(=fN#GL6ng*qev+%@eu`$wxY6+R1~yK_G6p53#19>Mef0{{U3{}6n78~|Ja E014W#fdBvi diff --git a/charts/v4.6.0/csi-driver-nfs/templates/csi-nfs-node.yaml b/charts/v4.6.0/csi-driver-nfs/templates/csi-nfs-node.yaml index cb42d57e..89778b4b 100644 --- a/charts/v4.6.0/csi-driver-nfs/templates/csi-nfs-node.yaml +++ b/charts/v4.6.0/csi-driver-nfs/templates/csi-nfs-node.yaml @@ -61,6 +61,9 @@ spec: resources: {{- toYaml .Values.node.resources.livenessProbe | nindent 12 }} securityContext: readOnlyRootFilesystem: true + capabilities: + drop: + - ALL - name: node-driver-registrar {{- if hasPrefix "/" .Values.image.nodeDriverRegistrar.repository }} image: "{{ .Values.image.baseRepo }}{{ .Values.image.nodeDriverRegistrar.repository }}:{{ .Values.image.nodeDriverRegistrar.tag }}" @@ -93,11 +96,17 @@ spec: - name: registration-dir mountPath: /registration resources: {{- toYaml .Values.node.resources.nodeDriverRegistrar | nindent 12 }} + securityContext: + capabilities: + drop: + - ALL - name: nfs securityContext: privileged: true capabilities: add: ["SYS_ADMIN"] + drop: + - ALL allowPrivilegeEscalation: true readOnlyRootFilesystem: true {{- if hasPrefix "/" .Values.image.nfs.repository }} diff --git a/charts/v4.7.0/csi-driver-nfs-v4.7.0.tgz b/charts/v4.7.0/csi-driver-nfs-v4.7.0.tgz index 489185106fab83e886fc56bb1287246d1ba06424..9aec45ebcc77c0a441bdecdfa5fc4e1ce9cfc9fc 100644 GIT binary patch delta 11218 zcmV;@D=pNsShrY^JW=g(+c>i5{MJ+8%6n>(SyPrjlANPksjZBinf2X?Qs)lpCspOye-5b3Uf zNT1?VjG2_{A|grvHAJ3wjyuQ8Arg}bP!QshvjMD*M_xTu)oWNBbq7RT$(SW5t(kPu#lAX(@S z^_wGhLp!Ryq66$p&>&;?Eau_5YP3@o||oYOqx3V75qvtL5fQ@9447Jnb$ zus$RTy4Ea|I?*zO(Q{vRLP1K_lqmR@z!M_W5*IzxZMBAgWybaD0E!1O{LufAvn^hpxbkj4GDVxAYAbiku51^~+NO z?J~yH!QaCs#(-lvzGPhX(9wT9e|DsbvC&U3fw+gBwGg^t{F=~_?yl*VOwtxY5f%B+ zoyM8M;RnKn{40@TH9Qv}5!yp|f=R4K6dA>$ht6P#vsmso)vA6_4VemW>3^9TMaUbC z^e=xK=G#8vAhDJ-csL}K$f*`^hE)3yLns-yuToAJCvtikV<9f|)QG8&kOZMYCkQ!_ zB*bwGA<1Ik*i5}1#sFQzw1?W7>N$&{b6qIKijO3ElG>IxuvFDnO}AfvBtnY(0}O`{ z${uQ8uzom(D2t)J6nslPsehX9TW=-Us2L7|Wjq8sa(-bRlY~e|yGS6>{Q0EYeM4F~ z-~LAi!Yvi1Sq~j{lbLEqc`d)hZffml!`8fFxv8w0;e4rFpK3 z@Vca)nO(QbvmLH?x7OL(Xzrm?E%?zyt0hHm(CO8g&`O=&$z53-&Oj4*Ns+~%XeAS& zJu*Z>>5N*>G`dbcj`iP4p8zTmrcwQi8a0hVT{ATrDUoIp_R;we$uUe3jyd3Hia;$2 zL@2Vu+-bG;_Rtj!fqw%HLFtE#f>I0<#sLYX_ef#YMx`sF8>J>IHJi{8(%V*{KyVoL z&{)b;^bQWH5-eh&IFMLe3nk2kWR!6TQWj~7z=Q%nQ1Ai`EJ!(-UC~$%rg9*&`7JtYV&iRBoGm73%K3OM>J4#lNtsp zf1Mof?0`kXfrP{|6Z=xZxc)zkAx?pde~wHybp-$Fq3Eb$Z4{JWlw?I6<7L)swDXJcIH{6vC%`$00R67CQW~P?$NEo_^t0iRe|$vk zpacdq(tjJ&V(q}t3dR`Xq*TR`7cW!X05g9pt*e>0^ibQ!UA%P?Oz{Y!U@)!K$}ONx z6|EZc=@ZIVp*x73#(IT=Rkvow_Eq7>wbj(9bj0{TPgbRqT`+oy<+z7B zW^>cgwcoLyMeZ~=({xpTEw$rrz*r2JdT|^gj40fcxKV&eR9&R|NREj>)>0*0Ev)oI ztNt0&(tqVIr)bDof^Nnn9GkiY_!}(H6UK9s-P6Km=jm$-VaLGisOIQDg55)GFpdF{jh|Z(S;fs~*4Ik`4Y2p;X$8@xiN|ty{fZ zBl8Df;)C8W0JTy}4#riEqUmcwC`qye3G$onvwyYya`;C^cuue5X~dPXsHWQ?1!uzN z(XgiWKKZRq#P#=!Fn?E@8lRomTD&1bgQ=%b)96oTLCp@j`*lf_FPhP<5{_iWGOCv> z2HX}^42jycOVnnGb0&_$uX9SpOK+rOG?XTLtRplAr57R<9O->r|5|m#?qpS z41bs$*HG}8EhQv;oU#~JQh1fKX0X0>+j{%{9B(BFqu|J8gf#zhG(Fk}v zbs32jmev>4+$~pVS2}Sz`@!@eGSM3fe}4yDuFrI4w15iKSEB}CRz)~8;x!yYf_tTl zp1!&~|K+$}d5x;WSEDH+5LPmge_JeDy}JgY$i(U@ih8PpT);-gR%z$F34Kd2SAT$Oa**829X>b~978Z&@luU4;s$c~s{23j$&Y=2l! zMFlX@{h>L%>$oQ1Lg_kL94S#X0j^|C$VQa>R>0OQK{cwkSF#3E>oF9^#x=gLmvn-s zh=b-T8Fk><7+v&6sVRgGS?TT?5t*ydAxn~s5;-+-8)T44#>GJd6Nq(S8|LAdNC;)d z;XvuX8g*(k_9WUXOeo)0aGhC(=6}%&7;_v-;A-uK!YtTg`4&REHh*S=spSyf zf$%t9Lq-(Jq%#8)p?8|-2*jGuNs?qzN4wymEI1~kow6S@Fq*rfzc#7gzQVO$Hr91I zUQ@2UKoPq1L2A^nt-@OFM1LBfI>T)lsT)b4M^^1<6ax_=ON{C}P((KeRiQdlIGPX^ z9{sK0ttAKwHY|yUB=wP#RvbaZw!HvyJl+4r(SIfAIzekUx#vlqCqIv2FvQ z;D-KGg!%HjGE8UpbiU4&`oZkPHBFJ-S~kEn^QNb*2w70#s;UYof`2OyJh_cGfZcF1 z%||m*Gang+x5L>v4T}9?54~?UuKf0|3u-o!!c5JE4cY?E`>kh-s40!iZuC7xJ%hPu zf9V6GTU46Ez{f^n7)nG*tQIk`rX;h6GXm5&w5q$@k_t27U+}Nch)kdeebUX3@dQwk z#ge3P3E3cAZNM)b7=JBmrNFgU-gx9Y#>7(Ndj-QX>)N+0aJAifRG6`Il;TlsQ4M1@ zkySn#D65#kVim48+sIzRElB; zy-rf;n>njv6Enj&j@gY3zmf&Rs;Nl_!sKI>WKdc6p9^Y6>`dz0uY) z&XufC$|X+{TjenWty~Lq%AbFip%DTx``w1#-UmWf7;IUwa9L?d@ne zq^^aH2)~NvHLaZwJupkIMj+ZpL>8=Dl)T&D#u)1*;{mD{aXIVp)C{RHUCdQ*rXV}$ z;_bWFKDPaiAv|FuLMao1sO^G)Fyll{5fLH-v5&%eB!BJ2bTuOPleGu%wh0}rOzbPL ztg1h40fDsZek42*TdB08rino^vQ5Q(}?dA2Vo!~*smE?!8rA&Fy% zlzwX4ERgXWSS%kaDFLdN1*O-r zH>Vey;(sY^Ok?{eB4m!Kn2Tz@TQIQ@NMvcsxLOlZs|vF$#Tc6mTk!xc_)IZ#+6K*L zosb#5ruJNB^)V99*m(UEH;4FvbH*1?y)KiJdyIwR1Uha!vY(=iyE9hwW#7|b9Yip# zY{$Y}4<19DDoH6B%2K7A#xQ}{Ax!avbfDt{i+@vn!otvgQU0j{6+uWMP^(j$r1j~7 z(h4gH%>d09Z#6ApqAAhnL(Xhe&!i5p0JRx3++dpO+0z5#-Fhf`F~$n-+A}164Uj5g z<(e00#-g;j2B0hqGcNLJs4nWlob+?b3c+O8l$pJzZE2yf$AH%`LnR6jmo{=L{2y z1W-XFnSiT(dPERfY>|;(5i~Pka=!R6(|Uu2J8XWV!eZXB5bHUnhcfbE0f#9IIx5%_ zff&9a^n_;kglDs;oU;^`5uT0+(&&DW?0-Whz$aCfm7Vh?ra{Wfxt0)} z3k9W5BFKHC(A|&*okf_O1?_h{gSJP`dV!(@unh%K9V8S)-DNRPs?J8^xItB}y^7QGS{xE~e$G{2iR69P#1GDanJR#2P_{8L_y)4i})M~6{^lk^f-6y(lvO(>H zabZ?7N7i?tk^U&buQDX^s}F_Tg+Sg>2;^2nAGa6sxXn<%y)mV!rj;iAigi{3$i=)(#L z{n7$JHx2dNFsO6G@Xd__H6L$C<`#l4HxIMiIH2+tLnrSgUUAdt#BIbPZXS8Kah&0% zQH5KKA-si%!A;`>H;)GVnqvR99PM{o@qJ%#MBnD|ds~Rs+e&QS#($A`kCogWQcT^p zBIvdhFSmJg+~%=xTZw$zQk>ft9@Vy$7`DwL);5n%+d?$jHe$~ncBI)RF=e~xv4?TW6rWsHT2eJDSs_Z)8@V|d!YxB!dh>9 zQ3|@CCuBu`A&i=f8mj&Eee(4C;U?p<<5f6&%9}ro1i>Ebh--e;b`qr-3p2z{EX9nQ z=T+WLxZps%l2*d_GOT4^Tb-paMnghpT>-hT&I1@+(3k_FjFxu$sR8i@QRb2(h^FWF~0b_QsabBR0k~ihniRm`O|Lp}M9(k6i}6hZ+*) zUa934cNMNCgJq+6p&Eu$if%oX*DwvtJSI3bTjv_#<>I*3oC9dcobbppJve$d1_3Uc zVk!Pdrf*hrA}-e3u6gw>{lV2Pw{Xs7*^?~~M(6!nb=_Tb_U%Mx8v@!SL|a4HR-E=a zdy#GKK!3Kr?|7KIja@8wKBl+5qqqwmzRIp)Tl<7t*%@qOFYrZZ{|{Q<-yL&!Bs%@0 z*W#D=$Lu^XkHZ6F`1~EXU>s9ZqZ7uIS>%SXC^!3I%D)!4UkaQybih2iGz+z}_907B zC3!1O^Ac@}v{Qc$TC1I?S3@|m>}K&^+$Vk;w11O=fw@}B+-TC}Eyb(s*!2wTR;^QiQ zBSCW{{5%ubOg|Qz!IqFsg}nh)14nbcMth9!(_9*|oyyLlilZ;1PW z@jMJ!r(RMURbqI)2X0}Lm<|5LnPdr;7JrN{Qu(xhJ_n=(js%Gy#BTg@RV!}W2F)Uk zns0sz88<$k$aDJL*y&Wqy>ZQAUni{ak(Uk@&d)Hr15oj2tU^_}kZeu|F>4b=O?FY# zWE(~EL*IQiQnb9CbneE()92M0i9L;Fb98w?7O5hzgI?jSE9npY2=X${MuaM*@_)%w z6Jb8|rkvKxF|w!Ho9AcFxUQXOBtIEeF%vvtyxf^S^&s4^j1l8A=>run`Fkd0nQ09> zmc&Lnt*L#tpY0^?|DUzleTnl=)e5!b82X$+Ug86Z+U^Cm)u-Xi!(x%=rzQ2|`B2Jn z_K#|jhH~y?qcZaCHnNl~J>YI}-+yqM?{=^o7(&_X!pt!)jhnNBuJf;d{`dDW3$Oq6&;MCEv3E6M#4<;N+_%DD?3|IQ&ae++F@NVZV!#yP zI2~h~3u6_wzFy{-MVVomveJ4w)tILiT@*Ps4F@j70HLG(rlvhD*b}a~j;>D==RR_+ zoJC|f1f7{ffKIz-RB|I(un(lj!tuU)NOqtkv<4D_PPib0+0(`A&&w5fmgJnAN>?zf z@h`7A%%>= zm^c8Fjlz2#a5YtT-yoqAZY^hjY}WcTbw@U_jf3tOrztG2op>OxtFJT}+w!MEf3Ggj z>!EOVD!seKg_2wMR9it8xBcz;&@{%&oR|d6R1~&5M5vH}qd964MSnmg;ZV%3;a$dp z<)k&hIwngK5&A#1n zyg&N2NgYtc3moVQJ_dOuql@gwEQ{P)Bmj97cIb+?NCM9-Da;;JK|uiPUWtJ<>lD7{XCSZ zR=1`Z6+E_KF@F((5*$I9g6Eb=Sq-R8FBeV&8`l$H8mYfc%F}SV)(B=~spb3g`PtnN zct+M*tBqUUreuH(kz~jhO@^A%2L`ihxyQA0Pge^!D}P`4J)@`nbJvjXLwClszq@O6 zr5tR9VWh$QUCqW;wUL0$=2W=vOEU=inUarQ*+!Xwkbmi9jS3>rkVPgrDW-@}`TV4V z-cntEKaUtol;ZSXk^ef>KmMEew~PO>LswmY24`AnRS>0)AO6RSZqPjpx`!T!-EL3+ z5B>b^v^mS1#^`mOR5b!|H;sON7_rU|^cwL`p8^ClLc!w9)N$yU$Nf^uOJ1xAyPh$%_{+zBxR3eth!cMfdRe;Wyo*?z7`(-+!R) z_Paa#WI|&8O?TtA>YaNePY?w5Qj{}DV>V5I%GymTsW_M%R<1@dQKO$eq0TQR{LLW} zZKwYHx#b%6bkQq_0SoAqCcMv|Tc185Lc=(V0JZ5*bYeV!ShP_G{jN>dRH7qQE)TWh zkj5m$qN(-#yTL#}457@oQwf&g_fv^Ii)rd63O~|mQK@vQI%Pfxj5OR>BgkJxmv6Jj?IEkBU7ij)_2`J}Z z#fvc$@&e=yEJDs1dp!+$sw1l;(5^23 zPAJG_Swrz!CWvHw>T)W}PkN~BjIXIbzyhuyW$5$gnQ!x8_ZF3wcz=XGe{P!rhy^T( z&-U7M2VJuRJ`#0ve><4GJZjIp4Aey6C{h~n%RfAMb#`|3y5E25DHsEefCrlX38RZk zlvkR*Y!bj8An;Lg92ou^ys1McP1~ zygXWI@l|23BY%R|ULR{L=nA%vL;};HSY~0;q1f(noB=qyBvg?#m)<(i>&tBJETx=G zNDQOOx#4AI21oirhW_9BA6}ikIlq{>jbZWBX)tljZZ2~qUW*XN*m`@b*eqUSY9N|c zR-+2hzzW#tCzwF&7y4?iO`?~7cyjUf?DdE9GoN-*aDSaYJUQ*3e|UXycKP=F;+?Ok zu`w$ucCoSNf~*P4Q%$evcvCFlz!mMb2?2s0lnu9+yHQGD%1v*nM(%pmfb1! z>uDJ!AAfrX2TcO3!eOiE3^9o_4)4Ys#F)iV4?U}VS3>Pako7)j!G;PMSNob8$zX)q zZ}pFi%O;!8vO-Z`6OQ9Ei1D;<0)u+!xa#DylDhbOSpA#=CoJ+;UMv|?7KxIAo28@E z&FgHSsLqh`fdb&I##xF-mMOKrcMojT$$#x_a(}JzvdhogfK1ZOH{oGLWk^@{D0l< zvu?NU|2uhcvh)Al#S;WU#oafPjKq2ePy6RK&(T~*U{#^@0aNhKg((x+*?|c3>eHN~Nr6R1o^3Aiz|9|}aS#|v%zBqc(-L3z- zcpU#fhJ?{Rtl|FGG;+I+f0GfWUvb4Nfqzcu=x6;Y7rY7n_%p>5Ok%a5XVI*F&qcoV z)42fGi65v9#BF*1Yt1|YzyBU$oQ(AOKc#hrj8dat+M|{OKm*RMfojJn%cKhf36M_m z+1rlsZgleK?JE!}k)2;74UG=e!@(ojJjGHt#Ri=B)|otF(6Oo#pF&8Tf6xZ( zi&t-6-+5b-G7_b?0*Q=o+z48 z>Wt}3$Y}inX?Hk4h6j1s&P>^6kU{LRH+ zJ>PP326_gkd-J_+((eyeX`3$97FwhfZbJ6+JFd zCyKf3IjLn83L#5UMm35BwuFuh*gWBN1v8zo!=j@~-Vix%?V(>VC2{O##NOAgmcRl@ z@HGgXd8kaGTcFZuZRf_5CBR z-^qE=TehXSN7a3;Zh!Ci`us`VYg(A-hS6_z3hV^)YqM}nJ|>&*Wpap4ug=Vs8d>Q) z*Dwi1d(XNj71)6bo5V4Kk0ejsu^-&1G9!hUzMfIl(*aX7EW>2&Q&&@ zvEJ+q=X^_ne@JYNIgWwF)+z6TY_L|{f}7z!aw$E=r*Z$s2RIC@(dJg;Kf5Q#$A>fV zpC?DV{oh?YHGgHGo)X7o;ZcjI9w=T!hW9H~=I=V@X588Cw&OPNE#m^Wjj1C{biHy$ z)H-zM!G`0e4uqW5&sECRuG6$v?NNx~5eXf}DA~8DexopQSs+v)Hif z0O6GA7<$n|@7vb(>PV&c?X-yWxAtgTXaano3yeUv_kU44CPM#vqjo~-4>K(4FLMk} z*IT2(FvcWVx>Xa3>}#ufc*57REfFe>bjg1D+VNi<>ub=CsI8EJQDk~=n_v;+peru3CAYmoFZ9bVYaP!Pqm)}CG;%#8qsjPZz2mo@p?(CqYf z2F<%H&41?A*WRy=!Oh{i-PU&C$nXmtE#{sm+|MTL-aozv(;`n%{|KG*4vj6Am`&XyN^^^N1 zJQn3nYj5Z5*_N|s<6X?%`Fi}aa!W#TPB#LcQGb)f@}cZb?s+G&ydt`x2D<4^M`Q{FG3v(IaDn^=h zcM6MqjJL5-Sc3a6w@Gkj=#GSwap2_sn=OmnCQ-JHjdrp2b9yg1U%4_Z=lr!kuy;rE zw|_dmx3NZMXn!4|pXv2lJLJawpKGbSUH{Kv_i)DlbMkC=|Hqv?b^niDbr4)0VfCR2XGRj{Ku^2}+M?W_T zy2t5VX{Az3)ic_T<%n-sG-oVkih85hDt}dyTEMsayQi}im0g>Sird9Rf6Y&g|98d^ zCuBq!hwZhoF#p@p^BVs@IXc<#|2uj1&?Q!C1=Y9in3*@XjSeyrD;|VW9A4uQh)y2; zUEKR8#t_G76tjVeP9=1-k2u6w-SZz~Ob4YMZ8Leb*5;Y3sYr0AIJh>&PT+efR&g8IKc|33Pt;TC_ST wXZlXL4v7FCm~x!`z15kBkVSB?V;82oXZP%$NAUdr00030|C__oTL5GM0M45g!2kdN delta 11194 zcmV;rD@D||ShHA=JWgwK+c=hJf7Y+Sm1nDy9#fVdNp^KBHI=s0J-*X%TvocLrm}sr z5P2kFOadGLl%r1P*8Gs&KR3VR79J!)3e?-LM68*PMFIz}gY(8gk&P@L$1jeab&tE> zbPrFuN6)`O-7WT^@yUe5{G0B^ZPf>n*e8FDGHA#+`b#zdPCzRZ*%nslmJN z5$_)NsqOy>jx!KjCIIvI|6%vpitd+2<4!Q>?e0aWS&p&*x>O^6~Yz*p~r!uYfVFw>Fl3LWWF zoQg4%a@~%I5D2u@Gg)7q< zUUO0upqwc29Mo*bmR>0MD1lQPZ?u0}`AP*Lqmr{YUU$V>0{Dc4@G1;hMy2XW$N@{} zA;~j9d+4uYp!)B9WXmFK3JY{Y;usCUR*5tRp0cci`XG^HXozD0hz!+Bbc3mWnF&z8 zIbt`oquMKmV7N6M3TIe>z-SL$-~xamoS>Xo2Jl1S72sF70c*b`UVSy&P6Bn%TojG zGRD;DzlThW0mpKD$++yHqyKpR>_`=3qn}^`aSuIfA#}s|HK8LtTr)12q%DLZD)Om2 zjWgAU9|#xnuSAa3^jv^MXb<5DCb61PWCV*II)fq3V!7W`tNKATWGa8WrDtjuA#XI& zzx-{OZ~KUY#G2FK;gC=wr<%bTRP93yp=8{?N;zSi$mwZ}g}Bg5Bc?(^5`?BZLCA?D zA&y%JNfragX6f}b2Iv~5J=E4%&shwe>q012bR^M>)V8#NrK+}Sy8Zei5mMwIU^s+O z_E7tR^}{hlSq$x^;9Gy}N!5DadMm+3&2SJb<006Y^E309Bt$yWMFNSY&nMmP8`8?@ z_CGQZZmBTMdg!p5%v3wdYxy~LQ)@>Xw&rEaO^qFH*q9@Y-NtxYn!L}DE%o*;i9v!t z{!9xvhCWv5)e=PR_)aK-cVpDB|86m)SvbgUo9dLcPwZYbAa}S+r#*ZdiEGb5VPOr{{7V5MncV+u<1{%Rjj4UQa3z-P* zks%UFX4G<~k#+KUtp8T>1W<`Ejp|?2tm!V)B~v4j5@{A;ADs`89K#ghm;;Wc2-K!P zgd#i5omOja4_$x35IE2flzhl2D8Vpc9FS0Qj}%sHRI(zvQDU+Zvk4s`t+omUg2S+f z#!{xDcW_YUU=a(&fyClkC}uV!ql`n4vPfeDCKULAf){9DLCVPlOUPA_=|O96?j zSseFGhkEG!udO{4SR8BHstStfa$Aq9Z?p(AT{)g0_=ta#G=^SFIGJ@5WHK>Jx!RAf?))5u`DjLZs-fwjh+$`W-{z7{cp%?UY3V35jJU_E8!G z7NE4!UaN(WBFCYOQBdx~A=KiTx#hM}$U7n>fiN;8D0N?v=Yof{KIM2@pTCuE6ZS5TYeAfFD`pQ}v?2hX2BGZyi7PJwgQ z6r@_IZ1>PLK$dc_7KhDxUgRtjWcgSbc&r>)o)uO1?@r`ah9c}*{fd6 zfVDGbX1i+Ju|_N*|Kj-z_!AMPKpJNp$1}Z?%m^EQG=ZpvkXFC<;*v}$&nww?1s=t=naW`Nr228zu93qS;+?0Kz0FkJ=NcWK(6M?LyO1M&3>4#S1 zGp40~%U@2>kh28cj7c~)bqnw}SfD42=O(+Sh0V@0))c~yf!R^&01*pZ%!6Xip!MInR1Q}?e!C?b{2fB6q#5IbSDLL`z1$=7 zCt%`(-Y@~RQcF(8Ro+E2)`U=!WC;@FH$7&5Yy0K!kBsmfU&qskD`8PBw}T4Kg3rTY zjqQE%TOEn(?-%v_U2SQ6c4BMsh6oL&o8^YQZ^gvk_ruRC^H<#Qztk@FSIb07FA?_ zz~s2r1)o{o_FpmtRAjsi>(TWw2b3~mHUgFia5zRxj)8ZOwP>O@Klk4$@?-i6k#Urm zXc9cCksTuJ_?t0pz%m+nd)d5}D{Y;EZ5qdbS}HxpfY3k^*JGl{pTyTdb2Q9o1U#O) zgv2sS>kDcgmdms&gE*c2U`7y`=nd6>e+OJH&va&_fC|)CqXuABL^w3;H5@~Nd!>t> zzPddB<+xvYjjGdE!zm&VRy>h^TWnjcT?0{QVr3PDJ=IArV54%nnIiBd@32H{A2D7a zzGSKhhoF%noA4Xpl7QnM)Ph?sN;+?AWBXPO-zv4n3}DEsl`9~!GiHc^77Q$Z8P-ct z0gUu`XpZkXt_iqMvQ8F9id9X3D_#?_5hcGBur*0gjcWBu)?jKmhT_<`#`pD>PVf|Q z&{QR(4m=y9i{2__rzUQL3^K{MIEY{Zu?}p*JRB1Vq0BfO zDEU`+of?TfiS`N;%D0ui&TK<}^JoEb&I%|Q(jb+oYDO{3lCNI(-<1wBwHWo;ukmtG zE`gdbLWjW3B5LtRvw0e6BsJEmn3Oc7z}0M!5LsZl&}92m>lIoyOe5pcJg4XsClH@v z0k^&YYNkb?CU&_c$mRZ~B~afh=pTX5Qbah$9ETFP+Iyie8@AZK1=Fs7&DmgTDTH?- zJdW3p(GXH84)TynLkJ3;N$mM_i1N9zQctHk8-BW=CqyGr{cUYpET*Z+QG8A)?xDs1 zl3mn8E;&m&Ge8k~r;(08tP!0gNhWo)3m(dXVlvt($1ww=c_{j8llbi`TpML$U1#7m z;o1unp-Ug6MhV*rtfeM@(g4+&Zc9krNCG{xN~2K(M2IXgqVGT<-JGrpHJHNDgs||) zZv`E9R?qaH0q6j&_DvpSt`aHV`OyKqfQWL3)sxMtn-vK1i*ANJ7ucH_=(|GJ=NBPz_)Y*5e^P~LAnDx$_TGOOr&ih3q|(rWU(Y^ zTtYS-t~TK34vdz6wNl{PD{nmV9b;mt(Y=CTnSJfs7P#7OJu1xDIZF1ZR8&KlO=Oj? zlbJ*}`RrjKSV%NWEjx>drJe5lF1Pv)yc;6NW|9dAcl$nXomb z31Pd4P77LUuK?AnIsl+3!TfqghBDpG$GLAq{Q4EiV~9zAtRatpf;RLhBB=z$4tkxW z(zkL}#wKQkaU8Q78-67Vf>jfv&^%I9kcG9K!!Za~saIsYz1<3j4mqnC%e(fa)ws)ZAl)4r+ zBK#tn*R*y%^uR2s8i8mZ5m}IKQPOUI8)K}uj0dRR#O12TQ!}N;bTL=JnS$(~i?{Dy z`^fe?hVX=u2&GI2qSOTeVaAD^A|gZvVjqR`P}GP18gva0^H z1qkjI&9PZ7uqXP+u46rGFfi5)i|Cx9Xi9NHLL}-o<=L^I5DVCMsCdEEh9r(5Qu3*7 zv*?WHz+(AWP6?=;H}OFYu3gw?WX7pgdNr$SS9w(119NnBd5S_D#~t*8W|Usb-kecv z+D~bJV;b8(5h3%Qin(3QwFMIkfkc+3jH^8%wWu&lQjD?5kQEQ$g3c5xr)|(|)(M%> zYiiGBRv*LhjE&ciadVI#IA?qT*6T7ky2n^3N}%J$Bl{`JxVvJ-SoS>w)Sp4q}QYqyrrvSe)vA6BY*di}Ftus0cz5f!dwgB&|;ulvY?t zXa;D;c&l*<6OD;R9&%QrdM0&%1t?|EP=jfzS5HrjSM^Z%VvH5uy=PGT8X#53$~7&} zghfen4M15KW?baUP~FspIqBz=6^zO5DYJS_YH1;`$AH%`LnRMo0UTy-`Y$DN8I>R}eK=Wdo7 z))!#v`s{*$4nN)-hE$+^zEEy}$K0LZlP5P3BQ=V7Wgb9nHL?$bsRXgS4C(BD0}t5s zWXNJ4cpxt9lMPNnfN9+-V!LSt)A$<$p*C(#)VnU z99iFmM*5=!zsiuvuRauV7Xo=lA&^@QecWEi<2FMbzoZbyM;qEW0Etb1eB++6GPz;~ zS^m*;Nmms#!{5Qh-RM6taa%&GRPnYlMP78K}| zQDNC(3EW}bw!_RGa1<5qW)8IwL6yj_qtpaSu-*ds*xY_rnvK|9(%~qV_S$7 z+e&2E{cwrJUD$w0Y#Pz^g~xAgBU)=~xVT{?*5;VFag^1TVyZTcpxQKEY8M@~t>~!y zLI)>2%6TJkfb9NOL*-1B5Q42xEZUob!YVP3=LK(v?NtegPRiM=qC zvl3@<=Du1KadHL{c%of^xz^HTQOVU3Ip!=IRYPxmmeSIHG;QwdvKM*~DXjIz7p0&J zdO}w87s9BysG&Mu-zU$wA8s-(J70yfr@Z;Ya1iXVj=1JmZ6{HZu`pBY#8S+-d0yr1 zgbNPDD{du>FT+~)wbfY)V>Bdm))kQZ>O6qK1&ui%%4m5PQ=A}>Y7*H(jQ#uatr5NmOa_>U}WB}Ro2}_XWveAwn3mxLbNr6ZN+J?ql;`) z1KGNN-tjQCja@8wKBu>>QQQR$Uqx%!mY#4cn!z@7fiFV(f6(&&?wG?Pk?9}36u-Pb zX6J!<93B`$=kLG;xrRdX!4wy%mW}$Z0K4eL%IB&&i zUUr)z?bM&st<_G{t0^2=a7*ckV6K!hH=1;LOYtfiyFS9d1+~5L=>BQ{ zJm)Pr7TGWq9b)Sd)=JvG>fvxbmJLlTbJ7lIS-ToeUUYi^F{2}~Ns@$Sr`Gy?UM2{> zZd%V{;w@S&H>4{V>f2!FjA(_ym}7ODj%c%y=swID&PA=v=i@|=D*b~-h1Z(Ot3*9j|p=%s^&^E1ru1XTPPt6){mB%9Mg%-TdzlU)=w*+$X) z(08AW6fJKjovV0w#=JTqv8StDXO8i4Vg1n5g5ur+`eDc(PM3@h~ zDW~;zjO?lQ=JlB~uWKh7$xnt=%mhyuFE!Jro(?x`W5oDO`anfX{+U*h~zwL&d9hCXMIm-s-UwtInX^=UZsu$blfaY;RSK9q8v{j*x6 zp`5$esEmBOjVvWgPq1WQFmsHHGnc%0 zt)Z}?8HUHaVbLNI)2|iJiFl&^t{#WE88auWz%x(znQSfns}-@i+5Yv<|Neo*V0OX3 z{`o(O>ip}U|NVW;!s~zi^M963>|Ko*vBc4I?ptAc?3|IQuCNbcvF0^@WWW^RI2~h~ z3u6_szFy{-MVVomveJ46)tILiT@*Ps4FxXP0HLG(rlvhD*b}a~jIK`;=RR^RoJC|f z1f7{ffKIz-L~_Gfun(lj!tuU)NOqt&v<4D_PPib0+0(`Augev9w&a|gN>?zf(J!w# z%qJ+UVIZsL{pqI=b{3_74Rs%b$cf?Mb{31cC@-LIZFG!1QSQ^qNJKb<#;f5bOdNp8 zM&UgVxSFWDZ#tn9ZY^hjY?k^oc1Jd`jnmyRPE%N3I`KeWS6*o{w&hO+|6X05*F)j# zQhK$;g`8WDR9it8xBcz;&@{%&oR|d6QWUm3M5vH}qd8&{ML;Df;ZUrupypM4jHsOO2vHrQ5$ z+NN`bdDLYjWhagCfRoV({C7wot0w6@QBM^~CyFCGAgE3HQ?TfnPQO3;wXw(5`BHow zKB6O|qJI;iX6dQjkzz_E{-|0Cm9)_`vpQj%-pvyw2q@tM;yB24{~J72vyd;GO$&>; zoQthRs=&8rZ+oU^3ZX_c&y_VKiuRerVe>@`WXz(uk0cypIx6xO4l|i?STEJXtfe@A zJQm|R;kY-O>ym?`%jG-#*7dZ_9o)PeqHF?uLVw`q;D+&QLPvo@&A_HyI?(**U{C+E z_EZWjK&@_R;4`{%A9-`Cw4)Bf(R(Uo$r6^4-p^LI5HTh&GaHk(u7zAw!n z=x0hkdU+dV0z#&fH7bZeLl&9jq?jT?<@1vcdP{Zv{XAkUQG(NdMgHqh|M+j>-!A^k zPF;2XnLg7>tAZ$T{O~_sbc60;&^`1(?0cc;x+=5${h$eSB>RzCN3ajKh3 z&8n$7HQQs$tJc8bcQ<%`Q90P~!@j?>#*{oPXm^L_S9pi#vT5Gt20;5pWJ99Y%xwF?Zt^RqJFtXm-sd@!uRvmB2RQAjAqzuieF? zyAv@hpNQGwNtnle0%mve`uHq@ByHy~U!;M)_L|jICvGS@BfTBRY$; z%bH@IU22KPeWvI!pCY;^k#m<~XMf3)JsY3n*}|!vt(?(W;Y7|{IqnNSfV1&&o6Qf` zJn*A5+dDY(DsbolNb?}v1c_f}%KH;vfdN__V2KJG_*ANM1Tklr{Rdei9VhY{=iK(7)1^eI3< zBNTl8-1_E@o=}j$Z0CRu#eac>B-K$+2kHYIilDspqBF%wyiOb4ZnyjVggU>N@HYoZw4M6%=ay^O(?zc!27fG|Q=0HTe{OyH zga{4eECSS~L(z%x0AkTb9rU|4T~mpURJlCVibEQc5R0bP^Y5ky0%8bdu1+ObhU1@f z1NpwjX}WkELUJr&WP_#*QSsNwOTL??wr;+kY!8Y#Tw>hM4TKdsT8&6k)PxL+8YICZ zxXj|X4WJHCHU2B+!qCnZcqW2_(SE1IFF6vlY{p`Rpm>C$+$KlWcmhv~1xvNdm%=AzeLBE2cnuk>EmrV3fOlVe~)32?oi+}tXeM{e9A%Q!nqgn|# zi=lc0(LtgM7Tn5NK&SG8#!k)e%NSEwqRHH9oT~B-Ezg^Gcfu_7Saz;cP8cV0T826_ zpwUc07oEaPe_~X^M_DeJfKX{0mz)hrRd6%Z;wqy`|2{K8>2rrDSqw&Qb#|!pawP;S zeS@xyWT>~|?|)^$6K~m-9%FIIVMsor_CdS4{X3x`mt_q_YndRD@u^FxEIsL=wllw` z{s0TOf|Q}ppJ%?!gWX$HTH+D<{JCu=AQrG>f40}AJL#Gn@R6vS``f|f)1U%6APZ(WXqP)`dWq%U`_5gv8lHGWqiGsN1b1JpnqYPk=p&Vg^``mQgd^LrUsY|L+JEUe}jUu^$f$@UBi;l&vnz z#3sVcsGM0K&40|f8r6qd4^8h?zd!~hTSAVrPfI01opn~E6I-y>UGzJmb|W7iRXf~B zbC9*cy?>?g^olWAX5e+s#^g_kQ#>Fs@kWMome$_|=+#d@c}a$w>1R2T(JyOkon$n^ z_HJLd^!g-YOKmPkGPX=J)}siE3C}|!1MZABk%9GgtOI$@j-5wh<`5C}G*h6tWMDhH zJ0=sLAcT?%2C&TL&TCw%3ftY=b3o5-vufcrcYpS_T3lvdS2u7IwwscAHHr;(EM^Lf zrA&kTjMdASg*aAvSI;lrR(n1M9Lw<~gw$Nf!mx`NNab{`rU37iX7m&oAEjiW(cU!eX~K_FRxPVR@?Q9Ur8?6C$*s z+*8|7g|dhrQXcVTAV!2Y%!)0i>C+kEet%&0czM96If7tsU2XtrOTVS&*jTZ2O9@JL z`h9}Z51e^Ur)ejk_q>4{0Ip4i+MqIX$w1z+yQF?OEu-XP@8F<`fmJAMwL3#h;*7() zF$XbbanwW4D&G}T`w?V)44Sc_g2&aqriL>ZruJL?Bjd8k=CdqQ)YpXL_zYq^?SGrV zpdLD|I{7T8EYpUt3MCRbF=cc^i;Py15cghoXV++k3%ht!9l2pwMylWJS8-Y8Z3jnVx*cr!&oa z=M|DvPR|Ip$(X7&W+$pre6jz}e19Z#$ZpC1*X=&*cI*DXljqNO{=d6;f*`24`(~1n zSnuFz|J>#|n(GLxGW5c2ho!{f_^P<$D)+XVefAR>LO2a$eL+=`GVD@yN!SZzYJP|z zV0|(KC?3RcPGdst9anY>2k3P=h6K321m5*)%!Twr|3}WU)Np8Bd?=hZJ%6NR{0hMP zUcXJBh5KKL2y5?r^DOfJcb`44?*GFVN6&Wt|2ugc|38L=(LSu<{?|BiyN-X85vE^p z#VdwR=;&wtDQCP1{`fP+6HH>Yp=Y~U{hqUY>!))8t`k2{n~2-;{@0p$1b+WL#5fu0 z^M6X}3K^wFzO+Xz2Y?2gU4H}Bj!~9L7X}g_o#eB(9|@r5cUjl5UW@y18taDdB@)5k zm9?Dneo%Mj1mD@bzgU~MMx?LO+O0=^A9n7-O3fn3g-Q-1A|%I4d5cv=qh(y>)wXQM zUetic^6aUyuATc9TCZ=tIW{-=SWj1n@-uP199KpI@Gj+S;UKV(!ughlYu4@y&LxBObxxMvH=RFw{_O1d_g zhDIB(ucF@~+iYsm$+-%(&irf|hH3RLKY#!FgEl{3yn6Hc&J55?_&_|H;!f#rS-G;z z^Fg>p*QMp2kvCFw*MDbNHg_+6vZeiB3mDDL_1PqCp+$Z_BMyBX9>1M0?XG=kD+$}T z>_ywmhknca;{F|Y4fgNU)`vecA@%UzrZok;IueC5N|G>x2^p>5yzEW~$nYR9+nFib z3^J%+`ZX75Cz=`Q46$5|-LCE+^kT<)&Ox8VHqTr5mYc)F4}ZsLxyiUcSb1r>R9k3~ zJhlni&mYJFm6+6K#~J(|^*ny`Kd+6NFt4yen zSZBV#qDW7v)6il8ZW`)HaSAfXOtv73Fhw|341p6xBln!tvZ@OqOHxL47mMB!Ix=AM zgx8gx>5Lt=JF4Ujk>l1L`UO)G$8JXKeeG%qERY0WgMZMOhsqSXMOQkl?VQ;5E%fbp zaFNG>Ij{8@myoZpY0P#*wP*#oqUn=GjwT;eegBB-cXD3zmThV7QFULd+dIBKe^K|E zHYU1Z^jn<*JHhw{R9HP^!GjpXzRyxl$OhVD#v+hX+cHqJ$ag5+2$rF5I zu5a>q(SLb{^4w}Vor?w*V%3o$p;4t>k>47nlh%}5eWazCB1sHZKoUarZGTmhuUIN@ zpr7#(lv!Kqp#u>cUn1`wLvzi$Fby0D*N*zR!2V`-c6s9OYht zur9Ek`l@f$n!2!oS^KB2%2L+W+iiRcr#NfpDu0{KSZ{WQbH2gDKP9%t9B1)jBb#?a zHW=M*;dJADfVpT{RV{qHWGnlMmLiDR5yg#2C2(8YXmt%U0N!WmiSx&V++d;(|&Y9+&(7*aKUw{7J zjss|s|L4Vvct9(RW|QK71@4+4?+QJ8t!bH z%k!(VoZ>@Nd{u;56TK~~Iga_}4u7WfX~$B;H!PYn7c)h@ z(QB0|NiA;O{oT{qiprtQM#b$yyT9hAM*llwh!ZlRjKlWYSeXCqsGk4n^FrfAXJVLJvwn15+GcXQ{Sniq>}> zag(;b>kRO9>${Fj($;tXPn+>LVVOYZXRk%8lX9l-lJ0JysCy8r+H diff --git a/charts/v4.7.0/csi-driver-nfs/templates/csi-nfs-node.yaml b/charts/v4.7.0/csi-driver-nfs/templates/csi-nfs-node.yaml index cb42d57e..89778b4b 100644 --- a/charts/v4.7.0/csi-driver-nfs/templates/csi-nfs-node.yaml +++ b/charts/v4.7.0/csi-driver-nfs/templates/csi-nfs-node.yaml @@ -61,6 +61,9 @@ spec: resources: {{- toYaml .Values.node.resources.livenessProbe | nindent 12 }} securityContext: readOnlyRootFilesystem: true + capabilities: + drop: + - ALL - name: node-driver-registrar {{- if hasPrefix "/" .Values.image.nodeDriverRegistrar.repository }} image: "{{ .Values.image.baseRepo }}{{ .Values.image.nodeDriverRegistrar.repository }}:{{ .Values.image.nodeDriverRegistrar.tag }}" @@ -93,11 +96,17 @@ spec: - name: registration-dir mountPath: /registration resources: {{- toYaml .Values.node.resources.nodeDriverRegistrar | nindent 12 }} + securityContext: + capabilities: + drop: + - ALL - name: nfs securityContext: privileged: true capabilities: add: ["SYS_ADMIN"] + drop: + - ALL allowPrivilegeEscalation: true readOnlyRootFilesystem: true {{- if hasPrefix "/" .Values.image.nfs.repository }} diff --git a/deploy/csi-nfs-node.yaml b/deploy/csi-nfs-node.yaml index bcdc2999..acf66dd2 100644 --- a/deploy/csi-nfs-node.yaml +++ b/deploy/csi-nfs-node.yaml @@ -45,6 +45,10 @@ spec: requests: cpu: 10m memory: 20Mi + securityContext: + capabilities: + drop: + - ALL - name: node-driver-registrar image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.10.0 args: @@ -77,11 +81,17 @@ spec: requests: cpu: 10m memory: 20Mi + securityContext: + capabilities: + drop: + - ALL - name: nfs securityContext: privileged: true capabilities: add: ["SYS_ADMIN"] + drop: + - ALL allowPrivilegeEscalation: true image: gcr.io/k8s-staging-sig-storage/nfsplugin:canary args: diff --git a/deploy/v4.6.0/csi-nfs-node.yaml b/deploy/v4.6.0/csi-nfs-node.yaml index 63b00809..519ac3d1 100644 --- a/deploy/v4.6.0/csi-nfs-node.yaml +++ b/deploy/v4.6.0/csi-nfs-node.yaml @@ -45,6 +45,10 @@ spec: requests: cpu: 10m memory: 20Mi + securityContext: + capabilities: + drop: + - ALL - name: node-driver-registrar image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.10.0 args: @@ -77,11 +81,17 @@ spec: requests: cpu: 10m memory: 20Mi + securityContext: + capabilities: + drop: + - ALL - name: nfs securityContext: privileged: true capabilities: add: ["SYS_ADMIN"] + drop: + - ALL allowPrivilegeEscalation: true image: registry.k8s.io/sig-storage/nfsplugin:v4.6.0 args: diff --git a/deploy/v4.7.0/csi-nfs-node.yaml b/deploy/v4.7.0/csi-nfs-node.yaml index 22aadb38..c4b8926f 100644 --- a/deploy/v4.7.0/csi-nfs-node.yaml +++ b/deploy/v4.7.0/csi-nfs-node.yaml @@ -45,6 +45,10 @@ spec: requests: cpu: 10m memory: 20Mi + securityContext: + capabilities: + drop: + - ALL - name: node-driver-registrar image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.10.0 args: @@ -77,11 +81,17 @@ spec: requests: cpu: 10m memory: 20Mi + securityContext: + capabilities: + drop: + - ALL - name: nfs securityContext: privileged: true capabilities: add: ["SYS_ADMIN"] + drop: + - ALL allowPrivilegeEscalation: true image: registry.k8s.io/sig-storage/nfsplugin:v4.7.0 args: